mirror of
https://github.com/opencontainers/runc.git
synced 2026-07-10 21:53:57 +08:00
Aleksa Sarai
ed6b1693b8
Due to the sensitive nature of these fixes, it was not possible to submit these upstream and vendor the upstream library. Instead, this patch uses a fork of github.com/opencontainers/selinux, branched at commit opencontainers/selinux@879a755db5. In order to permit downstreams to build with this patched version, a snapshot of the forked version has been included in internal/third_party/selinux. Note that since we use "go mod vendor", the patched code is usable even without being "go get"-able. Once the embargo for this issue is lifted we can submit the patches upstream and switch back to a proper upstream go.mod entry. Also, this requires us to temporarily disable the CI job we have that disallows "replace" directives. Fixes: GHSA-cgrx-mc8f-2prm CVE-2025-52881 Signed-off-by: Aleksa Sarai <cyphar@cyphar.com>
160 lines
2.2 KiB
Go
160 lines
2.2 KiB
Go
//go:build !linux
|
|
// +build !linux
|
|
|
|
package selinux
|
|
|
|
func attrPath(string) string {
|
|
return ""
|
|
}
|
|
|
|
func readConThreadSelf(string) (string, error) {
|
|
return "", nil
|
|
}
|
|
|
|
func writeConThreadSelf(string, string) error {
|
|
return nil
|
|
}
|
|
|
|
func setDisabled() {}
|
|
|
|
func getEnabled() bool {
|
|
return false
|
|
}
|
|
|
|
func classIndex(string) (int, error) {
|
|
return -1, nil
|
|
}
|
|
|
|
func setFileLabel(string, string) error {
|
|
return nil
|
|
}
|
|
|
|
func lSetFileLabel(string, string) error {
|
|
return nil
|
|
}
|
|
|
|
func fileLabel(string) (string, error) {
|
|
return "", nil
|
|
}
|
|
|
|
func lFileLabel(string) (string, error) {
|
|
return "", nil
|
|
}
|
|
|
|
func setFSCreateLabel(string) error {
|
|
return nil
|
|
}
|
|
|
|
func fsCreateLabel() (string, error) {
|
|
return "", nil
|
|
}
|
|
|
|
func currentLabel() (string, error) {
|
|
return "", nil
|
|
}
|
|
|
|
func pidLabel(int) (string, error) {
|
|
return "", nil
|
|
}
|
|
|
|
func execLabel() (string, error) {
|
|
return "", nil
|
|
}
|
|
|
|
func canonicalizeContext(string) (string, error) {
|
|
return "", nil
|
|
}
|
|
|
|
func computeCreateContext(string, string, string) (string, error) {
|
|
return "", nil
|
|
}
|
|
|
|
func calculateGlbLub(string, string) (string, error) {
|
|
return "", nil
|
|
}
|
|
|
|
func peerLabel(uintptr) (string, error) {
|
|
return "", nil
|
|
}
|
|
|
|
func setKeyLabel(string) error {
|
|
return nil
|
|
}
|
|
|
|
func keyLabel() (string, error) {
|
|
return "", nil
|
|
}
|
|
|
|
func (c Context) get() string {
|
|
return ""
|
|
}
|
|
|
|
func newContext(string) (Context, error) {
|
|
return Context{}, nil
|
|
}
|
|
|
|
func clearLabels() {
|
|
}
|
|
|
|
func reserveLabel(string) {
|
|
}
|
|
|
|
func isMLSEnabled() bool {
|
|
return false
|
|
}
|
|
|
|
func enforceMode() int {
|
|
return Disabled
|
|
}
|
|
|
|
func setEnforceMode(int) error {
|
|
return nil
|
|
}
|
|
|
|
func defaultEnforceMode() int {
|
|
return Disabled
|
|
}
|
|
|
|
func releaseLabel(string) {
|
|
}
|
|
|
|
func roFileLabel() string {
|
|
return ""
|
|
}
|
|
|
|
func kvmContainerLabels() (string, string) {
|
|
return "", ""
|
|
}
|
|
|
|
func initContainerLabels() (string, string) {
|
|
return "", ""
|
|
}
|
|
|
|
func containerLabels() (string, string) {
|
|
return "", ""
|
|
}
|
|
|
|
func securityCheckContext(string) error {
|
|
return nil
|
|
}
|
|
|
|
func copyLevel(string, string) (string, error) {
|
|
return "", nil
|
|
}
|
|
|
|
func chcon(string, string, bool) error {
|
|
return nil
|
|
}
|
|
|
|
func dupSecOpt(string) ([]string, error) {
|
|
return nil, nil
|
|
}
|
|
|
|
func getDefaultContextWithLevel(string, string, string) (string, error) {
|
|
return "", nil
|
|
}
|
|
|
|
func label(_ string) string {
|
|
return ""
|
|
}
|