lxc-test-unpriv: test for different cgroups per subsystem

Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
lxc-test-apparmor-mount: don't clear out /etc/lxc/lxc-usernet

Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
fix lxc.mount.auto clearing

the way config_mount was structured, sending 'lxc.mount.auto = '
ended up actually clearing all lxc.mount.entrys.  Fix that by
moving the check for an empty value to after the subkey checks.
Then, actually do the clearing of auto_mounts in config_mount_auto.

The 'strlen(subkey)' check being removed was bogus - the subkey
either known to be 'lxc.mount.entry', else subkey would have been
NULL (and forced a return in the block above).

This would have been clearer if the config_mount() and helper
fns were structured like the rest of confile.c.  It's tempting
to switch it over, but there are subtleties in there so it's
not something to do without a lot of thought and testing.

Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
conf.c: Define MS_PRIVATE for Android

Signed-off-by: Stéphane Graber <stgraber@ubuntu.com>
network: convert param ifname to const.

We should not modify ifname in lxc_netdev_move_by_name(),
making it as const in param list will make our code more
robust.

Signed-off-by: Dongsheng Yang <yangds.fnst@cn.fujitsu.com>
Acked-by: Serge E. Hallyn <serge.hallyn@ubuntu.com>
network: check result of if_nametoindex().

When we want to get index of a ifname which does not
exist, we should return a -EINVAL in this case.

Signed-off-by: Dongsheng Yang <yangds.fnst@cn.fujitsu.com>
Acked-by: Serge E. Hallyn <serge.hallyn@ubuntu.com>
lxc_start: ERROR if container is already running.

We should exit with a error when starting a running container.

Signed-off-by: Dongsheng Yang <yangds.fnst@cn.fujitsu.com>
Acked-by: Serge E. Hallyn <serge.hallyn@ubuntu.com>
network: allow lxc_network_move_by_index() rename netdev in moving.

In netlink, we can set the dest_name of netdev when move netdev
between namespaces in one netlink request. And moving a netdev of
a src_name to a netdev with a dest_name is a common usecase.

So this patch add a parametaer to lxc_network_move_by_index() to
indicate the dest_name for the movement. NULL means same with
the src_name.

Signed-off-by: Dongsheng Yang <yangds.fnst@cn.fujitsu.com>
Acked-by: Serge E. Hallyn <serge.hallyn@ubuntu.com>
network: introduce a interface named lxc_netdev_isup().

When we need to know some info about a netdev, such as is_up or not,
we need to read the flag for the netdev.

This patch introduce a interface function named lxc_netdev_isup()
to check is a netdev up or down.

And introduce a network private function named netdev_get_flag()
to get flag for netdev by netlink.

Changelog: 10/15/2015: Return failure if name==NULL to avoid later strlen fun

Signed-off-by: Dongsheng Yang <yangds.fnst@cn.fujitsu.com>
Acked-by: Serge E. Hallyn <serge.hallyn@ubuntu.com>
utils: move useful helper functions from lxccontainer to utils.

Function of enter_to_ns() is useful but currently is static for
lxccontainer.c.

This patch split it into two parts named as switch_to_newuser()
and switch_to_newnet() into utils.c.

Signed-off-by: Dongsheng Yang <yangds.fnst@cn.fujitsu.com>
Acked-by: Serge E. Hallyn <serge.hallyn@ubuntu.com>
container: introduce two functions named as {at/de}tach_interface().

Currently, we depends on ip command to attach interface to container.
It means we only implemented it by python.

This patch implement adding and removing interface by c and added
them in struct container.

Changelog: 10/15/2014 (serge): return error if ifname is NULL.

Signed-off-by: Dongsheng Yang <yangds.fnst@cn.fujitsu.com>
Acked-by: Serge E. Hallyn <serge.hallyn@ubuntu.com>
python-lxc: Add [at|de]tach_interface() to python binding.

Changelog: 10/15/2014: serge: make ifname mandatory for detach_interface.

Signed-off-by: Dongsheng Yang <yangds.fnst@cn.fujitsu.com>
Acked-by: Serge E. Hallyn <serge.hallyn@ubuntu.com>
lxc-device: rewrite lxc-device.

As there is a function named attach_interface to pass
a interface to container now, we do not need to relay on
python impolementation for lxc-device any more.

changelog: 10/15/2014: serge: fail immediately if run as non-root.
changelog: 10/15/2014: serge: add explicit error message on bad usage (fix build failure)

Signed-off-by: Dongsheng Yang <yangds.fnst@cn.fujitsu.com>
Acked-by: Serge E. Hallyn <serge.hallyn@ubuntu.com>
lxccontainer.c: rename enter_to_ns to enter_net_ns

because that's what it does

Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
netdev_move_by_index: support wlan

The python lxc-device supported adding wlan devices, so add that
support as well.  Since the python one did not support 'del',
I didn't try adding that support, though it should be trivial to
add.

We should be able to do the wlan adding using netlink, but I
went ahead and used 'iw' as the netlink path looked more
complicated than it does for other nics.  Patches to switch that
over would be very welcome.

Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
c/r: factor out network dump/restore code

Break the monolithic ->checkpoint and ->restore functions into smaller ones.
This is in preparation for the checkpoint/restore tty work, which has a similar
need to dump information outside of criu.

Signed-off-by: Tycho Andersen <tycho.andersen@canonical.com>
Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
c/r: refactor the way we pass data to criu/scripts

We previously wrote a bunch of files (eth*, veth*, and bridge*) as hard coded
files which we used as the names of interfaces to restore via criu's
--veth-pair. This meant that if people, e.g. gave a different bridge on their
new host, we would use our saved bridge in bridge* and try to restore to the
wrong bridge. Instead, we can just generate a new veth id (if the user hasn't
provided one), and use whatever the user configured values for the interface
name and bridge are.

This allows people to switch the bridge that they restore onto simply by
migrating the rootfs and config, and then changing the bridge name in the
container's configuration before running lxc-checkpoint.

Signed-off-by: Tycho Andersen <tycho.andersen@canonical.com>
Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
c/r: use sizeof instead of magic numbers

Signed-off-by: Tycho Andersen <tycho.andersen@canonical.com>
Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
fix typo (spurious ';')

Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
apparmor: check for mount feature at a better time

Check for it when we check for apparmor being enabled, rather
than doing it during the middle of a container setup.

This avoid the need to try mounting /sys and /sys/kernel/security
in the middle of startup, which we may not be allowed to anyway.

Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
Acked-by: Dwight Engen <dwight.engen@oracle.com>