github/kata-containers
1
0
Fork 2
mirror of https://github.com/kata-containers/kata-containers.git synced 2026-07-25 14:18:54 +00:00
Code Issues Projects Releases Wiki Activity

Merge pull request #13415 from Apokleos/disable-sb-bmnt

Browse Source 
kata-types: disallow sandbox bind mounts from annotations
This commit is contained in:
Fabiano Fidêncio
2026-07-20 13:36:06 +02:00
committed by GitHub
parent 681c0ffc47 9566efd4bd
commit 86e5531504
1 changed files with 6 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
src/libs/kata-types/src/annotations/mod.rs
View File

@@ -1154,14 +1154,12 @@ impl Annotation {
config.runtime.shared_mounts = serde_json::from_str(value.as_str())?;
}
KATA_ANNO_CFG_SANDBOX_BIND_MOUNTS => {
let args: Vec<String> = value
.to_string()
.split_ascii_whitespace()
.map(str::to_string)
.collect();
for arg in args {
config.runtime.sandbox_bind_mounts.push(arg.to_string());
}
// Host bind-mount paths are operator-controlled configuration only.
// Never honor them from untrusted workload annotations.
warn!(
sl!(),
"Annotation {} is not permitted from workload annotations", key
);
}
_ => {
warn!(sl!(), "Annotation {} not enabled", key);