- 21 Nov, 2013 2 commits
-
-
Serge Hallyn authored
If the container is dir-backed, we don't actually mount it (to support unprivileged use). So always set the LXC_ROOTFS_MOUNT to bdev->dest, not to the rootfs path specified in the container configuration. This should fix bug http://pad.lv/1253573Signed-off-by:
Serge Hallyn <serge.hallyn@ubuntu.com> Acked-by:
Stéphane Graber <stgraber@ubuntu.com>
-
Michael H. Warfield authored
If autodev is not specifically set to 0 or 1, attempts to determine if systemd is being utilized and forces autodev=1 to prevent host system conflicts and collisions. If autodev is enabled and the host /dev is mounted with devtmpfs or /dev/.lxc is mounted with another file system... Each container created by a privileged user gets a /dev directory mapped off the host /dev here: /dev/.lxc/${name}.$( hash $lxcpath/$name ) Each container created by a non-privileged user gets a /dev/directory mapped off the host /dev here: /dev/.lxc/user/${name}.$( hash $lxcpath/$name ) The /dev/.lxc/user is mode 1777 to allow unpriv access. The /dev/.lxc/{containerdev} is bind mounted into the container /dev. Fallback on failure is to mount tmpfs into the container /dev. A symlink is created from $lxcpath/$name/rootfs.dev back to the /dev relative directory to provid a code consistent reference for updating container devs. Signed-off-by:Michael H. Warfield <mhw@WittsEnd.com> Signed-off-by:
-
- 20 Nov, 2013 3 commits
-
-
Nikola Kotur authored
There are scenarios in which we want to execute process with specific privileges elevated. An example for this might be executing a process inside the container securely, with capabilities dropped, but not in container's cgroup so that we can have per process restrictions inside single container. Similar to namespaces, privileges to be elevated can be OR'd: lxc-attach --elevated-privileges='CAP|CGROUP' ... Backward compatibility with previous versions is retained. In case no privileges are specified behaviour is the same as before: all of them are elevated. Signed-off-by:Nikola Kotur <kotnick@gmail.com> Acked-By:
Christian Seiler <christian@iwakd.de> Signed-off-by:
-
Serge Hallyn authored
We were finding it, but not saving it. Signed-off-by: -
S.Çağlar Onur authored
Free previously allocated memory if realloc fails. Signed-off-by:
S.Çağlar Onur <caglar@10ur.org> Signed-off-by:
-
- 19 Nov, 2013 15 commits
-
-
Serge Hallyn authored
Signed-off-by: -
Serge Hallyn authored
Signed-off-by:
-
Serge Hallyn authored
Signed-off-by:
-
Serge Hallyn authored
Signed-off-by:
-
Serge Hallyn authored
get_allotted doesn't get the list of nic names, only the # of nics allowed to the user. We check the db_file later for existing number of nics. Also close the conf file on success, and print filename and errno if we failed to open conf file. Signed-off-by:
-
Serge Hallyn authored
Signed-off-by:
-
Serge Hallyn authored
Everywhere else return an error code instead. Signed-off-by:
-
Serge Hallyn authored
Signed-off-by:
-
Serge Hallyn authored
Signed-off-by:
-
Serge Hallyn authored
Temporarily set our euid back to the calling ruid, so that the access(2) check can succeed based on the euid being the userns creator. Also switch from atoi to strtol Signed-off-by:
-
S.Çağlar Onur authored
This also fixes possible crashes due to passing NULL to strlen function Changes since v1; * Fixed a typo spotted by Serge Signed-off-by:
-
Dwight Engen authored
Signed-off-by:
Dwight Engen <dwight.engen@oracle.com> Signed-off-by:
-
Dwight Engen authored
This allows the boot messages to be seen which are useful for monitoring container startup. Signed-off-by:
-
Dwight Engen authored
This is needed when using the user namespace since the kernel check does not allow user_ns root to successfully call vhangup(2), and mingetty will quit in this case. Signed-off-by:
-
Dwight Engen authored
Signed-off-by:
-
- 18 Nov, 2013 7 commits
-
-
S.Çağlar Onur authored
Signed-off-by:
-
S.Çağlar Onur authored
Signed-off-by:
-
KATOH Yasufumi authored
Improve the consistency of expression Signed-off-by:
KATOH Yasufumi <karma@jazz.email.ne.jp> Acked-by:
-
Nikola Kotur authored
Signed-off-by:
-
S.Çağlar Onur authored
fix memory leaks reported by cppcheck in src/lxc/lxc_monitor.c. Since this is a cli tool it doesn't really matter but might silence some warnings for debugging Signed-off-by:
-
S.Çağlar Onur authored
Signed-off-by:
-
S.Çağlar Onur authored
Signed-off-by:
-
- 15 Nov, 2013 2 commits
-
-
Stéphane Graber authored
Signed-off-by: -
Stéphane Graber authored
So this implements the changes we discussed yesterday: - Only one container may be queried at the time - -n is now required once again - -H + a single filter only returns the value - -t/--is-state is now removed Note that -S is considered as more than a single filter, so -H in that case only affects the formatting of the values. For the same reason, I haven't yet implemented the -H + multiple filters case which we said should return a simple "key: value" output as it wasn't trivial to re-arrange the stats code to print a different format (for the other options, it's just a two lines change in the print functions). Signed-off-by:
-
- 14 Nov, 2013 3 commits
-
-
Serge Hallyn authored
To do this, add a c->clear_config() helper to the api. (this fixes the bug https://bugs.launchpad.net/bugs/1251352) Signed-off-by:
-
S.Çağlar Onur authored
Signed-off-by:
-
Bogdan Purcareata authored
When moving an interface from the host netns to a container's, the ifindex might not remain the same. This happens when the index of the host interface is already assigned to another interface in the new netns. For veth/vlan/macvlan, virtual interfaces are first created on the host, and then moved in the container. Since they are created after all other interfaces are discovered, there is no chance for its assigned ifindex to be already present in a freshly created netns, because it's a greater number. However, when moving a physical interface, there is a chance that its ifindex in the host netns is not free in the new netns. The patch forces ifindex re-read for the LXC_NET_PHYS case to update the lxc_netdev structure. Signed-off-by:
Bogdan Purcareata <bogdan.purcareata@freescale.com> Signed-off-by:
-
- 13 Nov, 2013 1 commit
-
-
S.Çağlar Onur authored
Adding block/char devices to running container is a common operation so provide a common implementation for users to consume. changes since v2; * lets the user set an alternate path inside the container as Stéphane suggested changes since v1; * removed duplicated code Signed-off-by:
-
- 12 Nov, 2013 6 commits
-
-
KATOH Yasufumi authored
Update for commit b9d957c3Signed-off-by:
-
KATOH Yasufumi authored
Update for commit 2752ececSigned-off-by:
-
pc-wurm authored
I think '-t timeout' was mistakenly written, so I corrected it to '-t template', since the -t argument is used for setting templates, not timeout as far as I know. Signed-off-by:
pc-wurm <yordanov@pc-wurm.de> Acked-by:
-
Stéphane Graber authored
Signed-off-by:
-
Dwight Engen authored
This is likely unnecessary, but is consistent with other uses of fopen()/fclose() in lxc. Signed-off-by:
-
Dwight Engen authored
We were calling save_config() twice within the create() flow, each from a different process. Depending on order of scheduling, sometimes the data from the first save_config() (which was just the stuff from LXC_DEFAULT_CONFIG) would overwrite the config we wanted (the full config), causing a truncated config file which would then cause lxc to segfault once it read it back in because no rootfs.path was set. This fixes it by only calling save_config() once in the create() flow. A rejected alternative was to call fsync(fileno(fout)) before the fclose in save_config. Signed-off-by:
-
- 11 Nov, 2013 1 commit
-
-
Serge Hallyn authored
commit aae93dd3 fixed the command socket name to use the right pathlen instead of always passing in the max socket namelen. However, this breaks lxc-info/lxc-list/etc for containers started before that commit. So if the correct command sock name doesn't work, try the preexising one. Note we can probably undo this "after awhile". Maybe in august 2014. Signed-off-by:
-
