call lxc_setup() after unshare(CLONE_NEWCGROUP)

When the running kernel supports cgroup namespaces and users want to manually
set up cgroups via lxc.hook.mount before the init binary starts the cgroup
namespace needs to be already unshared. Otherwise the view on the cgroup mounts
is wrong. This commit places the call to lxc_setup() after the
LXC_SYNC_POST_CGROUP barrier.

Before this commit, the tty fds we allocate from a fresh devpts instance in the
container's namespaces before the init binary starts were referring to the
host's cgroup namespace since lxc_setup() was called before
unshare(CLONE_NEWCGROUP). Although not a security risk at this point since
setns() restricts its calls to /proc/<self>/ns files it's still better to do it
*after* the cgroup namespace has been unshared.

Adding a Suggested-by line for the lxc.mount.hook fix for Quentin.

Closes #1597.
Suggested-by: Quentin Dufour <quentin@dufour.tk>
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Fix issue #1702, do remount with the MS_REMOUNT flag when mounts with MS_RDONLY

Signed-off-by: Li Feng <lifeng68@huawei.com>

Signed-off-by: Li Feng <lifeng68@huawei.com>

Signed-off-by: Li Feng <lifeng68@huawei.com>

cgfsng: remove the old workdaround code

update doc and test

Signed-off-by: Long Wang <w@laoqinren.net>

Signed-off-by: Long Wang <w@laoqinren.net>

Signed-off-by: Long Wang <w@laoqinren.net>

Signed-off-by: Long Wang <w@laoqinren.net>

Signed-off-by: Long Wang <w@laoqinren.net>

Signed-off-by: Long Wang <w@laoqinren.net>

Signed-off-by: Long Wang <w@laoqinren.net>

Signed-off-by: Long Wang <w@laoqinren.net>

Signed-off-by: Long Wang <w@laoqinren.net>

Signed-off-by: Long Wang <w@laoqinren.net>

Signed-off-by: Long Wang <w@laoqinren.net>

Signed-off-by: Long Wang <w@laoqinren.net>

Signed-off-by: Long Wang <w@laoqinren.net>

cgfsng: only output debug info when we set cgroup data

Update Japanese man pages

add "--defined" option
Signed-off-by: KATOH Yasufumi <karma@jazz.email.ne.jp>

Follow updates of configuration keys:
* Delete lxc.kmsg (commit 26a38fb6)
* lxc.console -> lxc.console.path (commit 3aed4934)
* lxc.mount -> lxc.mount.fstab (commit 47148e96)
* lxc.net.ipv{4,6} -> lxc.net.ipv{4,6}.address (commit 9ff60df2, 2e44ae28)
* lxc.tty -> lxc.tty.max, lxc.devttydir -> lxc.tty.dir (commit fe1c5887)
* lxc.pts -> lxc.pty.max (commit 232763)
Signed-off-by: KATOH Yasufumi <karma@jazz.email.ne.jp>

Only output debug info `cgroup 'xxxx' set to 'yyyy'` when we set
cgroup data.
Signed-off-by: Long Wang <w@laoqinren.net>

Signed-off-by: Stéphane Graber <stgraber@ubuntu.com>

Fix potential CVE when using spaces in LXC names
Signed-off-by: William Gathoye <william@gathoye.be>

start: dup std{in,out,err} to pty slave

non-functional changes
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

In the case the container has a console with a valid slave pty file descriptor
we duplicate std{in,out,err} to the slave file descriptor so console logging
works correctly. When the container does not have a valid slave pty file
descriptor for its console and is started daemonized we should dup to
/dev/null.

Closes #1646.
Signed-off-by: Li Feng <lifeng68@huawei.com>
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

delete comments

utils: use access instead of stat

we shoud test whether the file exists and grants
execute permissions.
Signed-off-by: Long Wang <w@laoqinren.net>

Signed-off-by: Long Wang <w@laoqinren.net>

Signed-off-by: Long Wang <w@laoqinren.net>

start: use separate socket on daemonized start

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>