mirror/runc
1
0
Fork 0
mirror of https://github.com/opencontainers/runc.git synced 2026-07-12 09:46:25 +08:00
Code Issues Packages Projects Releases Wiki Activity
2,458 Commits 7 Branches 82 Tags
b7219cc2b34588e523eb0a53f1f69c7eacdb6d60
Commit Graph

536 Commits

Author SHA1 Message Date
Peng Gao b7219cc2b3 Update nsenter README 
Signed-off-by: Peng Gao <peng.gao.dut@gmail.com>
 2016-05-14 22:38:43 +08:00
Aleksa Sarai e991f041a1 Revert "Need to make sure labels applied to /dev" 
Signed-off-by: Aleksa Sarai <asarai@suse.de>
 2016-05-11 23:28:01 +10:00
Kenfe-Mickael Laventure 27814ee120 Allow updating kmem.limit_in_bytes if initialized at cgroup creation 
Signed-off-by: Kenfe-Mickael Laventure <mickael.laventure@gmail.com>
 2016-05-06 08:05:15 -07:00
rajasec cb04f48486 Updating error condition in applying apparmor profile 
Signed-off-by: rajasec <rajasec79@gmail.com>
 2016-05-04 19:10:55 +05:30
Dan Walsh 77f312c51c Need to make sure labels applied to /dev 
Signed-off-by: Dan Walsh <dwalsh@redhat.com>
 2016-05-02 08:17:49 -04:00
Michael Crosby e87c59e2e4 Merge pull request #793 from bboreham/label-sep 
Use '=' instead of ':' separator on labels
 2016-04-29 15:19:28 -07:00
Jim Berlage c5b0caf76d Correct outdated URL 
`libcontainer/cgroups/utils.go` uses an incorrect path to the
documentation for cgroups.  This updates the comment to use the correct
URL.  Fixes #794.

Signed-off-by: Jim Berlage <james.berlage@gmail.com>
 2016-04-29 10:44:27 -05:00
Bryan Boreham 4a87beb661 Use '=' instead of ':' separator on labels, which is now deprecated by Docker 
Signed-off-by: Bryan Boreham <bjboreham@gmail.com>
 2016-04-29 13:01:44 +01:00
Justin Cormack e18de63108 If possible, apply seccomp rules immediately before exec 
See https://github.com/docker/docker/issues/22252

Previously we would apply seccomp rules before applying
capabilities, because it requires CAP_SYS_ADMIN. This
however means that a seccomp profile needs to allow
operations such as setcap() and setuid() which you
might reasonably want to disallow.

If prctl(PR_SET_NO_NEW_PRIVS) has been applied however
setting a seccomp filter is an unprivileged operation.
Therefore if this has been set, apply the seccomp
filter as late as possible, after capabilities have
been dropped and the uid set.

Note a small number of syscalls will take place
after the filter is applied, such as `futex`,
`stat` and `execve`, so these still need to be allowed
in addition to any the program itself needs.

Signed-off-by: Justin Cormack <justin.cormack@docker.com>
 2016-04-27 20:06:14 +01:00
Mrunal Patel 091ed0b043 Merge pull request #777 from cyphar/fix-null-pointer-deref 
libcontainer: specconv: fix nil dereference in resource setup
 2016-04-24 19:09:30 -07:00
Aleksa Sarai a939c7ecd9 libcontainer: specconv: fix nil dereference in resource setup 
This caused issues if someone omitted or set "resources": null, in the
runC config. The panic follows.

panic: runtime error: invalid memory address or nil pointer dereference
[signal 0xb code=0x1 addr=0x20 pc=0x545b53]

goroutine 1 [running]:
panic(0x7aed40, 0xc820014260)
        /usr/lib64/go/src/runtime/panic.go:464 +0x3e6
github.com/opencontainers/runc/libcontainer/specconv.CreateLibcontainerConfig(0xc8200b0e30, 0x836480, 0x0, 0x0)
        /home/cyphar/src/runc/Godeps/_workspace/src/github.com/opencontainers/runc/libcontainer/specconv/spec_linux.go:222 +0xe83
main.createContainer(0xc82007eb40, 0x7ffd8024e439, 0x4, 0xc82008e780, 0x0, 0x0, 0x0, 0x0)
        /home/cyphar/src/runc/utils_linux.go:174 +0x105
main.startContainer(0xc82007eb40, 0xc82008e780, 0x0, 0x0, 0x0)
        /home/cyphar/src/runc/start.go:114 +0x189
main.glob.func11(0xc82007eb40)
        /home/cyphar/src/runc/start.go:78 +0x13e
github.com/codegangsta/cli.Command.Run(0x829a58, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x87ada0, 0x1a, 0x8dff80, ...)
        /home/cyphar/src/runc/Godeps/_workspace/src/github.com/codegangsta/cli/command.go:137 +0x1081
github.com/codegangsta/cli.(*App).Run(0xc82007e900, 0xc82000a050, 0x5, 0x5, 0x0, 0x0)
        /home/cyphar/src/runc/Godeps/_workspace/src/github.com/codegangsta/cli/app.go:176 +0xffa
main.main()
        /home/cyphar/src/runc/main.go:123 +0xc8e

Signed-off-by: Aleksa Sarai <asarai@suse.de>
 2016-04-25 11:52:22 +10:00
Aleksa Sarai 399175c227 Merge pull request #679 from rajasec/selinux-errorcheck 
Adding selinux check during container start
 2016-04-24 16:24:26 +00:00
Alexander Morozov ae0fc15b1e Merge pull request #608 from inatatsu/reduce-parsing-mountinfo 
Eliminate redundant parsing of mountinfo
 2016-04-23 22:30:54 -07:00
Mrunal Patel e25811108b Bump up spec and add support for mount label 
Signed-off-by: Mrunal Patel <mrunalp@gmail.com>
 2016-04-22 15:31:39 -07:00
Tatsushi Inagaki eb0a144b5e Rootfs: reduce redundant parsing of mountinfo 
Postpone parsing mountinfo until pivot_root() actually failed

Signed-off-by: Tatsushi Inagaki <e29253@jp.ibm.com>
 2016-04-22 09:41:28 +09:00
Tatsushi Inagaki 78e1a4fc2e Selinux: reduce redundant parsing of mountinfo 
Avoid parsing the whole lines of mountinfo after the mountpoint
is found.

Signed-off-by: Tatsushi Inagaki <e29253@jp.ibm.com>
 2016-04-22 09:41:28 +09:00
Tatsushi Inagaki 2a1a6cdf44 Cgroup: reduce redundant parsing of mountinfo 
Avoid parsing the whole lines of mountinfo after all mountpoints
of the target subsytems are found, or when the target subsystem
is not enabled.

Signed-off-by: Tatsushi Inagaki <e29253@jp.ibm.com>
 2016-04-22 09:41:28 +09:00
rajasec 733ff99f6d Updating kcore in validator test 
Signed-off-by: rajasec <rajasec79@gmail.com>
 2016-04-21 15:29:19 +05:30
Michael Crosby 7dd87976ed Merge pull request #758 from rajasec/container-pause-comment 
Update the comment for container pause
 2016-04-19 16:16:41 -07:00
Michael Crosby 76261a4854 Merge pull request #762 from ncopa/musl-fix-headers 
nsexec: fix build against musl libc
 2016-04-19 15:29:13 -07:00
Michael Crosby 27fd0575ee Merge pull request #763 from mrunalp/userns_cgroups_ro 
Allow mounting cgroups as read-only when user namespace is configured
 2016-04-19 10:36:00 -07:00
Mrunal Patel a6104c3bbe Allow mounting cgroups as read-only when user namespace is configured 
We use bind mount to achieve this as other file system remounts are disallowed
in a user namespace.

Signed-off-by: Mrunal Patel <mrunalp@gmail.com>
 2016-04-19 10:12:09 -07:00
rajasec d0bf80e481 Adding selinux check during container start 
Signed-off-by: rajasec <rajasec79@gmail.com>

Fixed review comments and rebased

Signed-off-by: rajasec <rajasec79@gmail.com>

updated the message as per review comment

Signed-off-by: Rajasekaran <rajasec79@gmail.com>
 2016-04-19 22:22:04 +05:30
Natanael Copa ac6bd95319 nsexec: fix build against musl libc 
Remove a wrongly added include which was added in commit 3c2e77ee (Add a
compatibility header for CentOS/RHEL 6, 2016-01-29) apparently to
fix this compile error on centos 6:

> In file included from
> Godeps/_workspace/src/github.com/opencontainers/runc/libcontainer/nsenter/nsexec.c:20:
> /usr/include/linux/netlink.h:35: error: expected specifier-qualifier-list before 'sa_family_t'

The glibc bits/sockaddr.h says that this header should never be included
directly[1]. Instead, sys/socket.h should be used.

The problem was correctly fixed later, in commit 394fb55 (Fix build
error on centos6, 2016-03-02) so the incorrect bits/sockaddr.h can
safely be removed.

This is needed to build musl libc.

Fixes #761

[1]: https://github.molgen.mpg.de/git-mirror/glibc/blob/20003c49884422da7ffbc459cdeee768a6fee07b/bits/sockaddr.h#L20

Signed-off-by: Natanael Copa <natanael.copa@docker.com>
 2016-04-19 10:58:17 +02:00
Aleksa Sarai 9384f484ff Merge pull request #759 from crosbymichael/err-context 
Add cause to error messages
 2016-04-19 01:52:43 +00:00
Michael Crosby 6978875298 Add cause to error messages 
This is the inital port of the libcontainer.Error to added a cause to
all the existing error messages.  Going forward, when an error can be
wrapped because it is not being checked at the higher levels for
something like `os.IsNotExist` we can add more information to the error
message like cause and stack file/line information.  This will help
higher level tools to know what cause a container start or operation to
fail.

Signed-off-by: Michael Crosby <crosbymichael@gmail.com>
 2016-04-18 11:37:26 -07:00
Qiang Huang 8b0f6a7e14 Merge pull request #757 from rajasec/spec-typo 
Typo in SPEC.md
 2016-04-18 09:59:48 +08:00
rajasec ccbd0a176f Update the comment for container pause 
Signed-off-by: rajasec <rajasec79@gmail.com>
 2016-04-16 14:59:19 +05:30
rajasec d663afe2a3 Rebased with spec changes 
Signed-off-by: rajasec <rajasec79@gmail.com>
 2016-04-16 07:10:02 +05:30
rajasec 2295e0ddb1 Typo in SPEC.md 
Signed-off-by: rajasec <rajasec79@gmail.com>
 2016-04-15 14:57:14 +05:30
Amit Krishnan 82050a5b8f Get runc to build clean on Solaris 
Signed-off-by: Amit Krishnan <krish.amit@gmail.com>
 2016-04-12 16:13:08 -07:00
Alexander Morozov 99b423c6cb Merge pull request #746 from crosbymichael/bump_spec412 
Update to version 0.1.0
 2016-04-12 14:34:16 -07:00
Michael Crosby f417e993d0 Update spec to v0.5.0 
Signed-off-by: Michael Crosby <crosbymichael@gmail.com>
 2016-04-12 14:11:40 -07:00
Michael Crosby 660029b476 Merge pull request #745 from AkihiroSuda/very-trivial-style-fix 
Fix trivial style errors reported by `go vet` and `golint`
 2016-04-12 13:33:00 -07:00
Michael Crosby 6460c26528 Merge pull request #744 from hqhq/hq_fix_swap_memory 
Fix problem when swap memory unsupported
 2016-04-12 10:05:47 -07:00
Alberto Leal 917c1f6d60 Add unit tests for 'utils' package 
Signed-off-by: Alberto Leal <albertonb@gmail.com>
 2016-04-12 13:29:37 +01:00
Akihiro Suda 1829531241 Fix trivial style errors reported by go vet and golint 
No substantial code change.
Note that some style errors reported by `golint` are not fixed due to possible compatibility issues.

Signed-off-by: Akihiro Suda <suda.kyoto@gmail.com>
 2016-04-12 08:13:16 +00:00
Qiang Huang 792251ae38 Fix problem when swap memory unsupported 
When swap memory is unsupported, Docker will set
cgroup.Resources.MemorySwap as -1.

Fixes: https://github.com/docker/docker/pull/21937

Signed-off-by: Qiang Huang <h.huangqiang@huawei.com>
 2016-04-12 15:08:10 +08:00
Aleksa Sarai af0cc71369 Merge pull request #717 from albertoleal/config-unittests 
Add unit tests for configs.Hooks
 2016-04-12 02:43:16 +00:00
Mrunal Patel 4023fe0fb9 Merge pull request #724 from cloudfoundry-incubator/hookstate-bundlepath 
HookState adhears to OCI
 2016-04-11 14:59:14 -07:00
Michael Crosby f54e41f7f0 Merge pull request #742 from LK4D4/carry_732 
Fix setupDev logic in rootfs_linux.go
 2016-04-11 11:16:36 -07:00
Akihiro Suda 42234a85d1 Fix setupDev logic in rootfs_linux.go 
setupDev was introduced in #96, but broken since #536 because spec 0.3.0 introduced default devices.

Fix #80 again
Fix docker/docker#21808

Signed-off-by: Akihiro Suda <suda.kyoto@gmail.com>
Signed-off-by: Alexander Morozov <lk4d4@docker.com>
 2016-04-11 10:29:40 -07:00
Mrunal Patel 5640330693 Fix for runc failing when rootfs has a traling slash 
Signed-off-by: Mrunal Patel <mrunalp@gmail.com>
 2016-04-11 09:50:28 -07:00
Alberto Leal 69be363508 Add unit tests for configs.Hooks 
Signed-off-by: Alberto Leal <albertonb@gmail.com>
 2016-04-09 07:27:33 +00:00
Aleksa Sarai 6c59168557 Merge pull request #730 from rhatdan/getfilecon 
Add label.GetFileLabel interface
 2016-04-09 05:25:11 +00:00
Mrunal Patel b24892c6b3 Fix broken build due to missing import 
Signed-off-by: Mrunal Patel <mrunalp@gmail.com>
 2016-04-08 16:35:20 -07:00
Alexander Morozov 1bef485001 Merge pull request #735 from mrunalp/mcs_race 
Synchronize writes to mcs map
 2016-04-08 14:37:53 -07:00
Mrunal Patel c6cfce304b Synchronize writes to mcs map 
Signed-off-by: Mrunal Patel <mrunalp@gmail.com>
 2016-04-08 14:16:00 -07:00
Michael Crosby bee8cb5fbb Report hook output on error 
Fixes #733

This reports the stdout/err for a hook if it returns a non-zero exit
status.

Signed-off-by: Michael Crosby <crosbymichael@gmail.com>
 2016-04-08 11:02:44 -07:00
Dan Walsh ff066b84ce Add label.GetFileLabel interface 
One of our volume plugins needs to get the label of the target mount point
so that it can set the content inside of the volume to match.

We need label.GetFileLabel() to make this work.

Signed-off-by: Dan Walsh <dwalsh@redhat.com>
 2016-04-08 13:10:37 -04:00