diff --git a/doc/lxc-attach.sgml.in b/doc/lxc-attach.sgml.in
index 5d6263f13..d5154fd18 100644
--- a/doc/lxc-attach.sgml.in
+++ b/doc/lxc-attach.sgml.in
@@ -52,6 +52,7 @@ Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
-n name-a arch-e
+ -s namespaces-- command
@@ -125,6 +126,29 @@ Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
+
+
+
+
+
+
+ Specify the namespaces to attach to, as a pipe-separated liste,
+ e.g. NETWORK|IPC. Allowed values are
+ MOUNT, PID,
+ UTSNAME, IPC,
+ USER and
+ NETWORK. This allows one to change
+ the context of the process to e.g. the network namespace of the
+ container while retaining the other namespaces as those of the
+ host.
+
+
+ Important: This option implies
+ .
+
+
+
+
@@ -147,19 +171,83 @@ Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
To deactivate the network link eth1 of a running container that
- does not have the NET_ADMIN capability, use the
- option to use increased capabilities:
+ does not have the NET_ADMIN capability, use either the
+ option to use increased capabilities,
+ assuming the ip tool is installed:
lxc-attach -n container -e -- /sbin/ip link delete eth1
+ Or, alternatively, use the to use the
+ tools installed on the host outside the container:
+
+ lxc-attach -n container -s NETWORK -- /sbin/ip link delete eth1
+
+
+ Compatibility
+
+ Attaching completely (including the pid and mount namespaces) to a
+ container requires a patched kernel, please see the lxc website for
+ details. lxc-attach will fail in that case if
+ used with an unpatched kernel.
+
+
+ Nevertheless, it will succeed on an unpatched kernel of version 3.0
+ or higher if the option is used to restrict the
+ namespaces that the process is to be attached to to one or more of
+ NETWORK, IPC
+ and UTSNAME.
+
+
+ Attaching to user namespaces is currently completely unsupported
+ by the kernel. lxc-attach should however be able
+ to do this once once future kernel versions implement this.
+
+
+
+
+ Notes
+
+ The Linux /proc and
+ /sys filesystems contain information
+ about some quantities that are affected by namespaces, such as
+ the directories named after process ids in
+ /proc or the network interface infromation
+ in /sys/class/net. The namespace of the
+ process mounting the pseudo-filesystems determines what information
+ is shown, not the namespace of the process
+ accessing /proc or
+ /sys.
+
+
+ If one uses the option to only attach to
+ the pid namespace of a container, but not its mount namespace
+ (which will contain the /proc of the
+ container and not the host), the contents of
+ will reflect that of the host and not the container. Analogously,
+ the same issue occurs when reading the contents of
+ /sys/class/net and attaching to just
+ the network namespace.
+
+
+ A workaround is to use lxc-unshare to unshare
+ the mount namespace after using lxc-attach with
+ -s PID and/or -s
+ NETWORK and then unmount and then mount again both
+ pseudo-filesystems within that new mount namespace, before
+ executing a program/script that relies on this information to be
+ correct.
+
+
+
Security
- The should be used with care, as it may break
- the isolation of the containers if used improperly.
+ The and options should
+ be used with care, as it may break the isolation of the containers
+ if used improperly.
diff --git a/src/lxc/lxc_attach.c b/src/lxc/lxc_attach.c
index 10d4a64ad..4f2275207 100644
--- a/src/lxc/lxc_attach.c
+++ b/src/lxc/lxc_attach.c
@@ -40,12 +40,14 @@
#include "start.h"
#include "sync.h"
#include "log.h"
+#include "namespace.h"
lxc_log_define(lxc_attach_ui, lxc);
static const struct option my_longopts[] = {
{"elevated-privileges", no_argument, 0, 'e'},
{"arch", required_argument, 0, 'a'},
+ {"namespaces", required_argument, 0, 's'},
LXC_COMMON_OPTIONS
};
@@ -55,6 +57,8 @@ static int namespace_flags = -1;
static int my_parser(struct lxc_arguments* args, int c, char* arg)
{
+ int ret;
+
switch (c) {
case 'e': elevated_privileges = 1; break;
case 'a':
@@ -64,6 +68,14 @@ static int my_parser(struct lxc_arguments* args, int c, char* arg)
return -1;
}
break;
+ case 's':
+ namespace_flags = 0;
+ ret = lxc_fill_namespace_flags(arg, &namespace_flags);
+ if (ret)
+ return -1;
+ /* -s implies -e */
+ elevated_privileges = 1;
+ break;
}
return 0;
@@ -84,7 +96,13 @@ Options :\n\
WARNING: This may leak privleges into the container.\n\
Use with care.\n\
-a, --arch=ARCH Use ARCH for program instead of container's own\n\
- architecture.\n",
+ architecture.\n\
+ -s, --namespaces=FLAGS\n\
+ Don't attach to all the namespaces of the container\n\
+ but just to the following OR'd list of flags:\n\
+ MOUNT, PID, UTSNAME, IPC, USER or NETWORK\n\
+ WARNING: Using -s implies -e, it may therefore\n\
+ leak privileges into the container. Use with care.\n",
.options = my_longopts,
.parser = my_parser,
.checker = NULL,