This adds lxc_config_item_is_supported() as API extension. It allows to check
whether a given config item (e.g. lxc.autodev) is supported by this LXC
instance. The function is useful in the following scenarios:
1. Users have compiled liblxc from source and have removed a config items from
   the corresponding struct in confile.c. (For example, embedded users might
   decide to gut a bunch of options that they cannot use.)
2. Callers that want to check for a specific configuration item independent of
   the version numbers exposed in our version.h header.
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Change sshd template to work with Ubuntu 17.04

A few things have changed and this patch makes container generated for sshd work in Ubuntu
Signed-off-by: Nikolay Martynov <mar.kolya@gmail.com>

utils: tweak lxc_mount_proc_if_needed()

Create /proc directory if it doesn't exist.

Closes #1475.
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Closes #1475.
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

conf: close fd in lxc_setup_devpts()

This left the file descriptor to the underlying /dev/ptmx file open which
confused the hell out of criu. Let's close it.

Closes https://github.com/lxc/lxd/issues/3243.
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

doc: add lxc.limit to lxc.container.conf(5)

Update for commit 93f9e90dSigned-off-by: KATOH Yasufumi <karma@jazz.email.ne.jp>

confile: fix musl build

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

cgroups: improve cgfsng debugging

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

In a lot of cases we need a list of the writeable cgroup controllers detected
by the cgfsng driver.
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

utils: use loop device helpers from LXD

create ISSUE_TEMPLATE.md

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Use the loop device helpers I wrote for LXD in LXC as well. They should be more
efficient.
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

conf: use bind-mount for /dev/ptmx

AppArmor will refuse on /dev/ptmx being a symlink.
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

autotools: check for cap_get_file

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

caps: skip file capability checks on android

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

attach|unshare: fix the wrong comment

Signed-off-by: 0x0916 <w@laoqinren.net>

fix typo introduced in #1509

Signed-off-by: Evgeni Golov <evgeni@debian.org>

idmap improvements

ls: simplify the judgment condition when list active containers

Signed-off-by: 0x0916 <w@laoqinren.net>

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

The new{g,u}idmap binaries where a source of trouble for users when they lacked
sufficient privileges. This commit adds code to check for sufficient privilege.
It checks whether new{g,u}idmap is root owned and has the setuid bit set and if
it doesn't it checks whether new{g,u}idmap is root owned and has CAP_SETUID in
its CAP_PERMITTED and CAP_EFFECTIVE set.

Closes #296.
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Add two new helpers that allow to determine whether a given proc or file has a
capability in the given set and move lxc_cap_is_set() to static function that
both call internally.

Closes #296.
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

android: add prlimit implementation for 32bit