runc: add CGO security build option

(cherry picked from commit d41500546fb8a067524de22860724b0fd7d163fd)

git-commit

@@ -1 +1 @@
-efce815f50e77075d10070d724aeec93660630a7
+3cd040ca87658befd016fb613b3e9e8ad6a528a6

patch/0133-runc-add-CGO-sercuity-build-options.patch

@@ -0,0 +1,27 @@
+From 70ec40e866f056f071e3df73e8f82608c9c1b741 Mon Sep 17 00:00:00 2001
+From: zhongjiawei <zhongjiawei1@huawei.com>
+Date: Thu, 22 Sep 2022 09:31:43 +0800
+Subject: [PATCH] runc: add CGO sercuity build options
+
+---
+ Makefile | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/Makefile b/Makefile
+index 94cf3f8..2f6bb17 100644
+--- a/Makefile
++++ b/Makefile
+@@ -45,8 +45,8 @@ LD_FLAGS='-w -buildid=none -tmpdir=/tmp/bep-runc -linkmode=external -extldflags=
+ static: $(SOURCES)
+ 	rm -rf /tmp/bep-runc && mkdir /tmp/bep-runc
+ 	CGO_ENABLED=1 \
+-	CGO_CFLAGS="-fstack-protector-strong -fPIE" \
+-	CGO_CPPFLAGS="-fstack-protector-strong -fPIE" \
++	CGO_CFLAGS="-fstack-protector-strong -fPIE -D_FORTIFY_SOURCE=2 -O2" \
++	CGO_CPPFLAGS="-fstack-protector-strong -fPIE -D_FORTIFY_SOURCE=2 -O2" \
+ 	CGO_LDFLAGS_ALLOW='-Wl,-z,relro,-z,now' \
+ 	CGO_LDFLAGS="-Wl,-z,relro,-z,now -Wl,-z,noexecstack" \
+ 	go build -buildmode=pie -tags "$(BUILDTAGS) cgo static_build" -ldflags '-extldflags=-static' -ldflags $(LD_FLAGS) -o runc .
+-- 
+2.30.0
+

runc-openeuler.spec

@@ -4,7 +4,7 @@
 
 Name: docker-runc
 Version: 1.0.0.rc3
-Release: 303
+Release: 304
 Summary: runc is a CLI tool for spawning and running containers according to the OCI specification.
 
 License: ASL 2.0
@@ -53,6 +53,12 @@ install -p -m 755 runc $RPM_BUILD_ROOT/%{_bindir}/runc
 %{_bindir}/runc
 
 %changelog
+* Thu Sep 22 2022 zhongjiawei<zhongjiawei1@huawei.com> - 1.0.0.rc3-304
+- Type:bugfix
+- CVE:NA
+- SUG:NA
+- DESC:add CGO security build option
+
 * Tue Aug 16 2022 zhongjiawei<zhongjiawei1@huawei.com> - 1.0.0.rc3-303
 - Type:bugfix
 - CVE:NA

series.conf

@@ -131,4 +131,5 @@ patch/0130-runc-fix-cgroup-info-print-error.patch
 patch/0128-runc-fix-CVE-2022-29162.patch
 patch/0131-runc-change-Umask-to-0022.patch
 patch/0132-runc-fix-systemd-cgroup-after-memory-type-changed.patch
+patch/0133-runc-add-CGO-sercuity-build-options.patch
 #end