package/{containerd,docker-compose,runc}: security bumps - #35
Open
rschueler wants to merge 39 commits into
Open
Conversation
automated build + check-package + legal-info. Signed-off-by: Christian Stewart <christian@aperture.us>
Signed-off-by: Christian Stewart <christian@aperture.us>
Signed-off-by: Christian Stewart <christian@aperture.us>
Daemonize is a command line utility to run a program as a Unix daemon. Signed-off-by: Christian Stewart <christian@aperture.us> --- TODO: Changes requested for v2: https://patchwork.ozlabs.org/project/buildroot/patch/20210124102241.1207866-1-christian@paral.in/
Adds both host and target packages for buildah. Buildah is a tool that facilitates building OCI images. https://github.com/containers/buildah The buildah tree does not ship with a default policy.json file, and instead relies on packagers to provide one. A patch is added to create a basic barebones policy.json which is installed to /etc/containers/policy.json with a hook. Signed-off-by: Christian Stewart <christian@aperture.us> --- v1 -> v2: - add package to developers - add host runc dependency for host package - add libgpgme runtime dependency v2 -> v3: - add policy.json to target: required by some commands - example: buildah pull docker.io/library/alpine - pull: tested on raspberry pi 4 v3 -> v4: - TODO: move policy.json to package dir - https://lists.buildroot.org/pipermail/buildroot/2022-January/634936.html - bump to version v1.32.1 - https://github.com/containers/buildah/releases/tag/v1.32.1 v4 -> v5: - bump to version 1.35.x Signed-off-by: Christian Stewart <christian@aperture.us>
Add a symlink to the expected location for vpdma-1ba in the root of the firmware directory. Signed-off-by: Christian Stewart <christian@aperture.us>
Signed-off-by: Christian Stewart <christian@paral.in>
Lack of an RNG source can block boot-up on headless systems with few hardware entropy sources. This patch allows rngd to start earlier than the current "basic.target" when systemd is used. Removing the dependency on "basic.target" and by extension, "sockets.target" will allow rngd to start before, for example, docker.sock - which can take some time to become ready without entropy. This is a cherry-pick of a peer project patch: https://patchwork.openembedded.org/patch/163303/ Signed-off-by: Christian Stewart <christian@aperture.us>
Signed-off-by: Christian Stewart <christian@aperture.us>
Signed-off-by: Christian Stewart <christian@aperture.us>
Img is a standalone, daemon-less, unprivileged Dockerfile and OCI compatible container image builder. It uses the moby-buildkit solver internally. The commands/UX mirror the Docker CLI for workflow compatibility. Using the genuinetools- prefix due to the generic nature of the "img" name. Adds both host and target variants. fuse-overlayfs can be used as an unprivileged and rootless overlay filesystem backend. https://github.com/genuinetools/img Signed-off-by: Christian Stewart <christian@aperture.us> --- TODO: https://patchwork.ozlabs.org/project/buildroot/patch/20210516010521.1375959-1-christian@aperture.us/ - changes to patch to add libfuse3 as host package requested.
rEFInd is a user-friendly EFI GUI for boot selection. It can be used as an alternative to Grub with a user-friendly graphical and/or text interface for selecting a boot option. The default refind.conf interactively displays a list of boot options on startup, including detected Buildroot Linux kernel/initrd files. https://www.rodsbooks.com/refind/ Signed-off-by: Christian Stewart <christian@aperture.us>
Signed-off-by: Christian Stewart <christian@paral.in>
Some Linux kernels do not correctly generate the include/generated path when running "make all" without first running "make prepare" Since running "make prepare" is always valid on any Linux kernel, take the extra step to explicitly run "make prepare" before "make all." Signed-off-by: Christian Stewart <christian@aperture.us>
crio implements the Kubelet Container Runtime Interface (CRI) using OCI conformant runtimes like runc or podman. https://github.com/cri-o/cri-o/ Signed-off-by: Christian Stewart <christian@aperture.us>
RTKLIB is an open source program package for standard and precise positioning with GNSS. Version used here is from rtkexplorer, which is better optimized and more frequently updated than original version by Tomoji Takasu. Signed-off-by: Jan Havran <havran.jan@email.cz> --- v1: WIP: For SkiffOS: - https://patchwork.ozlabs.org/project/buildroot/patch/YhJLS73VW3szIXR+@arch-zen.localdomain/ - Changes applied from Thomas's review. - There are still Changes Requested before submitting upstream. - Updated to latest revision of the pkg. - Skip building the fortran files, need to investigate when this is necessary. Tested-by: Christian Stewart <christian@aperture.us>
Some kernels have device tree overlay files: make arch/arm64/boot/dts/amlogic/overlays/odroidn2/i2c0.dtbo Add an option to add these dtbo files to the LINUX_DTBS list. BR2_LINUX_KERNEL_INTREE_DTS_OVERLAY_NAME="amlogic/overlays/odroidn2/i2c0" Signed-off-by: Christian Stewart <christian@aperture.us>
Signed-off-by: Christian Stewart <christian@aperture.us>
Android bootimg utilities: mkbootimg and unpackbootimg. Signed-off-by: Christian Stewart <christian@paral.in> --- v1: CHANGES REQUESTED (Pending) https://patchwork.ozlabs.org/project/buildroot/patch/20220724235818.679881-1-christian@paral.in/
Signed-off-by: Christian Stewart <christian@aperture.us>
Add option to avoid build failures on older kernels. Signed-off-by: Christian Stewart <christian@aperture.us>
Fixes a build failure against some older toolchains. Signed-off-by: Christian Stewart <christian@aperture.us>
Some packages have CMakeLists.txt requiring CMake <3.5. Newer CMake forces at minimum version 3.5, leading to build failures: https://github.com/skiffos/SkiffOS/actions/runs/14208988354/job/39812576139#step:8:638 https://github.com/skiffos/SkiffOS/actions/runs/14211566256/job/39819600184#step:8:26664 Add the suggested build flag to force version 3.5.x and fix the error: -DCMAKE_POLICY_VERSION_MINIMUM=3.5 This is applied to all cmake packages to force 3.5 as a minimum. Signed-off-by: Christian Stewart <christian@aperture.us>
BR2_GOPROXY now configures the Go module proxy URL used to download Go modules specified in project go.mod and go.sum files. By default, it uses Google's official Go module mirror at proxy.golang.org, falling back to direct downloads if the module is not found in the mirror. This change sets the default GOPROXY value to match Go's built-in default of "https://proxy.golang.org,direct" which provides several benefits: - Avoid package breakages due to missing module sources - Better alignment with upstream Go toolchain defaults - Faster downloads via the proxy compared to direct Git clones - Maintains reproducible builds through Go's module checksum validation The default value from the toolchain can be read with "go env GOPROXY" We rely on package developers to audit their dependencies in go.mod and go.sum. The value can be configured to: - A comma-separated list of proxy URLs - "off" to disable all downloads - "direct" to download directly from source repositories For more details on Go module proxies: https://go.dev/ref/mod#module-proxy Discussion: https://lore.kernel.org/all/CADvTj4pXO2rwJ8oCzzGNY+OxLuo3uJnDT2PAxbyquw0L6dhfiA@mail.gmail.com/T/#t Signed-off-by: James Hilliard <james.hilliard1@gmail.com> Signed-off-by: Christian Stewart <christian@aperture.us> --- v1 -> v2: - added more context and links - renamed to GOPROXY instead of GOPROXY_LIST - moved into the !BR2_PRIMARY_SITE_ONLY section
Signed-off-by: Christian Stewart <christian@aperture.us>
Force Docker Engine to use the C DNS resolver. Fixes some issues related to the Go DNS resolver. Signed-off-by: Christian Stewart <christian@aperture.us>
Rewrap help text to comply with buildroot requirement of max 62 characters per line in help text. Signed-off-by: Christian Stewart <christian@aperture.us>
Add required Upstream field to patch header to comply with buildroot patch documentation requirements.
This series is currently marked "stable" on the gentoo repo. Signed-off-by: Christian Stewart <christian@aperture.us>
Signed-off-by: Christian Stewart <christian@aperture.us>
Add wasm32 (WebAssembly) as a buildroot architecture target using wasi-sdk 30 (clang/LLVM) as the external toolchain. This enables cross-compilation of userspace packages to wasm32-wasi. Architecture support: - Config.in.wasm32: Kconfig definition (little-endian, no MMU) - arch.mk.wasm32: wasi-libc emulation flags (-D_WASI_EMULATED_SIGNAL, -D_WASI_EMULATED_MMAN, etc.), setjmp/longjmp via -mllvm -wasm-enable-sjlj, force-include of wasi-posix-fixups.h - Flags guarded by ifeq ($(BR2_wasm32),y) to avoid leaking into other architecture builds Toolchain (toolchain-external-wasi-sdk): - Downloads wasi-sdk 30 for host arch (x86_64 or aarch64) - Installs wasi-sysroot to staging with symlink conflict resolution - Post-eval overrides: sets CC/CXX/LD to clang, AR/RANLIB to llvm-ar/llvm-ranlib, disables FORTIFY_SOURCE and relro (N/A for WASM) POSIX stub headers (51 files in wasi-stubs/): - wasi-posix-fixups.h (~460 lines): master compatibility header with ~80 POSIX function declarations, struct definitions (sigaction, rlimit, sockaddr_un with sun_path), and constants (signals, socket options, ioctls). Wrapped in #ifndef __ASSEMBLER__ guard. - Stub headers for linux/ (rtnetlink, netlink, capability, if_addr, if_link, if_arp, etc.), net/ (if, route, ethernet), sys/ (epoll, mount, wait, personality, etc.), and top-level (netdb, pwd, grp, termios, syslog, etc.) Busybox linker patch (0015-trylink): - Detects wasm-ld limitations via check_cc tests: --start-group/ --end-group, --warn-common, --verbose, -Map - Follows existing --sort-section/--sort-common detection pattern Replace -mllvm -wasm-enable-sjlj with __wasm_exception_handling__ define in wasi-posix-fixups.h (suppresses setjmp.h errors without requiring LLVM-level sjlj which caused issues). Add __posix_fcntl3 host import declaration so libc.a replacement can forward fcntl calls to the wasivm kernel. Patch wasi-libc static libraries as part of the toolchain install to fix conflicts with the wasivm kernel host imports. Without these patches, wasi-libc maintains internal state (signal handler tables, exit paths, CWD tracking) that bypasses the kernel, causing crashes. libc.a patches: fcntl.c.obj - replaced: forwards to env.__posix_fcntl3 chdir.c.obj - removed: env.chdir handles kernel CWD abort.c.obj - removed: env.abort delivers SIGABRT cleanly exit.c.obj - replaced: fflush(NULL) + env.__posix_exit (vfork-aware) _Exit.c.obj - replaced: env.__posix_exit directly libwasi-emulated-signal.a: signal.c.obj - removed: env.signal/raise/sigaction via kernel Set --export=__errno_location so host runtimes can set errno. Enable BR2_USE_MMU for wasm32 since the wasivm kernel implements vfork/exec. Add ~100 autoconf function cache overrides to TARGET_CONFIGURE_ARGS so configure scripts detect wasi-posix-fixups.h functions correctly despite the type mismatch with autoconf test patterns. Add -L$(STAGING_DIR)/usr/lib to TARGET_LDFLAGS for ncurses. Patch pselect.c.obj in libc.a: the original wasi-libc pselect returns ENOSYS when errorfds is non-empty, breaking any program using select() with exceptfds (standard POSIX pattern for EOF monitoring). The replacement converts fd_sets to pollfd arrays and calls poll(). Add wasi-posix-fixups.h declarations for sigaltstack, sigpending, setitimer/getitimer, killpg, WCOREDUMP, and SO_RCVBUFFORCE/ SO_SNDBUFFORCE socket options needed by vim and ncurses. Tested: busybox 1.37.0 compiles to 71 KB WebAssembly binary with 134 applets. Full buildroot rootfs.tar generated (550 KB). Signed-off-by: Christian Stewart <christian@aperture.us>
Signed-off-by: Christian Stewart <christian@aperture.us>
Carry the upstream namespace__fprintf warning fix and compare BTF function prototype parameter types so host-pahole 1.28 builds with GCC 16 -Werror. Fix kfunc const warning with gcc 16. Fix string const warnings with gcc 16. Signed-off-by: Christian Stewart <christian@aperture.us>
Signed-off-by: Christian Stewart <christian@aperture.us>
NetworkManager Meson searches PATH for modprobe when the option is unset. Buildroot target configure runs with HOST_DIR/bin and HOST_DIR/sbin first in BR_PATH, so it can compile the host modprobe path into the target daemon. Pass the target modprobe path explicitly, matching the existing iptables paths. Related: skiffos/SkiffOS#357 Signed-off-by: Christian Stewart <christian@aperture.us>
Fixes the following security issues: CVE-2026-39822: os: root escape via symlink plus trailing slash go1.26.5 (released 2026-07-07) includes security fixes to the crypto/tls and os packages, as well as bug fixes to the compiler, the runtime, the go command, and the net, os, and syscall packages. https://go.dev/doc/devel/release#go1.26.5 Signed-off-by: Christian Stewart <christian@aperture.us>
Fixes three advisories published on 2026-07-01 and addressed by containerd on 2026-07-09 across all maintained branches: CVE-2026-53488 critical image-config LABEL flows to a host-root command (>= 2.0.0, < 2.0.10) CVE-2026-47262 medium image-triggered runtime DoS via unbounded group parsing (>= 2.0.0, < 2.0.10) CVE-2026-46680 medium user ID handling bypass allows runAsNonRoot evasion (>= 2.0.4, fixed in 2.0.9) 2.0.11 is the current release of the 2.0.x branch, so this stays within the series already packaged rather than moving to 2.3.x. Signed-off-by: Rainer Schueler <rainer.schueler@tobrain.org>
rschueler
changed the title
added 2 commits
August 4, 2026 08:12
CVE-2025-62725 (CVSS 8.9, CWE-22, EPSS 0.137 / 96th percentile) — path traversal through remote OCI compose artifacts. When a layer carries the annotations com.docker.compose.extends or com.docker.compose.envfile, Compose joins the attacker-supplied value from com.docker.compose.file / com.docker.compose.envfile with its local cache directory and writes there. The path is never constrained to that directory, so a crafted artifact can overwrite arbitrary files as the user running compose. Two things make this worse than a typical container-image issue: no container is ever started — resolving the artifact is enough, so read-only commands such as `docker compose config` or `docker compose ps` trigger it — and it applies to every workflow that resolves remote OCI compose artifacts, including CI runners. Fixed upstream in v2.40.2 (commit 69bcb96), GHSA-gv8h-7v7w-r22q. Hash regenerated from the go-vendored tarball produced by the download post-process; the LICENSE hash is unchanged. Signed-off-by: Rainer Schueler <rainer.schueler@tobrain.org>
CVE-2026-41579 (CVSS 3.3) — affects versions prior to 1.3.6, 1.4.0-rc.1, 1.4.0-rc.12, 1.5.0-rc.1 and 1.5.0-rc.1, in the container setup path. Low severity, but the bump is a patch release inside the 1.3.x series and carries no interface change, so there is little reason to carry the finding instead. Drops 0001-Replace-os.Is-error-checking-functions-with-their-er.patch. That patch backported upstream runc 536e183451b7 ("Replace os.Is error checking functions with their errors.Is counterpart"), which is contained in 1.3.6 — validator.go, criu_linux.go, device_unix.go and the rest of the files it touched already use errors.Is. Keeping it makes the build fail at the patch step, which is how this was found. The only remaining os.Is* callers in 1.3.6 are integration tests and vendored third-party code, neither of which the patch addressed. Hash regenerated from the go-vendored tarball; the LICENSE hash is unchanged. Signed-off-by: Rainer Schueler <rainer.schueler@tobrain.org>
rschueler
force-pushed
the
containerd-2.0.11
branch
from
August 4, 2026 06:13
a8cfe93 to
2ca4a24
Compare
rschueler
pushed a commit
to rschueler/SkiffOS
that referenced
this pull request
Aug 4, 2026
docker-compose 2.38.2 → 2.40.2 closes CVE-2025-62725 (CVSS 8.9), a path traversal through remote OCI compose artifacts: a crafted layer's com.docker.compose.extends or .envfile annotation is joined with the local cache directory without being constrained to it, and resolving the artifact is enough — no container has to start, so `docker compose config` triggers it. runc 1.3.5 → 1.3.6 closes CVE-2026-41579 (3.3) in the container setup path. Low severity, but a patch release with no interface change. Both went into skiffos/buildroot#35 alongside the containerd bump. Not bumped: docker-engine and docker-cli. CVE-2026-42306 (7.2) and CVE-2026-41568 (6.1) match the packaged 28.3.3, but the records list github.com/docker/docker/daemon <= 28.5.2 as affected — there is no 28.x fix, only Engine 29.5.1. A major version jump needs its own change and its own testing. These three were invisible to the previous scanner. They only surfaced after the matching engine moved to grype, which normalises version strings before matching where NVD's cpeName lookup returned nothing.
paralin
force-pushed
the
skiff
branch
2 times, most recently
from
August 31, 2026 00:27
8cabb19 to
58659d0
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Three security bumps against the
skiffbranch. Each is the smallest release that carries the fix, and none crosses a major version.containerd 2.0.7 → 2.0.11
Three advisories published 2026-07-01, fixed by containerd 2026-07-09 across all maintained branches.
CVE-2026-53488 is the one that matters: the CRI plugin propagates labels from an image config (the
LABELinstruction in a Dockerfile) into a context where they reach a command run as root on the host. Pulling an untrusted image is enough.2.0.11 is the current release of the 2.0.x branch, so this stays within the series already packaged. Moving to 2.3.x would pull in a Go toolchain bump and API changes that are a separate discussion.
docker-compose 2.38.2 → 2.40.2
CVE-2025-62725, CVSS 8.9, CWE-22, EPSS 0.137 (96th percentile).
Compose trusts the path information embedded in remote OCI compose artifacts. When a layer carries the annotations
com.docker.compose.extendsorcom.docker.compose.envfile, Compose joins the attacker-supplied value with its local cache directory and writes there, without constraining the result to that directory.Two things make this worse than a typical image issue: no container is ever started, so read-only commands such as
docker compose configordocker compose psare enough to trigger it; and it applies to every workflow that resolves remote OCI compose artifacts, CI runners included.Fixed upstream in v2.40.2 (commit 69bcb96), GHSA-gv8h-7v7w-r22q.
runc 1.3.5 → 1.3.6
CVE-2026-41579, CVSS 3.3, in the container setup path. Low severity, but a patch release inside the 1.3.x series with no interface change — little reason to carry the finding instead.
Verification
Built for
pi/4x64(arm64) against this branch; containerd, containerd-shim-runc-v2 and ctr install into the target as before.All three are
golang-packages whose hashes cover the go-vendored tarball produced by the download post-process, so they cannot be taken from an upstream release page. Each was regenerated by running the package's-sourcetarget and reading back the computed hash:The
LICENSEhashes are unchanged in all three; verified against the top-levelLICENSEin each tarball, not the vendored ones.Not included: docker-engine / docker-cli
CVE-2026-42306 (7.2) and CVE-2026-41568 (6.1) match the packaged 28.3.3, and it would be natural to bump to the latest 28.x. That does not help. The CVE records list
github.com/docker/docker/daemon <= 28.5.2as affected — there is no fix in the 28 series, only Docker Engine 29.5.1. That is a major version jump and belongs in its own change, not bundled here.Upstream
Checked buildroot upstream first:
mastercarries containerd 2.1.x, docker-compose 2.38.2 and runc 1.3.5, so there is nothing to cherry-pick for any of the three. These are fork-local bumps.