Initialize nss libraries in Glibc so that the dynamic libraries are loaded in the host

justincormack · Tibor Vass · commit a316b10dab79 · 2019-07-26T01:27:57.000Z
environment not in the chroot from untrusted files. See also OpenVZ https://github.com/kolyshkin/vzctl/blob/a3f732ef751998913fcf0a11b3e05236b51fd7e9/src/enter.c#L227-L234 Signed-off-by: Justin Cormack <justin.cormack@docker.com> (cherry picked from commit cea6dca993c2b4cfa99b1e7a19ca134c8ebc236b) Signed-off-by: Tibor Vass <tibor@docker.com>
diff --git a/pkg/chrootarchive/archive.go b/pkg/chrootarchive/archive.go
@@ -4,13 +4,22 @@ import (
 	"fmt"
 	"io"
 	"io/ioutil"
+	"net"
 	"os"
+	"os/user"
 	"path/filepath"
 
 	"github.com/docker/docker/pkg/archive"
 	"github.com/docker/docker/pkg/idtools"
 )
 
+func init() {
+	// initialize nss libraries in Glibc so that the dynamic libraries are loaded in the host
+	// environment not in the chroot from untrusted files.
+	_, _ = user.Lookup("docker")
+	_, _ = net.LookupHost("localhost")
+}
+
 // NewArchiver returns a new Archiver which uses chrootarchive.Untar
 func NewArchiver(idMapping *idtools.IdentityMapping) *archive.Archiver {
 	if idMapping == nil {
