Commits · 36fb1e0796e656b3be144bf66d00f585604609ef · Chen Yisong / lxc

09 Dec, 2020 7 commits
- Restore interfaces to the correct namespace on error · 36fb1e07
  Blair Steven authored Dec 09, 2020
```
If the container unexpectedly exists we may need to restore physical
interfaces back into the main namespace in a tidy way.
Signed-off-by: Blair Steven <blair.steven@alliedtelesis.co.nz>
```
  36fb1e07
- added standard resolver option to the lxc-download.in shell script · d2938916
  Andrew Deng authored Nov 20, 2020
```
Signed-off-by: Andrew Deng <adeng1433@gmail.com>
```
  d2938916
- confile: clean up hooks · 434f12c1
  Christian Brauner authored Dec 08, 2020
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  434f12c1
- confile: clean up network configuration parsing · 2b9319af
  Christian Brauner authored Dec 08, 2020
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  2b9319af
- tree-wide: use call_cleaner(netns_freeifaddrs) · 20f0e57d
  Christian Brauner authored Dec 08, 2020
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  20f0e57d
- macro: bump MAX_GRBUF_SIZE to 2 mb · af12eb5d
  Christian Brauner authored Dec 07, 2020
```
Closes #3592.
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  af12eb5d
- macro: move MAX_GRBUF_SIZE · 41b43296
  Christian Brauner authored Dec 07, 2020
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  41b43296
04 Dec, 2020 18 commits

network: fix LXC_NET_NONE cleanup · 92bc7090

authored Dec 02, 2020

We have a case where we have a nested container with LXC_NET_NONE run
inside a container that's *also* got no network namespace (run by
lxc-usernsexec).

The "am I root" check in this function then does not suffice, since the
euid of the task is 0 but it does not have privilege over its network
namespace, and thus cannot do any of the restore operations:

lxc foo 20201201232059.271 TRACE network - network.c:lxc_restore_phys_nics_to_netns:3299 - Moving physical network devices back to parent network namespace
lxc foo 20201201232059.271 ERROR network - network.c:lxc_restore_phys_nics_to_netns:3307 - Operation not permitted - Failed to enter network namespace
lxc foo 20201201232059.271 ERROR start - start.c:__lxc_start:2045 - Failed to move physical network devices back to parent network namespace

Let's check that we indeed did clone the network namespace, and thus have
things to restore to their correct namespace before attempting to actually
restore them.

I suspect it's possible we can also get rid of some of the network namespace
preservation stuff in start.c in the LXC_NET_NONE case.
Signed-off-by: Tycho Andersen <tycho@tycho.pizza>

92bc7090

commands_utils: fix lxc-wait · b70ddc2e

authored Nov 18, 2020

Closes: #3570
Fixes: 7792a5b6 ("commands: add additional check to lxc_cmd_sock_get_state()")
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

b70ddc2e

file_utils: fix config file parsing · 1c7c31b5

authored Nov 17, 2020

We accidently used the "bytes_to_write" variable after we've written all the
bytes at which point it is guaranteed to be 0. Let's use the "bytes_read"
variable instead.
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

1c7c31b5

conf: switch to fd_to_fd() when copying mountinfo · 1e9e5816

authored Nov 16, 2020

Closes: #3580.
Link: https://bugzilla.kernel.org/show_bug.cgi?id=209971Suggested-by: Joan Bruguera <joanbrugueram@gmail.com>
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

1e9e5816

parse: rework config parsing routine · dcc39fca
Christian Brauner authored Nov 16, 2020
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
dcc39fca
cgfsng: adjust log level to warn instead of error · 1bd5fb39
lifeng68 authored Nov 13, 2020
```
Signed-off-by: lifeng68 <lifeng68@huawei.com>
```
1bd5fb39
attach: silence stdio permission adjust warnings · c5e1a70c
Christian Brauner authored Nov 05, 2020
```
Closes: #3576.
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
c5e1a70c

seccomp: log aborted system calls · 9436750e

authored Nov 02, 2020

Suggested-by: Jann Horn <jann@thejh.net>
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

9436750e

seccomp: make seccomp notifier fd non-blocking · cbb504c9

authored Nov 02, 2020

Suggested-by: Jann Horn <jann@thejh.net>
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

cbb504c9

utils: check snprintf return value · c253925b
Christian Brauner authored Oct 28, 2020
```
Fixes: Coverity 1465853
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
c253925b
conf: check snprint return value · c6c2cf30
Christian Brauner authored Oct 28, 2020
```
Fixes: Coverity 1465854
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
c6c2cf30
utils: don't deref after NULL check · 64163d8d
Christian Brauner authored Oct 28, 2020
```
Fixes: Coverity 1465855
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
64163d8d
commands: don't deref after NULL check · bd5ed71d
Christian Brauner authored Oct 28, 2020
```
Fixes: Coverity 1465657
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
bd5ed71d
tests: Fix compilation with appamor enabled. · 15190a6a
Ruben Jenster authored Oct 23, 2020
```
Signed-off-by: Ruben Jenster <r.jenster@drachenfels.de>
```
15190a6a

lxccontainer: fix lxc_config_item_is_supported · c14c31d4

authored Oct 23, 2020

Use exact match instead of longest prefix match
to check whether a config item is supported.
Signed-off-by: Ruben Jenster <r.jenster@drachenfels.de>

c14c31d4

seccomp: Avoid duplicate processing of rules for host native arch. · 55cbb1a6
Ruben Jenster authored Oct 23, 2020
```
Signed-off-by: Ruben Jenster <r.jenster@drachenfels.de>
```
55cbb1a6
seccomp: Fix handling of pseudo syscalls and improve logging for rule processing. · 687f9b9b
Ruben Jenster authored Oct 22, 2020
```
Signed-off-by: Ruben Jenster <r.jenster@drachenfels.de>
```
687f9b9b
Update Japanese pam_cgfs(8) to reflect lack of support for pure cgroupv2 · 7d40e58b
KATOH Yasufumi authored Oct 25, 2020
```
Update for commit b87ed83bSigned-off-by: KATOH Yasufumi <karma@jazz.email.ne.jp>
```
7d40e58b

21 Oct, 2020 3 commits

Release LXC 4.0.5 · 7bae22f7
Stéphane Graber authored Oct 21, 2020
```
Signed-off-by: Stéphane Graber <stgraber@ubuntu.com>
```
7bae22f7
conf: account for early return when sending devpts fd · fd40394a
Christian Brauner authored Oct 20, 2020
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
fd40394a

conf: always send response to parent waiting for devptfs_fd · 0c5d9c45

authored Oct 20, 2020

When no devpts devices are requested we used to return early but did not send a
response to the parent. This is a problem because the parent will be waiting
for a devpts fd to be sent. Make sure to always send a response.
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

0c5d9c45

19 Oct, 2020 12 commits

start: improve devpts fd sending · 90a3b1da
Christian Brauner authored Oct 19, 2020
```
Closes: #3549.
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
90a3b1da
sync: log synchronization states · 49f04965
Christian Brauner authored Oct 19, 2020
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
49f04965
sync: switch to new error helpers · dab1ce7f
Christian Brauner authored Oct 19, 2020
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
dab1ce7f

seccomp: fix compilation on powerpc · 8d3bcf63

authored Oct 16, 2020

Link: https://launchpadlibrarian.net/502200189/buildlog_snap_ubuntu_bionic_ppc64el_lxd-latest-edge_BUILDING.txt.gzSigned-off-by: Christian Brauner <christian.brauner@ubuntu.com>

8d3bcf63

seccomp: improve default notification sending · 6778323d
Christian Brauner authored Oct 15, 2020
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
6778323d
seccomp: log invalid seccomp notify ids · 95cc56cd
Christian Brauner authored Oct 15, 2020
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
95cc56cd
seccomp: Check if syscall is supported on compat architecture. · 7241d0f4
Ruben Jenster authored Oct 13, 2020
```
Signed-off-by: Ruben Jenster <r.jenster@drachenfels.de>
```
7241d0f4

Remove obsolete setting regarding the Standard Output · 9b43bce0

authored Sep 23, 2020

The Standard output type "syslog" is obsolete, causing a warning since systemd
version 246 [1].

Please consider using "journal" or "journal+console"

[1] https://github.com/systemd/systemd/blob/master/NEWS#L202Signed-off-by: Mingli Yu <mingli.yu@windriver.com>

9b43bce0

lxc-usernsexec: setgroups() similar to other places shouldn't fail on EPERM · 5e433189

authored Sep 17, 2020

FAIL: lxc-tests: lxc-test-usernsexec (1s)
---
as test-userns executing /tmp/autopkgtest.waGEXj/build.Hm3/src/src/tests/lxc-test-usernsexec
uid=1001 gid=1001 name=test-userns subuid=165536 subgid=165536 ver=1:4.0.4-0ubuntu3
lxc-utils=1:4.0.4-0ubuntu3 kver=5.8.0-19-generic
USERNSEXEC=lxc-usernsexec
nouidgid: PASS
myuidgid: FAIL - runtest failed 1
  $ lxc-usernsexec -mu:0:1001:1 -mg:0:1001:1 -- /tmp/autopkgtest.waGEXj/build.Hm3/src/src/tests/lxc-test-usernsexec inside f0
  lxc 20200914222824.562 ERROR    utils - utils.c:lxc_setgroups:1363 - Operation not permitted - Failed to setgroups()
  kid 73112 is gone 1
subuidgid: PASS
bothsets: PASS
mismatch: PASS
ERRORS: myuidgid
---
Reported-by: Seth Forshee <seth.forshee@canonical.com>
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

5e433189

commands: don't fail if unfreeze fails · 422820d5

authored Sep 17, 2020

We can e.g. fail the unfreeze because the freezer cgroup is not available and
then we erronously report that stopping the container failed.

Closes: #3471.
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

422820d5

attach: use lxc_terminal_signal_sigmask_safe_blocked() · f59f2f9e
Christian Brauner authored Sep 02, 2020
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
f59f2f9e
terminal: introduce lxc_terminal_signal_sigmask_safe_blocked() · 1748c4bd
Christian Brauner authored Sep 02, 2020
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
1748c4bd