*: verify operations on /proc/... are on procfs #2130

cyphar · 2019-09-27T02:02:23Z

This is an additional mitigation for CVE-2019-16884. The primary problem
is that Docker can be coerced into bind-mounting a file system on top of
/proc (resulting in label-related writes to /proc no longer happening).

While we are working on mitigations against permitting the mounts, this
helps avoid our code from being tricked into writing to non-procfs
files. This is not a perfect solution (after all, there might be a
bind-mount of a different procfs file over the target) but in order to
exploit that you would need to be able to tweak a config.json pretty
specifically (which thankfully Docker doesn't allow).

Specifically this stops AppArmor from not labeling a process silently
due to /proc/self/attr/... being incorrectly set, and stops any
accidental fd leaks because /proc/self/fd/... is not real.

See #2128
Signed-off-by: Aleksa Sarai [email protected]

cyphar · 2019-09-28T01:19:17Z

/ping @opencontainers/runc-maintainers

This is a bump to v1.3.0, plus the necessary CVE-2019-16884 mitigation. Signed-off-by: Aleksa Sarai <[email protected]>

dqminh · 2019-09-29T21:27:27Z

LGTM

libcontainer/utils/utils_unix.go

This is an additional mitigation for CVE-2019-16884. The primary problem is that Docker can be coerced into bind-mounting a file system on top of /proc (resulting in label-related writes to /proc no longer happening). While we are working on mitigations against permitting the mounts, this helps avoid our code from being tricked into writing to non-procfs files. This is not a perfect solution (after all, there might be a bind-mount of a different procfs file over the target) but in order to exploit that you would need to be able to tweak a config.json pretty specifically (which thankfully Docker doesn't allow). Specifically this stops AppArmor from not labeling a process silently due to /proc/self/attr/... being incorrectly set, and stops any accidental fd leaks because /proc/self/fd/... is not real. Signed-off-by: Aleksa Sarai <[email protected]>

dqminh · 2019-09-30T09:25:21Z

LGTM

crosbymichael · 2019-09-30T14:49:43Z

LGTM

* Update the runc vendor to v1.0.0-rc9 which includes an additional mitigation for [CVE-2019-16884](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-16884). - More details on the runc CVE in [opencontainers/runc#2128](opencontainers/runc#2128), and the additional mitigations in [opencontainers/runc#2130](opencontainers/runc#2130). * Add local-fs.target to service file to fix corrupt image after unexpected host reboot. Reported in [containerd#3671](containerd#3671), and fixed by [containerd#3745](containerd#3745). * Fix large output of processes with TTY getting occasionally truncated. Reported in [containerd#3738](containerd#3738) and fixed by [containerd#3754](containerd#3754). * Fix direct unpack when running in user namespace. Reported in [containerd#3762](containerd#3762), and fixed by [containerd#3779](containerd#3779). * Update Golang runtime to 1.12.13, which includes security fixes to the `crypto/dsa` package made in Go 1.12.11 ([CVE-2019-17596](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-17596)), and fixes to the go command, `runtime`, `syscall` and `net` packages (Go 1.12.12). * Add Windows process shim installer [containerd#3792](containerd#3792) * CRI fixes: - Fix shim delete error code to avoid unnecessary retries in the CRI plugin. Discovered in [containerd/cri#1309](containerd/cri#1309), and fixed by [containerd#3733](containerd#3733) and [containerd#3740](containerd#3740). Signed-off-by: Sebastiaan van Stijn <[email protected]>

* Update the runc vendor to v1.0.0-rc9 which includes an additional mitigation for [CVE-2019-16884](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-16884). - More details on the runc CVE in [opencontainers/runc#2128](opencontainers/runc#2128), and the additional mitigations in [opencontainers/runc#2130](opencontainers/runc#2130). * Add local-fs.target to service file to fix corrupt image after unexpected host reboot. Reported in [containerd#3671](containerd#3671), and fixed by [containerd#3746](containerd#3746). * Update Golang runtime to 1.12.13, which includes security fixes to the `crypto/dsa` package made in Go 1.12.11 ([CVE-2019-17596](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-17596)), and fixes to the go command, `runtime`, `syscall` and `net` packages (Go 1.12.12). * CRI fixes: - Fix shim delete error code to avoid unnecessary retries in the CRI plugin. Discovered in [containerd/cri#1309](containerd/cri#1309), and fixed by [containerd#3732](containerd#3732) and [containerd#3739](containerd#3739). Signed-off-by: Sebastiaan van Stijn <[email protected]>

full diff: opencontainers/runc@3e425f8...v1.0.0-rc9 - opencontainers/runc#1951 Add SCMP_ACT_LOG as a valid Seccomp action - opencontainers/runc#2130 *: verify operations on /proc/... are on procfs This is an additional mitigation for CVE-2019-16884. The primary problem is that Docker can be coerced into bind-mounting a file system on top of /proc (resulting in label-related writes to /proc no longer happening). While we are working on mitigations against permitting the mounts, this helps avoid our code from being tricked into writing to non-procfs files. This is not a perfect solution (after all, there might be a bind-mount of a different procfs file over the target) but in order to exploit that you would need to be able to tweak a config.json pretty specifically (which thankfully Docker doesn't allow). Specifically this stops AppArmor from not labeling a process silently due to /proc/self/attr/... being incorrectly set, and stops any accidental fd leaks because /proc/self/fd/... is not real. Signed-off-by: Sebastiaan van Stijn <[email protected]>

full diff: containerd/containerd@v1.2.10...v1.2.11 The eleventh patch release for containerd 1.2 includes an updated runc with an additional fix for CVE-2019-16884 and a Golang update. Notable Updates ----------------------- - Update the runc vendor to v1.0.0-rc9 which includes an additional mitigation for CVE-2019-16884. More details on the runc CVE in opencontainers/runc#2128, and the additional mitigations in opencontainers/runc#2130. - Add local-fs.target to service file to fix corrupt image after unexpected host reboot. Reported in containerd/containerd#3671, and fixed by containerd/containerd#3746. - Update Golang runtime to 1.12.13, which includes security fixes to the crypto/dsa package made in Go 1.12.11 (CVE-2019-17596), and fixes to the go command, runtime, syscall and net packages (Go 1.12.12). CRI fixes: ----------------------- - Fix shim delete error code to avoid unnecessary retries in the CRI plugin. Discovered in containerd/cri#1309, and fixed by containerd/containerd#3732 and containerd/containerd#3739. Signed-off-by: Sebastiaan van Stijn <[email protected]>

full diff: opencontainers/runc@3e425f8...v1.0.0-rc9 - opencontainers/runc#1951 Add SCMP_ACT_LOG as a valid Seccomp action - opencontainers/runc#2130 *: verify operations on /proc/... are on procfs This is an additional mitigation for CVE-2019-16884. The primary problem is that Docker can be coerced into bind-mounting a file system on top of /proc (resulting in label-related writes to /proc no longer happening). While we are working on mitigations against permitting the mounts, this helps avoid our code from being tricked into writing to non-procfs files. This is not a perfect solution (after all, there might be a bind-mount of a different procfs file over the target) but in order to exploit that you would need to be able to tweak a config.json pretty specifically (which thankfully Docker doesn't allow). Specifically this stops AppArmor from not labeling a process silently due to /proc/self/attr/... being incorrectly set, and stops any accidental fd leaks because /proc/self/fd/... is not real. Signed-off-by: Sebastiaan van Stijn <[email protected]> Upstream-commit: efcd84e47c6bc3f5e52eb2cce518f55501d60ce7 Component: engine

full diff: containerd/containerd@v1.2.10...v1.2.11 The eleventh patch release for containerd 1.2 includes an updated runc with an additional fix for CVE-2019-16884 and a Golang update. Notable Updates ----------------------- - Update the runc vendor to v1.0.0-rc9 which includes an additional mitigation for CVE-2019-16884. More details on the runc CVE in opencontainers/runc#2128, and the additional mitigations in opencontainers/runc#2130. - Add local-fs.target to service file to fix corrupt image after unexpected host reboot. Reported in containerd/containerd#3671, and fixed by containerd/containerd#3746. - Update Golang runtime to 1.12.13, which includes security fixes to the crypto/dsa package made in Go 1.12.11 (CVE-2019-17596), and fixes to the go command, runtime, syscall and net packages (Go 1.12.12). CRI fixes: ----------------------- - Fix shim delete error code to avoid unnecessary retries in the CRI plugin. Discovered in containerd/cri#1309, and fixed by containerd/containerd#3732 and containerd/containerd#3739. Signed-off-by: Sebastiaan van Stijn <[email protected]> Upstream-commit: cfcf25bb5409eb0c3a9c257b225f2b8890142030 Component: engine

This was referenced Sep 27, 2019

AppArmor can be bypassed by a malicious image that specifies a volume at /proc #2128

Closed

Only allow proc mount if it is procfs #2129

Merged

cyphar changed the title ~~apparmor: verify that writes to /proc/... are on procfs~~ *: verify operations on /proc/... are on procfs Sep 27, 2019

vendor: update github.com/opencontainers/selinux

9aef504

This is a bump to v1.3.0, plus the necessary CVE-2019-16884 mitigation. Signed-off-by: Aleksa Sarai <[email protected]>

dqminh reviewed Sep 29, 2019

View reviewed changes

libcontainer/utils/utils_unix.go Outdated Show resolved Hide resolved

crosbymichael merged commit cad42f6 into opencontainers:master Sep 30, 2019

cyphar deleted the apparmor-verify-procfs branch September 30, 2019 14:58

thaJeztah mentioned this pull request Nov 8, 2019

[release/1.2] Prepare v1.2.11 release containerd/containerd#3811

Merged

thaJeztah mentioned this pull request Nov 8, 2019

[release/1.3] Prepare v1.3.1 release containerd/containerd#3812

Merged

thaJeztah mentioned this pull request Nov 28, 2019

[19.03] Update containerd to v1.2.11, runc v1.0.0-rc9 docker-archive/engine#428

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

*: verify operations on /proc/... are on procfs #2130

*: verify operations on /proc/... are on procfs #2130

cyphar commented Sep 27, 2019 •

edited

Loading

cyphar commented Sep 28, 2019

dqminh commented Sep 29, 2019 •

edited by caniszczyk

Loading

dqminh commented Sep 30, 2019 •

edited by caniszczyk

Loading

crosbymichael commented Sep 30, 2019 •

edited by caniszczyk

Loading

*: verify operations on /proc/... are on procfs #2130

*: verify operations on /proc/... are on procfs #2130

Conversation

cyphar commented Sep 27, 2019 • edited Loading

cyphar commented Sep 28, 2019

dqminh commented Sep 29, 2019 • edited by caniszczyk Loading

dqminh commented Sep 30, 2019 • edited by caniszczyk Loading

crosbymichael commented Sep 30, 2019 • edited by caniszczyk Loading

cyphar commented Sep 27, 2019 •

edited

Loading

dqminh commented Sep 29, 2019 •

edited by caniszczyk

Loading

dqminh commented Sep 30, 2019 •

edited by caniszczyk

Loading

crosbymichael commented Sep 30, 2019 •

edited by caniszczyk

Loading