Skip to content

bump libseccomp-golang v0.9.1#3371

Merged
estesp merged 1 commit intocontainerd:masterfrom
thaJeztah:bump_libseccomp
Jun 26, 2019
Merged

bump libseccomp-golang v0.9.1#3371
estesp merged 1 commit intocontainerd:masterfrom
thaJeztah:bump_libseccomp

Conversation

@thaJeztah
Copy link
Copy Markdown
Member

@thaJeztah thaJeztah commented Jun 25, 2019

full diff: seccomp/libseccomp-golang@32f571b...689e3c1

Release notes:

  • Version 0.9.1 - May 21, 2019
  • Minimum supported version of libseccomp bumped to v2.2.0 (seccomp/libseccomp-golang@fc02980)
  • PowerPC and S390(x) architectures are unavailable below library version v2.3.0 and will return errors if used with incompatible libraries
  • Use Libseccomp's seccomp_version API to retrieve library version
  • Unconditionally set TSync attribute for filters, due to Go's heavily threaded nature
  • Fix CVE-2017-18367 - Multiple syscall arguments were incorrectly combined with logical-OR, instead of logical-AND (seccomp/libseccomp-golang@06e7a29)
  • Fix a failure to build on Debian-based distributions due to CGo code
  • Fix unit test failures on 32-bit architectures
  • Improve several errors to be more verbose about their causes
  • Add support for SCMP_ACT_LOG (with libseccomp versions 2.4.x and higher), permitting syscalls but logging their execution
  • Add support for SCMP_FLTATR_CTL_LOG (with libseccomp versions 2.4.x and higher), logging not-allowed actions when they are denied

@thaJeztah
bump libseccomp-golang v0.9.1
bb41ef8 
full diff: seccomp/libseccomp-golang@32f571b...689e3c1

Release notes:

* Version 0.9.1 - May 21, 2019
- Minimum supported version of libseccomp bumped to v2.2.0 (seccomp/libseccomp-golang@fc02980)
- PowerPC and S390(x) architectures are unavailable below library version v2.3.0 and will return errors if used with incompatible libraries
- Use Libseccomp's `seccomp_version` API to retrieve library version
- Unconditionally set TSync attribute for filters, due to Go's heavily threaded nature
- Fix [CVE-2017-18367](https://nvd.nist.gov/vuln/detail/CVE-2017-18367) - Multiple syscall arguments were incorrectly combined with logical-OR, instead of logical-AND (seccomp/libseccomp-golang@06e7a29)
- Fix a failure to build on Debian-based distributions due to CGo code
- Fix unit test failures on 32-bit architectures
- Improve several errors to be more verbose about their causes
- Add support for SCMP_ACT_LOG (with libseccomp versions 2.4.x and higher), permitting syscalls but logging their execution
- Add support for SCMP_FLTATR_CTL_LOG (with libseccomp versions 2.4.x and higher), logging not-allowed actions when they are denied

Signed-off-by: Sebastiaan van Stijn <[email protected]>
@thaJeztah
Copy link
Copy Markdown
Member Author

thaJeztah commented Jun 25, 2019

corresponding PR for containerd/cri: containerd/cri#1189 (I assumed it was OK to bump this separate from a revendor of containerd/cri).

should this be marked for cherry-picking?

@Random-Liu @justincormack ptal

@theopenlab-ci
Copy link
Copy Markdown

theopenlab-ci Bot commented Jun 25, 2019

Build succeeded.

@thaJeztah
Copy link
Copy Markdown
Member Author

thaJeztah commented Jun 25, 2019

Failure is https://travis-ci.org/containerd/containerd/jobs/550175559/config

Test Suite Failed
--- FAIL: TestCRISuite (60.80s)
    cri_test.go:121: Failed to run tests in paralllel: exit status 1
FAIL

@crosbymichael
Copy link
Copy Markdown
Member

crosbymichael commented Jun 25, 2019

LGTM

@ehotinger
Copy link
Copy Markdown
Contributor

ehotinger commented Jun 25, 2019

@crosbymichael @thaJeztah just curious, have you folks tried out using dependabot (or similar) for automating PRs like these?

@thaJeztah
Copy link
Copy Markdown
Member Author

thaJeztah commented Jun 25, 2019

I've discussed using it in some other contexts; it could help with some of these (not sure if it would help for all, as we sometimes have to curate/coordinate what version to pin to). Switching to Go Mod also could help for some cases (but brings a lot of problems with it as well)

estesp
estesp approved these changes Jun 26, 2019
View reviewed changes
Copy link
Copy Markdown
Member

@estesp estesp left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@estesp estesp merged commit 0e87608 into containerd:master Jun 26, 2019
@thaJeztah thaJeztah deleted the bump_libseccomp branch June 26, 2019 07:24
This was referenced Jun 26, 2019
Merged
Merged
@Random-Liu
Copy link
Copy Markdown
Member

Random-Liu commented Jul 27, 2019 •
edited
Loading

seccomp_version is added in libseccomp 2.3.0 seccomp/libseccomp@58a7c20.

This change increases libseccomp requirement to 2.3.0, NOT "Minimum supported version of libseccomp bumped to v2.2.0 (seccomp/libseccomp-golang@fc02980"

I've tried with libseccomp 2.2.3, and got error undefined symbol: seccomp_version.

Is this what we expected? If it is, I'll update one of our test image; if not, we may want to fix it.

@Random-Liu Random-Liu mentioned this pull request Jul 27, 2019
Merged
@thaJeztah
Copy link
Copy Markdown
Member Author

thaJeztah commented Jul 27, 2019

Yes that commit was confusing as it mentioned both 2.2.0 and 2.3.0

@justincormack
Copy link
Copy Markdown
Contributor

justincormack commented Jul 29, 2019

Hmm, I had forgotten about that incompatibility. That basically means having to drop support for older distros which is probably not what we want.

This was referenced Aug 15, 2019
Merged
Merged
This was referenced Oct 7, 2019
Merged
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@estesp estesp estesp approved these changes

+1 more reviewer

@justincormack justincormack justincormack approved these changes

Reviewers whose approvals may not affect merge requirements

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

6 participants

@thaJeztah @crosbymichael @ehotinger @Random-Liu @justincormack @estesp