Star0
5
代码
代码
Issues8
Pull Requests6
项目讨论
Wiki
分析
Star0
5
已关闭
Fix CVE-2025-65105 #30
XingSongSun创建于 6月3日关闭于 11 天前
Fix CVE-2025-65105 #30
已关闭
XingSongSun创建于 6月3日关闭于 11 天前
从XingSongSun/apptainerCVE-2025-65105合入到src-openeuler/apptaineropenEuler-24.03-LTS-SP3
共 3 个文件变更+231-2
Mapptainer.spec+8-2
@@ -42,7 +42,7 @@
42Summary: Application and environment virtualization formerly known as Singularity42Summary: Application and environment virtualization formerly known as Singularity
43Name: apptainer43Name: apptainer
44Version: 1.1.644Version: 1.1.6
45-Release: 345+Release: 4
46# See LICENSE.md for first party code (BSD-3-Clause and LBNL BSD)46# See LICENSE.md for first party code (BSD-3-Clause and LBNL BSD)
47# See LICENSE_THIRD_PARTY.md for incorporated code (ASL 2.0)47# See LICENSE_THIRD_PARTY.md for incorporated code (ASL 2.0)
48# See LICENSE_DEPENDENCIES.md for dependencies48# See LICENSE_DEPENDENCIES.md for dependencies
@@ -59,6 +59,8 @@ Patch12: 81.patch
59%endif59%endif
60Patch13: add-loong64-support-for-bbolt.patch60Patch13: add-loong64-support-for-bbolt.patch
61Patch14: openEuler-golang-1.21.4.patch61Patch14: openEuler-golang-1.21.4.patch
62+Patch15: backport-CVE-2025-65105-1.patch
63+Patch16: backport-CVE-2025-65105-2.patch
62 64
63# This Conflicts is in case someone tries to install the main apptainer65# This Conflicts is in case someone tries to install the main apptainer
64# package when an old singularity package is installed. An Obsoletes is on66# package when an old singularity package is installed. An Obsoletes is on
@@ -282,6 +284,8 @@ Provides the optional setuid-root portion of Apptainer.
282 284
283%prep285%prep
284%if "%{?squashfuse_version}" != ""286%if "%{?squashfuse_version}" != ""
287+%patch -P 15 -p1
288+%patch -P 16 -p1
285# the default directory for other steps is where the %%prep section ends289# the default directory for other steps is where the %%prep section ends
286# so do main package last290# so do main package last
287%setup -b 10 -n squashfuse-%{squashfuse_version}291%setup -b 10 -n squashfuse-%{squashfuse_version}
@@ -435,6 +439,8 @@ fi
435%attr(4755, root, root) %{_libexecdir}/%{name}/bin/starter-suid439%attr(4755, root, root) %{_libexecdir}/%{name}/bin/starter-suid
436 440
437%changelog441%changelog
442+* Tue Jun 02 2026 sunwenhan <sunwenhan@xfusion.com> - 1.1.6-4
443+- Fix CVE-2025-65105
438* Mon Dec 09 2024 zhengting <zhengting13@huawei.com> - 1.1.6-3444* Mon Dec 09 2024 zhengting <zhengting13@huawei.com> - 1.1.6-3
439- Patch golang verison fro openEuler 24.03445- Patch golang verison fro openEuler 24.03
440 446 
@@ -442,4 +448,4 @@ fi
442- add loong64 support for bbolt448- add loong64 support for bbolt
443 449 
444* Tue Feb 21 2023 Yikun<yikunkero@gmail.com> - 1.1.6-1450* Tue Feb 21 2023 Yikun<yikunkero@gmail.com> - 1.1.6-1
445-- Init package451+- Init package
Abackport-CVE-2025-65105-1.patch+67-0
@@ -0,0 +1,67 @@
1+From 4313b42717e18a4add7dd7503528bc15af905981 Mon Sep 17 00:00:00 2001
2+From: David Trudgian <david.trudgian@sylabs.io>
3+Date: Thu, 13 Nov 2025 13:35:05 +0000
4+Subject: [PATCH] fix: use pathrs-lite/procfs when writing apparmor profile
5+ 
6+When an apparmor profile is writtend into the attr/exec in procfs, we
7+must ensure we are writing into a genuine attr/exec inside a genuins
8+procfs.
9+ 
10+This is necessary to block attacks that redirect the write somewhere
11+that it is ineffective, leading to a silent failure to apply the
12+apparmor profile.
13+ 
14+Signed-off-by: Dave Dykstra <2129743+DrDaveD@users.noreply.github.com>
15+---
16+ .../security/apparmor/apparmor_supported.go | 24 +++++++++++++++++--
17+ 1 file changed, 22 insertions(+), 2 deletions(-)
18+ 
19+diff --git a/internal/pkg/security/apparmor/apparmor_supported.go b/internal/pkg/security/apparmor/apparmor_supported.go
20+index 9cb8b50484..f0c123f7a6 100644
21+--- a/internal/pkg/security/apparmor/apparmor_supported.go
22++++ b/internal/pkg/security/apparmor/apparmor_supported.go
23+@@ -2,7 +2,7 @@
24+ // Apptainer a Series of LF Projects LLC.
25+ // For website terms of use, trademark policy, privacy policy and other
26+ // project policies see https://lfprojects.org/policies
27+-// Copyright (c) 2018-2022, Sylabs Inc. All rights reserved.
28++// Copyright (c) 2018-2025, Sylabs Inc. All rights reserved.
29+ // This software is licensed under a 3-clause BSD license. Please consult the
30+ // LICENSE.md file distributed with the sources of this project regarding your
31+ // rights to use or distribute this software.
32+@@ -14,6 +14,10 @@ package apparmor
33+ import (
34+ "fmt"
35+ "os"
36++
37++ "github.com/cyphar/filepath-securejoin/pathrs-lite"
38++ "github.com/cyphar/filepath-securejoin/pathrs-lite/procfs"
39++ "golang.org/x/sys/unix"
40+ )
41+
42+ // Enabled returns whether AppArmor is enabled.
43+@@ -27,7 +31,23 @@ func Enabled() bool {
44+
45+ // LoadProfile loads the specified AppArmor profile.
46+ func LoadProfile(profile string) error {
47+- f, err := os.OpenFile("/proc/self/attr/exec", os.O_WRONLY, 0)
48++ // We must make sure we are actually opening and writing to a real attr/exec
49++ // in a real procfs so that the profile takes effect. Using
50++ // pathrs-lite/procfs as below accomplishes this.
51++ proc, err := procfs.OpenProcRoot()
52++ if err != nil {
53++ return err
54++ }
55++ defer proc.Close()
56++
57++ attrExec, closer, err := proc.OpenThreadSelf("attr/exec")
58++ if err != nil {
59++ return err
60++ }
61++ defer closer()
62++ defer attrExec.Close()
63++
64++ f, err := pathrs.Reopen(attrExec, unix.O_WRONLY|unix.O_CLOEXEC)
65+ if err != nil {
66+ return err
67+ }
Abackport-CVE-2025-65105-2.patch+156-0
@@ -0,0 +1,156 @@
1+From 82f17900a0c31bc769bf9b4612d271c7068d8bf2 Mon Sep 17 00:00:00 2001
2+From: David Trudgian <david.trudgian@sylabs.io>
3+Date: Thu, 13 Nov 2025 14:24:44 +0000
4+Subject: [PATCH] fix: fail if --security options can't be applied
5+ 
6+When a `--security` option is supplied on the command line, it is
7+reasonable to expect the limitations requested will be applied to the
8+container.
9+ 
10+Previously, when a limitation was not applied due to a subsystem (e.g.
11+SELinux) being unavailable, a warning was displayed but execution
12+continued. The warning is easily overlooked or not observed when running
13+via scripts / automation.
14+ 
15+Modify the flow so that we now exit with a fatal error when a `--security`
16+option cannot be applied.
17+ 
18+Signed-off-by: Dave Dykstra <2129743+DrDaveD@users.noreply.github.com>
19+---
20+ internal/pkg/security/security.go | 8 ++---
21+ internal/pkg/security/security_test.go | 44 ++++++++++++++------------
22+ 2 files changed, 27 insertions(+), 25 deletions(-)
23+ 
24+diff --git a/internal/pkg/security/security.go b/internal/pkg/security/security.go
25+index 19ac12f9af..08a21e2c7b 100644
26+--- a/internal/pkg/security/security.go
27++++ b/internal/pkg/security/security.go
28+@@ -2,7 +2,7 @@
29+ // Apptainer a Series of LF Projects LLC.
30+ // For website terms of use, trademark policy, privacy policy and other
31+ // project policies see https://lfprojects.org/policies
32+-// Copyright (c) 2018-2020, Sylabs Inc. All rights reserved.
33++// Copyright (c) 2018-2025, Sylabs Inc. All rights reserved.
34+ // This software is licensed under a 3-clause BSD license. Please consult the
35+ // LICENSE.md file distributed with the sources of this project regarding your
36+ // rights to use or distribute this software.
37+@@ -32,7 +32,7 @@ func Configure(config *specs.Spec) error {
38+ return err
39+ }
40+ } else {
41+- sylog.Warningf("selinux is not enabled or supported on this system")
42++ return fmt.Errorf("selinux requested, but is not enabled or supported on this system")
43+ }
44+ } else if config.Process.ApparmorProfile != "" {
45+ if apparmor.Enabled() {
46+@@ -40,7 +40,7 @@ func Configure(config *specs.Spec) error {
47+ return err
48+ }
49+ } else {
50+- sylog.Warningf("apparmor is not enabled or supported on this system")
51++ return fmt.Errorf("apparmor requested, but is not enabled or supported on this system")
52+ }
53+ }
54+ }
55+@@ -50,7 +50,7 @@ func Configure(config *specs.Spec) error {
56+ return err
57+ }
58+ } else {
59+- sylog.Warningf("seccomp requested but not enabled, seccomp library is missing or too old")
60++ return fmt.Errorf("seccomp requested but not enabled, seccomp library is missing or too old")
61+ }
62+ }
63+ return nil
64+diff --git a/internal/pkg/security/security_test.go b/internal/pkg/security/security_test.go
65+index b8d15e1843..567321afb0 100644
66+--- a/internal/pkg/security/security_test.go
67++++ b/internal/pkg/security/security_test.go
68+@@ -2,7 +2,7 @@
69+ // Apptainer a Series of LF Projects LLC.
70+ // For website terms of use, trademark policy, privacy policy and other
71+ // project policies see https://lfprojects.org/policies
72+-// Copyright (c) 2019, Sylabs Inc. All rights reserved.
73++// Copyright (c) 2019-2025, Sylabs Inc. All rights reserved.
74+ // This software is licensed under a 3-clause BSD license. Please consult the
75+ // LICENSE.md file distributed with the sources of this project regarding your
76+ // rights to use or distribute this software.
77+@@ -10,14 +10,12 @@
78+ package security
79+
80+ import (
81+- "os"
82+ "runtime"
83+ "testing"
84+
85+ "github.com/apptainer/apptainer/internal/pkg/security/apparmor"
86+ "github.com/apptainer/apptainer/internal/pkg/security/selinux"
87+ "github.com/apptainer/apptainer/internal/pkg/test"
88+- "github.com/apptainer/apptainer/internal/pkg/util/mainthread"
89+ "github.com/opencontainers/runtime-spec/specs-go"
90+ )
91+
92+@@ -93,6 +91,16 @@ func TestConfigure(t *testing.T) {
93+ },
94+ disabled: !selinux.Enabled(),
95+ },
96++ {
97++ desc: "SELinux when not available",
98++ spec: specs.Spec{
99++ Process: &specs.Process{
100++ SelinuxLabel: "unconfined_u:unconfined_r:unconfined_t:s0",
101++ },
102++ },
103++ expectFailure: true,
104++ disabled: selinux.Enabled(),
105++ },
106+ {
107+ desc: "with bad apparmor profile",
108+ spec: specs.Spec{
109+@@ -112,6 +120,15 @@ func TestConfigure(t *testing.T) {
110+ },
111+ disabled: !apparmor.Enabled(),
112+ },
113++ {
114++ desc: "apparmor when not available",
115++ spec: specs.Spec{
116++ Process: &specs.Process{
117++ ApparmorProfile: "unconfined",
118++ },
119++ },
120++ disabled: apparmor.Enabled(),
121++ },
122+ }
123+
124+ for _, s := range specs {
125+@@ -122,9 +139,9 @@ func TestConfigure(t *testing.T) {
126+
127+ var err error
128+
129+- mainthread.Execute(func() {
130+- err = Configure(&s.spec)
131+- })
132++ runtime.LockOSThread()
133++ defer runtime.UnlockOSThread()
134++ err = Configure(&s.spec)
135+
136+ if err != nil && !s.expectFailure {
137+ t.Errorf("unexpected failure %s: %s", s.desc, err)
138+@@ -134,18 +151,3 @@ func TestConfigure(t *testing.T) {
139+ })
140+ }
141+ }
142+-
143+-func init() {
144+- runtime.LockOSThread()
145+-}
146+-
147+-func TestMain(m *testing.M) {
148+- go func() {
149+- os.Exit(m.Run())
150+- }()
151+-
152+- // run functions requiring execution in main thread
153+- for f := range mainthread.FuncChannel {
154+- f()
155+- }
156+-}