Skip to content

Commit f9ecb45

Browse files
sunnylovestiramisusunnylovestiramisu
committed
Fix for CVEs
1 parent cf6f4db commit f9ecb45

File tree

4 files changed

+30
-20
lines changed

4 files changed

+30
-20
lines changed

‎Dockerfile

+17-14
Original file line numberDiff line numberDiff line change
@@ -24,7 +24,7 @@ ADD . .
2424
RUN GOARCH=$(echo $TARGETPLATFORM | cut -f2 -d '/') GCE_PD_CSI_STAGING_VERSION=$STAGINGVERSION make gce-pd-driver
2525

2626
# Start from Kubernetes Debian base.
27-
FROM k8s.gcr.io/build-image/debian-base:buster-v1.9.0 as debian
27+
FROM gke.gcr.io/debian-base:bullseye-v1.4.3-gke.0 as debian
2828
# Install necessary dependencies
2929
# google_nvme_id script depends on the following packages: nvme-cli, xxd, bash
3030
RUN clean-install util-linux e2fsprogs mount ca-certificates udev xfsprogs nvme-cli xxd bash
@@ -65,6 +65,7 @@ COPY --from=debian /usr/lib/xfsprogs/xfs* /usr/lib/xfsprogs/
6565
COPY --from=debian /usr/sbin/xfs* /usr/sbin/
6666
# Add dependencies for /lib/udev_containerized/google_nvme_id script
6767
COPY --from=debian /usr/sbin/nvme /usr/sbin/nvme
68+
COPY --from=debian /usr/share/man/man7 /usr/usr/share/man/man7
6869
COPY --from=debian /usr/bin/xxd /usr/bin/xxd
6970
COPY --from=debian /bin/bash /bin/bash
7071
COPY --from=debian /bin/date /bin/date
@@ -74,28 +75,30 @@ COPY --from=debian /bin/ln /bin/ln
7475
COPY --from=debian /bin/udevadm /bin/udevadm
7576

7677
# Copy shared libraries into distroless base.
77-
COPY --from=debian /lib/${LIB_DIR_PREFIX}-linux-gnu/libblkid.so.1 \
78+
COPY --from=debian /lib/${LIB_DIR_PREFIX}-linux-gnu/libpcre.so.3 \
79+
/lib/${LIB_DIR_PREFIX}-linux-gnu/libselinux.so.1 \
80+
/lib/${LIB_DIR_PREFIX}-linux-gnu/libtinfo.so.6 \
81+
/lib/${LIB_DIR_PREFIX}-linux-gnu/libe2p.so.2 \
7882
/lib/${LIB_DIR_PREFIX}-linux-gnu/libcom_err.so.2 \
7983
/lib/${LIB_DIR_PREFIX}-linux-gnu/libdevmapper.so.1.02.1 \
80-
/lib/${LIB_DIR_PREFIX}-linux-gnu/libe2p.so.2 \
8184
/lib/${LIB_DIR_PREFIX}-linux-gnu/libext2fs.so.2 \
8285
/lib/${LIB_DIR_PREFIX}-linux-gnu/libgcc_s.so.1 \
8386
/lib/${LIB_DIR_PREFIX}-linux-gnu/liblzma.so.5 \
84-
/lib/${LIB_DIR_PREFIX}-linux-gnu/libmount.so.1 \
85-
/lib/${LIB_DIR_PREFIX}-linux-gnu/libpcre.so.3 \
86-
/lib/${LIB_DIR_PREFIX}-linux-gnu/libreadline.so.5 \
87-
/lib/${LIB_DIR_PREFIX}-linux-gnu/libselinux.so.1 \
88-
/lib/${LIB_DIR_PREFIX}-linux-gnu/libtinfo.so.6 \
89-
/lib/${LIB_DIR_PREFIX}-linux-gnu/libudev.so.1 \
90-
/lib/${LIB_DIR_PREFIX}-linux-gnu/libuuid.so.1 \
87+
/lib/${LIB_DIR_PREFIX}-linux-gnu/libreadline.so.8 \
9188
/lib/${LIB_DIR_PREFIX}-linux-gnu/libz.so.1 /lib/${LIB_DIR_PREFIX}-linux-gnu/
9289

93-
COPY --from=debian /usr/lib/${LIB_DIR_PREFIX}-linux-gnu/libacl.so.1 \
90+
COPY --from=debian /usr/lib/${LIB_DIR_PREFIX}-linux-gnu/libblkid.so.1 \
91+
/usr/lib/${LIB_DIR_PREFIX}-linux-gnu/libinih.so.1 \
92+
/usr/lib/${LIB_DIR_PREFIX}-linux-gnu/libmount.so.1 \
93+
/usr/lib/${LIB_DIR_PREFIX}-linux-gnu/libudev.so.1 \
94+
/usr/lib/${LIB_DIR_PREFIX}-linux-gnu/libuuid.so.1 \
95+
/usr/lib/${LIB_DIR_PREFIX}-linux-gnu/libacl.so.1 \
9496
/usr/lib/${LIB_DIR_PREFIX}-linux-gnu/libattr.so.1 \
95-
/usr/lib/${LIB_DIR_PREFIX}-linux-gnu/libicudata.so.63 \
96-
/usr/lib/${LIB_DIR_PREFIX}-linux-gnu/libicui18n.so.63 \
97-
/usr/lib/${LIB_DIR_PREFIX}-linux-gnu/libicuuc.so.63 \
97+
/usr/lib/${LIB_DIR_PREFIX}-linux-gnu/libicudata.so.67 \
98+
/usr/lib/${LIB_DIR_PREFIX}-linux-gnu/libicui18n.so.67 \
99+
/usr/lib/${LIB_DIR_PREFIX}-linux-gnu/libicuuc.so.67 \
98100
/usr/lib/${LIB_DIR_PREFIX}-linux-gnu/libkmod.so.2 \
101+
/usr/lib/${LIB_DIR_PREFIX}-linux-gnu/libpcre2-8.so.0 \
99102
/usr/lib/${LIB_DIR_PREFIX}-linux-gnu/libstdc++.so.6 /usr/lib/${LIB_DIR_PREFIX}-linux-gnu/
100103

101104
# Copy NVME support required script and rules into distroless base.

‎pkg/gce-cloud-provider/compute/gce-compute.go

+6-2
Original file line numberDiff line numberDiff line change
@@ -1129,9 +1129,13 @@ func (cloud *CloudProvider) waitForSnapshotCreation(ctx context.Context, project
11291129

11301130
// kmsKeyEqual returns true if fetchedKMSKey and storageClassKMSKey refer to the same key.
11311131
// fetchedKMSKey - key returned by the server
1132-
// example: projects/{0}/locations/{1}/keyRings/{2}/cryptoKeys/{3}/cryptoKeyVersions/{4}
1132+
//
1133+
// example: projects/{0}/locations/{1}/keyRings/{2}/cryptoKeys/{3}/cryptoKeyVersions/{4}
1134+
//
11331135
// storageClassKMSKey - key as provided by the client
1134-
// example: projects/{0}/locations/{1}/keyRings/{2}/cryptoKeys/{3}
1136+
//
1137+
// example: projects/{0}/locations/{1}/keyRings/{2}/cryptoKeys/{3}
1138+
//
11351139
// cryptoKeyVersions should be disregarded if the rest of the key is identical.
11361140
func KmsKeyEqual(fetchedKMSKey, storageClassKMSKey string) bool {
11371141
return removeCryptoKeyVersion(fetchedKMSKey) == removeCryptoKeyVersion(storageClassKMSKey)

‎pkg/gce-pd-csi-driver/node_test.go

+3-1
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,9 @@ Copyright 2018 The Kubernetes Authors.
44
Licensed under the Apache License, Version 2.0 (the "License");
55
you may not use this file except in compliance with the License.
66
You may obtain a copy of the License at
7-
http://www.apache.org/licenses/LICENSE-2.0
7+
8+
http://www.apache.org/licenses/LICENSE-2.0
9+
810
Unless required by applicable law or agreed to in writing, software
911
distributed under the License is distributed on an "AS IS" BASIS,
1012
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.

‎test/k8s-integration/version.go

+4-3
Original file line numberDiff line numberDiff line change
@@ -131,9 +131,10 @@ func mustParseVersion(version string) *version {
131131
}
132132

133133
// Helper function to compare versions.
134-
// -1 -- if left < right
135-
// 0 -- if left == right
136-
// 1 -- if left > right
134+
//
135+
// -1 -- if left < right
136+
// 0 -- if left == right
137+
// 1 -- if left > right
137138
func (v *version) compare(right *version) int {
138139
for i, b := range v.version {
139140
if b > right.version[i] {

0 commit comments

Comments
 (0)