Skip to content

L
lxc
Switch branch/tag
  1. 05 Mar, 2012 1 commit
    • cgroups: fix broken support for deprecated ns cgroup · fc3c7f7f
      Serge Hallyn authored 
      when using ns cgroup, use /cgroup/<init-cgroup> rather than
/cgroup/<init-cgroup>/lxc

At least lxc-start, lxc-stop, lxc-cgroup, lxc-console and lxc-ls work
with this patch.  I've tested this in a 2.6.35 kernel with ns cgroup,
and in a 3.2 kernel without ns cgroup.

Note also that because of the check for container reboot support,
if we're using the ns cgroup we now end up with a /cgroup/<container>/2
cgroup created, empty, by the clone(CLONE_NEWPID).  I'm really not
sure how much time we want to spend cleaning such things up since
ns cgroup is deprecated in kernel.
Signed-off-by: 's avatarSerge Hallyn <serge@hallyn.com>
Signed-off-by: 's avatarDaniel Lezcano <dlezcano@fr.ibm.com>
  3. 01 Mar, 2012 2 commits
  5. 26 Feb, 2012 31 commits
  7. 25 Feb, 2012 1 commit
  9. 23 Feb, 2012 5 commits
    • fix-automake-1.13 · ce6ce9d6
      Jon Nordby authored 
      ## 0001-Replace-pkglib_PROGRAMS-with-pkglibexec_PROGRAMS.patch [diff]
From 95c566740bba899acc7792c11fcdb3f4d32dcfc9 Mon Sep 17 00:00:00 2001
From: Jon Nordby <jononor@gmail.com>
Date: Fri, 10 Feb 2012 11:38:35 +0100
Subject: [PATCH] Replace pkglib_PROGRAMS with pkglibexec_PROGRAMS

Without this change, autogen.sh fails with automake 1.11.3
Signed-off-by: 's avatarDaniel Lezcano <dlezcano@fr.ibm.com>
    • Add man page for lxc-attach · 49ee6cdc
      Christian Seiler authored 
      Signed-off-by: 's avatarDaniel Lezcano <dlezcano@fr.ibm.com>
    • lxc-attach: Drop privileges when attaching to container unless requested otherwise · cb014488
      Christian Seiler authored 
      lxc-attach will now put the process that is attached to the container into
the correct cgroups corresponding to the container, set the correct
personality and drop the privileges.

The information is extracted from entries in /proc of the init process of
the container. Note that this relies on the (reasonable) assumption that the
init process does not in fact drop additional capabilities from its bounding
set.

Additionally, 2 command line options are added to lxc-attach: One to prevent
the capabilities from being dropped and the process from being put into the
cgroup (-e, --elevated-privileges) and a second one to explicitly state the
architecture which the process will see, (-a, --arch) which defaults to the
container's current architecture.
Signed-off-by: 's avatarDaniel Lezcano <dlezcano@fr.ibm.com>
    • Move lxc_attach from namespace.c to attach.c and rename it to lxc_attach_to_ns · 99d50954
      Christian Seiler authored 
      Since lxc-attach helper functions now have an own source file, lxc_attach is
moved from namespace.c to attach.c and is renamed to lxc_attach_to_ns,
because that better reflects what the function does (attaching to a
container can also contain the setting of the process's personality, adding
it to the corresponding cgroups and dropping specific capabilities).
Signed-off-by: 's avatarDaniel Lezcano <dlezcano@fr.ibm.com>
    • Add attach.[ch]: Helper functions for lxc-attach · e0732705
      Christian Seiler authored 
      The following helper functions for lxc-attach are added to a new file
attach.c:
 - lxc_proc_get_context_info: Get cgroup memberships, personality and
   capability bounding set from /proc for a given process.
 - lxc_proc_free_context_info: Free the data structure responsible
 - lxc_attach_proc_to_cgroups: Add the process specified by the pid
   parameter to the cgroups given by the ctx parameter.
 - lxc_attach_drop_privs: Drop capabilities to the capability mask given in
   the ctx parameter.
Signed-off-by: 's avatarDaniel Lezcano <dlezcano@fr.ibm.com>