Traverse symlinks about imgpkg HOT 6 CLOSED

Hi @benmoss,

imgpkg intentionally skips symlinks to ensure better security. I found the commit that reflects this decision, if you would like to take a look.

from imgpkg.

Fair enough, it's definitely possible for me to produce a directory with manifests that aren't symlinked, but not sure how this makes things more secure

from imgpkg.

Fair enough, it's definitely possible for me to produce a directory with manifests that aren't symlinked, but not sure how this makes things more secure

If you have a symlink that points back to the root of your disk, imgpkg would be walking all the files and folders of your disk, which can become a security risk.

One option you have is to use multiple -f flags and example:

❯ tree
.
├── assets
│   └── CarvelLogo.png
├── deployment
│   ├── config
│   │   ├── app.yml
│   │   ├── crds.yml
│   │   ├── helpers.star
│   │   ├── projects.yml
│   │   └── schema.yml
│   ├── prepare-env.sh
│   └── vendir.yml
├── tmp
│   ├── config
│   │   ├── images.yml

If you want to add multiple folders you could try to do

imgpkg push -b localhost:5000/test -f tmp -f assets -f deployment
dir: .
dir: .imgpkg
file: .imgpkg/images.yml
file: images.yml
file: images1.yml
dir: .
file: CarvelLogo.png
dir: .
dir: config
file: config/app.yml
file: config/crds.yml
file: config/helpers.star
file: config/projects.yml
file: config/schema.yml
file: prepare-env.sh
file: vendir.yml
Pushed 'localhost:5000/test@sha256:cebd982a00e726ac8eab35ade31c04e5c9f2c6226ac3285fd912f6471c83d764'
Succeeded

The only caveat here is that all the folder contents would be placed at the root of the bundle. Do you think this could help in your use case?

from imgpkg.

Yeah, in my case I was using symlinks to try to simplify the number of directories I would have to enumerate from vendored dependencies. I wanted to get my project to just be able to do to

imgpkg push -b localhost:5000/test -f config

config/foo -> ../vendor/dep1/foo
config/bar -> ../vendor/dep2/bar

vendor/dep1/foo <-- want this
vendor/dep1/bar <-- dont want this
vendor/dep2/bar <-- want this

I think maybe vendir can make this possible without symlinks.

from imgpkg.

You could also do
imgpkg push -b localhost:5000/test -f config -f vendor/dep1/foo -f vendor/dep2/bar

the only caveat would be that foo and bar would be present in the bundle at the root level.

from imgpkg.

For now, we are going to close this issue as a no-fix. Feel free to reopen this issue if you find other use cases that we should consider.
The major concern for us is always the security hazard that is associated with follow these symlinks to other parts of the disk (ex: /etc/passwd or other files).

from imgpkg.