5 commits

Author	SHA1	Message	Date
Akihiro Suda	6d68080907	update runc library to v1.0.0-rc10 (CVE-2019-19921) ... Notable changes: * Fix CVE-2019-19921 (Volume mount race condition with shared mounts): https://github.com/opencontainers/runc/pull/2207 * Fix exec FIFO race: https://github.com/opencontainers/runc/pull/2185 * Basic support for cgroup v2. Almost feature-complete, but still missing support for systemd mode in rootless. See also https://github.com/opencontainers/runc/issues/2209 for the known issues. Full changes: https://github.com/opencontainers/runc/compare/v1.0.0-rc9...v1.0.0-rc10 Also updates go-selinux: 3a1f366feb...5215b1806f (See https://github.com/containerd/cri/pull/1383#issuecomment-578227009) Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>	2020-01-25 04:06:24 +09:00
Sebastiaan van Stijn	f43826c433	bump opencontainers/selinux to v1.2 ... Signed-off-by: Sebastiaan van Stijn <github@gone.nl>	2019-03-21 10:10:05 +01:00
Sebastiaan van Stijn	31a9c9e791	Update containerd dependencies ... This updates the containerd dependencies to match the versions used by the vendored containerd version Signed-off-by: Sebastiaan van Stijn <github@gone.nl>	2018-10-04 15:19:53 +02:00
Sebastiaan van Stijn	73c8238614	bump opencontainers/selinux to b29023b86e4a69d1b46b7e7b4e2b6fda03f0b9cd ... This vendoring fixes two issues. 1. When a user specifies an SELinux MCS Label (level) to override moby picking an unigue MCS label, the code currently picks a label then overrides with the user selected. This works fine, except the unique MCS Label is leaked and will not be used until the daemon is restarted. 2. The override label, is not reserved. This could potentially cause an issue where the daemon could pick the same MCS Label again for a different container. (~ 1/500,000 Chance). The updated selinux go bindings, now release the overriden unigue label, and reserve the one specified by the user. Signed-off-by: Sebastiaan van Stijn <github@gone.nl>	2017-10-31 16:54:16 +01:00
Antonio Murdaca	abbbf91498	Switch to using opencontainers/selinux for selinux bindings ... Signed-off-by: Antonio Murdaca <runcom@redhat.com>	2017-04-24 21:29:47 +02:00

Renamed from vendor/github.com/opencontainers/runc/libcontainer/label/label_selinux.go (Browse further)