From b8dc5213e8d9f200dc1f5bbf22599f25a04fe3a3 Mon Sep 17 00:00:00 2001 From: Aleksa Sarai Date: Thu, 11 Feb 2016 21:15:50 +1100 Subject: [PATCH] libcontainer: cgroups: fs: fix path safety Ensure that path safety is maintained, this essentially reapplies c0cad6aa5e44 ("cgroups: fs: fix cgroup.Parent path sanitisation"), which was accidentally removed in 256f3a8ebc11 ("Add support for CgroupsPath field"). Signed-off-by: Aleksa Sarai --- libcontainer/cgroups/fs/apply_raw.go | 10 ++++++++-- libcontainer/utils/utils.go | 5 +++++ 2 files changed, 13 insertions(+), 2 deletions(-) diff --git a/libcontainer/cgroups/fs/apply_raw.go b/libcontainer/cgroups/fs/apply_raw.go index 81bf0b89a..b7461b932 100644 --- a/libcontainer/cgroups/fs/apply_raw.go +++ b/libcontainer/cgroups/fs/apply_raw.go @@ -14,6 +14,7 @@ import ( "github.com/opencontainers/runc/libcontainer/cgroups" "github.com/opencontainers/runc/libcontainer/configs" + libcontainerUtils "github.com/opencontainers/runc/libcontainer/utils" ) var ( @@ -276,9 +277,14 @@ func getCgroupData(c *configs.Cgroup, pid int) (*cgroupData, error) { return nil, fmt.Errorf("cgroup: either Path or Name and Parent should be used") } - innerPath := c.Path + // XXX: Do not remove this code. Path safety is important! -- cyphar + cgPath := libcontainerUtils.CleanPath(c.Path) + cgParent := libcontainerUtils.CleanPath(c.Parent) + cgName := libcontainerUtils.CleanPath(c.Name) + + innerPath := cgPath if innerPath == "" { - innerPath = filepath.Join(c.Parent, c.Name) + innerPath = filepath.Join(cgParent, cgName) } return &cgroupData{ diff --git a/libcontainer/utils/utils.go b/libcontainer/utils/utils.go index 1f5528ff3..68ae3c477 100644 --- a/libcontainer/utils/utils.go +++ b/libcontainer/utils/utils.go @@ -63,6 +63,11 @@ func WriteJSON(w io.Writer, v interface{}) error { // be a subdirectory of the prefixed path. This is all done lexically, so paths // that include symlinks won't be safe as a result of using CleanPath. func CleanPath(path string) string { + // Deal with empty strings nicely. + if path == "" { + return "" + } + // Ensure that all paths are cleaned (especially problematic ones like // "/../../../../../" which can cause lots of issues). path = filepath.Clean(path)