.gitignore: Ignores COPYING file created by make

Signed-off-by: Thomas Parrott <thomas.parrott@canonical.com>

lxc-test-usernsexec: If user is root, then create and use non-root user.

Previously if the user was root, then the test would just skip
running (and exit 0).  The lxc test environment is run as root.
So, instead of never doing anything there, we create a user,
make sure it is in /etc/sub{ug}id and then execute the test as that
user.

If user is already non-root, then just execute the tests as before.
Signed-off-by: Scott Moser <smoser@brickies.net>

Add test of lxc-usernsexec

The test executes lxc-usernsexec to create some files and chmod them.
Then makes assertions on the uid and gid of those files from outside.
Signed-off-by: Scott Moser <smoser@brickies.net>

api_extensions: add "pidfd"

Somehow it's documented but wasn't ever added.
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Signed-off-by: Stéphane Graber <stgraber@ubuntu.com>

lxc-usernsexec: improvements

We can fail to setgroups() when "deny" has been set which we need to set when
we are a fully unprivileged user.

Closes: 3420.
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

network: use __instantiate_ns_common() in instantiate_ns_phys() too

Fixes: https://lists.linuxcontainers.org/pipermail/lxc-users/2020-May/015245.htmlSigned-off-by: Christian Brauner <christian.brauner@ubuntu.com>

bionic: s/lxc_raw_execveat()/execveat()/g

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

network: fix {mac,ip,v}lan device creation

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

network: restore old behavior

I introduced a regression: when users didn't specify a specific name via
lxc.net.<idx>.name then the device would retain the random name it received
when we created it. Before we would use the "eth%d" syntax to get the kernel to
assign a fixed name. Restore that behavior.

Closes: #3407.
Fixes: 8bf64b77 ("network: rework network device creation")
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

clone3: add infrastructure and switch container creation to it

improve LXC_CMD_GET_CGROUP compatibility

When a newer lxc library communicates with an older one
(such as running an lxc 4.0 lxc-freeze on a longer running
container which was started while lxc was still at version
3), the LXC_CMD_GET_LIMITING_CGROUP command is not
available, causing the remote to just close the socket.
Catch this and try the previous command instead.
Signed-off-by: Wolfgang Bumiller <w.bumiller@proxmox.com>

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

No more weird api quirks between architectures and cool new features.
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Don't busy loop on freeze with cgroupv2

EPOLLIN will always be true and therefore end up
busy-looping
Signed-off-by: Wolfgang Bumiller <w.bumiller@proxmox.com>

Signed-off-by: Wolfgang Bumiller <w.bumiller@proxmox.com>

in order to be able to listen for EPOLLPRI
Signed-off-by: Wolfgang Bumiller <w.bumiller@proxmox.com>

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

This will be the central place for all process management helpers. This also
removes raw_syscalls.{c,h}.
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

They are offset by 1024.
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

console: only create detached mount when a console is requested

otherwise weird things might happen.
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

reboot fixes

Disable and enable syslog around lxc_check_inherited().
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>