Commits · ea57e42409bf56b60759c0fffc978ba116a711ce · Chen Yisong / lxc · GitLab

04 Feb, 2021 14 commits
- tree-wide: s/mntpt_fd/dfd_mnt/g · ea57e424
  Christian Brauner authored Feb 04, 2021
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  ea57e424
- tree-wide: s/dev_mntpt_fd/dfd_dev/g · a5a08920
  Christian Brauner authored Feb 04, 2021
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  a5a08920
- syscall_wrappers: fix PROTECT_OPEN_W macro · 8ea5110c
  Christian Brauner authored Feb 04, 2021
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  8ea5110c
- conf: restricted fd-only lxc_fill_autodev() · 927ea337
  Christian Brauner authored Feb 04, 2021
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  927ea337
- conf: start stashing dfd to host's / during container setup · a370f16b
  Christian Brauner authored Feb 04, 2021
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  a370f16b
- conf: fix lxc_setup_dev_console() · 86087bd6
  Christian Brauner authored Feb 04, 2021
```
We were printing garbage on accident.
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  86087bd6
- utils: add mount_from_at() · 977687db
  Christian Brauner authored Feb 04, 2021
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  977687db
- cgroups: restrict open calls in cgroup_attach_create_leaf() · 7043e2b4
  Christian Brauner authored Feb 04, 2021
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  7043e2b4
- cgroups: improve error handling and logging in cgroup_attach_leaf() · 6e2078de
  Christian Brauner authored Feb 04, 2021
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  6e2078de
- cgroups: fix argument vetting in cgroup_attach() · 88c27c53
  Christian Brauner authored Feb 04, 2021
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  88c27c53
- attach: fix fallback logic when attaching to cgroups · 9a57778b
  Christian Brauner authored Feb 04, 2021
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  9a57778b
- cgroups: switch to fd-based cgroup mounting · 02efd041
  Christian Brauner authored Feb 04, 2021
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  02efd041
- cgroups: restricted fd-only controller mountpoint creation · c689b58a
  Christian Brauner authored Feb 04, 2021
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  c689b58a
- cgroups: fix cgroup mounting · 315f8a4e
  Christian Brauner authored Feb 04, 2021
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  315f8a4e
03 Feb, 2021 20 commits
- Merge pull request #3650 from brauner/2021-02-03/fixes_1 · dfb71524
  Stéphane Graber authored Feb 03, 2021
```
conf: harden various mount paths
```
  dfb71524
- utils: harden __safe_mount_beneath_at() · cbc2ddf5
  Christian Brauner authored Feb 03, 2021
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  cbc2ddf5
- conf: refactor transient procfs mounting · 952b5031
  Christian Brauner authored Feb 03, 2021
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  952b5031
- conf: restrict open call in lxc_mount_rootfs() · ccf53741
  Christian Brauner authored Feb 03, 2021
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  ccf53741
- conf: make lxc_create_tmp_proc_mount() static · e1b9d6af
  Christian Brauner authored Feb 03, 2021
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  e1b9d6af
- conf: coding style · fdb57ab4
  Christian Brauner authored Feb 03, 2021
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  fdb57ab4
- Merge pull request #3648 from brauner/2021-02-03/fixes · f8dcf07f
  Stéphane Graber authored Feb 03, 2021
```
conf: open hardening & fd-only operations
```
  f8dcf07f
- Merge pull request #3649 from brauner/2021-02-03/attach_via_pidfds · b5e75029
  Stéphane Graber authored Feb 03, 2021
```
attach: attach to namespaces via pidfds
```
  b5e75029
- attach: attach to namespaces via pidfds · 9b31ab58
  Christian Brauner authored Feb 03, 2021
```
This is a feature we've enabled in kernel v5.8 and v5.9.
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  9b31ab58
- conf: fd-only devtps setup · a26822c5
  Christian Brauner authored Feb 03, 2021
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  a26822c5
- conf: fd-only pivot root · 7f50ec8b
  Christian Brauner authored Feb 03, 2021
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  7f50ec8b
- conf: restrict open for lxc_mount_rootfs() · 99ca5632
  Christian Brauner authored Feb 03, 2021
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  99ca5632
- conf: fd-only operations in lxc_setup_dev_symlinks() · 79019997
  Christian Brauner authored Feb 03, 2021
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  79019997
- conf: harden open in lxc_fill_autodev() · 81498328
  Christian Brauner authored Feb 03, 2021
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  81498328
- conf: restrict open of dev/ · ce011f53
  Christian Brauner authored Feb 03, 2021
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  ce011f53
- conf: remove unnecessary syscall · fdf7314d
  Christian Brauner authored Feb 03, 2021
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  fdf7314d
- rexec: mark all fds as close-on-exec if possible · 531d36ad
  Christian Brauner authored Feb 03, 2021
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  531d36ad
- syscalls: add close_range() · e8aaef81
  Christian Brauner authored Feb 03, 2021
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  e8aaef81
- rexec: check lseek() return value · 6b69d7f8
  Christian Brauner authored Feb 03, 2021
```
Not really needed buy ok.

Fixes: Coverity: 1472769
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  6b69d7f8
- tests: check for NULL in device_add_remove · 3c981fcb
  Christian Brauner authored Feb 03, 2021
```
Fixes: Coverity 1472768
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  3c981fcb
02 Feb, 2021 6 commits
- Merge pull request #3647 from brauner/2021-02-02/fixes · 07f89a4f
  Stéphane Graber authored Feb 02, 2021
```
cgroup2: only rely on command socket when getting cgroup values
```
  07f89a4f
- cgroups: improve parameter vetting · b7aeda96
  Christian Brauner authored Feb 03, 2021
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  b7aeda96
- tests: support pure unified cgroup layouts in cgpath test · 7d013ccc
  Christian Brauner authored Feb 02, 2021
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  7d013ccc
- test: add logging to device_add_remove · a4f24357
  Christian Brauner authored Feb 02, 2021
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  a4f24357
- freezer: remove lxc_cmd_freeze() and lxc_cmd_unfreeze() calls · ea299bfc
  Christian Brauner authored Feb 02, 2021
```
We're now handling them better.
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  ea299bfc
- commands: use __cgroup_unfreeze() directly · 9d47970b
  Christian Brauner authored Feb 02, 2021
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  9d47970b