Commit Graph

2037 Commits

Author SHA1 Message Date
Stéphane Graber
c01c25fcdd
Tab/spaces consistency for templates
Signed-off-by: Stéphane Graber <stgraber@ubuntu.com>
2013-11-25 11:57:34 -05:00
Stéphane Graber
f7f1ba77b7
Drop trailing white spaces.
Signed-off-by: Stéphane Graber <stgraber@ubuntu.com>
2013-11-25 11:52:43 -05:00
James Hunt
953e611cea Add '--enable-api-docs' for doxygen-generated public API docs.
Signed-off-by: James Hunt <james.hunt@ubuntu.com>
Acked-by: Stéphane Graber <stgraber@ubuntu.com>
2013-11-25 11:50:01 -05:00
Guilhem Lettron
703d065d52 lxc-ubuntu: Factorize @LOCALSTATEDIR@ variable
Signed-off-by: Guilhem Lettron <guilhem.lettron@optiflows.com>
Acked-by: Stéphane Graber <stgraber@ubuntu.com>
2013-11-25 11:29:55 -05:00
Guilhem Lettron
5eb28ae492 lxc-ubuntu: Add mirror and security-mirror options
Signed-off-by: Guilhem Lettron <guilhem.lettron@optiflows.com>
Acked-by: Stéphane Graber <stgraber@ubuntu.com>
2013-11-25 11:29:46 -05:00
Guilhem Lettron
28b62856db lxc-ubuntu: Move package install to post-process
Signed-off-by: Guilhem Lettron <guilhem.lettron@optiflows.com>
Acked-by: Stéphane Graber <stgraber@ubuntu.com>
2013-11-25 11:29:30 -05:00
Guilhem Lettron
2004e7da82 lxc-ubuntu: Add extra options
This adds support for "packages", "user" and "password"

Signed-off-by: Guilhem Lettron <guilhem.lettron@optiflows.com>
Acked-by: Stéphane Graber <stgraber@ubuntu.com>
2013-11-25 11:28:47 -05:00
Elan Ruusamäe
853d58fdf5 use awk, instead of 'grep | awk'
Signed-off-by: Elan Ruusamäe <glen@delfi.ee>
Acked-by: Stéphane Graber <stgraber@ubuntu.com>
2013-11-25 11:15:12 -05:00
KATOH Yasufumi
1b29d73cba doc: Update Japanese lxc-attach(1)
Update for commit 4d69b2939c

Signed-off-by: KATOH Yasufumi <karma@jazz.email.ne.jp>
Acked-by: Stéphane Graber <stgraber@ubuntu.com>
2013-11-25 11:13:22 -05:00
Serge Hallyn
ea0da52972 don't fail lxc-init if we couldn't mount proc
In general proc gets mounted ahead of time, so init shouldn't
have to do it.  Without this patch, you cannot

	lxc-execute -n x1 -s lxc.cap.drop=sys_admin /bin/bash

(See https://bugs.launchpad.net/ubuntu/+source/lxc/+bug/1253669 for
a bug about this)

Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
Acked-by: Stéphane Graber <stgraber@ubuntu.com>
2013-11-22 15:52:57 -06:00
Serge Hallyn
4355ab5fab lxcapi_destroy: run in a namespace if we are unprivileged
This is necessary to have the rights to remove files owned by our subuids.

Also update lxc_rmdir_onedev to return 0 on success, -1 on failure.
Callers were not consistent in using it correctly, and this is more
in keeping with the rest of our code.

Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
Acked-by: Stéphane Graber <stgraber@ubuntu.com>
2013-11-22 15:20:16 -06:00
Stéphane Graber
dfd6d8f019
Add lxc.service to extra_DIST
Signed-off-by: Stéphane Graber <stgraber@ubuntu.com>
2013-11-22 14:35:33 -05:00
S.Çağlar Onur
d3d35117e3 add lxc-usernsexec to .gitignore
Signed-off-by: S.Çağlar Onur <caglar@10ur.org>
Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
2013-11-22 13:08:51 -06:00
Serge Hallyn
59328d58d3 remove HAVE_NEWUIDMAP and NEWUIDMAP
Always build lxc-usernsexec.  Else we require having uidmap
installed on the build host for no good reason.  And we never
actually used the NEWUIDMAP path we detected.

Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
Acked-by: Stéphane Graber <stgraber@ubuntu.com>
2013-11-22 08:32:37 -06:00
Serge Hallyn
94272b7104 lxc_usernsexec: fix build breakage
Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
2013-11-21 21:55:06 -06:00
Michael H. Warfield
87ff951e68 Support files for systemd on Fedora.
Added a file "lxc.service" for a systemd service file.

Added a file "lxc-devsetup" to setup /dev/ on startup to support autodev
in containers.

Service file references lxc-devsetup as an ExecStartPre command.  The
lxc-devsetup script is not dependent on systemd or Fedora and can
be used at bootup on any system.

Modified lxc.spec.in to install the two new files on Fedora.  The systemd
specific code in the lxc.spec file may need some review and conditionalize
for systemd on non-systemd rpm-based systems.

Signed-off-by: Michael H. Warfield <mhw@WittsEnd.com>
Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
2013-11-21 11:25:35 -06:00
Serge Hallyn
24ef39f4d5 lxcapi_clone: set the right environment variable for mounted fs
If the container is dir-backed, we don't actually mount it (to
support unprivileged use).  So always set the LXC_ROOTFS_MOUNT
to bdev->dest, not to the rootfs path specified in the container
configuration.

This should fix bug http://pad.lv/1253573

Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
Acked-by: Stéphane Graber <stgraber@ubuntu.com>
2013-11-21 10:25:43 -05:00
Michael H. Warfield
bc6928ffdb Setup devtmpfs and /dev for autodev bind mounts.
If autodev is not specifically set to 0 or 1, attempts to determine if
systemd is being utilized and forces autodev=1 to prevent host system
conflicts and collisions.

If autodev is enabled and the host /dev is mounted with devtmpfs
or /dev/.lxc is mounted with another file system...

Each container created by a privileged user gets a /dev directory
mapped off the host /dev here:

	/dev/.lxc/${name}.$( hash $lxcpath/$name )

Each container created by a non-privileged user gets a /dev/directory
mapped off the host /dev here:

	/dev/.lxc/user/${name}.$( hash $lxcpath/$name )

The /dev/.lxc/user is mode 1777 to allow unpriv access.

The /dev/.lxc/{containerdev} is bind mounted into the container /dev.

Fallback on failure is to mount tmpfs into the container /dev.

A symlink is created from $lxcpath/$name/rootfs.dev back to the /dev
relative directory to provid a code consistent reference for updating
container devs.

Signed-off-by: Michael H. Warfield <mhw@WittsEnd.com>
Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
2013-11-20 21:42:53 -06:00
Nikola Kotur
4d69b2939c lxc-attach: elevate specific privileges
There are scenarios in which we want to execute process with specific
privileges elevated.

An example for this might be executing a process inside the container
securely, with capabilities dropped, but not in container's cgroup so
that we can have per process restrictions inside single container.

Similar to namespaces, privileges to be elevated can be OR'd:

    lxc-attach --elevated-privileges='CAP|CGROUP' ...

Backward compatibility with previous versions is retained. In case no
privileges are specified behaviour is the same as before: all of them
are elevated.

Signed-off-by: Nikola Kotur <kotnick@gmail.com>
Acked-By: Christian Seiler <christian@iwakd.de>
Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
2013-11-20 10:54:47 -06:00
Serge Hallyn
c7e426bef6 lxc-usernsexec: fix the default map behavior
We were finding it, but not saving it.

Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
2013-11-20 10:07:40 -06:00
S.Çağlar Onur
2716b48772 fix memory leaks reported by cppcheck in src/lxc/lxc_usernsexec.c
Free previously allocated memory if realloc fails.

Signed-off-by: S.Çağlar Onur <caglar@10ur.org>
Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
2013-11-20 09:57:42 -06:00
Serge Hallyn
49aba4d3c8 lxc_user_nic: fix fd leak reported by coverity
Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
2013-11-19 17:10:32 -06:00
Serge Hallyn
03c2eb1563 lxc-user-nic: improve cull_entries
Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
Acked-by: Stéphane Graber <stgraber@ubuntu.com>
2013-11-19 16:27:43 -06:00
Serge Hallyn
82160e6f08 lxc_user_nic: initialize cnic to NULL to please compiler
Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
Acked-by: Stéphane Graber <stgraber@ubuntu.com>
2013-11-19 16:27:17 -06:00
Serge Hallyn
552a7d0595 lxc_user_nic: make all fns static for consistency
Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
Acked-by: Stéphane Graber <stgraber@ubuntu.com>
2013-11-19 16:27:12 -06:00
Serge Hallyn
8c81de199c lxc_user_nic: fix get_allotted description.
get_allotted doesn't get the list of nic names, only the # of nics
allowed to the user.  We check the db_file later for existing
number of nics.

Also close the conf file on success, and print filename and errno
if we failed to open conf file.

Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
Acked-by: Stéphane Graber <stgraber@ubuntu.com>
2013-11-19 16:27:02 -06:00
Serge Hallyn
c8f73ce205 lxc_user_nic: report failing filename in open_and_lock error cases
Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
Acked-by: Stéphane Graber <stgraber@ubuntu.com>
2013-11-19 16:26:58 -06:00
Serge Hallyn
78f97d4c4f lxc_user_nic: only exit from main and usage
Everywhere else return an error code instead.

Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
Acked-by: Stéphane Graber <stgraber@ubuntu.com>
2013-11-19 16:26:33 -06:00
Serge Hallyn
d56e223681 lxc_user_nic: report strerror(errno)
Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
Acked-by: Stéphane Graber <stgraber@ubuntu.com>
2013-11-19 16:26:29 -06:00
Serge Hallyn
95dfc8bd4b lxc_user_nic: don't pass unused arg to get_username()
Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
Acked-by: Stéphane Graber <stgraber@ubuntu.com>
2013-11-19 16:26:22 -06:00
Serge Hallyn
8d9f636daf lxc_user_nic: add a check to make sure caller owns target netns
Temporarily set our euid back to the calling ruid, so that the
access(2) check can succeed based on the euid being the userns
creator.

Also switch from atoi to strtol

Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
Acked-by: Stéphane Graber <stgraber@ubuntu.com>
2013-11-19 16:25:52 -06:00
S.Çağlar Onur
ad40563e90 fix memory leaks reported by cppcheck in src/lxc/conf.c (v2)
This also fixes possible crashes due to passing NULL to strlen function

Changes since v1;
* Fixed a typo spotted by Serge

Signed-off-by: S.Çağlar Onur <caglar@10ur.org>
Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
2013-11-19 16:22:12 -06:00
Dwight Engen
eff9177f71 oracle template: fix pam login failures under user namespace
Signed-off-by: Dwight Engen <dwight.engen@oracle.com>
Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
2013-11-19 16:22:11 -06:00
Dwight Engen
88927db9ae oracle template: don't clear console tty
This allows the boot messages to be seen which are useful for monitoring
container startup.

Signed-off-by: Dwight Engen <dwight.engen@oracle.com>
Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
2013-11-19 16:22:10 -06:00
Dwight Engen
2e83f7201c oracle template: prevent mingetty from calling vhangup(2)
This is needed when using the user namespace since the kernel check does
not allow user_ns root to successfully call vhangup(2), and mingetty will
quit in this case.

Signed-off-by: Dwight Engen <dwight.engen@oracle.com>
Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
2013-11-19 16:22:09 -06:00
Dwight Engen
31f38b1721 oracle template: further disable selinux in ol5 container
Signed-off-by: Dwight Engen <dwight.engen@oracle.com>
Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
2013-11-19 16:22:07 -06:00
S.Çağlar Onur
7be677a8aa p is a pointer and cannot be negative so check if it is NULL
Signed-off-by: S.Çağlar Onur <caglar@10ur.org>
Acked-by: Serge E. Hallyn <serge.hallyn@ubuntu.com>
2013-11-18 10:48:32 -05:00
S.Çağlar Onur
d380c7ff55 free previously allocated memory if realloc fails in src/lxc/lsm/apparmor.c
Signed-off-by: S.Çağlar Onur <caglar@10ur.org>
Acked-by: Serge E. Hallyn <serge.hallyn@ubuntu.com>
2013-11-18 10:47:45 -05:00
KATOH Yasufumi
6127da6b3f Improve Japanese man pages
Improve the consistency of expression

Signed-off-by: KATOH Yasufumi <karma@jazz.email.ne.jp>
Acked-by: Stéphane Graber <stgraber@ubuntu.com>
2013-11-18 10:45:20 -05:00
Nikola Kotur
c1c2297ba4 lxc-lua: LFS library is not being used
Signed-off-by: Nikola Kotur <kotnick@gmail.com>
Acked-by: Dwight Engen <dwight.engen@oracle.com>
2013-11-18 10:44:33 -05:00
S.Çağlar Onur
9992b49cde fix memory leaks reported by cppcheck in src/lxc/lxc_monitor.c. Since this is a cli tool it doesn't really matter but might silence some warnings for debugging
Signed-off-by: S.Çağlar Onur <caglar@10ur.org>
Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
2013-11-18 09:32:14 -06:00
S.Çağlar Onur
c6a9b0d797 add missing paranthesis (v2)
Signed-off-by: S.Çağlar Onur <caglar@10ur.org>
Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
2013-11-18 09:29:27 -06:00
S.Çağlar Onur
9529609a81 fix memory leaks reported by cppcheck in src/lxc/bdev.c
Signed-off-by: S.Çağlar Onur <caglar@10ur.org>
Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
2013-11-18 09:28:43 -06:00
Stéphane Graber
dceb6c8018
change version to 1.0.0.alpha3 in configure.ac
Signed-off-by: Stéphane Graber <stgraber@ubuntu.com>
2013-11-15 16:08:17 -05:00
Stéphane Graber
5444216b7e lxc-info: Rework based on mailinglist thread
So this implements the changes we discussed yesterday:
 - Only one container may be queried at the time
 - -n is now required once again
 - -H + a single filter only returns the value
 - -t/--is-state is now removed

Note that -S is considered as more than a single filter, so -H in that
case only affects the formatting of the values.

For the same reason, I haven't yet implemented the -H + multiple filters
case which we said should return a simple "key: value" output as it
wasn't trivial to re-arrange the stats code to print a different format
(for the other options, it's just a two lines change in the print
functions).

Signed-off-by: Stéphane Graber <stgraber@ubuntu.com>
Acked-by: Dwight Engen <dwight.engen@oracle.com>
2013-11-15 16:06:49 -05:00
Serge Hallyn
4df7f012b9 lxc-start: if we pass in a config file, then don't use any loaded config
To do this, add a c->clear_config() helper to the api.

(this fixes the bug https://bugs.launchpad.net/bugs/1251352)

Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
Acked-by: Stéphane Graber <stgraber@ubuntu.com>
2013-11-14 13:27:22 -06:00
S.Çağlar Onur
41f683579c gather all locking related code into src/lxc/lxclock.c
Signed-off-by: S.Çağlar Onur <caglar@10ur.org>
Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
2013-11-14 12:00:58 -06:00
Bogdan Purcareata
b466dc337c setup_netdev: re-read ifindex in LXC_NET_PHYS case
When moving an interface from the host netns to a container's,
the ifindex might not remain the same. This happens when the
index of the host interface is already assigned to another interface
in the new netns.

For veth/vlan/macvlan, virtual interfaces are first created on the host,
and then moved in the container. Since they are created after all other
interfaces are discovered, there is no chance for its assigned ifindex
to be already present in a freshly created netns, because it's a greater
number.

However, when moving a physical interface, there is a chance that its
ifindex in the host netns is not free in the new netns. The patch
forces ifindex re-read for the LXC_NET_PHYS case to update the
lxc_netdev structure.

Signed-off-by: Bogdan Purcareata <bogdan.purcareata@freescale.com>
Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
2013-11-14 09:25:09 -06:00
S.Çağlar Onur
a9a0ed90dd introduce lxcapi_add_device_node and lxcapi_remove_device_node to API (v3)
Adding block/char devices to running container is a common operation so
provide a common implementation for users to consume.

changes since v2;
* lets the user set an alternate path inside the container as Stéphane suggested

changes since v1;
* removed duplicated code

Signed-off-by: S.Çağlar Onur <caglar@10ur.org>
Acked-by: Stéphane Graber <stgraber@ubuntu.com>
2013-11-13 10:00:29 -05:00
KATOH Yasufumi
28254e6380 doc: Update Japanese lxc-info(1) for printing statistics
Update for commit b9d957c316

Signed-off-by: KATOH Yasufumi <karma@jazz.email.ne.jp>
Acked-by: Stéphane Graber <stgraber@ubuntu.com>
2013-11-12 16:05:13 -05:00