fix: CNI: avoid error with iptables setuid check (release-4.2) #3445
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
wobito
approved these changes
Dec 20, 2024
Newer versions of the `iptables` command use a real vs effective uid check whether they are being called from a setuid script, and exit if that's the case. This check was added because iptables can call out to binaries / libraries on `PATH` / `LD_LIBRARY_PATH`, and these are generally under control of the user - allowing privilege escalation attackes. Singularity sanitizes the environment before running CNI plugins, which will call `iptables`, so we can set both real and effective uid to 0 to avoid the error. While we are here, make `PATH` sanitization the default in the network code, rather than relying on the caller applying it. Add some tests around the priv escalation / drop code. Fixes sylabs#3318
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Description of the Pull Request (PR):
Pick #3444
Newer versions of the
iptablescommand use a real vs effective uid check whether they are being called from a setuid script, and exit if that's the case.This check was added because iptables can call out to binaries / libraries on
PATH/LD_LIBRARY_PATH, and these are generally under control of the user - allowing privilege escalation attackes.Singularity sanitizes the environment before running CNI plugins, which will call
iptables, so we can set both real and effective uid to 0 to avoid the error.While we are here, make
PATHsanitization the default in the network code, rather than relying on the caller applying it.This fixes or addresses the following GitHub issues:
Before submitting a PR, make sure you have done the following:
make checkand tested this PR locally with amake test, andmake testallif possible (see CONTRIBUTING.md).