Audit finding: Insecure configuration for running Acala node in a Docker container
Project: Acala
Auditor: Trail of Bits
Impact: Low
Likelihood: Difficulty-High
Vulnerability class (audit): Configuration
Vulnerability class (Scout): TBD

1. Insecure configuration for running Acala node in a Docker container\nSeverity: Low\nDifficulty: High\nType: Configuration\nFinding ID: TOB-ACA-001\nTarget: documentation for running node in a Docker container\n\nDescription\nThe Acala documentation describes how to launch an Acala node in a Docker container, from the acala/acala-node docker images. While those images run the node process as a non-root user, the documented way to run them does not prevent the user to gain more privileges. This may allow an attacker who gets code execution access within the container to escalate their privileges in certain scenarios.\n\nThe first docker invocation can be found at the integration-guide/node-management documentation page:\n\ndocker run -p 9944:9944 acala/acala-node:0.6.2 --name \"calling_home_from_a_docker_container\" --rpc-external --ws-external\n\nWhile the second at the network-maintainers/mandala-maintainers-guide page:\n\ndocker run -d --restart=always -p 30333:30333 -p 9933:9933 -p 9944:9944 -v node-data:/acala/data acala/acala-node:latest --chain mandala --base-path=/acala/data/01-001 --ws-port 9944 --rpc-port 9933 --port 30333 --ws-external --rpc-external --ws-max-connections 1000 --rpc-cors=all --unsafe-ws-external --unsafe-rpc-external --pruning=archive --name \"Name of Telemetry\"\n\nBoth of those invocations do not set the \"No New Privileges\" flag and do not drop all Linux capabilities. Those features prevent the user from gaining more privileges through e.g. suid binaries and from gaining more Linux capabilities. The current value of those settings can be inspected by reading the /proc/$PID/status file as shown in Figures 1.1 and 1.2, where the second figure shows those settings with security flags applied to the docker run invocation.\n\n$ docker run --rm -it --entrypoint bash acala/acala-node:latest acala@d7720fb273ce:/$ cat /proc/$$/status | egrep 'Cap|NoNewPrivs|Seccomp'\nCapInh: 00000000a80425fb\nCapPrm: 0000000000000000\nCapEff: 0000000000000000\nCapBnd: 00000000a80425fb\nCapAmb: 0000000000000000\nNoNewPrivs: 0\nSeccomp: 2\n\nFigure 1.1: Inspecting the parent process (here: bash) Linux capabilities sets, the \"No New Privileges\" flag and its Seccomp status. While the process has no effective Linux capabilities (CapEff) currently, it may gain them through e.g. suid binaries.\n\n$ docker run --rm -it --cap-drop=ALL --security-opt=no-new-privileges:true --entrypoint bash acala/acala-node:latest acala@aeec10d88e66:/$ cat /proc/$$/status | egrep 'Cap|NoNewPrivs|Seccomp'\nCapInh: 0000000000000000\nCapPrm: 0000000000000000\nCapEff: 0000000000000000\nCapBnd: 0000000000000000\nCapAmb: 0000000000000000\nNoNewPrivs: 1\nSeccomp: 2\n\nFigure 1.2: Inspecting the process status after passing in docker run flags which drops all Linux capabilities and sets the \"No New Privileges\" flag.\n\nExploit Scenario\nAlice runs an Acala node in a Docker container. Eve finds a bug that allows her to run arbitrary code on Alice's node. She then uses the bug and runs a suid binary to gain more privileges in the container to attack the host system.\n\nCurrently, the only suid binaries present in the acala/acala-node:latest (93c46b70e208) image are /bin/mount, /bin/umount, /bin/su and /usr/lib/openssh/ssh-keysign. Analyzing these binaries was outside the scope of this assessment.\n\nRecommendations\nShort term, add the \"--cap-drop=ALL --security-opt=no-new-privileges:true\" flags to all docker run invocations listed in the Acala documentation for running a node in a Docker container. This will increase the security of containers run by the users.\n\nLong term, consider using a multi-stage Docker image build for Acala docker image and adding only the necessary binaries to the resulting image. This will decrease the attack surface for an attacker who gains code execution in the container and should also result in smaller Docker images. Additionally, review the Appendix C: Docker Recommendations for further Docker guidance.

Summary: Docker containers are not configured with the 'No New Privileges' flag or dropped Linux capabilities, allowing privilege escalation.