Skip to content

Commit 87bd784

Browse files
committed
Add dmz-vs-selinux kludge and a way to disable it
Add a workaround for a problem of older container-selinux not allowing runc to use dmz feature. If runc sees that SELinux is in enforced mode and the container's SELinux label is set, it disables dmz. Add a build tag, runc_dmz_selinux_nocompat, which disables the workaround. Newer distros that ship container-selinux >= 2.224.0 (currently CentOS Stream 8 and 9, RHEL 8 and 9, and Fedora 38+) may build runc with this build tag set to benefit from dmz working with SELinux. Document the build tag in the top-level and libct/dmz READMEs. Use the build tag in our CI builds for CentOS Stream 9 and Fedora 38, as they already has container-selinux 2.224.0 available in updates. Add a TODO to use the build tag for CentOS Stream 8 once it has container-selinux updated. Signed-off-by: Kir Kolyshkin <[email protected]>
1 parent 393c7a8 commit 87bd784

File tree

7 files changed

+71
-1
lines changed

7 files changed

+71
-1
lines changed

.cirrus.yml

Lines changed: 12 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -57,7 +57,7 @@ task:
5757
mkdir -p -m 0700 /root/.ssh
5858
vagrant ssh-config >> /root/.ssh/config
5959
guest_info_script: |
60-
ssh default 'sh -exc "uname -a && systemctl --version && df -T && cat /etc/os-release && go version && sestatus"'
60+
ssh default 'sh -exc "uname -a && systemctl --version && df -T && cat /etc/os-release && go version && sestatus && rpm -q container-selinux"'
6161
check_config_script: |
6262
ssh default /vagrant/script/check-config.sh
6363
unit_tests_script: |
@@ -159,6 +159,17 @@ task:
159159
echo -e "Host localhost\n\tStrictHostKeyChecking no\t\nIdentityFile /root/.ssh/id_ed25519\n" >> /root/.ssh/config
160160
sed -e "s,PermitRootLogin.*,PermitRootLogin prohibit-password,g" -i /etc/ssh/sshd_config
161161
systemctl restart sshd
162+
163+
# Disable the dmz-vs-selinux workaround for distros that have container-selinux >= 2.224.0.
164+
case $DISTRO in
165+
# TODO: remove centos-stream-8.
166+
centos-7|centos-stream-8)
167+
# Do nothing.
168+
;;
169+
*)
170+
echo 'export EXTRA_BUILDTAGS=runc_dmz_selinux_nocompat' >> /root/.bashrc
171+
;;
172+
esac
162173
host_info_script: |
163174
uname -a
164175
# -----

README.md

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -69,13 +69,15 @@ make BUILDTAGS=""
6969
|---------------|---------------------------------------|--------------------|---------------------|
7070
| `seccomp` | Syscall filtering using `libseccomp`. | yes | `libseccomp` |
7171
| `!runc_nodmz` | Reduce memory usage for CVE-2019-5736 protection by using a small C binary, [see `memfd-bind` for more details][contrib-memfd-bind]. `runc_nodmz` disables this feature and causes runc to use a different protection mechanism which will further increases memory usage temporarily during container startup. This feature can also be disabled at runtime by setting the `RUNC_DMZ=legacy` environment variable. | yes ||
72+
| `runc_dmz_selinux_nocompat` | Disables a SELinux DMZ workaround (new distros should set this). See [dmz README] for details. | no ||
7273

7374
The following build tags were used earlier, but are now obsoleted:
7475
- **nokmem** (since runc v1.0.0-rc94 kernel memory settings are ignored)
7576
- **apparmor** (since runc v1.0.0-rc93 the feature is always enabled)
7677
- **selinux** (since runc v1.0.0-rc93 the feature is always enabled)
7778

7879
[contrib-memfd-bind]: /contrib/cmd/memfd-bind/README.md
80+
[dmz README]: /libcontainer/dmz/README.md
7981

8082
### Running the test suite
8183

Vagrantfile.fedora

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -32,6 +32,9 @@ EOF
3232
# To avoid "avc: denied { nosuid_transition }" from SELinux as we run tests on /tmp.
3333
mount -o remount,suid /tmp
3434
35+
# Disable selinux-vs-dmz workaround as Fedora doesn't need it.
36+
echo 'export EXTRA_BUILDTAGS=runc_dmz_selinux_nocompat' >> /root/.bashrc
37+
3538
# Prevent the "fatal: unsafe repository" git complain during build.
3639
git config --global --add safe.directory /vagrant
3740

libcontainer/container_linux.go

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -457,6 +457,10 @@ func slicesContains[S ~[]E, E comparable](slice S, needle E) bool {
457457
}
458458

459459
func isDmzBinarySafe(c *configs.Config) bool {
460+
if !dmz.WorksWithSELinux(c) {
461+
return false
462+
}
463+
460464
// Because we set the dumpable flag in nsexec, the only time when it is
461465
// unsafe to use runc-dmz is when the container process would be able to
462466
// race against "runc init" and bypass the ptrace_may_access() checks.

libcontainer/dmz/README.md

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -15,4 +15,16 @@ It also support all the architectures we support in runc.
1515

1616
If the GOARCH we use for compiling doesn't support nolibc, it fallbacks to using the C stdlib.
1717

18+
## SELinux compatibility issue and a workaround
19+
20+
Older SELinux policy can prevent runc to execute the dmz binary. The issue is
21+
fixed in [container-selinux v2.224.0]. Yet, some older distributions may not
22+
have the fix, so runc has a runtime workaround of disabling dmz if it finds
23+
that SELinux is in enforced mode and the container SELinux label is set.
24+
25+
Distributions that have a sufficiently new container-selinux can disable the
26+
workaround by building runc with the `runc_dmz_selinux_nocompat` build flag,
27+
essentially allowing dmz to be used together with SELinux.
28+
1829
[nolibc-upstream]: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/tools/include/nolibc?h=v6.6-rc3
30+
[container-selinux v2.224.0]: https://github.com/containers/container-selinux/releases/tag/v2.224.0

libcontainer/dmz/selinux.go

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
//go:build runc_dmz_selinux_nocompat || !linux
2+
3+
package dmz
4+
5+
import "github.com/opencontainers/runc/libcontainer/configs"
6+
7+
// WorksWithSELinux tells whether runc-dmz can work with SELinux.
8+
func WorksWithSELinux(*configs.Config) bool {
9+
return true
10+
}

libcontainer/dmz/selinux_compat.go

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
//go:build linux && !runc_dmz_selinux_nocompat
2+
3+
package dmz
4+
5+
import (
6+
"github.com/opencontainers/runc/libcontainer/configs"
7+
"github.com/opencontainers/selinux/go-selinux"
8+
)
9+
10+
// WorksWithSELinux tells whether runc-dmz can work with SELinux.
11+
//
12+
// Older SELinux policy can prevent runc to execute the dmz binary. The issue is
13+
// fixed in container-selinux >= 2.224.0:
14+
//
15+
// - https://github.com/containers/container-selinux/issues/274
16+
// - https://github.com/containers/container-selinux/pull/280
17+
//
18+
// Alas, there is is no easy way to do a runtime check if dmz works with
19+
// SELinux, so the below workaround is enabled by default. It results in
20+
// disabling dmz in case container SELinux label is set and the selinux is in
21+
// enforced mode.
22+
//
23+
// Newer distributions that have the sufficiently new container-selinux version
24+
// can build runc with runc_dmz_selinux_nocompat build flag to disable this
25+
// workaround (essentially allowing dmz to be used together with SELinux).
26+
func WorksWithSELinux(c *configs.Config) bool {
27+
return c.ProcessLabel == "" || selinux.EnforceMode() != selinux.Enforcing
28+
}

0 commit comments

Comments
 (0)