Commit Graph

2664 Commits

Author SHA1 Message Date
Bogdan Purcareata
50dbb8209b lxc-busybox: follow symlinks when inspecting busybox binary
Signed-off-by: Bogdan Purcareata <bogdan.purcareata@freescale.com>
Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
2014-03-24 14:19:27 -05:00
Michael H. Warfield
826cde7c21 Added root_password_expired password control tuning knob.
Added the environment variable "root_password_expired" to
control if the initial, temporary, root password is initially
set up as "expired".  If set to "yes" (default), the root password
is set as "expired" and the user must change it at first login.

Signed-off-by: Michael H. Warfield <mhw@WittsEnd.com>
Acked-by: Stéphane Graber <stgraber@ubuntu.com>
2014-03-22 20:58:08 -04:00
Michael H. Warfield
779b47fdca Support SIGPWR in Fedora and Centos containers.
Added code to catch SIGPWR for Upstart in Fedora and CentOS
containers as well as for Systemd in Fedora containers.

Signed-off-by: Michael H. Warfield <mhw@WittsEnd.com>
Acked-by: Stéphane Graber <stgraber@ubuntu.com>
2014-03-22 20:58:03 -04:00
Michael H. Warfield
f5067ecbcc Set timezone for new container if not previously defined.
If the container does not already contain an /etc/localtime
timezone definition, then copy a definition from the host to
the container.  This is often a symlink to an appropriate
system timezone definition files and is presumed to exist in

Signed-off-by: Michael H. Warfield <mhw@WittsEnd.com>
Acked-by: Stéphane Graber <stgraber@ubuntu.com>
2014-03-22 20:57:57 -04:00
Michael H. Warfield
dfb2291eca Fix arch cross-build when running distro cross-build.
Corner case existed when building a cross-arch container (i686 on x86_64)
on a cross-distro host (Fedora container on Ubuntu host).  Fixed the
arch "fixup" code to do the right thing when running from the bootstrap.

Signed-off-by: Michael H. Warfield <mhw@WittsEnd.com>
Acked-by: Stéphane Graber <stgraber@ubuntu.com>
2014-03-22 20:57:49 -04:00
Dwight Engen
0d9acb997f fix console stdin,stdout,stderr fds
The fds for stdin,stdout,stderr that we were leaving open for /sbin/init
in the container were those from /dev/tty or lxc.console (if given), which
wasn't right. Inside the container it should only have access to the pty
that lxc creates representing the console.

This was noticed because busybox's init was resetting the termio on its
stdin which was effecting the actual users terminal instead of the pty.
This meant it was setting icanon so were were not passing keystrokes
immediately to the pty, and hence command line history/editing wasn't
working.

Fix by dup'ing the console pty to stdin,stdout,stderr just before
exec()ing /sbin/init. Fix fd leak in error handling that I noticed while
going through this code.

Also tested with lxc.console = none, lxc.console = /dev/tty7 and no
lxc.console specified.

V2: The first version was getting EBADF sometimes on dup2() because
lxc_console_set_stdfds() was being called after lxc_check_inherited()
had already closed the fds for the pty. Fix by calling
lxc_check_inherited() as late as possible which also extends coverage
of open fd checked code.

V3: Don't move lxc_check_inherited() since it needs to be called while
the tmp proc mount is still mounted. Move call to lxc_console_set_stdfds()
just before it.

Signed-off-by: Dwight Engen <dwight.engen@oracle.com>
Acked-by: Serge E. Hallyn <serge.hallyn@ubuntu.com>
2014-03-21 15:03:55 -04:00
KATOH Yasufumi
c43e979d66 Update Japanese lxc-create(1) for 'best' option
Update for commit a526a632e0

Signed-off-by: KATOH Yasufumi <karma@jazz.email.ne.jp>
Acked-by: Stéphane Graber <stgraber@ubuntu.com>
2014-03-21 15:00:22 -04:00
Serge Hallyn
79bff4f886 mutex cgmanager access
It looks like either libdbus or libnih is showing some corruption with
threaded access to the cgmanager-client library.  Until we can
straighten that out, mutex access to the cgmanager.

The worst part of this is having to take and drop the mutex at every
fork.  This also means that we can't keep a connection open for the
duration of container startup, since that would deadlock forks.

If we were going to keep it like this, then we could get rid of some
code in start.c.  However we take a performance hit here which I
really hope we can rectify soon.

The other approach we could take would be to keep a global count of
references to cgroup_manager.  Mutex the open, close, and each use
of the cgroup_manager proxy (and the inc/dec of the refcount).  This
way we could in fact keep the connection open for the duration of
container start.  The atfork handler child_fn would have to close
the connection if open.

Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
Acked-by: Stéphane Graber <stgraber@ubuntu.com>
2014-03-21 10:51:36 -04:00
Holger Amann
23e880832b debian: Symlink /etc/mtab
/etc/mtab doesn’t exist after bootstrapping a debian container, and will
be created as regular file after first start.

That leads to at least two errors:
- output of `mount` is wrong and get messed up the more often you
  start/stop the container
- /dev/pts/ptmx has wrong permissions

Signed-off-by: Holger Amann <holger@sauspiel.de>
Acked-by: Stéphane Graber <stgraber@ubuntu.com>
2014-03-21 10:36:34 -04:00
Serge Hallyn
a526a632e0 lxc-create manpage: specify -B best option
Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
Acked-by: Stéphane Graber <stgraber@ubuntu.com>
2014-03-21 10:25:20 -04:00
Stéphane Graber
ef53625fe1 lxc-debian: Don't eat the argument after -c
Reported-by: Robie Basak <robie.basak@canonical.com>
Signed-off-by: Stéphane Graber <stgraber@ubuntu.com>
Acked-by: Serge E. Hallyn <serge.hallyn@ubuntu.com>
2014-03-21 10:25:02 -04:00
Stéphane Graber
0cd97e9658 tests: Don't hardcode the cgroup list
Signed-off-by: Stéphane Graber <stgraber@ubuntu.com>
Acked-by: Serge E. Hallyn <serge.hallyn@ubuntu.com>
2014-03-13 19:09:06 -04:00
Stéphane Graber
4fd0838c69 tests: daemonize in startone
This should finally silence this test for good :)

Signed-off-by: Stéphane Graber <stgraber@ubuntu.com>
Acked-by: Serge E. Hallyn <serge.hallyn@ubuntu.com>
2014-03-13 11:31:22 -04:00
KATOH Yasufumi
e9c5dc7ba3 Fix typo to checking newgidmap existing
Signed-off-by: KATOH Yasufumi <karma@jazz.email.ne.jp>
Acked-by: Stéphane Graber <stgraber@ubuntu.com>
2014-03-13 10:10:01 -04:00
Stéphane Graber
612c49e1cd tests: Add missing include
Signed-off-by: Stéphane Graber <stgraber@ubuntu.com>
2014-03-12 23:52:20 -04:00
Stéphane Graber
53b11e4538 tests: Silence startone harder
Signed-off-by: Stéphane Graber <stgraber@ubuntu.com>
2014-03-12 23:48:12 -04:00
Stéphane Graber
3f458ed004 tests: Support cgmanager
When cgmanager is around, use dbus-send to setup the cgroups, this
allows the tests to work in a container without cgroupfs access.

Signed-off-by: Stéphane Graber <stgraber@ubuntu.com>
Acked-by: Serge E. Hallyn <serge.hallyn@ubuntu.com>
2014-03-12 23:28:05 -04:00
Stéphane Graber
3f5004190a tests: Close all fds in startone
Signed-off-by: Stéphane Graber <stgraber@ubuntu.com>
2014-03-12 20:56:23 -04:00
Serge Hallyn
b099e9e9bd support lxc.mount.auto for get_config_item and clear_config_item
Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
Acked-by: Stéphane Graber <stgraber@ubuntu.com>
2014-03-12 20:16:14 -04:00
Serge Hallyn
787c3ebec6 lxc: tests: use busybox template rather than ubuntu
to speed up tests where it doesn't matter

Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
Acked-by: Stéphane Graber <stgraber@ubuntu.com>
2014-03-12 20:16:11 -04:00
Dwight Engen
395d87ff23 make failure to connect to cgmanager DEBUG instead of ERROR
You can have both cgmanager and cgfs compiled in, and lxc will fall back
at runtime to cgfs if it cannot connect to cgmanager, so print the failure
to connect as a DEBUG like the code used to do.

Signed-off-by: Dwight Engen <dwight.engen@oracle.com>
Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
2014-03-11 15:00:01 -05:00
Serge Hallyn
a2868fe90b cgmanager: avoid stray dbus connections
There are two parts to this fix.

First, create a private DBusConnection manually, instead of using
nih_dbus_connect.  The latter always creates a shared connection,
which cannot be closed.  Note: creating an actual shared connection,
mutexing it among all threads, and creating per-thread proxies would
be an alternative - however we don't want long-lived connections as
they tend not to be reliable (especially if cgmanager restarts).

Second, use pthread_setspecific to create per-thread keys which can
be associated with destructors.  Specify a destructor which closes
the dbus connection.  If a thread dies while holding cgmanager,
the connection will be closed.  Otherwise, we close the connection
and unset the key.

Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
Acked-by: Stéphane Graber <stgraber@ubuntu.com>
2014-03-11 10:55:44 -04:00
KATOH Yasufumi
800648d24a doc: Update Japanese lxc-autostart(1) for -A option
update for commit e582991fd0

Signed-off-by: KATOH Yasufumi <karma@jazz.email.ne.jp>
Acked-by: Stéphane Graber <stgraber@ubuntu.com>
2014-03-11 10:26:25 -04:00
KATOH Yasufumi
9111aa7932 doc: Update Japanese lxc-autostart(1) for -a and -g options
update for commit e447a8a706

Signed-off-by: KATOH Yasufumi <karma@jazz.email.ne.jp>
Acked-by: Stéphane Graber <stgraber@ubuntu.com>
2014-03-11 10:26:22 -04:00
Stéphane Graber
1bc1269ba5
lxc-opensuse: Fix syntax error
Signed-off-by: Stéphane Graber <stgraber@ubuntu.com>
2014-03-10 17:33:12 -04:00
Serge Hallyn
ba3f32cf15 cgm_destroy: ignore a NULL d->cgroup_path
Depending on where during container creation we failed, cgroup_path
may be NULL.  Don't try to delete the cgroup in that case.

(Also fix a wrong function name in an ERROR message)

Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
Acked-by: Stéphane Graber <stgraber@ubuntu.com>
2014-03-10 13:02:58 -04:00
Stéphane Graber
1efaeac9ae
Fix broken XML in previous commit
Signed-off-by: Stéphane Graber <stgraber@ubuntu.com>
2014-03-10 10:34:56 -04:00
KATOH Yasufumi
465532c424 doc: Update Japanese lxc-ls(1)
update for commit 860490af5d

Signed-off-by: KATOH Yasufumi <karma@jazz.email.ne.jp>
Acked-by: Stéphane Graber <stgraber@ubuntu.com>
2014-03-10 10:29:25 -04:00
KATOH Yasufumi
b5dd93f70c doc: Update Japanese lxc-create(1)
update for commit d3de16bb56

Signed-off-by: KATOH Yasufumi <karma@jazz.email.ne.jp>
Acked-by: Stéphane Graber <stgraber@ubuntu.com>
2014-03-10 10:29:16 -04:00
Serge Hallyn
4b2f98f5f8 check netnsfd before closing
Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
2014-03-07 20:39:14 -06:00
Serge Hallyn
94a18c830e fix leak of netnsfd in recent commit
Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
2014-03-07 20:38:20 -06:00
Stéphane Graber
1fc64d22ae Don't trigger SYSERROR for optional mounts
Signed-off-by: Stéphane Graber <stgraber@ubuntu.com>
Acked-by: Serge E. Hallyn <serge.hallyn@ubuntu.com>
2014-03-07 19:13:09 -05:00
Dwight Engen
36eaa69415 fix fd leak in test-concurrent
Opening a debug log for every thread at every iteration of test-concurrent
causes it to quickly run out of fd's because this fd is leaked. Fix this
by adding a new api: lxc_log_close().

As Caglar noted, the log handling is in general a bit "interesting" because
a logfile can be opened through the per-container api
c->set_config_item("lxc.logfile") but lxc_log_fd is now per-thread data. It
just so happens in test-concurrent that there is a 1:1 mapping of threads
to logfiles.

Split out getting debug logs from quiet since I think they are useful
separately. If debug is specified, get a log of any mode, not just during
start.

Signed-off-by: Dwight Engen <dwight.engen@oracle.com>
Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
2014-03-07 16:56:04 -06:00
Stéphane Graber
d3de16bb56 lxc-create: Require --template be passed
It's often been reported that the behavior of lxc-create without -t is a
bit confusing. This change makes lxc-create require the --template
option and introduces a new "none" special value which when set will
fallback to the old template-less behavior.

Signed-off-by: Stéphane Graber <stgraber@ubuntu.com>
Acked-by: Serge E. Hallyn <serge.hallyn@ubuntu.com>
2014-03-07 17:18:51 -05:00
Stéphane Graber
9ec38a6dd7 lxc-ls: Add interfaces field
Signed-off-by: Stéphane Graber <stgraber@ubuntu.com>
Acked-by: Serge E. Hallyn <serge.hallyn@ubuntu.com>
2014-03-07 17:18:50 -05:00
Stéphane Graber
860490af5d lxc-ls: Update help message to include fields
Instead of maintaining hardcoded lists, point everyone to --help and
have the current list of valid and default fields printed there.

Signed-off-by: Stéphane Graber <stgraber@ubuntu.com>
Acked-by: Serge E. Hallyn <serge.hallyn@ubuntu.com>
2014-03-07 17:18:47 -05:00
Stéphane Graber
e582991fd0 lxc-autostart: Add a new --ignore-auto/-A flag
When passed, this flag will cause lxc-autostart to ignore the value of
lxc.start.auto.

This then allows things like: lxc-autostart -s -a -A

Which will select all containers regardless of groups (-a), regardless
of whether they are actually marked as auto-started (-A) and will shut
them down (-s).

Update our init scripts to use the new feature.

Signed-off-by: Stéphane Graber <stgraber@ubuntu.com>
Acked-by: Serge E. Hallyn <serge.hallyn@ubuntu.com>
2014-03-07 17:18:44 -05:00
Stéphane Graber
e447a8a706 lxc-autostart: Document -a and -g
Signed-off-by: Stéphane Graber <stgraber@ubuntu.com>
Acked-by: Serge E. Hallyn <serge.hallyn@ubuntu.com>
2014-03-07 17:18:29 -05:00
Serge Hallyn
2af6bd1bdc lxc: manually move NICs back to host after container stops
This prevents things like bridges from being destroyed by the kernel.

My hope is that just doing this will be enough to also ensure that
the device will be available to be renamed immediately, so that
we don't need to do a retry loop.

Tested with a dummy device.  renaming dummy0 to dummy5 in container,
then shutting down container, returns dummy0 to the host.

Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
Acked-by: Stéphane Graber <stgraber@ubuntu.com>
2014-03-07 14:28:38 -05:00
S.Çağlar Onur
9f4f402a0e add shared lxc_log_fd into TLS
Signed-off-by: S.Çağlar Onur <caglar@10ur.org>
Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
2014-03-06 23:17:43 -06:00
S.Çağlar Onur
dc5406bbbd put shared variables into thread-local storage
This doesn't solve the general design problem of the log.c (eg; some log lines
got lost or scattered into multiple files) but at least prevent multithreaded
code from crashing.

Before this change something like following;

sudo src/tests/lxc-test-concurrent -i 10 -j 20

was crashing nearly all the time due to 3afbcc4600 as we started to
set lxc.loglevel and lxc.logfile with that commit.

Signed-off-by: S.Çağlar Onur <caglar@10ur.org>
Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
2014-03-06 22:58:32 -06:00
Serge Hallyn
e5ab821d6f Revert "fix console stdin,stdout,stderr fds"
This reverts commit 1da0ad1e0a.
2014-03-06 18:01:08 -06:00
S.Çağlar Onur
3afbcc4600 wait 15 seconds instead of forever and produce debug logs for further analyze
Signed-off-by: S.Çağlar Onur <caglar@10ur.org>
Acked-by: Serge E. Hallyn <serge.hallyn@ubuntu.com>
Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
2014-03-06 17:09:26 -06:00
Serge Hallyn
7c9a999558 cgmanager: tell dbus to do locking
Thanks to S.Çağlar for figuring out that we needed this!

Also fix a memory leak found by coverity.

Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
2014-03-06 10:23:17 -06:00
Serge Hallyn
b711e4af87 add missing return false on error path
Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
2014-03-05 19:03:04 -06:00
Dwight Engen
1da0ad1e0a fix console stdin,stdout,stderr fds
The fds for stdin,stdout,stderr that we were leaving open for /sbin/init
in the container were those from /dev/tty or lxc.console (if given), which
wasn't right. Inside the container it should only have access to the pty
that lxc creates representing the console.

This was noticed because busybox's init was resetting the termio on its
stdin which was effecting the actual users terminal instead of the pty.
This meant it was setting icanon so were were not passing keystrokes
immediately to the pty, and hence command line history/editing wasn't
working.

Fix by dup'ing the console pty to stdin,stdout,stderr just before
exec()ing /sbin/init. Fix fd leak in error handling that I noticed while
going through this code.

Also tested with lxc.console = none, lxc.console = /dev/tty7 and no
lxc.console specified.

Signed-off-by: Dwight Engen <dwight.engen@oracle.com>
Acked-by: Stéphane Graber <stgraber@ubuntu.com>
2014-03-05 15:58:58 -05:00
Serge Hallyn
de269ee8de snapshot: fix overlayfs restore
And add a testcase to catch regressions.

Without this patch, restoring a snapshot of an overlayfs based
container fails, because we do not pass in LXC_CLONE_SNAPSHOT,
and overlayfs does not support clone without snapshot.

Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
Acked-by: Stéphane Graber <stgraber@ubuntu.com>
2014-03-04 17:40:53 -05:00
Stéphane Graber
7b5f650017
Update gitignore for lxc-ls
Signed-off-by: Stéphane Graber <stgraber@ubuntu.com>
2014-03-04 17:40:24 -05:00
Serge Hallyn
b149d22a0e cgmanager: switch to TLS
Drop the thread mutex.  Set a (TLS) boolean at container start to
indicate that the connection should be kept open;  set it back to false
only when container start is complete.  Every cgm_ method opens the
connection if not already open, and closes it if cgm_keep_connection
is false.

Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
Acked-by: Stéphane Graber <stgraber@ubuntu.com>
2014-03-04 17:34:34 -05:00
Serge Hallyn
7e4dfe0bc1 cgmanager updates
1. remove the cgm_dbus_disconnected handler.  We're using a proxy
   anyway, and not keeping it around.

2. comment most of the cgm functions to describe when they are called, to
   ease locking review

3. the cgmanager mutex is now held for the duration of a connection, from
   cgm_dbus_connect to cgm_dbus_disconnect.

3b. so remove the mutex lock/unlock from functions which are called during
   container startup with the cgmanager connection already up

4. remove the cgroup_restart().  It's no longer needed since we don't
   daemonize while we have the cgmanager socket open.

5. report errors and return early if cgm_dbus_connect() fails

6. don't keep the cgm connection open after cgm_ops_init.  I'm a bit torn
   on this one as it means that things like lxc-start will always connect
   twice.  But if we do this there is no good answer, given threaded API
   users, on when to drop that initial connection.

7. cgm_unfreeze and nrtasks: grab the dbus connection, as we'll never
   have it at that point.  (technically i doubt anyone will use
   cgmanager and utmp helper on the same host :)

8. lxc_spawn: make sure we only disconnect cgroups if they were already
   connected.

Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
Acked-by: Stéphane Graber <stgraber@ubuntu.com>
2014-03-04 17:34:29 -05:00