mirror/runc
1
0
Fork 0
mirror of https://github.com/opencontainers/runc.git synced 2026-07-10 21:53:57 +08:00
Code Issues Packages Projects Releases Wiki Activity

libct: close rootFd ASAP in maskPaths

Browse Source 
Close the root file descriptor immediately after use in maskPaths to
reduce the window during which an attacker could potentially exploit
an open fd to access or manipulate the root filesystem. This follows
the principle of least privilege and mitigates risks in compromised
or malicious container scenarios.

Co-authored-by: Kir Kolyshkin <kolyshkin@gmail.com>
Signed-off-by: lifubang <lifubang@acmcoder.com>
This commit is contained in:
lifubang
2026-05-16 04:40:37 +00:00
parent e7e2f00248
commit b88635e57e
2 changed files with 12 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files
libcontainer/rootfs_linux.go
+9 -1
View File
@@ -1338,7 +1338,10 @@ func maskDir(path, mountLabel string) error {
// mounts ( proc/kcore ). // mounts ( proc/kcore ).
// For files, maskPath bind mounts /dev/null over the top of the specified path. // For files, maskPath bind mounts /dev/null over the top of the specified path.
// For directories, maskPath mounts read-only tmpfs over the top of the specified path. // For directories, maskPath mounts read-only tmpfs over the top of the specified path.
func maskPaths(rootFd *os.File, paths []string, mountLabel string) error { func maskPaths(rootFs string, paths []string, mountLabel string) error {
if len(paths) == 0 {
return nil
}
devNull, err := os.OpenFile("/dev/null", unix.O_PATH, 0) devNull, err := os.OpenFile("/dev/null", unix.O_PATH, 0)
if err != nil { if err != nil {
return fmt.Errorf("can't mask paths: %w", err) return fmt.Errorf("can't mask paths: %w", err)
@@ -1405,7 +1408,12 @@ func maskPaths(rootFd *os.File, paths []string, mountLabel string) error {
// resolves the underlying inode via procfs and re-opens it through // resolves the underlying inode via procfs and re-opens it through
// rootFd, so the resulting fd is anchored to the real path inside the // rootFd, so the resulting fd is anchored to the real path inside the
// container rootfs even if path was a /proc/self/fd/N alias. // container rootfs even if path was a /proc/self/fd/N alias.
rootFd, err := os.OpenFile(rootFs, unix.O_DIRECTORY|unix.O_CLOEXEC|unix.O_PATH, 0)
if err != nil {
return fmt.Errorf("open rootfs handle for masked paths: %w", err)
}
reopened, err := reopenAfterMount(rootFd, dstFh, unix.O_PATH|unix.O_CLOEXEC) reopened, err := reopenAfterMount(rootFd, dstFh, unix.O_PATH|unix.O_CLOEXEC)
rootFd.Close()
if err != nil { if err != nil {
return fmt.Errorf("can't reopen shared directory mask: %w", err) return fmt.Errorf("can't reopen shared directory mask: %w", err)
} }
libcontainer/standard_init_linux.go
+3 -10
View File
@@ -142,17 +142,10 @@ func (l *linuxStandardInit) Init() error {
} }
} }
if len(l.config.Config.MaskPaths) > 0 { if err := maskPaths("/", l.config.Config.MaskPaths, l.config.Config.MountLabel); err != nil {
rootFd, err := os.OpenFile("/", unix.O_DIRECTORY|unix.O_CLOEXEC|unix.O_PATH, 0) return err
if err != nil {
return fmt.Errorf("open rootfs handle for masked paths: %w", err)
}
err = maskPaths(rootFd, l.config.Config.MaskPaths, l.config.Config.MountLabel)
rootFd.Close()
if err != nil {
return err
}
} }
pdeath, err := system.GetParentDeathSignal() pdeath, err := system.GetParentDeathSignal()
if err != nil { if err != nil {
return fmt.Errorf("can't get pdeath signal: %w", err) return fmt.Errorf("can't get pdeath signal: %w", err)