0295e9602f
Fixes CVE-2022-29162 Minor security issue (which appears to not be exploitable) related to process capabilities. A bug was found in runc where runc exec --cap executed processes with ble Linux process capabilities, creating an atypical Linux environment. For more information, see GHSA-f3fp-gc8g-vw66 and CVE-2022-29162. runc spec no longer sets any inheritable capabilities in the created example OCI spec (config.json) file. https://github.com/opencontainers/runc/releases/tag/v1.1.2 Signed-off-by: Christian Stewart <christian@paral.in> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
27 lines
684 B
Makefile
27 lines
684 B
Makefile
################################################################################
|
|
#
|
|
# runc
|
|
#
|
|
################################################################################
|
|
|
|
RUNC_VERSION = 1.1.2
|
|
RUNC_SITE = $(call github,opencontainers,runc,v$(RUNC_VERSION))
|
|
RUNC_LICENSE = Apache-2.0, LGPL-2.1 (libseccomp)
|
|
RUNC_LICENSE_FILES = LICENSE
|
|
RUNC_CPE_ID_VENDOR = linuxfoundation
|
|
|
|
RUNC_LDFLAGS = -X main.version=$(RUNC_VERSION)
|
|
RUNC_TAGS = cgo static_build
|
|
|
|
ifeq ($(BR2_PACKAGE_LIBAPPARMOR),y)
|
|
RUNC_DEPENDENCIES += libapparmor
|
|
RUNC_TAGS += apparmor
|
|
endif
|
|
|
|
ifeq ($(BR2_PACKAGE_LIBSECCOMP),y)
|
|
RUNC_TAGS += seccomp
|
|
RUNC_DEPENDENCIES += libseccomp host-pkgconf
|
|
endif
|
|
|
|
$(eval $(golang-package))
|