fix(deps): update module github.com/opencontainers/runc to v1.2.0 (main)

[cilium-renovate]

This PR contains the following updates:

Package	Type	Update	Change
github.com/opencontainers/runc	require	minor	v1.1.15 -> v1.2.0

---

Release Notes

opencontainers/runc (github.com/opencontainers/runc)

v1.2.0: runc v1.2.0 -- "できるときにできることをやるんだ。それが今だ。"

Compare Source

This is the long-awaited release of runc 1.2.0! The primary changes from rc3
are general improvements and fixes for minor regressions related to the
new /proc/self/exe cloning logic in runc 1.2, follow-on patches related
to CVE-2024-45310, as well as some other minor changes.

• In order to alleviate the remaining concerns around the memory usage and
  (arguably somewhat unimportant, but measurable) performance overhead of
  memfds for cloning /proc/self/exe, we have added a new protection using
  overlayfs that is used if you have enough privileges and the running
  kernel supports it. It has effectively no performance nor memory overhead
  (compared to no cloning at all). (#​4448)
• The original fix for CVE-2024-45310 was intentionally very
  limited in scope to make it easier to review, however it also did not handle
  all possible os.MkdirAll cases and thus could lead to regressions. We have
  switched to the more complete implementation in the newer versions of
  github.com/cyphar/filepath-securejoin. (#​4393, #​4400, #​4421, #​4430)
• In certain situations (a system with lots of mounts or racing mounts) we
  could accidentally end up leaking mounts from the container into the host.
  This has been fixed. (#​4417)
• The fallback logic for O_TMPFILE clones of /proc/self/exe had a minor
  bug that would cause us to miss non-noexec directories and thus fail to
  start containers on some systems. (#​4444)
• Sometimes the cloned /proc/self/exe file descriptor could be placed in a
  way that it would get clobbered by the Go runtime. We had a fix for this
  already but it turns out it could still break in rare circumstances, but it
  has now been fixed. (#​4294, #​4452)
• It is not possible for runc kill to work properly in some specific
  configurations (such as rootless containers with no cgroups and a shared pid
  namespace). We now output a warning for such configurations. (#​4398)
• memfd-bind: update the documentation and make path handling with the systemd
  unit more idiomatic. (#​4428)
• We now use v0.16 of Cilium's eBPF library, including fixes that quite a few
  downstreams asked for. (#​4397, #​4396)
• Some internal runc init synchronisation that was no longer necessary (due
  to the /proc/self/exe cloning move to Go) was removed. (#​4441)

Static Linking Notices

The runc binary distributed with this release are statically linked with
the following GNU LGPL-2.1 licensed libraries, with runc acting
as a "work that uses the Library":

• libseccomp

The versions of these libraries were not modified from their upstream versions,
but in order to comply with the LGPL-2.1 (§6(a)), we have attached the
complete source code for those libraries which (when combined with the attached
runc source code) may be used to exercise your rights under the LGPL-2.1.

However we strongly suggest that you make use of your distribution's packages
or download them from the authoritative upstream sources, especially since
these libraries are related to the security of your containers.

---

Thanks to all of the contributors who made this release possible:

• Akhil Mohan [email protected]
• Akihiro Suda [email protected]
• Aleksa Sarai [email protected]
• Amir M. Ghazanfari <a.m.ghazanfari76@​gmail.com>
• Kir Kolyshkin [email protected]
• Rafael Roquetto [email protected]
• Rodrigo Campos [email protected]
• Sebastiaan van Stijn [email protected]
• Stavros Panakakis [email protected]
• lifubang [email protected]

Signed-off-by: Aleksa Sarai [email protected]

---

Configuration

📅 Schedule: Branch creation - "on monday and friday" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Renovate Bot.

[cilium-renovate]

ℹ Artifact update notice

File name: contrib/tetragon-rthooks/go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

• 1 additional dependency was updated

Details:

Package	Change
github.com/cyphar/filepath-securejoin	v0.3.1 -> v0.3.4