]>
git.proxmox.com Git - mirror_lxc.git/log
Christian Brauner [Thu, 18 Feb 2021 15:26:16 +0000 (16:26 +0100)]
bpf: simplify bpf (device) program freeing
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Christian Brauner [Thu, 18 Feb 2021 15:21:04 +0000 (16:21 +0100)]
bpf: make bpf_program_cgroup_attach() static
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Christian Brauner [Thu, 18 Feb 2021 15:13:45 +0000 (16:13 +0100)]
bpf: prevent double-close
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Christian Brauner [Thu, 18 Feb 2021 14:52:52 +0000 (15:52 +0100)]
cgroups: use close_equal() and free_equal()
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Christian Brauner [Thu, 18 Feb 2021 14:52:35 +0000 (15:52 +0100)]
memory_utils: add close_equal() and free_equal()
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Christian Brauner [Thu, 18 Feb 2021 14:39:17 +0000 (15:39 +0100)]
lxccontainer: fix reboot logging
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Christian Brauner [Thu, 18 Feb 2021 13:50:03 +0000 (14:50 +0100)]
bpf: rework live device cgroup update
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Christian Brauner [Thu, 18 Feb 2021 13:42:39 +0000 (14:42 +0100)]
compiler: fix fallthrough attribute
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Christian Brauner [Thu, 18 Feb 2021 13:42:15 +0000 (14:42 +0100)]
bpf: fix return values in bpf_program_cgroup_attach()
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Christian Brauner [Thu, 18 Feb 2021 12:35:03 +0000 (13:35 +0100)]
bpf: let bpf_list_add_device() take the device list directly
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Christian Brauner [Thu, 18 Feb 2021 12:20:40 +0000 (13:20 +0100)]
bpf: add and use bpf_cgroup_devices_attach() helper
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Christian Brauner [Thu, 18 Feb 2021 11:41:57 +0000 (12:41 +0100)]
cgroups: remove compile-time bpf support detection
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Christian Brauner [Thu, 18 Feb 2021 11:29:50 +0000 (12:29 +0100)]
bpf: vendor bpf headers
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Christian Brauner [Thu, 18 Feb 2021 11:02:54 +0000 (12:02 +0100)]
bpf: handling missing defines
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Christian Brauner [Thu, 18 Feb 2021 10:45:41 +0000 (11:45 +0100)]
bpf: rework bpf_program_cgroup_detach()
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Christian Brauner [Thu, 18 Feb 2021 10:37:55 +0000 (11:37 +0100)]
commands: rework bpf devices BPF_F_REPLACE codepath
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Christian Brauner [Thu, 18 Feb 2021 10:37:28 +0000 (11:37 +0100)]
bpf: don't close invalid fd, simply swap
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Christian Brauner [Thu, 18 Feb 2021 10:36:32 +0000 (11:36 +0100)]
bpf: use __u32 not uint32_t
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Christian Brauner [Thu, 18 Feb 2021 10:23:30 +0000 (11:23 +0100)]
macro: add swap helper
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Christian Brauner [Thu, 18 Feb 2021 09:43:10 +0000 (10:43 +0100)]
commands: replace bpf program on update
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Christian Brauner [Thu, 18 Feb 2021 09:41:52 +0000 (10:41 +0100)]
commands: improve bpf device program management
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Christian Brauner [Thu, 18 Feb 2021 09:39:39 +0000 (10:39 +0100)]
cgroups: improve bpf device program management
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Christian Brauner [Thu, 18 Feb 2021 09:39:14 +0000 (10:39 +0100)]
bpf: add helpers for better bpf device program management
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Christian Brauner [Thu, 18 Feb 2021 09:24:10 +0000 (10:24 +0100)]
cgroups: improve bpf device program handling
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Christian Brauner [Thu, 18 Feb 2021 09:23:29 +0000 (10:23 +0100)]
cgroups: make device cgroups semantics clearer
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Christian Brauner [Thu, 18 Feb 2021 09:19:27 +0000 (10:19 +0100)]
bpf: enable helpers to let caller replace existing bpf programs
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Christian Brauner [Thu, 18 Feb 2021 09:18:56 +0000 (10:18 +0100)]
bpf: align struct initialization
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Christian Brauner [Thu, 18 Feb 2021 09:17:21 +0000 (10:17 +0100)]
bpf: use return macros
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Christian Brauner [Thu, 18 Feb 2021 09:15:39 +0000 (10:15 +0100)]
conf: introduce lxc_bpf_devices_rule_t type
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Christian Brauner [Wed, 17 Feb 2021 23:51:14 +0000 (00:51 +0100)]
bpf: use cgroup fd directly instead of paths
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Christian Brauner [Wed, 17 Feb 2021 23:38:47 +0000 (00:38 +0100)]
cgroups: kill monitor_full_path
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Christian Brauner [Wed, 17 Feb 2021 23:35:22 +0000 (00:35 +0100)]
cgroups: free correct path
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Christian Brauner [Wed, 17 Feb 2021 21:54:44 +0000 (22:54 +0100)]
utils: fix print_r() debugging helper
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Christian Brauner [Wed, 17 Feb 2021 21:48:40 +0000 (22:48 +0100)]
cgroups: fix error values
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Christian Brauner [Wed, 17 Feb 2021 17:49:20 +0000 (18:49 +0100)]
cgroups: don't overwrite type
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Christian Brauner [Wed, 17 Feb 2021 15:59:40 +0000 (16:59 +0100)]
cgroups: make it extremely obvious that we're transitioning from a flag to a type
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Stéphane Graber [Wed, 17 Feb 2021 17:30:57 +0000 (12:30 -0500)]
Merge pull request #3680 from brauner/2021-02-17/cgroups_2
cgroups: fourth batch of cgroup fixes
Christian Brauner [Wed, 17 Feb 2021 15:40:48 +0000 (16:40 +0100)]
cgroups: create controller directories if missing
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Christian Brauner [Wed, 17 Feb 2021 15:28:42 +0000 (16:28 +0100)]
cgroups: use non-flag based checking now that we switched all codepaths over
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Christian Brauner [Wed, 17 Feb 2021 15:24:50 +0000 (16:24 +0100)]
conf: use brackets to clarify check semantics
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Christian Brauner [Wed, 17 Feb 2021 15:23:51 +0000 (16:23 +0100)]
cgroups: validate that only a single cgroup mount type is set
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Christian Brauner [Wed, 17 Feb 2021 15:23:20 +0000 (16:23 +0100)]
cgroups: prevent cgroup mount type overwrite
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Christian Brauner [Wed, 17 Feb 2021 15:29:56 +0000 (16:29 +0100)]
cgroups: ensure that cgroup_root is initialized in legacy codepaths
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Christian Brauner [Wed, 17 Feb 2021 14:29:14 +0000 (15:29 +0100)]
cgroups: distinguish between tmpfs and unified based cgroup layouts file descriptors
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Christian Brauner [Wed, 17 Feb 2021 14:24:23 +0000 (15:24 +0100)]
cgroups: log intermediate cleanup
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Stéphane Graber [Wed, 17 Feb 2021 13:59:13 +0000 (08:59 -0500)]
Merge pull request #3679 from brauner/2021-02-17/cgroups
cgroups: third batch of cgroup fixes
Christian Brauner [Wed, 17 Feb 2021 13:36:10 +0000 (14:36 +0100)]
cgroups: prevent NULL pointer deref
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Christian Brauner [Wed, 17 Feb 2021 09:45:35 +0000 (10:45 +0100)]
cgroups: simplify mount opening
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Christian Brauner [Wed, 17 Feb 2021 09:35:58 +0000 (10:35 +0100)]
cgroups: ensure we prune the limit dir
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Christian Brauner [Wed, 17 Feb 2021 09:30:30 +0000 (10:30 +0100)]
cgroups: ensure we don't remove cgroups we didn't create
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Christian Brauner [Wed, 17 Feb 2021 09:08:27 +0000 (10:08 +0100)]
cgroups: don't move pivot cgroup under the monitor's cgroup
Otherwise we will never be able to destroy the monitor's cgroup.
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Christian Brauner [Wed, 17 Feb 2021 09:06:29 +0000 (10:06 +0100)]
cgroups: don't rely on absolute path
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Christian Brauner [Wed, 17 Feb 2021 09:04:58 +0000 (10:04 +0100)]
cgroups: be stricter when creating payloads
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Christian Brauner [Wed, 17 Feb 2021 09:03:42 +0000 (10:03 +0100)]
cgroups: rework cgroup tree creation
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Christian Brauner [Wed, 17 Feb 2021 08:28:46 +0000 (09:28 +0100)]
cgroups: ensure leaf cgroup is correctly pruned on creation failure
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Christian Brauner [Wed, 17 Feb 2021 08:14:33 +0000 (09:14 +0100)]
cgroups: rework cgroup tree removal on creation failure
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Christian Brauner [Wed, 17 Feb 2021 08:06:37 +0000 (09:06 +0100)]
cgroups: remove obsolote check
In the new layout we don't need to do this.
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Christian Brauner [Wed, 17 Feb 2021 08:04:03 +0000 (09:04 +0100)]
cgroups: reorder function arguments
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Stéphane Graber [Wed, 17 Feb 2021 01:27:03 +0000 (20:27 -0500)]
Merge pull request #3678 from brauner/2021-02-17/unified_controller_delegation
cgroups: rework unified cgroup controller delegation
Christian Brauner [Wed, 17 Feb 2021 00:43:51 +0000 (01:43 +0100)]
start: delegate than move into the target cgroup
This is a way more sensible model.
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Christian Brauner [Wed, 17 Feb 2021 00:20:00 +0000 (01:20 +0100)]
cgroups: rework unified controller delegation
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Christian Brauner [Wed, 17 Feb 2021 00:10:27 +0000 (01:10 +0100)]
cgroups: check correct variable
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Christian Brauner [Wed, 17 Feb 2021 00:05:09 +0000 (01:05 +0100)]
cgroups: s/openat()/open_at()/g
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Stéphane Graber [Wed, 17 Feb 2021 00:16:38 +0000 (19:16 -0500)]
Merge pull request #3677 from brauner/2021-02-17/cgroup_pruning
cgroups: fd-only cgroup tree pruning
Stéphane Graber [Wed, 17 Feb 2021 00:16:23 +0000 (19:16 -0500)]
Merge pull request #3676 from brauner/2021-02-16/fixes
cgroups: fixes
Christian Brauner [Tue, 16 Feb 2021 23:49:41 +0000 (00:49 +0100)]
cgroups: remove obsolote cgroup_tree handling
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Christian Brauner [Tue, 16 Feb 2021 22:05:23 +0000 (23:05 +0100)]
cgroups: fd-only cgroup tree pruning
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Christian Brauner [Tue, 16 Feb 2021 19:53:16 +0000 (20:53 +0100)]
file_utils: move dup_cloexec() to header
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Christian Brauner [Tue, 16 Feb 2021 22:18:45 +0000 (23:18 +0100)]
cgroups: prevent double-close
Fixes: Coverity 1473183
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Christian Brauner [Tue, 16 Feb 2021 22:06:40 +0000 (23:06 +0100)]
Stéphane Graber [Tue, 16 Feb 2021 21:37:42 +0000 (16:37 -0500)]
Merge pull request #3675 from brauner/2021-02-16/fixes
cgroups: second batch of cgroup fixes
Christian Brauner [Tue, 16 Feb 2021 17:43:28 +0000 (18:43 +0100)]
cgroups: rework how hierarchies are added
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Christian Brauner [Tue, 16 Feb 2021 17:38:26 +0000 (18:38 +0100)]
cgroups: fix fd leaks
They didn't really matter because we want to keep them around for as long as
the container lives anyway.
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Christian Brauner [Tue, 16 Feb 2021 16:56:31 +0000 (17:56 +0100)]
cgroups: allow "" base cgroup paths
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Christian Brauner [Tue, 16 Feb 2021 16:51:57 +0000 (17:51 +0100)]
string_utils: handle empty strings in must_make_path()
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Christian Brauner [Tue, 16 Feb 2021 16:47:27 +0000 (17:47 +0100)]
cgroups: improve logging
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Christian Brauner [Tue, 16 Feb 2021 16:08:15 +0000 (17:08 +0100)]
cgroups: rework legacy cpuset handling
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Christian Brauner [Tue, 16 Feb 2021 14:32:16 +0000 (15:32 +0100)]
cgroups: fd-based only cgroup creation
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Christian Brauner [Tue, 16 Feb 2021 12:36:13 +0000 (13:36 +0100)]
cgroups: stash fds for the controller mountpoint and base cgroup path
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Christian Brauner [Tue, 16 Feb 2021 12:28:48 +0000 (13:28 +0100)]
cgroups: fail when no cgroup hierarchies are found
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Christian Brauner [Tue, 16 Feb 2021 12:25:26 +0000 (13:25 +0100)]
cgroups: rework base cgroup parsing
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Christian Brauner [Tue, 16 Feb 2021 10:46:36 +0000 (11:46 +0100)]
cgroups: rework add_hierarchy()
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Christian Brauner [Tue, 16 Feb 2021 10:35:43 +0000 (11:35 +0100)]
cgroups: better document stashed file descriptors
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Christian Brauner [Tue, 16 Feb 2021 10:22:56 +0000 (11:22 +0100)]
cgroups: stash host's cgroupfs file descriptor
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Christian Brauner [Tue, 16 Feb 2021 09:55:38 +0000 (10:55 +0100)]
cgroups: s/cg_init()/__cgroup_init()/g
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Stéphane Graber [Mon, 15 Feb 2021 17:56:52 +0000 (12:56 -0500)]
Merge pull request #3674 from brauner/2021-02-15/nesting
cgroups: tighten cgroup config items
Christian Brauner [Mon, 15 Feb 2021 16:02:55 +0000 (17:02 +0100)]
confile: forbid absolute paths in config items that modify the cgroup layout
This is not a safety measure but merely is supposed to raise awareness that
these paths are always relative to the cgroup root as determined by
lxc.cgroup.relative.
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Christian Brauner [Mon, 15 Feb 2021 15:49:09 +0000 (16:49 +0100)]
confile: forbid walking upwards for confile items that modify cgroup layout
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Christian Brauner [Mon, 15 Feb 2021 16:53:58 +0000 (17:53 +0100)]
confile_utils: normalize paths in config items
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Christian Brauner [Mon, 15 Feb 2021 15:36:39 +0000 (16:36 +0100)]
confile: use set_config_path_item() for most cgroup layout modifiers
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Stéphane Graber [Mon, 15 Feb 2021 17:08:01 +0000 (12:08 -0500)]
Merge pull request #3673 from brauner/2021-02-15/nesting
cgroups: first batch of cgroup mounting fixes
Christian Brauner [Mon, 15 Feb 2021 14:07:02 +0000 (15:07 +0100)]
cgroupfs: rework cgroup2 mounting
We now explicitly refuse to mount cgroups on pure unified layouts when the
container is not running in a separate cgroup namespace. This is not a
regression since we simply always failed before anyway. I will likely fix this
very soon though. But there are bigger fish to fry currently.
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Christian Brauner [Mon, 15 Feb 2021 12:58:10 +0000 (13:58 +0100)]
cgroups: log early return
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Christian Brauner [Mon, 15 Feb 2021 12:54:51 +0000 (13:54 +0100)]
cgroups: s/__cg_mount_direct()/__cgroupfs_mount()/g
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Christian Brauner [Mon, 15 Feb 2021 12:54:10 +0000 (13:54 +0100)]
cgroups: strip LXC_AUTO_CGROUP_MIXED and LXC_AUTO_CGROUP_FULL_MIXED when cgroup namespaces are supported and used
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Christian Brauner [Mon, 15 Feb 2021 12:45:45 +0000 (13:45 +0100)]
cgroups: fix flag checking in legacy mount paths
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Christian Brauner [Mon, 15 Feb 2021 12:44:24 +0000 (13:44 +0100)]
cgroups: s/cg_mount_cgroup_full()/cgroupfs_bind_mount()/g
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Christian Brauner [Mon, 15 Feb 2021 12:42:40 +0000 (13:42 +0100)]
cgroups: s/cg_mount_in_cgroup_namespace()/cgroupfs_mount()/g
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Christian Brauner [Mon, 15 Feb 2021 12:41:02 +0000 (13:41 +0100)]
conf: remove wrong comment
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Christian Brauner [Mon, 15 Feb 2021 12:36:49 +0000 (13:36 +0100)]
cgroups: switch to flag-based checking
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>