build: enable libpathrs by default

libpathrs has better hardening against certain attacks (most notably on
older kernels) so we should use it by default. This opens the door to
us using cyphar.com/go-pathrs in the future in order to remove some of
our internal/pathrs wrappers (that reimplement bits of libpathrs).

Signed-off-by: Aleksa Sarai <cyphar@cyphar.com>

CHANGELOG.md

@@ -47,6 +47,12 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
   `/proc/self/exe` sealing we introduced in runc [1.2.0][]. (#5141)
 
 ### Changed ###
+- Our release binaries and default build configuration now use [libpathrs][] by
+  default, providiung better hardening against certain kinds of attacks. Users
+  of runc should not see any changes as a result of this, but pacakgers will
+  need to adjust their packaging accordingly. runc can still be built without
+  libpathrs (by building without the `libpathrs` build tag), but we currently
+  plan to make runc 1.6 *require* libpathrs. (#5103)
 - Previously we made an attempt to make our `runc.armhf` release binaries work
   with ARMv6 (which would allow runc to work on the original Raspberry Pi).
   Unfortunately, this has effectively always been broken (because we
@@ -54,6 +60,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
   it) and so we are now officially matching [the Debian definition of `armhf`][debian-armhf]
   (that is, ARMv7). (#5103)
 
+[libpathrs]: https://github.com/cyphar/libpathrs
 [debian-armhf]: https://wiki.debian.org/ArmHardFloatPort
 
 ## [1.4.0] - 2025-11-27

Makefile

@@ -12,7 +12,7 @@ GIT_BRANCH_CLEAN := $(shell echo $(GIT_BRANCH) | sed -e "s/[^[:alnum:]]/-/g")
 RUNC_IMAGE := runc_dev$(if $(GIT_BRANCH_CLEAN),:$(GIT_BRANCH_CLEAN))
 PROJECT := github.com/opencontainers/runc
 EXTRA_BUILDTAGS :=
-BUILDTAGS := seccomp urfave_cli_no_docs
+BUILDTAGS := seccomp urfave_cli_no_docs libpathrs
 BUILDTAGS += $(EXTRA_BUILDTAGS)
 
 COMMIT := $(shell git describe --dirty --long --always)

README.md

@@ -112,7 +112,7 @@ make EXTRA_BUILDTAGS="runc_nocriu"
 | Build Tag     | Feature                               | Enabled by Default | Dependencies        |
 |---------------|---------------------------------------|--------------------|---------------------|
 | `seccomp`     | Syscall filtering using `libseccomp`. | yes                | `libseccomp`        |
-| `libpathrs`   | Use [`libpathrs`][] for path safety.  | no                 | [`libpathrs`][]     |
+| `libpathrs`   | Use [`libpathrs`][] for path safety.  | yes                | [`libpathrs`][]     |
 | `runc_nocriu` | **Disables** runc checkpoint/restore. | no                 | `criu`              |
 
 The following build tags were used earlier, but are now obsoleted: