From: Christian Stewart <hidden> Date: 2021-02-10 23:52:02
Security fixes:
- CVE-2021-21285 Prevent an invalid image from crashing docker daemon
- CVE-2021-21284 Lock down file permissions to prevent remapped root from accessing docker state
- Ensure AppArmor and SELinux profiles are applied when building with BuildKit
Signed-off-by: Christian Stewart <redacted>
---
package/docker-engine/docker-engine.hash | 2 +-
package/docker-engine/docker-engine.mk | 2 +-
2 files changed, 2 insertions(+), 2 deletions(-)
From: Peter Korsgaard <peter@korsgaard.com> Date: 2021-02-11 15:49:34
quoted
quoted
quoted
quoted
"Christian" == Christian Stewart [off-list ref] writes:
> https://github.com/opencontainers/runc/releases/tag/v1.0.0-rc93
Is this meant for master or next?
It is in the same series as security bumps, but I see the release notes
talks about a feature-rich release?
It also mentions the following:
For packagers the following changes have been made which will have impact on
your packaging of runc:
The "selinux" and "apparmor" buildtags have been removed, and now all runc
builds will have SELinux and AppArmor support enabled. Note that "seccomp"
is still optional (though we very highly recommend you enable it).
But I see no changes related to this?
--
Bye, Peter Korsgaard
From: Peter Korsgaard <peter@korsgaard.com> Date: 2021-02-11 15:52:34
quoted
quoted
quoted
quoted
"Christian" == Christian Stewart [off-list ref] writes:
> Security fixes:
> - CVE-2021-21285 Prevent an invalid image from crashing docker daemon
> - CVE-2021-21284 Lock down file permissions to prevent remapped root from accessing docker state
> - Ensure AppArmor and SELinux profiles are applied when building with BuildKit
> Signed-off-by: Christian Stewart [off-list ref]
Committed, thanks. For 2020.02.x / 2020.11.x I will instead bump to
19.03.15, which includes the same fixes.
--
Bye, Peter Korsgaard
From: Peter Korsgaard <peter@korsgaard.com> Date: 2021-02-11 15:52:42
quoted
quoted
quoted
quoted
"Christian" == Christian Stewart [off-list ref] writes:
> Client fixes:
> - Check contexts before importing them to reduce risk of extracted files escaping context store
> Signed-off-by: Christian Stewart [off-list ref]
Committed, thanks.
--
Bye, Peter Korsgaard
It is in the same series as security bumps, but I see the release notes
talks about a feature-rich release?
Runc is now on their 93rd release candidate. Now is not the time to
decide to stop at #92.
It also mentions the following:
For packagers the following changes have been made which will have impact on
your packaging of runc:
The "selinux" and "apparmor" buildtags have been removed, and now all runc
builds will have SELinux and AppArmor support enabled. Note that "seccomp"
is still optional (though we very highly recommend you enable it).
But I see no changes related to this?
I don't have seccomp enabled on my systems, and docker + runc is still
working as per this series.
Additionally, I see that there are still conditional build tags
"linux,cgo,seccomp" in the code, which exclude seccomp unless the
seccomp build tag is set. So I don't think that the note in the
release notes is accurate - you still need the "seccomp" build tag for
runc to have seccomp support.
So everything is fine to merge this to master as-is. (Tested as well).
Best regards,
Christian Stewart