Paul Holzinger 43fbde4e66 kube play: don't follow volume symlinks onto the host ...

For ConfigMap and Secret kube play volumes podman populates the data
from the yaml. However the volume content is not controlled by us and we
can be tricked following a symlink to a file on the host instead.

Fixes: CVE-2025-9566

Signed-off-by: Paul Holzinger <pholzing@redhat.com>

2025-09-04 16:18:35 +02:00

..

annotations

update golangci-lint to 1.60.1

2024-08-19 11:41:28 +02:00

api

Switch common, storage and image to monorepo.

2025-09-01 12:33:04 +02:00

auth

Switch common, storage and image to monorepo.

2025-09-01 12:33:04 +02:00

autoupdate

Switch common, storage and image to monorepo.

2025-09-01 12:33:04 +02:00

bindings

Switch common, storage and image to monorepo.

2025-09-01 12:33:04 +02:00

channel

bump golangci-lint to v1.50.1

2022-12-15 13:39:56 +01:00

checkpoint

Switch common, storage and image to monorepo.

2025-09-01 12:33:04 +02:00

copy

Fix windows path handling in podman cp

2025-04-08 15:23:08 -07:00

criu

chore: delete obsolete // +build lines

2024-01-04 11:53:38 +02:00

ctime

update golangci/golangci-lint to v1.63.4

2025-01-07 15:48:53 +01:00

domain

kube play: don't follow volume symlinks onto the host

2025-09-04 16:18:35 +02:00

emulation

pkg/emulation.parseBinfmtMisc(): accept empty "flags" fields

2025-07-23 15:53:39 -04:00

env

update golangci/golangci-lint to v1.63.4

2025-01-07 15:48:53 +01:00

errorhandling

pkg/errorhandling: remove deadcode

2025-06-26 19:37:14 +02:00

farm

Switch common, storage and image to monorepo.

2025-09-01 12:33:04 +02:00

fileserver

pkg/fileserver: remove deadcode

2025-06-26 19:37:15 +02:00

inspect

Switch common, storage and image to monorepo.

2025-09-01 12:33:04 +02:00

k8s.io

Pod YAML: Add support for lifecycle.stopSignal

2025-06-23 08:23:31 -04:00

libartifact

Switch common, storage and image to monorepo.

2025-09-01 12:33:04 +02:00

logiface

Initial implementation of podman quadlet commands

2025-07-18 13:57:11 -07:00

lookup

Cease using deprecated runc userlookup

2024-02-02 11:02:43 -05:00

machine

Switch common, storage and image to monorepo.

2025-09-01 12:33:04 +02:00

namespaces

pkg/namespaces: remove deadcode

2025-06-26 19:37:15 +02:00

parallel

pkg/parallel: remove deadcode

2025-06-26 19:37:15 +02:00

pidhandle

Verify the ExecSession pid before killing it.

2025-05-06 06:24:13 +02:00

ps

Switch common, storage and image to monorepo.

2025-09-01 12:33:04 +02:00

rctl

pkg/rctl: fix fprintf statement

2025-03-31 12:27:55 -07:00

rootless

Switch common, storage and image to monorepo.

2025-09-01 12:33:04 +02:00

seccomp

pkg: switch to golang native error wrapping

2022-07-08 08:54:47 +02:00

selinux

…

signal

pkg/signal: ignore SIGTOP for signal proxy

2025-04-30 19:43:13 +02:00

specgen

Switch common, storage and image to monorepo.

2025-09-01 12:33:04 +02:00

specgenutil

Switch common, storage and image to monorepo.

2025-09-01 12:33:04 +02:00

specgenutilexternal

Allow not specifying type with --mount flag

2025-05-30 14:47:13 -04:00

syncmap

Add syncmap package and use it for graph stop/remove

2025-02-17 14:32:34 -05:00

systemd

Merge pull request #26932 from ogajduse/feature/quadlet-httpproxy-26925

2025-09-01 16:04:15 +00:00

terminal

Fix Lint on Windows and enable the job

2024-02-20 08:06:18 -05:00

trust

Switch common, storage and image to monorepo.

2025-09-01 12:33:04 +02:00

util

Switch common, storage and image to monorepo.

2025-09-01 12:33:04 +02:00