Commit `7d675c19a7`

7d675c19a78fa24a9d80cc1a45e39348d193b8f6

parent: 42d56acf6e

Verified · cmc ci/build: success ci/test: failure

cmc <hello@cleberg.net> · 2026-09-07 01:27 UTC

deploy, wiki: ProtectKernelTunables=no so a container can mount proc

The flag overmounts /proc in the unit's namespace and the kernel then
refuses a fresh proc mount in any child user namespace. The container
masks the same paths for the build.

Ref #144

Layout: unified · split

.gitbay/wiki/Threat-Model.org +7 −3

   repository is trusted; there is no automatic fallback to it — a runner
   configured for podman that cannot find one refuses to start, because
   dropping isolation silently is worse than a stopped runner. The
-  systemd drop-in still adds =ProtectSystem=full= and the kernel and
+  systemd drop-in still adds =ProtectSystem=full= and the cgroup
-  cgroup protections, and =-repos= still limits a runner to named
+  protections, and =-repos= still limits a runner to named
-  repositories. =NoNewPrivileges= is *off*: rootless podman sets up its
+  repositories. =ProtectKernelTunables= is *off*: it overmounts =/proc=
+  in the unit's namespace and the kernel then refuses a proc mount in
+  any child user namespace, which every rootless container needs; the
+  container masks the same paths for the build itself.
+  =NoNewPrivileges= is *off*: rootless podman sets up its
   namespace with the setuid =newuidmap=, which that flag blocks, so the
   choice is between it and containers at all. Containers are the stronger
   boundary — the flag constrained a process that was already running

deploy/gitbay-runner.override.conf +9 −1

	@@ -60,7 +60,15 @@ IOWeight=30
60	# yes. Set it back if you run that way.	60	# yes. Set it back if you run that way.
61	NoNewPrivileges=no	61	NoNewPrivileges=no
62	ProtectSystem=full	62	ProtectSystem=full
63	ProtectKernelTunables=yes	63	# ProtectKernelTunables is off, for the same reason NoNewPrivileges is
		64	# (#144). It overmounts /proc/sys and friends in this unit's namespace,
		65	# and the kernel then refuses a fresh proc mount in any child user
		66	# namespace ("mount too revealing"): crun fails with "mount `proc` to
		67	# `proc`: Operation not permitted". There is no podman setting for it.
		68	# What the flag protected — /proc/sys from a build running on the host
		69	# as this user — the container now covers: a build gets its own proc,
		70	# with those paths masked by the runtime. Under -isolation none, set it
		71	# back to yes.
64	ProtectControlGroups=yes	72	ProtectControlGroups=yes
65	RestrictSUIDSGID=yes	73	RestrictSUIDSGID=yes
66	Delegate=yes	74	Delegate=yes

Commit 7d675c19a7

Commit `7d675c19a7`