[lxc-devel] bugs with LXC container : mount and rmmod command

Elias Olivares eolivares at 1g6.biz
Thu Mar 4 16:05:43 UTC 2010


Hi ! 

I've tried to reproduce this bug on 0.6.5 lxc release and the same bug appears when i run the umount command or rmmod command. 

To reproduce the bug : 

Host name : debian 
Guest container name : container 

You MUST create a dedicated partition to share your containers (an other partition than " / ") 

debian:# df 

/dev/hda1 7850996 2058732 5393452 28% / 
tmpfs 253768 0 253768 0% /lib/init/rw 
udev 10240 108 10132 2% /dev 
tmpfs 253768 0 253768 0% /dev/shm 
/dev/hdb1 4127076 552552 3364880 15% /mnt/vmr1 

Then enter into the container (lxc-console -n container) and stop cron, syslog, bind 9,ssh processes. 

container:~# ps aux 

USER PID %CPU %MEM VSZ RSS TTY STAT START TIME COMMAND 
root 1 0.0 0.1 1984 692 ? Ss 11:10 0:00 init [2] 
root 387 0.0 0.4 5884 2272 console Ss 11:10 0:00 /bin/login -- 
root 388 0.0 0.1 1992 572 tty1 Ss+ 11:10 0:00 /sbin/getty 38400 tty1 
root 389 0.0 0.1 1992 568 tty2 Ss+ 11:10 0:00 /sbin/getty 38400 tty2 
root 390 0.0 0.1 1992 568 tty3 Ss+ 11:10 0:00 /sbin/getty 38400 tty3 
root 392 0.0 0.5 4132 2680 console S 11:11 0:00 -bash 
root 584 0.0 0.1 2644 956 console R+ 11:43 0:00 ps aux 

Then use the mount command : 

container:~# mount -o remount,ro / 

Return to the Host and try to create a file in /mnt/vmr1/ . The folder is set in "read only". 

The second bug : 

Install ntfs module in the host : (exemple with ntfs module) 

debian:# modprobe ntfs 

Enter into the container and delete ntfs module 

container:~# rmmod ntfs 

Return to the host : the module has been removed 



Does anyone have solved this problem ? 

I think it is a major security problem. 


----- Mail Original ----- 
De: "Daniel Lezcano" <daniel.lezcano at free.fr> 
À: "Elias Olivares" <eolivares at 1g6.biz> 
Cc: lxc-devel at lists.sourceforge.net 
Envoyé: Vendredi 8 Janvier 2010 13:14:36 
Objet: Re: [lxc-devel] bugs with LXC container : mount and rmmod command 

Elias Olivares wrote: 
> 
> 
> Hi ! 
> 
> I've found the way to reproduce the bug. 
> 
> Host name : debian 
> Guest container name : container 
> 
> You MUST create a dedicated partition to share your containers (an other partition than " / ") 

Thanks, I will check when I have time. 



> Here the container is created in /mnt/vmr1/ : 
> 
> debian:# df 
> 
> /dev/hda1 7850996 2058732 5393452 28% / 
> tmpfs 253768 0 253768 0% /lib/init/rw 
> udev 10240 108 10132 2% /dev 
> tmpfs 253768 0 253768 0% /dev/shm 
> /dev/hdb1 4127076 552552 3364880 15% /mnt/vmr1 
> 
> Then enter into the container (lxc-console -n container) and stop cron, syslog, bind 9,ssh processes. 
> 
> container:~# ps aux 
> 
> USER PID %CPU %MEM VSZ RSS TTY STAT START TIME COMMAND 
> root 1 0.0 0.1 1984 692 ? Ss 11:10 0:00 init [2] 
> root 387 0.0 0.4 5884 2272 console Ss 11:10 0:00 /bin/login -- 
> root 388 0.0 0.1 1992 572 tty1 Ss+ 11:10 0:00 /sbin/getty 38400 tty1 
> root 389 0.0 0.1 1992 568 tty2 Ss+ 11:10 0:00 /sbin/getty 38400 tty2 
> root 390 0.0 0.1 1992 568 tty3 Ss+ 11:10 0:00 /sbin/getty 38400 tty3 
> root 392 0.0 0.5 4132 2680 console S 11:11 0:00 -bash 
> root 584 0.0 0.1 2644 956 console R+ 11:43 0:00 ps aux 
> 
> Then use the mount command : 
> 
> container:~# mount -o remount,ro / 
> 
> Return to the Host and try to create a file in /mnt/vmr1/ . The folder is set in "read only". 
> 
> I tried with the 0.6.4 version and I have the same problem. 
> 
> 
> Elias Olivares 
> 
> 
> ----- Mail Original ----- 
> De: "Elias Olivares" <eolivares at 1g6.biz> 
> À: "Daniel Lezcano" <daniel.lezcano at free.fr> 
> Cc: lxc-devel at lists.sourceforge.net 
> Envoyé: Mercredi 6 Janvier 2010 16:05:58 
> Objet: Re: [lxc-devel] bugs with LXC container : mount and rmmod command 
> 
> 
> Ok thanks for this advice. I can't try now but I will try tommorow ... 
> 
> Elias 
> 
> 
> ----- Mail Original ----- 
> De: "Daniel Lezcano" <daniel.lezcano at free.fr> 
> À: "Elias Olivares" <eolivares at 1g6.biz> 
> Cc: lxc-devel at lists.sourceforge.net 
> Envoyé: Mercredi 6 Janvier 2010 13:03:59 
> Objet: Re: [lxc-devel] bugs with LXC container : mount and rmmod command 
> 
> Elias Olivares wrote: 
>> Hi 
>> 
>> 
>> My Lxc configuration file : ( /var/lib/lxc/xxx.1g6.biz /config ) 
>> 
>> lxc.utsname = xxx.1g6.biz 
>> lxc.tty = 4 
>> lxc.pts = 1024 
>> lxc.network.type = veth 
>> lxc.network.flags = up 
>> lxc.network.link = br0 
>> lxc.network.name = eth0 
>> lxc.network.mtu = 1500 
>> #lxc.mount = 
>> lxc.rootfs = /mnt/vmr1/xxx.1g6.biz 
>> lxc.cgroup.devices.deny = a 
>> # /dev/null and zero 
>> lxc.cgroup.devices.allow = c 1:3 rwm 
>> lxc.cgroup.devices.allow = c 1:5 rwm 
>> # consoles 
>> lxc.cgroup.devices.allow = c 5:1 rwm 
>> lxc.cgroup.devices.allow = c 5:0 rwm 
>> lxc.cgroup.devices.allow = c 4:0 rwm 
>> lxc.cgroup.devices.allow = c 4:1 rwm 
>> # /dev/{,u}random 
>> lxc.cgroup.devices.allow = c 1:9 rwm 
>> lxc.cgroup.devices.allow = c 1:8 rwm 
>> lxc.cgroup.devices.allow = c 136:* rwm 
>> lxc.cgroup.devices.allow = c 5:2 rwm 
>> # rtc 
>> lxc.cgroup.devices.allow = c 254:0 rwm 
>> 
>> # lxc-version 
>> lxc version: 0.6.3 
> 
> There were some modifications with how the rootfs is mounted. 
> 
> Can you check against the 0.6.4 version ? 
> 
> wget http://lxc.sourceforge.net/download/lxc/lxc-0.6.4.tar.gz 
> tar xvzf lxc-0.6.4.tar.gz 
> cd lxc-0.6.4 
> ./configure --localstate=/var --prefix=/usr --libdir=/usr/lib64 (if you 
> are on a x86_64 arch). 
> make && sudo make install 
> 
> Or may be you can try with the latest git repository: 
> 
> git-clone git://lxc.git.sourceforge.net/gitroot/lxc/lxc 
> cd lxc 
> ./autogen.sh 
> ./configure --localstate=/var --prefix=/usr --libdir=/usr/lib64 (if you 
> are on a x86_64 arch). 
> make && sudo make install 
> 
> ------------------------------------------------------------------------------ 
> This SF.Net email is sponsored by the Verizon Developer Community 
> Take advantage of Verizon's best-in-class app development support 
> A streamlined, 14 day to market process makes app distribution fast and easy 
> Join now and get one step closer to millions of Verizon customers 
> http://p.sf.net/sfu/verizon-dev2dev 
> _______________________________________________ 
> Lxc-devel mailing list 
> Lxc-devel at lists.sourceforge.net 
> https://lists.sourceforge.net/lists/listinfo/lxc-devel 
> 
> 
> 
> ------------------------------------------------------------------------ 
> 
> ------------------------------------------------------------------------------ 
> This SF.Net email is sponsored by the Verizon Developer Community 
> Take advantage of Verizon's best-in-class app development support 
> A streamlined, 14 day to market process makes app distribution fast and easy 
> Join now and get one step closer to millions of Verizon customers 
> http://p.sf.net/sfu/verizon-dev2dev 
> 
> 
> ------------------------------------------------------------------------ 
> 
> _______________________________________________ 
> Lxc-devel mailing list 
> Lxc-devel at lists.sourceforge.net 
> https://lists.sourceforge.net/lists/listinfo/lxc-devel 

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.linuxcontainers.org/pipermail/lxc-devel/attachments/20100304/26fc9b48/attachment.html>


More information about the lxc-devel mailing list