build: add static libcap to output

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

confile: don't use path_simplify() on lxc.{execute,init}.cmd

Fixes: #4015
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

conf: add cgroup2, cgroup2:ro, cgroup2:force, cgroup2:ro:force options

We keep running into situations where we want to pre-mount a pure
cgroup2 layout regardless of the layout of the host.

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

AUTHORS: Update to point to git history

Signed-off-by: Stéphane Graber <stgraber@ubuntu.com>

conf: handle kernels without or not using SMT

On kernel not enabling or not using SMT core scheduling will return with
ENODEV. Handle such kernels.

Link: https://github.com/lxc/lxd/issues/9419
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

doc: fix typo in English lxc.container.conf(5)

Signed-off-by: KATOH Yasufumi <karma@jazz.email.ne.jp>

doc: Add lxc.sched.core to Japanese lxc.container.conf(5)

Update for commit 09996a4

Signed-off-by: KATOH Yasufumi <karma@jazz.email.ne.jp>

doc: add loglevels to ja and ko common options

Update for commit 44b87e8

Signed-off-by: KATOH Yasufumi <karma@jazz.email.ne.jp>

conf: make it more obvious how auto-mount flags are defined

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

criu: support restoring containers with pre-created veth devices

We did th CRIU and kernel work but for some reason we never did push the
LXC work.

Link: https://github.com/checkpoint-restore/criu/commit/cdb0d427020f0531f5a35146513c3a36b6eece11
      commit cdb0d427020f ("net: allow restoring of precreated veth devices")
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Release LXC 4.0.11

Signed-off-by: Stéphane Graber <stgraber@ubuntu.com>

conf: verify that rootfs is stable after setting up mounts

Apparently some users changed their rootfs via their lxc.mount.entry
entries. Let's not allow that as that can cause confusion during
container setup. So lets verify that the rootfs is stable after setup.

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

README.md: mention RISC-V architecture

Signed-off-by: Heinrich Schuchardt <heinrich.schuchardt@canonical.com>

Add riscv64 to --arch parameter values

lxc-attach uses an --arch parameter. 'riscv64' should be a usable value.

Signed-off-by: Heinrich Schuchardt <heinrich.schuchardt@canonical.com>

conf: don't fail umount2()

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

conf: fix coding style

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

caps: ensure \0-termination

Fixes: Coverity 1492865
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

attach: improve error logging

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

af_unix: replace log_error_errno()

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

criu: fix error message

as of 59d8a539d106 ("criu: massage exec_criu()") I see:

In file included from criu.c:22:
criu.c: In function 'exec_criu':
log.h:376:2: error: '%s' directive argument is null [-Werror=format-overflow=]
  376 |  LXC_ERROR(&locinfo, format, ##__VA_ARGS__);   \
      |  ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
log.h:457:3: note: in expansion of macro 'ERROR'
  457 |   ERROR("%s - " format, ptr, ##__VA_ARGS__); \
      |   ^~~~~
log.h:491:3: note: in expansion of macro 'SYSERROR'
  491 |   SYSERROR(format, ##__VA_ARGS__);              \
      |   ^~~~~~~~
criu.c:325:11: note: in expansion of macro 'log_error_errno'
  325 |    return log_error_errno(-ENOMEM, ENOMEM, "Failed to remove extraneous slashes from \"%s\"", tmp);
      |           ^~~~~~~~~~~~~~~

it looks like we should be logging the string that failed, vs. tmp here.

(my log was taken from stable-4.0, but the same issue exists on master it
seems.)

Signed-off-by: Tycho Andersen <tycho@tycho.pizza>

tests: remove trailing endifs

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

lxc-monitord: fix integer comparisions

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

test: fix nested capability tests

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

attach: improve error logging for drop_capabilities()

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

tests: expand capability tests

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

tree-wide: use __u32 for capabilities

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

cgroups: use __u32 for cpumasks

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

conf: improve capability handling

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

tests: add test for lxc.cap.keep

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

conf: fix lxc.cap.keep behavior

Fixes: ##3993
Fixes: 20ab75789eb9 ("conf: simplify and port caps to new list type")
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

terminal: log at warning message

The lxc_devpts_terminal() helper is called in contexts where it can fail
due to various reasons but where we safely fallback to allocating
terminal devices on the host. Logging error messages irritates users so
just log warning messages.

Link: https://discuss.linuxcontainers.org/t/lxc-attach-error-failed-to-open-terminal-multiplexer-device
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

log: improve %m handling on musl

Fixes: #3961
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

start: make failure to apply core scheduling fatal

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

start: use core scheduling error helper

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

start: don't fail when core scheduling isn't supported

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

syscall_wrappers: fix core scheduling creation helper naming

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

tree-wide: cast to core scheduling cookie to llu

Link: https://launchpadlibrarian.net/561086365/buildlog_ubuntu-focal-ppc64el.lxc_1%3A4.0.10+master~20210930-1812-0ubuntu1~focal_BUILDING.txt.gz
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

attach: handle core scheduling

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

lxc: add lxc.sched.core

Core scheduling defines if the container payload is marked as being
schedulable on the same core. Doing so will cause the kernel scheduler
to ensure that tasks that are not in the same group never run
simultaneously on a core. This can serve as an extra security measure to
prevent the container payload from using cross hyper thread attacks.

The only allowed values are 0 and 1. Set this to 1 to create a core
scheduling domain for the container or 0 to not create one. If not set
explicitly no core scheduling domain will be created for the container.

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

initutils: add missing prctl include

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

build: compiler attribute improvements

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

github: Drop 16.04 tests

Signed-off-by: Stéphane Graber <stgraber@ubuntu.com>

build: check whether compiler supports nonnull and returns_nonnull attributes

Fixes: #3980
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

hooks: fix quoting

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

templates: don't double quote

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

build: add templates

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

build: fix remaining HAVE_* generations

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

tree-wide: fix HAVE_* checks

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

cmds: fix includes

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

cmds: fix integer conversions

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

lxc-monitord: use {} around ;

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

build: add cmd builds

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

build: add hooks

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

build: build hooks directly in their folder

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

build: improve meson build

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

build: use dummy config data

to avoid having to rely on newer meson features.

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

build: expand default_options

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

build: add commands

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

build: split netns_ifaddrs into separate sources

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

hooks: use cloexec everywhere

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

build: fix tools build

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

build: fix hook program build

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Don't include internal headers in external library headers

Signed-off-by: Stéphane Graber <stgraber@ubuntu.com>

tools: use correct include for Android

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

build: support lto

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

cgroups: fix declarations and headers

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

network: fix integer comparisons

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

build: ensure all relevant calls are checked for availability at build time

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

build: show more detailed information

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

build: record meson version

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

build: use correct minimal meson version requirement

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

build: remove pointless prefixdir validation

Meson will handle this internall and treat a non-absolute path as an
error.

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

tests: fix config file tests

Link: https://bugs.launchpad.net/bugs/1943441
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

log: fix cross-compilation with %m modifier

Fixes: #3961
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

build: set more variables and print summary

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

build: add more global config variables

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

build: set diagnostic colours directly in default_options

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

build: add single option directly to static library

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

build: remove unneeded variables

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

build: use common dependencies variable

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

build: libdir and bindir are the default for shared libraries and executables

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

build: set find_library('libcap', require : false)

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

build: -fPIC and -shared are handled automatically

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

build: use dependency() where possible

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

build: set as-needed in default_options

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

build: set pie in default_options

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Fix `lxc-cgroup` smart completion.

Also make bash function more readable for itself.

Signed-off-by: Edênis Freindorfer Azevedo <edenisfa@gmail.com>

Refactor ` __lxc_check_name_present()`.

Print name of container found, if any.

Signed-off-by: Edênis Freindorfer Azevedo <edenisfa@gmail.com>

Check completion for prefixes names.

If a name is a prefix of another word available for completion, adjust
to show all words with given prefix.

Signed-off-by: Edênis Freindorfer Azevedo <edenisfa@gmail.com>

Add `__lxc_cgroup_state_object()`.

Support cgroup state-object completion values for `lxc-cgroup`.

Signed-off-by: Edênis Freindorfer Azevedo <edenisfa@gmail.com>

Update `_lxc_usernsexec`.

Not really much can be done for this function, as `-m` requires an ID
mapping that has to be manually input, since it will use
`/etc/sub{g,u}id` if not specified.

Signed-off-by: Edênis Freindorfer Azevedo <edenisfa@gmail.com>

Add completion for `lxc-copy` param `--fssize`.

Signed-off-by: Edênis Freindorfer Azevedo <edenisfa@gmail.com>

Add `__lxc_get_selinux_contexts()`.

List SElinux contexts available. Not clear if this could be only for
root or if normal user with `sudo` is also supported.

Using `Fedora34` for basic testing.

Signed-off-by: Edênis Freindorfer Azevedo <edenisfa@gmail.com>

Refactor `__lxc_groups()` to `__lxc_get_groups()`.

Make code logic be more clear to what it is being done.

Signed-off-by: Edênis Freindorfer Azevedo <edenisfa@gmail.com>

Another round of more bash-like syntax.

Signed-off-by: Edênis Freindorfer Azevedo <edenisfa@gmail.com>

Fix `lxc-create` completion.

Do not append a name of an existing container.

Signed-off-by: Edênis Freindorfer Azevedo <edenisfa@gmail.com>

Add support for comma as a completion word.

For `lxc-ls --groups` and `lxc-autostart --groups`.
Support leading comma, trailing comma, embedded double comma.

Signed-off-by: Edênis Freindorfer Azevedo <edenisfa@gmail.com>

Refactor `__lxc_piped_args`.

Use bash functions for common array operations. Keep code logic somewhat
easy to read for bug hunting.

Signed-off-by: Edênis Freindorfer Azevedo <edenisfa@gmail.com>

Fix `lxc-snapshot` completion.

For options `-r,--restore` and `-d,--destroy`, we need the container
name to create the list of completion values.

Therefore, it is needed to scan the current command line to check if
there is a container name available.

Signed-off-by: Edênis Freindorfer Azevedo <edenisfa@gmail.com>

Use more bash-like syntax.

Signed-off-by: Edênis Freindorfer Azevedo <edenisfa@gmail.com>