From 435cc81be6b79cdec73b4002c0dae549b2f6ae6d Mon Sep 17 00:00:00 2001 From: Aleksa Sarai Date: Fri, 18 Jul 2025 15:33:56 +1000 Subject: [PATCH] init: use securejoin for /proc/self/setgroups Signed-off-by: Aleksa Sarai --- libcontainer/init_linux.go | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/libcontainer/init_linux.go b/libcontainer/init_linux.go index 9672b037a..31166170e 100644 --- a/libcontainer/init_linux.go +++ b/libcontainer/init_linux.go @@ -5,6 +5,7 @@ import ( "encoding/json" "errors" "fmt" + "io" "net" "os" "path/filepath" @@ -21,6 +22,7 @@ import ( "github.com/opencontainers/cgroups" "github.com/opencontainers/runc/internal/linux" + "github.com/opencontainers/runc/internal/pathrs" "github.com/opencontainers/runc/libcontainer/capabilities" "github.com/opencontainers/runc/libcontainer/configs" "github.com/opencontainers/runc/libcontainer/system" @@ -470,7 +472,12 @@ func setupUser(config *initConfig) error { // We don't need to use /proc/thread-self here because setgroups is a // per-userns file and thus is global to all threads in a thread-group. // This lets us avoid having to do runtime.LockOSThread. - setgroups, err := os.ReadFile("/proc/self/setgroups") + var setgroups []byte + setgroupsFile, err := pathrs.ProcSelfOpen("setgroups", unix.O_RDONLY) + if err == nil { + setgroups, err = io.ReadAll(setgroupsFile) + _ = setgroupsFile.Close() + } if err != nil && !os.IsNotExist(err) { return err }