Skip to content

L
lxc
Switch branch/tag
  1. 07 Oct, 2015 1 commit
    • Make overlayfs mounts work directly · 6e46cc0d
      Christian Brauner authored 
      When users wanted to mount overlay directories with lxc.mount.entry they had to
create upperdirs and workdirs beforehand in order to mount them. To create it
for them we add the functions mount_entry_create_overlay_dirs() and
mount_entry_create_aufs_dirs() which do this for them. User can now simply
specify e.g.:

        lxc.mount.entry = /lower merged overlay lowerdir=/lower,upper=/upper,workdir=/workdir,create=dir

and /upper and /workdir will be created for them. /upper and /workdir need to
be absolute paths to directories which are created under the containerdir (e.g.
under $lxcpath/CONTAINERNAME/). Relative mountpoints, mountpoints outside the
containerdir, and mountpoints within the container's rootfs are ignored. (The
latter *might* change in the future should it be considered safe/useful.)

Specifying

        lxc.mount.entry = /lower merged overlay lowerdir=/lower:/lower2,create=dir

will lead to a read-only overlay mount in accordance with the
kernel-documentation.

Specifying

        lxc.mount.entry = /lower merged overlay lowerdir=/lower,create=dir

will fail when no upperdir and workdir options are given.
Signed-off-by: 's avatarChristian Brauner <christianvanbrauner@gmail.com>
Acked-by: 's avatarSerge E. Hallyn <serge.hallyn@ubuntu.com>
  3. 05 Oct, 2015 8 commits
  5. 30 Sep, 2015 3 commits
  7. 29 Sep, 2015 3 commits
    • Define O_PATH and O_NOFOLLOW for Android · 4928c718
      Stéphane Graber authored 
      Signed-off-by: 's avatarStéphane Graber <stgraber@ubuntu.com>
    • Add a slackware template. · 3a05a669
      Matteo Bernardini authored 
      Requires pkgtools and slackpkg (from the slackware-current tree).
Signed-off-by: 's avatarMatteo Bernardini <ponce@slackbuilds.org>
    • CVE-2015-1335: Protect container mounts against symlinks · 592fd47a
      Serge Hallyn authored 
      When a container starts up, lxc sets up the container's inital fstree
by doing a bunch of mounting, guided by the container configuration
file.  The container config is owned by the admin or user on the host,
so we do not try to guard against bad entries.  However, since the
mount target is in the container, it's possible that the container admin
could divert the mount with symbolic links.  This could bypass proper
container startup (i.e. confinement of a root-owned container by the
restrictive apparmor policy, by diverting the required write to
/proc/self/attr/current), or bypass the (path-based) apparmor policy
by diverting, say, /proc to /mnt in the container.

To prevent this,

1. do not allow mounts to paths containing symbolic links

2. do not allow bind mounts from relative paths containing symbolic
links.

Details:

Define safe_mount which ensures that the container has not inserted any
symbolic links into any mount targets for mounts to be done during
container setup.

The host's mount path may contain symbolic links.  As it is under the
control of the administrator, that's ok.  So safe_mount begins the check
for symbolic links after the rootfs->mount, by opening that directory.

It opens each directory along the path using openat() relative to the
parent directory using O_NOFOLLOW.  When the target is reached, it
mounts onto /proc/self/fd/<targetfd>.

Use safe_mount() in mount_entry(), when mounting container proc,
and when needed.  In particular, safe_mount() need not be used in
any case where:

1. the mount is done in the container's namespace
2. the mount is for the container's rootfs
3. the mount is relative to a tmpfs or proc/sysfs which we have
   just safe_mount()ed ourselves

Since we were using proc/net as a temporary placeholder for /proc/sys/net
during container startup, and proc/net is a symbolic link, use proc/tty
instead.

Update the lxc.container.conf manpage with details about the new
restrictions.

Finally, add a testcase to test some symbolic link possibilities.

Reported-by: Roman Fiedler
Signed-off-by: 's avatarSerge Hallyn <serge.hallyn@ubuntu.com>
Acked-by: 's avatarStéphane Graber <stgraber@ubuntu.com>
  9. 28 Sep, 2015 9 commits
  11. 26 Sep, 2015 2 commits
  13. 25 Sep, 2015 2 commits
  15. 21 Sep, 2015 12 commits