From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from lists.gentoo.org (pigeon.gentoo.org [208.92.234.80]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by finch.gentoo.org (Postfix) with ESMTPS id A66281382C5 for ; Tue, 30 Jan 2018 17:01:06 +0000 (UTC) Received: from pigeon.gentoo.org (localhost [127.0.0.1]) by pigeon.gentoo.org (Postfix) with SMTP id DF0FDE0CE6; Tue, 30 Jan 2018 17:01:05 +0000 (UTC) Received: from smtp.gentoo.org (woodpecker.gentoo.org [IPv6:2001:470:ea4a:1:5054:ff:fec7:86e4]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by pigeon.gentoo.org (Postfix) with ESMTPS id AF784E0CE6 for ; Tue, 30 Jan 2018 17:01:05 +0000 (UTC) Received: from oystercatcher.gentoo.org (oystercatcher.gentoo.org [148.251.78.52]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.gentoo.org (Postfix) with ESMTPS id 961CC335C5B for ; Tue, 30 Jan 2018 17:01:03 +0000 (UTC) Received: from localhost.localdomain (localhost [IPv6:::1]) by oystercatcher.gentoo.org (Postfix) with ESMTP id B1AE91D2 for ; Tue, 30 Jan 2018 17:01:01 +0000 (UTC) From: "Matthias Maier" To: gentoo-commits@lists.gentoo.org Content-Transfer-Encoding: 8bit Content-type: text/plain; charset=UTF-8 Reply-To: gentoo-dev@lists.gentoo.org, "Matthias Maier" Message-ID: <1517331612.dd450253467dd8d704a398d794d1a704cac81ecc.tamiko@gentoo> Subject: [gentoo-commits] repo/gentoo:master commit in: app-emulation/lxc/, app-emulation/lxc/files/ X-VCS-Repository: repo/gentoo X-VCS-Files: app-emulation/lxc/Manifest app-emulation/lxc/files/lxc-2.1.1-cgroups-enable-container-without-CAP_SYS_ADMIN.patch app-emulation/lxc/files/lxc-2.1.1-fix-cgroup2-detection.patch app-emulation/lxc/files/lxc.initd.7 app-emulation/lxc/lxc-2.1.1.ebuild X-VCS-Directories: app-emulation/lxc/ app-emulation/lxc/files/ X-VCS-Committer: tamiko X-VCS-Committer-Name: Matthias Maier X-VCS-Revision: dd450253467dd8d704a398d794d1a704cac81ecc X-VCS-Branch: master Date: Tue, 30 Jan 2018 17:01:01 +0000 (UTC) Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-Id: Gentoo Linux mail X-BeenThere: gentoo-commits@lists.gentoo.org X-Archives-Salt: 6d13a01c-0f30-40e2-a283-a538d9b40751 X-Archives-Hash: f362f2999a883a697fb9967ba454f1d5 commit: dd450253467dd8d704a398d794d1a704cac81ecc Author: i.Dark_Templar dark-templar-archives net> AuthorDate: Sun Nov 5 08:50:03 2017 +0000 Commit: Matthias Maier gentoo org> CommitDate: Tue Jan 30 17:00:12 2018 +0000 URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=dd450253 app-emulation/lxc: bump to version 2.1.1. [tamiko: regenerate metadata to make remote hook happy] Closes: https://bugs.gentoo.org/636572 Closes: https://github.com/gentoo/gentoo/pull/6128 Signed-off-by: Matthias Maier gentoo.org> app-emulation/lxc/Manifest | 1 + ...ps-enable-container-without-CAP_SYS_ADMIN.patch | 164 +++++++++++++++++ .../files/lxc-2.1.1-fix-cgroup2-detection.patch | 26 +++ app-emulation/lxc/files/lxc.initd.7 | 124 +++++++++++++ app-emulation/lxc/lxc-2.1.1.ebuild | 201 +++++++++++++++++++++ 5 files changed, 516 insertions(+) diff --git a/app-emulation/lxc/Manifest b/app-emulation/lxc/Manifest index c9008c2d3c8..5c6a4ead6f8 100644 --- a/app-emulation/lxc/Manifest +++ b/app-emulation/lxc/Manifest @@ -2,3 +2,4 @@ DIST lxc-1.0.11.tar.gz 850645 BLAKE2B 1a8eff91d970d3160d5ca7338f4e4d68c722a277a8 DIST lxc-1.0.8.tar.gz 575127 BLAKE2B 246ac7a2b4306c52a741b2f763bcc81d9999fb27942ef93d6a786ed2ea010c646f5a2388407d26425387b8a819cacae927c8512995bf19b11d610e1887ea6470 SHA512 f552a4f48bb47d26c6b9ddaf8221a439c0848e3f54ec41b77d54717c21bddd56193941046cc96c699790e8265e762a926469c25ee687adcf7795f2906b1c260a DIST lxc-2.0.7.tar.gz 792557 BLAKE2B e5f1e6d8961938200e116527fab8ce341cf285826afdccac88f4bae65ffd649a406dac7555024557f38c4b415a59cd3b5fb255f1dbf015ce01d4975bed3b1c80 SHA512 eb48dc800ce43d2f4d46e0cecc4d0a714b3e22c6a4975776b54d17d1d20d5a1411e6b605215282f1f77286ddf22b61c80b86b83752191fc18023894ef7a1c44d DIST lxc-2.0.9.tar.gz 1333044 BLAKE2B 44d405bf933923a020a6aadca9d84cfce04db72ac0ef1a727c83eca8121683419a2e74849f08fb4773010002928b424840fa9ec19ab619e420b1dfb5156de5c6 SHA512 c7c595fbc6163e500700b756ae30c96b70d41b9bf297a609622b5d5b8431171ed8db70fa8368c3b9650c86452820e9da7f329f9186ae75c24a7adb15d5826102 +DIST lxc-2.1.1.tar.gz 1378640 BLAKE2B 5fca516540a886729434579ff99acf3baa06977fa0e0b6f24dbf15094626335fc073597d308276e3dd20e27ceabf1477cc8e99d1fd24cf50b9aed2720b887b69 SHA512 2989d57acddfe091adcf8031721c3c9a2f8eff5476bd6155366b76ea7511e0f6120e669276e056e3963863e0f0acf3b095d44c36fa6652e67c197671f28cbdd4 diff --git a/app-emulation/lxc/files/lxc-2.1.1-cgroups-enable-container-without-CAP_SYS_ADMIN.patch b/app-emulation/lxc/files/lxc-2.1.1-cgroups-enable-container-without-CAP_SYS_ADMIN.patch new file mode 100644 index 00000000000..8493491d0d6 --- /dev/null +++ b/app-emulation/lxc/files/lxc-2.1.1-cgroups-enable-container-without-CAP_SYS_ADMIN.patch @@ -0,0 +1,164 @@ +From b635e92d21d2a4d71a553388f18cfa08f44bf1ba Mon Sep 17 00:00:00 2001 +From: Christian Brauner +Date: Mon, 30 Oct 2017 14:16:46 +0100 +Subject: [PATCH] cgroups: enable container without CAP_SYS_ADMIN + +In case cgroup namespaces are supported but we do not have CAP_SYS_ADMIN we +need to mount cgroups for the container. This patch enables both privileged and +unprivileged containers without CAP_SYS_ADMIN. + +Closes #1737. + +Signed-off-by: Christian Brauner +--- + src/lxc/cgroups/cgfs.c | 3 ++- + src/lxc/cgroups/cgfsng.c | 52 +++++++++++++++++++++++++++++++++++++++++++++--- + src/lxc/cgroups/cgroup.c | 2 +- + src/lxc/conf.c | 3 --- + src/lxc/conf.h | 1 + + 5 files changed, 53 insertions(+), 8 deletions(-) + +diff --git a/src/lxc/cgroups/cgfs.c b/src/lxc/cgroups/cgfs.c +index bcbd6613..efd627f0 100644 +--- a/src/lxc/cgroups/cgfs.c ++++ b/src/lxc/cgroups/cgfs.c +@@ -1418,11 +1418,12 @@ static bool cgroupfs_mount_cgroup(void *hdata, const char *root, int type) + struct cgfs_data *cgfs_d; + struct cgroup_process_info *info, *base_info; + int r, saved_errno = 0; ++ struct lxc_handler *handler = hdata; + + if (cgns_supported()) + return true; + +- cgfs_d = hdata; ++ cgfs_d = handler->cgroup_data; + if (!cgfs_d) + return false; + base_info = cgfs_d->info; +diff --git a/src/lxc/cgroups/cgfsng.c b/src/lxc/cgroups/cgfsng.c +index e43edd7d..ec6440c1 100644 +--- a/src/lxc/cgroups/cgfsng.c ++++ b/src/lxc/cgroups/cgfsng.c +@@ -50,6 +50,7 @@ + #include + #include + ++#include "caps.h" + #include "cgroup.h" + #include "cgroup_utils.h" + #include "commands.h" +@@ -1616,17 +1617,49 @@ do_secondstage_mounts_if_needed(int type, struct hierarchy *h, + return 0; + } + ++static int mount_cgroup_cgns_supported(struct hierarchy *h, const char *controllerpath) ++{ ++ int ret; ++ char *controllers = NULL; ++ char *type = "cgroup2"; ++ ++ if (!h->is_cgroup_v2) { ++ controllers = lxc_string_join(",", (const char **)h->controllers, false); ++ if (!controllers) ++ return -ENOMEM; ++ type = "cgroup"; ++ } ++ ++ ret = mount("cgroup", controllerpath, type, MS_NOSUID|MS_NOEXEC|MS_NODEV|MS_RELATIME, controllers); ++ free(controllers); ++ if (ret < 0) { ++ SYSERROR("Failed to mount %s with cgroup filesystem type %s", controllerpath, type); ++ return -1; ++ } ++ ++ DEBUG("Mounted %s with cgroup filesystem type %s", controllerpath, type); ++ return 0; ++} ++ + static bool cgfsng_mount(void *hdata, const char *root, int type) + { +- struct cgfsng_handler_data *d = hdata; ++ int i; + char *tmpfspath = NULL; + bool retval = false; +- int i; ++ struct lxc_handler *handler = hdata; ++ struct cgfsng_handler_data *d = handler->cgroup_data; ++ bool has_cgns = false, has_sys_admin = true; + + if ((type & LXC_AUTO_CGROUP_MASK) == 0) + return true; + +- if (cgns_supported()) ++ has_cgns = cgns_supported(); ++ if (!lxc_list_empty(&handler->conf->keepcaps)) ++ has_sys_admin = in_caplist(CAP_SYS_ADMIN, &handler->conf->keepcaps); ++ else ++ has_sys_admin = !in_caplist(CAP_SYS_ADMIN, &handler->conf->caps); ++ ++ if (has_cgns && has_sys_admin) + return true; + + tmpfspath = must_make_path(root, "/sys/fs/cgroup", NULL); +@@ -1662,6 +1695,19 @@ static bool cgfsng_mount(void *hdata, const char *root, int type) + free(controllerpath); + goto bad; + } ++ ++ if (has_cgns && !has_sys_admin) { ++ /* If cgroup namespaces are supported but the container ++ * will not have CAP_SYS_ADMIN after it has started we ++ * need to mount the cgroups manually. ++ */ ++ r = mount_cgroup_cgns_supported(h, controllerpath); ++ free(controllerpath); ++ if (r < 0) ++ goto bad; ++ continue; ++ } ++ + if (mount_cgroup_full(type, h, controllerpath, d->container_cgroup) < 0) { + free(controllerpath); + goto bad; +diff --git a/src/lxc/cgroups/cgroup.c b/src/lxc/cgroups/cgroup.c +index 674e3090..36a665b1 100644 +--- a/src/lxc/cgroups/cgroup.c ++++ b/src/lxc/cgroups/cgroup.c +@@ -166,7 +166,7 @@ bool cgroup_chown(struct lxc_handler *handler) + bool cgroup_mount(const char *root, struct lxc_handler *handler, int type) + { + if (ops) +- return ops->mount_cgroup(handler->cgroup_data, root, type); ++ return ops->mount_cgroup(handler, root, type); + + return false; + } +diff --git a/src/lxc/conf.c b/src/lxc/conf.c +index d2fab945..44d97843 100644 +--- a/src/lxc/conf.c ++++ b/src/lxc/conf.c +@@ -210,9 +210,6 @@ __thread struct lxc_conf *current_config; + struct lxc_conf *current_config; + #endif + +-/* Declare this here, since we don't want to reshuffle the whole file. */ +-static int in_caplist(int cap, struct lxc_list *caps); +- + static struct mount_opt mount_opt[] = { + { "async", 1, MS_SYNCHRONOUS }, + { "atime", 1, MS_NOATIME }, +diff --git a/src/lxc/conf.h b/src/lxc/conf.h +index c61f861e..63e71e2d 100644 +--- a/src/lxc/conf.h ++++ b/src/lxc/conf.h +@@ -402,5 +402,6 @@ extern unsigned long add_required_remount_flags(const char *s, const char *d, + unsigned long flags); + extern int run_script(const char *name, const char *section, const char *script, + ...); ++extern int in_caplist(int cap, struct lxc_list *caps); + + #endif /* __LXC_CONF_H */ +-- +2.13.6 + diff --git a/app-emulation/lxc/files/lxc-2.1.1-fix-cgroup2-detection.patch b/app-emulation/lxc/files/lxc-2.1.1-fix-cgroup2-detection.patch new file mode 100644 index 00000000000..c16d28ac303 --- /dev/null +++ b/app-emulation/lxc/files/lxc-2.1.1-fix-cgroup2-detection.patch @@ -0,0 +1,26 @@ +From cdfe90a49f516b0f1210d181980f14a4765e10da Mon Sep 17 00:00:00 2001 +From: Christian Brauner +Date: Mon, 30 Oct 2017 14:17:20 +0100 +Subject: [PATCH] cgfsng: fix cgroup2 detection + +Signed-off-by: Christian Brauner +--- + src/lxc/cgroups/cgfsng.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/src/lxc/cgroups/cgfsng.c b/src/lxc/cgroups/cgfsng.c +index 897336f0..e43edd7d 100644 +--- a/src/lxc/cgroups/cgfsng.c ++++ b/src/lxc/cgroups/cgfsng.c +@@ -815,7 +815,7 @@ static void add_controller(char **clist, char *mountpoint, char *base_cgroup) + new->fullcgpath = NULL; + + /* record if this is the cgroup v2 hierarchy */ +- if (!strcmp(base_cgroup, "cgroup2")) ++ if (clist && !strcmp(*clist, "cgroup2")) + new->is_cgroup_v2 = true; + else + new->is_cgroup_v2 = false; +-- +2.13.6 + diff --git a/app-emulation/lxc/files/lxc.initd.7 b/app-emulation/lxc/files/lxc.initd.7 new file mode 100644 index 00000000000..6a42b6aac52 --- /dev/null +++ b/app-emulation/lxc/files/lxc.initd.7 @@ -0,0 +1,124 @@ +#!/sbin/openrc-run +# Copyright 1999-2017 Gentoo Foundation +# Distributed under the terms of the GNU General Public License v2 + +CONTAINER=${SVCNAME#*.} + +LXC_PATH=`lxc-config lxc.lxcpath` + +lxc_get_configfile() { + if [ -f "${LXC_PATH}/${CONTAINER}.conf" ]; then + echo "${LXC_PATH}/${CONTAINER}.conf" + elif [ -f "${LXC_PATH}/${CONTAINER}/config" ]; then + echo "${LXC_PATH}/${CONTAINER}/config" + else + eerror "Unable to find a suitable configuration file." + eerror "If you set up the container in a non-standard" + eerror "location, please set the CONFIGFILE variable." + return 1 + fi +} + +[ $CONTAINER != $SVCNAME ] && CONFIGFILE=${CONFIGFILE:-$(lxc_get_configfile)} + +lxc_get_var() { + awk 'BEGIN { FS="[ \t]*=[ \t]*" } $1 == "'$1'" { print $2; exit }' ${CONFIGFILE} +} + +lxc_get_net_link_type() { + awk 'BEGIN { FS="[ \t]*=[ \t]*"; _link=""; _type="" } + $1 == "lxc.network.type" {_type=$2;} + $1 == "lxc.network.link" {_link=$2;} + match($1, /lxc\.net\.[[:digit:]]+\.type/) {_type=$2;} + match($1, /lxc\.net\.[[:digit:]]+\.link/) {_link=$2;} + {if(_link != "" && _type != ""){ + printf("%s:%s\n", _link, _type ); + _link=""; _type=""; + }; }' <${CONFIGFILE} +} + +checkconfig() { + if [ ${CONTAINER} = ${SVCNAME} ]; then + eerror "You have to create an init script for each container:" + eerror " ln -s lxc /etc/init.d/lxc.container" + return 1 + fi + + # no need to output anything, the function takes care of that. + [ -z "${CONFIGFILE}" ] && return 1 + + utsname=$(lxc_get_var lxc.uts.name) + if [ -z "$utsname" ] ; then + utsname=$(lxc_get_var lxc.utsname) + fi + + if [ "${CONTAINER}" != "${utsname}" ]; then + eerror "You should use the same name for the service and the" + eerror "container. Right now the container is called ${utsname}" + return 1 + fi +} + +depend() { + # be quiet, since we have to run depend() also for the + # non-muxed init script, unfortunately. + checkconfig 2>/dev/null || return 0 + + config ${CONFIGFILE} + need localmount + use lxcfs + + local _x _if + for _x in $(lxc_get_net_link_type); do + _if=${_x%:*} + case "${_x##*:}" in + # when the network type is set to phys, we can make use of a + # network service (for instance to set it up before we disable + # the net_admin capability), but we might also not set it up + # at all on the host and leave the net_admin capable service + # to take care of it. + phys) use net.${_if} ;; + *) need net.${_if} ;; + esac + done +} + +start() { + checkconfig || return 1 + rm -f /var/log/lxc/${CONTAINER}.log + + rootpath=$(lxc_get_var lxc.rootfs) + + # Check the format of our init and the chroot's init, to see + # if we have to use linux32 or linux64; always use setarch + # when required, as that makes it easier to deal with + # x32-based containers. + case $(scanelf -BF '%a#f' ${rootpath}/sbin/init) in + EM_X86_64) setarch=linux64;; + EM_386) setarch=linux32;; + esac + + ebegin "Starting ${CONTAINER}" + env -i ${setarch} $(which lxc-start) -l WARN -n ${CONTAINER} -f ${CONFIGFILE} -d -o /var/log/lxc/${CONTAINER}.log + sleep 1 + + # lxc-start -d will _always_ report a correct startup, even if it + # failed, so rather than trust that, check that the cgroup exists. + [ -d /sys/fs/cgroup/cpuset/lxc/${CONTAINER} ] + eend $? +} + +stop() { + checkconfig || return 1 + + + if ! [ -d /sys/fs/cgroup/cpuset/lxc/${CONTAINER} ]; then + ewarn "${CONTAINER} doesn't seem to be started." + return 0 + fi + + # 10s should be enough to shut everything down + ebegin "Stopping ${CONTAINER}" + lxc-stop -t 10 -n ${CONTAINER} + eend $? +} diff --git a/app-emulation/lxc/lxc-2.1.1.ebuild b/app-emulation/lxc/lxc-2.1.1.ebuild new file mode 100644 index 00000000000..7ddad1b7527 --- /dev/null +++ b/app-emulation/lxc/lxc-2.1.1.ebuild @@ -0,0 +1,201 @@ +# Copyright 1999-2017 Gentoo Foundation +# Distributed under the terms of the GNU General Public License v2 + +EAPI="6" + +PYTHON_COMPAT=( python{3_4,3_5} ) +DISTUTILS_OPTIONAL=1 + +inherit autotools bash-completion-r1 distutils-r1 linux-info versionator flag-o-matic systemd + +DESCRIPTION="LinuX Containers userspace utilities" +HOMEPAGE="https://linuxcontainers.org/" +SRC_URI="https://linuxcontainers.org/downloads/lxc/${P}.tar.gz" + +KEYWORDS="~amd64 ~arm ~arm64" + +LICENSE="LGPL-3" +SLOT="0" +IUSE="cgmanager doc examples lua python seccomp" + +RDEPEND="net-libs/gnutls + sys-libs/libcap + cgmanager? ( app-admin/cgmanager ) + lua? ( >=dev-lang/lua-5.1:= ) + python? ( ${PYTHON_DEPS} ) + seccomp? ( sys-libs/libseccomp )" + +DEPEND="${RDEPEND} + doc? ( app-text/docbook-sgml-utils ) + >=sys-kernel/linux-headers-3.2" + +RDEPEND="${RDEPEND} + sys-process/criu + sys-apps/util-linux + app-misc/pax-utils + virtual/awk" + +CONFIG_CHECK="~CGROUPS ~CGROUP_DEVICE + ~CPUSETS ~CGROUP_CPUACCT + ~CGROUP_SCHED + + ~NAMESPACES + ~IPC_NS ~USER_NS ~PID_NS + + ~NETLINK_DIAG ~PACKET_DIAG + ~INET_UDP_DIAG ~INET_TCP_DIAG + ~UNIX_DIAG ~CHECKPOINT_RESTORE + + ~CGROUP_FREEZER + ~UTS_NS ~NET_NS + ~VETH ~MACVLAN + + ~POSIX_MQUEUE + ~!NETPRIO_CGROUP + + ~!GRKERNSEC_CHROOT_MOUNT + ~!GRKERNSEC_CHROOT_DOUBLE + ~!GRKERNSEC_CHROOT_PIVOT + ~!GRKERNSEC_CHROOT_CHMOD + ~!GRKERNSEC_CHROOT_CAPS + ~!GRKERNSEC_PROC + ~!GRKERNSEC_SYSFS_RESTRICT +" + +ERROR_DEVPTS_MULTIPLE_INSTANCES="CONFIG_DEVPTS_MULTIPLE_INSTANCES: needed for pts inside container" + +ERROR_CGROUP_FREEZER="CONFIG_CGROUP_FREEZER: needed to freeze containers" + +ERROR_UTS_NS="CONFIG_UTS_NS: needed to unshare hostnames and uname info" +ERROR_NET_NS="CONFIG_NET_NS: needed for unshared network" + +ERROR_VETH="CONFIG_VETH: needed for internal (host-to-container) networking" +ERROR_MACVLAN="CONFIG_MACVLAN: needed for internal (inter-container) networking" + +ERROR_NETLINK_DIAG="CONFIG_NETLINK_DIAG: needed for lxc-checkpoint" +ERROR_PACKET_DIAG="CONFIG_PACKET_DIAG: needed for lxc-checkpoint" +ERROR_INET_UDP_DIAG="CONFIG_INET_UDP_DIAG: needed for lxc-checkpoint" +ERROR_INET_TCP_DIAG="CONFIG_INET_TCP_DIAG: needed for lxc-checkpoint" +ERROR_UNIX_DIAG="CONFIG_UNIX_DIAG: needed for lxc-checkpoint" +ERROR_CHECKPOINT_RESTORE="CONFIG_CHECKPOINT_RESTORE: needed for lxc-checkpoint" + +ERROR_POSIX_MQUEUE="CONFIG_POSIX_MQUEUE: needed for lxc-execute command" + +ERROR_NETPRIO_CGROUP="CONFIG_NETPRIO_CGROUP: as of kernel 3.3 and lxc 0.8.0_rc1 this causes LXCs to fail booting." + +ERROR_GRKERNSEC_CHROOT_MOUNT="CONFIG_GRKERNSEC_CHROOT_MOUNT: some GRSEC features make LXC unusable see postinst notes" +ERROR_GRKERNSEC_CHROOT_DOUBLE="CONFIG_GRKERNSEC_CHROOT_DOUBLE: some GRSEC features make LXC unusable see postinst notes" +ERROR_GRKERNSEC_CHROOT_PIVOT="CONFIG_GRKERNSEC_CHROOT_PIVOT: some GRSEC features make LXC unusable see postinst notes" +ERROR_GRKERNSEC_CHROOT_CHMOD="CONFIG_GRKERNSEC_CHROOT_CHMOD: some GRSEC features make LXC unusable see postinst notes" +ERROR_GRKERNSEC_CHROOT_CAPS="CONFIG_GRKERNSEC_CHROOT_CAPS: some GRSEC features make LXC unusable see postinst notes" +ERROR_GRKERNSEC_PROC="CONFIG_GRKERNSEC_PROC: this GRSEC feature is incompatible with unprivileged containers" +ERROR_GRKERNSEC_SYSFS_RESTRICT="CONFIG_GRKERNSEC_SYSFS_RESTRICT: this GRSEC feature is incompatible with unprivileged containers" + +DOCS=(AUTHORS CONTRIBUTING MAINTAINERS NEWS README doc/FAQ.txt) + +REQUIRED_USE="python? ( ${PYTHON_REQUIRED_USE} )" + +pkg_setup() { + kernel_is -lt 4 7 && CONFIG_CHECK="${CONFIG_CHECK} ~DEVPTS_MULTIPLE_INSTANCES" + linux-info_pkg_setup +} + +src_prepare() { + eapply "${FILESDIR}"/${PN}-2.0.6-bash-completion.patch + #558854 + eapply "${FILESDIR}"/${PN}-2.0.5-omit-sysconfig.patch + eapply "${FILESDIR}"/${PN}-2.1.1-fix-cgroup2-detection.patch + eapply "${FILESDIR}"/${PN}-2.1.1-cgroups-enable-container-without-CAP_SYS_ADMIN.patch + eapply_user + eautoreconf +} + +src_configure() { + append-flags -fno-strict-aliasing + + if use python; then + #541932 + python_setup "python3*" + export PKG_CONFIG_PATH="${T}/${EPYTHON}/pkgconfig:${PKG_CONFIG_PATH}" + fi + + # I am not sure about the --with-rootfs-path + # /var/lib/lxc is probably more appropriate than + # /usr/lib/lxc. + # Note by holgersson: Why is apparmor disabled? + econf \ + --localstatedir=/var \ + --bindir=/usr/bin \ + --sbindir=/usr/bin \ + --with-config-path=/var/lib/lxc \ + --with-rootfs-path=/var/lib/lxc/rootfs \ + --with-distro=gentoo \ + --with-runtime-path=/run \ + --disable-apparmor \ + --disable-werror \ + $(use_enable cgmanager) \ + $(use_enable doc) \ + $(use_enable examples) \ + $(use_enable lua) \ + $(use_enable python) \ + $(use_enable seccomp) +} + +python_compile() { + distutils-r1_python_compile build_ext -I ../ -L ../${PN} +} + +src_compile() { + default + + if use python; then + pushd "${S}/src/python-${PN}" > /dev/null + distutils-r1_src_compile + popd > /dev/null + fi +} + +src_install() { + default + + mv "${ED}"/usr/share/bash-completion/completions/${PN} "${ED}"/$(get_bashcompdir)/${PN}-start || die + # start-ephemeral is no longer a command but removing it here + # generates QA warnings (still in upstream completion script) + bashcomp_alias ${PN}-start \ + ${PN}-{attach,cgroup,copy,console,create,destroy,device,execute,freeze,info,monitor,snapshot,start-ephemeral,stop,unfreeze,wait} + + if use python; then + pushd "${S}/src/python-lxc" > /dev/null + # Unset DOCS. This has been handled by the default target + unset DOCS + distutils-r1_src_install + popd > /dev/null + fi + + keepdir /etc/lxc /var/lib/lxc/rootfs /var/log/lxc + + find "${D}" -name '*.la' -delete + + # Gentoo-specific additions! + newinitd "${FILESDIR}/${PN}.initd.7" ${PN} + + # Remember to compare our systemd unit file with the upstream one + # config/init/systemd/lxc.service.in + systemd_newunit "${FILESDIR}"/${PN}_at.service.4 "lxc@.service" +} + +pkg_postinst() { + elog "" + elog "Starting from version ${PN}-1.1.0-r3, the default lxc path has been" + elog "moved from /etc/lxc to /var/lib/lxc. If you still want to use /etc/lxc" + elog "please add the following to your /etc/lxc/default.conf" + elog "lxc.lxcpath = /etc/lxc" + elog "" + elog "There is an init script provided with the package now; no documentation" + elog "is currently available though, so please check out /etc/init.d/lxc ." + elog "You _should_ only need to symlink it to /etc/init.d/lxc.configname" + elog "to start the container defined into /etc/lxc/configname.conf ." + elog "For further information about LXC development see" + elog "http://blog.flameeyes.eu/tag/lxc" # remove once proper doc is available + elog "" +}