python3: Deal with potential NULL char* Closes #1466 Signed-off-by: Stéphane Graber <stgraber@ubuntu.com>

Fixed - set PyErr when Container.__init__ fails When container init failed for whatever reason, previously it resulted in a `SystemError: NULL result without error in PyObject_Call` This will now result in a RuntimeError with the error message previously printed to stderr. Signed-off-by: Aron Podrigal <aronp@guaranteedplus.com>

python-lxc: Call PyOS_AfterFork after attaching to a container As lxc_attach() calls fork() PyOS_AfterFork should be called in the new process if the Python interpreter will continue to be used. Signed-off-by: Danil Osherov <shindo@yandex-team.ru>

Fix indentation I've noticed that a bunch of the code we've included over the past few weeks has been using 8-spaces rather than tabs, making it all very hard to read depending on your tabstop setting. This commit attempts to revert all of that back to proper tabs and fix a few more cases I've noticed here and there. No functional changes are included in this commit. Signed-off-by: Stéphane Graber <stgraber@ubuntu.com>

add bdevtype to lxc create procedure Signed-off-by: Bieliaievskyi Sergey magelan09@gmail.com

Bug #158: Deletion of unnecessary checks before calls of the function "free" The function "free" is documented in the way that no action shall occur for a passed null pointer. It is therefore not needed that a function caller repeats a corresponding check. http://stackoverflow.com/questions/18775608/free-a-null-pointer-anyway-or-check-first This issue was fixed by using the software Coccinelle 1.0.0-rc23. Signed-off-by: Markus Elfring <elfring@users.sourceforge.net> Acked-by: Stéphane Graber <stgraber@ubuntu.com>

python-lxc: Add [at|de]tach_interface() to python binding. Changelog: 10/15/2014: serge: make ifname mandatory for detach_interface. Signed-off-by: Dongsheng Yang <yangds.fnst@cn.fujitsu.com> Acked-by: Serge E. Hallyn <serge.hallyn@ubuntu.com>

Fix build error(ISO C90 specs violation) in lxc.c This patch fixes following build errors. running build_ext building '_lxc' extension creating build/temp.linux-x86_64-3.4 gcc -pthread -Wno-unused-result -Werror=declaration-after-statement -DDYNAMIC_ANNOTATIONS_ENABLED=1 -DNDEBUG -g -fwrapv -O3 -Wall -Wstrict-prototypes -march=x86-64 -mtune=generic -O2 -pipe -fstack-protector-strong --param=ssp-buffer-size=4 -fPIC -I../../src -I../../src -I/usr/include/python3.4m -c lxc.c -o ./build/temp.linux-x86_64-3.4/lxc.o lxc.c: In function ‘convert_tuple_to_char_pointer_array’: lxc.c:49:5: error: ISO C90 forbids mixed declarations and code [-Werror=declaration-after-statement] char **result = (char**) calloc(argc + 1, sizeof(char*)); ^ lxc.c:60:9: error: ISO C90 forbids mixed declarations and code [-Werror=declaration-after-statement] char *str = NULL; ^ lxc.c: In function ‘Container_get_cgroup_item’: lxc.c:822:5: error: ISO C90 forbids mixed declarations and code [-Werror=declaration-after-statement] char* value = (char*) malloc(sizeof(char)*len + 1); ^ lxc.c: In function ‘Container_get_config_item’: lxc.c:861:5: error: ISO C90 forbids mixed declarations and code [-Werror=declaration-after-statement] char* value = (char*) malloc(sizeof(char)*len + 1); ^ lxc.c: In function ‘Container_get_keys’: lxc.c:903:5: error: ISO C90 forbids mixed declarations and code [-Werror=declaration-after-statement] char* value = (char*) malloc(sizeof(char)*len + 1); ^ cc1: some warnings being treated as errors error: command 'gcc' failed with exit status 1 Makefile:472: recipe for target 'all' failed make[3]: *** [all] Error 1 make[3]: Leaving directory '/home/masami/codes/lxc/src/python-lxc' Makefile:394: recipe for target 'all-recursive' failed make[2]: *** [all-recursive] Error 1 make[2]: Leaving directory '/home/masami/codes/lxc/src' Makefile:338: recipe for target 'all' failed make[1]: *** [all] Error 2 make[1]: Leaving directory '/home/masami/codes/lxc/src' Makefile:484: recipe for target 'all-recursive' failed make: *** [all-recursive] Error 1 build env: distribution: Arch Linux gcc version 4.9.1 20140903 (prerelease) (GCC) Signed-off-by: Masami Ichikawa <masami256@gmail.com> Acked-by: Stéphane Graber <stgraber@ubuntu.com>

Fix attach_wait and threads Signed-off-by: Dorian Eikenberg <dorian.eikenberg@uni-duesseldorf.de> Acked-by: Serge E. Hallyn <serge.hallyn@ubuntu.com> Acked-by: Stéphane Graber <stgraber@ubuntu.com>

python3: Fix crashes in snapshot() This makes sure all PyObject structs are always initialized to NULL, this will fix issues such as (issue #239). Also add a snapshot/list/restore testcase to the python3 api test code. Signed-off-by: Stéphane Graber <stgraber@ubuntu.com> Acked-by: Serge E. Hallyn <serge.hallyn@ubuntu.com>

python3: Handle invalid global config keys Signed-off-by: Stéphane Graber <stgraber@ubuntu.com> Acked-by: Serge E. Hallyn <serge.hallyn@ubuntu.com>

python3: Don't require a template name The template name isn't required, if it's not passed, then create will simply be asked to create a container without a rootfs. Signed-off-by: Stéphane Graber <stgraber@ubuntu.com> Acked-by: Serge E. Hallyn <serge.hallyn@ubuntu.com>

python3: Add missing get_running_config_item binding Signed-off-by: Stéphane Graber <stgraber@ubuntu.com> Acked-by: Serge E. Hallyn <serge.hallyn@ubuntu.com>

shutdown: Rework API and lxc-stop With this change, shutdown() will no longer call stop() after the timeout, instead it'll just return false and it's up to the caller to then call stop() if appropriate. This also updates the bindings, tests and other scripts. lxc-stop is then updated to do proper option checking and use shutdown, stop or reboot as appropriate. Signed-off-by: Stéphane Graber <stgraber@ubuntu.com> Acked-by: Serge E. Hallyn <serge.hallyn@ubuntu.com>

Fix handling of empty config keys Signed-off-by: Stéphane Graber <stgraber@ubuntu.com> Acked-by: Serge E. Hallyn <serge.hallyn@ubuntu.com>

python3: binding update This adds rename(new_name) to the binding as well as two new const, LXC_CLONE_KEEPBDEVTYPE and LXC_CLONE_MAYBE_SNAPSHOT. Signed-off-by: Stéphane Graber <stgraber@ubuntu.com> Acked-by: Serge E. Hallyn <serge.hallyn@ubuntu.com>

Re-organize API for global lxc.conf config Instead of having one function for each possible key in lxc.conf which doesn't really scale and requires an API update for every new key, switch to a generic lxc_get_global_config_item() function which takes a key name as argument. Signed-off-by: Stéphane Graber <stgraber@ubuntu.com> Acked-by: Serge E. Hallyn <serge.hallyn@ubuntu.com>

adjust include statements (v2) Use "#include <somefile.h>" style for external or exported headers only. changes since v1: - adjusted formatting as Stéphane suggested Signed-off-by: S.Çağlar Onur <caglar@10ur.org> Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>

remove LXC_CLONE_COPYHOOKS and make lxcapi_clone to copy hooks unconditionally (v3) changes since v1; incorporated Serge's changes changes since v2; added missing Signed-off-by Signed-off-by: S.Çağlar Onur <caglar@10ur.org> Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>

Allow unsetting daemonize and close_fds As mentioned in a previous commit, this does two changes: - Make want_daemonize return a bool (false on failure, true on success) - Make both want_daemonize and want_close_all_fds take a "state" argument so the user can choose to unset those flags. This commit also updates all occurences of those two functions and turns the daemonize attribute from an int to a bool. Signed-off-by: Stéphane Graber <stgraber@ubuntu.com> Acked-by: Serge Hallyn <serge.hallyn@ubuntu.com>

python3: Use FSConverter for all paths Signed-off-by: Stéphane Graber <stgraber@ubuntu.com> Acked-by: Serge E. Hallyn <serge.hallyn@ubuntu.com>

python3: Allow setting daemonize and close_fds This extends the list of arguments of start() allowing the user to request the container be started in the foreground and have control on whether fds will be closed or not (daemonize=True implies that too). One problem at the moment however is that while we have functions to set close_fds and daemonize in the API, we don't have functions to unset those flags, so those new parameters will only work on the initial call to start() any further call will use the values of the previous one. I think it'd make sense to change lxcapi slightly to have daemonize and close_fds offer a similar interface, both returning booleans and both accepting a value as a parameter so API users can set the value they want. Signed-off-by: Stéphane Graber <stgraber@ubuntu.com> Acked-by: Serge E. Hallyn <serge.hallyn@ubuntu.com>

python3: Add snapshot_* to the binding Signed-off-by: Stéphane Graber <stgraber@ubuntu.com> Acked-by: Serge E. Hallyn <serge.hallyn@ubuntu.com>

python3: Allow passing create flags Signed-off-by: Stéphane Graber <stgraber@ubuntu.com> Acked-by: Serge E. Hallyn <serge.hallyn@ubuntu.com>

python3: Add clone() to the binding Signed-off-by: Stéphane Graber <stgraber@ubuntu.com> Acked-by: Serge E. Hallyn <serge.hallyn@ubuntu.com>

python3: Sort list of exports Signed-off-by: Stéphane Graber <stgraber@ubuntu.com>

python3: Add (add|remove)_device_node Signed-off-by: Stéphane Graber <stgraber@ubuntu.com> Acked-by: Serge E. Hallyn <serge.hallyn@ubuntu.com>

python3: Add controllable property to the binding Signed-off-by: Stéphane Graber <stgraber@ubuntu.com> Acked-by: Serge E. Hallyn <serge.hallyn@ubuntu.com>

python3: Add clear_config() to the binding Signed-off-by: Stéphane Graber <stgraber@ubuntu.com> Acked-by: Serge E. Hallyn <serge.hallyn@ubuntu.com>

python3: Re-order all functions This properly regroups the module functions together and then sorts all other functions alphabetically to match the function and property lists. Signed-off-by: Stéphane Graber <stgraber@ubuntu.com> Acked-by: Serge E. Hallyn <serge.hallyn@ubuntu.com>

python3: Add reboot() to the binding Signed-off-by: Stéphane Graber <stgraber@ubuntu.com> Acked-by: Serge E. Hallyn <serge.hallyn@ubuntu.com>

python3: Sort all method/property lists Signed-off-by: Stéphane Graber <stgraber@ubuntu.com> Acked-by: Serge E. Hallyn <serge.hallyn@ubuntu.com>

python3: Code style Drop any tab as spaces are preferred, get everything to fit the 80char limit. Signed-off-by: Stéphane Graber <stgraber@ubuntu.com> Acked-by: Serge E. Hallyn <serge.hallyn@ubuntu.com>

python3: Add list_containers to C API This adds a new list_containers function to the python3 binding and a matching override in __init__.py that adds the as_object parameter. This should be compatible to the previous pure python implementation with the advantage of also listing active non-defined containers (fixing github issue #68). Signed-off-by: Stéphane Graber <stgraber@ubuntu.com> Acked-by: Serge E. Hallyn <serge.hallyn@ubuntu.com>

support setting lsm label at exec or immediately - Add attach test cases - Moved setting of LSM label later to avoid failure of IPC between parent and child during attach Signed-off-by: Dwight Engen <dwight.engen@oracle.com> Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>

Add get_interfaces to the API get_ips accepts an interface name as a parameter but there was no way to get the interfaces names from the container. This patch introduces a new get_interfaces call to the API so that users can obtain the name of the interfaces. Support for python bindings also introduced as a part of this version. Signed-off-by: S.Çağlar Onur <caglar@10ur.org> Acked-by: Stéphane Graber <stgraber@ubuntu.com>

licensing: Add missing headers and FSF address Signed-off-by: Stéphane Graber <stgraber@ubuntu.com>

python/attach: Add function that returns personality for architecture Adds the arch_to_personality function that looks up an architecture and returns the corresponding personality. This may be used in conjunction with the attach/attach_wait keyword argument. Signed-off-by: Christian Seiler <christian@iwakd.de> Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>

python/attach: export CLONE_NEW* constants to Python Signed-off-by: Christian Seiler <christian@iwakd.de> Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>

python/attach: Fix minor memory leaks Signed-off-by: Christian Seiler <christian@iwakd.de> Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>

Remove all trailing whitespaces Signed-off-by: Stéphane Graber <stgraber@ubuntu.com>

python: add attach support Add methods attach() and attach_wait() to the Python API that give access to the attach functionality of LXC. Both accept two main arguments: 1. run: A python function that is executed inside the container 2. payload: (optional) A parameter that will be passed to the python function Additionally, the following keyword arguments are supported: attach_flags: How attach should operate, i.e. whether to attach to cgroups, whether to drop capabilities, etc. The following constants are defined as part of the lxc module that may be OR'd together for this option: LXC_ATTACH_MOVE_TO_CGROUP LXC_ATTACH_DROP_CAPABILITIES LXC_ATTACH_SET_PERSONALITY LXC_ATTACH_APPARMOR LXC_ATTACH_REMOUNT_PROC_SYS LXC_ATTACH_DEFAULT namespaces: Which namespaces to attach to, as defined as the flags that may be passed to the clone(2) system call. Note: maybe we should export these flags too. personality: The personality of the process, it will be passed to the personality(2) syscall. Note: maybe we should provide access to the function that converts arch into personality. initial_cwd: The initial working directory after attaching. uid: The user id after attaching. gid: The group id after attaching. env_policy: The environment policy, may be one of: LXC_ATTACH_KEEP_ENV LXC_ATTACH_CLEAR_ENV extra_env_vars: A list (or tuple) of environment variables (in the form KEY=VALUE) that should be set once attach has succeeded. extra_keep_env: A list (or tuple) of names of environment variables that should be kept regardless of policy. stdin: A file/socket/... object that should be used as stdin for the attached process. (If not a standard Python object, it has to implemented the fileno() method and provide a fd as the result.) stdout, stderr: See stdin. attach() returns the PID of the attached process, or -1 on failure. attach_wait() returns the return code of the attached process after that has finished executing, or -1 on failure. Note that if the exit status of the process is 255, -1 will also be returned, since attach failures result in an exit code of 255. Two default run functions are also provided in the lxc module: attach_run_command: Runs the specified command attach_run_shell: Runs a shell in the container Examples (assumeing c is a Container object): c.attach_wait(lxc.attach_run_command, 'id') c.attach_wait(lxc.attach_run_shell) def foo(): print("Hello World") # the following line is important, otherwise the exit code of # the attached program will be -1 # sys.exit(0) will also work return 0 c.attach_wait(foo) c.attach_wait(lxc.attach_run_command, ['cat', '/proc/self/cgroup']) c.attach_wait(lxc.attach_run_command, ['cat', '/proc/self/cgroup'], attach_flags=(lxc.LXC_ATTACH_DEFAULT & ~lxc.LXC_ATTACH_MOVE_TO_CGROUP)) Note that while it is possible to execute Python code inside the container by passing a function (see example), it is unwise to import modules, since there is no guarantee that the Python installation inside the container is in any way compatible with that outside of it. If you want to run Python code directly, please import all modules before attaching and only use them within the container. Signed-off-by: Christian Seiler <christian@iwakd.de> Acked-by: Serge E. Hallyn <serge.hallyn@ubuntu.com>

python: improve convert_tuple_to_char_pointer_array convert_tuple_to_char_pointer_array now also accepts lists and not only tuples when converting to a C array. Other fixes: - some checking that it's actually a list/tuple before trying to convert - off-by-a-few-bytes allocation error (sizeof(char *)*n+1 vs. sizeof(char *)*(n+1)/calloc(...)) Signed-off-by: Christian Seiler <christian@iwakd.de> Acked-by: Serge E. Hallyn <serge.hallyn@ubuntu.com>

create: add a quiet flag If set, then fds 0,1,2 will be redirected while the creation template is executed. Note, as Dwight has pointed out, if fd 0 is redirected, then if templates ask for input there will be a problem. We could simply not redirect fd 0, or we could require that templates work without interaction. I'm assuming here that we want to do the latter, but I'm open to changing that. Reported-by: "S.Çağlar Onur" <caglar@10ur.org> Acked-by: Stéphane Graber <stgraber@ubuntu.com> Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>

console API improvements Add a higher level console API that opens a tty/console and runs the mainloop as well. Rename existing API to console_getfd(). Use these in the python binding. Allow attaching a console peer after container bootup, including if the container was launched with -d. This is made possible by allocation of a "proxy" pty as the peer when the console is attached to. Improve handling of SIGWINCH, the pty size will be correctly set at the beginning of a session and future changes when using the lxc_console() API will be propagated to it as well. Refactor some common code between lxc_console.c and console.c. The variable wait4q (renamed to saw_escape) was static, making the mainloop callback not safe across threads. This wasn't a problem when the callback was in the non-threaded lxc-console, but now that it is internal to console.c, we have to take care of it. This is now contained in a per-tty state structure. Don't attempt to open /dev/null as the console peer since /dev/null cannot be added to the mainloop (epoll_ctl() fails with EPERM). This isn't needed to get the console setup (and the log to work) since the case of not having a peer at console init time has to be handled to allow for attaching to it later. Move signalfd libc wrapper/replacement to utils.h. Signed-off-by: Dwight Engen <dwight.engen@oracle.com> Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>

Move container creation fully into the api 1. implement bdev->create: python and lua: send NULL for bdevtype and bdevspecs. They'll want to be updated to pass those in in a way that makes sense, but I can't think about that right now. 2. templates: pass --rootfs If the container is backed by a device which must be mounted (i.e. lvm) then pass the actual rootfs mount destination to the templates. Note that the lxc.rootfs can be a mounted block device. The template should actually be installing the rootfs under the path where the lxc.rootfs is *mounted*. Still, some people like to run templates by hand and assume purely directory backed containers, so continue to support that use case (i.e. if no --rootfs is listed). Make sure the templates don't re-write lxc.rootfs if it is already in the config. (Most were already checking for that) 3. Replace lxc-create script with lxc_create.c program. Changelog: May 24: when creating a container, create $lxcpath/$name/partial, and flock it. When done, close that file and unlink it. In lxc_container_new() and lxcapi_start(), check for this file. If it is locked, create is ongoing. If it exists but is not locked, create() was killed - remove the container. May 24: dont disk-lock during lxcapi_create. The partial lock is sufficient. Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>

lxcapi: Add new get_ips() call This adds a new get_ips call which takes a family (inet, inet6 or NULL), a network interface (or NULL for all) and a scope (0 for global) and returns a char** of all the IPs in the container. This also adds a matching python3 binding (function result is a tuple) and deprecates the previous pure-python get_ips() implementation. WARNING: The python get_ips() call is quite different from the previous implementation. The timeout argument has been removed, the family names are slightly different (inet/inet6 vs ipv4/ipv6) and an extra scope parameter has been added. Signed-off-by: Stéphane Graber <stgraber@ubuntu.com> Acked-by: Serge E. Hallyn <serge.hallyn@ubuntu.com>

python: Make the code compatibly with 3.2 The previous change used some 3.3-specific functions. We still support 3.2 so revert to 3.2-compatible calls. Reported-by: S.Çağlar Onur <caglar@10ur.org> Signed-off-by: Stéphane Graber <stgraber@ubuntu.com> Acked-by: Serge E. Hallyn <serge.hallyn@ubuntu.com>

python: Fix convert_tuple_to_char_pointer_array This finally fixes a few issues with the magic convert_tuple_to_char_pointer_array function. This now clearly copies the char* from the python object so we don't end up keeping reference to those. Also add the few required free calls to free the content of the array. Signed-off-by: Stéphane Graber <stgraber@ubuntu.com> Acked-by: Serge E. Hallyn <serge.hallyn@ubuntu.com>

python: Lots of fixes in C extension Fixes a lot of issues found by a code review done by Barry Warsaw. Those include: - Wrong signature for getters - Various memory leaks - Various optimizations - More consistent return values - Proper exception handling Signed-off-by: Stéphane Graber <stgraber@ubuntu.com> Reported-by: Barry Warsaw <barry@ubuntu.com> Acked-by: Barry Warsaw <barry@ubuntu.com> Acked-by: Serge E. Hallyn <serge.hallyn@ubuntu.com>

python: Fix memory management Signed-off-by: Stéphane Graber <stgraber@ubuntu.com>

python: Fix runtime failure on armhf Recent testing on Ubuntu armhf showed that the python module was failing to import. After some time tracking the issue down, the problem was identified as being a non-terminated list of get/setters. This commit fixes that issue as well as a few other potential ones that were identified during debugging. Signed-off-by: Stéphane Graber <stgraber@ubuntu.com> Acked-by: Serge E. Hallyn <serge.hallyn@ubuntu.com>

python: Add get_version to binding Signed-off-by: Stéphane Graber <stgraber@ubuntu.com> Acked-by: Serge E. Hallyn <serge.hallyn@ubuntu.com>

python: Don't hardcode LXCPATH in python module Signed-off-by: Stéphane Graber <stgraber@ubuntu.com> Acked-by: Serge E. Hallyn <serge.hallyn@ubuntu.com>

python-lxc: Update for new calls Add the two new calls to the API and add the new container_path parameter to the constructor (optional). This also extends list_containers to support the config_path parameter. At this point none of the actual tools are changed to make use of those as we'll probably want to make sure all the tools get the extra option at once. Signed-off-by: Stéphane Graber <stgraber@ubuntu.com> Tested-by: Serge E. Hallyn <serge.hallyn@ubuntu.com> Acked-by: Serge E. Hallyn <serge.hallyn@ubuntu.com>

lxc api: fix some config_path oddities 1. When calling c->set_config_path(), update configfile. I.e. if we are setting the config_path to /var/lib/lxc, then the configfile should be changed to /var/lib/lxc/$container/config 2. Add an optional configpath argument to lxc_container_new. If NULL, then the default will be used (as before). If set, then the passed-in path will be used. This way you can do c1 = lxc.Container("r1", "/var/lib/lxc"); c2 = lxc.Container("r2", "/home/user/lxcbase"); (Note I did *not* implement the python or lua binding to pass that argument along) Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com> Acked-by: Stéphane Graber <stgraber@ubuntu.com>

python: Add binding for {get|set}_cgroup_item Updates the binding for the two new functions. This also fixes some problems with the argument checking of get_config_item that'd otherwise lead to a segfault. The python binding for set_cgroup_item and get_cgroup_item are pretty raw as lxc has little control over the cgroup entries. That means that we don't try to interpret lists as we do for the config entries. Signed-off-by: Stéphane Graber <stgraber@ubuntu.com> Acked-by: Serge E. Hallyn <serge.hallyn@ubuntu.com>

python-lxc: Add missing space between two help lines One character fix making the documentation readable in help() Signed-off-by: Stéphane Graber <stgraber@ubuntu.com>

Remove zombie_handler from python-lxc code This code was addeed to deal with stopped/dead containers but really shouldn't be implemented there. Instead the setsid() call in start() should be enough to prevent python from getting the SIGCHLD and having to deal with it.

Add python-lxc based on the new liblxc API. This adds a basic python binding done in C and a python overlay to extend some features and provide a user-friendlier API. This python API only supports python 3.x and was tested with >= 3.2. It's disabled by default in configure and can be turned on by using --enable-python. A basic example of the API can be found in src/python-lxc/test.py. More documentation and examples will be added soon.