I have been working on a new functionality for the prctl syscall utility that addresses a common security concern with container runtimes.

On a Linux system, under /proc it is possible to find many interesting files about a process, one of them is /proc/[pid]/exe, that points to the executable file that was used to launch the process. The man page for proc(5) states the following:

/ p r o c / [ p U n b t i n o y h d d r r ] e m p e / r a r a e l o d x L l c e e i y e d n ; s u s p x r a [ o 2 t p c . t i e 2 e d s m ] s a p . , n t d i t n I h l g f e a t t c e t h o r o e n , t o p e t p a n h e t t i n h s s n i a o f t m f i e l w t e i h h l a i i l s s s o b s a p e y e e m s n n b y o m t u l b h n i o e l c l i i e n l c x k i e e n l c d k i u , n t a k a t r b h e c l e o e n n . s o t y t a m i Y b a n o o v i u l a n i i g c c l a a t n l b h i l e e n e v k a e i c n w f t i u t l t a y l h l p e e c p m a n a t p t i h r a n n o i a c n t m / h e [ t r p h e o i e a f d d ] s t / t h h e r a e x i s e n e g a x t l e o r c ( e u r d a t u e d e n l y d e a t t c n e e o o d r m t ) m m h ' i a e n n r a a d p t . c p e o e d p n T y d ( h e t i o d y s f p t i s t o c y h a m e t l b h l o s e y l a i m o b c e r y i e g c l x i a i e n l n c a l k u l i t n a p g c b a a l t p n e h t n h t a r b h m e e a e a t . d _ d i e e s I x r n i e b t f e a ( e i 3 r n m ) e g u ) n l . c r t e u i d n ‐

This can be useful in certain situations, but it can also pose a security risk. In particular, the /proc/self/exe file became popular with the CVE-2019-5736 vulnerability, which allowed attackers to escape from a container and gain access to the host!

Much was written about this vulnerability, in particular I suggest to learn more about the issue here: https://unit42.paloaltonetworks.com/breaking-docker-via-runc-explaining-cve-2019-5736/.

The short version is that the attacker was able to overwrite the container runtime executable file on the host taking advantage of the /proc/self/exe file.

The workaround that was implemented in the container runtimes was to use a read-only bind mount, or using a copying of the runtime executable and then using it to re-exec itself before handing the container execution.

To solve the root problem, I’ve proposed a new option for prctl() called PR_HIDE_SELF_EXE. This feature makes any access to /proc/self/exe always return ENOENT, effectively preventing a process from being able to access its own executable file.

It would have been better if the kernel didn’t allow such kind of issues at all, but at this point any change on how /proc/self/exe works would be a breaking change. Instead prctl(PR_HIDE_SELF_EXE) is not a breaking change since a program must opt-in to use this feature and it won’t affect programs that don’t use it.

Once the PR_HIDE_SELF_EXE flag has been set, it cannot be cleared; it will be automatically cleared when the process calls again execve.

Here there is an example of how it would look:

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18

#include <stdio.h>
#include <fcntl.h>
#include <errno.h>
#include <sys/prctl.h>

int main()
{
        int fd;
        errno = 0;
        fd = open("/proc/self/exe", O_RDONLY);
        printf("Got fd: %d (%m)\n", fd);
        close(fd);
        prctl(PR_HIDE_SELF_EXE, 1, 0, 0, 0);
        errno = 0;
        fd = open("/proc/self/exe", O_RDONLY);
        printf("Got fd: %d (%m)\n", fd);
        return 0;
}

and then running it:

1
2
3
4

$ gcc -o hide hide.c
$ ./hide
Got fd: 3 (Success)
Got fd: -1 (No such file or directory)