Get Gentoo!
gentoo.org sites
gentoo.org Wiki Bugs Forums Packages
Planet Archives Sources
Infra Status
aboutsummaryrefslogtreecommitdiff
path: root/src
Commit message (Collapse)AuthorAgeFilesLines
* build: use libtool for linking the library, and link lxc-init statically.Diego Elio Pettenò2012-03-241-24/+7
| | | | | | | | | | | | | | | The shared object versioning on the library (soname) was completely wrong, as the ABI doesn't seem to be guaranteed between one version and the other, so proposing all of them as .so.0 is very wrong. Furthermore you generally want lxc-init static so that you don't have to add (or have a compatible version of) libcap and liblxc within a container you want to use lxc-execute with. To solve the issue, use the good old libtool to take care of the library building, and pass -all-static to the lxc-init linking stage. Also drop the manual rpath handling, and leave it to libtool to manage.
* do check for utmp checking at the right timeSerge Hallyn2012-03-191-5/+9
| | | | | | | | | | | | | | We were doing the check for whether we need to watch utmp from a thread cloned from that which will actually do the utmp watching. As a result, the utmp file was always being watched, even if it didn't need to be. Move the check to the parent thread. Bug-Ubuntu: https://bugs.launchpad.net/ubuntu/+source/lxc/+bug/948623 Signed-off-by: Serge Hallyn <serge.hallyn@canonical.com> Signed-off-by: Daniel Lezcano <dlezcano@fr.ibm.com>
* cgroups: fix broken support for deprecated ns cgroupSerge Hallyn2012-03-052-25/+41
| | | | | | | | | | | | | | | | | | when using ns cgroup, use /cgroup/<init-cgroup> rather than /cgroup/<init-cgroup>/lxc At least lxc-start, lxc-stop, lxc-cgroup, lxc-console and lxc-ls work with this patch. I've tested this in a 2.6.35 kernel with ns cgroup, and in a 3.2 kernel without ns cgroup. Note also that because of the check for container reboot support, if we're using the ns cgroup we now end up with a /cgroup/<container>/2 cgroup created, empty, by the clone(CLONE_NEWPID). I'm really not sure how much time we want to spend cleaning such things up since ns cgroup is deprecated in kernel. Signed-off-by: Serge Hallyn <serge@hallyn.com> Signed-off-by: Daniel Lezcano <dlezcano@fr.ibm.com>
* If a container is already running, say so in error msgs.Serge Hallyn2012-02-261-1/+6
| | | | | | | | Otherwise there is no clear indication to the user why the container startup failed. Signed-off-by: Serge Hallyn <serge@hallyn.com> Signed-off-by: Daniel Lezcano <dlezcano@fr.ibm.com>
* add option to close inherited fdsSerge Hallyn2012-02-267-6/+25
| | | | | | | | The option is implied by '-d', because the admin won't see the warning message. Signed-off-by: Serge Hallyn <serge@hallyn.com> Signed-off-by: Daniel Lezcano <dlezcano@fr.ibm.com>
* add lxc.devttydir config variableSerge Hallyn2012-02-263-19/+150
| | | | | | | | If set, then the console and ttys will be bind-mounted not over /dev/console, but /dev/<ttydir>/console and then symlinked from there to /dev/console. Signed-off-by: Serge Hallyn <serge@hallyn.com> Signed-off-by: Daniel Lezcano <dlezcano@fr.ibm.com>
* lxc-clone: support btrfs and clean up safelyUbuntu2012-02-261-120/+127
| | | | | | | btrfs support from Scott Moser. Signed-off-by: Serge Hallyn <serge.hallyn@canonical.com> Signed-off-by: Daniel Lezcano <dlezcano@fr.ibm.com>
* add btrfs support to lxc-createUbuntu2012-02-261-15/+34
| | | | | | | From Scott Moser. Signed-off-by: Serge Hallyn <serge.hallyn@canonical.com> Signed-off-by: Daniel Lezcano <dlezcano@fr.ibm.com>
* remove unused fddir variableSerge Hallyn2012-02-261-3/+0
| | | | | | | Thanks to dlezcano for spotting this. Signed-off-by: Serge Hallyn <serge.hallyn@canonical.com> Signed-off-by: Daniel Lezcano <dlezcano@fr.ibm.com>
* lxc-init: use INFO when failed to mount /dev/shmSerge Hallyn2012-02-261-1/+1
| | | | | Signed-off-by: Serge Hallyn <serge.hallyn@canonical.com> Signed-off-by: Daniel Lezcano <dlezcano@fr.ibm.com>
* silence netstat warnings in lxc-lsSerge Hallyn2012-02-261-1/+1
| | | | | | | | | netstat -x sometimes spits errors to stderr like: warning, got bogus unix line. Shut those up as they don't help lxc-ls. Signed-off-by: Serge Hallyn <serge.hallyn@canonical.com> Signed-off-by: Daniel Lezcano <dlezcano@fr.ibm.com>
* fix reboot support detectionSerge Hallyn2012-02-261-14/+52
| | | | | | | | | In order for reboot(LINUX_REBOOT_CMD_CADON) to detect whether container reboot is supported, it must be done in a non-init pid namespace. Fix that. Signed-off-by: Serge Hallyn <serge.hallyn@canonical.com> Signed-off-by: Daniel Lezcano <dlezcano@fr.ibm.com>
* if lxc-init can't mount /dev/shm, don't fail.Serge Hallyn2012-02-261-1/+2
| | | | | | | | | | The 'lxc-init' (a lightweight init process used by lxc-execute in place of upstart etc) tries to mount /dev/shm during startup. If that fails (for instance /dev/shm does not exist) then it aborts execution and returns -1. This is unreasonable as very few applications actually need /dev/shm. Signed-off-by: Serge Hallyn <serge.hallyn@canonical.com> Signed-off-by: Daniel Lezcano <dlezcano@fr.ibm.com>
* Don't raise error if container didn't sys_rebootSerge Hallyn2012-02-261-16/+19
| | | | | | | | | | | Don't call it an error if a container exits without calling sys_reboot. Particularly since that will almost always be the case with lxc-execute. This fixes a regression introduced in commit "49296e2ebfe7c5f9d6ebafbb54f5c5e56a0cc085: support proper container reboot" Signed-off-by: Serge Hallyn <serge.hallyn@canonical.com> Signed-off-by: Daniel Lezcano <dlezcano@fr.ibm.com>
* lxc-start: exit early and cleanly if we have insufficient privsSerge Hallyn2012-02-263-0/+47
| | | | | Signed-off-by: Serge Hallyn <serge.hallyn@canonical.com> Signed-off-by: Daniel Lezcano <dlezcano@fr.ibm.com>
* recursively delete cgroups on container shutdownSerge Hallyn2012-02-261-1/+44
| | | | | | | | If a container has created its own cgroups, i.e. by running libvirtd, then if we don't delete all child cgroups, then the rmdir will fail. Signed-off-by: Serge Hallyn <serge.hallyn@canonical.com> Signed-off-by: Daniel Lezcano <dlezcano@fr.ibm.com>
* fix lxc-netstat for nested cgroupsSerge Hallyn2012-02-261-2/+12
| | | | | | | | | | | Use the correct path for the container's cgroup task file. Also exit out early and cleanly if the container is not running, and bind-mount /proc/$pid/net with '-n' to keep the entry out of mtab, else the mtab entry will never go away. Signed-off-by: Serge Hallyn <serge.hallyn@canonical.com> Signed-off-by: Daniel Lezcano <dlezcano@fr.ibm.com>
* support proper container rebootSerge Hallyn2012-02-262-7/+55
| | | | | | | | | | | | This patch looks for Daniel's kernel patch allowing the lxc monitor to tell container reboot from shutdown based on the exit signal. If that patch is not there, utmp monitoring is used. Otherwise, it only looks for the signal. Note that the 'conf->need_utmp_watch' is technically not necessary, as there is no harm in watching the utmp file. Signed-off-by: Serge Hallyn <serge.hallyn@canonical.com> Signed-off-by: Daniel Lezcano <dlezcano@fr.ibm.com>
* lxc-create: fix error with lvmSerge Hallyn2012-02-261-1/+1
| | | | | | | | when --lvname is given, use that for lvcreate instead of using lxc_name, which is wrong. Signed-off-by: Serge Hallyn <serge.hallyn@canonical.com> Signed-off-by: Daniel Lezcano <dlezcano@fr.ibm.com>
* lxc-clone.in: define localstatedir, as @LXCPATH@ might be defined in terms of itSerge Hallyn2012-02-261-0/+1
| | | | | Signed-off-by: Serge Hallyn <serge.hallyn@canonical.com> Signed-off-by: Daniel Lezcano <dlezcano@fr.ibm.com>
* add lvm support to lxc-createSerge Hallyn2012-02-262-9/+120
| | | | | | | | | | | | | 1. Some templates copy the cached pristine rootfs using 'cp a b' where b is $lxc_path/$name/rootfs. That doesn't do the right thing if rootfs already exists, as it will when it is an lvm or other mount. So switch to 'rsync a/ b/'. (cp can be made to work too of course). 2. Update lxc-create to support backing stores. For now only lvm is implemented. Signed-off-by: Serge Hallyn <serge.hallyn@canonical.com> Signed-off-by: Daniel Lezcano <dlezcano@fr.ibm.com>
* Fix several nagging bugs in lxc-destroySerge Hallyn2012-02-261-7/+27
| | | | | | | | | | | | Don't delete a running container. If it's running, abort the delete unless a new '-f' (force) flag is given, in which case, stop it first. Handle the case where we can't find $rootfs in config Fix broken detection of lvm backing store Signed-off-by: Serge Hallyn <serge.hallyn@canonical.com> Signed-off-by: Daniel Lezcano <dlezcano@fr.ibm.com>
* Support nested cgroupsSerge Hallyn2012-02-263-35/+184
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | With this patch, I can start a container 'o1' inside another container 'o1'. (Of course, the containers must be on a different subnet) Detail: 1. Create cgroups for containers under /lxc. 2. Support nested lxc: respect init's cgroup: Create cgroups under init's cgroup. So if we start a container c2 inside a container 'c1', we'll use /sys/fs/cgroup/freezer/lxc/c1/lxc/c2 instead of /sys/fs/cgroup/freezer/c2. This allows a container c1 to be created inside container c1 It also allow a container's limits to be enforced on all a container's children (which a MAC policy could already enforce, in which case current lxc code would be unable to nest altogether). 3. Finally, if a container's cgroup already exists, rename it rather than failing to start the container. Try to WARN the user so they might go clean the old cgroup up. Whereas without this patch, container o1's cgroup would be /sys/fs/cgroup/<subsys>/o1, it now becomes /sys/fs/cgroup/<subsys>/<initcgroup>/lxc/o1 so if init is in cgroup '/' then o1's freezer cgroup would be: /sys/fs/cgroup/freezer/lxc/o1 Changelog: . make lxc-ps work with separate mtab. If cgroups were mounted with -n, and mtab is not linked to /proc/self/mounts, then 'mount -t cgroup' won't show these mounts. So make lxc-ps not use it, but rather use /proc/self/mounts directly. . lxc-ls in the past assumed that a container's cgroup was just '/<name>'. Now it is '/<host-init-cgroup>/lxc/<name>'. Handle that. . first version of this patch was setting clone_children on <path-to-cpusets-cgroup>/<init-cgroup>/lxc, not the parent of that dir. That failed to initialize that cgroup, so tasks could not enter it. Signed-off-by: Serge Hallyn <serge.hallyn@canonical.com> Signed-off-by: Daniel Lezcano <dlezcano@fr.ibm.com>
* fix-automake-1.13Jon Nordby2012-02-231-1/+1
| | | | | | | | | | | | ## 0001-Replace-pkglib_PROGRAMS-with-pkglibexec_PROGRAMS.patch [diff] From 95c566740bba899acc7792c11fcdb3f4d32dcfc9 Mon Sep 17 00:00:00 2001 From: Jon Nordby <jononor@gmail.com> Date: Fri, 10 Feb 2012 11:38:35 +0100 Subject: [PATCH] Replace pkglib_PROGRAMS with pkglibexec_PROGRAMS Without this change, autogen.sh fails with automake 1.11.3 Signed-off-by: Daniel Lezcano <dlezcano@fr.ibm.com>
* lxc-attach: Drop privileges when attaching to container unless requested ↵Christian Seiler2012-02-231-13/+102
| | | | | | | | | | | | | | | | | | | | | otherwise lxc-attach will now put the process that is attached to the container into the correct cgroups corresponding to the container, set the correct personality and drop the privileges. The information is extracted from entries in /proc of the init process of the container. Note that this relies on the (reasonable) assumption that the init process does not in fact drop additional capabilities from its bounding set. Additionally, 2 command line options are added to lxc-attach: One to prevent the capabilities from being dropped and the process from being put into the cgroup (-e, --elevated-privileges) and a second one to explicitly state the architecture which the process will see, (-a, --arch) which defaults to the container's current architecture. Signed-off-by: Daniel Lezcano <dlezcano@fr.ibm.com>
* Move lxc_attach from namespace.c to attach.c and rename it to lxc_attach_to_nsChristian Seiler2012-02-235-50/+38
| | | | | | | | | | Since lxc-attach helper functions now have an own source file, lxc_attach is moved from namespace.c to attach.c and is renamed to lxc_attach_to_ns, because that better reflects what the function does (attaching to a container can also contain the setting of the process's personality, adding it to the corresponding cgroups and dropping specific capabilities). Signed-off-by: Daniel Lezcano <dlezcano@fr.ibm.com>
* Add attach.[ch]: Helper functions for lxc-attachChristian Seiler2012-02-233-1/+295
| | | | | | | | | | | | | | The following helper functions for lxc-attach are added to a new file attach.c: - lxc_proc_get_context_info: Get cgroup memberships, personality and capability bounding set from /proc for a given process. - lxc_proc_free_context_info: Free the data structure responsible - lxc_attach_proc_to_cgroups: Add the process specified by the pid parameter to the cgroups given by the ctx parameter. - lxc_attach_drop_privs: Drop capabilities to the capability mask given in the ctx parameter. Signed-off-by: Daniel Lezcano <dlezcano@fr.ibm.com>
* Add lxc_config_parse_arch to parse architecture stringsChristian Seiler2012-02-232-23/+32
| | | | | | | | | | Add the function lxc_config_parse_arch that parses an architecture string (x86, i686, x86_64, amd64) and returns the corresponding personality. This is required for lxc-attach, which accepts architectures independently of lxc.arch. The parsing of lxc.arch now also uses the same function to ensure consistency. Signed-off-by: Daniel Lezcano <dlezcano@fr.ibm.com>
* cgroup: Make cgroup_attach a public functionChristian Seiler2012-02-232-2/+3
| | | | | | | | lxc-attach needs to be able to attach a process to specific cgroup, so cgroup_attach is renamed to lxc_cgroup_attach and now also defined in the header file. Signed-off-by: Daniel Lezcano <dlezcano@fr.ibm.com>
* Enable get_cgroup_mount to search for mount points satisfying multiple ↵Christian Seiler2012-02-231-1/+30
| | | | | | | | | | | | | subsystems at once lxc-attach functionality reads /proc/init_pid/cgroup to determine the cgroup of the container for a given subsystem. However, since subsystems may be mounted together, we want to be on the safe side and be sure that we really find the correct mount point, so we allow get_cgroup_mount to check for *all* the subsystems; the subsystem parameter may now be a comma-separated list. Signed-off-by: Daniel Lezcano <dlezcano@fr.ibm.com>
* Add missing double-include #ifndef/#define/#endif to confile.hChristian Seiler2012-02-231-0/+5
| | | | Signed-off-by: Daniel Lezcano <dlezcano@fr.ibm.com>
* Add missing 'extern' keyword to functions defined in cgroup.hChristian Seiler2012-02-231-5/+5
| | | | Signed-off-by: Daniel Lezcano <dlezcano@fr.ibm.com>
* Accept numeric values for capabilities to dropChristian Seiler2012-02-231-0/+17
| | | | | | | | lxc.cap.drop now also accepts numeric values for capabilities. This allows the user to specify capabilities LXC doesn't know about yet or capabilities that were not part of the kernel headers LXC was compiled against. Signed-off-by: Daniel Lezcano <dlezcano@fr.ibm.com>
* Add CAP_SYSLOG and CAP_WAKE_ALARM to list of capabilitiesChristian Seiler2012-02-231-0/+6
| | | | Signed-off-by: Daniel Lezcano <dlezcano@fr.ibm.com>
* Add function to determine CAP_LAST_CAP of the current kernel dynamicallyChristian Seiler2012-02-232-0/+48
| | | | | | | | | | | The function lxc_caps_last_cap() determines CAP_LAST_CAP of the current kernel dynamically. It first tries to read /proc/sys/kernel/cap_last_cap. If that fails, because the kernel does not support this interface yet, it loops through all capabilities and tries to determine whether the current capability is part of the bounding set. The first capability for which prctl() fails is considered to be CAP_LAST_CAP. Signed-off-by: Daniel Lezcano <dlezcano@fr.ibm.com>
* correctly install signal handler for lxc-initJian Xiao2012-02-231-3/+19
| | | | | | | | | This patch is to correct the manipulation of signal masks when installing signal handlers for lxc-init. Signed-off-by: Jian Xiao <jian@linux.vnet.ibm.com> Signed-off-by: Greg Kurz <gkurz@fr.ibm.com> Signed-off-by: Daniel Lezcano <dlezcano@fr.ibm.com>
* remove redundent LXC_TTY_HANDLERJian Xiao2012-02-232-36/+2
| | | | | | | | All the signals (except fatal ones) are redirected to signalfd at lxc_init, so the LXC_TTY_HANDLERs are redundant. This patch removes them. Signed-off-by: Jian Xiao <jian@linux.vnet.ibm.com> Signed-off-by: Daniel Lezcano <dlezcano@fr.ibm.com>
* limit rm to rootfs, avoiding nuking of any bind mounts fromandrea rota2012-01-051-1/+1
| | | | | | the host Signed-off-by: Daniel Lezcano <dlezcano@fr.ibm.com>
* lxc: line buffered output for lxc-monitorGreg Kurz2012-01-051-0/+2
| | | | | | | | | | | A typical usage is to start lxc-monitor in popen() and parse the ouput. Unfortunately, glibc defaults to block buffering for pipes and you may have to wait several lines before anything is written to stdout... this prevent the use of lxc-monitor to implement automatons. Let's go line buffered ! Signed-off-by: Greg Kurz <gkurz@fr.ibm.com> Signed-off-by: Daniel Lezcano <dlezcano@fr.ibm.com>
* Fix ia64 cloneDaniel Lezcano2012-01-051-2/+2
| | | | | | Fix the stack address for ia64. Signed-off-by: Daniel Lezcano <dlezcano@fr.ibm.com>
* Fix network cleanup on errorDaniel Lezcano2012-01-052-6/+11
| | | | | | | Network cleanup does not cleanup correctly the virtual interfaces in case of an error. Signed-off-by: Daniel Lezcano <dlezcano@fr.ibm.com>
* give explicit error when the cgroup are not foundDaniel Lezcano2012-01-051-1/+7
| | | | | | | | | When the cgroup is not mounted, we silently exit without giving some clues to the user with what is happening. Give some info and an explicit error. Signed-off-by: Daniel Lezcano <dlezcano@fr.ibm.com>
* fix indentation of the previous patchDaniel Lezcano2012-01-051-3/+8
| | | | Signed-off-by: Daniel Lezcano <dlezcano@fr.ibm.com>
* Set high byte of mac addresses for host veth devices to 0xfeChristian Seiler2012-01-051-0/+40
| | | | | | | | | | | | | | | | | | When used in conjunction with a bridge, veth devices with random addresses may change the mac address of the bridge itself if the mac address of the interface newly added is numerically lower than the previous mac address of the bridge. This is documented kernel behavior. To avoid changing the host's mac address back and forth when starting and/or stopping containers, this patch ensures that the high byte of the mac address of the veth interface visible from the host side is set to 0xfe. A similar logic is also implemented in libvirt. Fixes SF bug #3411497 See also: <http://thread.gmane.org/gmane.linux.kernel.containers.lxc.general/2709> Signed-off-by: Daniel Lezcano <dlezcano@fr.ibm.com> Acked-by: Serge Hallyn <serge.hallyn@canonical.com>
* Revert "lxc: use -iquote instead of -I"Daniel Lezcano2011-11-181-6/+1
| | | | This reverts commit a2dea4ea209a8fcf6837668bbe59f350931d1c07.
* lxc: use -iquote instead of -IGreg Kurz2011-11-101-1/+6
| | | | | | | | | To avoid name collisions between local and system header files. For example, if you try to include the <pty.h> system file, you end up including the one from lxc... Signed-off-by: Greg Kurz <gkurz@fr.ibm.com> Signed-off-by: Daniel Lezcano <dlezcano@fr.ibm.com>
* lxc: fix erroneous includesGreg Kurz2011-11-108-12/+19
| | | | | | | The "" notation is preferrable if the header file is local. Signed-off-by: Greg Kurz <gkurz@fr.ibm.com> Signed-off-by: Daniel Lezcano <dlezcano@fr.ibm.com>
* fix lxc-destroyDaniel Lezcano2011-11-101-0/+1
| | | | | | Add missing 'localstatedir' directory definition. Signed-off-by: Daniel Lezcano <dlezcano@fr.ibm.com>
* extend the struct lxc_argumentsCedric Le Goater2011-10-242-0/+4
| | | | | | | | | This patch adds a private argument to extend the struct lxc_arguments. This is useful to develop custom lxc commands outside mainline lxc. Signed-off-by: Cedric Le Goater <clg@fr.ibm.com> Signed-off-by: Daniel Lezcano <dlezcano@fr.ibm.com>
* lxc: introduce lxc_execute()Greg Kurz2011-10-246-46/+107
| | | | | | | | | | | | | | | | This patch allows to create application containers with liblxc.so directly. Some code cleanups on the way: - separate ops for lxc_execute() and lxc_start(): the factorisation is wrong here as we may have specific things to do if we're running an application container. It deserves separate ops. - lxc_arguments_dup() is merged in the pre-exec operation: this is a first use for the execute op introduced just above. It's better to build the arguments to execvp() where they're really used. Signed-off-by: Greg Kurz <gkurz@fr.ibm.com> Signed-off-by: Daniel Lezcano <dlezcano@fr.ibm.com> Cc: Cedric Le Goater <clg@fr.ibm.com>