[3.2.3-rhel] seccomp: propagate defaultErrnoRet

[kolyshkin]

(same as #11033 but for v3.2.3-rhel branch)

This fixes the issue of not propagating defaultErrnoRet from
system's seccomp.json to container's config.json, which can
result in redundant seccomp rules and inability to start a container
when using some runtimes (notably runc up to and including 1.0.1).

The fix is to vendor in containers/common with the fixed pkg/seccomp
which no longer ignores defaultErrnoRet.

Fixes: #11031
Fixes: bugzilla.redhat.com/1987049

Proposed changelog entry

Bugfixes:
 * Fixed a bug of ignoring the `defaultErrnoRet` field in system's seccomp.json,
   which may cause an "error adding seccomp filter rule for syscall" error
   and a failure to start a container when using `--runtime=runc` (#11031).

[mheon]

Do we have a new-enough c/common in 8.4.0.2 to require this? If so, I think we definitely need a BZ spun up to get this landed.

…

On Sun, Jul 25, 2021 at 7:01 AM openshift-ci[bot] ***@***.***> wrote: [APPROVALNOTIFIER] This PR is *NOT APPROVED* This pull-request has been approved by: *kolyshkin <#11039#>* To complete the pull request process <https://git.k8s.io/community/contributors/guide/owners.md#the-code-review-process>, please assign *jwhonce* after the PR has been reviewed. You can assign the PR to them by writing /assign @jwhonce in a comment when ready. The full list of commands accepted by this bot can be found here <https://go.k8s.io/bot-commands?repo=containers%2Fpodman>. Needs approval from an approver in each of these files: - *OWNERS <https://github.com/containers/podman/blob/v3.2.3-rhel/OWNERS>* Approvers can indicate their approval by writing /approve in a comment Approvers can cancel approval by writing /approve cancel in a comment — You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub <#11039 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AB3AOCATKS3ORIAZ3MZ77KTTZPVJDANCNFSM5A6NVI6A> .

[kolyshkin]

Do we have a new-enough c/common in 8.4.0.2 to require this? If so, I think
we definitely need a BZ spun up to get this landed.

I assume we don't. As long as the vendored version is used for building podman in rhel (which I believe is how things are), we do not care about what version of containers-common rpm is installed.

[vrothberg]

Yes, we need a BZ to merge any PR into the -rhel branch (also to start rebuilding packages). @kolyshkin, would you open one?

/hold

[kolyshkin]

Yes, we need a BZ to merge any PR into the -rhel branch (also to start rebuilding packages). @kolyshkin, would you open one?

Done, please see bugzilla.redhat.com/1987049

Description updated.

[vrothberg]

/lgtm

Let's wait for an ACK in the BZ before merge. Thank you, Kir!

[rhatdan]

/approve

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: kolyshkin, rhatdan

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [rhatdan]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[rhatdan]

/hold cancel
Looks like we have acks.