tbb-commits September 2017

tbb-commits@lists.torproject.org

2 participants
85 discussions

[tor-browser-bundle/maint-7.0] Updating gk's subkeys
by gk＠torproject.org 20 Sep '17

20 Sep '17

commit 787fb6cd2b7fd50bbe8a8089ba24d6827aa5697e Author: Georg Koppen <gk(a)torproject.org> Date: Wed Sep 20 13:47:43 2017 +0000 Updating gk's subkeys --- gitian/gpg/gk.gpg | Bin 41255 -> 88633 bytes 1 file changed, 0 insertions(+), 0 deletions(-) diff --git a/gitian/gpg/gk.gpg b/gitian/gpg/gk.gpg index 9037e43..2eb314e 100644 Binary files a/gitian/gpg/gk.gpg and b/gitian/gpg/gk.gpg differ

1 0

[tor-browser-bundle/maint-7.0] Release preparations for 7.0.6
by gk＠torproject.org 20 Sep '17

20 Sep '17

commit 9531065790b09471d9deb66dad59fcc44bdd6db3 Author: Georg Koppen <gk(a)torproject.org> Date: Wed Sep 20 13:18:52 2017 +0000 Release preparations for 7.0.6 Changelog update, versions bump, and config.yml update --- Bundle-Data/Docs/ChangeLog.txt | 14 ++++++++++++++ gitian/versions | 14 +++++++------- tools/update-responses/config.yml | 10 +++++----- 3 files changed, 26 insertions(+), 12 deletions(-) diff --git a/Bundle-Data/Docs/ChangeLog.txt b/Bundle-Data/Docs/ChangeLog.txt index aace374..310cdf0 100644 --- a/Bundle-Data/Docs/ChangeLog.txt +++ b/Bundle-Data/Docs/ChangeLog.txt @@ -1,3 +1,17 @@ +Tor Browser 7.0.6 -- September 26 2017 + * All Platforms + * Update Firefox to 52.4.0esr + * Update Tor to 0.3.1.7 + * Update Torbutton to 1.9.7.7 + * Bug 22542: Security Settings window too small on macOS 10.12 (fixup) + * Bug 20375: Warn users after entering fullscreen mode + * Update HTTPS-Everywhere to 2017.9.12 + * Update NoScript to 5.0.10 + * Bug 21830: Copying large text from web console leaks to /tmp + * Bug 23393: Don't crash all tabs when closing one tab + * OS X + * Bug 23404: Add missing Noto Sans Buginese font to the macOS whitelist + Tor Browser 7.0.5 -- September 4 2017 * All Platforms * Update Torbutton to 1.9.7.6 diff --git a/gitian/versions b/gitian/versions index d6e1dd4..368fb98 100755 --- a/gitian/versions +++ b/gitian/versions @@ -10,15 +10,15 @@ DATA_OUTSIDE_APP_DIR=1 VERIFY_TAGS=1 -FIREFOX_VERSION=52.3.0esr +FIREFOX_VERSION=52.4.0esr TORBROWSER_UPDATE_CHANNEL=release TORBROWSER_TAG=tor-browser-${FIREFOX_VERSION}-7.0-1-build1 -TOR_TAG=tor-0.3.0.10 +TOR_TAG=tor-0.3.1.7 TORLAUNCHER_TAG=0.2.12.3 -TORBUTTON_TAG=1.9.7.6 -HTTPSE_TAG=2017.8.31 +TORBUTTON_TAG=1.9.7.7 +HTTPSE_TAG=2017.9.12 NSIS_TAG=v0.3.1 ZLIB_TAG=v1.2.8 LIBEVENT_TAG=release-2.0.22-stable @@ -45,7 +45,7 @@ GITIAN_TAG=tor-browser-builder-4-5 OPENSSL_VER=1.0.2k GMP_VER=5.1.3 FIREFOX_LANG_VER=$FIREFOX_VERSION -FIREFOX_LANG_BUILD=build2 +FIREFOX_LANG_BUILD=build1 BINUTILS_VER=2.24 GCC_VER=5.1.0 CLANG_VER=3.8.0 @@ -67,7 +67,7 @@ YASM_VER=1.2.0 ## File names for the source packages OPENSSL_PACKAGE=openssl-${OPENSSL_VER}.tar.gz GMP_PACKAGE=gmp-${GMP_VER}.tar.bz2 -NOSCRIPT_PACKAGE=noscript_security_suite-5.0.9-fx+sm.xpi +NOSCRIPT_PACKAGE=noscript_security_suite-5.0.10-fx+sm.xpi CCTOOLS_PACKAGE=cctools.tar.gz OSXSDK_PACKAGE=MacOSX10.7.sdk.tar.gz MSVCR100_PACKAGE=msvcr100.dll @@ -102,7 +102,7 @@ YASM_PACKAGE=yasm-${YASM_VER}.tar.gz OPENSSL_HASH=6b3977c61f2aedf0f96367dcfb5c6e578cf37e7b8d913b4ecb6643c3cb88d8c0 GMP_HASH=752079520b4690531171d0f4532e40f08600215feefede70b24fabdc6f1ab160 OSXSDK_HASH=da77bb0003fcca5ea8c4e8cb2da8828ded750c54afdcac29ec6f3b46ad5e3adf -NOSCRIPT_HASH=610dc5ffcc7133f2ccc2f1a14280e326d371a8a2fc76497becf2d5cf21257955 +NOSCRIPT_HASH=cfc8018a5ddd2a699581932a9911e28b1060667c7849cf5283b548b5b29a65a2 CCTOOLS_HASH=e908fdebc2886ee5491ebfc7e7950af451b3c4e2439c2d7a923ed06ad05113e4 MSVCR100_HASH=1221a09484964a6f38af5e34ee292b9afefccb3dc6e55435fd3aaf7c235d9067 PYCRYPTO_HASH=f2ce1e989b272cfcb677616763e0a2e7ec659effa67a88aa92b3a65528f60a3c diff --git a/tools/update-responses/config.yml b/tools/update-responses/config.yml index dbd4551..9838c8a 100644 --- a/tools/update-responses/config.yml +++ b/tools/update-responses/config.yml @@ -20,13 +20,13 @@ build_targets: osx64: Darwin_x86_64-gcc3 channels: alpha: 7.0a4 - release: 7.0.5 + release: 7.0.6 versions: - 7.0.5: - platformVersion: 52.3.0 - detailsURL: https://blog.torproject.org/blog/tor-browser-705-released + 7.0.6: + platformVersion: 52.4.0 + detailsURL: https://blog.torproject.org/blog/tor-browser-706-released incremental_from: - - 7.0.4 + - 7.0.5 migrate_archs: osx32: osx64 migrate_langs:

1 0

[tor-browser/tor-browser-52.4.0esr-7.0-1] squash! Bug 6253: Add canvas image extraction prompt.
by gk＠torproject.org 20 Sep '17

20 Sep '17

commit 852e4a1ef17e19ea5f57072f1ea3779107e7dce2 Author: Kathy Brade <brade(a)pearlcrescent.com> Date: Wed Sep 20 09:26:21 2017 -0400 squash! Bug 6253: Add canvas image extraction prompt. When processing the ShowCanvasPermissionPrompt message in the main (parent) process, avoid returning an error from the IPC handler if the browser element cannot be obtained. Prior to this change, canvas prompt requests that arrived as a tab was closing would generate an error, which in turn caused the main process to kill the content process. --- dom/ipc/TabParent.cpp | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/dom/ipc/TabParent.cpp b/dom/ipc/TabParent.cpp index ff1b41afafdb..9731561ce0b3 100644 --- a/dom/ipc/TabParent.cpp +++ b/dom/ipc/TabParent.cpp @@ -3281,7 +3281,12 @@ bool TabParent::RecvShowCanvasPermissionPrompt(const nsCString& firstPartyURI) { nsCOMPtr<nsIBrowser> browser = do_QueryInterface(mFrameElement); - NS_ENSURE_TRUE(browser, false); + if (!browser) { + // If the tab is being closed, the browser may not be available. + // In this case we can ignore the request. + return true; + } + nsCOMPtr<nsIObserverService> os = services::GetObserverService(); NS_ENSURE_TRUE(os, false); nsresult rv = os->NotifyObservers(browser, "canvas-permissions-prompt",

1 0

[tor-browser/tor-browser-52.3.0esr-7.5-2] Bug 1365047 Turn on the Windows DLL Blocklist in MinGW r=aklotz
by gk＠torproject.org 20 Sep '17

20 Sep '17

commit 1eeaa470e06b7538a961b2f33dddaeafdcc456fd Author: Tom Ritter <tom(a)mozilla.com> Date: Mon May 15 15:49:20 2017 -0500 Bug 1365047 Turn on the Windows DLL Blocklist in MinGW r=aklotz MozReview-Commit-ID: 3hF7iOdH89P --HG-- extra : rebase_source : 95614960544ae55b983dbbd40e1036ff236204b3 --- mozglue/build/WindowsDllBlocklist.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/mozglue/build/WindowsDllBlocklist.h b/mozglue/build/WindowsDllBlocklist.h index 5afe6b8ceee8..82d4a365351f 100644 --- a/mozglue/build/WindowsDllBlocklist.h +++ b/mozglue/build/WindowsDllBlocklist.h @@ -6,7 +6,7 @@ #ifndef mozilla_windowsdllblocklist_h #define mozilla_windowsdllblocklist_h -#if defined(_MSC_VER) && (defined(_M_IX86) || defined(_M_X64)) +#if (defined(_MSC_VER) || defined(__MINGW32__)) && (defined(_M_IX86) || defined(_M_X64)) #include <windows.h> #include "mozilla/GuardObjects.h"

1 0

[torbutton/maint-1.9.7] Release preparations for 1.9.7.7
by gk＠torproject.org 20 Sep '17

20 Sep '17

commit 3f8bb67a052a51f8e11d4acb8f105b48fd521b92 Author: Georg Koppen <gk(a)torproject.org> Date: Wed Sep 20 06:45:58 2017 +0000 Release preparations for 1.9.7.7 CHANGELOG update and version bump --- src/CHANGELOG | 4 ++++ src/install.rdf | 2 +- 2 files changed, 5 insertions(+), 1 deletion(-) diff --git a/src/CHANGELOG b/src/CHANGELOG index 9a6a53a..35f198c 100644 --- a/src/CHANGELOG +++ b/src/CHANGELOG @@ -1,3 +1,7 @@ +1.9.7.7 + * Bug 22542: Security Settings window too small on macOS 10.12 (fixup) + * Bug 20375: Warn users after entering fullscreen mode + 1.9.7.6 * Bug 22989: Fix dimensions of new windows on macOS * Translations update diff --git a/src/install.rdf b/src/install.rdf index 4549bda..97cdfd7 100644 --- a/src/install.rdf +++ b/src/install.rdf @@ -6,7 +6,7 @@ <em:name>Torbutton</em:name> <em:creator>Mike Perry</em:creator> <em:id>torbutton(a)torproject.org</em:id> - <em:version>1.9.7.6</em:version> + <em:version>1.9.7.7</em:version> <em:multiprocessCompatible>true</em:multiprocessCompatible> <em:homepageURL>https://www.torproject.org/projects/torbrowser.html.en</em:homepageURL> <em:optionsURL>chrome://torbutton/content/preferences.xul</em:optionsURL>

1 0

[torbutton/maint-1.9.7] fixup! Bug 22542: Security Settings window too small on macOS 10.12
by gk＠torproject.org 20 Sep '17

20 Sep '17

commit 9aa6f29c896be65a4f883dd4bd73f48e07d359a7 Author: Kathy Brade <brade(a)pearlcrescent.com> Date: Wed Jul 12 13:52:28 2017 -0400 fixup! Bug 22542: Security Settings window too small on macOS 10.12 Automatically adjust the height of the Security Settings window so that no scrollbar is needed. Also, add 100 pixels to the width and increase maxheight and maxwidth to give users more flexibility when they choose to manually resize the window. --- src/chrome/content/preferences.js | 46 ++++++++++++++++++++++++++++++++++---- src/chrome/content/preferences.xul | 10 ++++----- 2 files changed, 47 insertions(+), 9 deletions(-) diff --git a/src/chrome/content/preferences.js b/src/chrome/content/preferences.js index 1e47cad..a76dddb 100644 --- a/src/chrome/content/preferences.js +++ b/src/chrome/content/preferences.js @@ -42,10 +42,7 @@ function torbutton_init_security_ui() { getIntPref("extensions.torbutton.security_slider"))); torbutton_set_custom(getBoolPref("extensions.torbutton.security_custom")); - // Show a scrollbar for the description text if one is needed. - // To avoid bug 21330, we set the overflow=auto style here instead - // of directly in the XUL. - document.getElementById("descBox").style.overflow = "auto"; + setTimeout(adjustDialogSize, 0); }; // Write the two prefs from the current settings. @@ -54,3 +51,44 @@ function torbutton_save_security_settings() { sliderPositionToPrefSetting(state.slider)); setBoolPref("extensions.torbutton.security_custom", state.custom); }; + +// Increase the height of this window so that a vertical scrollbar is not +// needed on the description box. +function adjustDialogSize() { + try { + // Find the height required by the tallest description element. + let descHeight = 0; + let descs = descNames.map(name => document.getElementById(name)); + descs.forEach(elem => { + let origCollapsed = elem.collapsed; + elem.collapsed = false; + let h = elem.scrollHeight; + elem.collapsed = origCollapsed; + if (h > descHeight) + descHeight = h; + }); + + // Cap the height (just in case). + const kMaxDescriptionHeight = 550; + if (descHeight > kMaxDescriptionHeight) + descHeight = kMaxDescriptionHeight; + + // Increase the height of the description container if it is too short. + let boxElem = document.getElementById("descBox"); + if (boxElem.clientHeight < descHeight) { + boxElem.setAttribute("height", descHeight); + + // Resize the XUL window to account for the new description height. In + // order for sizeToContent() to work correctly, it seems that we must + // remove the height attribute from the dialog (that attribute is added + // after a user manually resizes the window). + document.documentElement.removeAttribute("height"); + sizeToContent(); + } + } catch (e) {} + + // Show a scrollbar for the description text if one is needed. + // To avoid bug 21330, we set the overflow=auto style here instead + // of directly in the XUL. + document.getElementById("descBox").style.overflow = "auto"; +} diff --git a/src/chrome/content/preferences.xul b/src/chrome/content/preferences.xul index 9bd8ae3..9ebc5d6 100644 --- a/src/chrome/content/preferences.xul +++ b/src/chrome/content/preferences.xul @@ -13,11 +13,11 @@ onload="torbutton_init_security_ui()" align="stretch" pack="center" - maxheight="350" + maxheight="600" minwidth="400" - maxwidth="600" + maxwidth="800" ondialogaccept="torbutton_save_security_settings()" - width="400" > + width="500" > <script type="application/x-javascript" src="torbutton_util.js"/> <script type="application/x-javascript" src="preferences.js"/> @@ -26,7 +26,7 @@ <caption label="&torbutton.prefs.sec_caption;"/> <hbox id="torbutton_slider_settings" flex="1" align="stretch" hidden="false"> <vbox> - <hbox height="220"> + <hbox flex="1" minheight="220"> <vbox> <scale id="torbutton_sec_slider" flex="1" min="1" max="3" movetoclick="true" orient="vertical" @@ -57,7 +57,7 @@ </vbox> </hbox> </vbox> - <vbox id="descBox" flex="1" width="400" style="overflow: hidden;"> + <vbox id="descBox" flex="1" style="overflow: hidden;"> <vbox id="desc_high" collapsed="true"> <description class="slider-text-size, slider-text-weight">

1 0

[torbutton/maint-1.9.7] Bug 20375: Warn users after entering fullscreen mode.
by gk＠torproject.org 20 Sep '17

20 Sep '17

commit d68d2b68366af9456adf8c152e127ec5c10344c5 Author: Arthur Edelstein <arthuredelstein(a)gmail.com> Date: Tue Aug 22 12:06:21 2017 -0700 Bug 20375: Warn users after entering fullscreen mode. When the browser window is maximized, we show users a notification warning that maximizing the screen is fingerprintable. We should show this warning when the window enters fullscreen mode as well. This change is especially important for macOS, which uses window.STATE_FULLSCREEN instead of window.STATE_MAXIMIZED when the user clicks the "maximize" button on the window title bar. --- src/chrome/content/torbutton.js | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/src/chrome/content/torbutton.js b/src/chrome/content/torbutton.js index 11f4b61..db6b694 100644 --- a/src/chrome/content/torbutton.js +++ b/src/chrome/content/torbutton.js @@ -2126,7 +2126,8 @@ var torbutton_resizelistener = m_tb_resize_handler = async function() { // Wait for end of execution queue to ensure we have correct windowState. await new Promise(resolve => setTimeout(resolve, 0)); - if (window.windowState === 1) { + if (window.windowState === window.STATE_MAXIMIZED || + window.windowState === window.STATE_FULLSCREEN) { if (m_tb_prefs. getIntPref("extensions.torbutton.maximize_warnings_remaining") > 0) {

1 0

[tor-browser/tor-browser-52.3.0esr-7.0-1] Bug 21830: Copying large text from web console leaks to /tmp
by gk＠torproject.org 20 Sep '17

20 Sep '17

commit 7a1b25245e73051cb724a7eb6a66de18263f88c2 Author: Georg Koppen <gk(a)torproject.org> Date: Fri Aug 4 05:55:49 2017 +0000 Bug 21830: Copying large text from web console leaks to /tmp Patch written by Neill Miller --- widget/nsTransferable.cpp | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/widget/nsTransferable.cpp b/widget/nsTransferable.cpp index e99d45401df8..976180c7581e 100644 --- a/widget/nsTransferable.cpp +++ b/widget/nsTransferable.cpp @@ -39,6 +39,7 @@ Notes to self: #include "nsIFile.h" #include "nsILoadContext.h" #include "mozilla/UniquePtr.h" +#include "mozilla/Preferences.h" NS_IMPL_ISUPPORTS(nsTransferable, nsITransferable) @@ -248,6 +249,11 @@ nsTransferable::Init(nsILoadContext* aContext) if (aContext) { mPrivateData = aContext->UsePrivateBrowsing(); + } else { + // without aContext here to provide PrivateBrowsing information, + // we defer to the active configured setting + mPrivateData = + mozilla::Preferences::GetBool("browser.privatebrowsing.autostart"); } #ifdef DEBUG mInitialized = true;

1 0

[tor-browser-build/master] Bug 23039: fix detection of runc version
by gk＠torproject.org 19 Sep '17

19 Sep '17

commit 1f054c59ddc349cf5719447bc51eaccde554312a Author: Nicolas Vigier <boklm(a)torproject.org> Date: Tue Sep 19 13:28:34 2017 +0200 Bug 23039: fix detection of runc version In the previous patch, we wrongly assumed that all runc 0.1.1 versions exited with 0 when given an unknown command, and used that to detect the version. It seems it is not true on all systems. We are now using the 'runc --version' command to find the version of runc. We don't support versions older than 0.1.1. --- rbm.conf | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/rbm.conf b/rbm.conf index ef37575..a93fa1a 100644 --- a/rbm.conf +++ b/rbm.conf @@ -375,11 +375,10 @@ ENV: ( var_p => { # runc100 is true if we are using runc >= 1.0.0 + # we assume that any version that is not 0.1.1 is >= 1.0.0 runc100 => sub { - # runc >= 1.0.0 exits with an error when trying to use an unknown - # command while older versions exit with 0 - my (undef, undef, $success) = capture_exec('sudo', 'runc', 'xyzxyzxyz'); - return !$success; + my ($out) = capture_exec('sudo', 'runc', '--version'); + return !($out =~ m/^runc version 0.1.1/); }, }, )

1 0

[tor-browser-build/master] Bug 23039: add support for runc 1.0.0
by gk＠torproject.org 15 Sep '17

15 Sep '17

commit 209818fc10ba14e8ebfb126cc364c26300795af9 Author: Nicolas Vigier <boklm(a)torproject.org> Date: Thu Sep 14 19:08:14 2017 +0200 Bug 23039: add support for runc 1.0.0 The var_p/runc100 option is used to detect the version of runc we are using. The format of the output of `runc --version` is different in both versions, so it is not easy to parse. However I noticed that runc 0.1.1 does not exit with an error when we try to use a command that does not exist while runc >= 1.0.0 does, so we use that to detect the runc version we are using. When using runc >= 1.0.0, we use `runc run` instead of `runc start': https://github.com/opencontainers/runc/commit/c669b8d1568633c68bd915561ceb2… In the runc config.json file, the format of the capabilities has been changed. Instead of having one list of capabilities, there are now separate lists for bounding, effective, inheritable, permitted and ambient capabilities (and we use the same list for all of them): https://github.com/opencontainers/runtime-spec/commit/eb114f057094dd2314682… We also add /proc/timer_list and /sys/firmware to the "maskedPaths", as those paths are now listed by default in the config.json file generated by `runc spec` with runc 1.0.0. --- README | 3 -- projects/common/runc-config.json | 91 +++++++++++++++++++++++++++++++++++++++- rbm.conf | 16 ++++++- 3 files changed, 105 insertions(+), 5 deletions(-) diff --git a/README b/README index 10cadec..5b4a2bc 100644 --- a/README +++ b/README @@ -8,9 +8,6 @@ To build Tor Browser, you need a Linux distribution that has support for runc (such as Debian jessie, Ubuntu 16.04, Fedora 20, etc ...). On Debian jessie, the runc package is available in backports. On Debian stretch, the runc package is available in the main repository. -Version 0.1.1 of runc is required (which is the version available in -Debian stretch and jessie-backports). It is not yet working with runc -version 1.0.0: https://trac.torproject.org/projects/tor/ticket/23039 Your user account should have sudo access, which is required to be able to extract container file systems, start containers and copy files to and diff --git a/projects/common/runc-config.json b/projects/common/runc-config.json index 02be3b0..a4386c6 100644 --- a/projects/common/runc-config.json +++ b/projects/common/runc-config.json @@ -1,5 +1,5 @@ { - "ociVersion": "1.0.0-rc1", + "ociVersion": "1.0.0[% IF !c("var_p/runc100") %]-rc1[% END %]", "platform": { "os": "linux", [% IF c("var/container/arch") == 'i386' -%] @@ -22,6 +22,90 @@ "TERM=xterm" ], "cwd": "/", +[% IF c("var_p/runc100") -%] + "capabilities": { + "bounding": [ + "CAP_AUDIT_WRITE", + "CAP_KILL", + "CAP_NET_BIND_SERVICE", + "CAP_SETGID", + "CAP_SETUID", + "CAP_MKNOD", + "CAP_SYS_CHROOT", +[% IF c("var/container/CAP_SYS_ADMIN") -%] + "CAP_SYS_ADMIN", +[% END -%] + "CAP_FSETID", + "CAP_FOWNER", + "CAP_DAC_OVERRIDE", + "CAP_CHOWN" + ], + "effective": [ + "CAP_AUDIT_WRITE", + "CAP_KILL", + "CAP_NET_BIND_SERVICE", + "CAP_SETGID", + "CAP_SETUID", + "CAP_MKNOD", + "CAP_SYS_CHROOT", +[% IF c("var/container/CAP_SYS_ADMIN") -%] + "CAP_SYS_ADMIN", +[% END -%] + "CAP_FSETID", + "CAP_FOWNER", + "CAP_DAC_OVERRIDE", + "CAP_CHOWN" + ], + "inheritable": [ + "CAP_AUDIT_WRITE", + "CAP_KILL", + "CAP_NET_BIND_SERVICE", + "CAP_SETGID", + "CAP_SETUID", + "CAP_MKNOD", + "CAP_SYS_CHROOT", +[% IF c("var/container/CAP_SYS_ADMIN") -%] + "CAP_SYS_ADMIN", +[% END -%] + "CAP_FSETID", + "CAP_FOWNER", + "CAP_DAC_OVERRIDE", + "CAP_CHOWN" + ], + "permitted": [ + "CAP_AUDIT_WRITE", + "CAP_KILL", + "CAP_NET_BIND_SERVICE", + "CAP_SETGID", + "CAP_SETUID", + "CAP_MKNOD", + "CAP_SYS_CHROOT", +[% IF c("var/container/CAP_SYS_ADMIN") -%] + "CAP_SYS_ADMIN", +[% END -%] + "CAP_FSETID", + "CAP_FOWNER", + "CAP_DAC_OVERRIDE", + "CAP_CHOWN" + ], + "ambient": [ + "CAP_AUDIT_WRITE", + "CAP_KILL", + "CAP_NET_BIND_SERVICE", + "CAP_SETGID", + "CAP_SETUID", + "CAP_MKNOD", + "CAP_SYS_CHROOT", +[% IF c("var/container/CAP_SYS_ADMIN") -%] + "CAP_SYS_ADMIN", +[% END -%] + "CAP_FSETID", + "CAP_FOWNER", + "CAP_DAC_OVERRIDE", + "CAP_CHOWN" + ] + }, +[% ELSE -%] "capabilities": [ "CAP_AUDIT_WRITE", "CAP_KILL", @@ -38,6 +122,7 @@ "CAP_DAC_OVERRIDE", "CAP_CHOWN" ], +[% END -%] "rlimits": [ { "type": "RLIMIT_NOFILE", @@ -165,6 +250,10 @@ "/proc/kcore", "/proc/latency_stats", "/proc/timer_stats", +[% IF c("var_p/runc100") -%] + "/proc/timer_list", + "/sys/firmware", +[% END -%] "/proc/sched_debug" ], "readonlyPaths": [ diff --git a/rbm.conf b/rbm.conf index 7bda275..ef37575 100644 --- a/rbm.conf +++ b/rbm.conf @@ -329,7 +329,7 @@ runc: cat > '[% c("var/container/dir") %]'/config.json << EOF [% INCLUDE 'runc-config.json' %] EOF - sudo runc start -b '[% c("var/container/dir") %]' rbm-[% sha256(c("build_id", { error_if_undef => 1 })) %] [% IF c("runc_hide_stderr") %]2>/dev/null[% END %] + sudo runc [% IF c("var_p/runc100") %]run[% ELSE %]start[% END %] -b '[% c("var/container/dir") %]' rbm-[% sha256(c("build_id", { error_if_undef => 1 })) %] [% IF c("runc_hide_stderr") %]2>/dev/null[% END %] remote_put: | #!/bin/sh @@ -369,3 +369,17 @@ runc: ENV: TZ: UTC LC_ALL: C +--- | + # This part of the file contains options written in perl + use IO::CaptureOutput qw(capture_exec); + ( + var_p => { + # runc100 is true if we are using runc >= 1.0.0 + runc100 => sub { + # runc >= 1.0.0 exits with an error when trying to use an unknown + # command while older versions exit with 0 + my (undef, undef, $success) = capture_exec('sudo', 'runc', 'xyzxyzxyz'); + return !$success; + }, + }, + )

1 0

← Newer
1
2
3
4
5
6
7
8
9
Older →

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

tbb-commits September 2017