Merge pull request #2969 from brauner/2019-05-01/seccomp_fixes

seccomp: ensure fields are set to 0

seccomp: ensure fields are set to 0

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Merge pull request #2950 from tomponline/tp-ipvlan

network: Adds IPVLAN support

network: Adds IPVLAN support

Example usage:

lxc.net[i].type=ipvlan
lxc.net[i].ipvlan.mode=[l3|l3s|l2] (defaults to l3)
lxc.net[i].ipvlan.flags=[bridge|private|vepa] (defaults to bridge)
lxc.net[i].link=eth0
lxc.net[i].flags=up

Signed-off-by: tomponline <thomas.parrott@canonical.com>

Merge pull request #2967 from brauner/2019-05-01/seccomp_notifier_api_removal

seccomp: remove alignment requirements

seccomp: remove alignment requirements

since apparently there are insane programming languages out there that just
silently remove packed members in structs.

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Merge pull request #2966 from brauner/2019-05-01/seccomp_notifier_api_removal

seccomp: don't commit to an api just yet

seccomp: don't commit to an api just yet

I'm not sure that I want to be married (to this layout) just yet.

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Merge pull request #2965 from brauner/2019-05-01/seccomp_notifier_fixes

seccomp: notifier fixes

seccomp: notifier fixes

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Merge pull request #2961 from tomponline/tp-static-net-funcs

network: Makes some routing functions static

network: Makes some routing functions static

The following functions can be made static for consistency:

lxc_ipv4_dest_add
lxc_ipv6_dest_add
lxc_ip_route_dest_add (renamed)

Signed-off-by: tomponline <thomas.parrott@canonical.com>

Merge pull request #2960 from tomponline/tp-seccomp-apiext-docs

docs: Adds missing doc entries for seccomp related API extensions

docs: Adds missing doc entries for seccomp related API extensions

Signed-off-by: tomponline <thomas.parrott@canonical.com>

Merge pull request #2949 from tomponline/tp-veth-routes

network: Adds veth static routes feature

Merge pull request #2957 from tomponline/tp-macvlan-mode

network: Fixes bug in macvlan mode selection

network: Fixes bug in macvlan mode selection

Signed-off-by: tomponline <thomas.parrott@canonical.com>

Merge pull request #2956 from brauner/2019-04-29/seccomp_trap_cleanup

seccomp: cleanup

seccomp: cleanup

Simplify and cleanup some of the seccomp code. This mainly focuses on removing
the open coding of various seccomp settings all over the code place in favor of
centralized helpers.

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Merge pull request #2955 from tomponline/tp-ignore-test-build

tests: Updates .gitignore to ignore test build artefacts

Merge pull request #2954 from tomponline/tp-vlan-hook

network: Fixes vlan hook script

tests: Updates .gitignore to ignore test build artefacts

Signed-off-by: tomponline <thomas.parrott@canonical.com>

network: Fixes vlan hook script

Signed-off-by: tomponline <thomas.parrott@canonical.com>

network: Adds support host side veth device static routes

Adds the following new config keys:

lxc.net.[i].veth.ipv4.route
lxc.net.[i].veth.ipv6.route
E.g.

lxc.net.0.veth.ipv4.route = 192.0.2.1/32
lxc.net.0.veth.ipv4.route = 192.0.3.0/24
lxc.net.0.veth.ipv6.route = 2001:db8::1/128
lxc.net.0.veth.ipv6.route = 2001:db8:2::/64

Signed-off-by: tomponline <thomas.parrott@canonical.com>

Merge pull request #2951 from tomponline/tp-typo

network: Fixes a little typo in an error message

Merge pull request #2952 from tomponline/tp-vlan-upscript

network: Adds hook handling for vlan network type

network: Adds upscript handling for vlan network type

Signed-off-by: tomponline <thomas.parrott@canonical.com>

network: Fixes a little typo in an error message

Signed-off-by: tomponline <thomas.parrott@canonical.com>

Merge pull request #2947 from brauner/2019-04-18/seccomp_trap

seccomp: SECCOMP_RET_USER_NOTIF support

start: silence clang

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

api_extensions: add seccomp_notify

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

doc: add lxc.seccomp.notify.proxy

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

seccomp: send default answer and try to reconnect

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

confile: add lxc.seccomp.notify.proxy

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

seccomp: SECCOMP_RET_USER_NOTIF support

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Merge pull request #2948 from pgauret/patch-1

Fix 'zfs get' command order

Fix 'zfs get' command order

Another case of calling 'zfs get' which requires reordering arguments to work with latest zfs.

Signed-off-by: Paul Gauret <pgauret@yahoo.com>

Merge pull request #2946 from tych0/remove-bad-doc

lxc-start: remove bad doc

lxc-start: remove bad doc

We don't in fact exit(1) if this is not specified, and it wouldn't make
sense to, since most people probably don't specify this.

Signed-off-by: Tycho Andersen <tycho@tycho.ws>

Merge pull request #2945 from brauner/2019-04-19/netns_getifaddrs_adapt_to_kernel_changes

netns_getifaddrs: adapt to kernel changes

netns_getifaddrs: adapt to kernel changes

s/NETLINK_DUMP_STRICT_CHK/NETLINK_GET_STRICT_CHK/g

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Merge pull request #2943 from brauner/master

configure: s/LDLAGS/LDFLAGS/

configure: s/LDLAGS/LDFLAGS/

I apparently cannot spell.

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Merge pull request #2940 from brauner/master

raw_syscalls: lxc_raw_clone() account for different trap number on 32bit SPARC

Merge pull request #2941 from flx42/reorder-mounts

conf: do lxc.mount.entry mounts right after lxc.mount.fstab

Merge pull request #2942 from flx42/nvidia-hook-handle-spaces-env

hooks/nvidia: handle spaces in NVIDIA_REQUIRE variables

conf: do lxc.mount.entry mounts right after lxc.mount.fstab

These configuration options use the same syntax and therefore it seems
more intuitive to have the same behavior for both of them, which is
not the case today since mount hooks and autodev mounts are called
between the two.

See: https://github.com/lxc/lxc/issues/2932

Signed-off-by: Felix Abecassis <fabecassis@nvidia.com>

raw_syscalls: lxc_raw_clone()

Account for different trap number on 32bit SPARC.

Link: https://bugs.gentoo.org/656368
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

hooks/nvidia: handle spaces in NVIDIA_REQUIRE variables

Previously, environment variables with a space where splitted.

Signed-off-by: Felix Abecassis <fabecassis@nvidia.com>

Merge pull request #2938 from pgauret/patch-1

Update zfs.c

storage: update zfs

Change zfs arguments. This also works with older zfs versions, tested with
zfs 0.7.9-3 on Ubuntu 18.10.

Closes #2916.

Signed-off-by: Paul Gauret <pgauret@yahoo.com>
[christian.brauner@ubuntu.com: adapt commit message and add Signed-off-by for Paul]
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Merge pull request #2937 from brauner/2019-04-14/issue_2912

storage: prevent unitialized variable warning

Merge pull request #2936 from brauner/2019-04-14/issue_2935

cgroups: fix potential nullderef

storage: prevent unitialized variable warning

We can simply fix this issue by switching to our cleanup macros instead of
manually freeing the memory.

Closes #2912.

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

cgroups: fix potential nullderef

The child_path variable is initialized very late in the function so jumping to
the on_error label would cause a nullderef. With the cleanup macros we can
simplify this function to simply do direct returns and avoid that whole issue.

Closes #2935.

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Merge pull request #2934 from brauner/2019-04-13/simplify_and_test

attach: use tighter scope for fd variable

attach: use tighter scope for fd variable

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Merge pull request #2928 from yosukesan/api_doc_generation_fails_under_out_of_source_build#2927

fix: #2927 api doc generation fails under out of source build.

Merge pull request #2926 from tenforward/japanese

doc: update Japanese lxc-user-nic manpage

fix: #2927 api doc generation fails under out of source build.

Signed-off-by: yosukesan <y.otsuki30@gmail.com>

doc: update Japanese lxc-user-nic manpage

Update for commit db74bbd

Signed-off-by: KATOH Yasufumi <karma@jazz.email.ne.jp>

Merge pull request #2924 from brauner/2019-04-05/lxc_user_nice_update

lxc-user-nic: update

lxc-user-nic: validate request

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Cc: Akihiro Suda <suda.akihiro@lab.ntt.co.jp>

doc: update lxc-user-nic manpage

Closes #1823.

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Cc: Akihiro Suda <suda.akihiro@lab.ntt.co.jp>

lxc-user-nic: small tweaks

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Cc: Akihiro Suda <suda.akihiro@lab.ntt.co.jp>

Merge pull request #2923 from flx42/more-pdeathsig-fixes

More pdeathsig fixes

Fix monitor pdeathsig handling

Signed-off-by: Felix Abecassis <fabecassis@nvidia.com>

Fix user namespace pdeathsig handling

Signed-off-by: Felix Abecassis <fabecassis@nvidia.com>

Merge pull request #2922 from brauner/2019-04-02/ovs_fixes

network: fix network device removal

network: fix network device removal

Closes #2849.

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Merge pull request #2920 from tenforward/update_docs

Update docs

doc: Add the description of apparmor profile generation to man pages

Only add to English and Japanese man pages.

Signed-off-by: KATOH Yasufumi <karma@jazz.email.ne.jp>

doc: Add lxc.rootfs.managed to lxc.container.conf(5)

Only add to English and Japanese man pages.

Signed-off-by: KATOH Yasufumi <karma@jazz.email.ne.jp>

doc: Add lxc.cgroup.relative to lxc.container.conf(5)

Only English and Japanese man pages.

Signed-off-by: KATOH Yasufumi <karma@jazz.email.ne.jp>

Merge pull request #2911 from tomponline/tp-2019-03-19/lvcreate

lvm: Updates lvcreate to wipe signatures if supported

Merge pull request #2910 from tomponline/tp-2019-03-19/travis

Travis: Adds -Wall and -Werror cflags flags to automatic build.

lvm: Updates lvcreate to wipe signatures if supported, fallbacks to old command if not.

Signed-off-by: tomponline <tomp@tomp.uk>

Merge pull request #2917 from tych0/check-init-pid-failures

lxccontainer: check do_lxcapi_init_pid() for failure

lxccontainer: check do_lxcapi_init_pid() for failure

This function can fail, because it uses the command API. If it does fail,
we get weird errors about not being able to open strange proc paths:

xc authyldapservice-c8020e20-e203-e852-90ef-4d378e8d1444 20190323163231.386 ERROR    lxc_utils - utils.c:switch_to_ns:1184 - No such file or directory - failed to open /proc/-104/ns/net

So let's check for errors before then.

Signed-off-by: Tycho Andersen <tycho@tycho.ws>

travis: Attempt to fix src/lxc/cmd/lxc_init.c:251: undefined reference to `pthread_sigmask

Signed-off-by: tomponline <tomp@tomp.uk>

attach: Adds ATTR_UNUSED to fd variable assignment to avoid clang unused variable warnings.

Signed-off-by: tomponline <tomp@tomp.uk>

Travis: Adds -Wall and -Werror gcc flags to automatic build.

Signed-off-by: tomponline <tomp@tomp.uk>

Merge pull request #2907 from brauner/2019-03-12/asan_support

hardening: enable address sanitizer build

hardening: enable address sanitizer build

This adds --{disable,enable}-asan. It is disabled by default.

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Merge pull request #2903 from flx42/fix-pid-namespace-pdeathsig-handling

Fix PID namespace pdeathsig handling

start: fix parent PID passed to lxc_set_death_signal

Fixes: #2902
Signed-off-by: Felix Abecassis <fabecassis@nvidia.com>

utils: fix handling of PID namespaces in lxc_set_death_signal

Signed-off-by: Felix Abecassis <fabecassis@nvidia.com>

Merge pull request #2901 from brauner/2019-03-11/compiler_flags

compiler: hardening

compiler: -fexceptions hardening

This hardens multi-threaded C. Without it, the implementation of thread
cancellation handlers (introduced by pthread_cleanup_push) uses a completely
unprotected function pointer on the stack. This function pointer can simplify
the exploitation of stack-based buffer overflows even if the thread in question
is never canceled.

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

compiler: -pipe

Avoid temporary files, speeding up builds.

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

compiler: -fasynchronous-unwind-tables hardening

Increased reliability of backtraces.

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Merge pull request #2900 from brauner/2019-03-11/2826

btrfs: ensure \0 byte at end

btrfs: ensure \0 byte at end

Apparently the name received from the tree walk is not guaranteed to have \0
byte at the end. So let's make sure we append one.
Note that this is only an issue if there are any subvolumes in the container's
rootfs.

Closes 2826.

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Merge pull request #2898 from brauner/2019-03-10/fix_post_stop_hooks

hooks: drop namespace references before post-stop

hooks: drop namespace references before post-stop

Callers such as LXD run post-stop hooks to perform cleanup operations on
shutdown. This can involve umount and other things. To avoid surprises with
lingering namespace references we should close all our namespace-preserving
file descriptors. We don't need them at this point anymore anyway.

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Merge pull request #2897 from TheSeven/master

Fix lxc.cgroup2.<controller> on cgroup2-only systems

Fix lxc.cgroup2.<controller> on cgroup2-only systems

Signed-off-by: Michael Sparmann <theseven@gmx.net>

Merge pull request #2896 from brauner/lxc/master

conf: avoid compiler warning

conf: avoid compiler warning

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Revert "conf: Fixes unitialised variable."

This reverts commit 912c4bb474b52284cf82c336b0af161be6c25ac1.

I accidently merged this commit. The initialization is wrong.

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>