[lxc-devel] [lxc/lxc] 61ecf6: CVE-2015-1331: lxclock: use /run/lxc/lock rather t...

[GitHub]

  Branch: refs/heads/stable-1.1
  Home:   https://github.com/lxc/lxc
  Commit: 61ecf69d7834921cc078e14d1b36c459ad8f91c7
      https://github.com/lxc/lxc/commit/61ecf69d7834921cc078e14d1b36c459ad8f91c7
  Author: Serge Hallyn <serge.hallyn at ubuntu.com>
  Date:   2015-07-22 (Wed, 22 Jul 2015)

  Changed paths:
    M src/lxc/lxclock.c
    M src/tests/locktests.c

  Log Message:
  -----------
  CVE-2015-1331: lxclock: use /run/lxc/lock rather than /run/lock/lxc

This prevents an unprivileged user to use LXC to create arbitrary file
on the filesystem.

Signed-off-by: Serge Hallyn <serge.hallyn at ubuntu.com>
Signed-off-by: Tyler Hicks <tyhicks at canonical.com>
Acked-by: Stéphane Graber <stgraber at ubuntu.com>


  Commit: 659e807c8dd1525a5c94bdecc47599079fad8407
      https://github.com/lxc/lxc/commit/659e807c8dd1525a5c94bdecc47599079fad8407
  Author: Stéphane Graber <stgraber at ubuntu.com>
  Date:   2015-07-22 (Wed, 22 Jul 2015)

  Changed paths:
    M src/lxc/attach.c

  Log Message:
  -----------
  CVE-2015-1334: Don't use the container's /proc during attach

A user could otherwise over-mount /proc and prevent the apparmor profile
or selinux label from being written which combined with a modified
/bin/sh or other commonly used binary would lead to unconfined code
execution.

Reported-by: Roman Fiedler
Signed-off-by: Stéphane Graber <stgraber at ubuntu.com>


Compare: https://github.com/lxc/lxc/compare/3d6347a4cd69...659e807c8dd1