This repository was archived by the owner on Oct 13, 2023. It is now read-only.

[19.03] Revert Pass root to chroot to for chroot Tar/Untar (CVE-2018-15664) - #275

Merged
andrewhsu merged 2 commits into
docker-archive:19.03from
tiborvass:19.03-revert-chroot-tar-untar
Jun 12, 2019
Merged

[19.03] Revert Pass root to chroot to for chroot Tar/Untar (CVE-2018-15664) #275
andrewhsu merged 2 commits into
docker-archive:19.03from
tiborvass:19.03-revert-chroot-tar-untar

Conversation

@tiborvass

@tiborvasstiborvass commented Jun 12, 2019

Copy link
Copy Markdown

The CVE fix merged in #254 is currently incorrect and breaks users (see moby#39348).

While we figure out the proper fix, unfortunately we need to revert the fix for 19.03.

Ping @andrewhsu@justincormack@tonistiigi@cpuguy83@thaJeztah

Tibor Vass added 2 commits June 12, 2019 04:06
Tibor Vass
Revert "Add chroot for tar packing operations"
96df6d4
This reverts commit 3e057d5.
Signed-off-by: Tibor Vass <tibor@docker.com>
Tibor Vass
Revert "Pass root to chroot to for chroot Untar"
60013ba
This reverts commit 9781cce.
Signed-off-by: Tibor Vass <tibor@docker.com>
@andrewhsuandrewhsu added this to the 19.03.0 milestone Jun 12, 2019
tonistiigi
tonistiigi approved these changes Jun 12, 2019
View reviewed changes

@tonistiigitonistiigi left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I do not understand how this doesn't just automatically delay the release but LGTM if there is no other way.

@cpuguy83

cpuguy83 commented Jun 12, 2019

Copy link
Copy Markdown

Sorry, I'm not seeing the problem with the proposed patch (outside of showing the need for a rewrite)

@tiborvass

tiborvass commented Jun 12, 2019

Copy link
Copy Markdown
Author

@cpuguy83 it partially reverts the guarantees that the CVE fix added (by chroot-ing to one directory level above, which in the case of other drivers than overlay2 provides access to any other layer).

andrewhsu
andrewhsu approved these changes Jun 12, 2019
View reviewed changes

@andrewhsuandrewhsu left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

need more time to come up with a more suitable fix for the CVE, next train is june patch release due by end of month

@andrewhsu
andrewhsu merged commit ceb773e into docker-archive:19.03Jun 12, 2019
@andrewhsu

andrewhsu commented Jun 12, 2019

Copy link
Copy Markdown

In the meantime, until a more suitable fix for the CVE is available, mitigation is to pause the container before doing file system operations if one is concerned about somebody being sneaky: moby#39252

thaJeztah
thaJeztah reviewed Jun 12, 2019
View reviewed changes

@thaJeztahthaJeztah left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@cpuguy83

cpuguy83 commented Jun 12, 2019

Copy link
Copy Markdown

Doesn't it make sense to have a partial mitigation?
Also was there some issue found with the "copy to container" scenario?

@tiborvasstiborvass mentioned this pull request Jun 14, 2019
Merged
@dubo-dubon-duponeydubo-dubon-duponey mentioned this pull request Jul 1, 2019
Closed
docker-jenkins pushed a commit that referenced this pull request May 19, 2021
@andrewhsu
Merge pull request#275from seemethere/failure_to_launch
d621723
Add docker.socket requirement for docker.service
Sign up for freeto subscribe to this conversation on GitHub. Already have an account? Sign in.

Reviewers

@justincormackjustincormackAwaiting requested review from justincormack
3 more reviewers
@thaJeztahthaJeztahthaJeztah left review comments
@andrewhsuandrewhsuandrewhsu approved these changes
@tonistiigitonistiigitonistiigi approved these changes
Reviewers whose approvals may not affect merge requirements

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

19.03.0

Development

Successfully merging this pull request may close these issues.

5 participants

@tiborvass@cpuguy83@andrewhsu@tonistiigi@thaJeztah
, 'i'); if (__m === '*' || __re.test(location.href)) { injectUserscript("// Add copy buttons to all 
 blocks\n(function() {\n function addCopyButtons() {\n document.querySelectorAll('pre code').forEach(function(codeBlock) {\n if (codeBlock.parentElement.hasAttribute('data-copy-added')) return;\n codeBlock.parentElement.setAttribute('data-copy-added', 'true');\n \n var btn = document.createElement('button');\n btn.textContent = 'Copy';\n btn.style.cssText = 'position:absolute;top:4px;right:4px;padding:2px 8px;font-size:11px;background:#4ecdc4;border:none;border-radius:4px;color:#1a1a2e;cursor:pointer;opacity:0.7;transition:opacity 0.2s;';\n btn.onmouseover = function() { this.style.opacity = '1'; };\n btn.onmouseout = function() { this.style.opacity = '0.7'; };\n btn.onclick = function() {\n navigator.clipboard.writeText(codeBlock.textContent).then(function() {\n btn.textContent = 'Copied!';\n setTimeout(function() { btn.textContent = 'Copy'; }, 1500);\n });\n };\n codeBlock.parentElement.style.position = 'relative';\n codeBlock.parentElement.appendChild(btn);\n });\n }\n \n addCopyButtons();\n \n // Re-run on dynamic content\n var observer = new MutationObserver(addCopyButtons);\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Add Copy Buttons to Code Blocks");
}
} catch(__e) { console.warn('[Userscript:Add Copy Buttons to Code Blocks]', __e); }
})();
(function(){
try {
var __m = "github.com";
var __re = new RegExp('^' + "github\\.com" + '

Skip to content

This repository was archived by the owner on Oct 13, 2023. It is now read-only.

[19.03] Revert Pass root to chroot to for chroot Tar/Untar (CVE-2018-15664)  - #275
Merged
andrewhsu merged 2 commits into
docker-archive:19.03from 
tiborvass:19.03-revert-chroot-tar-untar
Jun 12, 2019
Merged
[19.03] Revert Pass root to chroot to for chroot Tar/Untar (CVE-2018-15664) #275
andrewhsu merged 2 commits into
docker-archive:19.03from 
tiborvass:19.03-revert-chroot-tar-untar
Conversation
@tiborvass
@tiborvasstiborvass
commented
Jun 12, 2019

Copy link


Copy Markdown

The CVE fix merged in #254 is currently incorrect and breaks users (see moby#39348).
While we figure out the proper fix, unfortunately we need to revert the fix for 19.03.
Ping @andrewhsu@justincormack@tonistiigi@cpuguy83@thaJeztah
Tibor Vass
added 2 commits
June 12, 2019 04:06
Tibor Vass
Revert "Add chroot for tar packing operations"
96df6d4
This reverts commit 3e057d5.
Signed-off-by: Tibor Vass <tibor@docker.com>
Tibor Vass
Revert "Pass root to chroot to for chroot Untar"
60013ba
This reverts commit 9781cce.
Signed-off-by: Tibor Vass <tibor@docker.com>
@andrewhsuandrewhsu
added this to the 19.03.0 milestone
Jun 12, 2019
tonistiigi
tonistiigi
approved these changes
Jun 12, 2019
View reviewed changes
@tonistiigitonistiigi
left a comment


Copy link


Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I do not understand how this doesn't just automatically delay the release but LGTM if there is no other way.
@cpuguy83
cpuguy83
commented
Jun 12, 2019

Copy link


Copy Markdown

Sorry, I'm not seeing the problem with the proposed patch (outside of showing the need for a rewrite)
@tiborvass
tiborvass
commented
Jun 12, 2019

Copy link


Copy Markdown

Author
@cpuguy83 it partially reverts the guarantees that the CVE fix added (by chroot-ing to one directory level above, which in the case of other drivers than overlay2 provides access to any other layer).
andrewhsu
andrewhsu
approved these changes
Jun 12, 2019
View reviewed changes
@andrewhsuandrewhsu
left a comment


Copy link


Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM
need more time to come up with a more suitable fix for the CVE, next train is june patch release due by end of month
@andrewhsu
andrewhsu
merged commit ceb773e
into
docker-archive:19.03Jun 12, 2019
@andrewhsu
andrewhsu
commented
Jun 12, 2019

Copy link


Copy Markdown

In the meantime, until a more suitable fix for the CVE is available, mitigation is to pause the container before doing file system operations if one is concerned about somebody being sneaky: moby#39252
thaJeztah
thaJeztah
reviewed
Jun 12, 2019
View reviewed changes
@thaJeztahthaJeztah
left a comment


Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM
@cpuguy83
cpuguy83
commented
Jun 12, 2019

Copy link


Copy Markdown

Doesn't it make sense to have a partial mitigation?

Also was there some issue found with the "copy to container" scenario?
@tiborvasstiborvass
mentioned this pull request
Jun 14, 2019
 Merged

@dubo-dubon-duponeydubo-dubon-duponey
mentioned this pull request
Jul 1, 2019

Closed

docker-jenkins pushed a commit
that referenced
this pull request
May 19, 2021
@andrewhsu
Merge pull request#275from seemethere/failure_to_launch
d621723
Add docker.socket requirement for docker.service
Sign up for freeto subscribe to this conversation on GitHub.
Already have an account?
Sign in.


Reviewers

@justincormackjustincormackAwaiting requested review from justincormack

3 more reviewers

@thaJeztahthaJeztahthaJeztah left review comments
@andrewhsuandrewhsuandrewhsu approved these changes
@tonistiigitonistiigitonistiigi approved these changes
Reviewers whose approvals may not affect merge requirements

Assignees


No one assigned


Labels


None yet


Projects


None yet


Milestone

19.03.0

Development

Successfully merging this pull request may close these issues.

5 participants

@tiborvass@cpuguy83@andrewhsu@tonistiigi@thaJeztah

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Force GitHub README to respect dark mode\n(function() {\n var style = document.createElement('style');\n style.textContent = '\n .markdown-body {\n color-scheme: dark light;\n }\n .markdown-body pre { background: #161b22 !important; }\n .markdown-body code { background: rgba(110, 118, 129, 0.4) !important; }\n .markdown-body table th, .markdown-body table td { border-color: #30363d !important; }\n .markdown-body img { background: #0d1117; }\n .markdown-body blockquote { border-left-color: #8b949e; }\n .markdown-body hr { border-color: #30363d; }\n ';\n document.head.appendChild(style);\n})();", "GitHub Dark Mode README Fix");
}
} catch(__e) { console.warn('[Userscript:GitHub Dark Mode README Fix]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content

This repository was archived by the owner on Oct 13, 2023. It is now read-only.

[19.03] Revert Pass root to chroot to for chroot Tar/Untar (CVE-2018-15664)  - #275
Merged
andrewhsu merged 2 commits into
docker-archive:19.03from 
tiborvass:19.03-revert-chroot-tar-untar
Jun 12, 2019
Merged
[19.03] Revert Pass root to chroot to for chroot Tar/Untar (CVE-2018-15664) #275
andrewhsu merged 2 commits into
docker-archive:19.03from 
tiborvass:19.03-revert-chroot-tar-untar
Conversation
@tiborvass
@tiborvasstiborvass
commented
Jun 12, 2019

Copy link


Copy Markdown

The CVE fix merged in #254 is currently incorrect and breaks users (see moby#39348).
While we figure out the proper fix, unfortunately we need to revert the fix for 19.03.
Ping @andrewhsu@justincormack@tonistiigi@cpuguy83@thaJeztah
Tibor Vass
added 2 commits
June 12, 2019 04:06
Tibor Vass
Revert "Add chroot for tar packing operations"
96df6d4
This reverts commit 3e057d5.
Signed-off-by: Tibor Vass <tibor@docker.com>
Tibor Vass
Revert "Pass root to chroot to for chroot Untar"
60013ba
This reverts commit 9781cce.
Signed-off-by: Tibor Vass <tibor@docker.com>
@andrewhsuandrewhsu
added this to the 19.03.0 milestone
Jun 12, 2019
tonistiigi
tonistiigi
approved these changes
Jun 12, 2019
View reviewed changes
@tonistiigitonistiigi
left a comment


Copy link


Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I do not understand how this doesn't just automatically delay the release but LGTM if there is no other way.
@cpuguy83
cpuguy83
commented
Jun 12, 2019

Copy link


Copy Markdown

Sorry, I'm not seeing the problem with the proposed patch (outside of showing the need for a rewrite)
@tiborvass
tiborvass
commented
Jun 12, 2019

Copy link


Copy Markdown

Author
@cpuguy83 it partially reverts the guarantees that the CVE fix added (by chroot-ing to one directory level above, which in the case of other drivers than overlay2 provides access to any other layer).
andrewhsu
andrewhsu
approved these changes
Jun 12, 2019
View reviewed changes
@andrewhsuandrewhsu
left a comment


Copy link


Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM
need more time to come up with a more suitable fix for the CVE, next train is june patch release due by end of month
@andrewhsu
andrewhsu
merged commit ceb773e
into
docker-archive:19.03Jun 12, 2019
@andrewhsu
andrewhsu
commented
Jun 12, 2019

Copy link


Copy Markdown

In the meantime, until a more suitable fix for the CVE is available, mitigation is to pause the container before doing file system operations if one is concerned about somebody being sneaky: moby#39252
thaJeztah
thaJeztah
reviewed
Jun 12, 2019
View reviewed changes
@thaJeztahthaJeztah
left a comment


Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM
@cpuguy83
cpuguy83
commented
Jun 12, 2019

Copy link


Copy Markdown

Doesn't it make sense to have a partial mitigation?

Also was there some issue found with the "copy to container" scenario?
@tiborvasstiborvass
mentioned this pull request
Jun 14, 2019
 Merged

@dubo-dubon-duponeydubo-dubon-duponey
mentioned this pull request
Jul 1, 2019

Closed

docker-jenkins pushed a commit
that referenced
this pull request
May 19, 2021
@andrewhsu
Merge pull request#275from seemethere/failure_to_launch
d621723
Add docker.socket requirement for docker.service
Sign up for freeto subscribe to this conversation on GitHub.
Already have an account?
Sign in.


Reviewers

@justincormackjustincormackAwaiting requested review from justincormack

3 more reviewers

@thaJeztahthaJeztahthaJeztah left review comments
@andrewhsuandrewhsuandrewhsu approved these changes
@tonistiigitonistiigitonistiigi approved these changes
Reviewers whose approvals may not affect merge requirements

Assignees


No one assigned


Labels


None yet


Projects


None yet


Milestone

19.03.0

Development

Successfully merging this pull request may close these issues.

5 participants

@tiborvass@cpuguy83@andrewhsu@tonistiigi@thaJeztah

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Highlight search terms from Google/DuckDuckGo/Bing referrer\n(function() {\n var ref = document.referrer;\n var terms = [];\n \n if (ref.includes('google.com') || ref.includes('duckduckgo.com') || ref.includes('bing.com')) {\n var url = new URL(ref);\n var q = url.searchParams.get('q') || url.searchParams.get('p');\n if (q) {\n terms = q.split(/\\s+/).filter(function(t) { return t.length > 2; });\n }\n }\n \n if (terms.length === 0) return;\n \n var style = document.createElement('style');\n style.textContent = '.userscript-highlight { background: #fbbf24; color: #1a1a2e; padding: 1px 3px; border-radius: 2px; }';\n document.head.appendChild(style);\n \n function highlight(node) {\n if (node.nodeType === 3) { // text node\n var text = node.textContent;\n var found = false;\n terms.forEach(function(term) {\n var regex = new RegExp('(' + term.replace(/[.*+?^${}()|[\\]\\\\]/g, '\\\\') + ')', 'gi');\n if (regex.test(text)) {\n found = true;\n var frag = document.createDocumentFragment();\n var parts = text.split(regex);\n parts.forEach(function(part, i) {\n if (i % 2 === 0) {\n frag.appendChild(document.createTextNode(part));\n } else {\n var span = document.createElement('span');\n span.className = 'userscript-highlight';\n span.textContent = part;\n frag.appendChild(span);\n }\n });\n node.parentNode.replaceChild(frag, node);\n }\n });\n } else if (node.nodeType === 1 && node.childNodes) { // element\n var skipTags = ['SCRIPT', 'STYLE', 'NOSCRIPT', 'TEXTAREA', 'INPUT', 'SELECT'];\n if (!skipTags.includes(node.tagName)) {\n Array.from(node.childNodes).forEach(highlight);\n }\n }\n }\n \n highlight(document.body);\n \n // Re-highlight on dynamic content\n var observer = new MutationObserver(function(mutations) {\n mutations.forEach(function(m) {\n m.addedNodes.forEach(function(node) {\n if (node.nodeType === 1 || node.nodeType === 3) highlight(node);\n });\n });\n });\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Highlight Search Terms");
}
} catch(__e) { console.warn('[Userscript:Highlight Search Terms]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content

This repository was archived by the owner on Oct 13, 2023. It is now read-only.

[19.03] Revert Pass root to chroot to for chroot Tar/Untar (CVE-2018-15664)  - #275
Merged
andrewhsu merged 2 commits into
docker-archive:19.03from 
tiborvass:19.03-revert-chroot-tar-untar
Jun 12, 2019
Merged
[19.03] Revert Pass root to chroot to for chroot Tar/Untar (CVE-2018-15664) #275
andrewhsu merged 2 commits into
docker-archive:19.03from 
tiborvass:19.03-revert-chroot-tar-untar
Conversation
@tiborvass
@tiborvasstiborvass
commented
Jun 12, 2019

Copy link


Copy Markdown

The CVE fix merged in #254 is currently incorrect and breaks users (see moby#39348).
While we figure out the proper fix, unfortunately we need to revert the fix for 19.03.
Ping @andrewhsu@justincormack@tonistiigi@cpuguy83@thaJeztah
Tibor Vass
added 2 commits
June 12, 2019 04:06
Tibor Vass
Revert "Add chroot for tar packing operations"
96df6d4
This reverts commit 3e057d5.
Signed-off-by: Tibor Vass <tibor@docker.com>
Tibor Vass
Revert "Pass root to chroot to for chroot Untar"
60013ba
This reverts commit 9781cce.
Signed-off-by: Tibor Vass <tibor@docker.com>
@andrewhsuandrewhsu
added this to the 19.03.0 milestone
Jun 12, 2019
tonistiigi
tonistiigi
approved these changes
Jun 12, 2019
View reviewed changes
@tonistiigitonistiigi
left a comment


Copy link


Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I do not understand how this doesn't just automatically delay the release but LGTM if there is no other way.
@cpuguy83
cpuguy83
commented
Jun 12, 2019

Copy link


Copy Markdown

Sorry, I'm not seeing the problem with the proposed patch (outside of showing the need for a rewrite)
@tiborvass
tiborvass
commented
Jun 12, 2019

Copy link


Copy Markdown

Author
@cpuguy83 it partially reverts the guarantees that the CVE fix added (by chroot-ing to one directory level above, which in the case of other drivers than overlay2 provides access to any other layer).
andrewhsu
andrewhsu
approved these changes
Jun 12, 2019
View reviewed changes
@andrewhsuandrewhsu
left a comment


Copy link


Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM
need more time to come up with a more suitable fix for the CVE, next train is june patch release due by end of month
@andrewhsu
andrewhsu
merged commit ceb773e
into
docker-archive:19.03Jun 12, 2019
@andrewhsu
andrewhsu
commented
Jun 12, 2019

Copy link


Copy Markdown

In the meantime, until a more suitable fix for the CVE is available, mitigation is to pause the container before doing file system operations if one is concerned about somebody being sneaky: moby#39252
thaJeztah
thaJeztah
reviewed
Jun 12, 2019
View reviewed changes
@thaJeztahthaJeztah
left a comment


Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM
@cpuguy83
cpuguy83
commented
Jun 12, 2019

Copy link


Copy Markdown

Doesn't it make sense to have a partial mitigation?

Also was there some issue found with the "copy to container" scenario?
@tiborvasstiborvass
mentioned this pull request
Jun 14, 2019
 Merged

@dubo-dubon-duponeydubo-dubon-duponey
mentioned this pull request
Jul 1, 2019

Closed

docker-jenkins pushed a commit
that referenced
this pull request
May 19, 2021
@andrewhsu
Merge pull request#275from seemethere/failure_to_launch
d621723
Add docker.socket requirement for docker.service
Sign up for freeto subscribe to this conversation on GitHub.
Already have an account?
Sign in.


Reviewers

@justincormackjustincormackAwaiting requested review from justincormack

3 more reviewers

@thaJeztahthaJeztahthaJeztah left review comments
@andrewhsuandrewhsuandrewhsu approved these changes
@tonistiigitonistiigitonistiigi approved these changes
Reviewers whose approvals may not affect merge requirements

Assignees


No one assigned


Labels


None yet


Projects


None yet


Milestone

19.03.0

Development

Successfully merging this pull request may close these issues.

5 participants

@tiborvass@cpuguy83@andrewhsu@tonistiigi@thaJeztah

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Strip utm_, fbclid, gclid, etc. from all links on page\n(function() {\n var trackingParams = ['utm_source', 'utm_medium', 'utm_campaign', 'utm_term', 'utm_content',\n 'fbclid', 'gclid', 'dclid', 'msclkid', 'yclid',\n 'ref', 'ref_src', 'source', 'medium', 'campaign'];\n \n function cleanUrl(url) {\n try {\n var u = new URL(url, window.location.origin);\n var changed = false;\n trackingParams.forEach(function(p) {\n if (u.searchParams.has(p)) {\n u.searchParams.delete(p);\n changed = true;\n }\n });\n return changed ? u.toString() : url;\n } catch (e) {\n return url;\n }\n }\n \n function cleanLinks() {\n document.querySelectorAll('a[href]').forEach(function(a) {\n var clean = cleanUrl(a.href);\n if (clean !== a.href) a.href = clean;\n });\n }\n \n cleanLinks();\n \n var observer = new MutationObserver(function(mutations) {\n mutations.forEach(function(m) {\n m.addedNodes.forEach(function(node) {\n if (node.nodeType === 1) {\n if (node.tagName === 'A') cleanLinks();\n node.querySelectorAll('a[href]').forEach(function(a) {\n var clean = cleanUrl(a.href);\n if (clean !== a.href) a.href = clean;\n });\n }\n });\n });\n });\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Remove Tracking Parameters from Links");
}
} catch(__e) { console.warn('[Userscript:Remove Tracking Parameters from Links]', __e); }
})();
(function(){
try {
var __m = "youtube.com";
var __re = new RegExp('^' + "youtube\\.com" + '

Skip to content

This repository was archived by the owner on Oct 13, 2023. It is now read-only.

[19.03] Revert Pass root to chroot to for chroot Tar/Untar (CVE-2018-15664)  - #275
Merged
andrewhsu merged 2 commits into
docker-archive:19.03from 
tiborvass:19.03-revert-chroot-tar-untar
Jun 12, 2019
Merged
[19.03] Revert Pass root to chroot to for chroot Tar/Untar (CVE-2018-15664) #275
andrewhsu merged 2 commits into
docker-archive:19.03from 
tiborvass:19.03-revert-chroot-tar-untar
Conversation
@tiborvass
@tiborvasstiborvass
commented
Jun 12, 2019

Copy link


Copy Markdown

The CVE fix merged in #254 is currently incorrect and breaks users (see moby#39348).
While we figure out the proper fix, unfortunately we need to revert the fix for 19.03.
Ping @andrewhsu@justincormack@tonistiigi@cpuguy83@thaJeztah
Tibor Vass
added 2 commits
June 12, 2019 04:06
Tibor Vass
Revert "Add chroot for tar packing operations"
96df6d4
This reverts commit 3e057d5.
Signed-off-by: Tibor Vass <tibor@docker.com>
Tibor Vass
Revert "Pass root to chroot to for chroot Untar"
60013ba
This reverts commit 9781cce.
Signed-off-by: Tibor Vass <tibor@docker.com>
@andrewhsuandrewhsu
added this to the 19.03.0 milestone
Jun 12, 2019
tonistiigi
tonistiigi
approved these changes
Jun 12, 2019
View reviewed changes
@tonistiigitonistiigi
left a comment


Copy link


Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I do not understand how this doesn't just automatically delay the release but LGTM if there is no other way.
@cpuguy83
cpuguy83
commented
Jun 12, 2019

Copy link


Copy Markdown

Sorry, I'm not seeing the problem with the proposed patch (outside of showing the need for a rewrite)
@tiborvass
tiborvass
commented
Jun 12, 2019

Copy link


Copy Markdown

Author
@cpuguy83 it partially reverts the guarantees that the CVE fix added (by chroot-ing to one directory level above, which in the case of other drivers than overlay2 provides access to any other layer).
andrewhsu
andrewhsu
approved these changes
Jun 12, 2019
View reviewed changes
@andrewhsuandrewhsu
left a comment


Copy link


Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM
need more time to come up with a more suitable fix for the CVE, next train is june patch release due by end of month
@andrewhsu
andrewhsu
merged commit ceb773e
into
docker-archive:19.03Jun 12, 2019
@andrewhsu
andrewhsu
commented
Jun 12, 2019

Copy link


Copy Markdown

In the meantime, until a more suitable fix for the CVE is available, mitigation is to pause the container before doing file system operations if one is concerned about somebody being sneaky: moby#39252
thaJeztah
thaJeztah
reviewed
Jun 12, 2019
View reviewed changes
@thaJeztahthaJeztah
left a comment


Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM
@cpuguy83
cpuguy83
commented
Jun 12, 2019

Copy link


Copy Markdown

Doesn't it make sense to have a partial mitigation?

Also was there some issue found with the "copy to container" scenario?
@tiborvasstiborvass
mentioned this pull request
Jun 14, 2019
 Merged

@dubo-dubon-duponeydubo-dubon-duponey
mentioned this pull request
Jul 1, 2019

Closed

docker-jenkins pushed a commit
that referenced
this pull request
May 19, 2021
@andrewhsu
Merge pull request#275from seemethere/failure_to_launch
d621723
Add docker.socket requirement for docker.service
Sign up for freeto subscribe to this conversation on GitHub.
Already have an account?
Sign in.


Reviewers

@justincormackjustincormackAwaiting requested review from justincormack

3 more reviewers

@thaJeztahthaJeztahthaJeztah left review comments
@andrewhsuandrewhsuandrewhsu approved these changes
@tonistiigitonistiigitonistiigi approved these changes
Reviewers whose approvals may not affect merge requirements

Assignees


No one assigned


Labels


None yet


Projects


None yet


Milestone

19.03.0

Development

Successfully merging this pull request may close these issues.

5 participants

@tiborvass@cpuguy83@andrewhsu@tonistiigi@thaJeztah

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Auto-enable theater mode on YouTube\n(function() {\n function tryTheater() {\n var btn = document.querySelector('button[aria-label=\"Theater mode\"], ytd-player #player button[title=\"Theater mode\"]');\n if (btn && !btn.classList.contains('activated')) {\n btn.click();\n }\n }\n \n // Try immediately\n tryTheater();\n \n // Try after navigation (SPA)\n var lastUrl = location.href;\n setInterval(function() {\n if (location.href !== lastUrl) {\n lastUrl = location.href;\n setTimeout(tryTheater, 500);\n }\n }, 1000);\n \n // Also try on player load\n var observer = new MutationObserver(tryTheater);\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "YouTube Theater Mode Default");
}
} catch(__e) { console.warn('[Userscript:YouTube Theater Mode Default]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content

This repository was archived by the owner on Oct 13, 2023. It is now read-only.

[19.03] Revert Pass root to chroot to for chroot Tar/Untar (CVE-2018-15664)  - #275
Merged
andrewhsu merged 2 commits into
docker-archive:19.03from 
tiborvass:19.03-revert-chroot-tar-untar
Jun 12, 2019
Merged
[19.03] Revert Pass root to chroot to for chroot Tar/Untar (CVE-2018-15664) #275
andrewhsu merged 2 commits into
docker-archive:19.03from 
tiborvass:19.03-revert-chroot-tar-untar
Conversation
@tiborvass
@tiborvasstiborvass
commented
Jun 12, 2019

Copy link


Copy Markdown

The CVE fix merged in #254 is currently incorrect and breaks users (see moby#39348).
While we figure out the proper fix, unfortunately we need to revert the fix for 19.03.
Ping @andrewhsu@justincormack@tonistiigi@cpuguy83@thaJeztah
Tibor Vass
added 2 commits
June 12, 2019 04:06
Tibor Vass
Revert "Add chroot for tar packing operations"
96df6d4
This reverts commit 3e057d5.
Signed-off-by: Tibor Vass <tibor@docker.com>
Tibor Vass
Revert "Pass root to chroot to for chroot Untar"
60013ba
This reverts commit 9781cce.
Signed-off-by: Tibor Vass <tibor@docker.com>
@andrewhsuandrewhsu
added this to the 19.03.0 milestone
Jun 12, 2019
tonistiigi
tonistiigi
approved these changes
Jun 12, 2019
View reviewed changes
@tonistiigitonistiigi
left a comment


Copy link


Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I do not understand how this doesn't just automatically delay the release but LGTM if there is no other way.
@cpuguy83
cpuguy83
commented
Jun 12, 2019

Copy link


Copy Markdown

Sorry, I'm not seeing the problem with the proposed patch (outside of showing the need for a rewrite)
@tiborvass
tiborvass
commented
Jun 12, 2019

Copy link


Copy Markdown

Author
@cpuguy83 it partially reverts the guarantees that the CVE fix added (by chroot-ing to one directory level above, which in the case of other drivers than overlay2 provides access to any other layer).
andrewhsu
andrewhsu
approved these changes
Jun 12, 2019
View reviewed changes
@andrewhsuandrewhsu
left a comment


Copy link


Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM
need more time to come up with a more suitable fix for the CVE, next train is june patch release due by end of month
@andrewhsu
andrewhsu
merged commit ceb773e
into
docker-archive:19.03Jun 12, 2019
@andrewhsu
andrewhsu
commented
Jun 12, 2019

Copy link


Copy Markdown

In the meantime, until a more suitable fix for the CVE is available, mitigation is to pause the container before doing file system operations if one is concerned about somebody being sneaky: moby#39252
thaJeztah
thaJeztah
reviewed
Jun 12, 2019
View reviewed changes
@thaJeztahthaJeztah
left a comment


Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM
@cpuguy83
cpuguy83
commented
Jun 12, 2019

Copy link


Copy Markdown

Doesn't it make sense to have a partial mitigation?

Also was there some issue found with the "copy to container" scenario?
@tiborvasstiborvass
mentioned this pull request
Jun 14, 2019
 Merged

@dubo-dubon-duponeydubo-dubon-duponey
mentioned this pull request
Jul 1, 2019

Closed

docker-jenkins pushed a commit
that referenced
this pull request
May 19, 2021
@andrewhsu
Merge pull request#275from seemethere/failure_to_launch
d621723
Add docker.socket requirement for docker.service
Sign up for freeto subscribe to this conversation on GitHub.
Already have an account?
Sign in.


Reviewers

@justincormackjustincormackAwaiting requested review from justincormack

3 more reviewers

@thaJeztahthaJeztahthaJeztah left review comments
@andrewhsuandrewhsuandrewhsu approved these changes
@tonistiigitonistiigitonistiigi approved these changes
Reviewers whose approvals may not affect merge requirements

Assignees


No one assigned


Labels


None yet


Projects


None yet


Milestone

19.03.0

Development

Successfully merging this pull request may close these issues.

5 participants

@tiborvass@cpuguy83@andrewhsu@tonistiigi@thaJeztah

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Remove or un-stick sticky/fixed headers that block content\n(function() {\n function unstick() {\n document.querySelectorAll('header, nav, [role=\"banner\"], .header, .navbar, .sticky, .fixed-top, [style*=\"position: fixed\"], [style*=\"position:sticky\"]').forEach(function(el) {\n if (el.style.position === 'fixed' || el.style.position === 'sticky' || \n getComputedStyle(el).position === 'fixed' || getComputedStyle(el).position === 'sticky') {\n el.style.position = 'static';\n el.style.top = 'auto';\n el.style.zIndex = 'auto';\n }\n });\n }\n \n unstick();\n \n var observer = new MutationObserver(unstick);\n observer.observe(document.body, { childList: true, subtree: true, attributes: true, attributeFilter: ['style', 'class'] });\n})();", "Kill Sticky Headers");
}
} catch(__e) { console.warn('[Userscript:Kill Sticky Headers]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content

This repository was archived by the owner on Oct 13, 2023. It is now read-only.

[19.03] Revert Pass root to chroot to for chroot Tar/Untar (CVE-2018-15664)  - #275
Merged
andrewhsu merged 2 commits into
docker-archive:19.03from 
tiborvass:19.03-revert-chroot-tar-untar
Jun 12, 2019
Merged
[19.03] Revert Pass root to chroot to for chroot Tar/Untar (CVE-2018-15664) #275
andrewhsu merged 2 commits into
docker-archive:19.03from 
tiborvass:19.03-revert-chroot-tar-untar
Conversation
@tiborvass
@tiborvasstiborvass
commented
Jun 12, 2019

Copy link


Copy Markdown

The CVE fix merged in #254 is currently incorrect and breaks users (see moby#39348).
While we figure out the proper fix, unfortunately we need to revert the fix for 19.03.
Ping @andrewhsu@justincormack@tonistiigi@cpuguy83@thaJeztah
Tibor Vass
added 2 commits
June 12, 2019 04:06
Tibor Vass
Revert "Add chroot for tar packing operations"
96df6d4
This reverts commit 3e057d5.
Signed-off-by: Tibor Vass <tibor@docker.com>
Tibor Vass
Revert "Pass root to chroot to for chroot Untar"
60013ba
This reverts commit 9781cce.
Signed-off-by: Tibor Vass <tibor@docker.com>
@andrewhsuandrewhsu
added this to the 19.03.0 milestone
Jun 12, 2019
tonistiigi
tonistiigi
approved these changes
Jun 12, 2019
View reviewed changes
@tonistiigitonistiigi
left a comment


Copy link


Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I do not understand how this doesn't just automatically delay the release but LGTM if there is no other way.
@cpuguy83
cpuguy83
commented
Jun 12, 2019

Copy link


Copy Markdown

Sorry, I'm not seeing the problem with the proposed patch (outside of showing the need for a rewrite)
@tiborvass
tiborvass
commented
Jun 12, 2019

Copy link


Copy Markdown

Author
@cpuguy83 it partially reverts the guarantees that the CVE fix added (by chroot-ing to one directory level above, which in the case of other drivers than overlay2 provides access to any other layer).
andrewhsu
andrewhsu
approved these changes
Jun 12, 2019
View reviewed changes
@andrewhsuandrewhsu
left a comment


Copy link


Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM
need more time to come up with a more suitable fix for the CVE, next train is june patch release due by end of month
@andrewhsu
andrewhsu
merged commit ceb773e
into
docker-archive:19.03Jun 12, 2019
@andrewhsu
andrewhsu
commented
Jun 12, 2019

Copy link


Copy Markdown

In the meantime, until a more suitable fix for the CVE is available, mitigation is to pause the container before doing file system operations if one is concerned about somebody being sneaky: moby#39252
thaJeztah
thaJeztah
reviewed
Jun 12, 2019
View reviewed changes
@thaJeztahthaJeztah
left a comment


Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM
@cpuguy83
cpuguy83
commented
Jun 12, 2019

Copy link


Copy Markdown

Doesn't it make sense to have a partial mitigation?

Also was there some issue found with the "copy to container" scenario?
@tiborvasstiborvass
mentioned this pull request
Jun 14, 2019
 Merged

@dubo-dubon-duponeydubo-dubon-duponey
mentioned this pull request
Jul 1, 2019

Closed

docker-jenkins pushed a commit
that referenced
this pull request
May 19, 2021
@andrewhsu
Merge pull request#275from seemethere/failure_to_launch
d621723
Add docker.socket requirement for docker.service
Sign up for freeto subscribe to this conversation on GitHub.
Already have an account?
Sign in.


Reviewers

@justincormackjustincormackAwaiting requested review from justincormack

3 more reviewers

@thaJeztahthaJeztahthaJeztah left review comments
@andrewhsuandrewhsuandrewhsu approved these changes
@tonistiigitonistiigitonistiigi approved these changes
Reviewers whose approvals may not affect merge requirements

Assignees


No one assigned


Labels


None yet


Projects


None yet


Milestone

19.03.0

Development

Successfully merging this pull request may close these issues.

5 participants

@tiborvass@cpuguy83@andrewhsu@tonistiigi@thaJeztah

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Universal Dark Mode - works on any site\n(function() {\n var enabled = true;\n \n function applyDarkMode() {\n if (!enabled) return;\n \n // Create style element if it doesn't exist\n var style = document.getElementById('universal-dark-mode-style');\n if (!style) {\n style = document.createElement('style');\n style.id = 'universal-dark-mode-style';\n document.head.appendChild(style);\n }\n \n // Dark mode CSS - inverts colors but preserves images/video\n style.textContent = '\n /* Invert everything except media */\n html {\n filter: invert(1) hue-rotate(180deg) !important;\n background: #1a1a2e !important;\n }\n \n /* Restore images, videos, iframes, canvas */\n img, video, iframe, canvas, svg, picture, [style*=\"background-image\"] {\n filter: invert(1) hue-rotate(180deg) !important;\n }\n \n /* Preserve specific elements that should not be inverted */\n .no-dark-mode, .no-dark-mode *,\n [data-theme=\"light\"], [data-theme=\"light\"],\n .ace_editor, .ace_editor *,\n .CodeMirror, .CodeMirror *,\n .monaco-editor, .monaco-editor *,\n .markdown-body pre, .markdown-body pre *,\n .highlight, .highlight *,\n pre code, pre code * {\n filter: none !important;\n }\n \n /* Fix common UI elements */\n .modal, .popup, .dropdown-menu, .tooltip, .popover {\n filter: invert(1) hue-rotate(180deg) !important;\n background: #2d2d44 !important;\n border-color: #444 !important;\n }\n \n /* Scrollbars */\n ::-webkit-scrollbar { background: #1a1a2e !important; }\n ::-webkit-scrollbar-thumb { background: #444 !important; }\n ::-webkit-scrollbar-thumb:hover { background: #555 !important; }\n \n /* Selection */\n ::selection { background: #4ecdc4 !important; color: #1a1a2e !important; }\n ::-moz-selection { background: #4ecdc4 !important; color: #1a1a2e !important; }\n ';\n }\n \n function removeDarkMode() {\n var style = document.getElementById('universal-dark-mode-style');\n if (style) style.remove();\n }\n \n // Toggle with Alt+Shift+D\n document.addEventListener('keydown', function(e) {\n if (e.altKey && e.shiftKey && e.key === 'D') {\n e.preventDefault();\n enabled = !enabled;\n if (enabled) {\n applyDarkMode();\n console.log('[Universal Dark Mode] Enabled');\n } else {\n removeDarkMode();\n console.log('[Universal Dark Mode] Disabled');\n }\n }\n });\n \n // Apply on load\n applyDarkMode();\n \n // Re-apply on dynamic content\n var observer = new MutationObserver(function(mutations) {\n if (enabled && !document.getElementById('universal-dark-mode-style')) {\n applyDarkMode();\n }\n });\n observer.observe(document.head, { childList: true });\n \n console.log('[Universal Dark Mode] Loaded - Press Alt+Shift+D to toggle');\n})();", "Universal Dark Mode");
}
} catch(__e) { console.warn('[Userscript:Universal Dark Mode]', __e); }
})();
})();

Skip to content

This repository was archived by the owner on Oct 13, 2023. It is now read-only.

[19.03] Revert Pass root to chroot to for chroot Tar/Untar (CVE-2018-15664)  - #275
Merged
andrewhsu merged 2 commits into
docker-archive:19.03from 
tiborvass:19.03-revert-chroot-tar-untar
Jun 12, 2019
Merged
[19.03] Revert Pass root to chroot to for chroot Tar/Untar (CVE-2018-15664) #275
andrewhsu merged 2 commits into
docker-archive:19.03from 
tiborvass:19.03-revert-chroot-tar-untar
Conversation
@tiborvass
@tiborvasstiborvass
commented
Jun 12, 2019

Copy link


Copy Markdown

The CVE fix merged in #254 is currently incorrect and breaks users (see moby#39348).
While we figure out the proper fix, unfortunately we need to revert the fix for 19.03.
Ping @andrewhsu@justincormack@tonistiigi@cpuguy83@thaJeztah
Tibor Vass
added 2 commits
June 12, 2019 04:06
Tibor Vass
Revert "Add chroot for tar packing operations"
96df6d4
This reverts commit 3e057d5.
Signed-off-by: Tibor Vass <tibor@docker.com>
Tibor Vass
Revert "Pass root to chroot to for chroot Untar"
60013ba
This reverts commit 9781cce.
Signed-off-by: Tibor Vass <tibor@docker.com>
@andrewhsuandrewhsu
added this to the 19.03.0 milestone
Jun 12, 2019
tonistiigi
tonistiigi
approved these changes
Jun 12, 2019
View reviewed changes
@tonistiigitonistiigi
left a comment


Copy link


Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I do not understand how this doesn't just automatically delay the release but LGTM if there is no other way.
@cpuguy83
cpuguy83
commented
Jun 12, 2019

Copy link


Copy Markdown

Sorry, I'm not seeing the problem with the proposed patch (outside of showing the need for a rewrite)
@tiborvass
tiborvass
commented
Jun 12, 2019

Copy link


Copy Markdown

Author
@cpuguy83 it partially reverts the guarantees that the CVE fix added (by chroot-ing to one directory level above, which in the case of other drivers than overlay2 provides access to any other layer).
andrewhsu
andrewhsu
approved these changes
Jun 12, 2019
View reviewed changes
@andrewhsuandrewhsu
left a comment


Copy link


Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM
need more time to come up with a more suitable fix for the CVE, next train is june patch release due by end of month
@andrewhsu
andrewhsu
merged commit ceb773e
into
docker-archive:19.03Jun 12, 2019
@andrewhsu
andrewhsu
commented
Jun 12, 2019

Copy link


Copy Markdown

In the meantime, until a more suitable fix for the CVE is available, mitigation is to pause the container before doing file system operations if one is concerned about somebody being sneaky: moby#39252
thaJeztah
thaJeztah
reviewed
Jun 12, 2019
View reviewed changes
@thaJeztahthaJeztah
left a comment


Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM
@cpuguy83
cpuguy83
commented
Jun 12, 2019

Copy link


Copy Markdown

Doesn't it make sense to have a partial mitigation?

Also was there some issue found with the "copy to container" scenario?
@tiborvasstiborvass
mentioned this pull request
Jun 14, 2019
 Merged

@dubo-dubon-duponeydubo-dubon-duponey
mentioned this pull request
Jul 1, 2019

Closed

docker-jenkins pushed a commit
that referenced
this pull request
May 19, 2021
@andrewhsu
Merge pull request#275from seemethere/failure_to_launch
d621723
Add docker.socket requirement for docker.service
Sign up for freeto subscribe to this conversation on GitHub.
Already have an account?
Sign in.


Reviewers

@justincormackjustincormackAwaiting requested review from justincormack

3 more reviewers

@thaJeztahthaJeztahthaJeztah left review comments
@andrewhsuandrewhsuandrewhsu approved these changes
@tonistiigitonistiigitonistiigi approved these changes
Reviewers whose approvals may not affect merge requirements

Assignees


No one assigned


Labels


None yet


Projects


None yet


Milestone

19.03.0

Development

Successfully merging this pull request may close these issues.

5 participants

@tiborvass@cpuguy83@andrewhsu@tonistiigi@thaJeztah