[PATCH] Do not set DOCKER_TMP to be owned by remapped root
authorBrian Goff <cpuguy83@gmail.com>
Tue, 6 Oct 2020 19:40:30 +0000 (19:40 +0000)
committerFelix Geyer <fgeyer@debian.org>
Sun, 21 Feb 2021 17:18:35 +0000 (17:18 +0000)
commit9b1938a59a146ddd8f7a3a0f541a0955229c1b02
tree92fbfcf5500695b6b141cce902a45bdf68ce9863
parent7c9e85c6d9e1036aa5469e74072c20c03fe0ffe9
[PATCH] Do not set DOCKER_TMP to be owned by remapped root

The remapped root does not need access to this dir.
Having this owned by the remapped root opens the host up to an
uprivileged user on the host being able to escalate privileges.

While it would not be normal for the remapped UID to be used outside of
the container context, it could happen.

Signed-off-by: Brian Goff <cpuguy83@gmail.com>
(cherry picked from commit bfedd2725971303efb7a2fe5d6990317b381622f)
Signed-off-by: Tibor Vass <tibor@docker.com>
Gbp-Pq: Name cve-2021-21284-2.patch
engine/daemon/daemon.go