[libvirt] [PATCH 2 of 2] [LXC] Create and enter the cgroup before starting container process

[Dan Smith]

Without this, our container child doesn't actually end up in the cgroup,
and thus runs unrestricted.  Note that this does not address the container's
ability to mount cgroup and move itself into the parent namespace.

While making this change, it became clear that we need to allow access to
the entire range of pty devices for the container console to work.  This
patch adds that logic as well.

diff -r 48a9209668ab -r 4babf77ec518 src/lxc_container.h
--- a/src/lxc_container.h	Thu Oct 16 14:01:13 2008 -0700
+++ b/src/lxc_container.h	Thu Oct 16 14:01:13 2008 -0700
@@ -40,6 +40,8 @@
 #define LXC_DEV_MAJ_TTY     5
 #define LXC_DEV_MIN_CONSOLE 1
 
+#define LXC_DEV_MAJ_PTY     136
+
 int lxcContainerSendContinue(int control);
 
 int lxcContainerStart(virDomainDefPtr def,
diff -r 48a9209668ab -r 4babf77ec518 src/lxc_controller.c
--- a/src/lxc_controller.c	Thu Oct 16 14:01:13 2008 -0700
+++ b/src/lxc_controller.c	Thu Oct 16 14:01:13 2008 -0700
@@ -102,6 +102,10 @@
         if (rc != 0)
             goto out;
     }
+
+    rc = virCgroupAllowDeviceMajor(cgroup, 'c', LXC_DEV_MAJ_PTY);
+    if (rc != 0)
+        goto out;
 
     rc = virCgroupAddTask(cgroup, getpid());
 out:
@@ -449,6 +453,9 @@
         goto cleanup;
     }
 
+    if (lxcSetContainerResources(def) < 0)
+        goto cleanup;
+
     if ((container = lxcContainerStart(def,
                                        nveths,
                                        veths,
@@ -459,9 +466,6 @@
     control[1] = -1;
 
     if (lxcControllerMoveInterfaces(nveths, veths, container) < 0)
-        goto cleanup;
-
-    if (lxcSetContainerResources(def) < 0)
         goto cleanup;
 
     if (lxcContainerSendContinue(control[0]) < 0)