!248 [sync] PR-245: runc：check cmd exist

From: @openeuler-sync-bot 
Reviewed-by: @zhangsong234 
Signed-off-by: @zhangsong234

git-commit

@@ -1 +1 @@
-8dfee68b9de75bc3ed4f74ee58e9f9cff7dcb00a
+3af9b6470b9bdac1d1e6e881e8f89963b6965519

patch/0052-runc-check-cmd-exist.patch

@@ -0,0 +1,36 @@
+From 032f0a78d6f4ba49a48ca1ae3d53e6dc8726ff1f Mon Sep 17 00:00:00 2001
+From: zhongjiawei <zhongjiawei1@huawei.com>
+Date: Tue, 6 Feb 2024 11:20:48 +0800
+Subject: [PATCH] runc:check cmd exist
+
+---
+ libcontainer/setns_init_linux.go | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/libcontainer/setns_init_linux.go b/libcontainer/setns_init_linux.go
+index 1eea851..f1dcab6 100644
+--- a/libcontainer/setns_init_linux.go
++++ b/libcontainer/setns_init_linux.go
+@@ -4,6 +4,7 @@ import (
+ 	"errors"
+ 	"fmt"
+ 	"os"
++	"os/exec"
+ 	"strconv"
+ 
+ 	"github.com/opencontainers/selinux/go-selinux"
+@@ -86,6 +87,11 @@ func (l *linuxSetnsInit) Init() error {
+ 	if err := finalizeNamespace(l.config); err != nil {
+ 		return err
+ 	}
++	// Check for the arg early to make sure it exists.
++	_, err := exec.LookPath(l.config.Args[0])
++	if err != nil {
++		return err
++	}
+ 	if err := apparmor.ApplyProfile(l.config.AppArmorProfile); err != nil {
+ 		return err
+ 	}
+-- 
+2.33.0
+

runc.spec

@@ -54,6 +54,12 @@ install -p -m 755 runc $RPM_BUILD_ROOT/%{_bindir}/runc
 %{_bindir}/runc
 
 %changelog
+* Tue Feb 06 2024 zhongjiawei<zhongjiawei1@huawei.com> - 1.1.3-24
+- Type:bugfix
+- CVE:NA
+- SUG:NA
+- DESC:check cmd exist
+
 * Thu Feb 01 2024 zhongjiawei<zhongjiawei1@huawei.com> - 1.1.3-23
 - Type:CVE
 - CVE:CVE-2024-21626

series.conf

@@ -49,3 +49,4 @@ patch/0048-runc-Fix-undefined-behavior.patch
 patch/0049-runc-nsexec-Check-for-errors-in-write_log.patch
 patch/0050-runc-increase-the-number-of-cgroup-deletion-retries.patch
 patch/0051-runc-fix-CVE-2024-21626.patch
+patch/0052-runc-check-cmd-exist.patch