Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

volume,container: chroot to source before exporting content #17528

Merged
merged 1 commit into from
Feb 16, 2023
Merged

volume,container: chroot to source before exporting content #17528

merged 1 commit into from
Feb 16, 2023
+26 −3

Conversation

flouthoc
Copy link
Collaborator

@flouthoc flouthoc commented Feb 16, 2023 •
edited
Loading

  • Utils must support higher level API to create Tar with chrooted into directory
  • Volume export: use TarwithChroot instead of Tar so we can make sure no symlink can be exported by tar if it exists outside of the source directory.
  • container export: use chroot and Tar instead of Tar so we can make sure no symlink can be exported by tar if it exists outside of the mointPoint.

[NO NEW TESTS NEEDED]
[NO TESTS NEEDED]
Race needs combination of external/in-container mechanism which is hard to repro in CI.

See: https://access.redhat.com/security/cve/CVE-2023-0778
Closes BZ:#2168256

Does this PR introduce a user-facing change?

volume,container: `chroot` to source before exporting content ( BZ:#2168256, CVE-2023-0778 )

@openshift-ci openshift-ci bot added release-note approved Indicates a PR has been approved by an approver from all required OWNERS files. labels Feb 16, 2023
@flouthoc
Copy link
Collaborator Author

cc @mheon @TomSweeneyRedHat

@mheon
Copy link
Member

mheon commented Feb 16, 2023

Please mention CVE Number in the commit message and release notes.

@TomSweeneyRedHat
Copy link
Member

And the BZ number(s) please.

@flouthoc flouthoc force-pushed the volume-security-patch branch from 7ecfb53 to 41c2cae Compare February 16, 2023 13:55
@flouthoc
volume,container: chroot to source before exporting content
6ca857f 
* Utils must support higher level API to create Tar with chrooted into
  directory
* Volume export: use TarwithChroot instead of Tar so we can make sure no
  symlink can be exported by tar if it exists outside of the source
directory.
* container export: use chroot and Tar instead of Tar so we can make sure no
  symlink can be exported by tar if it exists outside of the mointPoint.

[NO NEW TESTS NEEDED]
[NO TESTS NEEDED]
Race needs combination of external/in-container mechanism which is hard to repro in CI.

Closes: BZ:#2168256
CVE: https://access.redhat.com/security/cve/CVE-2023-0778

Signed-off-by: Aditya R <[email protected]>
@flouthoc flouthoc force-pushed the volume-security-patch branch from 41c2cae to 6ca857f Compare February 16, 2023 13:56
@TomSweeneyRedHat
Copy link
Member

LGTM

@mheon
Copy link
Member

mheon commented Feb 16, 2023

LGTM
@containers/podman-maintainers PTAL

giuseppe
giuseppe approved these changes Feb 16, 2023
View reviewed changes
Copy link
Member

@giuseppe giuseppe left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@openshift-ci
Copy link
Contributor

openshift-ci bot commented Feb 16, 2023

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: flouthoc, giuseppe

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@mheon
Copy link
Member

mheon commented Feb 16, 2023

/lgtm
/hold

Complete list of cherry-pick branches:
v4.4 (upstream)
v4.4.1-rhel (https://bugzilla.redhat.com/show_bug.cgi?id=2169618)
v4.0-rhel (https://bugzilla.redhat.com/show_bug.cgi?id=2169617)
v3.0.1-rhel (https://bugzilla.redhat.com/show_bug.cgi?id=2169616)

@openshift-ci openshift-ci bot added the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Feb 16, 2023
@openshift-ci openshift-ci bot added the lgtm Indicates that a PR is ready to be merged. label Feb 16, 2023
@mheon
Copy link
Member

mheon commented Feb 16, 2023

@ashley-cui We're going to need a new upstream release off v4.4 today or tomorrow to get this landed.

@mheon
Copy link
Member

mheon commented Feb 16, 2023

Actually, scratch v3.0.1-rhel - the feature hadn't landed by then.

@TomSweeneyRedHat
Copy link
Member

And FWIW @ashley-cui best case scenario is to get the next spin of v4.4 completed by COB today, so we can have Jindrich build a test module overnight and get it into QE's hands early Friday afternoon their time. But, don't kill yourself for that, tomorrow would be OK if push came to shove.

@TomSweeneyRedHat
Copy link
Member

TomSweeneyRedHat commented Feb 16, 2023 •
edited
Loading

@flouthoc can you spin up a PR in the 4.4.1-rhel branch please?

@ashley-cui
Copy link
Member

@TomSweeneyRedHat I'll spin it up as soon as this PR merges and is cherry-picked into the v4.4 branch :)

@mheon
Copy link
Member

mheon commented Feb 16, 2023

@TomSweeneyRedHat @ashley-cui We don't do releases for RHEL. v4.4 is upstream - we're doing a v4.4.2 to get a release out to Fedora & Co. as soon as possible. Having the commit in v4.4.1 is sufficient.

@mheon
Copy link
Member

mheon commented Feb 16, 2023

Speaking of...

/cherry-pick v4.4.1-rhel
/cherry-pick v4.4
/cherry-pick v4.0-rhel

@openshift-cherrypick-robot
Copy link
Collaborator

@mheon: once the present PR merges, I will cherry-pick it on top of v4.4.1-rhel in a new PR and assign it to you.

In response to this:

Speaking of...

/cherry-pick v4.4.1-rhel
/cherry-pick v4.4
/cherry-pick v4.0-rhel

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

@mheon
Copy link
Member

mheon commented Feb 16, 2023

/hold cancel

@openshift-ci openshift-ci bot removed the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Feb 16, 2023
@openshift-merge-robot openshift-merge-robot merged commit e7616b4 into containers:main Feb 16, 2023
@openshift-cherrypick-robot
Copy link
Collaborator

@mheon: #17528 failed to apply on top of branch "v4.4.1-rhel":

Applying: volume,container: chroot to source before exporting content
Using index info to reconstruct a base tree...
M	libpod/container_internal.go
Falling back to patching base and 3-way merge...
Auto-merging libpod/container_internal.go
CONFLICT (content): Merge conflict in libpod/container_internal.go
error: Failed to merge in the changes.
hint: Use 'git am --show-current-patch=diff' to see the failed patch
Patch failed at 0001 volume,container: chroot to source before exporting content
When you have resolved this problem, run "git am --continue".
If you prefer to skip this patch, run "git am --skip" instead.
To restore the original branch and stop patching, run "git am --abort".

In response to this:

Speaking of...

/cherry-pick v4.4.1-rhel
/cherry-pick v4.4
/cherry-pick v4.0-rhel

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

@openshift-cherrypick-robot
Copy link
Collaborator

@mheon: #17528 failed to apply on top of branch "v4.4":

Applying: volume,container: chroot to source before exporting content
Using index info to reconstruct a base tree...
M	libpod/container_internal.go
Falling back to patching base and 3-way merge...
Auto-merging libpod/container_internal.go
CONFLICT (content): Merge conflict in libpod/container_internal.go
error: Failed to merge in the changes.
hint: Use 'git am --show-current-patch=diff' to see the failed patch
Patch failed at 0001 volume,container: chroot to source before exporting content
When you have resolved this problem, run "git am --continue".
If you prefer to skip this patch, run "git am --skip" instead.
To restore the original branch and stop patching, run "git am --abort".

In response to this:

Speaking of...

/cherry-pick v4.4.1-rhel
/cherry-pick v4.4
/cherry-pick v4.0-rhel

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

@openshift-cherrypick-robot
Copy link
Collaborator

@mheon: #17528 failed to apply on top of branch "v4.0-rhel":

Applying: volume,container: chroot to source before exporting content
Using index info to reconstruct a base tree...
M	libpod/container_internal.go
M	utils/utils.go
Falling back to patching base and 3-way merge...
Auto-merging utils/utils.go
Auto-merging libpod/container_internal.go
CONFLICT (content): Merge conflict in libpod/container_internal.go
error: Failed to merge in the changes.
hint: Use 'git am --show-current-patch=diff' to see the failed patch
Patch failed at 0001 volume,container: chroot to source before exporting content
When you have resolved this problem, run "git am --continue".
If you prefer to skip this patch, run "git am --skip" instead.
To restore the original branch and stop patching, run "git am --abort".

In response to this:

Speaking of...

/cherry-pick v4.4.1-rhel
/cherry-pick v4.4
/cherry-pick v4.0-rhel

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

@ashley-cui
Copy link
Member

ashley-cui commented Feb 16, 2023 •
edited
Loading

Looks like this needs to be manually cherry-picked as it doesn't apply cleanly :(

@mheon
Copy link
Member

mheon commented Feb 16, 2023

Import differences, eugh.

I'll take it.

@mheon mheon mentioned this pull request Feb 16, 2023
Merged
@mheon
Copy link
Member

mheon commented Feb 16, 2023

#17532

@mheon mheon mentioned this pull request Feb 16, 2023
Merged
@mheon
Copy link
Member

mheon commented Feb 16, 2023

#17533

@mheon mheon mentioned this pull request Feb 16, 2023
Merged
@mheon
Copy link
Member

mheon commented Feb 16, 2023

#17535

@TomSweeneyRedHat
Copy link
Member

TY, TY @mheon

openshift-merge-robot added a commit that referenced this pull request Feb 16, 2023
@openshift-merge-robot
Merge pull request #17535 from mheon/backport_17528_40rhel
d54ecc8 
[v4.0-rhel] Backport #17528
openshift-merge-robot added a commit that referenced this pull request Feb 17, 2023
@openshift-merge-robot
Merge pull request #17532 from mheon/backport_17528_44
f17495e 
Backport #17528 to v4.4
openshift-merge-robot added a commit that referenced this pull request Feb 17, 2023
@openshift-merge-robot
Merge pull request #17533 from mheon/backport_17528_441rhel
ca30f81 
[v4.4.1-rhel] Backport #17528
doanac pushed a commit to lmp-mirrors/meta-virtualization that referenced this pull request Aug 1, 2023
@petermarko @zeddii
podman: ignore CVE-2022-2989 and CVE-2023-0778
07a578d 
NVD shows only redhat links and does not mention fixed-in release
se these CVEs will show-up in reports indefinitely.
They are already fixed in current version, so ignore them.

CVE-2022-2989
* GHSA-4wjj-jwc9-2x96
* containers/podman#15618
* commit d82a41687e614d9ac8b2d169dee47fe226835e4c Add container GID to additional groups

CVE-2023-0778
* GHSA-qwqv-rqgf-8qh8
* containers/podman#17528
* commit 6ca857feb07a5fdc96fd947afef03916291673d8 volume,container: chroot to source before exporting content

Signed-off-by: Peter Marko <[email protected]>
@github-actions github-actions bot added the locked - please file new issue/PR Assist humans wanting to comment on an old issue or PR with locked comments. label Sep 9, 2023
@github-actions github-actions bot locked as resolved and limited conversation to collaborators Sep 9, 2023
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Reviewers

@giuseppe giuseppe giuseppe approved these changes

Assignees

@mheon mheon

Labels
approved Indicates a PR has been approved by an approver from all required OWNERS files. lgtm Indicates that a PR is ready to be merged. locked - please file new issue/PR Assist humans wanting to comment on an old issue or PR with locked comments. release-note
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
7 participants
@flouthoc @mheon @TomSweeneyRedHat @ashley-cui @openshift-cherrypick-robot @giuseppe @openshift-merge-robot