openSUSE: 2019:2288-1: moderate: singularity
Description
This update for singularity fixes the following issues:
singularity was updated to version 3.4.1:
This point release addresses the following issues:
- Fixes an issue where a PID namespace was always being used
- Fixes compilation on non 64-bit architectures
- Allows fakeroot builds for zypper, pacstrap, and debootstrap
- Correctly detects seccomp on OpenSUSE
- Honors GO_MODFLAGS properly in the mconfig generated makefile
- Passes the Mac hostname to the VM in MacOS Singularity builds
- Handles temporary EAGAIN failures when setting up loop devices on recent
kernels.
New version 3.4.0. Many changes since 3.2.1, for the full changelog please
read CHANGELOG.md
Update to version 3.2.1:
This point release fixes the following bugs:
- Allows users to join instances with non-suid workflow
- Removes false warning when seccomp is disabled on the host
- Fixes an issue in the terminal when piping output to commands
- Binds NVIDIA persistenced socket when `--nv` is invoked
Improve integration with SUSE Products: add support to create Singularity
images with SLE.
* Newer SUSE versions use a different path for the RPM database.
* When the installation succeeds by an installation scriptlet fails zypper
returns error code 107. Don't treat this as an error.
* In order to specify a repository GPG key, add support for multi line
variables.
* In order to specify a list of additional repos, add support to 'indexed'
variables.
* Improve handling of SUSE repositires:
- For SLE, use SUSEConnect to get all product repos.
- Allow to specify a repository GPG key.
- Allow to specify additional installation repositories.
- Add group 'singularity', fix ownerships.
Updated to singularity v3.2.0
* CVE-2019-11328: Instance files are now stored in user's home directory
for privacy and many checks have been added to ensure that a user can't
manipulate files to change `starter-suid` behavior when instances are
joined (many thanks to Matthias Gerstner from the SUSE security team for
finding and securely reporting this vulnerability) (boo#1128598)
* New features / functionalities
- Introduced a new basic framework for creating and managing plugins
- Added the ability to create containers through multi-stage builds
- Created the concept of a Sylabs Cloud "remote" endpoint and added the
ability for users and admins to set them through CLI and conf files
- Added caching for images from Singularity Hub
- Made it possible to compile Singularity outside of `$GOPATH`
- Added a json partition to SIF files for OCI configuration when
building from an OCI source
- Full integration with Singularity desktop for MacOS code base
* New Commands
- Introduced the `plugin` command group for creating and managing
plugins.
* Introduced the `remote` command group to support management of
Singularity endpoints.
* Added to the `key` command group to improve PGP key management.
* Added the `Stage:
Patch
Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2019-2288=1 - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2019-2288=1
Package List
- openSUSE Backports SLE-15-SP1 (aarch64 ppc64le s390x x86_64): singularity-3.4.1-bp151.3.3.1 singularity-debuginfo-3.4.1-bp151.3.3.1 - openSUSE Backports SLE-15 (aarch64 ppc64le s390x x86_64): singularity-3.4.1-bp150.2.10.1
References
https://www.suse.com/security/cve/CVE-2019-11328.html https://bugzilla.suse.com/1125369 https://bugzilla.suse.com/1128598--