coverity: #1425742

fix error condition check

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

coverity: #1425740

free allocated memory

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

coverity: #1425739

check snprintf() return value

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

coverity: #1425737

free allocated memory

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

coverity: #1425735

use correct inequality comparison

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

coverity: #1425734

free memory on error

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Merge pull request #1994 from brauner/2017-12-04/bugfixes

attach: do not fail on non-existing namespaces

Merge pull request #1996 from brauner/2017-12-04/reenable_coverity_scan

test: Coverity scan integration

Merge pull request #2004 from brauner/2017-12-06/fix_log_env_variable

start: set loglevel correctly

start: set loglevel correctly

We want the loglevel that the user specified when starting the container
because it overrides the default one set in the config.

Closes #2003.

Reported-by: Felix Abecassis <fabecassis@nvidia.com>
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

arguments: move to tools/ subdirectory

The arguments.{c,h} file should not be a part of liblxc itself. It should only
be used for the lxc tools.

Signed-off-by: RicardoSanchezA <ricardo.sanchez@utexas.edu>
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Merge pull request #2002 from tenforward/japanese

Add lxc.console.*, lxc.namespace.*, and lxc.init.cwd to Japanese lxc.container.conf(5)

doc: Add lxc.init.cwd to Japanese lxc.container.conf(5)

Signed-off-by: KATOH Yasufumi <karma@jazz.email.ne.jp>

doc: Add lxc.namespace.[namespace identifier] to Japanese lxc.container.conf(5)

and fix the description of namespace inheritance

Signed-off-by: KATOH Yasufumi <karma@jazz.email.ne.jp>

doc: Add lxc.console.buffer.* and lxc.console.rotate to Japanese lxc.container.conf(5)

and update the description of lxc.console.logfile

Signed-off-by: KATOH Yasufumi <karma@jazz.email.ne.jp>

Merge pull request #1992 from lifeng68/add_init_cwd

confile:add lxc.init.cwd

confile:add lxc.init.cwd

Signed-off-by: LiFeng <lifeng68@huawei.com>

Merge pull request #2000 from hallyn/2017-12-04/execargs

lxc_execute: properly figure out number of needed arguments

lxc_execute: properly figure out number of needed arguments

The lxc_log args have noghing to do with lxc.rootfs.path, and
we need room for a NULL at end of arguments.

How this bug was hidden for so long I don't know - I can only
trigger it on certain systems under certain conditions, but it's
definately wrong as is.

Signed-off-by: Serge Hallyn <shallyn@cisco.com>

test: reenable Coverity integration

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

attach: do not fail on non-existing namespaces

Closes #1993.

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Merge pull request #1979 from marcosps/issue_494

lxc_unshare: Add uid_mapping when creating userns

Merge pull request #1988 from abbasally5/feature-improve-bash-completion-1236

Add bash completion to list backing store types for lxc-create -B

Merge pull request #1989 from p-l-/fix-lxc-checkconfig

Fix lxc-checkconfig output

Merge pull request #1981 from brauner/2017-12-01/fix_android_sethostname

utils: declare sethostname() static inline

criu: silence static analysis

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

confile: remove dead assignment

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

criu: initialize status

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

confile_legacy: prevent null pointer deref

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

conf: prevent null pointer dereference

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Insert missing "echo" after "is_enabled"

Signed-off-by: Pierre LALET <pierre.lalet@cea.fr>

Fix SETCOLOR_FAILURE evaluation

Signed-off-by: Pierre LALET <pierre.lalet@cea.fr>

Add bash completion to list backing store types for lxc-create -B
- Backing Store types are hard-coded (Not sure how to get programmatically)
- Closes #1236

Signed-off-by: Abbas Ally <abbasally5@yahoo.com>

Merge pull request #1984 from CC-Hsu/patch-1

Add new dependency to Slackware template

Add new dependency to Slackware template

I followed the [changelog of Slackware-current]<http://www.slackware.com/changelog/>,
and found that Slackware-current split hostname utility from util-linux package in Nov 17 2017.
So I add the new package to the template.

Signed-off-by: Chia-Chun Hsu <a12321aabb@gmail.com>

Merge pull request #1983 from iDarkTemplar/update_template

Update gentoo.moresecure.conf.

Update gentoo.moresecure.conf.

Closes https://github.com/lxc/lxc/issues/1928

Signed-off-by: i.Dark_Templar <darktemplar@dark-templar-archives.net>

lxc_unshare: Add uid_mapping when creating userns

Change conf.c to export function write_id_mapping, which will now be
called inside main function of lxc_unshare.c.

This is required because setuid syscalls only permits a new userns to
set a new uid if the uid of parameter is mapped inside the ns using
uid_map file[1]. So, just after the clone invocation, map the uid passed as
parameter into the newly created user namespace, and put the current uid
as the ID-outside-ns. After the mapping is done, setuid call succeeds.

Closes: #494
[1] https://elixir.free-electrons.com/linux/latest/source/kernel/user_namespace.c#L286

Signed-off-by: Marcos Paulo de Souza <marcos.souza.org@gmail.com>

utils: declare sethostname() static inline

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Merge pull request #1980 from flx42/lxc-oci-layer-caching

OCI layer caching + misc fixes

lxc-oci: support skopeo layer caching

This requires skopeo version 0.1.25

Signed-off-by: Felix Abecassis <fabecassis@nvidia.com>

lxc-oci: support index files with multiple manifests

Previously, the output would contain "null" strings in this case.

Signed-off-by: Felix Abecassis <fabecassis@nvidia.com>

lxc-oci: rely on jq instead of sed to transform values

Signed-off-by: Felix Abecassis <fabecassis@nvidia.com>

lxc-oci: remove unhelpful comment

Signed-off-by: Felix Abecassis <fabecassis@nvidia.com>

lxc-oci: cleanup temporary download directory if umoci is interrupted

Signed-off-by: Felix Abecassis <fabecassis@nvidia.com>

Merge pull request #1955 from flx42/confile-fix-misc-issues

Fix errors in configuration file parsing

confile_utils: simplify lxc_config_net_hwaddr

In addition to the memory corruption fixed in ee3e84df78424d26fc6c90862fbe0fa92a686b0d,
this function was also performing invalid memory accesses for the following inputs:
- `lxc.net`
- `lxc.net.`
- `lxc.net.0.`
- `lxc.network`
- `lxc.network.0.`

Signed-off-by: Felix Abecassis <fabecassis@nvidia.com>

confile: error out if a network configuration key has no subkey

This prevent an infinite recursion in the case of "lxc.net.0. = a"

Signed-off-by: Felix Abecassis <fabecassis@nvidia.com>

log: fix infinite loop with multiple lxc.log.syslog keys

This caused the linked list of appenders to loop on itself, creating
an infinite logging loop in `__lxc_log_append`.

Signed-off-by: Felix Abecassis <fabecassis@nvidia.com>

tests: add a function for negative netdev tests

Signed-off-by: Felix Abecassis <fabecassis@nvidia.com>

confile: fix memory leak

Signed-off-by: Felix Abecassis <fabecassis@nvidia.com>

Merge pull request #1932 from 3XX0/dhclient-hook

hooks: add dhclient hooks

Merge pull request #1958 from AustinReichert/tools-refactor-lxc-wait

tools/lxc_wait: removed internal logging

Merge pull request #1959 from AustinReichert/tools-refactor-lxc-usernsexec

tools/lxc_usernsexec: removed internal logging

Merge pull request #1960 from AustinReichert/tools-refactor-lxc-unfreeze

tools/lxc_unfreeze: removed internal logging

Merge pull request #1961 from AustinReichert/tools-refactor-lxc-top

tools/lxc_top: removed internal logging

Merge pull request #1962 from AustinReichert/tools-refactor-lxc-stop

tools/lxc_stop: removed internal logging

Merge pull request #1963 from AustinReichert/tools-refactor-lxc-start

tools/lxc_start: removed internal logging

Merge pull request #1964 from AustinReichert/tools-refactor-lxc-snapshot

tools/lxc_snapshot: removed internal logging

Merge pull request #1966 from AustinReichert/tools-refactor-lxc-ls

tools/lxc_ls: remove internal logging

Merge pull request #1965 from AustinReichert/tools-refactor-lxc-monitor

tools/lxc_monitor: removed internal logging

Merge pull request #1967 from AustinReichert/tools-refactor-lxc-info

tools/lxc_info: removed internal logging

Merge pull request #1968 from AustinReichert/tools-refactor-lxc-freeze

tools/lxc_freeze: remove internal logging

Merge pull request #1969 from AustinReichert/tools-refactor-lxc-execute

tools/lxc_execute: removed internal logging

Merge pull request #1957 from AustinReichert/tools-refactor-lxc-unshare

tools/lxc_unshare: removed internal logging

Merge pull request #1970 from AustinReichert/tools-refactor-lxc-device

tools/lxc_device: remove internal logging

Merge pull request #1971 from AustinReichert/tools-refactor-lxc-destroy

tools/lxc_destroy: remove internal logging

Merge pull request #1972 from AustinReichert/tools-refactor-lxc-create

tools/lxc_create: remove internal logging

Merge pull request #1973 from AustinReichert/tools-refactor-lxc-copy

tools/lxc_copy: remove internal logging

Merge pull request #1974 from AustinReichert/tools-refactor-lxc-console

tools/lxc_console: remove internal logging

Merge pull request #1975 from AustinReichert/tools-refactor-lxc-clone

tools/lxc_clone: remove internal logging

tools/lxc_wait: removed internal logging

Signed-off-by: AustinReichert <austinskyreichert@utexas.edu>

tools/lxc_usernsexec: removed internal logging

Signed-off-by: AustinReichert <austinskyreichert@utexas.edu>

tools/lxc_unshare: removed internal logging

Signed-off-by: AustinReichert <austinskyreichert@utexas.edu>

tools/lxc_unfreeze: removed internal logging

Signed-off-by: AustinReichert <austinskyreichert@utexas.edu>

tools/lxc_top: removed internal logging

Signed-off-by: AustinReichert <austinskyreichert@utexas.edu>

tools/lxc_stop: removed internal logging

Signed-off-by: AustinReichert <austinskyreichert@utexas.edu>

tools/lxc_start: removed internal logging

Signed-off-by: AustinReichert <austinskyreichert@utexas.edu>

tools/lxc_snapshot: removed internal logging

Signed-off-by: AustinReichert <austinskyreichert@utexas.edu>

tools/lxc_monitor: removed internal logging

Signed-off-by: AustinReichert <austinskyreichert@utexas.edu>

tools/lxc_copy: remove internal logging

Signed-off-by: AustinReichert <austinskyreichert@utexas.edu>

tools/lxc_ls: remove internal logging

Signed-off-by: AustinReichert <austinskyreichert@utexas.edu>

tools/lxc_info: removed internal logging

Signed-off-by: AustinReichert <austinskyreichert@utexas.edu>

tools/lxc_freeze: remove internal logging

Signed-off-by: AustinReichert <austinskyreichert@utexas.edu>

tools/lxc_execute: removed internal logging

Signed-off-by: AustinReichert <austinskyreichert@utexas.edu>

tools/lxc_device: remove internal logging

Signed-off-by: AustinReichert <austinskyreichert@utexas.edu>

tools/lxc_destroy: remove internal logging

Signed-off-by: AustinReichert <austinskyreichert@utexas.edu>

tools/lxc_create: remove internal logging

Signed-off-by: AustinReichert <austinskyreichert@utexas.edu>

tools/lxc_console: remove internal logging

Signed-off-by: AustinReichert <austinskyreichert@utexas.edu>

tools/lxc_clone: remove internal logging

Signed-off-by: AustinReichert <austinskyreichert@utexas.edu>

Merge pull request #1952 from marcosps/duplicated_sethostname

utils.h: Avoid duplicated sethostname implementation

Merge pull request #1954 from AustinReichert/tools-refactor-lxc-autostart

tools/lxc_autostart: remove internal logging

Merge pull request #1953 from AustinReichert/tools-refactor-lxc-cgroup

tools/lxc_cgroup: remove internal logging

tools/lxc_autostart: remove internal logging

Signed-off-by: AustinReichert <austinskyreichert@utexas.edu>

tools/lxc_cgroup: remove internal logging

Signed-off-by: AustinReichert <austinskyreichert@utexas.edu>

utils.h: Avoid duplicated sethostname implementation

Move duplicated implementatin of sethostname from conf.c and
lxc_unshare.c to utils.h

Signed-off-by: Marcos Paulo de Souza <marcos.souza.org@gmail.com>

Merge pull request #1949 from marcosps/issue_84

Use AX_PTHREAD config script to detect pthread api

seccomp: filter syscalls based on arguments

In order to support filtering syscalls based on arguments the seccomp version 2
specification is extended to the following form:

syscall_name action [index,value,op,valueTwo] [index,value,op]...

where the arguments of the tuple [index,value,valueTwo,op] have the following
meaning:
1. index (uint32_t):
   The index of the syscall argument.
2. value (uint64_t):
   The value for the syscall argument specified by "index".
3. valueTwo (uint64_t, optional):
   The value for the syscall argument specified by "index". This optional value
   is only valid in conjunction with SCMP_CMP_MASKED_EQ.
4. op (string):
   The operator for the syscall argument. Valid operators are the constants
   - SCMP_CMP_NE        (!=)
   - SCMP_CMP_LE        (<=)
   - SCMP_CMP_EQ        (==)
   - SCMP_CMP_GE        (>=)
   - SCMP_CMP_GT        (>)
   - SCMP_CMP_MASKED_EQ (&=)
   as defined by libseccomp >= v2.3.2.
   For convenience liblxc also understands the standard operator notation
   indicated in brackets after the libseccomp constants above as an equivalent
   notation.
Note that it is legal to specify multiple entries for the same syscall.

An example for an extended seccomp version 2 profile is:

2
blacklist allow
reject_force_umount  # comment this to allow umount -f;  not recommended
[all]
kexec_load errno 1 [0,1,SCMP_CMP_LE][3,1,==][5,1,SCMP_CMP_MASKED_EQ,1]
open_by_handle_at errno 1
init_module errno 1
finit_module errno 1
delete_module errno 1
unshare errno 9 [0,0x10000000,SCMP_CMP_EQ]
unshare errno 2 [0,0x20000000,SCMP_CMP_EQ]

Closes #1564.

Signed-off-by: LiFeng <lifeng68@huawei.com>
Reviewed-by: Christian Brauner <christian.brauner@ubuntu.com>

Use AX_PTHREAD config script to detect pthread api

Closes: #84
Signed-off-by: Marcos Paulo de Souza <marcos.souza.org@gmail.com>

start.c: always switch uid and gid

Signed-off-by: Yifeng Tan <tanyifeng1@huawei.com>
Reviewed-by: Christian Brauner <christian.brauner@ubuntu.com>