Container detection misses LXC/Incus and other systemd-managed containers; host-only rules and their remediations run inside the guest

Abierto Apto para principiantes
  • ¿Algo no está bien?
#15,316 0 comentarios 0 reacciones 0 asignados Ver en GitHub

Los mantenedores suelen responder en 2 días

Nadie ha tomado este issue todavía.

Evaluación

Dificultad
2/5
Tiempo estimado
1-3 horas
Aptitud para principiantes
74/100
Tipo de issue
Error
Claridad
Bien especificado
Estado de actividad
Activo
Stack tecnológico
ansible, linux, shell
Área
security, testing

Línea de trabajo

Empieza por shared/applicability/oval/installed_env_is_a_container.xml y las definiciones de bash_conditional en shared/applicability/container.yml y machine.yml. Compara sus comprobaciones actuales con la detección de LXC que ya utilizan las condiciones de Ansible y, después, añade de forma coherente la comprobación propuesta de /run/systemd/container. El objetivo se cumple cuando tanto OVAL como las comprobaciones de Bash detectan los huéspedes LXC como contenedores, de modo que las reglas exclusivas del host no sean aplicables y sus correcciones no se ejecuten dentro del huésped.

Escrito por el modelo de indexación a partir del texto del issue.

Descripción

Description of problem:

The applicability check installed_env_is_a_container (and its negation installed_env_is_a_machine) only looks for /.dockerenv and /run/.containerenv. LXC/Incus system containers create neither file, so an LXC guest is classified as machine (bare metal or VM).

This contradicts the Ansible side of the same platforms. ansible_conditional in shared/applicability/container.yml and machine.yml already counts lxc (and openvz) as a container. Only the OVAL check and bash_conditional miss it.

Impact on a Debian 13 guest in an unprivileged LXC, profile cis_level1_server:

  • Eight rules gated by machine, not_container or not_bootc_and_not_container are evaluated and fail. None of them can be fixed inside the guest, because AppArmor, /dev/shm and the partition layout are owned by the host:
    grub2_enable_apparmor, package_apparmor_installed, package_apparmor-utils_installed, sysctl_reapply_after_network, mount_option_dev_shm_nodev, mount_option_dev_shm_noexec, mount_option_dev_shm_nosuid, partition_for_tmp
  • The bash remediations use the same file-based conditional, so they do run inside the container and damage it:
    • sysctl_reapply_after_network installs sysctl-reapply-network.service running sysctl --system. In an unprivileged container the kernel.*, fs.* and vm.* keys are read-only, so the unit always exits non-zero and the system ends up degraded.
    • The /tmp mount-option remediation writes /etc/systemd/system/tmp.mount.d/mount_options.conf from the currently active options. In an idmapped unprivileged container these include uid=100000,gid=100000 (the host-side ID of container root). tmp.mount then fails with tmpfs: Invalid uid '100000', and /tmp is no longer mounted after the next boot.
SCAP Security Guide Version:

0.1.82 (ssg-debian13-ds.xml). The applicability sources are unchanged on master (checked at bb706dd, 2026-11-06).

Operating System Version:

Debian 13.7 (trixie), systemd 257.13, OpenSCAP 1.4.2. The guest is an unprivileged LXC on Proxmox VE (host kernel 7.0.14-22-pve).

Steps to Reproduce:
  1. Start any Debian 13 unprivileged LXC/Incus guest with systemd as PID 1.
  2. Observe: systemd-detect-virt → lxc, cat /run/systemd/container → lxc. Neither /.dockerenv nor /run/.containerenv exists.
  3. oscap xccdf eval --profile xccdf_org.ssgproject.content_profile_cis_level1_server --results results.xml ssg-debian13-ds.xml
  4. Generate and run the bash remediation for sysctl_reapply_after_network, or for the /tmp mount options.
Actual Results:

The guest is classified as machine. The eight host-only rules above fail, and their remediations run and break the guest (failed unit, /tmp not mounted).

Expected Results:

The guest is classified as a container, as the Ansible conditionals already do. Host-only rules are notapplicable, and the bash remediations print Remediation is not applicable, nothing was done.

Additional Information/Debugging Steps:

Proposed fix: systemd's PID 1 writes /run/systemd/container whenever the container manager sets the container= environment variable (write_container_id() in src/core/main.c). LXC, Incus/LXD, systemd-nspawn and Podman all set it. One more criterion would therefore cover every systemd-based container:

  • OVAL (shared/applicability/oval/installed_env_is_a_container.xml): a third file_test with check_existence="all_exist" for /run/systemd/container, OR-ed with the existing two.
  • bash_conditional in container.yml: [ -f /.dockerenv ] || [ -f /run/.containerenv ] || [ -f /run/systemd/container ], and the negated form in machine.yml.

Guests without systemd still expose container= in /proc/1/environ, which could be added later if wanted.

With LXC recognised as a container, a second gap becomes the dominant one: system_with_kernel switches off most userspace rules in system containers. I filed that separately as a proposal: #15317.

I'm happy to open a PR for the detection fix.

Lenguaje dominante
Shell
Estrellas
2.8k
Forks
847
Merge medio
3 d 10 h
PR fusionados (30 d)
81

Preparar el entorno

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de ComplianceAsCode/content

Todos los issues de ComplianceAsCode/content

Issues similares

Más issues de Shell/Bash

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.