Aleksa Sarai d463f6485b *: verify that operations on /proc/... are on procfs ... This is an additional mitigation for CVE-2019-16884. The primary problem is that Docker can be coerced into bind-mounting a file system on top of /proc (resulting in label-related writes to /proc no longer happening). While we are working on mitigations against permitting the mounts, this helps avoid our code from being tricked into writing to non-procfs files. This is not a perfect solution (after all, there might be a bind-mount of a different procfs file over the target) but in order to exploit that you would need to be able to tweak a config.json pretty specifically (which thankfully Docker doesn't allow). Specifically this stops AppArmor from not labeling a process silently due to /proc/self/attr/... being incorrectly set, and stops any accidental fd leaks because /proc/self/fd/... is not real. Signed-off-by: Aleksa Sarai <asarai@suse.de>		2019-09-30 09:06:48 +10:00
..
apparmor.go	*: verify that operations on /proc/... are on procfs	2019-09-30 09:06:48 +10:00
apparmor_disabled.go	Adding error conditions when apparmor disabled	2015-11-22 13:14:18 +05:30