Tags · ravilr/runc

Due to CVE-2019-5736, we had to do another -rc release so users can update. We
hope to be able to release 1.0.0 in the near future (there is still an
outstanding spec-compliance issue with OCI hooks which we need to resolve
first).

This also updates runc to a vendored commit of the runtime-spec rather than a
full release, which will hopefully be rectified with runc 1.0.0. #k

Security:
+ Mitigate CVE-2019-5736. This is an updated version of the patch series sent
out on openwall and we encourage users to update. opencontainers#1982 opencontainers#1984

NOTE: This mitigation *WILL NOT WORK* if you run untrusted containers with
host uid 0 and give them CAP_SYS_ADMIN (the protection operates
through a hidden read-only bind-mount which can be re-mounted by
CAP_SYS_ADMIN privileged users).

Put simply -- we consider granting CAP_SYS_ADMIN to untrusted
containers without user namespaces to be fundamentally insecure, as
such we do not consider this to be a security issue.

If you want an additional host-level mitigation, use `chattr +i` on
the host file to ensure containers without CAP_LINUX_IMMUTABLE cannot
write to it -- even with CAP_SYS_ADMIN. But as above, if you give
CAP_LINUX_IMMUTABLE to a container you will have problems.

An alternative is to bind-mount a sealed memfd copy of the runc
binary over the binary (runc will detect this and will not attempt
further mitigation, because sealed memfds are fundamentally
unmodifiable) but this requires more in-depth work by administrators.

+ There appear to be production users of --no-pivot-root, which is something
that we absolutely recommend against and do not consider to be a secure
configuration -- since pivot_root(2) has many security properties that are
not possible to provide with just chroot(2).

However, a specific issue was discovered which we decided to mitigate in
order to avoid production users being exploited by it. This security issue
is *not* elligible for a CVE because it requires an insecure configuration
(--no-pivot-root). opencontainers#1962

Features:
+ Add intelrdt support for MBA to runc (a new intelrdt feature available in
Linux 4.18+). opencontainers#1919
+ Add support for specifying a CRIU configuration file for checkpoint/restore
(which makes use of a new org.criu.config annotation). opencontainers#1933 opencontainers#1964
+ Add support for "runc exec --preserve-fds". opencontainers#1995
* Added support for SELinux labeling of keyrings. opencontainers#2012

Fixes:
* Correct handling of "runc kill" when a container is stopped or paused.
opencontainers#1934 opencontainers#1943
* Error out if built with nokmem and kmemcg limits were requested. opencontainers#1939
* Update check-config.sh to be in line with Docker's. opencontainers#1942
* Improve handling of kmem and the systemd cgroup driver. opencontainers#1960
* Improve resilience of adding setns tasks to cgroups. opencontainers#1950
- Remove (broken) detection of .scope for systemd. opencontainers#1978
* Fix console hanging with preserve-fds, where not enough fds have actually
been provided to runc (which is a very common mistake when using
--preserve-fds). opencontainers#2000
* Create bind-mounts when restoring. opencontainers#1968
* Fix regression of zombie "runc init" processes. opencontainers#2023

Thanks to all of the contributors that made this release possible:

* Ace-Tang <aceapril@126.com>
* Adrian Reber <areber@redhat.com>
* Aleksa Sarai <asarai@suse.de>
* Alex Fang <littlelightlittlefire@gmail.com>
* Christian Brauner <christian.brauner@ubuntu.com>
* Daniel, Dao Quang Minh <dqminh89@gmail.com>
* Daniel J Walsh <dwalsh@redhat.com>
* Filipe Brandenburger <filbranden@google.com>
* Giuseppe Scrivano <gscrivan@redhat.com>
* JoeWrightss <zhoulin.xie@daocloud.io>
* John Howard <jhoward@microsoft.com>
* Justin Cormack <justin.cormack@docker.com>
* Kenta Tada <Kenta.Tada@sony.com>
* Lifubang <lifubang@acmcoder.com>
* Michael Crosby <crosbymichael@gmail.com>
* Mrunal Patel <mrunal@me.com>
* Tom Godkin <tgodkin@pivotal.io>
* Vincent Batts <vbatts@hashbangbash.com>
* Xiaochen Shen <xiaochen.shen@intel.com>

With special thanks and well-wishes to Victor Marmol and Rohit Jnagal, who have
both decided to give up their maintainership. Thanks for all of your
contributions over the years, and good luck with your future endeavours!

Signed-off-by: Aleksa Sarai <asarai@suse.de>

Mar 28, 2019
69ae5da
zip
tar.gz

v1.0.0-rc6

v1.0.0~rc6

This is the final feature release of runc before 1.0, rather than 1.0
itself. The reason for tihs is that, during the preparations for this
release (which was originally meant to be 1.0) it was brought up that
there were several spec-compliance problems. One of these was related to
hook ordering, and upon trying to fix them it turns out that many users
(notably the NVIDIA OCI hooks) make use of our incorrect hook ordering.
Many of the proposed solutions to this problem all require a lot of time
and co-ordination, and thus would stall this release indefinitely.

So, the idea is to have an intermediate release which will mark a
freeze-on-everything-except-spec-compliance-bugs. No other changes will
be included pre-1.0 (aside from security patches obviously).

Features:
 + Upgrade to using Go 1.10. opencontainers#1711
 + Upgrade to CRIU 3.11. opencontainers#1711 opencontainers#1864 opencontainers#1935 opencontainers#1936
 + Allow for checkpoint-restore into a foreign network namespace. opencontainers#1849
 + The "type" field for bind-mounts is now ignored. This is important, because
   many users incorrectly assume that "type" defines a bind-mount and not
   "options". Previously you had to set both. opencontainers#1753 opencontainers#1845
 + "setgroups=allow" is now possible in rootless mode, but requires the use of
   the privileged newgidmap helper (fully-rootless still requires
   "setgroups=deny"). opencontainers#1693
 + Rootless mode can now safely ignore a read-only cgroupfs. opencontainers#1759 opencontainers#1806
 + Several aspects of rootless mode are now used inside user namespaces. This
   is necessary for a bunch of useful things (such as running Docker inside an
   user namespace), but did cause some breakages. We think they've all been
   fixed -- but if not please submit an issue! opencontainers#1688 opencontainers#1808 opencontainers#1816 opencontainers#1862
 + Improve kernel.{domain,host}name sysctl handling, to allow the NIS
   domainname to be set from Docker or other callers without an OCI spec
   change. opencontainers#1827
 + Add documentation for one of the more confusion parts of runc, how terminals
   are handled (including an explanation of --console-socket). All the gory
   details and recommendations are available in docs/terminals.md. opencontainers#1730
 + Allow /proc to be bind-mounted over (useful for rootless containers). opencontainers#1832
 + Ignore ENOSYS for keyctl(2) operations. This is necessary to get Docker
   working with LXC under the default seccomp profile (which is what ChromeOS
   uses). opencontainers#1893
 + Add support for the Intel RDT/MBA resource control system. opencontainers#1632 opencontainers#1913
 + Allow building with completely-disabled kmemcg support, to get around
   problems with broken kernels (RHEL 7.5 can oops with kmemcg accounting
   enabled). opencontainers#1921 opencontainers#1922 opencontainers#1930
 + Add support for cgroup namespaces, which in turn fixes a few other issues we
   encountered with the previous code (which could be moving us to a cgroup
   during Go execution). opencontainers#1916

Fixes:
 * Namespace creation with user namespaces now plays a bit nicer with SELinux
   and IPC (which had a bug where the in-kernel mqueue mount would have the
   wrong tag if using unshare(CLONE_NEWUSER|CLONE_NEWIPC)). This is done to
   avoid future problems with broken kernel integration. opencontainers#1562
 * Mild refactor of libcontainer/user. opencontainers#1749
 * Fix null-pointer-exception when no cgroups were set. opencontainers#1752
 * Various DBus and systemd related changes for the systemd-cgroup driver.
   opencontainers#1754 opencontainers#1772 opencontainers#1776 opencontainers#1781 opencontainers#1805 opencontainers#1917
 * Apply SELinux label to masked directories. opencontainers#1756
 * Obey the XDG spec and set the sticky bit on runc's root when using
   XDG_RUNTIME_DIR (in rootless mode). opencontainers#1760
 * Only configure network namespaces if we are creating them. opencontainers#1777
 * Fix race in runc-exec against a currently-exiting pid1. opencontainers#1812
 * Forward GOMAXPROCS to try to reduce the number of threads started by 'runc
   init'. Unforunately there's no way to stop Go from spawning new threads so
   this is more of a recommendation. opencontainers#1830
 * Fix tmpcopyup in cases where /tmp is not a private mount. opencontainers#1873
 * Whitelist /proc/loadavg for bind-mounting. opencontainers#1882
 * Protect against deletion of runc state directory with a containerid of "..",
   as well as the addition of other path hardening code. opencontainers#1883
 * Handle duplicated cgroupfs mountpoint entries more sanely, to make runc work
   on distributions that use-and-abuse shared subtrees. opencontainers#1817
 * Fix console hanging in several cases. opencontainers#1895 opencontainers#1897
 * Lock-to-a-thread during 'runc init' to ensure that that we don't switch
   threads and run within a different SELinux label. opencontainers#1814
 * Respect cgroupPath when trying to find the cgroupfs mountpoint (which can
   happen in cases where containers are given different cgroupfs mounts). opencontainers#1872
 * And many other minor changes, many from first-time contributors! opencontainers#1746 opencontainers#1748
   opencontainers#1749 opencontainers#1784 opencontainers#1779 opencontainers#1785 opencontainers#1796 opencontainers#1819 opencontainers#1825 opencontainers#1836 opencontainers#1824 opencontainers#1820 opencontainers#1838 opencontainers#1840
   opencontainers#1841 opencontainers#1867 opencontainers#1871 opencontainers#1855 opencontainers#1854 opencontainers#1874 opencontainers#1868 opencontainers#1886 opencontainers#1892 opencontainers#1858 opencontainers#1894 opencontainers#1908
   opencontainers#1880 opencontainers#1910 opencontainers#1915 opencontainers#1903 opencontainers#1922 opencontainers#1926 opencontainers#1928 opencontainers#1925 opencontainers#1911

Fixes (for spec violations):
 * Don't set a container to "running" when exec-ing into it (because it might
   be in the "created" state). opencontainers#1771
 * oom_score_adj is now no longer modified if it was unspecified in config.json
   (this was a spec violation). opencontainers#1759
 * Set "status" in hook stdin, as well as switch to using *spec.State to avoid
   JSON-representation drift. opencontainers#1741

Thanks to all of the contributors that made this release possible:

 * Ace-Tang <aceapril@126.com>
 * Adrian Reber <areber@redhat.com>
 * Akihiro Suda <suda.akihiro@lab.ntt.co.jp>
 * Alban Crequy <alban@kinvolk.io>
 * Aleksa Sarai <asarai@suse.de>
 * Alex Glikson <alex.glikson@gmail.com>
 * Andrei Vagin <avagin@virtuozzo.com>
 * Antonio Murdaca <runcom@redhat.com>
 * Bin Chen <nk@devicu.com>
 * ChangFeng <changfeng@pinduoduo.com>
 * Chris Aniszczyk <caniszczyk@gmail.com>
 * Danail Branekov <danailster@gmail.com>
 * Daniel, Dao Quang Minh <dqminh89@gmail.com>
 * Daniel J Walsh <dwalsh@redhat.com>
 * Denys Smirnov <denys@sourced.tech>
 * Derek Carr <decarr@redhat.com>
 * dlorenc <lorenc.d@gmail.com>
 * Dmitry Smirnov <onlyjob@member.fsf.org>
 * Dominik Süß <dominik@suess.wtf>
 * Filipe Brandenburger <filbranden@google.com>
 * Giuseppe Scrivano <gscrivan@redhat.com>
 * Harald Nordgren <haraldnordgren@gmail.com>
 * Jay Kamat <jaygkamat@gmail.com>
 * Jonathan Marler <johnnymarler@gmail.com>
 * Kenta Tada <Kenta.Tada@sony.com>
 * Kir Kolyshkin <kolyshkin@gmail.com>
 * Lifubang <lifubang@acmcoder.com>
 * Lin Yang <lin.a.yang@intel.com>
 * Marco Vedovati <mvedovati@suse.com>
 * Michael Crosby <crosbymichael@gmail.com>
 * Mike Brown <brownwm@us.ibm.com>
 * Mrunal Patel <mrunalp@gmail.com>
 * Nalin Dahyabhai <nalin@redhat.com>
 * Qiang Huang <h.huangqiang@huawei.com>
 * Sebastien Boeuf <sebastien.boeuf@intel.com>
 * Sergio Lopez <slp@redhat.com>
 * Tamal Saha <tamal@appscode.com>
 * Tibor Vass <tibor@docker.com>
 * vikaschoudhary16 <choudharyvikas16@gmail.com>
 * Vincent Batts <vbatts@hashbangbash.com>
 * W. Trevor King <wking@tremily.us>
 * Xiaochen Shen <xiaochen.shen@intel.com>
 * Yan Zhu <yanzhu@alauda.io>
 * Yuanhong Peng <pengyuanhong@huawei.com>

Signed-off-by: Aleksa Sarai <asarai@suse.de>

Nov 21, 2018
ccb5efd
zip
tar.gz

PreviousNext

Navigation Menu

runc_fix_upon_v1.0.0-rc93

v1.0.0-rc93

v1.0.0-rc92

v1.0.0-rc91

v1.0.0-rc90

v1.0.0-rc10

v1.0.0-rc9

v1.0.0-rc8

v1.0.0-rc7

v1.0.0-rc6

Tags: ravilr/runc