From 8758aae7d159af2a49fa9708242697070dc88a9a Mon Sep 17 00:00:00 2001 From: louiseschmidtgen Date: Tue, 6 Feb 2024 15:02:33 +0100 Subject: [PATCH] runc strict patches --- ...ange-profile-immediately-not-on-exec.patch | 0 ...-set-the-NNP-flag-after-changing-the.patch | 47 ++++++++++++++++ ...nux-change-AppArmor-profile-as-late-.patch | 54 +++++++++++++++++++ ...ange-profile-immediately-not-on-exec.patch | 36 +++++++++++++ ...-set-the-NNP-flag-after-changing-the.patch | 0 ...nux-change-AppArmor-profile-as-late-.patch | 0 6 files changed, 137 insertions(+) rename build-scripts/components/runc/strict-patches/{default => v1.1.12}/0001-apparmor-change-profile-immediately-not-on-exec.patch (100%) create mode 100644 build-scripts/components/runc/strict-patches/v1.1.12/0002-setns_init_linux-set-the-NNP-flag-after-changing-the.patch create mode 100644 build-scripts/components/runc/strict-patches/v1.1.12/0003-standard_init_linux-change-AppArmor-profile-as-late-.patch create mode 100644 build-scripts/components/runc/strict-patches/v1.1.4/0001-apparmor-change-profile-immediately-not-on-exec.patch rename build-scripts/components/runc/strict-patches/{default => v1.1.4}/0002-setns_init_linux-set-the-NNP-flag-after-changing-the.patch (100%) rename build-scripts/components/runc/strict-patches/{default => v1.1.4}/0003-standard_init_linux-change-AppArmor-profile-as-late-.patch (100%) diff --git a/build-scripts/components/runc/strict-patches/default/0001-apparmor-change-profile-immediately-not-on-exec.patch b/build-scripts/components/runc/strict-patches/v1.1.12/0001-apparmor-change-profile-immediately-not-on-exec.patch similarity index 100% rename from build-scripts/components/runc/strict-patches/default/0001-apparmor-change-profile-immediately-not-on-exec.patch rename to build-scripts/components/runc/strict-patches/v1.1.12/0001-apparmor-change-profile-immediately-not-on-exec.patch diff --git a/build-scripts/components/runc/strict-patches/v1.1.12/0002-setns_init_linux-set-the-NNP-flag-after-changing-the.patch b/build-scripts/components/runc/strict-patches/v1.1.12/0002-setns_init_linux-set-the-NNP-flag-after-changing-the.patch new file mode 100644 index 0000000000..2b9ac883bd --- /dev/null +++ b/build-scripts/components/runc/strict-patches/v1.1.12/0002-setns_init_linux-set-the-NNP-flag-after-changing-the.patch @@ -0,0 +1,47 @@ +From 5351ef6f5b592472e077512714b2516cdbae1b51 Mon Sep 17 00:00:00 2001 +From: Angelos Kolaitis +Date: Thu, 1 Feb 2024 11:23:08 +0200 +Subject: [PATCH 2/3] setns_init_linux: set the NNP flag after changing the + apparmor profile + +With the current version of the AppArmor kernel module, it's not +possible to switch the AppArmor profile if the NoNewPrivileges flag is +set. So, we invert the order of the two operations. + +Adjusts the previous patch for runc version v1.1.12 + +Co-Authored-By: Alberto Mardegan +--- + libcontainer/setns_init_linux.go | 10 +++++----- + 1 file changed, 5 insertions(+), 5 deletions(-) + +diff --git a/libcontainer/setns_init_linux.go b/libcontainer/setns_init_linux.go +index d1bb122..00407ce 100644 +--- a/libcontainer/setns_init_linux.go ++++ b/libcontainer/setns_init_linux.go +@@ -56,11 +56,6 @@ func (l *linuxSetnsInit) Init() error { + return err + } + } +- if l.config.NoNewPrivileges { +- if err := unix.Prctl(unix.PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0); err != nil { +- return err +- } +- } + if err := selinux.SetExecLabel(l.config.ProcessLabel); err != nil { + return err + } +@@ -84,6 +79,11 @@ func (l *linuxSetnsInit) Init() error { + if err := apparmor.ApplyProfile(l.config.AppArmorProfile); err != nil { + return err + } ++ if l.config.NoNewPrivileges { ++ if err := unix.Prctl(unix.PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0); err != nil { ++ return err ++ } ++ } + + // Check for the arg before waiting to make sure it exists and it is + // returned as a create time error. +-- +2.34.1 \ No newline at end of file diff --git a/build-scripts/components/runc/strict-patches/v1.1.12/0003-standard_init_linux-change-AppArmor-profile-as-late-.patch b/build-scripts/components/runc/strict-patches/v1.1.12/0003-standard_init_linux-change-AppArmor-profile-as-late-.patch new file mode 100644 index 0000000000..9415a05f88 --- /dev/null +++ b/build-scripts/components/runc/strict-patches/v1.1.12/0003-standard_init_linux-change-AppArmor-profile-as-late-.patch @@ -0,0 +1,54 @@ +From 103a94a51ea334d25bf573f2f20cd4d9a099d827 Mon Sep 17 00:00:00 2001 +From: Alberto Mardegan +Date: Thu, 17 Jun 2021 14:31:35 +0300 +Subject: [PATCH 3/3] standard_init_linux: change AppArmor profile as late as + possible + +--- + libcontainer/standard_init_linux.go | 18 +++++++++--------- + 1 file changed, 9 insertions(+), 9 deletions(-) + +diff --git a/libcontainer/standard_init_linux.go b/libcontainer/standard_init_linux.go +index d1d9435..7097571 100644 +--- a/libcontainer/standard_init_linux.go ++++ b/libcontainer/standard_init_linux.go +@@ -127,10 +127,6 @@ func (l *linuxStandardInit) Init() error { + return &os.SyscallError{Syscall: "sethostname", Err: err} + } + } +- if err := apparmor.ApplyProfile(l.config.AppArmorProfile); err != nil { +- return fmt.Errorf("unable to apply apparmor profile: %w", err) +- } +- + for key, value := range l.config.Config.Sysctl { + if err := writeSystemProperty(key, value); err != nil { + return err +@@ -150,17 +146,21 @@ func (l *linuxStandardInit) Init() error { + if err != nil { + return fmt.Errorf("can't get pdeath signal: %w", err) + } +- if l.config.NoNewPrivileges { +- if err := unix.Prctl(unix.PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0); err != nil { +- return &os.SyscallError{Syscall: "prctl(SET_NO_NEW_PRIVS)", Err: err} +- } +- } + // Tell our parent that we're ready to Execv. This must be done before the + // Seccomp rules have been applied, because we need to be able to read and + // write to a socket. + if err := syncParentReady(l.pipe); err != nil { + return fmt.Errorf("sync ready: %w", err) + } ++ if err := apparmor.ApplyProfile(l.config.AppArmorProfile); err != nil { ++ return fmt.Errorf("apply apparmor profile: %w", err) ++ } ++ if l.config.NoNewPrivileges { ++ if err := unix.Prctl(unix.PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0); err != nil { ++ return fmt.Errorf("set nonewprivileges: %w", err) ++ } ++ } ++ + if err := selinux.SetExecLabel(l.config.ProcessLabel); err != nil { + return fmt.Errorf("can't set process label: %w", err) + } +-- +2.34.1 \ No newline at end of file diff --git a/build-scripts/components/runc/strict-patches/v1.1.4/0001-apparmor-change-profile-immediately-not-on-exec.patch b/build-scripts/components/runc/strict-patches/v1.1.4/0001-apparmor-change-profile-immediately-not-on-exec.patch new file mode 100644 index 0000000000..30bc4c5100 --- /dev/null +++ b/build-scripts/components/runc/strict-patches/v1.1.4/0001-apparmor-change-profile-immediately-not-on-exec.patch @@ -0,0 +1,36 @@ +From cc499086e2bbde59a349b52bdf7ce414b6fb3f0a Mon Sep 17 00:00:00 2001 +From: Alberto Mardegan +Date: Wed, 16 Jun 2021 15:04:16 +0300 +Subject: [PATCH] apparmor: change profile immediately, not on exec + +--- + libcontainer/apparmor/apparmor_linux.go | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/libcontainer/apparmor/apparmor_linux.go b/libcontainer/apparmor/apparmor_linux.go +index 8b1483c7..292cfa6d 100644 +--- a/libcontainer/apparmor/apparmor_linux.go ++++ b/libcontainer/apparmor/apparmor_linux.go +@@ -48,9 +48,9 @@ func setProcAttr(attr, value string) error { + return err + } + +-// changeOnExec reimplements aa_change_onexec from libapparmor in Go +-func changeOnExec(name string) error { +- if err := setProcAttr("exec", "exec "+name); err != nil { ++// changeProfile reimplements aa_change_profile from libapparmor in Go ++func changeProfile(name string) error { ++ if err := setProcAttr("current", "changeprofile "+name); err != nil { + return fmt.Errorf("apparmor failed to apply profile: %w", err) + } + return nil +@@ -64,5 +64,5 @@ func applyProfile(name string) error { + return nil + } + +- return changeOnExec(name) ++ return changeProfile(name) + } +-- +2.25.1 + diff --git a/build-scripts/components/runc/strict-patches/default/0002-setns_init_linux-set-the-NNP-flag-after-changing-the.patch b/build-scripts/components/runc/strict-patches/v1.1.4/0002-setns_init_linux-set-the-NNP-flag-after-changing-the.patch similarity index 100% rename from build-scripts/components/runc/strict-patches/default/0002-setns_init_linux-set-the-NNP-flag-after-changing-the.patch rename to build-scripts/components/runc/strict-patches/v1.1.4/0002-setns_init_linux-set-the-NNP-flag-after-changing-the.patch diff --git a/build-scripts/components/runc/strict-patches/default/0003-standard_init_linux-change-AppArmor-profile-as-late-.patch b/build-scripts/components/runc/strict-patches/v1.1.4/0003-standard_init_linux-change-AppArmor-profile-as-late-.patch similarity index 100% rename from build-scripts/components/runc/strict-patches/default/0003-standard_init_linux-change-AppArmor-profile-as-late-.patch rename to build-scripts/components/runc/strict-patches/v1.1.4/0003-standard_init_linux-change-AppArmor-profile-as-late-.patch