Commits · b4c5f15e4dbdb17216f3e0eb1920c56f02f95df4 · Chen Yisong / lxc

15 Dec, 2020 16 commits
- confile: cleanup set_config_signal_reboot() · b4c5f15e
  Christian Brauner authored Dec 08, 2020
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  b4c5f15e
- confile: cleanup set_config_signal_halt() · 409f44a4
  Christian Brauner authored Dec 08, 2020
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  409f44a4
- confile: cleanup set_config_log_level() · 5e36bd6b
  Christian Brauner authored Dec 08, 2020
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  5e36bd6b
- confile: cleanup set_config_log_level() · 2d6ad5b6
  Christian Brauner authored Dec 08, 2020
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  2d6ad5b6
- confile: cleanup set_config_log_file() · 1633b15c
  Christian Brauner authored Dec 08, 2020
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  1633b15c
- confile: cleanup set_config_apparmor_raw() · 2c5cd61e
  Christian Brauner authored Dec 08, 2020
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  2c5cd61e
- confile: cleanup set_config_apparmor_allow_nesting() · dc1d08c4
  Christian Brauner authored Dec 08, 2020
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  dc1d08c4
- confile: cleanup set_config_apparmor_allow_incomplete() · 095be41e
  Christian Brauner authored Dec 08, 2020
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  095be41e
- confile: cleanup set_config_tty_max() · 399ea236
  Christian Brauner authored Dec 08, 2020
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  399ea236
- confile: cleanup set_config_environment() · 1c6e971f
  Christian Brauner authored Dec 08, 2020
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  1c6e971f
- confile: cleanup set_config_group() · cf7daa76
  Christian Brauner authored Dec 08, 2020
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  cf7daa76
- confile: cleanup set_config_monitor_signal_pdeath() · fad06846
  Christian Brauner authored Dec 08, 2020
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  fad06846
- confile: cleanup set_config_monitor() · ae09f614
  Christian Brauner authored Dec 08, 2020
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  ae09f614
- confile: cleanup set_config_start() · ef28a725
  Christian Brauner authored Dec 08, 2020
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  ef28a725
- confile: cleanup set_config_pty_max() · 1e0665e9
  Christian Brauner authored Dec 08, 2020
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  1e0665e9
- confile: cleanup set_config_personality() · 14cccbef
  Christian Brauner authored Dec 08, 2020
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  14cccbef
09 Dec, 2020 7 commits
- Restore interfaces to the correct namespace on error · 36fb1e07
  Blair Steven authored Dec 09, 2020
```
If the container unexpectedly exists we may need to restore physical
interfaces back into the main namespace in a tidy way.
Signed-off-by: Blair Steven <blair.steven@alliedtelesis.co.nz>
```
  36fb1e07
- added standard resolver option to the lxc-download.in shell script · d2938916
  Andrew Deng authored Nov 20, 2020
```
Signed-off-by: Andrew Deng <adeng1433@gmail.com>
```
  d2938916
- confile: clean up hooks · 434f12c1
  Christian Brauner authored Dec 08, 2020
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  434f12c1
- confile: clean up network configuration parsing · 2b9319af
  Christian Brauner authored Dec 08, 2020
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  2b9319af
- tree-wide: use call_cleaner(netns_freeifaddrs) · 20f0e57d
  Christian Brauner authored Dec 08, 2020
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  20f0e57d
- macro: bump MAX_GRBUF_SIZE to 2 mb · af12eb5d
  Christian Brauner authored Dec 07, 2020
```
Closes #3592.
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  af12eb5d
- macro: move MAX_GRBUF_SIZE · 41b43296
  Christian Brauner authored Dec 07, 2020
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  41b43296
04 Dec, 2020 17 commits

network: fix LXC_NET_NONE cleanup · 92bc7090

authored Dec 02, 2020

We have a case where we have a nested container with LXC_NET_NONE run
inside a container that's *also* got no network namespace (run by
lxc-usernsexec).

The "am I root" check in this function then does not suffice, since the
euid of the task is 0 but it does not have privilege over its network
namespace, and thus cannot do any of the restore operations:

lxc foo 20201201232059.271 TRACE network - network.c:lxc_restore_phys_nics_to_netns:3299 - Moving physical network devices back to parent network namespace
lxc foo 20201201232059.271 ERROR network - network.c:lxc_restore_phys_nics_to_netns:3307 - Operation not permitted - Failed to enter network namespace
lxc foo 20201201232059.271 ERROR start - start.c:__lxc_start:2045 - Failed to move physical network devices back to parent network namespace

Let's check that we indeed did clone the network namespace, and thus have
things to restore to their correct namespace before attempting to actually
restore them.

I suspect it's possible we can also get rid of some of the network namespace
preservation stuff in start.c in the LXC_NET_NONE case.
Signed-off-by: Tycho Andersen <tycho@tycho.pizza>

92bc7090

commands_utils: fix lxc-wait · b70ddc2e

authored Nov 18, 2020

Closes: #3570
Fixes: 7792a5b6 ("commands: add additional check to lxc_cmd_sock_get_state()")
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

b70ddc2e

file_utils: fix config file parsing · 1c7c31b5

authored Nov 17, 2020

We accidently used the "bytes_to_write" variable after we've written all the
bytes at which point it is guaranteed to be 0. Let's use the "bytes_read"
variable instead.
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

1c7c31b5

conf: switch to fd_to_fd() when copying mountinfo · 1e9e5816

authored Nov 16, 2020

Closes: #3580.
Link: https://bugzilla.kernel.org/show_bug.cgi?id=209971Suggested-by: Joan Bruguera <joanbrugueram@gmail.com>
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

1e9e5816

parse: rework config parsing routine · dcc39fca
Christian Brauner authored Nov 16, 2020
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
dcc39fca
cgfsng: adjust log level to warn instead of error · 1bd5fb39
lifeng68 authored Nov 13, 2020
```
Signed-off-by: lifeng68 <lifeng68@huawei.com>
```
1bd5fb39
attach: silence stdio permission adjust warnings · c5e1a70c
Christian Brauner authored Nov 05, 2020
```
Closes: #3576.
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
c5e1a70c

seccomp: log aborted system calls · 9436750e

authored Nov 02, 2020

Suggested-by: Jann Horn <jann@thejh.net>
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

9436750e

seccomp: make seccomp notifier fd non-blocking · cbb504c9

authored Nov 02, 2020

Suggested-by: Jann Horn <jann@thejh.net>
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

cbb504c9

utils: check snprintf return value · c253925b
Christian Brauner authored Oct 28, 2020
```
Fixes: Coverity 1465853
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
c253925b
conf: check snprint return value · c6c2cf30
Christian Brauner authored Oct 28, 2020
```
Fixes: Coverity 1465854
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
c6c2cf30
utils: don't deref after NULL check · 64163d8d
Christian Brauner authored Oct 28, 2020
```
Fixes: Coverity 1465855
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
64163d8d
commands: don't deref after NULL check · bd5ed71d
Christian Brauner authored Oct 28, 2020
```
Fixes: Coverity 1465657
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
bd5ed71d
tests: Fix compilation with appamor enabled. · 15190a6a
Ruben Jenster authored Oct 23, 2020
```
Signed-off-by: Ruben Jenster <r.jenster@drachenfels.de>
```
15190a6a

lxccontainer: fix lxc_config_item_is_supported · c14c31d4

authored Oct 23, 2020

Use exact match instead of longest prefix match
to check whether a config item is supported.
Signed-off-by: Ruben Jenster <r.jenster@drachenfels.de>

c14c31d4

seccomp: Avoid duplicate processing of rules for host native arch. · 55cbb1a6
Ruben Jenster authored Oct 23, 2020
```
Signed-off-by: Ruben Jenster <r.jenster@drachenfels.de>
```
55cbb1a6
seccomp: Fix handling of pseudo syscalls and improve logging for rule processing. · 687f9b9b
Ruben Jenster authored Oct 22, 2020
```
Signed-off-by: Ruben Jenster <r.jenster@drachenfels.de>
```
687f9b9b