R-1214: the capped copy refuses any path with a symlink in it (security review: a link under /mnt pointing outside resolves elsewhere for the daemon); red-proved; unreleased

2026-10-22 17:51:14 +02:00
parent 03c0a693b8
commit ae394670c1
3 changed files with 33 additions and 3 deletions
@@ -818,9 +818,15 @@ func rsyncMirror(src, dst string) error {
 const tier2CopyMemCap = "512m"

 // tier2CappedPath: a path the controller and the Docker daemon see identically (the guest's /mnt is bind-mounted into
-// the controller at /mnt). Never a relative path, never `..`.
+// the controller at /mnt). Never a relative path, never `..`, and NO SYMLINK anywhere in it: a link under /mnt that
+// points outside /mnt resolves to a different place for the daemon (found by the commit's security review,
+// 2026-10-22) — the path must resolve to itself. The path must exist (rsyncMirror creates dst first).
 func tier2CappedPath(p string) bool {
-	return strings.HasPrefix(p, tier2CappedRoot) && filepath.Clean(p) == p
+	if !strings.HasPrefix(p, tier2CappedRoot) || filepath.Clean(p) != p {
+		return false
+	}
+	real, err := filepath.EvalSymlinks(p)
+	return err == nil && real == p
 }

 // tier2CappedRoot is "/mnt/" in production (a test seam: tests point it at a temp dir).