This is to avoid:

https://errors.ubuntu.com/problem/d640a68bf7343705899d7ca8c6bc070d477cd845Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>

Update for commit a8dfe4e0 and 6039eaa2Signed-off-by: KATOH Yasufumi <karma@jazz.email.ne.jp>
Acked-by: Stéphane Graber <stgraber@ubuntu.com>

Update for commit c154af98Signed-off-by: KATOH Yasufumi <karma@jazz.email.ne.jp>
Acked-by: Stéphane Graber <stgraber@ubuntu.com>

Signed-off-by: KATOH Yasufumi <karma@jazz.email.ne.jp>
Acked-by: Stéphane Graber <stgraber@ubuntu.com>

Check if symbols SCMP_ARCH_ARM and SCMP_ARCH_PPC are defined.
Signed-off-by: Christian Brauner <christian.brauner@mailbox.org>
Acked-by: Serge E. Hallyn <serge.hallyn@ubuntu.com>

Generally we enforce that a [arch] seccomp section can only be used on [arch].
However, on amd64 we allow [i386] sections for i386 containers, and there we
also take [all] sections and apply them for both 32- and 64-bit.

Do that also for ppc64 and arm64.  This allows seccomp-protected armhf
containers to run on arm64.
Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
Acked-by: Stéphane Graber <stgraber@ubuntu.com>

In which case lxc will not update the apparmor profile at all.
Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
Acked-by: Stéphane Graber <stgraber@ubuntu.com>

Update for commit 2b47bac3Signed-off-by: Sungbae Yoo <sungbae.yoo@samsung.com>
Acked-by: Stéphane Graber <stgraber@ubuntu.com>

The commit: e5848d39 <netdev_move_by_index: support wlan> only
made netdev_move_by_name support wlan, instead of netdev_move_by_index.

Given netdev_move_by_name is a wrapper of netdev_move_by_index, so here
replacing all of the call to lxc_netdev_move_by_index with lxc_netdev_move_by_name
to let lxc-start support wlan phys.
Signed-off-by: fupan li <fupan.li@windriver.com>
Acked-by: Serge E. Hallyn <serge.hallyn@ubuntu.com>

Signed-off-by: Wolfgang Bumiller <w.bumiller@proxmox.com>
Acked-by: Serge E. Hallyn <serge.hallyn@ubuntu.com>

If manual mounting with elevated permissions is required
this can currently only be done in pre-start hooks or before
starting LXC. In both cases the mounts would appear in the
host's namespace.
With this flag the namespace is unshared before the startup
sequence, so that mounts performed in the pre-start hook
don't show up on the host.
Signed-off-by: Wolfgang Bumiller <w.bumiller@proxmox.com>
Acked-by: Serge E. Hallyn <serge.hallyn@ubuntu.com>

v2: get rid of extra debug crap
Signed-off-by: Tycho Andersen <tycho.andersen@canonical.com>
Acked-by: Serge E. Hallyn <serge.hallyn@ubuntu.com>

Signed-off-by: Stéphane Graber <stgraber@ubuntu.com>
Acked-by: Serge E. Hallyn <serge.hallyn@ubuntu.com>

This is currently breaking our daily image builds which happen in a
perfectly clean environment without a Debian keyring and without
anything in /var/cache/lxc
Signed-off-by: Stéphane Graber <stgraber@ubuntu.com>

lxc_container struct: add comment about moving member fns

Better handle preserve_ns behavior

Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>

Signed-off-by: Stéphane Graber <stgraber@ubuntu.com>
Acked-by: Serge E. Hallyn <serge.hallyn@ubuntu.com>

lxcapi_clone: restore the unexpanded config len

Otherwise it gets shortened with the temporary len but never
restored - which will only break API users which do a clone
then continue to use the original container, meaning this is
a hard one to detect.
Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>

It breaks container starts.

This reverts commit 473ebc77.

Commit b6b2b194 preserves the container's namespaces for
possible later use in stop hook.  But some kernels don't have
/proc/pid/ns/ns for all the namespaces we may be interested in.
So warn but continue if this is the case.

Implement stgraber's suggested semantics.

 - User requests some namespaces be preserved:
    - If /proc/self/ns is missing => fail (saying kernel misses setns)
    - If /proc/self/ns/<namespace> entry is missing => fail (saying kernel misses setns for <namespace>)
 - User doesn't request some namespaces be preserved:
    - If /proc/self/ns is missing => log an INFO message (kernel misses setns) and continue
    - If /proc/self/ns/<namespace> entry is missing => log an INFO message (kernel misses setns for <namespace>) and continue
Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>

lxc-ls: use /usr/bin/env to find an appropriate python3 to run

Fetch Debian archive GPG keyrings when they're not available

seccomp: handle inverted arch

Closes #694

When we start cloning container c1 to c2, we first save c1's
configuration in c2's as a starting point.  We long ago cleared
out the lxc.rootfs entry before saving it, so that if we are
killed before we update the rootfs, c2's rootfs doesn't point
to c1's.  Because then lxc-destroy -n c2 would delete c1's rootfs.

But when we introduced the unexpanded_config, we didn't update
this code to clear the rootfs out of the unexpanded_config, which
is what now actually gets saved in write_config().

Do so.
Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
Acked-by: Stéphane Graber <stgraber@ubuntu.com>

Local variables should not have the same name as global variables to avoid
confusion.
Signed-off-by: Christian Brauner <christian.brauner@mailbox.org>
Acked-by: Serge E. Hallyn <serge.hallyn@ubuntu.com>

When we create a random container directory with mkdtemp() we set the mode to
0770 otherwise do_lxcapi_clone() will complain about not being able to create
the config.
Signed-off-by: Christian Brauner <christianvanbrauner@gmail.com>
Acked-by: Serge E. Hallyn <serge.hallyn@ubuntu.com>

When the clone failed we tried to destroy the container. This will lead to a
segfault. Instead simply return -1. Also move the call to free_mnts() after the
put label to free the user specified mounts even when we just goto put.
Signed-off-by: Christian Brauner <christianvanbrauner@gmail.com>
Acked-by: Serge E. Hallyn <serge.hallyn@ubuntu.com>

(A trivial fix for lxc-copy is included.)
Signed-off-by: Christian Brauner <christian.brauner@mailbox.org>

This is a complete reimplementation of lxc-clone and lxc-start-ephemeral.
lxc-copy merges the functionalities of lxc-clone + lxc-start-ephemeral.

(1) Cloning containers:

	(a) as copy:

		lxc-copy -n aa -N bb

	(b) as snapshot:

		lxc-copy -n aa -N bb -s

(2) Renaming containers:

	lxc-copy -n aa -N bb -R

(3) Starting ephemeral containers:

Ephemeral containers are created and started by passing the flag -e /
--ephemeral. Whenever this flag is missing a copy of the container is created.
The flag -e / --ephemeral implies -s / --snapshot.

	(a) start ephemeral container daemonized with random name:

		lxc-copy -n aa -e

	(b) start ephemeral container in foreground mode with random name:

		lxc-copy -n aa -e -F

	(c) start ephemeral container with specified name in daemonized mode:
	    Analogous to lxc-start ephemeral containers start in daemonized
            mode per default:

		lxc-copy -n aa -N bb -e

	    One can however also explicitly pass -d / --daemon:

		lxc-copy -n aa -N bb -e -d

	    but both commands are equivalent.

	(d) start non-ephemeral container in daemonized mode:

		lxc-copy -n aa -D -e

	(e) start ephemeral container in daemonized mode and keep the original
	    hostname:

		lxc-copy -n aa -K -e

	(f) start ephemeral container in daemonized mode and keep the
	    MAC-address of the original container:

		lxc-copy -n aa -M -e

	(g) start ephemeral container with custom mounts (additional mounts can
            be of type {bind,aufs,overlay}) in daemonized mode:

		lxc-copy -n aa -e -m bind=/src:/dest:ro,aufs=/src:/dest,overlay=/src:/dest

(4) Other options:

	lxc-copy --help

In order to create a random containername and random upper- and workdirs for
custom mounts we use mkdtemp() to not just create the names but also directly
create the corresponding directories. This will be safer and make the code
considerably shorter.
Signed-off-by: Christian Brauner <christianvanbrauner@gmail.com>
Acked-by: Serge E. Hallyn <serge.hallyn@ubuntu.com>

Instead, let's just allocate new space for the proctitle to live and point
the kernel at that.

v2: take out testing hunk
v3: check return from realloc
Signed-off-by: Tycho Andersen <tycho.andersen@canonical.com>
Acked-by: Serge E. Hallyn <serge.hallyn@ubuntu.com>

lxc uses uname to check the kernel version.  Seccomp respects userspace.  In the case
of 32-bit userspace on 64-bit kernel, this was a bad combination.

When we run into that case, make sure that the compat seccomp context is 32-bit, and
the lxc->seccomp_ctx is the 64-bit.

Closes #654
Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>

 - Update list of supported releases
 - Make the fallback release trusty
 - Don't specify the compression algorithm (use auto-detection) so that
   people passing tarballs to the template don't see regressions.
Signed-off-by: Stéphane Graber <stgraber@ubuntu.com>
Acked-by: Serge E. Hallyn <serge.hallyn@ubuntu.com>

When running the debian template on a non-debian host, it's usual not to
have debian-archive-keyring.gpg. When that happens, we skip the
signature checking of the release, which is dangerous because it's made over
HTTP.

This commit adds automatic fetching of Debian release keys.

Strongly related to #409
Signed-off-by: Virgil Dupras <hsoft@hardcoded.net>

This fixes invocations of certain commands when python3 is installed in
a nonstandard path (/usr/local/bin, for example).
Signed-off-by: Fox Wilson <2016fwilson@tjhsst.edu>

This isn't in any way fatal, so let's only warn about it with INFO, not
ERROR.
Signed-off-by: Tycho Andersen <tycho.andersen@canonical.com>
Acked-by: Serge E. Hallyn <serge.hallyn@ubuntu.com>

Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>

Instead of relying on the old ptrace loop, we should instead put all the
tasks in the container into the freezer. This will stop them all at the
same time, preventing fork bombs from causing criu to infinite loop (and is
also simply a lot faster).

Note that this uses --freeze-cgroup which isn't in criu 1.7, so it should
only go into master.
Signed-off-by: Tycho Andersen <tycho.andersen@canonical.com>
Acked-by: Stéphane Graber <stgraber@ubuntu.com>

PR_SET_MM_MAP only went in to the kernel at 3.18 (or 3.19), so we need to
define these for kernels before then. If there was an error, the code
simply logs the failure and continues on.

Also, we can drop the PR_SET_MM_otherstuff contstants since those were
dropped in 93525c00.
Signed-off-by: Tycho Andersen <tycho.andersen@canonical.com>
Acked-by: Stéphane Graber <stgraber@ubuntu.com>