diff options
| author | Simon McVittie <smcv@collabora.com> | 2021-09-01 12:45:54 +0100 |
|---|---|---|
| committer | Alexander Larsson <alexander.larsson@gmail.com> | 2021-10-08 12:53:20 +0200 |
| commit | 9766ee05b1425db397d2cf23afd24c7f6146a69f (patch) | |
| tree | c08a9b5d9f39a54a05aeedc867099fcf6780f8c7 | |
| parent | a10f52a7565c549612c92b8e736a6698a53db330 (diff) | |
| download | flatpak-9766ee05b1425db397d2cf23afd24c7f6146a69f.tar.gz | |
run: Disallow recently-added mount-manipulation syscalls
If we don't allow mount() then we shouldn't allow these either.
Partially fixes GHSA-67h7-w3jq-vh4q.
Thanks: an anonymous reporter
Signed-off-by: Simon McVittie <smcv@collabora.com>
| -rw-r--r-- | common/flatpak-run.c | 12 |
1 files changed, 12 insertions, 0 deletions
diff --git a/common/flatpak-run.c b/common/flatpak-run.c index aca50394..7cbabde0 100644 --- a/common/flatpak-run.c +++ b/common/flatpak-run.c @@ -2951,6 +2951,18 @@ setup_seccomp (FlatpakBwrap *bwrap, * Return ENOSYS so user-space will fall back to clone(). * (GHSA-67h7-w3jq-vh4q; see also https://github.com/moby/moby/commit/9f6b562d) */ {SCMP_SYS (clone3), ENOSYS}, + + /* New mount manipulation APIs can also change our VFS. There's no + * legitimate reason to do these in the sandbox, so block all of them + * rather than thinking about which ones might be dangerous. + * (GHSA-67h7-w3jq-vh4q) */ + {SCMP_SYS (open_tree), ENOSYS}, + {SCMP_SYS (move_mount), ENOSYS}, + {SCMP_SYS (fsopen), ENOSYS}, + {SCMP_SYS (fsconfig), ENOSYS}, + {SCMP_SYS (fsmount), ENOSYS}, + {SCMP_SYS (fspick), ENOSYS}, + {SCMP_SYS (mount_setattr), ENOSYS}, }; struct |