|
1 | | -From 8716daa06e9eb421438b338f18b6b650b082b208 Mon Sep 17 00:00:00 2001 |
2 | | -From: Cameron Baird <cameronbaird@microsoft.com> |
3 | | -Date: Tue, 16 Apr 2024 22:33:46 +0000 |
4 | | -Subject: [PATCH 4/4] CVE-2021-3602 |
5 | | - |
6 | | ---- |
7 | | - .../github.com/containers/buildah/chroot/run.go | 15 +++++---------- |
8 | | - .../podman/v3/pkg/specgen/generate/security.go | 7 +++++-- |
9 | | - 2 files changed, 10 insertions(+), 12 deletions(-) |
10 | | - |
11 | | -diff --git a/vendor/github.com/containers/buildah/chroot/run.go b/vendor/github.com/containers/buildah/chroot/run.go |
12 | | -index a93f97dcd..643f5c91d 100644 |
13 | | ---- a/vendor/github.com/containers/buildah/chroot/run.go |
14 | | -+++ b/vendor/github.com/containers/buildah/chroot/run.go |
15 | | -@@ -160,7 +160,7 @@ func RunUsingChroot(spec *specs.Spec, bundlePath, homeDir string, stdin io.Reade |
16 | | - cmd := unshare.Command(runUsingChrootCommand) |
17 | | - cmd.Stdin, cmd.Stdout, cmd.Stderr = stdin, stdout, stderr |
18 | | - cmd.Dir = "/" |
19 | | -- cmd.Env = append([]string{fmt.Sprintf("LOGLEVEL=%d", logrus.GetLevel())}, os.Environ()...) |
20 | | -+ cmd.Env = []string{fmt.Sprintf("LOGLEVEL=%d", logrus.GetLevel())} |
21 | | - |
22 | | - logrus.Debugf("Running %#v in %#v", cmd.Cmd, cmd) |
23 | | - confwg.Add(1) |
24 | | -@@ -206,7 +206,7 @@ func runUsingChrootMain() { |
25 | | - os.Exit(1) |
26 | | - } |
27 | | - |
28 | | -- if options.Spec == nil { |
29 | | -+ if options.Spec == nil || options.Spec.Process == nil { |
30 | | - fmt.Fprintf(os.Stderr, "invalid options spec in runUsingChrootMain\n") |
31 | | - os.Exit(1) |
32 | | - } |
33 | | -@@ -572,7 +572,7 @@ func runUsingChroot(spec *specs.Spec, bundlePath string, ctty *os.File, stdin io |
34 | | - cmd := unshare.Command(append([]string{runUsingChrootExecCommand}, spec.Process.Args...)...) |
35 | | - cmd.Stdin, cmd.Stdout, cmd.Stderr = stdin, stdout, stderr |
36 | | - cmd.Dir = "/" |
37 | | -- cmd.Env = append([]string{fmt.Sprintf("LOGLEVEL=%d", logrus.GetLevel())}, os.Environ()...) |
38 | | -+ cmd.Env = []string{fmt.Sprintf("LOGLEVEL=%d", logrus.GetLevel())} |
39 | | - cmd.UnshareFlags = syscall.CLONE_NEWUTS | syscall.CLONE_NEWNS |
40 | | - requestedUserNS := false |
41 | | - for _, ns := range spec.Linux.Namespaces { |
42 | | -@@ -662,7 +662,7 @@ func runUsingChrootExecMain() { |
43 | | - // Set the hostname. We're already in a distinct UTS namespace and are admins in the user |
44 | | - // namespace which created it, so we shouldn't get a permissions error, but seccomp policy |
45 | | - // might deny our attempt to call sethostname() anyway, so log a debug message for that. |
46 | | -- if options.Spec == nil { |
47 | | -+ if options.Spec == nil || options.Spec.Process == nil { |
48 | | - fmt.Fprintf(os.Stderr, "invalid options spec passed in\n") |
49 | | - os.Exit(1) |
50 | | - } |
51 | | -@@ -818,7 +818,6 @@ func runUsingChrootExecMain() { |
52 | | - // Output debug messages when that differs from what we're being asked to do. |
53 | | - func logNamespaceDiagnostics(spec *specs.Spec) { |
54 | | - sawMountNS := false |
55 | | -- sawUserNS := false |
56 | | - sawUTSNS := false |
57 | | - for _, ns := range spec.Linux.Namespaces { |
58 | | - switch ns.Type { |
59 | | -@@ -853,9 +852,8 @@ func logNamespaceDiagnostics(spec *specs.Spec) { |
60 | | - } |
61 | | - case specs.UserNamespace: |
62 | | - if ns.Path != "" { |
63 | | -- logrus.Debugf("unable to join user namespace %q, creating a new one", ns.Path) |
64 | | -+ logrus.Debugf("unable to join user namespace, sorry about that") |
65 | | - } |
66 | | -- sawUserNS = true |
67 | | - case specs.UTSNamespace: |
68 | | - if ns.Path != "" { |
69 | | - logrus.Debugf("unable to join UTS namespace %q, creating a new one", ns.Path) |
70 | | -@@ -866,9 +864,6 @@ func logNamespaceDiagnostics(spec *specs.Spec) { |
71 | | - if !sawMountNS { |
72 | | - logrus.Debugf("mount namespace not requested, but creating a new one anyway") |
73 | | - } |
74 | | -- if !sawUserNS { |
75 | | -- logrus.Debugf("user namespace not requested, but creating a new one anyway") |
76 | | -- } |
77 | | - if !sawUTSNS { |
78 | | - logrus.Debugf("UTS namespace not requested, but creating a new one anyway") |
79 | | - } |
80 | 1 | diff --git a/vendor/github.com/containers/podman/v3/pkg/specgen/generate/security.go b/vendor/github.com/containers/podman/v3/pkg/specgen/generate/security.go |
81 | 2 | index e0e4a47a4..3cda89a32 100644 |
82 | 3 | --- a/vendor/github.com/containers/podman/v3/pkg/specgen/generate/security.go |
|
0 commit comments