Affected by GO-2022-0452 and 4 other vulnerabilities

GO-2022-0452: Default inheritable capabilities for linux container should be empty in github.com/opencontainers/runc

GO-2022-0914: mount destinations can be swapped via symlink-exchange to cause mounts outside the rootfs in github.com/opencontainers/runc

GO-2023-1682: rootless: `/sys/fs/cgroup` is writable when cgroupns isn't unshared in runc in github.com/opencontainers/runc

GO-2023-1683: runc AppArmor bypass with symlinked /proc in github.com/opencontainers/runc

GO-2024-3110: runc can be confused to create empty files/directories on the host in github.com/opencontainers/runc

ebpf

package

v1.0.0-rc92 Latest Latest Go to latest Published: Aug 5, 2020 License: Apache-2.0 Imports: 3 Imported by: 0

Details

This section is empty.

This section is empty.

func LoadAttachCgroupDeviceFilter(insts asm.Instructions, license string, dirFD int) (func() error, error)

LoadAttachCgroupDeviceFilter installs eBPF device filter program to /sys/fs/cgroup/<foo> directory.

Requires the system to be running in cgroup2 unified-mode with kernel >= 4.15 .

This section is empty.

Path	Synopsis
devicefilter Package devicefilter containes eBPF device filter program The implementation is based on https://github.com/containers/crun/blob/0.10.2/src/libcrun/ebpf.c Although ebpf.c is originally licensed under LGPL-3.0-or-later, the author (Giuseppe Scrivano) agreed to relicense the file in Apache License 2.0: https://github.com/opencontainers/runc/issues/2144#issuecomment-543116397	Package devicefilter containes eBPF device filter program The implementation is based on https://github.com/containers/crun/blob/0.10.2/src/libcrun/ebpf.c Although ebpf.c is originally licensed under LGPL-3.0-or-later, the author (Giuseppe Scrivano) agreed to relicense the file in Apache License 2.0: https://github.com/opencontainers/runc/issues/2144#issuecomment-543116397