gian/incus-mirror
1
0
Fork 0
mirror of https://github.com/lxc/incus synced 2026-08-02 05:26:46 +00:00
Code Issues Actions 2 Packages Projects Releases Wiki Activity
stable-6.0
incus-mirror/internal/server
History
Stéphane Graber d0f2c86fcb
incusd/instance/lxc: Confine credentials write to credentials directory 
systemd credentials name could be abused to escape the credentials
folder and allow for arbitrary writes to the host filesystem allowing
for privilege escalation and denial of service attacks.

We now use Go's OpenRoot (openat2) to restrict all file interactions to
the "credentials" directory, avoiding such attacks.

This addresses CVE-2026-33945

Reported-by: https://7asecurity.com
Signed-off-by: Stéphane Graber <stgraber@stgraber.org>
2026-03-27 14:11:02 -04:00
..
acme internal/server/acme: Update certificate renewal call 2026-03-11 23:37:15 -04:00
apparmor incusd/apparmor/instance: Fix logs volume handling 2026-03-12 00:10:49 -04:00
auth incusd/auth/oidc: Cleanup and tighten subnet claim handling 2026-03-27 14:07:48 -04:00
backup incusd/s3: Use standard TLS config on S3 API calls 2026-03-27 14:03:58 -04:00
bgp incusd: Don't needlessly use format string functions 2025-08-11 01:13:09 -04:00
certificate incusd/certificate: Allow to retrieve a single API certificate 2026-03-11 23:59:50 -04:00
cgroup incusd: Don't needlessly use format string functions 2025-08-11 01:13:09 -04:00
cluster incusd/cluster: Add missing project handling to ConnectIfVolumeIsRemote 2026-03-11 23:39:18 -04:00
config incusd/config: Fix import shadowing 2025-08-13 20:33:20 -04:00
daemon internal/server: Move all packages from incusd 2023-09-29 23:44:30 -04:00
db incusd/db/networks: Set Project in getPartialNetworkByProjectAndName 2026-03-12 00:13:31 -04:00
device incusd/device/nic_physical: Drop support for connected key 2026-03-13 13:57:56 -04:00
dns incusd: Port to new database functions 2025-08-11 01:13:53 -04:00
dnsmasq incusd: Don't needlessly use format string functions 2025-08-11 01:13:09 -04:00
endpoints incusd/endpoints/starttls: Report correct ServerName 2026-03-12 00:13:52 -04:00
events incusd: Don't needlessly use format string functions 2025-08-11 01:13:09 -04:00
firewall internal/server/firewall: fix linter complaints - #2636 2026-03-12 00:17:26 -04:00
fsmonitor incusd/fsmonitor: Read multiple fanotify events 2026-03-11 23:58:06 -04:00
instance incusd/instance/lxc: Confine credentials write to credentials directory 2026-03-27 14:11:02 -04:00
ip incusd/ip/link: Add support for virtual function trusted property 2026-03-11 23:52:01 -04:00
lifecycle incusd/lifecycle: Fix project prefix in volume name 2026-03-11 23:11:26 -04:00
locking internal: Fix spelling errors found by codespell 2025-03-28 17:02:38 -04:00
logging incusd/logging/webhook: Initial webhook logger 2025-08-12 22:36:56 -04:00
metadata doc: Update config 2026-03-13 14:41:46 -04:00
metrics incusd/metrics: Implement incus_boot_time_seconds and incus_time_seconds 2026-03-11 23:58:33 -04:00
migration internal/server/migration: fix linter complaints - #2636 2026-03-12 00:17:53 -04:00
network incusd/network/common: Use FPrintf instead of WriteString 2026-03-12 01:38:41 -04:00
node incusd/config: Add storage logs_volume option 2026-03-12 00:10:09 -04:00
operations incusd/operations: Fix missing Unlock 2026-03-12 00:19:24 -04:00
project internal/server/project: fix linter complaints - #2636 2026-03-12 00:17:43 -04:00
refcount internal/server: Move all packages from incusd 2023-09-29 23:44:30 -04:00
request incusd/request: Strip port from event address 2024-08-06 10:02:31 -04:00
response incusd/response: Store original Host in forwardedResponse 2026-03-12 00:13:17 -04:00
scriptlet incusd/auth/scriptlet: Expose API certificate and request TLS chain to the scriptlet 2026-03-11 23:59:51 -04:00
seccomp internal/server/seccomp: fix linter complaints - #2636 2026-03-12 00:17:51 -04:00
state internal: Fix spelling errors found by codespell 2025-03-28 17:02:38 -04:00
storage incusd/storage/s3: Don't assume backup structure 2026-03-27 14:07:28 -04:00
sys internal/server/sys: fix linter complaints - #2636 2026-03-12 00:17:41 -04:00
syslog incusd: Rename reverters from revert to reverter 2025-08-10 00:17:30 -04:00
task internal/server/task: fix linter complaints - #2636 2026-03-12 00:17:55 -04:00
ucred incusd: Don't needlessly use format string functions 2025-08-11 01:13:09 -04:00
util internal/server/util: fix linter complaints - #2636 2026-03-12 00:17:45 -04:00
vsock incusd: Simplify code by using modern constructs 2025-08-11 00:08:44 -04:00
warnings incusd: Don't needlessly use format string functions 2025-08-11 01:13:09 -04:00