From 0d5d6dab57590f9f52666031c1979f4cf136d12e Mon Sep 17 00:00:00 2001 From: Giuseppe Scrivano Date: Fri, 25 Oct 2019 21:50:29 +0200 Subject: systemd: mask /sys/fs/cgroup/systemd/release_agent when running in systemd mode on cgroups v1, make sure the /sys/fs/cgroup/systemd/release_agent is masked otherwise the container is able to modify it and execute scripts on the host. Signed-off-by: Giuseppe Scrivano --- libpod/container_internal_linux.go | 1 + 1 file changed, 1 insertion(+) (limited to 'libpod/container_internal_linux.go') diff --git a/libpod/container_internal_linux.go b/libpod/container_internal_linux.go index b7d353327..283d38a0f 100644 --- a/libpod/container_internal_linux.go +++ b/libpod/container_internal_linux.go @@ -550,6 +550,7 @@ func (c *Container) setupSystemd(mounts []spec.Mount, g generate.Generator) erro Options: []string{"bind", "nodev", "noexec", "nosuid"}, } g.AddMount(systemdMnt) + g.AddLinuxMaskedPaths("/sys/fs/cgroup/systemd/release_agent") } return nil -- cgit v1.2.3-54-g00ecf