doos/audit/README.md

audit

Scope: README · AGENTS · COMPARISON · docs/RESEARCH

A fixed, named set of 18 known CVEs relevant to the mechanisms doos uses (user namespaces, overlayfs, tar extraction, abstract sockets, mount handling), each in its own directory with the public source, why it matters to doos specifically, and a non-destructive regression check against build/doos. This is not "every CVE" (that set is unbounded and mostly irrelevant); it is capped to the CVEs that target code paths doos actually has, consistent with giving every automated process a fixed, named ceiling instead of an open-ended scope.

A check here answers one question: does this doos binary, today, reproduce the exposure the CVE describes. It is not a claim that doos is unaffected by anything not listed, and it does not replace the gaps already tracked in docs/RESEARCH and COMPARISON section 6.

Running it

cmake -S . -B build && cmake --build build   # build/doos must exist first
make -C audit test                           # sequential
make -C audit -j8 test                       # concurrent, one job per CVE
make -C audit report                         # runs all, never stops, one line prefix per CVE
make -C audit list                           # names the CVE directories

Each check is independent, writes only under its own mktemp -d, and cleans up on exit. Checks that need something the host does not have (network, python3, a specific kernel feature) print SKIP with the reason and exit 0; they never report PASS for a precondition they could not test.

Verdicts

Verdict	Meaning
PASS	This doos binary does not reproduce the exposure described by the CVE, under the conditions this check creates.
FAIL	It does. Treat as a regression; the check prints what it observed.
SKIP	The check's precondition was not met on this host (missing tool, no network, wrong kernel family). Not a verdict on doos.

What is deliberately not here

No kernel memory-corruption exploit code (Dirty Pipe, Dirty COW, the legacy_parse_param heap overflow). Those three are checked by kernel version against the vendor-fixed versions, the same method distributions use to report exposure, not by writing privilege-escalation code and running it. Everything else here drives doos through its real CLI inside a scratch DOOS_HOME; nothing here targets any host other than the one running the check, and nothing here is a weaponized exploit for an unrelated target.

The list

CVE	Component the bug lives in	What doos has in common
CVE-2019-5736	runc (Go) /proc/self/exe handling	overlayed host /usr must stay read-only from inside
CVE-2024-21626	runc (Go) fchdir / fd close ordering	no leaked host fd reachable from the exec'd process
CVE-2020-15257	containerd-shim (Go) UID-only access check	--net host shares the host's abstract socket namespace by design
CVE-2022-0185	Linux kernel fs/fs_context.c	depends on unprivileged user namespaces; doos's seccomp denylist blocks the mount family
CVE-2022-0847	Linux kernel pipe buffer handling	doos runs on the host kernel; a kernel bug is a doos-host bug
CVE-2016-5195	Linux kernel mm/gup.c	doos runs on the host kernel; a kernel bug is a doos-host bug
CVE-2026-17106	moby/go-archive (Go), and tar extractors generally	doos image add extracts caller-supplied tarballs the same way
CVE-2021-30465	runc (Go) mount target resolution	fsutil::mkdirs follows symlinks the same way create_directories does by default
CVE-2021-3493	Linux kernel overlayfs (fs/overlayfs)	doos mounts overlayfs inside an unprivileged user namespace on every attach
CVE-2023-2640	Linux kernel overlayfs (Ubuntu patch set)	same mount doos issues on every attach
CVE-2023-32629	Linux kernel overlayfs (Ubuntu patch set)	same mount doos issues on every attach
CVE-2015-1328	Linux kernel overlayfs	same precondition doos depends on (overlayfs + unprivileged user namespace)
CVE-2022-0492	Linux kernel kernel/cgroup/cgroup-v1.c	doos uses cgroup v2 only and mounts no /sys/cgroupfs into the container
CVE-2022-27650	crun / Moby (Go/C) capability handling at container start	doos sets its own capability bounding set in Hardening::apply()
CVE-2019-16884	runc (Go) mount-target validation	doos's own /proc must be a real proc mount, independent of any AppArmor profile
CVE-2023-28642	runc (Go) /proc mount-target validation	doos's own /proc must be a real directory mount, not substitutable by an image
CVE-2018-12020	GnuPG status-fd / verbose filename echoing	doos trusts gpg's verdict to decide whether to extract a downloaded image
CVE-2020-7039	libslirp (C) packet parsing	slirp4netns, doos's default --net mode, links this library

Back to README, SPEC, AGENTS, COMPARISON.