Details
-
Improvement
-
Status: In Progress
-
Major
-
Resolution: Unresolved
-
1.7.0, 1.8.0
-
None
-
None
-
Mesos Foundations: RI-13 Sp 44, Mesos Foundations: RI13 Sp 45
-
2
Description
The libarchive source provides the following flag:
/* Default: Do not try to guard against extracts redirected by symlinks. */ /* Note: With ARCHIVE_EXTRACT_UNLINK, will remove any intermediate symlink. */ #define ARCHIVE_EXTRACT_SECURE_SYMLINKS (0x0100)
https://github.com/libarchive/libarchive/blob/master/libarchive/archive.h#L672-L674
We should check if the default behavior is unsecure (i.e. allowing a fetched artifact to affect files outside the sandbox).
Attachments
Issue Links
- is related to
-
MESOS-9610 Fetcher vulnerability - escaping from sandbox
- Resolved