Hi, Current lxc driver unexpectedly allows users inside containers to reboot host physical machine. This patch prevents this by dropping CAP_SYS_BOOT capability in the bounding set of the init processes in every containers. Note that the patch intends to make it easy to add further capabilities to drop if needed, although I'm not sure which capabilities should be dropped. (We might need to drop CAP_SETFCAP as well to be strict...) Thanks, ozaki-r Signed-off-by: Ryota Ozaki <ozaki.ryota(a)gmail.com&gt; >From 0e7a7622bc6411bbe76c05c63c6e6e61d379d97b Mon Sep 17 00:00:00 2001 From: Ryota Ozaki <ozaki.ryota(a)gmail.com&gt; Date: Fri, 8 May 2009 04:29:24 +0900 Subject: [PATCH] lxc: drop CAP_SYS_BOOT capability to prevent rebooting from inside containers Current lxc driver unexpectedly allows users inside containers to reboot host physical machine. This patch prevents this by dropping CAP_SYS_BOOT capability in the bounding set of the init processes in every containers. --- src/lxc_container.c | 30 ++++++++++++++++++++++++++++++ 1 files changed, 30 insertions(+), 0 deletions(-) diff --git a/src/lxc_container.c b/src/lxc_container.c index 3946b84..37ab216 100644 --- a/src/lxc_container.c +++ b/src/lxc_container.c @@ -32,6 +32,8 @@ #include <sys/ioctl.h> #include <sys/mount.h> #include <sys/wait.h> +#include <sys/prctl.h> +#include <sys/capability.h> #include <unistd.h> #include <mntent.h> @@ -639,6 +641,30 @@ static int lxcContainerSetupMounts(virDomainDefPtr vmDef, return lxcContainerSetupExtraMounts(vmDef); } + +static int lxcContainerDropCapabilities( virDomainDefPtr vmDef ) +{ + int i; + const struct { + int id; + const char *name; + } caps[] = { +#define ID_STRING(name) name, #name + { ID_STRING(CAP_SYS_BOOT) }, + }; + + for (i = 0 ; i < ARRAY_CARDINALITY(caps) ; i++) { + if (prctl(PR_CAPBSET_DROP, caps[i].id, 0, 0, 0)) { + lxcError(NULL, NULL, VIR_ERR_INTERNAL_ERROR, + "%s", _("failed to drop %s"), caps[i].name); + return -1;

+ } + } + + return 0; +} + + /** * lxcChild: * @argv: Pointer to container arguments @@ -705,6 +731,10 @@ static int lxcContainerChild( void *data ) if (lxcContainerEnableInterfaces(argv->nveths, argv->veths) < 0) return -1; + /* drop a set of root capabilities */ + if (lxcContainerDropCapabilities(vmDef) < 0) + return -1; + /* this function will only return if an error occured */ return lxcContainerExecInit(vmDef); } -- 1.6.0.6 -- Libvir-list mailing list Libvir-list(a)redhat.com https://www.redhat.com/mailman/listinfo/libvir-list

Hi, Current lxc driver unexpectedly allows users inside containers to reboot host physical machine. This patch prevents this by dropping CAP_SYS_BOOT capability in the bounding set of the init processes in every containers. Note that the patch intends to make it easy to add further capabilities to drop if needed, although I'm not sure which capabilities should be dropped. (We might need to drop CAP_SETFCAP as well to be strict...)

Signed-off-by: Ryota Ozaki <ozaki.ryota(a)gmail.com&gt; >From 0e7a7622bc6411bbe76c05c63c6e6e61d379d97b Mon Sep 17 00:00:00 2001 From: Ryota Ozaki <ozaki.ryota(a)gmail.com&gt; Date: Fri, 8 May 2009 04:29:24 +0900 Subject: [PATCH] lxc: drop CAP_SYS_BOOT capability to prevent rebooting from inside containers Current lxc driver unexpectedly allows users inside containers to reboot host physical machine. This patch prevents this by dropping CAP_SYS_BOOT capability in the bounding set of the init processes in every containers. --- src/lxc_container.c | 30 ++++++++++++++++++++++++++++++ 1 files changed, 30 insertions(+), 0 deletions(-) diff --git a/src/lxc_container.c b/src/lxc_container.c index 3946b84..37ab216 100644 --- a/src/lxc_container.c +++ b/src/lxc_container.c @@ -32,6 +32,8 @@ #include <sys/ioctl.h> #include <sys/mount.h> #include <sys/wait.h> +#include <sys/prctl.h> +#include <sys/capability.h> #include <unistd.h> #include <mntent.h> @@ -639,6 +641,30 @@ static int lxcContainerSetupMounts(virDomainDefPtr vmDef, return lxcContainerSetupExtraMounts(vmDef); } + +static int lxcContainerDropCapabilities( virDomainDefPtr vmDef ) +{ + int i; + const struct { + int id; + const char *name; + } caps[] = { +#define ID_STRING(name) name, #name + { ID_STRING(CAP_SYS_BOOT) }, + }; + + for (i = 0 ; i < ARRAY_CARDINALITY(caps) ; i++) { + if (prctl(PR_CAPBSET_DROP, caps[i].id, 0, 0, 0)) { + lxcError(NULL, NULL, VIR_ERR_INTERNAL_ERROR, + "%s", _("failed to drop %s"), caps[i].name); + return -1; + } + } + + return 0; +} + + /** * lxcChild: * @argv: Pointer to container arguments @@ -705,6 +731,10 @@ static int lxcContainerChild( void *data ) if (lxcContainerEnableInterfaces(argv->nveths, argv->veths) < 0) return -1; + /* drop a set of root capabilities */ + if (lxcContainerDropCapabilities(vmDef) < 0) + return -1; + /* this function will only return if an error occured */ return lxcContainerExecInit(vmDef); } -- 1.6.0.6 -- Libvir-list mailing list Libvir-list(a)redhat.com https://www.redhat.com/mailman/listinfo/libvir-list

On Fri, May 08, 2009 at 09:04:35AM +0900, Ryota Ozaki wrote: > Hi, > > Current lxc driver unexpectedly allows users inside containers to reboot > host physical machine. This patch prevents this by dropping CAP_SYS_BOOT > capability in the bounding set of the init processes in every containers. > > Note that the patch intends to make it easy to add further capabilities > to drop if needed, although I'm not sure which capabilities should be > dropped. (We might need to drop CAP_SETFCAP as well to be strict...) > > Thanks, > ozaki-r > > Signed-off-by: Ryota Ozaki <ozaki.ryota(a)gmail.com&gt; > > >From 0e7a7622bc6411bbe76c05c63c6e6e61d379d97b Mon Sep 17 00:00:00 2001 > From: Ryota Ozaki <ozaki.ryota(a)gmail.com&gt; > Date: Fri, 8 May 2009 04:29:24 +0900 > Subject: [PATCH] lxc: drop CAP_SYS_BOOT capability to prevent > rebooting from inside containers > > Current lxc driver unexpectedly allows users inside containers to reboot > host physical machine. This patch prevents this by dropping CAP_SYS_BOOT > capability in the bounding set of the init processes in every containers. > --- > src/lxc_container.c | 30 ++++++++++++++++++++++++++++++ > 1 files changed, 30 insertions(+), 0 deletions(-) > > diff --git a/src/lxc_container.c b/src/lxc_container.c > index 3946b84..37ab216 100644 > --- a/src/lxc_container.c > +++ b/src/lxc_container.c > @@ -32,6 +32,8 @@ > #include <sys/ioctl.h> > #include <sys/mount.h> > #include <sys/wait.h> > +#include <sys/prctl.h> > +#include <sys/capability.h> > #include <unistd.h> > #include <mntent.h> I had to move those 2 includes after #include <linux/fs.h> otherwise MS_MOVE which is defined in the later would not be found anymore. Weird but true ! > @@ -639,6 +641,30 @@ static int lxcContainerSetupMounts(virDomainDefPtr vmDef, > return lxcContainerSetupExtraMounts(vmDef); > } > > + > +static int lxcContainerDropCapabilities( virDomainDefPtr vmDef ) > +{ > + int i; > + const struct { > + int id; > + const char *name; > + } caps[] = { > +#define ID_STRING(name) name, #name > + { ID_STRING(CAP_SYS_BOOT) }, > + }; > + > + for (i = 0 ; i < ARRAY_CARDINALITY(caps) ; i++) { > + if (prctl(PR_CAPBSET_DROP, caps[i].id, 0, 0, 0)) { > + lxcError(NULL, NULL, VIR_ERR_INTERNAL_ERROR, > + "%s", _("failed to drop %s"), caps[i].name); Here the compiler complained about the args it really should be lxcError(NULL, NULL, VIR_ERR_INTERNAL_ERROR, _("failed to drop %s"), caps[i].name); > + return -1; > + } > + } > + > + return 0; > +} > + That said with the two fixes this looks like a good patch, so applied and commited, thanks ! Daniel