Commits · f640cf46061737879f263ea42d733a1e7e4eec9b · Chen Yisong / lxc

29 Jul, 2018 18 commits
- network: s/write()/lxc_write_nointr()/g · f640cf46
  Christian Brauner authored Jul 29, 2018
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  f640cf46
- network: s/read()/lxc_read_nointr()/g · c72cda4e
  Christian Brauner authored Jul 29, 2018
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  c72cda4e
- lxccontainer: s/read()/lxc_read_nointr()/g · 3e1e9db8
  Christian Brauner authored Jul 29, 2018
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  3e1e9db8
- lxccontainer: s/write()/lxc_write_nointr()/g · 2a2a676d
  Christian Brauner authored Jul 29, 2018
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  2a2a676d
- criu: s/write()/lxc_write_nointr()/g · 614be9bc
  Christian Brauner authored Jul 29, 2018
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  614be9bc
- criu: s/read()/lxc_read_nointr()/g · 668ba602
  Christian Brauner authored Jul 29, 2018
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  668ba602
- cmd: s/read()/lxc_read_nointr()/g · 243fdadf
  Christian Brauner authored Jul 29, 2018
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  243fdadf
- cmd: s/write()/lxc_write_nointr()/g · ff50dd77
  Christian Brauner authored Jul 29, 2018
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  ff50dd77
- cmd: s/pipe()/pipe2()/g · 04dc1c00
  Christian Brauner authored Jul 29, 2018
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  04dc1c00
- lxccontainer: s/pipe()/pipe2()/g · 0ac84f04
  Christian Brauner authored Jul 29, 2018
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  0ac84f04
- lxccontainer: cleanup do_lxcapi_get_interfaces() · 9f4866a6
  Christian Brauner authored Jul 29, 2018
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  9f4866a6
- criu: s/pipe()/pipe2()/ · de31cb57
  Christian Brauner authored Jul 29, 2018
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  de31cb57
- conf: always close pipe in run_userns_fn() · adaffdd7
  Christian Brauner authored Jul 29, 2018
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  adaffdd7
- conf: s/pipe()/pipe2()/g · 979f9e34
  Christian Brauner authored Jul 29, 2018
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  979f9e34
- Merge pull request #2497 from brauner/2018-07-29/nl_fix · 646b1be9
  Christian Brauner authored Jul 29, 2018
```
nl: avoid NULL pointer dereference
```
  646b1be9
- nl: avoid NULL pointer dereference · c8f05589
  Rafał Miłecki authored Jul 29, 2018
```
It's a valid case to call nla_put() with NULL data and 0 len. It's done e.g. in
the nla_put_attr().

There has to be a check for data in nla_put() as passing NULL to the memcpy()
is not allowed. Even if length is 0, both pointers have to be valid.

For a reference see C99 standard (7.21.1/2), it says: "pointer arguments on
such a call shall still have valid values".
Reported-by: Daniel Gimpelevich <daniel@gimpelevich.san-francisco.ca.us>
Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
[christian.brauner@ubuntu.com: adapted commit message]
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  c8f05589
- Merge pull request #2496 from flx42/nvidia-hook-lgpl · a4f181a4
  Stéphane Graber authored Jul 28, 2018
```
Fix license of the nvidia hook
```
  a4f181a4
- Fix license of the nvidia hook · d23c6cc9
  Felix Abecassis authored Jul 28, 2018
```
Fixes: #2494
Signed-off-by: Felix Abecassis <fabecassis@nvidia.com>
```
  d23c6cc9
26 Jul, 2018 17 commits
- Merge pull request #2493 from brauner/2018-07-26/bugfixes · 38a8a5e5
  Stéphane Graber authored Jul 26, 2018
```
utils: add lxc_iterate_parts(), compile with -Wvla and -std=gnu11
```
  38a8a5e5
- autotools: default to -Wvla -std=gnu11 · 81a56e80
  Christian Brauner authored Jul 26, 2018
```
We can't really support anything less than gcc-4.8 anyway.
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  81a56e80
- include: remove VLAs · dd94de5a
  Christian Brauner authored Jul 26, 2018
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  dd94de5a
- tests: remove VLAs · f994bc87
  Christian Brauner authored Jul 26, 2018
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  f994bc87
- Makefile: add missing lxctest.h · b84eb74f
  Christian Brauner authored Jul 26, 2018
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  b84eb74f
- utils: s/strtok_r()/lxc_iterate_parts()/g · 84c5549b
  Christian Brauner authored Jul 26, 2018
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  84c5549b
- tools: s/strtok_r()/lxc_iterate_parts()/g · 7de8e0a9
  Christian Brauner authored Jul 26, 2018
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  7de8e0a9
- storage: s/strtok_r()/lxc_iterate_parts()/g · eb29852f
  Christian Brauner authored Jul 26, 2018
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  eb29852f
- state: s/strtok_r()/lxc_iterate_parts()/g · 89aca5a5
  Christian Brauner authored Jul 26, 2018
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  89aca5a5
- parse: s/strtok_r()/lxc_iterate_parts()/g · 834027f1
  Christian Brauner authored Jul 26, 2018
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  834027f1
- namespace: s/strtok_r()/lxc_iterate_parts()/g · 803fd7bf
  Christian Brauner authored Jul 26, 2018
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  803fd7bf
- lxccontainer: s/strtok_r()/lxc_iterate_parts()/g · 3c1f04cd
  Christian Brauner authored Jul 26, 2018
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  3c1f04cd
- confile: s/strtok_r()/lxc_iterate_parts()/g · 62dd965e
  Christian Brauner authored Jul 26, 2018
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  62dd965e
- conf: s/strtok_r()/lxc_iterate_parts()/g · 8db9d26f
  Christian Brauner authored Jul 26, 2018
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  8db9d26f
- cgroups: s/strtok_r()/lxc_iterate_parts() · 0be0d78f
  Christian Brauner authored Jul 26, 2018
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  0be0d78f
- utils: add lxc_iterate_parts() · 521b4771
  Christian Brauner authored Jul 26, 2018
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  521b4771
- Merge pull request #2479 from Blub/apparmor-profiles · 40008155
  Serge Hallyn authored Jul 25, 2018
```
RFC: Generated Apparmor profiles, namespaces, stacking
```
  40008155
25 Jul, 2018 5 commits

tests: add test for generated apparmor profiles · e7311a84
Wolfgang Bumiller authored Jul 24, 2018
```
Signed-off-by: Wolfgang Bumiller <w.bumiller@proxmox.com>
```
e7311a84

apparmor: allow start-container to change to lxc-** · 242a9fa7

authored Jul 24, 2018

For generated profiles with apparmor namespaces we get
profile names with slashes in them. To match those, we need
to allow changing to lxc-**, not just lxc-*.
Signed-off-by: Wolfgang Bumiller <w.bumiller@proxmox.com>

242a9fa7

apparmor: profile generation · 1800f924

authored Jul 25, 2018

This copies lxd's apparmor profile generation. This tries to
detect features such as cgroup namespaces, apparmor
namespaces and stacking support, and has profile parts
conditionally for unprivileged containers.

This introduces the following changes to the configuration:
  lxc.apparmor.profile = generated
    The fixed value 'generated' will cause this
    functionality to be used, otherwise there should be no
    functional changes happening unless specifically
    requested with the next key:
  lxc.apparmor.allow_nesting
    This is a boolean which, if enabled, causes the
    following changes: When generated apparmor profiles are
    used, they will contain the necessary changes to allow
    creating a nested container. In addition to the usual
    mount points, /dev/.lxc/proc and /dev/.lxc/sys will
    contain procfs and sysfs mount points without the lxcfs
    overlays, which, if generated apparmor profiles are
    being used, will not be read/writable directly.
  lxc.apparmor.raw
    A list of raw apparmor profile lines to append to the
    profile. Only valid when using generated profiles.

The following apparmor profile lines have not been copied
from lxd:

  mount /var/lib/lxd/shmounts/ -> /var/lib/lxd/shmounts/,
  mount none -> /var/lib/lxd/shmounts/,
  mount options=bind /var/lib/lxd/shmounts/** -> /var/lib/lxd/**,

They should be added via lxc.apparmor.raw entries by lxd.

In order for apparmor_parser's cache to be of use, this adds
a --with-apparmor-cache-dir ./configure option.
Signed-off-by: Wolfgang Bumiller <w.bumiller@proxmox.com>

1800f924

apparmor: update current profiles · 6e6aca3e

authored Jul 25, 2018

remove cgmanager rules and add fstype=cgroup2 variants for
the existing fstype=cgroup rules
Signed-off-by: Wolfgang Bumiller <w.bumiller@proxmox.com>

6e6aca3e

utils: add must_concat helper · eb5c2e6a
Wolfgang Bumiller authored Jul 18, 2018
```
Signed-off-by: Wolfgang Bumiller <w.bumiller@proxmox.com>
```
eb5c2e6a