Docker: --ipc=host and security

Question

So in order to get MIT-SHM working between application running inside docker container and x11 running on the host, I have to pass --ipc host during starting the container. I've read the documentation about what it's supposed to do.

Assuming the application is NOT running as root (inside the container), what possible attack vectors does this open? In other words, how much does the --ipc host compromise the security?

Answer 1

In terms of attack surface --ipc=host removes a layer of security and creates new attack vectors as any application running on the host that misbehaves when presented with malicious data in shared memory segments can become a potential attack vector.

Performance-sensitive programs use shared memory to store and exchange volatile data (x11 frame buffers are one example). In your case the non-root user in the container has access to the x11 server shared memory.

Running as non-root inside the container should somewhat limit unauthorized access, assuming correct permissions are set on all shared objects. Nonetheless if an attacker gained root privileges inside your container they would have access to all shared objects owned by root (some objects might still be restricted by the IPC_OWNER capability which is not enabled by default).

You may ask yourself for each application on the host :

• What are the odds of a compromise from maliciously crafted shared memory segments?

• What are the consequences of a compromise? Is the application confined in any way?