check whether rootfs is shared before running pre-mount hooks

this expands c597baa8f9 and 2c6f3fc932.

Also move the block using detect_ramfs_rootfs() from setup_rootfs() to
lxc_setup()

Signed-off-by: Florian Klink <flokli@flokli.de>
Acked-by: Serge E. Hallyn <serge.hallyn@ubuntu.com>
move lxc-init to /sbin/init.lxc

Using the multiarch dir causes problems when running lxc-execute
on amd64 with an i386 container.  /sbin/lxc-init is a more confusing
name and will show up in 'lxc<tab>'.  /sbin/init.lxc should be quite
obvious as an init for lxc.

Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
Acked-by: Stéphane Graber <stgraber@ubuntu.com>
config_network_type: set macvlan default mode to private

If a default mode is not set, the container requires an explicit
mode specified in the config file, otherwise creating the
container fails.

Signed-off-by: Bogdan Purcareata <bogdan.purcareata@freescale.com>
Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
add yum plugin to repatch rootfs on yum update

oracle-template: Split patching rootfs vs one time setup into separate
shell functions so the template can be run with --patch.

oracle-template: Update to install the yum plugin and itself (as lxc-patch)
into a container. The plugin just runs lxc-patch --patch <path> so it is
fairly generic, but in this case it is running a copy of the template inside
the container.

Signed-off-by: Dwight Engen <dwight.engen@oracle.com>
Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
lxc.spec: adjust for move of libexecdir/lxc-init to sbin/lxc.init

Signed-off-by: Dwight Engen <dwight.engen@oracle.com>
Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
Use on_path to find init.lxc

Signed-off-by: Stéphane Graber <stgraber@ubuntu.com>
Acked-by: Serge E. Hallyn <serge.hallyn@ubuntu.com>
tests: Also propagate the https proxy

Signed-off-by: Stéphane Graber <stgraber@ubuntu.com>
Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
download: Set a 30s timeout for wget request

Signed-off-by: Stéphane Graber <stgraber@ubuntu.com>
Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
apparmor: don't allow mounting cgroupfs by default

Leave the line to do it (commented out) as some users may not be
using cgmanager, and may in fact still need those mounts.

Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
Acked-by: Stéphane Graber <stgraber@ubuntu.com>
apparmor: auto-generate the blacklist rules

This uses the generate-apparmor-rules.py script I sent out some time
ago to auto-generate apparmor rules based on a higher level set of
block/allow rules.

Add apparmor policy testcase to make sure that some of the paths we
expect to be denied (and allowed) write access to are in fact in
effect in the final policy.

With this policy, libvirt in a container is able to start its
default network, which previously it could not.

v2: address feedback from stgraber
	  put lxc-generate-aa-rules.py into EXTRA_DIST
	  add lxc-test-apparmor, container-base and container-rules to .gitignore
	  take lxc-test-apparmor out of EXTRA_DIST
	  make lxc-generate-aa-rules.py pep8-compliant
	  don't automatically generate apparmor rules
	  This is only bc we can't be guaranteed that python3 will be
	  available.

Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
Acked-by: Stéphane Graber <stgraber@ubuntu.com>
fix lxc-console not working by default

fix lxc-console not working by default

Signed-off-by: Guillaume ZITTA <lxc@zitta.fr>
Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>