search

kubernetes / mount-utils

Package mount defines an interface to mounting filesystems.
Apache License 2.0
57 stars 30 forks source link

Secure against (sensitive) mount options that contains , (comma)? #15

Closed johanot closed 6 months ago

johanot commented 1 year ago

re: https://github.com/kubernetes/mount-utils/blob/master/mount_linux.go#L325

If mount options themselves contain a comma, it is possible for one mount option to be interpreted as multiple options. This might be a problem especially for sensitive mount options that can cause leakages of sensitive values into logfiles.

e.g. password=my,passw0rd will give an error like: "Invalid mount option passw0rd" in the kernel log (denpeding on the mount driver)

This issue might be out of scope for this library to handle, since fs-drivers (afaik, correct me?) behave differently and some might allow escaping of mount options with backslash while others might not. So I'm fine with this being closed as: "up to the implementer to guard against" - as long as that's a conscious decision.

k8s-triage-robot commented 8 months ago

The Kubernetes project currently lacks enough contributors to adequately respond to all issues.

This bot triages un-triaged issues according to the following rules:

You can:

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale

k8s-triage-robot commented 7 months ago

The Kubernetes project currently lacks enough active contributors to adequately respond to all issues.

This bot triages un-triaged issues according to the following rules:

You can:

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle rotten

k8s-triage-robot commented 6 months ago

The Kubernetes project currently lacks enough active contributors to adequately respond to all issues and PRs.

This bot triages issues according to the following rules:

You can:

Please send feedback to sig-contributor-experience at kubernetes/community.

/close not-planned

k8s-ci-robot commented 6 months ago

@k8s-triage-robot: Closing this issue, marking it as "Not Planned".

In response to [this](https://github.com/kubernetes/mount-utils/issues/15#issuecomment-2026076546): >The Kubernetes project currently lacks enough active contributors to adequately respond to all issues and PRs. > >This bot triages issues according to the following rules: >- After 90d of inactivity, `lifecycle/stale` is applied >- After 30d of inactivity since `lifecycle/stale` was applied, `lifecycle/rotten` is applied >- After 30d of inactivity since `lifecycle/rotten` was applied, the issue is closed > >You can: >- Reopen this issue with `/reopen` >- Mark this issue as fresh with `/remove-lifecycle rotten` >- Offer to help out with [Issue Triage][1] > >Please send feedback to sig-contributor-experience at [kubernetes/community](https://github.com/kubernetes/community). > >/close not-planned > >[1]: https://www.kubernetes.dev/docs/guide/issue-triage/ Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md). If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository.