diff options
4 files changed, 0 insertions, 335 deletions
diff --git a/app-emulation/lxc/files/lxc-2.0.6-bash-completion.patch b/app-emulation/lxc/files/lxc-2.0.6-bash-completion.patch deleted file mode 100644 index 6033e36c7985..000000000000 --- a/app-emulation/lxc/files/lxc-2.0.6-bash-completion.patch +++ /dev/null @@ -1,27 +0,0 @@ -diff --git a/config/bash/lxc.in b/config/bash/lxc.in -index 7dcf302..5927fe2 100644 ---- a/config/bash/lxc.in -+++ b/config/bash/lxc.in -@@ -1,4 +1,3 @@ --_have lxc-start && { - _lxc_names() { - COMPREPLY=( $( compgen -W "$( lxc-ls )" "$cur" ) ) - } -@@ -100,4 +99,3 @@ _have lxc-start && { - - complete -o default -F _lxc_generic_o lxc-copy - complete -o default -F _lxc_generic_o lxc-start-ephemeral --} -diff --git a/configure.ac b/configure.ac -index 4640c0d..14ccdd3 100644 ---- a/configure.ac -+++ b/configure.ac -@@ -478,7 +478,7 @@ AM_CONDITIONAL([ENABLE_BASH], [test "x$enable_bash" = "xyes"]) - AM_COND_IF([ENABLE_BASH], - [AC_MSG_CHECKING([bash completion directory]) - PKG_CHECK_VAR(bashcompdir, [bash-completion], [completionsdir], , -- bashcompdir="${sysconfdir}/bash_completion.d") -+ bashcompdir="$datadir/bash-completion/completions") - AC_MSG_RESULT([$bashcompdir]) - AC_SUBST(bashcompdir) - ]) diff --git a/app-emulation/lxc/files/lxc-2.1.1-cgroups-enable-container-without-CAP_SYS_ADMIN.patch b/app-emulation/lxc/files/lxc-2.1.1-cgroups-enable-container-without-CAP_SYS_ADMIN.patch deleted file mode 100644 index 8493491d0d65..000000000000 --- a/app-emulation/lxc/files/lxc-2.1.1-cgroups-enable-container-without-CAP_SYS_ADMIN.patch +++ /dev/null @@ -1,164 +0,0 @@ -From b635e92d21d2a4d71a553388f18cfa08f44bf1ba Mon Sep 17 00:00:00 2001 -From: Christian Brauner <christian.brauner@ubuntu.com> -Date: Mon, 30 Oct 2017 14:16:46 +0100 -Subject: [PATCH] cgroups: enable container without CAP_SYS_ADMIN - -In case cgroup namespaces are supported but we do not have CAP_SYS_ADMIN we -need to mount cgroups for the container. This patch enables both privileged and -unprivileged containers without CAP_SYS_ADMIN. - -Closes #1737. - -Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com> ---- - src/lxc/cgroups/cgfs.c | 3 ++- - src/lxc/cgroups/cgfsng.c | 52 +++++++++++++++++++++++++++++++++++++++++++++--- - src/lxc/cgroups/cgroup.c | 2 +- - src/lxc/conf.c | 3 --- - src/lxc/conf.h | 1 + - 5 files changed, 53 insertions(+), 8 deletions(-) - -diff --git a/src/lxc/cgroups/cgfs.c b/src/lxc/cgroups/cgfs.c -index bcbd6613..efd627f0 100644 ---- a/src/lxc/cgroups/cgfs.c -+++ b/src/lxc/cgroups/cgfs.c -@@ -1418,11 +1418,12 @@ static bool cgroupfs_mount_cgroup(void *hdata, const char *root, int type) - struct cgfs_data *cgfs_d; - struct cgroup_process_info *info, *base_info; - int r, saved_errno = 0; -+ struct lxc_handler *handler = hdata; - - if (cgns_supported()) - return true; - -- cgfs_d = hdata; -+ cgfs_d = handler->cgroup_data; - if (!cgfs_d) - return false; - base_info = cgfs_d->info; -diff --git a/src/lxc/cgroups/cgfsng.c b/src/lxc/cgroups/cgfsng.c -index e43edd7d..ec6440c1 100644 ---- a/src/lxc/cgroups/cgfsng.c -+++ b/src/lxc/cgroups/cgfsng.c -@@ -50,6 +50,7 @@ - #include <linux/types.h> - #include <linux/kdev_t.h> - -+#include "caps.h" - #include "cgroup.h" - #include "cgroup_utils.h" - #include "commands.h" -@@ -1616,17 +1617,49 @@ do_secondstage_mounts_if_needed(int type, struct hierarchy *h, - return 0; - } - -+static int mount_cgroup_cgns_supported(struct hierarchy *h, const char *controllerpath) -+{ -+ int ret; -+ char *controllers = NULL; -+ char *type = "cgroup2"; -+ -+ if (!h->is_cgroup_v2) { -+ controllers = lxc_string_join(",", (const char **)h->controllers, false); -+ if (!controllers) -+ return -ENOMEM; -+ type = "cgroup"; -+ } -+ -+ ret = mount("cgroup", controllerpath, type, MS_NOSUID|MS_NOEXEC|MS_NODEV|MS_RELATIME, controllers); -+ free(controllers); -+ if (ret < 0) { -+ SYSERROR("Failed to mount %s with cgroup filesystem type %s", controllerpath, type); -+ return -1; -+ } -+ -+ DEBUG("Mounted %s with cgroup filesystem type %s", controllerpath, type); -+ return 0; -+} -+ - static bool cgfsng_mount(void *hdata, const char *root, int type) - { -- struct cgfsng_handler_data *d = hdata; -+ int i; - char *tmpfspath = NULL; - bool retval = false; -- int i; -+ struct lxc_handler *handler = hdata; -+ struct cgfsng_handler_data *d = handler->cgroup_data; -+ bool has_cgns = false, has_sys_admin = true; - - if ((type & LXC_AUTO_CGROUP_MASK) == 0) - return true; - -- if (cgns_supported()) -+ has_cgns = cgns_supported(); -+ if (!lxc_list_empty(&handler->conf->keepcaps)) -+ has_sys_admin = in_caplist(CAP_SYS_ADMIN, &handler->conf->keepcaps); -+ else -+ has_sys_admin = !in_caplist(CAP_SYS_ADMIN, &handler->conf->caps); -+ -+ if (has_cgns && has_sys_admin) - return true; - - tmpfspath = must_make_path(root, "/sys/fs/cgroup", NULL); -@@ -1662,6 +1695,19 @@ static bool cgfsng_mount(void *hdata, const char *root, int type) - free(controllerpath); - goto bad; - } -+ -+ if (has_cgns && !has_sys_admin) { -+ /* If cgroup namespaces are supported but the container -+ * will not have CAP_SYS_ADMIN after it has started we -+ * need to mount the cgroups manually. -+ */ -+ r = mount_cgroup_cgns_supported(h, controllerpath); -+ free(controllerpath); -+ if (r < 0) -+ goto bad; -+ continue; -+ } -+ - if (mount_cgroup_full(type, h, controllerpath, d->container_cgroup) < 0) { - free(controllerpath); - goto bad; -diff --git a/src/lxc/cgroups/cgroup.c b/src/lxc/cgroups/cgroup.c -index 674e3090..36a665b1 100644 ---- a/src/lxc/cgroups/cgroup.c -+++ b/src/lxc/cgroups/cgroup.c -@@ -166,7 +166,7 @@ bool cgroup_chown(struct lxc_handler *handler) - bool cgroup_mount(const char *root, struct lxc_handler *handler, int type) - { - if (ops) -- return ops->mount_cgroup(handler->cgroup_data, root, type); -+ return ops->mount_cgroup(handler, root, type); - - return false; - } -diff --git a/src/lxc/conf.c b/src/lxc/conf.c -index d2fab945..44d97843 100644 ---- a/src/lxc/conf.c -+++ b/src/lxc/conf.c -@@ -210,9 +210,6 @@ __thread struct lxc_conf *current_config; - struct lxc_conf *current_config; - #endif - --/* Declare this here, since we don't want to reshuffle the whole file. */ --static int in_caplist(int cap, struct lxc_list *caps); -- - static struct mount_opt mount_opt[] = { - { "async", 1, MS_SYNCHRONOUS }, - { "atime", 1, MS_NOATIME }, -diff --git a/src/lxc/conf.h b/src/lxc/conf.h -index c61f861e..63e71e2d 100644 ---- a/src/lxc/conf.h -+++ b/src/lxc/conf.h -@@ -402,5 +402,6 @@ extern unsigned long add_required_remount_flags(const char *s, const char *d, - unsigned long flags); - extern int run_script(const char *name, const char *section, const char *script, - ...); -+extern int in_caplist(int cap, struct lxc_list *caps); - - #endif /* __LXC_CONF_H */ --- -2.13.6 - diff --git a/app-emulation/lxc/files/lxc-2.1.1-cve-2018-6556.patch b/app-emulation/lxc/files/lxc-2.1.1-cve-2018-6556.patch deleted file mode 100644 index bad1e274527e..000000000000 --- a/app-emulation/lxc/files/lxc-2.1.1-cve-2018-6556.patch +++ /dev/null @@ -1,118 +0,0 @@ -From d183654ec1a2cd1149bdb92601ccb7246bddb14e Mon Sep 17 00:00:00 2001 -From: Christian Brauner <christian.brauner@ubuntu.com> -Date: Wed, 25 Jul 2018 19:56:54 +0200 -Subject: [PATCH] CVE 2018-6556: verify netns fd in lxc-user-nic - -Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com> ---- - src/lxc/lxc_user_nic.c | 35 ++++++++++++++++++++++++++++++++--- - src/lxc/utils.c | 12 ++++++++++++ - src/lxc/utils.h | 5 +++++ - 3 files changed, 49 insertions(+), 3 deletions(-) - -ADDENDUM from vdupras@gentoo.org: Original patch from Christian didn't -include LXC_PROC_PID_FD_LEN define, but referenced it. This resulted in -code that doesn't compile. I fetched the definition from the stable-3.0 -branch and included it to this patch. Also, this diff is regenerated -from lxc-2.1.1 tag instead of stable-2.0 branch. - -diff --git a/src/lxc/lxc_user_nic.c b/src/lxc/lxc_user_nic.c -index 6f550f0d..09a342ac 100644 ---- a/src/lxc/lxc_user_nic.c -+++ b/src/lxc/lxc_user_nic.c -@@ -1124,12 +1124,41 @@ int main(int argc, char *argv[]) - exit(EXIT_FAILURE); - } - } else if (request == LXC_USERNIC_DELETE) { -- netns_fd = open(args.pid, O_RDONLY); -+ char opath[LXC_PROC_PID_FD_LEN]; -+ -+ /* Open the path with O_PATH which will not trigger an actual -+ * open(). Don't report an errno to the caller to not leak -+ * information whether the path exists or not. -+ * When stracing setuid is stripped so this is not a concern -+ * either. -+ */ -+ netns_fd = open(args.pid, O_PATH | O_CLOEXEC); - if (netns_fd < 0) { -- usernic_error("Could not open \"%s\": %s\n", args.pid, -- strerror(errno)); -+ usernic_error("Failed to open \"%s\"\n", args.pid); - exit(EXIT_FAILURE); - } -+ -+ if (!fhas_fs_type(netns_fd, NSFS_MAGIC)) { -+ usernic_error("Path \"%s\" does not refer to a network namespace path\n", args.pid); -+ close(netns_fd); -+ exit(EXIT_FAILURE); -+ } -+ -+ ret = snprintf(opath, sizeof(opath), "/proc/self/fd/%d", netns_fd); -+ if (ret < 0 || (size_t)ret >= sizeof(opath)) { -+ close(netns_fd); -+ exit(EXIT_FAILURE); -+ } -+ -+ /* Now get an fd that we can use in setns() calls. */ -+ ret = open(opath, O_RDONLY | O_CLOEXEC); -+ if (ret < 0) { -+ usernic_error("Failed to open \"%s\": %s\n", args.pid, strerror(errno)); -+ close(netns_fd); -+ exit(EXIT_FAILURE); -+ } -+ close(netns_fd); -+ netns_fd = ret; - } - - if (!create_db_dir(LXC_USERNIC_DB)) { -diff --git a/src/lxc/utils.c b/src/lxc/utils.c -index e6a44a51..c2a08a9d 100644 ---- a/src/lxc/utils.c -+++ b/src/lxc/utils.c -@@ -2380,6 +2380,18 @@ bool has_fs_type(const char *path, fs_type_magic magic_val) - return has_type; - } - -+bool fhas_fs_type(int fd, fs_type_magic magic_val) -+{ -+ int ret; -+ struct statfs sb; -+ -+ ret = fstatfs(fd, &sb); -+ if (ret < 0) -+ return false; -+ -+ return is_fs_type(&sb, magic_val); -+} -+ - bool lxc_nic_exists(char *nic) - { - #define __LXC_SYS_CLASS_NET_LEN 15 + IFNAMSIZ + 1 -diff --git a/src/lxc/utils.h b/src/lxc/utils.h -index e83ed49e..06ec74d7 100644 ---- a/src/lxc/utils.h -+++ b/src/lxc/utils.h -@@ -46,11 +46,16 @@ - #define __S_ISTYPE(mode, mask) (((mode)&S_IFMT) == (mask)) - #endif - -+#ifndef NSFS_MAGIC -+#define NSFS_MAGIC 0x6e736673 -+#endif -+ - /* Useful macros */ - /* Maximum number for 64 bit integer is a string with 21 digits: 2^64 - 1 = 21 */ - #define LXC_NUMSTRLEN64 21 - #define LXC_LINELEN 4096 - #define LXC_IDMAPLEN 4096 -+#define LXC_PROC_PID_FD_LEN (6 + LXC_NUMSTRLEN64 + 4 + LXC_NUMSTRLEN64 + 1) - - /* returns 1 on success, 0 if there were any failures */ - extern int lxc_rmdir_onedev(char *path, const char *exclude); -@@ -402,6 +407,7 @@ extern void *must_realloc(void *orig, size_t sz); - /* __typeof__ should be safe to use with all compilers. */ - typedef __typeof__(((struct statfs *)NULL)->f_type) fs_type_magic; - extern bool has_fs_type(const char *path, fs_type_magic magic_val); -+extern bool fhas_fs_type(int fd, fs_type_magic magic_val); - extern bool is_fs_type(const struct statfs *fs, fs_type_magic magic_val); - extern bool lxc_nic_exists(char *nic); diff --git a/app-emulation/lxc/files/lxc-2.1.1-fix-cgroup2-detection.patch b/app-emulation/lxc/files/lxc-2.1.1-fix-cgroup2-detection.patch deleted file mode 100644 index c16d28ac3033..000000000000 --- a/app-emulation/lxc/files/lxc-2.1.1-fix-cgroup2-detection.patch +++ /dev/null @@ -1,26 +0,0 @@ -From cdfe90a49f516b0f1210d181980f14a4765e10da Mon Sep 17 00:00:00 2001 -From: Christian Brauner <christian.brauner@ubuntu.com> -Date: Mon, 30 Oct 2017 14:17:20 +0100 -Subject: [PATCH] cgfsng: fix cgroup2 detection - -Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com> ---- - src/lxc/cgroups/cgfsng.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/src/lxc/cgroups/cgfsng.c b/src/lxc/cgroups/cgfsng.c -index 897336f0..e43edd7d 100644 ---- a/src/lxc/cgroups/cgfsng.c -+++ b/src/lxc/cgroups/cgfsng.c -@@ -815,7 +815,7 @@ static void add_controller(char **clist, char *mountpoint, char *base_cgroup) - new->fullcgpath = NULL; - - /* record if this is the cgroup v2 hierarchy */ -- if (!strcmp(base_cgroup, "cgroup2")) -+ if (clist && !strcmp(*clist, "cgroup2")) - new->is_cgroup_v2 = true; - else - new->is_cgroup_v2 = false; --- -2.13.6 - |