.crun.metadata

@@ -0,0 +1 @@
+c79a414d0b980611ba929a7526b7b4c30c2b3b1d SOURCES/crun-0.18.tar.gz

.gitignore

@@ -1 +1 @@
-/*.tar.gz
+SOURCES/crun-0.18.tar.gz

SOURCES/0001-revert-tests-build-init-always-statically.patch

@@ -0,0 +1,43 @@
+From 320a7ec41342c95fd6bdc500cd207eb0ea5cda6a Mon Sep 17 00:00:00 2001
+From: Giuseppe Scrivano <gscrivan@redhat.com>
+Date: Fri, 19 Feb 2021 13:25:37 +0100
+Subject: [PATCH] Revert "tests: build init always statically"
+
+This reverts commit a0f322a49a10a014a447b505eda5923a8e6aff7c as it
+causes issues on RHEL 8.
+
+Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
+---
+ Makefile.am | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/Makefile.am b/Makefile.am
+index e39dc3b..2b8e18b 100644
+--- a/Makefile.am
++++ b/Makefile.am
+@@ -14,7 +14,7 @@ srpm: dist-gzip rpm/crun.spec
+ 	$(MAKE) -C $(WD) dist-gzip
+ 	rpmbuild -bs --define "_sourcedir $(WD)" --define "_specdir $(WD)" --define "_builddir $(WD)" --define "_srcrpmdir $(WD)" --define "_rpmdir $(WD)" --define "_buildrootdir $(WD)/.build" rpm/crun.spec
+ 
+-CLEANFILES = crun.spec tests/init
++CLEANFILES = crun.spec
+ 
+ lib_LTLIBRARIES = libcrun.la
+ 
+@@ -79,9 +79,9 @@ noinst_PROGRAMS = tests/init $(UNIT_TESTS)
+ 
+ TESTS_LDADD = libcrun_testing.a $(FOUND_LIBS)
+ 
+-tests/init: tests/init.c
+-	$(CC) -static-libgcc --static -o $@ $<
+-EXTRA_DIST += tests/init.c
++tests_init_LDADD =
++tests_init_LDFLAGS = -static-libgcc -all-static
++tests_init_SOURCES = tests/init.c $(UNIT_TESTS)
+ 
+ tests_tests_libcrun_utils_CFLAGS = -I $(abs_top_builddir)/libocispec/src -I $(abs_top_srcdir)/libocispec/src -I $(abs_top_builddir)/src -I $(abs_top_srcdir)/src
+ tests_tests_libcrun_utils_SOURCES = tests/tests_libcrun_utils.c
+-- 
+2.29.2
+
+

SOURCES/0001-spec-do-not-set-inheritable-capabilities.patch

@@ -0,0 +1,30 @@
+From ed485db1465d67f0215c27529c57a76a1daf5135 Mon Sep 17 00:00:00 2001
+From: Giuseppe Scrivano <gscrivan@redhat.com>
+Date: Mon, 28 Feb 2022 11:05:18 +0100
+Subject: [PATCH 1/2] spec: do not set inheritable capabilities
+
+Closes: CVE-2022-27650
+
+Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
+(cherry picked from commit b847d146d496c9d7beba166fd595488e85488562)
+---
+ src/libcrun/container.c | 3 ---
+ 1 file changed, 3 deletions(-)
+
+diff --git a/src/libcrun/container.c b/src/libcrun/container.c
+index d3fb017..1e3f3e6 100644
+--- a/src/libcrun/container.c
++++ b/src/libcrun/container.c
+@@ -128,9 +128,6 @@ static char spec_file[] = "\
+ 				\"CAP_NET_BIND_SERVICE\"\n\
+ 			],\n\
+ 			\"inheritable\": [\n\
+-				\"CAP_AUDIT_WRITE\",\n\
+-				\"CAP_KILL\",\n\
+-				\"CAP_NET_BIND_SERVICE\"\n\
+ 			],\n\
+ 			\"permitted\": [\n\
+ 				\"CAP_AUDIT_WRITE\",\n\
+-- 
+2.35.1
+

SOURCES/0002-exec-cap-do-not-set-inheritable-capabilities.patch

@@ -0,0 +1,31 @@
+From 21cb5a8c7bcc90c42743ffd15cd11a55bf66993d Mon Sep 17 00:00:00 2001
+From: Giuseppe Scrivano <gscrivan@redhat.com>
+Date: Mon, 28 Feb 2022 11:06:50 +0100
+Subject: [PATCH 2/2] exec: --cap do not set inheritable capabilities
+
+Closes: CVE-2022-27650
+
+Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
+(cherry picked from commit 1aeeed2e4fdeffb4875c0d0b439915894594c8c6)
+---
+ src/exec.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/src/exec.c b/src/exec.c
+index bf6c05f..8c9862d 100644
+--- a/src/exec.c
++++ b/src/exec.c
+@@ -250,8 +250,8 @@ crun_command_exec (struct crun_global_arguments *global_args, int argc, char **a
+           capabilities->effective = exec_options.cap;
+           capabilities->effective_len = exec_options.cap_size;
+ 
+-          capabilities->inheritable = dup_array (exec_options.cap, exec_options.cap_size);
+-          capabilities->inheritable_len = exec_options.cap_size;
++          capabilities->inheritable = NULL;
++          capabilities->inheritable_len = 0;
+ 
+           capabilities->bounding = dup_array (exec_options.cap, exec_options.cap_size);
+           capabilities->bounding_len = exec_options.cap_size;
+-- 
+2.35.1
+

SPECS/crun.spec

@@ -0,0 +1,101 @@
+Summary: OCI runtime written in C
+Name: crun
+Version: 0.18
+Release: 3%{?dist}
+Source0: https://github.com/containers/%{name}/releases/download/%{version}/%{name}-%{version}.tar.gz
+Patch0: 0001-revert-tests-build-init-always-statically.patch
+Patch1: 0001-spec-do-not-set-inheritable-capabilities.patch
+Patch2: 0002-exec-cap-do-not-set-inheritable-capabilities.patch
+License: GPLv2+
+URL: https://github.com/containers/crun
+# https://fedoraproject.org/wiki/PackagingDrafts/Go#Go_Language_Architectures
+ExclusiveArch: %{go_arches}
+# We always run autogen.sh
+BuildRequires: autoconf
+BuildRequires: automake
+BuildRequires: gcc
+BuildRequires: python3
+BuildRequires: git
+BuildRequires: libcap-devel
+BuildRequires: systemd-devel
+BuildRequires: yajl-devel
+BuildRequires: libseccomp-devel
+BuildRequires: libselinux-devel
+BuildRequires: python3-libmount
+BuildRequires: libtool
+BuildRequires: go-md2man
+Provides: oci-runtime = 2
+
+%description
+crun is a runtime for running OCI containers
+
+%prep
+%autosetup -Sgit -n %{name}-%{version}
+
+%build
+export CFLAGS="%{optflags} -D_LARGEFILE_SOURCE -D_LARGEFILE64_SOURCE -D_FILE_OFFSET_BITS=64"
+./autogen.sh
+%configure --disable-silent-rules
+
+%make_build
+
+%install
+%make_install
+rm -rf $RPM_BUILD_ROOT/usr/lib*
+
+%files
+%license COPYING
+%{_bindir}/%{name}
+%{_mandir}/man1/*
+
+%changelog
+* Tue Apr 05 2022 Jindrich Novy <jnovy@redhat.com> - 0.18-3
+- fix CVE-2022-27650
+- Related: #2061390
+
+* Fri Feb 19 2021 Jindrich Novy <jnovy@redhat.com> - 0.18-2
+- allow to build without glibc-static (thanks to Giuseppe Scrivano)
+- Related: #1883490
+
+* Fri Feb 19 2021 Jindrich Novy <jnovy@redhat.com> - 0.18-1
+- update to https://github.com/containers/crun/releases/tag/0.18
+- Related: #1883490
+
+* Fri Jan 22 2021 Jindrich Novy <jnovy@redhat.com> - 0.17-1
+- update to https://github.com/containers/crun/releases/tag/0.17
+- Related: #1883490
+
+* Thu Dec 03 2020 Jindrich Novy <jnovy@redhat.com> - 0.16-2
+- exclude i686 because of build failures
+- Related: #1883490
+
+* Wed Nov 25 2020 Jindrich Novy <jnovy@redhat.com> - 0.16-1
+- update to https://github.com/containers/crun/releases/tag/0.16
+- Related: #1883490
+
+* Wed Nov 04 2020 Jindrich Novy <jnovy@redhat.com> - 0.15.1-1
+- update to https://github.com/containers/crun/releases/tag/0.15.1
+- Related: #1883490
+
+* Thu Oct 29 2020 Jindrich Novy <jnovy@redhat.com> - 0.15-2
+- synchronize with stream-container-tools-rhel8
+- Related: #1883490
+
+* Wed Oct 21 2020 Jindrich Novy <jnovy@redhat.com> - 0.15-1
+- synchronize with stream-container-tools-rhel8
+- Related: #1883490
+
+* Tue Aug 11 2020 Jindrich Novy <jnovy@redhat.com> - 0.14.1-2
+- use proper CFLAGS
+- Related: #1821193
+
+* Wed Jul 08 2020 Jindrich Novy <jnovy@redhat.com> - 0.14.1-1
+- update to https://github.com/containers/crun/releases/tag/v0.14.1
+- Related: #1821193
+
+* Thu Jul 02 2020 Jindrich Novy <jnovy@redhat.com> - 0.14-1
+- update to https://github.com/containers/crun/releases/tag/v0.14
+- Related: #1821193
+
+* Tue Jun 16 2020 Giuseppe Scrivano <gscrivan@redhat.com> - 0.13-1
+- initial import

crun.spec

@@ -1,235 +0,0 @@
-Summary: OCI runtime written in C
-Name: crun
-Version: 1.8.7
-Release: 1%{?dist}
-Source0: https://github.com/containers/%{name}/releases/download/%{version}/%{name}-%{version}.tar.gz
-License: GPLv2+
-URL: https://github.com/containers/crun
-# https://fedoraproject.org/wiki/PackagingDrafts/Go#Go_Language_Architectures
-ExclusiveArch: %{go_arches}
-# We always run autogen.sh
-BuildRequires: autoconf
-BuildRequires: automake
-BuildRequires: gcc
-BuildRequires: python3
-BuildRequires: git
-BuildRequires: libcap-devel
-BuildRequires: systemd-devel
-BuildRequires: yajl-devel
-BuildRequires: libseccomp-devel
-BuildRequires: libselinux-devel
-BuildRequires: criu-devel
-BuildRequires: python3-libmount
-BuildRequires: libtool
-BuildRequires: /usr/bin/go-md2man
-BuildRequires: libgcrypt-devel
-Provides: oci-runtime
-Recommends: criu >= 3.17.1
-Recommends: criu-libs
-
-%description
-crun is a runtime for running OCI containers
-
-%prep
-%autosetup -Sgit -n %{name}-%{version}
-
-%build
-export CFLAGS="%{optflags} -D_LARGEFILE_SOURCE -D_LARGEFILE64_SOURCE -D_FILE_OFFSET_BITS=64"
-./autogen.sh
-%configure --disable-silent-rules
-
-%make_build
-
-%install
-%make_install
-rm -rf %{buildroot}%{_prefix}/lib*
-
-%files
-%license COPYING
-%{_bindir}/%{name}
-%{_mandir}/man1/*
-
-%changelog
-* Tue Aug 22 2023 Jindrich Novy <jnovy@redhat.com> - 1.8.7-1
-- update to https://github.com/containers/crun/releases/tag/1.8.7
-- Related: #2176055
-
-* Mon Jul 31 2023 Jindrich Novy <jnovy@redhat.com> - 1.8.6-1
-- update to https://github.com/containers/crun/releases/tag/1.8.6
-- Related: #2176055
-
-* Mon May 22 2023 Jindrich Novy <jnovy@redhat.com> - 1.8.5-1
-- update to https://github.com/containers/crun/releases/tag/1.8.5
-- Related: #2176055
-
-* Mon Apr 24 2023 Jindrich Novy <jnovy@redhat.com> - 1.8.4-1
-- update to https://github.com/containers/crun/releases/tag/1.8.4
-- Related: #2176055
-
-* Tue Apr 04 2023 Jindrich Novy <jnovy@redhat.com> - 1.8.3-2
-- fix could not find symbol criu_set_lsm_mount_context in libcriu.so
-- Resolves: #2183041
-
-* Sun Mar 26 2023 Jindrich Novy <jnovy@redhat.com> - 1.8.3-1
-- update to https://github.com/containers/crun/releases/tag/1.8.3
-- Related: #2176055
-
-* Fri Mar 24 2023 Jindrich Novy <jnovy@redhat.com> - 1.8.2-1
-- update to https://github.com/containers/crun/releases/tag/1.8.2
-- Related: #2176055
-
-* Mon Mar 20 2023 Jindrich Novy <jnovy@redhat.com> - 1.8.1-2
-- add BR: criu-devel
-- Related: #2176055
-
-* Thu Mar 09 2023 Jindrich Novy <jnovy@redhat.com> - 1.8.1-1
-- update to https://github.com/containers/crun/releases/tag/1.8.1
-- Related: #2176055
-
-* Wed Nov 30 2022 Jindrich Novy <jnovy@redhat.com> - 1.7.2-1
-- update to https://github.com/containers/crun/releases/tag/1.7.2
-- Related: #2123641
-
-* Mon Nov 28 2022 Jindrich Novy <jnovy@redhat.com> - 1.7.1-1
-- update to https://github.com/containers/crun/releases/tag/1.7.1
-- Related: #2123641
-
-* Tue Nov 08 2022 Jindrich Novy <jnovy@redhat.com> - 1.7-1
-- update to https://github.com/containers/crun/releases/tag/1.7
-- Related: #2123641
-
-* Thu Sep 08 2022 Jindrich Novy <jnovy@redhat.com> - 1.6-1
-- update to https://github.com/containers/crun/releases/tag/1.6
-- Related: #2123641
-
-* Tue Jul 26 2022 Jindrich Novy <jnovy@redhat.com> - 1.5-1
-- update to https://github.com/containers/crun/releases/tag/1.5
-- Related: #2061390
-
-* Wed May 11 2022 Jindrich Novy <jnovy@redhat.com> - 1.4.5-2
-- BuildRequires: /usr/bin/go-md2man
-- Related: #2061390
-
-* Wed Apr 27 2022 Jindrich Novy <jnovy@redhat.com> - 1.4.5-1
-- update to https://github.com/containers/crun/releases/tag/1.4.5
-- Related: #2061390
-
-* Thu Mar 24 2022 Jindrich Novy <jnovy@redhat.com> - 1.4.4-1
-- update to https://github.com/containers/crun/releases/tag/1.4.4
-- Related: #2061390
-
-* Mon Mar 07 2022 Jindrich Novy <jnovy@redhat.com> - 1.4.3-1
-- update to https://github.com/containers/crun/releases/tag/1.4.3
-- Related: #2061390
-
-* Wed Jan 26 2022 Jindrich Novy <jnovy@redhat.com> - 1.4.2-1
-- update to https://github.com/containers/crun/releases/tag/1.4.2
-- Related: #2001445
-
-* Fri Jan 14 2022 Jindrich Novy <jnovy@redhat.com> - 1.4.1-1
-- update to https://github.com/containers/crun/releases/tag/1.4.1
-- Related: #2001445
-
-* Wed Dec 22 2021 Jindrich Novy <jnovy@redhat.com> - 1.4-1
-- update to https://github.com/containers/crun/releases/tag/1.4
-- Related: #2001445
-
-* Mon Nov 08 2021 Jindrich Novy <jnovy@redhat.com> - 1.3-1
-- update to https://github.com/containers/crun/releases/tag/1.3
-- Related: #2001445
-
-* Mon Oct 11 2021 Jindrich Novy <jnovy@redhat.com> - 1.2-1
-- update to https://github.com/containers/crun/releases/tag/1.2
-- Related: #2001445
-
-* Mon Sep 27 2021 Jindrich Novy <jnovy@redhat.com> - 1.1-1
-- update to https://github.com/containers/crun/releases/tag/1.1
-- Related: #2001445
-
-* Thu Aug 26 2021 Jindrich Novy <jnovy@redhat.com> - 1.0-1
-- update to https://github.com/containers/crun/releases/tag/1.0
-- Related: #1934415
-
-* Fri Aug 06 2021 Jindrich Novy <jnovy@redhat.com> - 0.21-3
-- remove BR: criu-devel and leave it just for RHEL9
-- Related: #1934415
-
-* Fri Aug 06 2021 Jindrich Novy <jnovy@redhat.com> - 0.21-2
-- do not use versioned provide
-- BR: criu-devel
-- Related: #1934415
-
-* Tue Jul 27 2021 Jindrich Novy <jnovy@redhat.com> - 0.21-1
-- update to https://github.com/containers/crun/releases/tag/0.21
-- Related: #1934415
-
-* Thu Jun 10 2021 Jindrich Novy <jnovy@redhat.com> - 0.20.1-1
-- update to https://github.com/containers/crun/releases/tag/0.20.1
-- Related: #1934415
-
-* Wed Jun 02 2021 Jindrich Novy <jnovy@redhat.com> - 0.20-1
-- update to https://github.com/containers/crun/releases/tag/0.20
-- Related: #1934415
-
-* Mon Apr 26 2021 Jindrich Novy <jnovy@redhat.com> - 0.19.1-1
-- update to https://github.com/containers/crun/releases/tag/0.19.1
-- Related: #1934415
-
-* Wed Apr 07 2021 Jindrich Novy <jnovy@redhat.com> - 0.19-2
-- remove unused patch reference from spec
-- Related: #1934415
-
-* Tue Apr 06 2021 Jindrich Novy <jnovy@redhat.com> - 0.19-1
-- update to https://github.com/containers/crun/releases/tag/0.19
-- Related: #1934415
-
-* Fri Feb 19 2021 Jindrich Novy <jnovy@redhat.com> - 0.18-1
-- allow to build without glibc-static (thanks to Giuseppe Scrivano)
-- Related: #1883490
-
-* Fri Feb 19 2021 Jindrich Novy <jnovy@redhat.com> - 0.17-2
-- reverting back to 0.17 as there's no glibc-static in RHEL
-- Related: #1883490
-
-* Fri Feb 19 2021 Jindrich Novy <jnovy@redhat.com> - 0.18-1
-- update to https://github.com/containers/crun/releases/tag/0.18
-- Related: #1883490
-
-* Fri Jan 22 2021 Jindrich Novy <jnovy@redhat.com> - 0.17-1
-- update to https://github.com/containers/crun/releases/tag/0.17
-- Related: #1883490
-
-* Thu Dec 03 2020 Jindrich Novy <jnovy@redhat.com> - 0.16-2
-- exclude i686 because of build failures
-- Related: #1883490
-
-* Wed Nov 25 2020 Jindrich Novy <jnovy@redhat.com> - 0.16-1
-- update to https://github.com/containers/crun/releases/tag/0.16
-- Related: #1883490
-
-* Wed Nov 04 2020 Jindrich Novy <jnovy@redhat.com> - 0.15.1-1
-- update to https://github.com/containers/crun/releases/tag/0.15.1
-- Related: #1883490
-
-* Thu Oct 29 2020 Jindrich Novy <jnovy@redhat.com> - 0.15-2
-- synchronize with stream-container-tools-rhel8
-- Related: #1883490
-
-* Wed Oct 21 2020 Jindrich Novy <jnovy@redhat.com> - 0.15-1
-- synchronize with stream-container-tools-rhel8
-- Related: #1883490
-
-* Tue Aug 11 2020 Jindrich Novy <jnovy@redhat.com> - 0.14.1-2
-- use proper CFLAGS
-- Related: #1821193
-
-* Wed Jul 08 2020 Jindrich Novy <jnovy@redhat.com> - 0.14.1-1
-- update to https://github.com/containers/crun/releases/tag/v0.14.1
-- Related: #1821193
-
-* Thu Jul 02 2020 Jindrich Novy <jnovy@redhat.com> - 0.14-1
-- update to https://github.com/containers/crun/releases/tag/v0.14
-- Related: #1821193
-
-* Tue Jun 16 2020 Giuseppe Scrivano <gscrivan@redhat.com> - 0.13-1
-- initial import

sources

@@ -1 +0,0 @@
-SHA512 (crun-1.8.7.tar.gz) = a8210a56c3412d44239328f7fcdb9526c863b905cf292c992c6ae2c79b257da7c38f8825e65ab9f5f5260bb2fd8a19c0ad9c14dba81a4f2abf54765dca84dfde