- 25 May, 2020 22 commits
-
-
Christian Brauner authored
Signed-off-by:Christian Brauner <christian.brauner@ubuntu.com>
-
Christian Brauner authored
Signed-off-by: -
Wolfgang Bumiller authored
When a newer lxc library communicates with an older one (such as running an lxc 4.0 lxc-freeze on a longer running container which was started while lxc was still at version 3), the LXC_CMD_GET_LIMITING_CGROUP command is not available, causing the remote to just close the socket. Catch this and try the previous command instead. Signed-off-by:Wolfgang Bumiller <w.bumiller@proxmox.com>
-
Wolfgang Bumiller authored
Otherwise we cannot use an 'a' entry in devices.deny/allow as these are not permitted once a subdirectory was created. Without isolation we initialize the devices cgroup particularly late, so there are probably cases which cannot work with isolation. Signed-off-by: -
Christian Brauner authored
Signed-off-by: -
Wolfgang Bumiller authored
This is a new approach to #1302 with a container-side configuration instead of a global boolean flag. Contrary to the previous PR using an optional additional parameter for the get-cgroup command, this introduces two new additional commands to get the limiting cgroup path and cgroup2 file descriptor. If the limiting option is not in use, these behave identical to their full-path counterparts. If these variables are used the payload will end up in the concatenation of lxc.cgroup.dir.container and lxc.cgroup.dir.container.inner (which may be empty), and the monitor will end up in lxc.cgruop.dir.monitor. The directories are fixed, no retry count logic is applied, failing to create these directories will simply be a hard error. Signed-off-by:
-
Stéphane Graber authored
Signed-off-by:Stéphane Graber <stgraber@ubuntu.com>
-
Christian Brauner authored
We can fail to setgroups() when "deny" has been set which we need to set when we are a fully unprivileged user. Closes: 3420. Signed-off-by: -
Christian Brauner authored
Signed-off-by: -
Christian Brauner authored
Fixes: https://lists.linuxcontainers.org/pipermail/lxc-users/2020-May/015245.htmlSigned-off-by:
-
Christian Brauner authored
Signed-off-by: -
Christian Brauner authored
Signed-off-by: -
Christian Brauner authored
I introduced a regression: when users didn't specify a specific name via lxc.net.<idx>.name then the device would retain the random name it received when we created it. Before we would use the "eth%d" syntax to get the kernel to assign a fixed name. Restore that behavior. Closes: #3407. Fixes: 8bf64b77 ("network: rework network device creation") Signed-off-by:
-
Christian Brauner authored
No more weird api quirks between architectures and cool new features. Signed-off-by: -
Wolfgang Bumiller authored
EPOLLIN will always be true and therefore end up busy-looping Signed-off-by: -
Wolfgang Bumiller authored
Signed-off-by: -
Wolfgang Bumiller authored
in order to be able to listen for EPOLLPRI Signed-off-by: -
Christian Brauner authored
Signed-off-by: -
Christian Brauner authored
This will be the central place for all process management helpers. This also removes raw_syscalls.{c,h}. Signed-off-by: -
Christian Brauner authored
Signed-off-by: -
Christian Brauner authored
They are offset by 1024. Signed-off-by: -
Christian Brauner authored
otherwise weird things might happen. Signed-off-by:
-
- 14 May, 2020 11 commits
-
-
Christian Brauner authored
Disable and enable syslog around lxc_check_inherited(). Signed-off-by: -
Christian Brauner authored
Signed-off-by: -
Christian Brauner authored
Signed-off-by: -
Christian Brauner authored
Signed-off-by: -
Christian Brauner authored
Signed-off-by: -
Christian Brauner authored
Signed-off-by: -
Christian Brauner authored
We need to make sure we don't overwrite values when they have already been set. Closes: #3405. Signed-off-by: -
Christian Brauner authored
Signed-off-by: -
Christian Brauner authored
Signed-off-by: -
Christian Brauner authored
Signed-off-by: -
Christian Brauner authored
Signed-off-by:
-
- 05 May, 2020 7 commits
-
-
Christian Brauner authored
which will allow us to catch more oob accesses. Signed-off-by: -
Christian Brauner authored
Signed-off-by: -
Christian Brauner authored
Fixes: Coverity 1461742. Signed-off-by: -
Christian Brauner authored
This depends on the new mount api. Closes #3164. Signed-off-by: -
Christian Brauner authored
to avoid the overhead of calling to lxc-usernsexec whenever we can. Signed-off-by: -
Christian Brauner authored
Fixes: #3183 Cc: Thomas Moschny <thomas.moschny@gmx.de> Signed-off-by: -
Christian Brauner authored
Fixes: #3183 Cc: Thomas Moschny <thomas.moschny@gmx.de> Signed-off-by:
-
