diff --git a/.gitignore b/.gitignore index 4d97e7f..dc6af45 100644 --- a/.gitignore +++ b/.gitignore @@ -1 +1 @@ -SOURCES/runc-425e105.tar.gz +SOURCES/runc-d736ef1.tar.gz diff --git a/.runc.metadata b/.runc.metadata index 1ff52c1..6c81a25 100644 --- a/.runc.metadata +++ b/.runc.metadata @@ -1 +1 @@ -cfbe1abc984f5b0be1413475f888e39304b265ae SOURCES/runc-425e105.tar.gz +812dbd873389db38f03438166784aee998146d30 SOURCES/runc-d736ef1.tar.gz diff --git a/SOURCES/1807.patch b/SOURCES/1807.patch index dcfae56..6d415f0 100644 --- a/SOURCES/1807.patch +++ b/SOURCES/1807.patch @@ -1,4 +1,4 @@ -From e3b37893afa498ef6254cc9d94c159b12e04d0b0 Mon Sep 17 00:00:00 2001 +From 3d99c51e1b38a440804a55c9f314f62cc50b8902 Mon Sep 17 00:00:00 2001 From: Giuseppe Scrivano Date: Fri, 25 May 2018 18:04:06 +0200 Subject: [PATCH] sd-notify: do not hang when NOTIFY_SOCKET is used with create @@ -10,21 +10,20 @@ still accessible from the container. Signed-off-by: Giuseppe Scrivano --- - notify_socket.go | 113 ++++++++++++++++++++++++++++++++++------------- + notify_socket.go | 112 ++++++++++++++++++++++++++++++++++------------- signals.go | 4 +- start.go | 13 +++++- utils_linux.go | 12 ++++- - 4 files changed, 106 insertions(+), 36 deletions(-) + 4 files changed, 105 insertions(+), 36 deletions(-) diff --git a/notify_socket.go b/notify_socket.go -index b890b5b1c..286ce1ddd 100644 +index e7453c62..d961453a 100644 --- a/notify_socket.go +++ b/notify_socket.go -@@ -6,11 +6,14 @@ import ( - "bytes" +@@ -7,11 +7,13 @@ import ( "fmt" "net" -+ "os" + "os" + "path" "path/filepath" + "strconv" @@ -37,7 +36,7 @@ index b890b5b1c..286ce1ddd 100644 "github.com/urfave/cli" ) -@@ -26,12 +29,12 @@ func newNotifySocket(context *cli.Context, notifySocketHost string, id string) * +@@ -27,12 +29,12 @@ func newNotifySocket(context *cli.Context, notifySocketHost string, id string) * } root := filepath.Join(context.GlobalString("root"), id) @@ -52,7 +51,7 @@ index b890b5b1c..286ce1ddd 100644 } return notifySocket -@@ -43,13 +46,19 @@ func (s *notifySocket) Close() error { +@@ -44,13 +46,19 @@ func (s *notifySocket) Close() error { // If systemd is supporting sd_notify protocol, this function will add support // for sd_notify protocol from within the container. @@ -76,7 +75,7 @@ index b890b5b1c..286ce1ddd 100644 addr := net.UnixAddr{ Name: s.socketPath, Net: "unixgram", -@@ -64,45 +73,89 @@ func (s *notifySocket) setupSocket() error { +@@ -71,45 +79,89 @@ func (s *notifySocket) setupSocket() error { return nil } @@ -189,7 +188,7 @@ index b890b5b1c..286ce1ddd 100644 } } diff --git a/signals.go b/signals.go -index b67f65a03..dd25e094c 100644 +index b67f65a0..dd25e094 100644 --- a/signals.go +++ b/signals.go @@ -70,6 +70,7 @@ func (h *signalHandler) forward(process *libcontainer.Process, tty *tty, detach @@ -211,7 +210,7 @@ index b67f65a03..dd25e094c 100644 } } diff --git a/start.go b/start.go -index 2bb698b20..3a1769a43 100644 +index 2bb698b2..3a1769a4 100644 --- a/start.go +++ b/start.go @@ -3,6 +3,7 @@ package main @@ -242,10 +241,10 @@ index 2bb698b20..3a1769a43 100644 return errors.New("cannot start a container that has stopped") case libcontainer.Running: diff --git a/utils_linux.go b/utils_linux.go -index ce50db145..670c0fcba 100644 +index 984e6b0f..46c26246 100644 --- a/utils_linux.go +++ b/utils_linux.go -@@ -406,7 +406,9 @@ func startContainer(context *cli.Context, spec *specs.Spec, action CtAct, criuOp +@@ -408,7 +408,9 @@ func startContainer(context *cli.Context, spec *specs.Spec, action CtAct, criuOp notifySocket := newNotifySocket(context, os.Getenv("NOTIFY_SOCKET"), id) if notifySocket != nil { @@ -256,7 +255,7 @@ index ce50db145..670c0fcba 100644 } container, err := createContainer(context, id, spec) -@@ -415,10 +417,16 @@ func startContainer(context *cli.Context, spec *specs.Spec, action CtAct, criuOp +@@ -417,10 +419,16 @@ func startContainer(context *cli.Context, spec *specs.Spec, action CtAct, criuOp } if notifySocket != nil { @@ -274,3 +273,6 @@ index ce50db145..670c0fcba 100644 } // Support on-demand socket activation by passing file descriptors into the container init process. +-- +2.21.0 + diff --git a/SOURCES/99-containers.conf b/SOURCES/99-containers.conf deleted file mode 100644 index 7e2d537..0000000 --- a/SOURCES/99-containers.conf +++ /dev/null @@ -1 +0,0 @@ -fs.may_detach_mounts=1 diff --git a/SPECS/runc.spec b/SPECS/runc.spec index 95e95f3..bcfab81 100644 --- a/SPECS/runc.spec +++ b/SPECS/runc.spec @@ -11,8 +11,8 @@ %if 0%{?rhel} > 7 && ! 0%{?fedora} %define gobuild(o:) \ -go build -buildmode pie -compiler gc -tags="rpm_crashtraceback ${BUILDTAGS:-}" -ldflags "${LDFLAGS:-} -compressdwarf=false -B 0x$(head -c20 /dev/urandom|od -An -tx1|tr -d ' \\n') -extldflags '%__global_ldflags'" -a -v -x %{?**}; -%endif # distro +go build -buildmode pie -compiler gc -tags="rpm_crashtraceback no_openssl ${BUILDTAGS:-}" -ldflags "${LDFLAGS:-} -compressdwarf=false -B 0x$(head -c20 /dev/urandom|od -An -tx1|tr -d ' \\n') -extldflags '%__global_ldflags'" -a -v -x %{?**}; +%endif %global provider github %global provider_tld com @@ -21,21 +21,19 @@ go build -buildmode pie -compiler gc -tags="rpm_crashtraceback ${BUILDTAGS:-}" - # https://github.com/opencontainers/runc %global import_path %{provider}.%{provider_tld}/%{project}/%{repo} %global git0 https://%{import_path} -%global commit0 425e105d5a03fabd737a126ad93d62a9eeede87f +%global commit0 d736ef14f0288d6993a1845745d6756cfc9ddd5a %global shortcommit0 %(c=%{commit0}; echo ${c:0:7}) Name: %{repo} Version: 1.0.0 -Release: 60.rc8%{?dist} +Release: 64.rc9%{?dist} Summary: CLI for running Open Containers ExcludeArch: %{ix86} License: ASL 2.0 URL: %{git0} Source0: %{git0}/archive/%{commit0}/%{name}-%{shortcommit0}.tar.gz -Source1: 99-containers.conf Patch0: 1807.patch -# If go_compiler is not set to 1, there is no virtual provide. Use golang instead. -BuildRequires: %{?go_compiler:compiler(go-compiler)}%{!?go_compiler:golang} >= 1.6.2 +BuildRequires: golang >= 1.12.12-4 BuildRequires: git BuildRequires: go-md2man BuildRequires: libseccomp-devel @@ -61,7 +59,7 @@ popd pushd GOPATH/src/%{import_path} export GOPATH=%{gopath}:$(pwd)/GOPATH export BUILDTAGS="selinux seccomp" -%gobuild -o %{name} %{import_path} +%gobuild -o %{name} %{import_path} pushd man ./md2man-all.sh @@ -91,6 +89,24 @@ install -p -m 0644 contrib/completions/bash/%{name} %{buildroot}%{_datadir}/bash %{_datadir}/bash-completion/completions/%{name} %changelog +* Wed Dec 11 2019 Jindrich Novy - 1.0.0-64.rc9 +- use no_openssl in BUILDTAGS (no vendored crypto in runc) +- Related: RHELPLAN-25139 + +* Mon Dec 09 2019 Jindrich Novy - 1.0.0-63.rc9 +- be sure to use golang >= 1.12.12-4 +- Related: RHELPLAN-25139 + +* Thu Nov 28 2019 Jindrich Novy - 1.0.0-62.rc9 +- rebuild because of CVE-2019-9512 and CVE-2019-9514 +- Resolves: #1766331, #1766303 + +* Thu Nov 21 2019 Jindrich Novy - 1.0.0-61.rc9 +- update to runc 1.0.0-rc9 release +- amend golang deps +- fixes CVE-2019-16884 +- Resolves: #1759651 + * Mon Jun 17 2019 Lokesh Mandvekar - 1.0.0-60.rc8 - Resolves: #1721247 - enable fips mode