lxc-download: Detect unpriv created by real root

This adds yet another case in the in_userns function detecting the case
where an unprivileged container is created by the real uid 0, in which
case we want to share the system wide cache but still use the
unprivileged templates and unpack method.

Signed-off-by: Stéphane Graber <stgraber@ubuntu.com>
Acked-by: Serge E. Hallyn <serge.hallyn@ubuntu.com>
fix attach when cgroups mounted after container start

When booting an OL7 container on OL6, systemd in the OL7 container mounted
some extra cgroup controllers, which are then present in /proc/self/cgroups
of every task on the host. This is the list used by attach to determine
which cgroups to move the attached task into, but when it asks the container
over the command interface for the path to the subsystem this will fail
since the controller didn't exist when the container was first started.

Instead of failing, this change allows the attach to continue, warning that
those cgroups that could not be found won't be attached to.

The problem can be more simply reproduced by starting a busybox container,
mounting a cgroup that was not previously mounted, and then attempting
to attach to to the busybox container.

The problem will likely not manifest with cgmanager since it only requests
the path for the first controller, which is likely to always be mounted.

Signed-off-by: Dwight Engen <dwight.engen@oracle.com>
Acked-by: Serge E. Hallyn <serge.hallyn@ubuntu.com>
Fix unprivileged containers started by root

This change makes it possible to create unprivileged containers as root.
They will be stored in the usual system wide location, use the usual
system wide cache but will be running using a uid/gid map.

To make things consistent as well as avoid potential range conflicts,
I'm removing the code that was directly writing the uid/gid ranges and
instead force all unprivileged containers through newuidmap/newgidmap.
This means you need to grant uid/gid ranges to root just as you would
for a normal user.

bdev and network restrictions however don't apply to those containers,
so you don't need to add lxc-usernic entries for root.

This essentially requires anyone wanting to run unprivileged containers
to have newuidmap and newgidmap on their system, those two are provided
by a very recent version of shadow.

Signed-off-by: Stéphane Graber <stgraber@ubuntu.com>
fix realloc() error on reboot container

lxc-1.0.0

The container with "lxc.network.type=phys" halted with error on reboot.

Error message:
*** glibc detected *** lxc-start: realloc(): invalid pointer: 0x0948eed0 ***

We have a sequence:

1) conf->saved_nic = relloc(NULL) on start start.c:container save_phys_nics()
2) free(conf->saved_nics) after stop container conf.c:lxc_rename_phys_nics_on_shutdown()
3) conf->saved_nic = relloc(conf->saved_nics) on restart container start.c:save_phys_nics() -> error relloc()

free(conf->saved_nics) in lxc_rename_phys_nics_on_shutdown() unnecessary, it will be called later in lxc_clear_saved_nics().

Signed-off-by: Vitaly Lavrov <vel21ripn@gmail.com>
--
  src/lxc/conf.c | 4 +---
  1 file changed, 1 insertions(+), 3 deletion(-)
setup_rootfs: always mount / slave

When the host root is rshared, this appears to fix both the extra mounts
in the container's /proc/self/mounts, and the lxc-attach ending up in
the host rootfs.

chroot_into_slave is careful to turn mounts into slave mounts
as quickly as possible, but for reasons I haven't wrapped my
head around, not quickly enough.  Mounting / ms_slave first
appears to do the trick.

It's possible that in cases (like android) where / is a chroot
and not a bind mount, this will fail, in which case we'll need
to first do a bind mount of / onto itself.  Let's not do that
until we're sure we need it.

Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>