lxc-download fixes

Closes #3511
Signed-off-by: Stéphane Graber <stgraber@ubuntu.com>

This reverts commit 409040e7.

Testing of both options show identical behavior but receive-keys does
not exist on older releases, so let's revert this.

Closes #3510
Signed-off-by: Stéphane Graber <stgraber@ubuntu.com>

api-extension: add missing seccomp_proxy_send_notify_fd extension

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

seccomp: add seccomp_notify_fd_active api extension

Since we haven't made this official api yet: YOLO
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

which allows to retrieve an active seccomp notifier fd from a running
container.
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

seccomp: don't close the mainloop, simply remove the handler

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

macro: define TIOCGPTPEER if missing

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

terminal: safely allocate pts devices from inside the container

This was a year long journey which seems to finally have come to an end.

Closes: #1620.
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

conf: ensure that the idmap pointer itself is freed

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

syscall: don't fail if __NR_signalfd is not defined

lxc fails to build if __NR_signalfd is not defined since version 4.0.0
and
https://github.com/lxc/lxc/commit/bed09c9cc0bec7bbd2442fcce4a2a0f03994cb09

However, some architectures don't define __NR_signalfd but only
__NR_signalfd4. This is the case for example for nios2 or csky:
https://github.com/bminor/glibc/blob/f9ac84f92f151e07586c55e14ed628d493a5929d/sysdeps/unix/sysv/linux/nios2/arch-syscall.h
https://github.com/bminor/glibc/blob/f9ac84f92f151e07586c55e14ed628d493a5929d/sysdeps/unix/sysv/linux/csky/arch-syscall.h

Fixes:
 - http://autobuild.buildroot.org/results/75096a48d2dbda57459523db3ed0952e63f93535Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>

seccomp: add missing header

Fixes: https://launchpadlibrarian.net/490341075/buildlog_snap_ubuntu_bionic_amd64_lxd-latest-edge_BUILDING.txt.gzSigned-off-by: Christian Brauner <christian.brauner@ubuntu.com>

seccomp: remove seccomp fd from event loop after task exited

Linux v5.8 will land my patch where seccomp notifies when a filter goes unused,
i.e. when the last task using a given seccomp filter has exited. This wasn't
possible before and so we accumulated file descriptors in the container's event
loop whenever we attached to the container.
I'm not sure whether the task exiting before we could handle its syscall should
cause us to report and error or not. For now, let's simply close the event loop
and not report an error.
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

selinux: remove security_context_t usage as it's deprecated

Link: https://bugs.launchpad.net/ubuntu/+source/lxc/+bug/1888705Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

autotools: fix Makefile

new mount api support: basics

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

that translates between the two mount apis.
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

tree-wide: hide unnecessary symbols

apparmor: Allow ro remount of boot_id

The rule added in 86384507 did not cover all
necessary mount calls for /proc/sys/kernel/random/boot_id
(in src/lxc/conf.c: lxc_setup_boot_id) - the ro remount is missing.
Signed-off-by: Stoiko Ivanov <s.ivanov@proxmox.com>

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>