summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorOpenShift Merge Robot <openshift-merge-robot@users.noreply.github.com>2019-03-11 17:56:51 -0700
committerGitHub <noreply@github.com>2019-03-11 17:56:51 -0700
commitdec36f2d0b940f7c144dd5617b3cb5bd31fd2bc5 (patch)
tree5f7c5204a19b8c7d2d68a9b2239adbbb0768a2ab
parent1466c8a2f8020c5cc1541348f5f6533239f94136 (diff)
parent66a72d9283475770707adc3f2be04a3b48635fd7 (diff)
downloadpodman-dec36f2d0b940f7c144dd5617b3cb5bd31fd2bc5.tar.gz
podman-dec36f2d0b940f7c144dd5617b3cb5bd31fd2bc5.tar.bz2
podman-dec36f2d0b940f7c144dd5617b3cb5bd31fd2bc5.zip
Merge pull request #2593 from mheon/scrub_tmpfs_links
Ensure that tmpfs mounts do not have symlinks
-rw-r--r--libpod/container_internal_linux.go13
1 files changed, 13 insertions, 0 deletions
diff --git a/libpod/container_internal_linux.go b/libpod/container_internal_linux.go
index c9f35dd75..3f3b22b6b 100644
--- a/libpod/container_internal_linux.go
+++ b/libpod/container_internal_linux.go
@@ -26,6 +26,7 @@ import (
"github.com/containers/libpod/pkg/resolvconf"
"github.com/containers/libpod/pkg/rootless"
"github.com/containers/storage/pkg/idtools"
+ "github.com/cyphar/filepath-securejoin"
"github.com/opencontainers/runc/libcontainer/user"
spec "github.com/opencontainers/runtime-spec/specs-go"
"github.com/opencontainers/runtime-tools/generate"
@@ -366,6 +367,18 @@ func (c *Container) generateSpec(ctx context.Context) (*spec.Spec, error) {
// For private volumes any root propagation value should work.
rootPropagation := ""
for _, m := range mounts {
+ // We need to remove all symlinks from tmpfs mounts.
+ // Runc and other runtimes may choke on them.
+ // Easy solution: use securejoin to do a scoped evaluation of
+ // the links, then trim off the mount prefix.
+ if m.Type == "tmpfs" {
+ finalPath, err := securejoin.SecureJoin(c.state.Mountpoint, m.Destination)
+ if err != nil {
+ return nil, errors.Wrapf(err, "error resolving symlinks for mount destination %s", m.Destination)
+ }
+ trimmedPath := strings.TrimPrefix(finalPath, strings.TrimSuffix(c.state.Mountpoint, "/"))
+ m.Destination = trimmedPath
+ }
g.AddMount(m)
for _, opt := range m.Options {
switch opt {