51 lines
2.0 KiB
Diff
51 lines
2.0 KiB
Diff
From 47f113c0362b7fad7e1e7a630193824729525236 Mon Sep 17 00:00:00 2001
|
|
From: Nalin Dahyabhai <nalin@redhat.com>
|
|
Date: Tue, 1 Oct 2024 11:01:45 -0400
|
|
Subject: [PATCH 1/3] CVE-2024-9407: validate "bind-propagation" flag settings
|
|
|
|
CVE-2024-9407: validate that the value for the "bind-propagation" flag
|
|
when handling "bind" and "cache" mounts in `buildah run` or in RUN
|
|
instructions is one of the values that we would accept without the
|
|
"bind-propagation=" prefix.
|
|
|
|
Signed-off-by: Nalin Dahyabhai <nalin@redhat.com>
|
|
(cherry picked from commit 732f77064830bb91062d475407b761ade2e4fe6b)
|
|
Signed-off-by: Danish Prakash <contact@danishpraka.sh>
|
|
---
|
|
internal/volumes/volumes.go | 12 ++++++++++++
|
|
1 file changed, 12 insertions(+)
|
|
|
|
diff --git a/internal/volumes/volumes.go b/internal/volumes/volumes.go
|
|
index a79b8df8c5ed..ccb81b27ed46 100644
|
|
--- a/internal/volumes/volumes.go
|
|
+++ b/internal/volumes/volumes.go
|
|
@@ -100,6 +100,12 @@ func GetBindMount(ctx *types.SystemContext, args []string, contextDir string, st
|
|
if len(kv) == 1 {
|
|
return newMount, "", fmt.Errorf("%v: %w", kv[0], errBadOptionArg)
|
|
}
|
|
+ switch kv[1] {
|
|
+ default:
|
|
+ return newMount, "", fmt.Errorf("%v: %q: %w", kv[0], kv[1], errBadMntOption)
|
|
+ case "shared", "rshared", "private", "rprivate", "slave", "rslave":
|
|
+ // this should be the relevant parts of the same list of options we accepted above
|
|
+ }
|
|
newMount.Options = append(newMount.Options, kv[1])
|
|
case "src", "source":
|
|
if len(kv) == 1 {
|
|
@@ -271,6 +277,12 @@ func GetCacheMount(args []string, store storage.Store, imageMountLabel string, a
|
|
if len(kv) == 1 {
|
|
return newMount, nil, fmt.Errorf("%v: %w", kv[0], errBadOptionArg)
|
|
}
|
|
+ switch kv[1] {
|
|
+ default:
|
|
+ return newMount, nil, fmt.Errorf("%v: %q: %w", kv[0], kv[1], errBadMntOption)
|
|
+ case "shared", "rshared", "private", "rprivate", "slave", "rslave":
|
|
+ // this should be the relevant parts of the same list of options we accepted above
|
|
+ }
|
|
newMount.Options = append(newMount.Options, kv[1])
|
|
case "id":
|
|
if len(kv) == 1 {
|
|
--
|
|
2.46.0
|
|
|