diff --git a/git-commit b/git-commit index 6ada732f6ce3b55d8525edc144b564ae8700b624..7b3c36d839d58042b2914d46381eeec23053a591 100644 --- a/git-commit +++ b/git-commit @@ -1 +1 @@ -8dfee68b9de75bc3ed4f74ee58e9f9cff7dcb00a +3af9b6470b9bdac1d1e6e881e8f89963b6965519 diff --git a/patch/0052-runc-check-cmd-exist.patch b/patch/0052-runc-check-cmd-exist.patch new file mode 100644 index 0000000000000000000000000000000000000000..3640e311f1031c8baabbbb61924831d79b267f7f --- /dev/null +++ b/patch/0052-runc-check-cmd-exist.patch @@ -0,0 +1,36 @@ +From 032f0a78d6f4ba49a48ca1ae3d53e6dc8726ff1f Mon Sep 17 00:00:00 2001 +From: zhongjiawei +Date: Tue, 6 Feb 2024 11:20:48 +0800 +Subject: [PATCH] runc:check cmd exist + +--- + libcontainer/setns_init_linux.go | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/libcontainer/setns_init_linux.go b/libcontainer/setns_init_linux.go +index 1eea851..f1dcab6 100644 +--- a/libcontainer/setns_init_linux.go ++++ b/libcontainer/setns_init_linux.go +@@ -4,6 +4,7 @@ import ( + "errors" + "fmt" + "os" ++ "os/exec" + "strconv" + + "github.com/opencontainers/selinux/go-selinux" +@@ -86,6 +87,11 @@ func (l *linuxSetnsInit) Init() error { + if err := finalizeNamespace(l.config); err != nil { + return err + } ++ // Check for the arg early to make sure it exists. ++ _, err := exec.LookPath(l.config.Args[0]) ++ if err != nil { ++ return err ++ } + if err := apparmor.ApplyProfile(l.config.AppArmorProfile); err != nil { + return err + } +-- +2.33.0 + diff --git a/runc.spec b/runc.spec index 8833bfe20accd5b34549d6475d70d49a9e539039..ef8614683980a56742d8135ece432230c8b4e87c 100644 --- a/runc.spec +++ b/runc.spec @@ -54,6 +54,12 @@ install -p -m 755 runc $RPM_BUILD_ROOT/%{_bindir}/runc %{_bindir}/runc %changelog +* Tue Feb 06 2024 zhongjiawei - 1.1.3-24 +- Type:bugfix +- CVE:NA +- SUG:NA +- DESC:check cmd exist + * Thu Feb 01 2024 zhongjiawei - 1.1.3-23 - Type:CVE - CVE:CVE-2024-21626 diff --git a/series.conf b/series.conf index 311050aefd0b7dd0ed05ce7ce9ab80f6b5441727..95f4db666fd4fa7d77908a369e5cb14643764b70 100644 --- a/series.conf +++ b/series.conf @@ -49,3 +49,4 @@ patch/0048-runc-Fix-undefined-behavior.patch patch/0049-runc-nsexec-Check-for-errors-in-write_log.patch patch/0050-runc-increase-the-number-of-cgroup-deletion-retries.patch patch/0051-runc-fix-CVE-2024-21626.patch +patch/0052-runc-check-cmd-exist.patch