restore: Defer new net-namespace creation until forked

Some kernel modules such as pktgen runs kthred upon
new-net creation taking last_pid we were requested.
Lets workaround this problem using clone + unshare
bundle.

Signed-off-by: Cyrill Gorcunov <gorcunov@openvz.org>
Acked-by: Andrew Vagin <avagin@parallels.com>
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>
bfd: Check images got flushed at the end

Signed-off-by: Pavel Emelyanov <xemul@parallels.com>
bfd: Don't flush read-only images

Signed-off-by: Pavel Emelyanov <xemul@parallels.com>
mount: Invert check for shared mounts check

Introduced by eb214be2, the empty mnt_share list cannot
produce the list_first_entry element :)

Signed-off-by: Pavel Emelyanov <xemul@parallels.com>
Acked-by: Andrew Vagin <avagin@parallels.com>
mnt: Helper and comment for bind mount validation

Signed-off-by: Pavel Emelyanov <xemul@parallels.com>
Acked-by: Andrew Vagin <avagin@parallels.com>
cr-dump: fix out-of-bounds write (OVERRUN)

CID 73381 (#1 of 1): Out-of-bounds write (OVERRUN)
15. overrun-local: Overrunning array loc_buf of 4096 bytes at byte offset 4096 using index len (which evaluates to 4096).

CID 73355 (#1 of 1): Out-of-bounds write (OVERRUN)
6. overrun-local: Overrunning array loc_buf of 4096 bytes at byte offset 4096 using index ret (which evaluates to 4096)

Signed-off-by: Andrey Vagin <avagin@openvz.org>
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>
page-xfer: write pidfile from a process which starts a service

When a process, which starts a service, exits, we know that we can
connect to the page server and we expect to find pidfile.

If we create pidfile from a page server process, we have a race window.

Signed-off-by: Andrey Vagin <avagin@openvz.org>
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>
page-server: don't forget to close a sever socket

CID 73348 (#1 of 1): Resource leak (RESOURCE_LEAK)
19. leaked_handle: Handle variable sk going out of scope leaks the handle.

Signed-off-by: Andrey Vagin <avagin@openvz.org>
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>
sysfs: fix use_after_free issue

CID 73379 (#1 of 1): Use after free (USE_AFTER_FREE)
31. deref_arg: Calling fclose dereferences freed pointer fp.

Signed-off-by: Andrey Vagin <avagin@openvz.org>
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>
shmem: don't unmap a memrory region in restore_shmem_content()

This function doesn't allocate memory, so it should not release it.

CID 73380 (#1 of 1): Use after free (USE_AFTER_FREE)
14. deref_arg: Calling munmap dereferences freed pointer addr.

Signed-off-by: Andrey Vagin <avagin@openvz.org>
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>
cgroups: fix use_after_free issue

list_for_each_entry_safe() should be used, you we are going to delete
something from a list.

CID 73383 (#1 of 1): Read from pointer after free (USE_AFTER_FREE)
4. deref_after_free: Dereferencing freed pointer prop.

Cc: Tycho Andersen <tycho.andersen@canonical.com>
Signed-off-by: Andrey Vagin <avagin@openvz.org>
Acked-by: Tycho Andersen <tycho.andersen@canonical.com>
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>
restore: don't leak a transport socket

CID 73354 (#1 of 1): Resource leak (RESOURCE_LEAK)
9. leaked_handle: Handle variable sock going out of scope leaks the handle

Signed-off-by: Andrey Vagin <avagin@openvz.org>
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>
cgroup: don't use fread in read_cgroup_prop()

I think this version of code is a bit more readable.
It doesn't do memcpy and doesn't allocate FILE.
Everyone knows arguments for read(), but only a few of
us know arguments for fread().

CID 73345 (#1 of 1): String not null terminated (STRING_NULL)
2. string_null_argument: Function fread does not terminate string *buf. [Note: The source code implementation of the function has been overridden by a builtin model.]

Cc: Tycho Andersen <tycho.andersen@canonical.com>
Signed-off-by: Andrey Vagin <avagin@openvz.org>
Acked-by: Tycho Andersen <tycho.andersen@canonical.com>
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>
sk-inet: don't leak sockets

CID 73347 (#7-4 of 7): Resource leak (RESOURCE_LEAK)
21. leaked_handle: Handle variable sk going out of scope leaks the handle.

Signed-off-by: Andrey Vagin <avagin@openvz.org>
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>
ipc_ns: don't leak memory

CID 73377: Resource leak (RESOURCE_LEAK)
10. leaked_storage: Variable values going out of scope leaks the storage
it points to.

Signed-off-by: Andrey Vagin <avagin@openvz.org>
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>
proc: don't leak memory

CID 73370: Resource leak (RESOURCE_LEAK)
13. leaked_storage: Variable timer going out of scope leaks the storage it points to.

Signed-off-by: Andrey Vagin <avagin@openvz.org>
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>
mount: bind-mount root into itself if processes are restored in userns

When we create a new mntns in a userns, all inhereted mounts are marked
as locked. pivot_root() returns EINVAL if a new root is locked.
userns: define protobuf messages for uid and gid maps

Normally, one of the first steps after creating a new user namespace is
to define the mappings used for the user and group IDs of the processes
that will be created in that namespace. This is done by writing mapping
information to the /proc/PID/uid_map and /proc/PID/gid_map files
corresponding to one of the processes in the user namespace.
criu: add constants about user namespaces
dump: get tasks ids from parasite

We have two reason for that:
* parsing of /proc/pid/status is slow
* parasite returns ids from a target userns