| From 0aad93f08ca4da8f33ad709dbe49593f6ff5c59c Mon Sep 17 00:00:00 2001 |
| From: Vinayak Goyal <vinaygo@google.com> |
| Date: Fri, 24 Mar 2023 21:34:34 +0000 |
| Subject: [PATCH 1/3] Add noexec nodev and nosuid to sandbox /etc/resolv.conf |
| mount bind. |
| |
| Signed-off-by: Vinayak Goyal <vinaygo@google.com> |
| (cherry picked from commit ae4dbb60d5e339bfcd5e8f41cdb0f8418e35ce54) |
| Signed-off-by: Vinayak Goyal <vinaygo@google.com> |
| --- |
| pkg/cri/server/sandbox_run_linux.go | 2 +- |
| 1 file changed, 1 insertion(+), 1 deletion(-) |
| |
| diff --git a/pkg/cri/server/sandbox_run_linux.go b/pkg/cri/server/sandbox_run_linux.go |
| index 381b38b8928..939fa63d435 100644 |
| --- a/pkg/cri/server/sandbox_run_linux.go |
| +++ b/pkg/cri/server/sandbox_run_linux.go |
| @@ -135,7 +135,7 @@ func (c *criService) sandboxContainerSpec(id string, config *runtime.PodSandboxC |
| Source: c.getResolvPath(id), |
| Destination: resolvConfPath, |
| Type: "bind", |
| - Options: []string{"rbind", "ro"}, |
| + Options: []string{"rbind", "ro", "nosuid", "nodev", "noexec"}, |
| }, |
| })) |
| |
| |
| From 5e953cfa62abb90b2c4dc775907cbb276637bfe8 Mon Sep 17 00:00:00 2001 |
| From: Vinayak Goyal <vinaygo@google.com> |
| Date: Wed, 29 Mar 2023 18:36:01 +0000 |
| Subject: [PATCH 2/3] Test to ensure nosuid,nodev,noexec are set on |
| /etc/reolv.conf mount. |
| |
| Signed-off-by: Vinayak Goyal <vinaygo@google.com> |
| (cherry picked from commit 990199a021fcbb5330cc3e050e581565f025366e) |
| Signed-off-by: Vinayak Goyal <vinaygo@google.com> |
| --- |
| pkg/cri/server/sandbox_run_linux_test.go | 8 ++++++++ |
| 1 file changed, 8 insertions(+) |
| |
| diff --git a/pkg/cri/server/sandbox_run_linux_test.go b/pkg/cri/server/sandbox_run_linux_test.go |
| index 9c646e06947..70209a45d27 100644 |
| --- a/pkg/cri/server/sandbox_run_linux_test.go |
| +++ b/pkg/cri/server/sandbox_run_linux_test.go |
| @@ -91,6 +91,14 @@ func getRunPodSandboxTestData() (*runtime.PodSandboxConfig, *imagespec.ImageConf |
| assert.NotEqual(t, "", spec.Process.SelinuxLabel) |
| assert.NotEqual(t, "", spec.Linux.MountLabel) |
| } |
| + |
| + assert.Contains(t, spec.Mounts, runtimespec.Mount{ |
| + Source: "/test/root/sandboxes/test-id/resolv.conf", |
| + Destination: resolvConfPath, |
| + Type: "bind", |
| + Options: []string{"rbind", "ro", "nosuid", "nodev", "noexec"}, |
| + }) |
| + |
| } |
| return config, imageConfig, specCheck |
| } |
| |
| From 9b4935d86436419670febe9695787a3aaf5ceeb7 Mon Sep 17 00:00:00 2001 |
| From: Vinayak Goyal <vinaygo@google.com> |
| Date: Thu, 30 Mar 2023 21:52:19 +0000 |
| Subject: [PATCH 3/3] Update sbserver to add noexec nodev and nosuid to |
| /etc/resolv.conf mount bind. |
| |
| Signed-off-by: Vinayak Goyal <vinaygo@google.com> |
| (cherry picked from commit ac84bf7c893bcce52e0ba7a44c9e37e02c945d0d) |
| Signed-off-by: Vinayak Goyal <vinaygo@google.com> |
| --- |
| pkg/cri/sbserver/podsandbox/sandbox_run_linux.go | 2 +- |
| pkg/cri/sbserver/podsandbox/sandbox_run_linux_test.go | 8 ++++++++ |
| 2 files changed, 9 insertions(+), 1 deletion(-) |
| |
| diff --git a/pkg/cri/sbserver/podsandbox/sandbox_run_linux.go b/pkg/cri/sbserver/podsandbox/sandbox_run_linux.go |
| index 437d792ceee..d0f95a706e7 100644 |
| --- a/pkg/cri/sbserver/podsandbox/sandbox_run_linux.go |
| +++ b/pkg/cri/sbserver/podsandbox/sandbox_run_linux.go |
| @@ -117,7 +117,7 @@ func (c *Controller) sandboxContainerSpec(id string, config *runtime.PodSandboxC |
| Source: c.getResolvPath(id), |
| Destination: resolvConfPath, |
| Type: "bind", |
| - Options: []string{"rbind", "ro"}, |
| + Options: []string{"rbind", "ro", "nosuid", "nodev", "noexec"}, |
| }, |
| })) |
| |
| diff --git a/pkg/cri/sbserver/podsandbox/sandbox_run_linux_test.go b/pkg/cri/sbserver/podsandbox/sandbox_run_linux_test.go |
| index 27996a1a37e..4f63407785b 100644 |
| --- a/pkg/cri/sbserver/podsandbox/sandbox_run_linux_test.go |
| +++ b/pkg/cri/sbserver/podsandbox/sandbox_run_linux_test.go |
| @@ -91,6 +91,14 @@ func getRunPodSandboxTestData() (*runtime.PodSandboxConfig, *imagespec.ImageConf |
| assert.NotEqual(t, "", spec.Process.SelinuxLabel) |
| assert.NotEqual(t, "", spec.Linux.MountLabel) |
| } |
| + |
| + assert.Contains(t, spec.Mounts, runtimespec.Mount{ |
| + Source: "/test/root/sandboxes/test-id/resolv.conf", |
| + Destination: resolvConfPath, |
| + Type: "bind", |
| + Options: []string{"rbind", "ro", "nosuid", "nodev", "noexec"}, |
| + }) |
| + |
| } |
| return config, imageConfig, specCheck |
| } |