Documentation
¶
Overview ¶
Package procmount checks that /proc hides other accounts' processes.
While a plugin runs, its /proc/<pid> entries (cmdline, comm, the names and number of its threads, its memory counters) are written by the plugin and readable by every account unless /proc is mounted with hidepid=invisible (hidepid=2). The agent account could poll them: a covert channel seccomp cannot close, since the plugin writes them from inside its own process. A pid namespace would not help: the parent namespace still lists the plugin. So lockfile requires the mount option, except in a container that declares itself (ContainerFile) and passes Container.Check: there no other account shares the pid namespace, and the parent namespace is the Docker host's.
Index ¶
Constants ¶
const ContainerFile = "/etc/lockfile/container.toml"
ContainerFile declares, in an image, that the console runs in a container of its own. Docker cannot mount /proc with hidepid, so there lockfile accepts a /proc that lists every process of the console's pid namespace, provided that namespace holds no other account (Container).
const Fix = "remount /proc with hidepid=invisible as root: " +
"mount -o remount,hidepid=invisible,gid=<admin group> /proc " +
"and make it permanent in /etc/fstab: " +
"proc /proc proc defaults,hidepid=invisible,gid=<admin group> 0 0 " +
"(gid= names a group whose members still see every process, for monitoring tools)"
Fix is the remedy, for the human: the remount and the fstab line.
Variables ¶
var ErrContainer = errors.New("not a private container")
ErrContainer is returned when a container's /proc cannot stand in for hidepid=invisible; it wraps the failed condition.
var ErrNoProc = errors.New("no proc filesystem mounted at /proc")
ErrNoProc is returned when no proc mount is found at /proc.
var ErrNotHidden = errors.New("/proc is not mounted with hidepid=invisible")
ErrNotHidden is returned when /proc shows other accounts' processes.
Functions ¶
func Check ¶
Check reads a mount table with read and returns nil when /proc hides other accounts' processes, ErrNotHidden or ErrNoProc otherwise, or the read error.
func CheckSystem ¶
func CheckSystem() error
CheckSystem checks this process's /proc: hidepid=invisible, or, where ContainerFile is present, the container's conditions instead.
func CheckWith ¶
CheckWith is CheckSystem with the mount table and the container given. A declared container must pass c.Check, hidepid or not (its error wraps ErrContainer, and ErrNotHidden too when /proc is not hidden). Undeclared, the result is Check's.
func Hidden ¶
Hidden reports whether the proc filesystem mounted at /proc (the last one, if mounted over) has hidepid=invisible or its numeric spelling hidepid=2. table is /proc/self/mountinfo or /proc/mounts.
func ReadMountinfo ¶
ReadMountinfo reads this process's mount table.
Types ¶
type Container ¶
type Container struct {
File string // ContainerFile
Proc string // "/proc"
PID int // this process, as its own pid namespace numbers it
UID int // the console's account
// Owner returns a file's owner uid (fileOwner).
Owner func(fs.FileInfo) (uid int, ok bool)
}
Container is the stand-in for hidepid=invisible in a container. All conditions must hold: File is a root-owned declaration that others cannot write, in such a directory; the console is in a pid namespace other than the initial one, and Proc is that namespace's /proc; no process listed there runs under an account other than root and UID (the console's); the console runs under a seccomp filter.
func SystemContainer ¶
func SystemContainer() Container
SystemContainer is the Container of this process.
Source Files