cgfsng: cgfsng_escape()

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

cgfsng: recursive_count_nrtasks()

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

cgfsng: recursive_count_nrtasks()

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

cgfsng: cgfsng_mount()

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

cgfsng: mount_cgroup_full()

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

cgfsng: cgfsng_chown()

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

cgfsng: cgfsng_enter()

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

cgfsng: cgfsng_create()

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

cgfsng: remove_path_for_hierarchy()

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

cgfsng: create_path_for_hierarchy()

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

cgfsng: cg_unified_create_cgroup()

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

cgfsng: recursive_destroy()

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

cgfsng: cgfsng_init()

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

cgfsng: cg_unified_get_current_cgroup()

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

cgfsng: cg_is_pure_unified()

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

cgfsng: cg_hybrid_init()

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

cgfsng: lxc_cgfsng_print_basecg_debuginfo()

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

cgfsng: lxc_cgfsng_print_hierarchies()

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

cgfsng: trim()

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

cgfsng: must_append_string()

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

cgfsng: cg_hybrid_get_current_cgroup()

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

cgfsng: controller_in_clist()

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

cgfsng: copy_to_eol()

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

cgfsng: cg_hybrid_get_mountpoint()

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

cgfsng: cg_hybrid_get_controllers()

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

cgfsng: all_controllers_found()

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

cgfsng: controller_found()

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

cgfsng: controller_list_is_dup()

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

cgfsng: controller_lists_intersect()

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

cgfsng: cg_legacy_handle_cpuset_hierarchy()

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

cgfsng: copy_parent_file()

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

cgfsng: cg_legacy_filter_and_set_cpus()

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

cgfsng: get_max_cpus()

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

cgfsng: lxc_cpumask_to_cpulist()

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

cgfsng: lxc_cpumask()

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

cgfsng: get_hierarchy()

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

cgfsng: must_append_controller()

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

cgfsng: string_in_list()

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

cgfsng: append_null_to_list()

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

cgfsng: add me to authors

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

cgfsng: move cg_legacy_must_prefix_named()

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

cgfsng: cg_legacy_must_prefix_named()

s/must_prefix_named/cg_legacy_must_prefix_named/

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

cgfsng: free_string_list()

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

cgfsng: fully document remaining variables

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

cgfsng: fully document struct cgfsng_handler_data

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

cgfsng: fully document struct hierarchy

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

cgfsng: order includes

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

confile: add "force" to cgroup:{mixed,ro,rw}

This lets users specify

        lxc.mount.auto = cgroup:mixed:force
or
        lxc.mount.auto = cgroup:ro:force
or
        lxc.mount.auto = cgroup:rw:force

When cgroup namespaces are supported LXC will not mount cgroups for the
container since it assumes that the init system will mount cgroups itself if it
wants to. This assumption already broke when users wanted to run containers
without CAP_SYS_ADMIN. For example, systemd based containers wouldn't start
since systemd needs to mount cgroups (named systemd hierarchy for legacy
cgroups and the unified hierarchy for unified cgroups) to track processes. This
problem was solved by detecting whether the container had CAP_SYS_ADMIN. If it
didn't we performed the cgroup mounts for it.
However, there are more cases when we should be able to mount cgroups for the
container when cgroup namespaces are supported:
- init systems not mounting cgroups themselves:
  A init system that doesn't mount cgroups would not have cgroups available
  especially when combined with custom LSM profiles to prevent cgroup
  {u}mount()ing inside containers.
- application containers:
  Application containers will usually not mount by cgroups themselves.
- read-only cgroups:
  It is useful to be able to mount cgroups read-only to e.g. prevent
  changing cgroup limits from inside the container while at the same time
  allowing the applications to perform introspection on their own cgroups. This
  again is mostly useful for application containers. System containers running
  systemd will usually not work correctly when cgroups are mounted read-only.
To be fair, all of those use-cases could be covered by custom hooks or
lxc.mount.entry entries but exposing it through lxc.mount.auto takes care of
setting correct mount options and adding the necessary logic to e.g. mount
filesystem read-only correctly.

Currently we only extend this to cgroup:{mixed,ro,rw} but technically there's
no reason not to enable the same behavior for cgroup-full:{mixed,ro,rw} as
well. If someone requests this we can simply treat it as a bug and add "force"
for cgroup-full.

Replaces #2136.

Signed-off-by: Shukui Yang <yangshukui@huawei.com>
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

README: add coverity

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

console: ensure that fd is marked EBADF

If the handler closes the file descriptor for the peer or master fd it is
crucial that we mark it as -EBADF. This will prevent lxc_console_delete()
from calling close() on an already closed file descriptor again. I've
observed the double close in the attach code.

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

start: don't call close on invalid file descriptor

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

utils: fix lxc_p{close,open}()

If a file descriptor fd is opened by fdopen() and associated with a stream f
will **not** have been dup()ed. This means that fclose(f) will also close the
fd. So never call close(fd) after fdopen(fd) succeeded.
This fixes a double close() Stéphane and I observed when debugging on aarch64
and armf.

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

tests: remove lxc-test-ubuntu

This is really taking a long time for not a lot of benefit.

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

CODING_STYLE: add section for str{n}cmp()

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

cgroups: use correct mask for chmod()

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

CODING_STYLE: add CODING_STYLE.md

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

CONTRIBUTING: update

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

cgfsng: simplifications and fixes

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

lxclock: remove pthread_atfork_handlers

They shouldn't be needed anymore.

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

conf: support mount propagation

Closes #810.

Signed-off-by: Yifeng Tan <tanyifeng1@huawei.com>
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Fix lxc-console hang

The variable 'descr' is mistakenly covered with 'descr_console'.

Signed-off-by: LiFeng <lifeng68@huawei.com>

Modify .gitignore

add:
src/lxc/cmd/lxc-checkconfig
src/lxc/cmd/lxc-update-config

Signed-off-by: LiFeng <lifeng68@huawei.com>

console: they are really not necessary

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

fix userns helper error handling

In both of these cases if there is actually an error, we won't close the
pipe and the api call will hang. Instead, let's be sure to close the pipe
before waiting, so that it doesn't hang.

Signed-off-by: Tycho Andersen <tycho@tycho.ws>

coverity: #1425971

Dereference after null check

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

coverity: #1426734

Argument cannot be negative

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

coverity: #1429139

Resource leak

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Restore most cases of am_guest_unpriv

The only cases where we really need to be privileged with respect
to the host is when we are trying to mknod, and in some cases
to do with a physical network device.  This patch leaves the
detection of the network device cases as a TODO.

This should fix the currently broken case of starting a privileged
container with at least one veth nic, nested inside an unprivileged
container.

Cc: Tycho Andersen <tycho@tycho.ws>
Signed-off-by: Serge Hallyn <shallyn@cisco.com>

define am_guest_unpriv

Sometimes we want to know whether we are privileged wrt our
namespaces, and sometimes we want to know whether we are priv
wrt init_user_ns.

Signed-off-by: Serge Hallyn <shallyn@cisco.com>

cgfsng: add required remount flags

https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=9566d6742852c527bf5af38af5cbb878dad75705

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

lsm: fix missing @ in function documentation

Signed-off-by: Marcos Paulo de Souza <marcos.souza.org@gmail.com>

selinux: simplify check for default label

Signed-off-by: Marcos Paulo de Souza <marcos.souza.org@gmail.com>
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

cgroups: add check for lxc.cgroup.use

Closes #870.

Signed-off-by: Marcos Paulo de Souza <marcos.souza.org@gmail.com>

templates: CentOS fixes

Issues fixed:
- lxc-centos died about a missing /run directory
- lxc-centos complained about some config files it couldn't modify
- the new container got stuck at startup time for a minute
  (literally), waiting for systemd-remount-fs startup script

Of course it still works for RHEL 6, CentOS 6 and 7 as well. I did not
verify earlier CentOS or RHEL releases.

Signed-off-by: Harald Dunkel <harald.dunkel@aixigo.de>
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

cgfsng: non-functional changes

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

cgfsng: do MS_REMOUNT

Perform MS_REMOUNT on mounts with MS_RDONLY.

Signed-off-by: LiFeng <lifeng68@huawei.com>
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

attach: non-functional changes

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

attach: set the container's environment variables

Set the same environment variables that were used when starting the container
when attaching to the container.

Signed-off-by: LiFeng <lifeng68@huawei.com>
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

cgroups: more consistent naming

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

cgroups: handle limits on the unified hierarchy

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

cgroups: cgfsng_set: handle unified hierarchy

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

cgroups: cgfsng_get: handle unified hierarchy

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

cgroups: cgfsng_attach: handle unified hierarchy

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

cgroups: cgfsng_create: handle unified hierarchy

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

cgroups: get controllers on the unified hierarchy

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

lxc.init: ignore SIGHUP

see comment for details.

Signed-off-by: Tycho Andersen <tycho@tycho.ws>

monitor: send SIGTERM to the container when SIGHUP is received

For the ->execute() case, we want to make sure the application dies when
SIGHUP is received. The next patch will ignore SIGHUP in the lxc monitor,
because tasks inside the container send SIGHUP to init to have it reload
its config sometimes, and we don't want to do that with init.lxc, since it
might actually kill the container if it forwards SIGHUP to the child and
the child can't handle it.

Signed-off-by: Tycho Andersen <tycho@tycho.ws>

lxc-init: use SIGKILL after alarm timeout

d76e3e1 inadvertently switched the alarm timeout from sigterm to sigkill.
We really want sigkill here, so let's bring it back.

Signed-off-by: Tycho Andersen <tycho@tycho.ws>

debian: We must use iproute on wheezy

Signed-off-by: Stéphane Graber <stgraber@ubuntu.com>

lsm: do not #ifdefine

Since we stopped linking against AppArmor we can now remove the conditional
compilation.

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

tools: make "-n" optional

This lets users use the tools with "lxc-* -n <container-name>" or
"lxc-* <container-name>".

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

debian: Use iproute2 instead of iproute

The package has pretty much always been iproute2 with iproute being an
alias for it, the alias is now gone so we need to use iproute2.

Signed-off-by: Stéphane Graber <stgraber@ubuntu.com>

better unprivileged detection

In particular, if we are already in a user namespace we are unprivileged,
and doing things like moving the physical nics back to the host netns won't
work. Let's do the same thing LXD does if euid == 0: inspect
/proc/self/uid_map and see what that says.

Signed-off-by: Tycho Andersen <tycho@tycho.ws>

better check for lock dir

Consider the case where we're running in a user namespace but in the host's
mount ns with the host's filesystem (something like
lxc-usernsexec ... lxc-execute ...), in this case, we'll be euid 0, but we
can't actually write to /run. Let's improve this locking check to make sure
we can actually write to /run before we decide to actually use it as our
locking dir.

Signed-off-by: Tycho Andersen <tycho@tycho.ws>

[cgfsng] show wrong errno

lxc_cgroup_set_data: h = get_hierarchy(controller);
if h is NULL, now errno is old, it donot set new one.
And then,
cgfsng_setup_limits:

    if (lxc_cgroup_set_data(cg->subsystem, cg->value, d)) {
if (do_devices && (errno == EACCES ||
errno == EPERM)) {
WARN("Error setting %s to %s for %s",
cg->subsystem, cg->value,
d->name);
continue;
}
SYSERROR("Error setting %s to %s for
 %s",
 cg->subsystem, cg->value,
 d->name);
goto out;
}

SYSERROR will show old errno, make me confused.

Signed-off-by: duguhaotian <duguhaotian@gmail.com>

network.c: Remove ip_forward_set and callers

The last user of ip_forward_set, lxc_ip_forward_on and
lxc_ip_forward_off was in 2009:

commit 92d385229be040cf034ac6efd9405b7bdfe06a3e
Author: Daniel Lezcano <dlezcano@fr.ibm.com>
Date:   Thu Oct 22 15:33:40 2009 +0200

    remove test directory

These functions are not called anymore.

Signed-off-by: Marcos Paulo de Souza <marcos.souza.org@gmail.com>

autotools: do not link against libapparmor

Since we write the label directly without going through the AppArmor API it
doesn't make sense to link against it.

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

apparmor: do not call aa_change_profile()

We can simply write the label ourselves. There's no magic happening.

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

lsm: add lsm_process_label_set_at()

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

lsm: add lsm_process_label_fd_get()

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>