From a0ca8c47e7f82015e17ab741de80444d79ef0f85 Mon Sep 17 00:00:00 2001
From: zhongjiawei <zhongjiawei1@huawei.com>
Date: Mon, 5 Feb 2024 17:29:21 +0800
Subject: [PATCH] runc:check cmd exist

---
 git-commit                            |  2 +-
 patch/0156-runc-check-cmd-exist.patch | 36 +++++++++++++++++++++++++++
 runc.spec                             |  8 +++++-
 series.conf                           |  1 +
 4 files changed, 45 insertions(+), 2 deletions(-)
 create mode 100644 patch/0156-runc-check-cmd-exist.patch

diff --git a/git-commit b/git-commit
index b29fd71..0e218a5 100644
--- a/git-commit
+++ b/git-commit
@@ -1 +1 @@
-5b7e5feb12b4d53a03cda29bbad6906415089c8c
+077273104199bd5d8201ee80bf78af5e21a44228
diff --git a/patch/0156-runc-check-cmd-exist.patch b/patch/0156-runc-check-cmd-exist.patch
new file mode 100644
index 0000000..01b092b
--- /dev/null
+++ b/patch/0156-runc-check-cmd-exist.patch
@@ -0,0 +1,36 @@
+From aff0fc10d4e651b722b40950c794435c55a33034 Mon Sep 17 00:00:00 2001
+From: zhongjiawei <zhongjiawei1@huawei.com>
+Date: Mon, 5 Feb 2024 17:24:25 +0800
+Subject: [PATCH] runc:check cmd exist
+
+---
+ libcontainer/setns_init_linux.go | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/libcontainer/setns_init_linux.go b/libcontainer/setns_init_linux.go
+index e38165d..74a91a6 100644
+--- a/libcontainer/setns_init_linux.go
++++ b/libcontainer/setns_init_linux.go
+@@ -6,6 +6,7 @@ package libcontainer
+ import (
+ 	"fmt"
+ 	"os"
++	"os/exec"
+ 	"syscall"
+ 
+ 	"github.com/opencontainers/runc/libcontainer/apparmor"
+@@ -64,6 +65,11 @@ func (l *linuxSetnsInit) Init() error {
+ 	if err := finalizeNamespace(l.config); err != nil {
+ 		return err
+ 	}
++	// Check for the arg early to make sure it exists.
++	_, err := exec.LookPath(l.config.Args[0])
++	if err != nil {
++		return err
++	}
+ 	if err := apparmor.ApplyProfile(l.config.AppArmorProfile); err != nil {
+ 		return err
+ 	}
+-- 
+2.33.0
+
diff --git a/runc.spec b/runc.spec
index c951637..5589b0a 100644
--- a/runc.spec
+++ b/runc.spec
@@ -4,7 +4,7 @@
 
 Name: docker-runc
 Version: 1.0.0.rc3
-Release: 320
+Release: 321
 Summary: runc is a CLI tool for spawning and running containers according to the OCI specification.
 
 License: ASL 2.0
@@ -57,6 +57,12 @@ install -p -m 755 runc $RPM_BUILD_ROOT/%{_bindir}/runc
 %{_bindir}/runc
 
 %changelog
+* Mon Feb 5 2024 zhongjiawei<zhongjiawei1@huawei.com> - 1.0.0.rc3-321
+- Type:bugfix
+- CVE:NA
+- SUG:NA
+- DESC:check cmd exist
+
 * Thu Feb 1 2024 zhongjiawei<zhongjiawei1@huawei.com> - 1.0.0.rc3-320
 - Type:CVE
 - CVE:CVE-2024-21626
diff --git a/series.conf b/series.conf
index d1f8ace..7834e42 100644
--- a/series.conf
+++ b/series.conf
@@ -155,4 +155,5 @@ patch/0152-runc-libcontainer-create-Cwd-when-it-does-not-exist.patch
 patch/0153-runc-delete-do-not-ignore-error-from-destroy.patch
 patch/0154-libct-Destroy-don-t-proceed-in-case-of-errors.patch
 patch/0155-runc-fix-CVE-2024-21626.patch
+patch/0156-runc-check-cmd-exist.patch
 #end
-- 
Gitee