8ebb77ac1d
Fixes the following security issues: - CVE-2019-19921: runc volume mount race condition with shared mounts - CVE-2019-16884: runc through 1.0.0-rc8, as used in Docker through 19.03.2-ce and other products, allows AppArmor restriction bypass because libcontainer/rootfs_linux.go incorrectly checks mount targets, and thus a malicious Docker image can mount over a /proc directory. For details, see the announcement: https://github.com/containerd/containerd/releases/tag/v1.2.12 containerd is now a separate CNCF sponsored project, and is no longer explicitly associated with docker/moby. Signed-off-by: Christian Stewart <christian@paral.in> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
41 lines
1.3 KiB
Makefile
41 lines
1.3 KiB
Makefile
################################################################################
|
|
#
|
|
# docker-containerd
|
|
#
|
|
################################################################################
|
|
|
|
DOCKER_CONTAINERD_VERSION = 1.2.12
|
|
DOCKER_CONTAINERD_SITE = $(call github,containerd,containerd,v$(DOCKER_CONTAINERD_VERSION))
|
|
DOCKER_CONTAINERD_LICENSE = Apache-2.0
|
|
DOCKER_CONTAINERD_LICENSE_FILES = LICENSE
|
|
|
|
DOCKER_CONTAINERD_WORKSPACE = vendor
|
|
|
|
DOCKER_CONTAINERD_LDFLAGS = \
|
|
-X github.com/docker/containerd.GitCommit=$(DOCKER_CONTAINERD_VERSION)
|
|
|
|
DOCKER_CONTAINERD_BUILD_TARGETS = cmd/ctr cmd/containerd cmd/containerd-shim
|
|
|
|
DOCKER_CONTAINERD_INSTALL_BINS = containerd containerd-shim
|
|
|
|
ifeq ($(BR2_PACKAGE_LIBSECCOMP),y)
|
|
DOCKER_CONTAINERD_DEPENDENCIES += libseccomp host-pkgconf
|
|
DOCKER_CONTAINERD_TAGS += seccomp
|
|
endif
|
|
|
|
ifeq ($(BR2_PACKAGE_DOCKER_CONTAINERD_DRIVER_BTRFS),y)
|
|
DOCKER_CONTAINERD_DEPENDENCIES += btrfs-progs
|
|
else
|
|
DOCKER_CONTAINERD_TAGS += no_btrfs
|
|
endif
|
|
|
|
define DOCKER_CONTAINERD_INSTALL_SYMLINKS
|
|
ln -fs runc $(TARGET_DIR)/usr/bin/docker-runc
|
|
ln -fs containerd-shim $(TARGET_DIR)/usr/bin/docker-containerd-shim
|
|
ln -fs containerd $(TARGET_DIR)/usr/bin/docker-containerd
|
|
endef
|
|
|
|
DOCKER_CONTAINERD_POST_INSTALL_TARGET_HOOKS += DOCKER_CONTAINERD_INSTALL_SYMLINKS
|
|
|
|
$(eval $(golang-package))
|