audit
Scope: README · AGENTS · COMPARISON · docs/RESEARCH
A fixed, named set of 8 known CVEs relevant to the mechanisms doos uses (user namespaces,
overlayfs, tar extraction, abstract sockets, mount handling), each in its own directory with
the public source, why it matters to doos specifically, and a non-destructive regression check
against build/doos. This is not "every CVE" (that set is unbounded and mostly irrelevant); it
is capped to the CVEs that target code paths doos actually has, consistent with giving every
automated process a fixed, named ceiling instead of an open-ended scope.
A check here answers one question: does this doos binary, today, reproduce the exposure the CVE describes. It is not a claim that doos is unaffected by anything not listed, and it does not replace the gaps already tracked in docs/RESEARCH and COMPARISON section 6.
Running it
cmake -S . -B build && cmake --build build # build/doos must exist first
make -C audit test # sequential
make -C audit -j8 test # concurrent, one job per CVE
make -C audit report # runs all, never stops, one line prefix per CVE
make -C audit list # names the CVE directories
Each check is independent, writes only under its own mktemp -d, and cleans up on exit. Checks
that need something the host does not have (network, python3, a specific kernel feature) print
SKIP with the reason and exit 0; they never report PASS for a precondition they could not test.
Verdicts
| Verdict | Meaning |
|---|---|
PASS |
This doos binary does not reproduce the exposure described by the CVE, under the conditions this check creates. |
FAIL |
It does. Treat as a regression; the check prints what it observed. |
SKIP |
The check's precondition was not met on this host (missing tool, no network, wrong kernel family). Not a verdict on doos. |
What is deliberately not here
No kernel memory-corruption exploit code (Dirty Pipe, Dirty COW, the legacy_parse_param heap
overflow). Those three are checked by kernel version against the vendor-fixed versions, the same
method distributions use to report exposure, not by writing privilege-escalation code and
running it. Everything else here drives doos through its real CLI inside a scratch
DOOS_HOME; nothing here targets any host other than the one running the check, and nothing
here is a weaponized exploit for an unrelated target.
The list
| CVE | Component the bug lives in | What doos has in common |
|---|---|---|
| CVE-2019-5736 | runc (Go) /proc/self/exe handling |
overlayed host /usr must stay read-only from inside |
| CVE-2024-21626 | runc (Go) fchdir / fd close ordering |
no leaked host fd reachable from the exec'd process |
| CVE-2020-15257 | containerd-shim (Go) UID-only access check | --net host shares the host's abstract socket namespace by design |
| CVE-2022-0185 | Linux kernel fs/fs_context.c |
depends on unprivileged user namespaces; doos's seccomp denylist blocks the mount family |
| CVE-2022-0847 | Linux kernel pipe buffer handling | doos runs on the host kernel; a kernel bug is a doos-host bug |
| CVE-2016-5195 | Linux kernel mm/gup.c |
doos runs on the host kernel; a kernel bug is a doos-host bug |
| CVE-2026-17106 | moby/go-archive (Go), and tar extractors generally | doos image add extracts caller-supplied tarballs the same way |
| CVE-2021-30465 | runc (Go) mount target resolution | fsutil::mkdirs follows symlinks the same way create_directories does by default |
Back to README, SPEC, AGENTS, COMPARISON.