File runc.changes of Package runc (Revision 83dfdcd72247af64a5b90ece0ec48d9e)
Currently displaying revision 83dfdcd72247af64a5b90ece0ec48d9e , Show latest
844
1
-------------------------------------------------------------------2
Thu Mar 21 03:46:48 UTC 2024 - Aleksa Sarai <asarai@suse.com>3
4
- Add upstream patch <https://github.com/opencontainers/runc/pull/4219> to5
properly fix -ENOSYS stub on ppc64le. bsc#1192051 bsc#12210506
+ 0001-bsc1221050-libct-seccomp-patchbpf-rm-duplicated-code.patch7
+ 0002-bsc1221050-seccomp-patchbpf-rename-nativeArch-linuxA.patch8
+ 0003-bsc1221050-seccomp-patchbpf-always-include-native-ar.patch9
10
-------------------------------------------------------------------11
Wed Jan 31 00:00:33 UTC 2024 - Aleksa Sarai <asarai@suse.com>12
13
- Update to runc v1.1.12. Upstream changelog is available from14
<https://github.com/opencontainers/runc/releases/tag/v1.1.12>. bsc#121889415
16
* This release fixes a container breakout vulnerability (CVE-2024-21626). For17
more details, see the upstream security advisory:18
<https://github.com/opencontainers/runc/security/advisories/GHSA-xr7r-f8xq-vfvv>19
* Remove upstreamed patches:20
- CVE-2024-21626.patch21
* Update runc.keyring to match upstream changes.22
23
-------------------------------------------------------------------24
Thu Jan 18 00:37:01 UTC 2024 - Aleksa Sarai <asarai@suse.com>25
26
[ This was only ever released for SLES. ]27
28
- Add upstream patch to fix embargoed issue CVE-2024-21626. bsc#121889429
<https://github.com/opencontainers/runc/security/advisories/GHSA-xr7r-f8xq-vfvv>30
+ CVE-2024-21626.patch31
32
-------------------------------------------------------------------33
Tue Jan 2 03:02:16 UTC 2024 - Aleksa Sarai <asarai@suse.com>34
35
- Update to runc v1.1.11. Upstream changelog is available from36
<https://github.com/opencontainers/runc/releases/tag/v1.1.11>.37
38
-------------------------------------------------------------------39
Wed Nov 1 07:25:46 UTC 2023 - Aleksa Sarai <asarai@suse.com>40
41
- Update to runc v1.1.10. Upstream changelog is available from42
<https://github.com/opencontainers/runc/releases/tag/v1.1.10>.43
44
-------------------------------------------------------------------45
Wed Sep 6 06:42:37 UTC 2023 - Danish Prakash <danish.prakash@suse.com>46
47
- Update to runc v1.1.9. Upstream changelog is available from48
<https://github.com/opencontainers/runc/releases/tag/v1.1.9>.49
50
-------------------------------------------------------------------51
Wed Jul 19 14:04:08 UTC 2023 - Aleksa Sarai <asarai@suse.com>52
53
- Update to runc v1.1.8. Upstream changelog is available from54
<https://github.com/opencontainers/runc/releases/tag/v1.1.8>.55
56
-------------------------------------------------------------------57
Thu Apr 27 09:43:31 UTC 2023 - Aleksa Sarai <asarai@suse.com>58
59
- Update to runc v1.1.7. Upstream changelog is available from60
<https://github.com/opencontainers/runc/releases/tag/v1.1.7>.61
- Update runc.keyring to upstream version.62
63
-------------------------------------------------------------------64
Wed Apr 12 04:17:29 UTC 2023 - Aleksa Sarai <asarai@suse.com>65
66
- Update to runc v1.1.6. Upstream changelog is available from67
<https://github.com/opencontainers/runc/releases/tag/v1.1.6>.68
69
-------------------------------------------------------------------70
Wed Mar 29 07:05:52 UTC 2023 - Aleksa Sarai <asarai@suse.com>71
72
- Update to runc v1.1.5. Upstream changelog is available from73
<https://github.com/opencontainers/runc/releases/tag/v1.1.5>.74
75
Includes fixes for the following CVEs:76
- CVE-2023-25809 bsc#120988477
- CVE-2023-27561 bsc#120896278
- CVE-2023-28642 bsc#120988879
80
* Fix the inability to use `/dev/null` when inside a container. bsc#116848181
* Fix changing the ownership of host's `/dev/null` caused by fd redirection82
(a regression in 1.1.1). bsc#120700483
* Fix rare runc exec/enter unshare error on older kernels.84
* nsexec: Check for errors in `write_log()`.85
86
- Drop version-specific Go requirement.87
88
-------------------------------------------------------------------89
Wed Aug 31 13:00:31 UTC 2022 - Fabian Vogt <fvogt@suse.com>90
91
- Update to runc v1.1.4. Upstream changelog is available from92
https://github.com/opencontainers/runc/releases/tag/v1.1.4.93
bsc#120202194
95
* Fix mounting via wrong proc fd. When the user and mount namespaces are96
used, and the bind mount is followed by the cgroup mount in the spec,97
the cgroup was mounted using the bind mount's mount fd.98
* Switch kill() in libcontainer/nsenter to sane_kill().99
* Fix "permission denied" error from runc run on noexec fs.100
* Fix failed exec after systemctl daemon-reload. Due to a regression101
in v1.1.3, the DeviceAllow=char-pts rwm rule was no longer added and102
was causing an error open /dev/pts/0: operation not permitted: unknown when systemd was reloaded.103
(boo#1202821)104
105
-------------------------------------------------------------------106
Thu Jun 9 00:22:16 UTC 2022 - Aleksa Sarai <asarai@suse.com>107
108
- Update to runc v1.1.3. Upstream changelog is available from109
https://github.com/opencontainers/runc/releases/tag/v1.1.3.110
(Includes a fix for bsc#1200088.)111
112
* Our seccomp `-ENOSYS` stub now correctly handles multiplexed syscalls on113
s390 and s390x. This solves the issue where syscalls the host kernel did not114
support would return `-EPERM` despite the existence of the `-ENOSYS` stub115
code (this was due to how s390x does syscall multiplexing).116
* Retry on dbus disconnect logic in libcontainer/cgroups/systemd now works as117
intended; this fix does not affect runc binary itself but is important for118
libcontainer users such as Kubernetes.119
* Inability to compile with recent clang due to an issue with duplicate120
constants in libseccomp-golang.121
* When using systemd cgroup driver, skip adding device paths that don't exist,122
to stop systemd from emitting warnings about those paths.123
* Socket activation was failing when more than 3 sockets were used.124
* Various CI fixes.125
* Allow to bind mount /proc/sys/kernel/ns_last_pid to inside container.126
* runc static binaries are now linked against libseccomp v2.5.4.127
- Remove upstreamed patches:128
- bsc1192051-0001-seccomp-enosys-always-return-ENOSYS-for-setup-2-on-s390x.patch129
130
-------------------------------------------------------------------131
Mon May 23 03:02:32 UTC 2022 - Aleksa Sarai <asarai@suse.com>132
133
- Backport <https://github.com/opencontainers/runc/pull/3474> to fix issues134
with newer syscalls (namely faccessat2) on older kernels on s390(x) caused by135
that platform's syscall multiplexing semantics. bsc#1192051 bsc#1199565136
+ bsc1192051-0001-seccomp-enosys-always-return-ENOSYS-for-setup-2-on-s390x.patch137
138
-------------------------------------------------------------------139
Thu May 12 10:04:57 UTC 2022 - Aleksa Sarai <asarai@suse.com>140
141
- Add ExcludeArch for s390 (not s390x) since we've never supported it.142
143
-------------------------------------------------------------------144
Wed May 11 22:43:51 UTC 2022 - Aleksa Sarai <asarai@suse.com>145
146
- Update to runc v1.1.2. Upstream changelog is available from147
https://github.com/opencontainers/runc/releases/tag/v1.1.2.148
CVE-2022-29162 bsc#1199460149
150
* A bug was found in runc where runc exec --cap executed processes with151
non-empty inheritable Linux process capabilities, creating an atypical Linux152
environment. For more information, see [GHSA-f3fp-gc8g-vw66][] and153
CVE-2022-29162. bsc#1199460154
* `runc spec` no longer sets any inheritable capabilities in the created155
example OCI spec (`config.json`) file.156
157
-------------------------------------------------------------------158
Tue Mar 29 03:33:30 UTC 2022 - Aleksa Sarai <asarai@suse.com>159
160
- Update to runc v1.1.1. Upstream changelog is available from161
https://github.com/opencontainers/runc/releases/tag/v1.1.1.162
163
* runc run/start can now run a container with read-only /dev in OCI spec,164
rather than error out. (#3355)165
* runc exec now ensures that --cgroup argument is a sub-cgroup. (#3403)166
libcontainer systemd v2 manager no longer errors out if one of the files167
listed in /sys/kernel/cgroup/delegate do not exist in container's168
cgroup. (#3387, #3404)169
* Loosen OCI spec validation to avoid bogus "Intel RDT is not supported"170
error. (#3406)171
* libcontainer/cgroups no longer panics in cgroup v1 managers if stat172
of /sys/fs/cgroup/unified returns an error other than ENOENT. (#3435)173
174
-------------------------------------------------------------------175
Mon Jan 17 07:15:26 UTC 2022 - Aleksa Sarai <asarai@suse.com>176
177
- Update to runc v1.1.0. Upstream changelog is available from178
https://github.com/opencontainers/runc/releases/tag/v1.1.0.179
180
- libcontainer will now refuse to build without the nsenter package being181
correctly compiled (specifically this requires CGO to be enabled). This182
should avoid folks accidentally creating broken runc binaries (and183
incorrectly importing our internal libraries into their projects). (#3331)184
185
-------------------------------------------------------------------186
Tue Dec 14 05:04:21 UTC 2021 - Aleksa Sarai <asarai@suse.com>187
188
- Update to runc v1.1.0~rc1. Upstream changelog is available from189
https://github.com/opencontainers/runc/releases/tag/v1.1.0-rc.1.190
191
+ Add support for RDMA cgroup added in Linux 4.11.192
* runc exec now produces exit code of 255 when the exec failed.193
This may help in distinguishing between runc exec failures194
(such as invalid options, non-running container or non-existent195
binary etc.) and failures of the command being executed.196
+ runc run: new --keep option to skip removal exited containers artefacts.197
This might be useful to check the state (e.g. of cgroup controllers) after198
the container has•exited.199
+ seccomp: add support for SCMP_ACT_KILL_PROCESS and SCMP_ACT_KILL_THREAD200
(the latter is just an alias for SCMP_ACT_KILL).201
+ seccomp: add support for SCMP_ACT_NOTIFY (seccomp actions). This allows202
users to create sophisticated seccomp filters where syscalls can be203
efficiently emulated by privileged processes on the host.204
+ checkpoint/restore: add an option (--lsm-mount-context) to set205
a different LSM mount context on restore.206
+ intelrdt: support ClosID parameter.207
+ runc exec --cgroup: an option to specify a (non-top) in-container cgroup208
to use for the process being executed.209
+ cgroup v1 controllers now support hybrid hierarchy (i.e. when on a cgroup v1210
machine a cgroup2 filesystem is mounted to /sys/fs/cgroup/unified, runc211
run/exec now adds the container to the appropriate cgroup under it).212
+ sysctl: allow slashes in sysctl names, to better match sysctl(8)'s213
behaviour.214
+ mounts: add support for bind-mounts which are inaccessible after switching215
the user namespace. Note that this does not permit the container any216
additional access to the host filesystem, it simply allows containers to217
have bind-mounts configured for paths the user can access but have218
restrictive access control settings for other users.219
+ Add support for recursive mount attributes using mount_setattr(2). These220
have the same names as the proposed mount(8) options -- just prepend r221
to the option name (such as rro).222
+ Add runc features subcommand to allow runc users to detect what features223
runc has been built with. This includes critical information such as224
supported mount flags, hook names, and so on. Note that the output of this225
command is subject to change and will not be considered stable until runc226
1.2 at the earliest. The runtime-spec specification for this feature is227
being developed in opencontainers/runtime-spec#1130.228
* system: improve performance of /proc/$pid/stat parsing.229
* cgroup2: when /sys/fs/cgroup is configured as a read-write mount, change230
the ownership of certain cgroup control files (as per231
/sys/kernel/cgroup/delegate) to allow for proper deferral to the container232
process.233
* runc checkpoint/restore: fixed for containers with an external bind mount234
which destination is a symlink.235
* cgroup: improve openat2 handling for cgroup directory handle hardening.236
runc delete -f now succeeds (rather than timing out) on a paused237
container.238
* runc run/start/exec now refuses a frozen cgroup (paused container in case of239
exec). Users can disable this using --ignore-paused.240
- Update version data embedded in binary to correctly include the git commit of241
the release.242
- Drop runc-rpmlintrc because we don't have runc-test anymore.243
244
-------------------------------------------------------------------245
Mon Dec 6 04:38:25 UTC 2021 - Aleksa Sarai <asarai@suse.com>246
247
- Update to runc v1.0.3. Upstream changelog is available from248
https://github.com/opencontainers/runc/releases/tag/v1.0.3. CVE-2021-43784249
bsc#1193436250
251
* A potential vulnerability was discovered in runc (related to an internal252
usage of netlink), however upon further investigation we discovered that253
while this bug was exploitable on the master branch of runc, no released254
version of runc could be exploited using this bug. The exploit required255
being able to create a netlink attribute with a length that would overflow a256
uint16 but this was not possible in any released version of runc. For more257
information see GHSA-v95c-p5hm-xq8f and CVE-2021-43784.258
259
Due to an abundance of caution we decided to do an emergency release with260
this fix, but to reiterate we do not believe this vulnerability was261
possible to exploit. Thanks to Felix Wilhelm from Google Project Zero for262
discovering and reporting this vulnerability so quickly.263
* Fixed inability to start a container with read-write bind mount of a264
read-only fuse host mount.265
* Fixed inability to start when read-only /dev in set in spec.266
* Fixed not removing sub-cgroups upon container delete, when rootless cgroup267
v2 is used with older systemd.268
* Fixed returning error from GetStats when hugetlb is unsupported (which269
causes excessive logging for kubernetes).270
271
-------------------------------------------------------------------272
Mon Aug 23 09:35:05 UTC 2021 - Aleksa Sarai <asarai@suse.com>273
274
- Update to runc v1.0.2. Upstream changelog is available from275
https://github.com/opencontainers/runc/releases/tag/v1.0.2276
277
* Fixed a failure to set CPU quota period in some cases on cgroup v1.278
* Fixed the inability to start a container with the "adding seccomp filter279
rule for syscall ..." error, caused by redundant seccomp rules (i.e. those280
that has action equal to the default one). Such redundant rules are now281
skipped.282
* Made release builds reproducible from now on.283
* Fixed a rare debug log race in runc init, which can result in occasional284
harmful "failed to decode ..." errors from runc run or exec.285
* Fixed the check in cgroup v1 systemd manager if a container needs to be286
frozen before Set, and add a setting to skip such freeze unconditionally.287
The previous fix for that issue, done in runc 1.0.1, was not working.288
289
-------------------------------------------------------------------290
Sun Jul 18 02:40:16 UTC 2021 - Aleksa Sarai <asarai@suse.com>291
292
- Update to runc v1.0.1. Upstream changelog is available from293
https://github.com/opencontainers/runc/releases/tag/v1.0.1294
295
* Fixed occasional runc exec/run failure ("interrupted system call") on an296
Azure volume.297
* Fixed "unable to find groups ... token too long" error with /etc/group298
containing lines longer than 64K characters.299
* cgroup/systemd/v1: fix leaving cgroup frozen after Set if a parent cgroup is300
frozen. This is a regression in 1.0.0, not affecting runc itself but some301
of libcontainer users (e.g Kubernetes).302
* cgroupv2: bpf: Ignore inaccessible existing programs in case of303
permission error when handling replacement of existing bpf cgroup304
programs. This fixes a regression in 1.0.0, where some SELinux305
policies would block runc from being able to run entirely.306
* cgroup/systemd/v2: don't freeze cgroup on Set.307
* cgroup/systemd/v1: avoid unnecessary freeze on Set.308
309
- Remove upstreamed patches:310
+ boo1187704-0001-cgroupv2-ebpf-ignore-inaccessible-existing-programs.patch311
312
-------------------------------------------------------------------313
Thu Jul 1 03:39:56 UTC 2021 - Aleksa Sarai <asarai@suse.com>314
315
- Backport <https://github.com/opencontainers/runc/pull/3055> to fix issues316
with runc under openSUSE MicroOS's SELinux policy. boo#1187704317
+ boo1187704-0001-cgroupv2-ebpf-ignore-inaccessible-existing-programs.patch318
319
-------------------------------------------------------------------320
Tue Jun 1 11:00:30 UTC 2021 - Aleksa Sarai <asarai@suse.com>321
322
- Update to runc v1.0.0. Upstream changelog is available from323
https://github.com/opencontainers/runc/releases/tag/v1.0.0324
325
! The usage of relative paths for mountpoints will now produce a warning326
(such configurations are outside of the spec, and in future runc will327
produce an error when given such configurations).328
329
* cgroupv2: devices: rework the filter generation to produce consistent330
results with cgroupv1, and always clobber any existing eBPF331
program(s) to fix runc update and avoid leaking eBPF programs332
(resulting in errors when managing containers).333
* cgroupv2: correctly convert "number of IOs" statistics in a334
cgroupv1-compatible way.335
* cgroupv2: support larger than 32-bit IO statistics on 32-bit architectures.336
* cgroupv2: wait for freeze to finish before returning from the freezing337
code, optimize the method for checking whether a cgroup is frozen.338
* cgroups/systemd: fixed "retry on dbus disconnect" logic introduced in rc94339
* cgroups/systemd: fixed returning "unit already exists" error from a systemd340
cgroup manager (regression in rc94)341
342
+ cgroupv2: support SkipDevices with systemd driver343
+ cgroup/systemd: return, not ignore, stop unit error from Destroy344
+ Make "runc --version" output sane even when built with go get or345
otherwise outside of our build scripts.346
+ cgroups: set SkipDevices during runc update (so we don't modify347
cgroups at all during runc update).348
+ cgroup1: blkio: support BFQ weights.349
+ cgroupv2: set per-device io weights if BFQ IO scheduler is available.350
351
-------------------------------------------------------------------352
Wed May 19 10:00:00 UTC 2021 - Aleksa Sarai <asarai@suse.com>353
354
- Update to runc v1.0.0~rc95. Upstream changelog is available from355
https://github.com/opencontainers/runc/releases/tag/v1.0.0-rc95356
357
This release of runc contains a fix for CVE-2021-30465, and users are358
strongly recommended to update (especially if you are providing359
semi-limited access to spawn containers to untrusted users). bsc#1185405360
361
-------------------------------------------------------------------362
Wed May 12 08:03:58 UTC 2021 - Aleksa Sarai <asarai@suse.com>363
364
- Update to runc v1.0.0~rc94. Upstream changelog is available from365
https://github.com/opencontainers/runc/releases/tag/v1.0.0-rc94366
Breaking Changes:367
* cgroupv1: kernel memory limits are now always ignored, as kmemcg has368
been effectively deprecated by the kernel. Users should make use of regular369
memory cgroup controls.370
Regression Fixes:371
* seccomp: fix 32-bit compilation errors372
* runc init: fix a hang caused by deadlock in seccomp/ebpf loading code373
* runc start: fix "chdir to cwd: permission denied" for some setups374
- Remove upstreamed patches:375
- 0001-cloned_binary-switch-from-error-to-warning-for-SYS_m.patch376
377
-------------------------------------------------------------------378
Mon Apr 26 07:54:54 UTC 2021 - Aleksa Sarai <asarai@suse.com>379
380
- Backport patch to fix build on SLE-12 ppc64le.381
+ 0001-cloned_binary-switch-from-error-to-warning-for-SYS_m.patch382
383
-------------------------------------------------------------------384
Wed Feb 3 04:09:17 UTC 2021 - Aleksa Sarai <asarai@suse.com>385
386
- Update to runc v1.0.0~rc93. Upstream changelog is available from387
https://github.com/opencontainers/runc/releases/tag/v1.0.0-rc93388
bsc#1182451 bsc#1184962389
390
* Cgroupv2 support is no longer considered experimental.391
* Mountinfo parsing code has been reworked significantly.392
* Special ENOSYS handling for seccomp profiles to avoid making new393
syscalls unusable for glibc.394
* Various rootless containers improvements.395
* The "selinux" and "apparmor" buildtags have been removed, and now all runc396
builds will have SELinux and AppArmor support enabled.397
398
-------------------------------------------------------------------399
Tue Feb 2 05:53:17 UTC 2021 - Aleksa Sarai <asarai@suse.com>400
401
- Update to handle the docker-runc removal. bsc#1181677402
- Modernise go building for runc now that it has go.mod.403
404
-------------------------------------------------------------------405
Fri Aug 28 07:38:29 UTC 2020 - Ralf Haferkamp <rhafer@suse.com>406
407
- Upgrade to runc v1.0.0~rc92 (bsc#1175821). Upstream changelog is available408
from https://github.com/opencontainers/runc/releases/tag/v1.0.0-rc92409
410
* Updates to CRIU support.411
* Improvements to cgroupfs performance and correctness.412
413
-------------------------------------------------------------------414
Thu Jul 2 01:24:49 UTC 2020 - Aleksa Sarai <asarai@suse.com>415
416
- Upgrade to runc v1.0.0~rc91. Upstream changelog is available from417
https://github.com/opencontainers/runc/releases/tag/v1.0.0-rc91418
419
* This release of runc has experimental support for cgroupv2-only systems.420
421
- Remove upstreamed patches:422
- bsc1149954-0001-sd-notify-do-not-hang-when-NOTIFY_SOCKET-is-used-wit.patch423
- bsc1168481-0001-cgroup-devices-major-cleanups-and-minimal-transition.patch424
425
-------------------------------------------------------------------426
Thu Jun 25 22:34:03 UTC 2020 - Aleksa Sarai <asarai@suse.com>427
428
- Switch to Go 1.13 for build.429
430
-------------------------------------------------------------------431
Wed May 13 06:49:44 UTC 2020 - Aleksa Sarai <asarai@suse.com>432
433
- Backport https://github.com/opencontainers/runc/pull/2391 to help fix434
bsc#1168481.435
+ bsc1168481-0001-cgroup-devices-major-cleanups-and-minimal-transition.patch436
437
-------------------------------------------------------------------438
Tue Apr 14 10:16:21 UTC 2020 - Ralf Haferkamp <rhafer@suse.com>439
440
- Renamed patch:441
0001-sd-notify-do-not-hang-when-NOTIFY_SOCKET-is-used-wit.patch442
to443
bsc1149954-0001-sd-notify-do-not-hang-when-NOTIFY_SOCKET-is-used-wit.patch444
445
-------------------------------------------------------------------446
Wed Mar 18 08:57:34 UTC 2020 - Ralf Haferkamp <rhafer@suse.com>447
448
- Added fix for bsc#1149954449
* 0001-sd-notify-do-not-hang-when-NOTIFY_SOCKET-is-used-wit.patch450
(cherry pick of https://github.com/opencontainers/runc/pull/1807)451
452
-------------------------------------------------------------------453
Thu Jan 23 17:18:05 UTC 2020 - Aleksa Sarai <asarai@suse.com>454
455
- Upgrade to runc v1.0.0~rc10. Upstream changelog is available from456
https://github.com/opencontainers/runc/releases/tag/v1.0.0-rc10457
- Drop upstreamed patches:458
- CVE-2019-19921.patch459
460
-------------------------------------------------------------------461
Tue Jan 21 22:10:58 UTC 2020 - Bjørn Lie <bjorn.lie@gmail.com>462
463
- Change packagewide go version to be greater or equal to 1.10.464
465
-------------------------------------------------------------------466
Fri Jan 17 03:02:46 UTC 2020 - Aleksa Sarai <asarai@suse.com>467
468
- Update CVE-2019-19921 patch to match upstream PR.469
* CVE-2019-19921.patch470
471
-------------------------------------------------------------------472
Tue Jan 14 04:44:36 UTC 2020 - Aleksa Sarai <asarai@suse.com>473
474
- Add backported fix for CVE-2019-19921. bsc#1160452475
+ CVE-2019-19921.patch476
477
-------------------------------------------------------------------478
Sat Oct 5 11:40:13 UTC 2019 - Aleksa Sarai <asarai@suse.com>479
480
- Upgrade to runc v1.0.0~rc9. Upstream changelog is available from481
https://github.com/opencontainers/runc/releases/tag/v1.0.0-rc9482
- Remove upstreamed patches:483
- CVE-2019-16884.patch484
485
-------------------------------------------------------------------486
Thu Sep 26 14:54:07 UTC 2019 - Aleksa Sarai <asarai@suse.com>487
488
- Add backported fix for CVE-2019-16884. bsc#1152308489
+ CVE-2019-16884.patch490
- Add runc-rpmlintrc to drop runc-test rpmlint warnings.491
492
-------------------------------------------------------------------493
Mon Apr 29 11:56:21 UTC 2019 - Aleksa Sarai <asarai@suse.com>494
495
- Upgrade to runc v1.0.0~rc8. Upstream changelog is available from496
https://github.com/opencontainers/runc/releases/tag/v1.0.0-rc8497
- Includes upstreamed patches for regressions (bsc#1131314 bsc#1131553).498
- Remove upstreamed patches:499
- CVE-2019-5736.patch500
501
-------------------------------------------------------------------502
Wed Feb 6 08:10:47 UTC 2019 - Aleksa Sarai <asarai@suse.com>503
504
- Add fix for CVE-2019-5736 (effectively copying /proc/self/exe during re-exec505
to avoid write attacks to the host runc binary). bsc#1121967506
+ CVE-2019-5736.patch507
508
-------------------------------------------------------------------509
Wed Dec 19 19:55:11 UTC 2018 - clee@suse.com510
511
- Update go requirements to >= go1.10 to fix512
* bsc#1118897 CVE-2018-16873513
go#29230 cmd/go: remote command execution during "go get -u"514
* bsc#1118898 CVE-2018-16874515
go#29231 cmd/go: directory traversal in "go get" via curly braces in import paths516
* bsc#1118899 CVE-2018-16875517
go#29233 crypto/x509: CPU denial of service518
519
-------------------------------------------------------------------520
Thu Dec 13 04:34:25 UTC 2018 - dorf@suse.com521
522
- Require golang = 1.10.523
524
-------------------------------------------------------------------525
Thu Nov 29 09:10:09 UTC 2018 - Aleksa Sarai <asarai@suse.com>526
527
- Upgrade to runc v1.0.0~rc6. Upstream changelog is available from528
https://github.com/opencontainers/runc/releases/tag/v1.0.0-rc6529
530
-------------------------------------------------------------------531
Wed Oct 31 14:01:03 UTC 2018 - Valentin Rothberg <vrothberg@suse.com>532
533
- Create a symlink in /usr/bin/runc to enable rootless Podman and Buildah.534
535
-------------------------------------------------------------------536
Wed Jun 13 12:59:09 UTC 2018 - dcassany@suse.com537
538
- Make use of %license macro539
540
-------------------------------------------------------------------541
Tue Jun 5 06:38:40 UTC 2018 - asarai@suse.com542
543
- Remove 'go test' from %check section, as it has only ever caused us problems544
and hasn't (as far as I remember) ever caught a release-blocking issue. Smoke545
testing has been far more useful. boo#1095817546
547
-------------------------------------------------------------------548
Tue Feb 27 17:18:32 UTC 2018 - asarai@suse.com549
550
- Upgrade to runc v1.0.0~rc5. Upstream changelog is available from551
https://github.com/opencontainers/runc/releases/tag/v1.0.0-rc5552
- Remove patch now merged upstream.553
- bsc1053532-0001-makefile-drop-usage-of-install.patch554
555
-------------------------------------------------------------------556
Thu Aug 17 04:39:56 UTC 2017 - asarai@suse.com557
558
- Use .tar.xz provided by upstream, as well as include the keyring to allow559
full provenance of the source.560
561
-------------------------------------------------------------------562
Sun Aug 13 14:25:32 UTC 2017 - asarai@suse.com563
564
- Use the upstream Makefile, to ensure that we always include the version565
information in runc. This was confusing users (and Docker). bsc#1053532566
- Add a backported patch to fix a Makefile bug.567
https://github.com/opencontainers/runc/pull/1555568
+ bsc1053532-0001-makefile-drop-usage-of-install.patch569
570
-------------------------------------------------------------------571
Thu Aug 10 17:14:02 UTC 2017 - asarai@suse.com572
573
- Update to runc v1.0.0-rc4. Upstream changelog:574
+ runc now supports v1.0.0 of the OCI runtime specification. #1527575
+ Rootless containers support has been released. The current state of576
this feature is that it only supports single-{uid,gid} mappings as an577
unprivileged user, and cgroups are completely unsupported. Work is578
being done to improve this. #774579
+ Rather than relying on CRIU version nnumbers, actually check if the580
system supports pre-dumping. #1371581
+ Allow the PIDs cgroup limit to be updated. #1423582
+ Add support for checkpoint/restore of containers with orphaned PTYs583
(which is effectively all containers with terminal=true). #1355584
+ Permit prestart hooks to modify the cgroup configuration of a585
container. #1239586
+ Add support for a wide variety of mount options. #1460587
+ Expose memory.use_hierarchy in MemoryStats. #1378588
* Fix incorrect handling of systems without the freezer cgroup. #1387589
* Many, many changes to switch away from Go's "syscall" stdlib to590
"golang.org/x/sys/unix". #1394 #1398 #1442 #1464 #1467 #1470 #1474591
#1478 #1491 #1482 #1504 #1519 #1530592
* Set cgroup resources when restoring a container. #1399593
* Switch back to using /sbin as the installation directory. #1406594
* Remove the arbitrary container ID length restriction. #1435595
* Make container force deletion ignore non-existent containers. #1451596
* Improve handling of arbitrary cgroup mount locations when populating597
cpuset. #1372598
* Make the SaneTerminal interface public. #1479599
* Fix cases where runc would report a container to be in a "Running"600
state if the init was a zombie or dead. #1489601
* Do not set supplementary groups for numeric users. #1450602
* Fix various issues with the "owner" field in runc-list. #1516603
* Many other miscellaneous fixes, some of which were made by first-time604
contributors. Thanks, and welcome to the project! #1406 #1400 #1365605
#1396 #1402 #1414 #1412 #1408 #1418 #1425 #1428 #1436 #1433 #1438606
#1410 #1447 #1388 #1484 #1481 #1496 #1245 #1524 #1534 #1526 #1533607
- Remove any semblance of non-Linux support. #1502608
- We no longer use shfmt for testing. #1510609
610
-------------------------------------------------------------------611
Wed Aug 2 13:51:43 UTC 2017 - asarai@suse.com612
613
- Use -buildmode=pie for tests and binary build. bsc#1048046 bsc#1051429614
- Cleanup seccomp builds similar to bsc#1028638615
- Remove the usage of 'cp -r' to reduce noise in the build logs.616
617
-------------------------------------------------------------------618
Thu Jul 6 17:14:17 UTC 2017 - thipp@suse.de619
620
- switch to opencontainers/runc master branch621
- remove CVE-2016-9962.patch622
- stop providing docker-runc623
624
-------------------------------------------------------------------625
Thu May 4 19:04:49 UTC 2017 - jmassaguerpla@suse.com626
627
- fix the golang requirement to 1.7 to the subpackages628
629
-------------------------------------------------------------------630
Tue May 2 15:49:41 UTC 2017 - jmassaguerpla@suse.com631
632
- fix golang requirement to 1.7633
634
-------------------------------------------------------------------635
Fri Apr 28 16:16:00 UTC 2017 - jengelh@inai.de636
637
- Substitute %__-type macro indirections638
639
-------------------------------------------------------------------640
Thu Apr 13 16:34:03 UTC 2017 - jmassaguerpla@suse.com641
642
- update version to the one required by docker-17.04.0-ce (bsc#1034053)643
remove ignore_cgroup2_mountpoint.patch . This is already included in644
the upstream source code.645
646
-------------------------------------------------------------------647
Wed Apr 12 09:55:28 UTC 2017 - jmassaguerpla@suse.com648
649
- Make sure this is being built with go 1.7650
651
-------------------------------------------------------------------652
Tue Apr 11 15:37:36 UTC 2017 - jmassaguerpla@suse.com653
654
- remove the go_arches macro because we are using go1.7 which655
is available in all archs656
657
-------------------------------------------------------------------658
Wed Mar 29 15:47:52 UTC 2017 - jmassaguerpla@suse.com659
660
- fix bsc#1028113 - runc: make sure to ignore cgroup v2 mountpoints661
This is a backport of https://github.com/opencontainers/runc/pull/1266662
+ ignore_cgroup2_mountpoint.patch663
664
-------------------------------------------------------------------665
Fri Feb 24 18:08:10 UTC 2017 - jmassaguerpla@suse.com666
667
- update to docker-1.13.0 requirement668
669
-------------------------------------------------------------------670
Fri Jan 13 13:58:33 UTC 2017 - jmassaguerpla@suse.com671
672
- fix CVE-2016-9962 bsc#1012568 and applying the patch673
CVE-2016-9962.patch, because 1.12.6 partially fixes it (it contains674
the first patch attached in bsc#1012568)675
676
-------------------------------------------------------------------677
Mon Dec 19 12:49:38 UTC 2016 - jmassaguerpla@suse.com678
679
- update runc to the version used in docker 1.12.5 (bsc#1016307).680
This fixes bsc#1015661681
682
-------------------------------------------------------------------683
Mon Dec 19 12:17:07 UTC 2016 - asarai@suse.com684
685
- For the moment, we have to switch to using Docker's fork of runC. This *will*686
be solved properly by creating a new package purely for Docker's runC fork,687
because it's quite silly to tie OCI project releases to Docker's vendoring688
scheme. Once this is fixed, this package will be switch to being purely-OCI.689
690
-------------------------------------------------------------------691
Fri Dec 16 17:05:37 UTC 2016 - jmassaguerpla@suse.com692
693
- add the /usr/bin/docker-run symlink to partially fix bsc#1015661694
695
-------------------------------------------------------------------696
Thu Nov 24 11:05:41 UTC 2016 - jmassaguerpla@suse.com697
698
- fix version by adding a revision "counter" so that it will always699
increase700
701
fix bsc#1009961702
703
-------------------------------------------------------------------704
Thu Oct 13 11:04:27 UTC 2016 - jmassaguerpla@suse.com705
706
- update to 02f8fa7 because that is the needed version for docker 1.12.1 (bsc#1004490)707
708
-------------------------------------------------------------------709
Wed Sep 21 05:13:26 UTC 2016 - jengelh@inai.de710
711
- Run fdupes.712
713
-------------------------------------------------------------------714
Mon Sep 19 11:57:45 UTC 2016 - jmassaguerpla@suse.com715
716
- fix go_arches definition: use global instead of define, otherwise717
it fails to build718
719
-------------------------------------------------------------------720
Fri Aug 26 08:59:54 UTC 2016 - asarai@suse.com721
722
- Remove docker-runc symlink because it's been fixed within the Docker723
package. bsc#978260724
725
-------------------------------------------------------------------726
Thu Aug 25 17:02:33 UTC 2016 - jmassaguerpla@suse.com727
728
- Create a symlink /usr/sbin/docker-runc -> /usr/sbin/docker729
Docker expects this symlink to exist bsc#978260730
731
-------------------------------------------------------------------732
Thu Aug 25 15:56:00 UTC 2016 - jmassaguerpla@suse.com733
734
- Remove GOPATH at the end of the GOPATH assignment735
cause GOPATH is empty and if we do that, we get the path ""736
appended, which causes gcc6-go to complain737
738
-------------------------------------------------------------------739
Wed Aug 24 12:27:57 UTC 2016 - jmassaguerpla@suse.com740
741
- add go_arches in project configuration: this way, we can use the742
same spec file but decide in the project configuration if to743
use gc-go or gcc-go for some archs.744
745
-------------------------------------------------------------------746
Thu Aug 18 10:35:29 UTC 2016 - jmassaguerpla@suse.com747
748
- use gcc6-go instead of gcc5-go (bsc#988408)749
- build ppc64le with gc-go because this version builds with gc-go 1.6750
751
-------------------------------------------------------------------752
Thu Aug 18 10:34:29 UTC 2016 - cbrauner@suse.de753
754
- bump git commit id to the one required by docker v1.12.0 (bsc#995058)755
- run unit tests during package build756
- remove seccomp-use-pkg-config.patch757
The patch is now upstream.758
- remove GO_BUILD_FLAGS macro and substitute with BUILDFLAGS env variable to759
allow for easier string appending.760
- only run unit test on architectures that provide the go list and go test tools761
762
-------------------------------------------------------------------763
Wed Aug 17 10:29:15 UTC 2016 - cbrauner@suse.de764
765
- Add runc-test package which contains the source code and the test. This766
package will be used to run the integration tests.767
- Simplify package build and check sections: Instead of symlinking we default to768
cp -avr. go list gets confused by symlinks hence, we need to copy the source769
code anyway if we want to run unit tests during package build at some point.770
771
-------------------------------------------------------------------772
Fri Apr 29 09:03:24 UTC 2016 - asarai@suse.de773
774
* Update to runC 0.1.1. (bsc#989566 FATE#320763) Changelog from upstream:775
776
This release includes a bug fix for adding the selinux mount label in the specification.777
778
-------------------------------------------------------------------779
Tue Apr 19 09:59:05 UTC 2016 - asarai@suse.de780
781
* Don't use gcc-go for aarch64, since gc has grown support for it and is more782
stable.783
784
-------------------------------------------------------------------785
Fri Apr 15 10:46:04 UTC 2016 - asarai@suse.de786
787
* Disable seccomp entirely for aarch64 builds, since it is not provided on all788
SUSE platforms.789
790
-------------------------------------------------------------------791
Wed Apr 13 12:03:09 UTC 2016 - asarai@suse.de792
793
* Update to runC 0.1.0. Changelog from upstream:794
795
This release updates runc to the OCI runtime specification v0.5.0 and includes796
various fixes and features.797
798
Features:799
+ cgroups: pid limits and stats800
+ cgroups: kmem stats801
+ systemd cgroup support802
+ libcontainer specconv package803
+ no pivot root option804
+ numeric ids are treated as uid/gid805
+ hook improvements806
807
Bug Fixes:808
* log flushing809
* atomic pid file creation810
* init error recovery811
* seccomp logging removed812
* delete container on aborted start813
* /dev bind mount handling814
815
-------------------------------------------------------------------816
Wed Mar 30 14:18:18 UTC 2016 - asarai@suse.de817
818
* Install to /usr/sbin. https://github.com/opencontainers/runc/pull/702819
820
-------------------------------------------------------------------821
Sun Mar 27 14:50:32 UTC 2016 - asarai@suse.de822
823
* Added runC man pages.824
* Recommended criu, since it's required for the checkpoint and restore825
functionality.826
827
-------------------------------------------------------------------828
Sun Mar 27 10:14:32 UTC 2016 - asarai@suse.de829
830
* Small updates to method of compilation to better match Makefile.831
832
-------------------------------------------------------------------833
Mon Mar 21 12:04:59 UTC 2016 - asarai@suse.de834
835
* Make compilation work on gcc-go only systems (ppc and s390).836
837
-------------------------------------------------------------------838
Mon Mar 21 08:24:02 UTC 2016 - asarai@suse.de839
840
* initial import of runC 0.0.9841
* add patch seccomp-use-pkg-config.patch which allows us to build runC, since842
they assume that the seccomp.h file lives at /usr/include/seccomp.h.843
844