Mask Linux thermal interrupt info in /proc and /sys.

[saschagrunert]

What type of PR is this?

/kind cleanup

What this PR does / why we need it:

On Linux, mask "/proc/interrupts" and "/sys/devices/system/cpu/cpu/thermal_throttle" inside containers by default. Privileged containers or containers started with --security-opt="systempaths=unconfined" are not affected.

Mitigates potential Thermal Side-Channel Vulnerability Exploit (https://github.com/moby/moby/security/advisories/GHSA-6fw5-f8r9-fgfm).

Also: improve integration test TestCreateWithCustomMaskedPaths() to ensure default masked paths don't apply to privileged containers.

Which issue(s) this PR fixes:

Refers to moby/moby#49560, cri-o/cri-o#9069

Special notes for your reviewer:

None

Does this PR introduce a user-facing change?

Masked off access to Linux thermal interrupt info in `/proc` and `/sys`.

Additional documentation e.g., KEPs (Kubernetes Enhancement Proposals), usage docs, etc.:

None

[dims]

looks like we need darwin support too! (typecheck fail)

[saschagrunert]

/retest

[saschagrunert]

/test pull-kubernetes-e2e-capz-windows-master

[saschagrunert]

/retest

[saschagrunert]

/retest

[k8s-ci-robot]

@saschagrunert: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
pull-kubernetes-e2e-capz-windows-master	65b8fba	link	false	/test pull-kubernetes-e2e-capz-windows-master

Full PR test history. Your PR dashboard. Please help us cut down on flakes by linking to an open issue when you hit one in your PR.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

[saschagrunert]

pull-kubernetes-e2e-capz-windows-master is mostly red over all PR's 🤔
/skip

[sftim]

Changelog suggestion

-Mask Linux thermal interrupt info in `/proc` and `/sys`.
+Masked off access to Linux thermal interrupt info in `/proc` and `/sys`.

[saschagrunert]

Changelog suggestion

Thanks, applied as suggested.

[bart0sh]

/triage accepted

[k8s-triage-robot]

The Kubernetes project currently lacks enough contributors to adequately respond to all PRs.

This bot triages PRs according to the following rules:

• After 90d of inactivity, lifecycle/stale is applied
• After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
• After 30d of inactivity since lifecycle/rotten was applied, the PR is closed

You can:

• Mark this PR as fresh with /remove-lifecycle stale
• Close this PR with /close
• Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale

[haircommander]

/hold cancel

[haircommander]

ah

/hold

I see, let's let a kubelet approver look

[SergeyKanzhelev]

/lgtm
/unhold
/approve

We typically keep these in-sync.

I wonder if it warrants the backport. I do not have access to https://github.com/moby/moby/security/advisories/GHSA-6fw5-f8r9-fgfm

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: dims, saschagrunert, SergeyKanzhelev

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• pkg/securitycontext/OWNERS [SergeyKanzhelev,dims]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[saschagrunert]

I wonder if it warrants the backport. I do not have access to https://github.com/moby/moby/security/advisories/GHSA-6fw5-f8r9-fgfm

Yes, I think so. Opened #132985, #132986 and #132987 for that.