From 013fe63f17b2e25ba06744c7db436ca0ab01285f Mon Sep 17 00:00:00 2001 From: Bruce Ashfield Date: Tue, 8 Nov 2016 15:14:51 -0500 Subject: runc: introduce oci-systemd-hook To support running "OS containers" aka systemd as the entry point under runc, we provide the oci-systemd-hook. By adding this to the pre-start and stop hook points, coupled with the proper config.json, you can start systemd controlled containers via runc. Signed-off-by: Bruce Ashfield --- .../0001-configure-drop-selinux-support.patch | 25 ++++++++++++++ .../0001-selinux-drop-selinux-support.patch | 40 ++++++++++++++++++++++ .../oci-systemd-hook/oci-systemd-hook_git.bb | 35 +++++++++++++++++++ 3 files changed, 100 insertions(+) create mode 100644 recipes-containers/oci-systemd-hook/oci-systemd-hook/0001-configure-drop-selinux-support.patch create mode 100644 recipes-containers/oci-systemd-hook/oci-systemd-hook/0001-selinux-drop-selinux-support.patch create mode 100644 recipes-containers/oci-systemd-hook/oci-systemd-hook_git.bb (limited to 'recipes-containers') diff --git a/recipes-containers/oci-systemd-hook/oci-systemd-hook/0001-configure-drop-selinux-support.patch b/recipes-containers/oci-systemd-hook/oci-systemd-hook/0001-configure-drop-selinux-support.patch new file mode 100644 index 00000000..510126e4 --- /dev/null +++ b/recipes-containers/oci-systemd-hook/oci-systemd-hook/0001-configure-drop-selinux-support.patch @@ -0,0 +1,25 @@ +From 12c263703a0b0ae92566de7e5440fce7b59cd9be Mon Sep 17 00:00:00 2001 +From: Bruce Ashfield +Date: Tue, 8 Nov 2016 13:16:19 -0500 +Subject: [PATCH] configure: drop selinux support + +Signed-off-by: Bruce Ashfield +--- + configure.ac | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/configure.ac b/configure.ac +index c1275acb253d..eaba7fbb57e2 100644 +--- a/configure.ac ++++ b/configure.ac +@@ -8,7 +8,6 @@ AC_USE_SYSTEM_EXTENSIONS + AC_SYS_LARGEFILE + + PKG_CHECK_MODULES([YAJL], [yajl >= 2.0.0]) +-PKG_CHECK_MODULES([SELINUX], [libselinux >= 2.0.0]) + PKG_CHECK_MODULES([LIBMOUNT], [mount >= 2.23.0]) + + AC_MSG_CHECKING([whether to disable argument checking]) +-- +2.4.0.53.g8440f74 + diff --git a/recipes-containers/oci-systemd-hook/oci-systemd-hook/0001-selinux-drop-selinux-support.patch b/recipes-containers/oci-systemd-hook/oci-systemd-hook/0001-selinux-drop-selinux-support.patch new file mode 100644 index 00000000..507cd08e --- /dev/null +++ b/recipes-containers/oci-systemd-hook/oci-systemd-hook/0001-selinux-drop-selinux-support.patch @@ -0,0 +1,40 @@ +From 9b66394c712ec0d0fcb2052baa7f590621a53461 Mon Sep 17 00:00:00 2001 +From: Bruce Ashfield +Date: Tue, 8 Nov 2016 13:15:46 -0500 +Subject: [PATCH] selinux: drop selinux support + +Signed-off-by: Bruce Ashfield +--- + src/systemdhook.c | 9 --------- + 1 file changed, 9 deletions(-) + +diff --git a/src/systemdhook.c b/src/systemdhook.c +index 274e5b910699..b9e8f1be376a 100644 +--- a/src/systemdhook.c ++++ b/src/systemdhook.c +@@ -14,7 +14,6 @@ + #include + #include + #include +-#include + #include + + #include "config.h" +@@ -538,14 +537,6 @@ static int prestart(const char *rootfs, + } + } + +- if (strcmp("", mount_label)) { +- rc = setfilecon(journal_dir, (security_context_t)mount_label); +- if (rc < 0) { +- pr_perror("Failed to set journal dir selinux context"); +- return -1; +- } +- } +- + if (makepath(cont_journal_dir, 0755) == -1) { + if (errno != EEXIST) { + pr_perror("Failed to mkdir container journal dir: %s", cont_journal_dir); +-- +2.4.0.53.g8440f74 + diff --git a/recipes-containers/oci-systemd-hook/oci-systemd-hook_git.bb b/recipes-containers/oci-systemd-hook/oci-systemd-hook_git.bb new file mode 100644 index 00000000..872872a1 --- /dev/null +++ b/recipes-containers/oci-systemd-hook/oci-systemd-hook_git.bb @@ -0,0 +1,35 @@ +DESCRIPTION = "OCI systemd hook enables users to run systemd in docker and OCI" +SECTION = "console/utils" +LICENSE = "GPLv3" +LIC_FILES_CHKSUM = "file://LICENSE;md5=d32239bcb673463ab874e80d47fae504" +PRIORITY = "optional" + +DEPENDS = "yajl util-linux" + +SRCREV = "ca515c1f399bd0b16e94b7c34aa1ef20498beca6" +SRC_URI = "git://github.com/projectatomic/oci-systemd-hook \ + file://0001-selinux-drop-selinux-support.patch \ + file://0001-configure-drop-selinux-support.patch \ +" + +PV = "0.0.1+git${SRCPV}" +S = "${WORKDIR}/git" + +inherit autotools pkgconfig + +PACKAGECONFIG ??= "" +PACKAGECONFIG[selinux] = ",,libselinux" + +EXTRA_OECONF += "--libexecdir=${libexecdir}/oci/hooks.d" + +# nothing to compile, we do it all in the install task +do_compile[noexec] = "1" + +do_install() { + # Avoid building docs, and other artifacts by surgically calling the + # semi-internal target of "install-exec-am" + oe_runmake 'DESTDIR=${D}' install-exec-am +} + +FILES_${PN} += "${libexecdir}/oci/hooks.d/" + -- cgit v1.2.3-54-g00ecf