Commit `7d675c19a7`

7d675c19a78fa24a9d80cc1a45e39348d193b8f6

parent: 42d56acf6e

Verified · cmc ci/build: success ci/test: failure

cmc <hello@cleberg.net> · 2026-09-07 01:27 UTC

deploy, wiki: ProtectKernelTunables=no so a container can mount proc

The flag overmounts /proc in the unit's namespace and the kernel then
refuses a fresh proc mount in any child user namespace. The container
masks the same paths for the build.

Ref #144

Layout: unified · split

.gitbay/wiki/Threat-Model.org +7 −3

		@@ -145,9 +145,13 @@ runner, polling over SSH, clones the commit and runs its steps.
145	145	repository is trusted; there is no automatic fallback to it — a runner
146	146	configured for podman that cannot find one refuses to start, because
147	147	dropping isolation silently is worse than a stopped runner. The
148		systemd drop-in still adds =ProtectSystem=full= and the kernel and
149		cgroup protections, and =-repos= still limits a runner to named
150		repositories. =NoNewPrivileges= is off: rootless podman sets up its
	148	systemd drop-in still adds =ProtectSystem=full= and the cgroup
	149	protections, and =-repos= still limits a runner to named
	150	repositories. =ProtectKernelTunables= is off: it overmounts =/proc=
	151	in the unit's namespace and the kernel then refuses a proc mount in
	152	any child user namespace, which every rootless container needs; the
	153	container masks the same paths for the build itself.
	154	=NoNewPrivileges= is off: rootless podman sets up its
151	155	namespace with the setuid =newuidmap=, which that flag blocks, so the
152	156	choice is between it and containers at all. Containers are the stronger
153	157	boundary — the flag constrained a process that was already running

deploy/gitbay-runner.override.conf +9 −1

		@@ -60,7 +60,15 @@ IOWeight=30
60	60	# yes. Set it back if you run that way.
61	61	NoNewPrivileges=no
62	62	ProtectSystem=full
63		ProtectKernelTunables=yes
	63	# ProtectKernelTunables is off, for the same reason NoNewPrivileges is
	64	# (#144). It overmounts /proc/sys and friends in this unit's namespace,
	65	# and the kernel then refuses a fresh proc mount in any child user
	66	# namespace ("mount too revealing"): crun fails with "mount `proc` to
	67	# `proc`: Operation not permitted". There is no podman setting for it.
	68	# What the flag protected — /proc/sys from a build running on the host
	69	# as this user — the container now covers: a build gets its own proc,
	70	# with those paths masked by the runtime. Under -isolation none, set it
	71	# back to yes.
64	72	ProtectControlGroups=yes
65	73	RestrictSUIDSGID=yes
66	74	Delegate=yes

Commit 7d675c19a7

Commit `7d675c19a7`