Signed-off-by: Claudio Kuenzler <ck@claudiokuenzler.com>

Use file/directory names from macro.h

cgroups: support cgroup2 freezer

suppress false-negative error in templates and nvidia hook

lxc-attach: make sure exit status of command is returned

[aa-profile] Deny access to /proc/acpi/**

Signed-off-by: Pierre-Elliott Bécue <becue@crans.org>

Commit ae68cad7 introduced a regression that
makes lxc-attach ignore the exit status of the executed command. This was first
identified in 3.0.4 LTS, while it worked on 3.0.3.

  # lxc-attach --version
  3.0.4
  # lxc-attach -n test false; echo $?
  0
Signed-off-by: Antonio Terceiro <terceiro@debian.org>
Bug-Debian: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=934983

lxc-create: check absoule path for param '--dir'

When pure cgroup unified mode is used we cannot pre-mount a tmpfs as this
confuses systemd.
Users should also set lxc.mount.auto = cgroup:force to ensure that systemd in
the container and on the host use identical cgroup layouts.
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Fix: #3123
Signed-off-by: qianfan Zhao <qianfanguijin@163.com>

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

attach: don't close stdout of getent

Signed-off-by: Wolfgang Bumiller <w.bumiller@proxmox.com>

utils: Fix wrong integer of a function parameter.

If SSL is enabled, utils will include function `do_sha1_hash()` to
generate a sha1 encrypted buffer. Last function argument of
`EVP_DigestFinal_ex()` requires a `unsigned int` but the current
parameter is an `integer` type.

See error:
utils.c:350:38: error: passing 'int *' to parameter of type 'unsigned int *' converts between pointers to integer types with different sign
      [-Werror,-Wpointer-sign]
        EVP_DigestFinal_ex(mdctx, md_value, md_len);
                                            ^~~~~~
/usr/include/openssl/evp.h:549:49: note: passing argument to parameter 's' here
                                  unsigned int *s);
Signed-off-by: Julio Faracco <jcfaracco@gmail.com>

lxccontainer: do_lxcapi_detach_interface to support detaching wlan devs

Signed-off-by: Thomas Parrott <thomas.parrott@canonical.com>

cgroups: initialize cpuset properly

Closes #3108.
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

tree-wide: initialize all auto-cleanup variables

network: restore ability to move nl80211 devices

Closes #3105.
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

pidfds: don't print a scary warning on ENOSYS

Most kernels don't have this functionality yet, and so the warning is
printed a lot. Our people are scared of warnings, so let's make it INFO
instead in this case.
Signed-off-by: Tycho Andersen <tycho@tycho.ws>

Closes: #3101.
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Signed-off-by: Stéphane Graber <stgraber@ubuntu.com>

Signed-off-by: Stéphane Graber <stgraber@ubuntu.com>

Signed-off-by: Stéphane Graber <stgraber@ubuntu.com>

Signed-off-by: Stéphane Graber <stgraber@ubuntu.com>

``/proc`` might be mounted with ``hidepid=2``.
This makes ``/proc/1/…`` appear absent for non-root users.
When using the templates or the nvidia hook as a non-root user
(e.g., when creating unprivileged containers) the error
"/proc/1/uid_map: No such file or directory" is printed.
Since the script works correctly despite the error, this error
message might be confusing for users.
Signed-off-by: Lukas Pirl <git@lukas-pirl.de>

seccomp: open memfd read-write

Makes it easier to implement syscalls which need to write to
a buffer passed by user space as a pointer.
Signed-off-by: Wolfgang Bumiller <w.bumiller@proxmox.com>

Adds veth router mode

Signed-off-by: Thomas Parrott <thomas.parrott@canonical.com>

Signed-off-by: Thomas Parrott <thomas.parrott@canonical.com>

Defaulting to bridge mode.
Signed-off-by: Thomas Parrott <thomas.parrott@canonical.com>

Suggested usage:

	return error_log_errno(err, "Failed: %s", "some error");

It sets errno to the value of err, then calls SYSERROR with the format and remaining args.

It always returns -1.
Suggested-by: Christian Brauner <christian.brauner@ubuntu.com>
Signed-off-by: Thomas Parrott <thomas.parrott@canonical.com>

Suppress hardcoded table sizes

. Use sizeof() instead of hardcoded values
. snprintf(..., size, ""...) is in error if the return code is >= size (not sufficient to set only ">")
Signed-off-by: Rachid Koucha <rachid.koucha@gmail.com>