slim now works with any Containerfile by injecting distro-agnostic scripts
at build time:
- /slim/init: mounts special filesystems, configures networking (static
QEMU slirp), sets up cgroup2, timezone, and rootless container prereqs.
Parses slim.cmd=<base64> from the kernel cmdline for runtime overrides,
otherwise execs /slim/exec.
- /slim/exec: generated from the image's CMD/ENTRYPOINT (via podman image
inspect), overridable via --cmd at build and run time.
Changes:
- New src/inject.rs: inspect image config, infer command, generate
/slim/exec script, inject /slim/ into mounted rootfs
- New src/scripts/slim-init.sh: the universal init script (include_str!)
- build.rs: rename --init to --cmd, inject scripts before packing,
drop Meta::save, restructure to ensure unmount always runs
- qemu.rs: hardcode init=/slim/init, add --cmd (base64 on cmdline),
drop Meta::load, add -no-reboot
- Remove src/meta.rs and meta.toml (no longer needed)
- Cargo.toml: add serde_json + base64, remove unused walkdir + cpio + toml
- Example Containerfiles simplified to plain FROM + CMD
- New example/test.sh for manual verification
- README updated for new workflow
The user-supplied image/name argument was interpolated unsanitized into
registry/{name}/initrd, so a name containing '../' (e.g. 'slim run
../../.ssh/authorized_keys') escaped the XDG data dir and let slim
create directories and read/write files at attacker-chosen locations.
validate_image_name now rejects empty names, '.', '..' and anything
outside [A-Za-z0-9._:-] at the registry_dir chokepoint used by both
build and run, plus a defense-in-depth containment check that the
resolved path stays under the registry root.
Fixes sec-2 from the code review.
- build: the rootless overlay mount only exists inside podman unshare's
user namespace; run the vmlinuz check/copy and the find|cpio pipeline
there, streaming cpio's stdout to the parent for gzipping (also drops
the initrd.tmp round-trip and excludes vmlinuz from the archive)
- build: unmount the image on all code paths, not just success
- run: treat timeout's exit 124 as the expected smoke-test timeout and
error on any other non-zero status (a missing qemu binary no longer
reports success)
Fixes bug-1, bug-2, bug-3 from the code review.
hulthe
marvin