[golang-github-gorilla-context/f20] disable debuginfo
by Lokesh Mandvekar
commit 2d0a828e421d7034f74b2ddb4ce8900891371f8f
Author: Lokesh Mandvekar <lsm5(a)fedoraproject.org>
Date: Thu Jul 24 01:44:21 2014 -0500
disable debuginfo
golang-github-gorilla-context.spec | 6 +++++-
1 files changed, 5 insertions(+), 1 deletions(-)
---
diff --git a/golang-github-gorilla-context.spec b/golang-github-gorilla-context.spec
index 2bee75a..d16c2be 100644
--- a/golang-github-gorilla-context.spec
+++ b/golang-github-gorilla-context.spec
@@ -1,10 +1,11 @@
+%global debug_package %{nil}
%global import_path github.com/gorilla/context
%global commit 14f550f51af52180c2eefed15e5fd18d63c0a64a
%global shortcommit %(c=%{commit}; echo ${c:0:7})
Name: golang-github-gorilla-context
Version: 0
-Release: 0.25.git%{shortcommit}%{?dist}
+Release: 0.26.git%{shortcommit}%{?dist}
Summary: A golang registry for global request variables
License: BSD
URL: http://www.gorillatoolkit.org/pkg/context
@@ -61,6 +62,9 @@ GOPATH=%{gopath}:%{buildroot}%{gopath} go test %{import_path}
%{gopath}/src/%{import_path}/*.go
%changelog
+* Thu Jul 24 2014 Lokesh Mandvekar <lsm5(a)fedoraproject.org> - 0-0.26.git
+- disable debuginfo
+
* Mon Jul 21 2014 Lokesh Mandvekar <lsm5(a)fedoraproject.org> - 0-0.25.git
- update to commit 14f550f51a for docker 1.1.0 (and 1.1.1)
- use golang packaging macros wherever applicable
9 years, 9 months
[golang-github-gorilla-context/f21] disable debuginfo
by Lokesh Mandvekar
commit fc59f126a6f55347c6fe6558d7ed0b470be43567
Author: Lokesh Mandvekar <lsm5(a)fedoraproject.org>
Date: Thu Jul 24 01:44:21 2014 -0500
disable debuginfo
golang-github-gorilla-context.spec | 6 +++++-
1 files changed, 5 insertions(+), 1 deletions(-)
---
diff --git a/golang-github-gorilla-context.spec b/golang-github-gorilla-context.spec
index 2bee75a..d16c2be 100644
--- a/golang-github-gorilla-context.spec
+++ b/golang-github-gorilla-context.spec
@@ -1,10 +1,11 @@
+%global debug_package %{nil}
%global import_path github.com/gorilla/context
%global commit 14f550f51af52180c2eefed15e5fd18d63c0a64a
%global shortcommit %(c=%{commit}; echo ${c:0:7})
Name: golang-github-gorilla-context
Version: 0
-Release: 0.25.git%{shortcommit}%{?dist}
+Release: 0.26.git%{shortcommit}%{?dist}
Summary: A golang registry for global request variables
License: BSD
URL: http://www.gorillatoolkit.org/pkg/context
@@ -61,6 +62,9 @@ GOPATH=%{gopath}:%{buildroot}%{gopath} go test %{import_path}
%{gopath}/src/%{import_path}/*.go
%changelog
+* Thu Jul 24 2014 Lokesh Mandvekar <lsm5(a)fedoraproject.org> - 0-0.26.git
+- disable debuginfo
+
* Mon Jul 21 2014 Lokesh Mandvekar <lsm5(a)fedoraproject.org> - 0-0.25.git
- update to commit 14f550f51a for docker 1.1.0 (and 1.1.1)
- use golang packaging macros wherever applicable
9 years, 9 months
[golang-github-gorilla-context] disable debuginfo
by Lokesh Mandvekar
commit afca8ecbb12878021f1928bee00c7fc5ef217272
Author: Lokesh Mandvekar <lsm5(a)fedoraproject.org>
Date: Thu Jul 24 01:44:21 2014 -0500
disable debuginfo
golang-github-gorilla-context.spec | 6 +++++-
1 files changed, 5 insertions(+), 1 deletions(-)
---
diff --git a/golang-github-gorilla-context.spec b/golang-github-gorilla-context.spec
index 2bee75a..d16c2be 100644
--- a/golang-github-gorilla-context.spec
+++ b/golang-github-gorilla-context.spec
@@ -1,10 +1,11 @@
+%global debug_package %{nil}
%global import_path github.com/gorilla/context
%global commit 14f550f51af52180c2eefed15e5fd18d63c0a64a
%global shortcommit %(c=%{commit}; echo ${c:0:7})
Name: golang-github-gorilla-context
Version: 0
-Release: 0.25.git%{shortcommit}%{?dist}
+Release: 0.26.git%{shortcommit}%{?dist}
Summary: A golang registry for global request variables
License: BSD
URL: http://www.gorillatoolkit.org/pkg/context
@@ -61,6 +62,9 @@ GOPATH=%{gopath}:%{buildroot}%{gopath} go test %{import_path}
%{gopath}/src/%{import_path}/*.go
%changelog
+* Thu Jul 24 2014 Lokesh Mandvekar <lsm5(a)fedoraproject.org> - 0-0.26.git
+- disable debuginfo
+
* Mon Jul 21 2014 Lokesh Mandvekar <lsm5(a)fedoraproject.org> - 0-0.25.git
- update to commit 14f550f51a for docker 1.1.0 (and 1.1.1)
- use golang packaging macros wherever applicable
9 years, 9 months
[docker-io/f20] Resolves: rhbz#1119849, rhbz#1119413, devel package and systemd CVE-2014-3499 fixes
by Lokesh Mandvekar
commit adfd8f5151baa17844b16a347c3514fda8051329
Author: Lokesh Mandvekar <lsm5(a)fedoraproject.org>
Date: Wed Jul 23 21:57:44 2014 -0500
Resolves: rhbz#1119849, rhbz#1119413, devel package and systemd CVE-2014-3499 fixes
audit-write.patch | 29 +++++++++++++
docker-io.spec | 116 ++++++++++++++++++++++++++++++++++++++++++++++++++++-
docker.service | 2 +-
docker.sysconfig | 1 +
4 files changed, 145 insertions(+), 3 deletions(-)
---
diff --git a/audit-write.patch b/audit-write.patch
new file mode 100644
index 0000000..140d8ab
--- /dev/null
+++ b/audit-write.patch
@@ -0,0 +1,29 @@
+From 29ecc95c31ecfe15e3b3d8db94cea1c555e526a3 Mon Sep 17 00:00:00 2001
+From: Alexandr Morozov <lk4d4math(a)gmail.com>
+Date: Wed, 23 Jul 2014 09:57:41 +0400
+Subject: [PATCH] Add AUDIT_WRITE cap
+
+Fixes #6345
+
+Thanks @larsks for outstanding investigation
+
+Docker-DCO-1.1-Signed-off-by: Alexandr Morozov <lk4d4math(a)gmail.com> (github: LK4D4)
+---
+ daemon/execdriver/native/template/default_template.go | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/daemon/execdriver/native/template/default_template.go b/daemon/execdriver/native/template/default_template.go
+index cc5cc4f..be3dd5a 100644
+--- a/daemon/execdriver/native/template/default_template.go
++++ b/daemon/execdriver/native/template/default_template.go
+@@ -23,6 +23,7 @@ func New() *libcontainer.Config {
+ "NET_BIND_SERVICE",
+ "SYS_CHROOT",
+ "KILL",
++ "AUDIT_WRITE",
+ },
+ Namespaces: map[string]bool{
+ "NEWNS": true,
+--
+1.9.3
+
diff --git a/docker-io.spec b/docker-io.spec
index 70bc468..d97dec1 100644
--- a/docker-io.spec
+++ b/docker-io.spec
@@ -11,11 +11,13 @@
Name: docker-io
Version: 1.0.0
-Release: 7%{?dist}
+Release: 8%{?dist}
Summary: Automates deployment of containerized applications
License: ASL 2.0
Patch1: upstream-patched-archive-tar.patch
Patch2: finalize-namespace.patch
+# Resolves: rhbz#1119849 - add AUDIT_WRITE capablility
+Patch3: audit-write.patch
URL: http://www.docker.io
# only x86_64 for now: https://github.com/dotcloud/docker/issues/136
ExclusiveArch: x86_64
@@ -44,7 +46,14 @@ BuildRequires: device-mapper-devel
BuildRequires: btrfs-progs-devel
BuildRequires: pkgconfig(systemd)
BuildRequires: pandoc
-Requires: systemd-units
+# Use appropriate NVR for systemd-units to ensure SocketUser and SocketGroup are available
+%if 0%{?fedora} >= 21
+Requires: systemd-units >= 214
+%else if 0%{?fedora} == 20
+Requires: systemd-units >= 208-20
+%else
+Requires: systemd-units >= 204-20
+%endif
# need xz to work with ubuntu images
# https://bugzilla.redhat.com/show_bug.cgi?id=1045220
Requires: xz
@@ -144,6 +153,8 @@ This is the source libraries for docker.
rm -rf vendor
%patch1 -p1 -b upstream-patched-archive-tar
%patch2 -p1 -b finalize-namespace
+%patch3 -p1
+rm daemon/execdriver/native/template/*.go.orig
%build
# set up temporary build gopath, and put our directory there
@@ -246,149 +257,250 @@ exit 0
%files devel
%defattr(-,root,root,-)
%dir %{gopath}/src/%{import_path}
+%dir %{gopath}/src/%{import_path}/api
%{gopath}/src/%{import_path}/api/MAINTAINERS
%{gopath}/src/%{import_path}/api/README.md
%{gopath}/src/%{import_path}/api/*.go
%{gopath}/src/%{import_path}/api/client/*.go
+%dir %{gopath}/src/%{import_path}/api/server
%{gopath}/src/%{import_path}/api/server/*.go
+%dir %{gopath}/src/%{import_path}/archive
%{gopath}/src/%{import_path}/archive/MAINTAINERS
%{gopath}/src/%{import_path}/archive/README.md
%{gopath}/src/%{import_path}/archive/*.go
%{gopath}/src/%{import_path}/archive/*.goupstream-patched-archive-tar
+%dir %{gopath}/src/%{import_path}/archive/testdata
%{gopath}/src/%{import_path}/archive/testdata/broken.tar
+%dir %{gopath}/src/%{import_path}/builtins
%{gopath}/src/%{import_path}/builtins/*.go
+%dir %{gopath}/src/%{import_path}/daemon
%{gopath}/src/%{import_path}/daemon/*.go
%{gopath}/src/%{import_path}/daemon/README.md
+%dir %{gopath}/src/%{import_path}/daemon/execdriver
%{gopath}/src/%{import_path}/daemon/execdriver/*.go
%{gopath}/src/%{import_path}/daemon/execdriver/MAINTAINERS
+%dir %{gopath}/src/%{import_path}/daemon/execdriver/execdrivers
%{gopath}/src/%{import_path}/daemon/execdriver/execdrivers/*.go
+%dir %{gopath}/src/%{import_path}/daemon/execdriver/lxc
%{gopath}/src/%{import_path}/daemon/execdriver/lxc/*.go
+%dir %{gopath}/src/%{import_path}/daemon/execdriver/native
%{gopath}/src/%{import_path}/daemon/execdriver/native/*.go
+%dir %{gopath}/src/%{import_path}/daemon/execdriver/native/configuration
%{gopath}/src/%{import_path}/daemon/execdriver/native/configuration/*.go
+%dir %{gopath}/src/%{import_path}/daemon/execdriver/native/template
%{gopath}/src/%{import_path}/daemon/execdriver/native/template/*.go
+%dir %{gopath}/src/%{import_path}/daemon/graphdriver
%{gopath}/src/%{import_path}/daemon/graphdriver/*.go
+%dir %{gopath}/src/%{import_path}/daemon/graphdriver/aufs
%{gopath}/src/%{import_path}/daemon/graphdriver/aufs/*.go
+%dir %{gopath}/src/%{import_path}/daemon/graphdriver/btrfs
%{gopath}/src/%{import_path}/daemon/graphdriver/btrfs/*.go
%{gopath}/src/%{import_path}/daemon/graphdriver/btrfs/MAINTAINERS
+%dir %{gopath}/src/%{import_path}/daemon/graphdriver/devmapper
%{gopath}/src/%{import_path}/daemon/graphdriver/devmapper/*.go
%{gopath}/src/%{import_path}/daemon/graphdriver/devmapper/MAINTAINERS
%{gopath}/src/%{import_path}/daemon/graphdriver/devmapper/README.md
+%dir %{gopath}/src/%{import_path}/daemon/graphdriver/graphtest
%{gopath}/src/%{import_path}/daemon/graphdriver/graphtest/*.go
+%dir %{gopath}/src/%{import_path}/daemon/graphdriver/vfs
%{gopath}/src/%{import_path}/daemon/graphdriver/vfs/*.go
+%dir %{gopath}/src/%{import_path}/daemon/networkdriver
+%dir %{gopath}/src/%{import_path}/daemon/networkdriver/bridge
%{gopath}/src/%{import_path}/daemon/networkdriver/bridge/*.go
+%dir %{gopath}/src/%{import_path}/daemon/networkdriver/ipallocator
%{gopath}/src/%{import_path}/daemon/networkdriver/ipallocator/*.go
%{gopath}/src/%{import_path}/daemon/networkdriver/*.go
+%dir %{gopath}/src/%{import_path}/daemon/networkdriver/portallocator
%{gopath}/src/%{import_path}/daemon/networkdriver/portallocator/*.go
+%dir %{gopath}/src/%{import_path}/daemon/networkdriver/portmapper
%{gopath}/src/%{import_path}/daemon/networkdriver/portmapper/*.go
+%dir %{gopath}/src/%{import_path}/daemonconfig
%{gopath}/src/%{import_path}/daemonconfig/README.md
%{gopath}/src/%{import_path}/daemonconfig/*.go
+%dir %{gopath}/src/%{import_path}/dockerversion
%{gopath}/src/%{import_path}/dockerversion/*.go
+%dir %{gopath}/src/%{import_path}/engine
%{gopath}/src/%{import_path}/engine/MAINTAINERS
%{gopath}/src/%{import_path}/engine/*.go
+%dir %{gopath}/src/%{import_path}/engine/rengine
%{gopath}/src/%{import_path}/engine/rengine/*.go
+%dir %{gopath}/src/%{import_path}/engine/spawn
%{gopath}/src/%{import_path}/engine/spawn/*.go
+%dir %{gopath}/src/%{import_path}/engine/spawn/subengine
%{gopath}/src/%{import_path}/engine/spawn/subengine/*.go
+%dir %{gopath}/src/%{import_path}/graph
%{gopath}/src/%{import_path}/graph/*.go
%{gopath}/src/%{import_path}/graph/*.goupstream-patched-archive-tar
+%dir %{gopath}/src/%{import_path}/image
%{gopath}/src/%{import_path}/image/*.go
+%dir %{gopath}/src/%{import_path}/links
%{gopath}/src/%{import_path}/links/*.go
+%dir %{gopath}/src/%{import_path}/nat
%{gopath}/src/%{import_path}/nat/*.go
+%dir %{gopath}/src/%{import_path}/opts
%{gopath}/src/%{import_path}/opts/*.go
+%dir %{gopath}/src/%{import_path}/pkg
%{gopath}/src/%{import_path}/pkg/README.md
+%dir %{gopath}/src/%{import_path}/pkg/apparmor
%{gopath}/src/%{import_path}/pkg/apparmor/*.go
+%dir %{gopath}/src/%{import_path}/pkg/beam
%{gopath}/src/%{import_path}/pkg/beam/MAINTAINERS
%{gopath}/src/%{import_path}/pkg/beam/*.go
+%dir %{gopath}/src/%{import_path}/pkg/beam/data
%{gopath}/src/%{import_path}/pkg/beam/data/*.go
%{gopath}/src/%{import_path}/pkg/beam/data/netstring.txt
+%dir %{gopath}/src/%{import_path}/pkg/beam/examples
+%dir %{gopath}/src/%{import_path}/pkg/beam/examples/beamsh
%{gopath}/src/%{import_path}/pkg/beam/examples/beamsh/beamsh
%{gopath}/src/%{import_path}/pkg/beam/examples/beamsh/*.go
+%dir %{gopath}/src/%{import_path}/pkg/beam/examples/beamsh/scripts
%{gopath}/src/%{import_path}/pkg/beam/examples/beamsh/scripts/*.ds
+%dir %{gopath}/src/%{import_path}/pkg/dockerscript
%{gopath}/src/%{import_path}/pkg/dockerscript/MAINTAINERS
%{gopath}/src/%{import_path}/pkg/dockerscript/*.go
+%dir %{gopath}/src/%{import_path}/pkg/dockerscript/scanner
%{gopath}/src/%{import_path}/pkg/dockerscript/scanner/*.go
+%dir %{gopath}/src/%{import_path}/pkg/graphdb
%{gopath}/src/%{import_path}/pkg/graphdb/MAINTAINERS
%{gopath}/src/%{import_path}/pkg/graphdb/*.go
+%dir %{gopath}/src/%{import_path}/pkg/iptables
%{gopath}/src/%{import_path}/pkg/iptables/MAINTAINERS
%{gopath}/src/%{import_path}/pkg/iptables/*.go
+%dir %{gopath}/src/%{import_path}/pkg/label
%{gopath}/src/%{import_path}/pkg/label/*.go
+%dir %{gopath}/src/%{import_path}/pkg/listenbuffer
%{gopath}/src/%{import_path}/pkg/listenbuffer/*.go
+%dir %{gopath}/src/%{import_path}/pkg/libcontainer
%{gopath}/src/%{import_path}/pkg/libcontainer/*.go
%{gopath}/src/%{import_path}/pkg/libcontainer/MAINTAINERS
%{gopath}/src/%{import_path}/pkg/libcontainer/README.md
%{gopath}/src/%{import_path}/pkg/libcontainer/TODO.md
+%dir %{gopath}/src/%{import_path}/pkg/libcontainer/cgroups
%{gopath}/src/%{import_path}/pkg/libcontainer/cgroups/*.go
+%dir %{gopath}/src/%{import_path}/pkg/libcontainer/cgroups/fs
%{gopath}/src/%{import_path}/pkg/libcontainer/cgroups/fs/*.go
+%dir %{gopath}/src/%{import_path}/pkg/libcontainer/cgroups/systemd
%{gopath}/src/%{import_path}/pkg/libcontainer/cgroups/systemd/*.go
+%dir %{gopath}/src/%{import_path}/pkg/libcontainer/console
%{gopath}/src/%{import_path}/pkg/libcontainer/console/*.go
%{gopath}/src/%{import_path}/pkg/libcontainer/container.json
+%dir %{gopath}/src/%{import_path}/pkg/libcontainer/devices
%{gopath}/src/%{import_path}/pkg/libcontainer/devices/*.go
+%dir %{gopath}/src/%{import_path}/pkg/libcontainer/mount
%{gopath}/src/%{import_path}/pkg/libcontainer/mount/*.go
+%dir %{gopath}/src/%{import_path}/pkg/libcontainer/mount/nodes
%{gopath}/src/%{import_path}/pkg/libcontainer/mount/nodes/*.go
+%dir %{gopath}/src/%{import_path}/pkg/libcontainer/namespaces
%{gopath}/src/%{import_path}/pkg/libcontainer/namespaces/*.go
%{gopath}/src/%{import_path}/pkg/libcontainer/namespaces/init.gofinalize-namespace
+%dir %{gopath}/src/%{import_path}/pkg/libcontainer/network
%{gopath}/src/%{import_path}/pkg/libcontainer/network/*.go
+%dir %{gopath}/src/%{import_path}/pkg/libcontainer/nsinit
%{gopath}/src/%{import_path}/pkg/libcontainer/nsinit/*.go
+%dir %{gopath}/src/%{import_path}/pkg/libcontainer/security
+%dir %{gopath}/src/%{import_path}/pkg/libcontainer/security/capabilities
%{gopath}/src/%{import_path}/pkg/libcontainer/security/capabilities/*.go
+%dir %{gopath}/src/%{import_path}/pkg/libcontainer/security/restrict
%{gopath}/src/%{import_path}/pkg/libcontainer/security/restrict/*.go
+%dir %{gopath}/src/%{import_path}/pkg/libcontainer/utils
%{gopath}/src/%{import_path}/pkg/libcontainer/utils/*.go
+%dir %{gopath}/src/%{import_path}/pkg/mflag
%{gopath}/src/%{import_path}/pkg/mflag/LICENSE
%{gopath}/src/%{import_path}/pkg/mflag/MAINTAINERS
%{gopath}/src/%{import_path}/pkg/mflag/README.md
+%dir %{gopath}/src/%{import_path}/pkg/mflag/example
%{gopath}/src/%{import_path}/pkg/mflag/example/example.go
%{gopath}/src/%{import_path}/pkg/mflag/*.go
+%dir %{gopath}/src/%{import_path}/pkg/mount
%{gopath}/src/%{import_path}/pkg/mount/MAINTAINERS
%{gopath}/src/%{import_path}/pkg/mount/*.go
+%dir %{gopath}/src/%{import_path}/pkg/namesgenerator
%{gopath}/src/%{import_path}/pkg/namesgenerator/*.go
+%dir %{gopath}/src/%{import_path}/pkg/netlink
%{gopath}/src/%{import_path}/pkg/netlink/MAINTAINERS
%{gopath}/src/%{import_path}/pkg/netlink/*.go
+%dir %{gopath}/src/%{import_path}/pkg/networkfs
%{gopath}/src/%{import_path}/pkg/networkfs/MAINTAINERS
+%dir %{gopath}/src/%{import_path}/pkg/networkfs/etchosts
%{gopath}/src/%{import_path}/pkg/networkfs/etchosts/*.go
+%dir %{gopath}/src/%{import_path}/pkg/networkfs/resolvconf
%{gopath}/src/%{import_path}/pkg/networkfs/resolvconf/*.go
+%dir %{gopath}/src/%{import_path}/pkg/proxy
%{gopath}/src/%{import_path}/pkg/proxy/MAINTAINERS
%{gopath}/src/%{import_path}/pkg/proxy/*.go
+%dir %{gopath}/src/%{import_path}/pkg/selinux
%{gopath}/src/%{import_path}/pkg/selinux/*.go
+%dir %{gopath}/src/%{import_path}/pkg/signal
%{gopath}/src/%{import_path}/pkg/signal/MAINTAINERS
%{gopath}/src/%{import_path}/pkg/signal/*.go
+%dir %{gopath}/src/%{import_path}/pkg/symlink
%{gopath}/src/%{import_path}/pkg/symlink/MAINTAINERS
%{gopath}/src/%{import_path}/pkg/symlink/*.go
+%dir %{gopath}/src/%{import_path}/pkg/symlink/testdata
+%dir %{gopath}/src/%{import_path}/pkg/symlink/testdata/fs
+%dir %{gopath}/src/%{import_path}/pkg/symlink/testdata/fs/a
%{gopath}/src/%{import_path}/pkg/symlink/testdata/fs/a/d
%{gopath}/src/%{import_path}/pkg/symlink/testdata/fs/a/e
%{gopath}/src/%{import_path}/pkg/symlink/testdata/fs/a/f
+%dir %{gopath}/src/%{import_path}/pkg/symlink/testdata/fs/b
%{gopath}/src/%{import_path}/pkg/symlink/testdata/fs/b/h
%{gopath}/src/%{import_path}/pkg/symlink/testdata/fs/g
%{gopath}/src/%{import_path}/pkg/symlink/testdata/fs/i
+%dir %{gopath}/src/%{import_path}/pkg/sysinfo
%{gopath}/src/%{import_path}/pkg/sysinfo/MAINTAINERS
%{gopath}/src/%{import_path}/pkg/sysinfo/*.go
+%dir %{gopath}/src/%{import_path}/pkg/system
%{gopath}/src/%{import_path}/pkg/system/MAINTAINERS
%{gopath}/src/%{import_path}/pkg/system/*.go
+%dir %{gopath}/src/%{import_path}/pkg/systemd
%{gopath}/src/%{import_path}/pkg/systemd/MAINTAINERS
%{gopath}/src/%{import_path}/pkg/systemd/*.go
+%dir %{gopath}/src/%{import_path}/pkg/term
%{gopath}/src/%{import_path}/pkg/term/MAINTAINERS
%{gopath}/src/%{import_path}/pkg/term/*.go
+%dir %{gopath}/src/%{import_path}/pkg/testutils
%{gopath}/src/%{import_path}/pkg/testutils/MAINTAINERS
%{gopath}/src/%{import_path}/pkg/testutils/README.md
%{gopath}/src/%{import_path}/pkg/testutils/testutils.go
+%dir %{gopath}/src/%{import_path}/pkg/units
%{gopath}/src/%{import_path}/pkg/units/MAINTAINERS
%{gopath}/src/%{import_path}/pkg/units/*.go
+%dir %{gopath}/src/%{import_path}/pkg/user
%{gopath}/src/%{import_path}/pkg/user/MAINTAINERS
%{gopath}/src/%{import_path}/pkg/user/*.go
+%dir %{gopath}/src/%{import_path}/pkg/version
%{gopath}/src/%{import_path}/pkg/version/*.go
+%dir %{gopath}/src/%{import_path}/registry
%{gopath}/src/%{import_path}/registry/MAINTAINERS
%{gopath}/src/%{import_path}/registry/*.go
+%dir %{gopath}/src/%{import_path}/runconfig
%{gopath}/src/%{import_path}/runconfig/*.go
+%dir %{gopath}/src/%{import_path}/server
%{gopath}/src/%{import_path}/server/MAINTAINERS
%{gopath}/src/%{import_path}/server/*.go
+%dir %{gopath}/src/%{import_path}/sysinit
%{gopath}/src/%{import_path}/sysinit/README.md
%{gopath}/src/%{import_path}/sysinit/*.go
+%dir %{gopath}/src/%{import_path}/utils
+%dir %{gopath}/src/%{import_path}/utils/filters
%{gopath}/src/%{import_path}/utils/filters/*.go
%{gopath}/src/%{import_path}/utils/*.goupstream-patched-archive-tar
%{gopath}/src/%{import_path}/utils/*.go
+%dir %{gopath}/src/%{import_path}/utils/testdata
+%dir %{gopath}/src/%{import_path}/utils/testdata/46af0962ab5afeb5ce6740d4d91652e69206fc991fd5328c1a94d364ad00e457
%{gopath}/src/%{import_path}/utils/testdata/46af0962ab5afeb5ce6740d4d91652e69206fc991fd5328c1a94d364ad00e457/json
%{gopath}/src/%{import_path}/utils/testdata/46af0962ab5afeb5ce6740d4d91652e69206fc991fd5328c1a94d364ad00e457/layer.tar
+%dir %{gopath}/src/%{import_path}/utils/testdata/511136ea3c5a64f264b78b5433614aec563103b4d4702f3ba7d4d2698e22c158
%{gopath}/src/%{import_path}/utils/testdata/511136ea3c5a64f264b78b5433614aec563103b4d4702f3ba7d4d2698e22c158/json
%{gopath}/src/%{import_path}/utils/testdata/511136ea3c5a64f264b78b5433614aec563103b4d4702f3ba7d4d2698e22c158/layer.tar
%changelog
+* Wed Jul 23 2014 Lokesh Mandvekar <lsm5(a)fedoraproject.org> - 1.0.0-8
+- Resolves: rhbz#1119849
+- Resolves: rhbz#1119413 - min delta between upstream and packaged unitfiles
+- devel package owns directories it creates
+- ensure min NVRs used for systemd contain fixes RE: CVE-2014-3499
+
* Wed Jul 16 2014 Vincent Batts <vbatts(a)fedoraproject.org> - 1.0.0-7
- clean up gopath
- add Provides for docker libraries
diff --git a/docker.service b/docker.service
index e2aace1..bb1a64a 100644
--- a/docker.service
+++ b/docker.service
@@ -7,7 +7,7 @@ Requires=docker.socket
[Service]
Type=notify
EnvironmentFile=-/etc/sysconfig/docker
-ExecStart=/usr/bin/docker -d --selinux-enabled -H fd://
+ExecStart=/usr/bin/docker -d -H fd:// $OPTIONS
Restart=on-failure
LimitNOFILE=1048576
LimitNPROC=1048576
diff --git a/docker.sysconfig b/docker.sysconfig
index a2fd2af..e5f99cb 100644
--- a/docker.sysconfig
+++ b/docker.sysconfig
@@ -1 +1,2 @@
# /etc/sysconfig/docker
+OPTIONS=--selinux-enabled
9 years, 9 months
[docker-io/f21] Resolves: rhbz#1119849, rhbz#1119413, devel package and systemd CVE-2014-3499 fixes
by Lokesh Mandvekar
commit 381e313b0e5bfe6bb7d8dd7c2c86633c3b49fb1e
Author: Lokesh Mandvekar <lsm5(a)fedoraproject.org>
Date: Wed Jul 23 21:57:44 2014 -0500
Resolves: rhbz#1119849, rhbz#1119413, devel package and systemd CVE-2014-3499 fixes
audit-write.patch | 29 +++++++++++++
docker-io.spec | 116 ++++++++++++++++++++++++++++++++++++++++++++++++++++-
docker.service | 2 +-
docker.sysconfig | 1 +
4 files changed, 145 insertions(+), 3 deletions(-)
---
diff --git a/audit-write.patch b/audit-write.patch
new file mode 100644
index 0000000..140d8ab
--- /dev/null
+++ b/audit-write.patch
@@ -0,0 +1,29 @@
+From 29ecc95c31ecfe15e3b3d8db94cea1c555e526a3 Mon Sep 17 00:00:00 2001
+From: Alexandr Morozov <lk4d4math(a)gmail.com>
+Date: Wed, 23 Jul 2014 09:57:41 +0400
+Subject: [PATCH] Add AUDIT_WRITE cap
+
+Fixes #6345
+
+Thanks @larsks for outstanding investigation
+
+Docker-DCO-1.1-Signed-off-by: Alexandr Morozov <lk4d4math(a)gmail.com> (github: LK4D4)
+---
+ daemon/execdriver/native/template/default_template.go | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/daemon/execdriver/native/template/default_template.go b/daemon/execdriver/native/template/default_template.go
+index cc5cc4f..be3dd5a 100644
+--- a/daemon/execdriver/native/template/default_template.go
++++ b/daemon/execdriver/native/template/default_template.go
+@@ -23,6 +23,7 @@ func New() *libcontainer.Config {
+ "NET_BIND_SERVICE",
+ "SYS_CHROOT",
+ "KILL",
++ "AUDIT_WRITE",
+ },
+ Namespaces: map[string]bool{
+ "NEWNS": true,
+--
+1.9.3
+
diff --git a/docker-io.spec b/docker-io.spec
index 70bc468..d97dec1 100644
--- a/docker-io.spec
+++ b/docker-io.spec
@@ -11,11 +11,13 @@
Name: docker-io
Version: 1.0.0
-Release: 7%{?dist}
+Release: 8%{?dist}
Summary: Automates deployment of containerized applications
License: ASL 2.0
Patch1: upstream-patched-archive-tar.patch
Patch2: finalize-namespace.patch
+# Resolves: rhbz#1119849 - add AUDIT_WRITE capablility
+Patch3: audit-write.patch
URL: http://www.docker.io
# only x86_64 for now: https://github.com/dotcloud/docker/issues/136
ExclusiveArch: x86_64
@@ -44,7 +46,14 @@ BuildRequires: device-mapper-devel
BuildRequires: btrfs-progs-devel
BuildRequires: pkgconfig(systemd)
BuildRequires: pandoc
-Requires: systemd-units
+# Use appropriate NVR for systemd-units to ensure SocketUser and SocketGroup are available
+%if 0%{?fedora} >= 21
+Requires: systemd-units >= 214
+%else if 0%{?fedora} == 20
+Requires: systemd-units >= 208-20
+%else
+Requires: systemd-units >= 204-20
+%endif
# need xz to work with ubuntu images
# https://bugzilla.redhat.com/show_bug.cgi?id=1045220
Requires: xz
@@ -144,6 +153,8 @@ This is the source libraries for docker.
rm -rf vendor
%patch1 -p1 -b upstream-patched-archive-tar
%patch2 -p1 -b finalize-namespace
+%patch3 -p1
+rm daemon/execdriver/native/template/*.go.orig
%build
# set up temporary build gopath, and put our directory there
@@ -246,149 +257,250 @@ exit 0
%files devel
%defattr(-,root,root,-)
%dir %{gopath}/src/%{import_path}
+%dir %{gopath}/src/%{import_path}/api
%{gopath}/src/%{import_path}/api/MAINTAINERS
%{gopath}/src/%{import_path}/api/README.md
%{gopath}/src/%{import_path}/api/*.go
%{gopath}/src/%{import_path}/api/client/*.go
+%dir %{gopath}/src/%{import_path}/api/server
%{gopath}/src/%{import_path}/api/server/*.go
+%dir %{gopath}/src/%{import_path}/archive
%{gopath}/src/%{import_path}/archive/MAINTAINERS
%{gopath}/src/%{import_path}/archive/README.md
%{gopath}/src/%{import_path}/archive/*.go
%{gopath}/src/%{import_path}/archive/*.goupstream-patched-archive-tar
+%dir %{gopath}/src/%{import_path}/archive/testdata
%{gopath}/src/%{import_path}/archive/testdata/broken.tar
+%dir %{gopath}/src/%{import_path}/builtins
%{gopath}/src/%{import_path}/builtins/*.go
+%dir %{gopath}/src/%{import_path}/daemon
%{gopath}/src/%{import_path}/daemon/*.go
%{gopath}/src/%{import_path}/daemon/README.md
+%dir %{gopath}/src/%{import_path}/daemon/execdriver
%{gopath}/src/%{import_path}/daemon/execdriver/*.go
%{gopath}/src/%{import_path}/daemon/execdriver/MAINTAINERS
+%dir %{gopath}/src/%{import_path}/daemon/execdriver/execdrivers
%{gopath}/src/%{import_path}/daemon/execdriver/execdrivers/*.go
+%dir %{gopath}/src/%{import_path}/daemon/execdriver/lxc
%{gopath}/src/%{import_path}/daemon/execdriver/lxc/*.go
+%dir %{gopath}/src/%{import_path}/daemon/execdriver/native
%{gopath}/src/%{import_path}/daemon/execdriver/native/*.go
+%dir %{gopath}/src/%{import_path}/daemon/execdriver/native/configuration
%{gopath}/src/%{import_path}/daemon/execdriver/native/configuration/*.go
+%dir %{gopath}/src/%{import_path}/daemon/execdriver/native/template
%{gopath}/src/%{import_path}/daemon/execdriver/native/template/*.go
+%dir %{gopath}/src/%{import_path}/daemon/graphdriver
%{gopath}/src/%{import_path}/daemon/graphdriver/*.go
+%dir %{gopath}/src/%{import_path}/daemon/graphdriver/aufs
%{gopath}/src/%{import_path}/daemon/graphdriver/aufs/*.go
+%dir %{gopath}/src/%{import_path}/daemon/graphdriver/btrfs
%{gopath}/src/%{import_path}/daemon/graphdriver/btrfs/*.go
%{gopath}/src/%{import_path}/daemon/graphdriver/btrfs/MAINTAINERS
+%dir %{gopath}/src/%{import_path}/daemon/graphdriver/devmapper
%{gopath}/src/%{import_path}/daemon/graphdriver/devmapper/*.go
%{gopath}/src/%{import_path}/daemon/graphdriver/devmapper/MAINTAINERS
%{gopath}/src/%{import_path}/daemon/graphdriver/devmapper/README.md
+%dir %{gopath}/src/%{import_path}/daemon/graphdriver/graphtest
%{gopath}/src/%{import_path}/daemon/graphdriver/graphtest/*.go
+%dir %{gopath}/src/%{import_path}/daemon/graphdriver/vfs
%{gopath}/src/%{import_path}/daemon/graphdriver/vfs/*.go
+%dir %{gopath}/src/%{import_path}/daemon/networkdriver
+%dir %{gopath}/src/%{import_path}/daemon/networkdriver/bridge
%{gopath}/src/%{import_path}/daemon/networkdriver/bridge/*.go
+%dir %{gopath}/src/%{import_path}/daemon/networkdriver/ipallocator
%{gopath}/src/%{import_path}/daemon/networkdriver/ipallocator/*.go
%{gopath}/src/%{import_path}/daemon/networkdriver/*.go
+%dir %{gopath}/src/%{import_path}/daemon/networkdriver/portallocator
%{gopath}/src/%{import_path}/daemon/networkdriver/portallocator/*.go
+%dir %{gopath}/src/%{import_path}/daemon/networkdriver/portmapper
%{gopath}/src/%{import_path}/daemon/networkdriver/portmapper/*.go
+%dir %{gopath}/src/%{import_path}/daemonconfig
%{gopath}/src/%{import_path}/daemonconfig/README.md
%{gopath}/src/%{import_path}/daemonconfig/*.go
+%dir %{gopath}/src/%{import_path}/dockerversion
%{gopath}/src/%{import_path}/dockerversion/*.go
+%dir %{gopath}/src/%{import_path}/engine
%{gopath}/src/%{import_path}/engine/MAINTAINERS
%{gopath}/src/%{import_path}/engine/*.go
+%dir %{gopath}/src/%{import_path}/engine/rengine
%{gopath}/src/%{import_path}/engine/rengine/*.go
+%dir %{gopath}/src/%{import_path}/engine/spawn
%{gopath}/src/%{import_path}/engine/spawn/*.go
+%dir %{gopath}/src/%{import_path}/engine/spawn/subengine
%{gopath}/src/%{import_path}/engine/spawn/subengine/*.go
+%dir %{gopath}/src/%{import_path}/graph
%{gopath}/src/%{import_path}/graph/*.go
%{gopath}/src/%{import_path}/graph/*.goupstream-patched-archive-tar
+%dir %{gopath}/src/%{import_path}/image
%{gopath}/src/%{import_path}/image/*.go
+%dir %{gopath}/src/%{import_path}/links
%{gopath}/src/%{import_path}/links/*.go
+%dir %{gopath}/src/%{import_path}/nat
%{gopath}/src/%{import_path}/nat/*.go
+%dir %{gopath}/src/%{import_path}/opts
%{gopath}/src/%{import_path}/opts/*.go
+%dir %{gopath}/src/%{import_path}/pkg
%{gopath}/src/%{import_path}/pkg/README.md
+%dir %{gopath}/src/%{import_path}/pkg/apparmor
%{gopath}/src/%{import_path}/pkg/apparmor/*.go
+%dir %{gopath}/src/%{import_path}/pkg/beam
%{gopath}/src/%{import_path}/pkg/beam/MAINTAINERS
%{gopath}/src/%{import_path}/pkg/beam/*.go
+%dir %{gopath}/src/%{import_path}/pkg/beam/data
%{gopath}/src/%{import_path}/pkg/beam/data/*.go
%{gopath}/src/%{import_path}/pkg/beam/data/netstring.txt
+%dir %{gopath}/src/%{import_path}/pkg/beam/examples
+%dir %{gopath}/src/%{import_path}/pkg/beam/examples/beamsh
%{gopath}/src/%{import_path}/pkg/beam/examples/beamsh/beamsh
%{gopath}/src/%{import_path}/pkg/beam/examples/beamsh/*.go
+%dir %{gopath}/src/%{import_path}/pkg/beam/examples/beamsh/scripts
%{gopath}/src/%{import_path}/pkg/beam/examples/beamsh/scripts/*.ds
+%dir %{gopath}/src/%{import_path}/pkg/dockerscript
%{gopath}/src/%{import_path}/pkg/dockerscript/MAINTAINERS
%{gopath}/src/%{import_path}/pkg/dockerscript/*.go
+%dir %{gopath}/src/%{import_path}/pkg/dockerscript/scanner
%{gopath}/src/%{import_path}/pkg/dockerscript/scanner/*.go
+%dir %{gopath}/src/%{import_path}/pkg/graphdb
%{gopath}/src/%{import_path}/pkg/graphdb/MAINTAINERS
%{gopath}/src/%{import_path}/pkg/graphdb/*.go
+%dir %{gopath}/src/%{import_path}/pkg/iptables
%{gopath}/src/%{import_path}/pkg/iptables/MAINTAINERS
%{gopath}/src/%{import_path}/pkg/iptables/*.go
+%dir %{gopath}/src/%{import_path}/pkg/label
%{gopath}/src/%{import_path}/pkg/label/*.go
+%dir %{gopath}/src/%{import_path}/pkg/listenbuffer
%{gopath}/src/%{import_path}/pkg/listenbuffer/*.go
+%dir %{gopath}/src/%{import_path}/pkg/libcontainer
%{gopath}/src/%{import_path}/pkg/libcontainer/*.go
%{gopath}/src/%{import_path}/pkg/libcontainer/MAINTAINERS
%{gopath}/src/%{import_path}/pkg/libcontainer/README.md
%{gopath}/src/%{import_path}/pkg/libcontainer/TODO.md
+%dir %{gopath}/src/%{import_path}/pkg/libcontainer/cgroups
%{gopath}/src/%{import_path}/pkg/libcontainer/cgroups/*.go
+%dir %{gopath}/src/%{import_path}/pkg/libcontainer/cgroups/fs
%{gopath}/src/%{import_path}/pkg/libcontainer/cgroups/fs/*.go
+%dir %{gopath}/src/%{import_path}/pkg/libcontainer/cgroups/systemd
%{gopath}/src/%{import_path}/pkg/libcontainer/cgroups/systemd/*.go
+%dir %{gopath}/src/%{import_path}/pkg/libcontainer/console
%{gopath}/src/%{import_path}/pkg/libcontainer/console/*.go
%{gopath}/src/%{import_path}/pkg/libcontainer/container.json
+%dir %{gopath}/src/%{import_path}/pkg/libcontainer/devices
%{gopath}/src/%{import_path}/pkg/libcontainer/devices/*.go
+%dir %{gopath}/src/%{import_path}/pkg/libcontainer/mount
%{gopath}/src/%{import_path}/pkg/libcontainer/mount/*.go
+%dir %{gopath}/src/%{import_path}/pkg/libcontainer/mount/nodes
%{gopath}/src/%{import_path}/pkg/libcontainer/mount/nodes/*.go
+%dir %{gopath}/src/%{import_path}/pkg/libcontainer/namespaces
%{gopath}/src/%{import_path}/pkg/libcontainer/namespaces/*.go
%{gopath}/src/%{import_path}/pkg/libcontainer/namespaces/init.gofinalize-namespace
+%dir %{gopath}/src/%{import_path}/pkg/libcontainer/network
%{gopath}/src/%{import_path}/pkg/libcontainer/network/*.go
+%dir %{gopath}/src/%{import_path}/pkg/libcontainer/nsinit
%{gopath}/src/%{import_path}/pkg/libcontainer/nsinit/*.go
+%dir %{gopath}/src/%{import_path}/pkg/libcontainer/security
+%dir %{gopath}/src/%{import_path}/pkg/libcontainer/security/capabilities
%{gopath}/src/%{import_path}/pkg/libcontainer/security/capabilities/*.go
+%dir %{gopath}/src/%{import_path}/pkg/libcontainer/security/restrict
%{gopath}/src/%{import_path}/pkg/libcontainer/security/restrict/*.go
+%dir %{gopath}/src/%{import_path}/pkg/libcontainer/utils
%{gopath}/src/%{import_path}/pkg/libcontainer/utils/*.go
+%dir %{gopath}/src/%{import_path}/pkg/mflag
%{gopath}/src/%{import_path}/pkg/mflag/LICENSE
%{gopath}/src/%{import_path}/pkg/mflag/MAINTAINERS
%{gopath}/src/%{import_path}/pkg/mflag/README.md
+%dir %{gopath}/src/%{import_path}/pkg/mflag/example
%{gopath}/src/%{import_path}/pkg/mflag/example/example.go
%{gopath}/src/%{import_path}/pkg/mflag/*.go
+%dir %{gopath}/src/%{import_path}/pkg/mount
%{gopath}/src/%{import_path}/pkg/mount/MAINTAINERS
%{gopath}/src/%{import_path}/pkg/mount/*.go
+%dir %{gopath}/src/%{import_path}/pkg/namesgenerator
%{gopath}/src/%{import_path}/pkg/namesgenerator/*.go
+%dir %{gopath}/src/%{import_path}/pkg/netlink
%{gopath}/src/%{import_path}/pkg/netlink/MAINTAINERS
%{gopath}/src/%{import_path}/pkg/netlink/*.go
+%dir %{gopath}/src/%{import_path}/pkg/networkfs
%{gopath}/src/%{import_path}/pkg/networkfs/MAINTAINERS
+%dir %{gopath}/src/%{import_path}/pkg/networkfs/etchosts
%{gopath}/src/%{import_path}/pkg/networkfs/etchosts/*.go
+%dir %{gopath}/src/%{import_path}/pkg/networkfs/resolvconf
%{gopath}/src/%{import_path}/pkg/networkfs/resolvconf/*.go
+%dir %{gopath}/src/%{import_path}/pkg/proxy
%{gopath}/src/%{import_path}/pkg/proxy/MAINTAINERS
%{gopath}/src/%{import_path}/pkg/proxy/*.go
+%dir %{gopath}/src/%{import_path}/pkg/selinux
%{gopath}/src/%{import_path}/pkg/selinux/*.go
+%dir %{gopath}/src/%{import_path}/pkg/signal
%{gopath}/src/%{import_path}/pkg/signal/MAINTAINERS
%{gopath}/src/%{import_path}/pkg/signal/*.go
+%dir %{gopath}/src/%{import_path}/pkg/symlink
%{gopath}/src/%{import_path}/pkg/symlink/MAINTAINERS
%{gopath}/src/%{import_path}/pkg/symlink/*.go
+%dir %{gopath}/src/%{import_path}/pkg/symlink/testdata
+%dir %{gopath}/src/%{import_path}/pkg/symlink/testdata/fs
+%dir %{gopath}/src/%{import_path}/pkg/symlink/testdata/fs/a
%{gopath}/src/%{import_path}/pkg/symlink/testdata/fs/a/d
%{gopath}/src/%{import_path}/pkg/symlink/testdata/fs/a/e
%{gopath}/src/%{import_path}/pkg/symlink/testdata/fs/a/f
+%dir %{gopath}/src/%{import_path}/pkg/symlink/testdata/fs/b
%{gopath}/src/%{import_path}/pkg/symlink/testdata/fs/b/h
%{gopath}/src/%{import_path}/pkg/symlink/testdata/fs/g
%{gopath}/src/%{import_path}/pkg/symlink/testdata/fs/i
+%dir %{gopath}/src/%{import_path}/pkg/sysinfo
%{gopath}/src/%{import_path}/pkg/sysinfo/MAINTAINERS
%{gopath}/src/%{import_path}/pkg/sysinfo/*.go
+%dir %{gopath}/src/%{import_path}/pkg/system
%{gopath}/src/%{import_path}/pkg/system/MAINTAINERS
%{gopath}/src/%{import_path}/pkg/system/*.go
+%dir %{gopath}/src/%{import_path}/pkg/systemd
%{gopath}/src/%{import_path}/pkg/systemd/MAINTAINERS
%{gopath}/src/%{import_path}/pkg/systemd/*.go
+%dir %{gopath}/src/%{import_path}/pkg/term
%{gopath}/src/%{import_path}/pkg/term/MAINTAINERS
%{gopath}/src/%{import_path}/pkg/term/*.go
+%dir %{gopath}/src/%{import_path}/pkg/testutils
%{gopath}/src/%{import_path}/pkg/testutils/MAINTAINERS
%{gopath}/src/%{import_path}/pkg/testutils/README.md
%{gopath}/src/%{import_path}/pkg/testutils/testutils.go
+%dir %{gopath}/src/%{import_path}/pkg/units
%{gopath}/src/%{import_path}/pkg/units/MAINTAINERS
%{gopath}/src/%{import_path}/pkg/units/*.go
+%dir %{gopath}/src/%{import_path}/pkg/user
%{gopath}/src/%{import_path}/pkg/user/MAINTAINERS
%{gopath}/src/%{import_path}/pkg/user/*.go
+%dir %{gopath}/src/%{import_path}/pkg/version
%{gopath}/src/%{import_path}/pkg/version/*.go
+%dir %{gopath}/src/%{import_path}/registry
%{gopath}/src/%{import_path}/registry/MAINTAINERS
%{gopath}/src/%{import_path}/registry/*.go
+%dir %{gopath}/src/%{import_path}/runconfig
%{gopath}/src/%{import_path}/runconfig/*.go
+%dir %{gopath}/src/%{import_path}/server
%{gopath}/src/%{import_path}/server/MAINTAINERS
%{gopath}/src/%{import_path}/server/*.go
+%dir %{gopath}/src/%{import_path}/sysinit
%{gopath}/src/%{import_path}/sysinit/README.md
%{gopath}/src/%{import_path}/sysinit/*.go
+%dir %{gopath}/src/%{import_path}/utils
+%dir %{gopath}/src/%{import_path}/utils/filters
%{gopath}/src/%{import_path}/utils/filters/*.go
%{gopath}/src/%{import_path}/utils/*.goupstream-patched-archive-tar
%{gopath}/src/%{import_path}/utils/*.go
+%dir %{gopath}/src/%{import_path}/utils/testdata
+%dir %{gopath}/src/%{import_path}/utils/testdata/46af0962ab5afeb5ce6740d4d91652e69206fc991fd5328c1a94d364ad00e457
%{gopath}/src/%{import_path}/utils/testdata/46af0962ab5afeb5ce6740d4d91652e69206fc991fd5328c1a94d364ad00e457/json
%{gopath}/src/%{import_path}/utils/testdata/46af0962ab5afeb5ce6740d4d91652e69206fc991fd5328c1a94d364ad00e457/layer.tar
+%dir %{gopath}/src/%{import_path}/utils/testdata/511136ea3c5a64f264b78b5433614aec563103b4d4702f3ba7d4d2698e22c158
%{gopath}/src/%{import_path}/utils/testdata/511136ea3c5a64f264b78b5433614aec563103b4d4702f3ba7d4d2698e22c158/json
%{gopath}/src/%{import_path}/utils/testdata/511136ea3c5a64f264b78b5433614aec563103b4d4702f3ba7d4d2698e22c158/layer.tar
%changelog
+* Wed Jul 23 2014 Lokesh Mandvekar <lsm5(a)fedoraproject.org> - 1.0.0-8
+- Resolves: rhbz#1119849
+- Resolves: rhbz#1119413 - min delta between upstream and packaged unitfiles
+- devel package owns directories it creates
+- ensure min NVRs used for systemd contain fixes RE: CVE-2014-3499
+
* Wed Jul 16 2014 Vincent Batts <vbatts(a)fedoraproject.org> - 1.0.0-7
- clean up gopath
- add Provides for docker libraries
diff --git a/docker.service b/docker.service
index e2aace1..bb1a64a 100644
--- a/docker.service
+++ b/docker.service
@@ -7,7 +7,7 @@ Requires=docker.socket
[Service]
Type=notify
EnvironmentFile=-/etc/sysconfig/docker
-ExecStart=/usr/bin/docker -d --selinux-enabled -H fd://
+ExecStart=/usr/bin/docker -d -H fd:// $OPTIONS
Restart=on-failure
LimitNOFILE=1048576
LimitNPROC=1048576
diff --git a/docker.sysconfig b/docker.sysconfig
index a2fd2af..e5f99cb 100644
--- a/docker.sysconfig
+++ b/docker.sysconfig
@@ -1 +1,2 @@
# /etc/sysconfig/docker
+OPTIONS=--selinux-enabled
9 years, 9 months
[docker-io] Resolves: rhbz#1119849, rhbz#1119413, devel package and systemd CVE-2014-3499 fixes
by Lokesh Mandvekar
commit b1fdc2eb30badf0d408fc62c40a446c618f7e153
Author: Lokesh Mandvekar <lsm5(a)fedoraproject.org>
Date: Wed Jul 23 21:57:44 2014 -0500
Resolves: rhbz#1119849, rhbz#1119413, devel package and systemd CVE-2014-3499 fixes
audit-write.patch | 29 +++++++++++++
docker-io.spec | 116 ++++++++++++++++++++++++++++++++++++++++++++++++++++-
docker.service | 2 +-
docker.sysconfig | 1 +
4 files changed, 145 insertions(+), 3 deletions(-)
---
diff --git a/audit-write.patch b/audit-write.patch
new file mode 100644
index 0000000..140d8ab
--- /dev/null
+++ b/audit-write.patch
@@ -0,0 +1,29 @@
+From 29ecc95c31ecfe15e3b3d8db94cea1c555e526a3 Mon Sep 17 00:00:00 2001
+From: Alexandr Morozov <lk4d4math(a)gmail.com>
+Date: Wed, 23 Jul 2014 09:57:41 +0400
+Subject: [PATCH] Add AUDIT_WRITE cap
+
+Fixes #6345
+
+Thanks @larsks for outstanding investigation
+
+Docker-DCO-1.1-Signed-off-by: Alexandr Morozov <lk4d4math(a)gmail.com> (github: LK4D4)
+---
+ daemon/execdriver/native/template/default_template.go | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/daemon/execdriver/native/template/default_template.go b/daemon/execdriver/native/template/default_template.go
+index cc5cc4f..be3dd5a 100644
+--- a/daemon/execdriver/native/template/default_template.go
++++ b/daemon/execdriver/native/template/default_template.go
+@@ -23,6 +23,7 @@ func New() *libcontainer.Config {
+ "NET_BIND_SERVICE",
+ "SYS_CHROOT",
+ "KILL",
++ "AUDIT_WRITE",
+ },
+ Namespaces: map[string]bool{
+ "NEWNS": true,
+--
+1.9.3
+
diff --git a/docker-io.spec b/docker-io.spec
index 70bc468..d97dec1 100644
--- a/docker-io.spec
+++ b/docker-io.spec
@@ -11,11 +11,13 @@
Name: docker-io
Version: 1.0.0
-Release: 7%{?dist}
+Release: 8%{?dist}
Summary: Automates deployment of containerized applications
License: ASL 2.0
Patch1: upstream-patched-archive-tar.patch
Patch2: finalize-namespace.patch
+# Resolves: rhbz#1119849 - add AUDIT_WRITE capablility
+Patch3: audit-write.patch
URL: http://www.docker.io
# only x86_64 for now: https://github.com/dotcloud/docker/issues/136
ExclusiveArch: x86_64
@@ -44,7 +46,14 @@ BuildRequires: device-mapper-devel
BuildRequires: btrfs-progs-devel
BuildRequires: pkgconfig(systemd)
BuildRequires: pandoc
-Requires: systemd-units
+# Use appropriate NVR for systemd-units to ensure SocketUser and SocketGroup are available
+%if 0%{?fedora} >= 21
+Requires: systemd-units >= 214
+%else if 0%{?fedora} == 20
+Requires: systemd-units >= 208-20
+%else
+Requires: systemd-units >= 204-20
+%endif
# need xz to work with ubuntu images
# https://bugzilla.redhat.com/show_bug.cgi?id=1045220
Requires: xz
@@ -144,6 +153,8 @@ This is the source libraries for docker.
rm -rf vendor
%patch1 -p1 -b upstream-patched-archive-tar
%patch2 -p1 -b finalize-namespace
+%patch3 -p1
+rm daemon/execdriver/native/template/*.go.orig
%build
# set up temporary build gopath, and put our directory there
@@ -246,149 +257,250 @@ exit 0
%files devel
%defattr(-,root,root,-)
%dir %{gopath}/src/%{import_path}
+%dir %{gopath}/src/%{import_path}/api
%{gopath}/src/%{import_path}/api/MAINTAINERS
%{gopath}/src/%{import_path}/api/README.md
%{gopath}/src/%{import_path}/api/*.go
%{gopath}/src/%{import_path}/api/client/*.go
+%dir %{gopath}/src/%{import_path}/api/server
%{gopath}/src/%{import_path}/api/server/*.go
+%dir %{gopath}/src/%{import_path}/archive
%{gopath}/src/%{import_path}/archive/MAINTAINERS
%{gopath}/src/%{import_path}/archive/README.md
%{gopath}/src/%{import_path}/archive/*.go
%{gopath}/src/%{import_path}/archive/*.goupstream-patched-archive-tar
+%dir %{gopath}/src/%{import_path}/archive/testdata
%{gopath}/src/%{import_path}/archive/testdata/broken.tar
+%dir %{gopath}/src/%{import_path}/builtins
%{gopath}/src/%{import_path}/builtins/*.go
+%dir %{gopath}/src/%{import_path}/daemon
%{gopath}/src/%{import_path}/daemon/*.go
%{gopath}/src/%{import_path}/daemon/README.md
+%dir %{gopath}/src/%{import_path}/daemon/execdriver
%{gopath}/src/%{import_path}/daemon/execdriver/*.go
%{gopath}/src/%{import_path}/daemon/execdriver/MAINTAINERS
+%dir %{gopath}/src/%{import_path}/daemon/execdriver/execdrivers
%{gopath}/src/%{import_path}/daemon/execdriver/execdrivers/*.go
+%dir %{gopath}/src/%{import_path}/daemon/execdriver/lxc
%{gopath}/src/%{import_path}/daemon/execdriver/lxc/*.go
+%dir %{gopath}/src/%{import_path}/daemon/execdriver/native
%{gopath}/src/%{import_path}/daemon/execdriver/native/*.go
+%dir %{gopath}/src/%{import_path}/daemon/execdriver/native/configuration
%{gopath}/src/%{import_path}/daemon/execdriver/native/configuration/*.go
+%dir %{gopath}/src/%{import_path}/daemon/execdriver/native/template
%{gopath}/src/%{import_path}/daemon/execdriver/native/template/*.go
+%dir %{gopath}/src/%{import_path}/daemon/graphdriver
%{gopath}/src/%{import_path}/daemon/graphdriver/*.go
+%dir %{gopath}/src/%{import_path}/daemon/graphdriver/aufs
%{gopath}/src/%{import_path}/daemon/graphdriver/aufs/*.go
+%dir %{gopath}/src/%{import_path}/daemon/graphdriver/btrfs
%{gopath}/src/%{import_path}/daemon/graphdriver/btrfs/*.go
%{gopath}/src/%{import_path}/daemon/graphdriver/btrfs/MAINTAINERS
+%dir %{gopath}/src/%{import_path}/daemon/graphdriver/devmapper
%{gopath}/src/%{import_path}/daemon/graphdriver/devmapper/*.go
%{gopath}/src/%{import_path}/daemon/graphdriver/devmapper/MAINTAINERS
%{gopath}/src/%{import_path}/daemon/graphdriver/devmapper/README.md
+%dir %{gopath}/src/%{import_path}/daemon/graphdriver/graphtest
%{gopath}/src/%{import_path}/daemon/graphdriver/graphtest/*.go
+%dir %{gopath}/src/%{import_path}/daemon/graphdriver/vfs
%{gopath}/src/%{import_path}/daemon/graphdriver/vfs/*.go
+%dir %{gopath}/src/%{import_path}/daemon/networkdriver
+%dir %{gopath}/src/%{import_path}/daemon/networkdriver/bridge
%{gopath}/src/%{import_path}/daemon/networkdriver/bridge/*.go
+%dir %{gopath}/src/%{import_path}/daemon/networkdriver/ipallocator
%{gopath}/src/%{import_path}/daemon/networkdriver/ipallocator/*.go
%{gopath}/src/%{import_path}/daemon/networkdriver/*.go
+%dir %{gopath}/src/%{import_path}/daemon/networkdriver/portallocator
%{gopath}/src/%{import_path}/daemon/networkdriver/portallocator/*.go
+%dir %{gopath}/src/%{import_path}/daemon/networkdriver/portmapper
%{gopath}/src/%{import_path}/daemon/networkdriver/portmapper/*.go
+%dir %{gopath}/src/%{import_path}/daemonconfig
%{gopath}/src/%{import_path}/daemonconfig/README.md
%{gopath}/src/%{import_path}/daemonconfig/*.go
+%dir %{gopath}/src/%{import_path}/dockerversion
%{gopath}/src/%{import_path}/dockerversion/*.go
+%dir %{gopath}/src/%{import_path}/engine
%{gopath}/src/%{import_path}/engine/MAINTAINERS
%{gopath}/src/%{import_path}/engine/*.go
+%dir %{gopath}/src/%{import_path}/engine/rengine
%{gopath}/src/%{import_path}/engine/rengine/*.go
+%dir %{gopath}/src/%{import_path}/engine/spawn
%{gopath}/src/%{import_path}/engine/spawn/*.go
+%dir %{gopath}/src/%{import_path}/engine/spawn/subengine
%{gopath}/src/%{import_path}/engine/spawn/subengine/*.go
+%dir %{gopath}/src/%{import_path}/graph
%{gopath}/src/%{import_path}/graph/*.go
%{gopath}/src/%{import_path}/graph/*.goupstream-patched-archive-tar
+%dir %{gopath}/src/%{import_path}/image
%{gopath}/src/%{import_path}/image/*.go
+%dir %{gopath}/src/%{import_path}/links
%{gopath}/src/%{import_path}/links/*.go
+%dir %{gopath}/src/%{import_path}/nat
%{gopath}/src/%{import_path}/nat/*.go
+%dir %{gopath}/src/%{import_path}/opts
%{gopath}/src/%{import_path}/opts/*.go
+%dir %{gopath}/src/%{import_path}/pkg
%{gopath}/src/%{import_path}/pkg/README.md
+%dir %{gopath}/src/%{import_path}/pkg/apparmor
%{gopath}/src/%{import_path}/pkg/apparmor/*.go
+%dir %{gopath}/src/%{import_path}/pkg/beam
%{gopath}/src/%{import_path}/pkg/beam/MAINTAINERS
%{gopath}/src/%{import_path}/pkg/beam/*.go
+%dir %{gopath}/src/%{import_path}/pkg/beam/data
%{gopath}/src/%{import_path}/pkg/beam/data/*.go
%{gopath}/src/%{import_path}/pkg/beam/data/netstring.txt
+%dir %{gopath}/src/%{import_path}/pkg/beam/examples
+%dir %{gopath}/src/%{import_path}/pkg/beam/examples/beamsh
%{gopath}/src/%{import_path}/pkg/beam/examples/beamsh/beamsh
%{gopath}/src/%{import_path}/pkg/beam/examples/beamsh/*.go
+%dir %{gopath}/src/%{import_path}/pkg/beam/examples/beamsh/scripts
%{gopath}/src/%{import_path}/pkg/beam/examples/beamsh/scripts/*.ds
+%dir %{gopath}/src/%{import_path}/pkg/dockerscript
%{gopath}/src/%{import_path}/pkg/dockerscript/MAINTAINERS
%{gopath}/src/%{import_path}/pkg/dockerscript/*.go
+%dir %{gopath}/src/%{import_path}/pkg/dockerscript/scanner
%{gopath}/src/%{import_path}/pkg/dockerscript/scanner/*.go
+%dir %{gopath}/src/%{import_path}/pkg/graphdb
%{gopath}/src/%{import_path}/pkg/graphdb/MAINTAINERS
%{gopath}/src/%{import_path}/pkg/graphdb/*.go
+%dir %{gopath}/src/%{import_path}/pkg/iptables
%{gopath}/src/%{import_path}/pkg/iptables/MAINTAINERS
%{gopath}/src/%{import_path}/pkg/iptables/*.go
+%dir %{gopath}/src/%{import_path}/pkg/label
%{gopath}/src/%{import_path}/pkg/label/*.go
+%dir %{gopath}/src/%{import_path}/pkg/listenbuffer
%{gopath}/src/%{import_path}/pkg/listenbuffer/*.go
+%dir %{gopath}/src/%{import_path}/pkg/libcontainer
%{gopath}/src/%{import_path}/pkg/libcontainer/*.go
%{gopath}/src/%{import_path}/pkg/libcontainer/MAINTAINERS
%{gopath}/src/%{import_path}/pkg/libcontainer/README.md
%{gopath}/src/%{import_path}/pkg/libcontainer/TODO.md
+%dir %{gopath}/src/%{import_path}/pkg/libcontainer/cgroups
%{gopath}/src/%{import_path}/pkg/libcontainer/cgroups/*.go
+%dir %{gopath}/src/%{import_path}/pkg/libcontainer/cgroups/fs
%{gopath}/src/%{import_path}/pkg/libcontainer/cgroups/fs/*.go
+%dir %{gopath}/src/%{import_path}/pkg/libcontainer/cgroups/systemd
%{gopath}/src/%{import_path}/pkg/libcontainer/cgroups/systemd/*.go
+%dir %{gopath}/src/%{import_path}/pkg/libcontainer/console
%{gopath}/src/%{import_path}/pkg/libcontainer/console/*.go
%{gopath}/src/%{import_path}/pkg/libcontainer/container.json
+%dir %{gopath}/src/%{import_path}/pkg/libcontainer/devices
%{gopath}/src/%{import_path}/pkg/libcontainer/devices/*.go
+%dir %{gopath}/src/%{import_path}/pkg/libcontainer/mount
%{gopath}/src/%{import_path}/pkg/libcontainer/mount/*.go
+%dir %{gopath}/src/%{import_path}/pkg/libcontainer/mount/nodes
%{gopath}/src/%{import_path}/pkg/libcontainer/mount/nodes/*.go
+%dir %{gopath}/src/%{import_path}/pkg/libcontainer/namespaces
%{gopath}/src/%{import_path}/pkg/libcontainer/namespaces/*.go
%{gopath}/src/%{import_path}/pkg/libcontainer/namespaces/init.gofinalize-namespace
+%dir %{gopath}/src/%{import_path}/pkg/libcontainer/network
%{gopath}/src/%{import_path}/pkg/libcontainer/network/*.go
+%dir %{gopath}/src/%{import_path}/pkg/libcontainer/nsinit
%{gopath}/src/%{import_path}/pkg/libcontainer/nsinit/*.go
+%dir %{gopath}/src/%{import_path}/pkg/libcontainer/security
+%dir %{gopath}/src/%{import_path}/pkg/libcontainer/security/capabilities
%{gopath}/src/%{import_path}/pkg/libcontainer/security/capabilities/*.go
+%dir %{gopath}/src/%{import_path}/pkg/libcontainer/security/restrict
%{gopath}/src/%{import_path}/pkg/libcontainer/security/restrict/*.go
+%dir %{gopath}/src/%{import_path}/pkg/libcontainer/utils
%{gopath}/src/%{import_path}/pkg/libcontainer/utils/*.go
+%dir %{gopath}/src/%{import_path}/pkg/mflag
%{gopath}/src/%{import_path}/pkg/mflag/LICENSE
%{gopath}/src/%{import_path}/pkg/mflag/MAINTAINERS
%{gopath}/src/%{import_path}/pkg/mflag/README.md
+%dir %{gopath}/src/%{import_path}/pkg/mflag/example
%{gopath}/src/%{import_path}/pkg/mflag/example/example.go
%{gopath}/src/%{import_path}/pkg/mflag/*.go
+%dir %{gopath}/src/%{import_path}/pkg/mount
%{gopath}/src/%{import_path}/pkg/mount/MAINTAINERS
%{gopath}/src/%{import_path}/pkg/mount/*.go
+%dir %{gopath}/src/%{import_path}/pkg/namesgenerator
%{gopath}/src/%{import_path}/pkg/namesgenerator/*.go
+%dir %{gopath}/src/%{import_path}/pkg/netlink
%{gopath}/src/%{import_path}/pkg/netlink/MAINTAINERS
%{gopath}/src/%{import_path}/pkg/netlink/*.go
+%dir %{gopath}/src/%{import_path}/pkg/networkfs
%{gopath}/src/%{import_path}/pkg/networkfs/MAINTAINERS
+%dir %{gopath}/src/%{import_path}/pkg/networkfs/etchosts
%{gopath}/src/%{import_path}/pkg/networkfs/etchosts/*.go
+%dir %{gopath}/src/%{import_path}/pkg/networkfs/resolvconf
%{gopath}/src/%{import_path}/pkg/networkfs/resolvconf/*.go
+%dir %{gopath}/src/%{import_path}/pkg/proxy
%{gopath}/src/%{import_path}/pkg/proxy/MAINTAINERS
%{gopath}/src/%{import_path}/pkg/proxy/*.go
+%dir %{gopath}/src/%{import_path}/pkg/selinux
%{gopath}/src/%{import_path}/pkg/selinux/*.go
+%dir %{gopath}/src/%{import_path}/pkg/signal
%{gopath}/src/%{import_path}/pkg/signal/MAINTAINERS
%{gopath}/src/%{import_path}/pkg/signal/*.go
+%dir %{gopath}/src/%{import_path}/pkg/symlink
%{gopath}/src/%{import_path}/pkg/symlink/MAINTAINERS
%{gopath}/src/%{import_path}/pkg/symlink/*.go
+%dir %{gopath}/src/%{import_path}/pkg/symlink/testdata
+%dir %{gopath}/src/%{import_path}/pkg/symlink/testdata/fs
+%dir %{gopath}/src/%{import_path}/pkg/symlink/testdata/fs/a
%{gopath}/src/%{import_path}/pkg/symlink/testdata/fs/a/d
%{gopath}/src/%{import_path}/pkg/symlink/testdata/fs/a/e
%{gopath}/src/%{import_path}/pkg/symlink/testdata/fs/a/f
+%dir %{gopath}/src/%{import_path}/pkg/symlink/testdata/fs/b
%{gopath}/src/%{import_path}/pkg/symlink/testdata/fs/b/h
%{gopath}/src/%{import_path}/pkg/symlink/testdata/fs/g
%{gopath}/src/%{import_path}/pkg/symlink/testdata/fs/i
+%dir %{gopath}/src/%{import_path}/pkg/sysinfo
%{gopath}/src/%{import_path}/pkg/sysinfo/MAINTAINERS
%{gopath}/src/%{import_path}/pkg/sysinfo/*.go
+%dir %{gopath}/src/%{import_path}/pkg/system
%{gopath}/src/%{import_path}/pkg/system/MAINTAINERS
%{gopath}/src/%{import_path}/pkg/system/*.go
+%dir %{gopath}/src/%{import_path}/pkg/systemd
%{gopath}/src/%{import_path}/pkg/systemd/MAINTAINERS
%{gopath}/src/%{import_path}/pkg/systemd/*.go
+%dir %{gopath}/src/%{import_path}/pkg/term
%{gopath}/src/%{import_path}/pkg/term/MAINTAINERS
%{gopath}/src/%{import_path}/pkg/term/*.go
+%dir %{gopath}/src/%{import_path}/pkg/testutils
%{gopath}/src/%{import_path}/pkg/testutils/MAINTAINERS
%{gopath}/src/%{import_path}/pkg/testutils/README.md
%{gopath}/src/%{import_path}/pkg/testutils/testutils.go
+%dir %{gopath}/src/%{import_path}/pkg/units
%{gopath}/src/%{import_path}/pkg/units/MAINTAINERS
%{gopath}/src/%{import_path}/pkg/units/*.go
+%dir %{gopath}/src/%{import_path}/pkg/user
%{gopath}/src/%{import_path}/pkg/user/MAINTAINERS
%{gopath}/src/%{import_path}/pkg/user/*.go
+%dir %{gopath}/src/%{import_path}/pkg/version
%{gopath}/src/%{import_path}/pkg/version/*.go
+%dir %{gopath}/src/%{import_path}/registry
%{gopath}/src/%{import_path}/registry/MAINTAINERS
%{gopath}/src/%{import_path}/registry/*.go
+%dir %{gopath}/src/%{import_path}/runconfig
%{gopath}/src/%{import_path}/runconfig/*.go
+%dir %{gopath}/src/%{import_path}/server
%{gopath}/src/%{import_path}/server/MAINTAINERS
%{gopath}/src/%{import_path}/server/*.go
+%dir %{gopath}/src/%{import_path}/sysinit
%{gopath}/src/%{import_path}/sysinit/README.md
%{gopath}/src/%{import_path}/sysinit/*.go
+%dir %{gopath}/src/%{import_path}/utils
+%dir %{gopath}/src/%{import_path}/utils/filters
%{gopath}/src/%{import_path}/utils/filters/*.go
%{gopath}/src/%{import_path}/utils/*.goupstream-patched-archive-tar
%{gopath}/src/%{import_path}/utils/*.go
+%dir %{gopath}/src/%{import_path}/utils/testdata
+%dir %{gopath}/src/%{import_path}/utils/testdata/46af0962ab5afeb5ce6740d4d91652e69206fc991fd5328c1a94d364ad00e457
%{gopath}/src/%{import_path}/utils/testdata/46af0962ab5afeb5ce6740d4d91652e69206fc991fd5328c1a94d364ad00e457/json
%{gopath}/src/%{import_path}/utils/testdata/46af0962ab5afeb5ce6740d4d91652e69206fc991fd5328c1a94d364ad00e457/layer.tar
+%dir %{gopath}/src/%{import_path}/utils/testdata/511136ea3c5a64f264b78b5433614aec563103b4d4702f3ba7d4d2698e22c158
%{gopath}/src/%{import_path}/utils/testdata/511136ea3c5a64f264b78b5433614aec563103b4d4702f3ba7d4d2698e22c158/json
%{gopath}/src/%{import_path}/utils/testdata/511136ea3c5a64f264b78b5433614aec563103b4d4702f3ba7d4d2698e22c158/layer.tar
%changelog
+* Wed Jul 23 2014 Lokesh Mandvekar <lsm5(a)fedoraproject.org> - 1.0.0-8
+- Resolves: rhbz#1119849
+- Resolves: rhbz#1119413 - min delta between upstream and packaged unitfiles
+- devel package owns directories it creates
+- ensure min NVRs used for systemd contain fixes RE: CVE-2014-3499
+
* Wed Jul 16 2014 Vincent Batts <vbatts(a)fedoraproject.org> - 1.0.0-7
- clean up gopath
- add Provides for docker libraries
diff --git a/docker.service b/docker.service
index e2aace1..bb1a64a 100644
--- a/docker.service
+++ b/docker.service
@@ -7,7 +7,7 @@ Requires=docker.socket
[Service]
Type=notify
EnvironmentFile=-/etc/sysconfig/docker
-ExecStart=/usr/bin/docker -d --selinux-enabled -H fd://
+ExecStart=/usr/bin/docker -d -H fd:// $OPTIONS
Restart=on-failure
LimitNOFILE=1048576
LimitNPROC=1048576
diff --git a/docker.sysconfig b/docker.sysconfig
index a2fd2af..e5f99cb 100644
--- a/docker.sysconfig
+++ b/docker.sysconfig
@@ -1 +1,2 @@
# /etc/sysconfig/docker
+OPTIONS=--selinux-enabled
9 years, 9 months
[Bug 1112700] New: docker container not started, bad file descriptor
by Red Hat Bugzilla
https://bugzilla.redhat.com/show_bug.cgi?id=1112700
Bug ID: 1112700
Summary: docker container not started, bad file descriptor
Product: Fedora
Version: 20
Component: docker-io
Assignee: lsm5(a)redhat.com
Reporter: ldoktor(a)redhat.com
QA Contact: extras-qa(a)fedoraproject.org
CC: admiller(a)redhat.com, golang(a)lists.fedoraproject.org,
hushan.jia(a)gmail.com, lsm5(a)redhat.com,
mattdm(a)redhat.com, mgoldman(a)redhat.com, s(a)shk.io,
vbatts(a)redhat.com
Created attachment 911745
--> https://bugzilla.redhat.com/attachment.cgi?id=911745&action=edit
/var/log/messages output
Description of problem:
Sometimes when I try to start container I get this message:
2014/06/24 13:39:34 finalize namespace drop bounding set read /proc/1/status:
bad file descriptor
and the container is not started.
Version-Release number of selected component (if applicable):
docker-io-1.0.0-1.fc20.x86_64
How reproducible:
rarely
Steps to Reproduce:
1. use `docker run ...` (in this example: `/usr/bin/docker -D run --interactive
--tty --name test_eHmi localhost:5000/ldoktor/fedora:latest bash -c bash`
Actual results:
Container is not started, message:
2014/06/24 13:39:34 finalize namespace drop bounding set read /proc/1/status:
bad file descriptor
is in the container output.
Expected results:
Container should start.
Additional info:
There were around 14 containers running and 2 not running when this bug
occurred. This bug happened to me 3 or 4 times during one week (testing docker,
so the failure percentage is really low).
--
You are receiving this mail because:
You are on the CC list for the bug.
9 years, 9 months