- 10 Jan, 2015 9 commits
-
-
Michael Adam authored
Signed-off-by:
Michael Adam <obnox@samba.org> Signed-off-by:
Serge Hallyn <serge.hallyn@ubuntu.com>
-
Michael Adam authored
Signed-off-by:
Michael Adam <obnox@samba.org> Signed-off-by:
Serge Hallyn <serge.hallyn@ubuntu.com>
-
Michael Adam authored
Signed-off-by:
Michael Adam <obnox@samba.org> Signed-off-by:
Serge Hallyn <serge.hallyn@ubuntu.com>
-
Michael Adam authored
Signed-off-by:
Michael Adam <obnox@samba.org> Signed-off-by:
Serge Hallyn <serge.hallyn@ubuntu.com>
-
Michael Adam authored
Signed-off-by:
Michael Adam <obnox@samba.org> Signed-off-by:
Serge Hallyn <serge.hallyn@ubuntu.com>
-
Michael Adam authored
Signed-off-by:
Michael Adam <obnox@samba.org> Signed-off-by:
Serge Hallyn <serge.hallyn@ubuntu.com>
-
Michael Adam authored
Signed-off-by:
Michael Adam <obnox@samba.org> Signed-off-by:
Serge Hallyn <serge.hallyn@ubuntu.com>
-
Michael Adam authored
Signed-off-by:
Michael Adam <obnox@samba.org> Signed-off-by:
Serge Hallyn <serge.hallyn@ubuntu.com>
-
Michael Adam authored
Signed-off-by:
Michael Adam <obnox@samba.org> Signed-off-by:
Serge Hallyn <serge.hallyn@ubuntu.com>
-
- 08 Jan, 2015 2 commits
-
-
hallyn authored
apparmor: Fix slave bind mounts
-
Martin Pitt authored
The permission to make a mount "slave" is spelt "make-slave", not "slave", see https://launchpad.net/bugs/1401619. Also, we need to make all mounts slave, not just the root dir. https://launchpad.net/bugs/1350947
-
- 05 Jan, 2015 5 commits
-
-
Stéphane Graber authored
Signed-off-by:
Stéphane Graber <stgraber@ubuntu.com> Acked-by:
Serge E. Hallyn <serge.hallyn@ubuntu.com>
-
Stéphane Graber authored
Just like we block access to mem and kmem, there's no good reason for the container to have access to kcore. Reported-by: Marc Schaefer Signed-off-by:
Stéphane Graber <stgraber@ubuntu.com> Acked-by:
Serge E. Hallyn <serge.hallyn@ubuntu.com>
-
Natanael Copa authored
Alpine Linux provides yaml files with latest release instead of the old approach with .latest.txt. Signed-off-by:
Natanael Copa <ncopa@alpinelinux.org> Acked-by:
Stéphane Graber <stgraber@ubuntu.com>
-
Michael Adam authored
fedora-release has been split into fedora-release and fedora-repos. Signed-off-by:
Michael Adam <obnox@samba.org> Acked-by:
Serge E. Hallyn <serge.hallyn@ubuntu.com>
-
Michael Adam authored
This is to prevent systemd-journald to enter a 100% cpu loop. Signed-off-by:
Michael Adam <obnox@samba.org> Acked-by:
Serge E. Hallyn <serge.hallyn@ubuntu.com>
-
- 19 Dec, 2014 4 commits
-
-
Johannes Kastl authored
lxc-opensuse: Disable building openSUSE containers on 13.2/Tumbleweed only if wrong version of build package is installed Signed-off-by:
Johannes Kastl <git@ojkastl.de> Acked-by:
Stéphane Graber <stgraber@ubuntu.com>
-
Johannes Kastl authored
Signed-off-by:
Johannes Kastl <git@ojkastl.de> Acked-by:
Stéphane Graber <stgraber@ubuntu.com>
-
Serge Hallyn authored
In contrast to what the comment above the line disabling it said, it seems to work just fine. It also is needed on current kernels (until Eric's patch hits upstream) to prevent unprivileged containers from hosing fuse filesystems they inherit. Signed-off-by:
Serge Hallyn <serge.hallyn@ubuntu.com> Acked-by:
Stéphane Graber <stgraber@ubuntu.com>
-
Serge Hallyn authored
If a container has a bind mount from a host nfs or fuse filesystem, and does 'umount -f', it will disconnect the host's filesystem. This patch adds a seccomp rule to block umount -f from a container. It also adds that rule to the default seccomp profile. Thanks stgraber for the idea :) Signed-off-by:
Serge Hallyn <serge.hallyn@ubuntu.com> Acked-by:
Stéphane Graber <stgraber@ubuntu.com>
-
- 04 Dec, 2014 4 commits
-
-
https://github.com/vlajos/misspell_fixerVeres Lajos authored
Signed-off-by:
Veres Lajos <vlajos@gmail.com> Acked-by:
Stéphane Graber <stgraber@ubuntu.com>
-
S.Çağlar Onur authored
Signed-off-by:
S.Çağlar Onur <caglar@10ur.org> Acked-by:
Stéphane Graber <stgraber@ubuntu.com>
-
Shuai Zhang authored
There are now two (permitted) ways to add data to netlink message: 1. put_xxx() 2. call nlmsg_reserve() to get a pointer to newly reserved room within the original netlink message, then write or memcpy data to that area. Both of them guarantee adding requested length data do not overflow the pre-allocated message buffer by checking against its cap field first. And there may be no need to access nlmsg_len outside nl module, because both put_xxx() and nlmsg_reserve() have alread did that for us. Signed-off-by:Shuai Zhang <zs.broccoli@gmail.com> Acked-by:
Stéphane Graber <stgraber@ubuntu.com>
-
Arjun Sreedharan authored
when waitpid() is interrupted, errno is not set to the negative value -EINTR. It is set to EINTR. check against EINTR. Signed-off-by:
Arjun Sreedharan <arjun024@gmail.com> Acked-by:
Stéphane Graber <stgraber@ubuntu.com>
-
- 03 Dec, 2014 3 commits
-
-
Stéphane Graber authored
Signed-off-by:Stéphane Graber <stgraber@ubuntu.com>
-
Shuai Zhang authored
Signed-off-by:
Shuai Zhang <zs.broccoli@gmail.com> Acked-by:
Stéphane Graber <stgraber@ubuntu.com>
-
Stéphane Graber authored
The previous error message made it look like the host interface name was the concatenation of both the host and guest interface names. Closes #374 Signed-off-by:Stéphane Graber <stgraber@ubuntu.com>
-
- 02 Dec, 2014 4 commits
-
-
Cameron Norman authored
Signed-off-by:
Cameron Norman <camerontnorman@gmail.com> Acked-by:
Stéphane Graber <stgraber@ubuntu.com>
-
Cameron Norman authored
Do as much as possible to allow containers switching from non-systemd to systemd to work as intended (but nothing that will cause side effects). Use update-rc.d disable instead of remove so the init scripts are not re-enabled when the package is updated Signed-off-by:
Cameron Norman <camerontnorman@gmail.com> Acked-by:
Stéphane Graber <stgraber@ubuntu.com>
-
KATOH Yasufumi authored
Update for commit e71549fcSigned-off-by:
KATOH Yasufumi <karma@jazz.email.ne.jp> Acked-by:
Stéphane Graber <stgraber@ubuntu.com>
-
KATOH Yasufumi authored
Update for commit 67c660d0Signed-off-by:
KATOH Yasufumi <karma@jazz.email.ne.jp> Acked-by:
Stéphane Graber <stgraber@ubuntu.com>
-
- 01 Dec, 2014 9 commits
-
-
Stéphane Graber authored
This reverts commit 55ae7edb. This change caused hangs in the testsuite, specifically with lxc-user-nic. Signed-off-by:
Stéphane Graber <stgraber@ubuntu.com>
-
Casey Marshall authored
Ran into this when trying to automate stgraber's "GUI in containers" post. Signed-off-by:
Casey Marshall <casey.marshall@canonical.com> Acked-by:
Stéphane Graber <stgraber@ubuntu.com>
-
overlay fs authored
This is a copy of patch version 3 for issue #278 on the issue-tracker: - Allow multiple bind-mounts (--bdir) and multiple cow-mounts (--cdir). - Further fixes to permissions throughout lxc-start-ephemeral (annotated in the code). Signed-off by: Oleg Freedholm <overlayfs@gmail.com> Acked-by:Stéphane Graber <stgraber@ubuntu.com>
-
Johannes Kastl authored
Signed-off-by:
Johannes Kastl <git@ojkastl.de> Acked-by:
Stéphane Graber <stgraber@ubuntu.com>
-
Stéphane Graber authored
Since it's no longer written in lua. Signed-off-by:Stéphane Graber <stgraber@ubuntu.com>
-
Stéphane Graber authored
Signed-off-by:
Stéphane Graber <stgraber@ubuntu.com> Acked-by:
Dwight Engen <dwight.engen@oracle.com>
-
Stéphane Graber authored
Signed-off-by:Stéphane Graber <stgraber@ubuntu.com>
-
Stéphane Graber authored
Signed-off-by:
Stéphane Graber <stgraber@ubuntu.com> Acked-by:
Dwight Engen <dwight.engen@oracle.com>
-
Shuai Zhang authored
There are now two (permitted) ways to add data to netlink message: 1. put_xxx() 2. call nlmsg_reserve() to get a pointer to newly reserved room within the original netlink message, then write or memcpy data to that area. Both of them guarantee adding requested length data do not overflow the pre-allocated message buffer by checking against its cap field first. And there may be no need to access nlmsg_len outside nl module, because both put_xxx() and nlmsg_reserve() have alread did that for us. Signed-off-by:
Shuai Zhang <zs.broccoli@gmail.com> Acked-by:
Stéphane Graber <stgraber@ubuntu.com>
-