lxc_attach.c revision 74476cf144523530022d76cef3a558b0662b592f
132N/A * lxc: linux Container library 132N/A * (C) Copyright IBM Corp. 2007, 2010 132N/A * This library is free software; you can redistribute it and/or 132N/A * modify it under the terms of the GNU Lesser General Public 132N/A * License as published by the Free Software Foundation; either 132N/A * version 2.1 of the License, or (at your option) any later version. 132N/A * This library is distributed in the hope that it will be useful, 132N/A * but WITHOUT ANY WARRANTY; without even the implied warranty of 132N/A * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU 132N/A * Lesser General Public License for more details. 132N/A * You should have received a copy of the GNU Lesser General Public 132N/A * License along with this library; if not, write to the Free Software 132N/A * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA 411N/AExecute the specified command - enter the container NAME\n\ 706N/A -n, --name=NAME NAME for name of the container\n\ 706N/A -e, --elevated-privileges\n\ 741N/A Use elevated privileges (capabilities, cgroup\n\ 741N/A restrictions) instead of those of the container.\n\ 706N/A WARNING: This may leak privleges into the container.\n\ 736N/A -a, --arch=ARCH Use ARCH for program instead of container's own\n\ 704N/A -s, --namespaces=FLAGS\n\ 487N/A Don't attach to all the namespaces of the container\n\ 704N/A but just to the following OR'd list of flags:\n\ 704N/A MOUNT, PID, UTSNAME, IPC, USER or NETWORK\n\ 487N/A WARNING: Using -s implies -e, it may therefore\n\ 487N/A leak privileges into the container. Use with care.\n\ 487N/A -R, --remount-sys-proc\n\ 320N/A Remount /sys and /proc if not attaching to the\n\ 336N/A mount namespace when using -s in order to properly\n\ 336N/A reflect the correct namespace context. See the\n\ 336N/A lxc-attach(1) manual page for details.\n",
949N/A * be available inside the container or we may not have 949N/A * the required permissions anymore 230N/A /* determine which namespaces the container was created with 230N/A "namespaces which the container unshared");
230N/A /* we need to attach before we fork since certain namespaces 230N/A * (such as pid namespaces) only really affect children of the 989N/A * current process and not the process itself 989N/A /* hack: we need sync.h infrastructure - and that needs a handler */ 989N/A ERROR(
"failed to initialize synchronization socket");
132N/A /* wait until the child has done configuring itself before 132N/A * we put it in a cgroup that potentially limits these 132N/A /* now that we are done with all privileged operations, 132N/A * we can add ourselves to the cgroup. Since we smuggled in 211N/A * the fds earlier, we still have write permission 213N/A /* since setns() for pid namespaces only really 213N/A * affects child processes, the pid we have is 213N/A * still valid outside the container, so this is 213N/A /* tell the child we are done initializing */ 211N/A /* A description of the purpose of this functionality is 211N/A * provided in the lxc-attach(1) manual page. We have to 246N/A * remount here and not in the parent process, otherwise 246N/A * /proc may not properly reflect the new pid namespace. 260N/A ERROR(
"could not ensure correct architecture: %s",
679N/A /* tell parent we are done setting up the container and wait 219N/A * until we have been put in the container's cgroup, if