New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

cgroups/cgfsng: fixes, features, and improved cgroup2 handling #1891

Merged
merged 10 commits into from Nov 7, 2017

Conversation

3 participants
@brauner
Member

brauner commented Oct 31, 2017

Signed-off-by: Christian Brauner christian.brauner@ubuntu.com

@brauner brauner added the Incomplete label Oct 31, 2017

@brauner

This comment has been minimized.

Show comment
Hide comment
@brauner

brauner Nov 1, 2017

Member

Note that for unprivileged containers that - for whatever strange reason - still drop CAP_SYS_ADMIN in their own user namespace we only ever mount hierarchies that are writable by she container. I think this is more secure and correct behavior because it means that any hierarchy in which the container is not placed into its own writable cgroup will not be visible to it and the container also won't be able to mount it by itself. This prevents quite some information leaks.

Member

brauner commented Nov 1, 2017

Note that for unprivileged containers that - for whatever strange reason - still drop CAP_SYS_ADMIN in their own user namespace we only ever mount hierarchies that are writable by she container. I think this is more secure and correct behavior because it means that any hierarchy in which the container is not placed into its own writable cgroup will not be visible to it and the container also won't be able to mount it by itself. This prevents quite some information leaks.

@brauner brauner removed the Incomplete label Nov 1, 2017

brauner added some commits Oct 31, 2017

cgroups/cgfsng: keep mountpoint intact
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
cgroups/cgfsng: cgfsns_chown() -> cgfsng_chown()
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
cgroups/cgfsng: make sure pointer is NULL
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
cgroups/cgfsng: support MS_READONLY with cgroup ns
If we lack CAP_SYS_ADMIN this is really useful.

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
log: check for i/o error with vsnprintf()
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
cgroupfs/cgfsng: tweak logging
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
cgroups/cgfsng: fix get_controllers() for cgroup2
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
cgroupfs/cgfsng: improve cgroup2 handling
This fixes a bunch of bugs.

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
config: remove SIGRTMIN+14 as lxc.signal.stop
We want to be able to SIGKILL an Archlinux container.

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
cgroups/cgfsng: remove is_lxcfs()
We don't need to parse fuse.lxcfs entries.

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

@lxc lxc deleted a comment from lxc-jenkins Nov 7, 2017

@lxc lxc deleted a comment from lxc-jenkins Nov 7, 2017

@lxc lxc deleted a comment from lxc-jenkins Nov 7, 2017

@lxc lxc deleted a comment from lxc-jenkins Nov 7, 2017

@lxc lxc deleted a comment from lxc-jenkins Nov 7, 2017

@lxc lxc deleted a comment from lxc-jenkins Nov 7, 2017

@lxc lxc deleted a comment from lxc-jenkins Nov 7, 2017

@lxc lxc deleted a comment from lxc-jenkins Nov 7, 2017

@lxc lxc deleted a comment from lxc-jenkins Nov 7, 2017

@lxc lxc deleted a comment from lxc-jenkins Nov 7, 2017

@lxc lxc deleted a comment from lxc-jenkins Nov 7, 2017

@lxc-jenkins

This comment has been minimized.

Show comment
Hide comment
@lxc-jenkins

lxc-jenkins Nov 7, 2017

Testsuite passed

lxc-jenkins commented Nov 7, 2017

Testsuite passed

@hallyn

This comment has been minimized.

Show comment
Hide comment
@hallyn

hallyn Nov 7, 2017

Member

Looks good, though the last patch seems misplaced.

Member

hallyn commented Nov 7, 2017

Looks good, though the last patch seems misplaced.

@hallyn hallyn merged commit 29e4eb3 into lxc:master Nov 7, 2017

4 checks passed

Branch target Branch target is correct
Details
Signed-off-by All commits signed-off
Details
Testsuite Testsuite passed
Details
continuous-integration/travis-ci/pr The Travis CI build passed
Details
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment