mirror of
https://gitlab.com/buildroot.org/buildroot.git
synced 2026-09-10 00:04:06 -09:00
b347285b1d
Fixes the following security issues (in v1.2.8): - CVE-2025-31133: container escape via "masked path" abuse due to mount race conditions https://github.com/opencontainers/runc/security/advisories/GHSA-9493-h29p-rfm2 - CVE-2025-52565: container escape with malicious config due to /dev/console mount and related races https://github.com/opencontainers/runc/security/advisories/GHSA-qw9x-cqr3-wc7r - CVE-2025-52881: container escape and denial of service due to arbitrary write gadgets and procfs write redirects https://github.com/opencontainers/runc/security/advisories/GHSA-cgrx-mc8f-2prm There are also numerous bugfixes. See the releases notes: - https://github.com/opencontainers/runc/releases/v1.2.5 - https://github.com/opencontainers/runc/releases/v1.2.6 - https://github.com/opencontainers/runc/releases/v1.2.7 - https://github.com/opencontainers/runc/releases/v1.2.8 - https://github.com/opencontainers/runc/releases/v1.2.9 Signed-off-by: Titouan Christophe <titouan.christophe@mind.be> Signed-off-by: Thomas Perale <thomas.perale@mind.be>
31 lines
786 B
Makefile
31 lines
786 B
Makefile
################################################################################
|
|
#
|
|
# runc
|
|
#
|
|
################################################################################
|
|
|
|
RUNC_VERSION = 1.2.9
|
|
RUNC_SITE = $(call github,opencontainers,runc,v$(RUNC_VERSION))
|
|
RUNC_LICENSE = Apache-2.0, LGPL-2.1 (libseccomp)
|
|
RUNC_LICENSE_FILES = LICENSE
|
|
RUNC_CPE_ID_VENDOR = linuxfoundation
|
|
|
|
RUNC_LDFLAGS = -X main.version=$(RUNC_VERSION)
|
|
RUNC_TAGS = cgo static_build
|
|
|
|
ifeq ($(BR2_PACKAGE_LIBAPPARMOR),y)
|
|
RUNC_DEPENDENCIES += libapparmor
|
|
RUNC_TAGS += apparmor
|
|
endif
|
|
|
|
ifeq ($(BR2_PACKAGE_LIBSECCOMP),y)
|
|
RUNC_TAGS += seccomp
|
|
RUNC_DEPENDENCIES += libseccomp host-pkgconf
|
|
endif
|
|
|
|
HOST_RUNC_LDFLAGS = $(RUNC_LDFLAGS)
|
|
HOST_RUNC_TAGS = cgo static_build
|
|
|
|
$(eval $(golang-package))
|
|
$(eval $(host-golang-package))
|