From 205d75d6cd21c8f8a6825e37cddea58a8d9001ab Mon Sep 17 00:00:00 2001 From: eabdullin Date: Thu, 15 May 2025 15:21:37 +0000 Subject: [PATCH] import CS oci-seccomp-bpf-hook-1.2.11-1.el9 --- .gitignore | 2 +- .oci-seccomp-bpf-hook.metadata | 1 - SOURCES/build-fix.patch | 12 -- SPECS/oci-seccomp-bpf-hook.spec | 168 -------------------- oci-seccomp-bpf-hook.spec | 262 ++++++++++++++++++++++++++++++++ sources | 1 + 6 files changed, 264 insertions(+), 182 deletions(-) delete mode 100644 .oci-seccomp-bpf-hook.metadata delete mode 100644 SOURCES/build-fix.patch delete mode 100644 SPECS/oci-seccomp-bpf-hook.spec create mode 100644 oci-seccomp-bpf-hook.spec create mode 100644 sources diff --git a/.gitignore b/.gitignore index 67e59d9..8472a9f 100644 --- a/.gitignore +++ b/.gitignore @@ -1 +1 @@ -SOURCES/v1.2.0.tar.gz +v1.2.11.tar.gz diff --git a/.oci-seccomp-bpf-hook.metadata b/.oci-seccomp-bpf-hook.metadata deleted file mode 100644 index 0de06b3..0000000 --- a/.oci-seccomp-bpf-hook.metadata +++ /dev/null @@ -1 +0,0 @@ -87e5a6bd76c56b81e779438c531f31f14a6c9b7e SOURCES/v1.2.0.tar.gz diff --git a/SOURCES/build-fix.patch b/SOURCES/build-fix.patch deleted file mode 100644 index 676352a..0000000 --- a/SOURCES/build-fix.patch +++ /dev/null @@ -1,12 +0,0 @@ -diff -up oci-seccomp-bpf-hook-1.2.0/vendor/github.com/iovisor/gobpf/bcc/module.go.orig oci-seccomp-bpf-hook-1.2.0/vendor/github.com/iovisor/gobpf/bcc/module.go ---- oci-seccomp-bpf-hook-1.2.0/vendor/github.com/iovisor/gobpf/bcc/module.go.orig 2021-05-21 14:15:44.936127448 +0200 -+++ oci-seccomp-bpf-hook-1.2.0/vendor/github.com/iovisor/gobpf/bcc/module.go 2021-05-21 14:16:03.459454988 +0200 -@@ -258,7 +258,7 @@ func (bpf *Module) attachProbe(evName st - func (bpf *Module) attachUProbe(evName string, attachType uint32, path string, addr uint64, fd, pid int) error { - evNameCS := C.CString(evName) - binaryPathCS := C.CString(path) -- res, err := C.bpf_attach_uprobe(C.int(fd), attachType, evNameCS, binaryPathCS, (C.uint64_t)(addr), (C.pid_t)(pid)) -+ res, err := C.bpf_attach_uprobe(C.int(fd), attachType, evNameCS, binaryPathCS, (C.uint64_t)(addr), (C.pid_t)(pid), 0) - C.free(unsafe.Pointer(evNameCS)) - C.free(unsafe.Pointer(binaryPathCS)) - diff --git a/SPECS/oci-seccomp-bpf-hook.spec b/SPECS/oci-seccomp-bpf-hook.spec deleted file mode 100644 index 9cff865..0000000 --- a/SPECS/oci-seccomp-bpf-hook.spec +++ /dev/null @@ -1,168 +0,0 @@ -%global with_check 0 - -%global _find_debuginfo_dwz_opts %{nil} -%global _dwz_low_mem_die_limit 0 - -%if 0%{?rhel} > 7 && ! 0%{?fedora} -%define gobuild(o:) \ -go build -buildmode pie -compiler gc -tags="rpm_crashtraceback libtrust_openssl ${BUILDTAGS:-}" -ldflags "${LDFLAGS:-} -linkmode=external -compressdwarf=false -B 0x$(head -c20 /dev/urandom|od -An -tx1|tr -d ' \\n') -extldflags '%__global_ldflags'" -a -v %{?**}; -%else -%if ! 0%{?gobuild:1} -%define gobuild(o:) GO111MODULE=off go build -buildmode pie -compiler gc -tags="rpm_crashtraceback ${BUILDTAGS:-}" -ldflags "${LDFLAGS:-} -linkmode=external -B 0x$(head -c20 /dev/urandom|od -An -tx1|tr -d ' \\n') -extldflags '-Wl,-z,relro -Wl,-z,now -specs=/usr/lib/rpm/redhat/redhat-hardened-ld '" -a -v %{?**}; -%endif -%endif - -%global provider github -%global provider_tld com -%global project containers -%global repo oci-seccomp-bpf-hook -# https://github.com/containers/oci-seccomp-bpf-hook -%global provider_prefix %{provider}.%{provider_tld}/%{project}/%{repo} -%global import_path %{provider_prefix} -%global git0 https://%{provider}.%{provider_tld}/%{project}/%{repo} - -# https://fedoraproject.org/wiki/PackagingDrafts/Go#Go_Language_Architectures -ExclusiveArch: %{go_arches} - -Name: oci-seccomp-bpf-hook -Version: 1.2.0 -Release: 3%{?dist} -Summary: OCI Hook to generate seccomp json files based on EBF syscalls used by container -License: ASL 2.0 -URL: %{git0} -Source0: %{git0}/archive/v%{version}.tar.gz -Patch0: build-fix.patch -BuildRequires: golang -BuildRequires: go-md2man -BuildRequires: glib2-devel -BuildRequires: glibc-devel -BuildRequires: bcc-devel -BuildRequires: git -BuildRequires: gpgme-devel -BuildRequires: libseccomp-devel -BuildRequires: make -Requires: crun >= 0.17 -Enhances: podman -Enhances: cri-o - -%description -%{summary} -%{repo} provides a library for applications looking to use -the Container Pod concept popularized by Kubernetes. - -%prep -%autosetup -Sgit -sed -i '/$(MAKE) -C docs install/d' Makefile -sed -i 's/HOOK_BIN_DIR/\%{_usr}\/libexec\/oci\/hooks.d/' %{name}.json -sed -i '/$(HOOK_DIR)\/%{name}.json/d' Makefile - -%build -export GO111MODULE=off -export GOPATH=$(pwd):$(pwd)/_build -export CGO_CFLAGS="%{optflags} -D_GNU_SOURCE -D_LARGEFILE_SOURCE -D_LARGEFILE64_SOURCE -D_FILE_OFFSET_BITS=64" - -mkdir _build -pushd _build -mkdir -p src/%{provider}.%{provider_tld}/%{project} -ln -s ../../../../ src/%{import_path} -popd -ln -s vendor src - -export GOPATH=$(pwd)/_build:$(pwd) -export LDFLAGS="-X main.version=%{version}" -%gobuild -o bin/%{name} %{import_path} - -pushd docs -go-md2man -in %{name}.md -out %{name}.1 -popd - -%install -%{__make} DESTDIR=%{buildroot} PREFIX=%{_prefix} install-nobuild -%{__make} DESTDIR=%{buildroot} PREFIX=%{_prefix} GOMD2MAN=go-md2man -C docs install-nobuild - -%check -%if 0%{?with_check} -# Since we aren't packaging up the vendor directory we need to link -# back to it somehow. Hack it up so that we can add the vendor -# directory from BUILD dir as a gopath to be searched when executing -# tests from the BUILDROOT dir. -ln -s ./ ./vendor/src # ./vendor/src -> ./vendor - -export GOPATH=%{buildroot}/%{gopath}:$(pwd)/vendor:%{gopath} - -%if ! 0%{?gotest:1} -%global gotest go test -%endif - -%gotest %{import_path}/src/%{name} -%endif - -#define license tag if not already defined -%{!?_licensedir:%global license %doc} - -%files -%license LICENSE -%doc README.md -%dir %{_libexecdir}/oci/hooks.d -%{_libexecdir}/oci/hooks.d/%{name} -%{_datadir}/containers/oci/hooks.d/%{name}.json -%{_mandir}/man1/%{name}.1* - -%changelog -* Fri May 21 2021 Jindrich Novy - 1.2.0-3 -- actually apply the build fix patch -- Related: #1934415 - -* Fri May 21 2021 Jindrich Novy - 1.2.0-2 -- resolve build issue -- Related: #1934415 - -* Mon Feb 22 2021 Jindrich Novy - 1.2.0-1 -- revert back to 1.2.0 - build issues -- Related: #1883490 - -* Fri Feb 19 2021 Jindrich Novy - 1.2.1-1 -- update to - https://github.com/containers/oci-seccomp-bpf-hook/releases/tag/v1.2.1 -- require crun >= 0.17 -- Related: #1883490 - -* Thu Jan 28 2021 Jindrich Novy - 1.2.0-1 -- revert back to 1.2.0 due to build issues -- Related: #1883490 - -* Thu Jan 28 2021 Jindrich Novy - 1.2.1-1 -- update to https://github.com/containers/oci-seccomp-bpf-hook/releases/tag/v1.2.1 -- Related: #1883490 - -* Tue Dec 08 2020 Jindrich Novy - 1.2.0-2 -- sync with RHEL8 devel branch -- Related: #1883490 - -* Wed Oct 21 2020 Jindrich Novy - 1.2.0-1 -- synchronize with stream-container-tools-rhel8 -- Related: #1883490 - -* Tue Aug 11 2020 Jindrich Novy - 1.1.2-3 -- propagate proper CFLAGS to CGO_CFLAGS to assure code hardening and optimization -- Related: #1821193 - -* Thu Jul 23 2020 Lokesh Mandvekar - 1.1.2-2 -- Resolves: #1857606 - -* Fri Jul 17 2020 Jindrich Novy - 1.1.2-1 -- update to https://github.com/containers/oci-seccomp-bpf-hook/releases/tag/v1.1.2 -- Related: #1821193 - -* Thu Jun 18 2020 Jindrich Novy - 1.1.1-1 -- update to https://github.com/containers/oci-seccomp-bpf-hook/releases/tag/v1.1.1 -- Related: #1821193 - -* Tue May 12 2020 Jindrich Novy - 1.1.0-2 -- exclude i686 arch as bcc, the build dependency is not built - for it -- Related: #1821193 - -* Tue May 12 2020 Jindrich Novy - 1.1.0-1 -- initial build for container-tools-rhel8 -- Related: #1821193 diff --git a/oci-seccomp-bpf-hook.spec b/oci-seccomp-bpf-hook.spec new file mode 100644 index 0000000..12b2a7c --- /dev/null +++ b/oci-seccomp-bpf-hook.spec @@ -0,0 +1,262 @@ +%global with_debug 1 + +%if 0%{?with_debug} +%global _find_debuginfo_dwz_opts %{nil} +%global _dwz_low_mem_die_limit 0 +%else +%global debug_package %{nil} +%endif + +# use the same arch definitions as present in the bcc package +ExclusiveArch: x86_64 %{power64} aarch64 s390x armv7hl + +Name: oci-seccomp-bpf-hook +Version: 1.2.11 +License: Apache-2.0 and BSD-2-Clause and BSD-3-Clause and ISC and MIT +Release: 1%{?dist} +ExclusiveArch: %{golang_arches_future} +Summary: OCI Hook to generate seccomp json files based on EBF syscalls used by container +URL: https://github.com/containers/oci-seccomp-bpf-hook +# Tarball fetched from upstream +Source0: https://github.com/containers/oci-seccomp-bpf-hook/archive/v%{version}.tar.gz +BuildRequires: golang +BuildRequires: go-md2man +BuildRequires: go-rpm-macros +BuildRequires: glib2-devel +BuildRequires: glibc-devel +BuildRequires: bcc-devel +BuildRequires: git +BuildRequires: gpgme-devel +BuildRequires: libseccomp-devel +BuildRequires: make +Requires: bcc +Enhances: podman +Enhances: cri-o +# vendored libraries +# awk '{print "Provides: bundled(golang("$1")) = "$2}' go.mod | sort | uniq | sed -e 's/-/_/g' -e '/bundled(golang())/d' -e '/bundled(golang(go\|module\|replace\|require))/d' +Provides: bundled(golang(github.com/iovisor/gobpf)) = v0.2.0 +Provides: bundled(golang(github.com/opencontainers/runtime_spec)) = v1.0.3_0.20200728170252_4d89ac9fbff6 +Provides: bundled(golang(github.com/seccomp/containers_golang)) = v0.6.0 +Provides: bundled(golang(github.com/seccomp/libseccomp_golang)) = v0.9.1 +Provides: bundled(golang(github.com/sirupsen/logrus)) = v1.8.1 +Provides: bundled(golang(github.com/stretchr/testify)) = v1.4.0 + +%description +%{summary} +%{name} provides a library for applications looking to use +the Container Pod concept popularized by Kubernetes. + +%package tests +Summary: Tests for %{name} + +Requires: %{name} = %{version}-%{release} +Requires: podman + +%description tests +%{summary} + +This subpackage contains system tests for %{name}. It's only meant for gating +tests. End user / customer usage cases are not supported. + +%prep +%autosetup -Sgit -n %{name}-%{version} +sed -i 's;HOOK_BIN_DIR;%{_libexecdir}/oci/hooks.d;' %{name}.json +sed -i '/$(HOOK_DIR)\/%{name}.json/d' Makefile + +%build +%set_build_flags +export CGO_CFLAGS=$CFLAGS +# These extra flags present in $CFLAGS have been skipped for now as they break the build +CGO_CFLAGS=$(echo $CGO_CFLAGS | sed 's/-flto=auto//g') +CGO_CFLAGS=$(echo $CGO_CFLAGS | sed 's/-Wp,D_GLIBCXX_ASSERTIONS//g') +CGO_CFLAGS=$(echo $CGO_CFLAGS | sed 's/-specs=\/usr\/lib\/rpm\/redhat\/redhat-annobin-cc1//g') + +%ifarch x86_64 +export CGO_CFLAGS+=" -m64 -mtune=generic -fcf-protection=full" +%endif + +export GO111MODULE=off +export GOPATH=$(pwd):$(pwd)/_build + +mkdir _build +cd _build +mkdir -p src/github.com/containers/ +ln -s ../../../../ src/github.com/containers/oci-seccomp-bpf-hook +cd .. +ln -s vendor src + +export GOPATH=$(pwd)/_build:$(pwd) +export LDFLAGS="-X main.version=%{version}" +%gobuild -o bin/%{name} github.com/containers/oci-seccomp-bpf-hook + +cd docs +go-md2man -in %{name}.md -out %{name}.1 +cd .. + +%install +%{__make} DESTDIR=%{buildroot} PREFIX=%{_prefix} install-nobuild +%{__make} DESTDIR=%{buildroot} PREFIX=%{_prefix} GOMD2MAN=go-md2man -C docs install-nobuild + +install -d -p %{buildroot}/%{_datadir}/%{name}/test/system +cp -pav test/. %{buildroot}/%{_datadir}/%{name}/test/system + +%check +%if 0%{?with_check} && 0%{?with_unit_test} && 0%{?with_devel} +# Since we aren't packaging up the vendor directory we need to link +# back to it somehow. Hack it up so that we can add the vendor +# directory from BUILD dir as a gopath to be searched when executing +# tests from the BUILDROOT dir. +ln -s ./ ./vendor/src # ./vendor/src -> ./vendor + +export GOPATH=%{buildroot}/%{gopath}:$(pwd)/vendor:%{gopath} + +%if ! 0%{?gotest:1} +%global gotest go test +%endif + +%gotest github.com/containers/oci-seccomp-bpf-hook/src/%{name} +%endif + +#define license tag if not already defined +%{!?_licensedir:%global license %doc} + +%files +%license LICENSE +%doc README.md +%dir %{_libexecdir}/oci/hooks.d +%{_libexecdir}/oci/hooks.d/%{name} +%{_datadir}/containers/oci/hooks.d/%{name}.json +%{_mandir}/man1/%{name}.1* + +%files tests +%license LICENSE +%{_datadir}/%{name}/test + +%changelog +* Wed Apr 09 2025 Jindrich Novy - 1.2.11-1 +- update to https://github.com/containers/oci-seccomp-bpf-hook/releases/tag/v1.2.11 +- simplify spec +- Resolves: RHEL-86603 + +* Wed Dec 04 2024 Jindrich Novy - 1.2.10-3 +- rebuild +- Resolves: RHEL-69918 + +* Thu Aug 15 2024 Jindrich Novy - 1.2.10-2 +- rebuild +- Resolves: RHEL-35939 + +* Fri Oct 20 2023 Jindrich Novy - 1.2.10-1 +- update to https://github.com/containers/oci-seccomp-bpf-hook/releases/tag/v1.2.10 +- Related: RHEL-2112 + +* Wed Apr 19 2023 Jindrich Novy - 1.2.9-1 +- update to https://github.com/containers/oci-seccomp-bpf-hook/releases/tag/v1.2.9 +- Related: #2176063 + +* Tue Oct 18 2022 Jindrich Novy - 1.2.8-1 +- update to https://github.com/containers/oci-seccomp-bpf-hook/releases/tag/v1.2.8 +- Related: #2124478 + +* Tue Jul 12 2022 Jindrich Novy - 1.2.6-1 +- update to https://github.com/containers/oci-seccomp-bpf-hook/releases/tag/v1.2.6 +- Related: #2061316 + +* Wed May 11 2022 Jindrich Novy - 1.2.5-2 +- BuildRequires: /usr/bin/go-md2man +- Related: #2061316 + +* Wed Mar 16 2022 Jindrich Novy - 1.2.5-1 +- update to https://github.com/containers/oci-seccomp-bpf-hook/releases/tag/v1.2.5 +- Related: #2061316 + +* Fri Oct 01 2021 Jindrich Novy - 1.2.3-5 +- perform only sanity/installability tests for now +- Related: #2000051 + +* Wed Sep 29 2021 Jindrich Novy - 1.2.3-4 +- add gating.yaml +- Related: #2000051 + +* Mon Aug 09 2021 Mohan Boddu - 1.2.3-3 +- Rebuilt for IMA sigs, glibc 2.34, aarch64 flags + Related: rhbz#1991688 + +* Tue Jun 22 2021 Mohan Boddu - 1.2.3-2 +- Rebuilt for RHEL 9 BETA for openssl 3.0 + Related: rhbz#1971065 + +* Mon Jun 14 2021 Jindrich Novy - 1.2.3-1 +- convert crun dependency to a conflict +- Related: #1970747 + +* Fri Apr 16 2021 Mohan Boddu - 1.2.1-2 +- Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 + +* Fri Feb 19 2021 Jindrich Novy - 1.2.1-1 +- update to + https://github.com/containers/oci-seccomp-bpf-hook/releases/tag/v1.2.1 +- require crun >= 0.17 + +* Thu Jan 28 2021 Jindrich Novy - 1.2.0-6 +- revert back to 1.2.0 due to build issues + +* Thu Jan 28 2021 Jindrich Novy - 1.2.1-1 +- update to + https://github.com/containers/oci-seccomp-bpf-hook/releases/tag/v1.2.1 + +* Tue Dec 08 2020 Jindrich Novy - 1.2.0-5 +- use go_arches macro + +* Fri Oct 02 2020 Jindrich Novy - 1.2.0-4 +- use the same arch definitions as present in the bcc package + +* Fri Oct 02 2020 Jindrich Novy - 1.2.0-3 +- exclude also armv7hl arch as bcc is not built there + +* Wed Sep 30 2020 Jindrich Novy - 1.2.0-2 +- fix spec file to accommodate the new upstream release + +* Wed Sep 30 2020 Jindrich Novy - 1.2.0-1 +- update to + https://github.com/containers/oci-seccomp-bpf-hook/releases/tag/v1.2.0 + +* Sat Aug 01 2020 Fedora Release Engineering - 1.1.1-3 +- Second attempt - Rebuilt for + https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild + +* Tue Jul 28 2020 Fedora Release Engineering - 1.1.1-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild + +* Fri Jul 17 2020 Jindrich Novy - 1.1.1-1 +- update to + https://github.com/containers/oci-seccomp-bpf-hook/releases/tag/v1.1.1 + +* Fri Jul 17 2020 Jindrich Novy - 1.1.0-2 +- switch to mainline releases + +* Tue May 19 2020 Lokesh Mandvekar - 1.1.0-1.1.git05a82a1 +- bump version +- reuse Makefile targets + +* Mon Feb 17 2020 Lokesh Mandvekar - 0.0.1-0.6.gitba7bbb16 +- Resolves: #1799105 - solve ftbfs and build latest upstream commit + +* Wed Jan 29 2020 Fedora Release Engineering - 0.0.1-0.5.git3baa603a +- Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild + +* Tue Nov 05 2019 Jindrich Novy - 0.0.1-0.4.git3baa603a +- limit arches to only those supported by bcc so that this can be built + +* Mon Nov 04 2019 Jindrich Novy - 0.0.1-0.3.git3baa603a +- fix the license - should be ASL 2.0 +- use %%gobuild + +* Mon Nov 04 2019 Jindrich Novy - 0.0.1-0.2.git3baa603a +- pull in golang deps as BR + +* Mon Sep 23 2019 Jindrich Novy - 0.0.1-0.1.git3baa603a +- fix spec file and build + +* Sun Sep 22 2019 Dan Walsh - 0.0.1 +- Initial Version diff --git a/sources b/sources new file mode 100644 index 0000000..0f21d6f --- /dev/null +++ b/sources @@ -0,0 +1 @@ +SHA512 (v1.2.11.tar.gz) = de52232add2d001b6cee891beb5f2c989c70bc6792892f6b7881b5e58c3f3a8402953635ada08bff297fb4868b78fe22e17fa18235d835569e78ea3e1b30b59d