]>
git.proxmox.com Git - mirror_lxc.git/log
Thomas Parrott [Sun, 8 Mar 2020 18:28:44 +0000 (18:28 +0000)]
network: Adds short sleep between veth setup and neighbour proxy add
There is an intermittent issue, experienced on at least Ubuntu 18.04 (5.3.0-40-generic) and Alpine 3.11 (5.4.12-1-virt) when using the router network interface type that causes the IP proxy neighbour entries on the host side of the veth pair to not be created.
The `ip neigh add proxy` command returns without an error, however by the time the network up hook has started the IP neighbour proxy entries are no longer there (if they ever were).
I've also tested this using netlink rather than the ip command to add and both are equally affected.
Adding a short sleep between setting up the veth pair and adding the proxy entries appears to fix it.
Signed-off-by: Thomas Parrott <thomas.parrott@canonical.com>
Stéphane Graber [Thu, 5 Mar 2020 10:36:38 +0000 (11:36 +0100)]
Merge pull request #3275 from brauner/2020-03-05/api_extension
utils: only move_fd() when fdopen() has been successful
Christian Brauner [Thu, 5 Mar 2020 10:14:24 +0000 (11:14 +0100)]
utils: only move_fd() when fdopen() has been successful
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Stéphane Graber [Thu, 5 Mar 2020 09:36:40 +0000 (10:36 +0100)]
Merge pull request #3274 from brauner/2020-03-05/api_extension
fixes
Christian Brauner [Thu, 5 Mar 2020 09:02:12 +0000 (10:02 +0100)]
api-extensions: document cgroup2_devices and cgroup2 api extensions
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Christian Brauner [Sat, 29 Feb 2020 02:35:04 +0000 (03:35 +0100)]
Merge pull request #3272 from ffontaine/master
src/lxc/raw_syscalls.c: fix sparc assembly
Fabrice Fontaine [Fri, 28 Feb 2020 16:35:42 +0000 (17:35 +0100)]
src/lxc/raw_syscalls.c: fix sparc assembly
Build of lxc 3.2.1 fails with ultrasparc on:
raw_syscalls.c: In function ‘lxc_raw_clone’:
raw_syscalls.c:66:3: error: invalid 'asm': invalid operand output code
asm volatile(
^~~
Issue has been added with commit
b52e8e68a61866da2af86e85905ec850f8a8b7fc which added %g1 instead of %%g1
Fixes:
- http://autobuild.buildroot.org/results/
17c2319850f02f24da6fbef9656c07f86fdc5a3a
Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Stéphane Graber [Fri, 28 Feb 2020 11:36:30 +0000 (12:36 +0100)]
Merge pull request #3271 from brauner/2020-02-28/support_cgroup_pattern_2
cgroups: honor lxc.cgroup.pattern if set explicitly II
Christian Brauner [Thu, 27 Feb 2020 22:02:31 +0000 (23:02 +0100)]
cgroups: honor lxc.cgroup.pattern if set explicitly II
Link: https://discuss.linuxcontainers.org/t/lxc-cgroup-pattern-is-not-being-honored
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Stéphane Graber [Fri, 28 Feb 2020 11:08:13 +0000 (12:08 +0100)]
Merge pull request #3270 from brauner/2020-02-27/support_cgroup_pattern
cgroups: honor lxc.cgroup.pattern if set explicitly
Christian Brauner [Thu, 27 Feb 2020 22:02:31 +0000 (23:02 +0100)]
cgroups: honor lxc.cgroup.pattern if set explicitly
Link: https://discuss.linuxcontainers.org/t/lxc-cgroup-pattern-is-not-being-honored
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Stéphane Graber [Tue, 25 Feb 2020 19:34:18 +0000 (20:34 +0100)]
Merge pull request #3268 from brauner/2020-02-25/cgroups
cgroups: remove unused method and cleanup cgroup_exit()
Christian Brauner [Tue, 25 Feb 2020 12:36:51 +0000 (13:36 +0100)]
cgroups: remove unused method and cleanup cgroup_exit()
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Stéphane Graber [Thu, 13 Feb 2020 00:10:31 +0000 (01:10 +0100)]
Merge pull request #3265 from brauner/2020-02-13/fix_setgroups
tree-wide: improve setgroups() dropping
Christian Brauner [Wed, 12 Feb 2020 23:16:15 +0000 (00:16 +0100)]
tree-wide: improve setgroups() dropping
Drop groups before we change to userns root.
Reported-by: Teddy Reed <teddy.reed@gmail.com>
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Christian Brauner [Mon, 10 Feb 2020 17:06:39 +0000 (18:06 +0100)]
Merge pull request #3264 from tych0/fix-leak
lxclock: fix a small memory leak
Tycho Andersen [Mon, 10 Feb 2020 15:14:33 +0000 (08:14 -0700)]
lxclock: fix a small memory leak
if (!name), we allocate an unnamed semaphore, but if we then fail to
allocate/create the lock, we don't free this semaphore, and we just leak
it.
Signed-off-by: Tycho Andersen <tycho@tycho.ws>
Christian Brauner [Wed, 5 Feb 2020 18:49:48 +0000 (19:49 +0100)]
Merge pull request #3261 from blenk92/fix-parse-config
container.conf: Fix parsing of config options:
Maximilian Blenk [Wed, 5 Feb 2020 18:25:53 +0000 (19:25 +0100)]
container.conf: Document that order is important in config_jump_table
Add a comment that documents that more specific options of a
namespace have to be added above more generic options in
config_jump_table.
Signed-off-by: Maximilian Blenk <Maximilian.Blenk@bmw.de>
Maximilian Blenk [Wed, 5 Feb 2020 18:19:05 +0000 (19:19 +0100)]
container.conf: Fix option ordering in config_jump_table
Currently lxc.selinux.context.keyring is placed after
lxc.selinux.context in config_jump_table. This entails that if
lxc.selinux.context.keyring is specified, lxc.selinux.context will be
matched to that option. This commit places the
lxc.selinux.context.keyring before lxc.selinux.context
Signed-off-by: Maximilian Blenk <Maximilian.Blenk@bmw.de>
Maximilian Blenk [Wed, 5 Feb 2020 18:17:51 +0000 (19:17 +0100)]
container.conf: Fix off by 2 in option parsing
This commit fixes a off by 2 in config option parsing
(due to missing parenthesis). The error occurs if for instance
lxc.net.0.type is parsed. In that case, the .0 is removed from the
string. However, due to the missing parenthesis, the null terminating
character is off by two which means the modified config option would
be lxc.net.typepe instead of lxc.net.type.
Signed-off-by: Maximilian Blenk <Maximilian.Blenk@bmw.de>
Christian Brauner [Fri, 31 Jan 2020 14:56:54 +0000 (15:56 +0100)]
Merge pull request #3260 from blenk92/add-keyring-option
Add keyring option
Maximilian Blenk [Wed, 29 Jan 2020 17:10:38 +0000 (18:10 +0100)]
doc: Add doc for keyring options
Signed-off-by: Maximilian Blenk <Maximilian.Blenk@bmw.de>
Maximilian Blenk [Thu, 30 Jan 2020 18:21:10 +0000 (19:21 +0100)]
container.conf: Add option to disable session keyring creation
lxc set's up a new session keyring for every container by default.
There might be valid use-cases where this is not wanted / needed
(e.g. systemd by default creates a new session keyring anyway).
Signed-off-by: Maximilian Blenk <Maximilian.Blenk@bmw.de>
Maximilian Blenk [Wed, 29 Jan 2020 16:09:50 +0000 (17:09 +0100)]
container.conf: Add option to set keyring SELinux context
lxc set's up a new session keyring for every container by default.
If executed on an SELinux enabled system, by default, the keyring
inherits the label of the creating process. If executed with the
currently available SELinux policy, this means that the keyring
is labeled with the lxc_t type. Applications inside the container,
however, might expect that the keyring is labeled with a certain
context (and will fail to access the keyring if it's not explicitly
allowed in the global policy). This patch introduces the config
option lxc.selinux.context.keyring which enables to specify the
label of the newly created keyring. That is, the keyring can be
labeled with the label expected by the started application.
Signed-off-by: Maximilian Blenk <Maximilian.Blenk@bmw.de>
Christian Brauner [Mon, 27 Jan 2020 13:11:12 +0000 (14:11 +0100)]
Merge pull request #3259 from chobostar/fix_default_cgroup_pattern
cgroups: fix default cgroup pattern
Kirill Petrov [Mon, 27 Jan 2020 08:51:36 +0000 (11:51 +0300)]
cgroups: fix default cgroup pattern
Signed-off-by: Kirill Petrov <yakutskkirill@mail.ru>
Stéphane Graber [Fri, 17 Jan 2020 13:18:10 +0000 (08:18 -0500)]
Merge pull request #3255 from brauner/2020-01-16/fix_monitor_hang
start: fix container killing logic
Christian Brauner [Thu, 16 Jan 2020 17:02:35 +0000 (18:02 +0100)]
start: fix container killing logic
We need to account for the case where pidfd's are not supported by the kernel
in question.
Closes: #3254
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Christian Brauner [Wed, 15 Jan 2020 10:15:13 +0000 (11:15 +0100)]
Merge pull request #3253 from tomponline/tp-network-mtu
network: Restore fixed MTU functionality
Thomas Parrott [Wed, 15 Jan 2020 09:33:31 +0000 (09:33 +0000)]
network: Restore fixed MTU functionality
If MTU setting is provided in network device config then always use it rather than inheriting from the link device.
Affected both bridge and router veth modes.
Signed-off-by: Thomas Parrott <thomas.parrott@canonical.com>
Stéphane Graber [Tue, 14 Jan 2020 14:58:33 +0000 (09:58 -0500)]
Merge pull request #3251 from brauner/master
test: increase timeout for api reboot tests
Christian Brauner [Tue, 14 Jan 2020 13:11:53 +0000 (14:11 +0100)]
Merge pull request #3250 from lifeng68/fix_lxc
cgroup.c: fix memory leak at cgroup init failed
Christian Brauner [Tue, 14 Jan 2020 12:50:45 +0000 (13:50 +0100)]
test: increase timeout for api reboot tests
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
LiFeng [Tue, 14 Jan 2020 09:17:13 +0000 (04:17 -0500)]
cgroup.c: fix memory leak at cgroup init failed
Signed-off-by: LiFeng <lifeng68@huawei.com>
Stéphane Graber [Fri, 10 Jan 2020 13:38:28 +0000 (08:38 -0500)]
Merge pull request #3248 from brauner/2020-01-05/veth_devices
network: improve veth device creation
Christian Brauner [Fri, 10 Jan 2020 11:30:02 +0000 (12:30 +0100)]
network: rework network device creation
This makes all the codepaths easier to follow and also moves and renames
devices in one single step.
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Christian Brauner [Thu, 9 Jan 2020 17:08:48 +0000 (18:08 +0100)]
network: fix network device removal
We can't delete by netdev->ifindex since that's the ifindex of the device in
the container, not on the host. The correct thing is done below.
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Christian Brauner [Thu, 9 Jan 2020 16:10:14 +0000 (17:10 +0100)]
tests: log api reboot test failures
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Christian Brauner [Thu, 9 Jan 2020 15:28:02 +0000 (16:28 +0100)]
network: fix typ and formatting in comment
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Christian Brauner [Thu, 9 Jan 2020 11:29:22 +0000 (12:29 +0100)]
network: improve veth device creation
This allows us to avoid having to move the network device. It also allows us to
work around a kernel bug that in combination with a recent change in systemd
244 causes uses of systemd-networkd to not get an ip address.
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Stéphane Graber [Thu, 9 Jan 2020 15:47:36 +0000 (10:47 -0500)]
Merge pull request #3249 from brauner/2020-01-09/bugfixes
handle kernel version <--> header incompatibility
Christian Brauner [Thu, 9 Jan 2020 11:25:30 +0000 (12:25 +0100)]
start: handle kernel header and kernel incompatability
We might e.g. be compiled in a container with old kernel headers. In this
scenario CLONE_PIDFD will work but pidfd_send_signal() might not be detected
because __NR_pidfd_send_signal is not defined because the kernel headers don't
match the kernel version.
This explains and fixes test-suite hangs on Jenkins I've recently debugged.
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Christian Brauner [Thu, 9 Jan 2020 11:28:54 +0000 (12:28 +0100)]
tests: timeout after 60 seconds
That should be more than enough to reboot.
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Christian Brauner [Thu, 9 Jan 2020 11:28:19 +0000 (12:28 +0100)]
mainloop: add missing \n
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Serge Hallyn [Wed, 8 Jan 2020 15:45:57 +0000 (09:45 -0600)]
Merge pull request #3241 from brauner/2019-12-25/remove_procfs_pidfd_support
start: remove procfs pidfd support
Stéphane Graber [Sat, 4 Jan 2020 19:11:50 +0000 (14:11 -0500)]
Merge pull request #3247 from Rachid-Koucha/patch-1
Suppress useless udhcpc directory
Rachid Koucha [Fri, 3 Jan 2020 09:48:41 +0000 (10:48 +0100)]
Suppress useless udhcpc directory
The udhcpc directory is created with "mkdir -p" at the place dynamically specified by "busybox udhcpc --help".
Signed-off-by: Rachid Koucha <rachid.koucha@gmail.com>
Christian Brauner [Fri, 27 Dec 2019 12:38:07 +0000 (13:38 +0100)]
Merge pull request #3244 from Rachid-Koucha/master
Adaptation to latest busybox
Christian Brauner [Fri, 27 Dec 2019 11:08:26 +0000 (12:08 +0100)]
Merge pull request #3243 from Rachid-Koucha/patch-1
Word repetition in comment
Rachid Koucha [Fri, 27 Dec 2019 07:49:00 +0000 (08:49 +0100)]
Adaptation to latest busybox
In busybox 1.30, the help of udhcpc for "-s" option changed:
--> busybox v1.27.2: -s,--script PROG Run PROG at DHCP events (default /usr/share/udhcpc/default.script)
--> busybox v1.30.1: -s PROG Run PROG at DHCP events (default /etc/udhcpc/default.script)
So, I changed the command line which extracts the script name to make it work for both versions
Signed-off-by: Rachid Koucha <rachid.koucha@gmail.com>
Christian Brauner [Wed, 25 Dec 2019 17:50:53 +0000 (18:50 +0100)]
start: remove procfs pidfd support
We'll only rely on proper anon-inode based pidfd support in the future.
There's no good reason to use the procfs fallback. All the fancy features we
might want to use are only available with anon-inode pidfds.
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Rachid Koucha [Thu, 26 Dec 2019 10:51:54 +0000 (11:51 +0100)]
Word repetition in comment
create_run_template(): Double "will mount" in a comment
Signed-off-by: Rachid Koucha <rachid.koucha@gmail.com>
Stéphane Graber [Wed, 25 Dec 2019 22:12:34 +0000 (17:12 -0500)]
Merge pull request #3238 from brauner/2019-12-23/travis
travis: enable -fsanitize=undefined
Christian Brauner [Mon, 23 Dec 2019 21:42:33 +0000 (22:42 +0100)]
Merge pull request #3239 from vikaig/fix-shebang
cmd: fix shebang
vikaig [Mon, 23 Dec 2019 21:31:53 +0000 (23:31 +0200)]
cmd: fix shebang
Signed-off-by: vikaig <vikaig99@gmail.com>
Christian Brauner [Mon, 23 Dec 2019 19:12:57 +0000 (20:12 +0100)]
travis: enable -fsanitize=undefined
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Christian Brauner [Mon, 23 Dec 2019 10:35:53 +0000 (11:35 +0100)]
Merge pull request #3235 from xinhua9569/master
fd: only add valid fd to mainloop
dongxinhua [Sat, 21 Dec 2019 09:44:40 +0000 (17:44 +0800)]
fd: only add valid fd to mainloop
Signed-off-by: dongxinhua <dongxinhua@huawei.com>
Christian Brauner [Tue, 17 Dec 2019 02:03:38 +0000 (03:03 +0100)]
Merge pull request #3233 from xinhua9569/master
seccomp: support s390 seccomp
Stéphane Graber [Tue, 17 Dec 2019 01:33:58 +0000 (20:33 -0500)]
Merge pull request #3232 from brauner/2019-12-17/cgroup2_api_extension
api_extensions: advertise cgroup2 support
dongxinhua [Tue, 17 Dec 2019 01:10:04 +0000 (09:10 +0800)]
seccomp: support s390 seccomp
Signed-off-by: dongxinhua <dongxinhua@huawei.com>
Christian Brauner [Mon, 16 Dec 2019 23:44:49 +0000 (00:44 +0100)]
api_extensions: advertise cgroup2 support
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Stéphane Graber [Thu, 12 Dec 2019 21:52:01 +0000 (16:52 -0500)]
Merge pull request #3229 from brauner/2019-12-12/cgroup_legacy_layout_regression
cgroups/cgfsng: do not prematurely close file descriptors
Christian Brauner [Thu, 12 Dec 2019 21:04:20 +0000 (22:04 +0100)]
cgroups/cgfsng: do not prematurely close file descriptors
When adding the new improved cgroup setup logic I didn't account for the fact
that we need the hierarchy fds up until chown. Add a dedicated cleanup method
to fix this:
lxc b1
20191212205052 .712 WARN cgfsng - cgroups/cgfsng.c:fchowmodat:1481 - Bad file descriptor - Failed to fchownat(-9, ,
1000000000 , 0, AT_EMPTY_PATH | AT_SYMLINK_NOFOLLOW )
lxc b1
20191212205052 .712 WARN cgfsng - cgroups/cgfsng.c:fchowmodat:1481 - Bad file descriptor - Failed to fchownat(-9, tasks,
1000000000 , 0, AT_EMPTY_PATH | AT_SYMLINK_NOFOLLOW )
lxc b1
20191212205052 .712 WARN cgfsng - cgroups/cgfsng.c:fchowmodat:1481 - Bad file descriptor - Failed to fchownat(-9, cgroup.procs,
1000000000 , 0, AT_EMPTY_PATH | AT_SYMLINK_NOFOLLOW )
lxc b1
20191212205052 .712 WARN cgfsng - cgroups/cgfsng.c:fchowmodat:1481 - Bad file descriptor - Failed to fchownat(-9, ,
1000000000 , 0, AT_EMPTY_PATH | AT_SYMLINK_NOFOLLOW )
lxc b1
20191212205052 .712 WARN cgfsng - cgroups/cgfsng.c:fchowmodat:1481 - Bad file descriptor - Failed to fchownat(-9, tasks,
1000000000 , 0, AT_EMPTY_PATH | AT_SYMLINK_NOFOLLOW )
lxc b1
20191212205052 .712 WARN cgfsng - cgroups/cgfsng.c:fchowmodat:1481 - Bad file descriptor - Failed to fchownat(-9, cgroup.procs,
1000000000 , 0, AT_EMPTY_PATH | AT_SYMLINK_NOFOLLOW )
lxc b1
20191212205052 .712 WARN cgfsng - cgroups/cgfsng.c:fchowmodat:1481 - Bad file descriptor - Failed to fchownat(-9, ,
1000000000 , 0, AT_EMPTY_PATH | AT_SYMLINK_NOFOLLOW )
lxc b1
20191212205052 .712 WARN cgfsng - cgroups/cgfsng.c:fchowmodat:1481 - Bad file descriptor - Failed to fchownat(-9, tasks,
1000000000 , 0, AT_EMPTY_PATH | AT_SYMLINK_NOFOLLOW )
lxc b1
20191212205052 .712 WARN cgfsng - cgroups/cgfsng.c:fchowmodat:1481 - Bad file descriptor - Failed to fchownat(-9, cgroup.procs,
1000000000 , 0, AT_EMPTY_PATH | AT_SYMLINK_NOFOLLOW )
lxc b1
20191212205052 .712 WARN cgfsng - cgroups/cgfsng.c:fchowmodat:1481 - Bad file descriptor - Failed to fchownat(-9, ,
1000000000 , 0, AT_EMPTY_PATH | AT_SYMLINK_NOFOLLOW )
lxc b1
20191212205052 .712 WARN cgfsng - cgroups/cgfsng.c:fchowmodat:1481 - Bad file descriptor - Failed to fchownat(-9, tasks,
1000000000 , 0, AT_EMPTY_PATH | AT_SYMLINK_NOFOLLOW )
lxc b1
20191212205052 .712 WARN cgfsng - cgroups/cgfsng.c:fchowmodat:1481 - Bad file descriptor - Failed to fchownat(-9, cgroup.procs,
1000000000 , 0, AT_EMPTY_PATH | AT_SYMLINK_NOFOLLOW )
lxc b1
20191212205052 .712 WARN cgfsng - cgroups/cgfsng.c:fchowmodat:1481 - Bad file descriptor - Failed to fchownat(-9, ,
1000000000 , 0, AT_EMPTY_PATH | AT_SYMLINK_NOFOLLOW )
lxc b1
20191212205052 .712 WARN cgfsng - cgroups/cgfsng.c:fchowmodat:1481 - Bad file descriptor - Failed to fchownat(-9, tasks,
1000000000 , 0, AT_EMPTY_PATH | AT_SYMLINK_NOFOLLOW )
lxc b1
20191212205052 .712 WARN cgfsng - cgroups/cgfsng.c:fchowmodat:1481 - Bad file descriptor - Failed to fchownat(-9, cgroup.procs,
1000000000 , 0, AT_EMPTY_PATH | AT_SYMLINK_NOFOLLOW )
lxc b1
20191212205052 .712 WARN cgfsng - cgroups/cgfsng.c:fchowmodat:1481 - Bad file descriptor - Failed to fchownat(-9, ,
1000000000 , 0, AT_EMPTY_PATH | AT_SYMLINK_NOFOLLOW )
lxc b1
20191212205052 .712 WARN cgfsng - cgroups/cgfsng.c:fchowmodat:1481 - Bad file descriptor - Failed to fchownat(-9, tasks,
1000000000 , 0, AT_EMPTY_PATH | AT_SYMLINK_NOFOLLOW )
lxc b1
20191212205052 .712 WARN cgfsng - cgroups/cgfsng.c:fchowmodat:1481 - Bad file descriptor - Failed to fchownat(-9, cgroup.procs,
1000000000 , 0, AT_EMPTY_PATH | AT_SYMLINK_NOFOLLOW )
lxc b1
20191212205052 .712 WARN cgfsng - cgroups/cgfsng.c:fchowmodat:1481 - Bad file descriptor - Failed to fchownat(-9, ,
1000000000 , 0, AT_EMPTY_PATH | AT_SYMLINK_NOFOLLOW )
lxc b1
20191212205052 .712 WARN cgfsng - cgroups/cgfsng.c:fchowmodat:1481 - Bad file descriptor - Failed to fchownat(-9, tasks,
1000000000 , 0, AT_EMPTY_PATH | AT_SYMLINK_NOFOLLOW )
lxc b1
20191212205052 .712 WARN cgfsng - cgroups/cgfsng.c:fchowmodat:1481 - Bad file descriptor - Failed to fchownat(-9, cgroup.procs,
1000000000 , 0, AT_EMPTY_PATH | AT_SYMLINK_NOFOLLOW )
lxc b1
20191212205052 .712 WARN cgfsng - cgroups/cgfsng.c:fchowmodat:1481 - Bad file descriptor - Failed to fchownat(-9, ,
1000000000 , 0, AT_EMPTY_PATH | AT_SYMLINK_NOFOLLOW )
lxc b1
20191212205052 .712 WARN cgfsng - cgroups/cgfsng.c:fchowmodat:1481 - Bad file descriptor - Failed to fchownat(-9, tasks,
1000000000 , 0, AT_EMPTY_PATH | AT_SYMLINK_NOFOLLOW )
lxc b1
20191212205052 .712 WARN cgfsng - cgroups/cgfsng.c:fchowmodat:1481 - Bad file descriptor - Failed to fchownat(-9, cgroup.procs,
1000000000 , 0, AT_EMPTY_PATH | AT_SYMLINK_NOFOLLOW )
lxc b1
20191212205052 .712 WARN cgfsng - cgroups/cgfsng.c:fchowmodat:1481 - Bad file descriptor - Failed to fchownat(-9, ,
1000000000 , 0, AT_EMPTY_PATH | AT_SYMLINK_NOFOLLOW )
lxc b1
20191212205052 .712 WARN cgfsng - cgroups/cgfsng.c:fchowmodat:1481 - Bad file descriptor - Failed to fchownat(-9, tasks,
1000000000 , 0, AT_EMPTY_PATH | AT_SYMLINK_NOFOLLOW )
lxc b1
20191212205052 .712 WARN cgfsng - cgroups/cgfsng.c:fchowmodat:1481 - Bad file descriptor - Failed to fchownat(-9, cgroup.procs,
1000000000 , 0, AT_EMPTY_PATH | AT_SYMLINK_NOFOLLOW )
lxc b1
20191212205052 .712 WARN cgfsng - cgroups/cgfsng.c:fchowmodat:1481 - Bad file descriptor - Failed to fchownat(-9, ,
1000000000 , 0, AT_EMPTY_PATH | AT_SYMLINK_NOFOLLOW )
lxc b1
20191212205052 .712 WARN cgfsng - cgroups/cgfsng.c:fchowmodat:1481 - Bad file descriptor - Failed to fchownat(-9, tasks,
1000000000 , 0, AT_EMPTY_PATH | AT_SYMLINK_NOFOLLOW )
lxc b1
20191212205052 .712 WARN cgfsng - cgroups/cgfsng.c:fchowmodat:1481 - Bad file descriptor - Failed to fchownat(-9, cgroup.procs,
1000000000 , 0, AT_EMPTY_PATH | AT_SYMLINK_NOFOLLOW )
lxc b1
20191212205052 .712 WARN cgfsng - cgroups/cgfsng.c:fchowmodat:1481 - Bad file descriptor - Failed to fchownat(-9, ,
1000000000 , 0, AT_EMPTY_PATH | AT_SYMLINK_NOFOLLOW )
lxc b1
20191212205052 .712 WARN cgfsng - cgroups/cgfsng.c:fchowmodat:1481 - Bad file descriptor - Failed to fchownat(-9, tasks,
1000000000 , 0, AT_EMPTY_PATH | AT_SYMLINK_NOFOLLOW )
lxc b1
20191212205052 .712 WARN cgfsng - cgroups/cgfsng.c:fchowmodat:1481 - Bad file descriptor - Failed to fchownat(-9, cgroup.procs,
1000000000 , 0, AT_EMPTY_PATH | AT_SYMLINK_NOFOLLOW )
lxc b1
20191212205052 .712 WARN cgfsng - cgroups/cgfsng.c:fchowmodat:1481 - Bad file descriptor - Failed to fchownat(-9, ,
1000000000 , 0, AT_EMPTY_PATH | AT_SYMLINK_NOFOLLOW )
lxc b1
20191212205052 .712 WARN cgfsng - cgroups/cgfsng.c:fchowmodat:1481 - Bad file descriptor - Failed to fchownat(-9, tasks,
1000000000 , 0, AT_EMPTY_PATH | AT_SYMLINK_NOFOLLOW )
lxc b1
20191212205052 .712 WARN cgfsng - cgroups/cgfsng.c:fchowmodat:1481 - Bad file descriptor - Failed to fchownat(-9, cgroup.procs,
1000000000 , 0, AT_EMPTY_PATH | AT_SYMLINK_NOFOLLOW )
Closes #3228.
Fixes: 1973b62aab41 ("cgroups/cgfsng: improve cgroup creation and removal")
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Stéphane Graber [Wed, 11 Dec 2019 13:59:36 +0000 (08:59 -0500)]
Merge pull request #3226 from brauner/cgroup_removal
cgroupfs: improve cgroup removal
Christian Brauner [Wed, 11 Dec 2019 06:37:36 +0000 (07:37 +0100)]
cgroups/cgfsng: improve cgroup creation and removal
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Stéphane Graber [Wed, 11 Dec 2019 02:46:06 +0000 (21:46 -0500)]
Merge pull request #3225 from brauner/cgroup_improvements
cgroups/cgfsng: rework legacy cpuset handling
Christian Brauner [Tue, 10 Dec 2019 20:00:59 +0000 (21:00 +0100)]
cgroups/cgfsng: rework cgroup removal
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Christian Brauner [Tue, 10 Dec 2019 17:15:30 +0000 (18:15 +0100)]
cgroups/cgfsng: rework legacy cpuset handling
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Christian Brauner [Tue, 10 Dec 2019 17:07:47 +0000 (18:07 +0100)]
cgroupfs/cgfsng: pass cgroup to cg_legacy_handle_cpuset_hierarchy() as const char *
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Stéphane Graber [Tue, 10 Dec 2019 14:51:02 +0000 (09:51 -0500)]
Merge pull request #3223 from brauner/flatten_cgroup_hierarchy
cgroups: flatten hierarchy
Christian Brauner [Tue, 10 Dec 2019 11:27:33 +0000 (12:27 +0100)]
cgroups: use explicit unsigned type for bitfield
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Christian Brauner [Mon, 9 Dec 2019 22:14:37 +0000 (23:14 +0100)]
cgroups: flatten hierarchy
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Stéphane Graber [Mon, 9 Dec 2019 15:37:53 +0000 (10:37 -0500)]
Merge pull request #3222 from brauner/security
file_utils: use O_NOCTTY | O_NOFOLLOW
Christian Brauner [Mon, 9 Dec 2019 10:20:29 +0000 (11:20 +0100)]
file_utils: use O_NOCTTY | O_NOFOLLOW
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Stéphane Graber [Sun, 8 Dec 2019 03:31:39 +0000 (22:31 -0500)]
Merge pull request #3218 from brauner/bpf_devices_devpath
cgroups/devices: enable devpath semantics for cgroup2 device controller
Christian Brauner [Sun, 8 Dec 2019 00:58:24 +0000 (01:58 +0100)]
cgroups/devices: enable devpath semantics for cgroup2 device controller
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Stéphane Graber [Sun, 8 Dec 2019 00:39:55 +0000 (19:39 -0500)]
Merge pull request #3217 from brauner/rework_cgroups
cgroups, logging: fixes and improvements
Christian Brauner [Sun, 8 Dec 2019 00:17:33 +0000 (01:17 +0100)]
cgroups/cgfsng: replace lxc_write_file()
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Christian Brauner [Sat, 7 Dec 2019 23:43:40 +0000 (00:43 +0100)]
cgroups/cgfsng: cgfsng_devices_activate()
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Christian Brauner [Sat, 7 Dec 2019 23:41:36 +0000 (00:41 +0100)]
cgroups/cgfsng: rework cgfsng_nrtasks()
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Christian Brauner [Sat, 7 Dec 2019 23:40:29 +0000 (00:40 +0100)]
cgroups/cgfsng: rework cgfsng_mount()
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Christian Brauner [Sat, 7 Dec 2019 23:38:16 +0000 (00:38 +0100)]
cgroups/cgfsng: rework cgfsng_chown()
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Christian Brauner [Sat, 7 Dec 2019 23:35:19 +0000 (00:35 +0100)]
cgroups/cgfsng: rework cgfsng_attach()
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Christian Brauner [Sat, 7 Dec 2019 23:33:24 +0000 (00:33 +0100)]
cgroups/cgfsng: rework cgfsng_setup_limits()
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Christian Brauner [Sat, 7 Dec 2019 23:27:22 +0000 (00:27 +0100)]
cgroups/cgfsng: rework cgfsng_setup_limits_legacy()
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Christian Brauner [Sat, 7 Dec 2019 23:24:20 +0000 (00:24 +0100)]
cgroups/cgfsng: rework cgfsng_{get,set}()
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Christian Brauner [Sat, 7 Dec 2019 23:20:02 +0000 (00:20 +0100)]
cgroups/cgfsng: rework cgfsng_unfreeze()
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Christian Brauner [Sat, 7 Dec 2019 23:18:52 +0000 (00:18 +0100)]
cgroups/cgfsng: rework cgfsng_get_hierarchies()
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Christian Brauner [Sat, 7 Dec 2019 23:17:58 +0000 (00:17 +0100)]
cgroups/cgfsng: rework cgfsng_num_hierarchies()
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Christian Brauner [Sat, 7 Dec 2019 23:16:59 +0000 (00:16 +0100)]
cgroups/cgfsng: rework cgfsng_escape()
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Christian Brauner [Sat, 7 Dec 2019 23:13:14 +0000 (00:13 +0100)]
cgroups/cgfsng: rework cgfsng_payload_enter()
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Christian Brauner [Sat, 7 Dec 2019 23:06:59 +0000 (00:06 +0100)]
cgroups/cgfsng: rework cgfsng_payload_create()
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Christian Brauner [Sat, 7 Dec 2019 22:47:16 +0000 (23:47 +0100)]
tree-wide: s/__unused/__lxc_unused/g
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Christian Brauner [Sat, 7 Dec 2019 21:19:20 +0000 (22:19 +0100)]
cgroups/cgfsng: rework cgroup attach
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Christian Brauner [Sat, 7 Dec 2019 21:12:00 +0000 (22:12 +0100)]
cgroups/cgfsng: don't dereference NULL-pointer
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Christian Brauner [Sat, 7 Dec 2019 21:04:04 +0000 (22:04 +0100)]
cgroups/cgfsng: log chown_cgroup_wrapper()
It's becoming more important on cgroup2 to properly delegate cgroups.
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Christian Brauner [Sat, 7 Dec 2019 20:51:58 +0000 (21:51 +0100)]
cgroups/cgfsng: rework cgroup2 unprivileged delegation
We accidently checked files to delegate for privileged container and not for
unprivileged containers in the pure unified case. Fix that and clean up the
delegation file parsing.
Closes #3206.
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Christian Brauner [Sat, 7 Dec 2019 17:17:48 +0000 (18:17 +0100)]
cgroups/cgfsng: rework cgfsng_{monitor,payload}_delegate_controllers()
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>