Skip to content

L
lxc
Switch branch/tag
  1. 26 Feb, 2012 31 commits
  3. 25 Feb, 2012 1 commit
  5. 23 Feb, 2012 8 commits
    • fix-automake-1.13 · ce6ce9d6
      Jon Nordby authored 
      ## 0001-Replace-pkglib_PROGRAMS-with-pkglibexec_PROGRAMS.patch [diff]
From 95c566740bba899acc7792c11fcdb3f4d32dcfc9 Mon Sep 17 00:00:00 2001
From: Jon Nordby <jononor@gmail.com>
Date: Fri, 10 Feb 2012 11:38:35 +0100
Subject: [PATCH] Replace pkglib_PROGRAMS with pkglibexec_PROGRAMS

Without this change, autogen.sh fails with automake 1.11.3
Signed-off-by: 's avatarDaniel Lezcano <dlezcano@fr.ibm.com>
    • Add man page for lxc-attach · 49ee6cdc
      Christian Seiler authored 
      Signed-off-by: 's avatarDaniel Lezcano <dlezcano@fr.ibm.com>
    • lxc-attach: Drop privileges when attaching to container unless requested otherwise · cb014488
      Christian Seiler authored 
      lxc-attach will now put the process that is attached to the container into
the correct cgroups corresponding to the container, set the correct
personality and drop the privileges.

The information is extracted from entries in /proc of the init process of
the container. Note that this relies on the (reasonable) assumption that the
init process does not in fact drop additional capabilities from its bounding
set.

Additionally, 2 command line options are added to lxc-attach: One to prevent
the capabilities from being dropped and the process from being put into the
cgroup (-e, --elevated-privileges) and a second one to explicitly state the
architecture which the process will see, (-a, --arch) which defaults to the
container's current architecture.
Signed-off-by: 's avatarDaniel Lezcano <dlezcano@fr.ibm.com>
    • Move lxc_attach from namespace.c to attach.c and rename it to lxc_attach_to_ns · 99d50954
      Christian Seiler authored 
      Since lxc-attach helper functions now have an own source file, lxc_attach is
moved from namespace.c to attach.c and is renamed to lxc_attach_to_ns,
because that better reflects what the function does (attaching to a
container can also contain the setting of the process's personality, adding
it to the corresponding cgroups and dropping specific capabilities).
Signed-off-by: 's avatarDaniel Lezcano <dlezcano@fr.ibm.com>
    • Add attach.[ch]: Helper functions for lxc-attach · e0732705
      Christian Seiler authored 
      The following helper functions for lxc-attach are added to a new file
attach.c:
 - lxc_proc_get_context_info: Get cgroup memberships, personality and
   capability bounding set from /proc for a given process.
 - lxc_proc_free_context_info: Free the data structure responsible
 - lxc_attach_proc_to_cgroups: Add the process specified by the pid
   parameter to the cgroups given by the ctx parameter.
 - lxc_attach_drop_privs: Drop capabilities to the capability mask given in
   the ctx parameter.
Signed-off-by: 's avatarDaniel Lezcano <dlezcano@fr.ibm.com>
    • Add lxc_config_parse_arch to parse architecture strings · 525f0002
      Christian Seiler authored 
      Add the function lxc_config_parse_arch that parses an architecture string
(x86, i686, x86_64, amd64) and returns the corresponding personality. This
is required for lxc-attach, which accepts architectures independently of
lxc.arch. The parsing of lxc.arch now also uses the same function to ensure
consistency.
Signed-off-by: 's avatarDaniel Lezcano <dlezcano@fr.ibm.com>
    • cgroup: Make cgroup_attach a public function · 28f2ae83
      Christian Seiler authored 
      lxc-attach needs to be able to attach a process to specific cgroup, so
cgroup_attach is renamed to lxc_cgroup_attach and now also defined in the
header file.
Signed-off-by: 's avatarDaniel Lezcano <dlezcano@fr.ibm.com>
    • Enable get_cgroup_mount to search for mount points satisfying multiple subsystems at once · 3ea24eb8
      Christian Seiler authored 
      lxc-attach functionality reads /proc/init_pid/cgroup to determine the cgroup
of the container for a given subsystem. However, since subsystems may be
mounted together, we want to be on the safe side and be sure that we really
find the correct mount point, so we allow get_cgroup_mount to check for
*all* the subsystems; the subsystem parameter may now be a comma-separated
list.
Signed-off-by: 's avatarDaniel Lezcano <dlezcano@fr.ibm.com>