daenamnu/nextcloud
1
0
Fork 0
mirror of https://github.com/nextcloud/all-in-one.git synced 2026-07-21 21:52:53 +00:00
Code Issues Packages Projects Releases Wiki Activity

Improve docker socket proxy config (#8458)

Browse Source
This commit is contained in:
Pablo Zmdl
2026-07-17 11:57:37 +02:00
committed by GitHub
parent a36d46987d 00db9a9af0
commit 4285168457
1 changed files with 13 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Containers/docker-socket-proxy/haproxy.cfg
+13 -1
View File
@@ -12,6 +12,15 @@ frontend http
mode http
bind :::2375 v4v6
http-request deny unless { src 127.0.0.1 } || { src ::1 } || { src NC_IPV4_PLACEHOLDER } || { src NC_IPV6_PLACEHOLDER }
# ACL to detect JSON \uXXXX unicode escape sequences in the request body.
# All values we accept (names, types, etc.) are restricted to plain ASCII
# (e.g. ^nc_app_[a-zA-Z0-9_.-]+), so a legitimate request never needs one.
# Without this, an attacker can hide literal strings such as "device" or
# "Binds" from the other regex-based ACLs below by encoding a character as
# e.g. "\u0064evice", bypassing those keyword checks entirely.
acl body_has_unicode_escape req.body -m reg -i "\\\\u[0-9a-f]{4}"
http-request deny if body_has_unicode_escape
# docker system _ping
http-request allow if { path,url_dec -m reg -i ^(/v[\d\.]+)?/_ping$ } METH_GET
# docker inspect image: GET images/%s/json
@@ -41,7 +50,10 @@ frontend http
acl binds_present req.body -m reg -i "\"HostConfig\"\s*:.*\"Binds\"\s*:"
# ACL to restrict the type of Mounts to volume
acl type_not_volume req.body -m reg -i "\"Mounts\"\s*:\s*\[[^\]]*(\"Type\"\s*:\s*\"(?!volume\b)\w+\"[^\]]*)+\]"
http-request deny if { path,url_dec -m reg -i ^(/v[\d\.]+)?/containers/create } nc_app_container_name !one_mount_volume binds_present type_not_volume METH_POST
# Deny if HostConfig.Binds is present, independently of other mounts or volumes
http-request deny if { path,url_dec -m reg -i ^(/v[\d\.]+)?/containers/create } nc_app_container_name binds_present
# Deny if required conditions are not met.
http-request deny if { path,url_dec -m reg -i ^(/v[\d\.]+)?/containers/create } nc_app_container_name !one_mount_volume type_not_volume METH_POST
# ACL to restrict container creation, that it has HostConfig.Privileged(by searching for "Privileged" word in all payload)
acl no_privileged_flag req.body -m reg -i "\"Privileged\""