Merge pull request #1992 from lifeng68/add_init_cwd

confile:add lxc.init.cwd

confile:add lxc.init.cwd

Signed-off-by: LiFeng <lifeng68@huawei.com>

Merge pull request #2000 from hallyn/2017-12-04/execargs

lxc_execute: properly figure out number of needed arguments

lxc_execute: properly figure out number of needed arguments

The lxc_log args have noghing to do with lxc.rootfs.path, and
we need room for a NULL at end of arguments.

How this bug was hidden for so long I don't know - I can only
trigger it on certain systems under certain conditions, but it's
definately wrong as is.

Signed-off-by: Serge Hallyn <shallyn@cisco.com>

Merge pull request #1979 from marcosps/issue_494

lxc_unshare: Add uid_mapping when creating userns

Merge pull request #1988 from abbasally5/feature-improve-bash-completion-1236

Add bash completion to list backing store types for lxc-create -B

Merge pull request #1989 from p-l-/fix-lxc-checkconfig

Fix lxc-checkconfig output

Merge pull request #1981 from brauner/2017-12-01/fix_android_sethostname

utils: declare sethostname() static inline

Insert missing "echo" after "is_enabled"

Signed-off-by: Pierre LALET <pierre.lalet@cea.fr>

Fix SETCOLOR_FAILURE evaluation

Signed-off-by: Pierre LALET <pierre.lalet@cea.fr>

Add bash completion to list backing store types for lxc-create -B
- Backing Store types are hard-coded (Not sure how to get programmatically)
- Closes #1236

Signed-off-by: Abbas Ally <abbasally5@yahoo.com>

Merge pull request #1984 from CC-Hsu/patch-1

Add new dependency to Slackware template

Add new dependency to Slackware template

I followed the [changelog of Slackware-current]<http://www.slackware.com/changelog/>,
and found that Slackware-current split hostname utility from util-linux package in Nov 17 2017.
So I add the new package to the template.

Signed-off-by: Chia-Chun Hsu <a12321aabb@gmail.com>

Merge pull request #1983 from iDarkTemplar/update_template

Update gentoo.moresecure.conf.

Update gentoo.moresecure.conf.

Closes https://github.com/lxc/lxc/issues/1928

Signed-off-by: i.Dark_Templar <darktemplar@dark-templar-archives.net>

lxc_unshare: Add uid_mapping when creating userns

Change conf.c to export function write_id_mapping, which will now be
called inside main function of lxc_unshare.c.

This is required because setuid syscalls only permits a new userns to
set a new uid if the uid of parameter is mapped inside the ns using
uid_map file[1]. So, just after the clone invocation, map the uid passed as
parameter into the newly created user namespace, and put the current uid
as the ID-outside-ns. After the mapping is done, setuid call succeeds.

Closes: #494
[1] https://elixir.free-electrons.com/linux/latest/source/kernel/user_namespace.c#L286

Signed-off-by: Marcos Paulo de Souza <marcos.souza.org@gmail.com>

utils: declare sethostname() static inline

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Merge pull request #1980 from flx42/lxc-oci-layer-caching

OCI layer caching + misc fixes

lxc-oci: support skopeo layer caching

This requires skopeo version 0.1.25

Signed-off-by: Felix Abecassis <fabecassis@nvidia.com>

lxc-oci: support index files with multiple manifests

Previously, the output would contain "null" strings in this case.

Signed-off-by: Felix Abecassis <fabecassis@nvidia.com>

lxc-oci: rely on jq instead of sed to transform values

Signed-off-by: Felix Abecassis <fabecassis@nvidia.com>

lxc-oci: remove unhelpful comment

Signed-off-by: Felix Abecassis <fabecassis@nvidia.com>

lxc-oci: cleanup temporary download directory if umoci is interrupted

Signed-off-by: Felix Abecassis <fabecassis@nvidia.com>

Merge pull request #1955 from flx42/confile-fix-misc-issues

Fix errors in configuration file parsing

confile_utils: simplify lxc_config_net_hwaddr

In addition to the memory corruption fixed in ee3e84df78424d26fc6c90862fbe0fa92a686b0d,
this function was also performing invalid memory accesses for the following inputs:
- `lxc.net`
- `lxc.net.`
- `lxc.net.0.`
- `lxc.network`
- `lxc.network.0.`

Signed-off-by: Felix Abecassis <fabecassis@nvidia.com>

confile: error out if a network configuration key has no subkey

This prevent an infinite recursion in the case of "lxc.net.0. = a"

Signed-off-by: Felix Abecassis <fabecassis@nvidia.com>

log: fix infinite loop with multiple lxc.log.syslog keys

This caused the linked list of appenders to loop on itself, creating
an infinite logging loop in `__lxc_log_append`.

Signed-off-by: Felix Abecassis <fabecassis@nvidia.com>

tests: add a function for negative netdev tests

Signed-off-by: Felix Abecassis <fabecassis@nvidia.com>

confile: fix memory leak

Signed-off-by: Felix Abecassis <fabecassis@nvidia.com>

Merge pull request #1932 from 3XX0/dhclient-hook

hooks: add dhclient hooks

Merge pull request #1958 from AustinReichert/tools-refactor-lxc-wait

tools/lxc_wait: removed internal logging

Merge pull request #1959 from AustinReichert/tools-refactor-lxc-usernsexec

tools/lxc_usernsexec: removed internal logging

Merge pull request #1960 from AustinReichert/tools-refactor-lxc-unfreeze

tools/lxc_unfreeze: removed internal logging

Merge pull request #1961 from AustinReichert/tools-refactor-lxc-top

tools/lxc_top: removed internal logging

Merge pull request #1962 from AustinReichert/tools-refactor-lxc-stop

tools/lxc_stop: removed internal logging

Merge pull request #1963 from AustinReichert/tools-refactor-lxc-start

tools/lxc_start: removed internal logging

Merge pull request #1964 from AustinReichert/tools-refactor-lxc-snapshot

tools/lxc_snapshot: removed internal logging

Merge pull request #1966 from AustinReichert/tools-refactor-lxc-ls

tools/lxc_ls: remove internal logging

Merge pull request #1965 from AustinReichert/tools-refactor-lxc-monitor

tools/lxc_monitor: removed internal logging

Merge pull request #1967 from AustinReichert/tools-refactor-lxc-info

tools/lxc_info: removed internal logging

Merge pull request #1968 from AustinReichert/tools-refactor-lxc-freeze

tools/lxc_freeze: remove internal logging

Merge pull request #1969 from AustinReichert/tools-refactor-lxc-execute

tools/lxc_execute: removed internal logging

Merge pull request #1957 from AustinReichert/tools-refactor-lxc-unshare

tools/lxc_unshare: removed internal logging

Merge pull request #1970 from AustinReichert/tools-refactor-lxc-device

tools/lxc_device: remove internal logging

Merge pull request #1971 from AustinReichert/tools-refactor-lxc-destroy

tools/lxc_destroy: remove internal logging

Merge pull request #1972 from AustinReichert/tools-refactor-lxc-create

tools/lxc_create: remove internal logging

Merge pull request #1973 from AustinReichert/tools-refactor-lxc-copy

tools/lxc_copy: remove internal logging

Merge pull request #1974 from AustinReichert/tools-refactor-lxc-console

tools/lxc_console: remove internal logging

Merge pull request #1975 from AustinReichert/tools-refactor-lxc-clone

tools/lxc_clone: remove internal logging

tools/lxc_wait: removed internal logging

Signed-off-by: AustinReichert <austinskyreichert@utexas.edu>

tools/lxc_usernsexec: removed internal logging

Signed-off-by: AustinReichert <austinskyreichert@utexas.edu>

tools/lxc_unshare: removed internal logging

Signed-off-by: AustinReichert <austinskyreichert@utexas.edu>

tools/lxc_unfreeze: removed internal logging

Signed-off-by: AustinReichert <austinskyreichert@utexas.edu>

tools/lxc_top: removed internal logging

Signed-off-by: AustinReichert <austinskyreichert@utexas.edu>

tools/lxc_stop: removed internal logging

Signed-off-by: AustinReichert <austinskyreichert@utexas.edu>

tools/lxc_start: removed internal logging

Signed-off-by: AustinReichert <austinskyreichert@utexas.edu>

tools/lxc_snapshot: removed internal logging

Signed-off-by: AustinReichert <austinskyreichert@utexas.edu>

tools/lxc_monitor: removed internal logging

Signed-off-by: AustinReichert <austinskyreichert@utexas.edu>

tools/lxc_copy: remove internal logging

Signed-off-by: AustinReichert <austinskyreichert@utexas.edu>

tools/lxc_ls: remove internal logging

Signed-off-by: AustinReichert <austinskyreichert@utexas.edu>

tools/lxc_info: removed internal logging

Signed-off-by: AustinReichert <austinskyreichert@utexas.edu>

tools/lxc_freeze: remove internal logging

Signed-off-by: AustinReichert <austinskyreichert@utexas.edu>

tools/lxc_execute: removed internal logging

Signed-off-by: AustinReichert <austinskyreichert@utexas.edu>

tools/lxc_device: remove internal logging

Signed-off-by: AustinReichert <austinskyreichert@utexas.edu>

tools/lxc_destroy: remove internal logging

Signed-off-by: AustinReichert <austinskyreichert@utexas.edu>

tools/lxc_create: remove internal logging

Signed-off-by: AustinReichert <austinskyreichert@utexas.edu>

tools/lxc_console: remove internal logging

Signed-off-by: AustinReichert <austinskyreichert@utexas.edu>

tools/lxc_clone: remove internal logging

Signed-off-by: AustinReichert <austinskyreichert@utexas.edu>

Merge pull request #1952 from marcosps/duplicated_sethostname

utils.h: Avoid duplicated sethostname implementation

Merge pull request #1954 from AustinReichert/tools-refactor-lxc-autostart

tools/lxc_autostart: remove internal logging

Merge pull request #1953 from AustinReichert/tools-refactor-lxc-cgroup

tools/lxc_cgroup: remove internal logging

tools/lxc_autostart: remove internal logging

Signed-off-by: AustinReichert <austinskyreichert@utexas.edu>

tools/lxc_cgroup: remove internal logging

Signed-off-by: AustinReichert <austinskyreichert@utexas.edu>

utils.h: Avoid duplicated sethostname implementation

Move duplicated implementatin of sethostname from conf.c and
lxc_unshare.c to utils.h

Signed-off-by: Marcos Paulo de Souza <marcos.souza.org@gmail.com>

Merge pull request #1949 from marcosps/issue_84

Use AX_PTHREAD config script to detect pthread api

seccomp: filter syscalls based on arguments

In order to support filtering syscalls based on arguments the seccomp version 2
specification is extended to the following form:

syscall_name action [index,value,op,valueTwo] [index,value,op]...

where the arguments of the tuple [index,value,valueTwo,op] have the following
meaning:
1. index (uint32_t):
   The index of the syscall argument.
2. value (uint64_t):
   The value for the syscall argument specified by "index".
3. valueTwo (uint64_t, optional):
   The value for the syscall argument specified by "index". This optional value
   is only valid in conjunction with SCMP_CMP_MASKED_EQ.
4. op (string):
   The operator for the syscall argument. Valid operators are the constants
   - SCMP_CMP_NE        (!=)
   - SCMP_CMP_LE        (<=)
   - SCMP_CMP_EQ        (==)
   - SCMP_CMP_GE        (>=)
   - SCMP_CMP_GT        (>)
   - SCMP_CMP_MASKED_EQ (&=)
   as defined by libseccomp >= v2.3.2.
   For convenience liblxc also understands the standard operator notation
   indicated in brackets after the libseccomp constants above as an equivalent
   notation.
Note that it is legal to specify multiple entries for the same syscall.

An example for an extended seccomp version 2 profile is:

2
blacklist allow
reject_force_umount  # comment this to allow umount -f;  not recommended
[all]
kexec_load errno 1 [0,1,SCMP_CMP_LE][3,1,==][5,1,SCMP_CMP_MASKED_EQ,1]
open_by_handle_at errno 1
init_module errno 1
finit_module errno 1
delete_module errno 1
unshare errno 9 [0,0x10000000,SCMP_CMP_EQ]
unshare errno 2 [0,0x20000000,SCMP_CMP_EQ]

Closes #1564.

Signed-off-by: LiFeng <lifeng68@huawei.com>
Reviewed-by: Christian Brauner <christian.brauner@ubuntu.com>

Use AX_PTHREAD config script to detect pthread api

Closes: #84
Signed-off-by: Marcos Paulo de Souza <marcos.souza.org@gmail.com>

start.c: always switch uid and gid

Signed-off-by: Yifeng Tan <tanyifeng1@huawei.com>
Reviewed-by: Christian Brauner <christian.brauner@ubuntu.com>

Merge pull request #1947 from brauner/2017-11-24/fix_cap_sys_admin_declaration

conf: move CAP_SYS_* definitions to utils.h

conf: move CAP_SYS_* definitions to utils.h

Closes #1946.

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Merge pull request #1944 from dnegreira/lxc_spec_in_typo_fix

Fixed typo on lxc.spec.in

Fixed typo on lxc.spec.in

Signed-off-by: David Negreira David@otherreality.net

Merge pull request #1939 from brauner/2017-11-22/more_elaborate_config_update_message

doc: documents lxc.namespace.[namespace identifier] + confile: improve legacy update message

Merge pull request #1941 from flx42/lxc-oci-improve-import

Improve lxc-oci.in

doc: document lxc.namespace.[namespace identifier]

Closes #1924.

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

lxc-oci: add support for registry authentication

Signed-off-by: Felix Abecassis <fabecassis@nvidia.com>

lxc-oci: import common.conf and userns.conf

Signed-off-by: Felix Abecassis <fabecassis@nvidia.com>

lxc-oci: import the environment variables

Signed-off-by: Felix Abecassis <fabecassis@nvidia.com>

lxc-oci: add utility function to retrieve the path of the config file

Signed-off-by: Felix Abecassis <fabecassis@nvidia.com>

confile: improve legacy update message

Closes #1938.

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

lxc-oci: write /etc/hosts

Signed-off-by: Felix Abecassis <fabecassis@nvidia.com>

lxc-oci: write /etc/hostname

Signed-off-by: Felix Abecassis <fabecassis@nvidia.com>

lxc-oci: support unprivileged umoci unpacking

Signed-off-by: Felix Abecassis <fabecassis@nvidia.com>

Merge pull request #1936 from Cypresslin/user-del-mute

lxc-test-unpriv: check user existence before removing it

Merge pull request #1935 from flx42/confile-overlapping-strncpy

confile_utils: fix overlapping strncpy

lxc-test-unpriv: check user existence before removing it

Check the test user (lxcunpriv) before calling deluser command,
otherwise it will print unnecessary error message:
/usr/sbin/deluser: The user 'lxcunpriv' does not exist.

Signed-off-by: Po-Hsu Lin <po-hsu.lin@canonical.com>

confile_utils: fix overlapping strncpy

In the case of "lxc.net.0.type", the pointers passed to strncpy were
only 2 elements apart, resulting in undefined behavior.

Signed-off-by: Felix Abecassis <fabecassis@nvidia.com>

Merge pull request #1933 from 3XX0/init-control-tty

lxc_init: set the control terminal in the child session

lxc_init: set the control terminal in the child session

Signed-off-by: Jonathan Calmels <jcalmels@nvidia.com>

hooks: add dhclient hooks

Add new hooks leveraging dhclient from the host to automatically
configure the container interfaces. This is especially useful for
application containers which rely on an IPAM driver for network
configuration (e.g. Docker).

Signed-off-by: Jonathan Calmels <jcalmels@nvidia.com>