Switch from encrypted AWS credentials to OIDC authentication
for Cirrus CI AWS EC2 instances (aarch64 builds).
(cherry picked from commit 64a3e31ab9)
Signed-off-by: Tim Zhou <tizhou@redhat.com>
On very slow systems it can be that it takes over 5s after the sleep
process was started and until the find_exec_pid_files function finds the
file. This was observed on a ppc64le machine by Red Hat QE.
Just making the sleep longer should fix that problem and it doesn't
really effect the total test time because we stop the container
afterwards so there is no extra delay added with this either.
Fixes: https://issues.redhat.com/browse/RHEL-145596
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
(cherry picked from commit 39750faab3)
Signed-off-by: Tom Sweeney <tomsweney@redhat.com>
The code checks for isPathOnVolume and isPathOnMount so we can just use
the SecureJoin here directly to check for path existance.
Then instead of walking symlinks and trying to guess if they are on a
mount just assume if it is a link (path is different from the normal
joined one) then don't error out early and let the OCI runtime deal with
it. The runtime does produce a less readable error but it still fails
and we have much less fragile code.
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
(cherry picked from commit d18e44e9ab)
Signed-off-by: tomsweeneyredhat <tsweeney@redhat.com>
MkdirAll can fail with EEXIST when the path is a symlink and the target
doesn't exist. As such we should ignore the error.
Note there is something fundemantal wrong here with the path access as
it is following the symlink to the host, however it is only for a
stat() so it is not an security issue here.
Fixes: 637c264e2e ("fix issues found by nilness")
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
(cherry picked from commit 7b1be7f177)
Signed-off-by: tomsweeneyredhat <tsweeney@redhat.com>
There doesn't seem any reason why the system commands should not join
the userns. In particular the main commands use ParentNSRequired and
UnshareNSRequired when they don't want to be joined to the main userns.
Since the system command don't set these the go code does the join and
re-exec anyway so might as well use the shortcut to speed that up.
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
Signed-off-by: tomsweeneyredhat <tsweeney@redhat.com>
When trying to join the conmon pid to recreate the pause process based
on the namespace it can be that the pid is no longer valid, i.e. when
conmon crashed or was killed.
Currently we have a big issue that can be reproduced using:
$ podman run -d quay.io/libpod/testimage:20241011 sleep 100
$ killall -9 conmon
$ killall catatonit
All commands would fail as we keep trying to rejoin the namespace of the
non existing conmon process.
So to address that fall back to creating a new namespace if we fail to
join the conmon pids.
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
Signed-off-by: tomsweeneyredhat <tsweeney@redhat.com>
Just a minor improvement as we know the size needed for the slice we can
allocate it only once instead of the append having to resize it.
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
Signed-off-by: tomsweeneyredhat <tsweeney@redhat.com>
Based on the description in commit 63ef557 this was added so that the
migrate command does not move the pause process into a separate cgroup.
It should however not disable the rejoining of the userns when the pause
process join failed. BEcause of this we end up calling migrate without a
userns and that then can fail if there are actual contianer it tries to
cleanup.
Fixes: 63ef5576ed ("command: migrate doesn't move process to cgroup")
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
Signed-off-by: tomsweeneyredhat <tsweeney@redhat.com>
There is no good reason to use logrus and os.Exit() here, other parts of
this function already return the error so do the same. The main podman
process will exit then with the normal formatted error message.
And also log an error about the last return which should never happen as
we should have exited above if the re-exec worked or errored out.
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
Signed-off-by: tomsweeneyredhat <tsweeney@redhat.com>
We do not use that package that we install for the test anyway and doing
this networking connection is causing heavy flakes at the moment.
Fixes: https://issues.redhat.com/browse/RHEL-138650
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
Signed-off-by: Yiqiao Pu <ypu@redhat.com>
With the bump in Go, a systemd test started squawking about
a lint error. I took the quick way out and squished the error.
Signed-off-by: tomsweeneyredhat <tsweeney@redhat.com>
Starting with runc 1.3.0 it errors when we pass unknown mount options to
the runtime, the copy/nocopy options are specific to podman when we
mount the volume and are not valid mount options for the runtime.
Fixes: #26938
Fixes: https://issues.redhat.com/browse/RHEL-132532,
https://issues.redhat.com/browse/RHEL-132531
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
Signed-off-by: tomsweeneyredhat <tsweeney@redhat.com>
Starting with runc 1.3.0 it errors when we pass unknown mount options to
the runtime, the volume-opt options are specifc to the volume we create
and should not be passed to the mount in the oci spec.
Fixes: #26938
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
Signed-off-by: tomsweeneyredhat <tsweeney@redhat.com>
The old location is deprecated and has been removed in v0.6.0 even. I
did this as extra commit to make cherry-picking easier.
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
Bump runc to v1.3.3 to address CVE-2025-52881
Also fixes CVE-2025-31133 and CVE-2025-52565
Fixes: https://issues.redhat.com/browse/RHEL-126635
Signed-off-by: tomsweeneyredhat <tsweeney@redhat.com>
As discussed at the cabal October 8, 2024 we have no need for these
tests on RHEL branches.
See commit 0ed2c91 for more details.
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
For ConfigMap and Secret kube play volumes podman populates the data
from the yaml. However the volume content is not controlled by us and we
can be tricked following a symlink to a file on the host instead.
Fixes: CVE-2025-9566
Fixes: https://issues.redhat.com/browse/RHEL-113140, https://issues.redhat.com/browse/RHEL-113151
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
Signed-off-by: tomsweeneyredhat <tsweeney@redhat.com>
In the journald driver there is a bug where the network event
attributes are not preserved. This causes the network driver to be
missing and that in turn causes the ToHumanReadable() function to print
an empty line. Fix it by making sure we preserve the network driver in
the event attributes.
Fixes: https://issues.redhat.com/browse/RHEL-109790
Cherry Pick Fixes: https://issues.redhat.com/browse/RHEL-110317,
https://issues.redhat.com/browse/RHEL-110318
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
Signed-off-by: tomsweeneyredhat <tsweeney@redhat.com>
Bump Buildah to v1.41.3 in preparation for Podman v5.6.0. This vendoring also
cures a last minute issue in the Buildah build code.
Signed-off-by: tomsweeneyredhat <tsweeney@redhat.com>
An issue was found late in Podman v5.6 RC2 and it was reported
in #26773. The failing test was changed so that it was skipped.
This commit renables that test as the fix should be contained
in Buildah 1.41.3.
Signed-off-by: tomsweeneyredhat <tsweeney@redhat.com>
Right now, only log-level=info, so not shown by default. We can
continue to up this in subsequent releases to convince folks of
the urgency of switching.
Resolves https://issues.redhat.com/browse/RUN-3343
Signed-off-by: Matt Heon <mheon@redhat.com>
