[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Bug#853866: marked as done (unblock: runc/0.1.1+dfsg1-2)

Your message dated Thu, 02 Feb 2017 18:36:00 +0000
with message-id <8e74acbf-5e74-bec7-4106-1642eb4c3883@thykier.net>
and subject line Re: unblock: runc/0.1.1+dfsg1-2
has caused the Debian Bug report #853866,
regarding unblock: runc/0.1.1+dfsg1-2
to be marked as done.

This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.

(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact owner@bugs.debian.org
immediately.)


-- 
853866: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=853866
Debian Bug Tracking System
Contact owner@bugs.debian.org with problems
--- Begin Message --- 
Package: release.debian.org
Severity: normal
User: release.debian.org@packages.debian.org
Usertags: unblock

Please unblock package runc

There was a CVE filed against runc recently (CVE-2016-9962), and the
patch to fix it was applied in the 0.1.1+dfsg1-2 team upload I just
made.  The patch is simply setting "runc exec" processes as
"non-dumpable" (which according to the CVE text and upstream, closes the
vulnerability).

unblock runc/0.1.1+dfsg1-2

-- System Information:
Debian Release: 9.0
  APT prefers testing
  APT policy: (500, 'testing')
Architecture: amd64 (x86_64)
Foreign Architectures: i386

Kernel: Linux 4.9.0-1-amd64 (SMP w/8 CPU cores)
Locale: LANG=en_US.utf8, LC_CTYPE=en_US.utf8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash
Init: systemd (via /run/systemd/system)

diff -Nru runc-0.1.1+dfsg1/debian/changelog runc-0.1.1+dfsg1/debian/changelog
--- runc-0.1.1+dfsg1/debian/changelog	2016-07-13 06:01:04.000000000 -0700
+++ runc-0.1.1+dfsg1/debian/changelog	2017-02-01 07:17:54.000000000 -0800
@@ -1,3 +1,10 @@
+runc (0.1.1+dfsg1-2) unstable; urgency=medium
+
+  * Team upload.
+  * Backport patch for CVE-2016-9962 (Closes: #850951)
+
+ -- Tianon Gravi <tianon@debian.org>  Wed, 01 Feb 2017 07:17:54 -0800
+
 runc (0.1.1+dfsg1-1) unstable; urgency=medium
 
   * New upstream release [June 2016].
diff -Nru runc-0.1.1+dfsg1/debian/control runc-0.1.1+dfsg1/debian/control
--- runc-0.1.1+dfsg1/debian/control	2016-07-13 05:58:01.000000000 -0700
+++ runc-0.1.1+dfsg1/debian/control	2016-11-29 14:18:25.000000000 -0800
@@ -3,7 +3,8 @@
 Priority: extra
 Maintainer: Debian Go Packaging Team <pkg-go-maintainers@lists.alioth.debian.org>
 Uploaders: Alexandre Viau <alexandre@alexandreviau.net>,
-           Dmitry Smirnov <onlyjob@debian.org>
+           Dmitry Smirnov <onlyjob@debian.org>,
+           Tim Potter <tpot@hpe.com>
 Build-Depends: debhelper (>= 9),
                dh-golang,
     go-md2man,
diff -Nru runc-0.1.1+dfsg1/debian/patches/cve-2016-9962.patch runc-0.1.1+dfsg1/debian/patches/cve-2016-9962.patch
--- runc-0.1.1+dfsg1/debian/patches/cve-2016-9962.patch	1969-12-31 16:00:00.000000000 -0800
+++ runc-0.1.1+dfsg1/debian/patches/cve-2016-9962.patch	2017-01-31 20:50:59.000000000 -0800
@@ -0,0 +1,23 @@
+Description: set "runc exec" processes as non-dumpable (CVE-2016-9962)
+Origin: https://github.com/opencontainers/runc/commit/50a19c6ff828c58e5dab13830bd3dacde268afe5 (backported to v0.1.1)
+Author: Tianon Gravi <tianon@debian.org>
+Forwarded: not-needed
+Applied-Upstream: > 1.0.0-rc2
+
+diff --git a/libcontainer/nsenter/nsexec.c b/libcontainer/nsenter/nsexec.c
+index 8f37d6c..3c74c63 100644
+--- a/libcontainer/nsenter/nsexec.c
++++ b/libcontainer/nsenter/nsexec.c
+@@ -364,6 +364,12 @@ void nsexec(void)
+ 		return;
+ 	}
+ 
++	/* make the process non-dumpable */
++	if (prctl(PR_SET_DUMPABLE, 0, 0, 0, 0) != 0) {
++		pr_perror("Failed to set process as non-dumpable");
++		exit(1);
++	}
++
+ 	// Retrieve the netlink header
+ 	struct nlmsghdr nl_msg_hdr;
+ 	int		len;
diff -Nru runc-0.1.1+dfsg1/debian/patches/series runc-0.1.1+dfsg1/debian/patches/series
--- runc-0.1.1+dfsg1/debian/patches/series	2016-07-13 05:08:22.000000000 -0700
+++ runc-0.1.1+dfsg1/debian/patches/series	2017-01-31 20:48:05.000000000 -0800
@@ -1 +1,2 @@
 disable-failing-tests.patch
+cve-2016-9962.patch

--- End Message ---
--- Begin Message --- 
On Wed, 01 Feb 2017 08:12:19 -0800 Tianon Gravi <tianon@debian.org> wrote:
> Package: release.debian.org
> Severity: normal
> User: release.debian.org@packages.debian.org
> Usertags: unblock
> 
> Please unblock package runc
> 
> There was a CVE filed against runc recently (CVE-2016-9962), and the
> patch to fix it was applied in the 0.1.1+dfsg1-2 team upload I just
> made.  The patch is simply setting "runc exec" processes as
> "non-dumpable" (which according to the CVE text and upstream, closes the
> vulnerability).
> 
> unblock runc/0.1.1+dfsg1-2
> 
> [...]

Unblocked, thanks.

~Niels

--- End Message ---
Reply to: