clang: Fix build warnings for 3.4

Signed-off-by: Stéphane Graber <stgraber@ubuntu.com>
fix minor typo in .gitignore

Signed-off-by: S.Çağlar Onur <caglar@10ur.org>
Acked-by: Stéphane Graber <stgraber@ubuntu.com>
alpinelinux: set correct lxc_arch for x86

Signed-off-by: Carlo Landmeter <clandmeter@gmail.com>
Acked-by: Stéphane Graber <stgraber@ubuntu.com>
use correct lxc-init path in sshd template

lxc-init got moved into SBINDIR/init.lxc recently.
This broke sshd template because path wasn't updated there.
This patch should fix this issue.

Signed-off-by: Nikolay Martynov <mar.kolya@gmail.com>
Acked-by: Stéphane Graber <stgraber@ubuntu.com>
lxc-create: make 'none' bdev type work again

This should address https://github.com/lxc/lxc/issues/199

Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
Acked-by: Stéphane Graber <stgraber@ubuntu.com>
lxc-ls: Update lxc.group handling

This introduces a new -g/--group argument to filter containers based on
their groups.

This supports the rather obvious: --group blah
Which will only list containers that are in group blah.

It may also be passed multiple times: --group blah --group bleh
Which will list containers that are in either (or both) blah or bleh.

And it also takes: --group blah,bleh --group doh
Which will list containers that are either in BOTH blah and bleh or in doh.

Signed-off-by: Stéphane Graber <stgraber@ubuntu.com>
Acked-by: Michael H. Warfield <mhw@WittsEnd.com>
Acked-by: Serge E. Hallyn <serge.hallyn@ubuntu.com>
lxc-ls: Typo in manpage

Signed-off-by: Stéphane Graber <stgraber@ubuntu.com>
doc: Update Japanese lxc-clone(1) for fixing typo

Update for commit 0e98b3bd319e887e76e37b513545d0e8eb893f24

Signed-off-by: KATOH Yasufumi <karma@jazz.email.ne.jp>
Acked-by: Stéphane Graber <stgraber@ubuntu.com>
doc: Update Japanese lxc-create(1) for 'none' bdev type

Update for commit 50040b5

Signed-off-by: KATOH Yasufumi <karma@jazz.email.ne.jp>
Acked-by: Stéphane Graber <stgraber@ubuntu.com>
lxc-ls: Allow the use of --groups without --fancy

There wasn't a good reason for that limit, we can simply make the code
slightly slower when --groups is passed and still have the expected
output even without --fancy.

Signed-off-by: Stéphane Graber <stgraber@ubuntu.com>
cgfs: don't mount /sys/fs/cgroup readonly

/sys/fs/cgroup is just a size-limited tmpfs, and making it ro does
nothing to affect our ability alter mount settings of its subdirs.
OTOH making it ro can upset mountall in the container which tries
to remount it rw, which may be refused.

So just don't do it.

Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
Cc: Christian Seiler <christian@iwakd.de>
Acked-by: Stéphane Graber <stgraber@ubuntu.com>
doc: Update Japanese lxc-ls(1) for the new -g/--group argument

Update for commit 0f02786

Signed-off-by: KATOH Yasufumi <karma@jazz.email.ne.jp>
Acked-by: Stéphane Graber <stgraber@ubuntu.com>
lxc-ls: Cache groups and show bygroup in autostart

This makes sure we only query lxc.group once and then reuse that list
for filtering, listing groups and autostart.

When a container is auto-started only as part of a group, autostart will
now show by-group instead of yes.

Signed-off-by: Stéphane Graber <stgraber@ubuntu.com>
Revert "cgfs: don't mount /sys/fs/cgroup readonly"

This reverts commit 8d783edcae3723a0106d75e1ff31b016e8b1d02c.
lxc-ls: Force running against containers without python

When using --nesting, we exec ourselves in the container context, if we
somehow need to dynamically-load modules from there, things break. So
make sure we pre-load everything we may need.

Signed-off-by: Stéphane Graber <stgraber@ubuntu.com>
Acked-by: Serge E. Hallyn <serge.hallyn@ubuntu.com>
Add missing MAX_STACKDEPTH define on MUTEX_DEBUGGING build

Corrected a small oversight when locking related code was moved from
src/lxc/utils.c to src/lxc/lxclock.c.

Signed-off-by: Stephen M Bennett <stephen_m_bennett@hotmail.com>
Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
python-lxc: minor fixes to __init__.py

Set a base class for the network object and set the encoding in the
header. Neither of those changes are required for python3 but they do
make it easier for anyone trying to make a python2 binding.

Signed-off-by: Stéphane Graber <stgraber@ubuntu.com>
cgfs: don't mount /sys/fs/cgroup readonly

Ubuntu containers have had trouble with automatic cgroup mounting that
was not read-write (i.e. lxc.mount.auto = cgroup{,-full}:{ro,mixed}) in
containers without CAP_SYS_ADMIN. Ubuntu's mountall program reads
/lib/init/fstab, which contains an entry for /sys/fs/cgroup. Since
there is no ro option specified for that filesystem, mountall will try
to remount it readwrite if it is already mounted. Without
CAP_SYS_ADMIN, that fails and mountall will interrupt boot and wait for
user input on whether to proceed anyway or to manually fix it,
effectively hanging container bootup.

This patch makes sure that /sys/fs/cgroup is always a readwrite tmpfs,
but that the actual cgroup hierarchy paths (/sys/fs/cgroup/$subsystem)
are readonly if :ro or :mixed is used. This still has the desired
effect within the container (no cgroup escalation possible and programs
get errors if they try to do so anyway), while keeping Ubuntu
containers happy.

Signed-off-by: Christian Seiler <christian@iwakd.de>
Cc: Serge Hallyn <serge.hallyn@ubuntu.com>
Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
Factor out capability parsing logic

Currently, setup_caps and dropcaps_except both use the same parsing
logic for parsing capabilities (try to identify by name, but allow
numerical specification). Since this is a common routine, separate it
out to improve maintainability and reuseability.

Signed-off-by: Christian Seiler <christian@iwakd.de>
Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
lxc.mount.auto: improve defaults for cgroup and cgroup-full

If the user specifies cgroup or cgroup-full without a specifier (:ro,
:rw or :mixed), this changes the behavior. Previously, these were
simple aliases for the :mixed variants; now they depend on whether the
container also has CAP_SYS_ADMIN; if it does they resolve to the :rw
variants, if it doesn't to the :mixed variants (as before).

If a container has CAP_SYS_ADMIN privileges, any filesystem can be
remounted read-write from within, so initially mounting the cgroup
filesystems partially read-only as a default creates a false sense of
security. It is better to default to full read-write mounts to show the
administrator what keeping CAP_SYS_ADMIN entails.

If an administrator really wants both CAP_SYS_ADMIN and the :mixed
variant of cgroup or cgroup-full automatic mounts, they can still
specify that explicitly; this commit just changes the default without
specifier.

Signed-off-by: Christian Seiler <christian@iwakd.de>
Cc: Serge Hallyn <serge.hallyn@ubuntu.com>
Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>