By allowing Open(at)InRoot to opt-out of the extra work done by MkdirAll
to do the necessary "partial lookups", Open(at)InRoot now does less work
for both implementations (resulting in a many-fold decrease in the number of
operations for openat2, and a modest improvement for non-openat2) and is
far more guaranteed to match the correct openat2(RESOLVE_IN_ROOT)
behaviour.
We now use readlinkat(fd, "") where possible. For Open(at)InRoot this
effectively just means that we no longer risk getting spurious errors during
rename races. However, for our hardened procfs handler, this in theory should
prevent mount attacks from tricking us when doing magic-link readlinks (even
when using the unsafe host /proc handle). Unfortunately Reopen is still
potentially vulnerable to those kinds of somewhat-esoteric attacks.
Several improvements were made to the errors returned by Open(at)InRoot and
MkdirAll when dealing with invalid paths under the emulated (ie.
non-openat2) implementation. Previously, some paths would return the wrong
error (ENOENT when the last component was a non-directory), and other paths
would be returned as though they were acceptable (trailing-slash components
after a non-directory would be ignored by Open(at)InRoot).
These changes were done to match openat2's behaviour and purely is a
consistency fix (most users are going to be using openat2 anyway).
However, it does introduce a new *os.File-based API which is much safer
to use for most usecases. These are adapted from [libpathrs][1] and are
the bare minimum to be able to operate more safely on an untrusted
rootfs where an attacker has write access (something that SecureJoin
cannot protect against). The new APIs are:
OpenInRoot, which resolves a path inside a rootfs and returns an
*os.File handle to the path. Note that the file handle returned by
OpenInRoot is an O_PATH handle, which cannot be used for reading or
writing (as well as some other operations -- see open(2) for more
details).
Reopen, which takes an O_PATH file handle and safely re-opens it to
"upgrade" it to a regular handle.
By allowing Open(at)InRoot to opt-out of the extra work done by MkdirAll
to do the necessary "partial lookups", Open(at)InRoot now does less work
for both implementations (resulting in a many-fold decrease in the number of
operations for openat2, and a modest improvement for non-openat2) and is
far more guaranteed to match the correct openat2(RESOLVE_IN_ROOT)
behaviour.
We now use readlinkat(fd, "") where possible. For Open(at)InRoot this
effectively just means that we no longer risk getting spurious errors during
rename races. However, for our hardened procfs handler, this in theory should
prevent mount attacks from tricking us when doing magic-link readlinks (even
when using the unsafe host /proc handle). Unfortunately Reopen is still
potentially vulnerable to those kinds of somewhat-esoteric attacks.
Several improvements were made to the errors returned by Open(at)InRoot and
MkdirAll when dealing with invalid paths under the emulated (ie.
non-openat2) implementation. Previously, some paths would return the wrong
error (ENOENT when the last component was a non-directory), and other paths
would be returned as though they were acceptable (trailing-slash components
after a non-directory would be ignored by Open(at)InRoot).
These changes were done to match openat2's behaviour and purely is a
consistency fix (most users are going to be using openat2 anyway).
[0.3.0] - 2024-07-11
Added
A new set of *os.File-based APIs have been added. These are adapted from
[libpathrs][] and we strongly suggest using them if possible (as they provide
far more protection against attacks than SecureJoin):
Open(at)InRoot resolves a path inside a rootfs and returns an *os.File
handle to the path. Note that the handle returned is an O_PATH handle,
which cannot be used for reading or writing (as well as some other
operations -- [see open(2) for more details][open.2])
Reopen takes an O_PATH file handle and safely re-opens it to upgrade
it to a regular handle. This can also be used with non-O_PATH handles,
but O_PATH is the most obvious application.
MkdirAll is an implementation of os.MkdirAll that is safe to use to
Add MountedFast by @kolyshkin in moby/sys#100
Note: most users should keep using Mounted, which already incorporates all optimizations from MountedFast
Bumps the go-modules group with 15 updates in the / directory:
1.33.11.34.11.5.51.5.60.2.50.3.11.4.41.4.51.4.11.4.20.19.20.20.10.0.150.0.160.5.00.6.00.1.00.2.03.23.123.24.51.2.21.3.00.5.40.5.52.17.02.18.00.49.00.53.01.62.01.65.0Updates
github.com/onsi/gomegafrom 1.33.1 to 1.34.1Release notes
Sourced from github.com/onsi/gomega's releases.
Changelog
Sourced from github.com/onsi/gomega's changelog.
Commits
fa057b8v1.34.15e71dcdUse slices from exp/slices to keep golang 1.20 compat32e5498v1.34.0cb3fa6arun go mod tidy and wonder why go get doesnt just run it for me in the first ...8af2ecebump ginkgo878940cfix incorrect handling of nil slices in HaveExactElements (fixes #771)f5bec80clean up bipartitegraph testsebadb67issue_765 - fixed bug in Hopcroft-Karp algorithm123a071Fix typo in docsc549e0dAdd RoundTripper method to ghttp.ServerUpdates
github.com/DataDog/zstdfrom 1.5.5 to 1.5.6Release notes
Sourced from github.com/DataDog/zstd's releases.
Commits
b52f603Merge pull request #143 from DataDog/viq111/1.5.6cf4778eUpdate Readme for 1.5.6ed87d43Update vendored zstd to 1.5.6dd7b332Merge pull request #136 from colinlyguo/fix-readmebeb4dfdMerge pull request #141 from DataDog/sfluor-patch-1e75a26aUpdate upperBound ratio when guessing the required decompression buffer sizec9a5141fix readme869dae0Merge pull request #132 from DataDog/viq111/bulk-fix-highlycompressed-payloadsbf7b920[bulk] Add extra empty payload decompression test9c0d33f[bulk] Fix namingUpdates
github.com/Microsoft/hcsshimfrom 0.12.4 to 0.11.7Commits
6749c2fFix process handle leak when launching a job container (#2187)e59d3d2Adding state attribute to the HNSEndpoint struct to support hyperv containers...1495e9fAdding support for loadbalancer policy update in hns. (#2085)eefee26Changes for checking the global version for modify policy version support. (#...cd46569OutBoundNATPolicy Schema changes (#2106)6678d78Update to go-winio v0.6.2 + fix lint errors4249a60Upgrade to golang 1.214dc03f1Add spans and drop large size high volume trace logsb16edf6Remove log package dependencyb5725e5Create container subdirectories for process dumpsUpdates
github.com/cyphar/filepath-securejoinfrom 0.2.5 to 0.3.1Release notes
Sourced from github.com/cyphar/filepath-securejoin's releases.
... (truncated)
Changelog
Sourced from github.com/cyphar/filepath-securejoin's changelog.
... (truncated)
Commits
ce7b28aVERSION: release v0.3.1a2c14f8CHANGELOG: add readlinkat(fd, "") shout-out4ea279fmerge #22 into cyphar/filepath-securejoin:main16e1becCHANGELOG: add initial changelog with current history2404ffbmerge #21 into cyphar/filepath-securejoin:mainf29b7a4lookup: handle // and trailing slash components correctlyecd61camerge #19 into cyphar/filepath-securejoin:main38b1220procfs: refactor statx mnt_id logic45c4415procfs: use readlink(fd, "") for magic-linksedab538merge #17 into cyphar/filepath-securejoin:mainUpdates
github.com/gabriel-vasile/mimetypefrom 1.4.4 to 1.4.5Release notes
Sourced from github.com/gabriel-vasile/mimetype's releases.
Commits
b36b70fremove exe from testdata (#561)e802551Bump the github-actions group across 1 directory with 3 updates (#560)f003e99Bump golang.org/x/net in the gomod group across 1 directory (#552)e0c5c59reduce project size by moving mimetype.gif to testdata (#548)f296c1balias rtf to application/rtf (#547)8329892Updating RTF Magic number to match <https://www.iana.org/assignments/media-ty...3267116remove tarbomb from testdata folder (#540)cdceff9zip: use []byte instead of string to prevent allocs (#537)77e3848tar: remove strconv dependency for tar checksum octal numbers (#536)09ff708json: improve performance by using a pool of scanners (#535)Updates
github.com/go-logr/logrfrom 1.4.1 to 1.4.2Release notes
Sourced from github.com/go-logr/logr's releases.
Commits
1205f42Merge pull request #295 from go-logr/dependabot/github_actions/actions/checko...ccedcbdMerge pull request #294 from go-logr/dependabot/github_actions/github/codeql-...bead577build(deps): bump actions/checkout from 4.1.5 to 4.1.6a492d95build(deps): bump github/codeql-action from 3.25.4 to 3.25.519ad07cbuild(deps): bump ossf/scorecard-action from 2.3.1 to 2.3.31c97a21build(deps): bump actions/checkout from 4.1.4 to 4.1.5f70c5b5build(deps): bump github/codeql-action from 3.25.3 to 3.25.44ade8d3build(deps): bump golangci/golangci-lint-action from 5.3.0 to 6.0.188d98bdMerge pull request #289 from go-logr/dependabot/github_actions/golangci/golan...432cd86Merge pull request #288 from go-logr/dependabot/github_actions/actions/setup-...Updates
github.com/go-ole/go-olefrom 1.3.0 to 1.2.6Commits
9f1c1d0Revert 1144933ebbad56211c67c56fd60da6a684550dc6d467d80Merge pull request #206 from oXis/master1144933oleutil: fix ForEach no working as intentedb5bef18Clear EXCEPINFO handling IDispatch.Invoke errorsabfd2bdClear VT_VARIANT inside a SafeArray.ToValueArray()conversion3a1b425btnGがbtnKに名前が変わっていました。14974a1Merge pull request #192 from andrewkroh/masterfc4e2cdUse NewLazySystemDLLe7f687fsafeArrayGetElement error when type is VT_BSTR938323aCreate FUNDING.ymlUpdates
github.com/google/go-containerregistryfrom 0.19.2 to 0.20.1Release notes
Sourced from github.com/google/go-containerregistry's releases.
Commits
c3d1dccCreateremote.Push(#1978)d36047aRestore blind-write to remote.Put (#1970)9915a85Referrer API must return correct Content-Type (#1968)Updates
github.com/mattn/go-runewidthfrom 0.0.15 to 0.0.16Commits
6ceadc6Support Unicode 15.1.0Updates
github.com/moby/sys/sequentialfrom 0.5.0 to 0.6.0Release notes
Sourced from github.com/moby/sys/sequential's releases.
Commits
03b9f8dMerge pull request #94 from thaJeztah/bump_mountinfobdd898emount: update github.com/moby/sys/mountinfo v0.5.0fbd276cMerge pull request #93 from kolyshkin/ci-f35afb7f50Merge pull request #92 from kolyshkin/more-linters9372d68ci: bump Fedora to 359a90d6dFormat code with gofumpt, enable linter85e4bfdMakefile: update golangci-lint to 1.43.0f0fb439.gitattributes: addb016007ci: add unconvert and errorlint linters to golanci6056970Fix errorlint warningsUpdates
github.com/moby/sys/userfrom 0.1.0 to 0.2.0Release notes
Sourced from github.com/moby/sys/user's releases.
... (truncated)
Commits
86870e7Merge pull request #140 from thaJeztah/integrate_libcontainer_userns5cd502cuser: require go1.21 or highera40602buser/userns: add godoc for packagebc3a8a5libct/userns: implement RunningInUserNS with sync.OnceValuebc0de32libct/userns: make fuzzer Linux-only, and remove stub for uidMapInUserNS333fe31libct/userns: change RunningInUserNS to a wrapper instead of an aliasbb72464remove pre-go1.17 build-tags87e38c8libcontainer/userns: simplify, and separate from "user" package.b19e084*: add go-1.17+ go:build tagsdb243e2*: rm redundant linux build tagUpdates
github.com/shirou/gopsutil/v3from 3.23.12 to 3.24.5Release notes
Sourced from github.com/shirou/gopsutil/v3's releases.
... (truncated)
Commits
4336530Merge pull request #1649 from shirou/feat/add_process_cwd_openbsdcb52f7aMerge pull request #1651 from Dylan-M/aix_support125da53Update the README charts with the AIX informationff4ae36Remove extraneous development note commentsdf9c9bfUpdate min version in the readme to match new required min version.1d7b4a3Revert accidental change of go version in go.mod (wasn't supposed to commit).9bf502fFix logic errors, syntax errors, and typosb133d60Ignore host_aix_ppc64 for nowb4d95a4Raise minimum go version to 1.18 (required by changes) and run go mod tidy0917790Remove inappropriate package additionUpdates
github.com/skeema/knownhostsfrom 1.2.2 to 1.3.0Commits
9485bdedocs: add PR template and CONTRIBUTING.md guide; minor README tweaks8b8ca37host matching: handle wildcards with non-standard port (#10)7c797a4Merge pull request #9 from skeema/certs-backwards-compat53a26ccMinor adjustments based on initial PR feedback69b4a62certs: reimplement previous commit to maintain backwards compatd314bf3Support cert authorities5832aa8ci: send coverage to Coveralls; upgrade action versions7acc57bgo.mod: update golang.org/x dependenciesUpdates
github.com/spdx/tools-golangfrom 0.5.4 to 0.5.5Release notes
Sourced from github.com/spdx/tools-golang's releases.
Commits
9db247bfix: provide a clearer error when using an invalid originator (#246)57d4b8efix: panic if JSON relationship array contains null (#239)606f188chore: update makefile to include bootstrap and go mod tidy (#243)282609efix: properly normalize Windows paths (#242)Looks like these dependencies are updatable in another way, so this is no longer needed.