History log of /unit/auto/isolation (Results 1 – 7 of 7)
Revision (<<< Hide revision tags) (Show revision tags >>>) Date Author Comments
# 2170:8eee6cdafb58 02-Aug-2022 Alejandro Colomar

Rejecting non-Linux pivot_root(2).

Some non-Linux systems implement pivot_root(2), even if they
don't document that. An example is MacOS:

$ grepc pivot_root / 2>/dev/null
.../sys/sysproto.h:3012:

Rejecting non-Linux pivot_root(2).

Some non-Linux systems implement pivot_root(2), even if they
don't document that. An example is MacOS:

$ grepc pivot_root / 2>/dev/null
.../sys/sysproto.h:3012:
int pivot_root(struct proc *, struct pivot_root_args *, int *);

Since the prototype of the syscall differs from that of Linux, we
can't use that syscall. Let's make sure the test only detects
pivot_root(2) under Linux. Also, rename the feature macro to make
clear that it's only about Linux's pivot_root(2).

This closes #737 issue on GitHub.

show more ...


# 2169:b8afbff114fc 18-Jun-2022 Alejandro Colomar

Including <mntent.h> iff it exists.

With NXT_HAVE_PIVOT_ROOT, we had issues in MacOS. Headers should
normally be included unconditionally, except of course if they
don't exist.

This fixes part of

Including <mntent.h> iff it exists.

With NXT_HAVE_PIVOT_ROOT, we had issues in MacOS. Headers should
normally be included unconditionally, except of course if they
don't exist.

This fixes part of the #737 issue on GitHub.

show more ...


# 2153:37bccff06c9f 18-Jun-2022 Alejandro Colomar

Replaced Linux syscall macros by libc macros.

User-space programs should use the SYS_*form, as documented in
syscall(2). That also adds compatibility to non-Linux systems.


Revision tags: 1.27.0-1, 1.27.0, 1.26.1-1, 1.26.1, 1.26.0-1, 1.26.0, 1.25.0-1, 1.25.0, 1.24.0-1, 1.24.0, 1.23.0-1, 1.23.0, 1.22.0-1, 1.22.0, 1.21.0-1, 1.21.0, 1.20.0-1, 1.20.0, 1.19.0-1, 1.19.0
# 1503:c21230ef5a0e 22-Jun-2020 Tiago Natel de Moura

Isolation: fixed build when features aren't detected.


Revision tags: 1.18.0-1, 1.18.0
# 1489:4a3ec07f4b19 28-May-2020 Tiago Natel de Moura

Added "rootfs" feature.


Revision tags: 1.17.0-1, 1.17.0, 1.16.0-1, 1.16.0, 1.15.0-1, 1.15.0, 1.14.0-1, 1.14.0
# 1306:3604d05e48be 06-Dec-2019 Tiago Natel

Isolation: allowed the use of credentials with unpriv userns.

The setuid/setgid syscalls requires root capabilities but if the kernel
supports unprivileged user namespace then the child process has

Isolation: allowed the use of credentials with unpriv userns.

The setuid/setgid syscalls requires root capabilities but if the kernel
supports unprivileged user namespace then the child process has the full
set of capabilities in the new namespace, then we can allow setting "user"
and "group" in such cases (this is a common security use case).

Tests were added to ensure user gets meaningful error messages for
uid/gid mapping misconfigurations.

show more ...


Revision tags: 1.13.0-1, 1.13.0, 1.12.0-1, 1.12.0, 1.11.0-2, 1.11.0-1, 1.11.0
# 1182:325b315e48c4 19-Sep-2019 Tiago de Bem Natel de Moura

Initial applications isolation support using Linux namespaces.