moby/integration-cli
Jérôme Petazzoni 1c4202a614 Mount /proc and /sys read-only, except in privileged containers.
It has been pointed out that some files in /proc and /sys can be used
to break out of containers. However, if those filesystems are mounted
read-only, most of the known exploits are mitigated, since they rely
on writing some file in those filesystems.

This does not replace security modules (like SELinux or AppArmor), it
is just another layer of security. Likewise, it doesn't mean that the
other mitigations (shadowing parts of /proc or /sys with bind mounts)
are useless. Those measures are still useful. As such, the shadowing
of /proc/kcore is still enabled with both LXC and native drivers.

Special care has to be taken with /proc/1/attr, which still needs to
be mounted read-write in order to enable the AppArmor profile. It is
bind-mounted from a private read-write mount of procfs.

All that enforcement is done in dockerinit. The code doing the real
work is in libcontainer. The init function for the LXC driver calls
the function from libcontainer to avoid code duplication.

Docker-DCO-1.1-Signed-off-by: Jérôme Petazzoni <jerome@docker.com> (github: jpetazzo)
2014-05-01 15:26:58 -07:00
..
build_tests/TestBuildSixtySteps initial version of cli integration tests 2014-03-29 23:09:40 +02:00
run_tests/TestVolumeWithSymlink Fixes #5152 : symlink in volume path 2014-04-28 13:18:12 -07:00
docker_cli_attach_test.go Port multiple attach test to cli tests 2014-04-18 02:14:00 +00:00
docker_cli_build_test.go cli integration: sync container & image deletion 2014-04-04 03:22:32 +03:00
docker_cli_commit_test.go Update commit test in cli 2014-04-18 02:24:19 +00:00
docker_cli_diff_test.go cli integration: sync container & image deletion 2014-04-04 03:22:32 +03:00
docker_cli_export_import_test.go cli integration: sync container & image deletion 2014-04-04 03:22:32 +03:00
docker_cli_images_test.go Convert a legacy integration test to a clean v2 CLI integration test. 2014-04-07 20:34:21 +00:00
docker_cli_import_test.go add test 2014-03-31 19:31:21 +00:00
docker_cli_info_test.go initial version of cli integration tests 2014-03-29 23:09:40 +02:00
docker_cli_kill_test.go cli integration: sync container & image deletion 2014-04-04 03:22:32 +03:00
docker_cli_logs_test.go Timestamps for docker logs. 2014-05-01 20:40:36 +04:00
docker_cli_nat_test.go Rename runtime/* to daemon/* 2014-04-17 14:43:01 -07:00
docker_cli_pull_test.go initial version of cli integration tests 2014-03-29 23:09:40 +02:00
docker_cli_push_test.go cli integration: sync container & image deletion 2014-04-04 03:22:32 +03:00
docker_cli_rm_test.go convert so rm tests to integration-cli 2014-04-18 17:40:12 +00:00
docker_cli_run_test.go Mount /proc and /sys read-only, except in privileged containers. 2014-05-01 15:26:58 -07:00
docker_cli_save_load_test.go cli integration: sync container & image deletion 2014-04-04 03:22:32 +03:00
docker_cli_search_test.go initial version of cli integration tests 2014-03-29 23:09:40 +02:00
docker_cli_tag_test.go cli integration: sync container & image deletion 2014-04-04 03:22:32 +03:00
docker_cli_top_test.go provide more information when TestTop tests fail 2014-04-17 03:39:15 +03:00
docker_cli_version_test.go Add API version to docker version 2014-04-01 17:30:19 -07:00
docker_test_vars.go initial version of cli integration tests 2014-03-29 23:09:40 +02:00
docker_utils.go Convert a legacy integration test to a clean v2 CLI integration test. 2014-04-07 20:34:21 +00:00
utils.go Convert a legacy integration test to a clean v2 CLI integration test. 2014-04-07 20:34:21 +00:00