lxc-clone: change uuid on xfs

Otherwise after cloning an lvm+xfs container you can't run the
original and clone at the same time.

Based on a patch by Maurizio Sambati posted at
https://bugs.launchpad.net/ubuntu/+source/lxc/+bug/1013549

Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
lxc-clone: fix handling of lxc.mount entries

The 'lxc.mount =' entry can have more than one space, or tabs, before the =.
We only need to disambiguate from 'lxc.mount.entry'.  So just check for a
space or tab after mount.

Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
lxc-wait: Add timeout option

Allow to specify a timeout for waiting on state changes via lxc-wait.
Helpful for scripts that need to handle errors or excessive delays in
state changing procedures.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
Introduce support for seccomp.

Hi,

This patch is so far just a proof of concept.  The libseccomp api will be
changing soon so it probably wouldn't be worth pulling this until it is
updated for the new API.

This patch introduces support for seccomp to lxc.  Seccomp lets a program
restrict its own (and its children's) future access to system calls.  It
uses a simple whitelist system call policy file.  It would probably be
better to switch to something more symbolic (i.e specifying 'open' rather
than the syscall #, especially given container arch flexibility).

I just wanted to get this out there as a first step.  You can also get
source for an ubuntu package based on this patch at
https://code.launchpad.net/~serge-hallyn/ubuntu/quantal/lxc/lxc-seccomp

Signed-off-by: Serge Hallyn <serge.hallyn@canonical.com>
confile: support 'lxc.include' option to include other config files

For instance

lxc.include = /var/lib/lxc/commonopts

in /var/lib/lxc/q1/config would cause the configuration in
/var/lib/lxc/commonopts to be loaded when container q1 starts.

Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
seccomp: include lxcseccomp.h in start.c

Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
Cleanup partial container if -h was passed to template

If user calls 'lxc-create -t ubuntu -- -h' (as opposed to
'lxc-create -t ubuntu -h') then the ubuntu template will print its
help then exit 0.  Then lxc-create does not cleanup.  So detect this
in lxc-create.
fix configure.ac for seccomp and apparmor

Use --enable-XXX=check when not specified to get reasonable defaults.

Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
Makefile.am: use right .h file name for seccomp

Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
Add network-down script

Analogously to lxc.network.script.up, add the ability to register a down
script. It is called before the guest network is finally destroyed,
allowing to clean up resources that are not reset/destroyed
automatically. Parameters of the down script are identical to the up
script except for the execution context "down".

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
ubuntu and debian templates: Clean up cache if cache build is interrupted

Otherwise the next lxc-create may rsync a bad cache.

Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
ubuntu template: apt-get clean after debootstrapping a cache

This saves quite a bit of space in the cache and containers.

See https://bugs.launchpad.net/ubuntu/+source/lxc/+bug/1037626 for the
original bug report.

Reported-by: Fajar A. Nugraha <list@fajar.net>
Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
lxc_start: exit early if insufficient privs in daemon mode

Starting a container with insufficient privilege (correctly) fails
during lxc_init.  However, if starting a daemonized container, we
daemonize before we get to that check.  Therefore while the
container will fail to start, and the logfile will show this, the
'lxc-start -n x -d' command will return success.  For ease of
scripting, do a check for the required privilege before we exit.

Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
lxc-create: Make location of container rootfs configurable

Make 'dir' an explicit backing store type, which accepts '--dir rootfs'
as an option to specify a custom location for the container rootfs.  Also
update lxc-destroy to now remove the rootfs separately, as removing
@LXCPATH@/$name may not hit it.

Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
lxc-start: Add command to retrieve the clone flags used to start the container.

Add the LXC_COMMAND_CLONE_FLAGS that retrieves the flags passed to clone(2)
when the container was started. This allows external programs to determine
which namespaces the container was unshared from.

Signed-off-by: Christian Seiler <christian@iwakd.de>
Cc: Daniel Lezcano <daniel.lezcano@free.fr>
Acked-by: Serge Hallyn <serge.hallyn@canonical.com>
lxc-attach: Remodel cgroup attach logic and attach to namespaces again in parent process

With the introduction of lxc-attach's functionality to attach to cgroups,
the setns() calls were put in the child process after the fork() and not the
parent process before the fork() so the parent process remained outside the
namespaces and could add the child to the correct cgroup.

Unfortunately, the pid namespace really affects only children of the current
process and not the process itself, which has several drawbacks: The
attached program does not have a pid inside the container and the context
that is used when remounting /proc from that process is wrong. Thus, the
previous logic of first setting the namespaces and then forking so the child
process (which then exec()s to the desired program) is a real member of the
container.

However, inside the container, there is no guarantee that the cgroup
filesystem is still be mounted and that we are allowed to write to it (which
is why the setns() was moved in the first place).

To work around both problems, we separate the cgroup attach functionality
into two parts: Preparing the attach process, which just opens the tasks
files of all cgroups and keeps the file descriptors open and the writing to
those fds part. This allows us to open all the tasks files in lxc_attach,
then call setns(), then fork, in the child process close them completely and
in the parent process just write the pid of the child process to all those
fds.

Signed-off-by: Christian Seiler <christian@iwakd.de>
Cc: Daniel Lezcano <daniel.lezcano@free.fr>
Acked-by: Serge Hallyn <serge.hallyn@canonical.com>
lxc-attach: Detect which namespaces to attach to dynamically

Use the command interface to contact lxc-start to receive the set of
flags passed to clone() when starting the container. This allows lxc-attach
to determine which namespaces were used for the container and select only
those to attach to.

Signed-off-by: Christian Seiler <christian@iwakd.de>
Cc: Daniel Lezcano <daniel.lezcano@free.fr>
Acked-by: Serge Hallyn <serge.hallyn@canonical.com>
lxc-unshare: Move functions to determine clone flags from command line options to namespace.c

In order to be able to reuse code in lxc-attach, the functions
lxc_namespace_2_cloneflag and lxc_fill_namespace_flags are moved from
lxc_unshare.c to namespace.c.

Signed-off-by: Christian Seiler <christian@iwakd.de>
Cc: Daniel Lezcano <daniel.lezcano@free.fr>
Acked-by: Serge Hallyn <serge.hallyn@canonical.com>
lxc-attach: Add -s option to select namespaces to attach to

This patch allows the user to select any list of namespaces (network, pid,
mount, uts, ipc, user) that lxc-attach should use when attaching to the
container; all other namespaces will not be attached to.

This allows the user to for example attach to just the network namespace and
use the host's (and not the container's) network tools to reconfigure the
network of the container.

Signed-off-by: Christian Seiler <christian@iwakd.de>
Cc: Daniel Lezcano <daniel.lezcano@free.fr>
Acked-by: Serge Hallyn <serge.hallyn@canonical.com>
lxc-attach: Add -R option to remount /sys and /proc when only partially attaching

When attaching to only some namespaces of the container but not the mount
namespace, the contents of /sys and /proc of the host system do not properly
reflect the context of the container's pid and/or network namespaces, and
possibly others.

The introduced -R option adds the possibility to additionally unshare the
mount namespace (when it is not being attached) and remount /sys and /proc
in order for those filesystems to properly reflect the container's context
even when only attaching to some of the namespaces.

Signed-off-by: Christian Seiler <christian@iwakd.de>
Acked-by: Serge Hallyn <serge.hallyn@canonical.com>
Cc: Daniel Lezcano <daniel.lezcano@free.fr>