Merge pull request #134 from evgeni/no-argv0-in-usage

don't use argv[0] in usage output

don't use argv[0] in usage output

otherwise this generates "funny" manpages like
  /home/remote/egolov/Devel/lxcfs/.libs/lt-lxcfs [-p pidfile] mountpoint
  /home/remote/egolov/Devel/lxcfs/.libs/lt-lxcfs -h
or
  /build/lxcfs-8lNGve/lxcfs-2.0/.1/.libs/lt-lxcfs [-p pidfile] mountpoint
  /build/lxcfs-8lNGve/lxcfs-2.0/.1/.libs/lt-lxcfs -h

Signed-off-by: Evgeni Golov <evgeni@debian.org>

Merge pull request #127 from brauner/2016-08-21/bugfixes

2016 08 21/bugfixes

Merge pull request #133 from glensc/pld

add pld linux support

add pld linux support

Signed-off-by: Elan Ruusamäe <glen@delfi.ee>

bindings: more consistent fs behavior

- e.g. let cg_mkdir() return EPERM

Signed-off-by: Christian Brauner <cbrauner@suse.de>

bindings: set errno in pick_controller_from_path()

This will allow us to provide better standard fs behavior.

Signed-off-by: Christian Brauner <cbrauner@suse.de>

bindings: non functional changes

- whitespace fixes for pick_controller_from_path()

Signed-off-by: Christian Brauner <cbrauner@suse.de>

lxcfs: better fs behavior on /var/lib/lxcfs

return -EPERM for mkdir(), rmdir(), chown(), chmod() on top directory
/var/lib/lxcfs.

Signed-off-by: Christian Brauner <cbrauner@suse.de>

lxcfs, bindings: show "." and ".." dir entries

Signed-off-by: Christian Brauner <cbrauner@suse.de>

bindings: allow access to /var/lib/lxcfs/proc

Signed-off-by: Christian Brauner <cbrauner@suse.de>

bindings: enable access to /var/lib/lxcfs/cgroup

Signed-off-by: Christian Brauner <cbrauner@suse.de>

bindings: grant access to /var/lib/lxcfs

Signed-off-by: Christian Brauner <cbrauner@suse.de>

Merge pull request #129 from brauner/2016-08-22/fix_cgfs_remove

bindings: use openat fd for fstatat(), unlinkat()

bindings: close open fds on error

Signed-off-by: Christian Brauner <cbrauner@suse.de>

bindings: use openat fd for fstatat(), unlinkat()

Signed-off-by: Christian Brauner <cbrauner@suse.de>

Merge pull request #132 from brauner/2016-08-24/better_debugging

bindings: improve debugging

bindings: improve debugging

- replace multiple DEBUG ifdefines with a single ifdefine at the top
- ifdefine lxcfs_debug() macro function that expands to nothing when -DDEBUG is
  not given

Signed-off-by: Christian Brauner <cbrauner@suse.de>

Merge pull request #130 from hallyn/2016-08-21/fixrace

2016 08 21/fixrace

meminfo: don't show negative swapfree

Also commonize some of the mem{,sw} free/used calculations.

Closes #115

pam: fix race in cgroup creation

If we find that a cgroup already exists, we should

1. remove all the cgroups which we've created so far
2. set existed to true
3. return failure

The caller should then detect that existed == true,
and re-try with the next index.

Signed-off-by: Serge Hallyn <serge@hallyn.com>

Merge pull request #126 from hallyn/2016-08-18/meminfo.more

Virtualize more of the meminfo fields

Virtualize more of the meminfo fields

The worst remaining offending line appears to be VmallocTotal.
Suggestions for how to calculate that would be appreciated.

Closes #119

Signed-off-by: Serge Hallyn <serge@hallyn.com>

Fix test_reload for lxcfs chroot

Signed-off-by: Stéphane Graber <stgraber@ubuntu.com>

Merge pull request #124 from brauner/2016-07-27/move_lxcfs_to_minimal_chroot

move lxcfs to minimal chroot

bindings: avoid using additional process

Instead of clone(..., CLONE_NEWNS | CLONE_FILES, ...) simply use
unshare(CLONE_NEWNS) and setns().

Signed-off-by: Christian Brauner <cbrauner@suse.de>

bindings: use strchr(), strrchr()

index(), rindex() are deprecated.

Signed-off-by: Christian Brauner <cbrauner@suse.de>

lxcfs, bindings: set fd_hierarchies in constructor

We need to initialize fd_hierarchies in the __constructor__ to guarantee a
consistent view across users of the shared library. Note well that hierarchies
and fd_hierarchies are considered read-only after the __constructor__ has run.

Signed-off-by: Christian Brauner <cbrauner@suse.de>

bindings: document new code

Signed-off-by: Christian Brauner <cbrauner@suse.de>

lxcfs: document new code

Signed-off-by: Christian Brauner <cbrauner@suse.de>

lxcfs, bindings: cleanup and fix exit logic

- close open file descriptors referring to cgroup hierarchies mounted in private
  lxcfs mount namespace
- fix exit logic in main()

Signed-off-by: Christian Brauner <cbrauner@suse.de>

bindings: open_pids_file()

Enable open_pids_file() to be used with *at() family of functions.

Signed-off-by: Christian Brauner <cbrauner@suse.de>

bindings: is_dir(), chown_tasks_files(), cgfs_chown_file()

Enable is_dir(), chown_tasks_files(), cgfs_chown_file() to be used with *at()
family of functions.

Signed-off-by: Christian Brauner <cbrauner@suse.de>

bindings: cgfs_chmod_file()

Enable cgfs_chmod_file() to be used with *at() family of functions.

Signed-off-by: Christian Brauner <cbrauner@suse.de>

bindings: cgfs_remove(), recursive_rmdir()

Enable cgfs_remove(), recursive_rmdir() to be used with *at() family of
functions.

Signed-off-by: Christian Brauner <cbrauner@suse.de>

bindings: chown_all_cgroup_files(), cgfs_create()

Enable chown_all_cgroup_files(), cgfs_create() to be used with *at() family of
functions.

Signed-off-by: Christian Brauner <cbrauner@suse.de>

bindings: cgfs_set_value(), write_string()

Enable cgfs_set_value(), write_string() to be used with *at() family of
functions.

Signed-off-by: Christian Brauner <cbrauner@suse.de>

bindings: caller_may_see_dir()

Signed-off-by: Christian Brauner <cbrauner@suse.de>

bindings: adapt caller_is_in_ancestor()

Signed-off-by: Christian Brauner <cbrauner@suse.de>

bindings: is_child_cgroup()

Enable is_child_cgroup() to be used with *at() family of functions.

Signed-off-by: Christian Brauner <cbrauner@suse.de>

bindings: cgfs_get_value(), slurp_file()

Enable cgfs_get_value() and slurp_file() to be used with *at() family of
functions.

Signed-off-by: Christian Brauner <cbrauner@suse.de>

bindings: cgfs_iterate_cgroup(), cgfs_get_key()

Enable cgfs_iterate_cgroup(), cgfs_get_key() to be used with *at() family of
functions.

Signed-off-by: Christian Brauner <cbrauner@suse.de>

bindings: return opened fd for controller

find_mounted_controller() now stores the corresponding open file descriptor for
the mount of the controller in the private lxcfs mount namespace in @cfd.

Signed-off-by: Christian Brauner <cbrauner@suse.de>

lxcfs, bindings: share cgroup info + add clone()

- So far lxcfs.c and bindings.{c,h} did not share cgroup information and we
  unnecessarily kept parsing and storing additional information. Let's share it
  instead.
- Add lxcfs_clone() function.
- Mount cgroups in a private mount namespace. We use CLONE_FILES so that file
  descriptors opened via lxcfs_clone() are not copied and hence are valid in
  child and parent.
- For each mounted hierarchy, open a file descriptor and store it in an mmap()ed
  array that is MAP_SHARED between parent and child.

Signed-off-by: Christian Brauner <cbrauner@suse.de>

lxcfs: add infrastructure to create minimal chroot

Signed-off-by: Christian Brauner <cbrauner@suse.de>

lxcfs: order includes

Signed-off-by: Christian Brauner <cbrauner@suse.de>

lxcfs, bindings: small improvements

- capitalize BASEDIR
- add missing newline to debug output

Signed-off-by: Christian Brauner <cbrauner@suse.de>

Merge pull request #121 from brauner/skip_cgroupv2

skip empty entries under /proc/self/cgroup

skip empty entries under /proc/self/cgroup

If cgroupv2 is enabled either alone or together with legacy hierarchies
/proc/self/cgroup can contain entries of the form:

        0::/

This will cause lxcfs to fail the cgroup mounts because it parses out the empty
string "" and later on passes it to mount(). Let's skip such entries.

Signed-off-by: Christian Brauner <cbrauner@suse.de>

under_systemd_user_slice: work right when init is in '/'

Signed-off-by: Serge Hallyn <serge@hallyn.com>

libpam_cgfs: don't create new path if we are under /user.slice/user-$uid.slice

(relative to our init's path)

Closes #117

Signed-off-by: Serge Hallyn <serge@hallyn.com>

Don't build pam/ when --with-pamdir=none

Closes #110

Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>

Merge pull request #109 from brauner/bugfixes

bugfixes

bugfixes

- Fix do_mount_cgroups(): It previously returned ret uninitialized on failure.
- Quite a few snprintf() call used size_t variables but then checked whether
  size_t < 0. Since size_t is unsigned these checks were always true. Let's use
  ssize_t instead which is signed.
- Use additional ssize_t variable to catch snprintf() error for swap
  calculation and add the value to the final result afterwards instead of
  directly.

Signed-off-by: Christian Brauner <christian.brauner@mailbox.org>

fix cg_access() for controller directories

The previous patch actually didn't handle those, but only
/cgroup itself.

Closes #107

Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>

access: allow rx to controller directories themselves

Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>

diskstats: revert to only showing devices we've used

Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>

diskstats: use recursive values, and some cleanup

Iuse the recursive cgroup values since we certainly want values
for child cgroups included.  Also simplify the code just a bit.

Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>

s390: print the virtualized #cpus in cpuinfo_read

Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>

fix proc_cpuinfo_read for s390x

cpuinfo is different on s390x.  On amd64 there is a set of lines
per processor, begging with 'processor   : n'.  On s390x, the first
line identifies the vendor, then there are general lines which apply
to all containers, finally the processors show up one per line.

So handle these differently.

Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>

tag final 2.0.0 release

Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>

configure.ac: release 2.0.0.rc9

Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>

fuse file info release: guard against multiple calls

While fuse clearly calls the release info helpers under pthread
lock, it's not as clear that it may not be called more than once.
Null everything after we free it.

The hope is that this will fix the occasional mysterious crashes
on very heavily used (50 containers nonstop) servers.

Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>

Merge pull request #104 from stgraber/master

hook: Fix typo in previous fix

hook: Fix typo in previous fix

Signed-off-by: Stéphane Graber <stgraber@ubuntu.com>

Merge pull request #103 from stgraber/master

hook: Don't fail when root mountpoint is a symlink

hook: Don't fail when root mountpoint is a symlink

Signed-off-by: Stéphane Graber <stgraber@ubuntu.com>

proc_access: return EACESS not EPERM

(per the manpage)

Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>

release 2.0.0.rc8

Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>

Merge pull request #102 from hallyn/2016-03-21/access

implement access(2)

remove obsolete comments

i *think* the 'should never get here' was a side effect of using cgmanager
which is no longer valid.

Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>

implement access(2)

This is needed by lxc's cgfsng driver.

Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>

release 2.0.0.rc7

Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>

use a better word in signal() failure error message

Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>

Merge pull request #100 from hallyn/2016-03-20/starton

upstart: change how we decide to not run in a container

Merge pull request #101 from hallyn/2016-03-20/misc

Address feedback from Markus Elfring

lxcfs reload: only call async-safe functions

So don't call fprintf, don't take a lock we don't need, just set
an atomic volatile int to 1 when called.

Closes #94

Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>

configure.ac: drop second call to AM_INIT_AUTOMAKE

Closes #95

Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>

handle error in signal(2)

Closes #96

Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>

upstart: change how we decide to not run in a container

Otherwise lxcfs keeps lxc from hitting state 'started', which
in turn blocks reboot/shutdown.

Closes #92

Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>

Merge pull request #99 from stgraber/master

hook: don't use mountpoint

hook: don't use mountpoint

It's not very reliable (had it fail on one of my servers) and since
we're already iterating through a list of mountpoints, it's also
completely unneeded.

Signed-off-by: Stéphane Graber <stgraber@ubuntu.com>

Merge pull request #98 from stgraber/master

Fix lxcfs mount handling with newer lxc

Fix lxcfs mount handling with newer lxc

Signed-off-by: Stéphane Graber <stgraber@ubuntu.com>

release 2.0.0.rc6

Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>

Merge pull request #97 from hallyn/2016-03-17/14.04

pam: support 14.04

pam: support 14.04

In 14.04 our pam_systemd module used a different format for the
login cgroups.  If we find one of those in our name, then we want
to just chown it to us and not do anything more, just as we do in
xenial.

Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>

release 2.0.0.rc5

Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>

Merge pull request #91 from hallyn/2016-03-14/nonint

pam_cgfs: create a new systemd cgroup if current isn't ours

pam_cgfs: create a new systemd cgroup if current isn't ours

If current systemd cgroup does not end in user-$uid.slice/session-c%d.scope,
then pam did not create our current systemd cgroup for us, so create a new
one rather than chowning the current one.

This happens with noninteractive sessions.

Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>

Add sysvinit to init systems for Debian and Ubuntu

Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>

systemd config files don't go under /usr

Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>

release 2.0.0.rc4

Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>

Simplify the upstart job

This fixes the nesting case as before it would hit the first check,
which stops the job, then post-stop would unmount it.

Instead, lets just not start in containers, lxcfs is meant to run on the
host and be bind-mounted from there into containers.

Signed-off-by: Stéphane Graber <stgraber@ubuntu.com>

Fix lxcfs passthrough

Signed-off-by: Stéphane Graber <stgraber@ubuntu.com>

release 2.0.0.rc3

Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>

Merge pull request #90 from hallyn/2016-03-07/cached

2016 03 07/cached

meminfo_read: return 0 for Slab

Slab: is supposed to be the "in-kernel data structures cache".  I don't
know of a good way to calculate this from memory cgroup info.  If/when
we find it we can update it.  This value is used by free -m meaning
that if we don't shrink it, we can end up with negative values for
used memory.

Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>

always use container root cgroup, not init pid's

Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>

Mount /proc files even if /sys/fs/cgroup is disabled

Signed-off-by: Stéphane Graber <stgraber@ubuntu.com>