summaryrefslogtreecommitdiffstats
path: root/recipes-containers/lxc
Commit message (Collapse)AuthorAgeFilesLines
* lxc: pull in networking and templates via RRECOMMENDSBruce Ashfield2026-06-151-0/+11
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | The lxc recipe ships three sub-packages: ${PN}, ${PN}-networking, and ${PN}-templates. ${PN} contains the lxc-* command-line binaries. ${PN}-networking owns lxc-net.service, /etc/default/lxc-net, the dnsmasq drop-in for the lxcbr0 bridge, and the firewall plumbing. ${PN}-templates owns /usr/share/lxc/templates, the per-distro container-creation scripts that lxc-create invokes via --template. Installing only the main ${PN} package leaves a non-functional LXC. There's no lxcbr0 bridge, so any container whose config references it (every download-template default config does) fails to start with network.c: netdev_configure_server_veth: Failed to attach "vethXXX" to bridge "lxcbr0", bridge interface doesn't exist and there are no template scripts, so lxc-create --template <foo> has nothing to invoke. The user-facing toolchain is effectively broken unless the integrator knows to add the sub-packages by hand. Pull both sub-packages in through RRECOMMENDS so any image that installs lxc gets a functional LXC by default, regardless of whether the install path is packagegroup-lxc, IMAGE_INSTALL:append, or CORE_IMAGE_EXTRA_INSTALL. Integrators who don't want them (custom networking, hand-written templates) can drop either or both through BAD_RECOMMENDATIONS. Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
* lxc: drop templates-actually-create-DOWNLOAD_TEMP-directory.patchBruce Ashfield2026-06-142-38/+0
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The local patch added in 2018 was meant to ensure DOWNLOAD_TEMP pointed at a directory that actually existed by routing mktemp through the -p option. Its else branch is reached precisely when DOWNLOAD_TEMP is unset (the elif catches the set case), but the rewrite DOWNLOAD_TEMP="$(mktemp -p ${DOWNLOAD_TEMP} -d)" substitutes an empty ${DOWNLOAD_TEMP} into the command line, leaving the shell to parse mktemp -p -d as -d being the argument value for -p rather than its own flag. mktemp then fails immediately with mktemp: failed to create file via template '-d/tmp.XXXXXXXXXX': No such file or directory and lxc-create exits before doing any network work. Every invocation of lxc-create --template download is broken. Ferry Toth reported this on the meta-virt list 2026-06-13 (subject "lxc: starting a container errors out"). His diagnosis is correct and the fix he proposed — drop the patch — is the right one. The original upstream line DOWNLOAD_TEMP="${DOWNLOAD_TEMP}$(mktemp -d)" handles both cases correctly: with DOWNLOAD_TEMP set the elif branch runs first, and with it unset the else branch reduces to just DOWNLOAD_TEMP="$(mktemp -d)" which lets mktemp pick the default TMPDIR / /tmp location and create the directory. The original 2018 motivation ("DOWNLOAD_TEMP will not be pointing to an actual directory") does not match how mktemp -d actually behaves on modern systems — the directory IS created, and that's the whole point of mktemp -d. The reported failure mode was likely a build-host environment quirk specific to that 2018 setup rather than a general bug worth carrying a layer-local patch for. Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
* lxc: update to v7.0.0Bruce Ashfield2026-05-291-3/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Bumping lxc to version v7.0.0, which comprises the following commits: e4415af07 Release LXC 7.0.0 14754e0b9 usernic: add a test for ovs port deletion permission 7c4348314 lxc-user-nic: clarify and fix aebd808da Don't leak an open fd 565540984 lvm.c: make sure tp gets freed cf5aa7ca5 tests/lxc-test-lxc-attach: Increase sleep time bae8a42f7 lsm/apparmor: allow binfmt_misc RW mounts c57010a38 apparmor: allow nosymfollow remounts b46f872d9 apparmor: allow nosymfollow remounts 9e541fa86 lxc: assume fsopen/open_tree/mount_setattr syscalls are supported 87ff1e31e lxc/start: assume CLONE_PIDFD and clone3 are supported eed40beb1 doc: mention that legacy/hybrid hierarchy support is dropped 27649a1f2 lxc/cgroups: warn if non-unified cgroup layout detected 105385172 config/templates: don't use cgroup1 settings 7d9be4a4b tests: use lxc.cgroup2 instead of lxc.cgroup f29c3a3a6 lxc/conf: drop cgroup1 config options (lxc.cgroup.*) db0d83e42 lxc/cgroups: drop cgroup1 mounting logic 936fa0629 lxc/cgroups: drop special handling logic for cgroup1 cpuset controller dfa8ea976 lxc/cgroup: drop cgroup1 device cgroup support 95ac49ec6 lxc/cgroups: drop cgroup1 freezer support 49bb4fad1 [nesting] Extend mount permissions in apparmor to allow systemd services' restrictions to work 88b44a5f9 cgroups: Skip systemd dbus logic when not using systemd cf5e950ee tests: mount_injection: ensure cleanup on test failure 110974e9c Fix issue where memfd functions were not being detected during meson setup. f5641d697 Fix issue where pidfd_ functions were not being detected during meson setup. 2bc6bac9c utils: Only single quote our own arguments 7174f2e2a utils: Update buffer size to account for quotes 589981f4f utils: Add quotes around exec arguments e4d847bd0 build(deps): bump actions/upload-artifact from 6 to 7 a01f7b4ac Add --rbuser to Japanese lxc-create(1) 29cd84d8e Add description for unprivileged containers to Japanese man page d8f2c55fa cmd/lxc-user-nic: prevent OOB read in name_is_in_groupnames aba5d1fbf lxc/network: define netlink uAPI constants for link properties 5e9b89c8f lxc/network: save/restore physical network interfaces altnames 3ba8131f0 lxc/network: optimize netdev_get_mtu 061acb0b3 meson.build: fix open_how include with glibc-2.43+ 511e4db8f meson.build: fix openat2 include typo, fix with glibc-2.43 +FORTIFY 5b64b5016 lxc: added support OpenRC init system c97f33e1f src/confile: fix values of lxc.cap.keep and lxc.cap.drop 97bd7699c tests/lxc-attach: ensure no data corruption happens during heavy IO on pts 4cb9884ed lxc/{terminal, file_utils}: ensure complete data writes in ptx/peer io handlers 4a30d82af github: test io_uring-based event loop 4a5aa19d7 build: update Makefile and meson.build 6a5550ec2 Improve the dbus scope creation error handling 0f5852edf cgfsng: fix reboots when using dbus 49c34b1bc copy_rdepends: Don't fail on missing source file 9e6caeabe start: Respect lxc.init.groups also in new user namespace e6ad17a79 start: Remove outdated comment about group dropping af691a1fa build(deps): bump actions/upload-artifact from 5 to 6 f085a8cbd Added documentation on unprivileged LXC containers 9799ebacc added doc for --rbduser 1090d85df added "--rbduser" option in "lxc-create -B rbd" fbeb7ce7e Fallback to XDG_RUNTIME_DIR when /run not found 969a3c599 checkonfig: Fixed compatible with toybox/gunzip fee221cae Initial changes without testing 9a1edb704 Enumerated all values in array 5d160e2a5 meson: add meson option for running doxygen in build 4d00d4f80 build: Check if P_PIDFD is defined 661780256 build(deps): bump actions/checkout from 5 to 6 1d1700a23 Ensure do_lxcapi_unfreeze returns false when getstate errors b89ed0a8e apparmor: skip /proc and /sys restrictions if nesting is enabled c81e03eb6 Update lxc.spec.in to use meson f3ff31e58 config/apparmor/abstractions: Drop manually generated container-base file 52929fc21 config/apparmor/abstractions: Fix meson build generation of container-base fc5a9422f build(deps): bump actions/upload-artifact from 4 to 5 4e48c0d09 builds workflow: make .orig.tar.gz unique per build 7f128c968 github: Drop focal source packages aa0fdd1a4 add MFD_EXEC and MFD_NOEXEC_SEAL flag to memfd_create 00f05b13d start: Only include linux/landlock.h when landlock is enabled 20aa142d5 Automatically detect compression format in the lxc-local template fba76ea65 lxccontainer: check if target exists before remove in create_mount_target() d269f0370 Standardize log file create mode to 0640 d79142d41 doc: add lxc.environment.{runtime,hooks} in Japanese man page c7bd5a357 Enable systemd to create /var/lib/lxc at runtime with StateDirectory e0290fa4a doc: add lxc.environment.{runtime, hooks} 9ebe1f11e api_extensions: add environment_runtime_hooks extension fbd37f04c conf: split `lxc.environment` into `runtime` and `hooks` 3f1658526 github: Enable landlock in tests 226bbf62f start: Add Landlock restrictions to monitor 8ef1ac504 start: Make lxc_handler mainloop to run in thread bfacedd4c meson: Add optional landlock protection for monitor 694944a7e commands: Fix indent 9b2422478 README: update links 95cad77e7 Rename CONTRIBUTING to CONTRIBUTING.md cc2a8494b README: Fix CI links e434816f2 build(deps): bump actions/checkout from 4 to 5 b3a5d2814 lxc/conf: do not leak opts.data memory in __lxc_idmapped_mounts_child() 5db329a4b lxc/network: null-terminate ifname string in lxc_network_recv_name_and_ifindex_from_child() 23633ab0f tests/lxc-test-snapdeps: try to load overlay kernel module 1d8d439af tests/lxc-test-rootfs: add idmapped rootfs testcase a53589e06 lxc/lxccontainer: stop printing misleading errors in enter_net_ns() a5189e3f5 lxc/process_utils.h: use strsignal() or sys_siglist[] for Non-GNU distros 39cb6d119 meson.build: use has_header_symbol() instead of get_define() to improve compatibility 0267998bc meson.build: fix checks for fsconfig and calls 6d6f0e1b0 meson.build: set `LXC_DISTRO_SYSCONF` when `-Dspecfile=true` ad0804e41 Add loong64 to list of recognized architectures d5beb15ae Revert "re-add onexec for apparmor, move label assumption until after container has been setup for attach" bba0a0d60 src/tests/oss-fuzz: pin meson to 1.7.2 to workaround build failures afb35f3de lxc/conf: support flag kind of mount options in lxc.mount.entry options 2e08794e0 lxc/conf: support nosymfollow mount flag 30b11e54a conf: Add support for "move" mount flag a9b343f48 src/tests/lxc-test-unpriv: prevent fail on cleanup path a13f86b07 src/tests/lxc-test-apparmor-mount: prevent fail on cleanup path 68e57809e src/tests/lxc-test-apparmor-generated: enable test ea92e49bd meson.build: remove quirk for Ubuntu 14.04 libcap-dev 7b9ee8967 apparmor test: add an overlay container start 50dee37cf re-add onexec for apparmor, move label assumption until after container has been setup for attach 0636ec66b lxc/conf,start: fix setting container_ttys environment variable c69830734 selinux: fix typo (AppArmor) 6cb00878e meson_options.txt: remove space before `:` for consistency 368ac7b80 meson_options.txt: don't use str when defining bool default values fc65c6a79 bionic: Remove custom getline, openpty and prlimit 4d52fe8e0 bionic: Remove bionic detection and support ee022cf05 README: Remove mention of old LXC version 0df81457d start: Re-introduce first SET_DUMPABLE call e5cc7a6be lxc/start: do prctl(PR_SET_DUMPABLE) after last uid/gid switch 3c6ea300b lxc/caps: fix open /proc/sys/kernel/cap_last_cap becd5538e lxc/conf: handle rootfs open_at error in lxc_mount_rootfs ff1ea5099 tools/lxc_attach: fix ENFORCE_MEMFD_REXEC checks c8cc47101 github: Add packaging workflow 7914afb0c global: Switch to new MAC prefix 7bd24f6cb global: Switch MAC generation to Zabbly prefix 31cd14682 sysconfig/lxc: remove false comment d047d81b7 Added LXC_IPV6_ENABLE option for lxc-net to enable or disable IPv6 9c9c27e8c github: Switch to native arm64 runners 59825e187 config-bcast: fix incorrect broadcast address calculation b4248f626 lxc/attach: Revert "- LXC attach should exit on SIGCHLD" 8d8fd27b5 conf: warn when capabilities are disabled or libcap is not found 844c49fcf dbus: replace hardcoded dbus address with environment variable 4c4636830 conf: log name of invalid capability in error 50be11e8d confile-vlanid: undefined is not a zero value f02158439 - LXC attach should exit on SIGCHLD 9589be83c github: Improve progress reporting 4fef63526 github: Cleanup OSS-fuzz 664344d9d github: Rework test workflow 6dd4c9bae github: Introduce shared testsuite logic 5b752b525 github: Introduce shared build logic e47b9ee65 github: Update coverity workflow 4527cec26 lxc.init: Allow SIGHUP from outside the container d25e7f306 lxc.init: Ignore user signals coming from inside the contianer c41c5ebfa lxc.init: Switch to sigaction 87dcdecf5 lxccontainer: fix enter_net_ns helper to work when netns is inherited 31012d49a lxc-net: Replace random IPv6 subnet d03cb0aca meson: fix minor typo f7c758537 fix return code of recursive all of cgroup_tree_prune d5c2d1eff Avoid null pointer dereference when using shared rootfs. rootfs->storage not set by lxc_storage_prepare when using a shared rootfs. d50ee6f7c create_run_template: don't use txtuid and txtguid out of scope 3764c1996 Add suppport for PuzzleFS images in the oci template a8ca9f5f3 meson.build: drop suggest-attribute=noreturn build option 36497cc90 meson.build: add -ffat-lto-objects 83bb86888 fix possible clang compile error in AARCH b79d2a525 README: Update security contact 7be043310 doc: Fix definitions of get_config_path and set_config_path b24d2d45b Exit 0 when there's no error 5db3d7299 idmap: Lower logging level of newXidmap tools to INFO 5603534a9 Remove unused function 01ae1fe55 meson: fix build with -Dtools-multicall=true on NixOS 4892749ef github: exclude clang & ubuntu-24.04 combination 20a14562d lxc/storage/zfs: ignore false-positive use-after-free warning 8a297c3ad github: properly check apparmor profile changes bdba5efee github: start using ubuntu-24.04 d29f72e37 apparmor: regenerate rules 32f88c8fe apparmor: use /{,**} instead of /** 083678be2 apparmor: regenerate rules 9c492b079 apparmor: fix rule path pattern specification syntax 63168bcf4 lxc-local: remove check for template existence before extraction d740a3423 lxc-local: fix incorrect path to `templates` file d7f2a52fd lxc-local: fix use of `LXC_PATH` before init 9a6448af4 Update lxc-execute.sgml.in 3bef71d7e Update lxc-{attach,execute}.sgml.in a7aa2974d Update lxc-execute.sgml.in 52bf34d8a Update lxc-attach.sgml.in ee8063bcf network: netdev_configure_server_veth: reduce scope of disable_ipv6_fd/path vars dd663dcb3 lxc/network: handle non-existing sysctl <ifname>/disable_ipv6 cca0f8767 github: test the lxc multicall binary builds too 4be1c12c1 meson: fix build on NixOS 054163193 meson: Set DEVEL flag post release Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
* lxc: delete extraneous PACKAGECONFIG[systemd] lineGavvala, Kris2026-04-281-1/+0
| | | | | | | | | | | | | | | | | | The PACKAGECONFIG[systemd] variable is assigned twice, with the second assignment overriding the first. This patch removes the unused assignment to avoid confusion. The duplication was introduced in an August 25, 2022 patch: 05f316f7 lxc: update to 5.x and meson Verfied that the build did not change after this deletion by checking the log files before and after and finding the same message: export systemd_system_unitdir="/usr/lib/systemd/system" export systemd_unitdir="/usr/lib/systemd" export systemd_user_unitdir="/usr/lib/systemd/user" Signed-off-by: Kris Gavvala <kris.gavvala@windriver.com> Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
* lxc: update to v6.0.6Bruce Ashfield2026-03-142-59/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This fixes the build with recent glibc and picks up the following fixes: 2597434ae Release LXC 6.0.6 d128f134d cmd/lxc-user-nic: prevent OOB read in name_is_in_groupnames c43aeaaed lxc/network: define netlink uAPI constants for link properties 42b43b31c lxc/network: save/restore physical network interfaces altnames 810f44ba0 lxc/network: optimize netdev_get_mtu 5e68a7a63 meson.build: fix open_how include with glibc-2.43+ 540f9e2bc meson.build: fix openat2 include typo, fix with glibc-2.43 +FORTIFY 01b9e35a7 lxc: added support OpenRC init system 885496ccc src/confile: fix values of lxc.cap.keep and lxc.cap.drop 99c3206c7 tests/lxc-attach: ensure no data corruption happens during heavy IO on pts b964611b3 lxc/{terminal, file_utils}: ensure complete data writes in ptx/peer io handlers d6ccb9abe github: test io_uring-based event loop 0448c9dd2 build: update Makefile and meson.build aa4212023 Improve the dbus scope creation error handling f9e73517e cgfsng: fix reboots when using dbus 2072ea4c7 copy_rdepends: Don't fail on missing source file c7eac1180 start: Respect lxc.init.groups also in new user namespace 8ed8145d6 start: Remove outdated comment about group dropping e9921c3d7 build(deps): bump actions/upload-artifact from 5 to 6 97a2e4af5 Added documentation on unprivileged LXC containers 59a30025e added doc for --rbduser 54d323a2d added "--rbduser" option in "lxc-create -B rbd" a262afb5d Fallback to XDG_RUNTIME_DIR when /run not found d7068a338 checkonfig: Fixed compatible with toybox/gunzip 4cc343edf Initial changes without testing bdce7a634 Enumerated all values in array edc57196f meson: add meson option for running doxygen in build 058be42aa build: Check if P_PIDFD is defined 099089971 Ensure do_lxcapi_unfreeze returns false when getstate errors f9ff9ea2a build(deps): bump actions/checkout from 5 to 6 Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
* lxc: restore DEBUG_PREFIX_MAP in TARGET_LDFLAGS for LTO reproducibilityRicardo Salveti2026-02-091-0/+3
| | | | | | | | | | | | | | | | | | | | oe-core [1] removed DEBUG_PREFIX_MAP from TARGET_LDFLAGS to avoid passing prefix-map options via the linker flags. This is fine for most projects since DEBUG_PREFIX_MAP is also provided via CFLAGS at configure time. However, lxc enables LTO by default, which causes link-time code generation to (re)emit debug information during the link step. Without DEBUG_PREFIX_MAP on the link command line, TMPDIR/WORKDIR paths can leak into DWARF, triggering the buildpaths QA check and breaking reproducibility. Append DEBUG_PREFIX_MAP back to TARGET_LDFLAGS for lxc to ensure prefix-map options are visible during LTO link-time compilation. [1] https://git.openembedded.org/openembedded-core/commit/?id=1797741aad02b8bf429fac4b81e30cdda64b5448 Signed-off-by: Ricardo Salveti <ricardo.salveti@oss.qualcomm.com> Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
* lxc: delete empty lxc state directoryVishwas Udupa2026-01-061-1/+1
| | | | | | | | | | | | lxc systemd service [1] defines a StateDirectory to ensure that the /var/lib/lxc directory is automatically created and managed by systemd during service startup. Do not create lxc directory at build time for systemd. [1] https://github.com/lxc/lxc/blob/f9ff9ea2a92653a823edf25e8e28c9dab08b3090/config/init/systemd/lxc.service.in#L16 Signed-off-by: Vishwas Udupa <vudupa@qti.qualcomm.com> Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
* lxc: Fix build with muslJaeyoon Jung2025-12-012-0/+57
| | | | | Signed-off-by: Jaeyoon Jung <jaeyoon.jung@lge.com> Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
* lxc: update to v6.0.5-tipBruce Ashfield2025-12-011-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | Bumping lxc to version v6.0.5-17-gf9ff9ea2a, which comprises the following commits: f9ff9ea2a build(deps): bump actions/checkout from 5 to 6 c21296262 apparmor: skip /proc and /sys restrictions if nesting is enabled be5ce5529 Update lxc.spec.in to use meson e716bd6c8 config/apparmor/abstractions: Drop manually generated container-base file 5d0182b0d config/apparmor/abstractions: Fix meson build generation of container-base 539424964 build(deps): bump actions/upload-artifact from 4 to 5 fdc302322 builds workflow: make .orig.tar.gz unique per build d0d4f9896 github: Drop focal source packages 944118acd add MFD_EXEC and MFD_NOEXEC_SEAL flag to memfd_create ca9ecef01 Automatically detect compression format in the lxc-local template 50bddb8e3 lxccontainer: check if target exists before remove in create_mount_target() d692ba5a9 Standardize log file create mode to 0640 0e84c43d7 Enable systemd to create /var/lib/lxc at runtime with StateDirectory 277634689 commands: Fix indent 9184960a8 README: update links 7e0e0d1ae Rename CONTRIBUTING to CONTRIBUTING.md 675ffcd71 README: Fix CI links 9e4e69ed1 Release LXC 6.0.5 Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
* lxc: update to v6.0.5Bruce Ashfield2025-10-181-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Bumping lxc to version v6.0.5, which comprises the following commits: 9e4e69ed1 Release LXC 6.0.5 a0fb994a5 build(deps): bump actions/checkout from 4 to 5 93a06e70f lxc/conf: do not leak opts.data memory in __lxc_idmapped_mounts_child() 97eeb8a9a lxc/network: null-terminate ifname string in lxc_network_recv_name_and_ifindex_from_child() 7a94d11d9 tests/lxc-test-snapdeps: try to load overlay kernel module 0bf6aedf0 tests/lxc-test-rootfs: add idmapped rootfs testcase 98ebede63 lxc/lxccontainer: stop printing misleading errors in enter_net_ns() 7111f9d83 lxc/process_utils.h: use strsignal() or sys_siglist[] for Non-GNU distros 032290ec8 meson.build: use has_header_symbol() instead of get_define() to improve compatibility 85c5312be meson.build: fix checks for fsconfig and calls 4da694582 meson.build: set `LXC_DISTRO_SYSCONF` when `-Dspecfile=true` e4cddef06 Add loong64 to list of recognized architectures e9980ac90 Revert "re-add onexec for apparmor, move label assumption until after container has been setup for attach" ab55d52a5 src/tests/oss-fuzz: pin meson to 1.7.2 to workaround build failures 9041ae313 lxc/conf: support flag kind of mount options in lxc.mount.entry options 859f736f0 lxc/conf: support nosymfollow mount flag c42951b71 conf: Add support for "move" mount flag e6bce2a2d src/tests/lxc-test-unpriv: prevent fail on cleanup path 601576a08 src/tests/lxc-test-apparmor-mount: prevent fail on cleanup path b12d1bf89 src/tests/lxc-test-apparmor-generated: enable test e35133a54 meson.build: remove quirk for Ubuntu 14.04 libcap-dev cbe34bcc2 apparmor test: add an overlay container start 1541bd8f2 re-add onexec for apparmor, move label assumption until after container has been setup for attach 8ab6ad25b lxc/conf,start: fix setting container_ttys environment variable b185e523f selinux: fix typo (AppArmor) Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
* lxc: update to v6.0.4Bruce Ashfield2025-07-071-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Bumping lxc to version v6.0.4-7-gb185e523f, which comprises the following commits: b185e523f selinux: fix typo (AppArmor) 4be5e7c65 meson_options.txt: remove space before `:` for consistency 81d00893a meson_options.txt: don't use str when defining bool default values 8a7ea2523 bionic: Remove custom getline, openpty and prlimit 136d5ae08 bionic: Remove bionic detection and support f362f6eed README: Remove mention of old LXC version 2663712e8 start: Re-introduce first SET_DUMPABLE call 0fb6eb66d Release LXC 6.0.4 312976c9b lxc/start: do prctl(PR_SET_DUMPABLE) after last uid/gid switch 77b9cb1dc lxc/caps: fix open /proc/sys/kernel/cap_last_cap dfe473705 lxc/conf: handle rootfs open_at error in lxc_mount_rootfs 782b666dc tools/lxc_attach: fix ENFORCE_MEMFD_REXEC checks bcb6d063d github: Add packaging workflow 3a4003c8c global: Switch to new MAC prefix 5cdef29d8 global: Switch MAC generation to Zabbly prefix 400115de0 sysconfig/lxc: remove false comment 0e99eaa35 Added LXC_IPV6_ENABLE option for lxc-net to enable or disable IPv6 84e02ca8c github: Switch to native arm64 runners f68da1c9f config-bcast: fix incorrect broadcast address calculation 5b31eb51a lxc/attach: Revert "- LXC attach should exit on SIGCHLD" 555276df9 conf: warn when capabilities are disabled or libcap is not found a99f593e3 dbus: replace hardcoded dbus address with environment variable d34b373ca conf: log name of invalid capability in error 56ef15e71 confile-vlanid: undefined is not a zero value b4fda3c60 - LXC attach should exit on SIGCHLD fe31d844e Release LXC 6.0.3 Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
* containers: adapt to UNPACKDIR changesBruce Ashfield2025-06-251-2/+0
| | | | | | | | | | | | | This commit updates the container recipes to the OE core UNPACKDIR changes. - We drop references to WORKDIR - We adjust destsuffix fetches to use BB_GIT_DEFAULT_DESTSUFFIX instead of 'git' - Update our GOPATH references to use UNPACKDIR - Drop S = assignemnts where possible Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
* metadata: add whitespace around assignmentsMartin Jansa2025-04-031-1/+1
| | | | | | | | | | With: https://lists.openembedded.org/g/bitbake-devel/message/17508 there are many WARNINGs from this layer will cover src_uri.inc files in next commit. Signed-off-by: Martin Jansa <martin.jansa@gmail.com> Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
* lxc: disable lxc-staticdev buildpaths checkingXiangyu Chen2025-02-181-0/+2
| | | | | | | | | | | | lxc enabled the ffat-lto-objects option since 6.0.3[1], that liblxc.a object files contain both the intermediate language and the object code, that cause yocto QA report a QA warning. Ref: [1] https://github.com/lxc/lxc/commit/277ac364074f8287be91393f50f8f999d51101c4 Signed-off-by: Xiangyu Chen <xiangyu.chen@windriver.com> Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
* lxc: update to v6.0.3Bruce Ashfield2025-01-171-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Bumping lxc to version v6.0.3, which comprises the following commits: fe31d844e Release LXC 6.0.3 b63c630fd github: Improve progress reporting eb5095c3c github: Cleanup OSS-fuzz 8fa61eea5 github: Rework test workflow 0be2aed41 github: Introduce shared testsuite logic 1fce28876 github: Introduce shared build logic 8fde2ff28 github: Update coverity workflow 787a0f821 lxc.init: Allow SIGHUP from outside the container 17fea37cc lxc.init: Ignore user signals coming from inside the contianer 5dead1d05 lxc.init: Switch to sigaction 3011e79f9 lxccontainer: fix enter_net_ns helper to work when netns is inherited 537986ec8 fix return code of recursive all of cgroup_tree_prune 7f148c284 lxc-net: Replace random IPv6 subnet 1fc5314ff meson: fix minor typo f7681840a Avoid null pointer dereference when using shared rootfs. rootfs->storage not set by lxc_storage_prepare when using a shared rootfs. 27f02b8c8 create_run_template: don't use txtuid and txtguid out of scope acc334a9c Add suppport for PuzzleFS images in the oci template f9992d819 meson.build: drop suggest-attribute=noreturn build option 277ac3640 meson.build: add -ffat-lto-objects 2444f5841 Release LXC 6.0.2 a85dc4b3d fix possible clang compile error in AARCH f5a5ea3cf README: Update security contact 226fe3d54 doc: Fix definitions of get_config_path and set_config_path a4c5d7ee0 Exit 0 when there's no error 19e14a26f idmap: Lower logging level of newXidmap tools to INFO 704504e3d Remove unused function f1be0d814 Release LXC 6.0.1 Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
* lxc: Fix meson build issuePawan Badganchi2024-07-221-2/+1
| | | | | | | | | | | | | Build is failing during do_configure stage for lxc as meson does not support --with-systemdsystemunitdir config parameter. Error: meson: error: unrecognized arguments: --with-systemdsystemunitdir=/etc/systemd/system/ Hence, use -Dsystemd-unitdir config parameter instead. Signed-off-by: Pawan Badganchi <badganchipv@gmail.com> Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
* lxc: update to v6.0.1Bruce Ashfield2024-07-151-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | Bumping lxc to version v6.0.1, which comprises the following commits: f1be0d814 Release LXC 6.0.1 9fb53cfa1 meson: fix build with -Dtools-multicall=true on NixOS f92aa6066 github: exclude clang & ubuntu-24.04 combination 6a0b1504e lxc/storage/zfs: ignore false-positive use-after-free warning 6ba6c3208 github: properly check apparmor profile changes 8e72b94bd github: start using ubuntu-24.04 f91ce0d8b apparmor: regenerate rules cba7a6746 apparmor: use /{,**} instead of /** e97321ff9 apparmor: regenerate rules 89071ba7b apparmor: fix rule path pattern specification syntax 32c7a157d lxc-local: remove check for template existence before extraction 81a2c8253 lxc-local: fix incorrect path to `templates` file fdeb88655 lxc-local: fix use of `LXC_PATH` before init be7179a08 Update lxc-execute.sgml.in 247f5eed5 Update lxc-{attach,execute}.sgml.in bb23a71af Update lxc-execute.sgml.in f98b7ab53 Update lxc-attach.sgml.in e31ce9753 network: netdev_configure_server_veth: reduce scope of disable_ipv6_fd/path vars bd8d5b747 lxc/network: handle non-existing sysctl <ifname>/disable_ipv6 41aa42e27 github: test the lxc multicall binary builds too 1b3b06d8e meson: fix build on NixOS 3dee5fb88 Release LXC 6.0.0 Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
* lxc: update ptest cases in black listXiangyu Chen2024-07-101-3/+9
| | | | | | | | | | | | | | | | | | | Released lxc-test-shutdowntest and lxc-test-state-server due to those back to normal since lxc upgraded to 6.0.0. lxc-test-no-new-privs and lxc-test-checkpoint-restore are broken test, already reported to upstream[1][2], move them to blacklist until upstream fix them. lxc-test-usernic always fails when use ptest-runner, but normal with run-ptest by manual. Ref: [1] https://github.com/lxc/lxc/issues/4296 [2] https://github.com/lxc/lxc/issues/4435 Signed-off-by: Xiangyu Chen <xiangyu.chen@windriver.com> Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
* lxc: update to v6.0.0Bruce Ashfield2024-05-294-183/+14
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Bumping lxc to version v6.0.0, which comprises the following commits: 3dee5fb88 Release LXC 6.0.0 17ac6f691 lxc.spec: Align SPDX license id 5fe2de84c Makefile: Align SPDX license id 97f93be72 meson: Align SPDX license id d4cd3741d COPYING: Clarify licensing of files without SPDX 8e67eb07c doc: Add SPDX headers and remove Author field cb94edf53 src/include: Add SPDX headers 7bc33ef6e src/tests: Add SPDX headers 007642c89 hooks: Add SPDX headers 1e9e66be3 lxc.spec: Clear default changelog 202d649d1 lxc.spec: Use SPDX 85abd4026 template: Use SPDX a074b3d27 config/yum: Use SPDX header 7ed43e5e9 COPYING: Remove whitespace 522721216 MAINTAINERS: Remove Dwight from the maintainer list 08bf8b9e2 lxc-checkconfig: Fix shellcheck 0f18db543 lxc-checkconfig: Show namespace limits f71b8e3f8 lxc-ls: list names with whitespaces in `--active`. 816b8973d lxc/tools: set default log_priority to ERROR 989ea3969 tools/lxc_autostart: don't fail when there are no containers dc4df2335 lxc/lxccontainer: specify file mode in open() call inside mod_rdep 630b46ed2 lxc/confile: do not print excess space before scale suffix for time.offset.boot 796f2ccb7 lxc/confile: do not print newline symbol in getter for lxc.time.offset.* dcc4fb929 tests/parse_config_file: fix some typos 6fea67429 tests/parse_config_file: add tests for lxc.time.offset.* ad8f55445 tree-wide: replace multiply_overflow with check_mul_overflow 4464cee19 lxccontainer: rework copy_file() 9d1aa932d lxccontainer: improve mod_rdep() 81c1bbf45 Revert "lxccontainer: fixes" 82fe01821 src/lxc/syscall_numbers.h: drop define -1 590a95d83 rexec: Avoid invalid free in rexec failure path f9978b179 README: Correct 'armvl7' to 'armv7l' 046b63cd2 unshare: simplify lookup_name 7452ee8ab lxc-unshare: fix an buffer overflow issue in lxc_unshare e88883445 lxc-net: Enable IPv6 by default d78ca00bc tests/meson: attempt to fix ossfuzz builds d18f993b3 github: master -> main 86799f554 meson: link with liblxc dynamically everywhere if possible b90fecfda network: use IN_LIBLXC 9eee450d2 storage_utils: move get_fssize to utils 6eb0a73e2 storage_utils: unhide and rename is_valid_storage_type to lxc_is_valid_storage_type 42eeffcb0 confile: unhide lxc_config_parse_arch() helper 9bb318881 conf: reorganize/split code to utils.c 863c59dc3 conf: reorganize/split code to idmap_utils.c b7591ad49 confile: unhide lxc_config_define*() helpers f14656ebf meson: introduce IN_LIBLXC preprocessor macro 672b2172d confile: move lxc_fill_elevated_privileges() to tools/lxc_attach 8f9733d75 tests: remove old and broken cgroup handling code from tests d51ea224e config: apparmor: add AppArmor profile for lxc-copy 627bb9460 tests: lxc-test-usernic: use iproute tool instead of brctl df0665b6d oci: resolve cross-filesystem blob caching failure ec85e5ca4 lxc-test-usernic: drop cgroup handling 27ec0b0f6 test-usernic: don't use ifconfig 44e845b3c Add x32 to the list of recognized architectures 07e3a516e lxc-download, lxc-local: preserve xattrs on unpack 9ac7c4895 tree-wide: use container_uses_namespace() in less trivial cases 64341ce7b tree-wide: use container_uses_namespace() helper 6b40e66c1 Fix error message. c8189ee2a Add verbose output in download template. 84cc3155a Align columns in lxc-download.in template 872db5424 build: add more options for customizing install df17ac417 Add loongarch64 support 112d5615e build(deps): bump actions/upload-artifact from 3 to 4 789457f1a config: try to create workdir if not exist 86f5c1226 lxc-local: Add --no-dev option to exclude /dev from the fstree f885a3c56 lxc-local: Re-organize code to use more functions 7c025072e lxc-local: Improve usage info faa38a197 lxc-local: Change LXC_CONFIG to LXC_METADATA to match args and be more clear d65fe1b27 Disable IPv6 link-local addresses for bridged veth 8cff8fa1a don't try to delete vlan 0 from veth 0e932812a conf: fix ephemeral copies abffab441 config/init: Drop upstart files 79a4a3cf8 doc: remove the warning mentionning upstart 7bf1695d0 hooks/ubuntu-cloud-prep: remove upstart handling fb73c18d2 meson: Remove support for upstart cc6819c69 reset root_nsuid_map and root_nsgid_map when idmaps is cleared a87d6fcc9 lxc/checkconfig: use multiline `echo` f3e01fa80 lxc/checkconfig: replace `echo -n` by printf ba4f810bc lxc/checkconfig: minor cosmetic change d52c345c8 lxc/checkconfig: avoid subshell (SC2235) f84f03d1d lxc/checkconfig: remove superfluous (..) around test command (SC2234) 74b9faa64 lxc/checkconfig: check exit code directly (SC2181) 5cc69e440 lxc/checkconfig: replace `! -z` by `-n` (SC2236) a4684eb11 lxc/checkconfig: add missing quotes to please shellcheck 8a611c0b2 lxc/checkconfig: remove some unneeded `echo -n` cb2574319 lxc/checkconfig: replace `type` by `command` 003efe6db lxc/checkconfig: replace `cat | grep` with `grep` adadfa372 lxc/lxccontainer: fix do_lxcapi_set_timeout retval c02367e59 containers in the FREEZING state also need to be unfreeze aca53bcf7 build(deps): bump actions/checkout from 3 to 4 84169158f lxccontainer.h: Move new fields to the end e2696df93 Remove references to LXD 7cec54455 Update console perms to 0600 3f45443fd Fix start api call to split quoted strings in execute or init command. fbc31691e github: Update for main branch 69e51b919 CONTRIBUTING: add a note on AI generated code 84cfe9772 get_hierarchy: dont WARN about no usable controller 64167f906 Add libarchive tar support for lxc download 213e2f68d github: Add DCO/target tests cf2b20209 explicitly convert *mainloop_handler to __u64 8575ffeb7 tests: fix parse_config_file seccomp test ca25f3bf6 src/tests: Fix container creation errors 539c39772 rename functions which clash with libsystemd's b670f0e75 commands: support timeout in LXC_CMD_GET_STATE 0fed82b26 lxccontainer: extend lxccontainer API with set_timeout 7fd671dbc mainloop: io_uring: disable IORING_POLL_ADD_MULTI 715fb4eff terminal: make a terminal FDs non-blocking 7eff16cc4 file_utils: add fd_make_nonblocking helper 747c4df31 file_utils: rename fd_make_nonblocking to fd_make_blocking ebea2b5a9 setproctitle(): Handle potential NULL return from strrchr() f7f15b20a make setproctitle()'s /proc/pid/stat parsing safe 890de0759 lsm: apparmor: allow to change mount propagation 5894cf310 console-log test: make sure container is stopped before restarting 820d2a2b3 switch from libsystemd's dbus to dbus-1 3c1453a38 tree-wide: convert fcntl(FD_CLOEXEC) to SOCK_CLOEXEC 4ea0b361f Allow fuse mounts in apparmor start-container. 1a2da75b6 Add support for squashfs images in oci via atomfs db3cbfa75 apparmor: don't try to mmap empty files 304bf58fa initutils: use PRIu64 for uint64_t in setproctitle 4de047f51 lxc-net.in: fix nftables syntax for IPv6 NAT 311bb8c53 Fix strlcat's return value checks 588b53b19 Fix typo: bev_type -> bdev_type 7914c259f drop broken lxc-test-fuzzers 849d80877 Fix build error on sparc64 caused by using the gold linker 43ad7816d lxc-default-cgns apparmor profile: allow overlay mounts 4fa83282b lxc_user_nic: fix get_mtu() error handling 1b0469530 Patching an incoming CVE (CVE-2022-47952) a8e1070c6 build: force linking against liblxc c27ea96f7 checkconfig: Fix filesystem capability check 3f361da61 checkconfig: Tweak cgroup handling 3ab04999d checkconfig: Tweak layout e027ca711 checkconfig: Hide version if no lxc-start 914fec51b checkconfig: Fix mixed tabs/spaces 70b176b0d src/lxc/meson.build: fix build without apparmor 42b22da6d cgroups: fix cgroup layout detection in __initialize_cgroups 0072919dd state: additional check in lxc_wait to prevent OOB 62b94d3ec cgroups: check snprintf retval in unpriv_systemd_create_scope 93d545e37 cgroups: fix buffer out-of-bounds access in enable_controllers_delegation f8aa61f97 network: always initialize struct nl_handler 6ea4a6c06 apparmor: properly check lxc_strmmap ret value b37cce95b github: fix coverity (add libpam-dev) a8dcf88d0 github: fix coverity build 7e7393413 conf: ensure mount tunnel is a dependent mount 01ae6d471 apparmor: allow shared mounts in start-container.in 81d94a4ee conf: create separate peer group for container's root 68020412c cgroups: only allocate user namespace if we have to 27f69d45b cgroups: use userns_exec_full() during cgroup removal 1029c2a06 README: remove lgtm dcf85308c meson.build: strip newline for variable assignments 8aac58866 meson.build: strip newlines from git output 16c6ff226 tests: lxc-test-reboot: Fix build on ia64 64eb31d02 src/lxc/meson.build: fix the static library path c6c705bfa build: drop build-time systemd dependency f321cd610 build: use cc.get_define to detect FS_CONFIG_* symbols 5aff4ea37 build: only build init.lxc.static if libcap is statically linkable c1f87c811 build: fix handling of dependancies to fix build on openSUSE bc318926d cgroups: fix -Waddress warning 4deaa28c0 Unroll IN_SET since the max usage is 2 elements check 73fd9bf55 tests: lxc-test-checkpoint-restore: use trap to do cleanup 8480c56a4 tools: lxc-destroy: update help message for --force 3cac3fce4 build: add libsystemd to oss fuzz dependencies f7cadaa34 lxc/attach: Detect EACCES from execvp and convert to 126 exit status 4ebca5a00 lxc-attach: Fix lost return codes of spawned processes that are killed 09233897b Update README.md 4a66dabf8 conf: allow cross-device links dc4f1220f build(deps): bump actions/checkout from 2 to 3 2b802090f Update cifuzz.yml 20cc78456 fix error message when use tools with -? option b0abedf60 use sd_bus_call_method_async to replace the asyncv one 589a930f1 tree-wide: split open helpers into open_utils.h 7b1836bce build: prevent the inclusion of linux/mount.h with a hack da8c29853 mount_utils: remove conf.h include 74c2f58e1 mount: move mount utilities from syscall_wrappers.h into mount_utils.h 68cf56489 tree-wide: minimize liburing.h inclusion 06f99c259 meson: fix docbook2x detection 133aa416c tree-wide: use struct open_how directly 63468abd3 tree-wide: use struct clone_args directly 4771699fd tree-wide: wipe direct or indirect linux/mount.h inclusion 16ebb29dc meson.build: allow explicit distrosysconfdir cbabe8abf build: check for FS_CONFIG_* header symbol in sys/mount.h ef1e0607b build: detect sys/pidfd.h availability c1115e150 build: detect where struct mount_attr is declared e452c8945 gitignore: Simplify 32a071519 lxc-usernsexec: allow to select which {g,u}id to switch to 7f6643071 README: update security mails 5e704fe38 meson.build: fix build without stack-protector 7d7235489 meson.build: fix build with -Dcapabilities=false 8ee887908 src/lxc/log.h: fix STRERROR_R_CHAR_P 353f0f992 meson: add remaining still-in-use config checks 3d360cf9d Store mount options in correct variable df3301046 Fix off-by-one error constructing mount options 8ee615c27 add check for statvfs 07a00b78f start: fix namespace sharing eae44ce19 conf: fix append_ttyname() 6c50e09f2 start: record inherited namespaces earlier to make it available for idmapped rootfs setup 7317d2a8a start: don't overwrite file descriptors during namespace preservation fc133a9f3 conf: log file descriptors on error during idmapped mount setup 26de6cbc8 fix for issue 4026: set broadcast to 0.0.0.0 for /31 and /32 c55353f84 use systemd dbus StartTransientUnit for unpriv cgroup2 b203e1a14 Fix uninitialized read in parse_cap when libcap is not used e73520adf meson: Set DEVEL flag post release f4d02217e tools: Provide multicall lxc binary 289d6413e meson: Generate compile commands by iterating over an array 132ff8e28 lxccontainer: rework copy_file() f357cb290 lxccontainer: improve mod_rdep() b576a47d5 Read list until process exits We also: - drop two patches that were backported - refresh the context of one Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
* lxc: convert remaining WORKDIR references to UNPACKDIRBruce Ashfield2024-05-291-2/+2
| | | | | | | | While the WORKDIR references seem to work, they may not continue to work. We switch to using UNPACKDIR which is where the SRC_URI referenced elements / files will be placed by the fetcher. Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
* lxc: fix broken test casesXiangyu Chen2024-04-093-0/+166
| | | | | | | | Upstream dropped cgroup handling in lxc-test-usernic lxc-test-unpriv and lxc-test-apparmor-mount to fix the broken cases. Signed-off-by: Xiangyu Chen <xiangyu.chen@windriver.com> Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
* lxc: adjust the lxc-test-unpriv running orderXiangyu Chen2024-01-191-1/+24
| | | | | | | | | | Some of lxc test cases can not full clean the system environment, that cause lxc-test-unpriv cannot execute successfully. Since those code in lxc are using for tests, so just adjust the cases order. Signed-off-by: Xiangyu Chen <xiangyu.chen@windriver.com> Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
* lxc: add distrosysconfdir option to make sure the lxc configuration in ↵Xiangyu Chen2023-12-041-1/+1
| | | | | | | | | | | | | | | | correct folder After the commit[1] "meson.build: allow explicit distrosysconfdir", the config of lxc would install to distrosysconfdir[2], if this value not set, it might set to /etc/sysconfig, that cause lxc-net configuration cannot be found[3] due to our bb file install the lxc-net to /etc/default folder. Ref: [1] https://github.com/lxc/lxc/commit/16ebb29dccb35bf74e8a19e8c45d2513f927476f [2] https://github.com/lxc/lxc/blob/main/config/sysconfig/meson.build#L9 [3] https://github.com/lxc/lxc/blob/main/config/sysconfig/lxc.in#L28 Signed-off-by: Xiangyu Chen <xiangyu.chen@windriver.com> Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
* recipes/classes/scripts: Drop SRCPV usageBruce Ashfield2023-08-241-1/+1
| | | | | | | | | bitbake has been enhanced such that SRCPV is no longer needed in PV to handle updating git hashes and task signatures. We can simplify our PV by dropping SRCPV Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
* lxc: update to 5.0.3Bruce Ashfield2023-08-241-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Bumping lxc to version lxc-5.0.3, which comprises the following commits: cb8e38aca Release LXC 5.0.3 85d3f4b1d github: Update for main branch d195603e3 CONTRIBUTING: add a note on AI generated code 54227bdb1 get_hierarchy: dont WARN about no usable controller be7efff35 github: Add DCO/target tests 8751cd208 explicitly convert *mainloop_handler to __u64 c16bb5b71 tests: fix parse_config_file seccomp test 95ef57c73 src/tests: Fix container creation errors 30c79f8a7 rename functions which clash with libsystemd's 3801a6a3d mainloop: io_uring: disable IORING_POLL_ADD_MULTI fba0ae071 terminal: make a terminal FDs non-blocking 1af412d2f file_utils: add fd_make_nonblocking helper eaaf041f6 file_utils: rename fd_make_nonblocking to fd_make_blocking d05fb8a45 setproctitle(): Handle potential NULL return from strrchr() 709d42691 make setproctitle()'s /proc/pid/stat parsing safe b183d437b console-log test: make sure container is stopped before restarting d638d5951 tree-wide: convert fcntl(FD_CLOEXEC) to SOCK_CLOEXEC c12c0acb0 Allow fuse mounts in apparmor start-container. c93418d98 Add support for squashfs images in oci via atomfs 3754e803f apparmor: don't try to mmap empty files 706ee25cd initutils: use PRIu64 for uint64_t in setproctitle 3cdd5078c lxc-net.in: fix nftables syntax for IPv6 NAT 97bf62247 Fix strlcat's return value checks 7c81572af Fix typo: bev_type -> bdev_type 727adc052 drop broken lxc-test-fuzzers Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
* lxc: update to 5.0.2-tipBruce Ashfield2023-04-051-1/+1
| | | | | | | | | Bumping lxc to version lxc-5.0.2-1-g727adc052, which comprises the following commits: 727adc052 drop broken lxc-test-fuzzers d57173681 Release LXC 5.0.2 Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
* lxc: templates/lxc-busybox.in: if busybox contains init then use itXiangyu Chen2023-03-172-0/+46
| | | | | Signed-off-by: Xiangyu Chen <xiangyu.chen@windriver.com> Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
* lxc: add -L option for curl in templates-use-curl-instead-of-wget.patchXiangyu Chen2023-03-171-1/+1
| | | | | | | | | | | | | | Add support of redirect option for curl, the linuxcontainers.org sometimes redirect to other mirror site such like us.lxd.images.canonical.com, this would cause the lxc-download script report download failed. Reproduce and verified on following command: lxc-create -t download -n test -- --dist archlinux --release current --arch arm64 Signed-off-by: Xiangyu Chen <xiangyu.chen@windriver.com> Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
* lxc: skip lxc-test-apparmor-mount and lxc-test-get_item in ptestXiangyu Chen2023-03-081-0/+3
| | | | | | | | | lxc-test-apparmor-mount and lxc-test-get_item related to apparmor, since the lxc-test-apparmor has been already skipped, so also skip those two cases. Signed-off-by: Xiangyu Chen <xiangyu.chen@windriver.com> Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
* treewide: bulk update patches with status fieldBruce Ashfield2023-01-275-0/+10
| | | | | | | | | | | | | | | While the insane.bbclass upstream-status check hasn't been made default, users of meta-virtualization may have it enabled in their distros .. so the effect is the same. We must have this tracking tag in out patches. This is a bulk update to add the tag and silence the QA message. As packages get updated, the normal/routine process of checking the patches will continue, and the status fields may (or may not) get more useful. Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
* lxc: update to v5.0.2Bruce Ashfield2023-01-192-53/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | We drop a patch that has been merged upsream, and also bump the version to lxc-5.0.2, which comprises the following commits: d57173681 Release LXC 5.0.2 17c85aac6 Fix build error on sparc64 caused by using the gold linker b7dfb1312 lxc-default-cgns apparmor profile: allow overlay mounts 5cde898f4 lxc_user_nic: fix get_mtu() error handling 80553b5b4 Patching an incoming CVE (CVE-2022-47952) 1089f49c5 build: force linking against liblxc 0d2a03118 checkconfig: Fix filesystem capability check e17429580 checkconfig: Tweak cgroup handling 4ab76611d checkconfig: Tweak layout 0bca9bb18 checkconfig: Hide version if no lxc-start 957e0a5d9 checkconfig: Fix mixed tabs/spaces 4916a16bd src/lxc/meson.build: fix build without apparmor a330126b4 build: use cc.get_define to detect FS_CONFIG_* symbols c89be8325 cgroups: fix cgroup layout detection in __initialize_cgroups 7802f3647 state: additional check in lxc_wait to prevent OOB 4b434bf52 cgroups: check snprintf retval in unpriv_systemd_create_scope 0eca8d2ea cgroups: fix buffer out-of-bounds access in enable_controllers_delegation 4ce8345d6 network: always initialize struct nl_handler 28a1591cd apparmor: properly check lxc_strmmap ret value bd56c89ea github: fix coverity (add libpam-dev) a1ead0dcc github: fix coverity build 9e35b3ecd conf: ensure mount tunnel is a dependent mount 2ff447445 apparmor: allow shared mounts in start-container.in 58e878209 conf: create separate peer group for container's root 06b4612ee cgroups: only allocate user namespace if we have to 2662959b8 cgroups: use userns_exec_full() during cgroup removal 4dcc84c6b README: remove lgtm 748720ceb tests: lxc-test-reboot: Fix build on ia64 5749e2e20 Unroll IN_SET since the max usage is 2 elements check 495b1bbf4 tests: lxc-test-checkpoint-restore: use trap to do cleanup 77e08b887 tools: lxc-destroy: update help message for --force 9165ff1ed lxc/attach: Detect EACCES from execvp and convert to 126 exit status 011faff36 lxc-attach: Fix lost return codes of spawned processes that are killed 931693945 Update README.md a6287882e conf: allow cross-device links 8fa6d765a build(deps): bump actions/checkout from 2 to 3 e08c1b740 Update cifuzz.yml 0e9e64db8 fix error message when use tools with -? option f1a61a5f0 use sd_bus_call_method_async to replace the asyncv one ca863bd72 tree-wide: split open helpers into open_utils.h 02900160c build: prevent the inclusion of linux/mount.h with a hack 51b8763b0 mount_utils: remove conf.h include 460243f40 mount: move mount utilities from syscall_wrappers.h into mount_utils.h d5d7e2036 tree-wide: minimize liburing.h inclusion e2b8776bb meson: fix docbook2x detection d1dfce9c5 tree-wide: use struct open_how directly c9bca3326 tree-wide: use struct clone_args directly 497479ea3 tree-wide: wipe direct or indirect linux/mount.h inclusion 02f4bd00f build: check for FS_CONFIG_* header symbol in sys/mount.h c222fb567 gitignore: Simplify 22e8a7941 meson.build: strip newline for variable assignments d5600cf76 meson.build: strip newlines from git output 7d6b53438 src/lxc/meson.build: fix the static library path 1d5c7e771 build: drop build-time systemd dependency 59f69162c build: only build init.lxc.static if libcap is statically linkable 062c2d980 build: fix handling of dependancies to fix build on openSUSE 2a9743bba cgroups: fix -Waddress warning e510d6bd8 build: detect sys/pidfd.h availability b7b269680 build: detect where struct mount_attr is declared 5313e5048 meson.build: allow explicit distrosysconfdir 0539095ac Release LXC 5.0.1 a1329fefe README: update security mails 315d4cec6 meson.build: fix build without stack-protector aba631cd4 meson.build: fix build with -Dcapabilities=false c2ee9b440 src/lxc/log.h: fix STRERROR_R_CHAR_P d441ee585 meson: add remaining still-in-use config checks 00a79876b Store mount options in correct variable da0f35646 Fix off-by-one error constructing mount options 31bff905a add check for statvfs 242289b6b start: fix namespace sharing 41f602361 conf: fix append_ttyname() ea4fd7f85 start: record inherited namespaces earlier to make it available for idmapped rootfs setup e74fd55bc start: don't overwrite file descriptors during namespace preservation dcfd75bb4 conf: log file descriptors on error during idmapped mount setup c3e648700 fix for issue 4026: set broadcast to 0.0.0.0 for /31 and /32 cfcbdb75f use systemd dbus StartTransientUnit for unpriv cgroup2 28726f215 Fix uninitialized read in parse_cap when libcap is not used d663495ee meson: Generate compile commands by iterating over an array Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
* lxc: fix compilation error for ARM/ARM64Chen Qi2022-08-252-0/+50
| | | | | | | | | | | | | | | | | There's compilation error when building lxc for ARM/ARM64 BSPs. The error message is as below: | ../git/src/lxc/cgroups/cgfsng.c:1234:111: error: incompatible type for argument 10 of 'sd_bus_call_method_asyncv' The 10th argument is of type va_list but NULL is supplied, thus causing compilation error. So we use sd_bus_call_method_async to replace the asyncv one to solve this issue. Signed-off-by: Chen Qi <Qi.Chen@windriver.com> Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
* lxc: update to 5.x and mesonBruce Ashfield2022-08-257-173/+127
| | | | | | | | | | | | | | | | | This is a significant update to lxc as autotools has been replaced with meson. Not all existing autotools options have meson equivalents, so there may be differences in functionallity. As part of this update, and unused features have been dropped, mainly when the meson equivalent was not available. Basic / core functionality has been tested with systemd, sysvinit requires more work, and patches will be accepted to restore that capability. Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
* lxc: update to 4.0.12Bruce Ashfield2022-03-212-16/+14
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | We refresh our wget -> curl patch for context, but otherwise, no other changes are required. Bumping lxc to version lxc-4.0.12-8-g5ba5725cb, which comprises the following commits: 5ba5725cb cgroups: modify cgroup2 attach logic 1e4631641 ttys: ensure container_ttys= env variable is set correctly 8ef019a6c doc: Fix reverse allowlist/denylist in Japanese man page f1c4a17e7 cgroups: log fd of newly created cgroup f7446b4e1 cgroups: check that opened file descriptor is a cgroup filesystem 71ba7f656 doc: Fix reverse allowlist/denylist f314419d1 lxc-checkconfig: Fix bashism ca4c25c6e lxc-net: don't start by default inside lxc 7e37cc96b Release LXC 4.0.12 d678aa61e lxccontainer: allow xdev when creating the container dir bc61d2354 github: Clear default ACL on /home fb0e0b3dd github: add systemd-coredump 53e0d390c github: more detailed compilation instructions db84a8b6b github: log system info e9282b6a6 github: ensure system liblxc is wiped ad8a3bd68 lxccontainer: properly wrap lxcapi_create() bceb81cd2 build: simplify thread local storage handling 919da35b0 build: only enable LTO for regular builds d0a1e9c44 lxccontainer: simplify partial file creation 62b5c0051 lxccontainer: improve create_partial() bfe24cb6a lxccontainer: improve do_lxcapi_create() 1a5c236ac lxccontainer: improve do_lxcapi_save_config() bae0d7196 conf: log termination status 4eb09aaad conf: improve userns_exec_mapped_root() 928943280 github: stop installing gnupg now that it's unused 7c70b0d14 lxc-download: Rely on HTTPS only 199d2077c Update README.md: Fix broken link (403 Forbidden) 0b6b230e3 attach: don't pointlessly call cgroup_init() dbef704fb commands: log command during file descriptor retrieval 733f9c909 lxc-checkconfig.in: CONFIG_NF_NAT_IPV4 was removed from the kernel 2019-03-03 ce392e230 (trivial) Fix error message, failure was connect not bind 5628bff79 seccomp: close seccomp notifier fd in cleanup handler 1f2af83a9 seccomp: only guard seccomp notify behind HAVE_DECL_SECCOMP_NOTIFY_FD 9451303d5 api-extensions: don't advertise seccomp notify support if it's not compiled in 23d07c315 use 2 sysfs instances for sys:mixed 0dd3258bd Revert "api: ->save_config() doesn't need to create container dir" 93edd510a api: ->save_config() doesn't need to create container dir 28b2e04f1 cgroups: fix compiler warning 15515f9a3 Revert "initutils: use vfork() in lxc_container_init()" 41d2530d1 macro: ensure necessary io_uring flags are defined fc4e948c9 autotools: Avoid multiple liblxc.so with --enable-pam a616a311a build: refuse to compile with unsupported liburing version 93be4e512 tests: add lxc.proc.* test d8027e49c tests: add lxc.sysctls.* test 6f580343e test: improve logging helpers a10ff3418 conf: improve logging setting sysctl and /proc/<pid>/ parameters 334cf7beb conf: apply /proc/sys and /proc/<pid>/ parameters 1b74e01ad tests: include config.h c36379431 build: move _FILE_OFFSET_BITS to common option f24c234ee start: log signal name and number 4915c9112 process_utils: add signal_name() helper 78baec37d build: improve liburing support detection 1a102b310 mainloop: make ifdefs easier to follow cf931928f Replace last occurence of 'which' with 'command -v' 1ec5939b4 Replace deprecated backticks with $() construct fdfb4a13d Replace 'which' with 'command -v' in tests too 71743e811 start: check event loop type before closing fd f69e6b4d3 mainloop: make sure that descr->ring is allocated 1a8895855 Replace 'which' with 'command -v' 9219277cc build: add io-uring-event-loop option d04eb166c build: add static libcap to output bc51048b7 confile: don't use path_simplify() on lxc.{execute,init}.cmd 48728e988 conf: add cgroup2, cgroup2:ro, cgroup2:force, cgroup2:ro:force options 4d3aad49d AUTHORS: Update to point to git history e328a988e conf: handle kernels without or not using SMT d40b0deb4 doc: fix typo in English lxc.container.conf(5) 49fab27fc doc: Add lxc.sched.core to Japanese lxc.container.conf(5) 1ad1cab80 doc: add loglevels to ja and ko common options 1505f0780 conf: make it more obvious how auto-mount flags are defined 429233cf0 criu: support restoring containers with pre-created veth devices 48e079bf3 Release LXC 4.0.11 Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
* global: update licence values to SPDX valuesBruce Ashfield2022-02-181-1/+1
| | | | | | | | | | These changes are the result of running the convert-spdx-licenses.py oe-core script. There's no impact to the build, but we will avoid issues when interacting with core QA by the alignment. Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
* global: convert github SRC_URIs to use https protocolBruce Ashfield2021-11-021-1/+1
| | | | | | | | | | | github is removing git:// access, and fetches will start experiencing interruptions in service, and eventually will fail completely. bitbake will also begin to warn on github src_uri's that don't use https. So we convert the meta-virt instances to use protocol=https (done using the oe-core contrib conversion script) Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
* lxc: update to 4.0.11Xu, Yanfei2021-11-025-182/+15
| | | | | | | | | | | | | | update to 4.0.11 1.drop two patches that have been integrated to upstream repo. 2.drop tests-add-no-validate-when-using-download-template.patch because it is no longer appropriate as the "download" has been replaced with "busybox" 3.fix the apply failure of templates-use-curl-instead-of-wget.patch 4.update lxc from 4.0.10 to 4.0.11 Signed-off-by: Yanfei Xu <yanfei.xu@windriver.com> Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
* lxc: Fix -c command for lxc-attachsana kazi2021-09-162-0/+37
| | | | | | | | | | Added fix_c_command.patch the -c command seems to be broken because the passed context is ignored and always overwritten by the context specified in the config file. Signed-off-by: Sana Kazi <Sana.Kazi@kpit.com> Signed-off-by: Sana Kazi <sanakazisk19@gmail.com> Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
* lxc: update to 4.0.10 and switch to gitBruce Ashfield2021-09-161-6/+4
| | | | | | | | To more easily pull in fixes / backports from newer versions, switching to git. This also allows bisecting and easier support when we run into upgrade issues. Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
* lxc: Enable seccomp support for lxcsana kazi2021-09-092-0/+48
| | | | | | | | | | | Enabled seccomp support for lxc. Also added a patch to enable seccomp.profile only when compiled with libseccomp. Currently, seccomp.profile is silently ignored. This could lead to the false impression that the seccomp filter is applied while it actually isn't. Signed-off-by: Sana Kazi <Sana.Kazi@kpit.com> Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
* global: overrides syntax conversionBruce Ashfield2021-08-021-26/+26
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | OEcore/bitbake are moving to use the clearer ":" as an overrides separator. This is pass one of updating the meta-virt recipes to use that syntax. This has only been minimally build/runtime tested, more changes will be required for missed overrides, or incorrect conversions Note: A recent bitbake is required: commit 75fad23fc06c008a03414a1fc288a8614c6af9ca Author: Richard Purdie <richard.purdie@linuxfoundation.org> Date: Sun Jul 18 12:59:15 2021 +0100 bitbake: data_smart/parse: Allow ':' characters in variable/function names It is becomming increasingly clear we need to find a way to show what is/is not an override in our syntax. We need to do this in a way which is clear to users, readable and in a way we can transition to. The most effective way I've found to this is to use the ":" charater to directly replace "_" where an override is being specified. This includes "append", "prepend" and "remove" which are effectively special override directives. This patch simply adds the character to the parser so bitbake accepts the value but maps it back to "_" internally so there is no behaviour change. This change is simple enough it could potentially be backported to older version of bitbake meaning layers using the new syntax/markup could work with older releases. Even if other no other changes are accepted at this time and we don't backport, it does set us on a path where at some point in future we could require a more explict syntax. I've tested this patch by converting oe-core/meta-yocto to the new syntax for overrides (9000+ changes) and then seeing that builds continue to work with this patch. (Bitbake rev: 0dbbb4547cb2570d2ce607e9a53459df3c0ac284) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
* lxc: update to 4.0.9Bruce Ashfield2021-07-124-128/+29
| | | | | | | | | Bumping lxc to a newer 4.0 -stable release. We drop two patches that have been integrated to the upstream repo, but otherwise, things are the same. Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
* lxc: add upstream-status to patchBruce Ashfield2021-04-181-0/+2
| | | | Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
* lxc-recipe: Fix compilation without seccomp when libseccomp is installedRameshkrishnanX Geddy Sekar2021-04-183-0/+97
| | | | | | | Original URL: https://github.com/lxc/lxc/pull/3623 Signed-off-by: RameshkrishnanX Geddy Sekar <rameshkrishnanx.geddy.sekar@intel.com> Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
* lxc: change download folderRobi Buranyi2021-03-111-1/+1
| | | | | | | | | The URI has been changed to 'https://linuxcontainers.org/downloads/lxc' by the site maintainers recently. Updating the recipe to reflect the new path. Signed-off-by: Robi Buranyi <rburanyi@google.com> Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
* lxc: update to 4.0.6Bruce Ashfield2021-02-073-70/+2
| | | | | | | | | Updating to the next minor revision in the LTS. We also drop two patches that are included in the main repository as partof this bump. Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
* lxc: Fix postinstall script for read-only rootfsDaniel Dragomir2021-01-101-4/+4
| | | | | | | | Ensure postinstall script for lxc-networking package can run at build time for a read-only rootfs (with sysvinit). Signed-off-by: Daniel Dragomir <Daniel.Dragomir@windriver.com> Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
* lxc: remove deprecated options in lxc*.serviceMingli Yu2020-10-013-0/+68
| | | | | | | | | | | Remove deprecated options in lxc*.service to silence below warning: # systemctl status lxc [snip] /usr/lib/systemd/system/lxc.service:17: Standard output type syslog is obsolete, automatically updating to journal. Please update your unit file, and consider removing the setting altogether. /usr/lib/systemd/system/lxc.service:18: Standard output type syslog is obsolete, automatically updating to journal. Please update your unit file, and consider removing the setting altogether. Signed-off-by: Mingli Yu <mingli.yu@windriver.com> Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
* lxc: Disable warnings as errorsKhem Raj2020-08-271-3/+1
| | | | | | | | Instead of disabling particular warnings, its better to use configure switch, since some of these warnings could be compiler specific Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
* lxc: update to v4.0.4Bruce Ashfield2020-08-183-6/+9
| | | | | | | While we are updating, we refresh one patch to remove fuzz, otherwise there are no significant changes. Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2026-07-26 22:09:28 +0000