summaryrefslogtreecommitdiff
path: root/pkg
diff options
context:
space:
mode:
authorDaniel J Walsh <dwalsh@redhat.com>2021-05-01 05:50:31 -0400
committerDaniel J Walsh <dwalsh@redhat.com>2021-05-04 14:40:43 -0400
commit4fd1965ab4d1395b5cc4a0e03526ef9c43f794ec (patch)
treee944a81bbdd86ab0e166923c2fde320311718de0 /pkg
parent7f2c27d43fc5d109c156e6203bf4901853b3cc7a (diff)
downloadpodman-4fd1965ab4d1395b5cc4a0e03526ef9c43f794ec.tar.gz
podman-4fd1965ab4d1395b5cc4a0e03526ef9c43f794ec.tar.bz2
podman-4fd1965ab4d1395b5cc4a0e03526ef9c43f794ec.zip
Add filepath glob support to --security-opt unmask
Want to allow users to specify --security-opt unmask=/proc/*. This allows us to run podman within podman more securely, then specifing umask=all, also gives the user more flexibilty. Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
Diffstat (limited to 'pkg')
-rw-r--r--pkg/specgen/generate/config_linux.go56
-rw-r--r--pkg/specgen/generate/config_linux_test.go28
2 files changed, 61 insertions, 23 deletions
diff --git a/pkg/specgen/generate/config_linux.go b/pkg/specgen/generate/config_linux.go
index 5c945cff3..6b9e9c4bf 100644
--- a/pkg/specgen/generate/config_linux.go
+++ b/pkg/specgen/generate/config_linux.go
@@ -10,7 +10,6 @@ import (
"github.com/containers/podman/v3/libpod/define"
"github.com/containers/podman/v3/pkg/rootless"
- "github.com/containers/podman/v3/pkg/util"
spec "github.com/opencontainers/runtime-spec/specs-go"
"github.com/opencontainers/runtime-tools/generate"
"github.com/pkg/errors"
@@ -151,30 +150,23 @@ func BlockAccessToKernelFilesystems(privileged, pidModeIsHost bool, mask, unmask
"/sys/dev/block",
}
- unmaskAll := false
- if unmask != nil && unmask[0] == "ALL" {
- unmaskAll = true
- }
-
if !privileged {
- if !unmaskAll {
- for _, mp := range defaultMaskPaths {
- // check that the path to mask is not in the list of paths to unmask
- if !util.StringInSlice(mp, unmask) {
- g.AddLinuxMaskedPaths(mp)
- }
+ for _, mp := range defaultMaskPaths {
+ // check that the path to mask is not in the list of paths to unmask
+ if shouldMask(mp, unmask) {
+ g.AddLinuxMaskedPaths(mp)
}
- for _, rp := range []string{
- "/proc/asound",
- "/proc/bus",
- "/proc/fs",
- "/proc/irq",
- "/proc/sys",
- "/proc/sysrq-trigger",
- } {
- if !util.StringInSlice(rp, unmask) {
- g.AddLinuxReadonlyPaths(rp)
- }
+ }
+ for _, rp := range []string{
+ "/proc/asound",
+ "/proc/bus",
+ "/proc/fs",
+ "/proc/irq",
+ "/proc/sys",
+ "/proc/sysrq-trigger",
+ } {
+ if shouldMask(rp, unmask) {
+ g.AddLinuxReadonlyPaths(rp)
}
}
@@ -376,3 +368,21 @@ func supportAmbientCapabilities() bool {
err := unix.Prctl(unix.PR_CAP_AMBIENT, unix.PR_CAP_AMBIENT_IS_SET, 0, 0, 0)
return err == nil
}
+
+func shouldMask(mask string, unmask []string) bool {
+ for _, m := range unmask {
+ if strings.ToLower(m) == "all" {
+ return false
+ }
+ for _, m1 := range strings.Split(m, ":") {
+ match, err := filepath.Match(m1, mask)
+ if err != nil {
+ logrus.Errorf(err.Error())
+ }
+ if match {
+ return false
+ }
+ }
+ }
+ return true
+}
diff --git a/pkg/specgen/generate/config_linux_test.go b/pkg/specgen/generate/config_linux_test.go
new file mode 100644
index 000000000..39973324b
--- /dev/null
+++ b/pkg/specgen/generate/config_linux_test.go
@@ -0,0 +1,28 @@
+package generate
+
+import (
+ "testing"
+
+ "github.com/stretchr/testify/assert"
+)
+
+func TestShouldMask(t *testing.T) {
+ tests := []struct {
+ mask string
+ unmask []string
+ shouldMask bool
+ }{
+ {"/proc/foo", []string{"all"}, false},
+ {"/proc/foo", []string{"ALL"}, false},
+ {"/proc/foo", []string{"/proc/foo"}, false},
+ {"/proc/foo", []string{"/proc/*"}, false},
+ {"/proc/foo", []string{"/proc/bar", "all"}, false},
+ {"/proc/foo", []string{"/proc/f*"}, false},
+ {"/proc/foo", []string{"/proc/b*"}, true},
+ {"/proc/foo", []string{}, true},
+ }
+ for _, test := range tests {
+ val := shouldMask(test.mask, test.unmask)
+ assert.Equal(t, val, test.shouldMask)
+ }
+}