Merge pull request #3934 from brauner/2021-08-12.fixes

cgroups: cpumask fixes

cgroups: s/calloc/zalloc/g

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

cgroups: fix cpu bitmasks

Link: https://discuss.linuxcontainers.org/t/lxc-4-0-9-lxc-start-sigabrt-on-systems-with-defined-offline-cpus-and-a-total-number-of-cpus-divisible-by-32
Signed-off-by: Jim Ferrigno <jim.ferrigno@oracle.com>
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Merge pull request #3899 from denisfa/master

Improve bash completion experience.

Merge pull request #3932 from brauner/2021-08-11.fixes

mainloop: further io_uring fixes

mainloop: disable IORING_SETUP_SQPOLL for now

It's a bit more complicated to use then I envisioned here.

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

mainloop: add comments about multishot and oneshot cleanup

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

mainloop: s/handler_name/name/g

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Merge pull request #3931 from brauner/2021-08-11.fixes

memory_utils: make cleanup handler as unused

mainloop: move variables into tighter scope

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

memory_utils: make cleanup handler as unused

They are sometimes used to just clean something up automatically at end
of scope but the variables themselves might not be actually used.

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Merge pull request #3930 from brauner/2021-08-10.fixes

mainloop: io_uring cleanup handling fixes

mainloop: fix io_uring cleanup handling

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

mainloop: remove CANCEL_RAISE flag

This is really not needed since we're not checking it anywhere anyway.

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

mainloop: minor fixes

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Merge pull request #3928 from simondeziel/download-user-agent

lxc-download: customize the user-agent to include LXC package version and compat level

Merge pull request #3929 from tych0/fix-sys-poll-warning

mainloop: s,sys/poll,poll

mainloop: s,sys/poll,poll

I get the following warning (which then fails the build because of
-Werror):

In file included from mainloop.c:11:
/usr/include/sys/poll.h:1:2: error: #warning redirecting incorrect #include <sys/poll.h> to <poll.h> [-Werror=cpp]
    1 | #warning redirecting incorrect #include <sys/poll.h> to <poll.h>
      |  ^~~~~~~

Signed-off-by: Tycho Andersen <tycho@tycho.pizza>

lxc-download: add LXC version/compat level to user-agent

Signed-off-by: Simon Deziel <simon.deziel@canonical.com>

Merge pull request #3924 from brauner/2021-06-04.io_uring

mainloop: io_uring support

mainloop: add io_uring support

Users can choose to compile liblxc with io_uring support. This will
cause LXC to use io_uring instead of epoll.
We're using both, io_uring's one-shot and multi-shot poll mode depending
on the type of handler.

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Merge pull request #3927 from tomponline/tp-nic-address-broadcast

doc: Adds mention of ability to specify manual IPv4 broadcast address

doc: Adds mention of ability to specify manual IPv4 broadcast address

See also https://github.com/lxc/lxd/pull/9103

Signed-off-by: Thomas Parrott <thomas.parrott@canonical.com>

tree-wide: s/lxc_epoll_descr/lxc_async_descr/g

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

conf: log session keyring failure on WARN level

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

cgroups: log at warning instead of error level

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Merge pull request #3926 from stgraber/master

doc/api-extensions: Grammar fix

doc/api-extensions: Grammar fix

Signed-off-by: Stéphane Graber <stgraber@ubuntu.com>

Merge pull request #3925 from brauner/2021-08-09.fixes

lsm/apparmor: small fixes

lsm/apparmor: use cleanup macro

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

lsm/apparmor: log failure to write AppArmor profile

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Merge pull request #3923 from brauner/2021-08-05.fixes

network: fix container with empty network namespaces

network: fix container with empty network namespaces

Fixes: #3922
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Merge pull request #3921 from brauner/2021-08-03.fixes

conf: rootfs mount option fixes

tests: add test for rootfs mount options

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

conf: allow mount options for rootfs when using new mount api

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

mount_utils: make some mount helpers static inline

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

conf: let parse_vfs_attr() handle legacy mount flags as well

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

conf: log failure to create tty mountpoint

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Merge pull request #3920 from brauner/2021-08-02.fixes

mount_utils: introduce mount_at()

conf: refactor lxc_recv_ttys_from_child()

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

conf: fix logging in lxc_idmapped_mounts_child()

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

mount_utils: introduce mount_at()

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Merge pull request #3919 from brauner/2021-07-31.devpts

terminal: handle kernel without TIOCGPTPEER

terminal: fail on unknown error during TIOCGPTPEER

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

terminal: move native terminal allocation from error logging to info

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

conf: handle kernels without TIOCGPTPEER

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Merge pull request #3918 from brauner/2021-07-30.devpts

conf: rework console setup

start: allow containers to use a native console

After all of the previous rework we can make it possible for a container
to use a console allocated from the container's devpts instance.

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

terminal: remove unused argument from lxc_devpts_terminal()

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

conf: rework console setup

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

file_utils: add open_at_same()

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

conf: use mount_fd() during console mounting

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

conf: use mount_fd() in lxc_setup_dev_console()

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

conf: use mount_fd() helper when mounting ttys

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

mount_utils: add mount_fd()

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

conf: stash pty_nr in struct lxc_terminal

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Merge pull request #3916 from brauner/2021-07-29.fixes

conf: move remaining setup before pivot root

conf: move lxc_create_ttys() before pivot root

This is the last setup step that occured after pivot root.

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

terminal: split out lxc_devpts_terminal() helper

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Merge pull request #3915 from brauner/2021-07-29.fixes

string_utils: cast __s64 to long long signed int

string_utils: cast __s64 to long long signed int

Link: https://launchpadlibrarian.net/550723147/buildlog_snap_ubuntu_focal_ppc64el_lxd-latest-edge_BUILDING.txt.gz
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Merge pull request #3914 from brauner/2021-07-29.devpts

devpts: move setup before pivot root

conf: merge devpts setup and move before pivot root

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

terminal: don't use ttyname_r() for native terminal allocation

Since we can call that function from another mount namespace we need to
do this manually.

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

conf: add and use mount_beneath_fd()

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

conf: update comment

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

conf: use a relative path in symlinkat()

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

conf: s/lxc_setup_devpts_parent/lxc_recv_devpts_from_child/g

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

conf: attach devpts mount directly when new mount api can be used

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

conf: set source property for devpts

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

conf: surface failures to setup console

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Merge pull request #3912 from brauner/2021-07-28.devpts

conf: devpts rework

Merge pull request #3913 from stgraber/master

Fix typos

Fix typos

This fixes all typos identified by lintian.

Signed-off-by: Stéphane Graber <stgraber@ubuntu.com>

conf: ensure devpts_fd is set to -EBADF

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

terminal: ttyname_r() returns an error number on failure

In other words, how inconsistent can an API be?

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

conf: use new mount api for devpts setup

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Merge pull request #3910 from petris/tty_enxio

lxc_setup_ttys: Handle existing ttyN file without underlying device

Merge pull request #3909 from petris/bpf_enosys_warn

bpf: simplify detection if BPF is supported

Merge pull request #3911 from siv0/fix_legacy_cgroup_devices

Fix legacy cgroup devices

bpf: bpf_devices_cgroup_supported() should check if bpf() is available

bpf_devices_cgroup_supported() tries to load a simple BPF program to
test if BPF works. This is problematic because the function used to load
the program - bpf_program_load_kernel() - emits an error to the log if
BPF is not enabled in the kernel although device controller is not
requested in the configuration. Users could interpret that as a problem.

Make bpf_devices_cgroup_supported() check if the BPF syscall is available
before calling bpf_program_load_kernel(). We can do it by passing a NULL
pointer instead of the syscall argument as the kernel returns either
ENOSYS, when the syscall is not implemented or EFAULT, when it is
implemented.

Signed-off-by: Petr Malat <oss@malat.biz>

lxc_setup_ttys: Handle existing ttyN file without underlying device

If a device file is opened and there isn't the underlying device,
the open call fails with ENXIO, but the path can be opened with
O_PATH, which is enough for mounting over the device file.

Generalize this idea and use O_PATH for all cases when the file
is there. One still must check for both ENXIO and EEXIST as it's
unspecified what error is reported if multiple error conditions
occur at the same time.

Signed-off-by: Petr Malat <oss@malat.biz>

cgroups: remove unneeded variables from cgroup_tree_create

Signed-off-by: Stoiko Ivanov <s.ivanov@proxmox.com>

cgroups: populate hierarchy for device cgroup

With the changes introduced in:
b7b1e3a34ce28b01206c48227930ff83d399e7b6
the hierarchy-struct did not have the path_lim set anymore, which is
needed by setup_limits_legacy (->cg_legacy_set_data->lxc_write_openat)
to actually access the cgroup directory.

The issue can be reproduced with a container config having
```
lxc.cgroup.devices.deny = a
```
(or any lxc.cgroup.devices entry) set on a system booted with
systemd.unified_cgroup_hierarchy=0.

This affects all privileged containers on PVE (due to the default
devices.deny entry).

Signed-off-by: Stoiko Ivanov <s.ivanov@proxmox.com>

Merge pull request #3908 from brauner/2021-07-15.fixes.4

terminal: fix error handling

terminal: fix error handling

Fixes: f382bcc6d820 ("terminal: log TIOCGPTPEER failure less alarmingly")
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Merge pull request #3907 from brauner/2021-07-15.fixes.3

terminal: log TIOCGPTPEER failure less alarmingly

Merge pull request #3906 from brauner/2021-07-15.fixes.2

grammar fixes

af_unix: report error when no fd is to be sent

Fixes: #3624
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

terminal: log TIOCGPTPEER failure less alarmingly

This is not a fatal error and the fallback codepath is equally safe.
When we use TIOCGPTPEER we're using a stashed fd to the container's
devpts mount's ptmx device and allocating a new fd non-path based
through this ioctl. If this ioctl can't be used we're falling back to
allocating a pts device from the host's devpts mount's ptmx device which
is path-based but is not under control of the container and so that's
safe. The difference is just that the first method gets you a nice
native terminal with all the pleasantries of having tty and friends
working whereas the latter method does not.

Fixes: #3625
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

sync: fix log message

Fixes: #3875
Suggested-by: Hank.shi <shk242673@163.com>
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

start: fix logging message

Fixes: #3875
Suggested-by: Hank.shi <shk242673@163.com>
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Merge pull request #3905 from brauner/2021-07-15.fixes

initutils: include pthread.h

initutils: include pthread.h

Otherwise we might end up with implicit function declaration warnings.

Link: https://jenkins.linuxcontainers.org/job/lxc-build-android/8915/console
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Merge pull request #3904 from hallyn/2021-07-14/mantypo

doc/common_options: add trace and alert loglevels

doc/common_options: add trace and alert loglevels

Signed-off-by: Serge Hallyn <serge@hallyn.com>

Merge pull request #3900 from brauner/2021-07-08.fixes

file_utils: surface ENOENT when falling back to openat()

file_utils: surface ENOENT when falling back to openat()

Link: https://discuss.linuxcontainers.org/t/error-failed-to-retrieve-pid-of-executing-child-process
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Improve bash completion.

Use as much as possible from each command `--help` for completion.

Some options require a long list of completions that should be dumped by
some command option. These are not added here yet.

Examples of those are: `lxc-info --config`, `lxc-execute --define` and
`lxc-start --define`.

Signed-off-by: Edenis Freindorfer Azevedo <edenisfa@gmail.com>