- 25 Nov, 2013 9 commits
-
-
Stéphane Graber authored
Signed-off-by:Stéphane Graber <stgraber@ubuntu.com>
-
Stéphane Graber authored
Signed-off-by:Stéphane Graber <stgraber@ubuntu.com>
-
James Hunt authored
Signed-off-by:
James Hunt <james.hunt@ubuntu.com> Acked-by:
Stéphane Graber <stgraber@ubuntu.com>
-
Guilhem Lettron authored
Signed-off-by:
Guilhem Lettron <guilhem.lettron@optiflows.com> Acked-by:
Stéphane Graber <stgraber@ubuntu.com>
-
Guilhem Lettron authored
Signed-off-by:
Guilhem Lettron <guilhem.lettron@optiflows.com> Acked-by:
Stéphane Graber <stgraber@ubuntu.com>
-
Guilhem Lettron authored
Signed-off-by:
Guilhem Lettron <guilhem.lettron@optiflows.com> Acked-by:
Stéphane Graber <stgraber@ubuntu.com>
-
Guilhem Lettron authored
This adds support for "packages", "user" and "password" Signed-off-by:
Guilhem Lettron <guilhem.lettron@optiflows.com> Acked-by:
Stéphane Graber <stgraber@ubuntu.com>
-
Elan Ruusamäe authored
Signed-off-by:
Elan Ruusamäe <glen@delfi.ee> Acked-by:
Stéphane Graber <stgraber@ubuntu.com>
-
KATOH Yasufumi authored
Update for commit 4d69b293Signed-off-by:
KATOH Yasufumi <karma@jazz.email.ne.jp> Acked-by:
Stéphane Graber <stgraber@ubuntu.com>
-
- 22 Nov, 2013 6 commits
-
-
Serge Hallyn authored
In general proc gets mounted ahead of time, so init shouldn't have to do it. Without this patch, you cannot lxc-execute -n x1 -s lxc.cap.drop=sys_admin /bin/bash (See https://bugs.launchpad.net/ubuntu/+source/lxc/+bug/1253669 for a bug about this) Signed-off-by:
Serge Hallyn <serge.hallyn@ubuntu.com> Acked-by:
Stéphane Graber <stgraber@ubuntu.com>
-
Serge Hallyn authored
This is necessary to have the rights to remove files owned by our subuids. Also update lxc_rmdir_onedev to return 0 on success, -1 on failure. Callers were not consistent in using it correctly, and this is more in keeping with the rest of our code. Signed-off-by:
Serge Hallyn <serge.hallyn@ubuntu.com> Acked-by:
Stéphane Graber <stgraber@ubuntu.com>
-
Stéphane Graber authored
Signed-off-by:Stéphane Graber <stgraber@ubuntu.com>
-
S.Çağlar Onur authored
Signed-off-by:
S.Çağlar Onur <caglar@10ur.org> Signed-off-by:
Serge Hallyn <serge.hallyn@ubuntu.com>
-
Serge Hallyn authored
Always build lxc-usernsexec. Else we require having uidmap installed on the build host for no good reason. And we never actually used the NEWUIDMAP path we detected. Signed-off-by:
Serge Hallyn <serge.hallyn@ubuntu.com> Acked-by:
Stéphane Graber <stgraber@ubuntu.com>
-
Serge Hallyn authored
Signed-off-by:Serge Hallyn <serge.hallyn@ubuntu.com>
-
- 21 Nov, 2013 3 commits
-
-
Michael H. Warfield authored
Added a file "lxc.service" for a systemd service file. Added a file "lxc-devsetup" to setup /dev/ on startup to support autodev in containers. Service file references lxc-devsetup as an ExecStartPre command. The lxc-devsetup script is not dependent on systemd or Fedora and can be used at bootup on any system. Modified lxc.spec.in to install the two new files on Fedora. The systemd specific code in the lxc.spec file may need some review and conditionalize for systemd on non-systemd rpm-based systems. Signed-off-by:
Michael H. Warfield <mhw@WittsEnd.com> Signed-off-by:
Serge Hallyn <serge.hallyn@ubuntu.com>
-
Serge Hallyn authored
If the container is dir-backed, we don't actually mount it (to support unprivileged use). So always set the LXC_ROOTFS_MOUNT to bdev->dest, not to the rootfs path specified in the container configuration. This should fix bug http://pad.lv/1253573Signed-off-by:
Serge Hallyn <serge.hallyn@ubuntu.com> Acked-by:
Stéphane Graber <stgraber@ubuntu.com>
-
Michael H. Warfield authored
If autodev is not specifically set to 0 or 1, attempts to determine if systemd is being utilized and forces autodev=1 to prevent host system conflicts and collisions. If autodev is enabled and the host /dev is mounted with devtmpfs or /dev/.lxc is mounted with another file system... Each container created by a privileged user gets a /dev directory mapped off the host /dev here: /dev/.lxc/${name}.$( hash $lxcpath/$name ) Each container created by a non-privileged user gets a /dev/directory mapped off the host /dev here: /dev/.lxc/user/${name}.$( hash $lxcpath/$name ) The /dev/.lxc/user is mode 1777 to allow unpriv access. The /dev/.lxc/{containerdev} is bind mounted into the container /dev. Fallback on failure is to mount tmpfs into the container /dev. A symlink is created from $lxcpath/$name/rootfs.dev back to the /dev relative directory to provid a code consistent reference for updating container devs. Signed-off-by:Michael H. Warfield <mhw@WittsEnd.com> Signed-off-by:
Serge Hallyn <serge.hallyn@ubuntu.com>
-
- 20 Nov, 2013 3 commits
-
-
Nikola Kotur authored
There are scenarios in which we want to execute process with specific privileges elevated. An example for this might be executing a process inside the container securely, with capabilities dropped, but not in container's cgroup so that we can have per process restrictions inside single container. Similar to namespaces, privileges to be elevated can be OR'd: lxc-attach --elevated-privileges='CAP|CGROUP' ... Backward compatibility with previous versions is retained. In case no privileges are specified behaviour is the same as before: all of them are elevated. Signed-off-by:Nikola Kotur <kotnick@gmail.com> Acked-By:
Christian Seiler <christian@iwakd.de> Signed-off-by:
Serge Hallyn <serge.hallyn@ubuntu.com>
-
Serge Hallyn authored
We were finding it, but not saving it. Signed-off-by:Serge Hallyn <serge.hallyn@ubuntu.com>
-
S.Çağlar Onur authored
Free previously allocated memory if realloc fails. Signed-off-by:
S.Çağlar Onur <caglar@10ur.org> Signed-off-by:
Serge Hallyn <serge.hallyn@ubuntu.com>
-
- 19 Nov, 2013 15 commits
-
-
Serge Hallyn authored
Signed-off-by:Serge Hallyn <serge.hallyn@ubuntu.com>
-
Serge Hallyn authored
Signed-off-by:
Serge Hallyn <serge.hallyn@ubuntu.com> Acked-by:
Stéphane Graber <stgraber@ubuntu.com>
-
Serge Hallyn authored
Signed-off-by:
Serge Hallyn <serge.hallyn@ubuntu.com> Acked-by:
Stéphane Graber <stgraber@ubuntu.com>
-
Serge Hallyn authored
Signed-off-by:
Serge Hallyn <serge.hallyn@ubuntu.com> Acked-by:
Stéphane Graber <stgraber@ubuntu.com>
-
Serge Hallyn authored
get_allotted doesn't get the list of nic names, only the # of nics allowed to the user. We check the db_file later for existing number of nics. Also close the conf file on success, and print filename and errno if we failed to open conf file. Signed-off-by:
Serge Hallyn <serge.hallyn@ubuntu.com> Acked-by:
Stéphane Graber <stgraber@ubuntu.com>
-
Serge Hallyn authored
Signed-off-by:
Serge Hallyn <serge.hallyn@ubuntu.com> Acked-by:
Stéphane Graber <stgraber@ubuntu.com>
-
Serge Hallyn authored
Everywhere else return an error code instead. Signed-off-by:
Serge Hallyn <serge.hallyn@ubuntu.com> Acked-by:
Stéphane Graber <stgraber@ubuntu.com>
-
Serge Hallyn authored
Signed-off-by:
Serge Hallyn <serge.hallyn@ubuntu.com> Acked-by:
Stéphane Graber <stgraber@ubuntu.com>
-
Serge Hallyn authored
Signed-off-by:
Serge Hallyn <serge.hallyn@ubuntu.com> Acked-by:
Stéphane Graber <stgraber@ubuntu.com>
-
Serge Hallyn authored
Temporarily set our euid back to the calling ruid, so that the access(2) check can succeed based on the euid being the userns creator. Also switch from atoi to strtol Signed-off-by:
Serge Hallyn <serge.hallyn@ubuntu.com> Acked-by:
Stéphane Graber <stgraber@ubuntu.com>
-
S.Çağlar Onur authored
This also fixes possible crashes due to passing NULL to strlen function Changes since v1; * Fixed a typo spotted by Serge Signed-off-by:
S.Çağlar Onur <caglar@10ur.org> Signed-off-by:
Serge Hallyn <serge.hallyn@ubuntu.com>
-
Dwight Engen authored
Signed-off-by:
Dwight Engen <dwight.engen@oracle.com> Signed-off-by:
Serge Hallyn <serge.hallyn@ubuntu.com>
-
Dwight Engen authored
This allows the boot messages to be seen which are useful for monitoring container startup. Signed-off-by:
Dwight Engen <dwight.engen@oracle.com> Signed-off-by:
Serge Hallyn <serge.hallyn@ubuntu.com>
-
Dwight Engen authored
This is needed when using the user namespace since the kernel check does not allow user_ns root to successfully call vhangup(2), and mingetty will quit in this case. Signed-off-by:
Dwight Engen <dwight.engen@oracle.com> Signed-off-by:
Serge Hallyn <serge.hallyn@ubuntu.com>
-
Dwight Engen authored
Signed-off-by:
Dwight Engen <dwight.engen@oracle.com> Signed-off-by:
Serge Hallyn <serge.hallyn@ubuntu.com>
-
- 18 Nov, 2013 4 commits
-
-
S.Çağlar Onur authored
Signed-off-by:
S.Çağlar Onur <caglar@10ur.org> Acked-by:
Serge E. Hallyn <serge.hallyn@ubuntu.com>
-
S.Çağlar Onur authored
Signed-off-by:
S.Çağlar Onur <caglar@10ur.org> Acked-by:
Serge E. Hallyn <serge.hallyn@ubuntu.com>
-
KATOH Yasufumi authored
Improve the consistency of expression Signed-off-by:
KATOH Yasufumi <karma@jazz.email.ne.jp> Acked-by:
Stéphane Graber <stgraber@ubuntu.com>
-
Nikola Kotur authored
Signed-off-by:
Nikola Kotur <kotnick@gmail.com> Acked-by:
Dwight Engen <dwight.engen@oracle.com>
-