Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

conversion: mention the potential risks of blindly copying annotations #1061

Open
wants to merge 1 commit into
base: main
Choose a base branch
from
Open

conversion: mention the potential risks of blindly copying annotations #1061

wants to merge 1 commit into from
+7 −0

Commits on May 16, 2023

  1. conversion: mention the potential risks of blindly copying annotations 

    While the ability to copy arbitrary container labels into the generated
runtime-spec is a very useful feature, it needs to be mentioned that
some runtime-spec annotations (such as "org.systemd.property.*" and
"run.oci.hooks.*") can allow an image to cause runtimes to either
configure an insecure container or act as a way to attack the host
machine.

It should be noted this is no different to any other malicious
config.json attack -- it is the responsibility of runtime-spec
generators to make sure the configuration is secure.

Reported-by: Akihiro Suda <[email protected]>
Signed-off-by: Aleksa Sarai <[email protected]>
    @cyphar
    cyphar committed May 16, 2023
    Configuration menu
    Copy the full SHA
    0c9ee57 View commit details
    Browse the repository at this point in the history