Scott Moser [Tue, 8 Oct 2013 00:41:23 +0000 (20:41 -0400)]
lxc-ubuntu-cloud: pass --numeric-owner and -p to untar
Just following up here, Serge raised the question of whether or not the
other two invocations of 'tar' in this script need '--numeric-owner'.
They probably should have it, although its of little concern because the
'build_root_tgz' path is only taken if there is no '-root.tar.gz' file for
download, and the only supported ubuntu release without the -root.tar.gz
download is 10.04 at this point.
Anyway, below is a more complete diff, also including a fix as
'--numeric-uid' is not a valid option to tar. The name is
'--numeric-owner'.
Signed-off-by: Scott Moser <smoser@ubuntu.com> Acked-by: Stéphane Graber <stgraber@ubuntu.com>
Dwight Engen [Fri, 4 Oct 2013 17:45:59 +0000 (13:45 -0400)]
always include the ja manpage sources in make dist
These need to be in the dist tarball even if the host packaging system
doesn't have docbook2x, otherwise configure will fail to find them. Also,
the build system may have docbook2x, even if the packaging system does not.
Dwight Engen [Fri, 4 Oct 2013 17:46:05 +0000 (13:46 -0400)]
fix errors when using docbook2man
docbook2man picks up some errors that docbook2x does not, fixing them
isn't harmful to docbook2x. The only real change is adding <para> and
<citerefentry> tags.
This patches the Fedora template to insure that the legacy network
startup scripts are enabled when NetworkManager has not been installed
in the container (default).
It also fixes a login problem with pam_loginuid.so in a container.
https://bugzilla.redhat.com/show_bug.cgi?id=966807
Signed-off-by: Michael H. Warfield <mhw@WittsEnd.com>
-- Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
Stéphane Graber [Fri, 4 Oct 2013 02:41:59 +0000 (22:41 -0400)]
lxc-ubuntu: Remove trim option
Container trimming is a bad idea in general, Ubuntu since 12.04 allows
standard systems to run in containers and we've got separate code to
deal with 10.04, so let's just drop trim.
templates/lxc-fedora Rework for distro independence.
This patch reworks the Fedora template to operate in the most "distro
agnostic" manner possible. It should even run on distros where rpm and
yum are not present and not available or may be incompatible. It
depends on the most basic set of system facilities like rsync but does
require squashfs support also be available to mount a LiveOS runtime.
Based on comments at Linux Plumbers, what I had been referring to as a
"run time environment" or RTE has been renamed in the code to refer to
it as a "bootstrap". It has been tested on Fedora (of course),
OpenSuse, Ubuntu, and Oracle (latest host versions of each) building
Fedora containers of F19 back through F9. Varying levels of database
problems were encountered from F11 and back and are "will not fix" due
to versions being long EOL. F15 and F16 build but do not run "out of
the box" due to systemd version issues and those are also "will not fix"
for the same reasons.
Signed-off-by: Michael H. Warfield <mhw@WittsEnd.com> Acked-by: Serge E. Hallyn <serge.hallyn@ubuntu.com> Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
Serge Hallyn [Thu, 3 Oct 2013 03:30:31 +0000 (22:30 -0500)]
add basic lxc-test-ubuntu (v3)
Some features of lxc - networking and LSM configuration for instance -
are generally configured by the distro packages. This program
tests the Ubuntu configuration.
changelog v2:
Switch to lxc-info -i to detect ip address as stgraber suggested
Don't look for 'expect' as I'm not using it yet.
changelog v3:
Make sure to only read one ip address from container.
Stéphane Graber [Wed, 2 Oct 2013 22:25:37 +0000 (18:25 -0400)]
Improve behaviour for unprivileged users
This mostly changes two things:
- Only log to the container's logfile on start/stop/restart/execute
- Call may_control() every time we use the API and return
"Insufficient privileges" on failure.
NOTE: I didn't test every single one of those but I'm fairly confident
in my copy/paste abilities and I confirmed they all build fine at least.
- When doing the selinux change, I noticed that there was a lot of
duplication of code in handing string configuration items, so I
refactored this into a common function.
- Added a config_string_max that can be passed a maximum acceptable
length, used to limit ttydir to NAME_MAX.
- The behavior of config_seccomp was different than other strings: if the
item was already defined, then the second attempt to set it would fail
instead of just replacing the value. Changed to just replace the value.
- Remove unused key and lxc_conf arguments to config_path_item().
Signed-off-by: Dwight Engen <dwight.engen@oracle.com> Acked-by: Serge E. Hallyn <serge.hallyn@ubuntu.com> Signed-off-by: Serge E. Hallyn <serge.hallyn@ubuntu.com>
The original rationale for this was to make sure that if
lxcpath was /home/serge/lxcbase, then then lockdir
(/run/user/serge/lock/lxc/home/serge/lxcbase) would be
owned by the same user as /home/serge/lxcbase.
The only user who can chown to other uids (without CAP_CHOWN
added to fP) is root, who shouldn't be mucking with non-root
owned containers anyway. In the meantime this causes a bunch
of noise for arguably no benefit.
This is an api function which will return false if the container
is running, and the caller may not talk to its monitor over its
command socket. Otherwise - if the container is not running, or
the caller may access it - it returns true.
We can use this in several tools early on to prevent the segvs
etc which we currently get.
Christian Seiler [Tue, 24 Sep 2013 20:45:08 +0000 (22:45 +0200)]
Automatic mounting: add more ways to mount the cgroup filesystem
This adds quite a few more ways to mount the cgroup filesystem
automatically:
- Specify ro/rw/mixed:
- ro: everything mounted read-only
- rw: everything mounted read-write
- mixed: only container's own cgroup is rw, rest ro
(default)
- Add cgroup-full that mounts the entire cgroup tree to the
corresponding directories. ro/rw/mixed also apply here.
Signed-off-by: Christian Seiler <christian@iwakd.de> Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
Christian Seiler [Tue, 24 Sep 2013 20:45:06 +0000 (22:45 +0200)]
Automatic mounts: improvements for /proc and /sys
Improve lxc.mount.auto code: allow the user to specify whether to mount
certain things read-only or read-write. Also make the code much more
easily extensible for the future.
Signed-off-by: Christian Seiler <christian@iwakd.de> Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
- change get_template_path() to only return NULL or non-NULL since one of
the callers was doing a free(-1) which caused the segfault. Handle the
NULL template case in the lxcapi_create() caller.
- make sure to free(tpath) in the sha1sum_file() failure case
Signed-off-by: Dwight Engen <dwight.engen@oracle.com> Acked-by: Serge E. Hallyn <serge.hallyn@ubuntu.com> Signed-off-by: Serge E. Hallyn <serge.hallyn@ubuntu.com>
refactor AppArmor into LSM backend, add SELinux support
Currently, a maximum of one LSM within LXC will be initialized and
used. If in the future stacked LSMs become a reality, we can support it
without changing the configuration syntax and add support for more than
a single LSM at a time to the lsm code.
Generic LXC code should note that lsm_process_label_set() will take
effect "now" for AppArmor, and upon exec() for SELinux.
- fix Oracle template mounting of proc and sysfs, needed when using SELinux
This one's easier to review by looking at the before and after files. It
splits up lxc_cgroup_load_meta2() by adding 3 helpers.
The result seems easier to reason about. A question I had, is, should
the kernel_subsystems ** be freed in the success case? I assumed it was
being used elsewhere but I can't find where. Currently it is only being
freed in the error case. I suspect we want to free it in the success
case as well.
doc: Japanese man pages is not generated when docbook-utils is used
Character encoding of Japanese man pages is UTF-8. But docbook-utils
can't treat it (and don't have --encoding option that use in
Makefile). So change to Japanese man pages is not generated when
docbook-utils is used.
arguments: remove trailing slashes for the input lxcpath
In lxc_cmd(), we use
snprintf(path, len, "%s/%s/command", lxcpath ? lxcpath : inpath, name);
to fill sock name, this assume lxcpath have no trailing slashes, so
if we use
lxc-info -n test -P /usr/local/var/lib/lxc_anon/
to get a running container's state, we will get state: STOPPED which
is wrong, because we combine a wrong sock name.
To fix this, just remove trailing slashes when parsing arguments.
The API header was included in a variety of ways before, standardize
those to "include <lxc/lxccontainer.h>" as this will always work both in
tree and on a system with the headers installed.
Expose underlying close_all_fds config value via API
Being able to set close_all_fds via API would be usefull for the
situations like running an application (let's say web server)
that controls the lifecycle of the container using the LXC API.
We don't want forked process to inherit parent's resource (file, socket, ...)
Signed-off-by: S.Çağlar Onur <caglar@10ur.org> Acked-by: Serge E. Hallyn <serge.hallyn@ubuntu.com>
get_ips accepts an interface name as a parameter but there was no
way to get the interfaces names from the container. This patch
introduces a new get_interfaces call to the API so that users
can obtain the name of the interfaces.
Support for python bindings also introduced as a part of this version.
pthread_mutex_lock() will only return an error if it was set to
PTHREAD_MUTEX_ERRORCHECK and we are recursively calling it (and
would otherwise have deadlocked). If that's the case then log a
message for future debugging and exit. Trying to "recover" is
nonsense at that point.
process_lock() was held over too long a time in lxcapi_start()
in the daemonize case. (note the non-daemonized case still needs a
check to enforce that it must NOT be called while threaded). Add
process_lock() at least across all open/close/socket() calls.
Anything done after a fork() doesn't need the locks as it is no
longer threaded - so some open/close/dups()s are not locked for
that reason. However, some common functions are called from both
threaded and non-threaded contexts. So after doing a fork(), do
a possibly-extraneous process_unlock() to make sure that, if we
were forked while pthread mutex was held, we aren't deadlocked by
nobody.
Tested that lp:~serge-hallyn/+junk/lxc-test still works with this
patch.
Christian Seiler [Thu, 12 Sep 2013 20:00:34 +0000 (22:00 +0200)]
Change rootfs pinning mechnism
Chane pinning mechanism: Use $rootfs/lxc.hold instead of $rootfs.hold
(in case $rootfs is a mountpoint itself), but delete the file
immediately after creating it (but keep it open). This will keep the
root filesystem busy but does not leave any unnecessary files lying
around.
Signed-off-by: Christian Seiler <christian@iwakd.de> Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
Christian Seiler [Wed, 11 Sep 2013 23:44:44 +0000 (01:44 +0200)]
Support for automatic mounting of filesystems
This patch adds the lxc.mount.auto configuration option that allows the
user to specify that certain standard filesystems should be
automatically pre-mounted when the container is started.
Currently, four things are implemented:
- /proc (mounted read-write)
- /sys (mounted read-only)
- /sys/fs/cgroup (special logic, see mailing list discussions)
- /proc/sysrq-trigger (see below)
/proc/sysrq-trigger may be used from within a container to trigger a
forced host reboot (echo b > /proc/sysrq-trigger) or do other things
that a container shouldn't be able to do. The logic here is to
bind-mount /dev/null over /proc/sysrq-trigger, so that that cannot
happen. This obviously only protects fully if CAP_SYS_ADMIN is not
available inside the container (otherwise that bind-mount could be
removed).
Signed-off-by: Christian Seiler <christian@iwakd.de> Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
Christian Seiler [Wed, 11 Sep 2013 23:44:43 +0000 (01:44 +0200)]
cgroup: Add lxc_setup_mount_cgroup to setup /sys/fs/cgroup inside the container
Add funbction to mount cgroup filesystem hierarchy into the container,
allowing only access to the parts that the container should have access
to, but none else.
Signed-off-by: Christian Seiler <christian@iwakd.de> Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
Christian Seiler [Wed, 11 Sep 2013 23:44:42 +0000 (01:44 +0200)]
cgroup: Split legacy 'ns' cgroup handling off from main cgroup handling
This patch splits off ns legacy cgroup handling from main cgroup
handling. It moves the creation of the cgroups before clone(), so that
the child will easily know which cgroups it will later belong to. Since
this is not possible for the renaming of the 'ns' cgroup, keep that
part after clone.
Signed-off-by: Christian Seiler <christian@iwakd.de> Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
If a cgroup hierarchy has ns cgroup composed, then we need to treat
that differently:
1. The container init will have already been switched to a new cgroup
called after its pid.
2. We can't move the container init to new deeper cgroup directories.
So, if we detect an ns cgroup, don't bother trying to construct a new
name according to the pattern. Just rename the current one to the
container name, and save that path for us to later enter and remove.
Note I'm not dealing with the subpaths so nested containers probably
won't work. However as ns cgroup is very much legacy, that should be
ok. Eventually we should be able to drop ns cgroup support altogether,
but not just yet.
apparmor.c: drop newline when reading current profile
Otherwise we fail to recognize if we are already unconfined. Then,
if we want to *start* unconfined, and /proc is readonly, start fails
even though it should be able to proceed.
With this patch, that situation works.
Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com> Reported-by: Andre nathan <andre@digirati.com.br>
This patch rewrites most of the cgroup logic. It creates a set of data
structures to store the kernel state of the cgroup hierarchies and
their mountpoints.
Mainly, everything is now grouped with respect to the hierarchies of
the system. Multiple controllers may be mounted together or separately
to different hierarchies, the data structures reflect this.
Each hierarchy may have multiple mount points (that were created
previously using the bind mount method) and each of these mount points
may point to a different prefix inside the cgroup tree. The current
code does not make any assumptions regarding the mount points, it just
parses /proc/self/mountinfo to acquire the relevant information.
The only requirement is that the current cgroup of either init (if
cgroup.pattern starts with '/' and the tools are executed as root) or
the current process (otherwise) are accessible. The root cgroup need
not be accessible.
The configuration option cgroup.pattern is introduced. For
root-executed containers, it specifies which format the cgroups should
be in. Example values may include '/lxc/%n', 'lxc/%n', '%n' or
'/machine/%n.lxc'. Any occurrence of '%n' is replaced with the name of
the container (and if clashes occur in any hierarchy, -1, -2, etc. are
appended globally). If the pattern starts with /, new containers'
cgroups will be located relative to init's cgroup; if it doesn't, they
will be located relative to the current process's cgroup.
Some changes to the cgroup.h API have been done to make it more
consistent, both with respect to naming and with respect to the
parameters. This causes some changes in other parts of the code that
are included in the patch.
There has been some testing of this functionality, but there are
probably still quite a few bugs in there, especially for people with
different configurations.
Signed-off-by: Christian Seiler <christian@iwakd.de> Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
projects / thirdparty / lxc.git / log
