always check whether rootfs is shared

(this expands on Dwight's recent patch, commit c597baa8f9)

After unshare(CLONE_NEWNS) and before doing any mounting, always
check whether rootfs is shared.  Otherwise template runs or clone
scripts can bleed mount activity to the host.

Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
Acked-by: Dwight Engen <dwight.engen@oracle.com>
Acked-by: Stéphane Graber <stgraber@ubuntu.com>
attach: Defined MS_REC and MS_SLAVE if not set

Signed-off-by: Stéphane Graber <stgraber@ubuntu.com>
python3: Add support for wlan device add

With this change it's now possible to add wlan devices to the container.
This will track down the right phy device, move it to the right
namespace (we don't care about its name), then if the user asked for a
new device name for the actual interface, we attach to the container and
rename the interface in there using attach.

I have tested this to work with both Intel and Atheros NICs.

This patch is based on the one provided to lxc-devel by Gregor Beck and
has then been updated to do the device renaming as well as minor code
style changes. Thanks!

Reported-by: Gregor Beck <gbeck@sernet.de>
Signed-off-by: Stéphane Graber <stgraber@ubuntu.com>
Acked-by: Serge E. Hallyn <serge.hallyn@ubuntu.com>
confile: Don't crash on invalid id_map

Signed-off-by: Stéphane Graber <stgraber@ubuntu.com>
Acked-by: Serge E. Hallyn <serge.hallyn@ubuntu.com>
upstart: Don't forward requests for LXC_DOMAIN

Without this change, a request to *.LXC_DOMAIN that doesn't get a local
result from dnsmasq will be forwarded to its upstream server with the
potential of a loop.

Thanks to Ed for the patch on Launchpad (LP: #1246094).

Reported-by: Ed Swierk
Signed-off-by: Stéphane Graber <stgraber@ubuntu.com>
lxc-download: Detect unpriv created by real root

This adds yet another case in the in_userns function detecting the case
where an unprivileged container is created by the real uid 0, in which
case we want to share the system wide cache but still use the
unprivileged templates and unpack method.

Signed-off-by: Stéphane Graber <stgraber@ubuntu.com>
Acked-by: Serge E. Hallyn <serge.hallyn@ubuntu.com>
fix attach when cgroups mounted after container start

When booting an OL7 container on OL6, systemd in the OL7 container mounted
some extra cgroup controllers, which are then present in /proc/self/cgroups
of every task on the host. This is the list used by attach to determine
which cgroups to move the attached task into, but when it asks the container
over the command interface for the path to the subsystem this will fail
since the controller didn't exist when the container was first started.

Instead of failing, this change allows the attach to continue, warning that
those cgroups that could not be found won't be attached to.

The problem can be more simply reproduced by starting a busybox container,
mounting a cgroup that was not previously mounted, and then attempting
to attach to to the busybox container.

The problem will likely not manifest with cgmanager since it only requests
the path for the first controller, which is likely to always be mounted.

Signed-off-by: Dwight Engen <dwight.engen@oracle.com>
Acked-by: Serge E. Hallyn <serge.hallyn@ubuntu.com>