From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1754394AbcFGTJw (ORCPT ); Tue, 7 Jun 2016 15:09:52 -0400 Received: from mx1.redhat.com ([209.132.183.28]:54912 "EHLO mx1.redhat.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1754169AbcFGTJu (ORCPT ); Tue, 7 Jun 2016 15:09:50 -0400 Date: Tue, 7 Jun 2016 21:09:42 +0200 From: Mateusz Guzik To: Zhao Lei Cc: linux-kernel@vger.kernel.org, containers@lists.linux-foundation.org, "Eric W. Biederman" , Kamezawa Hiroyuki Subject: Re: [PATCH v2 3/3] Write dump into container's filesystem for pipe_type core_pattern Message-ID: <20160607190941.d4hfqehvwxylon4l@mguzik> References: <9d61a9a95ca4c323adc182abf32714b46e963405.1465293010.git.zhaolei@cn.fujitsu.com> MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Disposition: inline In-Reply-To: <9d61a9a95ca4c323adc182abf32714b46e963405.1465293010.git.zhaolei@cn.fujitsu.com> User-Agent: Mutt/1.6.0.1 (2016-04-01) X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.5.110.38]); Tue, 07 Jun 2016 19:09:50 +0000 (UTC) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Tue, Jun 07, 2016 at 07:29:37PM +0800, Zhao Lei wrote: > In current system, when we set core_pattern to a pipe, both pipe program > and program's output are in host's filesystem. > But when we set core_pattern to a file, the container will write dump > into container's filesystem. > > For example, when we set following core_pattern: > # echo "|/my_dump_pipe %s %c %p %u %g %t e" >/proc/sys/kernel/core_pattern > and trigger a segment fault in a container, my_dump_pipe is searched from > host's filesystem, and it will write coredump into host's filesystem too. > > In a privileged container, user can destroy host system by following > command: > # # In a container > # echo "|/bin/dd of=/boot/vmlinuz" >/proc/sys/kernel/core_pattern > # make_dump > > Actually, all operation in a container should not change host's > environment, the container should use core_pattern as its private setting. > In detail, in core dump action: > 1: Search pipe program in container's fs namespace. > 2: Run pipe program in container's fs namespace to write coredump to it. > > This patch fixed above problem by running pipe program with container's > fs_root. > This does not look sufficient, but I can't easily verify. For instance, is the spawned process able to attach itself with ptrace to processes outside of the original container? Even if not, can it mount procfs and use /proc/pid/root of processes outside of said container? The spawned process should be subject to all limitations imposed on the container (which may mean it just must be in the container). -- Mateusz Guzik