bug? I can see /dev/sdX from inside a container

[dragonauta]

I'm really not sure about where to report this.
I know this is not a Proxmox bug, so I'm asking for guidance (and also to inform this to you).

I have a Proxmox server at home. I made a container and installed Gnome, Xdummy and x11vnc to have a full desktop. So I can access this containerized desktop over VNC.
Problem is that I actually can see proxmox devices when launching Gnome Disk Utility, even loop devices corresponding to other containers... as a normal user!!!

# pveversion -v
proxmox-ve: 4.2-58 (running kernel: 4.4.13-2-pve)
pve-manager: 4.2-17 (running version: 4.2-17/e1400248)
pve-kernel-4.4.13-1-pve: 4.4.13-56
pve-kernel-4.4.8-1-pve: 4.4.8-52
pve-kernel-4.4.13-2-pve: 4.4.13-58
lvm2: 2.02.116-pve2
corosync-pve: 2.4.0-1
libqb0: 1.0-1
pve-cluster: 4.0-43
qemu-server: 4.0-85
pve-firmware: 1.1-8
libpve-common-perl: 4.0-71
libpve-access-control: 4.0-19
libpve-storage-perl: 4.0-56
pve-libspice-server1: 0.12.8-1
vncterm: 1.2-1
pve-qemu-kvm: 2.6-1
pve-container: 1.0-72
pve-firewall: 2.0-29
pve-ha-manager: 1.0-33
ksm-control-daemon: 1.2-1
glusterfs-client: 3.5.2-2+deb8u2
lxc-pve: 2.0.3-4
lxcfs: 2.0.2-pve1
cgmanager: 0.39-pve1
criu: 1.6.0-1
fence-agents-pve: not correctly installed

When on VNC session, opening a gnome-terminal, it seems pretty normal.

dragonauta@desktop ~ $ su -
Password:
root@desktop ~ # ls -l /dev
total 0
c--x--x--x 1 root tty  136, 7 ago 18 20:32 console
lrwxrwxrwx 1 root root  13 ago 17 14:05 fd -> /proc/self/fd
crw-rw-rw- 1 root root  1, 7 ago 17 14:05 full
srw-rw-rw- 1 root root  0 ago 17 14:05 log
crw-rw-rw- 1 root root  1, 3 ago 17 14:05 null
lrwxrwxrwx 1 root root  13 ago 17 14:05 ptmx -> /dev/pts/ptmx
drwxr-xr-x 2 root root  0 ago 17 14:05 pts
crw-rw-rw- 1 root root  1, 8 ago 17 14:05 random
lrwxrwxrwx 1 root root  8 ago 17 14:05 shm -> /run/shm
lrwxrwxrwx 1 root root  15 ago 17 14:05 stderr -> /proc/self/fd/2
lrwxrwxrwx 1 root root  15 ago 17 14:05 stdin -> /proc/self/fd/0
lrwxrwxrwx 1 root root  15 ago 17 14:05 stdout -> /proc/self/fd/1
crw-rw-rw- 1 root root  5, 0 ago 17 14:05 tty
crw--w---- 1 root tty  136, 0 ago 17 14:06 tty1
crw--w---- 1 root tty  136, 1 ago 17 14:06 tty2
crw-rw-rw- 1 root root  1, 9 ago 17 14:05 urandom
prw-r----- 1 root adm  0 ago 18 20:32 xconsole
crw-rw-rw- 1 root root  1, 5 ago 17 14:05 zero
root@desktop ~ #

But running Gnome Disk Utility as normal user it shows this
I can see /dev/dm-0 /dev/dm-1 /dev/dm-2 /dev/sda /dev/sdb /dev/sdc and loop devices from other containers.
I can see options like performance, formatting, etc.
Didn't make any change.

Definitely this is not normal as I'm inside a container.
Also I'm aware that is not a normal situation as per containers normally do not run desktops
Any advice?
Where should I open a bug report? systemd? lxc?

Thanks

 

[fabian]

containers don't provide the same isolation that virtual machines do - since the kernel is shared, a lot of information is shared as well. in this case, /sys/block contains information about block devices that the kernel knows about, and this is available in all containers and the host. access to those devices is limited, but their existence is not hidden.

 

[dragonauta]

Thanks fabian for the explanation.
I really didn't know that. I really worried there were a security issue or something.
Thanks again