cgmanager chown: close socketpair on error paths

Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
Acked-by: Stéphane Graber <stgraber@ubuntu.com>
upstart: Make sure FORWARD is allowed for containers

Signed-off-by: Stéphane Graber <stgraber@ubuntu.com>
Acked-by: Serge E. Hallyn <serge.hallyn@ubuntu.com>
bdev: Rename mount_unknow_fs to mount_unknown_fs

Signed-off-by: Stéphane Graber <stgraber@ubuntu.com>
Acked-by: Serge E. Hallyn <serge.hallyn@ubuntu.com>
doc: lxc-info -c doesn't require RUNNING

Signed-off-by: Stéphane Graber <stgraber@ubuntu.com>
use susv3 head arguments

Without enabling INCLUDE_SUSv2 in busybox, we need to use head's -n argument,
rather than -#.

Signed-off-by: Christopher Larson <kergoth@gmail.com>
Acked-by: Stéphane Graber <stgraber@ubuntu.com>
Fix lxc-stop's argument parsing

Change lxc-stop's argument parsing so that it matches what the help option
and the man page both describe.

Signed-off-by: Robert Vogelgesang <vogel@users.sourceforge.net>
Acked-by: Stéphane Graber <stgraber@ubuntu.com>
lxc-ubuntu-cloud: various small changes

 * ppc64el images now exist and generally function.
   Instead of failing because an arch isnt in the list,
   let that check happen by ability to download something.
 * update the hard coded ubuntu releases to know about 'trusty'
   and drop no longer supported releases (consistent with behavior
   when distro-info is available)
 * shorten the logic that decides if host and container arch
   are supported.
 * support skipping "invalid arch" check entirely via undocumented
   variable UCTEMPLATE_SKIP_ARCH_CHECK.
 * update usage to reference 'tryreleased' as the default 'stream'
 * give good error message if user tries 'released' and there
   is no released version available.

Signed-off-by: Scott Moser <smoser@ubuntu.com>
Acked-by: Stéphane Graber <stgraber@ubuntu.com>
lxc-ubuntu-cloud: Update arm* cross

| host arch | arm64 | armhf | armel |
-------------------------------------
| arm64     |   X   |   X   |   X   |
| armhf     |       |   X   |   X   |
| armel     |       |   X   |   X   |
-------------------------------------

Although optional, all existing arm64 silicon supports 32bit instructions.
armel/armhf is only a userspace change, so they are interchangeable.
However armhf isn't supported on all armel platforms (e.g. armv6) but
all those we support have hard-float.

Signed-off-by: Stéphane Graber <stgraber@ubuntu.com>
cgmanager: implement attach

The cgroupfs-specific code is moved from attach.c to cgroup.c.

lxc-cgmanager now only chgrps the container's cgroup, so that the
unprivileged user still owns the tasks file allowing him to enter
the container cgroup (for attach).

Some other changes rolled into the cgmanager update:

Make the list of subsystems not per-handler, as it will not change.  As
a result, the only state we need to keep in the per-handler cgroup data
is the char *cgroup_path, so we can drop the cgm_data struct altogether.

Catch nih errors (as not doing so causes later crashes).

Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
Acked-by: Stéphane Graber <stgraber@ubuntu.com>
cgmanager: support lxc.mount.auto = cgroup

If it (or any variation thereof) is in the container configuration,
then mount /sys/fs/cgroup/cgmanager.lower (if it exists) or
/sys/fs/cgroup/cgmanager into the container so it can run a
cgproxy.

Also make sure to clear our groups when we start or attach to a
container.  Else with unprivileged containers we end up with
lots of nogroups listed in /proc/1/status.

Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
Acked-by: Stéphane Graber <stgraber@ubuntu.com>
cgroup: change unfreeze_fromhandler to return bool

To be more consistent with other cgroup_ops methods, in the hopes
of having less return-value-related mixups.

Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
Acked-by: Stéphane Graber <stgraber@ubuntu.com>
specify mode whenever mounting tmpfs

Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
Acked-by: Stéphane Graber <stgraber@ubuntu.com>
lxc_info: Fix -H with -c

Signed-off-by: Stéphane Graber <stgraber@ubuntu.com>
Acked-by: Serge E. Hallyn <serge.hallyn@ubuntu.com>
Implement lxc.rootfs.options

This introduces a new lxc.rootfs.options which lets you pass new
mountflags/mountdata when mounting the root filesystem.

Signed-off-by: Stéphane Graber <stgraber@ubuntu.com>
Acked-by: Serge E. Hallyn <serge.hallyn@ubuntu.com>
Fix the timeout == 0 case in lxcapi_shutdown()

The timeout argument should be handled as follows:
   -1 => Wait forever
    0 => Don't wait
  > 0 => Wait for timeout seconds

Without this patch, the 0 case is mapped to -1.

Signed-off-by: Robert Vogelgesang <vogel@users.sourceforge.net>
Acked-by: Stéphane Graber <stgraber@ubuntu.com>
cgmanager: chmod the container's base directory 775

In order for attach to work, the container owner must be able to
write to the tasks file.  Therefore we make the container's cgroup
owned by the container root group, but the container owner uid.
So for the container root to be allowed to create new cgroups, it
needs group write perms.

With this patch, an unprivileged container with an
lxc.mount.auto = cgroup entry entry can run the cgproxy and pass
all cgmanager tests.

Acls would have been another way to do this, but are not yet being
used/exported by cgmanager.

Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
Acked-by: Stéphane Graber <stgraber@ubuntu.com>
shutdown: Rework API and lxc-stop

With this change, shutdown() will no longer call stop() after the
timeout, instead it'll just return false and it's up to the caller to
then call stop() if appropriate.

This also updates the bindings, tests and other scripts.

lxc-stop is then updated to do proper option checking and use shutdown,
stop or reboot as appropriate.

Signed-off-by: Stéphane Graber <stgraber@ubuntu.com>
Acked-by: Serge E. Hallyn <serge.hallyn@ubuntu.com>