Container detection misses LXC/Incus and other systemd-managed containers; host-only rules and their remediations run inside the guest

Aperta Adatta ai principianti
  • Qualcosa non va?
#15,316 0 commenti 0 reazioni 0 assegnatari Vedi su GitHub

I maintainer di solito rispondono entro 2 giorni

Nessuno ha ancora preso questa issue.

Valutazione

Difficoltà
2/5
Tempo stimato
1-3 ore
Idoneità per principianti
74/100
Tipo di issue
Bug
Chiarezza
Specificata chiaramente
Stato di attività
Attiva
Stack tecnologico
ansible, linux, shell
Ambito
security, testing

Direzione di ricerca

Inizia da shared/applicability/oval/installed_env_is_a_container.xml e dalle definizioni di bash_conditional in shared/applicability/container.yml e machine.yml. Confronta i controlli attuali con il rilevamento di LXC già utilizzato dalle condizioni Ansible, quindi aggiungi in modo coerente il controllo proposto di /run/systemd/container. Il lavoro è completato quando sia OVAL sia i controlli Bash rilevano gli ospiti LXC come container, così che le regole riservate all’host non siano applicabili e le relative correzioni non vengano eseguite all’interno dell’ospite.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

Description of problem:

The applicability check installed_env_is_a_container (and its negation installed_env_is_a_machine) only looks for /.dockerenv and /run/.containerenv. LXC/Incus system containers create neither file, so an LXC guest is classified as machine (bare metal or VM).

This contradicts the Ansible side of the same platforms. ansible_conditional in shared/applicability/container.yml and machine.yml already counts lxc (and openvz) as a container. Only the OVAL check and bash_conditional miss it.

Impact on a Debian 13 guest in an unprivileged LXC, profile cis_level1_server:

  • Eight rules gated by machine, not_container or not_bootc_and_not_container are evaluated and fail. None of them can be fixed inside the guest, because AppArmor, /dev/shm and the partition layout are owned by the host:
    grub2_enable_apparmor, package_apparmor_installed, package_apparmor-utils_installed, sysctl_reapply_after_network, mount_option_dev_shm_nodev, mount_option_dev_shm_noexec, mount_option_dev_shm_nosuid, partition_for_tmp
  • The bash remediations use the same file-based conditional, so they do run inside the container and damage it:
    • sysctl_reapply_after_network installs sysctl-reapply-network.service running sysctl --system. In an unprivileged container the kernel.*, fs.* and vm.* keys are read-only, so the unit always exits non-zero and the system ends up degraded.
    • The /tmp mount-option remediation writes /etc/systemd/system/tmp.mount.d/mount_options.conf from the currently active options. In an idmapped unprivileged container these include uid=100000,gid=100000 (the host-side ID of container root). tmp.mount then fails with tmpfs: Invalid uid '100000', and /tmp is no longer mounted after the next boot.
SCAP Security Guide Version:

0.1.82 (ssg-debian13-ds.xml). The applicability sources are unchanged on master (checked at bb706dd, 2026-11-06).

Operating System Version:

Debian 13.7 (trixie), systemd 257.13, OpenSCAP 1.4.2. The guest is an unprivileged LXC on Proxmox VE (host kernel 7.0.14-22-pve).

Steps to Reproduce:
  1. Start any Debian 13 unprivileged LXC/Incus guest with systemd as PID 1.
  2. Observe: systemd-detect-virt → lxc, cat /run/systemd/container → lxc. Neither /.dockerenv nor /run/.containerenv exists.
  3. oscap xccdf eval --profile xccdf_org.ssgproject.content_profile_cis_level1_server --results results.xml ssg-debian13-ds.xml
  4. Generate and run the bash remediation for sysctl_reapply_after_network, or for the /tmp mount options.
Actual Results:

The guest is classified as machine. The eight host-only rules above fail, and their remediations run and break the guest (failed unit, /tmp not mounted).

Expected Results:

The guest is classified as a container, as the Ansible conditionals already do. Host-only rules are notapplicable, and the bash remediations print Remediation is not applicable, nothing was done.

Additional Information/Debugging Steps:

Proposed fix: systemd's PID 1 writes /run/systemd/container whenever the container manager sets the container= environment variable (write_container_id() in src/core/main.c). LXC, Incus/LXD, systemd-nspawn and Podman all set it. One more criterion would therefore cover every systemd-based container:

  • OVAL (shared/applicability/oval/installed_env_is_a_container.xml): a third file_test with check_existence="all_exist" for /run/systemd/container, OR-ed with the existing two.
  • bash_conditional in container.yml: [ -f /.dockerenv ] || [ -f /run/.containerenv ] || [ -f /run/systemd/container ], and the negated form in machine.yml.

Guests without systemd still expose container= in /proc/1/environ, which could be added later if wanted.

With LXC recognised as a container, a second gap becomes the dominant one: system_with_kernel switches off most userspace rules in system containers. I filed that separately as a proposal: #15317.

I'm happy to open a PR for the detection fix.

Lingua principale
Shell
Stelle
2.8k
Fork
847
Merge medio
3g 10h
PR unite (30g)
81

Preparare l'ambiente

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di ComplianceAsCode/content

Tutte le issue di ComplianceAsCode/content

Issue simili

Altre issue su Shell/Bash

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.