diff options
14 files changed, 8 insertions, 922 deletions
diff --git a/recipes-containers/lxc/files/add-lxc.rebootsignal.patch b/recipes-containers/lxc/files/add-lxc.rebootsignal.patch deleted file mode 100644 index e54d188f..00000000 --- a/recipes-containers/lxc/files/add-lxc.rebootsignal.patch +++ /dev/null | |||
| @@ -1,96 +0,0 @@ | |||
| 1 | From dd267776ee265737520c2c661a51c2d29cf43cb0 Mon Sep 17 00:00:00 2001 | ||
| 2 | From: Bogdan Purcareata <bogdan.purcareata@freescale.com> | ||
| 3 | Date: Mon, 16 Feb 2015 09:38:34 +0000 | ||
| 4 | Subject: [PATCH 10/12] add lxc.rebootsignal | ||
| 5 | |||
| 6 | Following the model of f0f1d8c076ae93d8ecf735c2eeae471e27ca6abd, add a reboot | ||
| 7 | signal for special init processes that work on something other than SIGINT. | ||
| 8 | |||
| 9 | Upstream-Status: Accepted | ||
| 10 | [https://github.com/lxc/lxc/commit/dd267776ee265737520c2c661a51c2d29cf43cb0] | ||
| 11 | |||
| 12 | Signed-off-by: Bogdan Purcareata <bogdan.purcareata@freescale.com> | ||
| 13 | Acked-by: Serge E. Hallyn <serge.hallyn@ubuntu.com> | ||
| 14 | --- | ||
| 15 | src/lxc/conf.h | 1 + | ||
| 16 | src/lxc/confile.c | 14 ++++++++++++++ | ||
| 17 | src/lxc/lxccontainer.c | 5 ++++- | ||
| 18 | 3 files changed, 19 insertions(+), 1 deletion(-) | ||
| 19 | |||
| 20 | diff --git a/src/lxc/conf.h b/src/lxc/conf.h | ||
| 21 | index afa5517..334ea70 100644 | ||
| 22 | --- a/src/lxc/conf.h | ||
| 23 | +++ b/src/lxc/conf.h | ||
| 24 | @@ -323,6 +323,7 @@ struct lxc_conf { | ||
| 25 | int maincmd_fd; | ||
| 26 | int autodev; // if 1, mount and fill a /dev at start | ||
| 27 | int haltsignal; // signal used to halt container | ||
| 28 | + int rebootsignal; // signal used to reboot container | ||
| 29 | int stopsignal; // signal used to hard stop container | ||
| 30 | int kmsg; // if 1, create /dev/kmsg symlink | ||
| 31 | char *rcfile; // Copy of the top level rcfile we read | ||
| 32 | diff --git a/src/lxc/confile.c b/src/lxc/confile.c | ||
| 33 | index 8544ac9..42d42e5 100644 | ||
| 34 | --- a/src/lxc/confile.c | ||
| 35 | +++ b/src/lxc/confile.c | ||
| 36 | @@ -98,6 +98,7 @@ static int config_includefile(const char *, const char *, struct lxc_conf *); | ||
| 37 | static int config_network_nic(const char *, const char *, struct lxc_conf *); | ||
| 38 | static int config_autodev(const char *, const char *, struct lxc_conf *); | ||
| 39 | static int config_haltsignal(const char *, const char *, struct lxc_conf *); | ||
| 40 | +static int config_rebootsignal(const char *, const char *, struct lxc_conf *); | ||
| 41 | static int config_stopsignal(const char *, const char *, struct lxc_conf *); | ||
| 42 | static int config_start(const char *, const char *, struct lxc_conf *); | ||
| 43 | static int config_group(const char *, const char *, struct lxc_conf *); | ||
| 44 | @@ -158,6 +159,7 @@ static struct lxc_config_t config[] = { | ||
| 45 | { "lxc.include", config_includefile }, | ||
| 46 | { "lxc.autodev", config_autodev }, | ||
| 47 | { "lxc.haltsignal", config_haltsignal }, | ||
| 48 | + { "lxc.rebootsignal", config_rebootsignal }, | ||
| 49 | { "lxc.stopsignal", config_stopsignal }, | ||
| 50 | { "lxc.start.auto", config_start }, | ||
| 51 | { "lxc.start.delay", config_start }, | ||
| 52 | @@ -1268,6 +1270,18 @@ static int config_haltsignal(const char *key, const char *value, | ||
| 53 | return 0; | ||
| 54 | } | ||
| 55 | |||
| 56 | +static int config_rebootsignal(const char *key, const char *value, | ||
| 57 | + struct lxc_conf *lxc_conf) | ||
| 58 | +{ | ||
| 59 | + int sig_n = sig_parse(value); | ||
| 60 | + | ||
| 61 | + if (sig_n < 0) | ||
| 62 | + return -1; | ||
| 63 | + lxc_conf->rebootsignal = sig_n; | ||
| 64 | + | ||
| 65 | + return 0; | ||
| 66 | +} | ||
| 67 | + | ||
| 68 | static int config_stopsignal(const char *key, const char *value, | ||
| 69 | struct lxc_conf *lxc_conf) | ||
| 70 | { | ||
| 71 | diff --git a/src/lxc/lxccontainer.c b/src/lxc/lxccontainer.c | ||
| 72 | index e02ee93..4422f4a 100644 | ||
| 73 | --- a/src/lxc/lxccontainer.c | ||
| 74 | +++ b/src/lxc/lxccontainer.c | ||
| 75 | @@ -1363,6 +1363,7 @@ free_tpath: | ||
| 76 | static bool lxcapi_reboot(struct lxc_container *c) | ||
| 77 | { | ||
| 78 | pid_t pid; | ||
| 79 | + int rebootsignal = SIGINT; | ||
| 80 | |||
| 81 | if (!c) | ||
| 82 | return false; | ||
| 83 | @@ -1371,7 +1372,9 @@ static bool lxcapi_reboot(struct lxc_container *c) | ||
| 84 | pid = c->init_pid(c); | ||
| 85 | if (pid <= 0) | ||
| 86 | return false; | ||
| 87 | - if (kill(pid, SIGINT) < 0) | ||
| 88 | + if (c->lxc_conf && c->lxc_conf->rebootsignal) | ||
| 89 | + rebootsignal = c->lxc_conf->rebootsignal; | ||
| 90 | + if (kill(pid, rebootsignal) < 0) | ||
| 91 | return false; | ||
| 92 | return true; | ||
| 93 | |||
| 94 | -- | ||
| 95 | 2.1.4 | ||
| 96 | |||
diff --git a/recipes-containers/lxc/files/document-lxc.rebootsignal.patch b/recipes-containers/lxc/files/document-lxc.rebootsignal.patch deleted file mode 100644 index d1cce40f..00000000 --- a/recipes-containers/lxc/files/document-lxc.rebootsignal.patch +++ /dev/null | |||
| @@ -1,140 +0,0 @@ | |||
| 1 | From baefc2176780b5e4527c1f86206c0ea72d80c8f5 Mon Sep 17 00:00:00 2001 | ||
| 2 | From: Bogdan Purcareata <bogdan.purcareata@freescale.com> | ||
| 3 | Date: Tue, 10 Mar 2015 10:06:58 +0000 | ||
| 4 | Subject: [PATCH] document lxc.rebootsignal | ||
| 5 | |||
| 6 | Also fix some minor indentation mishaps since we're here. | ||
| 7 | |||
| 8 | Upstrem-Status: Backport [from LXC 1.1] | ||
| 9 | [https://github.com/lxc/lxc/commit/936762f3fb6cf10e0756719f03aebe052d5c31a8] | ||
| 10 | |||
| 11 | Signed-off-by: Bogdan Purcareata <bogdan.purcareata@freescale.com> | ||
| 12 | Acked-by: Serge E. Hallyn <serge.hallyn@ubuntu.com> | ||
| 13 | --- | ||
| 14 | doc/lxc-stop.sgml.in | 4 +- | ||
| 15 | doc/lxc.container.conf.sgml.in | 86 ++++++++++++++++++++++++++---------------- | ||
| 16 | 2 files changed, 57 insertions(+), 33 deletions(-) | ||
| 17 | |||
| 18 | diff --git a/doc/lxc-stop.sgml.in b/doc/lxc-stop.sgml.in | ||
| 19 | index bc5e6a8..3c69fed 100644 | ||
| 20 | --- a/doc/lxc-stop.sgml.in | ||
| 21 | +++ b/doc/lxc-stop.sgml.in | ||
| 22 | @@ -70,7 +70,9 @@ Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA | ||
| 23 | the container's init process, waiting up to 60 seconds for the container | ||
| 24 | to exit, and then returning. If the container fails to cleanly exit in | ||
| 25 | 60 seconds, it will be sent the <command>lxc.stopsignal</command> | ||
| 26 | - (defaults to SIGKILL) to force it to shut down. | ||
| 27 | + (defaults to SIGKILL) to force it to shut down. A request to reboot will | ||
| 28 | + send the <command>lxc.rebootsignal</command> (defaults to SIGINT) to the | ||
| 29 | + container's init process. | ||
| 30 | </para> | ||
| 31 | <para> | ||
| 32 | The <optional>-W</optional>, <optional>-r</optional>, | ||
| 33 | diff --git a/doc/lxc.container.conf.sgml.in b/doc/lxc.container.conf.sgml.in | ||
| 34 | index e98496d..1962528 100644 | ||
| 35 | --- a/doc/lxc.container.conf.sgml.in | ||
| 36 | +++ b/doc/lxc.container.conf.sgml.in | ||
| 37 | @@ -158,46 +158,68 @@ Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA | ||
| 38 | <refsect2> | ||
| 39 | <title>Halt signal</title> | ||
| 40 | <para> | ||
| 41 | - Allows one to specify signal name or number, sent by lxc-stop to the | ||
| 42 | - container's init process to cleanly shutdown the container. Different | ||
| 43 | - init systems could use different signals to perform clean shutdown | ||
| 44 | - sequence. This option allows the signal to be specified in kill(1) | ||
| 45 | - fashion, e.g. SIGPWR, SIGRTMIN+14, SIGRTMAX-10 or plain number. The | ||
| 46 | - default signal is SIGPWR. | ||
| 47 | + Allows one to specify signal name or number, sent by lxc-stop to the | ||
| 48 | + container's init process to cleanly shutdown the container. Different | ||
| 49 | + init systems could use different signals to perform clean shutdown | ||
| 50 | + sequence. This option allows the signal to be specified in kill(1) | ||
| 51 | + fashion, e.g. SIGPWR, SIGRTMIN+14, SIGRTMAX-10 or plain number. The | ||
| 52 | + default signal is SIGPWR. | ||
| 53 | </para> | ||
| 54 | <variablelist> | ||
| 55 | - <varlistentry> | ||
| 56 | - <term> | ||
| 57 | - <option>lxc.haltsignal</option> | ||
| 58 | - </term> | ||
| 59 | - <listitem> | ||
| 60 | - <para> | ||
| 61 | - specify the signal used to halt the container | ||
| 62 | - </para> | ||
| 63 | - </listitem> | ||
| 64 | - </varlistentry> | ||
| 65 | + <varlistentry> | ||
| 66 | + <term> | ||
| 67 | + <option>lxc.haltsignal</option> | ||
| 68 | + </term> | ||
| 69 | + <listitem> | ||
| 70 | + <para> | ||
| 71 | + specify the signal used to halt the container | ||
| 72 | + </para> | ||
| 73 | + </listitem> | ||
| 74 | + </varlistentry> | ||
| 75 | + </variablelist> | ||
| 76 | + </refsect2> | ||
| 77 | + | ||
| 78 | + <refsect2> | ||
| 79 | + <title>Reboot signal</title> | ||
| 80 | + <para> | ||
| 81 | + Allows one to specify signal name or number, sent by lxc-stop to | ||
| 82 | + reboot the container. This option allows signal to be specified in | ||
| 83 | + kill(1) fashion, e.g. SIGTERM, SIGRTMIN+14, SIGRTMAX-10 or plain number. | ||
| 84 | + The default signal is SIGINT. | ||
| 85 | + </para> | ||
| 86 | + <variablelist> | ||
| 87 | + <varlistentry> | ||
| 88 | + <term> | ||
| 89 | + <option>lxc.rebootsignal</option> | ||
| 90 | + </term> | ||
| 91 | + <listitem> | ||
| 92 | + <para> | ||
| 93 | + specify the signal used to reboot the container | ||
| 94 | + </para> | ||
| 95 | + </listitem> | ||
| 96 | + </varlistentry> | ||
| 97 | </variablelist> | ||
| 98 | </refsect2> | ||
| 99 | |||
| 100 | <refsect2> | ||
| 101 | <title>Stop signal</title> | ||
| 102 | <para> | ||
| 103 | - Allows one to specify signal name or number, sent by lxc-stop to forcibly | ||
| 104 | - shutdown the container. This option allows signal to be specified in | ||
| 105 | - kill(1) fashion, e.g. SIGKILL, SIGRTMIN+14, SIGRTMAX-10 or plain number. | ||
| 106 | - The default signal is SIGKILL. | ||
| 107 | - </para> | ||
| 108 | - <variablelist> | ||
| 109 | - <varlistentry> | ||
| 110 | - <term> | ||
| 111 | - <option>lxc.stopsignal</option> | ||
| 112 | - </term> | ||
| 113 | - <listitem> | ||
| 114 | - <para> | ||
| 115 | - specify the signal used to stop the container | ||
| 116 | - </para> | ||
| 117 | - </listitem> | ||
| 118 | - </varlistentry> | ||
| 119 | + Allows one to specify signal name or number, sent by lxc-stop to forcibly | ||
| 120 | + shutdown the container. This option allows signal to be specified in | ||
| 121 | + kill(1) fashion, e.g. SIGKILL, SIGRTMIN+14, SIGRTMAX-10 or plain number. | ||
| 122 | + The default signal is SIGKILL. | ||
| 123 | + </para> | ||
| 124 | + <variablelist> | ||
| 125 | + <varlistentry> | ||
| 126 | + <term> | ||
| 127 | + <option>lxc.stopsignal</option> | ||
| 128 | + </term> | ||
| 129 | + <listitem> | ||
| 130 | + <para> | ||
| 131 | + specify the signal used to stop the container | ||
| 132 | + </para> | ||
| 133 | + </listitem> | ||
| 134 | + </varlistentry> | ||
| 135 | </variablelist> | ||
| 136 | </refsect2> | ||
| 137 | |||
| 138 | -- | ||
| 139 | 2.1.4 | ||
| 140 | |||
diff --git a/recipes-containers/lxc/files/lxc-busybox-Remove-warning-for-dynamically-linked-Bu.patch b/recipes-containers/lxc/files/lxc-busybox-Remove-warning-for-dynamically-linked-Bu.patch deleted file mode 100644 index c0a810b1..00000000 --- a/recipes-containers/lxc/files/lxc-busybox-Remove-warning-for-dynamically-linked-Bu.patch +++ /dev/null | |||
| @@ -1,43 +0,0 @@ | |||
| 1 | From 07e4c41f2963d73b9aedd552c74f17a33e89f020 Mon Sep 17 00:00:00 2001 | ||
| 2 | From: Bogdan Purcareata <bogdan.purcareata@nxp.com> | ||
| 3 | Date: Thu, 24 Mar 2016 11:54:27 +0000 | ||
| 4 | Subject: [PATCH] lxc-busybox: Remove warning for dynamically linked Busybox | ||
| 5 | MIME-Version: 1.0 | ||
| 6 | Content-Type: text/plain; charset=UTF-8 | ||
| 7 | Content-Transfer-Encoding: 8bit | ||
| 8 | |||
| 9 | The warning has been present since commit 32b37181ea (with no purpose stated). | ||
| 10 | Support for dynamically linked Busybox has been added since commit bf6cc73696. | ||
| 11 | Haven't encountered any issues with dynamically linked Busybox in my last | ||
| 12 | 2 years' testing. | ||
| 13 | |||
| 14 | Upstream-status: Accepted | ||
| 15 | [https://github.com/lxc/lxc/commit/07e4c41f2963d73b9aedd552c74f17a33e89f020] | ||
| 16 | |||
| 17 | Signed-off-by: Bogdan Purcareata <bogdan.purcareata@nxp.com> | ||
| 18 | Acked-by: Stéphane Graber <stgraber@ubuntu.com> | ||
| 19 | --- | ||
| 20 | templates/lxc-busybox.in | 7 ------- | ||
| 21 | 1 file changed, 7 deletions(-) | ||
| 22 | |||
| 23 | diff --git a/templates/lxc-busybox.in b/templates/lxc-busybox.in | ||
| 24 | index f547f9e..336fa12 100644 | ||
| 25 | --- a/templates/lxc-busybox.in | ||
| 26 | +++ b/templates/lxc-busybox.in | ||
| 27 | @@ -304,13 +304,6 @@ configure_busybox() | ||
| 28 | return 1 | ||
| 29 | fi | ||
| 30 | |||
| 31 | - file -L $(which busybox) | grep -q "statically linked" | ||
| 32 | - if [ $? -ne 0 ]; then | ||
| 33 | - echo "warning : busybox is not statically linked." | ||
| 34 | - echo "warning : The template script may not correctly" | ||
| 35 | - echo "warning : setup the container environment." | ||
| 36 | - fi | ||
| 37 | - | ||
| 38 | # copy busybox in the rootfs | ||
| 39 | cp $(which busybox) $rootfs/bin | ||
| 40 | if [ $? -ne 0 ]; then | ||
| 41 | -- | ||
| 42 | 1.9.1 | ||
| 43 | |||
diff --git a/recipes-containers/lxc/files/lxc-busybox-Touch-etc-fstab-in-the-container-rootfs.patch b/recipes-containers/lxc/files/lxc-busybox-Touch-etc-fstab-in-the-container-rootfs.patch deleted file mode 100644 index 33862ddc..00000000 --- a/recipes-containers/lxc/files/lxc-busybox-Touch-etc-fstab-in-the-container-rootfs.patch +++ /dev/null | |||
| @@ -1,30 +0,0 @@ | |||
| 1 | From 6ab1ca0375feeb00070f0c0f9186551b08b1ee5e Mon Sep 17 00:00:00 2001 | ||
| 2 | From: Bogdan Purcareata <bogdan.purcareata@nxp.com> | ||
| 3 | Date: Tue, 22 Mar 2016 13:33:57 +0000 | ||
| 4 | Subject: [PATCH] lxc-busybox: Touch /etc/fstab in the container rootfs | ||
| 5 | |||
| 6 | Upstream-status: Accepted | ||
| 7 | [https://github.com/lxc/lxc/commit/6ab1ca0375feeb00070f0c0f9186551b08b1ee5e] | ||
| 8 | |||
| 9 | Signed-off-by: Bogdan Purcareata <bogdan.purcareata@nxp.com> | ||
| 10 | --- | ||
| 11 | templates/lxc-busybox.in | 3 +++ | ||
| 12 | 1 file changed, 3 insertions(+) | ||
| 13 | |||
| 14 | diff --git a/templates/lxc-busybox.in b/templates/lxc-busybox.in | ||
| 15 | index c020e66..f547f9e 100644 | ||
| 16 | --- a/templates/lxc-busybox.in | ||
| 17 | +++ b/templates/lxc-busybox.in | ||
| 18 | @@ -330,6 +330,9 @@ configure_busybox() | ||
| 19 | # relink /sbin/init | ||
| 20 | ln $rootfs/bin/busybox $rootfs/sbin/init | ||
| 21 | |||
| 22 | + # /etc/fstab must exist for "mount -a" | ||
| 23 | + touch $rootfs/etc/fstab | ||
| 24 | + | ||
| 25 | # passwd exec must be setuid | ||
| 26 | chmod +s $rootfs/bin/passwd | ||
| 27 | touch $rootfs/etc/shadow | ||
| 28 | -- | ||
| 29 | 1.9.1 | ||
| 30 | |||
diff --git a/recipes-containers/lxc/files/lxc-busybox-add-OpenSSH-support.patch b/recipes-containers/lxc/files/lxc-busybox-add-OpenSSH-support.patch deleted file mode 100644 index f2f332cb..00000000 --- a/recipes-containers/lxc/files/lxc-busybox-add-OpenSSH-support.patch +++ /dev/null | |||
| @@ -1,246 +0,0 @@ | |||
| 1 | From ed52814c776963efdcc9dcda1ec26fc09930ef93 Mon Sep 17 00:00:00 2001 | ||
| 2 | From: Bogdan Purcareata <bogdan.purcareata@freescale.com> | ||
| 3 | Date: Wed, 22 Apr 2015 14:53:32 +0000 | ||
| 4 | Subject: [PATCH] lxc-busybox: add OpenSSH support | ||
| 5 | MIME-Version: 1.0 | ||
| 6 | Content-Type: text/plain; charset=UTF-8 | ||
| 7 | Content-Transfer-Encoding: 8bit | ||
| 8 | |||
| 9 | Add an additional template parameter for SSH support in the container. Currently | ||
| 10 | this can be implemented using the Dropbear or OpenSSH utility. The respective | ||
| 11 | tool needs to be available on the host Linux. | ||
| 12 | |||
| 13 | If the parameter is omitted, the template will look for the Dropbear utility on | ||
| 14 | the host and install it if it is available (legacy behavior). | ||
| 15 | |||
| 16 | Adding OpenSSH support has been done following the model in the lxc-sshd | ||
| 17 | template. | ||
| 18 | |||
| 19 | Upstream-status: Accepted | ||
| 20 | [https://github.com/lxc/lxc/commit/ed52814c776963efdcc9dcda1ec26fc09930ef93] | ||
| 21 | |||
| 22 | Signed-off-by: Bogdan Purcareata <bogdan.purcareata@freescale.com> | ||
| 23 | Acked-by: Stéphane Graber <stgraber@ubuntu.com> | ||
| 24 | --- | ||
| 25 | templates/lxc-busybox.in | 169 ++++++++++++++++++++++++++++++++++++++--------- | ||
| 26 | 1 file changed, 139 insertions(+), 30 deletions(-) | ||
| 27 | |||
| 28 | diff --git a/templates/lxc-busybox.in b/templates/lxc-busybox.in | ||
| 29 | index 7e05bd6..95961a3 100644 | ||
| 30 | --- a/templates/lxc-busybox.in | ||
| 31 | +++ b/templates/lxc-busybox.in | ||
| 32 | @@ -22,6 +22,7 @@ | ||
| 33 | |||
| 34 | LXC_MAPPED_UID= | ||
| 35 | LXC_MAPPED_GID= | ||
| 36 | +SSH= | ||
| 37 | |||
| 38 | # Make sure the usual locations are in PATH | ||
| 39 | export PATH=$PATH:/usr/sbin:/usr/bin:/sbin:/bin | ||
| 40 | @@ -160,6 +161,116 @@ EOF | ||
| 41 | return $res | ||
| 42 | } | ||
| 43 | |||
| 44 | +install_dropbear() | ||
| 45 | +{ | ||
| 46 | + # copy dropbear binary | ||
| 47 | + cp $(which dropbear) $rootfs/usr/sbin | ||
| 48 | + if [ $? -ne 0 ]; then | ||
| 49 | + echo "Failed to copy dropbear in the rootfs" | ||
| 50 | + return 1 | ||
| 51 | + fi | ||
| 52 | + | ||
| 53 | + # make symlinks to various ssh utilities | ||
| 54 | + utils="\ | ||
| 55 | + $rootfs/usr/bin/dbclient \ | ||
| 56 | + $rootfs/usr/bin/scp \ | ||
| 57 | + $rootfs/usr/bin/ssh \ | ||
| 58 | + $rootfs/usr/sbin/dropbearkey \ | ||
| 59 | + $rootfs/usr/sbin/dropbearconvert \ | ||
| 60 | + " | ||
| 61 | + echo $utils | xargs -n1 ln -s /usr/sbin/dropbear | ||
| 62 | + | ||
| 63 | + # add necessary config files | ||
| 64 | + mkdir $rootfs/etc/dropbear | ||
| 65 | + dropbearkey -t rsa -f $rootfs/etc/dropbear/dropbear_rsa_host_key > /dev/null 2>&1 | ||
| 66 | + dropbearkey -t dss -f $rootfs/etc/dropbear/dropbear_dss_host_key > /dev/null 2>&1 | ||
| 67 | + | ||
| 68 | + echo "'dropbear' ssh utility installed" | ||
| 69 | + | ||
| 70 | + return 0 | ||
| 71 | +} | ||
| 72 | + | ||
| 73 | +install_openssh() | ||
| 74 | +{ | ||
| 75 | + # tools to be installed | ||
| 76 | + server_utils="sshd" | ||
| 77 | + client_utils="\ | ||
| 78 | + ssh \ | ||
| 79 | + scp \ | ||
| 80 | + sftp \ | ||
| 81 | + ssh-add \ | ||
| 82 | + ssh-agent \ | ||
| 83 | + ssh-keygen \ | ||
| 84 | + ssh-keyscan \ | ||
| 85 | + ssh-argv0 \ | ||
| 86 | + ssh-copy-id \ | ||
| 87 | + " | ||
| 88 | + | ||
| 89 | + # new folders used by ssh | ||
| 90 | + ssh_tree="\ | ||
| 91 | +$rootfs/etc/ssh \ | ||
| 92 | +$rootfs/var/empty/sshd \ | ||
| 93 | +$rootfs/var/lib/empty/sshd \ | ||
| 94 | +$rootfs/var/run/sshd \ | ||
| 95 | +" | ||
| 96 | + | ||
| 97 | + # create folder structure | ||
| 98 | + mkdir -p $ssh_tree | ||
| 99 | + if [ $? -ne 0 ]; then | ||
| 100 | + return 1 | ||
| 101 | + fi | ||
| 102 | + | ||
| 103 | + # copy binaries | ||
| 104 | + for bin in $server_utils $client_utils; do | ||
| 105 | + tool_path=`which $bin` | ||
| 106 | + cp $tool_path $rootfs/$tool_path | ||
| 107 | + if [ $? -ne 0 ]; then | ||
| 108 | + echo "Unable to copy $tool_path in the rootfs" | ||
| 109 | + return 1 | ||
| 110 | + fi | ||
| 111 | + done | ||
| 112 | + | ||
| 113 | + # add user and group | ||
| 114 | + cat <<EOF >> $rootfs/etc/passwd | ||
| 115 | +sshd:x:74:74:Privilege-separated SSH:/var/empty/sshd:/sbin/nologin | ||
| 116 | +EOF | ||
| 117 | + | ||
| 118 | + cat <<EOF >> $rootfs/etc/group | ||
| 119 | +sshd:x:74: | ||
| 120 | +EOF | ||
| 121 | + | ||
| 122 | + # generate container keys | ||
| 123 | + ssh-keygen -t rsa -N "" -f $rootfs/etc/ssh/ssh_host_rsa_key >/dev/null 2>&1 | ||
| 124 | + ssh-keygen -t dsa -N "" -f $rootfs/etc/ssh/ssh_host_dsa_key >/dev/null 2>&1 | ||
| 125 | + | ||
| 126 | + # by default setup root password with no password | ||
| 127 | + cat <<EOF > $rootfs/etc/ssh/sshd_config | ||
| 128 | +Port 22 | ||
| 129 | +Protocol 2 | ||
| 130 | +HostKey /etc/ssh/ssh_host_rsa_key | ||
| 131 | +HostKey /etc/ssh/ssh_host_dsa_key | ||
| 132 | +UsePrivilegeSeparation yes | ||
| 133 | +KeyRegenerationInterval 3600 | ||
| 134 | +ServerKeyBits 768 | ||
| 135 | +SyslogFacility AUTH | ||
| 136 | +LogLevel INFO | ||
| 137 | +LoginGraceTime 120 | ||
| 138 | +PermitRootLogin yes | ||
| 139 | +StrictModes yes | ||
| 140 | +RSAAuthentication yes | ||
| 141 | +PubkeyAuthentication yes | ||
| 142 | +IgnoreRhosts yes | ||
| 143 | +RhostsRSAAuthentication no | ||
| 144 | +HostbasedAuthentication no | ||
| 145 | +PermitEmptyPasswords yes | ||
| 146 | +ChallengeResponseAuthentication no | ||
| 147 | +EOF | ||
| 148 | + | ||
| 149 | + echo "'OpenSSH' utility installed" | ||
| 150 | + | ||
| 151 | + return 0 | ||
| 152 | +} | ||
| 153 | + | ||
| 154 | configure_busybox() | ||
| 155 | { | ||
| 156 | rootfs=$1 | ||
| 157 | @@ -230,34 +341,6 @@ EOF | ||
| 158 | lxc-unshare -s MOUNT -- /bin/sh < $CHPASSWD_FILE | ||
| 159 | rm $CHPASSWD_FILE | ||
| 160 | |||
| 161 | - # add ssh functionality if dropbear package available on host | ||
| 162 | - which dropbear >/dev/null 2>&1 | ||
| 163 | - if [ $? -eq 0 ]; then | ||
| 164 | - # copy dropbear binary | ||
| 165 | - cp $(which dropbear) $rootfs/usr/sbin | ||
| 166 | - if [ $? -ne 0 ]; then | ||
| 167 | - echo "Failed to copy dropbear in the rootfs" | ||
| 168 | - return 1 | ||
| 169 | - fi | ||
| 170 | - | ||
| 171 | - # make symlinks to various ssh utilities | ||
| 172 | - utils="\ | ||
| 173 | - $rootfs/usr/bin/dbclient \ | ||
| 174 | - $rootfs/usr/bin/scp \ | ||
| 175 | - $rootfs/usr/bin/ssh \ | ||
| 176 | - $rootfs/usr/sbin/dropbearkey \ | ||
| 177 | - $rootfs/usr/sbin/dropbearconvert \ | ||
| 178 | - " | ||
| 179 | - echo $utils | xargs -n1 ln -s /usr/sbin/dropbear | ||
| 180 | - | ||
| 181 | - # add necessary config files | ||
| 182 | - mkdir $rootfs/etc/dropbear | ||
| 183 | - dropbearkey -t rsa -f $rootfs/etc/dropbear/dropbear_rsa_host_key > /dev/null 2>&1 | ||
| 184 | - dropbearkey -t dss -f $rootfs/etc/dropbear/dropbear_dss_host_key > /dev/null 2>&1 | ||
| 185 | - | ||
| 186 | - echo "'dropbear' ssh utility installed" | ||
| 187 | - fi | ||
| 188 | - | ||
| 189 | return 0 | ||
| 190 | } | ||
| 191 | |||
| 192 | @@ -315,12 +398,12 @@ remap_userns() | ||
| 193 | usage() | ||
| 194 | { | ||
| 195 | cat <<EOF | ||
| 196 | -$1 -h|--help -p|--path=<path> | ||
| 197 | +$1 -h|--help -p|--path=<path> -s|--ssh={dropbear,openssh} | ||
| 198 | EOF | ||
| 199 | return 0 | ||
| 200 | } | ||
| 201 | |||
| 202 | -options=$(getopt -o hp:n: -l help,rootfs:,path:,name:,mapped-uid:,mapped-gid: -- "$@") | ||
| 203 | +options=$(getopt -o hp:n:s: -l help,rootfs:,path:,name:,mapped-uid:,mapped-gid:,ssh: -- "$@") | ||
| 204 | if [ $? -ne 0 ]; then | ||
| 205 | usage $(basename $0) | ||
| 206 | exit 1 | ||
| 207 | @@ -336,6 +419,7 @@ do | ||
| 208 | -n|--name) name=$2; shift 2;; | ||
| 209 | --mapped-uid) LXC_MAPPED_UID=$2; shift 2;; | ||
| 210 | --mapped-gid) LXC_MAPPED_GID=$2; shift 2;; | ||
| 211 | + -s|--ssh) SSH=$2; shift 2;; | ||
| 212 | --) shift 1; break ;; | ||
| 213 | *) break ;; | ||
| 214 | esac | ||
| 215 | @@ -384,3 +468,28 @@ if [ $? -ne 0 ]; then | ||
| 216 | echo "failed to remap files to user" | ||
| 217 | exit 1 | ||
| 218 | fi | ||
| 219 | + | ||
| 220 | +if [ -n "$SSH" ]; then | ||
| 221 | + case "$SSH" in | ||
| 222 | + "dropbear") | ||
| 223 | + install_dropbear | ||
| 224 | + if [ $? -ne 0 ]; then | ||
| 225 | + echo "Unable to install 'dropbear' ssh utility" | ||
| 226 | + exit 1 | ||
| 227 | + fi ;; | ||
| 228 | + "openssh") | ||
| 229 | + install_openssh | ||
| 230 | + if [ $? -ne 0 ]; then | ||
| 231 | + echo "Unable to install 'OpenSSH' utility" | ||
| 232 | + exit 1 | ||
| 233 | + fi ;; | ||
| 234 | + *) | ||
| 235 | + echo "$SSH: unrecognized ssh utility" | ||
| 236 | + exit 1 | ||
| 237 | + esac | ||
| 238 | +else | ||
| 239 | + which dropbear >/dev/null 2>&1 | ||
| 240 | + if [ $? -eq 0 ]; then | ||
| 241 | + install_dropbear | ||
| 242 | + fi | ||
| 243 | +fi | ||
| 244 | -- | ||
| 245 | 2.1.4 | ||
| 246 | |||
diff --git a/recipes-containers/lxc/files/lxc-busybox-use-lxc.rebootsignal-SIGTERM.patch b/recipes-containers/lxc/files/lxc-busybox-use-lxc.rebootsignal-SIGTERM.patch deleted file mode 100644 index 2f4513ee..00000000 --- a/recipes-containers/lxc/files/lxc-busybox-use-lxc.rebootsignal-SIGTERM.patch +++ /dev/null | |||
| @@ -1,31 +0,0 @@ | |||
| 1 | From 22fb28a946397ec19b247efe170c15b263bf89af Mon Sep 17 00:00:00 2001 | ||
| 2 | From: Bogdan Purcareata <bogdan.purcareata@freescale.com> | ||
| 3 | Date: Mon, 16 Feb 2015 09:38:36 +0000 | ||
| 4 | Subject: [PATCH 12/12] lxc-busybox: use lxc.rebootsignal = SIGTERM | ||
| 5 | |||
| 6 | Otherwise lxc-stop -r has no effect on the container. | ||
| 7 | |||
| 8 | Upstream-Status: Accepted | ||
| 9 | [https://github.com/lxc/lxc/commit/22fb28a946397ec19b247efe170c15b263bf89af] | ||
| 10 | |||
| 11 | Signed-off-by: Bogdan Purcareata <bogdan.purcareata@freescale.com> | ||
| 12 | Acked-by: Serge E. Hallyn <serge.hallyn@ubuntu.com> | ||
| 13 | --- | ||
| 14 | templates/lxc-busybox.in | 1 + | ||
| 15 | 1 file changed, 1 insertion(+) | ||
| 16 | |||
| 17 | diff --git a/templates/lxc-busybox.in b/templates/lxc-busybox.in | ||
| 18 | index 72531d6..7e05bd6 100644 | ||
| 19 | --- a/templates/lxc-busybox.in | ||
| 20 | +++ b/templates/lxc-busybox.in | ||
| 21 | @@ -270,6 +270,7 @@ copy_configuration() | ||
| 22 | grep -q "^lxc.rootfs" $path/config 2>/dev/null || echo "lxc.rootfs = $rootfs" >> $path/config | ||
| 23 | cat <<EOF >> $path/config | ||
| 24 | lxc.haltsignal = SIGUSR1 | ||
| 25 | +lxc.rebootsignal = SIGTERM | ||
| 26 | lxc.utsname = $name | ||
| 27 | lxc.tty = 1 | ||
| 28 | lxc.pts = 1 | ||
| 29 | -- | ||
| 30 | 2.1.4 | ||
| 31 | |||
diff --git a/recipes-containers/lxc/files/lxc-fix-B-S.patch b/recipes-containers/lxc/files/lxc-fix-B-S.patch index 3822655e..a776b4f8 100644 --- a/recipes-containers/lxc/files/lxc-fix-B-S.patch +++ b/recipes-containers/lxc/files/lxc-fix-B-S.patch | |||
| @@ -1,16 +1,15 @@ | |||
| 1 | Index: lxc-1.0.7/config/init/upstart/Makefile.am | 1 | Index: lxc-2.0.0/config/init/upstart/Makefile.am |
| 2 | =================================================================== | 2 | =================================================================== |
| 3 | --- lxc-1.0.7.orig/config/init/upstart/Makefile.am | 3 | --- lxc-2.0.0.orig/config/init/upstart/Makefile.am |
| 4 | +++ lxc-1.0.7/config/init/upstart/Makefile.am | 4 | +++ lxc-2.0.0/config/init/upstart/Makefile.am |
| 5 | @@ -3,9 +3,9 @@ EXTRA_DIST = lxc.conf lxc-instance.conf | 5 | @@ -3,9 +3,9 @@ |
| 6 | if INIT_SCRIPT_UPSTART | 6 | if INIT_SCRIPT_UPSTART |
| 7 | install-upstart: lxc.conf lxc-instance.conf lxc-net.conf | 7 | install-upstart: lxc.conf lxc-instance.conf lxc-net.conf |
| 8 | $(MKDIR_P) $(DESTDIR)$(sysconfdir)/init/ | 8 | $(MKDIR_P) $(DESTDIR)$(sysconfdir)/init/ |
| 9 | - $(INSTALL_DATA) lxc.conf $(DESTDIR)$(sysconfdir)/init/ | 9 | - $(INSTALL_DATA) lxc.conf $(DESTDIR)$(sysconfdir)/init/ |
| 10 | - $(INSTALL_DATA) lxc-instance.conf $(DESTDIR)$(sysconfdir)/init/ | ||
| 11 | - $(INSTALL_DATA) lxc-net.conf $(DESTDIR)$(sysconfdir)/init/ | ||
| 12 | + $(INSTALL_DATA) $(srcdir)/lxc.conf $(DESTDIR)$(sysconfdir)/init/ | 10 | + $(INSTALL_DATA) $(srcdir)/lxc.conf $(DESTDIR)$(sysconfdir)/init/ |
| 13 | + $(INSTALL_DATA) $(srcdir)/lxc-instance.conf $(DESTDIR)$(sysconfdir)/init/ | 11 | $(INSTALL_DATA) $(srcdir)/lxc-instance.conf $(DESTDIR)$(sysconfdir)/init/ |
| 12 | - $(INSTALL_DATA) lxc-net.conf $(DESTDIR)$(sysconfdir)/init/ | ||
| 14 | + $(INSTALL_DATA) $(srcdir)/lxc-net.conf $(DESTDIR)$(sysconfdir)/init/ | 13 | + $(INSTALL_DATA) $(srcdir)/lxc-net.conf $(DESTDIR)$(sysconfdir)/init/ |
| 15 | 14 | ||
| 16 | uninstall-upstart: | 15 | uninstall-upstart: |
diff --git a/recipes-containers/lxc/files/lxc-let-lxc-start-support-wlan-phys.patch b/recipes-containers/lxc/files/lxc-let-lxc-start-support-wlan-phys.patch deleted file mode 100644 index 9146fd07..00000000 --- a/recipes-containers/lxc/files/lxc-let-lxc-start-support-wlan-phys.patch +++ /dev/null | |||
| @@ -1,72 +0,0 @@ | |||
| 1 | From 4acc7a24e098445de502a6f59a8b3dff2cd8536d Mon Sep 17 00:00:00 2001 | ||
| 2 | From: fli <fupan.li@windriver.com> | ||
| 3 | Date: Thu, 21 Apr 2016 19:07:10 -0700 | ||
| 4 | Subject: [PATCH] lxc: let lxc-start support wlan phys | ||
| 5 | |||
| 6 | The commit: e5848d395cb <netdev_move_by_index: support wlan> only | ||
| 7 | made netdev_move_by_name support wlan, instead of netdev_move_by_index. | ||
| 8 | |||
| 9 | Given netdev_move_by_name is a wrapper of netdev_move_by_index, so here | ||
| 10 | replacing all of the call to lxc_netdev_move_by_index with lxc_netdev_move_by_name | ||
| 11 | to let lxc-start support wlan phys. | ||
| 12 | |||
| 13 | Signed-off-by: fli <fupan.li@windriver.com> | ||
| 14 | --- | ||
| 15 | src/lxc/conf.c | 20 ++++++++++++++++---- | ||
| 16 | 1 file changed, 16 insertions(+), 4 deletions(-) | ||
| 17 | |||
| 18 | diff --git a/src/lxc/conf.c b/src/lxc/conf.c | ||
| 19 | index 034bdff..bcba0f1 100644 | ||
| 20 | --- a/src/lxc/conf.c | ||
| 21 | +++ b/src/lxc/conf.c | ||
| 22 | @@ -2623,6 +2623,7 @@ void restore_phys_nics_to_netns(int netnsfd, struct lxc_conf *conf) | ||
| 23 | { | ||
| 24 | int i, ret, oldfd; | ||
| 25 | char path[MAXPATHLEN]; | ||
| 26 | + char ifname[IFNAMSIZ]; | ||
| 27 | |||
| 28 | if (netnsfd < 0) | ||
| 29 | return; | ||
| 30 | @@ -2643,9 +2644,13 @@ void restore_phys_nics_to_netns(int netnsfd, struct lxc_conf *conf) | ||
| 31 | } | ||
| 32 | for (i=0; i<conf->num_savednics; i++) { | ||
| 33 | struct saved_nic *s = &conf->saved_nics[i]; | ||
| 34 | - if (lxc_netdev_move_by_index(s->ifindex, 1, NULL)) | ||
| 35 | - WARN("Error moving nic index:%d back to host netns", | ||
| 36 | - s->ifindex); | ||
| 37 | + /* retrieve the name of the interface */ | ||
| 38 | + if (!if_indextoname(s->ifindex, ifname)) { | ||
| 39 | + WARN("no interface corresponding to index '%d'", s->ifindex); | ||
| 40 | + continue; | ||
| 41 | + } | ||
| 42 | + if (lxc_netdev_move_by_name(ifname, 1, NULL)) | ||
| 43 | + WARN("Error moving nic name:%s back to host netns", ifname); | ||
| 44 | } | ||
| 45 | if (setns(oldfd, 0) != 0) | ||
| 46 | SYSERROR("Failed to re-enter monitor's netns"); | ||
| 47 | @@ -3208,6 +3213,7 @@ int lxc_assign_network(struct lxc_list *network, pid_t pid) | ||
| 48 | { | ||
| 49 | struct lxc_list *iterator; | ||
| 50 | struct lxc_netdev *netdev; | ||
| 51 | + char ifname[IFNAMSIZ]; | ||
| 52 | int am_root = (getuid() == 0); | ||
| 53 | int err; | ||
| 54 | |||
| 55 | @@ -3228,7 +3234,13 @@ int lxc_assign_network(struct lxc_list *network, pid_t pid) | ||
| 56 | if (!netdev->ifindex) | ||
| 57 | continue; | ||
| 58 | |||
| 59 | - err = lxc_netdev_move_by_index(netdev->ifindex, pid, NULL); | ||
| 60 | + /* retrieve the name of the interface */ | ||
| 61 | + if (!if_indextoname(netdev->ifindex, ifname)) { | ||
| 62 | + ERROR("no interface corresponding to index '%d'", netdev->ifindex); | ||
| 63 | + return -1; | ||
| 64 | + } | ||
| 65 | + | ||
| 66 | + err = lxc_netdev_move_by_name(ifname, pid, NULL); | ||
| 67 | if (err) { | ||
| 68 | ERROR("failed to move '%s' to the container : %s", | ||
| 69 | netdev->link, strerror(-err)); | ||
| 70 | -- | ||
| 71 | 2.7.4 | ||
| 72 | |||
diff --git a/recipes-containers/lxc/files/lxc_setup_fs-Create-dev-shm-folder-if-it-doesn-t-exi.patch b/recipes-containers/lxc/files/lxc_setup_fs-Create-dev-shm-folder-if-it-doesn-t-exi.patch deleted file mode 100644 index 751a7ac6..00000000 --- a/recipes-containers/lxc/files/lxc_setup_fs-Create-dev-shm-folder-if-it-doesn-t-exi.patch +++ /dev/null | |||
| @@ -1,39 +0,0 @@ | |||
| 1 | From 81e3c9cf8b2f230d761738da28e9dc69fb90ec46 Mon Sep 17 00:00:00 2001 | ||
| 2 | From: Bogdan Purcareata <bogdan.purcareata@nxp.com> | ||
| 3 | Date: Fri, 8 Jan 2016 15:38:44 +0000 | ||
| 4 | Subject: [PATCH] lxc_setup_fs: Create /dev/shm folder if it doesn't exist | ||
| 5 | |||
| 6 | When running application containers with lxc-execute, /dev is | ||
| 7 | populated only with device entries. Since /dev is a tmpfs mount in | ||
| 8 | the container environment, the /dev/shm folder not being present is not | ||
| 9 | a sufficient reason for the /dev/shm mount to fail. | ||
| 10 | |||
| 11 | Create the /dev/shm directory if not present. | ||
| 12 | |||
| 13 | Upstream-status: Accepted | ||
| 14 | [https://github.com/lxc/lxc/commit/81e3c9cf8b2f230d761738da28e9dc69fb90ec46] | ||
| 15 | |||
| 16 | Signed-off-by: Bogdan Purcareata <bogdan.purcareata@nxp.com> | ||
| 17 | Acked-by: Serge E. Hallyn <serge.hallyn@ubuntu.com> | ||
| 18 | --- | ||
| 19 | src/lxc/initutils.c | 4 ++++ | ||
| 20 | 1 file changed, 4 insertions(+) | ||
| 21 | |||
| 22 | diff --git a/src/lxc/initutils.c b/src/lxc/initutils.c | ||
| 23 | index 45df60f..8d9016c 100644 | ||
| 24 | --- a/src/lxc/initutils.c | ||
| 25 | +++ b/src/lxc/initutils.c | ||
| 26 | @@ -47,6 +47,10 @@ extern void lxc_setup_fs(void) | ||
| 27 | if (mount_fs("proc", "/proc", "proc")) | ||
| 28 | INFO("failed to remount proc"); | ||
| 29 | |||
| 30 | + /* if /dev has been populated by us, /dev/shm does not exist */ | ||
| 31 | + if (access("/dev/shm", F_OK) && mkdir("/dev/shm", 0777)) | ||
| 32 | + INFO("failed to create /dev/shm"); | ||
| 33 | + | ||
| 34 | /* if we can't mount /dev/shm, continue anyway */ | ||
| 35 | if (mount_fs("shmfs", "/dev/shm", "tmpfs")) | ||
| 36 | INFO("failed to mount /dev/shm"); | ||
| 37 | -- | ||
| 38 | 1.9.1 | ||
| 39 | |||
diff --git a/recipes-containers/lxc/files/make-some-OpenSSH-tools-optional.patch b/recipes-containers/lxc/files/make-some-OpenSSH-tools-optional.patch deleted file mode 100644 index 2d287885..00000000 --- a/recipes-containers/lxc/files/make-some-OpenSSH-tools-optional.patch +++ /dev/null | |||
| @@ -1,49 +0,0 @@ | |||
| 1 | From 34be0d3cd8c4eaca9929470bc8bce5e74975bccf Mon Sep 17 00:00:00 2001 | ||
| 2 | From: Bogdan Purcareata <bogdan.purcareata@freescale.com> | ||
| 3 | Date: Thu, 23 Apr 2015 08:33:00 +0000 | ||
| 4 | Subject: [PATCH] lxc-busybox: make some OpenSSH tools optional | ||
| 5 | |||
| 6 | Currently, when installing OpenSSH in a Busybox container, the template searches | ||
| 7 | for all the OpenSSH client binaries available in the Debian distro package. The | ||
| 8 | included tools might differ from distro to distro, so make part of the tools | ||
| 9 | optional. The mandatory tools, without which installing OpenSSH fails, are | ||
| 10 | "sshd" for the server and "ssh" and "scp" for the client. | ||
| 11 | |||
| 12 | Upstream-Status: Submitted | ||
| 13 | [https://lists.linuxcontainers.org/pipermail/lxc-devel/2015-April/011696.html] | ||
| 14 | |||
| 15 | Signed-off-by: Bogdan Purcareata <bogdan.purcareata@freescale.com> | ||
| 16 | --- | ||
| 17 | templates/lxc-busybox.in | 9 +++++++++ | ||
| 18 | 1 file changed, 9 insertions(+) | ||
| 19 | |||
| 20 | diff --git a/templates/lxc-busybox.in b/templates/lxc-busybox.in | ||
| 21 | index 95961a3..17a3006 100644 | ||
| 22 | --- a/templates/lxc-busybox.in | ||
| 23 | +++ b/templates/lxc-busybox.in | ||
| 24 | @@ -197,6 +197,8 @@ install_openssh() | ||
| 25 | client_utils="\ | ||
| 26 | ssh \ | ||
| 27 | scp \ | ||
| 28 | + " | ||
| 29 | + client_optional_utils="\ | ||
| 30 | sftp \ | ||
| 31 | ssh-add \ | ||
| 32 | ssh-agent \ | ||
| 33 | @@ -230,6 +232,13 @@ $rootfs/var/run/sshd \ | ||
| 34 | fi | ||
| 35 | done | ||
| 36 | |||
| 37 | + for bin in $client_optional_utils; do | ||
| 38 | + tool_path=`which $bin` | ||
| 39 | + if [ $? -eq 0 ]; then | ||
| 40 | + cp $tool_path $rootfs/$tool_path | ||
| 41 | + fi | ||
| 42 | + done | ||
| 43 | + | ||
| 44 | # add user and group | ||
| 45 | cat <<EOF >> $rootfs/etc/passwd | ||
| 46 | sshd:x:74:74:Privilege-separated SSH:/var/empty/sshd:/sbin/nologin | ||
| 47 | -- | ||
| 48 | 2.1.4 | ||
| 49 | |||
diff --git a/recipes-containers/lxc/files/mount_proc_if_needed-only-safe-mount-when-rootfs-is-.patch b/recipes-containers/lxc/files/mount_proc_if_needed-only-safe-mount-when-rootfs-is-.patch deleted file mode 100644 index c3afd858..00000000 --- a/recipes-containers/lxc/files/mount_proc_if_needed-only-safe-mount-when-rootfs-is-.patch +++ /dev/null | |||
| @@ -1,69 +0,0 @@ | |||
| 1 | From f267d6668e3a95cb2247accb169cf1bc7f8ffcab Mon Sep 17 00:00:00 2001 | ||
| 2 | From: Bogdan Purcareata <bogdan.purcareata@nxp.com> | ||
| 3 | Date: Wed, 20 Jan 2016 10:53:57 +0000 | ||
| 4 | Subject: [PATCH] mount_proc_if_needed: only safe mount when rootfs is defined | ||
| 5 | |||
| 6 | The safe_mount function was introduced in order to address CVE-2015-1335, | ||
| 7 | one of the vulnerabilities being a mount with a symlink for the | ||
| 8 | destination path. In scenarios such as lxc-execute with no rootfs, the | ||
| 9 | destination path is the host /proc, which is previously mounted by the | ||
| 10 | host, and is unmounted and mounted again in a new set of namespaces, | ||
| 11 | therefore eliminating the need to check for it being a symlink. | ||
| 12 | |||
| 13 | Mount the rootfs normally if the rootfs is NULL, keep the safe mount | ||
| 14 | only for scenarios where a different rootfs is defined. | ||
| 15 | |||
| 16 | Upstream-status: Accepted | ||
| 17 | [https://github.com/lxc/lxc/commit/f267d6668e3a95cb2247accb169cf1bc7f8ffcab] | ||
| 18 | |||
| 19 | Signed-off-by: Bogdan Purcareata <bogdan.purcareata@nxp.com> | ||
| 20 | Acked-by: Serge E. Hallyn <serge.hallyn@ubuntu.com> | ||
| 21 | --- | ||
| 22 | src/lxc/conf.c | 1 + | ||
| 23 | src/lxc/utils.c | 10 +++++++++- | ||
| 24 | 2 files changed, 10 insertions(+), 1 deletion(-) | ||
| 25 | |||
| 26 | diff --git a/src/lxc/conf.c b/src/lxc/conf.c | ||
| 27 | index 632dde3..1e30c0c 100644 | ||
| 28 | --- a/src/lxc/conf.c | ||
| 29 | +++ b/src/lxc/conf.c | ||
| 30 | @@ -3509,6 +3509,7 @@ int ttys_shift_ids(struct lxc_conf *c) | ||
| 31 | return 0; | ||
| 32 | } | ||
| 33 | |||
| 34 | +/* NOTE: not to be called from inside the container namespace! */ | ||
| 35 | int tmp_proc_mount(struct lxc_conf *lxc_conf) | ||
| 36 | { | ||
| 37 | int mounted; | ||
| 38 | diff --git a/src/lxc/utils.c b/src/lxc/utils.c | ||
| 39 | index 4e96a50..0bc7a20 100644 | ||
| 40 | --- a/src/lxc/utils.c | ||
| 41 | +++ b/src/lxc/utils.c | ||
| 42 | @@ -1704,6 +1704,8 @@ int safe_mount(const char *src, const char *dest, const char *fstype, | ||
| 43 | * | ||
| 44 | * Returns < 0 on failure, 0 if the correct proc was already mounted | ||
| 45 | * and 1 if a new proc was mounted. | ||
| 46 | + * | ||
| 47 | + * NOTE: not to be called from inside the container namespace! | ||
| 48 | */ | ||
| 49 | int mount_proc_if_needed(const char *rootfs) | ||
| 50 | { | ||
| 51 | @@ -1737,8 +1739,14 @@ int mount_proc_if_needed(const char *rootfs) | ||
| 52 | return 0; | ||
| 53 | |||
| 54 | domount: | ||
| 55 | - if (safe_mount("proc", path, "proc", 0, NULL, rootfs) < 0) | ||
| 56 | + if (!strcmp(rootfs,"")) /* rootfs is NULL */ | ||
| 57 | + ret = mount("proc", path, "proc", 0, NULL); | ||
| 58 | + else | ||
| 59 | + ret = safe_mount("proc", path, "proc", 0, NULL, rootfs); | ||
| 60 | + | ||
| 61 | + if (ret < 0) | ||
| 62 | return -1; | ||
| 63 | + | ||
| 64 | INFO("Mounted /proc in container for security transition"); | ||
| 65 | return 1; | ||
| 66 | } | ||
| 67 | -- | ||
| 68 | 1.9.1 | ||
| 69 | |||
diff --git a/recipes-containers/lxc/files/open_without_symlink-Account-when-prefix-is-empty-st.patch b/recipes-containers/lxc/files/open_without_symlink-Account-when-prefix-is-empty-st.patch deleted file mode 100644 index 28f9889b..00000000 --- a/recipes-containers/lxc/files/open_without_symlink-Account-when-prefix-is-empty-st.patch +++ /dev/null | |||
| @@ -1,37 +0,0 @@ | |||
| 1 | From 01074e5b34719537cef474c6b81d4f55e6427639 Mon Sep 17 00:00:00 2001 | ||
| 2 | From: Bogdan Purcareata <bogdan.purcareata@nxp.com> | ||
| 3 | Date: Fri, 8 Jan 2016 15:38:35 +0000 | ||
| 4 | Subject: [PATCH] open_without_symlink: Account when prefix is empty string | ||
| 5 | |||
| 6 | In the current implementation, the open_without_symlink function | ||
| 7 | will default to opening the root mount only if the passed rootfs | ||
| 8 | prefix is null. It doesn't account for the case where this prefix | ||
| 9 | is passed as an empty string. | ||
| 10 | |||
| 11 | Properly handle this second case as well. | ||
| 12 | |||
| 13 | Upstream-Status: Accepted | ||
| 14 | [https://github.com/lxc/lxc/commit/01074e5b34719537cef474c6b81d4f55e6427639] | ||
| 15 | |||
| 16 | Signed-off-by: Bogdan Purcareata <bogdan.purcareata@nxp.com> | ||
| 17 | Acked-by: Serge E. Hallyn <serge.hallyn@ubuntu.com> | ||
| 18 | --- | ||
| 19 | src/lxc/utils.c | 2 +- | ||
| 20 | 1 file changed, 1 insertion(+), 1 deletion(-) | ||
| 21 | |||
| 22 | diff --git a/src/lxc/utils.c b/src/lxc/utils.c | ||
| 23 | index ed8c4c4..4e96a50 100644 | ||
| 24 | --- a/src/lxc/utils.c | ||
| 25 | +++ b/src/lxc/utils.c | ||
| 26 | @@ -1575,7 +1575,7 @@ static int open_without_symlink(const char *target, const char *prefix_skip) | ||
| 27 | fulllen = strlen(target); | ||
| 28 | |||
| 29 | /* make sure prefix-skip makes sense */ | ||
| 30 | - if (prefix_skip) { | ||
| 31 | + if (prefix_skip && strlen(prefix_skip) > 0) { | ||
| 32 | curlen = strlen(prefix_skip); | ||
| 33 | if (!is_subdir(target, prefix_skip, curlen)) { | ||
| 34 | ERROR("WHOA there - target '%s' didn't start with prefix '%s'", | ||
| 35 | -- | ||
| 36 | 1.9.1 | ||
| 37 | |||
diff --git a/recipes-containers/lxc/files/open_without_symlink-Don-t-SYSERROR-on-something-els.patch b/recipes-containers/lxc/files/open_without_symlink-Don-t-SYSERROR-on-something-els.patch deleted file mode 100644 index 098ead7e..00000000 --- a/recipes-containers/lxc/files/open_without_symlink-Don-t-SYSERROR-on-something-els.patch +++ /dev/null | |||
| @@ -1,49 +0,0 @@ | |||
| 1 | From 88e078ba865b675f9a0dc61caa0732d7052593f8 Mon Sep 17 00:00:00 2001 | ||
| 2 | From: Christian Brauner <christian.brauner@mailbox.org> | ||
| 3 | Date: Wed, 23 Mar 2016 16:37:09 +0100 | ||
| 4 | Subject: [PATCH] open_without_symlink: Don't SYSERROR on something else than | ||
| 5 | ELOOP | ||
| 6 | |||
| 7 | The open_without_symlink routine has been specifically created to prevent | ||
| 8 | mounts with synlinks as source or destination. Keep SYSERROR'ing in that | ||
| 9 | particular scenario, but leave error handling to calling functions for the | ||
| 10 | other ones - e.g. optional bind mount when the source dir doesn't exist | ||
| 11 | throws a nasty error. | ||
| 12 | |||
| 13 | Upstream-status: Accepted | ||
| 14 | [https://github.com/lxc/lxc/commit/88e078ba865b675f9a0dc61caa0732d7052593f8] | ||
| 15 | |||
| 16 | Signed-off-by: Bogdan Purcareata <bogdan.purcareata@nxp.com> | ||
| 17 | --- | ||
| 18 | src/lxc/utils.c | 7 ++++--- | ||
| 19 | 1 file changed, 4 insertions(+), 3 deletions(-) | ||
| 20 | |||
| 21 | diff --git a/src/lxc/utils.c b/src/lxc/utils.c | ||
| 22 | index 6bee698..8e7ebbc 100644 | ||
| 23 | --- a/src/lxc/utils.c | ||
| 24 | +++ b/src/lxc/utils.c | ||
| 25 | @@ -1621,8 +1621,6 @@ static int open_without_symlink(const char *target, const char *prefix_skip) | ||
| 26 | errno = saved_errno; | ||
| 27 | if (errno == ELOOP) | ||
| 28 | SYSERROR("%s in %s was a symbolic link!", nextpath, target); | ||
| 29 | - else | ||
| 30 | - SYSERROR("Error examining %s in %s", nextpath, target); | ||
| 31 | goto out; | ||
| 32 | } | ||
| 33 | } | ||
| 34 | @@ -1667,8 +1665,11 @@ int safe_mount(const char *src, const char *dest, const char *fstype, | ||
| 35 | |||
| 36 | destfd = open_without_symlink(dest, rootfs); | ||
| 37 | if (destfd < 0) { | ||
| 38 | - if (srcfd != -1) | ||
| 39 | + if (srcfd != -1) { | ||
| 40 | + saved_errno = errno; | ||
| 41 | close(srcfd); | ||
| 42 | + errno = saved_errno; | ||
| 43 | + } | ||
| 44 | return destfd; | ||
| 45 | } | ||
| 46 | |||
| 47 | -- | ||
| 48 | 1.9.1 | ||
| 49 | |||
diff --git a/recipes-containers/lxc/lxc_1.1.5.bb b/recipes-containers/lxc/lxc_2.0.0.bb index 1864ef83..34aab38a 100644 --- a/recipes-containers/lxc/lxc_1.1.5.bb +++ b/recipes-containers/lxc/lxc_2.0.0.bb | |||
| @@ -26,25 +26,13 @@ SRC_URI = "http://linuxcontainers.org/downloads/${BPN}-${PV}.tar.gz \ | |||
| 26 | file://runtest.patch \ | 26 | file://runtest.patch \ |
| 27 | file://run-ptest \ | 27 | file://run-ptest \ |
| 28 | file://automake-ensure-VPATH-builds-correctly.patch \ | 28 | file://automake-ensure-VPATH-builds-correctly.patch \ |
| 29 | file://add-lxc.rebootsignal.patch \ | ||
| 30 | file://document-lxc.rebootsignal.patch \ | ||
| 31 | file://lxc-busybox-use-lxc.rebootsignal-SIGTERM.patch \ | ||
| 32 | file://lxc-fix-B-S.patch \ | 29 | file://lxc-fix-B-S.patch \ |
| 33 | file://lxc-busybox-add-OpenSSH-support.patch \ | ||
| 34 | file://make-some-OpenSSH-tools-optional.patch \ | ||
| 35 | file://lxc-doc-upgrade-to-use-docbook-3.1-DTD.patch \ | 30 | file://lxc-doc-upgrade-to-use-docbook-3.1-DTD.patch \ |
| 36 | file://logs-optionally-use-base-filenames-to-report-src-fil.patch \ | 31 | file://logs-optionally-use-base-filenames-to-report-src-fil.patch \ |
| 37 | file://open_without_symlink-Account-when-prefix-is-empty-st.patch \ | ||
| 38 | file://lxc_setup_fs-Create-dev-shm-folder-if-it-doesn-t-exi.patch \ | ||
| 39 | file://mount_proc_if_needed-only-safe-mount-when-rootfs-is-.patch \ | ||
| 40 | file://open_without_symlink-Don-t-SYSERROR-on-something-els.patch \ | ||
| 41 | file://lxc-busybox-Touch-etc-fstab-in-the-container-rootfs.patch \ | ||
| 42 | file://lxc-busybox-Remove-warning-for-dynamically-linked-Bu.patch \ | ||
| 43 | file://lxc-let-lxc-start-support-wlan-phys.patch \ | ||
| 44 | " | 32 | " |
| 45 | 33 | ||
| 46 | SRC_URI[md5sum] = "dd9684dde0a58ed13f4f49c855b79a1a" | 34 | SRC_URI[md5sum] = "04a7245a614cd3296b0ae9ceeeb83fbb" |
| 47 | SRC_URI[sha256sum] = "9588ad1b04e114ee7370f690c65131e28098b28d2521d97c73557d11897ed0be" | 35 | SRC_URI[sha256sum] = "5b737e114d8ef1feb193fba936d77a5697a7c8a10199a068cdd90d1bd27c10e4" |
| 48 | 36 | ||
| 49 | S = "${WORKDIR}/${BPN}-${PV}" | 37 | S = "${WORKDIR}/${BPN}-${PV}" |
| 50 | 38 | ||
