mirror of
https://github.com/linuxkit/linuxkit.git
synced 2026-01-18 21:31:50 +00:00
998eaa7dad
Go commit https://github.com/golang/go/issues/23672 introduced a whitelist ofr flags passed into gcc to prevent arbitrary code execution (CVE-2018-6574). The x86 rngd code uses two CFLAGS not on the whitelist. Add them to 'CGO_CFLAGS_ALLOW'. Signed-off-by: Rolf Neugebauer <rolf.neugebauer@gmail.com>
19 lines
565 B
Docker
19 lines
565 B
Docker
FROM linuxkit/alpine:96ad1eb5ec262b4cd0eef574cdc0b225b502d9ee AS mirror
|
|
|
|
RUN apk add --no-cache go gcc musl-dev linux-headers
|
|
ENV GOPATH=/go PATH=$PATH:/go/bin
|
|
|
|
# see https://github.com/golang/go/issues/23672
|
|
ENV CGO_CFLAGS_ALLOW=(-mrdrnd|-mrdseed)
|
|
|
|
COPY cmd/rngd/ /go/src/rngd/
|
|
RUN REQUIRE_CGO=1 go-compile.sh /go/src/rngd
|
|
|
|
FROM scratch
|
|
ENTRYPOINT []
|
|
CMD []
|
|
WORKDIR /
|
|
COPY --from=mirror /go/bin/rngd /sbin/rngd
|
|
CMD ["/sbin/rngd"]
|
|
LABEL org.mobyproject.config='{"capabilities": ["CAP_SYS_ADMIN"], "oomScoreAdj": -800, "readonly": true, "net": "new", "ipc": "new"}'
|