Releases: apptainer/singularity
Singularity 3.5.3
Singularity 3.5.3 is a bugfix release with the following changes and fixes:
Changed defaults / behaviours
The following minor behaviour changes have been made in 3.5.3 to allow correct operation on CRAY CLE6, and correct an issue with multi-stage image builds that was blocking use by build systems such as Spack:
- Container action scripts are no longer bound in from
etc/actions.d
on the host. They are created dynamically and inserted at container startup. %files from ...
will no longer follow symlinks when copying between stages in a multi stage build, as symlinks should be copied so that they resolve identically in later stages. Copying%files
from the host will still maintain previous behavior of following links.
Bug Fixes
- Bind additional CUDA 10.2 libs when using the
--nv
option withoutnvidia-container-cli
. - Fix an NVIDIA persistenced socket bind error with
--writable
. - Add detection of ceph to allow workarounds that avoid issues with sandboxes on ceph filesystems.
- Ensure setgid is inherited during make install.
- Ensure the root directory of a build has owner write permissions, regardless of the permissions in the bootstrap source.
- Fix a regression in
%post
and%test
to honor the-c
option. - Fix an issue running
%post
when a container doesn't have/etc/resolv.conf
or/etc/hosts
files. - Fix an issue with UID detection on RHEL6 when running instances.
- Fix a logic error when a sandbox image is in an overlay incompatible location, and both overlay and underlay are disabled globally.
- Fix an issue causing user namespace to always be used when
allow-setuid=no
was configured in a setuid installation. - Always allow key IDs and fingerprints to be specified with or without a
0x
prefix when usingsingularity keys
- Fix an issue preventing joining an instance started with
--boot
. - Provide a useful error message if an invalid library:// path is provided.
- Bring in multi-part upload client functionality that will address large image upload / proxied upload issues with a future update to Sylabs cloud.
In addition, numerous improvements have been made to the test suites, allowing them to pass cleanly on a range of kernel versions and distributions that are not covered by the open-source CI runs.
Many thanks to those who have contributed code, bug reports, and testing!
As always, please report any bugs to: https://github.com/sylabs/singularity/issues/new
If you think that you've discovered a security vulnerability please report it to:
security@sylabs.io
Singularity 3.5.2 Release
Security Release
The 3.5.2 release of Singularity contains fixes for a security issue related to incorrect file permissions (CVE-2019-19724) on user configuration and cache directories.
In Singularity >=3.3.0 (on all OS/kernels) the $HOME/.singularity
directory holding user configuration and caches is incorrectly created with 777 permissions. If the $HOME
directory of a user has group/any x
permission set, then a malicious user with login access to the host system may traverse into $HOME/.singularity
and:
-
Inject a remote.yaml configuration file that can direct interactions with Sylabs cloud services / Singularity Enterprise to a malicious server. This may result in the execution of malicious container images.
-
Read the content of a user’s cached containers, which may include sensitive private data.
In Singularity >=2.4.0 (on all OS/kernels) the $HOME/.singularity
directory and any explicit SINGULARITY_CACHEDIR
directory are created with 755, or umask dependent permissions. If a user’s $HOME
directory, or the directory containing an explicitly set SINGULARITY_CACHEDIR
, have group/any x
permission set, then a malicious user with login access to the host system may:
- Read the content of a user’s cached containers, which may include sensitive private data.
Singularity 3.5.2 should be installed immediately, and all previous versions of Singularity should be removed.
Additionally, we recommend running chmod 700
against the .singularity
directory within all user $HOME directories, especially if $HOME directories may have group/any x
bits set on your system.
Mitigations / Notes
If no user $HOME
directories have group/any x
bits set, and SINGULARITY_CACHEDIR
has never been set to a location open to shared access, the exploits listed above are not possible.
If Singularity is configured to only run containers signed with keys specified in an execution control list, and these keys are not compromised, arbitrary malicious containers cannot be run with a remote.yaml
exploit.
Singularity 3.5.2 ensures 700
permissions are set on $HOME/.singularity
when the singularity
command is run by a user, and that 700
permissions are set for any existing or new explicit cache directory configured using the SINGULARITY_CACHEDIR
environment variable.
This release makes additional permission changes to further harden plugin operations against weak directory permissions / sudo secure umask settings, that should not occur without explicit administrator action.
Singularity Desktop for Mac
Previous alpha and beta versions of Singularity Desktop for Mac are affected by this issue. A new beta release, beta-v0.2, is being prepared, and will be available shortly.
Patches against prior versions
In keeping with our commitment to the open source community to release security patches incorporated into Singularity PRO, Sylabs is also releasing patches that can be applied to the 3.1, 2.6, 2.5, and 2.4 series. Even though 3.5.2 technically deprecates all previous open-source versions of Singularity, interested parties can find the patches to fix this specific issue at the following links:
- 3.1: https://repo.sylabs.io/security/2019/CVE-2019-19724-31.diff
- 2.6 / 2.5 / 2.4: https://repo.sylabs.io/security/2019/CVE-2019-19724-2x.diff
Note - these prior versions of Singularity may be subject to additional security issues, addressed by further patches released previously. Please review the release history carefully before using a deprecated version of Singularity.
Release Notes
Security related fix
- 700 permissions are enforced on
$HOME/.singularity
andSINGULARITY_CACHEDIR
directories (CVE-2019-19724). Many thanks to Stuart Barkley for reporting this issue.
Bug Fixes
- Fixes an issue preventing use of
.docker/config
for docker registry
authentication. - Fixes the
run-help
command in the unprivileged workflow. - Fixes a regression in the
inspect
command to support older image formats. - Adds a workaround for an EL6 kernel bug regarding shared bind mounts.
- Fixes caching of http(s) sources with conflicting filenames.
- Fixes a fakeroot sandbox build error on certain filesystems, e.g. lustre, GPFS.
- Fixes a fakeroot build failure to a sandbox in $HOME.
- Fixes a fakeroot build failure from a bad def file section script location.
- Fixes container execution errors when CWD is a symlink.
- Provides a useful warning r.e. possible fakeroot build issues when seccomp
support is not available. - Fixes an issue where the
--disable-cache
option was not being honored.
Singularity 3.5.1 Release
This is the first bugfix release for Singularity 3.5
New features / functionalities
A single feature has been added in the bugfix release, with specific
functionality:
- A new option
allow container encrypted
can be set tono
in
singularity.conf
to prevent execution of encrypted containers.
Bug Fixes
This bugfix release addresses the following issues:
- Fixes a disk space leak when building from docker-archive.
- Makes container process SIGABRT return the expected code.
- Fixes the
inspect
command in unprivileged workflows. - Sets an appropriate default umask during build stages, to avoid issues with
very restrictive user umasks. - Fixes an issue with build script content being consumed from STDIN.
- Corrects the behavior of underlay with non-empty / symlinked CWD and absolute
symlink binds targets. - Fixes execution of containers when binding BTRFS filesystems.
- Fixes build / check failures for MIPS & PPC64.
- Ensures file ownership maintained when building image from sandbox.
- Fixes a squashfs mount error on kernel 5.4.0 and above.
- Fixes an underlay fallback problem, which prevented use of sandboxes on
lustre filesystems.
Known Issues
The following are known issues in this release, and will be addressed in an upcoming version of Singularity:
- Using
--fakeroot
to build sandboxes to GPFS, and most sandboxes to Lustre filesystems, is known not to work. As a workaround you may built to a local filesystem, e.g./tmp/mysandbox
and copy to GPFS/Lustre. - Caching of
http(s)://
image sources is incorrect. Images with the same final part in the URL will be considered the same image. Use--disable-cache
orsingularity cache clean
between runs, or usesingularity pull
to explicitly fetch the image to a local SIF file.
Thanks to our contributors for code, feedback, and testing efforts!
As always, please report any bugs to: https://github.com/sylabs/singularity/issues/new
If you think that you've discovered a security vulnerability please report it to:
security@sylabs.io
Have fun!
Singularity 3.5.0 release
Howdy container enthusiasts!
Singularity 3.5.0 brings some new features, most notably AMD GPU / ROCm support. We also have a couple of behavior changes noted below. Apart from this many bug fixes and small tweaks have been merged.
New features / functionalities
- New support for AMD GPUs via
--rocm
option added to bind ROCm devices and
libraries into containers. - Plugins can now modify Singularity behaviour with two mutators: CLI and
Runtime. - Introduced the
config global
command to editsingularity.conf
settings
from the CLI. - Introduced the
config fakeroot
command to setupsubuid
andsubgid
mappings for--fakeroot
from the Singularity CLI.
Changed defaults / behaviours
- Go 1.13 adopted.
- Vendored modules removed from the Git tree, will be included in release tarballs.
- Singularity will now fail with an error if a requested bind mount cannot be
made.- This is beneficial to fail fast in workflows where a task may fail a long
way downstream if a bind mount is unavailable. - Any unavailable bind mount sources must be removed from
singularity.conf
.
- This is beneficial to fail fast in workflows where a task may fail a long
- Docker/OCI image extraction now faithfully respects layer
permissions.- This may lead to sandboxes that cannot be removed without
modifying permissions. --fix-perms
option added to preserve old behaviour when
building sandboxes.- Discussion issue for this change at: https://github.com/sylabs/singularity/issues/4671
- This may lead to sandboxes that cannot be removed without
Singularity>
prompt is always set when entering shell in a container.- The current
umask
will be honored when building a SIF file. instance exec
processes acquire cgroups set oninstance start
--fakeroot
supports uid/subgid ranges >65536singularity version
now reports semver compliant version
information.
Deprecated / removed commands
- Deprecated
--id
flag forsign
andverify
; replaced with--sif-id
.
Thanks to our contributors for code, feedback and, testing efforts!
As always, please report any bugs to: https://github.com/sylabs/singularity/issues/new
If you think that you've discovered a security vulnerability please report it to:
security@sylabs.io
Have fun!
Singularity 3.4.2 release
This is the v3.4.2 bugfix release of Singularity, which addresses non-security related issues that were found in v3.4.1. We recommend you update to v3.4.2 for improved stability.
This release addresses the following issues:
- Sets workable permissions on OCI -> sandbox rootless builds
- Fallback correctly to user namespace for non setuid installation
- Correctly handle the starter-suid binary for non-root installs
- Creates CACHEDIR if it doesn't exist
- Sets apex loglevel for umoci to match singularity loglevel
Thanks to our contributors for code, feedback and, testing efforts!
As always, please report any bugs to: https://github.com/sylabs/singularity/issues/new
If you think that you've discovered a security vulnerability please report it to:
security@sylabs.io
Have fun!
Singularity 3.4.1 release
This is the v3.4.1 bugfix release of Singularity, which addresses non-security related issues that were found in v3.4.0. We recommend you update to v3.4.1 for improved stability.
This release addresses the following issues:
- Fixes an issue where a PID namespace was always being used
- Fixes compilation on non 64-bit architectures
- Allows fakeroot builds for zypper, pacstrap, and debootstrap
- Correctly detects seccomp on OpenSUSE
- Honors GO_MODFLAGS properly in the mconfig generated makefile
- Passes the Mac hostname to the VM in MacOS Singularity builds
- Handles temporary EAGAIN failures when setting up loop devices on recent kernels
- Fixes excessive memory usage in singularity push
Thanks to our contributors for code, feedback and, testing efforts!
As always, please report any bugs to: https://github.com/sylabs/singularity/issues/new
If you think that you've discovered a security vulnerability please report it to:
security@sylabs.io
Have fun!
Singularity 3.4.0 release
Howdy Singularity cowpokes! 🤠 🐄
The major new feature of this release is the ability to build and run encrypted containers. These containers are encrypted at rest, in transit, and even while running! There is no intermediate decrypted rootfs left around upon termination. Data is decrypted totally in kernel space.
Below is a slightly more thorough list of changes in 3.4.0. For a complete list, please see the commit history in git and on GitHub.
New features / functionalities
- New support for building and running encrypted containers with RSA keys and passphrases
--pem-path
option added to thebuild
and action commands for RSA based encrypted containers--passphrase
option added tobuild
and action commands for passphrase based encrypted containersSINGULARITY_ENCRYPTION_PEM_PATH
andSINGULARITY_ENCRYPTION_PASSPHRASE
environment variables added to serve same functions as above--encrypt
option added tobuild
command to build an encrypted container when environment variables contain a secret
- New
--disable-cache
flag prevents caching of downloaded containers - Added support for multi-line variables in singularity def-files
- Added support for 'indexed' def-file variables (like arrays)
- Added support for SUSE SLE Products
- Added the def-file variables:
product, user, regcode, productpgp, registerurl, modules, otherurl (indexed) - Support multiple-architecture tags in the SCS library
- Added a
--dry-run
flag tocache clean
- Added a
SINGULARITY_SYPGPDIR
environment variable to specify the location of PGP key data - Added a
--nonet
option to the action commands to disable networking when running with the--vm
option - Added a
--long-list
flag to thekey search
command to preserve - Added experimental, hidden
--fusemount
flag to pass a command to mount a libfuse3 based file system within the container
Changed defaults / behaviors
- Runtime now properly honors
SINGULARITY_DISABLE_CACHE
environment variable remote add
command now automatically attempts to login and a--no-login
flag is added to disable this behavior- Using the
pull
command to download an unsigned container no longer produces an error code cache clean
command now prompts user before cleaning when run without--force
option and is more verbose- Shortened the default output of the
key search
command
Deprecated / removed commands
- The
--allow-unsigned
flag topull
has been deprecated and will be removed in the future
As always, please report any bugs to:
https://github.com/sylabs/singularity/issues/new
And if you think that you've discovered a security vulnerability please report it to:
security@sylabs.io
Have fun!
Singularity 3.3.0
Hey, hey, hey Singularity community!
Here's a brand spankin' new release of Singularity!
Major new features include a --fakeroot
flag allowing you to build without sudo
and spoof uid 0 on kernels with user namespace support, a sif
command allowing you to inspect and manipulate SIF files, and an oras
URI allowing you to push and pull SIF files to supported OCI registries! More details appear below and the full details appear in the git log.
Changed defaults / behaviors
- Remote login and status commands will now use the default remote if a remote name is not supplied
- Added Singularity hub (
shub
) cache support when using thepull
command - Clean cache in a safer way by only deleting the cache subdirectories
- Improvements to the
cache clean
command
New features / functionalities
- new
oras
URI for pushing and pulling SIF files to and from supported OCI registries - added the
--fakeroot
option tobuild
,exec
,run
,shell
,test
, andinstance start
commands to run container in a new user namespace as uid 0 - added the
fakeroot
network type for use with the--network
option sif
command to allow for the inspection and manipulation of SIF files with the following subcommandsadd
Add a data object to a SIF filedel
Delete a specified object descriptor and data from SIF filedump
Extract and output data objects from SIF filesheader
Display SIF global headersinfo
Display detailed information of object descriptorslist
List object descriptors from SIF filesnew
Create a new empty SIF image filesetprim
Set primary system partition
As always, please report any bugs to:
https://github.com/sylabs/singularity/issues/new
And if you think that you've discovered a security vulnerability please report it to:
security@sylabs.io
Have fun!
Singularity 3.2.1
Howdy Singularity Containnerds! 🤓
This point release fixes a few pesky bugs that were discovered in v3.2.0. In particular it:
- Allows users to join instances with non-suid workflow
- Removes false warning when seccomp is disabled on the host
- Fixes an issue in the terminal when piping output to commands
- Binds NVIDIA persistenced socket when
--nv
is invoked
As always, please report any bugs to:
https://github.com/sylabs/singularity/issues/new
And if you think that you've discovered a security vulnerability please report it to:
security@sylabs.io
Have fun!
Singularity 3.2.0
Greetings Singularity community!
The 3.2.0 release contains fixes for a high severity security issue affecting Singularity >=3.1.0 on Linux kernels that support namespace requirements (pid
namespace) for creating and joining instances (CVE-2019-11328). A malicious user with local/network access to the host system (e.g. ssh) could exploit this vulnerability due to insecure permissions allowing a user to edit files within /run/singularity/instances/sing/<user>/<instance>
. The manipulation of those files can change the behavior of the starter-suid
program when instances are joined resulting in potential privilege escalation on the host.
Singularity 3.2.0 should be installed immediately, and all previous versions of Singularity should be removed. The vulnerability addressed in this release affects systems on which unprivileged users are permitted to initiate and join instances via the suid workflow. If you are unable to upgrade immediately, you should disable the suid workflow on your system. You can do so by setting the following in the singularity.conf
file:
allow setuid = no
In keeping with our commitment to the open source community, Sylabs is also releasing a patch that can be applied to the 3.1 series. Even though 3.2.0 technically deprecates all previous versions of Singularity, interested parties can find the patch to fix this vulnerability in the 3.1 series at the following link:
https://repo.sylabs.io/security/2019/CVE-2019-11328.diff
In addition to a security patch, 3.2.0 has a lot of great features. Highlights include a new plugin system, the added ability to create multi-stage builds, and better integration with the Singularity Container Services KeyStore. More details appear in the release notes below:
Security related fix
- Instance files are now stored in user's home directory for privacy and many checks have been added to ensure that a user can't manipulate files to change
starter-suid
behavior when instances are joined
(many thanks to Matthias Gerstner from the SUSE security team for finding and securely reporting this vulnerability)
New features / functionalities
- Introduced a new basic framework for creating and managing plugins
- Added the ability to create containers through multi-stage builds
- Created the concept of a Sylabs Cloud "remote" endpoint and added the ability for users and admins to set them through CLI and conf files
- Added caching for images from Singularity Hub
- Made it possible to compile Singularity outside of
$GOPATH
- Added a json partition to SIF files for OCI configuration when building from an OCI source
- Full integration with Singularity desktop for MacOS code base
New Commands
-
Introduced the
plugin
command group for creating and managing pluginscompile
Compile a singularity plugindisable
disable an installed singularity pluginenable
Enable an installed singularity plugininspect
Inspect a singularity plugin (either an installed one or an image)install
Install a singularity pluginlist
List installed singularity pluginsuninstall
Uninstall removes the named plugin from the system
-
Introduced the
remote
command group to support management of Singularity endpoints:add
Create a new Sylabs Cloud remote endpointlist
List all remote endpoints that are configuredlogin
Log into a remote endpoint using an authentication tokenremove
Remove an existing Sylabs Cloud remote endpointstatus
Check the status of the services at an endpointuse
Set a remote endpoint to be used by default
-
Added to the
key
command group to improve PGP key management:export
Export a public or private key into a specific fileimport
Import a local key into the local keyringremove
Remove a local public key
-
Added the
Stage: <name>
keyword to the definition file header and thefrom <stage name>
option/argument pair to the%files
section to support multistage builds
Deprecated / removed commands
- The
--token/-t
option has been deprecated in favor of thesingularity remote
command group
Changed defaults / behaviors
- Ask to confirm password on a newly generated PGP key
- Prompt to push a key to the KeyStore when generated
- Refuse to push an unsigned container unless overridden with
--allow-unauthenticated/-U
option - Warn and prompt when pulling an unsigned container without the
--allow-unauthenticated/-U
option
As always, please report any bugs to:
https://github.com/sylabs/singularity/issues/new
And if you think that you've discovered a security vulnerability please report it to:
security@sylabs.io