42 lines
1.4 KiB
Diff
42 lines
1.4 KiB
Diff
From e3b8749e93d2412385498c9ed6cf6550b2992aaf Mon Sep 17 00:00:00 2001
|
|
From: bwzhang <zhangbowei@kylinos.cn>
|
|
Date: Mon, 18 Mar 2024 15:06:38 +0800
|
|
Subject: [PATCH] fix PLATYPUS attack of RAPL accessible to a container
|
|
Security Advisories:
|
|
https://github.com/containerd/containerd/security/advisories/GHSA-7ww5-4wqc-m92c
|
|
upstream:
|
|
https://github.com/containerd/containerd/commit/9e4d53df751605b2c3fa12ed062f8d7a76c0b3f3
|
|
|
|
---
|
|
contrib/apparmor/template.go | 1 +
|
|
oci/spec.go | 1 +
|
|
2 files changed, 2 insertions(+)
|
|
|
|
diff --git a/contrib/apparmor/template.go b/contrib/apparmor/template.go
|
|
index ba613c3..5c4f785 100644
|
|
--- a/contrib/apparmor/template.go
|
|
+++ b/contrib/apparmor/template.go
|
|
@@ -81,6 +81,7 @@ profile {{.Name}} flags=(attach_disconnected,mediate_deleted) {
|
|
deny /sys/fs/c[^g]*/** wklx,
|
|
deny /sys/fs/cg[^r]*/** wklx,
|
|
deny /sys/firmware/** rwklx,
|
|
+ deny /sys/devices/virtual/powercap/** rwklx,
|
|
deny /sys/kernel/security/** rwklx,
|
|
|
|
{{if ge .Version 208095}}
|
|
diff --git a/oci/spec.go b/oci/spec.go
|
|
index a1c98dd..62d212a 100644
|
|
--- a/oci/spec.go
|
|
+++ b/oci/spec.go
|
|
@@ -171,6 +171,7 @@ func populateDefaultUnixSpec(ctx context.Context, s *Spec, id string) error {
|
|
"/proc/timer_stats",
|
|
"/proc/sched_debug",
|
|
"/sys/firmware",
|
|
+ "/sys/devices/virtual/powercap",
|
|
"/proc/scsi",
|
|
},
|
|
ReadonlyPaths: []string{
|
|
--
|
|
2.20.1
|
|
|