bdev: free after bdev_init

(Except in cases where we will immediately exit)

Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
introduce lxc.cap.keep

The lxc configuration file currently supports 'lxc.cap.drop', a list of
capabilities to be dropped (using the bounding set) from the container.
The problem with this is that over time new capabilities are added.  So
an older container configuration file may, over time, become insecure.

Walter has in the past suggested replacing lxc.cap.drop with
lxc.cap.preserve, which would have the inverse sense - any capabilities
in that set would be kept, any others would be dropped.

Realistically both have the same problem - the sendmail capabilities
bug proved that running code with unexpectedly dropped privilege can be
dangerous.  This patch gives the admin a choice:  You can use either
lxc.cap.keep or lxc.cap.drop, not both.

Both continue to be ignored if a user namespace is in use.

Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
fix typo

Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
clone: don't copy rdepends when not doing a snapshot clone

Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
lua: fix a bug in the parsing of /proc/mounts

Signed-off-by: Natanael Copa <ncopa@alpinelinux.org>
Acked-by: Dwight Engen <dwight.engen@oracle.com>
Acked-by: Stéphane Graber <stgraber@ubuntu.com>
lua: prepare for Lua 5.2

Adjust code for Lua 5.2 and keep compatibility with Lua 5.1.

Signed-off-by: Natanael Copa <ncopa@alpinelinux.org>
Acked-by: Dwight Engen <dwight.engen@oracle.com>
Acked-by: Stéphane Graber <stgraber@ubuntu.com>
configure/makefile: Allow specify Lua pkg-config file with --with-lua-pc

Enable support for both Lua 5.1 and 5.2 by letting user specify the Lua
pkg-config package name. By default it will use 'lua' and try figure
out which version it is.

Signed-off-by: Natanael Copa <ncopa@alpinelinux.org>
Acked-by: Stéphane Graber <stgraber@ubuntu.com>
lua: implement usleep in C module

So we avoid running os.execute

Signed-off-by: Natanael Copa <ncopa@alpinelinux.org>
Acked-by: Stéphane Graber <stgraber@ubuntu.com>
lua: implement dirname in C rather than depend on external executable

Instead of popen and run external executable dirname we implement a
dirname in C in the core module.

We also remove the unused basename function.

Signed-off-by: Natanael Copa <ncopa@alpinelinux.org>
Acked-by: Stéphane Graber <stgraber@ubuntu.com>
lua: fix stats gathering

- remove lxc subdir in cgroup paths (done in commit b98f7d6e)
- remove extraneous debug printfs
- remove extra call to stats_clear

Signed-off-by: Dwight Engen <dwight.engen@oracle.com>
Acked-by: Stéphane Graber <stgraber@ubuntu.com>
add AS_VAR_COPY for older autoconf versions

Signed-off-by: Dwight Engen <dwight.engen@oracle.com>
Acked-by: Stéphane Graber <stgraber@ubuntu.com>
sanity-check number of detected capabilities

Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
lua: fix logic to enable lua support in configure

When there is no --enable-lua or --with-lua-pc, Lua should not be
enabled.

This fixes a bug introduced with 12e93188 (configure/makefile:
Allow specify Lua pkg-config file with --with-lua-pc) that caused
configure script to fail if lua headers was missing.

Signed-off-by: Natanael Copa <ncopa@alpinelinux.org>
Acked-by: Stéphane Graber <stgraber@ubuntu.com>
lxc_spawn: don't close pinfd until container is stopped

Otherwise containers may be able to remount -o ro their rootfs
at shutdown.

Reported-by: Harald Dunkel <harri@afaics.de>
Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
Acked-by: Stéphane Graber <stgraber@ubuntu.com>
configure: enable Lua if found and continue without if not

Search for Lua if no --enable-lua/--disable-lua specified but continue
without if not found.

If --enable-lua is specified and Lua is not found then return error.

If --disable-lua is specified, then don't search for Lua.

Signed-off-by: Natanael Copa <ncopa@alpinelinux.org>
Acked-by: Stéphane Graber <stgraber@ubuntu.com>