]>
git.proxmox.com Git - mirror_lxc.git/log
Christian Brauner [Tue, 11 Jun 2019 21:36:56 +0000 (23:36 +0200)]
seccomp: s/HAVE_DECL_SECCOMP_NOTIF_GET_FD/HAVE_DECL_SECCOMP_NOTIFY_FD/g
Align with upstream libseccomp.
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Christian Brauner [Tue, 11 Jun 2019 21:34:33 +0000 (23:34 +0200)]
seccomp: /sseccomp_notif_free/seccomp_notify_free/g
Align with upstream libseccomp.
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Christian Brauner [Tue, 11 Jun 2019 21:33:22 +0000 (23:33 +0200)]
seccomp: s/seccomp_notif_alloc/seccomp_notify_alloc/g
Align with upstream libseccomp.
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Christian Brauner [Tue, 11 Jun 2019 21:32:19 +0000 (23:32 +0200)]
seccomp: s/seccomp_notif_id_valid/seccomp_notify_id_valid/g
Align with upstream libseccomp.
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Christian Brauner [Tue, 11 Jun 2019 21:31:12 +0000 (23:31 +0200)]
seccomp: s/seccomp_notif_send_resp/seccomp_notify_respond/g
Align with upstream libseccomp.
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Christian Brauner [Tue, 11 Jun 2019 21:29:39 +0000 (23:29 +0200)]
seccomp: s/seccomp_notif_receive/seccomp_notify_receive/g
Align with upstream libseccomp.
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Christian Brauner [Tue, 11 Jun 2019 21:27:33 +0000 (23:27 +0200)]
seccomp: s/seccomp_notif_get_fd/seccomp_notify_fd/g
Align with upstream libseccomp.
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Christian Brauner [Tue, 11 Jun 2019 21:25:44 +0000 (23:25 +0200)]
seccomp: s/SCMP_ACT_USER_NOTIF/SCMP_ACT_NOTIFY/g
Align with upstream libseccomp.
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Stéphane Graber [Fri, 17 May 2019 07:10:47 +0000 (09:10 +0200)]
Merge pull request #3010 from brauner/2019-05-17/bugfixes
lxccontainer: cleanup attach functions
Christian Brauner [Fri, 17 May 2019 05:50:45 +0000 (07:50 +0200)]
lxccontainer: cleanup attach functions
Specifically, refloat function arguments and remove useless comments.
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Stéphane Graber [Thu, 16 May 2019 17:33:41 +0000 (19:33 +0200)]
Merge pull request #3009 from brauner/2019-05-16/rework_attach
attach: do not reload container
Christian Brauner [Thu, 16 May 2019 13:29:41 +0000 (15:29 +0200)]
attach: do not reload container
Let lxc_attach() reuse the already initialized container.
Closes https://github.com/lxc/lxd/issues/5755.
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Christian Brauner [Thu, 16 May 2019 08:11:42 +0000 (10:11 +0200)]
Merge pull request #3006 from tomponline/tp-phys-downhook
network: Fixes bug that stopped down hook from running for phys netdevs
Thomas Parrott [Wed, 15 May 2019 16:09:47 +0000 (17:09 +0100)]
network: Fixes bug that stopped down hook from running for phys netdevs
Signed-off-by: Thomas Parrott <thomas.parrott@canonical.com>
Christian Brauner [Wed, 15 May 2019 15:40:52 +0000 (17:40 +0200)]
Merge pull request #3005 from tomponline/tp-phys-ns-restore
network: move phys netdevs back to monitor's net ns rather than pid 1's
Thomas Parrott [Wed, 15 May 2019 14:54:12 +0000 (15:54 +0100)]
network: move phys netdevs back to monitor's net ns rather than pid 1's
Updates lxc_restore_phys_nics_to_netns() to move phys netdevs back to the monitor's network namespace rather than the previously hardcoded PID 1 net ns.
This is to fix instances where LXC is started inside a net ns different from PID 1 and physical devices are moved back to a different net ns when the container is shutdown than the net ns than where the container was started from.
Signed-off-by: Thomas Parrott <thomas.parrott@canonical.com>
Stéphane Graber [Wed, 15 May 2019 14:19:19 +0000 (16:19 +0200)]
Merge pull request #3004 from brauner/master
configure: handle checks when cross-compiling
Christian Brauner [Wed, 15 May 2019 13:44:36 +0000 (15:44 +0200)]
configure: handle checks when cross-compiling
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Christian Brauner [Mon, 13 May 2019 13:57:29 +0000 (15:57 +0200)]
Merge pull request #3001 from Rachid-Koucha/patch-11
Use %m instead of strerror() when available
Rachid Koucha [Mon, 13 May 2019 12:57:02 +0000 (14:57 +0200)]
Error prone semicolon
Suppressed error prone semicolon in SYSTRACE() macro.
Signed-off-by: Rachid Koucha <rachid.koucha@gmail.com>
Rachid Koucha [Mon, 13 May 2019 11:21:14 +0000 (13:21 +0200)]
Use %m instead of strerror() when available
Use %m under HAVE_M_FORMAT instead of strerror()
Signed-off-by: Rachid Koucha <rachid.koucha@gmail.com>
Christian Brauner [Mon, 13 May 2019 11:19:55 +0000 (13:19 +0200)]
Merge pull request #2999 from rikardfalkeborn/fix-realloc-memleak-proctitle
initutils: Fix memleak on realloc failure
Christian Brauner [Mon, 13 May 2019 11:19:22 +0000 (13:19 +0200)]
Merge pull request #2998 from rikardfalkeborn/fix-returning-non-bool
Fix returning -1 in functions with return type bool
Christian Brauner [Mon, 13 May 2019 11:18:54 +0000 (13:18 +0200)]
Merge pull request #3000 from Rachid-Koucha/patch-11
Config: check for %m availability
Rachid Koucha [Mon, 13 May 2019 11:13:18 +0000 (13:13 +0200)]
Config: check for %m availability
GLIBC supports %m to avoid calling strerror(). Using it saves some code space.
==> This check will define HAVE_M_FORMAT to be use wherever possible (e.g. log.h)
Signed-off-by: Rachid Koucha <rachid.koucha@gmail.com>
Rikard Falkeborn [Sun, 12 May 2019 00:22:15 +0000 (02:22 +0200)]
initutils: Fix memleak on realloc failure
Signed-off-by: Rikard Falkeborn <rikard.falkeborn@gmail.com>
Rikard Falkeborn [Sat, 11 May 2019 23:47:56 +0000 (01:47 +0200)]
zfs: Fix return value on zfs_snapshot error
Returning -1 in a function with return type bool is the same as
returning true. Change to return false to indicate error properly.
Detected with cppcheck.
Signed-off-by: Rikard Falkeborn <rikard.falkeborn@gmail.com>
Rikard Falkeborn [Sat, 11 May 2019 23:46:27 +0000 (01:46 +0200)]
lvm: Fix return value if lvm_create_clone fails
Returning -1 in a function with return type bool is the same as
returning true. Change to return false to indicate error properly.
Detected with cppcheck.
Signed-off-by: Rikard Falkeborn <rikard.falkeborn@gmail.com>
Rikard Falkeborn [Sat, 11 May 2019 23:39:51 +0000 (01:39 +0200)]
criu: Remove unnecessary return after _exit()
Since _exit() will terminate, the return statement is dead code. Also,
returning -1 from a function with bool as return type is confusing.
Detected with cppcheck.
Signed-off-by: Rikard Falkeborn <rikard.falkeborn@gmail.com>
Christian Brauner [Fri, 10 May 2019 21:47:28 +0000 (23:47 +0200)]
Merge pull request #2997 from rst0git/criu-v-option
criu: Use -v4 instead of -vvvvvv
Radostin Stoyanov [Fri, 10 May 2019 21:25:54 +0000 (22:25 +0100)]
criu: Use -v4 instead of -vvvvvv
CRIU has only 4 levels of verbosity (errors, warnings, info, debug).
Thus, using `-v4` is more appropriate.
https://criu.org/Logging
Signed-off-by: Radostin Stoyanov <rstoyanov1@gmail.com>
Christian Brauner [Fri, 10 May 2019 19:35:56 +0000 (21:35 +0200)]
Merge pull request #2993 from Rachid-Koucha/patch-9
New --bbpath option and unecessary --rootfs checks
Rachid Koucha [Fri, 10 May 2019 19:28:35 +0000 (21:28 +0200)]
Option --busybox-path instead of --bbpath
As suggested during the review.
Signed-off-by: Rachid Koucha <rachid.koucha@gmail.com>
Christian Brauner [Fri, 10 May 2019 19:20:20 +0000 (21:20 +0200)]
Merge pull request #2996 from brauner/Rachid-Koucha-patch-10
lxccontainer: do not display if missing privileges
Rachid Koucha [Fri, 10 May 2019 16:56:12 +0000 (18:56 +0200)]
lxccontainer: do not display if missing privileges
lxc-ls without root privileges on privileged containers should not display
information. In lxc_container_new(), ongoing_create()'s result is not checked
for all possible returned values. Hence, an unprivileged user can send command
messages to the container's monitor. For example:
$ lxc-ls -P /.../tests -f
NAME STATE AUTOSTART GROUPS IPV4 IPV6 UNPRIVILEGED
ctr - 0 - - - false
$ sudo lxc-ls -P /.../tests -f
NAME STATE AUTOSTART GROUPS IPV4 IPV6 UNPRIVILEGED
ctr RUNNING 0 - 10.0.3.51 - false
After this change:
$ lxc-ls -P /.../tests -f <-------- No more display without root privileges
$ sudo lxc-ls -P /.../tests -f
NAME STATE AUTOSTART GROUPS IPV4 IPV6 UNPRIVILEGED
ctr RUNNING 0 - 10.0.3.37 - false
$
Signed-off-by: Rachid Koucha <rachid.koucha@gmail.com>
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Rachid Koucha [Fri, 10 May 2019 15:01:13 +0000 (17:01 +0200)]
New --bbpath option and unecessary --rootfs checks
. Add the "--bbpath" option to pass an alternate busybox pathname instead of the one found from ${PATH}.
. Take this opportunity to add some formatting in the usage display
. As a try is done to pick rootfs from the config file and set it to ${path}/rootfs, it is unnecessary to make it mandatory
Signed-off-by: Rachid Koucha <rachid.koucha@gmail.com>
Stéphane Graber [Fri, 10 May 2019 12:36:56 +0000 (08:36 -0400)]
Merge pull request #2992 from brauner/2019-05-10/coding_style_update
coding style: update
Christian Brauner [Fri, 10 May 2019 11:15:25 +0000 (13:15 +0200)]
coding style: update
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Christian Brauner [Fri, 10 May 2019 07:30:35 +0000 (09:30 +0200)]
Merge pull request #2985 from tomponline/tp-mtu
network: Adds mtu support for phys and macvlan types
Christian Brauner [Fri, 10 May 2019 06:48:59 +0000 (08:48 +0200)]
Merge pull request #2989 from Rachid-Koucha/patch-8
Redirect error messages to stderr
Rachid Koucha [Fri, 10 May 2019 05:39:03 +0000 (07:39 +0200)]
Redirect error messages to stderr
Some error messages were not redirected to stderr.
Moreover, do "exit 0" instead of "exit 1" when "help" option is passed.
Signed-off-by: Rachid Koucha <rachid.koucha@gmail.com>
Stéphane Graber [Thu, 9 May 2019 19:19:58 +0000 (15:19 -0400)]
Merge pull request #2986 from brauner/2019-05-09/clone_pidfd
start: use CLONE_PIDFD
Christian Brauner [Thu, 9 May 2019 17:40:23 +0000 (19:40 +0200)]
start: use CLONE_PIDFD
Use CLONE_PIDFD when possible.
Note the clone() syscall ignores unknown flags which is usually a design
mistake. However, for us this bug is a feature since we can just pass the flag
along and see whether the kernel has given us a pidfd.
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Thomas Parrott [Thu, 9 May 2019 15:47:42 +0000 (16:47 +0100)]
api: Adds the network_phys_macvlan_mtu extension
This will allow LXD to check for custom MTU support for phys and macvlan devices.
Signed-off-by: Thomas Parrott <thomas.parrott@canonical.com>
Thomas Parrott [Thu, 9 May 2019 15:40:08 +0000 (16:40 +0100)]
network: Restores phys device MTU on container shutdown
The phys devices will now have their original MTUs recorded at start and restored at shutdown.
This is to protect the original phys device from having any container level MTU customisation being applied to the device once it is restored to the host.
Signed-off-by: Thomas Parrott <thomas.parrott@canonical.com>
Christian Brauner [Thu, 9 May 2019 15:09:51 +0000 (17:09 +0200)]
namespace: support CLONE_PIDFD with lxc_clone()
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Thomas Parrott [Thu, 9 May 2019 14:34:20 +0000 (15:34 +0100)]
network: Adds mtu support for phys and macvlan types
Signed-off-by: Thomas Parrott <thomas.parrott@canonical.com>
Stéphane Graber [Thu, 9 May 2019 13:37:51 +0000 (09:37 -0400)]
Merge pull request #2984 from brauner/2019-05-09/clone_pidfd
clone: add infrastructure for CLONE_PIDFD
Christian Brauner [Thu, 9 May 2019 13:01:27 +0000 (15:01 +0200)]
clone: add infrastructure for CLONE_PIDFD
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=
eac7078a0fff1e72cf2b641721e3f55ec7e5e21e
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Christian Brauner [Thu, 9 May 2019 13:00:32 +0000 (15:00 +0200)]
raw_syscalls: simplify assembly
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Co-developed-by: David Howells <dhowells@redhat.com>
Signed-off-by: David Howells <dhowells@redhat.com>
Stéphane Graber [Thu, 9 May 2019 12:47:34 +0000 (08:47 -0400)]
Merge pull request #2906 from brauner/2019-03-12/namespace_switching
utils: improve switch_to_ns()
Christian Brauner [Tue, 12 Mar 2019 16:51:50 +0000 (17:51 +0100)]
utils: improve switch_to_ns()
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Christian Brauner [Thu, 9 May 2019 09:09:45 +0000 (11:09 +0200)]
Merge pull request #2983 from tenforward/japanese
Update Japanese lxc.container.conf(5)
KATOH Yasufumi [Thu, 9 May 2019 06:24:18 +0000 (15:24 +0900)]
doc: Fix and improve Japanese translation
Signed-off-by: KATOH Yasufumi <karma@jazz.email.ne.jp>
Reviewed-by: Hiroaki Nakamura <hnakamur@gmail.com>
KATOH Yasufumi [Wed, 8 May 2019 12:42:16 +0000 (21:42 +0900)]
doc: Update Japanese lxc.container.conf(5)
This is the translation for the following description:
- lxc.seccomp.notify.proxy (commit
8a64375 )
- host side veth device static routes (commit
d4a7da4 )
- IPVLAN (commit
c9f5238 )
- Layer 2 proxy mode (commit
6509154 )
- gateway device route mode (commit
a2f9a67 )
and fix typo in English man page.
Signed-off-by: KATOH Yasufumi <karma@jazz.email.ne.jp>
Christian Brauner [Tue, 7 May 2019 14:14:51 +0000 (16:14 +0200)]
Merge pull request #2982 from Rachid-Koucha/patch-5
Devices created in rootfs instead of rootfs/dev
Rachid Koucha [Tue, 7 May 2019 14:03:02 +0000 (16:03 +0200)]
Devices created in rootfs instead of rootfs/dev
Added /dev in the mknod commands.
Signed-off-by: Rachid Koucha <rachid.koucha@gmail.com>
Christian Brauner [Tue, 7 May 2019 13:50:43 +0000 (15:50 +0200)]
Merge pull request #2981 from tomponline/tp-veth-gateway
network: Re-works veth gateway logic
tomponline [Tue, 7 May 2019 13:23:24 +0000 (14:23 +0100)]
network: Re-works veth gateway logic
Handles more errors and gives better error messages.
Signed-off-by: tomponline <thomas.parrott@canonical.com>
Christian Brauner [Tue, 7 May 2019 12:03:52 +0000 (14:03 +0200)]
Merge pull request #2979 from tomponline/tp-vlan-mtu
network: Makes vlan network interfaces set mtu before upscript called
Christian Brauner [Tue, 7 May 2019 11:37:38 +0000 (13:37 +0200)]
Merge pull request #2978 from tomponline/tp-ipvlan-mtu
network: Adds custom mtu support for ipvlan interfaces
tomponline [Tue, 7 May 2019 11:34:34 +0000 (12:34 +0100)]
network: Makes vlan network interfaces set mtu before upscript called
This is consistent with veth and ipvlan types.
Also makes the debug message for success occur after up script has run.
Also makes device clean up on error more thorough and consistent.
Signed-off-by: tomponline <thomas.parrott@canonical.com>
tomponline [Tue, 7 May 2019 11:13:46 +0000 (12:13 +0100)]
network: Adds custom mtu support for ipvlan interfaces
Signed-off-by: tomponline <thomas.parrott@canonical.com>
Stéphane Graber [Mon, 6 May 2019 19:10:20 +0000 (15:10 -0400)]
Merge pull request #2976 from brauner/2019-05-06/bugfixes
seccomp: document path calculation
Stéphane Graber [Mon, 6 May 2019 18:36:50 +0000 (14:36 -0400)]
Merge pull request #2977 from brauner/2019-05-06/pidfd_send_signal
raw_syscalls: add initial support for pidfd_send_signal()
Christian Brauner [Mon, 6 May 2019 08:49:31 +0000 (10:49 +0200)]
raw_syscalls: add initial support for pidfd_send_signal()
Well, I added this syscall so we better use it. :)
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Christian Brauner [Mon, 6 May 2019 07:39:40 +0000 (09:39 +0200)]
seccomp: document path calculation
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Stéphane Graber [Sun, 5 May 2019 04:20:06 +0000 (00:20 -0400)]
Merge pull request #2974 from brauner/master
tree-wide: make socket SOCK_CLOEXEC
Stéphane Graber [Sun, 5 May 2019 04:19:51 +0000 (00:19 -0400)]
Merge pull request #2975 from brauner/2019-05-04/returns_twice
compiler: add __returns_twice attribute
Christian Brauner [Sat, 4 May 2019 11:35:51 +0000 (13:35 +0200)]
compiler: add __returns_twice attribute
The returns_twice attribute tells the compiler that a function may return more
than one time. The compiler will ensure that all registers are dead before
calling such a function and will emit a warning about the variables that may be
clobbered after the second return from the function. Examples of such functions
are setjmp and vfork. The longjmp-like counterpart of such function, if any,
might need to be marked with the noreturn attribute.
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Christian Brauner [Sat, 4 May 2019 10:56:45 +0000 (12:56 +0200)]
Merge pull request #2973 from tomponline/tp-gw-dev
network: Adds gateway device route mode
Christian Brauner [Fri, 3 May 2019 19:09:37 +0000 (21:09 +0200)]
Merge pull request #2968 from tomponline/tp-ipvlan-l2proxy
network: Static routes for IPVLAN with L2PROXY
tomponline [Wed, 1 May 2019 16:59:23 +0000 (17:59 +0100)]
network: Adds ipvlan static routes for l2proxy mode
Signed-off-by: tomponline <thomas.parrott@canonical.com>
Christian Brauner [Fri, 3 May 2019 18:35:02 +0000 (20:35 +0200)]
tree-wide: make socket SOCK_CLOEXEC
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
tomponline [Fri, 3 May 2019 09:21:45 +0000 (10:21 +0100)]
network: Adds gateway device route mode
Adds ability to specify "dev" as the gateway value, which will cause a device route to be set as default gateway.
Signed-off-by: tomponline <thomas.parrott@canonical.com>
Christian Brauner [Fri, 3 May 2019 10:36:00 +0000 (12:36 +0200)]
Merge pull request #2964 from tomponline/tp-l2proxy
network: Adds layer 2 (ARP/NDP) proxy mode
Stéphane Graber [Thu, 2 May 2019 20:56:10 +0000 (16:56 -0400)]
Merge pull request #2972 from brauner/2019-05-02/seccomp_notify_mem_fd
seccomp: send process memory fd
Christian Brauner [Thu, 2 May 2019 20:55:51 +0000 (22:55 +0200)]
Merge pull request #2971 from hallyn/2019-05-01/nsshare.2
namespaces: allow a pathname to a nsfd for namespace to share
Christian Brauner [Thu, 2 May 2019 15:06:00 +0000 (17:06 +0200)]
seccomp: send process memory fd
There's an inherent race when reading a process's memory. The easiest way is to
have liblxc get an fd and check that the race was one, send it to the caller
(They are free to ignore it if they don't use recvmsg()).
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Serge Hallyn [Thu, 2 May 2019 01:17:23 +0000 (18:17 -0700)]
namespaces: allow a pathname to a nsfd for namespace to share
Signed-off-by: Serge Hallyn <shallyn@cisco.com>
tomponline [Tue, 30 Apr 2019 13:25:27 +0000 (14:25 +0100)]
network: Adds layer 2 (ARP/NDP) proxy mode
Adds the lxc.net.[i].l2proxy flag that can be either 0 or 1.
Defaults to 0.
This, when used with lxc.net.[i].link, will add IP neighbour proxy entries on the linked device
for any IPv4 and IPv6 addresses on the container's network device.
Additionally, for IPv6 addresses it will check the following sysctl values and fail with an error if not set:
net.ipv6.conf.[link].proxy_ndp=1
net.ipv6.conf.[link].forwarding=1
Signed-off-by: tomponline <thomas.parrott@canonical.com>
Stéphane Graber [Wed, 1 May 2019 16:44:48 +0000 (12:44 -0400)]
Merge pull request #2969 from brauner/2019-05-01/seccomp_fixes
seccomp: ensure fields are set to 0
Christian Brauner [Wed, 1 May 2019 16:35:58 +0000 (18:35 +0200)]
seccomp: ensure fields are set to 0
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Christian Brauner [Wed, 1 May 2019 16:24:56 +0000 (18:24 +0200)]
Merge pull request #2950 from tomponline/tp-ipvlan
network: Adds IPVLAN support
tomponline [Fri, 26 Apr 2019 10:26:45 +0000 (11:26 +0100)]
network: Adds IPVLAN support
Example usage:
lxc.net[i].type=ipvlan
lxc.net[i].ipvlan.mode=[l3|l3s|l2] (defaults to l3)
lxc.net[i].ipvlan.flags=[bridge|private|vepa] (defaults to bridge)
lxc.net[i].link=eth0
lxc.net[i].flags=up
Signed-off-by: tomponline <thomas.parrott@canonical.com>
Stéphane Graber [Wed, 1 May 2019 03:16:46 +0000 (23:16 -0400)]
Merge pull request #2967 from brauner/2019-05-01/seccomp_notifier_api_removal
seccomp: remove alignment requirements
Christian Brauner [Wed, 1 May 2019 00:04:02 +0000 (02:04 +0200)]
seccomp: remove alignment requirements
since apparently there are insane programming languages out there that just
silently remove packed members in structs.
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Stéphane Graber [Tue, 30 Apr 2019 23:42:33 +0000 (19:42 -0400)]
Merge pull request #2966 from brauner/2019-05-01/seccomp_notifier_api_removal
seccomp: don't commit to an api just yet
Christian Brauner [Tue, 30 Apr 2019 23:17:49 +0000 (01:17 +0200)]
seccomp: don't commit to an api just yet
I'm not sure that I want to be married (to this layout) just yet.
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Stéphane Graber [Tue, 30 Apr 2019 22:53:21 +0000 (18:53 -0400)]
Merge pull request #2965 from brauner/2019-05-01/seccomp_notifier_fixes
seccomp: notifier fixes
Christian Brauner [Tue, 30 Apr 2019 22:36:41 +0000 (00:36 +0200)]
seccomp: notifier fixes
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Christian Brauner [Tue, 30 Apr 2019 09:46:24 +0000 (11:46 +0200)]
Merge pull request #2961 from tomponline/tp-static-net-funcs
network: Makes some routing functions static
tomponline [Tue, 30 Apr 2019 09:30:58 +0000 (10:30 +0100)]
network: Makes some routing functions static
The following functions can be made static for consistency:
lxc_ipv4_dest_add
lxc_ipv6_dest_add
lxc_ip_route_dest_add (renamed)
Signed-off-by: tomponline <thomas.parrott@canonical.com>
Christian Brauner [Tue, 30 Apr 2019 09:17:40 +0000 (11:17 +0200)]
Merge pull request #2960 from tomponline/tp-seccomp-apiext-docs
docs: Adds missing doc entries for seccomp related API extensions
tomponline [Tue, 30 Apr 2019 09:14:55 +0000 (10:14 +0100)]
docs: Adds missing doc entries for seccomp related API extensions
Signed-off-by: tomponline <thomas.parrott@canonical.com>
Christian Brauner [Mon, 29 Apr 2019 15:15:38 +0000 (17:15 +0200)]
Merge pull request #2949 from tomponline/tp-veth-routes
network: Adds veth static routes feature
Christian Brauner [Mon, 29 Apr 2019 14:17:42 +0000 (16:17 +0200)]
Merge pull request #2957 from tomponline/tp-macvlan-mode
network: Fixes bug in macvlan mode selection
tomponline [Mon, 29 Apr 2019 14:11:17 +0000 (15:11 +0100)]
network: Fixes bug in macvlan mode selection
Signed-off-by: tomponline <thomas.parrott@canonical.com>
Stéphane Graber [Mon, 29 Apr 2019 13:47:29 +0000 (09:47 -0400)]
Merge pull request #2956 from brauner/2019-04-29/seccomp_trap_cleanup
seccomp: cleanup
Christian Brauner [Mon, 29 Apr 2019 08:16:01 +0000 (10:16 +0200)]
seccomp: cleanup
Simplify and cleanup some of the seccomp code. This mainly focuses on removing
the open coding of various seccomp settings all over the code place in favor of
centralized helpers.
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>