Ubuntu import 1.0-rc93

debian/changelog

@@ -1,3 +1,17 @@
+runc (1.0.0~rc93-0ubuntu1) UNRELEASED; urgency=medium
+
+  * New upstream release (LP: #1919182).
+    - runc now has special handling for seccomp profiles to avoid making new
+      syscalls unusable for glibc (LP: #1916485).
+  * Remove patch addressing a bug fixed by upstream:
+    - debian/patches/test--fix_TestGetAdditionalGroups.patch
+  * Refresh patch:
+    - debian/patches/test--skip-fs-related-cgroups-test.patch
+  * Backport upstream patch to fix patchpbf test on armhf:
+    - debian/patches/fix-patchpbf-test-on-32-bit.patch
+
+ -- Lucas Kanashiro <kanashiro@ubuntu.com>  Tue, 10 Mar 2021 09:30:36 -0300
+
 runc (1.0.0~rc92-0ubuntu1) hirsute; urgency=medium
 
   * New upstream release.

debian/patches/fix-patchpbf-test-on-32-bit.patch

@@ -0,0 +1,74 @@
+From: Aleksa Sarai <asarai@suse.de>
+Date: Tue, 2 Feb 2021 16:30:59 -0800
+Subject: fix patchpbf test on 32-bit
+
+Origin: https://github.com/opencontainers/runc/pull/2768/commits/47a96495208f5dfdceabc1a2acbfa1c0517aac80
+Reviewed-By: Lucas Kanashiro <kanashiro@ubuntu.com>
+Last-Updated: 2021-03-12
+---
+ libcontainer/seccomp/patchbpf/enosys_linux_test.go | 17 ++++++++++-------
+ 1 file changed, 10 insertions(+), 7 deletions(-)
+
+diff --git a/libcontainer/seccomp/patchbpf/enosys_linux_test.go b/libcontainer/seccomp/patchbpf/enosys_linux_test.go
+index 17b92af..f9a4bf6 100644
+--- a/libcontainer/seccomp/patchbpf/enosys_linux_test.go
++++ b/libcontainer/seccomp/patchbpf/enosys_linux_test.go
+@@ -159,7 +159,7 @@ func testEnosysStub(t *testing.T, defaultAction configs.Action, arches []string)
+ 			type syscallTest struct {
+ 				syscall  string
+ 				sysno    libseccomp.ScmpSyscall
+-				expected int
++				expected uint32
+ 			}
+
+ 			scmpArch, err := libseccomp.GetArchFromString(arch)
+@@ -177,9 +177,9 @@ func testEnosysStub(t *testing.T, defaultAction configs.Action, arches []string)
+ 			// Add explicit syscalls (whether they will return -ENOSYS
+ 			// depends on the filter rules).
+ 			for idx, syscall := range explicitSyscalls {
+-				expected := int(retFallthrough)
++				expected := retFallthrough
+ 				if idx >= enosysStart {
+-					expected = int(retErrnoEnosys)
++					expected = retErrnoEnosys
+ 				}
+ 				sysno, err := libseccomp.GetSyscallFromNameByArch(syscall, scmpArch)
+ 				if err != nil {
+@@ -201,7 +201,7 @@ func testEnosysStub(t *testing.T, defaultAction configs.Action, arches []string)
+ 				syscallTests = append(syscallTests, syscallTest{
+ 					sysno:    sysno,
+ 					syscall:  syscall,
+-					expected: int(retFallthrough),
++					expected: retFallthrough,
+ 				})
+ 			}
+
+@@ -216,7 +216,7 @@ func testEnosysStub(t *testing.T, defaultAction configs.Action, arches []string)
+ 				syscallTests = append(syscallTests, syscallTest{
+ 					sysno:    sysno,
+ 					syscall:  fmt.Sprintf("syscall_%#x", sysno),
+-					expected: int(retErrnoEnosys),
++					expected: retErrnoEnosys,
+ 				})
+ 			}
+
+@@ -224,14 +224,17 @@ func testEnosysStub(t *testing.T, defaultAction configs.Action, arches []string)
+ 			for _, test := range syscallTests {
+ 				// Override the expected value in the two special cases.
+ 				if !archSet[arch] || isAllowAction(defaultAction) {
+-					test.expected = int(retFallthrough)
++					test.expected = retFallthrough
+ 				}
+
+ 				payload := mockSyscallPayload(t, test.sysno, nativeArch, 0x1337, 0xF00BA5)
+-				ret, err := filter.Run(payload)
++				// NOTE: golang.org/x/net/bpf returns int here rather
++				// than uint32.
++				rawRet, err := filter.Run(payload)
+ 				if err != nil {
+ 					t.Fatalf("error running filter: %v", err)
+ 				}
++				ret := uint32(rawRet)
+ 				if ret != test.expected {
+ 					t.Logf("mock filter for %v %v:", arches, allowedSyscalls)
+ 					for idx, insn := range program {

debian/patches/series

@@ -1,4 +1,4 @@
-test--fix_TestGetAdditionalGroups.patch
 test--skip-Hugetlb.patch
 test--skip_TestFactoryNewTmpfs.patch
 test--skip-fs-related-cgroups-tests.patch
+fix-patchpbf-test-on-32-bit.patch

debian/patches/test--skip-fs-related-cgroups-tests.patch

@@ -4,7 +4,7 @@ Description: Skip tests which rely on cgroups mountpoints on the filesystem
  are failing.
 Author: Lucas Kanashiro <kanashiro@ubuntu.com>
 Forwarded: not-needed
-Last-Updated: 2021-01-12
+Last-Updated: 2021-03-10
 
 --- a/libcontainer/cgroups/fs/fs_test.go
 +++ b/libcontainer/cgroups/fs/fs_test.go
@@ -16,63 +16,7 @@ Last-Updated: 2021-01-12
  	if cgroups.IsCgroup2UnifiedMode() {
  		t.Skip("cgroup v2 is not supported")
  	}
-@@ -46,6 +47,7 @@
- }
-
- func TestInvalidAbsoluteCgroupPath(t *testing.T) {
-+	t.Skip("UM - SIGSEGV due to invalid memory access")
- 	if cgroups.IsCgroup2UnifiedMode() {
- 		t.Skip("cgroup v2 is not supported")
- 	}
-@@ -81,6 +83,7 @@
-
- // XXX: Remove me after we get rid of configs.Cgroup.Name and configs.Cgroup.Parent.
- func TestInvalidCgroupParent(t *testing.T) {
-+	t.Skip("UM - SIGSEGV due to invalid memory access")
- 	if cgroups.IsCgroup2UnifiedMode() {
- 		t.Skip("cgroup v2 is not supported")
- 	}
-@@ -117,6 +120,7 @@
-
- // XXX: Remove me after we get rid of configs.Cgroup.Name and configs.Cgroup.Parent.
- func TestInvalidAbsoluteCgroupParent(t *testing.T) {
-+	t.Skip("UM - SIGSEGV due to invalid memory access")
- 	if cgroups.IsCgroup2UnifiedMode() {
- 		t.Skip("cgroup v2 is not supported")
- 	}
-@@ -153,6 +157,7 @@
-
- // XXX: Remove me after we get rid of configs.Cgroup.Name and configs.Cgroup.Parent.
- func TestInvalidCgroupName(t *testing.T) {
-+	t.Skip("UM - SIGSEGV due to invalid memory access")
- 	if cgroups.IsCgroup2UnifiedMode() {
- 		t.Skip("cgroup v2 is not supported")
- 	}
-@@ -190,6 +195,7 @@
-
- // XXX: Remove me after we get rid of configs.Cgroup.Name and configs.Cgroup.Parent.
- func TestInvalidAbsoluteCgroupName(t *testing.T) {
-+	t.Skip("UM - SIGSEGV due to invalid memory access")
- 	if cgroups.IsCgroup2UnifiedMode() {
- 		t.Skip("cgroup v2 is not supported")
- 	}
-@@ -226,6 +232,7 @@
-
- // XXX: Remove me after we get rid of configs.Cgroup.Name and configs.Cgroup.Parent.
- func TestInvalidCgroupNameAndParent(t *testing.T) {
-+	t.Skip("UM - SIGSEGV due to invalid memory access")
- 	if cgroups.IsCgroup2UnifiedMode() {
- 		t.Skip("cgroup v2 is not supported")
- 	}
-@@ -262,6 +269,7 @@
-
- // XXX: Remove me after we get rid of configs.Cgroup.Name and configs.Cgroup.Parent.
- func TestInvalidAbsoluteCgroupNameAndParent(t *testing.T) {
-+	t.Skip("UM - SIGSEGV due to invalid memory access")
- 	if cgroups.IsCgroup2UnifiedMode() {
- 		t.Skip("cgroup v2 is not supported")
- 	}
-@@ -297,6 +305,7 @@
+@@ -93,6 +94,7 @@
  }
 
  func TestTryDefaultCgroupRoot(t *testing.T) {
@@ -82,11 +26,11 @@ Last-Updated: 2021-01-12
  	if cgroups.IsCgroup2UnifiedMode() {
 --- a/libcontainer/cgroups/fscommon/fscommon_test.go
 +++ b/libcontainer/cgroups/fscommon/fscommon_test.go
-@@ -14,6 +14,7 @@
+@@ -12,6 +12,7 @@
  )
 
  func TestWriteCgroupFileHandlesInterrupt(t *testing.T) {
 +	t.Skip("UM - No cgroup mountpoint in memory during build time")
- 	if cgroups.IsCgroup2UnifiedMode() {
- 		t.Skip("cgroup v2 is not supported")
- 	}
+ 	const (
+ 		memoryCgroupMount = "/sys/fs/cgroup/memory"
+ 		memoryLimit       = "memory.limit_in_bytes"