vendor: bump runc to 1.0.1

The commands used were (roughly):

	hack/pin-dependency.sh github.com/opencontainers/runc v1.0.1
	hack/lint-dependencies.sh
	# Follow its recommendations.
	hack/pin-dependency.sh github.com/cilium/ebpf v0.6.2
	hack/pin-dependency.sh github.com/opencontainers/selinux v1.8.2
	hack/pin-dependency.sh github.com/sirupsen/logrus v1.8.1
	# Recheck.
	hack/lint-dependencies.sh
	GO111MODULE=on go mod edit -dropreplace github.com/willf/bitset
	hack/update-vendor.sh
	# Recheck.
	hack/lint-dependencies.sh
	hack/update-internal-modules.sh
	# Recheck.
	hack/lint-dependencies.sh

Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>

vendor/github.com/opencontainers/runc/libcontainer/cgroups/fs2/freezer.go

@@ -3,27 +3,20 @@
 package fs2
 
 import (
+	"bufio"
 	stdErrors "errors"
+	"fmt"
 	"os"
 	"strings"
+	"time"
 
-	"github.com/opencontainers/runc/libcontainer/cgroups/fscommon"
+	"github.com/opencontainers/runc/libcontainer/cgroups"
 	"github.com/opencontainers/runc/libcontainer/configs"
 	"github.com/pkg/errors"
 	"golang.org/x/sys/unix"
 )
 
 func setFreezer(dirPath string, state configs.FreezerState) error {
-	if err := supportsFreezer(dirPath); err != nil {
-		// We can ignore this request as long as the user didn't ask us to
-		// freeze the container (since without the freezer cgroup, that's a
-		// no-op).
-		if state == configs.Undefined || state == configs.Thawed {
-			return nil
-		}
-		return errors.Wrap(err, "freezer not supported")
-	}
-
 	var stateStr string
 	switch state {
 	case configs.Undefined:
@@ -36,11 +29,23 @@ func setFreezer(dirPath string, state configs.FreezerState) error {
 		return errors.Errorf("invalid freezer state %q requested", state)
 	}
 
-	if err := fscommon.WriteFile(dirPath, "cgroup.freeze", stateStr); err != nil {
+	fd, err := cgroups.OpenFile(dirPath, "cgroup.freeze", unix.O_RDWR)
+	if err != nil {
+		// We can ignore this request as long as the user didn't ask us to
+		// freeze the container (since without the freezer cgroup, that's a
+		// no-op).
+		if state != configs.Frozen {
+			return nil
+		}
+		return errors.Wrap(err, "freezer not supported")
+	}
+	defer fd.Close()
+
+	if _, err := fd.WriteString(stateStr); err != nil {
 		return err
 	}
 	// Confirm that the cgroup did actually change states.
-	if actualState, err := getFreezer(dirPath); err != nil {
+	if actualState, err := readFreezer(dirPath, fd); err != nil {
 		return err
 	} else if actualState != state {
 		return errors.Errorf(`expected "cgroup.freeze" to be in state %q but was in %q`, state, actualState)
@@ -48,13 +53,8 @@ func setFreezer(dirPath string, state configs.FreezerState) error {
 	return nil
 }
 
-func supportsFreezer(dirPath string) error {
-	_, err := fscommon.ReadFile(dirPath, "cgroup.freeze")
-	return err
-}
-
 func getFreezer(dirPath string) (configs.FreezerState, error) {
-	state, err := fscommon.ReadFile(dirPath, "cgroup.freeze")
+	fd, err := cgroups.OpenFile(dirPath, "cgroup.freeze", unix.O_RDONLY)
 	if err != nil {
 		// If the kernel is too old, then we just treat the freezer as being in
 		// an "undefined" state.
@@ -63,12 +63,67 @@ func getFreezer(dirPath string) (configs.FreezerState, error) {
 		}
 		return configs.Undefined, err
 	}
-	switch strings.TrimSpace(state) {
-	case "0":
+	defer fd.Close()
+
+	return readFreezer(dirPath, fd)
+}
+
+func readFreezer(dirPath string, fd *os.File) (configs.FreezerState, error) {
+	if _, err := fd.Seek(0, 0); err != nil {
+		return configs.Undefined, err
+	}
+	state := make([]byte, 2)
+	if _, err := fd.Read(state); err != nil {
+		return configs.Undefined, err
+	}
+	switch string(state) {
+	case "0\n":
 		return configs.Thawed, nil
-	case "1":
-		return configs.Frozen, nil
+	case "1\n":
+		return waitFrozen(dirPath)
 	default:
 		return configs.Undefined, errors.Errorf(`unknown "cgroup.freeze" state: %q`, state)
 	}
 }
+
+// waitFrozen polls cgroup.events until it sees "frozen 1" in it.
+func waitFrozen(dirPath string) (configs.FreezerState, error) {
+	fd, err := cgroups.OpenFile(dirPath, "cgroup.events", unix.O_RDONLY)
+	if err != nil {
+		return configs.Undefined, err
+	}
+	defer fd.Close()
+
+	// XXX: Simple wait/read/retry is used here. An implementation
+	// based on poll(2) or inotify(7) is possible, but it makes the code
+	// much more complicated. Maybe address this later.
+	const (
+		// Perform maxIter with waitTime in between iterations.
+		waitTime = 10 * time.Millisecond
+		maxIter  = 1000
+	)
+	scanner := bufio.NewScanner(fd)
+	for i := 0; scanner.Scan(); {
+		if i == maxIter {
+			return configs.Undefined, fmt.Errorf("timeout of %s reached waiting for the cgroup to freeze", waitTime*maxIter)
+		}
+		line := scanner.Text()
+		val := strings.TrimPrefix(line, "frozen ")
+		if val != line { // got prefix
+			if val[0] == '1' {
+				return configs.Frozen, nil
+			}
+
+			i++
+			// wait, then re-read
+			time.Sleep(waitTime)
+			_, err := fd.Seek(0, 0)
+			if err != nil {
+				return configs.Undefined, err
+			}
+		}
+	}
+	// Should only reach here either on read error,
+	// or if the file does not contain "frozen " line.
+	return configs.Undefined, scanner.Err()
+}