K
Q

Why does Kubernetes allow global read/write in kubelet directory?

2/18/2019

I installed Kubernetes 1.13.1 cluster using kubeadm, docker 17.12.1-ce and flannel networking

However, I found that Kubernetes master server has many empty files with permission 666 which allows any user can read/write by command:

$ find /var/lib -perm 666

The following results shows that Kubernetes components kube-controller-manager, kube-scheduler, etcd, kube-apiserver, kube-proxy, coredns, install-cni and kube-flannel created those insecure files.

/var/lib/kubelet/pods/d4ff37ee76fe761a28f11175fd1c384e/containers/kube-controller-manager/67675b22
/var/lib/kubelet/pods/d4ff37ee76fe761a28f11175fd1c384e/containers/kube-controller-manager/2472b441
/var/lib/kubelet/pods/d4ff37ee76fe761a28f11175fd1c384e/containers/kube-controller-manager/4bd17709
/var/lib/kubelet/pods/d4ff37ee76fe761a28f11175fd1c384e/containers/kube-controller-manager/ed3b53cd
/var/lib/kubelet/pods/d4ff37ee76fe761a28f11175fd1c384e/containers/kube-controller-manager/db4af185
/var/lib/kubelet/pods/d4ff37ee76fe761a28f11175fd1c384e/containers/kube-controller-manager/043af2e4
/var/lib/kubelet/pods/d4ff37ee76fe761a28f11175fd1c384e/containers/kube-controller-manager/c53c15c7
/var/lib/kubelet/pods/d4ff37ee76fe761a28f11175fd1c384e/containers/kube-controller-manager/a16fefca
/var/lib/kubelet/pods/44b569a35761491825f4e7253fbf0543/containers/kube-scheduler/1d5bf9d8
/var/lib/kubelet/pods/44b569a35761491825f4e7253fbf0543/containers/kube-scheduler/c94fa723
/var/lib/kubelet/pods/44b569a35761491825f4e7253fbf0543/containers/kube-scheduler/4bd7ff3b
/var/lib/kubelet/pods/44b569a35761491825f4e7253fbf0543/containers/kube-scheduler/16991a34
/var/lib/kubelet/pods/44b569a35761491825f4e7253fbf0543/containers/kube-scheduler/cc39443a
/var/lib/kubelet/pods/44b569a35761491825f4e7253fbf0543/containers/kube-scheduler/e6e4aace
/var/lib/kubelet/pods/44b569a35761491825f4e7253fbf0543/containers/kube-scheduler/81a73a2d
/var/lib/kubelet/pods/4f58ccda5ae6e0c130245af30581f553/containers/etcd/aa52c49d
/var/lib/kubelet/pods/4f58ccda5ae6e0c130245af30581f553/containers/etcd/4ab06094
/var/lib/kubelet/pods/4f58ccda5ae6e0c130245af30581f553/containers/etcd/48d77ff1
/var/lib/kubelet/pods/4f58ccda5ae6e0c130245af30581f553/containers/etcd/8a69b2a8
/var/lib/kubelet/pods/4f58ccda5ae6e0c130245af30581f553/containers/etcd/2d3110c6
/var/lib/kubelet/pods/4f58ccda5ae6e0c130245af30581f553/containers/etcd/1050c0c2
/var/lib/kubelet/pods/4f58ccda5ae6e0c130245af30581f553/containers/etcd/3c9b35d2
/var/lib/kubelet/pods/4f58ccda5ae6e0c130245af30581f553/containers/etcd/585456e6
/var/lib/kubelet/pods/431d2fd1385de8d92297e09b707498e8/containers/kube-apiserver/8be88549
/var/lib/kubelet/pods/431d2fd1385de8d92297e09b707498e8/containers/kube-apiserver/cfb428fd
/var/lib/kubelet/pods/431d2fd1385de8d92297e09b707498e8/containers/kube-apiserver/013626b1
/var/lib/kubelet/pods/431d2fd1385de8d92297e09b707498e8/containers/kube-apiserver/7e786acf
/var/lib/kubelet/pods/431d2fd1385de8d92297e09b707498e8/containers/kube-apiserver/9421eba8
/var/lib/kubelet/pods/431d2fd1385de8d92297e09b707498e8/containers/kube-apiserver/7ed5b175
/var/lib/kubelet/pods/431d2fd1385de8d92297e09b707498e8/containers/kube-apiserver/6fc2a524
/var/lib/kubelet/pods/431d2fd1385de8d92297e09b707498e8/containers/kube-apiserver/dca6882b
/var/lib/kubelet/pods/205f8dce-31b6-11e9-a4aa-000c295ecaec/containers/kube-proxy/914ac6c3
/var/lib/kubelet/pods/205f8dce-31b6-11e9-a4aa-000c295ecaec/containers/kube-proxy/3c44eff3
/var/lib/kubelet/pods/205f8dce-31b6-11e9-a4aa-000c295ecaec/containers/kube-proxy/a85f6e51
/var/lib/kubelet/pods/205f8dce-31b6-11e9-a4aa-000c295ecaec/containers/kube-proxy/c4463b68
/var/lib/kubelet/pods/205f8dce-31b6-11e9-a4aa-000c295ecaec/containers/kube-proxy/34e5f60f
/var/lib/kubelet/pods/205f8dce-31b6-11e9-a4aa-000c295ecaec/containers/kube-proxy/e0376b53
/var/lib/kubelet/pods/205f8dce-31b6-11e9-a4aa-000c295ecaec/containers/kube-proxy/b3826292
/var/lib/kubelet/pods/205f8dce-31b6-11e9-a4aa-000c295ecaec/containers/kube-proxy/aecca296
/var/lib/kubelet/pods/2076242e-31b6-11e9-a4aa-000c295ecaec/containers/coredns/117caf5a
/var/lib/kubelet/pods/2076242e-31b6-11e9-a4aa-000c295ecaec/containers/coredns/438a9268
/var/lib/kubelet/pods/2076242e-31b6-11e9-a4aa-000c295ecaec/containers/coredns/335b2b55
/var/lib/kubelet/pods/2076242e-31b6-11e9-a4aa-000c295ecaec/containers/coredns/6cfbeba3
/var/lib/kubelet/pods/2076242e-31b6-11e9-a4aa-000c295ecaec/containers/coredns/b8af2455
/var/lib/kubelet/pods/2076242e-31b6-11e9-a4aa-000c295ecaec/containers/coredns/cc246570
/var/lib/kubelet/pods/2076242e-31b6-11e9-a4aa-000c295ecaec/containers/coredns/036e6102
/var/lib/kubelet/pods/2076f7b0-31b6-11e9-a4aa-000c295ecaec/containers/coredns/59e51c33
/var/lib/kubelet/pods/2076f7b0-31b6-11e9-a4aa-000c295ecaec/containers/coredns/fc15d13f
/var/lib/kubelet/pods/2076f7b0-31b6-11e9-a4aa-000c295ecaec/containers/coredns/68e17599
/var/lib/kubelet/pods/2076f7b0-31b6-11e9-a4aa-000c295ecaec/containers/coredns/ee907d2f
/var/lib/kubelet/pods/2076f7b0-31b6-11e9-a4aa-000c295ecaec/containers/coredns/96253eba
/var/lib/kubelet/pods/2076f7b0-31b6-11e9-a4aa-000c295ecaec/containers/coredns/38268733
/var/lib/kubelet/pods/2076f7b0-31b6-11e9-a4aa-000c295ecaec/containers/coredns/57319601
/var/lib/kubelet/pods/2076f7b0-31b6-11e9-a4aa-000c295ecaec/containers/coredns/9d2cc8d4
/var/lib/kubelet/pods/478813b4-31b8-11e9-a4aa-000c295ecaec/containers/install-cni/b480c6a8
/var/lib/kubelet/pods/478813b4-31b8-11e9-a4aa-000c295ecaec/containers/install-cni/13b9e8b2
/var/lib/kubelet/pods/478813b4-31b8-11e9-a4aa-000c295ecaec/containers/install-cni/caf80049
/var/lib/kubelet/pods/478813b4-31b8-11e9-a4aa-000c295ecaec/containers/install-cni/e1956197
/var/lib/kubelet/pods/478813b4-31b8-11e9-a4aa-000c295ecaec/containers/install-cni/6f7cf72c
/var/lib/kubelet/pods/478813b4-31b8-11e9-a4aa-000c295ecaec/containers/install-cni/ae3a7534
/var/lib/kubelet/pods/478813b4-31b8-11e9-a4aa-000c295ecaec/containers/install-cni/cfde7073
/var/lib/kubelet/pods/478813b4-31b8-11e9-a4aa-000c295ecaec/containers/install-cni/4c5f4031
/var/lib/kubelet/pods/478813b4-31b8-11e9-a4aa-000c295ecaec/containers/install-cni/843e7a92
/var/lib/kubelet/pods/478813b4-31b8-11e9-a4aa-000c295ecaec/containers/kube-flannel/a3934024
/var/lib/kubelet/pods/478813b4-31b8-11e9-a4aa-000c295ecaec/containers/kube-flannel/e4aa6627
/var/lib/kubelet/pods/478813b4-31b8-11e9-a4aa-000c295ecaec/containers/kube-flannel/3316e4ef
/var/lib/kubelet/pods/478813b4-31b8-11e9-a4aa-000c295ecaec/containers/kube-flannel/b3c0c65b
/var/lib/kubelet/pods/478813b4-31b8-11e9-a4aa-000c295ecaec/containers/kube-flannel/5520d34e
/var/lib/kubelet/pods/478813b4-31b8-11e9-a4aa-000c295ecaec/containers/kube-flannel/fc02f300
/var/lib/kubelet/pods/478813b4-31b8-11e9-a4aa-000c295ecaec/containers/kube-flannel/2b3ea969
/var/lib/kubelet/pods/478813b4-31b8-11e9-a4aa-000c295ecaec/containers/kube-flannel/c445f6e1
-- lotusirous
kubernetes
security

Similar Questions

Running Flask web application in Google Kubernetes Engine
Kubernetes Hyperledger Fabric Orderer - Failed to Create new connection
Is there any way to enable Kubernetes on Docker for Mac via terminal?
How to change the access mode of PVC in open shift

1 Answer

3/5/2019

I think this does not impose any security concern.
Please note, that disclosed by you files in the listing (with 666 permissions) cannot be accessed unless parent directories in the path has the execute bit permission set (ref. Linux Wiki).

-- Nepomucen
Source: StackOverflow