NO-ISSUE: Changes to prepare for new 4.22 rebase#6231
NO-ISSUE: Changes to prepare for new 4.22 rebase#6231openshift-merge-bot[bot] merged 3 commits intoopenshift:mainfrom
Conversation
openshift-ci-robot
added
the
jira/valid-reference
|
@pmtk: This pull request explicitly references no jira issue. DetailsIn response to this: Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
📝 WalkthroughWalkthroughUpgraded vendored modules (filepath-securejoin → v0.5.1, runc → v1.2.8, selinux → v1.12.0), removed two etcd local replace directives, and introduced pathrs-lite (fd, procfs, gocompat, kernelversion, consts, assert) plus runc pathrs integrations; multiple legacy Linux helpers were removed or replaced. Changes
Sequence Diagram(s)sequenceDiagram
participant Caller as Caller
participant Pathrs as pathrs-lite
participant FD as internal/fd
participant Procfs as internal/procfs
participant Kernel as Kernel/syscalls
Caller->>Pathrs: request lookup / open / mkdir
Pathrs->>FD: prepareAt → Openat/Openat2 / Readlinkat / Fstat
FD->>Kernel: syscall (openat2/openat/readlink/statx/fstat)
Kernel-->>FD: result / error
FD-->>Pathrs: *os.File or error
Pathrs->>Procfs: ProcSelf/overmount/mountID checks / reopen helpers
Procfs->>Kernel: probe features / open proc handles
Kernel-->>Procfs: probe results
Procfs-->>Pathrs: verified handles / paths or error
Pathrs-->>Caller: safe *os.File or error
Estimated code review effort🎯 4 (Complex) | ⏱️ ~50 minutes 🚥 Pre-merge checks | ✅ 3✅ Passed checks (3 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing touches🧪 Generate unit tests (beta)
Tip Issue Planner is now in beta. Read the docs and try it out! Share your feedback on Discord. Comment |
openshift-ci
bot
added
the
approved
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 8
🤖 Fix all issues with AI agents
In `@go.mod`:
- Around line 133-135: The go.mod currently pins
github.com/opencontainers/selinux at v1.12.0 which is vulnerable
(CVE-2025-52881); update the selinux dependency to v1.13.0 or later by changing
the module version (github.com/opencontainers/selinux -> v1.13.0 or newer) in
go.mod or running `go get github.com/opencontainers/selinux@v1.13.0` (or later),
then run `go mod tidy` and verify the updated version in go.sum; ensure you
re-run tests and any container/runtime integration checks to confirm no
regressions after upgrading (also confirm runc remains at the patched v1.2.8).
In `@vendor/github.com/cyphar/filepath-securejoin/doc.go`:
- Line 46: The markdown reference link for [os.Root] in
vendor/github.com/cyphar/filepath-securejoin/doc.go is malformed (it uses
"https:///" instead of "https://"); update the URL in the comment to use
"https://" (i.e., change "https:///" to "https://") so the link resolves
correctly, and optionally add a note to report this to the upstream project or
include a local vendored patch—locate the comment containing "[os.Root]" in
doc.go to make the edit.
In
`@vendor/github.com/cyphar/filepath-securejoin/pathrs-lite/internal/fd/openat2_linux.go`:
- Around line 42-46: The Openat2 function dereferences the how pointer
unconditionally which will panic if nil; update Openat2 to guard against a nil
how by creating a local unix.OpenHow value when how == nil (or copy into a local
variable AlwaysHow := *how / defaultHow when how != nil), then operate on that
local (set Flags |= unix.O_CLOEXEC) and pass its address to the subsequent call;
reference the Openat2 function and the how variable so the change replaces
direct mutations of how with mutations on the local safeOpenHow before using it.
In
`@vendor/github.com/cyphar/filepath-securejoin/pathrs-lite/internal/procfs/procfs_linux.go`:
- Around line 130-137: The clonePrivateProcMount function leaks the first
procRoot file descriptor when hookForcePrivateProcRootOpenTreeAtRecursive forces
the AT_RECURSIVE fallback after a successful fd.OpenTree; update
clonePrivateProcMount to close the initially opened procRoot (call
procRoot.Close() or fd.Close on the handle) before reassigning it with the
second fd.OpenTree call, and ensure you only attempt to close when procRoot is
non-nil and the first open succeeded (use the existing procRoot, err variables),
preserving error semantics if the close itself fails or if the second OpenTree
returns an error.
- Around line 326-336: The code handling a fallback for ProcRoot masks the real
failure by returning the original err when OpenUnsafeProcRoot() (called as proc,
err2 := OpenUnsafeProcRoot()) fails; change the error return to propagate err2
(the OpenUnsafeProcRoot error) instead of err so callers see the actual failure
from OpenUnsafeProcRoot when it fails during the proc.lookup fallback. Ensure
the return in that branch returns nil, nil, err2 and keep the surrounding logic
(ProcRoot switch, proc.lookup, err checks) intact.
In `@vendor/github.com/cyphar/filepath-securejoin/README.md`:
- Line 184: Remove the unused Markdown link reference `[umoci]` from the
README.md (or restore its corresponding inline reference) so the markdownlint
MD053 warning is resolved; specifically, either delete the `[umoci]:
https://github.com/opencontainers/umoci` reference or add usages of `[umoci]` in
the document where intended.
In `@vendor/github.com/opencontainers/runc/internal/pathrs/root_pathrslite.go`:
- Around line 66-71: Add O_CLOEXEC to the flags before calling unix.Openat and
wrap any returned error in an os.PathError that includes the operation "openat"
and the full path (root+"/"+subpath): when preparing flags for unix.Openat (the
flags variable used in the unix.Openat call), ensure flags |= unix.O_CLOEXEC |
unix.O_CREAT | unix.O_NOFOLLOW, and if unix.Openat returns err, return
(&os.PathError{Op: "openat", Path: root + "/" + subpath, Err: err}) instead of
the raw err so callers get path context while preserving the existing
os.NewFile(uintptr(fd), root+"/"+subpath) return.
In `@vendor/modules.txt`:
- Around line 59-67: The selinux dependency is vulnerable to CVE-2025-52881;
update the module github.com/opencontainers/selinux to v1.13.0 or later by
changing the version requirement to >= v1.13.0 in your module config (go.mod),
then run dependency resolution (go get github.com/opencontainers/selinux@v1.13.0
and go mod tidy) and regenerate vendored dependencies so the new version is
recorded; also verify go.sum no longer pins the older v1.12.x and ensure no
indirect dependencies reintroduce the vulnerable version.
| github.com/opencontainers/runc v1.2.8 // indirect | ||
| github.com/opencontainers/runtime-spec v1.2.0 // indirect | ||
| github.com/opencontainers/selinux v1.11.1 // indirect | ||
| github.com/opencontainers/selinux v1.12.0 // indirect |
There was a problem hiding this comment.
🧩 Analysis chain
🌐 Web query:
GHSA-cgrx-mc8f-2prm runc patched version
💡 Result:
For GHSA-cgrx-mc8f-2prm (opencontainers runc), the patched runc versions are: 1.2.8, 1.3.3, and 1.4.0-rc.3. [1]
(Also noted in the same advisory: github.com/opencontainers/selinux is patched in 1.13.0.) [1]
🌐 Web query:
GO-2025-4098 runc container escape fix version
💡 Result:
For GO-2025-4098 (CVE-2025-52881) affecting runc:
- Fixed runc versions: v1.2.8, v1.3.3, v1.4.0-rc.3 (and later in each line) — i.e., upgrade to at least one of those patched releases. [1][2]
- Also affected module:
github.com/opencontainers/selinux— fixed in v1.13.0 (upgrade to v1.13.0+). [1]
Affected runc ranges (per Go vuln report): before v1.2.8; v1.3.0-rc.1 to before v1.3.3; v1.4.0-rc.1 to before v1.4.0-rc.3. [1]
Sources: [1] [2]
Upgrade selinux to v1.13.0 or later.
The vulnerability (GHSA-cgrx-mc8f-2prm / CVE-2025-52881) affects both runc and selinux. While runc v1.2.8 is correctly patched, selinux v1.12.0 is not—it requires v1.13.0+. The current dependency is exposed to a HIGH severity runc container escape vulnerability.
🧰 Tools
🪛 OSV Scanner (2.3.2)
[HIGH] 135-135: github.com/opencontainers/selinux 1.12.0: Container escape and DDoS due to arbitrary write gadgets and procfs write redirects in github.com/opencontainers/runc
(GO-2025-4098)
[HIGH] 135-135: github.com/opencontainers/selinux 1.12.0: runc container escape and denial of service due to arbitrary write gadgets and procfs write redirects
🤖 Prompt for AI Agents
In `@go.mod` around lines 133 - 135, The go.mod currently pins
github.com/opencontainers/selinux at v1.12.0 which is vulnerable
(CVE-2025-52881); update the selinux dependency to v1.13.0 or later by changing
the module version (github.com/opencontainers/selinux -> v1.13.0 or newer) in
go.mod or running `go get github.com/opencontainers/selinux@v1.13.0` (or later),
then run `go mod tidy` and verify the updated version in go.sum; ensure you
re-run tests and any container/runtime integration checks to confirm no
regressions after upgrading (also confirm runc remains at the patched v1.2.8).
There was a problem hiding this comment.
Can't do it just yet - it would bump the github.com/cyphar/filepath-securejoin to too recent version which would require runc bump which would break K8s from o/kubernetes
There was a problem hiding this comment.
@pmtk, understood—dependency chain constraints during the rebase make sense.
Is there a plan to upgrade selinux to v1.13.0+ in a follow-up once the K8s compatibility issues are resolved? Would you like me to create a tracking issue for this security update?
vendor/github.com/cyphar/filepath-securejoin/pathrs-lite/internal/fd/openat2_linux.go
Show resolved
Hide resolved
vendor/github.com/cyphar/filepath-securejoin/pathrs-lite/internal/procfs/procfs_linux.go
Show resolved
Hide resolved
vendor/github.com/cyphar/filepath-securejoin/pathrs-lite/internal/procfs/procfs_linux.go
Show resolved
Hide resolved
vendor/github.com/opencontainers/runc/internal/pathrs/root_pathrslite.go
Show resolved
Hide resolved
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Fix all issues with AI agents
In `@vendor/github.com/opencontainers/selinux/go-selinux/selinux_linux.go`:
- Around line 738-740: The check that decides ErrNotTGLeader is using
unix.Getuid() incorrectly; replace the real-UID check with a PID check by
calling unix.Getpid() instead of unix.Getuid() so the condition becomes
unix.Getpid() != unix.Gettid(); update the conditional that returns
ErrNotTGLeader (the block referencing unix.Gettid() and ErrNotTGLeader) to use
unix.Getpid() to correctly detect “not thread-group leader.”
🧹 Nitpick comments (1)
vendor/github.com/cyphar/filepath-securejoin/pathrs-lite/lookup_linux.go (1)
62-63: Stale TODO: Go 1.21 has been out since August 2023.The comment
// TODO: Switch to clear once we switch to Go 1.21.is outdated. However, this is vendored upstream code — no action needed on your side.
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Fix all issues with AI agents
In `@etcd/vendor/github.com/openshift/microshift/pkg/config/apiserver.go`:
- Around line 158-169: The issue is that ToApiserverArgs() always applies
fg.CustomNoUpgrade.Enabled/Disabled even when FeatureSet isn't
"CustomNoUpgrade"; update validation or guarding: either modify
validateFeatureGates to return an error if fg.FeatureSet is not
"CustomNoUpgrade" but fg.CustomNoUpgrade.Enabled or .Disabled are non-empty, or
change ToApiserverArgs to only call addFeatures on fg.CustomNoUpgrade when
fg.FeatureSet == "CustomNoUpgrade"; reference the validateFeatureGates function
and the ToApiserverArgs method and the CustomNoUpgrade.Enabled/Disabled fields
when making the fix so non-empty custom lists cannot bypass feature-set checks
unless FeatureSet is explicitly "CustomNoUpgrade".
- Around line 204-205: The error message currently uses intersect.UnsortedList()
which produces a non-deterministic ordering; replace the call to
intersect.UnsortedList() with intersect.SortedList() (or otherwise sort the
slice) in the block that checks if a.Intersection(b) has length > 0 so the
returned fmt.Errorf("%s: %s", errorMsg, ...) contains a stable, deterministic
list; update the code where a.Intersection(b) is computed and the fmt.Errorf
call to use SortedList() instead of UnsortedList().
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In @.lichen.yaml:
- Around line 37-40: The comment in .lichen.yaml claims Kubernetes is using
v0.6.1 of "github.com/cyphar/filepath-securejoin" but provides no source; either
remove the v0.6.1 claim or add a verifiable reference (e.g., a link to the
upstream Kubernetes go.mod or CHERRY-PICK/RELEASE note that pins that version
and an optional date) so the comment is maintainable; update the comment above
the path "github.com/cyphar/filepath-securejoin" to include that link and
context or delete the unsupported v0.6.1 mention and keep only the verifiable
K8s 1.35 / v0.6.0 statement.
|
/override ci/prow/ocp-full-conformance-rhel-eus ci/prow/ocp-full-conformance-serial-rhel-eus Unrelated issue. |
|
@pacevedom: Overrode contexts on behalf of pacevedom: ci/prow/ocp-full-conformance-rhel-eus, ci/prow/ocp-full-conformance-serial-rhel-eus DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: pacevedom, pmtk The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
|
@pmtk: all tests passed! Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
|
/verified by @pmtk |
openshift-ci-robot
added
the
verified
|
@pmtk: This PR has been marked as verified by DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
3 participants
Summary by CodeRabbit
New Features
Chores
Compatibility