mirror of
https://github.com/godotengine/buildroot.git
synced 2026-01-02 21:48:20 +03:00
0251b3ab5e
Fixes the following security issues:
- CVE-2019-19921: runc volume mount race condition with shared mounts
- CVE-2019-16884: runc through 1.0.0-rc8, as used in Docker through
19.03.2-ce and other products, allows AppArmor restriction bypass because
libcontainer/rootfs_linux.go incorrectly checks mount targets, and thus a
malicious Docker image can mount over a /proc directory.
For details, see the announcement:
https://github.com/containerd/containerd/releases/tag/v1.2.12
containerd is now a separate CNCF sponsored project, and is no longer
explicitly associated with docker/moby.
Signed-off-by: Christian Stewart <christian@paral.in>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 8ebb77ac1d)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
41 lines
1.3 KiB
Makefile
41 lines
1.3 KiB
Makefile
################################################################################
|
|
#
|
|
# docker-containerd
|
|
#
|
|
################################################################################
|
|
|
|
DOCKER_CONTAINERD_VERSION = 1.2.12
|
|
DOCKER_CONTAINERD_SITE = $(call github,containerd,containerd,v$(DOCKER_CONTAINERD_VERSION))
|
|
DOCKER_CONTAINERD_LICENSE = Apache-2.0
|
|
DOCKER_CONTAINERD_LICENSE_FILES = LICENSE
|
|
|
|
DOCKER_CONTAINERD_WORKSPACE = vendor
|
|
|
|
DOCKER_CONTAINERD_LDFLAGS = \
|
|
-X github.com/docker/containerd.GitCommit=$(DOCKER_CONTAINERD_VERSION)
|
|
|
|
DOCKER_CONTAINERD_BUILD_TARGETS = cmd/ctr cmd/containerd cmd/containerd-shim
|
|
|
|
DOCKER_CONTAINERD_INSTALL_BINS = containerd containerd-shim
|
|
|
|
ifeq ($(BR2_PACKAGE_LIBSECCOMP),y)
|
|
DOCKER_CONTAINERD_DEPENDENCIES += libseccomp host-pkgconf
|
|
DOCKER_CONTAINERD_TAGS += seccomp
|
|
endif
|
|
|
|
ifeq ($(BR2_PACKAGE_DOCKER_CONTAINERD_DRIVER_BTRFS),y)
|
|
DOCKER_CONTAINERD_DEPENDENCIES += btrfs-progs
|
|
else
|
|
DOCKER_CONTAINERD_TAGS += no_btrfs
|
|
endif
|
|
|
|
define DOCKER_CONTAINERD_INSTALL_SYMLINKS
|
|
ln -fs runc $(TARGET_DIR)/usr/bin/docker-runc
|
|
ln -fs containerd-shim $(TARGET_DIR)/usr/bin/docker-containerd-shim
|
|
ln -fs containerd $(TARGET_DIR)/usr/bin/docker-containerd
|
|
endef
|
|
|
|
DOCKER_CONTAINERD_POST_INSTALL_TARGET_HOOKS += DOCKER_CONTAINERD_INSTALL_SYMLINKS
|
|
|
|
$(eval $(golang-package))
|