packages/runc
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

!65 runc: change Umask to 0022

Browse Source 
From: @zhong-jiawei-1 
Reviewed-by: @duguhaotian, @Vanient 
Signed-off-by: @duguhaotian
This commit is contained in:
openeuler-ci-bot 2022-08-09 12:01:42 +00:00 committed by Gitee
commit c1abbefb72
No known key found for this signature in database
GPG Key ID: 173E9B9CA92EEF8F
4 changed files with 7 additions and 128 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

52
patch/0033-runc-change-runc-default-umask-to-027.patch
View File

@ -1,52 +0,0 @@
From 49ff7be84939cf93b8bf4861ddc783704fb3f50b Mon Sep 17 00:00:00 2001
From: dengguangxing <dengguangxing@huawei.com>
Date: Mon, 8 Jan 2018 10:35:34 +0800
Subject: [PATCH 33/94] runc: change runc default umask to 027
[Changelog]:change runc default umask to 027
change exec process default umask to 0027
Change-Id: Ia7ff0216adc17d61586954de83031be21ab88338
Signed-off-by: dengguangxing <dengguangxing@huawei.com>
---
libcontainer/rootfs_linux.go | 2 +-
libcontainer/setns_init_linux.go | 3 +++
2 files changed, 4 insertions(+), 1 deletion(-)
diff --git a/libcontainer/rootfs_linux.go b/libcontainer/rootfs_linux.go
index d507373..1c93903 100644
--- a/libcontainer/rootfs_linux.go
+++ b/libcontainer/rootfs_linux.go
@@ -136,7 +136,7 @@ func finalizeRootfs(config *configs.Config) (err error) {
}
}
- syscall.Umask(0022)
+ syscall.Umask(0027)
return nil
}
diff --git a/libcontainer/setns_init_linux.go b/libcontainer/setns_init_linux.go
index 48cc0ae..e8e969a 100644
--- a/libcontainer/setns_init_linux.go
+++ b/libcontainer/setns_init_linux.go
@@ -5,6 +5,7 @@ package libcontainer
import (
"fmt"
"os"
+ "syscall"
"github.com/opencontainers/runc/libcontainer/apparmor"
"github.com/opencontainers/runc/libcontainer/keys"
@@ -40,6 +41,8 @@ func (l *linuxSetnsInit) Init() error {
return err
}
}
+ // set exec process umask to 0027 according to secure policy
+ syscall.Umask(0027)
if l.config.NoNewPrivileges {
if err := system.Prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0); err != nil {
return err
--
2.7.4.3

73
patch/0080-runc-support-specify-umask.patch
View File

@ -1,73 +0,0 @@
From 18f5c5e20e342af002b0edb2295f64ea12632cc4 Mon Sep 17 00:00:00 2001
From: wangfengtu <wangfengtu@huawei.com>
Date: Fri, 21 Dec 2018 15:02:16 +0800
Subject: [PATCH 80/94] runc: support specify umask
reason:support specify umask.
Umask can be 0022 or 0027(default) by specify umask when
start container by command `docker create/run` or start
daemon by command `dockerd`. For example:
$ dockerd --annotation native.umask=normal
$ dockerd --annotation native.umask=secure
$ docker run --exec-opt native.umask=normal
$ docker run --exec-opt native.umask=secure
`normal` reparent umask is 0022, `secure`
reparent umask is 0027.
Change-Id: I49166759ad42dca0ac1f9755f85592e93951c249
Signed-off-by: lujingxiao <lujingxiao@huawei.com>
Signed-off-by: wangfengtu <wangfengtu@huawei.com>
---
libcontainer/rootfs_linux.go | 7 ++++++-
libcontainer/setns_init_linux.go | 10 ++++++++--
2 files changed, 14 insertions(+), 3 deletions(-)
diff --git a/libcontainer/rootfs_linux.go b/libcontainer/rootfs_linux.go
index 38bdd1b..3dd5113 100644
--- a/libcontainer/rootfs_linux.go
+++ b/libcontainer/rootfs_linux.go
@@ -136,7 +136,12 @@ func finalizeRootfs(config *configs.Config) (err error) {
}
}
- syscall.Umask(0027)
+ umask := libcontainerUtils.SearchLabels(config.Labels, "native.umask")
+ if umask == "normal" {
+ syscall.Umask(0022)
+ } else {
+ syscall.Umask(0027)
+ }
return nil
}
diff --git a/libcontainer/setns_init_linux.go b/libcontainer/setns_init_linux.go
index e8e969a..b3fab21 100644
--- a/libcontainer/setns_init_linux.go
+++ b/libcontainer/setns_init_linux.go
@@ -11,6 +11,7 @@ import (
"github.com/opencontainers/runc/libcontainer/keys"
"github.com/opencontainers/runc/libcontainer/seccomp"
"github.com/opencontainers/runc/libcontainer/system"
+ "github.com/opencontainers/runc/libcontainer/utils"
"github.com/opencontainers/selinux/go-selinux/label"
)
@@ -41,8 +42,13 @@ func (l *linuxSetnsInit) Init() error {
return err
}
}
- // set exec process umask to 0027 according to secure policy
- syscall.Umask(0027)
+ // set exec process umask to 0027 or 0022 according to container's config
+ umask := utils.SearchLabels(l.config.Config.Labels, "native.umask")
+ if umask == "normal" {
+ syscall.Umask(0022)
+ } else {
+ syscall.Umask(0027)
+ }
if l.config.NoNewPrivileges {
if err := system.Prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0); err != nil {
return err
--
2.7.4.3

8
runc-openeuler.spec
View File

@ -2,7 +2,7 @@
Name: docker-runc
Version: 1.0.0.rc3
Release: 204
Release: 205
Summary: runc is a CLI tool for spawning and running containers according to the OCI specification.
License: ASL 2.0
@ -41,6 +41,12 @@ install -p -m 755 runc $RPM_BUILD_ROOT/%{_bindir}/runc
%{_bindir}/runc
%changelog
* Tue Aug 9 2022 zhongjiawei<zhongjiawei1@huawei.com> - 1.0.0.rc3-205
- Type:bugfix
- CVE:NA
- SUG:NA
- DESC:change Uamsk to 0022
* Thu Jun 03 2021 xiadanni<xiadanni1@huawei.com> - 1.0.0.rc3-204
- Type:CVE
- CVE:CVE-2022-29162

2
series.conf
View File

@ -30,7 +30,6 @@
0030-Update-memory-specs-to-use-int64-not-uint64.patch
0031-Add-spec-for-euleros.patch
0032-runc-17-Always-save-own-namespace-paths.patch
0033-runc-change-runc-default-umask-to-027.patch
0034-runc-17-Add-some-compatibility-code-to-surpor.patch
0035-runc-17-Add-root-to-HookState-for-compatibili.patch
0036-runc-17-add-compatibility-for-docker-1.11.2.patch
@ -75,7 +74,6 @@
0077-runc-Require-libseccomp-static-lib-for-upgrade-f.patch
0078-runc-Fix-race-in-runc-exec.patch
0079-runc-modify-spec-file-for-upgrade.patch
0080-runc-support-specify-umask.patch
0081-runc-fix-oom-killer-disable-unhandled-due-t.patch
0082-runc-make-runc-spec-and-docker-18.9-compati.patch
0083-log-fix-runc-log-decode-failed.patch