Subject: bug#34446: closed (Re: [bug#34446] Runc container escape patches CVE-2019-5736)

From: [email-masked] (GNU bug Tracking System)
Date: Tue, 12 Feb 2019 17:57:03 +0000

Your bug report

#34446: Runc container escape patches CVE-2019-5736

which was filed against the guix-patches package, has been closed.

The explanation is attached below, along with your original report.
If you require more details, please reply to [email-masked].

-- 
34446: http://debbugs.gnu.org/cgi/bugreport.cgi?bug=34446
GNU Bug Tracking System
Contact [email-masked] with problems

Subject: Re: [bug#34446] Runc container escape patches CVE-2019-5736
From: Leo Famulari <[email-masked]>
To: Danny Milosavljevic <[email-masked]>
Cc: [email-masked]
Date: Tue, 12 Feb 2019 12:56:31 -0500
List-Id: <debbugs-submit.debbugs.gnu.org>

On Tue, Feb 12, 2019 at 01:10:34AM +0100, Danny Milosavljevic wrote:
> as originally released by upstream, Docker looks up auxiliary commands in PATH,
> using a Go function called "LookPath".
> 
> Our package definition patches a lot of the specific LookPath calls to
> refer to inputs by absolute path.
> 
> I've booby-trapped the remaining LookPath calls so we won't accidentially
> have an internal tool looked up in $PATH.
> 
> If we have not forgotten any LookPath calls, there should have been no remaining
> LookPath calls and it would not have failed the build.

Thanks for explaining this :)

> > .gopath/src/github.com/docker/docker/vendor/github.com/docker/libnetwork/iptables/iptables.go:90:15: undefined: exec.Guix_doesnt_want_LookPath
> > .gopath/src/github.com/docker/docker/vendor/github.com/docker/libnetwork/iptables/iptables.go:90:45: invalid character U+005C '\'
> 
> Please examine line 90.  It probably has a LookPath line with a new argument we
> haven't seen before.

Okay, they added a lookup for 'iptables-legacy' which is what Debian has
renamed iptables. I changed this to just look up 'iptables' since its
equivalent on our end and in how the Docker code uses it and pushed as
ea7cddaac782b2cdc789a354e172356ed5c183e7.

Thanks again for your help!

Subject: Runc container escape patches CVE-2019-5736
From: Leo Famulari <[email-masked]>
To: [email-masked]
Date: Mon, 11 Feb 2019 18:37:08 -0500
List-Id: <debbugs-submit.debbugs.gnu.org>

These patches aim to fix CVE-2019-5736 in runc / Docker:

https://seclists.org/oss-sec/2019/q1/119

However, after applying these patches, Docker fails to build as shown
below. Runc, docker-cli, and containerd still build.

Please help :)

------
phase `setup-environment' succeeded after 0.0 seconds
starting phase `build'
# WARNING! I don't seem to be running in a Docker container.
# The result of this command might be an incorrect build, and will not be
# officially supported.
#
# Try this instead: make all
#

Removing bundles/

---> Making bundle: dynbinary (in bundles/dynbinary)
Building: bundles/dynbinary-daemon/dockerd-dev
# github.com/docker/docker/vendor/github.com/docker/libnetwork/iptables
.gopath/src/github.com/docker/docker/vendor/github.com/docker/libnetwork/iptables/iptables.go:90:15: undefined: exec.Guix_doesnt_want_LookPath
.gopath/src/github.com/docker/docker/vendor/github.com/docker/libnetwork/iptables/iptables.go:90:45: invalid character U+005C '\'
Backtrace:
           4 (primitive-load "/gnu/store/n5jmx2wksfvcrwlpv2zafd5hany…")
In ice-9/eval.scm:
   191:35  3 (_ _)
In srfi/srfi-1.scm:
   863:16  2 (every1 #<procedure ac28a0 at /gnu/store/rkv7z31csb2xa…> …)
In /gnu/store/rkv7z31csb2xandzhnvm5kc0i78pf0ay-module-import/guix/build/gnu-build-system.scm:
   799:28  1 (_ _)
In /gnu/store/rkv7z31csb2xandzhnvm5kc0i78pf0ay-module-import/guix/build/utils.scm:
    616:6  0 (invoke _ . _)

/gnu/store/rkv7z31csb2xandzhnvm5kc0i78pf0ay-module-import/guix/build/utils.scm:616:6: In procedure invoke:
Throw to key `srfi-34' with args `(#<condition &invoke-error [program: "hack/make.sh" arguments: ("dynbinary") exit-status: 2 term-signal: #f stop-signal: #f] 491cc0>)'.
builder for `/gnu/store/ihdm0nlw118mrb8wq127864g9pgrmghk-docker-18.09.2.drv' failed with exit code 1
build of /gnu/store/ihdm0nlw118mrb8wq127864g9pgrmghk-docker-18.09.2.drv failed
View build log at '/var/log/guix/drvs/ih/dm0nlw118mrb8wq127864g9pgrmghk-docker-18.09.2.drv.bz2'.
guix build: error: build of `/gnu/store/ihdm0nlw118mrb8wq127864g9pgrmghk-docker-18.09.2.drv' failed
------