2
0
mirror of git://github.com/lxc/lxc synced 2025-08-31 09:59:34 +00:00
Commit Graph

10509 Commits

Author SHA1 Message Date
Christian Brauner
310f5976da strchrnul: include header
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
2021-04-23 09:07:39 +02:00
Christian Brauner
9bdae39f86 conf: don't allow idmapped lxc.mount.{entry,fstab} just yet
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
2021-04-23 09:07:37 +02:00
Christian Brauner
0125a899a9 conf: tweak parse_lxc_mntopts()
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
2021-04-23 09:07:36 +02:00
Christian Brauner
4f0e018646 apparmor: handle on-exec
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
2021-04-23 09:07:34 +02:00
Christian Brauner
a45cba8765 attach: use correct lxc_namespace_t type
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
2021-04-23 09:07:33 +02:00
Christian Brauner
d07d0091f4 attach: visually separate pids from fds during initalization
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
2021-04-23 09:07:31 +02:00
Christian Brauner
7597491b5a conf: verify that the rootfs can support idmapped mounts
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
2021-04-23 09:07:28 +02:00
Christian Brauner
88dff0a5fd start: documented idmapped mounts
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
2021-04-23 09:07:27 +02:00
Christian Brauner
fb9f0d8468 mount_utils: add two detached mount helpers
They'll come in handy in the future.

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
2021-04-23 09:07:26 +02:00
Christian Brauner
45e08d76c9 conf: support idmapping directories
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
2021-04-23 09:07:24 +02:00
Christian Brauner
f3dde9c37c mount_utils: add helper to determine whether new mount api supports bind mounts
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
2021-04-23 09:07:22 +02:00
Christian Brauner
39c2e2e32b storage: keep a reference to lxc_rootfs in lxc_storage
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
2021-04-23 09:07:21 +02:00
Christian Brauner
1633166b85 mount_utils: add support for mount_setattr() syscall
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
2021-04-23 09:07:20 +02:00
Christian Brauner
4c51f61472 confile: parse idmap=<path> mount option for rootfs
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
2021-04-23 09:07:19 +02:00
Christian Brauner
70e105ee18 conf: add first, trivial support for idmapped mounts
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
2021-04-23 09:07:08 +02:00
Christian Brauner
a2d701dae1 conf: rework lxc specific mount option parsing
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
2021-04-23 09:06:52 +02:00
Evgeny Vereshchagin
8b83dcdfc7 seccomp: init and destroy notifier.cookie
It's a follow-up to 84cf6d259b

Closes https://github.com/lxc/lxc/issues/3806

Signed-off-by: Evgeny Vereshchagin <evvers@ya.ru>
2021-04-23 09:06:45 +02:00
Evgeny Vereshchagin
5855f270b5 autoconf: stop passing -fsanitize=address via AM_LDFLAGS
The snippet is redundant because the build system automatically
passes the sanitizers flags set in AM_CFLAGS to the linker

Signed-off-by: Evgeny Vereshchagin <evvers@ya.ru>
2021-04-21 10:05:11 +02:00
Evgeny Vereshchagin
6b2e9a0fc6 ci: get rid of the -static-libasan stopgap
Signed-off-by: Evgeny Vereshchagin <evvers@ya.ru>
2021-04-21 10:05:10 +02:00
Evgeny Vereshchagin
bbed65ec88 build-system: stop building init.lxc.static with sanitizers
`-static` isn't compatible with `-fsanitize=`:
```
gcc: error: cannot specify -static with -fsanitize=address
```

Signed-off-by: Evgeny Vereshchagin <evvers@ya.ru>
2021-04-21 10:05:10 +02:00
Evgeny Vereshchagin
e83874ca22 autoconf: add AC_LANG_SOURCE to CC_CHECK_LDFLAGS
Inspired by https://lore.kernel.org/alsa-devel/18135209-abc9-ca1c-84e0-8ac3e75caaf1@perex.cz/t/

Signed-off-by: Evgeny Vereshchagin <evvers@ya.ru>
2021-04-21 10:05:09 +02:00
Evgeny Vereshchagin
4a0a06175e ci: make use of --enable-sanitizers instead of CFLAGS
Signed-off-by: Evgeny Vereshchagin <evvers@ya.ru>
2021-04-21 10:05:08 +02:00
Evgeny Vereshchagin
d5c1b3ab2c tests: free the buffer filled by lxc_cmd_rsp_recv
Fixes https://github.com/lxc/lxc/issues/3796

Signed-off-by: Evgeny Vereshchagin <evvers@ya.ru>
2021-04-21 10:05:07 +02:00
Evgeny Vereshchagin
c3d3cebd74 Revert "ci: get around https://github.com/lxc/lxc/issues/3796"
This reverts commit 44818e893e.

Signed-off-by: Evgeny Vereshchagin <evvers@ya.ru>
2021-04-21 10:05:06 +02:00
Evgeny Vereshchagin
e19c80075c ci: build with -Wall -Werror
Signed-off-by: Evgeny Vereshchagin <evvers@ya.ru>
2021-04-21 10:05:05 +02:00
Evgeny Vereshchagin
c20326dc6f ci: turn on strict_string_checks
Signed-off-by: Evgeny Vereshchagin <evvers@ya.ru>
2021-04-21 10:05:05 +02:00
Evgeny Vereshchagin
6856fc54ed ci: get around https://github.com/lxc/lxc/issues/3796
Signed-off-by: Evgeny Vereshchagin <evvers@ya.ru>
2021-04-21 10:05:04 +02:00
Evgeny Vereshchagin
d2139d6be5 ci: prevent lxc-exercise from running indefinitely
and show all the commands it runs to make it easier to
debug potential issues.

Signed-off-by: Evgeny Vereshchagin <evvers@ya.ru>
2021-04-21 10:05:03 +02:00
Evgeny Vereshchagin
660b74d5dc ci: get around https://github.com/lxc/lxc/issues/3788
Signed-off-by: Evgeny Vereshchagin <evvers@ya.ru>
2021-04-21 10:05:02 +02:00
Evgeny Vereshchagin
3e3f699b1e ci: get around https://github.com/lxc/lxc/issues/3798
Signed-off-by: Evgeny Vereshchagin <evvers@ya.ru>
2021-04-21 10:05:01 +02:00
Evgeny Vereshchagin
060c1b13ff ci: switch to lxc-exercise from the lxc-ci repository
Signed-off-by: Evgeny Vereshchagin <evvers@ya.ru>
2021-04-21 10:05:00 +02:00
Evgeny Vereshchagin
33132141d3 ci: link lib[au]san with init.lxc.static statically
init.lxc.static is run in arbitrary containers where the libasan library lxc has been built with
isn't always installed. To make it work let's override GCC's default and link both libasan
and libubsan statically. It should help to fix issues like
```
++ lxc-execute -n c1 -- sudo -u ubuntu /nnptest
lxc-init: error while loading shared libraries: libasan.so.5: cannot open shared object file: No such file or directory
```

Signed-off-by: Evgeny Vereshchagin <evvers@ya.ru>
2021-04-21 10:04:59 +02:00
Evgeny Vereshchagin
b347825b83 ci: an attempt to run the tests under ASan/UBsan
Signed-off-by: Evgeny Vereshchagin <evvers@ya.ru>
2021-04-21 10:04:58 +02:00
Evgeny Vereshchagin
816d252c18 apparmor: turn bytes into null-terminated strings before calling strcspn
```
==70349==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x6020000009fb at pc 0x000000433b70 bp 0x7ffcde087810 sp 0x7ffcde086fd0
READ of size 12 at 0x6020000009fb thread T0
    #0 0x433b6f in strcspn (/usr/bin/lxc-execute+0x433b6f)
    #1 0x7f720413a5cb in apparmor_process_label_get /home/runner/work/lxc/lxc/src/lxc/lsm/apparmor.c:449:8
    #2 0x7f720413bc2a in apparmor_prepare /home/runner/work/lxc/lxc/src/lxc/lsm/apparmor.c:1104:13
    #3 0x7f720409b6e9 in lxc_init /home/runner/work/lxc/lxc/src/lxc/start.c:848:8
    #4 0x7f72040a395a in __lxc_start /home/runner/work/lxc/lxc/src/lxc/start.c:2009:8
    #5 0x7f7203fc7186 in lxc_execute /home/runner/work/lxc/lxc/src/lxc/execute.c:99:9
    #6 0x7f7204000e44 in do_lxcapi_start /home/runner/work/lxc/lxc/src/lxc/lxccontainer.c:1112:9
    #7 0x7f7203ff0c07 in lxcapi_start /home/runner/work/lxc/lxc/src/lxc/lxccontainer.c:1149:8
    #8 0x4c6912 in main /home/runner/work/lxc/lxc/src/lxc/tools/lxc_execute.c:224:9
    #9 0x7f72034ac0b2 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x270b2)
    #10 0x41d93d in _start (/usr/bin/lxc-execute+0x41d93d)
+ echo ---

0x6020000009fb is located 0 bytes to the right of 11-byte region [0x6020000009f0,0x6020000009fb)
allocated by thread T0 here:
    #0 0x496399 in realloc (/usr/bin/lxc-execute+0x496399)
    #1 0x7f7203fcf85c in fd_to_buf /home/runner/work/lxc/lxc/src/lxc/file_utils.c:463:10
    #2 0x7f720413a52b in apparmor_process_label_get /home/runner/work/lxc/lxc/src/lxc/lsm/apparmor.c:442:8
    #3 0x7f720413bc2a in apparmor_prepare /home/runner/work/lxc/lxc/src/lxc/lsm/apparmor.c:1104:13
    #4 0x7f720409b6e9 in lxc_init /home/runner/work/lxc/lxc/src/lxc/start.c:848:8
    #5 0x7f72040a395a in __lxc_start /home/runner/work/lxc/lxc/src/lxc/start.c:2009:8
    #6 0x7f7203fc7186 in lxc_execute /home/runner/work/lxc/lxc/src/lxc/execute.c:99:9
    #7 0x7f7204000e44 in do_lxcapi_start /home/runner/work/lxc/lxc/src/lxc/lxccontainer.c:1112:9
    #8 0x7f7203ff0c07 in lxcapi_start /home/runner/work/lxc/lxc/src/lxc/lxccontainer.c:1149:8
    #9 0x4c6912 in main /home/runner/work/lxc/lxc/src/lxc/tools/lxc_execute.c:224:9
```

Signed-off-by: Evgeny Vereshchagin <evvers@ya.ru>
2021-04-21 10:04:55 +02:00
Christian Brauner
71c436462c commands: don't needlessly allocate
Fixes: #3796
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
2021-04-18 17:50:48 +02:00
Christian Brauner
7ed8a62218 process_utils: free stack after return
Fixes: #3789
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
2021-04-18 17:50:48 +02:00
Christian Brauner
a905c1eda8 configure: fix sanitizer compilation
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
2021-04-18 17:50:47 +02:00
Christian Brauner
370f27e167 error_utils: add missing macro.h include
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
2021-04-18 17:50:46 +02:00
Evgeny Vereshchagin
48d0042063 tests: pass on ASAN/UBSAN options to several tests
to make it easier to run them under ASan/UBSan.

Signed-off-by: Evgeny Vereshchagin <evvers@ya.ru>
2021-04-18 17:50:45 +02:00
Evgeny Vereshchagin
742467fe11 tests: stop cutting off right square brackets in share_ns
Closes https://github.com/lxc/lxc/issues/3791

Signed-off-by: Evgeny Vereshchagin <evvers@ya.ru>
2021-04-18 17:50:45 +02:00
Evgeny Vereshchagin
7b2876362f tests: switch to the "busybox" template in lxc-test-checkpoint-restore
criu can't seem to dump systemd-logind used in Ubuntu due to what appears to be
https://github.com/checkpoint-restore/criu/issues/1430.
Let's switch to busybox where all the processes hopefully can be dumped.

Closes https://github.com/lxc/lxc/issues/3792

Signed-off-by: Evgeny Vereshchagin <evvers@ya.ru>
2021-04-18 17:50:42 +02:00
Christian Brauner
42f652435c lxccontainer: fix container creation error paths
Fixes: #3782
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
2021-04-15 10:26:22 +02:00
Evgeny Vereshchagin
b4ad57ae87 tests: fix a memory leak in attach
Signed-off-by: Evgeny Vereshchagin <evvers@ya.ru>
2021-04-15 10:26:21 +02:00
Evgeny Vereshchagin
257562c244 tests: fix a memory leak in cgpath
```
==131188==ERROR: LeakSanitizer: detected memory leaks

Direct leak of 568 byte(s) in 1 object(s) allocated from:
    #0 0x7f8918943bc8 in malloc (/lib/x86_64-linux-gnu/libasan.so.5+0x10dbc8)
    #1 0x7f89181ee5a3 in lxc_container_new /home/vagrant/lxc/src/lxc/lxccontainer.c:5264
    #2 0x55ffc5022869 in test_container /home/vagrant/lxc/src/tests/cgpath.c:176
    #3 0x55ffc5023023 in main /home/vagrant/lxc/src/tests/cgpath.c:233
    #4 0x7f891709e0b2 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x270b2)
```

Signed-off-by: Evgeny Vereshchagin <evvers@ya.ru>
2021-04-15 10:26:17 +02:00
Christian Brauner
8e2ef39ba5 Revert "confile: make lxc_get_config() and lxc_get_config_net() always return non-NULL"
This reverts commit 674791ed75.

Our stable queue tool somehow still listed this patch as pending when it
had already been applied earlier.

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
2021-04-13 14:42:15 +02:00
Evgeny Vereshchagin
2cba1595e6 tests: fix a memory leak in lxcpath
```
$ sudo ./src/tests/lxc-test-lxcpath

=================================================================
==95911==ERROR: LeakSanitizer: detected memory leaks

Direct leak of 39 byte(s) in 1 object(s) allocated from:
    #0 0x7effafc8d3dd in strdup (/lib/x86_64-linux-gnu/libasan.so.5+0x963dd)
    #1 0x7effaf5a2de6 in lxcapi_config_file_name /home/vagrant/lxc/src/lxc/lxccontainer.c:3190
    #2 0x562961680c30 in main /home/vagrant/lxc/src/tests/lxcpath.c:49
    #3 0x7effae5150b2 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x270b2)

Direct leak of 21 byte(s) in 1 object(s) allocated from:
    #0 0x7effafc8d3dd in strdup (/lib/x86_64-linux-gnu/libasan.so.5+0x963dd)
    #1 0x7effaf5a2de6 in lxcapi_config_file_name /home/vagrant/lxc/src/lxc/lxccontainer.c:3190
    #2 0x56296168115e in main /home/vagrant/lxc/src/tests/lxcpath.c:77
    #3 0x7effae5150b2 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x270b2)

Direct leak of 21 byte(s) in 1 object(s) allocated from:
    #0 0x7effafc8d3dd in strdup (/lib/x86_64-linux-gnu/libasan.so.5+0x963dd)
    #1 0x7effaf5a2de6 in lxcapi_config_file_name /home/vagrant/lxc/src/lxc/lxccontainer.c:3190
    #2 0x562961680f0a in main /home/vagrant/lxc/src/tests/lxcpath.c:63
    #3 0x7effae5150b2 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x270b2)

SUMMARY: AddressSanitizer: 81 byte(s) leaked in 3 allocation(s).
```

Signed-off-by: Evgeny Vereshchagin <evvers@ya.ru>
2021-04-13 14:35:37 +02:00
Evgeny Vereshchagin
e46bffbb19 tests: fix a memory leak in cgpath
```
$ sudo ./src/tests/lxc-test-cgpath
Container creation tests...Passed
Container creation with LXCPATH tests...Passed

=================================================================
==57206==ERROR: LeakSanitizer: detected memory leaks

Direct leak of 296 byte(s) in 1 object(s) allocated from:
    #0 0x7fef22c27dc6 in calloc (/lib/x86_64-linux-gnu/libasan.so.5+0x10ddc6)
    #1 0x557c6e3ce3d9 in cgroup_ops_init cgroups/cgfsng.c:3347
    #2 0x557c6e3d6516 in cgroup_init cgroups/cgroup.c:33
    #3 0x557c6e3788e2 in test_running_container /home/vagrant/lxc/src/tests/cgpath.c:102
    #4 0x557c6e379c69 in test_container /home/vagrant/lxc/src/tests/cgpath.c:197
    #5 0x557c6e379e37 in main /home/vagrant/lxc/src/tests/cgpath.c:233
    #6 0x7fef2136c0b2 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x270b2)

Direct leak of 296 byte(s) in 1 object(s) allocated from:
    #0 0x7fef22c27dc6 in calloc (/lib/x86_64-linux-gnu/libasan.so.5+0x10ddc6)
    #1 0x557c6e3ce3d9 in cgroup_ops_init cgroups/cgfsng.c:3347
    #2 0x557c6e3d6516 in cgroup_init cgroups/cgroup.c:33
    #3 0x557c6e3788e2 in test_running_container /home/vagrant/lxc/src/tests/cgpath.c:102
    #4 0x557c6e379c69 in test_container /home/vagrant/lxc/src/tests/cgpath.c:197
    #5 0x557c6e379e61 in main /home/vagrant/lxc/src/tests/cgpath.c:237
    #6 0x7fef2136c0b2 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x270b2)
```

Signed-off-by: Evgeny Vereshchagin <evvers@ya.ru>
2021-04-13 14:35:36 +02:00
Christian Brauner
674791ed75 confile: make lxc_get_config() and lxc_get_config_net() always return non-NULL
Introduce the concept of an unsupported config item.

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
2021-04-13 14:35:29 +02:00
Christian Brauner
9c75153c5c Revert "rexec: mark all fds as close-on-exec if possible"
This reverts commit 531d36ad00.

Callers might want to explicilty inhert file descriptors so we can't
close them behind their back when we exec.

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
2021-04-12 19:49:05 +02:00
Christian Brauner
0c167942df attach: don't return early when calculating namespaces via pidfd
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
2021-04-12 19:49:04 +02:00