podman cannot mount volumes with external symlinks #6003

joequant · 2020-04-27T15:37:18Z

/kind bug

Description

Podman volumes with external symlinks does not seem to be mountable

Steps to reproduce the issue:

Create volume with symlink which references files outside of the volume. For example symbolic link to ../foo
Try to mount the volume.
Volume does not mount

Describe the results you received:
Volume fails to mount

Describe the results you expected:

Volume should mount, and when I enter the image, I should see the symbolic link point to the file within the context of the mounted volume. This is the behavior in docker. Also these sorts of symbolic links are very common in directory /etc which points to /usr/share or to other directories outside the volume

Error: unable to start container 34e9c7636cd474d63741b93ecbd0dabfcab44aad263cedac4b4aa65ef93c5460: error copying content from container 34e9c7636cd474d63741b93ecbd0dabfcab44aad263cedac4b4aa65ef93c5460 into volume demo_etc: invalid symlink "/home/joe/.local/share/containers/storage/volumes/demo_etc/_data/httpd/logs" -> "../../var/log/httpd"

Additional information you deem important (e.g. issue happens only occasionally):

Output of podman version:
[joe@big-apple bench]$ podman version
Version: 2.0.0-dev
RemoteAPI Version: 1
Go Version: go1.14.2
OS/Arch: linux/amd64


**Output of `podman info --debug`:**

[joe@big-apple SPECS]$ 
  configFile: /home/joe/.config/containers/storage.conf
  containerStore:
    number: 9
    paused: 0
    running: 5
    stopped: 4
  graphDriverName: vfs
  graphOptions: {}
  graphRoot: /home/joe/.local/share/containers/storage
  graphStatus: {}
  imageStore:
    number: 36
  runRoot: /run/user/1000/containers
  volumePath: /home/joe/.local/share/containers/storage/volumes
version:
  Built: 0
  GitCommit: ""
  GoVersion: go1.14.2
  OsArch: linux/amd64
  RemoteAPIVersion: 1
  Version: 2.0.0-dev

Package info (e.g. output of rpm -q podman or apt list podman):

podman-2.0.0-0.1.dev.git8857ba2.mga8

Additional environment details (AWS, VirtualBox, physical, etc.):

The text was updated successfully, but these errors were encountered:

mheon · 2020-04-27T15:55:42Z

Create a volume how? podman volume create, mount into a container, add a symlink in the volume?

joequant · 2020-04-28T02:55:07Z

The work flow is 1) create a container with symlinks 2) set up a podman-compose or podman to mount a named volume with the directory with symlinks 3) podman tries to populate the named volume by copying the files from the container 4) and it fails It appears that there is an internal check that throws an exception when podman does a copy. I'd suggest changing that exception into a warning. The use case is that I have a container but I'd like to persist /etc and /etc has a symlinks to files in /usr/share

…

On Mon, Apr 27, 2020 at 11:55 PM Matthew Heon ***@***.***> wrote: Create a volume how? podman volume create, mount into a container, add a symlink in the volume? — You are receiving this because you authored the thread. Reply to this email directly, view it on GitHub <#6003 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAWGAGLOMUXSPEJZUXYPTF3ROWTI5ANCNFSM4MSA6Q3Q> .

rhatdan · 2020-04-28T16:25:21Z

I believe this check it to prevent CVEs, We might be a little more strict then we need to be.

mheon · 2020-04-28T16:51:37Z

We're using c/storage's CopyWithTar() to accomplish the actual copy-up. I think you may be right that this is a CVE fix for other uses of that function (it's also used for podman cp and Dockerfile ADD instructions, I believe). I think the issue here is the ../../ component of the link, which we see as a potential attempt to escape the container.

joequant · 2020-05-10T19:15:34Z

Any suggestions on how to fix? I can add a flag to CopyWithTar to avoid the check when copying a volume

mheon · 2020-05-10T21:38:42Z

That's definitely one way to do it. I somewhat wonder if we really need all of CopyWithTar for what should be a relatively simple copy.

joequant · 2020-05-16T20:22:25Z

Is there any reason why I can't just replace CopyWithTar with a call to shutil?

This patch uses termie/go-shutil to copy containers rather than tar. The problem with tar is that it does not copy symlinks pointing outside of the volume.

This patch uses internal copy to copy containers rather than tar. The problem with tar is that it does not copy symlinks pointing outside of the volume.

joequant · 2020-05-19T18:52:58Z

put in a fix in #6279

This turned out to be a very tricky patch to get right.

github-actions · 2020-06-19T00:08:55Z

A friendly reminder that this issue had no activity for 30 days.

rhatdan · 2020-06-19T11:15:00Z

@joequant What is going on with this one?

joequant · 2020-08-09T22:40:29Z

I have a patch that fixes the issue, but it turns out to be quite difficult to get everything right.

Unfortunately, the solution for me is to keep using docker until someone else can figure out how to address this issue.

rhatdan · 2020-08-10T13:21:29Z

@baude PTAL

github-actions · 2020-10-16T00:19:58Z

A friendly reminder that this issue had no activity for 30 days.

Forceu · 2020-11-23T15:48:10Z

Any update on this issue?

mheon · 2020-11-23T16:03:24Z

I imagine that reworking our copyup code to use Buildah's copier package should solve this.

rhatdan · 2020-12-24T12:08:42Z

@vrothberg did your rework of the copier code fix this issue?

mheon · 2020-12-24T17:18:07Z

I don't believe he hit this code - only podman cp. Given the way he structured the copy code, sharing that for copy-up no longer seems feasible. Using the Buildah Copier package still seems like the best way to do this though.

github-actions · 2021-01-25T00:49:14Z

A friendly reminder that this issue had no activity for 30 days.

rhatdan · 2021-01-25T15:20:14Z

@mheon Any chance you can work on this one?

agates · 2021-01-25T15:24:39Z

If it helps for testing, I received this when trying to run paloaltonetworks/minemeld

mheon · 2021-01-25T15:27:26Z

@rhatdan I can take a look once I'm done with what I'm working on now.

The old copy-up implementation was very unhappy with symlinks, which could cause containers to fail to start for unclear reasons when a directory we wanted to copy-up contained one. Rewrite to use the Buildah Copier, which is more recent and should be both safer and less likely to blow up over links. At the same time, fix a deadlock in copy-up for volumes requiring mounting - the Mountpoint() function tried to take the already-acquired volume lock. Fixes containers#6003 Signed-off-by: Matthew Heon <mheon@redhat.com>

mheon · 2021-02-10T18:42:05Z

Fix in #9308

The old copy-up implementation was very unhappy with symlinks, which could cause containers to fail to start for unclear reasons when a directory we wanted to copy-up contained one. Rewrite to use the Buildah Copier, which is more recent and should be both safer and less likely to blow up over links. At the same time, fix a deadlock in copy-up for volumes requiring mounting - the Mountpoint() function tried to take the already-acquired volume lock. Fixes containers#6003 Signed-off-by: Matthew Heon <mheon@redhat.com>

openshift-ci-robot added the kind/bug Categorizes issue or PR as related to a bug. label Apr 27, 2020

joequant mentioned this issue May 19, 2020

Dev/use shutil for copy #6278

Closed

github-actions bot added the stale-issue label Jun 19, 2020

joequant mentioned this issue Aug 9, 2020

copy errors when copying a symlink that extends out of a volume containers/podman-compose#148

Open

rhatdan assigned baude Aug 10, 2020

baude assigned mheon and unassigned baude Sep 2, 2020

vrothberg removed the stale-issue label Sep 15, 2020

github-actions bot added the stale-issue label Oct 16, 2020

rhatdan removed the stale-issue label Dec 24, 2020

github-actions bot added the stale-issue label Jan 25, 2021

rhatdan removed the stale-issue label Jan 25, 2021

mheon added the In Progress This issue is actively being worked by the assignee, please do not work on this at this time. label Feb 9, 2021

mheon mentioned this issue Feb 10, 2021

Rewrite copy-up to use buildah Copier #9308

Merged

openshift-merge-robot closed this as completed in #9308 Feb 11, 2021

github-actions bot added the locked - please file new issue/PR Assist humans wanting to comment on an old issue or PR with locked comments. label Sep 22, 2023

github-actions bot locked as resolved and limited conversation to collaborators Sep 22, 2023

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

podman cannot mount volumes with external symlinks #6003

podman cannot mount volumes with external symlinks #6003

joequant commented Apr 27, 2020

mheon commented Apr 27, 2020

joequant commented Apr 28, 2020 via email

rhatdan commented Apr 28, 2020

mheon commented Apr 28, 2020

joequant commented May 10, 2020

mheon commented May 10, 2020

joequant commented May 16, 2020

joequant commented May 19, 2020

github-actions bot commented Jun 19, 2020

rhatdan commented Jun 19, 2020

joequant commented Aug 9, 2020

rhatdan commented Aug 10, 2020

github-actions bot commented Oct 16, 2020

Forceu commented Nov 23, 2020

mheon commented Nov 23, 2020

rhatdan commented Dec 24, 2020

mheon commented Dec 24, 2020

github-actions bot commented Jan 25, 2021

rhatdan commented Jan 25, 2021

agates commented Jan 25, 2021

mheon commented Jan 25, 2021

mheon commented Feb 10, 2021

podman cannot mount volumes with external symlinks #6003

podman cannot mount volumes with external symlinks #6003

Comments

joequant commented Apr 27, 2020

mheon commented Apr 27, 2020

joequant commented Apr 28, 2020 via email

rhatdan commented Apr 28, 2020

mheon commented Apr 28, 2020

joequant commented May 10, 2020

mheon commented May 10, 2020

joequant commented May 16, 2020

joequant commented May 19, 2020

github-actions bot commented Jun 19, 2020

rhatdan commented Jun 19, 2020

joequant commented Aug 9, 2020

rhatdan commented Aug 10, 2020

github-actions bot commented Oct 16, 2020

Forceu commented Nov 23, 2020

mheon commented Nov 23, 2020

rhatdan commented Dec 24, 2020

mheon commented Dec 24, 2020

github-actions bot commented Jan 25, 2021

rhatdan commented Jan 25, 2021

agates commented Jan 25, 2021

mheon commented Jan 25, 2021

mheon commented Feb 10, 2021