Possible DoS via dbus socket available in containers

[Cédric Jeanneret]

Hello there,

This is the upstream version of a Red Hat Bugzilla[0], as a summary of the investigations and state.
Red Hat is asking for a CVE number and considers this issue as "Moderate CVE" - since it's, for now, private on the Bugzilla, I set it to private here as well.

Report content:
Since [1], container_t is allowed to send messages to the host DBus service. This is linked to rhbz#1738134.

This can lead to a denial of service (DoS) if a rogue user can talk to the DBus socket from a compromised container. This is true for every container with /run or /var/run bind-mounted from the host. Neither root or sudo are needed within the container.

We should revert asap that patch, and put to use the newly created log as per:
Master/ussuri
- https://review.opendev.org/699216
- https://review.opendev.org/699226
- https://review.opendev.org/699215
Train:
- https://review.opendev.org/701186
- https://review.opendev.org/701187
Stein:
- https://review.opendev.org/701523
- https://review.opendev.org/701561 (yet to be merged)

If we revert that patch already, it will break the metrics for the healthchecks until the provided logfile is used instead of "journalctl" calls - Not sure about the real impact, especially for osp-15 (how many customers are actually running prod on it, with metrics and all), but it might be worth the breakage, compared to the security risk...

Please note than the listed changes are NOT sufficient - collectd|sensu must update their configuration/script in order to use the new log - this change is not yet available, and is in the hand of the Metric/Monitoring Team (CloudOps).

Cheers,

C.

[0] https://bugzilla.redhat.com/show_bug.cgi?id=1788561
[1] https://github.com/redhat-openstack/openstack-selinux/commit/66e8a6f7313b5fbe9954396960e05f35f62c4e5c

[Summer Long (slong-g)]

CVE-2020-1690 has been assigned to this issue.