Buildroot Archive on lore.kernel.org
 help / color / mirror / Atom feed
From: Bernd Kuhls <bernd@kuhls.net>
To: buildroot@buildroot.org
Cc: Christian Stewart <christian@aperture.us>
Subject: [Buildroot] [PATCH 5/5] package/runc: security bump version to 1.3.6
Date: Sun, 16 Aug 2026 22:32:07 +0200	[thread overview]
Message-ID: <20260816203207.3980846-5-bernd@kuhls.net> (raw)
In-Reply-To: <20260816203207.3980846-1-bernd@kuhls.net>

https://github.com/opencontainers/runc/releases/tag/v1.3.6

Fixes CVE-2026-41579.

Rebased patch due to upstream commits
https://github.com/opencontainers/runc/commit/a8e53f2c6d6d25cb3dd643cc514f118aab44b097
https://github.com/opencontainers/runc/commit/42cfcbe4533a094cbffd23d17dc355bbb25938a1

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
---
Gitlab pipelines passed:
https://gitlab.com/bkuhls/buildroot/-/commits/99b74ab8c322d7aacf9b9bee370fc273a0dc7fa5

 ...ror-checking-functions-with-their-er.patch | 31 ++-----------------
 package/runc/runc.hash                        |  2 +-
 package/runc/runc.mk                          |  2 +-
 3 files changed, 5 insertions(+), 30 deletions(-)

diff --git a/package/runc/0001-Replace-os.Is-error-checking-functions-with-their-er.patch b/package/runc/0001-Replace-os.Is-error-checking-functions-with-their-er.patch
index 4e103099f9..6664b62191 100644
--- a/package/runc/0001-Replace-os.Is-error-checking-functions-with-their-er.patch
+++ b/package/runc/0001-Replace-os.Is-error-checking-functions-with-their-er.patch
@@ -35,6 +35,8 @@ Conflicts:
   libcontainer/container_linux.go
   libcontainer/intelrdt/intelrdt.go
 Signed-off-by: Romain Naour <romain.naour@smile.fr>
+[Bernd: rebased for version 1.3.6]
+Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
 ---
  libcontainer/configs/validate/validator.go      |  6 +++---
  libcontainer/configs/validate/validator_test.go |  7 ++++---
@@ -286,16 +288,7 @@ diff --git a/libcontainer/rootfs_linux.go b/libcontainer/rootfs_linux.go
 index 31d05174..abc372f3 100644
 --- a/libcontainer/rootfs_linux.go
 +++ b/libcontainer/rootfs_linux.go
-@@ -361,7 +361,7 @@ func mountCgroupV1(m mountEntry, c *mountConfig) error {
- 			// symlink(2) is very dumb, it will just shove the path into
- 			// the link and doesn't do any checks or relative path
- 			// conversion. Also, don't error out if the cgroup already exists.
--			if err := os.Symlink(mc, filepath.Join(c.root, m.Destination, ss)); err != nil && !os.IsExist(err) {
-+			if err := os.Symlink(mc, filepath.Join(c.root, m.Destination, ss)); err != nil && !errors.Is(err, os.ErrExist) {
- 				return err
- 			}
- 		}
-@@ -613,7 +613,7 @@ func mountToRootfs(c *mountConfig, m mountEntry) error {
+@@ -625,7 +625,7 @@ func mountToRootfs(c *mountConfig, m mountEntry) error {
  			return err
  		}
  		if fi, err := os.Lstat(dest); err != nil {
@@ -304,24 +297,6 @@ index 31d05174..abc372f3 100644
  				return err
  			}
  		} else if !fi.IsDir() {
-@@ -910,7 +910,7 @@ func setupDevSymlinks(rootfs string) error {
- 			src = link[0]
- 			dst = filepath.Join(rootfs, link[1])
- 		)
--		if err := os.Symlink(src, dst); err != nil && !os.IsExist(err) {
-+		if err := os.Symlink(src, dst); err != nil && !errors.Is(err, os.ErrExist) {
- 			return err
- 		}
- 	}
-@@ -1132,7 +1132,7 @@ func setReadonly() error {
- 
- func setupPtmx(config *configs.Config) error {
- 	ptmx := filepath.Join(config.Rootfs, "dev/ptmx")
--	if err := os.Remove(ptmx); err != nil && !os.IsNotExist(err) {
-+	if err := os.Remove(ptmx); err != nil && !errors.Is(err, os.ErrNotExist) {
- 		return err
- 	}
- 	if err := os.Symlink("pts/ptmx", ptmx); err != nil {
 diff --git a/libcontainer/specconv/spec_linux_test.go b/libcontainer/specconv/spec_linux_test.go
 index 66359f79..88156516 100644
 --- a/libcontainer/specconv/spec_linux_test.go
diff --git a/package/runc/runc.hash b/package/runc/runc.hash
index d3132b1008..67511d2939 100644
--- a/package/runc/runc.hash
+++ b/package/runc/runc.hash
@@ -1,3 +1,3 @@
 # Locally computed
-sha256  72620f9b0e62d8da80c0c08a6265ab10d24330c544115c30713ba1429bde706d  runc-1.3.5-go2.tar.gz
+sha256  8816e8d4181d13012d16733e837425f5f67df57dfac28bc58a68f7dfcd54291b  runc-1.3.6-go2.tar.gz
 sha256  552a739c3b25792263f731542238b92f6f8d07e9a488eae27e6c4690038a8243  LICENSE
diff --git a/package/runc/runc.mk b/package/runc/runc.mk
index 10ff98c9d7..e0c93baeb9 100644
--- a/package/runc/runc.mk
+++ b/package/runc/runc.mk
@@ -4,7 +4,7 @@
 #
 ################################################################################
 
-RUNC_VERSION = 1.3.5
+RUNC_VERSION = 1.3.6
 RUNC_SITE = $(call github,opencontainers,runc,v$(RUNC_VERSION))
 RUNC_LICENSE = Apache-2.0, LGPL-2.1 (libseccomp)
 RUNC_LICENSE_FILES = LICENSE
-- 
2.47.3

_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot

  parent reply	other threads:[~2026-08-16 20:33 UTC|newest]

Thread overview: 10+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2026-08-16 20:32 [Buildroot] [PATCH 1/5] package/containerd: security bump version to 2.0.11 Bernd Kuhls
2026-08-16 20:32 ` [Buildroot] [PATCH 2/5] package/docker-engine: security bump to version 28.5.2 Bernd Kuhls
2026-08-16 22:15   ` Peter Korsgaard
2026-08-16 20:32 ` [Buildroot] [PATCH 3/5] package/docker-compose: bump to version 2.40.3 Bernd Kuhls
2026-08-16 22:16   ` Peter Korsgaard
2026-08-16 20:32 ` [Buildroot] [PATCH 4/5] package/docker-cli: bump version to 28.5.2 Bernd Kuhls
2026-08-16 22:15   ` Peter Korsgaard
2026-08-16 20:32 ` Bernd Kuhls [this message]
2026-08-16 22:20   ` [Buildroot] [PATCH 5/5] package/runc: security bump version to 1.3.6 Peter Korsgaard
2026-08-16 22:15 ` [Buildroot] [PATCH 1/5] package/containerd: security bump version to 2.0.11 Peter Korsgaard

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20260816203207.3980846-5-bernd@kuhls.net \
    --to=bernd@kuhls.net \
    --cc=buildroot@buildroot.org \
    --cc=christian@aperture.us \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox