By allowing Open(at)InRoot to opt-out of the extra work done by MkdirAll
to do the necessary "partial lookups", Open(at)InRoot now does less work
for both implementations (resulting in a many-fold decrease in the number of
operations for openat2, and a modest improvement for non-openat2) and is
far more guaranteed to match the correct openat2(RESOLVE_IN_ROOT)
behaviour.
We now use readlinkat(fd, "") where possible. For Open(at)InRoot this
effectively just means that we no longer risk getting spurious errors during
rename races. However, for our hardened procfs handler, this in theory should
prevent mount attacks from tricking us when doing magic-link readlinks (even
when using the unsafe host /proc handle). Unfortunately Reopen is still
potentially vulnerable to those kinds of somewhat-esoteric attacks.
Several improvements were made to the errors returned by Open(at)InRoot and
MkdirAll when dealing with invalid paths under the emulated (ie.
non-openat2) implementation. Previously, some paths would return the wrong
error (ENOENT when the last component was a non-directory), and other paths
would be returned as though they were acceptable (trailing-slash components
after a non-directory would be ignored by Open(at)InRoot).
These changes were done to match openat2's behaviour and purely is a
consistency fix (most users are going to be using openat2 anyway).
However, it does introduce a new *os.File-based API which is much safer
to use for most usecases. These are adapted from [libpathrs][1] and are
the bare minimum to be able to operate more safely on an untrusted
rootfs where an attacker has write access (something that SecureJoin
cannot protect against). The new APIs are:
OpenInRoot, which resolves a path inside a rootfs and returns an
*os.File handle to the path. Note that the file handle returned by
OpenInRoot is an O_PATH handle, which cannot be used for reading or
writing (as well as some other operations -- see open(2) for more
details).
Reopen, which takes an O_PATH file handle and safely re-opens it to
"upgrade" it to a regular handle.
By allowing Open(at)InRoot to opt-out of the extra work done by MkdirAll
to do the necessary "partial lookups", Open(at)InRoot now does less work
for both implementations (resulting in a many-fold decrease in the number of
operations for openat2, and a modest improvement for non-openat2) and is
far more guaranteed to match the correct openat2(RESOLVE_IN_ROOT)
behaviour.
We now use readlinkat(fd, "") where possible. For Open(at)InRoot this
effectively just means that we no longer risk getting spurious errors during
rename races. However, for our hardened procfs handler, this in theory should
prevent mount attacks from tricking us when doing magic-link readlinks (even
when using the unsafe host /proc handle). Unfortunately Reopen is still
potentially vulnerable to those kinds of somewhat-esoteric attacks.
Bumps the go-modules group with 16 updates in the / directory:
1.5.5
1.5.6
0.0.0-20220526054621-78278af1949d
0.0.1
0.0.15
0.0.16
1.33.1
1.34.2
0.18.7
0.18.8
0.5.4
0.5.5
2.17.0
2.19.1
1.0.0
1.0.1
3.2.1
3.3.0
0.12.4
0.12.6
1.3.9
1.4.0
0.2.5
0.3.1
0.5.0
0.6.0
0.1.0
0.3.0
1.2.2
1.3.0
1.6.0
1.7.0
Updates
github.com/DataDog/zstd
from 1.5.5 to 1.5.6Release notes
Sourced from github.com/DataDog/zstd's releases.
Commits
b52f603
Merge pull request #143 from DataDog/viq111/1.5.6cf4778e
Update Readme for 1.5.6ed87d43
Update vendored zstd to 1.5.6dd7b332
Merge pull request #136 from colinlyguo/fix-readmebeb4dfd
Merge pull request #141 from DataDog/sfluor-patch-1e75a26a
Update upperBound ratio when guessing the required decompression buffer sizec9a5141
fix readme869dae0
Merge pull request #132 from DataDog/viq111/bulk-fix-highlycompressed-payloadsbf7b920
[bulk] Add extra empty payload decompression test9c0d33f
[bulk] Fix namingUpdates
github.com/Netflix/go-env
from 0.0.0-20220526054621-78278af1949d to 0.0.1Release notes
Sourced from github.com/Netflix/go-env's releases.
Commits
Updates
github.com/mattn/go-runewidth
from 0.0.15 to 0.0.16Commits
6ceadc6
Support Unicode 15.1.0Updates
github.com/onsi/gomega
from 1.33.1 to 1.34.2Release notes
Sourced from github.com/onsi/gomega's releases.
Changelog
Sourced from github.com/onsi/gomega's changelog.
Commits
7cabed6
v1.34.2c59c6dc
bump ginkgo as well8158b99
bump to go 1.22 - remove x/exp dependencyfa057b8
v1.34.15e71dcd
Use slices from exp/slices to keep golang 1.20 compat32e5498
v1.34.0cb3fa6a
run go mod tidy and wonder why go get doesnt just run it for me in the first ...8af2ece
bump ginkgo878940c
fix incorrect handling of nil slices in HaveExactElements (fixes #771)f5bec80
clean up bipartitegraph testsUpdates
github.com/paketo-buildpacks/occam
from 0.18.7 to 0.18.8Release notes
Sourced from github.com/paketo-buildpacks/occam's releases.
Commits
1193f3c
Bump docker to version 26.1.5 to fix CVE-2024-411105cd4ede
Updates go mod version to 1.23.02e5b930
Updates go mod version to 1.22.6815b014
Bump github.com/paketo-buildpacks/packit/v2 from 2.14.1 to 2.14.274a79fb
Bump github.com/paketo-buildpacks/packit/v2 from 2.14.0 to 2.14.190134a5
Bump github.com/google/go-containerregistry from 0.20.1 to 0.20.2653a6fb
Bump github.com/onsi/gomega from 1.34.0 to 1.34.1ed0e429
Bump github.com/onsi/gomega from 1.33.1 to 1.34.0f467245
Updates go mod version to 1.22.5c97acf2
Bump github.com/google/go-containerregistry from 0.20.0 to 0.20.1Updates
github.com/paketo-buildpacks/packit/v2
from 2.14.0 to 2.14.2Release notes
Sourced from github.com/paketo-buildpacks/packit/v2's releases.
Commits
3bc586e
do not run draft release workflow on branches named v2-<something>d558b87
Bump github.com/onsi/gomega from 1.33.1 to 1.34.19f2a7b3
Bump github.com/gabriel-vasile/mimetype from 1.4.4 to 1.4.5b117031
Updating github-configb6530bc
Include error handling7222905
Fix override of existing values in prepend & appende366827
Updating github-configa8ac405
Bump github.com/gabriel-vasile/mimetype from 1.4.3 to 1.4.44ff7347
Bump github.com/BurntSushi/toml from 1.3.2 to 1.4.0Updates
github.com/spdx/tools-golang
from 0.5.4 to 0.5.5Release notes
Sourced from github.com/spdx/tools-golang's releases.
Commits
9db247b
fix: provide a clearer error when using an invalid originator (#246)57d4b8e
fix: panic if JSON relationship array contains null (#239)606f188
chore: update makefile to include bootstrap and go mod tidy (#243)282609e
fix: properly normalize Windows paths (#242)Updates
github.com/sylabs/sif/v2
from 2.17.0 to 2.19.1Release notes
Sourced from github.com/sylabs/sif/v2's releases.
Commits
1ed3ce5
Merge pull request #384 from tri-adam/overflow-fix6f00aba
fix: check descriptor capacity during SIF creationc1fcc37
fix: correct the range check for descriptor IDsfd8a090
Merge pull request #383 from tri-adam/golangci-lint-v1.60d2a9ddc
fix: address lint with golangci-lint v1.60f4453b3
ci: remove deprecated exportloopref linterdd77d01
chore: bump golangci-lint to v1.60518b3a3
build(deps): bump github.com/sigstore/sigstore from 1.8.4 to 1.8.8 (#381)afa5a4e
Merge pull request #382 from tri-adam/go-1.239a07943
chore: bump module to Go 1.22Updates
golang.org/x/crypto
from 0.24.0 to 0.26.0Commits
5bcd010
go.mod: update golang.org/x dependencies3375612
ssh: add support for unpadded RSA signaturesbb80217
ssh: don't use dsa keys in integration tests6879722
ssh: remove go 1.21+ dependency on slicese983fa2
sha3: Avo port of keccakf_amd64.s80fd972
LICENSE: update per Google Legalf2bc3a6
x509roots/fallback/internal/goissue52287: deleted66d9c3
x509roots/fallback: update bundle9fadb0b
go.mod: update golang.org/x dependenciesa6a393f
all: bump go.mod version and drop compatibility shimsUpdates
golang.org/x/net
from 0.26.0 to 0.28.0Commits
4542a42
go.mod: update golang.org/x dependencies765c7e8
xsrftoken: create no padding base64 string by RawURLEncoding032e4e4
LICENSE: update per Google Legale2310ae
go.mod: update golang.org/x dependencies77708f7
quic: skip tests which depend on unimplemented UDP functions on Plan 99617c63
http2: avoid Transport hang with Connection: close and AllowHTTPUpdates
golang.org/x/sync
from 0.7.0 to 0.8.0Commits
411f99e
LICENSE: update per Google LegalUpdates
golang.org/x/sys
from 0.21.0 to 0.24.0Commits
914deed
unix: add missing ETHTOOL_FLAG_ constants4c7077e
windows: add enums for IpAdapterUnicastAddress29298aa
windows: delete TestGetKeyboardLayoutaa1c4c8
unix: provide Mount on openbsdcde4660
unix: add linux mseal system call31ef9e7
unix: update to Linux kernel 6.10d03a807
unix: update glibc to 2.40beb5949
windows: correctly generate GetAce syscall7bb0bf7
cpu: add Int8 matrix multiplication instructions CPU feature flag for ARM64bce4cf7
windows: add GetKeyboardLayout & ToUnicodeExUpdates
dario.cat/mergo
from 1.0.0 to 1.0.1Release notes
Sourced from dario.cat/mergo's releases.
Commits
59ea6a9
Merge pull request #251 from joshkaplinsky/joshkaplinsky/without-dereference-...96f24af
Merge pull request #253 from vsemichev/master2f1a615
fixes issue #187. adds test to verify the fix.4da170b
fixes issue #187. attempt #3a13a117
fixes issue #187. attempt #26b830ff
fixes issue #187f33862a
WithoutDereference should respect structscde9f0e
Merge pull request #246 from darccio/darccio/v1-frozenf1e2fe5
chore: frozen v17f7b4af
Update FUNDING.ymlUpdates
github.com/Masterminds/semver/v3
from 3.2.1 to 3.3.0Release notes
Sourced from github.com/Masterminds/semver/v3's releases.
Changelog
Sourced from github.com/Masterminds/semver/v3's changelog.
Commits
e6e3d4d
Merge pull request #249 from mattfarina/update-changelog-3.3.0e80c4ea
Updating changelog for 3.3.080427ad
Merge pull request #248 from mattfarina/bump-min-versionb610837
bumping min version in go.mod based on what's testeda4cccd8
Merge pull request #246 from mattfarina/bump-go-1.237c178cf
Updating the testing version of Go used29f94c1
Merge pull request #241 from grosser/grosser/validate2cf1b16
Merge pull request #245 from mattfarina/remove-vertb55476a
Removing reference to vertd07450b
simplify StrictNewVersionUpdates
github.com/Microsoft/hcsshim
from 0.12.4 to 0.12.6Release notes
Sourced from github.com/Microsoft/hcsshim's releases.
Commits
f922f2a
Omnibus dependency updates (#2051)7d25ce2
Update module versions85a5a57
drop usage of deprecated package/methodsd4b1cc0
Bump opa/containerd to latest versions6a5ebd3
Upgrade deps to resolve CVEs (#2225)4f46058
Omnibus dependency update (#2166)e970943
Modifying network flag EnableIov.4f77a09
Hcsshim wrapper over HNS API needed for exclusion of management mac addresses...3b5bd8a
[release/0.12] vendor: github.com/containerd/containerd v17.1840cdbc8
Adding state attribute to the HNSEndpoint struct to support hyperv containers...Updates
github.com/cloudflare/circl
from 1.3.9 to 1.4.0Release notes
Sourced from github.com/cloudflare/circl's releases.
Commits
c311e46
Preparing for release v1.4.062385a8
Add ML-KEM decapsulation key check.2b4626d
Add ML-KEM (FIPS 203).d26845f
eddilithium3: fix typosUpdates
github.com/cyphar/filepath-securejoin
from 0.2.5 to 0.3.1Release notes
Sourced from github.com/cyphar/filepath-securejoin's releases.
... (truncated)
Changelog
Sourced from github.com/cyphar/filepath-securejoin's changelog.