import buildah-1.29.1-1.module+el8.8.0+18195+471da4bb

This commit is contained in:
CentOS Sources 2023-03-28 09:51:13 +00:00 committed by root
parent 1e7fd53019
commit 4c20ad3f27
4 changed files with 86 additions and 97 deletions

View File

@ -1 +1 @@
c8bc997a5ec79fcc363dc8c81dbb5818912e60fb SOURCES/buildah-1.27.0-db8d592.tar.gz
b9b966712b25554f9cf08b1c49a80b60fd3dc56d SOURCES/release-1.29-7fa17a8.tar.gz

2
.gitignore vendored
View File

@ -1 +1 @@
SOURCES/buildah-1.27.0-db8d592.tar.gz
SOURCES/release-1.29-7fa17a8.tar.gz

View File

@ -1,90 +0,0 @@
From 9934b17365083ce966b44c5ce3c7e052f516e255 Mon Sep 17 00:00:00 2001
From: Aditya R <arajan@redhat.com>
Date: Wed, 24 Aug 2022 08:42:23 +0530
Subject: [PATCH] run: add container gid to additional groups
When container is created with specific uid and gid also add container
gid to supplementary/additional group.
Signed-off-by: Aditya R <arajan@redhat.com>
---
run_common.go | 1 +
tests/bud.bats | 16 ++++++++++++++++
tests/bud/supplemental-groups/Dockerfile | 3 +++
tests/run.bats | 14 ++++++++++++++
4 files changed, 34 insertions(+)
create mode 100644 tests/bud/supplemental-groups/Dockerfile
diff --git a/run_common.go b/run_common.go
index 2054c56527..f5a5ec8505 100644
--- a/run_common.go
+++ b/run_common.go
@@ -262,6 +262,7 @@ func (b *Builder) configureUIDGID(g *generate.Generator, mountPoint string, opti
}
g.SetProcessUID(user.UID)
g.SetProcessGID(user.GID)
+ g.AddProcessAdditionalGid(user.GID)
for _, gid := range user.AdditionalGids {
g.AddProcessAdditionalGid(gid)
}
diff --git a/tests/bud.bats b/tests/bud.bats
index a37e418b41..07bdf45cac 100644
--- a/tests/bud.bats
+++ b/tests/bud.bats
@@ -366,6 +366,22 @@ _EOF
expect_output --substring "invalid response status"
}
+@test "build test has gid in supplemental groups" {
+ _prefetch alpine
+ run_buildah build $WITH_POLICY_JSON -t source -f $BUDFILES/supplemental-groups/Dockerfile
+ # gid 1000 must be in supplemental groups
+ expect_output --substring "Groups: 1000"
+}
+
+@test "build test if supplemental groups has gid with --isolation chroot" {
+ test -z "${BUILDAH_ISOLATION}" || skip "BUILDAH_ISOLATION=${BUILDAH_ISOLATION} overrides --isolation"
+
+ _prefetch alpine
+ run_buildah build --isolation chroot $WITH_POLICY_JSON -t source -f $BUDFILES/supplemental-groups/Dockerfile
+ # gid 1000 must be in supplemental groups
+ expect_output --substring "Groups: 1000"
+}
+
# Test skipping images with FROM
@test "build-test skipping unwanted stages with FROM" {
mkdir -p ${TEST_SCRATCH_DIR}/bud/platform
diff --git a/tests/bud/supplemental-groups/Dockerfile b/tests/bud/supplemental-groups/Dockerfile
new file mode 100644
index 0000000000..462d9ea7a4
--- /dev/null
+++ b/tests/bud/supplemental-groups/Dockerfile
@@ -0,0 +1,3 @@
+FROM alpine
+USER 1000:1000
+RUN cat /proc/$$/status
diff --git a/tests/run.bats b/tests/run.bats
index 2e8836c470..e34091fcbe 100644
--- a/tests/run.bats
+++ b/tests/run.bats
@@ -349,6 +349,20 @@ function configure_and_check_user() {
expect_output "888:888"
}
+@test "run --user and verify gid in supplemental groups" {
+ skip_if_no_runtime
+
+ # Create the container.
+ _prefetch alpine
+ run_buildah from $WITH_POLICY_JSON alpine
+ ctr="$output"
+
+ # Run with uid:gid 1000:1000 and verify if gid is present in additional groups
+ run_buildah run --user 1000:1000 "$ctr" cat /proc/self/status
+ # gid 1000 must be in additional/supplemental groups
+ expect_output --substring "Groups: 1000 "
+}
+
@test "run --workingdir" {
skip_if_no_runtime

View File

@ -11,14 +11,14 @@ go build -buildmode pie -compiler gc -tags="rpm_crashtraceback libtrust_openssl
%endif
%global import_path github.com/containers/buildah
#%%global branch main
%global commit0 db8d5921a770e7536b34c56d062b47795b548d35
%global branch release-1.29
%global commit0 7fa17a8428727eb3ecaca088bda1ebec590eeb8c
%global shortcommit0 %(c=%{commit0}; echo ${c:0:7})
Epoch: 1
Name: buildah
Version: 1.27.0
Release: 2%{?dist}
Version: 1.29.1
Release: 1%{?dist}
Summary: A command line tool used for creating OCI Images
License: ASL 2.0
URL: https://%{name}.io
@ -29,7 +29,6 @@ Source0: https://%{import_path}/tarball/%{commit0}/%{branch}-%{shortcommit0}.tar
%else
Source0: https://%{import_path}/archive/%{commit0}/%{name}-%{version}-%{shortcommit0}.tar.gz
%endif
Patch0: https://patch-diff.githubusercontent.com/raw/containers/buildah/pull/4200.patch
BuildRequires: golang >= 1.17.7
BuildRequires: git
BuildRequires: glib2-devel
@ -136,6 +135,86 @@ make DESTDIR=%{buildroot} PREFIX=%{_prefix} -C docs install
%{_datadir}/%{name}/test
%changelog
* Thu Feb 16 2023 Jindrich Novy <jnovy@redhat.com> - 1:1.29.1-1
- update to the latest content of https://github.com/containers/buildah/tree/release-1.29
(https://github.com/containers/buildah/commit/7fa17a8)
- Related: #2123641
* Fri Feb 10 2023 Jindrich Novy <jnovy@redhat.com> - 1:1.29.0-4
- update to the latest content of https://github.com/containers/buildah/tree/release-1.29
(https://github.com/containers/buildah/commit/c822cc6)
- Related: #2123641
* Tue Jan 31 2023 Jindrich Novy <jnovy@redhat.com> - 1:1.29.0-3
- update to the latest content of https://github.com/containers/buildah/tree/release-1.29
(https://github.com/containers/buildah/commit/94b723c)
- Related: #2123641
* Mon Jan 30 2023 Jindrich Novy <jnovy@redhat.com>
- update to the latest content of https://github.com/containers/buildah/tree/release-1.29.0
(https://github.com/containers/buildah/commit/)
- Related: #2123641
* Fri Jan 27 2023 Jindrich Novy <jnovy@redhat.com> - 1:1.29.0-1
- update to the latest content of https://github.com/containers/buildah/tree/release-1.29.0
(https://github.com/containers/buildah/commit/94b723c)
- Related: #2123641
* Wed Jan 25 2023 Jindrich Novy <jnovy@redhat.com> - 1:1.29.0-0.5
- update to the latest content of https://github.com/containers/buildah/tree/main
(https://github.com/containers/buildah/commit/078a7ff)
- Related: #2123641
* Tue Jan 24 2023 Jindrich Novy <jnovy@redhat.com> - 1:1.29.0-0.4
- update to the latest content of https://github.com/containers/buildah/tree/main
(https://github.com/containers/buildah/commit/4b72f05)
- Related: #2123641
* Wed Jan 18 2023 Jindrich Novy <jnovy@redhat.com> - 1:1.29.0-0.3
- update to the latest content of https://github.com/containers/buildah/tree/main
(https://github.com/containers/buildah/commit/c541c35)
- Related: #2123641
* Tue Jan 17 2023 Jindrich Novy <jnovy@redhat.com> - 1:1.29.0-0.2
- update to the latest content of https://github.com/containers/buildah/tree/main
(https://github.com/containers/buildah/commit/39dfa73)
- Related: #2123641
* Fri Jan 13 2023 Jindrich Novy <jnovy@redhat.com> - 1:1.29.0-0.1
- update to the latest content of https://github.com/containers/buildah/tree/main
(https://github.com/containers/buildah/commit/8ca903b)
- Resolves: #2140087
* Fri Jan 06 2023 Jindrich Novy <jnovy@redhat.com> - 1:1.28.2-3
- update to the latest content of https://github.com/containers/buildah/tree/release-1.28
(https://github.com/containers/buildah/commit/cfefbb6)
- Resolves: #2140087
* Tue Dec 06 2022 Jindrich Novy <jnovy@redhat.com> - 1:1.28.2-2
- update to the latest content of https://github.com/containers/buildah/tree/release-1.28
(https://github.com/containers/buildah/commit/7e4d9dd)
- Resolves: #2136319
* Mon Nov 28 2022 Jindrich Novy <jnovy@redhat.com> - 1:1.28.2-1
- update to https://github.com/containers/buildah/releases/tag/v1.28.2
- Related: #2123641
* Thu Oct 06 2022 Jindrich Novy <jnovy@redhat.com> - 1:1.28.0-1
- update to https://github.com/containers/buildah/releases/tag/v1.28.0
- Related: #2123641
* Wed Sep 21 2022 Jindrich Novy <jnovy@redhat.com> - 1:1.27.2-1
- update to https://github.com/containers/buildah/releases/tag/v1.27.2
- Related: #2123641
* Mon Sep 12 2022 Jindrich Novy <jnovy@redhat.com> - 1:1.27.1-2
- drop applied patch
- Related: #2123641
* Mon Sep 12 2022 Jindrich Novy <jnovy@redhat.com> - 1:1.27.1-1
- update to https://github.com/containers/buildah/releases/tag/v1.27.1
- Related: #2123641
* Fri Aug 26 2022 Jindrich Novy <jnovy@redhat.com> - 1:1.27.0-2
- fix CVE-2022-2990
- Related: #2061390