[libvirt] [PATCH v2 2/8] LXC: enable user namespace when user set the uidmap

[Daniel P. Berrange]

On Fri, May 10, 2013 at 05:58:11PM +0800, Gao feng wrote:
> If the idmap exist, the user namespace will be enabled
> automatically.
> If you want disable user namespace,just remove these
> elements from XML.
> 
> Signed-off-by: Gao feng <gaofeng at cn.fujitsu.com>
> ---
>  src/lxc/lxc_container.c | 14 ++++----------
>  1 file changed, 4 insertions(+), 10 deletions(-)
> 
> diff --git a/src/lxc/lxc_container.c b/src/lxc/lxc_container.c
> index 8e1d10a..094f205 100644
> --- a/src/lxc/lxc_container.c
> +++ b/src/lxc/lxc_container.c
> @@ -2030,16 +2030,10 @@ cleanup:
>      return ret;
>  }
>  
> -static int userns_supported(void)
> +static int userns_supported(virDomainDefPtr def)
>  {
> -#if 1
> -    /*
> -     * put off using userns until uid mapping is implemented
> -     */
> -    return 0;
> -#else
> -    return lxcContainerAvailable(LXC_CONTAINER_FEATURE_USER) == 0;
> -#endif
> +    return (def->idmap.nuidmap && def->idmap.ngidmap &&
> +            lxcContainerAvailable(LXC_CONTAINER_FEATURE_USER) == 0);


No you can't do this - it causes the code to silently ignore the
reqested  idmap if the kernel doesn't support it. If the kernel
can't support it we must report a fatal error to the user not
ignore it.


You should separate these checks really - userns_supported() to
check the kernel and  'userns_required(def)' to check fi the config
requires it.

>  virArch lxcContainerGetAlt32bitArch(virArch arch)
> @@ -2119,7 +2113,7 @@ int lxcContainerStart(virDomainDefPtr def,
>  
>      cflags = CLONE_NEWPID|CLONE_NEWNS|CLONE_NEWUTS|CLONE_NEWIPC|SIGCHLD;
>  
> -    if (userns_supported()) {
> +    if (userns_supported(def)) {
>          VIR_DEBUG("Enable user namespaces");
>          cflags |= CLONE_NEWUSER;
>      }

Regards,
Daniel
-- 
|: http://berrange.com      -o-    http://www.flickr.com/photos/dberrange/ :|
|: http://libvirt.org              -o-             http://virt-manager.org :|
|: http://autobuild.org       -o-         http://search.cpan.org/~danberr/ :|
|: http://entangle-photo.org       -o-       http://live.gnome.org/gtk-vnc :|