Commits · f8dcf07fd3caafbfa98ec95d14c84aeb90c41ef8 · Chen Yisong / lxc · GitLab

03 Feb, 2021 14 commits
- Merge pull request #3648 from brauner/2021-02-03/fixes · f8dcf07f
  Stéphane Graber authored Feb 03, 2021
```
conf: open hardening & fd-only operations
```
  f8dcf07f
- Merge pull request #3649 from brauner/2021-02-03/attach_via_pidfds · b5e75029
  Stéphane Graber authored Feb 03, 2021
```
attach: attach to namespaces via pidfds
```
  b5e75029
- attach: attach to namespaces via pidfds · 9b31ab58
  Christian Brauner authored Feb 03, 2021
```
This is a feature we've enabled in kernel v5.8 and v5.9.
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  9b31ab58
- conf: fd-only devtps setup · a26822c5
  Christian Brauner authored Feb 03, 2021
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  a26822c5
- conf: fd-only pivot root · 7f50ec8b
  Christian Brauner authored Feb 03, 2021
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  7f50ec8b
- conf: restrict open for lxc_mount_rootfs() · 99ca5632
  Christian Brauner authored Feb 03, 2021
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  99ca5632
- conf: fd-only operations in lxc_setup_dev_symlinks() · 79019997
  Christian Brauner authored Feb 03, 2021
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  79019997
- conf: harden open in lxc_fill_autodev() · 81498328
  Christian Brauner authored Feb 03, 2021
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  81498328
- conf: restrict open of dev/ · ce011f53
  Christian Brauner authored Feb 03, 2021
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  ce011f53
- conf: remove unnecessary syscall · fdf7314d
  Christian Brauner authored Feb 03, 2021
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  fdf7314d
- rexec: mark all fds as close-on-exec if possible · 531d36ad
  Christian Brauner authored Feb 03, 2021
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  531d36ad
- syscalls: add close_range() · e8aaef81
  Christian Brauner authored Feb 03, 2021
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  e8aaef81
- rexec: check lseek() return value · 6b69d7f8
  Christian Brauner authored Feb 03, 2021
```
Not really needed buy ok.

Fixes: Coverity: 1472769
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  6b69d7f8
- tests: check for NULL in device_add_remove · 3c981fcb
  Christian Brauner authored Feb 03, 2021
```
Fixes: Coverity 1472768
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  3c981fcb
02 Feb, 2021 26 commits
- Merge pull request #3647 from brauner/2021-02-02/fixes · 07f89a4f
  Stéphane Graber authored Feb 02, 2021
```
cgroup2: only rely on command socket when getting cgroup values
```
  07f89a4f
- cgroups: improve parameter vetting · b7aeda96
  Christian Brauner authored Feb 03, 2021
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  b7aeda96
- tests: support pure unified cgroup layouts in cgpath test · 7d013ccc
  Christian Brauner authored Feb 02, 2021
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  7d013ccc
- test: add logging to device_add_remove · a4f24357
  Christian Brauner authored Feb 02, 2021
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  a4f24357
- freezer: remove lxc_cmd_freeze() and lxc_cmd_unfreeze() calls · ea299bfc
  Christian Brauner authored Feb 02, 2021
```
We're now handling them better.
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  ea299bfc
- commands: use __cgroup_unfreeze() directly · 9d47970b
  Christian Brauner authored Feb 02, 2021
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  9d47970b
- cgroups: export __cgroup_unfreeze() for use in commands · c9c814f4
  Christian Brauner authored Feb 02, 2021
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  c9c814f4
- cgroups: use lxc_cmd_get_limiting_cgroup2_fd() · ae4fcc7b
  Christian Brauner authored Feb 02, 2021
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  ae4fcc7b
- commands: add missing lxc_cmd_get_limiting_cgroup2_fd() implementation · 6f7f2966
  Christian Brauner authored Feb 02, 2021
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  6f7f2966
- cgpath: add logging · 44322ead
  Christian Brauner authored Feb 02, 2021
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  44322ead
- attach: explicitly close seccomp notifier fd · c5bac506
  Christian Brauner authored Feb 02, 2021
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  c5bac506
- cgroups: switch back to returning ints · 5ef7547f
  Christian Brauner authored Feb 02, 2021
```
Whick makes for easier error checking and fallback code.
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  5ef7547f
- attach: check for ENOCGROUP2 explicitly · 29619d41
  Christian Brauner authored Feb 02, 2021
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  29619d41
- cgroups: return ENOCGROUP2 from cgroup_attach() · 6b55ce0e
  Christian Brauner authored Feb 02, 2021
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  6b55ce0e
- cgroups: stricter argument vetting for cgroup_attach() · 6407e1c2
  Christian Brauner authored Feb 02, 2021
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  6407e1c2
- cgroups: move down cgroup_attach() · 029d8e88
  Christian Brauner authored Feb 02, 2021
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  029d8e88
- lxccontainer: use correct error checks · 739af847
  Christian Brauner authored Feb 02, 2021
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  739af847
- cgroups: vet parameters · b57f9b13
  Christian Brauner authored Feb 02, 2021
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  b57f9b13
- cgroups: remove unused conf argument · bfe2971a
  Christian Brauner authored Feb 02, 2021
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  bfe2971a
- cgroups: rewind() file before polling again · 281c3645
  Christian Brauner authored Feb 02, 2021
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  281c3645
- lxccontainer: use cgroup_freeze() and cgroup_unfreeze() · 97d7b200
  Christian Brauner authored Feb 02, 2021
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  97d7b200
- freezer: make methods return bool · 4639029c
  Christian Brauner authored Feb 02, 2021
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  4639029c
- cgroups: add cgroup_freeze() and cgroup_unfreeze() · c8af3332
  Christian Brauner authored Feb 02, 2021
```
These are unified hierarchy only methods which don't need to initialize a full
cgroup driver. Instead, they rely on the command socket to retrieve a cgroup2
file descriptor to the container's cgroup.
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  c8af3332
- freezer: use lxc_cmd_notify_state_listeners() · 419847a8
  Christian Brauner authored Feb 02, 2021
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  419847a8
- commands_utils: add lcx_cmd_notify_state_listeners() · 241670e7
  Christian Brauner authored Feb 02, 2021
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  241670e7
- cgroups: annotate cgroup_get()/cgroup_set() · 751a624f
  Christian Brauner authored Feb 02, 2021
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  751a624f