File runc.changes of Package runc
860
1
-------------------------------------------------------------------2
Mon Jul 22 13:08:06 UTC 2024 - Aleksa Sarai <asarai@suse.com>3
4
[ This was only ever released for SLES and Leap. ]5
6
- Update to runc v1.1.13. Upstream changelog is available from7
<https://github.com/opencontainers/runc/releases/tag/v1.1.12>.8
- Rebase patches:9
* 0001-bsc1221050-libct-seccomp-patchbpf-rm-duplicated-code.patch10
* 0002-bsc1221050-seccomp-patchbpf-rename-nativeArch-linuxA.patch11
* 0003-bsc1221050-seccomp-patchbpf-always-include-native-ar.patch12
- Backport <https://github.com/opencontainers/runc/pull/3931> to fix a13
performance issue when running lots of containers, caused by system getting14
too many mount notifications. bsc#121496015
+ 0004-bsc1214960-nsenter-cloned_binary-remove-bindfd-logic.patch16
17
-------------------------------------------------------------------18
Thu Mar 21 03:46:48 UTC 2024 - Aleksa Sarai <asarai@suse.com>19
20
- Add upstream patch <https://github.com/opencontainers/runc/pull/4219> to21
properly fix -ENOSYS stub on ppc64le. bsc#1192051 bsc#122105022
+ 0001-bsc1221050-libct-seccomp-patchbpf-rm-duplicated-code.patch23
+ 0002-bsc1221050-seccomp-patchbpf-rename-nativeArch-linuxA.patch24
+ 0003-bsc1221050-seccomp-patchbpf-always-include-native-ar.patch25
26
-------------------------------------------------------------------27
Wed Jan 31 00:00:33 UTC 2024 - Aleksa Sarai <asarai@suse.com>28
29
- Update to runc v1.1.12. Upstream changelog is available from30
<https://github.com/opencontainers/runc/releases/tag/v1.1.12>. bsc#121889431
32
* This release fixes a container breakout vulnerability (CVE-2024-21626). For33
more details, see the upstream security advisory:34
<https://github.com/opencontainers/runc/security/advisories/GHSA-xr7r-f8xq-vfvv>35
* Remove upstreamed patches:36
- CVE-2024-21626.patch37
* Update runc.keyring to match upstream changes.38
39
-------------------------------------------------------------------40
Thu Jan 18 00:37:01 UTC 2024 - Aleksa Sarai <asarai@suse.com>41
42
[ This was only ever released for SLES. ]43
44
- Add upstream patch to fix embargoed issue CVE-2024-21626. bsc#121889445
<https://github.com/opencontainers/runc/security/advisories/GHSA-xr7r-f8xq-vfvv>46
+ CVE-2024-21626.patch47
48
-------------------------------------------------------------------49
Tue Jan 2 03:02:16 UTC 2024 - Aleksa Sarai <asarai@suse.com>50
51
- Update to runc v1.1.11. Upstream changelog is available from52
<https://github.com/opencontainers/runc/releases/tag/v1.1.11>.53
54
-------------------------------------------------------------------55
Wed Nov 1 07:25:46 UTC 2023 - Aleksa Sarai <asarai@suse.com>56
57
- Update to runc v1.1.10. Upstream changelog is available from58
<https://github.com/opencontainers/runc/releases/tag/v1.1.10>.59
60
-------------------------------------------------------------------61
Wed Sep 6 06:42:37 UTC 2023 - Danish Prakash <danish.prakash@suse.com>62
63
- Update to runc v1.1.9. Upstream changelog is available from64
<https://github.com/opencontainers/runc/releases/tag/v1.1.9>.65
66
-------------------------------------------------------------------67
Wed Jul 19 14:04:08 UTC 2023 - Aleksa Sarai <asarai@suse.com>68
69
- Update to runc v1.1.8. Upstream changelog is available from70
<https://github.com/opencontainers/runc/releases/tag/v1.1.8>.71
72
-------------------------------------------------------------------73
Thu Apr 27 09:43:31 UTC 2023 - Aleksa Sarai <asarai@suse.com>74
75
- Update to runc v1.1.7. Upstream changelog is available from76
<https://github.com/opencontainers/runc/releases/tag/v1.1.7>.77
- Update runc.keyring to upstream version.78
79
-------------------------------------------------------------------80
Wed Apr 12 04:17:29 UTC 2023 - Aleksa Sarai <asarai@suse.com>81
82
- Update to runc v1.1.6. Upstream changelog is available from83
<https://github.com/opencontainers/runc/releases/tag/v1.1.6>.84
85
-------------------------------------------------------------------86
Wed Mar 29 07:05:52 UTC 2023 - Aleksa Sarai <asarai@suse.com>87
88
- Update to runc v1.1.5. Upstream changelog is available from89
<https://github.com/opencontainers/runc/releases/tag/v1.1.5>.90
91
Includes fixes for the following CVEs:92
- CVE-2023-25809 bsc#120988493
- CVE-2023-27561 bsc#120896294
- CVE-2023-28642 bsc#120988895
96
* Fix the inability to use `/dev/null` when inside a container. bsc#116848197
* Fix changing the ownership of host's `/dev/null` caused by fd redirection98
(a regression in 1.1.1). bsc#120700499
* Fix rare runc exec/enter unshare error on older kernels.100
* nsexec: Check for errors in `write_log()`.101
102
- Drop version-specific Go requirement.103
104
-------------------------------------------------------------------105
Wed Aug 31 13:00:31 UTC 2022 - Fabian Vogt <fvogt@suse.com>106
107
- Update to runc v1.1.4. Upstream changelog is available from108
https://github.com/opencontainers/runc/releases/tag/v1.1.4.109
bsc#1202021110
111
* Fix mounting via wrong proc fd. When the user and mount namespaces are112
used, and the bind mount is followed by the cgroup mount in the spec,113
the cgroup was mounted using the bind mount's mount fd.114
* Switch kill() in libcontainer/nsenter to sane_kill().115
* Fix "permission denied" error from runc run on noexec fs.116
* Fix failed exec after systemctl daemon-reload. Due to a regression117
in v1.1.3, the DeviceAllow=char-pts rwm rule was no longer added and118
was causing an error open /dev/pts/0: operation not permitted: unknown when systemd was reloaded.119
(boo#1202821)120
121
-------------------------------------------------------------------122
Thu Jun 9 00:22:16 UTC 2022 - Aleksa Sarai <asarai@suse.com>123
124
- Update to runc v1.1.3. Upstream changelog is available from125
https://github.com/opencontainers/runc/releases/tag/v1.1.3.126
(Includes a fix for bsc#1200088.)127
128
* Our seccomp `-ENOSYS` stub now correctly handles multiplexed syscalls on129
s390 and s390x. This solves the issue where syscalls the host kernel did not130
support would return `-EPERM` despite the existence of the `-ENOSYS` stub131
code (this was due to how s390x does syscall multiplexing).132
* Retry on dbus disconnect logic in libcontainer/cgroups/systemd now works as133
intended; this fix does not affect runc binary itself but is important for134
libcontainer users such as Kubernetes.135
* Inability to compile with recent clang due to an issue with duplicate136
constants in libseccomp-golang.137
* When using systemd cgroup driver, skip adding device paths that don't exist,138
to stop systemd from emitting warnings about those paths.139
* Socket activation was failing when more than 3 sockets were used.140
* Various CI fixes.141
* Allow to bind mount /proc/sys/kernel/ns_last_pid to inside container.142
* runc static binaries are now linked against libseccomp v2.5.4.143
- Remove upstreamed patches:144
- bsc1192051-0001-seccomp-enosys-always-return-ENOSYS-for-setup-2-on-s390x.patch145
146
-------------------------------------------------------------------147
Mon May 23 03:02:32 UTC 2022 - Aleksa Sarai <asarai@suse.com>148
149
- Backport <https://github.com/opencontainers/runc/pull/3474> to fix issues150
with newer syscalls (namely faccessat2) on older kernels on s390(x) caused by151
that platform's syscall multiplexing semantics. bsc#1192051 bsc#1199565152
+ bsc1192051-0001-seccomp-enosys-always-return-ENOSYS-for-setup-2-on-s390x.patch153
154
-------------------------------------------------------------------155
Thu May 12 10:04:57 UTC 2022 - Aleksa Sarai <asarai@suse.com>156
157
- Add ExcludeArch for s390 (not s390x) since we've never supported it.158
159
-------------------------------------------------------------------160
Wed May 11 22:43:51 UTC 2022 - Aleksa Sarai <asarai@suse.com>161
162
- Update to runc v1.1.2. Upstream changelog is available from163
https://github.com/opencontainers/runc/releases/tag/v1.1.2.164
CVE-2022-29162 bsc#1199460165
166
* A bug was found in runc where runc exec --cap executed processes with167
non-empty inheritable Linux process capabilities, creating an atypical Linux168
environment. For more information, see [GHSA-f3fp-gc8g-vw66][] and169
CVE-2022-29162. bsc#1199460170
* `runc spec` no longer sets any inheritable capabilities in the created171
example OCI spec (`config.json`) file.172
173
-------------------------------------------------------------------174
Tue Mar 29 03:33:30 UTC 2022 - Aleksa Sarai <asarai@suse.com>175
176
- Update to runc v1.1.1. Upstream changelog is available from177
https://github.com/opencontainers/runc/releases/tag/v1.1.1.178
179
* runc run/start can now run a container with read-only /dev in OCI spec,180
rather than error out. (#3355)181
* runc exec now ensures that --cgroup argument is a sub-cgroup. (#3403)182
libcontainer systemd v2 manager no longer errors out if one of the files183
listed in /sys/kernel/cgroup/delegate do not exist in container's184
cgroup. (#3387, #3404)185
* Loosen OCI spec validation to avoid bogus "Intel RDT is not supported"186
error. (#3406)187
* libcontainer/cgroups no longer panics in cgroup v1 managers if stat188
of /sys/fs/cgroup/unified returns an error other than ENOENT. (#3435)189
190
-------------------------------------------------------------------191
Mon Jan 17 07:15:26 UTC 2022 - Aleksa Sarai <asarai@suse.com>192
193
- Update to runc v1.1.0. Upstream changelog is available from194
https://github.com/opencontainers/runc/releases/tag/v1.1.0.195
196
- libcontainer will now refuse to build without the nsenter package being197
correctly compiled (specifically this requires CGO to be enabled). This198
should avoid folks accidentally creating broken runc binaries (and199
incorrectly importing our internal libraries into their projects). (#3331)200
201
-------------------------------------------------------------------202
Tue Dec 14 05:04:21 UTC 2021 - Aleksa Sarai <asarai@suse.com>203
204
- Update to runc v1.1.0~rc1. Upstream changelog is available from205
https://github.com/opencontainers/runc/releases/tag/v1.1.0-rc.1.206
207
+ Add support for RDMA cgroup added in Linux 4.11.208
* runc exec now produces exit code of 255 when the exec failed.209
This may help in distinguishing between runc exec failures210
(such as invalid options, non-running container or non-existent211
binary etc.) and failures of the command being executed.212
+ runc run: new --keep option to skip removal exited containers artefacts.213
This might be useful to check the state (e.g. of cgroup controllers) after214
the container has•exited.215
+ seccomp: add support for SCMP_ACT_KILL_PROCESS and SCMP_ACT_KILL_THREAD216
(the latter is just an alias for SCMP_ACT_KILL).217
+ seccomp: add support for SCMP_ACT_NOTIFY (seccomp actions). This allows218
users to create sophisticated seccomp filters where syscalls can be219
efficiently emulated by privileged processes on the host.220
+ checkpoint/restore: add an option (--lsm-mount-context) to set221
a different LSM mount context on restore.222
+ intelrdt: support ClosID parameter.223
+ runc exec --cgroup: an option to specify a (non-top) in-container cgroup224
to use for the process being executed.225
+ cgroup v1 controllers now support hybrid hierarchy (i.e. when on a cgroup v1226
machine a cgroup2 filesystem is mounted to /sys/fs/cgroup/unified, runc227
run/exec now adds the container to the appropriate cgroup under it).228
+ sysctl: allow slashes in sysctl names, to better match sysctl(8)'s229
behaviour.230
+ mounts: add support for bind-mounts which are inaccessible after switching231
the user namespace. Note that this does not permit the container any232
additional access to the host filesystem, it simply allows containers to233
have bind-mounts configured for paths the user can access but have234
restrictive access control settings for other users.235
+ Add support for recursive mount attributes using mount_setattr(2). These236
have the same names as the proposed mount(8) options -- just prepend r237
to the option name (such as rro).238
+ Add runc features subcommand to allow runc users to detect what features239
runc has been built with. This includes critical information such as240
supported mount flags, hook names, and so on. Note that the output of this241
command is subject to change and will not be considered stable until runc242
1.2 at the earliest. The runtime-spec specification for this feature is243
being developed in opencontainers/runtime-spec#1130.244
* system: improve performance of /proc/$pid/stat parsing.245
* cgroup2: when /sys/fs/cgroup is configured as a read-write mount, change246
the ownership of certain cgroup control files (as per247
/sys/kernel/cgroup/delegate) to allow for proper deferral to the container248
process.249
* runc checkpoint/restore: fixed for containers with an external bind mount250
which destination is a symlink.251
* cgroup: improve openat2 handling for cgroup directory handle hardening.252
runc delete -f now succeeds (rather than timing out) on a paused253
container.254
* runc run/start/exec now refuses a frozen cgroup (paused container in case of255
exec). Users can disable this using --ignore-paused.256
- Update version data embedded in binary to correctly include the git commit of257
the release.258
- Drop runc-rpmlintrc because we don't have runc-test anymore.259
260
-------------------------------------------------------------------261
Mon Dec 6 04:38:25 UTC 2021 - Aleksa Sarai <asarai@suse.com>262
263
- Update to runc v1.0.3. Upstream changelog is available from264
https://github.com/opencontainers/runc/releases/tag/v1.0.3. CVE-2021-43784265
bsc#1193436266
267
* A potential vulnerability was discovered in runc (related to an internal268
usage of netlink), however upon further investigation we discovered that269
while this bug was exploitable on the master branch of runc, no released270
version of runc could be exploited using this bug. The exploit required271
being able to create a netlink attribute with a length that would overflow a272
uint16 but this was not possible in any released version of runc. For more273
information see GHSA-v95c-p5hm-xq8f and CVE-2021-43784.274
275
Due to an abundance of caution we decided to do an emergency release with276
this fix, but to reiterate we do not believe this vulnerability was277
possible to exploit. Thanks to Felix Wilhelm from Google Project Zero for278
discovering and reporting this vulnerability so quickly.279
* Fixed inability to start a container with read-write bind mount of a280
read-only fuse host mount.281
* Fixed inability to start when read-only /dev in set in spec.282
* Fixed not removing sub-cgroups upon container delete, when rootless cgroup283
v2 is used with older systemd.284
* Fixed returning error from GetStats when hugetlb is unsupported (which285
causes excessive logging for kubernetes).286
287
-------------------------------------------------------------------288
Mon Aug 23 09:35:05 UTC 2021 - Aleksa Sarai <asarai@suse.com>289
290
- Update to runc v1.0.2. Upstream changelog is available from291
https://github.com/opencontainers/runc/releases/tag/v1.0.2292
293
* Fixed a failure to set CPU quota period in some cases on cgroup v1.294
* Fixed the inability to start a container with the "adding seccomp filter295
rule for syscall ..." error, caused by redundant seccomp rules (i.e. those296
that has action equal to the default one). Such redundant rules are now297
skipped.298
* Made release builds reproducible from now on.299
* Fixed a rare debug log race in runc init, which can result in occasional300
harmful "failed to decode ..." errors from runc run or exec.301
* Fixed the check in cgroup v1 systemd manager if a container needs to be302
frozen before Set, and add a setting to skip such freeze unconditionally.303
The previous fix for that issue, done in runc 1.0.1, was not working.304
305
-------------------------------------------------------------------306
Sun Jul 18 02:40:16 UTC 2021 - Aleksa Sarai <asarai@suse.com>307
308
- Update to runc v1.0.1. Upstream changelog is available from309
https://github.com/opencontainers/runc/releases/tag/v1.0.1310
311
* Fixed occasional runc exec/run failure ("interrupted system call") on an312
Azure volume.313
* Fixed "unable to find groups ... token too long" error with /etc/group314
containing lines longer than 64K characters.315
* cgroup/systemd/v1: fix leaving cgroup frozen after Set if a parent cgroup is316
frozen. This is a regression in 1.0.0, not affecting runc itself but some317
of libcontainer users (e.g Kubernetes).318
* cgroupv2: bpf: Ignore inaccessible existing programs in case of319
permission error when handling replacement of existing bpf cgroup320
programs. This fixes a regression in 1.0.0, where some SELinux321
policies would block runc from being able to run entirely.322
* cgroup/systemd/v2: don't freeze cgroup on Set.323
* cgroup/systemd/v1: avoid unnecessary freeze on Set.324
325
- Remove upstreamed patches:326
+ boo1187704-0001-cgroupv2-ebpf-ignore-inaccessible-existing-programs.patch327
328
-------------------------------------------------------------------329
Thu Jul 1 03:39:56 UTC 2021 - Aleksa Sarai <asarai@suse.com>330
331
- Backport <https://github.com/opencontainers/runc/pull/3055> to fix issues332
with runc under openSUSE MicroOS's SELinux policy. boo#1187704333
+ boo1187704-0001-cgroupv2-ebpf-ignore-inaccessible-existing-programs.patch334
335
-------------------------------------------------------------------336
Tue Jun 1 11:00:30 UTC 2021 - Aleksa Sarai <asarai@suse.com>337
338
- Update to runc v1.0.0. Upstream changelog is available from339
https://github.com/opencontainers/runc/releases/tag/v1.0.0340
341
! The usage of relative paths for mountpoints will now produce a warning342
(such configurations are outside of the spec, and in future runc will343
produce an error when given such configurations).344
345
* cgroupv2: devices: rework the filter generation to produce consistent346
results with cgroupv1, and always clobber any existing eBPF347
program(s) to fix runc update and avoid leaking eBPF programs348
(resulting in errors when managing containers).349
* cgroupv2: correctly convert "number of IOs" statistics in a350
cgroupv1-compatible way.351
* cgroupv2: support larger than 32-bit IO statistics on 32-bit architectures.352
* cgroupv2: wait for freeze to finish before returning from the freezing353
code, optimize the method for checking whether a cgroup is frozen.354
* cgroups/systemd: fixed "retry on dbus disconnect" logic introduced in rc94355
* cgroups/systemd: fixed returning "unit already exists" error from a systemd356
cgroup manager (regression in rc94)357
358
+ cgroupv2: support SkipDevices with systemd driver359
+ cgroup/systemd: return, not ignore, stop unit error from Destroy360
+ Make "runc --version" output sane even when built with go get or361
otherwise outside of our build scripts.362
+ cgroups: set SkipDevices during runc update (so we don't modify363
cgroups at all during runc update).364
+ cgroup1: blkio: support BFQ weights.365
+ cgroupv2: set per-device io weights if BFQ IO scheduler is available.366
367
-------------------------------------------------------------------368
Wed May 19 10:00:00 UTC 2021 - Aleksa Sarai <asarai@suse.com>369
370
- Update to runc v1.0.0~rc95. Upstream changelog is available from371
https://github.com/opencontainers/runc/releases/tag/v1.0.0-rc95372
373
This release of runc contains a fix for CVE-2021-30465, and users are374
strongly recommended to update (especially if you are providing375
semi-limited access to spawn containers to untrusted users). bsc#1185405376
377
-------------------------------------------------------------------378
Wed May 12 08:03:58 UTC 2021 - Aleksa Sarai <asarai@suse.com>379
380
- Update to runc v1.0.0~rc94. Upstream changelog is available from381
https://github.com/opencontainers/runc/releases/tag/v1.0.0-rc94382
Breaking Changes:383
* cgroupv1: kernel memory limits are now always ignored, as kmemcg has384
been effectively deprecated by the kernel. Users should make use of regular385
memory cgroup controls.386
Regression Fixes:387
* seccomp: fix 32-bit compilation errors388
* runc init: fix a hang caused by deadlock in seccomp/ebpf loading code389
* runc start: fix "chdir to cwd: permission denied" for some setups390
- Remove upstreamed patches:391
- 0001-cloned_binary-switch-from-error-to-warning-for-SYS_m.patch392
393
-------------------------------------------------------------------394
Mon Apr 26 07:54:54 UTC 2021 - Aleksa Sarai <asarai@suse.com>395
396
- Backport patch to fix build on SLE-12 ppc64le.397
+ 0001-cloned_binary-switch-from-error-to-warning-for-SYS_m.patch398
399
-------------------------------------------------------------------400
Wed Feb 3 04:09:17 UTC 2021 - Aleksa Sarai <asarai@suse.com>401
402
- Update to runc v1.0.0~rc93. Upstream changelog is available from403
https://github.com/opencontainers/runc/releases/tag/v1.0.0-rc93404
bsc#1182451 bsc#1184962405
406
* Cgroupv2 support is no longer considered experimental.407
* Mountinfo parsing code has been reworked significantly.408
* Special ENOSYS handling for seccomp profiles to avoid making new409
syscalls unusable for glibc.410
* Various rootless containers improvements.411
* The "selinux" and "apparmor" buildtags have been removed, and now all runc412
builds will have SELinux and AppArmor support enabled.413
414
-------------------------------------------------------------------415
Tue Feb 2 05:53:17 UTC 2021 - Aleksa Sarai <asarai@suse.com>416
417
- Update to handle the docker-runc removal. bsc#1181677418
- Modernise go building for runc now that it has go.mod.419
420
-------------------------------------------------------------------421
Fri Aug 28 07:38:29 UTC 2020 - Ralf Haferkamp <rhafer@suse.com>422
423
- Upgrade to runc v1.0.0~rc92 (bsc#1175821). Upstream changelog is available424
from https://github.com/opencontainers/runc/releases/tag/v1.0.0-rc92425
426
* Updates to CRIU support.427
* Improvements to cgroupfs performance and correctness.428
429
-------------------------------------------------------------------430
Thu Jul 2 01:24:49 UTC 2020 - Aleksa Sarai <asarai@suse.com>431
432
- Upgrade to runc v1.0.0~rc91. Upstream changelog is available from433
https://github.com/opencontainers/runc/releases/tag/v1.0.0-rc91434
435
* This release of runc has experimental support for cgroupv2-only systems.436
437
- Remove upstreamed patches:438
- bsc1149954-0001-sd-notify-do-not-hang-when-NOTIFY_SOCKET-is-used-wit.patch439
- bsc1168481-0001-cgroup-devices-major-cleanups-and-minimal-transition.patch440
441
-------------------------------------------------------------------442
Thu Jun 25 22:34:03 UTC 2020 - Aleksa Sarai <asarai@suse.com>443
444
- Switch to Go 1.13 for build.445
446
-------------------------------------------------------------------447
Wed May 13 06:49:44 UTC 2020 - Aleksa Sarai <asarai@suse.com>448
449
- Backport https://github.com/opencontainers/runc/pull/2391 to help fix450
bsc#1168481.451
+ bsc1168481-0001-cgroup-devices-major-cleanups-and-minimal-transition.patch452
453
-------------------------------------------------------------------454
Tue Apr 14 10:16:21 UTC 2020 - Ralf Haferkamp <rhafer@suse.com>455
456
- Renamed patch:457
0001-sd-notify-do-not-hang-when-NOTIFY_SOCKET-is-used-wit.patch458
to459
bsc1149954-0001-sd-notify-do-not-hang-when-NOTIFY_SOCKET-is-used-wit.patch460
461
-------------------------------------------------------------------462
Wed Mar 18 08:57:34 UTC 2020 - Ralf Haferkamp <rhafer@suse.com>463
464
- Added fix for bsc#1149954465
* 0001-sd-notify-do-not-hang-when-NOTIFY_SOCKET-is-used-wit.patch466
(cherry pick of https://github.com/opencontainers/runc/pull/1807)467
468
-------------------------------------------------------------------469
Thu Jan 23 17:18:05 UTC 2020 - Aleksa Sarai <asarai@suse.com>470
471
- Upgrade to runc v1.0.0~rc10. Upstream changelog is available from472
https://github.com/opencontainers/runc/releases/tag/v1.0.0-rc10473
- Drop upstreamed patches:474
- CVE-2019-19921.patch475
476
-------------------------------------------------------------------477
Tue Jan 21 22:10:58 UTC 2020 - Bjørn Lie <bjorn.lie@gmail.com>478
479
- Change packagewide go version to be greater or equal to 1.10.480
481
-------------------------------------------------------------------482
Fri Jan 17 03:02:46 UTC 2020 - Aleksa Sarai <asarai@suse.com>483
484
- Update CVE-2019-19921 patch to match upstream PR.485
* CVE-2019-19921.patch486
487
-------------------------------------------------------------------488
Tue Jan 14 04:44:36 UTC 2020 - Aleksa Sarai <asarai@suse.com>489
490
- Add backported fix for CVE-2019-19921. bsc#1160452491
+ CVE-2019-19921.patch492
493
-------------------------------------------------------------------494
Sat Oct 5 11:40:13 UTC 2019 - Aleksa Sarai <asarai@suse.com>495
496
- Upgrade to runc v1.0.0~rc9. Upstream changelog is available from497
https://github.com/opencontainers/runc/releases/tag/v1.0.0-rc9498
- Remove upstreamed patches:499
- CVE-2019-16884.patch500
501
-------------------------------------------------------------------502
Thu Sep 26 14:54:07 UTC 2019 - Aleksa Sarai <asarai@suse.com>503
504
- Add backported fix for CVE-2019-16884. bsc#1152308505
+ CVE-2019-16884.patch506
- Add runc-rpmlintrc to drop runc-test rpmlint warnings.507
508
-------------------------------------------------------------------509
Mon Apr 29 11:56:21 UTC 2019 - Aleksa Sarai <asarai@suse.com>510
511
- Upgrade to runc v1.0.0~rc8. Upstream changelog is available from512
https://github.com/opencontainers/runc/releases/tag/v1.0.0-rc8513
- Includes upstreamed patches for regressions (bsc#1131314 bsc#1131553).514
- Remove upstreamed patches:515
- CVE-2019-5736.patch516
517
-------------------------------------------------------------------518
Wed Feb 6 08:10:47 UTC 2019 - Aleksa Sarai <asarai@suse.com>519
520
- Add fix for CVE-2019-5736 (effectively copying /proc/self/exe during re-exec521
to avoid write attacks to the host runc binary). bsc#1121967522
+ CVE-2019-5736.patch523
524
-------------------------------------------------------------------525
Wed Dec 19 19:55:11 UTC 2018 - clee@suse.com526
527
- Update go requirements to >= go1.10 to fix528
* bsc#1118897 CVE-2018-16873529
go#29230 cmd/go: remote command execution during "go get -u"530
* bsc#1118898 CVE-2018-16874531
go#29231 cmd/go: directory traversal in "go get" via curly braces in import paths532
* bsc#1118899 CVE-2018-16875533
go#29233 crypto/x509: CPU denial of service534
535
-------------------------------------------------------------------536
Thu Dec 13 04:34:25 UTC 2018 - dorf@suse.com537
538
- Require golang = 1.10.539
540
-------------------------------------------------------------------541
Thu Nov 29 09:10:09 UTC 2018 - Aleksa Sarai <asarai@suse.com>542
543
- Upgrade to runc v1.0.0~rc6. Upstream changelog is available from544
https://github.com/opencontainers/runc/releases/tag/v1.0.0-rc6545
546
-------------------------------------------------------------------547
Wed Oct 31 14:01:03 UTC 2018 - Valentin Rothberg <vrothberg@suse.com>548
549
- Create a symlink in /usr/bin/runc to enable rootless Podman and Buildah.550
551
-------------------------------------------------------------------552
Wed Jun 13 12:59:09 UTC 2018 - dcassany@suse.com553
554
- Make use of %license macro555
556
-------------------------------------------------------------------557
Tue Jun 5 06:38:40 UTC 2018 - asarai@suse.com558
559
- Remove 'go test' from %check section, as it has only ever caused us problems560
and hasn't (as far as I remember) ever caught a release-blocking issue. Smoke561
testing has been far more useful. boo#1095817562
563
-------------------------------------------------------------------564
Tue Feb 27 17:18:32 UTC 2018 - asarai@suse.com565
566
- Upgrade to runc v1.0.0~rc5. Upstream changelog is available from567
https://github.com/opencontainers/runc/releases/tag/v1.0.0-rc5568
- Remove patch now merged upstream.569
- bsc1053532-0001-makefile-drop-usage-of-install.patch570
571
-------------------------------------------------------------------572
Thu Aug 17 04:39:56 UTC 2017 - asarai@suse.com573
574
- Use .tar.xz provided by upstream, as well as include the keyring to allow575
full provenance of the source.576
577
-------------------------------------------------------------------578
Sun Aug 13 14:25:32 UTC 2017 - asarai@suse.com579
580
- Use the upstream Makefile, to ensure that we always include the version581
information in runc. This was confusing users (and Docker). bsc#1053532582
- Add a backported patch to fix a Makefile bug.583
https://github.com/opencontainers/runc/pull/1555584
+ bsc1053532-0001-makefile-drop-usage-of-install.patch585
586
-------------------------------------------------------------------587
Thu Aug 10 17:14:02 UTC 2017 - asarai@suse.com588
589
- Update to runc v1.0.0-rc4. Upstream changelog:590
+ runc now supports v1.0.0 of the OCI runtime specification. #1527591
+ Rootless containers support has been released. The current state of592
this feature is that it only supports single-{uid,gid} mappings as an593
unprivileged user, and cgroups are completely unsupported. Work is594
being done to improve this. #774595
+ Rather than relying on CRIU version nnumbers, actually check if the596
system supports pre-dumping. #1371597
+ Allow the PIDs cgroup limit to be updated. #1423598
+ Add support for checkpoint/restore of containers with orphaned PTYs599
(which is effectively all containers with terminal=true). #1355600
+ Permit prestart hooks to modify the cgroup configuration of a601
container. #1239602
+ Add support for a wide variety of mount options. #1460603
+ Expose memory.use_hierarchy in MemoryStats. #1378604
* Fix incorrect handling of systems without the freezer cgroup. #1387605
* Many, many changes to switch away from Go's "syscall" stdlib to606
"golang.org/x/sys/unix". #1394 #1398 #1442 #1464 #1467 #1470 #1474607
#1478 #1491 #1482 #1504 #1519 #1530608
* Set cgroup resources when restoring a container. #1399609
* Switch back to using /sbin as the installation directory. #1406610
* Remove the arbitrary container ID length restriction. #1435611
* Make container force deletion ignore non-existent containers. #1451612
* Improve handling of arbitrary cgroup mount locations when populating613
cpuset. #1372614
* Make the SaneTerminal interface public. #1479615
* Fix cases where runc would report a container to be in a "Running"616
state if the init was a zombie or dead. #1489617
* Do not set supplementary groups for numeric users. #1450618
* Fix various issues with the "owner" field in runc-list. #1516619
* Many other miscellaneous fixes, some of which were made by first-time620
contributors. Thanks, and welcome to the project! #1406 #1400 #1365621
#1396 #1402 #1414 #1412 #1408 #1418 #1425 #1428 #1436 #1433 #1438622
#1410 #1447 #1388 #1484 #1481 #1496 #1245 #1524 #1534 #1526 #1533623
- Remove any semblance of non-Linux support. #1502624
- We no longer use shfmt for testing. #1510625
626
-------------------------------------------------------------------627
Wed Aug 2 13:51:43 UTC 2017 - asarai@suse.com628
629
- Use -buildmode=pie for tests and binary build. bsc#1048046 bsc#1051429630
- Cleanup seccomp builds similar to bsc#1028638631
- Remove the usage of 'cp -r' to reduce noise in the build logs.632
633
-------------------------------------------------------------------634
Thu Jul 6 17:14:17 UTC 2017 - thipp@suse.de635
636
- switch to opencontainers/runc master branch637
- remove CVE-2016-9962.patch638
- stop providing docker-runc639
640
-------------------------------------------------------------------641
Thu May 4 19:04:49 UTC 2017 - jmassaguerpla@suse.com642
643
- fix the golang requirement to 1.7 to the subpackages644
645
-------------------------------------------------------------------646
Tue May 2 15:49:41 UTC 2017 - jmassaguerpla@suse.com647
648
- fix golang requirement to 1.7649
650
-------------------------------------------------------------------651
Fri Apr 28 16:16:00 UTC 2017 - jengelh@inai.de652
653
- Substitute %__-type macro indirections654
655
-------------------------------------------------------------------656
Thu Apr 13 16:34:03 UTC 2017 - jmassaguerpla@suse.com657
658
- update version to the one required by docker-17.04.0-ce (bsc#1034053)659
remove ignore_cgroup2_mountpoint.patch . This is already included in660
the upstream source code.661
662
-------------------------------------------------------------------663
Wed Apr 12 09:55:28 UTC 2017 - jmassaguerpla@suse.com664
665
- Make sure this is being built with go 1.7666
667
-------------------------------------------------------------------668
Tue Apr 11 15:37:36 UTC 2017 - jmassaguerpla@suse.com669
670
- remove the go_arches macro because we are using go1.7 which671
is available in all archs672
673
-------------------------------------------------------------------674
Wed Mar 29 15:47:52 UTC 2017 - jmassaguerpla@suse.com675
676
- fix bsc#1028113 - runc: make sure to ignore cgroup v2 mountpoints677
This is a backport of https://github.com/opencontainers/runc/pull/1266678
+ ignore_cgroup2_mountpoint.patch679
680
-------------------------------------------------------------------681
Fri Feb 24 18:08:10 UTC 2017 - jmassaguerpla@suse.com682
683
- update to docker-1.13.0 requirement684
685
-------------------------------------------------------------------686
Fri Jan 13 13:58:33 UTC 2017 - jmassaguerpla@suse.com687
688
- fix CVE-2016-9962 bsc#1012568 and applying the patch689
CVE-2016-9962.patch, because 1.12.6 partially fixes it (it contains690
the first patch attached in bsc#1012568)691
692
-------------------------------------------------------------------693
Mon Dec 19 12:49:38 UTC 2016 - jmassaguerpla@suse.com694
695
- update runc to the version used in docker 1.12.5 (bsc#1016307).696
This fixes bsc#1015661697
698
-------------------------------------------------------------------699
Mon Dec 19 12:17:07 UTC 2016 - asarai@suse.com700
701
- For the moment, we have to switch to using Docker's fork of runC. This *will*702
be solved properly by creating a new package purely for Docker's runC fork,703
because it's quite silly to tie OCI project releases to Docker's vendoring704
scheme. Once this is fixed, this package will be switch to being purely-OCI.705
706
-------------------------------------------------------------------707
Fri Dec 16 17:05:37 UTC 2016 - jmassaguerpla@suse.com708
709
- add the /usr/bin/docker-run symlink to partially fix bsc#1015661710
711
-------------------------------------------------------------------712
Thu Nov 24 11:05:41 UTC 2016 - jmassaguerpla@suse.com713
714
- fix version by adding a revision "counter" so that it will always715
increase716
717
fix bsc#1009961718
719
-------------------------------------------------------------------720
Thu Oct 13 11:04:27 UTC 2016 - jmassaguerpla@suse.com721
722
- update to 02f8fa7 because that is the needed version for docker 1.12.1 (bsc#1004490)723
724
-------------------------------------------------------------------725
Wed Sep 21 05:13:26 UTC 2016 - jengelh@inai.de726
727
- Run fdupes.728
729
-------------------------------------------------------------------730
Mon Sep 19 11:57:45 UTC 2016 - jmassaguerpla@suse.com731
732
- fix go_arches definition: use global instead of define, otherwise733
it fails to build734
735
-------------------------------------------------------------------736
Fri Aug 26 08:59:54 UTC 2016 - asarai@suse.com737
738
- Remove docker-runc symlink because it's been fixed within the Docker739
package. bsc#978260740
741
-------------------------------------------------------------------742
Thu Aug 25 17:02:33 UTC 2016 - jmassaguerpla@suse.com743
744
- Create a symlink /usr/sbin/docker-runc -> /usr/sbin/docker745
Docker expects this symlink to exist bsc#978260746
747
-------------------------------------------------------------------748
Thu Aug 25 15:56:00 UTC 2016 - jmassaguerpla@suse.com749
750
- Remove GOPATH at the end of the GOPATH assignment751
cause GOPATH is empty and if we do that, we get the path ""752
appended, which causes gcc6-go to complain753
754
-------------------------------------------------------------------755
Wed Aug 24 12:27:57 UTC 2016 - jmassaguerpla@suse.com756
757
- add go_arches in project configuration: this way, we can use the758
same spec file but decide in the project configuration if to759
use gc-go or gcc-go for some archs.760
761
-------------------------------------------------------------------762
Thu Aug 18 10:35:29 UTC 2016 - jmassaguerpla@suse.com763
764
- use gcc6-go instead of gcc5-go (bsc#988408)765
- build ppc64le with gc-go because this version builds with gc-go 1.6766
767
-------------------------------------------------------------------768
Thu Aug 18 10:34:29 UTC 2016 - cbrauner@suse.de769
770
- bump git commit id to the one required by docker v1.12.0 (bsc#995058)771
- run unit tests during package build772
- remove seccomp-use-pkg-config.patch773
The patch is now upstream.774
- remove GO_BUILD_FLAGS macro and substitute with BUILDFLAGS env variable to775
allow for easier string appending.776
- only run unit test on architectures that provide the go list and go test tools777
778
-------------------------------------------------------------------779
Wed Aug 17 10:29:15 UTC 2016 - cbrauner@suse.de780
781
- Add runc-test package which contains the source code and the test. This782
package will be used to run the integration tests.783
- Simplify package build and check sections: Instead of symlinking we default to784
cp -avr. go list gets confused by symlinks hence, we need to copy the source785
code anyway if we want to run unit tests during package build at some point.786
787
-------------------------------------------------------------------788
Fri Apr 29 09:03:24 UTC 2016 - asarai@suse.de789
790
* Update to runC 0.1.1. (bsc#989566 FATE#320763) Changelog from upstream:791
792
This release includes a bug fix for adding the selinux mount label in the specification.793
794
-------------------------------------------------------------------795
Tue Apr 19 09:59:05 UTC 2016 - asarai@suse.de796
797
* Don't use gcc-go for aarch64, since gc has grown support for it and is more798
stable.799
800
-------------------------------------------------------------------801
Fri Apr 15 10:46:04 UTC 2016 - asarai@suse.de802
803
* Disable seccomp entirely for aarch64 builds, since it is not provided on all804
SUSE platforms.805
806
-------------------------------------------------------------------807
Wed Apr 13 12:03:09 UTC 2016 - asarai@suse.de808
809
* Update to runC 0.1.0. Changelog from upstream:810
811
This release updates runc to the OCI runtime specification v0.5.0 and includes812
various fixes and features.813
814
Features:815
+ cgroups: pid limits and stats816
+ cgroups: kmem stats817
+ systemd cgroup support818
+ libcontainer specconv package819
+ no pivot root option820
+ numeric ids are treated as uid/gid821
+ hook improvements822
823
Bug Fixes:824
* log flushing825
* atomic pid file creation826
* init error recovery827
* seccomp logging removed828
* delete container on aborted start829
* /dev bind mount handling830
831
-------------------------------------------------------------------832
Wed Mar 30 14:18:18 UTC 2016 - asarai@suse.de833
834
* Install to /usr/sbin. https://github.com/opencontainers/runc/pull/702835
836
-------------------------------------------------------------------837
Sun Mar 27 14:50:32 UTC 2016 - asarai@suse.de838
839
* Added runC man pages.840
* Recommended criu, since it's required for the checkpoint and restore841
functionality.842
843
-------------------------------------------------------------------844
Sun Mar 27 10:14:32 UTC 2016 - asarai@suse.de845
846
* Small updates to method of compilation to better match Makefile.847
848
-------------------------------------------------------------------849
Mon Mar 21 12:04:59 UTC 2016 - asarai@suse.de850
851
* Make compilation work on gcc-go only systems (ppc and s390).852
853
-------------------------------------------------------------------854
Mon Mar 21 08:24:02 UTC 2016 - asarai@suse.de855
856
* initial import of runC 0.0.9857
* add patch seccomp-use-pkg-config.patch which allows us to build runC, since858
they assume that the seccomp.h file lives at /usr/include/seccomp.h.859
860