- 17 Apr, 2017 4 commits
-
-
Christian Brauner authored
The new{g,u}idmap binaries where a source of trouble for users when they lacked sufficient privileges. This commit adds code to check for sufficient privilege. It checks whether new{g,u}idmap is root owned and has the setuid bit set and if it doesn't it checks whether new{g,u}idmap is root owned and has CAP_SETUID in its CAP_PERMITTED and CAP_EFFECTIVE set. Closes #296. Signed-off-by:Christian Brauner <christian.brauner@ubuntu.com>
-
Christian Brauner authored
Add two new helpers that allow to determine whether a given proc or file has a capability in the given set and move lxc_cap_is_set() to static function that both call internally. Closes #296. Signed-off-by: -
Christian Brauner authored
Signed-off-by: -
Wolfgang Bumiller authored
These functions define pointer to their key shifted by a number and guard access to it later via another variable. Let's make this more explicit (and additionally have the pointer be NULL in the case where it is not supposed to be used). Signed-off-by:Wolfgang Bumiller <w.bumiller@proxmox.com>
-
- 10 Apr, 2017 2 commits
-
-
Jakob Gillich authored
Signed-off-by:Jakob Gillich <jakob@gillich.me>
-
Vincent Catros authored
Signed-off-by:Vincent Catros <vincent.catros@laposte.net>
-
- 04 Apr, 2017 6 commits
-
-
Denis Pynkin authored
Some "/sys" entries exceeds buffer size. This results to some statistics loss ('BlkIO' in particular): wc -c /sys/fs/cgroup/blkio/lxc/alt/blkio.throttle.io_service_bytes 318 /sys/fs/cgroup/blkio/lxc/alt/blkio.throttle.io_service_bytes Signed-off-by:Denis Pynkin <dans@altlinux.org>
-
Torsten Fohrer authored
Signed-off-by:Torsten Fohrer <tfohrer@googlemail.com>
-
Christian Brauner authored
Signed-off-by:Serge Hallyn <serge@hallyn.com>
-
Torsten Fohrer authored
In case of a container that is rebooting, freeing veth.pair.name here results in losing given veth.pair name (Only if given lxc_netdev is reused). Signed-off-by: -
Christian Brauner authored
Signed-off-by: -
Stéphane Graber authored
[stable-2.0] default password cleanup
-
- 25 Mar, 2017 3 commits
-
-
Evgeni Golov authored
Refs: #1158 Signed-off-by:Evgeni Golov <evgeni@debian.org>
-
Evgeni Golov authored
Signed-off-by: -
Evgeni Golov authored
closes #302 Signed-off-by:
-
- 22 Mar, 2017 4 commits
-
-
John Chen authored
Fixing the typo making `suggest_default_idmap` open `subuidfile` instead of `subgidfile` to read subgid information. Signed-off-by:Pochang Chen <johnchen902@gmail.com>
-
Stéphane Graber authored
We waste a lot of time waiting for Ubuntu containers to cleanly stop right before we destroy them anyway. Signed-off-by:Stéphane Graber <stgraber@ubuntu.com>
-
Stéphane Graber authored
Signed-off-by: -
Christian Brauner authored
Signed-off-by:
-
- 20 Mar, 2017 21 commits
-
-
Christian Brauner authored
conf.c: In function 'lxc_assign_network': conf.c:3096:25: error: '%lu' directive output may be truncated writing between 1 and 20 bytes into a region of size 19 [-Werror=format-truncation=] snprintf(pidstr, 19, "%lu", (unsigned long) pid); ^~~ conf.c:3096:24: note: using the range [1, 18446744073709551615] for directive argument snprintf(pidstr, 19, "%lu", (unsigned long) pid); ^~~~~ In file included from /usr/include/stdio.h:938:0, from conf.c:35: /usr/include/x86_64-linux-gnu/bits/stdio2.h:64:10: note: format output between 2 and 21 bytes into a destination of size 19 return __builtin___snprintf_chk (__s, __n, __USE_FORTIFY_LEVEL - 1, ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ __bos (__s), __fmt, __va_arg_pack ()); ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ confile.c: In function 'network_new_hwaddrs': confile.c:2889:38: error: '%02x' directive output may be truncated writing between 2 and 8 bytes into a region of size 6 [-Werror=format-truncation=] snprintf(hwaddr, 18, "00:16:3e:%02x:%02x:%02x", ^~~~ confile.c:2889:23: note: using the range [0, 4294967295] for directive argument snprintf(hwaddr, 18, "00:16:3e:%02x:%02x:%02x", ^~~~~~~~~~~~~~~~~~~~~~~~~ confile.c:2889:23: note: using the range [0, 4294967295] for directive argument In file included from /usr/include/stdio.h:938:0, from confile.c:24: /usr/include/x86_64-linux-gnu/bits/stdio2.h:64:10: note: format output between 18 and 36 bytes into a destination of size 18 return __builtin___snprintf_chk (__s, __n, __USE_FORTIFY_LEVEL - 1, ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ __bos (__s), __fmt, __va_arg_pack ()); ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Not sure whether the latter is really a problem. We might need an additional fix later on. Signed-off-by: -
Christian Brauner authored
Signed-off-by: -
Tai Kedzierski authored
Signed-off-by:Tai Kedzierski <dch.tai@gmail.com>
-
Tai Kedzierski authored
Signed-off-by: -
Tai Kedzierski authored
Checks if DOWNLOAD_KEYSERVER has already been set in the environment before setting a value Signed-off-by: -
Stéphane Graber authored
Closes #1466 Signed-off-by: -
otofune authored
Signed-off-by:otofune <otofune@gmail.com>
-
otofune authored
- already found /etc/localtime - duplicate creation /etc/resolv.conf Signed-off-by: -
Serge Hallyn authored
Signed-off-by: -
Jakub Jirutka authored
Some mirrors from the mirrors list are not very reliable and it seems that no one really wants to use some random mirror as the default option. Signed-off-by:Jakub Jirutka <jakub@jirutka.cz>
-
Stéphane Graber authored
Signed-off-by: -
Harald Dunkel authored
Signed-off-by:Harald Dunkel <harald.dunkel@aixigo.de>
-
Christian Brauner authored
Signed-off-by: -
Christian Brauner authored
Signed-off-by: -
Christian Brauner authored
Signed-off-by: -
Christian Brauner authored
Signed-off-by: -
Serge Hallyn authored
Newer libseccomp has a flag called SCMP_FLTATR_ATL_TSKIP which allows syscall '-1' (nop) to be executed. Without that flag, debuggers cannot skip system calls inside containers. For reference, see the seccomp(2) manpage, which says: The tracer can skip the system call by changing the system call number to -1. and see the seccomp issue #80 Signed-off-by: -
Christian Brauner authored
Signed-off-by: -
Christian Brauner authored
The conversion algorithm used uses a clever trick by letting a year start at 1 March. So we need to add 1 for January and February. Signed-off-by: -
Christian Brauner authored
Signed-off-by: -
Evgeni Golov authored
Signed-off-by:
-
