From 827d6df9aa81cb6473f1c5fc9c9c8559331f5aff Mon Sep 17 00:00:00 2001 From: zhongjiawei Date: Tue, 9 Aug 2022 20:39:34 +0800 Subject: [PATCH] runc: change Umask to 0022 --- ...unc-change-runc-default-umask-to-027.patch | 52 ------------- patch/0080-runc-support-specify-umask.patch | 73 ------------------- runc-openeuler.spec | 8 +- series.conf | 2 - 4 files changed, 7 insertions(+), 128 deletions(-) delete mode 100644 patch/0033-runc-change-runc-default-umask-to-027.patch delete mode 100644 patch/0080-runc-support-specify-umask.patch diff --git a/patch/0033-runc-change-runc-default-umask-to-027.patch b/patch/0033-runc-change-runc-default-umask-to-027.patch deleted file mode 100644 index bee6ab3..0000000 --- a/patch/0033-runc-change-runc-default-umask-to-027.patch +++ /dev/null @@ -1,52 +0,0 @@ -From 49ff7be84939cf93b8bf4861ddc783704fb3f50b Mon Sep 17 00:00:00 2001 -From: dengguangxing -Date: Mon, 8 Jan 2018 10:35:34 +0800 -Subject: [PATCH 33/94] runc: change runc default umask to 027 - -[Changelog]:change runc default umask to 027 -change exec process default umask to 0027 - -Change-Id: Ia7ff0216adc17d61586954de83031be21ab88338 -Signed-off-by: dengguangxing ---- - libcontainer/rootfs_linux.go | 2 +- - libcontainer/setns_init_linux.go | 3 +++ - 2 files changed, 4 insertions(+), 1 deletion(-) - -diff --git a/libcontainer/rootfs_linux.go b/libcontainer/rootfs_linux.go -index d507373..1c93903 100644 ---- a/libcontainer/rootfs_linux.go -+++ b/libcontainer/rootfs_linux.go -@@ -136,7 +136,7 @@ func finalizeRootfs(config *configs.Config) (err error) { - } - } - -- syscall.Umask(0022) -+ syscall.Umask(0027) - return nil - } - -diff --git a/libcontainer/setns_init_linux.go b/libcontainer/setns_init_linux.go -index 48cc0ae..e8e969a 100644 ---- a/libcontainer/setns_init_linux.go -+++ b/libcontainer/setns_init_linux.go -@@ -5,6 +5,7 @@ package libcontainer - import ( - "fmt" - "os" -+ "syscall" - - "github.com/opencontainers/runc/libcontainer/apparmor" - "github.com/opencontainers/runc/libcontainer/keys" -@@ -40,6 +41,8 @@ func (l *linuxSetnsInit) Init() error { - return err - } - } -+ // set exec process umask to 0027 according to secure policy -+ syscall.Umask(0027) - if l.config.NoNewPrivileges { - if err := system.Prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0); err != nil { - return err --- -2.7.4.3 - diff --git a/patch/0080-runc-support-specify-umask.patch b/patch/0080-runc-support-specify-umask.patch deleted file mode 100644 index 4f351a6..0000000 --- a/patch/0080-runc-support-specify-umask.patch +++ /dev/null @@ -1,73 +0,0 @@ -From 18f5c5e20e342af002b0edb2295f64ea12632cc4 Mon Sep 17 00:00:00 2001 -From: wangfengtu -Date: Fri, 21 Dec 2018 15:02:16 +0800 -Subject: [PATCH 80/94] runc: support specify umask - -reason:support specify umask. -Umask can be 0022 or 0027(default) by specify umask when -start container by command `docker create/run` or start -daemon by command `dockerd`. For example: -$ dockerd --annotation native.umask=normal -$ dockerd --annotation native.umask=secure -$ docker run --exec-opt native.umask=normal -$ docker run --exec-opt native.umask=secure -`normal` reparent umask is 0022, `secure` -reparent umask is 0027. - -Change-Id: I49166759ad42dca0ac1f9755f85592e93951c249 -Signed-off-by: lujingxiao -Signed-off-by: wangfengtu ---- - libcontainer/rootfs_linux.go | 7 ++++++- - libcontainer/setns_init_linux.go | 10 ++++++++-- - 2 files changed, 14 insertions(+), 3 deletions(-) - -diff --git a/libcontainer/rootfs_linux.go b/libcontainer/rootfs_linux.go -index 38bdd1b..3dd5113 100644 ---- a/libcontainer/rootfs_linux.go -+++ b/libcontainer/rootfs_linux.go -@@ -136,7 +136,12 @@ func finalizeRootfs(config *configs.Config) (err error) { - } - } - -- syscall.Umask(0027) -+ umask := libcontainerUtils.SearchLabels(config.Labels, "native.umask") -+ if umask == "normal" { -+ syscall.Umask(0022) -+ } else { -+ syscall.Umask(0027) -+ } - return nil - } - -diff --git a/libcontainer/setns_init_linux.go b/libcontainer/setns_init_linux.go -index e8e969a..b3fab21 100644 ---- a/libcontainer/setns_init_linux.go -+++ b/libcontainer/setns_init_linux.go -@@ -11,6 +11,7 @@ import ( - "github.com/opencontainers/runc/libcontainer/keys" - "github.com/opencontainers/runc/libcontainer/seccomp" - "github.com/opencontainers/runc/libcontainer/system" -+ "github.com/opencontainers/runc/libcontainer/utils" - "github.com/opencontainers/selinux/go-selinux/label" - ) - -@@ -41,8 +42,13 @@ func (l *linuxSetnsInit) Init() error { - return err - } - } -- // set exec process umask to 0027 according to secure policy -- syscall.Umask(0027) -+ // set exec process umask to 0027 or 0022 according to container's config -+ umask := utils.SearchLabels(l.config.Config.Labels, "native.umask") -+ if umask == "normal" { -+ syscall.Umask(0022) -+ } else { -+ syscall.Umask(0027) -+ } - if l.config.NoNewPrivileges { - if err := system.Prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0); err != nil { - return err --- -2.7.4.3 - diff --git a/runc-openeuler.spec b/runc-openeuler.spec index 0b176d6..9f143a9 100644 --- a/runc-openeuler.spec +++ b/runc-openeuler.spec @@ -2,7 +2,7 @@ Name: docker-runc Version: 1.0.0.rc3 -Release: 204 +Release: 205 Summary: runc is a CLI tool for spawning and running containers according to the OCI specification. License: ASL 2.0 @@ -41,6 +41,12 @@ install -p -m 755 runc $RPM_BUILD_ROOT/%{_bindir}/runc %{_bindir}/runc %changelog +* Tue Aug 9 2022 zhongjiawei - 1.0.0.rc3-205 +- Type:bugfix +- CVE:NA +- SUG:NA +- DESC:change Uamsk to 0022 + * Tue Aug 09 2022 zhongjiawei - 1.0.0.rc3-204 - Type:CVE - CVE:CVE-2022-29162 diff --git a/series.conf b/series.conf index 2bd51ad..3c16f42 100644 --- a/series.conf +++ b/series.conf @@ -30,7 +30,6 @@ 0030-Update-memory-specs-to-use-int64-not-uint64.patch 0031-Add-spec-for-euleros.patch 0032-runc-17-Always-save-own-namespace-paths.patch -0033-runc-change-runc-default-umask-to-027.patch 0034-runc-17-Add-some-compatibility-code-to-surpor.patch 0035-runc-17-Add-root-to-HookState-for-compatibili.patch 0036-runc-17-add-compatibility-for-docker-1.11.2.patch @@ -75,7 +74,6 @@ 0077-runc-Require-libseccomp-static-lib-for-upgrade-f.patch 0078-runc-Fix-race-in-runc-exec.patch 0079-runc-modify-spec-file-for-upgrade.patch -0080-runc-support-specify-umask.patch 0081-runc-fix-oom-killer-disable-unhandled-due-t.patch 0082-runc-make-runc-spec-and-docker-18.9-compati.patch 0083-log-fix-runc-log-decode-failed.patch -- Gitee