Path Safety in the Trenches
summary
Walks through concrete fixes for filesystem confused‑deputy bugs that produced CVE-2025-31133, CVE-2025-52565 and CVE-2025-52881, showing a migration of runc’s codebase to file-descriptor semantics and a Rust/C Go library stack that works in practice. Uses openat2 and resolve_beneath (with open_tree/fsopen fallbacks) to block races and overmount attacks, audits special device major/minor checks, and ships libpathrs / pathrs-light as the practical helper; new mount API makes the final design race-free on modern kernels but legacy fallbacks remain required.
AI-written summary · about
chapters (11)
- 0:00Introduction to runC
- 1:42Regular path safety
- 6:27Legacy and library solutions
- 9:02Strict path safety
- 10:54Hardening with mount APIs
- 14:08Threat models in runC
- 17:23Vulnerability case studies
- 20:59Advanced mount attacks
- 23:28Future work and kernel needs
- 27:08AppArmor and side effects
- 30:10Symlink issues and Q&A
related talks
39mSecure Path Operations and Libpathrs
30mPathless First: Redefining Runc Container Security Against ProcFS-Based Attacks
29mSecuring Container Runtimes -- How Hard Can It Be?
45mSecuring Container Runtimes -- How Hard Can It Be?
19mCounterexamples in Safe Rust
15mUnsafe at Any Copy: Name Collisions from Mixing Case Sensitivities
45mMaking Containers Safer
34mExploiting a Slightly Peculiar Volume Configuration with SIG-Honk