Skip to content

Commit 09de135

Browse files
mtrmacmtrmac
authored
Merge pull request #448 from mtrmac/securejoin
Update github.com/cyphar/filepath-securejoin to v0.6.0 and github.com/opencontainers/runc to v1.3.3
2 parents 97d630e + 2b18be9 commit 09de135

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

80 files changed

+5918
-1154
lines changed

‎common/go.mod‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,7 @@ require (
1313
github.com/containernetworking/plugins v1.8.0
1414
github.com/containers/ocicrypt v1.2.1
1515
github.com/coreos/go-systemd/v22 v22.6.0
16-
github.com/cyphar/filepath-securejoin v0.4.1
16+
github.com/cyphar/filepath-securejoin v0.6.0
1717
github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc
1818
github.com/disiqueira/gotree/v3 v3.0.2
1919
github.com/docker/distribution v2.8.3+incompatible
@@ -29,7 +29,7 @@ require (
2929
github.com/opencontainers/cgroups v0.0.6
3030
github.com/opencontainers/go-digest v1.0.0
3131
github.com/opencontainers/image-spec v1.1.1
32-
github.com/opencontainers/runc v1.3.2
32+
github.com/opencontainers/runc v1.3.3
3333
github.com/opencontainers/runtime-spec v1.2.1
3434
github.com/opencontainers/runtime-tools v0.9.1-0.20250523060157-0ea5ed0382a2
3535
github.com/opencontainers/selinux v1.12.0
@@ -54,6 +54,7 @@ require (
5454
)
5555

5656
require (
57+
cyphar.com/go-pathrs v0.2.1 // indirect
5758
dario.cat/mergo v1.0.2 // indirect
5859
github.com/Azure/go-ansiterm v0.0.0-20250102033503-faa5f7b0171c // indirect
5960
github.com/Masterminds/semver/v3 v3.4.0 // indirect

‎common/go.sum‎

Lines changed: 6 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,5 @@
1+
cyphar.com/go-pathrs v0.2.1 h1:9nx1vOgwVvX1mNBWDu93+vaceedpbsDqo+XuBGL40b8=
2+
cyphar.com/go-pathrs v0.2.1/go.mod h1:y8f1EMG7r+hCuFf/rXsKqMJrJAUoADZGNh5/vZPKcGc=
13
dario.cat/mergo v1.0.2 h1:85+piFYR1tMbRrLcDwR18y4UKJ3aH1Tbzi24VRW1TK8=
24
dario.cat/mergo v1.0.2/go.mod h1:E/hbnu0NxMFBjpMIE34DRGLWqDy0g5FuKDhCb31ngxA=
35
github.com/Azure/go-ansiterm v0.0.0-20250102033503-faa5f7b0171c h1:udKWzYgxTojEKWjV8V+WSxDXJ4NFATAsZjh8iIbsQIg=
@@ -60,8 +62,8 @@ github.com/coreos/go-systemd/v22 v22.6.0/go.mod h1:iG+pp635Fo7ZmV/j14KUcmEyWF+0X
6062
github.com/cpuguy83/go-md2man/v2 v2.0.6/go.mod h1:oOW0eioCTA6cOiMLiUPZOpcVxMig6NIQQ7OS05n1F4g=
6163
github.com/cyberphone/json-canonicalization v0.0.0-20241213102144-19d51d7fe467 h1:uX1JmpONuD549D73r6cgnxyUu18Zb7yHAy5AYU0Pm4Q=
6264
github.com/cyberphone/json-canonicalization v0.0.0-20241213102144-19d51d7fe467/go.mod h1:uzvlm1mxhHkdfqitSA92i7Se+S9ksOn3a3qmv/kyOCw=
63-
github.com/cyphar/filepath-securejoin v0.4.1 h1:JyxxyPEaktOD+GAnqIqTf9A8tHyAG22rowi7HkoSU1s=
64-
github.com/cyphar/filepath-securejoin v0.4.1/go.mod h1:Sdj7gXlvMcPZsbhwhQ33GguGLDGQL7h7bg04C/+u9jI=
65+
github.com/cyphar/filepath-securejoin v0.6.0 h1:BtGB77njd6SVO6VztOHfPxKitJvd/VPT+OFBFMOi1Is=
66+
github.com/cyphar/filepath-securejoin v0.6.0/go.mod h1:A8hd4EnAeyujCJRrICiOWqjS1AX0a9kM5XL+NwKoYSc=
6567
github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
6668
github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
6769
github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc h1:U9qPSI2PIWSS1VwoXQT9A3Wy9MM3WgvqSxFWenqJduM=
@@ -204,8 +206,8 @@ github.com/opencontainers/go-digest v1.0.0 h1:apOUWs51W5PlhuyGyz9FCeeBIOUDA/6nW8
204206
github.com/opencontainers/go-digest v1.0.0/go.mod h1:0JzlMkj0TRzQZfJkVvzbP0HBR3IKzErnv2BNG4W4MAM=
205207
github.com/opencontainers/image-spec v1.1.1 h1:y0fUlFfIZhPF1W537XOLg0/fcx6zcHCJwooC2xJA040=
206208
github.com/opencontainers/image-spec v1.1.1/go.mod h1:qpqAh3Dmcf36wStyyWU+kCeDgrGnAve2nCC8+7h8Q0M=
207-
github.com/opencontainers/runc v1.3.2 h1:GUwgo0Fx9M/pl2utaSYlJfdBcXAB/CZXDxe322lvJ3Y=
208-
github.com/opencontainers/runc v1.3.2/go.mod h1:F7UQQEsxcjUNnFpT1qPLHZBKYP7yWwk6hq8suLy9cl0=
209+
github.com/opencontainers/runc v1.3.3 h1:qlmBbbhu+yY0QM7jqfuat7M1H3/iXjju3VkP9lkFQr4=
210+
github.com/opencontainers/runc v1.3.3/go.mod h1:D7rL72gfWxVs9cJ2/AayxB0Hlvn9g0gaF1R7uunumSI=
209211
github.com/opencontainers/runtime-spec v1.2.1 h1:S4k4ryNgEpxW1dzyqffOmhI1BHYcjzU8lpJfSlR0xww=
210212
github.com/opencontainers/runtime-spec v1.2.1/go.mod h1:jwyrGlmzljRJv/Fgzds9SsS/C5hL+LL3ko9hs6T5lQ0=
211213
github.com/opencontainers/runtime-tools v0.9.1-0.20250523060157-0ea5ed0382a2 h1:2xZEHOdeQBV6PW8ZtimN863bIOl7OCW/X10K0cnxKeA=

‎image/go.mod‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -58,7 +58,7 @@ require (
5858
github.com/containerd/log v0.1.0 // indirect
5959
github.com/containerd/stargz-snapshotter/estargz v0.18.1 // indirect
6060
github.com/coreos/go-oidc/v3 v3.14.1 // indirect
61-
github.com/cyphar/filepath-securejoin v0.4.1 // indirect
61+
github.com/cyphar/filepath-securejoin v0.6.0 // indirect
6262
github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
6363
github.com/docker/go-metrics v0.0.1 // indirect
6464
github.com/docker/go-units v0.5.0 // indirect

‎image/go.sum‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -49,8 +49,8 @@ github.com/coreos/go-oidc/v3 v3.14.1 h1:9ePWwfdwC4QKRlCXsJGou56adA/owXczOzwKdOum
4949
github.com/coreos/go-oidc/v3 v3.14.1/go.mod h1:HaZ3szPaZ0e4r6ebqvsLWlk2Tn+aejfmrfah6hnSYEU=
5050
github.com/cyberphone/json-canonicalization v0.0.0-20241213102144-19d51d7fe467 h1:uX1JmpONuD549D73r6cgnxyUu18Zb7yHAy5AYU0Pm4Q=
5151
github.com/cyberphone/json-canonicalization v0.0.0-20241213102144-19d51d7fe467/go.mod h1:uzvlm1mxhHkdfqitSA92i7Se+S9ksOn3a3qmv/kyOCw=
52-
github.com/cyphar/filepath-securejoin v0.4.1 h1:JyxxyPEaktOD+GAnqIqTf9A8tHyAG22rowi7HkoSU1s=
53-
github.com/cyphar/filepath-securejoin v0.4.1/go.mod h1:Sdj7gXlvMcPZsbhwhQ33GguGLDGQL7h7bg04C/+u9jI=
52+
github.com/cyphar/filepath-securejoin v0.6.0 h1:BtGB77njd6SVO6VztOHfPxKitJvd/VPT+OFBFMOi1Is=
53+
github.com/cyphar/filepath-securejoin v0.6.0/go.mod h1:A8hd4EnAeyujCJRrICiOWqjS1AX0a9kM5XL+NwKoYSc=
5454
github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
5555
github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
5656
github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc h1:U9qPSI2PIWSS1VwoXQT9A3Wy9MM3WgvqSxFWenqJduM=

‎storage/go.mod‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@ module go.podman.io/storage
77
require (
88
github.com/BurntSushi/toml v1.5.0
99
github.com/containerd/stargz-snapshotter/estargz v0.18.1
10-
github.com/cyphar/filepath-securejoin v0.4.1
10+
github.com/cyphar/filepath-securejoin v0.6.0
1111
github.com/docker/go-units v0.5.0
1212
github.com/google/go-intervals v0.0.2
1313
github.com/json-iterator/go v1.1.12
@@ -32,6 +32,7 @@ require (
3232
)
3333

3434
require (
35+
cyphar.com/go-pathrs v0.2.1 // indirect
3536
github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
3637
github.com/google/go-cmp v0.7.0 // indirect
3738
github.com/google/uuid v1.6.0 // indirect

‎storage/go.sum‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,12 @@
1+
cyphar.com/go-pathrs v0.2.1 h1:9nx1vOgwVvX1mNBWDu93+vaceedpbsDqo+XuBGL40b8=
2+
cyphar.com/go-pathrs v0.2.1/go.mod h1:y8f1EMG7r+hCuFf/rXsKqMJrJAUoADZGNh5/vZPKcGc=
13
github.com/BurntSushi/toml v1.5.0 h1:W5quZX/G/csjUnuI8SUYlsHs9M38FC7znL0lIO+DvMg=
24
github.com/BurntSushi/toml v1.5.0/go.mod h1:ukJfTF/6rtPPRCnwkur4qwRxa8vTRFBF0uk2lLoLwho=
35
github.com/containerd/stargz-snapshotter/estargz v0.18.1 h1:cy2/lpgBXDA3cDKSyEfNOFMA/c10O1axL69EU7iirO8=
46
github.com/containerd/stargz-snapshotter/estargz v0.18.1/go.mod h1:ALIEqa7B6oVDsrF37GkGN20SuvG/pIMm7FwP7ZmRb0Q=
57
github.com/creack/pty v1.1.9/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ33E=
6-
github.com/cyphar/filepath-securejoin v0.4.1 h1:JyxxyPEaktOD+GAnqIqTf9A8tHyAG22rowi7HkoSU1s=
7-
github.com/cyphar/filepath-securejoin v0.4.1/go.mod h1:Sdj7gXlvMcPZsbhwhQ33GguGLDGQL7h7bg04C/+u9jI=
8+
github.com/cyphar/filepath-securejoin v0.6.0 h1:BtGB77njd6SVO6VztOHfPxKitJvd/VPT+OFBFMOi1Is=
9+
github.com/cyphar/filepath-securejoin v0.6.0/go.mod h1:A8hd4EnAeyujCJRrICiOWqjS1AX0a9kM5XL+NwKoYSc=
810
github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
911
github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
1012
github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc h1:U9qPSI2PIWSS1VwoXQT9A3Wy9MM3WgvqSxFWenqJduM=

‎storage/pkg/chunked/storage_linux.go‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,7 @@ import (
1818
"syscall"
1919

2020
"github.com/containerd/stargz-snapshotter/estargz"
21-
securejoin "github.com/cyphar/filepath-securejoin"
21+
"github.com/cyphar/filepath-securejoin/pathrs-lite"
2222
jsoniter "github.com/json-iterator/go"
2323
"github.com/klauspost/compress/zstd"
2424
"github.com/klauspost/pgzip"
@@ -2040,10 +2040,10 @@ func (fg *stagedFileGetter) Get(filename string) (io.ReadCloser, error) {
20402040
}
20412041
filename = path
20422042
}
2043-
pathFD, err := securejoin.OpenatInRoot(fg.rootDir, filename)
2043+
pathFD, err := pathrs.OpenatInRoot(fg.rootDir, filename)
20442044
if err != nil {
20452045
return nil, err
20462046
}
20472047
defer pathFD.Close()
2048-
return securejoin.Reopen(pathFD, unix.O_RDONLY)
2048+
return pathrs.Reopen(pathFD, unix.O_RDONLY)
20492049
}

‎storage/userns.go‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@ import (
88
"os/user"
99
"strconv"
1010

11-
securejoin "github.com/cyphar/filepath-securejoin"
11+
pathrs "github.com/cyphar/filepath-securejoin/pathrs-lite"
1212
libcontainerUser "github.com/moby/sys/user"
1313
"github.com/sirupsen/logrus"
1414
drivers "go.podman.io/storage/drivers"
@@ -331,11 +331,11 @@ func getAutoUserNSIDMappings(
331331

332332
// Securely open (read-only) a file in a container mount.
333333
func secureOpen(containerMount, file string) (*os.File, error) {
334-
tmpFile, err := securejoin.OpenInRoot(containerMount, file)
334+
tmpFile, err := pathrs.OpenInRoot(containerMount, file)
335335
if err != nil {
336336
return nil, err
337337
}
338338
defer tmpFile.Close()
339339

340-
return securejoin.Reopen(tmpFile, unix.O_RDONLY)
340+
return pathrs.Reopen(tmpFile, unix.O_RDONLY)
341341
}

‎vendor/cyphar.com/go-pathrs/.golangci.yml‎

Lines changed: 43 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

0 commit comments

Comments
 (0)