ms2k/lazaret
SHA256
Watch
0
Code Releases 3 Activity

Refuse prepared-lower child mount crossings

Browse source
This commit is contained in:
ms2k 2026-07-16 21:09:48 +09:00
commit b35582a9e6
1 changed files with 83 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

15
crates/lazaret-prepared-lower/src/layer.rs
View file

@ -859,7 +859,10 @@ fn timestamps(seconds: u64) -> Timestamps {
}
fn secure_resolve() -> ResolveFlags {
ResolveFlags::BENEATH | ResolveFlags::NO_SYMLINKS | ResolveFlags::NO_MAGICLINKS
ResolveFlags::BENEATH
| ResolveFlags::NO_SYMLINKS
| ResolveFlags::NO_MAGICLINKS
| ResolveFlags::NO_XDEV
}
fn rewound(source: &File) -> Result<File> {
@ -867,3 +870,13 @@ fn rewound(source: &File) -> Result<File> {
file.seek(SeekFrom::Start(0))?;
Ok(file)
}
#[cfg(test)]
mod tests {
use super::*;
#[test]
fn retained_layer_resolution_refuses_mount_crossing() {
assert!(secure_resolve().contains(ResolveFlags::NO_XDEV));
}
}