Code

nsexec: cloned binary rework#3987

Code

Merged

AkihiroSuda merged 8 commits intoopencontainers:mainopencontainers/runc:mainfrom cyphar:cloned-binary-reworkCopy head branch name to clipboardSep 24, 2023

+1,431-664

Commits

Commits on Sep 22, 2023

• scripts: add proper 386 and amd64 target triples and builds

  Show description for 321aa20
  cyphar

  committed
  321aa20

• nsexec: migrate memfd /proc/self/exe logic to Go code

  Show description for 0e9a335
  cyphar

  committed
  0e9a335

• dmz: add fallbacks to handle noexec for O_TMPFILE and mktemp()

  Show description for e089db3
  cyphar

  committed
  e089db3

• runc-dmz: reduce memfd binary cloning cost with small C binary

  Show description for dac4171
  

  lifubang

  and

  cyphar

  committed
  dac4171

• contrib: memfd-bind: add helper for memfd-sealed-bind trick

  Show description for b9a4727
  cyphar

  committed
  b9a4727

• tests: integration: fix capability setting for CAP_DAC_OVERRIDE

  Show description for 6be763e
  cyphar

  committed
  6be763e

• tests: integration: add runc-dmz smoke tests

  Show description for f8348f6
  cyphar

  committed
  f8348f6

• dmz: use sendfile(2) when cloning /proc/self/exe

  Show description for 90c8d36
  cyphar

  committed
  90c8d36