Release LXC 3.0.0

Signed-off-by: Stéphane Graber <stgraber@ubuntu.com>

Merge pull request #2239 from brauner/2018-03-27/fixup_action_script

Allow passing action scripts to CRIU

Allow passing action scripts to CRIU

Closes #2236.

Signed-off-by: Eytan Heidingsfeld <eytanh@gmail.com>
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Merge pull request #2238 from stgraber/master

configure.ac: Support redhatenterpriseserver

configure.ac: Support redhatenterpriseserver

Signed-off-by: Stéphane Graber <stgraber@ubuntu.com>

Release LXC 3.0.0.beta4

Signed-off-by: Stéphane Graber <stgraber@ubuntu.com>

Merge pull request #2237 from brauner/2018-03-26/always_make_dumpable

start: always make us dumpable

start: always make us dumpable

Otherwise lxc.hook.mount hooks that try to inspect /proc/<pid>/*
will fail.

Cc: Jonathan Calmels <jcalmels@nvidia.com>
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Merge pull request #2235 from brauner/2018-03-25/simplify_autodev

conf: simplify autodev

conf: simplify lxc_fill_autodev()

This function was way more syscall heavy than it needed to be.

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Merge pull request #2232 from flx42/dhclient-hook-apparmor

hooks: fix dhclient hook when an AppArmor profile is active

Release LXC 3.0.0.beta3

Signed-off-by: Stéphane Graber <stgraber@ubuntu.com>

Merge pull request #2233 from brauner/2018-03-23/truncate_config_file

lxccontainer: truncate config file

lxccontainer: truncate config file

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Merge pull request #2231 from stgraber/master

pam: Fix missing symbols in module

hooks: fix dhclient hook when an AppArmor profile is active

Signed-off-by: Felix Abecassis <fabecassis@nvidia.com>

pam: Fix missing symbols in module

Signed-off-by: Stéphane Graber <stgraber@ubuntu.com>

Merge pull request #2229 from fliiiix/lxc_net_improvements

Rename ifup/down and remove usless parameter passing

Merge pull request #2230 from tych0/drop-log-whitespace

remove leading whitespace from log files

Rename ifup/down and remove usless parameter passing

Signed-off-by: Felix <de-ch@hotmail.de>

remove leading whitespace from log files

This has annoyed me for a long time, 3.0 seems like the time to fix it :).

I think the way that the log prefix was intended to be used was perhaps a
dynamic prefix per file, but we don't do that today; we include the
filename later in the log message. Instead, we use it as the tool name,
which for liblxc is always "lxc", but could also be things like
"lxc-cgroup" or whatever. There is absolutely no reason to pad this, since
it is always the same for every log file (in fact, we could probably get
rid of the prefix all together, but that seems slightly more drastic).

Instead, let's just drop this padding. Hopefully this will save thousands
of hours of slight annoyance and right scrolling in various pastebins.

Signed-off-by: Tycho Andersen <tycho@tycho.ws>

Merge pull request #2225 from flx42/nvidia-hook-fixes

NVIDIA hook improvements

hooks: implement passthrough for latest features of libnvidia-container

The "display" driver capability will expose /dev/nvidia-modeset:
https://github.com/NVIDIA/libnvidia-container/commit/9398d41d9f571578d6543703d287b014bcf1bb8c

The "--ldcache" argument allows overriding the location of the DSO cache:
https://github.com/NVIDIA/libnvidia-container/commit/41656bf9ed71448972f3254a10ceb3c53225a4e6

The "--root" argument allows nvidia-container-cli to execute in a different rootfs:
https://github.com/NVIDIA/libnvidia-container/commit/019fdc14e325eea55fbe0397a581bda9d0c4c5b1

Signed-off-by: Felix Abecassis <fabecassis@nvidia.com>

hooks: fix nvidia hook when running under the lxc-start AppArmor profile

For a reason that I don't understand, the profile transition needs to
be done on the current process. Changing the attributes for a
subsequent execve(2) (with /proc/self/attr/exec) will cause the kernel
to set AT_SECURE in the auxiliary vector and thus secure_getenv(3)
inside libnvidia-container will return NULL.

Signed-off-by: Felix Abecassis <fabecassis@nvidia.com>

Release LXC 3.0.0.beta2

Signed-off-by: Stéphane Graber <stgraber@ubuntu.com>

Merge pull request #2223 from flx42/fix-lxc-execute-use-after-free

tools: fix container use-after-free

tools: fix container use-after-free

Fields daemonize and error_num were being called after the
lxc_container_put.

Signed-off-by: Felix Abecassis <fabecassis@nvidia.com>

Merge pull request #2222 from tenforward/japanese

doc: Remove aufs in Japanese man pages

doc: Remove aufs in Japanese man pages

* and tweak English lxc-copy(1)

Signed-off-by: KATOH Yasufumi <karma@jazz.email.ne.jp>

Merge pull request #2210 from brauner/2018-03-10/conf_cleanups

tree-wide: remove aufs storage driver

terminal: s/Theh/The/

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

conf: initialize pflags

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

conf: coding style changes

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

tree-wide: remove aufs storage driver

We've announced quite a while back and printed out errors and warning everytime
someone used the aufs driver.

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

conf: order includes

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Merge pull request #2221 from tych0/fix-use-after-free

fix handler use-after-free

fix handler use-after-free

The problem here is that __lxc_start frees the handler, so any use
afterwards is invalid. Since we don't have access to the actual struct
lxc_container object in __lxc_start, let's pass a pointer to error_num in
so it can be returned.

Unfortunately, I'm a little too paranoid to change the return type of
lxc_start, since it returns failure if some of the cleanup fails, which
may be useful in some cases. So let's keep this out of band.

Closes #2218
Closes #2219

Reported-by: Felix Abecassis <fabecassis@nvidia.com>
Signed-off-by: Tycho Andersen <tycho@tycho.ws>

Merge pull request #2217 from flx42/fix-mount-hooks-double-call

conf: do not run the "mount" hooks twice

conf: do not run the "mount" hooks twice

Regression introduced by 8353b4c90ed18e570521134f2c60bef56a082b55

Signed-off-by: Felix Abecassis <fabecassis@nvidia.com>

Merge pull request #2216 from igalic/fix/clang-warning

conf: fix clang warning when building w/o libcap

conf: fix clang warning when building w/o libcap

when compiling lxc with clang-5.0 parse_cap()'s main loop will produce a
warning about a tautological comparision (#2215).

By moving the result of computation into a variable (end) this is no
longer a constant expression. clang-5.0 does not do dataflow analysis at
this point, so it is, to quote someone from #llvm, "morally equivalent"
to casting `(int)i`.

in addition, we also clean up the #if HAVE_LIBCAP to no longer need
its #else branch!

Signed-off-by: Igor Galić <igor.galic@automatic-server.com>

Merge pull request #2214 from flx42/fix-lxc-execute

tools: fix usage of boolean function set_config_item

tools: fix usage of boolean function set_config_item

Signed-off-by: Felix Abecassis <fabecassis@nvidia.com>

Merge pull request #2213 from hallyn/2018-03-13/revert-cg

Revert "cgroups: don't escape if we're not real root"

Revert "cgroups: don't escape if we're not real root"

This reverts commit 8d961e28f1d759669b477a659cbb694aaa2af915.

Unfortunately I don't believe the check is correct in the general case.

Signed-off-by: Serge Hallyn <shallyn@cisco.com>

Merge pull request #2212 from tych0/cgroup-escape-host-unpriv

cgroups: don't escape if we're not real root

cgroups: don't escape if we're not real root

If we're host unpriv but root in our userns, we can't really escape
cgroups. Let's switch the cgroup escape test to reflect this.

Signed-off-by: Tycho Andersen <tycho@tycho.ws>

Merge pull request #2211 from tych0/usernsexec-init-log

usernsexec: init log fd

usernsexec: init log fd

lxc-usernsexec uses some functions (e.g. lxc_map_ids()), which are part of
the lxc library and thus use the WARN etc. macros to emit log messages.
However, it doesn't initialize the log in any way, so these messages go
into the ether.

lxc-usernsexec currently has no log parameters, so let's just log these to
stderr. Someone can do something fancier later if they want.

Signed-off-by: Tycho Andersen <tycho@tycho.ws>

Merge pull request #2209 from tenforward/fix_personality

tools: Include config.h in tool_utils.c

tools: Include config.h in tool_utils.c

Since we do not include config.h, personality is not set. This is fix
it. See issue #2208.

Signed-off-by: KATOH Yasufumi <karma@jazz.email.ne.jp>

Merge pull request #2203 from flx42/fix-libcap-amzn1

Add a workaround for a build issue with old versions of libcap

Add a workaround for a build issue with old versions of libcap

Fixes: #2178
Signed-off-by: Felix Abecassis <fabecassis@nvidia.com>

Merge pull request #2202 from brauner/2018-03-02/coding_style_update

CODING_STYLE: update

CODING_STYLE: add languages to highlight

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

CODING_STYLE: arrays of structs

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

CODING_STYLE: clang-format

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

CODING_STYLE: remove duplicate _exit() entry

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Merge pull request #2201 from tenforward/japanese

doc: Add lxc.console.size and remove lxc.console.buffer.logfile in Japanese man page

doc: Add lxc.console.size and remove lxc.console.buffer.logfile in Japanese man pages

Update for commit 861813e and 23e0d9a for lxc.container.conf(5)

Signed-off-by: KATOH Yasufumi <karma@jazz.email.ne.jp>

Release LXC 3.0.0.beta1

Signed-off-by: Stéphane Graber <stgraber@ubuntu.com>

Merge pull request #2199 from brauner/2018-03-01/bugfixes

start: handle kernels without setns support

config: start with a full capability set

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

start: handle kernels without setns support

Closes #1390.

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

attach: rename to LXC_ATTACH_TERMINAL

Rename from LXC_ATTACH_ALLOCATE_PTY to LXC_ATTACH_TERMINAL. The latter is
shorter and more generic. I don't want this whole terminology of ptys, ttys,
and consoles to leak through the API.

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Merge pull request #2197 from stgraber/master

Fix typo

Fix typo

Signed-off-by: Stéphane Graber <stgraber@ubuntu.com>

Merge pull request #2164 from brauner/2018-02-14/add_flag_to_compile_tools

tree-wide: rm {lua,python3} bindings, rm deprecated binaries, rm deprecated templates, add --{disable,enable}-{commands,tools} flag

Merge pull request #2196 from brauner/2018-02-28/more_terminal_fixes

terminal: improvements and cleanup

terminal: non-functional changes

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

terminal: non-functional changes

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

terminal: lxc_terminal_map_ids()

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

terminal: lxc_terminal_prepare_login()

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

terminal: lxc_make_controlling_terminal()

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

terminal: lxc_console()

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

terminal: lxc_terminal_master_cb()

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

terminal: lxc_terminal_stdin_cb()

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

terminal: lxc_terminal_set_stdfds()

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

terminal: lxc_terminal_setup()

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

terminal: lxc_terminal_create()

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

terminal: lxc_terminal_peer_default()

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

terminal: lxc_terminal_free()

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

terminal: lxc_terminal_allocate()

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

terminal: lxc_terminal_peer_proxy_alloc()

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

terminal: lxc_terminal_peer_proxy_free()

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

terminal: lxc_setup_tios()

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

terminal: lxc_terminal_mainloop_add()

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

terminal: lxc_terminal_io_cb()

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

terminal: lxc_terminal_write_log_file()

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

terminal: error out when SIGTERM cannot be added

This should be an error condition.

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

terminal: non-functional changes

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

terminal: lxc_terminal_signalfd_cb()

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

mainloop: add LXC_MAINLOOP_ERROR

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

lxc-local: add --mapped-{g,u}id flags

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

lxc-oci: make shellcheck clean

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

lxc-local: coding style

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

lxc-busybox: make shellcheck clean

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

lxc-download: make POSIX shellcheck clean

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

templates: bump compat level to 5

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

tree-wide: rm templates in favor of distrobuilder

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>