From 81d043a98ca268d72bbefcd36b2908e3ab4d380a Mon Sep 17 00:00:00 2001
From: "Louise K. Schmidtgen"
 <107889048+louiseschmidtgen@users.noreply.github.com>
Date: Thu, 8 Feb 2024 08:30:05 +0100
Subject: [PATCH] Bump containerd to v1.6.28 and runc to v.1.1.12 (#4398)

* update containerd and runc versions

* runc strict patches
---
 .../components/containerd/version.sh          |  2 +-
 ...ange-profile-immediately-not-on-exec.patch |  0
 ...-set-the-NNP-flag-after-changing-the.patch | 47 ++++++++++++++++
 ...nux-change-AppArmor-profile-as-late-.patch | 54 +++++++++++++++++++
 ...ange-profile-immediately-not-on-exec.patch | 36 +++++++++++++
 ...-set-the-NNP-flag-after-changing-the.patch |  0
 ...nux-change-AppArmor-profile-as-late-.patch |  0
 build-scripts/components/runc/version.sh      |  2 +-
 8 files changed, 139 insertions(+), 2 deletions(-)
 rename build-scripts/components/runc/strict-patches/{default => v1.1.12}/0001-apparmor-change-profile-immediately-not-on-exec.patch (100%)
 create mode 100644 build-scripts/components/runc/strict-patches/v1.1.12/0002-setns_init_linux-set-the-NNP-flag-after-changing-the.patch
 create mode 100644 build-scripts/components/runc/strict-patches/v1.1.12/0003-standard_init_linux-change-AppArmor-profile-as-late-.patch
 create mode 100644 build-scripts/components/runc/strict-patches/v1.1.4/0001-apparmor-change-profile-immediately-not-on-exec.patch
 rename build-scripts/components/runc/strict-patches/{default => v1.1.4}/0002-setns_init_linux-set-the-NNP-flag-after-changing-the.patch (100%)
 rename build-scripts/components/runc/strict-patches/{default => v1.1.4}/0003-standard_init_linux-change-AppArmor-profile-as-late-.patch (100%)

diff --git a/build-scripts/components/containerd/version.sh b/build-scripts/components/containerd/version.sh
index fd83aba7c9..151d227ac7 100755
--- a/build-scripts/components/containerd/version.sh
+++ b/build-scripts/components/containerd/version.sh
@@ -1,3 +1,3 @@
 #!/bin/bash
 
-echo "v1.6.15"
+echo "v1.6.28"
diff --git a/build-scripts/components/runc/strict-patches/default/0001-apparmor-change-profile-immediately-not-on-exec.patch b/build-scripts/components/runc/strict-patches/v1.1.12/0001-apparmor-change-profile-immediately-not-on-exec.patch
similarity index 100%
rename from build-scripts/components/runc/strict-patches/default/0001-apparmor-change-profile-immediately-not-on-exec.patch
rename to build-scripts/components/runc/strict-patches/v1.1.12/0001-apparmor-change-profile-immediately-not-on-exec.patch
diff --git a/build-scripts/components/runc/strict-patches/v1.1.12/0002-setns_init_linux-set-the-NNP-flag-after-changing-the.patch b/build-scripts/components/runc/strict-patches/v1.1.12/0002-setns_init_linux-set-the-NNP-flag-after-changing-the.patch
new file mode 100644
index 0000000000..2b9ac883bd
--- /dev/null
+++ b/build-scripts/components/runc/strict-patches/v1.1.12/0002-setns_init_linux-set-the-NNP-flag-after-changing-the.patch
@@ -0,0 +1,47 @@
+From 5351ef6f5b592472e077512714b2516cdbae1b51 Mon Sep 17 00:00:00 2001
+From: Angelos Kolaitis <angelos.kolaitis@canonical.com>
+Date: Thu, 1 Feb 2024 11:23:08 +0200
+Subject: [PATCH 2/3] setns_init_linux: set the NNP flag after changing the
+ apparmor profile
+
+With the current version of the AppArmor kernel module, it's not
+possible to switch the AppArmor profile if the NoNewPrivileges flag is
+set. So, we invert the order of the two operations.
+
+Adjusts the previous patch for runc version v1.1.12
+
+Co-Authored-By: Alberto Mardegan <mardy@users.sourceforge.net>
+---
+ libcontainer/setns_init_linux.go | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/libcontainer/setns_init_linux.go b/libcontainer/setns_init_linux.go
+index d1bb122..00407ce 100644
+--- a/libcontainer/setns_init_linux.go
++++ b/libcontainer/setns_init_linux.go
+@@ -56,11 +56,6 @@ func (l *linuxSetnsInit) Init() error {
+ 			return err
+ 		}
+ 	}
+-	if l.config.NoNewPrivileges {
+-		if err := unix.Prctl(unix.PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0); err != nil {
+-			return err
+-		}
+-	}
+ 	if err := selinux.SetExecLabel(l.config.ProcessLabel); err != nil {
+ 		return err
+ 	}
+@@ -84,6 +79,11 @@ func (l *linuxSetnsInit) Init() error {
+ 	if err := apparmor.ApplyProfile(l.config.AppArmorProfile); err != nil {
+ 		return err
+ 	}
++	if l.config.NoNewPrivileges {
++		if err := unix.Prctl(unix.PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0); err != nil {
++			return err
++		}
++	}
+
+ 	// Check for the arg before waiting to make sure it exists and it is
+ 	// returned as a create time error.
+--
+2.34.1
\ No newline at end of file
diff --git a/build-scripts/components/runc/strict-patches/v1.1.12/0003-standard_init_linux-change-AppArmor-profile-as-late-.patch b/build-scripts/components/runc/strict-patches/v1.1.12/0003-standard_init_linux-change-AppArmor-profile-as-late-.patch
new file mode 100644
index 0000000000..9415a05f88
--- /dev/null
+++ b/build-scripts/components/runc/strict-patches/v1.1.12/0003-standard_init_linux-change-AppArmor-profile-as-late-.patch
@@ -0,0 +1,54 @@
+From 103a94a51ea334d25bf573f2f20cd4d9a099d827 Mon Sep 17 00:00:00 2001
+From: Alberto Mardegan <mardy@users.sourceforge.net>
+Date: Thu, 17 Jun 2021 14:31:35 +0300
+Subject: [PATCH 3/3] standard_init_linux: change AppArmor profile as late as
+ possible
+
+---
+ libcontainer/standard_init_linux.go | 18 +++++++++---------
+ 1 file changed, 9 insertions(+), 9 deletions(-)
+
+diff --git a/libcontainer/standard_init_linux.go b/libcontainer/standard_init_linux.go
+index d1d9435..7097571 100644
+--- a/libcontainer/standard_init_linux.go
++++ b/libcontainer/standard_init_linux.go
+@@ -127,10 +127,6 @@ func (l *linuxStandardInit) Init() error {
+ 			return &os.SyscallError{Syscall: "sethostname", Err: err}
+ 		}
+ 	}
+-	if err := apparmor.ApplyProfile(l.config.AppArmorProfile); err != nil {
+-		return fmt.Errorf("unable to apply apparmor profile: %w", err)
+-	}
+-
+ 	for key, value := range l.config.Config.Sysctl {
+ 		if err := writeSystemProperty(key, value); err != nil {
+ 			return err
+@@ -150,17 +146,21 @@ func (l *linuxStandardInit) Init() error {
+ 	if err != nil {
+ 		return fmt.Errorf("can't get pdeath signal: %w", err)
+ 	}
+-	if l.config.NoNewPrivileges {
+-		if err := unix.Prctl(unix.PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0); err != nil {
+-			return &os.SyscallError{Syscall: "prctl(SET_NO_NEW_PRIVS)", Err: err}
+-		}
+-	}
+ 	// Tell our parent that we're ready to Execv. This must be done before the
+ 	// Seccomp rules have been applied, because we need to be able to read and
+ 	// write to a socket.
+ 	if err := syncParentReady(l.pipe); err != nil {
+ 		return fmt.Errorf("sync ready: %w", err)
+ 	}
++	if err := apparmor.ApplyProfile(l.config.AppArmorProfile); err != nil {
++		return fmt.Errorf("apply apparmor profile: %w", err)
++	}
++	if l.config.NoNewPrivileges {
++		if err := unix.Prctl(unix.PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0); err != nil {
++			return fmt.Errorf("set nonewprivileges: %w", err)
++		}
++	}
++
+ 	if err := selinux.SetExecLabel(l.config.ProcessLabel); err != nil {
+ 		return fmt.Errorf("can't set process label: %w", err)
+ 	}
+--
+2.34.1
\ No newline at end of file
diff --git a/build-scripts/components/runc/strict-patches/v1.1.4/0001-apparmor-change-profile-immediately-not-on-exec.patch b/build-scripts/components/runc/strict-patches/v1.1.4/0001-apparmor-change-profile-immediately-not-on-exec.patch
new file mode 100644
index 0000000000..30bc4c5100
--- /dev/null
+++ b/build-scripts/components/runc/strict-patches/v1.1.4/0001-apparmor-change-profile-immediately-not-on-exec.patch
@@ -0,0 +1,36 @@
+From cc499086e2bbde59a349b52bdf7ce414b6fb3f0a Mon Sep 17 00:00:00 2001
+From: Alberto Mardegan <mardy@users.sourceforge.net>
+Date: Wed, 16 Jun 2021 15:04:16 +0300
+Subject: [PATCH] apparmor: change profile immediately, not on exec
+
+---
+ libcontainer/apparmor/apparmor_linux.go | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/libcontainer/apparmor/apparmor_linux.go b/libcontainer/apparmor/apparmor_linux.go
+index 8b1483c7..292cfa6d 100644
+--- a/libcontainer/apparmor/apparmor_linux.go
++++ b/libcontainer/apparmor/apparmor_linux.go
+@@ -48,9 +48,9 @@ func setProcAttr(attr, value string) error {
+ 	return err
+ }
+ 
+-// changeOnExec reimplements aa_change_onexec from libapparmor in Go
+-func changeOnExec(name string) error {
+-	if err := setProcAttr("exec", "exec "+name); err != nil {
++// changeProfile reimplements aa_change_profile from libapparmor in Go
++func changeProfile(name string) error {
++	if err := setProcAttr("current", "changeprofile "+name); err != nil {
+ 		return fmt.Errorf("apparmor failed to apply profile: %w", err)
+ 	}
+ 	return nil
+@@ -64,5 +64,5 @@ func applyProfile(name string) error {
+ 		return nil
+ 	}
+ 
+-	return changeOnExec(name)
++	return changeProfile(name)
+ }
+-- 
+2.25.1
+
diff --git a/build-scripts/components/runc/strict-patches/default/0002-setns_init_linux-set-the-NNP-flag-after-changing-the.patch b/build-scripts/components/runc/strict-patches/v1.1.4/0002-setns_init_linux-set-the-NNP-flag-after-changing-the.patch
similarity index 100%
rename from build-scripts/components/runc/strict-patches/default/0002-setns_init_linux-set-the-NNP-flag-after-changing-the.patch
rename to build-scripts/components/runc/strict-patches/v1.1.4/0002-setns_init_linux-set-the-NNP-flag-after-changing-the.patch
diff --git a/build-scripts/components/runc/strict-patches/default/0003-standard_init_linux-change-AppArmor-profile-as-late-.patch b/build-scripts/components/runc/strict-patches/v1.1.4/0003-standard_init_linux-change-AppArmor-profile-as-late-.patch
similarity index 100%
rename from build-scripts/components/runc/strict-patches/default/0003-standard_init_linux-change-AppArmor-profile-as-late-.patch
rename to build-scripts/components/runc/strict-patches/v1.1.4/0003-standard_init_linux-change-AppArmor-profile-as-late-.patch
diff --git a/build-scripts/components/runc/version.sh b/build-scripts/components/runc/version.sh
index a2f23ec634..0d42d6b131 100755
--- a/build-scripts/components/runc/version.sh
+++ b/build-scripts/components/runc/version.sh
@@ -1,3 +1,3 @@
 #!/bin/bash
 
-echo "v1.1.4"
+echo "v1.1.12"