5.15 Ensure the host's process namespace is not shared

Information

Process ID (PID) namespaces isolate the process ID number space, meaning that processes in different PID namespaces can have the same PID. This is process level isolation between containers and the host.
Rationale:
PID namespace provides separation of processes. The PID Namespace removes the view of the system processes, and allows process ids to be reused including PID 1. If the host's PID namespace is shared with the container, it would basically allow processes within the container to see all of the processes on the host system. This breaks the benefit of process level isolation between the host and the containers. Someone having access to the container can eventually know all the processes running on the host system and can even kill the host system processes from within the container. This can be catastrophic. Hence, do not share the host's process namespace with the containers.

Solution

Do not start a container with --pid=host argument.
For example, do not start a container as below:
docker run --interactive --tty --pid=host centos /bin/bash
Impact:
Container processes cannot see the processes on the host system. In certain cases, you want your container to share the host's process namespace. For example, you could build a container with debugging tools like strace or gdb, but want to use these tools when debugging processes within the container. If this is desired, then share only one (or needed) host process by using the -p switch.
For example,
docker run --pid=host rhel7 strace -p 1234
Default Value:
By default, all containers have the PID namespace enabled and the host's process namespace is not shared with the containers.

See Also

https://workbench.cisecurity.org/files/1726

Item Details

Category: SYSTEM AND COMMUNICATIONS PROTECTION

References: 800-53|SC-39, CSCv6|18

Plugin: Unix

Control ID: 1166c1f24e7272334ff64e013524d66c9019fc7ecd81c07370a9d7a3a40a1979