Closes #2073.
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Closes #2073.
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Closes #2073.
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Closes #2073.
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Closes #2073.
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

cgroups: add unified hierarchy support

tools: add UNPRIVILEGED field in fancy output mode

Sigterm handling

lxc-init: use SIGKILL after alarm timeout

see comment for details.
Signed-off-by: Tycho Andersen <tycho@tycho.ws>

For the ->execute() case, we want to make sure the application dies when
SIGHUP is received. The next patch will ignore SIGHUP in the lxc monitor,
because tasks inside the container send SIGHUP to init to have it reload
its config sometimes, and we don't want to do that with init.lxc, since it
might actually kill the container if it forwards SIGHUP to the child and
the child can't handle it.
Signed-off-by: Tycho Andersen <tycho@tycho.ws>

d76e3e1a inadvertently switched the alarm timeout from sigterm to sigkill.
We really want sigkill here, so let's bring it back.
Signed-off-by: Tycho Andersen <tycho@tycho.ws>

hooks: change the semantic of NVIDIA_VISIBLE_DEVICES=""

With LXC, you can override the value of an environment variable to
null, but you can't unset an existing variable.

The NVIDIA hook was previously activated when NVIDIA_VISIBLE_DEVICES
was set to null. As a result, it was not possible to disable the hook
by overriding the environment variable in the configuration.

The hook can now be disabled by setting NVIDIA_VISIBLE_DEVICES to
null or to the new special value "void".
Signed-off-by: Felix Abecassis <fabecassis@nvidia.com>

debian: We must use iproute on wheezy

Signed-off-by: Stéphane Graber <stgraber@ubuntu.com>

lsm: do not #ifdefine

Since we stopped linking against AppArmor we can now remove the conditional
compilation.
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

tools: make "-n" optional

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

confile_legacy: fix legacy network parser

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

lsm: simplifcations

This lets users use the tools with "lxc-* -n <container-name>" or
"lxc-* <container-name>".
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

seccomp.c: Use return instead of attribution and return

Signed-off-by: Marcos Paulo de Souza <marcos.souza.org@gmail.com>

debian: Use iproute2 instead of iproute

The package has pretty much always been iproute2 with iproute being an
alias for it, the alias is now gone so we need to use iproute2.
Signed-off-by: Stéphane Graber <stgraber@ubuntu.com>

Unpriv fixups

Signed-off-by: Tycho Andersen <tycho@tycho.ws>

In particular, if we are already in a user namespace we are unprivileged,
and doing things like moving the physical nics back to the host netns won't
work. Let's do the same thing LXD does if euid == 0: inspect
/proc/self/uid_map and see what that says.
Signed-off-by: Tycho Andersen <tycho@tycho.ws>

Consider the case where we're running in a user namespace but in the host's
mount ns with the host's filesystem (something like
lxc-usernsexec ... lxc-execute ...), in this case, we'll be euid 0, but we
can't actually write to /run. Let's improve this locking check to make sure
we can actually write to /run before we decide to actually use it as our
locking dir.
Signed-off-by: Tycho Andersen <tycho@tycho.ws>

[cgfsng] show wrong errno