chore(deps): update module github.com/opencontainers/runc to v1.1.5 #1412
Conversation
![renovate[bot]](https://avatars.githubusercontent.com/in/2740?s=60&v=4){kind=small}
| @@ -55,6 +55,7 @@ require ( | |||
| github.com/acarl005/stripansi v0.0.0-20180116102854-5a71ef0e047d // indirect | |||
| github.com/asaskevich/govalidator v0.0.0-20230301143203-a9d515a09cc2 // indirect | |||
| github.com/chzyer/readline v1.5.1 // indirect | |||
| github.com/cilium/ebpf v0.9.1 // indirect | |||
There was a problem hiding this comment.
This adds ... a lot of ... code.
Need to investigate
There was a problem hiding this comment.
opencontainers/runc#3452 changed it in runc so we do not have to import so much, I guess there is a regression which added the unwanted imports back in some place.
There was a problem hiding this comment.
nevermind this is a downgrade, go versioning is something...
there is a reason this uses a replace here.
There was a problem hiding this comment.
Thanks for checking. Let's close it
Signed-off-by: Renovate Bot <bot@renovateapp.com>
renovate
bot
force-pushed
the
renovate/git.luolix.top-opencontainers-runc-1.x
branch
from
ec40972
to
4355380
Compare
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: renovate[bot] The full list of commands accepted by this bot can be found here.
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
Renovate Ignore NotificationAs this PR has been closed unmerged, Renovate will now ignore this update (v1.1.5). You will still receive a PR once a newer version is released, so if you wish to permanently ignore this dependency, please add it to the If this PR was closed by mistake or you changed your mind, you can simply rename this PR and you will soon get a fresh replacement PR opened. |
This PR contains the following updates:
v1.1.1-0.20220617142545-8b9452f75cbc->v1.1.5Release Notes
opencontainers/runc
v1.1.5: runc 1.1.5 -- "囚われた屈辱は 反撃の嚆矢だ"Compare Source
This is the fifth patch release in the 1.1.z series of runc, which fixes
three CVEs found in runc.
CVE-2023-25809 is a vulnerability involving rootless containers where
(under specific configurations), the container would have write access
to the /sys/fs/cgroup/user.slice/... cgroup hierarchy. No other
hierarchies on the host were affected. This vulnerability was
discovered by Akihiro Suda.
GHSA-m8cg-xc2p-r3fc
CVE-2023-27561 was a regression which effectively re-introduced
CVE-2019-19921. This bug was present from v1.0.0-rc95 to v1.1.4. This
regression was discovered by @Beuc.
GHSA-vpvm-3wq2-2wvm
CVE-2023-28642 is a variant of CVE-2023-27561 and was fixed by the same
patch. This variant of the above vulnerability was reported by Lei
Wang.
GHSA-g2j6-57v7-gm8c
In addition, the following other fixes are included in this release:
/dev/nullwhen inside a container. (#3620)/dev/nullcaused by fd redirection(a regression in 1.1.1). (#3674, #3731)
CentOS < 7.7. (#3776)
write_log(). (#3721)Static Linking Notices
The
runcbinary distributed with this release are statically linked withthe following GNU LGPL-2.1 licensed libraries, with
runcactingas a "work that uses the Library":
The versions of these libraries were not modified from their upstream versions,
but in order to comply with the LGPL-2.1 (§6(a)), we have attached the
complete source code for those libraries which (when combined with the attached
runc source code) may be used to exercise your rights under the LGPL-2.1.
However we strongly suggest that you make use of your distribution's packages
or download them from the authoritative upstream sources, especially since
these libraries are related to the security of your containers.
Thanks to all of the contributors who made this release possible:
[Due to the security-critical nature of this release, it was released
without a direct vote but was agreed to by the required number of
maintainers.]
Signed-off-by: Aleksa Sarai cyphar@cyphar.com
v1.1.4: runc 1.1.4 -- "If you look for perfection, you'll never be content."Compare Source
This is the fourth patch release in the 1.1.z series of runc, primarily
fixing a regression introduced in 1.1.3 related to device rules. It also
fixes a few other bugs.
used, and the bind mount is followed by the cgroup mount in the spec,
the cgroup was mounted using the bind mount's mount fd. (#3511)
kill()inlibcontainer/nsentertosane_kill(). (#3536)runc runonnoexecfs. (#3541)systemctl daemon-reload. Due to a regressionin v1.1.3, the
DeviceAllow=char-pts rwmrule was no longer added andwas causing an error
open /dev/pts/0: operation not permitted: unknownwhen systemd was reloaded. (#3554)Static Linking Notices
The
runcbinary distributed with this release are statically linked withthe following GNU LGPL-2.1 licensed libraries, with
runcactingas a "work that uses the Library":
The versions of these libraries were not modified from their upstream versions,
but in order to comply with the LGPL-2.1 (§6(a)), we have attached the
complete source code for those libraries which (when combined with the attached
runc source code) may be used to exercise your rights under the LGPL-2.1.
However we strongly suggest that you make use of your distribution's packages
or download them from the authoritative upstream sources, especially since
these libraries are related to the security of your containers.
Thanks to all of the contributors who made this release possible:
Signed-off-by: Aleksa Sarai cyphar@cyphar.com
v1.1.3: runc 1.1.3 -- "In the beginning there was nothing, which exploded."Compare Source
This is the third release of the 1.1.z series of runc, and contains
various minor improvements and bugfixes.
-ENOSYSstub now correctly handles multiplexed syscalls ons390 and s390x. This solves the issue where syscalls the host kernel did not
support would return
-EPERMdespite the existence of the-ENOSYSstubcode (this was due to how s390x does syscall multiplexing). (#3478)
intended; this fix does not affect runc binary itself but is important for
libcontainer users such as Kubernetes. (#3476)
constants in libseccomp-golang. (#3477)
to stop systemd from emitting warnings about those paths. (#3504)
Static Linking Notices
The
runcbinary distributed with this release are statically linked withthe following GNU LGPL-2.1 licensed libraries, with
runcactingas a "work that uses the Library":
The versions of these libraries were not modified from their upstream versions,
but in order to comply with the LGPL-2.1 (§6(a)), we have attached the
complete source code for those libraries which (when combined with the attached
runc source code) may be used to exercise your rights under the LGPL-2.1.
However we strongly suggest that you make use of your distribution's packages
or download them from the authoritative upstream sources, especially since
these libraries are related to the security of your containers.
Thanks to all of the contributors who made this release possible:
Signed-off-by: Aleksa Sarai cyphar@cyphar.com
v1.1.2: runc 1.1.2 -- "I should think I’m going to be a perpetual student."Compare Source
This is the second patch release of the runc 1.1 release branch. It
fixes CVE-2022-29162, a minor security issue (which appears to not be
exploitable) related to process capabilities.
This is a similar bug to the ones found and fixed in Docker and
containerd recently (CVE-2022-24769).
non-empty inheritable Linux process capabilities, creating an atypical Linux
environment. For more information, see GHSA-f3fp-gc8g-vw66 and
CVE-2022-29162.
runc specno longer sets any inheritable capabilities in the createdexample OCI spec (
config.json) file.Static Linking Notices
The
runcbinary distributed with this release are statically linked withthe following GNU LGPL-2.1 licensed libraries, with
runcactingas a "work that uses the Library":
The versions of these libraries were not modified from their upstream versions,
but in order to comply with the LGPL-2.1 (§6(a)), we have attached the
complete source code for those libraries which (when combined with the attached
runc source code) may be used to exercise your rights under the LGPL-2.1.
However we strongly suggest that you make use of your distribution's packages
or download them from the authoritative upstream sources, especially since
these libraries are related to the security of your containers.
Configuration
📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR has been generated by Mend Renovate. View repository job log here.