user: prevent falling back to looking up numeric usernames#221
Conversation
vvoland
left a comment
vvoland
left a comment
There was a problem hiding this comment.
This only tests the case where gid/uid still falls within int .
If it's larger, it will still resolve to root because it will be treated as an username and still resolved.
So:
9223372036854775808:x:0:0:root:/root:/bin/sh
USER 9223372036854775808
Means that the runtime will actually resolve it to root.
This is "correct" behavior, but its confusing to treat a numeric value as an username.
|
@vvoland - trying to see where that codepath would be; testing |
|
On 64 bit |
thaJeztah
changed the title
|
Do we need the same for |
|
Yeah, makes sense; also updated As a follow-up, I'm considering cleaning up this code; the logic seems to be much too complicated. |
thaJeztah
force-pushed
the
limit_uidgid
branch
3 times, most recently
from
2d39888 to
a310bf9
Compare
Improve handling of numeric user/group to prevent looking up numeric values as usernames. This fixes a similar issue as CVE-2026-46680 in containerd. Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
kolyshkin
left a comment
kolyshkin
left a comment
There was a problem hiding this comment.
LGTM overall; maybe just a slight improvement to the second commit?
thaJeztah
force-pushed
the
limit_uidgid
branch
2 times, most recently
from
69522ff to
210a41e
Compare
Co-authored-by: Kir Kolyshkin <kolyshkin@gmail.com> Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
4 participants
Addresses a similar issue as CVE-2026-46680 in containerd.