| > I don't think it's up for debate that this is much worse than just running Traefik as a normal user I'm not arguing that there's not a better option. In fact, when I say this is a "defense in depth" issue, that's exactly what I mean. It would improve security. It would be better. But there is no active vulnerability to be exploited. If the system works as intended, this doesn't cause any issues, it's only an issue if there are other real vulnerabilities. > Do you also run your other web servers as root? Yes, because capsh --cap-add NET_ADMIn is poorly understood and poorly used I run many other servers as root. Admittedly, many of them are written in other languages such as C and fork workers that drop privileges because the c stdlib (libc) supports that easily. Traefik is written in go where forking workers that drop privileges is much harder. Go doesn't use libc, and setuid doesn't actually work correctly [0], so of course it doesn't drop privileges like other software written in better languages. > This is completely irrelevant. Once a hacker is inside the Traefik process (i.e. can execute code under Traefik's PID) That's the entire point. It requires an attacker to exploit a real security issue, therefore this hardening you're talking about is a defense in depth. The way you're talking about it, you make it sound like there's an active vulnerability, not just a defense in depth improvement. They're vastly different. The developers are not ignoring a real vulnerability, and your all-or-nothing stance on this issue is un-nuanced to the point of harming your communication about it. My previous offer is still on: $500 bucks that you can't exploit this if I link you to a traefik configured in this way you refuse to run it. [0]: https://github.com/golang/go/issues/1435 |
> The way you're talking about it, you make it sound like there's an active vulnerability, not just a defense in depth improvement. They're vastly different.
Please note that I never termed it a vulnerability (whether active or not). I merely called it a security issue – which it was/is because it gives users a false sense of security. I also made that point very clear in my post on Github.
> My previous offer is still on: $500 bucks that you can't exploit this if I link you to a traefik configured in this way you refuse to run it.
Being able to recognize and avoid potential security holes and being able to exploit them in practice are two different things. I think I'm fairly good at the former (in the sense that I'm able to avoid the most common pitfalls) but I have only limited experience with the latter. And while I am aware that in-depth hacking expertise would be very valuable even when examining certain security practices (it's definitely on my to-do list), I don't think it is required to point out basic flaws and potential attack vectors. So as much as I appreciate your offer, I don't think me being or not being able to hack your system implies anything with regards to how secure Traefik is.