[lxc-devel] [PATCH v2 1/1] support shmmax/shmall KEY for lxc-execute
Serge Hallyn
serge.hallyn at canonical.com
Sun Jul 8 03:13:39 UTC 2012
Quoting jian at linux.vnet.ibm.com (jian at linux.vnet.ibm.com):
> From: Jian Xiao <jian at linux.vnet.ibm.com>
>
> Signed-off-by: Jian Xiao <jian at linux.vnet.ibm.com>
Thanks, Jian. Looks great.
Acked-by: Serge Hallyn <serge.hallyn at ubuntu.com>
-serge
> ---
> src/lxc/conf.c | 77 +++++++++++++++++++++++++++++++++++++++++++++++++++++
> src/lxc/conf.h | 2 +
> src/lxc/confile.c | 32 ++++++++++++++++++++++
> 3 files changed, 111 insertions(+), 0 deletions(-)
>
> diff --git a/src/lxc/conf.c b/src/lxc/conf.c
> index e8088bb..3988b2a 100644
> --- a/src/lxc/conf.c
> +++ b/src/lxc/conf.c
> @@ -1285,6 +1285,78 @@ static int setup_caps(struct lxc_list *caps)
> return 0;
> }
>
> +static int shm_write(const char *pathname, unsigned long val)
> +{
> + int rc, fd;
> + char val_str[64];
> +
> + fd = open(pathname, O_WRONLY);
> + if (fd < 0) {
> + SYSERROR("fail to open %s", pathname);
> + return -1;
> + }
> +
> + snprintf(val_str, sizeof(val_str), "%lu", val);
> +
> + rc = write(fd, val_str, strlen(val_str));
> + if (rc < 0) {
> + SYSERROR("fail to write %s to %s", val_str, pathname);
> + close(fd);
> + return -1;
> + }
> +
> + close(fd);
> +
> + DEBUG("%s has been set to %lu\n", pathname, val);
> +
> + return 0;
> +
> +}
> +
> +static int setup_shm(struct lxc_conf *lxc_conf)
> +{
> + int rc = 0;
> + uid_t euid = geteuid();
> +
> + if ((!lxc_conf->shmmax) && (!lxc_conf->shmall))
> + return 0;
> +
> + /* Process has all the capabilities set, but cannot open shm*
> + * to write. Temporarily set euid to root to get around this.
> + * This is only done for non-root uid.
> + */
> + if (euid && seteuid(0)) {
> + SYSERROR("failed to change euid to 0\n");
> + return -1;
> + }
> +
> + if (lxc_conf->shmmax &&
> + shm_write("/proc/sys/kernel/shmmax", lxc_conf->shmmax))
> + rc = -1;
> +
> + if (lxc_conf->shmall &&
> + shm_write("/proc/sys/kernel/shmall", lxc_conf->shmall))
> + rc = -1;
> +
> + /* set euid back */
> + if (euid) {
> + if (seteuid(euid)) {
> + ERROR("failed to change euid to '%d': %m", euid);
> + return -1;
> + }
> +
> + /* seteuid() to non-zero clears effective capabilities
> + * so we need to restore them
> + */
> + if (lxc_caps_up()) {
> + ERROR("failed to restore capabilities: %m");
> + return -1;
> + }
> + }
> +
> + return rc;
> +}
> +
> static int setup_hw_addr(char *hwaddr, const char *ifname)
> {
> struct sockaddr sockaddr;
> @@ -2027,6 +2099,11 @@ int lxc_setup(const char *name, struct lxc_conf *lxc_conf)
> return -1;
> }
>
> + if (setup_shm(lxc_conf)) {
> + ERROR("failed to set shm");
> + return -1;
> + }
> +
> if (setup_pivot_root(&lxc_conf->rootfs)) {
> ERROR("failed to set rootfs for '%s'", name);
> return -1;
> diff --git a/src/lxc/conf.h b/src/lxc/conf.h
> index 09f55cb..b443326 100644
> --- a/src/lxc/conf.h
> +++ b/src/lxc/conf.h
> @@ -216,6 +216,8 @@ struct lxc_conf {
> struct lxc_rootfs rootfs;
> char *ttydir;
> int close_all_fds;
> + unsigned long shmmax;
> + unsigned long shmall;
> };
>
> /*
> diff --git a/src/lxc/confile.c b/src/lxc/confile.c
> index b305aef..f71f4c7 100644
> --- a/src/lxc/confile.c
> +++ b/src/lxc/confile.c
> @@ -71,6 +71,8 @@ static int config_network_ipv6(const char *, char *, struct lxc_conf *);
> static int config_network_ipv6_gateway(const char *, char *, struct lxc_conf *);
> static int config_cap_drop(const char *, char *, struct lxc_conf *);
> static int config_console(const char *, char *, struct lxc_conf *);
> +static int config_shmmax(const char *, char *, struct lxc_conf *);
> +static int config_shmall(const char *, char *, struct lxc_conf *);
>
> typedef int (*config_cb)(const char *, char *, struct lxc_conf *);
>
> @@ -107,6 +109,8 @@ static struct config config[] = {
> { "lxc.network.ipv6", config_network_ipv6 },
> { "lxc.cap.drop", config_cap_drop },
> { "lxc.console", config_console },
> + { "lxc.shmmax", config_shmmax },
> + { "lxc.shmall", config_shmall },
> };
>
> static const size_t config_size = sizeof(config)/sizeof(struct config);
> @@ -876,6 +880,34 @@ static int config_utsname(const char *key, char *value, struct lxc_conf *lxc_con
> return 0;
> }
>
> +static int config_shmmax(const char *key, char *value, struct lxc_conf *lxc_conf)
> +{
> + if (!strlen(value))
> + return -1;
> +
> + errno = 0;
> + lxc_conf->shmmax = strtoul(value, NULL, 0);
> + if (errno) {
> + SYSERROR("failed to strtoul '%s'", value);
> + return -1;
> + }
> + return 0;
> +}
> +
> +static int config_shmall(const char *key, char *value, struct lxc_conf *lxc_conf)
> +{
> + if (!strlen(value))
> + return -1;
> +
> + errno = 0;
> + lxc_conf->shmall = strtoul(value, NULL, 0);
> + if (errno) {
> + SYSERROR("failed to strtoul '%s'", value);
> + return -1;
> + }
> + return 0;
> +}
> +
> static int parse_line(char *buffer, void *data)
> {
> struct config *config;
> --
> 1.7.1
>
>
> ------------------------------------------------------------------------------
> Live Security Virtual Conference
> Exclusive live event will cover all the ways today's security and
> threat landscape has changed and how IT managers can respond. Discussions
> will include endpoint security, mobile security and the latest in malware
> threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/
> _______________________________________________
> Lxc-devel mailing list
> Lxc-devel at lists.sourceforge.net
> https://lists.sourceforge.net/lists/listinfo/lxc-devel
More information about the lxc-devel
mailing list