ms2k/lazaret
SHA256
Watch
0
Code Releases 3 Activity

Refuse prepared-lower child mount crossings

Browse source
This commit is contained in:
ms2k 2026-07-16 21:09:48 +09:00
commit b35582a9e6
1 changed files with 83 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

10
crates/lazaret-prepared-lower/src/store.rs
View file

@ -693,7 +693,10 @@ fn hex(bytes: &[u8]) -> String {
}
fn secure_resolve() -> ResolveFlags {
ResolveFlags::BENEATH | ResolveFlags::NO_SYMLINKS | ResolveFlags::NO_MAGICLINKS
ResolveFlags::BENEATH
| ResolveFlags::NO_SYMLINKS
| ResolveFlags::NO_MAGICLINKS
| ResolveFlags::NO_XDEV
}
#[cfg(test)]
@ -711,4 +714,9 @@ mod fixed_directory_tests {
std::fs::set_permissions(directory.path(), std::fs::Permissions::from_mode(0o700)).unwrap();
assert!(require_owned_directory(&root).is_ok());
}
#[test]
fn retained_store_resolution_refuses_mount_crossing() {
assert!(secure_resolve().contains(ResolveFlags::NO_XDEV));
}
}