Signed-off-by: Wolfgang Bumiller <w.bumiller@proxmox.com>

For generated profiles with apparmor namespaces we get
profile names with slashes in them. To match those, we need
to allow changing to lxc-**, not just lxc-*.
Signed-off-by: Wolfgang Bumiller <w.bumiller@proxmox.com>

This copies lxd's apparmor profile generation. This tries to
detect features such as cgroup namespaces, apparmor
namespaces and stacking support, and has profile parts
conditionally for unprivileged containers.

This introduces the following changes to the configuration:
  lxc.apparmor.profile = generated
    The fixed value 'generated' will cause this
    functionality to be used, otherwise there should be no
    functional changes happening unless specifically
    requested with the next key:
  lxc.apparmor.allow_nesting
    This is a boolean which, if enabled, causes the
    following changes: When generated apparmor profiles are
    used, they will contain the necessary changes to allow
    creating a nested container. In addition to the usual
    mount points, /dev/.lxc/proc and /dev/.lxc/sys will
    contain procfs and sysfs mount points without the lxcfs
    overlays, which, if generated apparmor profiles are
    being used, will not be read/writable directly.
  lxc.apparmor.raw
    A list of raw apparmor profile lines to append to the
    profile. Only valid when using generated profiles.

The following apparmor profile lines have not been copied
from lxd:

  mount /var/lib/lxd/shmounts/ -> /var/lib/lxd/shmounts/,
  mount none -> /var/lib/lxd/shmounts/,
  mount options=bind /var/lib/lxd/shmounts/** -> /var/lib/lxd/**,

They should be added via lxc.apparmor.raw entries by lxd.

In order for apparmor_parser's cache to be of use, this adds
a --with-apparmor-cache-dir ./configure option.
Signed-off-by: Wolfgang Bumiller <w.bumiller@proxmox.com>

remove cgmanager rules and add fstype=cgroup2 variants for
the existing fstype=cgroup rules
Signed-off-by: Wolfgang Bumiller <w.bumiller@proxmox.com>

Signed-off-by: Wolfgang Bumiller <w.bumiller@proxmox.com>

Signed-off-by: Wolfgang Bumiller <w.bumiller@proxmox.com>

Always return -1 on error (some code paths returned -1, some
returned negative error codes), don't assume 'errno' is set
afterwards, as the function already prints errors and not
all code paths will have a usable errno value.
Signed-off-by: Wolfgang Bumiller <w.bumiller@proxmox.com>

don't kill all my processes when running it as user...
Signed-off-by: Wolfgang Bumiller <w.bumiller@proxmox.com>

Signed-off-by: Wolfgang Bumiller <w.bumiller@proxmox.com>

change log macro of error case from lxc_ambient_caps_up/down

Mount injection API 

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Signed-off-by: Liza Tretyakova <elizabet.tretyakova@gmail.com>
[christian.brauner@ubuntu.com: coding style]
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Signed-off-by: Liza Tretyakova <elizabet.tretyakova@gmail.com>

Signed-off-by: Liza Tretyakova <elizabet.tretyakova@gmail.com>

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Signed-off-by: Liza Tretyakova <elizabet.tretyakova@gmail.com>

Signed-off-by: Liza Tretyakova <elizabet.tretyakova@gmail.com>

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Signed-off-by: Liza Tretyakova <elizabet.tretyakova@gmail.com>

Signed-off-by: Liza Tretyakova <elizabet.tretyakova@gmail.com>
[christian@brauner.io: minor coding-style changes]
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Signed-off-by: Liza Tretyakova <elizabet.tretyakova@gmail.com>

Signed-off-by: Liza Tretyakova <elizabet.tretyakova@gmail.com>

Signed-off-by: Liza Tretyakova <elizabet.tretyakova@gmail.com>

Signed-off-by: Liza Tretyakova <elizabet.tretyakova@gmail.com>

Signed-off-by: Liza Tretyakova <elizabet.tretyakova@gmail.com>

Signed-off-by: Liza Tretyakova <elizabet.tretyakova@gmail.com>

Signed-off-by: 2xsec <dh48.jeong@samsung.com>

docs: tools: -d/--daemonize for lxc-execute

Signed-off-by: 2xsec <dh48.jeong@samsung.com>

thread safe: rand() => rand_r()

Explicit null dereferenced
Signed-off-by: 2xsec <dh48.jeong@samsung.com>

Signed-off-by: 2xsec <dh48.jeong@samsung.com>

attach: fix return value & cleanups

Signed-off-by: 2xsec <dh48.jeong@samsung.com>

docs: add long options of lxc-unshare

Signed-off-by: 2xsec <dh48.jeong@samsung.com>