[arch-commits] Commit in runc/repos/community-x86_64 (3 files)

Morten Linderud foxboron at archlinux.org
Mon Feb 11 13:22:00 UTC 2019


    Date: Monday, February 11, 2019 @ 13:21:59
  Author: foxboron
Revision: 431738

archrelease: copy trunk to community-x86_64

Added:
  runc/repos/community-x86_64/0001-nsenter-clone-proc-self-exe-to-avoid-exposing-host-b.patch
    (from rev 431737, runc/trunk/0001-nsenter-clone-proc-self-exe-to-avoid-exposing-host-b.patch)
  runc/repos/community-x86_64/PKGBUILD
    (from rev 431737, runc/trunk/PKGBUILD)
Deleted:
  runc/repos/community-x86_64/PKGBUILD

-----------------------------------------------------------------+
 0001-nsenter-clone-proc-self-exe-to-avoid-exposing-host-b.patch |  304 ++++++++++
 PKGBUILD                                                        |   90 +-
 2 files changed, 354 insertions(+), 40 deletions(-)

Copied: runc/repos/community-x86_64/0001-nsenter-clone-proc-self-exe-to-avoid-exposing-host-b.patch (from rev 431737, runc/trunk/0001-nsenter-clone-proc-self-exe-to-avoid-exposing-host-b.patch)
===================================================================
--- 0001-nsenter-clone-proc-self-exe-to-avoid-exposing-host-b.patch	                        (rev 0)
+++ 0001-nsenter-clone-proc-self-exe-to-avoid-exposing-host-b.patch	2019-02-11 13:21:59 UTC (rev 431738)
@@ -0,0 +1,304 @@
+From 604a8f8120ef128c0a5bc778e71909eeb0906842 Mon Sep 17 00:00:00 2001
+From: Aleksa Sarai <asarai at suse.de>
+Date: Wed, 9 Jan 2019 13:40:01 +1100
+Subject: [PATCH] nsenter: clone /proc/self/exe to avoid exposing host binary
+ to container
+
+There are quite a few circumstances where /proc/self/exe pointing to a
+pretty important container binary is a _bad_ thing, so to avoid this we
+have to make a copy (preferably doing self-clean-up and not being
+writeable).
+
+As a hotfix we require memfd_create(2), but we can always extend this to
+use a scratch MNT_DETACH overlayfs or tmpfs. The main downside to this
+approach is no page-cache sharing for the runc binary (which overlayfs
+would give us) but this is far less complicated.
+
+This is only done during nsenter so that it happens transparently to the
+Go code, and any libcontainer users benefit from it. This also makes
+ExtraFiles and --preserve-fds handling trivial (because we don't need to
+worry about it).
+
+Fixes: CVE-2019-5736
+Signed-off-by: Aleksa Sarai <asarai at suse.de>
+---
+ libcontainer/nsenter/cloned_binary.c | 236 +++++++++++++++++++++++++++
+ libcontainer/nsenter/nsexec.c        |  11 ++
+ 2 files changed, 247 insertions(+)
+ create mode 100644 libcontainer/nsenter/cloned_binary.c
+
+diff --git a/libcontainer/nsenter/cloned_binary.c b/libcontainer/nsenter/cloned_binary.c
+new file mode 100644
+index 000000000000..ec383c173dd2
+--- /dev/null
++++ b/libcontainer/nsenter/cloned_binary.c
+@@ -0,0 +1,236 @@
++#define _GNU_SOURCE
++#include <unistd.h>
++#include <stdio.h>
++#include <stdlib.h>
++#include <stdbool.h>
++#include <string.h>
++#include <limits.h>
++#include <fcntl.h>
++
++#include <sys/types.h>
++#include <sys/stat.h>
++#include <sys/vfs.h>
++#include <sys/mman.h>
++#include <sys/sendfile.h>
++#include <sys/syscall.h>
++
++#include <linux/magic.h>
++#include <linux/memfd.h>
++
++#define MEMFD_COMMENT "runc_cloned:/proc/self/exe"
++#define MEMFD_LNKNAME "/memfd:" MEMFD_COMMENT " (deleted)"
++
++/* Use our own wrapper for memfd_create. */
++#if !defined(SYS_memfd_create) && defined(__NR_memfd_create)
++#  define SYS_memfd_create __NR_memfd_create
++#endif
++#ifndef SYS_memfd_create
++#  error "memfd_create(2) syscall not supported by this glibc version"
++#endif
++int memfd_create(const char *name, unsigned int flags)
++{
++	return syscall(SYS_memfd_create, name, flags);
++}
++
++/* This comes directly from <linux/fcntl.h>. */
++#ifndef F_LINUX_SPECIFIC_BASE
++# define F_LINUX_SPECIFIC_BASE 1024
++#endif
++#ifndef F_ADD_SEALS
++# define F_ADD_SEALS (F_LINUX_SPECIFIC_BASE + 9)
++# define F_GET_SEALS (F_LINUX_SPECIFIC_BASE + 10)
++#endif
++#ifndef F_SEAL_SEAL
++# define F_SEAL_SEAL   0x0001	/* prevent further seals from being set */
++# define F_SEAL_SHRINK 0x0002	/* prevent file from shrinking */
++# define F_SEAL_GROW   0x0004	/* prevent file from growing */
++# define F_SEAL_WRITE  0x0008	/* prevent writes */
++#endif
++
++/*
++ * Verify whether we are currently in a self-cloned program. It's not really
++ * possible to trivially identify a memfd compared to a regular tmpfs file, so
++ * the best we can do is to check whether the readlink(2) looks okay and that
++ * it is on a tmpfs.
++ */
++static int is_self_cloned(void)
++{
++	struct statfs statfsbuf = {0};
++	char linkname[PATH_MAX + 1] = {0};
++
++	if (statfs("/proc/self/exe", &statfsbuf) < 0)
++		return -1;
++	if (readlink("/proc/self/exe", linkname, PATH_MAX) < 0)
++		return -1;
++
++	return statfsbuf.f_type == TMPFS_MAGIC &&
++		!strncmp(linkname, MEMFD_LNKNAME, PATH_MAX);
++}
++
++/*
++ * Basic wrapper around mmap(2) that gives you the file length so you can
++ * safely treat it as an ordinary buffer. Only gives you read access.
++ */
++static char *read_file(char *path, size_t *length)
++{
++	int fd;
++	char buf[4096], *copy = NULL;
++
++	if (!length)
++		goto err;
++	*length = 0;
++
++	fd = open(path, O_RDONLY|O_CLOEXEC);
++	if (fd < 0)
++		goto err_free;
++
++	for (;;) {
++		int n;
++		char *old = copy;
++
++		n = read(fd, buf, sizeof(buf));
++		if (n < 0)
++			goto err_fd;
++		if (!n)
++			break;
++
++		do {
++			copy = realloc(old, (*length + n) * sizeof(*old));
++		} while(!copy);
++
++		memcpy(copy + *length, buf, n);
++		*length += n;
++	}
++	close(fd);
++	return copy;
++
++err_fd:
++	close(fd);
++err_free:
++	free(copy);
++err:
++	return NULL;
++}
++
++/*
++ * A poor-man's version of "xargs -0". Basically parses a given block of
++ * NUL-delimited data, within the given length and adds a pointer to each entry
++ * to the array of pointers.
++ */
++static int parse_xargs(char *data, int data_length, char ***output)
++{
++	int num = 0;
++	char *cur = data;
++
++	if (!data || *output)
++		return -1;
++
++	do {
++		*output = malloc(sizeof(**output));
++	} while (!*output);
++
++	while (cur < data + data_length) {
++		char **old = *output;
++
++		num++;
++		do {
++			*output = realloc(old, (num + 1) * sizeof(*old));
++		} while (!*output);
++
++		(*output)[num - 1] = cur;
++		cur += strlen(cur) + 1;
++	}
++	(*output)[num] = NULL;
++	return num;
++}
++
++/*
++ * "Parse" out argv and envp from /proc/self/cmdline and /proc/self/environ.
++ * This is necessary because we are running in a context where we don't have a
++ * main() that we can just get the arguments from.
++ */
++static int fetchve(char ***argv, char ***envp)
++{
++	char *cmdline, *environ;
++	size_t cmdline_size, environ_size;
++
++	cmdline = read_file("/proc/self/cmdline", &cmdline_size);
++	if (!cmdline)
++		goto err;
++	environ = read_file("/proc/self/environ", &environ_size);
++	if (!environ)
++		goto err_free;
++
++	if (parse_xargs(cmdline, cmdline_size, argv) <= 0)
++		goto err_free_both;
++	if (parse_xargs(environ, environ_size, envp) <= 0)
++		goto err_free_both;
++
++	return 0;
++
++err_free_both:
++	free(environ);
++err_free:
++	free(cmdline);
++err:
++	return -1;
++}
++
++static int clone_binary(void)
++{
++	int binfd, memfd, err;
++	ssize_t sent = 0;
++	struct stat statbuf = {0};
++
++	binfd = open("/proc/self/exe", O_RDONLY|O_CLOEXEC);
++	if (binfd < 0)
++		goto err;
++	if (fstat(binfd, &statbuf) < 0)
++		goto err_binfd;
++
++	memfd = memfd_create(MEMFD_COMMENT, MFD_CLOEXEC|MFD_ALLOW_SEALING);
++	if (memfd < 0)
++		goto err_binfd;
++
++	while (sent < statbuf.st_size) {
++		ssize_t n = sendfile(memfd, binfd, NULL, statbuf.st_size - sent);
++		if (n < 0)
++			goto err_memfd;
++		sent += n;
++	}
++
++	err = fcntl(memfd, F_ADD_SEALS, F_SEAL_SHRINK|F_SEAL_GROW|F_SEAL_WRITE|F_SEAL_SEAL);
++	if (err < 0)
++		goto err_memfd;
++
++	close(binfd);
++	return memfd;
++
++err_memfd:
++	close(memfd);
++err_binfd:
++	close(binfd);
++err:
++	return -1;
++}
++
++int ensure_cloned_binary(void)
++{
++	int execfd;
++	char **argv = NULL, **envp = NULL;
++
++	/* Check that we're not self-cloned, and if we are then bail. */
++	int cloned = is_self_cloned();
++	if (cloned != 0)
++		return cloned;
++
++	if (fetchve(&argv, &envp) < 0)
++		return -1;
++
++	execfd = clone_binary();
++	if (execfd < 0)
++		return -1;
++
++	fexecve(execfd, argv, envp);
++	return -1;
++}
+diff --git a/libcontainer/nsenter/nsexec.c b/libcontainer/nsenter/nsexec.c
+index 28269dfc027f..4fdfec1b7b89 100644
+--- a/libcontainer/nsenter/nsexec.c
++++ b/libcontainer/nsenter/nsexec.c
+@@ -534,6 +534,9 @@ void join_namespaces(char *nslist)
+ 	free(namespaces);
+ }
+ 
++/* Defined in cloned_binary.c. */
++int ensure_cloned_binary(void);
++
+ void nsexec(void)
+ {
+ 	int pipenum;
+@@ -549,6 +552,14 @@ void nsexec(void)
+ 	if (pipenum == -1)
+ 		return;
+ 
++	/*
++	 * We need to re-exec if we are not in a cloned binary. This is necessary
++	 * to ensure that containers won't be able to access the host binary
++	 * through /proc/self/exe. See CVE-2019-5736.
++	 */
++	if (ensure_cloned_binary() < 0)
++		bail("could not ensure we are a cloned binary");
++
+ 	/* Parse all of the netlink configuration. */
+ 	nl_parse(pipenum, &config);
+ 
+-- 
+2.20.1
+
+

Deleted: PKGBUILD
===================================================================
--- PKGBUILD	2019-02-11 13:21:48 UTC (rev 431737)
+++ PKGBUILD	2019-02-11 13:21:59 UTC (rev 431738)
@@ -1,40 +0,0 @@
-# Maintainer: Sébastien "Seblu" Luttringer
-
-pkgname=runc
-pkgver=1.0.0rc5+168+g079817cc
-pkgrel=1
-pkgdesc='CLI tool for managing OCI compliant containers'
-arch=(x86_64)
-url='https://runc.io/'
-license=(Apache)
-depends=(glibc libseccomp)
-makedepends=(git go-pie go-md2man)
-_commit=079817cc26ec5292ac375bb9f47f373d33574949  # master
-source=(git+https://github.com/opencontainers/runc.git#commit=$_commit)
-md5sums=('SKIP')
-
-pkgver() {
-  cd runc
-  git describe | sed 's/^v//;s/-//;s/-/+/g'
-}
-
-prepare() {
-  mkdir -p src/github.com/opencontainers
-  cp -r runc src/github.com/opencontainers/
-}
-
-build() {
-  cd src/github.com/opencontainers/runc
-  GOPATH="$srcdir" BUILDTAGS='seccomp' make runc man
-}
-
-package() {
-  cd src/github.com/opencontainers/runc
-
-  install -Dm755 runc "$pkgdir/usr/bin/runc"
-  install -Dm644 contrib/completions/bash/runc \
-    "$pkgdir/usr/share/bash-completion/completions/runc"
-  
-  install -d "$pkgdir/usr/share/man/man8"
-  install -m644 man/man8/*.8 "$pkgdir/usr/share/man/man8"
-}

Copied: runc/repos/community-x86_64/PKGBUILD (from rev 431737, runc/trunk/PKGBUILD)
===================================================================
--- PKGBUILD	                        (rev 0)
+++ PKGBUILD	2019-02-11 13:21:59 UTC (rev 431738)
@@ -0,0 +1,50 @@
+# Maintainer: Morten Linderud <foxboron at archlinux.org>
+# Contributor: Sébastien "Seblu" Luttringer
+
+pkgname=runc
+pkgver=1.0.0rc6
+pkgrel=1
+pkgdesc='CLI tool for managing OCI compliant containers'
+arch=(x86_64)
+url='https://runc.io/'
+license=(Apache)
+depends=(libseccomp)
+makedepends=(git go-pie go-md2man)
+_commit=ccb5efd37fb7c86364786e9137e22948751de7ed
+source=("git+https://github.com/opencontainers/runc.git#commit=$_commit?signed"
+		"0001-nsenter-clone-proc-self-exe-to-avoid-exposing-host-b.patch")
+validpgpkeys=("5F36C6C61B5460124A75F5A69E18AA267DDB8DB4")
+sha256sums=('SKIP'
+            '327ee5b857062d53527701e70ae86a0614732e11b9000ab7a69f9e32981717c6')
+
+pkgver() {
+  cd runc
+  git describe | sed 's/^v//;s/-//;s/-/+/g'
+}
+
+prepare() {
+  mkdir -p src/github.com/opencontainers
+  cp -r runc src/github.com/opencontainers/
+  cd src/github.com/opencontainers/runc
+  patch -Np1 -i "${srcdir}/0001-nsenter-clone-proc-self-exe-to-avoid-exposing-host-b.patch"
+}
+
+build() {
+  cd src/github.com/opencontainers/runc
+  export EXTRA_FLAGS="-gcflags all=-trimpath=${PWD} -asmflags all=-trimpath=${PWD}"
+  export GOPATH="$srcdir"
+  export EXTRA_LDFLAGS="-extldflags ${LDFLAGS}"
+  export BUILDTAGS='seccomp'
+  make runc man
+}
+
+package() {
+  cd src/github.com/opencontainers/runc
+
+  install -Dm755 runc "$pkgdir/usr/bin/runc"
+  install -Dm644 contrib/completions/bash/runc \
+    "$pkgdir/usr/share/bash-completion/completions/runc"
+  
+  install -d "$pkgdir/usr/share/man/man8"
+  install -m644 man/man8/*.8 "$pkgdir/usr/share/man/man8"
+}



More information about the arch-commits mailing list