diff options
| author | OpenShift Merge Robot <openshift-merge-robot@users.noreply.github.com> | 2018-10-05 11:19:48 -0700 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2018-10-05 11:19:48 -0700 |
| commit | 260357cf8b8ddb8b85781a753b952b3392873c09 (patch) | |
| tree | 77a1be42f9f4b77f6d91e712ab4e7fe5ff321bbc /cmd/podman/runlabel.go | |
| parent | 550270364bb533f29742534ff31e15cbf54c57da (diff) | |
| parent | d4eca12cc12734f2b578e1b1967d69889c21c487 (diff) | |
| download | podman-260357cf8b8ddb8b85781a753b952b3392873c09.tar.gz podman-260357cf8b8ddb8b85781a753b952b3392873c09.tar.bz2 podman-260357cf8b8ddb8b85781a753b952b3392873c09.zip | |
Merge pull request #1594 from vrothberg/runlabel
runlabel: execute /proc/self/exe and avoid recursion
Diffstat (limited to 'cmd/podman/runlabel.go')
| -rw-r--r-- | cmd/podman/runlabel.go | 9 |
1 files changed, 9 insertions, 0 deletions
diff --git a/cmd/podman/runlabel.go b/cmd/podman/runlabel.go index c5dd98ee6..34e6b9093 100644 --- a/cmd/podman/runlabel.go +++ b/cmd/podman/runlabel.go @@ -94,6 +94,14 @@ func runlabelCmd(c *cli.Context) error { newImage *image.Image ) + // Evil images could trick into recursively executing the runlabel + // command. Avoid this by setting the "PODMAN_RUNLABEL_NESTED" env + // variable when executing a label first. + nested := os.Getenv("PODMAN_RUNLABEL_NESTED") + if nested == "1" { + return fmt.Errorf("nested runlabel calls: runlabels cannot execute the runlabel command") + } + opts := make(map[string]string) runtime, err := libpodruntime.GetRuntime(c) if err != nil { @@ -177,6 +185,7 @@ func runlabelCmd(c *cli.Context) error { cmd := shared.GenerateCommand(runLabel, imageName, c.String("name")) env := shared.GenerateRunEnvironment(c.String("name"), imageName, opts) + env = append(env, "PODMAN_RUNLABEL_NESTED=1") if !c.Bool("quiet") { fmt.Printf("Command: %s\n", strings.Join(cmd, " ")) |