From ee526dbf016650ae5d8a0914372a021dc330dda0 Mon Sep 17 00:00:00 2001 From: Daniel Golle Date: Sun, 13 Sep 2026 22:43:08 +0100 Subject: [PATCH] procd: update to git HEAD of 2026-09-13 Various fixes and improvements in procd/ujail/uxc to better support the use of ujail and uxc as container runtime environments, now compliant with the OCI run-time spec version 1.3.0. Also brings basic udebug tracing support and replaces the seccomp preload libraries with a ucode implementation: procd-seccomp ships trace2seccomp plus its utrace and seccomp-trace aliases and needs only ucode and its fs module, while the OCI seccomp code now links into ujail. uxc installs the new uxc-net and uxc-stack helpers and depends on the ucode modules they use, and on odhcpd, which serves RA, DHCPv6 and DHCPv4 on container networks. Adjacent changes in firewall4, netifd and odhcpd still have to find their way into the tree for dynamically addressed native uxc containers to be fully functional. Signed-off-by: Daniel Golle --- package/system/procd/Makefile | 30 +++++---- package/system/procd/files/uxc.init | 15 ++++- package/system/procd/files/uxc.sh | 96 +++++++++++++++++++++++++++++ 3 files changed, 126 insertions(+), 15 deletions(-) create mode 100644 package/system/procd/files/uxc.sh diff --git a/package/system/procd/Makefile b/package/system/procd/Makefile index 1603c891315..14610a598bb 100644 --- a/package/system/procd/Makefile +++ b/package/system/procd/Makefile @@ -12,9 +12,9 @@ PKG_RELEASE:=1 PKG_SOURCE_PROTO:=git PKG_SOURCE_URL=$(PROJECT_GIT)/project/procd.git -PKG_MIRROR_HASH:=bd9e510b303b58f1edb1bfc4629e523f9a96c80a5b66cf5c972f9245bfec5596 -PKG_SOURCE_DATE:=2026-06-17 -PKG_SOURCE_VERSION:=60fdbf00e924fff0a510c4ec31c520d35e69bfe1 +PKG_MIRROR_HASH:=8ce832e630f4b62382b997156af3ca947602297b0f9158eb068ab205f5506cbf +PKG_SOURCE_DATE:=2026-09-13 +PKG_SOURCE_VERSION:=0df1972a90e3316a9e2319ea8b606e89f700b360 CMAKE_INSTALL:=1 PKG_LICENSE:=GPL-2.0 @@ -65,21 +65,21 @@ define Package/procd-ujail SECTION:=base CATEGORY:=Base system DEPENDS:=@KERNEL_NAMESPACES +@KERNEL_UTS_NS +@KERNEL_IPC_NS +@KERNEL_PID_NS \ - +libubox +libubus +libuci +libblobmsg-json + +libubox +libubus +libuci +libblobmsg-json +libudebug TITLE:=OpenWrt process jail helper endef define Package/procd-seccomp SECTION:=base CATEGORY:=Base system - DEPENDS:=@USE_SECCOMP +libubox +libblobmsg-json - TITLE:=OpenWrt process seccomp helper + utrace + DEPENDS:=@USE_SECCOMP +ucode +ucode-mod-fs + TITLE:=OpenWrt process seccomp helper + trace2seccomp endef define Package/uxc SECTION:=base CATEGORY:=Base system - DEPENDS:=+procd-ujail +libubus +libubox +libblobmsg-json +blockd +PACKAGE_uxc:rpcd + DEPENDS:=+procd-ujail +libubus +libubox +libblobmsg-json +blockd +odhcpd +ucode +ucode-mod-fs +ucode-mod-ubus +ucode-mod-uci +ucode-mod-uloop +PACKAGE_uxc:rpcd TITLE:=OpenWrt container management MAINTAINER:=Daniel Golle endef @@ -130,11 +130,10 @@ define Package/procd-ujail/install endef define Package/procd-seccomp/install - $(INSTALL_DIR) $(1)/sbin $(1)/lib - $(INSTALL_DATA) $(PKG_INSTALL_DIR)/usr/lib/libpreload-seccomp.so $(1)/lib - $(INSTALL_BIN) $(PKG_INSTALL_DIR)/usr/sbin/utrace $(1)/sbin/ - $(LN) utrace $(1)/sbin/seccomp-trace - $(INSTALL_DATA) $(PKG_INSTALL_DIR)/usr/lib/libpreload-trace.so $(1)/lib + $(INSTALL_DIR) $(1)/sbin + $(INSTALL_BIN) $(PKG_INSTALL_DIR)/usr/sbin/trace2seccomp $(1)/sbin/ + $(LN) trace2seccomp $(1)/sbin/utrace + $(LN) trace2seccomp $(1)/sbin/seccomp-trace endef define Package/uxc/conffiles @@ -142,10 +141,15 @@ define Package/uxc/conffiles endef define Package/uxc/install - $(INSTALL_DIR) $(1)/sbin + $(INSTALL_DIR) $(1)/sbin $(1)/usr/share/uxc $(INSTALL_BIN) $(PKG_INSTALL_DIR)/usr/sbin/uxc $(1)/sbin/ + $(INSTALL_BIN) $(PKG_INSTALL_DIR)/usr/sbin/uxc-net $(1)/sbin/ + $(INSTALL_BIN) $(PKG_INSTALL_DIR)/usr/sbin/uxc-stack $(1)/sbin/ + $(INSTALL_DATA) $(PKG_INSTALL_DIR)/usr/share/uxc/uxc-stack.uc $(1)/usr/share/uxc/ $(INSTALL_DIR) $(1)/etc/init.d $(INSTALL_BIN) ./files/uxc.init $(1)/etc/init.d/uxc + $(INSTALL_DIR) $(1)/lib/functions + $(INSTALL_DATA) ./files/uxc.sh $(1)/lib/functions/ endef $(eval $(call BuildPackage,procd)) diff --git a/package/system/procd/files/uxc.init b/package/system/procd/files/uxc.init index 0b51925a719..5c696731c7e 100644 --- a/package/system/procd/files/uxc.init +++ b/package/system/procd/files/uxc.init @@ -6,11 +6,22 @@ NAME=uxc PROG=/sbin/uxc start_service() { + local ready + + ready=$(ubus call block status 2>/dev/null | jsonfilter -e '@.ready') + [ "$ready" = "true" ] || return 0 + procd_open_instance "uxc" procd_set_param command "$PROG" boot procd_close_instance } -service_triggers() { - procd_add_raw_trigger "mount.add" 3000 /etc/init.d/uxc start +reload_service() { + "$PROG" boot +} + +service_triggers() { + procd_add_raw_trigger "mount.ready" 250 /etc/init.d/uxc reload + procd_add_raw_trigger "mount.add" 250 /etc/init.d/uxc reload + procd_add_raw_trigger "uxc.bringup" 250 /etc/init.d/uxc reload } diff --git a/package/system/procd/files/uxc.sh b/package/system/procd/files/uxc.sh new file mode 100644 index 00000000000..534a1ac3ad6 --- /dev/null +++ b/package/system/procd/files/uxc.sh @@ -0,0 +1,96 @@ +# uxc container package-hook helpers, sourced by the install scripts of +# container- and stack- packages. + +UXC_STOP_WAIT=15 + +uxc_preinst() { + local name="$1" newvol="$2" newsize="$3" + local reg="/tmp/run/uvol/.meta/uxc/$name.json" + local oldvol free i + + [ -n "$IPKG_INSTROOT" ] && return 0 + + if [ ! -L /tmp/run/uvol/.meta ]; then + echo "uxc: cannot install '$name': the uvol metadata volume is not mounted at /tmp/run/uvol/.meta" >&2 + echo "uxc: no usable uvol backend; install 'autopart' (block), or provision an LVM VG / UBI space for uvol" >&2 + return 1 + fi + + [ -f "$reg" ] || return 0 + + oldvol="$(sed -n 's|.*"path"[: ]*"/tmp/run/uvol/\([^"]*\)".*|\1|p' "$reg")" + [ -z "$oldvol" ] && return 0 + [ "$oldvol" = "$newvol" ] && return 0 + + uxc kill "$name" KILL 2>/dev/null + i=0 + while [ "$i" -lt "$UXC_STOP_WAIT" ] && uxc list 2>/dev/null | grep -qE "^$name[[:space:]].*[[:space:]]running"; do + sleep 1 + i=$((i + 1)) + done + + free="$(uvol free 2>/dev/null)" + if [ -n "$free" ] && [ -n "$newsize" ] && [ "$free" -lt "$newsize" ]; then + uvol down "$oldvol" 2>/dev/null + uvol remove "$oldvol" 2>/dev/null + fi + + return 0 +} + +uxc_postinst() { + local name="$1" + + [ -n "$IPKG_INSTROOT" ] && return 0 + uxc create "$name" 2>/dev/null + uxc start "$name" 2>/dev/null + + return 0 +} + +uxc_prerm() { + local name="$1" + + [ -n "$IPKG_INSTROOT" ] && return 0 + uxc kill "$name" 2>/dev/null + + return 0 +} + +uxc_postrm() { + local name="$1" left + + [ -n "$IPKG_INSTROOT" ] && return 0 + + rm -rf "/tmp/run/uvol/.meta/uxc/state/$name" "/tmp/run/uvol/.meta/uxc/settings/$name.json" + + left="$(uvol list 2>/dev/null | while read -r vn rest; do + case "$vn" in "$name"|"$name".*) echo "$vn";; esac + done)" + [ -z "$left" ] && return 0 + + echo "container '$name' removed; persistent data volumes were kept. To delete this data, run:" >&2 + echo "$left" | sed 's/^/ uvol remove /' >&2 + + return 0 +} + +# The $IPKG_INSTROOT guards live in this file rather than in an +# in-Makefile define, where make eats the dollar sign. +uxc_stack_postinst() { + local app="$1" + + [ -n "$IPKG_INSTROOT" ] && return 0 + uxc-stack up "$app" + + return 0 +} + +uxc_stack_prerm() { + local app="$1" + + [ -n "$IPKG_INSTROOT" ] && return 0 + uxc-stack down "$app" + + return 0 +}