[libvirt] [PATCH]LXC: force container to enable network namespace

[Daniel P. Berrange]

On Wed, Aug 21, 2013 at 05:49:05PM +0800, Chen Hanxiao wrote:
> From: Chen Hanxiao <chenhanxiao at cn.fujitsu.com>
> 
> If we don't enable network namespace, we could shutdown host
> inside container by command 'shutdown', which is unacceptable.
> This patch will force users to enable network namespace
> before they start container.
> 
> Signed-off-by: Chen Hanxiao <chenhanxiao at cn.fujitsu.com>
> ---
>  src/lxc/lxc_container.c |    6 ++++++
>  1 files changed, 6 insertions(+), 0 deletions(-)
> 
> diff --git a/src/lxc/lxc_container.c b/src/lxc/lxc_container.c
> index c7a22ab..5631ad7 100644
> --- a/src/lxc/lxc_container.c
> +++ b/src/lxc/lxc_container.c
> @@ -1937,6 +1937,12 @@ int lxcContainerStart(virDomainDefPtr def,
>      if (lxcNeedNetworkNamespace(def)) {
>          VIR_DEBUG("Enable network namespaces");
>          cflags |= CLONE_NEWNET;
> +    } else {
> +        errno = EINVAL;
> +
> +        virReportSystemError(errno, "%s",
> +                             _("Network namespace needed"));
> +        return -1;
>      }
>  
>      pid = clone(lxcContainerChild, stacktop, cflags, &args);

NACK.

We explicitly want to allow containers sharing the host's network
namespace. If you wish to prevent the problem you describe, then
set the <privnet/> feature in the XML, or configure virtual NICs

Daniel
-- 
|: http://berrange.com      -o-    http://www.flickr.com/photos/dberrange/ :|
|: http://libvirt.org              -o-             http://virt-manager.org :|
|: http://autobuild.org       -o-         http://search.cpan.org/~danberr/ :|
|: http://entangle-photo.org       -o-       http://live.gnome.org/gtk-vnc :|