summaryrefslogtreecommitdiff
path: root/src/nspawn
AgeCommit message (Collapse)Author
2014-02-18sd-rtnl-message: store reference to the bus in the messageTom Gundersen
This mimics the sd-bus api, as we may need it in the future.
2014-02-17nspawn: netns_fd can be removed nowLennart Poettering
2014-02-16nspawn: typo fix in helpThomas Hindoe Paaboel Andersen
2014-02-16nspawn: add new --network-bridge= switchTom Gundersen
This adds the host side of the veth link to the given bridge. Also refactor the creation of the veth interfaces a bit to set it up from the host rather than the container. This simplifies the addition to the bridge, but otherwise the behavior is unchanged.
2014-02-15sd-rtnl: always include linux/rtnetlink.hTom Gundersen
2014-02-15sd-rtnl: message_open_container - don't take a 'size' argumentTom Gundersen
We can always know the size based on the type, so let's do this inside the library.
2014-02-14nspawn: if we don't find bash, try shLennart Poettering
2014-02-14nspawn: don't accept just any tree to executeLennart Poettering
When invoked without -D in an arbitrary directory we should not try to execute anything, make some validity checks first.
2014-02-13nspawn: make socket(AF_NETLINK, *, NETLINK_AUDIT) fail with EAFNOTSUPPORT in ↵Lennart Poettering
containers The kernel still doesn't support audit in containers, so let's make use of seccomp and simply turn it off entirely. We can get rid of this big as soon as the kernel is fixed again.
2014-02-13nspawn: add new --network-veth switch to add a virtual ethernet link to the hostLennart Poettering
2014-02-13nspawn: check with udev before we take possession of an interfaceLennart Poettering
2014-02-13nspawn: no need to subscribe to netlink messages if we just want to execute ↵Lennart Poettering
one operation
2014-02-13nspawn: --private-network should imply CAP_NET_ADMINLennart Poettering
2014-02-13rtnl: rename constructors from the form sd_rtnl_xxx_yyy_new() to ↵Lennart Poettering
sd_rtnl_xxx_new_yyy() So far we followed the rule to always indicate the "flavour" of constructors after the "_new_" or "_open_" in the function name, so let's keep things in sync here for rtnl and do the same.
2014-02-13rtnl: drop "sd_" prefix from cleanup macrosLennart Poettering
The "sd_" prefix is supposed to be used on exported symbols only, and not in the middle of names. Let's drop it from the cleanup macros hence, to make things simpler. The bus cleanup macros don't carry the "sd_" either, so this brings the APIs a bit nearer.
2014-02-13nspawn: add new --network-interface= switch to move an existing interface ↵Lennart Poettering
into the container
2014-02-13nspawn: introduce --capability=all for retaining all capabilitiesLennart Poettering
2014-02-12nspawn: newer kernels (>= 3.14) allow resetting the audit loginuid, make use ↵Lennart Poettering
of this
2014-02-11machined: optionally, allow registration of pre-existing units (scopesLennart Poettering
or services) as machine with machined
2014-02-11nspawn: add --register=yes|no switch to optionally disable registration of ↵Lennart Poettering
the container with machined
2014-02-10nspawn: add new --share-system switch to run a container without PID/UTS/IPC ↵Lennart Poettering
namespacing
2014-02-10nspawn,man: use a common vocabulary when referring to selinux security contextsLennart Poettering
Let's always call the security labels the same way: SMACK: "Smack Label" SELINUX: "SELinux Security Context" And the low-level encapsulation is called "seclabel". Now let's hope we stick to this vocabulary in future, too, and don't mix "label"s and "security contexts" and so on wildly.
2014-02-10nspawn: require /etc/os-release only for initVincent Batts
/etc/os-release is expected for the case for booting a full system, and need not be required for thin container execution.
2014-02-07nspawn: rename --file-label to --apifs-label since it's really just about ↵Lennart Poettering
the API file systems, nothing else
2014-02-06nspawn: fix HAVE_SELINUX ifdefTom Gundersen
2014-02-06nspawn: add --quiet switch for turning off any output noiseLennart Poettering
2014-02-05nspawn: always use default busLennart Poettering
2014-02-04nspawn: various fixes in selinux hookupLennart Poettering
- As suggested, prefix argument variables with "arg_" how we do this usually. - As suggested, don't involve memory allocations when storing command line arguments. - Break --help text at 80 chars - man: explain that this is about SELinux - don't do unnecessary memory allocations when putting together mount option string
2014-02-04Add SELinux support to systemd-nspawnDan Walsh
This patch adds to new options: -Z PROCESS_LABEL This specifies the process label to run on processes run within the container. -L FILE_LABEL The file label to assign to memory file systems created within the container. For example if you wanted to wrap an container with SELinux sandbox labels, you could execute a command line the following chcon system_u:object_r:svirt_sandbox_file_t:s0:c0,c1 -R /srv/container systemd-nspawn -L system_u:object_r:svirt_sandbox_file_t:s0:c0,c1 -Z system_u:system_r:svirt_lxc_net_t:s0:c0,c1 -D /srv/container /bin/sh
2014-02-01bus: update kdbus.h (ABI break)Kay Sievers
2014-01-29nspawn: fix reboot event fd reuseLennart Poettering
2014-01-20exec: introduce PrivateDevices= switch to provide services with a private /devLennart Poettering
Similar to PrivateNetwork=, PrivateTmp= introduce PrivateDevices= that sets up a private /dev with only the API pseudo-devices like /dev/null, /dev/zero, /dev/random, but not any physical devices in them.
2014-01-09nspawn: do not invoke RegisterMachine on machined from inside the new PID ↵Lennart Poettering
namespace On kdbus user credentials are not translated across PID namespaces, but simply invalidated if sender and receiver namespaces don't match. This makes it impossible to properly authenticate requests from different PID namespaces (which is probably a good thing). Hence, register the machine in the parent and not the client and properly synchronize this.
2013-12-20DEFAULT_PATH_SPLIT_USR macroShawn Landden
2013-12-13nspawn: add new --setenv= switch to set an environment variable for the ↵Lennart Poettering
container to spawn
2013-12-11nspawn: complain and continue if machine has same idZbigniew Jędrzejewski-Szmek
If --link-journal=host or --link-journal=guest is used, this totally cannot work and we exit with an error. If however --link-journal=auto or --link-journal=no is used, just display a warning. Having the same machine id can happen if booting from the same filesystem as the host. Since other things mostly function correctly, let's allow that. https://bugs.freedesktop.org/show_bug.cgi?id=68369
2013-12-12bus: connect directly via kdbus in sd_bus_open_system_container()Lennart Poettering
kdbus fortunately exposes the container's busses in the host fs, hence we can access it directly instead of doing the namespacing dance.
2013-12-06Get rid of our reimplementation of basenameZbigniew Jędrzejewski-Szmek
The only problem is that libgen.h #defines basename to point to it's own broken implementation instead of the GNU one. This can be fixed by #undefining basename.
2013-12-06nspawn: fix buggy mount_binds, now works for bind-mounted filesShawn Landden
2013-11-30nspawn: set up a kdbus namespace when starting a containerLennart Poettering
2013-11-26nspawn: improve error message when we cannot resolve the root directory argumentLennart Poettering
2013-11-20nspawn: add new --drop-capability= switchLennart Poettering
2013-11-12bus: introduce concept of a default bus for each thread and make use of it ↵Lennart Poettering
everywhere We want to emphasize bus connections as per-thread communication primitives, hence introduce a concept of a per-thread default bus, and make use of it everywhere.
2013-11-07bus: log message parsing errors everywhere with a generalized ↵Lennart Poettering
bus_log_parse_error()
2013-11-06clients: unify how we invoke getopt_long()Lennart Poettering
Among other things this makes sure we always expose a --version command and show it in the help texts.
2013-11-06nspawn: explicitly terminate machines when we exit nspawnLennart Poettering
https://bugs.freedesktop.org/show_bug.cgi?id=68370 https://bugzilla.redhat.com/show_bug.cgi?id=988883
2013-11-05nspawn: log out of memory errorsDjalal Harouni
2013-10-31machinectl: add new command to spawn a getty inside a containerLennart Poettering
2013-10-31nspawn: split out pty forwaring logic into ptyfwd.cLennart Poettering
2013-10-30nspawn: only pass in slice setting if it is setLennart Poettering
generated by cgit v1.2.3-54-g00ecf (git 2.45.2) at 2024-12-15 02:56:09 +0000