Running at rev 8803834036205cf2cac5cfca98bb3875812c897a.
Inside a guest, both /proc/sys/fs/protected_hardlinks and /proc/sys/fs/protected_symlinks read 0, and /, /workspace and the agent state directories all sit on one device.
That means an unprivileged guest process can hardlink a root-owned file it cannot write into a directory it controls. Any later root-run recursive chown over that directory then hands it ownership of the original inode. We hit this concretely: a uid-1000 process could link a read-only, root-owned instruction file into a writable path.
Debian sets both to 1 via /etc/sysctl.d, which a microVM init does not apply. Setting them in the guest kernel would close the class for anything running as root in a cell, rather than each caller having to scope its own recursive operations.
Running at rev
8803834036205cf2cac5cfca98bb3875812c897a.Inside a guest, both
/proc/sys/fs/protected_hardlinksand/proc/sys/fs/protected_symlinksread0, and/,/workspaceand the agent state directories all sit on one device.That means an unprivileged guest process can hardlink a root-owned file it cannot write into a directory it controls. Any later root-run recursive
chownover that directory then hands it ownership of the original inode. We hit this concretely: a uid-1000 process could link a read-only, root-owned instruction file into a writable path.Debian sets both to 1 via
/etc/sysctl.d, which a microVM init does not apply. Setting them in the guest kernel would close the class for anything running as root in a cell, rather than each caller having to scope its own recursive operations.