Stay Connected:

ELBA-2021-9315

ELBA-2021-9315 - runc bug fix update

Type:BUG
Severity:NA
Release Date:2021-06-18

Description


skopeo
[1:0.1.37-3.0.1]
- add oracle registry into the conf file [Orabug: 29845934, 30302344]
- delivering fix for [Orabug: 29874238] by Nikita Gerasimov

[1:0.1.37-3]
- rebase to 0.1.37 for RHEL7u7

[1:0.1.37-1]
- bump to v0.1.37

[1:0.1.36-2]
- Resolves: #1693961 - /usr/share/rhel/secrets is 755

[1:0.1.36-1]
- Resolves: #1717921 - rebase to v0.1.36

[1:0.1.35-2.git404c5bd]
- rebase

[1:0.1.31-8.gitb0b750d]
- Resolves: #1667289 - install /usr/share/containers/seccomp.json

[1:0.1.31-7.gitb0b750d]
- change obsoletes conditional for skopeo-containers

[1:0.1.31-6.gitb0b750d]
- properly obsolete 1:0.1.31-1

[1:0.1.31-5.gitb0b750d]
- macros for centos

[1:0.1.31-4.gitb0b750d]
- rebase

[0.1.31-2.gite3034e1]
- add statx to seccomp.json to containers-config
- Change skopeo-containers to containers-common

[0.1.31-1.dev.gitae64ff7]
- Resolves: #1599980, #1599224
- bump to v0.1.31-dev
- built commit ae64ff7

[0.1.30-14.gitca3bff6]
- Add devicemapper support

[1:0.1.29-3.git7add6fc]
- move registries.conf to skopeo-containers from atomic

[0.1.29-2.git]
- bump to 0.1.29-1
- Updated containers/image
docker-archive generates docker legacy compatible images
Do not create subdirectories for layers with no configs
Ensure the layer IDs in legacy docker/tarfile metadata are unique
docker-archive: repeated layers are symlinked in the tar file
sysregistries: remove all trailing slashes
Improve docker/* error messages
Fix failure to make auth directory
Create a new slice in Schema1.UpdateLayerInfos
Drop unused storageImageDestination.{image,systemContext}
Load a *storage.Image only once in storageImageSource
Support gzip for docker-archive files
Remove .tar extension from blob and config file names
ostree, src: support copy of compressed layers
ostree: re-pull layer if it misses uncompressed_digest|uncompressed_size
image: fix docker schema v1 -> OCI conversion
Add /etc/containers/certs.d as default certs directory

[1:0.1.29-1.dev,gitb08350d]
- Resolves: #1543707

[1:0.1.28-1.git0270e56]
- rebased to 0.1.28

[1:0.1.27-3.dev.git14245f2]
- rebased to 0.1.27-3.dev.git14245f2

[1:0.1.26-2.dev.git2e8377a]
- bump changelog

[0.1.25-2.git2e8377a7]
- Add manifest type conversion to skopeo copy
- User can select from 3 manifest types: oci, v2s1, or v2s2
- e.g skopeo copy --format v2s1 --compress-blobs docker-archive:alp.tar dir:my-directory

[0.1.25-2.git7fd6f66b]
- Force storage.conf to default to overlay

[0.1.25-1.git7fd6f66b]
- Fix CVE in tar-split
- copy: add shared blob directory support for OCI sources/destinations
- Aligning Docker version between containers/image and skopeo
- Update image-tools, and remove the duplicate Sirupsen/logrus vendor
- makefile: use -buildmode=pie

[1:0.1.24-8.git28d4e08a]
- Add /usr/share/containers/mounts.conf

[1:0.1.24-5.gitdd2c3e3]
- built commit dd2c3e3a8e33b849f3625f4f56fa229c76448629

[1:0.1.24-3.dev.git28d4e08]
- add rhel subscription secrets date to skopeo-containers
- skopeo-containers conflicts with docker >= 2:1.13.1-61

[1:0.1.24-2.dev.git28d4e08]
- Update container/storage.conf and containers-storage.conf man page
- Default override to true so it is consistent with RHEL.

[1:0.1.24-1.dev.git28d4e08]
- Resolves: #1499274
- built commit 28d4e08

[1:0.1.23-1.git1bbd87f]
- Resolves: #1455575, #1478416, #1387217
- bump to v0.1.23

[1:0.1.20-2.1.gite802625]
- bump release to 2.1
- built commit e802625b7cb7f4af9ab77bd2be9eb441ff2f28a2

[1:0.1.20-1.1.gite802625]
- built commit e802625b7cb7f4af9ab77bd2be9eb441ff2f28a2

[1:0.1.19-1.1.git62e3747]
- bump to v0.1.19
- built commit 62e3747

[1:0.1.18-1.2]
- build for all available arches (previous build didn't do this)

[1:0.1.18-1.1]
- rebuilt for all arches on extras 7.4
- enable debuginfo package

[1:0.1.18-1]
- btrfs-progs-devel, device-mapper-devel added to build dependencies
- built commit b08008c

[1:0.1.17-1]
- Resolves: #1404274 - ship upstream v0.1.17 release
- built commit b3b4e2b

[1:0.1.17-0.7.git1f655f3]
- runtime dep was missing epoch value, added now

[1:0.1.17-0.6.git1f655f3]
- Resolves: #1396531 - list skopeo runtime requirements correctly

[1:0.1.17-0.5]
- built commit 1f655f3

[1:0.1.17-0.4]
- Resolves: #1386386 - skopeo-containers conflicts with atomic <= 1.13.1-1
- use correct bug number, #1385584 was for atomic

[1:0.1.17-0.3]
- Resolves: #1385584 - skopeo-containers conflicts with atomic <= 1.13.1-1

[1:0.1.17-0.2]
- obsoletes atomic, fixed dependencies
- %{_sysconfdir}/containers/ owned only by skopeo-containers

[1:0.1.17-0.1]
- rebase, skopeo-containers subpackage added

[1:0.1.14-0.6]
- built mtrmac/integrate-all-the-things commit d830391

[1:0.1.14-0.5]
- built mtrmac/integrate-all-the-things commit 85e4551

[1:0.1.14-0.4]
- built mtrmac/integrate-all-the-things commit 02b9f8b

[1:0.1.14-0.3]
- built mtrmac/integrate-all-the-things commit b3fcce0

[1:0.1.14-0.2.dev]
- own the whole bash-completion dir (https://fedoraproject.org/wiki/Packaging:Guidelines)

[1:0.1.14-0.1.dev]
- update to 0.1.14-dev

[1:0.1.13-8]
- bump release, srpm issues in previous build

[1:0.1.13-7]
- build with golang >= 1.6.2

[1:0.1.13-6]
- Bump Epoch to 1 since that's what skopeo had when it was an atomic
subpackage

[0.1.13-5]
- include go-srpm-macros and compiler(go-compiler) in fedora conditionals
- define %gobuild if not already
- add patch to build with older version of golang

[0.1.13-4]
- update to v0.1.12

[0.1.12-3]
- fix go build source path

[0.1.12-2]
- update to v0.1.12

[0.1.11-1]
- update to v0.1.11

[0.1.10-1]
- update to v0.1.10
- change runcom -> projectatomic

[0.1.9-1]
- update to v0.1.9

[0.1.8-1]
- update to v0.1.8

[0.1.4-2]
- https://fedoraproject.org/wiki/Changes/golang1.6

[0.1.4]
- First package for Fedora

runc
[1.0.0-1.rc95]
- Addresses CVE-2021-30465

runc
[1.0.0-92.rc92]
- Add epoch value of 2 to allow upgrade to 1.0.0-92.rc92 from 1.0.0-93.rc93.

[1.0.0-92.rc92]
- Build for https://github.com/opencontainers/runc/releases/tag/v1.0.0-rc92

container-selinux
[2:2.119.2-1.911c772]
- fix #1811759

[2:2.119.1-2.c57a6f9]
- update to 2.119.1 RHEL7 branch
- Related: RHELPLAN-26239

[2:2.107-3]
- use 2.107 in RHEL7u7
- add build.sh script

[2:2.107-2]
- Resolves: #1626215

[2:2.107-1]
- bump to v2.107

[2:2.99-1]
- built commit b13d03b

[2:2.95-2]
- rebase

[2:2.84-2]
- rebase

[2.77-1]
- backported fixes from upstream

[2.76-1]
- Allow containers to use fuse file systems by default
- Allow containers to sendto dgram socket of container runtimes
- Needed to run container runtimes in notify socket unit files.

[2.74-1]
- Allow containers to setexec themselves

[2:2.73-3]
- tweak macro for fedora - applies to rhel8 as well

[2:2.73-2]
- moved changelog entries:
- Define spc_t as a container_domain, so that container_runtime will transition
to spc_t even when setup with nosuid.
- Allow container_runtimes to setattr on callers fifo_files
- Fix restorecon to not error on missing directory

[2.69-3]
- Make sure we pull in the latest selinux-policy

[2.69-2]
- Add map support to container-selinux for RHEL 7.5
- Dontudit attempts to write to kernel_sysctl_t

[2.68-1]
- Add label for /var/lib/origin
- Add customizable_file_t to customizable_types

[2.67-1]
- Add policy for container_logreader_t

[2.66-1]
- Allow dnsmasq to dbus chat with spc_t

[2.64-1]
- Allow containers to create all socket classes

[2.62-1]
- Label overlay directories under /var/lib/containers/ correctly

[2.61-1]
- Allow spc_t to load kernel modules from inside of container

[2.60-1]
- Allow containers to list cgroup directories
- Transition for unconfined_service_t to container_runtime_t when executing container_runtime_exec_t.

[2.58-2]
- Run restorecon /usr/bin/podman in postinstall

[2.58-1]
- Add labels to allow podman to be run from a systemd unit file

[2.57-1]
- Set the version of SELinux policy required to the latest to fix build issues.

[2.56-1]
- Allow container_runtime_t to transition to spc_t over unlabeled files

[2.55-1]
Allow iptables to read container state
Dontaudit attempts from containers to write to /proc/self
Allow spc_t to change attributes on container_runtime_t fifo files

[2.52-1]
- Add better support for writing custom selinux policy for customer container domains.

[2.51-1]
- Allow shell_exec_t as a container_runtime_t entrypoint

[2.50-1]
- Allow bin_t as a container_runtime_t entrypoint

[2.49-1]
- Add support for MLS running container runtimes
- Add missing allow rules for running systemd in a container

[2.48-1]
- Update policy to match master branch
- Remove typebounds and replace with nnp_transition and nosuid_transition calls

[2.41-1]
- Add support to nnp_transition for container domains
- Eliminates need for typebounds.

[2.40-1]
- Allow container_runtime_t to use user ttys
- Fixes bounds check for container_t

[2.39-1]
- Allow container runtimes to use interited terminals. This helps
satisfy the bounds check of container_t versus container_runtime_t.

[2.38-1]
- Allow container runtimes to mmap container_file_t devices
- Add labeling for rhel push plugin

[2.37-1]
- Allow containers to use inherited ttys
- Allow ostree to handle labels under /var/lib/containers/ostree

[2.36-1]
- Allow containers to relabelto/from all file types to container_file_t

[2.35-1]
- Allow container to map chr_files labeled container_file_t

[2.34-1]
- Dontaudit container processes getattr on kernel file systems

[2.33-1]
- Allow containers to read /etc/resolv.conf and /etc/hosts if volume
- mounted into container.

[2.32-1]
- Make sure users creating content in /var/lib with right labels

[2.31-1]
- Allow the container runtime to dbus chat with dnsmasq
- add dontaudit rules for container trying to write to /proc

[2.29-1]
- Add support for lxcd
- Add support for labeling of tmpfs storage created within a container.

[2.28-1]
- Allow a container to umount a container_file_t filesystem

[2.27-1]
- Allow container runtimes to work with the netfilter sockets
- Allow container_file_t to be an entrypoint for VM's
- Allow spc_t domains to transition to svirt_t

[2.24-1]
- Make sure container_runtime_t has all access of container_t

[2.23-1]
- Allow container runtimes to create sockets in tmp dirs

[2.22-1]
- Add additonal support for crio labeling.

[2.21-3]
- Fixup spec file conditionals

[2:2.21-2]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild

[2.21-1]
- Allow containers to execmod on container_share_t files.

[2.20-2]
- Relabel runc and crio executables

[2.20-1]
- Allow container processes to getsession

[2:2.19-2.1]
- update release tag to isolate from 7.3

[2:2.19-1]
- Fix mcs transition problem on stdin/stdout/stderr
- Add labels for CRI-O
- Allow containers to use tunnel sockets

[2:2.15-1.1]
- Resolves: #1451289
- rebase to v2.15
- built @origin/RHEL-1.12 commit 583ca40

[2:2.10-2.1]
- Make sure we have a late enough version of policycoreutils

[2:2.10-1]
- Update to the latest container-selinux patch from upstream
- Label files under /usr/libexec/lxc as container_runtime_exec_t
- Give container_t access to XFRM sockets
- Allow spc_t to dbus chat with init system
- Allow containers to read cgroup configuration mounted into a container

[2:2.9-4]
- Resolves: #1425574
- built commit 79a6d70

[2:2.9-3]
- Resolves: #1420591
- built @origin/RHEL-1.12 commit 8f876c4

[2:2.9-2]
- built @origin/RHEL-1.12 commit 33cb78b

[2:2.8-2]
-

[2:2.7-1]
- built origin/RHEL-1.12 commit 21dd37b

[2:2.4-2]
- correct version-release in changelog entries

[2:2.4-1]
- Add typebounds statement for container_t from container_runtime_t
- We should only label runc not runc*

[2:2.3-1]
- Fix labeling on /usr/bin/runc.*
- Add sandbox_net_domain access to container.te
- Remove containers ability to look at /etc content

[2:2.2-4]
- use upstream's RHEL-1.12 branch, commit 56c32da for CentOS 7

[2:2.2-3]
- properly disable docker module in %post

[2:2.2-2]
- depend on selinux-policy-targeted
- relabel docker-latest* files as well

[2:2.2-1]
- bump to v2.2
- additional labeling for ocid

[2:2.0-2]
- install policy at level 200
- From: Dan Walsh

[2:2.0-1]
- Resolves: #1406517 - bump to v2.0 (first upload to Fedora as a
standalone package)
- include projectatomic/RHEL-1.12 branch commit for building on centos/rhel

[2:1.12.4-29]
- new package (separated from docker)




Updated Packages


Release/ArchitectureFilenameMD5sumSuperseded By Advisory
Oracle Linux 7 (aarch64) container-selinux-2.119.2-1.911c772.el7_8.src.rpm093e12b3d9fabe33ea59a11da1000955-
runc-1.0.0-1.rc95.el7.src.rpm39627ea0856ff4f5f738a4376a70f7aa-
runc-1.0.0-92.rc92.el7.src.rpm6b40f65212e42df764bd8d1a71d61052ELSA-2021-9298
skopeo-0.1.37-3.0.1.el7.src.rpmab04779689308b5c5d0ce50388df69f3-
container-selinux-2.119.2-1.911c772.el7_8.noarch.rpme693e4428ca154c10913404394ca9dc4-
containers-common-0.1.37-3.0.1.el7.aarch64.rpm9d4be4ac6d4af3c996e01124d0312c64-
runc-1.0.0-1.rc95.el7.aarch64.rpm9c5495a25fcf6b7cd3da016c6b636c06-
runc-1.0.0-92.rc92.el7.aarch64.rpmb83d1379d8509abd94a2582282f8ea39ELSA-2021-9298
Oracle Linux 7 (x86_64) container-selinux-2.119.2-1.911c772.el7_8.src.rpm093e12b3d9fabe33ea59a11da1000955-
runc-1.0.0-1.rc95.el7.src.rpm39627ea0856ff4f5f738a4376a70f7aa-
runc-1.0.0-92.rc92.el7.src.rpm6b40f65212e42df764bd8d1a71d61052ELSA-2021-9298
skopeo-0.1.37-3.0.1.el7.src.rpmab04779689308b5c5d0ce50388df69f3-
container-selinux-2.119.2-1.911c772.el7_8.noarch.rpme693e4428ca154c10913404394ca9dc4-
containers-common-0.1.37-3.0.1.el7.x86_64.rpma5dc23f39ad548e772a09d1328586091-
runc-1.0.0-1.rc95.el7.x86_64.rpmde1de92f75b8f485ecc0fe366631131b-
runc-1.0.0-92.rc92.el7.x86_64.rpma7c521cc1d97337ec3b610456fda2f34ELSA-2021-9298



This page is generated automatically and has not been checked for errors or omissions. For clarification or corrections please contact the Oracle Linux ULN team

software.hardware.complete
Subscribe | Careers | Contact Us | Legal Notices | Terms of Use | Your Privacy Rights