-
Notifications
You must be signed in to change notification settings - Fork 784
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
add path sandboxing to file
function
#1249
Conversation
If a sandbox path is provided in the configuration, the `file` function will prefix the path parameter and prevent relative paths from falling outside the sandbox.
|
||
// BlacklistedFunctions is a set of functions to be disabled | ||
// when executing the template | ||
BlacklistedFunctions []string |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
👍
So I think this basically looks fine. Tests, documentation, etc. Related to the sym-links. It would be pretty trivial to just add a filepath.EvalSymlinks call just before the filepath.Rel call to eliminate sym-linking outside of the box. |
Ok, cool. I'll add that as a belt-and-suspenders for Nomad's own isolation (which we wouldn't enjoy for the |
@eikenb I've added the symlink walking check, which required a small rework of how the tests were being run to include real files on the file system under |
LGTM |
pulls in configuration option for blacklisting template functions from: hashicorp/consul-template#1243 hashicorp/consul-template#1246 pulls in configuration option for file sandboxing from: hashicorp/consul-template#1249
pulls in configuration option for blacklisting template functions from: hashicorp/consul-template#1243 hashicorp/consul-template#1246 pulls in configuration option for file sandboxing from: hashicorp/consul-template#1249
pulls in configuration option for blacklisting template functions from: hashicorp/consul-template#1243 hashicorp/consul-template#1246 pulls in configuration option for file sandboxing from: hashicorp/consul-template#1249
pulls in configuration option for blacklisting template functions from: hashicorp/consul-template#1243 hashicorp/consul-template#1246 pulls in configuration option for file sandboxing from: hashicorp/consul-template#1249 hashicorp/consul-template#1254 [wip consul-template]
pulls in configuration option for blacklisting template functions from: hashicorp/consul-template#1243 hashicorp/consul-template#1246 pulls in configuration option for file sandboxing from: hashicorp/consul-template#1249 hashicorp/consul-template#1254
pulls in configuration option for blacklisting template functions from: hashicorp/consul-template#1243 hashicorp/consul-template#1246 pulls in configuration option for file sandboxing from: hashicorp/consul-template#1249 hashicorp/consul-template#1254
pulls in configuration option for blacklisting template functions from: hashicorp/consul-template#1243 hashicorp/consul-template#1246 pulls in configuration option for file sandboxing from: hashicorp/consul-template#1249 hashicorp/consul-template#1254 pulls in vault KVv2 read fixes from: hashicorp/consul-template#1253
pulls in configuration option for blacklisting template functions from: hashicorp/consul-template#1243 hashicorp/consul-template#1246 pulls in configuration option for file sandboxing from: hashicorp/consul-template#1249 hashicorp/consul-template#1254 pulls in vault KVv2 read fixes from: hashicorp/consul-template#1253
pulls in configuration option for blacklisting template functions from: hashicorp/consul-template#1243 hashicorp/consul-template#1246 pulls in configuration option for file sandboxing from: hashicorp/consul-template#1249 hashicorp/consul-template#1254 pulls in vault KVv2 read fixes from: hashicorp/consul-template#1253
pulls in configuration option for blacklisting template functions from: hashicorp/consul-template#1243 hashicorp/consul-template#1246 pulls in configuration option for file sandboxing from: hashicorp/consul-template#1249 hashicorp/consul-template#1254 pulls in vault KVv2 read fixes from: hashicorp/consul-template#1253
If a sandbox path is provided in the configuration, the
file
function will prefix the path parameter and prevent relative paths from falling outside the sandbox.@eikenb I've already vendored this into hashicorp/nomad#6075 for discussion there, but for now this is a draft so that we can chat about the implementation and what you think about the config UX.
Example of use:
ct-demo.hcl
ct-demo.conf
Results:
Removing the
sandbox_path
field has the expected result: dumping the contents of that file to the terminal.