- 16 Jul, 2017 40 commits
-
-
Christian Brauner authored
Signed-off-by:Christian Brauner <christian.brauner@ubuntu.com>
-
Christian Brauner authored
Signed-off-by: -
Christian Brauner authored
Signed-off-by: -
Breno Leitao authored
Starting at version 3.6, Alpine Linux has support for ppc64le architecture. Adding the new keys also. Signed-off-by:Breno Leitao <breno.leitao@gmail.com>
-
0x0916 authored
Signed-off-by:0x0916 <w@laoqinren.net>
-
0x0916 authored
when the log level is TRACE, this patch export the seccomp filter to log file. the ouput of `seccomp_export_pfc()` is human readable and this feature is useful for user to make sure their `seccomp configuration file` is right. Output for he default ubuntu container's seccomp filter is the following: ``` lxc-start ubuntu 20170520024159.412 INFO lxc_apparmor - lsm/apparmor.c:apparmor_process_label_set:238 - changed apparmor profile to lxc-container-default-cgns if ($arch == 3221225534) # filter for syscall "finit_module" (313) [priority: 65535] if ($syscall == 313) action ERRNO(1); # filter for syscall "open_by_handle_at" (304) [priority: 65535] if ($syscall == 304) action ERRNO(1); # filter for syscall "kexec_load" (246) [priority: 65535] if ($syscall == 246) action ERRNO(1); # filter for syscall "delete_module" (176) [priority: 65535] if ($syscall == 176) action ERRNO(1); # filter for syscall "init_module" (175) [priority: 65535] if ($syscall == 175) action ERRNO(1); # filter for syscall "umount2" (166) [priority: 65533] if ($syscall == 166) if ($a1.hi32 & 0x00000000 == 0) if ($a1.lo32 & 0x00000001 == 1) action ERRNO(13); # default action action ALLOW; if ($arch == 1073741827) # filter for syscall "finit_module" (350) [priority: 65535] if ($syscall == 350) action ERRNO(1); # filter for syscall "open_by_handle_at" (342) [priority: 65535] if ($syscall == 342) action ERRNO(1); # filter for syscall "kexec_load" (283) [priority: 65535] if ($syscall == 283) action ERRNO(1); # filter for syscall "delete_module" (129) [priority: 65535] if ($syscall == 129) action ERRNO(1); # filter for syscall "init_module" (128) [priority: 65535] if ($syscall == 128) action ERRNO(1); # filter for syscall "umount2" (52) [priority: 65534] if ($syscall == 52) if ($a1 & 0x00000001 == 1) action ERRNO(13); # default action action ALLOW; if ($arch == 3221225534) # filter for syscall "kexec_load" (1073742352) [priority: 65535] if ($syscall == 1073742352) action ERRNO(1); # filter for syscall "finit_module" (1073742137) [priority: 65535] if ($syscall == 1073742137) action ERRNO(1); # filter for syscall "open_by_handle_at" (1073742128) [priority: 65535] if ($syscall == 1073742128) action ERRNO(1); # filter for syscall "delete_module" (1073742000) [priority: 65535] if ($syscall == 1073742000) action ERRNO(1); # filter for syscall "init_module" (1073741999) [priority: 65535] if ($syscall == 1073741999) action ERRNO(1); # filter for syscall "umount2" (1073741990) [priority: 65534] if ($syscall == 1073741990) if ($a1 & 0x00000001 == 1) action ERRNO(13); # default action action ALLOW; action KILL; lxc-start ubuntu 20170520024159.412 NOTICE lxc_start - start.c:start:1470 - Exec'ing "/sbin/init". ``` Signed-off-by: -
Christian Brauner authored
Signed-off-by: -
Christian Brauner authored
bionic seems to lack a definition of __S_ISTYPE(). Signed-off-by: -
Christian Brauner authored
Closes https://github.com/lxc/lxd/issues/3384. Signed-off-by:
-
Christian Brauner authored
Signed-off-by: -
Christian Brauner authored
Signed-off-by: -
Christian Brauner authored
Signed-off-by: -
Christian Brauner authored
Signed-off-by: -
Christian Brauner authored
Signed-off-by: -
Christian Brauner authored
The removed codepath was non-functional for a long time now. All mounting is handled through bdev.{c,h} and if that fails the other codepath would necessarily fail as well. So let's remove them. This makes it way clearer what is going on and simplifies things massively. Signed-off-by: -
Christian Brauner authored
- Enable lxc_abstract_unix_{send,recv}_fd() to send and receive multiple fds at once. - lxc_abstract_unix_{send,recv}_fd() -> lxc_abstract_unix_{send,recv}_fds() - Send tty fds from child to parent all at once. Signed-off-by: -
Christian Brauner authored
Signed-off-by: -
Christian Brauner authored
Signed-off-by: -
Christian Brauner authored
Signed-off-by: -
Christian Brauner authored
This is a potentially security sensitive operation and I really want to keep an eye on *when exactly* this is send. So add more logging on the TRACE() level. Signed-off-by: -
Christian Brauner authored
This also fixes a bug where we caused a double mapping, when the {u,g}id for the user was mapped to container root {g,u}id. Signed-off-by: -
Christian Brauner authored
Signed-off-by: -
Christian Brauner authored
Signed-off-by: -
Christian Brauner authored
This adds confile_utils.{c,h} which will contain a helpers to parse lxc configuration files. Signed-off-by: -
Shane Chen authored
Signed-off-by:Shane Chen <ss1ha3tw@gmail.com>
-
Christian Brauner authored
This adds a test that checks LXC's configuration jump table whether all methods for a given configuration item are implemented. If it is not, we'll error out. This should provide additional safety since a) the API can now be sure that dereferencing the pointer for a given method in the config struct is safe and b) when users implement new configuration keys and forget to implement a required method we'll see it right away. Signed-off-by: -
Christian Brauner authored
Signed-off-by: -
Christian Brauner authored
Afaict, userns_exec_1() is only used to operate based on privileges for the user's own {g,u}id on the host and for the container root's unmapped {g,u}id. This means we require only to establish a mapping from: - the container root {g,u}id as seen from the host -> user's host {g,u}id - the container root -> some sub{g,u}id The former we add, if the user did not specifiy a mapping. The latter we retrieve from the ontainer's configured {g,u}id mappings. Closes #1598. Signed-off-by: -
Shane Chen authored
Signed-off-by: -
Christian Brauner authored
Signed-off-by: -
Christian Brauner authored
Signed-off-by: -
JD Friedrikson authored
Ever since 8eb62c24, systemd has not been able to cleanly stop lxc containers (via lxc@) because it's still using SIGPWR for systemd-based containers. We should now use the nice logic in 330ae3d3 to stop the containers instead. Signed-off-by:
JD Friedrikson <yours@decompo.site>
-
Christian Brauner authored
Signed-off-by: -
Christian Brauner authored
Signed-off-by: -
Christian Brauner authored
Signed-off-by: -
Christian Brauner authored
Signed-off-by: -
Christian Brauner authored
Signed-off-by: -
Christian Brauner authored
Signed-off-by: -
Christian Brauner authored
Signed-off-by: -
Christian Brauner authored
Signed-off-by:
-
