[libvirt] [PATCH]LXC: force container to enable network namespace
From: Chen Hanxiao <chenhanxiao@cn.fujitsu.com> If we don't enable network namespace, we could shutdown host inside container by command 'shutdown', which is unacceptable. This patch will force users to enable network namespace before they start container. Signed-off-by: Chen Hanxiao <chenhanxiao@cn.fujitsu.com> --- src/lxc/lxc_container.c | 6 ++++++ 1 files changed, 6 insertions(+), 0 deletions(-) diff --git a/src/lxc/lxc_container.c b/src/lxc/lxc_container.c index c7a22ab..5631ad7 100644 --- a/src/lxc/lxc_container.c +++ b/src/lxc/lxc_container.c @@ -1937,6 +1937,12 @@ int lxcContainerStart(virDomainDefPtr def, if (lxcNeedNetworkNamespace(def)) { VIR_DEBUG("Enable network namespaces"); cflags |= CLONE_NEWNET; + } else { + errno = EINVAL; + + virReportSystemError(errno, "%s", + _("Network namespace needed")); + return -1; } pid = clone(lxcContainerChild, stacktop, cflags, &args); -- 1.7.1
On Wed, Aug 21, 2013 at 05:49:05PM +0800, Chen Hanxiao wrote:
From: Chen Hanxiao <chenhanxiao@cn.fujitsu.com>
If we don't enable network namespace, we could shutdown host inside container by command 'shutdown', which is unacceptable. This patch will force users to enable network namespace before they start container.
Signed-off-by: Chen Hanxiao <chenhanxiao@cn.fujitsu.com> --- src/lxc/lxc_container.c | 6 ++++++ 1 files changed, 6 insertions(+), 0 deletions(-)
diff --git a/src/lxc/lxc_container.c b/src/lxc/lxc_container.c index c7a22ab..5631ad7 100644 --- a/src/lxc/lxc_container.c +++ b/src/lxc/lxc_container.c @@ -1937,6 +1937,12 @@ int lxcContainerStart(virDomainDefPtr def, if (lxcNeedNetworkNamespace(def)) { VIR_DEBUG("Enable network namespaces"); cflags |= CLONE_NEWNET; + } else { + errno = EINVAL; + + virReportSystemError(errno, "%s", + _("Network namespace needed")); + return -1; }
pid = clone(lxcContainerChild, stacktop, cflags, &args);
NACK. We explicitly want to allow containers sharing the host's network namespace. If you wish to prevent the problem you describe, then set the <privnet/> feature in the XML, or configure virtual NICs Daniel -- |: http://berrange.com -o- http://www.flickr.com/photos/dberrange/ :| |: http://libvirt.org -o- http://virt-manager.org :| |: http://autobuild.org -o- http://search.cpan.org/~danberr/ :| |: http://entangle-photo.org -o- http://live.gnome.org/gtk-vnc :|
On 08/21/2013 05:53 PM, Daniel P. Berrange wrote:
On Wed, Aug 21, 2013 at 05:49:05PM +0800, Chen Hanxiao wrote:
From: Chen Hanxiao <chenhanxiao@cn.fujitsu.com>
If we don't enable network namespace, we could shutdown host inside container by command 'shutdown', which is unacceptable. This patch will force users to enable network namespace before they start container.
Signed-off-by: Chen Hanxiao <chenhanxiao@cn.fujitsu.com> --- src/lxc/lxc_container.c | 6 ++++++ 1 files changed, 6 insertions(+), 0 deletions(-)
diff --git a/src/lxc/lxc_container.c b/src/lxc/lxc_container.c index c7a22ab..5631ad7 100644 --- a/src/lxc/lxc_container.c +++ b/src/lxc/lxc_container.c @@ -1937,6 +1937,12 @@ int lxcContainerStart(virDomainDefPtr def, if (lxcNeedNetworkNamespace(def)) { VIR_DEBUG("Enable network namespaces"); cflags |= CLONE_NEWNET; + } else { + errno = EINVAL; + + virReportSystemError(errno, "%s", + _("Network namespace needed")); + return -1; }
pid = clone(lxcContainerChild, stacktop, cflags, &args);
NACK.
We explicitly want to allow containers sharing the host's network namespace. If you wish to prevent the problem you describe, then set the <privnet/> feature in the XML, or configure virtual NICs
At least we should give user some warning message or add a notification about the probable reboot problem if user doesn't configure private net namespace for container. Thanks
On Thu, Aug 22, 2013 at 09:23:50AM +0800, Gao feng wrote:
On 08/21/2013 05:53 PM, Daniel P. Berrange wrote:
On Wed, Aug 21, 2013 at 05:49:05PM +0800, Chen Hanxiao wrote:
From: Chen Hanxiao <chenhanxiao@cn.fujitsu.com>
If we don't enable network namespace, we could shutdown host inside container by command 'shutdown', which is unacceptable. This patch will force users to enable network namespace before they start container.
Signed-off-by: Chen Hanxiao <chenhanxiao@cn.fujitsu.com> --- src/lxc/lxc_container.c | 6 ++++++ 1 files changed, 6 insertions(+), 0 deletions(-)
diff --git a/src/lxc/lxc_container.c b/src/lxc/lxc_container.c index c7a22ab..5631ad7 100644 --- a/src/lxc/lxc_container.c +++ b/src/lxc/lxc_container.c @@ -1937,6 +1937,12 @@ int lxcContainerStart(virDomainDefPtr def, if (lxcNeedNetworkNamespace(def)) { VIR_DEBUG("Enable network namespaces"); cflags |= CLONE_NEWNET; + } else { + errno = EINVAL; + + virReportSystemError(errno, "%s", + _("Network namespace needed")); + return -1; }
pid = clone(lxcContainerChild, stacktop, cflags, &args);
NACK.
We explicitly want to allow containers sharing the host's network namespace. If you wish to prevent the problem you describe, then set the <privnet/> feature in the XML, or configure virtual NICs
At least we should give user some warning message or add a notification about the probable reboot problem if user doesn't configure private net namespace for container.
That can be documented in the drvlxc.html.in page Daniel -- |: http://berrange.com -o- http://www.flickr.com/photos/dberrange/ :| |: http://libvirt.org -o- http://virt-manager.org :| |: http://autobuild.org -o- http://search.cpan.org/~danberr/ :| |: http://entangle-photo.org -o- http://live.gnome.org/gtk-vnc :|
-----Original Message----- From: Daniel P. Berrange [mailto:berrange@redhat.com] Sent: Thursday, August 22, 2013 5:42 PM To: Gao feng Cc: Chen Hanxiao; libvir-list@redhat.com Subject: Re: [libvirt] [PATCH]LXC: force container to enable network namespace
On Thu, Aug 22, 2013 at 09:23:50AM +0800, Gao feng wrote:
On 08/21/2013 05:53 PM, Daniel P. Berrange wrote:
On Wed, Aug 21, 2013 at 05:49:05PM +0800, Chen Hanxiao wrote:
From: Chen Hanxiao <chenhanxiao@cn.fujitsu.com>
If we don't enable network namespace, we could shutdown host inside container by command 'shutdown', which is unacceptable. This patch will force users to enable network namespace before they start container.
Signed-off-by: Chen Hanxiao <chenhanxiao@cn.fujitsu.com> --- src/lxc/lxc_container.c | 6 ++++++ 1 files changed, 6 insertions(+), 0 deletions(-)
diff --git a/src/lxc/lxc_container.c b/src/lxc/lxc_container.c index c7a22ab..5631ad7 100644 --- a/src/lxc/lxc_container.c +++ b/src/lxc/lxc_container.c @@ -1937,6 +1937,12 @@ int lxcContainerStart(virDomainDefPtr def, if (lxcNeedNetworkNamespace(def)) { VIR_DEBUG("Enable network namespaces"); cflags |= CLONE_NEWNET; + } else { + errno = EINVAL; + + virReportSystemError(errno, "%s", + _("Network namespace needed")); + return -1; }
pid = clone(lxcContainerChild, stacktop, cflags, &args);
NACK.
We explicitly want to allow containers sharing the host's network namespace. If you wish to prevent the problem you describe, then set the <privnet/> feature in the XML, or configure virtual NICs
At least we should give user some warning message or add a notification about the probable reboot problem if user doesn't configure private net namespace for container.
That can be documented in the drvlxc.html.in page
Thanks. New patches will come soon.
Daniel -- |: http://berrange.com -o- http://www.flickr.com/photos/dberrange/ :| |: http://libvirt.org -o- http://virt-manager.org :| |: http://autobuild.org -o- http://search.cpan.org/~danberr/ :| |: http://entangle-photo.org -o- http://live.gnome.org/gtk-vnc :|
participants (4)
-
Chen HanXiao -
Chen Hanxiao
-
Daniel P. Berrange -
Gao feng