diff options
14 files changed, 8 insertions, 922 deletions
diff --git a/recipes-containers/lxc/files/add-lxc.rebootsignal.patch b/recipes-containers/lxc/files/add-lxc.rebootsignal.patch deleted file mode 100644 index e54d188f..00000000 --- a/recipes-containers/lxc/files/add-lxc.rebootsignal.patch +++ /dev/null | |||
@@ -1,96 +0,0 @@ | |||
1 | From dd267776ee265737520c2c661a51c2d29cf43cb0 Mon Sep 17 00:00:00 2001 | ||
2 | From: Bogdan Purcareata <bogdan.purcareata@freescale.com> | ||
3 | Date: Mon, 16 Feb 2015 09:38:34 +0000 | ||
4 | Subject: [PATCH 10/12] add lxc.rebootsignal | ||
5 | |||
6 | Following the model of f0f1d8c076ae93d8ecf735c2eeae471e27ca6abd, add a reboot | ||
7 | signal for special init processes that work on something other than SIGINT. | ||
8 | |||
9 | Upstream-Status: Accepted | ||
10 | [https://github.com/lxc/lxc/commit/dd267776ee265737520c2c661a51c2d29cf43cb0] | ||
11 | |||
12 | Signed-off-by: Bogdan Purcareata <bogdan.purcareata@freescale.com> | ||
13 | Acked-by: Serge E. Hallyn <serge.hallyn@ubuntu.com> | ||
14 | --- | ||
15 | src/lxc/conf.h | 1 + | ||
16 | src/lxc/confile.c | 14 ++++++++++++++ | ||
17 | src/lxc/lxccontainer.c | 5 ++++- | ||
18 | 3 files changed, 19 insertions(+), 1 deletion(-) | ||
19 | |||
20 | diff --git a/src/lxc/conf.h b/src/lxc/conf.h | ||
21 | index afa5517..334ea70 100644 | ||
22 | --- a/src/lxc/conf.h | ||
23 | +++ b/src/lxc/conf.h | ||
24 | @@ -323,6 +323,7 @@ struct lxc_conf { | ||
25 | int maincmd_fd; | ||
26 | int autodev; // if 1, mount and fill a /dev at start | ||
27 | int haltsignal; // signal used to halt container | ||
28 | + int rebootsignal; // signal used to reboot container | ||
29 | int stopsignal; // signal used to hard stop container | ||
30 | int kmsg; // if 1, create /dev/kmsg symlink | ||
31 | char *rcfile; // Copy of the top level rcfile we read | ||
32 | diff --git a/src/lxc/confile.c b/src/lxc/confile.c | ||
33 | index 8544ac9..42d42e5 100644 | ||
34 | --- a/src/lxc/confile.c | ||
35 | +++ b/src/lxc/confile.c | ||
36 | @@ -98,6 +98,7 @@ static int config_includefile(const char *, const char *, struct lxc_conf *); | ||
37 | static int config_network_nic(const char *, const char *, struct lxc_conf *); | ||
38 | static int config_autodev(const char *, const char *, struct lxc_conf *); | ||
39 | static int config_haltsignal(const char *, const char *, struct lxc_conf *); | ||
40 | +static int config_rebootsignal(const char *, const char *, struct lxc_conf *); | ||
41 | static int config_stopsignal(const char *, const char *, struct lxc_conf *); | ||
42 | static int config_start(const char *, const char *, struct lxc_conf *); | ||
43 | static int config_group(const char *, const char *, struct lxc_conf *); | ||
44 | @@ -158,6 +159,7 @@ static struct lxc_config_t config[] = { | ||
45 | { "lxc.include", config_includefile }, | ||
46 | { "lxc.autodev", config_autodev }, | ||
47 | { "lxc.haltsignal", config_haltsignal }, | ||
48 | + { "lxc.rebootsignal", config_rebootsignal }, | ||
49 | { "lxc.stopsignal", config_stopsignal }, | ||
50 | { "lxc.start.auto", config_start }, | ||
51 | { "lxc.start.delay", config_start }, | ||
52 | @@ -1268,6 +1270,18 @@ static int config_haltsignal(const char *key, const char *value, | ||
53 | return 0; | ||
54 | } | ||
55 | |||
56 | +static int config_rebootsignal(const char *key, const char *value, | ||
57 | + struct lxc_conf *lxc_conf) | ||
58 | +{ | ||
59 | + int sig_n = sig_parse(value); | ||
60 | + | ||
61 | + if (sig_n < 0) | ||
62 | + return -1; | ||
63 | + lxc_conf->rebootsignal = sig_n; | ||
64 | + | ||
65 | + return 0; | ||
66 | +} | ||
67 | + | ||
68 | static int config_stopsignal(const char *key, const char *value, | ||
69 | struct lxc_conf *lxc_conf) | ||
70 | { | ||
71 | diff --git a/src/lxc/lxccontainer.c b/src/lxc/lxccontainer.c | ||
72 | index e02ee93..4422f4a 100644 | ||
73 | --- a/src/lxc/lxccontainer.c | ||
74 | +++ b/src/lxc/lxccontainer.c | ||
75 | @@ -1363,6 +1363,7 @@ free_tpath: | ||
76 | static bool lxcapi_reboot(struct lxc_container *c) | ||
77 | { | ||
78 | pid_t pid; | ||
79 | + int rebootsignal = SIGINT; | ||
80 | |||
81 | if (!c) | ||
82 | return false; | ||
83 | @@ -1371,7 +1372,9 @@ static bool lxcapi_reboot(struct lxc_container *c) | ||
84 | pid = c->init_pid(c); | ||
85 | if (pid <= 0) | ||
86 | return false; | ||
87 | - if (kill(pid, SIGINT) < 0) | ||
88 | + if (c->lxc_conf && c->lxc_conf->rebootsignal) | ||
89 | + rebootsignal = c->lxc_conf->rebootsignal; | ||
90 | + if (kill(pid, rebootsignal) < 0) | ||
91 | return false; | ||
92 | return true; | ||
93 | |||
94 | -- | ||
95 | 2.1.4 | ||
96 | |||
diff --git a/recipes-containers/lxc/files/document-lxc.rebootsignal.patch b/recipes-containers/lxc/files/document-lxc.rebootsignal.patch deleted file mode 100644 index d1cce40f..00000000 --- a/recipes-containers/lxc/files/document-lxc.rebootsignal.patch +++ /dev/null | |||
@@ -1,140 +0,0 @@ | |||
1 | From baefc2176780b5e4527c1f86206c0ea72d80c8f5 Mon Sep 17 00:00:00 2001 | ||
2 | From: Bogdan Purcareata <bogdan.purcareata@freescale.com> | ||
3 | Date: Tue, 10 Mar 2015 10:06:58 +0000 | ||
4 | Subject: [PATCH] document lxc.rebootsignal | ||
5 | |||
6 | Also fix some minor indentation mishaps since we're here. | ||
7 | |||
8 | Upstrem-Status: Backport [from LXC 1.1] | ||
9 | [https://github.com/lxc/lxc/commit/936762f3fb6cf10e0756719f03aebe052d5c31a8] | ||
10 | |||
11 | Signed-off-by: Bogdan Purcareata <bogdan.purcareata@freescale.com> | ||
12 | Acked-by: Serge E. Hallyn <serge.hallyn@ubuntu.com> | ||
13 | --- | ||
14 | doc/lxc-stop.sgml.in | 4 +- | ||
15 | doc/lxc.container.conf.sgml.in | 86 ++++++++++++++++++++++++++---------------- | ||
16 | 2 files changed, 57 insertions(+), 33 deletions(-) | ||
17 | |||
18 | diff --git a/doc/lxc-stop.sgml.in b/doc/lxc-stop.sgml.in | ||
19 | index bc5e6a8..3c69fed 100644 | ||
20 | --- a/doc/lxc-stop.sgml.in | ||
21 | +++ b/doc/lxc-stop.sgml.in | ||
22 | @@ -70,7 +70,9 @@ Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA | ||
23 | the container's init process, waiting up to 60 seconds for the container | ||
24 | to exit, and then returning. If the container fails to cleanly exit in | ||
25 | 60 seconds, it will be sent the <command>lxc.stopsignal</command> | ||
26 | - (defaults to SIGKILL) to force it to shut down. | ||
27 | + (defaults to SIGKILL) to force it to shut down. A request to reboot will | ||
28 | + send the <command>lxc.rebootsignal</command> (defaults to SIGINT) to the | ||
29 | + container's init process. | ||
30 | </para> | ||
31 | <para> | ||
32 | The <optional>-W</optional>, <optional>-r</optional>, | ||
33 | diff --git a/doc/lxc.container.conf.sgml.in b/doc/lxc.container.conf.sgml.in | ||
34 | index e98496d..1962528 100644 | ||
35 | --- a/doc/lxc.container.conf.sgml.in | ||
36 | +++ b/doc/lxc.container.conf.sgml.in | ||
37 | @@ -158,46 +158,68 @@ Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA | ||
38 | <refsect2> | ||
39 | <title>Halt signal</title> | ||
40 | <para> | ||
41 | - Allows one to specify signal name or number, sent by lxc-stop to the | ||
42 | - container's init process to cleanly shutdown the container. Different | ||
43 | - init systems could use different signals to perform clean shutdown | ||
44 | - sequence. This option allows the signal to be specified in kill(1) | ||
45 | - fashion, e.g. SIGPWR, SIGRTMIN+14, SIGRTMAX-10 or plain number. The | ||
46 | - default signal is SIGPWR. | ||
47 | + Allows one to specify signal name or number, sent by lxc-stop to the | ||
48 | + container's init process to cleanly shutdown the container. Different | ||
49 | + init systems could use different signals to perform clean shutdown | ||
50 | + sequence. This option allows the signal to be specified in kill(1) | ||
51 | + fashion, e.g. SIGPWR, SIGRTMIN+14, SIGRTMAX-10 or plain number. The | ||
52 | + default signal is SIGPWR. | ||
53 | </para> | ||
54 | <variablelist> | ||
55 | - <varlistentry> | ||
56 | - <term> | ||
57 | - <option>lxc.haltsignal</option> | ||
58 | - </term> | ||
59 | - <listitem> | ||
60 | - <para> | ||
61 | - specify the signal used to halt the container | ||
62 | - </para> | ||
63 | - </listitem> | ||
64 | - </varlistentry> | ||
65 | + <varlistentry> | ||
66 | + <term> | ||
67 | + <option>lxc.haltsignal</option> | ||
68 | + </term> | ||
69 | + <listitem> | ||
70 | + <para> | ||
71 | + specify the signal used to halt the container | ||
72 | + </para> | ||
73 | + </listitem> | ||
74 | + </varlistentry> | ||
75 | + </variablelist> | ||
76 | + </refsect2> | ||
77 | + | ||
78 | + <refsect2> | ||
79 | + <title>Reboot signal</title> | ||
80 | + <para> | ||
81 | + Allows one to specify signal name or number, sent by lxc-stop to | ||
82 | + reboot the container. This option allows signal to be specified in | ||
83 | + kill(1) fashion, e.g. SIGTERM, SIGRTMIN+14, SIGRTMAX-10 or plain number. | ||
84 | + The default signal is SIGINT. | ||
85 | + </para> | ||
86 | + <variablelist> | ||
87 | + <varlistentry> | ||
88 | + <term> | ||
89 | + <option>lxc.rebootsignal</option> | ||
90 | + </term> | ||
91 | + <listitem> | ||
92 | + <para> | ||
93 | + specify the signal used to reboot the container | ||
94 | + </para> | ||
95 | + </listitem> | ||
96 | + </varlistentry> | ||
97 | </variablelist> | ||
98 | </refsect2> | ||
99 | |||
100 | <refsect2> | ||
101 | <title>Stop signal</title> | ||
102 | <para> | ||
103 | - Allows one to specify signal name or number, sent by lxc-stop to forcibly | ||
104 | - shutdown the container. This option allows signal to be specified in | ||
105 | - kill(1) fashion, e.g. SIGKILL, SIGRTMIN+14, SIGRTMAX-10 or plain number. | ||
106 | - The default signal is SIGKILL. | ||
107 | - </para> | ||
108 | - <variablelist> | ||
109 | - <varlistentry> | ||
110 | - <term> | ||
111 | - <option>lxc.stopsignal</option> | ||
112 | - </term> | ||
113 | - <listitem> | ||
114 | - <para> | ||
115 | - specify the signal used to stop the container | ||
116 | - </para> | ||
117 | - </listitem> | ||
118 | - </varlistentry> | ||
119 | + Allows one to specify signal name or number, sent by lxc-stop to forcibly | ||
120 | + shutdown the container. This option allows signal to be specified in | ||
121 | + kill(1) fashion, e.g. SIGKILL, SIGRTMIN+14, SIGRTMAX-10 or plain number. | ||
122 | + The default signal is SIGKILL. | ||
123 | + </para> | ||
124 | + <variablelist> | ||
125 | + <varlistentry> | ||
126 | + <term> | ||
127 | + <option>lxc.stopsignal</option> | ||
128 | + </term> | ||
129 | + <listitem> | ||
130 | + <para> | ||
131 | + specify the signal used to stop the container | ||
132 | + </para> | ||
133 | + </listitem> | ||
134 | + </varlistentry> | ||
135 | </variablelist> | ||
136 | </refsect2> | ||
137 | |||
138 | -- | ||
139 | 2.1.4 | ||
140 | |||
diff --git a/recipes-containers/lxc/files/lxc-busybox-Remove-warning-for-dynamically-linked-Bu.patch b/recipes-containers/lxc/files/lxc-busybox-Remove-warning-for-dynamically-linked-Bu.patch deleted file mode 100644 index c0a810b1..00000000 --- a/recipes-containers/lxc/files/lxc-busybox-Remove-warning-for-dynamically-linked-Bu.patch +++ /dev/null | |||
@@ -1,43 +0,0 @@ | |||
1 | From 07e4c41f2963d73b9aedd552c74f17a33e89f020 Mon Sep 17 00:00:00 2001 | ||
2 | From: Bogdan Purcareata <bogdan.purcareata@nxp.com> | ||
3 | Date: Thu, 24 Mar 2016 11:54:27 +0000 | ||
4 | Subject: [PATCH] lxc-busybox: Remove warning for dynamically linked Busybox | ||
5 | MIME-Version: 1.0 | ||
6 | Content-Type: text/plain; charset=UTF-8 | ||
7 | Content-Transfer-Encoding: 8bit | ||
8 | |||
9 | The warning has been present since commit 32b37181ea (with no purpose stated). | ||
10 | Support for dynamically linked Busybox has been added since commit bf6cc73696. | ||
11 | Haven't encountered any issues with dynamically linked Busybox in my last | ||
12 | 2 years' testing. | ||
13 | |||
14 | Upstream-status: Accepted | ||
15 | [https://github.com/lxc/lxc/commit/07e4c41f2963d73b9aedd552c74f17a33e89f020] | ||
16 | |||
17 | Signed-off-by: Bogdan Purcareata <bogdan.purcareata@nxp.com> | ||
18 | Acked-by: Stéphane Graber <stgraber@ubuntu.com> | ||
19 | --- | ||
20 | templates/lxc-busybox.in | 7 ------- | ||
21 | 1 file changed, 7 deletions(-) | ||
22 | |||
23 | diff --git a/templates/lxc-busybox.in b/templates/lxc-busybox.in | ||
24 | index f547f9e..336fa12 100644 | ||
25 | --- a/templates/lxc-busybox.in | ||
26 | +++ b/templates/lxc-busybox.in | ||
27 | @@ -304,13 +304,6 @@ configure_busybox() | ||
28 | return 1 | ||
29 | fi | ||
30 | |||
31 | - file -L $(which busybox) | grep -q "statically linked" | ||
32 | - if [ $? -ne 0 ]; then | ||
33 | - echo "warning : busybox is not statically linked." | ||
34 | - echo "warning : The template script may not correctly" | ||
35 | - echo "warning : setup the container environment." | ||
36 | - fi | ||
37 | - | ||
38 | # copy busybox in the rootfs | ||
39 | cp $(which busybox) $rootfs/bin | ||
40 | if [ $? -ne 0 ]; then | ||
41 | -- | ||
42 | 1.9.1 | ||
43 | |||
diff --git a/recipes-containers/lxc/files/lxc-busybox-Touch-etc-fstab-in-the-container-rootfs.patch b/recipes-containers/lxc/files/lxc-busybox-Touch-etc-fstab-in-the-container-rootfs.patch deleted file mode 100644 index 33862ddc..00000000 --- a/recipes-containers/lxc/files/lxc-busybox-Touch-etc-fstab-in-the-container-rootfs.patch +++ /dev/null | |||
@@ -1,30 +0,0 @@ | |||
1 | From 6ab1ca0375feeb00070f0c0f9186551b08b1ee5e Mon Sep 17 00:00:00 2001 | ||
2 | From: Bogdan Purcareata <bogdan.purcareata@nxp.com> | ||
3 | Date: Tue, 22 Mar 2016 13:33:57 +0000 | ||
4 | Subject: [PATCH] lxc-busybox: Touch /etc/fstab in the container rootfs | ||
5 | |||
6 | Upstream-status: Accepted | ||
7 | [https://github.com/lxc/lxc/commit/6ab1ca0375feeb00070f0c0f9186551b08b1ee5e] | ||
8 | |||
9 | Signed-off-by: Bogdan Purcareata <bogdan.purcareata@nxp.com> | ||
10 | --- | ||
11 | templates/lxc-busybox.in | 3 +++ | ||
12 | 1 file changed, 3 insertions(+) | ||
13 | |||
14 | diff --git a/templates/lxc-busybox.in b/templates/lxc-busybox.in | ||
15 | index c020e66..f547f9e 100644 | ||
16 | --- a/templates/lxc-busybox.in | ||
17 | +++ b/templates/lxc-busybox.in | ||
18 | @@ -330,6 +330,9 @@ configure_busybox() | ||
19 | # relink /sbin/init | ||
20 | ln $rootfs/bin/busybox $rootfs/sbin/init | ||
21 | |||
22 | + # /etc/fstab must exist for "mount -a" | ||
23 | + touch $rootfs/etc/fstab | ||
24 | + | ||
25 | # passwd exec must be setuid | ||
26 | chmod +s $rootfs/bin/passwd | ||
27 | touch $rootfs/etc/shadow | ||
28 | -- | ||
29 | 1.9.1 | ||
30 | |||
diff --git a/recipes-containers/lxc/files/lxc-busybox-add-OpenSSH-support.patch b/recipes-containers/lxc/files/lxc-busybox-add-OpenSSH-support.patch deleted file mode 100644 index f2f332cb..00000000 --- a/recipes-containers/lxc/files/lxc-busybox-add-OpenSSH-support.patch +++ /dev/null | |||
@@ -1,246 +0,0 @@ | |||
1 | From ed52814c776963efdcc9dcda1ec26fc09930ef93 Mon Sep 17 00:00:00 2001 | ||
2 | From: Bogdan Purcareata <bogdan.purcareata@freescale.com> | ||
3 | Date: Wed, 22 Apr 2015 14:53:32 +0000 | ||
4 | Subject: [PATCH] lxc-busybox: add OpenSSH support | ||
5 | MIME-Version: 1.0 | ||
6 | Content-Type: text/plain; charset=UTF-8 | ||
7 | Content-Transfer-Encoding: 8bit | ||
8 | |||
9 | Add an additional template parameter for SSH support in the container. Currently | ||
10 | this can be implemented using the Dropbear or OpenSSH utility. The respective | ||
11 | tool needs to be available on the host Linux. | ||
12 | |||
13 | If the parameter is omitted, the template will look for the Dropbear utility on | ||
14 | the host and install it if it is available (legacy behavior). | ||
15 | |||
16 | Adding OpenSSH support has been done following the model in the lxc-sshd | ||
17 | template. | ||
18 | |||
19 | Upstream-status: Accepted | ||
20 | [https://github.com/lxc/lxc/commit/ed52814c776963efdcc9dcda1ec26fc09930ef93] | ||
21 | |||
22 | Signed-off-by: Bogdan Purcareata <bogdan.purcareata@freescale.com> | ||
23 | Acked-by: Stéphane Graber <stgraber@ubuntu.com> | ||
24 | --- | ||
25 | templates/lxc-busybox.in | 169 ++++++++++++++++++++++++++++++++++++++--------- | ||
26 | 1 file changed, 139 insertions(+), 30 deletions(-) | ||
27 | |||
28 | diff --git a/templates/lxc-busybox.in b/templates/lxc-busybox.in | ||
29 | index 7e05bd6..95961a3 100644 | ||
30 | --- a/templates/lxc-busybox.in | ||
31 | +++ b/templates/lxc-busybox.in | ||
32 | @@ -22,6 +22,7 @@ | ||
33 | |||
34 | LXC_MAPPED_UID= | ||
35 | LXC_MAPPED_GID= | ||
36 | +SSH= | ||
37 | |||
38 | # Make sure the usual locations are in PATH | ||
39 | export PATH=$PATH:/usr/sbin:/usr/bin:/sbin:/bin | ||
40 | @@ -160,6 +161,116 @@ EOF | ||
41 | return $res | ||
42 | } | ||
43 | |||
44 | +install_dropbear() | ||
45 | +{ | ||
46 | + # copy dropbear binary | ||
47 | + cp $(which dropbear) $rootfs/usr/sbin | ||
48 | + if [ $? -ne 0 ]; then | ||
49 | + echo "Failed to copy dropbear in the rootfs" | ||
50 | + return 1 | ||
51 | + fi | ||
52 | + | ||
53 | + # make symlinks to various ssh utilities | ||
54 | + utils="\ | ||
55 | + $rootfs/usr/bin/dbclient \ | ||
56 | + $rootfs/usr/bin/scp \ | ||
57 | + $rootfs/usr/bin/ssh \ | ||
58 | + $rootfs/usr/sbin/dropbearkey \ | ||
59 | + $rootfs/usr/sbin/dropbearconvert \ | ||
60 | + " | ||
61 | + echo $utils | xargs -n1 ln -s /usr/sbin/dropbear | ||
62 | + | ||
63 | + # add necessary config files | ||
64 | + mkdir $rootfs/etc/dropbear | ||
65 | + dropbearkey -t rsa -f $rootfs/etc/dropbear/dropbear_rsa_host_key > /dev/null 2>&1 | ||
66 | + dropbearkey -t dss -f $rootfs/etc/dropbear/dropbear_dss_host_key > /dev/null 2>&1 | ||
67 | + | ||
68 | + echo "'dropbear' ssh utility installed" | ||
69 | + | ||
70 | + return 0 | ||
71 | +} | ||
72 | + | ||
73 | +install_openssh() | ||
74 | +{ | ||
75 | + # tools to be installed | ||
76 | + server_utils="sshd" | ||
77 | + client_utils="\ | ||
78 | + ssh \ | ||
79 | + scp \ | ||
80 | + sftp \ | ||
81 | + ssh-add \ | ||
82 | + ssh-agent \ | ||
83 | + ssh-keygen \ | ||
84 | + ssh-keyscan \ | ||
85 | + ssh-argv0 \ | ||
86 | + ssh-copy-id \ | ||
87 | + " | ||
88 | + | ||
89 | + # new folders used by ssh | ||
90 | + ssh_tree="\ | ||
91 | +$rootfs/etc/ssh \ | ||
92 | +$rootfs/var/empty/sshd \ | ||
93 | +$rootfs/var/lib/empty/sshd \ | ||
94 | +$rootfs/var/run/sshd \ | ||
95 | +" | ||
96 | + | ||
97 | + # create folder structure | ||
98 | + mkdir -p $ssh_tree | ||
99 | + if [ $? -ne 0 ]; then | ||
100 | + return 1 | ||
101 | + fi | ||
102 | + | ||
103 | + # copy binaries | ||
104 | + for bin in $server_utils $client_utils; do | ||
105 | + tool_path=`which $bin` | ||
106 | + cp $tool_path $rootfs/$tool_path | ||
107 | + if [ $? -ne 0 ]; then | ||
108 | + echo "Unable to copy $tool_path in the rootfs" | ||
109 | + return 1 | ||
110 | + fi | ||
111 | + done | ||
112 | + | ||
113 | + # add user and group | ||
114 | + cat <<EOF >> $rootfs/etc/passwd | ||
115 | +sshd:x:74:74:Privilege-separated SSH:/var/empty/sshd:/sbin/nologin | ||
116 | +EOF | ||
117 | + | ||
118 | + cat <<EOF >> $rootfs/etc/group | ||
119 | +sshd:x:74: | ||
120 | +EOF | ||
121 | + | ||
122 | + # generate container keys | ||
123 | + ssh-keygen -t rsa -N "" -f $rootfs/etc/ssh/ssh_host_rsa_key >/dev/null 2>&1 | ||
124 | + ssh-keygen -t dsa -N "" -f $rootfs/etc/ssh/ssh_host_dsa_key >/dev/null 2>&1 | ||
125 | + | ||
126 | + # by default setup root password with no password | ||
127 | + cat <<EOF > $rootfs/etc/ssh/sshd_config | ||
128 | +Port 22 | ||
129 | +Protocol 2 | ||
130 | +HostKey /etc/ssh/ssh_host_rsa_key | ||
131 | +HostKey /etc/ssh/ssh_host_dsa_key | ||
132 | +UsePrivilegeSeparation yes | ||
133 | +KeyRegenerationInterval 3600 | ||
134 | +ServerKeyBits 768 | ||
135 | +SyslogFacility AUTH | ||
136 | +LogLevel INFO | ||
137 | +LoginGraceTime 120 | ||
138 | +PermitRootLogin yes | ||
139 | +StrictModes yes | ||
140 | +RSAAuthentication yes | ||
141 | +PubkeyAuthentication yes | ||
142 | +IgnoreRhosts yes | ||
143 | +RhostsRSAAuthentication no | ||
144 | +HostbasedAuthentication no | ||
145 | +PermitEmptyPasswords yes | ||
146 | +ChallengeResponseAuthentication no | ||
147 | +EOF | ||
148 | + | ||
149 | + echo "'OpenSSH' utility installed" | ||
150 | + | ||
151 | + return 0 | ||
152 | +} | ||
153 | + | ||
154 | configure_busybox() | ||
155 | { | ||
156 | rootfs=$1 | ||
157 | @@ -230,34 +341,6 @@ EOF | ||
158 | lxc-unshare -s MOUNT -- /bin/sh < $CHPASSWD_FILE | ||
159 | rm $CHPASSWD_FILE | ||
160 | |||
161 | - # add ssh functionality if dropbear package available on host | ||
162 | - which dropbear >/dev/null 2>&1 | ||
163 | - if [ $? -eq 0 ]; then | ||
164 | - # copy dropbear binary | ||
165 | - cp $(which dropbear) $rootfs/usr/sbin | ||
166 | - if [ $? -ne 0 ]; then | ||
167 | - echo "Failed to copy dropbear in the rootfs" | ||
168 | - return 1 | ||
169 | - fi | ||
170 | - | ||
171 | - # make symlinks to various ssh utilities | ||
172 | - utils="\ | ||
173 | - $rootfs/usr/bin/dbclient \ | ||
174 | - $rootfs/usr/bin/scp \ | ||
175 | - $rootfs/usr/bin/ssh \ | ||
176 | - $rootfs/usr/sbin/dropbearkey \ | ||
177 | - $rootfs/usr/sbin/dropbearconvert \ | ||
178 | - " | ||
179 | - echo $utils | xargs -n1 ln -s /usr/sbin/dropbear | ||
180 | - | ||
181 | - # add necessary config files | ||
182 | - mkdir $rootfs/etc/dropbear | ||
183 | - dropbearkey -t rsa -f $rootfs/etc/dropbear/dropbear_rsa_host_key > /dev/null 2>&1 | ||
184 | - dropbearkey -t dss -f $rootfs/etc/dropbear/dropbear_dss_host_key > /dev/null 2>&1 | ||
185 | - | ||
186 | - echo "'dropbear' ssh utility installed" | ||
187 | - fi | ||
188 | - | ||
189 | return 0 | ||
190 | } | ||
191 | |||
192 | @@ -315,12 +398,12 @@ remap_userns() | ||
193 | usage() | ||
194 | { | ||
195 | cat <<EOF | ||
196 | -$1 -h|--help -p|--path=<path> | ||
197 | +$1 -h|--help -p|--path=<path> -s|--ssh={dropbear,openssh} | ||
198 | EOF | ||
199 | return 0 | ||
200 | } | ||
201 | |||
202 | -options=$(getopt -o hp:n: -l help,rootfs:,path:,name:,mapped-uid:,mapped-gid: -- "$@") | ||
203 | +options=$(getopt -o hp:n:s: -l help,rootfs:,path:,name:,mapped-uid:,mapped-gid:,ssh: -- "$@") | ||
204 | if [ $? -ne 0 ]; then | ||
205 | usage $(basename $0) | ||
206 | exit 1 | ||
207 | @@ -336,6 +419,7 @@ do | ||
208 | -n|--name) name=$2; shift 2;; | ||
209 | --mapped-uid) LXC_MAPPED_UID=$2; shift 2;; | ||
210 | --mapped-gid) LXC_MAPPED_GID=$2; shift 2;; | ||
211 | + -s|--ssh) SSH=$2; shift 2;; | ||
212 | --) shift 1; break ;; | ||
213 | *) break ;; | ||
214 | esac | ||
215 | @@ -384,3 +468,28 @@ if [ $? -ne 0 ]; then | ||
216 | echo "failed to remap files to user" | ||
217 | exit 1 | ||
218 | fi | ||
219 | + | ||
220 | +if [ -n "$SSH" ]; then | ||
221 | + case "$SSH" in | ||
222 | + "dropbear") | ||
223 | + install_dropbear | ||
224 | + if [ $? -ne 0 ]; then | ||
225 | + echo "Unable to install 'dropbear' ssh utility" | ||
226 | + exit 1 | ||
227 | + fi ;; | ||
228 | + "openssh") | ||
229 | + install_openssh | ||
230 | + if [ $? -ne 0 ]; then | ||
231 | + echo "Unable to install 'OpenSSH' utility" | ||
232 | + exit 1 | ||
233 | + fi ;; | ||
234 | + *) | ||
235 | + echo "$SSH: unrecognized ssh utility" | ||
236 | + exit 1 | ||
237 | + esac | ||
238 | +else | ||
239 | + which dropbear >/dev/null 2>&1 | ||
240 | + if [ $? -eq 0 ]; then | ||
241 | + install_dropbear | ||
242 | + fi | ||
243 | +fi | ||
244 | -- | ||
245 | 2.1.4 | ||
246 | |||
diff --git a/recipes-containers/lxc/files/lxc-busybox-use-lxc.rebootsignal-SIGTERM.patch b/recipes-containers/lxc/files/lxc-busybox-use-lxc.rebootsignal-SIGTERM.patch deleted file mode 100644 index 2f4513ee..00000000 --- a/recipes-containers/lxc/files/lxc-busybox-use-lxc.rebootsignal-SIGTERM.patch +++ /dev/null | |||
@@ -1,31 +0,0 @@ | |||
1 | From 22fb28a946397ec19b247efe170c15b263bf89af Mon Sep 17 00:00:00 2001 | ||
2 | From: Bogdan Purcareata <bogdan.purcareata@freescale.com> | ||
3 | Date: Mon, 16 Feb 2015 09:38:36 +0000 | ||
4 | Subject: [PATCH 12/12] lxc-busybox: use lxc.rebootsignal = SIGTERM | ||
5 | |||
6 | Otherwise lxc-stop -r has no effect on the container. | ||
7 | |||
8 | Upstream-Status: Accepted | ||
9 | [https://github.com/lxc/lxc/commit/22fb28a946397ec19b247efe170c15b263bf89af] | ||
10 | |||
11 | Signed-off-by: Bogdan Purcareata <bogdan.purcareata@freescale.com> | ||
12 | Acked-by: Serge E. Hallyn <serge.hallyn@ubuntu.com> | ||
13 | --- | ||
14 | templates/lxc-busybox.in | 1 + | ||
15 | 1 file changed, 1 insertion(+) | ||
16 | |||
17 | diff --git a/templates/lxc-busybox.in b/templates/lxc-busybox.in | ||
18 | index 72531d6..7e05bd6 100644 | ||
19 | --- a/templates/lxc-busybox.in | ||
20 | +++ b/templates/lxc-busybox.in | ||
21 | @@ -270,6 +270,7 @@ copy_configuration() | ||
22 | grep -q "^lxc.rootfs" $path/config 2>/dev/null || echo "lxc.rootfs = $rootfs" >> $path/config | ||
23 | cat <<EOF >> $path/config | ||
24 | lxc.haltsignal = SIGUSR1 | ||
25 | +lxc.rebootsignal = SIGTERM | ||
26 | lxc.utsname = $name | ||
27 | lxc.tty = 1 | ||
28 | lxc.pts = 1 | ||
29 | -- | ||
30 | 2.1.4 | ||
31 | |||
diff --git a/recipes-containers/lxc/files/lxc-fix-B-S.patch b/recipes-containers/lxc/files/lxc-fix-B-S.patch index 3822655e..a776b4f8 100644 --- a/recipes-containers/lxc/files/lxc-fix-B-S.patch +++ b/recipes-containers/lxc/files/lxc-fix-B-S.patch | |||
@@ -1,16 +1,15 @@ | |||
1 | Index: lxc-1.0.7/config/init/upstart/Makefile.am | 1 | Index: lxc-2.0.0/config/init/upstart/Makefile.am |
2 | =================================================================== | 2 | =================================================================== |
3 | --- lxc-1.0.7.orig/config/init/upstart/Makefile.am | 3 | --- lxc-2.0.0.orig/config/init/upstart/Makefile.am |
4 | +++ lxc-1.0.7/config/init/upstart/Makefile.am | 4 | +++ lxc-2.0.0/config/init/upstart/Makefile.am |
5 | @@ -3,9 +3,9 @@ EXTRA_DIST = lxc.conf lxc-instance.conf | 5 | @@ -3,9 +3,9 @@ |
6 | if INIT_SCRIPT_UPSTART | 6 | if INIT_SCRIPT_UPSTART |
7 | install-upstart: lxc.conf lxc-instance.conf lxc-net.conf | 7 | install-upstart: lxc.conf lxc-instance.conf lxc-net.conf |
8 | $(MKDIR_P) $(DESTDIR)$(sysconfdir)/init/ | 8 | $(MKDIR_P) $(DESTDIR)$(sysconfdir)/init/ |
9 | - $(INSTALL_DATA) lxc.conf $(DESTDIR)$(sysconfdir)/init/ | 9 | - $(INSTALL_DATA) lxc.conf $(DESTDIR)$(sysconfdir)/init/ |
10 | - $(INSTALL_DATA) lxc-instance.conf $(DESTDIR)$(sysconfdir)/init/ | ||
11 | - $(INSTALL_DATA) lxc-net.conf $(DESTDIR)$(sysconfdir)/init/ | ||
12 | + $(INSTALL_DATA) $(srcdir)/lxc.conf $(DESTDIR)$(sysconfdir)/init/ | 10 | + $(INSTALL_DATA) $(srcdir)/lxc.conf $(DESTDIR)$(sysconfdir)/init/ |
13 | + $(INSTALL_DATA) $(srcdir)/lxc-instance.conf $(DESTDIR)$(sysconfdir)/init/ | 11 | $(INSTALL_DATA) $(srcdir)/lxc-instance.conf $(DESTDIR)$(sysconfdir)/init/ |
12 | - $(INSTALL_DATA) lxc-net.conf $(DESTDIR)$(sysconfdir)/init/ | ||
14 | + $(INSTALL_DATA) $(srcdir)/lxc-net.conf $(DESTDIR)$(sysconfdir)/init/ | 13 | + $(INSTALL_DATA) $(srcdir)/lxc-net.conf $(DESTDIR)$(sysconfdir)/init/ |
15 | 14 | ||
16 | uninstall-upstart: | 15 | uninstall-upstart: |
diff --git a/recipes-containers/lxc/files/lxc-let-lxc-start-support-wlan-phys.patch b/recipes-containers/lxc/files/lxc-let-lxc-start-support-wlan-phys.patch deleted file mode 100644 index 9146fd07..00000000 --- a/recipes-containers/lxc/files/lxc-let-lxc-start-support-wlan-phys.patch +++ /dev/null | |||
@@ -1,72 +0,0 @@ | |||
1 | From 4acc7a24e098445de502a6f59a8b3dff2cd8536d Mon Sep 17 00:00:00 2001 | ||
2 | From: fli <fupan.li@windriver.com> | ||
3 | Date: Thu, 21 Apr 2016 19:07:10 -0700 | ||
4 | Subject: [PATCH] lxc: let lxc-start support wlan phys | ||
5 | |||
6 | The commit: e5848d395cb <netdev_move_by_index: support wlan> only | ||
7 | made netdev_move_by_name support wlan, instead of netdev_move_by_index. | ||
8 | |||
9 | Given netdev_move_by_name is a wrapper of netdev_move_by_index, so here | ||
10 | replacing all of the call to lxc_netdev_move_by_index with lxc_netdev_move_by_name | ||
11 | to let lxc-start support wlan phys. | ||
12 | |||
13 | Signed-off-by: fli <fupan.li@windriver.com> | ||
14 | --- | ||
15 | src/lxc/conf.c | 20 ++++++++++++++++---- | ||
16 | 1 file changed, 16 insertions(+), 4 deletions(-) | ||
17 | |||
18 | diff --git a/src/lxc/conf.c b/src/lxc/conf.c | ||
19 | index 034bdff..bcba0f1 100644 | ||
20 | --- a/src/lxc/conf.c | ||
21 | +++ b/src/lxc/conf.c | ||
22 | @@ -2623,6 +2623,7 @@ void restore_phys_nics_to_netns(int netnsfd, struct lxc_conf *conf) | ||
23 | { | ||
24 | int i, ret, oldfd; | ||
25 | char path[MAXPATHLEN]; | ||
26 | + char ifname[IFNAMSIZ]; | ||
27 | |||
28 | if (netnsfd < 0) | ||
29 | return; | ||
30 | @@ -2643,9 +2644,13 @@ void restore_phys_nics_to_netns(int netnsfd, struct lxc_conf *conf) | ||
31 | } | ||
32 | for (i=0; i<conf->num_savednics; i++) { | ||
33 | struct saved_nic *s = &conf->saved_nics[i]; | ||
34 | - if (lxc_netdev_move_by_index(s->ifindex, 1, NULL)) | ||
35 | - WARN("Error moving nic index:%d back to host netns", | ||
36 | - s->ifindex); | ||
37 | + /* retrieve the name of the interface */ | ||
38 | + if (!if_indextoname(s->ifindex, ifname)) { | ||
39 | + WARN("no interface corresponding to index '%d'", s->ifindex); | ||
40 | + continue; | ||
41 | + } | ||
42 | + if (lxc_netdev_move_by_name(ifname, 1, NULL)) | ||
43 | + WARN("Error moving nic name:%s back to host netns", ifname); | ||
44 | } | ||
45 | if (setns(oldfd, 0) != 0) | ||
46 | SYSERROR("Failed to re-enter monitor's netns"); | ||
47 | @@ -3208,6 +3213,7 @@ int lxc_assign_network(struct lxc_list *network, pid_t pid) | ||
48 | { | ||
49 | struct lxc_list *iterator; | ||
50 | struct lxc_netdev *netdev; | ||
51 | + char ifname[IFNAMSIZ]; | ||
52 | int am_root = (getuid() == 0); | ||
53 | int err; | ||
54 | |||
55 | @@ -3228,7 +3234,13 @@ int lxc_assign_network(struct lxc_list *network, pid_t pid) | ||
56 | if (!netdev->ifindex) | ||
57 | continue; | ||
58 | |||
59 | - err = lxc_netdev_move_by_index(netdev->ifindex, pid, NULL); | ||
60 | + /* retrieve the name of the interface */ | ||
61 | + if (!if_indextoname(netdev->ifindex, ifname)) { | ||
62 | + ERROR("no interface corresponding to index '%d'", netdev->ifindex); | ||
63 | + return -1; | ||
64 | + } | ||
65 | + | ||
66 | + err = lxc_netdev_move_by_name(ifname, pid, NULL); | ||
67 | if (err) { | ||
68 | ERROR("failed to move '%s' to the container : %s", | ||
69 | netdev->link, strerror(-err)); | ||
70 | -- | ||
71 | 2.7.4 | ||
72 | |||
diff --git a/recipes-containers/lxc/files/lxc_setup_fs-Create-dev-shm-folder-if-it-doesn-t-exi.patch b/recipes-containers/lxc/files/lxc_setup_fs-Create-dev-shm-folder-if-it-doesn-t-exi.patch deleted file mode 100644 index 751a7ac6..00000000 --- a/recipes-containers/lxc/files/lxc_setup_fs-Create-dev-shm-folder-if-it-doesn-t-exi.patch +++ /dev/null | |||
@@ -1,39 +0,0 @@ | |||
1 | From 81e3c9cf8b2f230d761738da28e9dc69fb90ec46 Mon Sep 17 00:00:00 2001 | ||
2 | From: Bogdan Purcareata <bogdan.purcareata@nxp.com> | ||
3 | Date: Fri, 8 Jan 2016 15:38:44 +0000 | ||
4 | Subject: [PATCH] lxc_setup_fs: Create /dev/shm folder if it doesn't exist | ||
5 | |||
6 | When running application containers with lxc-execute, /dev is | ||
7 | populated only with device entries. Since /dev is a tmpfs mount in | ||
8 | the container environment, the /dev/shm folder not being present is not | ||
9 | a sufficient reason for the /dev/shm mount to fail. | ||
10 | |||
11 | Create the /dev/shm directory if not present. | ||
12 | |||
13 | Upstream-status: Accepted | ||
14 | [https://github.com/lxc/lxc/commit/81e3c9cf8b2f230d761738da28e9dc69fb90ec46] | ||
15 | |||
16 | Signed-off-by: Bogdan Purcareata <bogdan.purcareata@nxp.com> | ||
17 | Acked-by: Serge E. Hallyn <serge.hallyn@ubuntu.com> | ||
18 | --- | ||
19 | src/lxc/initutils.c | 4 ++++ | ||
20 | 1 file changed, 4 insertions(+) | ||
21 | |||
22 | diff --git a/src/lxc/initutils.c b/src/lxc/initutils.c | ||
23 | index 45df60f..8d9016c 100644 | ||
24 | --- a/src/lxc/initutils.c | ||
25 | +++ b/src/lxc/initutils.c | ||
26 | @@ -47,6 +47,10 @@ extern void lxc_setup_fs(void) | ||
27 | if (mount_fs("proc", "/proc", "proc")) | ||
28 | INFO("failed to remount proc"); | ||
29 | |||
30 | + /* if /dev has been populated by us, /dev/shm does not exist */ | ||
31 | + if (access("/dev/shm", F_OK) && mkdir("/dev/shm", 0777)) | ||
32 | + INFO("failed to create /dev/shm"); | ||
33 | + | ||
34 | /* if we can't mount /dev/shm, continue anyway */ | ||
35 | if (mount_fs("shmfs", "/dev/shm", "tmpfs")) | ||
36 | INFO("failed to mount /dev/shm"); | ||
37 | -- | ||
38 | 1.9.1 | ||
39 | |||
diff --git a/recipes-containers/lxc/files/make-some-OpenSSH-tools-optional.patch b/recipes-containers/lxc/files/make-some-OpenSSH-tools-optional.patch deleted file mode 100644 index 2d287885..00000000 --- a/recipes-containers/lxc/files/make-some-OpenSSH-tools-optional.patch +++ /dev/null | |||
@@ -1,49 +0,0 @@ | |||
1 | From 34be0d3cd8c4eaca9929470bc8bce5e74975bccf Mon Sep 17 00:00:00 2001 | ||
2 | From: Bogdan Purcareata <bogdan.purcareata@freescale.com> | ||
3 | Date: Thu, 23 Apr 2015 08:33:00 +0000 | ||
4 | Subject: [PATCH] lxc-busybox: make some OpenSSH tools optional | ||
5 | |||
6 | Currently, when installing OpenSSH in a Busybox container, the template searches | ||
7 | for all the OpenSSH client binaries available in the Debian distro package. The | ||
8 | included tools might differ from distro to distro, so make part of the tools | ||
9 | optional. The mandatory tools, without which installing OpenSSH fails, are | ||
10 | "sshd" for the server and "ssh" and "scp" for the client. | ||
11 | |||
12 | Upstream-Status: Submitted | ||
13 | [https://lists.linuxcontainers.org/pipermail/lxc-devel/2015-April/011696.html] | ||
14 | |||
15 | Signed-off-by: Bogdan Purcareata <bogdan.purcareata@freescale.com> | ||
16 | --- | ||
17 | templates/lxc-busybox.in | 9 +++++++++ | ||
18 | 1 file changed, 9 insertions(+) | ||
19 | |||
20 | diff --git a/templates/lxc-busybox.in b/templates/lxc-busybox.in | ||
21 | index 95961a3..17a3006 100644 | ||
22 | --- a/templates/lxc-busybox.in | ||
23 | +++ b/templates/lxc-busybox.in | ||
24 | @@ -197,6 +197,8 @@ install_openssh() | ||
25 | client_utils="\ | ||
26 | ssh \ | ||
27 | scp \ | ||
28 | + " | ||
29 | + client_optional_utils="\ | ||
30 | sftp \ | ||
31 | ssh-add \ | ||
32 | ssh-agent \ | ||
33 | @@ -230,6 +232,13 @@ $rootfs/var/run/sshd \ | ||
34 | fi | ||
35 | done | ||
36 | |||
37 | + for bin in $client_optional_utils; do | ||
38 | + tool_path=`which $bin` | ||
39 | + if [ $? -eq 0 ]; then | ||
40 | + cp $tool_path $rootfs/$tool_path | ||
41 | + fi | ||
42 | + done | ||
43 | + | ||
44 | # add user and group | ||
45 | cat <<EOF >> $rootfs/etc/passwd | ||
46 | sshd:x:74:74:Privilege-separated SSH:/var/empty/sshd:/sbin/nologin | ||
47 | -- | ||
48 | 2.1.4 | ||
49 | |||
diff --git a/recipes-containers/lxc/files/mount_proc_if_needed-only-safe-mount-when-rootfs-is-.patch b/recipes-containers/lxc/files/mount_proc_if_needed-only-safe-mount-when-rootfs-is-.patch deleted file mode 100644 index c3afd858..00000000 --- a/recipes-containers/lxc/files/mount_proc_if_needed-only-safe-mount-when-rootfs-is-.patch +++ /dev/null | |||
@@ -1,69 +0,0 @@ | |||
1 | From f267d6668e3a95cb2247accb169cf1bc7f8ffcab Mon Sep 17 00:00:00 2001 | ||
2 | From: Bogdan Purcareata <bogdan.purcareata@nxp.com> | ||
3 | Date: Wed, 20 Jan 2016 10:53:57 +0000 | ||
4 | Subject: [PATCH] mount_proc_if_needed: only safe mount when rootfs is defined | ||
5 | |||
6 | The safe_mount function was introduced in order to address CVE-2015-1335, | ||
7 | one of the vulnerabilities being a mount with a symlink for the | ||
8 | destination path. In scenarios such as lxc-execute with no rootfs, the | ||
9 | destination path is the host /proc, which is previously mounted by the | ||
10 | host, and is unmounted and mounted again in a new set of namespaces, | ||
11 | therefore eliminating the need to check for it being a symlink. | ||
12 | |||
13 | Mount the rootfs normally if the rootfs is NULL, keep the safe mount | ||
14 | only for scenarios where a different rootfs is defined. | ||
15 | |||
16 | Upstream-status: Accepted | ||
17 | [https://github.com/lxc/lxc/commit/f267d6668e3a95cb2247accb169cf1bc7f8ffcab] | ||
18 | |||
19 | Signed-off-by: Bogdan Purcareata <bogdan.purcareata@nxp.com> | ||
20 | Acked-by: Serge E. Hallyn <serge.hallyn@ubuntu.com> | ||
21 | --- | ||
22 | src/lxc/conf.c | 1 + | ||
23 | src/lxc/utils.c | 10 +++++++++- | ||
24 | 2 files changed, 10 insertions(+), 1 deletion(-) | ||
25 | |||
26 | diff --git a/src/lxc/conf.c b/src/lxc/conf.c | ||
27 | index 632dde3..1e30c0c 100644 | ||
28 | --- a/src/lxc/conf.c | ||
29 | +++ b/src/lxc/conf.c | ||
30 | @@ -3509,6 +3509,7 @@ int ttys_shift_ids(struct lxc_conf *c) | ||
31 | return 0; | ||
32 | } | ||
33 | |||
34 | +/* NOTE: not to be called from inside the container namespace! */ | ||
35 | int tmp_proc_mount(struct lxc_conf *lxc_conf) | ||
36 | { | ||
37 | int mounted; | ||
38 | diff --git a/src/lxc/utils.c b/src/lxc/utils.c | ||
39 | index 4e96a50..0bc7a20 100644 | ||
40 | --- a/src/lxc/utils.c | ||
41 | +++ b/src/lxc/utils.c | ||
42 | @@ -1704,6 +1704,8 @@ int safe_mount(const char *src, const char *dest, const char *fstype, | ||
43 | * | ||
44 | * Returns < 0 on failure, 0 if the correct proc was already mounted | ||
45 | * and 1 if a new proc was mounted. | ||
46 | + * | ||
47 | + * NOTE: not to be called from inside the container namespace! | ||
48 | */ | ||
49 | int mount_proc_if_needed(const char *rootfs) | ||
50 | { | ||
51 | @@ -1737,8 +1739,14 @@ int mount_proc_if_needed(const char *rootfs) | ||
52 | return 0; | ||
53 | |||
54 | domount: | ||
55 | - if (safe_mount("proc", path, "proc", 0, NULL, rootfs) < 0) | ||
56 | + if (!strcmp(rootfs,"")) /* rootfs is NULL */ | ||
57 | + ret = mount("proc", path, "proc", 0, NULL); | ||
58 | + else | ||
59 | + ret = safe_mount("proc", path, "proc", 0, NULL, rootfs); | ||
60 | + | ||
61 | + if (ret < 0) | ||
62 | return -1; | ||
63 | + | ||
64 | INFO("Mounted /proc in container for security transition"); | ||
65 | return 1; | ||
66 | } | ||
67 | -- | ||
68 | 1.9.1 | ||
69 | |||
diff --git a/recipes-containers/lxc/files/open_without_symlink-Account-when-prefix-is-empty-st.patch b/recipes-containers/lxc/files/open_without_symlink-Account-when-prefix-is-empty-st.patch deleted file mode 100644 index 28f9889b..00000000 --- a/recipes-containers/lxc/files/open_without_symlink-Account-when-prefix-is-empty-st.patch +++ /dev/null | |||
@@ -1,37 +0,0 @@ | |||
1 | From 01074e5b34719537cef474c6b81d4f55e6427639 Mon Sep 17 00:00:00 2001 | ||
2 | From: Bogdan Purcareata <bogdan.purcareata@nxp.com> | ||
3 | Date: Fri, 8 Jan 2016 15:38:35 +0000 | ||
4 | Subject: [PATCH] open_without_symlink: Account when prefix is empty string | ||
5 | |||
6 | In the current implementation, the open_without_symlink function | ||
7 | will default to opening the root mount only if the passed rootfs | ||
8 | prefix is null. It doesn't account for the case where this prefix | ||
9 | is passed as an empty string. | ||
10 | |||
11 | Properly handle this second case as well. | ||
12 | |||
13 | Upstream-Status: Accepted | ||
14 | [https://github.com/lxc/lxc/commit/01074e5b34719537cef474c6b81d4f55e6427639] | ||
15 | |||
16 | Signed-off-by: Bogdan Purcareata <bogdan.purcareata@nxp.com> | ||
17 | Acked-by: Serge E. Hallyn <serge.hallyn@ubuntu.com> | ||
18 | --- | ||
19 | src/lxc/utils.c | 2 +- | ||
20 | 1 file changed, 1 insertion(+), 1 deletion(-) | ||
21 | |||
22 | diff --git a/src/lxc/utils.c b/src/lxc/utils.c | ||
23 | index ed8c4c4..4e96a50 100644 | ||
24 | --- a/src/lxc/utils.c | ||
25 | +++ b/src/lxc/utils.c | ||
26 | @@ -1575,7 +1575,7 @@ static int open_without_symlink(const char *target, const char *prefix_skip) | ||
27 | fulllen = strlen(target); | ||
28 | |||
29 | /* make sure prefix-skip makes sense */ | ||
30 | - if (prefix_skip) { | ||
31 | + if (prefix_skip && strlen(prefix_skip) > 0) { | ||
32 | curlen = strlen(prefix_skip); | ||
33 | if (!is_subdir(target, prefix_skip, curlen)) { | ||
34 | ERROR("WHOA there - target '%s' didn't start with prefix '%s'", | ||
35 | -- | ||
36 | 1.9.1 | ||
37 | |||
diff --git a/recipes-containers/lxc/files/open_without_symlink-Don-t-SYSERROR-on-something-els.patch b/recipes-containers/lxc/files/open_without_symlink-Don-t-SYSERROR-on-something-els.patch deleted file mode 100644 index 098ead7e..00000000 --- a/recipes-containers/lxc/files/open_without_symlink-Don-t-SYSERROR-on-something-els.patch +++ /dev/null | |||
@@ -1,49 +0,0 @@ | |||
1 | From 88e078ba865b675f9a0dc61caa0732d7052593f8 Mon Sep 17 00:00:00 2001 | ||
2 | From: Christian Brauner <christian.brauner@mailbox.org> | ||
3 | Date: Wed, 23 Mar 2016 16:37:09 +0100 | ||
4 | Subject: [PATCH] open_without_symlink: Don't SYSERROR on something else than | ||
5 | ELOOP | ||
6 | |||
7 | The open_without_symlink routine has been specifically created to prevent | ||
8 | mounts with synlinks as source or destination. Keep SYSERROR'ing in that | ||
9 | particular scenario, but leave error handling to calling functions for the | ||
10 | other ones - e.g. optional bind mount when the source dir doesn't exist | ||
11 | throws a nasty error. | ||
12 | |||
13 | Upstream-status: Accepted | ||
14 | [https://github.com/lxc/lxc/commit/88e078ba865b675f9a0dc61caa0732d7052593f8] | ||
15 | |||
16 | Signed-off-by: Bogdan Purcareata <bogdan.purcareata@nxp.com> | ||
17 | --- | ||
18 | src/lxc/utils.c | 7 ++++--- | ||
19 | 1 file changed, 4 insertions(+), 3 deletions(-) | ||
20 | |||
21 | diff --git a/src/lxc/utils.c b/src/lxc/utils.c | ||
22 | index 6bee698..8e7ebbc 100644 | ||
23 | --- a/src/lxc/utils.c | ||
24 | +++ b/src/lxc/utils.c | ||
25 | @@ -1621,8 +1621,6 @@ static int open_without_symlink(const char *target, const char *prefix_skip) | ||
26 | errno = saved_errno; | ||
27 | if (errno == ELOOP) | ||
28 | SYSERROR("%s in %s was a symbolic link!", nextpath, target); | ||
29 | - else | ||
30 | - SYSERROR("Error examining %s in %s", nextpath, target); | ||
31 | goto out; | ||
32 | } | ||
33 | } | ||
34 | @@ -1667,8 +1665,11 @@ int safe_mount(const char *src, const char *dest, const char *fstype, | ||
35 | |||
36 | destfd = open_without_symlink(dest, rootfs); | ||
37 | if (destfd < 0) { | ||
38 | - if (srcfd != -1) | ||
39 | + if (srcfd != -1) { | ||
40 | + saved_errno = errno; | ||
41 | close(srcfd); | ||
42 | + errno = saved_errno; | ||
43 | + } | ||
44 | return destfd; | ||
45 | } | ||
46 | |||
47 | -- | ||
48 | 1.9.1 | ||
49 | |||
diff --git a/recipes-containers/lxc/lxc_1.1.5.bb b/recipes-containers/lxc/lxc_2.0.0.bb index 1864ef83..34aab38a 100644 --- a/recipes-containers/lxc/lxc_1.1.5.bb +++ b/recipes-containers/lxc/lxc_2.0.0.bb | |||
@@ -26,25 +26,13 @@ SRC_URI = "http://linuxcontainers.org/downloads/${BPN}-${PV}.tar.gz \ | |||
26 | file://runtest.patch \ | 26 | file://runtest.patch \ |
27 | file://run-ptest \ | 27 | file://run-ptest \ |
28 | file://automake-ensure-VPATH-builds-correctly.patch \ | 28 | file://automake-ensure-VPATH-builds-correctly.patch \ |
29 | file://add-lxc.rebootsignal.patch \ | ||
30 | file://document-lxc.rebootsignal.patch \ | ||
31 | file://lxc-busybox-use-lxc.rebootsignal-SIGTERM.patch \ | ||
32 | file://lxc-fix-B-S.patch \ | 29 | file://lxc-fix-B-S.patch \ |
33 | file://lxc-busybox-add-OpenSSH-support.patch \ | ||
34 | file://make-some-OpenSSH-tools-optional.patch \ | ||
35 | file://lxc-doc-upgrade-to-use-docbook-3.1-DTD.patch \ | 30 | file://lxc-doc-upgrade-to-use-docbook-3.1-DTD.patch \ |
36 | file://logs-optionally-use-base-filenames-to-report-src-fil.patch \ | 31 | file://logs-optionally-use-base-filenames-to-report-src-fil.patch \ |
37 | file://open_without_symlink-Account-when-prefix-is-empty-st.patch \ | ||
38 | file://lxc_setup_fs-Create-dev-shm-folder-if-it-doesn-t-exi.patch \ | ||
39 | file://mount_proc_if_needed-only-safe-mount-when-rootfs-is-.patch \ | ||
40 | file://open_without_symlink-Don-t-SYSERROR-on-something-els.patch \ | ||
41 | file://lxc-busybox-Touch-etc-fstab-in-the-container-rootfs.patch \ | ||
42 | file://lxc-busybox-Remove-warning-for-dynamically-linked-Bu.patch \ | ||
43 | file://lxc-let-lxc-start-support-wlan-phys.patch \ | ||
44 | " | 32 | " |
45 | 33 | ||
46 | SRC_URI[md5sum] = "dd9684dde0a58ed13f4f49c855b79a1a" | 34 | SRC_URI[md5sum] = "04a7245a614cd3296b0ae9ceeeb83fbb" |
47 | SRC_URI[sha256sum] = "9588ad1b04e114ee7370f690c65131e28098b28d2521d97c73557d11897ed0be" | 35 | SRC_URI[sha256sum] = "5b737e114d8ef1feb193fba936d77a5697a7c8a10199a068cdd90d1bd27c10e4" |
48 | 36 | ||
49 | S = "${WORKDIR}/${BPN}-${PV}" | 37 | S = "${WORKDIR}/${BPN}-${PV}" |
50 | 38 | ||