[lxc-devel] [lxc/lxc] d3a9be: rexec: make rexecution opt-in for library callers

[Stéphane Graber]

  Branch: refs/heads/master
  Home:   https://github.com/lxc/lxc
  Commit: d3a9befc86113228f77c89030336faa84a5557c0
      https://github.com/lxc/lxc/commit/d3a9befc86113228f77c89030336faa84a5557c0
  Author: Christian Brauner <christian.brauner at ubuntu.com>
  Date:   2019-02-12 (Tue, 12 Feb 2019)

  Changed paths:
    M src/lxc/Makefile.am
    M src/lxc/rexec.c
    A src/lxc/rexec.h
    M src/lxc/tools/lxc_attach.c

  Log Message:
  -----------
  rexec: make rexecution opt-in for library callers

We cannot rexecute the liblxc shared library unconditionally as this would
break most of our downstreams. Here are some scenarios:
- anyone performing a dlopen() on the shared library (e.g. users of the LXC
  Python bindings)
- LXD as it needs to know the absolute path to its own executable based on
  /proc/self/exe etc.

This commit makes the rexecution of liblxc conditional on whether the
LXC_MEMFD_REXEC environment variable is set or not. If it is then liblxc is
unconditionally rexecuted.

The only relevant attack vector exists for lxc-attach which we simply reexecute
unconditionally.

Reported-by: Stéphane Graber <stgraber at ubuntu.com>
Signed-off-by: Christian Brauner <christian.brauner at ubuntu.com>


  Commit: b091c341d5131e54ed4152855439b7a188d371dc
      https://github.com/lxc/lxc/commit/b091c341d5131e54ed4152855439b7a188d371dc
  Author: Stéphane Graber <stgraber at stgraber.org>
  Date:   2019-02-12 (Tue, 12 Feb 2019)

  Changed paths:
    M src/lxc/Makefile.am
    M src/lxc/rexec.c
    A src/lxc/rexec.h
    M src/lxc/tools/lxc_attach.c

  Log Message:
  -----------
  Merge pull request #2846 from brauner/2019-02-12/CVE-2019-5736

rexec: make rexecution opt-in for library callers


Compare: https://github.com/lxc/lxc/compare/b88ccedc1e05...b091c341d513