From 5c0b694ef3a4b86cdcd7ce03f1b300252ca70a05 Mon Sep 17 00:00:00 2001 From: Sebastiaan van Stijn Date: Mon, 2 Nov 2020 10:27:51 +0100 Subject: [PATCH 1/2] container: make hostconfig.json non-world-readable (0600) When writing container's `hostconfig.json`, permissions were set to 0644 (world- readable). While this is not a security concern (as the `/var/lib/docker/containers` directory has `0700` or `0701` permissions), there is no real need to have these permissions, as this file is only accessed by the daemon. Looking at history for file permissions; - 06b53e3fc7aca2b3dae32edab08c7662d3e9e7e8 (first implementation) used `0666` (world-writable) - cf1a6c08fa03aa7020f8f5b414bb9349a9c8371a refactored the code, and removed explicit permissions - ea3cbd3274664f5b16fce78d7df036f6b5c94e30 introduced atomic writes, and brought back the `0666` permissions - 3ec8fed7476704f061891d4c421c615da49e30c7 removed world-writable bits, but kept world-readable This patch updates the permissions to `0600`, matching what's used for `config.v2.json`, which was updated in ae52cea3ab46e1e728606349fb6baa9a8203f3ed, but forgot to update `hostconfig.json`. Signed-off-by: Sebastiaan van Stijn --- container/container.go | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/container/container.go b/container/container.go index df90a4ee2c..da9253afb3 100644 --- a/container/container.go +++ b/container/container.go @@ -244,7 +244,7 @@ func (container *Container) WriteHostConfig() (*containertypes.HostConfig, error return nil, err } - f, err := ioutils.NewAtomicFileWriter(pth, 0644) + f, err := ioutils.NewAtomicFileWriter(pth, 0600) if err != nil { return nil, err } From f4aafedc4857082caf04b017d372af095365ad1b Mon Sep 17 00:00:00 2001 From: Sebastiaan van Stijn Date: Mon, 2 Nov 2020 10:32:59 +0100 Subject: [PATCH 2/2] container: minor cleanup/refactor Signed-off-by: Sebastiaan van Stijn --- container/container.go | 17 +++++++++-------- 1 file changed, 9 insertions(+), 8 deletions(-) diff --git a/container/container.go b/container/container.go index da9253afb3..3da63743ab 100644 --- a/container/container.go +++ b/container/container.go @@ -43,7 +43,10 @@ import ( "github.com/sirupsen/logrus" ) -const configFileName = "config.v2.json" +const ( + configFileName = "config.v2.json" + hostConfigFileName = "hostconfig.json" +) // ExitStatus provides exit reasons for a container. type ExitStatus struct { @@ -158,12 +161,9 @@ func (container *Container) FromDisk() error { return container.readHostConfig() } -// toDisk saves the container configuration on disk and returns a deep copy. +// toDisk writes the container's configuration (config.v2.json, hostconfig.json) +// to disk and returns a deep copy. func (container *Container) toDisk() (*Container, error) { - var ( - buf bytes.Buffer - deepCopy Container - ) pth, err := container.ConfigPath() if err != nil { return nil, err @@ -176,11 +176,13 @@ func (container *Container) toDisk() (*Container, error) { } defer f.Close() + var buf bytes.Buffer w := io.MultiWriter(&buf, f) if err := json.NewEncoder(w).Encode(container); err != nil { return nil, err } + var deepCopy Container if err := json.NewDecoder(&buf).Decode(&deepCopy); err != nil { return nil, err } @@ -188,7 +190,6 @@ func (container *Container) toDisk() (*Container, error) { if err != nil { return nil, err } - return &deepCopy, nil } @@ -348,7 +349,7 @@ func (container *Container) ExitOnNext() { // HostConfigPath returns the path to the container's JSON hostconfig func (container *Container) HostConfigPath() (string, error) { - return container.GetRootResourcePath("hostconfig.json") + return container.GetRootResourcePath(hostConfigFileName) } // ConfigPath returns the path to the container's JSON config