conf: support idmapped lxc.mount.entry entries

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Make sure we catch any weird behavior.
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Skip rootfs pinning for read-only file system.

Signed-off-by: Wei Mingzhi <weimingzhi@baidu.com>

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

start: move idmapped mount setup later

At the prior location we we're placed between sending and receiving
networking information over the data socket causing the startup to fail.
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

conf: fix containers without rootfs

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Fixes: #3838
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Fixes: #3838
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

cgroups: clean up cgroup_ops on initialization error

Fixes: #3836
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

oss-fuzz: add basic cgroup_init()/cgroup_exit() fuzzing

tests: fix lxc-test-arch-parse for make dist

Fixes: https://jenkins.linuxcontainers.org/job/lxc-build-tarballs/2762/consoleSigned-off-by: Christian Brauner <christian.brauner@ubuntu.com>

confile: re-add aarch64 architecture

Ensure that we detect all supported architectures and don't regress
recognizing them.
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Apparenty we dropped this when we cleaned up architecture handling.

Fixes: #3832
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Skip rootfs pinning for ZFS roots.

Per https://github.com/lxc/lxc/pull/3831#discussion_r628865713Signed-off-by: Jeff Cook <jeff@jeffcook.io>

Signed-off-by: Jeff Cook <jeff@jeffcook.io>

doc: document new idmap= option for lxc.rootfs.options

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

conf: handle kernels with CAP_SETFCAP

LXC is being very clever and sometimes maps the caller's uid into the
child userns. This means that the caller can technically write fscaps
that are valid in the ancestor userns (which can be a security issue in
some scenarios) so newer kernels require CAP_SETFCAP to do this. Until
newuidmap/newgidmap are updated to account for this simply write the
mapping directly in this case.

Cc: stable-4.0
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

lxc.arch fixes

Introduce LXC_ATTACH_DETECT_PERSONALITY to make it explicit what is
happening instead of using -1.
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Catch errors in personality handling better.
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

In a moment of idioticity I switch -1 with 0xffffffff in the header
definition but we use -1 to autodetect.
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Fix architecture parsing. So far we couldn't really differ between "want
default architecture" and "failed to parse requested architecture"
because the -1 return value means both. Fix this by using the return
value only to indicate success or failure and return the parsed
personality in a return argument.
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Use the dedicated LXC_ARCH_UNCHANGED macro everywhere instead of relying
on -1 being correct.
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Now that we have the infra to make personality handling unconitional
remove the ifndefs everywhere.
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

There's no need to making personality handling conditional as it has
been around for such a long time that only weird systems wouldn't have
support for it. And especially if the user requested a specific
personality to be set but the system doesn't support the personality
syscall we should loudly fail instead of moving on.
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Don't spam the logs because we do receive a lot of file descriptors.
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>