Skip to content

[release-1.29] Bump runc up to 1.2.9 for CVE-2025-52881, CVE-2025-31133 and CVE-2025-52565 #6538

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Open
cevich wants to merge 32 commits into
base: release-1.29
Choose a base branch
from
Open

[release-1.29] Bump runc up to 1.2.9 for CVE-2025-52881, CVE-2025-31133 and CVE-2025-52565 #6538

cevich wants to merge 32 commits into from
+626,111 −182,179

Conversation

@cevich
Copy link
Member

@cevich cevich commented Nov 25, 2025 •
edited
Loading

What type of PR is this?

/kind other

What this PR does / why we need it:

Backport PR #6484 & #6511

How to verify it

CI + Manual

Which issue(s) this PR fixes:

None

Special notes for your reviewer:

The commits in this PR were created with the assistance of AI, based on the source #6520. When reviewing please pay special attention to the following:

  1. Vendor directory consistency:

    • Vendor directory was completely regenerated using make vendor-in-container after each go.mod change
    • Never manually edited, ensuring consistency with go.mod and go.sum
    • Backport change: Same process as source branch - vendor directory was regenerated after dependency updates to ensure consistency.

  2. All compilation verified:

    • Project compiles successfully with make after every commit
    • All compilation errors encountered during backport were resolved and ammended to the commit.

  3. "Disable lint checking"

    • This check fails on the branch even w/o any changes.
    • In CI the problem is difficult to diagnose as no output is provided,
      rather the process is simply killed.
    • Backport change: This commit was manually created, it does not exist on the
      source PRs.

  4. "Bump runc to v1.2.8 - CVE-2025-52881" and subsequent commits include extensive .Get() method calls:

    • run_common.go: Added .Get() calls for defaultConfig.Containers.DNSServers.Get(), DNSSearches.Get(), and DNSOptions.Get()
    • run_linux.go: Added .Get() call for defaultContainerConfig.Containers.DefaultUlimits.Get()
    • pkg/cli/common.go: Added .Get() calls for defaultContainerConfig.Containers.Volumes, Devices, DNSSearches, DNSServers, and DNSOptions
    • imagebuildah/executor.go: Added .Get() calls for defaultContainerConfig.Containers.Devices and Volumes
    • cmd/buildah/from.go: Added .Get() calls for defaultContainerConfig.Containers.DefaultUlimits and Devices
    • cmd/buildah/main.go: Added .Get() call for defaultContainerConfig.Engine.Env
    • Reason: The containers/common package changed attributedstring.Slice types to require explicit .Get() method calls to convert to []string before use.

  5. "run: handle relabeling bind mounts ourselves" - SELinux relabeling changes:

    • Added relabel() function in run_common.go that wraps label.Relabel() with error handling for ENOTSUP cases
    • Modified run_linux.go to detect and handle z and Z mount flags before passing mounts to the runtime, removing these flags from mount options after relabeling
    • Backport change: The source branch had similar logic, but the relabel() function was added as a helper to centralize the relabeling logic.

  6. "vendor: switch to moby/sys/capability" - Capability library migration:

    • Switched from github.com/syndtr/gocapability to github.com/moby/sys/capability in go.mod
    • Updated all imports and changed capability.List() to capability.ListKnown()
    • Backport change: Applied identically to the source branch. No adaptations were needed as the capability handling code structure is consistent between release-1.29 and release-1.33.

  7. SELinux API updates - Direct selinux package usage:

    • Backport change: Applied identically to the source branch. The duplicate import removal was necessary to resolve compilation errors during the backport.

  8. "Don't set ambient capabilities" - Ambient capability handling:

    • Modified chroot/run_linux.go to set ambient capabilities to empty array {} instead of using spec.Process.Capabilities.Ambient
    • Backport change: The source branch also modified cmd/buildah/unshare.go in the debugCapabilities function, but this was skipped during backport because the debugCapabilities function does not exist in the release-1.29 branch. Only the chroot/run_linux.go changes were applied.

  9. "Integration tests: run git daemon on a random-but-bind()able port" and "Add a dummy 'runtime' that just dumps its config file" - New test infrastructure:

    • Backport change: Applied identically to the source branch. The test infrastructure additions were straightforward and required no adaptations.

  10. "runUsingRuntime: use named constants for runtime states" - Runtime state constants:

    • Backport change: Applied identically to the source branch. The constants are available in the same specs package version used by release-1.29.

  11. "Bump Buildah to v1.29.6" - Version and changelog updates:

    • Content manually generated using buildah_release 1.29.6 script.

Does this PR introduce a user-facing change?

None

@cevich cevich mentioned this pull request Nov 25, 2025
Closed
@cevich cevich force-pushed the release-1.29_cve_3113-52565-52881 branch from ed66f58 to 6566cd2 Compare November 25, 2025 21:12
@cevich cevich marked this pull request as draft November 26, 2025 15:55
@cevich cevich mentioned this pull request Nov 26, 2025
Open
@cevich cevich force-pushed the release-1.29_cve_3113-52565-52881 branch from 6566cd2 to ded4bd3 Compare November 26, 2025 19:09
@openshift-ci
Copy link
Contributor

openshift-ci bot commented Nov 26, 2025

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: cevich
Once this PR has been reviewed and has the lgtm label, please assign rhatdan for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@TomSweeneyRedHat
Copy link
Member

TomSweeneyRedHat commented Nov 26, 2025

@cevich I'm not sure where all these PRs came from when you put this together, regardless, it looks like a man page or two may need tweaking:

[+0017s] xref-helpmsgs-manpages: buildah login --help lists --compat-auth-file, but --compat-auth-file not in docs/buildah-login.1.md
[+0017s] xref-helpmsgs-manpages: buildah logout --help lists --compat-auth-file, but --compat-auth-file not in docs/buildah-logout.1.md

@cevich
Copy link
Member Author

cevich commented Nov 26, 2025

Actually the documentation is correct. My clanker helped identify the change as being caused by an update to Cobra w/ behavior changes, as part of the runc v1.2.8 update. So sadly, code changes are needed to fix this here and in #6540

@cevich
Copy link
Member Author

cevich commented Nov 26, 2025

@cevich I'm not sure where all these PRs

I've lost track days ago. With David out this week, I'm just going down my list of what needs updating and trying to make as much backport progress as I can (based on the next higher version). I'm hoping when the dust settles, it will all get worked out in the end.

@cevich
Copy link
Member Author

cevich commented Nov 26, 2025

Testing out a fix to the CLI options / Cobra update problem over in PR #6540

@cevich cevich force-pushed the release-1.29_cve_3113-52565-52881 branch from ded4bd3 to 71772b7 Compare December 1, 2025 14:15
@cevich
Copy link
Member Author

cevich commented Dec 1, 2025

Added "Handle Cobra v1.5 -> v1.8 behavior changes" commit.

@cevich cevich force-pushed the release-1.29_cve_3113-52565-52881 branch 3 times, most recently from 28b801f to 23c69c3 Compare December 1, 2025 21:00
@cevich
Copy link
Member Author

cevich commented Dec 2, 2025

Suggestion from Tom/Nalin:

the commits on the tip of https://github.com/nalind/buildah/tree/ci-1.29, particularly bumping the version of golang.org/x/tools and the linter in the tests/tools subdirectory, should get that further along.

@cevich
Copy link
Member Author

cevich commented Dec 2, 2025

Backported:

Note: I saw a few commits (6bf7400 and 56eadec) I may consider bringing here in place of disabling the lint-checking, but it's a low priority ATM.

@cevich cevich force-pushed the release-1.29_cve_3113-52565-52881 branch 2 times, most recently from 513abff to 7bf8e56 Compare December 2, 2025 20:01
@cevich cevich mentioned this pull request Dec 4, 2025
Open
@cevich cevich changed the title [release-1.29] Bump runc up to 1.2.8 for CVE-2025-52881, CVE-2025-31133 and CVE-2025-52565 [release-1.29] Bump runc up to 1.2.9 for CVE-2025-52881, CVE-2025-31133 and CVE-2025-52565 Dec 4, 2025
@cevich cevich force-pushed the release-1.29_cve_3113-52565-52881 branch from 7bf8e56 to becc9db Compare December 5, 2025 15:24
@cevich
Copy link
Member Author

cevich commented Dec 5, 2025

Note to me: CI first turned green in becc9db

@cevich cevich force-pushed the release-1.29_cve_3113-52565-52881 branch 2 times, most recently from 50a274d to 2d01a8e Compare December 5, 2025 19:41
@TomSweeneyRedHat TomSweeneyRedHat force-pushed the release-1.29_cve_3113-52565-52881 branch from 8c823de to 55f20a6 Compare December 8, 2025 13:05
@cevich cevich force-pushed the release-1.29_cve_3113-52565-52881 branch 2 times, most recently from a33eea4 to 7d89222 Compare December 8, 2025 19:59
nalind and others added 22 commits December 10, 2025 09:46
@nalind @cevich
Partially work around containers/common
1dd4dd8 
 ... setting RLIMIT_NPROC wrong

The version of containers/common we're currently using on this branch included a
bug which was later fixed by containers/common#2199.
If we get an update on its v0.60 branch which includes that fix, we can
drop this patch from this branch, but until then, work around the part
that breaks our tests.

Signed-off-by: Nalin Dahyabhai <[email protected]>
Signed-off-by: tomsweeneyredhat <[email protected]>
Signed-off-by: Chris Evich <[email protected]>
@nalind @cevich
test start_git_server(): chown the sample repo we'll serve
5569150 
Grab a piece of containers#5550 that
uses `chown` to reset ownership of the sample repository we're going to
be serving to match the current user, to avoid a git unsafe-directory
error.

Signed-off-by: Nalin Dahyabhai <[email protected]>
@nalind @cevich
CI: switch to debian for testing there
8e1439d 
The updated images we're using have switched from Ubuntu to Debian.

Signed-off-by: Nalin Dahyabhai <[email protected]>
@nalind @cevich
CI: run integration tests on Fedora with both crun and runc
d7a53d2 
Run integration tests (both as root and rootless) with both crun and
runc on Fedora, to help ensure that we can use either.

Signed-off-by: Nalin Dahyabhai <[email protected]>
@nalind @cevich
run: handle relabeling bind mounts ourselves
cfe6264 
Handle requested relabeling of bind mounts (i.e., the "z" and "Z" flags)
directly, instead of letting the runtime handle the relabeling.

Signed-off-by: Nalin Dahyabhai <[email protected]>
@rhatdan @cevich
Ignore errors if label.Relabel returns ENOSUP
d84bc70 
This is a common mistake by users and is ignored in some places
but not everywhere. This change will help this to be ignored everwhere.

Signed-off-by: Daniel J Walsh <[email protected]>
@nalind @cevich
Update github.com/containers/image/v5 to get updated docker-daemon:
4f6e12d 
Update the image library to get a version of the "docker-daemon"
transport that can contact the version of the docker daemon that we
use in our conformance tests.

Signed-off-by: Nalin Dahyabhai <[email protected]>
@mtrmac @cevich
Add support for --compat-auth-file in login/logout
a020a38 
This mostly just inherits the c/common/pkg/auth implementation,
except that AuthFilePath and DockerCompatAuthFilePath can not be set
simultaneously, so don't always set AuthFilePath. c/common already
defaults to the same locations internally.

Test handle only invalid commands; a true interoperability test
would require a running Docker on the CI systems, which is not currently
available. That interoperability was tested manually
(and is presumed to be integration-tested in the Podman repo).

Signed-off-by: Miloslav Trmač <[email protected]>
@vrothberg @cevich
container.conf: support attributed string slices
f9b3cbb 
All `[]string`s in containers.conf have now been migrated to attributed
string slices which require some adjustments in Buildah and Podman.

[NO NEW TESTS NEEDED]

Signed-off-by: Valentin Rothberg <[email protected]>
@nalind @cevich
Stop setting "parent" in docker format
c94b377 
Newer docker build doesn't set it, so we need to stop.

Signed-off-by: Nalin Dahyabhai <[email protected]>
@nalind @cevich
commit: set "parent" for docker format only when requested
ac14485 
Make setting the Parent field in the config blob of a docker format
image optional (yes, we're bringing it back!), since it no longer
appears to be set by newer versions of docker build.

Signed-off-by: Nalin Dahyabhai <[email protected]>
@nalind @cevich
Builder.SetWorkDir(): trim off a path separator suffix, if there is one
63231e1 
If the working directory ends with the path separator, and trimming it
wouldn't produce an empty value, trim it, for conformance.

This was originally fixed in imagebuilder, and we picked up the change
automatically, but this should provide the same end-result.

Signed-off-by: Nalin Dahyabhai <[email protected]>
@nalind @cevich
Backport test fix from pull/5016
ee378bf 
6ec6f04 includes both dependency
updates and a fix for a test which was impacted by the behaviors it
changed.  Pull the dependency updates out.

Signed-off-by: Nalin Dahyabhai <[email protected]>
@nalind @cevich
Update tests to compensate for changed error messages
333db20 
Dependency updates changed the text of an error message; update tests
that checked for it.

Signed-off-by: Nalin Dahyabhai <[email protected]>
@nalind @cevich
Update a push test
98925b7 
Pushing an image won't log that signatures are being written if the
image isn't signed, so check for the message that's logged when the
manifest is written.

Signed-off-by: Nalin Dahyabhai <[email protected]>
@nalind @cevich
Update the selinux spc test
d432f1b 
Pick up the test updates from containers#4829, where we learned that disabling
SELinux process labeling in a non-privileged context doesn't result in
the container process being granted super privileges.

Signed-off-by: Nalin Dahyabhai <[email protected]>
@flouthoc @cevich
.cirrus: run -race only on non-PR branch
88e9d89 
Signed-off-by: flouthoc <[email protected]>
@nalind @cevich
Makefile: run unit and conformance tests without -cover
ba1eaac 
When running unit and conformance tests, drop the -cover flag from the
invocation of `go test`.

Signed-off-by: Nalin Dahyabhai <[email protected]>
@nalind @cevich
Add a dummy "runtime" that just dumps its config file
4b8de2f 
Signed-off-by: Nalin Dahyabhai <[email protected]>

Signed-off-by: Chris Evich <[email protected]>
Assisted-by: Claude (Anthropic)
@nalind @cevich
runUsingRuntime: use named constants for runtime states
ee9abec 
Use the named constants for the status values that runtimes can report
to us when we run them with the "state" command.

Signed-off-by: Nalin Dahyabhai <[email protected]>
@edsantiago @cevich
Temporarily hard-skip bud-multiple-platform-values test
3d2ea2c 
It is completely broken (see containers#4396) and is now causing failures
in Fedora gating tests:

   https://artifacts.dev.testing-farm.io/30e7b5bc-d162-4ae7-9a60-896f0186bf73/

Signed-off-by: Ed Santiago <[email protected]>
@TomSweeneyRedHat @cevich
[release-1.29] Bump to v1.29.6
9b7207d 
Bump Buildah to v1.29.6

Signed-off-by: tomsweeneyredhat <[email protected]>
Signed-off-by: Chris Evich <[email protected]>
@cevich cevich force-pushed the release-1.29_cve_3113-52565-52881 branch from 825cdd4 to 9b7207d Compare December 10, 2025 14:50
@cevich
Copy link
Member Author

cevich commented Dec 10, 2025

force-push: Injected backport of "Partially work around containers/common" commit.

@cevich
Copy link
Member Author

cevich commented Dec 10, 2025

Re-running about half the integration tests. All are networking flakes.

@TomSweeneyRedHat
Copy link
Member

TomSweeneyRedHat commented Dec 10, 2025

LGTM
once the tests are happy

@cevich
Copy link
Member Author

cevich commented Dec 10, 2025

Re-ran: "Integration fedora-40 using crun w/ vfs" - Another likely flake, this time some kind of "out of disk space" error 😞

@cevich
Copy link
Member Author

cevich commented Dec 10, 2025

Oof, re-ran again, different flakes this time 😢

@mheon
Copy link
Member

mheon commented Dec 10, 2025

LGTM, for reference...

@cevich
Copy link
Member Author

cevich commented Dec 10, 2025

Note: The "[Partially work around containers/common]" commit is missing from the changelog 😞

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

kind/other

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

10 participants

@cevich @TomSweeneyRedHat @mheon @nalind @kolyshkin @rhatdan @mtrmac @vrothberg @flouthoc @edsantiago