mirror of
https://github.com/containerd/containerd.git
synced 2026-10-28 17:45:13 +08:00
Sebastiaan van Stijn
87f2e7e318
This is the second patch release in the 1.5.z release series of runc, which primarily includes a workaround for a Linux kernel bug causing random runc crashes when using cgroup v2, and other fixes. Fixed - `runc exec -p` with a `process.json` lacking env now sets HOME again (a regression in runc 1.3.0). - Worked around a Linux kernel bug (present since kernel v6.17, fixed in v7.2) which caused the kernel to write past the end of the structure provided by userspace (runc). This resulted in memory corruption inside runc (manifesting as random crashes) when configuring device rules on cgroup v2 systems. - `runc exec --cgroup` (and the equivalent libcontainer `Process.SubCgroupPaths` API) no longer accepts a sub-cgroup path that escapes the container's cgroup into a sibling cgroup sharing the same name prefix. Note that using `--cgroup` requires the same privileges as running runc exec itself, so this is a correctness rather than a security fix. - Fixed a missing `O_CLOEXEC` when opening the cgroup v2 directory to set up device rules. - Some long-standing file-descriptor leaks on the eBPF devices cgroups were fixed. - When rootfsPropagation is set to `rslave`, the rootfs parent mount is no longer made private before pivoting into the rootfs, so unmount/remount events on host mountpoints under the rootfs are now propagated to the running container. - runc no longer misdetects a non-initial user namespace as the initial one when that namespace has a full identity ID mapping (0 0 4294967295), as used by systemd >= 260 units with `PrivateUsers=full`. Previously this made runc skip its user namespace code paths, so starting a container in such a unit failed with `bpf_prog_query(BPF_CGROUP_DEVICE) failed: operation not permitted`. - Fixed a runc init panic (`SIGABRT`) on the error path, caused by SELinux labels being reset after the cached libpathrs procfs handle was already closed. This is fixed both by not resetting the labels on the init error path, and by updating to libpathrs v0.2.6, which now handles a closed procfs handle gracefully. - Fixed various issues when the libseccomp version runc is run with differs from the one it was compiled against (e.g. built with libseccomp >= 2.6.0 and run with an older one), by updating to libseccomp-golang v0.12.0. This also supersedes the `SECCOMP_FILTER_FLAG_WAIT_KILLABLE_RECV` workaround added in runc 1.5.1. - The libseccomp library statically linked into release binaries is now built with optimizations enabled (the default `-g -O2 CFLAGS`); previously it was built unoptimized. Changed - Switched to opencontainers/cgroups v0.1.0, which no longer uses the high-level cilium/ebpf API to manage cgroup v2 device rules. As a result, the runc binary shrunk by about 1 MiB (7.5%) on amd64. This also means runc no longer calls the cilium/ebpf code affected by GO-2026-6238. - Updated golang.org/x/net to v0.55.0. - Updated builds to libseccomp v2.6.1. release-notes: https://github.com/opencontainers/runc/releases/tag/v1.5.2 full diff: https://github.com/opencontainers/runc/releases/compare/v1.5.1...v1.5.2 Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2 lines
7 B
Plaintext
2 lines
7 B
Plaintext
v1.5.2
|