Signed-off-by: Long Wang <w@laoqinren.net>

Signed-off-by: Long Wang <w@laoqinren.net>

This pr https://github.com/lxc/lxc/pull/1618 kill lxc-monitord, for backwards compatibility,
we also send state to legacy lxc-monitord state server in function `lxc_set_state`.

we should also send state if there is no state clients registered, otherwise `lxc-monitor` client will
not get state change event if container changed state to `STARTING` or `RUNNING`.
Signed-off-by: 0x0916 <w@laoqinren.net>

lxc-monitor has an option to tell lxc-monitord to quit.

```
~/lxc (master) # lxc-monitor --help
lxc-monitor monitors the state of the NAME container

Options :
  -n, --name=NAME   NAME of the container
                    NAME may be a regular expression
  -Q, --quit        tell lxc-monitord to quit
```
But it does not work. This patch fix that.
Signed-off-by: 0x0916 <w@laoqinren.net>

Our logging function will always spew out the function name.
Signed-off-by: 0x0916 <w@laoqinren.net>

Fix issue: https://github.com/lxc/lxc/issues/505Signed-off-by: 0x0916 <w@laoqinren.net>

CentOS only has i386 and x86_64 listed in mirrorlist.centos.org,
use http://mirror.centos.org/altarch/ for all other arches instead

See: https://bugs.centos.org/view.php?id=11250Signed-off-by: Evgeni Golov <evgeni@debian.org>

uname -m reports aarch64, but Debian calls the arch arm64
Signed-off-by: Evgeni Golov <evgeni@debian.org>

Signed-off-by: 0x0916 <w@laoqinren.net>

Signed-off-by: 0x0916 <w@laoqinren.net>

Signed-off-by: 0x0916 <w@laoqinren.net>

This reverts commit 758243d8.
Signed-off-by: 0x0916 <w@laoqinren.net>

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Signed-off-by: Li Feng <lifeng68@huawei.com>

Add description of new network configuration, and tweak.

Update for commit b9986e43Signed-off-by: KATOH Yasufumi <karma@jazz.email.ne.jp>

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Signed-off-by: Yifeng Tan <tanyifeng1@huawei.com>

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

This logs the configured networks on the trace level to support debugging.
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Some of the checks were previously performed when parsing the network config.
But since we allow for a little more flexibility now it doesn't work anymore.
Instead, let's validate the network at creation time.
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

lxc_get_netdev_by_idx() takes care of checking whether a given netdev struct
for a given index is already allocated. If so it returns a pointer to it to the
caller.
If it doesn't find it it will allocate a new netdev struct and insert it into
the network list at the right position. For example, let's say you have the
following networks defined in your config file:

lxc.network.0.type=veth
lxc.network.0.link=lxcbr0
lxc.network.0.name=eth0
lxc.network.0.flags=up

lxc.network.3.type=veth
lxc.network.3.link=lxcbr0
lxc.network.3.name=eth1
lxc.network.3.flags=up
lxc.network.3.hwaddr = 00:16:3e:5d:7d:65

lxc.network.1.type=veth
lxc.network.1.link=lxcbr0
lxc.network.1.name=eth0
lxc.network.1.flags=up

lxc_get_netdev_by_idx() will take care that the internal network list appears
in the order:

0
1
3

The ordering of the keys themselves can also be random, meaning you could do:

lxc.network.3.type=veth
lxc.network.0.link=lxcbr0
lxc.network.0.name=eth0
lxc.network.3.hwaddr = 00:16:3e:5d:7d:65
lxc.network.0.flags=up
lxc.network.3.flags=up
lxc.network.0.type=veth
lxc.network.3.link=lxcbr0
lxc.network.3.name=eth1

and lxc_get_netdev_by_idx() would still figure out the correct ordering since
it keeps track of the index.
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

and rename it to lxc_config_value_empty()
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

When we merged the new logging function for the api we exposed the log level
argument in the struct as "priority" which we actually requested to be changed
to "level" which somehow didn't happen and we missed it. Given the fact there
has been no new liblxc release let's fix it right now before it hits users.
Also, take the chance to change the terminology in the log from "priority" to
"level" globally. This is to prevent confusion with syslog's "priority"
argument which we also support.
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Since we kicked lxc-monitord there will very likely be no user processes around
anymore after all container's have been stopped. Which is a very very very good
thing. So let's not error out when pkill doesn't find any processes.
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

A LXC container's lifecycle is regulated by the states STARTING, RUNNING,
STOPPING, STOPPED, ABORTING. These states are tracked in the LXC handler and
can be checked via approriate functions in the command socket callback system.
(The freezer stages are not part of a container's lifecycle since they are not
recorded in the LXC handler. This might change in the future but given that the
freezer controller will be removed from future cgroup implementations it is
unlikely.) So far, LXC was using an external helper to track the states of a
container (lxc-monitord). This solution was error prone. For example, the
external state server would hang in various scenarios that seemed to be caused
by either very subtle internal races or irritation of the external state server
by signals.

LXC will switch from an external state monitor (lxc-monitord) which serves as a
state server for state clients to a native implementation using the indiviual
container's command socket. This solution was discussed and outlined by Stéphane
Graber and Christian Brauner during a LX{C,D} sprint.

The LXC handler will gain an additional field to track state clients. In order
for a state client to receive state notifications from the command server he
will need to register himself via the lxc_cmd_state_server() function in the
state client list. The state client list will be served by lxc_set_state()
during the container's lifecycle. lxc_set_state() will also take care of
removing any clients from the state list in the LXC handler once the requested
state has been reached and sent to the client.
In order to prevent races between adding and serving new state clients the state
client list and the state field in the LXC handler will be protected by a lock.

This commit effectively deprecates lxc-monitord. Instead of serving states to
state clients via the lxc-monitord fifo and socket we will now send the state
of the container via the container's command socket.
lxc-monitord is still useable and will - for the sake of the lxc-monitor
command - be kept around so that non-API state clients can still monitor the
container during it's lifecycle.
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Starting at version 3.6, Alpine Linux has support for ppc64le
architecture. Adding the new keys also.
Signed-off-by: Breno Leitao <breno.leitao@gmail.com>

Signed-off-by: 0x0916 <w@laoqinren.net>

when the log level is TRACE, this patch export the seccomp
filter to log file.

the ouput of `seccomp_export_pfc()` is human readable and this feature
is useful for user to make sure their `seccomp configuration file` is
right.

Output for he default ubuntu container's seccomp filter is the
following:

```
      lxc-start ubuntu 20170520024159.412 INFO     lxc_apparmor - lsm/apparmor.c:apparmor_process_label_set:238 - changed apparmor profile to lxc-container-default-cgns
if ($arch == 3221225534)
  # filter for syscall "finit_module" (313) [priority: 65535]
  if ($syscall == 313)
    action ERRNO(1);
  # filter for syscall "open_by_handle_at" (304) [priority: 65535]
  if ($syscall == 304)
    action ERRNO(1);
  # filter for syscall "kexec_load" (246) [priority: 65535]
  if ($syscall == 246)
    action ERRNO(1);
  # filter for syscall "delete_module" (176) [priority: 65535]
  if ($syscall == 176)
    action ERRNO(1);
  # filter for syscall "init_module" (175) [priority: 65535]
  if ($syscall == 175)
    action ERRNO(1);
  # filter for syscall "umount2" (166) [priority: 65533]
  if ($syscall == 166)
    if ($a1.hi32 & 0x00000000 == 0)
      if ($a1.lo32 & 0x00000001 == 1)
        action ERRNO(13);
  # default action
  action ALLOW;
if ($arch == 1073741827)
  # filter for syscall "finit_module" (350) [priority: 65535]
  if ($syscall == 350)
    action ERRNO(1);
  # filter for syscall "open_by_handle_at" (342) [priority: 65535]
  if ($syscall == 342)
    action ERRNO(1);
  # filter for syscall "kexec_load" (283) [priority: 65535]
  if ($syscall == 283)
    action ERRNO(1);
  # filter for syscall "delete_module" (129) [priority: 65535]
  if ($syscall == 129)
    action ERRNO(1);
  # filter for syscall "init_module" (128) [priority: 65535]
  if ($syscall == 128)
    action ERRNO(1);
  # filter for syscall "umount2" (52) [priority: 65534]
  if ($syscall == 52)
    if ($a1 & 0x00000001 == 1)
      action ERRNO(13);
  # default action
  action ALLOW;
if ($arch == 3221225534)
  # filter for syscall "kexec_load" (1073742352) [priority: 65535]
  if ($syscall == 1073742352)
    action ERRNO(1);
  # filter for syscall "finit_module" (1073742137) [priority: 65535]
  if ($syscall == 1073742137)
    action ERRNO(1);
  # filter for syscall "open_by_handle_at" (1073742128) [priority: 65535]
  if ($syscall == 1073742128)
    action ERRNO(1);
  # filter for syscall "delete_module" (1073742000) [priority: 65535]
  if ($syscall == 1073742000)
    action ERRNO(1);
  # filter for syscall "init_module" (1073741999) [priority: 65535]
  if ($syscall == 1073741999)
    action ERRNO(1);
  # filter for syscall "umount2" (1073741990) [priority: 65534]
  if ($syscall == 1073741990)
    if ($a1 & 0x00000001 == 1)
      action ERRNO(13);
  # default action
  action ALLOW;
action KILL;
      lxc-start ubuntu 20170520024159.412 NOTICE   lxc_start - start.c:start:1470 - Exec'ing "/sbin/init".
```
Signed-off-by: 0x0916 <w@laoqinren.net>

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

bionic seems to lack a definition of __S_ISTYPE().
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Closes https://github.com/lxc/lxd/issues/3384.
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>