https://bugzilla.redhat.com/show_bug.cgi?id=1119282

--- Comment #2 from Marek Goldmann mgoldman@redhat.com --- In my case the issue is with docker-io-1.0.0-6.fc20.x86_64 package.

https://bugzilla.redhat.com/show_bug.cgi?id=1119282

Phil beaaegicfqmq6rykaqaakty3lqcg6btv@protected32.unixadm.org changed:

What |Removed |Added ---------------------------------------------------------------------------- CC| |beaaegicfqmq6rykaqaakty3lqc | |g6btv@protected32.unixadm.o | |rg

--- Comment #4 from Phil beaaegicfqmq6rykaqaakty3lqcg6btv@protected32.unixadm.org --- docker-io changelog shows:

* Tue Jun 24 2014 Lokesh Mandvekar lsm5@fedoraproject.org - 1.0.0-4 - Set mode,user,group in docker.socket file

file /usr/lib/systemd/system/docker.socket: SocketUser=root SocketGroup=docker

On startup, this is what systemd tells us:

systemd[1]: [/usr/lib/systemd/system/docker.socket:7] Unknown lvalue 'SocketUser' in section 'Socket' systemd[1]: [/usr/lib/systemd/system/docker.socket:8] Unknown lvalue 'SocketGroup' in section 'Socket'

Looks like Lokesh added a systemd feature that isn't available in F20 yet: https://github.com/systemd/systemd/commit/3900e5fdff688dc3c273f177d9d913b738...

https://bugzilla.redhat.com/show_bug.cgi?id=1119282

--- Comment #6 from Phil beaaegicfqmq6rykaqaakty3lqcg6btv@protected32.unixadm.org --- Hi Lokesh,

SocketUser and SocketGroup came with systemd 214. F20 ships 208.

Let's see what happens next :)

https://bugzilla.redhat.com/show_bug.cgi?id=1119282

Lars Kellogg-Stedman lars@redhat.com changed:

What |Removed |Added ---------------------------------------------------------------------------- CC| |lars@redhat.com

--- Comment #8 from Lars Kellogg-Stedman lars@redhat.com --- Note that you can work around this issue in Fedora 20 like this:

systemctl stop docker.socket systemctl disable docker.socket systemctl disable docker

cat > /etc/systemd/system/docker.service <<EOF [Unit] Description=Docker Application Container Engine Documentation=http://docs.docker.io After=network.target

[Service] Type=notify EnvironmentFile=-/etc/sysconfig/docker ExecStart=/usr/bin/docker -d --selinux-enabled --dns 172.17.42.1 Restart=on-failure LimitNOFILE=1048576 LimitNPROC=1048576

[Install] WantedBy=multi-user.target EOF

systemctl enable docker systemctl start docker

This disable socket activation for docker, which means that systemd is no longer responsible for creating the docker socket. The docker daemon itself will create the socket, and will create it owned by the "docker" group (or any other group you specify in the --group command line option).

This change will persist after a reboot (unlike manually chmod'ing the socket created by systemd).

https://bugzilla.redhat.com/show_bug.cgi?id=1119282

--- Comment #9 from Fedora Update System updates@fedoraproject.org --- systemd-208-20.fc20 has been submitted as an update for Fedora 20. https://admin.fedoraproject.org/updates/systemd-208-20.fc20

https://bugzilla.redhat.com/show_bug.cgi?id=1119282

Fedora Update System updates@fedoraproject.org changed:

What |Removed |Added ---------------------------------------------------------------------------- Status|ON_QA |CLOSED Fixed In Version| |systemd-208-20.fc20 Resolution|--- |ERRATA Last Closed| |2014-07-21 23:30:31

--- Comment #11 from Fedora Update System updates@fedoraproject.org --- systemd-208-20.fc20 has been pushed to the Fedora 20 stable repository. If problems still persist, please make note of it in this bug report.

https://bugzilla.redhat.com/show_bug.cgi?id=1119282

--- Comment #13 from Lokesh Mandvekar lsm5@fedoraproject.org --- Hi Peter, looks like the systemd folks only pushed it for f20, I could push the non-socket-activation version for f19 which would take care of this bug.

Also just fyi, f21 might be out soon (still few days to go I think), making f19 end-of-life.

https://bugzilla.redhat.com/show_bug.cgi?id=1119282

--- Comment #15 from Zbigniew Jędrzejewski-Szmek zbyszek@in.waw.pl --- It seems that the patch is easy to backport from F20 to F19, so I'll release a patched systemd-204 for F19 too.

https://bugzilla.redhat.com/show_bug.cgi?id=1119282

--- Comment #17 from Lokesh Mandvekar lsm5@fedoraproject.org --- (In reply to Zbigniew Jędrzejewski-Szmek from comment #15)

It seems that the patch is easy to backport from F20 to F19, so I'll release a patched systemd-204 for F19 too.

coool, thanks so much :)

https://bugzilla.redhat.com/show_bug.cgi?id=1119282

--- Comment #19 from Fedora Update System updates@fedoraproject.org --- systemd-204-20.fc19 has been submitted as an update for Fedora 19. https://admin.fedoraproject.org/updates/systemd-204-20.fc19

https://bugzilla.redhat.com/show_bug.cgi?id=1119282

Fedora Update System updates@fedoraproject.org changed:

What |Removed |Added ---------------------------------------------------------------------------- Fixed In Version|systemd-208-20.fc20 |systemd-204-20.fc19

--- Comment #21 from Fedora Update System updates@fedoraproject.org --- systemd-204-20.fc19 has been pushed to the Fedora 19 stable repository. If problems still persist, please make note of it in this bug report.

https://bugzilla.redhat.com/show_bug.cgi?id=1119282

Lars Kellogg-Stedman lars@redhat.com changed:

What |Removed |Added ---------------------------------------------------------------------------- Flags|needinfo? |

--- Comment #23 from Lars Kellogg-Stedman lars@redhat.com --- hallajs: it was an intentional configuration change that running "docker" requires root privileges, because having docker access effectively gives you root on the system. Because this is a security issue, the default configuration is unlikely to change.

If you don't have these particular concerns in your own environment, you can simply configure your system to have a `docker` group, make sure you're a member of that group, and make sure the `docker` daemon is configured to use that group when it creates the socket.

https://bugzilla.redhat.com/show_bug.cgi?id=1119282

--- Comment #25 from Lars Kellogg-Stedman lars@redhat.com --- Yajo: While true, that's because sudo's primary purpose is privilege escalation. That is *not* the primary purpose of Docker, and it is highly likely that the privilege-escalating aspects of Docker are not necessarily obvious to everyone using it.

Anyway, I was just stating my understanding of why the changes were made. If folks want to see a change in this behavior, it would probably be better to open a new bz for that specific request rather that continuing discussion on this one that was closed last year.

https://bugzilla.redhat.com/show_bug.cgi?id=1119282

Stef Walter stefw@redhat.com changed:

What |Removed |Added ---------------------------------------------------------------------------- CC| |stefw@redhat.com

--- Comment #27 from Stef Walter stefw@redhat.com --- The difference between privilege escalation via sudo and that via docker is that the former is audited, logged, and uses a well known privilege escalation path.

Privilege escalation via the docker group (which is correctly not present by default) is not audited, cannot be logged, is wide open, does not respect SELinux contexts.

Even the upstream Docker project warns against this.