console: they are really not necessary

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

coverity: bug smash

fix userns helper error handling

In both of these cases if there is actually an error, we won't close the
pipe and the api call will hang. Instead, let's be sure to close the pipe
before waiting, so that it doesn't hang.
Signed-off-by: Tycho Andersen <tycho@tycho.ws>

Signed-off-by: duguhaotian <duguhaotian@gmail.com>

Dereference after null check
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Dereference after null check
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

The container name can't be NULL so don't give coverity the impression that it
could be.

Silences coverity #1426123.
Silences coverity #1426124.
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Unchecked return value
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Argument cannot be negative
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Resource leak
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

start: check for cgroup namespace support

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

2018 02 08/priv

The only cases where we really need to be privileged with respect
to the host is when we are trying to mknod, and in some cases
to do with a physical network device.  This patch leaves the
detection of the network device cases as a TODO.

This should fix the currently broken case of starting a privileged
container with at least one veth nic, nested inside an unprivileged
container.

Cc: Tycho Andersen <tycho@tycho.ws>
Signed-off-by: Serge Hallyn <shallyn@cisco.com>

Sometimes we want to know whether we are privileged wrt our
namespaces, and sometimes we want to know whether we are priv
wrt init_user_ns.
Signed-off-by: Serge Hallyn <shallyn@cisco.com>

confile: add lxc.namespace.share.[namespace], lxc.namespace.keep, lxc.namespace.clone

tools/lxc-ls: fix logic for unpriv containers

cgfsng: add required remount flags

https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=9566d6742852c527bf5af38af5cbb878dad75705Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Signed-off-by: Marcos Paulo de Souza <marcos.souza.org@gmail.com>

Signed-off-by: Marcos Paulo de Souza <marcos.souza.org@gmail.com>
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Closes #870.
Signed-off-by: Marcos Paulo de Souza <marcos.souza.org@gmail.com>

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Issues fixed:
- lxc-centos died about a missing /run directory
- lxc-centos complained about some config files it couldn't modify
- the new container got stuck at startup time for a minute
  (literally), waiting for systemd-remount-fs startup script

Of course it still works for RHEL 6, CentOS 6 and 7 as well. I did not
verify earlier CentOS or RHEL releases.
Signed-off-by: Harald Dunkel <harald.dunkel@aixigo.de>
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Perform MS_REMOUNT on mounts with MS_RDONLY.
Signed-off-by: LiFeng <lifeng68@huawei.com>
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Set the same environment variables that were used when starting the container
when attaching to the container.
Signed-off-by: LiFeng <lifeng68@huawei.com>
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>