Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Co-developed-by: David Howells <dhowells@redhat.com>
Signed-off-by: David Howells <dhowells@redhat.com>

Update Japanese lxc.container.conf(5)

Signed-off-by: KATOH Yasufumi <karma@jazz.email.ne.jp>
Reviewed-by: Hiroaki Nakamura <hnakamur@gmail.com>

This is the translation for the following description:
  - lxc.seccomp.notify.proxy (commit 8a643759)
  - host side veth device static routes (commit d4a7da46)
  - IPVLAN (commit c9f52382)
  - Layer 2 proxy mode (commit 6509154d)
  - gateway device route mode (commit a2f9a670)

and fix typo in English man page.
Signed-off-by: KATOH Yasufumi <karma@jazz.email.ne.jp>

Devices created in rootfs instead of rootfs/dev

Added /dev in the mknod commands.
Signed-off-by: Rachid Koucha <rachid.koucha@gmail.com>

network: Re-works veth gateway logic

Handles more errors and gives better error messages.
Signed-off-by: tomponline <thomas.parrott@canonical.com>

network: Makes vlan network interfaces set mtu before upscript called

network: Adds custom mtu support for ipvlan interfaces

This is consistent with veth and ipvlan types.

Also makes the debug message for success occur after up script has run.

Also makes device clean up on error more thorough and consistent.
Signed-off-by: tomponline <thomas.parrott@canonical.com>

Signed-off-by: tomponline <thomas.parrott@canonical.com>

seccomp: document path calculation

raw_syscalls: add initial support for pidfd_send_signal()

Well, I added this syscall so we better use it. :)
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

tree-wide: make socket SOCK_CLOEXEC

compiler: add __returns_twice attribute

The returns_twice attribute tells the compiler that a function may return more
than one time. The compiler will ensure that all registers are dead before
calling such a function and will emit a warning about the variables that may be
clobbered after the second return from the function. Examples of such functions
are setjmp and vfork. The longjmp-like counterpart of such function, if any,
might need to be marked with the noreturn attribute.
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

network: Adds gateway device route mode

network: Static routes for IPVLAN with L2PROXY

Signed-off-by: tomponline <thomas.parrott@canonical.com>

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Adds ability to specify "dev" as the gateway value, which will cause a device route to be set as default gateway.
Signed-off-by: tomponline <thomas.parrott@canonical.com>

network: Adds layer 2 (ARP/NDP) proxy mode

seccomp: send process memory fd

namespaces: allow a pathname to a nsfd for namespace to share

There's an inherent race when reading a process's memory. The easiest way is to
have liblxc get an fd and check that the race was one, send it to the caller
(They are free to ignore it if they don't use recvmsg()).
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Signed-off-by: Serge Hallyn <shallyn@cisco.com>

Adds the lxc.net.[i].l2proxy flag that can be either 0 or 1.

Defaults to 0.

This, when used with lxc.net.[i].link, will add IP neighbour proxy entries on the linked device
for any IPv4 and IPv6 addresses on the container's network device.

Additionally, for IPv6 addresses it will check the following sysctl values and fail with an error if not set:

	net.ipv6.conf.[link].proxy_ndp=1
	net.ipv6.conf.[link].forwarding=1
Signed-off-by: tomponline <thomas.parrott@canonical.com>

seccomp: ensure fields are set to 0

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

network: Adds IPVLAN support

Example usage:

	lxc.net[i].type=ipvlan
	lxc.net[i].ipvlan.mode=[l3|l3s|l2] (defaults to l3)
	lxc.net[i].ipvlan.flags=[bridge|private|vepa] (defaults to bridge)
	lxc.net[i].link=eth0
	lxc.net[i].flags=up
Signed-off-by: tomponline <thomas.parrott@canonical.com>

seccomp: remove alignment requirements

since apparently there are insane programming languages out there that just
silently remove packed members in structs.
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

seccomp: don't commit to an api just yet

I'm not sure that I want to be married (to this layout) just yet.
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

seccomp: notifier fixes

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>