runc is a CLI tool for spawning and running containers according to the OCI specification. It was found that AppArmor can be bypassed when /proc
inside the container is symlinked with a specific mount configuration. This issue has been fixed in runc version 1.1.5, by prohibiting symlinked /proc
. See PR #3785 for details. users are advised to upgrade. Users unable to upgrade should avoid using an untrusted container image.
{ "availability": "Available with Ubuntu Pro: https://ubuntu.com/pro", "ubuntu_priority": "medium", "binaries": [ { "runc": "1.0.0~rc7+git20190403.029124da-0ubuntu1~16.04.4+esm4", "runc-dbgsym": "1.0.0~rc7+git20190403.029124da-0ubuntu1~16.04.4+esm4", "golang-github-opencontainers-runc-dev": "1.0.0~rc7+git20190403.029124da-0ubuntu1~16.04.4+esm4" } ] }