Uploaded image for project: 'FreePBX'
  1. FreePBX
  2. FREEPBX-19588

Firewall doesn't understand container restrictions

    XMLWordPrintable

    Details

    • Type: Bug
    • Status: Open
    • Priority: Minor
    • Resolution: Unresolved
    • Affects Version/s: None
    • Fix Version/s: 13
    • Component/s: Firewall
    • Labels:
      None
    • ToDo:

      Description

      Docker now masks access to /proc/timer_list, which means that the file is VISIBLE, but is not accessible - see https://github.com/moby/moby/pull/25630

      This causes this to happen:

      
      root@lxc-01:~# lxc launch c7 centos7-test
      Creating centos7-test
      Starting centos7-test
      root@lxc-01:~# lxc exec centos7-test bash
      [root@centos7-test ~]# ls -al /proc/timer_list
      -r-------- 1 65534 65534 0 Mar  3 21:10 /proc/timer_list
      [root@centos7-test ~]# id
      uid=0(root) gid=0(root) groups=0(root)
      [root@centos7-test ~]# cat /proc/timer_list
      cat: /proc/timer_list: Permission denied
      [root@centos7-test ~]#
      

      The current test in firewall only tests if the file exists, not if the file contains valid information.

      This simply requires the exception be changed to a 'return 0' (this is a single line change)

      https://github.com/xrobau/firewall/commit/6d8c69c2ed52d083f88674fea02efa070cc9caad

      I have created and signed a test package as proof that this works, which is attached. This is NOT the final result, as the times are still off, and the Ratelimit vs Blocked page is not accurate, because firewall can't tell how old the packets are, but this at least solves the primary issue of the status page crashing.

        Gliffy Diagrams

          Attachments

            Activity

              People

              • Assignee:
                Unassigned
                Reporter:
                xrobau Rob Thomas
              • Votes:
                0 Vote for this issue
                Watchers:
                2 Start watching this issue

                Dates

                • Created:
                  Updated:

                  NextupJiraPlusStatus

                  Error rendering 'slack.nextup.jira:nextup-jira-plus-status'. Please contact your Jira administrators.