Commits · 6f6c71cdcaa9338fe6eea87e3ff7dff25d5dfcd2 · Chen Yisong / lxc · GitLab

05 Feb, 2021 12 commits
- tests: improve lxc.init.groups tests · 6f6c71cd
  Christian Brauner authored Feb 05, 2021
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  6f6c71cd
- confile: handle appending init groups · c71f64cb
  Christian Brauner authored Feb 05, 2021
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  c71f64cb
- conf: use lxc_groups_t directly · 4822319f
  Christian Brauner authored Feb 05, 2021
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  4822319f
- attach_options: use size_t for lxc_groups_t · fb4dbb51
  Christian Brauner authored Feb 05, 2021
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  fb4dbb51
- attach: use brackets around flag check · 9475d2b9
  Christian Brauner authored Feb 05, 2021
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  9475d2b9
- attach_options: use standard C pointer syntax · f5072dcd
  Christian Brauner authored Feb 05, 2021
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  f5072dcd
- attach_options: initialize .groups · f41aa73b
  Christian Brauner authored Feb 05, 2021
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  f41aa73b
- attach: Add groups option to keep additional group IDs. · 8caac583
  Ruben Jenster authored Feb 04, 2021
```
Signed-off-by: Ruben Jenster <r.jenster@drachenfels.de>
```
  8caac583
- confile: add lxc.init.groups to keep additional groups · bf31b337
  Ruben Jenster authored Oct 30, 2020
```
Signed-off-by: Ruben Jenster <r.jenster@drachenfels.de>
```
  bf31b337
- utils: rework lxc_setgroups() · 5a7f1dc6
  Christian Brauner authored Feb 05, 2021
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  5a7f1dc6
- tree-wide: use lxc_drop_groups() instead of lxc_setgroups(0, NULL) · 8917c382
  Christian Brauner authored Feb 05, 2021
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  8917c382
- utils: add lxc_drop_groups() · 8dd6f81e
  Christian Brauner authored Feb 05, 2021
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  8dd6f81e
04 Feb, 2021 17 commits
- Merge pull request #3651 from brauner/2021-02-04/fixes · 5ee510d6
  Stéphane Graber authored Feb 04, 2021
```
cgroups: fix cgroup mounting
```
  5ee510d6
- cgroups: check for correct error in __cg_unified_attach() from cgroup_attach() · 59114d80
  Christian Brauner authored Feb 04, 2021
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  59114d80
- tree-wide: s/dfd_root_host/dfd_host/g · ea11a215
  Christian Brauner authored Feb 04, 2021
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  ea11a215
- tree-wide: s/mntpt_fd/dfd_mnt/g · ea57e424
  Christian Brauner authored Feb 04, 2021
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  ea57e424
- tree-wide: s/dev_mntpt_fd/dfd_dev/g · a5a08920
  Christian Brauner authored Feb 04, 2021
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  a5a08920
- syscall_wrappers: fix PROTECT_OPEN_W macro · 8ea5110c
  Christian Brauner authored Feb 04, 2021
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  8ea5110c
- conf: restricted fd-only lxc_fill_autodev() · 927ea337
  Christian Brauner authored Feb 04, 2021
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  927ea337
- conf: start stashing dfd to host's / during container setup · a370f16b
  Christian Brauner authored Feb 04, 2021
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  a370f16b
- conf: fix lxc_setup_dev_console() · 86087bd6
  Christian Brauner authored Feb 04, 2021
```
We were printing garbage on accident.
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  86087bd6
- utils: add mount_from_at() · 977687db
  Christian Brauner authored Feb 04, 2021
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  977687db
- cgroups: restrict open calls in cgroup_attach_create_leaf() · 7043e2b4
  Christian Brauner authored Feb 04, 2021
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  7043e2b4
- cgroups: improve error handling and logging in cgroup_attach_leaf() · 6e2078de
  Christian Brauner authored Feb 04, 2021
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  6e2078de
- cgroups: fix argument vetting in cgroup_attach() · 88c27c53
  Christian Brauner authored Feb 04, 2021
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  88c27c53
- attach: fix fallback logic when attaching to cgroups · 9a57778b
  Christian Brauner authored Feb 04, 2021
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  9a57778b
- cgroups: switch to fd-based cgroup mounting · 02efd041
  Christian Brauner authored Feb 04, 2021
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  02efd041
- cgroups: restricted fd-only controller mountpoint creation · c689b58a
  Christian Brauner authored Feb 04, 2021
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  c689b58a
- cgroups: fix cgroup mounting · 315f8a4e
  Christian Brauner authored Feb 04, 2021
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  315f8a4e
03 Feb, 2021 11 commits
- Merge pull request #3650 from brauner/2021-02-03/fixes_1 · dfb71524
  Stéphane Graber authored Feb 03, 2021
```
conf: harden various mount paths
```
  dfb71524
- utils: harden __safe_mount_beneath_at() · cbc2ddf5
  Christian Brauner authored Feb 03, 2021
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  cbc2ddf5
- conf: refactor transient procfs mounting · 952b5031
  Christian Brauner authored Feb 03, 2021
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  952b5031
- conf: restrict open call in lxc_mount_rootfs() · ccf53741
  Christian Brauner authored Feb 03, 2021
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  ccf53741
- conf: make lxc_create_tmp_proc_mount() static · e1b9d6af
  Christian Brauner authored Feb 03, 2021
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  e1b9d6af
- conf: coding style · fdb57ab4
  Christian Brauner authored Feb 03, 2021
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  fdb57ab4
- Merge pull request #3648 from brauner/2021-02-03/fixes · f8dcf07f
  Stéphane Graber authored Feb 03, 2021
```
conf: open hardening & fd-only operations
```
  f8dcf07f
- Merge pull request #3649 from brauner/2021-02-03/attach_via_pidfds · b5e75029
  Stéphane Graber authored Feb 03, 2021
```
attach: attach to namespaces via pidfds
```
  b5e75029
- attach: attach to namespaces via pidfds · 9b31ab58
  Christian Brauner authored Feb 03, 2021
```
This is a feature we've enabled in kernel v5.8 and v5.9.
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  9b31ab58
- conf: fd-only devtps setup · a26822c5
  Christian Brauner authored Feb 03, 2021
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  a26822c5
- conf: fd-only pivot root · 7f50ec8b
  Christian Brauner authored Feb 03, 2021
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  7f50ec8b