``/proc`` might be mounted with ``hidepid=2``.
This makes ``/proc/1/…`` appear absent for non-root users.
When using the templates or the nvidia hook as a non-root user
(e.g., when creating unprivileged containers) the error
"/proc/1/uid_map: No such file or directory" is printed.
Since the script works correctly despite the error, this error
message might be confusing for users.
Signed-off-by: Lukas Pirl <git@lukas-pirl.de>

To be used when making file/directory names for containers (e.g. in lxccontainer.c)
Signed-off-by: Rachid Koucha <rachid.koucha@gmail.com>

To make the file/directory names, use the defines from macro.h
Signed-off-by: Rachid Koucha <rachid.koucha@gmail.com>

Signed-off-by: Stéphane Graber <stgraber@ubuntu.com>

If SSL is enabled, utils will include function `do_sha1_hash()` to
generate a sha1 encrypted buffer. Last function argument of
`EVP_DigestFinal_ex()` requires a `unsigned int` but the current
parameter is an `integer` type.

See error:
utils.c:350:38: error: passing 'int *' to parameter of type 'unsigned int *' converts between pointers to integer types with different sign
      [-Werror,-Wpointer-sign]
        EVP_DigestFinal_ex(mdctx, md_value, md_len);
                                            ^~~~~~
/usr/include/openssl/evp.h:549:49: note: passing argument to parameter 's' here
                                  unsigned int *s);
Signed-off-by: Julio Faracco <jcfaracco@gmail.com>

Signed-off-by: Thomas Parrott <thomas.parrott@canonical.com>

Closes #3108.
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Most kernels don't have this functionality yet, and so the warning is
printed a lot. Our people are scared of warnings, so let's make it INFO
instead in this case.
Signed-off-by: Tycho Andersen <tycho@tycho.ws>

Signed-off-by: Stéphane Graber <stgraber@ubuntu.com>

Suggested usage:

	return error_log_errno(err, "Failed: %s", "some error");

It sets errno to the value of err, then calls SYSERROR with the format and remaining args.

It always returns -1.
Suggested-by: Christian Brauner <christian.brauner@ubuntu.com>
Signed-off-by: Thomas Parrott <thomas.parrott@canonical.com>

. Use sizeof() instead of hardcoded values
. snprintf(..., size, ""...) is in error if the return code is >= size (not sufficient to set only ">")
Signed-off-by: Rachid Koucha <rachid.koucha@gmail.com>

Fixed a typo in error message
Signed-off-by: Rachid Koucha <rachid.koucha@gmail.com>

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Signed-off-by: Wolfgang Bumiller <w.bumiller@proxmox.com>

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Closes #3066.
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

In start.c, do not fill path[] table if not necessary
Signed-off-by: Rachid Koucha <rachid.koucha@gmail.com>

Signed-off-by: LiFeng <lifeng68@huawei.com>

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Signed-off-by: LiFeng <lifeng68@huawei.com>

Signed-off-by: Stéphane Graber <stgraber@ubuntu.com>

Reported-by: Free Ekanayaka <free.ekanayaka@canonical.com>
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Signed-off-by: t00416110 <tanyifeng1@huawei.com>

None of them seem to support pkg-config themselves, else we could add
them to Requires.private.
Signed-off-by: Serge Hallyn <shallyn@cisco.com>

In privileged mode, the container startup looses a file descriptor for "handler->nsfd[LX_NS_NET]". At line 1782, we preserve the namespaces file descriptor (in privileged mode, the network namespace is also preserved) :
	for (i = 0; i < LXC_NS_MAX; i++)
		if (handler->ns_on_clone_flags & ns_info[i].clone_flag)
			INFO("Cloned %s", ns_info[i].flag_name);

	if (!lxc_try_preserve_namespaces(handler, handler->ns_on_clone_flags, handler->pid)) {
		ERROR("Failed to preserve cloned namespaces for lxc.hook.stop");
		goto out_delete_net;
	}

Then at line 1830, we preserve one more time the network namespace :
		ret = lxc_try_preserve_ns(handler->pid, "net");
		if (ret < 0) {
			if (ret != -EOPNOTSUPP) {
				SYSERROR("Failed to preserve net namespace");
				goto out_delete_net;
			}
The latter overwrites the file descriptor already stored in handler->nsfd[LXC_NS_NET] at line 1786.

So, this fix checks that the entry is not already filled.
Signed-off-by: Rachid Koucha <rachid.koucha@gmail.com>

Return an error code when the name is invalid instead of pretending that things
are fine.

Closes #3044.
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

The reason for this is because openssl can be statically linked
against, gnutls cannot.
Signed-off-by: Serge Hallyn <shallyn@cisco.com>

Update for commit 8de90384Signed-off-by: KATOH Yasufumi <karma@jazz.email.ne.jp>

The hook string names must not be repeated in the source code to facilitate future changes
Signed-off-by: Rachid Koucha <rachid.koucha@gmail.com>

Closes #3027.

BugLink: https://bugs.launchpad.net/bugs/1831258
Cc: Dimitri John Ledkov <xnox@ubuntu.com>
Cc: Scott Moser <smoser@ubuntu.com>
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Signed-off-by: Paul Romlow <paul@romlow.com>