CVE-2019-16884: runc AppArmor confinement weakened by incorrect mount-target validation for /proc
Scope: audit · README · COMPARISON · docs/RESEARCH
CVSS 6.5-7.5. Fixed in runc 1.0.0-rc9.
Source
Relevance to doos
runc's root filesystem setup validated a mount target incorrectly, letting a crafted
image mount something over /proc in a way that weakened the AppArmor profile runc
otherwise applies. doos has no AppArmor profile that constrains the container's own
filesystem view the way docker-default does (COMPARISON.md section 6 already states
this as a design difference, not a bug), so the specific confinement this CVE weakens
does not exist in doos to begin with. What is still worth checking directly is the thing
runc's bug actually let an attacker do: substitute a non-proc mount at the container's
/proc.
What the check does
Attaches a container and checks, from inside, that /proc's filesystem type (via
/proc/self/mountinfo on the real /proc doos mounted, read before the check's own
command could remount it) is proc, matching doMount("proc", ..., "proc", ...) in
src/sandbox.cpp.
Caveats
Confirms doos's own /proc mount is what it claims to be at container start; it does
not attempt the image-controlled mount-target substitution runc's bug needed, since doos
has no AppArmor profile for that substitution to bypass in the first place.
Run: make test in this directory, or make -C audit test from the repo root.