Update module github.com/opencontainers/runc to v1.1.8 #1570
Conversation
![renovate[bot]](https://avatars.githubusercontent.com/in/2740?s=60&v=4){kind=small}
renovate
bot
force-pushed
the
renovate/github.com-opencontainers-runc-1.x
branch
from
ba1679f
to
b89acfd
Compare
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: renovate[bot] The full list of commands accepted by this bot can be found here.
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
|
runc is going to cause a big bump in size... |
renovate
bot
force-pushed
the
renovate/github.com-opencontainers-runc-1.x
branch
3 times, most recently
from
5be0c16
to
9010c41
Compare
|
renovate
bot
force-pushed
the
renovate/github.com-opencontainers-runc-1.x
branch
from
9010c41
to
2de76b2
Compare
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
renovate
bot
force-pushed
the
renovate/github.com-opencontainers-runc-1.x
branch
from
2de76b2
to
801c932
Compare
|
this is a downgrade, we use main (1.2) but it tries to downgrade us to 1.1 |
Renovate Ignore NotificationBecause you closed this PR without merging, Renovate will ignore this update (v1.1.8). You will get a PR once a newer version is released. To ignore this dependency forever, add it to the If you accidentally closed this PR, or if you changed your mind: rename this PR to get a fresh replacement PR. |
This PR contains the following updates:
v1.1.1-0.20220617142545-8b9452f75cbc->v1.1.8Release Notes
opencontainers/runc (github.com/opencontainers/runc)
v1.1.8: runc 1.1.8 -- "海纳百川 有容乃大"Compare Source
This is the eighth patch release of the 1.1.z release branch of runc.
The most notable change is the addition of RISC-V support, along with a
few bug fixes.
.codespellrc: update for 2.2.5. (#3909)Static Linking Notices
The
runcbinary distributed with this release are statically linked withthe following GNU LGPL-2.1 licensed libraries, with
runcactingas a "work that uses the Library":
The versions of these libraries were not modified from their upstream versions,
but in order to comply with the LGPL-2.1 (§6(a)), we have attached the
complete source code for those libraries which (when combined with the attached
runc source code) may be used to exercise your rights under the LGPL-2.1.
However we strongly suggest that you make use of your distribution's packages
or download them from the authoritative upstream sources, especially since
these libraries are related to the security of your containers.
Thanks to all of the contributors who made this release possible:
Signed-off-by: Aleksa Sarai [email protected]
v1.1.7: runc 1.1.7 -- "Ночевала тучка золотая на груди утеса-великана."Compare Source
This is the seventh patch release in the 1.1.z release of runc, and is
the last planned release of the 1.1.z series. It contains a fix for
cgroup device rules with systemd when handling device rules for devices
that don't exist (though for devices whose drivers don't correctly
register themselves in the kernel -- such as the NVIDIA devices -- the
full fix only works with systemd v240+).
DeviceAllowrules if the device does not exist (a regression introducedin runc 1.1.3). This fix also reverts the workaround added in runc 1.1.5,
removing an extra warning emitted by runc run/start. (#3845, #3708, #3671)
runc.keyring, which contains the keysused to sign runc releases. (#3838)
Static Linking Notices
The
runcbinary distributed with this release are statically linked withthe following GNU LGPL-2.1 licensed libraries, with
runcactingas a "work that uses the Library":
The versions of these libraries were not modified from their upstream versions,
but in order to comply with the LGPL-2.1 (§6(a)), we have attached the
complete source code for those libraries which (when combined with the attached
runc source code) may be used to exercise your rights under the LGPL-2.1.
However we strongly suggest that you make use of your distribution's packages
or download them from the authoritative upstream sources, especially since
these libraries are related to the security of your containers.
Thanks to all of the contributors who made this release possible:
Signed-off-by: Aleksa Sarai [email protected]
v1.1.6: runc 1.1.6 -- "In this world nothing is certain but death and taxes."Compare Source
This is the sixth path release in the 1.1.z series of runc, which fixes
a series of cgroup-related issues.
Note that this release can no longer be built from sources using Go
1.16. Using a latest maintained Go 1.20.x or Go 1.19.x release is
recommended. Go 1.17 can still be used.
UnitExisterrorfrom systemd while trying to create a systemd unit, which in some scenarios
may result in a container not being added to the proper systemd unit and
cgroup. (#3780, #3806)
resources.cpu.cpusto systemd unit property (AllowedCPUs) in case of morethan 8 CPUs, resulting in the wrong AllowedCPUs setting. (#3808)
of PID 1 cgroup, resulting in inability to place PID 1 in a non-root cgroup.
(#3811)
container when the file to be executed does not have executable bit set for
the user, not taking the
CAP_DAC_OVERRIDEcapability into account. This isa regression in runc 1.1.4, as well as in Go 1.20 and 1.20.1 (#3715, #3817)
misccontroller. (#3823)Known issues
Static Linking Notices
The
runcbinary distributed with this release are statically linked withthe following GNU LGPL-2.1 licensed libraries, with
runcactingas a "work that uses the Library":
The versions of these libraries were not modified from their upstream versions,
but in order to comply with the LGPL-2.1 (§6(a)), we have attached the
complete source code for those libraries which (when combined with the attached
runc source code) may be used to exercise your rights under the LGPL-2.1.
However we strongly suggest that you make use of your distribution's packages
or download them from the authoritative upstream sources, especially since
these libraries are related to the security of your containers.
Thanks to all of the contributors who made this release possible:
Signed-off-by: Aleksa Sarai [email protected]
v1.1.5: runc 1.1.5 -- "囚われた屈辱は 反撃の嚆矢だ"Compare Source
This is the fifth patch release in the 1.1.z series of runc, which fixes
three CVEs found in runc.
CVE-2023-25809 is a vulnerability involving rootless containers where
(under specific configurations), the container would have write access
to the /sys/fs/cgroup/user.slice/... cgroup hierarchy. No other
hierarchies on the host were affected. This vulnerability was
discovered by Akihiro Suda.
GHSA-m8cg-xc2p-r3fc
CVE-2023-27561 was a regression which effectively re-introduced
CVE-2019-19921. This bug was present from v1.0.0-rc95 to v1.1.4. This
regression was discovered by @Beuc.
GHSA-vpvm-3wq2-2wvm
CVE-2023-28642 is a variant of CVE-2023-27561 and was fixed by the same
patch. This variant of the above vulnerability was reported by Lei
Wang.
GHSA-g2j6-57v7-gm8c
In addition, the following other fixes are included in this release:
/dev/nullwhen inside a container. (#3620)/dev/nullcaused by fd redirection(a regression in 1.1.1). (#3674, #3731)
CentOS < 7.7. (#3776)
write_log(). (#3721)Static Linking Notices
The
runcbinary distributed with this release are statically linked withthe following GNU LGPL-2.1 licensed libraries, with
runcactingas a "work that uses the Library":
The versions of these libraries were not modified from their upstream versions,
but in order to comply with the LGPL-2.1 (§6(a)), we have attached the
complete source code for those libraries which (when combined with the attached
runc source code) may be used to exercise your rights under the LGPL-2.1.
However we strongly suggest that you make use of your distribution's packages
or download them from the authoritative upstream sources, especially since
these libraries are related to the security of your containers.
Thanks to all of the contributors who made this release possible:
[Due to the security-critical nature of this release, it was released
without a direct vote but was agreed to by the required number of
maintainers.]
Signed-off-by: Aleksa Sarai [email protected]
v1.1.4: runc 1.1.4 -- "If you look for perfection, you'll never be content."Compare Source
This is the fourth patch release in the 1.1.z series of runc, primarily
fixing a regression introduced in 1.1.3 related to device rules. It also
fixes a few other bugs.
used, and the bind mount is followed by the cgroup mount in the spec,
the cgroup was mounted using the bind mount's mount fd. (#3511)
kill()inlibcontainer/nsentertosane_kill(). (#3536)runc runonnoexecfs. (#3541)systemctl daemon-reload. Due to a regressionin v1.1.3, the
DeviceAllow=char-pts rwmrule was no longer added andwas causing an error
open /dev/pts/0: operation not permitted: unknownwhen systemd was reloaded. (#3554)Static Linking Notices
The
runcbinary distributed with this release are statically linked withthe following GNU LGPL-2.1 licensed libraries, with
runcactingas a "work that uses the Library":
The versions of these libraries were not modified from their upstream versions,
but in order to comply with the LGPL-2.1 (§6(a)), we have attached the
complete source code for those libraries which (when combined with the attached
runc source code) may be used to exercise your rights under the LGPL-2.1.
However we strongly suggest that you make use of your distribution's packages
or download them from the authoritative upstream sources, especially since
these libraries are related to the security of your containers.
Thanks to all of the contributors who made this release possible:
Signed-off-by: Aleksa Sarai [email protected]
v1.1.3: runc 1.1.3 -- "In the beginning there was nothing, which exploded."Compare Source
This is the third release of the 1.1.z series of runc, and contains
various minor improvements and bugfixes.
-ENOSYSstub now correctly handles multiplexed syscalls ons390 and s390x. This solves the issue where syscalls the host kernel did not
support would return
-EPERMdespite the existence of the-ENOSYSstubcode (this was due to how s390x does syscall multiplexing). (#3478)
intended; this fix does not affect runc binary itself but is important for
libcontainer users such as Kubernetes. (#3476)
constants in libseccomp-golang. (#3477)
to stop systemd from emitting warnings about those paths. (#3504)
Static Linking Notices
The
runcbinary distributed with this release are statically linked withthe following GNU LGPL-2.1 licensed libraries, with
runcactingas a "work that uses the Library":
The versions of these libraries were not modified from their upstream versions,
but in order to comply with the LGPL-2.1 (§6(a)), we have attached the
complete source code for those libraries which (when combined with the attached
runc source code) may be used to exercise your rights under the LGPL-2.1.
However we strongly suggest that you make use of your distribution's packages
or download them from the authoritative upstream sources, especially since
these libraries are related to the security of your containers.
Thanks to all of the contributors who made this release possible:
Signed-off-by: Aleksa Sarai [email protected]
v1.1.2: runc 1.1.2 -- "I should think I’m going to be a perpetual student."Compare Source
This is the second patch release of the runc 1.1 release branch. It
fixes CVE-2022-29162, a minor security issue (which appears to not be
exploitable) related to process capabilities.
This is a similar bug to the ones found and fixed in Docker and
containerd recently (CVE-2022-24769).
non-empty inheritable Linux process capabilities, creating an atypical Linux
environment. For more information, see GHSA-f3fp-gc8g-vw66 and
CVE-2022-29162.
runc specno longer sets any inheritable capabilities in the createdexample OCI spec (
config.json) file.Static Linking Notices
The
runcbinary distributed with this release are statically linked withthe following GNU LGPL-2.1 licensed libraries, with
runcactingas a "work that uses the Library":
The versions of these libraries were not modified from their upstream versions,
but in order to comply with the LGPL-2.1 (§6(a)), we have attached the
complete source code for those libraries which (when combined with the attached
runc source code) may be used to exercise your rights under the LGPL-2.1.
However we strongly suggest that you make use of your distribution's packages
or download them from the authoritative upstream sources, especially since
these libraries are related to the security of your containers.
Configuration
📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR has been generated by Mend Renovate. View repository job log here.