apparmor: silence 'silent' mount denials

newer lxc uses 'silent' when remounting on shutdown.  Silence that denial too

Author: Jamie Strandboge <jamie@canonical.com>
Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
Acked-by: Stéphane Graber <stgraber@ubuntu.com>
add file/func/line to debug info

Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
Acked-by: Stéphane Graber <stgraber@ubuntu.com>
apparmor: restrict signal and ptrace for processes

Restrict signal and ptrace for processes running under the container
profile. Rules based on AppArmor base abstraction. Add unix rules for
processes running under the container profile.

Signed-off-by: Jamie Strandboge <jamie@canonical.com>
Acked-by: Serge Hallyn <serge.hallyn@ubuntu.com>
Acked-by: Stéphane Graber <stgraber@ubuntu.com>
tests: Fix unpriv test

Don't use $TUSER as it's not defined. Also don't include
lxc-test-usernic in extra_DIST.

Signed-off-by: Stéphane Graber <stgraber@ubuntu.com>
cgmanager: several fixes

These all fix various ways that cgroup actions could fail if an
unprivileged user's cgroup paths were not all the same for all
controllers.

1. in cgm_{g,s}et, use the right controller, not the first in the list,
   to get the cgroup path.

2. when we pass 'all' to cgmanager for a ${METHOD}_abs, make sure that all
   cgroup paths are the same.  That isn't necessary for methods not
   taking an absolute path, so split up the former
   cgm_supports_multiple_controllers() function into two booleans, one
   telling whether cgm supports it, and another telling us whether
   cgm supports it AND all controller cgroup paths are the same.

3. separately, do_cgm_enter with abs=true couldn't work if all
   cgroup paths were not the same.  So just ditch that helper and
   call lxc_cgmanager_enter() where needed, because the special
   cases would be more complicated.

Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
lxc: don't call pivot_root if / is on a ramfs

pivot_root can't be called if / is on a ramfs. Currently chroot is
called before pivot_root. In this case the standard well-known
'chroot escape' technique allows to escape a container.

I think the best way to handle this situation is to make following actions:
* clean all mounts, which should not be visible in CT
* move CT's rootfs into /
* make chroot into /

I don't have a host, where / is on a ramfs, so I can't test this patch.

Signed-off-by: Andrey Vagin <avagin@openvz.org>
Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
lxc-test-unpriv: don't clear out /etc/lxc/lxc-usernet

Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
lxc-test-unpriv: test for different cgroups per subsystem

Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
fix lxc.mount.auto clearing

the way config_mount was structured, sending 'lxc.mount.auto = '
ended up actually clearing all lxc.mount.entrys.  Fix that by
moving the check for an empty value to after the subkey checks.
Then, actually do the clearing of auto_mounts in config_mount_auto.

The 'strlen(subkey)' check being removed was bogus - the subkey
either known to be 'lxc.mount.entry', else subkey would have been
NULL (and forced a return in the block above).

This would have been clearer if the config_mount() and helper
fns were structured like the rest of confile.c.  It's tempting
to switch it over, but there are subtleties in there so it's
not something to do without a lot of thought and testing.

Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
conf.c: Define MS_PRIVATE for Android

Signed-off-by: Stéphane Graber <stgraber@ubuntu.com>
network: convert param ifname to const.

We should not modify ifname in lxc_netdev_move_by_name(),
making it as const in param list will make our code more
robust.

Signed-off-by: Dongsheng Yang <yangds.fnst@cn.fujitsu.com>
Acked-by: Serge E. Hallyn <serge.hallyn@ubuntu.com>
network: check result of if_nametoindex().

When we want to get index of a ifname which does not
exist, we should return a -EINVAL in this case.

Signed-off-by: Dongsheng Yang <yangds.fnst@cn.fujitsu.com>
Acked-by: Serge E. Hallyn <serge.hallyn@ubuntu.com>
lxc_start: ERROR if container is already running.

We should exit with a error when starting a running container.

Signed-off-by: Dongsheng Yang <yangds.fnst@cn.fujitsu.com>
Acked-by: Serge E. Hallyn <serge.hallyn@ubuntu.com>
network: allow lxc_network_move_by_index() rename netdev in moving.

In netlink, we can set the dest_name of netdev when move netdev
between namespaces in one netlink request. And moving a netdev of
a src_name to a netdev with a dest_name is a common usecase.

So this patch add a parametaer to lxc_network_move_by_index() to
indicate the dest_name for the movement. NULL means same with
the src_name.

Signed-off-by: Dongsheng Yang <yangds.fnst@cn.fujitsu.com>
Acked-by: Serge E. Hallyn <serge.hallyn@ubuntu.com>
network: introduce a interface named lxc_netdev_isup().

When we need to know some info about a netdev, such as is_up or not,
we need to read the flag for the netdev.

This patch introduce a interface function named lxc_netdev_isup()
to check is a netdev up or down.

And introduce a network private function named netdev_get_flag()
to get flag for netdev by netlink.

Changelog: 10/15/2015: Return failure if name==NULL to avoid later strlen fun

Signed-off-by: Dongsheng Yang <yangds.fnst@cn.fujitsu.com>
Acked-by: Serge E. Hallyn <serge.hallyn@ubuntu.com>
lxccontainer.c: rename enter_to_ns to enter_net_ns

because that's what it does

Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
Fix typo in lxc-gentoo template

Signed-off-by: Dark Templar <dark_templar@hotbox.ru>
Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
lxc_global_config_value can return the default lxc.cgroup.pattern whether root or non-root

>>> On Tue, 30 Sep 2014 19:48:09 +0000
    in message   "Re: [lxc-devel] [PATCH] lxc-config can show lxc.cgroup.(use|pattern)"
                  Serge Hallyn-san wrote:

> I think it would be worth also augmenting
> lxc_global_config_value() to return a default lxc.cgroup.use
> for 'all', and a default lxc.cgroup.pattern ("/lxc/%n" for root
> or "%n" for non-root).

lxc.cgroup.pattern is like this? (^_^;)

Signed-off-by: KATOH Yasufumi <karma@jazz.email.ne.jp>
Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
busybox template: support for unprivileged containers

Apply the changes found in templates/lxc-download to the busybox template as
well. Change ownership of the config and fstab files to the unprivileged user,
and the ownership of the rootfs to root in the new user namespace.

Eliminate the "unsupported for userns" flag.

Signed-off-by: Bogdan Purcareata <bogdan.purcareata@freescale.com>
Acked-by: Serge E. Hallyn <serge.hallyn@ubuntu.com>
busybox template: mount fstab when available

When running unprivileged, lxc-create will touch a fstab file, with bind-mounts
for the ttys and other devices. Add this entry in the container config.

Signed-off-by: Bogdan Purcareata <bogdan.purcareata@freescale.com>
Acked-by: Serge E. Hallyn <serge.hallyn@ubuntu.com>