- Update to runc v1.0.3. Upstream changelog is available from
https://github.com/opencontainers/runc/releases/tag/v1.0.3. CVE-2021-43784
* A potential vulnerability was discovered in runc (related to an internal
usage of netlink), however upon further investigation we discovered that
while this bug was exploitable on the master branch of runc, no released
version of runc could be exploited using this bug. The exploit required
being able to create a netlink attribute with a length that would overflow a
uint16 but this was not possible in any released version of runc. For more
information see GHSA-v95c-p5hm-xq8f and CVE-2021-43784.
Due to an abundance of caution we decided to do an emergency release with
this fix, but to reiterate we do not believe this vulnerability was
possible to exploit. Thanks to Felix Wilhelm from Google Project Zero for
discovering and reporting this vulnerability so quickly.
* Fixed inability to start a container with read-write bind mount of a
read-only fuse host mount.
* Fixed inability to start when read-only /dev in set in spec.
* Fixed not removing sub-cgroups upon container delete, when rootless cgroup
v2 is used with older systemd.
* Fixed returning error from GetStats when hugetlb is unsupported (which
causes excessive logging for kubernetes).
OBS-URL: https://build.opensuse.org/request/show/935874
OBS-URL: https://build.opensuse.org/package/show/Virtualization:containers/runc?expand=0&rev=118
- Update to runc v1.0.2. Upstream changelog is available from
https://github.com/opencontainers/runc/releases/tag/v1.0.2
* Fixed a failure to set CPU quota period in some cases on cgroup v1.
* Fixed the inability to start a container with the "adding seccomp filter
rule for syscall ..." error, caused by redundant seccomp rules (i.e. those
that has action equal to the default one). Such redundant rules are now
skipped.
* Made release builds reproducible from now on.
* Fixed a rare debug log race in runc init, which can result in occasional
harmful "failed to decode ..." errors from runc run or exec.
* Fixed the check in cgroup v1 systemd manager if a container needs to be
frozen before Set, and add a setting to skip such freeze unconditionally.
The previous fix for that issue, done in runc 1.0.1, was not working.
OBS-URL: https://build.opensuse.org/request/show/913731
OBS-URL: https://build.opensuse.org/package/show/Virtualization:containers/runc?expand=0&rev=117
- Update to runc v1.0.1. Upstream changelog is available from
https://github.com/opencontainers/runc/releases/tag/v1.0.1
* Fixed occasional runc exec/run failure ("interrupted system call") on an
Azure volume.
* Fixed "unable to find groups ... token too long" error with /etc/group
containing lines longer than 64K characters.
* cgroup/systemd/v1: fix leaving cgroup frozen after Set if a parent cgroup is
frozen. This is a regression in 1.0.0, not affecting runc itself but some
of libcontainer users (e.g Kubernetes).
* cgroupv2: bpf: Ignore inaccessible existing programs in case of
permission error when handling replacement of existing bpf cgroup
programs. This fixes a regression in 1.0.0, where some SELinux
policies would block runc from being able to run entirely.
* cgroup/systemd/v2: don't freeze cgroup on Set.
* cgroup/systemd/v1: avoid unnecessary freeze on Set.
- Remove upstreamed patches:
+ boo1187704-0001-cgroupv2-ebpf-ignore-inaccessible-existing-programs.patch
OBS-URL: https://build.opensuse.org/request/show/907285
OBS-URL: https://build.opensuse.org/package/show/Virtualization:containers/runc?expand=0&rev=116
- Update to runc v1.0.0. Upstream changelog is available from
https://github.com/opencontainers/runc/releases/tag/v1.0.0
! The usage of relative paths for mountpoints will now produce a warning
(such configurations are outside of the spec, and in future runc will
produce an error when given such configurations).
* cgroupv2: devices: rework the filter generation to produce consistent
results with cgroupv1, and always clobber any existing eBPF
program(s) to fix runc update and avoid leaking eBPF programs
(resulting in errors when managing containers).
* cgroupv2: correctly convert "number of IOs" statistics in a
cgroupv1-compatible way.
* cgroupv2: support larger than 32-bit IO statistics on 32-bit architectures.
* cgroupv2: wait for freeze to finish before returning from the freezing
code, optimize the method for checking whether a cgroup is frozen.
* cgroups/systemd: fixed "retry on dbus disconnect" logic introduced in rc94
* cgroups/systemd: fixed returning "unit already exists" error from a systemd
cgroup manager (regression in rc94)
+ cgroupv2: support SkipDevices with systemd driver
+ cgroup/systemd: return, not ignore, stop unit error from Destroy
+ Make "runc --version" output sane even when built with go get or
otherwise outside of our build scripts.
+ cgroups: set SkipDevices during runc update (so we don't modify
cgroups at all during runc update).
+ cgroup1: blkio: support BFQ weights.
+ cgroupv2: set per-device io weights if BFQ IO scheduler is available.
OBS-URL: https://build.opensuse.org/request/show/901272
OBS-URL: https://build.opensuse.org/package/show/Virtualization:containers/runc?expand=0&rev=113
/usr/share/doc/packages/docker/CHANGELOG.md. CVE-2021-21285 CVE-2021-21284
- Drop docker-runc, docker-test and docker-libnetwork packages. We now just use
the upstream runc package (it's stable enough and Docker no longer pins git
versions). docker-libnetwork is so unstable that it doesn't have any
versioning scheme and so it really doesn't make sense to maintain the project
as a separate package. bsc#1181641 bsc#1181677
OBS-URL: https://build.opensuse.org/package/show/Virtualization:containers/runc?expand=0&rev=100
- Update to runc v1.0.0-rc4. Upstream changelog:
+ runc now supports v1.0.0 of the OCI runtime specification. #1527
+ Rootless containers support has been released. The current state of
this feature is that it only supports single-{uid,gid} mappings as an
unprivileged user, and cgroups are completely unsupported. Work is
being done to improve this. #774
+ Rather than relying on CRIU version nnumbers, actually check if the
system supports pre-dumping. #1371
+ Allow the PIDs cgroup limit to be updated. #1423
+ Add support for checkpoint/restore of containers with orphaned PTYs
(which is effectively all containers with terminal=true). #1355
+ Permit prestart hooks to modify the cgroup configuration of a
container. #1239
+ Add support for a wide variety of mount options. #1460
+ Expose memory.use_hierarchy in MemoryStats. #1378
* Fix incorrect handling of systems without the freezer cgroup. #1387
* Many, many changes to switch away from Go's "syscall" stdlib to
"golang.org/x/sys/unix". #1394#1398#1442#1464#1467#1470#1474#1478#1491#1482#1504#1519#1530
* Set cgroup resources when restoring a container. #1399
* Switch back to using /sbin as the installation directory. #1406
* Remove the arbitrary container ID length restriction. #1435
* Make container force deletion ignore non-existent containers. #1451
* Improve handling of arbitrary cgroup mount locations when populating
cpuset. #1372
* Make the SaneTerminal interface public. #1479
* Fix cases where runc would report a container to be in a "Running"
state if the init was a zombie or dead. #1489
* Do not set supplementary groups for numeric users. #1450
* Fix various issues with the "owner" field in runc-list. #1516
* Many other miscellaneous fixes, some of which were made by first-time
contributors. Thanks, and welcome to the project! #1406#1400#1365#1396#1402#1414#1412#1408#1418#1425#1428#1436#1433#1438#1410#1447#1388#1484#1481#1496#1245#1524#1534#1526#1533
- Remove any semblance of non-Linux support. #1502
- We no longer use shfmt for testing. #1510
OBS-URL: https://build.opensuse.org/request/show/516116
OBS-URL: https://build.opensuse.org/package/show/Virtualization:containers/runc?expand=0&rev=54
