diff --git a/git-commit b/git-commit index 206eba9f3553aa2d54ba0ce6749f73aefc5e9263..2684b128e605b27e78c061085f9d69c059206b3d 100644 --- a/git-commit +++ b/git-commit @@ -1 +1 @@ -b17d05d6bfb1f6d087f5585e5236ffc04173af69 +0912c2b6b709b0ded8a36dd5b008ceb2d5476b20 diff --git a/patch/0033-runc-libcontainer-skip-chown-of-dev-null-caused-by-fd-red.patch b/patch/0033-runc-libcontainer-skip-chown-of-dev-null-caused-by-fd-red.patch new file mode 100644 index 0000000000000000000000000000000000000000..2bdf85beaed10364050fe9dceffdd60be10bb933 --- /dev/null +++ b/patch/0033-runc-libcontainer-skip-chown-of-dev-null-caused-by-fd-red.patch @@ -0,0 +1,41 @@ +From 52d2b0f2598c255f8fcc295e12a3ddfd4a89dd43 Mon Sep 17 00:00:00 2001 +From: Jaroslav Jindrak +Date: Fri, 20 Jan 2023 21:41:12 +0100 +Subject: [PATCH 1/2] libcontainer: skip chown of /dev/null caused by fd + redirection + +In 18c4760a (libct: fixStdioPermissions: skip chown if not needed) +the check whether the STDIO file descriptors point to /dev/null was +removed which can cause /dev/null to change ownership e.g. when using +docker exec on a running container: + +$ ls -l /dev/null +crw-rw-rw- 1 root root 1, 3 Aug 1 14:12 /dev/null +$ docker exec -u test 0ad6d3064e9d ls +$ ls -l /dev/null +crw-rw-rw- 1 test root 1, 3 Aug 1 14:12 /dev/null + +Signed-off-by: Jaroslav Jindrak +--- + libcontainer/init_linux.go | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/libcontainer/init_linux.go b/libcontainer/init_linux.go +index 1e5c394c..2e4c5935 100644 +--- a/libcontainer/init_linux.go ++++ b/libcontainer/init_linux.go +@@ -411,8 +411,9 @@ func fixStdioPermissions(u *user.ExecUser) error { + return &os.PathError{Op: "fstat", Path: file.Name(), Err: err} + } + +- // Skip chown if uid is already the one we want. +- if int(s.Uid) == u.Uid { ++ // Skip chown if uid is already the one we want or any of the STDIO descriptors ++ // were redirected to /dev/null. ++ if int(s.Uid) == u.Uid || s.Rdev == null.Rdev { + continue + } + +-- +2.33.0 + diff --git a/patch/0034-runc-Fixed-init-state-error-variable.patch b/patch/0034-runc-Fixed-init-state-error-variable.patch new file mode 100644 index 0000000000000000000000000000000000000000..1701ced29e36ad523ab93dcb2d8d47ce3765d2fb --- /dev/null +++ b/patch/0034-runc-Fixed-init-state-error-variable.patch @@ -0,0 +1,29 @@ +From ab18f1e6bf59d651889a9483f45f0e88368669c9 Mon Sep 17 00:00:00 2001 +From: Vipul Newaskar +Date: Sun, 13 Nov 2022 23:46:12 +0530 +Subject: [PATCH 2/2] Fixed init state error variable + +Init State Error message was using the err variable instead of uerr, which has been fixed now. +The error message should not show "nil" now. + +Signed-off-by: Vipul Newaskar +--- + libcontainer/process_linux.go | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/libcontainer/process_linux.go b/libcontainer/process_linux.go +index 1124cf54..3b453ccd 100644 +--- a/libcontainer/process_linux.go ++++ b/libcontainer/process_linux.go +@@ -555,7 +555,7 @@ func (p *initProcess) start() (retErr error) { + // procRun sync. + state, uerr := p.container.updateState(p) + if uerr != nil { +- return fmt.Errorf("unable to store init state: %w", err) ++ return fmt.Errorf("unable to store init state: %w", uerr) + } + p.container.initProcessStartTime = state.InitProcessStartTime + +-- +2.33.0 + diff --git a/runc.spec b/runc.spec index f8644df00a914ce02871c573f8df6cbae4ae0792..8b0d872733c6af85307f79930f182e38d79ff44b 100644 --- a/runc.spec +++ b/runc.spec @@ -3,7 +3,7 @@ Name: docker-runc Version: 1.1.3 -Release: 11 +Release: 12 Summary: runc is a CLI tool for spawning and running containers according to the OCI specification. License: ASL 2.0 @@ -54,6 +54,12 @@ install -p -m 755 runc $RPM_BUILD_ROOT/%{_bindir}/runc %{_bindir}/runc %changelog +* Tue Mar 21 2023 zhongjiawei - 1.1.3-12 +- Type:bugfix +- CVE:NA +- SUG:NA +- DESC:libcontainer: skip chown of /dev/null caused by fd redirection + * Thu Feb 9 2023 zhongjiawei - 1.1.3-11 - Type:bugfix - CVE:NA diff --git a/series.conf b/series.conf index 380e5858dbb00061353dde951fdd68cfb83aa81e..07d9c8507071e03102a2156bc3c7a4cab42fa649 100644 --- a/series.conf +++ b/series.conf @@ -30,3 +30,5 @@ patch/0029-runc-runc-log-forward-to-syslog.patch patch/0030-runc-support-specify-umask.patch patch/0031-runc-modify-linuxcontainer-starttime-uint64-type-tob.patch patch/0032-runc-make-runc-spec-compatible-1.0.0.rc3.patch +patch/0033-runc-libcontainer-skip-chown-of-dev-null-caused-by-fd-red.patch +patch/0034-runc-Fixed-init-state-error-variable.patch