Compare commits

...

No commits in common. "c8-stream-3.0" and "stream-container-tools-rhel8-rhel-8.10.0" have entirely different histories.

8 changed files with 284 additions and 207 deletions

View File

@ -1 +0,0 @@
c79a414d0b980611ba929a7526b7b4c30c2b3b1d SOURCES/crun-0.18.tar.gz

2
.gitignore vendored
View File

@ -1 +1 @@
SOURCES/crun-0.18.tar.gz
/*.tar.gz

View File

@ -1,43 +0,0 @@
From 320a7ec41342c95fd6bdc500cd207eb0ea5cda6a Mon Sep 17 00:00:00 2001
From: Giuseppe Scrivano <gscrivan@redhat.com>
Date: Fri, 19 Feb 2021 13:25:37 +0100
Subject: [PATCH] Revert "tests: build init always statically"
This reverts commit a0f322a49a10a014a447b505eda5923a8e6aff7c as it
causes issues on RHEL 8.
Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
---
Makefile.am | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/Makefile.am b/Makefile.am
index e39dc3b..2b8e18b 100644
--- a/Makefile.am
+++ b/Makefile.am
@@ -14,7 +14,7 @@ srpm: dist-gzip rpm/crun.spec
$(MAKE) -C $(WD) dist-gzip
rpmbuild -bs --define "_sourcedir $(WD)" --define "_specdir $(WD)" --define "_builddir $(WD)" --define "_srcrpmdir $(WD)" --define "_rpmdir $(WD)" --define "_buildrootdir $(WD)/.build" rpm/crun.spec
-CLEANFILES = crun.spec tests/init
+CLEANFILES = crun.spec
lib_LTLIBRARIES = libcrun.la
@@ -79,9 +79,9 @@ noinst_PROGRAMS = tests/init $(UNIT_TESTS)
TESTS_LDADD = libcrun_testing.a $(FOUND_LIBS)
-tests/init: tests/init.c
- $(CC) -static-libgcc --static -o $@ $<
-EXTRA_DIST += tests/init.c
+tests_init_LDADD =
+tests_init_LDFLAGS = -static-libgcc -all-static
+tests_init_SOURCES = tests/init.c $(UNIT_TESTS)
tests_tests_libcrun_utils_CFLAGS = -I $(abs_top_builddir)/libocispec/src -I $(abs_top_srcdir)/libocispec/src -I $(abs_top_builddir)/src -I $(abs_top_srcdir)/src
tests_tests_libcrun_utils_SOURCES = tests/tests_libcrun_utils.c
--
2.29.2

View File

@ -1,30 +0,0 @@
From ed485db1465d67f0215c27529c57a76a1daf5135 Mon Sep 17 00:00:00 2001
From: Giuseppe Scrivano <gscrivan@redhat.com>
Date: Mon, 28 Feb 2022 11:05:18 +0100
Subject: [PATCH 1/2] spec: do not set inheritable capabilities
Closes: CVE-2022-27650
Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
(cherry picked from commit b847d146d496c9d7beba166fd595488e85488562)
---
src/libcrun/container.c | 3 ---
1 file changed, 3 deletions(-)
diff --git a/src/libcrun/container.c b/src/libcrun/container.c
index d3fb017..1e3f3e6 100644
--- a/src/libcrun/container.c
+++ b/src/libcrun/container.c
@@ -128,9 +128,6 @@ static char spec_file[] = "\
\"CAP_NET_BIND_SERVICE\"\n\
],\n\
\"inheritable\": [\n\
- \"CAP_AUDIT_WRITE\",\n\
- \"CAP_KILL\",\n\
- \"CAP_NET_BIND_SERVICE\"\n\
],\n\
\"permitted\": [\n\
\"CAP_AUDIT_WRITE\",\n\
--
2.35.1

View File

@ -1,31 +0,0 @@
From 21cb5a8c7bcc90c42743ffd15cd11a55bf66993d Mon Sep 17 00:00:00 2001
From: Giuseppe Scrivano <gscrivan@redhat.com>
Date: Mon, 28 Feb 2022 11:06:50 +0100
Subject: [PATCH 2/2] exec: --cap do not set inheritable capabilities
Closes: CVE-2022-27650
Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
(cherry picked from commit 1aeeed2e4fdeffb4875c0d0b439915894594c8c6)
---
src/exec.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/src/exec.c b/src/exec.c
index bf6c05f..8c9862d 100644
--- a/src/exec.c
+++ b/src/exec.c
@@ -250,8 +250,8 @@ crun_command_exec (struct crun_global_arguments *global_args, int argc, char **a
capabilities->effective = exec_options.cap;
capabilities->effective_len = exec_options.cap_size;
- capabilities->inheritable = dup_array (exec_options.cap, exec_options.cap_size);
- capabilities->inheritable_len = exec_options.cap_size;
+ capabilities->inheritable = NULL;
+ capabilities->inheritable_len = 0;
capabilities->bounding = dup_array (exec_options.cap, exec_options.cap_size);
capabilities->bounding_len = exec_options.cap_size;
--
2.35.1

View File

@ -1,101 +0,0 @@
Summary: OCI runtime written in C
Name: crun
Version: 0.18
Release: 3%{?dist}
Source0: https://github.com/containers/%{name}/releases/download/%{version}/%{name}-%{version}.tar.gz
Patch0: 0001-revert-tests-build-init-always-statically.patch
Patch1: 0001-spec-do-not-set-inheritable-capabilities.patch
Patch2: 0002-exec-cap-do-not-set-inheritable-capabilities.patch
License: GPLv2+
URL: https://github.com/containers/crun
# https://fedoraproject.org/wiki/PackagingDrafts/Go#Go_Language_Architectures
ExclusiveArch: %{go_arches}
# We always run autogen.sh
BuildRequires: autoconf
BuildRequires: automake
BuildRequires: gcc
BuildRequires: python3
BuildRequires: git
BuildRequires: libcap-devel
BuildRequires: systemd-devel
BuildRequires: yajl-devel
BuildRequires: libseccomp-devel
BuildRequires: libselinux-devel
BuildRequires: python3-libmount
BuildRequires: libtool
BuildRequires: go-md2man
Provides: oci-runtime = 2
%description
crun is a runtime for running OCI containers
%prep
%autosetup -Sgit -n %{name}-%{version}
%build
export CFLAGS="%{optflags} -D_LARGEFILE_SOURCE -D_LARGEFILE64_SOURCE -D_FILE_OFFSET_BITS=64"
./autogen.sh
%configure --disable-silent-rules
%make_build
%install
%make_install
rm -rf $RPM_BUILD_ROOT/usr/lib*
%files
%license COPYING
%{_bindir}/%{name}
%{_mandir}/man1/*
%changelog
* Tue Apr 05 2022 Jindrich Novy <jnovy@redhat.com> - 0.18-3
- fix CVE-2022-27650
- Related: #2061390
* Fri Feb 19 2021 Jindrich Novy <jnovy@redhat.com> - 0.18-2
- allow to build without glibc-static (thanks to Giuseppe Scrivano)
- Related: #1883490
* Fri Feb 19 2021 Jindrich Novy <jnovy@redhat.com> - 0.18-1
- update to https://github.com/containers/crun/releases/tag/0.18
- Related: #1883490
* Fri Jan 22 2021 Jindrich Novy <jnovy@redhat.com> - 0.17-1
- update to https://github.com/containers/crun/releases/tag/0.17
- Related: #1883490
* Thu Dec 03 2020 Jindrich Novy <jnovy@redhat.com> - 0.16-2
- exclude i686 because of build failures
- Related: #1883490
* Wed Nov 25 2020 Jindrich Novy <jnovy@redhat.com> - 0.16-1
- update to https://github.com/containers/crun/releases/tag/0.16
- Related: #1883490
* Wed Nov 04 2020 Jindrich Novy <jnovy@redhat.com> - 0.15.1-1
- update to https://github.com/containers/crun/releases/tag/0.15.1
- Related: #1883490
* Thu Oct 29 2020 Jindrich Novy <jnovy@redhat.com> - 0.15-2
- synchronize with stream-container-tools-rhel8
- Related: #1883490
* Wed Oct 21 2020 Jindrich Novy <jnovy@redhat.com> - 0.15-1
- synchronize with stream-container-tools-rhel8
- Related: #1883490
* Tue Aug 11 2020 Jindrich Novy <jnovy@redhat.com> - 0.14.1-2
- use proper CFLAGS
- Related: #1821193
* Wed Jul 08 2020 Jindrich Novy <jnovy@redhat.com> - 0.14.1-1
- update to https://github.com/containers/crun/releases/tag/v0.14.1
- Related: #1821193
* Thu Jul 02 2020 Jindrich Novy <jnovy@redhat.com> - 0.14-1
- update to https://github.com/containers/crun/releases/tag/v0.14
- Related: #1821193
* Tue Jun 16 2020 Giuseppe Scrivano <gscrivan@redhat.com> - 0.13-1
- initial import

282
crun.spec Normal file
View File

@ -0,0 +1,282 @@
Summary: OCI runtime written in C
Name: crun
Version: 1.14.3
Release: 2%{?dist}
Source0: https://github.com/containers/%{name}/releases/download/%{version}/%{name}-%{version}.tar.gz
License: GPLv2+
URL: https://github.com/containers/crun
# https://fedoraproject.org/wiki/PackagingDrafts/Go#Go_Language_Architectures
ExclusiveArch: %{go_arches}
# We always run autogen.sh
BuildRequires: autoconf
BuildRequires: automake
BuildRequires: gcc
BuildRequires: python3
BuildRequires: git
BuildRequires: libcap-devel
BuildRequires: systemd-devel
BuildRequires: yajl-devel
BuildRequires: libseccomp-devel
BuildRequires: libselinux-devel
BuildRequires: criu-devel
BuildRequires: python3-libmount
BuildRequires: libtool
BuildRequires: /usr/bin/go-md2man
Provides: oci-runtime
Recommends: criu >= 3.17.1
Recommends: criu-libs
%description
crun is a runtime for running OCI containers
%prep
%autosetup -Sgit -n %{name}-%{version}
%build
export CFLAGS="%{optflags} -D_LARGEFILE_SOURCE -D_LARGEFILE64_SOURCE -D_FILE_OFFSET_BITS=64"
./autogen.sh
%configure --disable-silent-rules
%make_build
%install
%make_install
rm -rf %{buildroot}%{_prefix}/lib*
%files
%license COPYING
%{_bindir}/%{name}
%{_mandir}/man1/*
%changelog
* Mon Feb 19 2024 Jindrich Novy <jnovy@redhat.com> - 1.14.3-2
- remove BR libgcrypt-devel, no longer needed
- Related: Jira:RHEL-2110
* Mon Feb 19 2024 Jindrich Novy <jnovy@redhat.com> - 1.14.3-1
- update to https://github.com/containers/crun/releases/tag/1.14.3
- Related: Jira:RHEL-2110
* Fri Feb 09 2024 Jindrich Novy <jnovy@redhat.com> - 1.14.1-1
- update to https://github.com/containers/crun/releases/tag/1.14.1
- Related: Jira:RHEL-2110
* Thu Jan 25 2024 Jindrich Novy <jnovy@redhat.com> - 1.14-1
- update to https://github.com/containers/crun/releases/tag/1.14
- Related: Jira:RHEL-2110
* Wed Jan 17 2024 Jindrich Novy <jnovy@redhat.com> - 1.13-1
- update to https://github.com/containers/crun/releases/tag/1.13
- Related: Jira:RHEL-2110
* Tue Jan 02 2024 Jindrich Novy <jnovy@redhat.com> - 1.12-1
- update to https://github.com/containers/crun/releases/tag/1.12
- Related: Jira:RHEL-2110
* Tue Nov 07 2023 Jindrich Novy <jnovy@redhat.com> - 1.11.2-1
- update to https://github.com/containers/crun/releases/tag/1.11.2
- Related: Jira:RHEL-2110
* Tue Oct 31 2023 Jindrich Novy <jnovy@redhat.com> - 1.11.1-1
- update to https://github.com/containers/crun/releases/tag/1.11.1
- Related: Jira:RHEL-2110
* Mon Oct 30 2023 Jindrich Novy <jnovy@redhat.com> - 1.11-1
- update to https://github.com/containers/crun/releases/tag/1.11
- Related: Jira:RHEL-2110
* Fri Sep 29 2023 Jindrich Novy <jnovy@redhat.com> - 1.9.2-1
- update to https://github.com/containers/crun/releases/tag/1.9.2
- Related: Jira:RHEL-2110
* Wed Sep 27 2023 Jindrich Novy <jnovy@redhat.com> - 1.9.1-1
- update to https://github.com/containers/crun/releases/tag/1.9.1
- Related: Jira:RHEL-2110
* Fri Sep 15 2023 Jindrich Novy <jnovy@redhat.com> - 1.9-1
- update to https://github.com/containers/crun/releases/tag/1.9
- Related: Jira:RHEL-2110
* Tue Aug 22 2023 Jindrich Novy <jnovy@redhat.com> - 1.8.7-1
- update to https://github.com/containers/crun/releases/tag/1.8.7
- Related: #2176055
* Mon Jul 31 2023 Jindrich Novy <jnovy@redhat.com> - 1.8.6-1
- update to https://github.com/containers/crun/releases/tag/1.8.6
- Related: #2176055
* Mon May 22 2023 Jindrich Novy <jnovy@redhat.com> - 1.8.5-1
- update to https://github.com/containers/crun/releases/tag/1.8.5
- Related: #2176055
* Mon Apr 24 2023 Jindrich Novy <jnovy@redhat.com> - 1.8.4-1
- update to https://github.com/containers/crun/releases/tag/1.8.4
- Related: #2176055
* Tue Apr 04 2023 Jindrich Novy <jnovy@redhat.com> - 1.8.3-2
- fix could not find symbol criu_set_lsm_mount_context in libcriu.so
- Resolves: #2183041
* Sun Mar 26 2023 Jindrich Novy <jnovy@redhat.com> - 1.8.3-1
- update to https://github.com/containers/crun/releases/tag/1.8.3
- Related: #2176055
* Fri Mar 24 2023 Jindrich Novy <jnovy@redhat.com> - 1.8.2-1
- update to https://github.com/containers/crun/releases/tag/1.8.2
- Related: #2176055
* Mon Mar 20 2023 Jindrich Novy <jnovy@redhat.com> - 1.8.1-2
- add BR: criu-devel
- Related: #2176055
* Thu Mar 09 2023 Jindrich Novy <jnovy@redhat.com> - 1.8.1-1
- update to https://github.com/containers/crun/releases/tag/1.8.1
- Related: #2176055
* Wed Nov 30 2022 Jindrich Novy <jnovy@redhat.com> - 1.7.2-1
- update to https://github.com/containers/crun/releases/tag/1.7.2
- Related: #2123641
* Mon Nov 28 2022 Jindrich Novy <jnovy@redhat.com> - 1.7.1-1
- update to https://github.com/containers/crun/releases/tag/1.7.1
- Related: #2123641
* Tue Nov 08 2022 Jindrich Novy <jnovy@redhat.com> - 1.7-1
- update to https://github.com/containers/crun/releases/tag/1.7
- Related: #2123641
* Thu Sep 08 2022 Jindrich Novy <jnovy@redhat.com> - 1.6-1
- update to https://github.com/containers/crun/releases/tag/1.6
- Related: #2123641
* Tue Jul 26 2022 Jindrich Novy <jnovy@redhat.com> - 1.5-1
- update to https://github.com/containers/crun/releases/tag/1.5
- Related: #2061390
* Wed May 11 2022 Jindrich Novy <jnovy@redhat.com> - 1.4.5-2
- BuildRequires: /usr/bin/go-md2man
- Related: #2061390
* Wed Apr 27 2022 Jindrich Novy <jnovy@redhat.com> - 1.4.5-1
- update to https://github.com/containers/crun/releases/tag/1.4.5
- Related: #2061390
* Thu Mar 24 2022 Jindrich Novy <jnovy@redhat.com> - 1.4.4-1
- update to https://github.com/containers/crun/releases/tag/1.4.4
- Related: #2061390
* Mon Mar 07 2022 Jindrich Novy <jnovy@redhat.com> - 1.4.3-1
- update to https://github.com/containers/crun/releases/tag/1.4.3
- Related: #2061390
* Wed Jan 26 2022 Jindrich Novy <jnovy@redhat.com> - 1.4.2-1
- update to https://github.com/containers/crun/releases/tag/1.4.2
- Related: #2001445
* Fri Jan 14 2022 Jindrich Novy <jnovy@redhat.com> - 1.4.1-1
- update to https://github.com/containers/crun/releases/tag/1.4.1
- Related: #2001445
* Wed Dec 22 2021 Jindrich Novy <jnovy@redhat.com> - 1.4-1
- update to https://github.com/containers/crun/releases/tag/1.4
- Related: #2001445
* Mon Nov 08 2021 Jindrich Novy <jnovy@redhat.com> - 1.3-1
- update to https://github.com/containers/crun/releases/tag/1.3
- Related: #2001445
* Mon Oct 11 2021 Jindrich Novy <jnovy@redhat.com> - 1.2-1
- update to https://github.com/containers/crun/releases/tag/1.2
- Related: #2001445
* Mon Sep 27 2021 Jindrich Novy <jnovy@redhat.com> - 1.1-1
- update to https://github.com/containers/crun/releases/tag/1.1
- Related: #2001445
* Thu Aug 26 2021 Jindrich Novy <jnovy@redhat.com> - 1.0-1
- update to https://github.com/containers/crun/releases/tag/1.0
- Related: #1934415
* Fri Aug 06 2021 Jindrich Novy <jnovy@redhat.com> - 0.21-3
- remove BR: criu-devel and leave it just for RHEL9
- Related: #1934415
* Fri Aug 06 2021 Jindrich Novy <jnovy@redhat.com> - 0.21-2
- do not use versioned provide
- BR: criu-devel
- Related: #1934415
* Tue Jul 27 2021 Jindrich Novy <jnovy@redhat.com> - 0.21-1
- update to https://github.com/containers/crun/releases/tag/0.21
- Related: #1934415
* Thu Jun 10 2021 Jindrich Novy <jnovy@redhat.com> - 0.20.1-1
- update to https://github.com/containers/crun/releases/tag/0.20.1
- Related: #1934415
* Wed Jun 02 2021 Jindrich Novy <jnovy@redhat.com> - 0.20-1
- update to https://github.com/containers/crun/releases/tag/0.20
- Related: #1934415
* Mon Apr 26 2021 Jindrich Novy <jnovy@redhat.com> - 0.19.1-1
- update to https://github.com/containers/crun/releases/tag/0.19.1
- Related: #1934415
* Wed Apr 07 2021 Jindrich Novy <jnovy@redhat.com> - 0.19-2
- remove unused patch reference from spec
- Related: #1934415
* Tue Apr 06 2021 Jindrich Novy <jnovy@redhat.com> - 0.19-1
- update to https://github.com/containers/crun/releases/tag/0.19
- Related: #1934415
* Fri Feb 19 2021 Jindrich Novy <jnovy@redhat.com> - 0.18-1
- allow to build without glibc-static (thanks to Giuseppe Scrivano)
- Related: #1883490
* Fri Feb 19 2021 Jindrich Novy <jnovy@redhat.com> - 0.17-2
- reverting back to 0.17 as there's no glibc-static in RHEL
- Related: #1883490
* Fri Feb 19 2021 Jindrich Novy <jnovy@redhat.com> - 0.18-1
- update to https://github.com/containers/crun/releases/tag/0.18
- Related: #1883490
* Fri Jan 22 2021 Jindrich Novy <jnovy@redhat.com> - 0.17-1
- update to https://github.com/containers/crun/releases/tag/0.17
- Related: #1883490
* Thu Dec 03 2020 Jindrich Novy <jnovy@redhat.com> - 0.16-2
- exclude i686 because of build failures
- Related: #1883490
* Wed Nov 25 2020 Jindrich Novy <jnovy@redhat.com> - 0.16-1
- update to https://github.com/containers/crun/releases/tag/0.16
- Related: #1883490
* Wed Nov 04 2020 Jindrich Novy <jnovy@redhat.com> - 0.15.1-1
- update to https://github.com/containers/crun/releases/tag/0.15.1
- Related: #1883490
* Thu Oct 29 2020 Jindrich Novy <jnovy@redhat.com> - 0.15-2
- synchronize with stream-container-tools-rhel8
- Related: #1883490
* Wed Oct 21 2020 Jindrich Novy <jnovy@redhat.com> - 0.15-1
- synchronize with stream-container-tools-rhel8
- Related: #1883490
* Tue Aug 11 2020 Jindrich Novy <jnovy@redhat.com> - 0.14.1-2
- use proper CFLAGS
- Related: #1821193
* Wed Jul 08 2020 Jindrich Novy <jnovy@redhat.com> - 0.14.1-1
- update to https://github.com/containers/crun/releases/tag/v0.14.1
- Related: #1821193
* Thu Jul 02 2020 Jindrich Novy <jnovy@redhat.com> - 0.14-1
- update to https://github.com/containers/crun/releases/tag/v0.14
- Related: #1821193
* Tue Jun 16 2020 Giuseppe Scrivano <gscrivan@redhat.com> - 0.13-1
- initial import

1
sources Normal file
View File

@ -0,0 +1 @@
SHA512 (crun-1.14.3.tar.gz) = a19b3478783480e26544704a8e2e685cf9e07b6739ed2569eaee8c3a1a66f56372312a0e93b4886a5f7b6773bafd7b19ac8e50c948bbc9d48ffeae0b62144796