summaryrefslogtreecommitdiff
AgeCommit message (Collapse)AuthorFilesLines
2017-12-11system.conf: Allow creating containers on the system buscontainers-minimum-101354Simon McVittie1-0/+2
Signed-off-by: Simon McVittie <smcv@collabora.com> Reviewed-by: Philip Withnall <withnall@endlessm.com> Bug: https://bugs.freedesktop.org/show_bug.cgi?id=101354
2017-12-11bus/driver: Allow unprivileged connections to create app-containersSimon McVittie1-3/+3
This lets ordinary users create a limited number of app-containers on the system bus. Signed-off-by: Simon McVittie <smcv@collabora.com> Reviewed-by: Philip Withnall <withnall@endlessm.com> Bug: https://bugs.freedesktop.org/show_bug.cgi?id=101354
2017-12-11Revert "test/uid-permissions: Assert that AddServer is privileged"Simon McVittie1-76/+0
I'm about to make that not be true. Signed-off-by: Simon McVittie <smcv@collabora.com> Reviewed-by: Philip Withnall <withnall@endlessm.com> Bug: https://bugs.freedesktop.org/show_bug.cgi?id=101354
2017-12-11test/containers: Exercise the resource limitsSimon McVittie4-1/+364
Signed-off-by: Simon McVittie <smcv@collabora.com> Reviewed-by: Philip Withnall <withnall@endlessm.com> Bug: https://bugs.freedesktop.org/show_bug.cgi?id=101354
2017-12-11containers: Enforce max_containers_per_userSimon McVittie2-3/+72
Signed-off-by: Simon McVittie <smcv@collabora.com> Reviewed-by: Philip Withnall <withnall@endlessm.com> Bug: https://bugs.freedesktop.org/show_bug.cgi?id=101354
2017-12-11bus/containers: Enforce max_connections_per_containerSimon McVittie1-0/+13
Signed-off-by: Simon McVittie <smcv@collabora.com> Reviewed-by: Philip Withnall <withnall@endlessm.com> Bug: https://bugs.freedesktop.org/show_bug.cgi?id=101354
2017-12-11bus/containers: Enforce max_containers limitSimon McVittie1-0/+18
Signed-off-by: Simon McVittie <smcv@collabora.com> Reviewed-by: Philip Withnall <withnall@endlessm.com> Bug: https://bugs.freedesktop.org/show_bug.cgi?id=101354
2017-12-11bus/containers: Limit the size of metadata we will storeSimon McVittie1-0/+30
Signed-off-by: Simon McVittie <smcv@collabora.com> Reviewed-by: Philip Withnall <withnall@endlessm.com> Bug: https://bugs.freedesktop.org/show_bug.cgi?id=101354
2017-12-11bus: Add (unused) settings for resource limits for containersSimon McVittie6-2/+84
These will be enforced in subsequent commits. Reviewed-by: Philip Withnall <withnall@endlessm.com> [smcv: Fix whitespace] Signed-off-by: Simon McVittie <smcv@collabora.com> Bug: https://bugs.freedesktop.org/show_bug.cgi?id=101354
2017-12-11test/containers: Check that GetInstanceInfo stops workingSimon McVittie1-0/+31
After the container instance is removed, the method should not work. Signed-off-by: Simon McVittie <smcv@collabora.com> Reviewed-by: Philip Withnall <withnall@endlessm.com> Bug: https://bugs.freedesktop.org/show_bug.cgi?id=101354
2017-12-11t/containers: Exercise trivial and non-trivial container metadataSimon McVittie1-0/+242
Signed-off-by: Simon McVittie <smcv@collabora.com> Reviewed-by: Philip Withnall <withnall@endlessm.com> Bug: https://bugs.freedesktop.org/show_bug.cgi?id=101354
2017-12-11bus/driver: Add GetConnectionInstance(), GetInstanceInfo()Simon McVittie3-0/+155
Signed-off-by: Simon McVittie <smcv@collabora.com> Reviewed-by: Philip Withnall <withnall@endlessm.com> Bug: https://bugs.freedesktop.org/show_bug.cgi?id=101354
2017-12-11test/dbus-daemon: Assert absence of Containers1 credentialsSimon McVittie1-0/+4
These connections are not to a container server. Signed-off-by: Simon McVittie <smcv@collabora.com> Reviewed-by: Philip Withnall <withnall@endlessm.com> Bug: https://bugs.freedesktop.org/show_bug.cgi?id=101354
2017-12-11bus/driver: Add basic container info to GetConnectionCredentials()Simon McVittie1-0/+16
Signed-off-by: Simon McVittie <smcv@collabora.com> Reviewed-by: Philip Withnall <withnall@endlessm.com> Bug: https://bugs.freedesktop.org/show_bug.cgi?id=101354
2017-12-11bus/driver: Containers can't use the Verbose and Stats interfacesSimon McVittie1-5/+5
These are debugging interfaces, which are essentially read-only. By default, Verbose is not available on the system bus at all and Stats is only available to uid 0, but both are available on the session bus, and they can be allowed for other uids by configuring the system bus. Signed-off-by: Simon McVittie <smcv@collabora.com> Reviewed-by: Philip Withnall <withnall@endlessm.com> Bug: https://bugs.freedesktop.org/show_bug.cgi?id=101354
2017-12-11bus/driver: Add a flag for methods that can't be invoked by containersSimon McVittie1-6/+25
We can relax AddServer() from PRIVILEGED to NOT_CONTAINERS when we've put resource limits in place, although for now it must remain PRIVILEGED because it uses up resources. Signed-off-by: Simon McVittie <smcv@collabora.com> Reviewed-by: Philip Withnall <withnall@endlessm.com> Bug: https://bugs.freedesktop.org/show_bug.cgi?id=101354
2017-12-11test/containers: Check that connections from containers are unprivilegedSimon McVittie1-0/+13
Signed-off-by: Simon McVittie <smcv@collabora.com> Reviewed-by: Philip Withnall <withnall@endlessm.com> Bug: https://bugs.freedesktop.org/show_bug.cgi?id=101354
2017-12-11test/containers: Check that containers can't make new containersSimon McVittie1-0/+65
We should prevent containers from trying to put a container in our container so we can sandbox while we sandbox. The implementation doesn't actually have any concept of nesting or layering, so that would potentially be privilege escalation. At the moment, this is just prevented by METHOD_FLAG_PRIVILEGED. When we remove that flag (after we've introduced better resource limits), we can specifically restrict this method to not be called by containers instead. This test will make sure we do. Signed-off-by: Simon McVittie <smcv@collabora.com> Reviewed-by: Philip Withnall <withnall@endlessm.com> Bug: https://bugs.freedesktop.org/show_bug.cgi?id=101354
2017-12-11bus/driver: Treat connections from inside containers as unprivilegedSimon McVittie1-3/+31
Even if the uid matches, a contained app shouldn't count as the owner of the bus. Signed-off-by: Simon McVittie <smcv@collabora.com> Reviewed-by: Philip Withnall <withnall@endlessm.com> Bug: https://bugs.freedesktop.org/show_bug.cgi?id=101354
2017-12-11bus/containers: Indicate in loginfo whether connection is containedSimon McVittie3-0/+59
Signed-off-by: Simon McVittie <smcv@collabora.com> Reviewed-by: Philip Withnall <withnall@endlessm.com> Bug: https://bugs.freedesktop.org/show_bug.cgi?id=101354
2017-12-11test/containers: Assert that InstanceRemoved is emittedSimon McVittie1-2/+108
Signed-off-by: Simon McVittie <smcv@collabora.com> Reviewed-by: Philip Withnall <withnall@endlessm.com> Bug: https://bugs.freedesktop.org/show_bug.cgi?id=101354
2017-12-11bus/containers: Emit InstanceRemoved signalSimon McVittie2-1/+77
Signed-off-by: Simon McVittie <smcv@collabora.com> Reviewed-by: Philip Withnall <withnall@endlessm.com> Bug: https://bugs.freedesktop.org/show_bug.cgi?id=101354
2017-12-11test/containers: Exercise the various ways to stop a containerSimon McVittie1-2/+347
Signed-off-by: Simon McVittie <smcv@collabora.com> Reviewed-by: Philip Withnall <withnall@endlessm.com> Bug: https://bugs.freedesktop.org/show_bug.cgi?id=101354
2017-12-11bus/containers: Don't allow stopping other users' containersSimon McVittie1-0/+32
On the system bus, that would be a denial of service, assuming we relax the access-control from METHOD_FLAG_PRIVILEGED to a new METHOD_FLAG_NOT_CONTAINERS later. Signed-off-by: Simon McVittie <smcv@collabora.com> Reviewed-by: Philip Withnall <withnall@endlessm.com> Bug: https://bugs.freedesktop.org/show_bug.cgi?id=101354
2017-12-11bus/containers: Implement methods to stop containers explicitlySimon McVittie4-0/+115
Signed-off-by: Simon McVittie <smcv@collabora.com> Reviewed-by: Philip Withnall <withnall@endlessm.com> Bug: https://bugs.freedesktop.org/show_bug.cgi?id=101354
2017-12-11bus/containers: Give each instance a list of all its connectionsSimon McVittie1-1/+37
Reviewed-by: Philip Withnall <withnall@endlessm.com> [smcv: Fix minor conflict] Signed-off-by: Simon McVittie <smcv@collabora.com> Bug: https://bugs.freedesktop.org/show_bug.cgi?id=101354
2017-12-11bus/containers: Shut down container servers when initiator goes awaySimon McVittie3-0/+46
We will eventually want to have other ways to signal that a container server should stop listening, so that the container manager doesn't have to stay on D-Bus (fd-passing the read end of a pipe whose write end will be closed by the container manager has been suggested as easier to deal with for Flatpak/Bubblewrap), but for now we're doing the simplest possible thing. Signed-off-by: Simon McVittie <smcv@collabora.com> Reviewed-by: Philip Withnall <withnall@endlessm.com> Bug: https://bugs.freedesktop.org/show_bug.cgi?id=101354
2017-12-11bus/containers: Link each container to its initiating connectionSimon McVittie1-3/+91
We will need this to be able to shut down the container when its creator vanishes. Reviewed-by: Philip Withnall <withnall@endlessm.com> [smcv: Fix minor conflict] Signed-off-by: Simon McVittie <smcv@collabora.com> Bug: https://bugs.freedesktop.org/show_bug.cgi?id=101354
2017-12-11bus/containers: Each connection to a container holds a referenceSimon McVittie1-2/+33
Reviewed-by: Philip Withnall <withnall@endlessm.com> [smcv: Fix minor conflicts] Signed-off-by: Simon McVittie <smcv@collabora.com> Bug: https://bugs.freedesktop.org/show_bug.cgi?id=101354
2017-12-11test/containers: Exercise connecting to the new socket as the wrong uidSimon McVittie1-0/+45
Signed-off-by: Simon McVittie <smcv@collabora.com> Reviewed-by: Philip Withnall <withnall@endlessm.com> Bug: https://bugs.freedesktop.org/show_bug.cgi?id=101354
2017-12-11bus/containers: Require connecting uid to match caller of AddServerSimon McVittie1-0/+43
If we're strict now, we can relax this later (either with a named parameter or always); but if we're lenient now, we'll be stuck with it forever, so be strict. Signed-off-by: Simon McVittie <smcv@collabora.com> Reviewed-by: Philip Withnall <withnall@endlessm.com> Bug: https://bugs.freedesktop.org/show_bug.cgi?id=101354
2017-12-11squash! test/containers: Exercise a successful call to AddServerSimon McVittie1-0/+4
Don't leak the directory names either.
2017-12-11test/containers: Exercise a successful call to AddServerSimon McVittie1-1/+202
Signed-off-by: Simon McVittie <smcv@collabora.com> Bug: https://bugs.freedesktop.org/show_bug.cgi?id=101354
2017-12-11bus/containers: Set up new connections to join the busSimon McVittie1-1/+5
Signed-off-by: Simon McVittie <smcv@collabora.com> Reviewed-by: Philip Withnall <withnall@endlessm.com> Bug: https://bugs.freedesktop.org/show_bug.cgi?id=101354
2017-12-11bus_context_add_incoming_connection: factor outSimon McVittie2-2/+12
Reviewed-by: Philip Withnall <withnall@endlessm.com> [smcv: Fix minor conflict] Signed-off-by: Simon McVittie <smcv@collabora.com> Bug: https://bugs.freedesktop.org/show_bug.cgi?id=101354
2017-12-11squash! bus/containers: Create a DBusServer and add it to the main loopSimon McVittie1-1/+1
--- goto out, because now we can.
2017-12-11squash! bus/containers: Create a DBusServer and add it to the main loopSimon McVittie1-7/+7
--- bus_containers_ensure_address_template: Don't leak dir in the case where XDG_RUNTIME_DIR is not set. Initializing with _dbus_string_init_const does not free the buffer created by _dbus_string_init.
2017-12-11bus/containers: Create a DBusServer and add it to the main loopSimon McVittie7-15/+324
This means we can accept connections on the new socket. For now, we don't process them and they get closed. For the system bus (or root's session bus, where the difference is harmless but makes automated testing easier), rely on system-wide infrastructure to create /run/dbus/containers. The upstream dbus distribution no longer contains integration glue for non-systemd boot systems, but downstreams that maintain a non-systemd boot system and are interested in the Containers interface should create /run/dbus/containers during boot. Signed-off-by: Simon McVittie <smcv@collabora.com> Bug: https://bugs.freedesktop.org/show_bug.cgi?id=101354
2017-12-11bus/containers: Build a global data structure for container instancesSimon McVittie4-3/+268
We still don't actually create a DBusServer for incoming connections at this point, much less accept incoming connections. Signed-off-by: Simon McVittie <smcv@collabora.com> Reviewed-by: Philip Withnall <withnall@endlessm.com> Bug: https://bugs.freedesktop.org/show_bug.cgi?id=101354
2017-12-11test/containers: Exercise the new parameter checkingSimon McVittie1-0/+89
Signed-off-by: Simon McVittie <smcv@collabora.com> Reviewed-by: Philip Withnall <withnall@endlessm.com> Bug: https://bugs.freedesktop.org/show_bug.cgi?id=101354
2017-12-11bus/containers: Do some basic checking on the parametersSimon McVittie1-0/+73
In particular, we now fail early if we can't extract the file descriptor, or if there are named parameters (none are supported yet). Signed-off-by: Simon McVittie <smcv@collabora.com> Reviewed-by: Philip Withnall <withnall@endlessm.com> Bug: https://bugs.freedesktop.org/show_bug.cgi?id=101354
2017-12-11test/containers: New testSimon McVittie2-0/+164
So far it only exercises SupportedArguments. Signed-off-by: Simon McVittie <smcv@collabora.com> Reviewed-by: Philip Withnall <withnall@endlessm.com> Bug: https://bugs.freedesktop.org/show_bug.cgi?id=101354
2017-12-11test/uid-permissions: Assert that AddServer is privilegedSimon McVittie1-0/+81
Signed-off-by: Simon McVittie <smcv@collabora.com> Reviewed-by: Philip Withnall <withnall@endlessm.com> Bug: https://bugs.freedesktop.org/show_bug.cgi?id=101354
2017-12-11travis-ci: Do at least one build with and one without containersSimon McVittie1-0/+2
Signed-off-by: Simon McVittie <smcv@collabora.com> Reviewed-by: Philip Withnall <withnall@endlessm.com> Bug: https://bugs.freedesktop.org/show_bug.cgi?id=101354
2017-12-11driver: Add a stub implementation of the Containers1 interfaceSimon McVittie10-0/+129
For now, this is considered to be a privileged operation, because the resource-limiting isn't wired up yet. It only contains the bare minimum of API. Signed-off-by: Simon McVittie <smcv@collabora.com> Reviewed-by: Philip Withnall <withnall@endlessm.com> Bug: https://bugs.freedesktop.org/show_bug.cgi?id=101354
2017-12-11spec: Document the initial Containers1 interfaceSimon McVittie1-0/+552
Signed-off-by: Simon McVittie <smcv@collabora.com> Reviewed-by: Philip Withnall <withnall@endlessm.com> Bug: https://bugs.freedesktop.org/show_bug.cgi?id=101354
2017-12-04_dbus_test_oom_handling: print TAP diagnosticsSimon McVittie1-8/+14
These aren't *that* verbose, so it seems OK to print them all the time, not just in the needlessly spammy verbose mode. Bug: https://bugs.freedesktop.org/show_bug.cgi?id=100317 Reviewed-by: Philip Withnall <withnall@endlessm.com> Signed-off-by: Simon McVittie <smcv@collabora.com>
2017-12-04tests: Add the ability to multiply up test timeoutsSimon McVittie5-11/+12
Tests that brute-force OOM code paths can be rather slow. Bug: https://bugs.freedesktop.org/show_bug.cgi?id=100317 Reviewed-by: Philip Withnall <withnall@endlessm.com> Signed-off-by: Simon McVittie <smcv@collabora.com>
2017-12-04test-utils: Separate failable and non-failable functionsSimon McVittie10-26/+54
test_object_try_whatever() now has libdbus-like OOM handling, while test_object_whatever() has GLib-like OOM handling. This is because an overwhelming majority of the callers of these functions either didn't check for OOM anyway, or checked for it but then aborted. In the uncommon case where we do care, we can use the _try_ version. Bug: https://bugs.freedesktop.org/show_bug.cgi?id=100317 Reviewed-by: Philip Withnall <withnall@endlessm.com> Signed-off-by: Simon McVittie <smcv@collabora.com>
2017-12-04test_connection_setup: Don't crash on unlikely OOMSimon McVittie1-1/+5
If _dbus_loop_queue_dispatch fails with OOM, we'd try to free cd, while cd is already owned by the connection's timeout functions. Bug: https://bugs.freedesktop.org/show_bug.cgi?id=100317 Reviewed-by: Philip Withnall <withnall@endlessm.com> Signed-off-by: Simon McVittie <smcv@collabora.com>
generated by cgit v1.2.3 (git 2.39.1) at 2024-11-21 12:49:55 +0000