10986 Commits

This Branch

This Branch

All Branches

Author	SHA1	Message	Date
Christian Brauner	c9c814f4d4	cgroups: export __cgroup_unfreeze() for use in commands ... Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>	2021-02-02 23:21:19 +01:00
Christian Brauner	ae4fcc7b11	cgroups: use lxc_cmd_get_limiting_cgroup2_fd() ... Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>	2021-02-02 23:08:04 +01:00
Christian Brauner	6f7f2966b1	commands: add missing lxc_cmd_get_limiting_cgroup2_fd() implementation ... Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>	2021-02-02 23:05:56 +01:00
Christian Brauner	44322ead39	cgpath: add logging ... Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>	2021-02-02 22:56:10 +01:00
Christian Brauner	c5bac50665	attach: explicitly close seccomp notifier fd ... Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>	2021-02-02 22:56:10 +01:00
Christian Brauner	5ef7547f3d	cgroups: switch back to returning ints ... Whick makes for easier error checking and fallback code. Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>	2021-02-02 22:56:10 +01:00
Christian Brauner	29619d419b	attach: check for ENOCGROUP2 explicitly ... Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>	2021-02-02 22:56:10 +01:00
Christian Brauner	6b55ce0ed3	cgroups: return ENOCGROUP2 from cgroup_attach() ... Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>	2021-02-02 22:56:10 +01:00
Christian Brauner	6407e1c244	cgroups: stricter argument vetting for cgroup_attach() ... Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>	2021-02-02 22:56:10 +01:00
Christian Brauner	029d8e8801	cgroups: move down cgroup_attach() ... Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>	2021-02-02 22:56:10 +01:00
Christian Brauner	739af8478c	lxccontainer: use correct error checks ... Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>	2021-02-02 22:15:43 +01:00
Christian Brauner	b57f9b1319	cgroups: vet parameters ... Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>	2021-02-02 21:59:04 +01:00
Christian Brauner	bfe2971ae4	cgroups: remove unused conf argument ... Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>	2021-02-02 21:58:09 +01:00
Christian Brauner	281c36454a	cgroups: rewind() file before polling again ... Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>	2021-02-02 19:29:41 +01:00
Christian Brauner	97d7b200d9	lxccontainer: use cgroup_freeze() and cgroup_unfreeze() ... Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>	2021-02-02 18:56:23 +01:00
Christian Brauner	4639029c9f	freezer: make methods return bool ... Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>	2021-02-02 18:56:23 +01:00
Christian Brauner	c8af3332bc	cgroups: add cgroup_freeze() and cgroup_unfreeze() ... These are unified hierarchy only methods which don't need to initialize a full cgroup driver. Instead, they rely on the command socket to retrieve a cgroup2 file descriptor to the container's cgroup. Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>	2021-02-02 18:56:23 +01:00
Christian Brauner	419847a8aa	freezer: use lxc_cmd_notify_state_listeners() ... Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>	2021-02-02 18:26:57 +01:00
Christian Brauner	241670e7e9	commands_utils: add lcx_cmd_notify_state_listeners() ... Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>	2021-02-02 18:26:29 +01:00
Christian Brauner	751a624fb5	cgroups: annotate cgroup_get()/cgroup_set() ... Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>	2021-02-02 18:09:29 +01:00
Christian Brauner	be835470f3	cgroups: move functions after methods ... This makes it more obvious that they are separate. Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>	2021-02-02 18:08:14 +01:00
Christian Brauner	69edb51d07	lxccontainer: use cgroup_set() ... Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>	2021-02-02 18:03:41 +01:00
Christian Brauner	efb4b3e80f	lxccontainer: use correct variable ordering ... Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>	2021-02-02 18:02:47 +01:00
Christian Brauner	983b1db09d	cgroups: add croup_set() ... This is a unified hierarchy only method which doesn't need to initialize a full cgroup driver. Instead, it relies on the command socket to retrieve a cgroup2 file descriptor to the container's cgroup. Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>	2021-02-02 17:40:30 +01:00
Christian Brauner	3baf0fc8b9	cgroups: reorder cgroup_get() arguments ... Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>	2021-02-02 17:40:08 +01:00
Christian Brauner	a29cc280c7	lxccontainer: use cgroup_get() ... Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>	2021-02-02 17:10:12 +01:00
Christian Brauner	b135642488	cgroups: add cgroup_get() ... This is a unified hierarchy only method which doesn't need to initialize a full cgroup driver. Instead, it relies on the command socket to retrieve a cgroup2 file descriptor to the container's cgroup. Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>	2021-02-02 17:10:10 +01:00
Christian Brauner	2b5e0b8bd2	file_utils: add lxc_read_try_buf_at() ... Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>	2021-02-02 16:59:14 +01:00
Christian Brauner	6de35cd959	macro: abuse ENOMEDIUM as ENOCGROUP2 ... Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>	2021-02-02 16:58:45 +01:00
Stéphane Graber	b22ae84389	Merge pull request #3646 from brauner/2021-02-02/fixes ... attach & cgroup hardening	2021-02-02 09:28:50 -05:00
Christian Brauner	ac01a9b83c	cgroups: switch controller delegation to fd-only operations ... Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>	2021-02-02 13:51:00 +01:00
Christian Brauner	6d15354365	cgroups: add unified_cgroup_fd() helper ... Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>	2021-02-02 13:46:03 +01:00
Christian Brauner	3c5fa7f3e8	file_utils: harden lxc_writeat() ... Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>	2021-02-02 13:45:26 +01:00
Christian Brauner	87c7dbcb9c	file_utils: harden lxc_open_dirfd() ... Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>	2021-02-02 13:45:11 +01:00
Christian Brauner	bcf9793d43	syscall_wrappers: add PROTECT_OPEN_W_* variants ... Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>	2021-02-02 13:44:37 +01:00
Christian Brauner	4c6c4794dc	memory_utils: add close_prot_errno_mov() ... Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>	2021-02-02 13:44:13 +01:00
Christian Brauner	e18aba7d2a	attach: move loading seccomp as late as possible ... We want to minimize the change that the profile blocks syscalls we need during attach setup and has the notifier enabled. Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>	2021-02-02 10:51:06 +01:00
Christian Brauner	92466fe34b	attach: move file descriptor closing into attach_context_container() ... This reduces the possibility of forgetting to close the namespace file descriptors when we change this codepath. Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>	2021-02-02 10:51:03 +01:00
Christian Brauner	72a19d2f38	attach: stricter lookup semantics for fdopen_at() calls ... Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>	2021-02-02 09:54:10 +01:00
Stéphane Graber	c7d644983f	Merge pull request #3645 from brauner/2021-02-01/fixes_4 ... attach: bugfixes	2021-02-01 17:13:37 -05:00
Christian Brauner	4ac35afb78	confile_utils: use lxc_log_trace() ... Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>	2021-02-01 22:54:47 +01:00
Christian Brauner	62fef886dc	conf: use lxc_log_trace() ... Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>	2021-02-01 22:53:56 +01:00
Christian Brauner	570e117338	commands_utils: don't leak memory ... Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>	2021-02-01 22:47:19 +01:00
Christian Brauner	52ed870ed0	attach: use correct put method ... Fixes: Coverity 1472763 Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>	2021-02-01 22:13:03 +01:00
Christian Brauner	cd5f35ec67	attach: prevent UAF ... Fixes: Coverity 1472761 Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>	2021-02-01 22:11:38 +01:00
Stéphane Graber	32947602fd	Merge pull request #3644 from brauner/2021-02-01/fixes_3 ... attach: harden open() calls	2021-02-01 15:26:08 -05:00
Christian Brauner	6f0c2cea14	attach: file descriptor based fdinfo handling ... Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>	2021-02-01 20:27:53 +01:00
Christian Brauner	8e5d175935	file_utils: remove O_NOFOLLOW from open_at() defaults ... Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>	2021-02-01 20:27:53 +01:00
Christian Brauner	6fc8a0dd82	lsm: harden read_file_at() ... Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>	2021-02-01 20:27:53 +01:00
Christian Brauner	46bf13b7c3	tree-wide: extend read_file_at() ... Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>	2021-02-01 20:27:53 +01:00