summaryrefslogtreecommitdiff
path: root/src/nspawn
AgeCommit message (Collapse)Author
2015-05-21nspawn: prohibit access to the kernel log buffer by defaultLennart Poettering
Unless CAP_SYSLOG is explicitly passed block all access to kmg
2015-05-21util: introduce PERSONALITY_INVALID as macro for 0xffffffffLULennart Poettering
2015-05-21nspawn: finish user namespace supportLennart Poettering
2015-05-20core,nspawn: unify code that moves the root dirLennart Poettering
2015-05-18nspawn: close extra fds before execing initAlban Crequy
When systemd-nspawn gets exec*()ed, it inherits the followings file descriptors: - 0, 1, 2: stdin, stdout, stderr - SD_LISTEN_FDS_START, ... SD_LISTEN_FDS_START+LISTEN_FDS: file descriptors passed by the system manager (useful for socket activation). They are passed to the child process (process leader). - extra lock fd: rkt passes a locked directory as an extra fd, so the directory remains locked as long as the container is alive. systemd-nspawn used to close all open fds except 0, 1, 2 and the SD_LISTEN_FDS_START..SD_LISTEN_FDS_START+LISTEN_FDS. This patch delays the close just before the exec so the nspawn process (parent) keeps the extra fds open. This patch supersedes the previous attempt ("cloexec extraneous fds"): http://lists.freedesktop.org/archives/systemd-devel/2015-May/031608.html
2015-05-18util: split all hostname related calls into hostname-util.cLennart Poettering
2015-05-14nspawn: allow access to device nodes listed in --bind= and --bind-ro= switchesStefan Junker
https://bugs.freedesktop.org/show_bug.cgi?id=90385
2015-05-13nspawn: skip symlink to a combined cgroup hierarchy if it already existsIago López Galeiras
If a symlink to a combined cgroup hierarchy already exists and points to the right path, skip it. This avoids an error when the cgroups are set manually before calling nspawn.
2015-05-13nspawn: only mount the cgroup root if it's not already mountedIago López Galeiras
This allows the user to set the cgroups manually before calling nspawn.
2015-05-13nspawn: rework custom mount point order, and add support for overlayfsLennart Poettering
Previously all bind mount mounts were applied in the order specified, followed by all tmpfs mounts in the order specified. This is problematic, if bind mounts shall be placed within tmpfs mounts. This patch hence reworks the custom mount point logic, and alwas applies them in strict prefix-first order. This means the order of mounts specified on the command line becomes irrelevant, the right operation will always be executed. While we are at it this commit also adds native support for overlayfs mounts, as supported by recent kernels.
2015-05-11nspawn: pass on kill signal setting to contaner scopeLennart Poettering
Let's just pass on what the user set for us.
2015-04-28nspawn: when run as a service, don't ask machined for terminatin of ourselvesLennart Poettering
2015-04-28nspawn: make sure we install the device policy if nspawn is run as unit as ↵Lennart Poettering
on the command line
2015-04-22nspawn: don't inherit read-only flag from disk image if --ephemeral is usedLennart Poettering
When --ephemeral is used there's no need to keep the image read-only, so let's not do that then.
2015-04-21tree-wide: get rid of more strerror() callsLennart Poettering
2015-04-11shared: add terminal-util.[ch]Ronny Chevalier
2015-04-11shared: add random-util.[ch]Ronny Chevalier
2015-04-10shared: add process-util.[ch]Ronny Chevalier
2015-04-10shared: add formats-util.hRonny Chevalier
2015-04-07path-util: fix more path_is_mount e792e890f falloutLennart Poettering
2015-04-06btrfs: add support for recursive btrfs snapshottingLennart Poettering
2015-04-06btrfs: make btrfs_subvol_snapshot() parameters a flags fieldLennart Poettering
2015-04-06btrfs: support recursively removing btrfs snapshotsLennart Poettering
2015-04-06util: rework rm_rf() logicLennart Poettering
- Move to its own file rm-rf.c - Change parameters into a single flags parameter - Remove "honour sticky" logic, it's unused these days
2015-03-31nspawn: fallback on bind mount when mknod failsAlban Crequy
Some systems abusively restrict mknod, even when the device node already exists in /dev. This is unfortunate because it prevents systemd-nspawn from creating the basic devices in /dev in the container. This patch implements a workaround: when mknod fails, fallback on bind mounts. Additionally, /dev/console was created with a mknod with the same major/minor as /dev/null before bind mounting a pts on it. This patch removes the mknod and creates an empty regular file instead. In order to test this patch, I used the following configuration, which I think should replicate the system with the abusive restriction on mknod: # grep devices /proc/self/cgroup 4:devices:/user.slice/restrict # cat /sys/fs/cgroup/devices/user.slice/restrict/devices.list c 1:9 r c 5:2 rw c 136:* rw # systemd-nspawn --register=false -D . v2: - remove "bind", it is not needed since there is already MS_BIND v3: - fix error management when calling touch() - fix lowercase in error message
2015-03-31nspawn: drop sd_booted() checkLennart Poettering
We have no such check in any of the other tools, hence don't have one in nspawn either. (This should make things nicer for Rocket, among other things) Note: removing this check does not mean that we support running nspawn on non-systemd. We explicitly don't. It just means that we remove the check for running it like that. You are still on your own if you do...
2015-03-31nspawn: change filesystem type from "bind" to NULL in mount() syscallsIago López Galeiras
Try to keep syscalls as minimal as possible.
2015-03-13nspawn: tell coverity that we ignore return valueZbigniew Jędrzejewski-Szmek
CID #1271353.
2015-03-13tree-wide: there is no ENOTSUP on linuxDavid Herrmann
Replace ENOTSUP by EOPNOTSUPP as this is what linux actually uses.
2015-03-07nspawn: fix use-after-free and leak in error pathsZbigniew Jędrzejewski-Szmek
CID #1257765.
2015-03-04nspawn: Map all seccomp filters to capabilitiesJay Faulkner
This change makes it so all seccomp filters are mapped to the appropriate capability and are only added if that capability was not requested when running the container. This unbreaks the remaining use cases broken by the addition of seccomp filters without respecting requested capabilities. Co-Authored-By: Clif Houck <me@clifhouck.com> [zj: - adapt to our coding style, make struct anonymous]
2015-02-25nspawn: make kill signal to use for PID 1 configurableLennart Poettering
2015-02-23remove unused includesThomas Hindoe Paaboel Andersen
This patch removes includes that are not used. The removals were found with include-what-you-use which checks if any of the symbols from a header is in use.
2015-02-23nspawn: fix whitespace and typo in partition table blurbJan Synacek
2015-02-19nspawn: chown basic device nodes to userns rootLennart Poettering
2015-02-19nspawn: fix build on non-selinux systemsLennart Poettering
2015-02-19nspawn: add basic user namespacing supportLennart Poettering
(This is incomplete, /proc and /sys are still owned by root from outside the container, not inside)
2015-02-18nspawn: when connected to pipes for stdin/stdout, pass them as-is to PID 1Lennart Poettering
Previously we always invoked the container PID 1 on /dev/console of the container. With this change we do so only if nspawn was invoked interactively (i.e. its stdin/stdout was connected to a TTY). In all other cases we directly pass through the fds unmodified. This has the benefit that nspawn can be added into shell pipelines. https://bugs.freedesktop.org/show_bug.cgi?id=87732
2015-02-18nspawn: add support for --property= to set scope propertiesLennart Poettering
This is similar to systemd-run's --property= setting.
2015-02-04nspawn: Allow module loading if CAP_SYS_MODULE is requestedJay Faulkner
nspawn containers currently block module loading in all cases, with no option to disable it. This allows an admin, specifically setting capability=CAP_SYS_MODULE or capability=all to load modules.
2015-02-03util: rework strappenda(), and rename it strjoina()Lennart Poettering
After all it is now much more like strjoin() than strappend(). At the same time, add support for NULL sentinels, even if they are normally not necessary.
2015-02-02remove unused variablesThomas Hindoe Paaboel Andersen
2015-01-23nspawn: when mounting the cgroup hierarchies, use the exact same mount ↵Lennart Poettering
options for the superblock as the host Otherwise we'll generate kernel runtime warnings about non-matching mount options.
2015-01-23nspawn: mount /tmp in the container, don't leave this to the container's initLennart Poettering
We really want /tmp to be properly mounted, especially in containers that lack CAP_SYS_ADMIN or that are not fully booted up and only get a shell, hence let's do so in nspawn already.
2015-01-23nspawn: allow bind-mounting char and block filesAlban Crequy
2015-01-20nspawn: work around kernel bug with partition table probing on loopback devicesLennart Poettering
When we set up a loopback device with partition probing, the udev "change" event about the configured device is first passed on to userspace, only the the in-kernel partition prober is started. Since partition probing fails with EBUSY when somebody has the device open, the probing frequently fails since udev starts probing/opening the device as soon as it gets the notification about it, and it might do so earlier than the kernel probing. This patch adds a (hopefully temporary) work-around for this, that compares the number of probed partitions of the kernel with those of blkid and synchronously asks for reprobing until the numebrs are in sync. This really deserves a proper kernel fix.
2015-01-20nspawn: add ipvlan supportTom Gundersen
2015-01-19nspawn: support dissecting GPT images that contain only a single generic ↵Lennart Poettering
linux partition This should allow running Ubuntu UEFI GPT Images with nspawn, unmodified.
2015-01-19inspawn: wait until udev has probed a loopback device before making us of itLennart Poettering
2015-01-15nspawn: fix log typosJonathan Boulle