proxmox-mirrors/mirror_lxc
1
0
Fork 0
mirror of https://git.proxmox.com/git/mirror_lxc synced 2025-08-13 23:52:30 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity
7,351 Commits 6 Branches 17 Tags 29 MiB
dd94de5a87
Commit Graph

7351 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Christian Brauner
5221c891da
Merge pull request #2444 from 2xsec/bugfix 
utils: move recursive_destroy() from cfgsng to utils.
 2018-07-03 10:52:15 +02:00
2xsec
abbec8b4c3
sync: modify error string 
Signed-off-by: 2xsec <dh48.jeong@samsung.com>
 2018-07-03 15:08:44 +09:00
2xsec
d7ab03757c
utils: move recursive_destroy() from cfgsng to utils. 
Signed-off-by: 2xsec <dh48.jeong@samsung.com>
 2018-07-03 14:44:24 +09:00
Christian Brauner
c5c4d6a3ba
Merge pull request #2441 from 2xsec/coverity 
coverity: #1425816
 2018-07-02 13:54:31 +02:00
2xsec
f766a9d22b
coverity: #1425816 
Explicit null dereferenced

Signed-off-by: 2xsec <dh48.jeong@samsung.com>
 2018-07-02 20:37:36 +09:00
Stéphane Graber
7e52f25209
Merge pull request #2440 from brauner/2018-06-30/console_fixes 
terminal: security fixes
 2018-07-01 23:09:30 -04:00
Christian Brauner
3d47b3b24d
tests: remove duplicate file_exists() definition 
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
 2018-07-01 20:00:15 +02:00
Christian Brauner
23c8a51676
attach: do not make terminal raw 
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
 2018-07-01 20:00:15 +02:00
Christian Brauner
77f6262f61
CODING_STYLE: add section about using strlcat() 
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
 2018-07-01 20:00:15 +02:00
Christian Brauner
5b74eb3cd7
start: delete terminal on error 
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
 2018-07-01 20:00:15 +02:00
Christian Brauner
408c18a185
terminal: set FD_CLOEXEC on pty file descriptors 
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Cc: Wolfgang Bumiller <w.bumiller@proxmox.com>
 2018-07-01 20:00:14 +02:00
Christian Brauner
a9d4ebc168
utils: add fd_cloexec() 
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Cc: Wolfgang Bumiller <w.bumiller@proxmox.com>
 2018-07-01 20:00:14 +02:00
Christian Brauner
3f15bdd9ca
terminal: safely retrieve path of slave device 
openpty() is a horrible function that uses strcpy() into the char *name
argument if name != NULL. We can't rely on the path being sane in all cases so
let's split out the name retrieval to ttyname_r().

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
 2018-07-01 20:00:14 +02:00
Christian Brauner
882671aa99
conf: simplify lxc_setup_dev_console() 
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
 2018-07-01 20:00:12 +02:00
Christian Brauner
2d876a974d
Merge pull request #2437 from 2xsec/bugfix 
tools: share internal API symbols
 2018-07-01 19:37:56 +02:00
2xsec
1b087dab84 tools: lxc-wait: remove the trailing . 
Signed-off-by: 2xsec <dh48.jeong@samsung.com>
 2018-07-01 22:52:40 +09:00
2xsec
162ad1f600 tools: lxc-top: fix coding style of strncmp 
Signed-off-by: 2xsec <dh48.jeong@samsung.com>
 2018-07-01 22:51:59 +09:00
2xsec
28b7b0f01a tools: lxc-start: remove the trailing . 
Signed-off-by: 2xsec <dh48.jeong@samsung.com>
 2018-07-01 22:50:51 +09:00
2xsec
d5202ddf0b tools: lxc-snapshot: fix coding style of strncmp 
Signed-off-by: 2xsec <dh48.jeong@samsung.com>
 2018-07-01 22:50:04 +09:00
2xsec
80287d7d35 tools: lxc-device: remove the trailing . & fix coding style of strncmp 
Signed-off-by: 2xsec <dh48.jeong@samsung.com>
 2018-07-01 22:49:07 +09:00
2xsec
8f0bdb0528 tools: lxc-destroy: remove the trailing . 
Signed-off-by: 2xsec <dh48.jeong@samsung.com>
 2018-07-01 22:47:25 +09:00
2xsec
77e5da8e1e tools: lxc-create: remove the trailing . & fix coding style of strncmp 
Signed-off-by: 2xsec <dh48.jeong@samsung.com>
 2018-07-01 22:46:19 +09:00
2xsec
5dec9c3ede tools: lxc-copy: remove the trailing . & fix coding style of strncmp 
Signed-off-by: 2xsec <dh48.jeong@samsung.com>
 2018-07-01 22:42:27 +09:00
2xsec
dc71fcca83 tools: lxc-config: fix coding style of strncmp 
Signed-off-by: 2xsec <dh48.jeong@samsung.com>
 2018-07-01 22:40:19 +09:00
2xsec
8fb41a340f tools: lxc-checkpoint: remove the trailing . 
Signed-off-by: 2xsec <dh48.jeong@samsung.com>
 2018-07-01 22:38:52 +09:00
2xsec
54d4713113 tools: lxc-autostart: remove the trailing . & fix coding style of strncmp 
Signed-off-by: 2xsec <dh48.jeong@samsung.com>
 2018-07-01 22:37:00 +09:00
2xsec
03e6adc680 tools: remote tool_list, tool_utils 
Signed-off-by: 2xsec <dh48.jeong@samsung.com>
 2018-06-30 18:45:22 +09:00
2xsec
ae41d188ee tools: arguments: share internal API symbols 
Signed-off-by: 2xsec <dh48.jeong@samsung.com>
 2018-06-30 18:45:22 +09:00
2xsec
457e3c5daf tools: lxc-monitor: share internal API symbols 
Signed-off-by: 2xsec <dh48.jeong@samsung.com>
 2018-06-30 18:45:22 +09:00
2xsec
9c382925a1 tools: lxc-create: share internal API symbols 
Signed-off-by: 2xsec <dh48.jeong@samsung.com>
 2018-06-30 18:45:22 +09:00
2xsec
ce9ed7c0c4 tools: lxc-snapshot: share internal API symbols 
Signed-off-by: 2xsec <dh48.jeong@samsung.com>
 2018-06-30 18:45:22 +09:00
2xsec
4888c7312f tools: lxc-checkpoint: fix log name 
Signed-off-by: 2xsec <dh48.jeong@samsung.com>
 2018-06-30 18:45:22 +09:00
2xsec
124fef5a83 tools: lxc-checkpoint: share internal API symbols 
Signed-off-by: 2xsec <dh48.jeong@samsung.com>
 2018-06-30 18:45:22 +09:00
2xsec
4f66541cc6 tools: lxc-unshare: share internal API symbols 
Signed-off-by: 2xsec <dh48.jeong@samsung.com>
 2018-06-30 18:45:22 +09:00
2xsec
e809eec64e tools: lxc-top: share internal API symbols 
Signed-off-by: 2xsec <dh48.jeong@samsung.com>
 2018-06-30 18:45:21 +09:00
2xsec
e9b0c67964 tools: lxc-copy: share internal API symbols 
Signed-off-by: 2xsec <dh48.jeong@samsung.com>
 2018-06-30 18:45:21 +09:00
2xsec
d899f11b7b tools: lxc-execute: share internal API symbols 
Signed-off-by: 2xsec <dh48.jeong@samsung.com>
 2018-06-30 18:45:21 +09:00
2xsec
a9cb0fb86f tools: lxc-device: share internal API symbols 
Signed-off-by: 2xsec <dh48.jeong@samsung.com>
 2018-06-30 18:45:21 +09:00
2xsec
75e607ba45 tools: lxc-destroy: share internal API symbols 
Signed-off-by: 2xsec <dh48.jeong@samsung.com>
 2018-06-30 18:45:21 +09:00
2xsec
138eda996f tools: lxc-console: share internal API symbols 
Signed-off-by: 2xsec <dh48.jeong@samsung.com>
 2018-06-30 18:45:21 +09:00
2xsec
b27cdf66dc tools: lxc-config: share internal API symbols 
Signed-off-by: 2xsec <dh48.jeong@samsung.com>
 2018-06-30 18:45:21 +09:00
2xsec
d2ba12a8af tools: lxc-ls: share internal API symbols 
Signed-off-by: 2xsec <dh48.jeong@samsung.com>
 2018-06-30 18:45:21 +09:00
2xsec
469711c520 tools: lxc-info: share internal API symbols 
Signed-off-by: 2xsec <dh48.jeong@samsung.com>
 2018-06-30 18:45:21 +09:00
2xsec
b14fc1007c utils: code cleanups 
Signed-off-by: 2xsec <dh48.jeong@samsung.com>
 2018-06-30 18:45:21 +09:00
2xsec
1cd7db650a tools: lxc-autostart: share internal API symbols 
Signed-off-by: 2xsec <dh48.jeong@samsung.com>
 2018-06-30 18:45:21 +09:00
Stéphane Graber
bb9f9cede7
Merge pull request #2438 from brauner/2018-06-29/linux-v4.18 
autodev: adapt to changes in Linux 4.18
 2018-06-29 12:28:58 -04:00
Christian Brauner
3e04a6083e
autodev: adapt to changes in Linux 4.18 
Starting with commit
55956b59df33 ("vfs: Allow userns root to call mknod on owned filesystems.")
Linux will allow mknod() in user namespaces for userns root if CAP_MKNOD is
available.
However, these device nodes are useless since

static struct super_block *alloc_super(struct file_system_type *type, int flags,
                                       struct user_namespace *user_ns)
{
        /* <snip> */

        if (s->s_user_ns != &init_user_ns)
                s->s_iflags |= SB_I_NODEV;

        /* <snip> */
}

will set the SB_I_NODEV flag on the filesystem. When a device node created in
non-init userns is open()ed the call chain will hit:

bool may_open_dev(const struct path *path)
{
        return !(path->mnt->mnt_flags & MNT_NODEV) &&
                !(path->mnt->mnt_sb->s_iflags & SB_I_NODEV);
}

which will cause an EPERM because the device node is located on an fs
owned by non-init-userns and thus doesn't grant access to device nodes due to
SB_I_NODEV.

The solution is straightforward. Unless you're real root you should bind-mount
device nodes.

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
 2018-06-29 14:36:13 +02:00
2xsec
1b36d9e9dd
tools: lxc-attach: share internal API symbols 
Signed-off-by: 2xsec <dh48.jeong@samsung.com>
 2018-06-28 23:19:50 +09:00
2xsec
93f81bc78d
tools: lxc-cgroup: share internal API symbols 
Signed-off-by: 2xsec <dh48.jeong@samsung.com>
 2018-06-28 23:13:01 +09:00
2xsec
df3ab00995
tools: lxc-wait: share internal API symbols 
Signed-off-by: 2xsec <dh48.jeong@samsung.com>
 2018-06-28 23:07:01 +09:00