github.com/moby/docker@v26.1.3+incompatible/internal/safepath/k8s_safeopen_linux.go (about)

     1  package safepath
     2  
     3  /*
     4  Copyright 2014 The Kubernetes Authors.
     5  
     6  Licensed under the Apache License, Version 2.0 (the "License");
     7  you may not use this file except in compliance with the License.
     8  You may obtain a copy of the License at
     9  
    10      http://www.apache.org/licenses/LICENSE-2.0
    11  
    12  Unless required by applicable law or agreed to in writing, software
    13  distributed under the License is distributed on an "AS IS" BASIS,
    14  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
    15  See the License for the specific language governing permissions and
    16  limitations under the License.
    17  */
    18  
    19  import (
    20  	"context"
    21  	"fmt"
    22  	"path/filepath"
    23  	"strings"
    24  
    25  	"github.com/containerd/log"
    26  	"github.com/docker/docker/internal/unix_noeintr"
    27  	"golang.org/x/sys/unix"
    28  )
    29  
    30  // kubernetesSafeOpen open path formed by concatenation of the base directory
    31  // and its subpath and return its fd.
    32  // Symlinks are disallowed (pathname must already resolve symlinks) and the
    33  // path must be within the base directory.
    34  // This is minimally modified code from https://github.com/kubernetes/kubernetes/blob/55fb1805a1217b91b36fa8fe8f2bf3a28af2454d/pkg/volume/util/subpath/subpath_linux.go#L530
    35  func kubernetesSafeOpen(base, subpath string) (int, error) {
    36  	// syscall.Openat flags used to traverse directories not following symlinks
    37  	const nofollowFlags = unix.O_RDONLY | unix.O_NOFOLLOW
    38  	// flags for getting file descriptor without following the symlink
    39  	const openFDFlags = unix.O_NOFOLLOW | unix.O_PATH
    40  
    41  	pathname := filepath.Join(base, subpath)
    42  	segments := strings.Split(subpath, string(filepath.Separator))
    43  
    44  	// Assumption: base is the only directory that we have under control.
    45  	// Base dir is not allowed to be a symlink.
    46  	parentFD, err := unix_noeintr.Open(base, nofollowFlags|unix.O_CLOEXEC, 0)
    47  	if err != nil {
    48  		return -1, &ErrNotAccessible{Path: base, Cause: err}
    49  	}
    50  	defer func() {
    51  		if parentFD != -1 {
    52  			if err = unix_noeintr.Close(parentFD); err != nil {
    53  				log.G(context.TODO()).Errorf("Closing FD %v failed for safeopen(%v): %v", parentFD, pathname, err)
    54  			}
    55  		}
    56  	}()
    57  
    58  	childFD := -1
    59  	defer func() {
    60  		if childFD != -1 {
    61  			if err = unix_noeintr.Close(childFD); err != nil {
    62  				log.G(context.TODO()).Errorf("Closing FD %v failed for safeopen(%v): %v", childFD, pathname, err)
    63  			}
    64  		}
    65  	}()
    66  
    67  	currentPath := base
    68  
    69  	// Follow the segments one by one using openat() to make
    70  	// sure the user cannot change already existing directories into symlinks.
    71  	for _, seg := range segments {
    72  		var deviceStat unix.Stat_t
    73  
    74  		currentPath = filepath.Join(currentPath, seg)
    75  		if !isLocalTo(currentPath, base) {
    76  			return -1, &ErrEscapesBase{Base: currentPath, Subpath: seg}
    77  		}
    78  
    79  		// Trigger auto mount if it's an auto-mounted directory, ignore error if not a directory.
    80  		// Notice the trailing slash is mandatory, see "automount" in openat(2) and open_by_handle_at(2).
    81  		unix_noeintr.Fstatat(parentFD, seg+"/", &deviceStat, unix.AT_SYMLINK_NOFOLLOW)
    82  
    83  		log.G(context.TODO()).Debugf("Opening path %s", currentPath)
    84  		childFD, err = unix_noeintr.Openat(parentFD, seg, openFDFlags|unix.O_CLOEXEC, 0)
    85  		if err != nil {
    86  			return -1, &ErrNotAccessible{Path: currentPath, Cause: err}
    87  		}
    88  
    89  		err := unix_noeintr.Fstat(childFD, &deviceStat)
    90  		if err != nil {
    91  			return -1, fmt.Errorf("error running fstat on %s with %v", currentPath, err)
    92  		}
    93  		fileFmt := deviceStat.Mode & unix.S_IFMT
    94  		if fileFmt == unix.S_IFLNK {
    95  			return -1, fmt.Errorf("unexpected symlink found %s", currentPath)
    96  		}
    97  
    98  		// Close parentFD
    99  		if err = unix_noeintr.Close(parentFD); err != nil {
   100  			return -1, fmt.Errorf("closing fd for %q failed: %v", filepath.Dir(currentPath), err)
   101  		}
   102  		// Set child to new parent
   103  		parentFD = childFD
   104  		childFD = -1
   105  	}
   106  
   107  	// We made it to the end, return this fd, don't close it
   108  	finalFD := parentFD
   109  	parentFD = -1
   110  
   111  	return finalFD, nil
   112  }