Re: [lxc-devel] [PATCH] fix autodev on SELinux enabled systems

2015-02-12 Thread Dwight Engen
On Thu, 12 Feb 2015 23:39:48 + Serge Hallyn wrote: > Quoting Dwight Engen (dwight.en...@oracle.com): > > commit 87da4ec3 changed autodev such that device nodes are created > > in a small tmpfs, rather than in a subdirectory of /dev. This > > causes a problem on an SELin

[lxc-devel] [PATCH] fix autodev on SELinux enabled systems

2015-02-12 Thread Dwight Engen
autodev created devices with the correct labels (ie. null_device_t for /dev/null). The bad labels were causing things like dhclient to fail in the container since they couldn't access /dev/null. Signed-off-by: Dwight Engen --- src/lxc/conf.c| 10 -- src/lxc/lsm/lsm.c

Re: [lxc-devel] Regarding splitting lxc and lxc-libs

2015-02-03 Thread Dwight Engen
On Tue, 03 Feb 2015 13:32:44 +0100 Johannes Kastl wrote: > -BEGIN PGP SIGNED MESSAGE- > Hash: SHA1 > > Hi guys, > > three question regarding the split of lxc into lxc and lxc-libs: > > 1. During packaging 1.1 for openSUSE I came across questions for the > split in lxc-libs and lxc pack

[lxc-devel] [PATCH cgmanager] bump required version of libnih to 1.0.3

2015-01-28 Thread Dwight Engen
Attempting to build with 1.0.2 gives the following error: nih-dbus-tool:org.linuxcontainers.cgmanager.xml:41:51: Invalid D-Bus type in type attribute: Unknown typecode since 1.0.2 does not support the type 'h' for passing the sockfd. Signed-off-by: Dwight Engen --- configure.ac |

Re: [lxc-devel] [PATCHES] add "--mask-tmp" to lxc-fedora, plus some template script fixes

2015-01-13 Thread Dwight Engen
On Tue, 13 Jan 2015 09:53:28 -0500 Stéphane Graber wrote: > On Tue, Jan 13, 2015 at 02:49:22PM +, Serge Hallyn wrote: > > Quoting Michael Adam (ob...@samba.org): > > > On 2015-01-10 at 15:59 +, Serge Hallyn wrote: > > > > Quoting Michael Adam (ob...@samba.org): > > > > > On 2015-01-10 at

Re: [lxc-devel] Valid Container Names/Identifiers

2014-12-16 Thread Dwight Engen
On Tue, 16 Dec 2014 10:22:05 -0500 Stéphane Graber wrote: > On Tue, Dec 16, 2014 at 10:36:13AM +0100, Till Walter wrote: > > Dear LXC Developers, > > > > the manual page of lxc-create states that "The container identifier > > format is an alphanumeric string". Yet besides [A-Za-z0-9] other > > c

Re: [lxc-devel] Building lxc 1.1 from spec: configure and automake

2014-12-08 Thread Dwight Engen
On Mon, 08 Dec 2014 20:51:09 +0100 Johannes Kastl wrote: > -BEGIN PGP SIGNED MESSAGE- > Hash: SHA1 > > Hi everyone, > > as 1.1 seems to be getting nearer, I wanted to start building packages > for openSUSE. First thing I ran into is the missing configure, so one > has to run autogen.sh

Re: [lxc-devel] [PATCH] Define a new lxc.init_cmd config option

2014-12-01 Thread Dwight Engen
On Wed, 26 Nov 2014 15:34:41 -0500 Stéphane Graber wrote: > Signed-off-by: Stéphane Graber Acked-by: Dwight Engen I think we should also update the lxc-start manpage, which says "If no command is specified, lxc-start will use the default "/sbin/init" command to run a sys

Re: [lxc-devel] [PATCH] Add missing files to ignore list

2014-12-01 Thread Dwight Engen
On Wed, 26 Nov 2014 15:34:20 -0500 Stéphane Graber wrote: > Signed-off-by: Stéphane Graber Acked-by: Dwight Engen > --- > .gitignore | 2 ++ > 1 file changed, 2 insertions(+) > > diff --git a/.gitignore b/.gitignore > index ddc4e18..aa3a537 100644 > --- a/.giti

[lxc-devel] [PATCH] lua: fix return value of attach() method

2014-11-17 Thread Dwight Engen
Add simple test case for attach() method. Add assert for return value from create() method which also returns a boolean. Signed-off-by: Dwight Engen --- src/lua-lxc/core.c |2 +- src/lua-lxc/test/apitest.lua |9 - 2 files changed, 9 insertions(+), 2 deletions(-) diff

Re: [lxc-devel] lxd: Initial design specifications

2014-11-07 Thread Dwight Engen
On Fri, 7 Nov 2014 10:16:06 -0500 Stéphane Graber wrote: > On Fri, Nov 07, 2014 at 09:52:34AM -0500, Dwight Engen wrote: > > On Fri, 7 Nov 2014 00:39:19 + > > Serge Hallyn wrote: > > > > > Quoting Stéphane Graber (stgra...@ubuntu.com): > > > >

Re: [lxc-devel] lxd: Initial design specifications

2014-11-07 Thread Dwight Engen
On Fri, 7 Nov 2014 00:39:19 + Serge Hallyn wrote: > Quoting Stéphane Graber (stgra...@ubuntu.com): > > On Thu, Nov 06, 2014 at 04:03:18PM -0500, Dwight Engen wrote: > > > > Re-reading the examples, except for that specific one, there's > > nothing that copy c

Re: [lxc-devel] lxd: Initial design specifications

2014-11-06 Thread Dwight Engen
On Wed, 5 Nov 2014 20:13:53 -0500 Stéphane Graber wrote: > Hey, > > So as of earlier today, we have a working repository for lxd at > github.com/lxc/lxd with the usual paperwork (license, contribution > guidelines, ...) and Serge just reviewed and merged the first design > specification. > > Th

Re: [lxc-devel] [PATCH 3/9] lxc_start: ERROR if container is already running.

2014-10-22 Thread Dwight Engen
On Wed, 22 Oct 2014 14:31:15 + Serge Hallyn wrote: > Quoting Alexandru Gheorghe (alghe.glo...@gmail.com): > > On 10/21/2014 07:54 PM, Serge Hallyn wrote: > > > Quoting Dwight Engen (dwight.en...@oracle.com): > > >> On Tue, 21 Oct 2014 09:58:29 -050

Re: [lxc-devel] [PATCH 3/9] lxc_start: ERROR if container is already running.

2014-10-21 Thread Dwight Engen
On Tue, 21 Oct 2014 09:58:29 -0500 Tycho Andersen wrote: > On Tue, Oct 21, 2014 at 02:54:34PM +, Serge Hallyn wrote: > > Quoting Tycho Andersen (tycho.ander...@canonical.com): > > > On Tue, Oct 21, 2014 at 02:29:28PM +, Serge Hallyn wrote: > > > > Quoting Tycho Andersen (tycho.ander...@ca

Re: [lxc-devel] [PATCH] apparmor: check for mount feature at a better time

2014-10-14 Thread Dwight Engen
h we may not be allowed to anyway. Hi Serge, it looks like with this change lxc won't attempt to mount /sys nor /sys/kernel/security at all? Just wanted to verify that we don't think anyone was relying on that. Acked-by: Dwight Engen > Signed-off-by: Serge Hallyn > ---

Re: [lxc-devel] [PATCH 1/1] fix lxc.mount.auto clearing

2014-10-10 Thread Dwight Engen
On Thu, 9 Oct 2014 22:50:46 + Serge Hallyn wrote: > Quoting Dwight Engen (dwight.en...@oracle.com): > > On Thu, 9 Oct 2014 16:01:15 + > > Serge Hallyn wrote: > > > > > the way config_mount was structured, sending 'lxc.mount.auto = ' > > >

Re: [lxc-devel] [PATCH 1/1] fix lxc.mount.auto clearing

2014-10-09 Thread Dwight Engen
earer if the config_mount() and helper > fns were structured like the rest of confile.c. It's tempting > to switch it over, but there are subtleties in there so it's > not something to do without a lot of thought and testing. > > Signed-off-by: Se

Re: [lxc-devel] lxc-dnsmasq user

2014-10-03 Thread Dwight Engen
On Thu, 2 Oct 2014 21:26:30 + Serge Hallyn wrote: > Quoting Dwight Engen (dwight.en...@oracle.com): > > Hi Mike, > > > > I was just wondering what the reason was for choosing to create a > > lxc-dnsmasq user? If I read the dnsmasq man-page right, it will >

[lxc-devel] lxc-dnsmasq user

2014-10-02 Thread Dwight Engen
Hi Mike, I was just wondering what the reason was for choosing to create a lxc-dnsmasq user? If I read the dnsmasq man-page right, it will normally drop privileges and switch to user 'nobody', so was there some reason 'nobody' was a problem? Just asking as it would be simpler if lxc didn't have t

[lxc-devel] [PATCH] systemd/selinux init scripts fixups

2014-10-02 Thread Dwight Engen
reate /run/lxc as init_var_run_t which dnsmasq can't write its pid into, so we restorecon it after creation (to var_run_t) - The lxc-net systemd .service file needs an [Install] section so that "systemctl enable lxc-net" will work Signed-off-by: Dwight Engen --- config/in

Re: [lxc-devel] [PATCH 1/1] pivot_root: switch to a new mechanism (v2)

2014-10-01 Thread Dwight Engen
On Mon, 29 Sep 2014 22:46:26 + Serge Hallyn wrote: > Quoting Andy Lutomirski (l...@amacapital.net): > > On Mon, Sep 29, 2014 at 2:46 PM, Serge Hallyn > > wrote: I'm not sure that "/" is > > well-defined. You have oldroot mounted on > > Whoa. Seems you're right. I would have expected it t

Re: [lxc-devel] [PATCH] pivot_root: umount ., not /

2014-09-30 Thread Dwight Engen
On Mon, 29 Sep 2014 22:51:35 + Serge Hallyn wrote: > This fixes pivot_root on 3.11 and older kernels. > > Signed-off-by: Serge Hallyn Acked-by: Dwight Engen Tested-by: Dwight Engen Thanks Serge! > --- > src/lxc/conf.c | 2 +- > 1 file changed, 1 insertion(+), 1 del

Re: [lxc-devel] [PATCH 1/1] pivot_root: switch to a new mechanism (v2)

2014-09-26 Thread Dwight Engen
On Sat, 20 Sep 2014 03:15:44 + Serge Hallyn wrote: > This idea came from Andy Lutomirski. Instead of using a > temporary directory for the pivot_root put-old, use "." both > for new-root and old-root. Then fchdir into the old root > temporarily in order to unmount the old-root, and finally

[lxc-devel] [PATCH v2 on top of Rework init scripts] fixups to init script rework

2014-09-26 Thread Dwight Engen
nterfering with the init scripts Signed-off-by: Dwight Engen --- v2: - move action() from common to sysvinit wrapper - set runtime_path for distro's that don't have /run - add bridge-utils, libcgroup to Requires .gitignore |7 ++- config/init/comm

Re: [lxc-devel] [PATCH] Rework init scripts

2014-09-26 Thread Dwight Engen
On Fri, 26 Sep 2014 11:06:00 -0400 Stéphane Graber wrote: > On Wed, Sep 24, 2014 at 07:16:32PM -0400, Dwight Engen wrote: > > On Wed, 24 Sep 2014 16:13:48 -0400 > > Stéphane Graber wrote: > > > > > On Wed, Sep 24, 2014 at 04:05:33PM -0400, Dwight Engen wrote: >

Re: [lxc-devel] [PATCH] Rework init scripts

2014-09-24 Thread Dwight Engen
On Wed, 24 Sep 2014 16:13:48 -0400 Stéphane Graber wrote: > On Wed, Sep 24, 2014 at 04:05:33PM -0400, Dwight Engen wrote: > > On Wed, 24 Sep 2014 13:17:28 -0400 > > Stéphane Graber wrote: > > > > > I've confirmed that the testsuite on all arches passes fi

Re: [lxc-devel] RFC: should lxc-create default to -B best?

2014-09-24 Thread Dwight Engen
On Wed, 24 Sep 2014 20:45:22 + Serge Hallyn wrote: > Quoting Dwight Engen (dwight.en...@oracle.com): > > In lxc-0.9.0 if -B wasn't given to lxc-create (the shell script), it > > would test if $rootfs was on a btrfs and if so would act as if -B > > btrfs were giv

Re: [lxc-devel] [PATCH] Rework init scripts

2014-09-24 Thread Dwight Engen
On Wed, 24 Sep 2014 13:17:28 -0400 Stéphane Graber wrote: > I've confirmed that the testsuite on all arches passes fine with that > change and close inspection of the resulting package looked good too. > > It'd be nice to have someone confirm that make rpm works with that > change as I don't hav

[lxc-devel] RFC: should lxc-create default to -B best?

2014-09-24 Thread Dwight Engen
In lxc-0.9.0 if -B wasn't given to lxc-create (the shell script), it would test if $rootfs was on a btrfs and if so would act as if -B btrfs were given (ie. create a subvolume). In lxc-1.x with the bdev backend, lxc-create has the option -B best which would have a similar result, but this is not t

[lxc-devel] [PATCH v3] port lxc-top from lua to C for wider availability

2014-09-23 Thread Dwight Engen
- keep but rename the lua version as an example of how to use the lua API - got rid of the fairly useless --max argument Signed-off-by: Dwight Engen --- v3: - remove unneeded exit from for loop (which could've cause a mem leak) - remove leftover debug printf - check return from realloc

Re: [lxc-devel] [PATCH v2] port lxc-top from lua to C for wider availability

2014-09-23 Thread Dwight Engen
On Mon, 22 Sep 2014 23:52:18 + Serge Hallyn wrote: > Quoting Dwight Engen (dwight.en...@oracle.com): > > - keep but rename the lua version as an example of how to use the > > lua API > > > > - got rid of the fairly useless --max argument > > > > Sig

[lxc-devel] [PATCH v2] port lxc-top from lua to C for wider availability

2014-09-22 Thread Dwight Engen
- keep but rename the lua version as an example of how to use the lua API - got rid of the fairly useless --max argument Signed-off-by: Dwight Engen --- v2: - name of source file should be lxc_top.c not lxc-top.c - distribute lxc-top.lua in tarball as reference example, but don't in

Re: [lxc-devel] [PATCH] port lxc-top from lua to C for wider availability

2014-09-22 Thread Dwight Engen
On Mon, 22 Sep 2014 17:15:40 + Serge Hallyn wrote: > Quoting Dwight Engen (dwight.en...@oracle.com): > > It seems lxc-top would be useful on some platforms which don't yet > > bundle the lxc lua binding. This is pretty much a direct port of > > the lua based lxc-to

Re: [lxc-devel] [PATCH] apparmor: make sure sysfs and securityfs are mounted when checking for mount feature

2014-09-22 Thread Dwight Engen
s caused lxc-test-apparmor to fail. > > Signed-off-by: Serge Hallyn Acked-by: Dwight Engen > --- > src/lxc/lsm/apparmor.c | 32 +--- > 1 file changed, 29 insertions(+), 3 deletions(-) > > diff --git a/src/lxc/lsm/apparmor.c b/src/lxc/lsm/apparmor.c &

Re: [lxc-devel] [PATCH RFC] apparmor: improve behavior when kernel lacks mount restrictions

2014-09-19 Thread Dwight Engen
h and run some python code (ie. the LXC_ATTACH_LSM_NOW) case. Anyway, I think what you have should not effect that. Acked-by: Dwight Engen > 3. add a testcase. To test the case were a kernel does not > provide mount restrictions, we mount an empty directory over > the /sys/kernel/security

[lxc-devel] [PATCH] port lxc-top from lua to C for wider availability

2014-09-19 Thread Dwight Engen
le of how to use the lua API - Got rid of the fairly useless --max argument Signed-off-by: Dwight Engen --- doc/lxc-top.sgml.in | 26 +-- src/lxc/Makefile.am | 1 + src/lxc/lxc-top | 243 - src/lxc/lxc-top.c

Re: [lxc-devel] RFC - umask

2014-09-11 Thread Dwight Engen
On Wed, 10 Sep 2014 20:06:24 + Serge Hallyn wrote: > Hi, > > so https://bugs.launchpad.net/bugs/1367730 points out another case > where running lxc under a tight umask can cause trouble for the > containers. How best to handle this? > > (1) We could ignore it. > > (2) We could detect too-t

Re: [lxc-devel] [PATCH 1/1] cgmanager get/set: clean up child (v2)

2014-08-15 Thread Dwight Engen
gt; Signed-off-by: Serge Hallyn Acked-by: Dwight Engen > --- > src/lxc/cgmanager.c | 30 +- > 1 file changed, 21 insertions(+), 9 deletions(-) > > diff --git a/src/lxc/cgmanager.c b/src/lxc/cgmanager.c > index c4f48e9..4db61c1 100644 > --- a/sr

Re: [lxc-devel] [PATCH] cgmanager get/set: clean up child

2014-08-15 Thread Dwight Engen
On Fri, 15 Aug 2014 16:20:06 + Serge Hallyn wrote: > Quoting Dwight Engen (dwight.en...@oracle.com): > > On Thu, 14 Aug 2014 21:56:04 + > > Serge Hallyn wrote: > > > > > Make sure we reap our child at cgm_{s,g}et. > > > > > > Not d

Re: [lxc-devel] [PATCH] cgmanager get/set: clean up child

2014-08-15 Thread Dwight Engen
On Thu, 14 Aug 2014 21:56:04 + Serge Hallyn wrote: > Make sure we reap our child at cgm_{s,g}et. > > Not doing this resulted in a defunct child of Tycho's > lxc-restore. > > Signed-off-by: Serge Hallyn Acked-by: Dwight Engen (with one question below) > --- &

Re: [lxc-devel] [PATCH 1/1] chmod container dir to 0750

2014-08-15 Thread Dwight Engen
an't just make chown_mapped_root() take a const char * because its visible and you want this to apply to -stable? At any rate, Acked-by: Dwight Engen > Signed-off-by: Serge Hallyn > --- > src/lxc/lxccontainer.c | 39 ++- > 1 file changed,

Re: [lxc-devel] Starting lxc via systemd on openSUSE: "action: command not found"

2014-08-13 Thread Dwight Engen
On Wed, 13 Aug 2014 17:48:59 -0400 "Michael H. Warfield" wrote: > On Wed, 2014-08-13 at 17:14 -0400, Dwight Engen wrote: > > On Wed, 13 Aug 2014 15:38:10 -0400 > > "Michael H. Warfield" wrote: > > > > > On Wed, 2014-08-13 at 21:2

Re: [lxc-devel] Starting lxc via systemd on openSUSE: "action: command not found"

2014-08-13 Thread Dwight Engen
On Wed, 13 Aug 2014 15:38:10 -0400 "Michael H. Warfield" wrote: > On Wed, 2014-08-13 at 21:22 +0200, Johannes Kastl wrote: > > Hi everyone, > > > > I tried to get some lxc containers to start on openSUSE, but could > > not get the systemd-service to start: > > > > > sudo systemctl status lxc.se

Re: [lxc-devel] [PATCH 2/6] Get systemd unit dir from pkg-config

2014-08-11 Thread Dwight Engen
On Thu, 31 Jul 2014 08:53:52 +0200 Martin Pitt wrote: > Don't install systemd unit files into $(prefix), they won't work > there. Instead, get them from systemd's pkg-config file. > --- > config/init/systemd/Makefile.am | 2 -- > configure.ac| 12 > 2 files chan

Re: [lxc-devel] [PATCH 1/6] Move lxcbr0 setup logic into lxc.net script

2014-08-11 Thread Dwight Engen
On Thu, 31 Jul 2014 08:53:51 +0200 Martin Pitt wrote: > Factor this out of the lxc-net.conf upstart job, so that it can be > used by init.d scripts and systemd units, too. > > Part of https://launchpad.net/bugs/1312532 > --- > config/init/upstart/lxc-net.conf | 88 > +---

[lxc-devel] [PATCH v2] provide an example SELinux policy for older releases

2014-07-24 Thread Dwight Engen
olicy, it is recommended not to use this sample policy, but to use the types already available on the system from /etc/selinux/targeted/contexts/lxc_contexts, ie: process = "system_u:system_r:svirt_lxc_net_t:s0" file = "system_u:object_r:svirt_sandbox_file_t:s0" Signed-off

Re: [lxc-devel] [PATCH] provide an example SELinux policy for older releases

2014-07-24 Thread Dwight Engen
On Thu, 24 Jul 2014 20:21:41 + Serge Hallyn wrote: > Quoting Dwight Engen (dwight.en...@oracle.com): > > The virtd_lxc_t type provided by the default RHEL/CentOS/Oracle 6.5 > > policy is an unconfined_domain(), so it doesn't really enforce > > anything. This change

[lxc-devel] [PATCH] provide an example SELinux policy for older releases

2014-07-24 Thread Dwight Engen
olicy, it is recommended not to use this sample policy, but to use the types already available on the system from /etc/selinux/targeted/contexts/lxc_contexts, ie: process = "system_u:system_r:svirt_lxc_net_t:s0" file = "system_u:object_r:svirt_sandbox_file_t:s0" Signed-off-by:

Re: [lxc-devel] LXC 1.0.4 has been released!

2014-07-07 Thread Dwight Engen
On Sat, 05 Jul 2014 11:25:57 -0400 "Michael H. Warfield" wrote: > On Sat, 2014-07-05 at 10:09 -0400, Michael H. Warfield wrote: > > On Sat, 2014-07-05 at 10:03 +0200, Johannes Kastl wrote: > > > Hi Michael, > > > > > > sorry for the delay, I was kinda busy... > > > > > > On 18.06.2014 19:15 Mic

[lxc-devel] [PATCH] lxc-oracle: mount cgroup:mixed

2014-07-03 Thread Dwight Engen
-by: Dwight Engen --- config/templates/oracle.common.conf.in | 2 +- templates/lxc-oracle.in| 4 +++- 2 files changed, 4 insertions(+), 2 deletions(-) diff --git a/config/templates/oracle.common.conf.in b/config/templates/oracle.common.conf.in index ec5ae94..10522b2 100644 --- a

Re: [lxc-devel] Regarding lxc-attach and lxc-device commands

2014-06-23 Thread Dwight Engen
On Mon, 23 Jun 2014 12:30:05 +0530 vinish ramachandran wrote: > Hi All, > > I have installed the latest lxc version (1.0.3-2) from 'Rawhide' and > created a new container with default template on my fedora-21 machine > [root@localhost ~]# lxc-ls > test1 > > When i try to run "ifconfig"

Re: [lxc-devel] [PATCH] [RFC] Reduce duplication in new style configs

2014-06-23 Thread Dwight Engen
On Fri, 20 Jun 2014 17:30:33 -0400 Stéphane Graber wrote: > This is a rather massive cleanup of config/templates/* > > As new templates were added, I've noticed that we pretty much all > share the tty/pts configs, some capabilities being dropped and most > of the cgroup configuration. All the us

Re: [lxc-devel] [PATCH] don't build init.lxc.static if libcap.a isn't available

2014-06-20 Thread Dwight Engen
On Fri, 20 Jun 2014 20:48:57 + Serge Hallyn wrote: > Quoting Dwight Engen (dwight.en...@oracle.com): > > Note that building init.lxc.static still requires a static libutil.a > > and libpthread.a, but these are available on most distro's through > > glibc-stat

[lxc-devel] [PATCH] don't build init.lxc.static if libcap.a isn't available

2014-06-20 Thread Dwight Engen
Note that building init.lxc.static still requires a static libutil.a and libpthread.a, but these are available on most distro's through glibc-static. Signed-off-by: Dwight Engen --- configure.ac| 13 + src/lxc/Makefile.am | 6 +- 2 files changed, 18 insertions(

[lxc-devel] [PATCH] fix the expansion of libexecdir when not explicitly passed to configure

2014-06-20 Thread Dwight Engen
Signed-off-by: Dwight Engen --- config/init/systemd/lxc.service.in | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/config/init/systemd/lxc.service.in b/config/init/systemd/lxc.service.in index 5f155b6..0a428a3 100644 --- a/config/init/systemd/lxc.service.in +++ b

Re: [lxc-devel] [lxc-users] Container escape through open_by_handle_at (shocker exploit)

2014-06-20 Thread Dwight Engen
On Wed, 18 Jun 2014 21:03:05 -0400 Dwight Engen wrote: > On Wed, 18 Jun 2014 14:11:49 -0400 > Stéphane Graber wrote: > > > Just fixing lxc-devel's e-mail address, it turns out that e-mails > > work better when you don't forget the tld :) > > >

Re: [lxc-devel] commit d021832111871f46bbce7edb0806944b4247b5d0 code build failed on Fedora19

2014-06-19 Thread Dwight Engen
On Thu, 19 Jun 2014 20:53:42 + Serge Hallyn wrote: > Quoting Dwight Engen (dwight.en...@oracle.com): > > On Thu, 19 Jun 2014 14:16:28 + > > Serge Hallyn wrote: > > > > > Quoting Stéphane Graber (stgra...@ubuntu.com): > > > > On Thu, Jun 19

Re: [lxc-devel] [PATCH 1/2] allow lxc.cap.keep = none

2014-06-19 Thread Dwight Engen
On Thu, 19 Jun 2014 20:48:27 + Serge Hallyn wrote: > Quoting Dwight Engen (dwight.en...@oracle.com): > > On Thu, 19 Jun 2014 19:45:14 + > > Serge Hallyn wrote: > > > > > Quoting Dwight Engen (dwight.en...@oracle.com): > > > > On Thu, 19 Ju

[lxc-devel] [PATCH v2] allow lxc.cap.keep = none

2014-06-19 Thread Dwight Engen
special value "none" to be given, which will clear all keep capabilities parsed up to this point. If the last parsed value is none, all capabilities will be dropped. Signed-off-by: Dwight Engen --- v2: implement as 'last wins' so none can be specified after caps, or vice

Re: [lxc-devel] [PATCH 1/2] allow lxc.cap.keep = none

2014-06-19 Thread Dwight Engen
On Thu, 19 Jun 2014 19:45:14 + Serge Hallyn wrote: > Quoting Dwight Engen (dwight.en...@oracle.com): > > On Thu, 19 Jun 2014 16:32:18 + > > Serge Hallyn wrote: > > > > > Quoting Dwight Engen (dwight.en...@oracle.com): > > > > On Thu, 19 Ju

Re: [lxc-devel] commit d021832111871f46bbce7edb0806944b4247b5d0 code build failed on Fedora19

2014-06-19 Thread Dwight Engen
On Thu, 19 Jun 2014 14:16:28 + Serge Hallyn wrote: > Quoting Stéphane Graber (stgra...@ubuntu.com): > > On Thu, Jun 19, 2014 at 04:14:25PM +0800, simonjin wrote: > > > All, > > > > > > gcc -I../../src -DLXCROOTFSMOUNT=\"/usr/lib64/lxc/rootfs\" > > > -DLXCPATH=\"/usr/var/lib/lxc\" > > > -DLXC

[lxc-devel] [PATCH] split -lcap and -lselinux out of LIBS

2014-06-19 Thread Dwight Engen
Signed-off-by: Dwight Engen --- configure.ac| 6 +++--- src/lxc/Makefile.am | 4 ++-- 2 files changed, 5 insertions(+), 5 deletions(-) diff --git a/configure.ac b/configure.ac index 8f5d21c..37eb9d5 100644 --- a/configure.ac +++ b/configure.ac @@ -218,8 +218,8 @@ fi AM_CONDITIONAL

Re: [lxc-devel] [PATCH 1/2] allow lxc.cap.keep = none

2014-06-19 Thread Dwight Engen
On Thu, 19 Jun 2014 16:32:18 + Serge Hallyn wrote: > Quoting Dwight Engen (dwight.en...@oracle.com): > > On Thu, 19 Jun 2014 14:23:40 + > > Serge Hallyn wrote: > > > > > Quoting Dwight Engen (dwight.en...@oracle.com): > > > > Commit 1fb8

Re: [lxc-devel] [PATCH 1/2] allow lxc.cap.keep = none

2014-06-19 Thread Dwight Engen
On Thu, 19 Jun 2014 14:23:40 + Serge Hallyn wrote: > Quoting Dwight Engen (dwight.en...@oracle.com): > > Commit 1fb86a7c introduced a way to drop capabilities without > > having to specify them all explicitly. Unfortunately, there is no > > way to drop them all, as jus

[lxc-devel] [PATCH 2/2] don't force dropping capabilities in lxc-init

2014-06-19 Thread Dwight Engen
ding prctl PR_CAPBSET_DROP in a loop from 0 to CAP_LAST_CAP would fix this, but I don't think its necessary to forcefully clear all capabilities since users can now specify lxc.cap.keep = none to drop all capabilities. Signed-off-by: Dwight Engen --- src/lxc/caps.c | 19 ---

[lxc-devel] [PATCH 1/2] allow lxc.cap.keep = none

2014-06-19 Thread Dwight Engen
special value "none" to be given, which will drop all capabilities. If "none" and some other valid capability are both specified, the "none" is ignored and the valid capability is kept. Signed-off-by: Dwight Engen --- doc/lxc.container.conf.sgml.in | 3 ++- src/

Re: [lxc-devel] No libcap.a on Fedora and derived distros

2014-06-19 Thread Dwight Engen
On Mon, 9 Jun 2014 18:51:53 + Serge Hallyn wrote: > Quoting Stéphane Graber (stgra...@ubuntu.com): > > On Mon, Jun 09, 2014 at 02:34:07PM -0400, Dwight Engen wrote: > > > On Mon, 9 Jun 2014 14:14:31 -0400 > > > Stéphane Graber wrote: > > > > > &g

Re: [lxc-devel] [lxc-users] Container escape through open_by_handle_at (shocker exploit)

2014-06-18 Thread Dwight Engen
On Wed, 18 Jun 2014 14:11:49 -0400 Stéphane Graber wrote: > Just fixing lxc-devel's e-mail address, it turns out that e-mails work > better when you don't forget the tld :) > > So, lxc-devel subscribers, see below: > > On Wed, Jun 18, 2014 at 01:41:19PM -0400, Stéphane Graber wrote: > > TL;DR:

Re: [lxc-devel] LXC 1.0.4 approaching

2014-06-10 Thread Dwight Engen
On Mon, 9 Jun 2014 11:06:03 -0400 Stéphane Graber wrote: > Hey there, > > I just pushed Mike's lxc-autostart change to 1.0.4 as it was requested > by both him (for Fedora) and Dwight (for Oracle). > > There's one more crasher in the python3 binding I'd like to sort out > and then I think I'll b

Re: [lxc-devel] No libcap.a on Fedora and derived distros

2014-06-09 Thread Dwight Engen
On Mon, 9 Jun 2014 14:14:31 -0400 Stéphane Graber wrote: > On Mon, Jun 09, 2014 at 02:10:36PM -0400, Dwight Engen wrote: > > Hi, > > > > I ran into a bit of a problem building master: > > Fedora (and derived distro's such as CentOs, Oracle, RHEL) don't

[lxc-devel] No libcap.a on Fedora and derived distros

2014-06-09 Thread Dwight Engen
Hi, I ran into a bit of a problem building master: Fedora (and derived distro's such as CentOs, Oracle, RHEL) don't ship with a static lib for libcap, which is needed to build init.lxc.static (commit 2d4b3e3d). Apparently [1] Fedora doesn't intend to ship one, thus there isn't a libcap-static. Any

Re: [lxc-devel] Cherry-picking to stable-1.0

2014-06-05 Thread Dwight Engen
On Wed, 04 Jun 2014 19:04:03 -0400 "Michael H. Warfield" wrote: > On Wed, 2014-06-04 at 17:41 -0400, Stéphane Graber wrote: > > On Wed, Jun 04, 2014 at 05:32:37PM -0400, Michael H. Warfield wrote: > > > On Wed, 2014-04-30 at 15:47 -0400, Stéphane Graber wrote: > > > > Hello, > > > > > > > I inte

Re: [lxc-devel] [PATCH RFC] Allow a few basic limits to be set at creation / runtime

2014-05-29 Thread Dwight Engen
On Thu, 29 May 2014 08:40:01 +0200 Stéphane Graber wrote: > On Wed, May 28, 2014 at 03:58:07PM +, Serge Hallyn wrote: > > Quoting Dwight Engen (dwight.en...@oracle.com): > > > On Wed, 28 May 2014 14:51:55 + > > > Serge Hallyn wrote: > > > >

Re: [lxc-devel] [PATCH RFC] Allow a few basic limits to be set at creation / runtime

2014-05-28 Thread Dwight Engen
On Wed, 28 May 2014 14:51:55 + Serge Hallyn wrote: > Quoting Dwight Engen (dwight.en...@oracle.com): > > Currently, a user has to read kernel/Documentation/cgroups/* to > > know what is available and then apply these using lxc-cgroups to > > set runtime limits, or hand e

[lxc-devel] [PATCH RFC] Allow a few basic limits to be set at creation / runtime

2014-05-27 Thread Dwight Engen
oduce config_cgroup_find to find an already set cgroup item, and use it in config_cgroup() to replace a value instead of appending another entry. This means that (in for example lxc-clone) only the last duplicate entry will now be written out. Signed-off-by: Dwight Engen --- .gitignore | 1 +

[lxc-devel] [PATCH] point user to updated man page in template boilerplate

2014-05-27 Thread Dwight Engen
Signed-off-by: Dwight Engen --- src/lxc/lxccontainer.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/lxc/lxccontainer.c b/src/lxc/lxccontainer.c index 8e611c7..ac6de62 100644 --- a/src/lxc/lxccontainer.c +++ b/src/lxc/lxccontainer.c @@ -1170,7 +1170,7 @@ static bool

[lxc-devel] [PATCH] lxc-oracle: fix ssh login under libvirt-lxc

2014-05-20 Thread Dwight Engen
Signed-off-by: Dwight Engen --- templates/lxc-oracle.in | 2 ++ 1 file changed, 2 insertions(+) diff --git a/templates/lxc-oracle.in b/templates/lxc-oracle.in index 8a8c821..7a704e6 100644 --- a/templates/lxc-oracle.in +++ b/templates/lxc-oracle.in @@ -129,6 +129,8 @@ EOF fi sed -i &#

Re: [lxc-devel] lxc on openSUSE: lxc-top not working due to lua?

2014-05-20 Thread Dwight Engen
On Tue, 20 May 2014 21:24:57 +0200 Johannes Kastl wrote: > -BEGIN PGP SIGNED MESSAGE- > Hash: SHA1 > > First of all, > > John, thanks for the answer and the link. > > On 19.05.2014 22:57 Michael H. Warfield wrote: > > > Nice! I love these sorts of discussions. I learn so much shit.

[lxc-devel] [PATCH] lxc-oracle: set hostname with systemd

2014-05-20 Thread Dwight Engen
Signed-off-by: Dwight Engen --- templates/lxc-oracle.in | 4 1 file changed, 4 insertions(+) diff --git a/templates/lxc-oracle.in b/templates/lxc-oracle.in index 2fa289b..8a8c821 100644 --- a/templates/lxc-oracle.in +++ b/templates/lxc-oracle.in @@ -340,6 +340,10 @@ TYPE=Ethernet EOF

[lxc-devel] [PATCH] lxc-oracle: add pts/[1-4] to securetty for libvirt-lxc

2014-05-19 Thread Dwight Engen
one else trying that scenario. Below is the backport to stable of 5f2ea8cfcb8ccd9bbb7cf18e1e260044f3f6dcaf and 7e4ca1a21debdf0d04285446e4dbff5d8647b2d3 (follow up fix to it) rolled into one if you choose to apply. -->8 Don't spawn a getty on /dev/console when running under libvi

[lxc-devel] [PATCH] remove TODO file with old item in it

2014-05-19 Thread Dwight Engen
éphane Graber Stéphane, I agree with your reasoning. Just thought I'd point out that Sheng may have done this because it was in the TODO file, which makes it a bit more unfortunate :( I had no idea this was in there, but I guess its been there since 2009, so maybe we should take it out

Re: [lxc-devel] lxc on openSUSE: lxc-top not working due to lua?

2014-05-19 Thread Dwight Engen
On Mon, 19 May 2014 22:10:24 +0200 Johannes Kastl wrote: > -BEGIN PGP SIGNED MESSAGE- > Hash: SHA1 > > On 19.05.2014 21:43 Dwight Engen wrote: > > >> Hi Johannes, the .spec file shouldn't need it, as it shouldn't > >> be present in bin

Re: [lxc-devel] lxc on openSUSE: lxc-top not working due to lua?

2014-05-19 Thread Dwight Engen
On Mon, 19 May 2014 19:47:27 + John Peacock wrote: > On Mon, 2014-05-19 at 15:43 -0400, Dwight Engen wrote: > > If you have it, then it seems likely that lua was enabled when you > > built your packages, but of course it won't run if lxc-lua isn't > > instal

Re: [lxc-devel] lxc on openSUSE: lxc-top not working due to lua?

2014-05-19 Thread Dwight Engen
On Mon, 19 May 2014 20:56:58 +0200 Johannes Kastl wrote: > -BEGIN PGP SIGNED MESSAGE- > Hash: SHA1 > > Hello Michael, > > On 17.05.2014 21:10 Michael H. Warfield wrote: > > > If they used the LXC project's lxc.spec file then the lua stuff is > > in the lxc-lua package. It's broken out

Re: [lxc-devel] [PATCH] lxc.container.conf(5): update guidance for lxc.mount.entry mount target

2014-05-16 Thread Dwight Engen
On Fri, 16 May 2014 10:15:43 -0400 Serge Hallyn wrote: > For years it has been best practice to use a relative path as > the mount target. But the manpage hasn't reflect that. Fix it. > > Signed-off-by: Serge Hallyn Acked-by: Dwight Engen > --- > doc/lxc.cont

Re: [lxc-devel] [PATCH] lxc-oracle: export upstart environment variable for maygetty

2014-05-16 Thread Dwight Engen
On Fri, 16 May 2014 13:45:52 + Serge Hallyn wrote: > Quoting Dwight Engen (dwight.en...@oracle.com): > > This is a fix to commit 5f2ea8cfcb8ccd9bbb7cf18e1e260044f3f6dcaf. > > Sorry, not sure how I missed this in testing the original patch. > > > > Signed-off-by

Re: [lxc-devel] [PATCH 3/2] nbd: exit cleanly if nbd fails to attach

2014-05-16 Thread Dwight Engen
On Thu, 15 May 2014 15:26:48 + Serge Hallyn wrote: > Signed-off-by: Serge Hallyn Acked-by: Dwight Engen > --- > src/lxc/bdev.c | 10 +- > 1 file changed, 9 insertions(+), 1 deletion(-) > > diff --git a/src/lxc/bdev.c b/src/lxc/bdev.c > index e22d83d..1d9a2

[lxc-devel] [PATCH] lxc-oracle: export upstart environment variable for maygetty

2014-05-16 Thread Dwight Engen
This is a fix to commit 5f2ea8cfcb8ccd9bbb7cf18e1e260044f3f6dcaf. Sorry, not sure how I missed this in testing the original patch. Signed-off-by: Dwight Engen --- templates/lxc-oracle.in | 1 + 1 file changed, 1 insertion(+) diff --git a/templates/lxc-oracle.in b/templates/lxc-oracle.in index

Re: [lxc-devel] [PATCH 2/2] lxc.container.conf: document the type: lxc.rootfs conventions

2014-05-15 Thread Dwight Engen
On Thu, 15 May 2014 14:33:47 + Serge Hallyn wrote: > Signed-off-by: Serge Hallyn Acked-by: Dwight Engen > --- > doc/lxc.container.conf.sgml.in | 14 ++ > 1 file changed, 14 insertions(+) > > diff --git a/doc/lxc.container.conf.sgml.in > b/doc/lxc.c

Re: [lxc-devel] [PATCH 1/2] add support for nbd (v3)

2014-05-15 Thread Dwight Engen
e groundwork for trivial > implementation of qed and raw images. > > changelog (may 12): fix idx check at detach > changelog (may 15): generalize qcow2 to nbd > > Signed-off-by: Serge Hallyn Acked-by: Dwight Engen > --- > src/lxc/bdev.c | 293 > +++

Re: [lxc-devel] [PATCH v2] add support for qcow2

2014-05-15 Thread Dwight Engen
On Wed, 14 May 2014 19:59:11 + Serge Hallyn wrote: > Quoting Dwight Engen (dwight.en...@oracle.com): > > On Mon, 12 May 2014 18:02:28 + > > Serge Hallyn wrote: > > > > > qcow2 backing stores can be attached to a nbd block device using > > > q

Re: [lxc-devel] [PATCH v2] add support for qcow2

2014-05-14 Thread Dwight Engen
the full device node (/dev/nbd0) but not the partition nodes (/dev/nbd0p?) which caused lxc to hang on startup. At any rate, this works great so thanks and: Acked-by: Dwight Engen > Signed-off-by: Serge Hallyn > --- > src/lxc/bdev.c | 296 >

Re: [lxc-devel] [PATCH 2/3] execute: bind init.lxc.static into container

2014-05-13 Thread Dwight Engen
On Tue, 13 May 2014 11:46:00 + Serge Hallyn wrote: > Quoting Serge Hallyn (serge.hal...@ubuntu.com): > > Quoting Dwight Engen (dwight.en...@oracle.com): > > > On Mon, 12 May 2014 18:04:00 + > > > Serge Hallyn wrote: > > > > > > > Signe

Re: [lxc-devel] [PATCH 2/3] execute: bind init.lxc.static into container

2014-05-12 Thread Dwight Engen
On Mon, 12 May 2014 18:04:00 + Serge Hallyn wrote: > Signed-off-by: Serge Hallyn > --- > src/lxc/conf.c | 58 > ++ 1 file > changed, 58 insertions(+) > > diff --git a/src/lxc/conf.c b/src/lxc/conf.c > index 7427a94..0580f46 100644 > --

[lxc-devel] [PATCH] lxc-oracle: add pts/[1-4] to securetty for libvirt-lxc

2014-05-12 Thread Dwight Engen
Don't spawn a getty on /dev/console when running under libvirt-lxc Signed-off-by: Dwight Engen --- templates/lxc-oracle.in | 30 +++--- 1 file changed, 23 insertions(+), 7 deletions(-) diff --git a/templates/lxc-oracle.in b/templates/lxc-oracle.in index 4a4df18..1c

Re: [lxc-devel] [lxc/lxc] 31efc3: archlinux template: added sigpwr handling to syste...

2014-05-07 Thread Dwight Engen
On Wed, 7 May 2014 15:50:00 -0500 Leonid Isaev wrote: > Hi, > > On Wed, 7 May 2014 13:25:04 -0500 > Stéphane Graber wrote: > > > On Wed, May 07, 2014 at 01:11:39PM -0500, Leonid Isaev wrote: > > > Hi, > > > > > > Unless I am missing something, I see multiple issues with > > > this change: >

Re: [lxc-devel] missing shebang or wrong permissions in lxc-patch.py

2014-05-07 Thread Dwight Engen
On Wed, 07 May 2014 20:56:31 +0200 Johannes Kastl wrote: > -BEGIN PGP SIGNED MESSAGE- > Hash: SHA1 > > Am 06.05.2014 22:14 schrieb Michael H. Warfield: > > > Ah what? First you're talking about openSUSE then you're asking > > about Fedora? I'm confused. The answer is, yes, Fedora has

[lxc-devel] [PATCH] remove assert since hwaddr isn't set by the download template

2014-05-07 Thread Dwight Engen
Signed-off-by: Dwight Engen --- src/python-lxc/examples/api_test.py | 1 - 1 file changed, 1 deletion(-) diff --git a/src/python-lxc/examples/api_test.py b/src/python-lxc/examples/api_test.py index 9f935d7..7952197 100755 --- a/src/python-lxc/examples/api_test.py +++ b/src/python-lxc/examples

[lxc-devel] [PATCH] install lxc-patch.py 644 to fix rpmlint warning

2014-05-07 Thread Dwight Engen
Signed-off-by: Dwight Engen --- config/yum/Makefile.am | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/config/yum/Makefile.am b/config/yum/Makefile.am index fb9c3bd..b77ae6f 100644 --- a/config/yum/Makefile.am +++ b/config/yum/Makefile.am @@ -1,6 +1,6 @@ yumpluginsdir

  1   2   3   >