From f0ef6218406c1cc13c2bb50253f8d6b39f4bc037e89fa3c2e1d20ccb9d87eacf Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?C=C3=A9dric=20Bosdonnat?= Date: Wed, 25 Jun 2014 14:28:44 +0000 Subject: [PATCH] Accepting request 238658 from home:cbosdonnat:branches:Virtualization - lxc-keep-caps-feature.patch: allow to keep/drop additional capabilities for LXC containers. bnc#881465 - lxc-keep-caps-feature-conversion.patch: convert lxc.cap.drop to the new domain configuration. - lxc-keep-caps-feature-doc.patch: documentation for the new feature. OBS-URL: https://build.opensuse.org/request/show/238658 OBS-URL: https://build.opensuse.org/package/show/Virtualization/libvirt?expand=0&rev=385 --- libvirt.changes | 9 + libvirt.spec | 6 + lxc-keep-caps-feature-conversion.patch | 223 +++++++ lxc-keep-caps-feature-doc.patch | 71 ++ lxc-keep-caps-feature.patch | 863 +++++++++++++++++++++++++ 5 files changed, 1172 insertions(+) create mode 100644 lxc-keep-caps-feature-conversion.patch create mode 100644 lxc-keep-caps-feature-doc.patch create mode 100644 lxc-keep-caps-feature.patch diff --git a/libvirt.changes b/libvirt.changes index ebc91dc..e114576 100644 --- a/libvirt.changes +++ b/libvirt.changes @@ -1,3 +1,12 @@ +------------------------------------------------------------------- +Wed Jun 25 13:42:00 UTC 2014 - cbosdonnat@suse.com + +- lxc-keep-caps-feature.patch: allow to keep/drop additional + capabilities for LXC containers. bnc#881465 +- lxc-keep-caps-feature-conversion.patch: convert lxc.cap.drop to + the new domain configuration. +- lxc-keep-caps-feature-doc.patch: documentation for the new feature. + ------------------------------------------------------------------- Mon Jun 2 10:48:21 MDT 2014 - jfehlig@suse.com diff --git a/libvirt.spec b/libvirt.spec index 6b38255..10b6e32 100644 --- a/libvirt.spec +++ b/libvirt.spec @@ -435,6 +435,9 @@ Patch102: xen-pv-cdrom.patch Patch103: add-nocow-to-vol-xml.patch # pending review upstream patches Patch150: libxl-migration-support.patch +Patch151: lxc-keep-caps-feature.patch +Patch152: lxc-keep-caps-feature-conversion.patch +Patch153: lxc-keep-caps-feature-doc.patch # Our patches Patch200: libvirtd-defaults.patch Patch201: libvirtd-init-script.patch @@ -951,6 +954,9 @@ namespaces. %patch102 -p1 %patch103 -p1 %patch150 -p1 +%patch151 -p1 +%patch152 -p1 +%patch153 -p1 %patch200 -p1 %patch201 -p1 %patch202 -p1 diff --git a/lxc-keep-caps-feature-conversion.patch b/lxc-keep-caps-feature-conversion.patch new file mode 100644 index 0000000..7516716 --- /dev/null +++ b/lxc-keep-caps-feature-conversion.patch @@ -0,0 +1,223 @@ +From f199dbab24896c31c90a3291c4779daccef949ed Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?C=C3=A9dric=20Bosdonnat?= +Date: Wed, 11 Jun 2014 16:43:45 +0200 +Subject: [PATCH 2/3] lxc domain from xml: convert lxc.cap.drop + +--- + src/lxc/lxc_native.c | 25 ++++++++++++++++++++++ + tests/lxcconf2xmldata/lxcconf2xml-blkiotune.xml | 2 ++ + tests/lxcconf2xmldata/lxcconf2xml-cpusettune.xml | 2 ++ + tests/lxcconf2xmldata/lxcconf2xml-cputune.xml | 2 ++ + tests/lxcconf2xmldata/lxcconf2xml-idmap.xml | 2 ++ + .../lxcconf2xmldata/lxcconf2xml-macvlannetwork.xml | 4 ++++ + tests/lxcconf2xmldata/lxcconf2xml-memtune.xml | 2 ++ + tests/lxcconf2xmldata/lxcconf2xml-nonenetwork.xml | 4 ++++ + tests/lxcconf2xmldata/lxcconf2xml-nonetwork.xml | 2 ++ + tests/lxcconf2xmldata/lxcconf2xml-physnetwork.xml | 4 ++++ + tests/lxcconf2xmldata/lxcconf2xml-simple.xml | 8 +++++++ + tests/lxcconf2xmldata/lxcconf2xml-vlannetwork.xml | 4 ++++ + 12 files changed, 61 insertions(+) + +diff --git a/src/lxc/lxc_native.c b/src/lxc/lxc_native.c +index f4c4556..29ec188 100644 +--- a/src/lxc/lxc_native.c ++++ b/src/lxc/lxc_native.c +@@ -838,6 +838,28 @@ lxcSetBlkioTune(virDomainDefPtr def, virConfPtr properties) + return 0; + } + ++static void ++lxcSetCapDrop(virDomainDefPtr def, virConfPtr properties) ++{ ++ virConfValuePtr value; ++ char **toDrop = NULL; ++ const char *capString; ++ size_t i; ++ ++ if ((value = virConfGetValue(properties, "lxc.cap.drop")) && value->str) ++ toDrop = virStringSplit(value->str, " ", 0); ++ ++ for (i = 0; i < VIR_DOMAIN_CAPS_FEATURE_LAST; i++) { ++ capString = virDomainCapsFeatureTypeToString(i); ++ if (toDrop != NULL && virStringArrayHasString(toDrop, capString)) ++ def->caps_features[i] = VIR_DOMAIN_FEATURE_STATE_OFF; ++ } ++ ++ def->features[VIR_DOMAIN_FEATURE_CAPABILITIES] = VIR_DOMAIN_CAPABILITIES_POLICY_ALLOW; ++ ++ virStringFreeList(toDrop); ++} ++ + virDomainDefPtr + lxcParseConfigString(const char *config) + { +@@ -935,6 +957,9 @@ lxcParseConfigString(const char *config) + if (lxcSetBlkioTune(vmdef, properties) < 0) + goto error; + ++ /* lxc.cap.drop */ ++ lxcSetCapDrop(vmdef, properties); ++ + goto cleanup; + + error: +diff --git a/tests/lxcconf2xmldata/lxcconf2xml-blkiotune.xml b/tests/lxcconf2xmldata/lxcconf2xml-blkiotune.xml +index 36b8e52..c9c0469 100644 +--- a/tests/lxcconf2xmldata/lxcconf2xml-blkiotune.xml ++++ b/tests/lxcconf2xmldata/lxcconf2xml-blkiotune.xml +@@ -25,6 +25,8 @@ + + + ++ ++ + + + destroy +diff --git a/tests/lxcconf2xmldata/lxcconf2xml-cpusettune.xml b/tests/lxcconf2xmldata/lxcconf2xml-cpusettune.xml +index 932ab61..e7863fa 100644 +--- a/tests/lxcconf2xmldata/lxcconf2xml-cpusettune.xml ++++ b/tests/lxcconf2xmldata/lxcconf2xml-cpusettune.xml +@@ -13,6 +13,8 @@ + + + ++ ++ + + + destroy +diff --git a/tests/lxcconf2xmldata/lxcconf2xml-cputune.xml b/tests/lxcconf2xmldata/lxcconf2xml-cputune.xml +index 1bab1c6..50c5358 100644 +--- a/tests/lxcconf2xmldata/lxcconf2xml-cputune.xml ++++ b/tests/lxcconf2xmldata/lxcconf2xml-cputune.xml +@@ -15,6 +15,8 @@ + + + ++ ++ + + + destroy +diff --git a/tests/lxcconf2xmldata/lxcconf2xml-idmap.xml b/tests/lxcconf2xmldata/lxcconf2xml-idmap.xml +index 050ccd6..80a83ff 100644 +--- a/tests/lxcconf2xmldata/lxcconf2xml-idmap.xml ++++ b/tests/lxcconf2xmldata/lxcconf2xml-idmap.xml +@@ -14,6 +14,8 @@ + + + ++ ++ + + + destroy +diff --git a/tests/lxcconf2xmldata/lxcconf2xml-macvlannetwork.xml b/tests/lxcconf2xmldata/lxcconf2xml-macvlannetwork.xml +index 996c0f7..3105b8c 100644 +--- a/tests/lxcconf2xmldata/lxcconf2xml-macvlannetwork.xml ++++ b/tests/lxcconf2xmldata/lxcconf2xml-macvlannetwork.xml +@@ -8,6 +8,10 @@ + exe + /sbin/init + ++ ++ ++ ++ + + destroy + restart +diff --git a/tests/lxcconf2xmldata/lxcconf2xml-memtune.xml b/tests/lxcconf2xmldata/lxcconf2xml-memtune.xml +index b7c919e..7df1ef0 100644 +--- a/tests/lxcconf2xmldata/lxcconf2xml-memtune.xml ++++ b/tests/lxcconf2xmldata/lxcconf2xml-memtune.xml +@@ -15,6 +15,8 @@ + + + ++ ++ + + + destroy +diff --git a/tests/lxcconf2xmldata/lxcconf2xml-nonenetwork.xml b/tests/lxcconf2xmldata/lxcconf2xml-nonenetwork.xml +index 6d9e16d..e002b99 100644 +--- a/tests/lxcconf2xmldata/lxcconf2xml-nonenetwork.xml ++++ b/tests/lxcconf2xmldata/lxcconf2xml-nonenetwork.xml +@@ -8,6 +8,10 @@ + exe + /sbin/init + ++ ++ ++ ++ + + destroy + restart +diff --git a/tests/lxcconf2xmldata/lxcconf2xml-nonetwork.xml b/tests/lxcconf2xmldata/lxcconf2xml-nonetwork.xml +index 101324a..dc9d635 100644 +--- a/tests/lxcconf2xmldata/lxcconf2xml-nonetwork.xml ++++ b/tests/lxcconf2xmldata/lxcconf2xml-nonetwork.xml +@@ -10,6 +10,8 @@ + + + ++ ++ + + + destroy +diff --git a/tests/lxcconf2xmldata/lxcconf2xml-physnetwork.xml b/tests/lxcconf2xmldata/lxcconf2xml-physnetwork.xml +index 5fe1b03..cfaceb5 100644 +--- a/tests/lxcconf2xmldata/lxcconf2xml-physnetwork.xml ++++ b/tests/lxcconf2xmldata/lxcconf2xml-physnetwork.xml +@@ -8,6 +8,10 @@ + exe + /sbin/init + ++ ++ ++ ++ + + destroy + restart +diff --git a/tests/lxcconf2xmldata/lxcconf2xml-simple.xml b/tests/lxcconf2xmldata/lxcconf2xml-simple.xml +index b3c3659..549fc39 100644 +--- a/tests/lxcconf2xmldata/lxcconf2xml-simple.xml ++++ b/tests/lxcconf2xmldata/lxcconf2xml-simple.xml +@@ -8,6 +8,14 @@ + exe + /sbin/init + ++ ++ ++ ++ ++ ++ ++ ++ + + destroy + restart +diff --git a/tests/lxcconf2xmldata/lxcconf2xml-vlannetwork.xml b/tests/lxcconf2xmldata/lxcconf2xml-vlannetwork.xml +index 45348ed..712be3e 100644 +--- a/tests/lxcconf2xmldata/lxcconf2xml-vlannetwork.xml ++++ b/tests/lxcconf2xmldata/lxcconf2xml-vlannetwork.xml +@@ -8,6 +8,10 @@ + exe + /sbin/init + ++ ++ ++ ++ + + destroy + restart +-- +1.8.4.5 + diff --git a/lxc-keep-caps-feature-doc.patch b/lxc-keep-caps-feature-doc.patch new file mode 100644 index 0000000..44bfd82 --- /dev/null +++ b/lxc-keep-caps-feature-doc.patch @@ -0,0 +1,71 @@ +From b6f1f5a3be5b2643b255882effdca2e903d9d738 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?C=C3=A9dric=20Bosdonnat?= +Date: Wed, 11 Jun 2014 17:01:11 +0200 +Subject: [PATCH 3/3] lxc: update doc to mention features/capabilities/* domain + configuration + +--- + docs/drvlxc.html.in | 47 +++++++++++++++++++++++++++++++++++++++++++++++ + 1 file changed, 47 insertions(+) + +diff --git a/docs/drvlxc.html.in b/docs/drvlxc.html.in +index fc4bc20..403ce24 100644 +--- a/docs/drvlxc.html.in ++++ b/docs/drvlxc.html.in +@@ -540,6 +540,53 @@ debootstrap, whatever) under /opt/vm-1-root: + </domain> + + ++

Altering the available capabilities

++ ++

++By default the libvirt LXC driver drops some capabilities among which CAP_MKNOD. ++However since 1.2.6 libvirt can be told to keep or ++drop some capabilities using a domain configuration like the following: ++

++
++...
++<features>
++  <capabilities policy='default'>
++    <mknod state='on'/>
++    <sys_chroot state='off'/>
++  </capabilities>
++</features>
++...
++
++

++The capabilities children elements are named after the capabilities as defined in ++man 7 capabilities. An off state tells libvirt to drop the ++capability, while an on state will force to keep the capability even though ++this one is dropped by default. ++

++

++The policy attribute can be one of default, allow ++or deny. It defines the default rules for capabilities: either keep the ++default behavior that is dropping a few selected capabilities, or keep all capabilities ++or drop all capabilities. The interest of allow and deny is that ++they guarantee that all capabilities will be kept (or removed) even if new ones are added ++later. ++

++

++The following example, drops all capabilities but CAP_MKNOD: ++

++
++...
++<features>
++  <capabilities policy='deny'>
++    <mknod state='on'/>
++  </capabilities>
++</features>
++...
++
++

++Note that allowing capabilities that are normally dropped by default can seriously ++affect the security of the container and the host. ++

+ +

Container usage / management

+ +-- +1.8.4.5 + diff --git a/lxc-keep-caps-feature.patch b/lxc-keep-caps-feature.patch new file mode 100644 index 0000000..dff9c28 --- /dev/null +++ b/lxc-keep-caps-feature.patch @@ -0,0 +1,863 @@ +From 370ed9b2535b11acaa776fbb4fc6dcb8671c2c88 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?C=C3=A9dric=20Bosdonnat?= +Date: Wed, 11 Jun 2014 15:03:58 +0200 +Subject: [PATCH 1/3] lxc: allow to keep or drop capabilities + +Added in the section of LXC domains +configuration. This section can contain elements named after the +capabilities like: + + , keep CAP_MKNOD capability + drop CAP_SYS_CHROOT capability + +Users can restrict or give more capabilities than the default using +this mechanism. +--- + docs/schemas/domaincommon.rng | 207 ++++++++++++++++++++++++ + src/conf/domain_conf.c | 126 ++++++++++++++- + src/conf/domain_conf.h | 56 +++++++ + src/libvirt_private.syms | 3 + + src/lxc/lxc_cgroup.c | 8 + + src/lxc/lxc_container.c | 123 ++++++++++++-- + src/util/vircgroup.c | 74 ++++++++- + src/util/vircgroup.h | 2 + + tests/domainschemadata/domain-caps-features.xml | 28 ++++ + 9 files changed, 602 insertions(+), 25 deletions(-) + create mode 100644 tests/domainschemadata/domain-caps-features.xml + +Index: libvirt-1.2.5/docs/schemas/domaincommon.rng +=================================================================== +--- libvirt-1.2.5.orig/docs/schemas/domaincommon.rng ++++ libvirt-1.2.5/docs/schemas/domaincommon.rng +@@ -3744,6 +3744,9 @@ + + + ++ ++ ++ + + + +@@ -4290,6 +4293,200 @@ + + + ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ + + + +@@ -4298,6 +4495,16 @@ + + + ++ ++ ++ ++ ++ default ++ allow ++ deny ++ ++ ++ + +