public inbox for pve-devel@lists.proxmox.com
 help / color / mirror / Atom feed
From: Wolfgang Bumiller <w.bumiller@proxmox.com>
To: Filip Schauer <f.schauer@proxmox.com>
Cc: pve-devel@lists.proxmox.com
Subject: Re: [pve-devel] [PATCH lxcfs v3 10/13] lxc.mount.hook: override env variables from container config
Date: Thu, 10 Jul 2025 11:30:10 +0200	[thread overview]
Message-ID: <amqzk4kzzde3hg4gbdyrhvlqiw6b2xewhurnzdmglgewd2tqum@gckwyuek6z3v> (raw)
In-Reply-To: <20250709123435.64796-11-f.schauer@proxmox.com>

NAK

This needs to be handled differently.

Before this series `lxc.environment` could not be set at all except by
manually modifying the config as *root*.

If we want to support the `Env` key in OCI images, we need to either
replace the `init` command with a wrapper setting that environment
before running the final command, or lxc itself needs to learn a new
configuration for this (eg. an `lxc.environment.runtime`).

On Wed, Jul 09, 2025 at 02:34:27PM +0200, Filip Schauer wrote:
> This can still break `/bin/sh` if an OCI image injects a different
> `libc.so.6` with $LD_LIBRARY_PATH.
> 
> Signed-off-by: Filip Schauer <f.schauer@proxmox.com>
> ---
> Arbitrary code execution is theoretically still possible with a
> specially crafted OCI image that provides a shared library and points
> $LD_LIBRARY_PATH to its parent directory. Although the code is confined
> to the container's namespace, it can still see the host file system.
> While this may not pose a significant security risk, it is nonetheless
> suboptimal. I am unsure about the best way to fully mitigate this.
> 
> Introduced in v3
> 
>  .../patches/reset-path-to-host-defaults.patch | 38 +++++++++++++++++++
>  debian/patches/series                         |  1 +
>  2 files changed, 39 insertions(+)
>  create mode 100644 debian/patches/reset-path-to-host-defaults.patch
> 
> diff --git a/debian/patches/reset-path-to-host-defaults.patch b/debian/patches/reset-path-to-host-defaults.patch
> new file mode 100644
> index 0000000..12f150d
> --- /dev/null
> +++ b/debian/patches/reset-path-to-host-defaults.patch
> @@ -0,0 +1,38 @@
> +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
> +From: Filip Schauer <f.schauer@proxmox.com>
> +Date: Mon, 23 Jun 2025 13:05:35 +0200
> +Subject: [PATCH] lxc.mount.hook: override env variables from container
> + config
> +
> +Without this, if the container config specifies a custom PATH variable
> +via lxc.environment that omits /usr/bin or /bin, binaries like
> +`readlink` and `mount` may not be found, causing container startup to
> +fail.
> +
> +Fixes startup breakage with images like `ghcr.io/nixos/nix:latest`.
> +
> +This also mitigates arbitrary code execution during container startup
> +before pivot_root (albeit confined in its own namespace) with a
> +specially crafted OCI image providing a custom `readlink` or `mount`
> +binary and pointing the PATH variable to it.
> +
> +Signed-off-by: Filip Schauer <f.schauer@proxmox.com>
> +---
> + share/lxc.mount.hook.in | 4 ++++
> + 1 file changed, 4 insertions(+)
> +
> +diff --git a/share/lxc.mount.hook.in b/share/lxc.mount.hook.in
> +index 6fd13b0..a25a5ef 100755
> +--- a/share/lxc.mount.hook.in
> ++++ b/share/lxc.mount.hook.in
> +@@ -11,6 +11,10 @@ do
> + 	shift
> + done
> + 
> ++# Set the PATH variable in case it was modified by lxc.environment
> ++PATH=/usr/bin:/bin
> ++LD_LIBRARY_PATH=
> ++
> + # We're dealing with mount entries, so expand any symlink
> + LXC_ROOTFS_MOUNT=$(readlink -f "${LXC_ROOTFS_MOUNT}")
> + 
> diff --git a/debian/patches/series b/debian/patches/series
> index bf650b4..f3391c0 100644
> --- a/debian/patches/series
> +++ b/debian/patches/series
> @@ -1 +1,2 @@
>  do-not-start-without-lxcfs.patch
> +reset-path-to-host-defaults.patch
> -- 
> 2.47.2


_______________________________________________
pve-devel mailing list
pve-devel@lists.proxmox.com
https://lists.proxmox.com/cgi-bin/mailman/listinfo/pve-devel


  reply	other threads:[~2025-07-10  9:29 UTC|newest]

Thread overview: 21+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2025-07-09 12:34 [pve-devel] [PATCH container/docs/lxcfs/manager/proxmox{, -perl-rs}/storage v3 00/13] support OCI images as container templates Filip Schauer
2025-07-09 12:34 ` [pve-devel] [PATCH proxmox v3 01/13] io: introduce RangeReader for bounded reads Filip Schauer
2025-07-10  6:04   ` Thomas Lamprecht
2025-07-09 12:34 ` [pve-devel] [PATCH proxmox v3 02/13] add proxmox-oci crate Filip Schauer
2025-07-10  8:46   ` Wolfgang Bumiller
2025-07-09 12:34 ` [pve-devel] [PATCH proxmox-perl-rs v3 03/13] add Perl mapping for OCI container image parser/extractor Filip Schauer
2025-07-10 10:39   ` Wolfgang Bumiller
2025-07-09 12:34 ` [pve-devel] [PATCH container v3 04/13] add support for OCI images as container templates Filip Schauer
2025-07-10 10:31   ` Wolfgang Bumiller
2025-07-09 12:34 ` [pve-devel] [PATCH container v3 05/13] config: add entrypoint parameter Filip Schauer
2025-07-09 12:34 ` [pve-devel] [PATCH container v3 06/13] configure static IP in LXC config for custom entrypoint Filip Schauer
2025-07-09 12:34 ` [pve-devel] [PATCH container v3 07/13] setup: debian: create /etc/network path if missing Filip Schauer
2025-07-09 12:34 ` [pve-devel] [PATCH container v3 08/13] setup: recursively mkdir /etc/systemd/{network, system-preset} Filip Schauer
2025-07-09 12:34 ` [pve-devel] [PATCH container v3 09/13] manage DHCP for containers with custom entrypoint Filip Schauer
2025-07-09 13:41   ` Filip Schauer
2025-07-10 10:34   ` Wolfgang Bumiller
2025-07-09 12:34 ` [pve-devel] [PATCH lxcfs v3 10/13] lxc.mount.hook: override env variables from container config Filip Schauer
2025-07-10  9:30   ` Wolfgang Bumiller [this message]
2025-07-09 12:34 ` [pve-devel] [PATCH storage v3 11/13] allow .tar container templates Filip Schauer
2025-07-09 12:34 ` [pve-devel] [PATCH manager v3 12/13] ui: storage upload: accept *.tar files as vztmpl Filip Schauer
2025-07-09 12:34 ` [pve-devel] [PATCH docs v3 13/13] ct: add OCI image docs Filip Schauer

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=amqzk4kzzde3hg4gbdyrhvlqiw6b2xewhurnzdmglgewd2tqum@gckwyuek6z3v \
    --to=w.bumiller@proxmox.com \
    --cc=f.schauer@proxmox.com \
    --cc=pve-devel@lists.proxmox.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
Service provided by Proxmox Server Solutions GmbH | Privacy | Legal