In LXD, we use the container name in the LSM profile. If the container name
is changed on migrate (on the host side), we want to use a different LSM
profile name (a. la. --cgroup-root). This flag adds that support.

v2: remove unused field, add comment about double detection in
    kerndat_lsm()
Signed-off-by: Tycho Andersen <tycho.andersen@canonical.com>
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>

Currently decoded with --pretty image cannot be encoded back if there's
an IP address inside. "Just decoded" can.
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>

Currently device numbers are shown as plain integers, but in
pretty output it's nice to see the major:minor pairs.
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>
Acked-by: Ruslan Kuprieiev <rkuprieiev@cloudlinux.com>

The crit tool should decode and encode all images and after
de- and en- sequence the result should be the same as before.
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>
Acked-by: Ruslan Kuprieiev <rkuprieiev@cloudlinux.com>

If someone wants to run all tests in any, but the most
difficult for criu, flavor, the 'best' one is introduced.
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>
Acked-by: Ruslan Kuprieiev <rkuprieiev@cloudlinux.com>

Currently launcher doesn't know that some tests are skipped
and draws incorrect progress bar :)
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>
Acked-by: Ruslan Kuprieiev <rkuprieiev@cloudlinux.com>

It's used to restore bind-mounts. For example, we cat the common
part of bind-mounts:

Core was generated by `criu restore -vvvv --file-locks --tcp-established --evasive-devices --manage-cg'.
Program terminated with signal 11, Segmentation fault.
741                     BUG_ON(target_root[tok] == '\0');
(gdb) bt

https://jira.sw.ru/browse/PSBM-41932

Reported-by: Virtuozzo QA Team
Signed-off-by: Andrew Vagin <avagin@virtuozzo.com>
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>

Restore a receive queue in cases of:

1)socketpair with closed second end;
2)peer-less socket, who is a peer for others.

We use here a hack, it is the connect() with AF_UNSPEC family,
which clears peer of restoring socket. See unix_dgram_connect()
for the details.

This also makes socket_close_data test working.

SOCK_STREAM is supported in TCP_ESTABLISHED case in the same
function.
Signed-off-by: Kirill Tkhai <ktkhai@virtuozzo.com>

v2: 1)Add a commentary near connect()
    2)Delete test/zdtm/live/static/socket_close_data.desc
v3: delete ui->ue->peer check
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>

Signed-off-by: Andrew Vagin <avagin@virtuozzo.com>
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>

In this case we mount source mount in a temporary place and use it to
create the bind-mount.
Signed-off-by: Andrew Vagin <avagin@virtuozzo.com>
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>

Signed-off-by: Andrew Vagin <avagin@virtuozzo.com>
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>

This is used to get a mount without over-mounted parts.
Signed-off-by: Andrew Vagin <avagin@virtuozzo.com>
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>

When we're restoring fsnotify watchees we need to resolve
path to a handle at some mountpoint referred by @s_dev
member (device ID) which is saved inside image. This
ID actually may be changed at the every mount (say
one restores container after machine reboot) or in
case of container's migration.

Thus the test for overmounting in __open_mountpoint
will fail and we get an error.

Lets do a trick: introduce @s_dev_rt member which
is supposed to carry run-time device ID. When dumping
this member simply equal to traditional @s_dev fetched
from the procfs, but when restoring we fetch it from
stat call once mountpoint become alive.

https://jira.sw.ru/browse/PSBM-41610

v2:
 - predefine MOUNT_INVALID_DEV
 - use fetch_rt_stat instead of assigning device in restore_shared_options
 - copy @s_dev_rt in propagate_siblings and propagate_mount
Signed-off-by: Cyrill Gorcunov <gorcunov@openvz.org>
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>

So here's the new test class that handles the test from
groups set. The class is inherited from zdtm_test one as
what it does is -- starts the pseudo-init in ns/uns flavors
and asks one to spawn() the sub-tests from the list.

All groups tests can only be run inside ns flavor, so if
the host flavor is asked, just the pseudo-init is spawned.
This is because using ns flavor is the easiest way to spawn
all the sub tests under this init (however, h flavor can be
supported by marking the pseudo-init as sub-reaper).

On stop this pseudo-init is signalled to stop, it in turn
stops all the sub-tests and then exits. When the pid
namespace destruction is complete, the sub-tests .out-s are
checked.
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>

Introduce yet another tests set called 'groups'. Each test
in this set is a list of existing zdtm tests that can be
started side-by-side in an ns flavor.

To 'create' such a test the zdtm.py group action is used,
which lists tests and semi-randomly groups them together.
The grouping possibility is checked by comparing the .desc
files of those -- desc-s should coincide. One exception is
test dependencies, these are just merged together.

After running the group action there appears groups/ dir
with tests each containing just the list of zdtm tests
that are in a group. The respective .desc file is also
generated and this one matches the .desc for tests inside.
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>

This is -- add ability to pull more than one binary into
mntns root and ability to start zdtm test with more stuff
in the environment than generated in start method itself.
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>

When starting inside ns flavor the test_init() routine prepares
the binary to be run inside namespaces. In particular this routine
fork()-s an init, execve()-s one to pick up mappings and exe from
the new mntns and then fork()-s the test itself. In order to go
back to test_init() for test initialization the execve() is done
again, but it's actually not required and confuses the reader.
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>

Signed-off-by: Pavel Emelyanov <xemul@parallels.com>

This one is to set up uids for userns, do ip l s lo up for netns
and do the prepare_mntns(). BTW, the latter's code is shifted one
tab left as this is where it should be.
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>

This patch implements checkpoint/restore functionality
for binfmt_misc mounts. Both magic and extension types
and "disabled" state are supported.
Signed-off-by: Kirill Tkhai <ktkhai@virtuozzo.com>
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>

This test is for unix sockets open in DGRAM mode.
Server opens a socket, binds it and waits for a signal.
Client connects to the socket and sends a message.

After the signal server checks that data is readable,
and that it's still possible to connect to the bound
socket.
Signed-off-by: Kirill Tkhai <ktkhai@virtuozzo.com>
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>

So, first of all we've fixed (I hope) the security issues
spotted by RedHat people. Another big thing of this release
is the huge amount of bug fixes found while testing live
migration. And enhancements for live migration itself is
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>

Due to security reasons the systemd-spawn mode is no longer
supported in service.

Also fix the default binding address to be in local cwd not
to start global service by chance.
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>

Signed-off-by: Pavel Emelyanov <xemul@parallels.com>

Currently we see that a cgroup yard are not umounted
with the ENOENT error, because cwd was changed.

v2: construct a path to remove a roots yard
Signed-off-by: Andrew Vagin <avagin@virtuozzo.com>
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>

Signed-off-by: Cyrill Gorcunov <gorcunov@openvz.org>
Acked-by: Tycho Andersen <tycho.andersen@canonical.com>
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>

Signed-off-by: Cyrill Gorcunov <gorcunov@openvz.org>
Acked-by: Tycho Andersen <tycho.andersen@canonical.com>
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>

This conflicts with predefined constants in our own syscalls lib.
Signed-off-by: Cyrill Gorcunov <gorcunov@openvz.org>
Acked-by: Tycho Andersen <tycho.andersen@canonical.com>
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>

We will need it for cr-check.
Signed-off-by: Cyrill Gorcunov <gorcunov@openvz.org>
iAcked-by: Tycho Andersen <tycho.andersen@canonical.com>
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>

When using non-run command the 'sat' option is not in opts dict,
so it should be checked with softer method.
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>

This test does nasty things with the root it runs in, in
particular is kills and creates /dev/null which may result
in /dev/null become 'deleted' for the tests running in
paralles with this. The lattest is critical for uns flavor
as ghost /dev/null will not be re-created (mknod fails).
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>

Signed-off-by: Pavel Emelyanov <xemul@parallels.com>

Also remove now unused skip_pid label.
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>
Acked-by: Andrew Vagin <avagin@virtuozzo.com>

The ns and uns flavors are MUCH better ways of launching tests in namespaces.
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>
Acked-by: Andrew Vagin <avagin@virtuozzo.com>

Signed-off-by: Pavel Emelyanov <xemul@parallels.com>
Acked-by: Andrew Vagin <avagin@virtuozzo.com>

Signed-off-by: Pavel Emelyanov <xemul@parallels.com>
Acked-by: Andrew Vagin <avagin@virtuozzo.com>

Signed-off-by: Pavel Emelyanov <xemul@parallels.com>

Signed-off-by: Pavel Emelyanov <xemul@parallels.com>

Instead of doing some dirs/files/links in launcher and some in
libzdtm, make everything in the launcher. The library is then
just to set up the namespaces.
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>

If we get EBUSY here, it means that we didn't umount in the test (i.e. we
didn't call fini() on some path). We should just do that instead.
Signed-off-by: Tycho Andersen <tycho.andersen@canonical.com>
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>