Privileged Container Escapes with Kernel Modules

This page cannot be shown here. You can still read it on the original site — the toolbar below keeps your place in the directory.

In all the playing around I’ve been doing with Linux kernel modules, I decided to see what would happen if you tried to load one from a Docker container. It turns out that privileged containers (or just those with CAP_SYS_MODULE) are able to use the sys_init_module() and sys_finit_module() syscalls - which are what’s used to load kernel modules. As all containers share their kernel…

Read on /posts/docker_escape/ ↗