Align the container behavior with VMs by reading the console ringbuffer
without resetting it, so the log can be fetched more than once.
Closes#3467
Signed-off-by: Stéphane Graber <stgraber@stgraber.org>
SPICE uses multiple connections, instead of triggering an event on each
of them, we only want to trigger it once at the beginning.
Signed-off-by: Stéphane Graber <stgraber@stgraber.org>
This fixes an issue when running on systems without the protect_symlinks
kernel protection enabled (introduced in 2012).
On such systems, a user could pre-create symlinks to sensitive files on
the system and trick Incus into truncating them and altering their file
mode and ownership.
This addresses CVE-2026-33711
Reported-by: https://7asecurity.com
Signed-off-by: Stéphane Graber <stgraber@stgraber.org>
This fixes three security issues related to file templates:
- The template target path could be made to be relative or gothrough
symlinks in a way that could lead to arbitrary write to the host
filesystem.
- The template directory could be relative, allowing for arbitrary read
from the host filesystem.
- The template file itself could be made relative, allowing for
arbitrary reads from the host filesystem.
In the case of the template target path, the new logic makes use of the
kernel's openat2 system call which brings a variety of flags that can be
used to restrict path resolution and detect potential issues.
For the template path itself, we now validate that it is a simple local
file and that the template directory isn't a symlink.
This fixes CVE-2026-23954
Reported-by: Rory McNamara <rory.mcnamara@snyk.io>
Signed-off-by: Stéphane Graber <stgraber@stgraber.org>
With the recent tightening of permissions on the instance folders, QEMU
is no longer able to directly write to the instance's folder.
We instead need a world writable location for those files to go.
Use /tmp and put a predictable pattern, restricted file permissions and
update the AppArmor policy for it.
Closes#2708
Signed-off-by: Stéphane Graber <stgraber@stgraber.org>
This will cause the remote client to get disconnected immediately rather
than on the next websocket message exchange.
Signed-off-by: Stéphane Graber <stgraber@stgraber.org>
Sponsored-by: https://webdock.io
Incus never had the old /1.0/containers and /1.0/virtual-machines
routes, it's therefore a waste of time for every API endpoint to do
extra request parsing and pass through the result of that operation
(which will always be instancetype.Any).
Signed-off-by: Stéphane Graber <stgraber@stgraber.org>
The last write sequence is already handled by the ws package, this is
just duplicated logic which may cause us to race with the ws package,
crashing the daemon.
Closes#1449
Signed-off-by: Stéphane Graber <stgraber@stgraber.org>
