Skip to content

Numeric user id passed to --user interpreted as user name if user name is numeric in container /etc/passwd #21436

Description

@jordmoz

Output of docker version:

Client:
 Version:      1.10.3
 API version:  1.22
 Go version:   go1.5.3
 Git commit:   20f81dd
 Built:        Thu Mar 10 15:54:52 2016
 OS/Arch:      linux/amd64

Server:
 Version:      1.10.3
 API version:  1.22
 Go version:   go1.5.3
 Git commit:   20f81dd
 Built:        Thu Mar 10 15:54:52 2016
 OS/Arch:      linux/amd64

Output of docker info:

Containers: 1
 Running: 1
 Paused: 0
 Stopped: 0
Images: 1
Server Version: 1.10.3
Storage Driver: devicemapper
 Pool Name: docker-8:1-262861-pool
 Pool Blocksize: 65.54 kB
 Base Device Size: 10.74 GB
 Backing Filesystem: ext4
 Data file: /dev/loop0
 Metadata file: /dev/loop1
 Data Space Used: 543.9 MB
 Data Space Total: 107.4 GB
 Data Space Available: 39.82 GB
 Metadata Space Used: 1.016 MB
 Metadata Space Total: 2.147 GB
 Metadata Space Available: 2.146 GB
 Udev Sync Supported: true
 Deferred Removal Enabled: false
 Deferred Deletion Enabled: false
 Deferred Deleted Device Count: 0
 Data loop file: /var/lib/docker/devicemapper/devicemapper/data
 WARNING: Usage of loopback devices is strongly discouraged for production use. Either use `--storage-opt dm.thinpooldev` or use `--storage-opt dm.no_warn_on_loop_devices=true` to suppress this warning.
 Metadata loop file: /var/lib/docker/devicemapper/devicemapper/metadata
 Library Version: 1.02.77 (2012-10-15)
Execution Driver: native-0.2
Logging Driver: json-file
Plugins: 
 Volume: local
 Network: bridge null host
Kernel Version: 3.13.0-83-generic
Operating System: Ubuntu 14.04.4 LTS
OSType: linux
Architecture: x86_64
CPUs: 4
Total Memory: 3.86 GiB
Name: jorddev
ID: OL4I:WFOH:3OGA:45VZ:YXHK:A2ME:WYJH:V3WJ:7UOV:AEGY:VJDI:X2JL
WARNING: No swap limit support

Additional environment details (AWS, VirtualBox, physical, etc.):
Running under VirtualBox through Vagrant.

Steps to reproduce the issue:

  1. On docker host:
    vagrant@jorddev:~$ docker run --rm -it ubuntu:latest /bin/bash
  2. In the just-started container:
    root@fb5fa3be8269:/# echo '31337:x:0:0:root:/root:/bin/bash' >> /etc/passwd
  3. In another terminal on the same docker host:
    vagrant@jorddev:~$ sudo docker exec -it --user 31337 sad_jones /bin/bash

Describe the results you received:

root@fb5fa3be8269:/# id
uid=0(root) gid=0(root) groups=0(root)

Describe the results you expected:
It should show my user id as 31337, not 0.

Additional information you deem important (e.g. issue happens only occasionally):

This could let image creators create malicious images which when run with a specific user id grant root in the container, and thus root to any mounted volumes.

Metadata

Metadata

Assignees

No one assigned

    Labels

    area/runtimeRuntimekind/bugBugs are bugs. The cause may or may not be known at triage time so debugging may be needed.priority/P2Normal priority: default priority applied.version/1.10

    Type

    No type

    Projects

    No projects

    Milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions