Antonio Terceiro | 24 Nov 02:51 2014
Picon

[PATCH v2] lxc-debian: support systemd as PID 1

Containers with systemd need a somewhat special setup, which I borrowed
and adapted from lxc-fedora. These changes are required so that Debian 8
(jessie) containers work properly, and are a no-op for previous Debian
versions.

Signed-off-by: Antonio Terceiro <terceiro <at> debian.org>
Acked-by: Serge E. Hallyn <serge.hallyn <at> ubuntu.com>
---
 templates/lxc-debian.in | 34 ++++++++++++++++++++++++++++++++++
 1 file changed, 34 insertions(+)

diff --git a/templates/lxc-debian.in b/templates/lxc-debian.in
index 5ffbe21..7e2f8f5 100644
--- a/templates/lxc-debian.in
+++ b/templates/lxc-debian.in
 <at>  <at>  -183,6 +183,38  <at>  <at>  install_packages()
     fi
 }

+configure_debian_systemd()
+{
+    path=$1
+    rootfs=$2
+    init="$(chroot ${rootfs} dpkg-query --search /sbin/init | cut -d : -f 1)"
+    if [ "$init" != "systemd-sysv" ]; then
+       # systemd is not PID 1
+       return
+    fi
+
+    echo 'lxc.autodev = 1' >> "$path/config"
(Continue reading)

beproject criu | 21 Nov 22:31 2014
Picon

cannot start lxc container

Before updating to 1.0.0 my lxc container was working file but now

I am not able to start the lxc container, i am getting error:

/sdcard # lxc-start -n L -f lxc.conf -- /init
lxc-start: invalid sequence number 1. expected 4
lxc-start: failed to spawn 'L'
lxc-start: Device or resource busy - cgroup_rmdir: failed to delete /sys/fs/cgroup/lxc/L
lxc-start: The container failed to start.
lxc-start: Additional information can be obtained by setting the --logfile and --logpriority options.
/sdcard #

Please help,

Thanks.
_______________________________________________
lxc-devel mailing list
lxc-devel <at> lists.linuxcontainers.org
http://lists.linuxcontainers.org/listinfo/lxc-devel
beproject criu | 21 Nov 19:28 2014
Picon

SIMPLE C PROGRAM IN LXC CONTAINER

How do i create a container running only a simple c program,say the container has only a c program running in it,where the c program has an infinite loop in it.
Please help,

Thanks.
_______________________________________________
lxc-devel mailing list
lxc-devel <at> lists.linuxcontainers.org
http://lists.linuxcontainers.org/listinfo/lxc-devel
GitHub | 21 Nov 00:37 2014

[lxc/lxc] a1c9a9: lxc/utils: bugfix freed pointer return value

  Branch: refs/heads/master
  Home:   https://github.com/lxc/lxc
  Commit: a1c9a9c97840b1b6b4e7a1ea9cf75aeb2f815659
      https://github.com/lxc/lxc/commit/a1c9a9c97840b1b6b4e7a1ea9cf75aeb2f815659
  Author: Silvio Fricke <silvio.fricke@...>
  Date:   2014-11-19 (Wed, 19 Nov 2014)

  Changed paths:
    M src/lxc/utils.c

  Log Message:
  -----------
  lxc/utils: bugfix freed pointer return value

We allocate a pointer and save this address in a static variable. After
this we freed this pointer and return.

Here a cuttout of a valgrind report:

	[...]
	==11568== Invalid read of size 1
	==11568==    at 0x4C2D524: strlen (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
	==11568==    by 0x5961C9B: puts (in /usr/lib/libc-2.20.so)
	==11568==    by 0x400890: main (lxc_config.c:73)
	==11568==  Address 0x6933e21 is 1 bytes inside a block of size 32 free'd
	==11568==    at 0x4C2B200: free (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
	==11568==    by 0x4E654F2: lxc_global_config_value (utils.c:415)
	==11568==    by 0x4E92177: lxc_get_global_config_item (lxccontainer.c:2287)
	==11568==    by 0x400883: main (lxc_config.c:71)
	[...]

Signed-off-by: Silvio Fricke <silvio.fricke@...>

  Commit: 80cf8077b3f5a019a8e4dcc481076d5b2a6b9edb
      https://github.com/lxc/lxc/commit/80cf8077b3f5a019a8e4dcc481076d5b2a6b9edb
  Author: hallyn <serge@...>
  Date:   2014-11-20 (Thu, 20 Nov 2014)

  Changed paths:
    M src/lxc/utils.c

  Log Message:
  -----------
  Merge pull request #358 from silvio/sfr/bugfix-freed-return-value

lxc/utils: bugfix freed pointer return value

Compare: https://github.com/lxc/lxc/compare/40580b462409...80cf8077b3f5
_______________________________________________
lxc-devel mailing list
lxc-devel <at> lists.linuxcontainers.org
http://lists.linuxcontainers.org/listinfo/lxc-devel
Nishant Agrawal | 20 Nov 05:19 2014
Picon

Fork-bomb test

Hi Folks,

I am trying to run fork bomb test inside a container to measure the 
extent of isolation containers provide. I am observing that even after 
putting all the available limits my host system becomes unresponsive 
after some time. Can someone throw light what should be the issue? 
Doesn't LXC handles situations like forkbomb?

I am running linux kernel 3.13.0.36generic.
I am setting below limits on the program,

  memory.limit_in_bytes 2G
  memory.soft_limit_in_bytes 1G
  memory.memsw.limit_in_bytes 3G
  memory.kmem.limit_in_bytes - 1G

Any help is appreciated.

Regards,
Nishant
_______________________________________________
lxc-devel mailing list
lxc-devel <at> lists.linuxcontainers.org
http://lists.linuxcontainers.org/listinfo/lxc-devel
Antonio Terceiro | 19 Nov 13:51 2014
Picon

[PATCH] lxc-debian: support systemd as PID 1

Containers with systemd need a somewhat special setup, which I borrowed
and adaptec from lxc-fedora. These changes are required so that Debian 8
(jessie) containers work properly, and are a no-op for previous Debian
versions.

Signed-off-by: Antonio Terceiro <terceiro <at> debian.org>
---
 templates/lxc-debian.in | 30 ++++++++++++++++++++++++++++++
 1 file changed, 30 insertions(+)

diff --git a/templates/lxc-debian.in b/templates/lxc-debian.in
index 5ffbe21..6864a98 100644
--- a/templates/lxc-debian.in
+++ b/templates/lxc-debian.in
 <at>  <at>  -183,6 +183,34  <at>  <at>  install_packages()
     fi
 }

+configure_debian_systemd()
+{
+    rootfs=$1
+    init="$(chroot ${rootfs} dpkg-query --search /sbin/init | cut -d : -f 1)"
+    if [ "$init" != "systemd-sysv" ]; then
+       # systemd is not PID 1
+       return
+    fi
+
+    # This function has been copied and adapted from lxc-fedora
+    rm -f ${rootfs}/etc/systemd/system/default.target
+    touch ${rootfs}/etc/fstab
+    chroot ${rootfs} ln -s /dev/null /etc/systemd/system/udev.service
+    chroot ${rootfs} ln -s /lib/systemd/system/multi-user.target /etc/systemd/system/default.target
+    # Make systemd honor SIGPWR
+    chroot ${rootfs} ln -s /lib/systemd/system/halt.target /etc/systemd/system/sigpwr.target
+    sed -e 's/^ConditionPathExists=/# ConditionPathExists=/' \
+        -e 's/After=dev-%i.device/After=/' \
+        < ${rootfs}/lib/systemd/system/getty\ <at> .service \
+        > ${rootfs}/etc/systemd/system/getty\ <at> .service
+    # Setup getty service on the 4 ttys we are going to allow in the
+    # default config.  Number should match lxc.tty
+    ( cd ${rootfs}/etc/systemd/system/getty.target.wants
+        for i in 1 2 3 4 ; do ln -sf ../getty\ <at> .service getty <at> tty${i}.service; done )
+
+    return 0
+}
+
 cleanup()
 {
     rm -rf $cache/partial-$release-$arch
 <at>  <at>  -522,6 +550,8  <at>  <at>  if [ $? -ne 0 ]; then
     exit 1
 fi

+configure_debian_systemd $rootfs
+
 copy_configuration $path $rootfs $name $arch
 if [ $? -ne 0 ]; then
     echo "failed write configuration file"
--

-- 
2.1.3

_______________________________________________
lxc-devel mailing list
lxc-devel <at> lists.linuxcontainers.org
http://lists.linuxcontainers.org/listinfo/lxc-devel
TAMUKI Shoichi | 19 Nov 09:23 2014
Picon

[PATCH v2] lxc-plamo: mount tmpfs on /dev/shm

Do mkdir $rootfs/dev/shm and then mount tmpfs on /dev/shm.

Signed-off-by: TAMUKI Shoichi <tamuki <at> linet.gr.jp>
---
 config/templates/plamo.common.conf.in | 1 +
 templates/lxc-plamo.in                | 1 +
 2 files changed, 2 insertions(+)

diff --git a/config/templates/plamo.common.conf.in b/config/templates/plamo.common.conf.in
index 483a556..22d9207 100644
--- a/config/templates/plamo.common.conf.in
+++ b/config/templates/plamo.common.conf.in
 <at>  <at>  -3,6 +3,7  <at>  <at>  lxc.include =  <at> LXCTEMPLATECONFIG <at> /common.conf

 # Default mount
 lxc.mount.auto = proc sys cgroup
+lxc.mount.entry = none dev/shm tmpfs nosuid,nodev,noexec,mode=1777 0 0

 # Doesn't support consoles in /dev/lxc/
 lxc.devttydir =
diff --git a/templates/lxc-plamo.in b/templates/lxc-plamo.in
index ce98c1a..5061056 100644
--- a/templates/lxc-plamo.in
+++ b/templates/lxc-plamo.in
 <at>  <at>  -153,6 +153,7  <at>  <at>  configure_plamo() {
   chmod    666 $rootfs/dev/random
   mknod -m 666 $rootfs/dev/urandom c 1 9
   mkdir -m 755 $rootfs/dev/pts
+  mkdir -m 755 $rootfs/dev/shm
   chmod    666 $rootfs/dev/tty
   chmod    600 $rootfs/dev/console
   mknod -m 666 $rootfs/dev/tty0 c 4 0
--

-- 
1.9.0
_______________________________________________
lxc-devel mailing list
lxc-devel <at> lists.linuxcontainers.org
http://lists.linuxcontainers.org/listinfo/lxc-devel
Abin Shahab | 12 Nov 01:06 2014

[PATCH] Remounts bind mounts if read-only flag is provided

Bind mounts do not honor filesystem mount options. This change will remount filesystems that are bind
mounted if there are changes to filesystem mount options, specifically if the mount is readonly.

Signed-off-by: Abin Shahab <ashahab <at> altiscale.com>
---
 src/lxc/conf.c | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/src/lxc/conf.c b/src/lxc/conf.c
index 5938c3e..a3779de 100644
--- a/src/lxc/conf.c
+++ b/src/lxc/conf.c
 <at>  <at>  -1921,10 +1921,12  <at>  <at>  static int mount_entry(const char *fsname, const char *target,
 	if ((mountflags & MS_REMOUNT) || (mountflags & MS_BIND)) {
 		DEBUG("remounting %s on %s to respect bind or remount options",
 		      fsname ? fsname : "(none)", target ? target : "(none)");
-
+		unsigned long rqd_flags = 0;
+		if (mountflags & MS_RDONLY)
+			rqd_flags |= MS_RDONLY;
 #ifdef HAVE_STATVFS
 		if (statvfs(fsname, &sb) == 0) {
-			unsigned long required_flags = 0;
+			unsigned long required_flags = rqd_flags;
 			if (sb.f_flag & MS_NOSUID)
 				required_flags |= MS_NOSUID;
 			if (sb.f_flag & MS_NODEV)
 <at>  <at>  -1940,7 +1942,7  <at>  <at>  static int mount_entry(const char *fsname, const char *target,
 			 * mountflags, then skip the remount
 			 */
 			if (!(mountflags & MS_REMOUNT)) {
-				if (!(required_flags & ~mountflags)) {
+				if (!(required_flags & ~mountflags) && rqd_flags == 0) {
 					DEBUG("mountflags already was %lu, skipping remount",
 						mountflags);
 					goto skipremount;
--

-- 
2.1.0

_______________________________________________
lxc-devel mailing list
lxc-devel <at> lists.linuxcontainers.org
http://lists.linuxcontainers.org/listinfo/lxc-devel
Bhushan Jain | 18 Nov 18:10 2014

Question on hardware-guaranteed security in the new LXD hypervisor for containers

Hi,
I am a PhD candidate at Stony Brook University working in the area of system security.
I had a few questions about the hardware-guaranteed security announced at http://www.ubuntu.com/cloud/tools/lxd

1. Which guarantees are we actually talking about here?
2. Does anyone have an idea about what is planned and what is the status of this support?
3. Does the linux kernel have to be changed to support this hardware?
4. How soon can we expect to be able to use in practice these hardware guarantees?
5. How is this new hardware different from say VT-x or SGX developed by Intel?

The current design documents in the lxd github repository don't seem to discuss this design space.

Thanks,
Bhushan
_______________________________________________
lxc-devel mailing list
lxc-devel <at> lists.linuxcontainers.org
http://lists.linuxcontainers.org/listinfo/lxc-devel
GitHub | 18 Nov 16:07 2014

[lxc/lxc] 370ec2: lxc/utils: improve choose_init code readability

  Branch: refs/heads/master
  Home:   https://github.com/lxc/lxc
  Commit: 370ec268c2bcc9613037dcc0cf89be44fac5a8c2
      https://github.com/lxc/lxc/commit/370ec268c2bcc9613037dcc0cf89be44fac5a8c2
  Author: Silvio Fricke <silvio.fricke@...>
  Date:   2014-11-12 (Wed, 12 Nov 2014)

  Changed paths:
    M src/lxc/utils.c

  Log Message:
  -----------
  lxc/utils: improve choose_init code readability

Signed-off-by: Silvio Fricke <silvio.fricke@...>

  Commit: 40580b462409d37bf73e2fdda9b7843e807e545e
      https://github.com/lxc/lxc/commit/40580b462409d37bf73e2fdda9b7843e807e545e
  Author: hallyn <serge@...>
  Date:   2014-11-18 (Tue, 18 Nov 2014)

  Changed paths:
    M src/lxc/utils.c

  Log Message:
  -----------
  Merge pull request #356 from silvio/sfr/utils-choose-init

lxc/utils: improve choose_init code readability

Compare: https://github.com/lxc/lxc/compare/845cbe1e788d...40580b462409
_______________________________________________
lxc-devel mailing list
lxc-devel <at> lists.linuxcontainers.org
http://lists.linuxcontainers.org/listinfo/lxc-devel
TAMUKI Shoichi | 18 Nov 09:38 2014
Picon

[PATCH] lxc-plamo: mount tmpfs on /dev/shm

Do mkdir $rootfs/dev/shm and then mount tmpfs on /dev/shm.

Signed-off-by: TAMUKI Shoichi <tamuki <at> linet.gr.jp>
---
 config/templates/plamo.common.conf.in | 1 +
 templates/lxc-plamo.in                | 1 +
 2 files changed, 2 insertions(+)

diff --git a/config/templates/plamo.common.conf.in b/config/templates/plamo.common.conf.in
index 483a556..e056809 100644
--- a/config/templates/plamo.common.conf.in
+++ b/config/templates/plamo.common.conf.in
 <at>  <at>  -3,6 +3,7  <at>  <at>  lxc.include =  <at> LXCTEMPLATECONFIG <at> /common.conf

 # Default mount
 lxc.mount.auto = proc sys cgroup
+lxc.mount.entry = none dev/shm tmpfs nosuid,nodev,mode=1777 0 0

 # Doesn't support consoles in /dev/lxc/
 lxc.devttydir =
diff --git a/templates/lxc-plamo.in b/templates/lxc-plamo.in
index ce98c1a..5061056 100644
--- a/templates/lxc-plamo.in
+++ b/templates/lxc-plamo.in
 <at>  <at>  -153,6 +153,7  <at>  <at>  configure_plamo() {
   chmod    666 $rootfs/dev/random
   mknod -m 666 $rootfs/dev/urandom c 1 9
   mkdir -m 755 $rootfs/dev/pts
+  mkdir -m 755 $rootfs/dev/shm
   chmod    666 $rootfs/dev/tty
   chmod    600 $rootfs/dev/console
   mknod -m 666 $rootfs/dev/tty0 c 4 0
--

-- 
1.9.0
_______________________________________________
lxc-devel mailing list
lxc-devel <at> lists.linuxcontainers.org
http://lists.linuxcontainers.org/listinfo/lxc-devel

Gmane