From 62b760911538ac42410df1164065172a1e867720 Mon Sep 17 00:00:00 2001
From: tomsweeneyredhat <tsweeney@redhat.com>
Date: Mon, 18 Mar 2024 10:47:43 -0400
Subject: [PATCH] [release-1.31] CVE-2024-1753 container escape fix

Addresses CVE-2024-1753 which allowed a user to write files to the
`/` directory of the host machine if selinux was not enabled.

Signed-off-by: tomsweeneyredhat <tsweeney@redhat.com>
---
 internal/parse/parse.go |  7 ++++++-
 tests/bud.bats          | 23 +++++++++++++++++++++++
 2 files changed, 29 insertions(+), 1 deletion(-)

diff --git a/internal/parse/parse.go b/internal/parse/parse.go
index 283e6fbf2f..8137451be0 100644
--- a/internal/parse/parse.go
+++ b/internal/parse/parse.go
@@ -11,6 +11,7 @@ import (
 
 	"errors"
 
+        "github.com/containers/buildah/copier"
 	"github.com/containers/buildah/define"
 	"github.com/containers/buildah/internal"
 	internalUtil "github.com/containers/buildah/internal/util"
@@ -181,7 +182,11 @@ func GetBindMount(ctx *types.SystemContext, args []string, contextDir string, st
 	// buildkit parity: support absolute path for sources from current build context
 	if contextDir != "" {
 		// path should be /contextDir/specified path
-		newMount.Source = filepath.Join(contextDir, filepath.Clean(string(filepath.Separator)+newMount.Source))
+                evaluated, err := copier.Eval(contextDir, newMount.Source, copier.EvalOptions{})
+                if err != nil {
+                        return newMount, "", err
+                }
+                newMount.Source = evaluated
 	} else {
 		// looks like its coming from `build run --mount=type=bind` allow using absolute path
 		// error out if no source is set
diff --git a/tests/bud.bats b/tests/bud.bats
index 0fa5db3216..8f71c8e4c1 100644
--- a/tests/bud.bats
+++ b/tests/bud.bats
@@ -6168,3 +6168,26 @@ _EOF
     false
   fi
 }
+
+@test "build no write file on host - CVE-2024-1753" {
+  _prefetch alpine
+  cat > ${TEST_SCRATCH_DIR}/Containerfile << _EOF
+FROM alpine as base
+
+RUN ln -s / /rootdir
+
+FROM alpine
+
+RUN echo "With exploit show host root, not the container's root, and create /BIND_BREAKOUT in / on the host"
+RUN --mount=type=bind,from=base,source=/rootdir,destination=/exploit,rw ls -l /exploit; touch /exploit/BIND_BREAKOUT; ls -l /exploit
+
+_EOF
+
+  run_buildah build $WITH_POLICY_JSON ${TEST_SCRATCH_DIR}
+  expect_output --substring "/BIND_BREAKOUT"
+
+  run ls /BIND_BREAKOUT
+  rm -f /BIND_BREAKOUT
+  assert "$status" -eq 2 "exit code from ls"
+  expect_output --substring "No such file or directory"
+}