terminal: dumb logging down

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Merge pull request #3689 from brauner/2021-02-21/fixes

cgroups: introduce fd-only cgroup attach via LXC_CMD_GET_CGROUP_CTX

attach: fix namespace preservation

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

commands: verify expected file descriptors were sent

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

commands: handle older clients gracefully

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

attach: remove additional newline

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

af_unix: add comment about cast

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

attach: fix unsupported namespaces

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

commands: lxc_cmd_add_state_client_callback()

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

commands: handle older clients elegantly

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

commands: send ENOSYS response

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

cgroups: introduce fd-only cgroup attach

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

commands: introduce LXC_CMD_GET_CGROUP_CTX

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

utils: add copy_struct_to_client()

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

log: add syswarn_set()

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

utils: add copy_struct_from_client()

Which is our variant of copy_struct_from_user() that Aleksa and I added to the
kernel.

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

macro: add min() macro

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

cgroups: allow cgroup fd batch retrieval

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

commands: add LXC_CMD_GET_CGROUP_FD

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

commands: introduce rsp_many_fds()

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

commands: introduce rsp_one_fd()

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

commands: introduce lxc_cmd_rsp_send_reap()

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

commands: be more explicit during command processing

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

state: _never_ return NULL from lxc_state2str()

Cc: Thomas Parrott <thomas.parrott@canonical.com>
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

cgroups: add cgroup_fds() helper

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

af_unix: improve SCM_RIGHTS file descriptor retrieval

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

commands: tweak validate_string_request()

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

commands: explicitly number enums

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

cgroups: close dfd_mon but keep dfd_con and dfd_lim open for all cgroup hierarchies

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

cgroups: start stashing all fds

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

cgroups: skip and warn about invalid file descriptors

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

memory_utils: fix close_equal()

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Merge pull request #3688 from brauner/2021-02-19/fixes_2

cgroups: rework cgroup initialization

cgroups: handle lxc.cgroup.use global parameter

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

cgroups: fix cg_legacy_freeze() return type

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

file_utils: tweak lxc_write_openat()

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

cgroups: improve utility controller handling

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

cgroups: s/cgroup2_chown/delegate/g

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

cgroups: move cgroup2 parameters into substruct

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

cgroups: s/container_limit_path/path_lim/g

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

cgroups: s/container_full_path/path_con/g

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

cgroups: s/cgfd_limit/dfd_lim/g

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

cgroups: s/cgfd_mon/dfd_mon/g

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

cgroups: s/cgfd_con/dfd_con/g

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

cgroups: s/mountpoint/at_mnt/g

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

cgroups: s/container_base_path/at_base/g

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

cgroups: rename cgroupfs mount fd

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

cgroups: simplify and fix mounting on non-cgroup namespace aware kernels

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

cgroups: introduce cgroup hierarchy type

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

cgroups: remove unused helpers

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

cgroups: s/add_hierarchy()/cgroup_hierarchy_add()/g

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

cgroups: split delegation checks into separate helpers

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

cgroups: simplify string list handling

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

cgroups: rework cgroup initialization

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

cgroups: split out unified cgroup helpers

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

memory_utils: adapt to new pointer error macros

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

macro: add pointer error encoding support

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

compiler: add likely() and unlikely() support

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

cgroups: s/basecginfo/cgroup_info/g

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

cgroups: simplify current cgroup retrieval on pure unified cgroup layouts

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

cgroups: tweak return values

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

cgroups: tweak lxc.cgroup.use handling in __cgroup_init()

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

cgroups: s/must_copy_string()/strdup()/g

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

cgroups: avoid additional variable for single access

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

cgroups: fix prune_init_scope()

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

string_utils: move lxc_iterate_parts()

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Merge pull request #3684 from brauner/2021-02-18/fixes_2

bpf: device cgroup improvements

Merge pull request #3687 from brauner/2021-02-19/fixes

lsm: fixes

doc: tweak cgroup headline

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

doc: epxlain eBPF-based device controller semantics

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

doc: add missing ".[controller file] suffix to lxc.cgroup{2}. key explanations

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

bpf: update device cgroup semantics

LXC has supported the bpf device controlller for a while now. A bpf device
program can be attached to the container's cgroup if this is a pure cgroup2
host.

The format for specifying device rules for the cgroup2 bpf device controller is
the same as for the legacy cgroup device controller; only the configuration key
prefix has to change. Specifically, device rules for the legacy cgroup device
controller are specified by via lxc.cgroup.devices.{allow,deny} whereas for the
cgroup2 bpf device controller lxc.cgroup2.devices.{allow,deny} must be used.

The following semantics apply:
1. The device rule "lxc.cgroup2.devices.deny = a" will cause LXC to instruct
   the kernel to block access to all devices by default. To grant access to
   devices "allow device rules" must be added via the
   "lxc.cgroup2.devices.allow" key. This is referred to as a "allowlist" device
   program.
2. The device rule "lxc.cgroup2.devices.allow = a" will cause LXC to instruct
   the kernel to allow access to all devices by default. To deny access to
   devices "deny device rules" must be added via "lxc.cgroup2.devices.deny"
   key. This is referred to as a "denylist" device program.
3. Specifying a rule as explained in 1. or 2. will cause all previous rules to
   be cleared, i.e. the device list will be reset.

For example the set of rules:

lxc.cgroup2.devices.deny = a
lxc.cgroup2.devices.allow = c *:* m
lxc.cgroup2.devices.allow = b *:* m
lxc.cgroup2.devices.allow = c 1:3 rwm

implements a "allowlist" device program, i.e. the kernel will block access to
all devices not specifically allowed in this list. This particular program
states that all character and block devices might be created but only /dev/null
might be read or written.

If we to switch to the set of rules to:

lxc.cgroup2.devices.allow = a
lxc.cgroup2.devices.deny = c *:* m
lxc.cgroup2.devices.deny = b *:* m
lxc.cgroup2.devices.deny = c 1:3 rwm

then LXC would instruct the kernel to implement a "denylist", i.e. the kernel
will allow access to all devices not specifically denied in this list. This
particular program states that no character devices or block devices might be
created and that /dev/null is not allow allowed to be read, written, or
created.

Consider the same program but followed by a rule as explained in 1. or 2.:

lxc.cgroup2.devices.allow = a
lxc.cgroup2.devices.deny = c *:* m
lxc.cgroup2.devices.deny = b *:* m
lxc.cgroup2.devices.deny = c 1:3 rwm
lxc.cgroup2.devices.allow = a

The last line will cause LXC to reset the device list without changing the type
of device program.

lxc.cgroup2.devices.allow = a
lxc.cgroup2.devices.deny = c *:* m
lxc.cgroup2.devices.deny = b *:* m
lxc.cgroup2.devices.deny = c 1:3 rwm
lxc.cgroup2.devices.deny = a

The last line will cause LXC to reset the device list and switch from a
"allowlist" program to a "denylist" program.

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

cgroups: tweak bpf_device_cgroup_prepare()

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

conf: expose lxc_clear_cgroup2_devices()

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

conf: improve lxc_clear_cgroups()

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

bpf: fix typos

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

bpf: comment bpf_cgroup_devices_update()

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

commands: only update bpf device program if really needed

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

cgroups: make device cgroup handling smarter and simpler

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

cgroups: ensure no garbage is returned

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

lsm: twek apparmor_process_label_get()

Fixes: Coverity 1473189
Fixes: Coverity 1473190
Fixes: 47f4914d88df ("apparmor: prefer /proc/.../attr/apparmor/current over legacy interface")
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

file_utils: allow fd_to_buf() to fail for real

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Merge pull request #3686 from cyphar/apparmor-attr-subdir

apparmor: prefer /proc/.../attr/apparmor/current over legacy interface

apparmor: prefer /proc/.../attr/apparmor/current over legacy interface

It turns out that since Linux 5.1 there are now per-LSM subdirectories
for major LSMs, which users are recommended to use over the "legacy"
top-level /proc/$pid/attr/... files[1]:

> Process attributes associated with “major” security modules should be
> accessed and maintained using the special files in /proc/.../attr. A
> security module may maintain a module specific subdirectory there,
> named after the module. /proc/.../attr/smack is provided by the Smack
> security module and contains all its special files. The files directly
> in /proc/.../attr remain as legacy interfaces for modules that provide
> subdirectories.

AppArmor has had such a directory since Linux 5.8[2], and it turns out
that with certain CONFIG_LSM configurations you can end up with AppArmor
files not being accessible from the legacy interface. Arch Linux
recently added BPF as one of the enabled LSM in their configuration, and
this broke runc[3] and LXC.

The solution is to first try to use /proc/$pid/attr/apparmor/current and
fall back to /proc/$pid/attr/current if the former is not available.

[1]: https://www.kernel.org/doc/html/latest/admin-guide/LSM/index.html
[2]: Linux 5.8 ; commit 6413f852ce08 ("apparmor: add proc subdir to attrs")
[3]: https://github.com/opencontainers/runc/issues/2801

Signed-off-by: Aleksa Sarai <cyphar@cyphar.com>

apparmor: clean up apparmor_process_label_get

Rather than open-coding file reading and retry semantics and
implementing the path generation logic separately to
apparmor_process_label_fd_get, refactor the logic so that it looks
closer to the pidfd version.

This will make it easier to implement the two-step handling for
/proc/self/attr/apparmor/current and makes this code slightly less
confusing.

Signed-off-by: Aleksa Sarai <cyphar@cyphar.com>

Merge pull request #3681 from brauner/2021-02-18/cgroups

cgroups: fixes & bpf rework

Merge pull request #3682 from brauner/2021-02-18/fixes

console: fixes

conf: don't log garbage

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

start: fix non-daemonized and application containers

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

conf: use saner mode for console

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

bpf: simplify bpf (device) program freeing

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

bpf: make bpf_program_cgroup_attach() static

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

bpf: prevent double-close

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

cgroups: use close_equal() and free_equal()

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

memory_utils: add close_equal() and free_equal()

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

lxccontainer: fix reboot logging

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

bpf: rework live device cgroup update

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

compiler: fix fallthrough attribute

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

bpf: fix return values in bpf_program_cgroup_attach()

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

bpf: let bpf_list_add_device() take the device list directly

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>