Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[release/1.7 backport] switch back from golang.org/x/sys/execabs to os/exec (go1.19) #9602

Merged
merged 2 commits into from Jan 8, 2024
Merged

[release/1.7 backport] switch back from golang.org/x/sys/execabs to os/exec (go1.19) #9602

merged 2 commits into from Jan 8, 2024

Conversation

thaJeztah
Copy link
Member

@thaJeztah
switch back from golang.org/x/sys/execabs to os/exec (go1.19)
2ad2a2e 
This is effectively a revert of 2ac9968, which
switched from os/exec to the golang.org/x/sys/execabs package to mitigate
security issues (mainly on Windows) with lookups resolving to binaries in the
current directory.

from the go1.19 release notes https://go.dev/doc/go1.19#os-exec-path

> ## PATH lookups
>
> Command and LookPath no longer allow results from a PATH search to be found
> relative to the current directory. This removes a common source of security
> problems but may also break existing programs that depend on using, say,
> exec.Command("prog") to run a binary named prog (or, on Windows, prog.exe) in
> the current directory. See the os/exec package documentation for information
> about how best to update such programs.
>
> On Windows, Command and LookPath now respect the NoDefaultCurrentDirectoryInExePath
> environment variable, making it possible to disable the default implicit search
> of “.” in PATH lookups on Windows systems.

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
(cherry picked from commit 2af6db6)
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
@thaJeztah
remove remaining uses of golang.org/x/sys/execabs
872af82 
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
fuweid
fuweid approved these changes Jan 8, 2024
View reviewed changes
Copy link
Member

@fuweid fuweid left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@fuweid fuweid merged commit 5a675f2 into containerd:release/1.7 Jan 8, 2024
56 checks passed
@thaJeztah thaJeztah deleted the 1.7_backport_no_execabs branch January 8, 2024 12:38
@dmcgowan dmcgowan mentioned this pull request Jan 12, 2024
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@estesp estesp estesp approved these changes

@fuweid fuweid fuweid approved these changes

Assignees
No one assigned
Labels
size/M
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

None yet
4 participants
@thaJeztah @estesp @fuweid @k8s-ci-robot