Changelog for runc-1.1.4-4.23.x86_64.rpm :

* Wed Aug 31 2022 Fabian Vogt - Update to runc v1.1.4. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.1.4. bsc#1202021
* Fix mounting via wrong proc fd. When the user and mount namespaces are used, and the bind mount is followed by the cgroup mount in the spec, the cgroup was mounted using the bind mount\'s mount fd.
* Switch kill() in libcontainer/nsenter to sane_kill().
* Fix \"permission denied\" error from runc run on noexec fs.
* Fix failed exec after systemctl daemon-reload. Due to a regression in v1.1.3, the DeviceAllow=char-pts rwm rule was no longer added and was causing an error open /dev/pts/0: operation not permitted: unknown when systemd was reloaded. (boo#1202821)
* Thu Jun 09 2022 Aleksa Sarai - Update to runc v1.1.3. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.1.3. (Includes a fix for bsc#1200088.)
* Our seccomp `-ENOSYS` stub now correctly handles multiplexed syscalls on s390 and s390x. This solves the issue where syscalls the host kernel did not support would return `-EPERM` despite the existence of the `-ENOSYS` stub code (this was due to how s390x does syscall multiplexing).
* Retry on dbus disconnect logic in libcontainer/cgroups/systemd now works as intended; this fix does not affect runc binary itself but is important for libcontainer users such as Kubernetes.
* Inability to compile with recent clang due to an issue with duplicate constants in libseccomp-golang.
* When using systemd cgroup driver, skip adding device paths that don\'t exist, to stop systemd from emitting warnings about those paths.
* Socket activation was failing when more than 3 sockets were used.
* Various CI fixes.
* Allow to bind mount /proc/sys/kernel/ns_last_pid to inside container.
* runc static binaries are now linked against libseccomp v2.5.4.- Remove upstreamed patches: - bsc1192051-0001-seccomp-enosys-always-return-ENOSYS-for-setup-2-on-s390x.patch
* Mon May 23 2022 Aleksa Sarai - Backport to fix issues with newer syscalls (namely faccessat2) on older kernels on s390(x) caused by that platform\'s syscall multiplexing semantics. bsc#1192051 bsc#1199565 + bsc1192051-0001-seccomp-enosys-always-return-ENOSYS-for-setup-2-on-s390x.patch
* Thu May 12 2022 Aleksa Sarai - Add ExcludeArch for s390 (not s390x) since we\'ve never supported it.
* Wed May 11 2022 Aleksa Sarai - Update to runc v1.1.2. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.1.2. CVE-2022-29162 bsc#1199460
* A bug was found in runc where runc exec --cap executed processes with non-empty inheritable Linux process capabilities, creating an atypical Linux environment. For more information, see [GHSA-f3fp-gc8g-vw66][] and CVE-2022-29162. bsc#1199460
* `runc spec` no longer sets any inheritable capabilities in the created example OCI spec (`config.json`) file.
* Tue Mar 29 2022 Aleksa Sarai - Update to runc v1.1.1. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.1.1.
* runc run/start can now run a container with read-only /dev in OCI spec, rather than error out. (#3355)
* runc exec now ensures that --cgroup argument is a sub-cgroup. (#3403) libcontainer systemd v2 manager no longer errors out if one of the files listed in /sys/kernel/cgroup/delegate do not exist in container\'s cgroup. (#3387, #3404)
* Loosen OCI spec validation to avoid bogus \"Intel RDT is not supported\" error. (#3406)
* libcontainer/cgroups no longer panics in cgroup v1 managers if stat of /sys/fs/cgroup/unified returns an error other than ENOENT. (#3435)
* Mon Jan 17 2022 Aleksa Sarai - Update to runc v1.1.0. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.1.0. - libcontainer will now refuse to build without the nsenter package being correctly compiled (specifically this requires CGO to be enabled). This should avoid folks accidentally creating broken runc binaries (and incorrectly importing our internal libraries into their projects). (#3331)
* Tue Dec 14 2021 Aleksa Sarai - Update to runc v1.1.0~rc1. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.1.0-rc.1. + Add support for RDMA cgroup added in Linux 4.11.
* runc exec now produces exit code of 255 when the exec failed. This may help in distinguishing between runc exec failures (such as invalid options, non-running container or non-existent binary etc.) and failures of the command being executed. + runc run: new --keep option to skip removal exited containers artefacts. This might be useful to check the state (e.g. of cgroup controllers) after the container hasexited. + seccomp: add support for SCMP_ACT_KILL_PROCESS and SCMP_ACT_KILL_THREAD (the latter is just an alias for SCMP_ACT_KILL). + seccomp: add support for SCMP_ACT_NOTIFY (seccomp actions). This allows users to create sophisticated seccomp filters where syscalls can be efficiently emulated by privileged processes on the host. + checkpoint/restore: add an option (--lsm-mount-context) to set a different LSM mount context on restore. + intelrdt: support ClosID parameter. + runc exec --cgroup: an option to specify a (non-top) in-container cgroup to use for the process being executed. + cgroup v1 controllers now support hybrid hierarchy (i.e. when on a cgroup v1 machine a cgroup2 filesystem is mounted to /sys/fs/cgroup/unified, runc run/exec now adds the container to the appropriate cgroup under it). + sysctl: allow slashes in sysctl names, to better match sysctl(8)\'s behaviour. + mounts: add support for bind-mounts which are inaccessible after switching the user namespace. Note that this does not permit the container any additional access to the host filesystem, it simply allows containers to have bind-mounts configured for paths the user can access but have restrictive access control settings for other users. + Add support for recursive mount attributes using mount_setattr(2). These have the same names as the proposed mount(8) options -- just prepend r to the option name (such as rro). + Add runc features subcommand to allow runc users to detect what features runc has been built with. This includes critical information such as supported mount flags, hook names, and so on. Note that the output of this command is subject to change and will not be considered stable until runc 1.2 at the earliest. The runtime-spec specification for this feature is being developed in opencontainers/runtime-spec#1130.
* system: improve performance of /proc/$pid/stat parsing.
* cgroup2: when /sys/fs/cgroup is configured as a read-write mount, change the ownership of certain cgroup control files (as per /sys/kernel/cgroup/delegate) to allow for proper deferral to the container process.
* runc checkpoint/restore: fixed for containers with an external bind mount which destination is a symlink.
* cgroup: improve openat2 handling for cgroup directory handle hardening. runc delete -f now succeeds (rather than timing out) on a paused container.
* runc run/start/exec now refuses a frozen cgroup (paused container in case of exec). Users can disable this using --ignore-paused.- Update version data embedded in binary to correctly include the git commit of the release.- Drop runc-rpmlintrc because we don\'t have runc-test anymore.
* Mon Dec 06 2021 Aleksa Sarai - Update to runc v1.0.3. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.0.3. CVE-2021-43784 bsc#1193436
* A potential vulnerability was discovered in runc (related to an internal usage of netlink), however upon further investigation we discovered that while this bug was exploitable on the master branch of runc, no released version of runc could be exploited using this bug. The exploit required being able to create a netlink attribute with a length that would overflow a uint16 but this was not possible in any released version of runc. For more information see GHSA-v95c-p5hm-xq8f and CVE-2021-43784. Due to an abundance of caution we decided to do an emergency release with this fix, but to reiterate we do not believe this vulnerability was possible to exploit. Thanks to Felix Wilhelm from Google Project Zero for discovering and reporting this vulnerability so quickly.
* Fixed inability to start a container with read-write bind mount of a read-only fuse host mount.
* Fixed inability to start when read-only /dev in set in spec.
* Fixed not removing sub-cgroups upon container delete, when rootless cgroup v2 is used with older systemd.
* Fixed returning error from GetStats when hugetlb is unsupported (which causes excessive logging for kubernetes).
* Mon Aug 23 2021 Aleksa Sarai - Update to runc v1.0.2. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.0.2
* Fixed a failure to set CPU quota period in some cases on cgroup v1.
* Fixed the inability to start a container with the \"adding seccomp filter rule for syscall ...\" error, caused by redundant seccomp rules (i.e. those that has action equal to the default one). Such redundant rules are now skipped.
* Made release builds reproducible from now on.
* Fixed a rare debug log race in runc init, which can result in occasional harmful \"failed to decode ...\" errors from runc run or exec.
* Fixed the check in cgroup v1 systemd manager if a container needs to be frozen before Set, and add a setting to skip such freeze unconditionally. The previous fix for that issue, done in runc 1.0.1, was not working.
* Sun Jul 18 2021 Aleksa Sarai - Update to runc v1.0.1. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.0.1
* Fixed occasional runc exec/run failure (\"interrupted system call\") on an Azure volume.
* Fixed \"unable to find groups ... token too long\" error with /etc/group containing lines longer than 64K characters.
* cgroup/systemd/v1: fix leaving cgroup frozen after Set if a parent cgroup is frozen. This is a regression in 1.0.0, not affecting runc itself but some of libcontainer users (e.g Kubernetes).
* cgroupv2: bpf: Ignore inaccessible existing programs in case of permission error when handling replacement of existing bpf cgroup programs. This fixes a regression in 1.0.0, where some SELinux policies would block runc from being able to run entirely.
* cgroup/systemd/v2: don\'t freeze cgroup on Set.
* cgroup/systemd/v1: avoid unnecessary freeze on Set.- Remove upstreamed patches: + boo1187704-0001-cgroupv2-ebpf-ignore-inaccessible-existing-programs.patch
* Thu Jul 01 2021 Aleksa Sarai - Backport to fix issues with runc under openSUSE MicroOS\'s SELinux policy. boo#1187704 + boo1187704-0001-cgroupv2-ebpf-ignore-inaccessible-existing-programs.patch
* Tue Jun 01 2021 Aleksa Sarai - Update to runc v1.0.0. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.0.0 ! The usage of relative paths for mountpoints will now produce a warning (such configurations are outside of the spec, and in future runc will produce an error when given such configurations).
* cgroupv2: devices: rework the filter generation to produce consistent results with cgroupv1, and always clobber any existing eBPF program(s) to fix runc update and avoid leaking eBPF programs (resulting in errors when managing containers).
* cgroupv2: correctly convert \"number of IOs\" statistics in a cgroupv1-compatible way.
* cgroupv2: support larger than 32-bit IO statistics on 32-bit architectures.
* cgroupv2: wait for freeze to finish before returning from the freezing code, optimize the method for checking whether a cgroup is frozen.
* cgroups/systemd: fixed \"retry on dbus disconnect\" logic introduced in rc94
* cgroups/systemd: fixed returning \"unit already exists\" error from a systemd cgroup manager (regression in rc94) + cgroupv2: support SkipDevices with systemd driver + cgroup/systemd: return, not ignore, stop unit error from Destroy + Make \"runc --version\" output sane even when built with go get or otherwise outside of our build scripts. + cgroups: set SkipDevices during runc update (so we don\'t modify cgroups at all during runc update). + cgroup1: blkio: support BFQ weights. + cgroupv2: set per-device io weights if BFQ IO scheduler is available.
* Wed May 19 2021 Aleksa Sarai - Update to runc v1.0.0~rc95. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.0.0-rc95 This release of runc contains a fix for CVE-2021-30465, and users are strongly recommended to update (especially if you are providing semi-limited access to spawn containers to untrusted users). bsc#1185405
* Wed May 12 2021 Aleksa Sarai - Update to runc v1.0.0~rc94. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.0.0-rc94 Breaking Changes:
* cgroupv1: kernel memory limits are now always ignored, as kmemcg has been effectively deprecated by the kernel. Users should make use of regular memory cgroup controls. Regression Fixes:
* seccomp: fix 32-bit compilation errors
* runc init: fix a hang caused by deadlock in seccomp/ebpf loading code
* runc start: fix \"chdir to cwd: permission denied\" for some setups- Remove upstreamed patches: - 0001-cloned_binary-switch-from-error-to-warning-for-SYS_m.patch
* Mon Apr 26 2021 Aleksa Sarai - Backport patch to fix build on SLE-12 ppc64le. + 0001-cloned_binary-switch-from-error-to-warning-for-SYS_m.patch
* Wed Feb 03 2021 Aleksa Sarai - Update to runc v1.0.0~rc93. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.0.0-rc93 bsc#1182451 bsc#1184962
* Cgroupv2 support is no longer considered experimental.
* Mountinfo parsing code has been reworked significantly.
* Special ENOSYS handling for seccomp profiles to avoid making new syscalls unusable for glibc.
* Various rootless containers improvements.
* The \"selinux\" and \"apparmor\" buildtags have been removed, and now all runc builds will have SELinux and AppArmor support enabled.
* Tue Feb 02 2021 Aleksa Sarai - Update to handle the docker-runc removal. bsc#1181677- Modernise go building for runc now that it has go.mod.
* Fri Aug 28 2020 Ralf Haferkamp - Upgrade to runc v1.0.0~rc92 (bsc#1175821). Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.0.0-rc92
* Updates to CRIU support.
* Improvements to cgroupfs performance and correctness.
* Thu Jul 02 2020 Aleksa Sarai - Upgrade to runc v1.0.0~rc91. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.0.0-rc91
* This release of runc has experimental support for cgroupv2-only systems.- Remove upstreamed patches: - bsc1149954-0001-sd-notify-do-not-hang-when-NOTIFY_SOCKET-is-used-wit.patch - bsc1168481-0001-cgroup-devices-major-cleanups-and-minimal-transition.patch
* Thu Jun 25 2020 Aleksa Sarai - Switch to Go 1.13 for build.
* Wed May 13 2020 Aleksa Sarai - Backport https://github.com/opencontainers/runc/pull/2391 to help fix bsc#1168481. + bsc1168481-0001-cgroup-devices-major-cleanups-and-minimal-transition.patch
* Tue Apr 14 2020 Ralf Haferkamp - Renamed patch: 0001-sd-notify-do-not-hang-when-NOTIFY_SOCKET-is-used-wit.patch to bsc1149954-0001-sd-notify-do-not-hang-when-NOTIFY_SOCKET-is-used-wit.patch
* Wed Mar 18 2020 Ralf Haferkamp - Added fix for bsc#1149954
* 0001-sd-notify-do-not-hang-when-NOTIFY_SOCKET-is-used-wit.patch (cherry pick of https://github.com/opencontainers/runc/pull/1807)
* Thu Jan 23 2020 Aleksa Sarai - Upgrade to runc v1.0.0~rc10. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.0.0-rc10- Drop upstreamed patches: - CVE-2019-19921.patch
* Tue Jan 21 2020 Bjørn Lie - Change packagewide go version to be greater or equal to 1.10.
* Fri Jan 17 2020 Aleksa Sarai - Update CVE-2019-19921 patch to match upstream PR.
* CVE-2019-19921.patch
* Tue Jan 14 2020 Aleksa Sarai - Add backported fix for CVE-2019-19921. bsc#1160452 + CVE-2019-19921.patch