From 4b300c8f04b04feca2b5629fa75006a81fcbdae6 Mon Sep 17 00:00:00 2001 From: Kir Kolyshkin Date: Tue, 4 Aug 2026 19:16:57 -0700 Subject: [PATCH 1/2] fs,fs2: AddPid: stricter subcgroup check Current check is not entirely adequate as it will allow writing pid to a cgroup with a name that is prefixed with the current cgroup name. For example, if current cgroup path ends in "/something", AddPid allows subcgroup to be "../somethingELSE". This is a correctness (rather than a security) fix as runc exec --cgroup (AFAIK the only user) has own checks, too. Fixes: 304da795 ("Implement AddPid method for cgroup managers") Signed-off-by: Kir Kolyshkin --- fs/fs.go | 3 ++- fs2/fs2.go | 3 ++- 2 files changed, 4 insertions(+), 2 deletions(-) diff --git a/fs/fs.go b/fs/fs.go index 879400c..cf1a875 100644 --- a/fs/fs.go +++ b/fs/fs.go @@ -154,7 +154,8 @@ func (m *Manager) AddPid(subcgroup string, pid int) (retErr error) { for _, dir := range m.paths { path := path.Join(dir, subcgroup) - if !strings.HasPrefix(path, dir) { + // Make sure path is either dir itself or below it. + if path != dir && !strings.HasPrefix(path, dir+"/") { return fmt.Errorf("bad sub cgroup path: %s", subcgroup) } diff --git a/fs2/fs2.go b/fs2/fs2.go index 46819a8..710fb4f 100644 --- a/fs2/fs2.go +++ b/fs2/fs2.go @@ -89,7 +89,8 @@ func (m *Manager) Apply(pid int) error { // a cgroup under under the manager's cgroup. func (m *Manager) AddPid(subcgroup string, pid int) error { path := filepath.Join(m.dirPath, subcgroup) - if !strings.HasPrefix(path, m.dirPath) { + // Make sure path is either m.dirPath itself or below it. + if path != m.dirPath && !strings.HasPrefix(path, m.dirPath+"/") { return fmt.Errorf("bad sub cgroup path: %s", subcgroup) } From 2b02ff9970432ad9523c0763c0115f231d8066c9 Mon Sep 17 00:00:00 2001 From: Kir Kolyshkin Date: Tue, 4 Aug 2026 19:27:43 -0700 Subject: [PATCH 2/2] devices: setV2: add missing O_CLOEXEC Signed-off-by: Kir Kolyshkin --- devices/v2.go | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/devices/v2.go b/devices/v2.go index 508f3dd..1116862 100644 --- a/devices/v2.go +++ b/devices/v2.go @@ -59,7 +59,7 @@ func setV2(dirPath string, r *cgroups.Resources) error { if err != nil { return err } - dirFD, err := unix.Open(dirPath, unix.O_DIRECTORY|unix.O_RDONLY, 0o600) + dirFD, err := unix.Open(dirPath, unix.O_DIRECTORY|unix.O_RDONLY|unix.O_CLOEXEC, 0o600) if err != nil { return fmt.Errorf("cannot get dir FD for %s", dirPath) }