From 9cde6b2e1f86d390b0730cb5339eb4920d631886 Mon Sep 17 00:00:00 2001 From: Enrico Scholz Date: Tue, 14 Oct 2003 15:40:50 +0000 Subject: [PATCH] Merged with SYSCALL_SWITCH branch (sswitch_merge tag) git-svn-id: http://svn.linux-vserver.org/svn/util-vserver/trunk@147 94cd875c-1c1d-0410-91d2-eb244daf1a30 --- util-vserver/.cvsignore | 6 + util-vserver/Makefile.am | 9 +- util-vserver/NEWS | 4 + util-vserver/configure.ac | 23 ++- util-vserver/lib/Makefile-files | 15 +- util-vserver/lib/checkversion.c | 43 ++++++ util-vserver/lib/getctx-compat.hc | 30 ++++ util-vserver/lib/getctx-legacy.hc | 73 ++++++++++ util-vserver/lib/getctx.c | 55 ++------ util-vserver/lib/getversion-internal.hc | 36 +++++ util-vserver/lib/getversion.c | 30 ++++ util-vserver/lib/safechroot-internal.hc | 48 +++++++ util-vserver/lib/syscall-compat.hc | 67 +++++++++ util-vserver/lib/syscall-legacy.hc | 239 ++++++++++++++++++++++++++++++++ util-vserver/lib/syscall.c | 218 ++++------------------------- util-vserver/lib/uint2str.c | 54 ++++++++ util-vserver/lib/virtual.h | 59 ++++++++ util-vserver/lib/vserver-internal.h | 89 ++++++++++++ util-vserver/lib/vserver.h | 39 ++++-- util-vserver/scripts/.cvsignore | 1 - util-vserver/src/Makefile-files | 4 - util-vserver/src/capchroot.c | 18 +-- util-vserver/src/chbind.c | 16 ++- util-vserver/src/chcontext.c | 4 +- util-vserver/src/rebootmgr.c | 1 + util-vserver/src/reducecap.c | 2 +- util-vserver/src/vserver-stat.c | 9 +- util-vserver/sysv/Makefile-files | 2 +- util-vserver/tests/chrootsafe.cc | 9 +- util-vserver/util-vserver.spec.in | 28 +++- 30 files changed, 941 insertions(+), 290 deletions(-) create mode 100644 util-vserver/lib/checkversion.c create mode 100644 util-vserver/lib/getctx-compat.hc create mode 100644 util-vserver/lib/getctx-legacy.hc create mode 100644 util-vserver/lib/getversion-internal.hc create mode 100644 util-vserver/lib/getversion.c create mode 100644 util-vserver/lib/safechroot-internal.hc create mode 100644 util-vserver/lib/syscall-compat.hc create mode 100644 util-vserver/lib/syscall-legacy.hc create mode 100644 util-vserver/lib/uint2str.c create mode 100644 util-vserver/lib/virtual.h create mode 100644 util-vserver/lib/vserver-internal.h diff --git a/util-vserver/.cvsignore b/util-vserver/.cvsignore index e2c5042..f340521 100644 --- a/util-vserver/.cvsignore +++ b/util-vserver/.cvsignore @@ -1,12 +1,18 @@ +.*-up-to-date +.deps COPYING ChangeLog INSTALL Makefile +aclocal.m4 +autom4te.cache +autoscan.log compile config.h config.h.in config.log config.status +configure.scan depcomp install-sh missing diff --git a/util-vserver/Makefile.am b/util-vserver/Makefile.am index f4f38d6..b20814a 100644 --- a/util-vserver/Makefile.am +++ b/util-vserver/Makefile.am @@ -42,7 +42,7 @@ noinst_PROGRAMS = $(test_PRGS) sysv_SCRIPTS = $(sysv_SCRPTS) sysconf_DATA = $(sysv_CFG) -BUILT_SOURCES = linuxcaps.h pathconfig.h +BUILT_SOURCES = linuxcaps.h pathconfig.h linuxvirtual.h man_MANS = $(man_DATMAN) @@ -57,7 +57,7 @@ EXTRA_DIST = $(sysv_XTRAS) $(sysv_CFG) \ AM_CPPFLAGS = -I $(top_srcdir)/lib -D _GNU_SOURCE AM_CFLAGS = -Wall -pedantic -CLEANFILES = $(sysv_GENSCRPTS) $(scripts_GENSCRPTS) \ +CLEANFILES = $(sysv_GENSCRPTS) $(scripts_GENSCRPTS) $(BUILT_SOURCES) \ .*.pathsubst.stamp */.*.pathsubst.stamp \ linuxcaps.h pathconfig.h @@ -70,6 +70,10 @@ endif linuxcaps.h: ln -sf ${kernelincludedir}/linux/capability.h linuxcaps.h +linuxvirtual.h: + ln -sf '$(kernelincludedir)/linux/virtual.h' '$@' && test -e '$@' || \ + ln -sf '$(top_srcdir)/lib/virtual.h' '$@' + pathconfig.h: .pathconfig.h.pathsubst.stamp .%.pathsubst.stamp: %.pathsubst Makefile @mkdir -p $$(dirname '$@') @@ -104,6 +108,7 @@ pathconfig.h: .pathconfig.h.pathsubst.stamp install-data-local: $(INSTALL) -d -m755 $(DESTDIR)$(localstatedir)/run/vservers + include $(top_srcdir)/lib/Makefile-files include $(top_srcdir)/src/Makefile-files include $(top_srcdir)/doc/Makefile-files diff --git a/util-vserver/NEWS b/util-vserver/NEWS index e69de29..6e8c93c 100644 --- a/util-vserver/NEWS +++ b/util-vserver/NEWS @@ -0,0 +1,4 @@ +version 0.23.6 +============== + + - fixed '--level' option on 'vserver ... chkconfig' diff --git a/util-vserver/configure.ac b/util-vserver/configure.ac index df9e5e5..c86bd5a 100644 --- a/util-vserver/configure.ac +++ b/util-vserver/configure.ac @@ -24,7 +24,7 @@ dnl distribution terms that you use for the rest of that program. dnl AC_PREREQ(2.57) -AC_INIT(util-vserver, 0.23.89.1, enrico.scholz@informatik.tu-chemnitz.de) +AC_INIT(util-vserver, 0.23.190.1, enrico.scholz@informatik.tu-chemnitz.de) AC_CONFIG_SRCDIR([src/capchroot.c]) AC_CONFIG_HEADER([config.h]) @@ -114,6 +114,27 @@ kernelincludedir=$kerneldir/include AC_SUBST(kernelincludedir) AC_MSG_RESULT($kernelincludedir/linux) +AC_MSG_CHECKING([for supported APIs]) +AC_ARG_ENABLE([apis], + [AC_HELP_STRING([--enable-apis=APIS], + [enable support for the given apis; possible values are: legacy,compat,ALL (default: ALL)])], + [], + [supported_apis=ALL]) + +test x"$supported_apis" != xALL || supported_apis='legacy,compat' +old_IFS=$IFS +IFS=,; +for i in $supported_apis; do + case "$i" in + compat) AC_DEFINE(VC_ENABLE_API_COMPAT, 1, [Enable support for compatibily syscall API]);; + legacy) AC_DEFINE(VC_ENABLE_API_LEGACY, 1, [Enable support for old, /proc parsing API]);; + *) AC_MSG_ERROR(['$i' is not a supported API]);; + esac +done +IFS=$old_IFS +AC_MSG_RESULT([$supported_apis]) + +AC_CHECK_FUNCS([sys_virtual_context]) AC_CHECK_DECLS(MS_MOVE,,,[#include ]) AC_CHECK_TYPES(ctx_t,,,[#include ]) diff --git a/util-vserver/lib/Makefile-files b/util-vserver/lib/Makefile-files index a72ed09..30d76a1 100644 --- a/util-vserver/lib/Makefile-files +++ b/util-vserver/lib/Makefile-files @@ -20,17 +20,26 @@ PKGCONFIG_FILES = lib/util-vserver lib_SRCS = lib/syscall.c \ + lib/checkversion.c \ lib/getctx.c \ - lib/int2str.c + lib/getversion.c \ + lib/uint2str.c lib_HDRS = lib/vserver.h -lib_XHDRS = lib/internal.h +lib_XHDRS = lib/syscall-compat.hc \ + lib/syscall-legacy.hc \ + lib/getctx-compat.hc \ + lib/getctx-legacy.hc \ + lib/getversion-internal.hc \ + lib/safechroot-internal.hc \ + lib/virtual.h \ + lib/vserver-internal.h lib_lib_LIBS = lib/libvserver.a lib_libvserver_a_SOURCES = $(lib_SRCS) -lib_libvserver_a_CPPFLAGS = -I$(kernelincludedir) -D_REENTRANT +lib_libvserver_a_CPPFLAGS = -I$(kernelincludedir) -D_REENTRANT -D_GNU_SOURCE # _REENTRANT is needed for dietlibc to use __error_location if USE_DIETLIBC diff --git a/util-vserver/lib/checkversion.c b/util-vserver/lib/checkversion.c new file mode 100644 index 0000000..f2ff63f --- /dev/null +++ b/util-vserver/lib/checkversion.c @@ -0,0 +1,43 @@ +// $Id$ --*- c++ -*-- + +// Copyright (C) 2003 Enrico Scholz +// +// This program is free software; you can redistribute it and/or modify +// it under the terms of the GNU General Public License as published by +// the Free Software Foundation; version 2 of the License. +// +// This program is distributed in the hope that it will be useful, +// but WITHOUT ANY WARRANTY; without even the implied warranty of +// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +// GNU General Public License for more details. +// +// You should have received a copy of the GNU General Public License +// along with this program; if not, write to the Free Software +// Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA. + + +#ifdef HAVE_CONFIG_H +# include +#endif +#include "compat.h" + +#include "vserver.h" +#include "getversion-internal.hc" + +int +utilvserver_checkCompatVersion() +{ + static int res=0; + static int v_errno; + + if (res==0) { + res = vc_get_version_internal(VC_CAT_COMPAT); + v_errno = errno; +#ifdef VC_ENABLE_API_LEGACY + if (res==-1 && errno==ENOSYS) res=0; +#endif + } + + errno = v_errno; + return res; +} diff --git a/util-vserver/lib/getctx-compat.hc b/util-vserver/lib/getctx-compat.hc new file mode 100644 index 0000000..96de609 --- /dev/null +++ b/util-vserver/lib/getctx-compat.hc @@ -0,0 +1,30 @@ +// $Id$ --*- c++ -*-- + +// Copyright (C) 2003 Enrico Scholz +// +// This program is free software; you can redistribute it and/or modify +// it under the terms of the GNU General Public License as published by +// the Free Software Foundation; version 2 of the License. +// +// This program is distributed in the hope that it will be useful, +// but WITHOUT ANY WARRANTY; without even the implied warranty of +// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +// GNU General Public License for more details. +// +// You should have received a copy of the GNU General Public License +// along with this program; if not, write to the Free Software +// Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA. + + +#ifndef H_UTIL_VSERVER_LIB_GETCTX_COMPAT_H +#define H_UTIL_VSERVER_LIB_GETCTX_COMPAT_H + +#include "getctx-legacy.hc" + +static inline ALWAYSINLINE ctx_t +vc_X_getctx_compat(pid_t pid) +{ + return vc_X_getctx_legacy(pid); +} + +#endif // H_UTIL_VSERVER_LIB_GETCTX_COMPAT_H diff --git a/util-vserver/lib/getctx-legacy.hc b/util-vserver/lib/getctx-legacy.hc new file mode 100644 index 0000000..17928c9 --- /dev/null +++ b/util-vserver/lib/getctx-legacy.hc @@ -0,0 +1,73 @@ +// $Id$ --*- c++ -*-- + +// Copyright (C) 2003 Enrico Scholz +// +// This program is free software; you can redistribute it and/or modify +// it under the terms of the GNU General Public License as published by +// the Free Software Foundation; version 2 of the License. +// +// This program is distributed in the hope that it will be useful, +// but WITHOUT ANY WARRANTY; without even the implied warranty of +// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +// GNU General Public License for more details. +// +// You should have received a copy of the GNU General Public License +// along with this program; if not, write to the Free Software +// Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA. + + +#ifndef H_UTIL_VSERVER_LIB_GETCTX_LEGACY_H +#define H_UTIL_VSERVER_LIB_GETCTX_LEGACY_H + +#ifdef HAVE_CONFIG_H +# include +#endif +#include "compat.h" + +#include "vserver.h" +#include "vserver-internal.h" +#include +#include +#include +#include + +#define CTX_TAG "\ns_context: " + +static ctx_t +vc_X_getctx_legacy(pid_t pid) +{ + static volatile size_t bufsize=4097; + // TODO: is this really race-free? + size_t cur_bufsize = bufsize; + int fd; + char status_name[ sizeof("/proc/01234/status") ]; + char buf[cur_bufsize]; + size_t len; + char *pos = 0; + + strcpy(status_name, "/proc/"); + len = utilvserver_uint2str(status_name+sizeof("/proc/")-1, + sizeof(status_name)-sizeof("/proc//status")+1, + pid, 10); + strcpy(status_name+sizeof("/proc/")+len-1, "/status"); + + fd = open(status_name, O_RDONLY); + if (fd==-1) return VC_NOCTX; + + len = read(fd, buf, cur_bufsize); + close(fd); + + if (len #endif - #include "compat.h" #include "vserver.h" -#include "internal.h" -#include -#include -#include -#include - -#define CTX_TAG "\ns_context: " - -ctx_t -getctx(pid_t pid) -{ - static volatile size_t bufsize=4097; - // TODO: is this really race-free? - size_t cur_bufsize = bufsize; - int fd; - char status_name[ sizeof("/proc/01234/status") ]; - char buf[cur_bufsize]; - size_t len; - char *pos = 0; - - strcpy(status_name, "/proc/"); - len = utilvserver_uint2str(status_name+sizeof("/proc/")-1, - sizeof(status_name)-sizeof("/proc//status")+1, - pid, 10); - strcpy(status_name+sizeof("/proc/")+len-1, "/status"); +#include "vserver-internal.h" - fd = open(status_name, O_RDONLY); - if (fd==-1) return CTX_NOCTX; +#ifdef VC_ENABLE_API_COMPAT +# include "getctx-compat.hc" +#endif - len = read(fd, buf, cur_bufsize); - close(fd); +#ifdef VC_ENABLE_API_LEGACY +# include "getctx-legacy.hc" +#endif - if (len - if (pos!=0) return atoi(pos+sizeof(CTX_TAG)-1); - else return CTX_NOCTX; -} - -#if 0 ctx_t -getcctx() +vc_X_getctx(pid_t pid) { - return getctx(getpid()); + CALL_VC(CALL_VC_COMPAT(vc_X_getctx, pid), + CALL_VC_LEGACY(vc_X_getctx, pid)); } -#endif diff --git a/util-vserver/lib/getversion-internal.hc b/util-vserver/lib/getversion-internal.hc new file mode 100644 index 0000000..a4a14d0 --- /dev/null +++ b/util-vserver/lib/getversion-internal.hc @@ -0,0 +1,36 @@ +// $Id$ --*- c++ -*-- + +// Copyright (C) 2003 Enrico Scholz +// +// This program is free software; you can redistribute it and/or modify +// it under the terms of the GNU General Public License as published by +// the Free Software Foundation; version 2 of the License. +// +// This program is distributed in the hope that it will be useful, +// but WITHOUT ANY WARRANTY; without even the implied warranty of +// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +// GNU General Public License for more details. +// +// You should have received a copy of the GNU General Public License +// along with this program; if not, write to the Free Software +// Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA. + + +#ifndef H_UTIL_VSERVER_LIB_GETVERSION_INTERNAL_H +#define H_UTIL_VSERVER_LIB_GETVERSION_INTERNAL_H + +#ifdef HAVE_CONFIG_H +# include +#endif +#include "compat.h" + +#include "vserver-internal.h" +#include "linuxvirtual.h" + +static inline ALWAYSINLINE int +vc_get_version_internal(int cat) +{ + return sys_virtual_context(VC_CMD(VERSION, 0, 0), cat, 0); +} + +#endif // H_UTIL_VSERVER_LIB_GETVERSION_INTERNAL_H diff --git a/util-vserver/lib/getversion.c b/util-vserver/lib/getversion.c new file mode 100644 index 0000000..94e4168 --- /dev/null +++ b/util-vserver/lib/getversion.c @@ -0,0 +1,30 @@ +// $Id$ --*- c++ -*-- + +// Copyright (C) 2003 Enrico Scholz +// +// This program is free software; you can redistribute it and/or modify +// it under the terms of the GNU General Public License as published by +// the Free Software Foundation; version 2 of the License. +// +// This program is distributed in the hope that it will be useful, +// but WITHOUT ANY WARRANTY; without even the implied warranty of +// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +// GNU General Public License for more details. +// +// You should have received a copy of the GNU General Public License +// along with this program; if not, write to the Free Software +// Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA. + + +#ifdef HAVE_CONFIG_H +# include +#endif +#include "compat.h" + +#include "getversion-internal.hc" + +int +vc_get_version(int cat) +{ + return vc_get_version(cat); +} diff --git a/util-vserver/lib/safechroot-internal.hc b/util-vserver/lib/safechroot-internal.hc new file mode 100644 index 0000000..0539889 --- /dev/null +++ b/util-vserver/lib/safechroot-internal.hc @@ -0,0 +1,48 @@ +// $Id$ --*- c++ -*-- + +// Copyright (C) 2003 Enrico Scholz +// +// This program is free software; you can redistribute it and/or modify +// it under the terms of the GNU General Public License as published by +// the Free Software Foundation; version 2 of the License. +// +// This program is distributed in the hope that it will be useful, +// but WITHOUT ANY WARRANTY; without even the implied warranty of +// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +// GNU General Public License for more details. +// +// You should have received a copy of the GNU General Public License +// along with this program; if not, write to the Free Software +// Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA. + + +#ifndef H_UTIL_VSERVER_LIB_SAFECHROOT_INTERNAL_H +#define H_UTIL_VSERVER_LIB_SAFECHROOT_INTERNAL_H + +#ifdef HAVE_CONFIG_H +# include +#endif +#include "compat.h" + +#include +#include + +#ifndef NDEBUG +static void +vc_tell_unsafe_chroot() +{ + static int flag = -1; + if (flag==-1) { + char const * const e = getenv("VC_TELL_UNSAFE_CHROOT"); + flag = e ? atoi(e) : 0; + flag = flag ? 1 : 0; + } + + if (flag) write(2, "Unsafe chroot() used\n", 23); +} +#else +static ALWAYSINLINE UNUSED void vc_tell_unsafe_chroot() {} +#endif + + +#endif // H_UTIL_VSERVER_LIB_SAFECHROOT_INTERNAL_H diff --git a/util-vserver/lib/syscall-compat.hc b/util-vserver/lib/syscall-compat.hc new file mode 100644 index 0000000..630265b --- /dev/null +++ b/util-vserver/lib/syscall-compat.hc @@ -0,0 +1,67 @@ +// $Id$ --*- c++ -*-- + +// Copyright (C) 2003 Enrico Scholz +// +// This program is free software; you can redistribute it and/or modify +// it under the terms of the GNU General Public License as published by +// the Free Software Foundation; version 2 of the License. +// +// This program is distributed in the hope that it will be useful, +// but WITHOUT ANY WARRANTY; without even the implied warranty of +// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +// GNU General Public License for more details. +// +// You should have received a copy of the GNU General Public License +// along with this program; if not, write to the Free Software +// Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA. + + +#ifdef HAVE_CONFIG_H +# include +#endif +#include "compat.h" + +#include "safechroot-internal.hc" + +#include "vserver.h" +#include "vserver-internal.h" + +#include + +static inline ALWAYSINLINE int +vc_new_s_context_compat(ctx_t ctx, unsigned int remove_cap, unsigned int flags) +{ + struct vcmd_new_s_context_v1 msg; + msg.remove_cap = remove_cap; + msg.flags = flags; + + return sys_virtual_context(VC_CMD(COMPAT, 1, 1), ctx, &msg); +} + +static inline ALWAYSINLINE int +vc_set_ipv4root_compat(uint32_t bcast, size_t nb, struct vc_ip_mask_pair const *ips) +{ + struct vcmd_set_ipv4root_v3 msg; + size_t i; + + if (nb>=NB_IPV4ROOT) { + errno = -EINVAL; + return -1; + } + + msg.broadcast = bcast; + + for (i=0; i +// based on syscall.cc by Jacques Gelinas +// +// This program is free software; you can redistribute it and/or modify +// it under the terms of the GNU General Public License as published by +// the Free Software Foundation; either version 2, or (at your option) +// any later version. +// +// This program is distributed in the hope that it will be useful, +// but WITHOUT ANY WARRANTY; without even the implied warranty of +// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +// GNU General Public License for more details. +// +// You should have received a copy of the GNU General Public License +// along with this program; if not, write to the Free Software +// Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA. + +/* + This tells the system call number for new_s_context and set_ipv4root + using /proc/self/status. This helps until the vserver project is + included officially in the kernel (and has its own syscall). + + We rely on /proc/self/status to find the syscall number. + + If it is not there, we rely on adm/unistd.h. + + If this file does not have those system calls (not a patched kernel source) + we rely on static values in this file. +*/ +#include "safechroot-internal.hc" + +#include +#include +#include +#include +#include +#include + +// Here is the trick. We keep a copy of the define, then undef it +// and then later, we try to locate the value reading /proc/self/status +// If this fails, we have the old preserved copy. +static int def_NR_set_ipv4root = 274; +#undef __NR_set_ipv4root + +static int __NR_set_ipv4root_rev0; +static int __NR_set_ipv4root_rev1; +static int __NR_set_ipv4root_rev2; +static int __NR_set_ipv4root_rev3; +static int rev_ipv4root=0; + + +static _syscall1(int, set_ipv4root_rev0, unsigned long, ip) +static _syscall2(int, set_ipv4root_rev1, unsigned long, ip, unsigned long, bcast) +static _syscall3(int, set_ipv4root_rev2, unsigned long *, ip, int, nb, unsigned long, bcast) +static _syscall4(int, set_ipv4root_rev3, unsigned long *, ip, int, nb, unsigned long, bcast, unsigned long *, mask) + +static int def_NR_new_s_context = 273; +#undef __NR_new_s_context +static int __NR_new_s_context_rev0; + //static int __NR_new_s_context_rev1; +static int rev_s_context=0; + +static _syscall3(int, new_s_context_rev0, int, newctx, int, remove_cap, int, flags) + //static _syscall4(int, new_s_context_rev1, int, nbctx, int *, ctxs, int, remove_cap, int, flags) + +#if 0 +#undef __NR_set_ctxlimit +static int __NR_set_ctxlimit=-1; +static int rev_set_ctxlimit=-1; + +static _syscall2 (int, set_ctxlimit, int, resource, long, limit) +#endif + +#undef __NR_chrootsafe +static int __NR_chrootsafe=-1; +static int rev_chrootsafe=-1; + +static _syscall1 (int, chrootsafe, const char *, dir) + +static void init() +{ + static int is_init = 0; + if (!is_init){ + FILE *fin = fopen ("/proc/self/status","r"); + __NR_set_ipv4root_rev0 = def_NR_set_ipv4root; + __NR_set_ipv4root_rev1 = def_NR_set_ipv4root; + __NR_set_ipv4root_rev2 = def_NR_set_ipv4root; + __NR_set_ipv4root_rev3 = def_NR_set_ipv4root; + __NR_new_s_context_rev0 = def_NR_new_s_context; + //__NR_new_s_context_rev1 = def_NR_new_s_context; + if (fin != NULL){ + char line[100]; + while (fgets(line,sizeof(line)-1,fin)!=NULL){ + int num; + char title[100],rev[100]; + rev[0] = '\0'; + if (sscanf(line,"%s %d %s",title,&num,rev)>=2){ + if (strcmp(title,"__NR_set_ipv4root:")==0){ + __NR_set_ipv4root_rev0 = num; + __NR_set_ipv4root_rev1 = num; + __NR_set_ipv4root_rev2 = num; + __NR_set_ipv4root_rev3 = num; + if (strncmp(rev,"rev",3)==0){ + rev_ipv4root = atoi(rev+3); + } +#if 0 + }else if (strcmp(title,"__NR_set_ctxlimit:")==0){ + __NR_set_ctxlimit = num; + if (strncmp(rev,"rev",3)==0){ + rev_set_ctxlimit = atoi(rev+3); + } +#endif + }else if (strcmp(title,"__NR_chrootsafe:")==0){ + __NR_chrootsafe = num; + if (strncmp(rev,"rev",3)==0){ + rev_chrootsafe = atoi(rev+3); + } + }else if (strcmp(title,"__NR_new_s_context:")==0){ + __NR_new_s_context_rev0 = num; + //__NR_new_s_context_rev1 = num; + if (strncmp(rev,"rev",3)==0){ + rev_s_context = atoi(rev+3); + } + } + } + } + fclose (fin); + } + is_init = 1; + } +} + +void vc_init_legacy() +{ + init(); +} + +static ALWAYSINLINE int +vc_new_s_context_legacy(int ctx, int remove_cap, int flags) +{ + int ret = -1; + init(); + if (rev_s_context == 0){ + return new_s_context_rev0(ctx, remove_cap, flags); + }else{ + errno = -ENOSYS; + ret = -1; + } + return ret; +} + +static ALWAYSINLINE int +vc_set_ipv4root_legacy_internal ( + unsigned long ip[], + int nb, + unsigned long bcast, + unsigned long mask[]) +{ + init(); + if (rev_ipv4root == 0){ + if (nb > 1){ + fprintf (stderr,"set_ipv4root: Several IP number specified, but this kernel only supports one. Ignored\n"); + } + return set_ipv4root_rev0 (ip[0]); + }else if (rev_ipv4root == 1){ + if (nb > 1){ + fprintf (stderr,"set_ipv4root: Several IP number specified, but this kernel only supports one. Ignored\n"); + } + return set_ipv4root_rev1 (ip[0],bcast); + }else if (rev_ipv4root == 2){ + return set_ipv4root_rev2 (ip,nb,bcast); + }else if (rev_ipv4root == 3){ + return set_ipv4root_rev3 (ip,nb,bcast,mask); + } + errno = EINVAL; + return -1; +} + +static ALWAYSINLINE int +vc_set_ipv4root_legacy(uint32_t bcast, size_t nb, struct vc_ip_mask_pair const *ips) +{ + unsigned long ip[nb]; + unsigned long mask[nb]; + size_t i; + + for (i=0; i -// based on syscall.cc by Jacques Gelinas // // This program is free software; you can redistribute it and/or modify // it under the terms of the GNU General Public License as published by -// the Free Software Foundation; either version 2, or (at your option) -// any later version. +// the Free Software Foundation; version 2 of the License. // // This program is distributed in the hope that it will be useful, // but WITHOUT ANY WARRANTY; without even the implied warranty of @@ -17,205 +15,49 @@ // along with this program; if not, write to the Free Software // Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA. -/* - This tells the system call number for new_s_context and set_ipv4root - using /proc/self/status. This helps until the vserver project is - included officially in the kernel (and has its own syscall). - We rely on /proc/self/status to find the syscall number. - - If it is not there, we rely on adm/unistd.h. - - If this file does not have those system calls (not a patched kernel source) - we rely on static values in this file. -*/ -#include -#include -#include -#include -#include -#include +#ifdef HAVE_CONFIG_H +# include +#endif +#include "compat.h" #include "compat.h" #include "vserver.h" +#include "vserver-internal.h" +#include "linuxvirtual.h" -// Here is the trick. We keep a copy of the define, then undef it -// and then later, we try to locate the value reading /proc/self/status -// If this fails, we have the old preserved copy. -static int def_NR_set_ipv4root = 227; -#undef __NR_set_ipv4root - -static int __NR_set_ipv4root_rev0; -static int __NR_set_ipv4root_rev1; -static int __NR_set_ipv4root_rev2; -static int __NR_set_ipv4root_rev3; -static int rev_ipv4root=0; - - -static _syscall1(int, set_ipv4root_rev0, unsigned long, ip) -static _syscall2(int, set_ipv4root_rev1, unsigned long, ip, unsigned long, bcast) -static _syscall3(int, set_ipv4root_rev2, unsigned long *, ip, int, nb, unsigned long, bcast) -static _syscall4(int, set_ipv4root_rev3, unsigned long *, ip, int, nb, unsigned long, bcast, unsigned long *, mask) - -static int def_NR_new_s_context = 226; -#undef __NR_new_s_context -static int __NR_new_s_context_rev0; -static int __NR_new_s_context_rev1; -static int rev_s_context=0; - -static _syscall3(int, new_s_context_rev0, int, newctx, int, remove_cap, int, flags) -static _syscall4(int, new_s_context_rev1, int, nbctx, int *, ctxs, int, remove_cap, int, flags) - -#undef __NR_set_ctxlimit -static int __NR_set_ctxlimit=-1; -static int rev_set_ctxlimit=-1; - -static _syscall2 (int, set_ctxlimit, int, resource, long, limit) - -#undef __NR_chrootsafe -static int __NR_chrootsafe=-1; -static int rev_chrootsafe=-1; +#ifdef VC_ENABLE_API_COMPAT +# include "syscall-compat.hc" +#endif -static _syscall1 (int, chrootsafe, const char *, dir) +#ifdef VC_ENABLE_API_LEGACY +# include "syscall-legacy.hc" +#endif -static void init() -{ - static int is_init = 0; - if (!is_init){ - FILE *fin = fopen ("/proc/self/status","r"); - __NR_set_ipv4root_rev0 = def_NR_set_ipv4root; - __NR_set_ipv4root_rev1 = def_NR_set_ipv4root; - __NR_set_ipv4root_rev2 = def_NR_set_ipv4root; - __NR_set_ipv4root_rev3 = def_NR_set_ipv4root; - __NR_new_s_context_rev1 = def_NR_new_s_context; - if (fin != NULL){ - char line[100]; - while (fgets(line,sizeof(line)-1,fin)!=NULL){ - int num; - char title[100],rev[100]; - rev[0] = '\0'; - if (sscanf(line,"%s %d %s",title,&num,rev)>=2){ - if (strcmp(title,"__NR_set_ipv4root:")==0){ - __NR_set_ipv4root_rev0 = num; - __NR_set_ipv4root_rev1 = num; - __NR_set_ipv4root_rev2 = num; - __NR_set_ipv4root_rev3 = num; - if (strncmp(rev,"rev",3)==0){ - rev_ipv4root = atoi(rev+3); - } - }else if (strcmp(title,"__NR_set_ctxlimit:")==0){ - __NR_set_ctxlimit = num; - if (strncmp(rev,"rev",3)==0){ - rev_set_ctxlimit = atoi(rev+3); - } - }else if (strcmp(title,"__NR_chrootsafe:")==0){ - __NR_chrootsafe = num; - if (strncmp(rev,"rev",3)==0){ - rev_chrootsafe = atoi(rev+3); - } - }else if (strcmp(title,"__NR_new_s_context:")==0){ - __NR_new_s_context_rev0 = num; - __NR_new_s_context_rev1 = num; - if (strncmp(rev,"rev",3)==0){ - rev_s_context = atoi(rev+3); - } - } - } - } - fclose (fin); - } - is_init = 1; - } -} - -void vserver_init() -{ - init(); -} - -int call_new_s_context(int nbctx, int ctxs[], int remove_cap, int flags) -{ - int ret = -1; - init(); - if (rev_s_context == 0){ - if (nbctx > 1){ - errno = EINVAL; - fprintf (stderr,"The current kernel does not support new_s_context revision 1\n"); - }else if (nbctx == 0){ - ret = new_s_context_rev0(-2,remove_cap,flags); - }else if (nbctx == 1){ - ret = new_s_context_rev0(ctxs[0],remove_cap,flags); - } - }else{ -fprintf (stderr,"new_s_context rev1 %d %d\n",nbctx,ctxs[0]); - ret = new_s_context_rev1(nbctx,ctxs,remove_cap,flags); - } - return ret; -} +#include +#include -int call_set_ipv4root ( - unsigned long ip[], - int nb, - unsigned long bcast, - unsigned long mask[]) -{ - init(); - if (rev_ipv4root == 0){ - if (nb > 1){ - fprintf (stderr,"set_ipv4root: Several IP number specified, but this kernel only supports one. Ignored\n"); - } - return set_ipv4root_rev0 (ip[0]); - }else if (rev_ipv4root == 1){ - if (nb > 1){ - fprintf (stderr,"set_ipv4root: Several IP number specified, but this kernel only supports one. Ignored\n"); - } - return set_ipv4root_rev1 (ip[0],bcast); - }else if (rev_ipv4root == 2){ - return set_ipv4root_rev2 (ip,nb,bcast); - }else if (rev_ipv4root == 3){ - return set_ipv4root_rev3 (ip,nb,bcast,mask); - } - errno = EINVAL; - return -1; -} +#if defined(VC_ENABLE_API_COMPAT) || defined(VC_ENABLE_API_LEGACY) -int call_chrootsafe (const char *dir) +int +vc_new_s_context(ctx_t ctx, unsigned int remove_cap, unsigned int flags) { - init(); - if (rev_chrootsafe == -1){ - fprintf (stderr,"chrootsafe: Unsupported system call, update kernel\n"); - }else if (rev_chrootsafe == 0){ - return chrootsafe (dir); - }else{ - fprintf (stderr,"chrootsafe: kernel support version %d, application expects version 0\n" - ,rev_chrootsafe); - } - errno = EINVAL; - return -1; + CALL_VC(CALL_VC_COMPAT(vc_new_s_context, ctx, remove_cap, flags), + CALL_VC_LEGACY(vc_new_s_context, ctx, remove_cap, flags)); } -/* - Return != 0 if chrootsafe is available -*/ -int has_chrootsafe() +int +vc_set_ipv4root(uint32_t bcast, size_t nb, struct vc_ip_mask_pair const *ips) { - init(); - return rev_chrootsafe != -1; + CALL_VC(CALL_VC_COMPAT(vc_set_ipv4root, bcast, nb, ips), + CALL_VC_LEGACY(vc_set_ipv4root, bcast, nb, ips)); } -int call_set_ctxlimit (int res, long limit) +int +vc_chrootsafe(char const *dir) { - init(); - if (rev_set_ctxlimit == -1){ - fprintf (stderr,"set_ctxlimit: Unsupported system call, update kernel\n"); - }else if (rev_set_ctxlimit == 0){ - return set_ctxlimit (res,limit); - }else{ - fprintf (stderr,"set_ctxlimit: kernel support version %d, application expects version 0\n" - ,rev_set_ctxlimit); - } - errno = EINVAL; - return -1; + CALL_VC(CALL_VC_COMPAT(vc_chrootsafe, dir), + CALL_VC_LEGACY(vc_chrootsafe, dir)); } - +#endif diff --git a/util-vserver/lib/uint2str.c b/util-vserver/lib/uint2str.c new file mode 100644 index 0000000..2ba5bf1 --- /dev/null +++ b/util-vserver/lib/uint2str.c @@ -0,0 +1,54 @@ +// $Id$ --*- c++ -*-- + +// Copyright (C) 2003 Enrico Scholz +// +// This program is free software; you can redistribute it and/or modify +// it under the terms of the GNU General Public License as published by +// the Free Software Foundation; version 2 of the License. +// +// This program is distributed in the hope that it will be useful, +// but WITHOUT ANY WARRANTY; without even the implied warranty of +// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +// GNU General Public License for more details. +// +// You should have received a copy of the GNU General Public License +// along with this program; if not, write to the Free Software +// Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA. + + +#ifdef HAVE_CONFIG_H +# include +#endif +#include "compat.h" + +#include +#include +#include + +size_t +utilvserver_uint2str(char *buf, size_t len, unsigned int val, unsigned char base) +{ + char *ptr = buf+len-1; + register size_t res; + if (base>=36 || len==0) return 0; + + *ptr = '\0'; + while (ptr>buf) { + unsigned char digit = val%base; + + --ptr; + *ptr = (digit<10 ? '0'+digit : + digit<36 ? 'a'+digit-10 : + (assert(false),'?')); + + val /= base; + if (val==0) break; + } + + assert(ptr>=buf && ptr<=buf+len-1); + + res = buf+len-ptr; + memmove(buf, ptr, res); + + return res-1; +} diff --git a/util-vserver/lib/virtual.h b/util-vserver/lib/virtual.h new file mode 100644 index 0000000..57d74bf --- /dev/null +++ b/util-vserver/lib/virtual.h @@ -0,0 +1,59 @@ +#ifndef _LINUX_VIRTUAL_H +#define _LINUX_VIRTUAL_H + +#include + +#define VC_CATEGORY(c) (((c) >> 24) & 0x3F) +#define VC_COMMAND(c) (((c) >> 16) & 0xFF) +#define VC_VERSION(c) ((c) & 0xFFF) + +#define VC_CMD(c,i,v) ((((VC_CAT_ ## c) & 0x3F) << 24) \ + | (((i) & 0xFF) << 16) | ((v) & 0xFFF)) + +#define VC_CAT_VERSION 0 +#define VC_CAT_PROCESS 1 +#define VC_CAT_MEMORY 2 +#define VC_CAT_NETWORK 3 + +#define VC_CAT_LIMITS 8 +#define VC_CAT_QUOTA 9 + +#define VC_CAT_OTHER 62 +#define VC_CAT_COMPAT 63 + +/* interface version */ + + //#define VC_VERSION 0x00010000 + + + +/* query version */ + +#define VCMD_get_version VC_CMD(VERSION, 0, 0) + + +/* compatibiliy vserver commands */ + +#define VCMD_new_s_context VC_CMD(COMPAT, 1, 1) +#define VCMD_set_ipv4root VC_CMD(COMPAT, 2, 3) + +/* compatibiliy vserver arguments */ + +struct vcmd_new_s_context_v1 { + uint32_t remove_cap; + uint32_t flags; +}; + +#define NB_IPV4ROOT 16 + +struct vcmd_set_ipv4root_v3 { + /* number of pairs in id */ + uint32_t broadcast; + struct { + uint32_t ip; + uint32_t mask; + } ip_mask_pair[NB_IPV4ROOT]; +}; + + +#endif /* _LINUX_VIRTUAL_H */ diff --git a/util-vserver/lib/vserver-internal.h b/util-vserver/lib/vserver-internal.h new file mode 100644 index 0000000..394039b --- /dev/null +++ b/util-vserver/lib/vserver-internal.h @@ -0,0 +1,89 @@ +// $Id$ --*- c++ -*-- + +// Copyright (C) 2003 Enrico Scholz +// +// This program is free software; you can redistribute it and/or modify +// it under the terms of the GNU General Public License as published by +// the Free Software Foundation; version 2 of the License. +// +// This program is distributed in the hope that it will be useful, +// but WITHOUT ANY WARRANTY; without even the implied warranty of +// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +// GNU General Public License for more details. +// +// You should have received a copy of the GNU General Public License +// along with this program; if not, write to the Free Software +// Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA. + + +#ifndef H_VSERVER_SYSCALL_INTERNAL_H +#define H_VSERVER_SYSCALL_INTERNAL_H + +#include +#include +#include +#include +#include +#include + +#ifndef __NR_sys_virtual_context +# define __NR_sys_virtual_context 273 +#endif + +#define VC_PREFIX 0) +#define VC_SUFFIX else (void)((void)0 +#define CALL_VC_NOOP (void)0 +#define CALL_VC_GENERAL(ID, SUFFIX, FUNC, ...) \ + VC_PREFIX; VC_SELECT(ID) return FUNC ## _ ## SUFFIX(__VA_ARGS__); VC_SUFFIX + +#if 1 +# define VC_SELECT(ID) case ID: if(1) +# define CALL_VC(...) \ + switch (utilvserver_checkCompatVersion()) { \ + case -1 : if (1) break; \ + VC_SUFFIX, __VA_ARGS__ , VC_PREFIX; \ + default : errno = EINVAL; \ + } \ + return -1 +#else +# define VC_SELECT(ID) if (1) +# define CALL_VC(...) \ + if (1) {} VC_SUFFIX, __VA_ARGS__, VC_PREFIX; \ + errno = ENOSYS; return -1 +#endif + +#ifdef VC_ENABLE_API_COMPAT +# define CALL_VC_COMPAT(F,...) CALL_VC_GENERAL(0x00010000, compat, F, __VA_ARGS__) +#else +# define CALL_VC_COMPAT(F,...) CALL_VC_NOOP +#endif + +#ifdef VC_ENABLE_API_LEGACY +# define CALL_VC_LEGACY(F,...) CALL_VC_GENERAL(0x00000000, legacy, F, __VA_ARGS__) +#else +# define CALL_VC_LEGACY(F,...) CALL_VC_NOOP +#endif + + + + +#ifdef __cplusplus +extern "C" { +#endif + +#ifndef HAVE_SYS_VIRTUAL_CONTEXT +static UNUSED +_syscall3(int, sys_virtual_context, + uint32_t, cmd, uint32_t, id, void *, data) +#endif + +size_t utilvserver_uint2str(char *buf, size_t len, + unsigned int val, unsigned char base); +int utilvserver_checkCompatVersion(); + +#ifdef __cplusplus +} +#endif + + +#endif // H_VSERVER_SYSCALL_INTERNAL_H diff --git a/util-vserver/lib/vserver.h b/util-vserver/lib/vserver.h index c9cd1f0..e476f4d 100644 --- a/util-vserver/lib/vserver.h +++ b/util-vserver/lib/vserver.h @@ -19,28 +19,45 @@ #ifndef H_VSERVER_SYSCALL_H #define H_VSERVER_SYSCALL_H +#include +#include #include -#include -#define CTX_NOCTX ((ctx_t)(-1)) +#define VC_NOCTX ((ctx_t)(-1)) #ifdef __cplusplus extern "C" { #endif -int call_new_s_context(int nbctx, int ctxs[], int remove_cap, int flags); -int call_set_ipv4root (unsigned long ip[], int nb, - unsigned long bcast, unsigned long mask[]); -int call_chrootsafe (const char *dir); -int has_chrootsafe(); -int call_set_ctxlimit (int res, long limit); + struct vc_ip_mask_pair { + uint32_t ip; + uint32_t mask; + }; -void vserver_init(); + /** Returns version of the given API-category */ + int vc_get_version(int category); + + /** Puts current process into context , removes the given caps and + * sets flags. + * Special values for ctx are + * - -2 which means the current context (just for changing caps and flags) + * - -1 which means the next free context; this value can be used by + * ordinary users also */ + int vc_new_s_context(ctx_t ctx, unsigned int remove_cap, unsigned int flags); - ctx_t getctx(pid_t pid); + /** Sets the ipv4root information. + * \precondition: nb<16 */ + int vc_set_ipv4root(uint32_t bcast, size_t nb, struct vc_ip_mask_pair const *ips); + + int vc_chrootsafe(char const *dir); -#define getcctx() (getctx(getpid())) + /** Returns the context of the given process. */ + ctx_t vc_X_getctx(pid_t pid); + + /** Returns the context of the current process. */ +#define vc_X_getcctx (getctx(getpid())) + #ifdef __cplusplus } #endif diff --git a/util-vserver/scripts/.cvsignore b/util-vserver/scripts/.cvsignore index 7f4fdef..61478f9 100644 --- a/util-vserver/scripts/.cvsignore +++ b/util-vserver/scripts/.cvsignore @@ -1,2 +1 @@ -.deps util-vserver-vars diff --git a/util-vserver/src/Makefile-files b/util-vserver/src/Makefile-files index fd0b82b..9ef81b0 100644 --- a/util-vserver/src/Makefile-files +++ b/util-vserver/src/Makefile-files @@ -42,7 +42,6 @@ src_sbin_PRGS = src/chbind \ src/chcontext \ src/rebootmgr \ src/reducecap \ - src/setctxlimit \ src/vdu \ src/vfiles \ src/new-namespace \ @@ -72,9 +71,6 @@ src_reducecap_LDADD = lib/libvserver.a src_save_ctxinfo_SOURCES = src/save_ctxinfo.c src_save_ctxinfo_LDADD = lib/libvserver.a -src_setctxlimit_SOURCES = src/setctxlimit.c -src_setctxlimit_LDADD = lib/libvserver.a - src_showattr_SOURCES = src/showattr.c src_showperm_SOURCES = src/showperm.c src_vbuild_SOURCES = src/vbuild.cc src/vutil.cc diff --git a/util-vserver/src/capchroot.c b/util-vserver/src/capchroot.c index a449b92..740a69c 100644 --- a/util-vserver/src/capchroot.c +++ b/util-vserver/src/capchroot.c @@ -26,6 +26,7 @@ #ifdef HAVE_CONFIG_H # include #endif +#include "compat.h" #include #include @@ -37,21 +38,8 @@ #include #include "linuxcaps.h" -#include "compat.h" #include "vserver.h" -static int my_chroot(const char *dir) -{ - int ret = -1; - if (has_chrootsafe()){ - ret = call_chrootsafe(dir); - }else{ - //fprintf (stderr,"Kernel do not support chrootsafe(), using chroot()\n"); - ret = chroot (dir); - } - return ret; -} - int main (int argc, char *argv[]) { if (argc < 3){ @@ -86,7 +74,7 @@ int main (int argc, char *argv[]) // and also a security flaw. The shared objects in the vserver // may be tweaked to get control of the root server ... getpwnam ("root"); - if (my_chroot (argv[dir]) == -1){ + if (vc_chrootsafe (argv[dir]) == -1){ fprintf (stderr,"Can't chroot to directory %s (%s)\n",argv[dir] ,strerror(errno)); }else{ @@ -94,7 +82,7 @@ int main (int argc, char *argv[]) int cmd = dir + 1; if (nochroot){ - call_new_s_context (0,NULL,1<h_addr,sizeof(addr)); - masks[nbaddrs] = mask; - addrs[nbaddrs++] = addr; + ips[nbaddrs].ip = addr; + ips[nbaddrs].mask = mask; + ++nbaddrs; } }else{ - masks[nbaddrs] = mask; - addrs[nbaddrs++] = addr; + ips[nbaddrs].ip = addr; + ips[nbaddrs].mask = mask; + ++nbaddrs; } i++; }else if (strcmp(arg,"--bcast")==0){ @@ -208,12 +210,12 @@ int main (int argc, char *argv[]) }else if (argv[i][0] == '-'){ usage(); }else{ - if (call_set_ipv4root(addrs,nbaddrs,bcast,masks)==0){ + if (vc_set_ipv4root(bcast,nbaddrs,ips)==0){ if (!silent){ int i; printf ("ipv4root is now"); for (i=0; i>24 ,(hostaddr>>16)&0xff diff --git a/util-vserver/src/chcontext.c b/util-vserver/src/chcontext.c index fda3602..21a8a15 100644 --- a/util-vserver/src/chcontext.c +++ b/util-vserver/src/chcontext.c @@ -252,7 +252,7 @@ int main (int argc, char *argv[]) if (disconnect == 0 || fork()==0){ int newctx; if (nbctx == 0) ctxs[nbctx++] = -1; - newctx = call_new_s_context(nbctx,ctxs,0,flags); + newctx = vc_new_s_context(ctxs[0],0,flags); if (newctx != -1){ if (hostname != NULL){ if (sethostname (hostname,strlen(hostname))==-1){ @@ -269,7 +269,7 @@ int main (int argc, char *argv[]) } } remove_cap &= (~add_cap); - if (remove_cap != 0) call_new_s_context (0,NULL,remove_cap,0); + if (remove_cap != 0) vc_new_s_context (-2,remove_cap,0); if (!silent){ printf ("New security context is %d\n" ,ctxs[0] == -1 ? newctx : ctxs[0]); diff --git a/util-vserver/src/rebootmgr.c b/util-vserver/src/rebootmgr.c index 2b3610c..2b1882f 100644 --- a/util-vserver/src/rebootmgr.c +++ b/util-vserver/src/rebootmgr.c @@ -40,6 +40,7 @@ #ifdef HAVE_CONFIG_H # include #endif +#include "compat.h" #include #include diff --git a/util-vserver/src/reducecap.c b/util-vserver/src/reducecap.c index 1c11e71..0f02813 100644 --- a/util-vserver/src/reducecap.c +++ b/util-vserver/src/reducecap.c @@ -223,7 +223,7 @@ int main (int argc, char *argv[]) if (show){ reducecap_print (&user); } - if (call_new_s_context(0,NULL,remove,flags)==-1){ + if (vc_new_s_context(-2,remove,flags)==-1){ perror ("new_s_context -2"); }else{ fprintf (stderr,"Executing\n"); diff --git a/util-vserver/src/vserver-stat.c b/util-vserver/src/vserver-stat.c index 9436e73..2032d1d 100644 --- a/util-vserver/src/vserver-stat.c +++ b/util-vserver/src/vserver-stat.c @@ -33,6 +33,9 @@ #ifdef HAVE_CONFIG_H # include #endif +#include "compat.h" + +#include "vserver.h" #include #include @@ -51,9 +54,6 @@ #define CTX_DIR_NAME "/var/run/vservers/" #define CTX_NAME_MAX_LEN 50 -int call_new_s_context(int nbctx, int ctxs[], int remove_cap, int flags); - - struct ctx_list { int ctx; @@ -457,7 +457,6 @@ int main(int argc, char **argv) DIR *proc_dir; struct dirent *dir_entry; pid_t my_pid; - static int ctx1[]={1}; // for error msg process_name = argv[0]; @@ -472,7 +471,7 @@ int main(int argc, char **argv) my_pid = getpid(); // try to switch in context 1 - if (call_new_s_context(1,ctx1, 0, 0) < 0) + if (vc_new_s_context(1,0, 0) < 0) { fprintf(stderr, "%s: unable to switch in context security #1\n", process_name); return -1; diff --git a/util-vserver/sysv/Makefile-files b/util-vserver/sysv/Makefile-files index 6601c4e..c1aaf13 100644 --- a/util-vserver/sysv/Makefile-files +++ b/util-vserver/sysv/Makefile-files @@ -46,7 +46,7 @@ sysv_CFG = sysv/vservers.conf sysv/%: sysv/%.subst @mkdir -p $$(dirname '$@') - sed -s 's!/usr/lib/util-vserver!$(pkglibdir)!g; \ + sed -e 's!/usr/lib/util-vserver!$(pkglibdir)!g; \ s!^USR_SBIN=/usr/sbin$$!USR_SBIN=$(sbindir)!g' '$<' >'$@.tmp' if cmp -s '$<' '$@.tmp'; then \ cp -p '$<' '$@'; \ diff --git a/util-vserver/tests/chrootsafe.cc b/util-vserver/tests/chrootsafe.cc index 70be9e3..2739433 100644 --- a/util-vserver/tests/chrootsafe.cc +++ b/util-vserver/tests/chrootsafe.cc @@ -23,6 +23,11 @@ chrootsafe /vservers/test */ +#ifdef HAVE_CONFIG_H +# include +#endif +#include "compat.h" + #include #include #include @@ -40,7 +45,7 @@ int main (int argc, char *argv[]) // This test must fail int fd = open ("/",O_RDONLY); if (fd != -1){ - if (call_chrootsafe(argv[1])==-1){ + if (vc_chrootsafe(argv[1])==-1){ fprintf (stderr,"Ok, chrootsafe failed with one open directory errno=%s\n",strerror(errno)); }else{ fprintf (stderr,"Hum, chrootsafe succeed with one open directory\n"); @@ -49,7 +54,7 @@ int main (int argc, char *argv[]) close (fd); } // Now it should work - if (call_chrootsafe(argv[1])!=-1){ + if (vc_chrootsafe(argv[1])!=-1){ fprintf (stderr,"Ok, chrootsafe worked\n"); system ("/bin/sh"); }else{ diff --git a/util-vserver/util-vserver.spec.in b/util-vserver/util-vserver.spec.in index 5084fbd..7fadae3 100644 --- a/util-vserver/util-vserver.spec.in +++ b/util-vserver/util-vserver.spec.in @@ -1,6 +1,7 @@ # $Id$ -%define confdir %_sysconfdir/vservers +%define confdir %_sysconfdir/vservers +%define pkglibdir %_libdir/%name Summary: Linux virtual server utilities Name: @PACKAGE@ @@ -12,8 +13,15 @@ Group: System Environment/Base URL: http://savannah.nongnu.org/projects/util-vserver/ Source0: http://savannah.nongnu.org/download/util-vserver/stable.pkg/%version/%name-%version.tar.bz2 BuildRoot: %_tmppath/%name-%version-%release-root +#Requires: util-vserver-core = %epoch:%version-%release Provides: vserver = %epoch:%version-%release Conflicts: vserver < %epoch:%version +BuildRequires: mount vconfig gawk iproute +BuildRequires: dietlibc gcc-c++ + +%package core +Summary: The core-utilities for util-vserver +Group: Applications/System %package sysv Summary: SysV-initscripts for vserver @@ -24,7 +32,7 @@ Requires: initscripts %package devel Summary: Header-files and libraries which are needed to develop vserver based applications Group: Development/Libraries - +Requires: pkgconfig %description This package provides the components and a framework to setup virtual @@ -36,6 +44,7 @@ can't interact with services in the main server. This requires a special kernel supporting the new new_s_context and set_ipv4root system call. +%description core %description sysv %description devel @@ -89,7 +98,7 @@ test "$1" = 0 || %{_initrddir}/rebootmgr condrestart >/dev/null || : %defattr(-,root,root,-) %doc AUTHORS COPYING ChangeLog NEWS README THANKS %doc doc/FAQ.txt -%_libdir/%name +%pkglibdir %_sbindir/* %_mandir/man8/* %dir %confdir @@ -97,6 +106,18 @@ test "$1" = 0 || %{_initrddir}/rebootmgr condrestart >/dev/null || : %dir %confdir/.distributions/rh* %dir %confdir/.distributions/*/apt %config(noreplace) %confdir/.distributions/*/apt/sources.list +%dir /var/run/vservers + +%if 0 +%files core +%defattr(-,root,root,-) +%dir %pkglibdir +%pkglibdir/filetime +%pkglibdir/ +filetime ifspec listdevip mask2prefix readlink save_ctxinfo save_s_context secure-mount showattr showperm util-vserver-vars + +chbind chcontext new-namespace reducecap setctxlimit util-vserver-vars +%endif %files sysv %defattr(-,root,root,-) @@ -107,6 +128,7 @@ test "$1" = 0 || %{_initrddir}/rebootmgr condrestart >/dev/null || : %defattr(-,root,root,-) %_includedir/*.h %_libdir/*.a +%_libdir/pkgconfig/* %changelog * Wed Oct 1 2003 Enrico Scholz - 0:0.23.5-0 -- 1.8.1.5