Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

cntr exec fails with umask set to 077 #247

Open
JustWhateverIOnlyWantBetterCodeView opened this issue Oct 17, 2023 · 0 comments
Open

cntr exec fails with umask set to 077 #247

JustWhateverIOnlyWantBetterCodeView opened this issue Oct 17, 2023 · 0 comments

Comments

@JustWhateverIOnlyWantBetterCodeView
Copy link

JustWhateverIOnlyWantBetterCodeView commented Oct 17, 2023

To reproduce run umask 077 in your shell and then attach to any container running non-root user inside. After that try to run cntr exec. It fails, because /.cntr/pid file was created with permissions 600 and is not readable.

I've tested with zsh and bash.

Also with umask set to 000 the pid file is created with permissions 666 which means it's writable by anyone, which could potentially be a security issue?

To fix this the correct permissions should be set when this file is created:

cntr/src/dotcntr.rs

Lines 26 to 37 in 43f88bf

pub fn write_pid_file(&self, target_pid: Pid) -> Result<()> {
let path = self.dir.path().join("pid");
let mut file = try_with!(File::create(&path), "failed to create {}", path.display());
let raw_pid: pid_t = target_pid.into();
try_with!(
file.write_all(format!("{}", raw_pid).as_bytes()),
"failed to write {}",
path.display()
);
Ok(())
}

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant