Repository: kubernetes-sigs/security-profiles-operator
Pull request #1586 (2023-03-30 10:13:52)

Update CRI-O and runc/crun base profiles


#### What type of PR is this?


/kind cleanup


#### What this PR does / why we need it:
Updated CRI-O as well as crun and runc.
#### Which issue(s) this PR fixes:

<!--
*Automatically closes linked issue when PR is merged.
Usage: `Fixes #<issue number>`, or `Fixes (paste link of issue)`.

Fixes #

or

None
-->
None
#### Does this PR have test?
None
<!--
If tests aren't applicable just write N/A.
-->

#### Special notes for your reviewer:
None
#### Does this PR introduce a user-facing change?

<!--
If no, just write "NONE" in the release-note block below.
If yes, a release note is required:
Enter your extended release note in the block below. If the PR requires additional action from users switching to the new release, include the string "action required".

For more information on release notes see: https://git.k8s.io/community/contributors/guide/release-notes.md
-->

```release-note
Updated crun v1.8.3 and runc v1.1.5 base profiles.
```


k8s-ci-robot: @saschagrunert: The following test **failed**, say `/retest` to rerun all failed tests or `/retest-required` to rerun all mandatory failed tests:

Test name | Commit | Details | Required | Rerun command
--- | --- | --- | --- | ---
pull-security-profiles-operator-verify | 32a1ef6c660d691d579d1e75070552bb6adf296e | [link](https://prow.k8s.io/view/gs/kubernetes-jenkins/pr-logs/pull/kubernetes-sigs_security-profiles-operator/1586/pull-security-profiles-operator-verify/1641383239216009216) | true | `/test pull-security-profiles-operator-verify`

[Full PR test history](https://prow.k8s.io/pr-history?org=kubernetes-sigs&repo=security-profiles-operator&pr=1586). [Your PR dashboard](https://prow.k8s.io/pr?query=is%3Apr%20state%3Aopen%20author%3Asaschagrunert). Please help us cut down on flakes by [linking to](https://git.k8s.io/community/contributors/devel/sig-testing/flaky-tests.md#filing-issues-for-flaky-tests) an [open issue](https://github.com/kubernetes-sigs/security-profiles-operator/issues?q=is:issue+is:open) when you hit one in your PR.

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).
</details>
<!-- test report -->
codecov-commenter: ## [Codecov](https://codecov.io/gh/kubernetes-sigs/security-profiles-operator/pull/1586?src=pr&el=h1&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=kubernetes-sigs) Report
> Merging [#1586](https://codecov.io/gh/kubernetes-sigs/security-profiles-operator/pull/1586?src=pr&el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=kubernetes-sigs) (7fddba9) into [main](https://codecov.io/gh/kubernetes-sigs/security-profiles-operator/commit/5cfd263ed8afed00fbe0af7cbeba78349d3dc87c?el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=kubernetes-sigs) (5cfd263) will **not change** coverage.
> The diff coverage is `n/a`.

<details><summary>Additional details and impacted files</summary>


```diff
@@           Coverage Diff           @@
##             main    #1586   +/-   ##
=======================================
  Coverage   48.97%   48.97%           
=======================================
  Files          69       69           
  Lines        6748     6748           
=======================================
  Hits         3305     3305           
  Misses       3318     3318           
  Partials      125      125           
```

</details>
k8s-ci-robot: @saschagrunert: The following test **failed**, say `/retest` to rerun all failed tests or `/retest-required` to rerun all mandatory failed tests:

Test name | Commit | Details | Required | Rerun command
--- | --- | --- | --- | ---
pull-security-profiles-operator-test-e2e | 7fddba9f4354f44c20c8d8d4ac53f6878821fafb | [link](https://prow.k8s.io/view/gs/kubernetes-jenkins/pr-logs/pull/kubernetes-sigs_security-profiles-operator/1586/pull-security-profiles-operator-test-e2e/1641387766728101888) | true | `/test pull-security-profiles-operator-test-e2e`

[Full PR test history](https://prow.k8s.io/pr-history?org=kubernetes-sigs&repo=security-profiles-operator&pr=1586). [Your PR dashboard](https://prow.k8s.io/pr?query=is%3Apr%20state%3Aopen%20author%3Asaschagrunert). Please help us cut down on flakes by [linking to](https://git.k8s.io/community/contributors/devel/sig-testing/flaky-tests.md#filing-issues-for-flaky-tests) an [open issue](https://github.com/kubernetes-sigs/security-profiles-operator/issues?q=is:issue+is:open) when you hit one in your PR.

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).
</details>
<!-- test report -->
saschagrunert: /test pull-security-profiles-operator-test-e2e

Patch:
diff --git a/README.md b/README.md
index 1bdc3a42e..c0ae410f8 100644
--- a/README.md
+++ b/README.md
@@ -4,6 +4,7 @@
 [![test](https://github.com/kubernetes-sigs/security-profiles-operator/actions/workflows/test.yml/badge.svg)](https://github.com/kubernetes-sigs/security-profiles-operator/actions/workflows/test.yml)
 [![coverage](https://codecov.io/gh/kubernetes-sigs/security-profiles-operator/branch/main/graph/badge.svg?token=37VIWSZ1ZT)](https://codecov.io/gh/kubernetes-sigs/security-profiles-operator)
 [![CII Best Practices](https://bestpractices.coreinfrastructure.org/projects/5368/badge)](https://bestpractices.coreinfrastructure.org/projects/5368)
+[![OCI security profiles](https://img.shields.io/badge/oci%3A%2F%2F-security%20profiles-blue?logo=kubernetes&logoColor=white)](https://github.com/orgs/security-profiles/packages)
 
 This project is the starting point for the _Security Profiles Operator_ (SPO), an
 out-of-tree Kubernetes enhancement which aims to make it easier for users to use
diff --git a/dependencies.yaml b/dependencies.yaml
index 31acc5914..dadbc5252 100644
--- a/dependencies.yaml
+++ b/dependencies.yaml
@@ -164,13 +164,13 @@ dependencies:
       match: VERSION
 
   - name: CRI-O
-    version: v1.26.2
+    version: v1.26.3
     refPaths:
     - path: hack/ci/install-cri-o.sh
       match: TAG
 
   - name: crun
-    version: v1.8.1
+    version: v1.8.3
     refPaths:
     - path: examples/baseprofile-crun.yaml
       match: name
@@ -178,7 +178,7 @@ dependencies:
       match: baseProfileNameCrun
 
   - name: runc
-    version: v1.1.4
+    version: v1.1.5
     refPaths:
     - path: examples/baseprofile-runc.yaml
       match: name
diff --git a/examples/baseprofile-crun.yaml b/examples/baseprofile-crun.yaml
index 40673a2e1..33dba1d9d 100644
--- a/examples/baseprofile-crun.yaml
+++ b/examples/baseprofile-crun.yaml
@@ -2,7 +2,7 @@
 apiVersion: security-profiles-operator.x-k8s.io/v1beta1
 kind: SeccompProfile
 metadata:
-  name: crun-v1.8.1
+  name: crun-v1.8.3
 spec:
   defaultAction: SCMP_ACT_ERRNO
   architectures:
@@ -54,6 +54,7 @@ spec:
         - setresgid
         - setresuid
         - setsid
+        - statfs
         - statx
         - symlinkat
         - umask
diff --git a/examples/baseprofile-runc.yaml b/examples/baseprofile-runc.yaml
index 78645fc90..0605b42b2 100644
--- a/examples/baseprofile-runc.yaml
+++ b/examples/baseprofile-runc.yaml
@@ -2,7 +2,7 @@
 apiVersion: security-profiles-operator.x-k8s.io/v1beta1
 kind: SeccompProfile
 metadata:
-  name: runc-v1.1.4
+  name: runc-v1.1.5
 spec:
   defaultAction: SCMP_ACT_ERRNO
   architectures:
diff --git a/hack/ci/install-cri-o.sh b/hack/ci/install-cri-o.sh
index 2d409fa60..1690dcc6b 100755
--- a/hack/ci/install-cri-o.sh
+++ b/hack/ci/install-cri-o.sh
@@ -15,7 +15,7 @@
 
 set -euo pipefail
 
-TAG=v1.26.2
+TAG=v1.26.3
 
 curl_retry() {
     curl -sSfL --retry 5 --retry-delay 3 "$@"
diff --git a/installation-usage.md b/installation-usage.md
index ed30dda9e..bc7ab29f0 100644
--- a/installation-usage.md
+++ b/installation-usage.md
@@ -1,6 +1,7 @@
 # Installation and Usage
 
 <!-- toc -->
+
 - [Features](#features)
 - [Architecture](#architecture)
 - [Tutorials and Demos](#tutorials-and-demos)
@@ -514,7 +515,7 @@ metadata:
   name: profile1
 spec:
   defaultAction: SCMP_ACT_ERRNO
-  baseProfileName: runc-v1.1.4
+  baseProfileName: runc-v1.1.5
   syscalls:
     - action: SCMP_ACT_ALLOW
       names:
@@ -550,7 +551,7 @@ metadata:
   name: profile1
 spec:
   defaultAction: SCMP_ACT_ERRNO
-  baseProfileName: oci://ghcr.io/security-profiles/runc:v1.1.4
+  baseProfileName: oci://ghcr.io/security-profiles/runc:v1.1.5
 ```
 
 The resulting profile `profile1` will then contain all base syscalls from the


Test patch:
diff --git a/test/tc_base_profiles_test.go b/test/tc_base_profiles_test.go
index 40a289b97..1f5417003 100644
--- a/test/tc_base_profiles_test.go
+++ b/test/tc_base_profiles_test.go
@@ -24,8 +24,8 @@ import (
 )
 
 const (
-	baseProfileNameRunc = "runc-v1.1.4"
-	baseProfileNameCrun = "crun-v1.8.1"
+	baseProfileNameRunc = "runc-v1.1.5"
+	baseProfileNameCrun = "crun-v1.8.3"
 )
 
 func (e *e2e) testCaseBaseProfile([]string) {