[WIP] CVE-2019-16884: container: use open fd to host /proc and /sys

[giuseppe]

use an open fd to refer to the host /proc and /sys when setting up the
SELinux and the AppArmor labels.

Addresses CVE-2019-16884.

Signed-off-by: Giuseppe Scrivano giuseppe@scrivano.org

[giuseppe]

marked as WIP as I've only tested the SELinux part so far.

/CC @crosbymichael @cyphar @rhatdan

[lgtm-com]

This pull request introduces 1 alert when merging 93b4bac into 423bc44 - view on LGTM.com

new alerts:

• 1 for Lossy pointer cast

[cyphar]

I really don't like the idea of using a host mountpoint for this -- it means that any possible bug which causes the fd to be leaked into the container allows for full access to the host filesystem. If stashing away an fd to the container's /proc mount is out of the question (if conmon was integrated into crun -- effectively copying the LXC model for container management -- this would be trivial) then at the very least this should be done with fds to the specific files that need to be written to instead of passing directory fds.

(As an aside, the new mount API would allow you to do this even more trivially by doing fsopen("proc") -- but obviously this would massively limit the number of kernels you could run on.)