By allowing Open(at)InRoot to opt-out of the extra work done by MkdirAll
to do the necessary "partial lookups", Open(at)InRoot now does less work
for both implementations (resulting in a many-fold decrease in the number of
operations for openat2, and a modest improvement for non-openat2) and is
far more guaranteed to match the correct openat2(RESOLVE_IN_ROOT)
behaviour.
We now use readlinkat(fd, "") where possible. For Open(at)InRoot this
effectively just means that we no longer risk getting spurious errors during
rename races. However, for our hardened procfs handler, this in theory should
prevent mount attacks from tricking us when doing magic-link readlinks (even
when using the unsafe host /proc handle). Unfortunately Reopen is still
potentially vulnerable to those kinds of somewhat-esoteric attacks.
Several improvements were made to the errors returned by Open(at)InRoot and
MkdirAll when dealing with invalid paths under the emulated (ie.
non-openat2) implementation. Previously, some paths would return the wrong
error (ENOENT when the last component was a non-directory), and other paths
would be returned as though they were acceptable (trailing-slash components
after a non-directory would be ignored by Open(at)InRoot).
These changes were done to match openat2's behaviour and purely is a
consistency fix (most users are going to be using openat2 anyway).
However, it does introduce a new *os.File-based API which is much safer
to use for most usecases. These are adapted from [libpathrs][1] and are
the bare minimum to be able to operate more safely on an untrusted
rootfs where an attacker has write access (something that SecureJoin
cannot protect against). The new APIs are:
OpenInRoot, which resolves a path inside a rootfs and returns an
*os.File handle to the path. Note that the file handle returned by
OpenInRoot is an O_PATH handle, which cannot be used for reading or
writing (as well as some other operations -- see open(2) for more
details).
Reopen, which takes an O_PATH file handle and safely re-opens it to
"upgrade" it to a regular handle.
By allowing Open(at)InRoot to opt-out of the extra work done by MkdirAll
to do the necessary "partial lookups", Open(at)InRoot now does less work
for both implementations (resulting in a many-fold decrease in the number of
operations for openat2, and a modest improvement for non-openat2) and is
far more guaranteed to match the correct openat2(RESOLVE_IN_ROOT)
behaviour.
We now use readlinkat(fd, "") where possible. For Open(at)InRoot this
effectively just means that we no longer risk getting spurious errors during
rename races. However, for our hardened procfs handler, this in theory should
prevent mount attacks from tricking us when doing magic-link readlinks (even
when using the unsafe host /proc handle). Unfortunately Reopen is still
potentially vulnerable to those kinds of somewhat-esoteric attacks.
Several improvements were made to the errors returned by Open(at)InRoot and
MkdirAll when dealing with invalid paths under the emulated (ie.
non-openat2) implementation. Previously, some paths would return the wrong
error (ENOENT when the last component was a non-directory), and other paths
would be returned as though they were acceptable (trailing-slash components
after a non-directory would be ignored by Open(at)InRoot).
These changes were done to match openat2's behaviour and purely is a
consistency fix (most users are going to be using openat2 anyway).
[0.3.0] - 2024-07-11
Added
A new set of *os.File-based APIs have been added. These are adapted from
[libpathrs][] and we strongly suggest using them if possible (as they provide
far more protection against attacks than SecureJoin):
Open(at)InRoot resolves a path inside a rootfs and returns an *os.File
handle to the path. Note that the handle returned is an O_PATH handle,
which cannot be used for reading or writing (as well as some other
operations -- [see open(2) for more details][open.2])
Reopen takes an O_PATH file handle and safely re-opens it to upgrade
it to a regular handle. This can also be used with non-O_PATH handles,
but O_PATH is the most obvious application.
MkdirAll is an implementation of os.MkdirAll that is safe to use to
Bumps the go-modules group with 29 updates in the / directory:
0.18.00.18.70.11.70.12.51.0.61.1.04.2.14.3.01.3.71.3.90.2.40.3.10.8.00.8.21.4.31.4.45.11.05.12.01.4.11.4.21.4.01.5.01.17.41.17.90.0.0-20230301153543-ba94b245509b0.1.10.0.150.0.160.5.00.6.00.1.00.2.04.1.194.1.210.4.40.4.70.2.00.4.03.23.123.24.51.3.11.4.00.5.30.5.52.15.02.18.00.3.130.3.140.5.30.5.40.49.00.53.00.17.00.19.00.25.00.27.01.33.01.34.2Updates
github.com/paketo-buildpacks/occamfrom 0.18.0 to 0.18.7Release notes
Sourced from github.com/paketo-buildpacks/occam's releases.
... (truncated)
Commits
aff3030Buildpack packaging should always target linux7b8692dUpdates go mod toolchain version to 1.22.4ddf2781Bump github.com/docker/dockere9fee75Adds support of buildpackages in buildpack store and updates freezer (#302)dda57beUpdating github-configf0b937bUse stable go version everywhere.354d744Bump to go 1.2164bc107Updating github-configd00fe4bBump github.com/docker/docker37502e4Bump github.com/testcontainers/testcontainers-go from 0.30.0 to 0.31.0Updates
github.com/ForestEckhardt/freezerfrom 0.0.12 to 0.1.0Release notes
Sourced from github.com/ForestEckhardt/freezer's releases.
Commits
a57bf55Updates fetchers to create buildpackagesUpdates
github.com/Microsoft/hcsshimfrom 0.11.7 to 0.12.5Release notes
Sourced from github.com/Microsoft/hcsshim's releases.
... (truncated)
Commits
e970943Modifying network flag EnableIov.4f77a09Hcsshim wrapper over HNS API needed for exclusion of management mac addresses...3b5bd8a[release/0.12] vendor: github.com/containerd/containerd v17.1840cdbc8Adding state attribute to the HNSEndpoint struct to support hyperv containers...c6a8327Adding support for loadbalancer policy update in hns. (#2085)44e4ec0Changes for checking the global version for modify policy version support. (#...62f86c0OutBoundNATPolicy Schema changes (#2106)c950974Update go-winio to v0.6.2 & fix lint errorsad1ccf5fix: move permissions to the correct job (#2080) (#2081)6588c1cUpdating permissions and github release action versions (#2078) (#2079)Updates
github.com/andybalholm/brotlifrom 1.0.6 to 1.1.0Commits
17e5901Make my matchfinder work more accessible.cf812c0matchfinder: add M01b6cf36matchfinder: remove MultiHash265f3afmatchfinder: penalize score for overlapping matchesa8d524amatchfinder: replace Score function with DistanceBitCost578645ematchfinder: add MultiHash24b2bfamatchfinder.M4: add Score function4a024e3matchfinder.M4: add match chain3a1c5cdFix typo in comment.0d2aef3matchfinder.M4: factor out extendMatch2Updates
github.com/cenkalti/backoff/v4from 4.2.1 to 4.3.0Commits
720b789remove travis badge from readmea83af7ffeat(backoff): Add functional options for ExponentialBackOff Closes #136Updates
github.com/cloudflare/circlfrom 1.3.7 to 1.3.9Release notes
Sourced from github.com/cloudflare/circl's releases.
Commits
75b28edPreparing CIRCL release v1.3.99e7c49bDetects invalid encodings of bls12381 elements.5f94471Test for invalid encodings of BLS12381.456fe41dilithium: fix typo4bb5601Serializing ciphertext with 32-bit prefixes.a4252c7Test functions working with ciphertext.64431bbTesting long plaintext.fe2b663Using SHAKE128 as a fixed prgn for golden files.2c600ffAlign to thepuregobuild tag, removingnoasmbuild taga4b7601Ensure pairing functions don't overwrite the input.Updates
github.com/cyphar/filepath-securejoinfrom 0.2.4 to 0.3.1Release notes
Sourced from github.com/cyphar/filepath-securejoin's releases.
... (truncated)
Changelog
Sourced from github.com/cyphar/filepath-securejoin's changelog.
... (truncated)
Commits
ce7b28aVERSION: release v0.3.1a2c14f8CHANGELOG: add readlinkat(fd, "") shout-out4ea279fmerge #22 into cyphar/filepath-securejoin:main16e1becCHANGELOG: add initial changelog with current history2404ffbmerge #21 into cyphar/filepath-securejoin:mainf29b7a4lookup: handle // and trailing slash components correctlyecd61camerge #19 into cyphar/filepath-securejoin:main38b1220procfs: refactor statx mnt_id logic45c4415procfs: use readlink(fd, "") for magic-linksedab538merge #17 into cyphar/filepath-securejoin:mainUpdates
github.com/docker/docker-credential-helpersfrom 0.8.0 to 0.8.2Release notes
Sourced from github.com/docker/docker-credential-helpers's releases.
Commits
6b9df3eMerge pull request #323 from thaJeztah/pass_simplify_getdc10c50Merge pull request #317 from docker/dependabot/github_actions/softprops/actio...896eb37build(deps): bump softprops/action-gh-release to 2.0.5a14669fpass: Get: remove redundant stat74840b3Merge pull request #322 from thaJeztah/pass_dryd3ef442pass: add utilities for encoding/decoding serverURLf64d6b1Merge pull request #321 from thaJeztah/fix_pass_errors1bb9aa3pass: return correct error, and ignore empty stores on list73b9e5dMerge pull request #320 from thaJeztah/update_gha0c43fedupdate to go1.21.10Updates
github.com/gabriel-vasile/mimetypefrom 1.4.3 to 1.4.4Release notes
Sourced from github.com/gabriel-vasile/mimetype's releases.
Commits
43192c8Bump the github-actions group across 1 directory with 3 updates (#534)07821d3Using io.ReadAll instead of ioutil.ReadAll (#525)9bd6023github actions & readme: remove codecov badge (#533)ff4d3d0improve performance for text detection (#532)bc511b8add defaultLimit and use it when resetting back (#531)341c422Improve x-subrip detection performance (#524)043efb9fix benchmark files order (#518)fd7639eftyp: exit asap to prevent mem allocs (#517)889166dMerge pull request #505 from gabriel-vasile/dependabot/github_actions/github-...e938b0cMerge pull request #502 from gabriel-vasile/dependabot/go_modules/gomod-82d2d...Updates
github.com/go-git/go-git/v5from 5.11.0 to 5.12.0Release notes
Sourced from github.com/go-git/go-git/v5's releases.
Commits
302dddeMerge pull request #1060 from go-git/dependabot/go_modules/github.com/gliderl...6bba34dbuild: bump github.com/gliderlabs/ssh from 0.3.6 to 0.3.7feaeb36Merge pull request #937 from matejrisek/feature/rename-short-fields7959a42Merge pull request #1052 from go-git/dependabot/go_modules/github.com/skeema/...4c17ce7build: bump github.com/skeema/knownhosts from 1.2.1 to 1.2.23f77e6fMerge pull request #1048 from pjbgf/fix-reset-validation6af38e0Merge pull request #1047 from avoidalone/mastere6c3e58Merge pull request #1044 from pjbgf/ff-merge04f7b23*: fix some commentsf4f1a87Merge pull request #971 from nodivbyzero/fix-177-diff-print-file-statsUpdates
github.com/go-logr/logrfrom 1.4.1 to 1.4.2Release notes
Sourced from github.com/go-logr/logr's releases.