Download Runc Rpm

Specifying configuration options such as volume mounts, memory limits or uid:gid mapping while running a container with docker is as simple as specifying command line options to the docker command. While using runc, these configurations are passed to runc as a file. This configuration file, the runtime-spec, is a configuration standard put in place by the Open Container Initiative (OCI) to specify options for a container and is used by runc[2]. In simpler words, the runtime-spec is a JSON file named config.json consisting of configurations pertaining to a specific container.


To accomplish this, runc uses criu, an open source piece of software which does the actual checkpoint and restore. In order to use runc commands such as checkpoint and restore, you ought to have the criu binary installed on your host system. You can find instruction for installing criu here.



download runc rpm

Download Zip https://t.co/M88i0XuaYS 






The runtime spec, as discussed above, is a set of configuration options stored in a file read by runc to apply configuration before running the container. In docker, you can explicitly set some of the options that you can provide in the runtime-spec. Going through the most common configuration options, you can:


Limit the amount of memory that can be allocated to the processes running under the new cgroup inside the container. For instance, the snippet below will instruct runc to limit the amount of memory available to the container to 2068MB. A value of -1 means unlimited memory.


The vulnerability allows a malicious container to (with minimal user interaction) overwrite the host runc binary and thus gain root-level code execution on the host. The level of user interaction is being able to run any command ... as root within a container in either of these contexts:




An attacker with root access in the container can then use /proc/[runc-pid]/exe as a reference to the runC binary on the host and overwrite it. Root access in the container is required to perform this attack as the runC binary is owned by root.

The next time runC is executed, the attacker will achieve code execution on the host. Since runC is normally run as root (e.g. by the Docker daemon), the attacker will gain root access on the host.


Basically, we cannot overwrite the runC binary while a process is running it. On the other hand, if the runC process exits, /proc/[runc-pid]/exe will vanish and we will lose the reference to the runC binary. To overcome this, we open /proc/[runc-pid]/exe for reading in our process, which creates a file descriptor at /proc/[our-pid]/fd/3.

We then wait for the runC process to exit, and proceed to open /proc/[our-pid]/fd/3 for writing, and overwrite runC.

Here is the code for overwrite_runc, shortened for brevity:






The constructor attribute (a GCC-specific syntax) indicates that the run_at_link function is to be executed as an initialization function [2] for libseccomp after the dynamic linker loads the library into the runC process. Since run_at_link will be executed by the runC process, it can access the runC binary at /proc/self/exe.

The runC process must exit for the runC binary to be writable though. To enforce the exit, run_at_link calls the execve syscall to execute overwrite_runc.


The docker run command executes runC twice. Once to create and run the container, which executes the POC to overwrite runC, and then again to stop the container using runc delete [3].

The second time runC is executed, it is already overwritten, and hence the reverse shell script is executed instead.


Very briefly, runc is the low-level tool which does the heavy lifting of spawning a Linux container. Other tools like Docker, Containerd, and CRI-O sit on top of runc to deal with things like data formatting and serialization, but runc is at the heart of all of these systems.


While full details are still embargoed to give people time to patch, the rough version is that when running a process as root (UID 0) inside a container, that process can exploit a bug in runc to gain root privileges on the host running the container. This then allows them unlimited access to the server as well as any other containers on that server.


Upgrading runc can generally be accomplished by upgrading the package runc for your distribution or by upgrading your OS image if using immutable images. This is a list of known safe versions for various distributions and platforms:


Google has issued a security bulletin with more detailed information but in short, if you are using the default GKE node image then you are safe. If you are using an Ubuntu node image then you will need to mitigate or upgrade to an image with a fixed version of runc.


A hypothetical attack using this security hole would start with an attacker packaging a container image with exploit code. If an admin makes the mistake of deploying this container image using tools like podman run or docker run or through an orchestrator like Kubernetes, then the executable could overwrite the runc command on the host, giving the attacker full access to the host.


Similar attacks are available when users exec into a running exploited container image. This exploit effects any container engines (CRI-O, Podman, Docker, Containerd, Buildah) that use the runc container runtime.


On an SELinux system, container processes are launched as the SELinux type container_t. SELinux policy defines that the only ordinary files container_t types can write to are labeled container_file_t. The default file label of runc is container_runtime_exec_t, which container_t would be denied when attempt is made to write to it.


User namespace could also protect against this exploit, since the process inside of the container while running as root inside of the container, is actually running as non-root outside of the container. Since runc is owned by root, the process would not be allowed to overwrite it.


Note: Podman has the capability to run containers in rootless mode, meaning that root inside of the container is actually running as the UID of the user running Podman. In this case the exploit would not be able to work, since runc would be owned by real root on the system.


The OCI (Open Container Initiative) was thencreated in response to the need for standardization and structured governance. The OCIproject ended up with two specifications - the Runtime Specification(runtime-spec) and the Image Specification (image-spec). Theformer defined a detailed API for the developers of runtimes tofollow. The libcontainer project was donated to OCI and the firststandardized runtime following the runtime-spec was created -runc. It represents a fully compatible API on top of libcontainerallowing users to directly spawn and manage containers.


Today container runtimes are often divided into two categories -low-level (runc, gVisor, Firecracker) and high-level (containerd,Docker, CRI-O, podman). The difference is in the amount of consumedOCI specification and additional features.


There are other more high-level runtimes, like Docker andContainerd, which implement this specification on top of runc. By doing so, they solve several disadvantages related to the usage of runc alone namely - image integrity, bundle history log and efficient container root file system usage. Be prepared, weare going to look into these more evaluated runtimes in the nextarticle !


As mentioned above, runc is an OCI compliant runtime - asoftware component responsible for the creation, configuration andmanagement of isolated Linux processes also called containers. Formally, runc is a client wrapper around libcontainer. As runc follows the OCI specification for container runtimes it requires two pieces of information:


Almost everything is ready. We have one last detail to take care of:since we would like to detach our root container from runc and itsfile descriptors to interact with it, we have to create a TTY socketand connect to it from both sides (from the container side and from ourterminal). We are going to userecvttywhich is part of the official runc project.


Now we have configured a virtual interface and connected the networknamespace of the runc init process with the host network namespace.This configuration is not mandatory and the container process executinga sh shell could be started without any connection to the host.However, this configuration can be useful for other processes deliveringnetwork functionalities. The sh program is still not running insidethe process as desired. After the configuration is done, one can finallyspawn the container running the predefined program.


For those familiar with other container technologies, this terminal isfamiliar ;). Okay runc is really cool but what more can we do with it?Well, pretty much anything concerning the life management of thiscontainer.


Checkpointing is another interesting feature of runc. It allows you tosnapshot the current state of a container (in RAM) and save it as a set of files.This state includes open file descriptors, memory content (pages inRAM) registers, mount points, etc.The process can be later resumed from this saved state. This can be really useful when onewants to transport a container from one host to another without losingits internal state (live migration). This feature can also be useful to reverse the process to a stable state (debugging). Runc does the checkpointing with the help of thecriu software. However, the latter doesnot come out of the box with runc and has to be installed separatelyand added to /usr/local/sbin in order to work properly. To illustratethe checkpointing we are going to stop a printer process and resume itafterwards. The config.json file will contain this:


The new container sleep process has indeed inherited the samenamespaces as the shell process already inside the container. The sameapplies for other things such as capabilities, cwd, etc. These can be changedwith the help of runc.


The runtime also allows to modify on the fly the resource limits interms of cgroups. This can be really useful for scaling and improvingperformance but also for degradation of performances/denial ofserviceof programs sharing or depending hierarchically on the set of cgroups ofa current process. By default runc creates a sub-cgroup of the root oneunder /sys/fs/cgroup/user.slice/. For this paragraph we are going torun in the container the following program:

 f448fe82f3