Set init process as non-dumpable
Backports fix from 2f7393a47307a16f8cee44a37b262e8b81021e3e to 1.11.x
Resolves CVE-2016-9962 for Docker 1.11.x.
Signed-off-by: Brian Goff <cpuguy83@gmail.com>
diff --git a/libcontainer/nsenter/nsexec.c b/libcontainer/nsenter/nsexec.c
index 8f37d6c..25e5f91 100644
--- a/libcontainer/nsenter/nsexec.c
+++ b/libcontainer/nsenter/nsexec.c
@@ -364,6 +364,12 @@
return;
}
+ /* make the process non-dumpable */
+ if (prctl(PR_SET_DUMPABLE, 0, 0, 0, 0) != 0) {
+ pr_perror("failed to set process as non-dumpable");
+ exit(1);
+ }
+
// Retrieve the netlink header
struct nlmsghdr nl_msg_hdr;
int len;
@@ -438,7 +444,7 @@
pr_perror("setgid failed");
exit(1);
}
-
+
if (setgroups(0, NULL) == -1) {
pr_perror("setgroups failed");
exit(1);
