File 0001-buildah-CVE-2024-1753-container-escape-fix.patch of Package podman.33052
From 070dcd6ed8ad816aaaa99d391fe907ef0a1200d8 Mon Sep 17 00:00:00 2001
From: Tom Sweeney <tsweeney@redhat.com>
Date: Tue, 19 Mar 2024 14:30:27 +0100
Subject: [PATCH] [buildah] CVE-2024-1753 container escape fix
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Addresses CVE-2024-1753 which allowed a user to write files to the `/` directory
of the host machine if selinux was not enabled.
Signed-off-by: tomsweeneyredhat <tsweeney@redhat.com>
Signed-off-by: Dan Čermák <dcermak@suse.com>
---
.../github.com/containers/buildah/internal/parse/parse.go | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
diff --git a/vendor/github.com/containers/buildah/internal/parse/parse.go b/vendor/github.com/containers/buildah/internal/parse/parse.go
index 5050be38b..a5121af2c 100644
--- a/vendor/github.com/containers/buildah/internal/parse/parse.go
+++ b/vendor/github.com/containers/buildah/internal/parse/parse.go
@@ -11,6 +11,7 @@ import (
"errors"
+ "github.com/containers/buildah/copier"
"github.com/containers/buildah/define"
"github.com/containers/buildah/internal"
internalUtil "github.com/containers/buildah/internal/util"
@@ -164,7 +165,11 @@ func GetBindMount(ctx *types.SystemContext, args []string, contextDir string, st
// buildkit parity: support absolute path for sources from current build context
if contextDir != "" {
// path should be /contextDir/specified path
- newMount.Source = filepath.Join(contextDir, filepath.Clean(string(filepath.Separator)+newMount.Source))
+ evaluated, err := copier.Eval(contextDir, newMount.Source, copier.EvalOptions{})
+ if err != nil {
+ return newMount, "", err
+ }
+ newMount.Source = evaluated
} else {
// looks like its coming from `build run --mount=type=bind` allow using absolute path
// error out if no source is set
--
2.44.0
