From d00e249c26506a8e6a42b7072d80b80a5e1fbf00 Mon Sep 17 00:00:00 2001 From: Sebastiaan van Stijn Date: Wed, 1 Feb 2017 11:36:44 -0800 Subject: [PATCH] [1.13.x] bump RunC / libcontainer to fix SELinux regression This bumps RunC and libcontainer to fix a regression in 1.13 that caused SELinux labels to not be applied correctly. Signed-off-by: Sebastiaan van Stijn --- hack/dockerfile/binaries-commits | 4 +++- vendor.conf | 3 ++- .../runc/libcontainer/label/label_selinux.go | 18 +++++++----------- 3 files changed, 12 insertions(+), 13 deletions(-) diff --git a/hack/dockerfile/binaries-commits b/hack/dockerfile/binaries-commits index c53eb8b896..8dfcca3946 100755 --- a/hack/dockerfile/binaries-commits +++ b/hack/dockerfile/binaries-commits @@ -1,7 +1,9 @@ #!/bin/sh TOMLV_COMMIT=9baf8a8a9f2ed20a8e54160840c492f937eeaf9a -RUNC_COMMIT=2f7393a47307a16f8cee44a37b262e8b81021e3e + +# When updating RUNC_COMMIT, also update runc in vendor.conf accordingly +RUNC_COMMIT=9df8b306d01f59d3a8029be411de015b7304dd8f CONTAINERD_COMMIT=aa8187dbd3b7ad67d8e5e3a15115d3eef43a7ed1 TINI_COMMIT=949e6facb77383876aeff8a6944dde66b3089574 LIBNETWORK_COMMIT=0f534354b813003a754606689722fe253101bc4e diff --git a/vendor.conf b/vendor.conf index dc9780fa04..c097789cfa 100644 --- a/vendor.conf +++ b/vendor.conf @@ -59,7 +59,8 @@ github.com/miekg/pkcs11 df8ae6ca730422dba20c768ff38ef7d79077a59f github.com/docker/go v1.5.1-1-1-gbaf439e github.com/agl/ed25519 d2b94fd789ea21d12fac1a4443dd3a3f79cda72c -github.com/opencontainers/runc 2f7393a47307a16f8cee44a37b262e8b81021e3e https://github.com/docker/runc.git # libcontainer +# When updating, also update RUNC_COMMIT in hack/dockerfile/binaries-commits accordingly +github.com/opencontainers/runc 9df8b306d01f59d3a8029be411de015b7304dd8f https://github.com/docker/runc.git # libcontainer github.com/opencontainers/runtime-spec 1c7c27d043c2a5e513a44084d2b10d77d1402b8c # specs github.com/seccomp/libseccomp-golang 32f571b70023028bd57d9288c20efbcb237f3ce0 # libcontainer deps (see src/github.com/opencontainers/runc/Godeps/Godeps.json) diff --git a/vendor/github.com/opencontainers/runc/libcontainer/label/label_selinux.go b/vendor/github.com/opencontainers/runc/libcontainer/label/label_selinux.go index d76846eafb..b6c2495e9f 100644 --- a/vendor/github.com/opencontainers/runc/libcontainer/label/label_selinux.go +++ b/vendor/github.com/opencontainers/runc/libcontainer/label/label_selinux.go @@ -33,19 +33,15 @@ func InitLabels(options []string) (string, string, error) { pcon := selinux.NewContext(processLabel) mcon := selinux.NewContext(mountLabel) for _, opt := range options { - val := strings.SplitN(opt, "=", 2) - if val[0] != "label" { - continue - } - if len(val) < 2 { - return "", "", fmt.Errorf("bad label option %q, valid options 'disable' or \n'user, role, level, type' followed by ':' and a value", opt) - } - if val[1] == "disable" { + if opt == "disable" { return "", "", nil } - con := strings.SplitN(val[1], ":", 2) - if len(con) < 2 || !validOptions[con[0]] { - return "", "", fmt.Errorf("bad label option %q, valid options 'disable, user, role, level, type'", con[0]) + if i := strings.Index(opt, ":"); i == -1 { + return "", "", fmt.Errorf("Bad label option %q, valid options 'disable' or \n'user, role, level, type' followed by ':' and a value", opt) + } + con := strings.SplitN(opt, ":", 2) + if !validOptions[con[0]] { + return "", "", fmt.Errorf("Bad label option %q, valid options 'disable, user, role, level, type'", con[0]) } pcon[con[0]] = con[1]