Bug 860218

Summary: /dev/pts must use the 'newinstance' mount flag to avoid security problem with containers
Product: Red Hat Enterprise Linux 7 Reporter: Daniel Berrange <berrange>
Component: kernelAssignee: Aristeu Rozanski <arozansk>
Status: CLOSED WONTFIX QA Contact: Red Hat Kernel QE team <kernel-qe>
Severity: medium Docs Contact:
Priority: low    
Version: 7.0CC: hpa, kernel-maint
Target Milestone: rc   
Target Release: ---   
Hardware: All   
OS: Linux   
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: 527483 Environment:
Last Closed: 2013-11-01 09:39:44 EDT Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Description Daniel Berrange 2012-09-25 05:45:40 EDT
+++ This bug was initially created as a clone of Bug #527483 +++

+++ This bug was initially created as a clone of Bug #501718 +++

Description of problem:
The Linux kernel now allows multiple instances of 'devpts' filesystem to be mounted on a host, and the pty indexes of each instance are independant. This feature allows Linux containers to be given private 'devpts' instances, preventing them from accessing PTYs from the host OS.

This is only secure, however, if every single mount of 'devpts' uses the 'newinstance' flag, including that of the initial host OS.

If the host OS does not use 'newinstance' mount option, then a container can still get access to the host's PTYs, which is clearly a security problem

When using 'newinstance', the /dev/ptmx  file must also be symlinked, or bind-mounted to /dev/pts/ptmx

There is more information about the required setup in the kernel tree documentation, 'filesystems/devpts.txt'. The key point is in the last paragraph

7. A mount of devpts without the 'newinstance' option results in binding to
   initial kernel mount.  This behavior while preserving legacy semantics,
   does not provide strict isolation in a container environment. i.e by
   mounting devpts without the 'newinstance' option, a container could
   get visibility into the 'host' or root container's devpts.
   To workaround this and have strict isolation, all mounts of devpts,
   including the mount in the root container, should use the newinstance

In Fedora 12, libvirt and the LXC toolchain will both be creating containers using 'newinstance' and want this to provide secure isolation of devpts. Thus we require that the host OS devpts is switched to use 'newinstance' and symlink of /dev/ptmx to /dev/pts/ptmx.

RPM claims the 'setup' RPM owns /etc/fstab, but that seems to be a ghost file, and AFAICT anaconda is responsible for initial creation. Thus I'm filing this bug against anaconda - feel free to reassign if this is the wrong place.

Version-Release number of selected component (if applicable):

How reproducible:

Steps to Reproduce:
1. Install a new Fedora host
2. 'mount | grep devpts'
3. ls -l /dev/ptmx
Actual results:
# mount | grep devpts
devpts on /dev/pts type devpts (rw,gid=5,mode=620)
# ls -l /dev/ptmx
crw-rw-rw-. 1 root tty 5, 2 2009-05-20 14:35 /dev/ptmx

Expected results:
# mount | grep devpts
devpts on /dev/pts type devpts (rw,gid=5,mode=620,newinstance)
# ls -l /dev/ptmx
lrwxrwxrwx. 1 root root 8 2009-05-20 14:36 ptmx -> pts/ptmx

Additional info:

--- Additional comment from berrange@redhat.com on 2009-05-20 09:47:59 EDT ---

Just to clarify, I do not want this for F11. It is too risky to make such a change for F11 at this stage.  Fedora 12 is my desired target for resolution.

--- Additional comment from katzj@redhat.com on 2009-05-20 11:34:24 EDT ---

If we want it mounted that way by default, then we should really change the defaults in the kernel.  Not require changes in anaconda, livecd-creator, appliance-creator, ...

--- Additional comment from berrange@redhat.com on 2012-09-25 10:44:12 BST ---

Latest proposal for upstream kernel is to kill off the 'newinstance' flag and make all /dev/pts instances private by default.

Comment 1 Daniel Berrange 2013-11-01 04:54:18 EDT
FYI, while it might be nice to do this, I no longer consider this an important fix for containers. With sVirt SELinux rules, the user will be blocked from accessing the original devpts instance, and likewise user namespaces would also block it. So it is only a security risk if neither user namespaces nor selinux were used, and this scenario is insecure for many other reasons too. So feel free to WONTFIX this bug unless the quoted kernel change is in fact already upstream.
Comment 2 Aristeu Rozanski 2013-11-01 09:39:44 EDT
It seems upstream didn't reach an agreement on this and I believe diverge from
upstream on this will cause problems. Closing with WONTFIX.
Thanks Daniel