rootless: harden slirp4netns with mount namespace and seccomp
When slirp4netns v0.4.0+ is used, now slirp4netns is hardened using mount namespace ("sandbox") and seccomp to mitigate potential vulnerabilities. bump up rootlesskit:2fcff6ceae...791ac8cb20
Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp> (cherry picked from commite20b7323fb
) Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
This commit is contained in:
parent
2ae5cbcf05
commit
5bd4233d7b
|
@ -39,6 +39,9 @@ fi
|
||||||
|
|
||||||
: "${DOCKERD_ROOTLESS_ROOTLESSKIT_NET:=}"
|
: "${DOCKERD_ROOTLESS_ROOTLESSKIT_NET:=}"
|
||||||
: "${DOCKERD_ROOTLESS_ROOTLESSKIT_MTU:=}"
|
: "${DOCKERD_ROOTLESS_ROOTLESSKIT_MTU:=}"
|
||||||
|
# if slirp4netns v0.4.0+ is installed, slirp4netns is hardened using sandbox (mount namespace) and seccomp
|
||||||
|
: "${DOCKERD_ROOTLESS_ROOTLESSKIT_SLIRP4NETNS_SANDBOX:=auto}"
|
||||||
|
: "${DOCKERD_ROOTLESS_ROOTLESSKIT_SLIRP4NETNS_SECCOMP:=auto}"
|
||||||
net=$DOCKERD_ROOTLESS_ROOTLESSKIT_NET
|
net=$DOCKERD_ROOTLESS_ROOTLESSKIT_NET
|
||||||
mtu=$DOCKERD_ROOTLESS_ROOTLESSKIT_MTU
|
mtu=$DOCKERD_ROOTLESS_ROOTLESSKIT_MTU
|
||||||
if [ -z $net ]; then
|
if [ -z $net ]; then
|
||||||
|
@ -77,6 +80,8 @@ if [ -z $_DOCKERD_ROOTLESS_CHILD ]; then
|
||||||
# * /run: copy-up is required so that we can create /run/docker (hardcoded for plugins) in our namespace
|
# * /run: copy-up is required so that we can create /run/docker (hardcoded for plugins) in our namespace
|
||||||
exec $rootlesskit \
|
exec $rootlesskit \
|
||||||
--net=$net --mtu=$mtu \
|
--net=$net --mtu=$mtu \
|
||||||
|
--slirp4netns-sandbox=$DOCKERD_ROOTLESS_ROOTLESSKIT_SLIRP4NETNS_SANDBOX \
|
||||||
|
--slirp4netns-seccomp=$DOCKERD_ROOTLESS_ROOTLESSKIT_SLIRP4NETNS_SECCOMP \
|
||||||
--disable-host-loopback --port-driver=builtin \
|
--disable-host-loopback --port-driver=builtin \
|
||||||
--copy-up=/etc --copy-up=/run \
|
--copy-up=/etc --copy-up=/run \
|
||||||
$DOCKERD_ROOTLESS_ROOTLESSKIT_FLAGS \
|
$DOCKERD_ROOTLESS_ROOTLESSKIT_FLAGS \
|
||||||
|
|
|
@ -1,7 +1,7 @@
|
||||||
#!/bin/sh
|
#!/bin/sh
|
||||||
|
|
||||||
# v0.6.0
|
# v0.7.0
|
||||||
ROOTLESSKIT_COMMIT=2fcff6ceae968a1d895e6205e5154b107247356f
|
ROOTLESSKIT_COMMIT=791ac8cb209a107505cd1ca5ddf23a49913e176c
|
||||||
|
|
||||||
install_rootlesskit() {
|
install_rootlesskit() {
|
||||||
case "$1" in
|
case "$1" in
|
||||||
|
|
Loading…
Reference in New Issue