eaf6071019
go1.21.1 (released 2023-09-06) includes four security fixes to the cmd/go, crypto/tls, and html/template packages, as well as bug fixes to the compiler, the go command, the linker, the runtime, and the context, crypto/tls, encoding/gob, encoding/xml, go/types, net/http, os, and path/filepath packages. See the Go 1.21.1 milestone on our issue tracker for details: https://github.com/golang/go/issues?q=milestone%3AGo1.21.1+label%3ACherryPickApproved full diff: https://github.com/golang/go/compare/go1.21.0...go1.21.1 From the security mailing: [security] Go 1.21.1 and Go 1.20.8 are released Hello gophers, We have just released Go versions 1.21.1 and 1.20.8, minor point releases. These minor releases include 4 security fixes following the security policy: - cmd/go: go.mod toolchain directive allows arbitrary execution The go.mod toolchain directive, introduced in Go 1.21, could be leveraged to execute scripts and binaries relative to the root of the module when the "go" command was executed within the module. This applies to modules downloaded using the "go" command from the module proxy, as well as modules downloaded directly using VCS software. Thanks to Juho Nurminen of Mattermost for reporting this issue. This is CVE-2023-39320 and Go issue https://go.dev/issue/62198. - html/template: improper handling of HTML-like comments within script contexts The html/template package did not properly handle HMTL-like "<!--" and "-->" comment tokens, nor hashbang "#!" comment tokens, in <script> contexts. This may cause the template parser to improperly interpret the contents of <script> contexts, causing actions to be improperly escaped. This could be leveraged to perform an XSS attack. Thanks to Takeshi Kaneko (GMO Cybersecurity by Ierae, Inc.) for reporting this issue. This is CVE-2023-39318 and Go issue https://go.dev/issue/62196. - html/template: improper handling of special tags within script contexts The html/template package did not apply the proper rules for handling occurrences of "<script", "<!--", and "</script" within JS literals in <script> contexts. This may cause the template parser to improperly consider script contexts to be terminated early, causing actions to be improperly escaped. This could be leveraged to perform an XSS attack. Thanks to Takeshi Kaneko (GMO Cybersecurity by Ierae, Inc.) for reporting this issue. This is CVE-2023-39319 and Go issue https://go.dev/issue/62197. - crypto/tls: panic when processing post-handshake message on QUIC connections Processing an incomplete post-handshake message for a QUIC connection caused a panic. Thanks to Marten Seemann for reporting this issue. This is CVE-2023-39321 and CVE-2023-39322 and Go issue https://go.dev/issue/62266. Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
144 lines
6.1 KiB
Docker
144 lines
6.1 KiB
Docker
# This dockerfile is used to test containerd within a container
|
|
#
|
|
# usage:
|
|
# 1.) docker build -t containerd-test -f Dockerfile.test ../
|
|
# 2.) docker run -it --privileged -v /tmp:/tmp --tmpfs /var/lib/containerd-test containerd-test bash
|
|
# 3.) $ make binaries install test
|
|
#
|
|
# Use the RUNC_VERSION build-arg to build with a custom version of runc, for example,
|
|
# to build runc v1.0.0-rc94, use:
|
|
#
|
|
# docker build -t containerd-test --build-arg RUNC_VERSION=v1.0.0-rc94 -f Dockerfile.test ../
|
|
|
|
# ------------------------------------------------------------------------------
|
|
# Public stages:
|
|
# "integration": for running integration tests:
|
|
# docker build -t containerd-test -f Dockerfile.test --target integration ../
|
|
# docker run --privileged containerd-test
|
|
#
|
|
# "cri-integration": for running cri-integration tests:
|
|
# docker build -t containerd-test -f Dockerfile.test --target cri-integration ../
|
|
# docker run --privileged --sysctl net.ipv6.conf.all.disable_ipv6=0 containerd-test
|
|
#
|
|
# "critest: for running critest:
|
|
# docker build -t containerd-test -f Dockerfile.test --target critest ../
|
|
# docker run --privileged --sysctl net.ipv6.conf.all.disable_ipv6=0 containerd-test
|
|
#
|
|
# "cri-in-userns": for running critest with "CRI-in-UserNS" mode; needs Rootless Docker/Podman/nerdctl:
|
|
# docker build -t containerd-test -f Dockerfile.test --target cri-in-userns ../
|
|
# docker run --privileged containerd-test
|
|
# ------------------------------------------------------------------------------
|
|
|
|
ARG GOLANG_VERSION=1.21.1
|
|
ARG GOLANG_IMAGE=golang
|
|
|
|
FROM ${GOLANG_IMAGE}:${GOLANG_VERSION} AS golang
|
|
|
|
# Install runc
|
|
FROM golang AS runc
|
|
RUN apt-get update && apt-get install -y --no-install-recommends \
|
|
libseccomp-dev \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
|
|
COPY script/setup/runc-version script/setup/install-runc ./
|
|
# Allow overriding the version of runc to install through build-args
|
|
ARG RUNC_VERSION
|
|
ARG GOPROXY=direct
|
|
ARG DESTDIR=/build
|
|
RUN ./install-runc
|
|
|
|
FROM golang AS build-env
|
|
RUN apt-get update && apt-get install -y --no-install-recommends \
|
|
btrfs-progs \
|
|
libseccomp-dev \
|
|
xfsprogs \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
RUN mkdir -p /go/src/github.com/containerd/containerd
|
|
WORKDIR /go/src/github.com/containerd/containerd
|
|
|
|
FROM golang AS cni
|
|
ENV DESTDIR=/build
|
|
COPY script/setup/install-cni go.mod /
|
|
RUN DESTDIR=/build /install-cni
|
|
|
|
FROM golang AS critools
|
|
ARG DESTDIR=/build
|
|
COPY script/setup/install-critools script/setup/critools-version ./
|
|
RUN GOBIN=$DESTDIR/usr/local/bin ./install-critools
|
|
|
|
# integration stage is for running integration tests.
|
|
FROM build-env AS integration
|
|
RUN apt-get update && apt-get install -y --no-install-recommends \
|
|
lsof \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
COPY --from=runc /build/ /
|
|
COPY contrib/Dockerfile.test.d/docker-entrypoint.sh /docker-entrypoint.sh
|
|
COPY . .
|
|
RUN make BUILDTAGS="no_btrfs no_devmapper" binaries install
|
|
VOLUME /tmp
|
|
# TestMain wants to unlink /var/lib/containerd-test, so the entire /var/lib has to be volumified.
|
|
VOLUME /var/lib
|
|
# The entrypoint script is needed for nesting cgroup v2.
|
|
ENTRYPOINT ["/docker-entrypoint.sh"]
|
|
CMD ["make", "integration"]
|
|
|
|
# cri-integration stage is for running cri-integration tests.
|
|
FROM integration AS cri-integration
|
|
RUN apt-get update && apt-get install -y --no-install-recommends \
|
|
sudo iptables \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
COPY --from=cni /build/ /
|
|
COPY --from=critools /build/ /
|
|
RUN make BUILDTAGS="no_btrfs no_devmapper" bin/cri-integration.test
|
|
# install-failpoint-binaries cannot be easily executed in a substage as it does not support custom DESTDIR.
|
|
RUN ./script/setup/install-failpoint-binaries
|
|
# The test scripts need these env vars to be explicitly set
|
|
ENV GITHUB_WORKSPACE=""
|
|
ENV DISABLE_CRI_SANDBOXES=""
|
|
ENV CONTAINERD_RUNTIME="io.containerd.runc.v2"
|
|
CMD ["make", "cri-integration"]
|
|
|
|
# critest stage is for running critest.
|
|
FROM cri-integration AS critest
|
|
# critest wants to create mounts under this directory, so it has to be volumified.
|
|
VOLUME /go/src/github.com/containerd/containerd
|
|
ENV TEST_RUNTIME="io.containerd.runc.v2"
|
|
CMD ["script/critest.sh", "/tmp"]
|
|
|
|
# cri-in-userns stage is for testing "CRI-in-UserNS", which should be used in conjunction with
|
|
# "Kubelet-in-UserNS": https://github.com/kubernetes/enhancements/tree/master/keps/sig-node/2033-kubelet-in-userns-aka-rootless
|
|
# This feature is mostly expected to be used for `kind` and `minikube`.
|
|
#
|
|
# Requires Rootless Docker/Podman/nerdctl with cgroup v2 delegation: https://rootlesscontaine.rs/getting-started/common/cgroup2/
|
|
# (Rootless Docker/Podman/nerdctl prepares the UserNS, so we do not need to create UserNS by ourselves)
|
|
FROM critest AS cri-in-userns
|
|
COPY contrib/Dockerfile.test.d/cri-in-userns/etc_containerd_config.toml /etc/containerd/config.toml
|
|
COPY contrib/Dockerfile.test.d/cri-in-userns/docker-entrypoint.sh /docker-entrypoint.sh
|
|
ENTRYPOINT ["/docker-entrypoint.sh"]
|
|
# Skip "runtime should support unsafe sysctls": `container init caused: write sysctl key fs.mqueue.msg_max: open /proc/sys/fs/mqueue/msg_max: permission denied`
|
|
# Skip "runtime should support safe sysctls": `container init caused: write sysctl key kernel.shm_rmid_forced: open /proc/sys/kernel/shm_rmid_forced: permission denied`
|
|
# Skip "should allow privilege escalation when (NoNewPrivis is) false": expected log "Effective uid: 0\n" (stream="stdout") not found in logs [{timestamp:{wall:974487519 ext:63761339984 loc:<nil>} stream:stdout log:Effective uid: 1000) }]
|
|
CMD ["critest", "--ginkgo.skip=should support unsafe sysctls|should support safe sysctls|should allow privilege escalation when false"]
|
|
|
|
# Install proto3
|
|
FROM golang AS proto3
|
|
ARG DESTDIR=/build
|
|
RUN apt-get update && apt-get install -y --no-install-recommends \
|
|
autoconf \
|
|
automake \
|
|
g++ \
|
|
libtool \
|
|
unzip \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
|
|
COPY script/setup/install-protobuf install-protobuf
|
|
RUN ./install-protobuf \
|
|
&& mkdir -p $DESTDIR/usr/local/bin $DESTDIR/usr/local/include \
|
|
&& mv /usr/local/bin/protoc $DESTDIR/usr/local/bin/protoc \
|
|
&& mv /usr/local/include/google $DESTDIR/usr/local/include/google
|
|
|
|
FROM build-env AS dev
|
|
COPY --from=proto3 /build/ /
|
|
COPY --from=runc /build/ /
|
|
COPY . .
|