network: fix LXC_NET_NONE cleanup

We have a case where we have a nested container with LXC_NET_NONE run
inside a container that's *also* got no network namespace (run by
lxc-usernsexec).

The "am I root" check in this function then does not suffice, since the
euid of the task is 0 but it does not have privilege over its network
namespace, and thus cannot do any of the restore operations:

lxc foo 20201201232059.271 TRACE    network - network.c:lxc_restore_phys_nics_to_netns:3299 - Moving physical network devices back to parent network namespace
lxc foo 20201201232059.271 ERROR    network - network.c:lxc_restore_phys_nics_to_netns:3307 - Operation not permitted - Failed to enter network namespace
lxc foo 20201201232059.271 ERROR    start - start.c:__lxc_start:2045 - Failed to move physical network devices back to parent network namespace

Let's check that we indeed did clone the network namespace, and thus have
things to restore to their correct namespace before attempting to actually
restore them.

I suspect it's possible we can also get rid of some of the network namespace
preservation stuff in start.c in the LXC_NET_NONE case.
Signed-off-by: Tycho Andersen <tycho@tycho.pizza>

doc: Add lxc.cgroup.dir.monitor.pivot to Japanese man page

Signed-off-by: KATOH Yasufumi <karma@jazz.email.ne.jp>

commands_utils: fix lxc-wait

Closes: #3570
Fixes: 7792a5b6 ("commands: add additional check to lxc_cmd_sock_get_state()")
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

file_utils: fix config file parsing

We accidently used the "bytes_to_write" variable after we've written all the
bytes at which point it is guaranteed to be 0. Let's use the "bytes_read"
variable instead.
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

conf: improve mountinfo and config parsing

Closes: #3580.
Link: https://bugzilla.kernel.org/show_bug.cgi?id=209971Suggested-by: Joan Bruguera <joanbrugueram@gmail.com>
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

cgfsng: adjust log level to warn instead of error

Signed-off-by: lifeng68 <lifeng68@huawei.com>

attach: silence stdio permission adjust warnings

Closes: #3576.
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Add missing free for monitor_pivot_dir.

Signed-off-by: Ruben Jenster <r.jenster@drachenfels.de>

seccomp: fixes

Suggested-by: Jann Horn <jann@thejh.net>
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Suggested-by: Jann Horn <jann@thejh.net>
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

coverity fixes

to avoid liblxc stumbling over an smaller struct passed in from an older
liblxc. In the future we should version by size but this requires a new
attach2().
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Fixes: Coverity 1465853
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Fixes: Coverity 1465854
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Fixes: Coverity 1465855
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Fixes: Coverity 1465657
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

lxc-attach: Enable setting the SELinux context

cgroups: Introduce lxc.cgroup.dir.monitor.pivot - fixes cgroup removal on termination

seccomp: fix pseudo syscalls, improve logging and avoid duplicate processing

tests: Fix compilation with appamor enabled.

lxccontainer: fix lxc_config_item_is_supported

Enable lxc-attach to set the SELinux context that the user will end up
in when attaching to a container (This can be used to overwrite the
context set in the config file). If the option is not used, behavior
will be as before
Signed-off-by: Maximilian Blenk <Maximilian.Blenk@bmw.de>

Signed-off-by: Ruben Jenster <r.jenster@drachenfels.de>

Use exact match instead of longest prefix match
to check whether a config item is supported.
Signed-off-by: Ruben Jenster <r.jenster@drachenfels.de>

On termination lxc may fail to remove either lxc.cgroup.dir or lxc.cgroup.dir.monitor,
because the monitor process may still be a member of either of these cgroups.
The pivot cgroup should not be a member (subpath) of any other container cgroup (dir).
because only empty cgroups can be removed.
Signed-off-by: Ruben Jenster <r.jenster@drachenfels.de>

Signed-off-by: Ruben Jenster <r.jenster@drachenfels.de>

Signed-off-by: Ruben Jenster <r.jenster@drachenfels.de>

Update Japanese pam_cgfs(8) to reflect lack of support for pure cgroupv2

Update for commit b87ed83bSigned-off-by: KATOH Yasufumi <karma@jazz.email.ne.jp>

conf: account for early return when sending devpts fd