72 lines
5.3 KiB
Markdown
72 lines
5.3 KiB
Markdown
# audit
|
|
|
|
**Scope:** [README](../README.md) · [AGENTS](../AGENTS.md) · [COMPARISON](../COMPARISON.md) · [docs/RESEARCH](../docs/RESEARCH.md)
|
|
|
|
A fixed, named set of 18 known CVEs relevant to the mechanisms doos uses (user namespaces,
|
|
overlayfs, tar extraction, abstract sockets, mount handling), each in its own directory with
|
|
the public source, why it matters to doos specifically, and a non-destructive regression check
|
|
against `build/doos`. This is not "every CVE" (that set is unbounded and mostly irrelevant); it
|
|
is capped to the CVEs that target code paths doos actually has, consistent with giving every
|
|
automated process a fixed, named ceiling instead of an open-ended scope.
|
|
|
|
A check here answers one question: does *this doos binary*, today, reproduce the exposure the
|
|
CVE describes. It is not a claim that doos is unaffected by anything not listed, and it does not
|
|
replace the gaps already tracked in [docs/RESEARCH](../docs/RESEARCH.md) and
|
|
[COMPARISON](../COMPARISON.md) section 6.
|
|
|
|
## Running it
|
|
|
|
```
|
|
cmake -S . -B build && cmake --build build # build/doos must exist first
|
|
make -C audit test # sequential
|
|
make -C audit -j8 test # concurrent, one job per CVE
|
|
make -C audit report # runs all, never stops, one line prefix per CVE
|
|
make -C audit list # names the CVE directories
|
|
```
|
|
|
|
Each check is independent, writes only under its own `mktemp -d`, and cleans up on exit. Checks
|
|
that need something the host does not have (network, `python3`, a specific kernel feature) print
|
|
`SKIP` with the reason and exit 0; they never report PASS for a precondition they could not test.
|
|
|
|
## Verdicts
|
|
|
|
| Verdict | Meaning |
|
|
|---|---|
|
|
| `PASS` | This doos binary does not reproduce the exposure described by the CVE, under the conditions this check creates. |
|
|
| `FAIL` | It does. Treat as a regression; the check prints what it observed. |
|
|
| `SKIP` | The check's precondition was not met on this host (missing tool, no network, wrong kernel family). Not a verdict on doos. |
|
|
|
|
## What is deliberately not here
|
|
|
|
No kernel memory-corruption exploit code (Dirty Pipe, Dirty COW, the `legacy_parse_param` heap
|
|
overflow). Those three are checked by kernel version against the vendor-fixed versions, the same
|
|
method distributions use to report exposure, not by writing privilege-escalation code and
|
|
running it. Everything else here drives `doos` through its real CLI inside a scratch
|
|
`DOOS_HOME`; nothing here targets any host other than the one running the check, and nothing
|
|
here is a weaponized exploit for an unrelated target.
|
|
|
|
## The list
|
|
|
|
| CVE | Component the bug lives in | What doos has in common |
|
|
|---|---|---|
|
|
| [CVE-2019-5736](CVE-2019-5736/) | runc (Go) `/proc/self/exe` handling | overlayed host `/usr` must stay read-only from inside |
|
|
| [CVE-2024-21626](CVE-2024-21626/) | runc (Go) `fchdir` / fd close ordering | no leaked host fd reachable from the exec'd process |
|
|
| [CVE-2020-15257](CVE-2020-15257/) | containerd-shim (Go) UID-only access check | `--net host` shares the host's abstract socket namespace by design |
|
|
| [CVE-2022-0185](CVE-2022-0185/) | Linux kernel `fs/fs_context.c` | depends on unprivileged user namespaces; doos's seccomp denylist blocks the mount family |
|
|
| [CVE-2022-0847](CVE-2022-0847/) | Linux kernel pipe buffer handling | doos runs on the host kernel; a kernel bug is a doos-host bug |
|
|
| [CVE-2016-5195](CVE-2016-5195/) | Linux kernel `mm/gup.c` | doos runs on the host kernel; a kernel bug is a doos-host bug |
|
|
| [CVE-2026-17106](CVE-2026-17106/) | moby/go-archive (Go), and tar extractors generally | `doos image add` extracts caller-supplied tarballs the same way |
|
|
| [CVE-2021-30465](CVE-2021-30465/) | runc (Go) mount target resolution | `fsutil::mkdirs` follows symlinks the same way `create_directories` does by default |
|
|
| [CVE-2021-3493](CVE-2021-3493/) | Linux kernel overlayfs (`fs/overlayfs`) | doos mounts overlayfs inside an unprivileged user namespace on every attach |
|
|
| [CVE-2023-2640](CVE-2023-2640/) | Linux kernel overlayfs (Ubuntu patch set) | same mount doos issues on every attach |
|
|
| [CVE-2023-32629](CVE-2023-32629/) | Linux kernel overlayfs (Ubuntu patch set) | same mount doos issues on every attach |
|
|
| [CVE-2015-1328](CVE-2015-1328/) | Linux kernel overlayfs | same precondition doos depends on (overlayfs + unprivileged user namespace) |
|
|
| [CVE-2022-0492](CVE-2022-0492/) | Linux kernel `kernel/cgroup/cgroup-v1.c` | doos uses cgroup v2 only and mounts no /sys/cgroupfs into the container |
|
|
| [CVE-2022-27650](CVE-2022-27650/) | crun / Moby (Go/C) capability handling at container start | doos sets its own capability bounding set in `Hardening::apply()` |
|
|
| [CVE-2019-16884](CVE-2019-16884/) | runc (Go) mount-target validation | doos's own `/proc` must be a real proc mount, independent of any AppArmor profile |
|
|
| [CVE-2023-28642](CVE-2023-28642/) | runc (Go) /proc mount-target validation | doos's own /proc must be a real directory mount, not substitutable by an image |
|
|
| [CVE-2018-12020](CVE-2018-12020/) | GnuPG status-fd / verbose filename echoing | doos trusts gpg's verdict to decide whether to extract a downloaded image |
|
|
| [CVE-2020-7039](CVE-2020-7039/) | libslirp (C) packet parsing | slirp4netns, doos's default --net mode, links this library |
|
|
|
|
Back to [README](../README.md), [SPEC](../SPEC.md), [AGENTS](../AGENTS.md), [COMPARISON](../COMPARISON.md).
|