Commits · eaafcd25fdffd7fedb10066d30fc1735d55c2548 · Chen Yisong / lxc · GitLab

26 Feb, 2021 40 commits
- lxccontainer: use correct error checks · eaafcd25
  Christian Brauner authored Feb 02, 2021
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  eaafcd25
- cgroups: vet parameters · cae16593
  Christian Brauner authored Feb 02, 2021
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  cae16593
- cgroups: remove unused conf argument · 8ab39cf2
  Christian Brauner authored Feb 02, 2021
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  8ab39cf2
- cgroups: rewind() file before polling again · cfb4d8d5
  Christian Brauner authored Feb 02, 2021
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  cfb4d8d5
- lxccontainer: use cgroup_freeze() and cgroup_unfreeze() · cb1c2544
  Christian Brauner authored Feb 02, 2021
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  cb1c2544
- freezer: make methods return bool · c275ab2d
  Christian Brauner authored Feb 02, 2021
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  c275ab2d
- cgroups: add cgroup_freeze() and cgroup_unfreeze() · e2298782
  Christian Brauner authored Feb 02, 2021
```
These are unified hierarchy only methods which don't need to initialize a full
cgroup driver. Instead, they rely on the command socket to retrieve a cgroup2
file descriptor to the container's cgroup.
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  e2298782
- freezer: use lxc_cmd_notify_state_listeners() · 071ed26f
  Christian Brauner authored Feb 02, 2021
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  071ed26f
- commands_utils: add lcx_cmd_notify_state_listeners() · 3bad551f
  Christian Brauner authored Feb 02, 2021
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  3bad551f
- cgroups: annotate cgroup_get()/cgroup_set() · 7f01b880
  Christian Brauner authored Feb 02, 2021
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  7f01b880
- cgroups: move functions after methods · db4482ef
  Christian Brauner authored Feb 02, 2021
```
This makes it more obvious that they are separate.
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  db4482ef
- lxccontainer: use cgroup_set() · 8cf74c65
  Christian Brauner authored Feb 02, 2021
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  8cf74c65
- lxccontainer: use correct variable ordering · 562c20d8
  Christian Brauner authored Feb 02, 2021
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  562c20d8
- cgroups: add croup_set() · e0f5c4e8
  Christian Brauner authored Feb 02, 2021
```
This is a unified hierarchy only method which doesn't need to initialize a full
cgroup driver. Instead, it relies on the command socket to retrieve a cgroup2
file descriptor to the container's cgroup.
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  e0f5c4e8
- cgroups: reorder cgroup_get() arguments · 5793c6c6
  Christian Brauner authored Feb 02, 2021
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  5793c6c6
- lxccontainer: use cgroup_get() · cc9644d2
  Christian Brauner authored Feb 02, 2021
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  cc9644d2
- cgroups: add cgroup_get() · 6d9ba015
  Christian Brauner authored Feb 02, 2021
```
This is a unified hierarchy only method which doesn't need to initialize a full
cgroup driver. Instead, it relies on the command socket to retrieve a cgroup2
file descriptor to the container's cgroup.
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  6d9ba015
- file_utils: add lxc_read_try_buf_at() · d2605aa8
  Christian Brauner authored Feb 02, 2021
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  d2605aa8
- macro: abuse ENOMEDIUM as ENOCGROUP2 · 500b6698
  Christian Brauner authored Feb 02, 2021
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  500b6698
- cgroups: switch controller delegation to fd-only operations · c0d717c3
  Christian Brauner authored Feb 02, 2021
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  c0d717c3
- cgroups: add unified_cgroup_fd() helper · 6870cd28
  Christian Brauner authored Feb 02, 2021
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  6870cd28
- file_utils: harden lxc_writeat() · 579a0d46
  Christian Brauner authored Feb 02, 2021
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  579a0d46
- file_utils: harden lxc_open_dirfd() · 11a2f972
  Christian Brauner authored Feb 02, 2021
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  11a2f972
- memory_utils: add close_prot_errno_mov() · 826de44f
  Christian Brauner authored Feb 02, 2021
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  826de44f
- attach: move loading seccomp as late as possible · f3b1c046
  Christian Brauner authored Feb 02, 2021
```
We want to minimize the change that the profile blocks syscalls we need during
attach setup and has the notifier enabled.
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  f3b1c046
- attach: move file descriptor closing into attach_context_container() · ec5ce3bb
  Christian Brauner authored Feb 02, 2021
```
This reduces the possibility of forgetting to close the namespace file
descriptors when we change this codepath.
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  ec5ce3bb
- attach: stricter lookup semantics for fdopen_at() calls · 639acb79
  Christian Brauner authored Feb 02, 2021
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  639acb79
- attach: use correct put method · 5d9569ca
  Christian Brauner authored Feb 01, 2021
```
Fixes: Coverity 1472763
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  5d9569ca
- attach: prevent UAF · 5e6b9c8a
  Christian Brauner authored Feb 01, 2021
```
Fixes: Coverity 1472761
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  5e6b9c8a
- attach: file descriptor based fdinfo handling · 35c672e8
  Christian Brauner authored Feb 01, 2021
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  35c672e8
- file_utils: remove O_NOFOLLOW from open_at() defaults · 60e1cd4e
  Christian Brauner authored Feb 01, 2021
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  60e1cd4e
- lsm: harden read_file_at() · d81eb918
  Christian Brauner authored Feb 01, 2021
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  d81eb918
- tree-wide: extend read_file_at() · 78a14d81
  Christian Brauner authored Feb 01, 2021
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  78a14d81
- attach: harden open calls · af0660e4
  Christian Brauner authored Feb 01, 2021
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  af0660e4
- syscall_wrappers: add PROTECT_LOOKUP, PROTECT_OPEN,… · 2aeb8b81
  Christian Brauner authored Feb 01, 2021
```
syscall_wrappers: add PROTECT_LOOKUP, PROTECT_OPEN, PROTECT_LOOKUP_WITH_SYMLINKS, PROTECT_OPEN_WITH_TRAILING_SYMLINKS
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  2aeb8b81
- file_utils: add open_at() · 73c476c5
  Christian Brauner authored Feb 01, 2021
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  73c476c5
- cgroups: remove pointless NULL checks · c6071562
  Christian Brauner authored Feb 01, 2021
```
We're already ensuring before that conf isn't NULL.
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  c6071562
- attach: stash host uid and host gid in attach_context · 07897df2
  Christian Brauner authored Feb 01, 2021
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  07897df2
- attach: document attach_context · 0c2b56fd
  Christian Brauner authored Feb 01, 2021
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  0c2b56fd
- attach: simplify opening of /proc/self · 58d62c86
  Christian Brauner authored Feb 01, 2021
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  58d62c86