{"action":"created","issue":{"url":"https://api.github.com/repos/docker/docker/issues/27610","repository_url":"https://api.github.com/repos/docker/docker","labels_url":"https://api.github.com/repos/docker/docker/issues/27610/labels{/name}","comments_url":"https://api.github.com/repos/docker/docker/issues/27610/comments","events_url":"https://api.github.com/repos/docker/docker/issues/27610/events","html_url":"https://github.com/docker/docker/pull/27610","id":184361547,"number":27610,"title":"Bump runc to f59ba3cdd76fdc08c004f42aa915996f6f420899","user":{"login":"crosbymichael","id":749551,"avatar_url":"https://avatars.githubusercontent.com/u/749551?v=3","gravatar_id":"","url":"https://api.github.com/users/crosbymichael","html_url":"https://github.com/crosbymichael","followers_url":"https://api.github.com/users/crosbymichael/followers","following_url":"https://api.github.com/users/crosbymichael/following{/other_user}","gists_url":"https://api.github.com/users/crosbymichael/gists{/gist_id}","starred_url":"https://api.github.com/users/crosbymichael/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/crosbymichael/subscriptions","organizations_url":"https://api.github.com/users/crosbymichael/orgs","repos_url":"https://api.github.com/users/crosbymichael/repos","events_url":"https://api.github.com/users/crosbymichael/events{/privacy}","received_events_url":"https://api.github.com/users/crosbymichael/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/docker/docker/labels/status/2-code-review","name":"status/2-code-review","color":"fad8c7"}],"state":"open","locked":false,"assignee":{"login":"vieux","id":1032519,"avatar_url":"https://avatars.githubusercontent.com/u/1032519?v=3","gravatar_id":"","url":"https://api.github.com/users/vieux","html_url":"https://github.com/vieux","followers_url":"https://api.github.com/users/vieux/followers","following_url":"https://api.github.com/users/vieux/following{/other_user}","gists_url":"https://api.github.com/users/vieux/gists{/gist_id}","starred_url":"https://api.github.com/users/vieux/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/vieux/subscriptions","organizations_url":"https://api.github.com/users/vieux/orgs","repos_url":"https://api.github.com/users/vieux/repos","events_url":"https://api.github.com/users/vieux/events{/privacy}","received_events_url":"https://api.github.com/users/vieux/received_events","type":"User","site_admin":false},"assignees":[{"login":"vieux","id":1032519,"avatar_url":"https://avatars.githubusercontent.com/u/1032519?v=3","gravatar_id":"","url":"https://api.github.com/users/vieux","html_url":"https://github.com/vieux","followers_url":"https://api.github.com/users/vieux/followers","following_url":"https://api.github.com/users/vieux/following{/other_user}","gists_url":"https://api.github.com/users/vieux/gists{/gist_id}","starred_url":"https://api.github.com/users/vieux/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/vieux/subscriptions","organizations_url":"https://api.github.com/users/vieux/orgs","repos_url":"https://api.github.com/users/vieux/repos","events_url":"https://api.github.com/users/vieux/events{/privacy}","received_events_url":"https://api.github.com/users/vieux/received_events","type":"User","site_admin":false}],"milestone":{"url":"https://api.github.com/repos/docker/docker/milestones/59","html_url":"https://github.com/docker/docker/milestones/1.12.3","labels_url":"https://api.github.com/repos/docker/docker/milestones/59/labels","id":2071001,"number":59,"title":"1.12.3","description":"milestone to track issues that can possibly warrant a patch release. see our Patch release policy for more information about the procedure; https://github.com/docker/docker/blob/master/project/PATCH-RELEASES.md","creator":{"login":"thaJeztah","id":1804568,"avatar_url":"https://avatars.githubusercontent.com/u/1804568?v=3","gravatar_id":"","url":"https://api.github.com/users/thaJeztah","html_url":"https://github.com/thaJeztah","followers_url":"https://api.github.com/users/thaJeztah/followers","following_url":"https://api.github.com/users/thaJeztah/following{/other_user}","gists_url":"https://api.github.com/users/thaJeztah/gists{/gist_id}","starred_url":"https://api.github.com/users/thaJeztah/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/thaJeztah/subscriptions","organizations_url":"https://api.github.com/users/thaJeztah/orgs","repos_url":"https://api.github.com/users/thaJeztah/repos","events_url":"https://api.github.com/users/thaJeztah/events{/privacy}","received_events_url":"https://api.github.com/users/thaJeztah/received_events","type":"User","site_admin":false},"open_issues":7,"closed_issues":20,"state":"open","created_at":"2016-10-14T18:46:37Z","updated_at":"2016-10-20T23:56:25Z","due_on":null,"closed_at":null},"comments":3,"created_at":"2016-10-20T22:59:59Z","updated_at":"2016-10-21T10:21:11Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/docker/docker/pulls/27610","html_url":"https://github.com/docker/docker/pull/27610","diff_url":"https://github.com/docker/docker/pull/27610.diff","patch_url":"https://github.com/docker/docker/pull/27610.patch"},"body":"Fixes #27540\r\nFixes #27590\r\n\r\nThis includes fixes for exec when there is a space in the process name of the stat file and removing ambient capabilities. \r\n\r\ndiff:\r\n\r\n```patch\r\ndiff --git a/Godeps/Godeps.json b/Godeps/Godeps.json\r\nindex 152246d..8e4d8ba 100644\r\n--- a/Godeps/Godeps.json\r\n+++ b/Godeps/Godeps.json\r\n@@ -68,7 +68,7 @@\r\n \t\t},\r\n \t\t{\r\n \t\t\t\"ImportPath\": \"github.com/syndtr/gocapability/capability\",\r\n-\t\t\t\"Rev\": \"e7cb7fa329f456b3855136a2642b197bad7366ba\"\r\n+\t\t\t\"Rev\": \"2c00daeb6c3b45114c80ac44119e7b8801fdd852\"\r\n \t\t},\r\n \t\t{\r\n \t\t\t\"ImportPath\": \"github.com/vishvananda/netlink\",\r\ndiff --git a/Godeps/_workspace/src/github.com/syndtr/gocapability/capability/capability.go b/Godeps/_workspace/src/github.com/syndtr/gocapability/capability/capability.go\r\nindex c07c557..c13f4e5 100644\r\n--- a/Godeps/_workspace/src/github.com/syndtr/gocapability/capability/capability.go\r\n+++ b/Godeps/_workspace/src/github.com/syndtr/gocapability/capability/capability.go\r\n@@ -10,42 +10,42 @@ package capability\r\n type Capabilities interface {\r\n \t// Get check whether a capability present in the given\r\n \t// capabilities set. The 'which' value should be one of EFFECTIVE,\r\n-\t// PERMITTED, INHERITABLE, BOUNDING or AMBIENT.\r\n+\t// PERMITTED, INHERITABLE or BOUNDING.\r\n \tGet(which CapType, what Cap) bool\r\n \r\n \t// Empty check whether all capability bits of the given capabilities\r\n \t// set are zero. The 'which' value should be one of EFFECTIVE,\r\n-\t// PERMITTED, INHERITABLE, BOUNDING or AMBIENT.\r\n+\t// PERMITTED, INHERITABLE or BOUNDING.\r\n \tEmpty(which CapType) bool\r\n \r\n \t// Full check whether all capability bits of the given capabilities\r\n \t// set are one. The 'which' value should be one of EFFECTIVE,\r\n-\t// PERMITTED, INHERITABLE, BOUNDING or AMBIENT.\r\n+\t// PERMITTED, INHERITABLE or BOUNDING.\r\n \tFull(which CapType) bool\r\n \r\n \t// Set sets capabilities of the given capabilities sets. The\r\n \t// 'which' value should be one or combination (OR'ed) of EFFECTIVE,\r\n-\t// PERMITTED, INHERITABLE, BOUNDING or AMBIENT.\r\n+\t// PERMITTED, INHERITABLE or BOUNDING.\r\n \tSet(which CapType, caps ...Cap)\r\n \r\n \t// Unset unsets capabilities of the given capabilities sets. The\r\n \t// 'which' value should be one or combination (OR'ed) of EFFECTIVE,\r\n-\t// PERMITTED, INHERITABLE, BOUNDING or AMBIENT.\r\n+\t// PERMITTED, INHERITABLE or BOUNDING.\r\n \tUnset(which CapType, caps ...Cap)\r\n \r\n \t// Fill sets all bits of the given capabilities kind to one. The\r\n-\t// 'kind' value should be one or combination (OR'ed) of CAPS,\r\n-\t// BOUNDS or AMBS.\r\n+\t// 'kind' value should be one or combination (OR'ed) of CAPS or\r\n+\t// BOUNDS.\r\n \tFill(kind CapType)\r\n \r\n \t// Clear sets all bits of the given capabilities kind to zero. The\r\n-\t// 'kind' value should be one or combination (OR'ed) of CAPS,\r\n-\t// BOUNDS or AMBS.\r\n+\t// 'kind' value should be one or combination (OR'ed) of CAPS or\r\n+\t// BOUNDS.\r\n \tClear(kind CapType)\r\n \r\n \t// String return current capabilities state of the given capabilities\r\n \t// set as string. The 'which' value should be one of EFFECTIVE,\r\n-\t// PERMITTED, INHERITABLE BOUNDING or AMBIENT\r\n+\t// PERMITTED, INHERITABLE or BOUNDING.\r\n \tStringCap(which CapType) string\r\n \r\n \t// String return current capabilities state as string.\r\ndiff --git a/Godeps/_workspace/src/github.com/syndtr/gocapability/capability/capability_linux.go b/Godeps/_workspace/src/github.com/syndtr/gocapability/capability/capability_linux.go\r\nindex 6d2135a..3dfcd39 100644\r\n--- a/Godeps/_workspace/src/github.com/syndtr/gocapability/capability/capability_linux.go\r\n+++ b/Godeps/_workspace/src/github.com/syndtr/gocapability/capability/capability_linux.go\r\n@@ -235,10 +235,9 @@ func (c *capsV1) Apply(kind CapType) error {\r\n }\r\n \r\n type capsV3 struct {\r\n-\thdr     capHeader\r\n-\tdata    [2]capData\r\n-\tbounds  [2]uint32\r\n-\tambient [2]uint32\r\n+\thdr    capHeader\r\n+\tdata   [2]capData\r\n+\tbounds [2]uint32\r\n }\r\n \r\n func (c *capsV3) Get(which CapType, what Cap) bool {\r\n@@ -257,8 +256,6 @@ func (c *capsV3) Get(which CapType, what Cap) bool {\r\n \t\treturn (1<<uint(what))&c.data[i].inheritable != 0\r\n \tcase BOUNDING:\r\n \t\treturn (1<<uint(what))&c.bounds[i] != 0\r\n-\tcase AMBIENT:\r\n-\t\treturn (1<<uint(what))&c.ambient[i] != 0\r\n \t}\r\n \r\n \treturn false\r\n@@ -278,9 +275,6 @@ func (c *capsV3) getData(which CapType, dest []uint32) {\r\n \tcase BOUNDING:\r\n \t\tdest[0] = c.bounds[0]\r\n \t\tdest[1] = c.bounds[1]\r\n-\tcase AMBIENT:\r\n-\t\tdest[0] = c.ambient[0]\r\n-\t\tdest[1] = c.ambient[1]\r\n \t}\r\n }\r\n \r\n@@ -319,9 +313,6 @@ func (c *capsV3) Set(which CapType, caps ...Cap) {\r\n \t\tif which&BOUNDING != 0 {\r\n \t\t\tc.bounds[i] |= 1 << uint(what)\r\n \t\t}\r\n-\t\tif which&AMBIENT != 0 {\r\n-\t\t\tc.ambient[i] |= 1 << uint(what)\r\n-\t\t}\r\n \t}\r\n }\r\n \r\n@@ -345,9 +336,6 @@ func (c *capsV3) Unset(which CapType, caps ...Cap) {\r\n \t\tif which&BOUNDING != 0 {\r\n \t\t\tc.bounds[i] &= ^(1 << uint(what))\r\n \t\t}\r\n-\t\tif which&AMBIENT != 0 {\r\n-\t\t\tc.ambient[i] &= ^(1 << uint(what))\r\n-\t\t}\r\n \t}\r\n }\r\n \r\n@@ -365,10 +353,6 @@ func (c *capsV3) Fill(kind CapType) {\r\n \t\tc.bounds[0] = 0xffffffff\r\n \t\tc.bounds[1] = 0xffffffff\r\n \t}\r\n-\tif kind&AMBS == AMBS {\r\n-\t\tc.ambient[0] = 0xffffffff\r\n-\t\tc.ambient[1] = 0xffffffff\r\n-\t}\r\n }\r\n \r\n func (c *capsV3) Clear(kind CapType) {\r\n@@ -385,10 +369,6 @@ func (c *capsV3) Clear(kind CapType) {\r\n \t\tc.bounds[0] = 0\r\n \t\tc.bounds[1] = 0\r\n \t}\r\n-\tif kind&AMBS == AMBS {\r\n-\t\tc.ambient[0] = 0\r\n-\t\tc.ambient[1] = 0\r\n-\t}\r\n }\r\n \r\n func (c *capsV3) StringCap(which CapType) (ret string) {\r\n@@ -430,10 +410,6 @@ func (c *capsV3) Load() (err error) {\r\n \t\t\tfmt.Sscanf(line[4:], \"nd:  %08x%08x\", &c.bounds[1], &c.bounds[0])\r\n \t\t\tbreak\r\n \t\t}\r\n-\t\tif strings.HasPrefix(line, \"CapA\") {\r\n-\t\t\tfmt.Sscanf(line[4:], \"mb:  %08x%08x\", &c.ambient[1], &c.ambient[0])\r\n-\t\t\tbreak\r\n-\t\t}\r\n \t}\r\n \tf.Close()\r\n \r\n@@ -466,25 +442,7 @@ func (c *capsV3) Apply(kind CapType) (err error) {\r\n \t}\r\n \r\n \tif kind&CAPS == CAPS {\r\n-\t\terr = capset(&c.hdr, &c.data[0])\r\n-\t\tif err != nil {\r\n-\t\t\treturn\r\n-\t\t}\r\n-\t}\r\n-\r\n-\tif kind&AMBS == AMBS {\r\n-\t\tfor i := Cap(0); i <= CAP_LAST_CAP; i++ {\r\n-\t\t\taction := pr_CAP_AMBIENT_LOWER\r\n-\t\t\tif c.Get(AMBIENT, i) {\r\n-\t\t\t\taction = pr_CAP_AMBIENT_RAISE\r\n-\t\t\t}\r\n-\t\t\terr := prctl(pr_CAP_AMBIENT, action, uintptr(i), 0, 0)\r\n-\t\t\t// Ignore EINVAL as not supported on kernels before 4.3\r\n-\t\t\tif errno, ok := err.(syscall.Errno); ok && errno == syscall.EINVAL {\r\n-\t\t\t\terr = nil\r\n-\t\t\t\tcontinue\r\n-\t\t\t}\r\n-\t\t}\r\n+\t\treturn capset(&c.hdr, &c.data[0])\r\n \t}\r\n \r\n \treturn\r\ndiff --git a/Godeps/_workspace/src/github.com/syndtr/gocapability/capability/enum.go b/Godeps/_workspace/src/github.com/syndtr/gocapability/capability/enum.go\r\nindex 6938173..fd0ce7f 100644\r\n--- a/Godeps/_workspace/src/github.com/syndtr/gocapability/capability/enum.go\r\n+++ b/Godeps/_workspace/src/github.com/syndtr/gocapability/capability/enum.go\r\n@@ -20,8 +20,6 @@ func (c CapType) String() string {\r\n \t\treturn \"bounding\"\r\n \tcase CAPS:\r\n \t\treturn \"caps\"\r\n-\tcase AMBIENT:\r\n-\t\treturn \"ambient\"\r\n \t}\r\n \treturn \"unknown\"\r\n }\r\n@@ -31,11 +29,9 @@ const (\r\n \tPERMITTED\r\n \tINHERITABLE\r\n \tBOUNDING\r\n-\tAMBIENT\r\n \r\n \tCAPS   = EFFECTIVE | PERMITTED | INHERITABLE\r\n \tBOUNDS = BOUNDING\r\n-\tAMBS   = AMBIENT\r\n )\r\n \r\n //go:generate go run enumgen/gen.go\r\ndiff --git a/Godeps/_workspace/src/github.com/syndtr/gocapability/capability/syscall_linux.go b/Godeps/_workspace/src/github.com/syndtr/gocapability/capability/syscall_linux.go\r\nindex eb71700..dd6f454 100644\r\n--- a/Godeps/_workspace/src/github.com/syndtr/gocapability/capability/syscall_linux.go\r\n+++ b/Godeps/_workspace/src/github.com/syndtr/gocapability/capability/syscall_linux.go\r\n@@ -38,15 +38,6 @@ func capset(hdr *capHeader, data *capData) (err error) {\r\n \treturn\r\n }\r\n \r\n-// not yet in syscall\r\n-const (\r\n-\tpr_CAP_AMBIENT           = 47\r\n-\tpr_CAP_AMBIENT_IS_SET    = uintptr(1)\r\n-\tpr_CAP_AMBIENT_RAISE     = uintptr(2)\r\n-\tpr_CAP_AMBIENT_LOWER     = uintptr(3)\r\n-\tpr_CAP_AMBIENT_CLEAR_ALL = uintptr(4)\r\n-)\r\n-\r\n func prctl(option int, arg2, arg3, arg4, arg5 uintptr) (err error) {\r\n \t_, _, e1 := syscall.Syscall6(syscall.SYS_PRCTL, uintptr(option), arg2, arg3, arg4, arg5, 0)\r\n \tif e1 != 0 {\r\ndiff --git a/libcontainer/capabilities_linux.go b/libcontainer/capabilities_linux.go\r\nindex 48338a1..4eda56d 100644\r\n--- a/libcontainer/capabilities_linux.go\r\n+++ b/libcontainer/capabilities_linux.go\r\n@@ -10,7 +10,7 @@ import (\r\n \t\"github.com/syndtr/gocapability/capability\"\r\n )\r\n \r\n-const allCapabilityTypes = capability.CAPS | capability.BOUNDS | capability.AMBS\r\n+const allCapabilityTypes = capability.CAPS | capability.BOUNDS\r\n \r\n var capabilityMap map[string]capability.Cap\r\n \r\ndiff --git a/libcontainer/system/proc.go b/libcontainer/system/proc.go\r\nindex 37808a2..a0e9637 100644\r\n--- a/libcontainer/system/proc.go\r\n+++ b/libcontainer/system/proc.go\r\n@@ -14,8 +14,10 @@ func GetProcessStartTime(pid int) (string, error) {\r\n \tif err != nil {\r\n \t\treturn \"\", err\r\n \t}\r\n+\treturn parseStartTime(string(data))\r\n+}\r\n \r\n-\tparts := strings.Split(string(data), \" \")\r\n+func parseStartTime(stat string) (string, error) {\r\n \t// the starttime is located at pos 22\r\n \t// from the man page\r\n \t//\r\n@@ -23,5 +25,19 @@ func GetProcessStartTime(pid int) (string, error) {\r\n \t// (22)  The  time the process started after system boot.  In kernels before Linux 2.6, this\r\n \t// value was expressed in jiffies.  Since Linux 2.6, the value is expressed in  clock  ticks\r\n \t// (divide by sysconf(_SC_CLK_TCK)).\r\n-\treturn parts[22-1], nil // starts at 1\r\n+\t//\r\n+\t// NOTE:\r\n+\t// pos 2 could contain space and is inside `(` and `)`:\r\n+\t// (2) comm  %s\r\n+\t// The filename of the executable, in parentheses.\r\n+\t// This is visible whether or not the executable is\r\n+\t// swapped out.\r\n+\t//\r\n+\t// the following is an example:\r\n+\t// 89653 (gunicorn: maste) S 89630 89653 89653 0 -1 4194560 29689 28896 0 3 146 32 76 19 20 0 1 0 2971844 52965376 3920 18446744073709551615 1 1 0 0 0 0 0 16781312 137447943 0 0 0 17 1 0 0 0 0 0 0 0 0 0 0 0 0 0\r\n+\r\n+\t// get parts after last `)`:\r\n+\ts := strings.Split(stat, \")\")\r\n+\tparts := strings.Split(strings.TrimSpace(s[len(s)-1]), \" \")\r\n+\treturn parts[22-3], nil // starts at 3 (after the filename pos `2`)\r\n }\r\ndiff --git a/libcontainer/system/proc_test.go b/libcontainer/system/proc_test.go\r\nnew file mode 100644\r\nindex 0000000..ba91029\r\n--- /dev/null\r\n+++ b/libcontainer/system/proc_test.go\r\n@@ -0,0 +1,20 @@\r\n+package system\r\n+\r\n+import \"testing\"\r\n+\r\n+func TestParseStartTime(t *testing.T) {\r\n+\tdata := map[string]string{\r\n+\t\t\"4902 (gunicorn: maste) S 4885 4902 4902 0 -1 4194560 29683 29929 61 83 78 16 96 17 20 0 1 0 9126532 52965376 1903 18446744073709551615 4194304 7461796 140733928751520 140733928698072 139816984959091 0 0 16781312 137447943 1 0 0 17 3 0 0 9 0 0 9559488 10071156 33050624 140733928758775 140733928758945 140733928758945 140733928759264 0\": \"9126532\",\r\n+\t\t\"9534 (cat) R 9323 9534 9323 34828 9534 4194304 95 0 0 0 0 0 0 0 20 0 1 0 9214966 7626752 168 18446744073709551615 4194304 4240332 140732237651568 140732237650920 140570710391216 0 0 0 0 0 0 0 17 1 0 0 0 0 0 6340112 6341364 21553152 140732237653865 140732237653885 140732237653885 140732237656047 0\":                                      \"9214966\",\r\n+\t\t\"24767 (irq/44-mei_me) S 2 0 0 0 -1 2129984 0 0 0 0 0 0 0 0 -51 0 1 0 8722075 0 0 18446744073709551615 0 0 0 0 0 0 0 2147483647 0 0 0 0 17 1 50 1 0 0 0 0 0 0 0 0 0 0 0\":                                                                                                                                                                         \"8722075\",\r\n+\t}\r\n+\tfor line, startTime := range data {\r\n+\t\tst, err := parseStartTime(line)\r\n+\t\tif err != nil {\r\n+\t\t\tt.Fatal(err)\r\n+\t\t}\r\n+\t\tif startTime != st {\r\n+\t\t\tt.Fatalf(\"expected start time %q but received %q\", startTime, st)\r\n+\t\t}\r\n+\t}\r\n+}\r\n```\r\n\r\nSigned-off-by: Michael Crosby <crosbymichael@gmail.com>"},"comment":{"url":"https://api.github.com/repos/docker/docker/issues/comments/255346711","html_url":"https://github.com/docker/docker/pull/27610#issuecomment-255346711","issue_url":"https://api.github.com/repos/docker/docker/issues/27610","id":255346711,"user":{"login":"justincormack","id":482364,"avatar_url":"https://avatars.githubusercontent.com/u/482364?v=3","gravatar_id":"","url":"https://api.github.com/users/justincormack","html_url":"https://github.com/justincormack","followers_url":"https://api.github.com/users/justincormack/followers","following_url":"https://api.github.com/users/justincormack/following{/other_user}","gists_url":"https://api.github.com/users/justincormack/gists{/gist_id}","starred_url":"https://api.github.com/users/justincormack/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/justincormack/subscriptions","organizations_url":"https://api.github.com/users/justincormack/orgs","repos_url":"https://api.github.com/users/justincormack/repos","events_url":"https://api.github.com/users/justincormack/events{/privacy}","received_events_url":"https://api.github.com/users/justincormack/received_events","type":"User","site_admin":false},"created_at":"2016-10-21T10:21:11Z","updated_at":"2016-10-21T10:21:11Z","body":"Yes, working on how best to support on master."}}
{"actor":{"display_login":"justincormack"}}