Merge pull request #3217 from brauner/rework_cgroups

src/lxc/af_unix.c

@@ -335,14 +335,14 @@ int lxc_unix_sockaddr(struct sockaddr_un *ret, const char *path)
 
 	len = strlen(path);
 	if (len == 0)
-		return minus_one_set_errno(EINVAL);
+		return ret_set_errno(-1, EINVAL);
 	if (path[0] != '/' && path[0] != '@')
-		return minus_one_set_errno(EINVAL);
+		return ret_set_errno(-1, EINVAL);
 	if (path[1] == '\0')
-		return minus_one_set_errno(EINVAL);
+		return ret_set_errno(-1, EINVAL);
 
 	if (len + 1 > sizeof(ret->sun_path))
-		return minus_one_set_errno(EINVAL);
+		return ret_set_errno(-1, EINVAL);
 
 	*ret = (struct sockaddr_un){
 	    .sun_family = AF_UNIX,

src/lxc/attach.c

@@ -104,9 +104,8 @@ static struct lxc_proc_context_info *lxc_proc_get_context_info(pid_t pid)
 
 static inline void lxc_proc_close_ns_fd(struct lxc_proc_context_info *ctx)
 {
-	for (int i = 0; i < LXC_NS_MAX; i++) {
-		__do_close_prot_errno int fd ATTR_UNUSED = move_fd(ctx->ns_fd[i]);
-	}
+	for (int i = 0; i < LXC_NS_MAX; i++)
+		close_prot_errno_disarm(ctx->ns_fd[i]);
 }
 
 static void lxc_proc_put_context_info(struct lxc_proc_context_info *ctx)
@@ -668,9 +667,8 @@ struct attach_clone_payload {
 
 static void lxc_put_attach_clone_payload(struct attach_clone_payload *p)
 {
-	__do_close_prot_errno int ipc_socket ATTR_UNUSED = p->ipc_socket;
-	__do_close_prot_errno int terminal_slave_fd ATTR_UNUSED = p->terminal_slave_fd;
-
+	close_prot_errno_disarm(p->ipc_socket);
+	close_prot_errno_disarm(p->terminal_slave_fd);
 	if (p->init_ctx) {
 		lxc_proc_put_context_info(p->init_ctx);
 		p->init_ctx = NULL;
@@ -1009,10 +1007,10 @@ int lxc_attach(struct lxc_container *container, lxc_attach_exec_t exec_function,
 	}
 
 	if (!container)
-		return minus_one_set_errno(EINVAL);
+		return ret_set_errno(-1, EINVAL);
 
 	if (!lxc_container_get(container))
-		return minus_one_set_errno(EINVAL);
+		return ret_set_errno(-1, EINVAL);
 
 	name = container->name;
 	lxcpath = container->config_path;

src/lxc/cgroups/cgroup.c

@@ -24,19 +24,16 @@ struct cgroup_ops *cgroup_init(struct lxc_conf *conf)
 {
 	struct cgroup_ops *cgroup_ops;
 
-	if (!conf) {
-		ERROR("No valid conf given");
-		return NULL;
-	}
+	if (!conf)
+		return log_error_errno(NULL, EINVAL, "No valid conf given");
 
 	cgroup_ops = cgfsng_ops_init(conf);
-	if (!cgroup_ops) {
-		ERROR("Failed to initialize cgroup driver");
-		return NULL;
-	}
+	if (!cgroup_ops)
+		return log_error_errno(NULL, errno, "Failed to initialize cgroup driver");
 
-	if (!cgroup_ops->data_init(cgroup_ops))
-		return NULL;
+	if (cgroup_ops->data_init(cgroup_ops))
+		return log_error_errno(NULL, errno,
+				       "Failed to initialize cgroup data");
 
 	TRACE("Initialized cgroup driver %s", cgroup_ops->driver);
 

src/lxc/cgroups/cgroup.h

@@ -132,7 +132,7 @@ struct cgroup_ops {
 	 */
 	cgroup_layout_t cgroup_layout;
 
-	bool (*data_init)(struct cgroup_ops *ops);
+	int (*data_init)(struct cgroup_ops *ops);
 	void (*payload_destroy)(struct cgroup_ops *ops, struct lxc_handler *handler);
 	void (*monitor_destroy)(struct cgroup_ops *ops, struct lxc_handler *handler);
 	bool (*monitor_create)(struct cgroup_ops *ops, struct lxc_handler *handler);

src/lxc/cgroups/cgroup2_devices.c

@@ -35,11 +35,11 @@ static int bpf_program_add_instructions(struct bpf_program *prog,
 	struct bpf_insn *new_insn;
 
 	if (prog->kernel_fd >= 0)
-		return error_log_errno(EBUSY, "Refusing to update bpf cgroup program that's already loaded");
+		return log_error_errno(-1, EBUSY, "Refusing to update bpf cgroup program that's already loaded");
 
 	new_insn = realloc(prog->instructions, sizeof(struct bpf_insn) * (count + prog->n_instructions));
 	if (!new_insn)
-		return error_log_errno(ENOMEM, "Failed to reallocate bpf cgroup program");
+		return log_error_errno(-1, ENOMEM, "Failed to reallocate bpf cgroup program");
 
 	prog->instructions = new_insn;
 	memcpy(prog->instructions + prog->n_instructions, instructions,
@@ -184,7 +184,7 @@ struct bpf_program *bpf_program_new(uint32_t prog_type)
 int bpf_program_init(struct bpf_program *prog)
 {
 	if (!prog)
-		return minus_one_set_errno(EINVAL);
+		return ret_set_errno(-1, EINVAL);
 
 	const struct bpf_insn pre_insn[] = {
 	    /* load device type to r2 */
@@ -217,7 +217,7 @@ int bpf_program_append_device(struct bpf_program *prog, struct device_item *devi
 	int device_type;
 
 	if (!prog || !device)
-		return minus_one_set_errno(EINVAL);
+		return ret_set_errno(-1, EINVAL);
 
 	/* This is a global rule so no need to append anything. */
 	if (device->global_rule > LXC_BPF_DEVICE_CGROUP_LOCAL_RULE) {
@@ -227,7 +227,7 @@ int bpf_program_append_device(struct bpf_program *prog, struct device_item *devi
 
 	device_type = bpf_device_type(device->type);
 	if (device_type < 0)
-		return error_log_errno(EINVAL, "Invalid bpf cgroup device type %c", device->type);
+		return log_error_errno(-1, EINVAL, "Invalid bpf cgroup device type %c", device->type);
 
 	if (device_type > 0)
 		jump_nr++;
@@ -249,7 +249,7 @@ int bpf_program_append_device(struct bpf_program *prog, struct device_item *devi
 
 		ret = bpf_program_add_instructions(prog, ins, ARRAY_SIZE(ins));
 		if (ret)
-			return error_log_errno(errno, "Failed to add instructions to bpf cgroup program");
+			return log_error_errno(-1, errno, "Failed to add instructions to bpf cgroup program");
 	}
 
 	if (!bpf_device_all_access(access_mask)) {
@@ -262,7 +262,7 @@ int bpf_program_append_device(struct bpf_program *prog, struct device_item *devi
 		jump_nr -= 3;
 		ret = bpf_program_add_instructions(prog, ins, ARRAY_SIZE(ins));
 		if (ret)
-			return error_log_errno(errno, "Failed to add instructions to bpf cgroup program");
+			return log_error_errno(-1, errno, "Failed to add instructions to bpf cgroup program");
 	}
 
 	if (device->major >= 0) {
@@ -272,7 +272,7 @@ int bpf_program_append_device(struct bpf_program *prog, struct device_item *devi
 
 		ret = bpf_program_add_instructions(prog, ins, ARRAY_SIZE(ins));
 		if (ret)
-			return error_log_errno(errno, "Failed to add instructions to bpf cgroup program");
+			return log_error_errno(-1, errno, "Failed to add instructions to bpf cgroup program");
 	}
 
 	if (device->minor >= 0) {
@@ -282,13 +282,13 @@ int bpf_program_append_device(struct bpf_program *prog, struct device_item *devi
 
 		ret = bpf_program_add_instructions(prog, ins, ARRAY_SIZE(ins));
 		if (ret)
-			return error_log_errno(errno, "Failed to add instructions to bpf cgroup program");
+			return log_error_errno(-1, errno, "Failed to add instructions to bpf cgroup program");
 	}
 
 	ret = bpf_program_add_instructions(prog, bpf_access_decision,
 					    ARRAY_SIZE(bpf_access_decision));
 	if (ret)
-		return error_log_errno(errno, "Failed to add instructions to bpf cgroup program");
+		return log_error_errno(-1, errno, "Failed to add instructions to bpf cgroup program");
 
 	return 0;
 }
@@ -301,7 +301,7 @@ int bpf_program_finalize(struct bpf_program *prog)
 	};
 
 	if (!prog)
-		return minus_one_set_errno(EINVAL);
+		return ret_set_errno(-1, EINVAL);
 
 	TRACE("Implementing %s bpf device cgroup program",
 	      prog->device_list_type == LXC_BPF_DEVICE_CGROUP_BLACKLIST
@@ -332,7 +332,7 @@ static int bpf_program_load_kernel(struct bpf_program *prog, char *log_buf,
 
 	prog->kernel_fd = bpf(BPF_PROG_LOAD, &attr, sizeof(attr));
 	if (prog->kernel_fd < 0)
-		return error_log_errno(errno, "Failed to load bpf program");
+		return log_error_errno(-1, errno, "Failed to load bpf program");
 
 	return 0;
 }
@@ -346,17 +346,17 @@ int bpf_program_cgroup_attach(struct bpf_program *prog, int type,
 	int ret;
 
 	if (!prog)
-		return minus_one_set_errno(EINVAL);
+		return ret_set_errno(-1, EINVAL);
 
 	if (flags & ~(BPF_F_ALLOW_OVERRIDE, BPF_F_ALLOW_MULTI))
-		return error_log_errno(EINVAL, "Invalid flags for bpf program");
+		return log_error_errno(-1, EINVAL, "Invalid flags for bpf program");
 
 	if (prog->attached_path) {
 		if (prog->attached_type != type)
-			return error_log_errno(EBUSY, "Wrong type for bpf program");
+			return log_error_errno(-1, EBUSY, "Wrong type for bpf program");
 
 		if (prog->attached_flags != flags)
-			return error_log_errno(EBUSY, "Wrong flags for bpf program");
+			return log_error_errno(-1, EBUSY, "Wrong flags for bpf program");
 
 		if (flags != BPF_F_ALLOW_OVERRIDE)
 			return true;
@@ -364,15 +364,15 @@ int bpf_program_cgroup_attach(struct bpf_program *prog, int type,
 
 	ret = bpf_program_load_kernel(prog, NULL, 0);
 	if (ret < 0)
-		return error_log_errno(ret, "Failed to load bpf program");
+		return log_error_errno(-1, ret, "Failed to load bpf program");
 
 	copy = strdup(path);
 	if (!copy)
-		return error_log_errno(ENOMEM, "Failed to duplicate cgroup path %s", path);
+		return log_error_errno(-1, ENOMEM, "Failed to duplicate cgroup path %s", path);
 
 	fd = open(path, O_DIRECTORY | O_RDONLY | O_CLOEXEC);
 	if (fd < 0)
-		return error_log_errno(errno, "Failed to open cgroup path %s", path);
+		return log_error_errno(-1, errno, "Failed to open cgroup path %s", path);
 
 	attr = (union bpf_attr){
 	    .attach_type	= type,
@@ -383,7 +383,7 @@ int bpf_program_cgroup_attach(struct bpf_program *prog, int type,
 
 	ret = bpf(BPF_PROG_ATTACH, &attr, sizeof(attr));
 	if (ret < 0)
-		return error_log_errno(errno, "Failed to attach bpf program");
+		return log_error_errno(-1, errno, "Failed to attach bpf program");
 
 	free_replace_move_ptr(prog->attached_path, copy);
 	prog->attached_type = type;
@@ -407,7 +407,7 @@ int bpf_program_cgroup_detach(struct bpf_program *prog)
 	fd = open(prog->attached_path, O_DIRECTORY | O_RDONLY | O_CLOEXEC);
 	if (fd < 0) {
 		if (errno != ENOENT)
-			return error_log_errno(errno, "Failed to open attach cgroup %s",
+			return log_error_errno(-1, errno, "Failed to open attach cgroup %s",
 					       prog->attached_path);
 	} else {
 		union bpf_attr attr;
@@ -420,7 +420,7 @@ int bpf_program_cgroup_detach(struct bpf_program *prog)
 
 		ret = bpf(BPF_PROG_DETACH, &attr, sizeof(attr));
 		if (ret < 0)
-			return error_log_errno(errno, "Failed to detach bpf program from cgroup %s",
+			return log_error_errno(-1, errno, "Failed to detach bpf program from cgroup %s",
 					       prog->attached_path);
 	}
 
@@ -488,11 +488,11 @@ int bpf_list_add_device(struct lxc_conf *conf, struct device_item *device)
 
 	list_elem = malloc(sizeof(*list_elem));
 	if (!list_elem)
-		return error_log_errno(ENOMEM, "Failed to allocate new device list");
+		return log_error_errno(-1, ENOMEM, "Failed to allocate new device list");
 
 	new_device = memdup(device, sizeof(struct device_item));
 	if (!new_device)
-		return error_log_errno(ENOMEM, "Failed to allocate new device item");
+		return log_error_errno(-1, ENOMEM, "Failed to allocate new device item");
 
 	lxc_list_add_elem(list_elem, move_ptr(new_device));
 	lxc_list_add_tail(&conf->devices, move_ptr(list_elem));

src/lxc/commands.c

@@ -913,16 +913,16 @@ int lxc_cmd_add_bpf_device_cgroup(const char *name, const char *lxcpath,
 	int ret;
 
 	if (strlen(device->access) > STRLITERALLEN("rwm"))
-		return error_log_errno(EINVAL, "Invalid access mode specified %s",
+		return log_error_errno(-1, EINVAL, "Invalid access mode specified %s",
 				       device->access);
 
 	ret = lxc_cmd(name, &cmd, &stopped, lxcpath, NULL);
 	if (ret < 0 || cmd.rsp.ret < 0)
-		return error_log_errno(errno, "Failed to add new bpf device cgroup rule");
+		return log_error_errno(-1, errno, "Failed to add new bpf device cgroup rule");
 
 	return 0;
 #else
-	return minus_one_set_errno(ENOSYS);
+	return ret_set_errno(-1, ENOSYS);
 #endif
 }
 
@@ -1006,7 +1006,7 @@ reap_client_fd:
 	 */
 	return 1;
 #else
-	return minus_one_set_errno(ENOSYS);
+	return ret_set_errno(-1, ENOSYS);
 #endif
 }
 
@@ -1155,7 +1155,7 @@ int lxc_cmd_seccomp_notify_add_listener(const char *name, const char *lxcpath,
 
 	return cmd.rsp.ret;
 #else
-	return minus_one_set_errno(ENOSYS);
+	return ret_set_errno(-1, ENOSYS);
 #endif
 }
 
@@ -1211,7 +1211,7 @@ int lxc_cmd_freeze(const char *name, const char *lxcpath, int timeout)
 
 	ret = lxc_cmd(name, &cmd, &stopped, lxcpath, NULL);
 	if (ret <= 0 || cmd.rsp.ret < 0)
-		return error_log_errno(errno, "Failed to freeze container");
+		return log_error_errno(-1, errno, "Failed to freeze container");
 
 	return cmd.rsp.ret;
 }
@@ -1244,7 +1244,7 @@ int lxc_cmd_unfreeze(const char *name, const char *lxcpath, int timeout)
 
 	ret = lxc_cmd(name, &cmd, &stopped, lxcpath, NULL);
 	if (ret <= 0 || cmd.rsp.ret < 0)
-		return error_log_errno(errno, "Failed to unfreeze container");
+		return log_error_errno(-1, errno, "Failed to unfreeze container");
 
 	return cmd.rsp.ret;
 }

src/lxc/compiler.h

@@ -45,6 +45,13 @@
 #define __returns_twice __attribute__((returns_twice))
 #endif
 
+/* This attribute is required to silence clang warnings */
+#if defined(__GNUC__)
+#define __lxc_unused __attribute__ ((unused))
+#else
+#define __lxc_unused
+#endif
+
 #define __cgfsng_ops
 
 #endif /* __LXC_COMPILER_H */

src/lxc/confile.c

@@ -401,11 +401,11 @@ static int set_config_net_l2proxy(const char *key, const char *value,
 		return clr_config_net_l2proxy(key, lxc_conf, data);
 
 	if (!netdev)
-		return minus_one_set_errno(EINVAL);
+		return ret_set_errno(-1, EINVAL);
 
 	ret = lxc_safe_uint(value, &val);
 	if (ret < 0)
-		return minus_one_set_errno(-ret);
+		return ret_set_errno(-1, -ret);
 
 	switch (val) {
 	case 0:
@@ -416,7 +416,7 @@ static int set_config_net_l2proxy(const char *key, const char *value,
 		return 0;
 	}
 
-	return minus_one_set_errno(EINVAL);
+	return ret_set_errno(-1, EINVAL);
 }
 
 static int set_config_net_name(const char *key, const char *value,
@@ -485,11 +485,11 @@ static int set_config_net_ipvlan_mode(const char *key, const char *value,
 		return clr_config_net_ipvlan_mode(key, lxc_conf, data);
 
 	if (!netdev)
-		return minus_one_set_errno(EINVAL);
+		return ret_set_errno(-1, EINVAL);
 
 	if (netdev->type != LXC_NET_IPVLAN) {
 		SYSERROR("Invalid ipvlan mode \"%s\", can only be used with ipvlan network", value);
-		return minus_one_set_errno(EINVAL);
+		return ret_set_errno(-1, EINVAL);
 	}
 
 	return lxc_ipvlan_mode_to_flag(&netdev->priv.ipvlan_attr.mode, value);
@@ -504,11 +504,11 @@ static int set_config_net_ipvlan_isolation(const char *key, const char *value,
 		return clr_config_net_ipvlan_isolation(key, lxc_conf, data);
 
 	if (!netdev)
-		return minus_one_set_errno(EINVAL);
+		return ret_set_errno(-1, EINVAL);
 
 	if (netdev->type != LXC_NET_IPVLAN) {
 		SYSERROR("Invalid ipvlan isolation \"%s\", can only be used with ipvlan network", value);
-		return minus_one_set_errno(EINVAL);
+		return ret_set_errno(-1, EINVAL);
 	}
 
 	return lxc_ipvlan_isolation_to_flag(&netdev->priv.ipvlan_attr.isolation, value);
@@ -729,11 +729,11 @@ static int set_config_net_veth_ipv4_route(const char *key, const char *value,
 		return clr_config_net_veth_ipv4_route(key, lxc_conf, data);
 
 	if (!netdev)
-		return minus_one_set_errno(EINVAL);
+		return ret_set_errno(-1, EINVAL);
 
 	if (netdev->type != LXC_NET_VETH) {
 		SYSERROR("Invalid ipv4 route \"%s\", can only be used with veth network", value);
-		return minus_one_set_errno(EINVAL);
+		return ret_set_errno(-1, EINVAL);
 	}
 
 	inetdev = malloc(sizeof(*inetdev));
@@ -754,22 +754,22 @@ static int set_config_net_veth_ipv4_route(const char *key, const char *value,
 
 	slash = strchr(valdup, '/');
 	if (!slash)
-		return minus_one_set_errno(EINVAL);
+		return ret_set_errno(-1, EINVAL);
 
 	*slash = '\0';
 	slash++;
 	if (*slash == '\0')
-		return minus_one_set_errno(EINVAL);
+		return ret_set_errno(-1, EINVAL);
 
 	netmask = slash;
 
 	ret = lxc_safe_uint(netmask, &inetdev->prefix);
 	if (ret < 0 || inetdev->prefix > 32)
-		return minus_one_set_errno(EINVAL);
+		return ret_set_errno(-1, EINVAL);
 
 	ret = inet_pton(AF_INET, valdup, &inetdev->addr);
 	if (!ret || ret < 0)
-		return minus_one_set_errno(EINVAL);
+		return ret_set_errno(-1, EINVAL);
 
 	lxc_list_add_tail(&netdev->priv.veth_attr.ipv4_routes, list);
 	move_ptr(inetdev);
@@ -900,11 +900,11 @@ static int set_config_net_veth_ipv6_route(const char *key, const char *value,
 		return clr_config_net_veth_ipv6_route(key, lxc_conf, data);
 
 	if (!netdev)
-		return minus_one_set_errno(EINVAL);
+		return ret_set_errno(-1, EINVAL);
 
 	if (netdev->type != LXC_NET_VETH) {
 		SYSERROR("Invalid ipv6 route \"%s\", can only be used with veth network", value);
-		return minus_one_set_errno(EINVAL);
+		return ret_set_errno(-1, EINVAL);
 	}
 
 	inet6dev = malloc(sizeof(*inet6dev));
@@ -925,22 +925,22 @@ static int set_config_net_veth_ipv6_route(const char *key, const char *value,
 
 	slash = strchr(valdup, '/');
 	if (!slash)
-		return minus_one_set_errno(EINVAL);
+		return ret_set_errno(-1, EINVAL);
 
 	*slash = '\0';
 	slash++;
 	if (*slash == '\0')
-		return minus_one_set_errno(EINVAL);
+		return ret_set_errno(-1, EINVAL);
 
 	netmask = slash;
 
 	ret = lxc_safe_uint(netmask, &inet6dev->prefix);
 	if (ret < 0 || inet6dev->prefix > 128)
-		return minus_one_set_errno(EINVAL);
+		return ret_set_errno(-1, EINVAL);
 
 	ret = inet_pton(AF_INET6, valdup, &inet6dev->addr);
 	if (!ret || ret < 0)
-		return minus_one_set_errno(EINVAL);
+		return ret_set_errno(-1, EINVAL);
 
 	lxc_list_add_tail(&netdev->priv.veth_attr.ipv6_routes, list);
 	move_ptr(inet6dev);
@@ -1004,7 +1004,7 @@ static int set_config_seccomp_allow_nesting(const char *key, const char *value,
 		return -1;
 
 	if (lxc_conf->seccomp.allow_nesting > 1)
-		return minus_one_set_errno(EINVAL);
+		return ret_set_errno(-1, EINVAL);
 
 	return 0;
 #else
@@ -1019,7 +1019,7 @@ static int set_config_seccomp_notify_cookie(const char *key, const char *value,
 #ifdef HAVE_SECCOMP_NOTIFY
 	return set_config_string_item(&lxc_conf->seccomp.notifier.cookie, value);
 #else
-	return minus_one_set_errno(ENOSYS);
+	return ret_set_errno(-1, ENOSYS);
 #endif
 }
 
@@ -1033,7 +1033,7 @@ static int set_config_seccomp_notify_proxy(const char *key, const char *value,
 		return clr_config_seccomp_notify_proxy(key, lxc_conf, NULL);
 
 	if (strncmp(value, "unix:", 5) != 0)
-		return minus_one_set_errno(EINVAL);
+		return ret_set_errno(-1, EINVAL);
 
 	offset = value + 5;
 	if (lxc_unix_sockaddr(&lxc_conf->seccomp.notifier.proxy_addr, offset) < 0)
@@ -1041,7 +1041,7 @@ static int set_config_seccomp_notify_proxy(const char *key, const char *value,
 
 	return 0;
 #else
-	return minus_one_set_errno(ENOSYS);
+	return ret_set_errno(-1, ENOSYS);
 #endif
 }
 
@@ -3985,7 +3985,7 @@ static int get_config_seccomp_notify_cookie(const char *key, char *retv, int inl
 #ifdef HAVE_SECCOMP_NOTIFY
 	return lxc_get_conf_str(retv, inlen, c->seccomp.notifier.cookie);
 #else
-	return minus_one_set_errno(ENOSYS);
+	return ret_set_errno(-1, ENOSYS);
 #endif
 }
 
@@ -3998,7 +3998,7 @@ static int get_config_seccomp_notify_proxy(const char *key, char *retv, int inle
 				    ? &c->seccomp.notifier.proxy_addr.sun_path[0]
 				    : &c->seccomp.notifier.proxy_addr.sun_path[1]);
 #else
-	return minus_one_set_errno(ENOSYS);
+	return ret_set_errno(-1, ENOSYS);
 #endif
 }
 
@@ -4611,7 +4611,7 @@ static inline int clr_config_seccomp_notify_cookie(const char *key,
 	c->seccomp.notifier.cookie = NULL;
 	return 0;
 #else
-	return minus_one_set_errno(ENOSYS);
+	return ret_set_errno(-1, ENOSYS);
 #endif
 }
 
@@ -4623,7 +4623,7 @@ static inline int clr_config_seccomp_notify_proxy(const char *key,
 	       sizeof(c->seccomp.notifier.proxy_addr));
 	return 0;
 #else
-	return minus_one_set_errno(ENOSYS);
+	return ret_set_errno(-1, ENOSYS);
 #endif
 }
 
@@ -5064,7 +5064,7 @@ static int clr_config_net_l2proxy(const char *key, struct lxc_conf *lxc_conf,
 	struct lxc_netdev *netdev = data;
 
 	if (!netdev)
-		return minus_one_set_errno(EINVAL);
+		return ret_set_errno(-1, EINVAL);
 
 	netdev->l2proxy = false;
 
@@ -5093,7 +5093,7 @@ static int clr_config_net_ipvlan_mode(const char *key,
 	struct lxc_netdev *netdev = data;
 
 	if (!netdev)
-		return minus_one_set_errno(EINVAL);
+		return ret_set_errno(-1, EINVAL);
 
 	if (netdev->type != LXC_NET_IPVLAN)
 		return 0;
@@ -5109,7 +5109,7 @@ static int clr_config_net_ipvlan_isolation(const char *key,
 	struct lxc_netdev *netdev = data;
 
 	if (!netdev)
-		return minus_one_set_errno(EINVAL);
+		return ret_set_errno(-1, EINVAL);
 
 	if (netdev->type != LXC_NET_IPVLAN)
 		return 0;
@@ -5125,7 +5125,7 @@ static int clr_config_net_veth_mode(const char *key,
 	struct lxc_netdev *netdev = data;
 
 	if (!netdev)
-		return minus_one_set_errno(EINVAL);
+		return ret_set_errno(-1, EINVAL);
 
 	if (netdev->type != LXC_NET_VETH)
 		return 0;
@@ -5493,7 +5493,7 @@ static int get_config_net_ipvlan_mode(const char *key, char *retv, int inlen,
 		memset(retv, 0, inlen);
 
 	if (!netdev)
-		return minus_one_set_errno(EINVAL);
+		return ret_set_errno(-1, EINVAL);
 
 	if (netdev->type != LXC_NET_IPVLAN)
 		return 0;
@@ -5532,7 +5532,7 @@ static int get_config_net_ipvlan_isolation(const char *key, char *retv, int inle
 		memset(retv, 0, inlen);
 
 	if (!netdev)
-		return minus_one_set_errno(EINVAL);
+		return ret_set_errno(-1, EINVAL);
 
 	if (netdev->type != LXC_NET_IPVLAN)
 		return 0;
@@ -5571,7 +5571,7 @@ static int get_config_net_veth_mode(const char *key, char *retv, int inlen,
 		memset(retv, 0, inlen);
 
 	if (!netdev)
-		return minus_one_set_errno(EINVAL);
+		return ret_set_errno(-1, EINVAL);
 
 	if (netdev->type != LXC_NET_VETH)
 		return 0;
@@ -5800,7 +5800,7 @@ static int get_config_net_veth_ipv4_route(const char *key, char *retv, int inlen
 		memset(retv, 0, inlen);
 
 	if (!netdev)
-		return minus_one_set_errno(EINVAL);
+		return ret_set_errno(-1, EINVAL);
 
 	if (netdev->type != LXC_NET_VETH)
 		return 0;
@@ -5891,7 +5891,7 @@ static int get_config_net_veth_ipv6_route(const char *key, char *retv, int inlen
 		memset(retv, 0, inlen);
 
 	if (!netdev)
-		return minus_one_set_errno(EINVAL);
+		return ret_set_errno(-1, EINVAL);
 
 	if (netdev->type != LXC_NET_VETH)
 		return 0;

src/lxc/confile_utils.c

@@ -503,7 +503,7 @@ int lxc_veth_mode_to_flag(int *mode, const char *value)
 		return 0;
 	}
 
-	return minus_one_set_errno(EINVAL);
+	return ret_set_errno(-1, EINVAL);
 }
 
 static struct lxc_macvlan_mode {

src/lxc/file_utils.c

@@ -18,6 +18,27 @@
 #include "string_utils.h"
 #include "utils.h"
 
+int lxc_open_dirfd(const char *dir)
+{
+	return open(dir, O_DIRECTORY | O_RDONLY | O_CLOEXEC);
+}
+
+int lxc_readat(int dirfd, const char *filename, void *buf, size_t count)
+{
+	__do_close_prot_errno int fd = -EBADF;
+	ssize_t ret;
+
+	fd = openat(dirfd, filename, O_RDONLY | O_CLOEXEC);
+	if (fd < 0)
+		return -1;
+
+	ret = lxc_read_nointr(fd, buf, count);
+	if (ret < 0 || (size_t)ret != count)
+		return -1;
+
+	return 0;
+}
+
 int lxc_writeat(int dirfd, const char *filename, const void *buf, size_t count)
 {
 	__do_close_prot_errno int fd = -EBADF;
@@ -34,6 +55,18 @@ int lxc_writeat(int dirfd, const char *filename, const void *buf, size_t count)
 	return 0;
 }
 
+int lxc_write_openat(const char *dir, const char *filename, const void *buf,
+		     size_t count)
+{
+	__do_close_prot_errno int dirfd = -EBADF;
+
+	dirfd = open(dir, O_DIRECTORY | O_RDONLY | O_CLOEXEC);
+	if (dirfd < 0)
+		return -1;
+
+	return lxc_writeat(dirfd, filename, buf, count);
+}
+
 int lxc_write_to_file(const char *filename, const void *buf, size_t count,
 		      bool add_newline, mode_t mode)
 {

src/lxc/file_utils.h

@@ -15,8 +15,11 @@
 /* read and write whole files */
 extern int lxc_write_to_file(const char *filename, const void *buf,
 			     size_t count, bool add_newline, mode_t mode);
+extern int lxc_readat(int dirfd, const char *filename, void *buf, size_t count);
 extern int lxc_writeat(int dirfd, const char *filename, const void *buf,
 		       size_t count);
+extern int lxc_write_openat(const char *dir, const char *filename,
+			    const void *buf, size_t count);
 extern int lxc_read_from_file(const char *filename, void *buf, size_t count);
 
 /* send and receive buffers completely */
@@ -47,5 +50,6 @@ extern ssize_t lxc_sendfile_nointr(int out_fd, int in_fd, off_t *offset,
 				   size_t count);
 extern char *file_to_buf(char *path, size_t *length);
 extern int fd_to_fd(int from, int to);
+extern int lxc_open_dirfd(const char *dir);
 
 #endif /* __LXC_FILE_UTILS_H */

src/lxc/log.h

@@ -26,13 +26,6 @@
 #define LXC_LOG_PREFIX_SIZE	32
 #define LXC_LOG_BUFFER_SIZE	4096
 
-/* This attribute is required to silence clang warnings */
-#if defined(__GNUC__)
-#define ATTR_UNUSED __attribute__ ((unused))
-#else
-#define ATTR_UNUSED
-#endif
-
 /* predefined lxc log priorities. */
 enum lxc_loglevel {
 	LXC_LOG_LEVEL_TRACE,
@@ -245,10 +238,10 @@ static inline void __lxc_log(const struct lxc_log_category *category,
  */
 #define lxc_log_priority_define(acategory, LEVEL)				\
 										\
-ATTR_UNUSED __attribute__ ((format (printf, 2, 3)))				\
+__lxc_unused __attribute__ ((format (printf, 2, 3)))				\
 static inline void LXC_##LEVEL(struct lxc_log_locinfo *, const char *, ...);	\
 										\
-ATTR_UNUSED static inline void LXC_##LEVEL(struct lxc_log_locinfo* locinfo,	\
+__lxc_unused static inline void LXC_##LEVEL(struct lxc_log_locinfo* locinfo,	\
 					   const char* format, ...)		\
 {										\
 	if (lxc_log_priority_is_enabled(acategory, LXC_LOG_LEVEL_##LEVEL)) {	\
@@ -484,19 +477,6 @@ ATTR_UNUSED static inline void LXC_##LEVEL(struct lxc_log_locinfo* locinfo,	\
 	} while (0)
 #endif
 
-#define error_log_errno(__errno__, format, ...)  \
-	({                                       \
-		errno = __errno__;               \
-		SYSERROR(format, ##__VA_ARGS__); \
-		-1;                              \
-	})
-
-#define log_trace(__ret__, format, ...)	      \
-	({                                    \
-		TRACE(format, ##__VA_ARGS__); \
-		__ret__;                      \
-	})
-
 #define log_error_errno(__ret__, __errno__, format, ...) \
 	({						 \
 		errno = __errno__;			 \
@@ -510,6 +490,19 @@ ATTR_UNUSED static inline void LXC_##LEVEL(struct lxc_log_locinfo* locinfo,	\
 		__ret__;		      \
 	})
 
+#define log_trace_errno(__ret__, __errno__, format, ...) \
+	({                                               \
+		errno = __errno__;			 \
+		SYSTRACE(format, ##__VA_ARGS__);         \
+		__ret__;                                 \
+	})
+
+#define log_trace(__ret__, format, ...)	      \
+	({                                    \
+		TRACE(format, ##__VA_ARGS__); \
+		__ret__;                      \
+	})
+
 #define log_warn_errno(__ret__, __errno__, format, ...) \
 	({						\
 		errno = __errno__;			\
@@ -517,16 +510,30 @@ ATTR_UNUSED static inline void LXC_##LEVEL(struct lxc_log_locinfo* locinfo,	\
 		__ret__;				\
 	})
 
+#define log_debug_errno(__ret__, __errno__, format, ...) \
+	({						 \
+		errno = __errno__;		         \
+		SYSDEBUG(format, ##__VA_ARGS__);	 \
+		__ret__;				 \
+	})
+
 #define log_debug(__ret__, format, ...)	      \
 	({				      \
 		DEBUG(format, ##__VA_ARGS__); \
 		__ret__;		      \
 	})
 
-#define log_debug_errno(__ret__, __errno__, format, ...) \
-	({						 \
-		SYSDEBUG(format, ##__VA_ARGS__);	 \
-		__ret__;				 \
+#define log_info_errno(__ret__, __errno__, format, ...) \
+	({                                              \
+		errno = __errno__;                      \
+		SYSINFO(format, ##__VA_ARGS__);         \
+		__ret__;                                \
+	})
+
+#define log_info(__ret__, format, ...)       \
+	({                                   \
+		INFO(format, ##__VA_ARGS__); \
+		__ret__;                     \
 	})
 
 extern int lxc_log_fd;

src/lxc/lxccontainer.c

@@ -5262,7 +5262,7 @@ out:
 static int do_lxcapi_seccomp_notify_fd(struct lxc_container *c)
 {
 	if (!c || !c->lxc_conf)
-		return minus_one_set_errno(-EINVAL);
+		return ret_set_errno(-1, -EINVAL);
 
 	return lxc_seccomp_get_notify_fd(&c->lxc_conf->seccomp);
 }

src/lxc/macro.h

@@ -442,18 +442,18 @@ enum {
 		__internal_fd__;            \
 	})
 
-#define minus_one_set_errno(__errno__) \
-	({                             \
-		errno = __errno__;     \
-		-1;                    \
-	})
-
 #define ret_set_errno(__ret__, __errno__) \
 	({                                \
 		errno = __errno__;        \
 		__ret__;                  \
 	})
 
+#define ret_errno(__errno__)       \
+	({                         \
+		errno = __errno__; \
+		-__errno__;        \
+	})
+
 #define free_replace_move_ptr(a, b) \
 	({                          \
 		free(a);            \

src/lxc/start.c

@@ -1119,8 +1119,8 @@ void lxc_abort(const char *name, struct lxc_handler *handler)
 static int do_start(void *data)
 {
 	struct lxc_handler *handler = data;
-	ATTR_UNUSED __do_close_prot_errno int data_sock0 = handler->data_sock[0],
-					      data_sock1 = handler->data_sock[1];
+	__lxc_unused __do_close_prot_errno int data_sock0 = handler->data_sock[0],
+					   data_sock1 = handler->data_sock[1];
 	__do_close_prot_errno int status_fd = -EBADF;
 	int ret;
 	uid_t new_uid;
@@ -1132,7 +1132,7 @@ static int do_start(void *data)
 
 	lxc_sync_fini_parent(handler);
 
-	if (lxc_abstract_unix_recv_fds(handler->data_sock[1], &status_fd, 1, NULL, 0) < 0) {
+	if (lxc_abstract_unix_recv_fds(data_sock1, &status_fd, 1, NULL, 0) < 0) {
 		ERROR("Failed to receive status file descriptor to child process");
 		goto out_warn_father;
 	}