X-Git-Url: http://git.linux-vserver.org/cgi-bin/gitweb.cgi?a=blobdiff_plain;f=lib%2Fvserver.h;h=b2858fa48997477402a879df1774322a15c624c2;hb=HEAD;hp=d403677f389cbac0418104669a264f03396875c9;hpb=3564d8678a2134185e5e6e83083de027b359ca28;p=util-vserver.git diff --git a/lib/vserver.h b/lib/vserver.h index d403677..b2858fa 100644 --- a/lib/vserver.h +++ b/lib/vserver.h @@ -141,6 +141,9 @@ #define VC_CAP_LEASE 28 #define VC_CAP_AUDIT_WRITE 29 #define VC_CAP_AUDIT_CONTROL 30 +#define VC_CAP_SETFCAP 31 +#define VC_CAP_MAC_OVERRIDE 32 +#define VC_CAP_MAC_ADMIN 33 #define VC_IMMUTABLE_FILE_FL 0x0000010lu #define VC_IMMUTABLE_LINK_FL 0x0008000lu @@ -151,11 +154,13 @@ #define VC_IATTR_ADMIN 0x00000001u #define VC_IATTR_WATCH 0x00000002u #define VC_IATTR_HIDE 0x00000004u -#define VC_IATTR_FLAGS 0x00000007u +#define VC_IATTR_WRITE 0x00000008u +#define VC_IATTR_FLAGS 0x0000000fu #define VC_IATTR_BARRIER 0x00010000u #define VC_IATTR_IUNLINK 0x00020000u #define VC_IATTR_IMMUTABLE 0x00040000u +#define VC_IATTR_COW 0x00080000u // the flags @@ -194,14 +199,19 @@ #define VC_VXF_PROLIFIC (1ULL<<49) #define VC_VXF_IGNEG_NICE (1ULL<<52) +#define VC_VXF_IGNEG_IONICE (1ULL<<53) // the ccapabilities #define VC_VXC_SET_UTSNAME 0x00000001ull #define VC_VXC_SET_RLIMIT 0x00000002ull +#define VC_VXC_FS_SECURITY 0x00000004ull +#define VC_VXC_TIOCSTI 0x00000010ull #define VC_VXC_RAW_ICMP 0x00000100ull #define VC_VXC_SYSLOG 0x00001000ull +#define VC_VXC_OOM_ADJUST 0x00002000ull +#define VC_VXC_AUDIT_CONTROL 0x00004000ull #define VC_VXC_SECURE_MOUNT 0x00010000ull #define VC_VXC_SECURE_REMOUNT 0x00020000ull @@ -211,6 +221,9 @@ #define VC_VXC_ADMIN_MAPPER 0x00200000ull #define VC_VXC_ADMIN_CLOOP 0x00400000ull +#define VC_VXC_KTHREAD 0x01000000ull +#define VC_VXC_NAMESPACE 0x02000000ull + // the scheduler flags #define VC_VXSM_FILL_RATE 0x0001 @@ -237,6 +250,7 @@ #define VC_NXF_SINGLE_IP 0x00000100ull #define VC_NXF_LBACK_REMAP 0x00000200ull +#define VC_NXF_LBACK_ALLOW 0x00000400ull #define VC_NXF_HIDE_NETIF 0x02000000ull #define VC_NXF_HIDE_LBACK 0x04000000ull @@ -249,6 +263,8 @@ // the network capabilities +#define VC_NXC_TUN_CREATE 0x00000001ull + #define VC_NXC_RAW_ICMP 0x00000100ull @@ -265,8 +281,18 @@ // the VCI bit values #define VC_VCI_NO_DYNAMIC (1 << 0) +#define VC_VCI_PROC_SECURE (1 << 4) +#define VC_VCI_HARDCPU (1 << 5) +#define VC_VCI_IDLELIMIT (1 << 6) +#define VC_VCI_IDLETIME (1 << 7) +#define VC_VCI_COWBL (1 << 8) +#define VC_VCI_FULLCOWBL (1 << 9) #define VC_VCI_SPACES (1 << 10) #define VC_VCI_NETV2 (1 << 11) +#define VC_VCI_MEMCG (1 << 12) +#define VC_VCI_DEBUG (1 << 16) +#define VC_VCI_HISTORY (1 << 20) +#define VC_VCI_TAGGED (1 << 24) #define VC_VCI_PPTAG (1 << 28) @@ -306,7 +332,15 @@ #ifndef CLONE_NEWIPC # define CLONE_NEWIPC 0x08000000 #endif - +#ifndef CLONE_NEWUSER +# define CLONE_NEWUSER 0x10000000 +#endif +#ifndef CLONE_NEWPID +# define CLONE_NEWPID 0x20000000 +#endif +#ifndef CLONE_NEWNET +# define CLONE_NEWNET 0x40000000 +#endif #define VC_BAD_PERSONALITY ((uint_least32_t)(-1)) @@ -358,6 +392,8 @@ extern "C" { */ vc_vci_t vc_get_vci(); + int vc_get_kernel(); + /** \brief Moves current process into a context * \ingroup syscalls * @@ -632,20 +668,26 @@ extern "C" { uint16_t vna_flags; uint16_t vna_prefix; uint16_t vna_parent; - union { - struct { - struct in_addr ip; - struct in_addr mask; - } ipv4; - struct { - struct in6_addr ip; - struct in6_addr mask; - } ipv6; - } u; -#define vna_v4_ip u.ipv4.ip -#define vna_v4_mask u.ipv4.mask -#define vna_v6_ip u.ipv6.ip -#define vna_v6_mask u.ipv6.mask + struct { + union { + struct in_addr v4; + struct in6_addr v6; + } ip; + union { + struct in_addr v4; + struct in6_addr v6; + } ip2; + union { + struct in_addr v4; + struct in6_addr v6; + } mask; + } s; +#define vna_v4_ip s.ip.v4 +#define vna_v4_ip2 s.ip2.v4 +#define vna_v4_mask s.mask.v4 +#define vna_v6_ip s.ip.v6 +#define vna_v6_ip2 s.ip2.v6 +#define vna_v6_mask s.mask.v6 }; struct vc_net_flags { @@ -740,10 +782,11 @@ extern "C" { char *val, size_t len) VC_ATTR_NONNULL((3)); /* namespace related functions */ - int vc_enter_namespace(xid_t xid, uint_least64_t mask); - int vc_set_namespace(xid_t xid, uint_least64_t mask); - int vc_cleanup_namespace(); - uint_least64_t vc_get_space_mask(); + int vc_enter_namespace(xid_t xid, uint_least64_t mask, uint32_t index); + int vc_set_namespace(xid_t xid, uint_least64_t mask, uint32_t index); + int vc_cleanup_namespace(void); + uint_least64_t vc_get_space_mask(void); + uint_least64_t vc_get_space_default(void); /* disk limit related things */ @@ -813,8 +856,21 @@ extern "C" { /* misc. syscalls */ int vc_set_mapping(xid_t xid, const char *device, const char *target, uint32_t flags); + int vc_unset_mapping(xid_t xid, const char *device, const char *target, uint32_t flags); + + int vc_get_badness(xid_t xid, int64_t *badness); + int vc_set_badness(xid_t xid, int64_t badness); + /** \brief Namespaces allowed to unshare */ + struct vc_umask { + uint_least64_t umask; + uint_least64_t mask; + }; + + int vc_get_umask(xid_t xid, struct vc_umask *umask); + int vc_set_umask(xid_t xid, struct vc_umask const *umask); + /** \brief Information about parsing errors * \ingroup helper */ @@ -887,7 +943,10 @@ extern "C" { int vc_list2ccap(char const *, size_t len, struct vc_err_listparser *err, struct vc_ctx_caps *); - + char const * vc_loumask2text(uint_least64_t *); + int vc_list2umask(char const *, size_t len, + struct vc_err_listparser *err, + struct vc_umask *); int vc_list2cflag(char const *, size_t len, struct vc_err_listparser *err, struct vc_ctx_flags *flags); @@ -917,7 +976,7 @@ extern "C" { uint_least64_t vc_get_insecurebcaps() VC_ATTR_CONST; inline static uint_least64_t vc_get_insecureccaps() { - return ~(VC_VXC_SET_UTSNAME|VC_VXC_RAW_ICMP); + return ~(VC_VXC_SET_UTSNAME|VC_VXC_RAW_ICMP|VC_VXC_AUDIT_CONTROL); } inline static int vc_setfilecontext(char const *filename, xid_t xid) { @@ -943,7 +1002,11 @@ extern "C" { vcFEATURE_COMPAT, vcFEATURE_MIGRATE, vcFEATURE_NAMESPACE, vcFEATURE_SCHED, vcFEATURE_VINFO, vcFEATURE_VHI, vcFEATURE_VSHELPER0, vcFEATURE_VSHELPER, vcFEATURE_VWAIT, - vcFEATURE_VNET, vcFEATURE_VSTAT, vcFEATURE_PPTAG, } + vcFEATURE_VNET, vcFEATURE_VSTAT, vcFEATURE_PPTAG, + vcFEATURE_PIDSPACE, vcFEATURE_SPACES, vcFEATURE_PERSISTENT, + vcFEATURE_PIVOT_ROOT, vcFEATURE_MEMCG, vcFEATURE_DYNAMIC, + vcFEATURE_BME, + } vcFeatureSet; bool vc_isSupported(vcFeatureSet) VC_ATTR_CONST; @@ -1023,6 +1086,8 @@ extern "C" { int vc_compareVserverById(char const *lhs, vcCfgStyle lhs_style, char const *rhs, vcCfgStyle rhs_style); + + void vc_exitLikeProcess(int pid, int ret) VC_ATTR_NORETURN; #define vcSKEL_INTERFACES 1u #define vcSKEL_PKGMGMT 2u