Christian Brauner
d6c06927df
conf: improve lxc_clear_cgroups()
...
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
2021-02-19 15:23:26 +01:00
Christian Brauner
159702774c
bpf: fix typos
...
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
2021-02-19 15:23:26 +01:00
Christian Brauner
a0f0e9df1d
bpf: comment bpf_cgroup_devices_update()
...
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
2021-02-19 15:23:26 +01:00
Christian Brauner
60532b18f4
commands: only update bpf device program if really needed
...
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
2021-02-19 15:23:26 +01:00
Christian Brauner
a134099de5
cgroups: make device cgroup handling smarter and simpler
...
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
2021-02-19 15:23:26 +01:00
Christian Brauner
fc4612cb39
cgroups: ensure no garbage is returned
...
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
2021-02-19 15:23:25 +01:00
Christian Brauner
ba9055c96b
lsm: twek apparmor_process_label_get()
...
Fixes: Coverity 1473189
Fixes: Coverity 1473190
Fixes: 47f4914d88
2021-02-19 14:40:58 +01:00
Christian Brauner
8b145a8778
file_utils: allow fd_to_buf() to fail for real
...
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
2021-02-19 14:32:36 +01:00
Christian Brauner
f43ed6a0ab
Merge pull request #3686 from cyphar/apparmor-attr-subdir
...
apparmor: prefer /proc/.../attr/apparmor/current over legacy interface
2021-02-19 13:15:31 +01:00
Aleksa Sarai
47f4914d88
apparmor: prefer /proc/.../attr/apparmor/current over legacy interface
...
It turns out that since Linux 5.1 there are now per-LSM subdirectories
for major LSMs, which users are recommended to use over the "legacy"
top-level /proc/$pid/attr/... files[1]:
> Process attributes associated with “major” security modules should be
> accessed and maintained using the special files in /proc/.../attr. A
> security module may maintain a module specific subdirectory there,
> named after the module. /proc/.../attr/smack is provided by the Smack
> security module and contains all its special files. The files directly
> in /proc/.../attr remain as legacy interfaces for modules that provide
> subdirectories.
AppArmor has had such a directory since Linux 5.8[2], and it turns out
that with certain CONFIG_LSM configurations you can end up with AppArmor
files not being accessible from the legacy interface. Arch Linux
recently added BPF as one of the enabled LSM in their configuration, and
this broke runc[3] and LXC.
The solution is to first try to use /proc/$pid/attr/apparmor/current and
fall back to /proc/$pid/attr/current if the former is not available.
[1]: https://www.kernel.org/doc/html/latest/admin-guide/LSM/index.html
[2]: Linux 5.8 ; commit 6413f852ce08 ("apparmor: add proc subdir to attrs")
[3]: https://github.com/opencontainers/runc/issues/2801
Signed-off-by: Aleksa Sarai <cyphar@cyphar.com>
2021-02-19 20:53:50 +11:00
Aleksa Sarai
301a5f8e78
apparmor: clean up apparmor_process_label_get
...
Rather than open-coding file reading and retry semantics and
implementing the path generation logic separately to
apparmor_process_label_fd_get, refactor the logic so that it looks
closer to the pidfd version.
This will make it easier to implement the two-step handling for
/proc/self/attr/apparmor/current and makes this code slightly less
confusing.
Signed-off-by: Aleksa Sarai <cyphar@cyphar.com>
2021-02-19 20:46:01 +11:00
Stéphane Graber
35a68d6df2
Merge pull request #3681 from brauner/2021-02-18/cgroups
...
cgroups: fixes & bpf rework
2021-02-18 11:52:52 -05:00
Stéphane Graber
599a0c6c9c
Merge pull request #3682 from brauner/2021-02-18/fixes
...
console: fixes
2021-02-18 11:42:17 -05:00
Christian Brauner
f640c8187a
conf: don't log garbage
...
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
2021-02-18 17:08:11 +01:00
Christian Brauner
f3dff08054
start: fix non-daemonized and application containers
...
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
2021-02-18 17:01:59 +01:00
Christian Brauner
1dd71c90e8
conf: use saner mode for console
...
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
2021-02-18 17:01:59 +01:00
Christian Brauner
ad755295f1
bpf: simplify bpf (device) program freeing
...
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
2021-02-18 16:26:16 +01:00
Christian Brauner
25903ba9c0
bpf: make bpf_program_cgroup_attach() static
...
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
2021-02-18 16:21:04 +01:00
Christian Brauner
da03dc28e1
bpf: prevent double-close
...
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
2021-02-18 16:13:45 +01:00
Christian Brauner
8c49586f0d
cgroups: use close_equal() and free_equal()
...
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
2021-02-18 15:55:24 +01:00
Christian Brauner
284868b249
memory_utils: add close_equal() and free_equal()
...
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
2021-02-18 15:52:35 +01:00
Christian Brauner
3d01776c50
lxccontainer: fix reboot logging
...
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
2021-02-18 15:39:27 +01:00
Christian Brauner
0a150695b4
bpf: rework live device cgroup update
...
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
2021-02-18 14:56:01 +01:00
Christian Brauner
fd1cf1b1ab
compiler: fix fallthrough attribute
...
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
2021-02-18 14:42:39 +01:00
Christian Brauner
d202c500d6
bpf: fix return values in bpf_program_cgroup_attach()
...
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
2021-02-18 14:42:15 +01:00
Christian Brauner
354d21c491
bpf: let bpf_list_add_device() take the device list directly
...
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
2021-02-18 13:35:03 +01:00
Christian Brauner
7da502de6a
bpf: add and use bpf_cgroup_devices_attach() helper
...
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
2021-02-18 13:29:26 +01:00
Christian Brauner
928937b114
cgroups: remove compile-time bpf support detection
...
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
2021-02-18 12:42:34 +01:00
Christian Brauner
7fc77b1ae0
bpf: vendor bpf headers
...
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
2021-02-18 12:34:51 +01:00
Christian Brauner
34683e39b9
bpf: handling missing defines
...
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
2021-02-18 12:02:54 +01:00
Christian Brauner
7aec2bd3cd
bpf: rework bpf_program_cgroup_detach()
...
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
2021-02-18 11:54:33 +01:00
Christian Brauner
9a2a38b313
commands: rework bpf devices BPF_F_REPLACE codepath
...
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
2021-02-18 11:54:33 +01:00
Christian Brauner
c38e5c4fd2
bpf: don't close invalid fd, simply swap
...
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
2021-02-18 11:54:32 +01:00
Christian Brauner
281f42afaa
bpf: use __u32 not uint32_t
...
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
2021-02-18 11:54:32 +01:00
Christian Brauner
a38a34f888
macro: add swap helper
...
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
2021-02-18 11:54:32 +01:00
Christian Brauner
79bc22bd24
commands: replace bpf program on update
...
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
2021-02-18 11:54:32 +01:00
Christian Brauner
934bb475e2
commands: improve bpf device program management
...
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
2021-02-18 11:54:32 +01:00
Christian Brauner
413e074bbe
cgroups: improve bpf device program management
...
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
2021-02-18 11:54:32 +01:00
Christian Brauner
df1a5345cd
bpf: add helpers for better bpf device program management
...
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
2021-02-18 11:54:20 +01:00
Christian Brauner
e41afad55e
cgroups: improve bpf device program handling
...
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
2021-02-18 10:51:07 +01:00
Christian Brauner
69885a7656
cgroups: make device cgroups semantics clearer
...
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
2021-02-18 10:51:07 +01:00
Christian Brauner
0d450efcf2
bpf: enable helpers to let caller replace existing bpf programs
...
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
2021-02-18 10:50:45 +01:00
Christian Brauner
8828c61a8b
bpf: align struct initialization
...
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
2021-02-18 10:50:03 +01:00
Christian Brauner
bee6ee17b0
bpf: use return macros
...
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
2021-02-18 10:50:03 +01:00
Christian Brauner
4b9dc703d2
conf: introduce lxc_bpf_devices_rule_t type
...
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
2021-02-18 10:50:03 +01:00
Christian Brauner
7c37e93740
bpf: use cgroup fd directly instead of paths
...
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
2021-02-18 10:50:03 +01:00
Christian Brauner
7064ee3a92
cgroups: kill monitor_full_path
...
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
2021-02-18 00:39:22 +01:00
Christian Brauner
11e5c6783e
cgroups: free correct path
...
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
2021-02-18 00:39:22 +01:00
Christian Brauner
05fe99f3a9
utils: fix print_r() debugging helper
...
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
2021-02-17 23:30:12 +01:00
Christian Brauner
bce04069bc
cgroups: fix error values
...
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
2021-02-17 22:48:56 +01:00
