]>
git.ipfire.org Git - thirdparty/lxc.git/log
Christian Brauner [Mon, 15 Feb 2021 16:02:55 +0000 (17:02 +0100)]
confile: forbid absolute paths in config items that modify the cgroup layout
This is not a safety measure but merely is supposed to raise awareness that
these paths are always relative to the cgroup root as determined by
lxc.cgroup.relative.
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Christian Brauner [Mon, 15 Feb 2021 15:49:09 +0000 (16:49 +0100)]
confile: forbid walking upwards for confile items that modify cgroup layout
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Christian Brauner [Mon, 15 Feb 2021 16:53:58 +0000 (17:53 +0100)]
confile_utils: normalize paths in config items
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Christian Brauner [Mon, 15 Feb 2021 15:36:39 +0000 (16:36 +0100)]
confile: use set_config_path_item() for most cgroup layout modifiers
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Stéphane Graber [Mon, 15 Feb 2021 17:08:01 +0000 (12:08 -0500)]
Merge pull request #3673 from brauner/2021-02-15/nesting
cgroups: first batch of cgroup mounting fixes
Christian Brauner [Mon, 15 Feb 2021 14:07:02 +0000 (15:07 +0100)]
cgroupfs: rework cgroup2 mounting
We now explicitly refuse to mount cgroups on pure unified layouts when the
container is not running in a separate cgroup namespace. This is not a
regression since we simply always failed before anyway. I will likely fix this
very soon though. But there are bigger fish to fry currently.
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Christian Brauner [Mon, 15 Feb 2021 12:58:10 +0000 (13:58 +0100)]
cgroups: log early return
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Christian Brauner [Mon, 15 Feb 2021 12:54:51 +0000 (13:54 +0100)]
cgroups: s/__cg_mount_direct()/__cgroupfs_mount()/g
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Christian Brauner [Mon, 15 Feb 2021 12:54:10 +0000 (13:54 +0100)]
cgroups: strip LXC_AUTO_CGROUP_MIXED and LXC_AUTO_CGROUP_FULL_MIXED when cgroup namespaces are supported and used
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Christian Brauner [Mon, 15 Feb 2021 12:45:45 +0000 (13:45 +0100)]
cgroups: fix flag checking in legacy mount paths
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Christian Brauner [Mon, 15 Feb 2021 12:44:24 +0000 (13:44 +0100)]
cgroups: s/cg_mount_cgroup_full()/cgroupfs_bind_mount()/g
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Christian Brauner [Mon, 15 Feb 2021 12:42:40 +0000 (13:42 +0100)]
cgroups: s/cg_mount_in_cgroup_namespace()/cgroupfs_mount()/g
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Christian Brauner [Mon, 15 Feb 2021 12:41:02 +0000 (13:41 +0100)]
conf: remove wrong comment
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Christian Brauner [Mon, 15 Feb 2021 12:36:49 +0000 (13:36 +0100)]
cgroups: switch to flag-based checking
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Christian Brauner [Mon, 15 Feb 2021 12:25:00 +0000 (13:25 +0100)]
cgroups: don't strip LXC_AUTO_CGROUP_FORCE
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Christian Brauner [Mon, 15 Feb 2021 12:23:51 +0000 (13:23 +0100)]
cgroups: make clear that a flag argument is passed to cgroup mount functions
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Christian Brauner [Mon, 15 Feb 2021 11:29:47 +0000 (12:29 +0100)]
utils: add development helper to quickly dump a directories contents
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Christian Brauner [Mon, 15 Feb 2021 11:23:36 +0000 (12:23 +0100)]
cgroups: improve cgroup mounting
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Christian Brauner [Mon, 15 Feb 2021 11:05:20 +0000 (12:05 +0100)]
cgroups: verify that we are actually running in cgroup namespace
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Christian Brauner [Mon, 15 Feb 2021 10:57:31 +0000 (11:57 +0100)]
cgroups: pass handler to cgroup mount() method
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Christian Brauner [Mon, 15 Feb 2021 10:55:33 +0000 (11:55 +0100)]
conf: don't pass conf separately to lxc_mount_auto_mounts()
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Christian Brauner [Mon, 15 Feb 2021 10:47:53 +0000 (11:47 +0100)]
cgroups: move cgns_supported() to cgroup utilities
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Stéphane Graber [Sun, 14 Feb 2021 20:38:58 +0000 (15:38 -0500)]
Merge pull request #3672 from brauner/2021-02-14/fixes
start: small fixes
Christian Brauner [Sun, 14 Feb 2021 19:45:22 +0000 (20:45 +0100)]
start: fix comment about time namespace preservation
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Christian Brauner [Sun, 14 Feb 2021 19:44:57 +0000 (20:44 +0100)]
start: improve comment in lxc_spawn()
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Christian Brauner [Sun, 14 Feb 2021 19:44:18 +0000 (20:44 +0100)]
start: improve comments
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Christian Brauner [Sun, 14 Feb 2021 19:41:50 +0000 (20:41 +0100)]
start: improve namespace preservation
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Christian Brauner [Sun, 14 Feb 2021 19:36:25 +0000 (20:36 +0100)]
start: fix error handling and improve comment
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Stéphane Graber [Sun, 14 Feb 2021 15:55:54 +0000 (10:55 -0500)]
Merge pull request #3671 from brauner/2021-02-14/namespace_hooks
hooks: rework exposing namespace information
Christian Brauner [Sun, 14 Feb 2021 13:07:44 +0000 (14:07 +0100)]
network: expose namespace fd paths to network hooks
Closes: #3667
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Christian Brauner [Sun, 14 Feb 2021 13:03:07 +0000 (14:03 +0100)]
start: rework namespace preservation and path creation for hooks
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Stéphane Graber [Sun, 14 Feb 2021 00:02:22 +0000 (19:02 -0500)]
Merge pull request #3670 from brauner/2021-02-13/fixes
tree-wide: convert to strequal() and strnequal()
Christian Brauner [Sat, 13 Feb 2021 20:37:47 +0000 (21:37 +0100)]
utils: convert to strequal()
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Christian Brauner [Sat, 13 Feb 2021 20:37:05 +0000 (21:37 +0100)]
seccomp: convert to strequal()
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Christian Brauner [Sat, 13 Feb 2021 20:36:14 +0000 (21:36 +0100)]
lxccontainer: convert to strequal()
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Christian Brauner [Sat, 13 Feb 2021 20:35:45 +0000 (21:35 +0100)]
lsm: convert to strequal()
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Christian Brauner [Sat, 13 Feb 2021 20:35:19 +0000 (21:35 +0100)]
freezer: convert to strequal()
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Christian Brauner [Sat, 13 Feb 2021 20:35:01 +0000 (21:35 +0100)]
file_utils: convert to strequal()
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Christian Brauner [Sat, 13 Feb 2021 20:34:33 +0000 (21:34 +0100)]
confile_utils: convert to strequal()
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Christian Brauner [Sat, 13 Feb 2021 20:33:58 +0000 (21:33 +0100)]
confile: convert to strequal()
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Christian Brauner [Sat, 13 Feb 2021 20:33:01 +0000 (21:33 +0100)]
conf: convert to strequal()
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Christian Brauner [Sat, 13 Feb 2021 20:32:20 +0000 (21:32 +0100)]
cgroups: convert to strequal()
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Christian Brauner [Sat, 13 Feb 2021 20:31:06 +0000 (21:31 +0100)]
attach: convert to strequal()
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Christian Brauner [Sat, 13 Feb 2021 20:30:50 +0000 (21:30 +0100)]
utils: convert to strequal()
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Christian Brauner [Sat, 13 Feb 2021 20:30:11 +0000 (21:30 +0100)]
terminal: convert to strequal()
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Christian Brauner [Sat, 13 Feb 2021 20:29:51 +0000 (21:29 +0100)]
string_utils: convert to strequal()
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Christian Brauner [Sat, 13 Feb 2021 20:28:46 +0000 (21:28 +0100)]
state: convert to strequal()
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Christian Brauner [Sat, 13 Feb 2021 20:28:29 +0000 (21:28 +0100)]
start: convert to strequal()
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Christian Brauner [Sat, 13 Feb 2021 20:27:53 +0000 (21:27 +0100)]
namespace: convert to strequal()
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Christian Brauner [Sat, 13 Feb 2021 20:27:35 +0000 (21:27 +0100)]
seccomp: convert to strequal()
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Christian Brauner [Sat, 13 Feb 2021 20:26:26 +0000 (21:26 +0100)]
network: convert to strequal()
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Christian Brauner [Sat, 13 Feb 2021 20:40:20 +0000 (21:40 +0100)]
lxccontainer: convert to strequal()
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Christian Brauner [Sat, 13 Feb 2021 20:24:16 +0000 (21:24 +0100)]
lsm: convert to strequal()
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Christian Brauner [Sat, 13 Feb 2021 20:23:01 +0000 (21:23 +0100)]
log: convert to strequal()
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Christian Brauner [Sat, 13 Feb 2021 20:22:35 +0000 (21:22 +0100)]
initutils: convert to strequal()
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Christian Brauner [Sat, 13 Feb 2021 20:21:58 +0000 (21:21 +0100)]
criu: convert to strequal()
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Christian Brauner [Sat, 13 Feb 2021 20:21:03 +0000 (21:21 +0100)]
confile_utils: convert to strequal()
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Christian Brauner [Sat, 13 Feb 2021 20:20:26 +0000 (21:20 +0100)]
confile: convert to strequal()
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Christian Brauner [Sat, 13 Feb 2021 20:16:18 +0000 (21:16 +0100)]
conf: convert to strequal()
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Christian Brauner [Sat, 13 Feb 2021 20:14:19 +0000 (21:14 +0100)]
cgroups: convert to strequal()
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Christian Brauner [Sat, 13 Feb 2021 20:12:45 +0000 (21:12 +0100)]
attach: convert to strequal()
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Stéphane Graber [Thu, 11 Feb 2021 14:14:16 +0000 (09:14 -0500)]
Merge pull request #3666 from brauner/2021-02-11/fixes
Improved mount api support checking & console setup hardening
Christian Brauner [Thu, 11 Feb 2021 13:51:46 +0000 (14:51 +0100)]
tree-wide: rework mount api support checks
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Christian Brauner [Thu, 11 Feb 2021 13:42:55 +0000 (14:42 +0100)]
conf: introduce lxc_bind_mount_console()
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Christian Brauner [Thu, 11 Feb 2021 13:41:02 +0000 (14:41 +0100)]
macro: add LXC_PROC_SELF_FD_LEN
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Christian Brauner [Thu, 11 Feb 2021 13:40:41 +0000 (14:40 +0100)]
file_utils: add same_file_lax()
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Christian Brauner [Thu, 11 Feb 2021 13:40:17 +0000 (14:40 +0100)]
string_utils: add fdstr()
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Christian Brauner [Thu, 11 Feb 2021 13:39:58 +0000 (14:39 +0100)]
string_utils: add proc_self_fd()
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Christian Brauner [Thu, 11 Feb 2021 13:39:20 +0000 (14:39 +0100)]
memory_utils: add close_move_fd()
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Stéphane Graber [Thu, 11 Feb 2021 12:59:48 +0000 (07:59 -0500)]
Merge pull request #3665 from brauner/2021-02-11/fixes
tree-wide: fixes
Christian Brauner [Thu, 11 Feb 2021 09:51:54 +0000 (10:51 +0100)]
utils: convert to strnprintf()
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Christian Brauner [Thu, 11 Feb 2021 09:49:10 +0000 (10:49 +0100)]
string_utils: convert to strnprintf()
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Christian Brauner [Thu, 11 Feb 2021 09:48:07 +0000 (10:48 +0100)]
terminal: convert to strnprintf()
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Christian Brauner [Thu, 11 Feb 2021 09:47:38 +0000 (10:47 +0100)]
start: convert to strnprintf()
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Christian Brauner [Thu, 11 Feb 2021 09:46:47 +0000 (10:46 +0100)]
seccomp: convert to strnprintf()
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Christian Brauner [Thu, 11 Feb 2021 09:45:14 +0000 (10:45 +0100)]
rexec: convert to strnprintf()
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Christian Brauner [Thu, 11 Feb 2021 09:44:38 +0000 (10:44 +0100)]
network: convert to strnprintf()
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Christian Brauner [Thu, 11 Feb 2021 09:42:22 +0000 (10:42 +0100)]
mount_utils: convert to strnprintf()
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Christian Brauner [Thu, 11 Feb 2021 09:41:52 +0000 (10:41 +0100)]
monitor: convert to strnprintf()
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Christian Brauner [Thu, 11 Feb 2021 09:40:56 +0000 (10:40 +0100)]
lxclock: convert to strnprintf()
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Christian Brauner [Thu, 11 Feb 2021 09:40:00 +0000 (10:40 +0100)]
lxccontainer: convert to strnprintf()
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Christian Brauner [Thu, 11 Feb 2021 09:32:22 +0000 (10:32 +0100)]
log: convert to strnprintf()
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Christian Brauner [Thu, 11 Feb 2021 09:30:38 +0000 (10:30 +0100)]
file_utils: convert to strnprintf()
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Christian Brauner [Thu, 11 Feb 2021 09:29:59 +0000 (10:29 +0100)]
criu: convert to strnprintf()
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Christian Brauner [Thu, 11 Feb 2021 09:28:07 +0000 (10:28 +0100)]
confile_utils: convert to strnprintf()
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Christian Brauner [Thu, 11 Feb 2021 09:27:06 +0000 (10:27 +0100)]
confile: convert to strnprintf()
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Christian Brauner [Thu, 11 Feb 2021 09:24:18 +0000 (10:24 +0100)]
conf: convert to strnprintf()
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Christian Brauner [Thu, 11 Feb 2021 09:18:41 +0000 (10:18 +0100)]
commands_utils: convert to strnprintf()
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Christian Brauner [Thu, 11 Feb 2021 09:16:34 +0000 (10:16 +0100)]
attach: convert to strnprintf()
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Christian Brauner [Thu, 11 Feb 2021 09:15:15 +0000 (10:15 +0100)]
cgroups: convert to strnprintf()
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Christian Brauner [Thu, 11 Feb 2021 09:14:34 +0000 (10:14 +0100)]
string_utils: add wrapper for snprintf()
This let's us avoid the tedious
if (ret < 0 || (size_t)ret >= sizeof(buf))
style of error checking.
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Stéphane Graber [Wed, 10 Feb 2021 20:52:59 +0000 (15:52 -0500)]
Merge pull request #3664 from brauner/2021-02-10/fixes
cgroups: fixes
Christian Brauner [Wed, 10 Feb 2021 19:18:37 +0000 (20:18 +0100)]
cgroups: log container process entering
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Christian Brauner [Wed, 10 Feb 2021 19:17:32 +0000 (20:17 +0100)]
cgroups: log monitor and transient process entering
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Christian Brauner [Wed, 10 Feb 2021 19:15:48 +0000 (20:15 +0100)]
cgroups: do not return early when entering monitor cgroups
This will happen when restoring a container via criu.
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Christian Brauner [Wed, 10 Feb 2021 19:14:38 +0000 (20:14 +0100)]
cgroups: use brackets to have clear semantics for flags checking
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Stéphane Graber [Wed, 10 Feb 2021 18:41:07 +0000 (13:41 -0500)]
Merge pull request #3663 from brauner/2021-02-10/fixes
criu: fixes
Christian Brauner [Wed, 10 Feb 2021 12:21:25 +0000 (13:21 +0100)]
criu: handle new cgroup layout
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Christian Brauner [Wed, 10 Feb 2021 12:12:47 +0000 (13:12 +0100)]
criu: lxc_init() already initializes cgroups
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Christian Brauner [Wed, 10 Feb 2021 12:03:06 +0000 (13:03 +0100)]
criu: warn about cgroup hierarchies without controllers
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>