mirror of
https://github.com/moby/buildkit.git
synced 2026-08-09 17:18:11 +00:00
2ee0a47757
The Windows cache mount is realized later by HCS from the resolved host
path, so verification alone leaves a check-to-use window in which the
verified entry could be swapped for a junction escaping the cache root
(concurrent cache access). Hold the verified source open with
GENERIC_READ and a share mode that omits FILE_SHARE_DELETE until the
mount is released, so the entry cannot be renamed or deleted (and thus
swapped) during that window. GENERIC_READ rather than DELETE is used so a
concurrent read/traverse open by the mount stack still succeeds;
validated against a real HCS worker (benign cache mounts still mount and
the escape is still rejected).
Add a unit test asserting the source cannot be renamed while pinned and
can be renamed after release.
Signed-off-by: Dawei Wei <wei.dawei.cn@gmail.com>
(cherry picked from commit 39a7b40489a036134a93502ea3d84d71dca072ea)
(cherry picked from commit 473663bad0)