Skip to content

Commit ed6b169

Browse files
committed
selinux: use safe procfs API for labels
Due to the sensitive nature of these fixes, it was not possible to submit these upstream and vendor the upstream library. Instead, this patch uses a fork of github.com/opencontainers/selinux, branched at commit opencontainers/selinux@879a755. In order to permit downstreams to build with this patched version, a snapshot of the forked version has been included in internal/third_party/selinux. Note that since we use "go mod vendor", the patched code is usable even without being "go get"-able. Once the embargo for this issue is lifted we can submit the patches upstream and switch back to a proper upstream go.mod entry. Also, this requires us to temporarily disable the CI job we have that disallows "replace" directives. Fixes: GHSA-cgrx-mc8f-2prm CVE-2025-52881 Signed-off-by: Aleksa Sarai <[email protected]>
1 parent d40b343 commit ed6b169

40 files changed

+4951
-100
lines changed

.github/workflows/validate.yml

Lines changed: 6 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -152,9 +152,12 @@ jobs:
152152
- name: no toolchain in go.mod # See https://github.com/opencontainers/runc/pull/4717, https://github.com/dependabot/dependabot-core/issues/11933.
153153
run: |
154154
if grep -q '^toolchain ' go.mod; then echo "Error: go.mod must not have toolchain directive, please fix"; exit 1; fi
155-
- name: no exclude nor replace in go.mod
156-
run: |
157-
if grep -Eq '^\s*(exclude|replace) ' go.mod; then echo "Error: go.mod must not have exclude/replace directive, it breaks go install. Please fix"; exit 1; fi
155+
# FIXME: This check needed to be disabled for the go-selinux patch addded
156+
# when patching CVE-2025-52881. This needs to be removed as soon as
157+
# the embargo is lifted, along with the replace directive in go.mod.
158+
#- name: no exclude nor replace in go.mod
159+
# run: |
160+
# if grep -Eq '^\s*(exclude|replace) ' go.mod; then echo "Error: go.mod must not have exclude/replace directive, it breaks go install. Please fix"; exit 1; fi
158161

159162

160163
commit:

go.mod

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -32,3 +32,8 @@ require (
3232
github.com/cpuguy83/go-md2man/v2 v2.0.7 // indirect
3333
github.com/russross/blackfriday/v2 v2.1.0 // indirect
3434
)
35+
36+
// FIXME: This is only intended as a short-term solution to include a patch for
37+
// CVE-2025-52881 in go-selinux without pushing the patches upstream. This
38+
// should be removed as soon as possible after the embargo is lifted.
39+
replace github.com/opencontainers/selinux => ./internal/third_party/selinux

go.sum

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -48,8 +48,6 @@ github.com/opencontainers/cgroups v0.0.5 h1:DRITAqcOnY0uSBzIpt1RYWLjh5DPDiqUs4fY
4848
github.com/opencontainers/cgroups v0.0.5/go.mod h1:oWVzJsKK0gG9SCRBfTpnn16WcGEqDI8PAcpMGbqWxcs=
4949
github.com/opencontainers/runtime-spec v1.2.2-0.20250818071321-383cadbf08c0 h1:RLn0YfUWkiqPGtgUANvJrcjIkCHGRl3jcz/c557M28M=
5050
github.com/opencontainers/runtime-spec v1.2.2-0.20250818071321-383cadbf08c0/go.mod h1:jwyrGlmzljRJv/Fgzds9SsS/C5hL+LL3ko9hs6T5lQ0=
51-
github.com/opencontainers/selinux v1.12.0 h1:6n5JV4Cf+4y0KNXW48TLj5DwfXpvWlxXplUkdTrmPb8=
52-
github.com/opencontainers/selinux v1.12.0/go.mod h1:BTPX+bjVbWGXw7ZZWUbdENt8w0htPSrlgOOysQaU62U=
5351
github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
5452
github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
5553
github.com/rogpeppe/go-internal v1.11.0 h1:cWPaGQEPrBb5/AsnsZesgZZ9yb1OQ+GOISoDNXVBh4M=
Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
[codespell]
2+
skip = ./.git,./go.sum,./go-selinux/testdata
Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
# Please see the documentation for all configuration options:
2+
# https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file
3+
4+
version: 2
5+
updates:
6+
# Dependencies listed in .github/workflows/*.yml
7+
- package-ecosystem: "github-actions"
8+
directory: "/"
9+
schedule:
10+
interval: "daily"
Lines changed: 163 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,163 @@
1+
name: validate
2+
on:
3+
push:
4+
tags:
5+
- v*
6+
branches:
7+
- master
8+
pull_request:
9+
10+
jobs:
11+
12+
commit:
13+
runs-on: ubuntu-24.04
14+
# Only check commits on pull requests.
15+
if: github.event_name == 'pull_request'
16+
steps:
17+
- name: get pr commits
18+
id: 'get-pr-commits'
19+
uses: tim-actions/[email protected]
20+
with:
21+
token: ${{ secrets.GITHUB_TOKEN }}
22+
23+
- name: check subject line length
24+
uses: tim-actions/[email protected]
25+
with:
26+
commits: ${{ steps.get-pr-commits.outputs.commits }}
27+
pattern: '^.{0,72}(\n.*)*$'
28+
error: 'Subject too long (max 72)'
29+
30+
lint:
31+
runs-on: ubuntu-24.04
32+
steps:
33+
- uses: actions/checkout@v5
34+
- uses: actions/setup-go@v6
35+
with:
36+
go-version: 1.24.x
37+
- uses: golangci/golangci-lint-action@v7
38+
with:
39+
version: v2.0
40+
41+
codespell:
42+
runs-on: ubuntu-24.04
43+
steps:
44+
- uses: actions/checkout@v5
45+
- name: install deps
46+
# Version of codespell bundled with Ubuntu is way old, so use pip.
47+
run: pip install codespell
48+
- name: run codespell
49+
run: codespell
50+
51+
cross:
52+
runs-on: ubuntu-24.04
53+
steps:
54+
- uses: actions/checkout@v5
55+
- name: cross
56+
run: make build-cross
57+
58+
test-stubs:
59+
runs-on: macos-latest
60+
steps:
61+
- uses: actions/checkout@v5
62+
- uses: actions/setup-go@v6
63+
with:
64+
go-version: 1.24.x
65+
- uses: golangci/golangci-lint-action@v7
66+
with:
67+
version: v2.0
68+
- name: test-stubs
69+
run: make test
70+
71+
test:
72+
strategy:
73+
fail-fast: false
74+
matrix:
75+
go-version: [1.19.x, 1.23.x, 1.24.x]
76+
race: ["-race", ""]
77+
runs-on: ubuntu-24.04
78+
steps:
79+
- uses: actions/checkout@v5
80+
81+
- name: install go ${{ matrix.go-version }}
82+
uses: actions/setup-go@v6
83+
with:
84+
go-version: ${{ matrix.go-version }}
85+
86+
- name: build
87+
run: make BUILDFLAGS="${{ matrix.race }}" build
88+
89+
- name: test
90+
run: make TESTFLAGS="${{ matrix.race }}" test
91+
92+
vm:
93+
name: "VM"
94+
strategy:
95+
fail-fast: false
96+
matrix:
97+
template:
98+
- template://almalinux-8
99+
- template://centos-stream-9
100+
- template://fedora
101+
- template://experimental/opensuse-tumbleweed
102+
runs-on: ubuntu-24.04
103+
steps:
104+
- uses: actions/checkout@v5
105+
106+
- name: "Install Lima"
107+
uses: lima-vm/lima-actions/setup@v1
108+
id: lima-actions-setup
109+
110+
- name: "Cache ~/.cache/lima"
111+
uses: actions/cache@v4
112+
with:
113+
path: ~/.cache/lima
114+
key: lima-${{ steps.lima-actions-setup.outputs.version }}-${{ matrix.template }}
115+
116+
- name: "Start VM"
117+
# --plain is set to disable file sharing, port forwarding, built-in containerd, etc. for faster start up
118+
run: limactl start --plain --name=default ${{ matrix.template }}
119+
120+
- name: "Initialize VM"
121+
run: |
122+
set -eux -o pipefail
123+
# Sync the current directory to /tmp/selinux in the guest
124+
limactl cp -r . default:/tmp/selinux
125+
# Install packages
126+
if lima command -v dnf >/dev/null; then
127+
lima sudo dnf install --setopt=install_weak_deps=false --setopt=tsflags=nodocs -y git-core make golang
128+
elif lima command -v zypper >/dev/null; then
129+
lima sudo zypper install -y git make go
130+
else
131+
echo >&2 "Unsupported distribution"
132+
exit 1
133+
fi
134+
135+
- name: "make test"
136+
continue-on-error: true
137+
run: lima make -C /tmp/selinux test
138+
139+
- name: "32-bit test"
140+
continue-on-error: true
141+
run: lima make -C /tmp/selinux GOARCH=386 test
142+
143+
# https://github.com/opencontainers/selinux/issues/222
144+
# https://github.com/opencontainers/selinux/issues/225
145+
- name: "racy test"
146+
continue-on-error: true
147+
run: lima bash -c 'cd /tmp/selinux && go test -timeout 10m -count 100000 ./go-selinux'
148+
149+
- name: "Show AVC denials"
150+
run: lima sudo ausearch -m AVC,USER_AVC || true
151+
152+
all-done:
153+
needs:
154+
- commit
155+
- lint
156+
- codespell
157+
- cross
158+
- test-stubs
159+
- test
160+
- vm
161+
runs-on: ubuntu-24.04
162+
steps:
163+
- run: echo "All jobs completed"
Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
build
Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
version: "2"
2+
3+
formatters:
4+
enable:
5+
- gofumpt
6+
7+
linters:
8+
enable:
9+
# - copyloopvar # Detects places where loop variables are copied. TODO enable for Go 1.22+
10+
- dupword # Detects duplicate words.
11+
- errorlint # Detects code that may cause problems with Go 1.13 error wrapping.
12+
- gocritic # Metalinter; detects bugs, performance, and styling issues.
13+
- gosec # Detects security problems.
14+
- misspell # Detects commonly misspelled English words in comments.
15+
- nilerr # Detects code that returns nil even if it checks that the error is not nil.
16+
- nolintlint # Detects ill-formed or insufficient nolint directives.
17+
- prealloc # Detects slice declarations that could potentially be pre-allocated.
18+
- predeclared # Detects code that shadows one of Go's predeclared identifiers
19+
- revive # Metalinter; drop-in replacement for golint.
20+
- thelper # Detects test helpers without t.Helper().
21+
- tparallel # Detects inappropriate usage of t.Parallel().
22+
- unconvert # Detects unnecessary type conversions.
23+
- usetesting # Reports uses of functions with replacement inside the testing package.
24+
settings:
25+
govet:
26+
enable-all: true
27+
settings:
28+
shadow:
29+
strict: true
30+
exclusions:
31+
generated: strict
32+
presets:
33+
- comments
34+
- common-false-positives
35+
- legacy
36+
- std-error-handling
37+
rules:
38+
- linters:
39+
- govet
40+
text: '^shadow: declaration of "err" shadows declaration'
41+
42+
issues:
43+
max-issues-per-linter: 0
44+
max-same-issues: 0
Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
* @kolyshkin @mrunalp @rhatdan @runcom @thajeztah
Lines changed: 119 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,119 @@
1+
## Contribution Guidelines
2+
3+
### Security issues
4+
5+
If you are reporting a security issue, do not create an issue or file a pull
6+
request on GitHub. Instead, disclose the issue responsibly by sending an email
7+
to [email protected] (which is inhabited only by the maintainers of
8+
the various OCI projects).
9+
10+
### Pull requests are always welcome
11+
12+
We are always thrilled to receive pull requests, and do our best to
13+
process them as fast as possible. Not sure if that typo is worth a pull
14+
request? Do it! We will appreciate it.
15+
16+
If your pull request is not accepted on the first try, don't be
17+
discouraged! If there's a problem with the implementation, hopefully you
18+
received feedback on what to improve.
19+
20+
We're trying very hard to keep the project lean and focused. We don't want it
21+
to do everything for everybody. This means that we might decide against
22+
incorporating a new feature.
23+
24+
25+
### Conventions
26+
27+
Fork the repo and make changes on your fork in a feature branch.
28+
For larger bugs and enhancements, consider filing a leader issue or mailing-list thread for discussion that is independent of the implementation.
29+
Small changes or changes that have been discussed on the project mailing list may be submitted without a leader issue.
30+
31+
If the project has a test suite, submit unit tests for your changes. Take a
32+
look at existing tests for inspiration. Run the full test suite on your branch
33+
before submitting a pull request.
34+
35+
Update the documentation when creating or modifying features. Test
36+
your documentation changes for clarity, concision, and correctness, as
37+
well as a clean documentation build. See ``docs/README.md`` for more
38+
information on building the docs and how docs get released.
39+
40+
Write clean code. Universally formatted code promotes ease of writing, reading,
41+
and maintenance. Always run `gofmt -s -w file.go` on each changed file before
42+
committing your changes. Most editors have plugins that do this automatically.
43+
44+
Pull requests descriptions should be as clear as possible and include a
45+
reference to all the issues that they address.
46+
47+
Commit messages must start with a capitalized and short summary
48+
written in the imperative, followed by an optional, more detailed
49+
explanatory text which is separated from the summary by an empty line.
50+
51+
Code review comments may be added to your pull request. Discuss, then make the
52+
suggested modifications and push additional commits to your feature branch. Be
53+
sure to post a comment after pushing. The new commits will show up in the pull
54+
request automatically, but the reviewers will not be notified unless you
55+
comment.
56+
57+
Before the pull request is merged, make sure that you squash your commits into
58+
logical units of work using `git rebase -i` and `git push -f`. After every
59+
commit the test suite (if any) should be passing. Include documentation changes
60+
in the same commit so that a revert would remove all traces of the feature or
61+
fix.
62+
63+
Commits that fix or close an issue should include a reference like `Closes #XXX`
64+
or `Fixes #XXX`, which will automatically close the issue when merged.
65+
66+
### Sign your work
67+
68+
The sign-off is a simple line at the end of the explanation for the
69+
patch, which certifies that you wrote it or otherwise have the right to
70+
pass it on as an open-source patch. The rules are pretty simple: if you
71+
can certify the below (from
72+
[developercertificate.org](http://developercertificate.org/)):
73+
74+
```
75+
Developer Certificate of Origin
76+
Version 1.1
77+
78+
Copyright (C) 2004, 2006 The Linux Foundation and its contributors.
79+
660 York Street, Suite 102,
80+
San Francisco, CA 94110 USA
81+
82+
Everyone is permitted to copy and distribute verbatim copies of this
83+
license document, but changing it is not allowed.
84+
85+
86+
Developer's Certificate of Origin 1.1
87+
88+
By making a contribution to this project, I certify that:
89+
90+
(a) The contribution was created in whole or in part by me and I
91+
have the right to submit it under the open source license
92+
indicated in the file; or
93+
94+
(b) The contribution is based upon previous work that, to the best
95+
of my knowledge, is covered under an appropriate open source
96+
license and I have the right under that license to submit that
97+
work with modifications, whether created in whole or in part
98+
by me, under the same open source license (unless I am
99+
permitted to submit under a different license), as indicated
100+
in the file; or
101+
102+
(c) The contribution was provided directly to me by some other
103+
person who certified (a), (b) or (c) and I have not modified
104+
it.
105+
106+
(d) I understand and agree that this project and the contribution
107+
are public and that a record of the contribution (including all
108+
personal information I submit with it, including my sign-off) is
109+
maintained indefinitely and may be redistributed consistent with
110+
this project or the open source license(s) involved.
111+
```
112+
113+
then you just add a line to every git commit message:
114+
115+
Signed-off-by: Joe Smith <[email protected]>
116+
117+
using your real name (sorry, no pseudonyms or anonymous contributions.)
118+
119+
You can add the sign off when creating the git commit via `git commit -s`.

0 commit comments

Comments
 (0)