From a139ff7419a0b12b53e22981ae7b7522dc2ebfa1 Mon Sep 17 00:00:00 2001 From: "Eduardo Lima (Etrunko)" Date: Wed, 15 Jun 2022 11:38:10 -0300 Subject: [PATCH 1/3] osbuilder: Fix wrong config setting Resolves: rhbz#2097377 --- 15-dracut-rhel.conf | 25 ------------------------- kata-containers.spec | 20 ++++++-------------- kata-osbuilder.sh | 3 +-- 3 files changed, 7 insertions(+), 41 deletions(-) delete mode 100644 15-dracut-rhel.conf diff --git a/15-dracut-rhel.conf b/15-dracut-rhel.conf deleted file mode 100644 index 89edb10..0000000 --- a/15-dracut-rhel.conf +++ /dev/null @@ -1,25 +0,0 @@ -# Custom RHEL dracut config for kata initrd/rootfs generation - - -# Fedora: kernel drivers we want in the initrd. -drivers+=" " -# virtio vsock -drivers+="vmw_vsock_virtio_transport " -# virtio net -drivers+="virtio_net " -# virtio fs -drivers+="virtiofs " -# virtio block -drivers+="virtio_blk " -# virtio scsi -drivers+="virtio_scsi " -# virtio serial. Could be dropped eventually, vsock covers us -drivers+="virtio_console " -# vfio -drivers+="vfio-pci vfio vfio_iommu_type1 irqbypass vfio_virqfd" - - -# Fedora: extra dracut modules -dracutmodules+=" " -# These aid debugging -dracutmodules+="bash rescue " diff --git a/kata-containers.spec b/kata-containers.spec index 4e81a27..958cdad 100644 --- a/kata-containers.spec +++ b/kata-containers.spec @@ -58,7 +58,7 @@ workload isolation and security advantages of VMs. https://katacontainers.io/.} src/agent/README.md Name: %{repo} -Release: 1%{?rcrel}%{?dist} +Release: 2%{?rcrel}%{?dist} Summary: Kata Containers version 2.x repository License: ASL 2.0 Url: https://%{download} @@ -66,11 +66,7 @@ Source0: https://%{download}/archive/%{version}%{?rcstr}/%{repo}-%{version}%{ Source1: https://%{download}/releases/download/%{version}/%{repo}-%{version}%{?rcstr}-vendor.tar.gz Source2: kata-osbuilder.sh Source3: kata-osbuilder-generate.service -%if 0%{?fedora} Source4: 15-dracut-fedora.conf -%else -Source4: 15-dracut-rhel.conf -%endif Source5: 50-kata # Keep this patch downstream as it'd be hard to justify such change upstream @@ -98,9 +94,7 @@ BuildRequires: protobuf-compiler BuildRequires: dracut BuildRequires: kernel -%if 0%{?fedora} BuildRequires: busybox -%endif %if 0%{?bundled_rust_deps} BuildRequires: cargo @@ -142,9 +136,7 @@ BuildRequires: crate(rustjail/default) >= 0.0.0 BuildRequires: crate(ttrpc/default) >= 0.0.0 %endif -%if 0%{?fedora} Requires: busybox -%endif Requires: dracut Requires: kernel @@ -159,7 +151,7 @@ Conflicts: kata-runtime Conflicts: kata-shim # The following architectures lack the required qemu support -ExcludeArch: %{arm} %{ix86} s390 +ExcludeArch: %{arm} %{ix86} s390 s390x %description %{common_description} @@ -171,12 +163,8 @@ ExcludeArch: %{arm} %{ix86} s390 # The machine type uses a modern default # The kernel parameters workaround an issue with cgroupsv2 after kernel 5.3 # To-do: add BUILDFLAGS=gobuildflags when the macro becomes available -%if 0%{?fedora} %global qemu qemu-system-%{_arch} %global qemupath %{_bindir}/%{qemu} -%else -%global qemupath %{_libexecdir}/%{qemu} -%endif # The machine type to be used is architecture specific: # aarch64: virt @@ -383,6 +371,10 @@ fi %changelog +* Wed Mar 09 2022 Eduardo Lima (Etrunko) - 2.3.3-2 +- osbuilder: Fix wrong config setting + Resolves: rhbz#2097377 + * Wed Mar 09 2022 Eduardo Lima (Etrunko) - 2.3.3-1 - kata-containers-2.3.3 diff --git a/kata-osbuilder.sh b/kata-osbuilder.sh index 3fcd2d4..9ecdd52 100755 --- a/kata-osbuilder.sh +++ b/kata-osbuilder.sh @@ -170,7 +170,7 @@ generate_rootfs() # obuilder script inflexibility for now, which expect that some rootfs.sh # code is called on a fully populated distro root. - + local agent_dir="${AGENT_DIR_PREFIX}/usr/libexec/kata-containers/agent" if [ -n "${TEST_MODE}" ] ; then @@ -188,7 +188,6 @@ generate_rootfs() dracut \ --confdir "${dracut_conf_dir}" \ --no-compress \ - --conf /dev/null \ ${tmp_initrd} ${KVERSION} # Extract the generated rootfs From aa486d0b4908ccd0a767897cf19229ee47a00c98 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Robert-Andr=C3=A9=20Mauchin?= Date: Wed, 22 Jun 2022 18:11:43 +0200 Subject: [PATCH 2/3] Rebuilt for CVE-2022-1996, CVE-2022-24675, CVE-2022-28327, CVE-2022-27191, CVE-2022-29526, CVE-2022-30629 --- kata-containers.spec | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/kata-containers.spec b/kata-containers.spec index 958cdad..0fd2da9 100644 --- a/kata-containers.spec +++ b/kata-containers.spec @@ -58,7 +58,7 @@ workload isolation and security advantages of VMs. https://katacontainers.io/.} src/agent/README.md Name: %{repo} -Release: 2%{?rcrel}%{?dist} +Release: 2%{?rcrel}%{?dist}.1 Summary: Kata Containers version 2.x repository License: ASL 2.0 Url: https://%{download} @@ -371,6 +371,10 @@ fi %changelog +* Wed Jun 22 2022 Robert-André Mauchin - 2.3.3-2.1 +- Rebuilt for CVE-2022-1996, CVE-2022-24675, CVE-2022-28327, CVE-2022-27191, + CVE-2022-29526, CVE-2022-30629 + * Wed Mar 09 2022 Eduardo Lima (Etrunko) - 2.3.3-2 - osbuilder: Fix wrong config setting Resolves: rhbz#2097377 From c84e33382225626013d6a6ba16bda69e7c78d5c8 Mon Sep 17 00:00:00 2001 From: Maxwell G Date: Tue, 19 Jul 2022 14:58:43 -0500 Subject: [PATCH 3/3] Rebuild for CVE-2022-{1705,32148,30631,30633,28131,30635,30632,30630,1962} in golang --- kata-containers.spec | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/kata-containers.spec b/kata-containers.spec index 0fd2da9..9c3c498 100644 --- a/kata-containers.spec +++ b/kata-containers.spec @@ -58,7 +58,7 @@ workload isolation and security advantages of VMs. https://katacontainers.io/.} src/agent/README.md Name: %{repo} -Release: 2%{?rcrel}%{?dist}.1 +Release: 2%{?rcrel}%{?dist}.2 Summary: Kata Containers version 2.x repository License: ASL 2.0 Url: https://%{download} @@ -371,6 +371,10 @@ fi %changelog +* Tue Jul 19 2022 Maxwell G - 2.3.3-2.2 +- Rebuild for CVE-2022-{1705,32148,30631,30633,28131,30635,30632,30630,1962} in + golang + * Wed Jun 22 2022 Robert-André Mauchin - 2.3.3-2.1 - Rebuilt for CVE-2022-1996, CVE-2022-24675, CVE-2022-28327, CVE-2022-27191, CVE-2022-29526, CVE-2022-30629