mir/lxc
2
0
Fork 0
mirror of git://github.com/lxc/lxc synced 2025-08-31 19:52:32 +00:00
Code Issues Releases Wiki Activity

start: lxc_setup() after unshare(CLONE_NEWCGROUP)

Browse Source 
When the running kernel supports cgroup namespaces and users want to manually
set up cgroups via lxc.hook.mount before the init binary starts the cgroup
namespace needs to be already unshared. Otherwise the view on the cgroup mounts
is wrong. This commit places the call to lxc_setup() after the
LXC_SYNC_POST_CGROUP barrier.

Before this commit, the tty fds we allocate from a fresh devpts instance in the
container's namespaces before the init binary starts were referring to the
host's cgroup namespace since lxc_setup() was called before
unshare(CLONE_NEWCGROUP). Although not a security risk at this point since
setns() restricts its calls to /proc/<self>/ns files it's still better to do it
*after* the cgroup namespace has been unshared.

Adding a Suggested-by line for the lxc.mount.hook fix for Quentin.

Closes #1597.

Suggested-by: Quentin Dufour <quentin@dufour.tk>
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
This commit is contained in:
Christian Brauner
2017-06-01 05:23:12 +02:00
parent fa1bafd3f0
commit f4152036dd
3 changed files with 22 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
src/lxc/conf.c
View File

@@ -4237,7 +4237,7 @@ int lxc_setup(struct lxc_handler *handler)
return -1;
}
NOTICE("'%s' is setup.", name);
NOTICE("Container \"%s\" is set up", name);
return 0;
}

31
src/lxc/start.c
View File

@@ -1012,12 +1012,6 @@ static int do_start(void *data)
"standard file descriptors. Migration will not work.");
}
/* Setup the container, ip, names, utsname, ... */
if (lxc_setup(handler)) {
ERROR("Failed to setup container \"%s\".", handler->name);
goto out_warn_father;
}
/* Ask father to setup cgroups and wait for him to finish. */
if (lxc_sync_barrier_parent(handler, LXC_SYNC_CGROUP))
goto out_error;
@@ -1042,6 +1036,12 @@ static int do_start(void *data)
INFO("Unshared CLONE_NEWCGROUP.");
}
/* Setup the container, ip, names, utsname, ... */
if (lxc_setup(handler)) {
ERROR("Failed to setup container \"%s\".", handler->name);
goto out_warn_father;
}
/* Set the label to change to when we exec(2) the container's init. */
if (lsm_process_label_set(NULL, handler->conf, 1, 1) < 0)
goto out_warn_father;
@@ -1161,6 +1161,9 @@ static int do_start(void *data)
setsid();
if (lxc_sync_barrier_parent(handler, LXC_SYNC_CGROUP_LIMITS))
goto out_warn_father;
/* After this call, we are in error because this ops should not return
* as it execs.
*/
@@ -1485,20 +1488,18 @@ static int lxc_spawn(struct lxc_handler *handler)
goto out_delete_net;
}
if (lxc_sync_barrier_child(handler, LXC_SYNC_CGROUP_UNSHARE))
goto out_delete_net;
if (!cgroup_setup_limits(handler, true)) {
ERROR("Failed to setup the devices cgroup for container \"%s\".", name);
goto out_delete_net;
}
TRACE("Set up cgroup device limits");
cgroup_disconnect();
cgroups_connected = false;
/* Read tty fds allocated by child. */
if (lxc_recv_ttys_from_child(handler) < 0) {
ERROR("Failed to receive tty info from child process.");
goto out_delete_net;
}
/* Tell the child to complete its initialization and wait for it to exec
* or return an error. (The child will never return
* LXC_SYNC_POST_CGROUP+1. It will either close the sync pipe, causing
@@ -1508,6 +1509,12 @@ static int lxc_spawn(struct lxc_handler *handler)
if (lxc_sync_barrier_child(handler, LXC_SYNC_POST_CGROUP))
return -1;
/* Read tty fds allocated by child. */
if (lxc_recv_ttys_from_child(handler) < 0) {
ERROR("Failed to receive tty info from child process.");
goto out_delete_net;
}
if (handler->ops->post_start(handler, handler->data))
goto out_abort;

2
src/lxc/sync.h
View File

@@ -30,6 +30,8 @@ enum {
LXC_SYNC_CONFIGURE,
LXC_SYNC_POST_CONFIGURE,
LXC_SYNC_CGROUP,
LXC_SYNC_CGROUP_UNSHARE,
LXC_SYNC_CGROUP_LIMITS,
LXC_SYNC_POST_CGROUP,
LXC_SYNC_RESTART,
LXC_SYNC_POST_RESTART,