Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[1.24] oci: add support for capping memory and disk usage from exec sync output #5935

Merged
merged 4 commits into from Jun 6, 2022
Merged

[1.24] oci: add support for capping memory and disk usage from exec sync output #5935

merged 4 commits into from Jun 6, 2022

Conversation

haircommander
Copy link
Member

What type of PR is this?

/kind bug

What this PR does / why we need it:

Which issue(s) this PR fixes:

Special notes for your reviewer:

Does this PR introduce a user-facing change?

Fix a bug where ExecSync requests (exec probes) could use an arbitrary amount of memory and disk. Output from ExecSync requests is now limited to 16MB (the amount that exec output was limited to in the dockershim). Disk limiting requires conmon 2.1.2 to work. See https://github.com/cri-o/cri-o/security/advisories/GHSA-fcm2-6c3h-pg6j and CVE-2022-1708 for more information.

@haircommander
oci: cap exec sync length
77f0429 
Signed-off-by: Peter Hunt <pehunt@redhat.com>
@openshift-ci openshift-ci bot added release-note Denotes a PR that will be considered when it comes time to generate release notes. kind/bug Categorizes issue or PR as related to a bug. dco-signoff: yes Indicates the PR's author has DCO signed all their commits. labels Jun 6, 2022
@openshift-ci openshift-ci bot requested review from klihub and wgahnagl June 6, 2022 17:42
@openshift-ci
Copy link
Contributor

openshift-ci bot commented Jun 6, 2022

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: haircommander

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@openshift-ci openshift-ci bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Jun 6, 2022
@haircommander
add support for conmon log-global-size-max
fc852b4 
Signed-off-by: Peter Hunt <pehunt@redhat.com>
@haircommander
conmonmgr: query help text to see if it supports log-global-size-max
8acadd3 
Signed-off-by: Peter Hunt <pehunt@redhat.com>
@haircommander
bump to v1.24.1
489819e 
Signed-off-by: Peter Hunt <pehunt@redhat.com>
@haircommander haircommander merged commit a3bbde8 into cri-o:release-1.24 Jun 6, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@fidencio fidencio Awaiting requested review from fidencio fidencio is a code owner

@mrunalp mrunalp Awaiting requested review from mrunalp mrunalp is a code owner

@runcom runcom Awaiting requested review from runcom runcom is a code owner

@klihub klihub Awaiting requested review from klihub

@wgahnagl wgahnagl Awaiting requested review from wgahnagl

Assignees
No one assigned
Labels
approved Indicates a PR has been approved by an approver from all required OWNERS files. dco-signoff: yes Indicates the PR's author has DCO signed all their commits. kind/bug Categorizes issue or PR as related to a bug. release-note Denotes a PR that will be considered when it comes time to generate release notes.
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

None yet
1 participant
@haircommander