Merge pull request #5583 from kolyshkin/1.4-5403

[1.4] ci: fix govulncheck and check-go jobs; fix sub-cgroup path check

Author: lifubang

.github/workflows/test.yml

@@ -25,24 +25,20 @@ jobs:
       fail-fast: false
       matrix:
         os: [ubuntu-24.04, ubuntu-24.04-arm]
-        go-version: [1.24.x, 1.25.x, 1.26.x]
+        go-version: [1.26.x, 1.27.x]
         rootless: ["rootless", ""]
         race: ["-race", ""]
         criu: ["", "criu-dev"]
         exclude:
           # Disable most of criu-dev jobs, as they are expensive
           # (need to compile criu) and don't add much value/coverage.
           - criu: criu-dev
-            go-version: 1.24.x
-          - criu: criu-dev
-            go-version: 1.25.x
+            go-version: 1.26.x
           - criu: criu-dev
             rootless: rootless
           # Do race detection only with latest stable Go version.
           - race: -race
-            go-version: 1.24.x
-          - race: -race
-            go-version: 1.25.x
+            go-version: 1.26.x
 
     runs-on: ${{ matrix.os }}
 

.github/workflows/validate.yml

@@ -9,7 +9,7 @@ on:
   pull_request:
   workflow_dispatch:
 env:
-  GO_VERSION: 1.24
+  GO_VERSION: 1.26
 permissions:
   contents: read
 
@@ -41,7 +41,7 @@ jobs:
           sudo apt -qy install libseccomp-dev
       - uses: golangci/golangci-lint-action@v9
         with:
-          version: v2.6
+          version: v2.12
           skip-cache: true
       # Extra linters, only checking new code from a pull request to main.
       - name: lint-extra

CHANGELOG.md

@@ -14,9 +14,26 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - For users making use of the `libpathrs` build tag, runc now depends on
   [libpathrs v0.2.5] or later, and attempting to build with older versions will
   cause compilation errors. (#5291, #5333)
+- Switched to opencontainers/cgroups v0.1.0, which no longer uses the
+  high-level cilium/ebpf API to manage cgroup v2 device rules. As a result,
+  the runc binary shrunk by about 1 MiB (7.5%) on amd64. (#5403, #5583)
 
 [libpathrs v0.2.5]: https://github.com/cyphar/libpathrs/releases/tag/v0.2.5
 
+### Fixed ###
+- Worked around a Linux kernel bug (present since kernel v6.17, fixed in v7.2)
+  which caused the kernel to write past the end of the structure
+  provided by userspace (runc). This resulted in memory corruption inside runc
+  (manifesting as random crashes) when configuring device rules on cgroup v2
+  systems. (#5403, #5583)
+- `runc exec --cgroup` (and the equivalent libcontainer `Process.SubCgroupPaths`
+  API) no longer accepts a sub-cgroup path that escapes the container's cgroup
+  into a sibling cgroup sharing the same name prefix. Note that using
+  `--cgroup` requires the same privileges as running `runc exec` itself, so
+  this is a correctness rather than a security fix. (#5403, #5583)
+- Fixed a missing `O_CLOEXEC` when opening the cgroup v2 directory to set up
+  device rules. (#5403, #5583)
+
 
 ## [1.4.3] - 2026-06-13
 

Dockerfile

@@ -1,4 +1,4 @@
-ARG GO_VERSION=1.25
+ARG GO_VERSION=1.26
 ARG BATS_VERSION=v1.12.0
 ARG LIBSECCOMP_VERSION=2.6.0
 

go.mod

@@ -15,7 +15,7 @@ require (
 	github.com/moby/sys/user v0.4.0
 	github.com/moby/sys/userns v0.1.0
 	github.com/mrunalp/fileutils v0.5.1
-	github.com/opencontainers/cgroups v0.0.6
+	github.com/opencontainers/cgroups v0.1.0
 	github.com/opencontainers/runtime-spec v1.3.0
 	github.com/opencontainers/selinux v1.13.0
 	github.com/seccomp/libseccomp-golang v0.11.1

go.sum

@@ -24,18 +24,10 @@ github.com/godbus/dbus/v5 v5.1.0 h1:4KLkAxT3aOY8Li4FRJe/KvhoNFFxo0m6fNuFUO8QJUk=
 github.com/godbus/dbus/v5 v5.1.0/go.mod h1:xhWf0FNVPg57R7Z0UbKHbJfkEywrmjJnf7w5xrFpKfA=
 github.com/google/go-cmp v0.6.0 h1:ofyhxvXcZhMsU5ulbFiLKl/XBFqE1GSq7atu8tAmTRI=
 github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
-github.com/josharian/native v1.1.0 h1:uuaP0hAbW7Y4l0ZRQ6C9zfb7Mg1mbFKry/xzDAfmtLA=
-github.com/josharian/native v1.1.0/go.mod h1:7X/raswPFr05uY3HiLlYeyQntB6OO7E/d2Cu7qoaN2w=
-github.com/jsimonetti/rtnetlink/v2 v2.0.1 h1:xda7qaHDSVOsADNouv7ukSuicKZO7GgVUCXxpaIEIlM=
-github.com/jsimonetti/rtnetlink/v2 v2.0.1/go.mod h1:7MoNYNbb3UaDHtF8udiJo/RH6VsTKP1pqKLUTVCvToE=
 github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE=
 github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk=
 github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
 github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
-github.com/mdlayher/netlink v1.7.2 h1:/UtM3ofJap7Vl4QWCPDGXY8d3GIY2UGSDbK+QWmY8/g=
-github.com/mdlayher/netlink v1.7.2/go.mod h1:xraEF7uJbxLhc5fpHL4cPe221LI2bdttWlU+ZGLfQSw=
-github.com/mdlayher/socket v0.4.1 h1:eM9y2/jlbs1M615oshPQOHZzj6R6wMT7bX5NPiQvn2U=
-github.com/mdlayher/socket v0.4.1/go.mod h1:cAqeGjoufqdxWkD7DkpyS+wcefOtmu5OQ8KuoJGIReA=
 github.com/moby/sys/capability v0.4.0 h1:4D4mI6KlNtWMCM1Z/K0i7RV1FkX+DBDHKVJpCndZoHk=
 github.com/moby/sys/capability v0.4.0/go.mod h1:4g9IK291rVkms3LKCDOoYlnV8xKwoDTpIrNEE35Wq0I=
 github.com/moby/sys/mountinfo v0.7.2 h1:1shs6aH5s4o5H2zQLn796ADW1wMrIwHsyJ2v9KouLrg=
@@ -46,8 +38,8 @@ github.com/moby/sys/userns v0.1.0 h1:tVLXkFOxVu9A64/yh59slHVv9ahO9UIev4JZusOLG/g
 github.com/moby/sys/userns v0.1.0/go.mod h1:IHUYgu/kao6N8YZlp9Cf444ySSvCmDlmzUcYfDHOl28=
 github.com/mrunalp/fileutils v0.5.1 h1:F+S7ZlNKnrwHfSwdlgNSkKo67ReVf8o9fel6C3dkm/Q=
 github.com/mrunalp/fileutils v0.5.1/go.mod h1:M1WthSahJixYnrXQl/DFQuteStB1weuxD2QJNHXfbSQ=
-github.com/opencontainers/cgroups v0.0.6 h1:tfZFWTIIGaUUFImTyuTg+Mr5x8XRiSdZESgEBW7UxuI=
-github.com/opencontainers/cgroups v0.0.6/go.mod h1:oWVzJsKK0gG9SCRBfTpnn16WcGEqDI8PAcpMGbqWxcs=
+github.com/opencontainers/cgroups v0.1.0 h1:6W05KiDvgj1yi/6D13SJCvYx8TAESz67szvHPxhfcrs=
+github.com/opencontainers/cgroups v0.1.0/go.mod h1:hPBRvnBhLZueEN0eJyozMeM3HeFGYlZW9KnO//px6G4=
 github.com/opencontainers/runtime-spec v1.3.0 h1:YZupQUdctfhpZy3TM39nN9Ika5CBWT5diQ8ibYCRkxg=
 github.com/opencontainers/runtime-spec v1.3.0/go.mod h1:jwyrGlmzljRJv/Fgzds9SsS/C5hL+LL3ko9hs6T5lQ0=
 github.com/opencontainers/selinux v1.13.0 h1:Zza88GWezyT7RLql12URvoxsbLfjFx988+LGaWfbL84=
@@ -81,8 +73,6 @@ github.com/vishvananda/netns v0.0.5 h1:DfiHV+j8bA32MFM7bfEunvT8IAqQ/NzSJHtcmW5zd
 github.com/vishvananda/netns v0.0.5/go.mod h1:SpkAiCQRtJ6TvvxPnOSyH3BMl6unz3xZlaprSwhNNJM=
 golang.org/x/net v0.43.0 h1:lat02VYK2j4aLzMzecihNvTlJNQUq316m2Mr9rnM6YE=
 golang.org/x/net v0.43.0/go.mod h1:vhO1fvI4dGsIjh73sWfUVjj3N7CA9WkKJNQm2svM6Jg=
-golang.org/x/sync v0.1.0 h1:wsuoTGHzEhffawBOhz5CYhcrV4IdKZbEyZjBMuTp12o=
-golang.org/x/sync v0.1.0/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sys v0.0.0-20220715151400-c0bba94af5f8/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.1.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.2.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=

libcontainer/process_linux.go

@@ -276,7 +276,8 @@ func (p *setnsProcess) addIntoCgroupV1() error {
 			return fmt.Errorf("unknown controller %s in SubCgroupPaths", ctrl)
 		}
 		cgPath := path.Join(base, sub)
-		if !strings.HasPrefix(cgPath, base) {
+		// Make sure cgPath is either base itself or below it.
+		if cgPath != base && !strings.HasPrefix(cgPath, base+"/") {
 			return fmt.Errorf("bad sub cgroup path: %s", sub)
 		}
 		paths[ctrl] = cgPath
@@ -384,7 +385,8 @@ func (p *setnsProcess) prepareCgroupFD() (*os.File, error) {
 		sub = p.process.SubCgroupPaths[""]
 	}
 	cgroup := path.Join(base, sub)
-	if !strings.HasPrefix(cgroup, base) {
+	// Make sure cgroup is either base itself or below it.
+	if cgroup != base && !strings.HasPrefix(cgroup, base+"/") {
 		return nil, fmt.Errorf("bad sub cgroup path: %s", sub)
 	}
 

tests/integration/exec.bats

@@ -7,6 +7,13 @@ function setup() {
 }
 
 function teardown() {
+	# Remove the sibling cgroup created by "runc exec --cgroup" tests, if any.
+	# It has to be removed before teardown_bundle, as the latter removes the
+	# parent cgroup, which can't be done while it has any children.
+	if [ -v SIBLING_CGROUP ]; then
+		rmdir "$SIBLING_CGROUP"
+		unset SIBLING_CGROUP
+	fi
 	teardown_bundle
 }
 
@@ -214,6 +221,22 @@ function check_exec_debug() {
 	[ "$status" -ne 0 ]
 	[[ "$output" == *"bad sub cgroup path"* ]]
 
+	# Check we can't join a sibling cgroup sharing our name prefix.
+	local cpu_path sibling
+	cpu_path=$(get_cgroup_path cpu)
+	sibling="$(basename "$cpu_path")-sibling"
+	# SIBLING_CGROUP is removed by teardown.
+	SIBLING_CGROUP="$(dirname "$cpu_path")/$sibling"
+	mkdir "$SIBLING_CGROUP"
+	runc exec --cgroup "../$sibling" test_busybox cat /proc/self/cgroup
+	[ "$status" -ne 0 ]
+	[[ "$output" == *"bad sub cgroup path"* ]]
+
+	# Same as above, for a particular controller.
+	runc exec --cgroup "cpu:../$sibling" test_busybox cat /proc/self/cgroup
+	[ "$status" -ne 0 ]
+	[[ "$output" == *"bad sub cgroup path"* ]]
+
 	# Check we can't join non-existing subcgroup.
 	runc exec --cgroup nonexistent test_busybox cat /proc/self/cgroup
 	[ "$status" -ne 0 ]
@@ -265,6 +288,16 @@ function check_exec_debug() {
 	[ "$status" -ne 0 ]
 	[[ "$output" == *"bad sub cgroup path"* ]]
 
+	# Check we can't join a sibling cgroup sharing our name prefix.
+	local sibling
+	sibling="$(basename "$CGROUP_V2_PATH")-sibling"
+	# SIBLING_CGROUP is removed by teardown.
+	SIBLING_CGROUP="$(dirname "$CGROUP_V2_PATH")/$sibling"
+	mkdir "$SIBLING_CGROUP"
+	runc exec --cgroup "../$sibling" test_busybox cat /proc/self/cgroup
+	[ "$status" -ne 0 ]
+	[[ "$output" == *"bad sub cgroup path"* ]]
+
 	# Check we can't join non-existing subcgroup.
 	runc exec --cgroup nonexistent test_busybox cat /proc/self/cgroup
 	[ "$status" -ne 0 ]