Security concerns with downloading proxmox lxc containers

[Johannes S]

Hello everybody,

this is my first post so I'm not sure whether it's the right place to ask. So if it's preferred to discuss things in a more private place please delete this and drop me a pm with the correct contact to discuss this..
First I want to say that I like the proxmox stack (PVE + PBS) very much I'm using it to setup my own little homelab and loving it.

Now I have stumbled across the following, which I probably misunderstood. I would greatly appreciate any hint on the nature of my misreasoning.

When I created my first lxc containers I noticed the templates library with alpine, debian etc. Although this is quite useful I noticed something which give me some pause:
When I download a container with this function it lands in my local storage with root:root so It looks like the actual download is done as a root user. This would worry me a bit since this might lead to a situation where somebody could download a malicious template with root privileges.
On the other hand pveproxy run as www-data which is propably the user the web interface is running under and thus also downloading the templates as www-data before changing the owner and group to root. I tried to look it up in the source and find out that the pveam command line tool seems to do the actual download but since I have no skills in perl I wasn't any wiser.

So the question is: Am I totally paranoid or is this a possible problem? After all in every other aspect my impression is, that the proxmox team deeply cares about security so I assume that I'm wrong. How exactly and under which user does pveam (or whatever piece of code does the template downloading and installing) run?

Many thanks in advance and best regards, Johannes

 

[dcsapak]

When I download a container with this function it lands in my local storage with root:root so It looks like the actual download is done as a root user. This would worry me a bit since this might lead to a situation where somebody could download a malicious template with root privileges.

why do you think this?

we have two daemons running pveproxy (running as www-data and doing most of the work) and pvedaemon, which is running as root for things that can only be done as root (e.g. mounting storages, etc)

the template list info is downloaded from our mirror and gpg signed, which is verified on download
the api call that downloads the template then uses the information of that to download the images, incl checking the md5 and sha512 checksums
so there should not be a way to download arbitrary files with root for this

since we download into a storage that is generally only writable by root, we have to route that api call through the pvedaemon

 

[Johannes S]

I was sure I already answered this somehow I must closed the wrong browser tabs some weeks ago.
So I want to apologize for not reacting earlier , that's not a polite thing to do.

Many thanks for your explaination, this makes sense and confirms my understanding that the developers of Proxmox know their stuff.

Best regards, Johannes.

 

[Stoiko Ivanov]

So if it's preferred to discuss things in a more private place please delete this and drop me a pm with the correct contact to discuss this..

Just to have answered this explicitly (also for future readers) - if you think you have found a security issue in our software - the process for reporting those (for all our software and all our products) is explained in the pve-wiki:
https://pve.proxmox.com/wiki/Security_Reporting