Speaker
Description
For quite a while there has been a wish from container runtime to be able to restrict how we can reuse a particular file descriptor. For instance, CVE-2019-5736 showcased a privilege escalation in runc, whereby the possibility of reopening /proc/self/exe as writeable allowed a malicious image to overwrite the runc binary. That was patched on the user space side by copying runc to a sealed memfd_create() file before executing the target. However, it would be better if we could just set restrictions on how some file descriptor can be used (via procfs or O_EMPTYPATH) to reopen a file as writeable in the first place. Thus we would like to have some kind of upgrade mask for file descriptors.
Effort has been spent in the past to implement something like this. For instance, by David Drysdale in 2013 and later by Aleksa Sarai as part of openat2(2) in 2019. I want to take some time to summarize some of these past ideas and see why they were unsuccessful, and what makes this in particular a hairy problem. We can finish with some discussion about what a merge-able patchset would look like.