coverity: #1425747

Resource leak
Signed-off-by: Donghwa Jeong <dh48.jeong@samsung.com>

Resource leak
Signed-off-by: Donghwa Jeong <dh48.jeong@samsung.com>

Resource leak
Signed-off-by: Donghwa Jeong <dh48.jeong@samsung.com>

terminal: enable local output processing

conf: only use newuidmap and newgidmap when necessary

fix bug: unpriv lxc will run lxc.net.[i].script.up now

Signed-off-by: harryoooooooooo <ymsc27884@gmail.com>

Signed-off-by: Jonathan Calmels <jcalmels@nvidia.com>

Signed-off-by: Jonathan Calmels <jcalmels@nvidia.com>

coverity: #1425811

Resource leak
Signed-off-by: Donghwa Jeong <dh48.jeong@samsung.com>

coverity: #1425753

Copy into fixed size buffer
Signed-off-by: Donghwa Jeong <dh48.jeong@samsung.com>

coverity: #1425836

Resource leak
Signed-off-by: Donghwa Jeong <dh48.jeong@samsung.com>

pam_cgfs: fix Logically dead code.

coverity: #1425849, #1425821, #1425794, #1425779, #1425777, #1425795, #1425841

Signed-off-by: Donghwa Jeong <dh48.jeong@samsung.com>

Signed-off-by: Donghwa Jeong <dh48.jeong@samsung.com>

Signed-off-by: Donghwa Jeong <dh48.jeong@samsung.com>

Signed-off-by: Donghwa Jeong <dh48.jeong@samsung.com>

Signed-off-by: Donghwa Jeong <dh48.jeong@samsung.com>

Signed-off-by: Donghwa Jeong <dh48.jeong@samsung.com>

Signed-off-by: Donghwa Jeong <dh48.jeong@samsung.com>

Signed-off-by: Donghwa Jeong <dh48.jeong@samsung.com>

Revert "seccomp: make do_resolve_add_rule() more strict"

Reported-by: Felix Abecassis <fabecassis@nvidia.com>
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Fix typo

Signed-off-by: Stéphane Graber <stgraber@ubuntu.com>

This reverts commit dfddc8aa.

Closes #2376.
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

conf: change some logs to print errno

Signed-off-by: Donghwa Jeong <dh48.jeong@samsung.com>

conf: copy mountinfo for remount_all_slave()

support tls in cross-compile

AC_RUN_IFELSE will fail in cross-compile,
we can use AC_COMPILE_IFELSE replace.
Signed-off-by: duguhaotian <duguhaotian@gmail.com>

While a container reads mountinfo from proc fs, the mountinfo can be changed by
the kernel anytime. This has caused critical issues on some devices.

Signed-off-by: Donghwa Jeong dh48.jeong@samsung.com
Reported-by: Donghwa Jeong dh48.jeong@samsung.com
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

More seccomp fixes

The mask was unconditionally parsed, it failed if no mask was
provided.
Signed-off-by: Felix Abecassis <fabecassis@nvidia.com>

The last (optional) argument was named "valueTwo", which seems to
originate from the OCI runtime spec:
https://github.com/opencontainers/runtime-spec/blob/master/config-linux.md#seccomp

In proper seccomp terminology, "value" is "datum_a" and "valueTwo" is "datum_b".

However, LXC's "valueTwo" was used as the mask for SCMP_CMP_MASKED_EQ,
while the mask is supposed to be "datum_a".
Signed-off-by: Felix Abecassis <fabecassis@nvidia.com>