Added a file "lxc.service" for a systemd service file.
Added a file "lxc-devsetup" to setup /dev/ on startup to support autodev
in containers.
Service file references lxc-devsetup as an ExecStartPre command. The
lxc-devsetup script is not dependent on systemd or Fedora and can
be used at bootup on any system.
Modified lxc.spec.in to install the two new files on Fedora. The systemd
specific code in the lxc.spec file may need some review and conditionalize
for systemd on non-systemd rpm-based systems.
Signed-off-by: Michael H. Warfield <mhw@WittsEnd.com>
Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
If the container is dir-backed, we don't actually mount it (to
support unprivileged use). So always set the LXC_ROOTFS_MOUNT
to bdev->dest, not to the rootfs path specified in the container
configuration.
This should fix bug http://pad.lv/1253573
Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
Acked-by: Stéphane Graber <stgraber@ubuntu.com>
If autodev is not specifically set to 0 or 1, attempts to determine if
systemd is being utilized and forces autodev=1 to prevent host system
conflicts and collisions.
If autodev is enabled and the host /dev is mounted with devtmpfs
or /dev/.lxc is mounted with another file system...
Each container created by a privileged user gets a /dev directory
mapped off the host /dev here:
/dev/.lxc/${name}.$( hash $lxcpath/$name )
Each container created by a non-privileged user gets a /dev/directory
mapped off the host /dev here:
/dev/.lxc/user/${name}.$( hash $lxcpath/$name )
The /dev/.lxc/user is mode 1777 to allow unpriv access.
The /dev/.lxc/{containerdev} is bind mounted into the container /dev.
Fallback on failure is to mount tmpfs into the container /dev.
A symlink is created from $lxcpath/$name/rootfs.dev back to the /dev
relative directory to provid a code consistent reference for updating
container devs.
Signed-off-by: Michael H. Warfield <mhw@WittsEnd.com>
Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
There are scenarios in which we want to execute process with specific
privileges elevated.
An example for this might be executing a process inside the container
securely, with capabilities dropped, but not in container's cgroup so
that we can have per process restrictions inside single container.
Similar to namespaces, privileges to be elevated can be OR'd:
lxc-attach --elevated-privileges='CAP|CGROUP' ...
Backward compatibility with previous versions is retained. In case no
privileges are specified behaviour is the same as before: all of them
are elevated.
Signed-off-by: Nikola Kotur <kotnick@gmail.com>
Acked-By: Christian Seiler <christian@iwakd.de>
Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
get_allotted doesn't get the list of nic names, only the # of nics
allowed to the user. We check the db_file later for existing
number of nics.
Also close the conf file on success, and print filename and errno
if we failed to open conf file.
Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
Acked-by: Stéphane Graber <stgraber@ubuntu.com>
Temporarily set our euid back to the calling ruid, so that the
access(2) check can succeed based on the euid being the userns
creator.
Also switch from atoi to strtol
Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
Acked-by: Stéphane Graber <stgraber@ubuntu.com>
This also fixes possible crashes due to passing NULL to strlen function
Changes since v1;
* Fixed a typo spotted by Serge
Signed-off-by: S.Çağlar Onur <caglar@10ur.org>
Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
This allows the boot messages to be seen which are useful for monitoring
container startup.
Signed-off-by: Dwight Engen <dwight.engen@oracle.com>
Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
This is needed when using the user namespace since the kernel check does
not allow user_ns root to successfully call vhangup(2), and mingetty will
quit in this case.
Signed-off-by: Dwight Engen <dwight.engen@oracle.com>
Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
So this implements the changes we discussed yesterday:
- Only one container may be queried at the time
- -n is now required once again
- -H + a single filter only returns the value
- -t/--is-state is now removed
Note that -S is considered as more than a single filter, so -H in that
case only affects the formatting of the values.
For the same reason, I haven't yet implemented the -H + multiple filters
case which we said should return a simple "key: value" output as it
wasn't trivial to re-arrange the stats code to print a different format
(for the other options, it's just a two lines change in the print
functions).
Signed-off-by: Stéphane Graber <stgraber@ubuntu.com>
Acked-by: Dwight Engen <dwight.engen@oracle.com>
To do this, add a c->clear_config() helper to the api.
(this fixes the bug https://bugs.launchpad.net/bugs/1251352)
Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
Acked-by: Stéphane Graber <stgraber@ubuntu.com>
When moving an interface from the host netns to a container's,
the ifindex might not remain the same. This happens when the
index of the host interface is already assigned to another interface
in the new netns.
For veth/vlan/macvlan, virtual interfaces are first created on the host,
and then moved in the container. Since they are created after all other
interfaces are discovered, there is no chance for its assigned ifindex
to be already present in a freshly created netns, because it's a greater
number.
However, when moving a physical interface, there is a chance that its
ifindex in the host netns is not free in the new netns. The patch
forces ifindex re-read for the LXC_NET_PHYS case to update the
lxc_netdev structure.
Signed-off-by: Bogdan Purcareata <bogdan.purcareata@freescale.com>
Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
Adding block/char devices to running container is a common operation so
provide a common implementation for users to consume.
changes since v2;
* lets the user set an alternate path inside the container as Stéphane suggested
changes since v1;
* removed duplicated code
Signed-off-by: S.Çağlar Onur <caglar@10ur.org>
Acked-by: Stéphane Graber <stgraber@ubuntu.com>
I think '-t timeout' was mistakenly written, so I corrected it to '-t
template', since the -t argument is used for setting templates, not
timeout as far as I know.
Signed-off-by: pc-wurm <yordanov@pc-wurm.de>
Acked-by: Stéphane Graber <stgraber@ubuntu.com>
This is likely unnecessary, but is consistent with other uses of
fopen()/fclose() in lxc.
Signed-off-by: Dwight Engen <dwight.engen@oracle.com>
Acked-by: S.Çağlar Onur <caglar@10ur.org>
Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
We were calling save_config() twice within the create() flow, each
from a different process. Depending on order of scheduling, sometimes
the data from the first save_config() (which was just the stuff from
LXC_DEFAULT_CONFIG) would overwrite the config we wanted (the full
config), causing a truncated config file which would then cause lxc
to segfault once it read it back in because no rootfs.path was set.
This fixes it by only calling save_config() once in the create()
flow. A rejected alternative was to call fsync(fileno(fout)) before
the fclose in save_config.
Signed-off-by: Dwight Engen <dwight.engen@oracle.com>
Acked-by: S.Çağlar Onur <caglar@10ur.org>
Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
commit aae93dd3dd fixed the command socket
name to use the right pathlen instead of always passing in the max
socket namelen. However, this breaks lxc-info/lxc-list/etc for
containers started before that commit. So if the correct command
sock name doesn't work, try the preexising one.
Note we can probably undo this "after awhile". Maybe in august 2014.
Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
Acked-by: Stéphane Graber <stgraber@ubuntu.com>
