|
 |
a8e2dd8 |
From 1fde98456652ddbcb750ade2121c5ceec93fbfae Mon Sep 17 00:00:00 2001
|
|
|
a8e2dd8 |
From: Debarshi Ray <rishi@fedoraproject.org>
|
|
|
a8e2dd8 |
Date: Thu, 13 Jul 2023 13:08:40 +0200
|
|
|
a8e2dd8 |
Subject: [PATCH] cmd/initContainer: Be aware of security hardened mount points
|
|
|
a8e2dd8 |
|
|
|
a8e2dd8 |
Sometimes locations such as /var/lib/flatpak, /var/lib/systemd/coredump
|
|
|
a8e2dd8 |
and /var/log/journal sit on security hardened mount points that are
|
|
|
a8e2dd8 |
marked as 'nosuid,nodev,noexec' [1]. In such cases, when Toolbx is used
|
|
|
a8e2dd8 |
rootless, an attempt to bind mount these locations read-only at runtime
|
|
|
a8e2dd8 |
with mount(8) fails because of permission problems:
|
|
|
a8e2dd8 |
# mount --rbind -o ro <source> <containerPath>
|
|
|
a8e2dd8 |
mount: <containerPath>: filesystem was mounted, but any subsequent
|
|
|
a8e2dd8 |
operation failed: Unknown error 5005.
|
|
|
a8e2dd8 |
|
|
|
a8e2dd8 |
(Note that the above error message from mount(8) was subsequently
|
|
|
a8e2dd8 |
improved to show something more meaningful than 'Unknown error' [2].)
|
|
|
a8e2dd8 |
|
|
|
a8e2dd8 |
The problem is that 'init-container' is running inside the container's
|
|
|
a8e2dd8 |
mount and user namespace, and the source paths were mounted inside the
|
|
|
a8e2dd8 |
host's namespace with 'nosuid,nodev,noexec'. The above mount(8) call
|
|
|
a8e2dd8 |
tries to remove the 'nosuid,nodev,noexec' flags from the mount point and
|
|
|
a8e2dd8 |
replace them with only 'ro', which is something that can't be done from
|
|
|
a8e2dd8 |
a child namespace.
|
|
|
a8e2dd8 |
|
|
|
a8e2dd8 |
Note that this doesn't fail when Toolbx is running as root. This is
|
|
|
a8e2dd8 |
because the container uses the host's user namespace and is able to
|
|
|
a8e2dd8 |
remove the 'nosuid,nodev,noexec' flags from the mount point and replace
|
|
|
a8e2dd8 |
them with only 'ro'. Even though it doesn't fail, the flags shouldn't
|
|
|
a8e2dd8 |
get replaced like that inside the container, because it removes the
|
|
|
a8e2dd8 |
security hardening of those mount points.
|
|
|
a8e2dd8 |
|
|
|
a8e2dd8 |
There's actually no benefit in bind mounting these paths as read-only.
|
|
|
a8e2dd8 |
It was historically done this way 'just to be safe' because a user isn't
|
|
|
a8e2dd8 |
expected to write to these locations from inside a container. However,
|
|
|
a8e2dd8 |
Toolbx doesn't intend to provide any heightened security beyond what's
|
|
|
a8e2dd8 |
already available on the host.
|
|
|
a8e2dd8 |
|
|
|
a8e2dd8 |
Hence, it's better to get out of the way and leave it to the permissions
|
|
|
a8e2dd8 |
on the source location from the host operating system to guard the
|
|
|
a8e2dd8 |
castle. This is accomplished by not passing any file system options to
|
|
|
a8e2dd8 |
mount(8) [1].
|
|
|
a8e2dd8 |
|
|
|
a8e2dd8 |
Based on an idea from Si.
|
|
|
a8e2dd8 |
|
|
|
a8e2dd8 |
[1] https://man7.org/linux/man-pages/man8/mount.8.html
|
|
|
a8e2dd8 |
|
|
|
a8e2dd8 |
[2] util-linux commit 9420ca34dc8b6f0f
|
|
|
a8e2dd8 |
https://github.com/util-linux/util-linux/commit/9420ca34dc8b6f0f
|
|
|
a8e2dd8 |
https://github.com/util-linux/util-linux/pull/2376
|
|
|
a8e2dd8 |
|
|
|
a8e2dd8 |
https://github.com/containers/toolbox/issues/911
|
|
|
a8e2dd8 |
---
|
|
|
a8e2dd8 |
src/cmd/initContainer.go | 6 +++---
|
|
|
a8e2dd8 |
1 file changed, 3 insertions(+), 3 deletions(-)
|
|
|
a8e2dd8 |
|
|
|
a8e2dd8 |
diff --git a/src/cmd/initContainer.go b/src/cmd/initContainer.go
|
|
|
a8e2dd8 |
index 465ac063b210..c4cd1b02d298 100644
|
|
|
a8e2dd8 |
--- a/src/cmd/initContainer.go
|
|
|
a8e2dd8 |
+++ b/src/cmd/initContainer.go
|
|
|
a8e2dd8 |
@@ -62,10 +62,10 @@ var (
|
|
|
a8e2dd8 |
{"/run/udev/data", "/run/host/run/udev/data", ""},
|
|
|
a8e2dd8 |
{"/run/udev/tags", "/run/host/run/udev/tags", ""},
|
|
|
a8e2dd8 |
{"/tmp", "/run/host/tmp", "rslave"},
|
|
|
a8e2dd8 |
- {"/var/lib/flatpak", "/run/host/var/lib/flatpak", "ro"},
|
|
|
a8e2dd8 |
+ {"/var/lib/flatpak", "/run/host/var/lib/flatpak", ""},
|
|
|
a8e2dd8 |
{"/var/lib/libvirt", "/run/host/var/lib/libvirt", ""},
|
|
|
a8e2dd8 |
- {"/var/lib/systemd/coredump", "/run/host/var/lib/systemd/coredump", "ro"},
|
|
|
a8e2dd8 |
- {"/var/log/journal", "/run/host/var/log/journal", "ro"},
|
|
|
a8e2dd8 |
+ {"/var/lib/systemd/coredump", "/run/host/var/lib/systemd/coredump", ""},
|
|
|
a8e2dd8 |
+ {"/var/log/journal", "/run/host/var/log/journal", ""},
|
|
|
a8e2dd8 |
{"/var/mnt", "/run/host/var/mnt", "rslave"},
|
|
|
a8e2dd8 |
}
|
|
|
a8e2dd8 |
)
|
|
|
a8e2dd8 |
--
|
|
|
a8e2dd8 |
2.41.0
|
|
|
a8e2dd8 |
|