cgroups: Introduce lxc.cgroup.dir.monitor.pivot - fixes cgroup removal on termination

seccomp: fix pseudo syscalls, improve logging and avoid duplicate processing

tests: Fix compilation with appamor enabled.

lxccontainer: fix lxc_config_item_is_supported

Signed-off-by: Ruben Jenster <r.jenster@drachenfels.de>

Use exact match instead of longest prefix match
to check whether a config item is supported.
Signed-off-by: Ruben Jenster <r.jenster@drachenfels.de>

On termination lxc may fail to remove either lxc.cgroup.dir or lxc.cgroup.dir.monitor,
because the monitor process may still be a member of either of these cgroups.
The pivot cgroup should not be a member (subpath) of any other container cgroup (dir).
because only empty cgroups can be removed.
Signed-off-by: Ruben Jenster <r.jenster@drachenfels.de>

Signed-off-by: Ruben Jenster <r.jenster@drachenfels.de>

Signed-off-by: Ruben Jenster <r.jenster@drachenfels.de>

Update Japanese pam_cgfs(8) to reflect lack of support for pure cgroupv2

Update for commit b87ed83bSigned-off-by: KATOH Yasufumi <karma@jazz.email.ne.jp>

conf: account for early return when sending devpts fd

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

conf: always send response to parent waiting for devptfs_fd

When no devpts devices are requested we used to return early but did not send a
response to the parent. This is a problem because the parent will be waiting
for a devpts fd to be sent. Make sure to always send a response.
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

startup fixes

Closes: #3549.
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

seccomp: fix compilation on powerpc

Link: https://launchpadlibrarian.net/502200189/buildlog_snap_ubuntu_bionic_ppc64el_lxd-latest-edge_BUILDING.txt.gzSigned-off-by: Christian Brauner <christian.brauner@ubuntu.com>

seccomp: bugfixes

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

seccomp: Check if syscall is supported on compat architecture.

Signed-off-by: Ruben Jenster <r.jenster@drachenfels.de>

Remove obsolete setting regarding the Standard Output

The Standard output type "syslog" is obsolete, causing a warning since systemd
version 246 [1].

Please consider using "journal" or "journal+console"

[1] https://github.com/systemd/systemd/blob/master/NEWS#L202Signed-off-by: Mingli Yu <mingli.yu@windriver.com>

lxc-usernsexec: setgroups() similar to other places shouldn't fail on…

FAIL: lxc-tests: lxc-test-usernsexec (1s)
---
as test-userns executing /tmp/autopkgtest.waGEXj/build.Hm3/src/src/tests/lxc-test-usernsexec
uid=1001 gid=1001 name=test-userns subuid=165536 subgid=165536 ver=1:4.0.4-0ubuntu3
lxc-utils=1:4.0.4-0ubuntu3 kver=5.8.0-19-generic
USERNSEXEC=lxc-usernsexec
nouidgid: PASS
myuidgid: FAIL - runtest failed 1
  $ lxc-usernsexec -mu:0:1001:1 -mg:0:1001:1 -- /tmp/autopkgtest.waGEXj/build.Hm3/src/src/tests/lxc-test-usernsexec inside f0
  lxc 20200914222824.562 ERROR    utils - utils.c:lxc_setgroups:1363 - Operation not permitted - Failed to setgroups()
  kid 73112 is gone 1
subuidgid: PASS
bothsets: PASS
mismatch: PASS
ERRORS: myuidgid
---
Reported-by: Seth Forshee <seth.forshee@canonical.com>
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

commands: don't fail if unfreeze fails

We can e.g. fail the unfreeze because the freezer cgroup is not available and
then we erronously report that stopping the container failed.

Closes: #3471.
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

avoid a NULL pointer dereference in lxc-attach

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Seems to appear when stderr is a terminal and not stdin or stdout.
Signed-off-by: Scott Parlane <scott.parlane@alliedtelesis.co.nz>

remove useless parameters

Signed-off-by: wujing <Jing.Woo@outlook.com>

cgroups: fix armhf builds

Check only rootfs as filesystem type