{"action":"created","issue":{"url":"https://api.github.com/repos/docker/docker/issues/14885","labels_url":"https://api.github.com/repos/docker/docker/issues/14885/labels{/name}","comments_url":"https://api.github.com/repos/docker/docker/issues/14885/comments","events_url":"https://api.github.com/repos/docker/docker/issues/14885/events","html_url":"https://github.com/docker/docker/pull/14885","id":96700517,"number":14885,"title":"Fix copying of symlinks in containers","user":{"login":"jlhawn","id":1441929,"avatar_url":"https://avatars.githubusercontent.com/u/1441929?v=3","gravatar_id":"","url":"https://api.github.com/users/jlhawn","html_url":"https://github.com/jlhawn","followers_url":"https://api.github.com/users/jlhawn/followers","following_url":"https://api.github.com/users/jlhawn/following{/other_user}","gists_url":"https://api.github.com/users/jlhawn/gists{/gist_id}","starred_url":"https://api.github.com/users/jlhawn/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jlhawn/subscriptions","organizations_url":"https://api.github.com/users/jlhawn/orgs","repos_url":"https://api.github.com/users/jlhawn/repos","events_url":"https://api.github.com/users/jlhawn/events{/privacy}","received_events_url":"https://api.github.com/users/jlhawn/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/docker/docker/labels/status/0-triage","name":"status/0-triage","color":"EEEEEE"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":5,"created_at":"2015-07-23T00:54:38Z","updated_at":"2015-07-23T07:56:18Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/docker/docker/pulls/14885","html_url":"https://github.com/docker/docker/pull/14885","diff_url":"https://github.com/docker/docker/pull/14885.diff","patch_url":"https://github.com/docker/docker/pull/14885.patch"},"body":"Copying a symlink should do just that: copy the symlink NOT copy the target of the symlink. Also, the resulting file from the copy should have the name of the symlink NOT the name of the target file.\r\n\r\nThis patch includes a fix to *StatPath*, *ArchivePath*, and *ExtractToDir* methods on containers. These operations *should* resolve symlinks that are in the path but if the resource itself is a symlink then it *should not* be resolved. This patch puts this logic into a common function `resolvePath` which resolves symlinks of the path's dir in scope of the container rootfs but does not resolve the final element of the path. Now archive, extract, and stat operations will return symlinks if the path is indeed a symlink."},"comment":{"url":"https://api.github.com/repos/docker/docker/issues/comments/124010662","html_url":"https://github.com/docker/docker/pull/14885#issuecomment-124010662","issue_url":"https://api.github.com/repos/docker/docker/issues/14885","id":124010662,"user":{"login":"thaJeztah","id":1804568,"avatar_url":"https://avatars.githubusercontent.com/u/1804568?v=3","gravatar_id":"","url":"https://api.github.com/users/thaJeztah","html_url":"https://github.com/thaJeztah","followers_url":"https://api.github.com/users/thaJeztah/followers","following_url":"https://api.github.com/users/thaJeztah/following{/other_user}","gists_url":"https://api.github.com/users/thaJeztah/gists{/gist_id}","starred_url":"https://api.github.com/users/thaJeztah/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/thaJeztah/subscriptions","organizations_url":"https://api.github.com/users/thaJeztah/orgs","repos_url":"https://api.github.com/users/thaJeztah/repos","events_url":"https://api.github.com/users/thaJeztah/events{/privacy}","received_events_url":"https://api.github.com/users/thaJeztah/received_events","type":"User","site_admin":false},"created_at":"2015-07-23T07:56:18Z","updated_at":"2015-07-23T07:56:18Z","body":"Because none of us is a security expert, I'd prefer to have the security team to have a look,\r\nboth at this change and the issue it should resolve (reported here https://github.com/docker/docker/pull/13171#issuecomment-123805210 and discussed on IRC, starting here: https://botbot.me/freenode/docker-dev/2015-07-22/?msg=45272608&page=6).\r\nBetter safe than sorry, now that we are still able to check before the 1.8 release.\r\n\r\nping @ewindisch @diogomonica @NathanMcCauley \r\n\r\n(just my 0.02, apologies if I crossed my boundaries here)"}}