|
 |
1f5593 |
From 28a697cce3e4f905dca700eda81d681a30eef9cd Mon Sep 17 00:00:00 2001
|
|
|
1f5593 |
From: Giuseppe Scrivano <gscrivan@redhat.com>
|
|
|
1f5593 |
Date: Fri, 11 Jan 2019 21:53:45 +0100
|
|
|
1f5593 |
Subject: [PATCH] rootfs: umount all procfs and sysfs with --no-pivot
|
|
|
1f5593 |
|
|
|
1f5593 |
When creating a new user namespace, the kernel doesn't allow to mount
|
|
|
1f5593 |
a new procfs or sysfs file system if there is not already one instance
|
|
|
1f5593 |
fully visible in the current mount namespace.
|
|
|
1f5593 |
|
|
|
1f5593 |
When using --no-pivot we were effectively inhibiting this protection
|
|
|
1f5593 |
from the kernel, as /proc and /sys from the host are still present in
|
|
|
1f5593 |
the container mount namespace.
|
|
|
1f5593 |
|
|
|
1f5593 |
A container without full access to /proc could then create a new user
|
|
|
1f5593 |
namespace, and from there able to mount a fully visible /proc, bypassing
|
|
|
1f5593 |
the limitations in the container.
|
|
|
1f5593 |
|
|
|
1f5593 |
A simple reproducer for this issue is:
|
|
|
1f5593 |
|
|
|
1f5593 |
unshare -mrfp sh -c "mount -t proc none /proc && echo c > /proc/sysrq-trigger"
|
|
|
1f5593 |
|
|
|
1f5593 |
Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
|
|
|
1f5593 |
---
|
|
|
1f5593 |
libcontainer/rootfs_linux.go | 35 +++++++++++++++++++++++++++++++++++
|
|
|
1f5593 |
1 file changed, 35 insertions(+)
|
|
|
1f5593 |
|
|
|
1f5593 |
diff --git a/libcontainer/rootfs_linux.go b/libcontainer/rootfs_linux.go
|
|
|
1f5593 |
index e7c2f8ada..6bd6da74a 100644
|
|
|
1f5593 |
--- a/libcontainer/rootfs_linux.go
|
|
|
1f5593 |
+++ b/libcontainer/rootfs_linux.go
|
|
|
1f5593 |
@@ -748,6 +748,41 @@ func pivotRoot(rootfs string) error {
|
|
|
1f5593 |
}
|
|
|
1f5593 |
|
|
|
1f5593 |
func msMoveRoot(rootfs string) error {
|
|
|
1f5593 |
+ mountinfos, err := mount.GetMounts()
|
|
|
1f5593 |
+ if err != nil {
|
|
|
1f5593 |
+ return err
|
|
|
1f5593 |
+ }
|
|
|
1f5593 |
+
|
|
|
1f5593 |
+ absRootfs, err := filepath.Abs(rootfs)
|
|
|
1f5593 |
+ if err != nil {
|
|
|
1f5593 |
+ return err
|
|
|
1f5593 |
+ }
|
|
|
1f5593 |
+
|
|
|
1f5593 |
+ for _, info := range mountinfos {
|
|
|
1f5593 |
+ p, err := filepath.Abs(info.Mountpoint)
|
|
|
1f5593 |
+ if err != nil {
|
|
|
1f5593 |
+ return err
|
|
|
1f5593 |
+ }
|
|
|
1f5593 |
+ // Umount every syfs and proc file systems, except those under the container rootfs
|
|
|
1f5593 |
+ if (info.Fstype != "proc" && info.Fstype != "sysfs") || filepath.HasPrefix(p, absRootfs) {
|
|
|
1f5593 |
+ continue
|
|
|
1f5593 |
+ }
|
|
|
1f5593 |
+ // Be sure umount events are not propagated to the host.
|
|
|
1f5593 |
+ if err := unix.Mount("", p, "", unix.MS_SLAVE|unix.MS_REC, ""); err != nil {
|
|
|
1f5593 |
+ return err
|
|
|
1f5593 |
+ }
|
|
|
1f5593 |
+ if err := unix.Unmount(p, unix.MNT_DETACH); err != nil {
|
|
|
1f5593 |
+ if err != unix.EINVAL && err != unix.EPERM {
|
|
|
1f5593 |
+ return err
|
|
|
1f5593 |
+ } else {
|
|
|
1f5593 |
+ // If we have not privileges for umounting (e.g. rootless), then
|
|
|
1f5593 |
+ // cover the path.
|
|
|
1f5593 |
+ if err := unix.Mount("tmpfs", p, "tmpfs", 0, ""); err != nil {
|
|
|
1f5593 |
+ return err
|
|
|
1f5593 |
+ }
|
|
|
1f5593 |
+ }
|
|
|
1f5593 |
+ }
|
|
|
1f5593 |
+ }
|
|
|
1f5593 |
if err := unix.Mount(rootfs, "/", "", unix.MS_MOVE, ""); err != nil {
|
|
|
1f5593 |
return err
|
|
|
1f5593 |
}
|