Lesson 1.22: Group memberships that equal root
System Security 101 audited sudo rules and SUID programs. Some ordinary-looking group memberships give the same power without either: a member of docker can start a container with the host's root filesystem mounted, lxd works the same way, disk can read the raw disk (shadow file included), and adm reads logs that often contain secrets. In the lab you list who holds these groups on Northwind's order server, see why the socket and device permissions make them powerful, remove memberships nobody needs, and document the one that must stay.
15 min
You will learn to
- Explain why docker, lxd and disk equal root
- List group members with getent and id
- Read socket and device permissions
- Remove unneeded memberships with gpasswd
- Document justified privileged access
Key terms
- Root-equivalent group
- A group whose members can gain root without sudo or SUID.
- Docker socket
- /var/run/docker.sock: the root daemon's API; write access means full control.
- Block device
- A disk as a raw stream of bytes (/dev/sda); reading it bypasses file permissions.
- adm group
- Read access to system logs in /var/log on Debian and Ubuntu.
- Rootless Docker
- Running the Docker daemon as an ordinary user, so the socket no longer grants root.
← The attack surface of a host · All lessons · Anatomy of a web application →