The primary change in this release for runc is that libpathrs's
behaviour when the cached ProcfsHandle fd is closed from underneath it
is now more graceful (previously this would cause panics on the error
path). This is a bit of an unusual program state, but it is something we
do in runc before we exec the user binary. Commit 1056e683a6 ("libct:
don't reset selinux labels on init error path") eliminated one cause of
such panics, but this should completely resolve the issue.
It also includes some key fixes when building with Clang or when
distributions re-generate the libpathrs <pathrs.h> header as part of
their build process which go-pathrs then consumes.
Signed-off-by: Aleksa Sarai <cyphar@cyphar.com>
Sometimes github fails with 503 or other transient error code. In other
similar places (.github/workflows/validate.yml, tests/integration/*.sh)
we already use curl --retry 5, so let's add it here to avoid flakes.
Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
This update includes a few breaking API changes that I needed to get in
before an actual runc release depends on it, so that we don't need to
deal with compatibility shims for them (or bumping the SOVERSION).
From a Go API perspective, there were no major changes -- though this
bump did also require a bump to github.com/cyphar/filepath-securejoin
because one of the wrapped APIs changed from int to uint64 as a flag
argument type. Again, better to get this done before we really depend on
this in a public way.
Signed-off-by: Aleksa Sarai <cyphar@cyphar.com>
runc's build scripts and CI setup used a mix of wget (4 sites) and
curl (8 sites) for HTTPS fetches. Standardise the three script sites on
curl, which is already required by the majority of call sites.
* script/build-libpathrs.sh and script/build-seccomp.sh: replace
wget "<url>"{,.asc} with curl -fsSLO "<url>"{,.asc}. Bash brace
expansion still yields two separate downloads (the tarball and its
.asc signature).
* script/setup_host.sh: replace wget with curl in the Fedora RPM
install list.
Leaving the single wget call in Dockerfile untouched per review
feedback -- the trixie base image already ships wget, and switching
would add an extra apt-get update && install step before the existing
single-pass package install.
Refs #5240
Signed-off-by: Ali <alliasgher123@gmail.com>
word boundary anchor \> is present only in GNU awk implementation. This
will not work if we are building libpathrs inside a container like
debian/ubuntu which uses mawk. Therefore switch to a POSIX compatible
regex that can be used with all implementations of awk to find the
system libc path
Signed-off-by: Akhil Mohan <akhilerm@gmail.com>
Signed-off-by: Aleksa Sarai <aleksa@amutable.com>
pathrs-lite supports transparently switching to libpathrs.so as the
backend with the "libpathrs" build tag. In order to make this work
properly with our CI and release build scripts, we we need to have a
similar setup as with we do with libseccomp.
Signed-off-by: Aleksa Sarai <cyphar@cyphar.com>
