53 lines
2.0 KiB
Diff
53 lines
2.0 KiB
Diff
From be63550b01f7b3a1788912d79e2866ee9cdd083b Mon Sep 17 00:00:00 2001
|
|
From: Paul Holzinger <pholzing@redhat.com>
|
|
Date: Wed, 2 Oct 2024 12:15:15 +0200
|
|
Subject: [PATCH 2/3] [conmon] pkg/subscriptions: use securejoin for the
|
|
container path
|
|
MIME-Version: 1.0
|
|
Content-Type: text/plain; charset=UTF-8
|
|
Content-Transfer-Encoding: 8bit
|
|
|
|
If we join a path from the container image we must always use securejoin
|
|
to prevent us from following a symlink onto the host.
|
|
|
|
Fixes CVE-2024-9341
|
|
|
|
Cherry-pick from
|
|
https://github.com/containers/common/commit/5a550b6fe26068dd1d5d2616c8595edf10b41e28
|
|
|
|
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
|
|
Signed-off-by: Dan Čermák <dcermak@suse.com>
|
|
Signed-off-by: Danish Prakash <contact@danishpraka.sh>
|
|
---
|
|
.../containers/common/pkg/subscriptions/subscriptions.go | 7 ++++++-
|
|
1 file changed, 6 insertions(+), 1 deletion(-)
|
|
|
|
diff --git a/vendor/github.com/containers/common/pkg/subscriptions/subscriptions.go b/vendor/github.com/containers/common/pkg/subscriptions/subscriptions.go
|
|
index 6ba2154a7790..b513ed0b1df9 100644
|
|
--- a/vendor/github.com/containers/common/pkg/subscriptions/subscriptions.go
|
|
+++ b/vendor/github.com/containers/common/pkg/subscriptions/subscriptions.go
|
|
@@ -10,6 +10,7 @@ import (
|
|
|
|
"github.com/containers/common/pkg/umask"
|
|
"github.com/containers/storage/pkg/idtools"
|
|
+ securejoin "github.com/cyphar/filepath-securejoin"
|
|
rspec "github.com/opencontainers/runtime-spec/specs-go"
|
|
"github.com/opencontainers/selinux/go-selinux/label"
|
|
"github.com/sirupsen/logrus"
|
|
@@ -345,7 +346,11 @@ func addFIPSModeSubscription(mounts *[]rspec.Mount, containerRunDir, mountPoint,
|
|
|
|
srcBackendDir := "/usr/share/crypto-policies/back-ends/FIPS"
|
|
destDir := "/etc/crypto-policies/back-ends"
|
|
- srcOnHost := filepath.Join(mountPoint, srcBackendDir)
|
|
+ srcOnHost, err := securejoin.SecureJoin(mountPoint, srcBackendDir)
|
|
+ if err != nil {
|
|
+ return fmt.Errorf("resolve %s in the container: %w", srcBackendDir, err)
|
|
+ }
|
|
+
|
|
if _, err := os.Stat(srcOnHost); err != nil {
|
|
if errors.Is(err, os.ErrNotExist) {
|
|
return nil
|
|
--
|
|
2.46.0
|
|
|