1
// verifyCwd ensures that the current directory is actually inside the mount
2
// namespace root of the current process.
3
func verifyCwd() error {
4
   // getcwd(2) on Linux detects if cwd is outside of the rootfs of the
5
  // current mount namespace root, and in that case prefixes "(unreachable)"
6
  // to the returned string. glibc's getcwd(3) and Go's Getwd() both detect
7
  // when this happens and return ENOENT rather than returning a non-absolute
8
  // path. In both cases we can therefore easily detect if we have an invalid
9
  // cwd by checking the return value of getcwd(3). See getcwd(3) for more
10
  // details, and CVE-2024-21626 for the security issue that motivated this
11
  // check.
12
  //
13
  // We have to use unix.Getwd() here because os.Getwd() has a workaround for
14
  // $PWD which involves doing stat(.), which can fail if the current
15
  // directory is inaccessible to the container process.
16
  if wd, err := unix.Getwd(); errors.Is(err, unix.ENOENT) {
17
    return errors.New("current working directory is outside of container mount namespace root -- possible container breakout detected")
18
  } else if err != nil {
19
    return fmt.Errorf("failed to verify if current working directory is safe: %w", err)
20
  } else if !filepath.IsAbs(wd) {
21
    // We shouldn't ever hit this, but check just in case.
22
    return fmt.Errorf("current working directory is not absolute -- possible container breakout detected: cwd is %q", wd)
23
  }
24
  return nil
25
}
26
...
27
  // Make sure our final working directory is inside the container.
28
  if err := verifyCwd(); err != nil {
29
    return err
30
  }

1
// CloseExecFrom sets the O_CLOEXEC flag on all file descriptors greater or
2
// equal to minFd in the current process.
3
func CloseExecFrom(minFd int) error {
4
  // Use close_range(CLOSE_RANGE_CLOEXEC) if possible.
5
  if haveCloseRangeCloexec() {
6
    err := unix.CloseRange(uint(minFd), math.MaxUint, unix.CLOSE_RANGE_CLOEXEC)
7
    return os.NewSyscallError("close_range", err)
8
  }
9
  // Otherwise, fall back to the standard loop.
10
  return fdRangeFrom(minFd, unix.CloseOnExec)
11
}
12
//go:linkname runtime_IsPollDescriptor internal/poll.IsPollDescriptor
13
// In order to make sure we do not close the internal epoll descriptors the Go
14
// runtime uses, we need to ensure that we skip descriptors that match
15
// "internal/poll".IsPollDescriptor. Yes, this is a Go runtime internal thing,
16
// unfortunately there's no other way to be sure we're only keeping the file
17
// descriptors the Go runtime needs. Hopefully nothing blows up doing this...
18
func runtime_IsPollDescriptor(fd uintptr) bool //nolint:revive
19
// UnsafeCloseFrom closes all file descriptors greater or equal to minFd in the
20
// current process, except for those critical to Go's runtime (such as the
21
// netpoll management descriptors).
22
//
23
// NOTE: That this function is incredibly dangerous to use in most Go code, as
24
// closing file descriptors from underneath *os.File handles can lead to very
25
// bad behaviour (the closed file descriptor can be re-used and then any
26
// *os.File operations would apply to the wrong file). This function is only
27
// intended to be called from the last stage of runc init.
28
func UnsafeCloseFrom(minFd int) error {
29
  // We cannot use close_range(2) even if it is available, because we must
30
  // not close some file descriptors.
31
  return fdRangeFrom(minFd, func(fd int) {
32
    if runtime_IsPollDescriptor(uintptr(fd)) {
33
      // These are the Go runtimes internal netpoll file descriptors.
34
      // These file descriptors are operated on deep in the Go scheduler,
35
      // and closing those files from underneath Go can result in panics.
36
      // There is no issue with keeping them because they are not
37
      // executable and are not useful to an attacker anyway. Also we
38
      // don't have any choice.
39
      return
40
    }
41
    if logs.IsLogrusFd(uintptr(fd)) {
42
      // Do not close the logrus output fd. We cannot exec a pipe, and
43
      // the contents are quite limited (very little attacker control,
44
      // JSON-encoded) making shellcode attacks unlikely.
45
      return
46
    }
47
    // There's nothing we can do about errors from close(2), and the
48
    // only likely error to be seen is EBADF which indicates the fd was
49
    // already closed (in which case, we got what we wanted).
50
    _ = unix.Close(fd)
51
  })
52
}

1
  cgroupRootHandle *os.File
2
...
3

4
  if err != nil {
5
    err = &os.PathError{Op: "openat2", Path: path, Err: err}
6
    // Check if cgroupFd is still opened to cgroupfsDir
7
    // Check if cgroupRootHandle is still opened to cgroupfsDir
8
    // (happens when this package is incorrectly used
9
    // across the chroot/pivot_root/mntns boundary, or
10
    // when /sys/fs/cgroup is remounted).
11
    //
12
    // TODO: if such usage will ever be common, amend this
13
    // to reopen cgroupFd and retry openat2.
14
    fdPath, closer := utils.ProcThreadSelf("fd/" + strconv.Itoa(cgroupFd))
15
    // to reopen cgroupRootHandle and retry openat2.
16
    fdPath, closer := utils.ProcThreadSelf("fd/" + strconv.Itoa(int(cgroupRootHandle.Fd())))
17
    defer closer()
18
    fdDest, _ := os.Readlink(fdPath)
19
    if fdDest != cgroupfsDir {
20
      // Wrap the error so it is clear that cgroupFd
21
      // Wrap the error so it is clear that cgroupRootHandle
22
      // is opened to an unexpected/wrong directory.
23
      err = fmt.Errorf("cgroupFd %d unexpectedly opened to %s != %s: %w",
24
        cgroupFd, fdDest, cgroupfsDir, err)
25
      err = fmt.Errorf("cgroupRootHandle %d unexpectedly opened to %s != %s: %w",
26
        cgroupRootHandle.Fd(), fdDest, cgroupfsDir, err)
27
    }
28
    return nil, err
29
  }

1
  // Before starting "runc init", mark all non-stdio open files as O_CLOEXEC
2
  // to make sure we don't leak any files into "runc init". Any files to be
3
  // passed to "runc init" through ExtraFiles will get dup2'd by the Go
4
  // runtime and thus their O_CLOEXEC flag will be cleared. This is some
5
  // additional protection against attacks like CVE-2024-21626, by making
6
  // sure we never leak files to "runc init" we didn't intend to.
7
  if err := utils.CloseExecFrom(3); err != nil {
8
    return fmt.Errorf("unable to mark non-stdio fds as cloexec: %w", err)
9
  }