Re: [lxc-devel] conceptual questions about user namespaces

2013-04-12 Thread Serge Hallyn
Quoting Guido Jäkel (g.jae...@dnb.de): > First i want to to say that i didn't test this feature by myself up to now. > But from reading the list, i have questions. > > For me, the main usecases of the user namespace feature seems to be: > > a) to "shift" the containers root user - a security dri

Re: [lxc-devel] Howto user namespaces?

2013-04-12 Thread Serge Hallyn
Quoting richard -rw- weinberger (richard.weinber...@gmail.com): > On Thu, Apr 11, 2013 at 11:40 PM, Serge Hallyn > wrote: > > Quoting richard -rw- weinberger (richard.weinber...@gmail.com): > >> Sadly, do_start() calls lxc_setup() which calls setup_console() which calls > >> later chmod(). > > >

Re: [lxc-devel] [PATCH] Use container specific domain socket name

2013-04-12 Thread Serge Hallyn
Quoting Daniel Lezcano (daniel.lezc...@free.fr): > Sorry for jumping so late in the thread but I disagree to use DBUS with > LXC because of the dependency with more packages, LXC has been designed > to be stand alone, nothing prevent to add more complexity and > dependencies but on top of LXC not i

Re: [lxc-devel] [PATCH] Use container specific domain socket name

2013-04-12 Thread S . Çağlar Onur
I'm not experienced with it so please forgive me if I'm talking non-sense but what about switching back to using (or abusing depending on your point of view) netlink via libnl? On Fri, Apr 12, 2013 at 10:02 AM, Serge Hallyn wrote: > Quoting Daniel Lezcano (daniel.lezc...@free.fr): > > Sorry for

[lxc-devel] [PATCH] fix checking hook script exit code

2013-04-12 Thread Dwight Engen
pclose returns the exit status from wait, we need to check that to see if the script itself failed or not. Tested a script that returned 0, 1, and also one that did a sleep and then was killed by a signal (abnormal termination). Signed-off-by: Dwight Engen --- src/lxc/conf.c | 7 +-- 1 file

Re: [lxc-devel] [PATCH] fix checking hook script exit code

2013-04-12 Thread Serge Hallyn
Quoting Dwight Engen (dwight.en...@oracle.com): > pclose returns the exit status from wait, we need to check that to see if > the script itself failed or not. Tested a script that returned 0, 1, and > also one that did a sleep and then was killed by a signal (abnormal > termination). > > Signed-of

Re: [lxc-devel] [PATCH] fix checking hook script exit code

2013-04-12 Thread Dwight Engen
On Fri, 12 Apr 2013 15:36:03 -0500 Serge Hallyn wrote: > Quoting Dwight Engen (dwight.en...@oracle.com): > > pclose returns the exit status from wait, we need to check that to > > see if the script itself failed or not. Tested a script that > > returned 0, 1, and also one that did a sleep and the

Re: [lxc-devel] [PATCH] Use container specific domain socket name

2013-04-12 Thread Daniel Lezcano
On 04/12/2013 06:55 PM, S.Çağlar Onur wrote: > I'm not experienced with it so please forgive me if I'm talking > non-sense but what about switching back to using (or abusing depending > on your point of view) netlink via libnl? Because it is much more than abusing :) It is hacking the rtnetlink se

Re: [lxc-devel] [PATCH] Use container specific domain socket name

2013-04-12 Thread S . Çağlar Onur
Hi Daniel, I might be completely wrong and I'm only asking for educational purposes as I started to read netlink docs couple of hours ago but it looks like it's possible to crete new netlink protocol/group and use it for IPC between userspace applications, in fact it looks like that's what udev-mo

Re: [lxc-devel] [PATCH] fix checking hook script exit code

2013-04-12 Thread Serge Hallyn
Quoting Dwight Engen (dwight.en...@oracle.com): > On Fri, 12 Apr 2013 15:36:03 -0500 > Serge Hallyn wrote: > > > Quoting Dwight Engen (dwight.en...@oracle.com): > > > pclose returns the exit status from wait, we need to check that to > > > see if the script itself failed or not. Tested a script t

Re: [lxc-devel] [PATCH] fix checking hook script exit code

2013-04-12 Thread Dwight Engen
On Fri, 12 Apr 2013 17:32:49 -0500 Serge Hallyn wrote: > Quoting Dwight Engen (dwight.en...@oracle.com): > > On Fri, 12 Apr 2013 15:36:03 -0500 > > Serge Hallyn wrote: > > > > > Quoting Dwight Engen (dwight.en...@oracle.com): > > > > pclose returns the exit status from wait, we need to check th