feat: relax extensions file structure validation

* allow empty directories (I see no harm in having them) * allow symlinks See also siderolabs/extensions#20 Signed-off-by: Andrey Smirnov <[email protected]>
siderolabs · Mar 17, 2022 · cd4d4c6 · cd4d4c6
1 parent 50594ab
commit cd4d4c6
Show file tree

Hide file tree

Showing 5 changed files with 2 additions and 35 deletions.
diff --git a/internal/pkg/extensions/extensions_test.go b/internal/pkg/extensions/extensions_test.go
@@ -76,10 +76,6 @@ func TestValidateFailures(t *testing.T) {
 			name:      "norootfs",
 			loadError: "extension rootfs is missing",
 		},
-		{
-			name:          "symlinks",
-			validateError: "symlinks are not allowed: \"/usr/local/b\"",
-		},
 		{
 			name:          "badpaths",
 			validateError: "path \"/boot/vmlinuz\" is not allowed in extensions",

diff --git a/internal/pkg/extensions/testdata/bad/symlinks/manifest.yaml b/internal/pkg/extensions/testdata/bad/symlinks/manifest.yaml
diff --git a/internal/pkg/extensions/testdata/bad/symlinks/rootfs/usr/local/b b/internal/pkg/extensions/testdata/bad/symlinks/rootfs/usr/local/b
diff --git a/internal/pkg/extensions/testdata/good/extension1/rootfs/usr/local/lib/a.so.1 b/internal/pkg/extensions/testdata/good/extension1/rootfs/usr/local/lib/a.so.1
@@ -0,0 +1 @@
+a.so
diff --git a/internal/pkg/extensions/validate.go b/internal/pkg/extensions/validate.go
@@ -70,11 +70,6 @@ func (ext *Extension) validateContents() error {
 			return fmt.Errorf("world-writeable files are not allowed: %q", itemPath)
 		}
 
-		// no symlinks
-		if d.Type().Type() == os.ModeSymlink {
-			return fmt.Errorf("symlinks are not allowed: %q", itemPath)
-		}
-
 		var st fs.FileInfo
 
 		st, err = d.Info()
@@ -88,24 +83,10 @@ func (ext *Extension) validateContents() error {
 		}
 
 		// no special files
-		if !d.IsDir() && !d.Type().IsRegular() {
+		if !d.IsDir() && !d.Type().IsRegular() && d.Type().Type() != os.ModeSymlink {
 			return fmt.Errorf("special files are not allowed: %q", itemPath)
 		}
 
-		// directories should be non-empty
-		if d.IsDir() {
-			var contents []fs.DirEntry
-
-			contents, err = os.ReadDir(path)
-			if err != nil {
-				return err
-			}
-
-			if len(contents) == 0 {
-				return fmt.Errorf("empty directories are not allowed: %q", itemPath)
-			}
-		}
-
 		// regular file: check for file path being whitelisted
 		if !d.IsDir() {
 			dirPath := filepath.Dir(itemPath)