Back to the news overview

LXC 3.0.4 has been released¶

21.06.2019

Introduction¶

The LXC team is pleased to announce the release of LXC 3.0.4!

As a stable bugfix release, no major changes have been done, instead focusing on bugfixes and minor usability improvements.

Highlights¶

Fix for runC CVE-2019-5736¶

This release comes with a fix for the privileged container breakout discovered earlier this year. As per our policy we don't consider privileged containers root safe and thus LXC as not received a CVE for this. However, we still provide a fix in this release. For more details see this blog post.

Prefix veth interface names with caller's uid¶

To make it easier for users to inspect veth devices LXC will now prefix the uid of the caller for the host veth device.

Improve using LXC on Android devices¶

This makes LXC look for standard tools in locations such as /system/bin that are specific to Android.
Additionally, it is now possible to correctly allocate loop devices on Android.

Backport all compiler hardening options which are standard on current master.¶

This backports:

-fdiagnostics-color
-Wimplicit-fallthrough=5
-Wcast-align
-Wstrict-prototypes
-fno-strict-aliasing
-fstack-clash-protection
-fstack-protector-strong
--param=ssp-buffer-size=4
-g
--mcet -fcf-protection
-Werror=implicit-function-declaration
-Wlogical-op
-Wmissing-include-dirs 
-Wold-style-definition
-Winit-self
-Wfloat-equal
-Wsuggest-attribute=noreturn
-Werror=return-type
-Werror=incompatible-pointer-types
-Wformat=2
-Wshadow
-Wendif-labels
-Werror=overflow
-fdiagnostics-show-option
-Werror=shift-count-overflow
-Werror=shift-overflow=2
-Wdate-time
-Wnested-externs
-fasynchronous-unwind-tables
-pipe
-fexceptions
-z relro
-z now

Remove all stack allocation (alloca())¶

As is already the case on master, all stack allocations via alloca() have been wiped from the codebase to increase security.

Added support for LGTM¶

This adds support for the LGTM code quality checker.

Add support for coccinelle code transformation tool¶

This allows us to automatically detect, remove, or add code to the LXC codebase to improve security and reliability.

Compiler based resource cleanup¶

The codebase will be slowly switched over to make user of cleanup attributes supported by compilers such as gcc and clang.

Remove fgets() from the codebase¶

To improve security all uses of fgets() have been removed from the codebase. Use of this function in new code is strongly discouraged.

Improve cgroup2 handling¶

With this release cgroup2 layouts will be better supported.

Setup lxc.mount.entry right after lxc.mount.fstab¶

This allows us to unify the mounting logic in LXC.

Expand namespace sharing options¶

When inheriting a namespace a pathname to a namespace file descriptor can now be specified.

Expand close-on-exec usage¶

All file descriptors that can be made close-on-exec are now close-on-exec.

Support pidfd api¶

Newer kernel versions allow interaction with processes through process file descriptors (pidfds). This eliminates various race conditions when e.g. sending signals or retrieving process information. This LXC version make use of the pidfd_send_signal() syscall and the CLONE_PIDFD flag with the clone() syscall.

Bugfixes (LXC)¶

• Fix cgroup deletion by not prematurely freeing the path to delete
• Fix lxc-usernsexec when falling back to the default id mapping
• Fix building LXC when the stack-protector option is not supported by the compiler
• Remove various unused functions from the codebase
• Make sure that lxc-cgroup gives output in all relevant cases
• Remove the handler for the SIGWINCH signal from the internal command handler since this is now handled via signalfd
• Fix copying containers by stripping the storage type prefix from the target path
• Ensure that veth device names can container all ASCII alphabetical characters
• Fix Android builds
• Handle kernels that do not support CLONE_NEWCGROUP
• Free memory used to record inherited namespaces
• Remove various deprecated headers
• Ensure lxc-init reports error in all failure paths
• Make various functions static
• Improve setting the parent death handling
• Fix network device removal
• Update zfs storage backend to new zfs tool syntax
• Fix vlan device handling through upscripts
• Dynamically allocate a stack for clone() and use standard 8MB stack size
• Improve static linking
• Ensure that the cgroup.mems value of the correct ancestor is initialized in the cpuset cgroup

Full commit list:

Bugfixes (LXC templates)¶

• Add new dependency for wget for lxc-slackware template
• plamo: Workaround for building plamo 32bit 6.x container on current 7.x
• plamo: Support https as download scheme and default to https

Bugfixes (python3 binding)¶

• No changes in this release, version bump only

Support and upgrade¶

LXC 3.0.4 is supported until June 2023 and is our current LTS release, users are encouraged to update to the latest bugfix releases as they're made available.

Downloads¶

• Main release tarball: lxc-3.0.4.tar.gz (GPG: lxc-3.0.4.tar.gz.asc)
• LXC templates tarball: lxc-templates-3.0.4.tar.gz (GPG: lxc-templates-3.0.4.tar.gz.asc)
• LXC python3 bindings tarball: python3-lxc-3.0.4.tar.gz (GPG: python3-lxc-3.0.4.tar.gz.asc)