lxc-destroy: add --lxc-path argument

Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
af_unix: make sure to keep useful errno

Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
userns: handle delayed write errors at fclose

As Kees pointed out, write() errors can be delayed and returned as
close() errors.  So don't ignore error on close when writing the
userns id mapping.

Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
c api -> createl: correctly handle 0 template args

Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
c api: send lxcpath to destroy command

Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
cgroup: improve support for multiple lxcpaths (v3)

Add a monitor command to get the cgroup for a running container.  This
allows container r1 started from /var/lib/lxc and container r1 started
from /home/ubuntu/lxcbase to pick unique cgroup directories (which
will be /sys/fs/cgroup/$subsys/lxc/r1 and .../r1-1), and all the lxc-*
tools to get that path over the monitor at lxcpath.

Rework the cgroup code.  Before, if /sys/fs/cgroup/$subsys/lxc/r1
already existed, it would be moved to 'deadXXXXX', and a new r1 created.
Instead, if r1 exists, use r1-1, r1-2, etc.

I ended up removing both the use of cgroup.clone_children and support
for ns cgroup.  Presumably we'll want to put support for ns cgroup
back in for older kernels.  Instead of guessing whether or not we
have clone_children support, just always explicitly do the only thing
that feature buys us - set cpuset.{cpus,mems} for newly created cgroups.

Note that upstream kernel is working toward strict hierarchical
limit enforcements, which will be good for us.

NOTE - I am changing the lxc_answer struct size.  This means that
upgrades to this version while containers are running will result
in lxc_* commands on pre-running containers will fail.

Changelog: (v3)
   implement cgroup attach
   fix a subtle bug arising when we lxc_get_cgpath() returned
     STOPPED rather than -1 (STOPPED is 0, and 0 meant success).
   Rename some functions and add detailed comments above most.
   Drop all my lxc_attach changes in favor of those by Christian
     Seiler (which are mostly the same, but improved).

Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
lxc-destroy man page: document --lxcpath option

Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
lxc-attach: Try really hard to determine login shell

If no command is specified, and using getpwuid() to determine the login
shell fails, try to spawn a process that executes the utility 'getent'.
getpwuid() may fail because of incompatibilities between the NSS
implementations on the host and in the container.

Signed-off-by: Christian Seiler <christian@iwakd.de>
lxc-attach: Default to /bin/sh if shell cannot be determined or exec'd

If getpwuid() fails and also the fallback of spawning of a 'getent'
process, and the user specified no command to execute, default to
/bin/sh and only fail if even that is not available. This should ensure
that unless the container is *really* weird, no matter what, the user
should always end up with a shell when calling lxc-attach with no
further arguments.

Signed-off-by: Christian Seiler <christian@iwakd.de>
lxc-attach: User namespaces: Use init's user & group id when attaching

When attaching to a container with a user namespace, try to detect the
user and group ids of init via /proc and attach as that same user. Only
if that is unsuccessful, fall back to (0, 0).

Signed-off-by: Christian Seiler <christian@iwakd.de>
attach: free result before potentially strduping a second time.

Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
attach: handle apparmor transitions in !NEWNS cases

If we're not attaching to the mount ns , then don't enter the
container's apparmor policy.  Since we're running binaries from the host
and not the container, that actually seems the sane thing to do (besides
also the lazier thing).

If we dont' do this patch, then we will need to move the apparmor attach
past the procfs remount, will need to also mount securityfs if available,
and for the !remount_proc_sys case we'll want to mount those just long
enough to do the apparmor transition.

Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
Acked-by: Stéphane Graber <stgraber@ubuntu.com>
include tests in make dist

This should eventually make the source releases available on sourceforge
also contain the tests.

Signed-off-by: Dwight Engen <dwight.engen@oracle.com>
Acked-by: Stéphane Graber <stgraber@ubuntu.com>
rootfs pin: fix two bugs

1. if there's no rootfs, return -2, not 0.
2. don't close pinfd unconditionally in do_start().

Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
Acked-by: David Ward <david.ward@ll.mit.edu>
python: Don't hardcode LXCPATH in python module

Signed-off-by: Stéphane Graber <stgraber@ubuntu.com>
Acked-by: Serge E. Hallyn <serge.hallyn@ubuntu.com>
API: export lxc_get_version()

Signed-off-by: Stéphane Graber <stgraber@ubuntu.com>
Acked-by: Serge E. Hallyn <serge.hallyn@ubuntu.com>
python: Add get_version to binding

Signed-off-by: Stéphane Graber <stgraber@ubuntu.com>
Acked-by: Serge E. Hallyn <serge.hallyn@ubuntu.com>
lxc-lenny: Remove deprecated template

Debian 5.0 Lenny turned out of support on the 6th of February 2012.

From now on, the only supported Debian template is lxc-debian.

Signed-off-by: Stéphane Graber <stgraber@ubuntu.com>
Acked-by: Serge E. Hallyn <serge.hallyn@ubuntu.com>
make [ug]id map ordering consistent with /proc/<nr>/[ug]id_map

The id ordering and case of u,g is also consistent with uidmapshift,
reducing confusion.

doc: Moved example to the the EXAMPLES section, and used values
corresponding to the defaults in the pending shadow-utils subuid patch.

Signed-off-by: Dwight Engen <dwight.engen@oracle.com>
Acked-by: Stéphane Graber <stgraber@ubuntu.com>
oracle template: fixes for older releases

This fixes some issues found by Oracle QA, including several cosmetic
errors seen during container bootup.

The rpm database needs moving on Debian hosts similar to on Ubuntu.

I took Serge's suggestions: Do the yum install in an unshared
mount namespace so the /proc mount done during OL4 install doesn't
pollute the host. No need to blacklist ipv6 modules.

Make the default release 6.3, unless the host is OL, then default
to the same version as the host (same as Ubuntu template does).

Signed-off-by: Dwight Engen <dwight.engen@oracle.com>
Acked-by: Serge E. Hallyn <serge.hallyn@ubuntu.com>