erabo/spiegel_podman
1
0
Fork 0
mirror of https://github.com/podman-container-tools/podman.git synced 2026-08-11 11:25:45 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 4
spiegel_podman/pkg
History
Paul Holzinger b026d9272c [v4.4.1-rhel] kube play: don't follow volume symlinks onto the host 
For ConfigMap and Secret kube play volumes podman populates the data
from the yaml. However the volume content is not controlled by us and we
can be tricked following a symlink to a file on the host instead.

Fixes: CVE-2025-9566

Fixes: https://issues.redhat.com/browse/RHEL-113150,
https://issues.redhat.com/browse/RHEL-113143,
https://issues.redhat.com/browse/OCPBUGS-61271, https://issues.redhat.com/browse/OCPBUGS-61267

Signed-off-by: Paul Holzinger <pholzing@redhat.com>
Signed-off-by: tomsweeneyredhat <tsweeney@redhat.com>
2025-09-09 20:00:21 -04:00
..
annotations Remove ReservedAnnotations from kube generate specification 2023-01-18 08:46:24 -05:00
api remote,build: error if containerignore is symlink 2024-03-13 20:02:10 +05:30
auth [CI:DOCS] Fix spelling and typos 2022-11-19 16:26:00 +01:00
autoupdate bump golangci-lint to v1.49.0 2022-10-17 09:19:41 +02:00
bindings remote,build: error if containerignore is symlink 2024-03-13 20:02:10 +05:30
channel bump golangci-lint to v1.50.1 2022-12-15 13:39:56 +01:00
checkpoint checkpoint restore: fix --ignore-static-ip/mac 2022-12-12 18:34:49 +01:00
copy pkg: switch to golang native error wrapping 2022-07-08 08:54:47 +02:00
criu deps: bump go-criu to v6 2022-11-01 13:57:24 +05:30
ctime Replace deprecated ioutil 2022-09-20 15:34:27 -04:00
domain [v4.4.1-rhel] kube play: don't follow volume symlinks onto the host 2025-09-09 20:00:21 -04:00
env [CI:DOCS] Fix spelling and typos 2022-11-19 16:26:00 +01:00
errorhandling libpod/runtime: switch to golang native error wrapping 2022-07-04 15:39:00 +02:00
inspect pkg/inspect: remove unused ImageResult type 2022-05-24 16:07:39 +02:00
k8s.io [v4.4.1-rhel] *: migrate image registry to registry.k8s.io 2024-07-20 16:44:53 -04:00
lookup bump golangci-lint to v1.50.1 2022-12-15 13:39:56 +01:00
machine Resolve symlink path for qemu directory if possible 2023-02-08 14:17:19 +00:00
namespaces libpod: Add pasta networking mode 2022-11-08 00:16:35 +01:00
parallel Fix stutters 2022-09-10 07:52:00 -04:00
ps DB: make loading container states optional 2023-01-27 09:14:12 +00:00
rctl pkg/rctl: Remove unused cgo dependency 2022-10-31 15:13:48 +00:00
rootless [v4.4.1-rhel] Add file switch for pre-exec hooks 2023-04-26 10:12:54 -04:00
rootlessport go fmt: use go 1.18 conditional-build syntax 2022-03-18 09:11:53 +01:00
seccomp pkg: switch to golang native error wrapping 2022-07-08 08:54:47 +02:00
selinux Fix SELinux functions names to not be repetitive 2020-04-23 15:57:34 -04:00
servicereaper go fmt: use go 1.18 conditional-build syntax 2022-03-18 09:11:53 +01:00
signal Run codespell on code 2022-11-04 10:57:41 -04:00
specgen oci: bind mount /sys with --userns=(auto|pod:) 2023-02-07 14:40:56 -05:00
specgenutil Remove ReservedAnnotations from kube generate specification 2023-01-18 08:46:24 -05:00
systemd kube play: only enforce passthrough in Quadlet 2023-02-20 07:53:56 +00:00
terminal podman ssh work, using new c/common interface 2022-08-09 14:00:58 -04:00
timetype bump golangci-lint to v1.49.0 2022-10-17 09:19:41 +02:00
trust pkg/trust: Take the default policy path from c/common/pkg/config 2022-11-25 10:14:15 +00:00
util Merge pull request #20906 from lsm5/v4.4.1-rhel-fr 2024-04-16 18:07:07 +00:00