Signed-off-by: Christian Brauner <christian.brauner@mailbox.org>

gentoo.moresecure.conf tries to drop the capability CAP_SYS_RESOURCES.
However, that capability doesn't exist, so the container doesn't start.
Change it to CAP_SYS_RESOURCE, according to capabilities(7).

Also correct the same typo in a comment in slackware.common.conf.
Signed-off-by: Karl-Johan Karlsson <creideiki@ferretporn.se>

I think (?) this may be related to our hanging monitor bug. Let's do this
anyway, as it's probably a good idea.
Signed-off-by: Tycho Andersen <tycho.andersen@canonical.com>

Required for proper applying dnsmasq config entries.
Signed-off-by: Andrey Kostin <andrey@kostin.email>

Signed-off-by: Thomas Tanaka <thomas.tanaka@oracle.com>

Update for commit f43d63bcSigned-off-by: Sungbae Yoo <sungbae.yoo@samsung.com>

When container init failed for whatever reason, previously it resulted
in a `SystemError: NULL result without error in PyObject_Call`
This will now result in a RuntimeError with the error message
previously printed to stderr.
Signed-off-by: Aron Podrigal <aronp@guaranteedplus.com>

Let lxc-checkconfig write to non-tty stdout without color control
characters
Signed-off-by: walkerning <foxdoraame@gmail.com>

Signed-off-by: Christian Brauner <christian.brauner@mailbox.org>

Signed-off-by: Christian Brauner <christian.brauner@mailbox.org>

Update for commit f43d63bcSigned-off-by: KATOH Yasufumi <karma@jazz.email.ne.jp>

Signed-off-by: Stéphane Graber <stgraber@ubuntu.com>

gcc -Wall warns about uninitialized variables (-Wmaybe-uninitialized), and
-Werror makes it fatal. This change allows the build to succeed by NULL'ifying
the pointer passed to strtok_r().

Note that strtok_r(3) anyway ignores a non-NULL arg3 pointer on the 1st call
with non-NULL arg1 string.
Signed-off-by: Leonid Isaev <leonid.isaev@jila.colorado.edu>
Acked-by: Serge Hallyn <serge.hallyn@ubuntu.com>

Signed-off-by: Christian Brauner <christian.brauner@mailbox.org>

Signed-off-by: Andrey Jr. Melnikov <temnota.am@gmail.com>

- /etc(/rc.d)?/init.d/functions does not exist on all distributions
- LSB does not define a message function without an explicit status
- Debian-derived systems add a log_daemon_msg for that

lets define an own log_daemon_msg as echo and try to load LSB init
functions afterwards, which might overload it with a nicer version

that way the init scripts should work on any system, without hard
dependencies on neither LSB nor /etc/init.d/functions

Closes #309 #310 #311
Signed-off-by: Evgeni Golov <evgeni@debian.org>

the target is obsolete since systemd v38 which everybody should have.

original patch by Daniel Baumann
Signed-off-by: Evgeni Golov <evgeni@debian.org>

```
>>> c = lxc.Container('ct')
>>> c.create('debian', args=('-r', 'jessie'))
Traceback (most recent call last):
  File "<stdin>", line 1, in <module>
  File "/usr/lib/python3/dist-packages/lxc/__init__.py", line 229, in
create
    template_args['args'] = tuple(tmp_args)
UnboundLocalError: local variable 'tmp_args' referenced before
assignment
```
Signed-off-by: Aron Podrigal <aronp@guaranteedplus.com>

original patch by Daniel Baumann

closes #308
Signed-off-by: Evgeni Golov <evgeni@debian.org>

Signed-off-by: Christian Brauner <christian.brauner@mailbox.org>

pty logging only works correctly when stdout and stderr refer to a pty. If they
do not, we do not dup2() them and lxc_console_cb_con() will never write to the
corresponding log file descriptor.

When redirection on stdout and stderr is used we can safely assume that the user
is already logging to a file or /dev/null and creating an additional pty log
doesn't seem to make sense.
Signed-off-by: Christian Brauner <christian.brauner@mailbox.org>

Note that is_crucial_subsystem still lists name=systemd.  That is
used in cgfs and cgmanager.  Cgmanager is typically setup to create
name=systemd, so it is ok.  cgfs uses is_crucial_subsystem() only
to decide whether failure to create or chown a directory should be
terminal.  That's ok, because (a) if name=systemd is not mounted then
we won't hit that, and (b) if name=systemd is mounted, then we'd
really still like to set it up for containers.
Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>

Using $(date) for LXC_GENERATE_DATE has various flaws:
* formating depends on the locale of the system we execute configure on
* the output is not really a date but more a timestamp

Let's use $(date --utc '+%Y-%m-%d') instead.

While at it, also support SOURCE_DATE_EPOCH [1] to make the build
reproducible

[1] https://reproducible-builds.org/specs/source-date-epoch/Signed-off-by: Evgeni Golov <evgeni@debian.org>

Signed-off-by: Christian Brauner <christian.brauner@mailbox.org>

Signed-off-by: Christian Brauner <christian.brauner@mailbox.org>

Signed-off-by: Christian Brauner <christian.brauner@mailbox.org>

This cleans up some sign-compare warnings as well as avoids any
possibilities of unintended signed offsets for indices during
iteration.
Signed-off-by: Matt Ullman <staticfox@staticfox.net>

Signed-off-by: Matt Ullman <staticfox@staticfox.net>

The current tests for lxc-attach pty allocation and I/O redirection rely on the
standard file descriptors of the test script to refer to a pty. If they do not
the tests are effectively useless with respect to pty allocation. We need a test
environment with the standard file descriptors refering to a pty as well. One
solution is to run this test under the script command.

This commit also adds a test whether pty logging works. This test is only
executed when all standard file descriptors refer to a pty.
Signed-off-by: Christian Brauner <christian.brauner@mailbox.org>

This requires us to check that at cgfsng_ops_init, rather than
cgfs_init.  Cache the hierarchy and cgroup.use info globally
rather than putting it into the per-container info, as cgmanager
does.  This is ok as both cgroup.use and the list of usable
hierarchies are in fact global to a lxc run.

Closes #952
Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>

Clean exit when read() == -1 && errno != EINTR or read() == 0.
Signed-off-by: Christian Brauner <christian.brauner@mailbox.org>

Using EPOLLHUP to determine when to exit the loop is unreliable. Let's exit
clean when read() returns -1 && errno != EINTR or 0.
Signed-off-by: Christian Brauner <christian.brauner@mailbox.org>

lxc-attach allocated a pty in a manner that relied on ts->stdinfd and
ts->stdoutfd to be set. We had to resort to a trick to get it working when
output is redirected. The new implementation gets rid of the black magic and
also simplifies the code.

This commit also implements pty logging for lxc-attach. Users will now be able
to log commands and corresponding output to a file given that lxc-attach
allocates a pty.
Signed-off-by: Christian Brauner <christian.brauner@mailbox.org>

lxc_console_create() calls lxc_console_peer_default() which in turn calls
lxc_console_sigwinch_init() which sets up the lxc_tty_state struct for the
current pty. Prior to this commit lxc_console_sigwinch_init() would consider
failures to install a SIGWINCH handler fatal and and return NULL. This commit
makes failures to install a SIGWINCH handler non-fatal. In such cases the
lxc_tty_state struct will still be set up but the sigfd member, which contains
the fd which receives SIGWINCH events, will be set to -1. (This also entails
that the sigset_t oldmaks field is meaningless.) Callers of
lxc_console_sigwinch_init() and lxc_console_sigwinch_fini() should thus make
sure that sigfd >= 0 or sigfd != -1 before trying to register a SIGWINCH handler
in e.g. an lxc_mainloop or resetting the sigmask (cf. lxc_attach.c).

These changes also imply that lxc_console_sigwinch_init() only fails with
ENOMEM. Thus, all cases where lxc_console_sigwinch_init() returns NULL are to be
considered fatal. This wasn't the case before this commit.
Signed-off-by: Christian Brauner <christian.brauner@mailbox.org>

Signed-off-by: Stéphane Graber <stgraber@ubuntu.com>

lxc_mount_auto_mounts(): free memory on failure

lxc-create: bugfixes and small improvements

Signed-off-by: Christian Brauner <christian.brauner@mailbox.org>

netlink_open: close socket on error

All uses of netlink_open() assume that on error the
nl_handler doesn't need to be closed, but some error cases
happen after the socket was opened successfully and used to
simply return -errno.
Signed-off-by: Wolfgang Bumiller <w.bumiller@proxmox.com>