0ct0pu5/moby
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Merge pull request #240 from seemethere/bundle_me_up_1809

Browse source 
[18.09-ce] [ENGSEC-30] CVE-2019-5736 apply fix via git bundle instead of patches
This commit is contained in:
Andrew Hsu 2019-02-06 15:39:49 -08:00 • committed by GitHub
commit eb137ff176
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
3 changed files with 17 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

1
Dockerfile
View file

@ -154,6 +154,7 @@ RUN PREFIX=/build/ ./install.sh $INSTALL_BINARY_NAME
FROM runtime-dev AS runc FROM runtime-dev AS runc
ENV INSTALL_BINARY_NAME=runc ENV INSTALL_BINARY_NAME=runc
COPY hack/dockerfile/install/install.sh ./install.sh COPY hack/dockerfile/install/install.sh ./install.sh
COPY git-bundles /go/src/github.com/docker/docker/git-bundles
COPY hack/dockerfile/install/$INSTALL_BINARY_NAME.installer ./ COPY hack/dockerfile/install/$INSTALL_BINARY_NAME.installer ./
RUN PREFIX=/build/ ./install.sh $INSTALL_BINARY_NAME RUN PREFIX=/build/ ./install.sh $INSTALL_BINARY_NAME

BIN
git-bundles/CVE-2019-5736.bundle Normal file
View file

Binary file not shown.

17
hack/dockerfile/install/runc.installer
View file

@ -5,6 +5,8 @@
# version that is used. If you need to update runc, open a pull request in # version that is used. If you need to update runc, open a pull request in
# the containerd project first, and update both after that is merged. # the containerd project first, and update both after that is merged.
RUNC_COMMIT=96ec2177ae841256168fcf76954f7177af9446eb RUNC_COMMIT=96ec2177ae841256168fcf76954f7177af9446eb
RUNC_OVERRIDE_COMMIT=09c8266bf2fcf9519a651b04ae54c967b9ab86ec
RUNC_BUNDLE=/go/src/github.com/docker/docker/git-bundles/CVE-2019-5736.bundle
install_runc() { install_runc() {
# If using RHEL7 kernels (3.10.0 el7), disable kmem accounting/limiting # If using RHEL7 kernels (3.10.0 el7), disable kmem accounting/limiting
@ -19,12 +21,25 @@ install_runc() {
git clone https://github.com/opencontainers/runc.git "$GOPATH/src/github.com/opencontainers/runc" git clone https://github.com/opencontainers/runc.git "$GOPATH/src/github.com/opencontainers/runc"
cd "$GOPATH/src/github.com/opencontainers/runc" cd "$GOPATH/src/github.com/opencontainers/runc"
git checkout -q "$RUNC_COMMIT" git checkout -q "$RUNC_COMMIT"
if [ -f "$RUNC_BUNDLE" ];then
git bundle unbundle "$RUNC_BUNDLE"
git checkout -q "$RUNC_OVERRIDE_COMMIT"
if [ "$(git rev-parse HEAD)" != "$RUNC_OVERRIDE_COMMIT" ]; then
echo "ERROR: Commit with bundle does not match override commit"
echo " $(git rev-parse HEAD) != '$RUNC_OVERRIDE_COMMIT'"
exit 1
fi
RUNC_COMMIT=$RUNC_OVERRIDE_COMMIT
fi
if [ -z "$1" ]; then if [ -z "$1" ]; then
target=static target=static
else else
target="$1" target="$1"
fi fi
make BUILDTAGS="$RUNC_BUILDTAGS" "$target" OVERRIDE_VERSION="1.0.0-rc6+dev.docker-18.09"
make BUILDTAGS="$RUNC_BUILDTAGS" COMMIT="$RUNC_COMMIT" VERSION="$OVERRIDE_VERSION" "$target"
mkdir -p ${PREFIX} mkdir -p ${PREFIX}
cp runc ${PREFIX}/runc cp runc ${PREFIX}/runc
} }