From fdcc9d3cad2f85954a241ccb910a61aaa1ef47f3 Mon Sep 17 00:00:00 2001 From: Aleksa Sarai Date: Fri, 20 Jun 2025 15:41:51 +1000 Subject: [PATCH] apparmor: use safe procfs API for labels EnsureProcHandle only protects us against a tmpfs mount, but the risk of a procfs path being used (such as /proc/self/sched) has been known for a while. Now that filepath-securejoin has a reasonably safe procfs API, switch to it. Fixes: GHSA-cgrx-mc8f-2prm CVE-2025-52881 Signed-off-by: Aleksa Sarai --- libcontainer/apparmor/apparmor_linux.go | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/libcontainer/apparmor/apparmor_linux.go b/libcontainer/apparmor/apparmor_linux.go index 10da91b3c..9f0f7b9aa 100644 --- a/libcontainer/apparmor/apparmor_linux.go +++ b/libcontainer/apparmor/apparmor_linux.go @@ -6,6 +6,9 @@ import ( "os" "sync" + "golang.org/x/sys/unix" + + "github.com/opencontainers/runc/internal/pathrs" "github.com/opencontainers/runc/libcontainer/utils" ) @@ -36,15 +39,15 @@ func setProcAttr(attr, value string) error { // Under AppArmor you can only change your own attr, so there's no reason // to not use /proc/thread-self/ (instead of /proc//, like libapparmor // does). - attrPath, closer := utils.ProcThreadSelf(attrSubPath) - defer closer() - - f, err := os.OpenFile(attrPath, os.O_WRONLY, 0) + f, closer, err := pathrs.ProcThreadSelfOpen(attrSubPath, unix.O_WRONLY|unix.O_CLOEXEC) if err != nil { return err } + defer closer() defer f.Close() + // NOTE: This is not really necessary since securejoin.ProcThreadSelf + // verifies this in a far stricter sense than EnsureProcHandle. if err := utils.EnsureProcHandle(f); err != nil { return err }