[release-1.21] Bump runc to v1.2.9 - CVE-2025-52881 #6522
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Contributor
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: dashea The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
Also update containers/storage to handle changes in the runc API. Fixes: https://issues.redhat.com/browse/RHEL-126918 Signed-off-by: David Shea <dshea@redhat.com> Signed-off-by: Nalin Dahyabhai <nalin@redhat.com>
dashea
force-pushed
the
dshea-release-1.21-runc-update
branch
11 times, most recently
from
9f4ef97 to
d0fd160
Compare
The updated libcontainer (part of runc) doesn't compile as cleanly on non-Linux platforms. We could work around some of the types not being defined on those platforms, as we do in later branches, but for now, and unless we need to for downstream consumers, this gets us to passing CI faster. Signed-off-by: Nalin Dahyabhai <nalin@redhat.com>
Signed-off-by: Nalin Dahyabhai <nalin@redhat.com>
Update the versions of ginkgo that we build for use by our e2e tests, and the linter. Signed-off-by: Nalin Dahyabhai <nalin@redhat.com>
Signed-off-by: Nalin Dahyabhai <nalin@redhat.com>
Signed-off-by: David Shea <dshea@redhat.com>
Signed-off-by: David Shea <dshea@redhat.com> Signed-off-by: Nalin Dahyabhai <nalin@redhat.com>
Signed-off-by: David Shea <dshea@redhat.com> Signed-off-by: Nalin Dahyabhai <nalin@redhat.com>
Signed-off-by: Nalin Dahyabhai <nalin@redhat.com>
The github.com/pkg/errors.Cause() function didn't call Unwrap(), so directly comparing its returned value with specific errors could fail. Compensate for that by using errors.Is() or errors.As() where possible. Signed-off-by: Nalin Dahyabhai <nalin@redhat.com>
Signed-off-by: Nalin Dahyabhai <nalin@redhat.com>
Buildah's pkg/blobcache has been moved into containers/image [1] to consolidate implementations of interfaces such as image destinations and image sources. Since there are no functional changes: [NO NEW TESTS NEEDED] [1] containers/image#1459 Signed-off-by: Valentin Rothberg <vrothberg@redhat.com> Signed-off-by: Nalin Dahyabhai <nalin@redhat.com>
When firing up a minimal server to serve up content so that we can retrieve it using HTTP, make it possible to let the kernel assign us which port to use, so that the script that's calling us doesn't have to make a(n occasionally bad) guess. Signed-off-by: Nalin Dahyabhai <nalin@redhat.com>
Update linter configuration to more closely align with main. Address some linter warnings, mark some others to be ignored. Signed-off-by: Nalin Dahyabhai <nalin@redhat.com>
Ambient capabilities can't be raised without inheritable ones, and since we don't raise inheritable, we should not raise ambient either. This went unnoticed because of a bug in syndtr/gocapability which is only fixed in its fork (see the next commit). Amends commit e7e55c9. Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com> Signed-off-by: Chris Evich <cevich@redhat.com> Assisted-by: Claude (Anthropic)
Newer docker build doesn't set it, so we need to stop. Signed-off-by: Nalin Dahyabhai <nalin@redhat.com>
Make setting the Parent field in the config blob of a docker format image optional (yes, we're bringing it back!), since it no longer appears to be set by newer versions of docker build. Signed-off-by: Nalin Dahyabhai <nalin@redhat.com>
Backport a fixup of the permissions of the testing git repository that we use when checking that we can clone repositories when building, because I generated the tarball of the contents with myself as the owner, instead of root, and newer git thinks that looks suspect. Ed fixed this on main a while ago. Signed-off-by: Nalin Dahyabhai <nalin@redhat.com>
Handle requested relabeling of bind mounts (i.e., the "z" and "Z" flags) directly, instead of letting the runtime handle the relabeling. Signed-off-by: Nalin Dahyabhai <nalin@redhat.com>
Signed-off-by: Nalin Dahyabhai <nalin@redhat.com> Signed-off-by: Chris Evich <cevich@redhat.com> Assisted-by: Claude (Anthropic) Signed-off-by: Nalin Dahyabhai <nalin@redhat.com>
Use the named constants for the status values that runtimes can report to us when we run them with the "state" command. Signed-off-by: Nalin Dahyabhai <nalin@redhat.com>
Pick up the test updates from containers#4829, where we learned that disabling SELinux process labeling in a non-privileged context doesn't result in the container process being granted super privileges. Signed-off-by: Nalin Dahyabhai <nalin@redhat.com>
When checking the not-standardized "architecture" label in the ubi8 base image, accept either the RPM-recognized value (x86_64, aarch64) or Go value (amd64, arm64), because it seems to have changed at least once. Signed-off-by: Nalin Dahyabhai <nalin@redhat.com>
Add /usr/lib/cni, which is where Debian packages containernetworking-plugins, to the default set of paths we search for CNI plugins. Signed-off-by: Nalin Dahyabhai <nalin@redhat.com>
When checking that the /etc/hosts entry that we add looks right, accept either tabs or spaces separating the IP address from the hostname, since we actually use tabs. Signed-off-by: Nalin Dahyabhai <nalin@redhat.com>
Signed-off-by: Nalin Dahyabhai <nalin@redhat.com>
dashea
force-pushed
the
dshea-release-1.21-runc-update
branch
from
d0fd160 to
7a63373
Compare
dosubot
bot
added
the
size:XL
dashea
force-pushed
the
dshea-release-1.21-runc-update
branch
3 times, most recently
from
fb62e78 to
8bbab84
Compare
... setting RLIMIT_NPROC wrong The version of containers/common we're currently using on this branch included a bug which was later fixed by containers/common#2199. If we get an update on its v0.60 branch which includes that fix, we can drop this patch from this branch, but until then, work around the part that breaks our tests. Signed-off-by: Nalin Dahyabhai <nalin@redhat.com> Signed-off-by: tomsweeneyredhat <tsweeney@redhat.com>
dashea
force-pushed
the
dshea-release-1.21-runc-update
branch
3 times, most recently
from
4ee7d60 to
64d2811
Compare
Since we started calling into the standard library's io/fs package directly, we effectively made Go 1.16 our minimum Go version, so we don't need to keep the workaround for compiling with Go 1.12. Signed-off-by: Nalin Dahyabhai <nalin@redhat.com>
Handing Put() an archive which uses host IDs while also including ID maps for mapping from container IDs to host IDs is a mistake, and the tests have been failing when run by non-root users since storage v1.38 started flagging it as such. Signed-off-by: Nalin Dahyabhai <nalin@redhat.com>
dashea
force-pushed
the
dshea-release-1.21-runc-update
branch
from
64d2811 to
1b2fbc1
Compare
Signed-off-by: David Shea <dshea@redhat.com>
dashea
force-pushed
the
dshea-release-1.21-runc-update
branch
from
1b2fbc1 to
36e881e
Compare
Member
|
LGTM, thanks! |
TomSweeneyRedHat
changed the title
Member
|
FYI, I tweaked the title of the PR from runc 1.2.8 to 1.2.9. |
Member
|
LGTM |
Member
|
/lgtm |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
5 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
What type of PR is this?
/kind other
What this PR does / why we need it:
Bump runc to v1.2.8, to address CVE-2025-52881. This is a huge jump, but this version of runc is the earliest that contains a fix for this CVE.
Which issue(s) this PR fixes:
This also fixes CVE-2025-31133 and CVE-2025-52565.
Fixes RHEL-126918.
How to verify it
Special notes for your reviewer:
Does this PR introduce a user-facing change?
[NO NEW TESTS NEEDED]