Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Merge pull request #2274 from brauner/2018-04-13/fix_seccomp_with_personality_and_64bit_kernel_32_bit_userspace

seccomp: handle arch inversion

This commit deals with different kernel and userspace layouts and nesting. Here
are three examples:
1. 64bit kernel and 64bit userspace running 32bit containers
2. 64bit kernel and 32bit userspace running 64bit containers
3. 64bit kernel and 64bit userspace running 32bit containers running 64bit containers
Two things to lookout for:
1. The compat arch that is detected might have already been present in the main
   context. So check that it actually hasn't been and only then add it.
2. The contexts don't need merging if the architectures are the same and also can't be.
With these changes I can run all crazy/weird combinations with proper seccomp
isolation.

Closes #654.

Link: https://bugs.chromium.org/p/chromium/issues/detail?id=832366Reported-by: Chirantan Ekbote <chirantan@chromium.org>
Reported-by: Sonny Rao <sonnyrao@chromium.org>
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

conf: fix net type checks in run_script_argv()

Signed-off-by: Jakub Skokan <jakub.skokan@havefun.cz>

conf: ret-try devpts mount without gid=5 on error

When starting application containers without a mapping for container root are
started, a dummy bind-mount target for lxc-init needs to be created. This will
not always work directly under "/" when e.g. permissions are missing due to the
ownership and/or mode of "/". We can try to work around this by using the
P_tmpdir as defined in POSIX which should usually land us in /tmp where
basically everyone can create files.
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

We should always default to mounting devpts with gid=5 but we should fallback
to mounting without gid=5. This let's us cover use-cases such as container
started with only a single mapping e.g.:

lxc.idmap = u 1000 1000 1
lxc.idmap = g 1000 1000 1

Closes #2257.
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

attach: try to always drop supplementary groups

rootfs pinning: On NFS, make file hidden but don't delete it

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

attach: always drop supplementary groups

Closes #2248.
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Mergeable branch for C0deAi fixes

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Closes #2262.
Signed-off-by: C0deAi <techsupport@mycode.ai>
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Closes #2262.
Signed-off-by: C0deAi <techsupport@mycode.ai>
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Value stored is never read.

Closes #2262.
Signed-off-by: C0deAi <techsupport@mycode.ai>
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Closes #1704.
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Fix compilation with static libcap and shared gnutls

Commit c06ed219 has broken
compilation with a static libcap and a shared gnutls.
This results in a build failure on init_lxc_static if gnutls is
a shared library as init_lxc_static is built with -all-static option
(see src/lxc/Makefile.am) and AC_CHECK_LIB adds gnutls to LIBS.

This commit fix the issue by removing default behavior of AC_CHECK_LIB
and handling manually GNUTLS_LIBS and HAVE_LIBGNUTLS

Fixes:
 - http://autobuild.buildroot.net/results/b655d6853c25a195df28d91512b3ffb6c654fc90Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>

Fix temp file creation

lxc_make_tmpfile() uses mkstemp() internally, and thus expects the
template to contain 'XXXXXX' and be writable.
Signed-off-by: Thomas Moschny <thomas.moschny@gmx.de>
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

lxc_make_tmpfile() uses mkstemp() internally, and thus expects the
template to contain 'XXXXXX' and be writable.
Signed-off-by: Thomas Moschny <thomas.moschny@gmx.de>
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

On NFS, avoid random names of the root pin file due to "NFS silly renaming" but use a fixed hidden name instead.

fix signal sending in lxc.init

The problem here is that these two clauses were ordered backwards: we first
check if the signal came from not the init pid, and if it did, then we give
a notice and return. The comment notes that this is intended to protect
against SIGCHLD, but we don't in fact know if the signal is a SIGCHLD yet,
because that's tested in the next hunk.

The symptom is that if I e.g. send SIGTERM from the outside world to the
container init, it ignores it and gives this notice. If we re-order these
clauses, it forwards non SIGCHLD signals, and ignores SIGCHLD signals from
things that aren't the real container process.
Signed-off-by: Tycho Andersen <tycho@tycho.ws>

doc: Tweak Japanese translation in lxc.container.conf(5)

Signed-off-by: KATOH Yasufumi <karma@jazz.email.ne.jp>

Signed-off-by: Fengtu Wang <wangfengtu@huawei.com>
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

confile: expand lxc.environment

When a bare environment variable is specified then retrieve the value from the
current environment. For example, setting

lxc.environment = PATH

will cause LXC to inherit the value of PATH from the current environment.
Suggested-by: Jonathan Calmels <jcalmels@nvidia.com>
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

bugfixes

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

If they aren't available fallback to BSD flock()s.

Closes #2245.
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

lxc-oci: cmd parsing and less verbose umoci

Signed-off-by: Felix Abecassis <fabecassis@nvidia.com>

Don't use the -r option of jq, since it will strip the double quotes.

Fixes: #2195
Signed-off-by: Felix Abecassis <fabecassis@nvidia.com>

Closes #2241.
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>