Maintaining Open Source Singularity Since 2017
Sylabs and Cray cooperate to secure Singularity on CLE5
By Adam Hughes
The Sylabs team has an exciting update regarding the recent PR_SET_NO_NEW_PRIVS security issue.
In collaboration with Cray, it has been discovered that the PR_SET_NO_NEW_PRIVS prctl() option is properly supported within the SLES11SP3 and CLE5 kernel. The reason it has been unsupported within Singularity (and other containers) is because the necessary user space dependencies are non-existent. This is good news, because we can directly declare these requirements within Singularity and properly use them within the kernel!
This modification has been added into the release-2.5 branch of Singularity in GitHub and it will be part of the next released version. If you need a supported version of Singularity that includes this feature and can securely support SLES11 and Cray’s CLE5 ASAP please contact Sylabs directly.
The fact remains that it is unsafe to run containers on host kernels that do not support PR_SET_NO_NEW_PRIVS but at least the problem set just shrunk! Great news for a Friday, and on that note, have a great weekend everyone!
Join Our Mailing List
Recent Posts
Related Posts
Laying the Groundwork for 2025: Sylabs’ Vision for Secure Multi-Cloud Solutions
With a legacy rooted in innovation through the work we’ve done with the Singularity platform, Sylabs has consistently worked to provide secure container technology to empower researchers, enterprises, and innovators worldwide. These efforts have paid dividends as we...
Creating New Levels of Security with Containers and Confidential Computing
Data breaches are becoming increasingly common. It's more important than ever to find robust solutions that protect sensitive information. Recent high-profile data breaches underscore the necessity for fresh approaches to data protection. Breaches like these are...
OCI-SIF Container Images: Unraveling Their Features and Benefits
Among the container industry, OCI (Open Container Initiative) and SIF (Singularity Image Format) stand out as two prominent formats, each offering unique features and benefits. Understanding their distinct characteristics is crucial for HPC developers seeking optimal...