1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
|
From 5eff67a2c294b7e72607e0949ebc0de21710e4d3 Mon Sep 17 00:00:00 2001
From: Brian Goff <cpuguy83@gmail.com>
Date: Tue, 6 Oct 2020 19:40:30 +0000
Subject: [PATCH] Do not set DOCKER_TMP to be owned by remapped root
The remapped root does not need access to this dir.
Having this owned by the remapped root opens the host up to an
uprivileged user on the host being able to escalate privileges.
While it would not be normal for the remapped UID to be used outside of
the container context, it could happen.
Signed-off-by: Brian Goff <cpuguy83@gmail.com>
(cherry picked from commit bfedd2725971303efb7a2fe5d6990317b381622f)
Signed-off-by: Tibor Vass <tibor@docker.com>
---
daemon/daemon.go | 8 +++-----
1 file changed, 3 insertions(+), 5 deletions(-)
diff --git a/engine/daemon/daemon.go b/engine/daemon/daemon.go
index acc619a6af14..24205cd1dc3d 100644
--- a/engine/daemon/daemon.go
+++ b/engine/daemon/daemon.go
@@ -748,7 +748,7 @@ func NewDaemon(ctx context.Context, config *config.Config, pluginStore *plugin.S
}
// set up the tmpDir to use a canonical path
- tmp, err := prepareTempDir(config.Root, rootIDs)
+ tmp, err := prepareTempDir(config.Root)
if err != nil {
return nil, fmt.Errorf("Unable to get the TempDir under %s: %s", config.Root, err)
}
@@ -1289,7 +1289,7 @@ func (daemon *Daemon) Subnets() ([]net.IPNet, []net.IPNet) {
// prepareTempDir prepares and returns the default directory to use
// for temporary files.
// If it doesn't exist, it is created. If it exists, its content is removed.
-func prepareTempDir(rootDir string, rootIdentity idtools.Identity) (string, error) {
+func prepareTempDir(rootDir string) (string, error) {
var tmpDir string
if tmpDir = os.Getenv("DOCKER_TMPDIR"); tmpDir == "" {
tmpDir = filepath.Join(rootDir, "tmp")
@@ -1307,9 +1307,7 @@ func prepareTempDir(rootDir string, rootIdentity idtools.Identity) (string, erro
}
}
}
- // We don't remove the content of tmpdir if it's not the default,
- // it may hold things that do not belong to us.
- return tmpDir, idtools.MkdirAllAndChown(tmpDir, 0700, rootIdentity)
+ return tmpDir, idtools.MkdirAllAndChown(tmpDir, 0700, idtools.CurrentIdentity())
}
func (daemon *Daemon) setGenericResources(conf *config.Config) error {
|
