mirror/runc
1
0
Fork 0
mirror of https://github.com/opencontainers/runc.git synced 2026-07-11 06:03:57 +08:00
Code Issues Packages Projects Releases Wiki Activity
8,120 Commits 7 Branches 82 Tags
main
Commit Graph

28 Commits

Author SHA1 Message Date
dependabot[bot] 9ffc42622a build(deps): bump github.com/opencontainers/selinux 
Bumps [github.com/opencontainers/selinux](https://github.com/opencontainers/selinux) from 1.14.1 to 1.15.1.
- [Release notes](https://github.com/opencontainers/selinux/releases)
- [Commits](https://github.com/opencontainers/selinux/compare/v1.14.1...v1.15.1)

---
updated-dependencies:
- dependency-name: github.com/opencontainers/selinux
  dependency-version: 1.15.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-06-03 22:17:11 +00:00
dependabot[bot] a8c5fcbc7e build(deps): bump github.com/opencontainers/selinux 
Bumps [github.com/opencontainers/selinux](https://github.com/opencontainers/selinux) from 1.13.1 to 1.14.1.
- [Release notes](https://github.com/opencontainers/selinux/releases)
- [Commits](https://github.com/opencontainers/selinux/compare/v1.13.1...v1.14.1)

---
updated-dependencies:
- dependency-name: github.com/opencontainers/selinux
  dependency-version: 1.14.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-05-13 21:31:07 +08:00
Aleksa Sarai 96f1962f91 deps: update to github.com/opencontainers/selinux@v0.13.0 
This new version includes the fixes for CVE-2025-52881, so we can remove
the internal/third_party copy of the library we added in commit
ed6b1693b8 ("selinux: use safe procfs API for labels") as well as the
"replace" directive in go.mod (which is problematic for "go get"
installs).

Fixes: ed6b1693b8 ("selinux: use safe procfs API for labels")
Signed-off-by: Aleksa Sarai <cyphar@cyphar.com>
 2025-11-08 02:14:38 +11:00
Aleksa Sarai ed6b1693b8 selinux: use safe procfs API for labels 
Due to the sensitive nature of these fixes, it was not possible to
submit these upstream and vendor the upstream library. Instead, this
patch uses a fork of github.com/opencontainers/selinux, branched at
commit opencontainers/selinux@879a755db5.

In order to permit downstreams to build with this patched version, a
snapshot of the forked version has been included in
internal/third_party/selinux. Note that since we use "go mod vendor",
the patched code is usable even without being "go get"-able. Once the
embargo for this issue is lifted we can submit the patches upstream and
switch back to a proper upstream go.mod entry.

Also, this requires us to temporarily disable the CI job we have that
disallows "replace" directives.

Fixes: GHSA-cgrx-mc8f-2prm CVE-2025-52881
Signed-off-by: Aleksa Sarai <cyphar@cyphar.com>
 2025-11-01 21:24:06 +11:00
dependabot[bot] bac338256c build(deps): bump github.com/opencontainers/selinux 
Bumps [github.com/opencontainers/selinux](https://github.com/opencontainers/selinux) from 1.11.1 to 1.12.0.
- [Release notes](https://github.com/opencontainers/selinux/releases)
- [Commits](https://github.com/opencontainers/selinux/compare/v1.11.1...v1.12.0)

---
updated-dependencies:
- dependency-name: github.com/opencontainers/selinux
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
 2025-03-24 04:56:16 +00:00
dependabot[bot] f20f273aff build(deps): bump github.com/opencontainers/selinux 
Bumps [github.com/opencontainers/selinux](https://github.com/opencontainers/selinux) from 1.11.0 to 1.11.1.
- [Release notes](https://github.com/opencontainers/selinux/releases)
- [Commits](https://github.com/opencontainers/selinux/compare/v1.11.0...v1.11.1)

---
updated-dependencies:
- dependency-name: github.com/opencontainers/selinux
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2024-10-23 04:20:54 +00:00
dependabot[bot] bc8d6e3b1f build(deps): bump github.com/opencontainers/selinux 
Bumps [github.com/opencontainers/selinux](https://github.com/opencontainers/selinux) from 1.10.2 to 1.11.0.
- [Release notes](https://github.com/opencontainers/selinux/releases)
- [Commits](https://github.com/opencontainers/selinux/compare/v1.10.2...v1.11.0)

---
updated-dependencies:
- dependency-name: github.com/opencontainers/selinux
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
 2023-02-10 00:34:56 +00:00
dependabot[bot] da9126f788 build(deps): bump github.com/opencontainers/selinux 
Bumps [github.com/opencontainers/selinux](https://github.com/opencontainers/selinux) from 1.10.1 to 1.10.2.
- [Release notes](https://github.com/opencontainers/selinux/releases)
- [Commits](https://github.com/opencontainers/selinux/compare/v1.10.1...v1.10.2)

---
updated-dependencies:
- dependency-name: github.com/opencontainers/selinux
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2022-09-29 04:09:47 +00:00
dependabot[bot] d77f898ff5 build(deps): bump github.com/opencontainers/selinux 
Bumps [github.com/opencontainers/selinux](https://github.com/opencontainers/selinux) from 1.10.0 to 1.10.1.
- [Release notes](https://github.com/opencontainers/selinux/releases)
- [Commits](https://github.com/opencontainers/selinux/compare/v1.10.0...v1.10.1)

---
updated-dependencies:
- dependency-name: github.com/opencontainers/selinux
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2022-03-30 04:16:27 +00:00
dependabot[bot] e9ed200031 build(deps): bump github.com/opencontainers/selinux from 1.9.1 to 1.10.0 
Bumps [github.com/opencontainers/selinux](https://github.com/opencontainers/selinux) from 1.9.1 to 1.10.0.
- [Release notes](https://github.com/opencontainers/selinux/releases)
- [Commits](https://github.com/opencontainers/selinux/compare/v1.9.1...v1.10.0)

---
updated-dependencies:
- dependency-name: github.com/opencontainers/selinux
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
 2021-11-22 04:21:12 +00:00
dependabot[bot] 6eba68deae build(deps): bump github.com/opencontainers/selinux from 1.8.5 to 1.9.1 
Bumps [github.com/opencontainers/selinux](https://github.com/opencontainers/selinux) from 1.8.5 to 1.9.1.
- [Release notes](https://github.com/opencontainers/selinux/releases)
- [Commits](https://github.com/opencontainers/selinux/compare/v1.8.5...v1.9.1)

---
updated-dependencies:
- dependency-name: github.com/opencontainers/selinux
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
 2021-10-07 04:21:41 +00:00
dependabot[bot] 622acd24fb build(deps): bump github.com/opencontainers/selinux from 1.8.4 to 1.8.5 
Bumps [github.com/opencontainers/selinux](https://github.com/opencontainers/selinux) from 1.8.4 to 1.8.5.
- [Release notes](https://github.com/opencontainers/selinux/releases)
- [Commits](https://github.com/opencontainers/selinux/compare/v1.8.4...v1.8.5)

---
updated-dependencies:
- dependency-name: github.com/opencontainers/selinux
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2021-09-10 04:22:23 +00:00
dependabot[bot] bda1bd7a2f build(deps): bump github.com/opencontainers/selinux from 1.8.3 to 1.8.4 
Bumps [github.com/opencontainers/selinux](https://github.com/opencontainers/selinux) from 1.8.3 to 1.8.4.
- [Release notes](https://github.com/opencontainers/selinux/releases)
- [Commits](https://github.com/opencontainers/selinux/compare/v1.8.3...v1.8.4)

---
updated-dependencies:
- dependency-name: github.com/opencontainers/selinux
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2021-08-10 04:22:14 +00:00
dependabot[bot] fc99ab7e65 build(deps): bump github.com/opencontainers/selinux from 1.8.2 to 1.8.3 
Bumps [github.com/opencontainers/selinux](https://github.com/opencontainers/selinux) from 1.8.2 to 1.8.3.
- [Release notes](https://github.com/opencontainers/selinux/releases)
- [Commits](https://github.com/opencontainers/selinux/compare/v1.8.2...v1.8.3)

---
updated-dependencies:
- dependency-name: github.com/opencontainers/selinux
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2021-08-03 04:21:49 +00:00
Kir Kolyshkin 65cf0e61fb Bump selinux to v1.8.2 
This is to include willf/bitset@v1.1.11 ->
bits-and-blooms/bitset@v1.2.0.

Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
 2021-06-02 16:27:27 -07:00
dependabot[bot] 9e964dfc38 build(deps): bump github.com/opencontainers/selinux from 1.8.0 to 1.8.1 
Bumps [github.com/opencontainers/selinux](https://github.com/opencontainers/selinux) from 1.8.0 to 1.8.1.
- [Release notes](https://github.com/opencontainers/selinux/releases)
- [Commits](https://github.com/opencontainers/selinux/compare/v1.8.0...v1.8.1)

---
updated-dependencies:
- dependency-name: github.com/opencontainers/selinux
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2021-06-02 06:49:52 +00:00
Akihiro Suda cb26930680 remove "selinux" build tag (Always compile SELinux support) 
The build tag was removed in go-selinux v1.8.0: https://github.com/opencontainers/selinux/pull/132

Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
 2020-12-16 17:41:11 +09:00
John Hwang 5935296367 Update go.mod 
Signed-off-by: John Hwang <john.f.hwang@gmail.com>
 2020-07-30 05:28:39 -07:00
Sebastiaan van Stijn b48bbdd08d vendor: opencontainers/selinux v1.5.1, update deprecated uses 
full diff: https://github.com/opencontainers/selinux/v1.4.0...v1.5.1

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
 2020-05-05 15:53:40 +02:00
Akihiro Suda dfc1b0cd51 update vendor 
Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
 2020-03-28 04:22:06 +09:00
Odin Ugedal 69e8fb2a74 Add support for GO Modules 
This removes vndr, and swiches to native Go Modules instead. All modules
are kept on the old version.

Keeps the vendor/ dir, so everything is backwards compatible.

Signed-off-by: Odin Ugedal <odin@ugedal.com>
 2020-03-07 09:29:29 +01:00
Sebastiaan van Stijn d8953334bb vendor: update opencontainers/selinux v1.3.3 
full diff: https://github.com/opencontainers/selinux/compare/v1.3.1...v1.3.3

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
 2020-03-02 12:41:07 +01:00
Sebastiaan van Stijn c295a6339c vendor: update opencontainers/selinux v1.3.1 
full diff: https://github.com/opencontainers/selinux/compare/5215b1806f52b1fcc2070a8826c542c9d33cd3cf...v1.3.1

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
 2020-03-02 12:41:01 +01:00
Aleksa Sarai 9aef504415 vendor: update github.com/opencontainers/selinux 
This is a bump to v1.3.0, plus the necessary CVE-2019-16884 mitigation.

Signed-off-by: Aleksa Sarai <asarai@suse.de>
 2019-09-30 00:36:59 +10:00
Daniel J Walsh 8362cd02c0 Vendor in latest selinux code for keycreate errors 
Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
 2019-04-24 08:41:56 -04:00
Daniel J Walsh dcf994b4f8 Fix SELinux failures on disabled SELinux Machines 
On some machines when setting the SELinux key labels to "", we are seeing
failures that cause runc to fail.  Even if SELinux is disabled.

This check will ignore callers calling SELinux Set*Label functions with ""
when SELinux is disabled.

Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
 2019-04-02 10:27:27 -04:00
Daniel J Walsh cd96170c10 Need to setup labeling of kernel keyrings. 
Work is ongoing in the kernel to support different kernel
keyrings per user namespace.  We want to allow SELinux to manage
kernel keyrings inside of the container.

Currently when runc creates the kernel keyring it gets the label which runc is
running with ususally `container_runtime_t`, with this change the kernel keyring
will be labeled with the container process label container_t:s0:C1,c2.

Container running as container_t:s0:c1,c2 can manage keyrings with the same label.

This change required a revendoring or the SELinux go bindings.

github.com/opencontainers/selinux.

Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
 2019-03-13 17:57:30 -04:00
Qiang Huang 5e7b48f7c0 Use opencontainers/selinux package 
It's splitted as a separate project.

Signed-off-by: Qiang Huang <h.huangqiang@huawei.com>
 2017-03-23 08:21:19 +08:00