Merge lp:~ubuntu-branches/ubuntu/quantal/lxc/quantal-201209062137 into lp:ubuntu/quantal/lxc

[Ubuntu Package Importer]

The package importer has detected a possible inconsistency between the package history in the archive and the history in bzr. As the archive is authoritative the importer has made lp:ubuntu/quantal/lxc reflect what is in the archive and the old bzr branch has been pushed to lp:~ubuntu-branches/ubuntu/quantal/lxc/quantal-201209062137. This merge proposal was created so that an Ubuntu developer can review the situations and perform a merge/upload if necessary. There are three typical cases where this can happen.
  1. Where someone pushes a change to bzr and someone else uploads the package without that change. This is the reason that this check is done by the importer. If this appears to be the case then a merge/upload should be done if the changes that were in bzr are still desirable.
  2. The importer incorrectly detected the above situation when someone made a change in bzr and then uploaded it.
  3. The importer incorrectly detected the above situation when someone just uploaded a package and didn't touch bzr.

If this case doesn't appear to be the first situation then set the status of the merge proposal to "Rejected" and help avoid the problem in future by filing a bug at https://bugs.launchpad.net/udd linking to this merge proposal.

(this is an automatically generated message)

Unmerged revisions

162. By Serge Hallyn on 2012-09-06

fix example ecryptfs hook

161. By Serge Hallyn on 2012-09-06

add example ecryptfs hook

160. By Serge Hallyn on 2012-09-06

0213-add-premount-hook.patch: add a premount hook to support encrypted
filesystems. (LP: #1043052)

159. By Stéphane Graber on 2012-09-06

Make iptables call more consistent

158. By Serge Hallyn on 2012-09-06

0212-lxc-destroy-rm-symlink: If rootfs is a symbolic link to a directory,
remove it.

157. By Serge Hallyn on 2012-09-06

0211-add-hooks-to-manpage: document lxc.hook in the lxc.conf manpage.

156. By Stéphane Graber on 2012-09-06

Add Debian template fixes

155. By Serge Hallyn on 2012-09-05

not complete - fix one more out of 3 errors

154. By Serge Hallyn on 2012-09-05

fix typo

153. By Serge Hallyn on 2012-09-05

0209-reload-conf-after-create: add ability to free a lxc_conf. Use that
after calling Container->Create() to completely reload the newly created
config.

=== added directory '.pc/0206-lxc-wait-initialize-timeout'
=== renamed directory '.pc/0206-lxc-wait-initialize-timeout' => '.pc/0206-lxc-wait-initialize-timeout.moved'
=== added file '.pc/0206-lxc-wait-initialize-timeout/.timestamp'
=== added directory '.pc/0206-lxc-wait-initialize-timeout/src'
=== added directory '.pc/0206-lxc-wait-initialize-timeout/src/lxc'
=== added file '.pc/0206-lxc-wait-initialize-timeout/src/lxc/lxc_wait.c'
--- .pc/0206-lxc-wait-initialize-timeout/src/lxc/lxc_wait.c	1970-01-01 00:00:00 +0000
+++ .pc/0206-lxc-wait-initialize-timeout/src/lxc/lxc_wait.c	2012-09-06 21:45:28 +0000
@@ -0,0 +1,99 @@
+/*
+ * lxc: linux Container library
+ *
+ * (C) Copyright IBM Corp. 2007, 2008
+ *
+ * Authors:
+ * Daniel Lezcano <dlezcano at fr.ibm.com>
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2.1 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
+ */
+#include <stdio.h>
+#include <string.h>
+#include <libgen.h>
+#include <unistd.h>
+#include <stdlib.h>
+#include <signal.h>
+#include <sys/types.h>
+
+#include <lxc/lxc.h>
+#include <lxc/log.h>
+#include <lxc/monitor.h>
+#include "arguments.h"
+
+lxc_log_define(lxc_wait_ui, lxc_monitor);
+
+static int my_checker(const struct lxc_arguments* args)
+{
+	if (!args->states) {
+		lxc_error(args, "missing state option to wait for.");
+		return -1;
+	}
+	return 0;
+}
+
+static int my_parser(struct lxc_arguments* args, int c, char* arg)
+{
+	switch (c) {
+	case 's': args->states = optarg; break;
+	case 't': args->timeout = atol(optarg); break;
+	}
+	return 0;
+}
+
+static const struct option my_longopts[] = {
+	{"state", required_argument, 0, 's'},
+	{"timeout", required_argument, 0, 't'},
+	LXC_COMMON_OPTIONS
+};
+
+static struct lxc_arguments my_args = {
+	.progname = "lxc-wait",
+	.help     = "\
+--name=NAME --state=STATE\n\
+\n\
+lxc-wait waits for NAME container state to reach STATE\n\
+\n\
+Options :\n\
+  -n, --name=NAME   NAME for name of the container\n\
+  -s, --state=STATE ORed states to wait for\n\
+                    STOPPED, STARTING, RUNNING, STOPPING,\n\
+                    ABORTING, FREEZING, FROZEN\n\
+  -t, --timeout=TMO Seconds to wait for state changes\n",
+	.options  = my_longopts,
+	.parser   = my_parser,
+	.checker  = my_checker,
+};
+
+static void timeout_handler(int signal)
+{
+	exit(-1);
+}
+
+int main(int argc, char *argv[])
+{
+	struct lxc_msg msg;
+	int s[MAX_STATE] = { }, fd;
+	int state, ret;
+
+	if (lxc_arguments_parse(&my_args, argc, argv))
+		return -1;
+
+	if (lxc_log_init(my_args.log_file, my_args.log_priority,
+			 my_args.progname, my_args.quiet))
+		return -1;
+
+	return lxc_wait(my_args.name, my_args.states, my_args.timeout);
+}

=== added directory '.pc/0207-ubuntu-cloud-fixes.patch'
=== renamed directory '.pc/0207-ubuntu-cloud-fixes.patch' => '.pc/0207-ubuntu-cloud-fixes.patch.moved'
=== added file '.pc/0207-ubuntu-cloud-fixes.patch/.timestamp'
=== added directory '.pc/0207-ubuntu-cloud-fixes.patch/templates'
=== added file '.pc/0207-ubuntu-cloud-fixes.patch/templates/lxc-ubuntu-cloud.in'
--- .pc/0207-ubuntu-cloud-fixes.patch/templates/lxc-ubuntu-cloud.in	1970-01-01 00:00:00 +0000
+++ .pc/0207-ubuntu-cloud-fixes.patch/templates/lxc-ubuntu-cloud.in	2012-09-06 21:45:28 +0000
@@ -0,0 +1,401 @@
+#!/bin/bash
+
+# template script for generating ubuntu container for LXC based on released cloud
+# images
+#
+# Copyright © 2012 Serge Hallyn <[e-mail]>
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License version 2, as
+# published by the Free Software Foundation.
+
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+
+# You should have received a copy of the GNU General Public License along
+# with this program; if not, write to the Free Software Foundation, Inc.,
+# 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+#
+
+set -e
+
+if [ -r /etc/default/lxc ]; then
+    . /etc/default/lxc
+fi
+
+copy_configuration()
+{
+    path=$1
+    rootfs=$2
+    name=$3
+    arch=$4
+    release=$5
+
+    if [ $arch = "i386" ]; then
+        arch="i686"
+    fi
+
+    # if there is exactly one veth network entry, make sure it has an
+    # associated hwaddr.
+    nics=`grep -e '^lxc\.network\.type[ \t]*=[ \t]*veth' $path/config | wc -l`
+    if [ $nics -eq 1 ]; then
+        grep -q "^lxc.network.hwaddr" $path/config || cat <<EOF >> $path/config
+lxc.network.hwaddr = 00:16:3e:$(openssl rand -hex 3| sed 's/\(..\)/\1:/g; s/.$//')
+EOF
+    fi
+
+    grep -q "^lxc.rootfs" $path/config 2>/dev/null || echo "lxc.rootfs = $rootfs" >> $path/config
+    cat <<EOF >> $path/config
+lxc.utsname = $name
+
+lxc.tty = 4
+lxc.pts = 1024
+lxc.mount  = $path/fstab
+lxc.arch = $arch
+lxc.cap.drop = sys_module mac_admin
+lxc.pivotdir = lxc_putold
+
+# uncomment the next line to run the container unconfined:
+#lxc.aa_profile = unconfined
+
+lxc.cgroup.devices.deny = a
+# Allow any mknod (but not using the node)
+lxc.cgroup.devices.allow = c *:* m
+lxc.cgroup.devices.allow = b *:* m
+# /dev/null and zero
+lxc.cgroup.devices.allow = c 1:3 rwm
+lxc.cgroup.devices.allow = c 1:5 rwm
+# consoles
+lxc.cgroup.devices.allow = c 5:1 rwm
+lxc.cgroup.devices.allow = c 5:0 rwm
+#lxc.cgroup.devices.allow = c 4:0 rwm
+#lxc.cgroup.devices.allow = c 4:1 rwm
+# /dev/{,u}random
+lxc.cgroup.devices.allow = c 1:9 rwm
+lxc.cgroup.devices.allow = c 1:8 rwm
+lxc.cgroup.devices.allow = c 136:* rwm
+lxc.cgroup.devices.allow = c 5:2 rwm
+# rtc
+lxc.cgroup.devices.allow = c 254:0 rwm
+#fuse
+lxc.cgroup.devices.allow = c 10:229 rwm
+#tun
+lxc.cgroup.devices.allow = c 10:200 rwm
+#full
+lxc.cgroup.devices.allow = c 1:7 rwm
+#hpet
+lxc.cgroup.devices.allow = c 10:228 rwm
+#kvm
+lxc.cgroup.devices.allow = c 10:232 rwm
+EOF
+
+    cat <<EOF > $path/fstab
+proc            proc         proc    nodev,noexec,nosuid 0 0
+sysfs           sys          sysfs defaults  0 0
+EOF
+
+    # rmdir /dev/shm for containers that have /run/shm
+    # I'm afraid of doing rm -rf $rootfs/dev/shm, in case it did
+    # get bind mounted to the host's /run/shm.  So try to rmdir
+    # it, and in case that fails move it out of the way.
+    if [ ! -L $rootfs/dev/shm ] && [ -d $rootfs/run/shm ] && [ -e $rootfs/dev/shm ]; then
+        mv $rootfs/dev/shm $rootfs/dev/shm.bak
+        ln -s /run/shm $rootfs/dev/shm
+    fi
+
+    return 0
+}
+
+usage()
+{
+    cat <<EOF
+LXC Container configuration for Ubuntu Cloud images.
+
+Generic Options
+[ -r | --release <release> ]: Release name of container, defaults to host
+[ -a | --arch ]: Arhcitecture of container, defaults to host arcitecture
+[ -C | --cloud ]: Configure container for use with meta-data service, defaults to no
+[ -T | --tarball ]: Location of tarball
+[ -d | --debug ]: Run with 'set -x' to debug errors
+[ -s | --stream]: Use specified stream rather than 'released'
+
+Options, mutually exclusive of "-C" and "--cloud":
+  [ -i | --hostid ]:    HostID for cloud-init, defaults to random string
+  [ -u | --userdata ]:  Cloud-init user-data file to configure container on start
+  [ -S | --auth-key ]:  SSH Public key file to inject into container
+  [ -L | --nolocales ]: Do not copy host's locales into container
+
+EOF
+    return 0
+}
+
+options=$(getopt -o a:hp:r:n:Fi:CLS:T:ds: -l arch:,help,path:,release:,name:,flush-cache,hostid:,auth-key:,cloud,no_locales,tarball:,debug,stream:,userdata: -- "$@")
+if [ $? -ne 0 ]; then
+    usage $(basename $0)
+    exit 1
+fi
+eval set -- "$options"
+
+release=lucid
+if [ -f /etc/lsb-release ]; then
+    . /etc/lsb-release
+    case "$DISTRIB_CODENAME" in
+        lucid|natty|oneiric|precise|quantal)
+            release=$DISTRIB_CODENAME
+        ;;
+    esac
+fi
+
+arch=$(arch)
+
+# Code taken from debootstrap
+if [ -x /usr/bin/dpkg ] && /usr/bin/dpkg --print-architecture >/dev/null 2>&1; then
+    arch=`/usr/bin/dpkg --print-architecture`
+elif type udpkg >/dev/null 2>&1 && udpkg --print-architecture >/dev/null 2>&1; then
+    arch=`/usr/bin/udpkg --print-architecture`
+else
+    arch=$(arch)
+    if [ "$arch" = "i686" ]; then
+        arch="i386"
+    elif [ "$arch" = "x86_64" ]; then
+        arch="amd64"
+    elif [ "$arch" = "armv7l" ]; then
+        # note: arm images don't exist before oneiric;  are called armhf in
+        # precise and later;  and are not supported by the query, so we don't actually
+        # support them yet (see check later on).  When Query2 is available,
+        # we'll use that to enable arm images.
+        arch="armel"
+    fi
+fi
+
+debug=0
+hostarch=$arch
+cloud=0
+locales=1
+flushcache=0
+stream="released"
+while true
+do
+    case "$1" in
+    -h|--help)         usage $0 && exit 0;;
+    -p|--path)         path=$2; shift 2;;
+    -n|--name)         name=$2; shift 2;;
+    -F|--flush-cache)  flushcache=1; shift 1;;
+    -r|--release)      release=$2; shift 2;;
+    -a|--arch)         arch=$2; shift 2;;
+    -i|--hostid)       host_id=$2; shift 2;;
+    -u|--userdata)     userdata=$2; shift 2;;
+    -C|--cloud)        cloud=1; shift 1;;
+    -S|--auth-key)     auth_key=$2; shift 2;;
+    -L|--no_locales)   locales=0; shift 2;;
+    -T|--tarball)      tarball=$2; shift 2;;
+    -d|--debug)        debug=1; shift 1;;
+    -s|--stream)       stream=$2; shift 2;;
+    --)                shift 1; break ;;
+        *)              break ;;
+    esac
+done
+
+if [ $debug -eq 1 ]; then
+    set -x
+fi
+
+if [ "$arch" == "i686" ]; then
+    arch=i386
+fi
+
+if [ $hostarch = "i386" -a $arch = "amd64" ]; then
+    echo "can't create amd64 container on i386"
+    exit 1
+fi
+
+if [ $arch != "i386" -a $arch != "amd64" ]; then
+    echo "Only i386 and amd64 are supported by the ubuntu cloud template."
+    exit 1
+fi
+
+if [ "$stream" != "daily" -a "$stream" != "released" ]; then
+    echo "Only 'daily' and 'released' streams are supported"
+    exit 1
+fi
+
+if [ -n "$userdata" ]; then
+    if [ ! -f "$userdata" ]; then
+        echo "Userdata ($userdata) does not exist"
+        exit 1
+    else
+        userdata=`readlink -f $userdata`
+    fi
+fi
+
+if [ -z "$path" ]; then
+    echo "'path' parameter is required"
+    exit 1
+fi
+
+if [ "$(id -u)" != "0" ]; then
+    echo "This script should be run as 'root'"
+    exit 1
+fi
+
+# detect rootfs
+config="$path/config"
+if grep -q '^lxc.rootfs' $config 2>/dev/null ; then
+    rootfs=`grep 'lxc.rootfs =' $config | awk -F= '{ print $2 }'`
+else
+    rootfs=$path/rootfs
+fi
+
+type ubuntu-cloudimg-query
+type wget
+
+# determine the url, tarball, and directory names
+# download if needed
+cache="/var/cache/lxc/cloud-$release"
+
+mkdir -p $cache
+
+if [ -n "$tarball" ]; then
+	url2="$tarball"
+else
+	url1=`ubuntu-cloudimg-query $release $stream $arch --format "%{url}\n"`
+	url2=`echo $url1 | sed -e 's/.tar.gz/-root\0/'`
+fi
+
+filename=`basename $url2`
+
+wgetcleanup()
+{
+	rm -f $filename
+}
+
+buildcleanup()
+{
+    cd $rootfs
+    umount -l $cache/$xdir || true
+    rm -rf $cache
+}
+
+# if the release doesn't have a *-rootfs.tar.gz, then create one from the
+# cloudimg.tar.gz by extracting the .img, mounting it loopback, and creating
+# a tarball from the mounted image.
+build_root_tgz()
+{
+    url=$1
+    filename=$2
+
+    xdir=`mktemp -d -p .`
+    tarname=`basename $url`
+    imgname="$release-*-cloudimg-$arch.img"
+    trap buildcleanup EXIT SIGHUP SIGINT SIGTERM
+    if [ $flushcache -eq 1 -o ! -f $cache/$tarname ]; then
+        rm -f $tarname
+        echo "Downloading cloud image from $url"
+        wget $url || { echo "Couldn't find cloud image $url."; exit 1; }
+    fi
+    echo "Creating new cached cloud image rootfs"
+    tar --wildcards -zxf $tarname $imgname
+    mount -o loop $imgname $xdir
+    (cd $xdir; tar zcf ../$filename .)
+    umount $xdir
+    rm -f $tarname $imgname
+    rmdir $xdir
+    echo "New cloud image cache created"
+    trap EXIT
+    trap SIGHUP
+    trap SIGINT
+    trap SIGTERM
+}
+
+mkdir -p /var/lock/subsys/
+(
+    flock -x 200
+
+    cd $cache
+    if [ $flushcache -eq 1 ]; then
+        echo "Clearing the cached images"
+        rm -f $filename
+    fi
+
+    trap wgetcleanup EXIT SIGHUP SIGINT SIGTERM
+    if [ ! -f $filename ]; then
+       wget $url2 || build_root_tgz $url1 $filename
+    fi
+    trap EXIT
+    trap SIGHUP
+    trap SIGINT
+    trap SIGTERM
+
+    echo "Extracting container rootfs"
+    mkdir -p $rootfs
+    cd $rootfs
+    tar -zxf $cache/$filename
+
+
+    if [ $cloud -eq 0 ]; then
+	echo "Configuring for running outside of a cloud environment"
+	echo "If you want to configure for a cloud evironment, please use '-- -C' to create the container"
+
+	seed_d=$rootfs/var/lib/cloud/seed/nocloud-net
+	rhostid=$(uuidgen | cut -c -8)
+	host_id=${hostid:-$rhostid}
+	mkdir -p $seed_d
+
+	cat > "$seed_d/meta-data" <<EOF
+instance_id: lxc-$host_id
+EOF
+
+	rm $rootfs/etc/hostname
+
+	if [ $locales -eq 1 ]; then
+		cp /usr/lib/locale/locale-archive $rootfs/usr/lib/locale/locale-archive
+	fi
+
+
+	if [ -n "$auth_key" -a -f "$auth_key" ]; then
+		u_path="/home/ubuntu/.ssh"
+		root_u_path="$rootfs/$u_path"
+		mkdir -p $root_u_path
+		cp $auth_key "$root_u_path/authorized_keys"
+		chroot $rootfs chown -R ubuntu: "$u_path"
+
+		echo "Inserted SSH public key from $auth_key into /home/ubuntu/.ssh/authorized_keys"
+	fi
+
+	if [ -f "$userdata" ]; then
+		echo "Using custom user-data"
+		cp $userdata $seed_d/user-data
+	else
+
+		if [ -z "$MIRROR" ]; then
+			MIRROR="http://archive.ubuntu.com/ubuntu"
+		fi
+
+		cat > "$seed_d/user-data" <<EOF
+#cloud-config
+output: {all: '| tee -a /var/log/cloud-init-output.log'}
+apt-mirror: $MIRROR
+manage_etc_hosts: localhost
+locale: $(/usr/bin/locale | awk -F= '/LANG=/ {print$NF}')
+EOF
+	fi
+
+	chroot $rootfs /usr/sbin/usermod -U ubuntu
+    	echo "ubuntu:ubuntu" | chroot $rootfs chpasswd
+	echo "Please login as user ubuntu with password ubuntu."
+
+   else
+
+	echo "Configured for running in a cloud environment."
+	echo "If you do not have a meta-data service, this container will likely be useless."
+
+   fi
+
+) 200>/var/lock/subsys/lxc-ubucloud
+
+copy_configuration $path $rootfs $name $arch $release
+
+echo "Container $name created."
+exit 0

=== added directory '.pc/0208-fix-getitem-utsname-segv'
=== renamed directory '.pc/0208-fix-getitem-utsname-segv' => '.pc/0208-fix-getitem-utsname-segv.moved'
=== added file '.pc/0208-fix-getitem-utsname-segv/.timestamp'
=== added directory '.pc/0208-fix-getitem-utsname-segv/src'
=== added directory '.pc/0208-fix-getitem-utsname-segv/src/lxc'
=== added file '.pc/0208-fix-getitem-utsname-segv/src/lxc/conf.c'
--- .pc/0208-fix-getitem-utsname-segv/src/lxc/conf.c	1970-01-01 00:00:00 +0000
+++ .pc/0208-fix-getitem-utsname-segv/src/lxc/conf.c	2012-09-06 21:45:28 +0000
@@ -0,0 +1,2467 @@
+/*
+ * lxc: linux Container library
+ *
+ * (C) Copyright IBM Corp. 2007, 2008
+ *
+ * Authors:
+ * Daniel Lezcano <dlezcano at fr.ibm.com>
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2.1 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
+ */
+#define _GNU_SOURCE
+#include <stdio.h>
+#undef _GNU_SOURCE
+#include <stdlib.h>
+#include <stdarg.h>
+#include <errno.h>
+#include <string.h>
+#include <dirent.h>
+#include <mntent.h>
+#include <unistd.h>
+#include <sys/wait.h>
+#include <pty.h>
+
+#include <linux/loop.h>
+
+#include <sys/types.h>
+#include <sys/utsname.h>
+#include <sys/param.h>
+#include <sys/stat.h>
+#include <sys/socket.h>
+#include <sys/mount.h>
+#include <sys/mman.h>
+#include <sys/prctl.h>
+#include <sys/capability.h>
+#include <sys/personality.h>
+
+#include <arpa/inet.h>
+#include <fcntl.h>
+#include <netinet/in.h>
+#include <net/if.h>
+#include <libgen.h>
+
+#include "network.h"
+#include "error.h"
+#include "parse.h"
+#include "config.h"
+#include "utils.h"
+#include "conf.h"
+#include "log.h"
+#include "lxc.h"	/* for lxc_cgroup_set() */
+#include "caps.h"       /* for lxc_caps_last_cap() */
+
+lxc_log_define(lxc_conf, lxc);
+
+#define MAXHWLEN    18
+#define MAXINDEXLEN 20
+#define MAXMTULEN   16
+#define MAXLINELEN  128
+
+#ifndef MS_DIRSYNC
+#define MS_DIRSYNC  128
+#endif
+
+#ifndef MS_REC
+#define MS_REC 16384
+#endif
+
+#ifndef MNT_DETACH
+#define MNT_DETACH 2
+#endif
+
+#ifndef MS_RELATIME
+#define MS_RELATIME (1 << 21)
+#endif
+
+#ifndef MS_STRICTATIME
+#define MS_STRICTATIME (1 << 24)
+#endif
+
+#ifndef CAP_SETFCAP
+#define CAP_SETFCAP 31
+#endif
+
+#ifndef CAP_MAC_OVERRIDE
+#define CAP_MAC_OVERRIDE 32
+#endif
+
+#ifndef CAP_MAC_ADMIN
+#define CAP_MAC_ADMIN 33
+#endif
+
+#ifndef PR_CAPBSET_DROP
+#define PR_CAPBSET_DROP 24
+#endif
+
+char *lxchook_names[NUM_LXC_HOOKS] = {
+	"pre-start", "mount", "start", "post-stop" };
+
+extern int pivot_root(const char * new_root, const char * put_old);
+
+typedef int (*instanciate_cb)(struct lxc_handler *, struct lxc_netdev *);
+
+struct mount_opt {
+	char *name;
+	int clear;
+	int flag;
+};
+
+struct caps_opt {
+	char *name;
+	int value;
+};
+
+static int instanciate_veth(struct lxc_handler *, struct lxc_netdev *);
+static int instanciate_macvlan(struct lxc_handler *, struct lxc_netdev *);
+static int instanciate_vlan(struct lxc_handler *, struct lxc_netdev *);
+static int instanciate_phys(struct lxc_handler *, struct lxc_netdev *);
+static int instanciate_empty(struct lxc_handler *, struct lxc_netdev *);
+
+static  instanciate_cb netdev_conf[LXC_NET_MAXCONFTYPE + 1] = {
+	[LXC_NET_VETH]    = instanciate_veth,
+	[LXC_NET_MACVLAN] = instanciate_macvlan,
+	[LXC_NET_VLAN]    = instanciate_vlan,
+	[LXC_NET_PHYS]    = instanciate_phys,
+	[LXC_NET_EMPTY]   = instanciate_empty,
+};
+
+static struct mount_opt mount_opt[] = {
+	{ "defaults",      0, 0              },
+	{ "ro",            0, MS_RDONLY      },
+	{ "rw",            1, MS_RDONLY      },
+	{ "suid",          1, MS_NOSUID      },
+	{ "nosuid",        0, MS_NOSUID      },
+	{ "dev",           1, MS_NODEV       },
+	{ "nodev",         0, MS_NODEV       },
+	{ "exec",          1, MS_NOEXEC      },
+	{ "noexec",        0, MS_NOEXEC      },
+	{ "sync",          0, MS_SYNCHRONOUS },
+	{ "async",         1, MS_SYNCHRONOUS },
+	{ "dirsync",       0, MS_DIRSYNC     },
+	{ "remount",       0, MS_REMOUNT     },
+	{ "mand",          0, MS_MANDLOCK    },
+	{ "nomand",        1, MS_MANDLOCK    },
+	{ "atime",         1, MS_NOATIME     },
+	{ "noatime",       0, MS_NOATIME     },
+	{ "diratime",      1, MS_NODIRATIME  },
+	{ "nodiratime",    0, MS_NODIRATIME  },
+	{ "bind",          0, MS_BIND        },
+	{ "rbind",         0, MS_BIND|MS_REC },
+	{ "relatime",      0, MS_RELATIME    },
+	{ "norelatime",    1, MS_RELATIME    },
+	{ "strictatime",   0, MS_STRICTATIME },
+	{ "nostrictatime", 1, MS_STRICTATIME },
+	{ NULL,            0, 0              },
+};
+
+static struct caps_opt caps_opt[] = {
+	{ "chown",             CAP_CHOWN             },
+	{ "dac_override",      CAP_DAC_OVERRIDE      },
+	{ "dac_read_search",   CAP_DAC_READ_SEARCH   },
+	{ "fowner",            CAP_FOWNER            },
+	{ "fsetid",            CAP_FSETID            },
+	{ "kill",              CAP_KILL              },
+	{ "setgid",            CAP_SETGID            },
+	{ "setuid",            CAP_SETUID            },
+	{ "setpcap",           CAP_SETPCAP           },
+	{ "linux_immutable",   CAP_LINUX_IMMUTABLE   },
+	{ "net_bind_service",  CAP_NET_BIND_SERVICE  },
+	{ "net_broadcast",     CAP_NET_BROADCAST     },
+	{ "net_admin",         CAP_NET_ADMIN         },
+	{ "net_raw",           CAP_NET_RAW           },
+	{ "ipc_lock",          CAP_IPC_LOCK          },
+	{ "ipc_owner",         CAP_IPC_OWNER         },
+	{ "sys_module",        CAP_SYS_MODULE        },
+	{ "sys_rawio",         CAP_SYS_RAWIO         },
+	{ "sys_chroot",        CAP_SYS_CHROOT        },
+	{ "sys_ptrace",        CAP_SYS_PTRACE        },
+	{ "sys_pacct",         CAP_SYS_PACCT         },
+	{ "sys_admin",         CAP_SYS_ADMIN         },
+	{ "sys_boot",          CAP_SYS_BOOT          },
+	{ "sys_nice",          CAP_SYS_NICE          },
+	{ "sys_resource",      CAP_SYS_RESOURCE      },
+	{ "sys_time",          CAP_SYS_TIME          },
+	{ "sys_tty_config",    CAP_SYS_TTY_CONFIG    },
+	{ "mknod",             CAP_MKNOD             },
+	{ "lease",             CAP_LEASE             },
+#ifdef CAP_AUDIT_WRITE
+	{ "audit_write",       CAP_AUDIT_WRITE       },
+#endif
+#ifdef CAP_AUDIT_CONTROL
+	{ "audit_control",     CAP_AUDIT_CONTROL     },
+#endif
+	{ "setfcap",           CAP_SETFCAP           },
+	{ "mac_override",      CAP_MAC_OVERRIDE      },
+	{ "mac_admin",         CAP_MAC_ADMIN         },
+#ifdef CAP_SYSLOG
+	{ "syslog",            CAP_SYSLOG            },
+#endif
+#ifdef CAP_WAKE_ALARM
+	{ "wake_alarm",        CAP_WAKE_ALARM        },
+#endif
+};
+
+static int run_script(const char *name, const char *section,
+		      const char *script, ...)
+{
+	int ret;
+	FILE *f;
+	char *buffer, *p, *output;
+	size_t size = 0;
+	va_list ap;
+
+	INFO("Executing script '%s' for container '%s', config section '%s'",
+	     script, name, section);
+
+	va_start(ap, script);
+	while ((p = va_arg(ap, char *)))
+		size += strlen(p) + 1;
+	va_end(ap);
+
+	size += strlen(script);
+	size += strlen(name);
+	size += strlen(section);
+	size += 3;
+
+	if (size > INT_MAX)
+		return -1;
+
+	buffer = alloca(size);
+	if (!buffer) {
+		ERROR("failed to allocate memory");
+		return -1;
+	}
+
+	ret = snprintf(buffer, size, "%s %s %s", script, name, section);
+	if (ret < 0 || ret >= size) {
+		ERROR("Script name too long");
+		free(buffer);
+		return -1;
+	}
+
+	va_start(ap, script);
+	while ((p = va_arg(ap, char *))) {
+		int len = size-ret;
+		int rc;
+		rc = snprintf(buffer + ret, len, " %s", p);
+		if (rc < 0 || rc >= len) {
+			free(buffer);
+			ERROR("Script args too long");
+			return -1;
+		}
+		ret += rc;
+	}
+	va_end(ap);
+
+	f = popen(buffer, "r");
+	if (!f) {
+		SYSERROR("popen failed");
+		return -1;
+	}
+
+	output = malloc(LXC_LOG_BUFFER_SIZE);
+	if (!output) {
+		ERROR("failed to allocate memory for script output");
+		return -1;
+	}
+
+	while(fgets(output, LXC_LOG_BUFFER_SIZE, f))
+		DEBUG("script output: %s", output);
+
+	free(output);
+
+	if (pclose(f)) {
+		ERROR("Script exited on error");
+		return -1;
+	}
+
+	return 0;
+}
+
+static int find_fstype_cb(char* buffer, void *data)
+{
+	struct cbarg {
+		const char *rootfs;
+		const char *target;
+		int mntopt;
+	} *cbarg = data;
+
+	char *fstype;
+
+	/* we don't try 'nodev' entries */
+	if (strstr(buffer, "nodev"))
+		return 0;
+
+	fstype = buffer;
+	fstype += lxc_char_left_gc(fstype, strlen(fstype));
+	fstype[lxc_char_right_gc(fstype, strlen(fstype))] = '\0';
+
+	DEBUG("trying to mount '%s'->'%s' with fstype '%s'",
+	      cbarg->rootfs, cbarg->target, fstype);
+
+	if (mount(cbarg->rootfs, cbarg->target, fstype, cbarg->mntopt, NULL)) {
+		DEBUG("mount failed with error: %s", strerror(errno));
+		return 0;
+	}
+
+	INFO("mounted '%s' on '%s', with fstype '%s'",
+	     cbarg->rootfs, cbarg->target, fstype);
+
+	return 1;
+}
+
+static int mount_unknow_fs(const char *rootfs, const char *target, int mntopt)
+{
+	int i;
+
+	struct cbarg {
+		const char *rootfs;
+		const char *target;
+		int mntopt;
+	} cbarg = {
+		.rootfs = rootfs,
+		.target = target,
+		.mntopt = mntopt,
+	};
+
+	/*
+	 * find the filesystem type with brute force:
+	 * first we check with /etc/filesystems, in case the modules
+	 * are auto-loaded and fall back to the supported kernel fs
+	 */
+	char *fsfile[] = {
+		"/etc/filesystems",
+		"/proc/filesystems",
+	};
+
+	for (i = 0; i < sizeof(fsfile)/sizeof(fsfile[0]); i++) {
+
+		int ret;
+
+		if (access(fsfile[i], F_OK))
+			continue;
+
+		ret = lxc_file_for_each_line(fsfile[i], find_fstype_cb, &cbarg);
+		if (ret < 0) {
+			ERROR("failed to parse '%s'", fsfile[i]);
+			return -1;
+		}
+
+		if (ret)
+			return 0;
+	}
+
+	ERROR("failed to determine fs type for '%s'", rootfs);
+	return -1;
+}
+
+static int mount_rootfs_dir(const char *rootfs, const char *target)
+{
+	return mount(rootfs, target, "none", MS_BIND | MS_REC, NULL);
+}
+
+static int setup_lodev(const char *rootfs, int fd, struct loop_info64 *loinfo)
+{
+	int rfd;
+	int ret = -1;
+
+	rfd = open(rootfs, O_RDWR);
+	if (rfd < 0) {
+		SYSERROR("failed to open '%s'", rootfs);
+		return -1;
+	}
+
+	memset(loinfo, 0, sizeof(*loinfo));
+
+	loinfo->lo_flags = LO_FLAGS_AUTOCLEAR;
+
+	if (ioctl(fd, LOOP_SET_FD, rfd)) {
+		SYSERROR("failed to LOOP_SET_FD");
+		goto out;
+	}
+
+	if (ioctl(fd, LOOP_SET_STATUS64, loinfo)) {
+		SYSERROR("failed to LOOP_SET_STATUS64");
+		goto out;
+	}
+
+	ret = 0;
+out:
+	close(rfd);
+
+	return ret;
+}
+
+static int mount_rootfs_file(const char *rootfs, const char *target)
+{
+	struct dirent dirent, *direntp;
+	struct loop_info64 loinfo;
+	int ret = -1, fd = -1, rc;
+	DIR *dir;
+	char path[MAXPATHLEN];
+
+	dir = opendir("/dev");
+	if (!dir) {
+		SYSERROR("failed to open '/dev'");
+		return -1;
+	}
+
+	while (!readdir_r(dir, &dirent, &direntp)) {
+
+		if (!direntp)
+			break;
+
+		if (!strcmp(direntp->d_name, "."))
+			continue;
+
+		if (!strcmp(direntp->d_name, ".."))
+			continue;
+
+		if (strncmp(direntp->d_name, "loop", 4))
+			continue;
+
+		rc = snprintf(path, MAXPATHLEN, "/dev/%s", direntp->d_name);
+		if (rc < 0 || rc >= MAXPATHLEN)
+			continue;
+
+		fd = open(path, O_RDWR);
+		if (fd < 0)
+			continue;
+
+		if (ioctl(fd, LOOP_GET_STATUS64, &loinfo) == 0) {
+			close(fd);
+			continue;
+		}
+
+		if (errno != ENXIO) {
+			WARN("unexpected error for ioctl on '%s': %m",
+			     direntp->d_name);
+			continue;
+		}
+
+		DEBUG("found '%s' free lodev", path);
+
+		ret = setup_lodev(rootfs, fd, &loinfo);
+		if (!ret)
+			ret = mount_unknow_fs(path, target, 0);
+		close(fd);
+
+		break;
+	}
+
+	if (closedir(dir))
+		WARN("failed to close directory");
+
+	return ret;
+}
+
+static int mount_rootfs_block(const char *rootfs, const char *target)
+{
+	return mount_unknow_fs(rootfs, target, 0);
+}
+
+/*
+ * pin_rootfs
+ * if rootfs is a directory, then open ${rootfs}.hold for writing for the
+ * duration of the container run, to prevent the container from marking the
+ * underlying fs readonly on shutdown.
+ * return -1 on error.
+ * return -2 if nothing needed to be pinned.
+ * return an open fd (>=0) if we pinned it.
+ */
+int pin_rootfs(const char *rootfs)
+{
+	char absrootfs[MAXPATHLEN];
+	char absrootfspin[MAXPATHLEN];
+	struct stat s;
+	int ret, fd;
+
+	if (rootfs == NULL || strlen(rootfs) == 0)
+		return 0;
+
+	if (!realpath(rootfs, absrootfs)) {
+		SYSERROR("failed to get real path for '%s'", rootfs);
+		return -1;
+	}
+
+	if (access(absrootfs, F_OK)) {
+		SYSERROR("'%s' is not accessible", absrootfs);
+		return -1;
+	}
+
+	if (stat(absrootfs, &s)) {
+		SYSERROR("failed to stat '%s'", absrootfs);
+		return -1;
+	}
+
+	if (!__S_ISTYPE(s.st_mode, S_IFDIR))
+		return -2;
+
+	ret = snprintf(absrootfspin, MAXPATHLEN, "%s%s", absrootfs, ".hold");
+	if (ret >= MAXPATHLEN) {
+		SYSERROR("pathname too long for rootfs hold file");
+		return -1;
+	}
+
+	fd = open(absrootfspin, O_CREAT | O_RDWR, S_IWUSR|S_IRUSR);
+	INFO("opened %s as fd %d\n", absrootfspin, fd);
+	return fd;
+}
+
+static int mount_rootfs(const char *rootfs, const char *target)
+{
+	char absrootfs[MAXPATHLEN];
+	struct stat s;
+	int i;
+
+	typedef int (*rootfs_cb)(const char *, const char *);
+
+	struct rootfs_type {
+		int type;
+		rootfs_cb cb;
+	} rtfs_type[] = {
+		{ S_IFDIR, mount_rootfs_dir },
+		{ S_IFBLK, mount_rootfs_block },
+		{ S_IFREG, mount_rootfs_file },
+	};
+
+	if (!realpath(rootfs, absrootfs)) {
+		SYSERROR("failed to get real path for '%s'", rootfs);
+		return -1;
+	}
+
+	if (access(absrootfs, F_OK)) {
+		SYSERROR("'%s' is not accessible", absrootfs);
+		return -1;
+	}
+
+	if (stat(absrootfs, &s)) {
+		SYSERROR("failed to stat '%s'", absrootfs);
+		return -1;
+	}
+
+	for (i = 0; i < sizeof(rtfs_type)/sizeof(rtfs_type[0]); i++) {
+
+		if (!__S_ISTYPE(s.st_mode, rtfs_type[i].type))
+			continue;
+
+		return rtfs_type[i].cb(absrootfs, target);
+	}
+
+	ERROR("unsupported rootfs type for '%s'", absrootfs);
+	return -1;
+}
+
+static int setup_utsname(struct utsname *utsname)
+{
+	if (!utsname)
+		return 0;
+
+	if (sethostname(utsname->nodename, strlen(utsname->nodename))) {
+		SYSERROR("failed to set the hostname to '%s'", utsname->nodename);
+		return -1;
+	}
+
+	INFO("'%s' hostname has been setup", utsname->nodename);
+
+	return 0;
+}
+
+static int setup_tty(const struct lxc_rootfs *rootfs,
+		     const struct lxc_tty_info *tty_info, char *ttydir)
+{
+	char path[MAXPATHLEN], lxcpath[MAXPATHLEN];
+	int i, ret;
+
+	if (!rootfs->path)
+		return 0;
+
+	for (i = 0; i < tty_info->nbtty; i++) {
+
+		struct lxc_pty_info *pty_info = &tty_info->pty_info[i];
+
+		ret = snprintf(path, sizeof(path), "%s/dev/tty%d",
+			 rootfs->mount, i + 1);
+		if (ret >= sizeof(path)) {
+			ERROR("pathname too long for ttys");
+			return -1;
+		}
+		if (ttydir) {
+			/* create dev/lxc/tty%d" */
+			ret = snprintf(lxcpath, sizeof(lxcpath), "%s/dev/%s/tty%d",
+				 rootfs->mount, ttydir, i + 1);
+			if (ret >= sizeof(lxcpath)) {
+				ERROR("pathname too long for ttys");
+				return -1;
+			}
+			ret = creat(lxcpath, 0660);
+			if (ret==-1 && errno != EEXIST) {
+				SYSERROR("error creating %s\n", lxcpath);
+				return -1;
+			}
+			close(ret);
+			ret = unlink(path);
+			if (ret && errno != ENOENT) {
+				SYSERROR("error unlinking %s\n", path);
+				return -1;
+			}
+
+			if (mount(pty_info->name, lxcpath, "none", MS_BIND, 0)) {
+				WARN("failed to mount '%s'->'%s'",
+				     pty_info->name, path);
+				continue;
+			}
+
+			ret = snprintf(lxcpath, sizeof(lxcpath), "%s/tty%d", ttydir, i+1);
+			if (ret >= sizeof(lxcpath)) {
+				ERROR("tty pathname too long");
+				return -1;
+			}
+			ret = symlink(lxcpath, path);
+			if (ret) {
+				SYSERROR("failed to create symlink for tty %d\n", i+1);
+				return -1;
+			}
+		} else {
+			if (mount(pty_info->name, path, "none", MS_BIND, 0)) {
+				WARN("failed to mount '%s'->'%s'",
+						pty_info->name, path);
+				continue;
+			}
+		}
+	}
+
+	INFO("%d tty(s) has been setup", tty_info->nbtty);
+
+	return 0;
+}
+
+static int setup_rootfs_pivot_root_cb(char *buffer, void *data)
+{
+	struct lxc_list	*mountlist, *listentry, *iterator;
+	char *pivotdir, *mountpoint, *mountentry;
+	int found;
+	void **cbparm;
+
+	mountentry = buffer;
+	cbparm = (void **)data;
+
+	mountlist = cbparm[0];
+	pivotdir  = cbparm[1];
+
+	/* parse entry, first field is mountname, ignore */
+	mountpoint = strtok(mountentry, " ");
+	if (!mountpoint)
+		return -1;
+
+	/* second field is mountpoint */
+	mountpoint = strtok(NULL, " ");
+	if (!mountpoint)
+		return -1;
+
+	/* only consider mountpoints below old root fs */
+	if (strncmp(mountpoint, pivotdir, strlen(pivotdir)))
+		return 0;
+
+	/* filter duplicate mountpoints */
+	found = 0;
+	lxc_list_for_each(iterator, mountlist) {
+		if (!strcmp(iterator->elem, mountpoint)) {
+			found = 1;
+			break;
+		}
+	}
+	if (found)
+		return 0;
+
+	/* add entry to list */
+	listentry = malloc(sizeof(*listentry));
+	if (!listentry) {
+		SYSERROR("malloc for mountpoint listentry failed");
+		return -1;
+	}
+
+	listentry->elem = strdup(mountpoint);
+	if (!listentry->elem) {
+		SYSERROR("strdup failed");
+		return -1;
+	}
+	lxc_list_add_tail(mountlist, listentry);
+
+	return 0;
+}
+
+static int umount_oldrootfs(const char *oldrootfs)
+{
+	char path[MAXPATHLEN];
+	void *cbparm[2];
+	struct lxc_list mountlist, *iterator;
+	int ok, still_mounted, last_still_mounted;
+	int rc;
+
+	/* read and parse /proc/mounts in old root fs */
+	lxc_list_init(&mountlist);
+
+	/* oldrootfs is on the top tree directory now */
+	rc = snprintf(path, sizeof(path), "/%s", oldrootfs);
+	if (rc >= sizeof(path)) {
+		ERROR("rootfs name too long");
+		return -1;
+	}
+	cbparm[0] = &mountlist;
+
+	cbparm[1] = strdup(path);
+	if (!cbparm[1]) {
+		SYSERROR("strdup failed");
+		return -1;
+	}
+
+	rc = snprintf(path, sizeof(path), "%s/proc/mounts", oldrootfs);
+	if (rc >= sizeof(path)) {
+		ERROR("container proc/mounts name too long");
+		return -1;
+	}
+
+	ok = lxc_file_for_each_line(path,
+				    setup_rootfs_pivot_root_cb, &cbparm);
+	if (ok < 0) {
+		SYSERROR("failed to read or parse mount list '%s'", path);
+		return -1;
+	}
+
+	/* umount filesystems until none left or list no longer shrinks */
+	still_mounted = 0;
+	do {
+		last_still_mounted = still_mounted;
+		still_mounted = 0;
+
+		lxc_list_for_each(iterator, &mountlist) {
+
+			/* umount normally */
+			if (!umount(iterator->elem)) {
+				DEBUG("umounted '%s'", (char *)iterator->elem);
+				lxc_list_del(iterator);
+				continue;
+			}
+
+			still_mounted++;
+		}
+
+	} while (still_mounted > 0 && still_mounted != last_still_mounted);
+
+
+	lxc_list_for_each(iterator, &mountlist) {
+
+		/* let's try a lazy umount */
+		if (!umount2(iterator->elem, MNT_DETACH)) {
+			INFO("lazy unmount of '%s'", (char *)iterator->elem);
+			continue;
+		}
+
+		/* be more brutal (nfs) */
+		if (!umount2(iterator->elem, MNT_FORCE)) {
+			INFO("forced unmount of '%s'", (char *)iterator->elem);
+			continue;
+		}
+
+		WARN("failed to unmount '%s'", (char *)iterator->elem);
+	}
+
+	return 0;
+}
+
+static int setup_rootfs_pivot_root(const char *rootfs, const char *pivotdir)
+{
+	char path[MAXPATHLEN];
+	int remove_pivotdir = 0;
+	int rc;
+
+	/* change into new root fs */
+	if (chdir(rootfs)) {
+		SYSERROR("can't chdir to new rootfs '%s'", rootfs);
+		return -1;
+	}
+
+	if (!pivotdir)
+		pivotdir = "mnt";
+
+	/* compute the full path to pivotdir under rootfs */
+	rc = snprintf(path, sizeof(path), "%s/%s", rootfs, pivotdir);
+	if (rc >= sizeof(path)) {
+		ERROR("pivot dir name too long");
+		return -1;
+	}
+
+	if (access(path, F_OK)) {
+
+		if (mkdir_p(path, 0755)) {
+			SYSERROR("failed to create pivotdir '%s'", path);
+			return -1;
+		}
+
+		remove_pivotdir = 1;
+		DEBUG("created '%s' directory", path);
+	}
+
+	DEBUG("mountpoint for old rootfs is '%s'", path);
+
+	/* pivot_root into our new root fs */
+	if (pivot_root(".", path)) {
+		SYSERROR("pivot_root syscall failed");
+		return -1;
+	}
+
+	if (chdir("/")) {
+		SYSERROR("can't chdir to / after pivot_root");
+		return -1;
+	}
+
+	DEBUG("pivot_root syscall to '%s' successful", rootfs);
+
+	/* we switch from absolute path to relative path */
+	if (umount_oldrootfs(pivotdir))
+		return -1;
+
+	/* remove temporary mount point, we don't consider the removing
+	 * as fatal */
+	if (remove_pivotdir && rmdir(pivotdir))
+		WARN("can't remove mountpoint '%s': %m", pivotdir);
+
+	return 0;
+}
+
+static int setup_rootfs(const struct lxc_rootfs *rootfs)
+{
+	if (!rootfs->path)
+		return 0;
+
+	if (access(rootfs->mount, F_OK)) {
+		SYSERROR("failed to access to '%s', check it is present",
+			 rootfs->mount);
+		return -1;
+	}
+
+	if (mount_rootfs(rootfs->path, rootfs->mount)) {
+		ERROR("failed to mount rootfs");
+		return -1;
+	}
+
+	DEBUG("mounted '%s' on '%s'", rootfs->path, rootfs->mount);
+
+	return 0;
+}
+
+int setup_pivot_root(const struct lxc_rootfs *rootfs)
+{
+	if (!rootfs->path)
+		return 0;
+
+	if (setup_rootfs_pivot_root(rootfs->mount, rootfs->pivot)) {
+		ERROR("failed to setup pivot root");
+		return -1;
+	}
+
+	return 0;
+}
+
+static int setup_pts(int pts)
+{
+	char target[PATH_MAX];
+
+	if (!pts)
+		return 0;
+
+	if (!access("/dev/pts/ptmx", F_OK) && umount("/dev/pts")) {
+		SYSERROR("failed to umount 'dev/pts'");
+		return -1;
+	}
+
+	if (mount("devpts", "/dev/pts", "devpts", MS_MGC_VAL,
+		  "newinstance,ptmxmode=0666")) {
+		SYSERROR("failed to mount a new instance of '/dev/pts'");
+		return -1;
+	}
+
+	if (access("/dev/ptmx", F_OK)) {
+		if (!symlink("/dev/pts/ptmx", "/dev/ptmx"))
+			goto out;
+		SYSERROR("failed to symlink '/dev/pts/ptmx'->'/dev/ptmx'");
+		return -1;
+	}
+
+	if (realpath("/dev/ptmx", target) && !strcmp(target, "/dev/pts/ptmx"))
+		goto out;
+
+	/* fallback here, /dev/pts/ptmx exists just mount bind */
+	if (mount("/dev/pts/ptmx", "/dev/ptmx", "none", MS_BIND, 0)) {
+		SYSERROR("mount failed '/dev/pts/ptmx'->'/dev/ptmx'");
+		return -1;
+	}
+
+	INFO("created new pts instance");
+
+out:
+	return 0;
+}
+
+static int setup_personality(int persona)
+{
+	if (persona == -1)
+		return 0;
+
+	if (personality(persona) < 0) {
+		SYSERROR("failed to set personality to '0x%x'", persona);
+		return -1;
+	}
+
+	INFO("set personality to '0x%x'", persona);
+
+	return 0;
+}
+
+static int setup_dev_console(const struct lxc_rootfs *rootfs,
+			 const struct lxc_console *console)
+{
+	char path[MAXPATHLEN];
+	struct stat s;
+	int ret;
+
+	ret = snprintf(path, sizeof(path), "%s/dev/console", rootfs->mount);
+	if (ret >= sizeof(path)) {
+		ERROR("console path too long\n");
+		return -1;
+	}
+
+	if (access(path, F_OK)) {
+		WARN("rootfs specified but no console found at '%s'", path);
+		return 0;
+	}
+
+	if (console->peer == -1) {
+		INFO("no console output required");
+		return 0;
+	}
+
+	if (stat(path, &s)) {
+		SYSERROR("failed to stat '%s'", path);
+		return -1;
+	}
+
+	if (chmod(console->name, s.st_mode)) {
+		SYSERROR("failed to set mode '0%o' to '%s'",
+			 s.st_mode, console->name);
+		return -1;
+	}
+
+	if (mount(console->name, path, "none", MS_BIND, 0)) {
+		ERROR("failed to mount '%s' on '%s'", console->name, path);
+		return -1;
+	}
+
+	INFO("console has been setup");
+	return 0;
+}
+
+static int setup_ttydir_console(const struct lxc_rootfs *rootfs,
+			 const struct lxc_console *console,
+			 char *ttydir)
+{
+	char path[MAXPATHLEN], lxcpath[MAXPATHLEN];
+	int ret;
+
+	/* create rootfs/dev/<ttydir> directory */
+	ret = snprintf(path, sizeof(path), "%s/dev/%s", rootfs->mount,
+		       ttydir);
+	if (ret >= sizeof(path))
+		return -1;
+	ret = mkdir(path, 0755);
+	if (ret && errno != EEXIST) {
+		SYSERROR("failed with errno %d to create %s\n", errno, path);
+		return -1;
+	}
+	INFO("created %s\n", path);
+
+	ret = snprintf(lxcpath, sizeof(lxcpath), "%s/dev/%s/console",
+		       rootfs->mount, ttydir);
+	if (ret >= sizeof(lxcpath)) {
+		ERROR("console path too long\n");
+		return -1;
+	}
+
+	snprintf(path, sizeof(path), "%s/dev/console", rootfs->mount);
+	ret = unlink(path);
+	if (ret && errno != ENOENT) {
+		SYSERROR("error unlinking %s\n", path);
+		return -1;
+	}
+
+	ret = creat(lxcpath, 0660);
+	if (ret==-1 && errno != EEXIST) {
+		SYSERROR("error %d creating %s\n", errno, lxcpath);
+		return -1;
+	}
+	close(ret);
+
+	if (console->peer == -1) {
+		INFO("no console output required");
+		return 0;
+	}
+
+	if (mount(console->name, lxcpath, "none", MS_BIND, 0)) {
+		ERROR("failed to mount '%s' on '%s'", console->name, lxcpath);
+		return -1;
+	}
+
+	/* create symlink from rootfs/dev/console to 'lxc/console' */
+	ret = snprintf(lxcpath, sizeof(lxcpath), "%s/console", ttydir);
+	if (ret >= sizeof(lxcpath)) {
+		ERROR("lxc/console path too long");
+		return -1;
+	}
+	ret = symlink(lxcpath, path);
+	if (ret) {
+		SYSERROR("failed to create symlink for console");
+		return -1;
+	}
+
+	INFO("console has been setup on %s", lxcpath);
+
+	return 0;
+}
+
+static int setup_console(const struct lxc_rootfs *rootfs,
+			 const struct lxc_console *console,
+			 char *ttydir)
+{
+	/* We don't have a rootfs, /dev/console will be shared */
+	if (!rootfs->path)
+		return 0;
+	if (!ttydir)
+		return setup_dev_console(rootfs, console);
+
+	return setup_ttydir_console(rootfs, console, ttydir);
+}
+
+static int setup_cgroup(const char *name, struct lxc_list *cgroups)
+{
+	struct lxc_list *iterator;
+	struct lxc_cgroup *cg;
+	int ret = -1;
+
+	if (lxc_list_empty(cgroups))
+		return 0;
+
+	lxc_list_for_each(iterator, cgroups) {
+
+		cg = iterator->elem;
+
+		if (lxc_cgroup_set(name, cg->subsystem, cg->value))
+			goto out;
+
+		DEBUG("cgroup '%s' set to '%s'", cg->subsystem, cg->value);
+	}
+
+	ret = 0;
+	INFO("cgroup has been setup");
+out:
+	return ret;
+}
+
+static void parse_mntopt(char *opt, unsigned long *flags, char **data)
+{
+	struct mount_opt *mo;
+
+	/* If opt is found in mount_opt, set or clear flags.
+	 * Otherwise append it to data. */
+
+	for (mo = &mount_opt[0]; mo->name != NULL; mo++) {
+		if (!strncmp(opt, mo->name, strlen(mo->name))) {
+			if (mo->clear)
+				*flags &= ~mo->flag;
+			else
+				*flags |= mo->flag;
+			return;
+		}
+	}
+
+	if (strlen(*data))
+		strcat(*data, ",");
+	strcat(*data, opt);
+}
+
+static int parse_mntopts(const char *mntopts, unsigned long *mntflags,
+			 char **mntdata)
+{
+	char *s, *data;
+	char *p, *saveptr = NULL;
+
+	*mntdata = NULL;
+	*mntflags = 0L;
+
+	if (!mntopts)
+		return 0;
+
+	s = strdup(mntopts);
+	if (!s) {
+		SYSERROR("failed to allocate memory");
+		return -1;
+	}
+
+	data = malloc(strlen(s) + 1);
+	if (!data) {
+		SYSERROR("failed to allocate memory");
+		free(s);
+		return -1;
+	}
+	*data = 0;
+
+	for (p = strtok_r(s, ",", &saveptr); p != NULL;
+	     p = strtok_r(NULL, ",", &saveptr))
+		parse_mntopt(p, mntflags, &data);
+
+	if (*data)
+		*mntdata = data;
+	else
+		free(data);
+	free(s);
+
+	return 0;
+}
+
+static int mount_entry(const char *fsname, const char *target,
+		       const char *fstype, unsigned long mountflags,
+		       const char *data)
+{
+	if (mount(fsname, target, fstype, mountflags & ~MS_REMOUNT, data)) {
+		SYSERROR("failed to mount '%s' on '%s'", fsname, target);
+		return -1;
+	}
+
+	if ((mountflags & MS_REMOUNT) || (mountflags & MS_BIND)) {
+
+		DEBUG("remounting %s on %s to respect bind or remount options",
+		      fsname, target);
+
+		if (mount(fsname, target, fstype,
+			  mountflags | MS_REMOUNT, data)) {
+			SYSERROR("failed to mount '%s' on '%s'",
+				 fsname, target);
+			return -1;
+		}
+	}
+
+	DEBUG("mounted '%s' on '%s', type '%s'", fsname, target, fstype);
+
+	return 0;
+}
+
+static inline int mount_entry_on_systemfs(struct mntent *mntent)
+{
+	unsigned long mntflags;
+	char *mntdata;
+	int ret;
+
+	if (parse_mntopts(mntent->mnt_opts, &mntflags, &mntdata) < 0) {
+		ERROR("failed to parse mount option '%s'", mntent->mnt_opts);
+		return -1;
+	}
+
+	ret = mount_entry(mntent->mnt_fsname, mntent->mnt_dir,
+			  mntent->mnt_type, mntflags, mntdata);
+
+	free(mntdata);
+
+	return ret;
+}
+
+static int mount_entry_on_absolute_rootfs(struct mntent *mntent,
+					  const struct lxc_rootfs *rootfs,
+					  const char *lxc_name)
+{
+	char *aux;
+	char path[MAXPATHLEN];
+	unsigned long mntflags;
+	char *mntdata;
+	int r, ret = 0, offset;
+
+	if (parse_mntopts(mntent->mnt_opts, &mntflags, &mntdata) < 0) {
+		ERROR("failed to parse mount option '%s'", mntent->mnt_opts);
+		return -1;
+	}
+
+	/* if rootfs->path is a blockdev path, allow container fstab to
+	 * use /var/lib/lxc/CN/rootfs as the target prefix */
+	r = snprintf(path, MAXPATHLEN, "/var/lib/lxc/%s/rootfs", lxc_name);
+	if (r < 0 || r >= MAXPATHLEN)
+		goto skipvarlib;
+
+	aux = strstr(mntent->mnt_dir, path);
+	if (aux) {
+		offset = strlen(path);
+		goto skipabs;
+	}
+
+skipvarlib:
+	aux = strstr(mntent->mnt_dir, rootfs->path);
+	if (!aux) {
+		WARN("ignoring mount point '%s'", mntent->mnt_dir);
+		goto out;
+	}
+	offset = strlen(rootfs->path);
+
+skipabs:
+
+	r = snprintf(path, MAXPATHLEN, "%s/%s", rootfs->mount,
+		 aux + offset);
+	if (r < 0 || r >= MAXPATHLEN) {
+		WARN("pathnme too long for '%s'", mntent->mnt_dir);
+		ret = -1;
+		goto out;
+	}
+
+
+	ret = mount_entry(mntent->mnt_fsname, path, mntent->mnt_type,
+			  mntflags, mntdata);
+
+out:
+	free(mntdata);
+	return ret;
+}
+
+static int mount_entry_on_relative_rootfs(struct mntent *mntent,
+					  const char *rootfs)
+{
+	char path[MAXPATHLEN];
+	unsigned long mntflags;
+	char *mntdata;
+	int ret;
+
+	if (parse_mntopts(mntent->mnt_opts, &mntflags, &mntdata) < 0) {
+		ERROR("failed to parse mount option '%s'", mntent->mnt_opts);
+		return -1;
+	}
+
+        /* relative to root mount point */
+	ret = snprintf(path, sizeof(path), "%s/%s", rootfs, mntent->mnt_dir);
+	if (ret >= sizeof(path)) {
+		ERROR("path name too long");
+		return -1;
+	}
+
+	ret = mount_entry(mntent->mnt_fsname, path, mntent->mnt_type,
+			  mntflags, mntdata);
+
+	free(mntdata);
+
+	return ret;
+}
+
+static int mount_file_entries(const struct lxc_rootfs *rootfs, FILE *file,
+	const char *lxc_name)
+{
+	struct mntent *mntent;
+	int ret = -1;
+
+	while ((mntent = getmntent(file))) {
+
+		if (!rootfs->path) {
+			if (mount_entry_on_systemfs(mntent))
+				goto out;
+			continue;
+		}
+
+		/* We have a separate root, mounts are relative to it */
+		if (mntent->mnt_dir[0] != '/') {
+			if (mount_entry_on_relative_rootfs(mntent,
+							   rootfs->mount))
+				goto out;
+			continue;
+		}
+
+		if (mount_entry_on_absolute_rootfs(mntent, rootfs, lxc_name))
+			goto out;
+	}
+
+	ret = 0;
+
+	INFO("mount points have been setup");
+out:
+	return ret;
+}
+
+static int setup_mount(const struct lxc_rootfs *rootfs, const char *fstab,
+	const char *lxc_name)
+{
+	FILE *file;
+	int ret;
+
+	if (!fstab)
+		return 0;
+
+	file = setmntent(fstab, "r");
+	if (!file) {
+		SYSERROR("failed to use '%s'", fstab);
+		return -1;
+	}
+
+	ret = mount_file_entries(rootfs, file, lxc_name);
+
+	endmntent(file);
+	return ret;
+}
+
+static int setup_mount_entries(const struct lxc_rootfs *rootfs, struct lxc_list *mount,
+	const char *lxc_name)
+{
+	FILE *file;
+	struct lxc_list *iterator;
+	char *mount_entry;
+	int ret;
+
+	file = tmpfile();
+	if (!file) {
+		ERROR("tmpfile error: %m");
+		return -1;
+	}
+
+	lxc_list_for_each(iterator, mount) {
+		mount_entry = iterator->elem;
+		fprintf(file, "%s\n", mount_entry);
+	}
+
+	rewind(file);
+
+	ret = mount_file_entries(rootfs, file, lxc_name);
+
+	fclose(file);
+	return ret;
+}
+
+static int setup_caps(struct lxc_list *caps)
+{
+	struct lxc_list *iterator;
+	char *drop_entry;
+	char *ptr;
+	int i, capid;
+
+	lxc_list_for_each(iterator, caps) {
+
+		drop_entry = iterator->elem;
+
+		capid = -1;
+
+		for (i = 0; i < sizeof(caps_opt)/sizeof(caps_opt[0]); i++) {
+
+			if (strcmp(drop_entry, caps_opt[i].name))
+				continue;
+
+			capid = caps_opt[i].value;
+			break;
+		}
+
+		if (capid < 0) {
+			/* try to see if it's numeric, so the user may specify
+			* capabilities  that the running kernel knows about but
+			* we don't */
+			capid = strtol(drop_entry, &ptr, 10);
+			if (!ptr || *ptr != '\0' ||
+			capid == LONG_MIN || capid == LONG_MAX)
+				/* not a valid number */
+				capid = -1;
+			else if (capid > lxc_caps_last_cap())
+				/* we have a number but it's not a valid
+				* capability */
+				capid = -1;
+		}
+
+	        if (capid < 0) {
+			ERROR("unknown capability %s", drop_entry);
+			return -1;
+		}
+
+		DEBUG("drop capability '%s' (%d)", drop_entry, capid);
+
+		if (prctl(PR_CAPBSET_DROP, capid, 0, 0, 0)) {
+                       SYSERROR("failed to remove %s capability", drop_entry);
+                       return -1;
+                }
+
+	}
+
+	DEBUG("capabilities has been setup");
+
+	return 0;
+}
+
+static int setup_hw_addr(char *hwaddr, const char *ifname)
+{
+	struct sockaddr sockaddr;
+	struct ifreq ifr;
+	int ret, fd;
+
+	ret = lxc_convert_mac(hwaddr, &sockaddr);
+	if (ret) {
+		ERROR("mac address '%s' conversion failed : %s",
+		      hwaddr, strerror(-ret));
+		return -1;
+	}
+
+	memcpy(ifr.ifr_name, ifname, IFNAMSIZ);
+	memcpy((char *) &ifr.ifr_hwaddr, (char *) &sockaddr, sizeof(sockaddr));
+
+	fd = socket(AF_INET, SOCK_DGRAM, 0);
+	if (fd < 0) {
+		ERROR("socket failure : %s", strerror(errno));
+		return -1;
+	}
+
+	ret = ioctl(fd, SIOCSIFHWADDR, &ifr);
+	close(fd);
+	if (ret)
+		ERROR("ioctl failure : %s", strerror(errno));
+
+	DEBUG("mac address '%s' on '%s' has been setup", hwaddr, ifname);
+
+	return ret;
+}
+
+static int setup_ipv4_addr(struct lxc_list *ip, int ifindex)
+{
+	struct lxc_list *iterator;
+	struct lxc_inetdev *inetdev;
+	int err;
+
+	lxc_list_for_each(iterator, ip) {
+
+		inetdev = iterator->elem;
+
+		err = lxc_ipv4_addr_add(ifindex, &inetdev->addr,
+					&inetdev->bcast, inetdev->prefix);
+		if (err) {
+			ERROR("failed to setup_ipv4_addr ifindex %d : %s",
+			      ifindex, strerror(-err));
+			return -1;
+		}
+	}
+
+	return 0;
+}
+
+static int setup_ipv6_addr(struct lxc_list *ip, int ifindex)
+{
+	struct lxc_list *iterator;
+	struct lxc_inet6dev *inet6dev;
+	int err;
+
+	lxc_list_for_each(iterator, ip) {
+
+		inet6dev = iterator->elem;
+
+		err = lxc_ipv6_addr_add(ifindex, &inet6dev->addr,
+					&inet6dev->mcast, &inet6dev->acast,
+					inet6dev->prefix);
+		if (err) {
+			ERROR("failed to setup_ipv6_addr ifindex %d : %s",
+			      ifindex, strerror(-err));
+			return -1;
+		}
+	}
+
+	return 0;
+}
+
+static int setup_netdev(struct lxc_netdev *netdev)
+{
+	char ifname[IFNAMSIZ];
+	char *current_ifname = ifname;
+	int err;
+
+	/* empty network namespace */
+	if (!netdev->ifindex) {
+		if (netdev->flags & IFF_UP) {
+			err = lxc_netdev_up("lo");
+			if (err) {
+				ERROR("failed to set the loopback up : %s",
+				      strerror(-err));
+				return -1;
+			}
+		}
+		return 0;
+	}
+
+	/* retrieve the name of the interface */
+	if (!if_indextoname(netdev->ifindex, current_ifname)) {
+		ERROR("no interface corresponding to index '%d'",
+		      netdev->ifindex);
+		return -1;
+	}
+
+	/* default: let the system to choose one interface name */
+	if (!netdev->name)
+		netdev->name = netdev->type == LXC_NET_PHYS ?
+			netdev->link : "eth%d";
+
+	/* rename the interface name */
+	err = lxc_netdev_rename_by_name(ifname, netdev->name);
+	if (err) {
+		ERROR("failed to rename %s->%s : %s", ifname, netdev->name,
+		      strerror(-err));
+		return -1;
+	}
+
+	/* Re-read the name of the interface because its name has changed
+	 * and would be automatically allocated by the system
+	 */
+	if (!if_indextoname(netdev->ifindex, current_ifname)) {
+		ERROR("no interface corresponding to index '%d'",
+		      netdev->ifindex);
+		return -1;
+	}
+
+	/* set a mac address */
+	if (netdev->hwaddr) {
+		if (setup_hw_addr(netdev->hwaddr, current_ifname)) {
+			ERROR("failed to setup hw address for '%s'",
+			      current_ifname);
+			return -1;
+		}
+	}
+
+	/* setup ipv4 addresses on the interface */
+	if (setup_ipv4_addr(&netdev->ipv4, netdev->ifindex)) {
+		ERROR("failed to setup ip addresses for '%s'",
+			      ifname);
+		return -1;
+	}
+
+	/* setup ipv6 addresses on the interface */
+	if (setup_ipv6_addr(&netdev->ipv6, netdev->ifindex)) {
+		ERROR("failed to setup ipv6 addresses for '%s'",
+			      ifname);
+		return -1;
+	}
+
+	/* set the network device up */
+	if (netdev->flags & IFF_UP) {
+		int err;
+
+		err = lxc_netdev_up(current_ifname);
+		if (err) {
+			ERROR("failed to set '%s' up : %s", current_ifname,
+			      strerror(-err));
+			return -1;
+		}
+
+		/* the network is up, make the loopback up too */
+		err = lxc_netdev_up("lo");
+		if (err) {
+			ERROR("failed to set the loopback up : %s",
+			      strerror(-err));
+			return -1;
+		}
+	}
+
+	/* We can only set up the default routes after bringing
+	 * up the interface, sine bringing up the interface adds
+	 * the link-local routes and we can't add a default
+	 * route if the gateway is not reachable. */
+
+	/* setup ipv4 gateway on the interface */
+	if (netdev->ipv4_gateway) {
+		if (!(netdev->flags & IFF_UP)) {
+			ERROR("Cannot add ipv4 gateway for %s when not bringing up the interface", ifname);
+			return -1;
+		}
+
+		if (lxc_list_empty(&netdev->ipv4)) {
+			ERROR("Cannot add ipv4 gateway for %s when not assigning an address", ifname);
+			return -1;
+		}
+
+		err = lxc_ipv4_gateway_add(netdev->ifindex, netdev->ipv4_gateway);
+		if (err) {
+			ERROR("failed to setup ipv4 gateway for '%s': %s",
+				      ifname, strerror(-err));
+			if (netdev->ipv4_gateway_auto) {
+				char buf[INET_ADDRSTRLEN];
+				inet_ntop(AF_INET, netdev->ipv4_gateway, buf, sizeof(buf));
+				ERROR("tried to set autodetected ipv4 gateway '%s'", buf);
+			}
+			return -1;
+		}
+	}
+
+	/* setup ipv6 gateway on the interface */
+	if (netdev->ipv6_gateway) {
+		if (!(netdev->flags & IFF_UP)) {
+			ERROR("Cannot add ipv6 gateway for %s when not bringing up the interface", ifname);
+			return -1;
+		}
+
+		if (lxc_list_empty(&netdev->ipv6) && !IN6_IS_ADDR_LINKLOCAL(netdev->ipv6_gateway)) {
+			ERROR("Cannot add ipv6 gateway for %s when not assigning an address", ifname);
+			return -1;
+		}
+
+		err = lxc_ipv6_gateway_add(netdev->ifindex, netdev->ipv6_gateway);
+		if (err) {
+			ERROR("failed to setup ipv6 gateway for '%s': %s",
+				      ifname, strerror(-err));
+			if (netdev->ipv6_gateway_auto) {
+				char buf[INET6_ADDRSTRLEN];
+				inet_ntop(AF_INET6, netdev->ipv6_gateway, buf, sizeof(buf));
+				ERROR("tried to set autodetected ipv6 gateway '%s'", buf);
+			}
+			return -1;
+		}
+	}
+
+	DEBUG("'%s' has been setup", current_ifname);
+
+	return 0;
+}
+
+static int setup_network(struct lxc_list *network)
+{
+	struct lxc_list *iterator;
+	struct lxc_netdev *netdev;
+
+	lxc_list_for_each(iterator, network) {
+
+		netdev = iterator->elem;
+
+		if (setup_netdev(netdev)) {
+			ERROR("failed to setup netdev");
+			return -1;
+		}
+	}
+
+	if (!lxc_list_empty(network))
+		INFO("network has been setup");
+
+	return 0;
+}
+
+static int setup_private_host_hw_addr(char *veth1)
+{
+	struct ifreq ifr;
+	int err;
+	int sockfd;
+
+	sockfd = socket(AF_INET, SOCK_DGRAM, 0);
+	if (sockfd < 0)
+		return -errno;
+
+	snprintf((char *)ifr.ifr_name, IFNAMSIZ, "%s", veth1);
+	err = ioctl(sockfd, SIOCGIFHWADDR, &ifr);
+	if (err < 0) {
+		close(sockfd);
+		return -errno;
+	}
+
+	ifr.ifr_hwaddr.sa_data[0] = 0xfe;
+	err = ioctl(sockfd, SIOCSIFHWADDR, &ifr);
+	close(sockfd);
+	if (err < 0)
+		return -errno;
+
+	DEBUG("mac address of host interface '%s' changed to private "
+	      "%02x:%02x:%02x:%02x:%02x:%02x", veth1,
+	      ifr.ifr_hwaddr.sa_data[0] & 0xff,
+	      ifr.ifr_hwaddr.sa_data[1] & 0xff,
+	      ifr.ifr_hwaddr.sa_data[2] & 0xff,
+	      ifr.ifr_hwaddr.sa_data[3] & 0xff,
+	      ifr.ifr_hwaddr.sa_data[4] & 0xff,
+	      ifr.ifr_hwaddr.sa_data[5] & 0xff);
+
+	return 0;
+}
+
+struct lxc_conf *lxc_conf_init(void)
+{
+	struct lxc_conf *new;
+	int i;
+
+	new = 	malloc(sizeof(*new));
+	if (!new) {
+		ERROR("lxc_conf_init : %m");
+		return NULL;
+	}
+	memset(new, 0, sizeof(*new));
+
+	new->umount_proc = 0;
+	new->personality = -1;
+	new->console.path = NULL;
+	new->console.peer = -1;
+	new->console.master = -1;
+	new->console.slave = -1;
+	new->console.name[0] = '\0';
+	new->rootfs.mount = LXCROOTFSMOUNT;
+	lxc_list_init(&new->cgroup);
+	lxc_list_init(&new->network);
+	lxc_list_init(&new->mount_list);
+	lxc_list_init(&new->caps);
+	new->aa_profile = NULL;
+	for (i=0; i<NUM_LXC_HOOKS; i++)
+		lxc_list_init(&new->hooks[i]);
+
+	return new;
+}
+
+static int instanciate_veth(struct lxc_handler *handler, struct lxc_netdev *netdev)
+{
+	char veth1buf[IFNAMSIZ], *veth1;
+	char veth2buf[IFNAMSIZ], *veth2;
+	int err;
+
+	if (netdev->priv.veth_attr.pair)
+		veth1 = netdev->priv.veth_attr.pair;
+	else {
+		err = snprintf(veth1buf, sizeof(veth1buf), "vethXXXXXX");
+		if (err >= sizeof(veth1buf)) { /* can't *really* happen, but... */
+			ERROR("veth1 name too long");
+			return -1;
+		}
+		veth1 = mktemp(veth1buf);
+	}
+
+	snprintf(veth2buf, sizeof(veth2buf), "vethXXXXXX");
+	veth2 = mktemp(veth2buf);
+
+	if (!strlen(veth1) || !strlen(veth2)) {
+		ERROR("failed to allocate a temporary name");
+		return -1;
+	}
+
+	err = lxc_veth_create(veth1, veth2);
+	if (err) {
+		ERROR("failed to create %s-%s : %s", veth1, veth2,
+		      strerror(-err));
+		return -1;
+	}
+
+	/* changing the high byte of the mac address to 0xfe, the bridge interface
+	 * will always keep the host's mac address and not take the mac address
+	 * of a container */
+	err = setup_private_host_hw_addr(veth1);
+	if (err) {
+		ERROR("failed to change mac address of host interface '%s' : %s",
+			veth1, strerror(-err));
+		goto out_delete;
+	}
+
+	if (netdev->mtu) {
+		err = lxc_netdev_set_mtu(veth1, atoi(netdev->mtu));
+		if (!err)
+			err = lxc_netdev_set_mtu(veth2, atoi(netdev->mtu));
+		if (err) {
+			ERROR("failed to set mtu '%s' for %s-%s : %s",
+			      netdev->mtu, veth1, veth2, strerror(-err));
+			goto out_delete;
+		}
+	}
+
+	if (netdev->link) {
+		err = lxc_bridge_attach(netdev->link, veth1);
+		if (err) {
+			ERROR("failed to attach '%s' to the bridge '%s' : %s",
+				      veth1, netdev->link, strerror(-err));
+			goto out_delete;
+		}
+	}
+
+	netdev->ifindex = if_nametoindex(veth2);
+	if (!netdev->ifindex) {
+		ERROR("failed to retrieve the index for %s", veth2);
+		goto out_delete;
+	}
+
+	err = lxc_netdev_up(veth1);
+	if (err) {
+		ERROR("failed to set %s up : %s", veth1, strerror(-err));
+		goto out_delete;
+	}
+
+	if (netdev->upscript) {
+		err = run_script(handler->name, "net", netdev->upscript, "up",
+				 "veth", veth1, (char*) NULL);
+		if (err)
+			goto out_delete;
+	}
+
+	DEBUG("instanciated veth '%s/%s', index is '%d'",
+	      veth1, veth2, netdev->ifindex);
+
+	return 0;
+
+out_delete:
+	lxc_netdev_delete_by_name(veth1);
+	return -1;
+}
+
+static int instanciate_macvlan(struct lxc_handler *handler, struct lxc_netdev *netdev)
+{
+	char peerbuf[IFNAMSIZ], *peer;
+	int err;
+
+	if (!netdev->link) {
+		ERROR("no link specified for macvlan netdev");
+		return -1;
+	}
+
+	err = snprintf(peerbuf, sizeof(peerbuf), "mcXXXXXX");
+	if (err >= sizeof(peerbuf))
+		return -1;
+
+	peer = mktemp(peerbuf);
+	if (!strlen(peer)) {
+		ERROR("failed to make a temporary name");
+		return -1;
+	}
+
+	err = lxc_macvlan_create(netdev->link, peer,
+				 netdev->priv.macvlan_attr.mode);
+	if (err) {
+		ERROR("failed to create macvlan interface '%s' on '%s' : %s",
+		      peer, netdev->link, strerror(-err));
+		return -1;
+	}
+
+	netdev->ifindex = if_nametoindex(peer);
+	if (!netdev->ifindex) {
+		ERROR("failed to retrieve the index for %s", peer);
+		lxc_netdev_delete_by_name(peer);
+		return -1;
+	}
+
+	if (netdev->upscript) {
+		err = run_script(handler->name, "net", netdev->upscript, "up",
+				 "macvlan", netdev->link, (char*) NULL);
+		if (err)
+			return -1;
+	}
+
+	DEBUG("instanciated macvlan '%s', index is '%d' and mode '%d'",
+	      peer, netdev->ifindex, netdev->priv.macvlan_attr.mode);
+
+	return 0;
+}
+
+/* XXX: merge with instanciate_macvlan */
+static int instanciate_vlan(struct lxc_handler *handler, struct lxc_netdev *netdev)
+{
+	char peer[IFNAMSIZ];
+	int err;
+
+	if (!netdev->link) {
+		ERROR("no link specified for vlan netdev");
+		return -1;
+	}
+
+	err = snprintf(peer, sizeof(peer), "vlan%d", netdev->priv.vlan_attr.vid);
+	if (err >= sizeof(peer)) {
+		ERROR("peer name too long");
+		return -1;
+	}
+
+	err = lxc_vlan_create(netdev->link, peer, netdev->priv.vlan_attr.vid);
+	if (err) {
+		ERROR("failed to create vlan interface '%s' on '%s' : %s",
+		      peer, netdev->link, strerror(-err));
+		return -1;
+	}
+
+	netdev->ifindex = if_nametoindex(peer);
+	if (!netdev->ifindex) {
+		ERROR("failed to retrieve the ifindex for %s", peer);
+		lxc_netdev_delete_by_name(peer);
+		return -1;
+	}
+
+	DEBUG("instanciated vlan '%s', ifindex is '%d'", " vlan1000",
+	      netdev->ifindex);
+
+	return 0;
+}
+
+static int instanciate_phys(struct lxc_handler *handler, struct lxc_netdev *netdev)
+{
+	if (!netdev->link) {
+		ERROR("no link specified for the physical interface");
+		return -1;
+	}
+
+	netdev->ifindex = if_nametoindex(netdev->link);
+	if (!netdev->ifindex) {
+		ERROR("failed to retrieve the index for %s", netdev->link);
+		return -1;
+	}
+
+	if (netdev->upscript) {
+		int err;
+		err = run_script(handler->name, "net", netdev->upscript,
+				 "up", "phys", netdev->link, (char*) NULL);
+		if (err)
+			return -1;
+	}
+
+	return 0;
+}
+
+static int instanciate_empty(struct lxc_handler *handler, struct lxc_netdev *netdev)
+{
+	netdev->ifindex = 0;
+	if (netdev->upscript) {
+		int err;
+		err = run_script(handler->name, "net", netdev->upscript,
+				 "up", "empty", (char*) NULL);
+		if (err)
+			return -1;
+	}
+	return 0;
+}
+
+int lxc_create_network(struct lxc_handler *handler)
+{
+	struct lxc_list *network = &handler->conf->network;
+	struct lxc_list *iterator;
+	struct lxc_netdev *netdev;
+
+	lxc_list_for_each(iterator, network) {
+
+		netdev = iterator->elem;
+
+		if (netdev->type < 0 || netdev->type > LXC_NET_MAXCONFTYPE) {
+			ERROR("invalid network configuration type '%d'",
+			      netdev->type);
+			return -1;
+		}
+
+		if (netdev_conf[netdev->type](handler, netdev)) {
+			ERROR("failed to create netdev");
+			return -1;
+		}
+
+	}
+
+	return 0;
+}
+
+void lxc_delete_network(struct lxc_list *network)
+{
+	struct lxc_list *iterator;
+	struct lxc_netdev *netdev;
+
+	lxc_list_for_each(iterator, network) {
+		netdev = iterator->elem;
+		if (netdev->ifindex == 0)
+			continue;
+
+		if (netdev->type == LXC_NET_PHYS) {
+			if (lxc_netdev_rename_by_index(netdev->ifindex, netdev->link))
+				WARN("failed to rename to the initial name the " \
+				     "netdev '%s'", netdev->link);
+			continue;
+		}
+
+		/* Recent kernel remove the virtual interfaces when the network
+		 * namespace is destroyed but in case we did not moved the
+		 * interface to the network namespace, we have to destroy it
+		 */
+		if (lxc_netdev_delete_by_index(netdev->ifindex))
+			WARN("failed to remove interface '%s'", netdev->name);
+	}
+}
+
+int lxc_assign_network(struct lxc_list *network, pid_t pid)
+{
+	struct lxc_list *iterator;
+	struct lxc_netdev *netdev;
+	int err;
+
+	lxc_list_for_each(iterator, network) {
+
+		netdev = iterator->elem;
+
+		/* empty network namespace, nothing to move */
+		if (!netdev->ifindex)
+			continue;
+
+		err = lxc_netdev_move_by_index(netdev->ifindex, pid);
+		if (err) {
+			ERROR("failed to move '%s' to the container : %s",
+			      netdev->link, strerror(-err));
+			return -1;
+		}
+
+		DEBUG("move '%s' to '%d'", netdev->name, pid);
+	}
+
+	return 0;
+}
+
+int lxc_find_gateway_addresses(struct lxc_handler *handler)
+{
+	struct lxc_list *network = &handler->conf->network;
+	struct lxc_list *iterator;
+	struct lxc_netdev *netdev;
+	int link_index;
+
+	lxc_list_for_each(iterator, network) {
+		netdev = iterator->elem;
+
+		if (!netdev->ipv4_gateway_auto && !netdev->ipv6_gateway_auto)
+			continue;
+
+		if (netdev->type != LXC_NET_VETH && netdev->type != LXC_NET_MACVLAN) {
+			ERROR("gateway = auto only supported for "
+			      "veth and macvlan");
+			return -1;
+		}
+
+		if (!netdev->link) {
+			ERROR("gateway = auto needs a link interface");
+			return -1;
+		}
+
+		link_index = if_nametoindex(netdev->link);
+		if (!link_index)
+			return -EINVAL;
+
+		if (netdev->ipv4_gateway_auto) {
+			if (lxc_ipv4_addr_get(link_index, &netdev->ipv4_gateway)) {
+				ERROR("failed to automatically find ipv4 gateway "
+				      "address from link interface '%s'", netdev->link);
+				return -1;
+			}
+		}
+
+		if (netdev->ipv6_gateway_auto) {
+			if (lxc_ipv6_addr_get(link_index, &netdev->ipv6_gateway)) {
+				ERROR("failed to automatically find ipv6 gateway "
+				      "address from link interface '%s'", netdev->link);
+				return -1;
+			}
+		}
+	}
+
+	return 0;
+}
+
+int lxc_create_tty(const char *name, struct lxc_conf *conf)
+{
+	struct lxc_tty_info *tty_info = &conf->tty_info;
+	int i;
+
+	/* no tty in the configuration */
+	if (!conf->tty)
+		return 0;
+
+	tty_info->pty_info =
+		malloc(sizeof(*tty_info->pty_info)*conf->tty);
+	if (!tty_info->pty_info) {
+		SYSERROR("failed to allocate pty_info");
+		return -1;
+	}
+
+	for (i = 0; i < conf->tty; i++) {
+
+		struct lxc_pty_info *pty_info = &tty_info->pty_info[i];
+
+		if (openpty(&pty_info->master, &pty_info->slave,
+			    pty_info->name, NULL, NULL)) {
+			SYSERROR("failed to create pty #%d", i);
+			tty_info->nbtty = i;
+			lxc_delete_tty(tty_info);
+			return -1;
+		}
+
+		DEBUG("allocated pty '%s' (%d/%d)",
+		      pty_info->name, pty_info->master, pty_info->slave);
+
+                /* Prevent leaking the file descriptors to the container */
+		fcntl(pty_info->master, F_SETFD, FD_CLOEXEC);
+		fcntl(pty_info->slave, F_SETFD, FD_CLOEXEC);
+
+		pty_info->busy = 0;
+	}
+
+	tty_info->nbtty = conf->tty;
+
+	INFO("tty's configured");
+
+	return 0;
+}
+
+void lxc_delete_tty(struct lxc_tty_info *tty_info)
+{
+	int i;
+
+	for (i = 0; i < tty_info->nbtty; i++) {
+		struct lxc_pty_info *pty_info = &tty_info->pty_info[i];
+
+		close(pty_info->master);
+		close(pty_info->slave);
+	}
+
+	free(tty_info->pty_info);
+	tty_info->nbtty = 0;
+}
+
+/*
+ * make sure /proc/self exists, and points to '1', since we are the
+ * container init.
+ * Else mount /proc.  Return 0 if proc was
+ * already mounted, 1 if we mounted it, -1 if we failed.
+ */
+static int mount_proc_if_needed(char *root_src, char *rootfs_tgt)
+{
+	char path[MAXPATHLEN];
+	char link[20];
+	int linklen, ret;
+
+	ret = snprintf(path, MAXPATHLEN, "%s/proc/self", root_src ? rootfs_tgt : "");
+	if (ret < 0 || ret >= MAXPATHLEN) {
+		SYSERROR("proc path name too long");
+		return -1;
+	}
+	memset(link, 0, 20);
+	linklen = readlink(path, link, 20);
+	INFO("I am %d, /proc/self points to %s\n", getpid(), link);
+	ret = snprintf(path, MAXPATHLEN, "%s/proc", root_src ? rootfs_tgt : "");
+	if (linklen < 0) /* /proc not mounted */
+		goto domount;
+	/* can't be longer than rootfs/proc/1 */
+	if (strncmp(link, "1", linklen) != 0) {
+		/* wrong /procs mounted */
+		umount2(path, MNT_DETACH); /* ignore failure */
+		goto domount;
+	}
+	/* the right proc is already mounted */
+	return 0;
+
+domount:
+	if (mount("proc", path, "proc", 0, NULL))
+		return -1;
+	INFO("Mounted /proc for the container\n");
+	return 1;
+}
+
+int lxc_setup(const char *name, struct lxc_conf *lxc_conf)
+{
+	int mounted;
+
+	if (setup_utsname(lxc_conf->utsname)) {
+		ERROR("failed to setup the utsname for '%s'", name);
+		return -1;
+	}
+
+	if (setup_network(&lxc_conf->network)) {
+		ERROR("failed to setup the network for '%s'", name);
+		return -1;
+	}
+
+	if (setup_rootfs(&lxc_conf->rootfs)) {
+		ERROR("failed to setup rootfs for '%s'", name);
+		return -1;
+	}
+
+	if (setup_mount(&lxc_conf->rootfs, lxc_conf->fstab, name)) {
+		ERROR("failed to setup the mounts for '%s'", name);
+		return -1;
+	}
+
+	if (setup_mount_entries(&lxc_conf->rootfs, &lxc_conf->mount_list, name)) {
+		ERROR("failed to setup the mount entries for '%s'", name);
+		return -1;
+	}
+
+	if (setup_cgroup(name, &lxc_conf->cgroup)) {
+		ERROR("failed to setup the cgroups for '%s'", name);
+		return -1;
+	}
+	if (run_lxc_hooks(name, "mount", lxc_conf)) {
+		ERROR("failed to run mount hooks for container '%s'.", name);
+		return -1;
+	}
+
+	if (setup_console(&lxc_conf->rootfs, &lxc_conf->console, lxc_conf->ttydir)) {
+		ERROR("failed to setup the console for '%s'", name);
+		return -1;
+	}
+
+	if (setup_tty(&lxc_conf->rootfs, &lxc_conf->tty_info, lxc_conf->ttydir)) {
+		ERROR("failed to setup the ttys for '%s'", name);
+		return -1;
+	}
+
+	/* aa_change_onexec makes more sense since we want to transition when
+	 * /sbin/init is exec'd.  But the transitions doesn't seem to work
+	 * then (refused).  aa_change_onexec will work since we're doing it
+	 * right before the exec, so we'll just use that for now.
+	 * In case the container fstab didn't mount /proc, we mount it.
+	 */
+	INFO("rootfs path is .%s., mount is .%s.", lxc_conf->rootfs.path,
+		lxc_conf->rootfs.mount);
+
+	mounted = mount_proc_if_needed(lxc_conf->rootfs.path, lxc_conf->rootfs.mount);
+	if (mounted == -1) {
+		SYSERROR("failed to mount /proc in the container.");
+		return -1;
+	} else if (mounted == 1) {
+		lxc_conf->umount_proc = 1;
+	}
+
+	if (setup_pivot_root(&lxc_conf->rootfs)) {
+		ERROR("failed to set rootfs for '%s'", name);
+		return -1;
+	}
+
+	if (setup_pts(lxc_conf->pts)) {
+		ERROR("failed to setup the new pts instance");
+		return -1;
+	}
+
+	if (setup_personality(lxc_conf->personality)) {
+		ERROR("failed to setup personality");
+		return -1;
+	}
+
+	if (setup_caps(&lxc_conf->caps)) {
+		ERROR("failed to drop capabilities");
+		return -1;
+	}
+
+	NOTICE("'%s' is setup.", name);
+
+	return 0;
+}
+
+int run_lxc_hooks(const char *name, char *hook, struct lxc_conf *conf)
+{
+	int which = -1;
+	struct lxc_list *it;
+
+	if (strcmp(hook, "pre-start") == 0)
+		which = LXCHOOK_PRESTART;
+	else if (strcmp(hook, "mount") == 0)
+		which = LXCHOOK_MOUNT;
+	else if (strcmp(hook, "start") == 0)
+		which = LXCHOOK_START;
+	else if (strcmp(hook, "post-stop") == 0)
+		which = LXCHOOK_POSTSTOP;
+	else
+		return -1;
+	lxc_list_for_each(it, &conf->hooks[which]) {
+		int ret;
+		char *hookname = it->elem;
+		ret = run_script(name, "lxc", hookname, hook, NULL);
+		if (ret)
+			return ret;
+	}
+	return 0;
+}
+
+static void lxc_remove_nic(struct lxc_list *it)
+{
+	struct lxc_netdev *netdev = it->elem;
+	struct lxc_list *it2;
+
+	lxc_list_del(it);
+
+	if (netdev->link)
+		free(netdev->link);
+	if (netdev->name)
+		free(netdev->name);
+	if (netdev->upscript)
+		free(netdev->upscript);
+	if (netdev->hwaddr)
+		free(netdev->hwaddr);
+	if (netdev->mtu)
+		free(netdev->mtu);
+	if (netdev->ipv4_gateway)
+		free(netdev->ipv4_gateway);
+	if (netdev->ipv6_gateway)
+		free(netdev->ipv6_gateway);
+	lxc_list_for_each(it2, &netdev->ipv4) {
+		lxc_list_del(it2);
+		free(it2->elem);
+		free(it2);
+	}
+	lxc_list_for_each(it2, &netdev->ipv6) {
+		lxc_list_del(it2);
+		free(it2->elem);
+		free(it2);
+	}
+	free(it);
+}
+
+/* we get passed in something like '0', '0.ipv4' or '1.ipv6' */
+int lxc_clear_nic(struct lxc_conf *c, char *key)
+{
+	char *p1;
+	int ret, idx, i;
+	struct lxc_list *it;
+	struct lxc_netdev *netdev;
+
+	p1 = index(key, '.');
+	if (!p1 || *(p1+1) == '\0')
+		p1 = NULL;
+
+	ret = sscanf(key, "%d", &idx);
+	if (ret != 1) return -1;
+	if (idx < 0)
+		return -1;
+
+	i = 0;
+	lxc_list_for_each(it, &c->network) {
+		if (i == idx)
+			break;
+		i++;
+	}
+	if (i < idx)  // we don't have that many nics defined
+		return -1;
+
+	if (!it || !it->elem)
+		return -1;
+
+	netdev = it->elem;
+
+	if (!p1) {
+		lxc_remove_nic(it);
+	} else if (strcmp(p1, "ipv4") == 0) {
+		struct lxc_list *it2;
+		lxc_list_for_each(it2, &netdev->ipv4) {
+			lxc_list_del(it2);
+			free(it2->elem);
+			free(it2);
+		}
+	} else if (strcmp(p1, "ipv6") == 0) {
+		struct lxc_list *it2;
+		lxc_list_for_each(it2, &netdev->ipv6) {
+			lxc_list_del(it2);
+			free(it2->elem);
+			free(it2);
+		}
+	} else if (strcmp(p1, "link") == 0) {
+		if (netdev->link) {
+			free(netdev->link);
+			netdev->link = NULL;
+		}
+	} else if (strcmp(p1, "name") == 0) {
+		if (netdev->name) {
+			free(netdev->name);
+			netdev->name = NULL;
+		}
+	} else if (strcmp(p1, "script.up") == 0) {
+		if (netdev->upscript) {
+			free(netdev->upscript);
+			netdev->upscript = NULL;
+		}
+	} else if (strcmp(p1, "hwaddr") == 0) {
+		if (netdev->hwaddr) {
+			free(netdev->hwaddr);
+			netdev->hwaddr = NULL;
+		}
+	} else if (strcmp(p1, "mtu") == 0) {
+		if (netdev->mtu) {
+			free(netdev->mtu);
+			netdev->mtu = NULL;
+		}
+	} else if (strcmp(p1, "ipv4_gateway") == 0) {
+		if (netdev->ipv4_gateway) {
+			free(netdev->ipv4_gateway);
+			netdev->ipv4_gateway = NULL;
+		}
+	} else if (strcmp(p1, "ipv6_gateway") == 0) {
+		if (netdev->ipv6_gateway) {
+			free(netdev->ipv6_gateway);
+			netdev->ipv6_gateway = NULL;
+		}
+	}
+		else return -1;
+
+	return 0;
+}
+
+int lxc_clear_config_network(struct lxc_conf *c)
+{
+	struct lxc_list *it;
+	lxc_list_for_each(it, &c->network) {
+		lxc_remove_nic(it);
+	}
+	return 0;
+}
+
+int lxc_clear_config_caps(struct lxc_conf *c)
+{
+	struct lxc_list *it;
+
+	lxc_list_for_each(it, &c->caps) {
+		lxc_list_del(it);
+		free(it->elem);
+		free(it);
+	}
+	return 0;
+}
+
+int lxc_clear_cgroups(struct lxc_conf *c, char *key)
+{
+	struct lxc_list *it;
+	bool all = false;
+	char *k = key + 11;
+
+	if (strcmp(key, "lxc.cgroup") == 0)
+		all = true;
+
+	lxc_list_for_each(it, &c->cgroup) {
+		struct lxc_cgroup *cg = it->elem;
+		if (!all && strcmp(cg->subsystem, k) != 0)
+			continue;
+		lxc_list_del(it);
+		free(cg->subsystem);
+		free(cg->value);
+		free(cg);
+		free(it);
+	}
+	return 0;
+}
+
+int lxc_clear_mount_entries(struct lxc_conf *c)
+{
+	struct lxc_list *it;
+
+	lxc_list_for_each(it, &c->mount_list) {
+		lxc_list_del(it);
+		free(it->elem);
+		free(it);
+	}
+	return 0;
+}
+
+int lxc_clear_hooks(struct lxc_conf *c)
+{
+	struct lxc_list *it;
+	int i;
+
+	for (i=0; i<NUM_LXC_HOOKS; i++) {
+		lxc_list_for_each(it, &c->hooks[i]) {
+			lxc_list_del(it);
+			free(it->elem);
+			free(it);
+		}
+	}
+	return 0;
+}

=== added file '.pc/0208-fix-getitem-utsname-segv/src/lxc/confile.c'
--- .pc/0208-fix-getitem-utsname-segv/src/lxc/confile.c	1970-01-01 00:00:00 +0000
+++ .pc/0208-fix-getitem-utsname-segv/src/lxc/confile.c	2012-09-06 21:45:28 +0000
@@ -0,0 +1,1670 @@
+/*
+ * lxc: linux Container library
+ *
+ * (C) Copyright IBM Corp. 2007, 2008
+ *
+ * Authors:
+ * Daniel Lezcano <dlezcano at fr.ibm.com>
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2.1 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
+ */
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <unistd.h>
+#include <errno.h>
+#include <fcntl.h>
+#include <pty.h>
+#include <sys/stat.h>
+#include <sys/types.h>
+#include <sys/param.h>
+#include <sys/utsname.h>
+#include <sys/personality.h>
+#include <arpa/inet.h>
+#include <netinet/in.h>
+#include <net/if.h>
+
+#include "parse.h"
+#include "confile.h"
+#include "utils.h"
+
+#include <lxc/log.h>
+#include <lxc/conf.h>
+#include "network.h"
+
+lxc_log_define(lxc_confile, lxc);
+
+static int config_personality(const char *, char *, struct lxc_conf *);
+static int config_pts(const char *, char *, struct lxc_conf *);
+static int config_tty(const char *, char *, struct lxc_conf *);
+static int config_ttydir(const char *, char *, struct lxc_conf *);
+static int config_aa_profile(const char *, char *, struct lxc_conf *);
+static int config_cgroup(const char *, char *, struct lxc_conf *);
+static int config_mount(const char *, char *, struct lxc_conf *);
+static int config_rootfs(const char *, char *, struct lxc_conf *);
+static int config_rootfs_mount(const char *, char *, struct lxc_conf *);
+static int config_pivotdir(const char *, char *, struct lxc_conf *);
+static int config_utsname(const char *, char *, struct lxc_conf *);
+static int config_hook(const char *key, char *value, struct lxc_conf *lxc_conf);
+static int config_network_type(const char *, char *, struct lxc_conf *);
+static int config_network_flags(const char *, char *, struct lxc_conf *);
+static int config_network_link(const char *, char *, struct lxc_conf *);
+static int config_network_name(const char *, char *, struct lxc_conf *);
+static int config_network_veth_pair(const char *, char *, struct lxc_conf *);
+static int config_network_macvlan_mode(const char *, char *, struct lxc_conf *);
+static int config_network_hwaddr(const char *, char *, struct lxc_conf *);
+static int config_network_vlan_id(const char *, char *, struct lxc_conf *);
+static int config_network_mtu(const char *, char *, struct lxc_conf *);
+static int config_network_ipv4(const char *, char *, struct lxc_conf *);
+static int config_network_ipv4_gateway(const char *, char *, struct lxc_conf *);
+static int config_network_script(const char *, char *, struct lxc_conf *);
+static int config_network_ipv6(const char *, char *, struct lxc_conf *);
+static int config_network_ipv6_gateway(const char *, char *, struct lxc_conf *);
+static int config_cap_drop(const char *, char *, struct lxc_conf *);
+static int config_console(const char *, char *, struct lxc_conf *);
+static int config_seccomp(const char *, char *, struct lxc_conf *);
+static int config_includefile(const char *, char *, struct lxc_conf *);
+static int config_network_nic(const char *, char *, struct lxc_conf *);
+
+typedef int (*config_cb)(const char *, char *, struct lxc_conf *);
+
+static struct lxc_config_t config[] = {
+
+	{ "lxc.arch",                 config_personality          },
+	{ "lxc.pts",                  config_pts                  },
+	{ "lxc.tty",                  config_tty                  },
+	{ "lxc.devttydir",            config_ttydir               },
+	{ "lxc.aa_profile",            config_aa_profile          },
+	{ "lxc.cgroup",               config_cgroup               },
+	{ "lxc.mount",                config_mount                },
+	{ "lxc.rootfs.mount",         config_rootfs_mount         },
+	{ "lxc.rootfs",               config_rootfs               },
+	{ "lxc.pivotdir",             config_pivotdir             },
+	{ "lxc.utsname",              config_utsname              },
+	{ "lxc.hook.pre-start",       config_hook                 },
+	{ "lxc.hook.mount",           config_hook                 },
+	{ "lxc.hook.start",           config_hook                 },
+	{ "lxc.hook.post-stop",       config_hook                 },
+	{ "lxc.network.type",         config_network_type         },
+	{ "lxc.network.flags",        config_network_flags        },
+	{ "lxc.network.link",         config_network_link         },
+	{ "lxc.network.name",         config_network_name         },
+	{ "lxc.network.macvlan.mode", config_network_macvlan_mode },
+	{ "lxc.network.veth.pair",    config_network_veth_pair    },
+	{ "lxc.network.script.up",    config_network_script       },
+	{ "lxc.network.hwaddr",       config_network_hwaddr       },
+	{ "lxc.network.mtu",          config_network_mtu          },
+	{ "lxc.network.vlan.id",      config_network_vlan_id      },
+	{ "lxc.network.ipv4.gateway", config_network_ipv4_gateway },
+	{ "lxc.network.ipv4",         config_network_ipv4         },
+	{ "lxc.network.ipv6.gateway", config_network_ipv6_gateway },
+	{ "lxc.network.ipv6",         config_network_ipv6         },
+	/* config_network_nic must come after all other 'lxc.network.*' entries */
+	{ "lxc.network.",             config_network_nic          },
+	{ "lxc.cap.drop",             config_cap_drop             },
+	{ "lxc.console",              config_console              },
+	{ "lxc.seccomp",              config_seccomp              },
+	{ "lxc.include",              config_includefile          },
+};
+
+static const size_t config_size = sizeof(config)/sizeof(struct lxc_config_t);
+
+extern struct lxc_config_t *lxc_getconfig(const char *key)
+{
+	int i;
+
+	for (i = 0; i < config_size; i++)
+		if (!strncmp(config[i].name, key,
+			     strlen(config[i].name)))
+			return &config[i];
+	return NULL;
+}
+
+#define strprint(str, inlen, ...) \
+	do { \
+		len = snprintf(str, inlen, ##__VA_ARGS__); \
+		if (len < 0) { SYSERROR("snprintf"); return -1; }; \
+		fulllen += len; \
+		if (inlen > 0) { \
+			if (str) str += len; \
+			inlen -= len; \
+			if (inlen < 0) inlen = 0; \
+		} \
+	} while (0);
+
+int lxc_listconfigs(char *retv, int inlen)
+{
+	int i, fulllen = 0, len;
+
+	if (!retv)
+		inlen = 0;
+	else
+		memset(retv, 0, inlen);
+	for (i = 0; i < config_size; i++) {
+		char *s = config[i].name;
+		if (s[strlen(s)-1] == '.')
+			continue;
+		strprint(retv, inlen, "%s\n", s);
+	}
+	return fulllen;
+}
+
+/*
+ * config entry is something like "lxc.network.0.ipv4"
+ * the key 'lxc.network.' was found.  So we make sure next
+ * comes an integer, find the right callback (by rewriting
+ * the key), and call it.
+ */
+static int config_network_nic(const char *key, char *value,
+			       struct lxc_conf *lxc_conf)
+{
+	char *copy = strdup(key), *p;
+	int ret = -1;
+	struct lxc_config_t *config;
+
+	if (!copy) {
+		SYSERROR("failed to allocate memory");
+		return -1;
+	}
+	/*
+	 * ok we know that to get here we've got "lxc.network."
+	 * and it isn't any of the other network entries.  So
+	 * after the second . should come an integer (# of defined
+	 * nic) followed by a valid entry.
+	 */
+	if (*(key+12) < '0' || *(key+12) > '9')
+		goto out;
+	p = index(key+12, '.');
+	if (!p)
+		goto out;
+	strcpy(copy+12, p+1);
+	config = lxc_getconfig(copy);
+	if (!config) {
+		ERROR("unknown key %s", key);
+		goto out;
+	}
+	ret = config->cb(key, value, lxc_conf);
+
+out:
+	free(copy);
+	return ret;
+}
+
+static int config_network_type(const char *key, char *value,
+			       struct lxc_conf *lxc_conf)
+{
+	struct lxc_list *network = &lxc_conf->network;
+	struct lxc_netdev *netdev;
+	struct lxc_list *list;
+
+	netdev = malloc(sizeof(*netdev));
+	if (!netdev) {
+		SYSERROR("failed to allocate memory");
+		return -1;
+	}
+
+	memset(netdev, 0, sizeof(*netdev));
+	lxc_list_init(&netdev->ipv4);
+	lxc_list_init(&netdev->ipv6);
+
+	list = malloc(sizeof(*list));
+	if (!list) {
+		SYSERROR("failed to allocate memory");
+		return -1;
+	}
+
+	lxc_list_init(list);
+	list->elem = netdev;
+
+	lxc_list_add_tail(network, list);
+
+	if (!strcmp(value, "veth"))
+		netdev->type = LXC_NET_VETH;
+	else if (!strcmp(value, "macvlan"))
+		netdev->type = LXC_NET_MACVLAN;
+	else if (!strcmp(value, "vlan"))
+		netdev->type = LXC_NET_VLAN;
+	else if (!strcmp(value, "phys"))
+		netdev->type = LXC_NET_PHYS;
+	else if (!strcmp(value, "empty"))
+		netdev->type = LXC_NET_EMPTY;
+	else {
+		ERROR("invalid network type %s", value);
+		return -1;
+	}
+	return 0;
+}
+
+static int config_ip_prefix(struct in_addr *addr)
+{
+	if (IN_CLASSA(addr->s_addr))
+		return 32 - IN_CLASSA_NSHIFT;
+	if (IN_CLASSB(addr->s_addr))
+		return 32 - IN_CLASSB_NSHIFT;
+	if (IN_CLASSC(addr->s_addr))
+		return 32 - IN_CLASSC_NSHIFT;
+
+	return 0;
+}
+
+/*
+ * if you have p="lxc.network.0.link", pass it p+12
+ * to get back '0' (the index of the nic)
+ */
+static int get_network_netdev_idx(const char *key)
+{
+	int ret, idx;
+
+	if (*key < '0' || *key > '9')
+		return -1;
+	ret = sscanf(key, "%d", &idx);
+	if (ret != 1)
+		return -1;
+	return idx;
+}
+
+/*
+ * if you have p="lxc.network.0", pass this p+12 and it will return
+ * the netdev of the first configured nic
+ */
+static struct lxc_netdev *get_netdev_from_key(const char *key,
+					      struct lxc_list *network)
+{
+	int i = 0, idx = get_network_netdev_idx(key);
+	struct lxc_netdev *netdev = NULL;
+	struct lxc_list *it;
+	if (idx == -1)
+		return NULL;
+	lxc_list_for_each(it, network) {
+		if (idx == i++) {
+			netdev = it->elem;
+			break;
+		}
+	}
+	return netdev;
+}
+
+extern int lxc_list_nicconfigs(struct lxc_conf *c, char *key, char *retv, int inlen)
+{
+	struct lxc_netdev *netdev;
+	int fulllen = 0, len;
+
+	netdev = get_netdev_from_key(key+12, &c->network);
+	if (!netdev)
+		return -1;
+
+	if (!retv)
+		inlen = 0;
+	else
+		memset(retv, 0, inlen);
+
+	strprint(retv, inlen, "script.up\n");
+	if (netdev->type != LXC_NET_EMPTY) {
+		strprint(retv, inlen, "flags\n");
+		strprint(retv, inlen, "link\n");
+		strprint(retv, inlen, "name\n");
+		strprint(retv, inlen, "hwaddr\n");
+		strprint(retv, inlen, "mtu\n");
+		strprint(retv, inlen, "ipv6\n");
+		strprint(retv, inlen, "ipv6_gateway\n");
+		strprint(retv, inlen, "ipv4\n");
+		strprint(retv, inlen, "ipv4_gateway\n");
+	}
+	switch(netdev->type) {
+	case LXC_NET_VETH:
+		strprint(retv, inlen, "veth.pair\n");
+		break;
+	case LXC_NET_MACVLAN:
+		strprint(retv, inlen, "macvlan.mode\n");
+		break;
+	case LXC_NET_VLAN:
+		strprint(retv, inlen, "vlan.id\n");
+		break;
+	case LXC_NET_PHYS:
+		break;
+	}
+	return fulllen;
+}
+
+static struct lxc_netdev *network_netdev(const char *key, const char *value,
+					 struct lxc_list *network)
+{
+	struct lxc_netdev *netdev = NULL;
+
+	if (lxc_list_empty(network)) {
+		ERROR("network is not created for '%s' = '%s' option",
+		      key, value);
+		return NULL;
+	}
+
+	if (get_network_netdev_idx(key+12) == -1)
+		netdev = lxc_list_last_elem(network);
+	else
+		netdev = get_netdev_from_key(key+12, network);
+
+	if (!netdev) {
+		ERROR("no network device defined for '%s' = '%s' option",
+		      key, value);
+		return NULL;
+	}
+
+	return netdev;
+}
+
+static int network_ifname(char **valuep, char *value)
+{
+	if (strlen(value) >= IFNAMSIZ) {
+		ERROR("invalid interface name: %s", value);
+		return -1;
+	}
+
+	*valuep = strdup(value);
+	if (!*valuep) {
+		ERROR("failed to dup string '%s'", value);
+		return -1;
+	}
+
+	return 0;
+}
+
+#ifndef MACVLAN_MODE_PRIVATE
+#  define MACVLAN_MODE_PRIVATE 1
+#endif
+
+#ifndef MACVLAN_MODE_VEPA
+#  define MACVLAN_MODE_VEPA 2
+#endif
+
+#ifndef MACVLAN_MODE_BRIDGE
+#  define MACVLAN_MODE_BRIDGE 4
+#endif
+
+static int macvlan_mode(int *valuep, char *value)
+{
+	struct mc_mode {
+		char *name;
+		int mode;
+	} m[] = {
+		{ "private", MACVLAN_MODE_PRIVATE },
+		{ "vepa", MACVLAN_MODE_VEPA },
+		{ "bridge", MACVLAN_MODE_BRIDGE },
+	};
+
+	int i;
+
+	for (i = 0; i < sizeof(m)/sizeof(m[0]); i++) {
+		if (strcmp(m[i].name, value))
+			continue;
+
+		*valuep = m[i].mode;
+		return 0;
+	}
+
+	return -1;
+}
+
+static int config_network_flags(const char *key, char *value,
+				struct lxc_conf *lxc_conf)
+{
+	struct lxc_netdev *netdev;
+
+	netdev = network_netdev(key, value, &lxc_conf->network);
+	if (!netdev)
+		return -1;
+
+	netdev->flags |= IFF_UP;
+
+	return 0;
+}
+
+static int config_network_link(const char *key, char *value,
+			       struct lxc_conf *lxc_conf)
+{
+	struct lxc_netdev *netdev;
+
+	netdev = network_netdev(key, value, &lxc_conf->network);
+	if (!netdev)
+		return -1;
+
+	return network_ifname(&netdev->link, value);
+}
+
+static int config_network_name(const char *key, char *value,
+			       struct lxc_conf *lxc_conf)
+{
+	struct lxc_netdev *netdev;
+
+	netdev = network_netdev(key, value, &lxc_conf->network);
+	if (!netdev)
+		return -1;
+
+	return network_ifname(&netdev->name, value);
+}
+
+static int config_network_veth_pair(const char *key, char *value,
+				    struct lxc_conf *lxc_conf)
+{
+	struct lxc_netdev *netdev;
+
+	netdev = network_netdev(key, value, &lxc_conf->network);
+	if (!netdev)
+		return -1;
+
+	return network_ifname(&netdev->priv.veth_attr.pair, value);
+}
+
+static int config_network_macvlan_mode(const char *key, char *value,
+				       struct lxc_conf *lxc_conf)
+{
+	struct lxc_netdev *netdev;
+
+	netdev = network_netdev(key, value, &lxc_conf->network);
+	if (!netdev)
+		return -1;
+
+	return macvlan_mode(&netdev->priv.macvlan_attr.mode, value);
+}
+
+static int config_network_hwaddr(const char *key, char *value,
+				 struct lxc_conf *lxc_conf)
+{
+	struct lxc_netdev *netdev;
+
+	netdev = network_netdev(key, value, &lxc_conf->network);
+	if (!netdev)
+		return -1;
+
+	netdev->hwaddr = strdup(value);
+	if (!netdev->hwaddr) {
+		SYSERROR("failed to dup string '%s'", value);
+		return -1;
+	}
+
+	return 0;
+}
+
+static int config_network_vlan_id(const char *key, char *value,
+			       struct lxc_conf *lxc_conf)
+{
+	struct lxc_netdev *netdev;
+
+	netdev = network_netdev(key, value, &lxc_conf->network);
+	if (!netdev)
+		return -1;
+
+	if (get_u16(&netdev->priv.vlan_attr.vid, value, 0))
+		return -1;
+
+	return 0;
+}
+
+static int config_network_mtu(const char *key, char *value,
+			      struct lxc_conf *lxc_conf)
+{
+	struct lxc_netdev *netdev;
+
+	netdev = network_netdev(key, value, &lxc_conf->network);
+	if (!netdev)
+		return -1;
+
+	netdev->mtu = strdup(value);
+	if (!netdev->mtu) {
+		SYSERROR("failed to dup string '%s'", value);
+		return -1;
+	}
+
+	return 0;
+}
+
+static int config_network_ipv4(const char *key, char *value,
+			       struct lxc_conf *lxc_conf)
+{
+	struct lxc_netdev *netdev;
+	struct lxc_inetdev *inetdev;
+	struct lxc_list *list;
+	char *cursor, *slash, *addr = NULL, *bcast = NULL, *prefix = NULL;
+
+	netdev = network_netdev(key, value, &lxc_conf->network);
+	if (!netdev)
+		return -1;
+
+	inetdev = malloc(sizeof(*inetdev));
+	if (!inetdev) {
+		SYSERROR("failed to allocate ipv4 address");
+		return -1;
+	}
+	memset(inetdev, 0, sizeof(*inetdev));
+
+	list = malloc(sizeof(*list));
+	if (!list) {
+		SYSERROR("failed to allocate memory");
+		return -1;
+	}
+
+	lxc_list_init(list);
+	list->elem = inetdev;
+
+	addr = value;
+
+	cursor = strstr(addr, " ");
+	if (cursor) {
+		*cursor = '\0';
+		bcast = cursor + 1;
+	}
+
+	slash = strstr(addr, "/");
+	if (slash) {
+		*slash = '\0';
+		prefix = slash + 1;
+	}
+
+	if (!addr) {
+		ERROR("no address specified");
+		return -1;
+	}
+
+	if (!inet_pton(AF_INET, addr, &inetdev->addr)) {
+		SYSERROR("invalid ipv4 address: %s", value);
+		return -1;
+	}
+
+	if (bcast && !inet_pton(AF_INET, bcast, &inetdev->bcast)) {
+		SYSERROR("invalid ipv4 broadcast address: %s", value);
+		return -1;
+	}
+
+	/* no prefix specified, determine it from the network class */
+	inetdev->prefix = prefix ? atoi(prefix) :
+		config_ip_prefix(&inetdev->addr);
+
+	/* if no broadcast address, let compute one from the
+	 * prefix and address
+	 */
+	if (!bcast) {
+		inetdev->bcast.s_addr = inetdev->addr.s_addr;
+		inetdev->bcast.s_addr |=
+			htonl(INADDR_BROADCAST >>  inetdev->prefix);
+	}
+
+	lxc_list_add(&netdev->ipv4, list);
+
+	return 0;
+}
+
+static int config_network_ipv4_gateway(const char *key, char *value,
+			               struct lxc_conf *lxc_conf)
+{
+	struct lxc_netdev *netdev;
+	struct in_addr *gw;
+
+	netdev = network_netdev(key, value, &lxc_conf->network);
+	if (!netdev)
+		return -1;
+
+	gw = malloc(sizeof(*gw));
+	if (!gw) {
+		SYSERROR("failed to allocate ipv4 gateway address");
+		return -1;
+	}
+
+	if (!value) {
+		ERROR("no ipv4 gateway address specified");
+		return -1;
+	}
+
+	if (!strcmp(value, "auto")) {
+		netdev->ipv4_gateway = NULL;
+		netdev->ipv4_gateway_auto = true;
+	} else {
+		if (!inet_pton(AF_INET, value, gw)) {
+			SYSERROR("invalid ipv4 gateway address: %s", value);
+			return -1;
+		}
+
+		netdev->ipv4_gateway = gw;
+		netdev->ipv4_gateway_auto = false;
+	}
+
+	return 0;
+}
+
+static int config_network_ipv6(const char *key, char *value,
+			       struct lxc_conf *lxc_conf)
+{
+	struct lxc_netdev *netdev;
+	struct lxc_inet6dev *inet6dev;
+	struct lxc_list *list;
+	char *slash;
+	char *netmask;
+
+	netdev = network_netdev(key, value, &lxc_conf->network);
+	if (!netdev)
+		return -1;
+
+	inet6dev = malloc(sizeof(*inet6dev));
+	if (!inet6dev) {
+		SYSERROR("failed to allocate ipv6 address");
+		return -1;
+	}
+	memset(inet6dev, 0, sizeof(*inet6dev));
+
+	list = malloc(sizeof(*list));
+	if (!list) {
+		SYSERROR("failed to allocate memory");
+		return -1;
+	}
+
+	lxc_list_init(list);
+	list->elem = inet6dev;
+
+	inet6dev->prefix = 64;
+	slash = strstr(value, "/");
+	if (slash) {
+		*slash = '\0';
+		netmask = slash + 1;
+		inet6dev->prefix = atoi(netmask);
+	}
+
+	if (!inet_pton(AF_INET6, value, &inet6dev->addr)) {
+		SYSERROR("invalid ipv6 address: %s", value);
+		return -1;
+	}
+
+	lxc_list_add(&netdev->ipv6, list);
+
+	return 0;
+}
+
+static int config_network_ipv6_gateway(const char *key, char *value,
+			               struct lxc_conf *lxc_conf)
+{
+	struct lxc_netdev *netdev;
+	struct in6_addr *gw;
+
+	netdev = network_netdev(key, value, &lxc_conf->network);
+	if (!netdev)
+		return -1;
+
+	gw = malloc(sizeof(*gw));
+	if (!gw) {
+		SYSERROR("failed to allocate ipv6 gateway address");
+		return -1;
+	}
+
+	if (!value) {
+		ERROR("no ipv6 gateway address specified");
+		return -1;
+	}
+
+	if (!strcmp(value, "auto")) {
+		netdev->ipv6_gateway = NULL;
+		netdev->ipv6_gateway_auto = true;
+	} else {
+		if (!inet_pton(AF_INET6, value, gw)) {
+			SYSERROR("invalid ipv6 gateway address: %s", value);
+			return -1;
+		}
+
+		netdev->ipv6_gateway = gw;
+		netdev->ipv6_gateway_auto = false;
+	}
+
+	return 0;
+}
+
+static int config_network_script(const char *key, char *value,
+				 struct lxc_conf *lxc_conf)
+{
+	struct lxc_netdev *netdev;
+
+	netdev = network_netdev(key, value, &lxc_conf->network);
+	if (!netdev)
+	return -1;
+
+	char *copy = strdup(value);
+	if (!copy) {
+		SYSERROR("failed to dup string '%s'", value);
+		return -1;
+	}
+	if (strstr(key, "script.up") != NULL) {
+		netdev->upscript = copy;
+		return 0;
+	}
+	SYSERROR("Unknown key: %s", key);
+	free(copy);
+	return -1;
+}
+
+static int add_hook(struct lxc_conf *lxc_conf, int which, char *hook)
+{
+	struct lxc_list *hooklist;
+
+	hooklist = malloc(sizeof(*hooklist));
+	if (!hooklist) {
+		free(hook);
+		return -1;
+	}
+	hooklist->elem = hook;
+	lxc_list_add_tail(&lxc_conf->hooks[which], hooklist);
+	return 0;
+}
+
+static int config_seccomp(const char *key, char *value,
+				 struct lxc_conf *lxc_conf)
+{
+	char *path;
+
+	if (lxc_conf->seccomp) {
+		ERROR("seccomp already defined");
+		return -1;
+	}
+	path = strdup(value);
+	if (!path) {
+		SYSERROR("failed to strdup '%s': %m", value);
+		return -1;
+	}
+
+	lxc_conf->seccomp = path;
+
+	return 0;
+}
+
+static int config_hook(const char *key, char *value,
+				 struct lxc_conf *lxc_conf)
+{
+	char *copy = strdup(value);
+	if (!copy) {
+		SYSERROR("failed to dup string '%s'", value);
+		return -1;
+	}
+	if (strcmp(key, "lxc.hook.pre-start") == 0)
+		return add_hook(lxc_conf, LXCHOOK_PRESTART, copy);
+	else if (strcmp(key, "lxc.hook.mount") == 0)
+		return add_hook(lxc_conf, LXCHOOK_MOUNT, copy);
+	else if (strcmp(key, "lxc.hook.start") == 0)
+		return add_hook(lxc_conf, LXCHOOK_START, copy);
+	else if (strcmp(key, "lxc.hook.post-stop") == 0)
+		return add_hook(lxc_conf, LXCHOOK_POSTSTOP, copy);
+	SYSERROR("Unknown key: %s", key);
+	free(copy);
+	return -1;
+}
+
+static int config_personality(const char *key, char *value,
+			      struct lxc_conf *lxc_conf)
+{
+	signed long personality = lxc_config_parse_arch(value);
+
+	if (personality >= 0)
+		lxc_conf->personality = personality;
+	else
+		WARN("unsupported personality '%s'", value);
+
+	return 0;
+}
+
+static int config_pts(const char *key, char *value, struct lxc_conf *lxc_conf)
+{
+	int maxpts = atoi(value);
+
+	lxc_conf->pts = maxpts;
+
+	return 0;
+}
+
+static int config_tty(const char *key, char *value, struct lxc_conf *lxc_conf)
+{
+	int nbtty = atoi(value);
+
+	lxc_conf->tty = nbtty;
+
+	return 0;
+}
+
+static int config_ttydir(const char *key, char *value,
+			  struct lxc_conf *lxc_conf)
+{
+	char *path;
+
+	if (!value || strlen(value) == 0)
+		return 0;
+	path = strdup(value);
+	if (!path) {
+		SYSERROR("failed to strdup '%s': %m", value);
+		return -1;
+	}
+
+	lxc_conf->ttydir = path;
+
+	return 0;
+}
+
+static int config_aa_profile(const char *key, char *value,
+			  struct lxc_conf *lxc_conf)
+{
+	char *path;
+
+	if (!value || strlen(value) == 0)
+		return 0;
+	path = strdup(value);
+	if (!path) {
+		SYSERROR("failed to strdup '%s': %m", value);
+		return -1;
+	}
+
+	lxc_conf->aa_profile = path;
+
+	return 0;
+}
+
+static int config_cgroup(const char *key, char *value, struct lxc_conf *lxc_conf)
+{
+	char *token = "lxc.cgroup.";
+	char *subkey;
+	struct lxc_list *cglist = NULL;
+	struct lxc_cgroup *cgelem = NULL;
+
+	subkey = strstr(key, token);
+
+	if (!subkey)
+		return -1;
+
+	if (!strlen(subkey))
+		return -1;
+
+	if (strlen(subkey) == strlen(token))
+		return -1;
+
+	subkey += strlen(token);
+
+	cglist = malloc(sizeof(*cglist));
+	if (!cglist)
+		goto out;
+
+	cgelem = malloc(sizeof(*cgelem));
+	if (!cgelem)
+		goto out;
+	memset(cgelem, 0, sizeof(*cgelem));
+
+	cgelem->subsystem = strdup(subkey);
+	cgelem->value = strdup(value);
+
+	if (!cgelem->subsystem || !cgelem->value)
+		goto out;
+
+	cglist->elem = cgelem;
+
+	lxc_list_add_tail(&lxc_conf->cgroup, cglist);
+
+	return 0;
+
+out:
+	if (cglist)
+		free(cglist);
+
+	if (cgelem) {
+		if (cgelem->subsystem)
+			free(cgelem->subsystem);
+
+		if (cgelem->value)
+			free(cgelem->value);
+
+		free(cgelem);
+	}
+
+	return -1;
+}
+
+static int config_fstab(const char *key, char *value, struct lxc_conf *lxc_conf)
+{
+	if (strlen(value) >= MAXPATHLEN) {
+		ERROR("%s path is too long", value);
+		return -1;
+	}
+
+	lxc_conf->fstab = strdup(value);
+	if (!lxc_conf->fstab) {
+		SYSERROR("failed to duplicate string %s", value);
+		return -1;
+	}
+
+	return 0;
+}
+
+static int config_mount(const char *key, char *value, struct lxc_conf *lxc_conf)
+{
+	char *fstab_token = "lxc.mount";
+	char *token = "lxc.mount.entry";
+	char *subkey;
+	char *mntelem;
+	struct lxc_list *mntlist;
+
+	subkey = strstr(key, token);
+
+	if (!subkey) {
+		subkey = strstr(key, fstab_token);
+
+		if (!subkey)
+			return -1;
+
+		return config_fstab(key, value, lxc_conf);
+	}
+
+	if (!strlen(subkey))
+		return -1;
+
+	mntlist = malloc(sizeof(*mntlist));
+	if (!mntlist)
+		return -1;
+
+	mntelem = strdup(value);
+	if (!mntelem)
+		return -1;
+	mntlist->elem = mntelem;
+
+	lxc_list_add_tail(&lxc_conf->mount_list, mntlist);
+
+	return 0;
+}
+
+static int config_cap_drop(const char *key, char *value,
+			   struct lxc_conf *lxc_conf)
+{
+	char *dropcaps, *sptr, *token;
+	struct lxc_list *droplist;
+	int ret = -1;
+
+	if (!strlen(value))
+		return -1;
+
+	dropcaps = strdup(value);
+	if (!dropcaps) {
+		SYSERROR("failed to dup '%s'", value);
+		return -1;
+	}
+
+	/* in case several capability drop is specified in a single line
+	 * split these caps in a single element for the list */
+	for (;;) {
+                token = strtok_r(dropcaps, " \t", &sptr);
+                if (!token) {
+			ret = 0;
+                        break;
+		}
+		dropcaps = NULL;
+
+		droplist = malloc(sizeof(*droplist));
+		if (!droplist) {
+			SYSERROR("failed to allocate drop list");
+			break;
+		}
+
+		/* note - i do believe we're losing memory here,
+		   note that token is already pointing into dropcaps
+		   which is strdup'd.  we never free that bit.
+		 */
+		droplist->elem = strdup(token);
+		if (!droplist->elem) {
+			SYSERROR("failed to dup '%s'", token);
+			free(droplist);
+			break;
+		}
+
+		lxc_list_add_tail(&lxc_conf->caps, droplist);
+        }
+
+	free(dropcaps);
+
+	return ret;
+}
+
+static int config_console(const char *key, char *value,
+			  struct lxc_conf *lxc_conf)
+{
+	char *path;
+
+	path = strdup(value);
+	if (!path) {
+		SYSERROR("failed to strdup '%s': %m", value);
+		return -1;
+	}
+
+	lxc_conf->console.path = path;
+
+	return 0;
+}
+
+static int config_includefile(const char *key, char *value,
+			  struct lxc_conf *lxc_conf)
+{
+	return lxc_config_read(value, lxc_conf);
+}
+
+static int config_rootfs(const char *key, char *value, struct lxc_conf *lxc_conf)
+{
+	if (strlen(value) >= MAXPATHLEN) {
+		ERROR("%s path is too long", value);
+		return -1;
+	}
+
+	lxc_conf->rootfs.path = strdup(value);
+	if (!lxc_conf->rootfs.path) {
+		SYSERROR("failed to duplicate string %s", value);
+		return -1;
+	}
+
+	return 0;
+}
+
+static int config_rootfs_mount(const char *key, char *value, struct lxc_conf *lxc_conf)
+{
+	if (strlen(value) >= MAXPATHLEN) {
+		ERROR("%s path is too long", value);
+		return -1;
+	}
+
+	lxc_conf->rootfs.mount = strdup(value);
+	if (!lxc_conf->rootfs.mount) {
+		SYSERROR("failed to duplicate string '%s'", value);
+		return -1;
+	}
+
+	return 0;
+}
+
+static int config_pivotdir(const char *key, char *value, struct lxc_conf *lxc_conf)
+{
+	if (strlen(value) >= MAXPATHLEN) {
+		ERROR("%s path is too long", value);
+		return -1;
+	}
+
+	lxc_conf->rootfs.pivot = strdup(value);
+	if (!lxc_conf->rootfs.pivot) {
+		SYSERROR("failed to duplicate string %s", value);
+		return -1;
+	}
+
+	return 0;
+}
+
+static int config_utsname(const char *key, char *value, struct lxc_conf *lxc_conf)
+{
+	struct utsname *utsname;
+
+	utsname = malloc(sizeof(*utsname));
+	if (!utsname) {
+		SYSERROR("failed to allocate memory");
+		return -1;
+	}
+
+	if (strlen(value) >= sizeof(utsname->nodename)) {
+		ERROR("node name '%s' is too long",
+			      utsname->nodename);
+		return -1;
+	}
+
+	strcpy(utsname->nodename, value);
+	lxc_conf->utsname = utsname;
+
+	return 0;
+}
+
+static int parse_line(char *buffer, void *data)
+{
+	struct lxc_config_t *config;
+	char *line, *linep;
+	char *dot;
+	char *key;
+	char *value;
+	int ret = 0;
+
+	if (lxc_is_line_empty(buffer))
+		return 0;
+
+	/* we have to dup the buffer otherwise, at the re-exec for
+	 * reboot we modified the original string on the stack by
+	 * replacing '=' by '\0' below
+	 */
+	linep = line = strdup(buffer);
+	if (!line) {
+		SYSERROR("failed to allocate memory for '%s'", buffer);
+		return -1;
+	}
+
+	line += lxc_char_left_gc(line, strlen(line));
+
+	/* martian option - ignoring it, the commented lines beginning by '#'
+	 * fall in this case
+	 */
+	if (strncmp(line, "lxc.", 4))
+		goto out;
+
+	ret = -1;
+
+	dot = strstr(line, "=");
+	if (!dot) {
+		ERROR("invalid configuration line: %s", line);
+		goto out;
+	}
+
+	*dot = '\0';
+	value = dot + 1;
+
+	key = line;
+	key[lxc_char_right_gc(key, strlen(key))] = '\0';
+
+	value += lxc_char_left_gc(value, strlen(value));
+	value[lxc_char_right_gc(value, strlen(value))] = '\0';
+
+	config = lxc_getconfig(key);
+	if (!config) {
+		ERROR("unknown key %s", key);
+		goto out;
+	}
+
+	ret = config->cb(key, value, data);
+
+out:
+	free(linep);
+	return ret;
+}
+
+int lxc_config_readline(char *buffer, struct lxc_conf *conf)
+{
+	return parse_line(buffer, conf);
+}
+
+int lxc_config_read(const char *file, struct lxc_conf *conf)
+{
+	return lxc_file_for_each_line(file, parse_line, conf);
+}
+
+int lxc_config_define_add(struct lxc_list *defines, char* arg)
+{
+	struct lxc_list *dent;
+
+	dent = malloc(sizeof(struct lxc_list));
+	if (!dent)
+		return -1;
+
+	dent->elem = arg;
+	lxc_list_add_tail(defines, dent);
+	return 0;
+}
+
+int lxc_config_define_load(struct lxc_list *defines, struct lxc_conf *conf)
+{
+	struct lxc_list *it;
+	int ret = 0;
+
+	lxc_list_for_each(it, defines) {
+		ret = lxc_config_readline(it->elem, conf);
+		if (ret)
+			break;
+	}
+
+	lxc_list_for_each(it, defines) {
+		lxc_list_del(it);
+		free(it);
+	}
+
+	return ret;
+}
+
+signed long lxc_config_parse_arch(const char *arch)
+{
+	struct per_name {
+		char *name;
+		unsigned long per;
+	} pername[4] = {
+		{ "x86", PER_LINUX32 },
+		{ "i686", PER_LINUX32 },
+		{ "x86_64", PER_LINUX },
+		{ "amd64", PER_LINUX },
+	};
+	size_t len = sizeof(pername) / sizeof(pername[0]);
+
+	int i;
+
+	for (i = 0; i < len; i++) {
+		if (!strcmp(pername[i].name, arch))
+		    return pername[i].per;
+	}
+
+	return -1;
+}
+
+static int lxc_get_conf_int(struct lxc_conf *c, char *retv, int inlen, int v)
+{
+	if (!retv)
+		inlen = 0;
+	else
+		memset(retv, 0, inlen);
+	return snprintf(retv, inlen, "%d", v);
+}
+
+static int lxc_get_arch_entry(struct lxc_conf *c, char *retv, int inlen)
+{
+	int len, fulllen = 0;
+
+	if (!retv)
+		inlen = 0;
+	else
+		memset(retv, 0, inlen);
+
+	switch(c->personality) {
+	case PER_LINUX32: strprint(retv, inlen, "x86"); break;
+	case PER_LINUX: strprint(retv, inlen, "x86_64"); break;
+	default: break;
+	}
+
+	return fulllen;
+}
+
+/*
+ * If you ask for a specific cgroup value, i.e. lxc.cgroup.devices.list,
+ * then just the value(s) will be printed.  Since there still could be
+ * more than one, it is newline-separated.
+ * (Maybe that's ambigous, since some values, i.e. devices.list, will
+ * already have newlines?)
+ * If you ask for 'lxc.cgroup", then all cgroup entries will be printed,
+ * in 'lxc.cgroup.subsystem.key = value' format.
+ */
+static int lxc_get_cgroup_entry(struct lxc_conf *c, char *retv, int inlen, char *key)
+{
+	int fulllen = 0, len;
+	int all = 0;
+	struct lxc_list *it;
+
+	if (!retv)
+		inlen = 0;
+	else
+		memset(retv, 0, inlen);
+
+	if (strcmp(key, "all") == 0)
+		all = 1;
+
+	lxc_list_for_each(it, &c->cgroup) {
+		struct lxc_cgroup *cg = it->elem;
+		if (all) {
+			strprint(retv, inlen, "lxc.cgroup.%s = %s\n", cg->subsystem, cg->value);
+		} else if (strcmp(cg->subsystem, key) == 0) {
+			strprint(retv, inlen, "%s\n", cg->value);
+		}
+	}
+	return fulllen;
+}
+
+static int lxc_get_item_hooks(struct lxc_conf *c, char *retv, int inlen, char *key)
+{
+	char *subkey;
+	int len, fulllen = 0, found = -1;
+	struct lxc_list *it;
+	int i;
+
+	/* "lxc.hook.mount" */
+	subkey = index(key, '.');
+	if (subkey) subkey = index(subkey+1, '.');
+	if (!subkey)
+		return -1;
+	subkey++;
+	if (!*subkey)
+		return -1;
+	for (i=0; i<NUM_LXC_HOOKS; i++) {
+		if (strcmp(lxchook_names[i], subkey) == 0) {
+			found=i;
+			break;
+		}
+	}
+	if (found == -1)
+		return -1;
+
+	if (!retv)
+		inlen = 0;
+	else
+		memset(retv, 0, inlen);
+
+	lxc_list_for_each(it, &c->hooks[found]) {
+		strprint(retv, inlen, "%s\n", (char *)it->elem);
+	}
+	return fulllen;
+}
+
+static int lxc_get_item_cap_drop(struct lxc_conf *c, char *retv, int inlen)
+{
+	int len, fulllen = 0;
+	struct lxc_list *it;
+
+	if (!retv)
+		inlen = 0;
+	else
+		memset(retv, 0, inlen);
+
+	lxc_list_for_each(it, &c->caps) {
+		strprint(retv, inlen, "%s\n", (char *)it->elem);
+	}
+	return fulllen;
+}
+
+static int lxc_get_mount_entries(struct lxc_conf *c, char *retv, int inlen)
+{
+	int len, fulllen = 0;
+	struct lxc_list *it;
+
+	if (!retv)
+		inlen = 0;
+	else
+		memset(retv, 0, inlen);
+
+	lxc_list_for_each(it, &c->mount_list) {
+		strprint(retv, inlen, "%s\n", (char *)it->elem);
+	}
+	return fulllen;
+}
+
+/*
+ * lxc.network.0.XXX, where XXX can be: name, type, link, flags, type,
+ * macvlan.mode, veth.pair, vlan, ipv4, ipv6, upscript, hwaddr, mtu,
+ * ipv4_gateway, ipv6_gateway.  ipvX_gateway can return 'auto' instead
+ * of an address.  ipv4 and ipv6 return lists (newline-separated).
+ * things like veth.pair return '' if invalid (i.e. if called for vlan
+ * type).
+ */
+static int lxc_get_item_nic(struct lxc_conf *c, char *retv, int inlen, char *key)
+{
+	char *p1;
+	int len, fulllen = 0;
+	struct lxc_netdev *netdev;
+
+	if (!retv)
+		inlen = 0;
+	else
+		memset(retv, 0, inlen);
+
+	p1 = index(key, '.');
+	if (!p1 || *(p1+1) == '\0') return -1;
+	p1++;
+
+	netdev = get_netdev_from_key(key, &c->network);
+	if (!netdev)
+		return -1;
+	if (strcmp(p1, "name") == 0) {
+		if (netdev->name)
+			strprint(retv, inlen, "%s", netdev->name);
+	} else if (strcmp(p1, "type") == 0) {
+		strprint(retv, inlen, "%s", lxc_net_type_to_str(netdev->type));
+	} else if (strcmp(p1, "link") == 0) {
+		if (netdev->link)
+			strprint(retv, inlen, "%s", netdev->link);
+	} else if (strcmp(p1, "flags") == 0) {
+		if (netdev->flags & IFF_UP)
+			strprint(retv, inlen, "up");
+	} else if (strcmp(p1, "upscript") == 0) {
+		if (netdev->upscript)
+			strprint(retv, inlen, "%s", netdev->upscript);
+	} else if (strcmp(p1, "hwaddr") == 0) {
+		if (netdev->hwaddr)
+			strprint(retv, inlen, "%s", netdev->hwaddr);
+	} else if (strcmp(p1, "mtu") == 0) {
+		if (netdev->mtu)
+			strprint(retv, inlen, "%s", netdev->mtu);
+	} else if (strcmp(p1, "macvlan.mode") == 0) {
+		if (netdev->type == LXC_NET_MACVLAN) {
+			const char *mode;
+			switch (netdev->priv.macvlan_attr.mode) {
+			case MACVLAN_MODE_PRIVATE: mode = "private"; break;
+			case MACVLAN_MODE_VEPA: mode = "vepa"; break;
+			case MACVLAN_MODE_BRIDGE: mode = "bridge"; break;
+			default: mode = "(invalid)"; break;
+			}
+			strprint(retv, inlen, "%s", mode);
+		}
+	} else if (strcmp(p1, "veth.pair") == 0) {
+		if (netdev->type == LXC_NET_VETH && netdev->priv.veth_attr.pair)
+			strprint(retv, inlen, "%s", netdev->priv.veth_attr.pair);
+	} else if (strcmp(p1, "vlan") == 0) {
+		if (netdev->type == LXC_NET_VLAN) {
+			strprint(retv, inlen, "%d", netdev->priv.vlan_attr.vid);
+		}
+	} else if (strcmp(p1, "ipv4_gateway") == 0) {
+		if (netdev->ipv4_gateway_auto) {
+			strprint(retv, inlen, "auto");
+		} else if (netdev->ipv4_gateway) {
+			char buf[INET_ADDRSTRLEN];
+			inet_ntop(AF_INET, netdev->ipv4_gateway, buf, sizeof(buf));
+			strprint(retv, inlen, "%s", buf);
+		}
+	} else if (strcmp(p1, "ipv4") == 0) {
+		struct lxc_list *it2;
+		lxc_list_for_each(it2, &netdev->ipv4) {
+			struct lxc_inetdev *i = it2->elem;
+			char buf[INET_ADDRSTRLEN];
+			inet_ntop(AF_INET, &i->addr, buf, sizeof(buf));
+			strprint(retv, inlen, "%s\n", buf);
+		}
+	} else if (strcmp(p1, "ipv6_gateway") == 0) {
+		if (netdev->ipv6_gateway_auto) {
+			strprint(retv, inlen, "auto");
+		} else if (netdev->ipv6_gateway) {
+			char buf[INET_ADDRSTRLEN];
+			inet_ntop(AF_INET, netdev->ipv6_gateway, buf, sizeof(buf));
+			strprint(retv, inlen, "%s", buf);
+		}
+	} else if (strcmp(p1, "ipv6") == 0) {
+		struct lxc_list *it2;
+		lxc_list_for_each(it2, &netdev->ipv6) {
+			struct lxc_inetdev *i = it2->elem;
+			char buf[INET_ADDRSTRLEN];
+			inet_ntop(AF_INET6, &i->addr, buf, sizeof(buf));
+			strprint(retv, inlen, "%s\n", buf);
+		}
+	}
+	return fulllen;
+}
+
+static int lxc_get_item_network(struct lxc_conf *c, char *retv, int inlen)
+{
+	int len, fulllen = 0;
+	struct lxc_list *it;
+
+	if (!retv)
+		inlen = 0;
+	else
+		memset(retv, 0, inlen);
+
+	lxc_list_for_each(it, &c->network) {
+		struct lxc_netdev *n = it->elem;
+		const char *t = lxc_net_type_to_str(n->type);
+		strprint(retv, inlen, "%s\n", t ? t : "(invalid)");
+	}
+	return fulllen;
+}
+
+int lxc_get_config_item(struct lxc_conf *c, char *key, char *retv, int inlen)
+{
+	char *v = NULL;
+
+	if (strcmp(key, "lxc.mount.entry") == 0)
+		return lxc_get_mount_entries(c, retv, inlen);
+	else if (strcmp(key, "lxc.mount") == 0)
+		v = c->fstab;
+	else if (strcmp(key, "lxc.tty") == 0)
+		return lxc_get_conf_int(c, retv, inlen, c->tty);
+	else if (strcmp(key, "lxc.pts") == 0)
+		return lxc_get_conf_int(c, retv, inlen, c->pts);
+	else if (strcmp(key, "lxc.devttydir") == 0)
+		v = c->ttydir;
+	else if (strcmp(key, "lxc.arch") == 0)
+		return lxc_get_arch_entry(c, retv, inlen);
+	else if (strcmp(key, "lxc.aa_profile") == 0)
+		v = c->aa_profile;
+	else if (strcmp(key, "lxc.cgroup") == 0) // all cgroup info
+		return lxc_get_cgroup_entry(c, retv, inlen, "all");
+	else if (strncmp(key, "lxc.cgroup.", 11) == 0) // specific cgroup info
+		return lxc_get_cgroup_entry(c, retv, inlen, key + 11);
+	else if (strcmp(key, "lxc.utsname") == 0)
+		v = c->utsname->nodename;
+	else if (strcmp(key, "lxc.console") == 0)
+		v = c->console.path;
+	else if (strcmp(key, "lxc.rootfs.mount") == 0)
+		v = c->rootfs.mount;
+	else if (strcmp(key, "lxc.rootfs") == 0)
+		v = c->rootfs.path;
+	else if (strcmp(key, "lxc.pivotdir") == 0)
+		v = c->rootfs.pivot;
+	else if (strcmp(key, "lxc.cap.drop") == 0)
+		return lxc_get_item_cap_drop(c, retv, inlen);
+	else if (strncmp(key, "lxc.hook", 8) == 0)
+		return lxc_get_item_hooks(c, retv, inlen, key);
+	else if (strcmp(key, "lxc.network") == 0)
+		return lxc_get_item_network(c, retv, inlen);
+	else if (strncmp(key, "lxc.network.", 12) == 0)
+		return lxc_get_item_nic(c, retv, inlen, key + 12);
+	else return -1;
+
+	if (!v)
+		return 0;
+	if (retv && inlen >= strlen(v) + 1)
+		strncpy(retv, v, strlen(v)+1);
+	return strlen(v);
+}
+
+int lxc_clear_config_item(struct lxc_conf *c, char *key)
+{
+	if (strcmp(key, "lxc.network") == 0)
+		return lxc_clear_config_network(c);
+	else if (strncmp(key, "lxc.network.", 12) == 0)
+		return lxc_clear_nic(c, key + 12);
+	else if (strcmp(key, "lxc.cap.drop") == 0)
+		return lxc_clear_config_caps(c);
+	else if (strncmp(key, "lxc.cgroup", 10) == 0)
+		return lxc_clear_cgroups(c, key);
+	else if (strcmp(key, "lxc.mount.entries") == 0)
+		return lxc_clear_mount_entries(c);
+	else if (strcmp(key, "lxc.hook") == 0)
+		return lxc_clear_hooks(c);
+
+	return -1;
+}
+
+/*
+ * writing out a confile.
+ */
+void write_config(FILE *fout, struct lxc_conf *c)
+{
+	struct lxc_list *it;
+	int i;
+
+	if (c->fstab)
+		fprintf(fout, "lxc.mount = %s\n", c->fstab);
+	lxc_list_for_each(it, &c->mount_list) {
+		fprintf(fout, "lxc.mount.entry = %s\n", (char *)it->elem);
+	}
+	if (c->tty)
+		fprintf(fout, "lxc.tty = %d\n", c->tty);
+	if (c->pts)
+		fprintf(fout, "lxc.pts = %d\n", c->pts);
+	if (c->ttydir)
+		fprintf(fout, "lxc.devttydir = %s\n", c->ttydir);
+	switch(c->personality) {
+	case PER_LINUX32: fprintf(fout, "lxc.arch = x86\n"); break;
+	case PER_LINUX: fprintf(fout, "lxc.arch = x86_64\n"); break;
+	default: break;
+	}
+	if (c->aa_profile)
+		fprintf(fout, "lxc.aa_profile = %s\n", c->aa_profile);
+	lxc_list_for_each(it, &c->cgroup) {
+		struct lxc_cgroup *cg = it->elem;
+		fprintf(fout, "lxc.cgroup.%s = %s\n", cg->subsystem, cg->value);
+	}
+	if (c->utsname)
+		fprintf(fout, "lxc.utsname = %s\n", c->utsname->nodename);
+	lxc_list_for_each(it, &c->network) {
+		struct lxc_netdev *n = it->elem;
+		const char *t = lxc_net_type_to_str(n->type);
+		struct lxc_list *it2;
+		fprintf(fout, "lxc.network.type = %s\n", t ? t : "(invalid)");
+		if (n->flags & IFF_UP)
+			fprintf(fout, "lxc.network.flags = up\n");
+		if (n->link)
+			fprintf(fout, "lxc.network.link = %s\n", n->link);
+		if (n->name)
+			fprintf(fout, "lxc.network.name = %s\n", n->name);
+		if (n->type == LXC_NET_MACVLAN) {
+			const char *mode;
+			switch (n->priv.macvlan_attr.mode) {
+			case MACVLAN_MODE_PRIVATE: mode = "private"; break;
+			case MACVLAN_MODE_VEPA: mode = "vepa"; break;
+			case MACVLAN_MODE_BRIDGE: mode = "bridge"; break;
+			default: mode = "(invalid)"; break;
+			}
+			fprintf(fout, "lxc.network.macvlan.mode = %s\n", mode);
+		} else if (n->type == LXC_NET_VETH) {
+			if (n->priv.veth_attr.pair)
+				fprintf(fout, "lxc.network.veth.pair = %s\n",
+					n->priv.veth_attr.pair);
+		} else if (n->type == LXC_NET_VLAN) {
+			fprintf(fout, "lxc.network.vlan.id = %d\n", n->priv.vlan_attr.vid);
+		}
+		if (n->upscript)
+			fprintf(fout, "lxc.network.script.up = %s\n", n->upscript);
+		if (n->hwaddr)
+			fprintf(fout, "lxc.network.hwaddr = %s\n", n->hwaddr);
+		if (n->mtu)
+			fprintf(fout, "lxc.network.mtu = %s\n", n->mtu);
+		if (n->ipv4_gateway_auto)
+			fprintf(fout, "lxc.network.ipv4.gateway = auto\n");
+		else if (n->ipv4_gateway) {
+			char buf[INET_ADDRSTRLEN];
+			inet_ntop(AF_INET, n->ipv4_gateway, buf, sizeof(buf));
+			fprintf(fout, "lxc.network.ipv4.gateway = %s\n", buf);
+		}
+		lxc_list_for_each(it2, &n->ipv4) {
+			struct lxc_inetdev *i = it2->elem;
+			char buf[INET_ADDRSTRLEN];
+			inet_ntop(AF_INET, &i->addr, buf, sizeof(buf));
+			fprintf(fout, "lxc.network.ipv4 = %s\n", buf);
+		}
+		if (n->ipv6_gateway_auto)
+			fprintf(fout, "lxc.network.ipv6.gateway = auto\n");
+		else if (n->ipv6_gateway) {
+			char buf[INET6_ADDRSTRLEN];
+			inet_ntop(AF_INET6, n->ipv6_gateway, buf, sizeof(buf));
+			fprintf(fout, "lxc.network.ipv6.gateway = %s\n", buf);
+		}
+		lxc_list_for_each(it2, &n->ipv6) {
+			struct lxc_inet6dev *i = it2->elem;
+			char buf[INET6_ADDRSTRLEN];
+			inet_ntop(AF_INET, &i->addr, buf, sizeof(buf));
+			fprintf(fout, "lxc.network.ipv6 = %s\n", buf);
+		}
+	}
+	lxc_list_for_each(it, &c->caps)
+		fprintf(fout, "lxc.cap.drop = %s\n", (char *)it->elem);
+	for (i=0; i<NUM_LXC_HOOKS; i++) {
+		lxc_list_for_each(it, &c->hooks[i])
+			fprintf(fout, "lxc.hook.%s = %s\n",
+				lxchook_names[i], (char *)it->elem);
+	}
+	if (c->console.path)
+		fprintf(fout, "lxc.console = %s\n", c->console.path);
+	if (c->rootfs.path)
+		fprintf(fout, "lxc.rootfs = %s\n", c->rootfs.path);
+	if (c->rootfs.mount && strcmp(c->rootfs.mount, LXCROOTFSMOUNT) != 0)
+		fprintf(fout, "lxc.rootfs.mount = %s\n", c->rootfs.mount);
+	if (c->rootfs.pivot)
+		fprintf(fout, "lxc.pivotdir = %s\n", c->rootfs.pivot);
+}

=== added directory '.pc/0209-reload-conf-after-create'
=== renamed directory '.pc/0209-reload-conf-after-create' => '.pc/0209-reload-conf-after-create.moved'
=== added file '.pc/0209-reload-conf-after-create/.timestamp'
=== added directory '.pc/0209-reload-conf-after-create/src'
=== added directory '.pc/0209-reload-conf-after-create/src/lxc'
=== added file '.pc/0209-reload-conf-after-create/src/lxc/conf.c'
--- .pc/0209-reload-conf-after-create/src/lxc/conf.c	1970-01-01 00:00:00 +0000
+++ .pc/0209-reload-conf-after-create/src/lxc/conf.c	2012-09-06 21:45:28 +0000
@@ -0,0 +1,2467 @@
+/*
+ * lxc: linux Container library
+ *
+ * (C) Copyright IBM Corp. 2007, 2008
+ *
+ * Authors:
+ * Daniel Lezcano <dlezcano at fr.ibm.com>
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2.1 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
+ */
+#define _GNU_SOURCE
+#include <stdio.h>
+#undef _GNU_SOURCE
+#include <stdlib.h>
+#include <stdarg.h>
+#include <errno.h>
+#include <string.h>
+#include <dirent.h>
+#include <mntent.h>
+#include <unistd.h>
+#include <sys/wait.h>
+#include <pty.h>
+
+#include <linux/loop.h>
+
+#include <sys/types.h>
+#include <sys/utsname.h>
+#include <sys/param.h>
+#include <sys/stat.h>
+#include <sys/socket.h>
+#include <sys/mount.h>
+#include <sys/mman.h>
+#include <sys/prctl.h>
+#include <sys/capability.h>
+#include <sys/personality.h>
+
+#include <arpa/inet.h>
+#include <fcntl.h>
+#include <netinet/in.h>
+#include <net/if.h>
+#include <libgen.h>
+
+#include "network.h"
+#include "error.h"
+#include "parse.h"
+#include "config.h"
+#include "utils.h"
+#include "conf.h"
+#include "log.h"
+#include "lxc.h"	/* for lxc_cgroup_set() */
+#include "caps.h"       /* for lxc_caps_last_cap() */
+
+lxc_log_define(lxc_conf, lxc);
+
+#define MAXHWLEN    18
+#define MAXINDEXLEN 20
+#define MAXMTULEN   16
+#define MAXLINELEN  128
+
+#ifndef MS_DIRSYNC
+#define MS_DIRSYNC  128
+#endif
+
+#ifndef MS_REC
+#define MS_REC 16384
+#endif
+
+#ifndef MNT_DETACH
+#define MNT_DETACH 2
+#endif
+
+#ifndef MS_RELATIME
+#define MS_RELATIME (1 << 21)
+#endif
+
+#ifndef MS_STRICTATIME
+#define MS_STRICTATIME (1 << 24)
+#endif
+
+#ifndef CAP_SETFCAP
+#define CAP_SETFCAP 31
+#endif
+
+#ifndef CAP_MAC_OVERRIDE
+#define CAP_MAC_OVERRIDE 32
+#endif
+
+#ifndef CAP_MAC_ADMIN
+#define CAP_MAC_ADMIN 33
+#endif
+
+#ifndef PR_CAPBSET_DROP
+#define PR_CAPBSET_DROP 24
+#endif
+
+char *lxchook_names[NUM_LXC_HOOKS] = {
+	"pre-start", "mount", "start", "post-stop" };
+
+extern int pivot_root(const char * new_root, const char * put_old);
+
+typedef int (*instanciate_cb)(struct lxc_handler *, struct lxc_netdev *);
+
+struct mount_opt {
+	char *name;
+	int clear;
+	int flag;
+};
+
+struct caps_opt {
+	char *name;
+	int value;
+};
+
+static int instanciate_veth(struct lxc_handler *, struct lxc_netdev *);
+static int instanciate_macvlan(struct lxc_handler *, struct lxc_netdev *);
+static int instanciate_vlan(struct lxc_handler *, struct lxc_netdev *);
+static int instanciate_phys(struct lxc_handler *, struct lxc_netdev *);
+static int instanciate_empty(struct lxc_handler *, struct lxc_netdev *);
+
+static  instanciate_cb netdev_conf[LXC_NET_MAXCONFTYPE + 1] = {
+	[LXC_NET_VETH]    = instanciate_veth,
+	[LXC_NET_MACVLAN] = instanciate_macvlan,
+	[LXC_NET_VLAN]    = instanciate_vlan,
+	[LXC_NET_PHYS]    = instanciate_phys,
+	[LXC_NET_EMPTY]   = instanciate_empty,
+};
+
+static struct mount_opt mount_opt[] = {
+	{ "defaults",      0, 0              },
+	{ "ro",            0, MS_RDONLY      },
+	{ "rw",            1, MS_RDONLY      },
+	{ "suid",          1, MS_NOSUID      },
+	{ "nosuid",        0, MS_NOSUID      },
+	{ "dev",           1, MS_NODEV       },
+	{ "nodev",         0, MS_NODEV       },
+	{ "exec",          1, MS_NOEXEC      },
+	{ "noexec",        0, MS_NOEXEC      },
+	{ "sync",          0, MS_SYNCHRONOUS },
+	{ "async",         1, MS_SYNCHRONOUS },
+	{ "dirsync",       0, MS_DIRSYNC     },
+	{ "remount",       0, MS_REMOUNT     },
+	{ "mand",          0, MS_MANDLOCK    },
+	{ "nomand",        1, MS_MANDLOCK    },
+	{ "atime",         1, MS_NOATIME     },
+	{ "noatime",       0, MS_NOATIME     },
+	{ "diratime",      1, MS_NODIRATIME  },
+	{ "nodiratime",    0, MS_NODIRATIME  },
+	{ "bind",          0, MS_BIND        },
+	{ "rbind",         0, MS_BIND|MS_REC },
+	{ "relatime",      0, MS_RELATIME    },
+	{ "norelatime",    1, MS_RELATIME    },
+	{ "strictatime",   0, MS_STRICTATIME },
+	{ "nostrictatime", 1, MS_STRICTATIME },
+	{ NULL,            0, 0              },
+};
+
+static struct caps_opt caps_opt[] = {
+	{ "chown",             CAP_CHOWN             },
+	{ "dac_override",      CAP_DAC_OVERRIDE      },
+	{ "dac_read_search",   CAP_DAC_READ_SEARCH   },
+	{ "fowner",            CAP_FOWNER            },
+	{ "fsetid",            CAP_FSETID            },
+	{ "kill",              CAP_KILL              },
+	{ "setgid",            CAP_SETGID            },
+	{ "setuid",            CAP_SETUID            },
+	{ "setpcap",           CAP_SETPCAP           },
+	{ "linux_immutable",   CAP_LINUX_IMMUTABLE   },
+	{ "net_bind_service",  CAP_NET_BIND_SERVICE  },
+	{ "net_broadcast",     CAP_NET_BROADCAST     },
+	{ "net_admin",         CAP_NET_ADMIN         },
+	{ "net_raw",           CAP_NET_RAW           },
+	{ "ipc_lock",          CAP_IPC_LOCK          },
+	{ "ipc_owner",         CAP_IPC_OWNER         },
+	{ "sys_module",        CAP_SYS_MODULE        },
+	{ "sys_rawio",         CAP_SYS_RAWIO         },
+	{ "sys_chroot",        CAP_SYS_CHROOT        },
+	{ "sys_ptrace",        CAP_SYS_PTRACE        },
+	{ "sys_pacct",         CAP_SYS_PACCT         },
+	{ "sys_admin",         CAP_SYS_ADMIN         },
+	{ "sys_boot",          CAP_SYS_BOOT          },
+	{ "sys_nice",          CAP_SYS_NICE          },
+	{ "sys_resource",      CAP_SYS_RESOURCE      },
+	{ "sys_time",          CAP_SYS_TIME          },
+	{ "sys_tty_config",    CAP_SYS_TTY_CONFIG    },
+	{ "mknod",             CAP_MKNOD             },
+	{ "lease",             CAP_LEASE             },
+#ifdef CAP_AUDIT_WRITE
+	{ "audit_write",       CAP_AUDIT_WRITE       },
+#endif
+#ifdef CAP_AUDIT_CONTROL
+	{ "audit_control",     CAP_AUDIT_CONTROL     },
+#endif
+	{ "setfcap",           CAP_SETFCAP           },
+	{ "mac_override",      CAP_MAC_OVERRIDE      },
+	{ "mac_admin",         CAP_MAC_ADMIN         },
+#ifdef CAP_SYSLOG
+	{ "syslog",            CAP_SYSLOG            },
+#endif
+#ifdef CAP_WAKE_ALARM
+	{ "wake_alarm",        CAP_WAKE_ALARM        },
+#endif
+};
+
+static int run_script(const char *name, const char *section,
+		      const char *script, ...)
+{
+	int ret;
+	FILE *f;
+	char *buffer, *p, *output;
+	size_t size = 0;
+	va_list ap;
+
+	INFO("Executing script '%s' for container '%s', config section '%s'",
+	     script, name, section);
+
+	va_start(ap, script);
+	while ((p = va_arg(ap, char *)))
+		size += strlen(p) + 1;
+	va_end(ap);
+
+	size += strlen(script);
+	size += strlen(name);
+	size += strlen(section);
+	size += 3;
+
+	if (size > INT_MAX)
+		return -1;
+
+	buffer = alloca(size);
+	if (!buffer) {
+		ERROR("failed to allocate memory");
+		return -1;
+	}
+
+	ret = snprintf(buffer, size, "%s %s %s", script, name, section);
+	if (ret < 0 || ret >= size) {
+		ERROR("Script name too long");
+		free(buffer);
+		return -1;
+	}
+
+	va_start(ap, script);
+	while ((p = va_arg(ap, char *))) {
+		int len = size-ret;
+		int rc;
+		rc = snprintf(buffer + ret, len, " %s", p);
+		if (rc < 0 || rc >= len) {
+			free(buffer);
+			ERROR("Script args too long");
+			return -1;
+		}
+		ret += rc;
+	}
+	va_end(ap);
+
+	f = popen(buffer, "r");
+	if (!f) {
+		SYSERROR("popen failed");
+		return -1;
+	}
+
+	output = malloc(LXC_LOG_BUFFER_SIZE);
+	if (!output) {
+		ERROR("failed to allocate memory for script output");
+		return -1;
+	}
+
+	while(fgets(output, LXC_LOG_BUFFER_SIZE, f))
+		DEBUG("script output: %s", output);
+
+	free(output);
+
+	if (pclose(f)) {
+		ERROR("Script exited on error");
+		return -1;
+	}
+
+	return 0;
+}
+
+static int find_fstype_cb(char* buffer, void *data)
+{
+	struct cbarg {
+		const char *rootfs;
+		const char *target;
+		int mntopt;
+	} *cbarg = data;
+
+	char *fstype;
+
+	/* we don't try 'nodev' entries */
+	if (strstr(buffer, "nodev"))
+		return 0;
+
+	fstype = buffer;
+	fstype += lxc_char_left_gc(fstype, strlen(fstype));
+	fstype[lxc_char_right_gc(fstype, strlen(fstype))] = '\0';
+
+	DEBUG("trying to mount '%s'->'%s' with fstype '%s'",
+	      cbarg->rootfs, cbarg->target, fstype);
+
+	if (mount(cbarg->rootfs, cbarg->target, fstype, cbarg->mntopt, NULL)) {
+		DEBUG("mount failed with error: %s", strerror(errno));
+		return 0;
+	}
+
+	INFO("mounted '%s' on '%s', with fstype '%s'",
+	     cbarg->rootfs, cbarg->target, fstype);