lxc: Finer-grained config control

Split config files into snippets isolating new LXC features by version.
Move `seccomp.allow_nesting` to version 4 or higher.

NOTE: this currently assumes that new LXC versions will keep compatibility
with old config options. The only exception to this was LXC 1.x -> 2.x

diff --git a/data/configs/config_1 b/data/configs/config_1
index 33671c4c4a536c4b9525dbb3d24cdddd41ec24ab..365cac307b34b88c046f93a5afbdfbd2ceb1440c 100644 (file)
--- a/data/configs/config_1
+++ b/data/configs/config_1
@@ -1,18 +1,9 @@
-# Waydroid LXC Config
-
-lxc.rootfs.path = /var/lib/waydroid/rootfs

 lxc.utsname = waydroid
 lxc.utsname = waydroid

-lxc.arch = LXCARCH
-lxc.autodev = 0
-# lxc.autodev.tmpfs.size = 25000000
-lxc.aa_profile = unconfined
-lxc.seccomp = /var/lib/waydroid/lxc/waydroid/waydroid.seccomp
-
-lxc.cap.keep = audit_control sys_nice wake_alarm setpcap setgid setuid sys_ptrace sys_admin wake_alarm block_suspend sys_time net_admin net_raw net_bind_service kill dac_override dac_read_search fsetid mknod syslog chown sys_resource fowner sys_module ipc_lock sys_chroot

 
 lxc.init_cmd = /init
 
 
 lxc.init_cmd = /init
 

-lxc.mount.auto = cgroup:ro sys:ro proc
+lxc.aa_profile = unconfined
+lxc.seccomp = /var/lib/waydroid/lxc/waydroid/waydroid.seccomp

 
 lxc.network.type = veth
 lxc.network.flags = up
 
 lxc.network.type = veth
 lxc.network.flags = up


@@ -21,9 +12,3 @@ lxc.network.name = eth0
 lxc.network.hwaddr = 00:16:3e:f9:d3:03
 lxc.network.mtu = 1500
 
 lxc.network.hwaddr = 00:16:3e:f9:d3:03
 lxc.network.mtu = 1500
 

-lxc.console.path = none
-lxc.pty.max = 10
-
-lxc.include = /var/lib/waydroid/lxc/waydroid/config_nodes
-
-lxc.hook.post-stop = /dev/null

diff --git a/data/configs/config_2 b/data/configs/config_2
index 34537ecd674ff20cfa2936f07bb00c3d8199444d..dcc6fc4de25b6cb784a4283d9ba7999cdb423652 100644 (file)
--- a/data/configs/config_2
+++ b/data/configs/config_2
@@ -1,21 +1,12 @@
-# Waydroid LXC Config
-
-lxc.rootfs.path = /var/lib/waydroid/rootfs

 lxc.uts.name = waydroid
 lxc.uts.name = waydroid

-lxc.arch = LXCARCH
-lxc.autodev = 0
-# lxc.autodev.tmpfs.size = 25000000
+

 lxc.apparmor.profile = unconfined
 lxc.seccomp.profile = /var/lib/waydroid/lxc/waydroid/waydroid.seccomp
 lxc.apparmor.profile = unconfined
 lxc.seccomp.profile = /var/lib/waydroid/lxc/waydroid/waydroid.seccomp

-lxc.seccomp.allow_nesting = 1

 
 

-lxc.cap.keep = audit_control sys_nice wake_alarm setpcap setgid setuid sys_ptrace sys_admin wake_alarm block_suspend sys_time net_admin net_raw net_bind_service kill dac_override dac_read_search fsetid mknod syslog chown sys_resource fowner sys_module ipc_lock sys_chroot

 lxc.no_new_privs = 1
 
 lxc.init.cmd = /init
 
 lxc.no_new_privs = 1
 
 lxc.init.cmd = /init
 

-lxc.mount.auto = cgroup:ro sys:ro proc
-

 lxc.net.0.type = veth
 lxc.net.0.flags = up
 lxc.net.0.link = waydroid0
 lxc.net.0.type = veth
 lxc.net.0.flags = up
 lxc.net.0.link = waydroid0


@@ -23,9 +14,3 @@ lxc.net.0.name = eth0
 lxc.net.0.hwaddr = 00:16:3e:f9:d3:03
 lxc.net.0.mtu = 1500
 
 lxc.net.0.hwaddr = 00:16:3e:f9:d3:03
 lxc.net.0.mtu = 1500
 

-lxc.console.path = none
-lxc.pty.max = 10
-
-lxc.include = /var/lib/waydroid/lxc/waydroid/config_nodes
-
-lxc.hook.post-stop = /dev/null

diff --git a/data/configs/config_4 b/data/configs/config_4
new file mode 100644 (file)
index 0000000..adecdad
--- /dev/null
+++ b/data/configs/config_4
@@ -0,0 +1,2 @@
+lxc.seccomp.allow_nesting = 1
+

diff --git a/data/configs/config_base b/data/configs/config_base
new file mode 100644 (file)
index 0000000..8bcff5c
--- /dev/null
+++ b/data/configs/config_base
@@ -0,0 +1,18 @@
+# Waydroid LXC Config
+
+lxc.rootfs.path = /var/lib/waydroid/rootfs
+lxc.arch = LXCARCH
+lxc.autodev = 0
+# lxc.autodev.tmpfs.size = 25000000
+
+lxc.cap.keep = audit_control sys_nice wake_alarm setpcap setgid setuid sys_ptrace sys_admin wake_alarm block_suspend sys_time net_admin net_raw net_bind_service kill dac_override dac_read_search fsetid mknod syslog chown sys_resource fowner sys_module ipc_lock sys_chroot
+
+lxc.mount.auto = cgroup:ro sys:ro proc
+
+lxc.console.path = none
+lxc.pty.max = 10
+
+lxc.include = /var/lib/waydroid/lxc/waydroid/config_nodes
+
+lxc.hook.post-stop = /dev/null
+

diff --git a/tools/helpers/lxc.py b/tools/helpers/lxc.py
index a13f838e1b779c97740d1b9682b90ccec14f8938..ee84c61ca90fc9c55c12f6b7006bfe86b6fc5423 100644 (file)
--- a/tools/helpers/lxc.py
+++ b/tools/helpers/lxc.py
@@ -130,18 +130,25 @@ def generate_nodes_lxc_config(args):
 
 def set_lxc_config(args):
     lxc_path = tools.config.defaults["lxc"] + "/waydroid"
 
 def set_lxc_config(args):
     lxc_path = tools.config.defaults["lxc"] + "/waydroid"

-    config_file = "config_2"

     lxc_ver = get_lxc_version(args)
     if lxc_ver == 0:
         raise OSError("LXC is not installed")
     lxc_ver = get_lxc_version(args)
     if lxc_ver == 0:
         raise OSError("LXC is not installed")

-    elif lxc_ver <= 2:
-        config_file = "config_1"
-    config_path = tools.config.tools_src + "/data/configs/" + config_file
+    config_paths = tools.config.tools_src + "/data/configs/config_"

     seccomp_profile = tools.config.tools_src + "/data/configs/waydroid.seccomp"
 
     seccomp_profile = tools.config.tools_src + "/data/configs/waydroid.seccomp"
 

+    config_snippets = [ config_paths + "base" ]
+    # lxc v1 is a bit special because some options got renamed later
+    if lxc_ver == 1:
+        config_snippets.append(config_paths + "1")
+    else:
+        for ver in range(2, 5):
+            snippet = config_paths + str(ver)
+            if lxc_ver >= ver and os.path.exists(snippet):
+                config_snippets.append(snippet)
+

     command = ["mkdir", "-p", lxc_path]
     tools.helpers.run.user(args, command)
     command = ["mkdir", "-p", lxc_path]
     tools.helpers.run.user(args, command)

-    command = ["cp", "-fpr", config_path, lxc_path + "/config"]
+    command = ["sh", "-c", "cat {} > \"{}\"".format(' '.join('"{0}"'.format(w) for w in config_snippets), lxc_path + "/config")]

     tools.helpers.run.user(args, command)
     command = ["sed", "-i", "s/LXCARCH/{}/".format(platform.machine()), lxc_path + "/config"]
     tools.helpers.run.user(args, command)
     tools.helpers.run.user(args, command)
     command = ["sed", "-i", "s/LXCARCH/{}/".format(platform.machine()), lxc_path + "/config"]
     tools.helpers.run.user(args, command)