interfaces/builtin: add add exec "/" to docker-support #6610
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
jdstrand
approved these changes
Mar 15, 2019
There was a problem hiding this comment.
This weird access has to do with memfd sealing. There is a kernel issue where the path is not visible to AppArmor and (we believe) because we're using attach_disconnected, it gets mapped to /. The same access was needed for greengrass. For now this is fine to add, but can you create a bug against the apparmor project and reference LP: #... here?
With @anonymouse64 filing a bug against apparmor, that is enough for jj to look into and escalate if it is a larger kernel/LSM issue as needed (it might be apparmor-specific, don't know yet). |
This access is needed to allow recent versions of runC inside docker 18.06.3 and 18.09.3 to run properly. Note that the snap is not affected by CVE-2019-5736 directly, but this access is needed so that the mitigation works properly. Signed-off-by: Ian Johnson <ian.johnson@canonical.com>
anonymouse64
force-pushed
the
bugfix/docker-support-runc-cve-2019-5736
branch
from
42f60f9
to
616333e
Compare
|
I filed apparmor bug https://bugs.launchpad.net/apparmor/+bug/1820344 for this |
zyga
reviewed
Mar 16, 2019
Co-Authored-By: anonymouse64 <person.uwsome@gmail.com>
Codecov Report
@@ Coverage Diff @@
## master #6610 +/- ##
==========================================
+ Coverage 79.16% 79.22% +0.05%
==========================================
Files 592 592
Lines 45461 45464 +3
==========================================
+ Hits 35991 36017 +26
+ Misses 6559 6532 -27
- Partials 2911 2915 +4
Continue to review full report at Codecov.
|
tianon
added a commit
to infosiftr/snapd
that referenced
this pull request
Jul 10, 2019
Newer runC applied further improvements to their CVE-2019-5736 mitigation in opencontainers/runc#1984 which change the nature of our apparmor denial from `/` to `/bin/runc` (which I have also commented on https://bugs.launchpad.net/apparmor/+bug/1820344 about). See also canonical#6610. Signed-off-by: Tianon Gravi <tianon@debian.org>
tianon
added a commit
to infosiftr/snapd
that referenced
this pull request
Jul 11, 2019
Newer runC applied further improvements to their CVE-2019-5736 mitigation in opencontainers/runc#1984 which change the nature of our apparmor denial from `/` to `/bin/runc` (which I have also commented on https://bugs.launchpad.net/apparmor/+bug/1820344 about). See also canonical#6610. Signed-off-by: Tianon Gravi <tianon@debian.org>
tianon
added a commit
to infosiftr/snapd
that referenced
this pull request
Jul 12, 2019
Newer runC applied further improvements to their CVE-2019-5736 mitigation in opencontainers/runc#1984 which change the nature of our apparmor denial from `/` to `/bin/runc` (which I have also commented on https://bugs.launchpad.net/apparmor/+bug/1820344 about). See also canonical#6610. Signed-off-by: Tianon Gravi <tianon@debian.org>
anonymouse64
added a commit
to anonymouse64/snapd
that referenced
this pull request
Jul 12, 2019
Newer runC applied further improvements to their CVE-2019-5736 mitigation in opencontainers/runc#1984 which change the nature of our apparmor denial from `/` to `/bin/runc` (which I have also commented on https://bugs.launchpad.net/apparmor/+bug/1820344 about). See also canonical#6610. (originally from Tianon Gravi, but re-committed due to CLA issues with the PR checks) Signed-off-by: Ian Johnson <ian.johnson@canonical.com>
mvo5
pushed a commit
that referenced
this pull request
Jul 15, 2019
Newer runC applied further improvements to their CVE-2019-5736 mitigation in opencontainers/runc#1984 which change the nature of our apparmor denial from `/` to `/bin/runc` (which I have also commented on https://bugs.launchpad.net/apparmor/+bug/1820344 about). See also #6610. (originally from Tianon Gravi, but re-committed due to CLA issues with the PR checks) Signed-off-by: Ian Johnson <ian.johnson@canonical.com>
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This access is needed to allow recent versions of runC inside docker
18.06.3 and 18.09.3 to run properly. Note that the snap is not affected
by CVE-2019-5736 directly, but this access is needed so that the
mitigation works properly.