diff --git a/VERSION-openeuler b/VERSION-openeuler index 3dce88bfe77fca9cc02c3d400d9222d4b0a456a5..5c640dd82812861a16fab90da940c0ed659751db 100644 --- a/VERSION-openeuler +++ b/VERSION-openeuler @@ -1 +1 @@ -18.09.0.116 +18.09.0.117 diff --git a/docker.spec b/docker.spec index 5479689aae8d1c4947acb3411a72e934e707b6a2..8047210f1abd4d48fe5d29cfe083eef5b6e11ff2 100644 --- a/docker.spec +++ b/docker.spec @@ -1,6 +1,6 @@ Name: docker-engine Version: 18.09.0 -Release: 116 +Release: 117 Summary: The open-source application container engine Group: Tools/Docker @@ -212,6 +212,12 @@ fi %endif %changelog +* Wed Sep 08 2021 xiadanni - 18.09.0-117 +- Type:bugfix +- CVE:NA +- SUG:NA +- DESC:add clone3 to seccomp whitelist to fix curl failed in X86 + * Fri Sep 03 2021 chenjiankun - 18.09.0-116 - Type:bugfix - CVE:NA diff --git a/git-commit b/git-commit index a4b8a7d737de8694603444c150deb96f35d771c4..25d592dce24ba7fd319313defcc5080053ef1a5e 100644 --- a/git-commit +++ b/git-commit @@ -1 +1 @@ -fe98eb898c92a27f02439bc043b071aaadaf3f6e +cfb8513e11e19660d19486f6a4ac25516f1413cd diff --git a/patch/0192-docker-add-clone3-to-seccomp-whitelist-to-fix-curl-f.patch b/patch/0192-docker-add-clone3-to-seccomp-whitelist-to-fix-curl-f.patch new file mode 100644 index 0000000000000000000000000000000000000000..de46a50a58774f5e63bd298e49a8122e342f778a --- /dev/null +++ b/patch/0192-docker-add-clone3-to-seccomp-whitelist-to-fix-curl-f.patch @@ -0,0 +1,30 @@ +From 376f6a9de2dcbf9605c23409a880eb3534af6ffa Mon Sep 17 00:00:00 2001 +From: xiadanni +Date: Wed, 8 Sep 2021 09:04:31 +0800 +Subject: [PATCH] docker: add clone3 to seccomp whitelist to fix curl failed in + X86 + +After kernel upgrade to 5.10, clone3 is defined. But if clone3 is not added +to docker seccomp whitelist, clone3 calling will be rejected in container, which +causes some commands like curl returns error. + +Signed-off-by: xiadanni +--- + components/engine/profiles/seccomp/seccomp_default.go | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/components/engine/profiles/seccomp/seccomp_default.go b/components/engine/profiles/seccomp/seccomp_default.go +index 60550124..ac81c2e0 100644 +--- a/components/engine/profiles/seccomp/seccomp_default.go ++++ b/components/engine/profiles/seccomp/seccomp_default.go +@@ -449,6 +449,7 @@ func DefaultProfile() *types.Seccomp { + { + Names: []string{ + "modify_ldt", ++ "clone3", + }, + Action: types.ActAllow, + Args: []*types.Arg{}, +-- +2.27.0 + diff --git a/series.conf b/series.conf index 09b3213be6a648ec9af744991e67064359dd70fa..743320fd88a50140a6e12705fde323f9bde4ac15 100644 --- a/series.conf +++ b/series.conf @@ -189,4 +189,5 @@ patch/0188-docker-check-containerd-pid-before-kill-it.patch patch/0189-docker-fix-Access-to-remapped-root-allows-privilege-.patch patch/0190-docker-fix-CVE-2021-21285.patch patch/0191-rollback-if-docker-restart-when-doing-BlkDiscard.patch +patch/0192-docker-add-clone3-to-seccomp-whitelist-to-fix-curl-f.patch #end