enforcement: fix use case when the same target has different hashes #1469
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
anmaxvl
force-pushed
the
fix-device-mount-enforcement
branch
from
8d7e712
to
9e133fa
Compare
|
moved github CI enablement for security policy unit tests into a separate PR: #1470 |
helsaawy
reviewed
Jul 27, 2022
anmaxvl
force-pushed
the
fix-device-mount-enforcement
branch
from
9e133fa
to
0566ad8
Compare
dcantah
reviewed
Aug 3, 2022
dcantah
reviewed
Aug 3, 2022
|
CI failure is because some hostprocess tests in containerd can't find powershell in their path, this fixes things #1473, but also without this fix the CI in my change is exceedingly flaky for the security policy test 🤣. |
|
Okay #1473 was merged, rebase should fix the CI |
Fix an issue when the same mount target could have different hashes during device mount policy enforcement. Although it's possible to mount different devices at the same mount location, this doesn't make sense for read-only container layers. The device mount enforcement logic has been updated to cover this case. This was discovered by randomized security policy unit tests. The tests have been updated, to minimize the chance of it happening by adding a minimal length for a random string and appropriate unit test has been added to cover the change. Signed-off-by: Maksim An <maksiman@microsoft.com>
Signed-off-by: Maksim An <maksiman@microsoft.com>
anmaxvl
force-pushed
the
fix-device-mount-enforcement
branch
from
5999711
to
74bef8d
Compare
helsaawy
approved these changes
Aug 8, 2022
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Fix an issue when the same mount target could have different hashes
during device mount policy enforcement.
Although it's possible to mount different devices at the same mount
location, this doesn't make sense for read-only container layers.
The device mount enforcement logic has been updated to cover this
case.
This was discovered by randomized security policy unit tests.
The tests have been updated, to minimize the chance of it happening
by adding a minimal length for a random string and appropriate unit
test has been added to cover the change.
Signed-off-by: Maksim An maksiman@microsoft.com