netbird/gvisor
0
0
Fork 0
mirror of https://github.com/netbirdio/gvisor.git synced 2026-05-22 17:12:49 -07:00
Code Issues Packages Projects Releases Wiki Activity

gofer: prevent access to the whole proc fs via procSelfFD

Browse Source
This commit is contained in:
Andrei Vagin
2023-03-14 16:24:05 -07:00
parent 6f76978048
commit 54a66a6639
1 changed files with 6 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
runsc/cmd/gofer.go
+6
View File
@@ -401,6 +401,12 @@ func setupRootFS(spec *specs.Spec, conf *config.Config) error {
if err := unix.Mount("runsc-proc", "/proc/proc", "proc", flags|unix.MS_RDONLY, ""); err != nil {
util.Fatalf("error mounting proc: %v", err)
}
// self/fd is bind-mounted, so that the FD return by
// OpenProcSelfFD() does not allow escapes with walking ".." .
if err := unix.Mount("/proc/proc/self/fd", "/proc/proc/self/fd",
"", unix.MS_RDONLY|unix.MS_BIND|unix.MS_NOEXEC, ""); err != nil {
util.Fatalf("error mounting proc/self/fd: %v", err)
}
if err := copyFile("/proc/etc/localtime", "/etc/localtime"); err != nil {
log.Warningf("Failed to copy /etc/localtime: %v. UTC timezone will be used.", err)
}