From 4fd1965ab4d1395b5cc4a0e03526ef9c43f794ec Mon Sep 17 00:00:00 2001
From: Daniel J Walsh <dwalsh@redhat.com>
Date: Sat, 1 May 2021 05:50:31 -0400
Subject: Add filepath glob support to --security-opt unmask

Want to allow users to specify --security-opt unmask=/proc/*.
This allows us to run podman within podman more securely, then
specifing umask=all, also gives the user more flexibilty.

Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
---
 pkg/specgen/generate/config_linux.go      | 56 ++++++++++++++++++-------------
 pkg/specgen/generate/config_linux_test.go | 28 ++++++++++++++++
 2 files changed, 61 insertions(+), 23 deletions(-)
 create mode 100644 pkg/specgen/generate/config_linux_test.go

(limited to 'pkg/specgen/generate')

diff --git a/pkg/specgen/generate/config_linux.go b/pkg/specgen/generate/config_linux.go
index 5c945cff3..6b9e9c4bf 100644
--- a/pkg/specgen/generate/config_linux.go
+++ b/pkg/specgen/generate/config_linux.go
@@ -10,7 +10,6 @@ import (
 
 	"github.com/containers/podman/v3/libpod/define"
 	"github.com/containers/podman/v3/pkg/rootless"
-	"github.com/containers/podman/v3/pkg/util"
 	spec "github.com/opencontainers/runtime-spec/specs-go"
 	"github.com/opencontainers/runtime-tools/generate"
 	"github.com/pkg/errors"
@@ -151,30 +150,23 @@ func BlockAccessToKernelFilesystems(privileged, pidModeIsHost bool, mask, unmask
 		"/sys/dev/block",
 	}
 
-	unmaskAll := false
-	if unmask != nil && unmask[0] == "ALL" {
-		unmaskAll = true
-	}
-
 	if !privileged {
-		if !unmaskAll {
-			for _, mp := range defaultMaskPaths {
-				// check that the path to mask is not in the list of paths to unmask
-				if !util.StringInSlice(mp, unmask) {
-					g.AddLinuxMaskedPaths(mp)
-				}
+		for _, mp := range defaultMaskPaths {
+			// check that the path to mask is not in the list of paths to unmask
+			if shouldMask(mp, unmask) {
+				g.AddLinuxMaskedPaths(mp)
 			}
-			for _, rp := range []string{
-				"/proc/asound",
-				"/proc/bus",
-				"/proc/fs",
-				"/proc/irq",
-				"/proc/sys",
-				"/proc/sysrq-trigger",
-			} {
-				if !util.StringInSlice(rp, unmask) {
-					g.AddLinuxReadonlyPaths(rp)
-				}
+		}
+		for _, rp := range []string{
+			"/proc/asound",
+			"/proc/bus",
+			"/proc/fs",
+			"/proc/irq",
+			"/proc/sys",
+			"/proc/sysrq-trigger",
+		} {
+			if shouldMask(rp, unmask) {
+				g.AddLinuxReadonlyPaths(rp)
 			}
 		}
 
@@ -376,3 +368,21 @@ func supportAmbientCapabilities() bool {
 	err := unix.Prctl(unix.PR_CAP_AMBIENT, unix.PR_CAP_AMBIENT_IS_SET, 0, 0, 0)
 	return err == nil
 }
+
+func shouldMask(mask string, unmask []string) bool {
+	for _, m := range unmask {
+		if strings.ToLower(m) == "all" {
+			return false
+		}
+		for _, m1 := range strings.Split(m, ":") {
+			match, err := filepath.Match(m1, mask)
+			if err != nil {
+				logrus.Errorf(err.Error())
+			}
+			if match {
+				return false
+			}
+		}
+	}
+	return true
+}
diff --git a/pkg/specgen/generate/config_linux_test.go b/pkg/specgen/generate/config_linux_test.go
new file mode 100644
index 000000000..39973324b
--- /dev/null
+++ b/pkg/specgen/generate/config_linux_test.go
@@ -0,0 +1,28 @@
+package generate
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestShouldMask(t *testing.T) {
+	tests := []struct {
+		mask       string
+		unmask     []string
+		shouldMask bool
+	}{
+		{"/proc/foo", []string{"all"}, false},
+		{"/proc/foo", []string{"ALL"}, false},
+		{"/proc/foo", []string{"/proc/foo"}, false},
+		{"/proc/foo", []string{"/proc/*"}, false},
+		{"/proc/foo", []string{"/proc/bar", "all"}, false},
+		{"/proc/foo", []string{"/proc/f*"}, false},
+		{"/proc/foo", []string{"/proc/b*"}, true},
+		{"/proc/foo", []string{}, true},
+	}
+	for _, test := range tests {
+		val := shouldMask(test.mask, test.unmask)
+		assert.Equal(t, val, test.shouldMask)
+	}
+}
-- 
cgit v1.2.3-54-g00ecf