!246 runc：check cmd exist

From: @zhong-jiawei-1 
Reviewed-by: @flyflyflypeng 
Signed-off-by: @flyflyflypeng

git-commit

@@ -1 +1 @@
-42a0c20aa2da66d8e2fd57b433752cce671a482d
+df767bfac9eec2ce7b635757f676ecb5b11ec195

patch/0052-runc-check-cmd-exist.patch

@@ -0,0 +1,36 @@
+From 032f0a78d6f4ba49a48ca1ae3d53e6dc8726ff1f Mon Sep 17 00:00:00 2001
+From: zhongjiawei <zhongjiawei1@huawei.com>
+Date: Tue, 6 Feb 2024 11:20:48 +0800
+Subject: [PATCH] runc:check cmd exist
+
+---
+ libcontainer/setns_init_linux.go | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/libcontainer/setns_init_linux.go b/libcontainer/setns_init_linux.go
+index 1eea851..f1dcab6 100644
+--- a/libcontainer/setns_init_linux.go
++++ b/libcontainer/setns_init_linux.go
+@@ -4,6 +4,7 @@ import (
+ 	"errors"
+ 	"fmt"
+ 	"os"
++	"os/exec"
+ 	"strconv"
+ 
+ 	"github.com/opencontainers/selinux/go-selinux"
+@@ -86,6 +87,11 @@ func (l *linuxSetnsInit) Init() error {
+ 	if err := finalizeNamespace(l.config); err != nil {
+ 		return err
+ 	}
++	// Check for the arg early to make sure it exists.
++	_, err := exec.LookPath(l.config.Args[0])
++	if err != nil {
++		return err
++	}
+ 	if err := apparmor.ApplyProfile(l.config.AppArmorProfile); err != nil {
+ 		return err
+ 	}
+-- 
+2.33.0
+

runc.spec

@@ -54,6 +54,12 @@ install -p -m 755 runc $RPM_BUILD_ROOT/%{_bindir}/runc
 %{_bindir}/runc
 
 %changelog
+* Tue Feb 06 2024 zhongjiawei<zhongjiawei1@huawei.com> - 1.1.3-25
+- Type:bugfix
+- CVE:NA
+- SUG:NA
+- DESC:check cmd exist
+
 * Thu Feb 01 2024 zhongjiawei<zhongjiawei1@huawei.com> - 1.1.3-24
 - Type:CVE
 - CVE:CVE-2024-21626

series.conf

@@ -49,3 +49,4 @@ patch/0048-runc-Fix-undefined-behavior.patch
 patch/0049-runc-nsexec-Check-for-errors-in-write_log.patch
 patch/0050-runc-increase-the-number-of-cgroup-deletion-retries.patch
 patch/0051-runc-fix-CVE-2024-21626.patch
+patch/0052-runc-check-cmd-exist.patch