do_rootfs_setup: fix return bugs

Fix return value on bind mount failure.

If we've already mounted the rootfs, exit after the bind mount
rather than re-trying the rootfs mount.  The only case where
this happens is when root is starting a container in a user
namespace and with a block device backing store.

In that case, pre-mount hooks will be executed in the initial
user namespace.  That may be worth fixing.  Or it may be what
we want.  We should think about it and fix it.

Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
Make legacy lxc-ls more robust

Behave well when /etc/lxc/${name} is a symlink to directory

Signed-off-by: Dark Templar <dark_templar@hotbox.ru>
Acked-by: Serge E. Hallyn <serge.hallyn@ubuntu.com>
c/r: put lxc-restore-net in /usr/share

On restore, we pass criu a script to manage the network interfaces (i.e. the
full path to lxc-restore-net), which we previously installed into
/var/lib/<tuple>/lxc. However, this is also the directory that is the default
for use in mounting the rootfs locally before pivot_root()ing. So, we mounted
the rootfs and then happliy called criu, pointing it to this directory which
didn't have lxc-restore-net any more, it just had the container's rootfs.
Instead, we should put lxc-restore-net somewhere else, so that criu can still
see it after the rootfs is mounted.

Signed-off-by: Tycho Andersen <tycho.andersen@canonical.com>
Acked-by: Serge E. Hallyn <serge.hallyn@ubuntu.com>
lxc-start: don't re-try to mount rootfs if we already did so

If we are root using a user namespace and are mounting a blockdev as rootfs,
then we do this before unsharing the userns, because we are not allowed to
do it in a userns.  But after unsharing the userns, we unconditionally
retried mounting the rootfs, resulting in failure.  stop that.

Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
Acked-by: Stéphane Graber <stgraber@ubuntu.com>
lxc_global_config_value: simplify the theme

Rather than try to free all the not-being-returned items at
each if clause where we assign one to return value, just NULL
the one we are returning so we can safely free all the
values.  This should fix the newly reported coverity memory
leak

Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
Acked-by: Stéphane Graber <stgraber@ubuntu.com>
attach: don't use confstr(_CS_PATH)

It is not system-definable, rather glibc sets that to bin:/usr/bin, which is
simply too restrictive.  So just always set our preferred path.

This was reported at:
https://bugs.launchpad.net/ubuntu/+source/lxc/+bug/1384327

Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
Acked-by: Stéphane Graber <stgraber@ubuntu.com>
overlay and aufs clone_paths: be more robust

Currently when we clone a container, bdev_copy passes NULL as dst argument
of bdev_init, then sees bdev->dest (as a result) is NULL, and sets
bdev->dest to $lxcpath/$name/rootfs.  so $ops->clone_paths() can
assume that "/rootfs" is at the end of the path.  The overlayfs and
aufs clonepaths do assume that and index to endofstring-6 and append
delta0.  Let's be more robust by actually finding the last / in
the path.

Then, instead of always setting oldbdev->dest to $lxcpath/$name/rootfs,
set it to oldbdev->src.  Else dir_clonepaths fails when mounting src
onto dest bc dest does not exist.  We could also fix that by creating
bdev->dest if needed, but that addes an empty directory to the old
container.

This fixes 'lxc-clone -o x1 -n x2' if x1 has lxc.rootfs = /var/lib/lxc/x1/x
and makes the overlayfs and aufs paths less fragile should something else
change.

Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
Acked-by: Stéphane Graber <stgraber@ubuntu.com>
Create the apt proxy in the cache instead of the 1st container

This addresses https://github.com/lxc/lxc/issues/280.

Signed-off-by: Simon Deziel <simon@sdeziel.info>
Acked-by: Stéphane Graber <stgraber@ubuntu.com>
Fixed mismatch on ipvX gateway

Signed-off-by: Sergio Jimenez <tripledes@gmail.com>
Acked-by: Stéphane Graber <stgraber@ubuntu.com>
attach: don't ignore sigint/sigkill if stdin is redirected

If attach is being done over passed-in fds, then we shouldn't
mess with the caller's signal table to ignore ctrl-c over the
fd.

Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
Acked-by: Stéphane Graber <stgraber@ubuntu.com>
overlayfs: overlayfs.v22 or higher needs workdir option

This patch creates workdir as "olwork", and retry mount with workdir
option when mount is failed.
It is used to prepare files before atomically swithing with
destination, and needs to be on the same filesystem as upperdir. It's
OK for it to be empty.

Signed-off-by: KATOH Yasufumi <karma@jazz.email.ne.jp>
Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
cgmanager: fix 'attach' with "all" controller support

"all" is not a supported keyword for cgmanager's get_pid_cgroup.
Pass the first mounted cgroup subsystem instead of passing "all" when
getting the container's cgorup to attach to.

Also, make sure that the target cgroup is in fact in all identical
cgroups before attaching with 'all".  If not, then we must attach to
each cgroup separately, or else we will not be in all the same cgroups
as the target container.

Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
Acked-by: Stéphane Graber <stgraber@ubuntu.com>
Fix clone issues

This commit fixes two issues at the time of clone:
* unnecessary directory is created when clone between overlayfs/aufs
* clone failed when the end of rootfs path is not "/rootfs"

Signed-off-by: KATOH Yasufumi <karma@jazz.email.ne.jp>
Acked-by: Serge E. Hallyn <serge.hallyn@ubuntu.com>
lxc-debian: Fix default mirrors

Fix a typo in the lines inserted in the default sources.list.
Change the default mirror to http.debian.net which is (supposedly) more
accurate and better than cdn.debian.net for a generic configuration.
Use security.debian.org directly for the {release}/updates repository.

Signed-off-by: Gu1 <gu1@aeroxteam.fr>
Acked-by: Stéphane Graber <stgraber@ubuntu.com>
added container:attach() into the Lua API
Update core.c

fixed indent and vars
lxc/utils: improve choose_init code readability

Signed-off-by: Silvio Fricke <silvio.fricke@gmail.com>
Merge pull request #353 from ashtoreth/master

added container:attach() into the Lua API
Merge pull request #356 from silvio/sfr/utils-choose-init

lxc/utils: improve choose_init code readability
lxc/utils: bugfix freed pointer return value

We allocate a pointer and save this address in a static variable. After
this we freed this pointer and return.

Here a cuttout of a valgrind report:

	[...]
	==11568== Invalid read of size 1
	==11568==    at 0x4C2D524: strlen (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
	==11568==    by 0x5961C9B: puts (in /usr/lib/libc-2.20.so)
	==11568==    by 0x400890: main (lxc_config.c:73)
	==11568==  Address 0x6933e21 is 1 bytes inside a block of size 32 free'd
	==11568==    at 0x4C2B200: free (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
	==11568==    by 0x4E654F2: lxc_global_config_value (utils.c:415)
	==11568==    by 0x4E92177: lxc_get_global_config_item (lxccontainer.c:2287)
	==11568==    by 0x400883: main (lxc_config.c:71)
	[...]

Signed-off-by: Silvio Fricke <silvio.fricke@gmail.com>