netlink: add __netlink_{send,recv,transaction}

These allow to pass a struct nlmsghdr directly and are used in the higher level
netlink_{send,rcv,transaction}.

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Merge pull request #2520 from brauner/2018-08-11/fix_netnsid_allocation

netns: improve netnsid allocation

start: make netnsid allocation failures non-fatal

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

netns: improve netnsid allocation

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

macro: add NLMSG_ERROR

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Merge pull request #2519 from 2xsec/bugfix

fix assignment of signed to bigger unsigned issue

fix assignment of signed to bigger unsigned issue

Signed-off-by: 2xsec <dh48.jeong@samsung.com>

Merge pull request #2516 from 2xsec/bugfix

tests: containertests: fix dereference pointer c

fix tainted int loop bound issue

Signed-off-by: 2xsec <dh48.jeong@samsung.com>

tests: containertests: fix dereference pointer c

Signed-off-by: 2xsec <dh48.jeong@samsung.com>

Merge pull request #2518 from brauner/2018-08-09/network_netns_id

network: type fixes lxc_netns_set_nsid()

network: type fixes lxc_netns_set_nsid()

The kernel expects a __s32 for NETNSA_NSID and a __u32 for NETNSA_FD.

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Merge pull request #2515 from brauner/2018-02-06/network_netns_id

netns: allocate network namespace id

netns: vendor NETNSA_*

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

travis: add linux-libc-dev

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

macro: move network macros from utils.h

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

netns: allocate network namespace id

Start to allocate a new network namespace id for each container.

Relates to https://github.com/lxc/lxd/issues/4831.

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

MAINTAINERS: add Wolfgang Bumiller

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Merge pull request #2513 from brauner/2018-08-06/fix_busybox

templates: avoid endless loop

CVE 2018-6556: verify netns fd in lxc-user-nic

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

templates: avoid endless loop

Closes #2512.

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Merge pull request #2495 from 2xsec/bugfix

add default log priority & cleanups

Merge pull request #2511 from 2xsec/coverity

fix coverity issues

coverity: #1438232

Failure to restore non-local value

Signed-off-by: 2xsec <dh48.jeong@samsung.com>

pam_cgfs: cleanups

Signed-off-by: 2xsec <dh48.jeong@samsung.com>

coverity: #1438231

Dereference after null check

Signed-off-by: 2xsec <dh48.jeong@samsung.com>

coverity: #1438230

Logically dead code

Signed-off-by: 2xsec <dh48.jeong@samsung.com>

coverity: #1438229

Resource leak

Signed-off-by: 2xsec <dh48.jeong@samsung.com>

coverity: #1438233

Resource leak

Signed-off-by: 2xsec <dh48.jeong@samsung.com>

coverity: #1438234

Resource leak

Signed-off-by: 2xsec <dh48.jeong@samsung.com>

coverity: #1438235

Resource leak

Signed-off-by: 2xsec <dh48.jeong@samsung.com>

coverity: #1438236

Resource leak

Signed-off-by: 2xsec <dh48.jeong@samsung.com>

tools: lxc-unshare: apply default log priority

Signed-off-by: 2xsec <dh48.jeong@samsung.com>

log: add default log priority

Signed-off-by: 2xsec <dh48.jeong@samsung.com>

log: function cleanups

Signed-off-by: 2xsec <dh48.jeong@samsung.com>

Merge pull request #2510 from brauner/2018-08-05/cap_fixes

tree-wide: pass unsigned long to prctl()

tree-wide: pass unsigned long to prctl()

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Merge pull request #2508 from brauner/2018-08-04/cap_fixes

macro: add new macro header, caps: bugfixes, log: bugfixes

log: bugfixes

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

caps: bugfixes

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

macro: add new macro header

This allows us to use a bunch of macros in our static build for init.lxc.static
without having to link against all of utils.{c,h}.

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

travis: export CFLAGS=-O0 for coverity

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

travis: build with -O0 for coverity

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Merge pull request #2505 from brauner/2018-07-31/bugfixes

coverity: #438136

READEM: update Serge's mail address

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Cc: Serge Hallyn <serge@hallyn.com>

coverity: #438136

String not null terminated

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Merge pull request #2503 from tenforward/japanese

doc: Add incompatibility with network type=none into Japanese man

doc: Add incompatibility with network type=none into Japanese man

Update for commit e4b3e36

Signed-off-by: KATOH Yasufumi <karma@jazz.email.ne.jp>

Merge pull request #2499 from brauner/lxc/master

bugfixes

Merge pull request #2475 from brauner/2018-07-16/monitor_signal_pdeath

conf: improve rootfs setup

Merge pull request #2502 from brauner/2018-07-27/fix_max_devpts_option

conf: mount devpts without "max" on EINVAL

conf: don't return a clobbered errno value

Signed-off-by: Wolfgang Bumiller <w.bumiller@proxmox.com>

conf: mount devpts without "max" on EINVAL

The "max" option to devpts got introduced in kernel 3.4.

Closes #2490.

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Merge pull request #2500 from akosiaris/patch-1

Unprivileged's incompatibility with type=none docs

Unprivileged's incompatibility with type=none docs

Unprivileged containers are not compatible with sharing the
host namespace due to an inability to mount sysfs. Add docs
in lxc.container.conf to document that out.

Refs #2463

Signed-off-by: Alexandros Kosiaris <akosiaris@gmail.com>

caps: handle EINTR in read()

We don't want to link caps.{c,h} against utils.{c,h} for the sake of our static
builds init.lxc.static. This means lxc_write_nointr() will not be available. So
handle it EINTR.

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

log: handle EINTR in read()

We don't want to link log.{c,h} against utils.{c,h} for the sake of our static
builds init.lxc.static. This means lxc_write_nointr() will not be available. So
handle it EINTR.

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

utils: s/read()/lxc_read_nointr()/g

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

terminal: s/read()/lxc_read_nointr()/g

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

monitor: s/write()/lxc_write_nointr()/g

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

monitor: s/read()/lxc_read_nointr()/g

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

apparmor: s/read()/lxc_read_nointr()/g

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

tools: s/write()/lxc_write_nointr()/g

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

tools: s/read()/lxc_read_nointr()/g

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

sync: s/write()/lxc_write_nointr()/g

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

sync: s/read()/lxc_read_nointr()/g

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

network: s/write()/lxc_write_nointr()/g

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

network: s/read()/lxc_read_nointr()/g

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

lxccontainer: s/read()/lxc_read_nointr()/g

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

lxccontainer: s/write()/lxc_write_nointr()/g

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

criu: s/write()/lxc_write_nointr()/g

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

criu: s/read()/lxc_read_nointr()/g

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

cmd: s/read()/lxc_read_nointr()/g

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

cmd: s/write()/lxc_write_nointr()/g

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

cmd: s/pipe()/pipe2()/g

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

lxccontainer: s/pipe()/pipe2()/g

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

lxccontainer: cleanup do_lxcapi_get_interfaces()

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

criu: s/pipe()/pipe2()/

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

conf: always close pipe in run_userns_fn()

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

conf: s/pipe()/pipe2()/g

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Merge pull request #2497 from brauner/2018-07-29/nl_fix

nl: avoid NULL pointer dereference

nl: avoid NULL pointer dereference

It's a valid case to call nla_put() with NULL data and 0 len. It's done e.g. in
the nla_put_attr().

There has to be a check for data in nla_put() as passing NULL to the memcpy()
is not allowed. Even if length is 0, both pointers have to be valid.

For a reference see C99 standard (7.21.1/2), it says: "pointer arguments on
such a call shall still have valid values".

Reported-by: Daniel Gimpelevich <daniel@gimpelevich.san-francisco.ca.us>
Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
[christian.brauner@ubuntu.com: adapted commit message]
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

confile: split mount options into flags and data

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

conf: improve rootfs setup

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Merge pull request #2496 from flx42/nvidia-hook-lgpl

Fix license of the nvidia hook

Fix license of the nvidia hook

Fixes: #2494
Signed-off-by: Felix Abecassis <fabecassis@nvidia.com>

Merge pull request #2493 from brauner/2018-07-26/bugfixes

utils: add lxc_iterate_parts(), compile with -Wvla and -std=gnu11

autotools: default to -Wvla -std=gnu11

We can't really support anything less than gcc-4.8 anyway.

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

include: remove VLAs

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

tests: remove VLAs

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Makefile: add missing lxctest.h

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

utils: s/strtok_r()/lxc_iterate_parts()/g

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

tools: s/strtok_r()/lxc_iterate_parts()/g

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

storage: s/strtok_r()/lxc_iterate_parts()/g

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

state: s/strtok_r()/lxc_iterate_parts()/g

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

parse: s/strtok_r()/lxc_iterate_parts()/g

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

namespace: s/strtok_r()/lxc_iterate_parts()/g

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

lxccontainer: s/strtok_r()/lxc_iterate_parts()/g

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

confile: s/strtok_r()/lxc_iterate_parts()/g

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

conf: s/strtok_r()/lxc_iterate_parts()/g

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>