runc 1.1.4 -- "If you look for perfection, you'll never be content."

This is the fourth patch release in the 1.1.z series of runc, primarily
fixing a regression introduced in 1.1.3 related to device rules. It also
fixes a few other bugs.

• Fix mounting via wrong proc fd. When the user and mount namespaces are
  used, and the bind mount is followed by the cgroup mount in the spec,
  the cgroup was mounted using the bind mount's mount fd. (#3511)
• Switch kill() in libcontainer/nsenter to sane_kill(). (#3536)
• Fix "permission denied" error from runc run on noexec fs. (#3541)
• Fix failed exec after systemctl daemon-reload. Due to a regression
  in v1.1.3, the DeviceAllow=char-pts rwm rule was no longer added and
  was causing an error open /dev/pts/0: operation not permitted: unknown when systemd was reloaded. (#3554)

Static Linking Notices

The runc binary distributed with this release are statically linked with
the following GNU LGPL-2.1 licensed libraries, with runc acting
as a "work that uses the Library":

• libseccomp

The versions of these libraries were not modified from their upstream versions,
but in order to comply with the LGPL-2.1 (§6(a)), we have attached the
complete source code for those libraries which (when combined with the attached
runc source code) may be used to exercise your rights under the LGPL-2.1.

However we strongly suggest that you make use of your distribution's packages
or download them from the authoritative upstream sources, especially since
these libraries are related to the security of your containers.

---

Thanks to all of the contributors who made this release possible:

• Akihiro Suda akihiro.suda.cz@hco.ntt.co.jp
• Aleksa Sarai cyphar@cyphar.com
• guodong guodong9211@gmail.com
• Kir Kolyshkin kolyshkin@gmail.com
• Mrunal Patel mrunal@me.com

Signed-off-by: Aleksa Sarai cyphar@cyphar.com