Repository: kubernetes-sigs/security-profiles-operator
Pull request #2103 (2024-02-01 14:07:09)

Update runc to 1.1.12


#### What type of PR is this?


/kind documentation

#### What this PR does / why we need it:
Update runc to v1.1.12 to address the CVE.
#### Which issue(s) this PR fixes:

<!--
*Automatically closes linked issue when PR is merged.
Usage: `Fixes #<issue number>`, or `Fixes (paste link of issue)`.

Fixes #

or

None
-->
None
#### Does this PR have test?
None
<!--
If tests aren't applicable just write N/A.
-->

#### Special notes for your reviewer:
None
#### Does this PR introduce a user-facing change?

<!--
If no, just write "NONE" in the release-note block below.
If yes, a release note is required:
Enter your extended release note in the block below. If the PR requires additional action from users switching to the new release, include the string "action required".

For more information on release notes see: https://git.k8s.io/community/contributors/guide/release-notes.md
-->

```release-note
None
```


k8s-ci-robot: [APPROVALNOTIFIER] This PR is **APPROVED**

This pull-request has been approved by: *<a href="https://github.com/kubernetes-sigs/security-profiles-operator/pull/2103#" title="Author self-approved">saschagrunert</a>*

The full list of commands accepted by this bot can be found [here](https://go.k8s.io/bot-commands?repo=kubernetes-sigs%2Fsecurity-profiles-operator).

The pull request process is described [here](https://git.k8s.io/community/contributors/guide/owners.md#the-code-review-process)

<details >
Needs approval from an approver in each of these files:

- ~~[OWNERS](https://github.com/kubernetes-sigs/security-profiles-operator/blob/main/OWNERS)~~ [saschagrunert]

Approvers can indicate their approval by writing `/approve` in a comment
Approvers can cancel approval by writing `/approve cancel` in a comment
</details>
<!-- META={"approvers":[]} -->
codecov-commenter: ## [Codecov](https://app.codecov.io/gh/kubernetes-sigs/security-profiles-operator/pull/2103?src=pr&el=h1&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=kubernetes-sigs) Report
> Merging [#2103](https://app.codecov.io/gh/kubernetes-sigs/security-profiles-operator/pull/2103?src=pr&el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=kubernetes-sigs) (f2200c0) into [main](https://app.codecov.io/gh/kubernetes-sigs/security-profiles-operator/commit/11d77f49d652b2b077eaeb9a0ef9eff5f24b6a8d?el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=kubernetes-sigs) (11d77f4) will **decrease** coverage by `0.06%`.
> Report is 2 commits behind head on main.
> The diff coverage is `n/a`.

<details><summary>Additional details and impacted files</summary>


```diff
@@            Coverage Diff             @@
##             main    #2103      +/-   ##
==========================================
- Coverage   45.50%   45.44%   -0.06%     
==========================================
  Files          79       79              
  Lines        7782     6412    -1370     
==========================================
- Hits         3541     2914     -627     
+ Misses       4099     3356     -743     
  Partials      142      142              
```

</details>
k8s-ci-robot: [APPROVALNOTIFIER] This PR is **APPROVED**

This pull-request has been approved by: *<a href="https://github.com/kubernetes-sigs/security-profiles-operator/pull/2103#pullrequestreview-1858964589" title="Approved">ccojocar</a>*, *<a href="https://github.com/kubernetes-sigs/security-profiles-operator/pull/2103#" title="Author self-approved">saschagrunert</a>*

The full list of commands accepted by this bot can be found [here](https://go.k8s.io/bot-commands?repo=kubernetes-sigs%2Fsecurity-profiles-operator).

The pull request process is described [here](https://git.k8s.io/community/contributors/guide/owners.md#the-code-review-process)

<details >
Needs approval from an approver in each of these files:

- ~~[OWNERS](https://github.com/kubernetes-sigs/security-profiles-operator/blob/main/OWNERS)~~ [ccojocar,saschagrunert]

Approvers can indicate their approval by writing `/approve` in a comment
Approvers can cancel approval by writing `/approve cancel` in a comment
</details>
<!-- META={"approvers":[]} -->

Patch:
diff --git a/dependencies.yaml b/dependencies.yaml
index fbb66da57..15854a708 100644
--- a/dependencies.yaml
+++ b/dependencies.yaml
@@ -164,7 +164,7 @@ dependencies:
       match: baseProfileNameCrun
 
   - name: runc
-    version: v1.1.11
+    version: v1.1.12
     refPaths:
     - path: examples/baseprofile-runc.yaml
       match: name
diff --git a/examples/baseprofile-runc.yaml b/examples/baseprofile-runc.yaml
index 883cb7287..d1a48eda1 100644
--- a/examples/baseprofile-runc.yaml
+++ b/examples/baseprofile-runc.yaml
@@ -2,7 +2,7 @@
 apiVersion: security-profiles-operator.x-k8s.io/v1beta1
 kind: SeccompProfile
 metadata:
-  name: runc-v1.1.11
+  name: runc-v1.1.12
 spec:
   defaultAction: SCMP_ACT_ERRNO
   architectures:
@@ -31,6 +31,7 @@ spec:
         - fstat
         - fstatfs
         - futex
+        - getcwd
         - getdents64
         - getpid
         - getppid
diff --git a/hack/ci/Vagrantfile-ubuntu b/hack/ci/Vagrantfile-ubuntu
index 93bb12643..aceb78094 100644
--- a/hack/ci/Vagrantfile-ubuntu
+++ b/hack/ci/Vagrantfile-ubuntu
@@ -56,7 +56,7 @@ Vagrant.configure("2") do |config|
       apt-get autoremove -y
 
       # Some tests require runc
-      RUNC_VERSION=v1.1.11
+      RUNC_VERSION=v1.1.12
       RUNC_BINARY=/usr/bin/crio-runc
       curl -sSfL --retry 5 --retry-delay 3 "https://github.com/opencontainers/runc/releases/download/$RUNC_VERSION/runc.amd64" -o "$RUNC_BINARY"
       chmod +x "$RUNC_BINARY"
diff --git a/installation-usage.md b/installation-usage.md
index e979465c1..a7c036286 100644
--- a/installation-usage.md
+++ b/installation-usage.md
@@ -519,7 +519,7 @@ metadata:
   name: profile1
 spec:
   defaultAction: SCMP_ACT_ERRNO
-  baseProfileName: runc-v1.1.9
+  baseProfileName: runc-v1.1.12
   syscalls:
     - action: SCMP_ACT_ALLOW
       names:
@@ -555,7 +555,7 @@ metadata:
   name: profile1
 spec:
   defaultAction: SCMP_ACT_ERRNO
-  baseProfileName: oci://ghcr.io/security-profiles/runc:v1.1.11
+  baseProfileName: oci://ghcr.io/security-profiles/runc:v1.1.12
 ```
 
 The resulting profile `profile1` will then contain all base syscalls from the
@@ -1962,18 +1962,18 @@ The `spoc` client is able to pull security profiles from OCI artifact compatible
 registries. To do that, just run `spoc pull`:
 
 ```console
-> spoc pull ghcr.io/security-profiles/runc:v1.1.11
-16:32:29.795597 Pulling profile from: ghcr.io/security-profiles/runc:v1.1.11
+> spoc pull ghcr.io/security-profiles/runc:v1.1.12
+16:32:29.795597 Pulling profile from: ghcr.io/security-profiles/runc:v1.1.12
 16:32:29.795610 Verifying signature
 
-Verification for ghcr.io/security-profiles/runc:v1.1.11 --
+Verification for ghcr.io/security-profiles/runc:v1.1.12 --
 The following checks were performed on each of these signatures:
   - Existence of the claims in the transparency log was verified offline
   - The code-signing certificate was verified using trusted certificate authority certificates
 
 [{"critical":{"identity":{"docker-reference":"ghcr.io/security-profiles/runc"},…}}]
 16:32:33.208695 Creating file store in: /tmp/pull-3199397214
-16:32:33.208713 Verifying reference: ghcr.io/security-profiles/runc:v1.1.11
+16:32:33.208713 Verifying reference: ghcr.io/security-profiles/runc:v1.1.12
 16:32:33.208718 Creating repository for ghcr.io/security-profiles/runc
 16:32:33.208742 Using tag: v1.1.4
 16:32:33.208743 Copying profile from repository
@@ -2107,15 +2107,15 @@ The Security Profiles Operator will try to pull the correct profile by using
 way, for example if a profile does not support any platform:
 
 ```
-> spoc pull ghcr.io/security-profiles/runc:v1.1.11
-11:07:14.788840 Pulling profile from: ghcr.io/security-profiles/runc:v1.1.11
+> spoc pull ghcr.io/security-profiles/runc:v1.1.12
+11:07:14.788840 Pulling profile from: ghcr.io/security-profiles/runc:v1.1.12
 11:07:14.788852 Verifying signature
 …
 11:07:17.559037 Copying profile from repository
 11:07:18.359152 Trying to read profile: profile-linux-amd64.yaml
 11:07:18.359209 Trying to read profile: profile.yaml
 11:07:18.359224 Trying to unmarshal seccomp profile
-11:07:18.359728 Got SeccompProfile: runc-v1.1.9
+11:07:18.359728 Got SeccompProfile: runc-v1.1.12
 11:07:18.359732 Saving profile in: /tmp/profile.yaml
 ```
 


Test patch:
diff --git a/test/tc_base_profiles_test.go b/test/tc_base_profiles_test.go
index fe4cd2487..7925e890d 100644
--- a/test/tc_base_profiles_test.go
+++ b/test/tc_base_profiles_test.go
@@ -24,7 +24,7 @@ import (
 )
 
 const (
-	baseProfileNameRunc = "runc-v1.1.11"
+	baseProfileNameRunc = "runc-v1.1.12"
 	baseProfileNameCrun = "crun-v1.14"
 )