Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package buildah for openSUSE:Factory checked in at 2022-08-29 09:43:02 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/buildah (Old) and /work/SRC/openSUSE:Factory/.buildah.new.2083 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "buildah" Mon Aug 29 09:43:02 2022 rev:59 rq:999783 version:1.27.0 Changes: -------- --- /work/SRC/openSUSE:Factory/buildah/buildah.changes 2022-08-25 15:09:37.453282295 +0200 +++ /work/SRC/openSUSE:Factory/.buildah.new.2083/buildah.changes 2022-08-29 09:43:14.703837976 +0200 @@ -1,0 +2,6 @@ +Fri Aug 26 12:13:12 UTC 2022 - Dan ??erm??k <dcer...@suse.com> + +- Add fix for CVE-2022-2990 / bsc#1202812 + add: add-container-gid-to-additional-groups.patch + +------------------------------------------------------------------- New: ---- add-container-gid-to-additional-groups.patch ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ buildah.spec ++++++ --- /var/tmp/diff_new_pack.EZjtHg/_old 2022-08-29 09:43:15.299839393 +0200 +++ /var/tmp/diff_new_pack.EZjtHg/_new 2022-08-29 09:43:15.303839402 +0200 @@ -26,6 +26,7 @@ URL: https://%{project} Source0: %{name}-%{version}.tar.xz Source1: %{name}-rpmlintrc +Patch0: https://github.com/containers/buildah/commit/f0b2d39b83cd3bae8a6d0ef8c05fd384f81412a0.patch#./add-container-gid-to-additional-groups.patch BuildRequires: bash-completion BuildRequires: device-mapper-devel BuildRequires: fdupes @@ -65,7 +66,7 @@ - Delete a working container or an image %prep -%setup -q +%autosetup -p1 %build # We can't use symlinks here because go-list gets confused by symlinks, so we ++++++ add-container-gid-to-additional-groups.patch ++++++ >From 9934b17365083ce966b44c5ce3c7e052f516e255 Mon Sep 17 00:00:00 2001 From: Aditya R <ara...@redhat.com> Date: Wed, 24 Aug 2022 08:42:23 +0530 Subject: [PATCH] run: add container gid to additional groups When container is created with specific uid and gid also add container gid to supplementary/additional group. Signed-off-by: Aditya R <ara...@redhat.com> --- run_common.go | 1 + tests/bud.bats | 16 ++++++++++++++++ tests/bud/supplemental-groups/Dockerfile | 3 +++ tests/run.bats | 14 ++++++++++++++ 4 files changed, 34 insertions(+) create mode 100644 tests/bud/supplemental-groups/Dockerfile diff --git a/run_common.go b/run_common.go index 2054c56527..f5a5ec8505 100644 --- a/run_common.go +++ b/run_common.go @@ -262,6 +262,7 @@ func (b *Builder) configureUIDGID(g *generate.Generator, mountPoint string, opti } g.SetProcessUID(user.UID) g.SetProcessGID(user.GID) + g.AddProcessAdditionalGid(user.GID) for _, gid := range user.AdditionalGids { g.AddProcessAdditionalGid(gid) } diff --git a/tests/bud.bats b/tests/bud.bats index a37e418b41..07bdf45cac 100644 --- a/tests/bud.bats +++ b/tests/bud.bats @@ -366,6 +366,22 @@ _EOF expect_output --substring "invalid response status" } +@test "build test has gid in supplemental groups" { + _prefetch alpine + run_buildah build $WITH_POLICY_JSON -t source -f $BUDFILES/supplemental-groups/Dockerfile + # gid 1000 must be in supplemental groups + expect_output --substring "Groups: 1000" +} + +@test "build test if supplemental groups has gid with --isolation chroot" { + test -z "${BUILDAH_ISOLATION}" || skip "BUILDAH_ISOLATION=${BUILDAH_ISOLATION} overrides --isolation" + + _prefetch alpine + run_buildah build --isolation chroot $WITH_POLICY_JSON -t source -f $BUDFILES/supplemental-groups/Dockerfile + # gid 1000 must be in supplemental groups + expect_output --substring "Groups: 1000" +} + # Test skipping images with FROM @test "build-test skipping unwanted stages with FROM" { mkdir -p ${TEST_SCRATCH_DIR}/bud/platform diff --git a/tests/bud/supplemental-groups/Dockerfile b/tests/bud/supplemental-groups/Dockerfile new file mode 100644 index 0000000000..462d9ea7a4 --- /dev/null +++ b/tests/bud/supplemental-groups/Dockerfile @@ -0,0 +1,3 @@ +FROM alpine +USER 1000:1000 +RUN cat /proc/$$/status diff --git a/tests/run.bats b/tests/run.bats index 2e8836c470..e34091fcbe 100644 --- a/tests/run.bats +++ b/tests/run.bats @@ -349,6 +349,20 @@ function configure_and_check_user() { expect_output "888:888" } +@test "run --user and verify gid in supplemental groups" { + skip_if_no_runtime + + # Create the container. + _prefetch alpine + run_buildah from $WITH_POLICY_JSON alpine + ctr="$output" + + # Run with uid:gid 1000:1000 and verify if gid is present in additional groups + run_buildah run --user 1000:1000 "$ctr" cat /proc/self/status + # gid 1000 must be in additional/supplemental groups + expect_output --substring "Groups: 1000 " +} + @test "run --workingdir" { skip_if_no_runtime
