fix: harden ephemeral mount option handling for inline volumes. by kapilupadhayay · Pull Request #2460 · kubernetes-sigs/blob-csi-driver

kapilupadhayay · 2026-05-14T07:29:09Z

Harden ephemeral mount option handling for inline volumes.

What type of PR is this?
/kind bug

What this PR does / why we need it:
Blocks the users to specify --tmp-path on ephemeral volumes
Which issue(s) this PR fixes:

Fixes #

Requirements:

uses conventional commit messages
includes documentation
adds unit tests
tested upgrade from previous version

Special notes for your reviewer:

Release note:

none

Inline ephemeral CSI volumes allow Pod authors to supply arbitrary blobfuse2 CLI options via volumeAttributes.mountOptions. Because blobfuse2 runs as root, a malicious --tmp-path value (e.g. /etc/kubernetes/manifests) causes root-owned blob cache writes to land on sensitive host paths, enabling static Pod injection and host-level RCE. Block --tmp-path and --config-file from user-supplied mount options for ephemeral volumes only. --config-file is blocked as a bypass vector: it can contain file_cache.path which is equivalent to --tmp-path. Regular PVC mount options (from StorageClass/PV, admin-controlled) are unaffected.

k8s-ci-robot · 2026-05-14T07:29:16Z

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: kapilupadhayay
Once this PR has been reviewed and has the lgtm label, please assign feiskyer for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

linux-foundation-easycla · 2026-05-14T07:29:16Z

The committers listed above are authorized under a signed CLA.

✅ login: kapilupadhayay / name: Kapil Upadhayay (8c7c5ba)

k8s-ci-robot · 2026-05-14T07:29:18Z

Welcome @kapilupadhayay!

It looks like this is your first PR to kubernetes-sigs/blob-csi-driver 🎉. Please refer to our pull request process documentation to help your PR have a smooth ride to approval.

You will be prompted by a bot to use commands during the review process. Do not be afraid to follow the prompts! It is okay to experiment. Here is the bot commands documentation.

You can also check if kubernetes-sigs/blob-csi-driver has its own contribution guidelines.

You may want to refer to our testing guide if you run into trouble with your tests not passing.

If you are having difficulty getting your pull request seen, please follow the recommended escalation practices. Also, for tips and tricks in the contribution process you may want to read the Kubernetes contributor cheat sheet. We want to make sure your contribution gets all the attention it needs!

Thank you, and welcome to Kubernetes. 😃

k8s-ci-robot · 2026-05-14T07:29:19Z

Hi @kapilupadhayay. Thanks for your PR.

I'm waiting for a kubernetes-sigs member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work.

Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

andyzhangx

can you sign the easycla first? (select individual contributor option)

andyzhangx · 2026-05-14T07:55:48Z

/ok-to-test

Copilot

Pull request overview

Hardens inline ephemeral CSI volume mounts by stripping security-sensitive blobfuse2 options (--tmp-path and --config-file) supplied via volumeAttributes.mountOptions, preventing root-owned cache writes to attacker-chosen host paths (e.g. /etc/kubernetes/manifests) that could enable static Pod injection and host RCE. PVC/StorageClass-supplied options (admin-controlled) are not affected.

Changes:

Adds sanitizeMountOptions and a blockedEphemeralMountOptions denylist in pkg/blob/blob.go.
Calls the sanitizer in NodeStageVolume before joining ephemeral mount options.
Adds TestSanitizeMountOptions covering pass-through, blocking, and whitespace cases.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.

File	Description
pkg/blob/blob.go	Introduces denylist and prefix-based sanitization for ephemeral mount options.
pkg/blob/nodeserver.go	Sanitizes ephemeral mount options before merging with mountFlags.
pkg/blob/blob_test.go	Unit tests for the new sanitizer covering allowed/blocked/whitespace cases.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

--block-cache-path is the block-cache mode equivalent of --tmp-path: blobfuse2 persists downloaded blocks (attacker-controlled blob content) to this directory as root. An ephemeral volume specifying --block-cache-path=/etc/kubernetes/manifests reproduces the same static-Pod-injection / host RCE primitive as the original --tmp-path exploit. Also extend the --config-file comment to cover block_cache.path as an additional config-file bypass path, and add a dedicated test case for the new blocked option. Addresses review comment.

Copilot

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated no new comments.

landreasyan · 2026-05-14T15:48:37Z

-		mountOptions = util.JoinMountOptions(mountOptions, strings.Split(ephemeralVolMountOptions, ","))
+		// Sanitize user-supplied mount options before use: strip options that are
+		// security-sensitive (e.g. --tmp-path) and must be driver-controlled.
+		sanitized := sanitizeMountOptions(strings.Split(ephemeralVolMountOptions, ","))


Should it silently sanitize and mount or should it throw an error saying that it can't mount with provided options?

I think I would prefer this failing with InvaidArgument error as the user isn't getting the requested behavior.

Yes, its better to fail with InvalidArg.

landreasyan · 2026-05-14T15:58:41Z

+		blocked := false
+		for _, blockedPrefix := range blockedEphemeralMountOptions {
+			if strings.HasPrefix(strings.TrimSpace(opt), blockedPrefix) {
+				klog.Warningf("mount option %q is not allowed for ephemeral volumes and will be ignored", opt)


is there a --temp-path*" mount that is ok? Any mount option starting with temp-path` will be blocked in this code path.

what about the short form of these mount options?

Made the check exact. None of the options have shorter forms.

landreasyan · 2026-05-14T17:00:28Z

Instead of keeping a deny-list of mounts, should we have a list of allowed mount options?

NedAnd1 · 2026-05-14T17:43:50Z

Instead of keeping a deny-list of mounts, should we have a list of allowed mount options?

Agreed, an allow list of safe mount options would improve security,
esp. since we're passing these options to a component that can add new ones at any time.

kapilupadhayay · 2026-05-15T12:13:31Z

Instead of keeping a deny-list of mounts, should we have a list of allowed mount options?

I believe deny list is still better. It won't be a breaking change and new options when added in the future need not be maintained in the list.

andyzhangx · 2026-05-16T01:00:26Z

@kapilupadhayay pls also add log-file-path parameter into the deny list, thx

k8s-ci-robot added the kind/bug Categorizes issue or PR as related to a bug. label May 14, 2026

k8s-ci-robot requested review from andyzhangx and cvvz May 14, 2026 07:29

k8s-ci-robot added the cncf-cla: no Indicates the PR's author has not signed the CNCF CLA. label May 14, 2026

andyzhangx reviewed May 14, 2026

View reviewed changes

Comment thread pkg/blob/blob.go Outdated

andyzhangx requested a review from Copilot May 14, 2026 07:55

k8s-ci-robot added ok-to-test Indicates a non-member PR verified by an org member that is safe to test. and removed needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. labels May 14, 2026

Copilot AI reviewed May 14, 2026

View reviewed changes

Comment thread pkg/blob/blob.go

k8s-ci-robot added size/L Denotes a PR that changes 100-499 lines, ignoring generated files. and removed size/M Denotes a PR that changes 30-99 lines, ignoring generated files. labels May 14, 2026

andyzhangx requested a review from Copilot May 14, 2026 08:42

Copilot started reviewing on behalf of andyzhangx May 14, 2026 08:43 View session

Copilot AI reviewed May 14, 2026

View reviewed changes

landreasyan reviewed May 14, 2026

View reviewed changes

Comment thread pkg/blob/blob.go

landreasyan changed the title ~~fix: block dangerous mount options for ephemeral CSI volumes~~ fix: harden ephemeral mount option handling for inline volumes. May 14, 2026

Conversation

kapilupadhayay commented May 14, 2026 • edited by landreasyan Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

k8s-ci-robot commented May 14, 2026

Uh oh!

linux-foundation-easycla Bot commented May 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

k8s-ci-robot commented May 14, 2026

Uh oh!

k8s-ci-robot commented May 14, 2026

Uh oh!

andyzhangx left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

andyzhangx commented May 14, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

landreasyan May 14, 2026

Choose a reason for hiding this comment

Uh oh!

landreasyan May 14, 2026

Choose a reason for hiding this comment

Uh oh!

kapilupadhayay May 15, 2026

Choose a reason for hiding this comment

Uh oh!

landreasyan May 14, 2026

Choose a reason for hiding this comment

Uh oh!

landreasyan May 14, 2026

Choose a reason for hiding this comment

Uh oh!

kapilupadhayay May 15, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

landreasyan commented May 14, 2026

Uh oh!

NedAnd1 commented May 14, 2026

Uh oh!

kapilupadhayay commented May 15, 2026

Uh oh!

andyzhangx commented May 16, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

kapilupadhayay commented May 14, 2026 •

edited by landreasyan

Loading

linux-foundation-easycla Bot commented May 14, 2026 •

edited

Loading