fix bug: unpriv lxc will run lxc.net.[i].script.up now

Signed-off-by: harryoooooooooo <ymsc27884@gmail.com>

coverity: #1425811

Resource leak
Signed-off-by: Donghwa Jeong <dh48.jeong@samsung.com>

coverity: #1425753

Copy into fixed size buffer
Signed-off-by: Donghwa Jeong <dh48.jeong@samsung.com>

coverity: #1425836

Resource leak
Signed-off-by: Donghwa Jeong <dh48.jeong@samsung.com>

pam_cgfs: fix Logically dead code.

coverity: #1425849, #1425821, #1425794, #1425779, #1425777, #1425795, #1425841

Signed-off-by: Donghwa Jeong <dh48.jeong@samsung.com>

Signed-off-by: Donghwa Jeong <dh48.jeong@samsung.com>

Signed-off-by: Donghwa Jeong <dh48.jeong@samsung.com>

Signed-off-by: Donghwa Jeong <dh48.jeong@samsung.com>

Signed-off-by: Donghwa Jeong <dh48.jeong@samsung.com>

Signed-off-by: Donghwa Jeong <dh48.jeong@samsung.com>

Signed-off-by: Donghwa Jeong <dh48.jeong@samsung.com>

Signed-off-by: Donghwa Jeong <dh48.jeong@samsung.com>

Revert "seccomp: make do_resolve_add_rule() more strict"

Reported-by: Felix Abecassis <fabecassis@nvidia.com>
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Fix typo

Signed-off-by: Stéphane Graber <stgraber@ubuntu.com>

This reverts commit dfddc8aa.

Closes #2376.
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

conf: change some logs to print errno

Signed-off-by: Donghwa Jeong <dh48.jeong@samsung.com>

conf: copy mountinfo for remount_all_slave()

support tls in cross-compile

AC_RUN_IFELSE will fail in cross-compile,
we can use AC_COMPILE_IFELSE replace.
Signed-off-by: duguhaotian <duguhaotian@gmail.com>

While a container reads mountinfo from proc fs, the mountinfo can be changed by
the kernel anytime. This has caused critical issues on some devices.

Signed-off-by: Donghwa Jeong dh48.jeong@samsung.com
Reported-by: Donghwa Jeong dh48.jeong@samsung.com
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

More seccomp fixes

The mask was unconditionally parsed, it failed if no mask was
provided.
Signed-off-by: Felix Abecassis <fabecassis@nvidia.com>

The last (optional) argument was named "valueTwo", which seems to
originate from the OCI runtime spec:
https://github.com/opencontainers/runtime-spec/blob/master/config-linux.md#seccomp

In proper seccomp terminology, "value" is "datum_a" and "valueTwo" is "datum_b".

However, LXC's "valueTwo" was used as the mask for SCMP_CMP_MASKED_EQ,
while the mask is supposed to be "datum_a".
Signed-off-by: Felix Abecassis <fabecassis@nvidia.com>

tree-wide: handle EINTR in some read()/write()

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Patch lxc-update-config

The current script doesn't generate a valid configuration for
lxc.network.ipv4 key, it lacking an .address part which lead to:

parse.c: lxc_file_for_each_line: 58 Failed to parse config: lxc.net.0.ipv4 = 192.168.10.101/24
Signed-off-by: Julien Surloppe <julien@surloppe.fr>

This patch fixes
commit 6e62213e ("templates: actually create DOWNLOAD_TEMP directory".
To use mktemp -p correctly the directories need to exist. So call mkdir -p.
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

templates: actually create DOWNLOAD_TEMP directory

The way 'mktemp' is currently used you will get a temp directory in
$TMPDIR or '/tmp' and DOWNLOAD_TEMP will not be pointing to an actual
directory. This will result in the wget operations failing and the
container will fail to create:

    ERROR: Failed to download http://....

Instead we want to use the '-p' option for mktemp to set the base path
and this will ensure that the temp directory is created in the correct
location and DOWNLOAD_TEMP will be consistent with this location.
Signed-off-by: Mark Asselstine <mark.asselstine@windriver.com>

confile_utils: apply strprint()