Proxmox/lxc
5
0
Fork 0
mirror of git://git.proxmox.com/git/lxc.git synced 2025-03-22 06:50:41 +03:00
Code Releases Activity

add fix for rw sysfs issue

Browse Source 
originally reported by Patrick William of Rack911Labs.

note: this has a slight (but unavoidable) potential for
breakage for containers that need a rw /sys for whatever
reason. those should already have set "lxc.mount.auto" to
contain "sys:rw" (or use a custom AA profile), because
remounting /sys rw is only possible with trickery inside the
container even without this patch.
This commit is contained in:
Fabian Grünbichler 2016-11-09 09:43:51 +01:00 committed by Wolfgang Bumiller
parent e90e6858af
commit 0d5c2e056d
2 changed files with 67 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

66
debian/patches/deny-rw-mounting-of-sys-and-proc.patch vendored Normal file
View File

@ -0,0 +1,66 @@
From 77596df581ee381896a5d9a9152c046ff164c65a Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Fabian=20Gr=C3=BCnbichler?= <f.gruenbichler@proxmox.com>
Date: Wed, 9 Nov 2016 09:14:26 +0100
Subject: [PATCH] deny rw mounting of /sys and /proc
this would allow root in a privileged container to change
the permissions of /sys on the host, which could lock out
non-root users.
if a rw /sys is desired, set "lxc.mount.auto" accordingly
---
config/apparmor/abstractions/container-base | 6 +++++-
config/apparmor/abstractions/container-base.in | 6 +++++-
2 files changed, 10 insertions(+), 2 deletions(-)
diff --git a/config/apparmor/abstractions/container-base b/config/apparmor/abstractions/container-base
index 06290de..3c64c66 100644
--- a/config/apparmor/abstractions/container-base
+++ b/config/apparmor/abstractions/container-base
@@ -84,7 +84,6 @@
deny mount fstype=debugfs -> /var/lib/ureadahead/debugfs/,
mount fstype=proc -> /proc/,
mount fstype=sysfs -> /sys/,
- mount options=(rw, nosuid, nodev, noexec, remount) -> /sys/,
deny /sys/firmware/efi/efivars/** rwklx,
deny /sys/kernel/security/** rwklx,
mount options=(move) /sys/fs/cgroup/cgmanager/ -> /sys/fs/cgroup/cgmanager.lower/,
@@ -93,6 +92,11 @@
# deny reads from debugfs
deny /sys/kernel/debug/{,**} rwklx,
+ # prevent rw mounting of /sys, because that allows changing its global permissions
+ deny mount -> /proc/,
+ deny mount -> /sys/,
+# mount options=(rw, nosuid, nodev, noexec, remount) -> /sys/,
+
# allow paths to be made slave, shared, private or unbindable
# FIXME: This currently doesn't work due to the apparmor parser treating those as allowing all mounts.
# mount options=(rw,make-slave) -> **,
diff --git a/config/apparmor/abstractions/container-base.in b/config/apparmor/abstractions/container-base.in
index 5bc9b28..482214e 100644
--- a/config/apparmor/abstractions/container-base.in
+++ b/config/apparmor/abstractions/container-base.in
@@ -84,7 +84,6 @@
deny mount fstype=debugfs -> /var/lib/ureadahead/debugfs/,
mount fstype=proc -> /proc/,
mount fstype=sysfs -> /sys/,
- mount options=(rw, nosuid, nodev, noexec, remount) -> /sys/,
deny /sys/firmware/efi/efivars/** rwklx,
deny /sys/kernel/security/** rwklx,
mount options=(move) /sys/fs/cgroup/cgmanager/ -> /sys/fs/cgroup/cgmanager.lower/,
@@ -93,6 +92,11 @@
# deny reads from debugfs
deny /sys/kernel/debug/{,**} rwklx,
+ # prevent rw mounting of /sys, because that allows changing its global permissions
+ deny mount -> /proc/,
+ deny mount -> /sys/,
+# mount options=(rw, nosuid, nodev, noexec, remount) -> /sys/,
+
# allow paths to be made slave, shared, private or unbindable
# FIXME: This currently doesn't work due to the apparmor parser treating those as allowing all mounts.
# mount options=(rw,make-slave) -> **,
--
2.1.4

1
debian/patches/series vendored
View File

@ -6,3 +6,4 @@ include-linux-sched.patch
use-var-lib-vz-as-default-dir.patch
#do-not-use-config-path-for-rootfs.patch
run-lxcnetaddbr.patch
deny-rw-mounting-of-sys-and-proc.patch