From e13eeea2db3743bf8d3fe2833e069a80e2c4102c Mon Sep 17 00:00:00 2001 From: Christian Seiler Date: Wed, 22 Aug 2012 00:03:15 +0200 Subject: [PATCH] lxc-attach: Add -s option to select namespaces to attach to This patch allows the user to select any list of namespaces (network, pid, mount, uts, ipc, user) that lxc-attach should use when attaching to the container; all other namespaces will not be attached to. This allows the user to for example attach to just the network namespace and use the host's (and not the container's) network tools to reconfigure the network of the container. Signed-off-by: Christian Seiler Cc: Daniel Lezcano Acked-by: Serge Hallyn --- doc/lxc-attach.sgml.in | 96 ++++++++++++++++++++++++++++++++++++++++-- src/lxc/lxc_attach.c | 20 ++++++++- 2 files changed, 111 insertions(+), 5 deletions(-) diff --git a/doc/lxc-attach.sgml.in b/doc/lxc-attach.sgml.in index 5d6263f13..d5154fd18 100644 --- a/doc/lxc-attach.sgml.in +++ b/doc/lxc-attach.sgml.in @@ -52,6 +52,7 @@ Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA -n name -a arch -e + -s namespaces -- command @@ -125,6 +126,29 @@ Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA + + + + + + + Specify the namespaces to attach to, as a pipe-separated liste, + e.g. NETWORK|IPC. Allowed values are + MOUNT, PID, + UTSNAME, IPC, + USER and + NETWORK. This allows one to change + the context of the process to e.g. the network namespace of the + container while retaining the other namespaces as those of the + host. + + + Important: This option implies + . + + + + @@ -147,19 +171,83 @@ Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA To deactivate the network link eth1 of a running container that - does not have the NET_ADMIN capability, use the - option to use increased capabilities: + does not have the NET_ADMIN capability, use either the + option to use increased capabilities, + assuming the ip tool is installed: lxc-attach -n container -e -- /sbin/ip link delete eth1 + Or, alternatively, use the to use the + tools installed on the host outside the container: + + lxc-attach -n container -s NETWORK -- /sbin/ip link delete eth1 + + + Compatibility + + Attaching completely (including the pid and mount namespaces) to a + container requires a patched kernel, please see the lxc website for + details. lxc-attach will fail in that case if + used with an unpatched kernel. + + + Nevertheless, it will succeed on an unpatched kernel of version 3.0 + or higher if the option is used to restrict the + namespaces that the process is to be attached to to one or more of + NETWORK, IPC + and UTSNAME. + + + Attaching to user namespaces is currently completely unsupported + by the kernel. lxc-attach should however be able + to do this once once future kernel versions implement this. + + + + + Notes + + The Linux /proc and + /sys filesystems contain information + about some quantities that are affected by namespaces, such as + the directories named after process ids in + /proc or the network interface infromation + in /sys/class/net. The namespace of the + process mounting the pseudo-filesystems determines what information + is shown, not the namespace of the process + accessing /proc or + /sys. + + + If one uses the option to only attach to + the pid namespace of a container, but not its mount namespace + (which will contain the /proc of the + container and not the host), the contents of + will reflect that of the host and not the container. Analogously, + the same issue occurs when reading the contents of + /sys/class/net and attaching to just + the network namespace. + + + A workaround is to use lxc-unshare to unshare + the mount namespace after using lxc-attach with + -s PID and/or -s + NETWORK and then unmount and then mount again both + pseudo-filesystems within that new mount namespace, before + executing a program/script that relies on this information to be + correct. + + + Security - The should be used with care, as it may break - the isolation of the containers if used improperly. + The and options should + be used with care, as it may break the isolation of the containers + if used improperly. diff --git a/src/lxc/lxc_attach.c b/src/lxc/lxc_attach.c index 10d4a64ad..4f2275207 100644 --- a/src/lxc/lxc_attach.c +++ b/src/lxc/lxc_attach.c @@ -40,12 +40,14 @@ #include "start.h" #include "sync.h" #include "log.h" +#include "namespace.h" lxc_log_define(lxc_attach_ui, lxc); static const struct option my_longopts[] = { {"elevated-privileges", no_argument, 0, 'e'}, {"arch", required_argument, 0, 'a'}, + {"namespaces", required_argument, 0, 's'}, LXC_COMMON_OPTIONS }; @@ -55,6 +57,8 @@ static int namespace_flags = -1; static int my_parser(struct lxc_arguments* args, int c, char* arg) { + int ret; + switch (c) { case 'e': elevated_privileges = 1; break; case 'a': @@ -64,6 +68,14 @@ static int my_parser(struct lxc_arguments* args, int c, char* arg) return -1; } break; + case 's': + namespace_flags = 0; + ret = lxc_fill_namespace_flags(arg, &namespace_flags); + if (ret) + return -1; + /* -s implies -e */ + elevated_privileges = 1; + break; } return 0; @@ -84,7 +96,13 @@ Options :\n\ WARNING: This may leak privleges into the container.\n\ Use with care.\n\ -a, --arch=ARCH Use ARCH for program instead of container's own\n\ - architecture.\n", + architecture.\n\ + -s, --namespaces=FLAGS\n\ + Don't attach to all the namespaces of the container\n\ + but just to the following OR'd list of flags:\n\ + MOUNT, PID, UTSNAME, IPC, USER or NETWORK\n\ + WARNING: Using -s implies -e, it may therefore\n\ + leak privileges into the container. Use with care.\n", .options = my_longopts, .parser = my_parser, .checker = NULL,