- 18 7月, 2013 9 次提交
-
-
由 Michal Privoznik 提交于
The activeUsbHostdevs item in LXCDriver are lockable, but the lock has to be called explicitly. Call the virObject(Un)Lock() in order to achieve mutual exclusion once lxcDriverLock is removed.
-
由 Michal Privoznik 提交于
The 'driver->caps' pointer can be changed on the fly. Accessing it currently requires the global driver lock. Isolate this access in a single helper, so a future patch can relax the locking constraints.
-
由 Michal Privoznik 提交于
-
由 Michal Privoznik 提交于
Annotate the fields in virLXCDriverPtr to indicate the locking rules for their use.
-
由 Michal Privoznik 提交于
-
由 Michal Privoznik 提交于
Currently the virLXCDriverPtr struct contains an wide variety of data with varying access needs. Move all the static config data into a dedicated virLXCDriverConfigPtr object. The only locking requirement is to hold the driver lock, while obtaining an instance of virLXCDriverConfigPtr. Once a reference is held on the config object, it can be used completely lockless since it is immutable. NB, not all APIs correctly hold the driver lock while getting a reference to the config object in this patch. This is safe for now since the config is never updated on the fly. Later patches will address this fully.
-
由 Michal Privoznik 提交于
It is not used anywhere, so it makes no sense to have it there.
-
由 Daniel P. Berrange 提交于
Merge the virCommandPreserveFD / virCommandTransferFD methods into a single virCommandPasFD method, and use a new VIR_COMMAND_PASS_FD_CLOSE_PARENT to indicate their difference in behaviour Signed-off-by: NDaniel P. Berrange <berrange@redhat.com>
-
由 Daniel P. Berrange 提交于
Wire up the new virDomainCreate{XML}WithFiles methods in the LXC driver, so that FDs get passed down to the init process. The lxc_container code needs to do a little dance in order to renumber the file descriptors it receives into linear order, starting from STDERR_FILENO + 1. Signed-off-by: NDaniel P. Berrange <berrange@redhat.com>
-
- 17 7月, 2013 2 次提交
-
-
由 Michal Privoznik 提交于
Commit 75c12564 states that virGetGroupList must not be called between fork and exec, then commit ee777e99 promptly violated that for lxc. Patch originally posted by Eric Blake <eblake@redhat.com>.
-
由 Michal Privoznik 提交于
Currently, if the primary security driver is 'none', we skip initializing caps->host.secModels. This means, later, when LXC domain XML is parsed and <seclabel type='none'/> is found (see virSecurityLabelDefsParseXML), the model name is not copied to the seclabel. This leads to subsequent crash in virSecurityManagerGenLabel where we call STREQ() over the model (note, that we are expecting model to be !NULL).
-
- 16 7月, 2013 7 次提交
-
-
由 Gao feng 提交于
The owner of this host devices should be the root user of container. Signed-off-by: NGao feng <gaofeng@cn.fujitsu.com>
-
由 Gao feng 提交于
These host devices are created for container, the owner should be the root user of container. Signed-off-by: NGao feng <gaofeng@cn.fujitsu.com>
-
由 Gao feng 提交于
Otherwise the container will fail to start if we enable user namespace, since there is no rights to do mknod in uninit user namespace. Signed-off-by: NGao feng <gaofeng@cn.fujitsu.com>
-
由 Gao feng 提交于
The owner of this disk device should be the root user of container. Signed-off-by: NGao feng <gaofeng@cn.fujitsu.com>
-
由 Gao feng 提交于
lxc driver will use this function to change the owner of hot added devices. Move virLXCControllerChown to lxc_container.c and Rename it to lxcContainerChown. Signed-off-by: NGao feng <gaofeng@cn.fujitsu.com>
-
由 Gao feng 提交于
These disk devices are created for container, the owner should be the root user of container. Signed-off-by: NGao feng <gaofeng@cn.fujitsu.com>
-
由 Gao feng 提交于
Since mknod in container is forbidden, we should setup disks on host side. Signed-off-by: NGao feng <gaofeng@cn.fujitsu.com>
-
- 12 7月, 2013 3 次提交
-
-
由 Daniel P. Berrange 提交于
When failing to start a container due to inaccessible root filesystem path, we did not log any meaningful error. Add a few debug statements to assist diagnosis Signed-off-by: NDaniel P. Berrange <berrange@redhat.com>
-
由 Eric Blake 提交于
https://bugzilla.redhat.com/show_bug.cgi?id=964358 POSIX states that multi-threaded apps should not use functions that are not async-signal-safe between fork and exec, yet we were using getpwuid_r and initgroups. Although rare, it is possible to hit deadlock in the child, when it tries to grab a mutex that was already held by another thread in the parent. I actually hit this deadlock when testing multiple domains being started in parallel with a command hook, with the following backtrace in the child: Thread 1 (Thread 0x7fd56bbf2700 (LWP 3212)): #0 __lll_lock_wait () at ../nptl/sysdeps/unix/sysv/linux/x86_64/lowlevellock.S:136 #1 0x00007fd5761e7388 in _L_lock_854 () from /lib64/libpthread.so.0 #2 0x00007fd5761e7257 in __pthread_mutex_lock (mutex=0x7fd56be00360) at pthread_mutex_lock.c:61 #3 0x00007fd56bbf9fc5 in _nss_files_getpwuid_r (uid=0, result=0x7fd56bbf0c70, buffer=0x7fd55c2a65f0 "", buflen=1024, errnop=0x7fd56bbf25b8) at nss_files/files-pwd.c:40 #4 0x00007fd575aeff1d in __getpwuid_r (uid=0, resbuf=0x7fd56bbf0c70, buffer=0x7fd55c2a65f0 "", buflen=1024, result=0x7fd56bbf0cb0) at ../nss/getXXbyYY_r.c:253 #5 0x00007fd578aebafc in virSetUIDGID (uid=0, gid=0) at util/virutil.c:1031 #6 0x00007fd578aebf43 in virSetUIDGIDWithCaps (uid=0, gid=0, capBits=0, clearExistingCaps=true) at util/virutil.c:1388 #7 0x00007fd578a9a20b in virExec (cmd=0x7fd55c231f10) at util/vircommand.c:654 #8 0x00007fd578a9dfa2 in virCommandRunAsync (cmd=0x7fd55c231f10, pid=0x0) at util/vircommand.c:2247 #9 0x00007fd578a9d74e in virCommandRun (cmd=0x7fd55c231f10, exitstatus=0x0) at util/vircommand.c:2100 #10 0x00007fd56326fde5 in qemuProcessStart (conn=0x7fd53c000df0, driver=0x7fd55c0dc4f0, vm=0x7fd54800b100, migrateFrom=0x0, stdin_fd=-1, stdin_path=0x0, snapshot=0x0, vmop=VIR_NETDEV_VPORT_PROFILE_OP_CREATE, flags=1) at qemu/qemu_process.c:3694 ... The solution is to split the work of getpwuid_r/initgroups into the unsafe portions (getgrouplist, called pre-fork) and safe portions (setgroups, called post-fork). * src/util/virutil.h (virSetUIDGID, virSetUIDGIDWithCaps): Adjust signature. * src/util/virutil.c (virSetUIDGID): Add parameters. (virSetUIDGIDWithCaps): Adjust clients. * src/util/vircommand.c (virExec): Likewise. * src/util/virfile.c (virFileAccessibleAs, virFileOpenForked) (virDirCreate): Likewise. * src/security/security_dac.c (virSecurityDACSetProcessLabel): Likewise. * src/lxc/lxc_container.c (lxcContainerSetID): Likewise. * configure.ac (AC_CHECK_FUNCS_ONCE): Check for setgroups, not initgroups. Signed-off-by: NEric Blake <eblake@redhat.com>
-
由 John Ferlan 提交于
Recent changes uncovered a NEGATIVE_RETURNS in the return from sysconf() when processing a for loop in virtTestCaptureProgramExecChild() in testutils.c Code review uncovered 3 other code paths with the same condition that weren't found by Covirity, so fixed those as well.
-
- 11 7月, 2013 2 次提交
-
-
由 Gao feng 提交于
these parameters shouldn't be marked as ATTRIBUTE_UNUSED. Signed-off-by: NGao feng <gaofeng@cn.fujitsu.com>
-
由 Daniel P. Berrange 提交于
Convert the type of loop iterators named 'i', 'j', k', 'ii', 'jj', 'kk', to be 'size_t' instead of 'int' or 'unsigned int', also santizing 'ii', 'jj', 'kk' to use the normal 'i', 'j', 'k' naming Signed-off-by: NDaniel P. Berrange <berrange@redhat.com>
-
- 10 7月, 2013 2 次提交
-
-
由 Michal Privoznik 提交于
-
由 Michal Privoznik 提交于
Similarly to VIR_STRDUP, we want the OOM error to be reported in VIR_ALLOC and friends.
-
- 09 7月, 2013 3 次提交
-
-
由 Gao feng 提交于
Create parent directroy for hostdev automatically when we start a lxc domain or attach a hostdev to a lxc domain. Signed-off-by: NGao feng <gaofeng@cn.fujitsu.com>
-
由 Gao feng 提交于
This helper function is used to create parent directory for the hostdev which will be added to the container. If the parent directory of this hostdev doesn't exist, the mknod of the hostdev will fail. eg with /dev/net/tun Signed-off-by: NGao feng <gaofeng@cn.fujitsu.com>
-
由 Richard Weinberger 提交于
Many applications use /dev/tty to read from stdin. e.g. zypper on openSUSE. Let's create this device node to unbreak those applications. As /dev/tty is a synonym for the current controlling terminal it cannot harm the host or any other containers. Signed-off-by: NRichard Weinberger <richard@nod.at>
-
- 03 7月, 2013 3 次提交
-
-
由 Daniel P. Berrange 提交于
Ensure that all APIs which list domain objects filter them against the access control system. Signed-off-by: NDaniel P. Berrange <berrange@redhat.com>
-
由 Gao feng 提交于
libivrt lxc can only set generic weight for container, This patch allows user to setup per device blkio weigh for container. Signed-off-by: NGao feng <gaofeng@cn.fujitsu.com>
-
由 Gao feng 提交于
We forgot to free the stack when Kernel doesn't support user namespace. Signed-off-by: NGao feng <gaofeng@cn.fujitsu.com>
-
- 02 7月, 2013 9 次提交
-
-
由 Daniel P. Berrange 提交于
Add some debug logging of LXC wait/continue messages and uid/gid map update code.
-
由 Daniel P. Berrange 提交于
User namespaces will deny the ability to mount the SELinux filesystem. This is harmless for libvirt's LXC needs, so the error can be ignored. Signed-off-by: NDaniel P. Berrange <berrange@redhat.com>
-
由 Gao feng 提交于
The owner of the /proc/meminfo in container should be the root user of container. Signed-off-by: NGao feng <gaofeng@cn.fujitsu.com>
-
由 Gao feng 提交于
These files are created for container, the owner should be the root user of container. Signed-off-by: NGao feng <gaofeng@cn.fujitsu.com>
-
由 Gao feng 提交于
Since these devices are created for the container. the owner should be the root user of the container. Signed-off-by: NGao feng <gaofeng@cn.fujitsu.com>
-
由 Gao feng 提交于
container will create /dev/pts directory in /dev. the owner of /dev should be the root user of container. Signed-off-by: NGao feng <gaofeng@cn.fujitsu.com>
-
由 Gao feng 提交于
Since these tty devices will be used by container, the owner of them should be the root user of container. This patch also adds a new function virLXCControllerChown, we can use this general function to change the owner of files. Signed-off-by: NGao feng <gaofeng@cn.fujitsu.com>
-
由 Gao feng 提交于
user namespace doesn't allow to create devices in uninit userns. We should create devices on host side. We first mount tmpfs on dev directroy under state dir of container. then create devices under this dev dir. Finally in container, mount the dev directroy created on host to the /dev/ directroy of container. Signed-off-by: NGao feng <gaofeng@cn.fujitsu.com>
-
由 Gao feng 提交于
This patch introduces new helper function virLXCControllerSetupUserns, in this function, we set the files uid_map and gid_map of the init task of container. lxcContainerSetID is used for creating cred for tasks running in container. Since after setuid/setgid, we may be a new user. This patch calls lxcContainerSetUserns at first to make sure the new created files belong to right user. Signed-off-by: NGao feng <gaofeng@cn.fujitsu.com>
-