summaryrefslogtreecommitdiff
path: root/source/ap/lxc/get-lxc.sh
diff options
context:
space:
mode:
authorPatrick J Volkerding <volkerdi@slackware.com>2019-02-13 00:22:29 +0000
committerEric Hameleers <alien@slackware.com>2019-02-13 08:59:45 +0100
commit73d387f5699866c6d340e729855cccab9c82c602 (patch)
treedf5a20013c88ffa12ccb0015de2aaf4a13cad89a /source/ap/lxc/get-lxc.sh
parentf5a2fd8812fe66114bc7581c08a922acca70b0fa (diff)
downloadcurrent-73d387f5699866c6d340e729855cccab9c82c602.tar.gz
Wed Feb 13 00:22:29 UTC 201920190213002229
a/kernel-firmware-20190212_28f5f7d-noarch-1.txz: Upgraded. a/kernel-generic-4.19.21-x86_64-1.txz: Upgraded. a/kernel-huge-4.19.21-x86_64-1.txz: Upgraded. a/kernel-modules-4.19.21-x86_64-1.txz: Upgraded. ap/lxc-2.0.9_d3a03247-x86_64-1.txz: Upgraded. This update fixes a security issue where a malicious privileged container could overwrite the host binary and thus gain root-level code execution on the host. As the LXC project considers privileged containers to be unsafe no CVE has been assigned for this issue for LXC. To prevent this attack, LXC has been patched to create a temporary copy of the calling binary itself when it starts or attaches to containers. To do this LXC creates an anonymous, in-memory file using the memfd_create() system call and copies itself into the temporary in-memory file, which is then sealed to prevent further modifications. LXC then executes this sealed, in-memory file instead of the original on-disk binary. For more information, see: https://seclists.org/oss-sec/2019/q1/119 (* Security fix *) d/kernel-headers-4.19.21-x86-1.txz: Upgraded. k/kernel-source-4.19.21-noarch-1.txz: Upgraded. l/libbluray-1.1.0-x86_64-1.txz: Upgraded. l/libcap-2.26-x86_64-2.txz: Rebuilt. Don't ship static library. l/xapian-core-1.4.10-x86_64-1.txz: Upgraded. n/gnupg2-2.2.13-x86_64-1.txz: Upgraded. n/irssi-1.2.0-x86_64-1.txz: Upgraded. n/libassuan-2.5.3-x86_64-1.txz: Upgraded. x/bitmap-1.0.9-x86_64-1.txz: Upgraded. x/libXau-1.0.9-x86_64-1.txz: Upgraded. x/pixman-0.38.0-x86_64-1.txz: Upgraded. isolinux/initrd.img: Rebuilt. kernels/*: Upgraded. usb-and-pxe-installers/usbboot.img: Rebuilt.
Diffstat (limited to 'source/ap/lxc/get-lxc.sh')
-rwxr-xr-xsource/ap/lxc/get-lxc.sh51
1 files changed, 51 insertions, 0 deletions
diff --git a/source/ap/lxc/get-lxc.sh b/source/ap/lxc/get-lxc.sh
new file mode 100755
index 00000000..28f7321a
--- /dev/null
+++ b/source/ap/lxc/get-lxc.sh
@@ -0,0 +1,51 @@
+#!/bin/sh
+
+# Copyright 2019 Patrick J. Volkerding, Sebeka, Minnesota, USA
+# All rights reserved.
+#
+# Redistribution and use of this script, with or without modification, is
+# permitted provided that the following conditions are met:
+#
+# 1. Redistributions of this script must retain the above copyright
+# notice, this list of conditions and the following disclaimer.
+#
+# THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR IMPLIED
+# WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
+# MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO
+# EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+# PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS;
+# OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
+# WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
+# OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF
+# ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+# Pull a stable branch + patches
+BRANCH=${1:-stable-2.0}
+
+# Clear download area:
+rm -rf lxc
+
+# Clone repository:
+git clone git://github.com/lxc/lxc
+
+# checkout $BRANCH:
+( cd lxc
+ git checkout $BRANCH || exit 1
+)
+
+LXC_MAJOR=$(cd lxc && grep "^m4_define(\[lxc_version_major" configure.ac | cut -f 2 -d ' ' | tr -d ')')
+LXC_MINOR=$(cd lxc && grep "^m4_define(\[lxc_version_minor" configure.ac | cut -f 2 -d ' ' | tr -d ')')
+LXC_MICRO=$(cd lxc && grep "^m4_define(\[lxc_version_micro" configure.ac | cut -f 2 -d ' ' | tr -d ')')
+HEADISAT="$( cd lxc && git log -1 --format=%h )"
+DATE="$( cd lxc && git log -1 --format=%ad --date=format:%Y%m%d )"
+
+# Cleanup. We're not packing up the whole git repo.
+( cd lxc && find . -type d -name ".git*" -exec rm -rf {} \; 2> /dev/null )
+mv lxc lxc-${LXC_MAJOR}.${LXC_MINOR}.${LXC_MICRO}_${HEADISAT}
+tar cf lxc-${LXC_MAJOR}.${LXC_MINOR}.${LXC_MICRO}_${HEADISAT}.tar lxc-${LXC_MAJOR}.${LXC_MINOR}.${LXC_MICRO}_${HEADISAT}
+xz -9 -f lxc-${LXC_MAJOR}.${LXC_MINOR}.${LXC_MICRO}_${HEADISAT}.tar
+rm -rf lxc-${LXC_MAJOR}.${LXC_MINOR}.${LXC_MICRO}_${HEADISAT}
+echo
+echo "lxc branch $BRANCH with HEAD at $HEADISAT packaged as lxc-${LXC_MAJOR}.${LXC_MINOR}.${LXC_MICRO}_${HEADISAT}.tar.xz"
+echo