feat: verify libpathrs version at both compile time and runtime

Makefile

@@ -2,6 +2,7 @@ SHELL = /bin/bash
 
 CONTAINER_ENGINE := docker
 GO ?= go
+PATHRS_MIN_VERSION ?= 0.2.5
 
 PREFIX ?= /usr/local
 BINDIR := $(PREFIX)/sbin
@@ -26,7 +27,8 @@ endif
 COMMIT := $(shell git describe --dirty --long --always)
 EXTRA_VERSION :=
 LDFLAGS_COMMON := -X main.gitCommit=$(COMMIT) \
-		  $(if $(strip $(EXTRA_VERSION)),-X main.extraVersion=$(EXTRA_VERSION),)
+		  $(if $(strip $(EXTRA_VERSION)),-X main.extraVersion=$(EXTRA_VERSION),) \
+		  -X main.PATHRS_MIN_VERSION=$(PATHRS_MIN_VERSION)
 
 GOARCH := $(shell $(GO) env GOARCH)
 
@@ -81,12 +83,26 @@ endif
 runc: runc-bin
 
 .PHONY: runc-bin
-runc-bin:
+runc-bin: check-libpathrs
 	$(GO_BUILD) -o runc .
 
 .PHONY: all
 all: runc
 
+.PHONY: check-libpathrs
+check-libpathrs:
+	@if [ -n "$(filter libpathrs,$(BUILDTAGS))" ]; then \
+		PATHRS_VERSION=$$(pkg-config --modversion pathrs 2>/dev/null); \
+		if [ -z "$$PATHRS_VERSION" ]; then \
+			echo "ERROR: pathrs not found via pkg-config" >&2; \
+			exit 1; \
+		fi; \
+		if ! printf '%s\n%s' "$(PATHRS_MIN_VERSION)" "$$PATHRS_VERSION" | sort -V -C; then \
+			echo "ERROR: pathrs version '$$PATHRS_VERSION' is too old; need >= '$(PATHRS_MIN_VERSION)'" >&2; \
+			exit 1; \
+		fi; \
+	fi
+
 TESTBINDIR := tests/cmd/_bin
 $(TESTBINDIR):
 	mkdir $(TESTBINDIR)
@@ -108,7 +124,7 @@ clean:
 static: static-bin
 
 .PHONY: static-bin
-static-bin:
+static-bin: check-libpathrs
 	$(GO_BUILD_STATIC) -o runc .
 
 .PHONY: releaseall

features_libpathrs.go

@@ -4,12 +4,25 @@ package main
 
 import (
 	"cyphar.com/go-pathrs"
+	"github.com/sirupsen/logrus"
+	"golang.org/x/mod/semver"
 )
 
+var PATHRS_MIN_VERSION string
+
 func pathrsVersionString() string {
 	info, err := pathrs.LibraryVersion()
 	if err != nil {
 		panic(err) // should never happen
 	}
 	return info.VersionString
 }
+
+func checkPathrsVersion() bool {
+	pathrsVersion := pathrsVersionString()
+	if semver.Compare("v"+pathrsVersion, "v"+PATHRS_MIN_VERSION) < 0 {
+		logrus.Errorf("pathrs version %s is too old; need >= %s", pathrsVersion, PATHRS_MIN_VERSION)
+		return false
+	}
+	return true
+}

features_pathrslite.go

@@ -5,3 +5,7 @@ package main
 func pathrsVersionString() string {
 	return ""
 }
+
+func checkPathrsVersion() bool {
+	return true
+}

go.mod

@@ -24,6 +24,7 @@ require (
 	github.com/urfave/cli/v3 v3.10.0
 	github.com/vishvananda/netlink v1.3.1
 	github.com/vishvananda/netns v0.0.5
+	golang.org/x/mod v0.37.0
 	golang.org/x/net v0.56.0
 	golang.org/x/sys v0.46.0
 )

go.sum

@@ -68,6 +68,8 @@ github.com/vishvananda/netlink v1.3.1 h1:3AEMt62VKqz90r0tmNhog0r/PpWKmrEShJU0wJW
 github.com/vishvananda/netlink v1.3.1/go.mod h1:ARtKouGSTGchR8aMwmkzC0qiNPrrWO5JS/XMVl45+b4=
 github.com/vishvananda/netns v0.0.5 h1:DfiHV+j8bA32MFM7bfEunvT8IAqQ/NzSJHtcmW5zdEY=
 github.com/vishvananda/netns v0.0.5/go.mod h1:SpkAiCQRtJ6TvvxPnOSyH3BMl6unz3xZlaprSwhNNJM=
+golang.org/x/mod v0.37.0 h1:vF1DjpVEshcIqoEaauuHebaLk1O1forxjxBaVn884JQ=
+golang.org/x/mod v0.37.0/go.mod h1:m8S8VeM9r4dzDwjrKO0a1sZP3YjeMamRRlD+fmR2Q/0=
 golang.org/x/net v0.56.0 h1:Rw8j/hFzGvJUZwNBXnAtf5sVDVt+65SK2C7IxCxZt5o=
 golang.org/x/net v0.56.0/go.mod h1:D3Ku6r+V6JROoZK144D2XfMHFcMq/0zSfLelVTCFKec=
 golang.org/x/sync v0.1.0 h1:wsuoTGHzEhffawBOhz5CYhcrV4IdKZbEyZjBMuTp12o=

init.go

@@ -8,6 +8,9 @@ import (
 )
 
 func init() {
+	if !checkPathrsVersion() {
+		os.Exit(1)
+	}
 	if len(os.Args) > 1 && os.Args[1] == "init" {
 		// This is the golang entry point for runc init, executed
 		// before main() but after libcontainer/nsenter's nsexec().