doc: Add lxc.aa_allow_incomplete flag to Japanese man

Update Japanese lxc.container.conf(5) for commit 93c709b

Signed-off-by: KATOH Yasufumi <karma@jazz.email.ne.jp>
Acked-by: Stéphane Graber <stgraber@ubuntu.com>
doc: Update Japanese lxc-top(1) for porting C version

Update for commit 7dc6f6e

Signed-off-by: KATOH Yasufumi <karma@jazz.email.ne.jp>
Acked-by: Stéphane Graber <stgraber@ubuntu.com>
lxc-checkpoint should fail if criu gets signal

The ->checkpoint() API call didn't exit correctly if criu was killed by a
signal instead of exiting, so lxc-checkpoint didn't fail correctly as a result.

Signed-off-by: Tycho Andersen <tycho.andersen@canonical.com>
Acked-by: Stéphane Graber <stgraber@ubuntu.com>
Initialize cgroups on lxc-checkpoint -r

With cgmanager, the cgroups are polled on demand, so these steps aren't needed.
However, with cgfs, lxc doesn't know about the cgroups for a container and so
it can't report any of the statistics about e.g. how much memory or CPU a
container is using.

Signed-off-by: Tycho Andersen <tycho.andersen@canonical.com>
Acked-by: Serge E. Hallyn <serge.hallyn@ubuntu.com>
Fix presentation of IPv6 addresses and gateway

Signed-off-by: Andre Nathan <andre@digirati.com.br>
Acked-by: Stéphane Graber <stgraber@ubuntu.com>
add src/python-lxc/setup.py into .gitignore

Signed-off-by: S.Çağlar Onur <caglar@10ur.org>
Acked-by: Stéphane Graber <stgraber@ubuntu.com>
Include network prefix when ipv4/ipv6 keys are queried

Signed-off-by: Sergio Jimenez <tripledes@gmail.com>
Acked-by: Stéphane Graber <stgraber@ubuntu.com>
apparmor: silence 'silent' mount denials

newer lxc uses 'silent' when remounting on shutdown.  Silence that denial too

Author: Jamie Strandboge <jamie@canonical.com>
Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
Acked-by: Stéphane Graber <stgraber@ubuntu.com>
doc: Drop lxc.pivotdir from Japanese lxc.container.conf(5)

Update for commit 2d489f9

Signed-off-by: KATOH Yasufumi <karma@jazz.email.ne.jp>
Acked-by: Stéphane Graber <stgraber@ubuntu.com>
Rework init scripts

This commit is based on the work of:
    Signed-off-by: Michael H. Warfield <mhw@WittsEnd.com>

A generic changelog would be:
 - Bring support for lxcbr0 to all distributions
 - Share the container startup and network configuration logic across
   distributions and init systems.
 - Have all the init scripts call the helper script.
 - Support for the various different distro-specific configuration
   locations to configure lxc-net and container startup.

Changes on top of Mike's original version:
 - Remove sysconfig/lxc-net as it's apparently only there as a
   workaround for an RPM limitation and is breaking Debian systems by
   including a useless file which will get registered as a package provided
   conffile in the dpkg database and will therefore cause conffile prompts
   on upgrades...
 - Go with a consistant coding style in the various init scripts.
 - Split out the common logic from the sysvinit scripts and ship both in
   their respective location rather than have them be copies.
 - Fix the upstart jobs so they actually work (there's no such thing as
   libexec on Debian systems).

Signed-off-by: Stéphane Graber <stgraber@ubuntu.com>
Acked-by: Serge E. Hallyn <serge.hallyn@ubuntu.com>
fixups to init script rework

- move action() from common to sysvinit wrapper since its only really
  applicable for sysvinit and not the other init systems

- fix bug in action() fallback, need to shift away msg before executing action

- make lxc-net 98 so it starts before lxc-container (99), otherwise the lxcbr0
  won't be available when containers are autostarted

- make the default RUNTIME_PATH be /var/run instead of /run. On older
  distros (like ol6.5) /run doesn't exist. lxc-net will create this directory
  and attempt to create the dnsmasq.pid file in it, but this will fail when
  SELinux is enabled because the directory will have the default_t type.
  Newer systems have /var/run symlinked to /run so you get to the same place
  in that case.

- add %postun to remove lxc-dnsmasq user when pkgs are removed

- fix bug in lxc-oracle template that was creating /var/lock/subsys/lxc as
  a dir and interfering with the init scripts

Signed-off-by: Dwight Engen <dwight.engen@oracle.com>
Acked-by: Stéphane Graber <stgraber@ubuntu.com>
add file/func/line to debug info

Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
Acked-by: Stéphane Graber <stgraber@ubuntu.com>
apparmor: restrict signal and ptrace for processes

Restrict signal and ptrace for processes running under the container
profile. Rules based on AppArmor base abstraction. Add unix rules for
processes running under the container profile.

Signed-off-by: Jamie Strandboge <jamie@canonical.com>
Acked-by: Serge Hallyn <serge.hallyn@ubuntu.com>
Acked-by: Stéphane Graber <stgraber@ubuntu.com>
sysconfig/lxc: Reverse sourcing logic

This prevents scripts running with -e to fail when lxc-net doesn't
exist.

Signed-off-by: Stéphane Graber <stgraber@ubuntu.com>
pivot_root: umount ., not /

This fixes pivot_root on 3.11 and older kernels.

Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
Acked-by: Stéphane Graber <stgraber@ubuntu.com>
change version to 1.1.0.alpha1 in configure.ac

Signed-off-by: Stéphane Graber <stgraber@ubuntu.com>
tests: Fix unpriv test

Don't use $TUSER as it's not defined. Also don't include
lxc-test-usernic in extra_DIST.

Signed-off-by: Stéphane Graber <stgraber@ubuntu.com>
fix: grep not match interface listed by `ip link list`

Interfaces listed by `ip link list` are prefixed with the index
identifier. The pattern "^$BRNAME" does not match.

 - dependencies to ifconfig and ip removed
 - wait until interface flagged with IFF_UP

Ref: https://github.com/torvalds/linux/blob/master/include/uapi/linux/if.h

Signed-off-by: Joshua Brunner <j.brunner@nexbyte.com>
cgmanager: several fixes

These all fix various ways that cgroup actions could fail if an
unprivileged user's cgroup paths were not all the same for all
controllers.

1. in cgm_{g,s}et, use the right controller, not the first in the list,
   to get the cgroup path.

2. when we pass 'all' to cgmanager for a ${METHOD}_abs, make sure that all
   cgroup paths are the same.  That isn't necessary for methods not
   taking an absolute path, so split up the former
   cgm_supports_multiple_controllers() function into two booleans, one
   telling whether cgm supports it, and another telling us whether
   cgm supports it AND all controller cgroup paths are the same.

3. separately, do_cgm_enter with abs=true couldn't work if all
   cgroup paths were not the same.  So just ditch that helper and
   call lxc_cgmanager_enter() where needed, because the special
   cases would be more complicated.

Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
lxc: don't call pivot_root if / is on a ramfs

pivot_root can't be called if / is on a ramfs. Currently chroot is
called before pivot_root. In this case the standard well-known
'chroot escape' technique allows to escape a container.

I think the best way to handle this situation is to make following actions:
* clean all mounts, which should not be visible in CT
* move CT's rootfs into /
* make chroot into /

I don't have a host, where / is on a ramfs, so I can't test this patch.

Signed-off-by: Andrey Vagin <avagin@openvz.org>
Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>