The following pull request was submitted through Github.
It can be accessed and reviewed at: https://github.com/lxc/lxc/pull/3466
This e-mail was sent by the LXC bot, direct replies will not reach the author
unless they happen to be subscribed to this list.
=== Description (from pull-request) ===
In `start.c:1284`, no_new_privs flag is set after LSM label is set.
Also, in `lxc.container.conf` documentation it is written that:
```
Note that PR_SET_NO_NEW_PRIVS is applied after the container has
changed into its intended AppArmor profile or SElinux context.
```
This commit fixes the behavior of `lxc_attach` by moving
`PR_SET_NO_NEW_PRIVS` set logic after LSM for the process is configured;
Closes #3393
Signed-off-by: Alexander Livenets <a.liven...@gmail.com>
From 6ce8e67825258fe8a38b057b1459a4f35e4b39bb Mon Sep 17 00:00:00 2001
From: Alexander Livenets <a.liven...@gmail.com>
Date: Tue, 30 Jun 2020 00:06:20 +0200
Subject: [PATCH] attach: set no_new_privs flag after LSM label
In `start.c:1284`, no_new_privs flag is set after LSM label is set.
Also, in `lxc.container.conf` documentation it is written that:
```
Note that PR_SET_NO_NEW_PRIVS is applied after the container has
changed into its intended AppArmor profile or SElinux context.
```
This commit fixes the behavior of `lxc_attach` by moving
`PR_SET_NO_NEW_PRIVS` set logic after LSM for the process is configured;
Closes #3393
Signed-off-by: Alexander Livenets <a.liven...@gmail.com>
---
src/lxc/attach.c | 22 +++++++++++-----------
1 file changed, 11 insertions(+), 11 deletions(-)
diff --git a/src/lxc/attach.c b/src/lxc/attach.c
index 38e16f2d1e..4cd4f4175a 100644
--- a/src/lxc/attach.c
+++ b/src/lxc/attach.c
@@ -770,17 +770,6 @@ static int attach_child_main(struct attach_clone_payload
*payload)
else
new_gid = ns_root_gid;
- if ((init_ctx->container && init_ctx->container->lxc_conf &&
- init_ctx->container->lxc_conf->no_new_privs) ||
- (options->attach_flags & LXC_ATTACH_NO_NEW_PRIVS)) {
- ret = prctl(PR_SET_NO_NEW_PRIVS, prctl_arg(1), prctl_arg(0),
- prctl_arg(0), prctl_arg(0));
- if (ret < 0)
- goto on_error;
-
- TRACE("Set PR_SET_NO_NEW_PRIVS");
- }
-
if (needs_lsm) {
bool on_exec;
@@ -795,6 +784,17 @@ static int attach_child_main(struct attach_clone_payload
*payload)
TRACE("Set %s LSM label to \"%s\"", lsm_name(),
init_ctx->lsm_label);
}
+ if ((init_ctx->container && init_ctx->container->lxc_conf &&
+ init_ctx->container->lxc_conf->no_new_privs) ||
+ (options->attach_flags & LXC_ATTACH_NO_NEW_PRIVS)) {
+ ret = prctl(PR_SET_NO_NEW_PRIVS, prctl_arg(1), prctl_arg(0),
+ prctl_arg(0), prctl_arg(0));
+ if (ret < 0)
+ goto on_error;
+
+ TRACE("Set PR_SET_NO_NEW_PRIVS");
+ }
+
if (init_ctx->container && init_ctx->container->lxc_conf &&
init_ctx->container->lxc_conf->seccomp.seccomp) {
struct lxc_conf *conf = init_ctx->container->lxc_conf;
_______________________________________________
lxc-devel mailing list
lxc-devel@lists.linuxcontainers.org
http://lists.linuxcontainers.org/listinfo/lxc-devel
