Skip to content
Permalink
Browse files

Merge pull request #2207 from cyphar/fix-double-volume-attack

rootfs: do not permit /proc mounts to non-directories
  • Loading branch information
mrunalp committed Jan 22, 2020
2 parents f6fb7a0 + 3291d66 commit 2fc03cc11c775b7a8b2e48d7ee447cb9bef32ad0
Showing with 12 additions and 0 deletions.
  1. +12 −0 libcontainer/rootfs_linux.go
@@ -299,6 +299,18 @@ func mountToRootfs(m *configs.Mount, rootfs, mountLabel string, enableCgroupns b

switch m.Device {
case "proc", "sysfs":
// If the destination already exists and is not a directory, we bail
// out This is to avoid mounting through a symlink or similar -- which
// has been a "fun" attack scenario in the past.
// TODO: This won't be necessary once we switch to libpathrs and we can
// stop all of these symlink-exchange attacks.
if fi, err := os.Lstat(dest); err != nil {
if !os.IsNotExist(err) {
return err
}
} else if fi.Mode()&os.ModeDir == 0 {
return fmt.Errorf("filesystem %q must be mounted on ordinary directory", m.Device)
}
if err := os.MkdirAll(dest, 0755); err != nil {
return err
}

0 comments on commit 2fc03cc

Please sign in to comment.
You can’t perform that action at this time.