Container detection misses LXC/Incus and other systemd-managed containers; host-only rules and their remediations run inside the guest

オープン 初心者向け
  • 何か問題がありますか？
#15,316 コメント 0 件 リアクション 0 件 担当者 0 名 GitHub で見る

メンテナーはふだん 2 日以内に返信

まだ誰も着手していません。

評価

難易度
2/5
見積もり時間
1〜3時間
初心者へのやさしさ
74/100
issue の種類
バグ
明瞭さ
明確に書かれている
活発さ
活発
技術スタック
ansible, linux, shell
領域
security, testing

調査の方向性

shared/applicability/oval/installed_env_is_a_container.xml と、shared/applicability/container.yml および machine.yml の bash_conditional 定義から始めてください。現在のチェックを、Ansible の条件ですでに使われている LXC 検出と比較し、提案されている /run/systemd/container のチェックを一貫して追加してください。OVAL と Bash の両方のチェックで LXC ゲストがコンテナーとして検出され、ホスト専用ルールが適用対象外となり、その修正がゲスト内で実行されない状態になれば完了です。

索引モデルが issue の本文から書いたものです。

説明

Description of problem:

The applicability check installed_env_is_a_container (and its negation installed_env_is_a_machine) only looks for /.dockerenv and /run/.containerenv. LXC/Incus system containers create neither file, so an LXC guest is classified as machine (bare metal or VM).

This contradicts the Ansible side of the same platforms. ansible_conditional in shared/applicability/container.yml and machine.yml already counts lxc (and openvz) as a container. Only the OVAL check and bash_conditional miss it.

Impact on a Debian 13 guest in an unprivileged LXC, profile cis_level1_server:

  • Eight rules gated by machine, not_container or not_bootc_and_not_container are evaluated and fail. None of them can be fixed inside the guest, because AppArmor, /dev/shm and the partition layout are owned by the host:
    grub2_enable_apparmor, package_apparmor_installed, package_apparmor-utils_installed, sysctl_reapply_after_network, mount_option_dev_shm_nodev, mount_option_dev_shm_noexec, mount_option_dev_shm_nosuid, partition_for_tmp
  • The bash remediations use the same file-based conditional, so they do run inside the container and damage it:
    • sysctl_reapply_after_network installs sysctl-reapply-network.service running sysctl --system. In an unprivileged container the kernel.*, fs.* and vm.* keys are read-only, so the unit always exits non-zero and the system ends up degraded.
    • The /tmp mount-option remediation writes /etc/systemd/system/tmp.mount.d/mount_options.conf from the currently active options. In an idmapped unprivileged container these include uid=100000,gid=100000 (the host-side ID of container root). tmp.mount then fails with tmpfs: Invalid uid '100000', and /tmp is no longer mounted after the next boot.
SCAP Security Guide Version:

0.1.82 (ssg-debian13-ds.xml). The applicability sources are unchanged on master (checked at bb706dd, 2026-11-06).

Operating System Version:

Debian 13.7 (trixie), systemd 257.13, OpenSCAP 1.4.2. The guest is an unprivileged LXC on Proxmox VE (host kernel 7.0.14-22-pve).

Steps to Reproduce:
  1. Start any Debian 13 unprivileged LXC/Incus guest with systemd as PID 1.
  2. Observe: systemd-detect-virt → lxc, cat /run/systemd/container → lxc. Neither /.dockerenv nor /run/.containerenv exists.
  3. oscap xccdf eval --profile xccdf_org.ssgproject.content_profile_cis_level1_server --results results.xml ssg-debian13-ds.xml
  4. Generate and run the bash remediation for sysctl_reapply_after_network, or for the /tmp mount options.
Actual Results:

The guest is classified as machine. The eight host-only rules above fail, and their remediations run and break the guest (failed unit, /tmp not mounted).

Expected Results:

The guest is classified as a container, as the Ansible conditionals already do. Host-only rules are notapplicable, and the bash remediations print Remediation is not applicable, nothing was done.

Additional Information/Debugging Steps:

Proposed fix: systemd's PID 1 writes /run/systemd/container whenever the container manager sets the container= environment variable (write_container_id() in src/core/main.c). LXC, Incus/LXD, systemd-nspawn and Podman all set it. One more criterion would therefore cover every systemd-based container:

  • OVAL (shared/applicability/oval/installed_env_is_a_container.xml): a third file_test with check_existence="all_exist" for /run/systemd/container, OR-ed with the existing two.
  • bash_conditional in container.yml: [ -f /.dockerenv ] || [ -f /run/.containerenv ] || [ -f /run/systemd/container ], and the negated form in machine.yml.

Guests without systemd still expose container= in /proc/1/environ, which could be added later if wanted.

With LXC recognised as a container, a second gap becomes the dominant one: system_with_kernel switches off most userspace rules in system containers. I filed that separately as a proposal: #15317.

I'm happy to open a PR for the detection fix.

主要言語
Shell
スター
2.8k
フォーク
847
平均マージ
3日 10時間
マージ済み PR（30日）
81

環境構築

はじめの一歩

  1. issue を最後まで読み、次にプロジェクトのコントリビューションガイドを読みます。
  2. 着手することを issue にコメントします — 二人が同じ作業をするのを防げます。
  3. リポジトリをフォークし、ブランチを切って変更します。
  4. issue 番号を参照したプルリクエストを送ります。

ComplianceAsCode/content のほかの issue

ComplianceAsCode/content の issue をすべて見る

似ている issue

Shell/Bash の issue をもっと見る

新しい issue をメールで受け取る

初心者向けの GitHub issue を短くまとめたダイジェスト。