container start: clone newcgroup immediately

rather than waiting and later unsharing. This "makes the creation of a new cgroup early enough that the existing cgroup mounts are visible. Which means any fancy permission checks I dream will work on a future version of liblxc." This also includes what should be a tiny improvement regarding netns, though it's conceivable it'll break something. Remember that with new kernels we need to unshare netns after we've become the root user in the new userns, so that netns files are owned by that root. But we were passing the unfiltered handler->clone_flags to the original clone(). This just resulted in a temporary extra netns generation, but still worked since our target netns, which we passed our devices into, was created late enough. Signed-off-by: Serge Hallyn <serge@hallyn.com> Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>

container start: clone newcgroup immediately
ff074c81 · Serge Hallyn · Stéphane Graber · 8511da27 · ff074c81
Commit ff074c81 authored Jun 25, 2016 by Serge Hallyn Committed by Stéphane Graber Nov 17, 2016
Hide whitespace changes
Inline Side-by-side

Showing with 5 additions and 6 deletions

start.c src/lxc/start.c +5 -6

No files found.
--- a/src/lxc/start.c
+++ b/src/lxc/start.c
@@ -909,11 +909,6 @@ static int do_start(void *data)
 		devnull_fd = -1;
 	}
-	if (cgns_supported() && unshare(CLONE_NEWCGROUP) != 0) {
-		SYSERROR("Failed to unshare cgroup namespace");
-		goto out_warn_father;
-	}
 	setsid();
 	/* after this call, we are in error because this
@@ -1136,7 +1131,11 @@ static int lxc_spawn(struct lxc_handler *handler)
 	flags = handler->clone_flags;
 	if (handler->clone_flags & CLONE_NEWUSER)
 		flags &= ~CLONE_NEWNET;
-	handler->pid = lxc_clone(do_start, handler, handler->clone_flags);
+	if (cgns_supported()) {
+		handler->clone_flags |= CLONE_NEWCGROUP;
+		flags |= CLONE_NEWCGROUP;
+	}
+	handler->pid = lxc_clone(do_start, handler, flags);
 	if (handler->pid < 0) {
 		SYSERROR("failed to fork into a new namespace");
 		goto out_delete_net;