Currently if a network namespace is dumped and something fails, sockets
remain in repair mode. It's because cpt_unlock_tcp_connections is
executed only if network namespace is not dumped.

cpt_unlock_tcp_connections disables repair mode for sockets and drops
netfilters. netfilters are not used in case of network namespaces.

v2: don't execute network-unlock scripts, if network namespace are not
    dumped.
Signed-off-by: Andrey Vagin <avagin@openvz.org>
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>

Signed-off-by: Cyrill Gorcunov <gorcunov@openvz.org>
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>

These are inherited from parent on fork(), thus need to put them in
clean state.
Signed-off-by: Ruslan Kuprieiev <kupruser@gmail.com>
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>

Signed-off-by: Ruslan Kuprieiev <kupruser@gmail.com>
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>

Signed-off-by: Pavel Emelyanov <xemul@parallels.com>

The only place left, that runs parasite by hands -- unmap().
Now we can use parasite_run() for that.
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>

Signed-off-by: Pavel Emelyanov <xemul@parallels.com>

Signed-off-by: Pavel Emelyanov <xemul@parallels.com>

Signed-off-by: Pavel Emelyanov <xemul@parallels.com>

This one keeps registers and sigmask for running thread. Will
be used for simpler parasite management.
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>

In case if we need to use vdso proxy the memory area
which holds restorer also has a place for vdso proxy
code itself, so on final pass we should not unmap it,
otherwise any call to vdso function will cause sigsegv.

IOW, the memory before final "cleanup" pass of restorer
might look as

    +-----------+---------+     +-------------+------+
    | bootstrap | rt-vdso | ... | application | vdso |
    +-----------+---------+     +-------------+------+
                       ^                         |
                       `-------------------------+

and we have redirected "vdso" code to jump to "rt-vdso".
After final pass the memory must look as

                +---------+     +-------------+------+
                | rt-vdso | ... | application | vdso |
                +---------+     +-------------+------+
                       ^                         |
                       `-------------------------+

I noticed this problem during container migration
testing, the container itself was suspended on 2.6.32
OpenVZ kernel with apache running inside, and any attempt
to connect to apache caused apache to crash.
Signed-off-by: Cyrill Gorcunov <gorcunov@openvz.org>
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>

The ctl->sig_blocked in this place is the same as sigframe's one,
as ctl's one was copied into sigframe's few steps before.
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>

Signed-off-by: Pavel Emelyanov <xemul@parallels.com>

Signed-off-by: Pavel Emelyanov <xemul@parallels.com>

Signed-off-by: Pavel Emelyanov <xemul@parallels.com>

Signed-off-by: Pavel Emelyanov <xemul@parallels.com>

Signed-off-by: Pavel Emelyanov <xemul@parallels.com>

If parasite exited unexpectedly, CRIU gets SIGCHLD and handles it.
In sigchld handler we need to wait any child process.
Currently criu waits neighbours in its group, but a dumped
processes is in another group usually. Here is a typo.
Signed-off-by: Andrey Vagin <avagin@openvz.org>
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>

As planned, this was bugfix-mainly release. However, some new
features were added. Looking forward the v1.0 release :)
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>

Signed-off-by: Pavel Emelyanov <xemul@parallels.com>

There can be a more sophisticated security policy, but right now
generic non-root user doesn't have any bits in there, so requiring
them to be zero is a sane starting point.
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>

There's ... a number of places where we want to do something
with /proc/self/fd/%d path. Each time we guess buffer size
that is enough for this. Make standard constant for this and
save some space on stack and drop args for some functions.
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>

Signed-off-by: Pavel Emelyanov <xemul@parallels.com>

Signed-off-by: Pavel Emelyanov <xemul@parallels.com>

CRIU puts wd-s for one inotify in one row (one after another),
so when collecting next wd, we can find the ify to attach them
to faster.
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>

The inotify_add_watch generates wd-s one-by one. We cannot
request for one, thus we call this syscall till the required
wd is generated.

Thus, if we want to restore several wd-s for an inotify, we
have to put them in ascending order. Otherwise we may restore
watch with higher wd earlier and will thus not be able to
generate the lower wd in a reasonable time.
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>

Signed-off-by: Pavel Emelyanov <xemul@parallels.com>

Signed-off-by: Pavel Emelyanov <xemul@parallels.com>

Signed-off-by: Pavel Emelyanov <xemul@parallels.com>

This can be broken image, need to handle this error gracefully.
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>

Handle the simplest (remap) case early. This makes code
simpler and reduces one level of indent.
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>

Signed-off-by: Pavel Emelyanov <xemul@parallels.com>

Signed-off-by: Pavel Emelyanov <xemul@parallels.com>

Convenient for debug.

 | (00.005999)   3857: fsnotify:           Restore inotify watch for 0x00800002:0x0000000000000002 (via /proc/self/fd/5 -> /)
 | (00.005999)   3857: fsnotify:           Restore inotify watch for 0x00800002:0x0000000000083a93 (via /home/criu/test/zdtm/live/static/inotify-removed (deleted).cr.1.ghost)
Signed-off-by: Cyrill Gorcunov <gorcunov@openvz.org>
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>

Hi!

Added "has_log_level = true" to test.c, so "log_level = 4" would have effect.
Also added log_level to test.py, for symmetry with test.c.
Signed-off-by: Ruslan Kuprieiev <kupruser@gmail.com>
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>

Otherwise

 | Error (proc_parse.c:227): Can't parse: 555555554000-555555577000 r-xp 00000000 b6:d2f61 133545                  /sbin/init
Signed-off-by: Cyrill Gorcunov <gorcunov@openvz.org>
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>

Signed-off-by: Pavel Emelyanov <xemul@parallels.com>

Igor reported the following file lock

 | (00.003139) lockinfo: 4:POSIX ADVISORY WRITE 46567 b6:5f0b1:524702 0 EOF
 | (00.003154) lockinfo: 5:POSIX ADVISORY WRITE 46559 b6:5f0b1:524661 0 EOF
 | (00.003172) lockinfo: 6:POSIX ADVISORY WRITE 46543 b6:5f0b1:524326 0 0
 | (00.003188) lockinfo: 7:POSIX ADVISORY WRITE 46543 b6:5f0b1:524367 0 EOF

where device maj number is pretty big and parsing failed.
Fix it removing field width.
Reported-by: Igor Sukhih <igor@parallels.com>
Signed-off-by: Cyrill Gorcunov <gorcunov@openvz.org>
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>

Logs are put into dedicated logfd, cwd is not used as well.
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>

This is where such stuff is typically placed.
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>