findmnt: make --target usable with bind mounts

The --target <non-mount-point> functionality should be enabled only if
previous regular search found nothing to avoid collisions with bind
mounts, because to detect mountpoint we use traditional child / parent
stat.st_dev comparison which does not work for bind mounts (--bind /A
/A).

Signed-off-by: Karel Zak <kzak@redhat.com>
kill: add note about threads to the man page

Addresses: http://bugzilla.redhat.com/show_bug.cgi?id=846790
Signed-off-by: Karel Zak <kzak@redhat.com>
libmount: allow to use propagation flags in fstab

Linux kernel does not allow to change more than one propagation flag
by one mount(2) syscall. The flags also cannot be mixed with another
mount options. It means that the propagation flags cannot be stored in
/etc/fstab, manual "mount --make-* <mountpoint>" is always necessary
after successful mount. Painful...

This patch implements additional mount(2) after previous successful
mount(2) (or exec /sbin/mount.<type>).

For example:

  mount /dev/sda1 /A -o private,unbindable,ro

or fstab entry:

  /dev/sda1   /A  auto  ro,private,unbindable

is implemented by three mount(2) calls:

	- 1st mounts /dev/sda1 with MS_RDONLY
	- 2nd sets MS_PRIVATE flag
        - 3rd sets MS_UNBINDABLE flag.

It's the same as as to manually call:

  mount /dev/sda1 /A -o ro
  mount --make-private /A
  mount --make-unbindable /A

This solution is not atomic, and umount(2) is not called if
propagation flags are not successfully applied, only error is
returned.

This change does not affect libmount API, so one beautiful day when
mount(2) syscall will be improved we can drop this nasty patch.

Signed-off-by: Karel Zak <kzak@redhat.com>
mount: support multiple MS_PROPAGATION flags in one mount(8) exec

Signed-off-by: Karel Zak <kzak@redhat.com>
tests: add/improve mount shared-subtree tests

Signed-off-by: Karel Zak <kzak@redhat.com>
mount: write success messages to stdout

Signed-off-by: Karel Zak <kzak@redhat.com>
libmount: keep MS_PROPAGATION flags in mnt_context_set_mflags() result

Signed-off-by: Karel Zak <kzak@redhat.com>
mount: make --verbose more verbose about propagation

Signed-off-by: Karel Zak <kzak@redhat.com>
findmnt: use tree output in more cases

It seems that we can create the tree also if output is restricted by
fstype or options filter, for example

	$ findmnt -t cgroups

Signed-off-by: Karel Zak <kzak@redhat.com>
Revert "unshare: support the switching of namespaces"

The functionality will be replaced with nsenter from Eric W.
Biederman.

This reverts commit 4bbe8099390d528018890efa914e268de3c4b44b.
nsenter: new command (light wrapper around setns)

Inspired by unshare, nsenter is a simple wrapper around setns that
allows running a new process in the context of an existing process.

Full paths may be specified to the namespace arguments so that
namespace file descriptors may be used wherever they reside in the
filesystem.

Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
unshare: Add support for the pid and user namespaces

- Update the unshare application to support the pid and user namespaces.
- Update the man page for the new options
- Fix typo in the man page where UTS was spelled UTC.
- Remove the vestigal support for running a suid unshare.
  After unsharing a user namespace setuid(getuid()) won't work because
  no uid or gid mappings have been specified yet. So it is just easier not
  to have any support for running suid.

Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
nsenter: Enhance waiting for a child process

In the case of a pid namespace we need to fork a child process instead
of calling exec.  Move all of that logic out of line into a function
continue_as_child, making the logic of the primary case easier to
understand.

Update the logic for waiting for a child process to suspend ourselves
when the child processes suspends and to continue the child process
when we are unsuspsended.  This supports the bash suspend command and
various editors that suspend themselves.

If the child process exits with a signal update the logic to run
kill(getpid(), WTERMSIG(status)) so the caller sees the same exit code
that nsenter observed.

There will always be permission to send signals to our children and
the tty is not changing so there is no need for the intermediate
process to forward signals to it's child.

Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
nsenter: Properly spell significant in a comment.

Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
nsenter: Add const to declarations where possible.

Make it clear where functions do not modify their arguments.

Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
nsenter: Replace a bare strtoul with strtoul_or_err

This is shorter code and makes things a bit clearer and less
error prone if anyone happens to copy the code.

Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
unshare,nsenter: Move the old libc handling into a common header namespace.h

Move the defitions of CLONE_NEWNS, CLONE_NEWUTS, CLONE_NEWIPC,
CLONE_NEWNET, CLONE_NEWUSER, CLONE_NEWPID into namespace.h in case
sched.h does not provide those definitions.  Are there systems
around that are old enough that still need this?

Move the definitions of unshare() and setns() into namespace.h
for supporting old versions of libc that does not provice these.
I have tested this support with setns as I still have systems
old enough that glibc does not wrap setns.

Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
nsenter: improve optional args in usage() and man page

Signed-off-by: Karel Zak <kzak@redhat.com>
cal: don't mix ncurses output functions and printf()

Fedora 18 (ncurses-libs-5.9-7.20121017, glibc-2.16-28):

$ cal | cat
Actual results:
    January 2013    Su Mo Tu We Th Fr Sa       1  2  3  4  5 6  7  8
9 10 11 1213 14 15 16 17 18 1920 21 22 23 24 25 2627 28 29 30 31

Not sure where is the problem, but it's too fragile to mix two
output methods in one code.

Addresses: https://bugzilla.redhat.com/show_bug.cgi?id=896447
Signed-off-by: Karel Zak <kzak@redhat.com>
ipcmk: use random_get_bytes() to generate IPC keys

Signed-off-by: Karel Zak <kzak@redhat.com>