]>
git.proxmox.com Git - mirror_lxc.git/log
0x0916 [Wed, 28 Jun 2017 11:26:02 +0000 (19:26 +0800)]
confile: namespace lxc.signal keys
* rename lxc.haltsignal to lxc.signal.halt
* rename lxc.rebootsignal to lxc.signal.reboot
* rename lxc.stopsignal to lxc.signal.stop
the legacy keys will be kept around until LXC 3.0 and then will be
removed.
Signed-off-by: 0x0916 <w@laoqinren.net>
0x0916 [Wed, 28 Jun 2017 09:30:41 +0000 (17:30 +0800)]
confile: namespace lxc.log keys
* rename lxc.logfile to lxc.log.file
* renaem lxc.loglevel to lxc.log.level
* rename lxc.syslog to lxc.log.syslog
the legacy keys will be kept around until LXC 3.0 and then will be
removed.
Signed-off-by: 0x0916 <w@laoqinren.net>
0x0916 [Wed, 28 Jun 2017 08:32:04 +0000 (16:32 +0800)]
confile: namespace lxc.init keys
* rename lxc.init_cmd to lxc.init.cmd
* rename lxc.init_uid to lxc.init.uid
* rename lxc.init_gid to lxc.init.gid
the legacy keys will be kept around until LXC 3.0 and then will be
removed.
Signed-off-by: 0x0916 <w@laoqinren.net>
0x0916 [Wed, 28 Jun 2017 08:14:14 +0000 (16:14 +0800)]
confile: rename lxc.limit to lxc.prlimit
Signed-off-by: 0x0916 <w@laoqinren.net>
Christian Brauner [Thu, 29 Jun 2017 11:17:59 +0000 (13:17 +0200)]
Merge pull request #1649 from 0x0916/2017-06-27/wipe-lxc-network-references
wipe all references lxc.network.{[i]}.* and replace with lxc.net.[i].*
0x0916 [Thu, 29 Jun 2017 03:48:35 +0000 (11:48 +0800)]
confile_legacy: fix lxc_clear_nic error
`lxc_clear_nic` can not clear the nic, because it will not found
the right `netdev`.
testcase from get_item.c
```
313 if (!c->set_config_item(c, "lxc.network.hwaddr", "00:16:3e:xx:xx:xx")) {
314 fprintf(stderr, "%d: failed to set network.hwaddr\n", __LINE__);
315 goto out;
316 }
317 if (!c->set_config_item(c, "lxc.network.ipv4", "10.2.3.4")) {
318 fprintf(stderr, "%d: failed to set ipv4\n", __LINE__);
319 goto out;
320 }
321
322 ret = c->get_config_item(c, "lxc.network.0.ipv4", v2, 255);
323 if (ret <= 0) {
324 fprintf(stderr, "%d: lxc.network.0.ipv4 returned %d\n", __LINE__, ret);
325 goto out;
326 }
327 if (!c->clear_config_item(c, "lxc.network.0.ipv4")) {
328 fprintf(stderr, "%d: failed clearing all ipv4 entries\n", __LINE__);
329 goto out;
330 }
331 ret = c->get_config_item(c, "lxc.network.0.ipv4", v2, 255);
332 if (ret != 0) {
333 fprintf(stderr, "%d: after clearing ipv4 entries get_item(lxc.network.0.ipv4 returned %d\n", __LINE__, ret);
334 goto out;
335 }
```
line `327` will failed to clear nic, and line `333` give the error.
Signed-off-by: 0x0916 <w@laoqinren.net>
0x0916 [Wed, 28 Jun 2017 23:32:54 +0000 (07:32 +0800)]
testcase: define a network before checks
Signed-off-by: 0x0916 <w@laoqinren.net>
0x0916 [Wed, 28 Jun 2017 02:59:39 +0000 (10:59 +0800)]
confile_utils: supporting new net hwaddr key in update_hwaddr
Signed-off-by: 0x0916 <w@laoqinren.net>
0x0916 [Wed, 28 Jun 2017 02:58:29 +0000 (10:58 +0800)]
confile: supporting new net hwaddr key in network_new_hwaddrs
Signed-off-by: 0x0916 <w@laoqinren.net>
0x0916 [Wed, 28 Jun 2017 02:56:43 +0000 (10:56 +0800)]
confile_utils: add lxc_config_net_hwaddr
`lxc_config_net_hwaddr` return true if the config entry
is `lxc.network.hwaddr` or `lxc.net.[i].hwaddr`, `lxc.network.[i].hwaddr`
Signed-off-by: 0x0916 <w@laoqinren.net>
0x0916 [Tue, 27 Jun 2017 03:38:23 +0000 (11:38 +0800)]
confile: update comment: replace p+12 with p+8
Signed-off-by: 0x0916 <w@laoqinren.net>
0x0916 [Mon, 26 Jun 2017 13:08:34 +0000 (21:08 +0800)]
replace all lxc.network* with lxc.net*
This patch wipe all references to lxc.network{[i]}.*
and replace with lxc.net.{[i]}.* in templates, documentation
and configuration files.
Signed-off-by: 0x0916 <w@laoqinren.net>
Christian Brauner [Tue, 27 Jun 2017 19:14:45 +0000 (21:14 +0200)]
Merge pull request #1652 from 0x0916/2017-06-27/free-downscript
confile: free netdev->downscript
0x0916 [Tue, 27 Jun 2017 14:12:38 +0000 (22:12 +0800)]
confile: free netdev->downscript
Signed-off-by: 0x0916 <w@laoqinren.net>
Christian Brauner [Tue, 27 Jun 2017 08:43:35 +0000 (10:43 +0200)]
Merge pull request #1650 from 0x0916/2017-06-27/refactor-confile-code
refactor confile code
0x0916 [Tue, 27 Jun 2017 07:54:23 +0000 (15:54 +0800)]
refactor confile code
Signed-off-by: 0x0916 <w@laoqinren.net>
Serge Hallyn [Mon, 26 Jun 2017 14:13:47 +0000 (09:13 -0500)]
Merge pull request #1639 from brauner/2017-06-23/lxc_2_1_preparations
confile: prepare for 2.1.
Christian Brauner [Mon, 26 Jun 2017 12:29:23 +0000 (14:29 +0200)]
Merge pull request #1648 from 0x0916/remove-__func__
remove the `__func__` macro
Christian Brauner [Mon, 26 Jun 2017 10:03:42 +0000 (12:03 +0200)]
Merge pull request #1647 from 0x0916/update-api-doc
API doc: update note for get_config_item
0x0916 [Mon, 26 Jun 2017 09:55:12 +0000 (17:55 +0800)]
remove the `__func__` macro
Our logging function will always spew out the function name.
Signed-off-by: 0x0916 <w@laoqinren.net>
0x0916 [Mon, 26 Jun 2017 09:28:47 +0000 (17:28 +0800)]
API doc: update note for get_config_item
Fix issue: https://github.com/lxc/lxc/issues/505
Signed-off-by: 0x0916 <w@laoqinren.net>
Christian Brauner [Sun, 25 Jun 2017 08:00:30 +0000 (10:00 +0200)]
Merge pull request #1644 from evgeni/centos-7
default to CentOS 7
Christian Brauner [Sat, 24 Jun 2017 17:37:38 +0000 (19:37 +0200)]
Merge pull request #1643 from evgeni/aarch64
templates/debian: add aarch64 → arm64 mapping
Christian Brauner [Sat, 24 Jun 2017 17:37:25 +0000 (19:37 +0200)]
Merge pull request #1645 from evgeni/centos-altarch
use altarch mirror for CentOS on arches other than i386 and x86_64
Evgeni Golov [Sat, 24 Jun 2017 16:53:05 +0000 (18:53 +0200)]
use altarch mirror for CentOS on arches other than i386 and x86_64
CentOS only has i386 and x86_64 listed in mirrorlist.centos.org,
use http://mirror.centos.org/altarch/ for all other arches instead
See: https://bugs.centos.org/view.php?id=11250
Signed-off-by: Evgeni Golov <evgeni@debian.org>
Evgeni Golov [Sat, 24 Jun 2017 16:56:22 +0000 (18:56 +0200)]
default to CentOS 7
Signed-off-by: Evgeni Golov <evgeni@debian.org>
Evgeni Golov [Sat, 24 Jun 2017 15:24:49 +0000 (17:24 +0200)]
templates/debian: add aarch64 → arm64 mapping
uname -m reports aarch64, but Debian calls the arch arm64
Signed-off-by: Evgeni Golov <evgeni@debian.org>
Christian Brauner [Fri, 23 Jun 2017 16:10:46 +0000 (18:10 +0200)]
Merge pull request #1635 from 0x0916/instead-of-strerror
Use strerror(errno) instead of %m
Christian Brauner [Fri, 23 Jun 2017 16:00:10 +0000 (18:00 +0200)]
Merge pull request #1640 from 0x0916/update-ignore-file
update .gitignore
0x0916 [Fri, 23 Jun 2017 15:17:29 +0000 (23:17 +0800)]
update .gitignore
Signed-off-by: 0x0916 <w@laoqinren.net>
0x0916 [Fri, 23 Jun 2017 11:41:34 +0000 (19:41 +0800)]
Use strerror(errno) instead of %m
Signed-off-by: 0x0916 <w@laoqinren.net>
Christian Brauner [Fri, 23 Jun 2017 13:39:00 +0000 (15:39 +0200)]
confile: remove lxc.pivotdir
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Christian Brauner [Fri, 23 Jun 2017 13:38:02 +0000 (15:38 +0200)]
confile: remove lxc.kmsg
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Christian Brauner [Fri, 23 Jun 2017 13:35:17 +0000 (15:35 +0200)]
confile: properly namespace security keys
- lxc.aa_profile => lxc.apparmor.profile
- lxc.aa_allow_incomplete => lxc.apparmor.allow_incomplete
- lxc.se_context => lxc.selinux.context
The legacy keys will be kept around until LXC 3.0 and then will be removed.
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Christian Brauner [Fri, 23 Jun 2017 13:34:15 +0000 (15:34 +0200)]
Merge pull request #1638 from 0x0916/fix-memory-resource-leak
fix memory and resource leak
Christian Brauner [Fri, 23 Jun 2017 12:44:12 +0000 (14:44 +0200)]
Merge pull request #1637 from 0x0916/fix-lxc.pc
Revert "Add a prefix to the lxc.pc"
0x0916 [Fri, 23 Jun 2017 12:36:56 +0000 (20:36 +0800)]
fix memory and resource leak
Signed-off-by: 0x0916 <w@laoqinren.net>
0x0916 [Fri, 23 Jun 2017 11:46:52 +0000 (19:46 +0800)]
Revert "Add a prefix to the lxc.pc"
This reverts commit
758243d8af0406e63cc5446c65d415298fa3cef2 .
Signed-off-by: 0x0916 <w@laoqinren.net>
Serge Hallyn [Wed, 21 Jun 2017 15:30:58 +0000 (10:30 -0500)]
Merge pull request #1632 from brauner/2017-06-19/new_network_parser_part_deux
network: new network parser part II
Christian Brauner [Wed, 21 Jun 2017 09:54:20 +0000 (11:54 +0200)]
Merge pull request #1633 from lifeng68/Fix_memory_leak
Fix memory leak of 'lxc_tty_state'
Christian Brauner [Wed, 21 Jun 2017 09:13:57 +0000 (11:13 +0200)]
confile: do not check for empty value twice
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Li Feng [Wed, 21 Jun 2017 05:38:06 +0000 (13:38 +0800)]
Fix memory leak of 'lxc_tty_state'
Signed-off-by: Li Feng <lifeng68@huawei.com>
Christian Brauner [Tue, 20 Jun 2017 22:44:17 +0000 (00:44 +0200)]
network: test legacy index based networks
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Christian Brauner [Tue, 20 Jun 2017 22:05:22 +0000 (00:05 +0200)]
network: return negative idx for legacy networks
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Christian Brauner [Tue, 20 Jun 2017 09:24:43 +0000 (11:24 +0200)]
network: test new network configuration parser
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Christian Brauner [Tue, 20 Jun 2017 09:16:13 +0000 (11:16 +0200)]
network: new network parser part II
Serge and I discussed the new network parser we've merge a couple of days ago.
He pointed out that a bunch of use-cases we're currently supporting in the old
network parser would be broken by the new parser. As we've pointed out many
times before, we're strongly commited to backwards compatibility and not
breaking existing use-cases. That's why we decided to take a new approach.
Instead of trying to mangle the old parser and new parser to come up with
something that allows a smooth transition we will simply deprecate the old
configuration keys with LXC 3.0. In the meantime we will support the full-blown
old legacy parser and the new network parser. Specifically, this means that
we're deprecating:
lxc.network.*
in favor of
lxc.net.*
With LXC 2.1. defining networks using lxc.network.* keys will cause a
deprecation warning to be shown/logged. We strongly suggest that users upgrade
their existing configuration files to switch to the new network configuration
parser. Starting with LXC 3.0 we will remove all lxc.network.* keys and will
only support lxc.net.* style network configurations.
Note that the new network configuration parser will only accept index based
configuration keys, i.e. we are only support lxc.net.[i].* keys without an
index such as lxc.net.type are not supported anymore. The advantages of this
approach are vast. Not just internally, but also user-facing since it is much
clearer what configuration key belongs to what network.
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Christian Brauner [Tue, 20 Jun 2017 08:46:42 +0000 (10:46 +0200)]
Merge pull request #1631 from tenforward/japanese
Update Japanese lxc.container.conf(5)
KATOH Yasufumi [Tue, 20 Jun 2017 08:36:30 +0000 (17:36 +0900)]
doc: Untabify Japanese lxc.container.conf(5)
Tab and white space is mixed in Japanese lxc.container.conf(5), so
unify into the white space.
Signed-off-by: KATOH Yasufumi <karma@jazz.email.ne.jp>
KATOH Yasufumi [Tue, 20 Jun 2017 08:28:49 +0000 (17:28 +0900)]
doc: Tweak Japanese lxc.container.conf(5)
Add description of new network configuration, and tweak.
Update for commit
b9986e437ba334a3860472a3e01ed2fa221603ab
Signed-off-by: KATOH Yasufumi <karma@jazz.email.ne.jp>
Serge Hallyn [Tue, 20 Jun 2017 01:30:16 +0000 (20:30 -0500)]
Merge pull request #1630 from brauner/2017-06-20/fix_siblk_detection
utils: use 1LU otherwise we overflow
Christian Brauner [Tue, 20 Jun 2017 00:48:47 +0000 (02:48 +0200)]
utils: use 1LU otherwise we overflow
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Christian Brauner [Mon, 19 Jun 2017 06:05:02 +0000 (08:05 +0200)]
Merge pull request #1628 from tanyifeng/fix_detect_way_of_bitmask
utils: fix the way to detect blocking signal
Yifeng Tan [Mon, 19 Jun 2017 10:36:13 +0000 (18:36 +0800)]
utils: fix the way to detect blocking signal
Signed-off-by: Yifeng Tan <tanyifeng1@huawei.com>
Serge Hallyn [Sun, 18 Jun 2017 22:24:27 +0000 (17:24 -0500)]
Merge pull request #1626 from brauner/2017-06-13/new_networks_parser
new network config parser
Christian Brauner [Sun, 18 Jun 2017 21:57:19 +0000 (23:57 +0200)]
confile: adapt warning
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Christian Brauner [Sun, 18 Jun 2017 10:24:38 +0000 (12:24 +0200)]
network: refuse to create unsupported net types
Containers setup by unprivileged users are only able to create veth network
types.
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Christian Brauner [Sun, 18 Jun 2017 10:22:46 +0000 (12:22 +0200)]
network: non-functional changes
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Christian Brauner [Sun, 18 Jun 2017 09:31:39 +0000 (11:31 +0200)]
network: improve network logging
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Christian Brauner [Sat, 17 Jun 2017 06:53:41 +0000 (08:53 +0200)]
network: preserve backwards compatibility
The new network parser will support specifying multiple networks in the old
format where each new non-indexed "lxc.network.type" line starts a new network
configuration. This way we don't break users. For now, we just print a
deprecation warning. We will KILL this in LXC 3.0.
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Christian Brauner [Thu, 15 Jun 2017 20:49:09 +0000 (22:49 +0200)]
network: add test-suite for configuration items
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Christian Brauner [Fri, 16 Jun 2017 19:18:37 +0000 (21:18 +0200)]
network: switch to single find + allocation fun
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Christian Brauner [Fri, 16 Jun 2017 18:40:31 +0000 (20:40 +0200)]
network: print deprecaton warning for networks
Specifying networks without an index is deprecated.
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Christian Brauner [Fri, 16 Jun 2017 15:53:53 +0000 (17:53 +0200)]
network: remove obsolete logic
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Christian Brauner [Fri, 16 Jun 2017 15:02:08 +0000 (17:02 +0200)]
network: final cleanup
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Christian Brauner [Fri, 16 Jun 2017 14:41:32 +0000 (16:41 +0200)]
network: implement network getters
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Christian Brauner [Fri, 16 Jun 2017 14:39:32 +0000 (16:39 +0200)]
network: allow to unset by passing empty value
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Christian Brauner [Fri, 16 Jun 2017 14:28:03 +0000 (16:28 +0200)]
network: give getters a void pointer arg
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Christian Brauner [Thu, 15 Jun 2017 20:05:53 +0000 (22:05 +0200)]
network: clear whole networks
When users specify
lxc.network.<n>
we remove the whole network from the networks list.
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Christian Brauner [Thu, 15 Jun 2017 17:14:00 +0000 (19:14 +0200)]
network: implement network clearing
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Christian Brauner [Thu, 15 Jun 2017 15:22:17 +0000 (17:22 +0200)]
network: abstract network handling
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Christian Brauner [Thu, 15 Jun 2017 17:08:22 +0000 (19:08 +0200)]
network: add arg to config clear method
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Christian Brauner [Wed, 14 Jun 2017 14:32:27 +0000 (16:32 +0200)]
network: add lxc_log_configured_netdevs()
This logs the configured networks on the trace level to support debugging.
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Christian Brauner [Wed, 14 Jun 2017 13:53:41 +0000 (15:53 +0200)]
network: use new network configuration parser
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Christian Brauner [Wed, 14 Jun 2017 11:53:23 +0000 (13:53 +0200)]
network: perform network validation at creation time
Some of the checks were previously performed when parsing the network config.
But since we allow for a little more flexibility now it doesn't work anymore.
Instead, let's validate the network at creation time.
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Christian Brauner [Wed, 14 Jun 2017 11:42:27 +0000 (13:42 +0200)]
network: implement lxc_get_netdev_by_idx()
lxc_get_netdev_by_idx() takes care of checking whether a given netdev struct
for a given index is already allocated. If so it returns a pointer to it to the
caller.
If it doesn't find it it will allocate a new netdev struct and insert it into
the network list at the right position. For example, let's say you have the
following networks defined in your config file:
lxc.network.0.type=veth
lxc.network.0.link=lxcbr0
lxc.network.0.name=eth0
lxc.network.0.flags=up
lxc.network.3.type=veth
lxc.network.3.link=lxcbr0
lxc.network.3.name=eth1
lxc.network.3.flags=up
lxc.network.3.hwaddr = 00:16:3e:5d:7d:65
lxc.network.1.type=veth
lxc.network.1.link=lxcbr0
lxc.network.1.name=eth0
lxc.network.1.flags=up
lxc_get_netdev_by_idx() will take care that the internal network list appears
in the order:
0
1
3
The ordering of the keys themselves can also be random, meaning you could do:
lxc.network.3.type=veth
lxc.network.0.link=lxcbr0
lxc.network.0.name=eth0
lxc.network.3.hwaddr = 00:16:3e:5d:7d:65
lxc.network.0.flags=up
lxc.network.3.flags=up
lxc.network.0.type=veth
lxc.network.3.link=lxcbr0
lxc.network.3.name=eth1
and lxc_get_netdev_by_idx() would still figure out the correct ordering since
it keeps track of the index.
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Christian Brauner [Tue, 13 Jun 2017 22:42:06 +0000 (00:42 +0200)]
network: add network counter
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Christian Brauner [Tue, 13 Jun 2017 22:39:35 +0000 (00:39 +0200)]
network: add data arg to set callback
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Christian Brauner [Tue, 13 Jun 2017 11:48:04 +0000 (13:48 +0200)]
network: mv config_value_empty() to confile_utils
and rename it to lxc_config_value_empty()
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Serge Hallyn [Fri, 16 Jun 2017 04:50:36 +0000 (23:50 -0500)]
Merge pull request #1627 from brauner/2017-06-15/fix_new_logging_api
tree-wide: priority -> level
Christian Brauner [Thu, 15 Jun 2017 10:13:04 +0000 (12:13 +0200)]
tree-wide: priority -> level
When we merged the new logging function for the api we exposed the log level
argument in the struct as "priority" which we actually requested to be changed
to "level" which somehow didn't happen and we missed it. Given the fact there
has been no new liblxc release let's fix it right now before it hits users.
Also, take the chance to change the terminology in the log from "priority" to
"level" globally. This is to prevent confusion with syslog's "priority"
argument which we also support.
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Serge Hallyn [Tue, 13 Jun 2017 05:34:47 +0000 (00:34 -0500)]
Merge pull request #1618 from brauner/2017-06-06/kill_lxc_monitord
start: kill lxc-monitord
Christian Brauner [Mon, 12 Jun 2017 14:06:17 +0000 (16:06 +0200)]
tests: don't fail when no processes for user exist
Since we kicked lxc-monitord there will very likely be no user processes around
anymore after all container's have been stopped. Which is a very very very good
thing. So let's not error out when pkill doesn't find any processes.
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Christian Brauner [Mon, 12 Jun 2017 09:18:05 +0000 (11:18 +0200)]
conf: fix wrong path on overlayfs
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Christian Brauner [Sun, 11 Jun 2017 04:33:06 +0000 (06:33 +0200)]
lxccontainer: cleanup + bugfixes
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Christian Brauner [Sun, 11 Jun 2017 03:44:52 +0000 (05:44 +0200)]
{start,lxccontainer}: add lxc_free_handler()
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Christian Brauner [Sat, 10 Jun 2017 23:29:45 +0000 (01:29 +0200)]
commands: add lxc_cmd_state_server()
A LXC container's lifecycle is regulated by the states STARTING, RUNNING,
STOPPING, STOPPED, ABORTING. These states are tracked in the LXC handler and
can be checked via approriate functions in the command socket callback system.
(The freezer stages are not part of a container's lifecycle since they are not
recorded in the LXC handler. This might change in the future but given that the
freezer controller will be removed from future cgroup implementations it is
unlikely.) So far, LXC was using an external helper to track the states of a
container (lxc-monitord). This solution was error prone. For example, the
external state server would hang in various scenarios that seemed to be caused
by either very subtle internal races or irritation of the external state server
by signals.
LXC will switch from an external state monitor (lxc-monitord) which serves as a
state server for state clients to a native implementation using the indiviual
container's command socket. This solution was discussed and outlined by Stéphane
Graber and Christian Brauner during a LX{C,D} sprint.
The LXC handler will gain an additional field to track state clients. In order
for a state client to receive state notifications from the command server he
will need to register himself via the lxc_cmd_state_server() function in the
state client list. The state client list will be served by lxc_set_state()
during the container's lifecycle. lxc_set_state() will also take care of
removing any clients from the state list in the LXC handler once the requested
state has been reached and sent to the client.
In order to prevent races between adding and serving new state clients the state
client list and the state field in the LXC handler will be protected by a lock.
This commit effectively deprecates lxc-monitord. Instead of serving states to
state clients via the lxc-monitord fifo and socket we will now send the state
of the container via the container's command socket.
lxc-monitord is still useable and will - for the sake of the lxc-monitor
command - be kept around so that non-API state clients can still monitor the
container during it's lifecycle.
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Stéphane Graber [Tue, 13 Jun 2017 03:24:34 +0000 (23:24 -0400)]
Merge pull request #1621 from leitao/master
lxc-alpine: Add support for ppc64le
Christian Brauner [Fri, 9 Jun 2017 15:20:20 +0000 (17:20 +0200)]
commands: add TRACE()ers
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Christian Brauner [Thu, 8 Jun 2017 22:12:32 +0000 (00:12 +0200)]
lxccontainer: only spawn monitord on demand
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Christian Brauner [Wed, 7 Jun 2017 20:23:56 +0000 (22:23 +0200)]
start: add lxc_init_handler()
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Christian Brauner [Mon, 12 Jun 2017 22:51:41 +0000 (00:51 +0200)]
Merge pull request #1615 from 0x0916/expose-lxc_log_init
API: expose function lxc_log_init
Breno Leitao [Mon, 12 Jun 2017 18:45:52 +0000 (13:45 -0500)]
lxc-alpine: Add support for ppc64le
Starting at version 3.6, Alpine Linux has support for ppc64le
architecture. Adding the new keys also.
Signed-off-by: Breno Leitao <breno.leitao@gmail.com>
Stéphane Graber [Tue, 6 Jun 2017 22:47:29 +0000 (16:47 -0600)]
Merge pull request #1588 from brauner/2017-05-26/update_opensuse_template
lxc-opensuse: add Tumbleweed as supported release
Christian Brauner [Tue, 6 Jun 2017 05:09:26 +0000 (23:09 -0600)]
Merge pull request #1578 from 0x0916/export-seccomp-filter-to-log
seccomp: export the seccomp filter after load it into kernel successful
0x0916 [Mon, 5 Jun 2017 06:31:03 +0000 (14:31 +0800)]
API: expose function lxc_log_init
Signed-off-by: 0x0916 <w@laoqinren.net>
0x0916 [Sat, 20 May 2017 02:49:06 +0000 (10:49 +0800)]
seccomp: export the seccomp filter after load it into kernel successful
when the log level is TRACE, this patch export the seccomp
filter to log file.
the ouput of `seccomp_export_pfc()` is human readable and this feature
is useful for user to make sure their `seccomp configuration file` is
right.
Output for he default ubuntu container's seccomp filter is the
following:
```
lxc-start ubuntu
20170520024159 .412 INFO lxc_apparmor - lsm/apparmor.c:apparmor_process_label_set:238 - changed apparmor profile to lxc-container-default-cgns
if ($arch ==
3221225534 )
# filter for syscall "finit_module" (313) [priority: 65535]
if ($syscall == 313)
action ERRNO(1);
# filter for syscall "open_by_handle_at" (304) [priority: 65535]
if ($syscall == 304)
action ERRNO(1);
# filter for syscall "kexec_load" (246) [priority: 65535]
if ($syscall == 246)
action ERRNO(1);
# filter for syscall "delete_module" (176) [priority: 65535]
if ($syscall == 176)
action ERRNO(1);
# filter for syscall "init_module" (175) [priority: 65535]
if ($syscall == 175)
action ERRNO(1);
# filter for syscall "umount2" (166) [priority: 65533]
if ($syscall == 166)
if ($a1.hi32 & 0x00000000 == 0)
if ($a1.lo32 & 0x00000001 == 1)
action ERRNO(13);
# default action
action ALLOW;
if ($arch ==
1073741827 )
# filter for syscall "finit_module" (350) [priority: 65535]
if ($syscall == 350)
action ERRNO(1);
# filter for syscall "open_by_handle_at" (342) [priority: 65535]
if ($syscall == 342)
action ERRNO(1);
# filter for syscall "kexec_load" (283) [priority: 65535]
if ($syscall == 283)
action ERRNO(1);
# filter for syscall "delete_module" (129) [priority: 65535]
if ($syscall == 129)
action ERRNO(1);
# filter for syscall "init_module" (128) [priority: 65535]
if ($syscall == 128)
action ERRNO(1);
# filter for syscall "umount2" (52) [priority: 65534]
if ($syscall == 52)
if ($a1 & 0x00000001 == 1)
action ERRNO(13);
# default action
action ALLOW;
if ($arch ==
3221225534 )
# filter for syscall "kexec_load" (
1073742352 ) [priority: 65535]
if ($syscall ==
1073742352 )
action ERRNO(1);
# filter for syscall "finit_module" (
1073742137 ) [priority: 65535]
if ($syscall ==
1073742137 )
action ERRNO(1);
# filter for syscall "open_by_handle_at" (
1073742128 ) [priority: 65535]
if ($syscall ==
1073742128 )
action ERRNO(1);
# filter for syscall "delete_module" (
1073742000 ) [priority: 65535]
if ($syscall ==
1073742000 )
action ERRNO(1);
# filter for syscall "init_module" (
1073741999 ) [priority: 65535]
if ($syscall ==
1073741999 )
action ERRNO(1);
# filter for syscall "umount2" (
1073741990 ) [priority: 65534]
if ($syscall ==
1073741990 )
if ($a1 & 0x00000001 == 1)
action ERRNO(13);
# default action
action ALLOW;
action KILL;
lxc-start ubuntu
20170520024159 .412 NOTICE lxc_start - start.c:start:1470 - Exec'ing "/sbin/init".
```
Signed-off-by: 0x0916 <w@laoqinren.net>
Stéphane Graber [Mon, 5 Jun 2017 23:52:46 +0000 (19:52 -0400)]
Merge pull request #1613 from brauner/2017-06-03/af_unix
abstract lxc_abstract_unix_{send,recv}_fd, bugfixes, and improvements
Christian Brauner [Sat, 27 May 2017 00:52:35 +0000 (02:52 +0200)]
lxc-opensuse: add Tumbleweed as supported release
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Stéphane Graber [Mon, 5 Jun 2017 23:30:00 +0000 (19:30 -0400)]
Merge pull request #1611 from brauner/2017-06-02/enforce_config_item_method_implementation
tests: enforce all methods for config items being implemented
Christian Brauner [Mon, 5 Jun 2017 21:41:59 +0000 (23:41 +0200)]
conf: fix bionic builds
bionic seems to lack a definition of __S_ISTYPE().
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>