Commits · 7cec31a9afb2fcfa4dde1edcec8b341c5d5254dd · Chen Yisong / lxc · GitLab

26 Feb, 2021 40 commits
- attach_options: use standard C pointer syntax · 7cec31a9
  Christian Brauner authored Feb 05, 2021
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  7cec31a9
- attach_options: initialize .groups · 2ab3ea3e
  Christian Brauner authored Feb 05, 2021
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  2ab3ea3e
- attach: Add groups option to keep additional group IDs. · 8066b01f
  Ruben Jenster authored Feb 04, 2021
```
Signed-off-by: Ruben Jenster <r.jenster@drachenfels.de>
```
  8066b01f
- confile: add lxc.init.groups to keep additional groups · e778f973
  Ruben Jenster authored Oct 30, 2020
```
Signed-off-by: Ruben Jenster <r.jenster@drachenfels.de>
```
  e778f973
- utils: rework lxc_setgroups() · 7e9d3f20
  Christian Brauner authored Feb 05, 2021
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  7e9d3f20
- tree-wide: use lxc_drop_groups() instead of lxc_setgroups(0, NULL) · 1529fd39
  Christian Brauner authored Feb 05, 2021
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  1529fd39
- utils: add lxc_drop_groups() · 35c45e17
  Christian Brauner authored Feb 05, 2021
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  35c45e17
- utils: check for snprintf() error · fde1420c
  Christian Brauner authored Feb 04, 2021
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  fde1420c
- attach: improve logging and terminology · 883a6f8f
  Christian Brauner authored Feb 04, 2021
```
The term "intermediate process" is not very nice imho, "transient process" fits
better.
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  883a6f8f
- cgroups: check for correct error in __cg_unified_attach() from cgroup_attach() · f6666d3b
  Christian Brauner authored Feb 04, 2021
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  f6666d3b
- tree-wide: s/dfd_root_host/dfd_host/g · cb17f83f
  Christian Brauner authored Feb 04, 2021
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  cb17f83f
- tree-wide: s/mntpt_fd/dfd_mnt/g · 856fb719
  Christian Brauner authored Feb 04, 2021
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  856fb719
- tree-wide: s/dev_mntpt_fd/dfd_dev/g · acf2aed8
  Christian Brauner authored Feb 04, 2021
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  acf2aed8
- syscall_wrappers: fix PROTECT_OPEN_W macro · 3bc37321
  Christian Brauner authored Feb 04, 2021
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  3bc37321
- conf: restricted fd-only lxc_fill_autodev() · 4eaba6a4
  Christian Brauner authored Feb 04, 2021
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  4eaba6a4
- conf: start stashing dfd to host's / during container setup · d6c618aa
  Christian Brauner authored Feb 04, 2021
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  d6c618aa
- conf: fix lxc_setup_dev_console() · f4c43287
  Christian Brauner authored Feb 04, 2021
```
We were printing garbage on accident.
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  f4c43287
- utils: add mount_from_at() · 7ce4f69a
  Christian Brauner authored Feb 04, 2021
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  7ce4f69a
- cgroups: restrict open calls in cgroup_attach_create_leaf() · 37b56e97
  Christian Brauner authored Feb 04, 2021
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  37b56e97
- cgroups: improve error handling and logging in cgroup_attach_leaf() · 1041c03b
  Christian Brauner authored Feb 04, 2021
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  1041c03b
- cgroups: fix argument vetting in cgroup_attach() · 85aaa781
  Christian Brauner authored Feb 04, 2021
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  85aaa781
- attach: fix fallback logic when attaching to cgroups · 9f880a8a
  Christian Brauner authored Feb 04, 2021
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  9f880a8a
- cgroups: switch to fd-based cgroup mounting · f10d69e3
  Christian Brauner authored Feb 04, 2021
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  f10d69e3
- cgroups: restricted fd-only controller mountpoint creation · 0c58dd31
  Christian Brauner authored Feb 04, 2021
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  0c58dd31
- utils: harden __safe_mount_beneath_at() · c8c6a0a7
  Christian Brauner authored Feb 03, 2021
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  c8c6a0a7
- conf: refactor transient procfs mounting · 8e262f5e
  Christian Brauner authored Feb 03, 2021
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  8e262f5e
- conf: restrict open call in lxc_mount_rootfs() · 7413dcc0
  Christian Brauner authored Feb 03, 2021
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  7413dcc0
- conf: make lxc_create_tmp_proc_mount() static · 8c979bf2
  Christian Brauner authored Feb 03, 2021
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  8c979bf2
- conf: coding style · f146497f
  Christian Brauner authored Feb 03, 2021
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  f146497f
- attach: attach to namespaces via pidfds · 908a0174
  Christian Brauner authored Feb 03, 2021
```
This is a feature we've enabled in kernel v5.8 and v5.9.
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  908a0174
- conf: fd-only devtps setup · 8fc6f417
  Christian Brauner authored Feb 03, 2021
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  8fc6f417
- conf: fd-only pivot root · 65d42af0
  Christian Brauner authored Feb 03, 2021
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  65d42af0
- conf: restrict open for lxc_mount_rootfs() · 8a1a6dd6
  Christian Brauner authored Feb 03, 2021
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  8a1a6dd6
- conf: fd-only operations in lxc_setup_dev_symlinks() · ec09da6f
  Christian Brauner authored Feb 03, 2021
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  ec09da6f
- conf: harden open in lxc_fill_autodev() · c18a6ad1
  Christian Brauner authored Feb 03, 2021
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  c18a6ad1
- conf: restrict open of dev/ · ebb4d1a2
  Christian Brauner authored Feb 03, 2021
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  ebb4d1a2
- conf: remove unnecessary syscall · d3491dfc
  Christian Brauner authored Feb 03, 2021
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  d3491dfc
- rexec: mark all fds as close-on-exec if possible · e85a4792
  Christian Brauner authored Feb 03, 2021
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  e85a4792
- syscalls: add close_range() · 83cd77db
  Christian Brauner authored Feb 03, 2021
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  83cd77db
- tests: check for NULL in device_add_remove · 24cd4551
  Christian Brauner authored Feb 03, 2021
```
Fixes: Coverity 1472768
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  24cd4551