libpod: mount safely subpaths #17992
Conversation
openshift-ci
bot
added
release-note-none
approved
giuseppe
force-pushed
the
safe-mount-subpath
branch
3 times, most recently
from
b0fb2e6
to
38b9036
Compare
| } | ||
| }() | ||
|
|
||
| fdPath := fmt.Sprintf("/proc/%d/fd/%d", os.Getpid(), f.Fd()) |
There was a problem hiding this comment.
Do I understand it correctly that the trick to avoid a TOCTOU is by using the FD here? The path may change but the FD will continue pointing to the same file?
Whether I understood it correctly or not, I think that a comment would be nice.
There was a problem hiding this comment.
the trick is that once it is opened, it cannot become a symlink anymore. So if we open, validate it and then use it, we are safe. I'll add a comment
There was a problem hiding this comment.
Excellent, thanks!
Clever idea, btw
giuseppe
force-pushed
the
safe-mount-subpath
branch
from
38b9036
to
cd748fb
Compare
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: giuseppe, vrothberg The full list of commands accepted by this bot can be found here. The pull request process is described here
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
giuseppe
force-pushed
the
safe-mount-subpath
branch
from
cd748fb
to
32d6622
Compare
|
Nice work. One nit, but not worth fixing unless you need to repush. /lgtm |
openshift-ci
bot
added
do-not-merge/hold
giuseppe
force-pushed
the
safe-mount-subpath
branch
from
32d6622
to
8a88390
Compare
add a function to securely mount a subpath inside a volume. We cannot trust that the subpath is safe since it is beneath a volume that could be controlled by a separate container. To avoid TOCTOU races between when we check the subpath and when the OCI runtime mounts it, we open the subpath, validate it, bind mount to a temporary directory and use it instead of the original path. Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
giuseppe
force-pushed
the
safe-mount-subpath
branch
from
8a88390
to
4d56292
Compare
|
/lgtm |
|
/hold cancel |
openshift-ci
bot
removed
the
do-not-merge/hold
github-actions
bot
added
the
locked - please file new issue/PR
add a function to securely mount a subpath inside a volume. We cannot trust that the subpath is safe since it is beneath a volume that could be controlled by a separate container. To avoid TOCTOU races between when we check the subpath and when the OCI runtime mounts it, we open the subpath, validate it, bind mount to a temporary directory and use it instead of the original path.
Does this PR introduce a user-facing change?