MSVSphere Packaging Team
11 months ago
parent
d2fc6f07b2
commit
ad8c4a80e1
@ -1 +1 @@
|
|||||||
SOURCES/toolbox-0.0.99.4-vendored.tar.xz
|
SOURCES/toolbox-0.0.99.5-vendored.tar.xz
|
||||||
|
|||||||
@ -1 +1 @@
|
|||||||
3a2506e53c44cab54d476ee38af7197175e8af10 SOURCES/toolbox-0.0.99.4-vendored.tar.xz
|
9b8595f66d8dd76636c308426919bb81cba5498a SOURCES/toolbox-0.0.99.5-vendored.tar.xz
|
||||||
|
|||||||
@ -1,89 +0,0 @@
|
|||||||
From fc5f568c5d82f4a16982268fa67092e52be91fbe Mon Sep 17 00:00:00 2001
|
|
||||||
From: Debarshi Ray <rishi@fedoraproject.org>
|
|
||||||
Date: Tue, 28 Feb 2023 17:12:04 +0100
|
|
||||||
Subject: [PATCH] cmd/root: Don't use podman(1) when generating the completions
|
|
||||||
|
|
||||||
Ever since commit bafbbe81c9220cb3, the shell completions are generated
|
|
||||||
while building Toolbx using the 'completion' command. This involves
|
|
||||||
running toolbox(1) itself, and hence invoking 'podman version' to decide
|
|
||||||
if 'podman system migrate' is needed or not.
|
|
||||||
|
|
||||||
Unfortunately, some build environments, like Fedora's, are set up inside
|
|
||||||
a chroot(2) or systemd-nspawn(1) or similar, where 'podman version' may
|
|
||||||
not work because it does various things with namespaces(7) and clone(2)
|
|
||||||
that can, under certain circumstances, encounter an EPERM.
|
|
||||||
|
|
||||||
Therefore, it's better to avoid using podman(1) when generating the
|
|
||||||
shell completions, especially, since they are generated by Cobra itself
|
|
||||||
and podman(1) is not involved at all.
|
|
||||||
|
|
||||||
Note that podman(1) is needed when the generated shell completions are
|
|
||||||
actually used in interactive command line environments. The shell
|
|
||||||
completions invoke the hidden '__complete' command to get the results
|
|
||||||
that are presented to the user, and, if needed, 'podman system migrate'
|
|
||||||
will continue to be run as part of that.
|
|
||||||
|
|
||||||
This partially reverts commit f3e005d0142d7ec76d5ac8f0a2f331a52fd46011
|
|
||||||
because podman(1) is now only an optional runtime dependency for the
|
|
||||||
system tests.
|
|
||||||
|
|
||||||
https://github.com/containers/podman/issues/17657
|
|
||||||
---
|
|
||||||
meson.build | 2 +-
|
|
||||||
src/cmd/root.go | 9 +++++++--
|
|
||||||
2 files changed, 8 insertions(+), 3 deletions(-)
|
|
||||||
|
|
||||||
diff --git a/meson.build b/meson.build
|
|
||||||
index 6f044bb204e3..653a3d3ac588 100644
|
|
||||||
--- a/meson.build
|
|
||||||
+++ b/meson.build
|
|
||||||
@@ -18,12 +18,12 @@ subid_dep = cc.find_library('subid', has_headers: ['shadow/subid.h'])
|
|
||||||
|
|
||||||
go = find_program('go')
|
|
||||||
go_md2man = find_program('go-md2man')
|
|
||||||
-podman = find_program('podman')
|
|
||||||
|
|
||||||
bats = find_program('bats', required: false)
|
|
||||||
codespell = find_program('codespell', required: false)
|
|
||||||
htpasswd = find_program('htpasswd', required: false)
|
|
||||||
openssl = find_program('openssl', required: false)
|
|
||||||
+podman = find_program('podman', required: false)
|
|
||||||
shellcheck = find_program('shellcheck', required: false)
|
|
||||||
skopeo = find_program('skopeo', required: false)
|
|
||||||
|
|
||||||
diff --git a/src/cmd/root.go b/src/cmd/root.go
|
|
||||||
index 304b03dcd889..9975ccc7a4c8 100644
|
|
||||||
--- a/src/cmd/root.go
|
|
||||||
+++ b/src/cmd/root.go
|
|
||||||
@@ -166,7 +166,7 @@ func preRun(cmd *cobra.Command, args []string) error {
|
|
||||||
|
|
||||||
logrus.Debugf("TOOLBOX_PATH is %s", toolboxPath)
|
|
||||||
|
|
||||||
- if err := migrate(); err != nil {
|
|
||||||
+ if err := migrate(cmd, args); err != nil {
|
|
||||||
return err
|
|
||||||
}
|
|
||||||
|
|
||||||
@@ -211,13 +211,18 @@ func rootRun(cmd *cobra.Command, args []string) error {
|
|
||||||
return rootRunImpl(cmd, args)
|
|
||||||
}
|
|
||||||
|
|
||||||
-func migrate() error {
|
|
||||||
+func migrate(cmd *cobra.Command, args []string) error {
|
|
||||||
logrus.Debug("Migrating to newer Podman")
|
|
||||||
|
|
||||||
if utils.IsInsideContainer() {
|
|
||||||
return nil
|
|
||||||
}
|
|
||||||
|
|
||||||
+ if cmdName, completionCmdName := cmd.Name(), completionCmd.Name(); cmdName == completionCmdName {
|
|
||||||
+ logrus.Debugf("Migration not needed: command %s doesn't need it", cmdName)
|
|
||||||
+ return nil
|
|
||||||
+ }
|
|
||||||
+
|
|
||||||
configDir, err := os.UserConfigDir()
|
|
||||||
if err != nil {
|
|
||||||
logrus.Debugf("Migrating to newer Podman: failed to get the user config directory: %s", err)
|
|
||||||
--
|
|
||||||
2.39.1
|
|
||||||
|
|
||||||
@ -0,0 +1,54 @@
|
|||||||
|
From 4f8b443ab925c84d059d894ddcfcf4dcf66a747e Mon Sep 17 00:00:00 2001
|
||||||
|
From: Debarshi Ray <rishi@fedoraproject.org>
|
||||||
|
Date: Mon, 29 Jun 2020 17:57:47 +0200
|
||||||
|
Subject: [PATCH] build: Make the build flags match Fedora's %{gobuildflags}
|
||||||
|
for PPC64
|
||||||
|
|
||||||
|
The Go toolchain also doesn't like the LDFLAGS environment variable as
|
||||||
|
exported by Fedora's %{meson} RPM macro.
|
||||||
|
|
||||||
|
Note that these flags are only meant for the "ppc64" CPU architecture,
|
||||||
|
and should be kept updated to match Fedora's Go guidelines. Use
|
||||||
|
'rpm --eval "%{gobuildflags}"' to expand the %{gobuildflags} macro.
|
||||||
|
---
|
||||||
|
src/go-build-wrapper | 13 +++++++++----
|
||||||
|
1 file changed, 9 insertions(+), 4 deletions(-)
|
||||||
|
|
||||||
|
diff --git a/src/go-build-wrapper b/src/go-build-wrapper
|
||||||
|
index c572d6dfb02b..cae2de426a96 100755
|
||||||
|
--- a/src/go-build-wrapper
|
||||||
|
+++ b/src/go-build-wrapper
|
||||||
|
@@ -33,9 +33,9 @@ if ! cd "$1"; then
|
||||||
|
exit 1
|
||||||
|
fi
|
||||||
|
|
||||||
|
-tags=""
|
||||||
|
+tags="-tags rpm_crashtraceback,${BUILDTAGS:-}"
|
||||||
|
if $7; then
|
||||||
|
- tags="-tags migration_path_for_coreos_toolbox"
|
||||||
|
+ tags="$tags,migration_path_for_coreos_toolbox"
|
||||||
|
fi
|
||||||
|
|
||||||
|
if ! libc_dir=$("$5" --print-file-name=libc.so); then
|
||||||
|
@@ -70,11 +70,16 @@ fi
|
||||||
|
|
||||||
|
dynamic_linker="/run/host$dynamic_linker_canonical_dirname/$dynamic_linker_basename"
|
||||||
|
|
||||||
|
+unset LDFLAGS
|
||||||
|
+
|
||||||
|
# shellcheck disable=SC2086
|
||||||
|
go build \
|
||||||
|
+ -compiler gc \
|
||||||
|
$tags \
|
||||||
|
- -trimpath \
|
||||||
|
- -ldflags "-extldflags '-Wl,-dynamic-linker,$dynamic_linker -Wl,-rpath,/run/host$libc_dir_canonical_dirname' -linkmode external -X github.com/containers/toolbox/pkg/version.currentVersion=$4" \
|
||||||
|
+ -ldflags "${LDFLAGS:-} -B 0x$(head -c20 /dev/urandom|od -An -tx1|tr -d ' \n') -compressdwarf=false -extldflags '-Wl,-z,relro -Wl,--as-needed -Wl,-z,now -specs=/usr/lib/rpm/redhat/redhat-hardened-ld -specs=/usr/lib/rpm/redhat/redhat-annobin-cc1 -Wl,--build-id=sha1 -Wl,-dynamic-linker,$dynamic_linker -Wl,-rpath,/run/host$libc_dir_canonical_dirname' -linkmode external -X github.com/containers/toolbox/pkg/version.currentVersion=$4" \
|
||||||
|
+ -a \
|
||||||
|
+ -v \
|
||||||
|
+ -x \
|
||||||
|
-o "$2/$3"
|
||||||
|
|
||||||
|
exit "$?"
|
||||||
|
--
|
||||||
|
2.43.0
|
||||||
|
|
||||||
@ -0,0 +1,54 @@
|
|||||||
|
From 3175ef2fab1f61f5784361070ac338dabda3c04e Mon Sep 17 00:00:00 2001
|
||||||
|
From: Debarshi Ray <rishi@fedoraproject.org>
|
||||||
|
Date: Mon, 29 Jun 2020 17:57:47 +0200
|
||||||
|
Subject: [PATCH] build: Make the build flags match Fedora's %{gobuildflags}
|
||||||
|
|
||||||
|
The Go toolchain doesn't like the LDFLAGS environment variable as
|
||||||
|
exported by Fedora's %{meson} RPM macro.
|
||||||
|
|
||||||
|
Note that these flags are meant for every CPU architecture other than
|
||||||
|
PPC64, and should be kept updated to match Fedora's Go guidelines. Use
|
||||||
|
'rpm --eval "%{gobuildflags}"' to expand the %{gobuildflags} macro.
|
||||||
|
---
|
||||||
|
src/go-build-wrapper | 14 ++++++++++----
|
||||||
|
1 file changed, 10 insertions(+), 4 deletions(-)
|
||||||
|
|
||||||
|
diff --git a/src/go-build-wrapper b/src/go-build-wrapper
|
||||||
|
index c572d6dfb02b..0e6a2efa6853 100755
|
||||||
|
--- a/src/go-build-wrapper
|
||||||
|
+++ b/src/go-build-wrapper
|
||||||
|
@@ -33,9 +33,9 @@ if ! cd "$1"; then
|
||||||
|
exit 1
|
||||||
|
fi
|
||||||
|
|
||||||
|
-tags=""
|
||||||
|
+tags="-tags rpm_crashtraceback,${BUILDTAGS:-}"
|
||||||
|
if $7; then
|
||||||
|
- tags="-tags migration_path_for_coreos_toolbox"
|
||||||
|
+ tags="$tags,migration_path_for_coreos_toolbox"
|
||||||
|
fi
|
||||||
|
|
||||||
|
if ! libc_dir=$("$5" --print-file-name=libc.so); then
|
||||||
|
@@ -70,11 +70,17 @@ fi
|
||||||
|
|
||||||
|
dynamic_linker="/run/host$dynamic_linker_canonical_dirname/$dynamic_linker_basename"
|
||||||
|
|
||||||
|
+unset LDFLAGS
|
||||||
|
+
|
||||||
|
# shellcheck disable=SC2086
|
||||||
|
go build \
|
||||||
|
+ -buildmode pie \
|
||||||
|
+ -compiler gc \
|
||||||
|
$tags \
|
||||||
|
- -trimpath \
|
||||||
|
- -ldflags "-extldflags '-Wl,-dynamic-linker,$dynamic_linker -Wl,-rpath,/run/host$libc_dir_canonical_dirname' -linkmode external -X github.com/containers/toolbox/pkg/version.currentVersion=$4" \
|
||||||
|
+ -ldflags "${LDFLAGS:-} -B 0x$(head -c20 /dev/urandom|od -An -tx1|tr -d ' \n') -compressdwarf=false -extldflags '-Wl,-z,relro -Wl,--as-needed -Wl,-z,now -specs=/usr/lib/rpm/redhat/redhat-hardened-ld -specs=/usr/lib/rpm/redhat/redhat-annobin-cc1 -Wl,--build-id=sha1 -Wl,-dynamic-linker,$dynamic_linker -Wl,-rpath,/run/host$libc_dir_canonical_dirname' -linkmode external -X github.com/containers/toolbox/pkg/version.currentVersion=$4" \
|
||||||
|
+ -a \
|
||||||
|
+ -v \
|
||||||
|
+ -x \
|
||||||
|
-o "$2/$3"
|
||||||
|
|
||||||
|
exit "$?"
|
||||||
|
--
|
||||||
|
2.43.0
|
||||||
|
|
||||||
@ -1,76 +0,0 @@
|
|||||||
From 1cc9e07b7c36fe9f9784b40b58f0a2a3694dd328 Mon Sep 17 00:00:00 2001
|
|
||||||
From: Debarshi Ray <rishi@fedoraproject.org>
|
|
||||||
Date: Thu, 13 Jul 2023 13:08:40 +0200
|
|
||||||
Subject: [PATCH] cmd/initContainer: Be aware of security hardened mount points
|
|
||||||
|
|
||||||
Sometimes locations such as /var/lib/flatpak, /var/lib/systemd/coredump
|
|
||||||
and /var/log/journal sit on security hardened mount points that are
|
|
||||||
marked as 'nosuid,nodev,noexec' [1]. In such cases, when Toolbx is used
|
|
||||||
rootless, an attempt to bind mount these locations read-only at runtime
|
|
||||||
with mount(8) fails because of permission problems:
|
|
||||||
# mount --rbind -o ro <source> <containerPath>
|
|
||||||
mount: <containerPath>: filesystem was mounted, but any subsequent
|
|
||||||
operation failed: Unknown error 5005.
|
|
||||||
|
|
||||||
(Note that the above error message from mount(8) was subsequently
|
|
||||||
improved to show something more meaningful than 'Unknown error' [2].)
|
|
||||||
|
|
||||||
The problem is that 'init-container' is running inside the container's
|
|
||||||
mount and user namespace, and the source paths were mounted inside the
|
|
||||||
host's namespace with 'nosuid,nodev,noexec'. The above mount(8) call
|
|
||||||
tries to remove the 'nosuid,nodev,noexec' flags from the mount point and
|
|
||||||
replace them with only 'ro', which is something that can't be done from
|
|
||||||
a child namespace.
|
|
||||||
|
|
||||||
Note that this doesn't fail when Toolbx is running as root. This is
|
|
||||||
because the container uses the host's user namespace and is able to
|
|
||||||
remove the 'nosuid,nodev,noexec' flags from the mount point and replace
|
|
||||||
them with only 'ro'. Even though it doesn't fail, the flags shouldn't
|
|
||||||
get replaced like that inside the container, because it removes the
|
|
||||||
security hardening of those mount points.
|
|
||||||
|
|
||||||
There's actually no benefit in bind mounting these paths as read-only.
|
|
||||||
It was historically done this way 'just to be safe' because a user isn't
|
|
||||||
expected to write to these locations from inside a container. However,
|
|
||||||
Toolbx doesn't intend to provide any heightened security beyond what's
|
|
||||||
already available on the host.
|
|
||||||
|
|
||||||
Hence, it's better to get out of the way and leave it to the permissions
|
|
||||||
on the source location from the host operating system to guard the
|
|
||||||
castle. This is accomplished by not passing any file system options to
|
|
||||||
mount(8) [1].
|
|
||||||
|
|
||||||
Based on an idea from Si.
|
|
||||||
|
|
||||||
[1] https://man7.org/linux/man-pages/man8/mount.8.html
|
|
||||||
|
|
||||||
[2] util-linux commit 9420ca34dc8b6f0f
|
|
||||||
https://github.com/util-linux/util-linux/commit/9420ca34dc8b6f0f
|
|
||||||
https://github.com/util-linux/util-linux/pull/2376
|
|
||||||
|
|
||||||
https://github.com/containers/toolbox/issues/911
|
|
||||||
---
|
|
||||||
src/cmd/initContainer.go | 6 +++---
|
|
||||||
1 file changed, 3 insertions(+), 3 deletions(-)
|
|
||||||
|
|
||||||
diff --git a/src/cmd/initContainer.go b/src/cmd/initContainer.go
|
|
||||||
index 222aa42e1036..41b825b33f58 100644
|
|
||||||
--- a/src/cmd/initContainer.go
|
|
||||||
+++ b/src/cmd/initContainer.go
|
|
||||||
@@ -62,10 +62,10 @@ var (
|
|
||||||
{"/run/udev/data", "/run/host/run/udev/data", ""},
|
|
||||||
{"/run/udev/tags", "/run/host/run/udev/tags", ""},
|
|
||||||
{"/tmp", "/run/host/tmp", "rslave"},
|
|
||||||
- {"/var/lib/flatpak", "/run/host/var/lib/flatpak", "ro"},
|
|
||||||
+ {"/var/lib/flatpak", "/run/host/var/lib/flatpak", ""},
|
|
||||||
{"/var/lib/libvirt", "/run/host/var/lib/libvirt", ""},
|
|
||||||
- {"/var/lib/systemd/coredump", "/run/host/var/lib/systemd/coredump", "ro"},
|
|
||||||
- {"/var/log/journal", "/run/host/var/log/journal", "ro"},
|
|
||||||
+ {"/var/lib/systemd/coredump", "/run/host/var/lib/systemd/coredump", ""},
|
|
||||||
+ {"/var/log/journal", "/run/host/var/log/journal", ""},
|
|
||||||
{"/var/mnt", "/run/host/var/mnt", "rslave"},
|
|
||||||
}
|
|
||||||
)
|
|
||||||
--
|
|
||||||
2.41.0
|
|
||||||
|
|
||||||
Loading…
Reference in new issue