A large number of generic procd, ujail and container related fixes and
improvements. See https://git.openwrt.org/project/procd/log/ for the
detailed history since commit 6a22d39648.
uxc keeps the per-run files of a container, the last exit record, the
generated environment file and the resources override, in
/tmp/run/uxc/<name>/. The pre-remove hook only stops a package
container and deletes it from procd, so that directory stays behind
until the next reboot. Remove it in the post-remove hook together with
the state and settings of the container.
When a container package is upgraded to a new image, the pre-install
hook only signals the old container and leaves its instance in procd.
The bring-up after the install then adds the container with once, which
procd refuses for a container it already has, so the new image starts
only after the next reboot.
Delete the old container in the pre-install hook, as the pre-remove hook
does. uxc kill without a signal returns once the container has stopped,
procd forgets a deleted container, and the bring-up starts the new
image.
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
457721d7544d jail: drop the deferred path's own mount-propagation remount
66a33c82f755 jail: keep locked flags on phase-2 read-only remounts
0925850d765b jail: keep locked flags when remounting a noafile mask
ac855770e3b2 jail: apply root_map_uid to a joined user namespace
7f1b26ce3759 jail: join an external userns after build_jail_fs()
88fe395b2cd5 jail: fail on an unresolvable -j specification
638c2ecfaf8a jail: let a joined namespace replace the created one
56e1a2032e0d jail: factor out the MS_* to MOUNT_ATTR_* translation
8c9df2b8ae32 jail: mount sysfs in the parent when the jail lacks a netns
4021843627a4 jail: log a failing mask mount
fa1f24c84ce7 jail: drop all capabilities for a bundle that names none
5670ff93498d uxc: report every failure with one exit status
6a22d3964822 service: add per-instance 'vrf' option
Allow to set the new 'vrf' instance option with procd_set_param. It
binds all sockets of a service to a VRF device, like 'ip vrf exec':
procd_set_param vrf <dev>
Assisted-by: Claude:claude-opus-5-5
Assisted-by: Claude:claude-fable-5-1
Link: https://github.com/openwrt/openwrt/pull/25568
Signed-off-by: Nick Hainke <vincent@systemli.org>
The audio group and the rule that puts the ALSA character devices in it
are part of procd and base-files, so every image carries them whether or
not it has a sound card, and a package wanting the group has nothing to
depend on. Playback, capture and MIDI all land in one group as well, so a
process allowed to play is also allowed to record.
Move the lot into a new audio-support package with three groups, audio,
audio-capture and midi, and a hotplug fragment that sorts the sound nodes
between them. kmod-sound-core depends on the package, and so do the image
profiles that ship a sound driver. The dependency is a plain one, not a
select, so sound support is offered once the feature is chosen; userspace
that needs one of the groups depends on the same package. Images without
it fall back to the generic rule and get /dev/snd/* as 0600 root:root.
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
The hotplug rules live in a single /etc/hotplug.json, so a package
that needs a device node named, owned or grouped its own way has no
way to contribute one; the alternatives are patching the shared file
or falling back to a shell script under /etc/hotplug.d.
Load /etc/hotplug.json.d/*.json from inside the device node branch,
ahead of the built-in name rules, and /etc/hotplug-preinit.json.d/*
at the end of the preinit script. Fragments are run in sorted order.
A fragment that creates a node keeps it: the generic rule below still
runs, but its mknod() fails with EEXIST and leaves the node alone.
This is done in preparation for deprecating some of the subtarget-wide
FEATURES flags, instead introducing feature-umbrella packages such as
`video-support` and `audio-support` shipping the hotplug rule snippets
and having all providers (ie. kmods) and users depend on them.
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
Add missing syscall names needed on 32-bit platforms to the pre-main
pre-main syscall allowlists.
Fixes: #25392
Fixes: ee526dbf01 ("procd: update to git HEAD of 2026-09-13")
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
The new seccomp rework broke builds on ARMv4 which doesn't have Thumb
support. Fix it.
c230ad87 jail: skip Thumb injection on cores without Thumb state
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
procd-ujail is not selected on targets without the required kernel
namespace support, but its shared architecture package can still be
installed there.
When the package is carried across an upgrade or installed later, jailed
services fail to start because clone() returns EINVAL.
Keep procd-ujail in target-specific package repositories so it is not
offered on incompatible targets.
Fixes: #22428
Signed-off-by: Dharmik Parmar <dharmikparmar2004@yahoo.com>
Various fixes and improvements in procd/ujail/uxc to better support
the use of ujail and uxc as container runtime environments, now
compliant with the OCI run-time spec version 1.3.0.
Also brings basic udebug tracing support and replaces the seccomp
preload libraries with a ucode implementation: procd-seccomp ships
trace2seccomp plus its utrace and seccomp-trace aliases and needs only
ucode and its fs module, while the OCI seccomp code now links into
ujail. uxc installs the new uxc-net and uxc-stack helpers and depends
on the ucode modules they use, and on odhcpd, which serves RA, DHCPv6
and DHCPv4 on container networks.
Adjacent changes in firewall4, netifd and odhcpd still have to find
their way into the tree for dynamically addressed native uxc
containers to be fully functional.
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
9ff6e43bb75f service: notify instance exit details via ubus
4f42296dc4f0 jail: mount rootfs overlay with userxattr in user namespace
60fdbf00e924 jail: chown rootfs overlay dir to mapped root in user namespace
Signed-off-by: Felix Fietkau <nbd@nbd.name>
ac5cc72f6cfa jail: mount ucode related bits into netifd jail
81119d3f249d instance: disable console logging
8013c0cd2755 jail: mount tools used by dhcp.sh in the netifd jail
876981d0516d jail: fix reading the oci device gid value
c92dbcd460d7 jail: make /dev/tty accessible by others
74bfbee8adb8 service: fix calloc_a argument
Signed-off-by: Felix Fietkau <nbd@nbd.name>
58eb263 instance: don't print error in case cgroups are disabled
9baf019 instance: use positive error numbers for strerror()
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
180ffcc instance: use mkdir_p helper
9493a3d signal: handle SIGUSR1 as halt
4dd22d0 cgroups: fix syntax error
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
7e5b324 instance: check length of names when creating cgroups
014f94c procd: jail/cgroups: fix OOB write in cgroups_apply()
e08cdc8 hotplug-dispatch: fix filter disallowing setting PATH
afa4391 service instance: Improve handling of watchdog config changes
52c64d2 service instance: Fix overwriting of watchdog linked list members
96c827f coldplug: fix missing header include
6b10c71 hotplug-dispatch: fix missing header include
58d7aaa initd/coldplug: create /dev/null before running udevtrigger
64f97ff hotplug-dispatch: redirect output to /dev/null
c4e9859 hotplug-dispatch: use stat if d_type is DT_UNKNOWN
bafdfff system: fix arguments validation in ubus handler
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
Some packages with variants did not specify the default among the
alternatives, so were left without any apk 'provider_priority'
for that package. This caused the apk solver to select the wrong
variant, silently changing the requested package list.
Notable among these were busybox, procd and the hostapd/wpad suite.
This behavior presented in the imagebuilders when creating the
image as follows, silently replacing packages even when explicitly
requested:
$ make image PACKAGES=busybox
...
( 14/148) Installing busybox-selinux (1.37.0-r6)
...
We add 'DEFAULT_VARIANT:=1' to the packages that were missing one,
providing apk with sufficient information to choose the correct
package.
See link below for further examples and discussion.
Link: https://github.com/openwrt/openwrt/pull/21288#issuecomment-3704101422
Signed-off-by: Eric Fahlgren <ericfahlgren@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/21358
Signed-off-by: Robert Marko <robimarko@gmail.com>
84372dab89a8 hotplug: switch to using avl tree for hotplug subsystems
4d023b8a8c51 hotplug: send event notifications
467800980021 hotplug: ensure that the button subsystem is always registered
Signed-off-by: Felix Fietkau <nbd@nbd.name>
2e206dbe77ec service: add support for triggers on service/instance data changes
735b48728fca service: remove leftover lines from previous commit
32469644a029 service: allow incremental changes to service properties
fd01fb852302 service: fix double free bug when dealing with data
Signed-off-by: Felix Fietkau <nbd@nbd.name>
e2f05de state: set_stdio: chdir back to / in case of failure
30542c9 inittab: Disable implicit controlling TTY.
Signed-off-by: John Crispin <john@phrozen.org>
It seems that we have some kind of a symbol name conflict which causes
CONFIG_SECCOMP to always be read as y.
Unfortunatelly, I could not figure out what is causing this, but simply
renaming SECCOMP to USE_SECCOMP seems to properly work and leaves the
symbol unset unless arch dependencies are satisfied.
This fixes qoriq and others that dont support seccomp from failing due
to procd-seccomp package being selected to get included but it cannot be
built for them:
ERROR: unable to select packages:
procd-seccomp (no such package):
required by: base-files-1637~52b6c92479[procd-seccomp]
Fixes: 4c65359af4 ("build: fix including busybox, procd and apk/opkg in imagebuilder")
Link: https://github.com/openwrt/openwrt/pull/17048
Signed-off-by: Robert Marko <robimarko@gmail.com>
7330fa5 initd: mount /sys and /proc with MS_RELATIME
Fixes mounting /proc in unpriviledged user namespace.
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
Since the image builder pulls package lists from metadata directly,
add procd and busybox as depdendencies to base-files.
As for the package manager itself, since it can be disabled it needs
to be added directly in the image builder makefile
Fixes: 44598c233d ("build: remove broken dependency of metadata on toplevel .config variables")
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Instead of relying on .config symbols for metadata, alter the DEFAULT
variable of affected packages. Fixes enabling opkg vs apk among others.
Signed-off-by: Felix Fietkau <nbd@nbd.name>
When using zst instead of xz, the hash changes. This commit fixes the
hash for packages and tools in core.
Signed-off-by: Paul Spooren <mail@aparcar.org>
254810d16cf1 watchdog: always close fd on watchdog stop
946552a7b598 trace: use standard POSIX header for basename()
Signed-off-by: Robert Marko <robimarko@gmail.com>
79f8cfa58ee7 ci: add github test workflow
428f40e7984f test commit fixing warnings
63058d1f81a5 ci: enable ujail builds
49ea930a862c utils: add key-value offset support to get_cmdline_val()
ca8c30208d5e inittab: fallback when multiple "console=" is detected
Required for the recent Elecom multiple console commits.
Signed-off-by: Robert Marko <robimarko@gmail.com>
Different from OPKG, APK uses a deterministic version schema which chips
the version into chunks and compares them individually. This enforces a
certain schema which was previously entirely flexible.
- Releases are added at the very and end prefixed with an `r` like
`1.2.3-r3`.
- Hashes are prefixed with a `~` like `1.2.3~abc123`.
- Dates become semantic versions, like `2024.04.01`
- Extra tags are possible like `_git`, `_alpha` and more.
For full details see the APK test list:
https://gitlab.alpinelinux.org/alpine/apk-tools/-/blob/master/test/version.data
Signed-off-by: Paul Spooren <mail@aparcar.org>
d852f877920b service: Fix retriggering of init.d-scripts.
7e6c6efd6fbc udebug: add support for logging via udebug
Signed-off-by: Felix Fietkau <nbd@nbd.name>
This is needed for ksh/bash style process substitution such as
<(command) and >(command) which was introduced in ash as of busybox
version 1.34.0 to work.
Signed-off-by: Erik Karlsson <erik.karlsson@genexis.eu>
The existing implementation incorrectly reported `running` for services
without any instances or with all instances stopped/terminated.
Improve the default implementation of `/etc/init.d/* status` to properly
report services with not running instances. In case a service exists,
but without running instance, the status call will now report
"not running" with exit code 5. In case some instances are running and
some are stopped/terminated, the call will report "running (X/Y)" where
`X` denoted the amount of running instances and `Y` the amount of total
registered ones.
Ref: https://forum.openwrt.org/t/x/159443
Signed-off-by: Jo-Philipp Wich <jo@mein.io>
This reduces open coding and allows to easily add a knob to enable
it treewide, where chosen packages can still opt-out via "no-lto".
Some packages used LTO, but not the linker plugin. This unifies 'em
all to attempt to produce better code.
Quoting man gcc(1):
"This improves the quality of optimization by exposing more code to the
link-time optimizer."
Also use -flto=auto instead of -flto=jobserver, as it's not guaranteed
that every buildsystem uses +$(MAKE) correctly.
Signed-off-by: Andre Heider <a.heider@gmail.com>
04d7570 jail: fs: don't overwrite existing mount target
6b9629b jail: don't assume positive return value of creat
190f13a init: attempt to mount efivarfs
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
Daniel Golle
Gary Dotzler
Nick Hainke
Dharmik Parmar
Felix Fietkau
Paul Spooren
Nora Schiffer
Eric Fahlgren
Christian Marangi
Hauke Mehrtens
John Crispin
Robert Marko
Erik Karlsson
Jo-Philipp Wich
Andre Heider