proxmox-mirrors/mirror_lxc
1
0
Fork 0
mirror of https://git.proxmox.com/git/mirror_lxc synced 2025-08-02 11:20:47 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity
8,686 Commits 6 Branches 17 Tags 29 MiB
0cf801fb65
Commit Graph

8686 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
tomponline
b670016ac9 network: Adds ipvlan static routes for l2proxy mode 
Signed-off-by: tomponline <thomas.parrott@canonical.com>
 2019-05-03 19:59:24 +01:00
Christian Brauner
ad9429e529
tree-wide: make socket SOCK_CLOEXEC 
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
 2019-05-03 20:35:02 +02:00
tomponline
a2f9a6706d network: Adds gateway device route mode 
Adds ability to specify "dev" as the gateway value, which will cause a device route to be set as default gateway.

Signed-off-by: tomponline <thomas.parrott@canonical.com>
 2019-05-03 15:08:49 +01:00
Christian Brauner
5b94d538dd
Merge pull request #2964 from tomponline/tp-l2proxy 
network: Adds layer 2 (ARP/NDP) proxy mode
 2019-05-03 12:36:00 +02:00
Stéphane Graber
9e1accb9d2
Merge pull request #2972 from brauner/2019-05-02/seccomp_notify_mem_fd 
seccomp: send process memory fd
 2019-05-02 16:56:10 -04:00
Christian Brauner
99b68bdb48
Merge pull request #2971 from hallyn/2019-05-01/nsshare.2 
namespaces: allow a pathname to a nsfd for namespace to share
 2019-05-02 22:55:51 +02:00
Christian Brauner
5ed06d3ad6
seccomp: send process memory fd 
There's an inherent race when reading a process's memory. The easiest way is to
have liblxc get an fd and check that the race was one, send it to the caller
(They are free to ignore it if they don't use recvmsg()).

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
 2019-05-02 17:06:00 +02:00
Serge Hallyn
39e6fd369d namespaces: allow a pathname to a nsfd for namespace to share 
Signed-off-by: Serge Hallyn <shallyn@cisco.com>
 2019-05-02 06:10:15 -07:00
tomponline
6509154de1 network: Adds layer 2 (ARP/NDP) proxy mode 
Adds the lxc.net.[i].l2proxy flag that can be either 0 or 1.

Defaults to 0.

This, when used with lxc.net.[i].link, will add IP neighbour proxy entries on the linked device
for any IPv4 and IPv6 addresses on the container's network device.

Additionally, for IPv6 addresses it will check the following sysctl values and fail with an error if not set:

	net.ipv6.conf.[link].proxy_ndp=1
	net.ipv6.conf.[link].forwarding=1

Signed-off-by: tomponline <thomas.parrott@canonical.com>
 2019-05-02 14:07:28 +01:00
Stéphane Graber
0b5afd323e
Merge pull request #2969 from brauner/2019-05-01/seccomp_fixes 
seccomp: ensure fields are set to 0
 2019-05-01 12:44:48 -04:00
Christian Brauner
370460664f
seccomp: ensure fields are set to 0 
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
 2019-05-01 18:35:58 +02:00
Christian Brauner
ea84ddf9e2
Merge pull request #2950 from tomponline/tp-ipvlan 
network: Adds IPVLAN support
 2019-05-01 18:24:56 +02:00
tomponline
c9f5238291 network: Adds IPVLAN support 
Example usage:

	lxc.net[i].type=ipvlan
	lxc.net[i].ipvlan.mode=[l3|l3s|l2] (defaults to l3)
	lxc.net[i].ipvlan.flags=[bridge|private|vepa] (defaults to bridge)
	lxc.net[i].link=eth0
	lxc.net[i].flags=up

Signed-off-by: tomponline <thomas.parrott@canonical.com>
 2019-05-01 10:10:44 +01:00
Stéphane Graber
28805eb0e7
Merge pull request #2967 from brauner/2019-05-01/seccomp_notifier_api_removal 
seccomp: remove alignment requirements
 2019-04-30 23:16:46 -04:00
Christian Brauner
2a621ecedd
seccomp: remove alignment requirements 
since apparently there are insane programming languages out there that just
silently remove packed members in structs.

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
 2019-05-01 02:04:02 +02:00
Stéphane Graber
2bad947676
Merge pull request #2966 from brauner/2019-05-01/seccomp_notifier_api_removal 
seccomp: don't commit to an api just yet
 2019-04-30 19:42:33 -04:00
Christian Brauner
ebc1c319f6
seccomp: don't commit to an api just yet 
I'm not sure that I want to be married (to this layout) just yet.

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
 2019-05-01 01:29:06 +02:00
Stéphane Graber
0b8bb8db54
Merge pull request #2965 from brauner/2019-05-01/seccomp_notifier_fixes 
seccomp: notifier fixes
 2019-04-30 18:53:21 -04:00
Christian Brauner
2ac0f627f5
seccomp: notifier fixes 
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
 2019-05-01 00:36:41 +02:00
Christian Brauner
8d539bc9a8
Merge pull request #2961 from tomponline/tp-static-net-funcs 
network: Makes some routing functions static
 2019-04-30 11:46:24 +02:00
tomponline
8f82874c8c network: Makes some routing functions static 
The following functions can be made static for consistency:

	lxc_ipv4_dest_add
	lxc_ipv6_dest_add
	lxc_ip_route_dest_add (renamed)

Signed-off-by: tomponline <thomas.parrott@canonical.com>
 2019-04-30 10:33:29 +01:00
Christian Brauner
75614e8e52
Merge pull request #2960 from tomponline/tp-seccomp-apiext-docs 
docs: Adds missing doc entries for seccomp related API extensions
 2019-04-30 11:17:40 +02:00
tomponline
7b766ddc3a docs: Adds missing doc entries for seccomp related API extensions 
Signed-off-by: tomponline <thomas.parrott@canonical.com>
 2019-04-30 10:14:55 +01:00
Christian Brauner
5efab6bf45
Merge pull request #2949 from tomponline/tp-veth-routes 
network: Adds veth static routes feature
 2019-04-29 17:15:38 +02:00
Christian Brauner
7815c73372
Merge pull request #2957 from tomponline/tp-macvlan-mode 
network: Fixes bug in macvlan mode selection
 2019-04-29 16:17:42 +02:00
tomponline
b56680fd74 network: Fixes bug in macvlan mode selection 
Signed-off-by: tomponline <thomas.parrott@canonical.com>
 2019-04-29 15:11:17 +01:00
Stéphane Graber
978dfc7ec4
Merge pull request #2956 from brauner/2019-04-29/seccomp_trap_cleanup 
seccomp: cleanup
 2019-04-29 09:47:29 -04:00
Christian Brauner
c3e3c21a10
seccomp: cleanup 
Simplify and cleanup some of the seccomp code. This mainly focuses on removing
the open coding of various seccomp settings all over the code place in favor of
centralized helpers.

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
 2019-04-29 15:17:31 +02:00
Stéphane Graber
27b737093d
Merge pull request #2955 from tomponline/tp-ignore-test-build 
tests: Updates .gitignore to ignore test build artefacts
 2019-04-29 08:59:32 -04:00
Stéphane Graber
c62784df38
Merge pull request #2954 from tomponline/tp-vlan-hook 
network: Fixes vlan hook script
 2019-04-29 08:59:20 -04:00
tomponline
9574a3780a tests: Updates .gitignore to ignore test build artefacts 
Signed-off-by: tomponline <thomas.parrott@canonical.com>
 2019-04-29 09:50:06 +01:00
tomponline
19abca58e2 network: Fixes vlan hook script 
Signed-off-by: tomponline <thomas.parrott@canonical.com>
 2019-04-29 09:44:57 +01:00
tomponline
d4a7da4632 network: Adds support host side veth device static routes 
Adds the following new config keys:

	lxc.net.[i].veth.ipv4.route
	lxc.net.[i].veth.ipv6.route
E.g.

	lxc.net.0.veth.ipv4.route = 192.0.2.1/32
	lxc.net.0.veth.ipv4.route = 192.0.3.0/24
	lxc.net.0.veth.ipv6.route = 2001:db8::1/128
	lxc.net.0.veth.ipv6.route = 2001:db8:2::/64

Signed-off-by: tomponline <thomas.parrott@canonical.com>
 2019-04-29 08:38:33 +01:00
Stéphane Graber
41cd8a8d8c
Merge pull request #2951 from tomponline/tp-typo 
network: Fixes a little typo in an error message
 2019-04-26 14:45:10 -04:00
Stéphane Graber
6af0bd7bbf
Merge pull request #2952 from tomponline/tp-vlan-upscript 
network: Adds hook handling for vlan network type
 2019-04-26 14:44:55 -04:00
tomponline
3a73d9f109 network: Adds upscript handling for vlan network type 
Signed-off-by: tomponline <thomas.parrott@canonical.com>
 2019-04-26 18:01:53 +01:00
tomponline
eb0628a701 network: Fixes a little typo in an error message 
Signed-off-by: tomponline <thomas.parrott@canonical.com>
 2019-04-26 17:51:44 +01:00
Stéphane Graber
a82463a071
Merge pull request #2947 from brauner/2019-04-18/seccomp_trap 
seccomp: SECCOMP_RET_USER_NOTIF support
 2019-04-25 18:44:37 -04:00
Christian Brauner
eab649dc41
start: silence clang 
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
 2019-04-25 21:35:52 +02:00
Christian Brauner
6cc93f0ed6
api_extensions: add seccomp_notify 
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
 2019-04-25 21:35:52 +02:00
Christian Brauner
8a6437599c
doc: add lxc.seccomp.notify.proxy 
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
 2019-04-25 21:35:52 +02:00
Christian Brauner
e35b7bf81c
seccomp: send default answer and try to reconnect 
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
 2019-04-25 21:35:28 +02:00
Christian Brauner
86ce1da153
confile: add lxc.seccomp.notify.proxy 
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
 2019-04-25 21:35:28 +02:00
Christian Brauner
cdb2a47f9b
seccomp: SECCOMP_RET_USER_NOTIF support 
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
 2019-04-25 21:35:28 +02:00
Christian Brauner
05bbce37b0
Merge pull request #2948 from pgauret/patch-1 
Fix 'zfs get' command order
 2019-04-24 18:30:43 +02:00
pgauret
69b6aa3056
Fix 'zfs get' command order 
Another case of calling 'zfs get' which requires reordering arguments to work with latest zfs.

Signed-off-by: Paul Gauret <pgauret@yahoo.com>
 2019-04-24 18:29:21 +02:00
Christian Brauner
a24d015daf
Merge pull request #2946 from tych0/remove-bad-doc 
lxc-start: remove bad doc
 2019-04-23 17:08:13 +02:00
Tycho Andersen
bd65f5ce50 lxc-start: remove bad doc 
We don't in fact exit(1) if this is not specified, and it wouldn't make
sense to, since most people probably don't specify this.

Signed-off-by: Tycho Andersen <tycho@tycho.ws>
 2019-04-23 08:48:29 -06:00
Stéphane Graber
60c20c6e0e
Merge pull request #2945 from brauner/2019-04-19/netns_getifaddrs_adapt_to_kernel_changes 
netns_getifaddrs: adapt to kernel changes
 2019-04-19 13:58:23 -04:00
Christian Brauner
c8ca5a435c
netns_getifaddrs: adapt to kernel changes 
s/NETLINK_DUMP_STRICT_CHK/NETLINK_GET_STRICT_CHK/g

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
 2019-04-19 15:24:51 +02:00