openkylin
/
runc
mirror of https://gitee.com/openkylin/runc.git
9
0
Fork 0
Code Issues Projects Releases Wiki Activity

CVE-2022-29162 runc: do not set inheritable capabilities

This commit is contained in:
yangfengsheng 2023-07-18 00:14:39 +08:00
parent 6cd88d70af
commit c15bc52e96
6 changed files with 6 additions and 40 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
debian/changelog vendored
View File

@ -1,3 +1,9 @@
runc (1.1.0-ok2) yangtze; urgency=medium
* yangfs215 CVE-2022-29162 runc: do not set inheritable capabilities
-- yangfengsheng <yangfs@whu.edu.cn> Tue, 18 Jul 2023 00:10:28 +0800
runc (1.1.0-ok1) yangtze; urgency=medium runc (1.1.0-ok1) yangtze; urgency=medium
* Merge new upstream version 1.1.0 * Merge new upstream version 1.1.0

1
exec.go
View File

@ -224,7 +224,6 @@ func getProcess(context *cli.Context, bundle string) (*specs.Process, error) {
if caps := context.StringSlice("cap"); len(caps) > 0 { if caps := context.StringSlice("cap"); len(caps) > 0 {
for _, c := range caps { for _, c := range caps {
p.Capabilities.Bounding = append(p.Capabilities.Bounding, c) p.Capabilities.Bounding = append(p.Capabilities.Bounding, c)
p.Capabilities.Inheritable = append(p.Capabilities.Inheritable, c)
p.Capabilities.Effective = append(p.Capabilities.Effective, c) p.Capabilities.Effective = append(p.Capabilities.Effective, c)
p.Capabilities.Permitted = append(p.Capabilities.Permitted, c) p.Capabilities.Permitted = append(p.Capabilities.Permitted, c)
p.Capabilities.Ambient = append(p.Capabilities.Ambient, c) p.Capabilities.Ambient = append(p.Capabilities.Ambient, c)

16
libcontainer/README.md
View File

@ -96,22 +96,6 @@ config := &configs.Config{
"CAP_KILL", "CAP_KILL",
"CAP_AUDIT_WRITE", "CAP_AUDIT_WRITE",
}, },
Inheritable: []string{
"CAP_CHOWN",
"CAP_DAC_OVERRIDE",
"CAP_FSETID",
"CAP_FOWNER",
"CAP_MKNOD",
"CAP_NET_RAW",
"CAP_SETGID",
"CAP_SETUID",
"CAP_SETFCAP",
"CAP_SETPCAP",
"CAP_NET_BIND_SERVICE",
"CAP_SYS_CHROOT",
"CAP_KILL",
"CAP_AUDIT_WRITE",
},
Permitted: []string{ Permitted: []string{
"CAP_CHOWN", "CAP_CHOWN",
"CAP_DAC_OVERRIDE", "CAP_DAC_OVERRIDE",

2
libcontainer/integration/exec_test.go
View File

@ -364,7 +364,6 @@ func TestProcessCaps(t *testing.T) {
pconfig.Capabilities.Bounding = append(config.Capabilities.Bounding, "CAP_NET_ADMIN") pconfig.Capabilities.Bounding = append(config.Capabilities.Bounding, "CAP_NET_ADMIN")
pconfig.Capabilities.Permitted = append(config.Capabilities.Permitted, "CAP_NET_ADMIN") pconfig.Capabilities.Permitted = append(config.Capabilities.Permitted, "CAP_NET_ADMIN")
pconfig.Capabilities.Effective = append(config.Capabilities.Effective, "CAP_NET_ADMIN") pconfig.Capabilities.Effective = append(config.Capabilities.Effective, "CAP_NET_ADMIN")
pconfig.Capabilities.Inheritable = append(config.Capabilities.Inheritable, "CAP_NET_ADMIN")
err = container.Run(&pconfig) err = container.Run(&pconfig)
ok(t, err) ok(t, err)
@ -1409,7 +1408,6 @@ func TestRootfsPropagationSharedMount(t *testing.T) {
pconfig2.Capabilities.Bounding = append(config.Capabilities.Bounding, "CAP_SYS_ADMIN") pconfig2.Capabilities.Bounding = append(config.Capabilities.Bounding, "CAP_SYS_ADMIN")
pconfig2.Capabilities.Permitted = append(config.Capabilities.Permitted, "CAP_SYS_ADMIN") pconfig2.Capabilities.Permitted = append(config.Capabilities.Permitted, "CAP_SYS_ADMIN")
pconfig2.Capabilities.Effective = append(config.Capabilities.Effective, "CAP_SYS_ADMIN") pconfig2.Capabilities.Effective = append(config.Capabilities.Effective, "CAP_SYS_ADMIN")
pconfig2.Capabilities.Inheritable = append(config.Capabilities.Inheritable, "CAP_SYS_ADMIN")
err = container.Run(pconfig2) err = container.Run(pconfig2)
_ = stdinR2.Close() _ = stdinR2.Close()

16
libcontainer/integration/template_test.go
View File

@ -75,22 +75,6 @@ func newTemplateConfig(t *testing.T, p *tParam) *configs.Config {
"CAP_KILL", "CAP_KILL",
"CAP_AUDIT_WRITE", "CAP_AUDIT_WRITE",
}, },
Inheritable: []string{
"CAP_CHOWN",
"CAP_DAC_OVERRIDE",
"CAP_FSETID",
"CAP_FOWNER",
"CAP_MKNOD",
"CAP_NET_RAW",
"CAP_SETGID",
"CAP_SETUID",
"CAP_SETFCAP",
"CAP_SETPCAP",
"CAP_NET_BIND_SERVICE",
"CAP_SYS_CHROOT",
"CAP_KILL",
"CAP_AUDIT_WRITE",
},
Ambient: []string{ Ambient: []string{
"CAP_CHOWN", "CAP_CHOWN",
"CAP_DAC_OVERRIDE", "CAP_DAC_OVERRIDE",

5
libcontainer/specconv/example.go
View File

@ -41,11 +41,6 @@ func Example() *specs.Spec {
"CAP_KILL", "CAP_KILL",
"CAP_NET_BIND_SERVICE", "CAP_NET_BIND_SERVICE",
}, },
Inheritable: []string{
"CAP_AUDIT_WRITE",
"CAP_KILL",
"CAP_NET_BIND_SERVICE",
},
Ambient: []string{ Ambient: []string{
"CAP_AUDIT_WRITE", "CAP_AUDIT_WRITE",
"CAP_KILL", "CAP_KILL",