{"action":"created","issue":{"url":"https://api.github.com/repos/opencontainers/runc/issues/1869","repository_url":"https://api.github.com/repos/opencontainers/runc","labels_url":"https://api.github.com/repos/opencontainers/runc/issues/1869/labels{/name}","comments_url":"https://api.github.com/repos/opencontainers/runc/issues/1869/comments","events_url":"https://api.github.com/repos/opencontainers/runc/issues/1869/events","html_url":"https://github.com/opencontainers/runc/pull/1869","id":351151877,"node_id":"MDExOlB1bGxSZXF1ZXN0MjA4ODE4MDI4","number":1869,"title":"rootless: make /sys/fs/cgroup/* read-only","user":{"login":"AkihiroSuda","id":9248427,"node_id":"MDQ6VXNlcjkyNDg0Mjc=","avatar_url":"https://avatars2.githubusercontent.com/u/9248427?v=4","gravatar_id":"","url":"https://api.github.com/users/AkihiroSuda","html_url":"https://github.com/AkihiroSuda","followers_url":"https://api.github.com/users/AkihiroSuda/followers","following_url":"https://api.github.com/users/AkihiroSuda/following{/other_user}","gists_url":"https://api.github.com/users/AkihiroSuda/gists{/gist_id}","starred_url":"https://api.github.com/users/AkihiroSuda/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/AkihiroSuda/subscriptions","organizations_url":"https://api.github.com/users/AkihiroSuda/orgs","repos_url":"https://api.github.com/users/AkihiroSuda/repos","events_url":"https://api.github.com/users/AkihiroSuda/events{/privacy}","received_events_url":"https://api.github.com/users/AkihiroSuda/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":8,"created_at":"2018-08-16T10:46:21Z","updated_at":"2018-10-16T15:17:07Z","closed_at":"2018-10-16T15:17:06Z","author_association":"CONTRIBUTOR","pull_request":{"url":"https://api.github.com/repos/opencontainers/runc/pulls/1869","html_url":"https://github.com/opencontainers/runc/pull/1869","diff_url":"https://github.com/opencontainers/runc/pull/1869.diff","patch_url":"https://github.com/opencontainers/runc/pull/1869.patch"},"body":"The default rootless spec bind-mounts /sys with \"rbind,ro\" (because mounting sysfs\r\nrequires netns to be unshared), however, it does not make subfilesystems mounted\r\nunder /sys read-only.\r\n\r\nSo, files under /sys/fs/cgroup were unexpectedly writable when they are chmod/chowned\r\nvia privileged helpers such as pam_cgfs.\r\n\r\nThis patch fixes the issue by mounting /sys/fs/cgroup/* as read-only explicitly.\r\n\r\nSigned-off-by: Akihiro Suda <suda.akihiro@lab.ntt.co.jp>"},"comment":{"url":"https://api.github.com/repos/opencontainers/runc/issues/comments/430278640","html_url":"https://github.com/opencontainers/runc/pull/1869#issuecomment-430278640","issue_url":"https://api.github.com/repos/opencontainers/runc/issues/1869","id":430278640,"node_id":"MDEyOklzc3VlQ29tbWVudDQzMDI3ODY0MA==","user":{"login":"AkihiroSuda","id":9248427,"node_id":"MDQ6VXNlcjkyNDg0Mjc=","avatar_url":"https://avatars2.githubusercontent.com/u/9248427?v=4","gravatar_id":"","url":"https://api.github.com/users/AkihiroSuda","html_url":"https://github.com/AkihiroSuda","followers_url":"https://api.github.com/users/AkihiroSuda/followers","following_url":"https://api.github.com/users/AkihiroSuda/following{/other_user}","gists_url":"https://api.github.com/users/AkihiroSuda/gists{/gist_id}","starred_url":"https://api.github.com/users/AkihiroSuda/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/AkihiroSuda/subscriptions","organizations_url":"https://api.github.com/users/AkihiroSuda/orgs","repos_url":"https://api.github.com/users/AkihiroSuda/repos","events_url":"https://api.github.com/users/AkihiroSuda/events{/privacy}","received_events_url":"https://api.github.com/users/AkihiroSuda/received_events","type":"User","site_admin":false},"created_at":"2018-10-16T15:17:06Z","updated_at":"2018-10-16T15:17:06Z","author_association":"CONTRIBUTOR","body":"On second thought maybe we should rather suggest users not mounting `/sys` when rootless && netns is not unshared.\r\n\r\nRootless BuildKit already removed `/sys` mount in https://github.com/moby/buildkit/pull/689\r\n\r\nFor Rootless Moby, `sysfs` mount (not bind-mount) is preserved, because netns is unshared via RootlessKit before starting `dockerd`: \r\nhttps://github.com/moby/moby/pull/38050\r\n\r\nI'm going to close this PR but I may change my mind later.\r\nRFC. @giuseppe @cyphar @jessfraz \r\n\r\n"}}
{"actor":{"display_login":"AkihiroSuda"}}