mir/lxc
2
0
Fork 0
mirror of git://github.com/lxc/lxc synced 2025-09-01 02:53:38 +00:00
Code Issues Releases Wiki Activity

container start: clone newcgroup immediately

Browse Source 
rather than waiting and later unsharing.

This "makes the creation of a new cgroup early enough that the existing
cgroup mounts are visible.  Which means any fancy permission checks
I dream will work on a future version of liblxc."

This also includes what should be a tiny improvement regarding netns,
though it's conceivable it'll break something.  Remember that with new
kernels we need to unshare netns after we've become the root user in the
new userns, so that netns files are owned by that root.  But we were
passing the unfiltered handler->clone_flags to the original clone().
This just resulted in a temporary extra netns generation, but still
worked since our target netns, which we passed our devices into, was
created late enough.

Signed-off-by: Serge Hallyn <serge@hallyn.com>
Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
This commit is contained in:
Serge Hallyn
2016-06-25 00:05:08 -05:00
parent b2a245c2b4
commit 9fac8fbbd9
1 changed files with 5 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
src/lxc/start.c
View File

@@ -908,11 +908,6 @@ static int do_start(void *data)
devnull_fd = -1;
}
if (cgns_supported() && unshare(CLONE_NEWCGROUP) != 0) {
SYSERROR("Failed to unshare cgroup namespace");
goto out_warn_father;
}
setsid();
/* after this call, we are in error because this
@@ -1135,7 +1130,11 @@ static int lxc_spawn(struct lxc_handler *handler)
flags = handler->clone_flags;
if (handler->clone_flags & CLONE_NEWUSER)
flags &= ~CLONE_NEWNET;
handler->pid = lxc_clone(do_start, handler, handler->clone_flags);
if (cgns_supported()) {
handler->clone_flags |= CLONE_NEWCGROUP;
flags |= CLONE_NEWCGROUP;
}
handler->pid = lxc_clone(do_start, handler, flags);
if (handler->pid < 0) {
SYSERROR("failed to fork into a new namespace");
goto out_delete_net;