unprivileged containers: use next available nic name if unspecified

Rather than always using eth0.  Otherwise unpriv containers cannot have
multiple lxc.network.type = veth's without manually setting
lxc.network.name =.

Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
Support openvswitch bridges

We detect whether ovs-vsctl is available.  If so, then we support
adding network interfaces to openvswitch bridges with it.

Note that with this patch, veths do not appear to be removed from the
openvswitch bridge.  This seems a bug in openvswitch, as the veths
in fact do disappear from the system.  If lxc is required to remove
the port from the bridge manually, that becomes more complicated
for unprivileged containers, as it would require a setuid-root
wrapper to be called at shutdown.

Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
fix typo

Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
fix typo in btrfs error msg

Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
add help string for ubuntu templete

Signed-off-by: Trần Ngọc Quân <vnwildman@gmail.com>
Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
apparmor: Allow slave bind mounts

Without this, if the system uses shared subtrees by default (like systemd), you
get a large stream of

  lxc-start: Permission denied - Failed to make /<mountpoint> rslave
  lxc-start: Continuing...

with

  apparmor="DENIED" operation="mount" info="failed flags match" error=-13
  profile="/usr/bin/lxc-start" name="/" pid=17284 comm="lxc-start" flags="rw, slave"

and eventual failure plus a lot of leftover mounts in the host.

https://launchpad.net/bugs/1325468
Merge pull request #285 from martinpitt/master

apparmor: Allow slave bind mounts
lxc-start: Add -F (foreground) option

Introduce a new -F option (no-op for now) as an opposite of -d.

Signed-off-by: Stéphane Graber <stgraber@ubuntu.com>
Acked-by: Serge E. Hallyn <serge.hallyn@ubuntu.com>
lxc-start: Daemonize by default

Signed-off-by: Stéphane Graber <stgraber@ubuntu.com>
Acked-by: Serge E. Hallyn <serge.hallyn@ubuntu.com>
download: Have wget retry 3 times

This forces wget to retry if it gets a network error.

Signed-off-by: Stéphane Graber <stgraber@ubuntu.com>
Acked-by: Serge E. Hallyn <serge.hallyn@ubuntu.com>
Support providing env vars to container init

It's quite useful to be able to configure containers by specifying
environment variables, which init (or initscripts) can use to adjust the
container's operation.

This patch adds one new configuration parameter, `lxc.environment`, which
can be specified zero or more times to define env vars to set in the
container, like this:

    lxc.environment = APP_ENV=production
    lxc.environment = SYSLOG_SERVER=192.0.2.42
    lxc.environment = SOMETHING_FUNNY=platypus

Default operation is unchanged; if the user doesn't specify any
lxc.environment parameters, the container environment will be what it is
today ('container=lxc').

Signed-off-by: Matt Palmer <mpalmer@hezmatt.org>
Acked-by: Stéphane Graber <stgraber@ubuntu.com>
Acked-by: Serge E. Hallyn <serge.hallyn@ubuntu.com>
Add the remaining bits for lxc.environment

This adds the few missing bits so that the new lxc.environment config
entry can be queried, cleared and saved as the others are.

Signed-off-by: Stéphane Graber <stgraber@ubuntu.com>
provide an example SELinux policy for older releases

The virtd_lxc_t type provided by the default RHEL/CentOS/Oracle 6.5
policy is an unconfined_domain(), so it doesn't really enforce anything.
This change will provide a link in the documentation to an example
policy that does confine containers.

On more recent distributions with new enough policy, it is recommended
not to use this sample policy, but to use the types already available
on the system from /etc/selinux/targeted/contexts/lxc_contexts, ie:

process = "system_u:system_r:svirt_lxc_net_t:s0"
file = "system_u:object_r:svirt_sandbox_file_t:s0"

Signed-off-by: Dwight Engen <dwight.engen@oracle.com>
Acked-by: Serge E. Hallyn <serge.hallyn@ubuntu.com>
print a helpful message if creating unpriv container with no idmap

This gives me:

ubuntu@c-t1:~$ lxc-create -t download -n u1
lxc_container: No mapping for container root
lxc_container: Error chowning /home/ubuntu/.local/share/lxc/u1/rootfs to container root
lxc_container: You must either run as root, or define uid mappings
lxc_container: To pass uid mappings to lxc-create, you could create
lxc_container: ~/.config/lxc/default.conf:
lxc_container: lxc.include = /etc/lxc/default.conf
lxc_container: lxc.id_map = u 0 100000 65536
lxc_container: lxc.id_map = g 0 100000 65536
lxc_container: Error creating backing store type (none) for u1
lxc_container: Error creating container u1

when I create a container without having an id mapping defined.

Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
use non-thread-safe getpwuid and getpwgid for android

We only call it (so far) after doing a fork(), so this is fine.  If we
ever need such a thing from threaded context, we'll simply need to write
our own version for android.

Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
Acked-by: Stéphane Graber <stgraber@ubuntu.com>
Move lxcbr0 setup logic into lxc.net script

Factor this out of the lxc-net.conf upstart job, so that it can be used by
init.d scripts and systemd units, too.

Part of https://launchpad.net/bugs/1312532

Signed-off-by: Martin Pitt <martin.pitt@ubuntu.com>
Acked-by: Serge E. Hallyn <serge.hallyn@ubuntu.com>
Get systemd unit dir from pkg-config

Don't install systemd unit files into $(prefix), they won't work there.
Instead, get them from systemd's pkg-config file.

Signed-off-by: Martin Pitt <martin.pitt@ubuntu.com>
Acked-by: Serge E. Hallyn <serge.hallyn@ubuntu.com>
Add systemd unit for lxc.net

This is the equivalent of the upstart lxc-net.conf to set up the LXC bridge.

This also drops "lxc.service" from tarballs. It is built source which depends
on configure options, so the statically shipped file will not work on most
systems.

https://launchpad.net/bugs/1312532

Signed-off-by: Martin Pitt <martin.pitt@ubuntu.com>
Acked-by: Serge E. Hallyn <serge.hallyn@ubuntu.com>
systemd: Ensure action() is defined

If /etc/rc.d/init.d/functions is not present or does not define an action()
function, provide a simple fallback using "echo".

Signed-off-by: Martin Pitt <martin.pitt@ubuntu.com>
Acked-by: Serge E. Hallyn <serge.hallyn@ubuntu.com>
systemd: Load AppArmor profiles if necessary/supported

On Ubuntu we need to set up the AppArmor profiles also under systemd.
Add a new helper "lxc-apparmor-load" and integrate it into lxc.service.

Signed-off-by: Martin Pitt <martin.pitt@ubuntu.com>
Acked-by: Serge E. Hallyn <serge.hallyn@ubuntu.com>