From 7fd08d24f622f9ad1c0a45d824cd03f409925b99 Mon Sep 17 00:00:00 2001 From: Vighnesh Maheshwari Date: Fri, 7 Nov 2025 21:33:58 -0800 Subject: [PATCH 1/3] runc: port upstream patch for tmpfs mount mode Signed-off-by: Vighnesh Maheshwari --- ...rootfs-only-set-mode-for-tmpfs-mount.patch | 131 ++++++++++++++++++ packages/runc/runc.spec | 2 + 2 files changed, 133 insertions(+) create mode 100644 packages/runc/1001-rootfs-only-set-mode-for-tmpfs-mount.patch diff --git a/packages/runc/1001-rootfs-only-set-mode-for-tmpfs-mount.patch b/packages/runc/1001-rootfs-only-set-mode-for-tmpfs-mount.patch new file mode 100644 index 000000000..a887d7eba --- /dev/null +++ b/packages/runc/1001-rootfs-only-set-mode-for-tmpfs-mount.patch @@ -0,0 +1,131 @@ +From e855129df22621a08a5436a5cb6e9bfff9a9ad0f Mon Sep 17 00:00:00 2001 +From: Aleksa Sarai +Date: Fri, 7 Nov 2025 14:52:09 +1100 +Subject: [PATCH] rootfs: only set mode= for tmpfs mount if target already + existed + +This was always the intended behaviour but commit 72fbb34f5006 ("rootfs: +switch to fd-based handling of mountpoint targets") regressed it when +adding a mechanism to create a file handle to the target if it didn't +already exist (causing the later stat to always succeed). + +A lot of people depend on this functionality, so add some tests to make +sure we don't break it in the future. + +Fixes: 72fbb34f5006 ("rootfs: switch to fd-based handling of mountpoint targets") +Signed-off-by: Aleksa Sarai +(cherry picked from commit 8d0921c4c76cdd527c86251c728e46f071c96337) +Signed-off-by: Aleksa Sarai +--- + libcontainer/rootfs_linux.go | 25 ++++++++-------- + tests/integration/mounts.bats | 54 +++++++++++++++++++++++++++++++++++ + 2 files changed, 66 insertions(+), 13 deletions(-) + +diff --git a/libcontainer/rootfs_linux.go b/libcontainer/rootfs_linux.go +index 204e6a80fc1..ab5a260dae8 100644 +--- a/libcontainer/rootfs_linux.go ++++ b/libcontainer/rootfs_linux.go +@@ -511,6 +511,18 @@ func (m *mountEntry) createOpenMountpoint(rootfs string) (Err error) { + _ = dstFile.Close() + } + }() ++ if err == nil && m.Device == "tmpfs" { ++ // If the original target exists, copy the mode for the tmpfs mount. ++ stat, err := dstFile.Stat() ++ if err != nil { ++ return fmt.Errorf("check tmpfs source mode: %w", err) ++ } ++ dt := fmt.Sprintf("mode=%04o", syscallMode(stat.Mode())) ++ if m.Data != "" { ++ dt = dt + "," + m.Data ++ } ++ m.Data = dt ++ } + if err != nil { + if !errors.Is(err, unix.ENOENT) { + return fmt.Errorf("lookup mountpoint target: %w", err) +@@ -551,19 +563,6 @@ func (m *mountEntry) createOpenMountpoint(rootfs string) (Err error) { + } + } + +- if m.Device == "tmpfs" { +- // If the original target exists, copy the mode for the tmpfs mount. +- stat, err := dstFile.Stat() +- if err != nil { +- return fmt.Errorf("check tmpfs source mode: %w", err) +- } +- dt := fmt.Sprintf("mode=%04o", syscallMode(stat.Mode())) +- if m.Data != "" { +- dt = dt + "," + m.Data +- } +- m.Data = dt +- } +- + dstFullPath, err := procfs.ProcSelfFdReadlink(dstFile) + if err != nil { + return fmt.Errorf("get mount destination real path: %w", err) +diff --git a/tests/integration/mounts.bats b/tests/integration/mounts.bats +index 11fb2cfc63e..2da17df2706 100644 +--- a/tests/integration/mounts.bats ++++ b/tests/integration/mounts.bats +@@ -234,6 +234,60 @@ function test_mount_order() { + [[ "$(stat -c %a rootfs/setgid/a/b/c)" == 2755 ]] + } + ++# https://github.com/opencontainers/runc/issues/4971 ++@test "runc run [tmpfs mount mode= inherit]" { ++ mkdir rootfs/tmpfs ++ chmod "=0710" rootfs/tmpfs ++ ++ update_config '.mounts += [{ ++ type: "tmpfs", ++ source: "tmpfs", ++ destination: "/tmpfs", ++ options: ["rw", "nodev", "nosuid"] ++ }]' ++ update_config '.process.args = ["stat", "-c", "%a", "/tmpfs"]' ++ ++ runc run test_busybox ++ [ "$status" -eq 0 ] ++ [[ "$output" == "710" ]] ++ ++ update_config '.process.args = ["cat", "/proc/self/mounts"]' ++ runc run test_busybox ++ [ "$status" -eq 0 ] ++ grep -Ex "tmpfs /tmpfs tmpfs [^ ]*\bmode=710\b[^ ]* .*" <<<"$output" ++} ++ ++# https://github.com/opencontainers/runc/issues/4971 ++@test "runc run [tmpfs mount mode=1777 default]" { ++ update_config '.mounts += [{ ++ type: "tmpfs", ++ source: "tmpfs", ++ destination: "/non-existent/foo/bar/baz", ++ options: ["rw", "nodev", "nosuid"] ++ }]' ++ update_config '.process.args = ["stat", "-c", "%a", "/non-existent/foo/bar/baz"]' ++ ++ rm -rf rootfs/non-existent ++ runc run test_busybox ++ [ "$status" -eq 0 ] ++ [[ "$output" == "1777" ]] ++ ++ update_config '.process.args = ["cat", "/proc/self/mounts"]' ++ ++ rm -rf rootfs/non-existent ++ runc run test_busybox ++ [ "$status" -eq 0 ] ++ # We don't explicitly set a mode= in this case, it is just the tmpfs default. ++ grep -Ex "tmpfs /non-existent/foo/bar/baz tmpfs .*" <<<"$output" ++ run ! grep -Ex "tmpfs /non-existent/foo/bar/baz tmpfs [^ ]*\bmode=[0-7]+\b[^ ]* .*" <<<"$output" ++ ++ # Verify that the actual modes are *not* 1777. ++ [[ "$(stat -c %a rootfs/non-existent)" == 755 ]] ++ [[ "$(stat -c %a rootfs/non-existent/foo)" == 755 ]] ++ [[ "$(stat -c %a rootfs/non-existent/foo/bar)" == 755 ]] ++ [[ "$(stat -c %a rootfs/non-existent/foo/bar/baz)" == 755 ]] ++} ++ + @test "runc run [ro /sys/fs/cgroup mounts]" { + # Without cgroup namespace. + update_config '.linux.namespaces -= [{"type": "cgroup"}]' diff --git a/packages/runc/runc.spec b/packages/runc/runc.spec index e963e1b93..936fbdb73 100644 --- a/packages/runc/runc.spec +++ b/packages/runc/runc.spec @@ -20,6 +20,8 @@ Source2: gpgkey-B64E4955B29FA3D463F2A9062897FAD2B7E9446F.asc # Kir Kolyshkin Source3: gpgkey-C2428CD75720FACDCF76B6EA17DE5ECB75A1100E.asc +Patch1001: 1001-rootfs-only-set-mode-for-tmpfs-mount.patch + BuildRequires: git BuildRequires: %{_cross_os}glibc-devel BuildRequires: %{_cross_os}libseccomp-devel From b8fc1a7af99c9722a1a3750a6f07386582da2349 Mon Sep 17 00:00:00 2001 From: Vighnesh Maheshwari Date: Fri, 7 Nov 2025 21:38:20 -0800 Subject: [PATCH 2/3] twoliter: bump core-kit to v10.9.2 Signed-off-by: Vighnesh Maheshwari --- Twoliter.toml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Twoliter.toml b/Twoliter.toml index 15f50dd13..5cae5f7c7 100644 --- a/Twoliter.toml +++ b/Twoliter.toml @@ -1,5 +1,5 @@ schema-version = 2 -release-version = "10.9.1" +release-version = "10.9.2" project-vendor = "Bottlerocket" [vendor.bottlerocket] From 33868e2c61ec623c5e6f3bd2d98ff7c8daca7643 Mon Sep 17 00:00:00 2001 From: Vighnesh Maheshwari Date: Fri, 7 Nov 2025 21:38:49 -0800 Subject: [PATCH 3/3] changelog: update for 10.9.2 release Signed-off-by: Vighnesh Maheshwari --- CHANGELOG.md | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index f9f31d626..33e130abd 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,3 +1,9 @@ +# v10.9.2 (2025-11-08) +## OS Changes +- Patch runc to set the correct mode for tmpfs mounts ([#731]) + +[#731]: https://github.com/bottlerocket-os/bottlerocket-core-kit/pull/731 + # v10.9.1 (2025-11-05) ## OS Changes - Update runc to v1.2.8 ([#708])