diff --git a/.docker-latest.metadata b/.docker-latest.metadata index 37b69f2..284c958 100644 --- a/.docker-latest.metadata +++ b/.docker-latest.metadata @@ -1,7 +1,7 @@ e85e178f427c3be0c06542b53ec973273a179d0d SOURCES/containerd-03e5862.tar.gz -d51bd47c3e89d2d41d7bd9baa900e2222b0fde5d SOURCES/docker-6774275.tar.gz +e34fa473b340adabc8361c7b9de4022accb551cc SOURCES/docker-3a17ad5.tar.gz a2a9f5deac1f258765a1840240f8d80c2767e99f SOURCES/docker-storage-setup-f7a3746.tar.gz -70100fa5ac215e33202e9069399b54fc99a416fb SOURCES/libnetwork-b6cb1ee.tar.gz -b7db522ba563dda969072fab86a92334486bc1e6 SOURCES/runc-e18c2ce.tar.gz +1dd4909fca7307c3da51e839252ecf03207100fb SOURCES/libnetwork-929077d.tar.gz +b439a84a41399362a37f0a82de97176e07a0044f SOURCES/runc-3753658.tar.gz a097f1adcbf8c793a405af91730b78204ba3e60b SOURCES/tini-6ad9813.tar.gz ea4b3d96c46fccb6781d66a6c53c087b179c80fe SOURCES/v1.10-migrator-c417a6a.tar.gz diff --git a/.gitignore b/.gitignore index 444facb..cf107fd 100644 --- a/.gitignore +++ b/.gitignore @@ -1,7 +1,7 @@ SOURCES/containerd-03e5862.tar.gz -SOURCES/docker-6774275.tar.gz +SOURCES/docker-3a17ad5.tar.gz SOURCES/docker-storage-setup-f7a3746.tar.gz -SOURCES/libnetwork-b6cb1ee.tar.gz -SOURCES/runc-e18c2ce.tar.gz +SOURCES/libnetwork-929077d.tar.gz +SOURCES/runc-3753658.tar.gz SOURCES/tini-6ad9813.tar.gz SOURCES/v1.10-migrator-c417a6a.tar.gz diff --git a/SOURCES/daemon.json b/SOURCES/daemon.json new file mode 100644 index 0000000..168b318 --- /dev/null +++ b/SOURCES/daemon.json @@ -0,0 +1,4 @@ +{ + "log-driver": "journald", + "signature-verification": false +} diff --git a/SOURCES/docker-latest-cleanup.service b/SOURCES/docker-latest-cleanup.service index 11c5e93..25debd8 100644 --- a/SOURCES/docker-latest-cleanup.service +++ b/SOURCES/docker-latest-cleanup.service @@ -1,11 +1,8 @@ [Unit] Description=Docker Cleanup -Requires=docker-latest.service +BindsTo=docker-latest.service [Service] Type=oneshot ExecStart=/usr/bin/sh -c "DEAD=`docker ps -aq -f status=dead` && [ -n \"$DEAD\" ] && docker rm $DEAD; exit 0" - -[Install] -WantedBy=multi-user.target diff --git a/SOURCES/docker-latest-cleanup.timer b/SOURCES/docker-latest-cleanup.timer index b4948d4..5d26a03 100644 --- a/SOURCES/docker-latest-cleanup.timer +++ b/SOURCES/docker-latest-cleanup.timer @@ -1,5 +1,7 @@ [Unit] Description=Run docker-cleanup every hour +BindsTo=docker-latest.service +After=docker-latest.service [Timer] OnCalendar=hourly diff --git a/SOURCES/docker-latest.service b/SOURCES/docker-latest.service index d59ca00..8b813a8 100644 --- a/SOURCES/docker-latest.service +++ b/SOURCES/docker-latest.service @@ -8,6 +8,7 @@ Requires=rhel-push-plugin.socket [Service] Type=notify NotifyAccess=all +KillMode=process EnvironmentFile=-/etc/sysconfig/docker-latest EnvironmentFile=-/etc/sysconfig/docker-latest-storage EnvironmentFile=-/etc/sysconfig/docker-latest-network @@ -20,6 +21,8 @@ ExecStart=/usr/bin/dockerd-latest \ --authorization-plugin=rhel-push-plugin \ --exec-opt native.cgroupdriver=systemd \ --userland-proxy-path=/usr/libexec/docker/docker-proxy-latest \ + --seccomp-profile=/etc/docker-latest/seccomp.json \ + --config-file=/etc/docker-latest/daemon.json \ -g /var/lib/docker-latest \ $OPTIONS \ $DOCKER_STORAGE_OPTIONS \ diff --git a/SOURCES/docker-latest.sysconfig b/SOURCES/docker-latest.sysconfig index 740654e..7bf6915 100644 --- a/SOURCES/docker-latest.sysconfig +++ b/SOURCES/docker-latest.sysconfig @@ -1,7 +1,7 @@ # /etc/sysconfig/docker-latest # Modify these options if you want to change the way the docker daemon runs -OPTIONS='--selinux-enabled --log-driver=journald --signature-verification=false' +OPTIONS='--selinux-enabled' DOCKER_CERT_PATH=/etc/docker # If you want to add your own registry to be used for docker search and docker diff --git a/SOURCES/seccomp.json b/SOURCES/seccomp.json new file mode 100644 index 0000000..b9a4564 --- /dev/null +++ b/SOURCES/seccomp.json @@ -0,0 +1,701 @@ +{ + "defaultAction": "SCMP_ACT_ERRNO", + "archMap": [ + { + "architecture": "SCMP_ARCH_X86_64", + "subArchitectures": [ + "SCMP_ARCH_X86", + "SCMP_ARCH_X32" + ] + }, + { + "architecture": "SCMP_ARCH_AARCH64", + "subArchitectures": [ + "SCMP_ARCH_ARM" + ] + }, + { + "architecture": "SCMP_ARCH_MIPS64", + "subArchitectures": [ + "SCMP_ARCH_MIPS", + "SCMP_ARCH_MIPS64N32" + ] + }, + { + "architecture": "SCMP_ARCH_MIPS64N32", + "subArchitectures": [ + "SCMP_ARCH_MIPS", + "SCMP_ARCH_MIPS64" + ] + }, + { + "architecture": "SCMP_ARCH_MIPSEL64", + "subArchitectures": [ + "SCMP_ARCH_MIPSEL", + "SCMP_ARCH_MIPSEL64N32" + ] + }, + { + "architecture": "SCMP_ARCH_MIPSEL64N32", + "subArchitectures": [ + "SCMP_ARCH_MIPSEL", + "SCMP_ARCH_MIPSEL64" + ] + }, + { + "architecture": "SCMP_ARCH_S390X", + "subArchitectures": [ + "SCMP_ARCH_S390" + ] + } + ], + "syscalls": [ + { + "names": [ + "accept", + "accept4", + "access", + "alarm", + "alarm", + "bind", + "brk", + "capget", + "capset", + "chdir", + "chmod", + "chown", + "chown32", + "clock_getres", + "clock_gettime", + "clock_nanosleep", + "close", + "connect", + "copy_file_range", + "creat", + "dup", + "dup2", + "dup3", + "epoll_create", + "epoll_create1", + "epoll_ctl", + "epoll_ctl_old", + "epoll_pwait", + "epoll_wait", + "epoll_wait_old", + "eventfd", + "eventfd2", + "execve", + "execveat", + "exit", + "exit_group", + "faccessat", + "fadvise64", + "fadvise64_64", + "fallocate", + "fanotify_mark", + "fchdir", + "fchmod", + "fchmodat", + "fchown", + "fchown32", + "fchownat", + "fcntl", + "fcntl64", + "fdatasync", + "fgetxattr", + "flistxattr", + "flock", + "fork", + "fremovexattr", + "fsetxattr", + "fstat", + "fstat64", + "fstatat64", + "fstatfs", + "fstatfs64", + "fsync", + "ftruncate", + "ftruncate64", + "futex", + "futimesat", + "getcpu", + "getcwd", + "getdents", + "getdents64", + "getegid", + "getegid32", + "geteuid", + "geteuid32", + "getgid", + "getgid32", + "getgroups", + "getgroups32", + "getitimer", + "getpeername", + "getpgid", + "getpgrp", + "getpid", + "getppid", + "getpriority", + "getrandom", + "getresgid", + "getresgid32", + "getresuid", + "getresuid32", + "getrlimit", + "get_robust_list", + "getrusage", + "getsid", + "getsockname", + "getsockopt", + "get_thread_area", + "gettid", + "gettimeofday", + "getuid", + "getuid32", + "getxattr", + "inotify_add_watch", + "inotify_init", + "inotify_init1", + "inotify_rm_watch", + "io_cancel", + "ioctl", + "io_destroy", + "io_getevents", + "ioprio_get", + "ioprio_set", + "io_setup", + "io_submit", + "ipc", + "kill", + "lchown", + "lchown32", + "lgetxattr", + "link", + "linkat", + "listen", + "listxattr", + "llistxattr", + "_llseek", + "lremovexattr", + "lseek", + "lsetxattr", + "lstat", + "lstat64", + "madvise", + "memfd_create", + "mincore", + "mkdir", + "mkdirat", + "mknod", + "mknodat", + "mlock", + "mlock2", + "mlockall", + "mmap", + "mmap2", + "mprotect", + "mq_getsetattr", + "mq_notify", + "mq_open", + "mq_timedreceive", + "mq_timedsend", + "mq_unlink", + "mremap", + "msgctl", + "msgget", + "msgrcv", + "msgsnd", + "msync", + "munlock", + "munlockall", + "munmap", + "nanosleep", + "newfstatat", + "_newselect", + "open", + "openat", + "pause", + "pipe", + "pipe2", + "poll", + "ppoll", + "prctl", + "pread64", + "preadv", + "prlimit64", + "pselect6", + "pwrite64", + "pwritev", + "read", + "readahead", + "readlink", + "readlinkat", + "readv", + "recv", + "recvfrom", + "recvmmsg", + "recvmsg", + "remap_file_pages", + "removexattr", + "rename", + "renameat", + "renameat2", + "restart_syscall", + "rmdir", + "rt_sigaction", + "rt_sigpending", + "rt_sigprocmask", + "rt_sigqueueinfo", + "rt_sigreturn", + "rt_sigsuspend", + "rt_sigtimedwait", + "rt_tgsigqueueinfo", + "sched_getaffinity", + "sched_getattr", + "sched_getparam", + "sched_get_priority_max", + "sched_get_priority_min", + "sched_getscheduler", + "sched_rr_get_interval", + "sched_setaffinity", + "sched_setattr", + "sched_setparam", + "sched_setscheduler", + "sched_yield", + "seccomp", + "select", + "semctl", + "semget", + "semop", + "semtimedop", + "send", + "sendfile", + "sendfile64", + "sendmmsg", + "sendmsg", + "sendto", + "setfsgid", + "setfsgid32", + "setfsuid", + "setfsuid32", + "setgid", + "setgid32", + "setgroups", + "setgroups32", + "setitimer", + "setpgid", + "setpriority", + "setregid", + "setregid32", + "setresgid", + "setresgid32", + "setresuid", + "setresuid32", + "setreuid", + "setreuid32", + "setrlimit", + "set_robust_list", + "setsid", + "setsockopt", + "set_thread_area", + "set_tid_address", + "setuid", + "setuid32", + "setxattr", + "shmat", + "shmctl", + "shmdt", + "shmget", + "shutdown", + "sigaltstack", + "signalfd", + "signalfd4", + "sigreturn", + "socket", + "socketcall", + "socketpair", + "splice", + "stat", + "stat64", + "statfs", + "statfs64", + "symlink", + "symlinkat", + "sync", + "sync_file_range", + "syncfs", + "sysinfo", + "syslog", + "tee", + "tgkill", + "time", + "timer_create", + "timer_delete", + "timerfd_create", + "timerfd_gettime", + "timerfd_settime", + "timer_getoverrun", + "timer_gettime", + "timer_settime", + "times", + "tkill", + "truncate", + "truncate64", + "ugetrlimit", + "umask", + "uname", + "unlink", + "unlinkat", + "utime", + "utimensat", + "utimes", + "vfork", + "vmsplice", + "wait4", + "waitid", + "waitpid", + "write", + "writev", + "mount", + "umount2", + "reboot", + "name_to_handle_at", + "unshare" + ], + "action": "SCMP_ACT_ALLOW", + "args": [], + "comment": "", + "includes": {}, + "excludes": {} + }, + { + "names": [ + "personality" + ], + "action": "SCMP_ACT_ALLOW", + "args": [ + { + "index": 0, + "value": 0, + "valueTwo": 0, + "op": "SCMP_CMP_EQ" + } + ], + "comment": "", + "includes": {}, + "excludes": {} + }, + { + "names": [ + "personality" + ], + "action": "SCMP_ACT_ALLOW", + "args": [ + { + "index": 0, + "value": 8, + "valueTwo": 0, + "op": "SCMP_CMP_EQ" + } + ], + "comment": "", + "includes": {}, + "excludes": {} + }, + { + "names": [ + "personality" + ], + "action": "SCMP_ACT_ALLOW", + "args": [ + { + "index": 0, + "value": 4294967295, + "valueTwo": 0, + "op": "SCMP_CMP_EQ" + } + ], + "comment": "", + "includes": {}, + "excludes": {} + }, + { + "names": [ + "breakpoint", + "cacheflush", + "set_tls" + ], + "action": "SCMP_ACT_ALLOW", + "args": [], + "comment": "", + "includes": { + "arches": [ + "arm", + "arm64" + ] + }, + "excludes": {} + }, + { + "names": [ + "arch_prctl" + ], + "action": "SCMP_ACT_ALLOW", + "args": [], + "comment": "", + "includes": { + "arches": [ + "amd64", + "x32" + ] + }, + "excludes": {} + }, + { + "names": [ + "modify_ldt" + ], + "action": "SCMP_ACT_ALLOW", + "args": [], + "comment": "", + "includes": { + "arches": [ + "amd64", + "x32", + "x86" + ] + }, + "excludes": {} + }, + { + "names": [ + "s390_pci_mmio_read", + "s390_pci_mmio_write", + "s390_runtime_instr" + ], + "action": "SCMP_ACT_ALLOW", + "args": [], + "comment": "", + "includes": { + "arches": [ + "s390", + "s390x" + ] + }, + "excludes": {} + }, + { + "names": [ + "open_by_handle_at" + ], + "action": "SCMP_ACT_ALLOW", + "args": [], + "comment": "", + "includes": { + "caps": [ + "CAP_DAC_READ_SEARCH" + ] + }, + "excludes": {} + }, + { + "names": [ + "bpf", + "clone", + "fanotify_init", + "lookup_dcookie", + "mount", + "name_to_handle_at", + "perf_event_open", + "setdomainname", + "sethostname", + "setns", + "umount", + "umount2", + "unshare" + ], + "action": "SCMP_ACT_ALLOW", + "args": [], + "comment": "", + "includes": { + "caps": [ + "CAP_SYS_ADMIN" + ] + }, + "excludes": {} + }, + { + "names": [ + "clone" + ], + "action": "SCMP_ACT_ALLOW", + "args": [ + { + "index": 0, + "value": 2080505856, + "valueTwo": 0, + "op": "SCMP_CMP_MASKED_EQ" + } + ], + "comment": "", + "includes": {}, + "excludes": { + "caps": [ + "CAP_SYS_ADMIN" + ], + "arches": [ + "s390", + "s390x" + ] + } + }, + { + "names": [ + "clone" + ], + "action": "SCMP_ACT_ALLOW", + "args": [ + { + "index": 1, + "value": 2080505856, + "valueTwo": 0, + "op": "SCMP_CMP_MASKED_EQ" + } + ], + "comment": "s390 parameter ordering for clone is different", + "includes": { + "arches": [ + "s390", + "s390x" + ] + }, + "excludes": { + "caps": [ + "CAP_SYS_ADMIN" + ] + } + }, + { + "names": [ + "reboot" + ], + "action": "SCMP_ACT_ALLOW", + "args": [], + "comment": "", + "includes": { + "caps": [ + "CAP_SYS_BOOT" + ] + }, + "excludes": {} + }, + { + "names": [ + "chroot" + ], + "action": "SCMP_ACT_ALLOW", + "args": [], + "comment": "", + "includes": { + "caps": [ + "CAP_SYS_CHROOT" + ] + }, + "excludes": {} + }, + { + "names": [ + "delete_module", + "init_module", + "finit_module", + "query_module" + ], + "action": "SCMP_ACT_ALLOW", + "args": [], + "comment": "", + "includes": { + "caps": [ + "CAP_SYS_MODULE" + ] + }, + "excludes": {} + }, + { + "names": [ + "acct" + ], + "action": "SCMP_ACT_ALLOW", + "args": [], + "comment": "", + "includes": { + "caps": [ + "CAP_SYS_PACCT" + ] + }, + "excludes": {} + }, + { + "names": [ + "kcmp", + "process_vm_readv", + "process_vm_writev", + "ptrace" + ], + "action": "SCMP_ACT_ALLOW", + "args": [], + "comment": "", + "includes": { + "caps": [ + "CAP_SYS_PTRACE" + ] + }, + "excludes": {} + }, + { + "names": [ + "iopl", + "ioperm" + ], + "action": "SCMP_ACT_ALLOW", + "args": [], + "comment": "", + "includes": { + "caps": [ + "CAP_SYS_RAWIO" + ] + }, + "excludes": {} + }, + { + "names": [ + "settimeofday", + "stime", + "adjtimex" + ], + "action": "SCMP_ACT_ALLOW", + "args": [], + "comment": "", + "includes": { + "caps": [ + "CAP_SYS_TIME" + ] + }, + "excludes": {} + }, + { + "names": [ + "vhangup" + ], + "action": "SCMP_ACT_ALLOW", + "args": [], + "comment": "", + "includes": { + "caps": [ + "CAP_SYS_TTY_CONFIG" + ] + }, + "excludes": {} + } + ] +} \ No newline at end of file diff --git a/SPECS/docker-latest.spec b/SPECS/docker-latest.spec index 152cc97..b173916 100644 --- a/SPECS/docker-latest.spec +++ b/SPECS/docker-latest.spec @@ -22,14 +22,14 @@ # macros for 'docker' package VR %global docker_epoch 2 %global docker_ver 1.12.6 -%global docker_rel 16 +%global docker_rel 22 # docker %global git_docker https://github.com/projectatomic/docker -%global commit_docker 677427538684e8297245ff74f081b1bf3ef5f1ec +%global commit_docker 3a17ad53336040e731130f2abd3ffbb13409d402 %global shortcommit_docker %(c=%{commit_docker}; echo ${c:0:7}) # docker_branch used in %%check -%global docker_branch docker-1.13.1 +%global docker_branch docker-1.13.1-rhel # d-s-s %global git_dss https://github.com/projectatomic/%{repo}-storage-setup/ @@ -46,7 +46,7 @@ # docker-runc %global git_runc https://github.com/projectatomic/runc -%global commit_runc e18c2ce5191576bab2e301b8ea250bd34dc0fc79 +%global commit_runc 375365825d2cd12cd2ea6cb9d34df34a1581abd9 %global shortcommit_runc %(c=%{commit_runc}; echo ${c:0:7}) # docker-containerd @@ -61,12 +61,12 @@ # docker-proxy %global git_libnetwork https://github.com/docker/libnetwork -%global commit_libnetwork b6cb1eee1e7fc27ee05f0eb830d3e60e67a88565 +%global commit_libnetwork 929077d0db4e9ed4fc543d4f77a60584c27df327 %global shortcommit_libnetwork %(c=%{commit_libnetwork}; echo ${c:0:7}) Name: %{repo}-latest Version: 1.13.1 -Release: 4%{?dist} +Release: 11.git%{shortcommit_docker}%{?dist} Summary: Automates deployment of containerized applications License: ASL 2.0 URL: https://%{provider}.%{provider_tld}/projectatomic/%{repo} @@ -88,6 +88,8 @@ Source13: %{git_tini}/archive/%{commit_tini}/tini-%{shortcommit_tini}.tar.gz Source14: %{git_libnetwork}/archive/%{commit_libnetwork}/libnetwork-%{shortcommit_libnetwork}.tar.gz Source15: %{name}-cleanup.service Source16: %{name}-cleanup.timer +Source17: daemon.json +Source18: seccomp.json #Source13: %%{repo}-containerd.service BuildRequires: cmake BuildRequires: git @@ -103,8 +105,7 @@ BuildRequires: gpgme-devel BuildRequires: libassuan-devel BuildRequires: pkgconfig(systemd) Requires: device-mapper-libs >= 7:1.02.97 - -Requires: container-selinux >= 2:2.10-2 +Requires: container-selinux >= 2:2.12-2 Requires: %{repo}-common >= %{docker_epoch}:%{docker_ver}-%{docker_rel} Requires: %{repo}-client-latest = %{version}-%{release} Requires: %{repo}-rhel-push-plugin >= %{docker_epoch}:%{docker_ver}-%{docker_rel} @@ -123,7 +124,6 @@ Provides: %{repo}-engine-latest = %{version}-%{release} # needs tar to be able to run containers Requires: tar - Requires: subscription-manager-plugin-container # include d-s-s into main docker package and obsolete existing d-s-s rpm @@ -131,7 +131,6 @@ Requires: subscription-manager-plugin-container Requires: lvm2 >= 7:1.02.97 Requires: xfsprogs Obsoletes: %{repo}-storage-setup <= 0.5-3 - Requires: skopeo-containers Requires: gnupg @@ -312,6 +311,10 @@ for x in bundles/latest; do break done +#install daemon.json and seccomp.json +install -dp %{buildroot}%{_sysconfdir}/%{name} +install -p -m 644 %{SOURCE17} %{buildroot}%{_sysconfdir}/%{name} +install -p -m 644 %{SOURCE18} %{buildroot}%{_sysconfdir}/%{name} # install manpages install -d %{buildroot}%{_mandir}/man1 @@ -466,6 +469,8 @@ exit 0 %license LICENSE* %doc AUTHORS CHANGELOG.md CONTRIBUTING.md MAINTAINERS NOTICE README* %config(noreplace) %{_sysconfdir}/sysconfig/%{name}* +%config(noreplace) %{_sysconfdir}/%{name}/daemon.json +%config(noreplace) %{_sysconfdir}/%{name}/seccomp.json %{_mandir}/man1/%{name}*.1.gz %{_mandir}/man5/Dockerfile-latest.5.gz %{_mandir}/man8/%{repo}d-latest.8.gz @@ -528,6 +533,41 @@ exit 0 %endif # with_migrator %changelog +* Tue May 17 2017 Lokesh Mandvekar - 1.13.1-11.git3a17ad5 +- Resolves: #1451796 +- built docker @projectatomic/docker-1.13.1-rhel commit 3a17ad5 + +* Tue May 09 2017 Lokesh Mandvekar - 1.13.1-10.git475c5d2 +- KillMode=process in docker-latest.service (RE: #1424709) + +* Tue May 09 2017 Lokesh Mandvekar - 1.13.1-9.git475c5d2 +- /etc/docker/{daemon,seccomp}.json should be config(noreplace) + +* Tue May 09 2017 Lokesh Mandvekar - 1.13.1-8.git475c5d2 +- correct docker-latest-cleanup.timer unitfile +- correct docker branch used in check section +- use docker-common >= 1.12.6-22 + +* Tue May 09 2017 Lokesh Mandvekar - 1.13.1-7.git475c5d2 +- built docker @projectatomic/docker-1.13.1-rhel commit 475c5d2 +- Resolves: #1447455 +- include patch for docker-cleanup unitfiles (RE: #1448457) + +* Tue May 02 2017 Lokesh Mandvekar - 1.13.1-6.gitb7732b0 +- Resolves: #1441100, #1444111, #1445134 +- built docker @projectatomic/docker-1.13.1-rhel commit b7732b0 +- built docker-runc @projectatomic/docker-1.13.1 commit 3753658 +- built docker-containerd @projectatomic/docker-1.13.1 commit 03e5862 +- built docker-init commit 6ad9813 +- built libnetwork commit 929077d + +* Thu Apr 27 2017 Lokesh Mandvekar - 1.13.1-5 +- built docker @projectatomic/docker-1.13.1 commit f27a6fc +- built docker-runc @projectatomic/docker-1.13.1 commit 3753658 +- built docker-containerd @projectatomic/docker-1.13.1 commit 03e5862 +- built docker-init commit 6ad9813 +- built libnetwork commit 5dc95a3 + * Tue Mar 21 2017 Lokesh Mandvekar - 1.13.1-4 - Resolves: #1427334 - remove docker-latest on container-selinux removal - install dead container cleanup unitfiles in main package