Package "lxc"

  lxc (2.0.11-0ubuntu1~16.04.3) xenial; urgency=medium

  * Cherry-pick upstream bugfix (fixes regression on attach with uid/gid):
    - attach: improve id switching
    - utils: make id switching functions return bool

  lxc (2.0.8-0ubuntu1~16.04.2) xenial; urgency=medium

  * Cherry-pick upstream workaround for ppc64el failure:
    - 0011-utils-fix-ppc64le-builds.patch

 -- Stéphane Graber <email address hidden> Mon, 29 May 2017 14:37:15 -0400

  lxc (2.0.7-0ubuntu1~16.04.2) xenial-security; urgency=medium

  * SECURITY UPDATE: lxc-user-nic doesn't check netns ownership (LP: #1654676)
    - Ensure target netns is caller-owned
    - CVE-2017-5985

 -- Stéphane Graber <email address hidden> Tue, 07 Mar 2017 14:37:03 -0500

  lxc (2.0.7-0ubuntu1~16.04.1) xenial; urgency=medium

  * New upstream bugfix release (2.0.7) (LP: #1660844)
    - attach: Close lsm label file descriptor
    - attach: Non-functional changes
    - attach: Simplify lsm_openat()
    - caps: Add lxc_cap_is_set()
    - conf: attach: Save errno across call to close
    - conf: Clearly report to either use drop or keep
    - conf: criu: Add make_anonymous_mount_file()
    - conf: Fix suggest_default_idmap()
    - configure: Add --enable-gnutls option
    - configure: Check for memfd_create()
    - configure: Check whether gettid() is declared
    - configure: Do not allow variable length arrays
    - configure: Remove -Werror=vla
    - configure: Use AC_HEADER_MAJOR to detect major()/minor()/makedev()
    - conf: Non-functional changes
    - conf: Remove thread-unsafe strsignal + improve log
    - init: Add cgroupfs-mount to Should-Start/Stop sysvinit LSB headers
    - log: Add lxc_unix_epoch_to_utc()
    - log: Annotate lxc_unix_epoch_to_utc()
    - log: Drop all timezone conversion functions
    - log: Make sure that date is correctly formatted
    - log: Use lxc_unix_epoch_to_utc()
    - log: Use N/A if getpid() != gettid() when threaded
    - log: Use thread-safe localtime_r()
    - lvm: Suppress warnings about leaked files
    - lxccontainer: Log failure to send sig to init pid
    - monitor: Add more logging
    - monitor: Close mainloop on exit if we opened it
    - monitor: Improve log + set log level to DEBUG
    - monitor: Log which pipe fd is currently used
    - monitor: Make lxc-monitord async signal safe
    - monitor: Non-functional changes
    - python3-lxc: Fix api_test.py on s390x
    - start: Check for CAP_SETGID before setgroups()
    - start: Fix execute and improve setgroups() calls
    - state: Use async signal safe fun in lxc_wait()
    - templates: lxc-debian: Don't read from /usr/lib/systemd on the host
    - templates: lxc-debian: Fix getty service startup
    - templates: lxc-debian: Fix typo with dpkg --print-foreign-architectures
    - templates: lxc-debian: Handle ppc hostarch -> powerpc
    - templates: lxc-opensuse: Change openSUSE default release to Leap 42.2
    - templates: lxc-opensuse: Remove libgcc_s1
    - templates: lxc-opensuse: Remove poweroff.target -> sigpwr.target copy
    - templates: lxc-opensuse: Set to be unconfined by AppArmor
    - templates: lxc-opensuse: Update for Leap 42.2
    - tests; Don't cause test failures on cleanup errors
    - tests: Skip unpriv tests on broken overlay module
    - tools: Improve logging
    - tools: lxc-start: Remove c->is_defined(c) check
    - tools: lxc-start: Set configfile after load_config
    - tools: Only check for O_RDONLY
    - tree-wide: Random macro cleanups
    - tree-wide: Remove any variable length arrays
    - tree-wide: Sic semper assertis!
    - utils: Add macro __LXC_NUMSTRLEN
    - utils: Add uid, gid, group convenience wrappers

  * Cherry-pick upstream bugfix:
    - 0002-Make-lxc-start-ephemeral-Python-3.2-compatible.patch

  * Resolve lintian warnings
    - Drop un-needed overrides
    - Fix typos in debian/control

 -- Stéphane Graber <email address hidden> Tue, 31 Jan 2017 18:37:52 -0500

  lxc (2.0.6-0ubuntu1~ubuntu16.04.2) xenial; urgency=medium

  * Cherry-pick upstream bugfix:
    - 0003-tools-only-check-for-O_RDONLY.patch (LP: #1653725)

 -- Stéphane Graber <email address hidden> Wed, 04 Jan 2017 19:52:32 -0500