For generated profiles with apparmor namespaces we get
profile names with slashes in them. To match those, we need
to allow changing to lxc-**, not just lxc-*.
Signed-off-by: Wolfgang Bumiller <w.bumiller@proxmox.com>

remove cgmanager rules and add fstype=cgroup2 variants for
the existing fstype=cgroup rules
Signed-off-by: Wolfgang Bumiller <w.bumiller@proxmox.com>

Signed-off-by: Wolfgang Bumiller <w.bumiller@proxmox.com>

Signed-off-by: Wolfgang Bumiller <w.bumiller@proxmox.com>

Always return -1 on error (some code paths returned -1, some
returned negative error codes), don't assume 'errno' is set
afterwards, as the function already prints errors and not
all code paths will have a usable errno value.
Signed-off-by: Wolfgang Bumiller <w.bumiller@proxmox.com>

don't kill all my processes when running it as user...
Signed-off-by: Wolfgang Bumiller <w.bumiller@proxmox.com>

Signed-off-by: Wolfgang Bumiller <w.bumiller@proxmox.com>

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Signed-off-by: 2xsec <dh48.jeong@samsung.com>

Signed-off-by: 2xsec <dh48.jeong@samsung.com>

Explicit null dereferenced
Signed-off-by: 2xsec <dh48.jeong@samsung.com>

Signed-off-by: 2xsec <dh48.jeong@samsung.com>

Signed-off-by: 2xsec <dh48.jeong@samsung.com>

Signed-off-by: 2xsec <dh48.jeong@samsung.com>

Signed-off-by: 2xsec <dh48.jeong@samsung.com>

Signed-off-by: 2xsec <dh48.jeong@samsung.com>

Signed-off-by: 2xsec <dh48.jeong@samsung.com>

Signed-off-by: 2xsec <dh48.jeong@samsung.com>

openSUSE Leap 15 is using --libdir=/usr/lib64 when building for
x86_64 so we need to allow this path in the apparmor profiles.

Link: https://bugzilla.opensuse.org/show_bug.cgi?id=1099239Signed-off-by: Markos Chandras <mchandras@suse.de>

This means they need to be added for remount and for fresh mounts.
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Argument cannot be negative
Signed-off-by: 2xsec <dh48.jeong@samsung.com>

Signed-off-by: 2xsec <dh48.jeong@samsung.com>

Signed-off-by: 2xsec <dh48.jeong@samsung.com>

Signed-off-by: 2xsec <dh48.jeong@samsung.com>

Passing additional configuration options with "--define" was broken.

Result of git bisect:
d899f11b is the first bad commit
Signed-off-by: Felix Abecassis <fabecassis@nvidia.com>

Signed-off-by: 2xsec <dh48.jeong@samsung.com>

Unchecked return value
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Unchecked return value
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

This improves handling kernels which allow userspace to create partially
functional devices nodes.
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Signed-off-by: 2xsec <dh48.jeong@samsung.com>

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

If users specified lxc.autodev = 1 it does not make sense to skip setting up
autodev if /dev does not exist. We rather should create it.
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Cc: Serge Hallyn <serge@hallyn.com>
Cc: Tycho Andersen <tycho@tycho.ws>