- 26 Jul, 2018 14 commits
-
-
Christian Brauner authored
Signed-off-by:Christian Brauner <christian.brauner@ubuntu.com>
-
Christian Brauner authored
Signed-off-by: -
Christian Brauner authored
Signed-off-by: -
Christian Brauner authored
Signed-off-by: -
Christian Brauner authored
Signed-off-by: -
Christian Brauner authored
Signed-off-by: -
Christian Brauner authored
Signed-off-by: -
Christian Brauner authored
Signed-off-by: -
Christian Brauner authored
Signed-off-by: -
Christian Brauner authored
Signed-off-by: -
Christian Brauner authored
Signed-off-by: -
Christian Brauner authored
Signed-off-by: -
Christian Brauner authored
Signed-off-by: -
Serge Hallyn authored
RFC: Generated Apparmor profiles, namespaces, stacking
-
- 25 Jul, 2018 6 commits
-
-
Wolfgang Bumiller authored
Signed-off-by:Wolfgang Bumiller <w.bumiller@proxmox.com>
-
Wolfgang Bumiller authored
For generated profiles with apparmor namespaces we get profile names with slashes in them. To match those, we need to allow changing to lxc-**, not just lxc-*. Signed-off-by: -
Wolfgang Bumiller authored
This copies lxd's apparmor profile generation. This tries to detect features such as cgroup namespaces, apparmor namespaces and stacking support, and has profile parts conditionally for unprivileged containers. This introduces the following changes to the configuration: lxc.apparmor.profile = generated The fixed value 'generated' will cause this functionality to be used, otherwise there should be no functional changes happening unless specifically requested with the next key: lxc.apparmor.allow_nesting This is a boolean which, if enabled, causes the following changes: When generated apparmor profiles are used, they will contain the necessary changes to allow creating a nested container. In addition to the usual mount points, /dev/.lxc/proc and /dev/.lxc/sys will contain procfs and sysfs mount points without the lxcfs overlays, which, if generated apparmor profiles are being used, will not be read/writable directly. lxc.apparmor.raw A list of raw apparmor profile lines to append to the profile. Only valid when using generated profiles. The following apparmor profile lines have not been copied from lxd: mount /var/lib/lxd/shmounts/ -> /var/lib/lxd/shmounts/, mount none -> /var/lib/lxd/shmounts/, mount options=bind /var/lib/lxd/shmounts/** -> /var/lib/lxd/**, They should be added via lxc.apparmor.raw entries by lxd. In order for apparmor_parser's cache to be of use, this adds a --with-apparmor-cache-dir ./configure option. Signed-off-by: -
Wolfgang Bumiller authored
remove cgmanager rules and add fstype=cgroup2 variants for the existing fstype=cgroup rules Signed-off-by: -
Wolfgang Bumiller authored
Signed-off-by: -
Wolfgang Bumiller authored
Signed-off-by:
-
- 24 Jul, 2018 5 commits
-
-
Stéphane Graber authored
lxccontainer: fix indendation
-
Christian Brauner authored
Signed-off-by: -
Wolfgang Bumiller authored
Always return -1 on error (some code paths returned -1, some returned negative error codes), don't assume 'errno' is set afterwards, as the function already prints errors and not all code paths will have a usable errno value. Signed-off-by: -
Wolfgang Bumiller authored
don't kill all my processes when running it as user... Signed-off-by: -
Wolfgang Bumiller authored
Signed-off-by:
-
- 22 Jul, 2018 15 commits
-
-
Christian Brauner authored
change log macro of error case from lxc_ambient_caps_up/down
-
Christian Brauner authored
Mount injection API
-
Christian Brauner authored
Signed-off-by: -
Christian Brauner authored
Signed-off-by: -
Christian Brauner authored
Signed-off-by: -
Liza Tretyakova authored
Signed-off-by:
Liza Tretyakova <elizabet.tretyakova@gmail.com> [christian.brauner@ubuntu.com: coding style] Signed-off-by:
-
Liza Tretyakova authored
Signed-off-by: -
Liza Tretyakova authored
Signed-off-by: -
Christian Brauner authored
Signed-off-by: -
Christian Brauner authored
Signed-off-by: -
Liza Tretyakova authored
Signed-off-by: -
Liza Tretyakova authored
Signed-off-by: -
Christian Brauner authored
Signed-off-by: -
Liza Tretyakova authored
Signed-off-by: -
Liza Tretyakova authored
Signed-off-by:
-
