Revert to b01dc82 baseline and backport CVE-2026-47766 fix#4
Merged
Conversation
|
TAG Bot TAG: 1.14.4-1deepin1 |
Contributor
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
Zeno-sole
changed the title
Contributor
Author
|
/integrate |
|
AutoIntegrationPr Bot |
Contributor
Author
|
/integrate |
Open rootfs /dev with safe_openat before creating default devices or handler-specific devices. This keeps rootfs-controlled /dev symlinks from redirecting device setup outside the container rootfs. Replace openat calls with safe_openat in create_missing_devs (linux.c) and libkrun_configure_container (handlers/krun.c) to validate the path and prevent symlink-based escapes. The patch is adapted for the 1.14.4 codebase: 1.14.4 uses O_RDONLY flags (1.21 uses O_PATH) and safe_openat requires an extra rootfs_len parameter (7 args vs 6 in 1.21). CVE: CVE-2026-47766 Origin: upstream, containers/crun@c6f338a Log: Fix CVE-2026-47766 by using safe_openat for rootfs /dev access Influence: 1. Verify container device creation works correctly with normal rootfs /dev 2. Test that rootfs /dev symlinks cannot redirect device setup outside rootfs 3. Validate krun handler container startup with /dev symlinks 4. Check no regression in default device population for containers 5. Run test_dev_symlink_does_not_populate_outside_rootfs test case fix: 修复 CVE-2026-47766 不跟随 rootfs /dev 符号链接 在创建默认设备或处理器特定设备之前，使用 safe_openat 打开 rootfs /dev。 这可以防止 rootfs 控制的 /dev 符号链接将设备设置重定向到容器 rootfs 之外。 在 create_missing_devs (linux.c) 和 libkrun_configure_container (handlers/krun.c) 中将 openat 调用替换为 safe_openat，以验证路径并防止基于符号链接的逃逸。 patch 已适配 1.14.4 代码库：1.14.4 使用 O_RDONLY 标志（1.21 使用 O_PATH）， 且 safe_openat 需要额外的 rootfs_len 参数（7 个参数，1.21 为 6 个）。 Log: 修复 CVE-2026-47766，使用 safe_openat 访问 rootfs /dev 防止符号链接逃逸 Influence: 1. 验证正常 rootfs /dev 下容器设备创建正常工作 2. 测试 rootfs /dev 符号链接无法将设备设置重定向到 rootfs 之外 3. 验证 krun 处理器在 /dev 符号链接下的容器启动 4. 检查容器默认设备填充无回归 5. 运行 test_dev_symlink_does_not_populate_outside_rootfs 测试用例 repo: crun #master
Zeno-sole
force-pushed
the
revert-to-b01dc82
branch
from
July 23, 2026 11:26
a29a51d to
0cfad39
Compare
Contributor
Author
|
/integrate |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
This PR reverts the repository to the
b01dc82baseline (1.14.4-1) and then backports the CVE-2026-47766 fix on top of it.Changes
1. Revert to b01dc82 state
Reverts all commits after
b01dc8251e983b3f7f7b5d6f7135717dc03ad421:e814bedfix(cve): CVE-2026-4776614e5c02feat: update crun to 1.21-12. Backport CVE-2026-47766 fix (new commit)
debian/patches/CVE-2026-47766.patch(identical to the original frome814bed)debian/patches/serieswithCVE-2026-47766.patch1.14.4-1deepin1usingdch, following RFC-0012 versioningCVE Details
src/libcrun/linux.c,src/libcrun/handlers/krun.c)safe_openatinstead ofopenatfor /dev accessVersion
1.14.4-1→1.14.4-1deepin1(RFC-0012 compliant)