While a completely unconfigured network interface is
considered manually managed, one that contains an ipv4 _or_
an ipv6 address needs to remove sections with no configured
address rather than printing the 'iface' section header with
no content.
Dominik Csapak [Thu, 11 Aug 2016 09:12:52 +0000 (11:12 +0200)]
fix #1078: accept arch parameter
we now accept the arch parameter,
when value is valid according to the JSONSchema
and skip detection on creation/restoration when we
explicitly set one
Fix #1070: vzdump: handle sparse files in suspend mode
In suspend mode we perform two rsyncs with --inplace which
is incompatible to --sparse. However, only the second one
really needs to do in-place updates, so the first stage
should use --sparse instead.
LXC doesn't reload the configuration on reboot causing
hotplugged changes to not be persistent across
container-side reboots.
Instead, let the post-stop hook return false so that lxc
stops while starting up a new instance in the background
with the updated config.
since we allow to create a container without hostname
(we are using localhost by default then) and hostname
is marked optional in the JSONSchema of the config
we should be able to delete the hostname
the following checks were copied from QemuMigrate and adapted for LXC:
- check volumes from current configuration AND snapshots
- look for and check lost/found volumes via PVE::Storage
- check for local linked clones
also adapt PVE::LXC::destroy_lxc_container to optionally
write an arbitray new config instead of deleting it
altogether. the old configuration is replaced by an empty
temporary configuration at the moment, but this could easily
be reused if/when a "create"-locked config is used instead
of an empty one.
these were only used once and their method signatures were
already quite long, so split up into
- delete old existing container and write new config
- mount
- restore archive / extract template
- restore configuration / setup new container
- unmount
rw/ro race occurs when a container contains the same bind
mount twice and another container contains a bind mount
containing the first container's destination. If the double
bind mounts are both meant to be read-only then the second
container could theoretically swap them out between the
mount and the read-only remount call, then swap them back
for the test. So to verify this we use the same file
descriptor we use for the dev/inode check and perform an
faccessat() call and expect it to return EROFS and nothing
else.
Also include O_NOFOLLOW in the checks' openat() calls.
While the container itself might not be running and cannot
influence the mounting between check_mount_path() and
mount(), this is a possibility when multiple containers
have write access to the same recursive bind mount
hierarchy.
This patch adds a walk_tree_nofollow() function performing
two things: It walks a path from a starting point following
no symlinks and erroring if it encounters one. And if
requested creates all the missing directories.
This replaces both the combination of check_mount_path() and
mkpath(), and the check_mount_path() in bindmount() while
giving the latter the ability to also access the "last
component" of the path via openat() a second time after
mounting (as an alternative to also including an fstatat()
syscall) in order to verify the path which was ultimately
mounted is indeed the path walked in the first check.
if the mountpoint configuration is not explicitly provided
via -rootfs or -mpX , recreate all volume mountpoints on the
provided -storage , restore the archive and then add
non-volume mountpoints back to the configuration.
if -rootfs (and optionally any -mpX) are provided, the old
configuration contained in the backup archive is ignored.
this allows reconfiguration of mountpoints when restoring a
backup, e.g. to change mountpoint paths or other options. in
this mode restoring backups to bind or device mountpoints is
also possible.
LXC::Config: make mountpoint_backup_enabled a class method
All subs in there are defined as class method and the commit
which introduced this also used it as one in
PVE::VZDump::LXC and thereby broke vzdump on containers
as it passes wrong parameters to the function.
Close #999: gentoo: hostname is in /etc/conf.d/hostname
This is also a shell-style assignment but should only
contain the hostname and nothing else. Although if someone
complains we could switch to ct_modify_file there as well.
remove_gateway_scripts() for debian containers can easily
match user-created scripts since it's not strict enough,
which now that we always clean up gateways appears to be an
issue for some.
To deal with this we update this portion to also use
BEGIN/END markers like we did with other files. (Note that
this means we explicitly include the BEGIN/END comment lines
in the 'attribute' list while parsing sections.)
In order to not break existing container configurations we
now remove either a begin/end marked section in
remove_gateway_scripts(), or if none was found fall back to
a much stricter variant of the old matching algorithm which
only triggers if the gateway setup lines are complete and
unmodified.
With DHCPv6 we're in a similar boat as with Alpine: The
default templates only ship busybox' udhcpc which doesn't do
ipv6 at all, and if dhclient/dhcpcd are installed there'd
still be no way to configure ONLY dhcpv6 without including
dhcpv4. (We could just dump in a dhclientv6.sh script to
/lib64/netifrc/net/dhclientv6.sh if someone absolutely needs
it...)
Also the fact that the network configuration can in *theory*
be a full blown bash script is a bit inconvenient.
Thomas Lamprecht [Wed, 11 May 2016 15:06:14 +0000 (17:06 +0200)]
setup: check if securetty exists
If securetty does not exists yet (e.g. some Alpine 3.2 templates do
that) this leads to an die on CT creation, although we do not need
an existing securetty file as all login devices/ttys are already
allowed if not existing.
Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
It seems busybox has some problems with links thus the tty dev
detection doesn't work, as workaround add also the lxc/tty[1-4] and
lxc/console devs to securetty to allow root login over the console.
Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
remove the calls to "ip route" in post-up and pre-down even
if no new gateway was defined for an interface, otherwise
those hooks will remain until manually removed.
Centos needs these in route6-$iface, not route-$iface.
It also seems to make sense to not include the
IPV6_DEFAULTGW when a route6-$iface file is used containing
the default gateway.
$conf->{rootfs} is supposed to be the property string value,
not the parsed property string. since this method is called
only twice (once for retrieving the rootfs information only,
once for retrieving the config only) and the second call
never needs the 'rootfs' part of the configuration, we can
safely not set it instead of introducing ugly workarounds
(e.g. setting a fake volume path or worse).
projects / pve-container.git / log