From fb353f6f421656cafba05a885c921ca73daa5d70 Mon Sep 17 00:00:00 2001
From: Giuseppe Scrivano <gscrivan@redhat.com>
Date: Sat, 21 Sep 2019 15:45:55 +0200
Subject: execuser: look at the source for /etc/{passwd,group} overrides

look if there are bind mounts that can shadow the /etc/passwd and
/etc/group files.  In that case, look at the bind mount source.

Closes: https://github.com/containers/libpod/pull/4068#issuecomment-533782941

Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
---
 pkg/lookup/lookup.go | 30 +++++++++++++++++-------------
 1 file changed, 17 insertions(+), 13 deletions(-)

(limited to 'pkg')

diff --git a/pkg/lookup/lookup.go b/pkg/lookup/lookup.go
index 70b97144f..a249dd753 100644
--- a/pkg/lookup/lookup.go
+++ b/pkg/lookup/lookup.go
@@ -29,17 +29,30 @@ func GetUserGroupInfo(containerMount, containerUser string, override *Overrides)
 		defaultExecUser       *user.ExecUser
 		err                   error
 	)
-	passwdPath := etcpasswd
-	groupPath := etcgroup
 
 	if override != nil {
 		// Check for an override /etc/passwd path
 		if override.ContainerEtcPasswdPath != "" {
-			passwdPath = override.ContainerEtcPasswdPath
+			passwdDest = override.ContainerEtcPasswdPath
 		}
 		// Check for an override for /etc/group path
 		if override.ContainerEtcGroupPath != "" {
-			groupPath = override.ContainerEtcGroupPath
+			groupDest = override.ContainerEtcGroupPath
+		}
+	}
+
+	if passwdDest == "" {
+		// Make sure the /etc/passwd destination is not a symlink to something naughty
+		if passwdDest, err = securejoin.SecureJoin(containerMount, etcpasswd); err != nil {
+			logrus.Debug(err)
+			return nil, err
+		}
+	}
+	if groupDest == "" {
+		// Make sure the /etc/group destination is not a symlink to something naughty
+		if groupDest, err = securejoin.SecureJoin(containerMount, etcgroup); err != nil {
+			logrus.Debug(err)
+			return nil, err
 		}
 	}
 
@@ -56,15 +69,6 @@ func GetUserGroupInfo(containerMount, containerUser string, override *Overrides)
 
 	}
 
-	// Make sure the /etc/group  and /etc/passwd destinations are not a symlink to something naughty
-	if passwdDest, err = securejoin.SecureJoin(containerMount, passwdPath); err != nil {
-		logrus.Debug(err)
-		return nil, err
-	}
-	if groupDest, err = securejoin.SecureJoin(containerMount, groupPath); err != nil {
-		logrus.Debug(err)
-		return nil, err
-	}
 	return user.GetExecUserPath(containerUser, defaultExecUser, passwdDest, groupDest)
 }
 
-- 
cgit v1.2.3-54-g00ecf