← Back to branch summary

~ubuntu-branches/ubuntu/quantal/lxc/quantal-201205292108

« back to all changes in this revision

Viewing changes to .pc/0063-check-apparmor-enabled/src/lxc/start.c

  • Committer: Package Import Robot
  • Author(s): Serge Hallyn
  • Date: 2012-04-26 15:18:35 UTC
  • mfrom: (3.1.41 sid)
  • Revision ID: package-import@ubuntu.com-20120426151835-3vz6kb4m90gb26js
Tags: 0.8.0~rc1-4ubuntu1
https://launchpad.net/bugs/988918
https://launchpad.net/bugs/981955
* Merge from unstable.  Remaining changes:
  - control:
    - update maintainer
    - Build-Depends: add dh-apparmor and libapparmor-dev
    - lxc Depends: add bridge-utils, dnsmasq-base, iptables, rsync
    - lxc Recommends: add cgroup-lite | cgroup-bin, openssl
    - lxc Suggests: add btrfs-tools, lvm2, qemu-user-static
    - lxc Conflicts: remove (cgroup-bin)
  - Add lxc-start-ephemeral and lxc-wait to debian/local
  - apparmor:
    - add lxc.apparmor, lxc-containers.apparmor,
      lxc-default.apparmor, and new lxc.apparmor.in
  - add debian/lxc.conf (default container creation config file)
  - debian/lxc.install.in:
    * add lxc-start-ephemeral
    * add debian/lxc.conf
    * skip lxc-debconf*
    * skip lxc-ls (Use upstream's)
  - debian/lxc*.install.in: use '*', not @DEB_HOST_MULTIARCH@
  - Use our own completely different lxc.postinst and lxc.postrm
  - remove lxc.templates
  - debian/rules:
    * add DEB_DH_INSTALLINIT_ARGS = --upstart-only
    * don't do debconf stuff
    * add debian/*.apparmor.in to files processed under
      override_dh_auto_clean
    * don't comment out ubuntu or busybox templates
    * do apparmor stuff and install our own lxc-wait under override_dh_install
    * install our upstart scripts in override_dh_installinit
  - add lxc.default, lxc.lxc-net.upstart, lxc.upstart under
    debian/

* patches kept:
  - 0013-lxc-create-use-default-config.patch (needed manual rebase)
  - 0030-ubuntu-template-fail.patch
  - 0031-ubuntu-template-resolvconf.patch
  - 0044-lxc-destroy-rm-autos
  - debian/patches/0045-fix-other-templates
  - debian/patches/0046-lxc-clone-change-hwaddr
  - debian/patches/0047-bindhome-check-shell
  - debian/patches/0049-ubuntu-template-sudo-and-cleanup
  - debian/patches/0050-clone-lvm-sizes
  - debian/patches/0052-ubuntu-bind-user-conflict
  - debian/patches/0053-lxc-start-pin-rootfs
  - debian/patches/0054-ubuntu-debug
  - debian/patches/0055-ubuntu-handle-badgrp
  - debian/patches/0056-dont-watch-utmp
  - debian/patches/0057-update-manpages
  - debian/patches/0058-fixup-ubuntu-cloud
  - debian/patches/0059-reenable-daily-cloudimg
  - debian/patches/0060-lxc-shutdown
  - debian/patches/0061-lxc-start-apparmor
  - debian/patches/0062-templates-relative-paths
  - debian/patches/0063-check-apparmor-enabled
  - debian/patches/0064-apparmor-mount-proc
  - debian/patches/0065-fix-bindhome-relpath
  - debian/patches/0066-confile-typo
  - debian/patches/0067-templates-lxc-profile
  - debian/patches/0068-fix-lxc-config-layout 
  - debian/patches/0069-ubuntu-cloud-fix
  - debian/patches/0070-templates-rmdir-dev-shm
  - debian/patches/0071-ubuntu-cloud-fix-image-extraction
  - debian/patches/0072-lxc-shutdown-help
  - debian/patches/0073-lxc-destroy-waits-before-destroy
  - mark all patches which have been forwarded as such, refresh all
* 0074-lxc-execute-find-init: lxc-init had moved.  Introduce a function in
  lxc-execute to go find it.  Otherwise lxc-execute for any older releases
  will fail.
* 0075-lxc-ls-bash: lxc-ls needs bash, not sh
* add debian/lxc.apparmor.in so DEB_HOST_MULTIARCH can be expanded
* 0076-fix-sprintfs:  - check return values for all sprintfs and snprintfs
  which could overflow (LP: #988918)
* 0077-execute-without-rootfs: let lxc-execute succeed with no rootfs
  (LP: #981955)

Show diffs side-by-side

added added

removed removed

Lines of Context:
.pc/0063-check-apparmor-enabled/src/lxc/start.c
21
21
 * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
22
22
 */
23
23
 
24
 
#include "../config.h"
 
24
#include "config.h"
 
25
 
25
26
#include <stdio.h>
26
27
#undef _GNU_SOURCE
27
28
#include <string.h>
32
33
#include <signal.h>
33
34
#include <fcntl.h>
34
35
#include <termios.h>
35
 
#include <namespace.h>
36
36
#include <sys/param.h>
37
37
#include <sys/file.h>
38
38
#include <sys/mount.h>
126
126
#include "commands.h"
127
127
#include "console.h"
128
128
#include "sync.h"
 
129
#include "namespace.h"
129
130
 
130
131
lxc_log_define(lxc_start, lxc);
131
132
 
132
 
LXC_TTY_HANDLER(SIGINT);
133
 
LXC_TTY_HANDLER(SIGQUIT);
134
 
 
135
133
static int match_fd(int fd)
136
134
{
137
135
        return (fd == 0 || fd == 1 || fd == 2);
142
140
        struct dirent dirent, *direntp;
143
141
        int fd, fddir;
144
142
        DIR *dir;
145
 
        int ret = 0;
146
143
 
147
144
restart:
148
145
        dir = opendir("/proc/self/fd");
154
151
        fddir = dirfd(dir);
155
152
 
156
153
        while (!readdir_r(dir, &dirent, &direntp)) {
157
 
                char procpath[64];
158
 
                char path[PATH_MAX];
159
 
                int gotpath = 1;
160
 
 
161
154
                if (!direntp)
162
155
                        break;
163
156
 
175
168
                if (match_fd(fd))
176
169
                        continue;
177
170
 
178
 
                snprintf(procpath, sizeof(procpath), "/proc/self/fd/%d", fd);
179
 
                if (readlink(procpath, path, sizeof(path)) == -1)
180
 
                        gotpath = 0;
181
 
 
182
 
                /*
183
 
                 * found inherited fd
184
 
                 */
185
 
 
186
171
                if (conf->close_all_fds) {
187
 
                        if (!gotpath)
188
 
                                INFO("closing inherited fd %d\n", fd);
189
 
                        else
190
 
                                INFO("closing inherited fd %d (%s)", fd, path);
191
172
                        close(fd);
192
173
                        closedir(dir);
 
174
                        INFO("closed inherited fd %d", fd);
193
175
                        goto restart;
194
176
                }
195
 
 
196
 
                ret = -1;
197
 
 
198
 
                snprintf(procpath, sizeof(procpath), "/proc/self/fd/%d", fd);
199
 
 
200
 
                if (!gotpath)
201
 
                        ERROR("readlink(%s) failed : %m", procpath);
202
 
                else
203
 
                        ERROR("inherited fd %d on %s", fd, path);
 
177
                WARN("inherited fd %d", fd);
204
178
        }
205
179
 
206
 
        if (closedir(dir))
207
 
                ERROR("failed to close directory");
208
 
        return ret;
 
180
        closedir(dir); /* cannot fail */
 
181
        return 0;
209
182
}
210
183
 
211
184
static int setup_signal_fd(sigset_t *oldmask)
627
600
 
628
601
                clone_flags |= CLONE_NEWNET;
629
602
 
 
603
                /* Find gateway addresses from the link device, which is
 
604
                 * no longer accessible inside the container. Do this
 
605
                 * before creating network interfaces, since goto
 
606
                 * out_delete_net does not work before lxc_clone. */
 
607
                if (lxc_find_gateway_addresses(handler)) {
 
608
                        ERROR("failed to find gateway addresses");
 
609
                        lxc_sync_fini(handler);
 
610
                        return -1;
 
611
                }
 
612
 
630
613
                /* that should be done before the clone because we will
631
614
                 * fill the netdev index and use them in the child
632
615
                 */
637
620
                }
638
621
        }
639
622
 
640
 
 
641
623
        /*
642
624
         * if the rootfs is not a blockdev, prevent the container from
643
625
         * marking it readonly.
735
717
                goto out_fini;
736
718
        }
737
719
 
738
 
        /* Avoid signals from terminal */
739
 
        LXC_TTY_ADD_HANDLER(SIGINT);
740
 
        LXC_TTY_ADD_HANDLER(SIGQUIT);
741
 
 
742
720
        err = lxc_poll(name, handler);
743
721
        if (err) {
744
722
                ERROR("mainloop exited with an error");
771
749
 
772
750
        err =  lxc_error_set_and_log(handler->pid, status);
773
751
out_fini:
774
 
        LXC_TTY_DEL_HANDLER(SIGQUIT);
775
 
        LXC_TTY_DEL_HANDLER(SIGINT);
776
752
        lxc_cgroup_destroy(name);
777
753
        lxc_fini(name, handler);
778
754
        return err;