cluster

commit 13d2fd8e27a709962600c41e2e0d07ded7d616a5
parent 1d852722ad98be8c629dd657685201b03ab01dd0
Author: MTRNord <mtrnord1@gmail.com>
Date:   Wed, 24 Jan 2024 00:41:44 +0100

Patch cve-2023-2640

Diffstat:
A
apps/base/tetragon/cve-2023-2640-overlayfs-ubuntu.yaml
 | 
55
+++++++++++++++++++++++++++++++++++++++++++++++++++++++
M
apps/base/tetragon/kustomization.yaml
 | 
1
+

2 files changed, 56 insertions(+), 0 deletions(-)
diff --git a/apps/base/tetragon/cve-2023-2640-overlayfs-ubuntu.yaml b/apps/base/tetragon/cve-2023-2640-overlayfs-ubuntu.yaml
@@ -0,0 +1,55 @@
+# https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-2640
+#
+# Description
+#  On Ubuntu kernels carrying both c914c0e27eb0 and
+#  "UBUNTU: SAUCE: overlayfs: Skip permission checking for trusted.overlayfs.* xattrs",
+#  an unprivileged user may set privileged extended attributes on the mounted files,
+#  leading them to be set on the upper files without the appropriate security checks.
+#
+# Affected ubuntu kernel version:
+#  6.2.0
+#  5.19.0 tested on kernel 5.19.0-46
+#  ...
+#
+# Prevention:
+#  Prevents copying up security.capability xattr on overlayfs from a user namespace,
+#  making it a nop.
+#
+# Prerequisites
+#  Needs a kernel with a CONFIG_BPF_KPROBE_OVERRIDE=y
+#
+# Doing "getcap upper/binary" will display empty file capabilities.
+#
+apiVersion: cilium.io/v1alpha1
+kind: TracingPolicy
+metadata:
+  name: "cve-2023-2460-overlayfs-ubuntu"
+    #annotations:
+      #url: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-2640
+      #description: "Prevents copying up security.capability xattr on overlayfs from a user namespace."
+      #author: "Djalal Harouni"
+spec:
+  kprobes:
+  - call: "security_inode_copy_up_xattr"
+    syscall: false
+    return: true
+    args:
+    - index: 0
+      type: "string"
+    returnArg:
+      index: 0
+      type: "int"
+    selectors:
+    - matchNamespaces:
+      - namespace: User
+        operator: NotIn
+        values:
+        - "host_ns"
+      matchArgs:
+      - index: 0
+        operator: "Equal"
+        values:
+        - "security.capability\0"
+      matchActions:
+      - action: Override
+        argError: 1  # Override with 1 avoids copying up security.capability, with -1 the copy up fails.
diff --git a/apps/base/tetragon/kustomization.yaml b/apps/base/tetragon/kustomization.yaml
@@ -4,3 +4,4 @@ namespace: tetragon
 resources:
   - repository.yaml
   - release.yaml
+  - cve-2023-2640-overlayfs-ubuntu.yaml