linux/meta-virtualization.git, branch dunfell

openvswitch: fix CVE-2020-35498 limitation in the OVS packet parsing

2024-05-14T02:33:28+00:00

Upstream-Status: Backport https://github.com/openvswitch/ovs/commit/0625dc79aec73b966f206e55655a2816696246d0 Signed-off-by: Hitendra Prajapati Signed-off-by: Bruce Ashfield

kubernetes: Backport fix for CVE-2021-25735 and CVE-2021-25737

2023-10-02T16:16:25+00:00

Upstream-commit: https://github.com/kubernetes/kubernetes/commit/e612ebfdff22e4bd27ad8345f7c82f074bfedf26 & https://github.com/kubernetes/kubernetes/commit/d57f0641d60b73934ebc2cdf4b6a63182217d10c & https://github.com/kubernetes/kubernetes/commit/901e8e07e1f031456ecd7fefce965aaa05916825 Signed-off-by: Vijay Anusuri Signed-off-by: Bruce Ashfield

kubernetes: Backport fix for CVE-2020-8565 & CVE-2020-8566

2023-08-27T13:32:17+00:00

Upstream-commit:https://github.com/kubernetes/kubernetes/commit/f0f52255412cbc6834bd225a59608ebb4a0d399b & https://github.com/kubernetes/kubernetes/commit/e91ec4fad3366d2dee020919f7c2a0d7b52fd3ea Signed-off-by: Vijay Anusuri Signed-off-by: Bruce Ashfield

kubernetes: Backport fix for CVE-2020-8564

2023-08-22T03:44:00+00:00

Upstream-commit: https://github.com/kubernetes/kubernetes/commit/11793434dac97a49bfed0150b56ac63e5dc34634 Signed-off-by: Vijay Anusuri Signed-off-by: Bruce Ashfield

lxc: backport patch to fix CVE-2022-47952

2023-05-19T14:42:46+00:00

Signed-off-by: Xiangyu Chen Signed-off-by: Bruce Ashfield

lxc: update to 4.0.12

2023-05-19T14:42:35+00:00

We refresh our wget -> curl patch for context, but otherwise, no other changes are required. Bumping lxc to version lxc-4.0.12-8-g5ba5725cb, which comprises the following commits: 5ba5725cb cgroups: modify cgroup2 attach logic 1e4631641 ttys: ensure container_ttys= env variable is set correctly 8ef019a6c doc: Fix reverse allowlist/denylist in Japanese man page f1c4a17e7 cgroups: log fd of newly created cgroup f7446b4e1 cgroups: check that opened file descriptor is a cgroup filesystem 71ba7f656 doc: Fix reverse allowlist/denylist f314419d1 lxc-checkconfig: Fix bashism ca4c25c6e lxc-net: don't start by default inside lxc 7e37cc96b Release LXC 4.0.12 d678aa61e lxccontainer: allow xdev when creating the container dir bc61d2354 github: Clear default ACL on /home fb0e0b3dd github: add systemd-coredump 53e0d390c github: more detailed compilation instructions db84a8b6b github: log system info e9282b6a6 github: ensure system liblxc is wiped ad8a3bd68 lxccontainer: properly wrap lxcapi_create() bceb81cd2 build: simplify thread local storage handling 919da35b0 build: only enable LTO for regular builds d0a1e9c44 lxccontainer: simplify partial file creation 62b5c0051 lxccontainer: improve create_partial() bfe24cb6a lxccontainer: improve do_lxcapi_create() 1a5c236ac lxccontainer: improve do_lxcapi_save_config() bae0d7196 conf: log termination status 4eb09aaad conf: improve userns_exec_mapped_root() 928943280 github: stop installing gnupg now that it's unused 7c70b0d14 lxc-download: Rely on HTTPS only 199d2077c Update README.md: Fix broken link (403 Forbidden) 0b6b230e3 attach: don't pointlessly call cgroup_init() dbef704fb commands: log command during file descriptor retrieval 733f9c909 lxc-checkconfig.in: CONFIG_NF_NAT_IPV4 was removed from the kernel 2019-03-03 ce392e230 (trivial) Fix error message, failure was connect not bind 5628bff79 seccomp: close seccomp notifier fd in cleanup handler 1f2af83a9 seccomp: only guard seccomp notify behind HAVE_DECL_SECCOMP_NOTIFY_FD 9451303d5 api-extensions: don't advertise seccomp notify support if it's not compiled in 23d07c315 use 2 sysfs instances for sys:mixed 0dd3258bd Revert "api: ->save_config() doesn't need to create container dir" 93edd510a api: ->save_config() doesn't need to create container dir 28b2e04f1 cgroups: fix compiler warning 15515f9a3 Revert "initutils: use vfork() in lxc_container_init()" 41d2530d1 macro: ensure necessary io_uring flags are defined fc4e948c9 autotools: Avoid multiple liblxc.so with --enable-pam a616a311a build: refuse to compile with unsupported liburing version 93be4e512 tests: add lxc.proc.* test d8027e49c tests: add lxc.sysctls.* test 6f580343e test: improve logging helpers a10ff3418 conf: improve logging setting sysctl and /proc// parameters 334cf7beb conf: apply /proc/sys and /proc// parameters 1b74e01ad tests: include config.h c36379431 build: move _FILE_OFFSET_BITS to common option f24c234ee start: log signal name and number 4915c9112 process_utils: add signal_name() helper 78baec37d build: improve liburing support detection 1a102b310 mainloop: make ifdefs easier to follow cf931928f Replace last occurence of 'which' with 'command -v' 1ec5939b4 Replace deprecated backticks with $() construct fdfb4a13d Replace 'which' with 'command -v' in tests too 71743e811 start: check event loop type before closing fd f69e6b4d3 mainloop: make sure that descr->ring is allocated 1a8895855 Replace 'which' with 'command -v' 9219277cc build: add io-uring-event-loop option d04eb166c build: add static libcap to output bc51048b7 confile: don't use path_simplify() on lxc.{execute,init}.cmd 48728e988 conf: add cgroup2, cgroup2:ro, cgroup2:force, cgroup2:ro:force options 4d3aad49d AUTHORS: Update to point to git history e328a988e conf: handle kernels without or not using SMT d40b0deb4 doc: fix typo in English lxc.container.conf(5) 49fab27fc doc: Add lxc.sched.core to Japanese lxc.container.conf(5) 1ad1cab80 doc: add loglevels to ja and ko common options 1505f0780 conf: make it more obvious how auto-mount flags are defined 429233cf0 criu: support restoring containers with pre-created veth devices 48e079bf3 Release LXC 4.0.11 Signed-off-by: Bruce Ashfield

lxc: update to 4.0.11

2023-05-19T14:42:21+00:00

update to 4.0.11 1.drop two patches that have been integrated to upstream repo. 2.drop tests-add-no-validate-when-using-download-template.patch because it is no longer appropriate as the "download" has been replaced with "busybox" 3.fix the apply failure of templates-use-curl-instead-of-wget.patch 4.update lxc from 4.0.10 to 4.0.11 Signed-off-by: Yanfei Xu Signed-off-by: Bruce Ashfield

lxc: Fix -c command for lxc-attach

2023-05-19T14:42:09+00:00

Added fix_c_command.patch the -c command seems to be broken because the passed context is ignored and always overwritten by the context specified in the config file. Signed-off-by: Sana Kazi Signed-off-by: Sana Kazi Signed-off-by: Bruce Ashfield

lxc: update to 4.0.10 and switch to git

2023-05-19T14:41:57+00:00

To more easily pull in fixes / backports from newer versions, switching to git. This also allows bisecting and easier support when we run into upgrade issues. Signed-off-by: Bruce Ashfield

lxc: Enable seccomp support for lxc

2023-05-19T14:41:47+00:00

Enabled seccomp support for lxc. Also added a patch to enable seccomp.profile only when compiled with libseccomp. Currently, seccomp.profile is silently ignored. This could lead to the false impression that the seccomp filter is applied while it actually isn't. Signed-off-by: Sana Kazi Signed-off-by: Bruce Ashfield