- This enables the user to destroy a container with all its snapshots without
  having to use lxc-snapshot first to destroy all snapshots. (The enum values
  DESTROY and SNAP from the previous commit are reused here again.)
- Some unification regarding the usage of exit() and return has been done.
Signed-off-by: Christian Brauner <christianvanbrauner@gmail.com>

"NAME for name of the container" becomes "NAME of the container"
Signed-off-by: Christian Brauner <christianvanbrauner@gmail.com>

Passing the LXC_CLONE_KEEPNAME flag to do_lxcapi_clone() was not respected. We
wrap clear_unexp_config_line() and set_config_item_line() in an appropriate
if-condition.
Signed-off-by: Christian Brauner <christianvanbrauner@gmail.com>

- This commit adapts lxc-clone to be similiar in usage and feel to the other
  lxc-* executables. It builds on the previous extension of the lxc_argument
  struct and now uses the default lxc_arguments_parse() function.
- Options which were not used have been removed.
- The LXC_CLONE_KEEPNAME flag was not respected in the previous version of
  lxc-clone. The culprit is a missing if-condition in lxccontainer.c. As this
  requires a change in one of the API functions in lxccontainer.c it will be
  addressed in a follow-up commit.
Signed-off-by: Christian Brauner <christianvanbrauner@gmail.com>

- lxc_snapshot.c lacked necessary members in the associated lxc_arguments struct
  in arguments.h. This commit extends the lxc_arguments struct to include
  several parameters used by lxc-snapshot which allows a rewrite that is more
  consistent with the rest of the lxc-* executables.
- All tests have been moved beyond the call to lxc_log_init() to allow for the
  messages to be printed or saved.
- Some small changes to the my_args struct. (The enum task is set to
  SNAP (for snapshot) per default and variables illustrating the usage of the
  command line flags are written in all caps.)
- arguments.h has been extended to accommodate a rewrite of lxc-clone
Signed-off-by: Christian Brauner <christianvanbrauner@gmail.com>

templates: lxc-opensuse, use rpm to determine build version

Fix error message when cannot find an lxc-init

zypper info's output is not usable for several reasons:
* it is localized -- there is no "Version: " in my output
* it shows results both from the repo and local system

So use plain rpm to determine whether build is installed and if proper
version is in place.
Signed-off-by: Jiri Slaby <jslaby@suse.cz>

lxc-init has been renamed init.lxc so adapt error message
Signed-off-by: Nicolas Cornu <ncornu@aldebaran.com>

We need specify which hashing algorithm was used to create the signature
we check.

Fixes #609
Signed-off-by: Natanael Copa <ncopa@alpinelinux.org>
Acked-by: Stéphane Graber <stgraber@ubuntu.com>

Add option to rename container to lxc-clone

Update Korean manuals

Update for commit 7cab33b1Signed-off-by: Sungbae Yoo <sungbae.yoo@samsung.com>

Update for commit 2cf7c05aSigned-off-by: Sungbae Yoo <sungbae.yoo@samsung.com>

Update for commit 1940bff4Signed-off-by: Sungbae Yoo <sungbae.yoo@samsung.com>

This commit adds an -R, --rename option to lxc-clone to rename a container. As
c->rename calls do_lxcapi_rename() which in turn calls do_lxcapi_clone() it
seemed best to implement it in lxc-clone rather than lxc-snapshot which also
calls do_lxcapi_clone(). Some additional unification regarding the usage of
return vs exit() in main() was done.
Signed-off-by: Christian Brauner <christianvanbrauner@gmail.com>

Update man pages

lxc-user-nic command cannot use common options.
Signed-off-by: KATOH Yasufumi <karma@jazz.email.ne.jp>

Signed-off-by: KATOH Yasufumi <karma@jazz.email.ne.jp>

Signed-off-by: KATOH Yasufumi <karma@jazz.email.ne.jp>

Add -P lxcpath and --version to lxc-ls manpage

lxc-ls takes -P lxcpath and --version as arguments but it did not specify these
options on the manpages.
Signed-off-by: Christian Brauner <christianvanbrauner@gmail.com>

seccomp: simplify and fix rule parsing

1) Two checks on amd64 for whether compat_ctx has already
been generated were redundant, as compat_ctx is generally
generated before entering the parsing loop.

2) With introduction of reject_force_umount the check for
whether the syscall has the same id on both native and
compat archs results in false behavior as this is an
internal keyword and thus produces a -1 on
seccomp_syscall_resolve_name_arch().
The result was that it was added to the native architecture
twice and never to the 32 bit architecture, causing it to
have no effect on 32 bit containers on 64 bit hosts.

3) I do not see a reason to care about whether the syscalls
have the same number on the two architectures. On the one
hand this check was there to avoid adding it to two archs
(and effectively leaving one arch unprotected), while on
the other hand it seemed to be okay to add it to the
same arch *twice*.

The entire architecture checking branches are now reduced to
three simple cases: 'native', 'non-native' and 'all'. With
'all' adding to both architectures regardless of the syscall
ID.

Also note that libseccomp had a bug in its architecture
checking, so architecture related filters weren't working as
expected before version 2.2.2, which may have contributed to
the confusion in the original architecture-related code.
Signed-off-by: Wolfgang Bumiller <w.bumiller@proxmox.com>

Signed-off-by: Stéphane Graber <stgraber@ubuntu.com>

A user could otherwise over-mount /proc and prevent the apparmor profile
or selinux label from being written which combined with a modified
/bin/sh or other commonly used binary would lead to unconfined code
execution.

Reported-by: Roman Fiedler
Signed-off-by: Stéphane Graber <stgraber@ubuntu.com>

This prevents an unprivileged user to use LXC to create arbitrary file
on the filesystem.
Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: Stéphane Graber <stgraber@ubuntu.com>

lxc-ubuntu-cloud: support passing vendor-data

vendor-data is supported in Ubuntu cloud images in trusty and later.
This allows the user to pass it in on create or clone.
Signed-off-by: Scott Moser <smoser@ubuntu.com>

Use /dev/loop-control if it exists

The Fedora 22 squashfs doesn't appear to work, the Fedora 21 isn't
available, so lets use the fedora archive mirror and pull the good old
Fedora 20 squashfs.
Signed-off-by: Stéphane Graber <stgraber@ubuntu.com>

Signed-off-by: Stéphane Graber <stgraber@ubuntu.com>

Apparently the paths have changed on the rsync server.
Signed-off-by: Stéphane Graber <stgraber@ubuntu.com>

Switch to Fedora 22 for now.
Signed-off-by: Stéphane Graber <stgraber@ubuntu.com>

This fixes some typos, missing newlines and unflushed output leading to
duplicate entries when piped (similar to what we had in lxc-info).

Reported-by: Marc Gariépy
Signed-off-by: Stéphane Graber <stgraber@ubuntu.com>

fix container creation from ansible lxc_containers module

Signed-off-by: Alex Punco <punco@selectel.ru>

Loop devices can be added on the fly when needed, they're
not always created beforehand. The loop-control device can
be used to find and allocate the next available number
instead of going through the /dev directory contents (which
is now only a fallback mechanism).
Signed-off-by: Wolfgang Bumiller <w.bumiller@proxmox.com>

debian template: reconfigure locales

Signed-off-by: feng xiahou <xiahoufeng@yahoo.com>