Otherwise unprivileged users may not have the privilege needed to
remove their cgroups.
Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>

Add features/small improvements to man pages (lxc-attach, lxc-copy)

Signed-off-by: Christian Brauner <christian.brauner@mailbox.org>

Signed-off-by: Christian Brauner <christian.brauner@mailbox.org>

Explain that the pipe symbol needs to be escaped for -e and -s.
Signed-off-by: Christian Brauner <christian.brauner@mailbox.org>

lxc-copy: correct order of copy and original & lxc-attach: setup ts->stdoutfd

Otherwise we cannot do things like:

- lxc-attach -n a runlevel </dev/null
- lxc-attach -n a runlevel </dev/null 2>/dev/null
- lxc-attach -n a runlevel </dev/null 2>/dev/null | cat
Signed-off-by: Christian Brauner <christian.brauner@mailbox.org>

	lxc-copy -n ORIG -N COPY -e

accidently printed

	"Created ORIG as clone of COPY"

instead of

	"Created COPY as clone of ORIG".
Fix the ordering.
Signed-off-by: Christian Brauner <christian.brauner@mailbox.org>

start.c: do not reboot on lxc.hook.post-stop fail

lxc should not reboot the container when lxc.hook.post-stop fails. It should
simply shutdown. This makes the behavior of lxc.hook.post-stop and
lxc.hook.pre-start consistent. When lxc.hook.pre-start fails, the container
does not start.
Signed-off-by: Christian Brauner <christian.brauner@mailbox.org>

lxc-attach: always allocate current controlling pty

lxc-attach uses lxc_console_create() to allocate a pty on the host.
lxc_console_create() in turn calls lxc_console_peer_default() which either
makes the current controlling pty our controlling pty for the container, or
uses whatever the user gave us (e.g. /dev/tty2 etc.). For lxc-attach we always
want the current controlling pty to be used. This commit ensures that we're in
fact always using the current controlling pty. The commit also fixes a segfault
when the user specified lxc.console.path = none.
Signed-off-by: Christian Brauner <christian.brauner@mailbox.org>

cgfs: don't chown/chmod/rm non-existing paths

Dirty fix for the current noisiness when lxc_cgroupfs_create() could not create
cgroups.
Signed-off-by: Christian Brauner <christian.brauner@mailbox.org>

Signed-off-by: Stéphane Graber <stgraber@ubuntu.com>

cgfs: ignore mount prefix in mountinfo if cgroup namespaces are suppo…

This is not 100% correct, but will suffice until we fix the kernel so that
we can distinguish between bind mounts and namespaced cgroupfs mounts.
Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>

fix cgfs failure for unpriv users

Cgmanager was taught awhile ago that only some cgroup controllers are
crucial.  Teach cgfs the same thing.

This patch needs improvement, but will fix failure of lxc without cgmanager
for unprivileged users for now.  In particular, needed improvements include:

1. the check for crucial subsystems needs to include lxc.use
2. we should keep a list of the actually used subsystems so we don't keep
trying to chmod and enter after create has found we couldn't use a particular
subsystem

This fixes unprivileged lxc use.  It does not appear to suffice to fix
nested unprivilegd lxd usage.
Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>

Rewrite template script for Alpine Linux

lxc-ls: count spaces

Signed-off-by: Jakub Jirutka <jakub@jirutka.cz>

Signed-off-by: Jakub Jirutka <jakub@jirutka.cz>

Signed-off-by: Jakub Jirutka <jakub@jirutka.cz>

Now it runs even on minimal Alpine system without bash, curl, openssl or
rsync.
Signed-off-by: Jakub Jirutka <jakub@jirutka.cz>

New template script is more readable and robust, uses cache and external
LXC config file as other templates.
Signed-off-by: Jakub Jirutka <jakub@jirutka.cz>

Update Korean manuals

doc: Update Japanese lxc-attach(1)

Update the description of pty allocation. Update for commit 478dda76.
Signed-off-by: KATOH Yasufumi <karma@jazz.email.ne.jp>

Update for commit 4608594eSigned-off-by: Sungbae Yoo <sungbae.yoo@samsung.com>

Update for commit 2ae6732f.
Signed-off-by: Sungbae Yoo <sungbae.yoo@samsung.com>

Update for commit e986ea3dSigned-off-by: Sungbae Yoo <sungbae.yoo@samsung.com>

Update for commit 7a126ae1Signed-off-by: Sungbae Yoo <sungbae.yoo@samsung.com>

Update for commit c4cafa08Signed-off-by: Sungbae Yoo <sungbae.yoo@samsung.com>

Otherwise line wrapping might occur too late.
Signed-off-by: Christian Brauner <christian.brauner@mailbox.org>

start: setsid in init task as well

If we don't do this, we'll leak the parent's session id to the container,
which maybe doesn't matter, but it still seems better to set it anyway.

Also, it breaks CRIU for containers that don't call setsid themselves.
Signed-off-by: Tycho Andersen <tycho.andersen@canonical.com>

lxc-attach: rework pty allocation

cgfs: make sure we use valid cgroup mountpoints

If lxcfs starts before cgroup-lite, then the first cgroup mountpoints in
/proc/self/mountinfo are /run/lxcfs/*.  Unprivileged users cannot access
these.  So privileged containers are ok, and unprivileged containers are ok
since they won't cache those to begin with.  But unprivileged root-owned
containers cache /run/lxcfs/* and then try to use them.

So when doing cgroup automounting check whether the mountpoints we have
stored are accessible, and if not look for a new one to use.
Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>