This release primarily includes fixes for spurious errors we hit when
checking that directories created by MkdirAll "look right". Upon further
consideration, these checks were fundamentally buggy and didn't offer
any practical protection anyway.
The mode and owner verification logic in MkdirAll has been removed. This
was originally intended to protect against some theoretical attacks but upon
further consideration these protections don't actually buy us anything and
they were causing spurious errors with more complicated filesystem setups.
The "is the created directory empty" logic in MkdirAll has also been
removed. This was not causing us issues yet, but some pseudofilesystems (such
as cgroup) create non-empty directories and so this logic would've been
wrong for such cases.
Thanks to all of the contributors who made this release possible:
This release includes a few fixes for MkdirAll when dealing with S_ISUID
and S_ISGID, to solve a regression runc hit when switching to MkdirAll.
Passing the S_ISUID or S_ISGID modes to MkdirAllInRoot will now return
an explicit error saying that those bits are ignored by mkdirat(2). In
the past a different error was returned, but since the silent ignoring
behaviour is codified in the man pages a more explicit error seems
apt. While silently ignoring these bits would be the most compatible
option, it could lead to users thinking their code sets these bits
when it doesn't. Programs that need to deal with compatibility can
mask the bits themselves. (#23, #25)
If a directory has S_ISGID set, then all child directories will have
S_ISGID set when created and a different gid will be used for any
inode created under the directory. Previously, the "expected owner and
mode" validation in securejoin.MkdirAll did not correctly handle this.
We now correctly handle this case. (#24, #25)
By allowing Open(at)InRoot to opt-out of the extra work done by MkdirAll
to do the necessary "partial lookups", Open(at)InRoot now does less work
for both implementations (resulting in a many-fold decrease in the number of
operations for openat2, and a modest improvement for non-openat2) and is
far more guaranteed to match the correct openat2(RESOLVE_IN_ROOT)
behaviour.
The mode and owner verification logic in MkdirAll has been removed. This
was originally intended to protect against some theoretical attacks but upon
further consideration these protections don't actually buy us anything and
they were causing spurious errors with more complicated filesystem setups.
The "is the created directory empty" logic in MkdirAll has also been
removed. This was not causing us issues yet, but some pseudofilesystems (such
as cgroup) create non-empty directories and so this logic would've been
wrong for such cases.
[0.3.2] - 2024-09-13
Changed
Passing the S_ISUID or S_ISGID modes to MkdirAllInRoot will now return
an explicit error saying that those bits are ignored by mkdirat(2). In the
past a different error was returned, but since the silent ignoring behaviour
is codified in the man pages a more explicit error seems apt. While silently
ignoring these bits would be the most compatible option, it could lead to
users thinking their code sets these bits when it doesn't. Programs that need
to deal with compatibility can mask the bits themselves. (#23, #25)
Fixed
If a directory has S_ISGID set, then all child directories will have
S_ISGID set when created and a different gid will be used for any inode
created under the directory. Previously, the "expected owner and mode"
validation in securejoin.MkdirAll did not correctly handle this. We now
correctly handle this case. (#24, #25)
[0.3.1] - 2024-07-23
Changed
By allowing Open(at)InRoot to opt-out of the extra work done by MkdirAll
to do the necessary "partial lookups", Open(at)InRoot now does less work
for both implementations (resulting in a many-fold decrease in the number of
operations for openat2, and a modest improvement for non-openat2) and is
far more guaranteed to match the correct openat2(RESOLVE_IN_ROOT)
behaviour.
We now use readlinkat(fd, "") where possible. For Open(at)InRoot this
effectively just means that we no longer risk getting spurious errors during
rename races. However, for our hardened procfs handler, this in theory should
prevent mount attacks from tricking us when doing magic-link readlinks (even
when using the unsafe host /proc handle). Unfortunately Reopen is still
potentially vulnerable to those kinds of somewhat-esoteric attacks.
Technically this [will only work on post-2.6.39 kernels][linux-readlinkat-emptypath]
but it seems incredibly unlikely anyone is using filepath-securejoin on a
pre-2011 kernel.
Bumps the go-modules group with 18 updates in the / directory:
1.33.11.34.20.18.70.18.81.0.01.0.11.5.51.5.63.2.13.3.03.2.33.3.00.12.40.12.71.3.91.4.00.1.00.2.00.3.10.3.20.2.50.3.31.17.91.17.100.0.150.0.160.5.00.6.01.2.21.3.02.17.02.19.10.8.00.9.00.11.50.11.6Updates
github.com/onsi/gomegafrom 1.33.1 to 1.34.2Release notes
Sourced from github.com/onsi/gomega's releases.
Changelog
Sourced from github.com/onsi/gomega's changelog.
Commits
7cabed6v1.34.2c59c6dcbump ginkgo as well8158b99bump to go 1.22 - remove x/exp dependencyfa057b8v1.34.15e71dcdUse slices from exp/slices to keep golang 1.20 compat32e5498v1.34.0cb3fa6arun go mod tidy and wonder why go get doesnt just run it for me in the first ...8af2ecebump ginkgo878940cfix incorrect handling of nil slices in HaveExactElements (fixes #771)f5bec80clean up bipartitegraph testsUpdates
github.com/paketo-buildpacks/occamfrom 0.18.7 to 0.18.8Release notes
Sourced from github.com/paketo-buildpacks/occam's releases.
Commits
1193f3cBump docker to version 26.1.5 to fix CVE-2024-411105cd4edeUpdates go mod version to 1.23.02e5b930Updates go mod version to 1.22.6815b014Bump github.com/paketo-buildpacks/packit/v2 from 2.14.1 to 2.14.274a79fbBump github.com/paketo-buildpacks/packit/v2 from 2.14.0 to 2.14.190134a5Bump github.com/google/go-containerregistry from 0.20.1 to 0.20.2653a6fbBump github.com/onsi/gomega from 1.34.0 to 1.34.1ed0e429Bump github.com/onsi/gomega from 1.33.1 to 1.34.0f467245Updates go mod version to 1.22.5c97acf2Bump github.com/google/go-containerregistry from 0.20.0 to 0.20.1Updates
github.com/paketo-buildpacks/packit/v2from 2.14.0 to 2.14.2Release notes
Sourced from github.com/paketo-buildpacks/packit/v2's releases.
Commits
3bc586edo not run draft release workflow on branches named v2-<something>d558b87Bump github.com/onsi/gomega from 1.33.1 to 1.34.19f2a7b3Bump github.com/gabriel-vasile/mimetype from 1.4.4 to 1.4.5b117031Updating github-configb6530bcInclude error handling7222905Fix override of existing values in prepend & appende366827Updating github-configa8ac405Bump github.com/gabriel-vasile/mimetype from 1.4.3 to 1.4.44ff7347Bump github.com/BurntSushi/toml from 1.3.2 to 1.4.0Updates
dario.cat/mergofrom 1.0.0 to 1.0.1Release notes
Sourced from dario.cat/mergo's releases.
Commits
59ea6a9Merge pull request #251 from joshkaplinsky/joshkaplinsky/without-dereference-...96f24afMerge pull request #253 from vsemichev/master2f1a615fixes issue #187. adds test to verify the fix.4da170bfixes issue #187. attempt #3a13a117fixes issue #187. attempt #26b830fffixes issue #187f33862aWithoutDereference should respect structscde9f0eMerge pull request #246 from darccio/darccio/v1-frozenf1e2fe5chore: frozen v17f7b4afUpdate FUNDING.ymlUpdates
github.com/DataDog/zstdfrom 1.5.5 to 1.5.6Release notes
Sourced from github.com/DataDog/zstd's releases.
Commits
b52f603Merge pull request #143 from DataDog/viq111/1.5.6cf4778eUpdate Readme for 1.5.6ed87d43Update vendored zstd to 1.5.6dd7b332Merge pull request #136 from colinlyguo/fix-readmebeb4dfdMerge pull request #141 from DataDog/sfluor-patch-1e75a26aUpdate upperBound ratio when guessing the required decompression buffer sizec9a5141fix readme869dae0Merge pull request #132 from DataDog/viq111/bulk-fix-highlycompressed-payloadsbf7b920[bulk] Add extra empty payload decompression test9c0d33f[bulk] Fix namingUpdates
github.com/Masterminds/semver/v3from 3.2.1 to 3.3.0Release notes
Sourced from github.com/Masterminds/semver/v3's releases.
Changelog
Sourced from github.com/Masterminds/semver/v3's changelog.
Commits
e6e3d4dMerge pull request #249 from mattfarina/update-changelog-3.3.0e80c4eaUpdating changelog for 3.3.080427adMerge pull request #248 from mattfarina/bump-min-versionb610837bumping min version in go.mod based on what's testeda4cccd8Merge pull request #246 from mattfarina/bump-go-1.237c178cfUpdating the testing version of Go used29f94c1Merge pull request #241 from grosser/grosser/validate2cf1b16Merge pull request #245 from mattfarina/remove-vertb55476aRemoving reference to vertd07450bsimplify StrictNewVersionUpdates
github.com/Masterminds/sprig/v3from 3.2.3 to 3.3.0Release notes
Sourced from github.com/Masterminds/sprig/v3's releases.
Changelog
Sourced from github.com/Masterminds/sprig/v3's changelog.
Commits
e708470Merge pull request #408 from mattfarina/update-changelog-3.38fc4354Updating the changelog for the 3.3.0 releasecb81a32Merge pull request #407 from mattfarina/remove-dup-math-functions2637693Removing duplicate documentation06b9a87Merge pull request #290 from zzhu41/patch-1e663ec6Merge pull request #369 from chey/patch-1bb2f73fMerge pull request #375 from carlpett/patch-1f07659eMerge pull request #400 from itzik-elayev/master98b35c1Add closing bracket7a88928Merge pull request #406 from mattfarina/update-mergoUpdates
github.com/Microsoft/hcsshimfrom 0.12.4 to 0.12.7Release notes
Sourced from github.com/Microsoft/hcsshim's releases.
Commits
86b5333Bump golangci/golangci-lint-action from 4 to 65ae96f3Update runc to v1.1.148f3fccdUpdate pkg versionsf922f2aOmnibus dependency updates (#2051)7d25ce2Update module versions85a5a57drop usage of deprecated package/methodsd4b1cc0Bump opa/containerd to latest versions6a5ebd3Upgrade deps to resolve CVEs (#2225)4f46058Omnibus dependency update (#2166)e970943Modifying network flag EnableIov.Updates
github.com/cloudflare/circlfrom 1.3.9 to 1.4.0Release notes
Sourced from github.com/cloudflare/circl's releases.
Commits
c311e46Preparing for release v1.4.062385a8Add ML-KEM decapsulation key check.2b4626dAdd ML-KEM (FIPS 203).d26845feddilithium3: fix typosUpdates
github.com/containerd/errdefsfrom 0.1.0 to 0.2.0Release notes
Sourced from github.com/containerd/errdefs's releases.
Commits
02b65bcMerge pull request #18 from dmcgowan/add-missing-interfaces41d12e1Complete interface definitions for errors70440b8Merge pull request #7 from dmcgowan/grpc-error-detailsb9dce4dAdd support for grpc error detailsffb0349Update Resolve function to support Is interface124d0dcMerge pull request #10 from dmcgowan/custom-error-messagesdc9b20eAdd support for custom error messages6c7f402Merge pull request #9 from dmcgowan/resolve-error9f87502Add a resolve error function to return first error6fb6cf0Merge pull request #8 from dmcgowan/add-stack-supportUpdates
github.com/cpuguy83/dockercfgfrom 0.3.1 to 0.3.2Release notes
Sourced from github.com/cpuguy83/dockercfg's releases.
Commits
a07c3d1Merge pull request #3 from stevenh/chore/improve-errors91bd66achore: improve errorsUpdates
github.com/cyphar/filepath-securejoinfrom 0.2.5 to 0.3.3Release notes
Sourced from github.com/cyphar/filepath-securejoin's releases.
... (truncated)
Changelog
Sourced from github.com/cyphar/filepath-securejoin's changelog.
... (truncated)
Commits
93cff46VERSION: release v0.3.32b3d97dmerge #26 into cyphar/filepath-securejoin:main09afcf2OpenInRoot: add CVE link to godoc5b5a7a4Add cross-links to godocdaead99Remove osVFS methods documentation208ded3tests: don't panic if the fd is closed626b5a5merge #29 into cyphar/filepath-securejoin:main92b699dmkdir: don't check that the directory is empty90adf5cmkdir: do not return errors for incorrect directory modes or owners3bf6419merge #30 into cyphar/filepath-securejoin:mainUpdates
github.com/docker/clifrom 27.0.2+incompatible to 27.1.1+incompatibleCommits
6312585Merge pull requestSuperseded by #626.