confile: error out if a network configuration key has no subkey

This prevent an infinite recursion in the case of "lxc.net.0. = a"

Signed-off-by: Felix Abecassis <fabecassis@nvidia.com>

log: fix infinite loop with multiple lxc.log.syslog keys

This caused the linked list of appenders to loop on itself, creating
an infinite logging loop in `__lxc_log_append`.

Signed-off-by: Felix Abecassis <fabecassis@nvidia.com>

tests: add a function for negative netdev tests

Signed-off-by: Felix Abecassis <fabecassis@nvidia.com>

confile: fix memory leak

Signed-off-by: Felix Abecassis <fabecassis@nvidia.com>

Merge pull request #1932 from 3XX0/dhclient-hook

hooks: add dhclient hooks

Merge pull request #1958 from AustinReichert/tools-refactor-lxc-wait

tools/lxc_wait: removed internal logging

Merge pull request #1959 from AustinReichert/tools-refactor-lxc-usernsexec

tools/lxc_usernsexec: removed internal logging

Merge pull request #1960 from AustinReichert/tools-refactor-lxc-unfreeze

tools/lxc_unfreeze: removed internal logging

Merge pull request #1961 from AustinReichert/tools-refactor-lxc-top

tools/lxc_top: removed internal logging

Merge pull request #1962 from AustinReichert/tools-refactor-lxc-stop

tools/lxc_stop: removed internal logging

Merge pull request #1963 from AustinReichert/tools-refactor-lxc-start

tools/lxc_start: removed internal logging

Merge pull request #1964 from AustinReichert/tools-refactor-lxc-snapshot

tools/lxc_snapshot: removed internal logging

Merge pull request #1966 from AustinReichert/tools-refactor-lxc-ls

tools/lxc_ls: remove internal logging

Merge pull request #1965 from AustinReichert/tools-refactor-lxc-monitor

tools/lxc_monitor: removed internal logging

Merge pull request #1967 from AustinReichert/tools-refactor-lxc-info

tools/lxc_info: removed internal logging

Merge pull request #1968 from AustinReichert/tools-refactor-lxc-freeze

tools/lxc_freeze: remove internal logging

Merge pull request #1969 from AustinReichert/tools-refactor-lxc-execute

tools/lxc_execute: removed internal logging

Merge pull request #1957 from AustinReichert/tools-refactor-lxc-unshare

tools/lxc_unshare: removed internal logging

Merge pull request #1970 from AustinReichert/tools-refactor-lxc-device

tools/lxc_device: remove internal logging

Merge pull request #1971 from AustinReichert/tools-refactor-lxc-destroy

tools/lxc_destroy: remove internal logging

Merge pull request #1972 from AustinReichert/tools-refactor-lxc-create

tools/lxc_create: remove internal logging

Merge pull request #1973 from AustinReichert/tools-refactor-lxc-copy

tools/lxc_copy: remove internal logging

Merge pull request #1974 from AustinReichert/tools-refactor-lxc-console

tools/lxc_console: remove internal logging

Merge pull request #1975 from AustinReichert/tools-refactor-lxc-clone

tools/lxc_clone: remove internal logging

tools/lxc_wait: removed internal logging

Signed-off-by: AustinReichert <austinskyreichert@utexas.edu>

tools/lxc_usernsexec: removed internal logging

Signed-off-by: AustinReichert <austinskyreichert@utexas.edu>

tools/lxc_unshare: removed internal logging

Signed-off-by: AustinReichert <austinskyreichert@utexas.edu>

tools/lxc_unfreeze: removed internal logging

Signed-off-by: AustinReichert <austinskyreichert@utexas.edu>

tools/lxc_top: removed internal logging

Signed-off-by: AustinReichert <austinskyreichert@utexas.edu>

tools/lxc_stop: removed internal logging

Signed-off-by: AustinReichert <austinskyreichert@utexas.edu>

tools/lxc_start: removed internal logging

Signed-off-by: AustinReichert <austinskyreichert@utexas.edu>

tools/lxc_snapshot: removed internal logging

Signed-off-by: AustinReichert <austinskyreichert@utexas.edu>

tools/lxc_monitor: removed internal logging

Signed-off-by: AustinReichert <austinskyreichert@utexas.edu>

tools/lxc_copy: remove internal logging

Signed-off-by: AustinReichert <austinskyreichert@utexas.edu>

tools/lxc_ls: remove internal logging

Signed-off-by: AustinReichert <austinskyreichert@utexas.edu>

tools/lxc_info: removed internal logging

Signed-off-by: AustinReichert <austinskyreichert@utexas.edu>

tools/lxc_freeze: remove internal logging

Signed-off-by: AustinReichert <austinskyreichert@utexas.edu>

tools/lxc_execute: removed internal logging

Signed-off-by: AustinReichert <austinskyreichert@utexas.edu>

tools/lxc_device: remove internal logging

Signed-off-by: AustinReichert <austinskyreichert@utexas.edu>

tools/lxc_destroy: remove internal logging

Signed-off-by: AustinReichert <austinskyreichert@utexas.edu>

tools/lxc_create: remove internal logging

Signed-off-by: AustinReichert <austinskyreichert@utexas.edu>

tools/lxc_console: remove internal logging

Signed-off-by: AustinReichert <austinskyreichert@utexas.edu>

tools/lxc_clone: remove internal logging

Signed-off-by: AustinReichert <austinskyreichert@utexas.edu>

Merge pull request #1952 from marcosps/duplicated_sethostname

utils.h: Avoid duplicated sethostname implementation

Merge pull request #1954 from AustinReichert/tools-refactor-lxc-autostart

tools/lxc_autostart: remove internal logging

Merge pull request #1953 from AustinReichert/tools-refactor-lxc-cgroup

tools/lxc_cgroup: remove internal logging

tools/lxc_autostart: remove internal logging

Signed-off-by: AustinReichert <austinskyreichert@utexas.edu>

tools/lxc_cgroup: remove internal logging

Signed-off-by: AustinReichert <austinskyreichert@utexas.edu>

utils.h: Avoid duplicated sethostname implementation

Move duplicated implementatin of sethostname from conf.c and
lxc_unshare.c to utils.h

Signed-off-by: Marcos Paulo de Souza <marcos.souza.org@gmail.com>

Merge pull request #1949 from marcosps/issue_84

Use AX_PTHREAD config script to detect pthread api

seccomp: filter syscalls based on arguments

In order to support filtering syscalls based on arguments the seccomp version 2
specification is extended to the following form:

syscall_name action [index,value,op,valueTwo] [index,value,op]...

where the arguments of the tuple [index,value,valueTwo,op] have the following
meaning:
1. index (uint32_t):
   The index of the syscall argument.
2. value (uint64_t):
   The value for the syscall argument specified by "index".
3. valueTwo (uint64_t, optional):
   The value for the syscall argument specified by "index". This optional value
   is only valid in conjunction with SCMP_CMP_MASKED_EQ.
4. op (string):
   The operator for the syscall argument. Valid operators are the constants
   - SCMP_CMP_NE        (!=)
   - SCMP_CMP_LE        (<=)
   - SCMP_CMP_EQ        (==)
   - SCMP_CMP_GE        (>=)
   - SCMP_CMP_GT        (>)
   - SCMP_CMP_MASKED_EQ (&=)
   as defined by libseccomp >= v2.3.2.
   For convenience liblxc also understands the standard operator notation
   indicated in brackets after the libseccomp constants above as an equivalent
   notation.
Note that it is legal to specify multiple entries for the same syscall.

An example for an extended seccomp version 2 profile is:

2
blacklist allow
reject_force_umount  # comment this to allow umount -f;  not recommended
[all]
kexec_load errno 1 [0,1,SCMP_CMP_LE][3,1,==][5,1,SCMP_CMP_MASKED_EQ,1]
open_by_handle_at errno 1
init_module errno 1
finit_module errno 1
delete_module errno 1
unshare errno 9 [0,0x10000000,SCMP_CMP_EQ]
unshare errno 2 [0,0x20000000,SCMP_CMP_EQ]

Closes #1564.

Signed-off-by: LiFeng <lifeng68@huawei.com>
Reviewed-by: Christian Brauner <christian.brauner@ubuntu.com>

Use AX_PTHREAD config script to detect pthread api

Closes: #84
Signed-off-by: Marcos Paulo de Souza <marcos.souza.org@gmail.com>

start.c: always switch uid and gid

Signed-off-by: Yifeng Tan <tanyifeng1@huawei.com>
Reviewed-by: Christian Brauner <christian.brauner@ubuntu.com>

Merge pull request #1947 from brauner/2017-11-24/fix_cap_sys_admin_declaration

conf: move CAP_SYS_* definitions to utils.h

conf: move CAP_SYS_* definitions to utils.h

Closes #1946.

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Merge pull request #1944 from dnegreira/lxc_spec_in_typo_fix

Fixed typo on lxc.spec.in

Fixed typo on lxc.spec.in

Signed-off-by: David Negreira David@otherreality.net

Merge pull request #1939 from brauner/2017-11-22/more_elaborate_config_update_message

doc: documents lxc.namespace.[namespace identifier] + confile: improve legacy update message

Merge pull request #1941 from flx42/lxc-oci-improve-import

Improve lxc-oci.in

doc: document lxc.namespace.[namespace identifier]

Closes #1924.

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

lxc-oci: add support for registry authentication

Signed-off-by: Felix Abecassis <fabecassis@nvidia.com>

lxc-oci: import common.conf and userns.conf

Signed-off-by: Felix Abecassis <fabecassis@nvidia.com>

lxc-oci: import the environment variables

Signed-off-by: Felix Abecassis <fabecassis@nvidia.com>

lxc-oci: add utility function to retrieve the path of the config file

Signed-off-by: Felix Abecassis <fabecassis@nvidia.com>

confile: improve legacy update message

Closes #1938.

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

lxc-oci: write /etc/hosts

Signed-off-by: Felix Abecassis <fabecassis@nvidia.com>

lxc-oci: write /etc/hostname

Signed-off-by: Felix Abecassis <fabecassis@nvidia.com>

lxc-oci: support unprivileged umoci unpacking

Signed-off-by: Felix Abecassis <fabecassis@nvidia.com>

Merge pull request #1936 from Cypresslin/user-del-mute

lxc-test-unpriv: check user existence before removing it

Merge pull request #1935 from flx42/confile-overlapping-strncpy

confile_utils: fix overlapping strncpy

lxc-test-unpriv: check user existence before removing it

Check the test user (lxcunpriv) before calling deluser command,
otherwise it will print unnecessary error message:
/usr/sbin/deluser: The user 'lxcunpriv' does not exist.

Signed-off-by: Po-Hsu Lin <po-hsu.lin@canonical.com>

confile_utils: fix overlapping strncpy

In the case of "lxc.net.0.type", the pointers passed to strncpy were
only 2 elements apart, resulting in undefined behavior.

Signed-off-by: Felix Abecassis <fabecassis@nvidia.com>

Merge pull request #1933 from 3XX0/init-control-tty

lxc_init: set the control terminal in the child session

lxc_init: set the control terminal in the child session

Signed-off-by: Jonathan Calmels <jcalmels@nvidia.com>

hooks: add dhclient hooks

Add new hooks leveraging dhclient from the host to automatically
configure the container interfaces. This is especially useful for
application containers which rely on an IPAM driver for network
configuration (e.g. Docker).

Signed-off-by: Jonathan Calmels <jcalmels@nvidia.com>

Merge pull request #1931 from brauner/2017-11-20/fix_state_socket

commands: fix state socket implementation

commands: fix state socket implementation

Remove dead state clients from state client list. Consider the following
scenario:

01 start container
02 issue shutdown request
03 state_client_fd is added to lxc_handler
03 container doesn't respond to shutdown request
04 user aborts shutdown request
05 lxc_cmd_fd_cleanup() removes state_client_fd from lxc_mainloop
06 invalid state_client_fd is still recorded in the lxc_handler
07 user issues lxc_cmd_stop() request via SIGKILL
08 container reaches STOPPED state and sends message to state_client_fd
09 state_client_fd number has been reused by lxc_cmd_stop_callback()
10 invalid data gets dumped to lxc_cmd_stop()

Reproducer:
Set an invalid shutdown signal to which the init system does not respond with a
shutdown via lxc.signal.halt e.g. "lxc.signal.halt = SIGUSR1". Then do:

1. start container
    root@conventiont|~
    > lxc-start -n a1

2. try to shutdown container
    root@conventiont|~
    > lxc-stop -n a1

3. abort shutdown
^C

4. SIGKILL the container (lxc.signal.stop = SIGKILL)
    root@conventiont|~
    > lxc-stop -n a1 -k
    lxc-stop: a1: commands.c: lxc_cmd_rsp_recv: 165 File too large - Response data for command "stop" is too long: 12641 bytes > 8192

To not let this happen we remove the state_client_fd from the lxc_handler when
we detect a cleanup event in lxc_cmd_fd_cleanup().

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

lxccontainer: non-functional changes

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

commands: non-functional changes

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Merge pull request #1930 from lifeng68/Fix_parse_err

Fix lxc_inherit_namespace function error

Fix namespace config parse error

Signed-off-by: LiFeng <lifeng68@huawei.com>

Merge pull request #1925 from brauner/2017-11-14/console_config_keys

console: add lxc.console.buffer.size, lxc.console.buffer.logfile, lxc.console.rotate

test: expand console log tests

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

commands: rotate console log file

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

commands: truncate console ringbuffer log file

When a "clear" request is sent to the console ringbuffer we should truncate the
console log file as well.

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

console: split console setup into logical parts

The lxc_console_create() function used to munge the ringbuffer setup and the
log file setup already. This made somewhat sense when we didn't have a separate
ringbuffer log file. Now it's just plain confusing. So split this into logical
helpers that future maintainers can understand:

- lxc_console_create_log_file()
- lxc_console_create_ringbuf(console);
- lxc_console_create_ringbuf_log_file(console);

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

commands: only set ringbuffer datalen when needed

If we do it unconditionally a request to only clear the ringbuffer and not read
or write anything will fail.

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

confile: add lxc.console.rotate

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

confile: add lxc.console.buffer.logfile

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

confile: add lxc.console.buffer.size

Determines the size of the ringbuffer.

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Merge pull request #1920 from brauner/2017-11-12/console_exit_clean_on_sigterm

console: exit mainloop on SIGTERM

Merge pull request #1922 from brauner/2017-11-13/generate_new_uuid_for_xfs_and_btrfs_snapshots

lvm: generate new UUID for xfs + btrfs filesystems

lvm: generate new UUID for xfs + btrfs filesystems

Closes #1909.

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

console: exit mainloop on SIGTERM

This allows cleanly exiting a console session without control sequences.

Relates to https://github.com/lxc/lxd/pull/4001 .

Note that the existence of a signal handler now doesn't guarantee that ts->node
is allocated. Instead, ts->node will now only be added to if stdinfd is a tty.
New checks need to take that into account.

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

console: prepare for generic signal handler

Non-functional changes to enable handling more signals.

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Merge pull request #1919 from brauner/2017-11-11/console_fix_escape_sequence

console: use correct escape sequence check

console: use correct escape sequence check

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Merge pull request #1918 from brauner/2017-11-11/daemonized_execute

lxccontainer: enable daemonized execute

Merge pull request #1907 from brauner/2017-11-08/cgfsng

cgroups/cgfsng: adapt to new cgroup2 delegation

tools: add "--daemonize/-d"

This lets's users run daemonized application containers with our minimal init
as pid 1 and the requested program as pid 2.

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>