Cache mounts (--mount type=cache,id=...) in Buildah and podman build do not properly validate that user-specified paths for the cache are within our cache directory, allowing a RUN instruction in a Containerfile to mount an arbitrary directory from the host (read/write) into the container as long as those files can be accessed by the user running Buildah. This codepath automatically performs an SELinux relabel on the directory in question to ensure the build has access to it, so SELinux does not stop this.

#1podman build ..." follows symlinks when reading .containerignore and .dockerignore We've received this potential security issue with Podman, and although not said, it's really in Buildah. I've asked one of our engineers (Aditya) to fix it upstream, but I think it might be wise to backport to Podman 4.1.1 as noted in the issue.

Please adivise next steps and setup any CVE's or BZ's as appropriate. more information in SNow -> https://redhat.service-now.com/surl.do?n=INC2395282