tree a15693ceaa8e599ad32b381aea4b5b128a94af62
parent e32fc16daa20c087eae4e7d4b16a79725a430108
author Jonathan A. Schweder <jonathanschweder@gmail.com> 1543536202 -0200
committer Sebastiaan van Stijn <github@gone.nl> 1543586271 +0100
gpgsig -----BEGIN PGP SIGNATURE-----
 
 iQIcBAABAgAGBQJcAUHfAAoJEHZpjznVJ86MHokP/1JwMKBXSyD3nmVsVV55+gRV
 7xRioqP5HISxblRKQGxbfOgWJeMqYaMaVAJ+4Z/UW4gCTw1UOwLYQCvF+oLN6X6d
 ehoRGCG8VVVRCOOhjEYWO2TwLd8QiMLAAL3dGJ6xnduI+trB9DBwqgRJiXKTfygJ
 RfTzRLx2dF1zOfsJ52V0YVy2BV3FiWoD1RSygcdnYbTwVsuU1Ji7ofb+65MHWyCM
 lKLk1lTGKIuzL9A7LekprC7FKVYybfKfTxtQuHe7yeBWsjBxMa8oTzpwpMg7Avq0
 c9D/eNxe4gg06wfPU+ZV8TuytxeVv2c3MgpyFKG3qLH3R4K4BJFPzySoLqjAzb+r
 IXD1ZYoTdFfKEOKlx5ykcN+EeQtxwR1ABs5idrt6LDu5bYQ/JFtBPyN1b77Z8ZVA
 5tPOd92FBSnEQ+AyrJ3MAD/6RpfUYYFJe5CFhUHf9EsMlfTWJnHqvH1TddOjxg+h
 n6l/rErVt9fUoRaDGFAEF+9Mg/tu+g26vGjEihmXi/u1w+iCYzROk9YYu6/IsKD1
 oMEe+YukaajaPKHMoAD9P27ya4snMl5OoOdbpToHiNw7FjQTtJe6IyvrOrmeakHD
 SVt+KZ7+mkaap5gKv2vqY4ICHjq2xBejxklh4EqV66ii8VnTF1D4oRoD4jCLoIk+
 k7sqQXG1FkbYnH8o/MC9
 =SHJn
 -----END PGP SIGNATURE-----

Masked /proc/asound

@sw-pschmied originally post this in #38285

While looking through the Moby source code was found /proc/asound to be
shared with containers as read-only (as defined in
https://github.com/moby/moby/blob/master/oci/defaults.go#L128).

This can lead to two information leaks.

---

**Leak of media playback status of the host**

Steps to reproduce the issue:

 - Listen to music/Play a YouTube video/Do anything else that involves
sound output
 - Execute docker run --rm ubuntu:latest bash -c "sleep 7; cat
/proc/asound/card*/pcm*p/sub*/status | grep state | cut -d ' ' -f2 |
grep RUNNING || echo 'not running'"
 - See that the containerized process is able to check whether someone
on the host is playing music as it prints RUNNING
 - Stop the music output
 - Execute the command again (The sleep is delaying the output because
information regarding playback status isn't propagated instantly)
 - See that it outputs not running

**Describe the results you received:**

A containerized process is able to gather information on the playback
status of an audio device governed by the host. Therefore a process of a
container is able to check whether and what kind of user activity is
present on the host system. Also, this may indicate whether a container
runs on a desktop system or a server as media playback rarely happens on
server systems.

The description above is in regard to media playback - when examining
`/proc/asound/card*/pcm*c/sub*/status` (`pcm*c` instead of `pcm*p`) this
can also leak information regarding capturing sound, as in recording
audio or making calls on the host system.

Signed-off-by: Jonathan A. Schweder <jonathanschweder@gmail.com>

(cherry picked from commit 64e52ff3dbdb31adc0a9930b3ea74b04b0df8d86)

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>