Browse code

Docker : Fix CVE-2019-5736

Change-Id: Ifee27d9791a57f3d1048cd40aa90ce831ec1ad4e
Reviewed-on: http://photon-jenkins.eng.vmware.com:8082/6674
Tested-by: gerrit-photon <photon-checkins@vmware.com>
Reviewed-by: Bo Gan <ganb@vmware.com>
(cherry picked from commit 7586dfe195a1aab9a27ef8cbee470accc37d81cd)
Reviewed-on: http://photon-jenkins.eng.vmware.com:8082/6683
Reviewed-by: Anish Swaminathan <anishs@vmware.com>
Tested-by: Anish Swaminathan <anishs@vmware.com>

Him Kalyan Bordoloi authored on 2019/02/11 23:58:20
Showing 3 changed files
1 1
deleted file mode 100644
... ...
@@ -1,222 +0,0 @@
1
-%global security_hardening nopie
2
-%define debug_package %{nil}
3
-%define __os_install_post %{nil}
4
-Summary:        Docker
5
-Name:           docker
6
-Version:        18.06.1
7
-Release:        2%{?dist}
8
-License:        ASL 2.0
9
-URL:            http://docs.docker.com
10
-Group:          Applications/File
11
-Vendor:         VMware, Inc.
12
-Distribution:   Photon
13
-Source0:        https://github.com/docker/docker-ce/archive/docker-%{version}-ce.tar.gz
14
-%define sha1 docker=ff91e1f87e81b29eafc9c098110c2537b2752f7c
15
-%define DOCKER_GITCOMMIT e68fc7a215d7133c34aa18e3b72b4a21fd0c6136
16
-Source99:       default-disable.preset
17
-Patch99:        remove-firewalld.patch
18
-
19
-BuildRequires:  systemd
20
-BuildRequires:  systemd-devel
21
-BuildRequires:  device-mapper-devel
22
-BuildRequires:  btrfs-progs-devel
23
-BuildRequires:  libseccomp
24
-BuildRequires:  libseccomp-devel
25
-BuildRequires:  libltdl-devel
26
-BuildRequires:  libgcc-devel
27
-BuildRequires:  glibc-devel
28
-BuildRequires:  unzip
29
-BuildRequires:  go = 1.10.7
30
-BuildRequires:  sed
31
-BuildRequires:  cmake
32
-BuildRequires:  findutils
33
-BuildRequires:  git
34
-BuildRequires:  libapparmor
35
-BuildRequires:  libapparmor-devel
36
-Requires:       libapparmor
37
-Requires:       libltdl
38
-Requires:       libgcc
39
-Requires:       glibc
40
-Requires:       libseccomp
41
-Requires:       systemd
42
-Requires:       device-mapper-libs
43
-
44
-%description
45
-Docker is an open source project to build, ship and run any application as a lightweight container.
46
-
47
-%package        doc
48
-Summary:        Documentation and vimfiles for docker
49
-Requires:       %{name} = %{version}
50
-
51
-%description    doc
52
-Documentation and vimfiles for docker
53
-
54
-%prep
55
-%setup -q -c
56
-
57
-%patch99 -p1
58
-
59
-mkdir -p /go/src/github.com
60
-cd /go/src/github.com
61
-mkdir opencontainers
62
-mkdir docker
63
-
64
-ln -snrf "$OLDPWD/components/engine" docker/docker
65
-ln -snrf "$OLDPWD/components/cli" docker/cli
66
-
67
-%build
68
-export GOPATH="/go"
69
-export PATH="$PATH:$GOPATH/bin"
70
-
71
-GIT_COMMIT=%{DOCKER_GITCOMMIT}
72
-GIT_COMMIT_SHORT=${GIT_COMMIT:0:7}
73
-
74
-cd "$GOPATH/src/github.com/docker"
75
-
76
-pushd cli
77
-DISABLE_WARN_OUTSIDE_CONTAINER=1 make VERSION=%{version} GITCOMMIT=${GIT_COMMIT_SHORT} dynbinary manpages
78
-popd
79
-
80
-pushd docker
81
-for component in tini "proxy dynamic" "runc all" "containerd dynamic"; do
82
-  RUNC_BUILDTAGS="seccomp apparmor" \
83
-  hack/dockerfile/install/install.sh $component
84
-done
85
-DOCKER_BUILDTAGS="pkcs11 seccomp apparmor exclude_graphdriver_aufs" \
86
-VERSION=%{version} DOCKER_GITCOMMIT=${GIT_COMMIT_SHORT} PRODUCT=docker hack/make.sh dynbinary
87
-popd
88
-
89
-%install
90
-install -d -m755 %{buildroot}%{_mandir}/man1
91
-install -d -m755 %{buildroot}%{_mandir}/man5
92
-install -d -m755 %{buildroot}%{_mandir}/man8
93
-install -d -m755 %{buildroot}%{_bindir}
94
-install -d -m755 %{buildroot}%{_unitdir}
95
-install -d -m755 %{buildroot}/lib/udev/rules.d
96
-install -d -m755 %{buildroot}%{_datadir}/bash-completion/completions
97
-
98
-# install binary
99
-install -p -m 755 "$(readlink -f components/cli/build/docker)" %{buildroot}%{_bindir}/docker
100
-install -p -m 755 "$(readlink -f components/engine/bundles/latest/dynbinary-daemon/dockerd)" %{buildroot}%{_bindir}/dockerd
101
-
102
-# install proxy
103
-install -p -m 755 /usr/local/bin/docker-proxy %{buildroot}%{_bindir}/docker-proxy
104
-
105
-# install containerd
106
-install -p -m 755 /usr/local/bin/docker-containerd %{buildroot}%{_bindir}/docker-containerd
107
-install -p -m 755 /usr/local/bin/docker-containerd-shim %{buildroot}%{_bindir}/docker-containerd-shim
108
-install -p -m 755 /usr/local/bin/docker-containerd-ctr %{buildroot}%{_bindir}/docker-containerd-ctr
109
-
110
-# install runc
111
-install -p -m 755 /usr/local/bin/docker-runc %{buildroot}%{_bindir}/docker-runc
112
-
113
-# install tini
114
-install -p -m 755 /usr/local/bin/docker-init %{buildroot}%{_bindir}/docker-init
115
-
116
-# install udev rules
117
-install -p -m 644 components/engine/contrib/udev/80-docker.rules %{buildroot}/lib/udev/rules.d/80-docker.rules
118
-
119
-# add init scripts
120
-install -p -m 644 components/packaging/rpm/systemd/docker.service %{buildroot}%{_unitdir}/docker.service
121
-
122
-# add bash completions
123
-install -p -m 644 components/cli/contrib/completion/bash/docker %{buildroot}%{_datadir}/bash-completion/completions/docker
124
-
125
-# install manpages
126
-install -p -m 644 components/cli/man/man1/*.1 %{buildroot}%{_mandir}/man1
127
-install -p -m 644 components/cli/man/man5/*.5 %{buildroot}%{_mandir}/man5
128
-install -p -m 644 components/cli/man/man8/*.8 %{buildroot}%{_mandir}/man8
129
-
130
-# add vimfiles
131
-install -d -m 755 %{buildroot}%{_datadir}/vim/vimfiles/doc
132
-install -d -m 755 %{buildroot}%{_datadir}/vim/vimfiles/ftdetect
133
-install -d -m 755 %{buildroot}%{_datadir}/vim/vimfiles/syntax
134
-install -p -m 644 components/engine/contrib/syntax/vim/doc/dockerfile.txt %{buildroot}%{_datadir}/vim/vimfiles/doc/dockerfile.txt
135
-install -p -m 644 components/engine/contrib/syntax/vim/ftdetect/dockerfile.vim %{buildroot}%{_datadir}/vim/vimfiles/ftdetect/dockerfile.vim
136
-install -p -m 644 components/engine/contrib/syntax/vim/syntax/dockerfile.vim %{buildroot}%{_datadir}/vim/vimfiles/syntax/dockerfile.vim
137
-
138
-mkdir -p build-docs
139
-for engine_file in AUTHORS CHANGELOG.md CONTRIBUTING.md LICENSE MAINTAINERS NOTICE README.md; do
140
-    cp "components/engine/$engine_file" "build-docs/engine-$engine_file"
141
-done
142
-for cli_file in LICENSE MAINTAINERS NOTICE README.md; do
143
-    cp "components/cli/$cli_file" "build-docs/cli-$cli_file"
144
-done
145
-
146
-install -v -D -m 0644 %{SOURCE99} %{buildroot}%{_presetdir}/50-docker.preset
147
-
148
-%pre
149
-if [ $1 -gt 0 ] ; then
150
-    # package upgrade scenario, before new files are installed
151
-
152
-    # clear any old state
153
-    rm -f %{_localstatedir}/lib/rpm-state/docker-is-active > /dev/null 2>&1 || :
154
-
155
-    # check if docker service is running
156
-    if systemctl is-active docker.service > /dev/null 2>&1; then
157
-        systemctl stop docker > /dev/null 2>&1 || :
158
-        touch %{_localstatedir}/lib/rpm-state/docker-is-active > /dev/null 2>&1 || :
159
-    fi
160
-fi
161
-
162
-%preun
163
-%systemd_preun docker.service
164
-
165
-%post
166
-if [ $1 -eq 1 ] ; then
167
-    getent group docker >/dev/null || groupadd -r docker
168
-fi
169
-%systemd_post docker.service
170
-
171
-%postun
172
-%systemd_postun_with_restart docker.service
173
-if [ $1 -eq 0 ] ; then
174
-    getent group docker >/dev/null && groupdel docker || :
175
-fi
176
-
177
-%posttrans
178
-if [ $1 -ge 0 ] ; then
179
-    # package upgrade scenario, after new files are installed
180
-
181
-    # check if docker was running before upgrade
182
-    if [ -f %{_localstatedir}/lib/rpm-state/docker-is-active ]; then
183
-        systemctl start docker > /dev/null 2>&1 || :
184
-        rm -f %{_localstatedir}/lib/rpm-state/docker-is-active > /dev/null 2>&1 || :
185
-    fi
186
-fi
187
-
188
-%clean
189
-rm -rf %{buildroot}/*
190
-
191
-%files
192
-%defattr(-,root,root)
193
-%{_unitdir}/docker.service
194
-%{_presetdir}/50-docker.preset
195
-%{_bindir}/docker
196
-%{_bindir}/dockerd
197
-%{_bindir}/docker-containerd
198
-%{_bindir}/docker-containerd-ctr
199
-%{_bindir}/docker-containerd-shim
200
-%{_bindir}/docker-proxy
201
-%{_bindir}/docker-runc
202
-%{_bindir}/docker-init
203
-%{_datadir}/bash-completion/completions/docker
204
-/lib/udev/rules.d/80-docker.rules
205
-
206
-%files doc
207
-%defattr(-,root,root)
208
-%doc build-docs/engine-AUTHORS build-docs/engine-CHANGELOG.md build-docs/engine-CONTRIBUTING.md build-docs/engine-LICENSE build-docs/engine-MAINTAINERS build-docs/engine-NOTICE build-docs/engine-README.md
209
-%doc build-docs/cli-LICENSE build-docs/cli-MAINTAINERS build-docs/cli-NOTICE build-docs/cli-README.md
210
-%doc
211
-%{_mandir}/man1/*
212
-%{_mandir}/man5/*
213
-%{_mandir}/man8/*
214
-%{_datadir}/vim/vimfiles/doc/dockerfile.txt
215
-%{_datadir}/vim/vimfiles/ftdetect/dockerfile.vim
216
-%{_datadir}/vim/vimfiles/syntax/dockerfile.vim
217
-
218
-%changelog
219
-*   Mon Jan 21 2019 Bo Gan <ganb@vmware.com> 18.06.1-2
220
--   Build using go 1.10.7
221
-*   Mon Jan 17 2019 Bo Gan <ganb@vmware.com> 18.06.1-1
222
--   Update to 18.06.1-ce
223 1
new file mode 100644
... ...
@@ -0,0 +1,224 @@
0
+%global security_hardening nopie
1
+%define debug_package %{nil}
2
+%define __os_install_post %{nil}
3
+Summary:        Docker
4
+Name:           docker
5
+Version:        18.06.2
6
+Release:        1%{?dist}
7
+License:        ASL 2.0
8
+URL:            http://docs.docker.com
9
+Group:          Applications/File
10
+Vendor:         VMware, Inc.
11
+Distribution:   Photon
12
+Source0:        https://github.com/docker/docker-ce/archive/docker-%{version}-ce.tar.gz
13
+%define sha1 docker=d67890d32c8e4ee09bf2a00585d95211d8def486
14
+%define DOCKER_GITCOMMIT 6d37f41e333ee478440ef969392020f7e3915cd3
15
+Source99:       default-disable.preset
16
+Patch99:        remove-firewalld.patch
17
+
18
+BuildRequires:  systemd
19
+BuildRequires:  systemd-devel
20
+BuildRequires:  device-mapper-devel
21
+BuildRequires:  btrfs-progs-devel
22
+BuildRequires:  libseccomp
23
+BuildRequires:  libseccomp-devel
24
+BuildRequires:  libltdl-devel
25
+BuildRequires:  libgcc-devel
26
+BuildRequires:  glibc-devel
27
+BuildRequires:  unzip
28
+BuildRequires:  go = 1.10.7
29
+BuildRequires:  sed
30
+BuildRequires:  cmake
31
+BuildRequires:  findutils
32
+BuildRequires:  git
33
+BuildRequires:  libapparmor
34
+BuildRequires:  libapparmor-devel
35
+Requires:       libapparmor
36
+Requires:       libltdl
37
+Requires:       libgcc
38
+Requires:       glibc
39
+Requires:       libseccomp
40
+Requires:       systemd
41
+Requires:       device-mapper-libs
42
+
43
+%description
44
+Docker is an open source project to build, ship and run any application as a lightweight container.
45
+
46
+%package        doc
47
+Summary:        Documentation and vimfiles for docker
48
+Requires:       %{name} = %{version}
49
+
50
+%description    doc
51
+Documentation and vimfiles for docker
52
+
53
+%prep
54
+%setup -q -c
55
+
56
+%patch99 -p1
57
+
58
+mkdir -p /go/src/github.com
59
+cd /go/src/github.com
60
+mkdir opencontainers
61
+mkdir docker
62
+
63
+ln -snrf "$OLDPWD/docker-ce-%{version}-ce/components/engine" docker/docker
64
+ln -snrf "$OLDPWD/docker-ce-%{version}-ce/components/cli" docker/cli
65
+
66
+%build
67
+export GOPATH="/go"
68
+export PATH="$PATH:$GOPATH/bin"
69
+
70
+GIT_COMMIT=%{DOCKER_GITCOMMIT}
71
+GIT_COMMIT_SHORT=${GIT_COMMIT:0:7}
72
+
73
+cd "$GOPATH/src/github.com/docker"
74
+
75
+pushd cli
76
+DISABLE_WARN_OUTSIDE_CONTAINER=1 make VERSION=%{version} GITCOMMIT=${GIT_COMMIT_SHORT} dynbinary manpages
77
+popd
78
+
79
+pushd docker
80
+for component in tini "proxy dynamic" "runc all" "containerd dynamic"; do
81
+  RUNC_BUILDTAGS="seccomp apparmor" \
82
+  hack/dockerfile/install/install.sh $component
83
+done
84
+DOCKER_BUILDTAGS="pkcs11 seccomp apparmor exclude_graphdriver_aufs" \
85
+VERSION=%{version} DOCKER_GITCOMMIT=${GIT_COMMIT_SHORT} PRODUCT=docker hack/make.sh dynbinary
86
+popd
87
+
88
+%install
89
+install -d -m755 %{buildroot}%{_mandir}/man1
90
+install -d -m755 %{buildroot}%{_mandir}/man5
91
+install -d -m755 %{buildroot}%{_mandir}/man8
92
+install -d -m755 %{buildroot}%{_bindir}
93
+install -d -m755 %{buildroot}%{_unitdir}
94
+install -d -m755 %{buildroot}/lib/udev/rules.d
95
+install -d -m755 %{buildroot}%{_datadir}/bash-completion/completions
96
+
97
+# install binary
98
+install -p -m 755 "$(readlink -f docker-ce-%{version}-ce/components/cli/build/docker)" %{buildroot}%{_bindir}/docker
99
+install -p -m 755 "$(readlink -f docker-ce-%{version}-ce/components/engine/bundles/latest/dynbinary-daemon/dockerd)" %{buildroot}%{_bindir}/dockerd
100
+
101
+# install proxy
102
+install -p -m 755 /usr/local/bin/docker-proxy %{buildroot}%{_bindir}/docker-proxy
103
+
104
+# install containerd
105
+install -p -m 755 /usr/local/bin/docker-containerd %{buildroot}%{_bindir}/docker-containerd
106
+install -p -m 755 /usr/local/bin/docker-containerd-shim %{buildroot}%{_bindir}/docker-containerd-shim
107
+install -p -m 755 /usr/local/bin/docker-containerd-ctr %{buildroot}%{_bindir}/docker-containerd-ctr
108
+
109
+# install runc
110
+install -p -m 755 /usr/local/bin/docker-runc %{buildroot}%{_bindir}/docker-runc
111
+
112
+# install tini
113
+install -p -m 755 /usr/local/bin/docker-init %{buildroot}%{_bindir}/docker-init
114
+
115
+# install udev rules
116
+install -p -m 644 docker-ce-%{version}-ce/components/engine/contrib/udev/80-docker.rules %{buildroot}/lib/udev/rules.d/80-docker.rules
117
+
118
+# add init scripts
119
+install -p -m 644 docker-ce-%{version}-ce/components/packaging/rpm/systemd/docker.service %{buildroot}%{_unitdir}/docker.service
120
+
121
+# add bash completions
122
+install -p -m 644 docker-ce-%{version}-ce/components/cli/contrib/completion/bash/docker %{buildroot}%{_datadir}/bash-completion/completions/docker
123
+
124
+# install manpages
125
+install -p -m 644 docker-ce-%{version}-ce/components/cli/man/man1/*.1 %{buildroot}%{_mandir}/man1
126
+install -p -m 644 docker-ce-%{version}-ce/components/cli/man/man5/*.5 %{buildroot}%{_mandir}/man5
127
+install -p -m 644 docker-ce-%{version}-ce/components/cli/man/man8/*.8 %{buildroot}%{_mandir}/man8
128
+
129
+# add vimfiles
130
+install -d -m 755 %{buildroot}%{_datadir}/vim/vimfiles/doc
131
+install -d -m 755 %{buildroot}%{_datadir}/vim/vimfiles/ftdetect
132
+install -d -m 755 %{buildroot}%{_datadir}/vim/vimfiles/syntax
133
+install -p -m 644 docker-ce-%{version}-ce/components/engine/contrib/syntax/vim/doc/dockerfile.txt %{buildroot}%{_datadir}/vim/vimfiles/doc/dockerfile.txt
134
+install -p -m 644 docker-ce-%{version}-ce/components/engine/contrib/syntax/vim/ftdetect/dockerfile.vim %{buildroot}%{_datadir}/vim/vimfiles/ftdetect/dockerfile.vim
135
+install -p -m 644 docker-ce-%{version}-ce/components/engine/contrib/syntax/vim/syntax/dockerfile.vim %{buildroot}%{_datadir}/vim/vimfiles/syntax/dockerfile.vim
136
+
137
+mkdir -p build-docs
138
+for engine_file in AUTHORS CHANGELOG.md CONTRIBUTING.md LICENSE MAINTAINERS NOTICE README.md; do
139
+    cp "docker-ce-%{version}-ce/components/engine/$engine_file" "build-docs/engine-$engine_file"
140
+done
141
+for cli_file in LICENSE MAINTAINERS NOTICE README.md; do
142
+    cp "docker-ce-%{version}-ce/components/cli/$cli_file" "build-docs/cli-$cli_file"
143
+done
144
+
145
+install -v -D -m 0644 %{SOURCE99} %{buildroot}%{_presetdir}/50-docker.preset
146
+
147
+%pre
148
+if [ $1 -gt 0 ] ; then
149
+    # package upgrade scenario, before new files are installed
150
+
151
+    # clear any old state
152
+    rm -f %{_localstatedir}/lib/rpm-state/docker-is-active > /dev/null 2>&1 || :
153
+
154
+    # check if docker service is running
155
+    if systemctl is-active docker.service > /dev/null 2>&1; then
156
+        systemctl stop docker > /dev/null 2>&1 || :
157
+        touch %{_localstatedir}/lib/rpm-state/docker-is-active > /dev/null 2>&1 || :
158
+    fi
159
+fi
160
+
161
+%preun
162
+%systemd_preun docker.service
163
+
164
+%post
165
+if [ $1 -eq 1 ] ; then
166
+    getent group docker >/dev/null || groupadd -r docker
167
+fi
168
+%systemd_post docker.service
169
+
170
+%postun
171
+%systemd_postun_with_restart docker.service
172
+if [ $1 -eq 0 ] ; then
173
+    getent group docker >/dev/null && groupdel docker || :
174
+fi
175
+
176
+%posttrans
177
+if [ $1 -ge 0 ] ; then
178
+    # package upgrade scenario, after new files are installed
179
+
180
+    # check if docker was running before upgrade
181
+    if [ -f %{_localstatedir}/lib/rpm-state/docker-is-active ]; then
182
+        systemctl start docker > /dev/null 2>&1 || :
183
+        rm -f %{_localstatedir}/lib/rpm-state/docker-is-active > /dev/null 2>&1 || :
184
+    fi
185
+fi
186
+
187
+%clean
188
+rm -rf %{buildroot}/*
189
+
190
+%files
191
+%defattr(-,root,root)
192
+%{_unitdir}/docker.service
193
+%{_presetdir}/50-docker.preset
194
+%{_bindir}/docker
195
+%{_bindir}/dockerd
196
+%{_bindir}/docker-containerd
197
+%{_bindir}/docker-containerd-ctr
198
+%{_bindir}/docker-containerd-shim
199
+%{_bindir}/docker-proxy
200
+%{_bindir}/docker-runc
201
+%{_bindir}/docker-init
202
+%{_datadir}/bash-completion/completions/docker
203
+/lib/udev/rules.d/80-docker.rules
204
+
205
+%files doc
206
+%defattr(-,root,root)
207
+%doc build-docs/engine-AUTHORS build-docs/engine-CHANGELOG.md build-docs/engine-CONTRIBUTING.md build-docs/engine-LICENSE build-docs/engine-MAINTAINERS build-docs/engine-NOTICE build-docs/engine-README.md
208
+%doc build-docs/cli-LICENSE build-docs/cli-MAINTAINERS build-docs/cli-NOTICE build-docs/cli-README.md
209
+%doc
210
+%{_mandir}/man1/*
211
+%{_mandir}/man5/*
212
+%{_mandir}/man8/*
213
+%{_datadir}/vim/vimfiles/doc/dockerfile.txt
214
+%{_datadir}/vim/vimfiles/ftdetect/dockerfile.vim
215
+%{_datadir}/vim/vimfiles/syntax/dockerfile.vim
216
+
217
+%changelog
218
+*   Mon Feb 11 2019 Him Kalyan Bordoloi <bordoloih@vmware.com> 18.06.2-1
219
+-   Upgrade Docker to fix CVE-2019-5736
220
+*   Mon Jan 21 2019 Bo Gan <ganb@vmware.com> 18.06.1-2
221
+-   Build using go 1.10.7
222
+*   Mon Jan 17 2019 Bo Gan <ganb@vmware.com> 18.06.1-1
223
+-   Update to 18.06.1-ce
... ...
@@ -1,7 +1,7 @@
1
-diff --git a/components/packaging/rpm/systemd/docker.service b/components/packaging/rpm/systemd/docker.service
1
+diff --git a/docker-ce-18.06.2-ce/components/packaging/rpm/systemd/docker.service b/docker-ce-18.06.2-ce/components/packaging/rpm/systemd/docker.service
2 2
 index 6c60646..a10146d 100644
3
-+++ b/components/packaging/rpm/systemd/docker.service
3
+--- a/docker-ce-18.06.2-ce/components/packaging/rpm/systemd/docker.service
4 4
 @@ -1,7 +1,7 @@
5 5
  [Unit]
6 6
  Description=Docker Application Container Engine