Closes: #3473.
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Signed-off-by: Johannes Kastl <kastl@b1-systems.de>

Signed-off-by: Johannes Kastl <kastl@b1-systems.de>

templates/lxc-download.in: fix wrong if condition (use the result of the gpg command, not the result when executing the result of the gpg command)
Signed-off-by: Johannes Kastl <kastl@b1-systems.de>

In `start.c:1284`, no_new_privs flag is set after LSM label is set.
Also, in `lxc.container.conf` documentation it is written that:
```
Note that PR_SET_NO_NEW_PRIVS is applied after the container has
changed into its intended AppArmor profile or SElinux context.
```
This commit fixes the behavior of `lxc_attach` by moving
`PR_SET_NO_NEW_PRIVS` set logic after LSM for the process is configured;

Closes #3393
Signed-off-by: Alexander Livenets <a.livenets@gmail.com>

Closes: Coverity 1465044.
Closes: Coverity 1465046.
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Fixes: Coverity 1465045.
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Signed-off-by: Wolfgang Bumiller <w.bumiller@proxmox.com>

Signed-off-by: Stéphane Graber <stgraber@ubuntu.com>

We're ignoring commands that we don't know about. They used to be fatal. Not
anymore.

Closes: #3459.
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Closes #3457
Signed-off-by: Stéphane Graber <stgraber@ubuntu.com>

Stopping a lxc container with without waiting on it was broken in master. This
patch fixes it.
Signed-off-by: Robert Vogelgesang <vogel@folz.de>

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

The previous change made things confusing by impliying there may be a
secondary when VLAN/IPVLAN/bridge members can only have a single parent
device.
Signed-off-by: Stéphane Graber <stgraber@ubuntu.com>

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

We can't do anything about the established kernel API but we can at least not
propagate the terminology.
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Signed-off-by: Gaurav Singh <gaurav1086@gmail.com>

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

It's now a wrapper around userns_exec_mapped_root() which allows us to avoid
fork() + exec() lxc-usernsexec makes things way nicer to test with ASAN etc.
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

If we set O_RDWR we won't be able to open directories and if we set O_PATH we
won't be able to chown.
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Closes: #3443.
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Signed-off-by: Thomas Parrott <thomas.parrott@canonical.com>

Signed-off-by: Thomas Parrott <thomas.parrott@canonical.com>

To avoid misleading errors about openvswitch when non-existent bridge link interface specified.
Signed-off-by: Thomas Parrott <thomas.parrott@canonical.com>

Signed-off-by: Thomas Parrott <thomas.parrott@canonical.com>

Signed-off-by: Thomas Parrott <thomas.parrott@canonical.com>

Previously if the user was root, then the test would just skip
running (and exit 0).  The lxc test environment is run as root.
So, instead of never doing anything there, we create a user,
make sure it is in /etc/sub{ug}id and then execute the test as that
user.

If user is already non-root, then just execute the tests as before.
Signed-off-by: Scott Moser <smoser@brickies.net>

The test executes lxc-usernsexec to create some files and chmod them.
Then makes assertions on the uid and gid of those files from outside.
Signed-off-by: Scott Moser <smoser@brickies.net>

Somehow it's documented but wasn't ever added.
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>