start: s/||/&&/ when mapping ids

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

cgfsng: simplifications and fixes

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Merge pull request #2162 from brauner/2018-02-10/remove_openpty_lock

lxclock: remove atfork handlers

tree-wide: remove cgmanager

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

lxclock: remove pthread_atfork_handlers

They shouldn't be needed anymore.

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Merge branch 'tanyifeng-support_mount_propagation' into lxc/master

conf: support mount propagation

Closes #810.

Signed-off-by: Yifeng Tan <tanyifeng1@huawei.com>
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Merge pull request #2158 from lifeng68/Fix_lxc-console

Fix lxc-console hang

Fix lxc-console hang

The variable 'descr' is mistakenly covered with 'descr_console'.

Signed-off-by: LiFeng <lifeng68@huawei.com>

Merge pull request #2159 from lifeng68/modify_gitignore

Modify .gitignore

Modify .gitignore

add:
src/lxc/cmd/lxc-checkconfig
src/lxc/cmd/lxc-update-config

Signed-off-by: LiFeng <lifeng68@huawei.com>

Merge pull request #2155 from brauner/2018-02-10/remove_legacy_items

tree-wide: remove legacy codepaths

tree-wide: remove legacy codepaths

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Merge pull request #2090 from brauner/2018-01-12/tools_remove_non_api_symbols

tools: remove non api symbols

Merge pull request #2150 from brauner/2018-02-10/cgfsng_fix_unpriv_devices

conf: fix clearing cgroup settings

Merge pull request #2151 from brauner/2018-02-10/remove_openpty_lock

console: they are really not necessary

console: they are really not necessary

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

conf: fix clearing cgroup settings

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Merge pull request #2144 from brauner/2018-02-08/coverity_bug_smash

coverity: bug smash

Merge pull request #2149 from tych0/fix-userns-error-handling

fix userns helper error handling

fix userns helper error handling

In both of these cases if there is actually an error, we won't close the
pipe and the api call will hang. Instead, let's be sure to close the pipe
before waiting, so that it doesn't hang.

Signed-off-by: Tycho Andersen <tycho@tycho.ws>

Merge branch 'duguhaotian-new' into lxc/master

conf: fix log message

Signed-off-by: duguhaotian <duguhaotian@gmail.com>

coverity: #1425971

Dereference after null check

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

coverity: #1426083

Dereference after null check

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

lxccontainer: satisfy coverity

The container name can't be NULL so don't give coverity the impression that it
could be.

Silences coverity #1426123.
Silences coverity #1426124.

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

start: use goto instead of simple return

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

coverity: #1426126

Unchecked return value

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

coverity: #1426734

Argument cannot be negative

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

coverity: #1429139

Resource leak

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Merge pull request #2143 from brauner/2018-02-08/fix_cgroup_ns

start: check for cgroup namespace support

start: check for cgroup namespace support

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Merge pull request #2142 from hallyn/2018-02-08/priv

2018 02 08/priv

Restore most cases of am_guest_unpriv

The only cases where we really need to be privileged with respect
to the host is when we are trying to mknod, and in some cases
to do with a physical network device.  This patch leaves the
detection of the network device cases as a TODO.

This should fix the currently broken case of starting a privileged
container with at least one veth nic, nested inside an unprivileged
container.

Cc: Tycho Andersen <tycho@tycho.ws>
Signed-off-by: Serge Hallyn <shallyn@cisco.com>

define am_guest_unpriv

Sometimes we want to know whether we are privileged wrt our
namespaces, and sometimes we want to know whether we are priv
wrt init_user_ns.

Signed-off-by: Serge Hallyn <shallyn@cisco.com>

Merge pull request #2125 from brauner/2018-02-02/add_namespace_configs

confile: add lxc.namespace.share.[namespace], lxc.namespace.keep, lxc.namespace.clone

Merge pull request #2137 from brauner/2018-02-07/fix_unprivileged_flag

tools/lxc-ls: fix logic for unpriv containers

Merge pull request #2140 from brauner/2018-02-08/cgfsng_fix_ro_remount

cgfsng: add required remount flags

tools/lxc_unshare: satisfy Android

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

cgfsng: add required remount flags

https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=9566d6742852c527bf5af38af5cbb878dad75705

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Merge branch 'marcosps-selinux_simplification' into lxc/master

lsm: fix missing @ in function documentation

Signed-off-by: Marcos Paulo de Souza <marcos.souza.org@gmail.com>

selinux: simplify check for default label

Signed-off-by: Marcos Paulo de Souza <marcos.souza.org@gmail.com>
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Merge branch 'marcosps-issue_870' into lxc/master

cgroups: add check for lxc.cgroup.use

Closes #870.

Signed-off-by: Marcos Paulo de Souza <marcos.souza.org@gmail.com>

include: remove getsubopt.*

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

tools/lxc-ls: fix logic for unpriv containers

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

templates: CentOS fixes

Issues fixed:
- lxc-centos died about a missing /run directory
- lxc-centos complained about some config files it couldn't modify
- the new container got stuck at startup time for a minute
  (literally), waiting for systemd-remount-fs startup script

Of course it still works for RHEL 6, CentOS 6 and 7 as well. I did not
verify earlier CentOS or RHEL releases.

Signed-off-by: Harald Dunkel <harald.dunkel@aixigo.de>
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Merge branch 'lifeng68-remount_cgroup' into lxc/master

cgfsng: non-functional changes

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

cgfsng: do MS_REMOUNT

Perform MS_REMOUNT on mounts with MS_RDONLY.

Signed-off-by: LiFeng <lifeng68@huawei.com>
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Merge branch 'lifeng68-use_env_vars_in_container' into lxc/master

attach: non-functional changes

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

attach: set the container's environment variables

Set the same environment variables that were used when starting the container
when attaching to the container.

Signed-off-by: LiFeng <lifeng68@huawei.com>
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

tools: move lxc-monitor to API symbols only

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

tools: non-functional changes

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

cmd: non-functional changes

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

tools: move lxc-unshare to API symbols only

Closes #2073.

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

tools: move lxc-wait to API symbols only

Closes #2073.

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

tools: move lxc-unfreeze to API symbols only

Closes #2073.

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

tools: move lxc-top to API symbols only

Closes #2073.

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

tools: move lxc-stop to API symbols only

Closes #2073.

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

tools: move lxc-start to API symbols only

Closes #2073.

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

tools: move lxc-snapshot to API symbols only

Closes #2073.

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

tools: move lxc-ls to API symbols only

Closes #2073.

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

tools: move lxc-info to API symbols only

Closes #2073.

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

tools: move lxc-freeze to API symbols only

Closes #2073.

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

tools: move lxc-execute to API symbols only

Closes #2073.

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

tools: move lxc-device to API symbols only

Closes #2073.

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

tools: move lxc-destroy to API symbols only

Closes #2073.

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

tools: move lxc-create to API symbols only

Closes #2073.

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

tools: move lxc-copy to API symbols only

Closes #2073.

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

cmd: move lxc-console to API symbols only

Closes #2073.

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

cmd: move lxc-config to API symbols only

Closes #2073.

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

tools: move lxc-clone to API symbols only

Closes #2073.

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

tools: move lxc-checkpoint to API symbols only

Closes #2073.

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

cmd: move lxc-update-config

Closes #2073.

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

cmd: move lxc-monitord

Closes #2073.

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

cmd: move lxc-user-nic

Closes #2073.

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

cmd: move lxc-checkconfig

Closes #2073.

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

cmd: move init.lxc{.static}

Closes #2073.

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

cmd: move lxc-lxc_usernsexec

Closes #2073.

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

tools: move lxc-cgroup to API symbols only

Closes #2073.

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

tools: move lxc-autostart to API symbols only

Closes #2073.

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

tools: lxc-autostart: non-functional changes

Closes #2073.

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

tools: move lxc-attach to API symbols only

Closes #2073.

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

doc: add lxc.namespace.clone + lxc.namespace.keep

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

start: resolve clone flags

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

confile: add lxc.namespace.keep

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

confile: add lxc.namespace.clone

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

confile: lxc.namespace.* -> lxc.namespace.share.*

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Merge pull request #2117 from brauner/2018-01-26/cgroup_v2_support

cgroups: add unified hierarchy support

Merge pull request #2044 from brauner/2017-12-16/lxc_ls_add_unprivileged_field

tools: add UNPRIVILEGED field in fancy output mode

Merge pull request #2130 from tych0/sigterm-handling

Sigterm handling

Merge pull request #2129 from tych0/sigterm-sigkill

lxc-init: use SIGKILL after alarm timeout

lxc.init: ignore SIGHUP

see comment for details.

Signed-off-by: Tycho Andersen <tycho@tycho.ws>

monitor: send SIGTERM to the container when SIGHUP is received

For the ->execute() case, we want to make sure the application dies when
SIGHUP is received. The next patch will ignore SIGHUP in the lxc monitor,
because tasks inside the container send SIGHUP to init to have it reload
its config sometimes, and we don't want to do that with init.lxc, since it
might actually kill the container if it forwards SIGHUP to the child and
the child can't handle it.

Signed-off-by: Tycho Andersen <tycho@tycho.ws>

lxc-init: use SIGKILL after alarm timeout

d76e3e1 inadvertently switched the alarm timeout from sigterm to sigkill.
We really want sigkill here, so let's bring it back.

Signed-off-by: Tycho Andersen <tycho@tycho.ws>

Merge pull request #2126 from flx42/nvidia-visible-devices-change-null-semantic

hooks: change the semantic of NVIDIA_VISIBLE_DEVICES=""

hooks: change the semantic of NVIDIA_VISIBLE_DEVICES=""

With LXC, you can override the value of an environment variable to
null, but you can't unset an existing variable.

The NVIDIA hook was previously activated when NVIDIA_VISIBLE_DEVICES
was set to null. As a result, it was not possible to disable the hook
by overriding the environment variable in the configuration.

The hook can now be disabled by setting NVIDIA_VISIBLE_DEVICES to
null or to the new special value "void".

Signed-off-by: Felix Abecassis <fabecassis@nvidia.com>