Stéphane Graber [Sat, 30 Nov 2013 00:19:09 +0000 (19:19 -0500)]
Move some common Ubuntu config
This introduces a new /usr/share/lxc/config directory containing common
configuration snippets.
The two Ubuntu templates are then simplified to just include the
relevant entries avoiding a whole lot of hardcoded cgroup, capabilities
and mount points configuration.
An extra comment is also added at the top of all generated configuration
files telling the user to look at lxc.conf(5) for more information.
Signed-off-by: Stéphane Graber <stgraber@ubuntu.com> Acked-by: Serge E. Hallyn <serge.hallyn@ubuntu.com>
Stéphane Graber [Thu, 5 Dec 2013 20:37:56 +0000 (15:37 -0500)]
Add support for new create=(dir,file) mount option
Just like we already had "optional", this adds two new LXC-specific
mount flags:
- create=dir (will do a mkdir_p on the path)
- create=file (will do a mkdir_p on the dirname + a fopen on the path)
This was motivated by some of the needed bind-mounts for the
unprivileged containers.
Signed-off-by: Stéphane Graber <stgraber@ubuntu.com> Acked-by: Serge E. Hallyn <serge.hallyn@ubuntu.com>
Stéphane Graber [Tue, 3 Dec 2013 21:45:13 +0000 (16:45 -0500)]
python3: Drop duplicate add_device_node function
It is now natively implemented in C, the new function takes the same
arguments (same order, different names) and has been confirmed to work
with lxc-device.
Serge Hallyn [Mon, 2 Dec 2013 19:17:34 +0000 (13:17 -0600)]
confile.c: clear entries if no value
For list configuration entries like capabilities and cgroups
entries, if there is a 'key =' value (i.e. "lxc.cap.drop =")
then clear any loaded entries.
Stéphane Graber [Fri, 29 Nov 2013 15:53:15 +0000 (10:53 -0500)]
Allow unsetting daemonize and close_fds
As mentioned in a previous commit, this does two changes:
- Make want_daemonize return a bool (false on failure, true on success)
- Make both want_daemonize and want_close_all_fds take a "state"
argument so the user can choose to unset those flags.
This commit also updates all occurences of those two functions and turns
the daemonize attribute from an int to a bool.
Stéphane Graber [Thu, 28 Nov 2013 19:32:53 +0000 (14:32 -0500)]
python3: Allow setting daemonize and close_fds
This extends the list of arguments of start() allowing the user to
request the container be started in the foreground and have control on
whether fds will be closed or not (daemonize=True implies that too).
One problem at the moment however is that while we have functions to set
close_fds and daemonize in the API, we don't have functions to unset
those flags, so those new parameters will only work on the initial call
to start() any further call will use the values of the previous one.
I think it'd make sense to change lxcapi slightly to have daemonize and
close_fds offer a similar interface, both returning booleans and both
accepting a value as a parameter so API users can set the value they
want.
Signed-off-by: Stéphane Graber <stgraber@ubuntu.com> Acked-by: Serge E. Hallyn <serge.hallyn@ubuntu.com>
Stéphane Graber [Thu, 28 Nov 2013 00:46:18 +0000 (19:46 -0500)]
ubuntu: Fix regression in post-process
THe recent reorg of lxc-ubuntu introduced some package installation in
post-process but without first disabling service startup.
As a result, if the cache is a bit out of date and a ssh update is
available, post-process will apply that update (as it does apt-get
install ssh vim) which in turn will attemp to start sshd. This will
either lead to ssh on the host being restarted or if there's no sshd on
the host, will fail the container creation as the postinst will get an
error from upstart.
The fix is very simply to add the same policy-rc.d trick when running
post-process.
Stéphane Graber [Tue, 26 Nov 2013 20:58:44 +0000 (15:58 -0500)]
python3: Add list_containers to C API
This adds a new list_containers function to the python3 binding and a
matching override in __init__.py that adds the as_object parameter.
This should be compatible to the previous pure python implementation
with the advantage of also listing active non-defined containers (fixing
github issue #68).
Signed-off-by: Stéphane Graber <stgraber@ubuntu.com> Acked-by: Serge E. Hallyn <serge.hallyn@ubuntu.com>
This adds an lxc-centos template for crreating CentOS 5+ templates. It
does NOT create CentOS 4 or earlier containers as these are way past
end of life and no longer supported. It is based on the work of
Fajar A. Nugraha <github@fajar.net> who modified an earlier Fedora
template. His work has been brought LARGELY into congruence with
the current Fedora template. It still lacks the distro agnostic
bootstrap and systemd code from the Fedora template but those should
only be relevant with CentOS 7 when that can of worms pops open
sometime next year or so.
Signed-off-by: Michael H. Warfield <mhw@WittsEnd.com> Acked-by: Stéphane Graber <stgraber@ubuntu.com>
Serge Hallyn [Sat, 23 Nov 2013 02:04:59 +0000 (20:04 -0600)]
lxc-user-nic: use common code from network.c
This pulls a lot of common code out of lxc_user_nic.c. It also
moves one function from conf.c that was duplicated in lxc_user_nic.c
(It removes a DEBUG statement because (a) it doesn't seem actually
useful and (b) DEBUG doesn't work in network.c).
Also replace the old test of only parsing code with a skeleton for
a full test. (Note - the test will need some work, it's just there
as do-what-i-mean code example)
Serge Hallyn [Fri, 22 Nov 2013 20:39:37 +0000 (14:39 -0600)]
lxcapi_destroy: run in a namespace if we are unprivileged
This is necessary to have the rights to remove files owned by our subuids.
Also update lxc_rmdir_onedev to return 0 on success, -1 on failure.
Callers were not consistent in using it correctly, and this is more
in keeping with the rest of our code.
Serge Hallyn [Fri, 22 Nov 2013 04:11:43 +0000 (22:11 -0600)]
remove HAVE_NEWUIDMAP and NEWUIDMAP
Always build lxc-usernsexec. Else we require having uidmap
installed on the build host for no good reason. And we never
actually used the NEWUIDMAP path we detected.
Added a file "lxc.service" for a systemd service file.
Added a file "lxc-devsetup" to setup /dev/ on startup to support autodev
in containers.
Service file references lxc-devsetup as an ExecStartPre command. The
lxc-devsetup script is not dependent on systemd or Fedora and can
be used at bootup on any system.
Modified lxc.spec.in to install the two new files on Fedora. The systemd
specific code in the lxc.spec file may need some review and conditionalize
for systemd on non-systemd rpm-based systems.
Signed-off-by: Michael H. Warfield <mhw@WittsEnd.com> Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
Serge Hallyn [Thu, 21 Nov 2013 15:05:59 +0000 (09:05 -0600)]
lxcapi_clone: set the right environment variable for mounted fs
If the container is dir-backed, we don't actually mount it (to
support unprivileged use). So always set the LXC_ROOTFS_MOUNT
to bdev->dest, not to the rootfs path specified in the container
configuration.
If autodev is not specifically set to 0 or 1, attempts to determine if
systemd is being utilized and forces autodev=1 to prevent host system
conflicts and collisions.
If autodev is enabled and the host /dev is mounted with devtmpfs
or /dev/.lxc is mounted with another file system...
Each container created by a privileged user gets a /dev directory
mapped off the host /dev here:
/dev/.lxc/${name}.$( hash $lxcpath/$name )
Each container created by a non-privileged user gets a /dev/directory
mapped off the host /dev here:
/dev/.lxc/user/${name}.$( hash $lxcpath/$name )
The /dev/.lxc/user is mode 1777 to allow unpriv access.
The /dev/.lxc/{containerdev} is bind mounted into the container /dev.
Fallback on failure is to mount tmpfs into the container /dev.
A symlink is created from $lxcpath/$name/rootfs.dev back to the /dev
relative directory to provid a code consistent reference for updating
container devs.
Signed-off-by: Michael H. Warfield <mhw@WittsEnd.com> Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
Nikola Kotur [Wed, 20 Nov 2013 15:07:37 +0000 (16:07 +0100)]
lxc-attach: elevate specific privileges
There are scenarios in which we want to execute process with specific
privileges elevated.
An example for this might be executing a process inside the container
securely, with capabilities dropped, but not in container's cgroup so
that we can have per process restrictions inside single container.
Similar to namespaces, privileges to be elevated can be OR'd:
lxc-attach --elevated-privileges='CAP|CGROUP' ...
Backward compatibility with previous versions is retained. In case no
privileges are specified behaviour is the same as before: all of them
are elevated.
Signed-off-by: Nikola Kotur <kotnick@gmail.com> Acked-By: Christian Seiler <christian@iwakd.de> Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
Dwight Engen [Mon, 18 Nov 2013 17:28:14 +0000 (12:28 -0500)]
oracle template: prevent mingetty from calling vhangup(2)
This is needed when using the user namespace since the kernel check does
not allow user_ns root to successfully call vhangup(2), and mingetty will
quit in this case.
S.Çağlar Onur [Fri, 15 Nov 2013 04:56:04 +0000 (23:56 -0500)]
fix memory leaks reported by cppcheck in src/lxc/lxc_monitor.c. Since this is a cli tool it doesn't really matter but might silence some warnings for debugging
Stéphane Graber [Fri, 15 Nov 2013 20:14:00 +0000 (15:14 -0500)]
lxc-info: Rework based on mailinglist thread
So this implements the changes we discussed yesterday:
- Only one container may be queried at the time
- -n is now required once again
- -H + a single filter only returns the value
- -t/--is-state is now removed
Note that -S is considered as more than a single filter, so -H in that
case only affects the formatting of the values.
For the same reason, I haven't yet implemented the -H + multiple filters
case which we said should return a simple "key: value" output as it
wasn't trivial to re-arrange the stats code to print a different format
(for the other options, it's just a two lines change in the print
functions).
setup_netdev: re-read ifindex in LXC_NET_PHYS case
When moving an interface from the host netns to a container's,
the ifindex might not remain the same. This happens when the
index of the host interface is already assigned to another interface
in the new netns.
For veth/vlan/macvlan, virtual interfaces are first created on the host,
and then moved in the container. Since they are created after all other
interfaces are discovered, there is no chance for its assigned ifindex
to be already present in a freshly created netns, because it's a greater
number.
However, when moving a physical interface, there is a chance that its
ifindex in the host netns is not free in the new netns. The patch
forces ifindex re-read for the LXC_NET_PHYS case to update the
lxc_netdev structure.
projects / mirror_lxc.git / log