summaryrefslogtreecommitdiff
path: root/linuxnamespaces/__init__.py
AgeCommit message (Collapse)Author
2024-06-22populate_sys: allow device accessHelmut Grohne
The systemd test suite does not like having no access to /sys/dev and other trees related to devices. Optionally provide them. Properly virtualizing them likely requires lxcfs or similar.
2024-06-22populate_sys: refactorHelmut Grohne
We now compute the actual bind mounts first and deduce the directories in need of creation from that. This makes populate_sys easier to extend.
2024-06-22populate_dev: fix /dev/net/tunHelmut Grohne
Fixes: 8b98dc846e7b ("populate_dev: remove assumption that newdev does not shadow origdev")
2024-06-22add function enable_loopback_ifHelmut Grohne
It can be used in a new network namespace to enable the loopback network interface and thus provide easy network isolation.
2024-06-16populate_dev: also provide /dev/shmHelmut Grohne
This is needed e.g. for Python's multiprocessing.SemLock.
2024-06-16populate_dev: install /dev/fdHelmut Grohne
This symlink turns out to be important for execveat. Its NOTES section details that /dev/fd needs to work in order for execveat to work. We better provide this symlink.
2024-06-11fix formatting and spelling errorsHelmut Grohne
No functional changes.
2024-06-11improve typingHelmut Grohne
linuxnamespaces/__init__.py: * linuxnamespaces.filedescriptor only exports FileDescriptor. By importing *, we re-export it implicitly. linuxnamespaces/atlocation.py: * PathLike should be parameterized and we no longer allow bytes there. linuxnamespaces/tarutils.py: * Resolve dict vs Mapping. tests/test_simple.py: * Establish expected type to mypy. examples/unschroot.py: * pidfd is first an int and later a FileDescriptor, but we always use it as int. * Also tell mypy that we cannot get NULL from waitid.
2024-05-28support sendfile in async_copyfdHelmut Grohne
2024-05-27add IDAllocation.reserve methodHelmut Grohne
Allow reserving a particular range instead of allocating a suitable large range of an IDAllocation. This is useful when a directory hierarchy defines the allocation and we merely want to verify it to be assigned.
2024-05-25add a FileDescriptor typeHelmut Grohne
It serves two main purposes. For one thing, it allows telling bare integers and file descriptors apart on a typing level similar to a NewType. For another it adds common methods to a file descriptor and enables closing it via a context manager.
2024-05-20add an asyncio waitid(P_PIDFD, ...) helperHelmut Grohne
2024-05-20add function async_copyfdHelmut Grohne
It is a bit like an async version of shutil.copyfileobj but for bare file descriptors and has an optimized version for pipes.
2024-05-17populate_dev: also create std{in,out,err} symlinksHelmut Grohne
When booting systemd, it'll create these symlinks, but when doing an application container, nothing does this and we risk creating regular files there.
2024-04-04add function populate_procHelmut Grohne
2024-04-04document security implications of populate_* functionsHelmut Grohne
2024-04-02a few formatting and typo fixesHelmut Grohne
2024-03-16add an asyncio variant of run_in_forkHelmut Grohne
2024-03-14rename AtLocation.symlink to symlink_toHelmut Grohne
This mirrors what was done for pathlib.Path to avoid confusion about argument order.
2024-03-01fix read-only bind_mountHelmut Grohne
As we learn from util-linux, MS_RDONLY is ignored on MS_BIND. Rather than remount, just use the new mount API as it doesn't suffer this limitation.
2024-02-25spell checkHelmut Grohne
2024-02-24populate_dev: remove assumption that newdev does not shadow origdevHelmut Grohne
In particular, one can now pass newdev = origdev.
2024-02-23delete unused importsHelmut Grohne
2024-02-21fix logic error in populate_sysHelmut Grohne
Fixes: 1de72653e0b9 ("add function linuxnamespaces.populate_sys")
2024-02-21improve error handling in linuxnamespaces.populate_devHelmut Grohne
2024-02-21add function linuxnamespaces.populate_sysHelmut Grohne
2024-02-21revoke the false promise that bytes would be convertible to PathHelmut Grohne
pathlib.Path(somebytes) fails. Hence bytes is not actually convertible and should not be included in PathConvertible. Then, we can simplify matters in quite a few places by knowing that the thing we work with is not bytes.
2024-01-25linuxnamespaces.run_in_fork: use os._exit instead of sys.exitHelmut Grohne
When using sys.exit, we actually raise a SystemExit exception and as a consequence exit all context managers. If a particular context manager pertains only the process at hand, we don't really care, because our process is supposed to vanish. If a context manager changes external state such as tempfile.NamedTemporaryFile, this is very bad and unexpected. We need to ensure that such cleanup is not performed. This also simplifies the test suite that had to emulate this behaviour already as pytest uses a context manager.
2024-01-22provide default for IDAllocation.allocation map arg targetHelmut Grohne
Most frequently, the root user is allocated.
2024-01-19add convenience function unshare_user_idmap_nohelperHelmut Grohne
2024-01-18initial checkinHelmut Grohne