rpms/buildah
5
0
Fork 0
Code Issues Pull Requests Releases Activity

import buildah-1.27.0-2.module+el8.7.0+16772+33343656

Browse Source
This commit is contained in:
CentOS Sources 2022-11-08 01:33:54 -05:00 committed by Stepan Oksanichenko
parent ec808854db
commit 1e64d887b6
4 changed files with 145 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
.buildah.metadata
View File

@ -1 +1 @@
aba5b2eba2e548797e63b6f70c8472ce17b7b9a4 SOURCES/buildah-1.26.2-1915998.tar.gz c8bc997a5ec79fcc363dc8c81dbb5818912e60fb SOURCES/buildah-1.27.0-db8d592.tar.gz

2
.gitignore vendored
View File

@ -1 +1 @@
SOURCES/buildah-1.26.2-1915998.tar.gz SOURCES/buildah-1.27.0-db8d592.tar.gz

90
SOURCES/4200.patch Normal file
View File

@ -0,0 +1,90 @@
From 9934b17365083ce966b44c5ce3c7e052f516e255 Mon Sep 17 00:00:00 2001
From: Aditya R <arajan@redhat.com>
Date: Wed, 24 Aug 2022 08:42:23 +0530
Subject: [PATCH] run: add container gid to additional groups
When container is created with specific uid and gid also add container
gid to supplementary/additional group.
Signed-off-by: Aditya R <arajan@redhat.com>
---
run_common.go | 1 +
tests/bud.bats | 16 ++++++++++++++++
tests/bud/supplemental-groups/Dockerfile | 3 +++
tests/run.bats | 14 ++++++++++++++
4 files changed, 34 insertions(+)
create mode 100644 tests/bud/supplemental-groups/Dockerfile
diff --git a/run_common.go b/run_common.go
index 2054c56527..f5a5ec8505 100644
--- a/run_common.go
+++ b/run_common.go
@@ -262,6 +262,7 @@ func (b *Builder) configureUIDGID(g *generate.Generator, mountPoint string, opti
}
g.SetProcessUID(user.UID)
g.SetProcessGID(user.GID)
+ g.AddProcessAdditionalGid(user.GID)
for _, gid := range user.AdditionalGids {
g.AddProcessAdditionalGid(gid)
}
diff --git a/tests/bud.bats b/tests/bud.bats
index a37e418b41..07bdf45cac 100644
--- a/tests/bud.bats
+++ b/tests/bud.bats
@@ -366,6 +366,22 @@ _EOF
expect_output --substring "invalid response status"
}
+@test "build test has gid in supplemental groups" {
+ _prefetch alpine
+ run_buildah build $WITH_POLICY_JSON -t source -f $BUDFILES/supplemental-groups/Dockerfile
+ # gid 1000 must be in supplemental groups
+ expect_output --substring "Groups: 1000"
+}
+
+@test "build test if supplemental groups has gid with --isolation chroot" {
+ test -z "${BUILDAH_ISOLATION}" || skip "BUILDAH_ISOLATION=${BUILDAH_ISOLATION} overrides --isolation"
+
+ _prefetch alpine
+ run_buildah build --isolation chroot $WITH_POLICY_JSON -t source -f $BUDFILES/supplemental-groups/Dockerfile
+ # gid 1000 must be in supplemental groups
+ expect_output --substring "Groups: 1000"
+}
+
# Test skipping images with FROM
@test "build-test skipping unwanted stages with FROM" {
mkdir -p ${TEST_SCRATCH_DIR}/bud/platform
diff --git a/tests/bud/supplemental-groups/Dockerfile b/tests/bud/supplemental-groups/Dockerfile
new file mode 100644
index 0000000000..462d9ea7a4
--- /dev/null
+++ b/tests/bud/supplemental-groups/Dockerfile
@@ -0,0 +1,3 @@
+FROM alpine
+USER 1000:1000
+RUN cat /proc/$$/status
diff --git a/tests/run.bats b/tests/run.bats
index 2e8836c470..e34091fcbe 100644
--- a/tests/run.bats
+++ b/tests/run.bats
@@ -349,6 +349,20 @@ function configure_and_check_user() {
expect_output "888:888"
}
+@test "run --user and verify gid in supplemental groups" {
+ skip_if_no_runtime
+
+ # Create the container.
+ _prefetch alpine
+ run_buildah from $WITH_POLICY_JSON alpine
+ ctr="$output"
+
+ # Run with uid:gid 1000:1000 and verify if gid is present in additional groups
+ run_buildah run --user 1000:1000 "$ctr" cat /proc/self/status
+ # gid 1000 must be in additional/supplemental groups
+ expect_output --substring "Groups: 1000 "
+}
+
@test "run --workingdir" {
skip_if_no_runtime

60
SPECS/buildah.spec
View File

@ -12,13 +12,13 @@ go build -buildmode pie -compiler gc -tags="rpm_crashtraceback libtrust_openssl
%global import_path github.com/containers/buildah %global import_path github.com/containers/buildah
#%%global branch main #%%global branch main
%global commit0 19159983d3ecdb16df97eb4c887902363066b474 %global commit0 db8d5921a770e7536b34c56d062b47795b548d35
%global shortcommit0 %(c=%{commit0}; echo ${c:0:7}) %global shortcommit0 %(c=%{commit0}; echo ${c:0:7})
Epoch: 1 Epoch: 1
Name: buildah Name: buildah
Version: 1.26.2 Version: 1.27.0
Release: 1%{?dist} Release: 2%{?dist}
Summary: A command line tool used for creating OCI Images Summary: A command line tool used for creating OCI Images
License: ASL 2.0 License: ASL 2.0
URL: https://%{name}.io URL: https://%{name}.io
@ -29,6 +29,7 @@ Source0: https://%{import_path}/tarball/%{commit0}/%{branch}-%{shortcommit0}.tar
%else %else
Source0: https://%{import_path}/archive/%{commit0}/%{name}-%{version}-%{shortcommit0}.tar.gz Source0: https://%{import_path}/archive/%{commit0}/%{name}-%{version}-%{shortcommit0}.tar.gz
%endif %endif
Patch0: https://patch-diff.githubusercontent.com/raw/containers/buildah/pull/4200.patch
BuildRequires: golang >= 1.17.7 BuildRequires: golang >= 1.17.7
BuildRequires: git BuildRequires: git
BuildRequires: glib2-devel BuildRequires: glib2-devel
@ -102,6 +103,7 @@ rm -f src/github.com/containers/storage/drivers/register/register_btrfs.go
%gobuild -o bin/%{name} %{import_path}/cmd/%{name} %gobuild -o bin/%{name} %{import_path}/cmd/%{name}
%gobuild -o imgtype %{import_path}/tests/imgtype %gobuild -o imgtype %{import_path}/tests/imgtype
%gobuild -o bin/copy %{import_path}/tests/copy %gobuild -o bin/copy %{import_path}/tests/copy
%gobuild -o bin/tutorial %{import_path}/tests/tutorial
GOMD2MAN=go-md2man %{__make} -C docs GOMD2MAN=go-md2man %{__make} -C docs
%install %install
@ -111,6 +113,7 @@ install -d -p %{buildroot}/%{_datadir}/%{name}/test/system
cp -pav tests/. %{buildroot}/%{_datadir}/%{name}/test/system cp -pav tests/. %{buildroot}/%{_datadir}/%{name}/test/system
cp imgtype %{buildroot}/%{_bindir}/%{name}-imgtype cp imgtype %{buildroot}/%{_bindir}/%{name}-imgtype
cp bin/copy %{buildroot}/%{_bindir}/%{name}-copy cp bin/copy %{buildroot}/%{_bindir}/%{name}-copy
cp bin/tutorial %{buildroot}/%{_bindir}/%{name}-tutorial
make DESTDIR=%{buildroot} PREFIX=%{_prefix} -C docs install make DESTDIR=%{buildroot} PREFIX=%{_prefix} -C docs install
#define license tag if not already defined #define license tag if not already defined
@ -129,37 +132,80 @@ make DESTDIR=%{buildroot} PREFIX=%{_prefix} -C docs install
%license LICENSE %license LICENSE
%{_bindir}/%{name}-imgtype %{_bindir}/%{name}-imgtype
%{_bindir}/%{name}-copy %{_bindir}/%{name}-copy
%{_bindir}/%{name}-tutorial
%{_datadir}/%{name}/test %{_datadir}/%{name}/test
%changelog %changelog
* Fri Aug 26 2022 Jindrich Novy <jnovy@redhat.com> - 1:1.27.0-2
- fix CVE-2022-2990
- Related: #2061390
* Tue Aug 09 2022 Jindrich Novy <jnovy@redhat.com> - 1:1.27.0-1
- update to https://github.com/containers/buildah/releases/tag/v1.27.0
- Related: #2061390
* Mon Aug 08 2022 Jindrich Novy <jnovy@redhat.com> - 1:1.26.4-3
- add buildah-tutorial to test subpackage
- Related: #2061390
* Thu Aug 04 2022 Jindrich Novy <jnovy@redhat.com> - 1:1.26.4-1
- update to https://github.com/containers/buildah/releases/tag/v1.26.4
- Related: #2061390
* Wed Aug 03 2022 Jindrich Novy <jnovy@redhat.com> - 1:1.26.3-1
- update to https://github.com/containers/buildah/releases/tag/v1.26.3
- Related: #2061390
* Thu Jul 07 2022 Jindrich Novy <jnovy@redhat.com> - 1:1.26.2-1 * Thu Jul 07 2022 Jindrich Novy <jnovy@redhat.com> - 1:1.26.2-1
- update to https://github.com/containers/buildah/releases/tag/v1.26.2 - update to https://github.com/containers/buildah/releases/tag/v1.26.2
- Related: #2061390 - Related: #2061390
* Tue Jun 07 2022 Jindrich Novy <jnovy@redhat.com> - 1:1.26.1-2 * Wed May 11 2022 Jindrich Novy <jnovy@redhat.com> - 1:1.26.1-2
- BuildRequires: /usr/bin/go-md2man - BuildRequires: /usr/bin/go-md2man
- Related: #2061390 - Related: #2061390
* Fri May 06 2022 Jindrich Novy <jnovy@redhat.com> - 1:1.26.1-1 * Thu May 05 2022 Jindrich Novy <jnovy@redhat.com> - 1:1.26.1-1
- update to https://github.com/containers/buildah/releases/tag/v1.26.1 - update to https://github.com/containers/buildah/releases/tag/v1.26.1
- Related: #2061390 - Related: #2061390
* Wed Apr 20 2022 Jindrich Novy <jnovy@redhat.com> - 1:1.25.1-2 * Thu May 05 2022 Jindrich Novy <jnovy@redhat.com> - 1:1.25.1-3
- add dependencies to network stack
- Related: #2061390
* Fri Apr 08 2022 Jindrich Novy <jnovy@redhat.com> - 1:1.25.1-2
- bump golang BR to 1.17.7 - bump golang BR to 1.17.7
- Related: #2061390 - Related: #2061390
* Thu Mar 31 2022 Jindrich Novy <jnovy@redhat.com> - 1:1.25.1-1 * Thu Mar 31 2022 Jindrich Novy <jnovy@redhat.com> - 1:1.25.1-1
- update to https://github.com/containers/buildah/releases/tag/v1.25.1 - update to https://github.com/containers/buildah/releases/tag/v1.25.1
- Related: #2061390
* Wed Mar 30 2022 Jindrich Novy <jnovy@redhat.com> - 1:1.25.0-1 * Wed Mar 30 2022 Jindrich Novy <jnovy@redhat.com> - 1:1.25.0-1
- update to https://github.com/containers/buildah/releases/tag/v1.25.0 - update to https://github.com/containers/buildah/releases/tag/v1.25.0
- Related: #2061390 - Related: #2061390
* Mon Mar 07 2022 Jindrich Novy <jnovy@redhat.com> - 1:1.24.2-1 * Mon Feb 21 2022 Lokesh Mandvekar <lsm5@redhat.com> - 1:1.24.2-2
- Add patch to fix bash symtax for gating tests - Add patch to fix bash symtax for gating tests
- Upstream PR: https://github.com/containers/buildah/pull/3792 - Upstream PR: https://github.com/containers/buildah/pull/3792
- Related: #2001445 - Related: #2001445
* Thu Feb 17 2022 Jindrich Novy <jnovy@redhat.com> - 1:1.24.2-1
- update to https://github.com/containers/buildah/releases/tag/v1.24.2
- Related: #2001445
* Fri Feb 04 2022 Jindrich Novy <jnovy@redhat.com> - 1:1.24.1-1
- update to https://github.com/containers/buildah/releases/tag/v1.24.1
- Related: #2001445
* Wed Feb 02 2022 Jindrich Novy <jnovy@redhat.com> - 1:1.24.0-1
- update to https://github.com/containers/buildah/releases/tag/v1.24.0
- Related: #2001445
* Tue Jan 25 2022 Jindrich Novy <jnovy@redhat.com> - 1:1.23.2-1
- update to the latest content of https://github.com/containers/buildah/tree/release-1.23
(https://github.com/containers/buildah/commit/83a66a7)
- Related: #2001445
* Mon Nov 22 2021 Jindrich Novy <jnovy@redhat.com> - 1:1.23.1-3 * Mon Nov 22 2021 Jindrich Novy <jnovy@redhat.com> - 1:1.23.1-3
- update to the latest content of https://github.com/containers/buildah/tree/release-1.23 - update to the latest content of https://github.com/containers/buildah/tree/release-1.23
(https://github.com/containers/buildah/commit/867c1bc) (https://github.com/containers/buildah/commit/867c1bc)