Set no_new_privs after setting the lsm label. If we do set it before we aren't
allowed to change the label anymore.
Signed-off-by: Christian Brauner <christian.brauner@canonical.com>

Signed-off-by: Christian Brauner <christian.brauner@canonical.com>

syslog tweaks

console: use correct log name

Signed-off-by: Christian Brauner <christian.brauner@mailbox.org>

Signed-off-by: Christian Brauner <christian.brauner@mailbox.org>

- add lxc_syslog_priority_to_string()
- add lxc_syslog_priority_to_int()
- remove syslog_facility struct
- add lxc.syslog to lxc_getconfig struct
- adapt config_syslog() callback
Signed-off-by: Christian Brauner <christian.brauner@mailbox.org>

lxc_console is used with lxc_console.c
Signed-off-by: Christian Brauner <christian.brauner@mailbox.org>

templates: remove creation of bogus directory in Debian templates

An incorrect quoting introduced in bf39edb3 caused a /{lib,etc} folder to
appear in Debian templates

The very next line :
    mkdir -p "${rootfs}/etc/systemd/system/getty.target.wants

makes creating ${rootfs}/etc/systemd/system/ unnecessary in the first
place
Signed-off-by: Maxime Besson <maxime.besson@smile.fr>

templates: rm halt.target -> sigpwr.target symlink

Given commit 330ae3d3:

    lxccontainer: detect if we should send SIGRTMIN+3

    This is required by systemd to cleanly shutdown. Other init systems should not
    have SIGRTMIN+3 in the blocked signals set.

we should stop symlinking halt.target to sigpwr.target for systemd.
Signed-off-by: Christian Brauner <cbrauner@suse.de>

set FULL_PATH_NAMES=NO in doc/api/Doxyfile

otherwise the generated docs have the full build path in them
and nonbody cares that the files were built in
 /build/lxc-_BVY2u/lxc-2.0.4/src/lxc/
Signed-off-by: Evgeni Golov <evgeni@debian.org>

Migration fixes

Previously, we write a "success" status but tried to parse the pid. This
meant that we wouldn't notice a successful restore but failure to parse the
pid, which was a little strange.

We still don't know the child pid, so we will end up with a restored
process tree and a running container, but at least in this case the API
will return false indicating that something failed.

We could kill(-1, 9) in this case, but since liblxc runs as root sometimes
(e.g. LXD), that would be a Very Bad Thing.
Signed-off-by: Tycho Andersen <tycho.andersen@canonical.com>

Signed-off-by: Tycho Andersen <tycho.andersen@canonical.com>

c/r: Fix pid_t on some arches

Signed-off-by: Stéphane Graber <stgraber@ubuntu.com>

c/r: use /proc/self/tid/children instead of pidfile

All we really needed a unique temp file for was passing the pid. Since CRIU
opened this with O_EXCL | O_CREAT, this was "safe" (users could still
overwrite it afterwards, but the monitor would immediately die since the
only valid number in there was the init process).

In any case, we can just read /proc/self/tid/children, which lists the
child process.

Closes #1150
Signed-off-by: Tycho Andersen <tycho.andersen@canonical.com>

tools: use boolean for ret in lxc_device.c

Signed-off-by: Christian Brauner <cbrauner@suse.de>

tools: use exit(EXIT_*) everywhere

add PLD Linux support to upstream repo

from pld-linux repo:
https://github.com/pld-linux/lxc/commits/auto/th/lxc-2.0.4-1/lxc-pld.in.sh
https://github.com/pld-linux/lxc/commits/auto/th/lxc-2.0.4-1/lxc-pld.patchSigned-off-by: Elan Ruusamäe <glen@delfi.ee>

templates: fedora requires openssl binary

/usr/share/lxc/templates/lxc-fedora: line 1078: openssl: command not found
Signed-off-by: Elan Ruusamäe <glen@delfi.ee>

use fd 9 instead of 200

to catch up mksh changes from 17abf278Signed-off-by: Elan Ruusamäe <glen@delfi.ee>

seccomp: non functional changes

- log more errnos
- adapt coding style
Signed-off-by: Christian Brauner <cbrauner@suse.de>

confile: add more archs to lxc_config_parse_arch()

seccomp: add support for s390x

Signed-off-by: Christian Brauner <cbrauner@suse.de>

Signed-off-by: Christian Brauner <cbrauner@suse.de>

Signed-off-by: Christian Brauner <cbrauner@suse.de>

Add MIPS support

Signed-off-by: James Cowgill <james410@cowgill.org.uk>

Fixes "unsupported personality" warnings when starting containers.
Signed-off-by: James Cowgill <james410@cowgill.org.uk>