opensource/podman
1
0
Fork 0
mirror of https://github.com/containers/podman.git synced 2025-10-19 12:12:36 +08:00
Code Issues Packages Projects Releases Wiki Activity

volume,container: chroot to source before exporting content

Browse Source 
* Utils must support higher level API to create Tar with chrooted into
  directory
* Volume export: use TarwithChroot instead of Tar so we can make sure no
  symlink can be exported by tar if it exists outside of the source
directory.
* container export: use chroot and Tar instead of Tar so we can make sure no
  symlink can be exported by tar if it exists outside of the mointPoint.

[NO NEW TESTS NEEDED]
[NO TESTS NEEDED]
Race needs combination of external/in-container mechanism which is hard to repro in CI.

CVE: https://access.redhat.com/security/cve/CVE-2023-0778

Signed-off-by: Aditya R <arajan@redhat.com>

MH: Cherry-pick to v4.4.1-rhel per RHBZ 2169618

Signed-off-by: Matt Heon <mheon@redhat.com>
This commit is contained in:
Aditya R
2023-02-10 15:16:27 +05:30
committed by Matthew Heon
parent 4f1dc3c6c3
commit 017535d05e
2 changed files with 26 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
libpod/container_internal.go
View File

@ -34,7 +34,7 @@ import (
"github.com/containers/podman/v4/pkg/systemd/notifyproxy"
"github.com/containers/podman/v4/pkg/util"
"github.com/containers/storage"
"github.com/containers/storage/pkg/archive"
"github.com/containers/storage/pkg/chrootarchive"
"github.com/containers/storage/pkg/idtools"
"github.com/containers/storage/pkg/lockfile"
"github.com/containers/storage/pkg/mount"
@ -763,7 +763,7 @@ func (c *Container) export(out io.Writer) error {
}()
}
input, err := archive.Tar(mountPoint, archive.Uncompressed)
input, err := chrootarchive.Tar(mountPoint, nil, mountPoint)
if err != nil {
return fmt.Errorf("reading container directory %q: %w", c.ID(), err)
}