app-emulation/runc: bring back p9 for docker 1.12

sdk_container/src/third_party/coreos-overlay/app-emulation/runc/Manifest

@@ -1 +1,2 @@
 DIST runc-1.0.0_rc2_p133.tar.gz 560793 SHA256 11f69923a786efb82b65d9f1eec0ac665a985e631a67f3f4d466dac720efacdd SHA512 8c19a02a55108cef36cbd1ff739a3c8e2962d188c426517fce91483ec525546d39c14072f0a0f2471b6b70a05cf6c1f0e99cfeb5e87203fcbae955bd5f5bd16b WHIRLPOOL 8a1f44234c668aca5c53e401ce80e2c297ad9c7ed0b10d782494e93020f824e6d5e3a00be221f1ff5d039df998c43556228503788181a45256d91278dd005721
+DIST runc-1.0.0_rc2_p9.tar.gz 550963 SHA256 374822cc2895ed3899b7a3a03b566413ea782fccec1307231f27894e9c6d5bea SHA512 0176fc0fd69b298b5cb304388544a45b3805154f635c4a7492daac6e33774b16ad76af2b3008205de169306812834f4299106c89a17b1667168f3ad2ddc2e975 WHIRLPOOL 5015352fe7dc9ddedf93d555cf2750b3e9d72adfda534b1e30a69ac8b6b05e73bfbbe0ba72f543be4e3133f1604a5b42acc3363d30187a75861ca42755dfff81

sdk_container/src/third_party/coreos-overlay/app-emulation/runc/files/0002-Dont-set-label-for-mqueue-under-userns.patch

@@ -0,0 +1,94 @@
+From 3ce50afe04f102cf28dbb6425773011707bf3ae0 Mon Sep 17 00:00:00 2001
+From: Mrunal Patel <mrunalp@gmail.com>
+Date: Wed, 12 Oct 2016 16:46:59 -0700
+Subject: [PATCH] Fix setting SELinux label for mqueue when user namespaces are
+ enabled
+
+If one tries to user SELinux with user namespaces, then labeling of /dev/mqueue
+fails because the IPC namespace belongs to the root in init_user_ns. This
+commit fixes that by unsharing IPC namespace after we clone into a new USER
+namespace so the IPC namespace is owned by the root inside the new USER
+namespace as opposed to init_user_ns.
+
+Signed-off-by: Mrunal Patel <mrunalp@gmail.com>
+---
+ libcontainer/nsenter/nsexec.c | 25 ++++++++++++++++++++-----
+ 1 file changed, 20 insertions(+), 5 deletions(-)
+
+diff --git a/libcontainer/nsenter/nsexec.c b/libcontainer/nsenter/nsexec.c
+index b93f827..1e8d4da 100644
+--- a/libcontainer/nsenter/nsexec.c
++++ b/libcontainer/nsenter/nsexec.c
+@@ -94,14 +94,20 @@ static int child_func(void *arg)
+ 	longjmp(*ca->env, JUMP_VAL);
+ }
+ 
+-static int clone_parent(jmp_buf *env, int flags) __attribute__ ((noinline));
+-static int clone_parent(jmp_buf *env, int flags)
++static int clone_parent(jmp_buf *env, int flags, bool delay_ipc_unshare) __attribute__ ((noinline));
++static int clone_parent(jmp_buf *env, int flags, bool delay_ipc_unshare)
+ {
+ 	int child;
+ 	struct clone_arg ca = {
+ 		.env = env,
+ 	};
+ 
++	// Don't clone into NEWIPC at the same time as cloning into NEWUSER.
++	// This way we can ensure that NEWIPC namespace belongs to the root in new user namespace.
++	if (delay_ipc_unshare) {
++		flags &= ~CLONE_NEWIPC;
++	}
++
+ 	child = clone(child_func, ca.stack_ptr, CLONE_PARENT | SIGCHLD | flags, &ca);
+ 
+ 	/*
+@@ -227,7 +233,7 @@ static void update_gidmap(int pid, char *map, int map_len)
+ 
+ #define JSON_MAX 4096
+ 
+-static void start_child(int pipenum, jmp_buf *env, int syncpipe[2], struct nlconfig_t *config)
++static void start_child(int pipenum, jmp_buf *env, int syncpipe[2], struct nlconfig_t *config, bool delay_ipc_unshare)
+ {
+ 	int len, childpid;
+ 	char buf[JSON_MAX];
+@@ -239,7 +245,7 @@ static void start_child(int pipenum, jmp_buf *env, int syncpipe[2], struct nlcon
+ 	 * (the bootstrap process). Also so we don't need to forward the
+ 	 * child's exit code or resend its death signal.
+ 	 */
+-	childpid = clone_parent(env, config->cloneflags);
++	childpid = clone_parent(env, config->cloneflags, delay_ipc_unshare);
+ 	if (childpid < 0)
+ 		bail("unable to fork");
+ 
+@@ -415,6 +421,9 @@ void nsexec(void)
+ 	if (config.cloneflags == -1)
+ 		bail("missing clone_flags");
+ 
++	bool delay_ipc_unshare = ((config.cloneflags & CLONE_NEWUSER) == CLONE_NEWUSER)
++		&& ((config.cloneflags & CLONE_NEWIPC) == CLONE_NEWIPC);
++
+ 	/* Pipe so we can tell the child when we've finished setting up. */
+ 	if (pipe(syncpipe) < 0)
+ 		bail("failed to setup sync pipe between parent and child");
+@@ -447,6 +456,12 @@ void nsexec(void)
+ 		if (setgroups(0, NULL) < 0)
+ 			bail("setgroups failed");
+ 
++		if (delay_ipc_unshare) {
++			if (unshare(CLONE_NEWIPC)) {
++				bail("unable to unshare IPC namespace");
++			}
++		}
++
+ 		if (consolefd != -1) {
+ 			if (ioctl(consolefd, TIOCSCTTY, 0) < 0)
+ 				bail("ioctl TIOCSCTTY failed");
+@@ -466,7 +481,7 @@ void nsexec(void)
+ 	}
+ 
+ 	/* Run the parent code. */
+-	start_child(pipenum, &env, syncpipe, &config);
++	start_child(pipenum, &env, syncpipe, &config, delay_ipc_unshare);
+ 
+ 	/* Should never be reached. */
+ 	bail("should never be reached");

sdk_container/src/third_party/coreos-overlay/app-emulation/runc/runc-1.0.0_rc2_p9.ebuild

@@ -0,0 +1,62 @@
+# Copyright 1999-2016 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+# $Header: $
+
+EAPI=5
+
+GITHUB_URI="github.com/opencontainers/runc"
+COREOS_GO_PACKAGE="${GITHUB_URI}"
+COREOS_GO_VERSION="go1.6"
+# the commit of runc that docker uses.
+# see https://github.com/docker/docker/blob/v1.12.6/Dockerfile#L245
+# Note: this commit is only really present in `docker/runc` in the 'docker/1.12.x' branch
+# Update the patch number when this commit is changed (i.e. the _p in the
+# ebuild).
+# The patch version is arbitrarily the number of commits since the tag version
+# spcified in the ebuild name. For example:
+# $ git log v1.0.0-rc2..${COMMIT_ID} --oneline | wc -l
+COMMIT_ID="50a19c6ff828c58e5dab13830bd3dacde268afe5"
+
+inherit eutils flag-o-matic coreos-go-depend vcs-snapshot
+
+DESCRIPTION="runc container cli tools"
+HOMEPAGE="http://runc.io"
+
+SRC_URI="https://${GITHUB_URI}/archive/${COMMIT_ID}.tar.gz -> ${P}.tar.gz"
+KEYWORDS="amd64 arm64"
+
+LICENSE="Apache-2.0"
+SLOT="0"
+IUSE="apparmor selinux +seccomp"
+
+DEPEND=""
+RDEPEND="
+	apparmor? ( sys-libs/libapparmor )
+	seccomp? ( sys-libs/libseccomp )
+"
+
+src_prepare() {
+	epatch "${FILESDIR}/0001-Makefile-do-not-install-dependencies-of-target.patch"
+	epatch "${FILESDIR}/0002-Dont-set-label-for-mqueue-under-userns.patch"
+
+	# Work around https://github.com/golang/go/issues/14669
+	# Remove after updating to go1.7
+	filter-flags -O*
+
+	go_export
+}
+
+src_compile() {
+	# build up optional flags
+	local options=(
+		$(usev apparmor)
+		$(usev seccomp)
+		$(usev selinux)
+	)
+
+	emake BUILDTAGS="${options[*]}" COMMIT="${COMMIT_ID}"
+}
+
+src_install() {
+	dobin runc
+}