aljaz/kata-containers
1
0
Fork 0
mirror of https://github.com/aljazceru/kata-containers.git synced 2026-01-06 07:54:22 +01:00
Code Issues Packages Projects Releases Wiki Activity

config: Protect jailer_path annotation

Browse Source 
The jailer_path annotation can be used to execute arbitrary code on
the host. Add a jailer_path_list configuration entry providing a list
of regular expressions that can be used to filter annotations that
represent valid file names.

Fixes: #901

Signed-off-by: Christophe de Dinechin <dinechin@redhat.com>
This commit is contained in:
Christophe de Dinechin
2020-05-15 17:49:01 +02:00
parent 076690179d
commit 27b6620b23
6 changed files with 20 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
src/runtime/pkg/katautils/config.go
View File

@@ -535,6 +535,7 @@ func newFirecrackerHypervisorConfig(h hypervisor) (vc.HypervisorConfig, error) {
HypervisorPath: hypervisor,
HypervisorPathList: h.HypervisorPathList,
JailerPath: jailer,
JailerPathList: h.JailerPathList,
KernelPath: kernel,
InitrdPath: initrd,
ImagePath: image,