crun wants to set empty_ns and this interface is missing from the
library. This adds it to libcriu.

Signed-off-by: Adrian Reber <[email protected]>

By default, the file name 'amdgpu_plugin.txt' is used also as the name
for the corresponding man page (`man amdgpu_plugin`). However, when
this man page is installed system-wide it would be more appropriate
to have a prefix 'criu-' (e.g., `man criu-amdgpu-plugin`).

Signed-off-by: Radostin Stoyanov <[email protected]>

Using the fact that we know criu_pid and criu is a parent of restored
process we can create pidfile with pid on caller pidns level.

We need to move mount namespace creation to child so that criu-ns can
see caller pidns proc.

Signed-off-by: Pavel Tikhomirov <[email protected]>

Signed-off-by: Adrian Reber <[email protected]>

Signed-off-by: Adrian Reber <[email protected]>

Newer Intel CPUs (Sapphire Rapids) have a much larger xsave area than
before. Looking at older CPUs I see 2440 bytes.

    # cpuid -1 -l 0xd -s 0
    ...
        bytes required by XSAVE/XRSTOR area     = 0x00000988 (2440)

On newer CPUs (Sapphire Rapids) it grows to 11008 bytes.

    # cpuid -1 -l 0xd -s 0
    ...
        bytes required by XSAVE/XRSTOR area     = 0x00002b00 (11008)

This increase the xsave area from one page to four pages.

Without this patch the fpu03 test fails, with this patch it works again.

Signed-off-by: Adrian Reber <[email protected]>

Signed-off-by: zhoujie <[email protected]>

The highlight feature of this release is the ability to use CRIU for
non-root users. Adrian Reber implemented the kernel part and created the
initial version of CRIU changes. Then Younes Manton joined the effort
and pushed it to the finish line.

The full change log is here: https://criu.org/Download/criu/3.18

Signed-off-by: Andrei Vagin <[email protected]>

Signed-off-by: Suraj Shirvankar <[email protected]>

The TOS(type of service) field in the ip header allows you specify the
priority of the socket data.

Signed-off-by: Suraj Shirvankar <[email protected]>

We do kerndat_has_nspid in kerndat_init already and save result to
kerndat cache, we don't need to recheck it each time.

Signed-off-by: Pavel Tikhomirov <[email protected]>

Previously when tv_sec>=100, the line would look like this:
(269.189615 Error [...]
Now the last char is overwritten with ')'.

Signed-off-by: Michal Clapinski <[email protected]>

In parse_pid_status there are 13 places where we do done++, so when
"done" is 13 it means that we have matched each of those 13 places and
we are ready to stop. In next lines we are not going to find anything.

So the right condition for the while loop is (done < 13).

Signed-off-by: Pavel Tikhomirov <[email protected]>

During the restore process, netlink fd uses the flags in the
NetlinkSkEntry structure to restore the file state, but during
the dump process, the flags values is not saved to the structure.

Signed-off-by: zhoujie <[email protected]>
Signed-off-by: hejingxian <[email protected]>

Testing only the thread group leader is not enough and can hide bugs.

Signed-off-by: Michal Clapinski <[email protected]>

Previously fixup was done before threads' registers were dumped so it
didn't actually work. This commit splits rseq fixup into thread leader
fixup and other threads fixup and applies them after the entities are
seized.

Signed-off-by: Michal Clapinski <[email protected]>

Signed-off-by: Michal Clapinski <[email protected]>

Signed-off-by: Michal Clapinski <[email protected]>

Kernel shouldn't clean up rseq_cs inside a critical section.
If rseq_cs has been cleaned up, it means there is a bug in migration.

Signed-off-by: Michal Clapinski <[email protected]>

This patch adds concurrency groups to the CI workflows to automatically
cancel any in-progress workflows when a pull request has been updated.
A `concurrency` group allows to ensure that a single job or workflow
will run at a time. For example, when a pull request is updated with
a force-push, the GiHub CI workflows currently in-progress will be
automatically cancelled, and the CI would run only with the updated
commits.

https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#concurrency

Signed-off-by: Radostin Stoyanov <[email protected]>

- use exit_code instead of returning ret
- replace -errno return with -1
- move fallback to if (!kdat.sk_unix_file)
- fix readlinkat error checking (ret < 0 && ret >= PATH_MAX) by using
  read_fd_link helper

Signed-off-by: Pavel Tikhomirov <[email protected]>

As we now don't have any calls to free in this function we can replace
all lables with explicit returns.

While on it: Replace useless -errno and 1 returns with -1 as from the
very first implementation of unix_resolve_name (it changed name to _old
later) in [1] any non-zero return was treated as error.

6d785e6cd ("unix: resolve a socket file when a socket descriptor is
available") [1]

Signed-off-by: Pavel Tikhomirov <[email protected]>

It is strange to free a pointer which is already in unix_sk_desc, either
on error path or on skip as we leave freed pointer in desc and it can
probably be used after free later and lead to some corruption. So I
would prefer not to free it as we don't have full controll over it here.

Fixes: 6d785e6cd ("unix: resolve a socket file when a socket descriptor is available")

Signed-off-by: Pavel Tikhomirov <[email protected]>

Fix cwd freeing on error path in get_cwd_check_perm and
on non-error-path in unix_fill_sock_name.

v2: use cleanup_free attribute in unix_fill_sock_name

Signed-off-by: Yuriy Vasiliev <[email protected]>
Signed-off-by: Pavel Tikhomirov <[email protected]>

For better logging.

Signed-off-by: Cyrill Gorcunov <[email protected]>
Signed-off-by: Pavel Tikhomirov <[email protected]>

Python 3.12 includes a few breaking changes, such as the removal of the
distutils module [1] and the deprecation of `setup.py install` in
favour of pip install [2]. This patch updates the installation script
for crit to reflect these changes by replacing the use of
`setup.py install` with `pip install` and `distutils` with
`setuptools`. In addition, a minimal pyproject.toml file has
been added as it is required by the new version of pip [3].

It is worth noting that with this change we are switching from the egg
packaging format to wheel [4] and add pip as a build dependency.

[1] https://www.python.org/downloads/release/python-3120a2/
[2] https://github.com/pypa/setuptools/pull/2824
[3] https://pip.pypa.io/en/stable/reference/build-system/pyproject-toml/
[4] https://packaging.python.org/en/latest/discussions/wheel-vs-egg/

Signed-off-by: Radostin Stoyanov <[email protected]>

First, let's move lookup_create_item-s to the end so that on pgid
replacement we don't have false positive pstree_pid_by_virt check
founding item created by sid replacement. (note: we need those
lookup_create_item-s for the sake of free pid selection mechanism)

Second, let's add checks for sid/pgid in images intersecting with
current_sid/pgid, as this would also bring problems on restore.

Signed-off-by: Pavel Tikhomirov <[email protected]>

In Virtuozzo tests we have seen uninformative errors:

(26.575039) 151187 fdinfo 6: pos: 0 flags: 2/0
(26.575076) sockets: Searching for socket 0x346d1 family 1
(666.230281 ----------------------------------------
(666.230586 Error (criu/cr-dump.c:1850): Dump files (pid: 151187) failed
with -1

So let's add some error messages to this stack.

Signed-off-by: Pavel Tikhomirov <[email protected]>

With this macro we can easily declare struct mntns_zdtm variables with
all lists properly initiallized. Let's use it in mount_complex_sharing
as without it we can have segfault on error path when accessing
uninitialized list pointers.

Signed-off-by: Pavel Tikhomirov <[email protected]>

Currently we only allow external fuse mount itself, let's allow
bindmount for it too. Other mount code is ready for this change and will
be able to bindmount it from corresponding external mount.

Signed-off-by: Pavel Tikhomirov <[email protected]>

When installing packages within Archlinux container, pacman fails with
the following errors:

(3/7) Creating temporary files...
/usr/lib/tmpfiles.d/journal-nocow.conf:26: Failed to replace specifiers in '/var/log/journal/%m': No such file or directory
/usr/lib/tmpfiles.d/systemd.conf:23: Failed to replace specifiers in '/run/log/journal/%m': No such file or directory
/usr/lib/tmpfiles.d/systemd.conf:25: Failed to replace specifiers in '/run/log/journal/%m': No such file or directory
/usr/lib/tmpfiles.d/systemd.conf:26: Failed to replace specifiers in '/run/log/journal/%m/*.journal*': No such file or directory
/usr/lib/tmpfiles.d/systemd.conf:29: Failed to replace specifiers in '/var/log/journal/%m': No such file or directory
/usr/lib/tmpfiles.d/systemd.conf:30: Failed to replace specifiers in '/var/log/journal/%m/system.journal': No such file or directory
/usr/lib/tmpfiles.d/systemd.conf:32: Failed to replace specifiers in '/var/log/journal/%m': No such file or directory
/usr/lib/tmpfiles.d/systemd.conf:33: Failed to replace specifiers in '/var/log/journal/%m/system.journal': No such file or directory

To solve this problem we need to initialize the machine ID.

Signed-off-by: Radostin Stoyanov <[email protected]>

This patch optimizes shell code as reading a single file as input using a 'cat' command to a program.

It is considered to be a Useless Use of Cat (UUOC).

It's more efficient to simply use redirection.

However, in some cases, even using the redirection operator '<' seems unnecessary.

Signed-off-by: KKrypt <[email protected]>

When we collect external mount namespace we don't want to dump mounts in
it, so lets remove this flag. This way we can e.g. use for_dump in
->parse() callbacks to separate in-container mounts from others.

This only affects rare case of `--ext-mount-map auto` but to be
absolutely correct let's fix it anyway.

Signed-off-by: Pavel Tikhomirov <[email protected]>

The new field cg_set is currently marked as required which causes backward
compatibility problem when using newer CRIU version to restore dumped image
from older version. This commit makes this field optional and reworks the
logic to fallback to use cg_set from task_core when it is not in
thread_core.

Signed-off-by: Bui Quang Minh <[email protected]>

The new field is_threaded is currently marked as required which causes
backward compatibility problem when using newer CRIU version to restore
dumped image from older version. This commit makes this field optional and
reworks the logic the skip fixing up threaded cgroup controllers if there
is no information in dumped image.

Signed-off-by: Bui Quang Minh <[email protected]>

Fixes: e1c4871 ("net: add nftables c/r")
Signed-off-by: Alexander Mikhalitsyn <[email protected]>

The patch is similar to what has been done in linux kernel, as this
warning effectively prevents us from adding list elements to local list
head. See https://github.com/torvalds/linux/commit/49beadbd47c2

Else we have:

    CC       criu/mount.o
  In file included from criu/include/cr_options.h:7,
                   from criu/mount.c:13:
  In function '__list_add',
      inlined from 'list_add' at include/common/list.h:41:2,
      inlined from 'mnt_tree_for_each' at criu/mount.c:1977:2:
  include/common/list.h:35:19: error: storing the address of local variable 'postpone' in
    '((struct list_head *)((char *)start + 8))[24].prev' [-Werror=dangling-pointer=]
     35 |         new->prev = prev;
        |         ~~~~~~~~~~^~~~~~
  criu/mount.c: In function 'mnt_tree_for_each':
  criu/mount.c:1972:19: note: 'postpone' declared here
   1972 |         LIST_HEAD(postpone);
        |                   ^~~~~~~~

Signed-off-by: Pavel Tikhomirov <[email protected]>

Setting all supported by CPU features in xstate_bv may bring it into
dirty-upper-state as documented in specs, resulting in lower
performance. Let's not do this and set only those have been used by
dumpee.

P.S.
Off course it has to be a one-liner!

Fixes: #1171

Signed-off-by: Dmitry Safonov <[email protected]>
Signed-off-by: Alexander Mikhalitsyn <[email protected]>

This patch documents how do we use `make lint` and `make indent` and
adds a note about their integration with CI.

Co-authored-by: Pavel Tikhomirov <[email protected]>
Signed-off-by: Radostin Stoyanov <[email protected]>

Without this we might try to restore iptables legacy images with
iptables nft.

Signed-off-by: Pavel Tikhomirov <[email protected]>

Nothing serious since OS will close it anyway but still to be precise.

Signed-off-by: Cyrill Gorcunov <[email protected]>
Signed-off-by: Pavel Tikhomirov <[email protected]>

Signed-off-by: Adrian Reber <[email protected]>

New message:

 ERROR: Required file /usr/lib64/libcrypto.so.3.0.1 not found.
 Exiting

Old message:

   File "/home/criu/coredump/criu_coredump/coredump.py", line 693, in _gen_mem_chunk
     f = open(fname, 'rb')
 FileNotFoundError: [Errno 2] No such file or directory: '/usr/lib64/libcrypto.so.3.0.1'

Signed-off-by: Adrian Reber <[email protected]>

This fixes errors with long command-lines:

  File "/home/criu/coredump/criu_coredump/coredump.py", line 320, in _gen_prpsinfo
    prpsinfo.pr_psargs = self._gen_cmdline(pid)
    ^^^^^^^^^^^^^^^^^^
ValueError: bytes too long (88, maximum length 80)

Signed-off-by: Adrian Reber <[email protected]>

Refactor lib/py/images/images.py to reduce code duplication
by extracting repetitive code into helper functions and
private methods. This improves code readability and maintainability,
as well as reducing the risk of bugs caused by duplicated code.
Additionally, in Makefile, lib/py/images/images.py is added to the
list of files to run by flake8 during CI.

Fixes: #340

Signed-off-by: Kouame Behouba Manasse <[email protected]>

In a previous commit, we set the default runtime to runc and
"manage-cgroups" to ignore. We remove the installation script
for crun as it is not used with this test.

Signed-off-by: Radostin Stoyanov <[email protected]>

This patch disables the checkpoint/restore of cgroups for
the tests using Podman as a temporary workaround for
https://github.com/checkpoint-restore/criu/issues/2091

Signed-off-by: Radostin Stoyanov <[email protected]>

Fixes: 37b99ebe5 ("files: Do setup_newborn_fds() later")

Signed-off-by: Pavel Tikhomirov <[email protected]>