{"action":"created","issue":{"url":"https://api.github.com/repos/commercialhaskell/stack/issues/260","labels_url":"https://api.github.com/repos/commercialhaskell/stack/issues/260/labels{/name}","comments_url":"https://api.github.com/repos/commercialhaskell/stack/issues/260/comments","events_url":"https://api.github.com/repos/commercialhaskell/stack/issues/260/events","html_url":"https://github.com/commercialhaskell/stack/issues/260","id":86980350,"number":260,"title":"Improve security of docker options in stack.yaml","user":{"login":"manny-fp","id":2164261,"avatar_url":"https://avatars.githubusercontent.com/u/2164261?v=3","gravatar_id":"","url":"https://api.github.com/users/manny-fp","html_url":"https://github.com/manny-fp","followers_url":"https://api.github.com/users/manny-fp/followers","following_url":"https://api.github.com/users/manny-fp/following{/other_user}","gists_url":"https://api.github.com/users/manny-fp/gists{/gist_id}","starred_url":"https://api.github.com/users/manny-fp/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/manny-fp/subscriptions","organizations_url":"https://api.github.com/users/manny-fp/orgs","repos_url":"https://api.github.com/users/manny-fp/repos","events_url":"https://api.github.com/users/manny-fp/events{/privacy}","received_events_url":"https://api.github.com/users/manny-fp/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/commercialhaskell/stack/labels/enhancement","name":"enhancement","color":"84b6eb"}],"state":"open","locked":false,"assignee":{"login":"manny-fp","id":2164261,"avatar_url":"https://avatars.githubusercontent.com/u/2164261?v=3","gravatar_id":"","url":"https://api.github.com/users/manny-fp","html_url":"https://github.com/manny-fp","followers_url":"https://api.github.com/users/manny-fp/followers","following_url":"https://api.github.com/users/manny-fp/following{/other_user}","gists_url":"https://api.github.com/users/manny-fp/gists{/gist_id}","starred_url":"https://api.github.com/users/manny-fp/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/manny-fp/subscriptions","organizations_url":"https://api.github.com/users/manny-fp/orgs","repos_url":"https://api.github.com/users/manny-fp/repos","events_url":"https://api.github.com/users/manny-fp/events{/privacy}","received_events_url":"https://api.github.com/users/manny-fp/received_events","type":"User","site_admin":false},"milestone":null,"comments":1,"created_at":"2015-06-10T13:57:49Z","updated_at":"2015-06-10T14:54:54Z","closed_at":null,"body":"Currently, if a user has `docker` installed and set up so their user can run it without `sudo`, it's possible to craft a stack.yaml that runs arbitrary commands as root.  This is due to well-known security weaknesses with Docker and basically any arbitrary code you run on your system (like, say, downloading an executable or shell script, or building a Haskell package that uses TemplateHaskell) could also take advantage of it), so this is far from unique to stack.\r\n\r\nThat said, I'd like to at least close the hole with stack.yaml, so that if you're doing your builds in a Docker container security is improved.  I propose to disallow the following settings in the project's stack.yaml (but still allow them in global/user stack.yamls and from the command-line).\r\n\r\n- `run-args`\r\n- `mount`\r\n- `pass-host`\r\n- `database-path`\r\n- `auto-pull`\r\n\r\nWe'll also need to document that users should only pull Docker images from trusted sources.  Anyone could craft a malicious image and point the `repo` setting to it, but I don't think we want to be in the business of whitelisting images.\r\n\r\nI also considered using the `docker run -u` option to always start containers as a non-root user, but anyone could still craft an image that has an entrypoint which `sudo`s to root, so that doesn't end up helping very much.\r\n"},"comment":{"url":"https://api.github.com/repos/commercialhaskell/stack/issues/comments/110784026","html_url":"https://github.com/commercialhaskell/stack/issues/260#issuecomment-110784026","issue_url":"https://api.github.com/repos/commercialhaskell/stack/issues/260","id":110784026,"user":{"login":"gregwebs","id":1183,"avatar_url":"https://avatars.githubusercontent.com/u/1183?v=3","gravatar_id":"","url":"https://api.github.com/users/gregwebs","html_url":"https://github.com/gregwebs","followers_url":"https://api.github.com/users/gregwebs/followers","following_url":"https://api.github.com/users/gregwebs/following{/other_user}","gists_url":"https://api.github.com/users/gregwebs/gists{/gist_id}","starred_url":"https://api.github.com/users/gregwebs/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/gregwebs/subscriptions","organizations_url":"https://api.github.com/users/gregwebs/orgs","repos_url":"https://api.github.com/users/gregwebs/repos","events_url":"https://api.github.com/users/gregwebs/events{/privacy}","received_events_url":"https://api.github.com/users/gregwebs/received_events","type":"User","site_admin":false},"created_at":"2015-06-10T14:54:54Z","updated_at":"2015-06-10T14:54:54Z","body":"More concretely, the attack scenario is: I clone a project because I want to patch a library, so I start by running `stack build`. Generally build systems have escape hatches to execute arbitrary code, but it is limited to the user's permission. If I have docker installed, the build process could escalate its privileges to root!\r\n\r\nI think this is getting at a larger problem for library authors; there is a `stack.yaml` that you would check in and *distribute*, and there are `stack.yaml` settings that you only want to develop with. Probably STACK_ROOT is meant to solve this, but in this case it cannot solve a security issue.\r\n\r\nI think it is better to not allow enabling docker from `stack.yaml` because it does not make sense to *distribute* that setting to other people. Enabling docker should be done some other way. Obviously env variables and cli options can be used, but eventually I may want to write that setting down and have it be automatically used. The approach we could take is to have a list of docker enabled projects in ~/.stack\r\n"}}