• 👉 Overview
• 👀 What ?
• 🧐 Why ?
• ⛏️ How ?
• ⏳ When ?
• ⚙️ Technical Explanations
• Overview
• Key Concepts
• Privilege Escalation Risks in LXD/LXC
• Root Access Inside Containers
• Mitigation Strategies
• Example Scenario: Privilege Escalation via LXD Group User
• Step-by-Step Example
• Mitigation Measures
• Conclusion
• 🖇️ References

👉 Overview

👀 What ?

LXD/LXC Group - Privilege escalation is a method where a user gains elevated access to resources that are normally protected from an application or user. In the context of LXD (Linux container daemon) and LXC (Linux Containers), it involves manipulating the containerized environment to gain root access to the host system.

🧐 Why ?

Understanding privilege escalation, particularly in relation to LXD/LXC, is crucial because it poses a significant security risk. If an attacker successfully performs a privilege escalation, they can take control of the entire system, access sensitive data, disrupt services, and perform unauthorized actions. It is therefore important for any system administrator or security professional to comprehend this topic in order to better protect their systems.

⛏️ How ?

Privilege escalation in LXD/LXC can be achieved through various means. One common method is by exploiting misconfigurations in the LXC/LXD setup, such as granting non-root users too many capabilities. Another way is by exploiting vulnerabilities within the host kernel or the LXC/LXD software itself. To protect against privilege escalation attacks, it's important to regularly update and patch your systems, restrict capabilities of non-root users, and follow other best practices for securing LXD/LXC.

⏳ When ?

The use and practice of LXD/LXC began with the project's inception in 2014. Since then, the technology has been widely adopted due to its lightweight nature and ease of use. However, as with any technology, it also introduced new attack vectors for malicious actors, including the risk of privilege escalation.

⚙️ Technical Explanations

Overview

LXD (Linux Container Daemon) and LXC (Linux Containers) provide operating-system level virtualization by creating isolated environments, known as containers, on a host system. Each container runs its own independent operating system, leveraging Linux kernel features such as namespaces and control groups (cgroups) to achieve this isolation. However, the shared kernel model presents potential security risks, particularly privilege escalation.

Key Concepts

1. Namespaces: Ensure isolation of system resources (like process IDs, user IDs, network interfaces) among containers.
2. cgroups: Control and limit the resource usage (CPU, memory, disk I/O) of containerized processes.

Privilege Escalation Risks in LXD/LXC

Root Access Inside Containers

If an attacker gains root access within a container, they could potentially escalate privileges to gain root access on the host system. This can be done through:

1. Kernel Exploits: Exploiting vulnerabilities in the shared kernel.
2. Misconfigurations: Leveraging improperly set permissions or insecure defaults.
3. Abusing Capabilities: Exploiting special privileges granted to processes.

Mitigation Strategies

1. Restrict Capabilities: Limit the capabilities granted to containers.
2. Regular Updates: Keep both the host and container operating systems updated to patch vulnerabilities.
3. Monitor Activity: Actively monitor for suspicious activities indicating a breach.

Example Scenario: Privilege Escalation via LXD Group User

Step-by-Step Example

1. Setup LXD Group User

Add a non-root user (bob) to the lxd group, allowing them to interact with the LXD daemon and create containers.

sudo usermod -a -G lxd bob

1. Create a New Container

The user bob can create a new LXD container:

lxc launch ubuntu:18.04 my-container

1. Mount Host Filesystem Inside the Container

bob can mount the host filesystem inside the container, which can lead to privilege escalation if not properly restricted:

lxc config device add my-container host-root disk source=/ path=/mnt/root recursive=true

This maps the host's root directory to /mnt/root inside the container.

1. Gain Root Access to Host System

Inside the container, bob can now navigate to /mnt/root and modify files as if they were on the host system. For example, adding their SSH key to the root user's authorized keys:

echo "ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQE..." >> /mnt/root/root/.ssh/authorized_keys

This allows bob to SSH into the host system as root, effectively escalating their privileges.

Mitigation Measures

1. Restrict Device Addition

Prevent non-root users from adding devices to LXD containers, which can be done by setting appropriate LXD profiles and permissions.

1. Secure Configuration

Ensure the lxd group has minimal necessary privileges and regularly audit group memberships and capabilities.

1. Patching and Updates

Regularly update the host and container images to ensure all security patches are applied, reducing the risk of kernel exploits.

1. Active Monitoring

Implement monitoring tools to detect unusual activities, such as unexpected changes in container configurations or filesystem accesses.

Conclusion

While LXD/LXC provides powerful containerization capabilities, it also introduces potential security risks, particularly related to privilege escalation. Understanding and mitigating these risks is critical for system administrators and security professionals. By implementing best practices such as restricting capabilities, keeping systems updated, and monitoring activities, the security of LXD/LXC deployments can be significantly enhanced. This approach ensures the effective and secure use of container technologies in various environments.

🖇️ References