deps: update to github.com/cyphar/filepath-securejoin@v0.4.1#4590
Merged
AkihiroSuda merged 1 commit intoopencontainers:mainfrom Jan 29, 2025
Merged
deps: update to github.com/cyphar/filepath-securejoin@v0.4.1#4590AkihiroSuda merged 1 commit intoopencontainers:mainfrom
AkihiroSuda merged 1 commit intoopencontainers:mainfrom
Conversation
Contributor
|
tests/cmd/seccompagent fails in SecureJoin; with added diagnostics, here's the error
I think this is about trailing diff --git a/tests/cmd/seccompagent/seccompagent.go b/tests/cmd/seccompagent/seccompagent.go
index be1e6c25..9d070474 100644
--- a/tests/cmd/seccompagent/seccompagent.go
+++ b/tests/cmd/seccompagent/seccompagent.go
@@ -144,15 +144,16 @@ func runMkdirForContainer(pid uint32, fileName string, mode uint32, metadata str
// We validated before that metadata is not a string that can make
// newFile a file in a different location other than root.
newFile := fmt.Sprintf("%s-%s", fileName, metadata)
- root := fmt.Sprintf("/proc/%d/cwd/", pid)
+ root := fmt.Sprintf("/proc/%d/cwd", pid)
if strings.HasPrefix(fileName, "/") {
// If it starts with /, use the rootfs as base
- root = fmt.Sprintf("/proc/%d/root/", pid)
+ root = fmt.Sprintf("/proc/%d/root", pid)
}
path, err := securejoin.SecureJoin(root, newFile)
if err != nil {
+ logrus.Errorf("securejoin(%q, %q) error: %v", root, newFile, err)
return err
}I'm not sure how many other real users cyphar/filepath-securejoin#43 breaks; if there will be more, maybe it makes sense to relax the validation slightly (e.g. do not allow |
Contributor
Oh well, it's not that easy of course. |
mtrmac
added a commit
to mtrmac/libpod
that referenced
this pull request
Jan 14, 2025
> go mod edit -replace github.com/opencontainers/runc=github.com/cyphar/runc@securejoin-0.4.0 per opencontainers/runc#4590 . Signed-off-by: Miloslav Trmač <mitr@redhat.com>
mtrmac
added a commit
to mtrmac/libpod
that referenced
this pull request
Jan 14, 2025
> go mod edit -replace github.com/opencontainers/runc=github.com/cyphar/runc@securejoin-0.4.0 per opencontainers/runc#4590 . Signed-off-by: Miloslav Trmač <mitr@redhat.com>
mtrmac
added a commit
to mtrmac/libpod
that referenced
this pull request
Jan 14, 2025
> go mod edit -replace github.com/opencontainers/runc=github.com/cyphar/runc@securejoin-0.4.0 per opencontainers/runc#4590 . Signed-off-by: Miloslav Trmač <mitr@redhat.com>
1 task
mtrmac
added a commit
to mtrmac/libpod
that referenced
this pull request
Jan 14, 2025
> go mod edit -replace github.com/opencontainers/runc=github.com/cyphar/runc@securejoin-0.4.0 per opencontainers/runc#4590 . Signed-off-by: Miloslav Trmač <mitr@redhat.com>
mtrmac
added a commit
to mtrmac/libpod
that referenced
this pull request
Jan 14, 2025
> go mod edit -replace github.com/opencontainers/runc=github.com/cyphar/runc@securejoin-0.4.0 per opencontainers/runc#4590 . Signed-off-by: Miloslav Trmač <mitr@redhat.com>
mtrmac
added a commit
to mtrmac/libpod
that referenced
this pull request
Jan 14, 2025
> go mod edit -replace github.com/opencontainers/runc=github.com/cyphar/runc@securejoin-0.4.0 per opencontainers/runc#4590 . Signed-off-by: Miloslav Trmač <mitr@redhat.com>
mtrmac
added a commit
to mtrmac/libpod
that referenced
this pull request
Jan 14, 2025
> go mod edit -replace github.com/opencontainers/runc=github.com/cyphar/runc@securejoin-0.4.0 per opencontainers/runc#4590 . Signed-off-by: Miloslav Trmač <mitr@redhat.com>
mtrmac
added a commit
to mtrmac/libpod
that referenced
this pull request
Jan 15, 2025
> go mod edit -replace github.com/opencontainers/runc=github.com/cyphar/runc@securejoin-0.4.0 per opencontainers/runc#4590 . Signed-off-by: Miloslav Trmač <mitr@redhat.com>
mtrmac
added a commit
to mtrmac/libpod
that referenced
this pull request
Jan 16, 2025
> go mod edit -replace github.com/opencontainers/runc=github.com/cyphar/runc@securejoin-0.4.0 per opencontainers/runc#4590 . Signed-off-by: Miloslav Trmač <mitr@redhat.com>
mtrmac
added a commit
to mtrmac/libpod
that referenced
this pull request
Jan 16, 2025
> go mod edit -replace github.com/opencontainers/runc=github.com/cyphar/runc@securejoin-0.4.0 per opencontainers/runc#4590 . Signed-off-by: Miloslav Trmač <mitr@redhat.com>
mtrmac
added a commit
to mtrmac/storage
that referenced
this pull request
Jan 20, 2025
opencontainers/runc#4590 is needed for Podman to be able to use it, so stay on the previous version for now. Signed-off-by: Miloslav Trmač <mitr@redhat.com>
Luap99
added a commit
to Luap99/storage
that referenced
this pull request
Jan 21, 2025
…n to v0.4.0" This reverts commit 05dcfd3. In particular this commit doesn't build when vendored into podman because runc fails to build with it. opencontainers/runc#4590 This is not visible in storage because runc is not imported here. Signed-off-by: Paul Holzinger <pholzing@redhat.com>
Merged
1 task
165f564 to
075a5a6
Compare
Member
Author
|
Updated to v0.4.1 which includes a fix for the non-clean paths issue. |
075a5a6 to
3380e2f
Compare
This release includes a minor breaking API change that requires us to rework the types of our wrappers, but there is no practical behaviour change. Signed-off-by: Aleksa Sarai <cyphar@cyphar.com>
3380e2f to
70e500e
Compare
AkihiroSuda
approved these changes
Jan 29, 2025
Contributor
|
Should we backport this to release-1.2? |
Contributor
Looks like we should, otherwise those who vendor runc could not bump filepath-securejoin. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This release includes a minor breaking API change that requires us to
rework the types of our wrappers, but there is no practical behaviour
change.
Signed-off-by: Aleksa Sarai cyphar@cyphar.com