dotcloud/docker — pull request #5674 by cyphar (2014-05-08 11:03:20+00:00)
Title: Properly handle copying of absolute symlinks

This PR is a fix for #5619.

Before this patch, a symbolic link pointing to an absolute path (such as
/etc/passwd, etc) would be copied from the *host* system, leading to
information disclosure. Since the docker daemon runs as root, this
symlink bug could cause essentially *any* file to be copied from the
host system (and the file mode was changed to be owned by the user which
copied the file). This vulnerability was caused by the container.Copy
method not properly accounting for absolute paths in symlinks.

This patch fixes the above vulnerability by ensuring that, when copying
files, if the file is a symlink, the symlink is repeatedly resolved
(and converted into a relative path) until the final target is found,
when regular copying will continue. This both fixes the original
vulnerability, and fixes other potential vulnerabilities (such as
chaining of symlinks to try to attempt the above vulnerability).

N.B. This patch means that the output filename when copying symlinks is
now the final target, not the link name.

Docker-DCO-1.1-Signed-off-by: Aleksa Sarai (github: cyphar)