Skip to content
This repository has been archived by the owner on Mar 9, 2022. It is now read-only.

[release/1.2 backport] bump libseccomp-golang v0.9.1 #1191

Merged

Conversation

thaJeztah
Copy link
Member

@thaJeztah thaJeztah commented Jun 26, 2019

backport of #1189 for the 1.2 branch

full diff: seccomp/libseccomp-golang@32f571b...689e3c1

Release notes:

  • Version 0.9.1 - May 21, 2019
  • Minimum supported version of libseccomp bumped to v2.2.0 (seccomp/libseccomp-golang@fc02980)
    • PowerPC and S390(x) architectures are unavailable below library version v2.3.0 and will return errors if used with incompatible libraries
  • Use Libseccomp's seccomp_version API to retrieve library version
  • Unconditionally set TSync attribute for filters, due to Go's heavily threaded nature
  • Fix CVE-2017-18367 - Multiple syscall arguments were incorrectly combined with logical-OR, instead of logical-AND (seccomp/libseccomp-golang@06e7a29)
  • Fix a failure to build on Debian-based distributions due to CGo code
  • Fix unit test failures on 32-bit architectures
  • Improve several errors to be more verbose about their causes
  • Add support for SCMP_ACT_LOG (with libseccomp versions 2.4.x and higher), permitting syscalls but logging their execution
  • Add support for SCMP_FLTATR_CTL_LOG (with libseccomp versions 2.4.x and higher), logging not-allowed actions when they are denied

(cherry picked from commit 3f49760)

full diff: seccomp/libseccomp-golang@32f571b...689e3c1

Release notes:

* Version 0.9.1 - May 21, 2019
- Minimum supported version of libseccomp bumped to v2.2.0 (seccomp/libseccomp-golang@fc02980)
  - PowerPC and S390(x) architectures are unavailable below library version v2.3.0 and will return errors if used with incompatible libraries
- Use Libseccomp's `seccomp_version` API to retrieve library version
- Unconditionally set TSync attribute for filters, due to Go's heavily threaded nature
- Fix [CVE-2017-18367](https://nvd.nist.gov/vuln/detail/CVE-2017-18367) - Multiple syscall arguments were incorrectly combined with logical-OR, instead of logical-AND (seccomp/libseccomp-golang@06e7a29)
- Fix a failure to build on Debian-based distributions due to CGo code
- Fix unit test failures on 32-bit architectures
- Improve several errors to be more verbose about their causes
- Add support for SCMP_ACT_LOG (with libseccomp versions 2.4.x and higher), permitting syscalls but logging their execution
- Add support for SCMP_FLTATR_CTL_LOG (with libseccomp versions 2.4.x and higher), logging not-allowed actions when they are denied

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
(cherry picked from commit 3f49760)
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
@k8s-ci-robot
Copy link

Hi @thaJeztah. Thanks for your PR.

I'm waiting for a containerd member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

@mikebrow
Copy link
Member

/ok-to-test

Copy link
Member

@mikebrow mikebrow left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

/LGTM

Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

3 participants