Patch from Harald Dunkel + tweak

Signed-off-by: Stéphane Graber <stgraber@ubuntu.com>

Signed-off-by: Harald Dunkel <harald.dunkel@aixigo.de>

lxc-user-nic: improvements

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Before this commit, lxc-user-nic could potentially have been tricked into
operating on a network namespace over which the caller did not hold privilege.

This commit ensures that the caller is privileged over the network namespace by
temporarily dropping privilege.

Launchpad: https://bugs.launchpad.net/ubuntu/+source/lxc/+bug/1654676Reported-by: Jann Horn <jannh@google.com>
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

seccomp: set SCMP_FLTATR_ATL_TSKIP if available

Newer libseccomp has a flag called SCMP_FLTATR_ATL_TSKIP which
allows syscall '-1' (nop) to be executed.  Without that flag,
debuggers cannot skip system calls inside containers.  For reference,
see the seccomp(2) manpage, which says:

	The tracer can skip the system call by changing the system call  number  to  -1.

and see the seccomp issue #80
Signed-off-by: Serge Hallyn <serge@hallyn.com>

cgfsng: make trim() safer

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

log: fix lxc_unix_epoch_to_utc()

The conversion algorithm used uses a clever trick by letting a year start at 1
March. So we need to add 1 for January and February.
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

start: dumb down SIGCHLD from WARN() to NOTICE()

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

debian template: Allow to embed a SSH public key in the new container

squeeze is not a supported release anymore, drop the key

Signed-off-by: Evgeni Golov <evgeni@debian.org>

Fix issue with the clonehostname hook not working for overlayfs snapshot clones

Previously this hook did not work when cloning containers using an overlayfs snapshot as the LXC_ROOTFS_PATH didn't point to the actual filesystem that the container would see. LXC_ROOTFS_MOUNT should be used instead and in fact lxc.container.conf man page says that you usually would want to use the _MOUNT variant.
Signed-off-by: Matt Keeler <mjkeeler7@gmail.com>

c/r: only supply --ext-mount-map for bind mounts

lxc-download: Bump compat level to 4

For templates introduced after LXC 2.0 was released.
Signed-off-by: Stéphane Graber <stgraber@ubuntu.com>

Various fixes for Fedora bootstrapping on non-Fedora hosts

Signed-off-by: Reto Gantenbein <reto.gantenbein@linuxmonk.ch>

Signed-off-by: Reto Gantenbein <reto.gantenbein@linuxmonk.ch>

- Make sure mirror URL is queried for $FEDORA_RELEASE_DEFAULT
- Fix image path for URLs queried via mirror list
Signed-off-by: Reto Gantenbein <reto.gantenbein@linuxmonk.ch>

Signed-off-by: Reto Gantenbein <reto.gantenbein@linuxmonk.ch>

sabayon: Use /bin/bash

The script is full of bashisms making it break when run with a simple
POSIX shell.
Signed-off-by: Stéphane Graber <stgraber@ubuntu.com>

Complete rework of lxc-fedora template

The rest of the mounts can be restored normally.
Signed-off-by: Tycho Andersen <tycho.andersen@canonical.com>

fix seccomp blocking x32 guests on amd64 (userspace) hosts

Add HAVE_LIBCAP

Currently it is impossible to build lxc with --disable-capabilities if
the user has libcap-dev installed on his system as:
 - calls to cap_xxx functions are not protected by HAVE_LIBCAP defines.
 The whole file is only protected by HAVE_SYS_CAPABILITY_H.
 - AC_CHECK_LIB default action-if-found is overriden by [true] so
 HAVE_LIBCAP is never written to config.h

This patch replaces all HAVE_SYS_CAPABILITY_H checks by HAVE_LIBCAP
checks (fix #1361)
Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>

Without this patch, x32 guests (and no others) worked "natively" with x32
host lxc, but not on regular amd64 hosts.  That was especially problematic
as a number of ioctls such as those needed by netfilter don't work in such
scenarios, thus you want to run amd64 on the host.

With the patch, you can use all three ABIs: i386 x32 amd64 on amd64 hosts.

Despite x32 being little used, there's no reason to deny it by default:
the admin needs to compile their own kernel with CONFIG_X86_X32=y or (on
Debian) boot with syscall.x32=y.  If they've done so, it is a reasonable
assumption they want x32 guests.
Signed-off-by: Adam Borowski <kilobyte@angband.pl>

lxc_setup_tios(): Ignore SIGTTOU and SIGTTIN signals

Make lxc-net return non-zero on failure