Add the Japanese translation for the lxc.init_cmd config option

Update for commit 67c660d

Signed-off-by: KATOH Yasufumi <karma@jazz.email.ne.jp>
Acked-by: Stéphane Graber <stgraber@ubuntu.com>
doc: Always include the Japanese lxc-top manpage

Update for commit e71549f

Signed-off-by: KATOH Yasufumi <karma@jazz.email.ne.jp>
Acked-by: Stéphane Graber <stgraber@ubuntu.com>
lxc-debian: adjust init system configurations

Do as much as possible to allow containers switching from non-systemd to
systemd to work as intended (but nothing that will cause side effects).
Use update-rc.d disable instead of remove so the init scripts are not
re-enabled when the package is updated

Signed-off-by: Cameron Norman <camerontnorman@gmail.com>
Acked-by: Stéphane Graber <stgraber@ubuntu.com>
lxc-debian: mask both Wheezy and Jessie udev services

Signed-off-by: Cameron Norman <camerontnorman@gmail.com>
Acked-by: Stéphane Graber <stgraber@ubuntu.com>
Improve veth error cases logging

The previous error message made it look like the host interface name was
the concatenation of both the host and guest interface names.

Closes #374

Signed-off-by: Stéphane Graber <stgraber@ubuntu.com>
fixed typo in comment

Signed-off-by: Shuai Zhang <zs.broccoli@gmail.com>
Acked-by: Stéphane Graber <stgraber@ubuntu.com>
change version to 1.1.0.alpha3 in configure.ac

Signed-off-by: Stéphane Graber <stgraber@ubuntu.com>
tests: try again when waitpid() sets errno as EINTR

when waitpid() is interrupted, errno is not set to the negative
value -EINTR. It is set to EINTR. check against EINTR.

Signed-off-by: Arjun Sreedharan <arjun024@gmail.com>
Acked-by: Stéphane Graber <stgraber@ubuntu.com>
audit: added capacity and reserve() to nlmsg

There are now two (permitted) ways to add data to netlink message:

 1. put_xxx()
 2. call nlmsg_reserve() to get a pointer to newly reserved room within the
    original netlink message, then write or memcpy data to that area.

Both of them guarantee adding requested length data do not overflow the
pre-allocated message buffer by checking against its cap field first.

And there may be no need to access nlmsg_len outside nl module, because both
put_xxx() and nlmsg_reserve() have alread did that for us.

Signed-off-by: Shuai Zhang <zs.broccoli@gmail.com>
Acked-by: Stéphane Graber <stgraber@ubuntu.com>
rmdir and lxc_unpriv returns non-negative error codes

Signed-off-by: S.Çağlar Onur <caglar@10ur.org>
Acked-by: Stéphane Graber <stgraber@ubuntu.com>
typofixes - https://github.com/vlajos/misspell_fixer

Signed-off-by: Veres Lajos <vlajos@gmail.com>
Acked-by: Stéphane Graber <stgraber@ubuntu.com>
seccomp: add rule to reject umount -f

If a container has a bind mount from a host nfs or fuse
filesystem, and does 'umount -f', it will disconnect the
host's filesystem.  This patch adds a seccomp rule to
block umount -f from a container.  It also adds that rule
to the default seccomp profile.

Thanks stgraber for the idea :)

Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
Acked-by: Stéphane Graber <stgraber@ubuntu.com>
Enable seccomp by default for unprivileged users.

In contrast to what the comment above the line disabling it said,
it seems to work just fine.  It also is needed on current kernels
(until Eric's patch hits upstream) to prevent unprivileged containers
from hosing fuse filesystems they inherit.

Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
Acked-by: Stéphane Graber <stgraber@ubuntu.com>
lxc-opensuse: default release changed to 13.1, as 12.3 reaches end-of-life soon

Signed-off-by: Johannes Kastl <git@ojkastl.de>
Acked-by: Stéphane Graber <stgraber@ubuntu.com>
lxc-opensuse: Disable building openSUSE containers on 13.2/Tumbleweed only if wrong version of build package is installed

Signed-off-by: Johannes Kastl <git@ojkastl.de>
Acked-by: Stéphane Graber <stgraber@ubuntu.com>
Also drop caps in unpriv containers

Signed-off-by: Stéphane Graber <stgraber@ubuntu.com>
Implement unprivileged autodev

Signed-off-by: Stéphane Graber <stgraber@ubuntu.com>