containers
/
podman
mirror of https://github.com/containers/podman.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

systemd: mask /sys/fs/cgroup/systemd/release_agent 

when running in systemd mode on cgroups v1, make sure the
/sys/fs/cgroup/systemd/release_agent is masked otherwise the container
is able to modify it and execute scripts on the host.

Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
This commit is contained in:
Giuseppe Scrivano 2019-10-25 21:50:29 +02:00
parent a01cb220c8
commit 0d5d6dab57
No known key found for this signature in database
GPG Key ID: E4730F97F60286ED
1 changed files with 1 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
libpod/container_internal_linux.go
View File

@ -550,6 +550,7 @@ func (c *Container) setupSystemd(mounts []spec.Mount, g generate.Generator) erro
Options: []string{"bind", "nodev", "noexec", "nosuid"}, Options: []string{"bind", "nodev", "noexec", "nosuid"},
} }
g.AddMount(systemdMnt) g.AddMount(systemdMnt)
g.AddLinuxMaskedPaths("/sys/fs/cgroup/systemd/release_agent")
} }
return nil return nil