cgroups/cgfsng: improve cgroup creation and removal

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Merge pull request #3225 from brauner/cgroup_improvements

cgroups/cgfsng: rework legacy cpuset handling

cgroups/cgfsng: rework cgroup removal

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

cgroups/cgfsng: rework legacy cpuset handling

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

cgroupfs/cgfsng: pass cgroup to cg_legacy_handle_cpuset_hierarchy() as const char *

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Merge pull request #3223 from brauner/flatten_cgroup_hierarchy

cgroups: flatten hierarchy

cgroups: use explicit unsigned type for bitfield

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

cgroups: flatten hierarchy

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Merge pull request #3222 from brauner/security

file_utils: use O_NOCTTY | O_NOFOLLOW

file_utils: use O_NOCTTY | O_NOFOLLOW

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Merge pull request #3218 from brauner/bpf_devices_devpath

cgroups/devices: enable devpath semantics for cgroup2 device controller

cgroups/devices: enable devpath semantics for cgroup2 device controller

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Merge pull request #3217 from brauner/rework_cgroups

cgroups, logging: fixes and improvements

cgroups/cgfsng: replace lxc_write_file()

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

cgroups/cgfsng: cgfsng_devices_activate()

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

cgroups/cgfsng: rework cgfsng_nrtasks()

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

cgroups/cgfsng: rework cgfsng_mount()

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

cgroups/cgfsng: rework cgfsng_chown()

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

cgroups/cgfsng: rework cgfsng_attach()

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

cgroups/cgfsng: rework cgfsng_setup_limits()

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

cgroups/cgfsng: rework cgfsng_setup_limits_legacy()

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

cgroups/cgfsng: rework cgfsng_{get,set}()

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

cgroups/cgfsng: rework cgfsng_unfreeze()

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

cgroups/cgfsng: rework cgfsng_get_hierarchies()

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

cgroups/cgfsng: rework cgfsng_num_hierarchies()

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

cgroups/cgfsng: rework cgfsng_escape()

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

cgroups/cgfsng: rework cgfsng_payload_enter()

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

cgroups/cgfsng: rework cgfsng_payload_create()

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

tree-wide: s/__unused/__lxc_unused/g

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

cgroups/cgfsng: rework cgroup attach

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

cgroups/cgfsng: don't dereference NULL-pointer

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

cgroups/cgfsng: log chown_cgroup_wrapper()

It's becoming more important on cgroup2 to properly delegate cgroups.

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

cgroups/cgfsng: rework cgroup2 unprivileged delegation

We accidently checked files to delegate for privileged container and not for
unprivileged containers in the pure unified case. Fix that and clean up the
delegation file parsing.

Closes #3206.
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

cgroups/cgfsng: rework cgfsng_{monitor,payload}_delegate_controllers()

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

cgroups/cgfsng: rework cgfsng_monitor_enter()

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

cgroups/cgfsng: rework cgfsng_monitor_create()

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

cgroups/cgfsng: rework cgfsng_monitor_destroy()

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

cgroups/cgfsng: rework cgfsng_payload_destroy()

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

log: remove unused compiler attribute

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

start: replace compiler attributes

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

log: replace compiler attributes

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

attach: replace closing helpers

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

compiler: add __unused attribute

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

{log, macro}: remove unused logging functions

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

lxccontainer: replace logging functions

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

confile_utils: replace logging functions

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

cgroups: rework return values of some functions

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

cgroups/cgroup2_devices: replace logging functions

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

cgroups/cgroup: replace logging functions

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

cgroups/cgfsng: replace logging functions

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

confile: replace logging helpers

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

network: replace logging helpers

s/error_log_errno(/log_error_errno(-1, /g
s/minus_one_set_errno(/ret_set_errno(-1, /g

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

commands: replace logging helpers

s/error_log_errno(/log_error_errno(-1, /g
s/minus_one_set_errno(/ret_set_errno(-1, /g

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

attach: s/minus_one_set_errno(/ret_set_errno(-1, /g

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

af_unix: s/minus_one_set_errno(/ret_set_errno(-1, /g

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

macro: add ret_errno()

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

log: rearrange

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Merge pull request #3215 from brauner/cgroup2_controller_delegation

cgroup2: rework controller delegation

cgroup2: rework controller delegation

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Merge pull request #3214 from Rachid-Koucha/patch-1

"busy" field init to -1 instead of 0

Merge pull request #3213 from blenk92/fix-mount-parsing

config: Fix parsing of mount options

"busy" field set to -1 instead of 0

"busy" field is assigned with the command socket descriptor when the terminal is in use. So, use "-1" to disable it.

Signed-off-by: Rachid Koucha <rachid.koucha@gmail.com>

"busy" field set to 1 instead of 0

"busy" field is assigned with the command socket descriptor when the terminal is in use. So, use "-1" to disable it.

Signed-off-by: Rachid Koucha <rachid.koucha@gmail.com>

Init "busy" field to -1 as 0 is valid fd

"busy" field is assigned with the command socket descriptor when the terminal is in use. So, use "-1" to disable it.
Signed-off-by: Rachid Koucha <rachid.koucha@gmail.com>

config: Fix parsing of mount options

When parsing mount options e.g. from lxc.mount.entry the specified
options are mapped to the flags constants. To do so, the strings
are compared to the options contained in mount_opt. However,
when comparing the strings, the length of the string is not
checked. That entails that the option "rootcontext=selinux-context"
is mapped to the mount option read-only (ro). This commit fixes
this issue by checking if a '=' is contained in the specified option
and additionally comparing the length of the strings.

Signed-off-by: Maximilian Blenk <Maximilian.Blenk@bmw.de>

Merge pull request #3204 from brauner/switch_to_spdx

lxc: switch to SPDX

Merge pull request #3207 from brauner/cgroup2_improvements_2

cgroups: improve container cgroup attaching

cgroups/devices: correctly verify bpf device useability in cgfsng_devices_activate()

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

cgroups: improve container cgroup attaching

The current attach.c codepath which handles moving the attaching process into
the container's cgroups allocates a whole new struct cgroup_ops and goes
through the trouble of reparsing the whole cgroup layout.
That's costly and wasteful. My plan has always been to move this into the
command api by getting fds for attaching back but but it's not worth going
through that hazzle for non-unified hosts. On pure unified hosts however -
being the future - we can just attach through a single fd so there's no need to
allocate and setup struct cgroup_ops.

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

lxc: switch to SPDX

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

commands: use logging return helpers

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Merge pull request #3205 from brauner/cgroup2_improvements

cgroup: add command to retrieve cgroup2 fd and rework cgroup2 attach

cgfsng: rework cgroup2 attach

On pure unified systemd we can use a single file descriptor to interact with
the cgroup filesystem. Add a method to retrieve it and as a start use it in our
unified attach codepath.

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

cgroups/devices: do not log error when bpf device feature is not available

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Merge pull request #3203 from brauner/freezer_fixes

freezer: cleanup

Merge pull request #2842 from brauner/2019-02-11/fix_licensing

tree-wide: Fix inconsistent license headers

freezer: cleanup

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Merge pull request #3178 from xinhua9569/master

conf: fix memory leak for set config rootfs options

Merge pull request #3202 from brauner/cgroup2_freezer_fixes

cgroups/freezer: rework cgroup2 freezer feature usage

cgroups/freezer: fix and improve cgroup2 freezer implementation

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

cgroups: add DEFAULT_MOUNTPOINT #define

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Merge pull request #3196 from brauner/cgroup2_devices_fixes_2

cgroups/devices: use dedicated enums

cgroups/devices: use dedicated enums

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Merge pull request #3195 from brauner/cgroup2_devices_fixes

cgroup2: add bpf device controller live update

cgroups/devices: introduce ebpf device cgroup global rule types

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

cgroups/devices: handle NULL

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

configure: enable -Wunused-but-set-variable

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

cgroups/cgfsng: implement cgroup2 device controller live update

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

conf: record cgroup2 devices in parsed format

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

cgroups/cgfsng: "atomically" replace bpf device programs

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

macro: remove unused macros

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

api_extension: add cgroup2_devices api extension

This will only be defined if liblxc was even compiled with bpf supported.
Support itself will be determined at runtime by liblxc itself.

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Merge pull request #3194 from brauner/cgroup2_devices

cgroups: add cgroup2 device controller support

cgroups: add cgroup2 device controller support

Add a bpf-based device controller implementation.

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Merge pull request #3193 from lifeng68/master

cgfsng: return attach fail if container stopped

cgfsng: return attach fail if container stopped

Signed-off-by: LiFeng <lifeng68@huawei.com>

conf: fix memory leak for set config rootfs options

Signed-off-by: dongxinhua <dongxinhua@huawei.com>

Merge pull request #3190 from idatahu/fix_ovs_log

fix wrong order of bridge/nic in error message

fix wrong order of bridge/nic in error message

Signed-off-by: Balázs Póka <poka@idata.hu>

Merge pull request #3189 from Rachid-Koucha/patch-2

Typo in a comment