Update containerd to fix AppArmor on SLES

go.mod

@@ -8,7 +8,7 @@ replace (
 	github.com/containerd/btrfs => github.com/containerd/btrfs v0.0.0-20181101203652-af5082808c83
 	github.com/containerd/cgroups => github.com/containerd/cgroups v0.0.0-20200531161412-0dbf7f05ba59
 	github.com/containerd/console => github.com/containerd/console v0.0.0-20181022165439-0650fd9eeb50
-	github.com/containerd/containerd => github.com/k3s-io/containerd v1.4.3-k3s1
+	github.com/containerd/containerd => github.com/k3s-io/containerd v1.4.3-k3s3
 	github.com/containerd/continuity => github.com/containerd/continuity v0.0.0-20190815185530-f2a389ac0a02
 	github.com/containerd/cri => github.com/rancher/cri v1.4.0-k3s.2 // k3s-release/1.4
 	github.com/containerd/fifo => github.com/containerd/fifo v0.0.0-20190816180239-bda0ff6ed73c

go.sum

@@ -466,8 +466,8 @@ github.com/jstemmer/go-junit-report v0.9.1/go.mod h1:Brl9GWCQeLvo8nXZwPNNblvFj/X
 github.com/jtolds/gls v4.20.0+incompatible/go.mod h1:QJZ7F/aHp+rZTRtaJ1ow/lLfFfVYBRgL+9YlvaHOwJU=
 github.com/julienschmidt/httprouter v1.2.0/go.mod h1:SYymIcj16QtmaHHD7aYtjjsJG7VTCxuUUipMqKk8s4w=
 github.com/jung-kurt/gofpdf v1.0.3-0.20190309125859-24315acbbda5/go.mod h1:7Id9E/uU8ce6rXgefFLlgrJj/GYY22cpxn+r32jIOes=
-github.com/k3s-io/containerd v1.4.3-k3s1 h1:4n8gpBDXa6IpinjzSl+uJsTPfg0l0Dus6zZBJLl3lDg=
-github.com/k3s-io/containerd v1.4.3-k3s1/go.mod h1:SQt4M1HhVTRsIIYHCfaelw8OGnk1FAkZbfiCx1WpkvE=
+github.com/k3s-io/containerd v1.4.3-k3s3 h1:cCczsk6P0KYYnFuh4FauXNMDcNl2LmDilCD6igR71WU=
+github.com/k3s-io/containerd v1.4.3-k3s3/go.mod h1:qHmUrsocqXRZQBvPKgoYfsBDfZ/tCtPta97L+VXqbak=
 github.com/k3s-io/etcd v0.5.0-alpha.5.0.20201208200253-50621aee4aea h1:7cwby0GoNAi8IsVrT0q+JfQpB6V76ZaEGhj6qts/mvU=
 github.com/k3s-io/etcd v0.5.0-alpha.5.0.20201208200253-50621aee4aea/go.mod h1:yVHk9ub3CSBatqGNg7GRmsnfLWtoW60w4eDYfh7vHDg=
 github.com/k3s-io/helm-controller v0.8.3 h1:GWxavyMz7Bw2ClxH5okkeOL8o5U6IBK7uauc44SDCjU=

vendor/github.com/containerd/containerd/contrib/apparmor/template.go

 // +build linux
 
 /*
+   Copyright The docker Authors.
+   Copyright The Moby Authors.
    Copyright The containerd Authors.
 
    Licensed under the Apache License, Version 2.0 (the "License");
@@ -22,6 +24,7 @@ import (
 	"bufio"
 	"fmt"
 	"io"
+	"io/ioutil"
 	"os"
 	"os/exec"
 	"path"
@@ -32,6 +35,10 @@ import (
 	"github.com/pkg/errors"
 )
 
+// NOTE: This code is copied from <github.com/docker/docker/profiles/apparmor>.
+//       If you plan to make any changes, please make sure they are also sent
+//       upstream.
+
 const dir = "/etc/apparmor.d"
 
 const defaultTemplate = `
@@ -48,6 +55,14 @@ profile {{.Name}} flags=(attach_disconnected,mediate_deleted) {
   capability,
   file,
   umount,
+{{if ge .Version 208096}}
+  # Host (privileged) processes may send signals to container processes.
+  signal (receive) peer=unconfined,
+  # Manager may send signals to container processes.
+  signal (receive) peer={{.DaemonProfile}},
+  # Container processes may send signals amongst themselves.
+  signal (send,receive) peer={{.Name}},
+{{end}}
 
   deny @{PROC}/* w,   # deny write for all files directly in /proc (not in a subdir)
   # deny write to files not in /proc/<number>/** or /proc/sys/**
@@ -76,10 +91,23 @@ profile {{.Name}} flags=(attach_disconnected,mediate_deleted) {
 `
 
 type data struct {
-	Name         string
-	Imports      []string
-	InnerImports []string
-	Version      int
+	Name          string
+	Imports       []string
+	InnerImports  []string
+	DaemonProfile string
+	Version       int
+}
+
+func cleanProfileName(profile string) string {
+	// Normally profiles are suffixed by " (enforce)". AppArmor profiles cannot
+	// contain spaces so this doesn't restrict daemon profile names.
+	if parts := strings.SplitN(profile, " ", 2); len(parts) >= 1 {
+		profile = parts[0]
+	}
+	if profile == "" {
+		profile = "unconfined"
+	}
+	return profile
 }
 
 func loadData(name string) (*data, error) {
@@ -100,6 +128,16 @@ func loadData(name string) (*data, error) {
 		return nil, errors.Wrap(err, "get apparmor_parser version")
 	}
 	p.Version = ver
+
+	// Figure out the daemon profile.
+	currentProfile, err := ioutil.ReadFile("/proc/self/attr/current")
+	if err != nil {
+		// If we couldn't get the daemon profile, assume we are running
+		// unconfined which is generally the default.
+		currentProfile = nil
+	}
+	p.DaemonProfile = cleanProfileName(string(currentProfile))
+
 	return &p, nil
 }
 

vendor/github.com/containerd/containerd/go.mod

@@ -4,31 +4,33 @@ go 1.14
 
 replace (
 	github.com/containerd/cri => github.com/k3s-io/cri v1.4.0-k3s.2 // k3s-release/1.4
-	k8s.io/api => k8s.io/api v0.19.0
-	k8s.io/apiextensions-apiserver => k8s.io/apiextensions-apiserver v0.19.0
-	k8s.io/apimachinery => k8s.io/apimachinery v0.19.0
-	k8s.io/apiserver => k8s.io/apiserver v0.19.0
-	k8s.io/cli-runtime => k8s.io/cli-runtime v0.19.0
-	k8s.io/client-go => k8s.io/client-go v0.19.0
-	k8s.io/cloud-provider => k8s.io/cloud-provider v0.19.0
-	k8s.io/cluster-bootstrap => k8s.io/cluster-bootstrap v0.19.0
-	k8s.io/code-generator => k8s.io/code-generator v0.19.0
-	k8s.io/component-base => k8s.io/component-base v0.19.0
-	k8s.io/cri-api => k8s.io/cri-api v0.19.0
-	k8s.io/csi-translation-lib => k8s.io/csi-translation-lib v0.19.0
-	k8s.io/kube-aggregator => k8s.io/kube-aggregator v0.19.0
-	k8s.io/kube-controller-manager => k8s.io/kube-controller-manager v0.19.0
-	k8s.io/kube-proxy => k8s.io/kube-proxy v0.19.0
-	k8s.io/kube-scheduler => k8s.io/kube-scheduler v0.19.0
-	k8s.io/kubectl => k8s.io/kubectl v0.19.0
-	k8s.io/kubelet => k8s.io/kubelet v0.19.0
-	k8s.io/kubernetes => k8s.io/kubernetes v1.19.0-rc.3
-	k8s.io/legacy-cloud-providers => k8s.io/legacy-cloud-providers v0.19.0
-	k8s.io/metrics => k8s.io/metrics v0.19.0
-	k8s.io/node-api => k8s.io/node-api v0.19.0
-	k8s.io/sample-apiserver => k8s.io/sample-apiserver v0.19.0
-	k8s.io/sample-cli-plugin => k8s.io/sample-cli-plugin v0.19.0
-	k8s.io/sample-controller => k8s.io/sample-controller v0.19.0
+	github.com/golang/protobuf => github.com/golang/protobuf v1.3.5
+	google.golang.org/genproto => google.golang.org/genproto v0.0.0-20200224152610-e50cd9704f63
+	k8s.io/api => k8s.io/api v0.19.5
+	k8s.io/apiextensions-apiserver => k8s.io/apiextensions-apiserver v0.19.5
+	k8s.io/apimachinery => k8s.io/apimachinery v0.19.5
+	k8s.io/apiserver => k8s.io/apiserver v0.19.5
+	k8s.io/cli-runtime => k8s.io/cli-runtime v0.19.5
+	k8s.io/client-go => k8s.io/client-go v0.19.5
+	k8s.io/cloud-provider => k8s.io/cloud-provider v0.19.5
+	k8s.io/cluster-bootstrap => k8s.io/cluster-bootstrap v0.19.5
+	k8s.io/code-generator => k8s.io/code-generator v0.19.5
+	k8s.io/component-base => k8s.io/component-base v0.19.5
+	k8s.io/cri-api => k8s.io/cri-api v0.19.5
+	k8s.io/csi-translation-lib => k8s.io/csi-translation-lib v0.19.5
+	k8s.io/kube-aggregator => k8s.io/kube-aggregator v0.19.5
+	k8s.io/kube-controller-manager => k8s.io/kube-controller-manager v0.19.5
+	k8s.io/kube-proxy => k8s.io/kube-proxy v0.19.5
+	k8s.io/kube-scheduler => k8s.io/kube-scheduler v0.19.5
+	k8s.io/kubectl => k8s.io/kubectl v0.19.5
+	k8s.io/kubelet => k8s.io/kubelet v0.19.5
+	k8s.io/kubernetes => k8s.io/kubernetes v1.19.5
+	k8s.io/legacy-cloud-providers => k8s.io/legacy-cloud-providers v0.19.5
+	k8s.io/metrics => k8s.io/metrics v0.19.5
+	k8s.io/node-api => k8s.io/node-api v0.19.5
+	k8s.io/sample-apiserver => k8s.io/sample-apiserver v0.19.5
+	k8s.io/sample-cli-plugin => k8s.io/sample-cli-plugin v0.19.5
+	k8s.io/sample-controller => k8s.io/sample-controller v0.19.5
 )
 
 require (
@@ -37,7 +39,7 @@ require (
 	github.com/Microsoft/hcsshim v0.8.10-0.20200715222032-5eafd1556990
 	github.com/Microsoft/hcsshim/test v0.0.0-20200803203718-d80bc7196cb0
 	github.com/containerd/aufs v0.0.0-20191030083217-371312c1e31c
-	github.com/containerd/btrfs v0.0.0-20200117014249-153935315f4a
+	github.com/containerd/btrfs v0.0.0-20201111183144-404b9149801e
 	github.com/containerd/cgroups v0.0.0-20200710171044-318312a37340
 	github.com/containerd/console v1.0.0
 	github.com/containerd/continuity v0.0.0-20200710164510-efbc4488d8fe
@@ -74,9 +76,9 @@ require (
 	github.com/tchap/go-patricia v2.2.6+incompatible // indirect
 	github.com/urfave/cli v1.22.2
 	go.etcd.io/bbolt v1.3.5
-	golang.org/x/net v0.0.0-20200707034311-ab3426394381
+	golang.org/x/net v0.0.0-20201110031124-69a78807bb2b
 	golang.org/x/sync v0.0.0-20190911185100-cd5d95a43a6e
-	golang.org/x/sys v0.0.0-20200728102440-3e129f6d46b1
+	golang.org/x/sys v0.0.0-20201112073958-5cba982894dd
 	google.golang.org/grpc v1.27.1
 	gotest.tools/v3 v3.0.2
 )

vendor/modules.txt

@@ -169,7 +169,7 @@ github.com/containerd/cgroups/v2
 github.com/containerd/cgroups/v2/stats
 # github.com/containerd/console v1.0.0 => github.com/containerd/console v0.0.0-20181022165439-0650fd9eeb50
 github.com/containerd/console
-# github.com/containerd/containerd v1.4.0 => github.com/k3s-io/containerd v1.4.3-k3s1
+# github.com/containerd/containerd v1.4.0 => github.com/k3s-io/containerd v1.4.3-k3s3
 ## explicit
 github.com/containerd/containerd
 github.com/containerd/containerd/api/events
@@ -2927,7 +2927,7 @@ vbom.ml/util/sortorder
 # github.com/containerd/btrfs => github.com/containerd/btrfs v0.0.0-20181101203652-af5082808c83
 # github.com/containerd/cgroups => github.com/containerd/cgroups v0.0.0-20200531161412-0dbf7f05ba59
 # github.com/containerd/console => github.com/containerd/console v0.0.0-20181022165439-0650fd9eeb50
-# github.com/containerd/containerd => github.com/k3s-io/containerd v1.4.3-k3s1
+# github.com/containerd/containerd => github.com/k3s-io/containerd v1.4.3-k3s3
 # github.com/containerd/continuity => github.com/containerd/continuity v0.0.0-20190815185530-f2a389ac0a02
 # github.com/containerd/cri => github.com/rancher/cri v1.4.0-k3s.2
 # github.com/containerd/fifo => github.com/containerd/fifo v0.0.0-20190816180239-bda0ff6ed73c