- Fix a regression introduced in v0.3.0 that caused archive extraction
to reject hardlinks with absolute targets, as produced by some image
builders. Absolute hardlink targets are now resolved relative to the
extraction root, while paths that escape the root remain rejected.
- Fix a regression introduced in v0.3.0 that caused archive extraction
to fail when applying permissions to device nodes, including nodes on
`nodev` filesystems and `dev/ptmx`. Device nodes are now referenced
without opening the underlying device before applying their mode.
- Set close-on-exec on file descriptors used by the Linux permission
fallback to prevent them from leaking into child processes.
full diff: https://github.com/moby/go-archive/compare/v0.3.2...v0.3.3
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
2a3ab8fcc0