proc: Fix /proc/cpuinfo not respecting personality #609
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
It was found that the personality within the container was not being properly respected, which for large numbers of CPUs would break reporting of /proc/cpuinfo in arm32 containers running on an arm64 host. Signed-off-by: Mathias Gibbens <gibmat@debian.org>
|
@mihalicyn can you take a look? |
sure! My bad that I've skipped that one. |
|
LGTM! Big thanks for noticing, debugging and fixing, Mathias! I'll do some refactoring in the following PR. |
mihalicyn
approved these changes
Sep 11, 2023
|
Would it be possible to merge this in the next few days? I'd like to have the fix included in the Debian 12.2 point release (scheduled for Oct 7). Working back from that date, I need to have the updated package basically ready by the 23rd so there's plenty of time for the update to be approved and included by the release team. |
stgraber
approved these changes
Sep 15, 2023
stgraber
pushed a commit
that referenced
this pull request
Jun 25, 2024
096972f and fc8f593 introduces task personalities retrieval to fix incorrect /proc files info in some cases. Linux governs access to personalities based on system ptrace policy, which may be restricted by an LSM (e.g. Yama). This patch implements a simple check for init's personality access to make sure ptrace usage is allowed, and prevent access from containers to proc files with "Permission denied" error if not. > closes #636 (follow-up to #553 and #609). Signed-off-by: Samuel FORESTIER <samuel+dev@forestier.app>
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
It was found that the personality within the container was not being properly respected, which for large numbers of CPUs would break reporting of
/proc/cpuinfoin arm32 containers running on an arm64 host.Tested on an arm64 QEMU VM; with this fix the 32bit container now properly reports
/proc/cpuinfo. Shamelessly copied most of the code from the existingproc_read_with_personality().Fixes: #608.