Update runc, crun and zeitgeist deps

Signed-off-by: Sascha Grunert <[email protected]>

Author: saschagrunert

Makefile

@@ -18,7 +18,7 @@ GOLANGCI_LINT_VERSION = v1.60.2
 REPO_INFRA_VERSION = v0.2.5
 KUSTOMIZE_VERSION = 5.2.1
 OPERATOR_SDK_VERSION ?= v1.25.0
-ZEITGEIST_VERSION = v0.5.3
+ZEITGEIST_VERSION = v0.5.4
 MDTOC_VERSION = v1.4.0
 CI_IMAGE ?= golang:1.23
 

dependencies.yaml

@@ -156,7 +156,7 @@ dependencies:
       match: VERSION
 
   - name: crun
-    version: 1.17
+    version: 1.18
     refPaths:
     - path: examples/baseprofile-crun.yaml
       match: name
@@ -166,7 +166,7 @@ dependencies:
       match: CRUN_VERSION
 
   - name: runc
-    version: v1.1.15
+    version: v1.2.0
     refPaths:
     - path: examples/baseprofile-runc.yaml
       match: name
@@ -231,7 +231,7 @@ dependencies:
       match: flatcar_developer_container
 
   - name: zeitgeist
-    version: 0.5.3
+    version: 0.5.4
     refPaths:
       - path: Makefile
         match: ZEITGEIST_VERSION

examples/baseprofile-crun.yaml

@@ -2,7 +2,7 @@
 apiVersion: security-profiles-operator.x-k8s.io/v1beta1
 kind: SeccompProfile
 metadata:
-  name: crun-v1.17
+  name: crun-v1.18
 spec:
   defaultAction: SCMP_ACT_ERRNO
   architectures:

examples/baseprofile-runc.yaml

@@ -2,7 +2,7 @@
 apiVersion: security-profiles-operator.x-k8s.io/v1beta1
 kind: SeccompProfile
 metadata:
-  name: runc-v1.1.15
+  name: runc-v1.2.0
 spec:
   defaultAction: SCMP_ACT_ERRNO
   architectures:
@@ -18,17 +18,23 @@ spec:
         - clone
         - clone3
         - close
+        - close_range
         - dup3
         - epoll_create1
         - epoll_ctl
         - epoll_pwait
         - execve
+        - exit
         - exit_group
+        - faccessat
         - faccessat2
         - fchdir
         - fchmodat
         - fchownat
         - fcntl
+        - fsconfig
+        - fsmount
+        - fsopen
         - fstat
         - fstatfs
         - futex
@@ -49,6 +55,7 @@ spec:
         - munmap
         - nanosleep
         - newfstatat
+        - open_tree
         - openat
         - openat2
         - pipe2
@@ -57,6 +64,7 @@ spec:
         - prlimit64
         - read
         - readlinkat
+        - recvfrom
         - rseq
         - rt_sigaction
         - rt_sigprocmask
@@ -73,11 +81,11 @@ spec:
         - setuid
         - sigaltstack
         - statfs
+        - statx
         - symlinkat
         - tgkill
         - umask
         - umount2
         - unlinkat
-        - unshare
         - utimensat
         - write

hack/install-crun

@@ -1,7 +1,7 @@
 #!/usr/bin/env bash
 set -euox pipefail
 
-CRUN_VERSION=1.17
+CRUN_VERSION=1.18
 CRUN_BIN=/tmp/crun
 
 # Current crun version

installation-usage.md

@@ -525,7 +525,7 @@ metadata:
   name: profile1
 spec:
   defaultAction: SCMP_ACT_ERRNO
-  baseProfileName: runc-v1.1.15
+  baseProfileName: runc-v1.2.0
   syscalls:
     - action: SCMP_ACT_ALLOW
       names:
@@ -2002,7 +2002,7 @@ The following checks were performed on each of these signatures:
 16:32:33.208743 Copying profile from repository
 16:32:34.119652 Reading profile
 16:32:34.119677 Trying to unmarshal seccomp profile
-16:32:34.120114 Got SeccompProfile: runc-v1.1.15
+16:32:34.120114 Got SeccompProfile: runc-v1.2.0
 16:32:34.120119 Saving profile in: /tmp/profile.yaml
 ```
 
@@ -2138,7 +2138,7 @@ way, for example if a profile does not support any platform:
 11:07:18.359152 Trying to read profile: profile-linux-amd64.yaml
 11:07:18.359209 Trying to read profile: profile.yaml
 11:07:18.359224 Trying to unmarshal seccomp profile
-11:07:18.359728 Got SeccompProfile: runc-v1.1.15
+11:07:18.359728 Got SeccompProfile: runc-v1.2.0
 11:07:18.359732 Saving profile in: /tmp/profile.yaml
 ```
 

test/tc_base_profiles_test.go

@@ -24,8 +24,8 @@ import (
 )
 
 const (
-	baseProfileNameRunc = "runc-v1.1.15"
-	baseProfileNameCrun = "crun-v1.17"
+	baseProfileNameRunc = "runc-v1.2.0"
+	baseProfileNameCrun = "crun-v1.18"
 )
 
 func (e *e2e) testCaseBaseProfile([]string) {