Commits · 04017a652238e51869f9b196845db9423bd2fc0b · Chen Yisong / lxc

31 Jul, 2018 24 commits

nl: avoid NULL pointer dereference · 04017a65

authored Jul 29, 2018

It's a valid case to call nla_put() with NULL data and 0 len. It's done e.g. in
the nla_put_attr().

There has to be a check for data in nla_put() as passing NULL to the memcpy()
is not allowed. Even if length is 0, both pointers have to be valid.

For a reference see C99 standard (7.21.1/2), it says: "pointer arguments on
such a call shall still have valid values".
Reported-by: Daniel Gimpelevich <daniel@gimpelevich.san-francisco.ca.us>
Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
[christian.brauner@ubuntu.com: adapted commit message]
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

04017a65

confile: split mount options into flags and data · 01ca5357
Christian Brauner authored Jul 29, 2018
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
01ca5357
conf: improve rootfs setup · 55a8306f
Christian Brauner authored Jul 29, 2018
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
55a8306f
Fix license of the nvidia hook · bd5580f3
Felix Abecassis authored Jul 28, 2018
```
Fixes: #2494
Signed-off-by: Felix Abecassis <fabecassis@nvidia.com>
```
bd5580f3

autotools: default to -Wvla -std=gnu11 · d53959fe

authored Jul 26, 2018

We can't really support anything less than gcc-4.8 anyway.
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

d53959fe

include: remove VLAs · 0c127b6e
Christian Brauner authored Jul 26, 2018
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
0c127b6e
utils: s/strtok_r()/lxc_iterate_parts()/g · 1c049676
Christian Brauner authored Jul 26, 2018
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
1c049676
tools: s/strtok_r()/lxc_iterate_parts()/g · 3eb0d9b3
Christian Brauner authored Jul 26, 2018
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
3eb0d9b3
storage: s/strtok_r()/lxc_iterate_parts()/g · 160da882
Christian Brauner authored Jul 26, 2018
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
160da882
state: s/strtok_r()/lxc_iterate_parts()/g · 60ca579b
Christian Brauner authored Jul 26, 2018
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
60ca579b
parse: s/strtok_r()/lxc_iterate_parts()/g · a5f46d80
Christian Brauner authored Jul 26, 2018
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
a5f46d80
namespace: s/strtok_r()/lxc_iterate_parts()/g · c195f854
Christian Brauner authored Jul 26, 2018
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
c195f854
lxccontainer: s/strtok_r()/lxc_iterate_parts()/g · fc6d8aea
Christian Brauner authored Jul 26, 2018
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
fc6d8aea
confile: s/strtok_r()/lxc_iterate_parts()/g · 9fee218f
Christian Brauner authored Jul 26, 2018
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
9fee218f
conf: s/strtok_r()/lxc_iterate_parts()/g · 69795191
Christian Brauner authored Jul 26, 2018
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
69795191
cgroups: s/strtok_r()/lxc_iterate_parts() · 821a008d
Christian Brauner authored Jul 26, 2018
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
821a008d
utils: add lxc_iterate_parts() · c97e6a4b
Christian Brauner authored Jul 26, 2018
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
c97e6a4b

apparmor: allow start-container to change to lxc-** · 28f9a704

authored Jul 24, 2018

For generated profiles with apparmor namespaces we get
profile names with slashes in them. To match those, we need
to allow changing to lxc-**, not just lxc-*.
Signed-off-by: Wolfgang Bumiller <w.bumiller@proxmox.com>

28f9a704

apparmor: update current profiles · 296f7311

authored Jul 25, 2018

remove cgmanager rules and add fstype=cgroup2 variants for
the existing fstype=cgroup rules
Signed-off-by: Wolfgang Bumiller <w.bumiller@proxmox.com>

296f7311

utils: add must_concat helper · 99b7f9db
Wolfgang Bumiller authored Jul 18, 2018
```
Signed-off-by: Wolfgang Bumiller <w.bumiller@proxmox.com>
```
99b7f9db
apparmor: use fopen_cloexec · f6eea250
Wolfgang Bumiller authored Jul 25, 2018
```
Signed-off-by: Wolfgang Bumiller <w.bumiller@proxmox.com>
```
f6eea250

lsm: fixup lsm_process_label_set_at return values · 28968d7d

authored Jul 12, 2018

Always return -1 on error (some code paths returned -1, some
returned negative error codes), don't assume 'errno' is set
afterwards, as the function already prints errors and not
all code paths will have a usable errno value.
Signed-off-by: Wolfgang Bumiller <w.bumiller@proxmox.com>

28968d7d

tests: lxc-test-apparmor-mount: check environment early · 11c52cb4

authored Jul 24, 2018

don't kill all my processes when running it as user...
Signed-off-by: Wolfgang Bumiller <w.bumiller@proxmox.com>

11c52cb4

tests: lxc-test-apparmor-mount: show a log on error · 7d08ed65
Wolfgang Bumiller authored Jul 23, 2018
```
Signed-off-by: Wolfgang Bumiller <w.bumiller@proxmox.com>
```
7d08ed65

24 Jul, 2018 16 commits
- confile: add missing header · 4d879838
  Christian Brauner authored Jul 22, 2018
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  4d879838
- change log macro of error case from lxc_ambient_caps_up/down · 46b217d7
  2xsec authored Jul 22, 2018
```
Signed-off-by: 2xsec <dh48.jeong@samsung.com>
```
  46b217d7
- docs: tools: -d/--daemonize for lxc-execute · 8713009e
  2xsec authored Jul 22, 2018
```
Signed-off-by: 2xsec <dh48.jeong@samsung.com>
```
  8713009e
- coverity: #1438067 · 4819db24
  2xsec authored Jul 21, 2018
```
Explicit null dereferenced
Signed-off-by: 2xsec <dh48.jeong@samsung.com>
```
  4819db24
- thread safe: rand() => rand_r() · 03df81a4
  2xsec authored Jul 21, 2018
```
Signed-off-by: 2xsec <dh48.jeong@samsung.com>
```
  03df81a4
- attach: move errno handling · 431b95c4
  2xsec authored Jul 21, 2018
```
Signed-off-by: 2xsec <dh48.jeong@samsung.com>
```
  431b95c4
- docs: add long options of lxc-unshare · a71e32ca
  2xsec authored Jul 21, 2018
```
Signed-off-by: 2xsec <dh48.jeong@samsung.com>
```
  a71e32ca
- attach: fix return value & cleanups · a01dec48
  2xsec authored Jul 21, 2018
```
Signed-off-by: 2xsec <dh48.jeong@samsung.com>
```
  a01dec48
- af_unix: fix return value & cleanups · 96d48ff3
  2xsec authored Jul 21, 2018
```
Signed-off-by: 2xsec <dh48.jeong@samsung.com>
```
  96d48ff3
- lxccontainer: coding rules · cbeda582
  2xsec authored Jul 20, 2018
```
Signed-off-by: 2xsec <dh48.jeong@samsung.com>
```
  cbeda582
- confile_utils: fix return value & cleanups · 94d4ec34
  2xsec authored Jul 20, 2018
```
Signed-off-by: 2xsec <dh48.jeong@samsung.com>
```
  94d4ec34
- apparmor: Allow /usr/lib* paths for mount and pivot_root · 9748d3f1
  Markos Chandras authored Jul 19, 2018
```
openSUSE Leap 15 is using --libdir=/usr/lib64 when building for
x86_64 so we need to allow this path in the apparmor profiles.

Link: https://bugzilla.opensuse.org/show_bug.cgi?id=1099239Signed-off-by: Markos Chandras <mchandras@suse.de>
```
  9748d3f1
- conf: the atime flags are locked in userns · 53c1c865
  Christian Brauner authored Jul 18, 2018
```
This means they need to be added for remount and for fresh mounts.
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  53c1c865
- confile: move signal helpers to confile utils · 370caa51
  Christian Brauner authored Jul 16, 2018
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  370caa51
- coverity: #1437949 · 200c29b1
  2xsec authored Jul 15, 2018
```
Argument cannot be negative
Signed-off-by: 2xsec <dh48.jeong@samsung.com>
```
  200c29b1
- tools: lxc-unshare: use lxc list for interface names · 671df9f1
  2xsec authored Jul 14, 2018
```
Signed-off-by: 2xsec <dh48.jeong@samsung.com>
```
  671df9f1