From c73a5773aa51627812dcfc7ba8a4d87a7114989c Mon Sep 17 00:00:00 2001 From: Takahiro Itazuri Date: Tue, 14 Jul 2026 11:21:17 +0000 Subject: [PATCH 1/5] chore: update libseccomp to v2.6.1 libseccomp v2.6.1 [1] includes several security fixes. Firecracker's runtime and bundled default filters are not affected by any of the addressed issues because runtime loads precompiled BPF filters and the default policies do not meet their trigger conditions. Update the dev container dependency to incorporate the fixes and harden seccompiler-bin when compiling unusually large custom profiles. [1]: https://github.com/seccomp/libseccomp/releases/tag/v2.6.1 Signed-off-by: Takahiro Itazuri --- tools/devctr/Dockerfile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tools/devctr/Dockerfile b/tools/devctr/Dockerfile index aeeca343197..b21cbfd4af8 100644 --- a/tools/devctr/Dockerfile +++ b/tools/devctr/Dockerfile @@ -71,7 +71,7 @@ RUN apt-get update \ # Builder: static libseccomp (musl) # ============================================================ FROM base-image AS libseccomp-builder -ENV LIBSECCOMP_VER="v2.6.0" +ENV LIBSECCOMP_VER="v2.6.1" # Install static version of libseccomp # We need to compile from source because From c2cd5fce794a6e8390c2c95e6289401c9b7c4755 Mon Sep 17 00:00:00 2001 From: Takahiro Itazuri Date: Tue, 14 Jul 2026 11:31:38 +0000 Subject: [PATCH 2/5] chore: update Rust toolchain to 1.97.0 Rust 1.97.0 [1] does not announce a CVE or security advisory. It does fix an unsound coercion in the `pin!` macro [2][3] that can let safe Rust code trigger undefined behavior. Firecracker's source does not use the affected `pin!` macro, so this issue does not affect Firecracker. Update the repository toolchain pin and development container to this release. [1]: https://github.com/rust-lang/rust/releases/tag/1.97.0 [2]: https://github.com/rust-lang/rust/issues/153438 [3]: https://github.com/rust-lang/rust/pull/153457 Signed-off-by: Takahiro Itazuri --- rust-toolchain.toml | 2 +- tools/devctr/Dockerfile | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/rust-toolchain.toml b/rust-toolchain.toml index ee0ec7e7c58..8db2c23f3f2 100644 --- a/rust-toolchain.toml +++ b/rust-toolchain.toml @@ -11,7 +11,7 @@ # allowlisted using a toolchain that requires it, causing the A/B-test to # always fail. [toolchain] -channel = "1.96.0" +channel = "1.97.0" targets = ["x86_64-unknown-linux-musl", "aarch64-unknown-linux-musl"] profile = "minimal" diff --git a/tools/devctr/Dockerfile b/tools/devctr/Dockerfile index b21cbfd4af8..c289b4594dd 100644 --- a/tools/devctr/Dockerfile +++ b/tools/devctr/Dockerfile @@ -204,7 +204,7 @@ RUN cp /usr/lib/python3/dist-packages/seccomp.cpython-312-"$ARCH"-linux-gnu.so " # Base: Rust toolchain (current version) # ============================================================ FROM python-deps AS rust-toolchain -ARG RUST_TOOLCHAIN="1.96.0" +ARG RUST_TOOLCHAIN="1.97.0" ENV CARGO_HOME=/usr/local/rust ENV RUSTUP_HOME=/usr/local/rust ENV PATH="$PATH:$CARGO_HOME/bin" From 42c4673f6cbcc43941a50a5cc465064c28611848 Mon Sep 17 00:00:00 2001 From: Takahiro Itazuri Date: Tue, 14 Jul 2026 11:39:01 +0000 Subject: [PATCH 3/5] chore: fix Clippy warnings introduced in Rust 1.97.0 Rust 1.97.0's Clippy reports redundant references passed to `format!` and direct map iteration when only the values are used. Remove the redundant formatting references in the cgroup and jailer code, and iterate over the MMIO device map with `HashMap::values`. These are lint-only changes and do not alter runtime behavior. Signed-off-by: Takahiro Itazuri --- src/jailer/src/cgroup.rs | 4 ++-- src/jailer/src/main.rs | 2 +- src/vmm/src/device_manager/mmio.rs | 2 +- 3 files changed, 4 insertions(+), 4 deletions(-) diff --git a/src/jailer/src/cgroup.rs b/src/jailer/src/cgroup.rs index 3daea49ec25..5c8b992a866 100644 --- a/src/jailer/src/cgroup.rs +++ b/src/jailer/src/cgroup.rs @@ -392,13 +392,13 @@ impl CgroupV2 { let parent = match path.as_ref().parent() { Some(p) => p, None => { - writeln_special(&cg_subtree_ctrl, format!("+{}", &controller))?; + writeln_special(&cg_subtree_ctrl, format!("+{}", controller))?; return Ok(()); } }; Self::write_all_subtree_control(parent, controller)?; - writeln_special(&cg_subtree_ctrl, format!("+{}", &controller)) + writeln_special(&cg_subtree_ctrl, format!("+{}", controller)) } // Returns controllers that can be enabled from the cgroup path specified diff --git a/src/jailer/src/main.rs b/src/jailer/src/main.rs index 7af54b1cfcc..0daed7db7c8 100644 --- a/src/jailer/src/main.rs +++ b/src/jailer/src/main.rs @@ -382,7 +382,7 @@ mod tests { let mut fds = Vec::new(); for i in 0..n { - let maybe_file = File::create(format!("{}/{}", &tmp_dir_path, i)); + let maybe_file = File::create(format!("{}/{}", tmp_dir_path, i)); fds.push(maybe_file.unwrap().into_raw_fd()); } diff --git a/src/vmm/src/device_manager/mmio.rs b/src/vmm/src/device_manager/mmio.rs index fca77ad8014..8c5e49c906b 100644 --- a/src/vmm/src/device_manager/mmio.rs +++ b/src/vmm/src/device_manager/mmio.rs @@ -434,7 +434,7 @@ impl MMIODeviceManager { #[cfg(target_arch = "aarch64")] pub fn virtio_device_info(&self) -> Vec<&MMIODeviceInfo> { let mut device_info = Vec::new(); - for (_, dev) in self.virtio_devices.iter() { + for dev in self.virtio_devices.values() { device_info.push(&dev.resources); } device_info From d8580776b0bca5cbc8e2d95f0424bc981aa8e8a2 Mon Sep 17 00:00:00 2001 From: Takahiro Itazuri Date: Tue, 14 Jul 2026 11:50:57 +0000 Subject: [PATCH 4/5] chore: Update DEVCTR_IMAGE_TAG to v92 The new devctr image contains Rust 1.97.0 and libseccomp v2.6.1. Signed-off-by: Takahiro Itazuri --- tools/devtool | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tools/devtool b/tools/devtool index d138564c370..b24f55b6096 100755 --- a/tools/devtool +++ b/tools/devtool @@ -68,7 +68,7 @@ DEVCTR_IMAGE_NO_TAG="public.ecr.aws/firecracker/fcuvm" # Development container tag -DEVCTR_IMAGE_TAG=${DEVCTR_IMAGE_TAG:-v91} +DEVCTR_IMAGE_TAG=${DEVCTR_IMAGE_TAG:-v92} # Development container image (name:tag) # This should be updated whenever we upgrade the development container. From 8c0eaec743f8888c8e724f66d4de6194306975f6 Mon Sep 17 00:00:00 2001 From: Takahiro Itazuri Date: Tue, 14 Jul 2026 13:00:03 +0000 Subject: [PATCH 5/5] test: suppress rustup info in cargo deny A/B test When a Rust toolchain update is tested, the devctr contains the new toolchain but not the old toolchain required by the A (before) checkout. Running cargo in that checkout invokes the rustup proxy, which installs the old toolchain before starting Cargo and writes informational lines to cargo-deny's stderr, for example: info: syncing channel updates for 1.96.0-x86_64-unknown-linux-gnu info: downloading 5 components The audit test parses each stderr line as JSON, so these lines cause a JSONDecodeError before the A and B results can be compared. Set RUSTUP_LOG=warn only for cargo deny. This suppresses rustup info output while preserving warnings and errors, and keeps the JSON parser strict. Signed-off-by: Takahiro Itazuri --- tests/integration_tests/security/test_sec_audit.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tests/integration_tests/security/test_sec_audit.py b/tests/integration_tests/security/test_sec_audit.py index 1acabb29a2f..bd311e87ba1 100644 --- a/tests/integration_tests/security/test_sec_audit.py +++ b/tests/integration_tests/security/test_sec_audit.py @@ -54,6 +54,6 @@ def set_of_vulnerabilities(output: utils.CommandReturn): toml_file = FC_WORKSPACE_DIR / "Cargo.toml" git_ab_test_host_command_if_pr( - f"cargo deny --manifest-path {toml_file} -f json check advisories", + f"RUSTUP_LOG=warn cargo deny --manifest-path {toml_file} -f json check advisories", comparator=set_did_not_grow_comparator(set_of_vulnerabilities), )