Function MkdirAllInRoot

internal/pathrs/mkdirall_pathrslite.go:50–72

MkdirAllInRoot attempts to make path, _ := securejoin.SecureJoin(root.Name(), unsafePath) os.MkdirAll(path, mode) os.Open(path) safer against attacks where components in the path are changed between SecureJoin returning and MkdirAll (or Open) being called. In particular, we try to detect any sy

(root *os.File, unsafePath string, mode os.FileMode)

// needed for a lot of runc callers and fixing this would require reworking a
// lot of path logic).
func MkdirAllInRoot(root *os.File, unsafePath string, mode os.FileMode) (*os.File, error) {
	unsafePath, err := hallucinateUnsafePath(root.Name(), unsafePath)
	if err != nil {
		return nil, fmt.Errorf("failed to construct hallucinated target path: %w", err)
	}

	// Check for any silly mode bits.
	if mode&^0o7777 != 0 {
		return nil, fmt.Errorf("tried to include non-mode bits in MkdirAll mode: 0o%.3o", mode)
	}
	// Linux (and thus os.MkdirAll) silently ignores the suid and sgid bits if
	// passed. While it would make sense to return an error in that case (since
	// the user has asked for a mode that won't be applied), for compatibility
	// reasons we have to ignore these bits.
	if ignoredBits := mode &^ 0o1777; ignoredBits != 0 {
		logrus.Warnf("MkdirAll called with no-op mode bits that are ignored by Linux: 0o%.3o", ignoredBits)
		mode &= 0o1777
	}

	return retryEAGAIN(func() (*os.File, error) {
		return pathrs.MkdirAllHandle(root, unsafePath, mode)
	})
}