chore(deps): update module cyphar.com/go-pathrs to v0.2.4 (main)

[elastic-renovate-prod]

This PR contains the following updates:

Package	Type	Update	Change
cyphar.com/go-pathrs	indirect	patch	v0.2.1 -> v0.2.4

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Release Notes

cyphar/libpathrs (cyphar.com/go-pathrs)

v0.2.4: libpathrs v0.2.4 -- "そう。神を生贄に捧げる！"

Compare Source

This release includes a series of bugfixes and important packaging
improvements that were found to be necessary while preparing for making
libpathrs a default dependency of runc.

Added

• New EXTRA_RUSTC_FLAGS and EXTRA_CARGO_FLAGS variables have been added to
  our Makefile, making it easier for packaging tools to adjust builds while
  still using make release.
• install.sh now accepts --rust-target and --rust-buildmode as parameters
  to make cross-compilation workflows easier to write (in particular, this is
  needed for runc's release scripts).
• We now produce signed release artefacts for our releases (though currently
  only in the form of signed source and cargo vendor tarballs). The accepted
  set of signing keys are available in libpathrs.keyring.

Changed

• The O_PATH resolver for procfs now has an additional bit of hardening
  (each component must be on a procfs -- previously we would check that it is
  on the same mount, which is an even stronger requirement but on older kernels
  it is possible to not have a mount ID to check against).

Fixed

• Previously, staticlib builds of libpathrs (i.e., libpathrs.a)
  inadvertently included symbol versioned symbols (@@​LIBPATHRS_X.Y), which
  would cause linker errors when trying to compile programs statically against
  libpathrs.

  This has been resolved, but downstream users who build runc without using
  make release will need to take care to ensure they correctly set the
  LIBPATHRS_CAPI_BUILDMODE environment variable when building and build
  libpathrs.a and libpathrs.so in separate cargo build (or cargo rustc) invocations. This is mostly necessary due to the lack of support for
  #[cfg(crate_type)].

• go-pathrs now correctly builds on 32-bit architectures.

• When doing procfs operations, previously libpathrs would internally keep a
  handle to ProcfsBase open during the entire operation (due to Drop
  semantics in Rust) rather than closing the file descriptor as quickly as
  possible. The file descriptor would be closed soon afterwards (and thus was
  not a leak) but tools that search for file descriptor leaks (such as runc's
  test suite) could incorrectly classify this as a leak. We now close this
  ProcfsBase handle far more aggressively.

• RHEL 8 kernels have backports of the fd-based mount API (fsopen(2),
  open_tree(2), et al.) but some runc testing found that they have very bad
  (and very difficult to debug) performance issues. Thus, to avoid broken
  backports libpathrs will now explicitly refuse to use the fd-based mount API
  if the reported kernel version is pre-5.2 and will instead fallback to the
  less-secure open("/proc").

• libpathrs 0.2.0 added some fdinfo-based hardening to the procfs
  resolver when openat2 is not available. Unfortunately, one aspect of this
  hardening had a hard requirement on a kernel feature only added in Linux
  5.14 (namely the ino field in fdinfo) and thus
  inadvertently increased our minimum kernel version requirement quite
  significantly. This additional hardening is now only treated as mandatory if
  the host kernel version is Linux 5.14 or newer.

• Some of the same fdinfo-based hardening had a separate issue when running
  in the context of a non-dumpable process on pre-5.14 kernels -- causing
  spurious EACCES errors. We now permit fdinfo to be inaccessible in this
  very specific situation.

v0.2.3: libpathrs v0.2.3 -- "この閃きを俺は信じる！"

Compare Source

This release just includes some key changes to our build system to properly
handle symbol versioning and to re-enable compilation for older Rust versions.

Fixed

• While our MSRV is Rust 1.63 (to allow libpathrs to be packaged for Debian
  12), we inadvertently depended on a Rust 1.64 feature in our build scripts
  (cargo rustc --crate-type). We have added a temporary workaround for Rust
  1.63, which will be removed after we update our MSRV.
• A bug in our system for generating symbol versions actually resulted in no
  versioned symbols for libpathrs.so when compiled with Rust 1.72 or newer.
  This bug has been present since libpathrs 0.2, meaning that this has been
  broken for all versions with versioned symbols. This has been fixed, and now
  our symbols are properly versioned.
  • In addition, building libpathrs.so with pre-1.90 Rust was broken because
    of unfortunate interactions with GNU ld and our version scripts. This has
    been resolved, but means that libpathrs now requires lld to compile,
    even on older Rust versions. Rust 1.90 switched to lld by default for
    x86 platforms.

Thanks to the following contributors for making this release possible:

• Aleksa Sarai cyphar@cyphar.com
• Andreas Schwab schwab@suse.de

Signed-off-by: Aleksa Sarai cyphar@cyphar.com

v0.2.2: libpathrs v0.2.2 -- "貴様ら全員刀の錆にしてやるぜ。"

Compare Source

This is a minor release of libpathrs which includes some improvements to
our openat2(2) fallback handling (necessary for runc and adapted from a
similar change to pathrs-lite), as well as minor improvements to "cargo
test" runs -- making the default %check RPM scriptlets work properly out
of the box.

Changed

• Add _test_race feature to allow you to opt-out of the race tests when
  testing with cargo test (which resolves the spurious EAGAIN failures you
  get with naive cargo test and cargo nextest runs, along with making the
  whole test run ~50x faster).

Fixed

• Previously, cargo test runs would fail with errors due to the unique
  execution environment that cargo nextest provides. We have resolved those
  differences and now have smoke tests in our CI to make sure that a naive
  cargo test run will succeed.
• libpathrs will now apply the same openat2 retry logic for any usage of
  openat2 (for scoped lookups), to further improve resiliency on busy
  systems.
• Our logic for deciding whether to use openat2(2) or fallback to an O_PATH
  resolver would cache the result to avoid doing needless test runs of
  openat2(2). However, this causes issues when libpathrs is being used by a
  program that applies new seccomp-bpf filters onto itself -- if the filter
  denies openat2(2) then we would return that error rather than falling back
  to the O_PATH resolver. To resolve this issue, we have introduced more
  flexible fallback mechanisms and no longer cache the result if openat2(2)
  was successful (only if there was an error).

Thanks to the following contributors for making this release possible:

• Aleksa Sarai cyphar@cyphar.com
• Kir Kolyshkin kolyshkin@gmail.com

Signed-off-by: Aleksa Sarai cyphar@cyphar.com

---

Configuration

📅 Schedule: Branch creation - "* 1 * * 1-5" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Renovate Bot.