update rpm .spec file

The following changes were made to fix rpmlint warnings/errors
- use %global instead of %define
  http://fedoraproject.org/wiki/PackagingDrafts/global_preferred_over_define
- change Summary to match .deb
- update License
- do not mention the libcap dependency explicitly, rpm will fill it in
- fix Summary, Description for libs and devel packages
- pass -q to %setup
- add %post for libs to run ldconfig
- explicitly name lxc man paths so pkg doesn't "own" /usr/share/man
- mark /etc/lxc/default.conf as a config file

In addition, while I was here:
- split lua bits into seperate lxc-lua package
- change Description to match .deb
- remove "Version" in changelog entries to follow
  http://fedoraproject.org/wiki/Packaging:Guidelines#Changelogs

Signed-off-by: Dwight Engen <dwight.engen@oracle.com>
Acked-by: Stéphane Graber <stgraber@ubuntu.com>
install lua module 0644 instead of 0755

Fixes rpmlint error "script-without-shebang". Checked other lua modules
and none are installed with execute permission.

Signed-off-by: Dwight Engen <dwight.engen@oracle.com>
Acked-by: Stéphane Graber <stgraber@ubuntu.com>
Pass through all options with -Bbest.

Remove the union in bdev_specs and store all options if -Bbest is passed. Fixes issue #31.

Signed-off-by: Sidnei da Silva <sidnei.da.silva@canonical.com>
Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
bdev.c: don't free right before exit

Also log execlp error code if it returns.

Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
Fix segfault on lxc-create when no template specified

When no template file is specified on lxc-create, recieve segfault.
So change not to append header in config when no template is specified.

Signed-off-by: KATOH Yasufumi <karma@jazz.email.ne.jp>
Acked-by: Stéphane Graber <stgraber@ubuntu.com>
template: Fix the container configuration issue in lxc-plamo

Signed-off-by: KATOH Yasufumi <karma@jazz.email.ne.jp>
Acked-by: Stéphane Graber <stgraber@ubuntu.com>
doc: Update Japanese lxc-create(1) for default thin pool name

Update for commit 055af165efb08f4dd54608896893bb6928fd472f

Signed-off-by: KATOH Yasufumi <karma@jazz.email.ne.jp>
Acked-by: Stéphane Graber <stgraber@ubuntu.com>
lxc-debian: Add hwaddr handling logic

Signed-off-by: Stéphane Graber <stgraber@ubuntu.com>
Acked-by: Serge E. Hallyn <serge.hallyn@ubuntu.com>
clang: Fix some simple issues

Signed-off-by: Stéphane Graber <stgraber@ubuntu.com>
oracle template: restrict writeability in /proc and /sys

Note that since we don't drop CAP_SYS_ADMIN, root in the container can
remount proc or sys however they want to, however this at least improves
the default situation.

Signed-off-by: Dwight Engen <dwight.engen@oracle.com>
Acked-by: Serge E. Hallyn <serge.hallyn@ubuntu.com>
apparmor: cache the are-we-enabled decision

Since we check /sys/kernel/security/ files when deciding whether
apparmor is enabled, and that might not be mounted in the container,
we cannot re-make the decision at apparmor_process_label_set() time.
Luckily we don't have to - just cache the decision made at
lsm_apparmor_drv_init().

Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
Acked-by: Stéphane Graber <stgraber@ubuntu.com>
Fix build failure on sparc

Signed-off-by: Thomas Nemeth <thomas.nemeth@laposte.net>
Acked-by: Stéphane Graber <stgraber@ubuntu.com>
clang: Remaining changes

Those are a bit less obvious than those I pushed directly to master.
All those changes were required to build LXC under clang here.

With this, gcc can be replaced by clang to build LXC so long as you're
not using the python3 binding (as python extensions can't be built under
clang at the moment).

For reference, the clang output for those is: http://paste.ubuntu.com/6292460/

Signed-off-by: Stéphane Graber <stgraber@ubuntu.com>
Acked-by: Serge E. Hallyn <serge.hallyn@ubuntu.com>
strtoul: check errno

In a few places we checked for LONG_MIN or LONG_MAX as indication
that strtoul failed.  That's not reliable.  As suggested in the
manpage, switch to checking errno value.

Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
container creation: support unpriv container creation in user namespaces

1. lxcapi_create: don't try to unshare and mount for dir backed containers

It's unnecessary, and breaks unprivileged lxc-create (since unpriv users
cannot yet unshare(CLONE_NEWNS)).

2. api_create: chown rootfs

chown rootfs to the host uid to which container root will be mapped

3. create: run template in a mapped user ns

4. use (setuid-root) newxidmap to set id_map if we are not root

This is needed to be able to set userns mappings as an unprivileged
user, for unprivileged lxc-start.

Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
Acked-by: Stéphane Graber <stgraber@ubuntu.com>
fix chowning of tty and console uids

It needs to be done from the handler, not the container, since
the container may not have the rights.

Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
Acked-by: Stéphane Graber <stgraber@ubuntu.com>

Changelog:
    Jul 22: remove hardcoded path for /bin/chown
    Jul 22: use new lxc-usernsexec

Conflicts:
	src/lxc/lxccontainer.c
lxc-busybox: if in userns, don't try to mknod

Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
Acked-by: Stéphane Graber <stgraber@ubuntu.com>
start: use lxc-user-nic if we are not root

Note this results in nics named things like 'lxcuser-0p'.  We'll
likely want to pass the requested name to lxc-user-nic, but let's
do that in a separate patch.

If we're not root, we can't create new network itnerfaces to pass
into the container.  Instead wait until the container is started,
and call lxc-user-nic to create and assign the nics.

Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
Acked-by: Stéphane Graber <stgraber@ubuntu.com>
lxc-ls: Rewrite nesting code to use the attach API

Signed-off-by: Stéphane Graber <stgraber@ubuntu.com>
Acked-by: Serge E. Hallyn <serge.hallyn@ubuntu.com>
cgroup: set memory.use_hierarchy

But don't fail the container start if that fails.

Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
Acked-by: Stéphane Graber <stgraber@ubuntu.com>