Stéphane Graber
c5416fd23d
i18n: Update translation templates
...
Tests / System (dir, stable, ubuntu-24.04-arm, cluster) (push) Has been cancelled
Tests / System (dir, stable, ubuntu-24.04-arm, standalone_container) (push) Has been cancelled
Tests / System (dir, stable, ubuntu-24.04-arm, standalone_core) (push) Has been cancelled
Tests / System (dir, stable, ubuntu-24.04-arm, standalone_network) (push) Has been cancelled
Tests / System (dir, stable, ubuntu-24.04-arm, standalone_storage) (push) Has been cancelled
Tests / System (dir, tip, ubuntu-24.04, cluster) (push) Has been cancelled
Tests / System (dir, tip, ubuntu-24.04, standalone_container) (push) Has been cancelled
Tests / System (dir, tip, ubuntu-24.04, standalone_core) (push) Has been cancelled
Tests / System (dir, tip, ubuntu-24.04, standalone_network) (push) Has been cancelled
Tests / System (dir, tip, ubuntu-24.04, standalone_storage) (push) Has been cancelled
Tests / System (dir, tip, ubuntu-24.04-arm, cluster) (push) Has been cancelled
Tests / System (dir, tip, ubuntu-24.04-arm, standalone_container) (push) Has been cancelled
Tests / System (dir, tip, ubuntu-24.04-arm, standalone_core) (push) Has been cancelled
Tests / System (dir, tip, ubuntu-24.04-arm, standalone_network) (push) Has been cancelled
Tests / System (dir, tip, ubuntu-24.04-arm, standalone_storage) (push) Has been cancelled
Tests / System (linstor, stable, ubuntu-24.04, cluster) (push) Has been cancelled
Tests / System (linstor, stable, ubuntu-24.04, standalone_storage) (push) Has been cancelled
Tests / System (lvm, stable, ubuntu-24.04, cluster) (push) Has been cancelled
Tests / System (lvm, stable, ubuntu-24.04, standalone_storage) (push) Has been cancelled
Tests / System (random, stable, ubuntu-24.04, cluster) (push) Has been cancelled
Tests / System (random, stable, ubuntu-24.04, standalone_storage) (push) Has been cancelled
Tests / System (zfs, stable, ubuntu-24.04, cluster) (push) Has been cancelled
Tests / System (zfs, stable, ubuntu-24.04, standalone_storage) (push) Has been cancelled
Tests / Client (oldstable, macos-latest) (push) Has been cancelled
Tests / Client (oldstable, ubuntu-latest) (push) Has been cancelled
Tests / Client (oldstable, windows-latest) (push) Has been cancelled
Tests / Client (stable, macos-latest) (push) Has been cancelled
Tests / Client (stable, ubuntu-latest) (push) Has been cancelled
Tests / Client (stable, windows-latest) (push) Has been cancelled
Tests / Documentation (push) Has been cancelled
Signed-off-by: Stéphane Graber <stgraber@stgraber.org>
2026-07-31 05:12:53 -04:00
Stéphane Graber
aa33abde29
incusd/bgp: Resolve neighbor address for unnumbered peers
...
Signed-off-by: Stéphane Graber <stgraber@stgraber.org>
2026-07-31 05:12:43 -04:00
Stéphane Graber
f31136c24b
incusd/daemon: Drop else branches in project expansion
...
Signed-off-by: Stéphane Graber <stgraber@stgraber.org>
2026-07-31 05:12:41 -04:00
Lucas Desgouilles
588893bd5b
docs: Clarify the sentence about Incus owning the ZFS pool/dataset
...
Signed-off-by: Lucas Desgouilles <ldesgoui@gmail.com>
2026-07-31 05:12:40 -04:00
Stéphane Graber
7914e9990d
incus/low-level: Fix naming inconsistency
...
Signed-off-by: Stéphane Graber <stgraber@stgraber.org>
2026-07-31 05:12:32 -04:00
Stéphane Graber
37ec604a01
i18n: Update translation templates
...
Tests / System (dir, stable, ubuntu-24.04-arm, cluster) (push) Waiting to run
Tests / System (dir, stable, ubuntu-24.04-arm, standalone_container) (push) Waiting to run
Tests / System (dir, stable, ubuntu-24.04-arm, standalone_core) (push) Waiting to run
Tests / System (dir, stable, ubuntu-24.04-arm, standalone_network) (push) Waiting to run
Tests / System (dir, stable, ubuntu-24.04-arm, standalone_storage) (push) Waiting to run
Tests / System (dir, tip, ubuntu-24.04, cluster) (push) Waiting to run
Tests / System (dir, tip, ubuntu-24.04, standalone_container) (push) Waiting to run
Tests / System (dir, tip, ubuntu-24.04, standalone_core) (push) Waiting to run
Tests / System (dir, tip, ubuntu-24.04, standalone_network) (push) Waiting to run
Tests / System (dir, tip, ubuntu-24.04, standalone_storage) (push) Waiting to run
Tests / System (dir, tip, ubuntu-24.04-arm, cluster) (push) Waiting to run
Tests / System (dir, tip, ubuntu-24.04-arm, standalone_container) (push) Waiting to run
Tests / System (dir, tip, ubuntu-24.04-arm, standalone_core) (push) Waiting to run
Tests / System (dir, tip, ubuntu-24.04-arm, standalone_network) (push) Waiting to run
Tests / System (dir, tip, ubuntu-24.04-arm, standalone_storage) (push) Waiting to run
Tests / System (linstor, stable, ubuntu-24.04, cluster) (push) Waiting to run
Tests / System (linstor, stable, ubuntu-24.04, standalone_storage) (push) Waiting to run
Tests / System (lvm, stable, ubuntu-24.04, cluster) (push) Waiting to run
Tests / System (lvm, stable, ubuntu-24.04, standalone_storage) (push) Waiting to run
Tests / System (random, stable, ubuntu-24.04, cluster) (push) Waiting to run
Tests / System (random, stable, ubuntu-24.04, standalone_storage) (push) Waiting to run
Tests / System (zfs, stable, ubuntu-24.04, cluster) (push) Waiting to run
Tests / System (zfs, stable, ubuntu-24.04, standalone_storage) (push) Waiting to run
Tests / Client (oldstable, macos-latest) (push) Waiting to run
Tests / Client (oldstable, ubuntu-latest) (push) Waiting to run
Tests / Client (oldstable, windows-latest) (push) Waiting to run
Tests / Client (stable, macos-latest) (push) Waiting to run
Tests / Client (stable, ubuntu-latest) (push) Waiting to run
Tests / Client (stable, windows-latest) (push) Waiting to run
Tests / Documentation (push) Waiting to run
Signed-off-by: Stéphane Graber <stgraber@stgraber.org>
2026-07-30 19:09:12 -04:00
Stéphane Graber
712e0f0ccd
Update gomod
...
Tests / System (dir, stable, ubuntu-24.04-arm, cluster) (push) Waiting to run
Tests / System (dir, stable, ubuntu-24.04-arm, standalone_container) (push) Waiting to run
Tests / System (dir, stable, ubuntu-24.04-arm, standalone_core) (push) Waiting to run
Tests / System (dir, stable, ubuntu-24.04-arm, standalone_network) (push) Waiting to run
Tests / System (dir, stable, ubuntu-24.04-arm, standalone_storage) (push) Waiting to run
Tests / System (dir, tip, ubuntu-24.04, cluster) (push) Waiting to run
Tests / System (dir, tip, ubuntu-24.04, standalone_container) (push) Waiting to run
Tests / System (dir, tip, ubuntu-24.04, standalone_core) (push) Waiting to run
Tests / System (dir, tip, ubuntu-24.04, standalone_network) (push) Waiting to run
Tests / System (dir, tip, ubuntu-24.04, standalone_storage) (push) Waiting to run
Tests / System (dir, tip, ubuntu-24.04-arm, cluster) (push) Waiting to run
Tests / System (dir, tip, ubuntu-24.04-arm, standalone_container) (push) Waiting to run
Tests / System (dir, tip, ubuntu-24.04-arm, standalone_core) (push) Waiting to run
Tests / System (dir, tip, ubuntu-24.04-arm, standalone_network) (push) Waiting to run
Tests / System (dir, tip, ubuntu-24.04-arm, standalone_storage) (push) Waiting to run
Tests / System (linstor, stable, ubuntu-24.04, cluster) (push) Waiting to run
Tests / System (linstor, stable, ubuntu-24.04, standalone_storage) (push) Waiting to run
Tests / System (lvm, stable, ubuntu-24.04, cluster) (push) Waiting to run
Tests / System (lvm, stable, ubuntu-24.04, standalone_storage) (push) Waiting to run
Tests / System (random, stable, ubuntu-24.04, cluster) (push) Waiting to run
Tests / System (random, stable, ubuntu-24.04, standalone_storage) (push) Waiting to run
Tests / System (zfs, stable, ubuntu-24.04, cluster) (push) Waiting to run
Tests / System (zfs, stable, ubuntu-24.04, standalone_storage) (push) Waiting to run
Tests / Client (oldstable, macos-latest) (push) Waiting to run
Tests / Client (oldstable, ubuntu-latest) (push) Waiting to run
Tests / Client (oldstable, windows-latest) (push) Waiting to run
Tests / Client (stable, macos-latest) (push) Waiting to run
Tests / Client (stable, ubuntu-latest) (push) Waiting to run
Tests / Client (stable, windows-latest) (push) Waiting to run
Tests / Documentation (push) Waiting to run
Signed-off-by: Stéphane Graber <stgraber@stgraber.org>
2026-07-30 13:46:17 -04:00
Stéphane Graber
c9b03dc818
Makefile: Bump to 1.25.12
...
Signed-off-by: Stéphane Graber <stgraber@stgraber.org>
2026-07-30 13:43:55 -04:00
Benjamin Somers
148fb1f9bc
incus/low-level: Support more formats in NVRAM getter and setter
...
Signed-off-by: Benjamin Somers <benjamin.somers@imt-atlantique.fr>
2026-07-30 13:42:22 -04:00
Benjamin Somers
6c3e3051a8
incusd/instances: Add headers to raw NVRAM variable response
...
Signed-off-by: Benjamin Somers <benjamin.somers@imt-atlantique.fr>
2026-07-30 13:42:21 -04:00
Benjamin Somers
a79367b6a8
shared/uefi: Export dumpAttributes
...
Signed-off-by: Benjamin Somers <benjamin.somers@imt-atlantique.fr>
2026-07-30 13:42:20 -04:00
Benjamin Somers
1b0442fbe9
incusd/response: Allow custom headers in devIncusResponse
...
Signed-off-by: Benjamin Somers <benjamin.somers@imt-atlantique.fr>
2026-07-30 13:42:18 -04:00
Benjamin Somers
bfe338acee
client: Make GetRawInstanceNVRAMGUIDVar return attributes
...
Signed-off-by: Benjamin Somers <benjamin.somers@imt-atlantique.fr>
2026-07-30 13:42:17 -04:00
Stéphane Graber
a89084e2de
incusd/instance/qemu: Use os.Root for template output
...
Matches the LXC driver, the existing checks already prevent escaping.
Signed-off-by: Stéphane Graber <stgraber@stgraber.org>
2026-07-30 13:42:16 -04:00
Stéphane Graber
8cdc503437
incusd: Fail closed on unknown authorization project expansion
...
The project expansion used for authorization silently returned the
requested project for any object type without an explicit branch, so a
new project-scoped API missing from the switch would bypass project
confinement. Handle every object type explicitly and error out otherwise.
Signed-off-by: Stéphane Graber <stgraber@stgraber.org>
2026-07-30 13:42:14 -04:00
Stéphane Graber
1e09276c31
incusd/instance: Confine exec-output access to its directory
...
Serve, list and delete exec output files through an os.OpenRoot handle so
a symlink in the exec-output directory can't be followed outside of it.
Signed-off-by: Stéphane Graber <stgraber@stgraber.org>
2026-07-30 13:42:13 -04:00
Stéphane Graber
038fd13e82
incusd/instance: Fix NVIDIA require.cuda and require.driver handling
...
The condition was inverted, so a configured value was silently dropped
while an empty value wrote an empty environment variable. Only write the
variable when a value is set.
Signed-off-by: Stéphane Graber <stgraber@stgraber.org>
2026-07-30 13:42:12 -04:00
Stéphane Graber
f86f08bfcd
incusd: Expand network address set project for authorization
...
The project expansion used for authorization had no branch for network
address sets, so their access checks ran against the requested project
rather than the effective one, letting a restricted project act on the
default project's address sets.
This addresses GHSA-6v6x-387m-rj4w (CVE pending)
Signed-off-by: Stéphane Graber <stgraber@stgraber.org>
2026-07-30 13:42:11 -04:00
Stéphane Graber
0de0aac019
incusd/project: Enforce isolated restriction when idmap key omitted
...
restricted.containers.privilege=isolated only rejected an explicit
security.idmap.isolated=false, but the key defaults to non-isolated when
omitted. Require containers to explicitly enable isolation.
This addresses CVE-2026-62313
Signed-off-by: Stéphane Graber <stgraber@stgraber.org>
2026-07-30 13:42:09 -04:00
Stéphane Graber
57c4158712
incusd/instance: Enforce project restrictions on migration overrides
...
The migration handler applied user-supplied config, device and profile
overrides without any project restriction check, letting a restricted
project set keys like security.privileged or raw.lxc.
This addresses CVE-2026-62940
Signed-off-by: Stéphane Graber <stgraber@stgraber.org>
2026-07-30 13:42:08 -04:00
Stéphane Graber
9bc9f9ba5a
incusd/instances: Re-check restrictions after copy config merge
...
The source instance's config is merged into the request only after the
initial project restriction check, letting a cross-project copy carry
restricted keys into the target project. Re-check the merged config.
This addresses CVE-2026-62941
Signed-off-by: Stéphane Graber <stgraber@stgraber.org>
2026-07-30 13:42:07 -04:00
Stéphane Graber
0d21c84dbf
incusd/instances: Validate instance name on backup import
...
This addresses GHSA-26gp-p5fw-3r2h (CVE pending)
Signed-off-by: Stéphane Graber <stgraber@stgraber.org>
2026-07-30 13:42:06 -04:00
Stéphane Graber
c7cf33d46a
incusd/storage: Validate volume name on ISO and backup import
...
This addresses GHSA-67qw-68v3-36h6 (CVE pending)
Signed-off-by: Stéphane Graber <stgraber@stgraber.org>
2026-07-30 13:42:05 -04:00
Stéphane Graber
3d7246efe5
incusd/images: Validate image fingerprint for all protocols
...
The fingerprint validation added for CVE-2026-48769 was only applied to
the direct protocol. Validate it for all protocols and re-check after it
is taken from the remote server's response.
This addresses GHSA-p2v3-6wvc-cv3p (CVE pending)
Signed-off-by: Stéphane Graber <stgraber@stgraber.org>
2026-07-30 13:42:04 -04:00
Stéphane Graber
181ae5c746
incusd/instance/qemu: Confine template access to instance root
...
The template traversal guard from CVE-2026-48752 was only applied to the
LXC driver. Apply the same checks to the QEMU driver.
This addresses GHSA-4qxq-p5hm-3q3p (CVE pending)
Signed-off-by: Stéphane Graber <stgraber@stgraber.org>
2026-07-30 13:42:02 -04:00
Stéphane Graber
1bb869273c
incusd/instance: Confine metadata.yaml access to instance root
...
This addresses CVE-2026-63343
Signed-off-by: Stéphane Graber <stgraber@stgraber.org>
2026-07-30 13:42:01 -04:00
Stéphane Graber
7135f0183d
incusd/storage: Confine backup.yaml write to instance root
...
This addresses CVE-2026-63125
Signed-off-by: Stéphane Graber <stgraber@stgraber.org>
2026-07-30 13:42:00 -04:00
Stéphane Graber
0b0847de51
incusd/instance: Confine OCI network writes to instance root
...
Also rejects line breaks in the oci.dns.domain and oci.dns.search values
which are written to the generated resolv.conf.
This addresses GHSA-7fj9-65v4-rp7h (CVE pending)
Signed-off-by: Stéphane Graber <stgraber@stgraber.org>
2026-07-30 13:41:59 -04:00
Stéphane Graber
4f847ad5ab
internal/instance: Prevent line breaks in NVIDIA config values
...
This addresses GHSA-m3j6-p3v3-qmjv (CVE pending)
Signed-off-by: Stéphane Graber <stgraber@stgraber.org>
2026-07-30 13:41:58 -04:00
Stéphane Graber
dbc1e36173
incusd/project: Restrict volume creation options in restricted projects
...
A user in a restricted project could set block.create_options to inject
arguments into the filesystem creation command run as root. Restrict such
projects to the pool's configured default for that option.
This addresses CVE-2026-62867
Signed-off-by: Stéphane Graber <stgraber@stgraber.org>
2026-07-30 13:41:57 -04:00
Benjamin Somers
e2c7394aa3
incusd/instances: Fix capitalization
...
Signed-off-by: Benjamin Somers <benjamin.somers@imt-atlantique.fr>
2026-07-30 13:41:55 -04:00
Benjamin Somers
2bd883a645
incus/low-level: Add rebuild-nvram to the list of repair actions
...
Signed-off-by: Benjamin Somers <benjamin.somers@imt-atlantique.fr>
Signed-off-by: Stéphane Graber <stgraber@stgraber.org>
2026-07-30 13:41:52 -04:00
Benjamin Somers
ecb90151e3
api: instance_nvram (updated)
...
Signed-off-by: Benjamin Somers <benjamin.somers@imt-atlantique.fr>
Signed-off-by: Stéphane Graber <stgraber@stgraber.org>
2026-07-30 13:41:50 -04:00
Benjamin Somers
044ca6c0b1
incusd/instance: Add ResetNVRAM
...
Signed-off-by: Benjamin Somers <benjamin.somers@imt-atlantique.fr>
2026-07-30 13:41:48 -04:00
Benjamin Somers
b2d7cce92e
incusd/instances: Add NVRAM rebuild as a repair action
...
Signed-off-by: Benjamin Somers <benjamin.somers@imt-atlantique.fr>
Signed-off-by: Stéphane Graber <stgraber@stgraber.org>
2026-07-30 13:41:47 -04:00
Stéphane Graber
14f14d0bc7
incusd/db: Port instance config and device fill to generated queries
...
This also fixes devices without any config keys being missed when
loading instances.
Signed-off-by: Stéphane Graber <stgraber@stgraber.org>
Sponsored-by: https://webdock.io
2026-07-30 13:41:45 -04:00
Stéphane Graber
c43966fff6
incusd/scriptlet: Scope instance device query
...
Signed-off-by: Stéphane Graber <stgraber@stgraber.org>
Sponsored-by: https://webdock.io
2026-07-30 13:41:44 -04:00
Stéphane Graber
cf6689a086
incusd/project: Scope config queries to project resources
...
Signed-off-by: Stéphane Graber <stgraber@stgraber.org>
Sponsored-by: https://webdock.io
2026-07-30 13:41:43 -04:00
Stéphane Graber
94cdfb9cea
incusd/backup: Only load referenced profile data
...
Signed-off-by: Stéphane Graber <stgraber@stgraber.org>
Sponsored-by: https://webdock.io
2026-07-30 13:41:41 -04:00
Stéphane Graber
227d059ae4
incusd: Only load referenced profile data
...
Signed-off-by: Stéphane Graber <stgraber@stgraber.org>
Sponsored-by: https://webdock.io
2026-07-30 13:41:40 -04:00
Stéphane Graber
1301ad3e36
incusd/db/cluster: Scope profile queries in Instance.ToAPI
...
Signed-off-by: Stéphane Graber <stgraber@stgraber.org>
Sponsored-by: https://webdock.io
2026-07-30 13:41:38 -04:00
Stéphane Graber
04e2a22081
incusd/db: Only load referenced profiles when filling instances
...
Signed-off-by: Stéphane Graber <stgraber@stgraber.org>
Sponsored-by: https://webdock.io
2026-07-30 13:41:37 -04:00
Stéphane Graber
23140fd487
incusd/db/cluster: Add referenced profile query helpers
...
Signed-off-by: Stéphane Graber <stgraber@stgraber.org>
Sponsored-by: https://webdock.io
2026-07-30 13:41:35 -04:00
Stéphane Graber
5df68bc37b
incusd/db/cluster: Update generated code
...
Signed-off-by: Stéphane Graber <stgraber@stgraber.org>
Sponsored-by: https://webdock.io
2026-07-30 13:41:34 -04:00
Stéphane Graber
a09d15b6a0
incusd/db: Add ReferenceID filtering to Config and Device
...
Signed-off-by: Stéphane Graber <stgraber@stgraber.org>
Sponsored-by: https://webdock.io
2026-07-30 13:41:33 -04:00
Stéphane Graber
182f71b6f7
generate-database: Add ReferenceID filtering for reference tables
...
Signed-off-by: Stéphane Graber <stgraber@stgraber.org>
Sponsored-by: https://webdock.io
2026-07-30 13:41:32 -04:00
Stéphane Graber
ce8c607f53
incusd: Fix goroutine leak when cluster instance list times out
...
Signed-off-by: Stéphane Graber <stgraber@stgraber.org>
Sponsored-by: https://webdock.io
2026-07-30 13:41:30 -04:00
Stéphane Graber
0055c230c2
incusd/operations: Remove operation from map on DB registration failure
...
Signed-off-by: Stéphane Graber <stgraber@stgraber.org>
Sponsored-by: https://webdock.io
2026-07-30 13:41:29 -04:00
Stéphane Graber
14474d91fa
incusd/instance/qemu: Release operation lock on snapshot size failure
...
Signed-off-by: Stéphane Graber <stgraber@stgraber.org>
Sponsored-by: https://webdock.io
2026-07-30 13:41:28 -04:00
Stéphane Graber
53b7afe098
incus/storage_volume: Add bitmap subcommand
...
Signed-off-by: Stéphane Graber <stgraber@stgraber.org>
2026-07-30 13:41:15 -04:00
