buildah/0002-conmon-pkg-subscriptions-use-securejoin-for-the-cont.patch

From 290dbe53fdc8c31aa51f0851c57bda0f195fc1a6 Mon Sep 17 00:00:00 2001
From: Paul Holzinger <pholzing@redhat.com>
Date: Wed, 2 Oct 2024 12:15:15 +0200
Subject: [PATCH 2/4] [conmon] pkg/subscriptions: use securejoin for the
 container path
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

If we join a path from the container image we must always use securejoin
to prevent us from following a symlink onto the host.

Fixes CVE-2024-9341

Cherry-pick from
https://github.com/containers/common/commit/5a550b6fe26068dd1d5d2616c8595edf10b41e28

Signed-off-by: Paul Holzinger <pholzing@redhat.com>
Signed-off-by: Dan Čermák <dcermak@suse.com>
Signed-off-by: Danish Prakash <contact@danishpraka.sh>
---
 .../containers/common/pkg/subscriptions/subscriptions.go   | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/vendor/github.com/containers/common/pkg/subscriptions/subscriptions.go b/vendor/github.com/containers/common/pkg/subscriptions/subscriptions.go
index 6845914aa285..71ee68a5909c 100644
--- a/vendor/github.com/containers/common/pkg/subscriptions/subscriptions.go
+++ b/vendor/github.com/containers/common/pkg/subscriptions/subscriptions.go
@@ -10,6 +10,7 @@ import (
 
 	"github.com/containers/common/pkg/umask"
 	"github.com/containers/storage/pkg/idtools"
+	securejoin "github.com/cyphar/filepath-securejoin"
 	rspec "github.com/opencontainers/runtime-spec/specs-go"
 	"github.com/opencontainers/selinux/go-selinux/label"
 	"github.com/sirupsen/logrus"
@@ -345,7 +346,11 @@ func addFIPSModeSubscription(mounts *[]rspec.Mount, containerRunDir, mountPoint,
 
 	srcBackendDir := "/usr/share/crypto-policies/back-ends/FIPS"
 	destDir := "/etc/crypto-policies/back-ends"
-	srcOnHost := filepath.Join(mountPoint, srcBackendDir)
+	srcOnHost, err := securejoin.SecureJoin(mountPoint, srcBackendDir)
+	if err != nil {
+		return fmt.Errorf("resolve %s in the container: %w", srcBackendDir, err)
+	}
+
 	if _, err := os.Stat(srcOnHost); err != nil {
 		if errors.Is(err, os.ErrNotExist) {
 			return nil
-- 
2.46.0