gentoo-mirror/gentoo
1
0
Fork 0
mirror of https://github.com/gentoo-mirror/gentoo.git synced 2026-09-23 16:49:10 -07:00
Code Issues Projects Releases Wiki Activity

app-emulation/lxc: remove unused patch files

Browse Source 
Signed-off-by: Joonas Niilola <juippis@gentoo.org>
This commit is contained in:
Joonas Niilola
2020-05-29 16:13:12 +03:00
parent 20b9c7959c
commit e6fffc5b9d
4 changed files with 0 additions and 335 deletions
Download Patch File Download Diff File Expand all files Collapse all files

27
app-emulation/lxc/files/lxc-2.0.6-bash-completion.patch
View File

@@ -1,27 +0,0 @@
diff --git a/config/bash/lxc.in b/config/bash/lxc.in
index 7dcf302..5927fe2 100644
--- a/config/bash/lxc.in
+++ b/config/bash/lxc.in
@@ -1,4 +1,3 @@
-_have lxc-start && {
_lxc_names() {
COMPREPLY=( $( compgen -W "$( lxc-ls )" "$cur" ) )
}
@@ -100,4 +99,3 @@ _have lxc-start && {
complete -o default -F _lxc_generic_o lxc-copy
complete -o default -F _lxc_generic_o lxc-start-ephemeral
-}
diff --git a/configure.ac b/configure.ac
index 4640c0d..14ccdd3 100644
--- a/configure.ac
+++ b/configure.ac
@@ -478,7 +478,7 @@ AM_CONDITIONAL([ENABLE_BASH], [test "x$enable_bash" = "xyes"])
AM_COND_IF([ENABLE_BASH],
[AC_MSG_CHECKING([bash completion directory])
PKG_CHECK_VAR(bashcompdir, [bash-completion], [completionsdir], ,
- bashcompdir="${sysconfdir}/bash_completion.d")
+ bashcompdir="$datadir/bash-completion/completions")
AC_MSG_RESULT([$bashcompdir])
AC_SUBST(bashcompdir)
])

164
app-emulation/lxc/files/lxc-2.1.1-cgroups-enable-container-without-CAP_SYS_ADMIN.patch
View File

@@ -1,164 +0,0 @@
From b635e92d21d2a4d71a553388f18cfa08f44bf1ba Mon Sep 17 00:00:00 2001
From: Christian Brauner <christian.brauner@ubuntu.com>
Date: Mon, 30 Oct 2017 14:16:46 +0100
Subject: [PATCH] cgroups: enable container without CAP_SYS_ADMIN
In case cgroup namespaces are supported but we do not have CAP_SYS_ADMIN we
need to mount cgroups for the container. This patch enables both privileged and
unprivileged containers without CAP_SYS_ADMIN.
Closes #1737.
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
---
src/lxc/cgroups/cgfs.c | 3 ++-
src/lxc/cgroups/cgfsng.c | 52 +++++++++++++++++++++++++++++++++++++++++++++---
src/lxc/cgroups/cgroup.c | 2 +-
src/lxc/conf.c | 3 ---
src/lxc/conf.h | 1 +
5 files changed, 53 insertions(+), 8 deletions(-)
diff --git a/src/lxc/cgroups/cgfs.c b/src/lxc/cgroups/cgfs.c
index bcbd6613..efd627f0 100644
--- a/src/lxc/cgroups/cgfs.c
+++ b/src/lxc/cgroups/cgfs.c
@@ -1418,11 +1418,12 @@ static bool cgroupfs_mount_cgroup(void *hdata, const char *root, int type)
struct cgfs_data *cgfs_d;
struct cgroup_process_info *info, *base_info;
int r, saved_errno = 0;
+ struct lxc_handler *handler = hdata;
if (cgns_supported())
return true;
- cgfs_d = hdata;
+ cgfs_d = handler->cgroup_data;
if (!cgfs_d)
return false;
base_info = cgfs_d->info;
diff --git a/src/lxc/cgroups/cgfsng.c b/src/lxc/cgroups/cgfsng.c
index e43edd7d..ec6440c1 100644
--- a/src/lxc/cgroups/cgfsng.c
+++ b/src/lxc/cgroups/cgfsng.c
@@ -50,6 +50,7 @@
#include <linux/types.h>
#include <linux/kdev_t.h>
+#include "caps.h"
#include "cgroup.h"
#include "cgroup_utils.h"
#include "commands.h"
@@ -1616,17 +1617,49 @@ do_secondstage_mounts_if_needed(int type, struct hierarchy *h,
return 0;
}
+static int mount_cgroup_cgns_supported(struct hierarchy *h, const char *controllerpath)
+{
+ int ret;
+ char *controllers = NULL;
+ char *type = "cgroup2";
+
+ if (!h->is_cgroup_v2) {
+ controllers = lxc_string_join(",", (const char **)h->controllers, false);
+ if (!controllers)
+ return -ENOMEM;
+ type = "cgroup";
+ }
+
+ ret = mount("cgroup", controllerpath, type, MS_NOSUID|MS_NOEXEC|MS_NODEV|MS_RELATIME, controllers);
+ free(controllers);
+ if (ret < 0) {
+ SYSERROR("Failed to mount %s with cgroup filesystem type %s", controllerpath, type);
+ return -1;
+ }
+
+ DEBUG("Mounted %s with cgroup filesystem type %s", controllerpath, type);
+ return 0;
+}
+
static bool cgfsng_mount(void *hdata, const char *root, int type)
{
- struct cgfsng_handler_data *d = hdata;
+ int i;
char *tmpfspath = NULL;
bool retval = false;
- int i;
+ struct lxc_handler *handler = hdata;
+ struct cgfsng_handler_data *d = handler->cgroup_data;
+ bool has_cgns = false, has_sys_admin = true;
if ((type & LXC_AUTO_CGROUP_MASK) == 0)
return true;
- if (cgns_supported())
+ has_cgns = cgns_supported();
+ if (!lxc_list_empty(&handler->conf->keepcaps))
+ has_sys_admin = in_caplist(CAP_SYS_ADMIN, &handler->conf->keepcaps);
+ else
+ has_sys_admin = !in_caplist(CAP_SYS_ADMIN, &handler->conf->caps);
+
+ if (has_cgns && has_sys_admin)
return true;
tmpfspath = must_make_path(root, "/sys/fs/cgroup", NULL);
@@ -1662,6 +1695,19 @@ static bool cgfsng_mount(void *hdata, const char *root, int type)
free(controllerpath);
goto bad;
}
+
+ if (has_cgns && !has_sys_admin) {
+ /* If cgroup namespaces are supported but the container
+ * will not have CAP_SYS_ADMIN after it has started we
+ * need to mount the cgroups manually.
+ */
+ r = mount_cgroup_cgns_supported(h, controllerpath);
+ free(controllerpath);
+ if (r < 0)
+ goto bad;
+ continue;
+ }
+
if (mount_cgroup_full(type, h, controllerpath, d->container_cgroup) < 0) {
free(controllerpath);
goto bad;
diff --git a/src/lxc/cgroups/cgroup.c b/src/lxc/cgroups/cgroup.c
index 674e3090..36a665b1 100644
--- a/src/lxc/cgroups/cgroup.c
+++ b/src/lxc/cgroups/cgroup.c
@@ -166,7 +166,7 @@ bool cgroup_chown(struct lxc_handler *handler)
bool cgroup_mount(const char *root, struct lxc_handler *handler, int type)
{
if (ops)
- return ops->mount_cgroup(handler->cgroup_data, root, type);
+ return ops->mount_cgroup(handler, root, type);
return false;
}
diff --git a/src/lxc/conf.c b/src/lxc/conf.c
index d2fab945..44d97843 100644
--- a/src/lxc/conf.c
+++ b/src/lxc/conf.c
@@ -210,9 +210,6 @@ __thread struct lxc_conf *current_config;
struct lxc_conf *current_config;
#endif
-/* Declare this here, since we don't want to reshuffle the whole file. */
-static int in_caplist(int cap, struct lxc_list *caps);
-
static struct mount_opt mount_opt[] = {
{ "async", 1, MS_SYNCHRONOUS },
{ "atime", 1, MS_NOATIME },
diff --git a/src/lxc/conf.h b/src/lxc/conf.h
index c61f861e..63e71e2d 100644
--- a/src/lxc/conf.h
+++ b/src/lxc/conf.h
@@ -402,5 +402,6 @@ extern unsigned long add_required_remount_flags(const char *s, const char *d,
unsigned long flags);
extern int run_script(const char *name, const char *section, const char *script,
...);
+extern int in_caplist(int cap, struct lxc_list *caps);
#endif /* __LXC_CONF_H */
--
2.13.6

118
app-emulation/lxc/files/lxc-2.1.1-cve-2018-6556.patch
View File

@@ -1,118 +0,0 @@
From d183654ec1a2cd1149bdb92601ccb7246bddb14e Mon Sep 17 00:00:00 2001
From: Christian Brauner <christian.brauner@ubuntu.com>
Date: Wed, 25 Jul 2018 19:56:54 +0200
Subject: [PATCH] CVE 2018-6556: verify netns fd in lxc-user-nic
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
---
src/lxc/lxc_user_nic.c | 35 ++++++++++++++++++++++++++++++++---
src/lxc/utils.c | 12 ++++++++++++
src/lxc/utils.h | 5 +++++
3 files changed, 49 insertions(+), 3 deletions(-)
ADDENDUM from vdupras@gentoo.org: Original patch from Christian didn't
include LXC_PROC_PID_FD_LEN define, but referenced it. This resulted in
code that doesn't compile. I fetched the definition from the stable-3.0
branch and included it to this patch. Also, this diff is regenerated
from lxc-2.1.1 tag instead of stable-2.0 branch.
diff --git a/src/lxc/lxc_user_nic.c b/src/lxc/lxc_user_nic.c
index 6f550f0d..09a342ac 100644
--- a/src/lxc/lxc_user_nic.c
+++ b/src/lxc/lxc_user_nic.c
@@ -1124,12 +1124,41 @@ int main(int argc, char *argv[])
exit(EXIT_FAILURE);
}
} else if (request == LXC_USERNIC_DELETE) {
- netns_fd = open(args.pid, O_RDONLY);
+ char opath[LXC_PROC_PID_FD_LEN];
+
+ /* Open the path with O_PATH which will not trigger an actual
+ * open(). Don't report an errno to the caller to not leak
+ * information whether the path exists or not.
+ * When stracing setuid is stripped so this is not a concern
+ * either.
+ */
+ netns_fd = open(args.pid, O_PATH | O_CLOEXEC);
if (netns_fd < 0) {
- usernic_error("Could not open \"%s\": %s\n", args.pid,
- strerror(errno));
+ usernic_error("Failed to open \"%s\"\n", args.pid);
exit(EXIT_FAILURE);
}
+
+ if (!fhas_fs_type(netns_fd, NSFS_MAGIC)) {
+ usernic_error("Path \"%s\" does not refer to a network namespace path\n", args.pid);
+ close(netns_fd);
+ exit(EXIT_FAILURE);
+ }
+
+ ret = snprintf(opath, sizeof(opath), "/proc/self/fd/%d", netns_fd);
+ if (ret < 0 || (size_t)ret >= sizeof(opath)) {
+ close(netns_fd);
+ exit(EXIT_FAILURE);
+ }
+
+ /* Now get an fd that we can use in setns() calls. */
+ ret = open(opath, O_RDONLY | O_CLOEXEC);
+ if (ret < 0) {
+ usernic_error("Failed to open \"%s\": %s\n", args.pid, strerror(errno));
+ close(netns_fd);
+ exit(EXIT_FAILURE);
+ }
+ close(netns_fd);
+ netns_fd = ret;
}
if (!create_db_dir(LXC_USERNIC_DB)) {
diff --git a/src/lxc/utils.c b/src/lxc/utils.c
index e6a44a51..c2a08a9d 100644
--- a/src/lxc/utils.c
+++ b/src/lxc/utils.c
@@ -2380,6 +2380,18 @@ bool has_fs_type(const char *path, fs_type_magic magic_val)
return has_type;
}
+bool fhas_fs_type(int fd, fs_type_magic magic_val)
+{
+ int ret;
+ struct statfs sb;
+
+ ret = fstatfs(fd, &sb);
+ if (ret < 0)
+ return false;
+
+ return is_fs_type(&sb, magic_val);
+}
+
bool lxc_nic_exists(char *nic)
{
#define __LXC_SYS_CLASS_NET_LEN 15 + IFNAMSIZ + 1
diff --git a/src/lxc/utils.h b/src/lxc/utils.h
index e83ed49e..06ec74d7 100644
--- a/src/lxc/utils.h
+++ b/src/lxc/utils.h
@@ -46,11 +46,16 @@
#define __S_ISTYPE(mode, mask) (((mode)&S_IFMT) == (mask))
#endif
+#ifndef NSFS_MAGIC
+#define NSFS_MAGIC 0x6e736673
+#endif
+
/* Useful macros */
/* Maximum number for 64 bit integer is a string with 21 digits: 2^64 - 1 = 21 */
#define LXC_NUMSTRLEN64 21
#define LXC_LINELEN 4096
#define LXC_IDMAPLEN 4096
+#define LXC_PROC_PID_FD_LEN (6 + LXC_NUMSTRLEN64 + 4 + LXC_NUMSTRLEN64 + 1)
/* returns 1 on success, 0 if there were any failures */
extern int lxc_rmdir_onedev(char *path, const char *exclude);
@@ -402,6 +407,7 @@ extern void *must_realloc(void *orig, size_t sz);
/* __typeof__ should be safe to use with all compilers. */
typedef __typeof__(((struct statfs *)NULL)->f_type) fs_type_magic;
extern bool has_fs_type(const char *path, fs_type_magic magic_val);
+extern bool fhas_fs_type(int fd, fs_type_magic magic_val);
extern bool is_fs_type(const struct statfs *fs, fs_type_magic magic_val);
extern bool lxc_nic_exists(char *nic);

26
app-emulation/lxc/files/lxc-2.1.1-fix-cgroup2-detection.patch
View File

@@ -1,26 +0,0 @@
From cdfe90a49f516b0f1210d181980f14a4765e10da Mon Sep 17 00:00:00 2001
From: Christian Brauner <christian.brauner@ubuntu.com>
Date: Mon, 30 Oct 2017 14:17:20 +0100
Subject: [PATCH] cgfsng: fix cgroup2 detection
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
---
src/lxc/cgroups/cgfsng.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/src/lxc/cgroups/cgfsng.c b/src/lxc/cgroups/cgfsng.c
index 897336f0..e43edd7d 100644
--- a/src/lxc/cgroups/cgfsng.c
+++ b/src/lxc/cgroups/cgfsng.c
@@ -815,7 +815,7 @@ static void add_controller(char **clist, char *mountpoint, char *base_cgroup)
new->fullcgpath = NULL;
/* record if this is the cgroup v2 hierarchy */
- if (!strcmp(base_cgroup, "cgroup2"))
+ if (clist && !strcmp(*clist, "cgroup2"))
new->is_cgroup_v2 = true;
else
new->is_cgroup_v2 = false;
--
2.13.6