Merge upstream branch 'main'

.github/workflows/builds.yml

@@ -18,7 +18,7 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: Install dependencies
         run: |

.github/workflows/coverity.yml

@@ -14,7 +14,7 @@ jobs:
     if: github.repository == 'lxc/lxc'
     steps:
       - name: Checkout code
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: Download Coverity Build Tool
         run: |

.github/workflows/tests.yml

@@ -12,7 +12,7 @@ jobs:
     runs-on: ubuntu-24.04
     steps:
       - name: Checkout code
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: Install dependencies
         run: |
@@ -64,7 +64,7 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
       - name: Checkout code
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: Install dependencies
         run: |

doc/lxc.container.conf.sgml.in

@@ -1546,17 +1546,11 @@
       </para>
 
       <para>
-	LXC distinguishes settings for the legacy and the unified hierarchy by
-	using different configuration key prefixes. To alter settings for
-	controllers in a legacy hierarchy the key prefix
-	<option>lxc.cgroup.</option> must be used and in order to alter the
-	settings for a controller in the unified hierarchy the
-	<option>lxc.cgroup2.</option> key must be used. Note that LXC will
-	ignore <option>lxc.cgroup.</option> settings on systems that only use
-	the unified hierarchy. Conversely, it will ignore
-	<option>lxc.cgroup2.</option> options on systems that only use legacy
-	hierarchies. <option>lxc.cgroup.</option> (legacy and hybrid hierarchy)
-	support is dropped.
+        Since LXC 7.0, only the unified cgroup hierarchy (cgroup v2) is
+        supported. To alter settings for controllers in the unified hierarchy,
+        the <option>lxc.cgroup2.</option> key prefix must be used.
+        The <option>lxc.cgroup.</option> key prefix, which was used for
+        legacy and hybrid hierarchy configurations, is no longer supported.
       </para>
 
       <para>
@@ -1573,45 +1567,30 @@
       </para>
 
       <para>
-	In the legacy hierarchy the device controller was implemented like most
-	other controllers as a set of files that could be written to. These
-	files where named "devices.allow" and "devices.deny". The legacy device
-	controller allowed the implementation of both "allowlists" and
-	"denylists".
+        LXC supports both "allowlist" and "denylist" semantics for device
+        access control. An allowlist blocks access to all devices by default,
+        and "allow rules" must be specified for particular devices or device
+        classes. A denylist allows access to all devices by default, and "deny
+        rules" must be specified to restrict access to particular devices or
+        device classes.
       </para>
 
       <para>
-	An allowlist is a device program that by default blocks access to all
-	devices. In order to access specific devices "allow rules" for
-	particular devices or device classes must be specified. In contrast, a
-	denylist is a device program that by default allows access to all
-	devices. In order to restrict access to specific devices "deny rules"
-	for particular devices or device classes must be specified.
+        In the unified cgroup hierarchy, the device controller is implemented
+        via an eBPF program of type
+        <option>BPF_PROG_TYPE_CGROUP_DEVICE</option> attached to a cgroup,
+        rather than the file-based interface used previously. LXC preserves
+        the same allowlist/denylist semantics in this eBPF-based device
+        controller. The following paragraphs explain these semantics in
+        detail.
       </para>
 
       <para>
-	In the unified cgroup hierarchy the implementation of the device
-	controller has completely changed. Instead of files to read from and
-	write to a eBPF program of
-	<option>BPF_PROG_TYPE_CGROUP_DEVICE</option> can be attached to a
-	cgroup. Even though the kernel implementation has changed completely
-	LXC tries to allow for the same semantics to be followed in the legacy
-	device cgroup and the unified eBPF-based device controller. The
-	following paragraphs explain the semantics for the unified eBPF-based
-	device controller.
+        Device rules for the cgroup2 eBPF-based device controller are
+        specified via <option>lxc.cgroup2.devices.allow</option> and
+        <option>lxc.cgroup2.devices.deny</option>.
       </para>
 
-      <para>
-	As mentioned the format for specifying device rules for the unified
-	eBPF-based device controller is the same as for the legacy cgroup
-	device controller; only the configuration key prefix has changed.
-	Specifically, device rules for the legacy cgroup device controller are
-	specified via <option>lxc.cgroup.devices.allow</option> and
-	<option>lxc.cgroup.devices.deny</option> whereas for the
-	cgroup2 eBPF-based device controller
-	<option>lxc.cgroup2.devices.allow</option> and
-	<option>lxc.cgroup2.devices.deny</option> must be used.
-      </para>
       <para>
         <itemizedlist>
           <listitem>
@@ -1722,21 +1701,6 @@
 	switch from an allowlist program to a denylist program.
       </para>
       <variablelist>
-        <varlistentry>
-          <term>
-            <option>lxc.cgroup.[controller name].[controller file]</option>
-          </term>
-          <listitem>
-            <para>
-              Specify the control group value to be set on a legacy cgroup
-              hierarchy. The controller name is the literal name of the control
-              group. The permitted names and the syntax of their values is not
-              dictated by LXC, instead it depends on the features of the Linux
-              kernel running at the time the container is started, eg.
-              <option>lxc.cgroup.cpuset.cpus</option>
-            </para>
-          </listitem>
-        </varlistentry>
         <varlistentry>
           <term>
             <option>lxc.cgroup2.[controller name].[controller file]</option>
@@ -1758,16 +1722,13 @@
           </term>
           <listitem>
             <para>
-              specify a directory or path in which the container's cgroup will
+              Specify a directory or path in which the container's cgroup will
               be created. For example, setting
               <option>lxc.cgroup.dir = my-cgroup/first</option> for a container
-              named "c1" will create the container's cgroup as a sub-cgroup of
-              "my-cgroup". For example, if the user's current cgroup "my-user"
-              is located in the root cgroup of the cpuset controller in a
-              cgroup v1 hierarchy this would create the cgroup
-              "/sys/fs/cgroup/cpuset/my-user/my-cgroup/first/c1" for the
-              container. Any missing cgroups will be created by LXC. This
-              presupposes that the user has write access to its current cgroup.
+              named "c1", if the user's current cgroup is "my-user", will
+              create the container's cgroups under "my-user/my-cgroup/first".
+              Any missing cgroups will be created by LXC. This presupposes
+              that the user has write access to its current cgroup.
             </para>
           </listitem>
         </varlistentry>
@@ -3093,11 +3054,11 @@
       cpus.share prioritize the control group, devices.allow makes
       usable the specified devices.</para>
       <programlisting>
-        lxc.cgroup.cpuset.cpus = 0,1
-        lxc.cgroup.cpu.shares = 1234
-        lxc.cgroup.devices.deny = a
-        lxc.cgroup.devices.allow = c 1:3 rw
-        lxc.cgroup.devices.allow = b 8:0 rw
+        lxc.cgroup2.cpuset.cpus = 0,1
+        lxc.cgroup2.cpu.shares = 1234
+        lxc.cgroup2.devices.deny = a
+        lxc.cgroup2.devices.allow = c 1:3 rw
+        lxc.cgroup2.devices.allow = b 8:0 rw
       </programlisting>
     </refsect2>
 
@@ -3128,11 +3089,11 @@
         lxc.net.2.hwaddr = 4a:49:43:49:79:ff
         lxc.net.2.ipv4.address = 10.2.3.6/24
         lxc.net.2.ipv6.address = 2003:db8:1:0:214:1234:fe0b:3297
-        lxc.cgroup.cpuset.cpus = 0,1
-        lxc.cgroup.cpu.shares = 1234
-        lxc.cgroup.devices.deny = a
-        lxc.cgroup.devices.allow = c 1:3 rw
-        lxc.cgroup.devices.allow = b 8:0 rw
+        lxc.cgroup2.cpuset.cpus = 0,1
+        lxc.cgroup2.cpu.shares = 1234
+        lxc.cgroup2.devices.deny = a
+        lxc.cgroup2.devices.allow = c 1:3 rw
+        lxc.cgroup2.devices.allow = b 8:0 rw
         lxc.mount.fstab = /etc/fstab.complex
         lxc.mount.entry = /lib /root/myrootfs/lib none ro,bind 0 0
         lxc.rootfs.path = dir:/mnt/rootfs.complex

src/lxc/confile.c

@@ -2675,7 +2675,7 @@ static int set_config_console_size(const char *key, const char *value,
  * lxc.include.
  * 'x' and 'X' are substituted in-place.
  */
-static void update_hwaddr(const char *line)
+static void update_hwaddr(char *line)
 {
 	char *p;
 
@@ -2701,7 +2701,7 @@ static void update_hwaddr(const char *line)
 	rand_complete_hwaddr(p);
 }
 
-int append_unexp_config_line(const char *line, struct lxc_conf *conf)
+int append_unexp_config_line(char *line, struct lxc_conf *conf)
 {
 	size_t linelen;
 	size_t len = conf->unexpanded_len;
@@ -4213,7 +4213,7 @@ static int get_config_uts_name(const char *key, char *retv, int inlen,
 static int get_config_hooks(const char *key, char *retv, int inlen,
 			    struct lxc_conf *c, void *data)
 {
-	char *subkey;
+	const char *subkey;
 	int len, fulllen = 0, found = -1;
 	struct string_entry *entry;
 	int i;

src/lxc/confile.h

@@ -75,7 +75,7 @@ __hidden extern int lxc_list_net(struct lxc_conf *c, const char *key, char *retv
 
 __hidden extern int lxc_config_read(const char *file, struct lxc_conf *conf, bool from_include);
 
-__hidden extern int append_unexp_config_line(const char *line, struct lxc_conf *conf);
+__hidden extern int append_unexp_config_line(char *line, struct lxc_conf *conf);
 
 extern int lxc_config_define_add(struct lxc_list *defines, char *arg);
 

src/lxc/confile_utils.c

@@ -903,7 +903,7 @@ int lxc_inherit_namespace(const char *nsfd_path, const char *lxcpath,
 {
 	__do_free char *dup = NULL;
 	int fd, pid;
-	char *lastslash;
+	const char *lastslash;
 
 	if (nsfd_path[0] == '/') {
 		return open(nsfd_path, O_RDONLY | O_CLOEXEC);

src/lxc/criu.c

@@ -939,6 +939,21 @@ static void do_restore(struct lxc_container *c, int status_pipe, struct migrate_
 		goto out_fini_handler;
 	}
 
+	if (!cgroup_ops->payload_delegate_controllers(cgroup_ops)) {
+		ERROR("Failed to delegate controllers to payload cgroup");
+		goto out_fini_handler;
+	}
+
+	if (!cgroup_ops->setup_limits(cgroup_ops, handler)) {
+		ERROR("Failed to setup cgroup limits");
+		goto out_fini_handler;
+	}
+
+	if (!cgroup_ops->chown(cgroup_ops, handler->conf))
+		goto out_fini_handler;
+
+	cgroup_ops->finalize(cgroup_ops);
+
 	if (!restore_net_info(c)) {
 		ERROR("failed restoring network info");
 		goto out_fini_handler;

src/lxc/pam/pam_cgfs.c

@@ -362,7 +362,7 @@ static char *copy_to_eol(char *s)
 /* Check if given entry under /proc/<pid>/mountinfo is a fuse.lxcfs mount. */
 static bool is_lxcfs(const char *line)
 {
-	char *p = strstr(line, " - ");
+	const char *p = strstr(line, " - ");
 	if (!p)
 		return false;
 
@@ -1914,7 +1914,7 @@ static bool cgv1_handle_cpuset_hierarchy(struct cgv1_hierarchy *h,
 
 	if (*cgroup == '/')
 		cgroup++;
-	slash = strchr(cgroup, '/');
+	slash = (char *)strchr(cgroup, '/');
 	if (slash)
 		*slash = '\0';
 

src/lxc/storage/nbd.c

@@ -291,7 +291,7 @@ static void nbd_detach(const char *path)
  */
 static int nbd_get_partition(const char *src)
 {
-	char *p = strchr(src, ':');
+	const char *p = strchr(src, ':');
 	if (!p)
 		return 0;
 

src/lxc/storage/zfs.c

@@ -461,7 +461,7 @@ int zfs_clonepaths(struct lxc_storage *orig, struct lxc_storage *new,
 			orig_src = cmd_output;
 		}
 
-		tmp = strrchr(orig_src, '/');
+		tmp = (char *)strrchr(orig_src, '/');
 		if (!tmp) {
 			ERROR("Failed to detect \"/\" in \"%s\"", orig_src);
 			return -1;