Repository: kubernetes-sigs/security-profiles-operator
Pull request #1650 (2023-04-25 09:12:01)

Bump CRI-O to v1.27.0 and update base profiles


#### What type of PR is this?


/kind cleanup


#### What this PR does / why we need it:
Update the dependencies to their latest release.
#### Which issue(s) this PR fixes:

None

#### Does this PR have test?

None

#### Special notes for your reviewer:
None
#### Does this PR introduce a user-facing change?

<!--
If no, just write "NONE" in the release-note block below.
If yes, a release note is required:
Enter your extended release note in the block below. If the PR requires additional action from users switching to the new release, include the string "action required".

For more information on release notes see: https://git.k8s.io/community/contributors/guide/release-notes.md
-->

```release-note
Updated runc and crun base profiles to their latest release.
```


k8s-ci-robot: [APPROVALNOTIFIER] This PR is **APPROVED**

This pull-request has been approved by: *<a href="https://github.com/kubernetes-sigs/security-profiles-operator/pull/1650#" title="Author self-approved">saschagrunert</a>*

The full list of commands accepted by this bot can be found [here](https://go.k8s.io/bot-commands?repo=kubernetes-sigs%2Fsecurity-profiles-operator).

The pull request process is described [here](https://git.k8s.io/community/contributors/guide/owners.md#the-code-review-process)

<details >
Needs approval from an approver in each of these files:

- ~~[OWNERS](https://github.com/kubernetes-sigs/security-profiles-operator/blob/main/OWNERS)~~ [saschagrunert]

Approvers can indicate their approval by writing `/approve` in a comment
Approvers can cancel approval by writing `/approve cancel` in a comment
</details>
<!-- META={"approvers":[]} -->

Patch:
diff --git a/dependencies.yaml b/dependencies.yaml
index 7476c56f7..5dc82b6bd 100644
--- a/dependencies.yaml
+++ b/dependencies.yaml
@@ -176,13 +176,13 @@ dependencies:
       match: VERSION
 
   - name: CRI-O
-    version: v1.26.3
+    version: v1.27.0
     refPaths:
     - path: hack/ci/install-cri-o.sh
       match: TAG
 
   - name: crun
-    version: v1.8.3
+    version: v1.8.4
     refPaths:
     - path: examples/baseprofile-crun.yaml
       match: name
@@ -190,7 +190,7 @@ dependencies:
       match: baseProfileNameCrun
 
   - name: runc
-    version: v1.1.5
+    version: v1.1.6
     refPaths:
     - path: examples/baseprofile-runc.yaml
       match: name
@@ -206,7 +206,7 @@ dependencies:
       match: VERSION
 
   - name: cosign
-    version: v2.0.0
+    version: v2.0.2
     refPaths:
     - path: hack/ci/install-cri-o.sh
       match: COSIGN_VERSION
@@ -260,3 +260,9 @@ dependencies:
     refPaths:
       - path: Makefile
         match: ZEITGEIST_VERSION
+
+  - name: yq
+    version: 4.33.3
+    refPaths:
+      - path: hack/ci/baseprofiles.sh
+        match: YQ_VERSION
diff --git a/examples/baseprofile-crun.yaml b/examples/baseprofile-crun.yaml
index 33dba1d9d..35d05ee08 100644
--- a/examples/baseprofile-crun.yaml
+++ b/examples/baseprofile-crun.yaml
@@ -2,7 +2,7 @@
 apiVersion: security-profiles-operator.x-k8s.io/v1beta1
 kind: SeccompProfile
 metadata:
-  name: crun-v1.8.3
+  name: crun-v1.8.4
 spec:
   defaultAction: SCMP_ACT_ERRNO
   architectures:
diff --git a/examples/baseprofile-runc.yaml b/examples/baseprofile-runc.yaml
index 0605b42b2..177baf295 100644
--- a/examples/baseprofile-runc.yaml
+++ b/examples/baseprofile-runc.yaml
@@ -2,7 +2,7 @@
 apiVersion: security-profiles-operator.x-k8s.io/v1beta1
 kind: SeccompProfile
 metadata:
-  name: runc-v1.1.5
+  name: runc-v1.1.6
 spec:
   defaultAction: SCMP_ACT_ERRNO
   architectures:
@@ -34,9 +34,11 @@ spec:
         - getdents64
         - getpid
         - getppid
+        - getrlimit
         - gettid
         - getuid
         - keyctl
+        - madvise
         - mkdirat
         - mknodat
         - mmap
diff --git a/hack/ci/baseprofiles.sh b/hack/ci/baseprofiles.sh
index b99fb2517..6f8d49f9c 100755
--- a/hack/ci/baseprofiles.sh
+++ b/hack/ci/baseprofiles.sh
@@ -15,11 +15,16 @@
 
 set -euo pipefail
 
+curl_retry() {
+    sudo curl -sSfL --retry 5 --retry-delay 3 "$@"
+}
+
 install_yq() {
     echo "Installing yq"
-    go install -mod=mod github.com/mikefarah/yq/v4@latest
-    GOPATH=$(go env GOPATH)
-    export PATH=$GOPATH/bin:$PATH
+    YQ_VERSION=4.33.3
+    curl_retry -o /usr/bin/yq \
+        https://github.com/mikefarah/yq/releases/download/v$YQ_VERSION/yq_linux_amd64
+    sudo chmod +x /usr/bin/yq
     yq --version
 }
 
@@ -168,9 +173,12 @@ EOT
     echo "Diffing output, while ignoring flaky syscalls 'rt_sigreturn', 'sched_yield' and 'tgkill'"
     git diff --exit-code -U0 -I rt_sigreturn -I sched_yield -I tgkill examples
 
-    echo "Verifying that profile is available in the GitHub container registry"
-    cosign verify --certificate-identity-regexp '.*' --certificate-oidc-issuer-regexp '.*' \
-        "ghcr.io/security-profiles/$RUNTIME:v$VERSION"
+    for RUNTIME in "${RUNTIMES[@]}"; do
+        echo "Verifying that the profile for runtime $RUNTIME is available in the GitHub container registry"
+        VERSION=$($RUNTIME --version | grep "$RUNTIME version" | grep -oP '\d+.*')
+        cosign verify --certificate-identity-regexp '.*' --certificate-oidc-issuer-regexp '.*' \
+            "ghcr.io/security-profiles/$RUNTIME:v$VERSION"
+    done
 }
 
 install_yq
diff --git a/hack/ci/install-cri-o.sh b/hack/ci/install-cri-o.sh
index e38e76974..70caf7899 100755
--- a/hack/ci/install-cri-o.sh
+++ b/hack/ci/install-cri-o.sh
@@ -15,7 +15,7 @@
 
 set -euo pipefail
 
-TAG=v1.26.3
+TAG=v1.27.0
 
 curl_retry() {
     curl -sSfL --retry 5 --retry-delay 3 "$@"
@@ -24,7 +24,7 @@ curl_retry() {
 # We need cosign as well as the bom tool here because the CRI-O installation
 # script will automatically verify the signatures based on their existence in
 # $PATH.
-COSIGN_VERSION=v2.0.0
+COSIGN_VERSION=v2.0.2
 curl_retry -o /usr/bin/cosign \
     https://github.com/sigstore/cosign/releases/download/$COSIGN_VERSION/cosign-linux-amd64
 chmod +x /usr/bin/cosign
diff --git a/installation-usage.md b/installation-usage.md
index 6b23a0fc9..4177f0c62 100644
--- a/installation-usage.md
+++ b/installation-usage.md
@@ -515,7 +515,7 @@ metadata:
   name: profile1
 spec:
   defaultAction: SCMP_ACT_ERRNO
-  baseProfileName: runc-v1.1.5
+  baseProfileName: runc-v1.1.6
   syscalls:
     - action: SCMP_ACT_ALLOW
       names:
@@ -551,7 +551,7 @@ metadata:
   name: profile1
 spec:
   defaultAction: SCMP_ACT_ERRNO
-  baseProfileName: oci://ghcr.io/security-profiles/runc:v1.1.5
+  baseProfileName: oci://ghcr.io/security-profiles/runc:v1.1.6
 ```
 
 The resulting profile `profile1` will then contain all base syscalls from the
@@ -1921,18 +1921,18 @@ The `spoc` client is able to pull security profiles from OCI artifact compatible
 registries. To do that, just run `spoc pull`:
 
 ```console
-> spoc pull ghcr.io/security-profiles/runc:v1.1.4
-16:32:29.795597 Pulling profile from: ghcr.io/security-profiles/runc:v1.1.4
+> spoc pull ghcr.io/security-profiles/runc:v1.1.6
+16:32:29.795597 Pulling profile from: ghcr.io/security-profiles/runc:v1.1.6
 16:32:29.795610 Verifying signature
 
-Verification for ghcr.io/security-profiles/runc:v1.1.4 --
+Verification for ghcr.io/security-profiles/runc:v1.1.6 --
 The following checks were performed on each of these signatures:
   - Existence of the claims in the transparency log was verified offline
   - The code-signing certificate was verified using trusted certificate authority certificates
 
 [{"critical":{"identity":{"docker-reference":"ghcr.io/security-profiles/runc"},…}}]
 16:32:33.208695 Creating file store in: /tmp/pull-3199397214
-16:32:33.208713 Verifying reference: ghcr.io/security-profiles/runc:v1.1.4
+16:32:33.208713 Verifying reference: ghcr.io/security-profiles/runc:v1.1.6
 16:32:33.208718 Creating repository for ghcr.io/security-profiles/runc
 16:32:33.208742 Using tag: v1.1.4
 16:32:33.208743 Copying profile from repository
diff --git a/internal/pkg/util/containers.go b/internal/pkg/util/containers.go
index 45d1b24bf..5cd400e37 100644
--- a/internal/pkg/util/containers.go
+++ b/internal/pkg/util/containers.go
@@ -69,7 +69,9 @@ func ContainerIDForPID(cache *ttlcache.Cache[string, string], pid int) (string,
 	for scanner.Scan() {
 		text := scanner.Text()
 
-		if containerID := ContainerIDRegex.FindString(text); containerID != "" {
+		if containerIDs := ContainerIDRegex.FindAllString(text, -1); 0 < len(containerIDs) {
+			// Using the last container ID in the cgroup path to support "docker in docker" use cases
+			containerID := containerIDs[len(containerIDs)-1]
 			// Update the cache
 			cache.Set(strconv.Itoa(pid), containerID, ttlcache.DefaultTTL)
 			return containerID, nil


Test patch:
diff --git a/test/tc_base_profiles_test.go b/test/tc_base_profiles_test.go
index 044802bf8..59b0500da 100644
--- a/test/tc_base_profiles_test.go
+++ b/test/tc_base_profiles_test.go
@@ -24,8 +24,8 @@ import (
 )
 
 const (
-	baseProfileNameRunc = "runc-v1.1.5"
-	baseProfileNameCrun = "crun-v1.8.3"
+	baseProfileNameRunc = "runc-v1.1.6"
+	baseProfileNameCrun = "crun-v1.8.4"
 )
 
 func (e *e2e) testCaseBaseProfile([]string) {