Merge pull request #2753 from brauner/2018-12-13/remove_sigwinch_cmd

terminal: remove sigwinch command

Merge pull request #2755 from brauner/2018-12-16/rootfs_managed

storage: do not destroy pre-existing rootfs

Merge pull request #2773 from brauner/2018-01-09/fix_cgroup_deletion

cgfsng: do not free container_full_path on error

Merge pull request #2770 from brauner/2018-01-07/container_copy

lxccontainer: fix container copy

Merge pull request #2771 from brauner/2018-01-07/seccomp_nesting_support

confile: add lxc.seccomp.allow_nesting

cgfsng: do not free container_full_path on error

Closes #2741.

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

confile: add lxc.seccomp.allow_nesting

This adds the lxc.seccomp.allow_nesting api extension. If
lxc.seccomp.allow_nesting is set to 1 then seccomp profiles will be
stacked. This way nested containers can load their own seccomp policy on
top of the policy that the outer container might have applied.

Cc: Simon Fels <simon.fels@canonical.com>
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

lxccontainer: fix container copy

We need to strip the prefix from the container's source path before
trying to update the file.

Closes #2380.

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Merge pull request #2768 from caglar10ur/revert-2763-dangling

Revert "Set c to NULL after freeing it"

Revert "Set c to NULL after freeing it"

Signed-off-by: S.Çağlar Onur <caglar@10ur.org>

Merge pull request #2767 from Blub/2019-01-04/use-syserror-on-write-error

conf: use SYSERROR on lxc_write_to_file errors

conf: use SYSERROR on lxc_write_to_file errors

Signed-off-by: Wolfgang Bumiller <w.bumiller@proxmox.com>

Merge pull request #2763 from caglar10ur/dangling

Set c to NULL after freeing it

Set c to NULL after freeing it

Signed-off-by: S.Çağlar Onur <caglar@10ur.org>

Merge pull request #2757 from brauner/2018-12-17/mount_injection_file

lxccontainer: fix mount api (mount_injection_file)

lxccontainer: fix mount api (mount_injection_file)

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

storage: do not destroy pre-existing rootfs

Closes #2752.

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Re-enable lxc_devel

Signed-off-by: Stéphane Graber <stgraber@ubuntu.com>

Release LXC 3.1.0

Signed-off-by: Stéphane Graber <stgraber@ubuntu.com>

terminal: remove sigwinch command

SIGWINCH is handled in lxc_terminal_signalfd_cb().

I cannot for the life of me figure out what this is supposed to do.
Afaict, it scans a global list that is totally unnecessary and also
let's say you have 100 ttys and for a single one SIGWINCH is sent. In
that case the whole list is walked and two ioctl()s are performed: one
to get window size one to set window size. For 99 of them the window
size hasn't changed.
If we see issues we can revert!

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Merge pull request #2751 from xorond/cgroup

fix #2742: lxc-cgroup not giving output

tools: add newline to lxc-cgroup output

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

fix lxc-cgroup not giving output

lxc-cgroup fails to provide any output since the latest version, this
should fix it

Signed-off-by: Oguz Bektas <o.bektas@proxmox.com>

Merge pull request #2749 from brauner/2018-12-11/storage_utils

storage: src cannot be truncated

storage: remove unused function

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Merge pull request #2747 from ffontaine/master

configure.ac: fix build without stack-protector

configure.ac: fix build without stack-protector

Compiler based hardening (including -fstack-protector-strong) are
enabled since version 3.0.3 and
https://github.com/lxc/lxc/commit/2268c27754152aa538db2c9e3753d72d19bcd17a

However, some compilers could missed the needed library (-lssp or
-lssp_nonshared) at linking step so use ax_check_link_flag instead of
ax_check_compile_flag

Fixes:
 - http://autobuild.buildroot.org/results/0b90e7dca2984652842832a41abad93ac49a9b86

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>

Merge pull request #2745 from ffontaine/master

stringutils: include stdarg for va_list

stringutils: include stdarg for va_list

Fixes:
 - http://autobuild.buildroot.org/results/0b90e7dca2984652842832a41abad93ac49a9b86

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>

Merge pull request #2743 from 2xsec/build

fix install error when using --disable-commands option

Merge pull request #2740 from CameronNemo/usernsexec

lxc-usernsexec: fix default map functionality

fix install error when using --disable-commands option

Signed-off-by: 2xsec <dh48.jeong@samsung.com>

lxc-usernsexec: fix default map functionality

* Place NULL bytes at the end of strings so that
  lxc_safe_ulong() can parse them correctly

* Only free the newly created id_map on error,
  to avoid passing garbage to lxc_map_ids()

Signed-off-by: Cameron Nemo <camerontnorman@gmail.com>

Merge pull request #2739 from tenforward/japanese

Add allowrunning option into Japanese lxc-copy(1)

Add allowrunning option into Japanese lxc-copy(1)

Update for commit 754076f

Signed-off-by: KATOH Yasufumi <karma@jazz.email.ne.jp>

Merge pull request #2737 from 2xsec/docs

doc: Add -a, --allowrunning arg to Korean lxc-copy(1)

doc: Add -a, --allowrunning arg to Korean lxc-copy(1)

Signed-off-by: 2xsec <dh48.jeong@samsung.com>

Merge pull request #1943 from bhelm/master

Added allowrunning command line option for snapshotting running containers

Merge pull request #2732 from brauner/2018-11-21/remove_freezer_requirement

cgfsng: remove freezer requirement

cgfsng: remove freezer requirement

The freezer controller has been made optional in all other codepaths so
don't require it.

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Merge pull request #2731 from rst0git/master

autotools: fix lxc-{create,copy} build

autotools: fix lxc-{create,copy} build

After commit 2b670df lxc-create and lxc-copy fails with "undefined
symbol: get_fssize".

Closes #2730

Signed-off-by: Radostin Stoyanov <rstoyanov1@gmail.com>

Merge pull request #2728 from brauner/2018-11-19/keyctl_non_fatal

utils: make keyring allocation failure non-fatal

utils: make keyring allocation failure non-fatal

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Merge pull request #2727 from Blub/2018-11-16/apparmor.ro-bind-remount-combinations

apparmor: allow various remount,bind options

apparmor: allow various remount,bind options

RW bind mounts need to be restricted for some paths in
order to avoid MAC restriction bypasses, but read-only bind
mounts shouldn't have that problem.

Additionally, combinations of 'nosuid', 'nodev' and
'noexec' flags shouldn't be a problem either and are
required with newer systemd versions, so let's allow those
as long as they're combined with 'ro,remount,bind'.

Signed-off-by: Wolfgang Bumiller <w.bumiller@proxmox.com>

Merge pull request #2725 from tomponline/tp-lvcreate

Adds -qq flags to lvcreate commands

Adds -qq flags to lvcreate commands to avoid answer 'no' to ant questions the LVM subsystem asks to avoid hanging lxc-create command

Signed-off-by: tomponline <tomp@tomp.uk>

Merge pull request #2723 from 2xsec/bugfix

pam_cgfs: remove dependency & redundancy functions

utils: add errno logs for exception case

Signed-off-by: 2xsec <dh48.jeong@samsung.com>

utils: fix coding styles

Signed-off-by: 2xsec <dh48.jeong@samsung.com>

pam_cgfs: remove dependency from cap & log

Signed-off-by: 2xsec <dh48.jeong@samsung.com>

cgfs: remove redundancy utils

Signed-off-by: 2xsec <dh48.jeong@samsung.com>

pam_cgfs: remove redundancy file utils

Signed-off-by: 2xsec <dh48.jeong@samsung.com>

Merge pull request #2722 from brauner/lxc/master

conf: s/ty/tty/g

conf: s/ty/tty/g

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Merge pull request #2720 from 2xsec/bugfix

replace read & write syscalls with nointr functions

Merge pull request #2721 from 2xsec/tizen

dlog: move match_dlog_fds()

dlog: move match_dlog_fds()

Signed-off-by: 2xsec <dh48.jeong@samsung.com>

log: replace write with lxc_write_nointr

Signed-off-by: 2xsec <dh48.jeong@samsung.com>

caps: replace read with lxc_read_nointr

Signed-off-by: 2xsec <dh48.jeong@samsung.com>

Merge pull request #2719 from ssup2/master

Fix spacing error in namespace.c

Fix spacing error in namespace.c

Signed-off-by: Jungsub Shin supsup5642@tmax.co.kr

Merge pull request #2717 from brauner/2018-11-02/fix_android

include: correctly include macro.h

include: correctly include macro.h

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

coverity: move to separate branch

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Merge pull request #2715 from 2xsec/bugfix

lxcmntent: coding rules

Merge pull request #2716 from 2xsec/tizen

log: fix too wide or inconsistent non-owner permissions

log: fix too wide or inconsistent non-owner permissions

Signed-off-by: 2xsec <dh48.jeong@samsung.com>

string_utils: coding rules

Signed-off-by: 2xsec <dh48.jeong@samsung.com>

lxcmntent: coding rules

Signed-off-by: 2xsec <dh48.jeong@samsung.com>

Merge pull request #2714 from brauner/2018-11-01/remove_accidental_debug_statements

confile: remove debug printf()s

confile: remove debug printf()s

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Merge pull request #2713 from brauner/2018-10-30/mount_injection

conf: expand shmounts lxc.mount.auto option

lxccontainer: fix temporary path removal

Needed-by: https://github.com/lxc/lxd/issues/5227
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

conf: don't setup shared mountpoint for shmounts

Leave it up to the caller for now until we have a clear way to do
this without causing double mounts etc.

Needed-by: https://github.com/lxc/lxd/issues/5227
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

conf: expand shmounts lxc.mount.auto option

Allow users to specify a path in the container they want to use.
This will help LXD.

Needed-by: https://github.com/lxc/lxd/issues/5227
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Merge pull request #2712 from jsoref/spelling

Spelling

Merge pull request #2710 from 2xsec/tizen

dlog: inherit dlog fds

Merge pull request #2709 from 2xsec/bugfix

storage_utils: add error handling

spelling: without

Signed-off-by: Josh Soref <jsoref@gmail.com>

spelling: userns

Signed-off-by: Josh Soref <jsoref@gmail.com>

spelling: unsigned

Signed-off-by: Josh Soref <jsoref@gmail.com>

spelling: timeout

Signed-off-by: Josh Soref <jsoref@gmail.com>

spelling: syscall

Signed-off-by: Josh Soref <jsoref@gmail.com>

spelling: successfully

Signed-off-by: Josh Soref <jsoref@gmail.com>

spelling: subtracting

Signed-off-by: Josh Soref <jsoref@gmail.com>

spelling: specify

Signed-off-by: Josh Soref <jsoref@gmail.com>

spelling: specified

Signed-off-by: Josh Soref <jsoref@gmail.com>

spelling: snapshotting

Signed-off-by: Josh Soref <jsoref@gmail.com>

spelling: securityfs

Signed-off-by: Josh Soref <jsoref@gmail.com>

spelling: root

Signed-off-by: Josh Soref <jsoref@gmail.com>

spelling: returns

Signed-off-by: Josh Soref <jsoref@gmail.com>

spelling: potentially

Signed-off-by: Josh Soref <jsoref@gmail.com>

spelling: portion

Signed-off-by: Josh Soref <jsoref@gmail.com>

spelling: pertains

Signed-off-by: Josh Soref <jsoref@gmail.com>

spelling: perhaps

Signed-off-by: Josh Soref <jsoref@gmail.com>

spelling: passphrase

Signed-off-by: Josh Soref <jsoref@gmail.com>

spelling: override

Signed-off-by: Josh Soref <jsoref@gmail.com>

spelling: overridden

Signed-off-by: Josh Soref <jsoref@gmail.com>