Commits · 11a2f972d2ce5dff76b09eec2425f41c59ef2bf6 · Chen Yisong / lxc · GitLab

26 Feb, 2021 40 commits
- file_utils: harden lxc_open_dirfd() · 11a2f972
  Christian Brauner authored Feb 02, 2021
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  11a2f972
- memory_utils: add close_prot_errno_mov() · 826de44f
  Christian Brauner authored Feb 02, 2021
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  826de44f
- attach: move loading seccomp as late as possible · f3b1c046
  Christian Brauner authored Feb 02, 2021
```
We want to minimize the change that the profile blocks syscalls we need during
attach setup and has the notifier enabled.
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  f3b1c046
- attach: move file descriptor closing into attach_context_container() · ec5ce3bb
  Christian Brauner authored Feb 02, 2021
```
This reduces the possibility of forgetting to close the namespace file
descriptors when we change this codepath.
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  ec5ce3bb
- attach: stricter lookup semantics for fdopen_at() calls · 639acb79
  Christian Brauner authored Feb 02, 2021
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  639acb79
- attach: use correct put method · 5d9569ca
  Christian Brauner authored Feb 01, 2021
```
Fixes: Coverity 1472763
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  5d9569ca
- attach: prevent UAF · 5e6b9c8a
  Christian Brauner authored Feb 01, 2021
```
Fixes: Coverity 1472761
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  5e6b9c8a
- attach: file descriptor based fdinfo handling · 35c672e8
  Christian Brauner authored Feb 01, 2021
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  35c672e8
- file_utils: remove O_NOFOLLOW from open_at() defaults · 60e1cd4e
  Christian Brauner authored Feb 01, 2021
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  60e1cd4e
- lsm: harden read_file_at() · d81eb918
  Christian Brauner authored Feb 01, 2021
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  d81eb918
- tree-wide: extend read_file_at() · 78a14d81
  Christian Brauner authored Feb 01, 2021
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  78a14d81
- attach: harden open calls · af0660e4
  Christian Brauner authored Feb 01, 2021
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  af0660e4
- syscall_wrappers: add PROTECT_LOOKUP, PROTECT_OPEN,… · 2aeb8b81
  Christian Brauner authored Feb 01, 2021
```
syscall_wrappers: add PROTECT_LOOKUP, PROTECT_OPEN, PROTECT_LOOKUP_WITH_SYMLINKS, PROTECT_OPEN_WITH_TRAILING_SYMLINKS
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  2aeb8b81
- file_utils: add open_at() · 73c476c5
  Christian Brauner authored Feb 01, 2021
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  73c476c5
- cgroups: remove pointless NULL checks · c6071562
  Christian Brauner authored Feb 01, 2021
```
We're already ensuring before that conf isn't NULL.
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  c6071562
- attach: stash host uid and host gid in attach_context · 07897df2
  Christian Brauner authored Feb 01, 2021
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  07897df2
- attach: document attach_context · 0c2b56fd
  Christian Brauner authored Feb 01, 2021
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  0c2b56fd
- attach: simplify opening of /proc/self · 58d62c86
  Christian Brauner authored Feb 01, 2021
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  58d62c86
- attach: move uid and gid handling to get_attach_context() · c793e9f3
  Christian Brauner authored Feb 01, 2021
```
the less we do in do_attach(), the better.
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  c793e9f3
- attach: initialize init_pid field to -ESRCH · 48fd08f9
  Christian Brauner authored Feb 01, 2021
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  48fd08f9
- attach: unifiy /proc/<init-pid>/status parsing · 18ed7fdc
  Christian Brauner authored Feb 01, 2021
```
and move it out of do_attach(). The less we do in the container's context the
better.
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  18ed7fdc
- file_utils: add fdopenat() · f3df6cf0
  Christian Brauner authored Feb 01, 2021
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  f3df6cf0
- lsm/apparmor: cleanup apparmor_process_label_set() · 7d9e64d8
  Christian Brauner authored Jan 31, 2021
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  7d9e64d8
- attach: hardening through use of pidfds · 3c6bc307
  Christian Brauner authored Jan 31, 2021
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  3c6bc307
- attach: file descriptors based LSM handling · a3d5e577
  Christian Brauner authored Jan 31, 2021
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  a3d5e577
- attach: don't needless check for NULL · 33afc644
  Christian Brauner authored Jan 30, 2021
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  33afc644
- cgroups: use cleanup macro for consistency · bdc9e48d
  Christian Brauner authored Jan 30, 2021
```
and to prevent future mishaps.
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  bdc9e48d
- cgroups: vet parameters more strictly · 0d657d6f
  Christian Brauner authored Jan 30, 2021
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  0d657d6f
- attach: init file descriptors to -EBADF · 6d1b54e7
  Christian Brauner authored Jan 29, 2021
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  6d1b54e7
- attach: move to file descriptor only namespace interactions · ea1b57df
  Christian Brauner authored Jan 29, 2021
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  ea1b57df
- attach: move to file descriptor-only interactions · b23d7e3e
  Christian Brauner authored Jan 29, 2021
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  b23d7e3e
- attach: rework attaching to namespace fds · 25b0a827
  Christian Brauner authored Jan 29, 2021
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  25b0a827
- attach: remove unneeded assignment · ee026aa0
  Christian Brauner authored Jan 29, 2021
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  ee026aa0
- attach: use STDIN_FILENO instead of hard-coding 0 · 64f221a1
  Christian Brauner authored Jan 29, 2021
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  64f221a1
- attach: move new_cwd into tighter scope · a8d63270
  Christian Brauner authored Jan 29, 2021
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  a8d63270
- attach: use dummy macros to make it easier to follow sync logic · 305a9b81
  Christian Brauner authored Jan 29, 2021
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  305a9b81
- attach: introduce sync_wait_fd() and sync_wake_fd() · 83742e7c
  Christian Brauner authored Jan 29, 2021
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  83742e7c
- sync: make all sync helpers return bool · b41057d3
  Christian Brauner authored Jan 29, 2021
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  b41057d3
- attach: introduce sync_wait_pid() and sync_wake_pid() · 025d7f87
  Christian Brauner authored Jan 29, 2021
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  025d7f87
- attach: use sync_wait()/sync_wake() where applicable · 909241f9
  Christian Brauner authored Jan 29, 2021
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  909241f9