Signed-off-by: Andrei Vagin <avagin@gmail.com>

Currently, we rely on the fact that nobody else is using random and
parent and child processes will get the same random values.

Now, this test fails on the fedora rawhide. There will be nothing wrong
if we will generate test messages before forking the test process.
Signed-off-by: Andrei Vagin <avagin@gmail.com>

open_proc_pid(PROC_SELF) returns a non-service file descriptor,
but it can take a place of a target file descriptor.
Signed-off-by: Andrei Vagin <avagin@gmail.com>

C/R in Docker from the stable repo is broken.
Signed-off-by: Andrei Vagin <avagin@gmail.com>

Not needed since e2bd7af9Signed-off-by: Cyrill Gorcunov <gorcunov@gmail.com>
Signed-off-by: Andrei Vagin <avagin@gmail.com>

The relevant test case test_rpc_with_configuration_file_overwriting_rpc()
was actually designed around the broken behaviour. It was only working
if a previous configuration file (set via environment variable in this
case) and the RPC configuration file have the same name. The test case
which tests that RPC configuration file settings are overwriting direct
RPC settings now makes sure that no other configuration file is set via
the environment variable. If it would be set, the test case would still
succeed, even with the previous patch applied. Which is and which was the
correct behaviour.

So the main reason for this change is to test the more likely use case
that the environment based configuration file and the RPC configuration
file have different names.
Signed-off-by: Adrian Reber <areber@redhat.com>
Signed-off-by: Andrei Vagin <avagin@gmail.com>

While writing runc test cases to verify that runc correctly uses RPC
configuration files it became clear that some things were not working as
they are supposed to. Looking closer at the code to set log files
via RPC configuration files I discovered that the code seems wrong (at
least I did not understand it any more (or the intentions behind it)).

This code tries to simplify that logic a bit and add more comments to
make clear what the intentions of the RPC configuration file code is.

v2:
  - fix existing test case to test better (more correct)
  - make changes requested by Andrei
v3:
  - more changes as requested by Andrei
Signed-off-by: Adrian Reber <areber@redhat.com>
Signed-off-by: Andrei Vagin <avagin@gmail.com>

By accident I found a segfault using pre-dump in combination with the
page-server. Doing the following I was able to trigger it:

 * criu page-server -D /tmp/1
 * criu pre-dump -t PID -D /tmp/3 --track-mem
 * criu page-server -D /tmp/4 --prev-images-dir ../1
 * criu pre-dump -t PID -D /tmp/3 --track-mem
 --> segfault

...
(00.010090) Warn  (criu/image.c:134): Failed to open parent directory
...
(00.012984) Error (criu/mem.c:318): Pid-reuse detection failed: no parent inventory, check warnings in get_parent_stats
...
(00.013037) Error (criu/mem.c:544): Can't dump page with parasite
...
(00.013955) Pre-dumping tasks' memory
(00.013966) 	Pre-dumping 8793
(00.014380) Transferring pages:
Segmentation fault (core dumped)

Looking in cr-dump.c at cr_pre_dump_finish(int ret) the function gets
the return code of the previous operations in 'ret' but it is
immediately overwritten and never used.

In older CRIU versions it used to be:

	if (ret < 0)
		goto err;

but that is gone now. So this reintroduces the check for the int
parameter given to cr_pre_dump_finish() by the function caller.

As the commands used to trigged the segfault do not make much sense the
result is still not usable and the same 'Warn' and 'Error' messages are
printed, but the segfault is gone.

V2:
  * set the return value correctly
Signed-off-by: Adrian Reber <areber@redhat.com>
Signed-off-by: Andrei Vagin <avagin@gmail.com>

This avoids installing .gitignore file to compel includes.

While at it, describe why this .gitignore is needed.
Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
Signed-off-by: Andrei Vagin <avagin@gmail.com>

No need to use either -r (recursive) or -f (force).
Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
Signed-off-by: Andrei Vagin <avagin@gmail.com>

As these function is never used outside of criu/mount.c
Signed-off-by: Pavel Tikhomirov <ptikhomirov@virtuozzo.com>
Signed-off-by: Andrei Vagin <avagin@gmail.com>

rmntns_root - is fd number of opened mntns root directory, these info
doesn't help to identify mntns involved in logs, show path to these
mntns instead.
Signed-off-by: Pavel Tikhomirov <ptikhomirov@virtuozzo.com>
Signed-off-by: Andrei Vagin <avagin@gmail.com>

Signed-off-by: Mike Rapoport <rppt@linux.ibm.com>
Signed-off-by: Andrei Vagin <avagin@gmail.com>

Using --lazy-pages with pre-dump causes partial memory dump and it's not
the intention. The whole point of pre-dump is to keep amount of memory that
would be dumped during tasks freeze to minimum.

Disallow running pre-dump with --lazy-pages.
Signed-off-by: Mike Rapoport <rppt@linux.ibm.com>
Signed-off-by: Andrei Vagin <avagin@gmail.com>

Signed-off-by: Radostin Stoyanov <rstoyanov1@gmail.com>
Signed-off-by: Andrei Vagin <avagin@gmail.com>

The macro __list_for_each is equivalent to list_for_each and it is not
used anywhere.
Signed-off-by: Radostin Stoyanov <rstoyanov1@gmail.com>
Signed-off-by: Andrei Vagin <avagin@gmail.com>

The criu-lazy-migration.sh was copied from criu-lazy-pages.sh and was not
updated enough to actually run zdtm.py with --lazy-migrate.

Fix it.
Signed-off-by: Mike Rapoport <rppt@linux.ibm.com>
Signed-off-by: Andrei Vagin <avagin@gmail.com>

The lazy memory dump used by the post copy migration cleans up page pipes
and parasite from zombie tasks, although for such task they are never
initialized.
Fix it.
Signed-off-by: Mike Rapoport <rppt@linux.ibm.com>
Signed-off-by: Andrei Vagin <avagin@gmail.com>

Raw sockets may carry any protocol they want so
lets try them out.
Signed-off-by: Cyrill Gorcunov <gorcunov@gmail.com>
Signed-off-by: Andrei Vagin <avagin@gmail.com>

Otherwise there might be a raw socket with AF_INET
family and IPPROTO_ICMPV6 protocol which surely
don't have to restore it.
Signed-off-by: Cyrill Gorcunov <gorcunov@gmail.com>
Signed-off-by: Andrei Vagin <avagin@gmail.com>

Acked-by: Cyrill Gorcunov <gorcunov@gmail.com>
Signed-off-by: Radostin Stoyanov <rstoyanov1@gmail.com>
Signed-off-by: Andrei Vagin <avagin@gmail.com>

Acked-by: Cyrill Gorcunov <gorcunov@gmail.com>
Signed-off-by: Radostin Stoyanov <rstoyanov1@gmail.com>
Signed-off-by: Andrei Vagin <avagin@gmail.com>

for filename in *.c; do
    if sort "$filename" | uniq -d | grep include; then
        echo "$filename"
    fi
done
Acked-by: Cyrill Gorcunov <gorcunov@gmail.com>
Signed-off-by: Radostin Stoyanov <rstoyanov1@gmail.com>
Signed-off-by: Andrei Vagin <avagin@gmail.com>

MAP_ANON has been deprecated, use MAP_ANONYMOUS instead.

https://lkml.org/lkml/2007/2/3/55Acked-by: Cyrill Gorcunov <gorcunov@gmail.com>
Signed-off-by: Radostin Stoyanov <rstoyanov1@gmail.com>
Signed-off-by: Andrei Vagin <avagin@gmail.com>

Acked-by: Cyrill Gorcunov <gorcunov@gmail.com>
Signed-off-by: Radostin Stoyanov <rstoyanov1@gmail.com>
Signed-off-by: Andrei Vagin <avagin@gmail.com>

Acked-by: Cyrill Gorcunov <gorcunov@gmail.com>
Signed-off-by: Radostin Stoyanov <rstoyanov1@gmail.com>
Signed-off-by: Andrei Vagin <avagin@gmail.com>

Signed-off-by: Andrei Vagin <avagin@gmail.com>

Start test
Test is SUID
./socket-tcp-nfconntrack --pidfile=socket-tcp-nfconntrack.pid --outfile=socket-tcp-nfconntrack.out
Another app is currently holding the xtables lock. Perhaps you want to use the -w option?
Signed-off-by: Andrei Vagin <avagin@gmail.com>

Signed-off-by: Andrei Vagin <avagin@gmail.com>

It is expected behaviour.
Signed-off-by: Andrei Vagin <avagin@gmail.com>

The test is trying to write into a closed socket and the kernel sends
SIGPIPE in this case, which is perfectly normal and should not fail the
test.
Signed-off-by: Andrei Vagin <avagin@gmail.com>

On a system with more than 10 network interfaces the link_nsid check
fails:

$ criu check --feature link_nsid
Warn  (criu/cr-check.c:1237): NSID isn't supported

The function kerndat_link_nsid() uses:

 nde.ifindex = 10;

This fails as there is already an interface with ifindex 10.

This patch moves the creation of the socket into the second network
namespace and the feature check succeeds.
Suggested-by: Jiri Benc <jbenc@redhat.com>
Signed-off-by: Adrian Reber <areber@redhat.com>
Signed-off-by: Andrei Vagin <avagin@gmail.com>

Fixes:
verify-elf: ERROR: ./usr/lib64/libcompel.so.1.0: undefined symbol: opts
Acked-by: Cyrill Gorcunov <gorcunov@gmail.com>
Reported-by: Alexey Shabalin <>
Signed-off-by: Dmitry Safonov <dima@arista.com>
Signed-off-by: Andrei Vagin <avagin@gmail.com>

This reverts commit 6b0292e12614.

handle_binary() is needed for preparing PIE header during compilation.
If we need to provide API for building another compel binary, probably
it should be a separate library from libcompel.{a,so}

IOW, there is no sense to have handle_binary() included into CRIU.
For CRIU it's needed only during the build to generate parasite header.

Move handle_elf() to compel binary from library, as it was previously
corrected in commit 64bb75a8 ("compel: Drop off handle-elf routines
from library").
Acked-by: Cyrill Gorcunov <gorcunov@gmail.com>
Cc: Cyrill Gorcunov <gorcunov@gmail.com>
Signed-off-by: Dmitry Safonov <dima@arista.com>
Signed-off-by: Andrei Vagin <avagin@gmail.com>

Libcompel supplies to the parasite PAGE_SIZE during infection.
On ppc64/aarch64 PAGE_SIZE can be different with Large pages,
under the cover it returns __page_size.

At this moment __page_size is located in criu binary, which
prevents using libcompel as .so library in other applications
than criu on ppc64/aarch64.

Export __page_size and __page_shift in libcompel.

Fixes: #572
Fixes: 2d965008 ("ppc64/aarch64: Dynamically define PAGE_SIZE")

Cc: Adrian Reber <areber@redhat.com>
Acked-by: Cyrill Gorcunov <gorcunov@gmail.com>
Reported-by: Alexey Shabalin
Signed-off-by: Dmitry Safonov <dima@arista.com>
Signed-off-by: Andrei Vagin <avagin@gmail.com>

Related: https://github.com/checkpoint-restore/criu/issues/577

Restoring a runc container which is running in the host's network
namespace locked the network (iptables-restore) without unlocking it.

This disables network logging if running in the host's network
namespace.
Suggested-by: Andrei Vagin <avagin@gmail.com>
Signed-off-by: Adrian Reber <areber@redhat.com>
Signed-off-by: Andrei Vagin <avagin@gmail.com>

Signed-off-by: Adrian Reber <areber@redhat.com>
Signed-off-by: Andrei Vagin <avagin@gmail.com>

Recently, I introduced a new mode when a service fd are not dupped into
a fixed file descriptor number. A side effect of this is that we need to
close the old descritpor if it was installed.

Fixes: d3499999 ("criu: remove all magic of service-fd when it isn't required")

Most of the typos were found by codespell.
Signed-off-by: Radostin Stoyanov <rstoyanov1@gmail.com>
Signed-off-by: Andrei Vagin <avagin@virtuozzo.com>

Signed-off-by: Radostin Stoyanov <rstoyanov1@gmail.com>
Reviewed-by: Dmitry Safonov <0x7f454c46@gmail.com>
Signed-off-by: Andrei Vagin <avagin@gmail.com>