gnu/packages/patches/runc-CVE-2019-5736.patch

   1 Fix CVE-2019-5736:
   2
   3 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5736
   4 https://seclists.org/oss-sec/2019/q1/119
   5
   6 Patch copied from upstream source repository:
   7
   8 https://github.com/opencontainers/runc/commit/0a8e4117e7f715d5fbeef398405813ce8e88558b
   9
  10 From 0a8e4117e7f715d5fbeef398405813ce8e88558b Mon Sep 17 00:00:00 2001
  11 From: Aleksa Sarai <asarai@suse.de>
  12 Date: Wed, 9 Jan 2019 13:40:01 +1100
  13 Subject: [PATCH] nsenter: clone /proc/self/exe to avoid exposing host binary
  14  to container
  15
  16 There are quite a few circumstances where /proc/self/exe pointing to a
  17 pretty important container binary is a _bad_ thing, so to avoid this we
  18 have to make a copy (preferably doing self-clean-up and not being
  19 writeable).
  20
  21 We require memfd_create(2) -- though there is an O_TMPFILE fallback --
  22 but we can always extend this to use a scratch MNT_DETACH overlayfs or
  23 tmpfs. The main downside to this approach is no page-cache sharing for
  24 the runc binary (which overlayfs would give us) but this is far less
  25 complicated.
  26
  27 This is only done during nsenter so that it happens transparently to the
  28 Go code, and any libcontainer users benefit from it. This also makes
  29 ExtraFiles and --preserve-fds handling trivial (because we don't need to
  30 worry about it).
  31
  32 Fixes: CVE-2019-5736
  33 Co-developed-by: Christian Brauner <christian.brauner@ubuntu.com>
  34 Signed-off-by: Aleksa Sarai <asarai@suse.de>
  35 ---
  36  libcontainer/nsenter/cloned_binary.c | 268 +++++++++++++++++++++++++++
  37  libcontainer/nsenter/nsexec.c        |  11 ++
  38  2 files changed, 279 insertions(+)
  39  create mode 100644 libcontainer/nsenter/cloned_binary.c
  40
  41 diff --git a/libcontainer/nsenter/cloned_binary.c b/libcontainer/nsenter/cloned_binary.c
  42 new file mode 100644
  43 index 000000000..c8a42c23f
  44 --- /dev/null
  45 +++ b/libcontainer/nsenter/cloned_binary.c
  46 @@ -0,0 +1,268 @@
  47 +/*
  48 + * Copyright (C) 2019 Aleksa Sarai <cyphar@cyphar.com>
  49 + * Copyright (C) 2019 SUSE LLC
  50 + *
  51 + * Licensed under the Apache License, Version 2.0 (the "License");
  52 + * you may not use this file except in compliance with the License.
  53 + * You may obtain a copy of the License at
  54 + *
  55 + *     http://www.apache.org/licenses/LICENSE-2.0
  56 + *
  57 + * Unless required by applicable law or agreed to in writing, software
  58 + * distributed under the License is distributed on an "AS IS" BASIS,
  59 + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  60 + * See the License for the specific language governing permissions and
  61 + * limitations under the License.
  62 + */
  63 +
  64 +#define _GNU_SOURCE
  65 +#include <unistd.h>
  66 +#include <stdio.h>
  67 +#include <stdlib.h>
  68 +#include <stdbool.h>
  69 +#include <string.h>
  70 +#include <limits.h>
  71 +#include <fcntl.h>
  72 +#include <errno.h>
  73 +
  74 +#include <sys/types.h>
  75 +#include <sys/stat.h>
  76 +#include <sys/vfs.h>
  77 +#include <sys/mman.h>
  78 +#include <sys/sendfile.h>
  79 +#include <sys/syscall.h>
  80 +
  81 +/* Use our own wrapper for memfd_create. */
  82 +#if !defined(SYS_memfd_create) && defined(__NR_memfd_create)
  83 +#  define SYS_memfd_create __NR_memfd_create
  84 +#endif
  85 +#ifdef SYS_memfd_create
  86 +#  define HAVE_MEMFD_CREATE
  87 +/* memfd_create(2) flags -- copied from <linux/memfd.h>. */
  88 +#  ifndef MFD_CLOEXEC
  89 +#    define MFD_CLOEXEC       0x0001U
  90 +#    define MFD_ALLOW_SEALING 0x0002U
  91 +#  endif
  92 +int memfd_create(const char *name, unsigned int flags)
  93 +{
  94 +       return syscall(SYS_memfd_create, name, flags);
  95 +}
  96 +#endif
  97 +
  98 +/* This comes directly from <linux/fcntl.h>. */
  99 +#ifndef F_LINUX_SPECIFIC_BASE
 100 +#  define F_LINUX_SPECIFIC_BASE 1024
 101 +#endif
 102 +#ifndef F_ADD_SEALS
 103 +#  define F_ADD_SEALS (F_LINUX_SPECIFIC_BASE + 9)
 104 +#  define F_GET_SEALS (F_LINUX_SPECIFIC_BASE + 10)
 105 +#endif
 106 +#ifndef F_SEAL_SEAL
 107 +#  define F_SEAL_SEAL   0x0001 /* prevent further seals from being set */
 108 +#  define F_SEAL_SHRINK 0x0002 /* prevent file from shrinking */
 109 +#  define F_SEAL_GROW   0x0004 /* prevent file from growing */
 110 +#  define F_SEAL_WRITE  0x0008 /* prevent writes */
 111 +#endif
 112 +
 113 +#define RUNC_SENDFILE_MAX 0x7FFFF000 /* sendfile(2) is limited to 2GB. */
 114 +#ifdef HAVE_MEMFD_CREATE
 115 +#  define RUNC_MEMFD_COMMENT "runc_cloned:/proc/self/exe"
 116 +#  define RUNC_MEMFD_SEALS \
 117 +       (F_SEAL_SEAL | F_SEAL_SHRINK | F_SEAL_GROW | F_SEAL_WRITE)
 118 +#endif
 119 +
 120 +static void *must_realloc(void *ptr, size_t size)
 121 +{
 122 +       void *old = ptr;
 123 +       do {
 124 +               ptr = realloc(old, size);
 125 +       } while(!ptr);
 126 +       return ptr;
 127 +}
 128 +
 129 +/*
 130 + * Verify whether we are currently in a self-cloned program (namely, is
 131 + * /proc/self/exe a memfd). F_GET_SEALS will only succeed for memfds (or rather
 132 + * for shmem files), and we want to be sure it's actually sealed.
 133 + */
 134 +static int is_self_cloned(void)
 135 +{
 136 +       int fd, ret, is_cloned = 0;
 137 +
 138 +       fd = open("/proc/self/exe", O_RDONLY|O_CLOEXEC);
 139 +       if (fd < 0)
 140 +               return -ENOTRECOVERABLE;
 141 +
 142 +#ifdef HAVE_MEMFD_CREATE
 143 +       ret = fcntl(fd, F_GET_SEALS);
 144 +       is_cloned = (ret == RUNC_MEMFD_SEALS);
 145 +#else
 146 +       struct stat statbuf = {0};
 147 +       ret = fstat(fd, &statbuf);
 148 +       if (ret >= 0)
 149 +               is_cloned = (statbuf.st_nlink == 0);
 150 +#endif
 151 +       close(fd);
 152 +       return is_cloned;
 153 +}
 154 +
 155 +/*
 156 + * Basic wrapper around mmap(2) that gives you the file length so you can
 157 + * safely treat it as an ordinary buffer. Only gives you read access.
 158 + */
 159 +static char *read_file(char *path, size_t *length)
 160 +{
 161 +       int fd;
 162 +       char buf[4096], *copy = NULL;
 163 +
 164 +       if (!length)
 165 +               return NULL;
 166 +
 167 +       fd = open(path, O_RDONLY | O_CLOEXEC);
 168 +       if (fd < 0)
 169 +               return NULL;
 170 +
 171 +       *length = 0;
 172 +       for (;;) {
 173 +               int n;
 174 +
 175 +               n = read(fd, buf, sizeof(buf));
 176 +               if (n < 0)
 177 +                       goto error;
 178 +               if (!n)
 179 +                       break;
 180 +
 181 +               copy = must_realloc(copy, (*length + n) * sizeof(*copy));
 182 +               memcpy(copy + *length, buf, n);
 183 +               *length += n;
 184 +       }
 185 +       close(fd);
 186 +       return copy;
 187 +
 188 +error:
 189 +       close(fd);
 190 +       free(copy);
 191 +       return NULL;
 192 +}
 193 +
 194 +/*
 195 + * A poor-man's version of "xargs -0". Basically parses a given block of
 196 + * NUL-delimited data, within the given length and adds a pointer to each entry
 197 + * to the array of pointers.
 198 + */
 199 +static int parse_xargs(char *data, int data_length, char ***output)
 200 +{
 201 +       int num = 0;
 202 +       char *cur = data;
 203 +
 204 +       if (!data || *output != NULL)
 205 +               return -1;
 206 +
 207 +       while (cur < data + data_length) {
 208 +               num++;
 209 +               *output = must_realloc(*output, (num + 1) * sizeof(**output));
 210 +               (*output)[num - 1] = cur;
 211 +               cur += strlen(cur) + 1;
 212 +       }
 213 +       (*output)[num] = NULL;
 214 +       return num;
 215 +}
 216 +
 217 +/*
 218 + * "Parse" out argv and envp from /proc/self/cmdline and /proc/self/environ.
 219 + * This is necessary because we are running in a context where we don't have a
 220 + * main() that we can just get the arguments from.
 221 + */
 222 +static int fetchve(char ***argv, char ***envp)
 223 +{
 224 +       char *cmdline = NULL, *environ = NULL;
 225 +       size_t cmdline_size, environ_size;
 226 +
 227 +       cmdline = read_file("/proc/self/cmdline", &cmdline_size);
 228 +       if (!cmdline)
 229 +               goto error;
 230 +       environ = read_file("/proc/self/environ", &environ_size);
 231 +       if (!environ)
 232 +               goto error;
 233 +
 234 +       if (parse_xargs(cmdline, cmdline_size, argv) <= 0)
 235 +               goto error;
 236 +       if (parse_xargs(environ, environ_size, envp) <= 0)
 237 +               goto error;
 238 +
 239 +       return 0;
 240 +
 241 +error:
 242 +       free(environ);
 243 +       free(cmdline);
 244 +       return -EINVAL;
 245 +}
 246 +
 247 +static int clone_binary(void)
 248 +{
 249 +       int binfd, memfd;
 250 +       ssize_t sent = 0;
 251 +
 252 +#ifdef HAVE_MEMFD_CREATE
 253 +       memfd = memfd_create(RUNC_MEMFD_COMMENT, MFD_CLOEXEC | MFD_ALLOW_SEALING);
 254 +#else
 255 +       memfd = open("/tmp", O_TMPFILE | O_EXCL | O_RDWR | O_CLOEXEC, 0711);
 256 +#endif
 257 +       if (memfd < 0)
 258 +               return -ENOTRECOVERABLE;
 259 +
 260 +       binfd = open("/proc/self/exe", O_RDONLY | O_CLOEXEC);
 261 +       if (binfd < 0)
 262 +               goto error;
 263 +
 264 +       sent = sendfile(memfd, binfd, NULL, RUNC_SENDFILE_MAX);
 265 +       close(binfd);
 266 +       if (sent < 0)
 267 +               goto error;
 268 +
 269 +#ifdef HAVE_MEMFD_CREATE
 270 +       int err = fcntl(memfd, F_ADD_SEALS, RUNC_MEMFD_SEALS);
 271 +       if (err < 0)
 272 +               goto error;
 273 +#else
 274 +       /* Need to re-open "memfd" as read-only to avoid execve(2) giving -EXTBUSY. */
 275 +       int newfd;
 276 +       char *fdpath = NULL;
 277 +
 278 +       if (asprintf(&fdpath, "/proc/self/fd/%d", memfd) < 0)
 279 +               goto error;
 280 +       newfd = open(fdpath, O_RDONLY | O_CLOEXEC);
 281 +       free(fdpath);
 282 +       if (newfd < 0)
 283 +               goto error;
 284 +
 285 +       close(memfd);
 286 +       memfd = newfd;
 287 +#endif
 288 +       return memfd;
 289 +
 290 +error:
 291 +       close(memfd);
 292 +       return -EIO;
 293 +}
 294 +
 295 +int ensure_cloned_binary(void)
 296 +{
 297 +       int execfd;
 298 +       char **argv = NULL, **envp = NULL;
 299 +
 300 +       /* Check that we're not self-cloned, and if we are then bail. */
 301 +       int cloned = is_self_cloned();
 302 +       if (cloned > 0 || cloned == -ENOTRECOVERABLE)
 303 +               return cloned;
 304 +
 305 +       if (fetchve(&argv, &envp) < 0)
 306 +               return -EINVAL;
 307 +
 308 +       execfd = clone_binary();
 309 +       if (execfd < 0)
 310 +               return -EIO;
 311 +
 312 +       fexecve(execfd, argv, envp);
 313 +       return -ENOEXEC;
 314 +}
 315 diff --git a/libcontainer/nsenter/nsexec.c b/libcontainer/nsenter/nsexec.c
 316 index 28269dfc0..7750af35e 100644
 317 --- a/libcontainer/nsenter/nsexec.c
 318 +++ b/libcontainer/nsenter/nsexec.c
 319 @@ -534,6 +534,9 @@ void join_namespaces(char *nslist)
 320         free(namespaces);
 321  }
 322
 323 +/* Defined in cloned_binary.c. */
 324 +extern int ensure_cloned_binary(void);
 325 +
 326  void nsexec(void)
 327  {
 328         int pipenum;
 329 @@ -549,6 +552,14 @@ void nsexec(void)
 330         if (pipenum == -1)
 331                 return;
 332
 333 +       /*
 334 +        * We need to re-exec if we are not in a cloned binary. This is necessary
 335 +        * to ensure that containers won't be able to access the host binary
 336 +        * through /proc/self/exe. See CVE-2019-5736.
 337 +        */
 338 +       if (ensure_cloned_binary() < 0)
 339 +               bail("could not ensure we are a cloned binary");
 340 +
 341         /* Parse all of the netlink configuration. */
 342         nl_parse(pipenum, &config);
 343