packages/lxc
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

!44 4.0.3: update base version to lxc_4.0.3

Browse Source 
Merge pull request !44 from lifeng_isula/master
This commit is contained in:
openeuler-ci-bot 2020-07-15 16:04:02 +08:00 committed by Gitee
commit 3cb6008eee
75 changed files with 22331 additions and 20130 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

22319
0001-huawei-adapt-to-huawei-4.0.3.patch Normal file
View File

File diff suppressed because it is too large Load Diff

50
0001-iSulad-add-HAVE_ISULAD-macro.patch
View File

@ -1,50 +0,0 @@
From 49f7dc89e5ae690a0b81570a81321b1593aeb994 Mon Sep 17 00:00:00 2001
From: LiFeng <lifeng68@huawei.com>
Date: Sat, 11 Apr 2020 15:43:38 +0800
Subject: [PATCH 01/49] iSulad: add HAVE_ISULAD macro
Signed-off-by: LiFeng <lifeng68@huawei.com>
---
configure.ac | 11 +++++++++++
src/lxc/Makefile.am | 3 +++
2 files changed, 14 insertions(+)
diff --git a/configure.ac b/configure.ac
index 90a4bd4..5f386d9 100644
--- a/configure.ac
+++ b/configure.ac
@@ -791,6 +791,17 @@ else
AC_MSG_RESULT([no])
fi
+AC_MSG_CHECKING([Whether adapt to iSulad])
+AC_ARG_ENABLE([isulad],
+ [AC_HELP_STRING([--enable-isulad], [enable adapt to iSulad [default=yes]])],
+ [adapt_isulad=$enableval], [adapt_isulad=yes])
+AM_CONDITIONAL([HAVE_ISULAD], [test "x$adapt_isulad" = "xyes"])
+if test "x$adapt_isulad" = "xyes"; then
+ AC_DEFINE([HAVE_ISULAD], 1, [adapt to iSulad])
+ AC_MSG_RESULT([yes])
+else
+ AC_MSG_RESULT([no])
+fi
# Files requiring some variable expansion
AC_CONFIG_FILES([
Makefile
diff --git a/src/lxc/Makefile.am b/src/lxc/Makefile.am
index c374c2d..e7fc844 100644
--- a/src/lxc/Makefile.am
+++ b/src/lxc/Makefile.am
@@ -212,6 +212,9 @@ AM_CFLAGS = -DLXCROOTFSMOUNT=\"$(LXCROOTFSMOUNT)\" \
-I $(top_srcdir)/src/lxc/storage \
-I $(top_srcdir)/src/lxc/cgroups
+if HAVE_ISULAD
+AM_CFLAGS += -DHAVE_ISULAD
+endif
if ENABLE_APPARMOR
AM_CFLAGS += -DHAVE_APPARMOR
endif
--
1.8.3.1

213
0002-confile-add-lxc.isulad.init.args-config-interface.patch
View File

@ -1,213 +0,0 @@
From 549a0a959b84a483d9f733cf7a157900f4c889c4 Mon Sep 17 00:00:00 2001
From: LiFeng <lifeng68@huawei.com>
Date: Sat, 11 Apr 2020 16:16:15 +0800
Subject: [PATCH 02/49] confile: add lxc.isulad.init.args config interface
lxc.isulad.init.args config interface is used to specify the args for
the container.
Signed-off-by: LiFeng <lifeng68@huawei.com>
---
src/lxc/conf.c | 17 ++++++++++++++
src/lxc/conf.h | 11 ++++++++-
src/lxc/confile.c | 62 ++++++++++++++++++++++++++++++++++++++++++++++++++
src/lxc/lxccontainer.c | 33 +++++++++++++++++++++++++++
4 files changed, 122 insertions(+), 1 deletion(-)
diff --git a/src/lxc/conf.c b/src/lxc/conf.c
index 2f6be9f..62a6979 100644
--- a/src/lxc/conf.c
+++ b/src/lxc/conf.c
@@ -3835,6 +3835,9 @@ void lxc_conf_free(struct lxc_conf *conf)
free(conf->cgroup_meta.controllers);
free(conf->shmount.path_host);
free(conf->shmount.path_cont);
+#ifdef HAVE_ISULAD
+ lxc_clear_init_args(conf);
+#endif
free(conf);
}
@@ -4645,3 +4648,17 @@ struct lxc_list *sort_cgroup_settings(struct lxc_list *cgroup_settings)
return result;
}
+
+#ifdef HAVE_ISULAD
+/*isulad clear init args*/
+int lxc_clear_init_args(struct lxc_conf *lxc_conf)
+{
+ size_t i;
+
+ for (i = 0; i < lxc_conf->init_argc; i++)
+ free(lxc_conf->init_argv[i]);
+ free(lxc_conf->init_argv);
+
+ return 0;
+}
+#endif
diff --git a/src/lxc/conf.h b/src/lxc/conf.h
index 64885c3..8a198e4 100644
--- a/src/lxc/conf.h
+++ b/src/lxc/conf.h
@@ -398,6 +398,13 @@ struct lxc_conf {
/* Absolute path (in the container) to the shared mount point */
char *path_cont;
} shmount;
+
+#ifdef HAVE_ISULAD
+ /* isulad add: init args used to repalce init_cmd*/
+ char **init_argv;
+ size_t init_argc;
+#endif
+
};
extern int write_id_mapping(enum idtype idtype, pid_t pid, const char *buf,
@@ -470,5 +477,7 @@ extern int lxc_clear_namespace(struct lxc_conf *c);
extern int userns_exec_minimal(const struct lxc_conf *conf,
int (*fn_parent)(void *), void *fn_parent_data,
int (*fn_child)(void *), void *fn_child_data);
-
+#ifdef HAVE_ISULAD
+int lxc_clear_init_args(struct lxc_conf *lxc_conf);
+#endif
#endif /* __LXC_CONF_H */
diff --git a/src/lxc/confile.c b/src/lxc/confile.c
index 0ca577f..e535beb 100644
--- a/src/lxc/confile.c
+++ b/src/lxc/confile.c
@@ -147,6 +147,9 @@ lxc_config_define(tty_dir);
lxc_config_define(uts_name);
lxc_config_define(sysctl);
lxc_config_define(proc);
+#ifdef HAVE_ISULAD
+lxc_config_define(init_args);
+#endif
/*
* Important Note:
@@ -259,6 +262,10 @@ static struct lxc_config_t config_jump_table[] = {
{ "lxc.uts.name", set_config_uts_name, get_config_uts_name, clr_config_uts_name, },
{ "lxc.sysctl", set_config_sysctl, get_config_sysctl, clr_config_sysctl, },
{ "lxc.proc", set_config_proc, get_config_proc, clr_config_proc, },
+#ifdef HAVE_ISULAD
+ { "lxc.isulad.init.args", set_config_init_args, get_config_init_args, clr_config_init_args, },
+
+#endif
};
static const size_t config_jump_table_size = sizeof(config_jump_table) / sizeof(struct lxc_config_t);
@@ -6094,3 +6101,58 @@ int lxc_list_net(struct lxc_conf *c, const char *key, char *retv, int inlen)
return fulllen;
}
+
+#ifdef HAVE_ISULAD
+/* isulad: set config for init args */
+static int set_config_init_args(const char *key, const char *value,
+ struct lxc_conf *lxc_conf, void *data)
+{
+ int ret = 0;
+ char *tmp = NULL;
+ char *new_value = NULL;
+
+ ret = set_config_string_item(&new_value, value);
+ if (ret || !new_value)
+ return ret;
+
+ tmp = realloc(lxc_conf->init_argv, (lxc_conf->init_argc + 1) * sizeof(char *));
+ if (!tmp) {
+ ERROR("Out of memory");
+ free(new_value);
+ return -1;
+ }
+
+ lxc_conf->init_argv = (char **)tmp;
+
+ lxc_conf->init_argv[lxc_conf->init_argc] = new_value;
+ lxc_conf->init_argc++;
+
+ return 0;
+}
+
+/* isulad: get config init args */
+static int get_config_init_args(const char *key, char *retv, int inlen,
+ struct lxc_conf *c, void *data)
+{
+ int i, len, fulllen = 0;
+ struct lxc_list *it;
+
+ if (!retv)
+ inlen = 0;
+ else
+ memset(retv, 0, inlen);
+
+ for (i = 0; i < c->init_argc; i++) {
+ strprint(retv, inlen, "%s", c->init_argv[i]);
+ }
+
+ return fulllen;
+}
+
+/* isulad: clr config init args*/
+static inline int clr_config_init_args(const char *key, struct lxc_conf *c,
+ void *data)
+{
+ return lxc_clear_init_args(c);
+}
+#endif
diff --git a/src/lxc/lxccontainer.c b/src/lxc/lxccontainer.c
index 487d838..f4462fd 100644
--- a/src/lxc/lxccontainer.c
+++ b/src/lxc/lxccontainer.c
@@ -857,6 +857,33 @@ static bool wait_on_daemonized_start(struct lxc_handler *handler, int pid)
return true;
}
+#ifdef HAVE_ISULAD
+/* isulad: use init argv as init cmd */
+static char **use_init_args(char **init_argv, size_t init_args)
+{
+ size_t i;
+ int nargs = 0;
+ char **argv;
+
+ if (!init_argv)
+ return NULL;
+
+ do {
+ argv = malloc(sizeof(char *));
+ } while (!argv);
+
+ argv[0] = NULL;
+ for (i = 0; i < init_args; i++)
+ push_arg(&argv, init_argv[i], &nargs);
+
+ if (nargs == 0) {
+ free(argv);
+ return NULL;
+ }
+ return argv;
+}
+#endif
+
static bool do_lxcapi_start(struct lxc_container *c, int useinit, char * const argv[])
{
int ret;
@@ -914,6 +941,12 @@ static bool do_lxcapi_start(struct lxc_container *c, int useinit, char * const a
argv = init_cmd = split_init_cmd(conf->init_cmd);
}
+#ifdef HAVE_ISULAD
+ if (!argv) {
+ argv = init_cmd = use_init_args(conf->init_argv, conf->init_argc);
+ }
+#endif
+
/* ... otherwise use default_args. */
if (!argv) {
if (useinit) {
--
1.8.3.1

1284
0003-confile-add-lxc.isulad.populate.device-interface.patch
View File

File diff suppressed because it is too large Load Diff

132
0004-confile-add-support-umask.patch
View File

@ -1,132 +0,0 @@
From e1bf4afdac0f4e1c19ad24c7c9fb915ce72906ed Mon Sep 17 00:00:00 2001
From: LiFeng <lifeng68@huawei.com>
Date: Sat, 11 Apr 2020 17:24:47 +0800
Subject: [PATCH 04/49] confile: add support umask
lxc.isulad.umask=normal make the container umask to 0022
lxc.isulad.umask=secure make the container umask to 0027 (default)
Signed-off-by: LiFeng <lifeng68@huawei.com>
---
src/lxc/attach.c | 5 +++++
src/lxc/conf.c | 6 ++++++
src/lxc/conf.h | 1 +
src/lxc/confile.c | 38 ++++++++++++++++++++++++++++++++++++++
4 files changed, 50 insertions(+)
diff --git a/src/lxc/attach.c b/src/lxc/attach.c
index 406b8ec..56d62ed 100644
--- a/src/lxc/attach.c
+++ b/src/lxc/attach.c
@@ -659,6 +659,11 @@ static int attach_child_main(struct attach_clone_payload *payload)
(options->attach_flags & LXC_ATTACH_LSM) &&
init_ctx->lsm_label;
+#ifdef HAVE_ISULAD
+ /*isulad: set system umask */
+ umask(init_ctx->container->lxc_conf->umask);
+#endif
+
/* A description of the purpose of this functionality is provided in the
* lxc-attach(1) manual page. We have to remount here and not in the
* parent process, otherwise /proc may not properly reflect the new pid
diff --git a/src/lxc/conf.c b/src/lxc/conf.c
index e9c0a37..e3fce51 100644
--- a/src/lxc/conf.c
+++ b/src/lxc/conf.c
@@ -2567,6 +2567,7 @@ struct lxc_conf *lxc_conf_init(void)
#ifdef HAVE_ISULAD
/* isulad add begin */
lxc_list_init(&new->populate_devs);
+ new->umask = 0027; /*default umask 0027*/
#endif
return new;
@@ -3522,6 +3523,11 @@ int lxc_setup(struct lxc_handler *handler)
if (ret < 0)
return -1;
+#ifdef HAVE_ISULAD
+ /*isulad: set system umask */
+ umask(lxc_conf->umask);
+#endif
+
ret = setup_personality(lxc_conf->personality);
if (ret < 0)
return log_error(-1, "Failed to set personality");
diff --git a/src/lxc/conf.h b/src/lxc/conf.h
index 452458c..7ed3cd0 100644
--- a/src/lxc/conf.h
+++ b/src/lxc/conf.h
@@ -427,6 +427,7 @@ struct lxc_conf {
/* populate devices*/
struct lxc_list populate_devs;
+ mode_t umask; //umask value
#endif
};
diff --git a/src/lxc/confile.c b/src/lxc/confile.c
index f0772f9..2df269a 100644
--- a/src/lxc/confile.c
+++ b/src/lxc/confile.c
@@ -150,6 +150,7 @@ lxc_config_define(proc);
#ifdef HAVE_ISULAD
lxc_config_define(init_args);
lxc_config_define(populate_device);
+lxc_config_define(umask);
#endif
/*
@@ -266,6 +267,7 @@ static struct lxc_config_t config_jump_table[] = {
#ifdef HAVE_ISULAD
{ "lxc.isulad.init.args", set_config_init_args, get_config_init_args, clr_config_init_args, },
{ "lxc.isulad.populate.device", set_config_populate_device, get_config_populate_device, clr_config_populate_device, },
+ { "lxc.isulad.umask", set_config_umask, get_config_umask, clr_config_umask, },
#endif
};
@@ -6273,4 +6275,40 @@ static inline int clr_config_populate_device(const char *key, struct lxc_conf *c
return lxc_clear_populate_devices(c);
}
+/* isulad: set config for umask */
+static int set_config_umask(const char *key, const char *value,
+ struct lxc_conf *lxc_conf, void *data)
+{
+ if (lxc_config_value_empty(value)) {
+ ERROR("Empty umask");
+ return -1;
+ }
+
+ if (strcmp(value, "normal") == 0) {
+ lxc_conf->umask = 0022;
+ return 0;
+ } else if (strcmp(value, "secure") == 0) {
+ lxc_conf->umask = 0027;
+ return 0;
+ } else {
+ ERROR("Invalid native umask: %s", value);
+ return -1;
+ }
+}
+
+/* isulad add: get umask value*/
+static int get_config_umask(const char *key, char *retv, int inlen,
+ struct lxc_conf *c, void *data)
+{
+ return lxc_get_conf_size_t(c, retv, inlen, c->umask);
+}
+
+/* isulad add: clear umask value */
+static inline int clr_config_umask(const char *key, struct lxc_conf *c,
+ void *data)
+{
+ c->umask = 0027;
+ return 0;
+}
+
#endif
--
1.8.3.1

1149
0005-cgroup-refact-cgroup-implemt.patch
View File

File diff suppressed because it is too large Load Diff

112
0006-modify-container-exit-code-and-stop-signal.patch
View File

@ -1,112 +0,0 @@
From ef7c687828efd488369ff860523aa15a42c72587 Mon Sep 17 00:00:00 2001
From: wujing <wujing50@huawei.com>
Date: Mon, 13 Apr 2020 04:58:46 -0400
Subject: [PATCH 06/49] modify container exit code and stop signal
Signed-off-by: wujing <wujing50@huawei.com>
---
src/lxc/lxccontainer.c | 10 ++++++++--
src/lxc/start.c | 28 ++++++++++++++++++++++++++++
2 files changed, 36 insertions(+), 2 deletions(-)
diff --git a/src/lxc/lxccontainer.c b/src/lxc/lxccontainer.c
index f4462fd..a617172 100644
--- a/src/lxc/lxccontainer.c
+++ b/src/lxc/lxccontainer.c
@@ -2101,7 +2101,12 @@ WRAP_API_1(bool, lxcapi_reboot2, int)
static bool do_lxcapi_shutdown(struct lxc_container *c, int timeout)
{
__do_close int pidfd = -EBADF, state_client_fd = -EBADF;
+#ifdef HAVE_ISULAD
+ // isulad: keep default signal the same as docker
+ int haltsignal = SIGTERM;
+#else
int haltsignal = SIGPWR;
+#endif
pid_t pid = -1;
lxc_state_t states[MAX_STATE] = {0};
int killret, ret;
@@ -2117,12 +2122,13 @@ static bool do_lxcapi_shutdown(struct lxc_container *c, int timeout)
if (pid <= 0)
return true;
- /* Detect whether we should send SIGRTMIN + 3 (e.g. systemd). */
if (c->lxc_conf && c->lxc_conf->haltsignal)
haltsignal = c->lxc_conf->haltsignal;
+#ifndef HAVE_ISULAD
+ /* Detect whether we should send SIGRTMIN + 3 (e.g. systemd). */
else if (task_blocks_signal(pid, (SIGRTMIN + 3)))
haltsignal = (SIGRTMIN + 3);
-
+#endif
/*
* Add a new state client before sending the shutdown signal so
diff --git a/src/lxc/start.c b/src/lxc/start.c
index a25bd04..5dcf828 100644
--- a/src/lxc/start.c
+++ b/src/lxc/start.c
@@ -1886,10 +1886,18 @@ out_sync_fini:
return -1;
}
+#ifdef HAVE_ISULAD
+// isulad: send '128 + signal' if container is killed by signal.
+#define EXIT_SIGNAL_OFFSET 128
+#endif
+
int __lxc_start(struct lxc_handler *handler, struct lxc_operations *ops,
void *data, const char *lxcpath, bool daemonize, int *error_num)
{
int ret, status;
+#ifdef HAVE_ISULAD
+ int exit_code;
+#endif
const char *name = handler->name;
struct lxc_conf *conf = handler->conf;
struct cgroup_ops *cgroup_ops;
@@ -1976,6 +1984,21 @@ int __lxc_start(struct lxc_handler *handler, struct lxc_operations *ops,
* reboot. This should mean it was an lxc-execute which simply exited.
* In any case, treat it as a 'halt'.
*/
+#ifdef HAVE_ISULAD
+ // isulad: recored log for container init exit
+ if (WIFSIGNALED(status)) {
+ int signal = WTERMSIG(status);
+ signal = WTERMSIG(status);
+ exit_code = EXIT_SIGNAL_OFFSET + signal;
+ ERROR("Container \"%s\" init exited with signal %d", name, signal);
+ } else if (WIFEXITED(status)) {
+ exit_code = WEXITSTATUS(status);
+ ERROR("Container \"%s\" init exited with status %d", name, exit_code);
+ } else {
+ exit_code = -1;
+ ERROR("Container \"%s\" init exited with unknown status", name);
+ }
+#else
if (WIFSIGNALED(status)) {
switch(WTERMSIG(status)) {
case SIGINT: /* halt */
@@ -1993,6 +2016,7 @@ int __lxc_start(struct lxc_handler *handler, struct lxc_operations *ops,
break;
}
}
+#endif
ret = lxc_restore_phys_nics_to_netns(handler);
if (ret < 0)
@@ -2000,7 +2024,11 @@ int __lxc_start(struct lxc_handler *handler, struct lxc_operations *ops,
close_prot_errno_disarm(handler->pinfd);
+#ifdef HAVE_ISULAD
+ lxc_monitor_send_exit_code(name, exit_code, handler->lxcpath);
+#else
lxc_monitor_send_exit_code(name, status, handler->lxcpath);
+#endif
lxc_error_set_and_log(handler->pid, status);
if (error_num)
*error_num = handler->exit_status;
--
1.8.3.1

545
0007-check-and-save-pid-info-file.patch
View File

@ -1,545 +0,0 @@
From 0d54daf204fd2bc41c45c7c159af6436d66b272c Mon Sep 17 00:00:00 2001
From: wujing <wujing50@huawei.com>
Date: Mon, 13 Apr 2020 05:48:03 -0400
Subject: [PATCH 07/49] check and save pid info file
Signed-off-by: wujing <wujing50@huawei.com>
---
src/lxc/conf.c | 1 +
src/lxc/conf.h | 2 +
src/lxc/lxccontainer.c | 29 +++++++++++-
src/lxc/lxccontainer.h | 12 +++++
src/lxc/start.c | 98 ++++++++++++++++++++++++++++++++++++++
src/lxc/tools/arguments.h | 16 +++++++
src/lxc/tools/lxc_start.c | 28 +++++++++++
src/lxc/utils.c | 117 ++++++++++++++++++++++++++++++++++++++++++++++
src/lxc/utils.h | 69 +++++++++++++++++++++++++++
9 files changed, 371 insertions(+), 1 deletion(-)
diff --git a/src/lxc/conf.c b/src/lxc/conf.c
index e806605..43437af 100644
--- a/src/lxc/conf.c
+++ b/src/lxc/conf.c
@@ -3961,6 +3961,7 @@ void lxc_conf_free(struct lxc_conf *conf)
free(conf->shmount.path_host);
free(conf->shmount.path_cont);
#ifdef HAVE_ISULAD
+ free(conf->container_info_file);
lxc_clear_init_args(conf);
lxc_clear_populate_devices(conf);
#endif
diff --git a/src/lxc/conf.h b/src/lxc/conf.h
index 7ed3cd0..23942ac 100644
--- a/src/lxc/conf.h
+++ b/src/lxc/conf.h
@@ -428,6 +428,8 @@ struct lxc_conf {
/* populate devices*/
struct lxc_list populate_devs;
mode_t umask; //umask value
+
+ char *container_info_file;
#endif
};
diff --git a/src/lxc/lxccontainer.c b/src/lxc/lxccontainer.c
index a617172..33bb3ec 100644
--- a/src/lxc/lxccontainer.c
+++ b/src/lxc/lxccontainer.c
@@ -5293,6 +5293,31 @@ static int do_lxcapi_seccomp_notify_fd(struct lxc_container *c)
WRAP_API(int, lxcapi_seccomp_notify_fd)
+#ifdef HAVE_ISULAD
+/* isulad add set info file path */
+static bool do_lxcapi_set_container_info_file(struct lxc_container *c, const char *info_file)
+{
+ struct lxc_conf *conf = NULL;
+
+ if (!c || !c->lxc_conf || !info_file)
+ return false;
+ if (container_mem_lock(c)) {
+ ERROR("Error getting mem lock");
+ return false;
+ }
+
+ conf = c->lxc_conf;
+ if (conf->container_info_file)
+ free(conf->container_info_file);
+ conf->container_info_file = safe_strdup(info_file);
+
+ container_mem_unlock(c);
+ return true;
+}
+
+WRAP_API_1(bool, lxcapi_set_container_info_file, const char *)
+#endif
+
struct lxc_container *lxc_container_new(const char *name, const char *configpath)
{
struct lxc_container *c;
@@ -5434,7 +5459,9 @@ struct lxc_container *lxc_container_new(const char *name, const char *configpath
c->mount = lxcapi_mount;
c->umount = lxcapi_umount;
c->seccomp_notify_fd = lxcapi_seccomp_notify_fd;
-
+#ifdef HAVE_ISULAD
+ c->set_container_info_file = lxcapi_set_container_info_file;
+#endif
return c;
err:
diff --git a/src/lxc/lxccontainer.h b/src/lxc/lxccontainer.h
index 4577de7..edfff32 100644
--- a/src/lxc/lxccontainer.h
+++ b/src/lxc/lxccontainer.h
@@ -865,6 +865,18 @@ struct lxc_container {
* \return pidfd of init process of the container.
*/
int (*init_pidfd)(struct lxc_container *c);
+
+#ifdef HAVE_ISULAD
+ /*! isulad add
+ * \brief An API call to set the path of info file
+ *
+ * \param c Container.
+ * \param info_file Value of the path of info file.
+ *
+ * \return \c true on success, else \c false.
+ */
+ bool (*set_container_info_file) (struct lxc_container *c, const char *info_file);
+#endif
};
/*!
diff --git a/src/lxc/start.c b/src/lxc/start.c
index 5dcf828..f5f9565 100644
--- a/src/lxc/start.c
+++ b/src/lxc/start.c
@@ -1537,6 +1537,94 @@ static inline int do_share_ns(void *arg)
return 0;
}
+#ifdef HAVE_ISULAD
+static int lxc_write_container_info(char *filename, pid_t pid, pid_t p_pid,
+ unsigned long long start_at, unsigned long long p_start_at)
+{
+ FILE *pid_fp = NULL;
+ int ret = 0;
+
+ pid_fp = lxc_fopen(filename, "w");
+ if (pid_fp == NULL) {
+ SYSERROR("Failed to create pidfile '%s'",filename);
+ ret = -1;
+ goto out;
+ }
+
+ if (fprintf(pid_fp, "%d %llu %d %llu\n", pid, start_at, p_pid, p_start_at) < 0) {
+ SYSERROR("Failed to write '%s'", filename);
+ ret = -1;
+ goto out;
+ }
+out:
+ if (pid_fp)
+ fclose(pid_fp);
+ pid_fp = NULL;
+ return ret;
+}
+
+static int lxc_check_container_info(char *filename, pid_t pid, pid_t p_pid,
+ unsigned long long start_at, unsigned long long p_start_at)
+{
+ int ret = 0;
+ int num;
+ char sbuf[1024] = {0}; /* bufs for stat */
+ int saved_pid; /* process id */
+ int saved_ppid; /* pid of parent process */
+ unsigned long long saved_start_time; /* start time of process -- seconds since 1-1-70 */
+ unsigned long long saved_pstart_time; /* start time of parent process -- seconds since 1-1-70 */
+
+ if ((lxc_file2str(filename, sbuf, sizeof(sbuf))) == -1) {
+ SYSERROR("Failed to read pidfile %s", filename);
+ ret = -1;
+ goto out;
+ }
+
+ num = sscanf(sbuf, "%d %Lu %d %Lu", &saved_pid, &saved_start_time, &saved_ppid, &saved_pstart_time);
+ if (num != 4) {
+ SYSERROR("Call sscanf error");
+ ret = -1;
+ goto out;
+ }
+
+ if (pid != saved_pid || p_pid != saved_ppid
+ || start_at != saved_start_time || p_start_at != saved_pstart_time) {
+ ERROR("Check container info failed");
+ ret = -1;
+ goto out;
+ }
+
+out:
+ return ret;
+}
+
+/* isuald: save pid/ppid info */
+static int lxc_save_container_info(char *filename, pid_t pid)
+{
+ int ret = 0;
+ pid_t p_pid = 0;
+ unsigned long long start_at = 0;
+ unsigned long long p_start_at = 0;
+
+ start_at = lxc_get_process_startat(pid);
+ p_pid = getpid();
+ p_start_at = lxc_get_process_startat(p_pid);
+
+ ret = lxc_write_container_info(filename, pid, p_pid, start_at, p_start_at);
+ if (ret != 0) {
+ goto out;
+ }
+
+ ret = lxc_check_container_info(filename, pid, p_pid, start_at, p_start_at);
+ if (ret != 0) {
+ goto out;
+ }
+
+out:
+ return ret;
+}
+#endif
+
/* lxc_spawn() performs crucial setup tasks and clone()s the new process which
* exec()s the requested container binary.
* Note that lxc_spawn() runs in the parent namespaces. Any operations performed
@@ -1648,6 +1736,16 @@ static int lxc_spawn(struct lxc_handler *handler)
}
TRACE("Cloned child process %d", handler->pid);
+#ifdef HAVE_ISULAD
+ /* isulad: save pid/ppid info into file*/
+ if (handler->conf->container_info_file) {
+ if (lxc_save_container_info(handler->conf->container_info_file, handler->pid)) {
+ ERROR("Failed to save cloned container pid");
+ goto out_delete_net;
+ }
+ }
+#endif
+
/* Verify that we can actually make use of pidfds. */
if (!lxc_can_use_pidfd(handler->pidfd))
close_prot_errno_disarm(handler->pidfd);
diff --git a/src/lxc/tools/arguments.h b/src/lxc/tools/arguments.h
index cb0ba74..91f4e9a 100644
--- a/src/lxc/tools/arguments.h
+++ b/src/lxc/tools/arguments.h
@@ -40,6 +40,9 @@ struct lxc_arguments {
/* for lxc-start */
const char *share_ns[32]; /* size must be greater than LXC_NS_MAX */
+#ifdef HAVE_ISULAD
+ const char *container_info; /* isulad: file used to store pid and ppid info of container */
+#endif
/* for lxc-console */
unsigned int ttynum;
@@ -152,6 +155,19 @@ struct lxc_arguments {
#define OPT_SHARE_UTS OPT_USAGE - 5
#define OPT_SHARE_PID OPT_USAGE - 6
+#ifdef HAVE_ISULAD
+#define OPT_INPUT_FIFO OPT_USAGE - 7
+#define OPT_OUTPUT_FIFO OPT_USAGE - 8
+#define OPT_STDERR_FIFO OPT_USAGE - 9
+#define OPT_CONTAINER_INFO OPT_USAGE - 10
+#define OPT_EXIT_FIFO OPT_USAGE - 11
+#define OPT_START_TIMEOUT OPT_USAGE - 12
+#define OPT_DISABLE_PTY OPT_USAGE - 13
+#define OPT_OPEN_STDIN OPT_USAGE - 14
+#define OPT_ATTACH_TIMEOUT OPT_USAGE - 15
+#define OPT_ATTACH_SUFFIX OPT_USAGE - 16
+#endif
+
extern int lxc_arguments_parse(struct lxc_arguments *args, int argc,
char *const argv[]);
diff --git a/src/lxc/tools/lxc_start.c b/src/lxc/tools/lxc_start.c
index 459b867..83ee75a 100644
--- a/src/lxc/tools/lxc_start.c
+++ b/src/lxc/tools/lxc_start.c
@@ -48,6 +48,9 @@ static const struct option my_longopts[] = {
{"share-ipc", required_argument, 0, OPT_SHARE_IPC},
{"share-uts", required_argument, 0, OPT_SHARE_UTS},
{"share-pid", required_argument, 0, OPT_SHARE_PID},
+#ifdef HAVE_ISULAD
+ {"container-pidfile", required_argument, 0, OPT_CONTAINER_INFO},
+#endif
LXC_COMMON_OPTIONS
};
@@ -118,6 +121,11 @@ static int my_parser(struct lxc_arguments *args, int c, char *arg)
case OPT_SHARE_PID:
args->share_ns[LXC_NS_PID] = arg;
break;
+#ifdef HAVE_ISULAD
+ case OPT_CONTAINER_INFO:
+ args->container_info = arg;
+ break;
+#endif
}
return 0;
}
@@ -163,6 +171,9 @@ int main(int argc, char *argv[])
"/sbin/init",
NULL,
};
+#ifdef HAVE_ISULAD
+ char *container_info_file = NULL;
+#endif
lxc_list_init(&defines);
@@ -283,6 +294,20 @@ int main(int argc, char *argv[])
goto out;
}
+#ifdef HAVE_ISULAD
+ /* isulad: container info file used to store pid and ppid info of container*/
+ if (my_args.container_info != NULL) {
+ if (ensure_path(&container_info_file, my_args.container_info) < 0) {
+ ERROR("Failed to ensure container's piddile '%s'", my_args.container_info);
+ goto out;
+ }
+ if (!c->set_container_info_file(c, container_info_file)) {
+ ERROR("Failed to set container's piddile '%s'", container_info_file);
+ goto out;
+ }
+ }
+#endif
+
if (my_args.console)
if (!c->set_config_item(c, "lxc.console.path", my_args.console))
goto out;
@@ -320,5 +345,8 @@ int main(int argc, char *argv[])
out:
lxc_container_put(c);
+#ifdef HAVE_ISULAD
+ free(container_info_file);
+#endif
exit(err);
}
diff --git a/src/lxc/utils.c b/src/lxc/utils.c
index 160b3db..ebcdae0 100644
--- a/src/lxc/utils.c
+++ b/src/lxc/utils.c
@@ -1931,4 +1931,121 @@ void lxc_write_error_message(int errfd, const char *format, ...)
if (sret < 0)
SYSERROR("Write errbuf failed");
}
+
+/* isulad: read file to buffer */
+int lxc_file2str(const char *filename, char ret[], int cap)
+{
+ int fd, num_read;
+
+ if ((fd = lxc_open(filename, O_RDONLY | O_CLOEXEC, 0)) == -1)
+ return -1;
+ if ((num_read = read(fd, ret, cap - 1)) <= 0)
+ num_read = -1;
+ else
+ ret[num_read] = 0;
+ close(fd);
+
+ return num_read;
+}
+
+/* isuald: lxc_stat2proc() makes sure it can handle arbitrary executable file basenames
+ * for `cmd', i.e. those with embedded whitespace or embedded ')'s.
+ * Such names confuse %s (see scanf(3)), so the string is split and %39c
+ * is used instead. (except for embedded ')' "(%[^)]c)" would work.
+ */
+static proc_t *lxc_stat2proc(const char *S)
+{
+ int num;
+ proc_t *P = NULL;
+ char *tmp = NULL;
+
+ if (!S)
+ return NULL;
+
+ tmp = strrchr(S, ')'); /* split into "PID (cmd" and "<rest>" */
+ if (!tmp)
+ return NULL;
+ *tmp = '\0'; /* replace trailing ')' with NUL */
+
+ P = malloc(sizeof(proc_t));
+ if (P == NULL)
+ return NULL;
+ (void)memset(P, 0x00, sizeof(proc_t));
+
+ /* parse these two strings separately, skipping the leading "(". */
+ num = sscanf(S, "%d (%15c", &P->pid, P->cmd); /* comm[16] in kernel */
+ if (num != 2) {
+ ERROR("Call sscanf error: %s", errno ? strerror(errno) : "");
+ free(P);
+ return NULL;
+ }
+ num = sscanf(tmp + 2, /* skip space after ')' too */
+ "%c "
+ "%d %d %d %d %d "
+ "%lu %lu %lu %lu %lu "
+ "%Lu %Lu %Lu %Lu " /* utime stime cutime cstime */
+ "%ld %ld %ld %ld "
+ "%Lu " /* start_time */
+ "%lu "
+ "%ld "
+ "%lu %lu %lu %lu %lu %lu "
+ "%*s %*s %*s %*s " /* discard, no RT signals & Linux 2.1 used hex */
+ "%lu %lu %lu "
+ "%d %d "
+ "%lu %lu",
+ &P->state,
+ &P->ppid, &P->pgrp, &P->session, &P->tty, &P->tpgid,
+ &P->flags, &P->min_flt, &P->cmin_flt, &P->maj_flt, &P->cmaj_flt,
+ &P->utime, &P->stime, &P->cutime, &P->cstime,
+ &P->priority, &P->nice, &P->timeout, &P->it_real_value,
+ &P->start_time,
+ &P->vsize,
+ &P->rss,
+ &P->rss_rlim, &P->start_code, &P->end_code, &P->start_stack, &P->kstk_esp,
+ &P->kstk_eip,
+ &P->wchan, &P->nswap, &P->cnswap,
+ &P->exit_signal, &P->processor, /* 2.2.1 ends with "exit_signal" */
+ &P->rtprio, &P->sched /* both added to 2.5.18 */
+ );
+ if (num != 35) {
+ ERROR("Call sscanf error: %s", errno ? strerror(errno) : "");
+ free(P);
+ return NULL;
+ }
+ if (P->tty == 0)
+ P->tty = -1; /* the old notty val, update elsewhere bef. moving to 0 */
+ return P;
+}
+
+/* isulad: get starttime of process pid */
+unsigned long long lxc_get_process_startat(pid_t pid)
+{
+ int sret = 0;
+ unsigned long long startat = 0;
+ proc_t *pid_info = NULL;
+ char filename[PATH_MAX] = {0};
+ char sbuf[1024] = {0}; /* bufs for stat */
+
+ sret = snprintf(filename, sizeof(filename), "/proc/%d/stat", pid);
+ if (sret < 0 || sret >= sizeof(filename)) {
+ ERROR("Failed to sprintf filename");
+ goto out;
+ }
+
+ if ((lxc_file2str(filename, sbuf, sizeof(sbuf))) == -1) {
+ SYSERROR("Failed to read pidfile %s", filename);
+ goto out;
+ }
+
+ pid_info = lxc_stat2proc(sbuf);
+ if (!pid_info) {
+ ERROR("Failed to get proc stat info");
+ goto out;
+ }
+
+ startat = pid_info->start_time;
+out:
+ free(pid_info);
+ return startat;
+}
#endif
diff --git a/src/lxc/utils.h b/src/lxc/utils.h
index 3c30565..11d6548 100644
--- a/src/lxc/utils.h
+++ b/src/lxc/utils.h
@@ -44,6 +44,73 @@ extern char *get_rundir(void);
#endif
#endif
+#ifdef HAVE_ISULAD
+/* isulad:
+ ld cutime, cstime, priority, nice, timeout, it_real_value, rss,
+ c state,
+ d ppid, pgrp, session, tty, tpgid,
+ s signal, blocked, sigignore, sigcatch,
+ lu flags, min_flt, cmin_flt, maj_flt, cmaj_flt, utime, stime,
+ lu rss_rlim, start_code, end_code, start_stack, kstk_esp, kstk_eip,
+ lu start_time, vsize, wchan, nswap, cnswap,
+*/
+
+/* Basic data structure which holds all information we can get about a process.
+ * (unless otherwise specified, fields are read from /proc/#/stat)
+ *
+ * Most of it comes from task_struct in linux/sched.h
+ */
+typedef struct proc_t {
+ // 1st 16 bytes
+ int pid; /* process id */
+ int ppid; /* pid of parent process */
+
+ char state; /* single-char code for process state (S=sleeping) */
+
+ unsigned long long
+ utime, /* user-mode CPU time accumulated by process */
+ stime, /* kernel-mode CPU time accumulated by process */
+ // and so on...
+ cutime, /* cumulative utime of process and reaped children */
+ cstime, /* cumulative stime of process and reaped children */
+ start_time; /* start time of process -- seconds since 1-1-70 */
+
+ long
+ priority, /* kernel scheduling priority */
+ timeout, /* ? */
+ nice, /* standard unix nice level of process */
+ rss, /* resident set size from /proc/#/stat (pages) */
+ it_real_value; /* ? */
+ unsigned long
+ rtprio, /* real-time priority */
+ sched, /* scheduling class */
+ vsize, /* number of pages of virtual memory ... */
+ rss_rlim, /* resident set size limit? */
+ flags, /* kernel flags for the process */
+ min_flt, /* number of minor page faults since process start */
+ maj_flt, /* number of major page faults since process start */
+ cmin_flt, /* cumulative min_flt of process and child processes */
+ cmaj_flt, /* cumulative maj_flt of process and child processes */
+ nswap, /* ? */
+ cnswap, /* cumulative nswap ? */
+ start_code, /* address of beginning of code segment */
+ end_code, /* address of end of code segment */
+ start_stack, /* address of the bottom of stack for the process */
+ kstk_esp, /* kernel stack pointer */
+ kstk_eip, /* kernel instruction pointer */
+ wchan; /* address of kernel wait channel proc is sleeping in */
+
+ char cmd[16]; /* basename of executable file in call to exec(2) */
+ int
+ pgrp, /* process group id */
+ session, /* session id */
+ tty, /* full device number of controlling terminal */
+ tpgid, /* terminal process group id */
+ exit_signal, /* might not be SIGCHLD */
+ processor; /* current (or most recent?) CPU */
+} proc_t;
+#endif
+
static inline int lxc_set_cloexec(int fd)
{
return fcntl(fd, F_SETFD, FD_CLOEXEC);
@@ -246,6 +313,8 @@ extern int fix_stdio_permissions(uid_t uid);
#ifdef HAVE_ISULAD
extern void lxc_write_error_message(int errfd, const char *format, ...);
+extern int lxc_file2str(const char *filename, char ret[], int cap);
+extern int unsigned long long lxc_get_process_startat(pid_t pid);
#endif
#endif /* __LXC_UTILS_H */
--
1.8.3.1

331
0008-support-block-device-as-rootfs.patch
View File

@ -1,331 +0,0 @@
From 6792a7f76d9084734d94e815b462ed2977fe107e Mon Sep 17 00:00:00 2001
From: tanyifeng <tanyifeng1@huawei.com>
Date: Tue, 15 Jan 2019 16:00:30 +0800
Subject: [PATCH 08/49] support block device as rootfs
Signed-off-by: LiFeng <lifeng68@huawei.com>
Signed-off-by: WangFengTu <wangfengtu@huawei.com>
---
src/lxc/Makefile.am | 1 +
src/lxc/conf.c | 36 +++++++++++++++++
src/lxc/storage/block.c | 86 +++++++++++++++++++++++++++++++++++++++++
src/lxc/storage/block.h | 41 ++++++++++++++++++++
src/lxc/storage/dir.c | 14 ++++++-
src/lxc/storage/storage.c | 21 ++++++++++
src/lxc/storage/storage_utils.c | 4 ++
7 files changed, 202 insertions(+), 1 deletion(-)
create mode 100644 src/lxc/storage/block.c
create mode 100644 src/lxc/storage/block.h
diff --git a/src/lxc/Makefile.am b/src/lxc/Makefile.am
index 21441c0..d8c2492 100644
--- a/src/lxc/Makefile.am
+++ b/src/lxc/Makefile.am
@@ -139,6 +139,7 @@ liblxc_la_SOURCES = af_unix.c af_unix.h \
start.c start.h \
storage/btrfs.c storage/btrfs.h \
storage/dir.c storage/dir.h \
+ storage/block.c storage/block.h \
storage/loop.c storage/loop.h \
storage/lvm.c storage/lvm.h \
storage/nbd.c storage/nbd.h \
diff --git a/src/lxc/conf.c b/src/lxc/conf.c
index 43437af..35488e0 100644
--- a/src/lxc/conf.c
+++ b/src/lxc/conf.c
@@ -3383,6 +3383,36 @@ reset_umask:
INFO("Populated devices into container /dev");
return ret;
}
+
+// isulad: setup rootfs mountopts
+static int setup_rootfs_mountopts(const struct lxc_rootfs *rootfs)
+{
+ unsigned long mflags, mntflags, pflags;
+ char *mntdata;
+
+ if(!rootfs || !rootfs->options)
+ return 0;
+
+ if (parse_propagationopts(rootfs->options, &pflags) < 0) {
+ return -1;
+ }
+
+ if (parse_mntopts(rootfs->options, &mntflags, &mntdata) < 0) {
+ free(mntdata);
+ return -1;
+ }
+ free(mntdata);
+
+ if (mntflags & MS_RDONLY) {
+ mflags = add_required_remount_flags("/", NULL, MS_BIND | MS_REC | mntflags | pflags | MS_REMOUNT);
+ DEBUG("remounting /");
+ if (mount("/", "/", NULL, mflags, 0) < 0) {
+ SYSERROR("Failed to remount /");
+ return -1;
+ }
+ }
+ return 0;
+}
#endif
int lxc_setup(struct lxc_handler *handler)
@@ -3531,6 +3561,12 @@ int lxc_setup(struct lxc_handler *handler)
if (ret < 0)
return log_error(-1, "Failed to setup new devpts instance");
+#ifdef HAVE_ISULAD
+ if (setup_rootfs_mountopts(&lxc_conf->rootfs)) {
+ return log_error(-1, "failed to set rootfs for '%s'", name);
+ }
+#endif
+
ret = lxc_create_ttys(handler);
if (ret < 0)
return -1;
diff --git a/src/lxc/storage/block.c b/src/lxc/storage/block.c
new file mode 100644
index 0000000..eb75e70
--- /dev/null
+++ b/src/lxc/storage/block.c
@@ -0,0 +1,86 @@
+/*
+ * lxc: linux Container library
+ *
+ * (C) Copyright IBM Corp. 2007, 2008
+ *
+ * Authors:
+ * Daniel Lezcano <daniel.lezcano at free.fr>
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2.1 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
+ */
+
+#ifndef _GNU_SOURCE
+#define _GNU_SOURCE 1
+#endif
+#include <stdint.h>
+#include <string.h>
+
+#include "config.h"
+#include "log.h"
+#include "storage.h"
+#include "storage_utils.h"
+#include "utils.h"
+
+lxc_log_define(blk, lxc);
+
+int blk_destroy(struct lxc_storage *orig)
+{
+ return 0;
+}
+
+bool blk_detect(const char *path)
+{
+ struct stat statbuf;
+ int ret;
+
+ if (!strncmp(path, "blk:", 4))
+ return true;
+
+ ret = stat(path, &statbuf);
+ if (ret == -1 && errno == EPERM) {
+ SYSERROR("blk_detect: failed to look at \"%s\"", path);
+ return false;
+ }
+
+ if (ret == 0 && S_ISBLK(statbuf.st_mode))
+ return true;
+
+ return false;
+}
+
+int blk_mount(struct lxc_storage *bdev)
+{
+ const char *src;
+ if (strcmp(bdev->type, "blk"))
+ return -22;
+
+ if (!bdev->src || !bdev->dest)
+ return -22;
+
+ src = lxc_storage_get_path(bdev->src, bdev->type);
+
+ return mount_unknown_fs(src, bdev->dest, bdev->mntopts);
+}
+
+int blk_umount(struct lxc_storage *bdev)
+{
+ if (strcmp(bdev->type, "blk"))
+ return -22;
+
+ if (!bdev->src || !bdev->dest)
+ return -22;
+
+ return umount(bdev->dest);
+}
diff --git a/src/lxc/storage/block.h b/src/lxc/storage/block.h
new file mode 100644
index 0000000..2fa7565
--- /dev/null
+++ b/src/lxc/storage/block.h
@@ -0,0 +1,41 @@
+/*
+ * lxc: linux Container library
+ *
+ * (C) Copyright IBM Corp. 2007, 2008
+ *
+ * Authors:
+ * Daniel Lezcano <daniel.lezcano at free.fr>
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2.1 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
+ */
+
+#ifndef __LXC_BLK_H
+#define __LXC_BLK_H
+
+#include <stdbool.h>
+#include <stdint.h>
+
+struct lxc_storage;
+
+struct bdev_specs;
+
+struct lxc_conf;
+
+extern int blk_destroy(struct lxc_storage *orig);
+extern bool blk_detect(const char *path);
+extern int blk_mount(struct lxc_storage *bdev);
+extern int blk_umount(struct lxc_storage *bdev);
+
+#endif /* __LXC_BLK_H */
diff --git a/src/lxc/storage/dir.c b/src/lxc/storage/dir.c
index 18a10a4..b3dbbd0 100644
--- a/src/lxc/storage/dir.c
+++ b/src/lxc/storage/dir.c
@@ -127,7 +127,11 @@ bool dir_detect(const char *path)
int dir_mount(struct lxc_storage *bdev)
{
__do_free char *mntdata = NULL;
+#ifdef HAVE_ISULAD
+ unsigned long mntflags = 0, pflags = 0;
+#else
unsigned long mflags = 0, mntflags = 0, pflags = 0;
+#endif
int ret;
const char *src;
@@ -147,6 +151,13 @@ int dir_mount(struct lxc_storage *bdev)
src = lxc_storage_get_path(bdev->src, bdev->type);
+#ifdef HAVE_ISULAD
+ ret = mount(src, bdev->dest, "bind", MS_BIND | MS_REC | (mntflags & ~MS_RDONLY) | pflags, mntdata);
+ if (ret < 0) {
+ return log_error_errno(-errno, errno, "Failed to mount \"%s\" on \"%s\"", src, bdev->dest);
+ }
+ TRACE("Mounted \"%s\" on \"%s\"", src, bdev->dest);
+#else
ret = mount(src, bdev->dest, "bind", MS_BIND | MS_REC | mntflags | pflags, mntdata);
if (ret < 0)
return log_error_errno(-errno, errno, "Failed to mount \"%s\" on \"%s\"", src, bdev->dest);
@@ -161,9 +172,10 @@ int dir_mount(struct lxc_storage *bdev)
DEBUG("Remounted \"%s\" on \"%s\" read-only with options \"%s\", mount flags \"%lu\", and propagation flags \"%lu\"",
src ? src : "(none)", bdev->dest ? bdev->dest : "(none)", mntdata, mflags, pflags);
}
-
TRACE("Mounted \"%s\" on \"%s\" with options \"%s\", mount flags \"%lu\", and propagation flags \"%lu\"",
src ? src : "(none)", bdev->dest ? bdev->dest : "(none)", mntdata, mflags, pflags);
+#endif
+
return 0;
}
diff --git a/src/lxc/storage/storage.c b/src/lxc/storage/storage.c
index 3f1b713..876311a 100644
--- a/src/lxc/storage/storage.c
+++ b/src/lxc/storage/storage.c
@@ -41,6 +41,7 @@
#include "storage_utils.h"
#include "utils.h"
#include "zfs.h"
+#include "block.h"
#ifndef HAVE_STRLCPY
#include "include/strlcpy.h"
@@ -94,6 +95,22 @@ static const struct lxc_storage_ops loop_ops = {
.can_backup = true,
};
+#ifdef HAVE_ISULAD
+/* block */
+static const struct lxc_storage_ops blk_ops = {
+ .detect = &blk_detect,
+ .mount = &blk_mount,
+ .umount = &blk_umount,
+ .clone_paths = NULL,
+ .destroy = &blk_destroy,
+ .create = NULL,
+ .copy = NULL,
+ .snapshot = NULL,
+ .can_snapshot = false,
+ .can_backup = true,
+};
+#endif
+
/* lvm */
static const struct lxc_storage_ops lvm_ops = {
.detect = &lvm_detect,
@@ -179,6 +196,10 @@ static const struct lxc_storage_type bdevs[] = {
{ .name = "overlayfs", .ops = &ovl_ops, },
{ .name = "loop", .ops = &loop_ops, },
{ .name = "nbd", .ops = &nbd_ops, },
+#ifdef HAVE_ISULAD
+ //isulad: block device
+ { .name = "blk", .ops = &blk_ops, }
+#endif
};
static const size_t numbdevs = sizeof(bdevs) / sizeof(struct lxc_storage_type);
diff --git a/src/lxc/storage/storage_utils.c b/src/lxc/storage/storage_utils.c
index a3ee353..bfbb782 100644
--- a/src/lxc/storage/storage_utils.c
+++ b/src/lxc/storage/storage_utils.c
@@ -335,7 +335,11 @@ int find_fstype_cb(char *buffer, void *data)
return 0;
}
+#ifdef HAVE_ISULAD
+ if (mount(cbarg->rootfs, cbarg->target, fstype, (mntflags & ~MS_RDONLY), mntdata)) {
+#else
if (mount(cbarg->rootfs, cbarg->target, fstype, mntflags, mntdata)) {
+#endif
SYSDEBUG("Failed to mount");
free(mntdata);
return 0;
--
1.8.3.1

393
0009-support-mount-squashfs-in-mount-entry.patch
View File

@ -1,393 +0,0 @@
From 6124835dde5abfeeb8ac796813f2f18803b96117 Mon Sep 17 00:00:00 2001
From: tanyifeng <tanyifeng1@huawei.com>
Date: Tue, 15 Jan 2019 19:54:13 +0800
Subject: [PATCH 09/49] support mount squashfs in mount entry
Signed-off-by: LiFeng <lifeng68@huawei.com>
Signed-off-by: WangFengTu <wangfengtu@huawei.com>
---
src/lxc/conf.c | 95 +++++++++++++++++++++++++++++++++++++++--
src/lxc/storage/loop.c | 36 +++++++++++++---
src/lxc/storage/storage_utils.c | 36 +++++++++++++++-
src/lxc/utils.c | 35 ++++++++++++++-
src/lxc/utils.h | 1 +
5 files changed, 191 insertions(+), 12 deletions(-)
diff --git a/src/lxc/conf.c b/src/lxc/conf.c
index 35488e0..1f779b9 100644
--- a/src/lxc/conf.c
+++ b/src/lxc/conf.c
@@ -58,6 +58,7 @@
#include "storage/overlay.h"
#include "syscall_wrappers.h"
#include "terminal.h"
+#include "loop.h"
#include "utils.h"
#include "uuid.h"
@@ -2013,6 +2014,84 @@ static int mount_entry_create_dir_file(const struct mntent *mntent,
return 0;
}
+#ifdef HAVE_ISULAD
+static int mount_entry_with_loop_dev(const char *src, const char *dest, const char *fstype,
+ char *mnt_opts, const char *rootfs)
+{
+ int srcfd = -1, destfd, ret, saved_errno;
+ char srcbuf[50], destbuf[50]; // only needs enough for /proc/self/fd/<fd>
+ const char *mntsrc = src;
+ int max_retry = 5;
+ struct lxc_storage loop;
+
+ if (!rootfs)
+ rootfs = "";
+
+ /* todo - allow symlinks for relative paths if 'allowsymlinks' option is passed */
+ if (src && src[0] != '/') {
+ INFO("this is a relative mount");
+ srcfd = open_without_symlink(src, NULL);
+ if (srcfd < 0)
+ return srcfd;
+ ret = snprintf(srcbuf, sizeof(srcbuf), "/proc/self/fd/%d", srcfd);
+ if (ret < 0 || ret > sizeof(srcbuf)) {
+ close(srcfd);
+ ERROR("Failed to print string");
+ return -EINVAL;
+ }
+ mntsrc = srcbuf;
+ }
+
+ destfd = open_without_symlink(dest, rootfs);
+ if (destfd < 0) {
+ if (srcfd != -1) {
+ saved_errno = errno;
+ close(srcfd);
+ errno = saved_errno;
+ }
+ return destfd;
+ }
+
+ ret = snprintf(destbuf, sizeof(destbuf), "/proc/self/fd/%d", destfd);
+ if (ret < 0 || ret > sizeof(destbuf)) {
+ if (srcfd != -1)
+ close(srcfd);
+ close(destfd);
+ ERROR("Out of memory");
+ return -EINVAL;
+ }
+
+retry:
+ loop.src = (char *)mntsrc;
+ loop.dest = destbuf;
+ loop.mntopts = mnt_opts;
+ loop.type = "loop";
+ loop.lofd = -1;
+ ret = loop_mount(&loop);
+ if (ret < 0) {
+ /* If loop is used by other program, mount may fail. So
+ * we do retry to ensure mount ok */
+ if (max_retry > 0) {
+ max_retry--;
+ DEBUG("mount entry with loop dev failed, retry mount."
+ "retry count left %d", max_retry);
+ goto retry;
+ }
+ }
+ if (loop.lofd != -1)
+ close(loop.lofd);
+ if (srcfd != -1)
+ close(srcfd);
+ close(destfd);
+ if (ret < 0) {
+ SYSERROR("Failed to mount %s onto %s", src, dest);
+ return ret;
+ }
+
+ return 0;
+}
+#endif
+
/* rootfs, lxc_name, and lxc_path can be NULL when the container is created
* without a rootfs. */
static inline int mount_entry_on_generic(struct mntent *mntent,
@@ -2026,6 +2105,7 @@ static inline int mount_entry_on_generic(struct mntent *mntent,
char *rootfs_path = NULL;
int ret;
bool dev, optional, relative;
+ const char *dest = path;
optional = hasmntopt(mntent, "optional") != NULL;
dev = hasmntopt(mntent, "dev") != NULL;
@@ -2052,9 +2132,18 @@ static inline int mount_entry_on_generic(struct mntent *mntent,
if (ret < 0)
return ret;
- ret = mount_entry(mntent->mnt_fsname, path, mntent->mnt_type, mntflags,
- pflags, mntdata, optional, dev, relative, rootfs_path);
-
+#ifdef HAVE_ISULAD
+ // isulad: support squashfs
+ if (strcmp(mntent->mnt_type, "squashfs") == 0) {
+ ret = mount_entry_with_loop_dev(mntent->mnt_fsname, dest, mntent->mnt_type,
+ mntent->mnt_opts, rootfs_path);
+ } else {
+#endif
+ ret = mount_entry(mntent->mnt_fsname, dest, mntent->mnt_type, mntflags,
+ pflags, mntdata, optional, dev, relative, rootfs_path);
+#ifdef HAVE_ISULAD
+ }
+#endif
return ret;
}
diff --git a/src/lxc/storage/loop.c b/src/lxc/storage/loop.c
index eebc1b6..345be50 100644
--- a/src/lxc/storage/loop.c
+++ b/src/lxc/storage/loop.c
@@ -21,6 +21,7 @@
#include "memory_utils.h"
#include "storage.h"
#include "storage_utils.h"
+#include "lxclock.h"
#include "utils.h"
lxc_log_define(loop, lxc);
@@ -216,9 +217,11 @@ bool loop_detect(const char *path)
int loop_mount(struct lxc_storage *bdev)
{
- int ret, loopfd;
+ int ret = 0;
+ int loopfd, lret;
char loname[PATH_MAX];
const char *src;
+ struct lxc_lock *l = NULL;
if (strcmp(bdev->type, "loop"))
return -22;
@@ -226,13 +229,29 @@ int loop_mount(struct lxc_storage *bdev)
if (!bdev->src || !bdev->dest)
return -22;
+ /* isulad: do lock before mount, so we can avoid use loop which is used by
+ * other starting contianers */
+ l = lxc_newlock("mount_lock", "mount_lock");
+ if (!l) {
+ SYSERROR("create file lock error when mount fs");
+ return -1;
+ }
+
+ lret = lxclock(l, 0);
+ if (lret) {
+ SYSERROR("try to lock failed when mount fs");
+ ret = -1;
+ goto out;
+ }
+
/* skip prefix */
src = lxc_storage_get_path(bdev->src, bdev->type);
loopfd = lxc_prepare_loop_dev(src, loname, LO_FLAGS_AUTOCLEAR);
if (loopfd < 0) {
ERROR("Failed to prepare loop device for loop file \"%s\"", src);
- return -1;
+ ret = -1;
+ goto out;
}
DEBUG("Prepared loop device \"%s\"", loname);
@@ -241,14 +260,21 @@ int loop_mount(struct lxc_storage *bdev)
ERROR("Failed to mount rootfs \"%s\" on \"%s\" via loop device \"%s\"",
bdev->src, bdev->dest, loname);
close(loopfd);
- return -1;
+ ret = -1;
+ goto out;
}
bdev->lofd = loopfd;
DEBUG("Mounted rootfs \"%s\" on \"%s\" via loop device \"%s\"",
bdev->src, bdev->dest, loname);
-
- return 0;
+out:
+ lret = lxcunlock(l);
+ if (lret) {
+ SYSERROR("try to unlock failed when mount fs");
+ ret = -1;
+ }
+ lxc_putlock(l);
+ return ret;
}
int loop_umount(struct lxc_storage *bdev)
diff --git a/src/lxc/storage/storage_utils.c b/src/lxc/storage/storage_utils.c
index bfbb782..07eee22 100644
--- a/src/lxc/storage/storage_utils.c
+++ b/src/lxc/storage/storage_utils.c
@@ -259,10 +259,14 @@ int is_blktype(struct lxc_storage *b)
return 0;
}
+// isulad: recored error
+static char **mount_errors = NULL;
+
int mount_unknown_fs(const char *rootfs, const char *target,
const char *options)
{
size_t i;
+ char *errs = NULL;
int ret;
struct cbarg {
const char *rootfs;
@@ -291,15 +295,30 @@ int mount_unknown_fs(const char *rootfs, const char *target,
ret = lxc_file_for_each_line(fsfile[i], find_fstype_cb, &cbarg);
if (ret < 0) {
ERROR("Failed to parse \"%s\"", fsfile[i]);
+ lxc_free_array((void**)mount_errors, free);
+ mount_errors = NULL;
return -1;
}
- if (ret)
+ if (ret) {
+ lxc_free_array((void**)mount_errors, free);
+ mount_errors = NULL;
return 0;
+ }
+ }
+
+ if (mount_errors != NULL) {
+ errs = lxc_string_join("\n", (const char **)mount_errors, false);
+ if (errs == NULL) {
+ ERROR("failed to join mount errors");
+ }
}
- ERROR("Failed to determine FSType for \"%s\"", rootfs);
+ ERROR("Failed to determine FSType for \"%s\": %s", rootfs, errs ? errs : "unknown reason");
+ free(errs);
+ lxc_free_array((void**)mount_errors, free);
+ mount_errors = NULL;
return -1;
}
@@ -318,6 +337,8 @@ int find_fstype_cb(char *buffer, void *data)
unsigned long mntflags = 0;
char *mntdata = NULL;
char *fstype;
+ char mount_err[BUFSIZ] = {0};
+ int ret;
/* we don't try 'nodev' entries */
if (strstr(buffer, "nodev"))
@@ -342,6 +363,17 @@ int find_fstype_cb(char *buffer, void *data)
#endif
SYSDEBUG("Failed to mount");
free(mntdata);
+ // isulad: recored error
+ ret = snprintf(mount_err, BUFSIZ, "\t\tmount %s onto %s with FSType %s failed: %s",
+ cbarg->rootfs, cbarg->target, fstype, strerror(errno));
+ if (ret < 0 || (size_t)ret >= BUFSIZ) {
+ ERROR("failed to format output mount error");
+ return 0;
+ }
+
+ if (lxc_append_string(&mount_errors, mount_err) < 0) {
+ ERROR("failed to append mount error");
+ }
return 0;
}
diff --git a/src/lxc/utils.c b/src/lxc/utils.c
index ebcdae0..90113e0 100644
--- a/src/lxc/utils.c
+++ b/src/lxc/utils.c
@@ -27,6 +27,7 @@
#include <sys/types.h>
#include <sys/wait.h>
#include <unistd.h>
+#include <sys/sysmacros.h>
#include "config.h"
#include "log.h"
@@ -1008,7 +1009,7 @@ static int open_if_safe(int dirfd, const char *nextpath)
*
* Return an open fd for the path, or <0 on error.
*/
-static int open_without_symlink(const char *target, const char *prefix_skip)
+int open_without_symlink(const char *target, const char *prefix_skip)
{
int curlen = 0, dirfd, fulllen, i;
char *dup;
@@ -1425,6 +1426,9 @@ static int lxc_get_unused_loop_dev(char *name_loop)
{
int loop_nr, ret;
int fd_ctl = -1, fd_tmp = -1;
+ // isulad: retry and try mknod
+ int max_retry = 200;
+ bool try_mknod = true;
fd_ctl = open("/dev/loop-control", O_RDWR | O_CLOEXEC);
if (fd_ctl < 0) {
@@ -1441,9 +1445,35 @@ static int lxc_get_unused_loop_dev(char *name_loop)
ret = snprintf(name_loop, LO_NAME_SIZE, "/dev/loop%d", loop_nr);
if (ret < 0 || ret >= LO_NAME_SIZE)
goto on_error;
-
+retry:
fd_tmp = open(name_loop, O_RDWR | O_CLOEXEC);
if (fd_tmp < 0) {
+#if HAVE_ISULAD
+ /* Success of LOOP_CTL_GET_FREE doesn't mean /dev/loop$i is ready,
+ * we try to make node by ourself to avoid wait. */
+ if (try_mknod) {
+ /* Do not check result of mknod because LOOP_CTL_GET_FREE
+ * alse do mknod, so this mknod may fail as node already
+ * exist. If we can open the node without error, we can
+ * say that it's be created successfully.
+ *
+ * note: 7 is the major device number of loopback devices
+ * in kernel.
+ */
+ mknod(name_loop, S_IFBLK | 0640, makedev(7, loop_nr));
+ try_mknod = false;
+ goto retry;
+ }
+ /* we need to wait some time to make sure it's ready for open if
+ * it can't open even if we have already try to make node by ourself. */
+ if (max_retry > 0) {
+ max_retry--;
+ usleep(5000); /* 5 millisecond */
+ goto retry;
+ }
+ SYSERROR("Failed to open loop \"%s\"", name_loop);
+ goto on_error;
+#else
/* on Android loop devices are moved under /dev/block, give it a shot */
ret = snprintf(name_loop, LO_NAME_SIZE, "/dev/block/loop%d", loop_nr);
if (ret < 0 || ret >= LO_NAME_SIZE)
@@ -1452,6 +1482,7 @@ static int lxc_get_unused_loop_dev(char *name_loop)
fd_tmp = open(name_loop, O_RDWR | O_CLOEXEC);
if (fd_tmp < 0)
SYSERROR("Failed to open loop \"%s\"", name_loop);
+#endif
}
on_error:
diff --git a/src/lxc/utils.h b/src/lxc/utils.h
index 11d6548..fbb0d55 100644
--- a/src/lxc/utils.h
+++ b/src/lxc/utils.h
@@ -215,6 +215,7 @@ extern bool cgns_supported(void);
extern char *choose_init(const char *rootfs);
extern bool switch_to_ns(pid_t pid, const char *ns);
extern char *get_template_path(const char *t);
+extern int open_without_symlink(const char *target, const char *prefix_skip);
extern int safe_mount(const char *src, const char *dest, const char *fstype,
unsigned long flags, const void *data,
const char *rootfs);
--
1.8.3.1

3568
0010-IO-refact-terminal-progress.patch
View File

File diff suppressed because it is too large Load Diff

271
0011-add-exit-fifo-to-monitor-state-of-lxc-monitor.patch
View File

@ -1,271 +0,0 @@
From 5aee93396a979771f59d8accc4f4c168fd31b584 Mon Sep 17 00:00:00 2001
From: wujing <wujing50@huawei.com>
Date: Mon, 13 Apr 2020 06:32:37 -0400
Subject: [PATCH 11/49] add exit fifo to monitor state of lxc monitor
Signed-off-by: wujing <wujing50@huawei.com>
---
src/lxc/conf.c | 4 ++++
src/lxc/conf.h | 2 ++
src/lxc/lxccontainer.c | 30 ++++++++++++++++++++++++++++++
src/lxc/lxccontainer.h | 8 ++++++++
src/lxc/start.c | 20 ++++++++++++++++++++
src/lxc/start.h | 5 +++++
src/lxc/tools/arguments.h | 1 +
src/lxc/tools/lxc_start.c | 14 ++++++++++++++
8 files changed, 84 insertions(+)
diff --git a/src/lxc/conf.c b/src/lxc/conf.c
index 1487b73..a904348 100644
--- a/src/lxc/conf.c
+++ b/src/lxc/conf.c
@@ -2668,6 +2668,7 @@ struct lxc_conf *lxc_conf_init(void)
#ifdef HAVE_ISULAD
/* isulad add begin */
lxc_list_init(&new->populate_devs);
+ new->exit_fd = -1;
new->umask = 0027; /*default umask 0027*/
new->console.init_fifo[0] = NULL;
new->console.init_fifo[1] = NULL;
@@ -4097,6 +4098,9 @@ void lxc_conf_free(struct lxc_conf *conf)
free(conf->shmount.path_cont);
#ifdef HAVE_ISULAD
free(conf->container_info_file);
+ if (conf->exit_fd != -1) {
+ close(conf->exit_fd);
+ }
lxc_clear_init_args(conf);
lxc_clear_populate_devices(conf);
#endif
diff --git a/src/lxc/conf.h b/src/lxc/conf.h
index 23942ac..c5b70e1 100644
--- a/src/lxc/conf.h
+++ b/src/lxc/conf.h
@@ -430,6 +430,8 @@ struct lxc_conf {
mode_t umask; //umask value
char *container_info_file;
+
+ int exit_fd; /* exit fifo fd*/
#endif
};
diff --git a/src/lxc/lxccontainer.c b/src/lxc/lxccontainer.c
index 891fc62..64cde99 100644
--- a/src/lxc/lxccontainer.c
+++ b/src/lxc/lxccontainer.c
@@ -281,6 +281,11 @@ static void lxc_container_free(struct lxc_container *c)
free(c->config_path);
c->config_path = NULL;
+#ifdef HAVE_ISULAD
+ free(c->exit_fifo);
+ c->exit_fifo = NULL;
+#endif
+
free(c);
}
@@ -894,7 +899,11 @@ static bool do_lxcapi_start(struct lxc_container *c, int useinit, char * const a
NULL,
};
char **init_cmd = NULL;
+#ifdef HAVE_ISULAD
+ int keepfds[] = {-1, -1, -1, -1, -1};
+#else
int keepfds[3] = {-1, -1, -1};
+#endif
/* container does exist */
if (!c)
@@ -1091,6 +1100,19 @@ static bool do_lxcapi_start(struct lxc_container *c, int useinit, char * const a
}
}
+#ifdef HAVE_ISULAD
+ /* isulad: open exit fifo */
+ if (c->exit_fifo) {
+ conf->exit_fd = lxc_open(c->exit_fifo, O_WRONLY | O_NONBLOCK | O_CLOEXEC, 0);
+ if (conf->exit_fd < 0) {
+ ERROR("Failed to open exit fifo %s: %s.", c->exit_fifo, strerror(errno));
+ lxc_free_handler(handler);
+ ret = 1;
+ goto on_error;
+ }
+ }
+#endif
+
conf->reboot = REBOOT_NONE;
/* Unshare the mount namespace if requested */
@@ -1125,6 +1147,14 @@ reboot:
keepfds[0] = handler->conf->maincmd_fd;
keepfds[1] = handler->state_socket_pair[0];
keepfds[2] = handler->state_socket_pair[1];
+
+#ifdef HAVE_ISULAD
+ /* keep exit fifo fd */
+ if (conf->exit_fd >= 0) {
+ keepfds[3] = conf->exit_fd;
+ }
+#endif
+
ret = lxc_check_inherited(conf, c->daemonize, keepfds,
sizeof(keepfds) / sizeof(keepfds[0]));
if (ret < 0) {
diff --git a/src/lxc/lxccontainer.h b/src/lxc/lxccontainer.h
index 4a9ba13..fa9bd5e 100644
--- a/src/lxc/lxccontainer.h
+++ b/src/lxc/lxccontainer.h
@@ -107,6 +107,14 @@ struct lxc_container {
/*! Full path to configuration file */
char *config_path;
+#ifdef HAVE_ISULAD
+ /*! isulad:
+ * \private
+ * exit FIFO File to open used monitor the state of lxc monitor process.
+ */
+ char *exit_fifo;
+#endif
+
/*!
* \brief Determine if \c /var/lib/lxc/$name/config exists.
*
diff --git a/src/lxc/start.c b/src/lxc/start.c
index f5f9565..70e8282 100644
--- a/src/lxc/start.c
+++ b/src/lxc/start.c
@@ -681,6 +681,11 @@ struct lxc_handler *lxc_init_handler(const char *name, struct lxc_conf *conf,
handler->nsfd[i] = -EBADF;
handler->name = name;
+
+#ifdef HAVE_ISULAD
+ handler->exit_code = -1; /* isulad: record exit code of container */
+#endif
+
if (daemonize)
handler->transient_pid = lxc_raw_getpid();
else
@@ -953,6 +958,16 @@ void lxc_end(struct lxc_handler *handler)
*/
lxc_monitor_send_state(name, STOPPED, handler->lxcpath);
+#ifdef HAVE_ISULAD
+ /* isuald: write exit code to exit fifo */
+ if (handler->conf->exit_fd >= 0) {
+ ret = write(handler->conf->exit_fd, &handler->exit_code, sizeof(int));
+ if (ret != sizeof(int)) {
+ SYSERROR("Failed to write to exit code to exit fifo.");
+ }
+ }
+#endif
+
/* The command socket is closed so no one can acces the command
* socket anymore so there's no need to lock it.
*/
@@ -2127,10 +2142,15 @@ int __lxc_start(struct lxc_handler *handler, struct lxc_operations *ops,
#else
lxc_monitor_send_exit_code(name, status, handler->lxcpath);
#endif
+
lxc_error_set_and_log(handler->pid, status);
if (error_num)
*error_num = handler->exit_status;
+#ifdef HAVE_ISULAD
+ handler->exit_code = exit_code; /* record exit code */
+#endif
+
/* These are not the droids you are looking for. */
__private_goto1:
lxc_delete_network(handler);
diff --git a/src/lxc/start.h b/src/lxc/start.h
index 7e2371c..1368d0e 100644
--- a/src/lxc/start.h
+++ b/src/lxc/start.h
@@ -122,6 +122,11 @@ struct lxc_handler {
int exit_status;
struct cgroup_ops *cgroup_ops;
+
+#ifdef HAVE_ISULAD
+ int exit_code;/* isulad: record the exit code of container */
+#endif
+
};
struct execute_args {
diff --git a/src/lxc/tools/arguments.h b/src/lxc/tools/arguments.h
index 214949b..ea5f938 100644
--- a/src/lxc/tools/arguments.h
+++ b/src/lxc/tools/arguments.h
@@ -43,6 +43,7 @@ struct lxc_arguments {
#ifdef HAVE_ISULAD
const char *container_info; /* isulad: file used to store pid and ppid info of container */
char *terminal_fifos[3]; /* isulad add, fifos used to redirct stdin/out/err */
+ const char *exit_monitor_fifo; /* isulad: fifo used to monitor state of monitor process */
#endif
/* for lxc-console */
diff --git a/src/lxc/tools/lxc_start.c b/src/lxc/tools/lxc_start.c
index 4c4c820..8041f02 100644
--- a/src/lxc/tools/lxc_start.c
+++ b/src/lxc/tools/lxc_start.c
@@ -28,6 +28,10 @@
#include "confile.h"
#include "log.h"
+#ifdef HAVE_ISULAD
+#include "isulad_utils.h"
+#endif
+
lxc_log_define(lxc_start, lxc);
static int my_parser(struct lxc_arguments *args, int c, char *arg);
@@ -50,6 +54,7 @@ static const struct option my_longopts[] = {
{"share-pid", required_argument, 0, OPT_SHARE_PID},
#ifdef HAVE_ISULAD
{"container-pidfile", required_argument, 0, OPT_CONTAINER_INFO},
+ {"exit-fifo", required_argument, 0, OPT_EXIT_FIFO},
#endif
LXC_COMMON_OPTIONS
};
@@ -121,6 +126,7 @@ static int my_parser(struct lxc_arguments *args, int c, char *arg)
case OPT_SHARE_PID:
args->share_ns[LXC_NS_PID] = arg;
break;
+
#ifdef HAVE_ISULAD
case OPT_CONTAINER_INFO:
args->container_info = arg;
@@ -133,8 +139,11 @@ static int my_parser(struct lxc_arguments *args, int c, char *arg)
break;
case OPT_STDERR_FIFO:
args->terminal_fifos[2] = arg;
+ case OPT_EXIT_FIFO:
+ args->exit_monitor_fifo = arg;
break;
#endif
+
}
return 0;
}
@@ -315,8 +324,13 @@ int main(int argc, char *argv[])
goto out;
}
}
+
if (my_args.terminal_fifos[0] || my_args.terminal_fifos[1] || my_args.terminal_fifos[2]) {
c->set_terminal_init_fifos(c, my_args.terminal_fifos[0], my_args.terminal_fifos[1], my_args.terminal_fifos[2]);
+
+ /* isulad: fifo used to monitor state of monitor process */
+ if (my_args.exit_monitor_fifo != NULL) {
+ c->exit_fifo = safe_strdup(my_args.exit_monitor_fifo);
}
#endif
--
1.8.3.1

142
0012-Adapt-to-isulad-log.patch
View File

@ -1,142 +0,0 @@
From 74612254660138c0fe96290a6f1ae3c8e46295b8 Mon Sep 17 00:00:00 2001
From: haozi007 <liuhao27@huawei.com>
Date: Mon, 13 Apr 2020 16:44:17 +0800
Subject: [PATCH 12/49] Adapt to isulad log
Signed-off-by: haozi007 <liuhao27@huawei.com>
---
src/lxc/log.c | 58 ++++++++++++++++++++++++++++++++++++++++++++++-
src/lxc/tools/lxc_start.c | 2 ++
2 files changed, 59 insertions(+), 1 deletion(-)
diff --git a/src/lxc/log.c b/src/lxc/log.c
index 30d6773..9794582 100644
--- a/src/lxc/log.c
+++ b/src/lxc/log.c
@@ -55,6 +55,38 @@ static char *log_vmname = NULL;
lxc_log_define(log, lxc);
+#ifdef HAVE_ISULAD
+static inline const char *isulad_get_fifo_path(const char *file)
+{
+#define ISULAD_FIFO_PREFIX "fifo:"
+
+ if (strncmp(file, ISULAD_FIFO_PREFIX, strlen(ISULAD_FIFO_PREFIX)) == 0) {
+ return (file + strlen(ISULAD_FIFO_PREFIX));
+ }
+ return NULL;
+}
+
+static int isulad_open_fifo(const char *file_path)
+{
+#define LOG_FIFO_SIZE (1024 * 1024)
+ int fd;
+
+ fd = lxc_unpriv(open(file_path, O_RDWR | O_NONBLOCK | O_CLOEXEC, 0640));
+ if (fd == -1) {
+ fprintf(stderr, "Open fifo %s failed: %s\n", file_path, strerror(errno));
+ return -1;
+ }
+
+ if (fcntl(fd, F_SETPIPE_SZ, LOG_FIFO_SIZE) == -1) {
+ printf("Set fifo buffer size failed: %s", strerror(errno));
+ close(fd);
+ return -1;
+ }
+
+ return fd;
+}
+#endif
+
static int lxc_log_priority_to_syslog(int priority)
{
switch (priority) {
@@ -321,6 +353,12 @@ static int log_append_logfile(const struct lxc_log_appender *appender,
#endif
log_container_name = lxc_log_get_container_name();
+#ifdef HAVE_ISULAD
+ /* use isulad log format */
+ if (log_container_name != NULL && strlen(log_container_name) > 15) {
+ log_container_name = log_container_name + (strlen(log_container_name) - 15);
+ }
+#endif
if (fd_to_use < 0)
fd_to_use = lxc_log_fd;
@@ -333,9 +371,13 @@ static int log_append_logfile(const struct lxc_log_appender *appender,
return ret;
n = snprintf(buffer, sizeof(buffer),
+#if HAVE_ISULAD
+ "%15s %s %-8s %s - %s:%s:%d -",
+#else
"%s%s%s %s %-8s %s - %s:%s:%d - ",
log_prefix,
log_container_name ? " " : "",
+#endif
log_container_name ? log_container_name : "",
date_time,
lxc_log_priority_to_string(event->priority),
@@ -590,6 +632,13 @@ static int __lxc_log_set_file(const char *fname, int create_dirs)
return ret_errno(EINVAL);
}
+#ifdef HAVE_ISULAD
+ fname = isulad_get_fifo_path(fname);
+ if (fname == NULL) {
+ return ret_errno(EINVAL);
+ }
+#endif
+
#if USE_CONFIGPATH_LOGS
/* We don't build_dir for the default if the default is i.e.
* /var/lib/lxc/$container/$container.log.
@@ -599,7 +648,11 @@ static int __lxc_log_set_file(const char *fname, int create_dirs)
if (build_dir(fname))
return log_error_errno(-errno, errno, "Failed to create dir for log file \"%s\"", fname);
+#if HAVE_ISULAD
+ lxc_log_fd = isulad_open_fifo(fname);
+#else
lxc_log_fd = log_open(fname);
+#endif
if (lxc_log_fd < 0)
return lxc_log_fd;
@@ -695,7 +748,10 @@ int lxc_log_init(struct lxc_log *log)
if (lxc_log_fd >= 0) {
lxc_log_category_lxc.appender = &log_appender_logfile;
- lxc_log_category_lxc.appender->next = &log_appender_stderr;
+#ifdef HAVE_ISULAD
+ if (!lxc_quiet_specified && !log->quiet)
+#endif
+ lxc_log_category_lxc.appender->next = &log_appender_stderr;
}
return ret;
diff --git a/src/lxc/tools/lxc_start.c b/src/lxc/tools/lxc_start.c
index 8041f02..11ff15b 100644
--- a/src/lxc/tools/lxc_start.c
+++ b/src/lxc/tools/lxc_start.c
@@ -139,6 +139,7 @@ static int my_parser(struct lxc_arguments *args, int c, char *arg)
break;
case OPT_STDERR_FIFO:
args->terminal_fifos[2] = arg;
+ break;
case OPT_EXIT_FIFO:
args->exit_monitor_fifo = arg;
break;
@@ -327,6 +328,7 @@ int main(int argc, char *argv[])
if (my_args.terminal_fifos[0] || my_args.terminal_fifos[1] || my_args.terminal_fifos[2]) {
c->set_terminal_init_fifos(c, my_args.terminal_fifos[0], my_args.terminal_fifos[1], my_args.terminal_fifos[2]);
+ }
/* isulad: fifo used to monitor state of monitor process */
if (my_args.exit_monitor_fifo != NULL) {
--
1.8.3.1

143
0013-set-env-in-container.patch
View File

@ -1,143 +0,0 @@
From 01d666e795a2cce1d4968202a38c73e673c42e88 Mon Sep 17 00:00:00 2001
From: wujing <wujing50@huawei.com>
Date: Mon, 13 Apr 2020 07:04:20 -0400
Subject: [PATCH 13/49] set env in container
Signed-off-by: wujing <wujing50@huawei.com>
---
src/lxc/attach.c | 7 +++++++
src/lxc/start.c | 7 +++++++
src/lxc/tools/lxc_start.c | 4 ++--
src/lxc/utils.c | 39 +++++++++++++++++++++++++++++++++++++++
src/lxc/utils.h | 2 ++
5 files changed, 57 insertions(+), 2 deletions(-)
diff --git a/src/lxc/attach.c b/src/lxc/attach.c
index 78b4700..801dc27 100644
--- a/src/lxc/attach.c
+++ b/src/lxc/attach.c
@@ -779,6 +779,13 @@ static int attach_child_main(struct attach_clone_payload *payload)
else
new_gid = ns_root_gid;
+#ifdef HAVE_ISULAD
+ // isulad: set env home in container
+ if (lxc_setup_env_home(new_uid) < 0) {
+ goto on_error;
+ }
+#endif
+
if ((init_ctx->container && init_ctx->container->lxc_conf &&
init_ctx->container->lxc_conf->no_new_privs) ||
(options->attach_flags & LXC_ATTACH_NO_NEW_PRIVS)) {
diff --git a/src/lxc/start.c b/src/lxc/start.c
index 70e8282..17766bc 100644
--- a/src/lxc/start.c
+++ b/src/lxc/start.c
@@ -1381,6 +1381,13 @@ static int do_start(void *data)
if (new_gid == nsgid)
new_gid = LXC_INVALID_GID;
+#ifdef HAVE_ISULAD
+ // isulad: set env home in container
+ if (lxc_setup_env_home(new_uid) < 0) {
+ goto out_warn_father;
+ }
+#endif
+
/* Make sure that the processes STDIO is correctly owned by the user that we are switching to */
ret = fix_stdio_permissions(new_uid);
if (ret)
diff --git a/src/lxc/tools/lxc_start.c b/src/lxc/tools/lxc_start.c
index 11ff15b..76802df6 100644
--- a/src/lxc/tools/lxc_start.c
+++ b/src/lxc/tools/lxc_start.c
@@ -139,7 +139,7 @@ static int my_parser(struct lxc_arguments *args, int c, char *arg)
break;
case OPT_STDERR_FIFO:
args->terminal_fifos[2] = arg;
- break;
+ break;
case OPT_EXIT_FIFO:
args->exit_monitor_fifo = arg;
break;
@@ -328,7 +328,7 @@ int main(int argc, char *argv[])
if (my_args.terminal_fifos[0] || my_args.terminal_fifos[1] || my_args.terminal_fifos[2]) {
c->set_terminal_init_fifos(c, my_args.terminal_fifos[0], my_args.terminal_fifos[1], my_args.terminal_fifos[2]);
- }
+ }
/* isulad: fifo used to monitor state of monitor process */
if (my_args.exit_monitor_fifo != NULL) {
diff --git a/src/lxc/utils.c b/src/lxc/utils.c
index 90113e0..5b04fa4 100644
--- a/src/lxc/utils.c
+++ b/src/lxc/utils.c
@@ -28,6 +28,7 @@
#include <sys/wait.h>
#include <unistd.h>
#include <sys/sysmacros.h>
+#include <pwd.h>
#include "config.h"
#include "log.h"
@@ -2079,4 +2080,42 @@ out:
free(pid_info);
return startat;
}
+
+// isulad: set env home in container
+int lxc_setup_env_home(uid_t uid)
+{
+#define __PASSWD_FILE__ "/etc/passwd"
+ char *homedir = "/"; // default home dir is /
+ FILE *stream = NULL;
+ struct passwd pw, *pwbufp = NULL;
+ char buf[BUFSIZ];
+
+ stream = fopen_cloexec(__PASSWD_FILE__, "r");
+ if (stream == NULL) {
+ SYSWARN("Failed to open %s", __PASSWD_FILE__);
+ goto set_env;
+ }
+
+ while (fgetpwent_r(stream, &pw, buf, sizeof(buf), &pwbufp) == 0 && pwbufp != NULL) {
+ if (pwbufp->pw_uid == uid) {
+ homedir = pwbufp->pw_dir;
+ goto set_env;
+ }
+ }
+ WARN("User invalid, can not find user '%u'", uid);
+
+set_env:
+ if (stream)
+ fclose(stream);
+
+ // if we didn't configure HOME, set it based on uid
+ if (setenv("HOME", homedir, 0) < 0) {
+ SYSERROR("Unable to set env 'HOME'");
+ return -1;
+ }
+
+ NOTICE("Setted env 'HOME' to %s", homedir);
+ return 0;
+}
+
#endif
diff --git a/src/lxc/utils.h b/src/lxc/utils.h
index fbb0d55..677f632 100644
--- a/src/lxc/utils.h
+++ b/src/lxc/utils.h
@@ -316,6 +316,8 @@ extern int fix_stdio_permissions(uid_t uid);
extern void lxc_write_error_message(int errfd, const char *format, ...);
extern int lxc_file2str(const char *filename, char ret[], int cap);
extern int unsigned long long lxc_get_process_startat(pid_t pid);
+// set env home in container
+extern int lxc_setup_env_home(uid_t uid);
#endif
#endif /* __LXC_UTILS_H */
--
1.8.3.1

452
0014-exec-refact-attach-progress.patch
View File

@ -1,452 +0,0 @@
From 61b64be9ac4e5d46e9363bb605c7b2e14d0cd2a2 Mon Sep 17 00:00:00 2001
From: LiFeng <lifeng68@huawei.com>
Date: Mon, 13 Apr 2020 20:41:03 +0800
Subject: [PATCH 14/49] exec: refact attach progress
Signed-off-by: LiFeng <lifeng68@huawei.com>
---
src/lxc/attach.c | 2 +-
src/lxc/attach_options.h | 23 +++-
src/lxc/conf.h | 2 +
src/lxc/terminal.c | 27 ++++-
src/lxc/tools/arguments.h | 1 +
src/lxc/tools/lxc_attach.c | 273 +++++++++++++++++++++++++++++++++++++++++++++
6 files changed, 324 insertions(+), 4 deletions(-)
diff --git a/src/lxc/attach.c b/src/lxc/attach.c
index 801dc27..e66ca1c 100644
--- a/src/lxc/attach.c
+++ b/src/lxc/attach.c
@@ -1420,7 +1420,7 @@ int lxc_attach(struct lxc_container *container, lxc_attach_exec_t exec_function,
}
if (pid == 0) {
- if (options->attach_flags & LXC_ATTACH_TERMINAL) {
+ if (options->attach_flags & LXC_ATTACH_TERMINAL && terminal.tty_state) {
ret = pthread_sigmask(SIG_SETMASK,
&terminal.tty_state->oldmask, NULL);
if (ret < 0) {
diff --git a/src/lxc/attach_options.h b/src/lxc/attach_options.h
index 3a02ee5..7b0ea5e 100644
--- a/src/lxc/attach_options.h
+++ b/src/lxc/attach_options.h
@@ -116,10 +116,12 @@ typedef struct lxc_attach_options_t {
#ifdef HAVE_ISULAD
char *init_fifo[3]; /* isulad: default fifos for the start */
int64_t timeout;/* isulad: Seconds for waiting on a container to attach/exec before it is killed*/
+ const char *suffix;
#endif
} lxc_attach_options_t;
+#ifdef HAVE_ISULAD
/*! Default attach options to use */
#define LXC_ATTACH_OPTIONS_DEFAULT \
{ \
@@ -136,8 +138,27 @@ typedef struct lxc_attach_options_t {
/* .stdout_fd = */ 1, \
/* .stderr_fd = */ 2, \
/* .log_fd = */ -EBADF, \
+ /* .init_fifo = */ {NULL, NULL, NULL}, \
}
-
+#else
+/*! Default attach options to use */
+#define LXC_ATTACH_OPTIONS_DEFAULT \
+ { \
+ /* .attach_flags = */ LXC_ATTACH_DEFAULT, \
+ /* .namespaces = */ -1, \
+ /* .personality = */ -1, \
+ /* .initial_cwd = */ NULL, \
+ /* .uid = */ (uid_t)-1, \
+ /* .gid = */ (gid_t)-1, \
+ /* .env_policy = */ LXC_ATTACH_KEEP_ENV, \
+ /* .extra_env_vars = */ NULL, \
+ /* .extra_keep_env = */ NULL, \
+ /* .stdin_fd = */ 0, \
+ /* .stdout_fd = */ 1, \
+ /* .stderr_fd = */ 2, \
+ /* .log_fd = */ -EBADF, \
+ }
+#endif
/*!
* Representation of a command to run in a container.
*/
diff --git a/src/lxc/conf.h b/src/lxc/conf.h
index c5b70e1..52460a3 100644
--- a/src/lxc/conf.h
+++ b/src/lxc/conf.h
@@ -432,6 +432,8 @@ struct lxc_conf {
char *container_info_file;
int exit_fd; /* exit fifo fd*/
+
+ char *errmsg; /* record error messages */
#endif
};
diff --git a/src/lxc/terminal.c b/src/lxc/terminal.c
index c8cd83f..775743d 100644
--- a/src/lxc/terminal.c
+++ b/src/lxc/terminal.c
@@ -1174,8 +1174,25 @@ static int lxc_terminal_peer_default(struct lxc_terminal *terminal)
if (terminal->path)
path = terminal->path;
- else
- path = "/dev/tty";
+
+#ifdef HAVE_ISULAD
+ /* isulad: if no console was given, try current controlling terminal, there
+ * won't be one if we were started as a daemon (-d)
+ */
+ if (!path && !access("/dev/tty", F_OK)) {
+ int fd;
+ fd = open("/dev/tty", O_RDWR);
+ if (fd >= 0) {
+ close(fd);
+ path = "/dev/tty";
+ }
+ }
+
+ if (!path) {
+ DEBUG("Not have a controlling terminal");
+ return 0;
+ }
+#endif
terminal->peer = lxc_unpriv(open(path, O_RDWR | O_CLOEXEC));
if (terminal->peer < 0) {
@@ -1884,9 +1901,15 @@ int lxc_terminal_prepare_login(int fd)
if (ret < 0)
return -1;
+#ifdef HAVE_ISULAD
+ ret = set_stdfds(fd);
+ if (ret < 0)
+ return -1;
+#else
ret = lxc_terminal_set_stdfds(fd);
if (ret < 0)
return -1;
+#endif
if (fd > STDERR_FILENO)
close(fd);
diff --git a/src/lxc/tools/arguments.h b/src/lxc/tools/arguments.h
index ea5f938..e0866d6 100644
--- a/src/lxc/tools/arguments.h
+++ b/src/lxc/tools/arguments.h
@@ -44,6 +44,7 @@ struct lxc_arguments {
const char *container_info; /* isulad: file used to store pid and ppid info of container */
char *terminal_fifos[3]; /* isulad add, fifos used to redirct stdin/out/err */
const char *exit_monitor_fifo; /* isulad: fifo used to monitor state of monitor process */
+ const char *suffix; /* isulad add, suffix used for connect with parent of execed process*/
#endif
/* for lxc-console */
diff --git a/src/lxc/tools/lxc_attach.c b/src/lxc/tools/lxc_attach.c
index a8f493a..47ac2f2 100644
--- a/src/lxc/tools/lxc_attach.c
+++ b/src/lxc/tools/lxc_attach.c
@@ -74,6 +74,12 @@ static const struct option my_longopts[] = {
{"rcfile", required_argument, 0, 'f'},
{"uid", required_argument, 0, 'u'},
{"gid", required_argument, 0, 'g'},
+#ifdef HAVE_ISULAD
+ {"in-fifo", required_argument, 0, OPT_INPUT_FIFO}, /* isulad add terminal fifos*/
+ {"out-fifo", required_argument, 0, OPT_OUTPUT_FIFO},
+ {"err-fifo", required_argument, 0, OPT_STDERR_FIFO},
+ {"suffix", required_argument, 0, OPT_ATTACH_SUFFIX},
+#endif
LXC_COMMON_OPTIONS
};
@@ -201,6 +207,20 @@ static int my_parser(struct lxc_arguments *args, int c, char *arg)
if (lxc_safe_uint(arg, &args->gid) < 0)
return -1;
break;
+#ifdef HAVE_ISULAD
+ case OPT_INPUT_FIFO:
+ args->terminal_fifos[0] = arg;
+ break;
+ case OPT_OUTPUT_FIFO:
+ args->terminal_fifos[1] = arg;
+ break;
+ case OPT_STDERR_FIFO:
+ args->terminal_fifos[2] = arg;
+ break;
+ case OPT_ATTACH_SUFFIX:
+ args->suffix = arg;
+ break;
+#endif
}
return 0;
@@ -264,6 +284,258 @@ static int lxc_attach_create_log_file(const char *log_file)
return fd;
}
+#ifdef HAVE_ISULAD
+// isulad: send '128 + signal' if container is killed by signal.
+#define ExitSignalOffset 128
+
+/*isulad: attach with terminal*/
+static int do_attach_foreground(struct lxc_container *c, lxc_attach_command_t *command,
+ lxc_attach_options_t *attach_options,
+ char **errmsg)
+{
+ int ret = 0;
+ pid_t pid;
+ int wexit = -1;
+ int signal;
+
+ if (command->program)
+ ret = c->attach(c, lxc_attach_run_command, command, attach_options, &pid);
+ else
+ ret = c->attach(c, lxc_attach_run_shell, NULL, attach_options, &pid);
+ if (ret < 0)
+ goto out;
+
+ ret = lxc_wait_for_pid_status(pid);
+ if (ret < 0)
+ goto out;
+
+ if (WIFEXITED(ret))
+ wexit = WEXITSTATUS(ret);
+ else
+ wexit = -1;
+
+ if (WIFSIGNALED(ret)) {
+ signal = WTERMSIG(ret);
+ wexit = ExitSignalOffset + signal;
+ }
+out:
+ if (c->lxc_conf->errmsg)
+ *errmsg = safe_strdup(c->lxc_conf->errmsg);
+ return wexit;
+}
+
+static void close_msg_pipe(int *errpipe)
+{
+ if (errpipe[0] >= 0) {
+ close(errpipe[0]);
+ errpipe[0] = -1;
+ }
+ if (errpipe[1] >= 0) {
+ close(errpipe[1]);
+ errpipe[1] = -1;
+ }
+}
+
+/*isulad: attach without terminal in background */
+static int do_attach_background(struct lxc_container *c, lxc_attach_command_t *command,
+ lxc_attach_options_t *attach_options,
+ char **errmsg)
+{
+ int ret = 0;
+ int msgpipe[2];
+ pid_t pid = 0;
+ ssize_t size_read;
+ char msgbuf[BUFSIZ + 1] = {0};
+
+ //pipdfd for get error message of child or grandchild process.
+ if (pipe2(msgpipe, O_CLOEXEC) != 0) {
+ SYSERROR("Failed to init msgpipe");
+ return -1;
+ }
+
+ pid = fork();
+ if (pid < 0) {
+ close_msg_pipe(msgpipe);
+ return -1;
+ }
+
+ if (pid != 0) {
+ close(msgpipe[1]);
+ msgpipe[1] = -1;
+ size_read = read(msgpipe[0], msgbuf, BUFSIZ);
+ if (size_read > 0) {
+ *errmsg = safe_strdup(msgbuf);
+ ret = -1;
+ }
+
+ close(msgpipe[0]);
+ msgpipe[0] = -1;
+
+ return ret;
+ }
+
+ /* second fork to be reparented by init */
+ pid = fork();
+ if (pid < 0) {
+ SYSERROR("Error doing dual-fork");
+ close_msg_pipe(msgpipe);
+ exit(1);
+ }
+ if (pid != 0) {
+ close_msg_pipe(msgpipe);
+ exit(0);
+ }
+
+ close(msgpipe[0]);
+ msgpipe[0] = -1;
+
+ if (null_stdfds() < 0) {
+ ERROR("failed to close fds");
+ exit(1);
+ }
+ setsid();
+
+ if (command->program)
+ ret = c->attach(c, lxc_attach_run_command, command, attach_options, &pid);
+ else
+ ret = c->attach(c, lxc_attach_run_shell, NULL, attach_options, &pid);
+ if (ret < 0) {
+ if (c->lxc_conf->errmsg)
+ lxc_write_error_message(msgpipe[1], "%s", c->lxc_conf->errmsg);
+ else
+ lxc_write_error_message(msgpipe[1], "Failed to attach container");
+ close(msgpipe[1]);
+ msgpipe[1] = -1;
+ ret = -1;
+ goto out;
+ }
+
+ close(msgpipe[1]);
+ msgpipe[1] = -1;
+
+ ret = wait_for_pid(pid);
+out:
+ lxc_container_put(c);
+ if (ret)
+ exit(EXIT_FAILURE);
+ else
+ exit(0);
+}
+
+int main(int argc, char *argv[])
+{
+ int ret = -1;
+ int wexit = 0;
+ struct lxc_log log;
+ char *errmsg = NULL;
+ pid_t pid;
+ lxc_attach_options_t attach_options = LXC_ATTACH_OPTIONS_DEFAULT;
+ lxc_attach_command_t command = (lxc_attach_command_t){.program = NULL};
+
+ if (lxc_caps_init())
+ exit(EXIT_FAILURE);
+
+ if (lxc_arguments_parse(&my_args, argc, argv))
+ exit(EXIT_FAILURE);
+
+ log.name = my_args.name;
+ log.file = my_args.log_file;
+ log.level = my_args.log_priority;
+ log.prefix = my_args.progname;
+ log.quiet = my_args.quiet;
+ log.lxcpath = my_args.lxcpath[0];
+
+ if (lxc_log_init(&log))
+ exit(EXIT_FAILURE);
+
+ if (geteuid())
+ if (access(my_args.lxcpath[0], O_RDONLY) < 0) {
+ ERROR("You lack access to %s", my_args.lxcpath[0]);
+ exit(EXIT_FAILURE);
+ }
+
+ struct lxc_container *c = lxc_container_new(my_args.name, my_args.lxcpath[0]);
+ if (!c)
+ exit(EXIT_FAILURE);
+
+ if (my_args.rcfile) {
+ c->clear_config(c);
+ if (!c->load_config(c, my_args.rcfile)) {
+ ERROR("Failed to load rcfile");
+ lxc_container_put(c);
+ exit(EXIT_FAILURE);
+ }
+
+ c->configfile = strdup(my_args.rcfile);
+ if (!c->configfile) {
+ ERROR("Out of memory setting new config filename");
+ lxc_container_put(c);
+ exit(EXIT_FAILURE);
+ }
+ }
+
+ if (!c->may_control(c)) {
+ ERROR("Insufficent privileges to control %s", c->name);
+ lxc_container_put(c);
+ exit(EXIT_FAILURE);
+ }
+
+ if (remount_sys_proc)
+ attach_options.attach_flags |= LXC_ATTACH_REMOUNT_PROC_SYS;
+
+ if (elevated_privileges)
+ attach_options.attach_flags &= ~(elevated_privileges);
+
+ if (my_args.terminal_fifos[0] || my_args.terminal_fifos[1] || my_args.terminal_fifos[2]) {
+ attach_options.init_fifo[0] = my_args.terminal_fifos[0];
+ attach_options.init_fifo[1] = my_args.terminal_fifos[1];
+ attach_options.init_fifo[2] = my_args.terminal_fifos[2];
+ attach_options.attach_flags |= LXC_ATTACH_TERMINAL;
+ } else if (stdfd_is_pty()) {
+ attach_options.attach_flags |= LXC_ATTACH_TERMINAL;
+ }
+
+ attach_options.namespaces = namespace_flags;
+ attach_options.personality = new_personality;
+ attach_options.env_policy = env_policy;
+ attach_options.extra_env_vars = extra_env;
+ attach_options.extra_keep_env = extra_keep;
+
+ if (my_args.argc > 0) {
+ command.program = my_args.argv[0];
+ command.argv = (char**)my_args.argv;
+ }
+
+ if (my_args.console_log) {
+ attach_options.log_fd = lxc_attach_create_log_file(my_args.console_log);
+ if (attach_options.log_fd < 0) {
+ ERROR("Failed to create log file for %s", c->name);
+ lxc_container_put(c);
+ exit(EXIT_FAILURE);
+ }
+ }
+
+ attach_options.suffix = my_args.suffix;
+
+ /* isulad: add do attach background */
+ if (attach_options.attach_flags & LXC_ATTACH_TERMINAL)
+ wexit = do_attach_foreground(c, &command, &attach_options, &errmsg);
+ else
+ wexit = do_attach_background(c, &command, &attach_options, &errmsg);
+
+ if (errmsg) {
+ fprintf(stderr, "%s:%s:%s:%d starting container process caused \"%s\"", c->name,
+ __FILE__, __func__, __LINE__, errmsg);
+ free(errmsg);
+ }
+
+ lxc_container_put(c);
+ if (wexit >= 0)
+ exit(wexit);
+
+ exit(EXIT_FAILURE);
+}
+#else
int main(int argc, char *argv[])
{
int ret = -1;
@@ -377,3 +649,4 @@ out:
exit(EXIT_FAILURE);
}
+#endif
--
1.8.3.1

357
0015-add-masked-paths-and-readonly-paths.patch
View File

@ -1,357 +0,0 @@
From c5ea37649d728630df34e1af22908b8e8124f772 Mon Sep 17 00:00:00 2001
From: wujing <wujing50@huawei.com>
Date: Mon, 13 Apr 2020 09:11:21 -0400
Subject: [PATCH 15/49] add masked paths and readonly paths
Signed-off-by: wujing <wujing50@huawei.com>
---
src/lxc/conf.c | 139 +++++++++++++++++++++++++++++++++++++++++++++++++++++-
src/lxc/conf.h | 12 +++++
src/lxc/confile.c | 106 +++++++++++++++++++++++++++++++++++++++++
3 files changed, 256 insertions(+), 1 deletion(-)
diff --git a/src/lxc/conf.c b/src/lxc/conf.c
index a904348..fce241b 100644
--- a/src/lxc/conf.c
+++ b/src/lxc/conf.c
@@ -1275,6 +1275,96 @@ static int lxc_mount_rootfs(struct lxc_conf *conf)
return 0;
}
+#ifdef HAVE_ISULAD
+// maskPath masks the top of the specified path inside a container to avoid
+// security issues from processes reading information from non-namespace aware
+// mounts ( proc/kcore ).
+static bool mask_path(const char *path)
+{
+ int ret;
+
+ if (!path)
+ return true;
+
+ ret = mount("/dev/null", path, "", MS_BIND, "");
+ if (ret < 0 && errno != ENOENT) {
+ if (errno == ENOTDIR) {
+ ret = mount("tmpfs", path, "tmpfs", MS_RDONLY, "");
+ if (ret < 0)
+ goto error;
+ return true;
+ }
+ goto error;
+ }
+ return true;
+
+error:
+ SYSERROR("Failed to mask path \"%s\": %s", path, strerror(errno));
+ return false;
+}
+
+// remount_readonly will bind over the top of an existing path and ensure that it is read-only.
+static bool remount_readonly(const char *path)
+{
+ int ret, i;
+
+ if (!path)
+ return true;
+
+ for (i = 0; i < 5; i++) {
+ ret = mount("", path, "", MS_REMOUNT | MS_RDONLY, "");
+ if (ret < 0 && errno != ENOENT) {
+ if (errno == EINVAL) {
+ // Probably not a mountpoint, use bind-mount
+ ret = mount(path, path, "", MS_BIND, "");
+ if (ret < 0)
+ goto on_error;
+ ret = mount(path, path, "", MS_BIND | MS_REMOUNT | MS_RDONLY | MS_REC | \
+ MS_NOEXEC | MS_NOSUID | MS_NODEV, "");
+ if (ret < 0)
+ goto on_error;
+ } else if (errno == EBUSY) {
+ DEBUG("Try to mount \"%s\" to readonly after 100ms.", path);
+ usleep(100 * 1000);
+ continue;
+ } else {
+ goto on_error;
+ }
+ }
+ return true;
+ }
+
+on_error:
+ SYSERROR("Unable to mount \"%s\" to readonly", path);
+ return false;
+}
+
+// isulad: setup rootfs masked paths
+static int setup_rootfs_maskedpaths(struct lxc_list *maskedpaths)
+{
+ struct lxc_list *it;
+
+ lxc_list_for_each(it, maskedpaths) {
+ if (!mask_path((char *)it->elem))
+ return -1;
+ }
+
+ return 0;
+}
+// isulad: setup rootfs ro paths
+static int setup_rootfs_ropaths(struct lxc_list *ropaths)
+{
+ struct lxc_list *it;
+
+ lxc_list_for_each(it, ropaths) {
+ if (!remount_readonly((char *)it->elem))
+ return -1;
+ }
+
+ return 0;
+}
+#endif
+
int lxc_chroot(const struct lxc_rootfs *rootfs)
{
__do_free char *nroot = NULL;
@@ -2666,8 +2756,9 @@ struct lxc_conf *lxc_conf_init(void)
seccomp_conf_init(new);
#ifdef HAVE_ISULAD
- /* isulad add begin */
lxc_list_init(&new->populate_devs);
+ lxc_list_init(&new->rootfs.maskedpaths);
+ lxc_list_init(&new->rootfs.ropaths);
new->exit_fd = -1;
new->umask = 0027; /*default umask 0027*/
new->console.init_fifo[0] = NULL;
@@ -3690,6 +3781,22 @@ int lxc_setup(struct lxc_handler *handler)
return log_error(-1, "Failed to setup sysctl parameters");
}
+#ifdef HAVE_ISULAD
+ // isulad: setup rootfs masked paths
+ if (!lxc_list_empty(&lxc_conf->rootfs.maskedpaths)) {
+ if (setup_rootfs_maskedpaths(&lxc_conf->rootfs.maskedpaths)) {
+ return log_error(-1, "failed to setup maskedpaths");
+ }
+ }
+
+ // isulad: setup rootfs ro paths
+ if (!lxc_list_empty(&lxc_conf->rootfs.ropaths)) {
+ if (setup_rootfs_ropaths(&lxc_conf->rootfs.ropaths)) {
+ return log_error(-1, "failed to setup readonlypaths");
+ }
+ }
+#endif
+
if (!lxc_list_empty(&lxc_conf->keepcaps)) {
if (!lxc_list_empty(&lxc_conf->caps))
return log_error(-1, "Container requests lxc.cap.drop and lxc.cap.keep: either use lxc.cap.drop or lxc.cap.keep, not both");
@@ -4103,6 +4210,8 @@ void lxc_conf_free(struct lxc_conf *conf)
}
lxc_clear_init_args(conf);
lxc_clear_populate_devices(conf);
+ lxc_clear_rootfs_masked_paths(conf);
+ lxc_clear_rootfs_ro_paths(conf);
#endif
free(conf);
}
@@ -4945,4 +5054,32 @@ int lxc_clear_populate_devices(struct lxc_conf *c)
return 0;
}
+/*isulad: clear rootfs masked paths*/
+int lxc_clear_rootfs_masked_paths(struct lxc_conf *c)
+{
+ struct lxc_list *it = NULL;
+ struct lxc_list *next = NULL;
+
+ lxc_list_for_each_safe(it, &c->rootfs.maskedpaths, next) {
+ lxc_list_del(it);
+ free(it->elem);
+ free(it);
+ }
+ return 0;
+}
+
+/*isulad: clear rootfs ro paths*/
+int lxc_clear_rootfs_ro_paths(struct lxc_conf *c)
+{
+ struct lxc_list *it = NULL;
+ struct lxc_list *next = NULL;
+
+ lxc_list_for_each_safe(it, &c->rootfs.ropaths, next) {
+ lxc_list_del(it);
+ free(it->elem);
+ free(it);
+ }
+ return 0;
+}
+
#endif
diff --git a/src/lxc/conf.h b/src/lxc/conf.h
index 52460a3..482fe0d 100644
--- a/src/lxc/conf.h
+++ b/src/lxc/conf.h
@@ -143,6 +143,8 @@ struct lxc_tty_info {
* @mountflags : the portion of @options that are flags
* @data : the portion of @options that are not flags
* @managed : whether it is managed by LXC
+ * @maskedpaths: A list of paths to be msked over inside the container
+ * @ropaths : A list of paths to be remounted with readonly inside the container
*/
struct lxc_rootfs {
char *path;
@@ -152,6 +154,14 @@ struct lxc_rootfs {
unsigned long mountflags;
char *data;
bool managed;
+
+#ifdef HAVE_ISULAD
+ /* isulad: maskedpaths */
+ struct lxc_list maskedpaths;
+ /* isulad: ropaths */
+ struct lxc_list ropaths;
+#endif
+
};
/*
@@ -511,5 +521,7 @@ extern int userns_exec_minimal(const struct lxc_conf *conf,
#ifdef HAVE_ISULAD
int lxc_clear_init_args(struct lxc_conf *lxc_conf);
int lxc_clear_populate_devices(struct lxc_conf *c);
+int lxc_clear_rootfs_masked_paths(struct lxc_conf *c);
+int lxc_clear_rootfs_ro_paths(struct lxc_conf *c);
#endif
#endif /* __LXC_CONF_H */
diff --git a/src/lxc/confile.c b/src/lxc/confile.c
index 2df269a..bf0fdf0 100644
--- a/src/lxc/confile.c
+++ b/src/lxc/confile.c
@@ -151,6 +151,8 @@ lxc_config_define(proc);
lxc_config_define(init_args);
lxc_config_define(populate_device);
lxc_config_define(umask);
+lxc_config_define(rootfs_masked_paths);
+lxc_config_define(rootfs_ro_paths);
#endif
/*
@@ -268,6 +270,8 @@ static struct lxc_config_t config_jump_table[] = {
{ "lxc.isulad.init.args", set_config_init_args, get_config_init_args, clr_config_init_args, },
{ "lxc.isulad.populate.device", set_config_populate_device, get_config_populate_device, clr_config_populate_device, },
{ "lxc.isulad.umask", set_config_umask, get_config_umask, clr_config_umask, },
+ { "lxc.isulad.rootfs.maskedpaths", set_config_rootfs_masked_paths, get_config_rootfs_masked_paths, clr_config_rootfs_masked_paths, },
+ { "lxc.isulad.rootfs.ropaths", set_config_rootfs_ro_paths, get_config_rootfs_ro_paths, clr_config_rootfs_ro_paths, },
#endif
};
@@ -6311,4 +6315,106 @@ static inline int clr_config_umask(const char *key, struct lxc_conf *c,
return 0;
}
+/* isulad: set config for rootfs masked paths */
+static int set_config_rootfs_masked_paths(const char *key, const char *value,
+ struct lxc_conf *lxc_conf, void *data)
+{
+ struct lxc_list *list_item = NULL;
+
+ if (lxc_config_value_empty(value))
+ return lxc_clear_rootfs_masked_paths(lxc_conf);
+
+ list_item = malloc(sizeof(*list_item));
+ if (list_item == NULL)
+ goto on_error;
+
+ list_item->elem = safe_strdup(value);
+
+ lxc_list_add_tail(&lxc_conf->rootfs.maskedpaths, list_item);
+
+ return 0;
+
+on_error:
+ free(list_item);
+
+ return -1;
+}
+
+// isulad: get config rootfs masked paths
+static int get_config_rootfs_masked_paths(const char *key, char *retv, int inlen,
+ struct lxc_conf *c, void *data)
+{
+ int len, fulllen = 0;
+ struct lxc_list *it = NULL;
+
+ if (!retv)
+ inlen = 0;
+ else
+ memset(retv, 0, inlen);
+
+ lxc_list_for_each(it, &c->rootfs.maskedpaths) {
+ strprint(retv, inlen, "%s\n", (char *)it->elem);
+ }
+
+ return fulllen;
+}
+
+/* isulad: set config for rootfs ro paths */
+static int set_config_rootfs_ro_paths(const char *key, const char *value,
+ struct lxc_conf *lxc_conf, void *data)
+{
+ struct lxc_list *list_item = NULL;
+
+ if (lxc_config_value_empty(value))
+ return lxc_clear_rootfs_ro_paths(lxc_conf);
+
+ list_item = malloc(sizeof(*list_item));
+ if (list_item == NULL)
+ goto on_error;
+
+ list_item->elem = safe_strdup(value);
+
+ lxc_list_add_tail(&lxc_conf->rootfs.ropaths, list_item);
+
+ return 0;
+
+on_error:
+ free(list_item);
+
+ return -1;
+}
+
+// isulad: get config rootfs ro paths
+static int get_config_rootfs_ro_paths(const char *key, char *retv, int inlen,
+ struct lxc_conf *c, void *data)
+{
+ int len, fulllen = 0;
+ struct lxc_list *it = NULL;
+
+ if (!retv)
+ inlen = 0;
+ else
+ memset(retv, 0, inlen);
+
+ lxc_list_for_each(it, &c->rootfs.ropaths) {
+ strprint(retv, inlen, "%s\n", (char *)it->elem);
+ }
+
+ return fulllen;
+}
+
+/* isulad: clr config rootfs masked paths */
+static inline int clr_config_rootfs_masked_paths(const char *key, struct lxc_conf *c,
+ void *data)
+{
+ return lxc_clear_rootfs_masked_paths(c);
+}
+
+/* isulad: clr config rootfs ro paths */
+static inline int clr_config_rootfs_ro_paths(const char *key, struct lxc_conf *c,
+ void *data)
+{
+ return lxc_clear_rootfs_ro_paths(c);
+}
+
#endif
--
1.8.3.1

369
0016-start-separate-i-and-t.patch
View File

@ -1,369 +0,0 @@
From 204008167f00ddda3f5f2b0121bcf29b3d55c689 Mon Sep 17 00:00:00 2001
From: LiFeng <lifeng68@huawei.com>
Date: Mon, 13 Apr 2020 21:17:15 +0800
Subject: [PATCH 16/49] start: separate -i and -t
Signed-off-by: LiFeng <lifeng68@huawei.com>
---
src/lxc/lxccontainer.c | 44 +++++++++++++++++-
src/lxc/lxccontainer.h | 27 +++++++++++
src/lxc/start.c | 111 +++++++++++++++++++++++++++++++++++++++++++++-
src/lxc/start.h | 4 ++
src/lxc/tools/arguments.h | 2 +
src/lxc/tools/lxc_start.c | 14 ++++++
6 files changed, 198 insertions(+), 4 deletions(-)
diff --git a/src/lxc/lxccontainer.c b/src/lxc/lxccontainer.c
index 64cde99..e27b63b 100644
--- a/src/lxc/lxccontainer.c
+++ b/src/lxc/lxccontainer.c
@@ -1163,12 +1163,18 @@ reboot:
goto on_error;
}
- if (useinit)
+ if (useinit) {
ret = lxc_execute(c->name, argv, 1, handler, c->config_path,
c->daemonize, &c->error_num);
- else
+ }
+ else {
+#ifdef HAVE_ISULAD
+ handler->disable_pty = c->disable_pty;
+ handler->open_stdin = c->open_stdin;
+#endif
ret = lxc_start(argv, handler, c->config_path, c->daemonize,
&c->error_num);
+ }
if (conf->reboot == REBOOT_REQ) {
INFO("Container requested reboot");
@@ -5381,6 +5387,40 @@ static bool do_lxcapi_set_container_info_file(struct lxc_container *c, const cha
}
WRAP_API_1(bool, lxcapi_set_container_info_file, const char *)
+
+static bool do_lxcapi_want_disable_pty(struct lxc_container *c, bool state)
+{
+ if (!c || !c->lxc_conf)
+ return false;
+
+ if (container_mem_lock(c))
+ return false;
+
+ c->disable_pty = state;
+
+ container_mem_unlock(c);
+
+ return true;
+}
+
+WRAP_API_1(bool, lxcapi_want_disable_pty, bool)
+
+static bool do_lxcapi_want_open_stdin(struct lxc_container *c, bool state)
+{
+ if (!c || !c->lxc_conf)
+ return false;
+
+ if (container_mem_lock(c))
+ return false;
+
+ c->open_stdin = state;
+
+ container_mem_unlock(c);
+
+ return true;
+}
+
+WRAP_API_1(bool, lxcapi_want_open_stdin, bool)
#endif
struct lxc_container *lxc_container_new(const char *name, const char *configpath)
diff --git a/src/lxc/lxccontainer.h b/src/lxc/lxccontainer.h
index fa9bd5e..de2ee46 100644
--- a/src/lxc/lxccontainer.h
+++ b/src/lxc/lxccontainer.h
@@ -113,6 +113,11 @@ struct lxc_container {
* exit FIFO File to open used monitor the state of lxc monitor process.
*/
char *exit_fifo;
+ /*! Whether container wishes to create pty or pipes for console log */
+ bool disable_pty;
+
+ /*! Whether container wishes to keep stdin active */
+ bool open_stdin;
#endif
/*!
@@ -908,6 +913,28 @@ struct lxc_container {
bool (*set_terminal_winch)(struct lxc_container *c, unsigned int height, unsigned int width);
bool (*set_exec_terminal_winch)(struct lxc_container *c, const char *suffix, unsigned int height, unsigned int width);
+
+ /*!
+ * \brief Change whether the container wants to create pty or pipes
+ * from the console log.
+ *
+ * \param c Container.
+ * \param state Value for the disable pty bit (0 or 1).
+ *
+ * \return \c true on success, else \c false.
+ */
+ bool (*want_disable_pty)(struct lxc_container *c, bool state);
+
+ /*!
+ * \brief Change whether the container wants to keep stdin active
+ * for parent process of container
+ *
+ * \param c Container.
+ * \param state Value for the open_stdin bit (0 or 1).
+ *
+ * \return \c true on success, else \c false.
+ */
+ bool (*want_open_stdin)(struct lxc_container *c, bool state);
#endif
};
diff --git a/src/lxc/start.c b/src/lxc/start.c
index 17766bc..145b015 100644
--- a/src/lxc/start.c
+++ b/src/lxc/start.c
@@ -580,6 +580,16 @@ int lxc_poll(const char *name, struct lxc_handler *handler)
TRACE("Mainloop is ready");
+#ifdef HAVE_ISULAD
+ // iSulad: close stdin pipe if we do not want open_stdin with container stdin
+ if (!handler->conf->console.open_stdin) {
+ if (handler->conf->console.pipes[0][1] > 0) {
+ close(handler->conf->console.pipes[0][1]);
+ handler->conf->console.pipes[0][1] = -1;
+ }
+ }
+#endif
+
ret = lxc_mainloop(&descr, -1);
close_prot_errno_disarm(descr.epfd);
if (ret < 0 || !handler->init_died)
@@ -733,6 +743,10 @@ int lxc_init(const char *name, struct lxc_handler *handler)
int ret;
const char *loglevel;
struct lxc_conf *conf = handler->conf;
+#ifdef HAVE_ISULAD
+ conf->console.disable_pty = handler->disable_pty;
+ conf->console.open_stdin = handler->open_stdin;
+#endif
handler->monitor_pid = lxc_raw_getpid();
status_fd = open("/proc/self/status", O_RDONLY | O_CLOEXEC);
@@ -1178,6 +1192,25 @@ static int do_start(void *data)
* means that migration won't work, but at least we won't spew output
* where it isn't wanted.
*/
+#ifdef HAVE_ISULAD
+ if (!handler->disable_pty && handler->daemonize && !handler->conf->autodev) {
+ char path[PATH_MAX];
+
+ ret = snprintf(path, sizeof(path), "%s/dev/null",
+ handler->conf->rootfs.mount);
+ if (ret < 0 || ret >= sizeof(path))
+ goto out_warn_father;
+
+ ret = access(path, F_OK);
+ if (ret != 0) {
+ devnull_fd = open_devnull();
+
+ if (devnull_fd < 0)
+ goto out_warn_father;
+ WARN("Using /dev/null from the host for container init's standard file descriptors. Migration will not work");
+ }
+ }
+#else
if (handler->daemonize && !handler->conf->autodev) {
char path[PATH_MAX];
@@ -1195,6 +1228,7 @@ static int do_start(void *data)
WARN("Using /dev/null from the host for container init's standard file descriptors. Migration will not work");
}
}
+#endif
/* Ask father to setup cgroups and wait for him to finish. */
ret = lxc_sync_barrier_parent(handler, LXC_SYNC_CGROUP);
@@ -1266,12 +1300,70 @@ static int do_start(void *data)
DEBUG("Set PR_SET_NO_NEW_PRIVS to block execve() gainable privileges");
}
+#ifdef HAVE_ISULAD
+ /* isulad: dup2 pipe[0][0] to container stdin, pipe[1][1] to container stdout, pipe[2][1] to container stderr */
+ if (handler->disable_pty) {
+ if (handler->conf->console.pipes[0][1] >= 0) {
+ close(handler->conf->console.pipes[0][1]);
+ handler->conf->console.pipes[0][1] = -1;
+ }
+
+ if (handler->conf->console.pipes[0][0] >= 0) {
+ ret = dup2(handler->conf->console.pipes[0][0], STDIN_FILENO);
+ if (ret < 0)
+ goto out_warn_father;
+ }
+
+ if (handler->conf->console.pipes[1][0] >= 0) {
+ close(handler->conf->console.pipes[1][0]);
+ handler->conf->console.pipes[1][0] = -1;
+ }
+
+ if (handler->conf->console.pipes[1][1] >= 0) {
+ ret = dup2(handler->conf->console.pipes[1][1], STDOUT_FILENO);
+ if (ret < 0)
+ goto out_warn_father;
+ }
+ if (handler->conf->console.pipes[2][0] >= 0) {
+ close(handler->conf->console.pipes[2][0]);
+ handler->conf->console.pipes[2][0] = -1;
+ }
+
+ if (handler->conf->console.pipes[2][1] >= 0) {
+ ret = dup2(handler->conf->console.pipes[2][1], STDERR_FILENO);
+ if (ret < 0)
+ goto out_warn_father;
+ }
+ }
+#endif
+
/* Some init's such as busybox will set sane tty settings on stdin,
* stdout, stderr which it thinks is the console. We already set them
* the way we wanted on the real terminal, and we want init to do its
* setup on its console ie. the pty allocated in lxc_terminal_setup() so
* make sure that that pty is stdin,stdout,stderr.
*/
+ setsid();
+#ifdef HAVE_ISULAD
+ if (!handler->disable_pty && handler->conf->console.slave >= 0) {
+ /* isulad:make the given terminal as controlling terminal to avoid warning
+ * sh: cannot set terminal process group (-1): Inappropriate ioctl for device
+ * sh: no job control in this shell */
+ if (ioctl(handler->conf->console.slave, TIOCSCTTY, NULL) < 0) {
+ ERROR("Faild to make the given terminal the controlling terminal of the calling process");
+ goto out_warn_father;
+ }
+ if (handler->daemonize || !handler->conf->is_execute)
+ ret = set_stdfds(handler->conf->console.slave);
+ else
+ ret = lxc_terminal_set_stdfds(handler->conf->console.slave);
+ if (ret < 0) {
+ ERROR("Failed to redirect std{in,out,err} to pty file "
+ "descriptor %d", handler->conf->console.slave);
+ goto out_warn_father;
+ }
+ }
+#else
if (handler->conf->console.slave >= 0) {
if (handler->daemonize || !handler->conf->is_execute)
ret = set_stdfds(handler->conf->console.slave);
@@ -1283,6 +1375,7 @@ static int do_start(void *data)
goto out_warn_father;
}
}
+#endif
/* If we mounted a temporary proc, then unmount it now. */
tmp_proc_unmount(handler->conf);
@@ -1306,6 +1399,21 @@ static int do_start(void *data)
close_prot_errno_disarm(handler->sigfd);
+ #ifdef HAVE_ISULAD
+ if (!handler->disable_pty && handler->conf->console.slave < 0 && handler->daemonize) {
+ if (devnull_fd < 0) {
+ devnull_fd = open_devnull();
+ if (devnull_fd < 0)
+ goto out_warn_father;
+ }
+
+ ret = set_stdfds(devnull_fd);
+ if (ret < 0) {
+ ERROR("Failed to redirect std{in,out,err} to \"/dev/null\"");
+ goto out_warn_father;
+ }
+ }
+ #else
if (handler->conf->console.slave < 0 && handler->daemonize) {
if (devnull_fd < 0) {
devnull_fd = open_devnull();
@@ -1319,11 +1427,10 @@ static int do_start(void *data)
goto out_warn_father;
}
}
+ #endif
close_prot_errno_disarm(devnull_fd);
- setsid();
-
if (handler->conf->init_cwd) {
ret = chdir(handler->conf->init_cwd);
if (ret < 0) {
diff --git a/src/lxc/start.h b/src/lxc/start.h
index 1368d0e..5ea5fe2 100644
--- a/src/lxc/start.h
+++ b/src/lxc/start.h
@@ -125,6 +125,10 @@ struct lxc_handler {
#ifdef HAVE_ISULAD
int exit_code;/* isulad: record the exit code of container */
+ /* Indicates whether should we using pipes or pty dup to std{in,out,err} for console log. */
+ bool disable_pty;
+ /* Indicates whether should we keep stdin active. */
+ bool open_stdin;
#endif
};
diff --git a/src/lxc/tools/arguments.h b/src/lxc/tools/arguments.h
index e0866d6..a6d9967 100644
--- a/src/lxc/tools/arguments.h
+++ b/src/lxc/tools/arguments.h
@@ -45,6 +45,8 @@ struct lxc_arguments {
char *terminal_fifos[3]; /* isulad add, fifos used to redirct stdin/out/err */
const char *exit_monitor_fifo; /* isulad: fifo used to monitor state of monitor process */
const char *suffix; /* isulad add, suffix used for connect with parent of execed process*/
+ int disable_pty;
+ int open_stdin;
#endif
/* for lxc-console */
diff --git a/src/lxc/tools/lxc_start.c b/src/lxc/tools/lxc_start.c
index 76802df6..321c847 100644
--- a/src/lxc/tools/lxc_start.c
+++ b/src/lxc/tools/lxc_start.c
@@ -143,6 +143,12 @@ static int my_parser(struct lxc_arguments *args, int c, char *arg)
case OPT_EXIT_FIFO:
args->exit_monitor_fifo = arg;
break;
+ case OPT_DISABLE_PTY:
+ args->disable_pty = 1;
+ break;
+ case OPT_OPEN_STDIN:
+ args->open_stdin = 1;
+ break;
#endif
}
@@ -334,6 +340,14 @@ int main(int argc, char *argv[])
if (my_args.exit_monitor_fifo != NULL) {
c->exit_fifo = safe_strdup(my_args.exit_monitor_fifo);
}
+
+ if (my_args.disable_pty) {
+ c->want_disable_pty(c, true);
+ }
+
+ if (my_args.open_stdin) {
+ c->want_open_stdin(c, true);
+ }
#endif
if (my_args.console)
--
1.8.3.1

289
0017-attach-add_terminal_fifos-Add-terminal-fifos-dynamic.patch
View File

@ -1,289 +0,0 @@
From 29c1823334219c03b1ef4d6b4965529b73ff071b Mon Sep 17 00:00:00 2001
From: LiFeng <lifeng68@huawei.com>
Date: Mon, 13 Apr 2020 21:39:35 +0800
Subject: [PATCH 17/49] attach: add_terminal_fifos: Add terminal fifos
dynamically
Signed-off-by: LiFeng <lifeng68@huawei.com>
---
src/lxc/commands.c | 94 +++++++++++++++++++++++++++++++++++++++++++++-----
src/lxc/commands.h | 8 +++++
src/lxc/lxccontainer.c | 24 +++++++++++++
src/lxc/terminal.c | 57 ++++++++++++++++++++++++++++++
src/lxc/terminal.h | 4 +++
5 files changed, 178 insertions(+), 9 deletions(-)
diff --git a/src/lxc/commands.c b/src/lxc/commands.c
index 991bca2..0ffc5c7 100644
--- a/src/lxc/commands.c
+++ b/src/lxc/commands.c
@@ -75,15 +75,18 @@ static const char *lxc_cmd_str(lxc_cmd_t cmd)
[LXC_CMD_GET_CONFIG_ITEM] = "get_config_item",
[LXC_CMD_GET_NAME] = "get_name",
[LXC_CMD_GET_LXCPATH] = "get_lxcpath",
- [LXC_CMD_ADD_STATE_CLIENT] = "add_state_client",
- [LXC_CMD_CONSOLE_LOG] = "console_log",
+ [LXC_CMD_ADD_STATE_CLIENT] = "add_state_client",
+ [LXC_CMD_CONSOLE_LOG] = "console_log",
[LXC_CMD_SERVE_STATE_CLIENTS] = "serve_state_clients",
[LXC_CMD_SECCOMP_NOTIFY_ADD_LISTENER] = "seccomp_notify_add_listener",
[LXC_CMD_ADD_BPF_DEVICE_CGROUP] = "add_bpf_device_cgroup",
- [LXC_CMD_FREEZE] = "freeze",
- [LXC_CMD_UNFREEZE] = "unfreeze",
- [LXC_CMD_GET_CGROUP2_FD] = "get_cgroup2_fd",
+ [LXC_CMD_FREEZE] = "freeze",
+ [LXC_CMD_UNFREEZE] = "unfreeze",
+ [LXC_CMD_GET_CGROUP2_FD] = "get_cgroup2_fd",
[LXC_CMD_GET_INIT_PIDFD] = "get_init_pidfd",
+#ifdef HAVE_ISULAD
+ [LXC_CMD_SET_TERMINAL_FIFOS] = "set_terminal_fifos",
+#endif
};
if (cmd >= LXC_CMD_MAX)
@@ -1388,6 +1391,76 @@ static int lxc_cmd_get_cgroup2_fd_callback(int fd, struct lxc_cmd_req *req,
return 0;
}
+#ifdef HAVE_ISULAD
+/*
+ * isulad: lxc_cmd_set_terminal_fifos: Set the fifos used for the container as terminal input/output
+ *
+ * @hashed_sock_name: hashed socket name
+ *
+ * Returns 0 when success, else when fail.
+ */
+int lxc_cmd_set_terminal_fifos(const char *name, const char *lxcpath, const char *in_fifo,
+ const char *out_fifo, const char *err_fifo)
+{
+ int ret = 0, stopped = 0;
+ int len = 0;
+ char *tmp = NULL;
+ const char *split = "&&&&", *none_fifo_name = "none";
+ const char *cmd_in_fifo = in_fifo ? in_fifo : none_fifo_name;
+ const char *cmd_out_fifo = out_fifo ? out_fifo : none_fifo_name;
+ const char *cmd_err_fifo = err_fifo ? err_fifo : none_fifo_name;
+
+ if (len + strlen(cmd_in_fifo) + strlen(split) + strlen(cmd_out_fifo) +
+ strlen(split) + strlen(cmd_err_fifo) == SIZE_MAX)
+ return -1;
+ len += strlen(cmd_in_fifo) + strlen(split) + strlen(cmd_out_fifo) + strlen(split) + strlen(cmd_err_fifo) + 1;
+ tmp = malloc(len);
+ if (tmp == NULL)
+ return -1;
+ ret = snprintf(tmp, len, "%s%s%s%s%s", cmd_in_fifo, split, cmd_out_fifo, split, cmd_err_fifo);
+ if (ret < 0 || ret >= len) {
+ ERROR("Failed to snprintf in fifo of command");
+ free(tmp);
+ return -1;
+ }
+
+ struct lxc_cmd_rr cmd = {
+ .req = {
+ .cmd = LXC_CMD_SET_TERMINAL_FIFOS,
+ .datalen = strlen(tmp)+1,
+ .data = tmp,
+ },
+ };
+
+ ret = lxc_cmd(name, &cmd, &stopped, lxcpath, NULL);
+ if (ret < 0) {
+ ERROR("Failed to send command to container");
+ free(tmp);
+ return -1;
+ }
+
+ if (cmd.rsp.ret != 0) {
+ ERROR("Command response error:%d", cmd.rsp.ret);
+ free(tmp);
+ return -1;
+ }
+
+ free(tmp);
+ return 0;
+}
+
+static int lxc_cmd_set_terminal_fifos_callback(int fd, struct lxc_cmd_req *req,
+ struct lxc_handler *handler, struct lxc_epoll_descr *descr)
+{
+ struct lxc_cmd_rsp rsp;
+ memset(&rsp, 0, sizeof(rsp));
+
+ rsp.ret = lxc_terminal_add_fifos(handler->conf, req->data);;
+
+ return lxc_cmd_rsp_send(fd, &rsp);
+}
+#endif
+
static int lxc_cmd_process(int fd, struct lxc_cmd_req *req,
struct lxc_handler *handler,
struct lxc_epoll_descr *descr)
@@ -1410,11 +1483,14 @@ static int lxc_cmd_process(int fd, struct lxc_cmd_req *req,
[LXC_CMD_CONSOLE_LOG] = lxc_cmd_console_log_callback,
[LXC_CMD_SERVE_STATE_CLIENTS] = lxc_cmd_serve_state_clients_callback,
[LXC_CMD_SECCOMP_NOTIFY_ADD_LISTENER] = lxc_cmd_seccomp_notify_add_listener_callback,
- [LXC_CMD_ADD_BPF_DEVICE_CGROUP] = lxc_cmd_add_bpf_device_cgroup_callback,
- [LXC_CMD_FREEZE] = lxc_cmd_freeze_callback,
- [LXC_CMD_UNFREEZE] = lxc_cmd_unfreeze_callback,
- [LXC_CMD_GET_CGROUP2_FD] = lxc_cmd_get_cgroup2_fd_callback,
+ [LXC_CMD_ADD_BPF_DEVICE_CGROUP] = lxc_cmd_add_bpf_device_cgroup_callback,
+ [LXC_CMD_FREEZE] = lxc_cmd_freeze_callback,
+ [LXC_CMD_UNFREEZE] = lxc_cmd_unfreeze_callback,
+ [LXC_CMD_GET_CGROUP2_FD] = lxc_cmd_get_cgroup2_fd_callback,
[LXC_CMD_GET_INIT_PIDFD] = lxc_cmd_get_init_pidfd_callback,
+#ifdef HAVE_ISULAD
+ [LXC_CMD_SET_TERMINAL_FIFOS] = lxc_cmd_set_terminal_fifos_callback,
+#endif
};
if (req->cmd >= LXC_CMD_MAX)
diff --git a/src/lxc/commands.h b/src/lxc/commands.h
index 9e52484..95815e6 100644
--- a/src/lxc/commands.h
+++ b/src/lxc/commands.h
@@ -38,6 +38,9 @@ typedef enum {
LXC_CMD_UNFREEZE,
LXC_CMD_GET_CGROUP2_FD,
LXC_CMD_GET_INIT_PIDFD,
+#ifdef HAVE_ISULAD
+ LXC_CMD_SET_TERMINAL_FIFOS,
+#endif
LXC_CMD_MAX,
} lxc_cmd_t;
@@ -130,4 +133,9 @@ extern int lxc_cmd_freeze(const char *name, const char *lxcpath, int timeout);
extern int lxc_cmd_unfreeze(const char *name, const char *lxcpath, int timeout);
extern int lxc_cmd_get_cgroup2_fd(const char *name, const char *lxcpath);
+#ifdef HAVE_ISULAD
+extern int lxc_cmd_set_terminal_fifos(const char *name, const char *lxcpath,
+ const char *in_fifo, const char *out_fifo, const char *err_fifo);
+#endif
+
#endif /* __commands_h */
diff --git a/src/lxc/lxccontainer.c b/src/lxc/lxccontainer.c
index e27b63b..d0e6e2b 100644
--- a/src/lxc/lxccontainer.c
+++ b/src/lxc/lxccontainer.c
@@ -5421,6 +5421,29 @@ static bool do_lxcapi_want_open_stdin(struct lxc_container *c, bool state)
}
WRAP_API_1(bool, lxcapi_want_open_stdin, bool)
+
+/* isulad add clean resources */
+static bool do_lxcapi_add_terminal_fifo(struct lxc_container *c, const char *in_fifo, const char *out_fifo, const char *err_fifo)
+{
+ bool ret = true;
+
+ if (!c || !c->lxc_conf)
+ return false;
+ if (container_mem_lock(c)) {
+ ERROR("Error getting mem lock");
+ return false;
+ }
+
+ if (lxc_cmd_set_terminal_fifos(c->name, c->config_path, in_fifo, out_fifo, err_fifo)) {
+ ERROR("Error set console fifos");
+ ret = false;
+ }
+
+ container_mem_unlock(c);
+ return ret;
+}
+
+WRAP_API_3(bool, lxcapi_add_terminal_fifo, const char *, const char *, const char *)
#endif
struct lxc_container *lxc_container_new(const char *name, const char *configpath)
@@ -5567,6 +5590,7 @@ struct lxc_container *lxc_container_new(const char *name, const char *configpath
#ifdef HAVE_ISULAD
c->set_container_info_file = lxcapi_set_container_info_file;
c->set_terminal_init_fifos = lxcapi_set_terminal_default_fifos;
+ c->add_terminal_fifos = lxcapi_add_terminal_fifo;
#endif
return c;
diff --git a/src/lxc/terminal.c b/src/lxc/terminal.c
index 775743d..4d7c2cd 100644
--- a/src/lxc/terminal.c
+++ b/src/lxc/terminal.c
@@ -1607,6 +1607,63 @@ err:
lxc_terminal_delete(terminal);
return -ENODEV;
}
+
+/* isulad: add fifos dynamic*/
+int lxc_terminal_add_fifos(struct lxc_conf *conf, const char *fifonames)
+{
+ int ret = 0;
+ struct lxc_terminal *terminal = &conf->console;
+ int fifofd_in = -1;
+ char *tmp = NULL, *saveptr = NULL, *in = NULL, *out = NULL, *err = NULL;
+ const char *none_fifo_name = "none";
+
+ tmp = safe_strdup(fifonames);
+
+ in = strtok_r(tmp, "&&&&", &saveptr);
+ if (!in) {
+ ret = -1;
+ goto free_out;
+ }
+ if (strcmp(in, none_fifo_name) == 0)
+ in = NULL;
+
+ out = strtok_r(NULL, "&&&&", &saveptr);
+ if (!out) {
+ ret = -1;
+ goto free_out;
+ }
+ if (strcmp(out, none_fifo_name) == 0)
+ out = NULL;
+
+ err = strtok_r(NULL, "&&&&", &saveptr);
+ if (!err) {
+ ret = -1;
+ goto free_out;
+ }
+ if (strcmp(err, none_fifo_name) == 0)
+ err = NULL;
+
+ ret = lxc_terminal_set_fifo(terminal, in, out, err, &fifofd_in);
+ if (ret < 0) {
+ ERROR("Faild to set fifos to console config");
+ ret = -1;
+ goto free_out;
+ }
+
+ if (lxc_mainloop_add_handler(terminal->descr, fifofd_in,
+ lxc_terminal_io_cb, terminal)) {
+ ERROR("console fifo not added to mainloop");
+ lxc_terminal_delete_fifo(fifofd_in, &terminal->fifos);
+ ret = -1;
+ goto free_out;
+ }
+
+free_out:
+ if (tmp)
+ free(tmp);
+ return ret;
+}
+
#else
int lxc_terminal_create(struct lxc_terminal *terminal)
{
diff --git a/src/lxc/terminal.h b/src/lxc/terminal.h
index dfc03c6..b4160b3 100644
--- a/src/lxc/terminal.h
+++ b/src/lxc/terminal.h
@@ -274,4 +274,8 @@ extern void lxc_terminal_init(struct lxc_terminal *terminal);
extern int lxc_terminal_map_ids(struct lxc_conf *c,
struct lxc_terminal *terminal);
+#ifdef HAVE_ISULAD
+int lxc_terminal_add_fifos(struct lxc_conf *conf, const char *fifonames);
+#endif
+
#endif /* __LXC_TERMINAL_H */
--
1.8.3.1

157
0018-pty-setup-pty-after-setup-rootfs-mount-options.patch
View File

@ -1,157 +0,0 @@
From 8d2f80168d89abc317affee358120dcf25b8af19 Mon Sep 17 00:00:00 2001
From: LiFeng <lifeng68@huawei.com>
Date: Tue, 14 Apr 2020 12:50:55 +0800
Subject: [PATCH 18/49] pty: setup pty after setup rootfs mount options
Signed-off-by: LiFeng <lifeng68@huawei.com>
---
src/lxc/conf.c | 16 +++++++++----
src/lxc/start.c | 2 +-
src/lxc/terminal.c | 67 ++++++++++++++++++++++++++++++++++++------------------
3 files changed, 57 insertions(+), 28 deletions(-)
diff --git a/src/lxc/conf.c b/src/lxc/conf.c
index fce241b..2e93227 100644
--- a/src/lxc/conf.c
+++ b/src/lxc/conf.c
@@ -3748,14 +3748,20 @@ int lxc_setup(struct lxc_handler *handler)
if (lxc_conf->autodev > 0)
(void)lxc_setup_boot_id();
+#ifdef HAVE_ISULAD
+ if (setup_rootfs_mountopts(&lxc_conf->rootfs)) {
+ return log_error(-1, "failed to set rootfs for '%s'", name);
+ }
+ if (lxc_conf->rootfs.path) {
+ ret = lxc_setup_devpts(lxc_conf);
+ if (ret < 0) {
+ return log_error(-1, "Failed to setup new devpts instance for '%s'", name);
+ }
+ }
+#else
ret = lxc_setup_devpts(lxc_conf);
if (ret < 0)
return log_error(-1, "Failed to setup new devpts instance");
-
-#ifdef HAVE_ISULAD
- if (setup_rootfs_mountopts(&lxc_conf->rootfs)) {
- return log_error(-1, "failed to set rootfs for '%s'", name);
- }
#endif
ret = lxc_create_ttys(handler);
diff --git a/src/lxc/start.c b/src/lxc/start.c
index 145b015..800f884 100644
--- a/src/lxc/start.c
+++ b/src/lxc/start.c
@@ -596,7 +596,7 @@ int lxc_poll(const char *name, struct lxc_handler *handler)
goto out_mainloop_console;
if (has_console)
- ret = lxc_mainloop(&descr_console, 0);
+ ret = lxc_mainloop(&descr_console, 100);
out_mainloop_console:
if (has_console) {
diff --git a/src/lxc/terminal.c b/src/lxc/terminal.c
index 4d7c2cd..1f46d49 100644
--- a/src/lxc/terminal.c
+++ b/src/lxc/terminal.c
@@ -186,6 +186,42 @@ static int lxc_terminal_truncate_log_file(struct lxc_terminal *terminal)
return lxc_unpriv(ftruncate(terminal->log_fd, 0));
}
+#ifdef HAVE_ISULAD
+/*
+ * isulad: support mult-logfiles
+ * */
+static int lxc_terminal_rename_old_log_file(struct lxc_terminal *terminal)
+{
+ int ret;
+ unsigned int i;
+ char tmp[PATH_MAX] = {0};
+ char *rename_fname = NULL;
+
+ for (i = terminal->log_rotate - 1; i > 1; i--) {
+ ret = snprintf(tmp, PATH_MAX, "%s.%u", terminal->log_path, i);
+ if (ret < 0 || ret >= PATH_MAX) {
+ free(rename_fname);
+ return -EFBIG;
+ }
+ free(rename_fname);
+ rename_fname = safe_strdup(tmp);
+ ret = snprintf(tmp, PATH_MAX, "%s.%u", terminal->log_path, (i - 1));
+ if (ret < 0 || ret >= PATH_MAX) {
+ free(rename_fname);
+ return -EFBIG;
+ }
+ ret = lxc_unpriv(rename(tmp, rename_fname));
+ if (ret < 0 && errno != ENOENT) {
+ free(rename_fname);
+ return ret;
+ }
+ }
+
+ free(rename_fname);
+ return 0;
+}
+#endif
+
static int lxc_terminal_rotate_log_file(struct lxc_terminal *terminal)
{
__do_free char *tmp = NULL;
@@ -199,6 +235,15 @@ static int lxc_terminal_rotate_log_file(struct lxc_terminal *terminal)
if (terminal->log_fd < 0)
return -EBADF;
+#ifdef HAVE_ISULAD
+ /* isuald: rotate old log file first */
+ ret = lxc_terminal_rename_old_log_file(terminal);
+ if(ret != 0) {
+ ERROR("Rename old log file failed");
+ return ret;
+ }
+#endif
+
len = strlen(terminal->log_path) + sizeof(".1");
tmp = must_realloc(NULL, len);
@@ -1512,21 +1557,6 @@ static int lxc_terminal_fifo_default(struct lxc_terminal *terminal)
return 0;
}
-static int use_unix_newline(int master_fd)
-{
- struct termios oldtios;
- int ret;
-
- ret = tcgetattr(master_fd, &oldtios);
- if (ret < 0)
- return -1;
- oldtios.c_oflag &= ~ONLCR;
- ret = tcsetattr(master_fd, TCSAFLUSH, &oldtios);
- if (ret < 0)
- return -1;
- return 0;
-}
-
int lxc_terminal_create(struct lxc_terminal *terminal)
{
int ret;
@@ -1544,13 +1574,6 @@ int lxc_terminal_create(struct lxc_terminal *terminal)
goto err;
}
- /* isulad: clear ONLCR flag */
- ret = use_unix_newline(terminal->master);
- if (ret < 0) {
- SYSERROR("Failed to clear ONLCR flag on terminal master");
- goto err;
- }
-
ret = fd_cloexec(terminal->master, true);
if (ret < 0) {
SYSERROR("Failed to set FD_CLOEXEC flag on terminal master");
--
1.8.3.1

963
0019-resize-implement-resize-function-in-exec-start.patch
View File

@ -1,963 +0,0 @@
From f690df5983011dd3b61f0e139c3e939f3fecf37a Mon Sep 17 00:00:00 2001
From: LiFeng <lifeng68@huawei.com>
Date: Tue, 14 Apr 2020 16:04:15 +0800
Subject: [PATCH 19/49] resize: implement resize function in exec/start
Signed-off-by: LiFeng <lifeng68@huawei.com>
---
src/lxc/Makefile.am | 10 +-
src/lxc/af_unix.c | 33 +++-
src/lxc/af_unix.h | 5 +-
src/lxc/attach.c | 51 +++++-
src/lxc/commands.c | 50 ++++++
src/lxc/commands.h | 2 +
src/lxc/exec_commands.c | 416 ++++++++++++++++++++++++++++++++++++++++++++++++
src/lxc/exec_commands.h | 73 +++++++++
src/lxc/lxccontainer.c | 50 ++++++
src/lxc/terminal.c | 27 ++++
src/lxc/terminal.h | 1 +
11 files changed, 710 insertions(+), 8 deletions(-)
create mode 100644 src/lxc/exec_commands.c
create mode 100644 src/lxc/exec_commands.h
diff --git a/src/lxc/Makefile.am b/src/lxc/Makefile.am
index 23935e5..c288c51 100644
--- a/src/lxc/Makefile.am
+++ b/src/lxc/Makefile.am
@@ -52,14 +52,15 @@ noinst_HEADERS = api_extensions.h \
utils.h \
uuid.h
-#if HAVE_ISULAD
+if HAVE_ISULAD
noinst_HEADERS += isulad_utils.h path.h \
json/json_common.h json/defs.h \
json/oci_runtime_hooks.h \
json/logger_json_file.h \
json/oci_runtime_spec.h \
- json/read-file.h
-#endif
+ json/read-file.h \
+ exec_commands.h
+endif
if IS_BIONIC
noinst_HEADERS += ../include/fexecve.h \
@@ -172,7 +173,8 @@ liblxc_la_SOURCES += isulad_utils.c isulad_utils.h \
json/oci_runtime_hooks.c json/oci_runtime_hooks.h \
json/logger_json_file.c json/logger_json_file.h \
json/oci_runtime_spec.c json/oci_runtime_spec.h \
- json/read-file.c json/read-file.h
+ json/read-file.c json/read-file.h \
+ exec_commands.c exec_commands.h
endif
if IS_BIONIC
diff --git a/src/lxc/af_unix.c b/src/lxc/af_unix.c
index e172088..9f268be 100644
--- a/src/lxc/af_unix.c
+++ b/src/lxc/af_unix.c
@@ -168,7 +168,7 @@ int lxc_unix_send_fds(int fd, int *sendfds, int num_sendfds, void *data,
}
static int lxc_abstract_unix_recv_fds_iov(int fd, int *recvfds, int num_recvfds,
- struct iovec *iov, size_t iovlen)
+ struct iovec *iov, size_t iovlen, unsigned int timeout)
{
__do_free char *cmsgbuf = NULL;
int ret;
@@ -188,6 +188,22 @@ static int lxc_abstract_unix_recv_fds_iov(int fd, int *recvfds, int num_recvfds,
msg.msg_iov = iov;
msg.msg_iovlen = iovlen;
+#ifdef HAVE_ISULAD
+ struct timeval out;
+ if (timeout > 0) {
+ memset(&out, 0, sizeof(out));
+ out.tv_sec = timeout / 1000000;
+ out.tv_usec = timeout % 1000000;
+ ret = setsockopt(fd, SOL_SOCKET, SO_RCVTIMEO,
+ (const void *)&out, sizeof(out));
+ if (ret < 0) {
+ ERROR("Failed to set %u timeout on containter "
+ "state socket", timeout);
+ return ret;
+ }
+ }
+#endif
+
do {
ret = recvmsg(fd, &msg, 0);
} while (ret < 0 && errno == EINTR);
@@ -220,8 +236,21 @@ int lxc_abstract_unix_recv_fds(int fd, int *recvfds, int num_recvfds,
.iov_base = data ? data : buf,
.iov_len = data ? size : sizeof(buf),
};
- return lxc_abstract_unix_recv_fds_iov(fd, recvfds, num_recvfds, &iov, 1);
+ return lxc_abstract_unix_recv_fds_iov(fd, recvfds, num_recvfds, &iov, 1, 0);
+}
+
+#ifdef HAVE_ISULAD
+int lxc_abstract_unix_recv_fds_timeout(int fd, int *recvfds, int num_recvfds,
+ void *data, size_t size, unsigned int timeout)
+{
+ char buf[1] = {0};
+ struct iovec iov = {
+ .iov_base = data ? data : buf,
+ .iov_len = data ? size : sizeof(buf),
+ };
+ return lxc_abstract_unix_recv_fds_iov(fd, recvfds, num_recvfds, &iov, 1, timeout);
}
+#endif
int lxc_abstract_unix_send_credential(int fd, void *data, size_t size)
{
diff --git a/src/lxc/af_unix.h b/src/lxc/af_unix.h
index 2531b0b..6943a61 100644
--- a/src/lxc/af_unix.h
+++ b/src/lxc/af_unix.h
@@ -27,5 +27,8 @@ extern int lxc_unix_sockaddr(struct sockaddr_un *ret, const char *path);
extern int lxc_unix_connect(struct sockaddr_un *addr);
extern int lxc_unix_connect_type(struct sockaddr_un *addr, int type);
extern int lxc_socket_set_timeout(int fd, int rcv_timeout, int snd_timeout);
-
+#ifdef HAVE_ISULAD
+int lxc_abstract_unix_recv_fds_timeout(int fd, int *recvfds, int num_recvfds,
+ void *data, size_t size, unsigned int timeout);
+#endif
#endif /* __LXC_AF_UNIX_H */
diff --git a/src/lxc/attach.c b/src/lxc/attach.c
index e66ca1c..33946bb 100644
--- a/src/lxc/attach.c
+++ b/src/lxc/attach.c
@@ -45,6 +45,10 @@
#include "terminal.h"
#include "utils.h"
+#ifdef HAVE_ISULAD
+#include "exec_commands.h"
+#endif
+
#if HAVE_SYS_PERSONALITY_H
#include <sys/personality.h>
#endif
@@ -998,6 +1002,13 @@ int lxc_attach(struct lxc_container *container, lxc_attach_exec_t exec_function,
struct lxc_conf *conf;
char *name, *lxcpath;
struct attach_clone_payload payload = {0};
+#ifdef HAVE_ISULAD
+ struct lxc_exec_command_handler exec_command;
+ const char *suffix = options->suffix;
+
+ exec_command.maincmd_fd = -1;
+ exec_command.terminal = &terminal;
+#endif
ret = access("/proc/self/ns", X_OK);
if (ret)
@@ -1129,6 +1140,12 @@ int lxc_attach(struct lxc_container *container, lxc_attach_exec_t exec_function,
}
terminal.log_fd = options->log_fd;
+#ifdef HAVE_ISULAD
+ if (suffix != NULL) {
+ exec_command.maincmd_fd = lxc_exec_cmd_init(name, lxcpath, suffix);
+ exec_command.terminal = &terminal;
+ }
+#endif
} else {
lxc_terminal_init(&terminal);
}
@@ -1169,6 +1186,15 @@ int lxc_attach(struct lxc_container *container, lxc_attach_exec_t exec_function,
ret = socketpair(PF_LOCAL, SOCK_STREAM | SOCK_CLOEXEC, 0, ipc_sockets);
if (ret < 0) {
SYSERROR("Could not set up required IPC mechanism for attaching");
+#ifdef HAVE_ISULAD
+ if (options->attach_flags & LXC_ATTACH_TERMINAL) {
+ lxc_terminal_delete(&terminal);
+ lxc_terminal_conf_free(&terminal);
+ if (exec_command.maincmd_fd != -1) {
+ close(exec_command.maincmd_fd);
+ }
+ }
+#endif
free(cwd);
lxc_proc_put_context_info(init_ctx);
return -1;
@@ -1184,6 +1210,17 @@ int lxc_attach(struct lxc_container *container, lxc_attach_exec_t exec_function,
pid = fork();
if (pid < 0) {
SYSERROR("Failed to create first subprocess");
+#ifdef HAVE_ISULAD
+ if (options->attach_flags & LXC_ATTACH_TERMINAL) {
+ lxc_terminal_delete(&terminal);
+ lxc_terminal_conf_free(&terminal);
+ if (exec_command.maincmd_fd != -1) {
+ close(exec_command.maincmd_fd);
+ }
+ }
+ close(ipc_sockets[0]);
+ close(ipc_sockets[1]);
+#endif
free(cwd);
lxc_proc_put_context_info(init_ctx);
return -1;
@@ -1239,7 +1276,9 @@ int lxc_attach(struct lxc_container *container, lxc_attach_exec_t exec_function,
ret = lxc_attach_terminal_mainloop_init(&terminal, &descr);
if (ret < 0)
goto on_error;
-
+#ifdef HAVE_ISULAD
+ (void)lxc_exec_cmd_mainloop_add(&descr, &exec_command);
+#endif
TRACE("Initialized terminal mainloop");
}
@@ -1352,6 +1391,11 @@ int lxc_attach(struct lxc_container *container, lxc_attach_exec_t exec_function,
if (options->attach_flags & LXC_ATTACH_TERMINAL) {
lxc_terminal_delete(&terminal);
lxc_terminal_conf_free(&terminal);
+#ifdef HAVE_ISULAD
+ if (exec_command.maincmd_fd != -1) {
+ close(exec_command.maincmd_fd);
+ }
+#endif
}
lxc_proc_put_context_info(init_ctx);
@@ -1365,6 +1409,11 @@ int lxc_attach(struct lxc_container *container, lxc_attach_exec_t exec_function,
lxc_attach_terminal_close_master(&terminal);
lxc_attach_terminal_close_peer(&terminal);
lxc_attach_terminal_close_log(&terminal);
+#ifdef HAVE_ISULAD
+ if (exec_command.maincmd_fd != -1) {
+ close(exec_command.maincmd_fd);
+ }
+#endif
}
/* Wait for the parent to have setup cgroups. */
diff --git a/src/lxc/commands.c b/src/lxc/commands.c
index 0ffc5c7..184a219 100644
--- a/src/lxc/commands.c
+++ b/src/lxc/commands.c
@@ -86,6 +86,7 @@ static const char *lxc_cmd_str(lxc_cmd_t cmd)
[LXC_CMD_GET_INIT_PIDFD] = "get_init_pidfd",
#ifdef HAVE_ISULAD
[LXC_CMD_SET_TERMINAL_FIFOS] = "set_terminal_fifos",
+ [LXC_CMD_SET_TERMINAL_WINCH] = "set_terminal_winch",
#endif
};
@@ -1459,6 +1460,54 @@ static int lxc_cmd_set_terminal_fifos_callback(int fd, struct lxc_cmd_req *req,
return lxc_cmd_rsp_send(fd, &rsp);
}
+
+struct lxc_cmd_set_terminal_winch_request {
+ unsigned int height;
+ unsigned int width;
+};
+
+int lxc_cmd_set_terminal_winch(const char *name, const char *lxcpath, unsigned int height, unsigned int width)
+{
+ int ret = 0, stopped = 0;
+ struct lxc_cmd_set_terminal_winch_request data = { 0 };
+
+ data.height = height;
+ data.width = width;
+
+ struct lxc_cmd_rr cmd = {
+ .req = {
+ .cmd = LXC_CMD_SET_TERMINAL_WINCH,
+ .datalen = sizeof(struct lxc_cmd_set_terminal_winch_request),
+ .data = &data,
+ },
+ };
+
+ ret = lxc_cmd(name, &cmd, &stopped, lxcpath, NULL);
+ if (ret < 0) {
+ ERROR("Failed to send command to container");
+ return -1;
+ }
+
+ if (cmd.rsp.ret != 0) {
+ ERROR("Command response error:%d", cmd.rsp.ret);
+ return -1;
+ }
+ return 0;
+}
+
+static int lxc_cmd_set_terminal_winch_callback(int fd, struct lxc_cmd_req *req,
+ struct lxc_handler *handler, struct lxc_epoll_descr *descr)
+{
+ struct lxc_cmd_rsp rsp;
+ struct lxc_cmd_set_terminal_winch_request *data = (struct lxc_cmd_set_terminal_winch_request *)(req->data);
+ memset(&rsp, 0, sizeof(rsp));
+
+ rsp.ret = lxc_set_terminal_winsz(&handler->conf->console, data->height, data->width);;
+
+ return lxc_cmd_rsp_send(fd, &rsp);
+
+}
+
#endif
static int lxc_cmd_process(int fd, struct lxc_cmd_req *req,
@@ -1490,6 +1539,7 @@ static int lxc_cmd_process(int fd, struct lxc_cmd_req *req,
[LXC_CMD_GET_INIT_PIDFD] = lxc_cmd_get_init_pidfd_callback,
#ifdef HAVE_ISULAD
[LXC_CMD_SET_TERMINAL_FIFOS] = lxc_cmd_set_terminal_fifos_callback,
+ [LXC_CMD_SET_TERMINAL_WINCH] = lxc_cmd_set_terminal_winch_callback,
#endif
};
diff --git a/src/lxc/commands.h b/src/lxc/commands.h
index 95815e6..aa8289d 100644
--- a/src/lxc/commands.h
+++ b/src/lxc/commands.h
@@ -40,6 +40,7 @@ typedef enum {
LXC_CMD_GET_INIT_PIDFD,
#ifdef HAVE_ISULAD
LXC_CMD_SET_TERMINAL_FIFOS,
+ LXC_CMD_SET_TERMINAL_WINCH,
#endif
LXC_CMD_MAX,
} lxc_cmd_t;
@@ -136,6 +137,7 @@ extern int lxc_cmd_get_cgroup2_fd(const char *name, const char *lxcpath);
#ifdef HAVE_ISULAD
extern int lxc_cmd_set_terminal_fifos(const char *name, const char *lxcpath,
const char *in_fifo, const char *out_fifo, const char *err_fifo);
+extern int lxc_cmd_set_terminal_winch(const char *name, const char *lxcpath, unsigned int height, unsigned int width);
#endif
#endif /* __commands_h */
diff --git a/src/lxc/exec_commands.c b/src/lxc/exec_commands.c
new file mode 100644
index 0000000..00129cb
--- /dev/null
+++ b/src/lxc/exec_commands.c
@@ -0,0 +1,416 @@
+/******************************************************************************
+ * Copyright (c) Huawei Technologies Co., Ltd. 2019. All rights reserved.
+ * Author: lifeng
+ * Create: 2019-12-08
+ * Description: provide container definition
+ * lxc: linux Container library
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2.1 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
+ ******************************************************************************/
+
+#ifndef _GNU_SOURCE
+#define _GNU_SOURCE 1
+#endif
+#include <caps.h>
+#include <errno.h>
+#include <fcntl.h>
+#include <malloc.h>
+#include <poll.h>
+#include <signal.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <sys/param.h>
+#include <sys/socket.h>
+#include <sys/un.h>
+#include <unistd.h>
+
+#include "af_unix.h"
+#include "cgroup.h"
+#include "exec_commands.h"
+#include "commands_utils.h"
+#include "conf.h"
+#include "config.h"
+#include "confile.h"
+#include "log.h"
+#include "lxc.h"
+#include "lxclock.h"
+#include "mainloop.h"
+#include "monitor.h"
+#include "terminal.h"
+#include "utils.h"
+
+lxc_log_define(commands_exec, lxc);
+
+static const char *lxc_exec_cmd_str(lxc_exec_cmd_t cmd)
+{
+ static const char *const cmdname[LXC_EXEC_CMD_MAX] = {
+ [LXC_EXEC_CMD_SET_TERMINAL_WINCH] = "set_exec_terminal_winch",
+ };
+
+ if (cmd >= LXC_EXEC_CMD_MAX)
+ return "Invalid request";
+
+ return cmdname[cmd];
+}
+
+static int lxc_exec_cmd_rsp_recv(int sock, struct lxc_exec_cmd_rr *cmd)
+{
+ int ret, rspfd;
+ struct lxc_exec_cmd_rsp *rsp = &cmd->rsp;
+
+ ret = lxc_abstract_unix_recv_fds_timeout(sock, &rspfd, 1, rsp, sizeof(*rsp), 1000 * 1000);
+ if (ret < 0) {
+ SYSERROR("Failed to receive response for command \"%s\"",
+ lxc_exec_cmd_str(cmd->req.cmd));
+
+ if (errno == ECONNRESET || errno == EAGAIN || errno == EWOULDBLOCK) {
+ errno = ECONNRESET; /*isulad set errno ECONNRESET when timeout */
+ return -1;
+ }
+
+ return -1;
+ }
+ TRACE("Command \"%s\" received response", lxc_exec_cmd_str(cmd->req.cmd));
+
+ if (rsp->datalen == 0) {
+ DEBUG("Response data length for command \"%s\" is 0",
+ lxc_exec_cmd_str(cmd->req.cmd));
+ return ret;
+ }
+
+ if (rsp->datalen > LXC_CMD_DATA_MAX) {
+ ERROR("Response data for command \"%s\" is too long: %d bytes > %d",
+ lxc_exec_cmd_str(cmd->req.cmd), rsp->datalen, LXC_CMD_DATA_MAX);
+ return -1;
+ }
+
+ rsp->data = malloc(rsp->datalen);
+ if (!rsp->data) {
+ errno = ENOMEM;
+ ERROR("Failed to allocate response buffer for command \"%s\"",
+ lxc_exec_cmd_str(cmd->req.cmd));
+ return -1;
+ }
+
+ ret = lxc_recv_nointr(sock, rsp->data, rsp->datalen, 0);
+ if (ret != rsp->datalen) {
+ SYSERROR("Failed to receive response data for command \"%s\"",
+ lxc_exec_cmd_str(cmd->req.cmd));
+ return -1;
+ }
+
+ return ret;
+}
+
+static int lxc_exec_cmd_rsp_send(int fd, struct lxc_exec_cmd_rsp *rsp)
+{
+ ssize_t ret;
+
+ errno = EMSGSIZE;
+ ret = lxc_send_nointr(fd, rsp, sizeof(*rsp), MSG_NOSIGNAL);
+ if (ret < 0 || (size_t)ret != sizeof(*rsp)) {
+ SYSERROR("Failed to send command response %zd", ret);
+ return -1;
+ }
+
+ if (!rsp->data || rsp->datalen <= 0)
+ return 0;
+
+ errno = EMSGSIZE;
+ ret = lxc_send_nointr(fd, rsp->data, rsp->datalen, MSG_NOSIGNAL);
+ if (ret < 0 || ret != (ssize_t)rsp->datalen) {
+ SYSWARN("Failed to send command response data %zd", ret);
+ return -1;
+ }
+
+ return 0;
+}
+
+static int lxc_exec_cmd_send(const char *name, struct lxc_exec_cmd_rr *cmd,
+ const char *lxcpath, const char *hashed_sock_name, const char *suffix)
+{
+ int client_fd, saved_errno;
+ ssize_t ret = -1;
+
+ client_fd = lxc_cmd_connect(name, lxcpath, hashed_sock_name, suffix);
+ if (client_fd < 0)
+ return -1;
+
+ ret = lxc_abstract_unix_send_credential(client_fd, &cmd->req,
+ sizeof(cmd->req));
+ if (ret < 0 || (size_t)ret != sizeof(cmd->req))
+ goto on_error;
+
+ if (cmd->req.datalen <= 0)
+ return client_fd;
+
+ errno = EMSGSIZE;
+ ret = lxc_send_nointr(client_fd, (void *)cmd->req.data,
+ cmd->req.datalen, MSG_NOSIGNAL);
+ if (ret < 0 || ret != (ssize_t)cmd->req.datalen)
+ goto on_error;
+
+ return client_fd;
+
+on_error:
+ saved_errno = errno;
+ close(client_fd);
+ errno = saved_errno;
+
+ return -1;
+}
+
+static int lxc_exec_cmd(const char *name, struct lxc_exec_cmd_rr *cmd, const char *lxcpath, const char *hashed_sock_name, const char *suffix)
+{
+ int client_fd = -1;
+ int saved_errno;
+ int ret = -1;
+
+ client_fd = lxc_exec_cmd_send(name, cmd, lxcpath, hashed_sock_name, suffix);
+ if (client_fd < 0) {
+ SYSTRACE("Command \"%s\" failed to connect command socket",
+ lxc_exec_cmd_str(cmd->req.cmd));
+ return -1;
+ }
+
+ ret = lxc_exec_cmd_rsp_recv(client_fd, cmd);
+
+ saved_errno = errno;
+ close(client_fd);
+ errno = saved_errno;
+ return ret;
+}
+
+int lxc_exec_cmd_set_terminal_winch(const char *name, const char *lxcpath, const char *suffix, unsigned int height, unsigned int width)
+{
+ int ret = 0;
+ struct lxc_exec_cmd_set_terminal_winch_request data = { 0 };
+
+ data.height = height;
+ data.width = width;
+
+ struct lxc_exec_cmd_rr cmd = {
+ .req = {
+ .cmd = LXC_EXEC_CMD_SET_TERMINAL_WINCH,
+ .datalen = sizeof(struct lxc_exec_cmd_set_terminal_winch_request),
+ .data = &data,
+ },
+ };
+
+ ret = lxc_exec_cmd(name, &cmd, lxcpath, NULL, suffix);
+ if (ret < 0) {
+ ERROR("Failed to send command to container");
+ return -1;
+ }
+
+ if (cmd.rsp.ret != 0) {
+ ERROR("Command response error:%d", cmd.rsp.ret);
+ return -1;
+ }
+ return 0;
+}
+
+static int lxc_exec_cmd_set_terminal_winch_callback(int fd, struct lxc_exec_cmd_req *req,
+ struct lxc_exec_command_handler *handler)
+{
+ struct lxc_exec_cmd_rsp rsp;
+ struct lxc_exec_cmd_set_terminal_winch_request *data = (struct lxc_exec_cmd_set_terminal_winch_request *)(req->data);
+ memset(&rsp, 0, sizeof(rsp));
+
+ rsp.ret = lxc_set_terminal_winsz(handler->terminal, data->height, data->width);;
+
+ return lxc_exec_cmd_rsp_send(fd, &rsp);
+
+}
+
+static int lxc_exec_cmd_process(int fd, struct lxc_exec_cmd_req *req,
+ struct lxc_exec_command_handler *handler)
+{
+ typedef int (*callback)(int, struct lxc_exec_cmd_req *, struct lxc_exec_command_handler *);
+
+ callback cb[LXC_EXEC_CMD_MAX] = {
+ [LXC_EXEC_CMD_SET_TERMINAL_WINCH] = lxc_exec_cmd_set_terminal_winch_callback,
+ };
+
+ if (req->cmd >= LXC_EXEC_CMD_MAX) {
+ ERROR("Undefined command id %d", req->cmd);
+ return -1;
+ }
+ return cb[req->cmd](fd, req, handler);
+}
+
+static void lxc_exec_cmd_fd_cleanup(int fd, struct lxc_epoll_descr *descr)
+{
+ lxc_mainloop_del_handler(descr, fd);
+ close(fd);
+ return;
+}
+
+static int lxc_exec_cmd_handler(int fd, uint32_t events, void *data,
+ struct lxc_epoll_descr *descr)
+{
+ int ret;
+ struct lxc_exec_cmd_req req;
+ void *reqdata = NULL;
+ struct lxc_exec_command_handler *handler = data;
+
+ ret = lxc_abstract_unix_rcv_credential(fd, &req, sizeof(req));
+ if (ret < 0) {
+ SYSERROR("Failed to receive data on command socket for command "
+ "\"%s\"", lxc_exec_cmd_str(req.cmd));
+
+ if (errno == EACCES) {
+ /* We don't care for the peer, just send and close. */
+ struct lxc_exec_cmd_rsp rsp = {.ret = ret};
+
+ lxc_exec_cmd_rsp_send(fd, &rsp);
+ }
+
+ goto out_close;
+ }
+
+ if (ret == 0)
+ goto out_close;
+
+ if (ret != sizeof(req)) {
+ WARN("Failed to receive full command request. Ignoring request "
+ "for \"%s\"", lxc_exec_cmd_str(req.cmd));
+ ret = -1;
+ goto out_close;
+ }
+
+ if (req.datalen > LXC_CMD_DATA_MAX) {
+ ERROR("Received command data length %d is too large for "
+ "command \"%s\"", req.datalen, lxc_exec_cmd_str(req.cmd));
+ errno = EFBIG;
+ ret = -EFBIG;
+ goto out_close;
+ }
+
+ if (req.datalen > 0) {
+ reqdata = alloca(req.datalen);
+ if (!reqdata) {
+ ERROR("Failed to allocate memory for \"%s\" command",
+ lxc_exec_cmd_str(req.cmd));
+ errno = ENOMEM;
+ ret = -ENOMEM;
+ goto out_close;
+ }
+
+ ret = lxc_recv_nointr(fd, reqdata, req.datalen, 0);
+ if (ret != req.datalen) {
+ WARN("Failed to receive full command request. Ignoring "
+ "request for \"%s\"", lxc_exec_cmd_str(req.cmd));
+ ret = LXC_MAINLOOP_ERROR;
+ goto out_close;
+ }
+
+ req.data = reqdata;
+ }
+
+ ret = lxc_exec_cmd_process(fd, &req, handler);
+ if (ret) {
+ /* This is not an error, but only a request to close fd. */
+ ret = LXC_MAINLOOP_CONTINUE;
+ goto out_close;
+ }
+
+out:
+ return ret;
+
+out_close:
+ lxc_exec_cmd_fd_cleanup(fd, descr);
+ goto out;
+}
+
+static int lxc_exec_cmd_accept(int fd, uint32_t events, void *data,
+ struct lxc_epoll_descr *descr)
+{
+ int connection = -1;
+ int opt = 1, ret = -1;
+
+ connection = accept(fd, NULL, 0);
+ if (connection < 0) {
+ SYSERROR("Failed to accept connection to run command");
+ return LXC_MAINLOOP_ERROR;
+ }
+
+ ret = fcntl(connection, F_SETFD, FD_CLOEXEC);
+ if (ret < 0) {
+ SYSERROR("Failed to set close-on-exec on incoming command connection");
+ goto out_close;
+ }
+
+ ret = setsockopt(connection, SOL_SOCKET, SO_PASSCRED, &opt, sizeof(opt));
+ if (ret < 0) {
+ SYSERROR("Failed to enable necessary credentials on command socket");
+ goto out_close;
+ }
+
+ ret = lxc_mainloop_add_handler(descr, connection, lxc_exec_cmd_handler, data);
+ if (ret) {
+ ERROR("Failed to add command handler");
+ goto out_close;
+ }
+
+out:
+ return ret;
+
+out_close:
+ close(connection);
+ goto out;
+}
+
+int lxc_exec_cmd_init(const char *name, const char *lxcpath, const char *suffix)
+{
+ int fd, ret;
+ char path[LXC_AUDS_ADDR_LEN] = {0};
+
+ ret = lxc_make_abstract_socket_name(path, sizeof(path), name, lxcpath, NULL, suffix);
+ if (ret < 0)
+ return -1;
+ TRACE("Creating abstract unix socket \"%s\"", &path[1]);
+
+ fd = lxc_abstract_unix_open(path, SOCK_STREAM, 0);
+ if (fd < 0) {
+ SYSERROR("Failed to create command socket %s", &path[1]);
+ if (errno == EADDRINUSE)
+ ERROR("Container \"%s\" appears to be already running", name);
+
+ return -1;
+ }
+
+ ret = fcntl(fd, F_SETFD, FD_CLOEXEC);
+ if (ret < 0) {
+ SYSERROR("Failed to set FD_CLOEXEC on command socket file descriptor");
+ close(fd);
+ return -1;
+ }
+
+ return fd;
+}
+
+int lxc_exec_cmd_mainloop_add(struct lxc_epoll_descr *descr, struct lxc_exec_command_handler *handler)
+{
+ int ret;
+ int fd = handler->maincmd_fd;
+
+ ret = lxc_mainloop_add_handler(descr, fd, lxc_exec_cmd_accept, handler);
+ if (ret < 0) {
+ ERROR("Failed to add handler for command socket");
+ close(fd);
+ }
+
+ return ret;
+}
diff --git a/src/lxc/exec_commands.h b/src/lxc/exec_commands.h
new file mode 100644
index 0000000..2581ee9
--- /dev/null
+++ b/src/lxc/exec_commands.h
@@ -0,0 +1,73 @@
+/******************************************************************************
+ * Copyright (c) Huawei Technologies Co., Ltd. 2019. All rights reserved.
+ * Author: lifeng
+ * Create: 2019-12-08
+ * Description: provide container definition
+ * lxc: linux Container library
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2.1 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
+ ******************************************************************************/
+
+#ifndef __LXC_EXEC_COMMANDS_H
+#define __LXC_EXEC_COMMANDS_H
+
+#include <stdio.h>
+#include <sys/types.h>
+#include <unistd.h>
+
+#include "lxccontainer.h"
+#include "macro.h"
+#include "state.h"
+#include "terminal.h"
+
+struct lxc_exec_command_handler {
+ int maincmd_fd;
+ struct lxc_terminal *terminal;
+};
+
+typedef enum {
+ LXC_EXEC_CMD_SET_TERMINAL_WINCH,
+ LXC_EXEC_CMD_MAX,
+} lxc_exec_cmd_t;
+
+struct lxc_exec_cmd_req {
+ lxc_exec_cmd_t cmd;
+ int datalen;
+ const void *data;
+};
+
+struct lxc_exec_cmd_rsp {
+ int ret; /* 0 on success, -errno on failure */
+ int datalen;
+ void *data;
+};
+
+struct lxc_exec_cmd_rr {
+ struct lxc_exec_cmd_req req;
+ struct lxc_exec_cmd_rsp rsp;
+};
+
+struct lxc_exec_cmd_set_terminal_winch_request {
+ unsigned int height;
+ unsigned int width;
+};
+
+struct lxc_epoll_descr;
+struct lxc_handler;
+
+extern int lxc_exec_cmd_init(const char *name, const char *lxcpath, const char *suffix);
+extern int lxc_exec_cmd_mainloop_add(struct lxc_epoll_descr *descr, struct lxc_exec_command_handler *handler);
+extern int lxc_exec_cmd_set_terminal_winch(const char *name, const char *lxcpath, const char *suffix, unsigned int height, unsigned int width);
+
+#endif /* __exec_commands_h */
diff --git a/src/lxc/lxccontainer.c b/src/lxc/lxccontainer.c
index d0e6e2b..75c1bbc 100644
--- a/src/lxc/lxccontainer.c
+++ b/src/lxc/lxccontainer.c
@@ -62,6 +62,10 @@
#include "utils.h"
#include "version.h"
+#ifdef HAVE_ISULAD
+#include "exec_commands.h"
+#endif
+
#if HAVE_OPENSSL
#include <openssl/evp.h>
#endif
@@ -5444,6 +5448,50 @@ static bool do_lxcapi_add_terminal_fifo(struct lxc_container *c, const char *in_
}
WRAP_API_3(bool, lxcapi_add_terminal_fifo, const char *, const char *, const char *)
+
+static bool do_lxcapi_set_terminal_winch(struct lxc_container *c, unsigned int height, unsigned int width)
+{
+ bool ret = true;
+
+ if (!c || !c->lxc_conf)
+ return false;
+ if (container_mem_lock(c)) {
+ ERROR("Error getting mem lock");
+ return false;
+ }
+
+ if (lxc_cmd_set_terminal_winch(c->name, c->config_path, height, width)) {
+ ERROR("Error set terminal winch");
+ ret = false;
+ }
+
+ container_mem_unlock(c);
+ return ret;
+}
+
+WRAP_API_2(bool, lxcapi_set_terminal_winch, unsigned int, unsigned int)
+
+static bool do_lxcapi_set_exec_terminal_winch(struct lxc_container *c, const char *suffix, unsigned int height, unsigned int width)
+{
+ bool ret = true;
+
+ if (!c || !c->lxc_conf)
+ return false;
+ if (container_mem_lock(c)) {
+ ERROR("Error getting mem lock");
+ return false;
+ }
+
+ if (lxc_exec_cmd_set_terminal_winch(c->name, c->config_path, suffix, height, width)) {
+ ERROR("Error set terminal winch");
+ ret = false;
+ }
+
+ container_mem_unlock(c);
+ return ret;
+}
+
+WRAP_API_3(bool, lxcapi_set_exec_terminal_winch, const char *, unsigned int, unsigned int)
#endif
struct lxc_container *lxc_container_new(const char *name, const char *configpath)
@@ -5591,6 +5639,8 @@ struct lxc_container *lxc_container_new(const char *name, const char *configpath
c->set_container_info_file = lxcapi_set_container_info_file;
c->set_terminal_init_fifos = lxcapi_set_terminal_default_fifos;
c->add_terminal_fifos = lxcapi_add_terminal_fifo;
+ c->set_terminal_winch = lxcapi_set_terminal_winch;
+ c->set_exec_terminal_winch = lxcapi_set_exec_terminal_winch;
#endif
return c;
diff --git a/src/lxc/terminal.c b/src/lxc/terminal.c
index 1f46d49..39a6718 100644
--- a/src/lxc/terminal.c
+++ b/src/lxc/terminal.c
@@ -187,6 +187,33 @@ static int lxc_terminal_truncate_log_file(struct lxc_terminal *terminal)
}
#ifdef HAVE_ISULAD
+
+int lxc_set_terminal_winsz(struct lxc_terminal *terminal, unsigned int height, unsigned int width)
+{
+ int ret = 0;
+ struct winsize wsz;
+
+ if (terminal->master < 0) {
+ return 0;
+ }
+
+ ret = ioctl(terminal->master, TIOCGWINSZ, &wsz);
+ if (ret < 0) {
+ WARN("Failed to get window size");
+ return -1;
+ }
+ wsz.ws_col = width;
+ wsz.ws_row = height;
+
+ ret = ioctl(terminal->master, TIOCSWINSZ, &wsz);
+ if (ret < 0)
+ WARN("Failed to set window size");
+ else
+ DEBUG("Set window size to %d columns and %d rows", wsz.ws_col,
+ wsz.ws_row);
+ return ret;
+}
+
/*
* isulad: support mult-logfiles
* */
diff --git a/src/lxc/terminal.h b/src/lxc/terminal.h
index b4160b3..f49142d 100644
--- a/src/lxc/terminal.h
+++ b/src/lxc/terminal.h
@@ -276,6 +276,7 @@ extern int lxc_terminal_map_ids(struct lxc_conf *c,
#ifdef HAVE_ISULAD
int lxc_terminal_add_fifos(struct lxc_conf *conf, const char *fifonames);
+int lxc_set_terminal_winsz(struct lxc_terminal *terminal, unsigned int height, unsigned int width);
#endif
#endif /* __LXC_TERMINAL_H */
--
1.8.3.1

104
0020-confile-decode-escape-charactors-in-config.patch
View File

@ -1,104 +0,0 @@
From 200cc2a1e95c0c0f17cf14f16d8ceb60ca3628c0 Mon Sep 17 00:00:00 2001
From: LiFeng <lifeng68@huawei.com>
Date: Tue, 14 Apr 2020 16:16:14 +0800
Subject: [PATCH 20/49] confile: decode escape charactors in config
Signed-off-by: LiFeng <lifeng68@huawei.com>
---
src/lxc/confile.c | 62 +++++++++++++++++++++++++++++++++++++++++++++++++++++++
1 file changed, 62 insertions(+)
diff --git a/src/lxc/confile.c b/src/lxc/confile.c
index bf0fdf0..a28c5da 100644
--- a/src/lxc/confile.c
+++ b/src/lxc/confile.c
@@ -2732,6 +2732,54 @@ struct parse_line_conf {
bool from_include;
};
+#ifdef HAVE_ISULAD
+// escape_string_decode compress some escape characters
+static char *escape_string_decode(const char *src)
+{
+ size_t src_end = 0;
+ size_t dst_end = 0;
+ size_t len = 0;
+ char *dst = NULL;
+
+ if (src == NULL) {
+ return NULL;
+ }
+
+ len = strlen(src);
+ if (len == 0) {
+ return NULL;
+ }
+
+ dst = calloc(1, len + 1);
+ if (dst == NULL) {
+ ERROR("Out of memory");
+ return NULL;
+ }
+
+ while(src_end < len) {
+ if (src[src_end] == '\\') {
+ switch (src[++src_end])
+ {
+ case 'r': dst[dst_end] = '\r'; break;
+ case 'n': dst[dst_end] = '\n'; break;
+ case 'f': dst[dst_end] = '\f'; break;
+ case 'b': dst[dst_end] = '\b'; break;
+ case 't': dst[dst_end] = '\t'; break;
+ case '\\': dst[dst_end] = '\\'; break;
+ // default do not decode
+ default: dst[dst_end++] = '\\'; dst[dst_end] = src[src_end]; break;
+ }
+ } else {
+ dst[dst_end] = src[src_end];
+ }
+ dst_end++;
+ src_end++;
+ }
+
+ return dst;
+}
+#endif
+
static int parse_line(char *buffer, void *data)
{
char *dot, *key, *line, *linep, *value;
@@ -2740,6 +2788,9 @@ static int parse_line(char *buffer, void *data)
int ret = 0;
char *dup = buffer;
struct parse_line_conf *plc = data;
+#ifdef HAVE_ISULAD
+ char *value_decode = NULL;
+#endif
/* If there are newlines in the config file we should keep them. */
empty_line = lxc_is_line_empty(dup);
@@ -2806,10 +2857,21 @@ static int parse_line(char *buffer, void *data)
goto on_error;
}
+#ifdef HAVE_ISULAD
+ value_decode = escape_string_decode(value);
+ if (value_decode == NULL) {
+ ERROR("Value %s decode failed", value);
+ }
+ ret = config->set(key, value_decode ? value_decode: value, plc->conf, NULL);
+#else
ret = config->set(key, value, plc->conf, NULL);
+#endif
on_error:
free(linep);
+#ifdef HAVE_ISULAD
+ free(value_decode);
+#endif
return ret;
}
--
1.8.3.1

387
0021-cgroup-add-retry-for-destory-cgroups.patch
View File

@ -1,387 +0,0 @@
From 4814d02fd3d364b599707b3cb298a8cc945033f9 Mon Sep 17 00:00:00 2001
From: LiFeng <lifeng68@huawei.com>
Date: Tue, 14 Apr 2020 17:07:24 +0800
Subject: [PATCH 21/49] cgroup: add retry for destory cgroups
Signed-off-by: LiFeng <lifeng68@huawei.com>
---
src/lxc/cgroups/cgfsng.c | 105 +++++++++++++++++++++++++
src/lxc/cgroups/cgroup.h | 4 +
src/lxc/start.c | 195 ++++++++++++++++++++++++++++++++++++++++++++++-
3 files changed, 303 insertions(+), 1 deletion(-)
diff --git a/src/lxc/cgroups/cgfsng.c b/src/lxc/cgroups/cgfsng.c
index 881dd39..00270ab 100644
--- a/src/lxc/cgroups/cgfsng.c
+++ b/src/lxc/cgroups/cgfsng.c
@@ -1000,6 +1000,106 @@ static int cgroup_tree_remove_wrapper(void *data)
return cgroup_tree_remove(arg->hierarchies, arg->container_cgroup);
}
+#ifdef HAVE_ISULAD
+
+static int isulad_cgroup_tree_remove(struct hierarchy **hierarchies,
+ const char *container_cgroup)
+{
+ if (!container_cgroup || !hierarchies)
+ return 0;
+
+ for (int i = 0; hierarchies[i]; i++) {
+ struct hierarchy *h = hierarchies[i];
+ int ret;
+
+ if (!h->container_full_path)
+ continue;
+
+ ret = lxc_rm_rf(h->container_full_path);
+ if (ret < 0) {
+ SYSERROR("Failed to destroy \"%s\"", h->container_full_path);
+ return -1;
+ }
+
+ free_disarm(h->container_full_path);
+ }
+
+ return 0;
+}
+
+static int isulad_cgroup_tree_remove_wrapper(void *data)
+{
+ struct generic_userns_exec_data *arg = data;
+ uid_t nsuid = (arg->conf->root_nsuid_map != NULL) ? 0 : arg->conf->init_uid;
+ gid_t nsgid = (arg->conf->root_nsgid_map != NULL) ? 0 : arg->conf->init_gid;
+ int ret;
+
+ if (!lxc_setgroups(0, NULL) && errno != EPERM)
+ return log_error_errno(-1, errno, "Failed to setgroups(0, NULL)");
+
+ ret = setresgid(nsgid, nsgid, nsgid);
+ if (ret < 0)
+ return log_error_errno(-1, errno, "Failed to setresgid(%d, %d, %d)",
+ (int)nsgid, (int)nsgid, (int)nsgid);
+
+ ret = setresuid(nsuid, nsuid, nsuid);
+ if (ret < 0)
+ return log_error_errno(-1, errno, "Failed to setresuid(%d, %d, %d)",
+ (int)nsuid, (int)nsuid, (int)nsuid);
+
+ return isulad_cgroup_tree_remove(arg->hierarchies, arg->container_cgroup);
+}
+
+__cgfsng_ops static bool isulad_cgfsng_payload_destroy(struct cgroup_ops *ops,
+ struct lxc_handler *handler)
+{
+ int ret;
+
+ if (!ops) {
+ ERROR("Called with uninitialized cgroup operations");
+ return false;
+ }
+
+ if (!ops->hierarchies) {
+ return false;
+ }
+
+ if (!handler) {
+ ERROR("Called with uninitialized handler");
+ return false;
+ }
+
+ if (!handler->conf) {
+ ERROR("Called with uninitialized conf");
+ return false;
+ }
+
+#ifdef HAVE_STRUCT_BPF_CGROUP_DEV_CTX
+ ret = bpf_program_cgroup_detach(handler->conf->cgroup2_devices);
+ if (ret < 0)
+ WARN("Failed to detach bpf program from cgroup");
+#endif
+
+ if (handler->conf && !lxc_list_empty(&handler->conf->id_map)) {
+ struct generic_userns_exec_data wrap = {
+ .conf = handler->conf,
+ .container_cgroup = ops->container_cgroup,
+ .hierarchies = ops->hierarchies,
+ .origuid = 0,
+ };
+ ret = userns_exec_1(handler->conf, isulad_cgroup_tree_remove_wrapper,
+ &wrap, "cgroup_tree_remove_wrapper");
+ } else {
+ ret = isulad_cgroup_tree_remove(ops->hierarchies, ops->container_cgroup);
+ }
+ if (ret < 0) {
+ SYSWARN("Failed to destroy cgroups");
+ return false;
+ }
+
+ return true;
+}
+#else
__cgfsng_ops static void cgfsng_payload_destroy(struct cgroup_ops *ops,
struct lxc_handler *handler)
{
@@ -1044,6 +1144,7 @@ __cgfsng_ops static void cgfsng_payload_destroy(struct cgroup_ops *ops,
if (ret < 0)
SYSWARN("Failed to destroy cgroups");
}
+#endif
#ifdef HAVE_ISULAD
__cgfsng_ops static void cgfsng_monitor_destroy(struct cgroup_ops *ops,
@@ -4107,7 +4208,11 @@ struct cgroup_ops *cgfsng_ops_init(struct lxc_conf *conf)
return NULL;
cgfsng_ops->data_init = cgfsng_data_init;
+#ifdef HAVE_ISULAD
+ cgfsng_ops->payload_destroy = isulad_cgfsng_payload_destroy;
+#else
cgfsng_ops->payload_destroy = cgfsng_payload_destroy;
+#endif
cgfsng_ops->monitor_destroy = cgfsng_monitor_destroy;
cgfsng_ops->monitor_create = cgfsng_monitor_create;
cgfsng_ops->monitor_enter = cgfsng_monitor_enter;
diff --git a/src/lxc/cgroups/cgroup.h b/src/lxc/cgroups/cgroup.h
index dcdc76b..a9048c4 100644
--- a/src/lxc/cgroups/cgroup.h
+++ b/src/lxc/cgroups/cgroup.h
@@ -144,7 +144,11 @@ struct cgroup_ops {
cgroup_layout_t cgroup_layout;
int (*data_init)(struct cgroup_ops *ops, struct lxc_conf *conf);
+#ifdef HAVE_ISULAD
+ bool (*payload_destroy)(struct cgroup_ops *ops, struct lxc_handler *handler);
+#else
void (*payload_destroy)(struct cgroup_ops *ops, struct lxc_handler *handler);
+#endif
void (*monitor_destroy)(struct cgroup_ops *ops, struct lxc_handler *handler);
bool (*monitor_create)(struct cgroup_ops *ops, struct lxc_handler *handler);
bool (*monitor_enter)(struct cgroup_ops *ops, struct lxc_handler *handler);
diff --git a/src/lxc/start.c b/src/lxc/start.c
index 800f884..0942c31 100644
--- a/src/lxc/start.c
+++ b/src/lxc/start.c
@@ -879,6 +879,170 @@ out_restore_sigmask:
return -1;
}
+#ifdef HAVE_ISULAD
+void trim_line(char *s)
+{
+ size_t len;
+
+ len = strlen(s);
+ while ((len > 1) && (s[len - 1] == '\n'))
+ s[--len] = '\0';
+}
+
+static int _read_procs_file(const char *path, pid_t **pids, size_t *len)
+{
+ FILE *f;
+ char *line = NULL;
+ size_t sz = 0;
+ pid_t *tmp_pids = NULL;
+
+ f = fopen_cloexec(path, "r");
+ if (!f)
+ return -1;
+
+ while (getline(&line, &sz, f) != -1) {
+ pid_t pid;
+ trim_line(line);
+ pid = (pid_t)atoll(line);
+ if (lxc_mem_realloc((void **)&tmp_pids, sizeof(pid_t) * (*len + 1), *pids, sizeof(pid_t) * (*len)) != 0) {
+ free(*pids);
+ *pids = NULL;
+ ERROR("out of memory");
+ free(line);
+ fclose(f);
+ return -1;
+ }
+ *pids = tmp_pids;
+
+ (*pids)[*len] = pid;
+ (*len)++;
+ }
+
+ free(line);
+ fclose(f);
+ return 0;
+}
+
+static int _recursive_read_cgroup_procs(const char *dirpath, pid_t **pids, size_t *len)
+{
+ struct dirent *direntp = NULL;
+ DIR *dir = NULL;
+ int ret, failed = 0;
+ char pathname[PATH_MAX];
+
+ dir = opendir(dirpath);
+ if (dir == NULL) {
+ WARN("Failed to open \"%s\"", dirpath);
+ return 0;
+ }
+
+ while ((direntp = readdir(dir))) {
+ struct stat mystat;
+ int rc;
+
+ if (!strcmp(direntp->d_name, ".") ||
+ !strcmp(direntp->d_name, ".."))
+ continue;
+
+ rc = snprintf(pathname, PATH_MAX, "%s/%s", dirpath, direntp->d_name);
+ if (rc < 0 || rc >= PATH_MAX) {
+ failed = 1;
+ continue;
+ }
+
+ if (strcmp(direntp->d_name, "cgroup.procs") == 0) {
+ if (_read_procs_file(pathname, pids, len)) {
+ failed = 1;
+
+ }
+ continue;
+ }
+
+ ret = lstat(pathname, &mystat);
+ if (ret) {
+ failed = 1;
+ continue;
+ }
+
+ if (S_ISDIR(mystat.st_mode)) {
+ if (_recursive_read_cgroup_procs(pathname, pids, len) < 0)
+ failed = 1;
+ }
+ }
+
+ ret = closedir(dir);
+ if (ret) {
+ WARN("Failed to close directory \"%s\"", dirpath);
+ failed = 1;
+ }
+
+ return failed ? -1 : 0;
+}
+
+int get_all_pids(struct cgroup_ops *cg_ops, pid_t **pids, size_t *len)
+{
+ const char *devices_path = NULL;
+
+ devices_path = cg_ops->get_cgroup_full_path(cg_ops, "devices");
+ if (!file_exists(devices_path)) {
+ return 0;
+ }
+
+ return _recursive_read_cgroup_procs(devices_path, pids, len);
+}
+
+static int set_cgroup_freezer(struct cgroup_ops *cg_ops, const char *value)
+{
+ char *fullpath;
+ int ret;
+
+ fullpath = must_make_path(cg_ops->get_cgroup_full_path(cg_ops, "freezer"), "freezer.state", NULL);
+ ret = lxc_write_to_file(fullpath, value, strlen(value), false, 0666);
+ free(fullpath);
+ return ret;
+}
+
+/* isulad: kill all process in container cgroup path */
+static void signal_all_processes(struct lxc_handler *handler)
+{
+ int ret;
+ struct cgroup_ops *cg_ops = handler->cgroup_ops;
+ pid_t *pids = NULL;
+ size_t len = 0, i;
+
+ ret = set_cgroup_freezer(cg_ops, "FROZEN");
+ if (ret < 0 && errno != ENOENT) {
+ WARN("cgroup_set frozen failed");
+ }
+
+ ret = get_all_pids(cg_ops, &pids, &len);
+ if (ret < 0) {
+ WARN("failed to get all pids");
+ }
+
+ for (i = 0; i < len; i++) {
+ ret = kill(pids[i], SIGKILL);
+ if (ret < 0 && errno != ESRCH) {
+ WARN("Can not kill process (pid=%d) with SIGKILL for container %s", pids[i], handler->name);
+ }
+ }
+
+ ret = set_cgroup_freezer(cg_ops, "THAWED");
+ if (ret < 0 && errno != ENOENT) {
+ WARN("cgroup_set thawed failed");
+ }
+
+ for (i = 0; i < len; i++) {
+ ret = lxc_wait_for_pid_status(pids[i]);
+ if (ret < 0 && errno != ECHILD) {
+ WARN("Failed to wait pid %d for container %s: %s", pids[i], handler->name, strerror(errno));
+ }
+ }
+
+ free(pids);
+}
+#endif
+
void lxc_end(struct lxc_handler *handler)
{
int ret;
@@ -952,11 +1116,37 @@ void lxc_end(struct lxc_handler *handler)
lsm_process_cleanup(handler->conf, handler->lxcpath);
+#ifdef HAVE_ISULAD
+ // close maincmd fd before destroy cgroup for isulad
+ if (handler->conf->reboot == REBOOT_NONE) {
+ /* For all new state clients simply close the command socket.
+ * This will inform all state clients that the container is
+ * STOPPED and also prevents a race between a open()/close() on
+ * the command socket causing a new process to get ECONNREFUSED
+ * because we haven't yet closed the command socket.
+ */
+ close_prot_errno_disarm(handler->conf->maincmd_fd);
+ TRACE("Closed command socket");
+ }
+ int retry_count = 0;
+ int max_retry = 10;
+retry:
+ if (cgroup_ops != NULL && !cgroup_ops->payload_destroy(cgroup_ops, handler)) {
+ TRACE("Trying to kill all subprocess");
+ signal_all_processes(handler);
+ TRACE("Finished kill all subprocess");
+ if (retry_count < max_retry) {
+ usleep(100 * 1000); /* 100 millisecond */
+ retry_count++;
+ goto retry;
+ }
+ SYSERROR("Failed to destroy cgroup path for container: \"%s\"", handler->name);
+ }
+#else
if (cgroup_ops) {
cgroup_ops->payload_destroy(cgroup_ops, handler);
cgroup_ops->monitor_destroy(cgroup_ops, handler);
}
-
if (handler->conf->reboot == REBOOT_NONE) {
/* For all new state clients simply close the command socket.
* This will inform all state clients that the container is
@@ -966,7 +1156,10 @@ void lxc_end(struct lxc_handler *handler)
*/
close_prot_errno_disarm(handler->conf->maincmd_fd);
TRACE("Closed command socket");
+ }
+#endif
+ if (handler->conf->reboot == REBOOT_NONE) {
/* This function will try to connect to the legacy lxc-monitord
* state server and only exists for backwards compatibility.
*/
--
1.8.3.1

313
0022-support-terminal-log.patch
View File

@ -1,313 +0,0 @@
From cd19f650d43fdae95e7e72bebe207f4ddc9deb85 Mon Sep 17 00:00:00 2001
From: haozi007 <liuhao27@huawei.com>
Date: Mon, 13 Apr 2020 19:18:26 +0800
Subject: [PATCH 22/49] support terminal log
Signed-off-by: haozi007 <liuhao27@huawei.com>
---
src/lxc/commands.c | 14 ++++++------
src/lxc/conf.c | 6 ++++++
src/lxc/confile.c | 3 +++
src/lxc/log.c | 54 +++++++++++++++++++++++------------------------
src/lxc/lxccontainer.c | 2 ++
src/lxc/start.c | 48 ++++++++++++++++++++---------------------
src/lxc/terminal.c | 1 +
src/lxc/tools/lxc_start.c | 6 ++++++
8 files changed, 76 insertions(+), 58 deletions(-)
diff --git a/src/lxc/commands.c b/src/lxc/commands.c
index 184a219..b21c12b 100644
--- a/src/lxc/commands.c
+++ b/src/lxc/commands.c
@@ -80,9 +80,9 @@ static const char *lxc_cmd_str(lxc_cmd_t cmd)
[LXC_CMD_SERVE_STATE_CLIENTS] = "serve_state_clients",
[LXC_CMD_SECCOMP_NOTIFY_ADD_LISTENER] = "seccomp_notify_add_listener",
[LXC_CMD_ADD_BPF_DEVICE_CGROUP] = "add_bpf_device_cgroup",
- [LXC_CMD_FREEZE] = "freeze",
- [LXC_CMD_UNFREEZE] = "unfreeze",
- [LXC_CMD_GET_CGROUP2_FD] = "get_cgroup2_fd",
+ [LXC_CMD_FREEZE] = "freeze",
+ [LXC_CMD_UNFREEZE] = "unfreeze",
+ [LXC_CMD_GET_CGROUP2_FD] = "get_cgroup2_fd",
[LXC_CMD_GET_INIT_PIDFD] = "get_init_pidfd",
#ifdef HAVE_ISULAD
[LXC_CMD_SET_TERMINAL_FIFOS] = "set_terminal_fifos",
@@ -1532,10 +1532,10 @@ static int lxc_cmd_process(int fd, struct lxc_cmd_req *req,
[LXC_CMD_CONSOLE_LOG] = lxc_cmd_console_log_callback,
[LXC_CMD_SERVE_STATE_CLIENTS] = lxc_cmd_serve_state_clients_callback,
[LXC_CMD_SECCOMP_NOTIFY_ADD_LISTENER] = lxc_cmd_seccomp_notify_add_listener_callback,
- [LXC_CMD_ADD_BPF_DEVICE_CGROUP] = lxc_cmd_add_bpf_device_cgroup_callback,
- [LXC_CMD_FREEZE] = lxc_cmd_freeze_callback,
- [LXC_CMD_UNFREEZE] = lxc_cmd_unfreeze_callback,
- [LXC_CMD_GET_CGROUP2_FD] = lxc_cmd_get_cgroup2_fd_callback,
+ [LXC_CMD_ADD_BPF_DEVICE_CGROUP] = lxc_cmd_add_bpf_device_cgroup_callback,
+ [LXC_CMD_FREEZE] = lxc_cmd_freeze_callback,
+ [LXC_CMD_UNFREEZE] = lxc_cmd_unfreeze_callback,
+ [LXC_CMD_GET_CGROUP2_FD] = lxc_cmd_get_cgroup2_fd_callback,
[LXC_CMD_GET_INIT_PIDFD] = lxc_cmd_get_init_pidfd_callback,
#ifdef HAVE_ISULAD
[LXC_CMD_SET_TERMINAL_FIFOS] = lxc_cmd_set_terminal_fifos_callback,
diff --git a/src/lxc/conf.c b/src/lxc/conf.c
index 2e93227..4088363 100644
--- a/src/lxc/conf.c
+++ b/src/lxc/conf.c
@@ -1767,6 +1767,9 @@ static int lxc_setup_ttydir_console(const struct lxc_rootfs *rootfs,
if (ret < 0 && errno != EEXIST)
return log_error_errno(-errno, errno, "Failed to create console");
+#ifdef HAVE_ISULAD
+ if (console->slave > 0) {
+#endif
ret = fchmod(console->slave, S_IXUSR | S_IXGRP);
if (ret < 0)
return log_error_errno(-errno, errno, "Failed to set mode \"0%o\" to \"%s\"", S_IXUSR | S_IXGRP, console->name);
@@ -1776,6 +1779,9 @@ static int lxc_setup_ttydir_console(const struct lxc_rootfs *rootfs,
if (ret < 0)
return log_error_errno(-1, errno, "Failed to mount \"%s\" on \"%s\"", console->name, lxcpath);
DEBUG("Mounted \"%s\" onto \"%s\"", console->name, lxcpath);
+#ifdef HAVE_ISULAD
+ }
+#endif
/* bind mount '/dev/<ttydir>/console' to '/dev/console' */
ret = safe_mount(lxcpath, path, "none", MS_BIND, 0, rootfs_path);
diff --git a/src/lxc/confile.c b/src/lxc/confile.c
index a28c5da..0fcebd4 100644
--- a/src/lxc/confile.c
+++ b/src/lxc/confile.c
@@ -2301,11 +2301,14 @@ static int set_config_console_rotate(const char *key, const char *value,
if (lxc_safe_uint(value, &lxc_conf->console.log_rotate) < 0)
return -1;
+#ifndef HAVE_ISULAD
+ /* isulad: support rotate muti-files */
if (lxc_conf->console.log_rotate > 1) {
ERROR("The \"lxc.console.rotate\" config key can only be set "
"to 0 or 1");
return -1;
}
+#endif
return 0;
}
diff --git a/src/lxc/log.c b/src/lxc/log.c
index 9794582..79caa2c 100644
--- a/src/lxc/log.c
+++ b/src/lxc/log.c
@@ -60,30 +60,30 @@ static inline const char *isulad_get_fifo_path(const char *file)
{
#define ISULAD_FIFO_PREFIX "fifo:"
- if (strncmp(file, ISULAD_FIFO_PREFIX, strlen(ISULAD_FIFO_PREFIX)) == 0) {
- return (file + strlen(ISULAD_FIFO_PREFIX));
- }
- return NULL;
+ if (strncmp(file, ISULAD_FIFO_PREFIX, strlen(ISULAD_FIFO_PREFIX)) == 0) {
+ return (file + strlen(ISULAD_FIFO_PREFIX));
+ }
+ return NULL;
}
static int isulad_open_fifo(const char *file_path)
{
#define LOG_FIFO_SIZE (1024 * 1024)
- int fd;
+ int fd;
- fd = lxc_unpriv(open(file_path, O_RDWR | O_NONBLOCK | O_CLOEXEC, 0640));
- if (fd == -1) {
- fprintf(stderr, "Open fifo %s failed: %s\n", file_path, strerror(errno));
- return -1;
- }
+ fd = lxc_unpriv(open(file_path, O_RDWR | O_NONBLOCK | O_CLOEXEC, 0640));
+ if (fd == -1) {
+ fprintf(stderr, "Open fifo %s failed: %s\n", file_path, strerror(errno));
+ return -1;
+ }
- if (fcntl(fd, F_SETPIPE_SZ, LOG_FIFO_SIZE) == -1) {
- printf("Set fifo buffer size failed: %s", strerror(errno));
- close(fd);
- return -1;
- }
+ if (fcntl(fd, F_SETPIPE_SZ, LOG_FIFO_SIZE) == -1) {
+ printf("Set fifo buffer size failed: %s", strerror(errno));
+ close(fd);
+ return -1;
+ }
- return fd;
+ return fd;
}
#endif
@@ -354,10 +354,10 @@ static int log_append_logfile(const struct lxc_log_appender *appender,
log_container_name = lxc_log_get_container_name();
#ifdef HAVE_ISULAD
- /* use isulad log format */
- if (log_container_name != NULL && strlen(log_container_name) > 15) {
- log_container_name = log_container_name + (strlen(log_container_name) - 15);
- }
+ /* use isulad log format */
+ if (log_container_name != NULL && strlen(log_container_name) > 15) {
+ log_container_name = log_container_name + (strlen(log_container_name) - 15);
+ }
#endif
if (fd_to_use < 0)
@@ -633,10 +633,10 @@ static int __lxc_log_set_file(const char *fname, int create_dirs)
}
#ifdef HAVE_ISULAD
- fname = isulad_get_fifo_path(fname);
- if (fname == NULL) {
- return ret_errno(EINVAL);
- }
+ fname = isulad_get_fifo_path(fname);
+ if (fname == NULL) {
+ return ret_errno(EINVAL);
+ }
#endif
#if USE_CONFIGPATH_LOGS
@@ -649,7 +649,7 @@ static int __lxc_log_set_file(const char *fname, int create_dirs)
return log_error_errno(-errno, errno, "Failed to create dir for log file \"%s\"", fname);
#if HAVE_ISULAD
- lxc_log_fd = isulad_open_fifo(fname);
+ lxc_log_fd = isulad_open_fifo(fname);
#else
lxc_log_fd = log_open(fname);
#endif
@@ -749,9 +749,9 @@ int lxc_log_init(struct lxc_log *log)
if (lxc_log_fd >= 0) {
lxc_log_category_lxc.appender = &log_appender_logfile;
#ifdef HAVE_ISULAD
- if (!lxc_quiet_specified && !log->quiet)
+ if (!lxc_quiet_specified && !log->quiet)
#endif
- lxc_log_category_lxc.appender->next = &log_appender_stderr;
+ lxc_log_category_lxc.appender->next = &log_appender_stderr;
}
return ret;
diff --git a/src/lxc/lxccontainer.c b/src/lxc/lxccontainer.c
index 75c1bbc..821cfa1 100644
--- a/src/lxc/lxccontainer.c
+++ b/src/lxc/lxccontainer.c
@@ -5641,6 +5641,8 @@ struct lxc_container *lxc_container_new(const char *name, const char *configpath
c->add_terminal_fifos = lxcapi_add_terminal_fifo;
c->set_terminal_winch = lxcapi_set_terminal_winch;
c->set_exec_terminal_winch = lxcapi_set_exec_terminal_winch;
+ c->want_disable_pty = lxcapi_want_disable_pty;
+ c->want_open_stdin = lxcapi_want_open_stdin;
#endif
return c;
diff --git a/src/lxc/start.c b/src/lxc/start.c
index 0942c31..f6a96b4 100644
--- a/src/lxc/start.c
+++ b/src/lxc/start.c
@@ -1387,24 +1387,9 @@ static int do_start(void *data)
*/
#ifdef HAVE_ISULAD
if (!handler->disable_pty && handler->daemonize && !handler->conf->autodev) {
- char path[PATH_MAX];
-
- ret = snprintf(path, sizeof(path), "%s/dev/null",
- handler->conf->rootfs.mount);
- if (ret < 0 || ret >= sizeof(path))
- goto out_warn_father;
-
- ret = access(path, F_OK);
- if (ret != 0) {
- devnull_fd = open_devnull();
-
- if (devnull_fd < 0)
- goto out_warn_father;
- WARN("Using /dev/null from the host for container init's standard file descriptors. Migration will not work");
- }
- }
#else
if (handler->daemonize && !handler->conf->autodev) {
+#endif
char path[PATH_MAX];
ret = snprintf(path, sizeof(path), "%s/dev/null",
@@ -1421,7 +1406,6 @@ static int do_start(void *data)
WARN("Using /dev/null from the host for container init's standard file descriptors. Migration will not work");
}
}
-#endif
/* Ask father to setup cgroups and wait for him to finish. */
ret = lxc_sync_barrier_parent(handler, LXC_SYNC_CGROUP);
@@ -2059,13 +2043,29 @@ static int lxc_spawn(struct lxc_handler *handler)
TRACE("Cloned child process %d", handler->pid);
#ifdef HAVE_ISULAD
- /* isulad: save pid/ppid info into file*/
- if (handler->conf->container_info_file) {
- if (lxc_save_container_info(handler->conf->container_info_file, handler->pid)) {
- ERROR("Failed to save cloned container pid");
- goto out_delete_net;
- }
- }
+ /* isulad: close pipe after clone */
+ if (handler->conf->console.pipes[0][0] >= 0) {
+ close(handler->conf->console.pipes[0][0]);
+ handler->conf->console.pipes[0][0] = -1;
+ }
+
+ if (handler->conf->console.pipes[1][1] >= 0) {
+ close(handler->conf->console.pipes[1][1]);
+ handler->conf->console.pipes[1][1] = -1;
+ }
+
+ if (handler->conf->console.pipes[2][1] >= 0) {
+ close(handler->conf->console.pipes[2][1]);
+ handler->conf->console.pipes[2][1] = -1;
+ }
+
+ /* isulad: save pid/ppid info into file*/
+ if (handler->conf->container_info_file) {
+ if (lxc_save_container_info(handler->conf->container_info_file, handler->pid)) {
+ ERROR("Failed to save cloned container pid");
+ goto out_delete_net;
+ }
+ }
#endif
/* Verify that we can actually make use of pidfds. */
diff --git a/src/lxc/terminal.c b/src/lxc/terminal.c
index 39a6718..14686fc 100644
--- a/src/lxc/terminal.c
+++ b/src/lxc/terminal.c
@@ -2090,3 +2090,4 @@ int lxc_terminal_map_ids(struct lxc_conf *c, struct lxc_terminal *terminal)
return 0;
}
+
diff --git a/src/lxc/tools/lxc_start.c b/src/lxc/tools/lxc_start.c
index 321c847..72a4494 100644
--- a/src/lxc/tools/lxc_start.c
+++ b/src/lxc/tools/lxc_start.c
@@ -53,8 +53,14 @@ static const struct option my_longopts[] = {
{"share-uts", required_argument, 0, OPT_SHARE_UTS},
{"share-pid", required_argument, 0, OPT_SHARE_PID},
#ifdef HAVE_ISULAD
+ {"in-fifo", required_argument, 0, OPT_INPUT_FIFO},
+ {"out-fifo", required_argument, 0, OPT_OUTPUT_FIFO},
+ {"err-fifo", required_argument, 0, OPT_STDERR_FIFO},
{"container-pidfile", required_argument, 0, OPT_CONTAINER_INFO},
{"exit-fifo", required_argument, 0, OPT_EXIT_FIFO},
+ {"start-timeout", required_argument, 0, OPT_START_TIMEOUT},
+ {"disable-pty", no_argument, 0, OPT_DISABLE_PTY},
+ {"open-stdin", no_argument, 0, OPT_OPEN_STDIN},
#endif
LXC_COMMON_OPTIONS
};
--
1.8.3.1

933
0023-Supporting-rootfs-mount-propagation.patch
View File

@ -1,933 +0,0 @@
From 0f756bece17253aadfe72e8f2eafe8a61d969f87 Mon Sep 17 00:00:00 2001
From: wujing <wujing50@huawei.com>
Date: Tue, 14 Apr 2020 04:53:05 -0400
Subject: [PATCH 23/49] Supporting rootfs mount propagation
Signed-off-by: wujing <wujing50@huawei.com>
---
src/lxc/conf.c | 429 +++++++++++++++++++++++++++++++++++-----
src/lxc/conf.h | 24 ++-
src/lxc/confile.c | 19 ++
src/lxc/criu.c | 7 +
src/lxc/storage/btrfs.c | 11 ++
src/lxc/storage/dir.c | 38 +++-
src/lxc/storage/overlay.c | 8 +
src/lxc/storage/storage_utils.c | 13 +-
src/lxc/storage/zfs.c | 9 +
src/lxc/utils.h | 4 +
10 files changed, 498 insertions(+), 64 deletions(-)
diff --git a/src/lxc/conf.c b/src/lxc/conf.c
index 4088363..e0a6f98 100644
--- a/src/lxc/conf.c
+++ b/src/lxc/conf.c
@@ -61,6 +61,8 @@
#include "loop.h"
#include "utils.h"
#include "uuid.h"
+#include "path.h"
+#include "utils.h"
#ifdef MAJOR_IN_MKDEV
#include <sys/mkdev.h>
@@ -1236,12 +1238,106 @@ static int lxc_fill_autodev(const struct lxc_rootfs *rootfs)
return 0;
}
+static void null_endofword(char *word)
+{
+ while (*word && *word != ' ' && *word != '\t')
+ word++;
+ *word = '\0';
+}
+
+/* skip @nfields spaces in @src */
+static char *get_field(char *src, int nfields)
+{
+ int i;
+ char *p = src;
+
+ for (i = 0; i < nfields; i++) {
+ while (*p && *p != ' ' && *p != '\t')
+ p++;
+
+ if (!*p)
+ break;
+
+ p++;
+ }
+
+ return p;
+}
+
+#ifdef HAVE_ISULAD
+static int rootfs_parent_mount_private(char *rootfs)
+{
+ /* walk /proc/self/mountinfo and change parent of rootfs to private */
+ FILE *f = fopen("/proc/self/mountinfo", "r");
+ char *line = NULL;
+ char *parent = NULL, *options = NULL;
+ size_t len = 0;
+ int ret = 0;
+
+ if (!f) {
+ SYSERROR("Failed to open /proc/self/mountinfo to make parent of rootfs to private");
+ return -1;
+ }
+
+ while (getline(&line, &len, f) != -1) {
+ char *target = NULL;
+ char *opts = NULL;
+ char *tmptarget = NULL;
+ target = get_field(line, 4);
+ if (!target)
+ continue;
+ tmptarget = safe_strdup(target);
+ null_endofword(tmptarget);
+ if (!strstr(rootfs, tmptarget)) {
+ free(tmptarget);
+ continue;
+ }
+ if (!parent || strlen(tmptarget) > strlen(parent)) {
+ free(parent);
+ parent = tmptarget;
+ } else {
+ free(tmptarget);
+ continue;
+ }
+ opts = get_field(target, 2);
+ if (!opts)
+ continue;
+ null_endofword(opts);
+ free(options);
+ options = safe_strdup(opts);
+ }
+
+ if (!parent || !options) {
+ ERROR("Could not find parent mount of %s", rootfs);
+ ret = -1;
+ } else {
+ if (strstr(options, "shared")) {
+ if (mount(NULL, parent, NULL, MS_PRIVATE, NULL)) {
+ SYSERROR("Failed to make %s private", parent);
+ ret = -1;
+ }
+ DEBUG("Mounted parent %s of rootfs %s to private", parent, rootfs);
+ }
+ }
+ free(parent);
+ free(options);
+ fclose(f);
+ free(line);
+ return ret;
+}
+#endif
+
static int lxc_mount_rootfs(struct lxc_conf *conf)
{
int ret;
struct lxc_storage *bdev;
const struct lxc_rootfs *rootfs = &conf->rootfs;
+#ifdef HAVE_ISULAD
+ unsigned long flags, mntflags, pflags;
+ char *mntdata = NULL;
+#endif
+
if (!rootfs->path) {
ret = mount("", "/", NULL, MS_SLAVE | MS_REC, 0);
if (ret < 0)
@@ -1255,6 +1351,44 @@ static int lxc_mount_rootfs(struct lxc_conf *conf)
return log_error_errno(-1, errno, "Failed to access to \"%s\". Check it is present",
rootfs->mount);
+#ifdef HAVE_ISULAD
+ // Support mount propagations of rootfs
+ // Get rootfs mnt propagation options, such as slave or shared
+ if (parse_mntopts(conf->rootfs.options, &mntflags, &pflags, &mntdata) < 0) {
+ free(mntdata);
+ return -1;
+ }
+ free(mntdata);
+
+ flags = MS_SLAVE | MS_REC;
+ if (pflags)
+ flags = pflags;
+
+ /* Mount propagation inside container can not greater than host.
+ * So we must change propagation of root according to flags, default is rslave.
+ * That means shared propagation inside container is disabled by default.
+ */
+ ret = mount("", "/", NULL, flags, NULL);
+ if (ret < 0) {
+ return log_error_errno(-1, errno, "Failed to make / to propagation flags %lu.", flags);
+ }
+
+ /* Make parent mount private to make sure following bind mount does
+ * not propagate in other namespaces. Also it will help with kernel
+ * check pass in pivot_root. (IS_SHARED(new_mnt->mnt_parent))
+ */
+ ret = rootfs_parent_mount_private(conf->rootfs.mount);
+ if (ret != 0) {
+ return log_error(-1, "Failed to make parent of rootfs %s to private.", conf->rootfs.mount);
+ }
+
+ ret = mount(conf->rootfs.mount, conf->rootfs.mount, "bind", MS_BIND | MS_REC, NULL);
+ if (ret < 0) {
+ SYSERROR("Failed to mount rootfs %s", conf->rootfs.mount);
+ return -1;
+ }
+#endif
+
bdev = storage_init(conf);
if (!bdev)
return log_error(-1, "Failed to mount rootfs \"%s\" onto \"%s\" with options \"%s\"",
@@ -1802,7 +1936,43 @@ static int lxc_setup_console(const struct lxc_rootfs *rootfs,
return lxc_setup_ttydir_console(rootfs, console, ttydir);
}
+#ifdef HAVE_ISULAD
+static void parse_mntopt(char *opt, unsigned long *mflags, unsigned long *pflags, char **data, size_t size)
+{
+ struct mount_opt *mo;
+
+ /* If opt is found in mount_opt, set or clear flags.
+ * Otherwise append it to data. */
+
+ for (mo = &mount_opt[0]; mo->name != NULL; mo++) {
+ if (strncmp(opt, mo->name, strlen(mo->name)) == 0) {
+ if (mo->clear)
+ *mflags &= ~mo->flag;
+ else
+ *mflags |= mo->flag;
+ return;
+ }
+ }
+
+ /* If opt is found in propagation_opt, set or clear flags. */
+ for (mo = &propagation_opt[0]; mo->name != NULL; mo++) {
+ if (strncmp(opt, mo->name, strlen(mo->name)) != 0)
+ continue;
+
+ if (mo->clear)
+ *pflags &= ~mo->flag;
+ else
+ *pflags |= mo->flag;
+
+ return;
+ }
+ if (strlen(*data))
+ (void)strlcat(*data, ",", size);
+
+ (void)strlcat(*data, opt, size);
+}
+#else
static int parse_mntopt(char *opt, unsigned long *flags, char **data, size_t size)
{
ssize_t ret;
@@ -1839,7 +2009,43 @@ static int parse_mntopt(char *opt, unsigned long *flags, char **data, size_t siz
return 0;
}
+#endif
+
+#ifdef HAVE_ISULAD
+int parse_mntopts(const char *mntopts, unsigned long *mntflags, unsigned long *pflags, char **mntdata)
+{
+ char *data, *p, *s;
+ size_t size;
+
+ *mntdata = NULL;
+ *mntflags = 0L;
+ *pflags = 0L;
+
+ if (!mntopts)
+ return 0;
+
+ s = safe_strdup(mntopts);
+ size = strlen(s) + 1;
+ data = malloc(size);
+ if (!data) {
+ free(s);
+ return -1;
+ }
+ *data = 0;
+
+ lxc_iterate_parts(p, s, ",")
+ parse_mntopt(p, mntflags, pflags, &data, size);
+
+ if (*data)
+ *mntdata = data;
+ else
+ free(data);
+ free(s);
+
+ return 0;
+}
+#else
int parse_mntopts(const char *mntopts, unsigned long *mntflags, char **mntdata)
{
__do_free char *mntopts_new = NULL, *mntopts_dup = NULL;
@@ -1870,6 +2076,7 @@ int parse_mntopts(const char *mntopts, unsigned long *mntflags, char **mntdata)
return 0;
}
+#endif
static void parse_propagationopt(char *opt, unsigned long *flags)
{
@@ -1908,32 +2115,6 @@ int parse_propagationopts(const char *mntopts, unsigned long *pflags)
return 0;
}
-static void null_endofword(char *word)
-{
- while (*word && *word != ' ' && *word != '\t')
- word++;
- *word = '\0';
-}
-
-/* skip @nfields spaces in @src */
-static char *get_field(char *src, int nfields)
-{
- int i;
- char *p = src;
-
- for (i = 0; i < nfields; i++) {
- while (*p && *p != ' ' && *p != '\t')
- p++;
-
- if (!*p)
- break;
-
- p++;
- }
-
- return p;
-}
-
static int mount_entry(const char *fsname, const char *target,
const char *fstype, unsigned long mountflags,
unsigned long pflags, const char *data, bool optional,
@@ -2186,6 +2367,82 @@ retry:
return 0;
}
+
+/* isulad: checkMountDestination checks to ensure that the mount destination is not over the top of /proc.
+ * dest is required to be an abs path and have any symlinks resolved before calling this function. */
+static int check_mount_destination(const char *rootfs, const char *dest)
+{
+ const char *invalid_destinations[] = {
+ "/proc",
+ NULL
+ };
+ // White list, it should be sub directories of invalid destinations
+ const char *valid_destinations[] = {
+ // These entries can be bind mounted by files emulated by fuse,
+ // so commands like top, free displays stats in container.
+ "/proc/cpuinfo",
+ "/proc/diskstats",
+ "/proc/meminfo",
+ "/proc/stat",
+ "/proc/swaps",
+ "/proc/uptime",
+ "/proc/net/dev",
+ NULL
+ };
+ const char **valid = NULL;
+ const char **invalid = NULL;
+
+ for(valid = valid_destinations; *valid != NULL; valid++) {
+ char *fullpath = NULL;
+ char *relpath = NULL;
+ const char *parts[3] = {
+ rootfs,
+ *valid,
+ NULL
+ };
+ fullpath = lxc_string_join("/", parts, false);
+ if (!fullpath) {
+ ERROR("Out of memory");
+ return -1;
+ }
+ relpath = path_relative(fullpath, dest);
+ free(fullpath);
+ if (!relpath)
+ return -1;
+ if (!strcmp(relpath, ".")) {
+ free(relpath);
+ return 0;
+ }
+ free(relpath);
+ }
+
+ for(invalid = invalid_destinations; *invalid != NULL; invalid++) {
+ char *fullpath = NULL;
+ char *relpath = NULL;
+ const char *parts[3] = {
+ rootfs,
+ *invalid,
+ NULL
+ };
+ fullpath = lxc_string_join("/", parts, false);
+ if (!fullpath) {
+ ERROR("Out of memory");
+ return -1;
+ }
+ relpath = path_relative(fullpath, dest);
+ free(fullpath);
+ if (!relpath)
+ return -1;
+ if (!strcmp(relpath, ".") || strncmp(relpath, "..", 2)) {
+ ERROR("%s cannot be mounted because it is located inside %s", dest, *invalid);
+ free(relpath);
+ return -1;
+ }
+ free(relpath);
+ }
+
+ return 0;
+}
#endif
/* rootfs, lxc_name, and lxc_path can be NULL when the container is created
@@ -2201,18 +2458,51 @@ static inline int mount_entry_on_generic(struct mntent *mntent,
char *rootfs_path = NULL;
int ret;
bool dev, optional, relative;
- const char *dest = path;
+ const char *dest = path;
+
+#ifdef HAVE_ISULAD
+ char *rpath = NULL;
+#endif
optional = hasmntopt(mntent, "optional") != NULL;
dev = hasmntopt(mntent, "dev") != NULL;
relative = hasmntopt(mntent, "relative") != NULL;
+#ifdef HAVE_ISULAD
+ // isulad: ensure that the destination of the bind mount is resolved of symlinks at mount time because
+ // any previous mounts can invalidate the next mount's destination.
+ // this can happen when a user specifies mounts within other mounts to cause breakouts or other
+ // evil stuff to try to escape the container's rootfs.
+ if (rootfs_path) {
+ rpath = follow_symlink_in_scope(path, rootfs_path);
+ if (!rpath) {
+ ERROR("Failed to get real path of '%s' in scope '%s'.", path, rootfs_path);
+ lxc_write_error_message(rootfs->errfd, "%s:%d: failed to get real path of '%s' in scope '%s'.",
+ __FILE__, __LINE__, path, rootfs_path);
+ return -1;
+ }
+ dest = rpath;
+
+ ret = check_mount_destination(rootfs_path, dest);
+ if (ret) {
+ ERROR("Mount destination is invalid: '%s'", dest);
+ lxc_write_error_message(rootfs->errfd, "%s:%d: mount destination is invalid: '%s'.",
+ __FILE__, __LINE__, dest);
+ free(rpath);
+ return -1;
+ }
+ }
+#else
if (rootfs && rootfs->path)
rootfs_path = rootfs->mount;
+#endif
ret = mount_entry_create_dir_file(mntent, path, rootfs, lxc_name,
lxc_path);
if (ret < 0) {
+#ifdef HAVE_ISULAD
+ free(rpath);
+#endif
if (optional)
return 0;
@@ -2220,6 +2510,29 @@ static inline int mount_entry_on_generic(struct mntent *mntent,
}
cull_mntent_opt(mntent);
+#ifdef HAVE_ISULAD
+ ret = parse_mntopts(mntent->mnt_opts, &mntflags, &pflags, &mntdata);
+ if (ret < 0) {
+ free(rpath);
+ return -1;
+ }
+
+ // support squashfs
+ if (strcmp(mntent->mnt_type, "squashfs") == 0) {
+ ret = mount_entry_with_loop_dev(mntent->mnt_fsname, dest, mntent->mnt_type,
+ mntent->mnt_opts, rootfs_path);
+ } else {
+ ret = mount_entry(mntent->mnt_fsname, dest, mntent->mnt_type, mntflags,
+ pflags, mntdata, optional, dev, relative, rootfs_path);
+ }
+
+ if (ret < 0) {
+ lxc_write_error_message(rootfs->errfd, "%s:%d: failed to mount %s as type %s.",
+ __FILE__, __LINE__, mntent->mnt_fsname, mntent->mnt_type);
+ }
+
+ free(rpath);
+#else
ret = parse_propagationopts(mntent->mnt_opts, &pflags);
if (ret < 0)
return -1;
@@ -2228,18 +2541,10 @@ static inline int mount_entry_on_generic(struct mntent *mntent,
if (ret < 0)
return ret;
-#ifdef HAVE_ISULAD
- // isulad: support squashfs
- if (strcmp(mntent->mnt_type, "squashfs") == 0) {
- ret = mount_entry_with_loop_dev(mntent->mnt_fsname, dest, mntent->mnt_type,
- mntent->mnt_opts, rootfs_path);
- } else {
-#endif
- ret = mount_entry(mntent->mnt_fsname, dest, mntent->mnt_type, mntflags,
- pflags, mntdata, optional, dev, relative, rootfs_path);
-#ifdef HAVE_ISULAD
- }
+ ret = mount_entry(mntent->mnt_fsname, dest, mntent->mnt_type, mntflags,
+ pflags, mntdata, optional, dev, relative, rootfs_path);
#endif
+
return ret;
}
@@ -2329,6 +2634,28 @@ static int mount_file_entries(const struct lxc_conf *conf,
while (getmntent_r(file, &mntent, buf, sizeof(buf))) {
int ret;
+#ifdef HAVE_ISULAD
+ //isulad, system contaienr, skip "proc/sys/xxx" path
+ if (conf->systemd != NULL && strcmp(conf->systemd, "true") == 0) {
+ if (strstr(mntent.mnt_dir, "proc/sys") != NULL) {
+ continue;
+ }
+ }
+
+ /* Note: Workaround for volume file path with space*/
+ mntent.mnt_fsname = lxc_string_replace(SPACE_MAGIC_STR, " ", mntent.mnt_fsname);
+ if(!mntent.mnt_fsname) {
+ SYSERROR("memory allocation error");
+ return -1;
+ }
+ mntent.mnt_dir = lxc_string_replace(SPACE_MAGIC_STR, " ", mntent.mnt_dir);
+ if(!mntent.mnt_dir) {
+ SYSERROR("memory allocation error");
+ free(mntent.mnt_fsname);
+ return -1;
+ }
+#endif
+
if (!rootfs->path)
ret = mount_entry_on_systemfs(&mntent);
else if (mntent.mnt_dir[0] != '/')
@@ -2337,6 +2664,14 @@ static int mount_file_entries(const struct lxc_conf *conf,
else
ret = mount_entry_on_absolute_rootfs(&mntent, rootfs,
lxc_name, lxc_path);
+
+#ifdef HAVE_ISULAD
+ free(mntent.mnt_fsname);
+ mntent.mnt_fsname = NULL;
+ free(mntent.mnt_dir);
+ mntent.mnt_dir = NULL;
+#endif
+
if (ret < 0)
return -1;
}
@@ -3391,7 +3726,13 @@ int lxc_setup_rootfs_prepare_root(struct lxc_conf *conf, const char *name,
return log_trace(0, "Bind mounted container / onto itself");
}
+#ifdef HAVE_ISULAD
+ if (!conf->rootfs.options) {
+ remount_all_slave();
+ }
+#else
remount_all_slave();
+#endif
ret = run_lxc_hooks(name, "pre-mount", conf, NULL);
if (ret < 0)
@@ -3585,16 +3926,12 @@ reset_umask:
static int setup_rootfs_mountopts(const struct lxc_rootfs *rootfs)
{
unsigned long mflags, mntflags, pflags;
- char *mntdata;
+ char *mntdata = NULL;
if(!rootfs || !rootfs->options)
return 0;
- if (parse_propagationopts(rootfs->options, &pflags) < 0) {
- return -1;
- }
-
- if (parse_mntopts(rootfs->options, &mntflags, &mntdata) < 0) {
+ if (parse_mntopts(rootfs->options, &mntflags, &pflags, &mntdata) < 0) {
free(mntdata);
return -1;
}
@@ -3602,9 +3939,9 @@ static int setup_rootfs_mountopts(const struct lxc_rootfs *rootfs)
if (mntflags & MS_RDONLY) {
mflags = add_required_remount_flags("/", NULL, MS_BIND | MS_REC | mntflags | pflags | MS_REMOUNT);
- DEBUG("remounting /");
+ DEBUG("remounting / as readonly");
if (mount("/", "/", NULL, mflags, 0) < 0) {
- SYSERROR("Failed to remount /");
+ SYSERROR("Failed to make / readonly.");
return -1;
}
}
diff --git a/src/lxc/conf.h b/src/lxc/conf.h
index 482fe0d..22c554d 100644
--- a/src/lxc/conf.h
+++ b/src/lxc/conf.h
@@ -156,10 +156,12 @@ struct lxc_rootfs {
bool managed;
#ifdef HAVE_ISULAD
- /* isulad: maskedpaths */
- struct lxc_list maskedpaths;
- /* isulad: ropaths */
- struct lxc_list ropaths;
+ /* isulad: maskedpaths */
+ struct lxc_list maskedpaths;
+ /* isulad: ropaths */
+ struct lxc_list ropaths;
+ /* isulad: errfd */
+ int errfd;
#endif
};
@@ -444,6 +446,8 @@ struct lxc_conf {
int exit_fd; /* exit fifo fd*/
char *errmsg; /* record error messages */
+
+ char *systemd; //systemd value
#endif
};
@@ -492,8 +496,6 @@ extern int userns_exec_1(const struct lxc_conf *conf, int (*fn)(void *),
void *data, const char *fn_name);
extern int userns_exec_full(struct lxc_conf *conf, int (*fn)(void *),
void *data, const char *fn_name);
-extern int parse_mntopts(const char *mntopts, unsigned long *mntflags,
- char **mntdata);
extern int parse_propagationopts(const char *mntopts, unsigned long *pflags);
extern void tmp_proc_unmount(struct lxc_conf *lxc_conf);
extern void remount_all_slave(void);
@@ -519,6 +521,16 @@ extern int userns_exec_minimal(const struct lxc_conf *conf,
int (*fn_parent)(void *), void *fn_parent_data,
int (*fn_child)(void *), void *fn_child_data);
#ifdef HAVE_ISULAD
+// isulad modify
+extern int parse_mntopts(const char *mntopts, unsigned long *mntflags,
+ unsigned long *pflags, char **mntdata);
+#else
+extern int parse_mntopts(const char *mntopts, unsigned long *mntflags,
+ char **mntdata);
+#endif
+
+#ifdef HAVE_ISULAD
+// isulad add
int lxc_clear_init_args(struct lxc_conf *lxc_conf);
int lxc_clear_populate_devices(struct lxc_conf *c);
int lxc_clear_rootfs_masked_paths(struct lxc_conf *c);
diff --git a/src/lxc/confile.c b/src/lxc/confile.c
index 0fcebd4..9ba3c7c 100644
--- a/src/lxc/confile.c
+++ b/src/lxc/confile.c
@@ -1358,6 +1358,10 @@ static int set_config_environment(const char *key, const char *value,
{
struct lxc_list *list_item = NULL;
+#ifdef HAVE_ISULAD
+ char *replaced = NULL;
+#endif
+
if (lxc_config_value_empty(value))
return lxc_clear_environment(lxc_conf);
@@ -1378,7 +1382,16 @@ static int set_config_environment(const char *key, const char *value,
env_var[1] = env_val;
list_item->elem = lxc_string_join("=", env_var, false);
} else {
+#ifdef HAVE_ISULAD
+ /* isulad: recover space replaced by SPACE_MAGIC_STR */
+ replaced = lxc_string_replace(SPACE_MAGIC_STR, " ", value);
+ if(!replaced)
+ goto on_error;
+
+ list_item->elem = replaced;
+#else
list_item->elem = strdup(value);
+#endif
}
if (!list_item->elem)
@@ -2594,6 +2607,11 @@ static int set_config_rootfs_options(const char *key, const char *value,
int ret;
struct lxc_rootfs *rootfs = &lxc_conf->rootfs;
+#ifdef HAVE_ISULAD
+ ret = parse_mntopts(value, &mflags, &pflags, &mdata);
+ if (ret < 0)
+ return -EINVAL;
+#else
ret = parse_mntopts(value, &mflags, &mdata);
if (ret < 0)
return -EINVAL;
@@ -2603,6 +2621,7 @@ static int set_config_rootfs_options(const char *key, const char *value,
free(mdata);
return -EINVAL;
}
+#endif
ret = set_config_string_item(&opts, value);
if (ret < 0) {
diff --git a/src/lxc/criu.c b/src/lxc/criu.c
index 1a909bb..14a8aae 100644
--- a/src/lxc/criu.c
+++ b/src/lxc/criu.c
@@ -371,8 +371,15 @@ static void exec_criu(struct cgroup_ops *cgroup_ops, struct lxc_conf *conf,
char *mntdata = NULL;
char arg[2 * PATH_MAX + 2];
+#ifdef HAVE_ISULAD
+ unsigned long pflags;
+
+ if (parse_mntopts(mntent.mnt_opts, &flags, &pflags, &mntdata) < 0)
+ goto err;
+#else
if (parse_mntopts(mntent.mnt_opts, &flags, &mntdata) < 0)
goto err;
+#endif
free(mntdata);
diff --git a/src/lxc/storage/btrfs.c b/src/lxc/storage/btrfs.c
index 92a4a6d..069a9dd 100644
--- a/src/lxc/storage/btrfs.c
+++ b/src/lxc/storage/btrfs.c
@@ -197,16 +197,27 @@ int btrfs_mount(struct lxc_storage *bdev)
const char *src;
int ret;
+#ifdef HAVE_ISULAD
+ unsigned long pflags = 0;
+#endif
+
if (strcmp(bdev->type, "btrfs"))
return -22;
if (!bdev->src || !bdev->dest)
return -22;
+#ifdef HAVE_ISULAD
+ if (parse_mntopts(bdev->mntopts, &mntflags, &pflags, &mntdata) < 0) {
+ free(mntdata);
+ return -22;
+ }
+#else
if (parse_mntopts(bdev->mntopts, &mntflags, &mntdata) < 0) {
free(mntdata);
return -22;
}
+#endif
src = lxc_storage_get_path(bdev->src, "btrfs");
diff --git a/src/lxc/storage/dir.c b/src/lxc/storage/dir.c
index b3dbbd0..1dc95f1 100644
--- a/src/lxc/storage/dir.c
+++ b/src/lxc/storage/dir.c
@@ -124,14 +124,39 @@ bool dir_detect(const char *path)
return false;
}
+#ifdef HAVE_ISULAD
int dir_mount(struct lxc_storage *bdev)
{
__do_free char *mntdata = NULL;
-#ifdef HAVE_ISULAD
unsigned long mntflags = 0, pflags = 0;
+ int ret;
+ const char *src;
+
+ if (strcmp(bdev->type, "dir"))
+ return -22;
+
+ if (!bdev->src || !bdev->dest)
+ return -22;
+
+ ret = parse_mntopts(bdev->mntopts, &mntflags, &pflags, &mntdata);
+ if (ret < 0)
+ return log_error_errno(ret, errno, "Failed to parse mount options \"%s\"", bdev->mntopts);
+
+ src = lxc_storage_get_path(bdev->src, bdev->type);
+
+ ret = mount(src, bdev->dest, "bind", MS_BIND | MS_REC | (mntflags & ~MS_RDONLY) | pflags, mntdata);
+ if (ret < 0) {
+ return log_error_errno(-errno, errno, "Failed to mount \"%s\" on \"%s\"", src, bdev->dest);
+ }
+ TRACE("Mounted \"%s\" on \"%s\"", src, bdev->dest);
+
+ return 0;
+}
#else
+int dir_mount(struct lxc_storage *bdev)
+{
+ __do_free char *mntdata = NULL;
unsigned long mflags = 0, mntflags = 0, pflags = 0;
-#endif
int ret;
const char *src;
@@ -151,13 +176,6 @@ int dir_mount(struct lxc_storage *bdev)
src = lxc_storage_get_path(bdev->src, bdev->type);
-#ifdef HAVE_ISULAD
- ret = mount(src, bdev->dest, "bind", MS_BIND | MS_REC | (mntflags & ~MS_RDONLY) | pflags, mntdata);
- if (ret < 0) {
- return log_error_errno(-errno, errno, "Failed to mount \"%s\" on \"%s\"", src, bdev->dest);
- }
- TRACE("Mounted \"%s\" on \"%s\"", src, bdev->dest);
-#else
ret = mount(src, bdev->dest, "bind", MS_BIND | MS_REC | mntflags | pflags, mntdata);
if (ret < 0)
return log_error_errno(-errno, errno, "Failed to mount \"%s\" on \"%s\"", src, bdev->dest);
@@ -174,10 +192,10 @@ int dir_mount(struct lxc_storage *bdev)
}
TRACE("Mounted \"%s\" on \"%s\" with options \"%s\", mount flags \"%lu\", and propagation flags \"%lu\"",
src ? src : "(none)", bdev->dest ? bdev->dest : "(none)", mntdata, mflags, pflags);
-#endif
return 0;
}
+#endif
int dir_umount(struct lxc_storage *bdev)
{
diff --git a/src/lxc/storage/overlay.c b/src/lxc/storage/overlay.c
index 770785c..75a81de 100644
--- a/src/lxc/storage/overlay.c
+++ b/src/lxc/storage/overlay.c
@@ -349,6 +349,9 @@ int ovl_mount(struct lxc_storage *bdev)
char *work, *lastslash;
size_t len, len2;
int ret, ret2;
+#ifdef HAVE_ISULAD
+ unsigned long pflags = 0;
+#endif
if (strcmp(bdev->type, "overlay") && strcmp(bdev->type, "overlayfs"))
return -22;
@@ -414,7 +417,12 @@ int ovl_mount(struct lxc_storage *bdev)
work = must_make_path(upper, LXC_OVERLAY_WORK_DIR, NULL);
upper[lastslash - upper] = '/';
+#ifdef HAVE_ISULAD
+ ret = parse_mntopts(bdev->mntopts, &mntflags, &pflags, &mntdata);
+#else
ret = parse_mntopts(bdev->mntopts, &mntflags, &mntdata);
+#endif
+
if (ret < 0) {
ERROR("Failed to parse mount options");
free(mntdata);
diff --git a/src/lxc/storage/storage_utils.c b/src/lxc/storage/storage_utils.c
index 07eee22..6fec638 100644
--- a/src/lxc/storage/storage_utils.c
+++ b/src/lxc/storage/storage_utils.c
@@ -340,6 +340,10 @@ int find_fstype_cb(char *buffer, void *data)
char mount_err[BUFSIZ] = {0};
int ret;
+#ifdef HAVE_ISULAD
+ unsigned long pflags = 0;
+#endif
+
/* we don't try 'nodev' entries */
if (strstr(buffer, "nodev"))
return 0;
@@ -351,14 +355,19 @@ int find_fstype_cb(char *buffer, void *data)
DEBUG("Trying to mount \"%s\"->\"%s\" with FSType \"%s\"", cbarg->rootfs,
cbarg->target, fstype);
- if (parse_mntopts(cbarg->options, &mntflags, &mntdata) < 0) {
+#ifdef HAVE_ISULAD
+ if (parse_mntopts(cbarg->options, &mntflags, &pflags, &mntdata) < 0) {
free(mntdata);
return 0;
}
-#ifdef HAVE_ISULAD
if (mount(cbarg->rootfs, cbarg->target, fstype, (mntflags & ~MS_RDONLY), mntdata)) {
#else
+ if (parse_mntopts(cbarg->options, &mntflags, &mntdata) < 0) {
+ free(mntdata);
+ return 0;
+ }
+
if (mount(cbarg->rootfs, cbarg->target, fstype, mntflags, mntdata)) {
#endif
SYSDEBUG("Failed to mount");
diff --git a/src/lxc/storage/zfs.c b/src/lxc/storage/zfs.c
index 4cc171f..025cf95 100644
--- a/src/lxc/storage/zfs.c
+++ b/src/lxc/storage/zfs.c
@@ -167,13 +167,22 @@ int zfs_mount(struct lxc_storage *bdev)
const char *src;
char cmd_output[PATH_MAX] = {0};
+#ifdef HAVE_ISULAD
+ unsigned long pflags = 0;
+#endif
+
if (strcmp(bdev->type, "zfs"))
return -22;
if (!bdev->src || !bdev->dest)
return -22;
+#ifdef HAVE_ISULAD
+ ret = parse_mntopts(bdev->mntopts, &mntflags, &pflags, &mntdata);
+#else
ret = parse_mntopts(bdev->mntopts, &mntflags, &mntdata);
+#endif
+
if (ret < 0) {
ERROR("Failed to parse mount options");
free(mntdata);
diff --git a/src/lxc/utils.h b/src/lxc/utils.h
index 677f632..36c458e 100644
--- a/src/lxc/utils.h
+++ b/src/lxc/utils.h
@@ -27,8 +27,12 @@
#include "memory_utils.h"
#include "raw_syscalls.h"
#include "string_utils.h"
+
#ifdef HAVE_ISULAD
#include "isulad_utils.h"
+
+/* isulad: replace space with SPACE_MAGIC_STR */
+#define SPACE_MAGIC_STR "[#)"
#endif
/* returns 1 on success, 0 if there were any failures */
--
1.8.3.1

40
0024-start-do-not-check-ppid-when-set-death-signal.patch
View File

@ -1,40 +0,0 @@
From 52b97324185142285f78143509244d88c6962826 Mon Sep 17 00:00:00 2001
From: LiFeng <lifeng68@huawei.com>
Date: Tue, 14 Apr 2020 17:38:44 +0800
Subject: [PATCH 24/49] start: do not check ppid when set death signal
Signed-off-by: LiFeng <lifeng68@huawei.com>
---
src/lxc/utils.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/src/lxc/utils.c b/src/lxc/utils.c
index 5b04fa4..27078e2 100644
--- a/src/lxc/utils.c
+++ b/src/lxc/utils.c
@@ -1734,11 +1734,14 @@ static int process_dead(/* takes */ int status_fd)
int lxc_set_death_signal(int signal, pid_t parent, int parent_status_fd)
{
int ret;
+#ifndef HAVE_ISULAD
pid_t ppid;
+#endif
ret = prctl(PR_SET_PDEATHSIG, prctl_arg(signal), prctl_arg(0),
prctl_arg(0), prctl_arg(0));
+#ifndef HAVE_ISULAD
/* verify that we haven't been orphaned in the meantime */
ppid = (pid_t)syscall(SYS_getppid);
if (ppid == 0) { /* parent outside our pidns */
@@ -1750,6 +1753,7 @@ int lxc_set_death_signal(int signal, pid_t parent, int parent_status_fd)
} else if (ppid != parent) {
return raise(SIGKILL);
}
+#endif
if (ret < 0)
return -1;
--
1.8.3.1

1244
0025-support-oci-hooks.patch
View File

File diff suppressed because it is too large Load Diff

306
0026-Supporting-UID-GID-configuration.patch
View File

@ -1,306 +0,0 @@
From 61bfa0ce515288897b93640507e48f09f0d78010 Mon Sep 17 00:00:00 2001
From: wujing <wujing50@huawei.com>
Date: Tue, 14 Apr 2020 23:17:04 -0400
Subject: [PATCH 26/49] Supporting UID GID configuration
Signed-off-by: wujing <wujing50@huawei.com>
---
src/lxc/attach.c | 16 ++++++++
src/lxc/conf.c | 19 ++++++++-
src/lxc/conf.h | 4 ++
src/lxc/start.c | 8 ++++
src/lxc/tools/lxc_attach.c | 99 +++++++++++++++++++++++++++++++++++++++++++---
5 files changed, 139 insertions(+), 7 deletions(-)
diff --git a/src/lxc/attach.c b/src/lxc/attach.c
index 33946bb..c77b929 100644
--- a/src/lxc/attach.c
+++ b/src/lxc/attach.c
@@ -749,8 +749,10 @@ static int attach_child_main(struct attach_clone_payload *payload)
goto on_error;
}
+#ifndef HAVE_ISULAD
if (!lxc_setgroups(0, NULL) && errno != EPERM)
goto on_error;
+#endif
if (options->namespaces & CLONE_NEWUSER) {
/* Check whether nsuid 0 has a mapping. */
@@ -892,6 +894,12 @@ static int attach_child_main(struct attach_clone_payload *payload)
if (new_gid == ns_root_gid)
new_gid = LXC_INVALID_GID;
+#ifdef HAVE_ISULAD
+ if (!lxc_setgroups(init_ctx->container->lxc_conf->init_groups_len,
+ init_ctx->container->lxc_conf->init_groups))
+ goto on_error;
+#endif
+
/* Make sure that the processes STDIO is correctly owned by the user that we are switching to */
ret = fix_stdio_permissions(new_uid);
if (ret)
@@ -1058,6 +1066,14 @@ int lxc_attach(struct lxc_container *container, lxc_attach_exec_t exec_function,
}
conf = init_ctx->container->lxc_conf;
+#ifdef HAVE_ISULAD
+ // always switch uid and gid for attach
+ if (options->uid == -1)
+ options->uid = init_ctx->container->lxc_conf->init_uid;
+ if (options->gid == -1)
+ options->gid = init_ctx->container->lxc_conf->init_gid;
+#endif
+
if (!fetch_seccomp(init_ctx->container, options))
WARN("Failed to get seccomp policy");
diff --git a/src/lxc/conf.c b/src/lxc/conf.c
index 71fd6f9..43ef067 100644
--- a/src/lxc/conf.c
+++ b/src/lxc/conf.c
@@ -5100,6 +5100,7 @@ void lxc_conf_free(struct lxc_conf *conf)
close(conf->exit_fd);
}
lxc_clear_init_args(conf);
+ lxc_clear_init_groups(conf);
lxc_clear_populate_devices(conf);
lxc_clear_rootfs_masked_paths(conf);
lxc_clear_rootfs_ro_paths(conf);
@@ -5919,11 +5920,25 @@ struct lxc_list *sort_cgroup_settings(struct lxc_list *cgroup_settings)
/*isulad clear init args*/
int lxc_clear_init_args(struct lxc_conf *lxc_conf)
{
- size_t i;
+ int i;
- for (i = 0; i < lxc_conf->init_argc; i++)
+ for (i = 0; i < lxc_conf->init_argc; i++) {
free(lxc_conf->init_argv[i]);
+ lxc_conf->init_argv[i] = NULL;
+ }
free(lxc_conf->init_argv);
+ lxc_conf->init_argv = NULL;
+ lxc_conf->init_argc = 0;
+
+ return 0;
+}
+
+/*isulad clear init groups*/
+int lxc_clear_init_groups(struct lxc_conf *lxc_conf)
+{
+ free(lxc_conf->init_groups);
+ lxc_conf->init_groups = NULL;
+ lxc_conf->init_groups_len = 0;
return 0;
}
diff --git a/src/lxc/conf.h b/src/lxc/conf.h
index 61c3383..879e427 100644
--- a/src/lxc/conf.h
+++ b/src/lxc/conf.h
@@ -451,6 +451,9 @@ struct lxc_conf {
char **init_argv;
size_t init_argc;
+ gid_t *init_groups;
+ size_t init_groups_len;
+
/* populate devices*/
struct lxc_list populate_devs;
mode_t umask; //umask value
@@ -548,6 +551,7 @@ extern int parse_mntopts(const char *mntopts, unsigned long *mntflags,
#ifdef HAVE_ISULAD
// isulad add
int lxc_clear_init_args(struct lxc_conf *lxc_conf);
+int lxc_clear_init_groups(struct lxc_conf *lxc_conf);
int lxc_clear_populate_devices(struct lxc_conf *c);
int lxc_clear_rootfs_masked_paths(struct lxc_conf *c);
int lxc_clear_rootfs_ro_paths(struct lxc_conf *c);
diff --git a/src/lxc/start.c b/src/lxc/start.c
index 4f45776..e2311ec 100644
--- a/src/lxc/start.c
+++ b/src/lxc/start.c
@@ -1685,8 +1685,16 @@ static int do_start(void *data)
#if HAVE_LIBCAP
if (lxc_proc_cap_is_set(CAP_SETGID, CAP_EFFECTIVE))
#endif
+ #ifdef HAVE_ISULAD
+ /* isulad: set groups for init process, and before we set uid and gid */
+ if (!lxc_setgroups(handler->conf->init_groups_len, handler->conf->init_groups)) {
+ ERROR("Can not set groups");
+ goto out_warn_father;
+ }
+ #else
if (!lxc_setgroups(0, NULL))
goto out_warn_father;
+ #endif
if (!lxc_switch_uid_gid(new_uid, new_gid))
goto out_warn_father;
diff --git a/src/lxc/tools/lxc_attach.c b/src/lxc/tools/lxc_attach.c
index 47ac2f2..b068c9a 100644
--- a/src/lxc/tools/lxc_attach.c
+++ b/src/lxc/tools/lxc_attach.c
@@ -72,9 +72,11 @@ static const struct option my_longopts[] = {
{"set-var", required_argument, 0, 'v'},
{"pty-log", required_argument, 0, 'L'},
{"rcfile", required_argument, 0, 'f'},
+#ifndef HAVE_ISULAD
{"uid", required_argument, 0, 'u'},
{"gid", required_argument, 0, 'g'},
-#ifdef HAVE_ISULAD
+#else
+ {"user", required_argument, 0, 'u'},
{"in-fifo", required_argument, 0, OPT_INPUT_FIFO}, /* isulad add terminal fifos*/
{"out-fifo", required_argument, 0, OPT_OUTPUT_FIFO},
{"err-fifo", required_argument, 0, OPT_STDERR_FIFO},
@@ -130,9 +132,18 @@ Options :\n\
multiple times.\n\
-f, --rcfile=FILE\n\
Load configuration file FILE\n\
+"
+#ifndef HAVE_ISULAD
+"\
-u, --uid=UID Execute COMMAND with UID inside the container\n\
-g, --gid=GID Execute COMMAND with GID inside the container\n\
-",
+"
+#else
+"\
+ --user User ID (format: UID[:GID])\n\
+"
+#endif
+,
.options = my_longopts,
.parser = my_parser,
.checker = NULL,
@@ -142,6 +153,71 @@ Options :\n\
.gid = LXC_INVALID_GID,
};
+#ifdef HAVE_ISULAD
+static int parse_user_id(const char *username, char **uid, char **gid, char **tmp_dup)
+{
+ char *tmp = NULL;
+ char *pdot = NULL;
+
+ if (uid == NULL || gid == NULL || tmp_dup == NULL) {
+ return -1;
+ }
+
+ if (username != NULL) {
+ tmp = strdup(username);
+ if (tmp == NULL) {
+ ERROR("Failed to duplicate user name");
+ return -1;
+ }
+
+ // for free tmp in caller
+ *tmp_dup = tmp;
+ pdot = strstr(tmp, ":");
+ if (pdot != NULL) {
+ *pdot = '\0';
+ if (pdot != tmp) {
+ // uid found
+ *uid = tmp;
+ }
+
+ if (*(pdot + 1) != '\0') {
+ // gid found
+ *gid = pdot + 1;
+ }
+ } else {
+ // No : found
+ if (*tmp != '\0') {
+ *uid = tmp;
+ }
+ }
+ }
+
+ return 0;
+}
+
+static int get_attach_uid_gid(const char *username, uid_t *user_id, gid_t *group_id)
+{
+ char *tmp = NULL;
+ char *uid = NULL;
+ char *gid = NULL;
+
+ // parse uid and gid by username
+ if (parse_user_id(username, &uid, &gid, &tmp) != 0) {
+ return -1;
+ }
+
+ if (uid != NULL) {
+ *user_id = (unsigned int)atoll(uid);
+ }
+ if (gid != NULL) {
+ *group_id = (unsigned int)atoll(gid);
+ }
+
+ free(tmp);
+ return 0;
+}
+#endif
+
static int my_parser(struct lxc_arguments *args, int c, char *arg)
{
int ret;
@@ -199,6 +275,7 @@ static int my_parser(struct lxc_arguments *args, int c, char *arg)
case 'f':
args->rcfile = arg;
break;
+#ifndef HAVE_ISULAD
case 'u':
if (lxc_safe_uint(arg, &args->uid) < 0)
return -1;
@@ -207,7 +284,13 @@ static int my_parser(struct lxc_arguments *args, int c, char *arg)
if (lxc_safe_uint(arg, &args->gid) < 0)
return -1;
break;
-#ifdef HAVE_ISULAD
+#else
+ case 'u':
+ if (get_attach_uid_gid(arg, &args->uid, &args->gid) != 0) {
+ ERROR("Failed to get attach user U/GID");
+ return -1;
+ }
+ break;
case OPT_INPUT_FIFO:
args->terminal_fifos[0] = arg;
break;
@@ -286,7 +369,7 @@ static int lxc_attach_create_log_file(const char *log_file)
#ifdef HAVE_ISULAD
// isulad: send '128 + signal' if container is killed by signal.
-#define ExitSignalOffset 128
+#define EXIT_SIGNAL_OFFSET 128
/*isulad: attach with terminal*/
static int do_attach_foreground(struct lxc_container *c, lxc_attach_command_t *command,
@@ -316,7 +399,7 @@ static int do_attach_foreground(struct lxc_container *c, lxc_attach_command_t *c
if (WIFSIGNALED(ret)) {
signal = WTERMSIG(ret);
- wexit = ExitSignalOffset + signal;
+ wexit = EXIT_SIGNAL_OFFSET + signal;
}
out:
if (c->lxc_conf->errmsg)
@@ -515,6 +598,12 @@ int main(int argc, char *argv[])
}
}
+ if (my_args.uid != LXC_INVALID_UID)
+ attach_options.uid = my_args.uid;
+
+ if (my_args.gid != LXC_INVALID_GID)
+ attach_options.gid = my_args.gid;
+
attach_options.suffix = my_args.suffix;
/* isulad: add do attach background */
--
1.8.3.1

240
0027-Capabilites-security-feature-enhanced.patch
View File

@ -1,240 +0,0 @@
From e71dabf21ddd2a093ebdfcc6f6c79200415d12b1 Mon Sep 17 00:00:00 2001
From: wujing <wujing50@huawei.com>
Date: Tue, 14 Apr 2020 23:30:46 -0400
Subject: [PATCH 27/49] Capabilites security feature enhanced
Signed-off-by: wujing <wujing50@huawei.com>
---
src/lxc/attach.c | 24 +++++++++++++
src/lxc/conf.c | 103 +++++++++++++++++++++++++++++++++++++++++++++++++++++++
src/lxc/conf.h | 1 +
src/lxc/start.c | 20 +++++++++++
4 files changed, 148 insertions(+)
diff --git a/src/lxc/attach.c b/src/lxc/attach.c
index c77b929..231fa5f 100644
--- a/src/lxc/attach.c
+++ b/src/lxc/attach.c
@@ -832,10 +832,12 @@ static int attach_child_main(struct attach_clone_payload *payload)
goto on_error;
}
+#ifndef HAVE_ISULAD
close(payload->ipc_socket);
payload->ipc_socket = -EBADF;
lxc_proc_put_context_info(init_ctx);
payload->init_ctx = NULL;
+#endif
/* The following is done after the communication socket is shut down.
* That way, all errors that might (though unlikely) occur up until this
@@ -895,6 +897,11 @@ static int attach_child_main(struct attach_clone_payload *payload)
new_gid = LXC_INVALID_GID;
#ifdef HAVE_ISULAD
+ if (prctl(PR_SET_KEEPCAPS, 1) < 0) {
+ SYSERROR("Failed to keep permitted capabilities");
+ goto on_error;
+ }
+
if (!lxc_setgroups(init_ctx->container->lxc_conf->init_groups_len,
init_ctx->container->lxc_conf->init_groups))
goto on_error;
@@ -908,6 +915,23 @@ static int attach_child_main(struct attach_clone_payload *payload)
if (!lxc_switch_uid_gid(new_uid, new_gid))
goto on_error;
+#ifdef HAVE_ISULAD
+ if (prctl(PR_SET_KEEPCAPS, 0) < 0) {
+ SYSERROR("Failed to clear permitted capabilities");
+ goto on_error;
+ }
+
+ if (lxc_drop_caps(init_ctx->container->lxc_conf) != 0) {
+ ERROR("Failed to drop caps.");
+ goto on_error;
+ }
+
+ close(payload->ipc_socket);
+ payload->ipc_socket = -EBADF;
+ lxc_proc_put_context_info(init_ctx);
+ payload->init_ctx = NULL;
+#endif
+
/* We're done, so we can now do whatever the user intended us to do. */
_exit(payload->exec_function(payload->exec_payload));
diff --git a/src/lxc/conf.c b/src/lxc/conf.c
index 43ef067..325e0c2 100644
--- a/src/lxc/conf.c
+++ b/src/lxc/conf.c
@@ -2902,6 +2902,16 @@ static int dropcaps_except(struct lxc_list *caps)
lxc_list_for_each (iterator, caps) {
keep_entry = iterator->elem;
+#ifdef HAVE_ISULAD
+ /* Do not keep any cap*/
+ if (strcmp(keep_entry, "ISULAD_KEEP_NONE") == 0) {
+ DEBUG("Do not keep any capability");
+ for(i = 0; i < numcaps; i++) {
+ caplist[i] = 0;
+ }
+ break;
+ }
+#endif
capid = parse_cap(keep_entry);
if (capid == -2)
continue;
@@ -4703,6 +4713,99 @@ int lxc_setup(struct lxc_handler *handler)
return 0;
}
+#ifdef HAVE_ISULAD
+/* isulad drop caps for container*/
+int lxc_drop_caps(struct lxc_conf *conf)
+{
+#define __DEF_CAP_TO_MASK(x) (1U << ((x) & 31))
+#if HAVE_LIBCAP
+ int ret = 0;
+ struct lxc_list *iterator = NULL;
+ char *keep_entry = NULL;
+ size_t i = 0;
+ int capid;
+ size_t numcaps = (size_t)lxc_caps_last_cap() + 1;
+ struct lxc_list *caps = NULL;
+ int *caplist = NULL;
+
+ if (lxc_list_empty(&conf->keepcaps))
+ return 0;
+
+ caps = &conf->keepcaps;
+
+ if (numcaps <= 0 || numcaps > 200)
+ return -1;
+
+ // caplist[i] is 1 if we keep capability i
+ caplist = malloc(numcaps * sizeof(int));
+ if (caplist == NULL) {
+ ERROR("Out of memory");
+ return -1;
+ }
+ (void)memset(caplist, 0, numcaps * sizeof(int));
+
+ lxc_list_for_each(iterator, caps) {
+
+ keep_entry = iterator->elem;
+ /* isulad: Do not keep any cap*/
+ if (strcmp(keep_entry, "ISULAD_KEEP_NONE") == 0) {
+ DEBUG("Do not keep any capability");
+ for(i = 0; i < numcaps; i++) {
+ caplist[i] = 0;
+ }
+ break;
+ }
+
+ capid = parse_cap(keep_entry);
+
+ if (capid == -2)
+ continue;
+
+ if (capid < 0) {
+ ERROR("unknown capability %s", keep_entry);
+ ret = -1;
+ goto out;
+ }
+
+ DEBUG("keep capability '%s' (%d)", keep_entry, capid);
+
+ caplist[capid] = 1;
+ }
+
+ struct __user_cap_header_struct cap_header_data;
+ struct __user_cap_data_struct cap_data_data[2];
+
+ cap_user_header_t cap_header = &cap_header_data;
+ cap_user_data_t cap_data = &cap_data_data[0];
+
+ memset(cap_header, 0,sizeof(struct __user_cap_header_struct));
+ memset(cap_data, 0, sizeof(struct __user_cap_data_struct) * 2);
+
+ cap_header->pid = 0;
+ cap_header->version = _LINUX_CAPABILITY_VERSION_3;
+
+ for (i = 0; i < numcaps; i++) {
+ if (caplist[i]) {
+ cap_data[CAP_TO_INDEX(i)].effective = cap_data[CAP_TO_INDEX(i)].effective | (i > 31 ? __DEF_CAP_TO_MASK(i % 32) : __DEF_CAP_TO_MASK(i));
+ cap_data[CAP_TO_INDEX(i)].permitted = cap_data[CAP_TO_INDEX(i)].permitted | (i > 31 ? __DEF_CAP_TO_MASK(i % 32) : __DEF_CAP_TO_MASK(i));
+ cap_data[CAP_TO_INDEX(i)].inheritable = cap_data[CAP_TO_INDEX(i)].inheritable | (i > 31 ? __DEF_CAP_TO_MASK(i % 32) : __DEF_CAP_TO_MASK(i));
+ }
+ }
+
+ if (capset(cap_header, cap_data)) {
+ SYSERROR("Failed to set capabilitys");
+ ret = -1;
+ goto out;
+ }
+
+#endif
+
+out:
+ free(caplist);
+ return ret;
+}
+#endif
+
int run_lxc_hooks(const char *name, char *hookname, struct lxc_conf *conf,
char *argv[])
{
diff --git a/src/lxc/conf.h b/src/lxc/conf.h
index 879e427..7b6fd3b 100644
--- a/src/lxc/conf.h
+++ b/src/lxc/conf.h
@@ -555,6 +555,7 @@ int lxc_clear_init_groups(struct lxc_conf *lxc_conf);
int lxc_clear_populate_devices(struct lxc_conf *c);
int lxc_clear_rootfs_masked_paths(struct lxc_conf *c);
int lxc_clear_rootfs_ro_paths(struct lxc_conf *c);
+int lxc_drop_caps(struct lxc_conf *conf);
int run_oci_hooks(const char *name, const char *hookname, struct lxc_conf *conf, const char *lxcpath);
#endif
#endif /* __LXC_CONF_H */
diff --git a/src/lxc/start.c b/src/lxc/start.c
index e2311ec..bb2e74a 100644
--- a/src/lxc/start.c
+++ b/src/lxc/start.c
@@ -1652,6 +1652,13 @@ static int do_start(void *data)
}
}
+#ifdef HAVE_ISULAD
+ if (prctl(PR_SET_KEEPCAPS, 1) < 0) {
+ SYSERROR("Failed to keep permitted capabilities");
+ goto out_warn_father;
+ }
+#endif
+
/* The container has been setup. We can now switch to an unprivileged
* uid/gid.
*/
@@ -1705,6 +1712,19 @@ static int do_start(void *data)
goto out_warn_father;
}
+#ifdef HAVE_ISULAD
+ /* isulad: drop the cap of current process */
+ if (prctl(PR_SET_KEEPCAPS, 0) < 0) {
+ SYSERROR("Failed to clear permitted capabilities");
+ goto out_warn_father;
+ }
+
+ if (lxc_drop_caps(handler->conf)) {
+ SYSERROR("Failed to drop caps");
+ goto out_warn_father;
+ }
+#endif
+
if (handler->conf->monitor_signal_pdeath != SIGKILL) {
ret = lxc_set_death_signal(handler->conf->monitor_signal_pdeath,
handler->monitor_pid, status_fd);
--
1.8.3.1

167
0028-Supporting-workdir-configuration.patch
View File

@ -1,167 +0,0 @@
From cbe77bd42528e92d9e3871a36133a2a11f5a3f21 Mon Sep 17 00:00:00 2001
From: wujing <wujing50@huawei.com>
Date: Wed, 15 Apr 2020 00:28:40 -0400
Subject: [PATCH 28/49] Supporting workdir configuration
Signed-off-by: wujing <wujing50@huawei.com>
---
src/lxc/attach.c | 18 ++++++++++++++++++
src/lxc/lxc.h | 7 +++++++
src/lxc/lxccontainer.c | 26 +++++++++++++++++++++++++-
src/lxc/lxccontainer.h | 14 ++++++++++++++
src/lxc/start.c | 10 ++++++++++
5 files changed, 74 insertions(+), 1 deletion(-)
diff --git a/src/lxc/attach.c b/src/lxc/attach.c
index 231fa5f..cb480ed 100644
--- a/src/lxc/attach.c
+++ b/src/lxc/attach.c
@@ -708,6 +708,24 @@ static int attach_child_main(struct attach_clone_payload *payload)
TRACE("Dropped capabilities");
}
+#ifdef HAVE_ISULAD
+ /* isulad: set workdir */
+ if (init_ctx->container->lxc_conf->init_cwd) {
+ char *init_cwd;
+ init_cwd = init_ctx->container->lxc_conf->init_cwd;
+ /* try to create workdir if not exist */
+ struct stat st;
+ if (stat(init_cwd, &st) < 0 && mkdir_p(init_cwd, 0750) < 0) {
+ SYSERROR("Try to create directory \"%s\" as workdir failed when attach", init_cwd);
+ goto on_error;
+ }
+ if (chdir(init_cwd)) {
+ SYSERROR("Could not change directory to \"%s\" when attach", init_cwd);
+ goto on_error;
+ }
+ }
+#endif
+
/* Always set the environment (specify (LXC_ATTACH_KEEP_ENV, NULL, NULL)
* if you want this to be a no-op).
*/
diff --git a/src/lxc/lxc.h b/src/lxc/lxc.h
index 630eff0..99fd422 100644
--- a/src/lxc/lxc.h
+++ b/src/lxc/lxc.h
@@ -83,6 +83,13 @@ extern lxc_state_t lxc_state(const char *name, const char *lxcpath);
*/
extern struct lxc_container *lxc_container_new(const char *name, const char *configpath);
+#ifdef HAVE_ISULAD
+/*
+ * Create a new container without loading config.
+ */
+extern struct lxc_container *lxc_container_without_config_new(const char *name, const char *configpath);
+#endif
+
/*
* Returns 1 on success, 0 on failure.
*/
diff --git a/src/lxc/lxccontainer.c b/src/lxc/lxccontainer.c
index 9b3ab75..ce2b2bf 100644
--- a/src/lxc/lxccontainer.c
+++ b/src/lxc/lxccontainer.c
@@ -5595,7 +5595,11 @@ static bool do_lxcapi_get_container_pids(struct lxc_container *c, pid_t **pids,s
WRAP_API_2(bool, lxcapi_get_container_pids, pid_t **,size_t *)
#endif
+#ifdef HAVE_ISULAD
+static struct lxc_container *do_lxc_container_new(const char *name, const char *configpath, bool load_config)
+#else
struct lxc_container *lxc_container_new(const char *name, const char *configpath)
+#endif
{
struct lxc_container *c;
size_t len;
@@ -5653,12 +5657,19 @@ struct lxc_container *lxc_container_new(const char *name, const char *configpath
fprintf(stderr, "Error allocating oci hooks file pathname\n");
goto err;
}
-#endif
+ if (load_config && file_exists(c->configfile)) {
+ if (!lxcapi_load_config(c, NULL)) {
+ fprintf(stderr, "Failed to load config for %s\n", name);
+ goto err;
+ }
+ }
+#else
if (file_exists(c->configfile) && !lxcapi_load_config(c, NULL)) {
fprintf(stderr, "Failed to load config for %s\n", name);
goto err;
}
+#endif
rc = ongoing_create(c);
switch (rc) {
@@ -5761,6 +5772,19 @@ err:
return NULL;
}
+#ifdef HAVE_ISULAD
+// isulad: new container without load config to save time
+struct lxc_container *lxc_container_without_config_new(const char *name, const char *configpath)
+{
+ return do_lxc_container_new(name, configpath, false);
+}
+
+struct lxc_container *lxc_container_new(const char *name, const char *configpath)
+{
+ return do_lxc_container_new(name, configpath, true);
+}
+#endif
+
int lxc_get_wait_states(const char **states)
{
int i;
diff --git a/src/lxc/lxccontainer.h b/src/lxc/lxccontainer.h
index f1621f9..e69be8f 100644
--- a/src/lxc/lxccontainer.h
+++ b/src/lxc/lxccontainer.h
@@ -1097,6 +1097,20 @@ struct lxc_console_log {
*/
struct lxc_container *lxc_container_new(const char *name, const char *configpath);
+#ifdef HAVE_ISULAD
+/*!
+ * \brief Create a new container without loading config.
+ *
+ * \param name Name to use for container.
+ * \param configpath Full path to configuration file to use.
+ *
+ * \return Newly-allocated container, or \c NULL on error.
+ *
+ * \note This function can only used for listing container.
+ */
+struct lxc_container *lxc_container_without_config_new(const char *name, const char *configpath);
+#endif
+
/*!
* \brief Add a reference to the specified container.
*
diff --git a/src/lxc/start.c b/src/lxc/start.c
index bb2e74a..70ce1bd 100644
--- a/src/lxc/start.c
+++ b/src/lxc/start.c
@@ -1609,6 +1609,16 @@ static int do_start(void *data)
close_prot_errno_disarm(devnull_fd);
if (handler->conf->init_cwd) {
+#ifdef HAVE_ISULAD
+ /* try to craete workdir if not exist */
+ struct stat st;
+ if (stat(handler->conf->init_cwd, &st) < 0 && mkdir_p(handler->conf->init_cwd, 0755) < 0) {
+ SYSERROR("Try to create directory \"%s\" as workdir failed", handler->conf->init_cwd);
+ lxc_write_error_message(handler->conf->errpipe[1], "%s:%d: Failed to create workdir: %s.",
+ __FILE__, __LINE__, strerror(errno));
+ goto out_warn_father;
+ }
+#endif
ret = chdir(handler->conf->init_cwd);
if (ret < 0) {
SYSERROR("Could not change directory to \"%s\"",
--
1.8.3.1

103
0029-Supporting-additional-groups-configuration.patch
View File

@ -1,103 +0,0 @@
From f25dd7358ea454e78c41094e79764ea9e09f28e7 Mon Sep 17 00:00:00 2001
From: wujing <wujing50@huawei.com>
Date: Wed, 15 Apr 2020 03:57:20 -0400
Subject: [PATCH 29/49] Supporting additional groups configuration
Signed-off-by: wujing <wujing50@huawei.com>
---
src/lxc/confile.c | 65 +++++++++++++++++++++++++++++++++++++++++++++++++++++++
1 file changed, 65 insertions(+)
diff --git a/src/lxc/confile.c b/src/lxc/confile.c
index 9ba3c7c..55cba6d 100644
--- a/src/lxc/confile.c
+++ b/src/lxc/confile.c
@@ -149,6 +149,7 @@ lxc_config_define(sysctl);
lxc_config_define(proc);
#ifdef HAVE_ISULAD
lxc_config_define(init_args);
+lxc_config_define(init_groups);
lxc_config_define(populate_device);
lxc_config_define(umask);
lxc_config_define(rootfs_masked_paths);
@@ -268,6 +269,7 @@ static struct lxc_config_t config_jump_table[] = {
{ "lxc.proc", set_config_proc, get_config_proc, clr_config_proc, },
#ifdef HAVE_ISULAD
{ "lxc.isulad.init.args", set_config_init_args, get_config_init_args, clr_config_init_args, },
+ { "lxc.isulad.init.groups", set_config_init_groups, get_config_init_groups, clr_config_init_groups, },
{ "lxc.isulad.populate.device", set_config_populate_device, get_config_populate_device, clr_config_populate_device, },
{ "lxc.isulad.umask", set_config_umask, get_config_umask, clr_config_umask, },
{ "lxc.isulad.rootfs.maskedpaths", set_config_rootfs_masked_paths, get_config_rootfs_masked_paths, clr_config_rootfs_masked_paths, },
@@ -6247,6 +6249,69 @@ static inline int clr_config_init_args(const char *key, struct lxc_conf *c,
return lxc_clear_init_args(c);
}
+/* isulad: set config for init groups */
+static int set_config_init_groups(const char *key, const char *value,
+ struct lxc_conf *lxc_conf, void *data)
+{
+ char *groups = NULL;
+ char *token = NULL;
+ int ret = -1;
+
+ if (lxc_config_value_empty(value))
+ return lxc_clear_init_groups(lxc_conf);
+
+ groups = strdup(value);
+ if (!groups)
+ return -1;
+
+ /* In case several capability keep is specified in a single line
+ * split these caps in a single element for the list.
+ */
+ lxc_iterate_parts(token, groups, " \t") {
+ gid_t *tmp = NULL;
+ if (lxc_mem_realloc((void **)&tmp, (lxc_conf->init_groups_len + 1) * sizeof(gid_t), lxc_conf->init_groups,
+ (lxc_conf->init_groups_len) * sizeof(gid_t)) != 0) {
+ ERROR("Out of memory");
+ goto on_error;
+ }
+ lxc_conf->init_groups = tmp;
+ tmp[lxc_conf->init_groups_len] = atoll(token);
+ lxc_conf->init_groups_len++;
+ }
+
+ ret = 0;
+
+on_error:
+ free(groups);
+
+ return ret;
+}
+
+/* isulad: get config init groups */
+static int get_config_init_groups(const char *key, char *retv, int inlen,
+ struct lxc_conf *c, void *data)
+{
+ int i, len, fulllen = 0;
+
+ if (!retv)
+ inlen = 0;
+ else
+ memset(retv, 0, inlen);
+
+ for (i = 0; i < c->init_groups_len; i++) {
+ strprint(retv, inlen, "%u\n", c->init_groups[i]);
+ }
+
+ return fulllen;
+}
+
+/* isulad: clr config init args*/
+static inline int clr_config_init_groups(const char *key, struct lxc_conf *c,
+ void *data)
+{
+ return lxc_clear_init_groups(c);
+}
+
/* isulad: set config for populate device */
static int set_config_populate_device(const char *key, const char *value,
struct lxc_conf *lxc_conf, void *data)
--
1.8.3.1

71
0030-set-negative-files.limit-value-to-max.patch
View File

@ -1,71 +0,0 @@
From eef7e463b7d4bebc305d65c35288c9fab6a5486f Mon Sep 17 00:00:00 2001
From: wujing <wujing50@huawei.com>
Date: Wed, 15 Apr 2020 05:45:49 -0400
Subject: [PATCH 30/49] set negative files.limit value to max
Signed-off-by: wujing <wujing50@huawei.com>
---
src/lxc/cgroups/cgfsng.c | 19 +++++++++++++++----
src/lxc/storage/storage.c | 8 +++++++-
2 files changed, 22 insertions(+), 5 deletions(-)
diff --git a/src/lxc/cgroups/cgfsng.c b/src/lxc/cgroups/cgfsng.c
index 00270ab..b6aef12 100644
--- a/src/lxc/cgroups/cgfsng.c
+++ b/src/lxc/cgroups/cgfsng.c
@@ -3481,16 +3481,27 @@ __cgfsng_ops static bool cgfsng_setup_limits_legacy(struct cgroup_ops *ops,
cg = iterator->elem;
if (do_devices == !strncmp("devices", cg->subsystem, 7)) {
- if (isulad_cg_legacy_set_data(ops, cg->subsystem, cg->value)) {
+ const char *cgvalue = cg->value;
+ if (strcmp(cg->subsystem, "files.limit") == 0) {
+ if (lxc_safe_long_long(cgvalue, &setvalue) != 0) {
+ SYSERROR("Invalid integer value %s", cgvalue);
+ goto out;
+ }
+ if (setvalue <= 0) {
+ cgvalue = "max";
+ }
+ }
+ if (isulad_cg_legacy_set_data(ops, cg->subsystem, cgvalue)) {
if (do_devices && (errno == EACCES || errno == EPERM)) {
- SYSWARN("Failed to set \"%s\" to \"%s\"", cg->subsystem, cg->value);
+ SYSWARN("Failed to set \"%s\" to \"%s\"", cg->subsystem, cgvalue);
continue;
}
- SYSERROR("Failed to set \"%s\" to \"%s\"", cg->subsystem, cg->value);
+ SYSERROR("Failed to set \"%s\" to \"%s\"", cg->subsystem, cgvalue);
goto out;
}
- DEBUG("Set controller \"%s\" set to \"%s\"", cg->subsystem, cg->value);
+ DEBUG("Set controller \"%s\" set to \"%s\"", cg->subsystem, cgvalue);
}
+
// isulad: check cpu shares
if (strcmp(cg->subsystem, "cpu.shares") == 0) {
if (isulad_cg_legacy_get_data(ops, cg->subsystem, value, sizeof(value) - 1) < 0) {
diff --git a/src/lxc/storage/storage.c b/src/lxc/storage/storage.c
index 876311a..5291b24 100644
--- a/src/lxc/storage/storage.c
+++ b/src/lxc/storage/storage.c
@@ -591,9 +591,15 @@ bool storage_destroy(struct lxc_conf *conf)
int destroy_rv = 0;
r = storage_init(conf);
+#ifdef HAVE_ISULAD
+ if (r == NULL) {
+ WARN("%s 's storage init failed, the storage may be deleted already", conf->name);
+ return true;
+ }
+#else
if (!r)
return ret;
-
+#endif
destroy_rv = r->ops->destroy(r);
if (destroy_rv == 0)
ret = true;
--
1.8.3.1

115
0031-head-file-remove-macro-HAVE_ISULAD-in-installed-head.patch
View File

@ -1,115 +0,0 @@
From 5065f006a775e345fa80c1250442ff0f5c05383f Mon Sep 17 00:00:00 2001
From: LiFeng <lifeng68@huawei.com>
Date: Wed, 15 Apr 2020 17:46:54 +0800
Subject: [PATCH 31/49] head file: remove macro HAVE_ISULAD in installed head
file
Signed-off-by: LiFeng <lifeng68@huawei.com>
---
src/lxc/attach_options.h | 25 ++-----------------------
src/lxc/lxccontainer.h | 6 ------
2 files changed, 2 insertions(+), 29 deletions(-)
diff --git a/src/lxc/attach_options.h b/src/lxc/attach_options.h
index 7b0ea5e..5f01739 100644
--- a/src/lxc/attach_options.h
+++ b/src/lxc/attach_options.h
@@ -113,15 +113,12 @@ typedef struct lxc_attach_options_t {
/*! File descriptor to log output. */
int log_fd;
-#ifdef HAVE_ISULAD
+
char *init_fifo[3]; /* isulad: default fifos for the start */
int64_t timeout;/* isulad: Seconds for waiting on a container to attach/exec before it is killed*/
const char *suffix;
-#endif
-
} lxc_attach_options_t;
-#ifdef HAVE_ISULAD
/*! Default attach options to use */
#define LXC_ATTACH_OPTIONS_DEFAULT \
{ \
@@ -140,25 +137,7 @@ typedef struct lxc_attach_options_t {
/* .log_fd = */ -EBADF, \
/* .init_fifo = */ {NULL, NULL, NULL}, \
}
-#else
-/*! Default attach options to use */
-#define LXC_ATTACH_OPTIONS_DEFAULT \
- { \
- /* .attach_flags = */ LXC_ATTACH_DEFAULT, \
- /* .namespaces = */ -1, \
- /* .personality = */ -1, \
- /* .initial_cwd = */ NULL, \
- /* .uid = */ (uid_t)-1, \
- /* .gid = */ (gid_t)-1, \
- /* .env_policy = */ LXC_ATTACH_KEEP_ENV, \
- /* .extra_env_vars = */ NULL, \
- /* .extra_keep_env = */ NULL, \
- /* .stdin_fd = */ 0, \
- /* .stdout_fd = */ 1, \
- /* .stderr_fd = */ 2, \
- /* .log_fd = */ -EBADF, \
- }
-#endif
+
/*!
* Representation of a command to run in a container.
*/
diff --git a/src/lxc/lxccontainer.h b/src/lxc/lxccontainer.h
index e69be8f..6ede70c 100644
--- a/src/lxc/lxccontainer.h
+++ b/src/lxc/lxccontainer.h
@@ -107,7 +107,6 @@ struct lxc_container {
/*! Full path to configuration file */
char *config_path;
-#ifdef HAVE_ISULAD
/*! isulad:
* \private
* exit FIFO File to open used monitor the state of lxc monitor process.
@@ -125,7 +124,6 @@ struct lxc_container {
* full path of json file
* */
char *ocihookfile;
-#endif
/*!
* \brief Determine if \c /var/lib/lxc/$name/config exists.
@@ -886,7 +884,6 @@ struct lxc_container {
*/
int (*init_pidfd)(struct lxc_container *c);
-#ifdef HAVE_ISULAD
/*! isulad add
* \brief An API call to set the path of info file
*
@@ -963,7 +960,6 @@ struct lxc_container {
* \return \c true on success, else \c false.
*/
bool (*get_container_pids)(struct lxc_container *c,pid_t **pids,size_t *pids_len);
-#endif
};
/*!
@@ -1097,7 +1093,6 @@ struct lxc_console_log {
*/
struct lxc_container *lxc_container_new(const char *name, const char *configpath);
-#ifdef HAVE_ISULAD
/*!
* \brief Create a new container without loading config.
*
@@ -1109,7 +1104,6 @@ struct lxc_container *lxc_container_new(const char *name, const char *configpath
* \note This function can only used for listing container.
*/
struct lxc_container *lxc_container_without_config_new(const char *name, const char *configpath);
-#endif
/*!
* \brief Add a reference to the specified container.
--
1.8.3.1

68
0032-link-proc-mounts-to-etc-mtab.patch
View File

@ -1,68 +0,0 @@
From e86ebe923f1ecc072d8a99949871b46fe8188ac9 Mon Sep 17 00:00:00 2001
From: wujing <wujing50@huawei.com>
Date: Wed, 15 Apr 2020 06:01:36 -0400
Subject: [PATCH 32/49] link proc mounts to etc mtab
Signed-off-by: wujing <wujing50@huawei.com>
---
src/lxc/conf.c | 37 +++++++++++++++++++++++++++++++++++++
1 file changed, 37 insertions(+)
diff --git a/src/lxc/conf.c b/src/lxc/conf.c
index 325e0c2..6856b1d 100644
--- a/src/lxc/conf.c
+++ b/src/lxc/conf.c
@@ -3977,6 +3977,37 @@ struct oci_hook_conf {
int which;
};
+static int create_mtab_link()
+{
+ ssize_t ret;
+ int mret;
+ struct stat sbuf;
+ const char *pathname = "/proc/mounts";
+ const char *slink = "/etc/mtab";
+
+ if (file_exists(slink)) {
+ return 0;
+ }
+
+ ret = stat(pathname, &sbuf);
+ if (ret < 0) {
+ SYSERROR("Failed to stat %s: %s", pathname, strerror(errno));
+ return -1;
+ }
+
+ mret = symlink(pathname, slink);
+ if (mret < 0 && errno != EEXIST) {
+ if (errno == EROFS) {
+ WARN("Failed to create link %s for target %s. Read-only filesystem", slink, pathname);
+ } else {
+ SYSERROR("Failed to create \"%s\"", slink);
+ return -1;
+ }
+ }
+
+ return 0;
+}
+
struct wait_conf {
pid_t pid;
unsigned long long startat;
@@ -4696,6 +4727,12 @@ int lxc_setup(struct lxc_handler *handler)
return log_error(-1, "failed to setup readonlypaths");
}
}
+
+ // isulad: create link /etc/mtab for /proc/mounts
+ if (create_mtab_link() != 0) {
+ ERROR("failed to create link /etc/mtab for target /proc/mounts");
+ goto on_error;
+ }
#endif
if (!lxc_list_empty(&lxc_conf->keepcaps)) {
--
1.8.3.1

423
0033-build-add-secure-build-flags.patch
View File

@ -1,423 +0,0 @@
From 2b69f168a6847885233e88be02a1143a4c55b59f Mon Sep 17 00:00:00 2001
From: LiFeng <lifeng68@huawei.com>
Date: Wed, 15 Apr 2020 18:58:24 +0800
Subject: [PATCH 33/49] build: add secure build flags
Signed-off-by: LiFeng <lifeng68@huawei.com>
---
configure.ac | 14 +++++-
src/lxc/Makefile.am | 8 +++-
src/lxc/cgroups/cgfsng.c | 117 ++++++++++++++++++++++++---------------------
src/lxc/confile.c | 1 -
src/lxc/terminal.c | 6 ++-
src/lxc/tools/lxc_attach.c | 2 -
src/lxc/utils.c | 7 +++
7 files changed, 93 insertions(+), 62 deletions(-)
diff --git a/configure.ac b/configure.ac
index 56d0cb7..438d292 100644
--- a/configure.ac
+++ b/configure.ac
@@ -43,6 +43,7 @@ AM_INIT_AUTOMAKE([-Wall -Werror -Wno-portability subdir-objects])
AC_CANONICAL_HOST
AM_PROG_CC_C_O
AC_USE_SYSTEM_EXTENSIONS
+CFLAGS=`echo "${CFLAGS#\-g}"`
# Test if we have a new enough compiler.
AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[
@@ -190,6 +191,11 @@ AC_ARG_ENABLE([werror],
[AS_HELP_STRING([--disable-werror], [do not treat warnings as errors])],
[enable_werror=$enableval], [enable_werror=yes])
+AC_ARG_ENABLE([debug],
+ [AC_HELP_STRING([--enable-debug],
+ [set -g into cflags [default=no]])],
+ [], [enable_debug=no])
+
# Allow disabling rpath
AC_ARG_ENABLE([rpath],
[AS_HELP_STRING([--enable-rpath], [set rpath in executables [default=no]])],
@@ -732,7 +738,6 @@ AX_CHECK_COMPILE_FLAG([-fno-strict-aliasing], [CFLAGS="$CFLAGS -fno-strict-alias
AX_CHECK_COMPILE_FLAG([-fstack-clash-protection], [CFLAGS="$CFLAGS -fstack-clash-protection"],,[-Werror])
AX_CHECK_LINK_FLAG([-fstack-protector-strong], [CFLAGS="$CFLAGS -fstack-protector-strong"],,[-Werror])
AX_CHECK_LINK_FLAG([--param=ssp-buffer-size=4], [CFLAGS="$CFLAGS --param=ssp-buffer-size=4"],,[-Werror])
-AX_CHECK_COMPILE_FLAG([-g], [CFLAGS="$CFLAGS -g"],,[-Werror])
AX_CHECK_COMPILE_FLAG([--mcet -fcf-protection], [CFLAGS="$CFLAGS --mcet -fcf-protection"],,[-Werror])
AX_CHECK_COMPILE_FLAG([-Werror=implicit-function-declaration], [CFLAGS="$CFLAGS -Werror=implicit-function-declaration"],,[-Werror])
AX_CHECK_COMPILE_FLAG([-Wlogical-op], [CFLAGS="$CFLAGS -Wlogical-op"],,[-Werror])
@@ -759,12 +764,17 @@ AX_CHECK_COMPILE_FLAG([-fexceptions], [CFLAGS="$CFLAGS -fexceptions"],,[-Werror]
AX_CHECK_LINK_FLAG([-z relro], [LDFLAGS="$LDFLAGS -z relro"],,[])
AX_CHECK_LINK_FLAG([-z now], [LDFLAGS="$LDFLAGS -z now"],,[])
+AX_CHECK_LINK_FLAG([-z noexecstack], [LDFLAGS="$LDFLAGS -z noexecstack"],,[])
-CFLAGS="$CFLAGS -Wvla -std=gnu11"
+CFLAGS="$CFLAGS -Wvla -std=gnu11 -D_FORTIFY_SOURCE=2 -Wall -fPIC -fPIE -pie"
if test "x$enable_werror" = "xyes"; then
CFLAGS="$CFLAGS -Werror"
fi
+if test "x$enable_debug" = "xyes"; then
+ CFLAGS="$CFLAGS -g"
+fi
+
AC_ARG_ENABLE([thread-safety],
[AS_HELP_STRING([--enable-thread-safety], [enforce thread-safety otherwise fail the build [default=yes]])],
[enable_thread_safety=$enableval], [enable_thread_safety=yes])
diff --git a/src/lxc/Makefile.am b/src/lxc/Makefile.am
index c288c51..0e1ba8d 100644
--- a/src/lxc/Makefile.am
+++ b/src/lxc/Makefile.am
@@ -276,6 +276,10 @@ liblxc_la_CFLAGS += -fsanitize=address \
-fno-omit-frame-pointer
endif
+if HAVE_ISULAD
+liblxc_la_CFLAGS += -D_FORTIFY_SOURCE=2 -Wall
+endif
+
if ENABLE_UBSAN
liblxc_la_CFLAGS += -fsanitize=undefined
endif
@@ -286,7 +290,9 @@ liblxc_la_LDFLAGS = -pthread \
-version-info @LXC_ABI_MAJOR@
if HAVE_ISULAD
-liblxc_la_LDFLAGS += @YAJL_LIBS@
+liblxc_la_LDFLAGS += @YAJL_LIBS@ -Wl,-z,relro \
+ -Wl,-z,now \
+ -Wl,-z,noexecstack
endif
liblxc_la_LIBADD = $(CAP_LIBS) \
diff --git a/src/lxc/cgroups/cgfsng.c b/src/lxc/cgroups/cgfsng.c
index b6aef12..1047c08 100644
--- a/src/lxc/cgroups/cgfsng.c
+++ b/src/lxc/cgroups/cgfsng.c
@@ -214,6 +214,7 @@ static char *read_file(const char *fnam)
return move_ptr(buf);
}
+#ifndef HAVE_ISULAD
/* Taken over modified from the kernel sources. */
#define NBITS 32 /* bits in uint32_t */
#define DIV_ROUND_UP(n, d) (((n) + (d)-1) / (d))
@@ -476,12 +477,14 @@ static bool copy_parent_file(const char *parent_cgroup,
value, child_cgroup, file);
return true;
}
+#endif
static inline bool is_unified_hierarchy(const struct hierarchy *h)
{
return h->version == CGROUP2_SUPER_MAGIC;
}
+#ifndef HAVE_ISULAD
/*
* Initialize the cpuset hierarchy in first directory of @cgroup_leaf and set
* cgroup.clone_children so that children inherit settings. Since the
@@ -561,6 +564,7 @@ static int cg_legacy_handle_cpuset_hierarchy(struct hierarchy *h,
return fret;
}
+#endif
/* Given two null-terminated lists of strings, return true if any string is in
* both.
@@ -946,29 +950,6 @@ static void lxc_cgfsng_print_basecg_debuginfo(char *basecginfo, char **klist,
TRACE("named subsystem %d: %s", k, *it);
}
-static int cgroup_tree_remove(struct hierarchy **hierarchies,
- const char *container_cgroup)
-{
- if (!container_cgroup || !hierarchies)
- return 0;
-
- for (int i = 0; hierarchies[i]; i++) {
- struct hierarchy *h = hierarchies[i];
- int ret;
-
- if (!h->container_full_path)
- continue;
-
- ret = lxc_rm_rf(h->container_full_path);
- if (ret < 0)
- WARN("Failed to destroy \"%s\"", h->container_full_path);
-
- free_disarm(h->container_full_path);
- }
-
- return 0;
-}
-
struct generic_userns_exec_data {
struct hierarchy **hierarchies;
const char *container_cgroup;
@@ -977,29 +958,6 @@ struct generic_userns_exec_data {
char *path;
};
-static int cgroup_tree_remove_wrapper(void *data)
-{
- struct generic_userns_exec_data *arg = data;
- uid_t nsuid = (arg->conf->root_nsuid_map != NULL) ? 0 : arg->conf->init_uid;
- gid_t nsgid = (arg->conf->root_nsgid_map != NULL) ? 0 : arg->conf->init_gid;
- int ret;
-
- if (!lxc_setgroups(0, NULL) && errno != EPERM)
- return log_error_errno(-1, errno, "Failed to setgroups(0, NULL)");
-
- ret = setresgid(nsgid, nsgid, nsgid);
- if (ret < 0)
- return log_error_errno(-1, errno, "Failed to setresgid(%d, %d, %d)",
- (int)nsgid, (int)nsgid, (int)nsgid);
-
- ret = setresuid(nsuid, nsuid, nsuid);
- if (ret < 0)
- return log_error_errno(-1, errno, "Failed to setresuid(%d, %d, %d)",
- (int)nsuid, (int)nsuid, (int)nsuid);
-
- return cgroup_tree_remove(arg->hierarchies, arg->container_cgroup);
-}
-
#ifdef HAVE_ISULAD
static int isulad_cgroup_tree_remove(struct hierarchy **hierarchies,
@@ -1100,6 +1058,52 @@ __cgfsng_ops static bool isulad_cgfsng_payload_destroy(struct cgroup_ops *ops,
return true;
}
#else
+static int cgroup_tree_remove(struct hierarchy **hierarchies,
+ const char *container_cgroup)
+{
+ if (!container_cgroup || !hierarchies)
+ return 0;
+
+ for (int i = 0; hierarchies[i]; i++) {
+ struct hierarchy *h = hierarchies[i];
+ int ret;
+
+ if (!h->container_full_path)
+ continue;
+
+ ret = lxc_rm_rf(h->container_full_path);
+ if (ret < 0)
+ WARN("Failed to destroy \"%s\"", h->container_full_path);
+
+ free_disarm(h->container_full_path);
+ }
+
+ return 0;
+}
+
+static int cgroup_tree_remove_wrapper(void *data)
+{
+ struct generic_userns_exec_data *arg = data;
+ uid_t nsuid = (arg->conf->root_nsuid_map != NULL) ? 0 : arg->conf->init_uid;
+ gid_t nsgid = (arg->conf->root_nsgid_map != NULL) ? 0 : arg->conf->init_gid;
+ int ret;
+
+ if (!lxc_setgroups(0, NULL) && errno != EPERM)
+ return log_error_errno(-1, errno, "Failed to setgroups(0, NULL)");
+
+ ret = setresgid(nsgid, nsgid, nsgid);
+ if (ret < 0)
+ return log_error_errno(-1, errno, "Failed to setresgid(%d, %d, %d)",
+ (int)nsgid, (int)nsgid, (int)nsgid);
+
+ ret = setresuid(nsuid, nsuid, nsuid);
+ if (ret < 0)
+ return log_error_errno(-1, errno, "Failed to setresuid(%d, %d, %d)",
+ (int)nsuid, (int)nsuid, (int)nsuid);
+
+ return cgroup_tree_remove(arg->hierarchies, arg->container_cgroup);
+}
+
__cgfsng_ops static void cgfsng_payload_destroy(struct cgroup_ops *ops,
struct lxc_handler *handler)
{
@@ -1227,6 +1231,14 @@ try_lxc_rm_rf:
}
#endif
+#ifdef HAVE_ISULAD
+__cgfsng_ops static inline bool cgfsng_monitor_create(struct cgroup_ops *ops,
+ struct lxc_handler *handler)
+{
+ return true;
+}
+#else
+
static int mkdir_eexist_on_last(const char *dir, mode_t mode)
{
const char *tmp = dir;
@@ -1311,13 +1323,6 @@ static void cgroup_tree_leaf_remove(struct hierarchy *h, bool payload)
SYSWARN("Failed to rmdir(\"%s\") cgroup", full_path);
}
-#ifdef HAVE_ISULAD
-__cgfsng_ops static inline bool cgfsng_monitor_create(struct cgroup_ops *ops,
- struct lxc_handler *handler)
-{
- return true;
-}
-#else
__cgfsng_ops static inline bool cgfsng_monitor_create(struct cgroup_ops *ops,
struct lxc_handler *handler)
{
@@ -3038,6 +3043,7 @@ static int device_cgroup_parse_access(struct device_item *device, const char *va
return 0;
}
+#ifndef HAVE_ISULAD
static int device_cgroup_rule_parse(struct device_item *device, const char *key,
const char *val)
{
@@ -3124,6 +3130,7 @@ static int device_cgroup_rule_parse(struct device_item *device, const char *key,
return device_cgroup_parse_access(device, ++val);
}
+#endif
#ifdef HAVE_ISULAD
__cgfsng_ops static int cgfsng_set(struct cgroup_ops *ops,
@@ -3307,6 +3314,7 @@ static int convert_devpath(const char *invalue, char *dest)
return 0;
}
+#ifndef HAVE_ISULAD
/* Called from setup_limits - here we have the container's cgroup_data because
* we created the cgroups.
*/
@@ -3339,6 +3347,7 @@ static int cg_legacy_set_data(struct cgroup_ops *ops, const char *filename,
return lxc_write_openat(h->container_full_path, filename, value, strlen(value));
}
+#endif
#ifdef HAVE_ISULAD
/* Called from setup_limits - here we have the container's cgroup_data because
@@ -3923,7 +3932,6 @@ static int cg_hybrid_init(struct cgroup_ops *ops, bool relative, bool unprivileg
__do_free char *base_cgroup = NULL, *mountpoint = NULL;
__do_free_string_list char **controller_list = NULL;
int type;
- bool writeable;
struct hierarchy *new;
type = get_cgroup_version(line);
@@ -3989,6 +3997,7 @@ static int cg_hybrid_init(struct cgroup_ops *ops, bool relative, bool unprivileg
base_cgroup[1] = '\0';
}
#else
+ bool writeable;
if (type == CGROUP2_SUPER_MAGIC)
writeable = test_writeable_v2(mountpoint, base_cgroup);
else
diff --git a/src/lxc/confile.c b/src/lxc/confile.c
index 55cba6d..f00afe9 100644
--- a/src/lxc/confile.c
+++ b/src/lxc/confile.c
@@ -6228,7 +6228,6 @@ static int get_config_init_args(const char *key, char *retv, int inlen,
struct lxc_conf *c, void *data)
{
int i, len, fulllen = 0;
- struct lxc_list *it;
if (!retv)
inlen = 0;
diff --git a/src/lxc/terminal.c b/src/lxc/terminal.c
index 14686fc..c0a4d1a 100644
--- a/src/lxc/terminal.c
+++ b/src/lxc/terminal.c
@@ -287,6 +287,7 @@ static int lxc_terminal_rotate_log_file(struct lxc_terminal *terminal)
return lxc_terminal_create_log_file(terminal);
}
+#ifndef HAVE_ISULAD
static int lxc_terminal_write_log_file(struct lxc_terminal *terminal, char *buf,
int bytes_read)
{
@@ -392,6 +393,7 @@ static int lxc_terminal_write_log_file(struct lxc_terminal *terminal, char *buf,
bytes_read -= ret;
return bytes_read;
}
+#endif
#ifdef HAVE_ISULAD
/* get time buffer */
@@ -1240,8 +1242,8 @@ void lxc_terminal_free(struct lxc_conf *conf, int fd)
static int lxc_terminal_peer_default(struct lxc_terminal *terminal)
{
- struct lxc_terminal_state *ts;
- const char *path;
+ struct lxc_terminal_state *ts = NULL;
+ const char *path = NULL;
int ret = 0;
if (terminal->path)
diff --git a/src/lxc/tools/lxc_attach.c b/src/lxc/tools/lxc_attach.c
index b068c9a..48e18bb 100644
--- a/src/lxc/tools/lxc_attach.c
+++ b/src/lxc/tools/lxc_attach.c
@@ -507,11 +507,9 @@ out:
int main(int argc, char *argv[])
{
- int ret = -1;
int wexit = 0;
struct lxc_log log;
char *errmsg = NULL;
- pid_t pid;
lxc_attach_options_t attach_options = LXC_ATTACH_OPTIONS_DEFAULT;
lxc_attach_command_t command = (lxc_attach_command_t){.program = NULL};
diff --git a/src/lxc/utils.c b/src/lxc/utils.c
index 39413ee..ba69995 100644
--- a/src/lxc/utils.c
+++ b/src/lxc/utils.c
@@ -1427,9 +1427,11 @@ static int lxc_get_unused_loop_dev(char *name_loop)
{
int loop_nr, ret;
int fd_ctl = -1, fd_tmp = -1;
+#if HAVE_ISULAD
// isulad: retry and try mknod
int max_retry = 200;
bool try_mknod = true;
+#endif
fd_ctl = open("/dev/loop-control", O_RDWR | O_CLOEXEC);
if (fd_ctl < 0) {
@@ -1446,7 +1448,10 @@ static int lxc_get_unused_loop_dev(char *name_loop)
ret = snprintf(name_loop, LO_NAME_SIZE, "/dev/loop%d", loop_nr);
if (ret < 0 || ret >= LO_NAME_SIZE)
goto on_error;
+
+#if HAVE_ISULAD
retry:
+#endif
fd_tmp = open(name_loop, O_RDWR | O_CLOEXEC);
if (fd_tmp < 0) {
#if HAVE_ISULAD
@@ -1693,6 +1698,7 @@ uint64_t lxc_find_next_power2(uint64_t n)
return n;
}
+#ifndef HAVE_ISULAD
static int process_dead(/* takes */ int status_fd)
{
__do_close int dupfd = -EBADF;
@@ -1730,6 +1736,7 @@ static int process_dead(/* takes */ int status_fd)
return ret;
}
+#endif
int lxc_set_death_signal(int signal, pid_t parent, int parent_status_fd)
{
--
1.8.3.1

726
0034-support-timeout.patch
View File

@ -1,726 +0,0 @@
From b13e288b8a46262e2c062ddfc152f10739b1691a Mon Sep 17 00:00:00 2001
From: haozi007 <liuhao27@huawei.com>
Date: Wed, 15 Apr 2020 17:35:53 +0800
Subject: [PATCH 34/49] support timeout
Signed-off-by: haozi007 <liuhao27@huawei.com>
---
src/lxc/attach.c | 104 ++++++++++++++++++++++++++++++++++++++--
src/lxc/attach.h | 6 +++
src/lxc/commands.c | 5 ++
src/lxc/execute.c | 12 +++++
src/lxc/lxc.h | 13 ++++-
src/lxc/lxccontainer.c | 41 ++++++++++++++--
src/lxc/lxccontainer.h | 16 +++++++
src/lxc/start.c | 115 +++++++++++++++++++++++++++++++++++++++++++--
src/lxc/start.h | 6 +++
src/lxc/tools/arguments.h | 2 +
src/lxc/tools/lxc_attach.c | 10 ++++
src/lxc/tools/lxc_start.c | 14 ++++++
src/lxc/utils.c | 11 +++++
src/lxc/utils.h | 2 +
14 files changed, 346 insertions(+), 11 deletions(-)
diff --git a/src/lxc/attach.c b/src/lxc/attach.c
index cb480ed..510c069 100644
--- a/src/lxc/attach.c
+++ b/src/lxc/attach.c
@@ -45,12 +45,27 @@
#include "terminal.h"
#include "utils.h"
+#if HAVE_SYS_PERSONALITY_H
+#include <sys/personality.h>
+#endif
+
#ifdef HAVE_ISULAD
#include "exec_commands.h"
-#endif
-#if HAVE_SYS_PERSONALITY_H
-#include <sys/personality.h>
+typedef enum {
+ ATTACH_INIT,
+ ATTACH_TIMEOUT,
+ ATTACH_MAX,
+} attach_timeout_t;
+
+static volatile attach_timeout_t g_attach_timeout_state = ATTACH_INIT;
+
+struct attach_timeout_conf {
+ int64_t timeout;
+ unsigned long long start_time;
+ pid_t pid;
+};
+
#endif
lxc_log_define(attach, lxc);
@@ -1038,9 +1053,67 @@ static inline void lxc_attach_terminal_close_log(struct lxc_terminal *terminal)
close_prot_errno_disarm(terminal->log_fd);
}
+#ifdef HAVE_ISULAD
+/* isulad: attach timeout thread function */
+static void* wait_attach_timeout(void *arg)
+{
+ struct attach_timeout_conf *conf = (struct attach_timeout_conf *)arg;
+
+ if (!conf || conf->timeout < 1)
+ goto out;
+ sleep(conf->timeout);
+ if (lxc_process_alive(conf->pid, conf->start_time)) {
+ g_attach_timeout_state = ATTACH_TIMEOUT;
+ if (kill(conf->pid, SIGKILL) < 0) {
+ ERROR("Failed to send signal %d to pid %d", SIGKILL, conf->pid);
+ }
+ }
+
+out:
+ free(conf);
+ return ((void *)0);
+}
+
+/* isulad: create attach timeout thread */
+static int create_attach_timeout_thread(int64_t attach_timeout, pid_t pid)
+{
+ int ret = 0;
+ pthread_t ptid;
+ pthread_attr_t attr;
+ struct attach_timeout_conf *timeout_conf = NULL;
+
+ timeout_conf = malloc(sizeof(struct attach_timeout_conf));
+ if (timeout_conf == NULL) {
+ ERROR("Failed to malloc attach timeout conf");
+ ret = -1;
+ goto out;
+ }
+
+ memset(timeout_conf, 0, sizeof(struct attach_timeout_conf));
+ timeout_conf->timeout = attach_timeout;
+ timeout_conf->pid = pid;
+ timeout_conf->start_time = lxc_get_process_startat(pid);
+
+ pthread_attr_init(&attr);
+ pthread_attr_setdetachstate(&attr, PTHREAD_CREATE_DETACHED);
+ ret = pthread_create(&ptid, &attr, wait_attach_timeout, timeout_conf);
+ if (ret != 0) {
+ ERROR("Create attach wait timeout thread failed");
+ free(timeout_conf);
+ goto out;
+ }
+
+out:
+ return ret;
+}
+int lxc_attach(struct lxc_container *container, lxc_attach_exec_t exec_function,
+ void *exec_payload, lxc_attach_options_t *options,
+ pid_t *attached_process, char **err_msg)
+#else
int lxc_attach(struct lxc_container *container, lxc_attach_exec_t exec_function,
void *exec_payload, lxc_attach_options_t *options,
pid_t *attached_process)
+#endif
{
int i, ret, status;
int ipc_sockets[2];
@@ -1417,6 +1490,26 @@ int lxc_attach(struct lxc_container *container, lxc_attach_exec_t exec_function,
*attached_process = attached_pid;
+#ifdef HAVE_ISULAD
+ if (options->timeout > 0) {
+ ret = create_attach_timeout_thread(options->timeout, *attached_process);
+ if (ret) {
+ ERROR("Failed to create attach timeout thread for container.");
+ goto close_mainloop;
+ }
+ }
+ /* isulad: read error msg from pipe */
+ ssize_t size_read;
+ char errbuf[BUFSIZ + 1] = {0};
+
+ size_read = read(conf->errpipe[0], errbuf, BUFSIZ);
+ if (size_read > 0) {
+ if (err_msg)
+ *err_msg = safe_strdup(errbuf);
+ goto close_mainloop;
+ }
+#endif
+
/* Now shut down communication with child, we're done. */
shutdown(ipc_sockets[0], SHUT_RDWR);
close(ipc_sockets[0]);
@@ -1433,6 +1526,11 @@ int lxc_attach(struct lxc_container *container, lxc_attach_exec_t exec_function,
}
}
+#ifdef HAVE_ISULAD
+ if (g_attach_timeout_state == ATTACH_TIMEOUT && err_msg != NULL && *err_msg == NULL) {
+ *err_msg = safe_strdup("Attach exceeded timeout");
+ }
+#endif
close_mainloop:
if (options->attach_flags & LXC_ATTACH_TERMINAL)
lxc_mainloop_close(&descr);
diff --git a/src/lxc/attach.h b/src/lxc/attach.h
index ef5a6c1..8316344 100644
--- a/src/lxc/attach.h
+++ b/src/lxc/attach.h
@@ -20,9 +20,15 @@ struct lxc_proc_context_info {
int ns_fd[LXC_NS_MAX];
};
+#ifdef HAVE_ISULAD
+extern int lxc_attach(struct lxc_container *container,
+ lxc_attach_exec_t exec_function, void *exec_payload,
+ lxc_attach_options_t *options, pid_t *attached_process, char **err_msg);
+#else
extern int lxc_attach(struct lxc_container *container,
lxc_attach_exec_t exec_function, void *exec_payload,
lxc_attach_options_t *options, pid_t *attached_process);
+#endif
extern int lxc_attach_remount_sys_proc(void);
diff --git a/src/lxc/commands.c b/src/lxc/commands.c
index b21c12b..c32aef1 100644
--- a/src/lxc/commands.c
+++ b/src/lxc/commands.c
@@ -119,7 +119,12 @@ static int lxc_cmd_rsp_recv(int sock, struct lxc_cmd_rr *cmd)
int ret;
struct lxc_cmd_rsp *rsp = &cmd->rsp;
+#ifdef HAVE_ISULAD
+ /*isulad: add timeout 1s to avoid long block due to [lxc monitor] error*/
+ ret = lxc_abstract_unix_recv_fds_timeout(sock, &fd_rsp, 1, rsp, sizeof(*rsp), 1000 * 1000);
+#else
ret = lxc_abstract_unix_recv_fds(sock, &fd_rsp, 1, rsp, sizeof(*rsp));
+#endif
if (ret < 0)
return log_warn_errno(-1,
errno, "Failed to receive response for command \"%s\"",
diff --git a/src/lxc/execute.c b/src/lxc/execute.c
index 7dd8358..59ff604 100644
--- a/src/lxc/execute.c
+++ b/src/lxc/execute.c
@@ -88,14 +88,26 @@ static struct lxc_operations execute_start_ops = {
.post_start = execute_post_start
};
+#ifdef HAVE_ISULAD
+int lxc_execute(const char *name, char *const argv[], int quiet,
+ struct lxc_handler *handler, const char *lxcpath,
+ bool daemonize, int *error_num, unsigned int start_timeout)
+#else
int lxc_execute(const char *name, char *const argv[], int quiet,
struct lxc_handler *handler, const char *lxcpath,
bool daemonize, int *error_num)
+#endif
{
+
struct execute_args args = {.argv = argv, .quiet = quiet};
TRACE("Doing lxc_execute");
handler->conf->is_execute = true;
+#ifdef HAVE_ISULAD
+ return __lxc_start(handler, &execute_start_ops, &args, lxcpath,
+ daemonize, error_num, start_timeout);
+#else
return __lxc_start(handler, &execute_start_ops, &args, lxcpath,
daemonize, error_num);
+#endif
}
diff --git a/src/lxc/lxc.h b/src/lxc/lxc.h
index 99fd422..ec2feaa 100644
--- a/src/lxc/lxc.h
+++ b/src/lxc/lxc.h
@@ -32,9 +32,14 @@ struct lxc_handler;
* @daemonize : whether or not the container is daemonized
* Returns 0 on success, < 0 otherwise
*/
+#ifdef HAVE_ISULAD
+extern int lxc_start(char *const argv[], struct lxc_handler *handler,
+ const char *lxcpath, bool daemonize, int *error_num,
+ unsigned int start_timeout);
+#else
extern int lxc_start(char *const argv[], struct lxc_handler *handler,
const char *lxcpath, bool daemonize, int *error_num);
-
+#endif
/*
* Start the specified command inside an application container
* @name : the name of the container
@@ -44,9 +49,15 @@ extern int lxc_start(char *const argv[], struct lxc_handler *handler,
* @daemonize : whether or not the container is daemonized
* Returns 0 on success, < 0 otherwise
*/
+#ifdef HAVE_ISULAD
+extern int lxc_execute(const char *name, char *const argv[], int quiet,
+ struct lxc_handler *handler, const char *lxcpath,
+ bool daemonize, int *error_num, unsigned int start_timeout);
+#else
extern int lxc_execute(const char *name, char *const argv[], int quiet,
struct lxc_handler *handler, const char *lxcpath,
bool daemonize, int *error_num);
+#endif
/*
* Close the fd associated with the monitoring
diff --git a/src/lxc/lxccontainer.c b/src/lxc/lxccontainer.c
index ce2b2bf..f622a63 100644
--- a/src/lxc/lxccontainer.c
+++ b/src/lxc/lxccontainer.c
@@ -1234,17 +1234,25 @@ reboot:
goto on_error;
}
+#ifdef HAVE_ISULAD
if (useinit) {
ret = lxc_execute(c->name, argv, 1, handler, c->config_path,
- c->daemonize, &c->error_num);
+ c->daemonize, &c->error_num, c->start_timeout);
}
else {
-#ifdef HAVE_ISULAD
handler->disable_pty = c->disable_pty;
handler->open_stdin = c->open_stdin;
-#endif
+ ret = lxc_start(argv, handler, c->config_path, c->daemonize,
+ &c->error_num, c->start_timeout);
+#else
+ if (useinit) {
+ ret = lxc_execute(c->name, argv, 1, handler, c->config_path,
+ c->daemonize, &c->error_num);
+ }
+ else {
ret = lxc_start(argv, handler, c->config_path, c->daemonize,
&c->error_num);
+#endif
}
if (conf->reboot == REBOOT_REQ) {
@@ -4200,8 +4208,13 @@ static int lxcapi_attach(struct lxc_container *c,
current_config = c->lxc_conf;
+#ifdef HAVE_ISULAD
+ ret = lxc_attach(c, exec_function, exec_payload, options,
+ attached_process, &c->lxc_conf->errmsg);
+#else
ret = lxc_attach(c, exec_function, exec_payload, options,
attached_process);
+#endif
current_config = NULL;
return ret;
}
@@ -4221,7 +4234,11 @@ static int do_lxcapi_attach_run_wait(struct lxc_container *c,
command.program = (char *)program;
command.argv = (char **)argv;
+#ifdef HAVE_ISULAD
+ ret = lxc_attach(c, lxc_attach_run_command, &command, options, &pid, NULL);
+#else
ret = lxc_attach(c, lxc_attach_run_command, &command, options, &pid);
+#endif
if (ret < 0)
return ret;
@@ -5593,6 +5610,23 @@ static bool do_lxcapi_get_container_pids(struct lxc_container *c, pid_t **pids,s
}
WRAP_API_2(bool, lxcapi_get_container_pids, pid_t **,size_t *)
+
+/* isulad add start timeout */
+static bool do_lxcapi_set_start_timeout(struct lxc_container *c, unsigned int start_timeout)
+{
+ if (!c || !c->lxc_conf)
+ return false;
+ if (container_mem_lock(c)) {
+ ERROR("Error getting mem lock");
+ return false;
+ }
+ c->start_timeout = start_timeout;
+ container_mem_unlock(c);
+ return true;
+}
+
+WRAP_API_1(bool, lxcapi_set_start_timeout, unsigned int)
+
#endif
#ifdef HAVE_ISULAD
@@ -5764,6 +5798,7 @@ struct lxc_container *lxc_container_new(const char *name, const char *configpath
c->want_open_stdin = lxcapi_want_open_stdin;
c->clean_container_resource = lxcapi_clean_container_resource;
c->get_container_pids = lxcapi_get_container_pids;
+ c->set_start_timeout = lxcapi_set_start_timeout;
#endif
return c;
diff --git a/src/lxc/lxccontainer.h b/src/lxc/lxccontainer.h
index 6ede70c..2951ac7 100644
--- a/src/lxc/lxccontainer.h
+++ b/src/lxc/lxccontainer.h
@@ -125,6 +125,12 @@ struct lxc_container {
* */
char *ocihookfile;
+ /*! isulad:
+ * \private
+ * start_timeout.
+ */
+ unsigned int start_timeout;
+
/*!
* \brief Determine if \c /var/lib/lxc/$name/config exists.
*
@@ -960,6 +966,16 @@ struct lxc_container {
* \return \c true on success, else \c false.
*/
bool (*get_container_pids)(struct lxc_container *c,pid_t **pids,size_t *pids_len);
+
+ /*! isulad add
+ * \brief An API call to set start timeout
+ *
+ * \param c Container.
+ * \param start_timeout Value of start timeout.
+ *
+ * \return \c true on success, else \c false.
+ */
+ bool (*set_start_timeout)(struct lxc_container *c, unsigned int start_timeout);
};
/*!
diff --git a/src/lxc/start.c b/src/lxc/start.c
index 70ce1bd..0bc1143 100644
--- a/src/lxc/start.c
+++ b/src/lxc/start.c
@@ -880,6 +880,21 @@ out_restore_sigmask:
}
#ifdef HAVE_ISULAD
+/* isulad: start timeout thread */
+typedef enum {
+ START_INIT,
+ START_TIMEOUT,
+ START_MAX,
+} start_timeout_t;
+
+static start_timeout_t global_timeout_state = START_INIT;
+static sem_t global_timeout_sem;
+
+struct start_timeout_conf {
+ unsigned int timeout;
+ int errfd;
+};
+
void trim_line(char *s)
{
size_t len;
@@ -2285,6 +2300,12 @@ static int lxc_spawn(struct lxc_handler *handler)
goto out_delete_net;
}
+ if (START_TIMEOUT == global_timeout_state) {
+ lxc_write_error_message(conf->errpipe[1], "Starting the container \"%s\" timeout.", name);
+ ERROR("Starting the container \"%s\" timeout.", name);
+ goto out_delete_net;
+ }
+
/* Tell the child to continue its initialization. We'll get
* LXC_SYNC_POST_OCI_PRESTART_HOOK when it is ready for us to run oci prestart hooks.
*/
@@ -2341,6 +2362,13 @@ static int lxc_spawn(struct lxc_handler *handler)
ERROR("Failed to run oci poststart hooks");
goto out_abort;
}
+
+ if (START_TIMEOUT == global_timeout_state) {
+ lxc_write_error_message(conf->errpipe[1], "Starting the container \"%s\" timeout.", name);
+ ERROR("Starting the container \"%s\" timeout.", name);
+ goto out_abort;
+ }
+
#endif
ret = lxc_set_state(name, handler, RUNNING);
@@ -2368,17 +2396,82 @@ out_sync_fini:
}
#ifdef HAVE_ISULAD
+/* isulad: start timeout thread function */
+static void* wait_start_timeout(void *arg)
+{
+ struct start_timeout_conf *conf = (struct start_timeout_conf *)arg;
+
+ sem_post(&global_timeout_sem);
+
+ if (!conf || conf->timeout < 1)
+ goto out;
+
+ sleep(conf->timeout);
+
+ global_timeout_state = START_TIMEOUT;
+
+out:
+ free(conf);
+ return ((void *)0);
+}
+
+/* isulad: create start timeout thread */
+static int create_start_timeout_thread(struct lxc_conf *conf, unsigned int start_timeout)
+{
+ int ret = 0;
+ pthread_t ptid;
+ pthread_attr_t attr;
+ struct start_timeout_conf *timeout_conf = NULL;
+
+ if (sem_init(&global_timeout_sem, 0, 0)) {
+ ERROR("Failed to init start timeout semaphore");/*lint !e613*/
+ ret = -1;
+ return ret;
+ }
+
+ timeout_conf = malloc(sizeof(struct start_timeout_conf));
+ if (timeout_conf == NULL) {
+ ERROR("Failed to malloc start timeout conf");
+ ret = -1;
+ goto out;
+ }
+
+ memset(timeout_conf, 0, sizeof(struct start_timeout_conf));
+ timeout_conf->errfd = conf->errpipe[1];
+ timeout_conf->timeout = start_timeout;
+
+ pthread_attr_init(&attr);
+ pthread_attr_setdetachstate(&attr, PTHREAD_CREATE_DETACHED);
+ ret = pthread_create(&ptid, &attr, wait_start_timeout, timeout_conf);
+ if (ret != 0) {
+ ERROR("Create start wait timeout thread failed");
+ free(timeout_conf);
+ goto out;
+ }
+
+ sem_wait(&global_timeout_sem);
+out:
+ sem_destroy(&global_timeout_sem);
+ return ret;
+}
+
// isulad: send '128 + signal' if container is killed by signal.
#define EXIT_SIGNAL_OFFSET 128
#endif
+
+#ifdef HAVE_ISULAD
+int __lxc_start(struct lxc_handler *handler, struct lxc_operations *ops,
+ void *data, const char *lxcpath, bool daemonize, int *error_num,
+ unsigned int start_timeout)
+{
+ int exit_code;
+#else
int __lxc_start(struct lxc_handler *handler, struct lxc_operations *ops,
void *data, const char *lxcpath, bool daemonize, int *error_num)
{
- int ret, status;
-#ifdef HAVE_ISULAD
- int exit_code;
#endif
+ int ret, status;
const char *name = handler->name;
struct lxc_conf *conf = handler->conf;
struct cgroup_ops *cgroup_ops;
@@ -2393,6 +2486,16 @@ int __lxc_start(struct lxc_handler *handler, struct lxc_operations *ops,
handler->daemonize = daemonize;
cgroup_ops = handler->cgroup_ops;
+#ifdef HAVE_ISULAD
+ /* isulad: add start timeout limit */
+ if (start_timeout > 0) {
+ ret = create_start_timeout_thread(conf, start_timeout);
+ if (ret) {
+ ERROR("Failed to create start timeout thread for container \"%s\".", name);
+ goto out_abort;
+ }
+ }
+#endif
if (!attach_block_device(handler->conf)) {
ERROR("Failed to attach block device");
ret = -1;
@@ -2574,14 +2677,18 @@ static struct lxc_operations start_ops = {
};
int lxc_start(char *const argv[], struct lxc_handler *handler,
- const char *lxcpath, bool daemonize, int *error_num)
+ const char *lxcpath, bool daemonize, int *error_num, unsigned int start_timeout)
{
struct start_args start_arg = {
.argv = argv,
};
TRACE("Doing lxc_start");
+#ifdef HAVE_ISULAD
+ return __lxc_start(handler, &start_ops, &start_arg, lxcpath, daemonize, error_num, start_timeout);
+#else
return __lxc_start(handler, &start_ops, &start_arg, lxcpath, daemonize, error_num);
+#endif
}
static void lxc_destroy_container_on_signal(struct lxc_handler *handler,
diff --git a/src/lxc/start.h b/src/lxc/start.h
index 4fc3ff7..cea37bc 100644
--- a/src/lxc/start.h
+++ b/src/lxc/start.h
@@ -170,8 +170,14 @@ extern void lxc_end(struct lxc_handler *handler);
*/
extern int lxc_check_inherited(struct lxc_conf *conf, bool closeall,
int *fds_to_ignore, size_t len_fds);
+#ifdef HAVE_ISULAD
+extern int __lxc_start(struct lxc_handler *handler,
+ struct lxc_operations* ops, void *data, const char *lxcpath,
+ bool daemonize, int *error_num, unsigned int start_timeout);
+#else
extern int __lxc_start(struct lxc_handler *, struct lxc_operations *, void *,
const char *, bool, int *);
+#endif
extern int resolve_clone_flags(struct lxc_handler *handler);
diff --git a/src/lxc/tools/arguments.h b/src/lxc/tools/arguments.h
index a6d9967..41ea109 100644
--- a/src/lxc/tools/arguments.h
+++ b/src/lxc/tools/arguments.h
@@ -47,6 +47,8 @@ struct lxc_arguments {
const char *suffix; /* isulad add, suffix used for connect with parent of execed process*/
int disable_pty;
int open_stdin;
+ unsigned int start_timeout; /* isulad: Seconds for waiting on a container to start before it is killed*/
+ int64_t attach_timeout; /* for lxc-attach */
#endif
/* for lxc-console */
diff --git a/src/lxc/tools/lxc_attach.c b/src/lxc/tools/lxc_attach.c
index 48e18bb..a855a8d 100644
--- a/src/lxc/tools/lxc_attach.c
+++ b/src/lxc/tools/lxc_attach.c
@@ -81,6 +81,7 @@ static const struct option my_longopts[] = {
{"out-fifo", required_argument, 0, OPT_OUTPUT_FIFO},
{"err-fifo", required_argument, 0, OPT_STDERR_FIFO},
{"suffix", required_argument, 0, OPT_ATTACH_SUFFIX},
+ {"timeout", required_argument, 0, OPT_ATTACH_TIMEOUT},
#endif
LXC_COMMON_OPTIONS
};
@@ -141,6 +142,7 @@ Options :\n\
#else
"\
--user User ID (format: UID[:GID])\n\
+ --timeout Timeout in seconds (default: 0)\n\
"
#endif
,
@@ -303,6 +305,13 @@ static int my_parser(struct lxc_arguments *args, int c, char *arg)
case OPT_ATTACH_SUFFIX:
args->suffix = arg;
break;
+ case OPT_ATTACH_TIMEOUT:
+ if(!is_non_negative_num(arg)) {
+ ERROR("Error attach timeout parameter:%s.\n", arg);
+ return -1;
+ }
+ args->attach_timeout = (unsigned int)atoll(arg);
+ break;
#endif
}
@@ -581,6 +590,7 @@ int main(int argc, char *argv[])
attach_options.env_policy = env_policy;
attach_options.extra_env_vars = extra_env;
attach_options.extra_keep_env = extra_keep;
+ attach_options.timeout = my_args.attach_timeout;
if (my_args.argc > 0) {
command.program = my_args.argv[0];
diff --git a/src/lxc/tools/lxc_start.c b/src/lxc/tools/lxc_start.c
index 72a4494..b430a1e 100644
--- a/src/lxc/tools/lxc_start.c
+++ b/src/lxc/tools/lxc_start.c
@@ -29,6 +29,7 @@
#include "log.h"
#ifdef HAVE_ISULAD
+#include <ctype.h>
#include "isulad_utils.h"
#endif
@@ -61,6 +62,7 @@ static const struct option my_longopts[] = {
{"start-timeout", required_argument, 0, OPT_START_TIMEOUT},
{"disable-pty", no_argument, 0, OPT_DISABLE_PTY},
{"open-stdin", no_argument, 0, OPT_OPEN_STDIN},
+ {"start-timeout", required_argument, 0, OPT_START_TIMEOUT},
#endif
LXC_COMMON_OPTIONS
};
@@ -155,6 +157,13 @@ static int my_parser(struct lxc_arguments *args, int c, char *arg)
case OPT_OPEN_STDIN:
args->open_stdin = 1;
break;
+ case OPT_START_TIMEOUT:
+ if(!is_non_negative_num(arg)) {
+ fprintf(stderr, "Error start timeout parameter:%s.\n", arg);
+ return -1;
+ }
+ args->start_timeout = (unsigned int)atoi(arg);
+ break;
#endif
}
@@ -354,6 +363,11 @@ int main(int argc, char *argv[])
if (my_args.open_stdin) {
c->want_open_stdin(c, true);
}
+
+ /* isulad: add start timeout */
+ if(my_args.start_timeout) {
+ c->set_start_timeout(c, my_args.start_timeout);
+ }
#endif
if (my_args.console)
diff --git a/src/lxc/utils.c b/src/lxc/utils.c
index ba69995..810b7fe 100644
--- a/src/lxc/utils.c
+++ b/src/lxc/utils.c
@@ -2167,4 +2167,15 @@ out:
return alive;
}
+bool is_non_negative_num(const char *s)
+{
+ if (!s || !strcmp(s, ""))
+ return false;
+ while(*s != '\0') {
+ if(!isdigit(*s))
+ return false;
+ ++s;
+ }
+ return true;
+}
#endif
diff --git a/src/lxc/utils.h b/src/lxc/utils.h
index a213ba7..39ef579 100644
--- a/src/lxc/utils.h
+++ b/src/lxc/utils.h
@@ -324,6 +324,8 @@ extern int unsigned long long lxc_get_process_startat(pid_t pid);
extern int lxc_setup_env_home(uid_t uid);
extern bool lxc_process_alive(pid_t pid, unsigned long long start_time);
+
+extern bool is_non_negative_num(const char *s);
#endif
#endif /* __LXC_UTILS_H */
--
1.8.3.1

659
0035-Seccomp-security-feature-enhanced.patch
View File

@ -1,659 +0,0 @@
From 327e83ff13bec4bf1fa80ede9515d3f9531d7d1f Mon Sep 17 00:00:00 2001
From: wujing <wujing50@huawei.com>
Date: Wed, 15 Apr 2020 06:37:43 -0400
Subject: [PATCH 35/49] Seccomp security feature enhanced
Signed-off-by: wujing <wujing50@huawei.com>
---
src/lxc/conf.c | 3 +-
src/lxc/seccomp.c | 548 +++++++++++++++++++++++++++++++++++++++++++++++++++++-
2 files changed, 548 insertions(+), 3 deletions(-)
diff --git a/src/lxc/conf.c b/src/lxc/conf.c
index 6856b1d..e8ee749 100644
--- a/src/lxc/conf.c
+++ b/src/lxc/conf.c
@@ -4730,8 +4730,7 @@ int lxc_setup(struct lxc_handler *handler)
// isulad: create link /etc/mtab for /proc/mounts
if (create_mtab_link() != 0) {
- ERROR("failed to create link /etc/mtab for target /proc/mounts");
- goto on_error;
+ return log_error(-1, "failed to create link /etc/mtab for target /proc/mounts");
}
#endif
diff --git a/src/lxc/seccomp.c b/src/lxc/seccomp.c
index 081d315..a75adb7 100644
--- a/src/lxc/seccomp.c
+++ b/src/lxc/seccomp.c
@@ -295,7 +295,11 @@ on_error:
#endif
#if HAVE_DECL_SECCOMP_SYSCALL_RESOLVE_NAME_ARCH
+#ifdef HAVE_ISULAD
+enum lxc_arch_t {
+#else
enum lxc_hostarch_t {
+#endif
lxc_seccomp_arch_all = 0,
lxc_seccomp_arch_native,
lxc_seccomp_arch_i386,
@@ -351,8 +355,13 @@ int get_hostarch(void)
return lxc_seccomp_arch_unknown;
}
+#ifdef HAVE_ISULAD
+scmp_filter_ctx get_new_ctx(enum lxc_arch_t n_arch,
+ uint32_t default_policy_action, uint32_t *architectures)
+#else
scmp_filter_ctx get_new_ctx(enum lxc_hostarch_t n_arch,
uint32_t default_policy_action, bool *needs_merge)
+#endif
{
int ret;
uint32_t arch;
@@ -475,10 +484,17 @@ scmp_filter_ctx get_new_ctx(enum lxc_hostarch_t n_arch,
return NULL;
}
TRACE("Removed native arch from main seccomp context");
-
+#ifdef HAVE_ISULAD
+ *architectures = arch;
+#else
*needs_merge = true;
+#endif
} else {
+#ifdef HAVE_ISULAD
+ *architectures = SCMP_ARCH_NATIVE;
+#else
*needs_merge = false;
+#endif
TRACE("Arch %d already present in main seccomp context", (int)n_arch);
}
@@ -510,7 +526,11 @@ bool do_resolve_add_rule(uint32_t arch, char *line, scmp_filter_ctx ctx,
if (ret < 0) {
errno = -ret;
SYSERROR("Failed loading rule to reject force umount");
+#ifdef HAVE_ISULAD
+ return true;
+#else
return false;
+#endif
}
INFO("Set seccomp rule to reject force umounts");
@@ -519,14 +539,24 @@ bool do_resolve_add_rule(uint32_t arch, char *line, scmp_filter_ctx ctx,
nr = seccomp_syscall_resolve_name(line);
if (nr == __NR_SCMP_ERROR) {
+#ifdef HAVE_ISULAD
+ DEBUG("Failed to resolve syscall \"%s\"", line);
+ DEBUG("This syscall will NOT be handled by seccomp");
+#else
WARN("Failed to resolve syscall \"%s\"", line);
WARN("This syscall will NOT be handled by seccomp");
+#endif
return true;
}
if (nr < 0) {
+#ifdef HAVE_ISULAD
+ DEBUG("Got negative return value %d for syscall \"%s\"", nr, line);
+ DEBUG("This syscall will NOT be handled by seccomp");
+#else
WARN("Got negative return value %d for syscall \"%s\"", nr, line);
WARN("This syscall will NOT be handled by seccomp");
+#endif
return true;
}
@@ -553,14 +583,42 @@ bool do_resolve_add_rule(uint32_t arch, char *line, scmp_filter_ctx ctx,
rule->args_num, arg_cmp);
if (ret < 0) {
errno = -ret;
+#ifdef HAVE_ISULAD
+ DEBUG("Failed loading rule for %s (nr %d action %d (%s))",
+ line, nr, rule->action, get_action_name(rule->action));
+#else
SYSERROR("Failed loading rule for %s (nr %d action %d (%s))",
line, nr, rule->action, get_action_name(rule->action));
+#endif
return false;
}
return true;
}
+#ifdef HAVE_ISULAD
+#define SCMP_ARCH_INDEX_MAX 3
+
+struct scmp_ctx_info {
+ uint32_t architectures[SCMP_ARCH_INDEX_MAX];
+ enum lxc_arch_t lxc_arch[SCMP_ARCH_INDEX_MAX];
+ scmp_filter_ctx contexts[SCMP_ARCH_INDEX_MAX];
+ bool needs_merge[SCMP_ARCH_INDEX_MAX];
+};
+
+static int get_arch_index(enum lxc_arch_t arch, struct scmp_ctx_info *ctx)
+{
+ int i;
+
+ for (i = 0; i < SCMP_ARCH_INDEX_MAX; i++) {
+ if (ctx->lxc_arch[i] == arch)
+ return i;
+ }
+
+ return -1;
+}
+#endif
+
/*
* v2 consists of
* [x86]
@@ -575,6 +633,493 @@ bool do_resolve_add_rule(uint32_t arch, char *line, scmp_filter_ctx ctx,
* write
* close
*/
+#ifdef HAVE_ISULAD
+static int parse_config_v2(FILE *f, char *line, size_t *line_bufsz, struct lxc_conf *conf)
+{
+ int ret;
+ char *p;
+ enum lxc_arch_t cur_rule_arch, native_arch;
+ bool blacklist = false;
+ uint32_t default_policy_action = -1, default_rule_action = -1;
+ struct seccomp_v2_rule rule;
+ struct scmp_ctx_info ctx;
+
+ if (strncmp(line, "blacklist", 9) == 0)
+ blacklist = true;
+ else if (strncmp(line, "whitelist", 9) != 0) {
+ ERROR("Bad seccomp policy style \"%s\"", line);
+ return -1;
+ }
+
+ p = strchr(line, ' ');
+ if (p) {
+ default_policy_action = get_v2_default_action(p + 1);
+ if (default_policy_action == -2)
+ return -1;
+ }
+
+ /* for blacklist, allow any syscall which has no rule */
+ if (blacklist) {
+ if (default_policy_action == -1)
+ default_policy_action = SCMP_ACT_ALLOW;
+
+ if (default_rule_action == -1)
+ default_rule_action = SCMP_ACT_KILL;
+ } else {
+ if (default_policy_action == -1)
+ default_policy_action = SCMP_ACT_KILL;
+
+ if (default_rule_action == -1)
+ default_rule_action = SCMP_ACT_ALLOW;
+ }
+
+ memset(&ctx, 0, sizeof(ctx));
+ ctx.architectures[0] = SCMP_ARCH_NATIVE;
+ ctx.architectures[1] = SCMP_ARCH_NATIVE;
+ ctx.architectures[2] = SCMP_ARCH_NATIVE;
+ native_arch = get_hostarch();
+ cur_rule_arch = native_arch;
+ if (native_arch == lxc_seccomp_arch_amd64) {
+ cur_rule_arch = lxc_seccomp_arch_all;
+
+ ctx.lxc_arch[0] = lxc_seccomp_arch_i386;
+ ctx.contexts[0] = get_new_ctx(lxc_seccomp_arch_i386,
+ default_policy_action, &ctx.architectures[0]);
+ if (!ctx.contexts[0])
+ goto bad;
+
+ ctx.lxc_arch[1] = lxc_seccomp_arch_x32;
+ ctx.contexts[1] = get_new_ctx(lxc_seccomp_arch_x32,
+ default_policy_action, &ctx.architectures[1]);
+ if (!ctx.contexts[1])
+ goto bad;
+
+ ctx.lxc_arch[2] = lxc_seccomp_arch_amd64;
+ ctx.contexts[2] = get_new_ctx(lxc_seccomp_arch_amd64,
+ default_policy_action, &ctx.architectures[2]);
+ if (!ctx.contexts[2])
+ goto bad;
+#ifdef SCMP_ARCH_PPC
+ } else if (native_arch == lxc_seccomp_arch_ppc64) {
+ cur_rule_arch = lxc_seccomp_arch_all;
+
+ ctx.lxc_arch[0] = lxc_seccomp_arch_ppc;
+ ctx.contexts[0] = get_new_ctx(lxc_seccomp_arch_ppc,
+ default_policy_action, &ctx.architectures[0]);
+ if (!ctx.contexts[0])
+ goto bad;
+
+ ctx.lxc_arch[1] = lxc_seccomp_arch_ppc64;
+ ctx.contexts[1] = get_new_ctx(lxc_seccomp_arch_ppc64,
+ default_policy_action, &ctx.architectures[1]);
+ if (!ctx.contexts[1])
+ goto bad;
+#endif
+#ifdef SCMP_ARCH_ARM
+ } else if (native_arch == lxc_seccomp_arch_arm64) {
+ cur_rule_arch = lxc_seccomp_arch_all;
+
+ ctx.lxc_arch[0] = lxc_seccomp_arch_arm;
+ ctx.contexts[0] = get_new_ctx(lxc_seccomp_arch_arm,
+ default_policy_action, &ctx.architectures[0]);
+ if (!ctx.contexts[0])
+ goto bad;
+
+#ifdef SCMP_ARCH_AARCH64
+ ctx.lxc_arch[1] = lxc_seccomp_arch_arm64;
+ ctx.contexts[1] = get_new_ctx(lxc_seccomp_arch_arm64,
+ default_policy_action, &ctx.architectures[1]);
+ if (!ctx.contexts[1])
+ goto bad;
+#endif
+#endif
+#ifdef SCMP_ARCH_MIPS
+ } else if (native_arch == lxc_seccomp_arch_mips64) {
+ cur_rule_arch = lxc_seccomp_arch_all;
+
+ ctx.lxc_arch[0] = lxc_seccomp_arch_mips;
+ ctx.contexts[0] = get_new_ctx(lxc_seccomp_arch_mips,
+ default_policy_action, &ctx.architectures[0]);
+ if (!ctx.contexts[0])
+ goto bad;
+
+ ctx.lxc_arch[1] = lxc_seccomp_arch_mips64n32;
+ ctx.contexts[1] = get_new_ctx(lxc_seccomp_arch_mips64n32,
+ default_policy_action, &ctx.architectures[1]);
+ if (!ctx.contexts[1])
+ goto bad;
+
+ ctx.lxc_arch[2] = lxc_seccomp_arch_mips64;
+ ctx.contexts[2] = get_new_ctx(lxc_seccomp_arch_mips64,
+ default_policy_action, &ctx.architectures[2]);
+ if (!ctx.contexts[2])
+ goto bad;
+ } else if (native_arch == lxc_seccomp_arch_mipsel64) {
+ cur_rule_arch = lxc_seccomp_arch_all;
+ ctx.lxc_arch[0] = lxc_seccomp_arch_mipsel;
+ ctx.contexts[0] = get_new_ctx(lxc_seccomp_arch_mipsel,
+ default_policy_action, &ctx.architectures[0]);
+ if (!ctx.contexts[0])
+ goto bad;
+
+ ctx.lxc_arch[1] = lxc_seccomp_arch_mipsel64n32;
+ ctx.contexts[1] = get_new_ctx(lxc_seccomp_arch_mipsel64n32,
+ default_policy_action, &ctx.architectures[1]);
+ if (!ctx.contexts[1])
+ goto bad;
+
+ ctx.lxc_arch[2] = lxc_seccomp_arch_mipsel64;
+ ctx.contexts[2] = get_new_ctx(lxc_seccomp_arch_mipsel64,
+ default_policy_action, &ctx.architectures[2]);
+ if (!ctx.contexts[2])
+ goto bad;
+#endif
+ }
+
+ if (default_policy_action != SCMP_ACT_KILL) {
+ ret = seccomp_reset(conf->seccomp.seccomp_ctx, default_policy_action);
+ if (ret != 0) {
+ ERROR("Error re-initializing Seccomp");
+ return -1;
+ }
+
+ ret = seccomp_attr_set(conf->seccomp.seccomp_ctx, SCMP_FLTATR_CTL_NNP, 0);
+ if (ret < 0) {
+ errno = -ret;
+ SYSERROR("Failed to turn off no-new-privs");
+ return -1;
+ }
+
+#ifdef SCMP_FLTATR_ATL_TSKIP
+ ret = seccomp_attr_set(conf->seccomp.seccomp_ctx, SCMP_FLTATR_ATL_TSKIP, 1);
+ if (ret < 0) {
+ errno = -ret;
+ SYSWARN("Failed to turn on seccomp nop-skip, continuing");
+ }
+#endif
+ }
+
+ while (getline(&line, line_bufsz, f) != -1) {
+ if (line[0] == '#')
+ continue;
+
+ if (line[0] == '\0')
+ continue;
+
+ remove_trailing_newlines(line);
+
+ INFO("Processing \"%s\"", line);
+ if (line[0] == '[') {
+ /* Read the architecture for next set of rules. */
+ if (strcmp(line, "[x86]") == 0 ||
+ strcmp(line, "[X86]") == 0) {
+ if (native_arch != lxc_seccomp_arch_i386 &&
+ native_arch != lxc_seccomp_arch_amd64) {
+ cur_rule_arch = lxc_seccomp_arch_unknown;
+ continue;
+ }
+
+ cur_rule_arch = lxc_seccomp_arch_i386;
+ } else if (strcmp(line, "[x32]") == 0 ||
+ strcmp(line, "[X32]") == 0) {
+ if (native_arch != lxc_seccomp_arch_amd64) {
+ cur_rule_arch = lxc_seccomp_arch_unknown;
+ continue;
+ }
+
+ cur_rule_arch = lxc_seccomp_arch_x32;
+ } else if (strcmp(line, "[X86_64]") == 0 ||
+ strcmp(line, "[x86_64]") == 0) {
+ if (native_arch != lxc_seccomp_arch_amd64) {
+ cur_rule_arch = lxc_seccomp_arch_unknown;
+ continue;
+ }
+
+ cur_rule_arch = lxc_seccomp_arch_amd64;
+ } else if (strcmp(line, "[all]") == 0 ||
+ strcmp(line, "[ALL]") == 0) {
+ cur_rule_arch = lxc_seccomp_arch_all;
+ }
+#ifdef SCMP_ARCH_ARM
+ else if (strcmp(line, "[arm]") == 0 ||
+ strcmp(line, "[ARM]") == 0) {
+ if (native_arch != lxc_seccomp_arch_arm &&
+ native_arch != lxc_seccomp_arch_arm64) {
+ cur_rule_arch = lxc_seccomp_arch_unknown;
+ continue;
+ }
+
+ cur_rule_arch = lxc_seccomp_arch_arm;
+ }
+#endif
+#ifdef SCMP_ARCH_AARCH64
+ else if (strcmp(line, "[arm64]") == 0 ||
+ strcmp(line, "[ARM64]") == 0) {
+ if (native_arch != lxc_seccomp_arch_arm64) {
+ cur_rule_arch = lxc_seccomp_arch_unknown;
+ continue;
+ }
+
+ cur_rule_arch = lxc_seccomp_arch_arm64;
+ }
+#endif
+#ifdef SCMP_ARCH_PPC64LE
+ else if (strcmp(line, "[ppc64le]") == 0 ||
+ strcmp(line, "[PPC64LE]") == 0) {
+ if (native_arch != lxc_seccomp_arch_ppc64le) {
+ cur_rule_arch = lxc_seccomp_arch_unknown;
+ continue;
+ }
+
+ cur_rule_arch = lxc_seccomp_arch_ppc64le;
+ }
+#endif
+#ifdef SCMP_ARCH_PPC64
+ else if (strcmp(line, "[ppc64]") == 0 ||
+ strcmp(line, "[PPC64]") == 0) {
+ if (native_arch != lxc_seccomp_arch_ppc64) {
+ cur_rule_arch = lxc_seccomp_arch_unknown;
+ continue;
+ }
+
+ cur_rule_arch = lxc_seccomp_arch_ppc64;
+ }
+#endif
+#ifdef SCMP_ARCH_PPC
+ else if (strcmp(line, "[ppc]") == 0 ||
+ strcmp(line, "[PPC]") == 0) {
+ if (native_arch != lxc_seccomp_arch_ppc &&
+ native_arch != lxc_seccomp_arch_ppc64) {
+ cur_rule_arch = lxc_seccomp_arch_unknown;
+ continue;
+ }
+
+ cur_rule_arch = lxc_seccomp_arch_ppc;
+ }
+#endif
+#ifdef SCMP_ARCH_MIPS
+ else if (strcmp(line, "[mips64]") == 0 ||
+ strcmp(line, "[MIPS64]") == 0) {
+ if (native_arch != lxc_seccomp_arch_mips64) {
+ cur_rule_arch = lxc_seccomp_arch_unknown;
+ continue;
+ }
+
+ cur_rule_arch = lxc_seccomp_arch_mips64;
+ } else if (strcmp(line, "[mips64n32]") == 0 ||
+ strcmp(line, "[MIPS64N32]") == 0) {
+ if (native_arch != lxc_seccomp_arch_mips64) {
+ cur_rule_arch = lxc_seccomp_arch_unknown;
+ continue;
+ }
+
+ cur_rule_arch = lxc_seccomp_arch_mips64n32;
+ } else if (strcmp(line, "[mips]") == 0 ||
+ strcmp(line, "[MIPS]") == 0) {
+ if (native_arch != lxc_seccomp_arch_mips &&
+ native_arch != lxc_seccomp_arch_mips64) {
+ cur_rule_arch = lxc_seccomp_arch_unknown;
+ continue;
+ }
+
+ cur_rule_arch = lxc_seccomp_arch_mips;
+ } else if (strcmp(line, "[mipsel64]") == 0 ||
+ strcmp(line, "[MIPSEL64]") == 0) {
+ if (native_arch != lxc_seccomp_arch_mipsel64) {
+ cur_rule_arch = lxc_seccomp_arch_unknown;
+ continue;
+ }
+
+ cur_rule_arch = lxc_seccomp_arch_mipsel64;
+ } else if (strcmp(line, "[mipsel64n32]") == 0 ||
+ strcmp(line, "[MIPSEL64N32]") == 0) {
+ if (native_arch != lxc_seccomp_arch_mipsel64) {
+ cur_rule_arch = lxc_seccomp_arch_unknown;
+ continue;
+ }
+
+ cur_rule_arch = lxc_seccomp_arch_mipsel64n32;
+ } else if (strcmp(line, "[mipsel]") == 0 ||
+ strcmp(line, "[MIPSEL]") == 0) {
+ if (native_arch != lxc_seccomp_arch_mipsel &&
+ native_arch != lxc_seccomp_arch_mipsel64) {
+ cur_rule_arch = lxc_seccomp_arch_unknown;
+ continue;
+ }
+
+ cur_rule_arch = lxc_seccomp_arch_mipsel;
+ }
+#endif
+#ifdef SCMP_ARCH_S390X
+ else if (strcmp(line, "[s390x]") == 0 ||
+ strcmp(line, "[S390X]") == 0) {
+ if (native_arch != lxc_seccomp_arch_s390x) {
+ cur_rule_arch = lxc_seccomp_arch_unknown;
+ continue;
+ }
+
+ cur_rule_arch = lxc_seccomp_arch_s390x;
+ }
+#endif
+ else {
+ goto bad_arch;
+ }
+
+ continue;
+ }
+
+ /* irrelevant arch - i.e. arm on i386 */
+ if (cur_rule_arch == lxc_seccomp_arch_unknown)
+ continue;
+
+ memset(&rule, 0, sizeof(rule));
+ /* read optional action which follows the syscall */
+ ret = parse_v2_rules(line, default_rule_action, &rule);
+ if (ret != 0) {
+ ERROR("Failed to interpret seccomp rule");
+ goto bad_rule;
+ }
+
+ if (cur_rule_arch == native_arch) {
+ /* add for native arch */
+ if (!do_resolve_add_rule(SCMP_ARCH_NATIVE, line,
+ conf->seccomp.seccomp_ctx, &rule))
+ goto bad_rule;
+
+ INFO("Added native rule for arch %d for %s action %d(%s)",
+ SCMP_ARCH_NATIVE, line, rule.action,
+ get_action_name(rule.action));
+ } else if (cur_rule_arch != lxc_seccomp_arch_all) {
+ /* add for compat specified arch */
+ int arch_index = get_arch_index(cur_rule_arch, &ctx);
+ if (arch_index < 0)
+ goto bad_arch;
+
+ if (!do_resolve_add_rule(ctx.architectures[arch_index], line,
+ ctx.contexts[arch_index], &rule))
+ goto bad_rule;
+
+ INFO("Added compat rule for arch %d for %s action %d(%s)",
+ ctx.architectures[arch_index], line, rule.action,
+ get_action_name(rule.action));
+ ctx.needs_merge[arch_index] = true;
+ } else {
+ /* add for all compat archs */
+ if (!do_resolve_add_rule(SCMP_ARCH_NATIVE, line,
+ conf->seccomp.seccomp_ctx, &rule))
+ goto bad_rule;
+
+ INFO("Added native rule for arch %d for %s action %d(%s)",
+ SCMP_ARCH_NATIVE, line, rule.action,
+ get_action_name(rule.action));
+
+ if (ctx.architectures[0] != SCMP_ARCH_NATIVE) {
+ if (!do_resolve_add_rule(ctx.architectures[0], line,
+ ctx.contexts[0], &rule))
+ goto bad_rule;
+
+ INFO("Added compat rule for arch %d for %s action %d(%s)",
+ ctx.architectures[0], line, rule.action,
+ get_action_name(rule.action));
+ ctx.needs_merge[0] = true;
+ }
+
+ if (ctx.architectures[1] != SCMP_ARCH_NATIVE) {
+ if (!do_resolve_add_rule(ctx.architectures[1], line,
+ ctx.contexts[1], &rule))
+ goto bad_rule;
+
+ INFO("Added compat rule for arch %d for %s action %d(%s)",
+ ctx.architectures[1], line, rule.action,
+ get_action_name(rule.action));
+ ctx.needs_merge[1] = true;
+ }
+
+ if (ctx.architectures[2] != SCMP_ARCH_NATIVE) {
+ if (!do_resolve_add_rule(ctx.architectures[2], line,
+ ctx.contexts[2], &rule))
+ goto bad_rule;
+
+ INFO("Added native rule for arch %d for %s action %d(%s)",
+ ctx.architectures[2], line, rule.action,
+ get_action_name(rule.action));
+ ctx.needs_merge[2] = true;
+ }
+ }
+
+ }
+
+ INFO("Merging compat seccomp contexts into main context");
+ if (ctx.contexts[0]) {
+ if (ctx.needs_merge[0]) {
+ ret = seccomp_merge(conf->seccomp.seccomp_ctx, ctx.contexts[0]);
+ if (ret < 0) {
+ ERROR("%s - Failed to merge first compat seccomp "
+ "context into main context", strerror(-ret));
+ goto bad;
+ }
+
+ TRACE("Merged first compat seccomp context into main context");
+ } else {
+ seccomp_release(ctx.contexts[0]);
+ ctx.contexts[0] = NULL;
+ }
+ }
+
+ if (ctx.contexts[1]) {
+ if (ctx.needs_merge[1]) {
+ ret = seccomp_merge(conf->seccomp.seccomp_ctx, ctx.contexts[1]);
+ if (ret < 0) {
+ ERROR("%s - Failed to merge second compat seccomp "
+ "context into main context", strerror(-ret));
+ goto bad;
+ }
+
+ TRACE("Merged second compat seccomp context into main context");
+ } else {
+ seccomp_release(ctx.contexts[1]);
+ ctx.contexts[1] = NULL;
+ }
+ }
+
+ if (ctx.contexts[2]) {
+ if (ctx.needs_merge[2]) {
+ ret = seccomp_merge(conf->seccomp.seccomp_ctx, ctx.contexts[2]);
+ if (ret < 0) {
+ ERROR("%s - Failed to merge third compat seccomp "
+ "context into main context", strerror(-ret));
+ goto bad;
+ }
+
+ TRACE("Merged third compat seccomp context into main context");
+ } else {
+ seccomp_release(ctx.contexts[2]);
+ ctx.contexts[2] = NULL;
+ }
+ }
+
+ free(line);
+ return 0;
+
+bad_arch:
+ ERROR("Unsupported architecture \"%s\"", line);
+
+bad_rule:
+bad:
+ if (ctx.contexts[0])
+ seccomp_release(ctx.contexts[0]);
+
+ if (ctx.contexts[1])
+ seccomp_release(ctx.contexts[1]);
+
+ if (ctx.contexts[2])
+ seccomp_release(ctx.contexts[2]);
+
+ free(line);
+
+ return -1;
+}
+#else
static int parse_config_v2(FILE *f, char *line, size_t *line_bufsz, struct lxc_conf *conf)
{
int ret;
@@ -1067,6 +1612,7 @@ bad:
return -1;
}
+#endif
#else /* HAVE_DECL_SECCOMP_SYSCALL_RESOLVE_NAME_ARCH */
static int parse_config_v2(FILE *f, char *line, struct lxc_conf *conf)
{
--
1.8.3.1

99
0036-Security-coding-modification.patch
View File

@ -1,99 +0,0 @@
From ff35c1cd6118668e13f7ca83d7d704bb9363155a Mon Sep 17 00:00:00 2001
From: wujing <wujing50@huawei.com>
Date: Wed, 15 Apr 2020 07:19:03 -0400
Subject: [PATCH 36/49] Security coding modification
Signed-off-by: wujing <wujing50@huawei.com>
---
src/lxc/commands_utils.c | 2 +-
src/lxc/confile.c | 22 ++++++++++++++++++++++
src/lxc/lxccontainer.c | 8 ++++++++
3 files changed, 31 insertions(+), 1 deletion(-)
diff --git a/src/lxc/commands_utils.c b/src/lxc/commands_utils.c
index 2f2670d..c5fc094 100644
--- a/src/lxc/commands_utils.c
+++ b/src/lxc/commands_utils.c
@@ -114,7 +114,7 @@ int lxc_make_abstract_socket_name(char *path, size_t pathlen,
}
ret = snprintf(offset, len, "%s/%s/%s", lxcpath, name, suffix);
- if (ret < 0)
+ if (ret < 0 || (size_t)ret >= len)
return log_error_errno(-1, errno, "Failed to create abstract socket name");
/*
diff --git a/src/lxc/confile.c b/src/lxc/confile.c
index f00afe9..8790494 100644
--- a/src/lxc/confile.c
+++ b/src/lxc/confile.c
@@ -4288,7 +4288,12 @@ static int get_config_prlimit(const char *key, char *retv, int inlen,
lxc_list_for_each(it, &c->limits) {
/* 2 colon separated 64 bit integers or the word 'unlimited' */
+#ifdef HAVE_ISULAD
+#define MAX_LIMIT_BUF_LEN ((INTTYPE_TO_STRLEN(uint64_t) * 2) + 2)
+ char buf[MAX_LIMIT_BUF_LEN] = { 0 };
+#else
char buf[INTTYPE_TO_STRLEN(uint64_t) * 2 + 2];
+#endif
int partlen;
struct lxc_limit *lim = it->elem;
@@ -4296,17 +4301,34 @@ static int get_config_prlimit(const char *key, char *retv, int inlen,
memcpy(buf, "unlimited", STRLITERALLEN("unlimited") + 1);
partlen = STRLITERALLEN("unlimited");
} else {
+#ifdef HAVE_ISULAD
+ partlen = snprintf(buf, MAX_LIMIT_BUF_LEN, "%" PRIu64, (uint64_t)lim->limit.rlim_cur);
+ if (partlen < 0 || partlen >= MAX_LIMIT_BUF_LEN) {
+ return -1;
+ }
+#else
partlen = sprintf(buf, "%" PRIu64,
(uint64_t)lim->limit.rlim_cur);
+#endif
}
if (lim->limit.rlim_cur != lim->limit.rlim_max) {
if (lim->limit.rlim_max == RLIM_INFINITY)
memcpy(buf + partlen, ":unlimited",
STRLITERALLEN(":unlimited") + 1);
+#ifdef HAVE_ISULAD
+ else {
+ int nret = snprintf(buf + partlen, (MAX_LIMIT_BUF_LEN - partlen),
+ ":%" PRIu64, (uint64_t)lim->limit.rlim_max);
+ if (nret < 0 || nret >= (MAX_LIMIT_BUF_LEN - partlen)) {
+ return -1;
+ }
+ }
+#else
else
sprintf(buf + partlen, ":%" PRIu64,
(uint64_t)lim->limit.rlim_max);
+#endif
}
if (get_all) {
diff --git a/src/lxc/lxccontainer.c b/src/lxc/lxccontainer.c
index f622a63..ab10ac6 100644
--- a/src/lxc/lxccontainer.c
+++ b/src/lxc/lxccontainer.c
@@ -3243,6 +3243,14 @@ static bool container_destroy(struct lxc_container *c,
if (ret < 0) {
ERROR("Failed to destroy directory \"%s\" for \"%s\"", path,
c->name);
+#ifdef HAVE_ISULAD
+ char msg[BUFSIZ] = { 0 };
+ ret = snprintf(msg, BUFSIZ, "Failed to destroy directory \"%s\": %s", path, errno ? strerror(errno) : "error");
+ if (ret < 0 || ret >= BUFSIZ) {
+ ERROR("Sprintf failed");
+ goto out;
+ }
+#endif
goto out;
}
INFO("Destroyed directory \"%s\" for \"%s\"", path, c->name);
--
1.8.3.1

35
0037-cgfsng-fix-build-error-device_cgroup_rule_parse.patch
View File

@ -1,35 +0,0 @@
From 5f8d8bb11c42fbf6bca39438530db88729e50f5e Mon Sep 17 00:00:00 2001
From: LiFeng <lifeng68@huawei.com>
Date: Thu, 16 Apr 2020 11:12:28 +0800
Subject: [PATCH 37/49] cgfsng: fix build error device_cgroup_rule_parse
Signed-off-by: LiFeng <lifeng68@huawei.com>
---
src/lxc/cgroups/cgfsng.c | 4 +---
1 file changed, 1 insertion(+), 3 deletions(-)
diff --git a/src/lxc/cgroups/cgfsng.c b/src/lxc/cgroups/cgfsng.c
index 1047c08..76576c5 100644
--- a/src/lxc/cgroups/cgfsng.c
+++ b/src/lxc/cgroups/cgfsng.c
@@ -3043,8 +3043,7 @@ static int device_cgroup_parse_access(struct device_item *device, const char *va
return 0;
}
-#ifndef HAVE_ISULAD
-static int device_cgroup_rule_parse(struct device_item *device, const char *key,
+int device_cgroup_rule_parse(struct device_item *device, const char *key,
const char *val)
{
int count, ret;
@@ -3130,7 +3129,6 @@ static int device_cgroup_rule_parse(struct device_item *device, const char *key,
return device_cgroup_parse_access(device, ++val);
}
-#endif
#ifdef HAVE_ISULAD
__cgfsng_ops static int cgfsng_set(struct cgroup_ops *ops,
--
1.8.3.1

31
0038-Ignore-errors-when-loading-rules-fail.patch
View File

@ -1,31 +0,0 @@
From 06a4fd31155821e4425a94ed0ff0d2353d5d940d Mon Sep 17 00:00:00 2001
From: wujing <wujing50@huawei.com>
Date: Wed, 15 Apr 2020 23:28:36 -0400
Subject: [PATCH 38/49] Ignore errors when loading rules fail
Signed-off-by: wujing <wujing50@huawei.com>
---
src/lxc/seccomp.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/src/lxc/seccomp.c b/src/lxc/seccomp.c
index a75adb7..b7c4de3 100644
--- a/src/lxc/seccomp.c
+++ b/src/lxc/seccomp.c
@@ -586,11 +586,12 @@ bool do_resolve_add_rule(uint32_t arch, char *line, scmp_filter_ctx ctx,
#ifdef HAVE_ISULAD
DEBUG("Failed loading rule for %s (nr %d action %d (%s))",
line, nr, rule->action, get_action_name(rule->action));
+ return true;
#else
SYSERROR("Failed loading rule for %s (nr %d action %d (%s))",
line, nr, rule->action, get_action_name(rule->action));
-#endif
return false;
+#endif
}
return true;
--
1.8.3.1

51
0039-net-adapt-to-isulad.patch
View File

@ -1,51 +0,0 @@
From c474b4e528e591680c6f9cbbcb27bdfe4e5f94f9 Mon Sep 17 00:00:00 2001
From: LiFeng <lifeng68@huawei.com>
Date: Thu, 16 Apr 2020 12:01:39 +0800
Subject: [PATCH 39/49] net: adapt to isulad
Signed-off-by: LiFeng <lifeng68@huawei.com>
---
src/lxc/commands_utils.c | 2 +-
src/lxc/network.c | 10 +++++++++-
2 files changed, 10 insertions(+), 2 deletions(-)
diff --git a/src/lxc/commands_utils.c b/src/lxc/commands_utils.c
index c5fc094..2f2670d 100644
--- a/src/lxc/commands_utils.c
+++ b/src/lxc/commands_utils.c
@@ -114,7 +114,7 @@ int lxc_make_abstract_socket_name(char *path, size_t pathlen,
}
ret = snprintf(offset, len, "%s/%s/%s", lxcpath, name, suffix);
- if (ret < 0 || (size_t)ret >= len)
+ if (ret < 0)
return log_error_errno(-1, errno, "Failed to create abstract socket name");
/*
diff --git a/src/lxc/network.c b/src/lxc/network.c
index b442ed5..19adb23 100644
--- a/src/lxc/network.c
+++ b/src/lxc/network.c
@@ -3448,10 +3448,18 @@ static int lxc_network_setup_in_child_namespaces_common(struct lxc_netdev *netde
/* set the network device up */
if (netdev->flags & IFF_UP) {
+
+#ifdef HAVE_ISULAD
+ if (netdev->name[0] != '\0') {
+ err = lxc_netdev_up(netdev->name);
+ if (err)
+ return log_error_errno(-1, -err, "Failed to set network device \"%s\" up", netdev->name);
+ }
+#else
err = lxc_netdev_up(netdev->name);
if (err)
return log_error_errno(-1, -err, "Failed to set network device \"%s\" up", netdev->name);
-
+#endif
/* the network is up, make the loopback up too */
err = lxc_netdev_up("lo");
if (err)
--
1.8.3.1

29
0040-cgfsng-make-container-full-path-in-cgfsng_get_cgroup.patch
View File

@ -1,29 +0,0 @@
From beefa97e5dd3daec438b6d8237af167fde1097dd Mon Sep 17 00:00:00 2001
From: LiFeng <lifeng68@huawei.com>
Date: Thu, 16 Apr 2020 12:35:45 +0800
Subject: [PATCH 40/49] cgfsng: make container full path in cgfsng_get_cgroup
Signed-off-by: LiFeng <lifeng68@huawei.com>
---
src/lxc/cgroups/cgfsng.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/src/lxc/cgroups/cgfsng.c b/src/lxc/cgroups/cgfsng.c
index 76576c5..e2a8983 100644
--- a/src/lxc/cgroups/cgfsng.c
+++ b/src/lxc/cgroups/cgfsng.c
@@ -2612,6 +2612,11 @@ __cgfsng_ops static const char *cgfsng_get_cgroup(struct cgroup_ops *ops,
return log_warn_errno(NULL, ENOENT, "Failed to find hierarchy for controller \"%s\"",
controller ? controller : "(null)");
+#ifdef HAVE_ISULAD
+ if (!h->container_full_path)
+ h->container_full_path = must_make_path(h->mountpoint, h->container_base_path, ops->container_cgroup, NULL);
+#endif
+
return h->container_full_path
? h->container_full_path + strlen(h->mountpoint)
: NULL;
--
1.8.3.1

52
0041-build-fix-some-bug-in-free-memory.patch
View File

@ -1,52 +0,0 @@
From dcc50d14398f1bfcde7c41e7480928e6c98b52d9 Mon Sep 17 00:00:00 2001
From: LiFeng <lifeng68@huawei.com>
Date: Thu, 16 Apr 2020 12:35:45 +0800
Subject: [PATCH 41/49] build: fix some bug in free memory
Signed-off-by: LiFeng <lifeng68@huawei.com>
---
src/lxc/lxccontainer.c | 10 ++++++++++
src/lxc/string_utils.c | 1 +
2 files changed, 11 insertions(+)
diff --git a/src/lxc/lxccontainer.c b/src/lxc/lxccontainer.c
index ab10ac6..818848a 100644
--- a/src/lxc/lxccontainer.c
+++ b/src/lxc/lxccontainer.c
@@ -6006,11 +6006,21 @@ int list_active_containers(const char *lxcpath, char ***nret,
continue;
}
+#ifdef HAVE_ISULAD
+ if (ct_name && ct_name_cnt) {
+ if (array_contains(&ct_name, p, ct_name_cnt)) {
+ if (is_hashed)
+ free(p);
+ continue;
+ }
+ }
+#else
if (array_contains(&ct_name, p, ct_name_cnt)) {
if (is_hashed)
free(p);
continue;
}
+#endif
if (!add_to_array(&ct_name, p, ct_name_cnt)) {
if (is_hashed)
diff --git a/src/lxc/string_utils.c b/src/lxc/string_utils.c
index dcb1160..9118add 100644
--- a/src/lxc/string_utils.c
+++ b/src/lxc/string_utils.c
@@ -501,6 +501,7 @@ int lxc_grow_array(void ***array, size_t *capacity, size_t new_size, size_t capa
/* first time around, catch some trivial mistakes of the user
* only initializing one of these */
if (!*array || !*capacity) {
+ free(*array);
*array = NULL;
*capacity = 0;
}
--
1.8.3.1

29
0042-cgfsng-make-container-full-path-in-destory-cgroup.patch
View File

@ -1,29 +0,0 @@
From a5cc738c0f322b35a759f83d8d631e657f8bd58b Mon Sep 17 00:00:00 2001
From: LiFeng <lifeng68@huawei.com>
Date: Thu, 16 Apr 2020 16:30:34 +0800
Subject: [PATCH 42/49] cgfsng: make container full path in destory cgroup
Signed-off-by: LiFeng <lifeng68@huawei.com>
---
src/lxc/cgroups/cgfsng.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/src/lxc/cgroups/cgfsng.c b/src/lxc/cgroups/cgfsng.c
index e2a8983..1e1df3b 100644
--- a/src/lxc/cgroups/cgfsng.c
+++ b/src/lxc/cgroups/cgfsng.c
@@ -970,8 +970,9 @@ static int isulad_cgroup_tree_remove(struct hierarchy **hierarchies,
struct hierarchy *h = hierarchies[i];
int ret;
- if (!h->container_full_path)
- continue;
+ if (!h->container_full_path) {
+ h->container_full_path = must_make_path(h->mountpoint, h->container_base_path, container_cgroup, NULL);
+ }
ret = lxc_rm_rf(h->container_full_path);
if (ret < 0) {
--
1.8.3.1

683
0043-support-error-report.patch
View File

@ -1,683 +0,0 @@
From 968c9e3e7715c080f23a1fd80c31d4bcf20d241b Mon Sep 17 00:00:00 2001
From: haozi007 <liuhao27@huawei.com>
Date: Thu, 16 Apr 2020 15:16:41 +0800
Subject: [PATCH 43/49] support error report
Signed-off-by: haozi007 <liuhao27@huawei.com>
---
src/lxc/attach.c | 60 +++++++++++++++++++++++++++++++++++++++++++----
src/lxc/attach_options.h | 12 ++++++++++
src/lxc/cgroups/cgfsng.c | 1 +
src/lxc/conf.c | 59 ++++++++++++++++++++++++++++++++++++++++++++++
src/lxc/conf.h | 5 ++++
src/lxc/execute.c | 7 ++++++
src/lxc/lxccontainer.c | 47 +++++++++++++++++++++++++++++++++++++
src/lxc/start.c | 21 +++++++++++++++++
src/lxc/start.h | 4 ++++
src/lxc/tools/lxc_ls.c | 8 +++++++
src/lxc/tools/lxc_start.c | 5 ++++
src/lxc/utils.c | 16 +++++++++++++
12 files changed, 241 insertions(+), 4 deletions(-)
diff --git a/src/lxc/attach.c b/src/lxc/attach.c
index 510c069..734cddd 100644
--- a/src/lxc/attach.c
+++ b/src/lxc/attach.c
@@ -677,9 +677,13 @@ static int attach_child_main(struct attach_clone_payload *payload)
bool needs_lsm = (options->namespaces & CLONE_NEWNS) &&
(options->attach_flags & LXC_ATTACH_LSM) &&
init_ctx->lsm_label;
-
#ifdef HAVE_ISULAD
- /*isulad: set system umask */
+ int msg_fd = -1;
+
+ /*isulad: record errpipe fd*/
+ msg_fd = init_ctx->container->lxc_conf->errpipe[1];
+ init_ctx->container->lxc_conf->errpipe[1] = -1;
+ /*isulad: set system umask */
umask(init_ctx->container->lxc_conf->umask);
#endif
@@ -963,10 +967,12 @@ static int attach_child_main(struct attach_clone_payload *payload)
payload->ipc_socket = -EBADF;
lxc_proc_put_context_info(init_ctx);
payload->init_ctx = NULL;
-#endif
-
+ _exit(payload->exec_function(payload->exec_payload, msg_fd));
+#else
/* We're done, so we can now do whatever the user intended us to do. */
_exit(payload->exec_function(payload->exec_payload));
+#endif
+
on_error:
lxc_put_attach_clone_payload(payload);
@@ -1331,6 +1337,25 @@ int lxc_attach(struct lxc_container *container, lxc_attach_exec_t exec_function,
return -1;
}
+#ifdef HAVE_ISULAD
+ /* isulad: pipdfd for get error message of child or grandchild process. */
+ if (pipe2(conf->errpipe, O_CLOEXEC) != 0) {
+ SYSERROR("Failed to init errpipe");
+ if (options->attach_flags & LXC_ATTACH_TERMINAL) {
+ lxc_terminal_delete(&terminal);
+ lxc_terminal_conf_free(&terminal);
+ if (exec_command.maincmd_fd != -1) {
+ close(exec_command.maincmd_fd);
+ }
+ }
+ close(ipc_sockets[0]);
+ close(ipc_sockets[1]);
+ free(cwd);
+ lxc_proc_put_context_info(init_ctx);
+ return -1;
+ }
+#endif
+
/* Create intermediate subprocess, two reasons:
* 1. We can't setns() in the child itself, since we want to make
* sure we are properly attached to the pidns.
@@ -1365,6 +1390,11 @@ int lxc_attach(struct lxc_container *container, lxc_attach_exec_t exec_function,
/* close unneeded file descriptors */
close(ipc_sockets[1]);
free(cwd);
+#ifdef HAVE_ISULAD
+ /* isulad: close errpipe */
+ close(conf->errpipe[1]);
+ conf->errpipe[1] = -1;
+#endif
lxc_proc_close_ns_fd(init_ctx);
if (options->attach_flags & LXC_ATTACH_TERMINAL)
lxc_attach_terminal_close_slave(&terminal);
@@ -1398,7 +1428,11 @@ int lxc_attach(struct lxc_container *container, lxc_attach_exec_t exec_function,
/* Setup resource limits */
if (!lxc_list_empty(&conf->limits)) {
+#ifdef HAVE_ISULAD
+ ret = setup_resource_limits(&conf->limits, pid, -1);
+#else
ret = setup_resource_limits(&conf->limits, pid);
+#endif
if (ret < 0)
goto on_error;
}
@@ -1561,6 +1595,12 @@ int lxc_attach(struct lxc_container *container, lxc_attach_exec_t exec_function,
/* close unneeded file descriptors */
close_prot_errno_disarm(ipc_sockets[0]);
+#ifdef HAVE_ISULAD
+ /* isulad: close errpipe */
+ close(conf->errpipe[0]);
+ conf->errpipe[0] = -1;
+#endif
+
if (options->attach_flags & LXC_ATTACH_TERMINAL) {
lxc_attach_terminal_close_master(&terminal);
lxc_attach_terminal_close_peer(&terminal);
@@ -1665,7 +1705,11 @@ int lxc_attach(struct lxc_container *container, lxc_attach_exec_t exec_function,
_exit(EXIT_SUCCESS);
}
+#ifdef HAVE_ISULAD
+int lxc_attach_run_command(void *payload, int msg_fd)
+#else
int lxc_attach_run_command(void *payload)
+#endif
{
int ret = -1;
lxc_attach_command_t *cmd = payload;
@@ -1681,11 +1725,19 @@ int lxc_attach_run_command(void *payload)
break;
}
}
+#ifdef HAVE_ISULAD
+ /* isulad: write error messages */
+ lxc_write_error_message(msg_fd, "exec: \"%s\": %s.", cmd->program, strerror(errno));
+#endif
return log_error_errno(ret, errno, "Failed to exec \"%s\"", cmd->program);
}
+#ifdef HAVE_ISULAD
+int lxc_attach_run_shell(void* payload, int msg_fd)
+#else
int lxc_attach_run_shell(void* payload)
+#endif
{
__do_free char *buf = NULL;
uid_t uid;
diff --git a/src/lxc/attach_options.h b/src/lxc/attach_options.h
index 5f01739..d5d4f44 100644
--- a/src/lxc/attach_options.h
+++ b/src/lxc/attach_options.h
@@ -49,7 +49,11 @@ enum {
*
* \return Function should return \c 0 on success, and any other value to denote failure.
*/
+#ifdef HAVE_ISULAD
+typedef int (*lxc_attach_exec_t)(void* payload, int msg_fd);
+#else
typedef int (*lxc_attach_exec_t)(void* payload);
+#endif
/*!
* LXC attach options for \ref lxc_container \c attach().
@@ -153,7 +157,11 @@ typedef struct lxc_attach_command_t {
*
* \return \c -1 on error, exit code of lxc_attach_command_t program on success.
*/
+#ifdef HAVE_ISULAD
+extern int lxc_attach_run_command(void* payload, int msg_fd);
+#else
extern int lxc_attach_run_command(void* payload);
+#endif
/*!
* \brief Run a shell command in the container.
@@ -162,7 +170,11 @@ extern int lxc_attach_run_command(void* payload);
*
* \return Exit code of shell.
*/
+#ifdef HAVE_ISULAD
+extern int lxc_attach_run_shell(void* payload, int msg_fd);
+#else
extern int lxc_attach_run_shell(void* payload);
+#endif
#ifdef __cplusplus
}
diff --git a/src/lxc/cgroups/cgfsng.c b/src/lxc/cgroups/cgfsng.c
index 1e1df3b..002f051 100644
--- a/src/lxc/cgroups/cgfsng.c
+++ b/src/lxc/cgroups/cgfsng.c
@@ -4233,6 +4233,7 @@ struct cgroup_ops *cgfsng_ops_init(struct lxc_conf *conf)
cgfsng_ops->data_init = cgfsng_data_init;
#ifdef HAVE_ISULAD
+ cgfsng_ops->errfd = conf ? conf->errpipe[1] : -1;
cgfsng_ops->payload_destroy = isulad_cgfsng_payload_destroy;
#else
cgfsng_ops->payload_destroy = cgfsng_payload_destroy;
diff --git a/src/lxc/conf.c b/src/lxc/conf.c
index e8ee749..d7a78bd 100644
--- a/src/lxc/conf.c
+++ b/src/lxc/conf.c
@@ -2275,8 +2275,15 @@ static int mount_entry_create_dir_file(const struct mntent *mntent,
if (hasmntopt(mntent, "create=dir")) {
ret = mkdir_p(path, 0755);
+#ifdef HAVE_ISULAD
+ if (ret < 0 && errno != EEXIST) {
+ lxc_write_error_message(rootfs->errfd, "%s:%d: mkdir %s: %s.", __FILE__, __LINE__, path, strerror(errno));
+ return log_error_errno(-1, errno, "Failed to create directory \"%s\"", path);
+ }
+#else
if (ret < 0 && errno != EEXIST)
return log_error_errno(-1, errno, "Failed to create directory \"%s\"", path);
+#endif
}
if (!hasmntopt(mntent, "create=file"))
@@ -2293,12 +2300,26 @@ static int mount_entry_create_dir_file(const struct mntent *mntent,
p2 = dirname(p1);
ret = mkdir_p(p2, 0755);
+#ifdef HAVE_ISULAD
+ if (ret < 0 && errno != EEXIST) {
+ lxc_write_error_message(rootfs->errfd, "%s:%d: mkdir %s: %s.", __FILE__, __LINE__, path, strerror(errno));
+ return log_error_errno(-1, errno, "Failed to create directory \"%s\"", path);
+ }
+#else
if (ret < 0 && errno != EEXIST)
return log_error_errno(-1, errno, "Failed to create directory \"%s\"", path);
+#endif
ret = mknod(path, S_IFREG | 0000, 0);
+#ifdef HAVE_ISULAD
+ if (ret < 0 && errno != EEXIST) {
+ lxc_write_error_message(rootfs->errfd, "%s:%d: open %s: %s.", __FILE__, __LINE__, path, strerror(errno));
+ return -errno;
+ }
+#else
if (ret < 0 && errno != EEXIST)
return -errno;
+#endif
return 0;
}
@@ -2960,7 +2981,11 @@ static int parse_resource(const char *res)
return resid;
}
+#ifdef HAVE_ISULAD
+int setup_resource_limits(struct lxc_list *limits, pid_t pid, int errfd)
+#else
int setup_resource_limits(struct lxc_list *limits, pid_t pid)
+#endif
{
int resid;
struct lxc_list *it;
@@ -2974,8 +2999,17 @@ int setup_resource_limits(struct lxc_list *limits, pid_t pid)
return log_error(-1, "Unknown resource %s", lim->resource);
#if HAVE_PRLIMIT || HAVE_PRLIMIT64
+#if HAVE_ISULAD
+ if (prlimit(pid, resid, &lim->limit, NULL) != 0) {
+ lxc_write_error_message(errfd, "%s:%d: Failed to set limit %s %lu %lu: %s.",
+ __FILE__, __LINE__, lim->resource,
+ lim->limit.rlim_cur, lim->limit.rlim_max, strerror(errno));
+ return log_error_errno(-1, errno, "Failed to set limit %s", lim->resource);
+ }
+#else
if (prlimit(pid, resid, &lim->limit, NULL) != 0)
return log_error_errno(-1, errno, "Failed to set limit %s", lim->resource);
+#endif
TRACE("Setup \"%s\" limit", lim->resource);
#else
@@ -3134,6 +3168,9 @@ struct lxc_conf *lxc_conf_init(void)
new->console.pipes[2][0] = -1;
new->console.pipes[2][1] = -1;
lxc_list_init(&new->console.fifos);
+ new->errmsg = NULL;
+ new->errpipe[0] = -1;
+ new->errpipe[1] = -1;
#endif
return new;
@@ -4534,8 +4571,16 @@ int lxc_setup(struct lxc_handler *handler)
char *keyring_context = NULL;
ret = lxc_setup_rootfs_prepare_root(lxc_conf, name, lxcpath);
+#ifdef HAVE_ISULAD
+ if (ret < 0) {
+ lxc_write_error_message(lxc_conf->errpipe[1], "%s:%d: failed to setup rootfs %s.",
+ __FILE__, __LINE__, lxc_conf->rootfs.path);
+ return log_error(-1, "Failed to setup rootfs");
+ }
+#else
if (ret < 0)
return log_error(-1, "Failed to setup rootfs");
+#endif
if (handler->nsfd[LXC_NS_UTS] == -EBADF) {
ret = setup_utsname(lxc_conf->utsname);
@@ -5243,6 +5288,8 @@ void lxc_conf_free(struct lxc_conf *conf)
lxc_clear_populate_devices(conf);
lxc_clear_rootfs_masked_paths(conf);
lxc_clear_rootfs_ro_paths(conf);
+ free(conf->errmsg);
+ lxc_close_error_pipe(conf->errpipe);
#endif
free(conf);
}
@@ -6127,4 +6174,16 @@ int lxc_clear_rootfs_ro_paths(struct lxc_conf *c)
return 0;
}
+/*isulad: close error pipe */
+void lxc_close_error_pipe(int *errpipe)
+{
+ if (errpipe[0] >= 0) {
+ close(errpipe[0]);
+ errpipe[0] = -1;
+ }
+ if (errpipe[1] >= 0) {
+ close(errpipe[1]);
+ errpipe[1] = -1;
+ }
+}
#endif
diff --git a/src/lxc/conf.h b/src/lxc/conf.h
index 7b6fd3b..4b6409e 100644
--- a/src/lxc/conf.h
+++ b/src/lxc/conf.h
@@ -506,7 +506,11 @@ extern int lxc_setup_rootfs_prepare_root(struct lxc_conf *conf,
const char *name, const char *lxcpath);
extern int lxc_setup(struct lxc_handler *handler);
extern int lxc_setup_parent(struct lxc_handler *handler);
+#ifdef HAVE_ISULAD
+extern int setup_resource_limits(struct lxc_list *limits, pid_t pid, int errfd);
+#else
extern int setup_resource_limits(struct lxc_list *limits, pid_t pid);
+#endif
extern int find_unmapped_nsid(const struct lxc_conf *conf, enum idtype idtype);
extern int mapped_hostid(unsigned id, const struct lxc_conf *conf,
enum idtype idtype);
@@ -557,5 +561,6 @@ int lxc_clear_rootfs_masked_paths(struct lxc_conf *c);
int lxc_clear_rootfs_ro_paths(struct lxc_conf *c);
int lxc_drop_caps(struct lxc_conf *conf);
int run_oci_hooks(const char *name, const char *hookname, struct lxc_conf *conf, const char *lxcpath);
+void lxc_close_error_pipe(int *errpipe);
#endif
#endif /* __LXC_CONF_H */
diff --git a/src/lxc/execute.c b/src/lxc/execute.c
index 59ff604..16c0fed 100644
--- a/src/lxc/execute.c
+++ b/src/lxc/execute.c
@@ -19,7 +19,11 @@
lxc_log_define(execute, start);
+#ifdef HAVE_ISULAD
+static int execute_start(struct lxc_handler *handler, void* data, int fd)
+#else
static int execute_start(struct lxc_handler *handler, void* data)
+#endif
{
int argc_add, j;
char **argv;
@@ -71,6 +75,9 @@ static int execute_start(struct lxc_handler *handler, void* data)
execvp(argv[0], argv);
SYSERROR("Failed to exec %s", argv[0]);
+#ifdef HAVE_ISULAD
+ lxc_write_error_message(fd, "Failed to exec: \"%s\": %s.", argv[0], strerror(errno));
+#endif
free(argv);
out1:
return 1;
diff --git a/src/lxc/lxccontainer.c b/src/lxc/lxccontainer.c
index 818848a..ed09a59 100644
--- a/src/lxc/lxccontainer.c
+++ b/src/lxc/lxccontainer.c
@@ -972,6 +972,8 @@ static bool do_lxcapi_start(struct lxc_container *c, int useinit, char * const a
char **init_cmd = NULL;
#ifdef HAVE_ISULAD
int keepfds[] = {-1, -1, -1, -1, -1};
+ ssize_t size_read;
+ char errbuf[BUFSIZ + 1] = {0};
#else
int keepfds[3] = {-1, -1, -1};
#endif
@@ -1046,10 +1048,23 @@ static bool do_lxcapi_start(struct lxc_container *c, int useinit, char * const a
char title[2048];
pid_t pid_first, pid_second;
+#ifdef HAVE_ISULAD
+ //isulad: pipdfd for get error message of child or grandchild process.
+ if (pipe2(conf->errpipe, O_CLOEXEC) != 0) {
+ SYSERROR("Failed to init errpipe");
+ free_init_cmd(init_cmd);
+ lxc_free_handler(handler);
+ return false;
+ }
+#endif
+
pid_first = fork();
if (pid_first < 0) {
free_init_cmd(init_cmd);
lxc_free_handler(handler);
+#ifdef HAVE_ISULAD
+ lxc_close_error_pipe(conf->errpipe);
+#endif
return false;
}
@@ -1059,11 +1074,25 @@ static bool do_lxcapi_start(struct lxc_container *c, int useinit, char * const a
* the PID file, child will do the free and unlink.
*/
c->pidfile = NULL;
+#ifdef HAVE_ISULAD
+ close(conf->errpipe[1]);
+ conf->errpipe[1] = -1;
+#endif
/* Wait for container to tell us whether it started
* successfully.
*/
started = wait_on_daemonized_start(handler, pid_first);
+#ifdef HAVE_ISULAD
+ if (!started) {
+ size_read = read(conf->errpipe[0], errbuf, BUFSIZ);
+ if (size_read > 0) {
+ conf->errmsg = safe_strdup(errbuf);
+ }
+ }
+ close(conf->errpipe[0]);
+ conf->errpipe[0] = -1;
+#endif
free_init_cmd(init_cmd);
lxc_free_handler(handler);
@@ -1099,6 +1128,9 @@ static bool do_lxcapi_start(struct lxc_container *c, int useinit, char * const a
if (pid_second != 0) {
free_init_cmd(init_cmd);
lxc_free_handler(handler);
+#ifdef HAVE_ISULAD
+ lxc_close_error_pipe(conf->errpipe);
+#endif
_exit(EXIT_SUCCESS);
}
@@ -1114,6 +1146,11 @@ static bool do_lxcapi_start(struct lxc_container *c, int useinit, char * const a
keepfds[0] = handler->conf->maincmd_fd;
keepfds[1] = handler->state_socket_pair[0];
keepfds[2] = handler->state_socket_pair[1];
+#ifdef HAVE_ISULAD
+ keepfds[4] = conf->errpipe[1];
+ close(conf->errpipe[0]);
+ conf->errpipe[0] = -1;
+#endif
ret = lxc_check_inherited(conf, true, keepfds,
sizeof(keepfds) / sizeof(keepfds[0]));
if (ret < 0)
@@ -1148,6 +1185,9 @@ static bool do_lxcapi_start(struct lxc_container *c, int useinit, char * const a
if (w < 0 || (size_t)w >= sizeof(pidstr)) {
free_init_cmd(init_cmd);
lxc_free_handler(handler);
+#ifdef HAVE_ISULAD
+ lxc_close_error_pipe(conf->errpipe);
+#endif
SYSERROR("Failed to write monitor pid to \"%s\"", c->pidfile);
@@ -1161,6 +1201,9 @@ static bool do_lxcapi_start(struct lxc_container *c, int useinit, char * const a
if (ret < 0) {
free_init_cmd(init_cmd);
lxc_free_handler(handler);
+#ifdef HAVE_ISULAD
+ lxc_close_error_pipe(conf->errpipe);
+#endif
SYSERROR("Failed to write monitor pid to \"%s\"", c->pidfile);
@@ -1224,6 +1267,9 @@ reboot:
if (conf->exit_fd >= 0) {
keepfds[3] = conf->exit_fd;
}
+ /* isulad: keep errpipe fd */
+ if (c->daemonize)
+ keepfds[4] = conf->errpipe[1];
#endif
ret = lxc_check_inherited(conf, c->daemonize, keepfds,
@@ -3250,6 +3296,7 @@ static bool container_destroy(struct lxc_container *c,
ERROR("Sprintf failed");
goto out;
}
+ c->error_string = safe_strdup(msg);
#endif
goto out;
}
diff --git a/src/lxc/start.c b/src/lxc/start.c
index 0bc1143..134235f 100644
--- a/src/lxc/start.c
+++ b/src/lxc/start.c
@@ -836,6 +836,9 @@ int lxc_init(const char *name, struct lxc_handler *handler)
ret = lxc_terminal_setup(conf);
if (ret < 0) {
ERROR("Failed to create console");
+#ifdef HAVE_ISULAD
+ lxc_write_error_message(conf->errpipe[1], "Failed to create console for container \"%s\".", name);
+#endif
goto out_restore_sigmask;
}
TRACE("Created console");
@@ -1470,6 +1473,9 @@ static int do_start(void *data)
/* Setup the container, ip, names, utsname, ... */
ret = lxc_setup(handler);
if (ret < 0) {
+#ifdef HAVE_ISULAD
+ lxc_write_error_message(handler->conf->errpipe[1], "Failed to setup lxc, please check the config file.");
+#endif
ERROR("Failed to setup container \"%s\"", handler->name);
goto out_warn_father;
}
@@ -1763,7 +1769,11 @@ static int do_start(void *data)
/* After this call, we are in error because this ops should not return
* as it execs.
*/
+#ifdef HAVE_ISULAD
+ handler->ops->start(handler, handler->data, handler->daemonize ? handler->conf->errpipe[1] : -1);
+#else
handler->ops->start(handler, handler->data);
+#endif
out_warn_father:
/* We want the parent to know something went wrong, so we return a
@@ -2246,7 +2256,11 @@ static int lxc_spawn(struct lxc_handler *handler)
goto out_delete_net;
if (!lxc_list_empty(&conf->limits)) {
+#ifdef HAVE_ISULAD
+ ret = setup_resource_limits(&conf->limits, handler->pid, conf->errpipe[1]);
+#else
ret = setup_resource_limits(&conf->limits, handler->pid);
+#endif
if (ret < 0) {
ERROR("Failed to setup resource limits");
goto out_delete_net;
@@ -2652,7 +2666,11 @@ struct start_args {
char *const *argv;
};
+#ifdef HAVE_ISULAD
+static int start(struct lxc_handler *handler, void* data, int fd)
+#else
static int start(struct lxc_handler *handler, void* data)
+#endif
{
struct start_args *arg = data;
@@ -2660,6 +2678,9 @@ static int start(struct lxc_handler *handler, void* data)
execvp(arg->argv[0], arg->argv);
SYSERROR("Failed to exec \"%s\"", arg->argv[0]);
+#ifdef HAVE_ISULAD
+ lxc_write_error_message(fd, "exec: \"%s\": %s.", arg->argv[0], strerror(errno));
+#endif
return 0;
}
diff --git a/src/lxc/start.h b/src/lxc/start.h
index cea37bc..ebeeb72 100644
--- a/src/lxc/start.h
+++ b/src/lxc/start.h
@@ -141,7 +141,11 @@ struct execute_args {
};
struct lxc_operations {
+#ifdef HAVE_ISULAD
+ int (*start)(struct lxc_handler *, void *, int);
+#else
int (*start)(struct lxc_handler *, void *);
+#endif
int (*post_start)(struct lxc_handler *, void *);
};
diff --git a/src/lxc/tools/lxc_ls.c b/src/lxc/tools/lxc_ls.c
index 4be8564..e601f9d 100644
--- a/src/lxc/tools/lxc_ls.c
+++ b/src/lxc/tools/lxc_ls.c
@@ -106,7 +106,11 @@ struct wrapargs {
/*
* Takes struct wrapargs as argument.
*/
+#ifdef HAVE_ISULAD
+static int ls_get_wrapper(void *wrap, int msgfd);
+#else
static int ls_get_wrapper(void *wrap);
+#endif
/*
* To calculate swap usage we should not simply check memory.usage_in_bytes and
@@ -1005,7 +1009,11 @@ static int my_parser(struct lxc_arguments *args, int c, char *arg)
return 0;
}
+#ifdef HAVE_ISULAD
+static int ls_get_wrapper(void *wrap, int msgfd)
+#else
static int ls_get_wrapper(void *wrap)
+#endif
{
int ret = -1;
size_t len = 0;
diff --git a/src/lxc/tools/lxc_start.c b/src/lxc/tools/lxc_start.c
index b430a1e..4f2c8af 100644
--- a/src/lxc/tools/lxc_start.c
+++ b/src/lxc/tools/lxc_start.c
@@ -392,6 +392,11 @@ int main(int argc, char *argv[])
else
err = c->start(c, 0, args) ? EXIT_SUCCESS : EXIT_FAILURE;
if (err) {
+#ifdef HAVE_ISULAD
+ if (c->lxc_conf->errmsg)
+ fprintf(stderr, "%s:%s:%s:%d starting container process caused \"%s\"", c->name,
+ __FILE__, __func__, __LINE__, c->lxc_conf->errmsg);
+#endif
ERROR("The container failed to start");
if (my_args.daemonize)
diff --git a/src/lxc/utils.c b/src/lxc/utils.c
index 810b7fe..4e418fb 100644
--- a/src/lxc/utils.c
+++ b/src/lxc/utils.c
@@ -73,6 +73,9 @@ static int _recursive_rmdir(const char *dirname, dev_t pdev,
int ret;
struct dirent *direntp;
char pathname[PATH_MAX];
+#ifdef HAVE_ISULAD
+ int saved_errno = 0;
+#endif
dir = opendir(dirname);
if (!dir)
@@ -135,6 +138,11 @@ static int _recursive_rmdir(const char *dirname, dev_t pdev,
} else {
ret = unlink(pathname);
if (ret < 0) {
+#ifdef HAVE_ISULAD
+ if (saved_errno == 0) {
+ saved_errno = errno;
+ }
+#endif
__do_close int fd = -EBADF;
fd = open(pathname, O_RDONLY | O_CLOEXEC | O_NONBLOCK);
@@ -160,10 +168,18 @@ static int _recursive_rmdir(const char *dirname, dev_t pdev,
}
if (rmdir(dirname) < 0 && !btrfs_try_remove_subvol(dirname) && !hadexclude) {
+#ifdef HAVE_ISULAD
+ if (saved_errno == 0) {
+ saved_errno = errno;
+ }
+#endif
SYSERROR("Failed to delete \"%s\"", dirname);
failed = 1;
}
+#ifdef HAVE_ISULAD
+ errno = saved_errno;
+#endif
return failed ? -1 : 0;
}
--
1.8.3.1

153
0044-remove-filelock-in-destroy-dir.patch
View File

@ -1,153 +0,0 @@
From 0441dc446ad9f0bc02c5ca7a76d793c8a7734fd9 Mon Sep 17 00:00:00 2001
From: haozi007 <liuhao27@huawei.com>
Date: Thu, 16 Apr 2020 15:39:50 +0800
Subject: [PATCH 44/49] remove filelock in destroy dir
Signed-off-by: haozi007 <liuhao27@huawei.com>
---
src/lxc/lxccontainer.c | 21 +++++++++++++++++++++
src/lxc/lxclock.c | 27 +++++++++++++++++++++++++++
src/lxc/lxclock.h | 4 ++++
src/lxc/start.c | 7 +++++++
src/lxc/storage/dir.c | 4 ++++
5 files changed, 63 insertions(+)
diff --git a/src/lxc/lxccontainer.c b/src/lxc/lxccontainer.c
index ed09a59..6281a8a 100644
--- a/src/lxc/lxccontainer.c
+++ b/src/lxc/lxccontainer.c
@@ -3168,8 +3168,19 @@ static bool container_destroy(struct lxc_container *c,
bool bret = false;
int ret = 0;
+#ifdef HAVE_ISULAD
+ if (!c)
+ return false;
+ // isulad: if container is not defined, we need to remove disk lock file
+ // which is created in lxc_container_new.
+ if (!do_lxcapi_is_defined(c)) {
+ container_disk_removelock(c);
+ return false;
+ }
+#else
if (!c || !do_lxcapi_is_defined(c))
return false;
+#endif
conf = c->lxc_conf;
if (container_disk_lock(c))
@@ -3310,13 +3321,23 @@ out:
free(path);
container_disk_unlock(c);
+#ifdef HAVE_ISULAD
+ if (bret && container_disk_removelock(c)) {
+ bret = false;
+ }
+#endif
return bret;
}
static bool do_lxcapi_destroy(struct lxc_container *c)
{
+#ifdef HAVE_ISULAD
+ if (!c)
+ return false;
+#else
if (!c || !lxcapi_is_defined(c))
return false;
+#endif
if (c->lxc_conf && c->lxc_conf->rootfs.managed) {
if (has_snapshots(c)) {
diff --git a/src/lxc/lxclock.c b/src/lxc/lxclock.c
index 318e5bf..bb0dca0 100644
--- a/src/lxc/lxclock.c
+++ b/src/lxc/lxclock.c
@@ -370,3 +370,30 @@ void container_disk_unlock(struct lxc_container *c)
lxcunlock(c->slock);
lxcunlock(c->privlock);
}
+
+#ifdef HAVE_ISULAD
+static int lxc_removelock(struct lxc_lock *l)
+{
+ int ret = 0;
+
+ if (l->type == LXC_LOCK_FLOCK) {
+ ret = unlink(l->u.f.fname);
+ if (ret && errno != ENOENT) {
+ SYSERROR("Error unlink %s", l->u.f.fname);
+ return ret;
+ }
+ }
+
+ return ret;
+}
+
+int container_disk_removelock(struct lxc_container *c)
+{
+ int ret;
+
+ ret = lxc_removelock(c->slock);
+ if (ret)
+ return ret;
+ return lxc_removelock(c->privlock);
+}
+#endif
diff --git a/src/lxc/lxclock.h b/src/lxc/lxclock.h
index 9f9bc3b..6a71d7c 100644
--- a/src/lxc/lxclock.h
+++ b/src/lxc/lxclock.h
@@ -154,4 +154,8 @@ extern int container_disk_lock(struct lxc_container *c);
*/
extern void container_disk_unlock(struct lxc_container *c);
+#ifdef HAVE_ISULAD
+int container_disk_removelock(struct lxc_container *c);
+#endif
+
#endif
diff --git a/src/lxc/start.c b/src/lxc/start.c
index 134235f..6779cee 100644
--- a/src/lxc/start.c
+++ b/src/lxc/start.c
@@ -2143,6 +2143,13 @@ static int lxc_spawn(struct lxc_handler *handler)
if (ret < 0)
SYSERROR("Failed to set environment variable: LXC_PID=%s", pidstr);
+#ifdef HAVE_ISULAD
+ if (handler->cgroup_ops->container_cgroup) {
+ if (setenv("LXC_CGROUP_PATH", handler->cgroup_ops->container_cgroup, 1))
+ SYSERROR("Failed to set environment variable: LXC_CGROUP_PATH=%s.", handler->cgroup_ops->container_cgroup);
+ }
+#endif
+
for (i = 0; i < LXC_NS_MAX; i++)
if (handler->ns_on_clone_flags & ns_info[i].clone_flag)
INFO("Cloned %s", ns_info[i].flag_name);
diff --git a/src/lxc/storage/dir.c b/src/lxc/storage/dir.c
index 1dc95f1..485572a 100644
--- a/src/lxc/storage/dir.c
+++ b/src/lxc/storage/dir.c
@@ -94,6 +94,9 @@ int dir_create(struct lxc_storage *bdev, const char *dest, const char *n,
int dir_destroy(struct lxc_storage *orig)
{
+#ifdef HAVE_ISULAD
+ // isulad: do not destroy rootfs for directory, it should be managed by caller
+#else
int ret;
const char *src;
@@ -102,6 +105,7 @@ int dir_destroy(struct lxc_storage *orig)
ret = lxc_rmdir_onedev(src, NULL);
if (ret < 0)
return log_error_errno(ret, errno, "Failed to delete \"%s\"", src);
+#endif
return 0;
}
--
1.8.3.1

120
0045-restore-default-signal-handler.patch
View File

@ -1,120 +0,0 @@
From 4a609606e050a9a4693541a965e34d8ac366f153 Mon Sep 17 00:00:00 2001
From: haozi007 <liuhao27@huawei.com>
Date: Thu, 16 Apr 2020 15:56:21 +0800
Subject: [PATCH 45/49] restore default signal handler
Signed-off-by: haozi007 <liuhao27@huawei.com>
---
hooks/Makefile.am | 3 +++
src/lxc/attach.c | 16 ++++++++++++++++
src/lxc/initutils.c | 4 ++++
src/lxc/start.c | 19 +++++++++++++++++++
4 files changed, 42 insertions(+)
diff --git a/hooks/Makefile.am b/hooks/Makefile.am
index 5ae73d7..ddfd4bc 100644
--- a/hooks/Makefile.am
+++ b/hooks/Makefile.am
@@ -10,6 +10,8 @@ hooks_SCRIPTS = \
squid-deb-proxy-client \
nvidia
+
+if !HAVE_ISULAD
binhooks_PROGRAMS = \
unmount-namespace
@@ -20,5 +22,6 @@ if IS_BIONIC
unmount_namespace_SOURCES += \
../src/include/lxcmntent.c ../src/include/lxcmntent.h
endif
+endif
EXTRA_DIST=$(hooks_SCRIPTS)
diff --git a/src/lxc/attach.c b/src/lxc/attach.c
index 734cddd..1dd2b47 100644
--- a/src/lxc/attach.c
+++ b/src/lxc/attach.c
@@ -679,12 +679,28 @@ static int attach_child_main(struct attach_clone_payload *payload)
init_ctx->lsm_label;
#ifdef HAVE_ISULAD
int msg_fd = -1;
+ sigset_t mask;
/*isulad: record errpipe fd*/
msg_fd = init_ctx->container->lxc_conf->errpipe[1];
init_ctx->container->lxc_conf->errpipe[1] = -1;
/*isulad: set system umask */
umask(init_ctx->container->lxc_conf->umask);
+
+ /*isulad: restore default signal handlers and unblock all signals*/
+ for (int i = 1; i < NSIG; i++)
+ signal(i, SIG_DFL);
+
+ ret = sigfillset(&mask);
+ if (ret < 0) {
+ SYSERROR("Failed to fill signal mask");
+ goto on_error;;
+ }
+ ret = sigprocmask(SIG_UNBLOCK, &mask, NULL);
+ if (ret < 0) {
+ SYSERROR("Failed to set signal mask");
+ goto on_error;
+ }
#endif
/* A description of the purpose of this functionality is provided in the
diff --git a/src/lxc/initutils.c b/src/lxc/initutils.c
index 5549c2e..76f0048 100644
--- a/src/lxc/initutils.c
+++ b/src/lxc/initutils.c
@@ -54,12 +54,16 @@ const char *lxc_global_config_value(const char *option_name)
{ NULL, NULL },
};
+#ifdef HAVE_ISULAD
+ static const char *values[sizeof(options) / sizeof(options[0])] = {0};
+#else
/* placed in the thread local storage pool for non-bionic targets */
#ifdef HAVE_TLS
static thread_local const char *values[sizeof(options) / sizeof(options[0])] = {0};
#else
static const char *values[sizeof(options) / sizeof(options[0])] = {0};
#endif
+#endif
/* user_config_path is freed as soon as it is used */
char *user_config_path = NULL;
diff --git a/src/lxc/start.c b/src/lxc/start.c
index 6779cee..5d2faee 100644
--- a/src/lxc/start.c
+++ b/src/lxc/start.c
@@ -1290,6 +1290,25 @@ static int do_start(void *data)
lxc_sync_fini_parent(handler);
+#ifdef HAVE_ISULAD
+ sigset_t mask;
+
+ /*isulad: restore default signal handlers and unblock all signals*/
+ for (int i = 1; i < NSIG; i++)
+ signal(i, SIG_DFL);
+
+ ret = sigfillset(&mask);
+ if (ret < 0) {
+ SYSERROR("Failed to fill signal mask");
+ goto out_warn_father;
+ }
+ ret = sigprocmask(SIG_UNBLOCK, &mask, NULL);
+ if (ret < 0) {
+ SYSERROR("Failed to set signal mask");
+ goto out_warn_father;
+ }
+#endif
+
if (lxc_abstract_unix_recv_fds(data_sock1, &status_fd, 1, NULL, 0) < 0) {
ERROR("Failed to receive status file descriptor to child process");
goto out_warn_father;
--
1.8.3.1

117
0046-add-support-systemd.patch
View File

@ -1,117 +0,0 @@
From 1922cc534f04a7a006064e7eae2dea44d0000cc3 Mon Sep 17 00:00:00 2001
From: tanyifeng <tanyifeng1@huawei.com>
Date: Sat, 20 Apr 2019 22:40:18 +0800
Subject: [PATCH 46/49] add support systemd
Signed-off-by: zhangsong <zhangsong34@huawei.com>
---
src/lxc/cgroups/cgfsng.c | 15 +++++++++++++++
src/lxc/conf.c | 1 +
src/lxc/confile.c | 30 ++++++++++++++++++++++++++++++
3 files changed, 46 insertions(+)
diff --git a/src/lxc/cgroups/cgfsng.c b/src/lxc/cgroups/cgfsng.c
index 002f051..4abaa86 100644
--- a/src/lxc/cgroups/cgfsng.c
+++ b/src/lxc/cgroups/cgfsng.c
@@ -2096,6 +2096,7 @@ __cgfsng_ops static bool cgfsng_mount(struct cgroup_ops *ops,
{
int i, ret;
char *tmpfspath = NULL;
+ char *systemdpath = NULL;
bool has_cgns = false, retval = false, wants_force_mount = false;
char **merged = NULL;
@@ -2242,10 +2243,24 @@ __cgfsng_ops static bool cgfsng_mount(struct cgroup_ops *ops,
}
}
+ // isulad: remount /sys/fs/cgroup/systemd to readwrite for system container
+ if (handler->conf->systemd != NULL && strcmp(handler->conf->systemd, "true") == 0) {
+ systemdpath = must_make_path(root, "/sys/fs/cgroup/systemd", NULL);
+ ret = mount(systemdpath, systemdpath, "bind",
+ MS_NOSUID|MS_NODEV|MS_NOEXEC|MS_RELATIME|MS_BIND|MS_REMOUNT, NULL);
+ if (ret < 0) {
+ SYSERROR("Failed to remount /sys/fs/cgroup/systemd.");
+ goto on_error;
+ }
+ }
+
retval = true;
on_error:
free(tmpfspath);
+ if (systemdpath != NULL) {
+ free(systemdpath);
+ }
lxc_free_array((void **)merged, free);
return retval;
}
diff --git a/src/lxc/conf.c b/src/lxc/conf.c
index d7a78bd..235965f 100644
--- a/src/lxc/conf.c
+++ b/src/lxc/conf.c
@@ -5283,6 +5283,7 @@ void lxc_conf_free(struct lxc_conf *conf)
if (conf->exit_fd != -1) {
close(conf->exit_fd);
}
+ free(conf->systemd);
lxc_clear_init_args(conf);
lxc_clear_init_groups(conf);
lxc_clear_populate_devices(conf);
diff --git a/src/lxc/confile.c b/src/lxc/confile.c
index 8790494..771f635 100644
--- a/src/lxc/confile.c
+++ b/src/lxc/confile.c
@@ -154,6 +154,7 @@ lxc_config_define(populate_device);
lxc_config_define(umask);
lxc_config_define(rootfs_masked_paths);
lxc_config_define(rootfs_ro_paths);
+lxc_config_define(systemd);
#endif
/*
@@ -274,6 +275,7 @@ static struct lxc_config_t config_jump_table[] = {
{ "lxc.isulad.umask", set_config_umask, get_config_umask, clr_config_umask, },
{ "lxc.isulad.rootfs.maskedpaths", set_config_rootfs_masked_paths, get_config_rootfs_masked_paths, clr_config_rootfs_masked_paths, },
{ "lxc.isulad.rootfs.ropaths", set_config_rootfs_ro_paths, get_config_rootfs_ro_paths, clr_config_rootfs_ro_paths, },
+ { "lxc.isulad.systemd", set_config_systemd, get_config_systemd, clr_config_systemd, },
#endif
};
@@ -6587,4 +6589,32 @@ static inline int clr_config_rootfs_ro_paths(const char *key, struct lxc_conf *c
return lxc_clear_rootfs_ro_paths(c);
}
+/* isulad: set config for systemd */
+static int set_config_systemd(const char *key, const char *value,
+ struct lxc_conf *lxc_conf, void *data)
+{
+ if (lxc_config_value_empty(value)) {
+ ERROR("Empty umask");
+ return -1;
+ }
+ lxc_conf->systemd = strdup(value);
+ return 0;
+}
+
+/* isulad add: get systemd value*/
+static int get_config_systemd(const char *key, char *retv, int inlen,
+ struct lxc_conf *c, void *data)
+{
+ return lxc_get_conf_str(retv, inlen, c->systemd);
+}
+
+/* isulad add: clear systemd value */
+static inline int clr_config_systemd(const char *key, struct lxc_conf *c,
+ void *data)
+{
+ free(c->systemd);
+ c->systemd = NULL;
+ return 0;
+}
+
#endif
--
1.8.3.1

103
0047-support-namespaced-kernel-params-can-be-changed-in-s.patch
View File

@ -1,103 +0,0 @@
From 288b6934f79456f056a2043216bbfdde4342b694 Mon Sep 17 00:00:00 2001
From: liuhao <liuhao27@huawei.com>
Date: Fri, 26 Apr 2019 07:13:53 +0800
Subject: [PATCH 47/49] support namespaced kernel params can be changed in
system container
Signed-off-by: yangchenliang <yangchenliang@huawei.com>
---
src/lxc/conf.c | 71 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
1 file changed, 71 insertions(+)
diff --git a/src/lxc/conf.c b/src/lxc/conf.c
index 235965f..15d8e42 100644
--- a/src/lxc/conf.c
+++ b/src/lxc/conf.c
@@ -1449,6 +1449,68 @@ error:
return false;
}
+#ifdef HAVE_ISULAD
+static bool remount_readwrite(const char *path)
+{
+ int ret, i;
+
+ if (!path)
+ return true;
+
+ for (i = 0; i < 5; i++) {
+ ret = mount("", path, "", MS_REMOUNT, "");
+ if (ret < 0 && errno != ENOENT) {
+ if (errno == EINVAL) {
+ // Probably not a mountpoint, use bind-mount
+ ret = mount(path, path, "", MS_BIND, "");
+ if (ret < 0)
+ goto on_error;
+ ret = mount(path, path, "", MS_BIND | MS_REMOUNT | MS_REC | \
+ MS_NOEXEC | MS_NOSUID | MS_NODEV, "");
+ if (ret < 0)
+ goto on_error;
+ } else if (errno == EBUSY) {
+ DEBUG("Try to mount \"%s\" to readonly after 100ms.", path);
+ usleep(100 * 1000);
+ continue;
+ } else {
+ goto on_error;
+ }
+ }
+ return true;
+ }
+
+on_error:
+ SYSERROR("Unable to mount \"%s\" to readwrite", path);
+ return false;
+}
+
+static int remount_proc_sys_mount_entries(struct lxc_list *mount_list, bool lsm_aa_allow_nesting)
+{
+ char buf[4096];
+ FILE *file;
+ struct mntent mntent;
+
+ file = make_anonymous_mount_file(mount_list, lsm_aa_allow_nesting);
+ if (!file)
+ return -1;
+
+ while (getmntent_r(file, &mntent, buf, sizeof(buf))) {
+ if (strstr(mntent.mnt_dir, "proc/sys") == NULL) {
+ continue;
+ }
+
+ if (!remount_readwrite((const char*)mntent.mnt_dir)) {
+ fclose(file);
+ return -1;
+ }
+ }
+
+ fclose(file);
+ return 0;
+}
+#endif
+
// remount_readonly will bind over the top of an existing path and ensure that it is read-only.
static bool remount_readonly(const char *path)
{
@@ -4773,6 +4835,15 @@ int lxc_setup(struct lxc_handler *handler)
}
}
+ //isulad: system container, remount /proc/sys/xxx by mount_list
+ if (lxc_conf->systemd != NULL && strcmp(lxc_conf->systemd, "true") == 0) {
+ if (!lxc_list_empty(&lxc_conf->mount_list)) {
+ if (remount_proc_sys_mount_entries(&lxc_conf->mount_list, lxc_conf->lsm_aa_allow_nesting)) {
+ return log_error(-1, "failed to remount /proc/sys");
+ }
+ }
+ }
+
// isulad: create link /etc/mtab for /proc/mounts
if (create_mtab_link() != 0) {
return log_error(-1, "failed to create link /etc/mtab for target /proc/mounts");
--
1.8.3.1

52
0048-don-t-use-the-unified-hierarchy-for-the-systemd-cgro.patch
View File

@ -1,52 +0,0 @@
From 4dfcafd037464a64047b70ffea3b91a70514ae92 Mon Sep 17 00:00:00 2001
From: liuhao <liuhao27@huawei.com>
Date: Fri, 10 May 2019 11:05:42 +0800
Subject: [PATCH 48/49] don't use the unified hierarchy for the systemd cgroup
Signed-off-by: zhangsong <zhangsong34@huawei.com>
---
src/lxc/cgroups/cgfsng.c | 14 ++++++++++++++
1 file changed, 14 insertions(+)
diff --git a/src/lxc/cgroups/cgfsng.c b/src/lxc/cgroups/cgfsng.c
index 4abaa86..4a0961f 100644
--- a/src/lxc/cgroups/cgfsng.c
+++ b/src/lxc/cgroups/cgfsng.c
@@ -2097,6 +2097,7 @@ __cgfsng_ops static bool cgfsng_mount(struct cgroup_ops *ops,
int i, ret;
char *tmpfspath = NULL;
char *systemdpath = NULL;
+ char *unifiedpath = NULL;
bool has_cgns = false, retval = false, wants_force_mount = false;
char **merged = NULL;
@@ -2245,6 +2246,16 @@ __cgfsng_ops static bool cgfsng_mount(struct cgroup_ops *ops,
// isulad: remount /sys/fs/cgroup/systemd to readwrite for system container
if (handler->conf->systemd != NULL && strcmp(handler->conf->systemd, "true") == 0) {
+ // isulad: don't use the unified hierarchy for the systemd cgroup
+ unifiedpath = must_make_path(root, "/sys/fs/cgroup/unified", NULL);
+ if (dir_exists(unifiedpath)) {
+ ret = umount2(unifiedpath, MNT_DETACH);
+ if (ret < 0) {
+ SYSERROR("Failed to umount /sys/fs/cgroup/unified.");
+ goto on_error;
+ }
+ }
+
systemdpath = must_make_path(root, "/sys/fs/cgroup/systemd", NULL);
ret = mount(systemdpath, systemdpath, "bind",
MS_NOSUID|MS_NODEV|MS_NOEXEC|MS_RELATIME|MS_BIND|MS_REMOUNT, NULL);
@@ -2261,6 +2272,9 @@ on_error:
if (systemdpath != NULL) {
free(systemdpath);
}
+ if (unifiedpath != NULL) {
+ free(unifiedpath);
+ }
lxc_free_array((void **)merged, free);
return retval;
}
--
1.8.3.1

99
0049-make-dev-bind-mount-from-host-tmpfs-for-system-conta.patch
View File

@ -1,99 +0,0 @@
From e1e3ad7bc7cb1a26cca676ff5e4a5ceaf7eedaee Mon Sep 17 00:00:00 2001
From: tanyifeng <tanyifeng1@huawei.com>
Date: Wed, 15 May 2019 12:42:08 +0800
Subject: [PATCH 49/49] make /dev bind mount from host tmpfs for system
container
Signed-off-by: zhangsong <zhangsong34@huawei.com>
---
src/lxc/conf.c | 33 +++++++++++++++++++++++++++++++--
1 file changed, 31 insertions(+), 2 deletions(-)
diff --git a/src/lxc/conf.c b/src/lxc/conf.c
index 15d8e42..4d8fa2a 100644
--- a/src/lxc/conf.c
+++ b/src/lxc/conf.c
@@ -1074,8 +1074,13 @@ on_error:
/* Just create a path for /dev under $lxcpath/$name and in rootfs If we hit an
* error, log it but don't fail yet.
*/
+#ifdef HAVE_ISULAD
+static int mount_autodev(const char *name, const struct lxc_rootfs *rootfs,
+ int autodevtmpfssize, const char *lxcpath, char *systemd)
+#else
static int mount_autodev(const char *name, const struct lxc_rootfs *rootfs,
int autodevtmpfssize, const char *lxcpath)
+#endif
{
__do_free char *path = NULL;
int ret;
@@ -1088,6 +1093,7 @@ static int mount_autodev(const char *name, const struct lxc_rootfs *rootfs,
/* $(rootfs->mount) + "/dev/pts" + '\0' */
clen = (rootfs->path ? strlen(rootfs->mount) : 0) + 9;
path = must_realloc(NULL, clen);
+
sprintf(mount_options, "size=%d,mode=755", (autodevtmpfssize != 0) ? autodevtmpfssize : 500000);
DEBUG("Using mount options: %s", mount_options);
@@ -1103,6 +1109,23 @@ static int mount_autodev(const char *name, const struct lxc_rootfs *rootfs,
goto reset_umask;
}
+#ifdef HAVE_ISULAD
+ if (systemd != NULL && !strcmp(systemd, "true")) {
+ ret = mount(path, path, "", MS_BIND, NULL);
+ if (ret < 0) {
+ SYSERROR("Failed to bind mount path \"%s\"", path);
+ goto reset_umask;
+ }
+ } else {
+ ret = safe_mount("none", path, "tmpfs", 0, mount_options,
+ rootfs->path ? rootfs->mount : NULL);
+ if (ret < 0) {
+ SYSERROR("Failed to mount tmpfs on \"%s\"", path);
+ goto reset_umask;
+ }
+ TRACE("Mounted tmpfs on \"%s\"", path);
+ }
+#else
ret = safe_mount("none", path, "tmpfs", 0, mount_options,
rootfs->path ? rootfs->mount : NULL );
if (ret < 0) {
@@ -1110,6 +1133,7 @@ static int mount_autodev(const char *name, const struct lxc_rootfs *rootfs,
goto reset_umask;
}
TRACE("Mounted tmpfs on \"%s\"", path);
+#endif
ret = snprintf(path, clen, "%s/dev/pts", rootfs->path ? rootfs->mount : "");
if (ret < 0 || (size_t)ret >= clen) {
@@ -4674,7 +4698,11 @@ int lxc_setup(struct lxc_handler *handler)
}
if (lxc_conf->autodev > 0) {
+#ifdef HAVE_ISULAD
+ ret = mount_autodev(name, &lxc_conf->rootfs, lxc_conf->autodevtmpfssize, lxcpath, lxc_conf->systemd);
+#else
ret = mount_autodev(name, &lxc_conf->rootfs, lxc_conf->autodevtmpfssize, lxcpath);
+#endif
if (ret < 0)
return log_error(-1, "Failed to mount \"/dev\"");
}
@@ -4838,11 +4866,12 @@ int lxc_setup(struct lxc_handler *handler)
//isulad: system container, remount /proc/sys/xxx by mount_list
if (lxc_conf->systemd != NULL && strcmp(lxc_conf->systemd, "true") == 0) {
if (!lxc_list_empty(&lxc_conf->mount_list)) {
- if (remount_proc_sys_mount_entries(&lxc_conf->mount_list, lxc_conf->lsm_aa_allow_nesting)) {
+ if (remount_proc_sys_mount_entries(&lxc_conf->mount_list,
+ lxc_conf->lsm_aa_allow_nesting)) {
return log_error(-1, "failed to remount /proc/sys");
}
}
- }
+ }
// isulad: create link /etc/mtab for /proc/mounts
if (create_mtab_link() != 0) {
--
1.8.3.1

27
0050-clean-add-init-fd-in-lxc_init_clean_handler.patch
View File

@ -1,27 +0,0 @@
From d15c6e2871202d8d8b928a4b4e11537997c24fc1 Mon Sep 17 00:00:00 2001
From: LiFeng <lifeng68@huawei.com>
Date: Thu, 16 Apr 2020 21:39:19 +0800
Subject: [PATCH] clean: add init fd in lxc_init_clean_handler
Signed-off-by: LiFeng <lifeng68@huawei.com>
---
src/lxc/start.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/src/lxc/start.c b/src/lxc/start.c
index 5d2faee..938ca8e 100644
--- a/src/lxc/start.c
+++ b/src/lxc/start.c
@@ -2913,7 +2913,9 @@ static struct lxc_handler *lxc_init_clean_handler(char *name, char *lxcpath, str
handler->lxcpath = lxcpath;
handler->pinfd = -1;
handler->sigfd = -EBADF;
+ handler->pidfd = -EBADF;
handler->init_died = false;
+ handler->monitor_status_fd = -EBADF;
handler->pid = pid;
handler->state_socket_pair[0] = handler->state_socket_pair[1] = -1;
if (handler->conf->reboot == REBOOT_NONE)
--
1.8.3.1

26
0051-init-pids-add-init-fd-in-lxc_init_pids_handler.patch
View File

@ -1,26 +0,0 @@
From 3931e7ef88aa2a8a67ca967ad1fe359df736ac86 Mon Sep 17 00:00:00 2001
From: LiFeng <lifeng68@huawei.com>
Date: Thu, 16 Apr 2020 22:15:30 +0800
Subject: [PATCH] init pids: add init fd in lxc_init_pids_handler
Signed-off-by: LiFeng <lifeng68@huawei.com>
---
src/lxc/start.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/src/lxc/start.c b/src/lxc/start.c
index 938ca8e..e099285 100644
--- a/src/lxc/start.c
+++ b/src/lxc/start.c
@@ -2967,6 +2967,8 @@ static struct lxc_handler *lxc_init_pids_handler(char *name, char *lxcpath, stru
handler->sigfd = -EBADF;
handler->init_died = false;
handler->state_socket_pair[0] = handler->state_socket_pair[1] = -1;
+ handler->monitor_status_fd = -EBADF;
+ handler->pidfd = -EBADF;
if (handler->conf->reboot == REBOOT_NONE)
lxc_list_init(&handler->conf->state_clients);
--
1.8.3.1

132
0052-setupdev-add-judge-whether-have-mount-dev-entry.patch
View File

@ -1,132 +0,0 @@
From 68d3c92b40e049a257bf86dbb29fb274a5f1125e Mon Sep 17 00:00:00 2001
From: LiFeng <lifeng68@huawei.com>
Date: Sat, 18 Apr 2020 18:13:16 +0800
Subject: [PATCH] setupdev: add judge whether have mount /dev entry
reason: If user specify the Destination "/dev".
1.Should not populate devices
2.Should not setup devpts
Signed-off-by: LiFeng <lifeng68@huawei.com>
---
src/lxc/conf.c | 62 +++++++++++++++++++++++++++++++++++++++++++++++++++++++---
1 file changed, 59 insertions(+), 3 deletions(-)
diff --git a/src/lxc/conf.c b/src/lxc/conf.c
index 4d8fa2a..e8568d8 100644
--- a/src/lxc/conf.c
+++ b/src/lxc/conf.c
@@ -1942,6 +1942,9 @@ static int lxc_setup_dev_console(const struct lxc_rootfs *rootfs,
if (ret < 0 && errno != EEXIST)
return log_error_errno(-errno, errno, "Failed to create console");
+#ifdef HAVE_ISULAD
+ if (console->slave > 0) {
+#endif
ret = fchmod(console->slave, S_IXUSR | S_IXGRP);
if (ret < 0)
return log_error_errno(-errno, errno, "Failed to set mode \"0%o\" to \"%s\"", S_IXUSR | S_IXGRP, console->name);
@@ -1949,7 +1952,9 @@ static int lxc_setup_dev_console(const struct lxc_rootfs *rootfs,
ret = safe_mount(console->name, path, "none", MS_BIND, 0, rootfs_path);
if (ret < 0)
return log_error_errno(-1, errno, "Failed to mount \"%s\" on \"%s\"", console->name, path);
-
+#ifdef HAVE_ISULAD
+ }
+#endif
DEBUG("Mounted pts device \"%s\" onto \"%s\"", console->name, path);
return 0;
}
@@ -2913,6 +2918,51 @@ static int setup_mount_entries(const struct lxc_conf *conf,
return mount_file_entries(conf, rootfs, f, lxc_name, lxc_path);
}
+#ifdef HAVE_ISULAD
+static bool have_dev_bind_mount_entry(FILE *file)
+{
+ bool have_bind_dev = false;
+ char buf[PATH_MAX];
+ struct mntent mntent;
+
+ while (getmntent_r(file, &mntent, buf, sizeof(buf))) {
+ mntent.mnt_dir = lxc_string_replace(SPACE_MAGIC_STR, " ", mntent.mnt_dir);
+ if(!mntent.mnt_dir) {
+ SYSERROR("memory allocation error");
+ continue;
+ }
+
+ if (strcmp(mntent.mnt_dir, "dev") == 0 && strcmp(mntent.mnt_type, "bind") == 0) {
+ have_bind_dev = true;
+ }
+
+ free(mntent.mnt_dir);
+ mntent.mnt_dir = NULL;
+
+ if (have_bind_dev)
+ return true;
+ }
+
+ return false;
+}
+
+// returns true if /dev needs to be set up.
+static bool need_setup_dev(const struct lxc_conf *conf, struct lxc_list *mount)
+{
+ __do_fclose FILE *f = NULL;
+
+ f = make_anonymous_mount_file(mount, conf->lsm_aa_allow_nesting);
+ if (!f)
+ return true;
+
+ if (have_dev_bind_mount_entry(f)) {
+ return false;
+ } else {
+ return true;
+ }
+}
+#endif
+
static int parse_cap(const char *cap)
{
size_t i;
@@ -4655,6 +4705,9 @@ int lxc_setup(struct lxc_handler *handler)
const char *lxcpath = handler->lxcpath, *name = handler->name;
struct lxc_conf *lxc_conf = handler->conf;
char *keyring_context = NULL;
+#ifdef HAVE_ISULAD
+ bool setup_dev = true;
+#endif
ret = lxc_setup_rootfs_prepare_root(lxc_conf, name, lxcpath);
#ifdef HAVE_ISULAD
@@ -4723,6 +4776,9 @@ int lxc_setup(struct lxc_handler *handler)
&lxc_conf->mount_list, name, lxcpath);
if (ret < 0)
return log_error(-1, "Failed to setup mount entries");
+#ifdef HAVE_ISULAD
+ setup_dev = need_setup_dev(lxc_conf, &lxc_conf->mount_list);
+#endif
}
if (lxc_conf->is_execute) {
@@ -4771,7 +4827,7 @@ int lxc_setup(struct lxc_handler *handler)
#ifdef HAVE_ISULAD
/* isulad: setup devices which will be populated in the container. */
- if (!lxc_list_empty(&lxc_conf->populate_devs)) {
+ if (!lxc_list_empty(&lxc_conf->populate_devs) && setup_dev) {
if (setup_populate_devs(&lxc_conf->rootfs, &lxc_conf->populate_devs) != 0) {
return log_error(-1, "Failed to setup devices in the container");
}
@@ -4813,7 +4869,7 @@ int lxc_setup(struct lxc_handler *handler)
if (setup_rootfs_mountopts(&lxc_conf->rootfs)) {
return log_error(-1, "failed to set rootfs for '%s'", name);
}
- if (lxc_conf->rootfs.path) {
+ if (lxc_conf->rootfs.path != NULL && setup_dev) {
ret = lxc_setup_devpts(lxc_conf);
if (ret < 0) {
return log_error(-1, "Failed to setup new devpts instance for '%s'", name);
--
1.8.3.1

288
0053-attach-seprate-i-and-t-flags.patch
View File

@ -1,288 +0,0 @@
From 36f64e652afc7fe3feac6d93468cbc4f3d53ec9a Mon Sep 17 00:00:00 2001
From: LiFeng <lifeng68@huawei.com>
Date: Tue, 21 Apr 2020 15:36:55 +0800
Subject: [PATCH] attach: seprate -i and -t flags
Signed-off-by: LiFeng <lifeng68@huawei.com>
---
src/lxc/attach.c | 100 ++++++++++++++++++++++++++++++++++++++++++++-
src/lxc/attach_options.h | 2 +
src/lxc/start.c | 1 +
src/lxc/terminal.c | 14 ++++---
src/lxc/tools/lxc_attach.c | 17 +++++++-
5 files changed, 125 insertions(+), 9 deletions(-)
diff --git a/src/lxc/attach.c b/src/lxc/attach.c
index 1dd2b47..5539fb1 100644
--- a/src/lxc/attach.c
+++ b/src/lxc/attach.c
@@ -653,6 +653,9 @@ struct attach_clone_payload {
struct lxc_proc_context_info *init_ctx;
lxc_attach_exec_t exec_function;
void *exec_payload;
+#ifdef HAVE_ISULAD
+ struct lxc_terminal *terminal;
+#endif
};
static void lxc_put_attach_clone_payload(struct attach_clone_payload *p)
@@ -665,6 +668,49 @@ static void lxc_put_attach_clone_payload(struct attach_clone_payload *p)
}
}
+#ifdef HAVE_ISULAD
+static int isulad_set_attach_pipes(struct lxc_terminal *terminal)
+{
+ int ret = 0;
+ if (terminal->pipes[0][1] >= 0) {
+ close(terminal->pipes[0][1]);
+ terminal->pipes[0][1] = -1;
+ }
+
+ if (terminal->pipes[0][0] >= 0) {
+ ret = dup2(terminal->pipes[0][0], STDIN_FILENO);
+ if (ret < 0)
+ goto out;
+ }
+
+ if (terminal->pipes[1][0] >= 0) {
+ close(terminal->pipes[1][0]);
+ terminal->pipes[1][0] = -1;
+ }
+
+ if (terminal->pipes[1][1] >= 0) {
+ ret = dup2(terminal->pipes[1][1], STDOUT_FILENO);
+ if (ret < 0)
+ goto out;
+ }
+ if (terminal->pipes[2][0] >= 0) {
+ close(terminal->pipes[2][0]);
+ terminal->pipes[2][0] = -1;
+ }
+
+ if (terminal->pipes[2][1] >= 0) {
+ ret = dup2(terminal->pipes[2][1], STDERR_FILENO);
+ if (ret < 0)
+ goto out;
+ }
+
+ setsid();
+out:
+ return ret;
+}
+
+#endif
+
static int attach_child_main(struct attach_clone_payload *payload)
{
int lsm_fd, ret;
@@ -933,6 +979,25 @@ static int attach_child_main(struct attach_clone_payload *payload)
}
if (options->attach_flags & LXC_ATTACH_TERMINAL) {
+
+#ifdef HAVE_ISULAD
+ /* isulad: dup2 pipe[0][0] to container stdin, pipe[1][1] to container stdout, pipe[2][1] to container stderr */
+ if (payload->terminal->disable_pty) {
+ ret = isulad_set_attach_pipes(payload->terminal);
+ if (ret < 0) {
+ SYSERROR("Failed to prepare terminal file pipes");
+ goto on_error;
+ }
+ }
+
+ if(!payload->terminal->disable_pty && payload->terminal_slave_fd >= 0) {
+ ret = lxc_terminal_prepare_login(payload->terminal_slave_fd);
+ if (ret < 0) {
+ SYSERROR("Failed to prepare terminal file descriptor %d", payload->terminal_slave_fd);
+ goto on_error;
+ }
+ }
+#else
ret = lxc_terminal_prepare_login(payload->terminal_slave_fd);
if (ret < 0) {
SYSERROR("Failed to prepare terminal file descriptor %d", payload->terminal_slave_fd);
@@ -940,6 +1005,7 @@ static int attach_child_main(struct attach_clone_payload *payload)
}
TRACE("Prepared terminal file descriptor %d", payload->terminal_slave_fd);
+#endif
}
/* Avoid unnecessary syscalls. */
@@ -1016,6 +1082,9 @@ static int lxc_attach_terminal(struct lxc_conf *conf,
free(terminal->init_fifo[2]);
terminal->init_fifo[2] = safe_strdup(options->init_fifo[2]);
}
+
+ terminal->disable_pty = options->disable_pty;
+ terminal->open_stdin = options->open_stdin;
#endif
ret = lxc_terminal_create(terminal);
@@ -1410,6 +1479,21 @@ int lxc_attach(struct lxc_container *container, lxc_attach_exec_t exec_function,
/* isulad: close errpipe */
close(conf->errpipe[1]);
conf->errpipe[1] = -1;
+ /* isulad: close pipe after clone */
+ if (terminal.pipes[0][0] >= 0) {
+ close(terminal.pipes[0][0]);
+ terminal.pipes[0][0] = -1;
+ }
+
+ if (terminal.pipes[1][1] >= 0) {
+ close(terminal.pipes[1][1]);
+ terminal.pipes[1][1] = -1;
+ }
+
+ if (terminal.pipes[2][1] >= 0) {
+ close(terminal.pipes[2][1]);
+ terminal.pipes[2][1] = -1;
+ }
#endif
lxc_proc_close_ns_fd(init_ctx);
if (options->attach_flags & LXC_ATTACH_TERMINAL)
@@ -1568,6 +1652,15 @@ int lxc_attach(struct lxc_container *container, lxc_attach_exec_t exec_function,
ret_parent = 0;
to_cleanup_pid = -1;
+ #ifdef HAVE_ISULAD
+ // iSulad: close stdin pipe if we do not want open_stdin with container stdin
+ if (!terminal.open_stdin) {
+ if (terminal.pipes[0][1] > 0) {
+ close(terminal.pipes[0][1]);
+ terminal.pipes[0][1] = -1;
+ }
+ }
+ #endif
if (options->attach_flags & LXC_ATTACH_TERMINAL) {
ret = lxc_mainloop(&descr, -1);
if (ret < 0) {
@@ -1671,6 +1764,9 @@ int lxc_attach(struct lxc_container *container, lxc_attach_exec_t exec_function,
payload.terminal_slave_fd = terminal.slave;
payload.exec_function = exec_function;
payload.exec_payload = exec_payload;
+#ifdef HAVE_ISULAD
+ payload.terminal = &terminal;
+#endif
pid = lxc_raw_clone(CLONE_PARENT, NULL);
if (pid < 0) {
@@ -1697,9 +1793,9 @@ int lxc_attach(struct lxc_container *container, lxc_attach_exec_t exec_function,
_exit(EXIT_FAILURE);
}
- if (options->attach_flags & LXC_ATTACH_TERMINAL)
+ if (options->attach_flags & LXC_ATTACH_TERMINAL) {
lxc_attach_terminal_close_slave(&terminal);
-
+ }
/* Tell grandparent the pid of the pid of the newly created child. */
ret = lxc_write_nointr(ipc_sockets[1], &pid, sizeof(pid));
if (ret != sizeof(pid)) {
diff --git a/src/lxc/attach_options.h b/src/lxc/attach_options.h
index d5d4f44..5767560 100644
--- a/src/lxc/attach_options.h
+++ b/src/lxc/attach_options.h
@@ -121,6 +121,8 @@ typedef struct lxc_attach_options_t {
char *init_fifo[3]; /* isulad: default fifos for the start */
int64_t timeout;/* isulad: Seconds for waiting on a container to attach/exec before it is killed*/
const char *suffix;
+ bool disable_pty;
+ bool open_stdin;
} lxc_attach_options_t;
/*! Default attach options to use */
diff --git a/src/lxc/start.c b/src/lxc/start.c
index e099285..68a6116 100644
--- a/src/lxc/start.c
+++ b/src/lxc/start.c
@@ -1789,6 +1789,7 @@ static int do_start(void *data)
* as it execs.
*/
#ifdef HAVE_ISULAD
+ close_prot_errno_disarm(status_fd);
handler->ops->start(handler, handler->data, handler->daemonize ? handler->conf->errpipe[1] : -1);
#else
handler->ops->start(handler, handler->data);
diff --git a/src/lxc/terminal.c b/src/lxc/terminal.c
index c0a4d1a..57def93 100644
--- a/src/lxc/terminal.c
+++ b/src/lxc/terminal.c
@@ -750,21 +750,23 @@ int lxc_terminal_io_cb(int fd, uint32_t events, void *data,
return LXC_MAINLOOP_CONTINUE;
} else if (fd == terminal->pipes[1][0] || fd == terminal->pipes[2][0]) {
if (fd == terminal->pipes[1][0]) {
- w_log = isulad_lxc_terminal_write_log_file(terminal, "stdout", NULL, 0);
+ if (terminal->log_fd >= 0) {
+ w_log = isulad_lxc_terminal_write_log_file(terminal, "stdout", NULL, 0);
+ }
terminal->pipes[1][0] = -EBADF;
} else if (fd == terminal->pipes[2][0]) {
- w_log = isulad_lxc_terminal_write_log_file(terminal, "stderr", NULL, 0);
+ if (terminal->log_fd >= 0) {
+ w_log = isulad_lxc_terminal_write_log_file(terminal, "stderr", NULL, 0);
+ }
terminal->pipes[2][0] = -EBADF;
}
- if (w_log < 0)
- TRACE("Failed to write %d bytes to terminal log", r);
close(fd);
- return LXC_MAINLOOP_CONTINUE;
+ return LXC_MAINLOOP_CLOSE;
} else if (fd == terminal->pipes[0][1]) {
TRACE("closed stdin pipe of container stdin");
terminal->pipes[0][1] = -EBADF;
close(fd);
- return LXC_MAINLOOP_CONTINUE;
+ return LXC_MAINLOOP_CLOSE;
} else {
ERROR("Handler received unexpected file descriptor");
}
diff --git a/src/lxc/tools/lxc_attach.c b/src/lxc/tools/lxc_attach.c
index a855a8d..da7a7d2 100644
--- a/src/lxc/tools/lxc_attach.c
+++ b/src/lxc/tools/lxc_attach.c
@@ -82,6 +82,8 @@ static const struct option my_longopts[] = {
{"err-fifo", required_argument, 0, OPT_STDERR_FIFO},
{"suffix", required_argument, 0, OPT_ATTACH_SUFFIX},
{"timeout", required_argument, 0, OPT_ATTACH_TIMEOUT},
+ {"disable-pty", no_argument, 0, OPT_DISABLE_PTY},
+ {"open-stdin", no_argument, 0, OPT_OPEN_STDIN},
#endif
LXC_COMMON_OPTIONS
};
@@ -312,9 +314,14 @@ static int my_parser(struct lxc_arguments *args, int c, char *arg)
}
args->attach_timeout = (unsigned int)atoll(arg);
break;
+ case OPT_DISABLE_PTY:
+ args->disable_pty = 1;
+ break;
+ case OPT_OPEN_STDIN:
+ args->open_stdin = 1;
+ break;
#endif
}
-
return 0;
}
@@ -614,6 +621,14 @@ int main(int argc, char *argv[])
attach_options.suffix = my_args.suffix;
+ if (my_args.disable_pty) {
+ attach_options.disable_pty = true;
+ }
+
+ if (my_args.open_stdin) {
+ attach_options.open_stdin = true;
+ }
+
/* isulad: add do attach background */
if (attach_options.attach_flags & LXC_ATTACH_TERMINAL)
wexit = do_attach_foreground(c, &command, &attach_options, &errmsg);
--
1.8.3.1

31
0054-start-do-not-check-pid-die-when-lxc_poll-exit.patch
View File

@ -1,31 +0,0 @@
From d5558ec70cbc4949d0a411ec32278201fdc189db Mon Sep 17 00:00:00 2001
From: LiFeng <lifeng68@huawei.com>
Date: Wed, 22 Apr 2020 11:14:22 +0800
Subject: [PATCH] start: do not check pid die when lxc_poll exit
Signed-off-by: LiFeng <lifeng68@huawei.com>
---
src/lxc/start.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/src/lxc/start.c b/src/lxc/start.c
index 68a6116..51d1325 100644
--- a/src/lxc/start.c
+++ b/src/lxc/start.c
@@ -2595,11 +2595,13 @@ int __lxc_start(struct lxc_handler *handler, struct lxc_operations *ops,
goto out_delete_network;
}
+#ifndef HAVE_ISULAD
if (!handler->init_died && handler->pid > 0) {
ERROR("Child process is not killed");
ret = -1;
goto out_delete_network;
}
+#endif
status = lxc_wait_for_pid_status(handler->pid);
if (status < 0)
--
1.8.3.1

64
0055-terminal-not-close-pipe-when-lxc_poll-exit.patch
View File

@ -1,64 +0,0 @@
From d0e0cc557dba264c4228e29edb178d57b25af2f5 Mon Sep 17 00:00:00 2001
From: LiFeng <lifeng68@huawei.com>
Date: Wed, 22 Apr 2020 20:54:19 +0800
Subject: [PATCH] terminal: not close pipe when lxc_poll exit
Signed-off-by: LiFeng <lifeng68@huawei.com>
---
src/lxc/attach.c | 4 +++-
src/lxc/terminal.c | 5 +++--
src/lxc/tools/lxc_attach.c | 3 +++
3 files changed, 9 insertions(+), 3 deletions(-)
diff --git a/src/lxc/attach.c b/src/lxc/attach.c
index 5539fb1..51f5c08 100644
--- a/src/lxc/attach.c
+++ b/src/lxc/attach.c
@@ -1542,7 +1542,9 @@ int lxc_attach(struct lxc_container *container, lxc_attach_exec_t exec_function,
if (ret < 0)
goto on_error;
#ifdef HAVE_ISULAD
- (void)lxc_exec_cmd_mainloop_add(&descr, &exec_command);
+ if (suffix != NULL) {
+ (void)lxc_exec_cmd_mainloop_add(&descr, &exec_command);
+ }
#endif
TRACE("Initialized terminal mainloop");
}
diff --git a/src/lxc/terminal.c b/src/lxc/terminal.c
index 57def93..0197503 100644
--- a/src/lxc/terminal.c
+++ b/src/lxc/terminal.c
@@ -760,12 +760,13 @@ int lxc_terminal_io_cb(int fd, uint32_t events, void *data,
}
terminal->pipes[2][0] = -EBADF;
}
- close(fd);
+ /* notes: do not close the master fd due to if we close the fd, the process may
+ * recive SIGHUP and the exit code will be 141 (128 + 13)
+ */
return LXC_MAINLOOP_CLOSE;
} else if (fd == terminal->pipes[0][1]) {
TRACE("closed stdin pipe of container stdin");
terminal->pipes[0][1] = -EBADF;
- close(fd);
return LXC_MAINLOOP_CLOSE;
} else {
ERROR("Handler received unexpected file descriptor");
diff --git a/src/lxc/tools/lxc_attach.c b/src/lxc/tools/lxc_attach.c
index da7a7d2..190f3c8 100644
--- a/src/lxc/tools/lxc_attach.c
+++ b/src/lxc/tools/lxc_attach.c
@@ -417,6 +417,9 @@ static int do_attach_foreground(struct lxc_container *c, lxc_attach_command_t *c
signal = WTERMSIG(ret);
wexit = EXIT_SIGNAL_OFFSET + signal;
}
+
+ ERROR("Execd pid %d exit with %d", pid, wexit);
+
out:
if (c->lxc_conf->errmsg)
*errmsg = safe_strdup(c->lxc_conf->errmsg);
--
1.8.3.1

178
0056-attach-add-sigfd-to-monitor-the-exit-of-pid.patch
View File

@ -1,178 +0,0 @@
From cb3a7926948c4d9668d54521cb7907436723b67a Mon Sep 17 00:00:00 2001
From: LiFeng <lifeng68@huawei.com>
Date: Wed, 22 Apr 2020 23:30:23 +0800
Subject: [PATCH] attach: add sigfd to monitor the exit of pid
Signed-off-by: LiFeng <lifeng68@huawei.com>
---
src/lxc/attach.c | 86 +++++++++++++++++++++++++++++++++++++++++++++++++++++-
src/lxc/terminal.c | 4 +--
2 files changed, 87 insertions(+), 3 deletions(-)
diff --git a/src/lxc/attach.c b/src/lxc/attach.c
index 51f5c08..b25222e 100644
--- a/src/lxc/attach.c
+++ b/src/lxc/attach.c
@@ -1197,6 +1197,56 @@ static int create_attach_timeout_thread(int64_t attach_timeout, pid_t pid)
out:
return ret;
}
+
+static int attach_signal_handler(int fd, uint32_t events, void *data,
+ struct lxc_epoll_descr *descr)
+{
+ int ret;
+ siginfo_t info;
+ pid_t *pid = data;
+
+ /* Check whether init is running. */
+ info.si_pid = 0;
+ ret = waitid(P_PID, *pid, &info, WEXITED | WNOWAIT | WNOHANG);
+ if (ret == 0 && info.si_pid == *pid) {
+ return log_error(LXC_MAINLOOP_CLOSE, "Container attach init process %d exited", *pid);
+ }
+
+ return LXC_MAINLOOP_CONTINUE;
+}
+
+static int isulad_setup_signal_fd(sigset_t *oldmask)
+{
+ int ret;
+ sigset_t mask;
+ const int signals[] = {SIGBUS, SIGILL, SIGSEGV, SIGWINCH};
+
+ /* Block everything except serious error signals. */
+ ret = sigfillset(&mask);
+ if (ret < 0)
+ return -EBADF;
+
+ for (int sig = 0; sig < (sizeof(signals) / sizeof(signals[0])); sig++) {
+ ret = sigdelset(&mask, signals[sig]);
+ if (ret < 0)
+ return -EBADF;
+ }
+
+ ret = pthread_sigmask(SIG_BLOCK, &mask, oldmask);
+ if (ret < 0)
+ return log_error_errno(-EBADF, errno,
+ "Failed to set signal mask");
+
+ ret = signalfd(-1, &mask, SFD_CLOEXEC);
+ if (ret < 0)
+ return log_error_errno(-EBADF,
+ errno, "Failed to create signal file descriptor");
+
+ TRACE("Created signal file descriptor %d", ret);
+
+ return ret;
+}
+
int lxc_attach(struct lxc_container *container, lxc_attach_exec_t exec_function,
void *exec_payload, lxc_attach_options_t *options,
pid_t *attached_process, char **err_msg)
@@ -1471,6 +1521,11 @@ int lxc_attach(struct lxc_container *container, lxc_attach_exec_t exec_function,
int ret_parent = -1;
pid_t to_cleanup_pid = pid;
struct lxc_epoll_descr descr = {0};
+#ifdef HAVE_ISULAD
+ int isulad_sigfd;
+ sigset_t isulad_oldmask;
+ struct lxc_epoll_descr isulad_descr = {0};
+#endif
/* close unneeded file descriptors */
close(ipc_sockets[1]);
@@ -1541,7 +1596,12 @@ int lxc_attach(struct lxc_container *container, lxc_attach_exec_t exec_function,
ret = lxc_attach_terminal_mainloop_init(&terminal, &descr);
if (ret < 0)
goto on_error;
+
#ifdef HAVE_ISULAD
+ ret = lxc_attach_terminal_mainloop_init(&terminal, &isulad_descr);
+ if (ret < 0)
+ goto on_error;
+
if (suffix != NULL) {
(void)lxc_exec_cmd_mainloop_add(&descr, &exec_command);
}
@@ -1549,6 +1609,16 @@ int lxc_attach(struct lxc_container *container, lxc_attach_exec_t exec_function,
TRACE("Initialized terminal mainloop");
}
+#ifdef HAVE_ISULAD
+ /* The signal fd has to be created before forking otherwise if the child
+ * process exits before we setup the signal fd, the event will be lost
+ * and the command will be stuck.
+ */
+ isulad_sigfd = isulad_setup_signal_fd(&isulad_oldmask);
+ if (isulad_sigfd < 0)
+ goto close_mainloop;
+#endif
+
/* Let the child process know to go ahead. */
status = 0;
ret = lxc_write_nointr(ipc_sockets[0], &status, sizeof(status));
@@ -1637,6 +1707,7 @@ int lxc_attach(struct lxc_container *container, lxc_attach_exec_t exec_function,
/* isulad: read error msg from pipe */
ssize_t size_read;
char errbuf[BUFSIZ + 1] = {0};
+ pid_t tmp_pid = *attached_process;
size_read = read(conf->errpipe[0], errbuf, BUFSIZ);
if (size_read > 0) {
@@ -1644,6 +1715,13 @@ int lxc_attach(struct lxc_container *container, lxc_attach_exec_t exec_function,
*err_msg = safe_strdup(errbuf);
goto close_mainloop;
}
+ if (options->attach_flags & LXC_ATTACH_TERMINAL) {
+ ret = lxc_mainloop_add_handler(&descr, isulad_sigfd, attach_signal_handler, &tmp_pid);
+ if (ret < 0) {
+ ERROR("Failed to add signal handler for %d to mainloop", tmp_pid);
+ goto close_mainloop;
+ }
+ }
#endif
/* Now shut down communication with child, we're done. */
@@ -1672,13 +1750,19 @@ int lxc_attach(struct lxc_container *container, lxc_attach_exec_t exec_function,
}
#ifdef HAVE_ISULAD
+ // do lxc_mainloop to make sure we do not lose any output
+ (void)lxc_mainloop(&isulad_descr, 100);
if (g_attach_timeout_state == ATTACH_TIMEOUT && err_msg != NULL && *err_msg == NULL) {
*err_msg = safe_strdup("Attach exceeded timeout");
}
#endif
close_mainloop:
- if (options->attach_flags & LXC_ATTACH_TERMINAL)
+ if (options->attach_flags & LXC_ATTACH_TERMINAL) {
+#ifdef HAVE_ISULAD
+ lxc_mainloop_close(&isulad_descr);
+#endif
lxc_mainloop_close(&descr);
+ }
on_error:
if (ipc_sockets[0] >= 0) {
diff --git a/src/lxc/terminal.c b/src/lxc/terminal.c
index 0197503..e696b4e 100644
--- a/src/lxc/terminal.c
+++ b/src/lxc/terminal.c
@@ -763,11 +763,11 @@ int lxc_terminal_io_cb(int fd, uint32_t events, void *data,
/* notes: do not close the master fd due to if we close the fd, the process may
* recive SIGHUP and the exit code will be 141 (128 + 13)
*/
- return LXC_MAINLOOP_CLOSE;
+ return LXC_MAINLOOP_CONTINUE;
} else if (fd == terminal->pipes[0][1]) {
TRACE("closed stdin pipe of container stdin");
terminal->pipes[0][1] = -EBADF;
- return LXC_MAINLOOP_CLOSE;
+ return LXC_MAINLOOP_CONTINUE;
} else {
ERROR("Handler received unexpected file descriptor");
}
--
1.8.3.1

34
0057-attach-add-read-data-from-attach-sigfd.patch
View File

@ -1,34 +0,0 @@
From a2097f947d40ff2da0b6ab47dbbc90a349ed33b9 Mon Sep 17 00:00:00 2001
From: LiFeng <lifeng68@huawei.com>
Date: Thu, 23 Apr 2020 11:05:37 +0800
Subject: [PATCH] attach: add read data from attach sigfd
Signed-off-by: LiFeng <lifeng68@huawei.com>
---
src/lxc/attach.c | 8 ++++++++
1 file changed, 8 insertions(+)
diff --git a/src/lxc/attach.c b/src/lxc/attach.c
index b25222e..068cc5f 100644
--- a/src/lxc/attach.c
+++ b/src/lxc/attach.c
@@ -1203,8 +1203,16 @@ static int attach_signal_handler(int fd, uint32_t events, void *data,
{
int ret;
siginfo_t info;
+ struct signalfd_siginfo siginfo;
pid_t *pid = data;
+ ret = lxc_read_nointr(fd, &siginfo, sizeof(siginfo));
+ if (ret < 0)
+ return log_error(LXC_MAINLOOP_ERROR, "Failed to read signal info from signal file descriptor %d", fd);
+
+ if (ret != sizeof(siginfo))
+ return log_error(LXC_MAINLOOP_ERROR, "Unexpected size for struct signalfd_siginfo");
+
/* Check whether init is running. */
info.si_pid = 0;
ret = waitid(P_PID, *pid, &info, WEXITED | WNOWAIT | WNOHANG);
--
1.8.3.1

251
0058-support-syslog-for-console.patch
View File

@ -1,251 +0,0 @@
From da93b4863324d200ffc69eb7eb87b686b47cc2ce Mon Sep 17 00:00:00 2001
From: haozi007 <liuhao27@huawei.com>
Date: Thu, 23 Apr 2020 19:46:22 +0800
Subject: [PATCH] support syslog for console
Signed-off-by: haozi007 <liuhao27@huawei.com>
---
src/lxc/confile.c | 109 +++++++++++++++++++++++++++++++++++++++++++++
src/lxc/terminal.c | 44 +++++++++++++++++-
src/lxc/terminal.h | 10 +++++
3 files changed, 162 insertions(+), 1 deletion(-)
diff --git a/src/lxc/confile.c b/src/lxc/confile.c
index 771f6355..b1d101a9 100644
--- a/src/lxc/confile.c
+++ b/src/lxc/confile.c
@@ -155,6 +155,9 @@ lxc_config_define(umask);
lxc_config_define(rootfs_masked_paths);
lxc_config_define(rootfs_ro_paths);
lxc_config_define(systemd);
+lxc_config_define(console_log_driver);
+lxc_config_define(console_syslog_tag);
+lxc_config_define(console_syslog_facility);
#endif
/*
@@ -276,6 +279,9 @@ static struct lxc_config_t config_jump_table[] = {
{ "lxc.isulad.rootfs.maskedpaths", set_config_rootfs_masked_paths, get_config_rootfs_masked_paths, clr_config_rootfs_masked_paths, },
{ "lxc.isulad.rootfs.ropaths", set_config_rootfs_ro_paths, get_config_rootfs_ro_paths, clr_config_rootfs_ro_paths, },
{ "lxc.isulad.systemd", set_config_systemd, get_config_systemd, clr_config_systemd, },
+ { "lxc.console.logdriver", set_config_console_log_driver, get_config_console_log_driver, clr_config_console_log_driver, },
+ { "lxc.console.syslog_tag", set_config_console_syslog_tag, get_config_console_syslog_tag, clr_config_console_syslog_tag, },
+ { "lxc.console.syslog_facility", set_config_console_syslog_facility, get_config_console_syslog_facility, clr_config_console_syslog_facility, },
#endif
};
@@ -6617,4 +6623,107 @@ static inline int clr_config_systemd(const char *key, struct lxc_conf *c,
return 0;
}
+static int set_config_console_log_driver(const char *key, const char *value,
+ struct lxc_conf *lxc_conf, void *data)
+{
+ return set_config_string_item(&lxc_conf->console.log_driver, value);
+}
+
+static int set_config_console_syslog_tag(const char *key, const char *value,
+ struct lxc_conf *lxc_conf, void *data)
+{
+ char buf[16] = { 0 };
+
+ if (value == NULL) {
+ return -1;
+ }
+ (void)strlcpy(buf, value, 16);
+ return set_config_string_item(&lxc_conf->console.log_syslog_tag, buf);
+}
+
+static int parse_facility(const char *facility)
+{
+#define FACILITIES_LEN 20
+ const char *facility_keys[FACILITIES_LEN] = {
+ "kern", "user", "mail", "daemon", "auth",
+ "syslog", "lpr", "news", "uucp", "cron", "authpriv", "ftp",
+ "local0", "local1", "local2", "local3", "local4", "local5", "local6", "local7"
+ };
+ const int facilities[FACILITIES_LEN] = {
+ LOG_KERN, LOG_USER, LOG_MAIL, LOG_DAEMON, LOG_AUTH, LOG_SYSLOG,
+ LOG_LPR, LOG_NEWS, LOG_UUCP, LOG_CRON, LOG_AUTHPRIV, LOG_FTP,
+ LOG_LOCAL0, LOG_LOCAL1, LOG_LOCAL2, LOG_LOCAL3, LOG_LOCAL4,
+ LOG_LOCAL5, LOG_LOCAL6, LOG_LOCAL7
+ };
+ int i = 0;
+
+ if (facility == NULL) {
+ return -1;
+ }
+
+ for (; i < FACILITIES_LEN; i++) {
+ if (strcmp(facility, facility_keys[i]) == 0) {
+ return facilities[i];
+ }
+ }
+
+ return -1;
+}
+
+static int set_config_console_syslog_facility(const char *key, const char *value,
+ struct lxc_conf *lxc_conf, void *data)
+{
+ int facility;
+
+ facility = parse_facility(value);
+ if (facility < 0) {
+ NOTICE("Invalid facility: %s", value);
+ facility = LOG_DAEMON;
+ }
+
+ lxc_conf->console.log_syslog_facility = facility;
+ return 0;
+}
+
+static int get_config_console_log_driver(const char *key, char *retv, int inlen,
+ struct lxc_conf *c, void *data)
+{
+ return lxc_get_conf_str(retv, inlen, c->console.log_driver);
+}
+
+static int get_config_console_syslog_tag(const char *key, char *retv, int inlen,
+ struct lxc_conf *c, void *data)
+{
+ return lxc_get_conf_str(retv, inlen, c->console.log_syslog_tag);
+}
+
+static int get_config_console_syslog_facility(const char *key, char *retv, int inlen,
+ struct lxc_conf *c, void *data)
+{
+ return lxc_get_conf_int(c, retv, inlen, c->console.log_syslog_facility);
+}
+
+static inline int clr_config_console_log_driver(const char *key,
+ struct lxc_conf *c, void *data)
+{
+ free(c->console.log_driver);
+ c->console.log_driver = NULL;
+ return 0;
+}
+
+static inline int clr_config_console_syslog_tag(const char *key,
+ struct lxc_conf *c, void *data)
+{
+ free(c->console.log_syslog_tag);
+ c->console.log_syslog_tag= NULL;
+ return 0;
+}
+
+static inline int clr_config_console_syslog_facility(const char *key,
+ struct lxc_conf *c, void *data)
+{
+ c->console.log_syslog_facility = LOG_DAEMON;
+ return 0;
+}
+
#endif
diff --git a/src/lxc/terminal.c b/src/lxc/terminal.c
index e696b4e4..9b831dc2 100644
--- a/src/lxc/terminal.c
+++ b/src/lxc/terminal.c
@@ -30,6 +30,7 @@
#include "utils.h"
#ifdef HAVE_ISULAD
#include "logger_json_file.h"
+#include "include/strlcpy.h"
#endif
#if HAVE_PTY_H
@@ -535,7 +536,7 @@ static int isulad_lxc_terminal_rotate_write_data(struct lxc_terminal *terminal,
return bytes_read;
}
-static ssize_t isulad_logger_write(struct lxc_terminal *terminal, const char *type, const char *buf,
+static ssize_t isulad_logger_json_write(struct lxc_terminal *terminal, const char *type, const char *buf,
int bytes_read)
{
logger_json_file *msg = NULL;
@@ -579,6 +580,31 @@ cleanup:
return ret;
}
+static ssize_t isulad_logger_syslog_write(struct lxc_terminal *terminal, const char *buf)
+{
+ syslog(LOG_INFO, "%s", buf);
+ return 0;
+}
+
+static inline bool is_syslog(const char *driver)
+{
+ if (driver == NULL) {
+ return false;
+ }
+
+ return (strcmp("syslog", driver) == 0);
+}
+
+static inline ssize_t isulad_logger_write(struct lxc_terminal *terminal, const char *type, const char *buf,
+ int bytes_read)
+{
+ if (is_syslog(terminal->log_driver)) {
+ return isulad_logger_syslog_write(terminal, buf);
+ }
+
+ return isulad_logger_json_write(terminal, type, buf, bytes_read);
+}
+
static int isulad_lxc_terminal_write_log_file(struct lxc_terminal *terminal, const char *type, char *buf,
int bytes_read)
{
@@ -1385,6 +1411,10 @@ void lxc_terminal_delete(struct lxc_terminal *terminal)
terminal->log_fd = -1;
#ifdef HAVE_ISULAD
+ if (is_syslog(terminal->log_driver)) {
+ closelog();
+ free(terminal->log_driver);
+ }
/* isulad: close all pipes */
if (terminal->pipes[0][0] >= 0)
close(terminal->pipes[0][0]);
@@ -1776,6 +1806,18 @@ int lxc_terminal_setup(struct lxc_conf *conf)
if (ret < 0)
return -1;
+#ifdef HAVE_ISULAD
+ if (is_syslog(terminal->log_driver)) {
+ if (terminal->log_syslog_tag == NULL) {
+ terminal->log_syslog_tag = malloc(16 * sizeof(char));
+ (void)strlcpy(terminal->log_syslog_tag, conf->name, 16);
+ }
+ if (terminal->log_syslog_facility <= 0) {
+ terminal->log_syslog_facility = LOG_DAEMON;
+ }
+ openlog(terminal->log_syslog_tag, LOG_PID, terminal->log_syslog_facility);
+ }
+#endif
ret = lxc_terminal_create_log_file(terminal);
if (ret < 0)
goto err;
diff --git a/src/lxc/terminal.h b/src/lxc/terminal.h
index f49142dc..9de4cd05 100644
--- a/src/lxc/terminal.h
+++ b/src/lxc/terminal.h
@@ -79,6 +79,16 @@ struct lxc_terminal {
/* whether the log file will be rotated */
unsigned int log_rotate;
+#ifdef HAVE_ISULAD
+ /* driver of log, support file and syslog */
+ char *log_driver;
+
+ /* syslog tag for every log */
+ char *log_syslog_tag;
+
+ /* syslog facility */
+ int log_syslog_facility;
+#endif
};
struct /* lxc_terminal_ringbuf */ {
--
2.25.3

29
0059-set-state-to-stopped.patch
View File

@ -1,29 +0,0 @@
From cdaabd27b2d3d091007d816d396c0b55301f2a42 Mon Sep 17 00:00:00 2001
From: haozi007 <liuhao27@huawei.com>
Date: Mon, 27 Apr 2020 10:54:37 +0800
Subject: [PATCH] set state to stopped
if send cmd to lxc-monitor timeout
Signed-off-by: haozi007 <liuhao27@huawei.com>
---
src/lxc/commands.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/src/lxc/commands.c b/src/lxc/commands.c
index c32aef19..37354e87 100644
--- a/src/lxc/commands.c
+++ b/src/lxc/commands.c
@@ -122,6 +122,9 @@ static int lxc_cmd_rsp_recv(int sock, struct lxc_cmd_rr *cmd)
#ifdef HAVE_ISULAD
/*isulad: add timeout 1s to avoid long block due to [lxc monitor] error*/
ret = lxc_abstract_unix_recv_fds_timeout(sock, &fd_rsp, 1, rsp, sizeof(*rsp), 1000 * 1000);
+ if (ret < 0 && (errno == ECONNRESET || errno == EAGAIN || errno == EWOULDBLOCK)) {
+ errno = ECONNRESET; /*isulad set errno ECONNRESET when timeout */
+ }
#else
ret = lxc_abstract_unix_recv_fds(sock, &fd_rsp, 1, rsp, sizeof(*rsp));
#endif
--
2.25.3

49
0060-attach-append-error-msg-when-call-attach-failed.patch
View File

@ -1,49 +0,0 @@
From de512a0c11bff1bfc8f0045e144bddc689742a21 Mon Sep 17 00:00:00 2001
From: LiFeng <lifeng68@huawei.com>
Date: Thu, 30 Apr 2020 16:40:14 +0800
Subject: [PATCH] attach: append error msg when call attach failed
Signed-off-by: LiFeng <lifeng68@huawei.com>
---
src/lxc/tools/lxc_attach.c | 13 ++++++++++---
1 file changed, 10 insertions(+), 3 deletions(-)
diff --git a/src/lxc/tools/lxc_attach.c b/src/lxc/tools/lxc_attach.c
index 190f3c8..dbddc2a 100644
--- a/src/lxc/tools/lxc_attach.c
+++ b/src/lxc/tools/lxc_attach.c
@@ -401,12 +401,17 @@ static int do_attach_foreground(struct lxc_container *c, lxc_attach_command_t *c
ret = c->attach(c, lxc_attach_run_command, command, attach_options, &pid);
else
ret = c->attach(c, lxc_attach_run_shell, NULL, attach_options, &pid);
- if (ret < 0)
+ if (ret < 0) {
+ *errmsg = safe_strdup("Internal error, failed to call attach");
goto out;
+ }
ret = lxc_wait_for_pid_status(pid);
- if (ret < 0)
+ if (ret < 0) {
+ free(*errmsg);
+ *errmsg = safe_strdup("Internal error, failed to wait attached process");
goto out;
+ }
if (WIFEXITED(ret))
wexit = WEXITSTATUS(ret);
@@ -421,8 +426,10 @@ static int do_attach_foreground(struct lxc_container *c, lxc_attach_command_t *c
ERROR("Execd pid %d exit with %d", pid, wexit);
out:
- if (c->lxc_conf->errmsg)
+ if (c->lxc_conf->errmsg) {
+ free(*errmsg);
*errmsg = safe_strdup(c->lxc_conf->errmsg);
+ }
return wexit;
}
--
1.8.3.1

41
0061-mount-fix-symlink-error-use-parsed-path.patch
View File

@ -1,41 +0,0 @@
From ac457309669377f9094936978ee695d6503fafc4 Mon Sep 17 00:00:00 2001
From: LiFeng <lifeng68@huawei.com>
Date: Thu, 30 Apr 2020 19:20:18 +0800
Subject: [PATCH] mount: fix symlink error, use parsed path
Signed-off-by: LiFeng <lifeng68@huawei.com>
---
src/lxc/conf.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/src/lxc/conf.c b/src/lxc/conf.c
index e8568d8..ad32725 100644
--- a/src/lxc/conf.c
+++ b/src/lxc/conf.c
@@ -2592,6 +2592,9 @@ static inline int mount_entry_on_generic(struct mntent *mntent,
dev = hasmntopt(mntent, "dev") != NULL;
relative = hasmntopt(mntent, "relative") != NULL;
+ if (rootfs && rootfs->path)
+ rootfs_path = rootfs->mount;
+
#ifdef HAVE_ISULAD
// isulad: ensure that the destination of the bind mount is resolved of symlinks at mount time because
// any previous mounts can invalidate the next mount's destination.
@@ -2616,12 +2619,9 @@ static inline int mount_entry_on_generic(struct mntent *mntent,
return -1;
}
}
-#else
- if (rootfs && rootfs->path)
- rootfs_path = rootfs->mount;
#endif
- ret = mount_entry_create_dir_file(mntent, path, rootfs, lxc_name,
+ ret = mount_entry_create_dir_file(mntent, dest, rootfs, lxc_name,
lxc_path);
if (ret < 0) {
#ifdef HAVE_ISULAD
--
1.8.3.1

113
0062-change-log-level-of-seccomp-setup.patch
View File

@ -1,113 +0,0 @@
From a7370435ac0591b5e2e4059b1aadd546bc92dae4 Mon Sep 17 00:00:00 2001
From: haozi007 <liuhao27@huawei.com>
Date: Wed, 6 May 2020 23:22:22 -0400
Subject: [PATCH] change log level of seccomp setup
Signed-off-by: haozi007 <liuhao27@huawei.com>
---
src/lxc/seccomp.c | 32 ++++++++++++++++++++++++++++++++
1 file changed, 32 insertions(+)
diff --git a/src/lxc/seccomp.c b/src/lxc/seccomp.c
index b7c4de36..4b9d23c5 100644
--- a/src/lxc/seccomp.c
+++ b/src/lxc/seccomp.c
@@ -562,7 +562,11 @@ bool do_resolve_add_rule(uint32_t arch, char *line, scmp_filter_ctx ctx,
memset(&arg_cmp, 0, sizeof(arg_cmp));
for (i = 0; i < rule->args_num; i++) {
+#ifdef HAVE_ISULAD
+ DEBUG("arg_cmp[%d]: SCMP_CMP(%u, %llu, %llu, %llu)", i,
+#else
INFO("arg_cmp[%d]: SCMP_CMP(%u, %llu, %llu, %llu)", i,
+#endif
rule->args_value[i].index,
(long long unsigned int)rule->args_value[i].op,
(long long unsigned int)rule->args_value[i].mask,
@@ -809,7 +813,11 @@ static int parse_config_v2(FILE *f, char *line, size_t *line_bufsz, struct lxc_c
remove_trailing_newlines(line);
+#ifdef HAVE_ISULAD
+ DEBUG("Processing \"%s\"", line);
+#else
INFO("Processing \"%s\"", line);
+#endif
if (line[0] == '[') {
/* Read the architecture for next set of rules. */
if (strcmp(line, "[x86]") == 0 ||
@@ -987,7 +995,11 @@ static int parse_config_v2(FILE *f, char *line, size_t *line_bufsz, struct lxc_c
conf->seccomp.seccomp_ctx, &rule))
goto bad_rule;
+#ifdef HAVE_ISULAD
+ DEBUG("Added native rule for arch %d for %s action %d(%s)",
+#else
INFO("Added native rule for arch %d for %s action %d(%s)",
+#endif
SCMP_ARCH_NATIVE, line, rule.action,
get_action_name(rule.action));
} else if (cur_rule_arch != lxc_seccomp_arch_all) {
@@ -1000,7 +1012,11 @@ static int parse_config_v2(FILE *f, char *line, size_t *line_bufsz, struct lxc_c
ctx.contexts[arch_index], &rule))
goto bad_rule;
+#ifdef HAVE_ISULAD
+ DEBUG("Added compat rule for arch %d for %s action %d(%s)",
+#else
INFO("Added compat rule for arch %d for %s action %d(%s)",
+#endif
ctx.architectures[arch_index], line, rule.action,
get_action_name(rule.action));
ctx.needs_merge[arch_index] = true;
@@ -1010,7 +1026,11 @@ static int parse_config_v2(FILE *f, char *line, size_t *line_bufsz, struct lxc_c
conf->seccomp.seccomp_ctx, &rule))
goto bad_rule;
+#ifdef HAVE_ISULAD
+ DEBUG("Added native rule for arch %d for %s action %d(%s)",
+#else
INFO("Added native rule for arch %d for %s action %d(%s)",
+#endif
SCMP_ARCH_NATIVE, line, rule.action,
get_action_name(rule.action));
@@ -1019,7 +1039,11 @@ static int parse_config_v2(FILE *f, char *line, size_t *line_bufsz, struct lxc_c
ctx.contexts[0], &rule))
goto bad_rule;
+#ifdef HAVE_ISULAD
+ DEBUG("Added compat rule for arch %d for %s action %d(%s)",
+#else
INFO("Added compat rule for arch %d for %s action %d(%s)",
+#endif
ctx.architectures[0], line, rule.action,
get_action_name(rule.action));
ctx.needs_merge[0] = true;
@@ -1030,7 +1054,11 @@ static int parse_config_v2(FILE *f, char *line, size_t *line_bufsz, struct lxc_c
ctx.contexts[1], &rule))
goto bad_rule;
+#ifdef HAVE_ISULAD
+ DEBUG("Added compat rule for arch %d for %s action %d(%s)",
+#else
INFO("Added compat rule for arch %d for %s action %d(%s)",
+#endif
ctx.architectures[1], line, rule.action,
get_action_name(rule.action));
ctx.needs_merge[1] = true;
@@ -1041,7 +1069,11 @@ static int parse_config_v2(FILE *f, char *line, size_t *line_bufsz, struct lxc_c
ctx.contexts[2], &rule))
goto bad_rule;
+#ifdef HAVE_ISULAD
+ DEBUG("Added native rule for arch %d for %s action %d(%s)",
+#else
INFO("Added native rule for arch %d for %s action %d(%s)",
+#endif
ctx.architectures[2], line, rule.action,
get_action_name(rule.action));
ctx.needs_merge[2] = true;
--
2.26.2

27
0063-hook-fix-memeory-leak.patch
View File

@ -1,27 +0,0 @@
From 5cff3f195151267b65c88c1412aa9553fa1e0510 Mon Sep 17 00:00:00 2001
From: LiFeng <lifeng68@huawei.com>
Date: Mon, 11 May 2020 12:14:30 +0800
Subject: [PATCH] hook: fix memeory leak
Signed-off-by: LiFeng <lifeng68@huawei.com>
---
src/lxc/conf.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/src/lxc/conf.c b/src/lxc/conf.c
index ad32725..f46255a 100644
--- a/src/lxc/conf.c
+++ b/src/lxc/conf.c
@@ -5447,6 +5447,9 @@ void lxc_conf_free(struct lxc_conf *conf)
lxc_clear_rootfs_ro_paths(conf);
free(conf->errmsg);
lxc_close_error_pipe(conf->errpipe);
+ if (conf->ocihooks) {
+ free_oci_runtime_spec_hooks(conf->ocihooks);
+ }
#endif
free(conf);
}
--
1.8.3.1

26
0064-termainal-fix-console-log-memory-leak.patch
View File

@ -1,26 +0,0 @@
From c08e50a792a088715e6752e5f93f8dff65f7cf27 Mon Sep 17 00:00:00 2001
From: LiFeng <lifeng68@huawei.com>
Date: Mon, 11 May 2020 14:00:17 +0800
Subject: [PATCH] termainal: fix console log memory leak
Signed-off-by: LiFeng <lifeng68@huawei.com>
---
src/lxc/terminal.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/src/lxc/terminal.c b/src/lxc/terminal.c
index 9b831dc..3d2960b 100644
--- a/src/lxc/terminal.c
+++ b/src/lxc/terminal.c
@@ -2114,6 +2114,8 @@ void lxc_terminal_conf_free(struct lxc_terminal *terminal)
free(terminal->init_fifo[1]);
free(terminal->init_fifo[2]);
lxc_terminal_delete_fifo(-1, &terminal->fifos);
+ free(terminal->log_driver);
+ free(terminal->log_syslog_tag);
#endif
}
--
1.8.3.1

32
0065-lxc-disable-terminal-stdout-stderr-pipe-O_NONBLOCK.patch
View File

@ -1,32 +0,0 @@
From 8c232b149654907867c12f10d801769f66d3500c Mon Sep 17 00:00:00 2001
From: gaohuatao <gaohuatao@huawei.com>
Date: Wed, 13 May 2020 23:19:25 -0400
Subject: [PATCH] lxc: disable terminal stdout/stderr pipe O_NONBLOCK
Signed-off-by: gaohuatao <gaohuatao@huawei.com>
---
src/lxc/terminal.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/src/lxc/terminal.c b/src/lxc/terminal.c
index 3d2960be..7441de79 100644
--- a/src/lxc/terminal.c
+++ b/src/lxc/terminal.c
@@ -1668,12 +1668,12 @@ int lxc_terminal_create(struct lxc_terminal *terminal)
goto err;
}
/* for stdout */
- if (pipe2(terminal->pipes[1], O_NONBLOCK | O_CLOEXEC)) {
+ if (pipe2(terminal->pipes[1], O_CLOEXEC)) {
ERROR("Failed to create stdout pipe");
goto err;
}
/* for stderr */
- if (pipe2(terminal->pipes[2], O_NONBLOCK | O_CLOEXEC)) {
+ if (pipe2(terminal->pipes[2], O_CLOEXEC)) {
ERROR("Failed to create stderr pipe");
goto err;
}
--
2.19.1

65
0066-lxc-fix-tests-build-error.patch
View File

@ -1,65 +0,0 @@
From 0bd5b0420aba3a8fb20c686db49a842a7a1eee4f Mon Sep 17 00:00:00 2001
From: lifeng68 <lifeng68@huawei.com>
Date: Tue, 19 May 2020 06:25:10 -0400
Subject: [PATCH] lxc: fix tests build error
Signed-off-by: lifeng68 <lifeng68@huawei.com>
---
src/tests/Makefile.am | 4 ++++
src/tests/attach.c | 9 +++++++++
2 files changed, 13 insertions(+)
diff --git a/src/tests/Makefile.am b/src/tests/Makefile.am
index 493b33c9d..59905d326 100644
--- a/src/tests/Makefile.am
+++ b/src/tests/Makefile.am
@@ -58,6 +58,10 @@ AM_CFLAGS=-DLXCROOTFSMOUNT=\"$(LXCROOTFSMOUNT)\" \
-I $(top_srcdir)/src/lxc/tools \
-pthread
+if HAVE_ISULAD
+AM_CFLAGS += -I $(top_srcdir)/src/lxc/json
+endif
+
if ENABLE_APPARMOR
AM_CFLAGS += -DHAVE_APPARMOR
endif
diff --git a/src/tests/attach.c b/src/tests/attach.c
index 07e641d56..acb4c89f4 100644
--- a/src/tests/attach.c
+++ b/src/tests/attach.c
@@ -29,6 +29,7 @@
#include "lxctest.h"
#include "utils.h"
#include "lsm/lsm.h"
+#include "config.h"
#include <lxc/lxccontainer.h>
@@ -76,7 +77,11 @@ static void test_attach_lsm_set_config(struct lxc_container *ct)
ct->save_config(ct, NULL);
}
+#ifdef HAVE_ISULAD
+static int test_attach_lsm_func_func(void* payload, int fd)
+#else
static int test_attach_lsm_func_func(void* payload)
+#endif
{
TSTOUT("%s", lsm_process_label_get(syscall(SYS_getpid)));
return 0;
@@ -187,7 +192,11 @@ static int test_attach_lsm_func(struct lxc_container *ct) { return 0; }
static int test_attach_lsm_cmd(struct lxc_container *ct) { return 0; }
#endif /* HAVE_APPARMOR || HAVE_SELINUX */
+#ifdef HAVE_ISULAD
+static int test_attach_func_func(void* payload, int fd)
+#else
static int test_attach_func_func(void* payload)
+#endif
{
TSTOUT("%d", (int)syscall(SYS_getpid));
return 0;
--
2.18.2

25
0067-set-normal-ret-value-when-populate-exist-device-successfully.patch
View File

@ -1,25 +0,0 @@
From e57686a8b94905829fc295981bc8d0a1253f186b Mon Sep 17 00:00:00 2001
From: wangkang <wangkang101@huawei.com>
Date: Fri, 22 May 2020 10:00:00 +0800
Subject: [PATCH] lxc: set normal ret value when populate exist device
successfully
---
src/lxc/conf.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/src/lxc/conf.c b/src/lxc/conf.c
index f46255a4..6890da12 100644
--- a/src/lxc/conf.c
+++ b/src/lxc/conf.c
@@ -4108,6 +4108,7 @@ static int setup_populate_devs(const struct lxc_rootfs *rootfs, struct lxc_list
ret = -1;
goto reset_umask;
}
+ ret = 0;
}
reset_umask:
--
2.18.2

26
0068-lxc-config-default-cgroup-pattern-to-lxc-n.patch
View File

@ -1,26 +0,0 @@
From 05ab7596df7f6c4b10401d4a9006f391176d3898 Mon Sep 17 00:00:00 2001
From: lifeng68 <lifeng68@huawei.com>
Date: Wed, 27 May 2020 17:13:25 +0800
Subject: [PATCH] lxc: config default cgroup pattern to lxc%n
Signed-off-by: lifeng68 <lifeng68@huawei.com>
---
configure.ac | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/configure.ac b/configure.ac
index 438d2923..3e86431d 100644
--- a/configure.ac
+++ b/configure.ac
@@ -496,7 +496,7 @@ AC_ARG_WITH([rootfs-path],
# cgroup pattern specification
AC_ARG_WITH([cgroup-pattern],
[AS_HELP_STRING([--with-cgroup-pattern=pattern], [pattern for container cgroups])],
- [with_cgroup_pattern=$withval], [with_cgroup_pattern=['']])
+ [with_cgroup_pattern=$withval], [with_cgroup_pattern=['lxc/%n']])
# The path for the apparmor_parser's cache for generated apparmor profiles
AC_ARG_WITH([apparmor-cache-dir],
--
2.20.1

41
0069-rootfs-support-use-host-rootfs-as-container-rootfs.patch
View File

@ -1,41 +0,0 @@
From 25a47f44f377e20b2939679f7df79c333627c97a Mon Sep 17 00:00:00 2001
From: lifeng68 <lifeng68@huawei.com>
Date: Wed, 24 Jun 2020 17:07:50 +0800
Subject: [PATCH] rootfs: support use host rootfs / as container rootfs
Signed-off-by: lifeng68 <lifeng68@huawei.com>
---
src/lxc/conf.c | 10 +++++++++-
1 file changed, 9 insertions(+), 1 deletion(-)
diff --git a/src/lxc/conf.c b/src/lxc/conf.c
index 6890da12..0744c19b 100644
--- a/src/lxc/conf.c
+++ b/src/lxc/conf.c
@@ -1367,7 +1367,7 @@ static int lxc_mount_rootfs(struct lxc_conf *conf)
{
int ret;
struct lxc_storage *bdev;
- const struct lxc_rootfs *rootfs = &conf->rootfs;
+ struct lxc_rootfs *rootfs = &conf->rootfs;
#ifdef HAVE_ISULAD
unsigned long flags, mntflags, pflags;
@@ -1378,6 +1378,14 @@ static int lxc_mount_rootfs(struct lxc_conf *conf)
ret = mount("", "/", NULL, MS_SLAVE | MS_REC, 0);
if (ret < 0)
return log_error_errno(-1, errno, "Failed to remount \"/\" MS_REC | MS_SLAVE");
+#ifdef HAVE_ISULAD
+ if (!access(rootfs->mount, F_OK)) {
+ rootfs->path = safe_strdup("/");
+ if (mount("/", rootfs->mount, NULL, MS_BIND, 0)) {
+ return log_error_errno(-1, errno, "Failed to mount \"/\" to %s", rootfs->mount);
+ }
+ }
+#endif
return 0;
}
--
2.25.1

72
0070-freeze-do-not-communicate-to-lxc-parent-when-unpause.patch
View File

@ -1,72 +0,0 @@
From e0387970de1ba7517dcfe88f32297775d90126f5 Mon Sep 17 00:00:00 2001
From: lifeng68 <lifeng68@huawei.com>
Date: Fri, 10 Jul 2020 11:51:20 +0800
Subject: [PATCH 2/2] freeze: do not communicate to lxc parent when unpause
Signed-off-by: lifeng68 <lifeng68@huawei.com>
---
src/lxc/lxccontainer.c | 31 +++++++++++++++++++++++++++++++
1 file changed, 31 insertions(+)
diff --git a/src/lxc/lxccontainer.c b/src/lxc/lxccontainer.c
index 6281a8a72..eef98df67 100644
--- a/src/lxc/lxccontainer.c
+++ b/src/lxc/lxccontainer.c
@@ -516,6 +516,20 @@ static bool do_lxcapi_is_running(struct lxc_container *c)
WRAP_API(bool, lxcapi_is_running)
+#ifdef HAVE_ISULAD
+static bool do_lxcapi_freeze(struct lxc_container *c)
+{
+ if (!c || !c->lxc_conf) {
+ return false;
+ }
+
+ if (lxc_freeze(c->lxc_conf, c->name, c->config_path) < 0) {
+ return false;
+ }
+
+ return true;
+}
+#else
static bool do_lxcapi_freeze(struct lxc_container *c)
{
lxc_state_t s;
@@ -529,9 +543,25 @@ static bool do_lxcapi_freeze(struct lxc_container *c)
return true;
}
+#endif
+
WRAP_API(bool, lxcapi_freeze)
+#ifdef HAVE_ISULAD
+static bool do_lxcapi_unfreeze(struct lxc_container *c)
+{
+ if (!c || !c->lxc_conf) {
+ return false;
+ }
+
+ if (lxc_unfreeze(c->lxc_conf, c->name, c->config_path) < 0) {
+ return false;
+ }
+
+ return true;
+}
+#else
static bool do_lxcapi_unfreeze(struct lxc_container *c)
{
lxc_state_t s;
@@ -545,6 +575,7 @@ static bool do_lxcapi_unfreeze(struct lxc_container *c)
return true;
}
+#endif
WRAP_API(bool, lxcapi_unfreeze)
--
2.25.1

4
apply-patches
View File

@ -16,9 +16,9 @@
set -ex
pkg=lxc-4.0.1
pkg=lxc-4.0.3
cwd=$PWD
src=$cwd/lxc-4.0.1
src=$cwd/lxc-4.0.3
tar -xzvf $pkg.tar.gz

BIN
lxc-4.0.1.tar.gz
View File

Binary file not shown.

BIN
lxc-4.0.3.tar.gz Normal file
View File

Binary file not shown.

89
lxc.spec
View File

@ -1,90 +1,21 @@
%global _release 2020071001
%global _release 2020071501
%global debug_package %{nil}
Name: lxc
Version: 4.0.1
Version: 4.0.3
Release: %{_release}
Summary: Linux Containers userspace tools
License: LGPLv2+
URL: https://github.com/lxc/lxc
Source0: lxc-4.0.1.tar.gz
Patch9000: 0001-iSulad-add-HAVE_ISULAD-macro.patch
Patch9001: 0002-confile-add-lxc.isulad.init.args-config-interface.patch
Patch9002: 0003-confile-add-lxc.isulad.populate.device-interface.patch
Patch9003: 0004-confile-add-support-umask.patch
Patch9004: 0005-cgroup-refact-cgroup-implemt.patch
Patch9005: 0006-modify-container-exit-code-and-stop-signal.patch
Patch9006: 0007-check-and-save-pid-info-file.patch
Patch9007: 0008-support-block-device-as-rootfs.patch
Patch9008: 0009-support-mount-squashfs-in-mount-entry.patch
Patch9009: 0010-IO-refact-terminal-progress.patch
Patch9010: 0011-add-exit-fifo-to-monitor-state-of-lxc-monitor.patch
Patch9011: 0012-Adapt-to-isulad-log.patch
Patch9012: 0013-set-env-in-container.patch
Patch9013: 0014-exec-refact-attach-progress.patch
Patch9014: 0015-add-masked-paths-and-readonly-paths.patch
Patch9015: 0016-start-separate-i-and-t.patch
Patch9016: 0017-attach-add_terminal_fifos-Add-terminal-fifos-dynamic.patch
Patch9017: 0018-pty-setup-pty-after-setup-rootfs-mount-options.patch
Patch9018: 0019-resize-implement-resize-function-in-exec-start.patch
Patch9019: 0020-confile-decode-escape-charactors-in-config.patch
Patch9020: 0021-cgroup-add-retry-for-destory-cgroups.patch
Patch9021: 0022-support-terminal-log.patch
Patch9022: 0023-Supporting-rootfs-mount-propagation.patch
Patch9023: 0024-start-do-not-check-ppid-when-set-death-signal.patch
Patch9024: 0025-support-oci-hooks.patch
Patch9025: 0026-Supporting-UID-GID-configuration.patch
Patch9026: 0027-Capabilites-security-feature-enhanced.patch
Patch9027: 0028-Supporting-workdir-configuration.patch
Patch9028: 0029-Supporting-additional-groups-configuration.patch
Patch9029: 0030-set-negative-files.limit-value-to-max.patch
Patch9030: 0031-head-file-remove-macro-HAVE_ISULAD-in-installed-head.patch
Patch9031: 0032-link-proc-mounts-to-etc-mtab.patch
Patch9032: 0033-build-add-secure-build-flags.patch
Patch9033: 0034-support-timeout.patch
Patch9034: 0035-Seccomp-security-feature-enhanced.patch
Patch9035: 0036-Security-coding-modification.patch
Patch9036: 0037-cgfsng-fix-build-error-device_cgroup_rule_parse.patch
Patch9037: 0038-Ignore-errors-when-loading-rules-fail.patch
Patch9038: 0039-net-adapt-to-isulad.patch
Patch9039: 0040-cgfsng-make-container-full-path-in-cgfsng_get_cgroup.patch
Patch9040: 0041-build-fix-some-bug-in-free-memory.patch
Patch9041: 0042-cgfsng-make-container-full-path-in-destory-cgroup.patch
Patch9042: 0043-support-error-report.patch
Patch9043: 0044-remove-filelock-in-destroy-dir.patch
Patch9044: 0045-restore-default-signal-handler.patch
Patch9045: 0046-add-support-systemd.patch
Patch9046: 0047-support-namespaced-kernel-params-can-be-changed-in-s.patch
Patch9047: 0048-don-t-use-the-unified-hierarchy-for-the-systemd-cgro.patch
Patch9048: 0049-make-dev-bind-mount-from-host-tmpfs-for-system-conta.patch
Patch9049: 0050-clean-add-init-fd-in-lxc_init_clean_handler.patch
Patch9050: 0051-init-pids-add-init-fd-in-lxc_init_pids_handler.patch
Patch9051: 0052-setupdev-add-judge-whether-have-mount-dev-entry.patch
Patch9052: 0053-attach-seprate-i-and-t-flags.patch
Patch9053: 0054-start-do-not-check-pid-die-when-lxc_poll-exit.patch
Patch9054: 0055-terminal-not-close-pipe-when-lxc_poll-exit.patch
Patch9055: 0056-attach-add-sigfd-to-monitor-the-exit-of-pid.patch
Patch9056: 0057-attach-add-read-data-from-attach-sigfd.patch
Patch9057: 0058-support-syslog-for-console.patch
Patch9058: 0059-set-state-to-stopped.patch
Patch9059: 0060-attach-append-error-msg-when-call-attach-failed.patch
Patch9060: 0061-mount-fix-symlink-error-use-parsed-path.patch
Patch9061: 0062-change-log-level-of-seccomp-setup.patch
Patch9062: 0063-hook-fix-memeory-leak.patch
Patch9063: 0064-termainal-fix-console-log-memory-leak.patch
Patch9064: 0065-lxc-disable-terminal-stdout-stderr-pipe-O_NONBLOCK.patch
Patch9065: 0066-lxc-fix-tests-build-error.patch
Patch9066: 0067-set-normal-ret-value-when-populate-exist-device-successfully.patch
Patch9067: 0068-lxc-config-default-cgroup-pattern-to-lxc-n.patch
Patch9068: 0069-rootfs-support-use-host-rootfs-as-container-rootfs.patch
Patch9069: 0070-freeze-do-not-communicate-to-lxc-parent-when-unpause.patch
Source0: lxc-4.0.3.tar.gz
Patch9001: 0001-huawei-adapt-to-huawei-4.0.3.patch
BuildRequires: systemd-units git libtool graphviz docbook2X doxygen chrpath
BuildRequires: pkgconfig(libseccomp)
BuildRequires: libcap libcap-devel libselinux-devel yajl yajl-devel
BuildRequires: pkgconfig(bash-completion)
Requires: lxc-libs = 4.0.1-%{release}
Requires: lxc-libs = 4.0.3-%{release}
%package libs
Summary: Runtime library files for %{name}
@ -102,7 +33,7 @@ overhead of full virtualization.
The %{name}-libs package contains libraries for running %{name} applications.
%{!?_pkgdocdir: %global _pkgdocdir %{_docdir}/lxc-4.0.1}
%{!?_pkgdocdir: %global _pkgdocdir %{_docdir}/lxc-4.0.3}
%description
Containers are insulated areas inside a system, which have their own namespace
@ -116,7 +47,7 @@ boot an entire "containerized" system, and to manage and debug your containers.
%package devel
Summary: Development files for lxc
Requires: lxc = 4.0.1-%{release}
Requires: lxc = 4.0.3-%{release}
Requires: pkgconfig
%description devel
@ -132,7 +63,7 @@ BuildArch: noarch
This package contains documentation for lxc for creating containers.
%prep
%autosetup -n lxc-4.0.1 -Sgit -p1
%autosetup -n lxc-4.0.3 -Sgit -p1
%build
%configure --enable-doc --enable-api-docs \
@ -253,8 +184,8 @@ make check
%{_mandir}/*/man7/%{name}*
%changelog
* Mon Apr 20 2020 openEuler Buildteam <buildteam@openeuler.org> - 4.0.1-2020042001
* Mon Apr 20 2020 openEuler Buildteam <buildteam@openeuler.org> - 4.0.3-2020071501
- Type:enhancement
- ID:NA
- SUG:NA
- DESC: update lxc to 4.0.1
- DESC: update lxc to 4.0.3