diff options
| author | Marcin Juszkiewicz <marcin.juszkiewicz+kolla@linaro.org> | 2022-04-13 20:19:38 +0200 |
|---|---|---|
| committer | Mark Goddard <mark@stackhpc.com> | 2022-04-14 11:32:51 +0100 |
| commit | c4fda7baa3ffc36b555c32a34a00042b6035b917 (patch) | |
| tree | 5b91d97b5cac79435b876bbf2fa18f55f5091954 /kolla/image | |
| parent | 4b5cfa85eb7c70fd4d2536e48b6b4d279c0ed163 (diff) | |
| download | kolla-c4fda7baa3ffc36b555c32a34a00042b6035b917.tar.gz kolla-c4fda7baa3ffc36b555c32a34a00042b6035b917.zip | |
Fix image builds with sources using a type=git
A recent change to git [1] introduced a new behaviour to work around a
CVE [2] that disallows any git operations in directories not owned by
the current user.
This may seem unrelated to installation, but it plays havoc with PBR,
which calls out to git to get to get revision history. So if you are
"pip install"-ing from a source tree you don't own, the PBR git calls
in that tree now fail and the install blows up.
When using type=source, kolla clones the repository, then creates a
tarball from it, which is ADDed to the image. The ownership of the files
in the tarball is preserved, which in this case will be the user running
kolla-build. Since the Docker build runs as root, we hit the PBR issue.
Our solution is to make sure that any tarball we generate from git
sources have all files owned by root:root so that the root user is able
to use git commands when building container images.
[1] https://github.com/git/git/commit/8959555cee7ec045958f9b6dd62e541affb7e7d9
[2] https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-24765.
Closes-Bug: #1969096
Related-Bug: #1968877
Co-Authored-By: Mark Goddard <mark@stackhpc.com>
Change-Id: I2cbf1f539880d512aa223c3ef3a4b19ee18854ac
Diffstat (limited to 'kolla/image')
| -rwxr-xr-x | kolla/image/build.py | 12 |
1 files changed, 11 insertions, 1 deletions
diff --git a/kolla/image/build.py b/kolla/image/build.py index 3d4fcc27a..4a6ecd495 100755 --- a/kolla/image/build.py +++ b/kolla/image/build.py @@ -368,8 +368,18 @@ class BuildTask(DockerTask): image.status = Status.ERROR return + # NOTE(mgoddard): Change ownership of files to root:root. This + # avoids an issue introduced by the fix for git CVE-2022-24765, + # which breaks PBR when the source checkout is not owned by the + # user installing it. LP#1969096 + def reset_userinfo(tarinfo): + tarinfo.uid = tarinfo.gid = 0 + tarinfo.uname = tarinfo.gname = "root" + return tarinfo + with tarfile.open(dest_archive, 'w') as tar: - tar.add(clone_dir, arcname=os.path.basename(clone_dir)) + tar.add(clone_dir, arcname=os.path.basename(clone_dir), + filter=reset_userinfo) elif source.get('type') == 'local': self.logger.debug("Getting local archive from %s", |