opensource/podman
1
0
Fork 0
mirror of https://github.com/containers/podman.git synced 2025-08-06 03:19:52 +08:00
Code Issues Packages Projects Releases Wiki Activity

Validate passed in timezone from tz option

Browse Source 
Erik Sjolund reported an issue where a badly formated file
could be passed into the `--tz` option and then the date in the container
would be badly messed up:

```
erik@laptop:~$ echo Hello > file.txt
erik@laptop:~$ podman run --tz=../../../home/erik/file.txt --rm -ti
docker.io/library/alpine cat /etc/localtime
Hello
erik@laptop:~$ podman --version
podman version 3.0.0-rc1
erik@laptop:~$
```
This fix checks to make sure the TZ passed in is a valid
value and then proceeds with the rest of the processing.

This was first reported as a potential security issue, but it
was thought not to be.   However, I thought closing the hole
sooner rather than later would be good.

Signed-off-by: TomSweeneyRedHat <tsweeney@redhat.com>
This commit is contained in:
TomSweeneyRedHat
2021-02-27 19:53:03 -05:00
parent ebc9871c93
commit 5b2e71dc5b
2 changed files with 33 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
libpod/container_internal_linux.go
View File

@ -1503,16 +1503,24 @@ func (c *Container) makeBindMounts() error {
}
// Make /etc/localtime
if c.Timezone() != "" {
ctrTimezone := c.Timezone()
if ctrTimezone != "" {
// validate the format of the timezone specified if it's not "local"
if ctrTimezone != "local" {
_, err = time.LoadLocation(ctrTimezone)
if err != nil {
return errors.Wrapf(err, "error finding timezone for container %s", c.ID())
}
}
if _, ok := c.state.BindMounts["/etc/localtime"]; !ok {
var zonePath string
if c.Timezone() == "local" {
if ctrTimezone == "local" {
zonePath, err = filepath.EvalSymlinks("/etc/localtime")
if err != nil {
return errors.Wrapf(err, "error finding local timezone for container %s", c.ID())
}
} else {
zone := filepath.Join("/usr/share/zoneinfo", c.Timezone())
zone := filepath.Join("/usr/share/zoneinfo", ctrTimezone)
zonePath, err = filepath.EvalSymlinks(zone)
if err != nil {
return errors.Wrapf(err, "error setting timezone for container %s", c.ID())

23
test/e2e/run_test.go
View File

@ -1412,7 +1412,28 @@ USER mail`
})
It("podman run --tz", func() {
session := podmanTest.Podman([]string{"run", "--tz", "foo", "--rm", ALPINE, "date"})
testDir := filepath.Join(podmanTest.RunRoot, "tz-test")
err := os.MkdirAll(testDir, 0755)
Expect(err).To(BeNil())
tzFile := filepath.Join(testDir, "tzfile.txt")
file, err := os.Create(tzFile)
Expect(err).To(BeNil())
_, err = file.WriteString("Hello")
Expect(err).To(BeNil())
file.Close()
badTZFile := fmt.Sprintf("../../../%s", tzFile)
session := podmanTest.Podman([]string{"run", "--tz", badTZFile, "--rm", ALPINE, "date"})
session.WaitWithDefaultTimeout()
Expect(session.ExitCode()).To(Not(Equal(0)))
Expect(session.ErrorToString()).To(ContainSubstring("error finding timezone for container"))
err = os.Remove(tzFile)
Expect(err).To(BeNil())
session = podmanTest.Podman([]string{"run", "--tz", "foo", "--rm", ALPINE, "date"})
session.WaitWithDefaultTimeout()
Expect(session.ExitCode()).To(Not(Equal(0)))