When parsing mount options e.g. from lxc.mount.entry the specified
options are mapped to the flags constants. To do so, the strings
are compared to the options contained in mount_opt. However,
when comparing the strings, the length of the string is not
checked. That entails that the option "rootcontext=selinux-context"
is mapped to the mount option read-only (ro). This commit fixes
this issue by checking if a '=' is contained in the specified option
and additionally comparing the length of the strings.
Signed-off-by: Maximilian Blenk <Maximilian.Blenk@bmw.de>

lxc: switch to SPDX

cgroups: improve container cgroup attaching

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

The current attach.c codepath which handles moving the attaching process into
the container's cgroups allocates a whole new struct cgroup_ops and goes
through the trouble of reparsing the whole cgroup layout.
That's costly and wasteful. My plan has always been to move this into the
command api by getting fds for attaching back but but it's not worth going
through that hazzle for non-unified hosts. On pure unified hosts however -
being the future - we can just attach through a single fd so there's no need to
allocate and setup struct cgroup_ops.
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

cgroup: add command to retrieve cgroup2 fd and rework cgroup2 attach

On pure unified systemd we can use a single file descriptor to interact with
the cgroup filesystem. Add a method to retrieve it and as a start use it in our
unified attach codepath.
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

freezer: cleanup

tree-wide: Fix inconsistent license headers

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

conf: fix memory leak for set config rootfs options

cgroups/freezer: rework cgroup2 freezer feature usage

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

cgroups/devices: use dedicated enums

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

cgroup2: add bpf device controller live update

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

This will only be defined if liblxc was even compiled with bpf supported.
Support itself will be determined at runtime by liblxc itself.
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

cgroups: add cgroup2 device controller support

Add a bpf-based device controller implementation.
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

cgfsng: return attach fail if container stopped

Signed-off-by: LiFeng <lifeng68@huawei.com>

Signed-off-by: dongxinhua <dongxinhua@huawei.com>

fix wrong order of bridge/nic in error message

Signed-off-by: Balázs Póka <poka@idata.hu>

Typo in a comment

"above" was used instead of "below"
Signed-off-by: Rachid Koucha <rachid.koucha@gmail.com>

tests: use /dev/null instead of /dev/network_latency

BugLink: https://bugs.launchpad.net/bugs/1848587

The latter device has been removed apparently.
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

configure.ac: fix build on toolchain without SSP