mirror of
https://github.com/opencontainers/runc.git
synced 2026-07-11 06:03:57 +08:00
Aleksa Sarai
ed6b1693b8
Due to the sensitive nature of these fixes, it was not possible to submit these upstream and vendor the upstream library. Instead, this patch uses a fork of github.com/opencontainers/selinux, branched at commit opencontainers/selinux@879a755db5. In order to permit downstreams to build with this patched version, a snapshot of the forked version has been included in internal/third_party/selinux. Note that since we use "go mod vendor", the patched code is usable even without being "go get"-able. Once the embargo for this issue is lifted we can submit the patches upstream and switch back to a proper upstream go.mod entry. Also, this requires us to temporarily disable the CI job we have that disallows "replace" directives. Fixes: GHSA-cgrx-mc8f-2prm CVE-2025-52881 Signed-off-by: Aleksa Sarai <cyphar@cyphar.com>
40 lines
1.4 KiB
Modula-2
40 lines
1.4 KiB
Modula-2
module github.com/opencontainers/runc
|
|
|
|
go 1.24.0
|
|
|
|
require (
|
|
github.com/checkpoint-restore/go-criu/v7 v7.2.0
|
|
github.com/containerd/console v1.0.5
|
|
github.com/coreos/go-systemd/v22 v22.6.0
|
|
github.com/cyphar/filepath-securejoin v0.5.0
|
|
github.com/docker/go-units v0.5.0
|
|
github.com/godbus/dbus/v5 v5.1.0
|
|
github.com/moby/sys/capability v0.4.0
|
|
github.com/moby/sys/mountinfo v0.7.2
|
|
github.com/moby/sys/user v0.4.0
|
|
github.com/moby/sys/userns v0.1.0
|
|
github.com/mrunalp/fileutils v0.5.1
|
|
github.com/opencontainers/cgroups v0.0.5
|
|
github.com/opencontainers/runtime-spec v1.2.2-0.20250818071321-383cadbf08c0
|
|
github.com/opencontainers/selinux v1.12.0
|
|
github.com/seccomp/libseccomp-golang v0.11.1
|
|
github.com/sirupsen/logrus v1.9.3
|
|
github.com/urfave/cli v1.22.17
|
|
github.com/vishvananda/netlink v1.3.1
|
|
github.com/vishvananda/netns v0.0.5
|
|
golang.org/x/net v0.46.0
|
|
golang.org/x/sys v0.37.0
|
|
google.golang.org/protobuf v1.36.10
|
|
)
|
|
|
|
require (
|
|
github.com/cilium/ebpf v0.17.3 // indirect
|
|
github.com/cpuguy83/go-md2man/v2 v2.0.7 // indirect
|
|
github.com/russross/blackfriday/v2 v2.1.0 // indirect
|
|
)
|
|
|
|
// FIXME: This is only intended as a short-term solution to include a patch for
|
|
// CVE-2025-52881 in go-selinux without pushing the patches upstream. This
|
|
// should be removed as soon as possible after the embargo is lifted.
|
|
replace github.com/opencontainers/selinux => ./internal/third_party/selinux
|