Long Wang [Sat, 8 Jul 2017 02:29:57 +0000 (10:29 +0800)]
af_unix: remove unlink operation
It is not necessary to unlink the abstract socket pathname when
we have finished using the socket. The abstract name is automatically
removed when the socket is closed.
This patch allows users to start containers in AppArmor namespaces.
Users can define their own profiles for their containers, but
lxc-start must be allowed to change to a namespace.
A container configuration file can wrap a container in an AppArmor
profile using lxc.aa_profile.
A process in an AppArmor namespace is restricted to view
or manage only the profiles belonging to this namespace, as if no
other profiles existed. A namespace can be created as follow:
sudo mkdir /sys/kernel/security/apparmor/policy/namespaces/$NAMESPACE
AppArmor can stack profiles so that the contained process is bound
by the intersection of all profiles of the stack. This is achieved
using the '//&' operator as follow:
In this case, even the guest process appears unconfined in the
namespace, it is still confined by $PROFILE.
A guest allowed to access "/sys/kernel/security/apparmor/** rwklix,"
will be able to manage its own profile set, while still being
enclosed in the topmost profile $PROFILE:
Different guests can be assigned the same namespace or different
namespaces. In the first case, they will share their profiles.
In the second case, they will have distinct sets of profiles.
use cppcheck tools `cppcheck --enable=warning .` on lxc source directory.
This patch fix the following warnning
```
[src/lxc/cgroups/cgfs.c:794]: (warning) %ld in format string (no. 3) requires 'long' but the argument type is 'unsigned long'.
[src/lxc/confile.c:4441]: (warning) %d in format string (no. 2) requires 'int' but the argument type is 'unsigned int'.
[src/lxc/confile.c:4502]: (warning) %d in format string (no. 2) requires 'int' but the argument type is 'unsigned int'.
[src/lxc/confile_legacy.c:921]: (warning) %d in format string (no. 2) requires 'int' but the argument type is 'unsigned int'.
[src/lxc/confile_legacy.c:938]: (warning) %d in format string (no. 2) requires 'int' but the argument type is 'unsigned int'.
[src/lxc/lxclock.c:63]: (warning) %zd in format string (no. 1) requires 'ssize_t' but the argument type is 'size_t {aka unsigned long}'.
[src/lxc/tools/lxc_info.c:118]: (warning) %u in format string (no. 1) requires 'unsigned int' but the argument type is 'signed int'.
[src/lxc/tools/lxc_info.c:118]: (warning) %u in format string (no. 2) requires 'unsigned int' but the argument type is 'signed int'.
[src/lxc/tools/lxc_info.c:123]: (warning) %u in format string (no. 1) requires 'unsigned int' but the argument type is 'signed int'.
[src/lxc/tools/lxc_info.c:127]: (warning) %u in format string (no. 1) requires 'unsigned int' but the argument type is 'signed int'.
[src/lxc/tools/lxc_info.c:130]: (warning) %u in format string (no. 1) requires 'unsigned int' but the argument type is 'signed int'.
[src/lxc/tools/lxc_top.c:212]: (warning) %u in format string (no. 1) requires 'unsigned int' but the argument type is 'signed int'.
[src/lxc/tools/lxc_top.c:212]: (warning) %u in format string (no. 2) requires 'unsigned int' but the argument type is 'signed int'.
[src/lxc/tools/lxc_top.c:217]: (warning) %u in format string (no. 1) requires 'unsigned int' but the argument type is 'signed int'.
[src/lxc/tools/lxc_top.c:221]: (warning) %u in format string (no. 1) requires 'unsigned int' but the argument type is 'signed int'.
[src/lxc/tools/lxc_top.c:224]: (warning) %u in format string (no. 1) requires 'unsigned int' but the argument type is 'signed int'.
```
Added '--apt-conf' argument for ALTLinux template.
Added [-a|--apt-conf] parameter for selection of exact package
providing 'apt-conf'. By default 'apt-conf-sisyphus' is used for
Sisyphus and 'apt-conf-branch' for the rest of branches.
start: send state to legacy lxc-monitord state server even if no state clients registered
This pr https://github.com/lxc/lxc/pull/1618 kill lxc-monitord, for backwards compatibility,
we also send state to legacy lxc-monitord state server in function `lxc_set_state`.
we should also send state if there is no state clients registered, otherwise `lxc-monitor` client will
not get state change event if container changed state to `STARTING` or `RUNNING`.
lxc-monitor has an option to tell lxc-monitord to quit.
```
~/lxc (master) # lxc-monitor --help
lxc-monitor monitors the state of the NAME container
Options :
-n, --name=NAME NAME of the container
NAME may be a regular expression
-Q, --quit tell lxc-monitord to quit
```
But it does not work. This patch fix that.
Serge and I discussed the new network parser we've merge a couple of days ago.
He pointed out that a bunch of use-cases we're currently supporting in the old
network parser would be broken by the new parser. As we've pointed out many
times before, we're strongly commited to backwards compatibility and not
breaking existing use-cases. That's why we decided to take a new approach.
Instead of trying to mangle the old parser and new parser to come up with
something that allows a smooth transition we will simply deprecate the old
configuration keys with LXC 3.0. In the meantime we will support the full-blown
old legacy parser and the new network parser. Specifically, this means that
we're deprecating:
lxc.network.*
in favor of
lxc.net.*
With LXC 2.1. defining networks using lxc.network.* keys will cause a
deprecation warning to be shown/logged. We strongly suggest that users upgrade
their existing configuration files to switch to the new network configuration
parser. Starting with LXC 3.0 we will remove all lxc.network.* keys and will
only support lxc.net.* style network configurations.
Note that the new network configuration parser will only accept index based
configuration keys, i.e. we are only support lxc.net.[i].* keys without an
index such as lxc.net.type are not supported anymore. The advantages of this
approach are vast. Not just internally, but also user-facing since it is much
clearer what configuration key belongs to what network.
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
The new network parser will support specifying multiple networks in the old
format where each new non-indexed "lxc.network.type" line starts a new network
configuration. This way we don't break users. For now, we just print a
deprecation warning. We will KILL this in LXC 3.0.
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
projects / thirdparty / lxc.git / log
