tree-wide: replace problematic terminology

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

tree-wide: remove problematic terminology

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

seccomp: replace problematic terminology

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

common.conf: replace problematic terminology

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Merge pull request #3865 from brauner/2021-06-14.listen_fds

Add support for LISTEN_FDS environment variable.

Add support for LISTEN_FDS environment variable.

The LISTEN_FDS environment variable defines the number of
file descriptors that should be inherited by the container,
in addition to stdio.
The LISTEN_FDS environment variable is defined in the OCI spec
and used to support socket activation.

Refs #3845

Signed-off-by: Ruben Jenster <r.jenster@drachenfels.de>
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Merge pull request #3864 from lifeng68/master

string utils: Make sure don't return uninitialized memory.

string utils: Make sure don't return uninitialized memory.

The function lxc_string_split_quoted and lxc_string_split_and_trim use
realloc to reduce the memory. But the result may be NULL, the the
returned memory will be uninitialized

Signed-off-by: LiFeng <lifeng68@huawei.com>

Merge pull request #3861 from brauner/2021-06-08.fixes.2

api_extensions: introduce idmapped_mounts_v2 api extension

api_extensions: introduce idmapped_mounts_v2 api extension

This indicates that LXC supports idmapping the rootfs and
idmapped lxc.mount.entry entries.

Link: https://github.com/lxc/lxd/issues/8870
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Merge pull request #3860 from brauner/2021-06-08.fixes

tools/lxc_autostart: fix failed count

tools/lxc_autostart: fix failed count

Don't include skipped containers in the failed count.

Fixes: #3857
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Merge pull request #3856 from brauner/2021-06-07.fixes

lsm/apparmor: actually report an error when we fail to wire AppArmor …

lsm/apparmor: actually report an error when we fail to wire AppArmor profile

Link: https://bugs.launchpad.net/ubuntu-kernel-tests/+bug/1931064
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Merge pull request #3854 from brauner/2021-06-03.fixes

lxc: add lpthread to lxc.pc

lxc: add lpthread to lxc.pc

Fixes: #3853
Suggested-by: Tycho Andersen <tycho@tycho.pizza>
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Merge pull request #3852 from pablofsf/lxc-net-nftables

Update lxc-net to support nftables

Update lxc-net to support nftables

Closes #3093
Closes #3602

Add support for nftables firewall rules if `nft` command line
interface is available in the system

Signed-off-by: Pablo Correa Gómez <ablocorrea@hotmail.com>

Merge pull request #3851 from brauner/2021-05-25.fixes

fixes

network: please broken compilers

Some users report that compilation fails because of reports that this
variable can be used uninitialized. Initialize it to silence the
compiler.

Fixes: https://github.com/lxc/lxc/issues/3850
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Merge pull request #3849 from stgraber/master

README: Update IRC

README: Update IRC

Signed-off-by: Stéphane Graber <stgraber@ubuntu.com>

Merge pull request #3848 from brauner/2021-05-21.fixes

start: rework fd synchronization

start: simplify startup synchronization

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

start: reorder START_SYNC_POST_CONFIGURE

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

start: use barrier instead of wake/wait pair

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

conf: use explicit signage in bit field

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

conf: move file descriptor synchronization with parent into single function

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

conf: move file descriptor synchronization with child into single function

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

cgroups: rework check whether legacy hierarchy is writable

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Merge pull request #3846 from brauner/2021-05-19.fixes

conf: fix mount option parsing

conf: fix mount option parsing

Fixes: Coverity 1484906
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Merge pull request #3843 from brauner/2021-05-17.idmapped.lxc.mount.entry

conf: support idmapped lxc.mount.entry entries

confile: free mount data

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

conf: add sequence when setting up idmapped mounts

Make sure we catch any weird behavior.

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

conf: support idmapped lxc.mount.entry entries

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Merge pull request #3844 from CecilHarvey/master

Skip rootfs pinning for read-only file system.

Skip rootfs pinning for read-only file system.

Signed-off-by: Wei Mingzhi <weimingzhi@baidu.com>

conf: rename struct mount_opt flag member s/flag/legacy_flag/

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

tree-wide: s/parse_mntopts/parse_mntopts_legacy/

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Merge pull request #3842 from brauner/2021-05-14.fixes

start: move idmapped mount setup later

start: move idmapped mount setup later

At the prior location we we're placed between sending and receiving
networking information over the data socket causing the startup to fail.

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Merge pull request #3840 from brauner/2021-05-12.fixes.rootfs

conf: fix containers without rootfs

conf: tweak rootfs handling

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

conf: don't unmount procfs and sysfs

Fixes: #3838
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

conf: allow xdev when setting up /dev

Fixes: #3838
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Merge pull request #3837 from brauner/2021-05-10.fixes.cgroup

cgroups: clean up cgroup_ops on initialization error

cgroups: clean up cgroup_ops on initialization error

Fixes: #3836
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Merge pull request #3826 from brauner/2021-05-04.fuzz.cgroup

oss-fuzz: add basic cgroup_init()/cgroup_exit() fuzzing

Merge pull request #3834 from brauner/2021-05-10.fixes

tests: fix lxc-test-arch-parse for make dist

tests: fix lxc-test-arch-parse for make dist

Fixes: https://jenkins.linuxcontainers.org/job/lxc-build-tarballs/2762/console
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Merge pull request #3833 from brauner/2021-05-09.fixes

confile: re-add aarch64 architecture

tests: add tests for supported architectures

Ensure that we detect all supported architectures and don't regress
recognizing them.

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

confile: re-add aarch64 architecture

Apparenty we dropped this when we cleaned up architecture handling.

Fixes: #3832
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Merge pull request #3831 from sjuxax/zfs-fix

Skip rootfs pinning for ZFS roots.

Reflow ZFS check to follow the style of the overlayfs return.

Per https://github.com/lxc/lxc/pull/3831#discussion_r628865713

Signed-off-by: Jeff Cook <jeff@jeffcook.io>

Skip rootfs pinning for ZFS roots.

Signed-off-by: Jeff Cook <jeff@jeffcook.io>

Merge pull request #3829 from brauner/2021-05-07.fixes

doc: document new idmap= option for lxc.rootfs.options

doc: document new idmap= option for lxc.rootfs.options

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Merge pull request #3827 from brauner/2021-05-06.cap_setfcap

conf: handle kernels with CAP_SETFCAP

conf: handle kernels with CAP_SETFCAP

LXC is being very clever and sometimes maps the caller's uid into the
child userns. This means that the caller can technically write fscaps
that are valid in the ancestor userns (which can be a security issue in
some scenarios) so newer kernels require CAP_SETFCAP to do this. Until
newuidmap/newgidmap are updated to account for this simply write the
mapping directly in this case.

Cc: stable-4.0
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

oss-fuzz: add basic cgroup_init()/cgroup_exit() fuzzing

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Merge pull request #3825 from brauner/2021-05-04.fixes

lxc.arch fixes

attach: introduce explicit personality macro

Introduce LXC_ATTACH_DETECT_PERSONALITY to make it explicit what is
happening instead of using -1.

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

conf: add personality_t

Catch errors in personality handling better.

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

attach_options: unbreak header

In a moment of idioticity I switch -1 with 0xffffffff in the header
definition but we use -1 to autodetect.

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

conf: rework lxc_config_parse_arch()

Fix architecture parsing. So far we couldn't really differ between "want
default architecture" and "failed to parse requested architecture"
because the -1 return value means both. Fix this by using the return
value only to indicate success or failure and return the parsed
personality in a return argument.

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

conf: tweak setup_personality()

Use the dedicated LXC_ARCH_UNCHANGED macro everywhere instead of relying
on -1 being correct.

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

tree-wide: make personality codepaths unconditional

Now that we have the infra to make personality handling unconitional
remove the ifndefs everywhere.

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

syscalls: wrap personality syscall if undefined

There's no need to making personality handling conditional as it has
been around for such a long time that only weird systems wouldn't have
support for it. And especially if the user requested a specific
personality to be set but the system doesn't support the personality
syscall we should loudly fail instead of moving on.

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

commands: log at debug not info level when receiving file descriptors

Don't spam the logs because we do receive a lot of file descriptors.

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

confile: make per_name struct static

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Merge pull request #3823 from evverx/gcc-11-workaround

string_utils: get around GCC-11 false positives

Merge pull request #3824 from evverx/sanitizers-follow-ups

github: remove the dh-* packages

string_utils: get around GCC-11 false positives

by getting rid of stpncpy

Tested with gcc (GCC) 11.1.1 20210428 (Red Hat 11.1.1-1)

Closes https://github.com/lxc/lxc/issues/3752

Signed-off-by: Evgeny Vereshchagin <evvers@ya.ru>

github: also pass the j option to make

Signed-off-by: Evgeny Vereshchagin <evvers@ya.ru>

github: remove the dh-* packages

We don't build any packages there so it seems we don't need
those packages any more. Apart from that, it should make the
script work on Ubuntu Hirsute where dh-systemd was merged into
debhelper and is no longer available.

Signed-off-by: Evgeny Vereshchagin <evvers@ya.ru>

Merge pull request #3819 from dev-aaront-org/console-mode-messages

conf: fix console chmod error log messages

Merge pull request #3822 from stgraber/master

github: Run apt-get update in sanitizer test

Merge pull request #3820 from brauner/2021-05-03.lxc_monitord.log

lxc_monitord: remove monitord log

github: Run apt-get update in sanitizer test

Signed-off-by: Stéphane Graber <stgraber@ubuntu.com>

lxc_monitord: remove monitord log

The tool is effectively unused with current master so removing the log
should be ok by now. Let's remove the log to avoid issues such as #3747.

Fixes #3747
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Merge pull request #3818 from evverx/disable-logs-on-oss-fuzz

oss-fuzz: always turn off logging on OSS-Fuzz

conf: fix console chmod error log messages

Signed-off-by: Aaron Thompson <dev@aaront.org>

Merge pull request #3817 from brauner/2021-04-30.fixes

cgroups: fix fallback attach codepath

cgroups: fix fallback attach codepath

When we attach to an old server the server can return ENOSYS instead of
ENOCGROUP2 which causes LXC to abort the attach unnecessary. Fix this!

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Merge pull request #3816 from brauner/2021-04-30/fixes

storage: fix dup_cloexec() call

oss-fuzz: always turn off logging on OSS-Fuzz

Apparently /proc/self/cmd can't be used (reliably) on OSS-Fuzz to figure out
whether the code is run inside the fuzz targets, which causes the
fuzz targets to fill the filesystem with log files.

Related: https://github.com/google/oss-fuzz/issues/5509
Should address https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=33835

Signed-off-by: Evgeny Vereshchagin <evvers@ya.ru>

storage: fix dup_cloexec() call

Fixes: Coverity 1477399
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Merge pull request #3814 from brauner/2021-04-28.fixes

api-extensions: add entry for idmapped_mounts

api-extensions: add entry for idmapped_mounts

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Merge pull request #3812 from brauner/2021-04-28.fixes

storage/dir: cleanup mount code

Merge pull request #3802 from evverx/build-system-fuzzers

oss-fuzz: switch to --enable-fuzzers

storage/dir: cleanup mount code

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

storage/dir: remove error handling down

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

storage/dir: source can't be empty

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

storage/dir: use "source" and "target" as terms

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

storage/dir: retrieve proper source path later

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

storage/dir: use clear error messages

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

storage/dir: bdev->dest can't be empty

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>