Fix some bugs in #1719

In particular, any text (like a #comment) following the mode
would end up in our mode line.
Signed-off-by: Serge Hallyn <serge@hallyn.com>

Fix up c8bf519d to fit our coding style

Also reduce the number of mallocs.
Signed-off-by: Serge Hallyn <serge@hallyn.com>

Allow full path in lxc.devices.allow

Use "rsync -SHaAX" to copy the cached rootfs into place

(updated by Serge to also handle hte new lxc-fedora{-legacy{.in
templates)
Signed-off-by: Harald Dunkel <harri@afaics.de>
Signed-off-by: Serge Hallyn <serge@hallyn.com>
Acked-by: Serge Hallyn <serge@hallyn.com>

lvm: fix check

Signed-off-by: Thomas Hipp <thipp@suse.de>
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

lvm: check whether lxc.bdev.lvm.vg is empty

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

cgroups: workaround gcc-7 bug

Also: LOL
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

cgroups: handle hybrid cgroup layouts

Closes #1669.
Closes #1678.
Relates to https://github.com/systemd/systemd/issues/6408.
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Some devices like LVM or cryptsetup entries have no stable major/minor, changing between host reboots.
In this case, hardcoded numbers are not usable in config file and there is currently no way to use hook with lxc-device to do the link at guest startup :

    * `pre-start`/`autodev` hook runs in host context but has the guest in stopped state and so lxc-device not usable
    * `start` hook is in running state but runs in guest context and so lxc-device not available

This patch converts fullpath in lxc.devices.allow to current major/minor numbers to address those changing numbers.
Signed-off-by: aeris <aeris@imirhil.fr>

call lxc_setup() after unshare(CLONE_NEWCGROUP)

When the running kernel supports cgroup namespaces and users want to manually
set up cgroups via lxc.hook.mount before the init binary starts the cgroup
namespace needs to be already unshared. Otherwise the view on the cgroup mounts
is wrong. This commit places the call to lxc_setup() after the
LXC_SYNC_POST_CGROUP barrier.

Before this commit, the tty fds we allocate from a fresh devpts instance in the
container's namespaces before the init binary starts were referring to the
host's cgroup namespace since lxc_setup() was called before
unshare(CLONE_NEWCGROUP). Although not a security risk at this point since
setns() restricts its calls to /proc/<self>/ns files it's still better to do it
*after* the cgroup namespace has been unshared.

Adding a Suggested-by line for the lxc.mount.hook fix for Quentin.

Closes #1597.
Suggested-by: Quentin Dufour <quentin@dufour.tk>
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Fix issue #1702, do remount with the MS_REMOUNT flag when mounts with MS_RDONLY

Signed-off-by: Li Feng <lifeng68@huawei.com>

Signed-off-by: Li Feng <lifeng68@huawei.com>

Signed-off-by: Li Feng <lifeng68@huawei.com>

cgfsng: remove the old workdaround code

update doc and test

Signed-off-by: Long Wang <w@laoqinren.net>

Signed-off-by: Long Wang <w@laoqinren.net>

Signed-off-by: Long Wang <w@laoqinren.net>

Signed-off-by: Long Wang <w@laoqinren.net>

Signed-off-by: Long Wang <w@laoqinren.net>

Signed-off-by: Long Wang <w@laoqinren.net>

Signed-off-by: Long Wang <w@laoqinren.net>

Signed-off-by: Long Wang <w@laoqinren.net>

Signed-off-by: Long Wang <w@laoqinren.net>

Signed-off-by: Long Wang <w@laoqinren.net>

Signed-off-by: Long Wang <w@laoqinren.net>

Signed-off-by: Long Wang <w@laoqinren.net>

Signed-off-by: Long Wang <w@laoqinren.net>

cgfsng: only output debug info when we set cgroup data