MCorange/wings
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Add AllowedMounts configuration option, block any custom mounts if they are not in the AllowedMounts list

Browse Source
This commit is contained in:
Matthew Penner 2020-07-04 15:32:53 -06:00
parent 63e7bde39c
commit 3a6050446f
2 changed files with 23 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
config/config.go
View File

@ -80,6 +80,9 @@ type Configuration struct {
// The location where the panel is running that this daemon should connect to // The location where the panel is running that this daemon should connect to
// to collect data and send events. // to collect data and send events.
PanelLocation string `json:"remote" yaml:"remote"` PanelLocation string `json:"remote" yaml:"remote"`
// AllowedMounts .
AllowedMounts []string `json:"allowed_mounts" yaml:"allowed_mounts"`
} }
// Defines the configuration of the internal SFTP server. // Defines the configuration of the internal SFTP server.

16
server/environment_docker.go
View File

@ -122,7 +122,7 @@ func (d *DockerEnvironment) InSituUpdate() error {
return errors.WithStack(err) return errors.WithStack(err)
} }
ctx, _ := context.WithTimeout(context.Background(), time.Second * 10) ctx, _ := context.WithTimeout(context.Background(), time.Second*10)
u := container.UpdateConfig{ u := container.UpdateConfig{
Resources: d.getResourcesForServer(), Resources: d.getResourcesForServer(),
} }
@ -254,7 +254,7 @@ func (d *DockerEnvironment) Start() error {
return errors.WithStack(err) return errors.WithStack(err)
} }
ctx, _ := context.WithTimeout(context.Background(), time.Second * 10) ctx, _ := context.WithTimeout(context.Background(), time.Second*10)
if err := d.Client.ContainerStart(ctx, d.Server.Uuid, types.ContainerStartOptions{}); err != nil { if err := d.Client.ContainerStart(ctx, d.Server.Uuid, types.ContainerStartOptions{}); err != nil {
return errors.WithStack(err) return errors.WithStack(err)
} }
@ -671,6 +671,17 @@ func (d *DockerEnvironment) Create() error {
} }
for _, m := range d.Server.Mounts { for _, m := range d.Server.Mounts {
for _, allowed := range config.Get().AllowedMounts {
if !strings.HasPrefix(m.Source, allowed) {
continue
}
log.WithFields(log.Fields{
"server": d.Server.Uuid,
"source": m.Source,
"target": m.Target,
"read_only": m.ReadOnly,
}).Debug("attaching mount to server's container")
mounts = append(mounts, mount.Mount{ mounts = append(mounts, mount.Mount{
Type: mount.TypeBind, Type: mount.TypeBind,
@ -679,6 +690,7 @@ func (d *DockerEnvironment) Create() error {
ReadOnly: m.ReadOnly, ReadOnly: m.ReadOnly,
}) })
} }
}
hostConf := &container.HostConfig{ hostConf := &container.HostConfig{
PortBindings: d.portBindings(), PortBindings: d.portBindings(),