helm icon indicating copy to clipboard operation
helm copied to clipboard

remove /proc/sysrq-trigger mount, default host namespaces true

Open philgebhardt opened this issue 1 year ago • 0 comments

Background

  • Gremlin currently allows a host shutdown in two different ways: using a /proc/sysrq-trigger, and issuing a shutdown from the host's PID namespace. Only the latter is documented, and the former performs a non-graceful shutdown (which isn't documented in Gremlin).
  • At the same time, hostPID=true has become a requirement for all container drivers except for the legacy docker driver. It makes sense to flip this to true to minimize issues at install time resulting from incorrect arguments.
    • hostNetwork is in the same situation, though unrelated to shutdown attacks.

Change

  • Remove mount of /proc/sysrq-trigger which disables this functionality in Gremlin
  • default hostPID=true to enable host attacks without sysrq
  • while we're at it, default hostNetwork=true as well, since it is required for reliability management features.

philgebhardt avatar Feb 07 '24 01:02 philgebhardt