From 65e821f8193c6be2f165f273ba6803a7f134f9f6 Mon Sep 17 00:00:00 2001 From: bwzhang Date: Mon, 18 Mar 2024 15:16:19 +0800 Subject: [PATCH] fix PLATYPUS attack of RAPL accessible to a container --- ...ack-of-RAPL-accessible-to-a-containe.patch | 41 +++++++++++++++++++ k3s-containerd.spec | 9 +++- 2 files changed, 49 insertions(+), 1 deletion(-) create mode 100644 0003-fix-PLATYPUS-attack-of-RAPL-accessible-to-a-containe.patch diff --git a/0003-fix-PLATYPUS-attack-of-RAPL-accessible-to-a-containe.patch b/0003-fix-PLATYPUS-attack-of-RAPL-accessible-to-a-containe.patch new file mode 100644 index 0000000..f34921c --- /dev/null +++ b/0003-fix-PLATYPUS-attack-of-RAPL-accessible-to-a-containe.patch @@ -0,0 +1,41 @@ +From e3b8749e93d2412385498c9ed6cf6550b2992aaf Mon Sep 17 00:00:00 2001 +From: bwzhang +Date: Mon, 18 Mar 2024 15:06:38 +0800 +Subject: [PATCH] fix PLATYPUS attack of RAPL accessible to a container + Security Advisories: + https://github.com/containerd/containerd/security/advisories/GHSA-7ww5-4wqc-m92c + upstream: + https://github.com/containerd/containerd/commit/9e4d53df751605b2c3fa12ed062f8d7a76c0b3f3 + +--- + contrib/apparmor/template.go | 1 + + oci/spec.go | 1 + + 2 files changed, 2 insertions(+) + +diff --git a/contrib/apparmor/template.go b/contrib/apparmor/template.go +index ba613c3..5c4f785 100644 +--- a/contrib/apparmor/template.go ++++ b/contrib/apparmor/template.go +@@ -81,6 +81,7 @@ profile {{.Name}} flags=(attach_disconnected,mediate_deleted) { + deny /sys/fs/c[^g]*/** wklx, + deny /sys/fs/cg[^r]*/** wklx, + deny /sys/firmware/** rwklx, ++ deny /sys/devices/virtual/powercap/** rwklx, + deny /sys/kernel/security/** rwklx, + + {{if ge .Version 208095}} +diff --git a/oci/spec.go b/oci/spec.go +index a1c98dd..62d212a 100644 +--- a/oci/spec.go ++++ b/oci/spec.go +@@ -171,6 +171,7 @@ func populateDefaultUnixSpec(ctx context.Context, s *Spec, id string) error { + "/proc/timer_stats", + "/proc/sched_debug", + "/sys/firmware", ++ "/sys/devices/virtual/powercap", + "/proc/scsi", + }, + ReadonlyPaths: []string{ +-- +2.20.1 + diff --git a/k3s-containerd.spec b/k3s-containerd.spec index 71c3f79..4139f18 100644 --- a/k3s-containerd.spec +++ b/k3s-containerd.spec @@ -3,7 +3,7 @@ %global version_suffix k3s1 Version: 1.6.6 Name: k3s-containerd -Release: 8 +Release: 9 Summary: An industry-standard container runtime License: Apache-2.0 URL: https://github.com/k3s-io/containerd @@ -14,6 +14,7 @@ Source1: sys.tar.gz Patch0: bbolt-add-loong64-support.patch Patch0001: 0001-Fix-CVE-2023-25153.patch Patch0002: 0002-Fix-CVE-2022-23471.patch +Patch0003: 0003-fix-PLATYPUS-attack-of-RAPL-accessible-to-a-containe.patch BuildRequires: golang glibc-static make btrfs-progs-devel @@ -78,6 +79,12 @@ cp -rf %{_builddir}/containerd-%{version}-%{version_suffix}/. %{buildroot}%{_lib %changelog +* Mon Mar 18 2024 zhangbowei - 1.6.6-k3s1-9 +- Type:bugfix +- CVE:NA +- SUG:NA +- DESC:fix PLATYPUS attack of RAPL accessible to a container + * Fri Mar 15 2024 zhangbowei - 1.6.6-k3s1-8 - Type:bugfix - CVE:NA -- Gitee