Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Add container GID to additional groups #15618

Merged
merged 1 commit into from
Sep 4, 2022
Merged

Add container GID to additional groups #15618

merged 1 commit into from
Sep 4, 2022

Conversation

mheon
Copy link
Member

@mheon mheon commented Sep 2, 2022

Mitigates a potential permissions issue. Mirrors containers/buildah#4200 and https://github.com/cri-o/cri-o/pull/6159/files

NONE

@openshift-ci
Copy link
Contributor

openshift-ci bot commented Sep 2, 2022

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: mheon

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@openshift-ci openshift-ci bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Sep 2, 2022
@mheon mheon force-pushed the add_group_to_addtlgroups branch 2 times, most recently from 4fe223a to 7e6616f Compare September 2, 2022 19:50
@mheon
Add container GID to additional groups
d82a416 
Mitigates a potential permissions issue. Mirrors Buildah PR containers#4200
and CRI-O PR containers#6159.

Signed-off-by: Matthew Heon <[email protected]>
@mheon mheon force-pushed the add_group_to_addtlgroups branch from 7e6616f to d82a416 Compare September 2, 2022 19:51
TomSweeneyRedHat
TomSweeneyRedHat reviewed Sep 2, 2022
View reviewed changes
Copy link
Member

@TomSweeneyRedHat TomSweeneyRedHat left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@baude
Copy link
Member

baude commented Sep 4, 2022

/lgtm

@openshift-ci openshift-ci bot added the lgtm Indicates that a PR is ready to be merged. label Sep 4, 2022
@openshift-merge-robot openshift-merge-robot merged commit 5c7f283 into containers:main Sep 4, 2022
@mheon
Copy link
Member Author

mheon commented Sep 6, 2022

/cherry-pick v4.2.0-rhel v3.0.1-rhel

@openshift-cherrypick-robot
Copy link
Collaborator

@mheon: cannot checkout v4.2.0-rhel v3.0.1-rhel: error checking out v4.2.0-rhel v3.0.1-rhel: exit status 1. output: error: pathspec 'v4.2.0-rhel v3.0.1-rhel' did not match any file(s) known to git

In response to this:

/cherry-pick v4.2.0-rhel v3.0.1-rhel

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

@mheon
Copy link
Member Author

mheon commented Sep 6, 2022

/cherry-pick v4.2.0-rhel

@mheon
Copy link
Member Author

mheon commented Sep 6, 2022

/cherry-pick v3.0.1-rhel

@openshift-cherrypick-robot openshift-cherrypick-robot mentioned this pull request Sep 6, 2022
Closed
@openshift-cherrypick-robot
Copy link
Collaborator

@mheon: new pull request created: #15656

In response to this:

/cherry-pick v4.2.0-rhel

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

@openshift-cherrypick-robot
Copy link
Collaborator

@mheon: #15618 failed to apply on top of branch "v3.0.1-rhel":

Applying: Add container GID to additional groups
Using index info to reconstruct a base tree...
M	libpod/container_internal_linux.go
M	pkg/specgen/namespaces.go
M	test/e2e/run_test.go
Falling back to patching base and 3-way merge...
Auto-merging test/e2e/run_test.go
CONFLICT (content): Merge conflict in test/e2e/run_test.go
Auto-merging pkg/specgen/namespaces.go
CONFLICT (content): Merge conflict in pkg/specgen/namespaces.go
Auto-merging libpod/container_internal_linux.go
error: Failed to merge in the changes.
hint: Use 'git am --show-current-patch=diff' to see the failed patch
Patch failed at 0001 Add container GID to additional groups
When you have resolved this problem, run "git am --continue".
If you prefer to skip this patch, run "git am --skip" instead.
To restore the original branch and stop patching, run "git am --abort".

In response to this:

/cherry-pick v3.0.1-rhel

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

@mheon
Copy link
Member Author

mheon commented Sep 8, 2022

/cherry-pick v4.2.0-rhel

@openshift-cherrypick-robot openshift-cherrypick-robot mentioned this pull request Sep 8, 2022
Merged
@openshift-cherrypick-robot
Copy link
Collaborator

@mheon: new pull request created: #15696

In response to this:

/cherry-pick v4.2.0-rhel

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

algitbot pushed a commit to alpinelinux/aports that referenced this pull request Nov 3, 2022
@J0WI
community/podman: update secfixes
8fcbb9d 
CVE-2022-2989 is fixed by containers/podman#15618.
See: https://nvd.nist.gov/vuln/detail/CVE-2022-2989
@mheon
Copy link
Member Author

mheon commented Feb 3, 2023

/cherry-pick v4.0-rhel

@openshift-cherrypick-robot
Copy link
Collaborator

@mheon: #15618 failed to apply on top of branch "v4.0-rhel":

Applying: Add container GID to additional groups
Using index info to reconstruct a base tree...
M	libpod/container_internal_linux.go
M	pkg/specgen/namespaces.go
M	test/e2e/run_test.go
Falling back to patching base and 3-way merge...
Auto-merging test/e2e/run_test.go
Auto-merging pkg/specgen/namespaces.go
CONFLICT (content): Merge conflict in pkg/specgen/namespaces.go
Auto-merging libpod/container_internal_linux.go
error: Failed to merge in the changes.
hint: Use 'git am --show-current-patch=diff' to see the failed patch
Patch failed at 0001 Add container GID to additional groups
When you have resolved this problem, run "git am --continue".
If you prefer to skip this patch, run "git am --skip" instead.
To restore the original branch and stop patching, run "git am --abort".

In response to this:

/cherry-pick v4.0-rhel

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

@mheon mheon mentioned this pull request Feb 3, 2023
Merged
openshift-merge-robot added a commit that referenced this pull request Feb 3, 2023
@openshift-merge-robot
Merge pull request #17357 from mheon/15618_40rhel
ccfe4dd 
Backport #15618 to v4.0-rhel
doanac pushed a commit to lmp-mirrors/meta-virtualization that referenced this pull request Aug 1, 2023
@petermarko @zeddii
podman: ignore CVE-2022-2989 and CVE-2023-0778
07a578d 
NVD shows only redhat links and does not mention fixed-in release
se these CVEs will show-up in reports indefinitely.
They are already fixed in current version, so ignore them.

CVE-2022-2989
* GHSA-4wjj-jwc9-2x96
* containers/podman#15618
* commit d82a41687e614d9ac8b2d169dee47fe226835e4c Add container GID to additional groups

CVE-2023-0778
* GHSA-qwqv-rqgf-8qh8
* containers/podman#17528
* commit 6ca857feb07a5fdc96fd947afef03916291673d8 volume,container: chroot to source before exporting content

Signed-off-by: Peter Marko <[email protected]>
@github-actions github-actions bot added the locked - please file new issue/PR Assist humans wanting to comment on an old issue or PR with locked comments. label Sep 12, 2023
@github-actions github-actions bot locked as resolved and limited conversation to collaborators Sep 12, 2023
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Reviewers

@TomSweeneyRedHat TomSweeneyRedHat TomSweeneyRedHat left review comments

Assignees

@baude baude

Labels
approved Indicates a PR has been approved by an approver from all required OWNERS files. lgtm Indicates that a PR is ready to be merged. locked - please file new issue/PR Assist humans wanting to comment on an old issue or PR with locked comments. release-note-none
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
5 participants
@mheon @baude @openshift-cherrypick-robot @TomSweeneyRedHat @openshift-merge-robot