mirror of
https://github.com/opencontainers/runc.git
synced 2026-07-11 06:03:57 +08:00
Aleksa Sarai
f2f16213e1
If we leak a file descriptor referencing the host filesystem, an attacker could use a /proc/self/fd magic-link as the source for execve to execute a host binary in the container. This would allow the binary itself (or a process inside the container in the 'runc exec' case) to write to a host binary, leading to a container escape. The simple solution is to make sure we close all file descriptors immediately before the execve(2) step. Doing this earlier can lead to very serious issues in Go (as file descriptors can be reused, any (*os.File) reference could start silently operating on a different file) so we have to do it as late as possible. Unfortunately, there are some Go runtime file descriptors that we must not close (otherwise the Go scheduler panics randomly). The only way of being sure which file descriptors cannot be closed is to sneakily go:linkname the runtime internal "internal/poll.IsPollDescriptor" function. This is almost certainly not recommended but there isn't any other way to be absolutely sure, while also closing any other possible files. In addition, we can keep the logrus forwarding logfd open because you cannot execve a pipe and the contents of the pipe are so restricted (JSON-encoded in a format we pick) that it seems unlikely you could even construct shellcode. Closing the logfd causes issues if there is an error returned from execve. In mainline runc, runc-dmz protects us against this attack because the intermediate execve(2) closes all of the O_CLOEXEC internal runc file descriptors and thus runc-dmz cannot access them to attack the host. Fixes: GHSA-xr7r-f8xq-vfvv CVE-2024-21626 Signed-off-by: Aleksa Sarai <cyphar@cyphar.com>
66 lines
1.5 KiB
Go
66 lines
1.5 KiB
Go
package logs
|
|
|
|
import (
|
|
"bufio"
|
|
"encoding/json"
|
|
"io"
|
|
"os"
|
|
|
|
"github.com/sirupsen/logrus"
|
|
)
|
|
|
|
// IsLogrusFd returns whether the provided fd matches the one that logrus is
|
|
// currently outputting to. This should only ever be called by UnsafeCloseFrom
|
|
// from `runc init`.
|
|
func IsLogrusFd(fd uintptr) bool {
|
|
file, ok := logrus.StandardLogger().Out.(*os.File)
|
|
return ok && file.Fd() == fd
|
|
}
|
|
|
|
func ForwardLogs(logPipe io.ReadCloser) chan error {
|
|
done := make(chan error, 1)
|
|
s := bufio.NewScanner(logPipe)
|
|
|
|
logger := logrus.StandardLogger()
|
|
if logger.ReportCaller {
|
|
// Need a copy of the standard logger, but with ReportCaller
|
|
// turned off, as the logs are merely forwarded and their
|
|
// true source is not this file/line/function.
|
|
logNoCaller := *logrus.StandardLogger()
|
|
logNoCaller.ReportCaller = false
|
|
logger = &logNoCaller
|
|
}
|
|
|
|
go func() {
|
|
for s.Scan() {
|
|
processEntry(s.Bytes(), logger)
|
|
}
|
|
if err := logPipe.Close(); err != nil {
|
|
logrus.Errorf("error closing log source: %v", err)
|
|
}
|
|
// The only error we want to return is when reading from
|
|
// logPipe has failed.
|
|
done <- s.Err()
|
|
close(done)
|
|
}()
|
|
|
|
return done
|
|
}
|
|
|
|
func processEntry(text []byte, logger *logrus.Logger) {
|
|
if len(text) == 0 {
|
|
return
|
|
}
|
|
|
|
var jl struct {
|
|
Level logrus.Level `json:"level"`
|
|
Msg string `json:"msg"`
|
|
}
|
|
if err := json.Unmarshal(text, &jl); err != nil {
|
|
logrus.Errorf("failed to decode %q to json: %v", text, err)
|
|
return
|
|
}
|
|
|
|
logger.Log(jl.Level, jl.Msg)
|
|
}
|