Commits · 5129b2d3edcaef2feebdb80ae478f3268cfba454 · Chen Yisong / lxc · GitLab

01 Feb, 2021 18 commits
- attach: harden open calls · 5129b2d3
  Christian Brauner authored Feb 01, 2021
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  5129b2d3
- syscall_wrappers: add PROTECT_LOOKUP, PROTECT_OPEN,… · cce677d1
  Christian Brauner authored Feb 01, 2021
```
syscall_wrappers: add PROTECT_LOOKUP, PROTECT_OPEN, PROTECT_LOOKUP_WITH_SYMLINKS, PROTECT_OPEN_WITH_TRAILING_SYMLINKS
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  cce677d1
- file_utils: add open_at() · 7166ab75
  Christian Brauner authored Feb 01, 2021
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  7166ab75
- Merge pull request #3642 from brauner/2021-02-01/fixes · 42673edd
  Stéphane Graber authored Feb 01, 2021
```
attach: rework id handling
```
  42673edd
- Merge pull request #3643 from brauner/2021-02-01/fixes_2 · 2b525963
  Stéphane Graber authored Feb 01, 2021
```
cgroups: remove pointless NULL checks
```
  2b525963
- cgroups: initialize variable · ed75d76e
  Christian Brauner authored Feb 01, 2021
```
Fixes: Coverity 1472651
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  ed75d76e
- cgroups: remove pointless NULL checks · bb6dbaf0
  Christian Brauner authored Feb 01, 2021
```
We're already ensuring before that conf isn't NULL.
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  bb6dbaf0
- attach: stash host uid and host gid in attach_context · 3ac4480a
  Christian Brauner authored Feb 01, 2021
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  3ac4480a
- attach: fix error checking for dup2() · 40301d48
  Christian Brauner authored Feb 01, 2021
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  40301d48
- attach: fix logging for stdfd replacement · 93b9960a
  Christian Brauner authored Feb 01, 2021
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  93b9960a
- attach: log failues to dup2() with SYSDEBUG() · a7563434
  Christian Brauner authored Feb 01, 2021
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  a7563434
- utils: use SYSTRACE() when logging stdio permission fixup failures · 7e90889d
  Christian Brauner authored Feb 01, 2021
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  7e90889d
- attach: document attach_context · 20718e39
  Christian Brauner authored Feb 01, 2021
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  20718e39
- attach: simplify opening of /proc/self · 595798bb
  Christian Brauner authored Feb 01, 2021
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  595798bb
- attach: move uid and gid handling to get_attach_context() · 4475fabb
  Christian Brauner authored Feb 01, 2021
```
the less we do in do_attach(), the better.
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  4475fabb
- attach: initialize init_pid field to -ESRCH · bac33ebd
  Christian Brauner authored Feb 01, 2021
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  bac33ebd
- attach: unifiy /proc/<init-pid>/status parsing · 9680e7b0
  Christian Brauner authored Feb 01, 2021
```
and move it out of do_attach(). The less we do in the container's context the
better.
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  9680e7b0
- file_utils: add fdopenat() · a60d8c4e
  Christian Brauner authored Feb 01, 2021
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  a60d8c4e
31 Jan, 2021 5 commits
- Merge pull request #3641 from brauner/2021-01-30/fixes · 326bb02c
  Stéphane Graber authored Jan 31, 2021
```
attach: pidfd-based hardening and file-descriptor-only LSM interactions
```
  326bb02c
- lsm/apparmor: cleanup apparmor_process_label_set() · fbf281d3
  Christian Brauner authored Jan 31, 2021
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  fbf281d3
- attach: hardening through use of pidfds · d8764025
  Christian Brauner authored Jan 31, 2021
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  d8764025
- attach: file descriptors based LSM handling · afc691a0
  Christian Brauner authored Jan 31, 2021
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  afc691a0
- cgroups: align methods · ca76baed
  Christian Brauner authored Jan 30, 2021
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  ca76baed
30 Jan, 2021 17 commits
- Merge pull request #3639 from brauner/2021-01-28/fixes · ee4aad1e
  Stéphane Graber authored Jan 30, 2021
```
cgroups: fixes and improvements
```
  ee4aad1e
- cgroups: use PTR_TO_U64() · 7d2f7ae1
  Christian Brauner authored Jan 30, 2021
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  7d2f7ae1
- attach: don't needless check for NULL · 640952e5
  Christian Brauner authored Jan 30, 2021
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  640952e5
- log: add lxc_log_trace() helper · de96cd60
  Christian Brauner authored Jan 30, 2021
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  de96cd60
- cgroups: use bpf log when logging at trace level · 4a888de1
  Christian Brauner authored Jan 30, 2021
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  4a888de1
- seccomp: use lxc_log_get_level() · 25a8b256
  Christian Brauner authored Jan 30, 2021
```
This will now enable LXD users to dump the seccomp filter in the log when
logging at TRACE level.
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  25a8b256
- log: rework lxc_log_get_level() · 09c8768a
  Christian Brauner authored Jan 30, 2021
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  09c8768a
- cgroups: use cleanup macro for consistency · 0450b7ce
  Christian Brauner authored Jan 30, 2021
```
and to prevent future mishaps.
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  0450b7ce
- cgroups: vet parameters more strictly · d5d4b98e
  Christian Brauner authored Jan 30, 2021
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  d5d4b98e
- seccomp: use lxc_log_get_fd() · 0464dec3
  Christian Brauner authored Jan 30, 2021
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  0464dec3
- log: add lxc_log_get_fd() · c422f3af
  Christian Brauner authored Jan 30, 2021
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  c422f3af
- log: remove pointless inline · ef1a597f
  Christian Brauner authored Jan 30, 2021
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  ef1a597f
- cgroups: tweak cgroup initialization · 6e214b74
  Christian Brauner authored Jan 30, 2021
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  6e214b74
- cgroups: use zalloc · c5d0238a
  Christian Brauner authored Jan 30, 2021
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  c5d0238a
- cgroups: ensure all memory is zeroed · 954d61c5
  Christian Brauner authored Jan 30, 2021
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  954d61c5
- cgroups: don't initiliaze NULL log · ca679784
  Christian Brauner authored Jan 30, 2021
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  ca679784
- cgroups: coding style fixes · f3ef7e67
  Christian Brauner authored Jan 30, 2021
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  f3ef7e67