CSCfi / CSCfi/HPCS

Spire Agent doesn't support cgroupsv2 for docker workload attestor plugin

Open
#5 2 comments 0 reactions 0 assignees View on GitHub
Dominant language
Python
Stars
8
Forks
0
PR merge metrics
No merged PRs in 30d

Description

Client's attestation isn't a security concern but more of a practical concern since a client cannot retrieve anything from the vault (write only policies).

Still, attesting clients' workloads makes harder for a user to spoof it's client identity. In order to do that, we currently leverage spire docker plugin, which provides a good way of making sure that the workload running runs inside of one of the HPCS-provided images.

This docker plugin makes usage of cgroupsv1 `/proc/PID/cgroups` which provides informations about the container, etc.
This behaviour has been modified in cgroupsv2 and this file doesn't provide anymore the needed informations. This way, docker plugin's functions are broken.

see : https://github.com/spiffe/spire/issues/4682
and : https://github.com/spiffe/spire/pull/4251

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.