[Buildroot] [PATCH 5/5] package/runc: security bump version to 1.3.6

https://github.com/opencontainers/runc/releases/tag/v1.3.6

Fixes CVE-2026-41579.

Rebased patch due to upstream commits
https://github.com/opencontainers/runc/commit/a8e53f2c6d6d25cb3dd643cc514f118aab44b097
https://github.com/opencontainers/runc/commit/42cfcbe4533a094cbffd23d17dc355bbb25938a1

Signed-off-by: Bernd Kuhls <[email protected]>
---
Gitlab pipelines passed:
https://gitlab.com/bkuhls/buildroot/-/commits/99b74ab8c322d7aacf9b9bee370fc273a0dc7fa5

 ...ror-checking-functions-with-their-er.patch | 31 ++-----------------
 package/runc/runc.hash                        |  2 +-
 package/runc/runc.mk                          |  2 +-
 3 files changed, 5 insertions(+), 30 deletions(-)

diff --git a/package/runc/0001-Replace-os.Is-error-checking-functions-with-their-er.patch b/package/runc/0001-Replace-os.Is-error-checking-functions-with-their-er.patch
index 4e103099f9..6664b62191 100644
--- a/package/runc/0001-Replace-os.Is-error-checking-functions-with-their-er.patch
+++ b/package/runc/0001-Replace-os.Is-error-checking-functions-with-their-er.patch
@@ -35,6 +35,8 @@ Conflicts:
   libcontainer/container_linux.go
   libcontainer/intelrdt/intelrdt.go
 Signed-off-by: Romain Naour <[email protected]>
+[Bernd: rebased for version 1.3.6]
+Signed-off-by: Bernd Kuhls <[email protected]>
 ---
  libcontainer/configs/validate/validator.go      |  6 +++---
  libcontainer/configs/validate/validator_test.go |  7 ++++---
@@ -286,16 +288,7 @@ diff --git a/libcontainer/rootfs_linux.go b/libcontainer/rootfs_linux.go
 index 31d05174..abc372f3 100644
 --- a/libcontainer/rootfs_linux.go
 +++ b/libcontainer/rootfs_linux.go
-@@ -361,7 +361,7 @@ func mountCgroupV1(m mountEntry, c *mountConfig) error {
- 			// symlink(2) is very dumb, it will just shove the path into
- 			// the link and doesn't do any checks or relative path
- 			// conversion. Also, don't error out if the cgroup already exists.
--			if err := os.Symlink(mc, filepath.Join(c.root, m.Destination, ss)); err != nil && !os.IsExist(err) {
-+			if err := os.Symlink(mc, filepath.Join(c.root, m.Destination, ss)); err != nil && !errors.Is(err, os.ErrExist) {
- 				return err
- 			}
- 		}
-@@ -613,7 +613,7 @@ func mountToRootfs(c *mountConfig, m mountEntry) error {
+@@ -625,7 +625,7 @@ func mountToRootfs(c *mountConfig, m mountEntry) error {
  			return err
  		}
  		if fi, err := os.Lstat(dest); err != nil {
@@ -304,24 +297,6 @@ index 31d05174..abc372f3 100644
  				return err
  			}
  		} else if !fi.IsDir() {
-@@ -910,7 +910,7 @@ func setupDevSymlinks(rootfs string) error {
- 			src = link[0]
- 			dst = filepath.Join(rootfs, link[1])
- 		)
--		if err := os.Symlink(src, dst); err != nil && !os.IsExist(err) {
-+		if err := os.Symlink(src, dst); err != nil && !errors.Is(err, os.ErrExist) {
- 			return err
- 		}
- 	}
-@@ -1132,7 +1132,7 @@ func setReadonly() error {
- 
- func setupPtmx(config *configs.Config) error {
- 	ptmx := filepath.Join(config.Rootfs, "dev/ptmx")
--	if err := os.Remove(ptmx); err != nil && !os.IsNotExist(err) {
-+	if err := os.Remove(ptmx); err != nil && !errors.Is(err, os.ErrNotExist) {
- 		return err
- 	}
- 	if err := os.Symlink("pts/ptmx", ptmx); err != nil {
 diff --git a/libcontainer/specconv/spec_linux_test.go b/libcontainer/specconv/spec_linux_test.go
 index 66359f79..88156516 100644
 --- a/libcontainer/specconv/spec_linux_test.go
diff --git a/package/runc/runc.hash b/package/runc/runc.hash
index d3132b1008..67511d2939 100644
--- a/package/runc/runc.hash
+++ b/package/runc/runc.hash
@@ -1,3 +1,3 @@
 # Locally computed
-sha256  72620f9b0e62d8da80c0c08a6265ab10d24330c544115c30713ba1429bde706d  runc-1.3.5-go2.tar.gz
+sha256  8816e8d4181d13012d16733e837425f5f67df57dfac28bc58a68f7dfcd54291b  runc-1.3.6-go2.tar.gz
 sha256  552a739c3b25792263f731542238b92f6f8d07e9a488eae27e6c4690038a8243  LICENSE
diff --git a/package/runc/runc.mk b/package/runc/runc.mk
index 10ff98c9d7..e0c93baeb9 100644
--- a/package/runc/runc.mk
+++ b/package/runc/runc.mk
@@ -4,7 +4,7 @@
 #
 ################################################################################
 
-RUNC_VERSION = 1.3.5
+RUNC_VERSION = 1.3.6
 RUNC_SITE = $(call github,opencontainers,runc,v$(RUNC_VERSION))
 RUNC_LICENSE = Apache-2.0, LGPL-2.1 (libseccomp)
 RUNC_LICENSE_FILES = LICENSE
-- 
2.47.3

_______________________________________________
buildroot mailing list
[email protected]
https://lists.buildroot.org/mailman/listinfo/buildroot