Skip to content

L
lxc
Commit 8f818a84 by Maximilian Blenk
Options

container.conf: Add option to disable session keyring creation

lxc set's up a new session keyring for every container by default. There might be valid use-cases where this is not wanted / needed (e.g. systemd by default creates a new session keyring anyway). Signed-off-by: 's avatarMaximilian Blenk <Maximilian.Blenk@bmw.de>
parent 4fef78bc
Showing with 62 additions and 28 deletions
src/lxc/conf.c
......@@ -2743,6 +2743,7 @@ struct lxc_conf *lxc_conf_init(void)
lxc_list_init(&new->lsm_aa_raw);
new->lsm_se_context = NULL;
new->lsm_se_keyring_context = NULL;
new->keyring_disable_session = false;
new->tmp_umount_proc = false;
new->tmp_umount_proc = 0;
new->shmount.path_host = NULL;
......@@ -3550,15 +3551,17 @@ int lxc_setup(struct lxc_handler *handler)
}
}
if (lxc_conf->lsm_se_keyring_context) {
keyring_context = lxc_conf->lsm_se_keyring_context;
} else if (lxc_conf->lsm_se_context) {
keyring_context = lxc_conf->lsm_se_context;
}
if (!lxc_conf->keyring_disable_session) {
if (lxc_conf->lsm_se_keyring_context) {
keyring_context = lxc_conf->lsm_se_keyring_context;
} else if (lxc_conf->lsm_se_context) {
keyring_context = lxc_conf->lsm_se_context;
}
ret = lxc_setup_keyring(keyring_context);
if (ret < 0)
return -1;
ret = lxc_setup_keyring(keyring_context);
if (ret < 0)
return -1;
}
if (handler->ns_clone_flags & CLONE_NEWNET) {
ret = lxc_setup_network_in_child_namespaces(lxc_conf,
......
src/lxc/conf.h
......@@ -299,6 +299,7 @@ struct lxc_conf {
struct lxc_list lsm_aa_raw;
char *lsm_se_context;
char *lsm_se_keyring_context;
bool keyring_disable_session;
bool tmp_umount_proc;
struct lxc_seccomp seccomp;
int maincmd_fd;
......
src/lxc/confile.c
......@@ -89,6 +89,7 @@ lxc_config_define(init_cmd);
lxc_config_define(init_cwd);
lxc_config_define(init_gid);
lxc_config_define(init_uid);
lxc_config_define(keyring_session);
lxc_config_define(log_file);
lxc_config_define(log_level);
lxc_config_define(log_syslog);
......@@ -188,6 +189,7 @@ static struct lxc_config_t config_jump_table[] = {
{ "lxc.init.gid", set_config_init_gid, get_config_init_gid, clr_config_init_gid, },
{ "lxc.init.uid", set_config_init_uid, get_config_init_uid, clr_config_init_uid, },
{ "lxc.init.cwd", set_config_init_cwd, get_config_init_cwd, clr_config_init_cwd, },
{ "lxc.keyring.session", set_config_keyring_session, get_config_keyring_session, clr_config_keyring_session },
{ "lxc.log.file", set_config_log_file, get_config_log_file, clr_config_log_file, },
{ "lxc.log.level", set_config_log_level, get_config_log_level, clr_config_log_level, },
{ "lxc.log.syslog", set_config_log_syslog, get_config_log_syslog, clr_config_log_syslog, },
......@@ -1477,6 +1479,12 @@ static int set_config_selinux_context_keyring(const char *key, const char *value
return set_config_string_item(&lxc_conf->lsm_se_keyring_context, value);
}
static int set_config_keyring_session(const char *key, const char *value,
struct lxc_conf *lxc_conf, void *data)
{
return set_config_bool_item(&lxc_conf->keyring_disable_session, value, false);
}
static int set_config_log_file(const char *key, const char *value,
struct lxc_conf *c, void *data)
{
......@@ -2547,26 +2555,7 @@ static int set_config_rootfs_path(const char *key, const char *value,
static int set_config_rootfs_managed(const char *key, const char *value,
struct lxc_conf *lxc_conf, void *data)
{
unsigned int val = 0;
if (lxc_config_value_empty(value)) {
lxc_conf->rootfs.managed = true;
return 0;
}
if (lxc_safe_uint(value, &val) < 0)
return -EINVAL;
switch (val) {
case 0:
lxc_conf->rootfs.managed = false;
return 0;
case 1:
lxc_conf->rootfs.managed = true;
return 0;
}
return -EINVAL;
return set_config_bool_item(&lxc_conf->rootfs.managed, value, true);
}
static int set_config_rootfs_mount(const char *key, const char *value,
......@@ -3553,6 +3542,12 @@ static int get_config_selinux_context_keyring(const char *key, char *retv, int i
return lxc_get_conf_str(retv, inlen, c->lsm_se_keyring_context);
}
static int get_config_keyring_session(const char *key, char *retv, int inlen,
struct lxc_conf *c, void *data)
{
return lxc_get_conf_bool(c, retv, inlen, c->keyring_disable_session);
}
/* If you ask for a specific cgroup value, i.e. lxc.cgroup.devices.list, then
* just the value(s) will be printed. Since there still could be more than one,
......@@ -4428,6 +4423,13 @@ static inline int clr_config_selinux_context_keyring(const char *key,
return 0;
}
static inline int clr_config_keyring_session(const char *key,
struct lxc_conf *c, void *data)
{
c->keyring_disable_session = false;
return 0;
}
static inline int clr_config_cgroup_controller(const char *key,
struct lxc_conf *c, void *data)
{
......@@ -6015,6 +6017,8 @@ int lxc_list_subkeys(struct lxc_conf *conf, const char *key, char *retv,
strprint(retv, inlen, "order\n");
} else if (!strcmp(key, "lxc.monitor")) {
strprint(retv, inlen, "unshare\n");
} else if (!strcmp(key, "lxc.keyring")) {
strprint(retv, inlen, "session\n");
} else {
fulllen = -1;
}
......
src/lxc/confile_utils.c
......@@ -649,6 +649,30 @@ int set_config_path_item(char **conf_item, const char *value)
return set_config_string_item_max(conf_item, value, PATH_MAX);
}
int set_config_bool_item(bool *conf_item, const char *value, bool empty_conf_action)
{
unsigned int val = 0;
if (lxc_config_value_empty(value)) {
*conf_item = empty_conf_action;
return 0;
}
if (lxc_safe_uint(value, &val) < 0)
return -EINVAL;
switch (val) {
case 0:
*conf_item = false;
return 0;
case 1:
*conf_item = true;
return 0;
}
return -EINVAL;
}
int config_ip_prefix(struct in_addr *addr)
{
if (IN_CLASSA(addr->s_addr))
......
src/lxc/confile_utils.h
......@@ -51,6 +51,8 @@ extern int set_config_string_item(char **conf_item, const char *value);
extern int set_config_string_item_max(char **conf_item, const char *value,
size_t max);
extern int set_config_path_item(char **conf_item, const char *value);
extern int set_config_bool_item(bool *conf_item, const char *value,
bool empty_conf_action);
extern int config_ip_prefix(struct in_addr *addr);
extern int network_ifname(char *valuep, const char *value, size_t size);
extern void rand_complete_hwaddr(char *hwaddr);
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment