tools/lxc_usernsexec: removed internal logging

Signed-off-by: AustinReichert <austinskyreichert@utexas.edu>

tools/lxc_unshare: removed internal logging

Signed-off-by: AustinReichert <austinskyreichert@utexas.edu>

tools/lxc_unfreeze: removed internal logging

Signed-off-by: AustinReichert <austinskyreichert@utexas.edu>

tools/lxc_top: removed internal logging

Signed-off-by: AustinReichert <austinskyreichert@utexas.edu>

tools/lxc_stop: removed internal logging

Signed-off-by: AustinReichert <austinskyreichert@utexas.edu>

tools/lxc_start: removed internal logging

Signed-off-by: AustinReichert <austinskyreichert@utexas.edu>
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

tools/lxc_snapshot: removed internal logging

Signed-off-by: AustinReichert <austinskyreichert@utexas.edu>

tools/lxc_monitor: removed internal logging

Signed-off-by: AustinReichert <austinskyreichert@utexas.edu>

tools/lxc_copy: remove internal logging

Signed-off-by: AustinReichert <austinskyreichert@utexas.edu>

tools/lxc_ls: remove internal logging

Signed-off-by: AustinReichert <austinskyreichert@utexas.edu>

btrfs: fix btrfs_snapshot()

Closes #1956.

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Signed-off-by: Adrian Reber <areber@redhat.com>

storage: constify where possible

This was made necessary by changes to the overlay driver.

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Signed-off-by: Adrian Reber <areber@redhat.com>

storage: remove unused declaration

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Signed-off-by: Adrian Reber <areber@redhat.com>

storage: make storage_copy() cleaner

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Signed-off-by: Adrian Reber <areber@redhat.com>

lxccontainer: various container creation fixes

This is beneficial for LXD as well.

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Signed-off-by: Adrian Reber <areber@redhat.com>

storage: make storage_init() smart and simplify

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Signed-off-by: Adrian Reber <areber@redhat.com>

storage: make storage_dir() smart

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Signed-off-by: Adrian Reber <areber@redhat.com>

loop: adapt to new config rootfs parser

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Signed-off-by: Adrian Reber <areber@redhat.com>

overlay: adapt to new config rootfs parser

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Signed-off-by: Adrian Reber <areber@redhat.com>

storage: pass down storage type

The configuration file parser now already detects the storage type so spare the
work and pass it down to the storage drivers.

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Signed-off-by: Adrian Reber <areber@redhat.com>

confile: parse storage type

Split lxc.rootfs.path = <storage type>:<container path> into <storage-type> and
<container path> to set the storage type and rootfs path value correctly.

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Signed-off-by: Adrian Reber <areber@redhat.com>

criu: detect veth name

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Signed-off-by: Adrian Reber <areber@redhat.com>

tools/lxc_info: removed internal logging

Signed-off-by: AustinReichert <austinskyreichert@utexas.edu>

tools/lxc_freeze: remove internal logging

Signed-off-by: AustinReichert <austinskyreichert@utexas.edu>

tools/lxc_execute: removed internal logging

Signed-off-by: AustinReichert <austinskyreichert@utexas.edu>

tools/lxc_device: remove internal logging

Signed-off-by: AustinReichert <austinskyreichert@utexas.edu>

tools/lxc_destroy: remove internal logging

Signed-off-by: AustinReichert <austinskyreichert@utexas.edu>

tools/lxc_create: remove internal logging

Signed-off-by: AustinReichert <austinskyreichert@utexas.edu>

tools/lxc_console: remove internal logging

Signed-off-by: AustinReichert <austinskyreichert@utexas.edu>

tools/lxc_clone: remove internal logging

Signed-off-by: AustinReichert <austinskyreichert@utexas.edu>

tools/lxc_autostart: remove internal logging

Signed-off-by: AustinReichert <austinskyreichert@utexas.edu>

tools/lxc_cgroup: remove internal logging

Signed-off-by: AustinReichert <austinskyreichert@utexas.edu>

utils.h: Avoid duplicated sethostname implementation

Move duplicated implementatin of sethostname from conf.c and
lxc_unshare.c to utils.h

Signed-off-by: Marcos Paulo de Souza <marcos.souza.org@gmail.com>

Use AX_PTHREAD config script to detect pthread api

Closes: #84
Signed-off-by: Marcos Paulo de Souza <marcos.souza.org@gmail.com>

start.c: always switch uid and gid

Signed-off-by: Yifeng Tan <tanyifeng1@huawei.com>
Reviewed-by: Christian Brauner <christian.brauner@ubuntu.com>

conf: move CAP_SYS_* definitions to utils.h

Closes #1946.

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Fixed typo on lxc.spec.in

Signed-off-by: David Negreira David@otherreality.net

confile: improve legacy update message

Closes #1938.

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

lxc-test-unpriv: check user existence before removing it

Check the test user (lxcunpriv) before calling deluser command,
otherwise it will print unnecessary error message:
/usr/sbin/deluser: The user 'lxcunpriv' does not exist.

Signed-off-by: Po-Hsu Lin <po-hsu.lin@canonical.com>

confile_utils: fix overlapping strncpy

In the case of "lxc.net.0.type", the pointers passed to strncpy were
only 2 elements apart, resulting in undefined behavior.

Signed-off-by: Felix Abecassis <fabecassis@nvidia.com>

lxc_init: set the control terminal in the child session

Signed-off-by: Jonathan Calmels <jcalmels@nvidia.com>

commands: fix state socket implementation

Remove dead state clients from state client list. Consider the following
scenario:

01 start container
02 issue shutdown request
03 state_client_fd is added to lxc_handler
03 container doesn't respond to shutdown request
04 user aborts shutdown request
05 lxc_cmd_fd_cleanup() removes state_client_fd from lxc_mainloop
06 invalid state_client_fd is still recorded in the lxc_handler
07 user issues lxc_cmd_stop() request via SIGKILL
08 container reaches STOPPED state and sends message to state_client_fd
09 state_client_fd number has been reused by lxc_cmd_stop_callback()
10 invalid data gets dumped to lxc_cmd_stop()

Reproducer:
Set an invalid shutdown signal to which the init system does not respond with a
shutdown via lxc.signal.halt e.g. "lxc.signal.halt = SIGUSR1". Then do:

1. start container
    root@conventiont|~
    > lxc-start -n a1

2. try to shutdown container
    root@conventiont|~
    > lxc-stop -n a1

3. abort shutdown
^C

4. SIGKILL the container (lxc.signal.stop = SIGKILL)
    root@conventiont|~
    > lxc-stop -n a1 -k
    lxc-stop: a1: commands.c: lxc_cmd_rsp_recv: 165 File too large - Response data for command "stop" is too long: 12641 bytes > 8192

To not let this happen we remove the state_client_fd from the lxc_handler when
we detect a cleanup event in lxc_cmd_fd_cleanup().

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

lxccontainer: non-functional changes

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

commands: non-functional changes

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

lvm: generate new UUID for xfs + btrfs filesystems

Closes #1909.

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

console: exit mainloop on SIGTERM

This allows cleanly exiting a console session without control sequences.

Relates to https://github.com/lxc/lxd/pull/4001 .

Note that the existence of a signal handler now doesn't guarantee that ts->node
is allocated. Instead, ts->node will now only be added to if stdinfd is a tty.
New checks need to take that into account.

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

console: prepare for generic signal handler

Non-functional changes to enable handling more signals.

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

console: use correct escape sequence check

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

lxccontainer: enable daemonized app containers

This enables daemonized application containers with our minimal init running as
pid one and the requested program running as second pid.

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

console: report detach message on demand

When users pass -1 there's there won't be an escape sequence to exit the
console so no need to print a misleading info message about how to detach.

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

cgroups/cgfsng: adapt to new cgroup2 delegation

In order to enable proper unprivileged cgroup delegation on newer kernels we not
just need to delegate the "cgroup.procs" file but also "cgroup.threads". But
don't report an error in case it doesn't exist. Also delegate
"cgroup.subtree_control" to enable delegation of controllers to descendant
cgroups.

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Add missing dependency libunistring

Hi,

I try to create a Slackware container in a Slackware64 14.2 current and
find that wget depends on libunistring.

So I add libunistring to the package list.

Closes #1915

Signed-off-by: Chia-Chun Hsu a12321aabb@gmail.com
Acked-by: Stéphane Graber <stgraber@ubuntu.com>

console: fix console info message

Now it will be displayed nicely formatted:

a1 login: chb@conventiont|~
> lxc console a1

Connected to tty 0
Type <Ctrl+a q> to exit the console, <Ctrl+a Ctrl+a> to enter Ctrl+a itself

Ubuntu 17.10 a1 console

a1 login:

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

tools/lxc_attach: removed api logging

Signed-off-by: Austin Reichert <austinskyreichert@utexas.edu>

attach: allow attach with empty conf

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

lxc-test-unpriv: fix the overlayfs mount error

This patch fixes the missing workdir issue for the overlayfs mount command in
the lxc-test-unpriv test.

link: https://bugs.launchpad.net/bugs/1730915
Signed-off-by: Po-Hsu Lin <po-hsu.lin@canonical.com>

console: non-functional changes

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

console: non-functional changes

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

commands: non-functional changes

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

config: remove SIGRTMIN+14 as lxc.signal.stop

We want to be able to SIGKILL an Archlinux container.

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

cgroupfs/cgfsng: improve cgroup2 handling

This fixes a bunch of bugs.

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

cgroups/cgfsng: fix get_controllers() for cgroup2

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

cgroups/cgfsng: remove is_lxcfs()

We don't need to parse fuse.lxcfs entries.

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

cgroupfs/cgfsng: tweak logging

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

log: check for i/o error with vsnprintf()

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

cgroups/cgfsng: support MS_READONLY with cgroup ns

If we lack CAP_SYS_ADMIN this is really useful.

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

cgroups/cgfsng: cgfsns_chown() -> cgfsng_chown()

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

cgroups/cgfsng: make sure pointer is NULL

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

cgroups/cgfsng: keep mountpoint intact

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

attach: handle namespace inheritance

We need to have lxc_attach() distinguish between a caller specifying specific
namespaces to attach to and a caller not requesting specific namespaces. The
latter is taken by lxc_attach() to mean that all namespaces will be attached.
This also needs to include all inherited namespaces.

Closes #1890.
Closes #1897.

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

tools: fix help output of lxc-create

Closes #1899.

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

storage: switch to ext4 as default filesystem

Closes #1899.

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

lxc/start.c: Fix legacy PR_{G,S}ET_NO_NEW_PRIVS handling

The configure checks for these use AC_CHECK_DECLS, which define the symbol
to 0 if not available - So adjust the code to match.  From the autoconf
manual:

https://www.gnu.org/software/autoconf/manual/autoconf-2.65/html_node/Generic-Declarations.html)

For each of the symbols (comma-separated list), define HAVE_DECL_symbol (in
all capitals) to ‘1’ if symbol is declared, otherwise to ‘0’.

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

conf: reap child in all cases

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

network: reap child in all cases

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

monitor: do not log useless warnings

lxc-monitord is deprecated so this is expected to fail.

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

start: close data socket in parent

Brings the number of open fds in the monitor process for a standard container
without ttys down to 17.

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

handler: make name argument const

There's no obvious need to strdup() the name of the container in the handler.
We can simply make this a pointer to the memory allocated in
lxc_container_new().

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

start: close non-needed file descriptors

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

lxc-start: remove unnecessary checks

The console struct is internal and liblxc takes care of creating paths.

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Fix compilation on toolchain without prlimit

Some toolchains which are not bionic like uclibc does not support
prlimit or prlimit64. In this case, return an error.
Moreover, if prlimit64 is available, use lxc implementation of prlimit.

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>

cgroups: enable container without CAP_SYS_ADMIN

In case cgroup namespaces are supported but we do not have CAP_SYS_ADMIN we
need to mount cgroups for the container. This patch enables both privileged and
unprivileged containers without CAP_SYS_ADMIN.

Closes #1737.

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

cgfsng: fix cgroup2 detection

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

attach: correctly handle namespace inheritance

When attaching to a container's namespaces we did not handle the case where we
inherited namespaces correctly. In essence, liblxc on start records the
namespaces the container was created with in the handler. But it only records
the clone flags that were passed to clone() and doesn't record the namespaces
we e.g. inherited from other containers. This means that attach only ever
attached to the clone flags. But this is only correct if all other namespaces
not recorded in the handler refer to the namespaces of the caller. However,
this need not be the case if the container has inherited namespaces from
another container. To handle this case we need to check whether caller and
container are in the same namespace. If they are, we know that things are all
good. If they aren't then we need to attach to these namespaces as well.

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Add missing lxc_container_put

Signed-off-by: Jordan Webb <jordemort@github.com>

Call lxc_config_define_load from lxc_execute again

Signed-off-by: Jordan Webb <jordemort@github.com>

namespace: use lxc_getpagesize()

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

conf: lxc_setup() -> lxc_setup_child()

Closes #1857.

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

confile_utils: add lxc_get_conf_uint64()

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

utils: add lxc_find_next_power2()

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

utils: parse_byte_size_string()

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

utils: add lxc_safe_long_long()

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

utils: add lxc_getpagesize()

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

utils: add lxc_make_tmpfile()

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

utils: add lxc_cloexec()

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

utils: move memfd_create() definition

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

lxc-debian: don't hardcode valid releases

This avoids the dance of updating the list of valid releases every time
Debian makes a new release.

It also fixes the following bug: even though lxc-debian will default to
creating containers of the latest stable by querying the archive, it
won't allow you to explicitly request `stable` because the current list
of valid releases don't include it.

Last, but not least, avoid hitting the mirror in the case the desired
release is one of the ones we know will always be there, i.e. stable,
testing, sid, and unstable.

Signed-off-by: Antonio Terceiro <terceiro@debian.org>

lxc-debian: don't write C.* locales to /etc/locale.gen

Doing that confuses locale generation. lxc-ubuntu does the same check

Signed-off-by: Antonio Terceiro <terceiro@debian.org>

Fix typo in lxc-net script

Signed-off-by: adrian5 <adrian5@users.noreply.github.com>

lxc-debian: allow creating `testing` and `unstable`

Being able to create `testing` containers, regardless of what's the name
of the next stable, is useful in several contexts, included but not
limited to testing purposes. i.e. one won't need to explicitly switch to
`bullseye` once `buster` is released to be able to continue tracking
`testing`. While we are at it, let's also enable `unstable`, which is
exactly the same as `sid`, but there is no reason for not being able to.

Signed-off-by: Antonio Terceiro <terceiro@debian.org>