10986 Commits

This Branch

This Branch

All Branches

Author	SHA1	Message	Date
Ruben Jenster	bf31b3378f	confile: add lxc.init.groups to keep additional groups ... Signed-off-by: Ruben Jenster <r.jenster@drachenfels.de>	2021-02-05 12:13:06 +01:00
Christian Brauner	5a7f1dc660	utils: rework lxc_setgroups() ... Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>	2021-02-05 12:12:29 +01:00
Christian Brauner	8917c3825a	tree-wide: use lxc_drop_groups() instead of lxc_setgroups(0, NULL) ... Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>	2021-02-05 12:12:28 +01:00
Christian Brauner	8dd6f81e70	utils: add lxc_drop_groups() ... Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>	2021-02-05 12:09:35 +01:00
Stéphane Graber	d71e4764b7	Merge pull request #3655 from brauner/2021-02-04/fixes_1 ... Tiny fixes in attach and utils	2021-02-04 17:44:48 -05:00
Christian Brauner	7f40f0617e	utils: check for snprintf() error ... Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>	2021-02-04 22:48:18 +01:00
Christian Brauner	bd6a23550f	attach: improve logging and terminology ... The term "intermediate process" is not very nice imho, "transient process" fits better. Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>	2021-02-04 22:45:19 +01:00
Stéphane Graber	5ee510d614	Merge pull request #3651 from brauner/2021-02-04/fixes ... cgroups: fix cgroup mounting	2021-02-04 15:40:31 -05:00
Christian Brauner	59114d8053	cgroups: check for correct error in __cg_unified_attach() from cgroup_attach() ... Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>	2021-02-04 20:27:40 +01:00
Christian Brauner	ea11a215dc	tree-wide: s/dfd_root_host/dfd_host/g ... Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>	2021-02-04 19:51:26 +01:00
Christian Brauner	ea57e42409	tree-wide: s/mntpt_fd/dfd_mnt/g ... Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>	2021-02-04 19:50:11 +01:00
Christian Brauner	a5a08920ee	tree-wide: s/dev_mntpt_fd/dfd_dev/g ... Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>	2021-02-04 19:50:10 +01:00
Christian Brauner	8ea5110c9c	syscall_wrappers: fix PROTECT_OPEN_W macro ... Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>	2021-02-04 19:49:32 +01:00
Christian Brauner	927ea337a4	conf: restricted fd-only lxc_fill_autodev() ... Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>	2021-02-04 19:49:32 +01:00
Christian Brauner	a370f16bcd	conf: start stashing dfd to host's / during container setup ... Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>	2021-02-04 19:49:22 +01:00
Christian Brauner	86087bd6bf	conf: fix lxc_setup_dev_console() ... We were printing garbage on accident. Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>	2021-02-04 18:45:32 +01:00
Christian Brauner	977687db1c	utils: add mount_from_at() ... Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>	2021-02-04 18:45:32 +01:00
Christian Brauner	7043e2b470	cgroups: restrict open calls in cgroup_attach_create_leaf() ... Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>	2021-02-04 18:45:32 +01:00
Christian Brauner	6e2078de11	cgroups: improve error handling and logging in cgroup_attach_leaf() ... Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>	2021-02-04 15:59:53 +01:00
Christian Brauner	88c27c5352	cgroups: fix argument vetting in cgroup_attach() ... Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>	2021-02-04 15:59:53 +01:00
Christian Brauner	9a57778bb5	attach: fix fallback logic when attaching to cgroups ... Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>	2021-02-04 15:59:53 +01:00
Christian Brauner	02efd04151	cgroups: switch to fd-based cgroup mounting ... Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>	2021-02-04 15:59:52 +01:00
Christian Brauner	c689b58ad3	cgroups: restricted fd-only controller mountpoint creation ... Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>	2021-02-04 15:59:52 +01:00
Christian Brauner	315f8a4e42	cgroups: fix cgroup mounting ... Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>	2021-02-04 15:59:50 +01:00
Stéphane Graber	dfb71524d7	Merge pull request #3650 from brauner/2021-02-03/fixes_1 ... conf: harden various mount paths	2021-02-03 17:05:35 -05:00
Christian Brauner	cbc2ddf5b3	utils: harden __safe_mount_beneath_at() ... Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>	2021-02-03 21:57:44 +01:00
Christian Brauner	952b5031b7	conf: refactor transient procfs mounting ... Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>	2021-02-03 21:54:52 +01:00
Christian Brauner	ccf5374124	conf: restrict open call in lxc_mount_rootfs() ... Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>	2021-02-03 20:58:45 +01:00
Christian Brauner	e1b9d6af00	conf: make lxc_create_tmp_proc_mount() static ... Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>	2021-02-03 20:55:01 +01:00
Christian Brauner	fdb57ab442	conf: coding style ... Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>	2021-02-03 20:51:56 +01:00
Stéphane Graber	f8dcf07fd3	Merge pull request #3648 from brauner/2021-02-03/fixes ... conf: open hardening & fd-only operations	2021-02-03 10:38:50 -05:00
Stéphane Graber	b5e7502996	Merge pull request #3649 from brauner/2021-02-03/attach_via_pidfds ... attach: attach to namespaces via pidfds	2021-02-03 10:23:53 -05:00
Christian Brauner	9b31ab5859	attach: attach to namespaces via pidfds ... This is a feature we've enabled in kernel v5.8 and v5.9. Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>	2021-02-03 15:23:56 +01:00
Christian Brauner	a26822c5d2	conf: fd-only devtps setup ... Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>	2021-02-03 11:49:52 +01:00
Christian Brauner	7f50ec8bd0	conf: fd-only pivot root ... Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>	2021-02-03 11:49:52 +01:00
Christian Brauner	99ca563299	conf: restrict open for lxc_mount_rootfs() ... Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>	2021-02-03 11:49:52 +01:00
Christian Brauner	79019997c8	conf: fd-only operations in lxc_setup_dev_symlinks() ... Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>	2021-02-03 11:49:52 +01:00
Christian Brauner	814983287e	conf: harden open in lxc_fill_autodev() ... Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>	2021-02-03 11:49:51 +01:00
Christian Brauner	ce011f53d8	conf: restrict open of dev/ ... Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>	2021-02-03 11:49:51 +01:00
Christian Brauner	fdf7314dc4	conf: remove unnecessary syscall ... Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>	2021-02-03 11:49:51 +01:00
Christian Brauner	531d36ad00	rexec: mark all fds as close-on-exec if possible ... Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>	2021-02-03 11:49:47 +01:00
Christian Brauner	e8aaef8159	syscalls: add close_range() ... Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>	2021-02-03 09:45:30 +01:00
Christian Brauner	6b69d7f8cf	rexec: check lseek() return value ... Not really needed buy ok. Fixes: Coverity: 1472769 Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>	2021-02-03 09:39:21 +01:00
Christian Brauner	3c981fcb78	tests: check for NULL in device_add_remove ... Fixes: Coverity 1472768 Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>	2021-02-03 09:36:23 +01:00
Stéphane Graber	07f89a4faf	Merge pull request #3647 from brauner/2021-02-02/fixes ... cgroup2: only rely on command socket when getting cgroup values	2021-02-02 18:30:27 -05:00
Christian Brauner	b7aeda9691	cgroups: improve parameter vetting ... Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>	2021-02-03 00:00:50 +01:00
Christian Brauner	7d013cccf9	tests: support pure unified cgroup layouts in cgpath test ... Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>	2021-02-02 23:52:18 +01:00
Christian Brauner	a4f2435718	test: add logging to device_add_remove ... Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>	2021-02-02 23:40:32 +01:00
Christian Brauner	ea299bfc98	freezer: remove lxc_cmd_freeze() and lxc_cmd_unfreeze() calls ... We're now handling them better. Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>	2021-02-02 23:24:28 +01:00
Christian Brauner	9d47970b9b	commands: use __cgroup_unfreeze() directly ... Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>	2021-02-02 23:21:21 +01:00