ESR-01-010 WP1: Host stdin/out/err File descriptors Accessible by Container Container IO refactoring
flxo opened this issue · comments
Cure53 confirmed in the code of the northstar-0.6.0 repository that Northstar inherits stdin/out/err for the container. While inheriting file descriptors is not a problem per se, Northstar directly passes the host stdin/out/err file descriptors to the container init.
As a consequence, the container can take control over the terminal of the host-side where the Northstar binary has been started. Beside writing to the terminal, it can also inject input and cause a break out in a worst-case scenario.
Fixed by #777