[PATCH] Fix CVE-2020-15257
authorTianon Gravi <tianon@infosiftr.com>
Tue, 24 Nov 2020 12:38:31 +0000 (12:38 +0000)
committerFelix Geyer <fgeyer@debian.org>
Sun, 21 Feb 2021 17:18:35 +0000 (17:18 +0000)
commitbd1900611f16f522359a89b784f651b1685f0e1e
tree3d8b6f50b75eef29b03301c08e4a3234dce97bd5
parentcfbd5a661e5b453258d006740394768a8c7f7de2
[PATCH] Fix CVE-2020-15257

This is the 1.2 backport. It's the Samuel Karp patch with additional changes:

 - Add ReadAddress function from commit 84a24711e88
 - Add "horten the unix socket path for shim" commit (a631796fda6)

Below is the original commit message:

-----------------------------------------------------------------------

Use path based unix socket for shims

This allows filesystem based ACLs for configuring access to the socket of a
shim.

Co-authored-by: Samuel Karp <skarp@amazon.com>
Signed-off-by: Samuel Karp <skarp@amazon.com>
Signed-off-by: Michael Crosby <michael@thepasture.io>
Signed-off-by: Michael Crosby <michael.crosby@apple.com>
-----------------------------------------------------------------------

containerd-shim: use path-based unix socket

This allows filesystem-based ACLs for configuring access to the socket
of a shim.

Ported from Michael Crosby's similar patch for v2 shims.

Signed-off-by: Samuel Karp <skarp@amazon.com>
-----------------------------------------------------------------------

Co-authored-by: Paulo Flabiano Smorigo <pfsmorigo@canonical.com>
Co-authored-by: varsha teratipally <teratipally@google.com>
Signed-off-by: Tianon Gravi <tianon@infosiftr.com>
Gbp-Pq: Name cve-2020-15257.patch
containerd/cmd/containerd-shim/main_unix.go
containerd/cmd/ctr/commands/shim/shim.go
containerd/container_test.go
containerd/runtime/v1/linux/bundle.go
containerd/runtime/v1/shim/client/client.go
containerd/runtime/v2/runc/service.go
containerd/runtime/v2/shim/shim.go
containerd/runtime/v2/shim/shim_unix.go
containerd/runtime/v2/shim/util.go
containerd/runtime/v2/shim/util_unix.go
containerd/runtime/v2/shim/util_windows.go