security: skip obtaining additional groups for root, as they don't matter

As it was reported, some systems don't use /etc/passwd.
On such systems getpwuid fails with undefined errno(see getpwuid(3))
not allowing criu to restrict ids with user additional groups.
Luckily, on such systems criu is run as root, so we can
just skip obtaining additional groups, as they don't matter
for root.

Reported-by: Christopher Covington <cov@codeaurora.org>
Signed-off-by: Ruslan Kuprieiev <kupruser@gmail.com>
Tested-by: Christopher Covington <cov@codeaurora.org>
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>
Copy x86 VDSO code to AArch64

While it duplicates hundreds of lines of code, this is the
short term strategy Cyrill and I have agreed to for supporting
VDSOs across multiple architectures [1]. With better
understanding of where things differ per-architecture, or even
improved consolidation in the kernel, we can hopefully move to
a more shared implementation in the future.

1. http://lists.openvz.org/pipermail/criu/2014-August/015218.html

Acked-by: Cyrill Gorcunov <gorcunov@openvz.org>
Signed-off-by: Christopher Covington <cov@codeaurora.org>
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>
Customize AArch64 VDSO code

This modifies the x86 VDSO code to work on AArch64.

Signed-off-by: Christopher Covington <cov@codeaurora.org>
Acked-by: Cyrill Gorcunov <gorcunov@openvz.org>
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>
mount: don't set m->bind if m is already mounted

The m->bind will be used to get the "lowest" mount. A mount is
called "lowest" in the chain of bind-mounts when its m->bind is
NULL. I.e. -- it's the mount of the root dir of an FS, all the
others are bind-mounted from it.

The propagate_siblings() is called for each new mount and sets
the bind field for others. A part of these other mounts can be
already mounted.

Signed-off-by: Andrey Vagin <avagin@openvz.org>
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>
mount: save local mount point paths on restore

On restore we add a temporary root to a mount point path. It's convinient
for restoring mount namespaces, but real paths are used for restoring
link-remap files.

v2: replace the offset field on a char * field

Signed-off-by: Andrey Vagin <avagin@openvz.org>
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>
link-remap: open link-remap files from correct mountpoints (v3)

Here is a problem with ghost files. Links are created on restore, but
they can't be created on any mount point, because a mount point can be
non-root bind-mount of another one. So we need to find the root mount
and create all links there.

v2: clean up
v3: add optimization for the case when both links on the same mount
point.
v4: don't look up mount points by mnt_id in a second time.

Signed-off-by: Andrey Vagin <avagin@openvz.org>
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>
notify: open files form a correct mount points (v2)

v2: add a comment before mntns_get_root_by_mnt_id(-1);
Signed-off-by: Andrey Vagin <avagin@openvz.org>
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>
zdtm: Check that files from alien mnt ns are handled (v2)

Check that files opened before switching to new mount namespace
remain in it after restore. Right now this is not so :( Andrey is
fixing the issue.

Christopher, can you check whether the ns_child's call to system()
works in your minimal set-ups (it launches cat and awk). If not,
then I should rewrite this routine in pure C.

The first version was written by Pavel (xemul@).

v2: don't use test_init_ns
    don't call awk and cat

Signed-off-by: Andrey Vagin <avagin@openvz.org>
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>
zdtm: check link-remap and ghost files from a few mntns (v2)

v2: change an author field in a test
Signed-off-by: Andrey Vagin <avagin@openvz.org>
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>
timerfd: arch, x86 -- Add sys_timerfd related syscalls

Signed-off-by: Cyrill Gorcunov <gorcunov@openvz.org>
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>
timerfd: arch, arm -- Add sys_timerfd related syscalls

This is required to support checkpoint and restore of timers
that notify via file descriptors on ARM and AArch64.

Signed-off-by: Christopher Covington <cov@codeaurora.org>
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>
timerfd: protobuf -- Add timerfd_entry

Will need it to carry timerfd entries.

Signed-off-by: Cyrill Gorcunov <gorcunov@openvz.org>
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>
timerfd: Add protobuf entries into the image

Signed-off-by: Cyrill Gorcunov <gorcunov@openvz.org>
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>
timerfd: Implement c/r procedure

Signed-off-by: Cyrill Gorcunov <gorcunov@openvz.org>
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>
timerfd: zdtm -- Add simple testcase

Signed-off-by: Cyrill Gorcunov <gorcunov@openvz.org>
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>
timerfd: Implement check routine

Reported-by: Jenkins
Signed-off-by: Cyrill Gorcunov <gorcunov@openvz.org>
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>
restore: actually fail if clone() fails

Signed-off-by: Tycho Andersen <tycho.andersen@canonical.com>
Acked-by: Cyrill Gorcunov <gorcunov@openvz.org>
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>
vdso: aarch64 -- Merge fixes from x86

This brings the changes made in the following commits to the
aarch64 copy of the code.

commit 7794f67f2055420c6b6c2967edfbe0c39a7cd744
Author: Cyrill Gorcunov <gorcunov@openvz.org>
Date:   Tue Aug 5 13:59:18 2014 +0400

    vdso: x86 -- Fix missing ability to remap vDSO if only one zone present

commit 066add0de44f462e7482571763f303ded0b4762f
Author: Cyrill Gorcunov <gorcunov@openvz.org>
Date:   Tue Aug 5 13:07:00 2014 +0400

    vdso: x86 -- Simplify vdso_proxify

Signed-off-by: Christopher Covington <cov@codeaurora.org>
Acked-by: Cyrill Gorcunov <gorcunov@openvz.org>
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>
cgroup: fix dereference before null check

Coverity: 1230177 Dereference before null check

There may be a null pointer dereference, or else the comparison against
null is unnecessary.  In parse_task_cgroup: All paths that lead to this
null pointer comparison already dereference the pointer earlier
(CWE-476)

Signed-off-by: Andrey Vagin <avagin@openvz.org>
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>
mount: fix dereference after null check

CID 1168169 (#1 of 1): Dereference after null check (FORWARD_NULL)
7. var_deref_model: Passing "mi" to function "do_bind_mount(struct
   mount_info *)", which dereferences null "mi->bind"

Signed-off-by: Andrey Vagin <avagin@openvz.org>
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>