Uh oh!
There was an error while loading. Please reload this page.
Change /dev to be mounted by default with /noexec - #725
Conversation
rhatdan
commented
Sep 24, 2021
@mrunalp PTAL |
rhatdan
commented
Sep 24, 2021
@runtime-tools-maintainers PTAL |
rhatdan
commented
Sep 24, 2021
@ caniszczyk, @crosbymichael, @dqminh, @hqhq, @liangchenye, @Mashimiao, @mrunalp, @tianon, @vbatts,@vishh, @zhouhao3 PTAL |
rhatdan
commented
Sep 24, 2021
For what it is worth, I ran this change through Podman's test suite with no failures. |
tianon
left a comment
There was a problem hiding this comment.
LGTM, although I'm not sure whether many other projects are using this particular code? (I believe runc, containerd, etc all have their own versions of this)
rhatdan
commented
Sep 25, 2021
Well it is used in Podman, Buildah, CRI-O. |
LGTM |
vbatts
commented
Sep 28, 2021
bah, Travis needs to be removed and switched to GitHub actions |
amye
commented
Sep 29, 2021
@caniszczyk ^ |
kolyshkin
commented
Oct 15, 2021
kolyshkin
commented
Oct 19, 2021
Let's merge this one only after #728 so we have CI. |
kolyshkin
commented
Oct 20, 2021
@rhatdan can you please rebase? This repo has CI now :) |
Podman had an issue, where someone was attemptig to mount all tmpfs within the container as noexec. They were able to get most of it done but "/dev", because it was done down in the runtime spec. I can think of no reason why "/dev", should not be mounted with noexec especially within a container. I know it is not mounted by default in Fedora that way, but I do not know why. Debian looks like it has made the change, and only one bug a couple of years ago showed issues, which would not apply to containers. https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=940171 Anyways this would make containers "slightly" more secure, and I think it is worth doing. Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
Podman had an issue, where someone was attemptig to mount all tmpfs
within the container as noexec. They were able to get most of it done
but "/dev", because it was done down in the runtime spec.
I can think of no reason why "/dev", should not be mounted with noexec
especially within a container. I know it is not mounted by default in
Fedora that way, but I do not know why.
Debian looks like it has made the change, and only one bug a couple of
years ago showed issues, which would not apply to containers.
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=940171
Anyways this would make containers "slightly" more secure, and I think it
is worth doing.
Signed-off-by: Daniel J Walsh dwalsh@redhat.com