mirror_lxc.git
7 days agoMerge pull request #3089 from Rachid-Koucha/patch-2 master
Christian Brauner [Thu, 11 Jul 2019 07:57:34 +0000 (09:57 +0200)]
Merge pull request #3089 from Rachid-Koucha/patch-2

Typo fix

7 days agoTypo fix
Rachid Koucha [Thu, 11 Jul 2019 07:42:05 +0000 (09:42 +0200)]
Typo fix

Fixed a typo in error message

Signed-off-by: Rachid Koucha <rachid.koucha@gmail.com>
7 days agoMerge pull request #3088 from tenforward/japanese
Christian Brauner [Thu, 11 Jul 2019 06:28:11 +0000 (08:28 +0200)]
Merge pull request #3088 from tenforward/japanese

doc: Add lxc.comp.notify.cookie to Japanese lxc.container.conf(5)

7 days agodoc: Add lxc.comp.notify.cookie to Japanese lxc.container.conf(5)
KATOH Yasufumi [Thu, 11 Jul 2019 06:22:08 +0000 (15:22 +0900)]
doc: Add lxc.comp.notify.cookie to Japanese lxc.container.conf(5)

update for commit 214008e

Signed-off-by: KATOH Yasufumi <karma@jazz.email.ne.jp>
7 days agoMerge pull request #3087 from brauner/master
Stéphane Graber [Wed, 10 Jul 2019 14:53:45 +0000 (10:53 -0400)]
Merge pull request #3087 from brauner/master

cgroup: check for non-empty conf

7 days agocgroup: check for non-empty conf
Christian Brauner [Wed, 10 Jul 2019 14:34:29 +0000 (16:34 +0200)]
cgroup: check for non-empty conf

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
8 days agoMerge pull request #3086 from brauner/2019-07-09/seccomp_fixes
Stéphane Graber [Tue, 9 Jul 2019 19:15:41 +0000 (15:15 -0400)]
Merge pull request #3086 from brauner/2019-07-09/seccomp_fixes

seccomp: coding style

8 days agoseccomp: coding style
Christian Brauner [Tue, 9 Jul 2019 19:08:20 +0000 (21:08 +0200)]
seccomp: coding style

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
8 days agoMerge pull request #3080 from Blub/seccomp-notify-api
Christian Brauner [Tue, 9 Jul 2019 15:50:44 +0000 (17:50 +0200)]
Merge pull request #3080 from Blub/seccomp-notify-api

Seccomp notify api update

8 days agoaf_unix: remove unused variable
Christian Brauner [Tue, 9 Jul 2019 15:19:29 +0000 (17:19 +0200)]
af_unix: remove unused variable

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
8 days agoseccomp: send caller pidfd along with proxied requests
Wolfgang Bumiller [Tue, 9 Jul 2019 10:18:43 +0000 (12:18 +0200)]
seccomp: send caller pidfd along with proxied requests

On the one hand this should close the race between the
process exiting until the proxy reads the request.
On the other hand it'll help the proxy quickly access info
from /proc (such as ./cwd, ./ns/mnt, ...)

Signed-off-by: Wolfgang Bumiller <w.bumiller@proxmox.com>
8 days agoseccomp: recvmsg with MSG_TRUNC
Wolfgang Bumiller [Mon, 8 Jul 2019 16:00:20 +0000 (18:00 +0200)]
seccomp: recvmsg with MSG_TRUNC

We only read the message without the cookie. For now assert
that the sender also didn't try to send more by letting
`recvmsg()` return the original size of the packet if it was
longer.

Signed-off-by: Wolfgang Bumiller <w.bumiller@proxmox.com>
8 days agodoc: document lxc.seccomp.notify.cookie
Wolfgang Bumiller [Fri, 5 Jul 2019 17:21:34 +0000 (19:21 +0200)]
doc: document lxc.seccomp.notify.cookie

and fix a minor typo

Signed-off-by: Wolfgang Bumiller <w.bumiller@proxmox.com>
8 days agoseccomp: defer reconnecting to the proxy
Wolfgang Bumiller [Fri, 5 Jul 2019 09:36:07 +0000 (11:36 +0200)]
seccomp: defer reconnecting to the proxy

With the previous commit we now attempt to reconnect to the
proxy in the beginning of the notify handler if we had no
connection.
If the connection fails later on, we now don't really need
to immediately try to reconnect if we send a default
response anyway (particularly if the recv() fails). (This
also gives the proxy more time, for instance if it was just
restarted.)

Signed-off-by: Wolfgang Bumiller <w.bumiller@proxmox.com>
8 days agoseccomp: keep retrying to reconnect to proxy
Wolfgang Bumiller [Fri, 5 Jul 2019 09:30:24 +0000 (11:30 +0200)]
seccomp: keep retrying to reconnect to proxy

If a syscall happens after we already failed to communicate
with the proxy, proxy_fd was -1.
Before the previous commit we'd then be stuck in the state
where there was no proxy registered. With the previous
commit we'd send a default reply and only then try to
reconnect.
Improve this even further by trying to reconnect right at
the start.

Signed-off-by: Wolfgang Bumiller <w.bumiller@proxmox.com>
8 days agoseccomp: send default response when there's no proxy
Wolfgang Bumiller [Fri, 5 Jul 2019 09:22:34 +0000 (11:22 +0200)]
seccomp: send default response when there's no proxy

Particularly, when there's no proxy registered (iow. none
configured but the seccomp profile still had a 'notify'
rule), we don't want to leave them hanging.

Signed-off-by: Wolfgang Bumiller <w.bumiller@proxmox.com>
8 days agoseccomp: retry connecting to the proxy once
Wolfgang Bumiller [Fri, 5 Jul 2019 08:41:19 +0000 (10:41 +0200)]
seccomp: retry connecting to the proxy once

If the first sendmsg() fails, try to reconnect once before
failing. Otherwise if a proxy restarts while no syscall
happens, the next syscall always fails with ENOSYS.

Signed-off-by: Wolfgang Bumiller <w.bumiller@proxmox.com>
8 days agoseccomp: don't ignore syscalls when there's no proxy
Wolfgang Bumiller [Fri, 5 Jul 2019 07:44:17 +0000 (09:44 +0200)]
seccomp: don't ignore syscalls when there's no proxy

The container process would just hang.

Signed-off-by: Wolfgang Bumiller <w.bumiller@proxmox.com>
8 days agoseccomp: remove reconnect-loop
Wolfgang Bumiller [Fri, 5 Jul 2019 07:40:04 +0000 (09:40 +0200)]
seccomp: remove reconnect-loop

When we fail to send a message, we send a default seccomp
response and try to reconnect to the proxy. It doesn't
really make much sense to retry to send the request over the
new connection as the syscall has already been answered. The
same goes for receiving the response - after reconnecting to
the proxy, we're a new client to a potentially new proxy
process, so awaiting a response without having sent a
request doesn't make all too much sense either.

In the future we should probably have a timeout or retry
count for the entire proxy _transaction_ before sending a
response to seccomp at all (and probably handle requests
asynchronously).

Signed-off-by: Wolfgang Bumiller <w.bumiller@proxmox.com>
8 days agoseccomp: use SOCK_SEQPACKET for the notify proxy
Wolfgang Bumiller [Fri, 5 Jul 2019 07:31:09 +0000 (09:31 +0200)]
seccomp: use SOCK_SEQPACKET for the notify proxy

The seccomp notify API has a few variables: The struct sizes
are queried at runtime, and we now also have a user
configured cookie.
This means that with a SOCK_STREAM connection the proxy
needs to carefully read() the right amount of data based on
the contents of our proxy message struct to avoid ending up
in the middle of a packet.
While for now this may not be too tragic, since we currently
only ever send a single packet and then wait for the
response, we may at some point want to be able to handle
multiple processes simultaneously, hence it makes sense to
switch to a packet based connection.

So switch to using SOCK_SEQPACKET which is packet based,
(and also guarantees ordering). The `MSG_PEEK` flag can be
used with `recvmsg()` to figure out a packet's size on the
other end, and usually the size *should* not change after
that for an existing connection from a running container.

Signed-off-by: Wolfgang Bumiller <w.bumiller@proxmox.com>
8 days agoseccomp: assert that __reserved is 0 in notify responses
Wolfgang Bumiller [Fri, 5 Jul 2019 10:55:48 +0000 (12:55 +0200)]
seccomp: assert that __reserved is 0 in notify responses

Signed-off-by: Wolfgang Bumiller <w.bumiller@proxmox.com>
8 days agoseccomp: update notify api
Wolfgang Bumiller [Fri, 5 Jul 2019 07:22:11 +0000 (09:22 +0200)]
seccomp: update notify api

The previous API doesn't reflect the fact that
`seccomp_notif` and `seccomp_notif_resp` are allocatd
dynamically with sizes figured out at runtime.

We now query the sizes via the seccomp(2) syscall and change
`struct seccomp_notify_proxy_msg` to contain the sizes
instead of the data, with the data following afterwards.

Additionally it did not provide a convenient way to identify
the container the message originated from, for which we now
include a cookie configured via `lxc.seccomp.notify.cookie`.

Since we currently always send exactly one request and await
the response immediately, verify the `id` in the client's
response.

Finally, the proxy message's "version" field is removed, and
we reserve 64 bits in its place.

Signed-off-by: Wolfgang Bumiller <w.bumiller@proxmox.com>
8 days agoconf: add lxc.seccomp.notify.cookie
Wolfgang Bumiller [Wed, 3 Jul 2019 15:30:49 +0000 (17:30 +0200)]
conf: add lxc.seccomp.notify.cookie

This is an arbitrary string to to be included in proxied
seccomp notification messages.

Signed-off-by: Wolfgang Bumiller <w.bumiller@proxmox.com>
8 days agofile_utils: add lxc_recvmsg_nointr_iov
Wolfgang Bumiller [Thu, 4 Jul 2019 12:25:02 +0000 (14:25 +0200)]
file_utils: add lxc_recvmsg_nointr_iov

Signed-off-by: Wolfgang Bumiller <w.bumiller@proxmox.com>
8 days agoaf_unix: add lxc_unix_connect_type
Wolfgang Bumiller [Thu, 4 Jul 2019 12:34:01 +0000 (14:34 +0200)]
af_unix: add lxc_unix_connect_type

we want to use SOCK_SEQPACKET and in the future perhaps
SOCK_DATAGRAM as well

Signed-off-by: Wolfgang Bumiller <w.bumiller@proxmox.com>
8 days agoaf_unix: add lxc_abstract_unix_recv_fds_iov()
Christian Brauner [Tue, 9 Jul 2019 10:17:42 +0000 (12:17 +0200)]
af_unix: add lxc_abstract_unix_recv_fds_iov()

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
9 days agoaf_unix: add lxc_abstract_unix_send_fds_iov
Wolfgang Bumiller [Thu, 4 Jul 2019 07:17:04 +0000 (09:17 +0200)]
af_unix: add lxc_abstract_unix_send_fds_iov

Signed-off-by: Wolfgang Bumiller <w.bumiller@proxmox.com>
9 days agoMerge pull request #3085 from Blub/pidfd_send_signal-fixup
Christian Brauner [Mon, 8 Jul 2019 21:33:58 +0000 (23:33 +0200)]
Merge pull request #3085 from Blub/pidfd_send_signal-fixup

pidf_send_signal: fix return value

9 days agopidf_send_signal: fix return value
Wolfgang Bumiller [Mon, 8 Jul 2019 16:10:35 +0000 (18:10 +0200)]
pidf_send_signal: fix return value

Signed-off-by: Wolfgang Bumiller <w.bumiller@proxmox.com>
10 days agoMerge pull request #3083 from brauner/2019-07-07/mount_api
Stéphane Graber [Sun, 7 Jul 2019 16:39:49 +0000 (12:39 -0400)]
Merge pull request #3083 from brauner/2019-07-07/mount_api

lxccontainer: properly cleanup on mount injection failure

10 days agolxccontainer: properly cleanup on mount injection failure
Christian Brauner [Sun, 7 Jul 2019 16:00:27 +0000 (18:00 +0200)]
lxccontainer: properly cleanup on mount injection failure

Closes: #3082
Reported-by: Stéphane Graber <stgraber@ubuntu.com>
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
13 days agoMerge pull request #3081 from brauner/2019-07-05/network_unification_fixes
Christian Brauner [Fri, 5 Jul 2019 09:44:45 +0000 (11:44 +0200)]
Merge pull request #3081 from brauner/2019-07-05/network_unification_fixes

start: call lxc_find_gateway_addresses early

13 days agostart: call lxc_find_gateway_addresses early
Thomas Parrott [Thu, 4 Jul 2019 21:38:23 +0000 (22:38 +0100)]
start: call lxc_find_gateway_addresses early

This restores the lxc.net.x.ipv4.gateway = auto and
lxc.net.x.ipv6.gateway = auto functionality.

When the child is created the parent and child have different views of
struct lxc_handler since - obviously - virtual memory is duplicated. So any
changes to done by the parent that the child should see need to be IPCed to it.
For any non-actual device creation stuff this does not make much sense. This
includes finding gateway addresses. Move it back prior to clone().

Fixes #3078

Signed-off-by: Thomas Parrott <thomas.parrott@canonical.com>
[christian.brauner@ubuntu.com: non-functional changes and update commit message]
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
2 weeks agoMerge pull request #3077 from brauner/2019-07-03/network_fixes
Stéphane Graber [Wed, 3 Jul 2019 22:13:20 +0000 (18:13 -0400)]
Merge pull request #3077 from brauner/2019-07-03/network_fixes

network: simplify lxc_network_move_created_netdev_priv()

2 weeks agonetwork: simplify lxc_network_move_created_netdev_priv()
Christian Brauner [Wed, 3 Jul 2019 21:55:57 +0000 (23:55 +0200)]
network: simplify lxc_network_move_created_netdev_priv()

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
2 weeks agoMerge pull request #3076 from brauner/2019-07-03/network_fixes
Stéphane Graber [Wed, 3 Jul 2019 21:43:54 +0000 (17:43 -0400)]
Merge pull request #3076 from brauner/2019-07-03/network_fixes

network: fixes after unifying network creation

2 weeks agonetwork: send names for all non-trivial network types
Christian Brauner [Wed, 3 Jul 2019 21:17:05 +0000 (23:17 +0200)]
network: send names for all non-trivial network types

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
2 weeks agonetwork: record created_name for instantiate_phys()
Christian Brauner [Wed, 3 Jul 2019 19:48:20 +0000 (21:48 +0200)]
network: record created_name for instantiate_phys()

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
2 weeks agonetwork: simplify instantiate_phys()
Christian Brauner [Wed, 3 Jul 2019 19:46:37 +0000 (21:46 +0200)]
network: simplify instantiate_phys()

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
2 weeks agonetwork: record created_name for instantiate_vlan()
Christian Brauner [Wed, 3 Jul 2019 19:44:52 +0000 (21:44 +0200)]
network: record created_name for instantiate_vlan()

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
2 weeks agonetwork: simplify instantiate_vlan()
Christian Brauner [Wed, 3 Jul 2019 19:44:19 +0000 (21:44 +0200)]
network: simplify instantiate_vlan()

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
2 weeks agonetwork: record created_name for instantiate_ipvlan()
Christian Brauner [Wed, 3 Jul 2019 19:43:19 +0000 (21:43 +0200)]
network: record created_name for instantiate_ipvlan()

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
2 weeks agonetwork: simplify instantiate_ipvlan()
Christian Brauner [Wed, 3 Jul 2019 19:42:18 +0000 (21:42 +0200)]
network: simplify instantiate_ipvlan()

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
2 weeks agonetwork: stash created_name in instantiate_macvlan()
Christian Brauner [Wed, 3 Jul 2019 19:39:54 +0000 (21:39 +0200)]
network: stash created_name in instantiate_macvlan()

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
2 weeks agonetwork: simplify instantiate_macvlan()
Christian Brauner [Wed, 3 Jul 2019 19:39:24 +0000 (21:39 +0200)]
network: simplify instantiate_macvlan()

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
2 weeks agonetwork: s/loDev/loop_device/g
Christian Brauner [Wed, 3 Jul 2019 19:37:37 +0000 (21:37 +0200)]
network: s/loDev/loop_device/g

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
2 weeks agoMerge pull request #3075 from brauner/2019-07-03/cgroups
Stéphane Graber [Wed, 3 Jul 2019 16:23:50 +0000 (12:23 -0400)]
Merge pull request #3075 from brauner/2019-07-03/cgroups

cgroups: hande cpuset initialization race

2 weeks agocgroups: hande cpuset initialization race
Christian Brauner [Wed, 3 Jul 2019 15:57:48 +0000 (17:57 +0200)]
cgroups: hande cpuset initialization race

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
2 weeks agoMerge pull request #3074 from brauner/2019-07-03/fix_phys_network_creation
Stéphane Graber [Wed, 3 Jul 2019 15:44:25 +0000 (11:44 -0400)]
Merge pull request #3074 from brauner/2019-07-03/fix_phys_network_creation

network: remove faulty restriction

2 weeks agonetwork: remove faulty restriction
Christian Brauner [Wed, 3 Jul 2019 13:13:46 +0000 (15:13 +0200)]
network: remove faulty restriction

Reported-by: Thomas Parrott <thomas.parrott@canonical.com>
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
2 weeks agoMerge pull request #3069 from brauner/2019-07-01/network_creation
Stéphane Graber [Tue, 2 Jul 2019 15:46:55 +0000 (11:46 -0400)]
Merge pull request #3069 from brauner/2019-07-01/network_creation

start: unify network creation

2 weeks agostart: expose LXC_PID to network hooks too
Christian Brauner [Tue, 2 Jul 2019 10:57:12 +0000 (12:57 +0200)]
start: expose LXC_PID to network hooks too

Closes #3066.
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
2 weeks agostart: unify and simplify network creation
Christian Brauner [Mon, 1 Jul 2019 15:55:16 +0000 (17:55 +0200)]
start: unify and simplify network creation

Make sure that network creation happens at the same time for containers started
by privileged and unprivileged users. The only reason we didn't do this so far
was to avoid sending network device ifindices around in the privileged case.

Link: https://github.com/lxc/lxc/issues/3066
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
2 weeks agoMerge pull request #3064 from brauner/2019-06-27/cleanup_macros
Stéphane Graber [Tue, 2 Jul 2019 02:06:23 +0000 (22:06 -0400)]
Merge pull request #3064 from brauner/2019-06-27/cleanup_macros

bugfixes

2 weeks agoMerge pull request #3059 from brauner/2019-06-21/seccomp_notify
Stéphane Graber [Tue, 2 Jul 2019 02:04:20 +0000 (22:04 -0400)]
Merge pull request #3059 from brauner/2019-06-21/seccomp_notify

lxccontainer: rework seccomp notify api function

2 weeks agoMerge pull request #3067 from Rachid-Koucha/patch-1
Christian Brauner [Sun, 30 Jun 2019 16:13:30 +0000 (18:13 +0200)]
Merge pull request #3067 from Rachid-Koucha/patch-1

Move code/variable in smaller scope

2 weeks agoMove code/variable in smaller scope
Rachid Koucha [Sat, 29 Jun 2019 21:21:14 +0000 (23:21 +0200)]
Move code/variable in smaller scope

In start.c, do not fill path[] table if not necessary

Signed-off-by: Rachid Koucha <rachid.koucha@gmail.com>
2 weeks agoMerge pull request #3065 from lifeng68/fix_memory_leak
Christian Brauner [Fri, 28 Jun 2019 09:53:52 +0000 (11:53 +0200)]
Merge pull request #3065 from lifeng68/fix_memory_leak

fix memory leak in do_storage_create

2 weeks agofix memory leak in do_storage_create
LiFeng [Fri, 28 Jun 2019 03:49:08 +0000 (23:49 -0400)]
fix memory leak in do_storage_create

Signed-off-by: LiFeng <lifeng68@huawei.com>
2 weeks agocgroups: move variable into tighter scope
Christian Brauner [Thu, 27 Jun 2019 12:48:34 +0000 (14:48 +0200)]
cgroups: move variable into tighter scope

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
2 weeks agocgroups: correctly order variables
Christian Brauner [Thu, 27 Jun 2019 12:46:47 +0000 (14:46 +0200)]
cgroups: correctly order variables

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
2 weeks agocgroups: move variable into tighter scope
Christian Brauner [Thu, 27 Jun 2019 12:45:36 +0000 (14:45 +0200)]
cgroups: move variable into tighter scope

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
2 weeks agocgroups: simplify cgfsng_nrtasks()
Christian Brauner [Thu, 27 Jun 2019 12:43:36 +0000 (14:43 +0200)]
cgroups: simplify cgfsng_nrtasks()

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
2 weeks agocgroups: move variable into tighter scope
Christian Brauner [Thu, 27 Jun 2019 12:43:09 +0000 (14:43 +0200)]
cgroups: move variable into tighter scope

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
2 weeks agocgroups: move variable into tighter scope
Christian Brauner [Thu, 27 Jun 2019 12:27:58 +0000 (14:27 +0200)]
cgroups: move variable into tighter scope

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
2 weeks agocgroups: use __do_free in cgfsng_attach()
Christian Brauner [Thu, 27 Jun 2019 12:27:39 +0000 (14:27 +0200)]
cgroups: use __do_free in cgfsng_attach()

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
2 weeks agocgroups: simplify cgfsng_setup_limits()
Christian Brauner [Thu, 27 Jun 2019 12:26:38 +0000 (14:26 +0200)]
cgroups: simplify cgfsng_setup_limits()

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
2 weeks agocgroups: move variables into tighter scope
Christian Brauner [Thu, 27 Jun 2019 12:26:14 +0000 (14:26 +0200)]
cgroups: move variables into tighter scope

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
2 weeks agocgroups: use __do_free
Christian Brauner [Thu, 27 Jun 2019 12:25:53 +0000 (14:25 +0200)]
cgroups: use __do_free

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
3 weeks agoMerge pull request #3063 from lifeng68/fix_memory_leak
Christian Brauner [Thu, 27 Jun 2019 07:40:55 +0000 (09:40 +0200)]
Merge pull request #3063 from lifeng68/fix_memory_leak

cgfsng: fix memory leak in lxc_cpumask_to_cpulist

3 weeks agocgfsng: fix memory leak in lxc_cpumask_to_cpulist
LiFeng [Thu, 27 Jun 2019 03:54:27 +0000 (23:54 -0400)]
cgfsng: fix memory leak in lxc_cpumask_to_cpulist

Signed-off-by: LiFeng <lifeng68@huawei.com>
3 weeks agolxccontainer: rework seccomp notify api function
Christian Brauner [Fri, 21 Jun 2019 10:59:36 +0000 (12:59 +0200)]
lxccontainer: rework seccomp notify api function

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
3 weeks agoMerge pull request #3056 from brauner/2019-06-20/cpuset
Stéphane Graber [Thu, 20 Jun 2019 17:54:12 +0000 (13:54 -0400)]
Merge pull request #3056 from brauner/2019-06-20/cpuset

cgfsng: write cpuset.mems of correct ancestor

3 weeks agocgfsng: write cpuset.mems of correct ancestor
Christian Brauner [Thu, 20 Jun 2019 17:37:09 +0000 (19:37 +0200)]
cgfsng: write cpuset.mems of correct ancestor

Reported-by: Free Ekanayaka <free.ekanayaka@canonical.com>
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
4 weeks agoMerge pull request #3052 from tanyifeng/fd_leak
Christian Brauner [Thu, 20 Jun 2019 09:33:41 +0000 (11:33 +0200)]
Merge pull request #3052 from tanyifeng/fd_leak

parse.c: fix fd leak from memfd_create

3 weeks agoparse.c: fix fd leak from memfd_create
t00416110 [Thu, 20 Jun 2019 20:26:59 +0000 (16:26 -0400)]
parse.c: fix fd leak from memfd_create

Signed-off-by: t00416110 <tanyifeng1@huawei.com>
4 weeks agoMerge pull request #3050 from hallyn/pkgconfig
Christian Brauner [Tue, 18 Jun 2019 19:09:28 +0000 (21:09 +0200)]
Merge pull request #3050 from hallyn/pkgconfig

lxc.pc.in: add libs.private for static linking

4 weeks agolxc.pc.in: add libs.private for static linking
Serge Hallyn [Mon, 17 Jun 2019 13:37:47 +0000 (08:37 -0500)]
lxc.pc.in: add libs.private for static linking

None of them seem to support pkg-config themselves, else we could add
them to Requires.private.

Signed-off-by: Serge Hallyn <shallyn@cisco.com>
4 weeks agoMerge pull request #3047 from Rachid-Koucha/patch-11
Christian Brauner [Sun, 16 Jun 2019 02:11:35 +0000 (04:11 +0200)]
Merge pull request #3047 from Rachid-Koucha/patch-11

Fixed file descriptor leak for network namespace

4 weeks agoFixed file descriptor leak for network namespace
Rachid Koucha [Sat, 15 Jun 2019 13:17:50 +0000 (15:17 +0200)]
Fixed file descriptor leak for network namespace

In privileged mode, the container startup looses a file descriptor for "handler->nsfd[LX_NS_NET]". At line 1782, we preserve the namespaces file descriptor (in privileged mode, the network namespace is also preserved) :
for (i = 0; i < LXC_NS_MAX; i++)
if (handler->ns_on_clone_flags & ns_info[i].clone_flag)
INFO("Cloned %s", ns_info[i].flag_name);

if (!lxc_try_preserve_namespaces(handler, handler->ns_on_clone_flags, handler->pid)) {
ERROR("Failed to preserve cloned namespaces for lxc.hook.stop");
goto out_delete_net;
}

Then at line 1830, we preserve one more time the network namespace :
ret = lxc_try_preserve_ns(handler->pid, "net");
if (ret < 0) {
if (ret != -EOPNOTSUPP) {
SYSERROR("Failed to preserve net namespace");
goto out_delete_net;
}
The latter overwrites the file descriptor already stored in handler->nsfd[LXC_NS_NET] at line 1786.

So, this fix checks that the entry is not already filled.

Signed-off-by: Rachid Koucha <rachid.koucha@gmail.com>
4 weeks agoMerge pull request #3045 from hallyn/2019-06-13/openssl
Serge Hallyn [Sat, 15 Jun 2019 04:00:48 +0000 (23:00 -0500)]
Merge pull request #3045 from hallyn/2019-06-13/openssl

[RFC\ Switch from gnutls to openssl for sha1

4 weeks agoMerge pull request #3046 from brauner/lxc/master
Stéphane Graber [Fri, 14 Jun 2019 11:48:31 +0000 (07:48 -0400)]
Merge pull request #3046 from brauner/lxc/master

network: fix lxc_netdev_rename_by_index()

4 weeks agonetwork: fix lxc_netdev_rename_by_index()
Christian Brauner [Fri, 14 Jun 2019 10:39:20 +0000 (12:39 +0200)]
network: fix lxc_netdev_rename_by_index()

Return an error code when the name is invalid instead of pretending that things
are fine.

Closes #3044.

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
4 weeks agoSwitch from gnutls to openssl for sha1
Serge Hallyn [Fri, 14 Jun 2019 03:08:26 +0000 (03:08 +0000)]
Switch from gnutls to openssl for sha1

The reason for this is because openssl can be statically linked
against, gnutls cannot.

Signed-off-by: Serge Hallyn <shallyn@cisco.com>
4 weeks agoMerge pull request #3042 from tenforward/japanese
Christian Brauner [Thu, 13 Jun 2019 12:10:00 +0000 (14:10 +0200)]
Merge pull request #3042 from tenforward/japanese

doc: add a note about shared ns + LSMs to Japanese doc

4 weeks agodoc: add a note about shared ns + LSMs to Japanese doc
KATOH Yasufumi [Thu, 13 Jun 2019 12:05:24 +0000 (21:05 +0900)]
doc: add a note about shared ns + LSMs to Japanese doc

Update for commit 8de90384363fe01f5258d36724dd3eae55918b5b

Signed-off-by: KATOH Yasufumi <karma@jazz.email.ne.jp>
5 weeks agoMerge pull request #3041 from brauner/2019-06-12/seccomp_notify_fixes
Stéphane Graber [Wed, 12 Jun 2019 12:18:24 +0000 (08:18 -0400)]
Merge pull request #3041 from brauner/2019-06-12/seccomp_notify_fixes

seccomp: do not set SECCOMP_FILTER_FLAG_NEW_LISTENER

5 weeks agoMerge pull request #3040 from Rachid-Koucha/patch-11
Christian Brauner [Wed, 12 Jun 2019 12:15:39 +0000 (14:15 +0200)]
Merge pull request #3040 from Rachid-Koucha/patch-11

Centralize hook names

5 weeks agoseccomp: do not set SECCOMP_FILTER_FLAG_NEW_LISTENER
Christian Brauner [Wed, 12 Jun 2019 11:42:25 +0000 (13:42 +0200)]
seccomp: do not set SECCOMP_FILTER_FLAG_NEW_LISTENER

Do not set SECCOMP_FILTER_FLAG_NEW_LISTENER as seccomp attribute.
Prior to libseccomp merging support for SECCOMP_RET_USER_NOTIF there was a
libseccomp specific attribute that needed to be set before
SECCOMP_RET_USER_NOTIF could be used. This has been removed.

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
5 weeks agoCentralize hook names
Rachid Koucha [Wed, 12 Jun 2019 06:36:40 +0000 (08:36 +0200)]
Centralize hook names

The hook string names must not be repeated in the source code to facilitate future changes

Signed-off-by: Rachid Koucha <rachid.koucha@gmail.com>
5 weeks agoMerge pull request #3039 from brauner/master
Stéphane Graber [Tue, 11 Jun 2019 22:11:32 +0000 (18:11 -0400)]
Merge pull request #3039 from brauner/master

seccomp: add ifdefine for SECCOMP_FILTER_FLAG_NEW_LISTENER

5 weeks agoseccomp: add ifdefine for SECCOMP_FILTER_FLAG_NEW_LISTENER
Christian Brauner [Tue, 11 Jun 2019 22:02:49 +0000 (00:02 +0200)]
seccomp: add ifdefine for SECCOMP_FILTER_FLAG_NEW_LISTENER

So that we can deal with older kernels.

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
5 weeks agoMerge pull request #3038 from brauner/master
Stéphane Graber [Tue, 11 Jun 2019 21:53:05 +0000 (17:53 -0400)]
Merge pull request #3038 from brauner/master

seccomp: s/SCMP_FLTATR_NEW_LISTENER/SECCOMP_FILTER_FLAG_NEW_LISTENER/g

5 weeks agoseccomp: s/SCMP_FLTATR_NEW_LISTENER/SECCOMP_FILTER_FLAG_NEW_LISTENER/g
Christian Brauner [Tue, 11 Jun 2019 21:51:34 +0000 (23:51 +0200)]
seccomp: s/SCMP_FLTATR_NEW_LISTENER/SECCOMP_FILTER_FLAG_NEW_LISTENER/g

Align with upstream libseccomp.

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
5 weeks agoMerge pull request #3037 from brauner/master
Stéphane Graber [Tue, 11 Jun 2019 21:43:10 +0000 (17:43 -0400)]
Merge pull request #3037 from brauner/master

seccomp: align with upstream libseccomp

5 weeks agoseccomp: s/HAVE_DECL_SECCOMP_NOTIF_GET_FD/HAVE_DECL_SECCOMP_NOTIFY_FD/g
Christian Brauner [Tue, 11 Jun 2019 21:36:56 +0000 (23:36 +0200)]
seccomp: s/HAVE_DECL_SECCOMP_NOTIF_GET_FD/HAVE_DECL_SECCOMP_NOTIFY_FD/g

Align with upstream libseccomp.

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
5 weeks agoseccomp: /sseccomp_notif_free/seccomp_notify_free/g
Christian Brauner [Tue, 11 Jun 2019 21:34:33 +0000 (23:34 +0200)]
seccomp: /sseccomp_notif_free/seccomp_notify_free/g

Align with upstream libseccomp.

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
5 weeks agoseccomp: s/seccomp_notif_alloc/seccomp_notify_alloc/g
Christian Brauner [Tue, 11 Jun 2019 21:33:22 +0000 (23:33 +0200)]
seccomp: s/seccomp_notif_alloc/seccomp_notify_alloc/g

Align with upstream libseccomp.

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
5 weeks agoseccomp: s/seccomp_notif_id_valid/seccomp_notify_id_valid/g
Christian Brauner [Tue, 11 Jun 2019 21:32:19 +0000 (23:32 +0200)]
seccomp: s/seccomp_notif_id_valid/seccomp_notify_id_valid/g

Align with upstream libseccomp.

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
5 weeks agoseccomp: s/seccomp_notif_send_resp/seccomp_notify_respond/g
Christian Brauner [Tue, 11 Jun 2019 21:31:12 +0000 (23:31 +0200)]
seccomp: s/seccomp_notif_send_resp/seccomp_notify_respond/g

Align with upstream libseccomp.

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>