6e3f7fbc07
The vulnerability allows a malicious container to (with minimal user
interaction) overwrite the host runc binary and thus gain root-level
code execution on the host. The level of user interaction is being able
to run any command (it doesn't matter if the command is not
attacker-controlled) as root within a container in either of these
contexts:
* Creating a new container using an attacker-controlled image.
* Attaching (docker exec) into an existing container which the
attacker had previous write access to.
For more details, see the advisory:
https://www.openwall.com/lists/oss-security/2019/02/11/2
The fix for this issue uses fexecve(3), which isn't available on uClibc, so
add a dependency on !uclibc to runc and propagate to the reverse
dependencies (containerd/docker-engine).
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
36 lines
1.2 KiB
Plaintext
36 lines
1.2 KiB
Plaintext
config BR2_PACKAGE_DOCKER_CONTAINERD
|
|
bool "docker-containerd"
|
|
depends on BR2_PACKAGE_HOST_GO_ARCH_SUPPORTS
|
|
depends on BR2_PACKAGE_HOST_GO_CGO_LINKING_SUPPORTS
|
|
depends on BR2_TOOLCHAIN_HAS_THREADS
|
|
depends on !BR2_PACKAGE_TOOLCHAIN_USES_UCLIBC # runc
|
|
depends on BR2_USE_MMU # util-linux
|
|
select BR2_PACKAGE_RUNC # runtime dependency
|
|
select BR2_PACKAGE_UTIL_LINUX # runtime dependency
|
|
select BR2_PACKAGE_UTIL_LINUX_BINARIES
|
|
select BR2_PACKAGE_UTIL_LINUX_PIVOT_ROOT
|
|
select BR2_PACKAGE_UTIL_LINUX_MOUNTPOINT
|
|
select BR2_PACKAGE_UTIL_LINUX_MOUNT
|
|
help
|
|
containerd is a daemon to control runC.
|
|
|
|
https://github.com/docker/containerd
|
|
|
|
if BR2_PACKAGE_DOCKER_CONTAINERD
|
|
|
|
config BR2_PACKAGE_DOCKER_CONTAINERD_DRIVER_BTRFS
|
|
bool "btrfs snapshot driver"
|
|
depends on BR2_USE_MMU # btrfs-progs
|
|
depends on BR2_TOOLCHAIN_HAS_THREADS # btrfs-progs
|
|
select BR2_PACKAGE_BTRFS_PROGS
|
|
help
|
|
Build the btrfs snapshot driver for containerd.
|
|
|
|
endif
|
|
|
|
comment "docker-containerd needs a glibc or musl toolchain w/ threads"
|
|
depends on BR2_PACKAGE_HOST_GO_ARCH_SUPPORTS
|
|
depends on BR2_PACKAGE_HOST_GO_CGO_LINKING_SUPPORTS
|
|
depends on BR2_USE_MMU
|
|
depends on !BR2_TOOLCHAIN_HAS_THREADS || BR2_TOOLCHAIN_USES_UCLIBC
|