Commits on Feb 14, 2019

1. rootfs: umount all procfs and sysfs with --no-pivot …

   When creating a new user namespace, the kernel doesn't allow to mount
   a new procfs or sysfs file system if there is not already one instance
   fully visible in the current mount namespace.
   
   When using --no-pivot we were effectively inhibiting this protection
   from the kernel, as /proc and /sys from the host are still present in
   the container mount namespace.
   
   A container without full access to /proc could then create a new user
   namespace, and from there able to mount a fully visible /proc, bypassing
   the limitations in the container.
   
   A simple reproducer for this issue is:
   
   unshare -mrfp sh -c "mount -t proc none /proc && echo c > /proc/sysrq-trigger"
   
   Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
   (cherry picked from commit 28a697c)
   Signed-off-by: Sebastiaan van Stijn <github@gone.nl>

   

   giuseppe authored and thaJeztah committed Feb 14, 2019
   Configuration menu

   • View commit details
   • Copy full SHA for 04d40d6
   • Browse repository at this point

   Copy the full SHA

   04d40d6 View commit details

   Browse the repository at this point in the history