oracle template: fix selinux context on symlinks in /dev

This fixes sshd getting an avc on traversing the /dev/ptmx symlink
(was default_t)

Signed-off-by: Dwight Engen <dwight.engen@oracle.com>
Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
fix busybox template for use with AppArmor

Ensure /proc and /sys are mounted in the container, otherwise
apparmor_enabled() will fail to find
/sys/module/apparmor/parameters/enabled

Signed-off-by: Dwight Engen <dwight.engen@oracle.com>
Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
add lsm op for checking if an lsm is present/enabled

Signed-off-by: Dwight Engen <dwight.engen@oracle.com>
Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
lxc-attach: fixed typo: privleges -> privileges

Signed-off-by: Dmitry Yu Okunev <dyokunev@ut.mephi.ru>
Acked-by: Stéphane Graber <stgraber@ubuntu.com>
lxc-debian: Force locales generation

Signed-off-by: Laurent Vallar <val@zbla.net>
Acked-by: Stéphane Graber <stgraber@ubuntu.com>
lxc-debian: Remove perl, use sed instead

Signed-off-by: Laurent Vallar <val@zbla.net>
Acked-by: Stéphane Graber <stgraber@ubuntu.com>
Change configure, replacing mandriva by openmandriva

The latest Mandriva distro release was in 2011 and nowadays distro named
OpenMandriva Lx.

Signed-off-by: Alexander Khryukin <alexander@mezon.ru>
Acked-by: Stéphane Graber <stgraber@ubuntu.com>
parse.c: don't print error message on callback rv > 0

A callback return value < 0 means there was an error, so print
out an error message.  But a rv > 0 is used by the mount_unknown_fs
functions to say "we found the one we want, stop here."

Document this, and only print an error message if rv < 0.  Otherwise,

	lxc-create -B lvm --fstype ext3 -t ubuntu -n u1

will print an (innocuous) error message about being unable to parse
the config value 'ext3'.

Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
Acked-by: Stéphane Graber <stgraber@ubuntu.com>
lxc-test-ubuntu: also allow the standard non-nested apparmor policy

Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
Acked-by: Stéphane Graber <stgraber@ubuntu.com>
lxc-start-ephemeral: Fix broken mount logic

This reworks the mount logic for lxc-start-ephemeral to be as follow:
 - Any real (non-bind) entry gets copied to the target fstab
 - Any bind-mount from a virtual fs gets copied to the target fstab
 - Any remaining bind-mount if confirmed to be valid gets setup as an
   overlay.

Extra bind-mounts passed through the -b option are mounted by the
pre-mount script and don't need processing by the fstab generator.

Signed-off-by: Stéphane Graber <stgraber@ubuntu.com>
Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
lxc-alpine: enable loopback interface by default

It was probably disabled by a mistake

Signed-off-by: Natanael Copa <ncopa@alpinelinux.org>
Acked-by: Stéphane Graber <stgraber@ubuntu.com>
add lsm op for getting name of enabled lsm

Signed-off-by: Dwight Engen <dwight.engen@oracle.com>
Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
support setting lsm label at exec or immediately

- Add attach test cases

- Moved setting of LSM label later to avoid failure of IPC between parent
  and child during attach

Signed-off-by: Dwight Engen <dwight.engen@oracle.com>
Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
use proper config item depending on which lsm is enabled

On a system with AppArmor enabled, if lxc.se_context is configured but
lxc.aa_profile is not (because the user just wants to use the default
AppArmor profile) lxc was passing the lxc.se_context to be set as the
new AppArmor profile. Determine which configuration item to use based
on which lsm is enabled.

Signed-off-by: Dwight Engen <dwight.engen@oracle.com>
Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
Add a --thinpool argument to lxc-create, to use thin pool backed lvm when creating the container. When cloning a container backed by a thin pool, the clone will default to the same thin pool.
Document the new --thinpool option
Allocate cmd string with alloca instead of malloc, close popen handle if fgets fails.
lsm.h: Fix inline definition

Signed-off-by: Stéphane Graber <stgraber@ubuntu.com>
lxccontainer.c: Replace rindex by strrchr (bionic)

Signed-off-by: Stéphane Graber <stgraber@ubuntu.com>
change version to 1.0.0.alpha2 in configure.ac

Signed-off-by: Stéphane Graber <stgraber@ubuntu.com>