Skip to content

L
lxc
Switch branch/tag
  1. 01 Aug, 2017 16 commits
  3. 31 Jul, 2017 2 commits
  5. 30 Jul, 2017 3 commits
  7. 29 Jul, 2017 4 commits
  9. 28 Jul, 2017 7 commits
  11. 27 Jul, 2017 2 commits
  13. 26 Jul, 2017 4 commits
  15. 25 Jul, 2017 1 commit
  17. 24 Jul, 2017 1 commit
    • start: lxc_setup() after unshare(CLONE_NEWCGROUP) · f4152036
      Christian Brauner authored 
      When the running kernel supports cgroup namespaces and users want to manually
set up cgroups via lxc.hook.mount before the init binary starts the cgroup
namespace needs to be already unshared. Otherwise the view on the cgroup mounts
is wrong. This commit places the call to lxc_setup() after the
LXC_SYNC_POST_CGROUP barrier.

Before this commit, the tty fds we allocate from a fresh devpts instance in the
container's namespaces before the init binary starts were referring to the
host's cgroup namespace since lxc_setup() was called before
unshare(CLONE_NEWCGROUP). Although not a security risk at this point since
setns() restricts its calls to /proc/<self>/ns files it's still better to do it
*after* the cgroup namespace has been unshared.

Adding a Suggested-by line for the lxc.mount.hook fix for Quentin.

Closes #1597.
Suggested-by: 's avatarQuentin Dufour <quentin@dufour.tk>
Signed-off-by: 's avatarChristian Brauner <christian.brauner@ubuntu.com>