lxc_clone.c: Allow size subfixes for -L parameter

lxc-clone ignores size subfixes (K, M, G) when using -L parameter. The
following is a quick patch to allow, for example, lxc-clone -L 10G.

Signed-off-by: Norberto Bensa <nbensa@gmail.com>
Acked-by: Serge E. Hallyn <serge.hallyn@ubuntu.com>
Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
create: add a quiet flag

If set, then fds 0,1,2 will be redirected while the creation
template is executed.

Note, as Dwight has pointed out, if fd 0 is redirected, then if
templates ask for input there will be a problem.  We could simply
not redirect fd 0, or we could require that templates work without
interaction.  I'm assuming here that we want to do the latter, but
I'm open to changing that.

Reported-by: "S.Çağlar Onur" <caglar@10ur.org>
Acked-by: Stéphane Graber <stgraber@ubuntu.com>
Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
remove old lxc-create script.

Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
ubuntu-cloud template: accept --rootfs argument

Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
lxc_create: prepend pretty header to config file (v2)

Define a sha1sum_file() function in utils.c.  Use that in lxcapi_create
to write out the sha1sum of the template being used.  If libgnutls is
not found, then the template sha1sum simply won't be printed into the
container config.

This patch also trivially fixes some cases where SYSERROR is used after
a fclose (masking errno) and missing consts in mkdir_p.

Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
userns: clear and save id_map (v2)

Otherwise (a) there is a memory leak when using user namespaces and
clearing a config, and (b) saving a container configuration file doesn't
maintain the userns mapping.  For instance, if container c1 has
lxc.id_map configuration entries, then

python3
import lxc
c=lxc.Container("c1")
c.save_config("/tmp/config1")

should show 'lxc.id_map =' entries in /tmp/config1.

Changelog for v2:
   1. fix incorrect saving of group types (s/'c'/'g')
   2. fix typo -> idmap->type should be idmap->idtype

Reported-by: Dwight Engen <dwight.engen@oracle.com>
Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
Acked-by: Dwight Engen <dwight.engen@oracle.com>
Tested-by: Dwight Engen <dwight.engen@oracle.com>
lxccontainer: don't define certain variables if !HAVE_GNUTLS

Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
Make get_ips timeout poll configurable

This commit increases the default timeout used by lxc-start-ephemeral
from 5 to 10, and adds support for an LXC_IP_TIMEOUT override.

Patchset 2:
  - Previous patch used a command line arg.

Signed-off-by: John McFarlane <john@rockfloat.com>
Acked-by: Stéphane Graber <stgraber@ubuntu.com>
clone: only update <rootfs>/etc/hostname if it exists

Signed-off-by: Dwight Engen <dwight.engen@oracle.com>
Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
ubuntu templates: add some kernel filesystems to container fstab

The debugfs, fusectl, and securityfs may not be mounted inside a
non-init userns.  But mountall hangs waiting for them to be
mounted.  So just pre-mount them using $lxcpath/$name/fstab as
bind mounts, which will prevent mountall from trying to mount
them.

If the kernel doesn't provide them, then the bind mount failure
will be ignored, and mountall in the container will proceed
without the mount since it is 'optional'.  But without these
bind mounts, starting a container inside a user namespace
hangs.

Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
Acked-by: Stéphane Graber <stgraber@ubuntu.com>
teach lxc-cirros about the --rootfs argument

Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
templates: require running as root

Up to now lxc-create ensured that you were running as root.  Now the
templates which require root need to do it for themselves.  Templates
which do mknod definately require root.

Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
Acked-by: Stéphane Graber <stgraber@ubuntu.com>
lxc-create: support unpriv users

Just make sure we are root if we are asked to deal with something other
than a directory, and make sure we have permission to create the
container in the given lxcpath.

The templates will need much more work.

Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
Acked-by: Stéphane Graber <stgraber@ubuntu.com>
ubuntu-cloud: changes to support unprivileged use

don't try to lock if using a specified tarball

The lock/subsys/lxc-ubuntu-cloud lock is to protect the tarballs
managed under /var/cache/lxc/cloud-$release.  Don't lock if we've
been handed a tarball.

fake device creation

Unprivileged users can't create devices, so bind mount null, tty, urandom
and console from the host.

Changelog:
	Jul 22: as Stéphane points out, remove a left-over debug line

Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
Acked-by: Stéphane Graber <stgraber@ubuntu.com>
send current cgroup to lxc_cgroup_create()

This is needed if we're going to have unprivileged users
create containers inside cgroups which they own.

Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
Acked-by: Stéphane Graber <stgraber@ubuntu.com>
A few changes for unprivileged lxc-start

When doing reboot test, must add clone_newuser to clone flags, else
we can't clone(CLONE_NEWPID).

If we don't have caps at lxc-start, don't refuse to start.  Drop the
lxc_caps_check() function altogether as it is unused now.

Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
Acked-by: Stéphane Graber <stgraber@ubuntu.com>
lxclock: use XDG_RUNTIME_DIR for lock if appropriate (v2)

If we are euid==0 or XDG_RUNTIME_DIR is not set, then use
/run/lock/lxc/$lxcpath/$lxcname as before.  Otherwise,
use $XDG_RUNTIME_DIR/lock/lxc/$lxcpath/$lxcname.

Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
Cc: Stéphane Graber <stephane.graber@canonical.com>
Acked-by: Stéphane Graber <stgraber@ubuntu.com>
define lxc-usernsexec

It uses the newuidmap and newgidmap program to start a shell in
a mapped user namespace.  While newuidmap and newgidmap are
setuid-root, lxc-usernsexec is not.

If new{ug}idmap are not available, then this program is not
built or installed.  Otherwise, it will be used to support creating,
starting, destroying, etc containers by unprivileged users using
their authorized subuids and subgids.

Example:
	usernsexec -m u:0:100000:1 -- /bin/bash

will, if the user is authorized to use subuid 100000, start a
bash shell in a user namespace where 100000 on the host is
mapped to root in the namespace, and the shell is running as
(privileged) root.

Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
Acked-by: Stéphane Graber <stgraber@ubuntu.com>
cgroup_enter: catch write errors

Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
Acked-by: Stéphane Graber <stgraber@ubuntu.com>
cgroups: fix the recently broken setting of clone_children

Several places think that the current cgroup will be NULL rather
than "/" when we're in the root cgroup.  Fix that.

Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>