Backport symlink fixes to rhel9-branch - #1524
Merged
Merged
Conversation
This tests to make sure that using remove on a symlink pointing to a directory just removes the symlink, not the whole directory. Note that shutil.rmtree has used a symlink resistant version since python 3.3 so this test is purely to demonstrate that remove() uses unlink in that case. (cherry picked from commit 69245f6) Related: RHEL-238021
Just in case they have already been created as symlinks, use remove instead of shutil which will raise an error. (cherry picked from commit dca1e79) Related: RHEL-238021
Make sure that all the kernels returned are under the root directory. This prevents potential issues with accessing files on the host system. (cherry picked from commit 0db5798) Related: RHEL-238021
If there is an existing module-info, and it is a symlink, remove it before writing the new one. (cherry picked from commit 6e4647e) Related: RHEL-238021
This helps catch mistakes with hardlink, symlink, copy, move trying to access paths outside of the outroot set in the template runner. Should help prevent accidentally accessing host files and paths. (cherry picked from commit 0bbb060) Related: RHEL-238021
This function is similar to joinpaths, except that it will evaluate the final path and raise a RuntimeError if it is outside of the first argument passed. This can be used to help prevent absolute symlinks and directory traversals from pointing outside of a directory tree. Includes tests. (cherry picked from commit e5115e3) Related: RHEL-238021
This will raise a RuntimeError if the real path points outside the template runner's outroot. NOTE: This does not guarantee the safety of the template -- this is running as root, it has access to the whole system and is not safe to pass unknown templates into. This change is meant to help prevent accidentally accessing the host files. (cherry picked from commit 36bfff1) Related: RHEL-238021
This prevents absolute symlinks in the ostree boot path from pointing outside the image's directory tree. (cherry picked from commit aef9a50) Related: RHEL-238021
This ensures that the path used for the config_files cannot point outside of the mount_dir. (cherry picked from commit 8d88b4c) Related: RHEL-238021
This ensures that the boot directory from the image cannot be a symlink pointing outside of the root_dir (cherry picked from commit bfc9cff) Resolves: RHEL-238021
Coverage Report for CI Build 31532382359Coverage increased (+0.6%) to 45.555%Details
Uncovered Changes
Coverage RegressionsNo coverage regressions found. Coverage Stats
💛 - Coveralls |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Backport of #1522
Resolves: RHEL-238021