[19.03 backport] update containerd 1.2.10, runc v1.0.0-rc8-92-g84373aaa (CVE-2019-16884)

[thaJeztah]

backports of:

• Update containerd binary to v1.2.10 moby/moby#39995 Update containerd to v1.2.10
• Update runc to v1.0.0-rc8-92-g84373aaa (CVE-2019-16884) moby/moby#40001 Update runc to v1.0.0-rc8-92-g84373aaa (CVE-2019-16884)

part of ENGCORE-1064
fixes ENGCORE-1065

Update containerd to v1.2.10

The tenth patch release for containerd 1.2 includes only one main bug fix in the
CRI plugin, but includes updated vendors/build runtimes that fix 2 reported CVEs in
runc and the Golang 1.12 runtime respectively.

Notable Updates

• Update the runc vendor to capture the fix for CVE-2019-16884. Fixed by PR Don't expose cgroups via the execdriver API. moby/moby#3685
  • More details on the runc CVE in AppArmor can be bypassed by a malicious image that specifies a volume at /proc opencontainers/runc#2128, fixed by Only allow proc mount if it is procfs opencontainers/runc#2129

• Update Golang runtime to 1.12.10 to handle CVE-2019-16276. More detail on the Golang CVE available in net/http: invalid headers are normalized, allowing request smuggling golang/go#34540
• CRI fixes:
  • Fix a bug that the default UNIX path is not in the default OCI config via the CRI plugin. Reported in cri path issue containerd/cri#1279 and fixed by [release/1.2] Backport fix for default UNIX environment in OCI container config containerd/cri#1283

Update runc to v1.0.0-rc8-92-g84373aaa (CVE-2019-16884)

full diff: opencontainers/runc@v1.0.0-rc8...3e425f8

• criu image path permission error when checkpoint rootless container opencontainers/runc#2010 criu image path permission error when checkpoint rootless container
• Update to Go 1.12 and drop obsolete versions opencontainers/runc#2028 Update to Go 1.12 and drop obsolete versions
• Update dependencies opencontainers/runc#2029 Update dependencies
• Support for logging from children processes opencontainers/runc#2034 Support for logging from children processes
• specconv: always set "type: bind" in case of MS_BIND opencontainers/runc#2035 specconv: always set "type: bind" in case of MS_BIND
• r.destroy can defer exec in runner.run method. opencontainers/runc#2038 r.destroy can defer exec in runner.run method
• Change the permissions of the notify listener socket to rwx for everyone opencontainers/runc#2041 Change the permissions of the notify listener socket to rwx for everyone
• libcontainer: intelrdt: add missing destroy handler in defer func opencontainers/runc#2042 libcontainer: intelrdt: add missing destroy handler in defer func
• Move systemd.Manager initialization into a function in that module opencontainers/runc#2047 Move systemd.Manager initialization into a function in that module
• main: not reopen /dev/stderr opencontainers/runc#2057 main: not reopen /dev/stderr
  • closes Runc + podman|cri-o + systemd issue with stderr opencontainers/runc#2056 Runc + podman|cri-o + systemd issue with stderr
  • closes kubelet fails starting CRI-O containers (Ubuntu 18.04 + systemd cgroups driver) kubernetes/kubernetes#77615 kubelet fails starting CRI-O containers (Ubuntu 18.04 + systemd cgroups driver)
  • closes Joining worker node not starting flannel or kube-proxy / CRI-O error "open /dev/stderr: no such device or address" cri-o/cri-o#2368 Joining worker node not starting flannel or kube-proxy / CRI-O error "open /dev/stderr: no such device or address"
• libcontainer: fix TestGetContainerState to check configs.NEWCGROUP opencontainers/runc#2061 libcontainer: fix TestGetContainerState to check configs.NEWCGROUP
• Fix cgroup hugetlb size prefix for kB opencontainers/runc#2065 Fix cgroup hugetlb size prefix for kB
• libcontainer: change seccomp test for clone syscall opencontainers/runc#2067 libcontainer: change seccomp test for clone syscall
• Update dependency libseccomp-golang opencontainers/runc#2074 Update dependency libseccomp-golang
• Bump CRIU to 3.12 opencontainers/runc#2081 Bump CRIU to 3.12
• doc: First process in container needs Init: true opencontainers/runc#2089 doc: First process in container needs Init: true
• Skip searching /dev/.udev for device nodes. opencontainers/runc#2094 Skip searching /dev/.udev for device nodes
  • closes HostDevices() race with older udevd versions opencontainers/runc#2093 HostDevices() race with older udevd versions
• man: fix man-pages opencontainers/runc#2098 man: fix man-pages
• cgroups/fs: check nil pointers in cgroup manager opencontainers/runc#2103 cgroups/fs: check nil pointers in cgroup manager
• Make get devices function public opencontainers/runc#2107 Make get devices function public
• libcontainer: initial support for cgroups v2 opencontainers/runc#2113 libcontainer: initial support for cgroups v2
• Avoid the dependency on cgo through go-systemd/util package opencontainers/runc#2116 Avoid the dependency on cgo through go-systemd/util package
  • removes github.com/coreos/pkg as dependency
• Remove libcontainer detection for systemd features opencontainers/runc#2117 Remove libcontainer detection for systemd features
  • fixes Remove libcontainer detection for systemd features opencontainers/runc#2117 Cache the systemd detection results
• libcontainer: update masked paths of /proc opencontainers/runc#2119 libcontainer: update masked paths of /proc
  • relates to Add /proc/keys to masked paths moby/moby#36368 Add /proc/keys to masked paths
  • relates to Masked /proc/asound moby/moby#38299 Masked /proc/asound
  • relates to Add /proc/acpi to masked paths moby/moby#37404 Add /proc/acpi to masked paths (CVE-2018-10892)
• nsenter: minor fixes opencontainers/runc#2122 nsenter: minor fixes
• Bump x/sys and update syscall for initial Risc-V support opencontainers/runc#2123 Bump x/sys and update syscall for initial Risc-V support
• cgroup: support mount of cgroup2 opencontainers/runc#2125 cgroup: support mount of cgroup2
• libcontainer/nsenter: Don't import C in non-cgo file opencontainers/runc#2126 libcontainer/nsenter: Don't import C in non-cgo file
• Only allow proc mount if it is procfs opencontainers/runc#2129 Only allow proc mount if it is procfs
  • addresses Only allow proc mount if it is procfs opencontainers/runc#2129 AppArmor can be bypassed by a malicious image that specifies a volume at /proc (CVE-2019-16884)

[thaJeztah]

marked as WIP because upstream runc bump wasn't merged yet

[thaJeztah]

@AkihiroSuda @crosbymichael @justincormack PTAL

[cpuguy83]

LGTM