Tonis Tiigi 408266e4ba user: limit size of parsed passwd/group files ...

Resolving a username to uid/gid read /etc/passwd and /etc/group via
os.Open with no upper bound, letting a crafted image force unbounded
memory use during user resolution. Cap reads at 10MiB and reject
non-regular files in both the OCI executor and the chown user resolver.

Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
(cherry picked from commit 83cfc1e0ea1dcf8816f259ee6720b8694ab874e5)

2026-06-24 10:56:53 -07:00

..

hosts.go

executor/oci: scope state files to roots

2026-03-25 08:14:31 -07:00

mounts_test.go

Upgrade to containerd 2

2025-01-13 16:42:48 -08:00

mounts.go

Upgrade to containerd 2

2025-01-13 16:42:48 -08:00

resolvconf_test.go

executor/oci: scope state files to roots

2026-03-25 08:14:31 -07:00

resolvconf.go

executor/oci: scope state files to roots

2026-03-25 08:14:31 -07:00

spec_darwin.go

security: validate exec security modes

2026-06-24 10:56:46 -07:00

spec_freebsd.go

security: validate exec security modes

2026-06-24 10:56:46 -07:00

spec_linux.go

security: validate exec security modes

2026-06-24 10:56:46 -07:00

spec_unix.go

feat: wcow: add support for bind and cache mounts

2025-02-20 21:19:03 +03:00

spec_windows.go

security: validate exec security modes

2026-06-24 10:56:46 -07:00

spec.go

vendor: migrate to github.com/gohugoio/hashstructure

2026-06-17 10:02:52 +02:00

user.go

user: limit size of parsed passwd/group files

2026-06-24 10:56:53 -07:00