tests: try again when waitpid() sets errno as EINTR

when waitpid() is interrupted, errno is not set to the negative
value -EINTR. It is set to EINTR. check against EINTR.

Signed-off-by: Arjun Sreedharan <arjun024@gmail.com>
Acked-by: Stéphane Graber <stgraber@ubuntu.com>
audit: added capacity and reserve() to nlmsg

There are now two (permitted) ways to add data to netlink message:

 1. put_xxx()
 2. call nlmsg_reserve() to get a pointer to newly reserved room within the
    original netlink message, then write or memcpy data to that area.

Both of them guarantee adding requested length data do not overflow the
pre-allocated message buffer by checking against its cap field first.

And there may be no need to access nlmsg_len outside nl module, because both
put_xxx() and nlmsg_reserve() have alread did that for us.

Signed-off-by: Shuai Zhang <zs.broccoli@gmail.com>
Acked-by: Stéphane Graber <stgraber@ubuntu.com>
rmdir and lxc_unpriv returns non-negative error codes

Signed-off-by: S.Çağlar Onur <caglar@10ur.org>
Acked-by: Stéphane Graber <stgraber@ubuntu.com>
typofixes - https://github.com/vlajos/misspell_fixer

Signed-off-by: Veres Lajos <vlajos@gmail.com>
Acked-by: Stéphane Graber <stgraber@ubuntu.com>
change version to 1.0.7 in configure.ac

Signed-off-by: Stéphane Graber <stgraber@ubuntu.com>
lxc-opensuse: default release changed to 13.1, as 12.3 reaches  end-of-life soon

Signed-off-by: Johannes Kastl <git@ojkastl.de>
Acked-by: Stéphane Graber <stgraber@ubuntu.com>
lxc-opensuse: Disable building openSUSE containers on 13.2/Tumbleweed only if wrong version of build package is installed

Signed-off-by: Johannes Kastl <git@ojkastl.de>
Acked-by: Stéphane Graber <stgraber@ubuntu.com>
seccomp: add rule to reject umount -f

If a container has a bind mount from a host nfs or fuse
filesystem, and does 'umount -f', it will disconnect the
host's filesystem.  This patch adds a seccomp rule to
block umount -f from a container.  It also adds that rule
to the default seccomp profile.

Thanks stgraber for the idea :)

Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
Acked-by: Stéphane Graber <stgraber@ubuntu.com>
Enable seccomp by default for unprivileged users.

In contrast to what the comment above the line disabling it said,
it seems to work just fine.  It also is needed on current kernels
(until Eric's patch hits upstream) to prevent unprivileged containers
from hosing fuse filesystems they inherit.

Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
Acked-by: Stéphane Graber <stgraber@ubuntu.com>