Skip to content
Projects
Groups
Snippets
Help
This project
Loading...
Sign in / Register
Toggle navigation
L
lxc
Project
Overview
Details
Activity
Cycle Analytics
Repository
Repository
Files
Commits
Branches
Tags
Contributors
Graph
Compare
Charts
Issues
0
Issues
0
List
Board
Labels
Milestones
Merge Requests
0
Merge Requests
0
CI / CD
CI / CD
Pipelines
Jobs
Schedules
Charts
Wiki
Wiki
Snippets
Snippets
Members
Members
Collapse sidebar
Close sidebar
Activity
Graph
Charts
Create a new issue
Jobs
Commits
Issue Boards
Open sidebar
Chen Yisong
lxc
Commits
50e3e83d
Unverified
Commit
50e3e83d
authored
May 07, 2020
by
Christian Brauner
Browse files
Options
Browse Files
Download
Email Patches
Plain Diff
tree-wide: this is all rather TODO than FIXME
Signed-off-by:
Christian Brauner
<
christian.brauner@ubuntu.com
>
parent
424886b1
Hide whitespace changes
Inline
Side-by-side
Showing
3 changed files
with
6 additions
and
6 deletions
+6
-6
attach_options.h
src/lxc/attach_options.h
+1
-1
apparmor.c
src/lxc/lsm/apparmor.c
+4
-4
lxccontainer.h
src/lxc/lxccontainer.h
+1
-1
No files found.
src/lxc/attach_options.h
View file @
50e3e83d
...
...
@@ -26,7 +26,7 @@ enum {
/* The following are off by default: */
LXC_ATTACH_REMOUNT_PROC_SYS
=
0x00010000
,
/*!< Remount /proc filesystem */
LXC_ATTACH_LSM_NOW
=
0x00020000
,
/*!<
FIXME: unknown
*/
LXC_ATTACH_LSM_NOW
=
0x00020000
,
/*!<
TODO: currently unused
*/
/* Set PR_SET_NO_NEW_PRIVS to block execve() gainable privileges. */
LXC_ATTACH_NO_NEW_PRIVS
=
0x00040000
,
/*!< PR_SET_NO_NEW_PRIVS */
LXC_ATTACH_TERMINAL
=
0x00080000
,
/*!< Allocate new terminal for attached process. */
...
...
src/lxc/lsm/apparmor.c
View file @
50e3e83d
...
...
@@ -122,7 +122,7 @@ static const char AA_PROFILE_BASE[] =
" deny /sys/kernel/debug/{,**} rwklx,
\n
"
"
\n
"
" # allow paths to be made slave, shared, private or unbindable
\n
"
" #
FIXME
: This currently doesn't work due to the apparmor parser treating those as allowing all mounts.
\n
"
" #
TODO
: This currently doesn't work due to the apparmor parser treating those as allowing all mounts.
\n
"
"# mount options=(rw,make-slave) -> **,
\n
"
"# mount options=(rw,make-rslave) -> **,
\n
"
"# mount options=(rw,make-shared) -> **,
\n
"
...
...
@@ -343,7 +343,7 @@ static const char AA_PROFILE_NESTING_BASE[] =
" mount /var/lib/lxd/shmounts/ -> /var/lib/lxd/shmounts/,
\n
"
" mount options=bind /var/lib/lxd/shmounts/** -> /var/lib/lxd/**,
\n
"
"
\n
"
" #
FIXME
: There doesn't seem to be a way to ask for:
\n
"
" #
TODO
: There doesn't seem to be a way to ask for:
\n
"
" # mount options=(ro,nosuid,nodev,noexec,remount,bind),
\n
"
" # as we always get mount to $cdir/proc/sys with those flags denied
\n
"
" # So allow all mounts until that is straightened out:
\n
"
...
...
@@ -538,7 +538,7 @@ static inline char *apparmor_namespace(const char *ctname, const char *lxcpath)
return
full
;
}
/*
FIXME
: This is currently run only in the context of a constructor (via the
/*
TODO
: This is currently run only in the context of a constructor (via the
* initial lsm_init() called due to its __attribute__((constructor)), so we
* do not have ERROR/... macros available, so there are some fprintf(stderr)s
* in there.
...
...
@@ -560,7 +560,7 @@ static bool check_apparmor_parser_version()
lxc_pclose
(
parserpipe
);
/* We stay silent for now as this most likely means the shell
* lxc_popen executed failed to find the apparmor_parser binary.
* See the
FIXME
comment above for details.
* See the
TODO
comment above for details.
*/
return
false
;
}
...
...
src/lxc/lxccontainer.h
View file @
50e3e83d
...
...
@@ -90,7 +90,7 @@ struct lxc_container {
* \private
* Container configuration.
*
* \internal
FIXME
: do we want the whole lxc_handler?
* \internal
TODO
: do we want the whole lxc_handler?
*/
struct
lxc_conf
*
lxc_conf
;
...
...
Write
Preview
Markdown
is supported
0%
Try again
or
attach a new file
Attach a file
Cancel
You are about to add
0
people
to the discussion. Proceed with caution.
Finish editing this message first!
Cancel
Please
register
or
sign in
to comment