Skip to content

Commit 59ce246

Browse files
jslobodzianjslobodzian
committed
Merge branch 'main' into 2.0
2 parents 55d64f6 + f55af6f commit 59ce246

15 files changed

+1178
-42
lines changed

‎SPECS/cri-o/CVE-2021-3602.patch

Lines changed: 119 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,119 @@
1+
From 8716daa06e9eb421438b338f18b6b650b082b208 Mon Sep 17 00:00:00 2001
2+
From: Cameron Baird <[email protected]>
3+
Date: Tue, 16 Apr 2024 22:33:46 +0000
4+
Subject: [PATCH 4/4] CVE-2021-3602
5+
6+
---
7+
.../github.com/containers/buildah/chroot/run.go | 15 +++++----------
8+
.../podman/v3/pkg/specgen/generate/security.go | 7 +++++--
9+
2 files changed, 10 insertions(+), 12 deletions(-)
10+
11+
diff --git a/vendor/github.com/containers/buildah/chroot/run.go b/vendor/github.com/containers/buildah/chroot/run.go
12+
index a93f97dcd..643f5c91d 100644
13+
--- a/vendor/github.com/containers/buildah/chroot/run.go
14+
+++ b/vendor/github.com/containers/buildah/chroot/run.go
15+
@@ -160,7 +160,7 @@ func RunUsingChroot(spec *specs.Spec, bundlePath, homeDir string, stdin io.Reade
16+
cmd := unshare.Command(runUsingChrootCommand)
17+
cmd.Stdin, cmd.Stdout, cmd.Stderr = stdin, stdout, stderr
18+
cmd.Dir = "/"
19+
- cmd.Env = append([]string{fmt.Sprintf("LOGLEVEL=%d", logrus.GetLevel())}, os.Environ()...)
20+
+ cmd.Env = []string{fmt.Sprintf("LOGLEVEL=%d", logrus.GetLevel())}
21+
22+
logrus.Debugf("Running %#v in %#v", cmd.Cmd, cmd)
23+
confwg.Add(1)
24+
@@ -206,7 +206,7 @@ func runUsingChrootMain() {
25+
os.Exit(1)
26+
}
27+
28+
- if options.Spec == nil {
29+
+ if options.Spec == nil || options.Spec.Process == nil {
30+
fmt.Fprintf(os.Stderr, "invalid options spec in runUsingChrootMain\n")
31+
os.Exit(1)
32+
}
33+
@@ -572,7 +572,7 @@ func runUsingChroot(spec *specs.Spec, bundlePath string, ctty *os.File, stdin io
34+
cmd := unshare.Command(append([]string{runUsingChrootExecCommand}, spec.Process.Args...)...)
35+
cmd.Stdin, cmd.Stdout, cmd.Stderr = stdin, stdout, stderr
36+
cmd.Dir = "/"
37+
- cmd.Env = append([]string{fmt.Sprintf("LOGLEVEL=%d", logrus.GetLevel())}, os.Environ()...)
38+
+ cmd.Env = []string{fmt.Sprintf("LOGLEVEL=%d", logrus.GetLevel())}
39+
cmd.UnshareFlags = syscall.CLONE_NEWUTS | syscall.CLONE_NEWNS
40+
requestedUserNS := false
41+
for _, ns := range spec.Linux.Namespaces {
42+
@@ -662,7 +662,7 @@ func runUsingChrootExecMain() {
43+
// Set the hostname. We're already in a distinct UTS namespace and are admins in the user
44+
// namespace which created it, so we shouldn't get a permissions error, but seccomp policy
45+
// might deny our attempt to call sethostname() anyway, so log a debug message for that.
46+
- if options.Spec == nil {
47+
+ if options.Spec == nil || options.Spec.Process == nil {
48+
fmt.Fprintf(os.Stderr, "invalid options spec passed in\n")
49+
os.Exit(1)
50+
}
51+
@@ -818,7 +818,6 @@ func runUsingChrootExecMain() {
52+
// Output debug messages when that differs from what we're being asked to do.
53+
func logNamespaceDiagnostics(spec *specs.Spec) {
54+
sawMountNS := false
55+
- sawUserNS := false
56+
sawUTSNS := false
57+
for _, ns := range spec.Linux.Namespaces {
58+
switch ns.Type {
59+
@@ -853,9 +852,8 @@ func logNamespaceDiagnostics(spec *specs.Spec) {
60+
}
61+
case specs.UserNamespace:
62+
if ns.Path != "" {
63+
- logrus.Debugf("unable to join user namespace %q, creating a new one", ns.Path)
64+
+ logrus.Debugf("unable to join user namespace, sorry about that")
65+
}
66+
- sawUserNS = true
67+
case specs.UTSNamespace:
68+
if ns.Path != "" {
69+
logrus.Debugf("unable to join UTS namespace %q, creating a new one", ns.Path)
70+
@@ -866,9 +864,6 @@ func logNamespaceDiagnostics(spec *specs.Spec) {
71+
if !sawMountNS {
72+
logrus.Debugf("mount namespace not requested, but creating a new one anyway")
73+
}
74+
- if !sawUserNS {
75+
- logrus.Debugf("user namespace not requested, but creating a new one anyway")
76+
- }
77+
if !sawUTSNS {
78+
logrus.Debugf("UTS namespace not requested, but creating a new one anyway")
79+
}
80+
diff --git a/vendor/github.com/containers/podman/v3/pkg/specgen/generate/security.go b/vendor/github.com/containers/podman/v3/pkg/specgen/generate/security.go
81+
index e0e4a47a4..3cda89a32 100644
82+
--- a/vendor/github.com/containers/podman/v3/pkg/specgen/generate/security.go
83+
+++ b/vendor/github.com/containers/podman/v3/pkg/specgen/generate/security.go
84+
@@ -146,6 +146,10 @@ func securityConfigureGenerator(s *specgen.SpecGenerator, g *generate.Generator,
85+
86+
configSpec := g.Config
87+
configSpec.Process.Capabilities.Ambient = []string{}
88+
+
89+
+ // Always unset the inheritable capabilities similarly to what the Linux kernel does
90+
+ // They are used only when using capabilities with uid != 0.
91+
+ configSpec.Process.Capabilities.Inheritable = []string{}
92+
configSpec.Process.Capabilities.Bounding = caplist
93+
94+
user := strings.Split(s.User, ":")[0]
95+
@@ -153,7 +157,6 @@ func securityConfigureGenerator(s *specgen.SpecGenerator, g *generate.Generator,
96+
if (user == "" && s.UserNS.NSMode != specgen.KeepID) || user == "root" || user == "0" {
97+
configSpec.Process.Capabilities.Effective = caplist
98+
configSpec.Process.Capabilities.Permitted = caplist
99+
- configSpec.Process.Capabilities.Inheritable = caplist
100+
} else {
101+
mergedCaps, err := capabilities.MergeCapabilities(nil, s.CapAdd, nil)
102+
if err != nil {
103+
@@ -175,12 +178,12 @@ func securityConfigureGenerator(s *specgen.SpecGenerator, g *generate.Generator,
104+
}
105+
configSpec.Process.Capabilities.Effective = userCaps
106+
configSpec.Process.Capabilities.Permitted = userCaps
107+
- configSpec.Process.Capabilities.Inheritable = userCaps
108+
109+
// Ambient capabilities were added to Linux 4.3. Set ambient
110+
// capabilities only when the kernel supports them.
111+
if supportAmbientCapabilities() {
112+
configSpec.Process.Capabilities.Ambient = userCaps
113+
+ configSpec.Process.Capabilities.Inheritable = userCaps
114+
}
115+
}
116+
117+
--
118+
2.33.8
119+

‎SPECS/cri-o/CVE-2021-44716.patch

Lines changed: 45 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,45 @@
1+
From deb00def7d110f1b4edbe5d03044a9d9f2516151 Mon Sep 17 00:00:00 2001
2+
From: Cameron Baird <[email protected]>
3+
Date: Wed, 17 Apr 2024 20:57:05 +0000
4+
Subject: [PATCH 2/2] CVE-2021-44716
5+
6+
---
7+
vendor/golang.org/x/net/http2/server.go | 15 ++++++++++++---
8+
1 file changed, 12 insertions(+), 3 deletions(-)
9+
10+
diff --git a/vendor/golang.org/x/net/http2/server.go b/vendor/golang.org/x/net/http2/server.go
11+
index e125bbd2a..5f417b444 100644
12+
--- a/vendor/golang.org/x/net/http2/server.go
13+
+++ b/vendor/golang.org/x/net/http2/server.go
14+
@@ -720,7 +720,15 @@ func (sc *serverConn) canonicalHeader(v string) string {
15+
sc.canonHeader = make(map[string]string)
16+
}
17+
cv = http.CanonicalHeaderKey(v)
18+
- sc.canonHeader[v] = cv
19+
+ // maxCachedCanonicalHeaders is an arbitrarily-chosen limit on the number of
20+
+ // entries in the canonHeader cache. This should be larger than the number
21+
+ // of unique, uncommon header keys likely to be sent by the peer, while not
22+
+ // so high as to permit unreaasonable memory usage if the peer sends an unbounded
23+
+ // number of unique header keys.
24+
+ const maxCachedCanonicalHeaders = 32
25+
+ if len(sc.canonHeader) < maxCachedCanonicalHeaders {
26+
+ sc.canonHeader[v] = cv
27+
+ }
28+
return cv
29+
}
30+
31+
@@ -2530,8 +2538,9 @@ func (rws *responseWriterState) writeChunk(p []byte) (n int, err error) {
32+
// prior to the headers being written. If the set of trailers is fixed
33+
// or known before the header is written, the normal Go trailers mechanism
34+
// is preferred:
35+
-// https://golang.org/pkg/net/http/#ResponseWriter
36+
-// https://golang.org/pkg/net/http/#example_ResponseWriter_trailers
37+
+//
38+
+// https://golang.org/pkg/net/http/#ResponseWriter
39+
+// https://golang.org/pkg/net/http/#example_ResponseWriter_trailers
40+
const TrailerPrefix = "Trailer:"
41+
42+
// promoteUndeclaredTrailers permits http.Handlers to set trailers
43+
--
44+
2.33.8
45+

0 commit comments

Comments
 (0)