mirror of
https://github.com/opencontainers/runc.git
synced 2026-02-05 09:46:08 +01:00
aca52c4690
Previously, we would see a ~3% failure rate when starting containers with mounts that contain ".." (which can trigger -EAGAIN). To counteract this, filepath-securejoin v0.5.1 includes a bump of the internal retry limit from 32 to 128, which lowers the failure rate to 0.12%. However, there is still a risk of spurious failure on regular systems. In order to try to provide more resilience (while avoiding DoS attacks), this patch also includes an additional retry loop that terminates based on a deadline rather than retry count. The deadline is 2ms, as my testing found that ~800us for a single pathrs operation was the longest latency due to -EAGAIN retries, and that was an outlier compared to the more common ~400us latencies -- so 2ms should be more than enough for any real system. The failure rates above were based on more 50k runs of runc with an attack script (from libpathrs) running a rename attack on all cores of a 16-core system, which is arguably a worst-case but heavily utilised servers could likely approach similar results. Tested-by: Phil Estes <estesp@gmail.com> Signed-off-by: Aleksa Sarai <cyphar@cyphar.com>
40 lines
1.3 KiB
Modula-2
40 lines
1.3 KiB
Modula-2
module github.com/opencontainers/runc
|
|
|
|
go 1.23.0
|
|
|
|
require (
|
|
github.com/checkpoint-restore/go-criu/v6 v6.3.0
|
|
github.com/containerd/console v1.0.5
|
|
github.com/coreos/go-systemd/v22 v22.5.0
|
|
github.com/cyphar/filepath-securejoin v0.5.1
|
|
github.com/docker/go-units v0.5.0
|
|
github.com/godbus/dbus/v5 v5.1.0
|
|
github.com/moby/sys/capability v0.4.0
|
|
github.com/moby/sys/mountinfo v0.7.2
|
|
github.com/moby/sys/user v0.3.0
|
|
github.com/moby/sys/userns v0.1.0
|
|
github.com/mrunalp/fileutils v0.5.1
|
|
github.com/opencontainers/cgroups v0.0.4
|
|
github.com/opencontainers/runtime-spec v1.2.1
|
|
github.com/opencontainers/selinux v1.12.0
|
|
github.com/seccomp/libseccomp-golang v0.10.0
|
|
github.com/sirupsen/logrus v1.9.3
|
|
github.com/urfave/cli v1.22.16
|
|
github.com/vishvananda/netlink v1.3.0
|
|
golang.org/x/net v0.35.0
|
|
golang.org/x/sys v0.30.0
|
|
google.golang.org/protobuf v1.36.5
|
|
)
|
|
|
|
require (
|
|
github.com/cilium/ebpf v0.17.3 // indirect
|
|
github.com/cpuguy83/go-md2man/v2 v2.0.5 // indirect
|
|
github.com/russross/blackfriday/v2 v2.1.0 // indirect
|
|
github.com/vishvananda/netns v0.0.4 // indirect
|
|
)
|
|
|
|
// FIXME: This is only intended as a short-term solution to include a patch for
|
|
// CVE-2025-52881 in go-selinux without pushing the patches upstream. This
|
|
// should be removed as soon as possible after the embargo is lifted.
|
|
replace github.com/opencontainers/selinux => ./internal/third_party/selinux
|