packages/runc
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

!75 runc: change Umask to 0022 and fix systemd cgroup after memory type changed

Browse Source 
From: @zhong-jiawei-1 
Reviewed-by: @Vanient, @duguhaotian 
Signed-off-by: @duguhaotian
This commit is contained in:
openeuler-ci-bot 2022-08-16 12:55:48 +00:00 committed by Gitee
commit bc11b02472
No known key found for this signature in database
GPG Key ID: 173E9B9CA92EEF8F
4 changed files with 102 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

57
patch/0131-runc-change-Umask-to-0022.patch Normal file
View File

@ -0,0 +1,57 @@
From f53243d64903d660e45a186dc11fa0ab13c39621 Mon Sep 17 00:00:00 2001
From: zhongjiawei <zhongjiawei1@huawei.com>
Date: Tue, 9 Aug 2022 18:29:53 +0800
Subject: [PATCH] runc: change Umask to 0022
---
libcontainer/rootfs_linux.go | 7 +------
libcontainer/setns_init_linux.go | 8 --------
2 files changed, 1 insertion(+), 14 deletions(-)
diff --git a/libcontainer/rootfs_linux.go b/libcontainer/rootfs_linux.go
index b005429..a1bd7e7 100644
--- a/libcontainer/rootfs_linux.go
+++ b/libcontainer/rootfs_linux.go
@@ -140,12 +140,7 @@ func finalizeRootfs(config *configs.Config) (err error) {
}
}
- umask := libcontainerUtils.SearchLabels(config.Labels, "native.umask")
- if umask == "normal" {
- syscall.Umask(0022)
- } else {
- syscall.Umask(0027)
- }
+ syscall.Umask(0022)
return nil
}
diff --git a/libcontainer/setns_init_linux.go b/libcontainer/setns_init_linux.go
index 1f7ec98..e6dfbba 100644
--- a/libcontainer/setns_init_linux.go
+++ b/libcontainer/setns_init_linux.go
@@ -11,7 +11,6 @@ import (
"github.com/opencontainers/runc/libcontainer/keys"
"github.com/opencontainers/runc/libcontainer/seccomp"
"github.com/opencontainers/runc/libcontainer/system"
- "github.com/opencontainers/runc/libcontainer/utils"
"github.com/opencontainers/selinux/go-selinux/label"
)
@@ -43,13 +42,6 @@ func (l *linuxSetnsInit) Init() error {
return err
}
}
- // set exec process umask to 0027 or 0022 according to container's config
- umask := utils.SearchLabels(l.config.Config.Labels, "native.umask")
- if umask == "normal" {
- syscall.Umask(0022)
- } else {
- syscall.Umask(0027)
- }
if l.config.NoNewPrivileges {
if err := system.Prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0); err != nil {
return err
--
2.30.0

30
patch/0132-runc-fix-systemd-cgroup-after-memory-type-changed.patch Normal file
View File

@ -0,0 +1,30 @@
From 22fab107bdb684d3e7651804b5f6ba3c432652ca Mon Sep 17 00:00:00 2001
From: xiadanni <xiadanni1@huawei.com>
Date: Mon, 9 Aug 2021 10:16:47 +0800
Subject: [PATCH] runc:fix systemd cgroup after memory type changed
upstream from
https://github.com/opencontainers/runc/pull/1573/commits/acaf6897f566c2f592a488c83dafcddec41524be
Signed-off-by: Qiang Huang <h.huangqiang@huawei.com>
Signed-off-by: xiadanni <xiadanni1@huawei.com>
---
libcontainer/cgroups/systemd/apply_systemd.go | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/libcontainer/cgroups/systemd/apply_systemd.go b/libcontainer/cgroups/systemd/apply_systemd.go
index 0411b72..a08a9a9 100644
--- a/libcontainer/cgroups/systemd/apply_systemd.go
+++ b/libcontainer/cgroups/systemd/apply_systemd.go
@@ -261,7 +261,7 @@ func (m *Manager) Apply(pid int) error {
if c.Resources.Memory != 0 {
properties = append(properties,
- newProp("MemoryLimit", c.Resources.Memory))
+ newProp("MemoryLimit", uint64(c.Resources.Memory)))
}
if c.Resources.CpuShares != 0 {
--
2.27.0

14
runc-openeuler.spec
View File

@ -4,7 +4,7 @@
Name: docker-runc
Version: 1.0.0.rc3
Release: 301
Release: 303
Summary: runc is a CLI tool for spawning and running containers according to the OCI specification.
License: ASL 2.0
@ -53,6 +53,18 @@ install -p -m 755 runc $RPM_BUILD_ROOT/%{_bindir}/runc
%{_bindir}/runc
%changelog
* Tue Aug 16 2022 zhongjiawei<zhongjiawei1@huawei.com> - 1.0.0.rc3-303
- Type:bugfix
- CVE:NA
- SUG:NA
- DESC:fix systemd cgroup after memory type changed
* Tue Aug 9 2022 zhongjiawei<zhongjiawei1@huawei.com> - 1.0.0.rc3-302
- Type:bugfix
- CVE:NA
- SUG:NA
- DESC:change Uamsk to 0022
* Tue Aug 09 2022 zhongjiawei<zhongjiawei1@huawei.com> - 1.0.0.rc3-301
- Type:bugfix
- CVE:NA

2
series.conf
View File

@ -129,4 +129,6 @@ patch/0128-runc-optimize-nsexec-logging.patch
patch/0129-runc-improve-log-for-debugging.patch
patch/0130-runc-fix-cgroup-info-print-error.patch
patch/0128-runc-fix-CVE-2022-29162.patch
patch/0131-runc-change-Umask-to-0022.patch
patch/0132-runc-fix-systemd-cgroup-after-memory-type-changed.patch
#end