diff --git a/agent/patches/0019-kata-agent-modify-make-flags.patch b/agent/patches/0019-kata-agent-modify-make-flags.patch new file mode 100644 index 0000000000000000000000000000000000000000..50f88fc5790baac5958a6b2baa2c47ff98b26e20 --- /dev/null +++ b/agent/patches/0019-kata-agent-modify-make-flags.patch @@ -0,0 +1,29 @@ +From 1c7aaafa7b8691ea6ed6c910455567b36bb6f5ff Mon Sep 17 00:00:00 2001 +From: jikui +Date: Thu, 18 Mar 2021 15:25:49 +0800 +Subject: [PATCH] kata-agent: modify make flags + +reason: modify make flags + +Signed-off-by: jikui +--- + Makefile | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/Makefile b/Makefile +index e4fd243..26fe898 100644 +--- a/Makefile ++++ b/Makefile +@@ -101,6 +101,9 @@ AGENT_IMAGE := katacontainers/agent-dev + AGENT_TAG := $(if $(COMMIT_NO_SHORT),$(COMMIT_NO_SHORT),dev) + + $(TARGET): $(GENERATED_FILES) $(SOURCES) $(VERSION_FILE) ++ CGO_CFLAGS="-fstack-protector-strong -fPIE -D_FORTIFY_SOURCE=2 -O2" \ ++ CGO_LDFLAGS_ALLOW="-Wl,-z,relro,-z,now" \ ++ CGO_LDFLAGS="-Wl,-z,relro,-z,now -Wl,-z,noexecstack" \ + go build $(BUILDFLAGS) -tags "$(BUILDTAGS)" -o $@ \ + -ldflags "-X main.version=$(VERSION_COMMIT) -X main.seccompSupport=$(SECCOMP) $(LDFLAGS) $(KATA_LDFLAGS)" + +-- +2.25.1 + diff --git a/agent/series.conf b/agent/series.conf index fc5adee738f4fa8d49e7d1c42f416de2580a81a0..732fc3f0b4daf9b5fd44790cef269af735afad2d 100644 --- a/agent/series.conf +++ b/agent/series.conf @@ -16,3 +16,4 @@ 0016-clock-synchronizes-clock-info-with-proxy.patch 0017-agent-add-support-of-new-sandbox-StratoVirt.patch 0018-kata-agent-update-nic-in-guest.patch +0019-kata-agent-modify-make-flags.patch diff --git a/kata-containers.spec b/kata-containers.spec index bb9449ac7eba4cde1e9a3833a924ec05bccdcd2e..79299ff5e43fa0eed1cc163d0ea22a8a00c704c9 100644 --- a/kata-containers.spec +++ b/kata-containers.spec @@ -2,7 +2,7 @@ %global debug_package %{nil} %define VERSION v1.11.1 -%define RELEASE 10 +%define RELEASE 11 Name: kata-containers Version: %{VERSION} @@ -70,6 +70,7 @@ install -p -m 755 -D %{_builddir}/kernel/linux/arch/arm64/boot/Image %{buildroot cd %{_builddir}/kata_integration mkdir -p -m 750 %{buildroot}/usr/bin +strip ./build/kata-runtime ./build/kata-proxy ./build/kata-shim ./build/kata-netmon install -p -m 750 ./build/kata-runtime ./build/kata-proxy ./build/kata-shim ./build/kata-netmon %{buildroot}/usr/bin/ install -p -m 640 ./build/kata-containers-initrd.img %{buildroot}/var/lib/kata/ mkdir -p -m 750 %{buildroot}/usr/share/defaults/kata-containers/ @@ -90,7 +91,13 @@ install -p -m 640 -D ./runtime/cli/config/configuration-qemu.toml %{buildroot}/u %changelog -* Fri Feb 19 2021 xinghe - 1.11.1-10 +* Thu Mar 17 2021 jikui - 1.11.1-11 +- Type:enhancement +- ID:NA +- SUG:NA +- DESC:modify make flags + +* Tue Feb 23 2021 xinghe - 1.11.1-10 - Type:CVE - ID:NA - SUG:NA diff --git a/proxy/patches/0002-kata-proxy-modify-make-flags.patch b/proxy/patches/0002-kata-proxy-modify-make-flags.patch new file mode 100644 index 0000000000000000000000000000000000000000..b164997e5e865a719cc8e2c6c3b225ffd464f74e --- /dev/null +++ b/proxy/patches/0002-kata-proxy-modify-make-flags.patch @@ -0,0 +1,29 @@ +From 2c5cbf2ca9624d5443ad334a8337cb58d57573b2 Mon Sep 17 00:00:00 2001 +From: jikui +Date: Thu, 18 Mar 2021 15:34:07 +0800 +Subject: [PATCH] kata-proxy: modify make flags + +reason: modify make flags + +Signed-off-by: jikui +--- + Makefile | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/Makefile b/Makefile +index a1b3eee..07e9ba8 100644 +--- a/Makefile ++++ b/Makefile +@@ -33,6 +33,9 @@ ifeq ($(STRIP),yes) + endif + + $(TARGET): $(SOURCES) $(VERSION_FILE) ++ CGO_CFLAGS="-fstack-protector-strong -fPIE -D_FORTIFY_SOURCE=2 -O2" \ ++ CGO_LDFLAGS_ALLOW="-Wl,-z,relro,-z,now" \ ++ CGO_LDFLAGS="-Wl,-z,relro,-z,now -Wl,-z,noexecstack" \ + go build $(BUILDFLAGS) -o $@ -ldflags "-X main.version=$(VERSION_COMMIT) $(KATA_LDFLAGS)" + + test: +-- +2.25.1 + diff --git a/proxy/series.conf b/proxy/series.conf index 1f29a6e09e095aac06ef3e23e53d3014353300ac..c798bb51f15770aa2ce4aa7761e9566f5675763e 100644 --- a/proxy/series.conf +++ b/proxy/series.conf @@ -1 +1,2 @@ 0001-clock-synchronizes-clock-info-to-agent.patch +0002-kata-proxy-modify-make-flags.patch diff --git a/runtime/patches/0068-kata-runtime-modify-make-flags.patch b/runtime/patches/0068-kata-runtime-modify-make-flags.patch new file mode 100644 index 0000000000000000000000000000000000000000..32e13bc87106644619b5c3107f99d7d6c5fd123c --- /dev/null +++ b/runtime/patches/0068-kata-runtime-modify-make-flags.patch @@ -0,0 +1,45 @@ +From 883dac2d9cd4daea88a9ac0325df02d1de578168 Mon Sep 17 00:00:00 2001 +From: jikui +Date: Thu, 18 Mar 2021 15:48:11 +0800 +Subject: [PATCH] kata-runtime: modify make flags + +reason: modify make flags + +Signed-off-by: jikui +--- + Makefile | 12 ++++++++++-- + 1 file changed, 10 insertions(+), 2 deletions(-) + +diff --git a/Makefile b/Makefile +index b62e64b..6b9f764 100644 +--- a/Makefile ++++ b/Makefile +@@ -521,7 +521,11 @@ containerd-shim-v2: $(SHIMV2_OUTPUT) + netmon: $(NETMON_TARGET_OUTPUT) + + $(NETMON_TARGET_OUTPUT): $(SOURCES) VERSION +- $(QUIET_BUILD)(cd $(NETMON_DIR) && go build $(BUILDFLAGS) -o $@ -ldflags "-X main.version=$(VERSION)" $(KATA_LDFLAGS)) ++ $(QUIET_BUILD)(cd $(NETMON_DIR) && \ ++ CGO_CFLAGS="-fstack-protector-strong -fPIE -D_FORTIFY_SOURCE=2 -O2" \ ++ CGO_LDFLAGS_ALLOW="-Wl,-z,relro,-z,now" \ ++ CGO_LDFLAGS="-Wl,-z,relro,-z,now -Wl,-z,noexecstack" \ ++ go build $(BUILDFLAGS) -o $@ -ldflags "-X main.version=$(VERSION)" $(KATA_LDFLAGS)) + + runtime: $(TARGET_OUTPUT) $(CONFIGS) + .DEFAULT: default +@@ -559,7 +563,11 @@ GENERATED_FILES += $(CLI_DIR)/config-generated.go + GENERATED_FILES += pkg/katautils/config-settings.go + + $(TARGET_OUTPUT): $(SOURCES) $(GENERATED_FILES) $(MAKEFILE_LIST) | show-summary +- $(QUIET_BUILD)(cd $(CLI_DIR) && go build $(KATA_LDFLAGS) $(BUILDFLAGS) -o $@ .) ++ $(QUIET_BUILD)(cd $(CLI_DIR) && \ ++ CGO_CFLAGS="-fstack-protector-strong -fPIE -D_FORTIFY_SOURCE=2 -O2" \ ++ CGO_LDFLAGS_ALLOW="-Wl,-z,relro,-z,now" \ ++ CGO_LDFLAGS="-Wl,-z,relro,-z,now -Wl,-z,noexecstack" \ ++ go build $(KATA_LDFLAGS) $(BUILDFLAGS) -o $@ .) + + $(SHIMV2_OUTPUT): $(SOURCES) $(GENERATED_FILES) $(MAKEFILE_LIST) + $(QUIET_BUILD)(cd $(SHIMV2_DIR)/ && go build $(KATA_LDFLAGS) -i -o $@ .) +-- +2.25.1 + diff --git a/runtime/series.conf b/runtime/series.conf index 462da994e348cbdc0d10b6ed8128e6066507c54a..78b2c57015f682a2d3878dd16cadc984f118a60d 100644 --- a/runtime/series.conf +++ b/runtime/series.conf @@ -63,3 +63,6 @@ 0063-kata-runtime-fix-get-sandbox-cpu-resources-problem.patch 0064-runtime-add-support-for-stratovirt-of-kata-check-cli.patch 0065-runtime-fixup-that-the-getPids-function-returns-pid-.patch +0066-CVE-2020-28914-1.patch +0067-CVE-2020-28914-2.patch +0068-kata-runtime-modify-make-flags.patch diff --git a/shim/patches/0002-kata-shim-modify-make-flags.patch b/shim/patches/0002-kata-shim-modify-make-flags.patch new file mode 100644 index 0000000000000000000000000000000000000000..290d3ed0b2f0d44026a382e2736faed9bafa4a28 --- /dev/null +++ b/shim/patches/0002-kata-shim-modify-make-flags.patch @@ -0,0 +1,29 @@ +From 0a4adf4ffafd31820c471353757de2a6e2260e39 Mon Sep 17 00:00:00 2001 +From: jikui +Date: Thu, 18 Mar 2021 15:52:27 +0800 +Subject: [PATCH] kata-shim: modify make flags + +reason: modify make flags + +Signed-off-by: jikui +--- + Makefile | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/Makefile b/Makefile +index 5cba637..b244053 100644 +--- a/Makefile ++++ b/Makefile +@@ -33,6 +33,9 @@ ifeq ($(STRIP),yes) + endif + + $(TARGET): $(SOURCES) $(VERSION_FILE) ++ CGO_CFLAGS="-fstack-protector-strong -fPIE -D_FORTIFY_SOURCE=2 -O2" \ ++ CGO_LDFLAGS_ALLOW="-Wl,-z,relro,-z,now" \ ++ CGO_LDFLAGS="-Wl,-z,relro,-z,now -Wl,-z,noexecstack" \ + go build $(BUILDFLAGS) -o $@ -ldflags "-X main.version=$(VERSION_COMMIT) $(KATA_LDFLAGS)" + + test: +-- +2.25.1 + diff --git a/shim/series.conf b/shim/series.conf index ce1ab400e6d85580734751282687de0cbfbb2b41..f9a1be03aba421f8814c59dda0805e0be828877f 100644 --- a/shim/series.conf +++ b/shim/series.conf @@ -1 +1,2 @@ 0001-kata-shim-fix-kata-shim-process-wait-long-tim.patch +0002-kata-shim-modify-make-flags.patch