netbird/gvisor
0
0
Fork 0
mirror of https://github.com/netbirdio/gvisor.git synced 2026-05-22 17:12:49 -07:00
Code Issues Packages Projects Releases Wiki Activity

Only allow host openat(2) syscalls with O_NOFOLLOW with directfs.

Browse Source 
Updates the directfs seccomp filters to ensure that all openat(2) host syscalls
have O_NOFOLLOW bit set. This would ensure that we don't follow a symlink in
the host filesystem by mistake.

The gofer client currently always uses O_NOFOLLOW. But this will help prevent
any malicious usage of openat(2) if the sandbox is compromised somehow.

The container filesystem is well-isolated from the host filesystems using
pivot_root(2). So following a host symlink from sandbox context should still
not escape the container. But this provides an additional layer of security.

PiperOrigin-RevId: 523839219
This commit is contained in:
Ayush Ranjan
2023-04-12 16:42:49 -07:00
committed by gVisor bot
parent f515471c3f
commit 114a033bd0
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
runsc/boot/filter/config.go
+1 -1
View File
@@ -416,7 +416,7 @@ func hostFilesystemFilters() seccomp.SyscallRules {
{
validFDCheck,
seccomp.MatchAny{},
seccomp.MatchAny{},
seccomp.MaskedEqual(unix.O_NOFOLLOW, unix.O_NOFOLLOW),
seccomp.MatchAny{},
},
},