Commits on Jan 14, 2019

1. rootfs: umount all procfs and sysfs with --no-pivot …

   When creating a new user namespace, the kernel doesn't allow to mount
   a new procfs or sysfs file system if there is not already one instance
   fully visible in the current mount namespace.
   
   When using --no-pivot we were effectively inhibiting this protection
   from the kernel, as /proc and /sys from the host are still present in
   the container mount namespace.
   
   A container without full access to /proc could then create a new user
   namespace, and from there able to mount a fully visible /proc, bypassing
   the limitations in the container.
   
   A simple reproducer for this issue is:
   
   unshare -mrfp sh -c "mount -t proc none /proc && echo c > /proc/sysrq-trigger"
   
   Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>

   

   giuseppe committed Jan 14, 2019
   Configuration menu

   • View commit details
   • Copy full SHA for 28a697c
   • Browse repository at this point

   Copy the full SHA

   28a697c View commit details

   Browse the repository at this point in the history