[release/1.1 backport] bump libseccomp-golang v0.9.1#3375
Conversation
full diff: seccomp/libseccomp-golang@32f571b...689e3c1 Release notes: * Version 0.9.1 - May 21, 2019 - Minimum supported version of libseccomp bumped to v2.2.0 (seccomp/libseccomp-golang@fc02980) - PowerPC and S390(x) architectures are unavailable below library version v2.3.0 and will return errors if used with incompatible libraries - Use Libseccomp's `seccomp_version` API to retrieve library version - Unconditionally set TSync attribute for filters, due to Go's heavily threaded nature - Fix [CVE-2017-18367](https://nvd.nist.gov/vuln/detail/CVE-2017-18367) - Multiple syscall arguments were incorrectly combined with logical-OR, instead of logical-AND (seccomp/libseccomp-golang@06e7a29) - Fix a failure to build on Debian-based distributions due to CGo code - Fix unit test failures on 32-bit architectures - Improve several errors to be more verbose about their causes - Add support for SCMP_ACT_LOG (with libseccomp versions 2.4.x and higher), permitting syscalls but logging their execution - Add support for SCMP_FLTATR_CTL_LOG (with libseccomp versions 2.4.x and higher), logging not-allowed actions when they are denied Signed-off-by: Sebastiaan van Stijn <[email protected]> (cherry picked from commit bb41ef8) Signed-off-by: Sebastiaan van Stijn <[email protected]>
Codecov Report
@@ Coverage Diff @@
## release/1.1 #3375 +/- ##
============================================
Coverage 49.07% 49.07%
============================================
Files 85 85
Lines 7598 7598
============================================
Hits 3729 3729
Misses 3194 3194
Partials 675 675
Continue to review full report at Codecov.
|
estesp
left a comment
estesp
left a comment
There was a problem hiding this comment.
LGTM
Backport required to fix a known CVE
|
FWIW; I discussed the vendor bump with @justincormack, and he thought that the actual vendor in containerd, containerd/cri, and dockerd are not critical for the CVE itself; the version in runc is the important one, but turned out that it was already patched (there was some confusion about that). Bumping the vendored files in these branches would still be good to have (IMO) to take away any doubt (and possibly security scanners finding a vulnerable version of the dependency). If there's concerns about updating these files here, feel free to close |
|
LGTM |
4 participants
backport of #3371 for the 1.1 branch
full diff: seccomp/libseccomp-golang@32f571b...689e3c1
Release notes:
seccomp_versionAPI to retrieve library versionSigned-off-by: Sebastiaan van Stijn [email protected]
(cherry picked from commit bb41ef8)
Signed-off-by: Sebastiaan van Stijn [email protected]