Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

singularity: 2.5.1 -> 2.5.2 #43157

Merged
merged 1 commit into from Jul 12, 2018
Merged

singularity: 2.5.1 -> 2.5.2 #43157

merged 1 commit into from Jul 12, 2018

Conversation

r-ryantm
Copy link
Contributor

@r-ryantm r-ryantm commented Jul 7, 2018

Semi-automatic update generated by https://github.com/ryantm/nixpkgs-update tools.

This update was made based on information from https://repology.org/metapackage/singularity/versions.

Version release notes (from GitHub) Greetings Singularity containerizers!

This release contains fixes for a high severity security issue affecting Singularity 2.3.0 through 2.5.1 on kernels that support overlay file systems (CVE-2018-12021). A malicious user with network access to the host system (e.g. ssh) could exploit this vulnerability to access sensitive information on disk and bypass directory image restrictions like those preventing the root file system from being mounted into the container.

Singularity 2.5.2 should be installed immediately, and all previous versions of Singularity should be removed. The vulnerability addressed in this release affects kernels that support overlayfs. If you are unable to upgrade immediately, you should set enable overlay = no in singularity.conf.

In addition, this release contains a large number of bug fixes. Details follow:

Security related fixes

  • Removed the option to use overlay images with singularity mount. This
    flaw could allow a malicious user accessing the host system to access
    sensitive information when coupled with persistent ext3 overlay.
  • Fixed a race condition that might allow a malicious user to bypass directory
    image restrictions, like mounting the host root filesystem as a container
    image

Bug fixes

As always, please report any bugs to:
https://github.com/singularityware/singularity/issues/new

These checks were done:

  • built on NixOS
  • /nix/store/3igwiqi311c18w13y5r7zrgpcnzylg9l-singularity-2.5.2/bin/singularity passed the binary check.
  • Warning: no invocation of /nix/store/3igwiqi311c18w13y5r7zrgpcnzylg9l-singularity-2.5.2/bin/run-singularity had a zero exit code or showed the expected version
  • 1 of 2 passed binary check by having a zero exit code.
  • 0 of 2 passed binary check by having the new version present in output.
  • found 2.5.2 with grep in /nix/store/3igwiqi311c18w13y5r7zrgpcnzylg9l-singularity-2.5.2
  • directory tree listing: https://gist.github.com/ed6db09ad43a19c6abf2d35d15ef489c
  • du listing: https://gist.github.com/9bd23f4d6ee86a9eb2ba7ec5c986741d

meta.description for singularity is: '"Designed around the notion of extreme mobility of compute and reproducible science, Singularity enables users to have full control of their operating system environment"'.

cc @jbedo for testing.

This build is cached with Cachix. To use the cache follow these instructions:

One time setup in nixpkgs Git checkout:

cachix use r-ryantm
git remote add r-ryantm https://github.com/r-ryantm/nixpkgs.git

Test this build:

git fetch r-ryantm && git checkout 4bb61a3ba43bb589b6a60893af7db51ca3984c64 && nix-shell --pure -I nixpkgs=. -p singularity

singularity: 2.5.1 -> 2.5.2
4bb61a3 
Semi-automatic update generated by https://github.com/ryantm/nixpkgs-update tools.

This update was made based on information from https://repology.org/metapackage/singularity/versions.

<details><summary>Version release notes (from GitHub)</summary>
Greetings Singularity containerizers!

This release contains fixes for a _high severity_ security issue affecting Singularity 2.3.0 through 2.5.1 on kernels that support overlay file systems (CVE-2018-12021). A malicious user with network access to the host system (e.g. ssh) could exploit this vulnerability to access sensitive information on disk and bypass directory image restrictions like those preventing the root file system from being mounted into the container.

Singularity 2.5.2 should be installed immediately, and all previous versions of Singularity should be removed. The vulnerability addressed in this release affects kernels that support overlayfs. If you are unable to upgrade immediately, you should set `enable overlay = no` in `singularity.conf`.

In addition, this release contains a large number of bug fixes.  Details follow:

## [Security related fixes](https://cve.mitre.org/cgi-bin/cvename.cgi?name=2018-12021)
 - Removed the option to use overlay images with `singularity mount`.  This
   flaw could allow a malicious user accessing the host system to access
   sensitive information when coupled with persistent ext3 overlay.
 - Fixed a race condition that might allow a malicious user to bypass directory
   image restrictions, like mounting the host root filesystem as a container
   image

## Bug fixes
 - Fix an error in malloc allocation NixOS#1620
 - Honor debug flag when pulling from docker hub NixOS#1556
 - Fix a bug with passwd abort NixOS#1580
 - Allow user to override singularity.conf "mount home = no" with --home option
   NixOS#1496
 - Improve debugging output NixOS#1535
 - Fix some bugs in bind mounting NixOS#1525
 - Define PR_(S|G)ET_NO_NEW_PRIVS in user space so that these features will
   work with kernels that implement them (like Cray systems) NixOS#1506
 - Create /dev/fd and standard streams symlinks in /dev when using minimal dev
   mount or when specifying -c/-C/--contain option NixOS#1420
 - Fixed * expansion during app runscript creation NixOS#1486

As always, please report any bugs to:
https://github.com/singularityware/singularity/issues/new</details>

These checks were done:

- built on NixOS
- /nix/store/3igwiqi311c18w13y5r7zrgpcnzylg9l-singularity-2.5.2/bin/singularity passed the binary check.
- Warning: no invocation of /nix/store/3igwiqi311c18w13y5r7zrgpcnzylg9l-singularity-2.5.2/bin/run-singularity had a zero exit code or showed the expected version
- 1 of 2 passed binary check by having a zero exit code.
- 0 of 2 passed binary check by having the new version present in output.
- found 2.5.2 with grep in /nix/store/3igwiqi311c18w13y5r7zrgpcnzylg9l-singularity-2.5.2
- directory tree listing: https://gist.github.com/ed6db09ad43a19c6abf2d35d15ef489c
- du listing: https://gist.github.com/9bd23f4d6ee86a9eb2ba7ec5c986741d
@GrahamcOfBorg
Copy link

No attempt on x86_64-darwin (full log)

The following builds were skipped because they don't evaluate on x86_64-darwin: singularity

Partial log (click to expand)


a) For `nixos-rebuild` you can set
  { nixpkgs.config.allowUnsupportedSystem = true; }
in configuration.nix to override this.

b) For `nix-env`, `nix-build`, `nix-shell` or any other Nix command you can add
  { allowUnsupportedSystem = true; }
to ~/.config/nixpkgs/config.nix.

@GrahamcOfBorg
Copy link

Success on x86_64-linux (full log)

Attempted: singularity

Partial log (click to expand)

/nix/store/3igwiqi311c18w13y5r7zrgpcnzylg9l-singularity-2.5.2/libexec/singularity/handlers/archive-cpio.sh: interpreter directive changed from "/bin/bash" to "/nix/store/8zkg9ac4s4alzyf4a8kfrig1j73z66dw-bash-4.4-p23/bin/bash"
/nix/store/3igwiqi311c18w13y5r7zrgpcnzylg9l-singularity-2.5.2/libexec/singularity/handlers/image-http.sh: interpreter directive changed from "/bin/bash" to "/nix/store/8zkg9ac4s4alzyf4a8kfrig1j73z66dw-bash-4.4-p23/bin/bash"
/nix/store/3igwiqi311c18w13y5r7zrgpcnzylg9l-singularity-2.5.2/libexec/singularity/handlers/archive-tar.sh: interpreter directive changed from "/bin/bash" to "/nix/store/8zkg9ac4s4alzyf4a8kfrig1j73z66dw-bash-4.4-p23/bin/bash"
/nix/store/3igwiqi311c18w13y5r7zrgpcnzylg9l-singularity-2.5.2/libexec/singularity/helpers/image.sh: interpreter directive changed from "/bin/bash" to "/nix/store/8zkg9ac4s4alzyf4a8kfrig1j73z66dw-bash-4.4-p23/bin/bash"
/nix/store/3igwiqi311c18w13y5r7zrgpcnzylg9l-singularity-2.5.2/libexec/singularity/helpers/apps/list.sh: interpreter directive changed from "/bin/bash" to "/nix/store/8zkg9ac4s4alzyf4a8kfrig1j73z66dw-bash-4.4-p23/bin/bash"
/nix/store/3igwiqi311c18w13y5r7zrgpcnzylg9l-singularity-2.5.2/libexec/singularity/helpers/help.sh: interpreter directive changed from "/bin/bash" to "/nix/store/8zkg9ac4s4alzyf4a8kfrig1j73z66dw-bash-4.4-p23/bin/bash"
/nix/store/3igwiqi311c18w13y5r7zrgpcnzylg9l-singularity-2.5.2/libexec/singularity/helpers/check.sh: interpreter directive changed from "/bin/bash" to "/nix/store/8zkg9ac4s4alzyf4a8kfrig1j73z66dw-bash-4.4-p23/bin/bash"
/nix/store/3igwiqi311c18w13y5r7zrgpcnzylg9l-singularity-2.5.2/libexec/singularity/helpers/inspect.sh: interpreter directive changed from "/bin/bash" to "/nix/store/8zkg9ac4s4alzyf4a8kfrig1j73z66dw-bash-4.4-p23/bin/bash"
/nix/store/3igwiqi311c18w13y5r7zrgpcnzylg9l-singularity-2.5.2/bin/run-singularity: interpreter directive changed from "/bin/sh" to "/nix/store/8zkg9ac4s4alzyf4a8kfrig1j73z66dw-bash-4.4-p23/bin/sh"
/nix/store/3igwiqi311c18w13y5r7zrgpcnzylg9l-singularity-2.5.2/bin/singularity: interpreter directive changed from "/bin/bash" to "/nix/store/8zkg9ac4s4alzyf4a8kfrig1j73z66dw-bash-4.4-p23/bin/bash"

@GrahamcOfBorg
Copy link

Success on aarch64-linux (full log)

Attempted: singularity

Partial log (click to expand)

/nix/store/ywwf1d990xhybfyk2affc8a8zi3dlgp6-singularity-2.5.2/libexec/singularity/bootstrap-scripts/deffile-driver-localimage.sh: interpreter directive changed from "/bin/bash" to "/nix/store/p0vy17dp9jk2mvqsxsqnb14s3797lay7-bash-4.4-p23/bin/bash"
/nix/store/ywwf1d990xhybfyk2affc8a8zi3dlgp6-singularity-2.5.2/libexec/singularity/bootstrap-scripts/deffile-driver-docker.sh: interpreter directive changed from "/bin/bash" to "/nix/store/p0vy17dp9jk2mvqsxsqnb14s3797lay7-bash-4.4-p23/bin/bash"
/nix/store/ywwf1d990xhybfyk2affc8a8zi3dlgp6-singularity-2.5.2/libexec/singularity/bootstrap-scripts/deffile-driver-debootstrap.sh: interpreter directive changed from "/bin/bash" to "/nix/store/p0vy17dp9jk2mvqsxsqnb14s3797lay7-bash-4.4-p23/bin/bash"
/nix/store/ywwf1d990xhybfyk2affc8a8zi3dlgp6-singularity-2.5.2/libexec/singularity/bootstrap-scripts/deffile-driver-busybox.sh: interpreter directive changed from "/bin/bash" to "/nix/store/p0vy17dp9jk2mvqsxsqnb14s3797lay7-bash-4.4-p23/bin/bash"
/nix/store/ywwf1d990xhybfyk2affc8a8zi3dlgp6-singularity-2.5.2/libexec/singularity/bootstrap-scripts/deffile-driver-arch.sh: interpreter directive changed from "/bin/bash" to "/nix/store/p0vy17dp9jk2mvqsxsqnb14s3797lay7-bash-4.4-p23/bin/bash"
/nix/store/ywwf1d990xhybfyk2affc8a8zi3dlgp6-singularity-2.5.2/libexec/singularity/bootstrap-scripts/checks.sh: interpreter directive changed from "/bin/bash" to "/nix/store/p0vy17dp9jk2mvqsxsqnb14s3797lay7-bash-4.4-p23/bin/bash"
/nix/store/ywwf1d990xhybfyk2affc8a8zi3dlgp6-singularity-2.5.2/libexec/singularity/bootstrap-scripts/functions: interpreter directive changed from "/bin/bash" to "/nix/store/p0vy17dp9jk2mvqsxsqnb14s3797lay7-bash-4.4-p23/bin/bash"
/nix/store/ywwf1d990xhybfyk2affc8a8zi3dlgp6-singularity-2.5.2/bin/run-singularity: interpreter directive changed from "/bin/sh" to "/nix/store/p0vy17dp9jk2mvqsxsqnb14s3797lay7-bash-4.4-p23/bin/sh"
/nix/store/ywwf1d990xhybfyk2affc8a8zi3dlgp6-singularity-2.5.2/bin/singularity: interpreter directive changed from "/bin/bash" to "/nix/store/p0vy17dp9jk2mvqsxsqnb14s3797lay7-bash-4.4-p23/bin/bash"
/nix/store/ywwf1d990xhybfyk2affc8a8zi3dlgp6-singularity-2.5.2

@FRidh FRidh merged commit 0d49968 into NixOS:master Jul 12, 2018
@r-ryantm r-ryantm deleted the auto-update/singularity branch July 12, 2018 12:37
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
10.rebuild-darwin: 0 10.rebuild-linux: 1-10
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

None yet
3 participants
@r-ryantm @GrahamcOfBorg @FRidh