lxc-download: Detect unpriv created by real root

This adds yet another case in the in_userns function detecting the case
where an unprivileged container is created by the real uid 0, in which
case we want to share the system wide cache but still use the
unprivileged templates and unpack method.

Signed-off-by: Stéphane Graber <stgraber@ubuntu.com>
Acked-by: Serge E. Hallyn <serge.hallyn@ubuntu.com>
fix attach when cgroups mounted after container start

When booting an OL7 container on OL6, systemd in the OL7 container mounted
some extra cgroup controllers, which are then present in /proc/self/cgroups
of every task on the host. This is the list used by attach to determine
which cgroups to move the attached task into, but when it asks the container
over the command interface for the path to the subsystem this will fail
since the controller didn't exist when the container was first started.

Instead of failing, this change allows the attach to continue, warning that
those cgroups that could not be found won't be attached to.

The problem can be more simply reproduced by starting a busybox container,
mounting a cgroup that was not previously mounted, and then attempting
to attach to to the busybox container.

The problem will likely not manifest with cgmanager since it only requests
the path for the first controller, which is likely to always be mounted.

Signed-off-by: Dwight Engen <dwight.engen@oracle.com>
Acked-by: Serge E. Hallyn <serge.hallyn@ubuntu.com>
fix realloc() error on reboot container

The container with "lxc.network.type=phys" halted with error on reboot.

Error message:
*** glibc detected *** lxc-start: realloc(): invalid pointer: 0x0948eed0 ***

We have a sequence:

1) conf->saved_nic = relloc(NULL) on start start.c:container save_phys_nics()
2) free(conf->saved_nics) after stop container
   conf.c:lxc_rename_phys_nics_on_shutdown()
3) conf->saved_nic = relloc(conf->saved_nics) on restart container
   start.c:save_phys_nics() -> error relloc()

free(conf->saved_nics) in lxc_rename_phys_nics_on_shutdown()
unnecessary, it will be called later in lxc_clear_saved_nics().

Signed-off-by: Vitaly Lavrov <vel21ripn@gmail.com>
Acked-by: Stéphane Graber <stgraber@ubuntu.com>
bdev: do not crash if specs is NULL

Signed-off-by: S.Çağlar Onur <caglar@10ur.org>
Acked-by: Stéphane Graber <stgraber@ubuntu.com>
lxc-download: Ignore return code from subshell

The previous change fixed parsing of multiple uid/gid ranges by using a
while loop, however a failure in that loop will cause the script to exit
(due to -e), so we need to ignore the return value of the commands
inside that loop.

Signed-off-by: Stéphane Graber <stgraber@ubuntu.com>
start: Fix print_top_failing_dir for /var/lib/lxc

In the case where /var/lib/lxc itself was not accessible,
print_top_failing_dir would fail to print the error message.

This fixes it and also change the initial access check for X_OK instead
of R_OK (to match what we actually need and print_top_failing_dir's own
check).

Signed-off-by: Stéphane Graber <stgraber@ubuntu.com>
Acked-by: Serge Hallyn <serge.hallyn@ubuntu.com>
Fix unprivileged containers started by root

This change makes it possible to create unprivileged containers as root.
They will be stored in the usual system wide location, use the usual
system wide cache but will be running using a uid/gid map.

This also updates lxc_usernsexec to use the same function as the rest of
LXC, centralizing all the userns switch in a single function.

That function now detects the presence of newuidmap and newgidmap on the
system, if they are present, they will be used for containers created as
either user or root. If they're not and the user isn't root, an error is
shown. If they're not and the user is root, LXC will directly set the
uid_map and gid_map values.

All that should allow for a consistent experience as well as supporting
distributions that don't yet ship newuidmap/newgidmap.

To make things simpler in the future, an helper function "on_path" is
also introduced and used to detect the presence of newuidmap and
newgidmap.

Signed-off-by: Stéphane Graber <stgraber@ubuntu.com>
Acked-by: Serge E. Hallyn <serge.hallyn@ubuntu.com>