- 28 Apr, 2018 4 commits
-
-
Christian Brauner authored
Unchecked return value Signed-off-by:Christian Brauner <christian.brauner@ubuntu.com>
-
Christian Brauner authored
Unused value Signed-off-by:Christian Brauner <christian.brauner@ubuntu.com>
-
Christian Brauner authored
Logically dead code Signed-off-by:Christian Brauner <christian.brauner@ubuntu.com>
-
Christian Brauner authored
do_lxcapi_create: set umask
-
- 26 Apr, 2018 2 commits
-
-
Christian Brauner authored
Fix tool_utils.c build when HAVE_SETNS is unset
-
Serj Kalichev authored
Add inline setns() function to tool_utils.h. Without it tool_utils.c can't be build when HAVE_SETNS is unset. Signed-off-by:Serj Kalichev <serj.kalichev@gmail.com>
-
- 24 Apr, 2018 6 commits
-
-
Christian Brauner authored
Fix memory leak in list_active_containers
-
LiFeng authored
Signed-off-by:LiFeng <lifeng68@huawei.com>
-
LiFeng authored
Signed-off-by:LiFeng <lifeng68@huawei.com>
-
Christian Brauner authored
Fix the memory leak in cgfsng_attach
-
Christian Brauner authored
Also pass action scripts to CRIU on checkpointing
-
Daniel Selifonov authored
Signed-off-by:Daniel Selifonov <ds@thyth.com>
-
- 23 Apr, 2018 2 commits
-
-
Christian Brauner authored
pam-cgfs: ignore the system umask when creating the cgroup hierarchy
-
Jonathan Calmels authored
Fixes: #2277 Signed-off-by:Jonathan Calmels <jcalmels@nvidia.com>
-
- 20 Apr, 2018 2 commits
-
-
Christian Brauner authored
lxc/tools/lxc_monitor: include missing <stddef.h>
-
Thomas Petazzoni authored
lxc_monitor.c uses offsetof(), so it should include <stddef.h>. Otherwise the build fails with the musl C library: tools/lxc_monitor.c: In function ‘lxc_abstract_unix_connect’: tools/lxc_monitor.c:324:9: warning: implicit declaration of function ‘offsetof’ [-Wimplicit-function-declaration] offsetof(struct sockaddr_un, sun_path) + len + 1); ^~~~~~~~ tools/lxc_monitor.c:324:18: error: expected expression before ‘struct’ offsetof(struct sockaddr_un, sun_path) + len + 1); ^~~~~~ Signed-off-by:Thomas Petazzoni <thomas.petazzoni@bootlin.com>
-
- 19 Apr, 2018 1 commit
-
-
Christian Brauner authored
lxc-oci: mkdir the download directory
-
- 18 Apr, 2018 4 commits
-
-
Felix Abecassis authored
Signed-off-by:Felix Abecassis <fabecassis@nvidia.com>
-
Serge Hallyn authored
seccomp: handle arch inversion - The Architecture Strikes Back
-
Christian Brauner authored
LXC generates and loads the seccomp-bpf filter in the host/container which spawn the new container. In other words, userspace N is responsible for generating and loading the seccomp-bpf filter which restricts userspace N + 1. Assume 64bit kernel and 32bit userspace running a 64bit container. In this case the 32-bit x86 userspace is used to create a seccomp-bpf filter for a 64-bit userspace. Unless one explicitly adds the 64-bit ABI to the libseccomp filter, or adjusts the default behavior for "BAD_ARCH", *all* 64-bit x86 syscalls will be blocked. Signed-off-by:
Christian Brauner <christian.brauner@ubuntu.com> Suggested-by:
Paul Moore <paul@paul-moore.com>
-
Christian Brauner authored
Rename "compat_ctx" to "contexts" and "compat_arch" to "architectures". Signed-off-by:Christian Brauner <christian.brauner@ubuntu.com>
-
- 15 Apr, 2018 4 commits
-
-
Christian Brauner authored
Closes #2280. Signed-off-by:Christian Brauner <christian.brauner@ubuntu.com>
-
Christian Brauner authored
Signed-off-by:Christian Brauner <christian.brauner@ubuntu.com>
-
Christian Brauner authored
Signed-off-by:Christian Brauner <christian.brauner@ubuntu.com>
-
Kaarle Ritvanen authored
Always use 022 as the umask when creating the rootfs directory and executing the template. A too loose umask may cause security issues. A too strict umask may cause programs to fail inside the container. Signed-off-by:Kaarle Ritvanen <kaarle.ritvanen@datakunkku.fi>
-
- 13 Apr, 2018 6 commits
-
-
Stéphane Graber authored
seccomp: handle all errors
-
Christian Brauner authored
Signed-off-by:Christian Brauner <christian.brauner@ubuntu.com>
-
Serge Hallyn authored
Merge pull request #2274 from brauner/2018-04-13/fix_seccomp_with_personality_and_64bit_kernel_32_bit_userspace seccomp: handle arch inversion
-
Christian Brauner authored
This commit deals with different kernel and userspace layouts and nesting. Here are three examples: 1. 64bit kernel and 64bit userspace running 32bit containers 2. 64bit kernel and 32bit userspace running 64bit containers 3. 64bit kernel and 64bit userspace running 32bit containers running 64bit containers Two things to lookout for: 1. The compat arch that is detected might have already been present in the main context. So check that it actually hasn't been and only then add it. 2. The contexts don't need merging if the architectures are the same and also can't be. With these changes I can run all crazy/weird combinations with proper seccomp isolation. Closes #654. Link: https://bugs.chromium.org/p/chromium/issues/detail?id=832366Reported-by:
Chirantan Ekbote <chirantan@chromium.org> Reported-by:
Sonny Rao <sonnyrao@chromium.org> Signed-off-by:
Christian Brauner <christian.brauner@ubuntu.com>
-
Christian Brauner authored
conf: fix net type checks in run_script_argv()
-
Jakub Skokan authored
Signed-off-by:Jakub Skokan <jakub.skokan@havefun.cz>
-
- 12 Apr, 2018 3 commits
-
-
Serge Hallyn authored
conf: ret-try devpts mount without gid=5 on error
-
Christian Brauner authored
When starting application containers without a mapping for container root are started, a dummy bind-mount target for lxc-init needs to be created. This will not always work directly under "/" when e.g. permissions are missing due to the ownership and/or mode of "/". We can try to work around this by using the P_tmpdir as defined in POSIX which should usually land us in /tmp where basically everyone can create files. Signed-off-by:Christian Brauner <christian.brauner@ubuntu.com>
-
Christian Brauner authored
We should always default to mounting devpts with gid=5 but we should fallback to mounting without gid=5. This let's us cover use-cases such as container started with only a single mapping e.g.: lxc.idmap = u 1000 1000 1 lxc.idmap = g 1000 1000 1 Closes #2257. Signed-off-by:Christian Brauner <christian.brauner@ubuntu.com>
-
- 11 Apr, 2018 3 commits
-
-
Serge Hallyn authored
attach: try to always drop supplementary groups
-
Serge Hallyn authored
rootfs pinning: On NFS, make file hidden but don't delete it
-
Christian Brauner authored
Signed-off-by:Christian Brauner <christian.brauner@ubuntu.com>
-
- 10 Apr, 2018 2 commits
-
-
Stéphane Graber authored
attach: always drop supplementary groups
-
Christian Brauner authored
Closes #2248. Signed-off-by:Christian Brauner <christian.brauner@ubuntu.com>
-
- 09 Apr, 2018 1 commit
-
-
Christian Brauner authored
Mergeable branch for C0deAi fixes
-