Debian Patches
Status for rust-p9/0.3.2-2
| Patch | Description | Author | Forwarded | Bugs | Origin | Last update |
|---|---|---|---|---|---|---|
| prevent-path-traversal-and-sandbox-escape.patch | Prevent path traversal and sandbox escape in directory walking A 9P client could escape the exported root: walking ".." from the root climbed out of it, and path components containing '/' or naming "." / ".." were accepted for create, mkdir, link, rename and unlink, allowing operations outside the shared directory. The server now pins the root by device and inode so ".." at the root stays at the root, validates every client-supplied path component, and opens the root O_PATH|O_NOFOLLOW. Since crosvm uses this crate to export a host directory to a guest, this fix is the whole point of the package. . This is upstream's own fix, which exists only in git: upstream bumped the crate version to 0.3.3 for it but has never tagged or published that release, and the newest crate on crates.io is 0.3.2. The patch combines the fix with its one-line prerequisite a8f3a19 ("Accept a shared ref in `read_dir`"); applying it to the 0.3.2 crate yields a source tree byte-identical to upstream commit 37ff802, so this is upstream's code rather than a port. |
Christian Blichmann <cblichmann@google.com> | no | upstream, https://github.com/google/rust-p9/commit/37ff8021bdbae5acdb1a971a79741ae23733223f |