Package: lxc / 1:3.1.0+really3.0.3-8

Metadata

Package Version Patches format
lxc 1:3.1.0+really3.0.3-8 3.0 (quilt)

Patch series

view the series file
Patch File delta Description
0001 apparmor profile generation.patch | (download)

configure.ac | 8 8 + 0 - 0 !
src/lxc/Makefile.am | 1 1 + 0 - 0 !
src/lxc/conf.c | 43 41 + 2 - 0 !
src/lxc/conf.h | 8 7 + 1 - 0 !
src/lxc/confile.c | 95 95 + 0 - 0 !
src/lxc/criu.c | 3 2 + 1 - 0 !
src/lxc/lsm/apparmor.c | 973 930 + 43 - 0 !
src/lxc/lsm/lsm.c | 30 28 + 2 - 0 !
src/lxc/lsm/lsm.h | 8 6 + 2 - 0 !
src/lxc/lsm/nop.c | 2 1 + 1 - 0 !
src/lxc/lsm/selinux.c | 4 1 + 3 - 0 !
src/lxc/start.c | 14 13 + 1 - 0 !
12 files changed, 1133 insertions(+), 56 deletions(-)

 apparmor: profile generation

This copies lxd's apparmor profile generation. This tries to
detect features such as cgroup namespaces, apparmor
namespaces and stacking support, and has profile parts
conditionally for unprivileged containers.

This introduces the following changes to the configuration:
  lxc.apparmor.profile = generated
    The fixed value 'generated' will cause this
    functionality to be used, otherwise there should be no
    functional changes happening unless specifically
    requested with the next key:
  lxc.apparmor.allow_nesting
    This is a boolean which, if enabled, causes the
    following changes: When generated apparmor profiles are
    used, they will contain the necessary changes to allow
    creating a nested container. In addition to the usual
    mount points, /dev/.lxc/proc and /dev/.lxc/sys will
    contain procfs and sysfs mount points without the lxcfs
    overlays, which, if generated apparmor profiles are
    being used, will not be read/writable directly.
  lxc.apparmor.raw
    A list of raw apparmor profile lines to append to the
    profile. Only valid when using generated profiles.

The following apparmor profile lines have not been copied
from lxd:

  mount /var/lib/lxd/shmounts/ -> /var/lib/lxd/shmounts/,
  mount none -> /var/lib/lxd/shmounts/,
  mount options=bind /var/lib/lxd/shmounts/** -> /var/lib/lxd/**,

They should be added via lxc.apparmor.raw entries by lxd.

In order for apparmor_parser's cache to be of use, this adds
a --with-apparmor-cache-dir ./configure option.

Signed-off-by: Wolfgang Bumiller <w.bumiller@proxmox.com>

0002 tests add test for generated apparmor profiles.patch | (download)

src/tests/Makefile.am | 2 2 + 0 - 0 !
src/tests/lxc-test-apparmor-generated | 84 84 + 0 - 0 !
2 files changed, 86 insertions(+)

 tests: add test for generated apparmor profiles

Signed-off-by: Wolfgang Bumiller <w.bumiller@proxmox.com>

0003 apparmor allow various remount bind options.patch | (download)

config/apparmor/abstractions/container-base | 10 10 + 0 - 0 !
config/apparmor/abstractions/container-base.in | 11 10 + 1 - 0 !
src/lxc/lsm/apparmor.c | 26 9 + 17 - 0 !
3 files changed, 29 insertions(+), 18 deletions(-)

 apparmor: allow various remount,bind options

RW bind mounts need to be restricted for some paths in
order to avoid MAC restriction bypasses, but read-only bind
mounts shouldn't have that problem.

Additionally, combinations of 'nosuid', 'nodev' and
'noexec' flags shouldn't be a problem either and are
required with newer systemd versions, so let's allow those
as long as they're combined with 'ro,remount,bind'.

Signed-off-by: Wolfgang Bumiller <w.bumiller@proxmox.com>

0004 CVE 2019 5736 runC rexec callers as memfd.patch | (download)

configure.ac | 12 12 + 0 - 0 !
src/lxc/Makefile.am | 4 4 + 0 - 0 !
src/lxc/file_utils.c | 41 40 + 1 - 0 !
src/lxc/file_utils.h | 1 1 + 0 - 0 !
src/lxc/rexec.c | 181 181 + 0 - 0 !
src/lxc/syscall_wrappers.h | 14 14 + 0 - 0 !
6 files changed, 252 insertions(+), 1 deletion(-)

 cve-2019-5736 (runc): rexec callers as memfd
MIME-Version: 1.0
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: 8bit

MIME-Version: 1.0
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: 8bit

Adam Iwaniuk and Borys Popławski discovered that an attacker can compromise the
runC host binary from inside a privileged runC container. As a result, this
could be exploited to gain root access on the host. runC is used as the default
runtime for containers with Docker, containerd, Podman, and CRI-O.

The attack can be made when attaching to a running container or when starting a
container running a specially crafted image.  For example, when runC attaches
to a container the attacker can trick it into executing itself. This could be
done by replacing the target binary inside the container with a custom binary
pointing back at the runC binary itself. As an example, if the target binary
was /bin/bash, this could be replaced with an executable script specifying the
interpreter path #!/proc/self/exe (/proc/self/exec is a symbolic link created
by the kernel for every process which points to the binary that was executed
for that process). As such when /bin/bash is executed inside the container,
instead the target of /proc/self/exe will be executed - which will point to the
runc binary on the host. The attacker can then proceed to write to the target
of /proc/self/exe to try and overwrite the runC binary on the host. However in
general, this will not succeed as the kernel will not permit it to be
overwritten whilst runC is executing. To overcome this, the attacker can
instead open a file descriptor to /proc/self/exe using the O_PATH flag and then
proceed to reopen the binary as O_WRONLY through /proc/self/fd/<nr> and try to
write to it in a busy loop from a separate process. Ultimately it will succeed
when the runC binary exits. After this the runC binary is compromised and can
be used to attack other containers or the host itself.

This attack is only possible with privileged containers since it requires root
privilege on the host to overwrite the runC binary. Unprivileged containers
with a non-identity ID mapping do not have the permission to write to the host
binary and therefore are unaffected by this attack.

LXC is also impacted in a similar manner by this vulnerability, however as the
LXC project considers privileged containers to be unsafe no CVE has been
assigned for this issue for LXC. Quoting from the
https://linuxcontainers.org/lxc/security/ project's Security information page:

"As privileged containers are considered unsafe, we typically will not consider
new container escape exploits to be security issues worthy of a CVE and quick
fix. We will however try to mitigate those issues so that accidental damage to
the host is prevented."

To prevent this attack, LXC has been patched to create a temporary copy of the
calling binary itself when it starts or attaches to containers. To do this LXC
creates an anonymous, in-memory file using the memfd_create() system call and
copies itself into the temporary in-memory file, which is then sealed to
prevent further modifications. LXC then executes this sealed, in-memory file
instead of the original on-disk binary. Any compromising write operations from
a privileged container to the host LXC binary will then write to the temporary
in-memory binary and not to the host binary on-disk, preserving the integrity
of the host LXC binary. Also as the temporary, in-memory LXC binary is sealed,
writes to this will also fail.

Note: memfd_create() was added to the Linux kernel in the 3.17 release.

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Co-Developed-by: Aleksa Sarai <asarai@suse.de>
0005 rexec make rexecution opt in for library callers.patch | (download)

src/lxc/Makefile.am | 4 3 + 1 - 0 !
src/lxc/rexec.c | 4 2 + 2 - 0 !
src/lxc/rexec.h | 26 26 + 0 - 0 !
src/lxc/tools/lxc_attach.c | 18 18 + 0 - 0 !
4 files changed, 49 insertions(+), 3 deletions(-)

 rexec: make rexecution opt-in for library callers
MIME-Version: 1.0
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: 8bit

MIME-Version: 1.0
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: 8bit

We cannot rexecute the liblxc shared library unconditionally as this would
break most of our downstreams. Here are some scenarios:
- anyone performing a dlopen() on the shared library (e.g. users of the LXC
  Python bindings)
- LXD as it needs to know the absolute path to its own executable based on
  /proc/self/exe etc.

This commit makes the rexecution of liblxc conditional on whether the
LXC_MEMFD_REXEC environment variable is set or not. If it is then liblxc is
unconditionally rexecuted.

The only relevant attack vector exists for lxc-attach which we simply reexecute
unconditionally.

Reported-by: Stéphane Graber <stgraber@ubuntu.com>
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>