Initialize nss libraries in Glibc so that the dynamic libraries are loaded in the...

See also OpenVZ https://github.com/kolyshkin/vzctl/blob/a3f732ef751998913fcf0a11b3e05236b51fd7e9/src/enter.c#L227-L234

Signed-off-by: Justin Cormack <justin.cormack@docker.com>
Signed-off-by: Tibor Vass <tibor@docker.com>
(cherry picked from commit a316b10dab79d9298b02c7930958ed52e0ccf4e4)

Gbp-Pq: Name cve-2019-14271-Initialize-nss-libraries-in-Glibc.patch

diff --git a/engine/pkg/chrootarchive/archive.go b/engine/pkg/chrootarchive/archive.go
index 6ff61e6a767af105d6584b4e5c60f75ed59f747b..83ed0c6b2feb7e77d0b4716b04c75a6dea75e5a8 100644 (file)
--- a/engine/pkg/chrootarchive/archive.go
+++ b/engine/pkg/chrootarchive/archive.go
@@ -4,13 +4,22 @@ import (
        "fmt"
        "io"
        "io/ioutil"
+       "net"
        "os"
+       "os/user"
        "path/filepath"
 
        "github.com/docker/docker/pkg/archive"
        "github.com/docker/docker/pkg/idtools"
 )
 
+func init() {
+       // initialize nss libraries in Glibc so that the dynamic libraries are loaded in the host
+       // environment not in the chroot from untrusted files.
+       _, _ = user.Lookup("docker")
+       _, _ = net.LookupHost("localhost")
+}
+
 // NewArchiver returns a new Archiver which uses chrootarchive.Untar
 func NewArchiver(idMapping *idtools.IdentityMapping) *archive.Archiver {
        if idMapping == nil {