Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package kubevirt1.8 for openSUSE:Factory checked in at 2026-07-28 21:01:03 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/kubevirt1.8 (Old) and /work/SRC/openSUSE:Factory/.kubevirt1.8.new.2004 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "kubevirt1.8" Tue Jul 28 21:01:03 2026 rev:5 rq:1368214 version:1.8.4 Changes: -------- --- /work/SRC/openSUSE:Factory/kubevirt1.8/kubevirt1.8.changes 2026-07-20 10:00:38.826769289 +0200 +++ /work/SRC/openSUSE:Factory/.kubevirt1.8.new.2004/kubevirt1.8.changes 2026-07-28 21:01:08.790594727 +0200 @@ -1,0 +2,35 @@ +Tue Jul 28 14:16:58 UTC 2026 - Victor Toso de Carvalho <[email protected]> + +- Add a libguestfs-tools subpackage: upstream's + cmd/libguestfs/entrypoint.sh plus the runtime dependency closure of + the libguestfs-tools container image that virtctl guestfs spawns. + Replaces the dead virt-libguestfs-tools-container package, which + still installs the retired unversioned kubevirt-manifests and whose + published image is frozen at kubevirt 1.4.0; the container image + flavor moves to kubevirt-1.8-image. +- Security update correcting a CVE over-claim from the previous + re-vendor, verified by auditing the fix code actually present in + the vendored tree: + * CVE-2026-39821 (bsc#1266575): the previous entry claimed this + fixed by the golang.org/x/net v0.55.0 re-vendor, but 0.55.0's + idna fix is compile-time gated on Unicode 16 tables, which only + exist for go1.27+ - it is inert in our go1.26 builds, so the + claim was incorrect. Re-vendor golang.org/x/net v0.55.0 -> + v0.57.0, whose idna package rejects all-ASCII Punycode labels + unconditionally; the CVE is now actually fixed. +- Re-vendor golang.org/x/text v0.37.0 -> v0.40.0: CVE-2026-56852 + (bsc#1271661), infinite loop on invalid input in unicode/norm. +- golang.org/x/crypto v0.52.0 -> v0.54.0 (pulled in by x/net 0.57.0; + no additional CVE claims). +- Add 0001-safepath-make-sure-whole-path-has-no-symlink.patch and + 0002-console-use-JoinNoFollow-for-console-socket-path.patch: + CVE-2026-13201 (bsc#1269093), safepath resolves a path whose last + component is a symlink without detecting it, allowing metadata + operations via /proc/self/fd to act on the symlink target. + Backports of upstream release-1.8 commits df739ab8cc and + 7cc09989a2. +- x/net 0.57.0 also contains the fix for CVE-2026-46600 + (bsc#1272415) in dns/dnsmessage; kubevirt does not vendor that + package (not affected). + +------------------------------------------------------------------- New: ---- 0001-safepath-make-sure-whole-path-has-no-symlink.patch 0002-console-use-JoinNoFollow-for-console-socket-path.patch ----------(New B)---------- New: no additional CVE claims). - Add 0001-safepath-make-sure-whole-path-has-no-symlink.patch and 0002-console-use-JoinNoFollow-for-console-socket-path.patch: New:- Add 0001-safepath-make-sure-whole-path-has-no-symlink.patch and 0002-console-use-JoinNoFollow-for-console-socket-path.patch: CVE-2026-13201 (bsc#1269093), safepath resolves a path whose last ----------(New E)---------- ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ kubevirt1.8.spec ++++++ --- /var/tmp/diff_new_pack.8H8Hiz/_old 2026-07-28 21:01:09.730627840 +0200 +++ /var/tmp/diff_new_pack.8H8Hiz/_new 2026-07-28 21:01:09.734627980 +0200 @@ -30,6 +30,8 @@ Source1: kubevirt1.8_containers_meta Source2: kubevirt1.8_containers_meta.service Source3: %{url}/releases/download/v%{version}/disks-images-provider.yaml +Patch0001: 0001-safepath-make-sure-whole-path-has-no-symlink.patch +Patch0002: 0002-console-use-JoinNoFollow-for-console-socket-path.patch Source100: %{name}-rpmlintrc BuildRequires: glibc-devel-static BuildRequires: golang-packaging @@ -186,6 +188,48 @@ The package provides sidecar-shim binary than will call the respective hooks with the proper command-line arguments. +%package libguestfs-tools +Provides: kubevirt-libguestfs-tools = %{version}-%{release} +Obsoletes: kubevirt-libguestfs-tools < %{version}-%{release} +Provides: kubevirt-1.8-libguestfs-tools = %{version}-%{release} +Obsoletes: kubevirt-1.8-libguestfs-tools < %{version}-%{release} +Summary: Contents of the libguestfs-tools container +Group: System/Packages +# The runtime closure of the libguestfs-tools container image (the pod +# spawned by virtctl guestfs): the guestfs stack plus the filesystem +# tools offered inside the appliance. Mirrors the rpm tree upstream +# keeps in rpm/BUILD.bazel for its quay.io/kubevirt/libguestfs-tools. +Requires: btrfsprogs +Requires: cryptsetup +Requires: dosfstools +Requires: e2fsprogs +Requires: gptfdisk +Requires: guestfs-tools +Requires: jfsutils +Requires: ldmtool +Requires: libguestfs +Requires: libguestfs-appliance +Requires: libguestfs-winsupport +Requires: mdadm +Requires: parted +Requires: qemu-tools +Requires: supermin +Requires: xfsprogs +Requires: xorriso +%ifarch x86_64 +Requires: qemu-x86 +%endif +%ifarch aarch64 +Requires: qemu-arm +Requires: qemu-uefi-aarch64 +Requires: qemu-x86 +%endif + +%description libguestfs-tools +The libguestfs-tools package provides the entrypoint script and the +runtime dependency closure of the libguestfs-tools container image +used by virtctl guestfs. + %if 0%{?suse_version} >= 1699 %package manifests Provides: kubevirt-manifests = %{version}-%{release} @@ -334,6 +378,10 @@ mkdir -p %{buildroot}%{_datadir}/kube-virt-1.8/pr-helper install -p -m 0644 cmd/pr-helper/multipath.conf %{buildroot}%{_datadir}/kube-virt-1.8/pr-helper/ +# Entrypoint for the libguestfs-tools container +mkdir -p %{buildroot}%{_datadir}/kube-virt-1.8/libguestfs-tools +install -p -m 0755 cmd/libguestfs/entrypoint.sh %{buildroot}%{_datadir}/kube-virt-1.8/libguestfs-tools/ + # Configuration files for libvirt mkdir -p %{buildroot}%{_datadir}/kube-virt-1.8/virt-launcher install -p -m 0644 cmd/virt-launcher/virtqemud.conf %{buildroot}%{_datadir}/kube-virt-1.8/virt-launcher @@ -425,6 +473,12 @@ %dir %{_datadir}/kube-virt-1.8 %{_datadir}/kube-virt-1.8/pr-helper +%files libguestfs-tools +%license LICENSE +%doc README.md +%dir %{_datadir}/kube-virt-1.8 +%{_datadir}/kube-virt-1.8/libguestfs-tools + %files sidecar-shim %license LICENSE %doc cmd/sidecars/README.md ++++++ 0001-safepath-make-sure-whole-path-has-no-symlink.patch ++++++ diff --git a/pkg/safepath/safepath.go b/pkg/safepath/safepath.go index 55366ed2e1..0497c54262 100644 --- a/pkg/safepath/safepath.go +++ b/pkg/safepath/safepath.go @@ -122,7 +122,18 @@ func OpenAtNoFollow(path *Path) (file *File, err error) { } fd = newfd } - return &File{fd: fd, path: path}, nil + file = &File{fd: fd, path: path} + fstat, err := os.Stat(file.SafePath()) + if err != nil { + _ = file.Close() + return nil, err + } + if fstat.Mode()&os.ModeSymlink != 0 { + _ = file.Close() + return nil, fmt.Errorf("%s: the pathname is symlink", path) + } + + return file, nil } func ChmodAtNoFollow(path *Path, mode os.FileMode) error { diff --git a/pkg/safepath/safepath_test.go b/pkg/safepath/safepath_test.go index 498a16a832..262e59c0fc 100644 --- a/pkg/safepath/safepath_test.go +++ b/pkg/safepath/safepath_test.go @@ -263,6 +263,40 @@ var _ = Describe("safepath", func() { Expect(unsafepath.UnsafeRelative(child.Raw())).To(Equal("/test")) }) + It("should fail on symlink as base", func() { + baseDir := GinkgoT().TempDir() + // Create dir acting as root + Expect(os.MkdirAll(filepath.Join(baseDir, "root"), os.ModePerm)).To(Succeed()) + + root, err := JoinAndResolveWithRelativeRoot(filepath.Join(baseDir, "root")) + Expect(err).ToNot(HaveOccurred()) + + // create dir and file within root + Expect(os.MkdirAll(filepath.Join(baseDir, "root", "dir"), os.ModePerm)).To(Succeed()) + f, err := os.Create(filepath.Join(baseDir, "root", "dir", "file")) + Expect(err).ToNot(HaveOccurred()) + Expect(f.Close()).ToNot(HaveOccurred()) + + // create symlinks to dir & file + Expect(os.Symlink(filepath.Join(baseDir, "root", "dir"), + filepath.Join(baseDir, "root", "symtodir"))). + To(Succeed()) + Expect(os.Symlink(filepath.Join(baseDir, "root", "dir", "file"), + filepath.Join(baseDir, "root", "symtofile"))). + To(Succeed()) + + // Test + _, err = JoinNoFollow(root, "symtodir") + Expect(err).To(MatchError(ContainSubstring("symlink"))) + + _, err = NewPathNoFollow(filepath.Join(baseDir, "root", "symtodir")) + Expect(err).To(MatchError(ContainSubstring("symlink"))) + + _, err = NewFileNoFollow(filepath.Join(baseDir, "root", "symtofile")) + Expect(err).To(MatchError(ContainSubstring("symlink"))) + + }) + It("should append new relative root components to the relative path", func() { baseDir := GinkgoT().TempDir() root, err := JoinAndResolveWithRelativeRoot(baseDir) ++++++ 0002-console-use-JoinNoFollow-for-console-socket-path.patch ++++++ diff --git a/pkg/virt-handler/rest/console.go b/pkg/virt-handler/rest/console.go index 9a853dadf1..d37c91988e 100644 --- a/pkg/virt-handler/rest/console.go +++ b/pkg/virt-handler/rest/console.go @@ -26,6 +26,7 @@ import ( "io" "net" "net/http" + "path/filepath" "strconv" "sync" @@ -295,7 +296,7 @@ func (t *ConsoleHandler) getUnixSocketPath(vmi *v1.VirtualMachineInstance, socke if err != nil { return nil, err } - return root.AppendAndResolveWithRelativeRoot("run", "kubevirt-private", string(vmi.GetUID()), socketName) + return safepath.JoinNoFollow(root, filepath.Join("run", "kubevirt-private", string(vmi.GetUID()), socketName)) } func unixSocketDialer(vmi *v1.VirtualMachineInstance, socketPath *safepath.Path) func() (net.Conn, error) { ++++++ kubevirt-1.8.4.tar.gz ++++++ /work/SRC/openSUSE:Factory/kubevirt1.8/kubevirt-1.8.4.tar.gz /work/SRC/openSUSE:Factory/.kubevirt1.8.new.2004/kubevirt-1.8.4.tar.gz differ: char 12, line 1
