Update sbserver to add noexec nodev and nosuid to /etc/resolv.conf mount bind.

vinayakankugoyal · vinayakankugoyal · commit ac84bf7c893b · 2023-03-30T21:54:21.000Z
Signed-off-by: Vinayak Goyal &lt;vinaygo@google.com&gt;
diff --git a/pkg/cri/sbserver/podsandbox/sandbox_run_linux.go b/pkg/cri/sbserver/podsandbox/sandbox_run_linux.go
@@ -115,7 +115,7 @@ func (c *Controller) sandboxContainerSpec(id string, config *runtime.PodSandboxC
 			Source:      c.getResolvPath(id),
 			Destination: resolvConfPath,
 			Type:        "bind",
-			Options:     []string{"rbind", "ro"},
+			Options:     []string{"rbind", "ro", "nosuid", "nodev", "noexec"},
 		},
 	}))
 
diff --git a/pkg/cri/sbserver/podsandbox/sandbox_run_linux_test.go b/pkg/cri/sbserver/podsandbox/sandbox_run_linux_test.go
@@ -91,6 +91,14 @@ func getRunPodSandboxTestData() (*runtime.PodSandboxConfig, *imagespec.ImageConf
 			assert.NotEqual(t, "", spec.Process.SelinuxLabel)
 			assert.NotEqual(t, "", spec.Linux.MountLabel)
 		}
+
+		assert.Contains(t, spec.Mounts, runtimespec.Mount{
+			Source:      "/test/root/sandboxes/test-id/resolv.conf",
+			Destination: resolvConfPath,
+			Type:        "bind",
+			Options:     []string{"rbind", "ro", "nosuid", "nodev", "noexec"},
+		})
+
 	}
 	return config, imageConfig, specCheck
 }

Original file line number	Diff line number	Diff line change
`@@ -91,6 +91,14 @@ func getRunPodSandboxTestData() (runtime.PodSandboxConfig, imagespec.ImageConf`
`91`	`91`	`assert.NotEqual(t, "", spec.Process.SelinuxLabel)`
`92`	`92`	`assert.NotEqual(t, "", spec.Linux.MountLabel)`
`93`	`93`	`}`
	`94`	`+`
	`95`	`+ assert.Contains(t, spec.Mounts, runtimespec.Mount{`
	`96`	`+ Source: "/test/root/sandboxes/test-id/resolv.conf",`
	`97`	`+ Destination: resolvConfPath,`
	`98`	`+ Type: "bind",`
	`99`	`+ Options: []string{"rbind", "ro", "nosuid", "nodev", "noexec"},`
	`100`	`+ })`
	`101`	`+`
`94`	`102`	`}`
`95`	`103`	`return config, imageConfig, specCheck`
`96`	`104`	`}`