[lxc-devel] [lxc/lxc] a1b624: lxc-download: Detect unpriv created by real root

[GitHub]

  Branch: refs/heads/master
  Home:   https://github.com/lxc/lxc
  Commit: a1b6244eb510affcd448a9ddf25603e532f4dec6
      https://github.com/lxc/lxc/commit/a1b6244eb510affcd448a9ddf25603e532f4dec6
  Author: Stéphane Graber <stgraber at ubuntu.com>
  Date:   2014-02-26 (Wed, 26 Feb 2014)

  Changed paths:
    M templates/lxc-download.in

  Log Message:
  -----------
  lxc-download: Detect unpriv created by real root

This adds yet another case in the in_userns function detecting the case
where an unprivileged container is created by the real uid 0, in which
case we want to share the system wide cache but still use the
unprivileged templates and unpack method.

Signed-off-by: Stéphane Graber <stgraber at ubuntu.com>
Acked-by: Serge E. Hallyn <serge.hallyn at ubuntu.com>


  Commit: c661b0a8fe9ea261862c5fb72835dd3a59e8cf96
      https://github.com/lxc/lxc/commit/c661b0a8fe9ea261862c5fb72835dd3a59e8cf96
  Author: Dwight Engen <dwight.engen at oracle.com>
  Date:   2014-02-26 (Wed, 26 Feb 2014)

  Changed paths:
    M src/lxc/cgfs.c

  Log Message:
  -----------
  fix attach when cgroups mounted after container start

When booting an OL7 container on OL6, systemd in the OL7 container mounted
some extra cgroup controllers, which are then present in /proc/self/cgroups
of every task on the host. This is the list used by attach to determine
which cgroups to move the attached task into, but when it asks the container
over the command interface for the path to the subsystem this will fail
since the controller didn't exist when the container was first started.

Instead of failing, this change allows the attach to continue, warning that
those cgroups that could not be found won't be attached to.

The problem can be more simply reproduced by starting a busybox container,
mounting a cgroup that was not previously mounted, and then attempting
to attach to to the busybox container.

The problem will likely not manifest with cgmanager since it only requests
the path for the first controller, which is likely to always be mounted.

Signed-off-by: Dwight Engen <dwight.engen at oracle.com>
Acked-by: Serge E. Hallyn <serge.hallyn at ubuntu.com>


Compare: https://github.com/lxc/lxc/compare/d4b621a52e92...c661b0a8fe9e