support a custom CentOS repository

This change introduces a flag --repo to the lxc-centos template
to allow using a local repository (e.g. a loop mounted installer
iso on your web server).

Signed-off-by: Harald Dunkel <harri@afaics.de>
Acked-by: Michael H. Warfield <mhw@WittsEnd.com>
Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
templates: Refuse to run unprivileged

Only the download and ubuntu-cloud templates work with unprivileged
containers, for all others, detect --mapped-uid and error out as early
as possible, recommending the use of the download template.

Signed-off-by: Stéphane Graber <stgraber@ubuntu.com>
Acked-by: Serge Hallyn <serge.hallyn@ubuntu.com>
create: pass --mapped-gid to templates next to --mapped-uid

That way templates can fix group ownership alongside uid ownership.

Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
Acked-by: Stéphane Graber <stgraber@ubuntu.com>
logging: Add lxc_log_options_no_override function

In current LXC, loglevel and logfile are write-once functions.
That behaviour was appropriate when those two were first introduced
(pre-API) but with current API, one would expect to be able to
set_config_item those multiple times.

So instead, introduce lxc_log_options_no_override which when called
turns those two config keys read-only and have all existing binaries
which use log_init call that function once they're done setting the
value requested by the user.

Signed-off-by: Stéphane Graber <stgraber@ubuntu.com>
Acked-by: Serge E. Hallyn <serge.hallyn@ubuntu.com>
gentoo: fix portage rw problem

Signed-off-by: Guillaume Zitta <github.guillaume@zitta.fr>
Acked-by: Stéphane Graber <stgraber@ubuntu.com>
cgmanager: update location of include file

Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
fix build with cgmanager on Fedora

- configure fails to compile the cgmanager test without -lnih -lnih-dbus

- fix include path from cgmanger commit f1d9bd1a

Signed-off-by: Dwight Engen <dwight.engen@oracle.com>
Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
log: Set log_define properly

This sets lxc_log_define to what should be appropriate values for all
existing binaries that call lxc_log_init.

The name is lxc_<bin name>_ui for anything that's user visible and
lxc_<bin name> for anything that's not.

The parent is set to "lxc" for anything using the API and to the
matching C file name for anything that isn't.

Signed-off-by: Stéphane Graber <stgraber@ubuntu.com>
Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
python3: Fix trivial error in clone()

Signed-off-by: Stéphane Graber <stgraber@ubuntu.com>
lxc.id_map bug when writing directly to /proc/pid/[ug]id_map [PATCH]

lxc.id_map bug when writing directly to /proc/pid/[ug]id_map

There's some code in src/lxc/conf.c that sets up the UID/GID mapping. It
can use the external newuidmap/newgidmap tools, or it can write to
/proc/pid/[ug]id_map directly. The latter case is broken: lines are written
without a newline (\n) at the end. This patch fixes that. Note that
I did not check if the newuidmap/newgidmap case still works. It should,
but I wasn't able to test it.

Signed-off-by: Miquel van Smoorenburg <mikevs@xs4all.net>
Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
Update license of lsm/selinux.c

Change the license from GPL to LGPL to avoid a tricky license situation
for liblxc.so.

Signed-off-by: Jonas Eriksson <jonas.eriksson@enea.com>
Signed-off-by: Dwight Engen <dwight.engen@oracle.com>
Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
templates: improve refusing to run unprivileged

For all templates except lxc-ubuntu-cloud and lxc-download, detect not
only --mapped-uid but also --mapped-gid and error out.  Detecting will
not be done after -- parameter because of non-option parameters.

Also, change the mode of lxc-archlinux.in 100755 to 100644.

Signed-off-by: TAMUKI Shoichi <tamuki@linet.gr.jp>
Acked-by: Stéphane Graber <stgraber@ubuntu.com>
doc: Add the common options section to lxc-create(1)

Signed-off-by: KATOH Yasufumi <karma@jazz.email.ne.jp>
Acked-by: Stéphane Graber <stgraber@ubuntu.com>
move cgroup.c to cgfs.c in preparation for backend change

This is just a move without any changes so history will be preserved.
Makefile.am was modified so that lxc will still build and run.

Signed-off-by: Dwight Engen <dwight.engen@oracle.com>
Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
split cgroup handling into discrete backends

- refactor cgroup into two backends, the classic cgfs driver and the new
  cgmanager. Instead of lxc_handler knowing about the internals of each,
  have it just store an opaque pointer to a struct that is private to
  each backend.

- rename a couple of cgroup functions for consistency: those that are
  considered an API (ie. exported by lxc.h) begin with lxc_ and those that
  are not are just cgroup_*

- made as many backend routines static as possible, only cg*_ops_init is
  exported

- made a nrtasks op which is needed by the utmp code for monitoring
  container shutdown, currently only implemented for the cgfs backend

Signed-off-by: Dwight Engen <dwight.engen@oracle.com>
Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
download: Force hkp on port 80 (for http proxies)

Signed-off-by: Stéphane Graber <stgraber@ubuntu.com>
Add missing include of signal.h

Signed-off-by: Stéphane Graber <stgraber@ubuntu.com>
implement cgmanager nrtasks

This op will be used on older kernels where container shutdown via reboot(2)
is not implemented and we use the utmp watching code.

Signed-off-by: Dwight Engen <dwight.engen@oracle.com>
Acked-by: Serge E. Hallyn <serge.hallyn@ubuntu.com>
download: Fix previous change

The previous change to support http proxies only worked when http_proxy
was set... Instead add some detection code and only use :80 when using
http_proxy.

That's a bit of a workaround, but it's the only way I could find to get
GPG to work with http_proxy.

Signed-off-by: Stéphane Graber <stgraber@ubuntu.com>
templates: Make sure usual locations are in PATH

Signed-off-by: Stéphane Graber <stgraber@ubuntu.com>
Acked-by: Serge E. Hallyn <serge.hallyn@ubuntu.com>