Commit Graph

2861 Commits

Author SHA1 Message Date
Stéphane Graber
44b97d6191 python3: Add list_containers to C API
This adds a new list_containers function to the python3 binding and a
matching override in __init__.py that adds the as_object parameter.

This should be compatible to the previous pure python implementation
with the advantage of also listing active non-defined containers (fixing
github issue #68).

Signed-off-by: Stéphane Graber <stgraber@ubuntu.com>
Acked-by: Serge E. Hallyn <serge.hallyn@ubuntu.com>
2013-11-26 22:29:43 -05:00
Michael H. Warfield
164105f656
Added templates/lxc-centos for CentOS containers.
This adds an lxc-centos template for crreating CentOS 5+ templates.  It
does NOT create CentOS 4 or earlier containers as these are way past
end of life and no longer supported.  It is based on the work of
Fajar A. Nugraha <github@fajar.net> who modified an earlier Fedora
template.  His work has been brought LARGELY into congruence with
the current Fedora template.  It still lacks the distro agnostic
bootstrap and systemd code from the Fedora template but those should
only be relevant with CentOS 7 when that can of worms pops open
sometime next year or so.

Signed-off-by: Michael H. Warfield <mhw@WittsEnd.com>
Acked-by: Stéphane Graber <stgraber@ubuntu.com>
2013-11-26 13:48:24 -05:00
Stéphane Graber
fc739df565 Some tweaks to direct route to gateway
The previous patch added code to add a static route prior to adding the
gateway to the interface.

This commit simply changes the logic so that this is only done on
failure to add the gateway.

Signed-off-by: Stéphane Graber <stgraber@ubuntu.com>
Acked-by: Serge Hallyn <serge.hallyn@ubuntu.com>
2013-11-26 10:22:55 -05:00
Guilhem Lettron
77dcf03a79 Add gateway as direct route for interface
Signed-off-by: Guilhem Lettron <guilhem.lettron@gmail.com>
Acked-by: Stéphane Graber <stgraber@ubuntu.com>
2013-11-26 10:22:47 -05:00
Stéphane Graber
7ee37fac5e
usernsexec: Include utils.h for unshare
Signed-off-by: Stéphane Graber <stgraber@ubuntu.com>
2013-11-25 18:24:03 -05:00
Stéphane Graber
5c5e32fdd3
usernsexec: Add missing getline.h include
Signed-off-by: Stéphane Graber <stgraber@ubuntu.com>
2013-11-25 18:22:05 -05:00
hallyn
7faa7f5200 Merge pull request #92 from majek/share-namespaces
Add options to `lxc-start` to inherit network, ipc and uts namespaces
2013-11-25 13:55:30 -08:00
Michael H. Warfield
5266cf0a64 lxc-fedora: Fixes for selinux and pam_loginuid.so
Just some additional catches for disabling selinux and pam_loginuid.so
thanks to Dwight Engen and the Oracle template.

Also add ssh and ssh-server to the default installation.

Signed-off-by: Michael H. Warfield <mhw@WittsEnd.com>
Acked-by: Stéphane Graber <stgraber@ubuntu.com>
2013-11-25 15:22:49 -05:00
Michael H. Warfield
6a59920b64 Fix stupid architecture error.
From 38cfabdbe0e46f5a0ed20687fcda48424b4a7b6d Mon Sep 17 00:00:00 2001
From: "Michael H. Warfield" <mhw@WittsEnd.com>
Date: Mon, 25 Nov 2013 10:34:48 -0500
Subject: [PATCH 1/2] Fix stupid architecture error.
Organization: Thaumaturgy & Speculums Technology

Fix stupid architecture error.

Stupid error and I did it!  Fixed hard coded x86_64 in several spots.

Signed-off-by: Michael H. Warfield <mhw@WittsEnd.com>
Acked-by: Stéphane Graber <stgraber@ubuntu.com>
2013-11-25 15:12:14 -05:00
Serge Hallyn
8befa924f8 lxc-user-nic: use common code from network.c
This pulls a lot of common code out of lxc_user_nic.c.  It also
moves one function from conf.c that was duplicated in lxc_user_nic.c
(It removes a DEBUG statement because (a) it doesn't seem actually
useful and (b) DEBUG doesn't work in network.c).

Also replace the old test of only parsing code with a skeleton for
a full test.  (Note - the test will need some work, it's just there
as do-what-i-mean code example)

Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
Acked-by: Stéphane Graber <stgraber@ubuntu.com>
2013-11-25 15:12:11 -05:00
Serge Hallyn
8f7b58d68f lxc-user-nic: dont risk passing EOF
Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
Acked-by: Stéphane Graber <stgraber@ubuntu.com>
2013-11-25 15:12:07 -05:00
Stéphane Graber
8cd80b50ef
Convert all files to utf-8
Signed-off-by: Stéphane Graber <stgraber@ubuntu.com>
2013-11-25 12:59:07 -05:00
Dwight Engen
db3392c017 add lxc-devsetup to EXTRA_DIST
fixes rpm build

Signed-off-by: Dwight Engen <dwight.engen@oracle.com>
Acked-by: Stéphane Graber <stgraber@ubuntu.com>
2013-11-25 12:18:56 -05:00
Stéphane Graber
c01c25fcdd
Tab/spaces consistency for templates
Signed-off-by: Stéphane Graber <stgraber@ubuntu.com>
2013-11-25 11:57:34 -05:00
Stéphane Graber
f7f1ba77b7
Drop trailing white spaces.
Signed-off-by: Stéphane Graber <stgraber@ubuntu.com>
2013-11-25 11:52:43 -05:00
James Hunt
953e611cea Add '--enable-api-docs' for doxygen-generated public API docs.
Signed-off-by: James Hunt <james.hunt@ubuntu.com>
Acked-by: Stéphane Graber <stgraber@ubuntu.com>
2013-11-25 11:50:01 -05:00
Guilhem Lettron
703d065d52 lxc-ubuntu: Factorize @LOCALSTATEDIR@ variable
Signed-off-by: Guilhem Lettron <guilhem.lettron@optiflows.com>
Acked-by: Stéphane Graber <stgraber@ubuntu.com>
2013-11-25 11:29:55 -05:00
Guilhem Lettron
5eb28ae492 lxc-ubuntu: Add mirror and security-mirror options
Signed-off-by: Guilhem Lettron <guilhem.lettron@optiflows.com>
Acked-by: Stéphane Graber <stgraber@ubuntu.com>
2013-11-25 11:29:46 -05:00
Guilhem Lettron
28b62856db lxc-ubuntu: Move package install to post-process
Signed-off-by: Guilhem Lettron <guilhem.lettron@optiflows.com>
Acked-by: Stéphane Graber <stgraber@ubuntu.com>
2013-11-25 11:29:30 -05:00
Guilhem Lettron
2004e7da82 lxc-ubuntu: Add extra options
This adds support for "packages", "user" and "password"

Signed-off-by: Guilhem Lettron <guilhem.lettron@optiflows.com>
Acked-by: Stéphane Graber <stgraber@ubuntu.com>
2013-11-25 11:28:47 -05:00
Elan Ruusamäe
853d58fdf5 use awk, instead of 'grep | awk'
Signed-off-by: Elan Ruusamäe <glen@delfi.ee>
Acked-by: Stéphane Graber <stgraber@ubuntu.com>
2013-11-25 11:15:12 -05:00
KATOH Yasufumi
1b29d73cba doc: Update Japanese lxc-attach(1)
Update for commit 4d69b2939c

Signed-off-by: KATOH Yasufumi <karma@jazz.email.ne.jp>
Acked-by: Stéphane Graber <stgraber@ubuntu.com>
2013-11-25 11:13:22 -05:00
Serge Hallyn
ea0da52972 don't fail lxc-init if we couldn't mount proc
In general proc gets mounted ahead of time, so init shouldn't
have to do it.  Without this patch, you cannot

	lxc-execute -n x1 -s lxc.cap.drop=sys_admin /bin/bash

(See https://bugs.launchpad.net/ubuntu/+source/lxc/+bug/1253669 for
a bug about this)

Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
Acked-by: Stéphane Graber <stgraber@ubuntu.com>
2013-11-22 15:52:57 -06:00
Serge Hallyn
4355ab5fab lxcapi_destroy: run in a namespace if we are unprivileged
This is necessary to have the rights to remove files owned by our subuids.

Also update lxc_rmdir_onedev to return 0 on success, -1 on failure.
Callers were not consistent in using it correctly, and this is more
in keeping with the rest of our code.

Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
Acked-by: Stéphane Graber <stgraber@ubuntu.com>
2013-11-22 15:20:16 -06:00
Stéphane Graber
dfd6d8f019
Add lxc.service to extra_DIST
Signed-off-by: Stéphane Graber <stgraber@ubuntu.com>
2013-11-22 14:35:33 -05:00
S.Çağlar Onur
d3d35117e3 add lxc-usernsexec to .gitignore
Signed-off-by: S.Çağlar Onur <caglar@10ur.org>
Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
2013-11-22 13:08:51 -06:00
Serge Hallyn
59328d58d3 remove HAVE_NEWUIDMAP and NEWUIDMAP
Always build lxc-usernsexec.  Else we require having uidmap
installed on the build host for no good reason.  And we never
actually used the NEWUIDMAP path we detected.

Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
Acked-by: Stéphane Graber <stgraber@ubuntu.com>
2013-11-22 08:32:37 -06:00
Serge Hallyn
94272b7104 lxc_usernsexec: fix build breakage
Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
2013-11-21 21:55:06 -06:00
Michael H. Warfield
87ff951e68 Support files for systemd on Fedora.
Added a file "lxc.service" for a systemd service file.

Added a file "lxc-devsetup" to setup /dev/ on startup to support autodev
in containers.

Service file references lxc-devsetup as an ExecStartPre command.  The
lxc-devsetup script is not dependent on systemd or Fedora and can
be used at bootup on any system.

Modified lxc.spec.in to install the two new files on Fedora.  The systemd
specific code in the lxc.spec file may need some review and conditionalize
for systemd on non-systemd rpm-based systems.

Signed-off-by: Michael H. Warfield <mhw@WittsEnd.com>
Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
2013-11-21 11:25:35 -06:00
Serge Hallyn
24ef39f4d5 lxcapi_clone: set the right environment variable for mounted fs
If the container is dir-backed, we don't actually mount it (to
support unprivileged use).  So always set the LXC_ROOTFS_MOUNT
to bdev->dest, not to the rootfs path specified in the container
configuration.

This should fix bug http://pad.lv/1253573

Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
Acked-by: Stéphane Graber <stgraber@ubuntu.com>
2013-11-21 10:25:43 -05:00
Michael H. Warfield
bc6928ffdb Setup devtmpfs and /dev for autodev bind mounts.
If autodev is not specifically set to 0 or 1, attempts to determine if
systemd is being utilized and forces autodev=1 to prevent host system
conflicts and collisions.

If autodev is enabled and the host /dev is mounted with devtmpfs
or /dev/.lxc is mounted with another file system...

Each container created by a privileged user gets a /dev directory
mapped off the host /dev here:

	/dev/.lxc/${name}.$( hash $lxcpath/$name )

Each container created by a non-privileged user gets a /dev/directory
mapped off the host /dev here:

	/dev/.lxc/user/${name}.$( hash $lxcpath/$name )

The /dev/.lxc/user is mode 1777 to allow unpriv access.

The /dev/.lxc/{containerdev} is bind mounted into the container /dev.

Fallback on failure is to mount tmpfs into the container /dev.

A symlink is created from $lxcpath/$name/rootfs.dev back to the /dev
relative directory to provid a code consistent reference for updating
container devs.

Signed-off-by: Michael H. Warfield <mhw@WittsEnd.com>
Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
2013-11-20 21:42:53 -06:00
Nikola Kotur
4d69b2939c lxc-attach: elevate specific privileges
There are scenarios in which we want to execute process with specific
privileges elevated.

An example for this might be executing a process inside the container
securely, with capabilities dropped, but not in container's cgroup so
that we can have per process restrictions inside single container.

Similar to namespaces, privileges to be elevated can be OR'd:

    lxc-attach --elevated-privileges='CAP|CGROUP' ...

Backward compatibility with previous versions is retained. In case no
privileges are specified behaviour is the same as before: all of them
are elevated.

Signed-off-by: Nikola Kotur <kotnick@gmail.com>
Acked-By: Christian Seiler <christian@iwakd.de>
Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
2013-11-20 10:54:47 -06:00
Serge Hallyn
c7e426bef6 lxc-usernsexec: fix the default map behavior
We were finding it, but not saving it.

Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
2013-11-20 10:07:40 -06:00
S.Çağlar Onur
2716b48772 fix memory leaks reported by cppcheck in src/lxc/lxc_usernsexec.c
Free previously allocated memory if realloc fails.

Signed-off-by: S.Çağlar Onur <caglar@10ur.org>
Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
2013-11-20 09:57:42 -06:00
Serge Hallyn
49aba4d3c8 lxc_user_nic: fix fd leak reported by coverity
Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
2013-11-19 17:10:32 -06:00
Serge Hallyn
03c2eb1563 lxc-user-nic: improve cull_entries
Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
Acked-by: Stéphane Graber <stgraber@ubuntu.com>
2013-11-19 16:27:43 -06:00
Serge Hallyn
82160e6f08 lxc_user_nic: initialize cnic to NULL to please compiler
Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
Acked-by: Stéphane Graber <stgraber@ubuntu.com>
2013-11-19 16:27:17 -06:00
Serge Hallyn
552a7d0595 lxc_user_nic: make all fns static for consistency
Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
Acked-by: Stéphane Graber <stgraber@ubuntu.com>
2013-11-19 16:27:12 -06:00
Serge Hallyn
8c81de199c lxc_user_nic: fix get_allotted description.
get_allotted doesn't get the list of nic names, only the # of nics
allowed to the user.  We check the db_file later for existing
number of nics.

Also close the conf file on success, and print filename and errno
if we failed to open conf file.

Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
Acked-by: Stéphane Graber <stgraber@ubuntu.com>
2013-11-19 16:27:02 -06:00
Serge Hallyn
c8f73ce205 lxc_user_nic: report failing filename in open_and_lock error cases
Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
Acked-by: Stéphane Graber <stgraber@ubuntu.com>
2013-11-19 16:26:58 -06:00
Serge Hallyn
78f97d4c4f lxc_user_nic: only exit from main and usage
Everywhere else return an error code instead.

Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
Acked-by: Stéphane Graber <stgraber@ubuntu.com>
2013-11-19 16:26:33 -06:00
Serge Hallyn
d56e223681 lxc_user_nic: report strerror(errno)
Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
Acked-by: Stéphane Graber <stgraber@ubuntu.com>
2013-11-19 16:26:29 -06:00
Serge Hallyn
95dfc8bd4b lxc_user_nic: don't pass unused arg to get_username()
Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
Acked-by: Stéphane Graber <stgraber@ubuntu.com>
2013-11-19 16:26:22 -06:00
Serge Hallyn
8d9f636daf lxc_user_nic: add a check to make sure caller owns target netns
Temporarily set our euid back to the calling ruid, so that the
access(2) check can succeed based on the euid being the userns
creator.

Also switch from atoi to strtol

Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
Acked-by: Stéphane Graber <stgraber@ubuntu.com>
2013-11-19 16:25:52 -06:00
S.Çağlar Onur
ad40563e90 fix memory leaks reported by cppcheck in src/lxc/conf.c (v2)
This also fixes possible crashes due to passing NULL to strlen function

Changes since v1;
* Fixed a typo spotted by Serge

Signed-off-by: S.Çağlar Onur <caglar@10ur.org>
Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
2013-11-19 16:22:12 -06:00
Dwight Engen
eff9177f71 oracle template: fix pam login failures under user namespace
Signed-off-by: Dwight Engen <dwight.engen@oracle.com>
Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
2013-11-19 16:22:11 -06:00
Dwight Engen
88927db9ae oracle template: don't clear console tty
This allows the boot messages to be seen which are useful for monitoring
container startup.

Signed-off-by: Dwight Engen <dwight.engen@oracle.com>
Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
2013-11-19 16:22:10 -06:00
Dwight Engen
2e83f7201c oracle template: prevent mingetty from calling vhangup(2)
This is needed when using the user namespace since the kernel check does
not allow user_ns root to successfully call vhangup(2), and mingetty will
quit in this case.

Signed-off-by: Dwight Engen <dwight.engen@oracle.com>
Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
2013-11-19 16:22:09 -06:00
Dwight Engen
31f38b1721 oracle template: further disable selinux in ol5 container
Signed-off-by: Dwight Engen <dwight.engen@oracle.com>
Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
2013-11-19 16:22:07 -06:00
S.Çağlar Onur
7be677a8aa p is a pointer and cannot be negative so check if it is NULL
Signed-off-by: S.Çağlar Onur <caglar@10ur.org>
Acked-by: Serge E. Hallyn <serge.hallyn@ubuntu.com>
2013-11-18 10:48:32 -05:00