10927 Commits

This Branch

This Branch

All Branches

Author	SHA1	Message	Date
Arjun Ramachandrula	b87ed83bbc	Updated documentation to reflect lack of support for pure cgroupv2 ... Signed-off-by: Arjun Ramachandrula <arjun.ramachandrula@gmail.com>	2020-08-15 16:16:03 -04:00
Stéphane Graber	76a59906e8	Merge pull request #3518 from brauner/2020-08-12/fixes ... lsm: remove the need for atomic operations	2020-08-12 17:31:08 -04:00
Christian Brauner	af04d84752	lsm: remove the need for atomic operations ... Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>	2020-08-12 22:42:40 +02:00
Stéphane Graber	b799325655	Merge pull request #3517 from brauner/2020-08-10/fixes_2 ... lsm: rewrite	2020-08-11 08:28:19 -04:00
Christian Brauner	3bb6ff017b	lsm: use atomic in ase we're used multi-threaded ... Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>	2020-08-11 10:32:01 +02:00
Christian Brauner	d701d729f6	lsm: rework lsm handling ... Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>	2020-08-11 09:41:27 +02:00
Stéphane Graber	d333aeb4fe	Merge pull request #3514 from brauner/2020-08-10/fixes ... conf: terminal and /dev hardening	2020-08-10 14:41:00 -04:00
Christian Brauner	8ea93a0fa7	terminal: harden terminal allocation ... Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>	2020-08-10 16:05:14 +02:00
Christian Brauner	953db219da	conf: move /dev setup to be file descriptor based ... Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>	2020-08-10 11:01:42 +02:00
Stéphane Graber	567104e59e	Merge pull request #3513 from brauner/2020-08-09/openat2 ... openat2() and safe mounting	2020-08-09 22:39:45 -04:00
Christian Brauner	d43d5191b5	conf: harden lxc_fill_autodev() via save_mount_beneath_at() ... Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>	2020-08-09 19:52:33 +02:00
Christian Brauner	6f61472bea	file_utils: add exists_dir_at() ... Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>	2020-08-09 19:52:32 +02:00
Christian Brauner	ae9215cfc0	conf: make use of stashed container mountpoint fd in mount_autodev() ... Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>	2020-08-09 19:52:32 +02:00
Christian Brauner	31f8b2fd47	conf: stash file descriptor to root mountpoint in struct lxc_rootfs ... This way we only need to open it _once_ per container startup. Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>	2020-08-09 19:52:31 +02:00
Christian Brauner	43535b6d26	utils: introduce safe_mount_beneath_at() ... Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>	2020-08-09 19:52:31 +02:00
Christian Brauner	8b1f4dd9b3	cgfsng: use safe_mount_beneath() ... Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>	2020-08-09 19:52:31 +02:00
Christian Brauner	ee8eeba881	conf: switch mount_autodev() to new safe_mount_beneath() helper ... Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>	2020-08-09 19:52:30 +02:00
Christian Brauner	65f0afdee2	utils: add safe_mount_beneath() based on openat2() ... Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>	2020-08-09 19:52:30 +02:00
Christian Brauner	2b0c810617	syscalls: add openat2() ... Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>	2020-08-09 19:52:30 +02:00
Christian Brauner	da0fdceb6d	Merge pull request #3512 from stgraber/master ... lxc-download fixes	2020-08-07 21:40:56 +02:00
Stéphane Graber	e14546e377	lxc-download: Fix retry loop ... Closes #3511 Signed-off-by: Stéphane Graber <stgraber@ubuntu.com>	2020-08-07 15:10:25 -04:00
Stéphane Graber	459fef2680	Revert "templates/lxc-download.in: use GPG option --receive-keys instead of --recv-keys" ... This reverts commit 409040e702. Testing of both options show identical behavior but receive-keys does not exist on older releases, so let's revert this. Closes #3510 Signed-off-by: Stéphane Graber <stgraber@ubuntu.com>	2020-08-07 15:09:01 -04:00
Stéphane Graber	dc9074bb79	Merge pull request #3509 from brauner/2020-08-06/fixes ... api-extension: add missing seccomp_proxy_send_notify_fd extension	2020-08-06 11:51:32 -04:00
Christian Brauner	0dd2e321c2	api-extension: add missing seccomp_proxy_send_notify_fd extension ... Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>	2020-08-06 17:33:09 +02:00
Stéphane Graber	2a35d949b8	Merge pull request #3508 from brauner/2020-08-06/fixes ... seccomp: add seccomp_notify_fd_active api extension	2020-08-06 09:27:31 -04:00
Christian Brauner	ec49d30f57	seccomp: send notify fd as part of the message ... Since we haven't made this official api yet: YOLO Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>	2020-08-06 15:09:12 +02:00
Christian Brauner	2140576960	seccomp: add seccomp_notify_fd_active api extension ... which allows to retrieve an active seccomp notifier fd from a running container. Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>	2020-08-06 14:40:13 +02:00
Stéphane Graber	05af17d749	Merge pull request #3507 from brauner/2020-08-06/fixes ... seccomp: don't close the mainloop, simply remove the handler	2020-08-06 08:38:06 -04:00
Christian Brauner	eb551cefed	seccomp: don't close the mainloop, simply remove the handler ... Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>	2020-08-06 14:14:10 +02:00
Stéphane Graber	c601840017	Merge pull request #3506 from brauner/2020-08-05/safe_native_terminal_allocation ... macro: define TIOCGPTPEER if missing	2020-08-05 15:14:28 -04:00
Christian Brauner	cfca9ccddc	conf: use openat() instead of open_tree() ... Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>	2020-08-05 20:50:27 +02:00
Christian Brauner	07002a08c1	macro: define TIOCGPTPEER if missing ... Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>	2020-08-05 16:44:53 +02:00
Stéphane Graber	1f15c1c3a2	Merge pull request #3505 from brauner/2020-08-05/safe_native_terminal_allocation ... terminal: safely allocate pts devices from inside the container	2020-08-05 10:10:52 -04:00
Christian Brauner	f797f05e6e	terminal: safely allocate pts devices from inside the container ... This was a year long journey which seems to finally have come to an end. Closes: #1620. Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>	2020-08-05 15:16:51 +02:00
Stéphane Graber	2d19c5e172	Merge pull request #3504 from brauner/2020-08-04/fixes ... conf: ensure that the idmap pointer itself is freed	2020-08-03 20:53:01 -04:00
Christian Brauner	7e62126388	conf: ensure that the idmap pointer itself is freed ... Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>	2020-08-04 00:05:05 +02:00
Christian Brauner	f3bbb01f8a	Merge pull request #3501 from ffontaine/master ... syscall: don't fail if __NR_signalfd is not defined	2020-07-28 13:25:48 +02:00
Fabrice Fontaine	3341e204dc	syscall: don't fail if __NR_signalfd is not defined ... lxc fails to build if __NR_signalfd is not defined since version 4.0.0 and bed09c9cc0 However, some architectures don't define __NR_signalfd but only __NR_signalfd4. This is the case for example for nios2 or csky: f9ac84f92f/sysdeps/unix/sysv/linux/nios2/arch-syscall.h f9ac84f92f/sysdeps/unix/sysv/linux/csky/arch-syscall.h Fixes: - http://autobuild.buildroot.org/results/75096a48d2dbda57459523db3ed0952e63f93535 Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>	2020-07-28 12:44:43 +02:00
Stéphane Graber	79c66a2af3	Merge pull request #3500 from brauner/2020-07-27/seccomp_notify_cleanup ... seccomp: add missing header	2020-07-27 12:02:48 -04:00
Christian Brauner	e4353a7fc4	seccomp: add missing header ... Fixes: https://launchpadlibrarian.net/490341075/buildlog_snap_ubuntu_bionic_amd64_lxd-latest-edge_BUILDING.txt.gz Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>	2020-07-27 17:26:42 +02:00
Stéphane Graber	64cbd48aa3	Merge pull request #3499 from brauner/2020-07-27/seccomp_notify_cleanup ... seccomp: remove seccomp fd from event loop after task exited	2020-07-27 08:16:30 -04:00
Christian Brauner	b2acb9dce9	seccomp: remove seccomp fd from event loop after task exited ... Linux v5.8 will land my patch where seccomp notifies when a filter goes unused, i.e. when the last task using a given seccomp filter has exited. This wasn't possible before and so we accumulated file descriptors in the container's event loop whenever we attached to the container. I'm not sure whether the task exiting before we could handle its syscall should cause us to report and error or not. For now, let's simply close the event loop and not report an error. Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>	2020-07-27 10:15:20 +02:00
Stéphane Graber	aaab14d098	Merge pull request #3498 from brauner/master ... selinux: remove security_context_t usage as it's deprecated	2020-07-25 12:49:14 -04:00
Christian Brauner	c18de5225b	selinux: remove security_context_t usage as it's deprecated ... Link: https://bugs.launchpad.net/ubuntu/+source/lxc/+bug/1888705 Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>	2020-07-25 11:36:46 +02:00
Stéphane Graber	d312ef6849	Merge pull request #3497 from brauner/2020-07-23/fix_snap_compilation ... autotools: fix Makefile	2020-07-23 12:52:37 -04:00
Stéphane Graber	c10c8a61e6	Merge pull request #3496 from brauner/2020-07-18/mount_pid ... new mount api support: basics	2020-07-23 10:34:36 -04:00
Christian Brauner	7a7286393a	Makefile: fix Makefile ... Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>	2020-07-23 10:33:33 +02:00
Christian Brauner	18780b9068	log: don't break logging by hiding symbols ... Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>	2020-07-23 10:20:50 +02:00
Christian Brauner	657256e0b8	attach: use new mount api ... Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>	2020-07-23 10:20:50 +02:00
Christian Brauner	14df702190	mount_utils: add mount_filesystem() helper ... that translates between the two mount apis. Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>	2020-07-23 10:20:50 +02:00