run_buffer(): unblock all signals for spawned scripts.

Currently, all scripts, specified as "lxc.network.script.up", inherit
lxc-execute's signal mask.
This, for example, includes blocked SIGALRM signal which, in turn, makes
alarm(2), sleep(3) and setitimer(2) functions silently unusable in all programs,
invoked in turn by the "lxc.network.script.up".
To fix this, run_buffer() should restore default signal mask prior to
executing "lxc.network.script.up".

A naive implementation would temprorary unblock all signals just before
calling popen() and block them back immediately after it.
But that would result in an immediate delivery of all pending signals just
after their unblocking.
Thus, we should restore default signal mask exactly in child (after fork())
just before calling exec().
To achieve this, a home-brewed popen() alternative is needed.
The added lxc_popen() and lxc_pclose() are mostly taken from glibc with
several simplifications (as we currently need only "re" mode).
The implementation uses Linux-specific pipe2() system-call,
which is only available since Linux 2.6.27 and supported by glibc since
version 2.9 (according to pipe(2) man-page), but this shouldn't be a
problem as lxc requires a fairly recent kernel too.

lxc_popen()/lxc_pclose() are meant to be direct replacements for their
stdio counterparts, so they perform no process_lock() locking
themselves. (as fopen_cloexec() does)
All existing users of popen()/pclose() are converted to the new
lxc_popen()/lxc_pclose().

(mazo: don't clear close-on-exec flag for parent's end;
place the new functions in utils.c;
convert bdev.c to use the new functions;
coding style fixes;
comments fixes;
commit message tweaks)

Signed-off-by: Ivan Bolsunov <bolsunov@telum.ru>
Signed-off-by: Andrey Mazo <mazo@telum.ru>
typo fix: create $rootfs/dev/pts

Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
don't run lxc-user-nic for empty netns

Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
coverity : fix memleak on error path

Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
coverity: fix memleak in userns_exec_1

Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
coverity: change flow to safely free in all exit paths

Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
coverity: fix use before null check

Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
coverity: avoid deref of explicitly NULL variable on error path

Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
coverity: fix mix of bool and int

Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
coverity: an int is not 1 byte

Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
coverity: don't deref null c

Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
coverity: drop gratuitous null check

Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
lxc-user-nic: fix the wrong use of realloc

fix the wrong use of realloc

Signed-off-by: Libo Chen <clbchenlibo.chen@huawei.com>
Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
make 'empty network' the default

Currently if no lxc.network.type section is in the container
configuration, the container ends up sharing the host's network.
This is a dangerous default.

Instead, add 'lxc.network.type = none' as a valid type, and make
en empty network the default.

If none as well as another network type are specified, then the
none type will be ignored.

Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
Acked-by: Stéphane Graber <stgraber@ubuntu.com>
Merge pull request #101 from ahippo/master

run_buffer(): unblock all signals for spawned scripts.
coverity: remove logically dead code

Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
ubuntu: Fix initial container creation

The list of packages must be comma separated, not space separated.

Signed-off-by: Stéphane Graber <stgraber@ubuntu.com>
configure.ac: Make our configure more consistent

This commit does the following changes:
 - Disable rpath by default
 - Switch all of our options to --enable-FEATURE in the help
 - Add auto-detection of libcap availability
 - Add auto-detection of python3 availability
 - Always specify the default value in --help
 - Add a configuration overview at the end

Signed-off-by: Stéphane Graber <stgraber@ubuntu.com>
Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
make mountcgroups hook to lxc.include aware (v2)

[resending the patch from correct branch]

commit 09ad624693cb0ef41cf246e2876b5f356783b34d introduced lxc.include option
to include other config files. This patch uses it in mountcgroups hook otherwise
lxc-start fails with following error message for the nested containers;

root@oOo:/var/lib/lxc/raring# lxc-start -l debug -o l -n raring -d
lxc-start: command get_cgroup failed to receive response

Signed-off-by: S.Çağlar Onur <caglar@10ur.org>
Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
stop: add nolock option

If the system gets into a bad state, it may become impossible to get
the lxc container locks.  We should still be able to stop containers
in that case.  Add a -L/--nolock option to specify this behavior.

Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
Acked-by: Stéphane Graber <stgraber@ubuntu.com>