rpms/buildah
6
0
Fork 0
Code Issues Pull Requests Releases Activity

import buildah-1.27.0-2.module+el8.7.0+16493+89f82ab8

Browse Source
This commit is contained in:
CentOS Sources 2022-09-27 05:30:49 -04:00 committed by Stepan Oksanichenko
parent 856d7498f1
commit 1e7fd53019
5 changed files with 152 additions and 52 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
.buildah.metadata
View File

@ -1 +1 @@
bfaa7b5c8d8169ed7a175c1edea673bca9dc184c SOURCES/buildah-1.24.2-ce608bc.tar.gz
c8bc997a5ec79fcc363dc8c81dbb5818912e60fb SOURCES/buildah-1.27.0-db8d592.tar.gz

2
.gitignore vendored
View File

@ -1 +1 @@
SOURCES/buildah-1.24.2-ce608bc.tar.gz
SOURCES/buildah-1.27.0-db8d592.tar.gz

90
SOURCES/4200.patch Normal file
View File

@ -0,0 +1,90 @@
From 9934b17365083ce966b44c5ce3c7e052f516e255 Mon Sep 17 00:00:00 2001
From: Aditya R <arajan@redhat.com>
Date: Wed, 24 Aug 2022 08:42:23 +0530
Subject: [PATCH] run: add container gid to additional groups
When container is created with specific uid and gid also add container
gid to supplementary/additional group.
Signed-off-by: Aditya R <arajan@redhat.com>
---
run_common.go | 1 +
tests/bud.bats | 16 ++++++++++++++++
tests/bud/supplemental-groups/Dockerfile | 3 +++
tests/run.bats | 14 ++++++++++++++
4 files changed, 34 insertions(+)
create mode 100644 tests/bud/supplemental-groups/Dockerfile
diff --git a/run_common.go b/run_common.go
index 2054c56527..f5a5ec8505 100644
--- a/run_common.go
+++ b/run_common.go
@@ -262,6 +262,7 @@ func (b *Builder) configureUIDGID(g *generate.Generator, mountPoint string, opti
}
g.SetProcessUID(user.UID)
g.SetProcessGID(user.GID)
+ g.AddProcessAdditionalGid(user.GID)
for _, gid := range user.AdditionalGids {
g.AddProcessAdditionalGid(gid)
}
diff --git a/tests/bud.bats b/tests/bud.bats
index a37e418b41..07bdf45cac 100644
--- a/tests/bud.bats
+++ b/tests/bud.bats
@@ -366,6 +366,22 @@ _EOF
expect_output --substring "invalid response status"
}
+@test "build test has gid in supplemental groups" {
+ _prefetch alpine
+ run_buildah build $WITH_POLICY_JSON -t source -f $BUDFILES/supplemental-groups/Dockerfile
+ # gid 1000 must be in supplemental groups
+ expect_output --substring "Groups: 1000"
+}
+
+@test "build test if supplemental groups has gid with --isolation chroot" {
+ test -z "${BUILDAH_ISOLATION}" || skip "BUILDAH_ISOLATION=${BUILDAH_ISOLATION} overrides --isolation"
+
+ _prefetch alpine
+ run_buildah build --isolation chroot $WITH_POLICY_JSON -t source -f $BUDFILES/supplemental-groups/Dockerfile
+ # gid 1000 must be in supplemental groups
+ expect_output --substring "Groups: 1000"
+}
+
# Test skipping images with FROM
@test "build-test skipping unwanted stages with FROM" {
mkdir -p ${TEST_SCRATCH_DIR}/bud/platform
diff --git a/tests/bud/supplemental-groups/Dockerfile b/tests/bud/supplemental-groups/Dockerfile
new file mode 100644
index 0000000000..462d9ea7a4
--- /dev/null
+++ b/tests/bud/supplemental-groups/Dockerfile
@@ -0,0 +1,3 @@
+FROM alpine
+USER 1000:1000
+RUN cat /proc/$$/status
diff --git a/tests/run.bats b/tests/run.bats
index 2e8836c470..e34091fcbe 100644
--- a/tests/run.bats
+++ b/tests/run.bats
@@ -349,6 +349,20 @@ function configure_and_check_user() {
expect_output "888:888"
}
+@test "run --user and verify gid in supplemental groups" {
+ skip_if_no_runtime
+
+ # Create the container.
+ _prefetch alpine
+ run_buildah from $WITH_POLICY_JSON alpine
+ ctr="$output"
+
+ # Run with uid:gid 1000:1000 and verify if gid is present in additional groups
+ run_buildah run --user 1000:1000 "$ctr" cat /proc/self/status
+ # gid 1000 must be in additional/supplemental groups
+ expect_output --substring "Groups: 1000 "
+}
+
@test "run --workingdir" {
skip_if_no_runtime

45
SOURCES/fix-bash-syntax.patch
View File

@ -1,45 +0,0 @@
From eedab4fd872c3be8ab15af767897f92c78a71fde Mon Sep 17 00:00:00 2001
From: Lokesh Mandvekar <lsm5@fedoraproject.org>
Date: Mon, 21 Feb 2022 14:58:40 -0500
Subject: [PATCH] helpers.bash: Use correct syntax
Fixes gating test failure:
```
/usr/share/buildah/test/system/./helpers.bash: line 474: !is_cgroupsv2: command not found
```
Co-authored-by: Yiqiao Pu <ypu@redhat.com>
I'm just the committer.
Signed-off-by: Lokesh Mandvekar <lsm5@fedoraproject.org>
---
tests/helpers.bash | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/tests/helpers.bash b/tests/helpers.bash
index bd2794c974..3e72108bec 100644
--- a/tests/helpers.bash
+++ b/tests/helpers.bash
@@ -433,9 +433,9 @@ function skip_if_rootless() {
##################################
function skip_if_rootless_and_cgroupv1() {
if test "$BUILDAH_ISOLATION" = "rootless"; then
- if !is_cgroupsv2; then
- skip "${1:-test does not work when \$BUILDAH_ISOLATION = rootless} and not cgroupv2"
- fi
+ if ! is_cgroupsv2; then
+ skip "${1:-test does not work when \$BUILDAH_ISOLATION = rootless} and not cgroupv2"
+ fi
fi
}
@@ -471,7 +471,7 @@ function skip_if_cgroupsv2() {
# skip_if_cgroupsv1 # Some tests don't work with cgroupsv1
#######################
function skip_if_cgroupsv1() {
- if !is_cgroupsv2; then
+ if ! is_cgroupsv2; then
skip "${1:-test does not work with cgroups v1}"
fi
}

65
SPECS/buildah.spec
View File

@ -12,12 +12,12 @@ go build -buildmode pie -compiler gc -tags="rpm_crashtraceback libtrust_openssl
%global import_path github.com/containers/buildah
#%%global branch main
%global commit0 ce608bcecdeb077daab846c83b026c508cff9688
%global commit0 db8d5921a770e7536b34c56d062b47795b548d35
%global shortcommit0 %(c=%{commit0}; echo ${c:0:7})
Epoch: 1
Name: buildah
Version: 1.24.2
Version: 1.27.0
Release: 2%{?dist}
Summary: A command line tool used for creating OCI Images
License: ASL 2.0
@ -29,14 +29,14 @@ Source0: https://%{import_path}/tarball/%{commit0}/%{branch}-%{shortcommit0}.tar
%else
Source0: https://%{import_path}/archive/%{commit0}/%{name}-%{version}-%{shortcommit0}.tar.gz
%endif
Patch0: fix-bash-syntax.patch
BuildRequires: golang >= 1.16.6
Patch0: https://patch-diff.githubusercontent.com/raw/containers/buildah/pull/4200.patch
BuildRequires: golang >= 1.17.7
BuildRequires: git
BuildRequires: glib2-devel
BuildRequires: libseccomp-devel
BuildRequires: ostree-devel
BuildRequires: glibc-static
BuildRequires: go-md2man
BuildRequires: /usr/bin/go-md2man
BuildRequires: gpgme-devel
BuildRequires: device-mapper-devel
BuildRequires: libassuan-devel
@ -45,6 +45,10 @@ Requires: runc >= 1.0.0-26
Requires: containers-common >= 2:1-2
Recommends: container-selinux
Requires: slirp4netns >= 0.3-0
Requires: containernetworking-plugins >= 0.9.1-1
Suggests: netavark
Requires: iptables
Requires: nftables
%description
The %{name} package provides a command line tool which can be used to
@ -99,6 +103,7 @@ rm -f src/github.com/containers/storage/drivers/register/register_btrfs.go
%gobuild -o bin/%{name} %{import_path}/cmd/%{name}
%gobuild -o imgtype %{import_path}/tests/imgtype
%gobuild -o bin/copy %{import_path}/tests/copy
%gobuild -o bin/tutorial %{import_path}/tests/tutorial
GOMD2MAN=go-md2man %{__make} -C docs
%install
@ -108,6 +113,7 @@ install -d -p %{buildroot}/%{_datadir}/%{name}/test/system
cp -pav tests/. %{buildroot}/%{_datadir}/%{name}/test/system
cp imgtype %{buildroot}/%{_bindir}/%{name}-imgtype
cp bin/copy %{buildroot}/%{_bindir}/%{name}-copy
cp bin/tutorial %{buildroot}/%{_bindir}/%{name}-tutorial
make DESTDIR=%{buildroot} PREFIX=%{_prefix} -C docs install
#define license tag if not already defined
@ -126,9 +132,58 @@ make DESTDIR=%{buildroot} PREFIX=%{_prefix} -C docs install
%license LICENSE
%{_bindir}/%{name}-imgtype
%{_bindir}/%{name}-copy
%{_bindir}/%{name}-tutorial
%{_datadir}/%{name}/test
%changelog
* Fri Aug 26 2022 Jindrich Novy <jnovy@redhat.com> - 1:1.27.0-2
- fix CVE-2022-2990
- Related: #2061390
* Tue Aug 09 2022 Jindrich Novy <jnovy@redhat.com> - 1:1.27.0-1
- update to https://github.com/containers/buildah/releases/tag/v1.27.0
- Related: #2061390
* Mon Aug 08 2022 Jindrich Novy <jnovy@redhat.com> - 1:1.26.4-3
- add buildah-tutorial to test subpackage
- Related: #2061390
* Thu Aug 04 2022 Jindrich Novy <jnovy@redhat.com> - 1:1.26.4-1
- update to https://github.com/containers/buildah/releases/tag/v1.26.4
- Related: #2061390
* Wed Aug 03 2022 Jindrich Novy <jnovy@redhat.com> - 1:1.26.3-1
- update to https://github.com/containers/buildah/releases/tag/v1.26.3
- Related: #2061390
* Thu Jul 07 2022 Jindrich Novy <jnovy@redhat.com> - 1:1.26.2-1
- update to https://github.com/containers/buildah/releases/tag/v1.26.2
- Related: #2061390
* Wed May 11 2022 Jindrich Novy <jnovy@redhat.com> - 1:1.26.1-2
- BuildRequires: /usr/bin/go-md2man
- Related: #2061390
* Thu May 05 2022 Jindrich Novy <jnovy@redhat.com> - 1:1.26.1-1
- update to https://github.com/containers/buildah/releases/tag/v1.26.1
- Related: #2061390
* Thu May 05 2022 Jindrich Novy <jnovy@redhat.com> - 1:1.25.1-3
- add dependencies to network stack
- Related: #2061390
* Fri Apr 08 2022 Jindrich Novy <jnovy@redhat.com> - 1:1.25.1-2
- bump golang BR to 1.17.7
- Related: #2061390
* Thu Mar 31 2022 Jindrich Novy <jnovy@redhat.com> - 1:1.25.1-1
- update to https://github.com/containers/buildah/releases/tag/v1.25.1
- Related: #2061390
* Wed Mar 30 2022 Jindrich Novy <jnovy@redhat.com> - 1:1.25.0-1
- update to https://github.com/containers/buildah/releases/tag/v1.25.0
- Related: #2061390
* Mon Feb 21 2022 Lokesh Mandvekar <lsm5@redhat.com> - 1:1.24.2-2
- Add patch to fix bash symtax for gating tests
- Upstream PR: https://github.com/containers/buildah/pull/3792