Skip to content

[release/1.7 backport] switch back from golang.org/x/sys/execabs to os/exec (go1.19)#9602

Merged
fuweid merged 2 commits intocontainerd:release/1.7from
thaJeztah:1.7_backport_no_execabs
Jan 8, 2024
Merged

[release/1.7 backport] switch back from golang.org/x/sys/execabs to os/exec (go1.19)#9602
fuweid merged 2 commits intocontainerd:release/1.7from
thaJeztah:1.7_backport_no_execabs

Conversation

@thaJeztah
Copy link
Member

This is effectively a revert of 2ac9968, which
switched from os/exec to the golang.org/x/sys/execabs package to mitigate
security issues (mainly on Windows) with lookups resolving to binaries in the
current directory.

from the go1.19 release notes https://go.dev/doc/go1.19#os-exec-path

> ## PATH lookups
>
> Command and LookPath no longer allow results from a PATH search to be found
> relative to the current directory. This removes a common source of security
> problems but may also break existing programs that depend on using, say,
> exec.Command("prog") to run a binary named prog (or, on Windows, prog.exe) in
> the current directory. See the os/exec package documentation for information
> about how best to update such programs.
>
> On Windows, Command and LookPath now respect the NoDefaultCurrentDirectoryInExePath
> environment variable, making it possible to disable the default implicit search
> of “.” in PATH lookups on Windows systems.

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
(cherry picked from commit 2af6db6)
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
@thaJeztah thaJeztah force-pushed the 1.7_backport_no_execabs branch from 508c8bd to 872af82 Compare January 5, 2024 09:10
Copy link
Member

@fuweid fuweid left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@fuweid fuweid merged commit 5a675f2 into containerd:release/1.7 Jan 8, 2024
@thaJeztah thaJeztah deleted the 1.7_backport_no_execabs branch January 8, 2024 12:38
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants