diff --git a/.fmf/version b/.fmf/version new file mode 100644 index 0000000..d00491f --- /dev/null +++ b/.fmf/version @@ -0,0 +1 @@ +1 diff --git a/.gitignore b/.gitignore index d704cea..fab44b7 100644 --- a/.gitignore +++ b/.gitignore @@ -57,3 +57,7 @@ /criu-3.18.tar.gz /criu-3.19.tar.gz /criu-4.0.tar.gz +/criu-4.1.tar.gz +/criu-4.1.1.tar.gz +/criu-4.2.tar.gz +/criu-4.2.1.tar.gz diff --git a/Makefile.config-set-CR_PLUGIN_DEFAULT-variable.patch b/Makefile.config-set-CR_PLUGIN_DEFAULT-variable.patch deleted file mode 100644 index 7f9584d..0000000 --- a/Makefile.config-set-CR_PLUGIN_DEFAULT-variable.patch +++ /dev/null @@ -1,49 +0,0 @@ -From bb35901e78216917ce8066fa805ce27f273d76a2 Mon Sep 17 00:00:00 2001 -From: Radostin Stoyanov -Date: Thu, 26 Sep 2024 10:59:32 +0100 -Subject: [PATCH] Makefile.config: set CR_PLUGIN_DEFAULT variable - -By default, CRIU uses the path "/usr/lib/criu" to install and load -plugins at runtime. This path is defined by the `PLUGINDIR` variable -in Makefile.install and `CR_PLUGIN_DEFAULT` in `criu/include/plugin.h`. -However, some distribution packages might install the CRIU plugins at -"/usr/lib64/criu" instead. This patch updates the makefile to align -the path defined by `CR_PLUGIN_DEFAULT` with the value of `PLUGINDIR`. - -Signed-off-by: Radostin Stoyanov ---- - Makefile.config | 4 ++++ - plugins/amdgpu/Makefile | 2 +- - 2 files changed, 5 insertions(+), 1 deletion(-) - -diff --git a/Makefile.config b/Makefile.config -index 52c250b21..5ab689d41 100644 ---- a/Makefile.config -+++ b/Makefile.config -@@ -59,6 +59,10 @@ endif - - export LIBS += $(LIBS_FEATURES) - -+ifneq ($(PLUGINDIR),) -+ FEATURE_DEFINES += -DCR_PLUGIN_DEFAULT="\"$(PLUGINDIR)\"" -+endif -+ - CONFIG_FILE = .config - - $(CONFIG_FILE): -diff --git a/plugins/amdgpu/Makefile b/plugins/amdgpu/Makefile -index 7d3388b80..a20d1d163 100644 ---- a/plugins/amdgpu/Makefile -+++ b/plugins/amdgpu/Makefile -@@ -15,7 +15,7 @@ DEPS_NOK := ; - __nmk_dir ?= ../../scripts/nmk/scripts/ - include $(__nmk_dir)msg.mk - --PLUGIN_CFLAGS := -g -Wall -Werror -D _GNU_SOURCE -shared -nostartfiles -fPIC -DCR_PLUGIN_DEFAULT="$(PLUGINDIR)" -+PLUGIN_CFLAGS := -g -Wall -Werror -D _GNU_SOURCE -shared -nostartfiles -fPIC - PLUGIN_LDFLAGS := -lpthread -lrt -ldrm -ldrm_amdgpu - - ifeq ($(CONFIG_AMDGPU),y) --- -2.46.1 - diff --git a/criu.spec b/criu.spec index 10c8c87..7102dfa 100644 --- a/criu.spec +++ b/criu.spec @@ -1,18 +1,19 @@ %global py_prefix python3 %global py_binary %{py_prefix} -# With annobin enabled, CRIU does not work anymore. It seems CRIU's -# parasite code breaks if annobin is enabled. +# CRIU's parasite/restorer code (criu/pie/) is compiled with its own CFLAGS +# that already disable hardening (-fno-stack-protector, -U_FORTIFY_SOURCE, +# -D_FORTIFY_SOURCE=0, -nostdlib). Standard RHEL hardening flags (PIE, RELRO, +# FORTIFY_SOURCE, stack protector) only affect the main criu binary and libs. +# +# Annobin remains disabled because its instrumentation gets injected into +# every compilation unit including parasite code, and there is no per-target +# way to exclude it through the Makefile. %undefine _annotated_build -# Disable automatic call to the set_build_flags macro -# at the beginning of the build, check, and install. -# This change was introduced in Fedora 36. -%undefine _auto_set_build_flags - Name: criu -Version: 4.0 -Release: 1%{?dist} +Version: 4.2.1 +Release: 2%{?dist} Summary: Tool for Checkpoint/Restore in User-space License: GPL-2.0-only AND LGPL-2.1-only AND MIT URL: http://criu.org/ @@ -23,8 +24,6 @@ Source0: https://github.com/checkpoint-restore/criu/archive/v%{version}/criu-%{v # in RPM and DEB is different. Patch99: criu.pc.patch -Patch100: Makefile.config-set-CR_PLUGIN_DEFAULT-variable.patch - Source5: criu-tmpfiles.conf BuildRequires: gcc @@ -33,25 +32,26 @@ BuildRequires: libnet-devel BuildRequires: protobuf-devel protobuf-c-devel %{py_prefix}-devel libnl3-devel libcap-devel BuildRequires: %{py_prefix}-pip BuildRequires: %{py_prefix}-setuptools -BuildRequires: %{py_prefix}-wheel +BuildRequires: (%{py_prefix}-wheel if %{py_prefix}-setuptools < 71) BuildRequires: %{py_prefix}-protobuf BuildRequires: asciidoctor BuildRequires: perl-interpreter BuildRequires: libselinux-devel BuildRequires: gnutls-devel BuildRequires: libdrm-devel +BuildRequires: libuuid-devel +BuildRequires: nftables-devel # Checkpointing containers with a tmpfs requires tar Recommends: tar %if 0%{?fedora} BuildRequires: libbsd-devel -BuildRequires: nftables-devel %endif BuildRequires: make # user-space and kernel changes are only available for x86_64, arm, # ppc64le, aarch64 and s390x # https://bugzilla.redhat.com/show_bug.cgi?id=902875 -ExclusiveArch: x86_64 %{arm} ppc64le aarch64 s390x +ExclusiveArch: x86_64 %{arm} ppc64le aarch64 s390x riscv64 %description criu is the user-space part of Checkpoint/Restore in User-space @@ -116,28 +116,42 @@ This script can help to workaround the so called "PID mismatch" problem. %setup -q %patch -P 99 -p1 -%patch -P 100 -p1 - %build # This package calls LD directly without specifying the LTO plugins. Until # that is fixed, disable LTO. %define _lto_cflags %{nil} +# CRIU's nmk build system calls ld directly for intermediate partial linking +# (ld -r). RHEL LDFLAGS contain -specs= options that only gcc understands; +# raw ld rejects them. Create a wrapper that strips -specs= for direct ld +# calls. The final criu binary link uses gcc (CC), not ld, so it still gets +# full hardening (-pie, -z relro, -z now) from the spec files. +mkdir -p %{_builddir}/bin +cat > %{_builddir}/bin/ld << 'LDWRAPPER' +#!/bin/sh +for arg do + shift + case "$arg" in -specs=*) continue ;; esac + set -- "$@" "$arg" +done +exec /usr/bin/ld "$@" +LDWRAPPER +chmod +x %{_builddir}/bin/ld + # %{?_smp_mflags} does not work -# -fstack-protector breaks build -CFLAGS+=`echo %{optflags} | sed -e 's,-fstack-protector\S*,,g'` make V=1 WERROR=0 PREFIX=%{_prefix} RUNDIR=/run/criu PYTHON=%{py_binary} PLUGINDIR=%{_libdir}/criu +CFLAGS+="%{optflags}" make V=1 WERROR=0 LD=%{_builddir}/bin/ld PREFIX=%{_prefix} RUNDIR=/run/criu PYTHON=%{py_binary} PLUGINDIR=%{_libdir}/criu NETWORK_LOCK_DEFAULT=NETWORK_LOCK_NFTABLES make V=1 WERROR=0 PREFIX=%{_prefix} PLUGINDIR=%{_libdir}/criu amdgpu_plugin make docs V=1 %install sed -e "s,--upgrade --ignore-installed,--no-index --no-deps -v --no-build-isolation,g" -i lib/Makefile -i crit/Makefile -make install-criu DESTDIR=$RPM_BUILD_ROOT PREFIX=%{_prefix} LIBDIR=%{_libdir} -make install-lib DESTDIR=$RPM_BUILD_ROOT PREFIX=%{_prefix} LIBDIR=%{_libdir} PYTHON=%{py_binary} PIPFLAGS="--no-build-isolation --no-index --no-deps --progress-bar off --upgrade --ignore-installed" -make install-amdgpu_plugin DESTDIR=$RPM_BUILD_ROOT PREFIX=%{_prefix} LIBDIR=%{_libdir} PLUGINDIR=%{_libdir}/criu -make install-cuda_plugin DESTDIR=$RPM_BUILD_ROOT PREFIX=%{_prefix} LIBDIR=%{_libdir} PLUGINDIR=%{_libdir}/criu -make install-crit DESTDIR=$RPM_BUILD_ROOT PREFIX=%{_prefix} LIBDIR=%{_libdir} PYTHON=%{py_binary} PIPFLAGS="--no-build-isolation --no-index --no-deps --progress-bar off --upgrade --ignore-installed" -make install-man DESTDIR=$RPM_BUILD_ROOT PREFIX=%{_prefix} LIBDIR=%{_libdir} +make install-criu LD=%{_builddir}/bin/ld DESTDIR=$RPM_BUILD_ROOT PREFIX=%{_prefix} LIBDIR=%{_libdir} BINDIR=%{_bindir} SBINDIR=%{_sbindir} +make install-lib LD=%{_builddir}/bin/ld DESTDIR=$RPM_BUILD_ROOT PREFIX=%{_prefix} LIBDIR=%{_libdir} PYTHON=%{py_binary} PIPFLAGS="--no-build-isolation --no-index --no-deps --progress-bar off --upgrade --ignore-installed" +make install-amdgpu_plugin LD=%{_builddir}/bin/ld DESTDIR=$RPM_BUILD_ROOT PREFIX=%{_prefix} LIBDIR=%{_libdir} PLUGINDIR=%{_libdir}/criu +make install-cuda_plugin LD=%{_builddir}/bin/ld DESTDIR=$RPM_BUILD_ROOT PREFIX=%{_prefix} LIBDIR=%{_libdir} PLUGINDIR=%{_libdir}/criu +make install-crit LD=%{_builddir}/bin/ld DESTDIR=$RPM_BUILD_ROOT PREFIX=%{_prefix} LIBDIR=%{_libdir} BINDIR=%{_bindir} SBINDIR=%{_sbindir} PYTHON=%{py_binary} PIPFLAGS="--no-build-isolation --no-index --no-deps --progress-bar off --upgrade --ignore-installed" +make install-man LD=%{_builddir}/bin/ld DESTDIR=$RPM_BUILD_ROOT PREFIX=%{_prefix} LIBDIR=%{_libdir} rm -f $RPM_BUILD_ROOT%{_mandir}/man1/compel.1 mkdir -p %{buildroot}%{_tmpfilesdir} @@ -188,6 +202,90 @@ rm -f $RPM_BUILD_ROOT%{_libdir}/libcriu.a %tmpfiles_create %{name}.conf %changelog +* Wed Jul 22 2026 Python Maint - 4.2.1-2 +- Rebuilt for Python 3.15.0b4 ABI change + +* Tue Jul 21 2026 Radostin Stoyanov - 4.2.1-1 +- Update to 4.2.1 +- Drop patches merged upstream + +* Wed Jul 15 2026 Fedora Release Engineering - 4.2-22 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_45_Mass_Rebuild + +* Mon Jul 06 2026 Adrian Reber - 4.2-21 +- One more test only patch for linux 7.1 + +* Wed Jun 03 2026 Python Maint - 4.2-20 +- Rebuilt for Python 3.15 + +* Thu May 28 2026 Miroslav Suchy - 4.2-19 +- rebuild for https://fedoraproject.org/wiki/Changes/Protobuf_5.x/6.x + +* Wed Apr 22 2026 Adrian Reber - 4.2-18 +- Route veth restore through usernsd for userns mode (upstream PR#3006) +- Fix rseq01 test for kernel 7.0 rseq changes (upstream PR#3007) +- Handle UDPLITE removal in kernel 7.1 (upstream PR#3003) + +* Thu Mar 26 2026 Adrian Reber - 4.2-17 +- Always use nftables network locking backend + +* Tue Mar 03 2026 Adrian Reber - 4.2-16 +- Fix tty compiler error (const qualifier warning) + +* Tue Mar 03 2026 Adrian Reber - 4.2-15 +- Fix rseq build failure with latest glibc in rawhide + +* Mon Mar 02 2026 Christopher Lusk - 4.2-14 +- Re-enable binary hardening flags for main binary + +* Fri Jan 16 2026 Fedora Release Engineering - 4.2-13 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild + +* Fri Jan 16 2026 Fedora Release Engineering - 4.2-12 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild + +* Mon Nov 17 2025 Cristian Le - 4.2-11 +- Convert STI tests to TMT (rhbz#2382879) + +* Mon Nov 17 2025 Adrian Reber - 4.2-5 +- Update to 4.2 + +* Fri Sep 19 2025 Python Maint - 4.1.1-4 +- Rebuilt for Python 3.14.0rc3 bytecode + +* Wed Aug 27 2025 Miro Hrončok - 4.1.1-3 +- Drop unused BuildRequires on python3-wheel + +* Fri Aug 15 2025 Python Maint - 4.1.1-2 +- Rebuilt for Python 3.14.0rc2 bytecode + +* Wed Jul 30 2025 Adrian Reber - 4.1.1-1 +- Update to 4.1.1 + +* Wed Jul 23 2025 Fedora Release Engineering - 4.1-5 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild + +* Tue Jun 17 2025 Python Maint - 4.1-4 +- Rebuilt for Python 3.14 + +* Wed Apr 23 2025 David Abdurachmanov - 4.1-3 +- Enable for riscv64 + +* Mon Apr 21 2025 Adrian Reber - 4.1-2 +- Apply upstream patch to fix a runc regression + +* Mon Apr 07 2025 Radostin Stoyanov - 4.1-1 +- Update to 4.1 + +* Thu Jan 16 2025 Fedora Release Engineering - 4.0-4 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild + +* Sun Dec 08 2024 Radostin Stoyanov - 4.0-3 +- Apply patch to handle vvar_vclock vma-s in rawhide + +* Thu Oct 17 2024 Adrian Reber - 4.0-2 +- Recommends: iptables + * Thu Sep 26 2024 Radostin Stoyanov - 4.0-1 - Update to 4.0 - Add package for cuda-plugin diff --git a/plans.fmf b/plans.fmf new file mode 100644 index 0000000..946731e --- /dev/null +++ b/plans.fmf @@ -0,0 +1,21 @@ +summary: Run all tests +discover: + how: fmf +prepare: + - name: Install the main package + how: install + package: + - criu +execute: + how: tmt + +/zdtm: + # Use the srpm sources + discover+: + dist-git-source: true + dist-git-merge: true + test: /tests/zdtm + +/podman: + discover+: + test: /tests/podman diff --git a/rpminspect.yaml b/rpminspect.yaml new file mode 100644 index 0000000..70daeea --- /dev/null +++ b/rpminspect.yaml @@ -0,0 +1,4 @@ +--- +annocheck: + jobs: + - hardened: --verbose --skip-dynamic-tags --skip-property-note --skip-bind-now --skip-pie --skip-cf-protection --skip-notes --skip-gaps --skip-optimization --skip-stack-clash --skip-stack-prot --skip-branch-protection diff --git a/sources b/sources index 8b4fba8..0744768 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (criu-4.0.tar.gz) = 38a3ae353385b1cc4e63f9b317af67bea88d67322e549cf87501873d59bdcc50e92f9c2ef85c736973c551520a91f579f80a010871d245b1a43a29f9fc69b1ab +SHA512 (criu-4.2.1.tar.gz) = 73a4f5d9e6af2d07c0b234201cce09a827dcb1dcb1b1095cb3944a0a37dd34f4d5ef3ce34e12568c38dff2b517809e64aff55be605e934d2ab39daa659ca9a97 diff --git a/tests/tests.yml b/tests/main.fmf similarity index 54% rename from tests/tests.yml rename to tests/main.fmf index 995fd2d..a743210 100644 --- a/tests/tests.yml +++ b/tests/main.fmf @@ -1,16 +1,8 @@ ---- -- hosts: localhost - roles: - - role: standard-test-source - tags: - - classic - - role: standard-test-basic - tags: - - classic - required_packages: - - podman - - curl - - jq +/zdtm: + summary: Test zdtm + test: ./run-zdtm.sh + duration: 30m + require: - checkpolicy - policycoreutils - make @@ -24,14 +16,17 @@ - libnl3-devel - libcap-devel - libaio-devel + - libuuid-devel - nftables-devel - python3-pyyaml - python3-protobuf - python-unversioned-command - tests: - - zdtm: - dir: . - run: ./run-zdtm.sh - - podman: - dir: . - run: ./run-podman-checkpoint-restore.sh + - crit + - python3-criu +/podman: + summary: Test podman + test: ./run-podman-checkpoint-restore.sh + require: + - podman + - curl + - jq diff --git a/tests/run-podman-checkpoint-restore.sh b/tests/run-podman-checkpoint-restore.sh index 845d0b4..6ed7ad6 100755 --- a/tests/run-podman-checkpoint-restore.sh +++ b/tests/run-podman-checkpoint-restore.sh @@ -3,6 +3,9 @@ set -eux ls -la +uname -a +rpm -qi criu || true +criu --version echo "Start container" podman --log-level debug run -d quay.io/adrianreber/counter diff --git a/tests/run-zdtm.sh b/tests/run-zdtm.sh index 460d090..ab046e1 100755 --- a/tests/run-zdtm.sh +++ b/tests/run-zdtm.sh @@ -3,6 +3,8 @@ set -xe uname -a +rpm -qi criu || true +criu --version # These zdtm tests are skipped because they fail only in CI system EXCLUDES=" \ @@ -13,6 +15,19 @@ EXCLUDES=" \ -x zdtm/static/socket-tcp4v6-closed \ -x zdtm/static/maps01 \ -x zdtm/static/maps04 \ + -x zdtm/static/del_standalone_un \ + -x zdtm/static/del_standalone_un_seqpacket \ + -x zdtm/static/deleted_unix_sock \ + -x zdtm/static/fifo_upon_unix_socket00 \ + -x zdtm/static/sk-unix-dgram-ghost \ + -x zdtm/static/sk-unix01 \ + -x zdtm/static/sk-unix01-seqpacket \ + -x zdtm/static/socket-tcpbuf \ + -x zdtm/static/socket-tcpbuf6 \ + -x zdtm/static/sockets00 \ + -x zdtm/static/sockets00-seqpacket \ + -x zdtm/static/sockets03 \ + -x zdtm/static/sockets03-seqpacket \ -x zdtm/static/cgroup04 \ -x zdtm/static/cgroup_ifpriomap \ -x zdtm/static/netns_sub \ @@ -33,10 +48,10 @@ run_test() { RESULT=42 -# this socket brakes CRIU's test cases +# this socket breaks CRIU's test cases rm -f /var/lib/sss/pipes/nss -cd "source/criu-$(crit --version)/" +cd ../criu-$(crit --version) echo "Build CRIU" make -j"$(nproc)"