search

cloudfoundry / guardian

containers4life
Apache License 2.0
77 stars 44 forks source link

Bump github.com/opencontainers/runc from 1.1.4 to 1.1.6 #377

Closed dependabot[bot] closed 1 year ago

dependabot[bot] commented 1 year ago

Bumps github.com/opencontainers/runc from 1.1.4 to 1.1.6.

Release notes

Sourced from github.com/opencontainers/runc's releases.

runc 1.1.5 -- "囚われた屈辱は　反撃の嚆矢だ"

This is the fifth patch release in the 1.1.z series of runc, which fixes three CVEs found in runc.

In addition, the following other fixes are included in this release:

  • Fix the inability to use /dev/null when inside a container. (#3620)
  • Fix changing the ownership of host's /dev/null caused by fd redirection (a regression in 1.1.1). (#3674, #3731)
  • Fix rare runc exec/enter unshare error on older kernels, including CentOS < 7.7. (#3776)
  • nsexec: Check for errors in write_log(). (#3721)

Static Linking Notices

The runc binary distributed with this release are statically linked with the following GNU LGPL-2.1 licensed libraries, with runc acting as a "work that uses the Library":

The versions of these libraries were not modified from their upstream versions, but in order to comply with the LGPL-2.1 (§6(a)), we have attached the complete source code for those libraries which (when combined with the attached runc source code) may be used to exercise your rights under the LGPL-2.1.

However we strongly suggest that you make use of your distribution's packages or download them from the authoritative upstream sources, especially since these libraries are related to the security of your containers.

... (truncated)

Changelog

Sourced from github.com/opencontainers/runc's changelog.

[1.1.6] - 2023-04-11

In this world nothing is certain but death and taxes.

Compatibility

  • This release can no longer be built from sources using Go 1.16. Using a latest maintained Go 1.20.x or Go 1.19.x release is recommended. Go 1.17 can still be used.

Fixed

  • systemd cgroup v1 and v2 drivers were deliberately ignoring UnitExist error from systemd while trying to create a systemd unit, which in some scenarios may result in a container not being added to the proper systemd unit and cgroup. (#3780, #3806)
  • systemd cgroup v2 driver was incorrectly translating cpuset range from spec's resources.cpu.cpus to systemd unit property (AllowedCPUs) in case of more than 8 CPUs, resulting in the wrong AllowedCPUs setting. (#3808)
  • systemd cgroup v1 driver was prefixing container's cgroup path with the path of PID 1 cgroup, resulting in inability to place PID 1 in a non-root cgroup. (#3811)
  • runc run/start may return "permission denied" error when starting a rootless container when the file to be executed does not have executable bit set for the user, not taking the CAP_DAC_OVERRIDE capability into account. This is a regression in runc 1.1.4, as well as in Go 1.20 and 1.20.1 (#3715, #3817)
  • cgroup v1 drivers are now aware of misc controller. (#3823)
  • Various CI fixes and improvements, mostly to ensure Go 1.19.x and Go 1.20.x compatibility.

[1.1.5] - 2023-03-29

囚われた屈辱は 反撃の嚆矢だ

Security

The following CVEs were fixed in this release:

  • [CVE-2023-25809][] is a vulnerability involving rootless containers where (under specific configurations), the container would have write access to the /sys/fs/cgroup/user.slice/... cgroup hierarchy. No other hierarchies on the host were affected. This vulnerability was discovered by Akihiro Suda.

  • [CVE-2023-27561][] was a regression in our protections against tricky /proc and /sys configurations (where the container mountpoint is a symlink) causing us to be tricked into incorrectly configuring the container, which effectively re-introduced [CVE-2019-19921][]. This regression was present from v1.0.0-rc95 to v1.1.4 and was discovered by @​Beuc. (#3785)

... (truncated)

Commits
  • 0f48801 VERSION: release 1.1.6
  • 0690c4e merge #3823 into release-1.1
  • e4ce94e libct/cg: add misc controller to v1 drivers
  • 53333a5 Merge pull request #3811 from haircommander/root-cgroup-no-init-1.1
  • 10cfd81 libctr/cgroups: don't take init's cgroup into account
  • 9c1c844 Merge pull request #3817 from kolyshkin/1.1-user-exec
  • d30d240 tests/int: test for CAP_DAC_OVERRIDE
  • 840b953 Fix runc run "permission denied" when rootless
  • c7a72ab Merge pull request #3808 from kolyshkin/1.1-cpuset-byte-order
  • 165d232 tests/int: add a "update cpuset cpus range via v2 unified map" test
  • Additional commits viewable in compare view


Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
cf-gitbot commented 1 year ago

We have created an issue in Pivotal Tracker to manage this. Unfortunately, the Pivotal Tracker project is private so you may be unable to view the contents of the story.

The labels on this github issue will be updated when the story is started.

dependabot[bot] commented 1 year ago

Looks like github.com/opencontainers/runc is up-to-date now, so this is no longer needed.