Add leaky vessels policy

[shaneboulden]

A policy for CVE-2024-21626, described here: https://access.redhat.com/security/cve/cve-2024-21626

You can test this image with a simple Containerfile:

FROM registry.access.redhat.com/ubi9/ubi

WORKDIR /proc/self/fd/7

A roxctl image check will then show that the image is vulnerable:

+--------------------------------+----------+--------------+--------------------------------+--------------------------------------+--------------------------------+
| Leaky Vessels: runc container  |   HIGH   |      -       |      CVE-2024-21626 is a       |      - Dockerfile line 'WORKDIR      |      Remove Containerfile      |
|            breakout            |          |              |   vulnerability in the runc    |        /proc/self/fd/7' found        |   lines resembling 'WORKDIR    |
|                                |          |              |   container runtime allowing   |                                      |  /proc/self/fd/[ID]' (with ID  |
|                                |          |              |  an attacker to break out of   |                                      | being a system dependent file  |
|                                |          |              |  the container isolation and   |                                      |          descriptor)           |
|                                |          |              |  achieve full root RCE via a   |                                      |                                |
|                                |          |              |  crafted image that exploits   |                                      |                                |
|                                |          |              |  an issue within the WORKDIR   |                                      |                                |
|                                |          |              |    instruction's handling.     |                                      |                                |
+--------------------------------+----------+--------------+--------------------------------+--------------------------------------+--------------------------------+

[srcporter]

Nice, thanks for the quick policy