We may need to revert this, but I *think* we no longer need this
with default configs.  The idea iirc was that if caller cannot
write to devices.allow (i.e. is in a user namespace), then ignore
permission failures if the cgroups are already sufficiently setup.
Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>

Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>

so that container root can create sub-cgroups
Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>

Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>

Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>

This makes simplifying assumptions:  all usable cgroups must be
mounted under /sys/fs/cgroup/controller or /sys/fs/cgroup/contr1,contr2.

Currently this will only work with cgroup namespaces, because
lxc.mount.auto = cgroup is not implemented.  So cgfsng_ops_init()
returns NULL if cgroup namespaces are not enabled.
Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>

doc: Update Korean lxc-attach(1) and lxc-copy(1), Improve lxc-unshare(1)

Explain that the pipe symbol needs to be escaped for -s.
Signed-off-by: Sungbae Yoo <sungbae.yoo@samsung.com>

Explain that the pipe symbol needs to be escaped for -e and -s.
Update for commit 759d521bSigned-off-by: Sungbae Yoo <sungbae.yoo@samsung.com>

Update for commit cc0607a9Signed-off-by: Sungbae Yoo <sungbae.yoo@samsung.com>

Signed-off-by: Stéphane Graber <stgraber@ubuntu.com>

console.{c.h}: add/improve documentation

Signed-off-by: Christian Brauner <christian.brauner@mailbox.org>

plamo: Update release version and repository for getting packages

Signed-off-by: KATOH Yasufumi <karma@jazz.email.ne.jp>

Update Japanese lxc-attach(1) and lxc-copy(1)

Explain that the pipe symbol needs to be escaped for -e and -s.
Update for commit 759d521bSigned-off-by: KATOH Yasufumi <karma@jazz.email.ne.jp>

Update for commit cc0607a9Signed-off-by: KATOH Yasufumi <karma@jazz.email.ne.jp>

2016 03 02/cgfs.rmperms

We have nothing else testing this, and it was a real regression in lp
bug 1552355.
Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>

info_ptr->created_paths_count can be 0, so don't blindly dereference
info_ptr->created_paths[ created_paths_count - 1].  Apparently we never
used to have 0 at the cleanup_name_on_this_level before, but now that
we can fail with -eperm and not just -eexist, we do.
Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>

don't always warn about unused cgroups, it's noisy and not helpful
Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>

Otherwise unprivileged users may not have the privilege needed to
remove their cgroups.
Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>

Add features/small improvements to man pages (lxc-attach, lxc-copy)

Signed-off-by: Christian Brauner <christian.brauner@mailbox.org>

Signed-off-by: Christian Brauner <christian.brauner@mailbox.org>

Explain that the pipe symbol needs to be escaped for -e and -s.
Signed-off-by: Christian Brauner <christian.brauner@mailbox.org>

lxc-copy: correct order of copy and original & lxc-attach: setup ts->stdoutfd

Otherwise we cannot do things like:

- lxc-attach -n a runlevel </dev/null
- lxc-attach -n a runlevel </dev/null 2>/dev/null
- lxc-attach -n a runlevel </dev/null 2>/dev/null | cat
Signed-off-by: Christian Brauner <christian.brauner@mailbox.org>

	lxc-copy -n ORIG -N COPY -e

accidently printed

	"Created ORIG as clone of COPY"

instead of

	"Created COPY as clone of ORIG".
Fix the ordering.
Signed-off-by: Christian Brauner <christian.brauner@mailbox.org>

start.c: do not reboot on lxc.hook.post-stop fail

lxc should not reboot the container when lxc.hook.post-stop fails. It should
simply shutdown. This makes the behavior of lxc.hook.post-stop and
lxc.hook.pre-start consistent. When lxc.hook.pre-start fails, the container
does not start.
Signed-off-by: Christian Brauner <christian.brauner@mailbox.org>

lxc-attach: always allocate current controlling pty

lxc-attach uses lxc_console_create() to allocate a pty on the host.
lxc_console_create() in turn calls lxc_console_peer_default() which either
makes the current controlling pty our controlling pty for the container, or
uses whatever the user gave us (e.g. /dev/tty2 etc.). For lxc-attach we always
want the current controlling pty to be used. This commit ensures that we're in
fact always using the current controlling pty. The commit also fixes a segfault
when the user specified lxc.console.path = none.
Signed-off-by: Christian Brauner <christian.brauner@mailbox.org>

cgfs: don't chown/chmod/rm non-existing paths

Dirty fix for the current noisiness when lxc_cgroupfs_create() could not create
cgroups.
Signed-off-by: Christian Brauner <christian.brauner@mailbox.org>

Signed-off-by: Stéphane Graber <stgraber@ubuntu.com>

cgfs: ignore mount prefix in mountinfo if cgroup namespaces are suppo…

This is not 100% correct, but will suffice until we fix the kernel so that
we can distinguish between bind mounts and namespaced cgroupfs mounts.
Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>

fix cgfs failure for unpriv users