Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
selinux: verify that writes to /proc/... are on procfs
This is an additional mitigation for CVE-2019-16884. The primary problem is that Docker can be coerced into bind-mounting a file system on top of /proc (resulting in label-related writes to /proc no longer happening). While runc is working on mitigations against permitting the mounts, this helps avoid go-selinux from being tricked into writing to non-procfs files. This is not a perfect solution (after all, there might be a bind-mount of a different procfs file over the target) but in order to exploit that you would need to be able to tweak a config.json pretty specifically (which thankfully Docker doesn't allow). Signed-off-by: Aleksa Sarai <cyphar@cyphar.com>
- Loading branch information