lxc-start: close inherited fds right before exec

Not before we've even forked.

Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
Acked-by: Stéphane Graber <stgraber@ubuntu.com>
re-open cgmanager socket after fork in daemonized start

Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
Acked-by: Stéphane Graber <stgraber@ubuntu.com>
coverity: Check fread length

Signed-off-by: Stéphane Graber <stgraber@ubuntu.com>
Acked-by: Serge E. Hallyn <serge.hallyn@ubuntu.com>
coverity: Silence potential null-deref warning

Signed-off-by: Stéphane Graber <stgraber@ubuntu.com>
Acked-by: Serge E. Hallyn <serge.hallyn@ubuntu.com>
coverity: Check fstat return value

Signed-off-by: Stéphane Graber <stgraber@ubuntu.com>
Acked-by: Serge E. Hallyn <serge.hallyn@ubuntu.com>
coverity: Check return value of setenv

Signed-off-by: Stéphane Graber <stgraber@ubuntu.com>
Acked-by: Serge E. Hallyn <serge.hallyn@ubuntu.com>
coverity: Check fcntl return value

Signed-off-by: Stéphane Graber <stgraber@ubuntu.com>
Acked-by: Serge E. Hallyn <serge.hallyn@ubuntu.com>
coverity: Don't pass uninitialized var to write

Signed-off-by: Stéphane Graber <stgraber@ubuntu.com>
Acked-by: Serge E. Hallyn <serge.hallyn@ubuntu.com>
change version to 1.0.0.rc2 in configure.ac

Signed-off-by: Stéphane Graber <stgraber@ubuntu.com>
always ensure a /proc while setting up container

Otherwise we can't open /proc/self/fd to find the fds to close.

Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
close inherited fds when we still have proc mounted

and don't close the sigfd

Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
fill missing netdev fields for unprivileged containers

lxc-user-nic now returns the names of the interfaces and
unpriv_assign_nic function parses that information to fill
missing netdev->veth_attr.pair and netdev->name.

With this patch get_running_config_item started to provide
correct information;

>>> import lxc; c = lxc.Container("rubik"); c.get_running_config_item("lxc.network.0.name"); c.get_running_config_item("lxc.network.0.veth.pair");
'eth0'
'veth9MT2L4'
>>>

and lxc-info started to show network stats;

lxc-info -n rubik
Name:           rubik
State:          RUNNING
PID:            23061
IP:             10.0.3.233
CPU use:        3.86 seconds
BlkIO use:      88.00 KiB
Memory use:     6.53 MiB
KMem use:       0 bytes
Link:           veth9MT2L4
 TX bytes:      3.45 KiB
 RX bytes:      8.83 KiB
 Total bytes:   12.29 KiB

Signed-off-by: S.Çağlar Onur <caglar@10ur.org>
Acked-by: Serge E. Hallyn <serge.hallyn@ubuntu.com>
Acked-by: Stéphane Graber <stgraber@ubuntu.com>
download: Support nested containers in unpriv

This adds detection for the case where we are root in an unprivileged
container and then run LXC from there. In this case, we want to download
to the system location, ignore the missing uid/gid ranges and run
templates that are userns-ready.

Signed-off-by: Stéphane Graber <stgraber@ubuntu.com>
Acked-by: Serge E. Hallyn <serge.hallyn@ubuntu.com>
support get_config_item(lxc.seccomp) and clear_config_item(lxc.seccomp)

Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
Acked-by: Stéphane Graber <stgraber@ubuntu.com>
attach: try to use the container's seccomp policy

We can't get the actual policy (in the case where the policy file
has changed) from the container, but at least we can use the
seccomp policy file listed in the container config file.

(If anyone wants to further improve this, it may be better to get
the seccomp policy over the cmd api;  not sure that's what we want,
and this seems simpler to hook into the existing code, so I went
this way for now)

Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
Acked-by: Stéphane Graber <stgraber@ubuntu.com>
configure.ac: Fix cgmanager detection

Signed-off-by: Stéphane Graber <stgraber@ubuntu.com>
close correct side of the pipe and increase buffer size by one to handle \n

Signed-off-by: S.Çağlar Onur <caglar@10ur.org>
Acked-by: Stéphane Graber <stgraber@ubuntu.com>
tests: Use trusty instead of lucid

This is required so the tests actually have a chance of passing on arm64
and ppc64el.

Signed-off-by: Stéphane Graber <stgraber@ubuntu.com>
Typo fix

Signed-off-by: Stéphane Graber <stgraber@ubuntu.com>
cgmanager: lock around cgmanager-client calls

Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>