From 290dbe53fdc8c31aa51f0851c57bda0f195fc1a6 Mon Sep 17 00:00:00 2001 From: Paul Holzinger Date: Wed, 2 Oct 2024 12:15:15 +0200 Subject: [PATCH 2/4] [conmon] pkg/subscriptions: use securejoin for the container path MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit If we join a path from the container image we must always use securejoin to prevent us from following a symlink onto the host. Fixes CVE-2024-9341 Cherry-pick from https://github.com/containers/common/commit/5a550b6fe26068dd1d5d2616c8595edf10b41e28 Signed-off-by: Paul Holzinger Signed-off-by: Dan Čermák Signed-off-by: Danish Prakash --- .../containers/common/pkg/subscriptions/subscriptions.go | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/vendor/github.com/containers/common/pkg/subscriptions/subscriptions.go b/vendor/github.com/containers/common/pkg/subscriptions/subscriptions.go index 6845914aa285..71ee68a5909c 100644 --- a/vendor/github.com/containers/common/pkg/subscriptions/subscriptions.go +++ b/vendor/github.com/containers/common/pkg/subscriptions/subscriptions.go @@ -10,6 +10,7 @@ import ( "github.com/containers/common/pkg/umask" "github.com/containers/storage/pkg/idtools" + securejoin "github.com/cyphar/filepath-securejoin" rspec "github.com/opencontainers/runtime-spec/specs-go" "github.com/opencontainers/selinux/go-selinux/label" "github.com/sirupsen/logrus" @@ -345,7 +346,11 @@ func addFIPSModeSubscription(mounts *[]rspec.Mount, containerRunDir, mountPoint, srcBackendDir := "/usr/share/crypto-policies/back-ends/FIPS" destDir := "/etc/crypto-policies/back-ends" - srcOnHost := filepath.Join(mountPoint, srcBackendDir) + srcOnHost, err := securejoin.SecureJoin(mountPoint, srcBackendDir) + if err != nil { + return fmt.Errorf("resolve %s in the container: %w", srcBackendDir, err) + } + if _, err := os.Stat(srcOnHost); err != nil { if errors.Is(err, os.ErrNotExist) { return nil -- 2.46.0