Description

While looking through the Moby source code I've found /proc/asound to be shared with containers as read-only (as defined in https://github.com/moby/moby/blob/master/oci/defaults.go#L128).

This can lead to two information leaks.

Leak of media playback status of the host
Steps to reproduce the issue:

• Listen to music/Play a YouTube video/Do anything else that involves sound output
• Execute docker run --rm ubuntu:latest bash -c "sleep 7; cat /proc/asound/card*/pcm*p/sub*/status | grep state | cut -d ' ' -f2 | grep RUNNING || echo 'not running'"
• See that the containerized process is able to check whether someone on the host is playing music as it prints RUNNING
• Stop the music output
• Execute the command again (The sleep is delaying the output because information regarding playback status isn't propagated instantly)
• See that it outputs not running

Describe the results you received:

A containerized process is able to gather information on the playback status of an audio device governed by the host. Therefore a process of a container is able to check whether and what kind of user activity is present on the host system. Also, this may indicate whether a container runs on a desktop system or a server as media playback rarely happens on server systems.

The description above is in regard to media playback - when examining /proc/asound/card*/pcm*c/sub*/status (pcm*c instead of pcm*p) this can also leak information regarding capturing sound, as in recording audio or making calls on the host system.

Describe the results you expected:

A process in a container isn't able to gather this kind of information.

The path /proc/asound or parts of it maybe can be masked in order to provide a container with its own version of the affected paths?

Leak of Monitor Type
Steps to reproduce the issue:

• Connect a monitor to your machine via DisplayPort and use its speakers to play music
• Execute docker run --rm ubuntu:latest bash -c "cat /proc/asound/card*/eld* | grep monitor_name"
• See that the containerized process is able to determine the montor model type, e.g. SMS24A650 for my Samsung monitor.

Describe the results you received:

A containerized process is able to gather information on the attached monitor of the host system.

Describe the results you expected:

A process in a container isn't able to gather this kind of information.

The path /proc/asound or parts of it maybe can be masked in order to provide a container with its own version of the affected paths?

Additional information you deem important (e.g. issue happens only occasionally):

All tests have been performed on a standard Ubuntu installation without any additional configuration applied to the system or Docker.

Output of docker version:

Client:
 Version:           18.06.1-ce
 API version:       1.38
 Go version:        go1.10.4
 Git commit:        e68fc7a
 Built:             Fri Oct 19 19:43:14 2018
 OS/Arch:           linux/amd64
 Experimental:      false

Server:
 Engine:
  Version:          18.06.1-ce
  API version:      1.38 (minimum version 1.12)
  Go version:       go1.10.4
  Git commit:       e68fc7a
  Built:            Thu Sep 27 02:39:50 2018
  OS/Arch:          linux/amd64
  Experimental:     false

Output of docker info:

Containers: [...]
 Running: [...]
 Paused: 0
 Stopped: [...]
Images: [...]
Server Version: 18.06.1-ce
Storage Driver: overlay2
 Backing Filesystem: extfs
 Supports d_type: true
 Native Overlay Diff: true
Logging Driver: json-file
Cgroup Driver: cgroupfs
Plugins:
 Volume: local
 Network: bridge host macvlan null overlay
 Log: awslogs fluentd gcplogs gelf journald json-file logentries splunk syslog
Swarm: inactive
Runtimes: runc
Default Runtime: runc
Init Binary: docker-init
containerd version:  (expected: 468a545b9edcd5932818eb9de8e72413e616e86e)
runc version: N/A (expected: 69663f0bd4b60df09991c08812a60108003fa340)
init version: v0.18.0 (expected: fec3683b971d9c3ef73f284f176672c44b448662)
Security Options:
 apparmor
 seccomp
  Profile: default
Kernel Version: [...]
Operating System: Ubuntu 18.04.1 LTS
OSType: linux
Architecture: x86_64
CPUs: [...]
Total Memory: [...]
Name: [...]
ID: CR7L:OCP4:IZ76:VHOD:ZCDV:PLTN:QKYD:D7TV:OYKN:3QB5:TQTN:QCAK
Docker Root Dir: /var/lib/docker
Debug Mode (client): false
Debug Mode (server): false
Registry: https://index.docker.io/v1/
Labels:
Experimental: false
Insecure Registries:
 127.0.0.0/8
Live Restore Enabled: false