config: start with a full capability set

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

mainloop: add LXC_MAINLOOP_ERROR

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

cgfsng: non-functional changes

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

lxc_init: don't mount filesystems

We have an extensive set of container config options to do this
for us, and doing this unconditionally breaks several use cases.
For instance, if we want to bind mount a /dev/shm using the
container configuration, then lxc-execute, then lxc-init will
rudely unmount the /dev/shm and remount it as a private tmpfs.

Signed-off-by: Serge Hallyn <shallyn@cisco.com>

lxc-snapshot: fix segfault

https://bugs.launchpad.net/ubuntu/+source/lxc/+bug/1751780

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

commands: remove mutex from state client list

I was thinking about the locking here yesterday and it dawned on me that we
actually don't need this at all:
- possible contention between traversing list to send states to state clients
  and adding new state clients to the list:
  It is the command handler that adds new state clients to the state client
  list. The command handler and the code that actually sends out the container
  states run in the same process so there's not contention and thus no locking
  needed.
- adding state clients to the list from multiple threads:
  The command handler itself is single-threaded so only one thread's request can
  be served at the same time so no locking is needed.
- sending out the state to state clients via the command handler itself:
  The state client also adds and removes state clients from the state client
  list so there's no locking needed.

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

CODING_STYLE: add section about _exit()

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

fix download template for /tmp as tmpfs or noexec

* prepend $LXC_PATH to $DOWNLOAD_TEMP on systems with /tmp mounted
  securely as a small tmpfs / noexec

* gpg_setup() creates $DOWNLOAD_TEMP so remove superflous mkdir

* fixes https://github.com/lxc/lxc/issues/516

Signed-off-by: Stuart Cardall <developer@it-offshore.co.uk>

cgfsng: fix get_hierarchy() for unified hierarchy

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

criu: du_dump()

thread-safety: s/exit()/_exit()/g

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

criu: do_restore()

thread-safety: s/exit()/_exit()/g

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

criu: criu_version_ok()

thread-safety: s/exit()/_exit()/g

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

lxccontainer: create_container_dir()

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

lxccontainer: do_create_container_dir()

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

lxccontainer: lxcapi_startl()

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

lxccontainer: lxcapi_start()

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

lxccontainer: free_init_cmd()

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

lxccontainer: split_init_cmd()

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

lxccontainer: push_arg()

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

lxccontainer: am_single_threaded()

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

lxccontainer: do_lxcapi_wait()

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

lxccontainer: do_lxcapi_want_close_all_fds()

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

lxccontainer: do_lxcapi_want_daemonize()

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

lxccontainer: do_lxcapi_load_config()

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

lxccontainer: load_config_locked()

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

lxccontainer: lxcapi_console()

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

lxccontainer: do_lxcapi_console_getfd()

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

lxccontainer: do_lxcapi_unfreeze()

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

lxccontainer: do_lxcapi_freeze()

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

lxccontainer: do_lxcapi_is_running()

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

lxccontainer: is_stopped()

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

lxccontainer: do_lxcapi_state()

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

lxccontainer: do_lxcapi_is_defined()

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

lxccontainer: lxc_container_{get,put}()

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

lxccontainer: lxc_container_free()

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

lxccontainer: create_partial()

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

lxccontainer: create_partial()

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

lxccontainer: ongoing_create()

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

lxccontainer: config_file_exists()

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

network: lxc_delete_network_unpriv_exec()

thread-safety: s/exit()/_exit()/g

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

network: lxc_create_network_unpriv_exec()

thread-safety: s/exit()/_exit()/g

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

utils: run_command()

thread-safety: s/exit()/_exit()/g

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

utils: lxc_popen()

thread-safety: s/exit()/_exit()/g

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

lxclock: {un}lock_mutex()

thread-safety: s/exit()/_exit()/g

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

lxccontainer: do_lxcapi_detach_interface()

thread-safety: s/exit()/_exit()/g

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

lxccontainer: do_add_remove_node()

thread-safety: s/exit()/_exit()/g

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

lxccontainer: do_lxcapi_clone()

thread-safety: s/exit()/_exit()/g

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

lxccontainer: do_lxcapi_get_ips()

thread-safety: s/exit/_exit()/g

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

lxccontainer: do_lxcapi_get_interfaces()

thread-safety: s/exit()/_exit/g

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

lxccontainer: do_lxcapi_create()

thread-safety: s/exit()/_exit()/g

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

lxccontainer: do_lxcapi_start()

thread-safety: s/exit()/_exit()/g

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

cgfsng: fix off-by-one error

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

utils: include linux/types.h

Closes #2178.

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

CVE 2018-6556: verify netns fd in lxc-user-nic

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

utils: add LXC_PROC_PID_FD_LEN

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Merge pull request #2359 from brauner/2018-05-28/fix_stable-2.0_network_parsing

confile: backport parts of network parsing

confile: backport parts of network parsing

This backports part of our robust network parser.

Closes #2271.

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

cgfsng: enable "force" for "cgroup-full"

This enables cgroup-full:{mixed,ro,rw}:force and reworks the mount logic.
When cgroup-full was specified we used to bind-mount the cgroups from the host.
That is pretty weird thing to do given that you can simply mount them directly
without going through bind-mounts.

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

start: do_destroy_container()

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

start: lxc_destroy_container_on_signal()

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

start: post_start()

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

start: start()

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

start: lxc_abort()

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

start: lxc_init()

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

start: lxc_init_handler()

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

start: lxc_poll()

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

start: signal_handler()

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

start: lxc_check_inherited()

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

start: preserve_ns()

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

start: close_ns()

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

start: print_top_failing_dir()

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

start: use correct prefix for includes

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

{commands,start}: remove element from list first

First remove the client from the list then close the fd. Otherwise we open
ourselves to a race where another codepath might be writing to a bad file
descriptor.

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

tree-wide: remove locking around openpty()

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

start: remove duplicate lxc_monitor_send_state()

Closes #2177.

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

lxccontainer: use wait_for_pid()

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

cgfsng: __cg_legacy_setup_limits()

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

cgfsng: cg_legacy_set_data()

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

cgfsng: convert_devpath()

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

cgfsng: cgfsng_set()

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

cgfsng: cgfsng_get()

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

cgfsng: cgfsng_attach()

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

cgfsng: __cg_unified_attach()

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

cgfsng: build_full_cgpath_from_monitorpath()

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

cgfsng: cgfsng_escape()

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

cgfsng: recursive_count_nrtasks()

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

cgfsng: recursive_count_nrtasks()

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

cgfsng: cgfsng_mount()

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

cgfsng: mount_cgroup_full()

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

cgfsng: cgfsng_chown()

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

cgfsng: cgfsng_enter()

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

cgfsng: cgfsng_create()

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

cgfsng: remove_path_for_hierarchy()

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

cgfsng: create_path_for_hierarchy()

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

cgfsng: cg_unified_create_cgroup()

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

cgfsng: recursive_destroy()

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

cgfsng: cgfsng_init()

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

cgfsng: cg_unified_get_current_cgroup()

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

cgfsng: cg_is_pure_unified()

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

cgfsng: cg_hybrid_init()

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>