Merge lp:~morphis/lxc-android-config/share-ipc-ns-with-host into lp:lxc-android-config/15.04

[Simon Fels]

Tell LXC to let the android container share the IPC namespace with host

With upcoming namespace support for binder which will then be handled
with the IPC namespace we need to make sure the host can still
communicate with the device enablement Android container. Otherwise
the Android container will get its own binder namespace and can't
talk with the host anymore.

Tell LXC to let the android container share the IPC namespace with host

With upcoming namespace support for binder which will then be handled
with the IPC namespace we need to make sure the host can still
communicate with the device enablement Android container. Otherwise
the Android container will get its own binder namespace and can't
talk with the host anymore.

[Konrad Zapałowicz (kzapalowicz)]

LGTM

review: Approve (code)

[Oliver Grawert (ogra)]

did you have anyone from the security team glance over this featue ? (just to make sure there are no giant security holes ripped out of the blue i remember binder always being a very sore point for them)

[Simon Fels (morphis)]

@ogra: Now. This is just for the time being. We didn't agreed yet that we will go forward with this or not.

review: Needs Fixing

Unmerged revisions

21. By Simon Fels on 2016-07-12

Use host IPC namespace for Android container

=== modified file 'debian/lxc-android-config.upstart'
--- debian/lxc-android-config.upstart	2015-09-02 07:50:44 +0000
+++ debian/lxc-android-config.upstart	2016-07-12 13:24:25 +0000
@@ -11,7 +11,7 @@
 
 console none
 
-exec lxc-start -n android -F -- /init
+exec lxc-start -n android -F --share-ipc 1 -- /init
 
 post-start script
     if [ ! -d /dev/cpuctl ] && [ -d /sys/fs/cgroup/cpu ]; then