From e2c989b7e172a30728da796bd2e30a4413ed0bae Mon Sep 17 00:00:00 2001 From: Aleksa Sarai Date: Wed, 4 Feb 2026 18:38:02 +0100 Subject: [PATCH] build: enable libpathrs by default libpathrs has better hardening against certain attacks (most notably on older kernels) so we should use it by default. This opens the door to us using cyphar.com/go-pathrs in the future in order to remove some of our internal/pathrs wrappers (that reimplement bits of libpathrs). Signed-off-by: Aleksa Sarai --- CHANGELOG.md | 7 +++++++ Makefile | 2 +- README.md | 2 +- 3 files changed, 9 insertions(+), 2 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 3f6c66946..12a2e3058 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -47,6 +47,12 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 `/proc/self/exe` sealing we introduced in runc [1.2.0][]. (#5141) ### Changed ### +- Our release binaries and default build configuration now use [libpathrs][] by + default, providiung better hardening against certain kinds of attacks. Users + of runc should not see any changes as a result of this, but pacakgers will + need to adjust their packaging accordingly. runc can still be built without + libpathrs (by building without the `libpathrs` build tag), but we currently + plan to make runc 1.6 *require* libpathrs. (#5103) - Previously we made an attempt to make our `runc.armhf` release binaries work with ARMv6 (which would allow runc to work on the original Raspberry Pi). Unfortunately, this has effectively always been broken (because we @@ -54,6 +60,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 it) and so we are now officially matching [the Debian definition of `armhf`][debian-armhf] (that is, ARMv7). (#5103) +[libpathrs]: https://github.com/cyphar/libpathrs [debian-armhf]: https://wiki.debian.org/ArmHardFloatPort ## [1.4.0] - 2025-11-27 diff --git a/Makefile b/Makefile index 0a00e6607..de5cc2e6a 100644 --- a/Makefile +++ b/Makefile @@ -12,7 +12,7 @@ GIT_BRANCH_CLEAN := $(shell echo $(GIT_BRANCH) | sed -e "s/[^[:alnum:]]/-/g") RUNC_IMAGE := runc_dev$(if $(GIT_BRANCH_CLEAN),:$(GIT_BRANCH_CLEAN)) PROJECT := github.com/opencontainers/runc EXTRA_BUILDTAGS := -BUILDTAGS := seccomp urfave_cli_no_docs +BUILDTAGS := seccomp urfave_cli_no_docs libpathrs BUILDTAGS += $(EXTRA_BUILDTAGS) COMMIT := $(shell git describe --dirty --long --always) diff --git a/README.md b/README.md index cf1df2369..84f6b9e9c 100644 --- a/README.md +++ b/README.md @@ -112,7 +112,7 @@ make EXTRA_BUILDTAGS="runc_nocriu" | Build Tag | Feature | Enabled by Default | Dependencies | |---------------|---------------------------------------|--------------------|---------------------| | `seccomp` | Syscall filtering using `libseccomp`. | yes | `libseccomp` | -| `libpathrs` | Use [`libpathrs`][] for path safety. | no | [`libpathrs`][] | +| `libpathrs` | Use [`libpathrs`][] for path safety. | yes | [`libpathrs`][] | | `runc_nocriu` | **Disables** runc checkpoint/restore. | no | `criu` | The following build tags were used earlier, but are now obsoleted: