Commit graph

1609 commits

Author SHA1 Message Date
Guillaume J. Charmes
b6344f992e Merge pull request #5448 from crosbymichael/selinux-defaults
Add selinux label support for processes and mount
2014-04-30 14:14:39 -07:00
Michael Crosby
4b772dcb94 Merge pull request #5506 from crosbymichael/add-system-maintainer
Add system maintainers
2014-04-30 14:14:21 -07:00
Michael Crosby
8e22ca2eed Merge pull request #5464 from tianon/close-leftover-fds 2014-04-30 12:27:52 -07:00
Michael Crosby
81479222ec Add system maintainers
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-04-30 12:01:06 -07:00
Bryan Matsuo
3c1ad30029 FIXES #5398: pkg/graphdb build only dependent on cgo tag
Docker-DCO-1.1-Signed-off-by: Bryan Matsuo <bryan.matsuo@gmail.com> (github: bmatsuo)
2014-04-30 11:57:10 -06:00
Tianon Gravi
f4cb0afb99 Fix various MAINTAINERS format inconsistencies
Docker-DCO-1.1-Signed-off-by: Andrew Page <admwiggin@gmail.com> (github: tianon)
2014-04-30 11:22:11 -06:00
Alexander Larsson
31e3d94a4f beam: Add more tests to unix_test.go
These are failing, and indicate things that need to be fixed.  The
primarily problem is the lack of framing between beam messages.

Docker-DCO-1.1-Signed-off-by: Alexander Larsson <alexl@redhat.com> (github: alexlarsson)
[solomon@docker.com: rebased on master]
Signed-off-by: Solomon Hykes <solomon@docker.com>
2014-04-30 02:10:09 -07:00
Tianon Gravi
8071676601 Update pkg/apparmor to provide a better error message when apparmor_parser cannot be found
Docker-DCO-1.1-Signed-off-by: Andrew Page <admwiggin@gmail.com> (github: tianon)
2014-04-29 23:19:21 -06:00
Tianon Gravi
c1dad4d063 Close extraneous file descriptors in containers
Without this patch, containers inherit the open file descriptors of the daemon, so my "exec 42>&2" allows us to "echo >&42 some nasty error with some bad advice" directly into the daemon log. :)

Also, "hack/dind" was already doing this due to issues caused by the inheritance, so I'm removing that hack too since this patch obsoletes it by generalizing it for all containers.

Docker-DCO-1.1-Signed-off-by: Andrew Page <admwiggin@gmail.com> (github: tianon)
2014-04-29 16:45:28 -06:00
Michael Crosby
b8de4afa9d Merge pull request #5476 from rjnagal/libcontainer-fixes
Cleanup cgroups on Set failures
2014-04-29 12:27:31 -07:00
Rohit Jnagal
592fd56d49 Cleanup existing controllers when cleanup fails mid-way.
Docker-DCO-1.1-Signed-off-by: Rohit Jnagal <jnagal@google.com> (github: rjnagal)
2014-04-29 18:59:20 +00:00
Michael Crosby
7b566eab43 Add mountlabel to dev
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-04-29 03:41:44 -07:00
Michael Crosby
50cc71ca29 Update process labels to be set at create not start
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-04-29 03:40:05 -07:00
Dan Walsh
2b713061f5 Fix SELinux errors caused by multi-threading
Occasionally the selinux_test program will fail because we are setting file
context based on the Process ID but not the TID.  THis change will always
use the TID to set SELinux labels.

Docker-DCO-1.1-Signed-off-by: Daniel Walsh <dwalsh@redhat.com> (github: rhatdan)
Docker-DCO-1.1-Signed-off-by: Dan Walsh <dwalsh@redhat.com> (github: crosbymichael)
2014-04-29 03:40:05 -07:00
Dan Walsh
d0559e92af This patch reworks the SELinux patch to be only run on demand by the daemon
Added --selinux-enable switch to daemon to enable SELinux labeling.

The daemon will now generate a new unique random SELinux label when a
container starts, and remove it when the container is removed.   The MCS
labels will be stored in the daemon memory.  The labels of containers will
be stored in the container.json file.

When the daemon restarts on boot or if done by an admin, it will read all containers json files and reserve the MCS labels.

A potential problem would be conflicts if you setup thousands of containers,
current scheme would handle ~500,000 containers.

Docker-DCO-1.1-Signed-off-by: Dan Walsh <dwalsh@redhat.com> (github: rhatdan)
Docker-DCO-1.1-Signed-off-by: Dan Walsh <dwalsh@redhat.com> (github: crosbymichael)
2014-04-29 03:40:05 -07:00
Michael Crosby
48d893cc6b Initial work on selinux patch
This has every container using the docker daemon's pid for the processes
label so it does not work correctly.
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-04-29 03:40:05 -07:00
Michael Crosby
f6024af3e8 Merge pull request #5455 from rjnagal/cgroup-stats
Add throttling stats for cpu cgroup
2014-04-28 17:53:37 -07:00
Rohit Jnagal
ed65857dae Another test to check for invalid stats.
Docker-DCO-1.1-Signed-off-by: Rohit Jnagal <jnagal@google.com> (github: rjnagal)
2014-04-29 00:32:05 +00:00
Rohit Jnagal
51d9b2b0a0 Add cpu throttling stats.
Docker-DCO-1.1-Signed-off-by: Rohit Jnagal <jnagal@google.com> (github: rjnagal)
2014-04-29 00:18:18 +00:00
Michael Crosby
0d006205f0 Merge pull request #5451 from vmarmol/add-memory-stats
Adding a unit test for stats in pkg/cgroup/fs/memory.go
2014-04-28 16:38:34 -07:00
Victor Vieux
a94e54c65b Merge pull request #5449 from tianon/remove-libcontainer-root-special-case
Remove "root" and "" special cases in libcontainer
2014-04-28 16:29:08 -07:00
Rohit Jnagal
8cb62581de Merge branch 'master' into libcontainer-fixes
Conflicts:
	pkg/libcontainer/README.md
	pkg/libcontainer/container.json

Docker-DCO-1.1-Signed-off-by: Rohit Jnagal <jnagal@google.com> (github: rjnagal)
2014-04-28 23:04:04 +00:00
Victor Marmol
1749d97ee8 Adding a unit test for pkg/cgroup/fs/memory.go
Docker-DCO-1.1-Signed-off-by: Victor Marmol <vmarmol@google.com> (github: vmarmol)
2014-04-28 22:58:25 +00:00
Tianon Gravi
c54bc4ca04 Remove "root" and "" special cases in libcontainer
These are unnecessary since the user package handles these cases properly already (as evidenced by the LXC backend not having these special cases).

I also updated the errors returned to match the other libcontainer error messages in this same file.

Also, switching from Setresuid to Setuid directly isn't a problem, because the "setuid" system call will automatically do that if our own effective UID is root currently: (from `man 2 setuid`)

    setuid() sets the effective user ID of the calling process.  If the
    effective UID of the caller is root, the real UID and saved set-user-
    ID are also set.

Docker-DCO-1.1-Signed-off-by: Andrew Page <admwiggin@gmail.com> (github: tianon)
2014-04-28 16:46:03 -06:00
Michael Crosby
5479a8e86f Merge pull request #5412 from vmarmol/add-blkio-test
Adding a test for blkio stats.
2014-04-28 12:50:20 -07:00
Michael Crosby
9e0eab6aed Merge pull request #5394 from vmarmol/add-croup-memory-stats
Add memory usage and max usage stats.
2014-04-28 12:44:34 -07:00
Victor Marmol
a49cc7f252 Adding a test for blkio stats.
Also adds a test utility we can use for other cgroup tests.

Docker-DCO-1.1-Signed-off-by: Victor Marmol <vmarmol@google.com> (github: vmarmol)
2014-04-26 07:29:13 +00:00
unclejack
3a8c935a4d Merge pull request #5411 from crosbymichael/lockdown
Update default restrictions for exec drivers
2014-04-26 03:27:56 +03:00
Rohit Jnagal
030155d44d Updated sample config to be usable. We should change the namespace
config to not need "value" later.

Docker-DCO-1.1-Signed-off-by: Rohit Jnagal <jnagal@google.com> (github: rjnagal)
2014-04-25 21:10:23 +00:00
Rohit Jnagal
aeb186a0ba Updated sample config and README to match the default template for
native execdriver.

Docker-DCO-1.1-Signed-off-by: Rohit Jnagal <jnagal@google.com> (github: rjnagal)
2014-04-25 06:02:30 +00:00
Victor Marmol
38d7599ca3 Add memory usage and max usage stats.
Docker-DCO-1.1-Signed-off-by: Victor Marmol <vmarmol@google.com> (github: vmarmol)
2014-04-25 02:51:28 +00:00
Rohit Jnagal
c81ca6ef71 Improved README formatting.
Docker-DCO-1.1-Signed-off-by: Rohit Jnagal <jnagal@google.com> (github: rjnagal)
2014-04-25 01:23:48 +00:00
Rohit Jnagal
35c12256c7 Add enabled option to namespaces and capabilities spec in
container.json. Although we don't yet check for enabled everywhere.

Docker-DCO-1.1-Signed-off-by: Rohit Jnagal <jnagal@google.com> (github: rjnagal)
2014-04-25 01:10:11 +00:00
Rohit Jnagal
8173da962b Fix typos in nsinit logs.
Docker-DCO-1.1-Signed-off-by: Rohit Jnagal <jnagal@google.com> (github: rjnagal)
2014-04-25 00:20:14 +00:00
Rohit Jnagal
60159f9737 Fix container.json sample to be loadable by nsinit.
Docker-DCO-1.1-Signed-off-by: Rohit Jnagal <jnagal@google.com> (github: rjnagal)
2014-04-25 00:17:45 +00:00
Victor Marmol
bcfc527abb Separating cgroup Memory and MemoryReservation.
This will allow for these to be set independently. Keep the current Docker behavior where Memory and MemoryReservation are set to the value of Memory.

Docker-DCO-1.1-Signed-off-by: Victor Marmol <vmarmol@google.com> (github: vmarmol)
2014-04-24 11:09:38 -07:00
Michael Crosby
76a06effef Ignore isnot exists errors for proc paths
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-04-24 10:35:20 -07:00
Michael Crosby
2ecea22c8c Update init for new apparmor import path
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-04-24 10:35:20 -07:00
Michael Crosby
bd7c140c01 Update container.json and readme
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-04-24 10:35:20 -07:00
Michael Crosby
e40bde54a5 Move capabilities into security pkg
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-04-24 10:35:20 -07:00
Michael Crosby
454751e768 Move mounts into types.go
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-04-24 10:35:20 -07:00
Michael Crosby
824ee83816 Move rest of console functions to pkg
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-04-24 10:35:20 -07:00
Michael Crosby
a77846506b Refactor mounts into pkg to make changes easier
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-04-24 10:35:20 -07:00
Michael Crosby
323ea01c18 Move console into its own package
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-04-24 10:35:20 -07:00
Michael Crosby
cc900b9db8 Mount over dev and only copy allowed nodes in
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-04-24 10:35:20 -07:00
Michael Crosby
ef923907df No not mount sysfs by default for non privilged containers
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-04-24 10:35:20 -07:00
Michael Crosby
3d546f20db Add restrictions to proc in libcontainer
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-04-24 10:35:19 -07:00
Michael Crosby
b5434b5d7f Move apparmor into security sub dir
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-04-24 10:35:19 -07:00
Rohit Jnagal
7ff609f95d Add support for cpu hardcapping to cgroups.
Docker-DCO-1.1-Signed-off-by: Rohit Jnagal <jnagal@google.com> (github: rjnagal)
2014-04-24 14:43:02 +00:00
Solomon Hykes
c5b6f20d56 Fix Go formatting in beam and dockerscript
Docker-DCO-1.1-Signed-off-by: Solomon Hykes <solomon@docker.com> (github: shykes)
2014-04-22 16:16:29 -07:00