开源软件构建与测试

We truncated the diff of some files because they were too big. If you want to see the full diff for every file, click here.

Changes of Revision 3

_service:tar_scm:lxc.spec Changed

@@ -1,58 +1,36 @@
-%global _release 2022102422
+%global _release 9
+%global enable_isulad 1
 
 Name:           lxc
-Version:        4.0.3
+Version:        5.0.2
 Release:        %{_release}
 Summary:        Linux Containers userspace tools
 License:        LGPLv2+ and GPLv2 and GPLv3
 URL:            https://github.com/lxc/lxc
-Source0:        https://linuxcontainers.org/downloads/lxc/lxc-4.0.3.tar.gz
-
-Patch0001:	0001-refactor-patch-code-of-utils-commands-and-so-on.patch
-Patch0002:	0002-refactor-patch-code-of-isulad-for-conf-exec-attach.patch
-Patch0003:	0003-refactor-patch-code-of-isulad-for-selinux-attach.patch
-Patch0004:	0004-refactor-patch-code-of-lxccontianer-and-so-on.patch
-Patch0005:	0005-refactor-patch-code-of-attach-and-seccomp.patch
-Patch0006:	0006-refactor-patch-about-namespace-log-terminal.patch
-Patch0007:	0007-refactor-patches-on-terminal.c-start.c-and-so-on.patch
-Patch0008:	0008-refactor-patch-code-of-json.patch
-Patch0009:	0009-fix-HOME-env-of-container-unset-error.patch
-Patch0010:	0010-check-yajl-only-when-have-isulad.patch
-Patch0011:	0011-drop-security_context_t.patch
-Patch0012:	0012-only-set-user-or-image-set-non-empty-HOME.patch
-Patch0013:	0013-return-fail-if-no-args-or-no-rootfs-path-found.patch
-Patch0014:	0014-fix-tools-using-option-give-error-message.patch
-Patch0015:	0015-fix-do-mask-pathes-after-parent-mounted.patch
-Patch0016:	0016-skip-kill-cgroup-processes-if-no-hierarchies.patch
-Patch0017:	0017-lxc-Add-sw64-architecture.patch
-Patch0018:	0018-add-macro-to-adapt-musl-libc.patch
-Patch0019:	0019-add-lxc-attach-add-gids-option.patch
-Patch0020:	0020-add-sscanf-adapation-code-for-musl.patch
-Patch0021:	0021-change-the-suffi-parameter-in-lxc-attach-help-output.patch
-Patch0022:	0022-fix-cve-CVE-2022-47952-log-leaks-root-information.patch
-Patch0023:	0023-fix-lxc-write-error-message.patch
-Patch0024:	0024-remove-process-inheritable-capability.patch
-Patch0025:	0025-fix-ops-hierarchies-cause-coredump.patch
-Patch0026:	0026-meminfo-cri-1.25.patch
-Patch0027:	0027-add-loongarch64-support-for-lxc.patch
-Patch0028:	0028-use-ocihooks-env-after-getenv.patch
-Patch0029:	0029-fix-mixed-use-of-signed-and-unsigned-type.patch
-Patch0030:	0030-remove-unused-meminfo-stats.patch
-Patch0031:	0031-lxc-attach-Fix-lost-return-codes-of-spawned-processe.patch
-Patch0032:	0032-fix-load-bpf-failed.patch
-Patch0033:	0033-fix-mount-device-path-incorrect.patch
-Patch0034:	0034-add-secure-compile-macro.patch
-Patch0035:	0035-codecheck-fix.patch
+Source0:        https://linuxcontainers.org/downloads/lxc/lxc-5.0.2.tar.gz
+
+Patch0001:	0001-iSulad-add-json-files-and-adapt-to-meson.patch
+Patch0002:	0002-iSulad-adapt-security-conf-attach-cgroup-and-start.patch
+Patch0003:	0003-iSulad-adapt-conf-network-storage-and-termianl.patch
+Patch0004:	0004-iSulad-adapt-confile-lxccontainer-and-start.patch
+Patch0005:	0005-fix-compile-error.patch
+Patch0006:	0006-remove-isulad_cgfsng.patch
+Patch0007:	0007-fix-run-container-failed-when-enable-isulad.patch
+Patch0008:	0008-bugfix-for-system-container-and-stream.patch
+Patch0009:	0009-bugfix-about-cgroup-mount-propagation-and-capabiliti.patch
+Patch0010:	0010-add-storage-block-code-for-embedded-image.patch
+Patch0011:	0011-skip-setup-console-if-disable-pty-and-fix-syscontain.patch
+Patch0012:	0012-fix-dev-mount-failed-and-skip-send-recv-devpts_fd-if.patch
 
 BuildRequires:  systemd-units git libtool graphviz docbook2X doxygen chrpath
 BuildRequires:  pkgconfig(libseccomp)
 BuildRequires:  libcap libcap-devel libselinux-devel yajl yajl-devel
-BuildRequires:  pkgconfig(bash-completion)
+BuildRequires:  pkgconfig(bash-completion) meson
 %ifarch riscv64
 BuildRequires:  libatomic_ops
 %endif
 
-Requires:       lxc-libs = 4.0.3-%{release}
+Requires:       lxc-libs = 5.0.2-%{release}
 
 %package           libs
 Summary:           Runtime library files for %{name}
@@ -70,7 +48,7 @@
 The %{name}-libs package contains libraries for running %{name} applications.
 
 
-%{!?_pkgdocdir: %global _pkgdocdir %{_docdir}/lxc-4.0.3}
+%{!?_pkgdocdir: %global _pkgdocdir %{_docdir}/lxc-5.0.2}
 
 %description
 Containers are insulated areas inside a system, which have their own namespace
@@ -84,7 +62,7 @@
 
 %package        devel
 Summary:        Development files for lxc
-Requires:       lxc = 4.0.3-%{release}
+Requires:       lxc = 5.0.2-%{release}
 Requires:       pkgconfig
 
 %description    devel
@@ -100,19 +78,18 @@
 This package contains documentation for lxc for creating containers.
 
 %prep
-%autosetup -n lxc-4.0.3 -Sgit -p1
+%autosetup -n lxc-5.0.2 -Sgit -p1
 
 %build
 %ifarch riscv64
 export LDFLAGS="%{build_ldflags} -latomic -pthread"
 %endif
-%configure --enable-doc --enable-api-docs \
-           --disable-silent-rules --docdir=%{_pkgdocdir} --disable-rpath \
-           --disable-static --disable-apparmor --enable-selinux \
-           --enable-seccomp \
-           --with-init-script=systemd --disable-werror
-
-%{make_build}
+%if 0%{?enable_isulad}
+meson setup -Disulad=true -Dtests=true -Dprefix=/usr build
+%else
+meson setup -Disulad=false -Dtests=true -Dprefix=/usr build
+%endif
+meson compile -C build
 
 %install
 %{make_install}
@@ -143,11 +120,9 @@
 chmod +x %{buildroot}/usr/lib64/liblxc.so
 %endif
 # docs
-mkdir -p %{buildroot}%{_pkgdocdir}/api
 %ifarch sw_64
 %else
-cp -a AUTHORS README %{buildroot}%{_pkgdocdir}
-cp -a doc/api/html/* %{buildroot}%{_pkgdocdir}/api/
+cp -a AUTHORS %{buildroot}%{_pkgdocdir}
 %endif
 
 # cache dir
@@ -164,7 +139,7 @@
 rm -rf %{buildroot}%{_sbindir}/init.%{name}.static
 rm -rf %{buildroot}%{_sysconfdir}/default/%{name}
 %check
-%make_build check
+meson test -C build
 
 %post
 
@@ -178,7 +153,8 @@
 %{_datadir}/%{name}/%{name}.functions
 %dir %{_datadir}/bash-completion
 %dir %{_datadir}/bash-completion/completions
-%{_datadir}/bash-completion/completions/lxc
+%{_datadir}/bash-completion/completions/*
+
 %files libs
 %defattr(-,root,root)
 %{_libdir}/liblxc.so
@@ -188,7 +164,6 @@
 %{_sbindir}/init.%{name}
 %{_sharedstatedir}/%{name}
 %dir %{_sysconfdir}/%{name}
-%config(noreplace) %{_sysconfdir}/%{name}/default.conf
 %config(noreplace) %{_sysconfdir}/lxc/*
 %config(noreplace) %{_sysconfdir}/sysconfig/*
 
@@ -197,14 +172,15 @@
 %{_unitdir}/%{name}.service
 %{_unitdir}/%{name}@.service
 %{_unitdir}/%{name}-net.service
+%{_unitdir}/%{name}-monitord.service
 %dir %{_localstatedir}/cache/%{name}
 
 %files devel
 %defattr(-,root,root)
+%{_libdir}/liblxc.a
 %{_includedir}/%{name}/*
 %{_libdir}/pkgconfig/%{name}.pc
 %dir %{_datadir}/%{name}
-%{_datadir}/%{name}/hooks
 %{_datadir}/%{name}/lxc-patch.py*
 %{_datadir}/%{name}/selinux
 %dir %{_datadir}/%{name}/templates
@@ -213,6 +189,9 @@
 %{_datadir}/%{name}/config/*
 %dir %{_datadir}/%{name}/__pycache__
 %{_datadir}/%{name}/__pycache__/*
+%if !0%{?enable_isulad}
+%{_datadir}/%{name}/hooks
+%endif
 
 
 %files help
@@ -229,509 +208,56 @@
 %endif
 
 %changelog
-* Mon Sep 11 2023 zhangxiaoyu<zhangxiaoyu58@huawei.com> - 4.0.3-2022102422
-- Type:bugfix
-- ID:NA
-- SUG:NA
-- DESC: rollback to 4.0.3
-

_service:tar_scm:0001-iSulad-add-json-files-and-adapt-to-meson.patch Added

@@ -0,0 +1,7992 @@
+From 757bc66c44a58ca2d65eb4c8199ad55cba580d00 Mon Sep 17 00:00:00 2001
+From: haozi007 <liuhao27@huawei.com>
+Date: Fri, 14 Jul 2023 11:21:56 +0800
+Subject: PATCH 1/3 iSulad add json files and adapt to meson
+
+Signed-off-by: haozi007 <liuhao27@huawei.com>
+---
+ meson.build                      |   30 +-
+ meson_options.txt                |    8 +
+ src/lxc/af_unix.c                |   50 +
+ src/lxc/af_unix.h                |    5 +
+ src/lxc/cgroups/isulad_cgfsng.c  | 3229 ++++++++++++++++++++++++++++++
+ src/lxc/commands.c               |  179 ++
+ src/lxc/commands.h               |   10 +
+ src/lxc/commands_utils.c         |   57 +
+ src/lxc/commands_utils.h         |    7 +
+ src/lxc/exec_commands.c          |  477 +++++
+ src/lxc/exec_commands.h          |   77 +
+ src/lxc/isulad_utils.c           |  535 +++++
+ src/lxc/isulad_utils.h           |  102 +
+ src/lxc/json/defs.c              |  205 ++
+ src/lxc/json/defs.h              |   37 +
+ src/lxc/json/json_common.c       | 1153 +++++++++++
+ src/lxc/json/json_common.h       |  194 ++
+ src/lxc/json/logger_json_file.c  |  246 +++
+ src/lxc/json/logger_json_file.h  |   45 +
+ src/lxc/json/oci_runtime_hooks.c |   52 +
+ src/lxc/json/oci_runtime_hooks.h |   15 +
+ src/lxc/json/oci_runtime_spec.c  |  195 ++
+ src/lxc/json/oci_runtime_spec.h  |   37 +
+ src/lxc/json/read-file.c         |   95 +
+ src/lxc/json/read-file.h         |   11 +
+ src/lxc/meson.build              |   26 +-
+ src/lxc/path.c                   |  521 +++++
+ src/lxc/path.h                   |   33 +
+ 28 files changed, 7629 insertions(+), 2 deletions(-)
+ create mode 100644 src/lxc/cgroups/isulad_cgfsng.c
+ create mode 100644 src/lxc/exec_commands.c
+ create mode 100644 src/lxc/exec_commands.h
+ create mode 100644 src/lxc/isulad_utils.c
+ create mode 100644 src/lxc/isulad_utils.h
+ create mode 100644 src/lxc/json/defs.c
+ create mode 100644 src/lxc/json/defs.h
+ create mode 100755 src/lxc/json/json_common.c
+ create mode 100755 src/lxc/json/json_common.h
+ create mode 100644 src/lxc/json/logger_json_file.c
+ create mode 100644 src/lxc/json/logger_json_file.h
+ create mode 100644 src/lxc/json/oci_runtime_hooks.c
+ create mode 100644 src/lxc/json/oci_runtime_hooks.h
+ create mode 100644 src/lxc/json/oci_runtime_spec.c
+ create mode 100644 src/lxc/json/oci_runtime_spec.h
+ create mode 100644 src/lxc/json/read-file.c
+ create mode 100644 src/lxc/json/read-file.h
+ create mode 100644 src/lxc/path.c
+ create mode 100644 src/lxc/path.h
+
+diff --git a/meson.build b/meson.build
+index 1b2d673..fda8045 100644
+--- a/meson.build
++++ b/meson.build
+@@ -163,6 +163,8 @@ want_seccomp = get_option('seccomp')
+ want_thread_safety = get_option('thread-safety')
+ want_memfd_rexec = get_option('memfd-rexec')
+ want_sd_bus = get_option('sd-bus')
++want_isulad = get_option('isulad')
++want_securecomplie = get_option('securecomplie')
+ 
+ srcconf.set_quoted('DEFAULT_CGROUP_PATTERN', cgrouppattern)
+ if coverity
+@@ -228,6 +230,19 @@ possible_link_flags = 
+     '-fstack-protector-strong',
+ 
+ 
++if want_isulad
++    possible_cc_flags += '-D_FORTIFY_SOURCE=2'
++    yajldep = dependency('yajl', version : '>=2')
++    srcconf.set('HAVE_ISULAD', yajldep.found())
++    liblxc_dependencies += yajldep
++else
++    srcconf.set('HAVE_ISULAD', false)
++endif
++
++if want_isulad or want_securecomplie
++    possible_link_flags += '-Wl,-z,noexecstack'
++endif
++
+ # The gold linker fails with a bus error on sparc64
+ if build_machine.cpu_family() != 'sparc64'
+     possible_link_flags += '-Wl,-fuse-ld=gold'
+@@ -881,13 +896,24 @@ template_scripts = 
+ test_programs = 
+ 
+ # Includes.
++if want_isulad
+ liblxc_includes = include_directories(
+     '.',
+     'src',
+     'src/include',
+     'src/lxc',
++    'src/lxc/json',
+     'src/lxc/cgroups',
+     'src/lxc/storage')
++else
++liblxc_includes = include_directories(
++    '.',
++    'src',
++    'src/include',
++    'src/lxc',
++    'src/lxc/cgroups',
++    'src/lxc/storage')
++endif
+ 
+ # Our static sub-project binaries don't (and in fact can't) link to our
+ # dependencies directly, but need access to the headers when compiling (most
+@@ -942,7 +968,9 @@ subdir('doc/ja')
+ subdir('doc/ko')
+ subdir('doc/examples')
+ subdir('doc/rootfs')
+-subdir('hooks')
++if not want_isulad
++    subdir('hooks')
++endif
+ if want_commands
+     subdir('src/lxc/cmd')
+ endif
+diff --git a/meson_options.txt b/meson_options.txt
+index 9803473..7146b17 100644
+--- a/meson_options.txt
++++ b/meson_options.txt
+@@ -120,3 +120,11 @@ option('memfd-rexec', type : 'boolean', value : 'true',
+ 
+ option('distrosysconfdir', type : 'string', value: '',
+        description: 'relative path to sysconfdir for distro default configuration')
++
++# was --{disable,enable}-isulad in autotools
++option('isulad', type: 'boolean', value: 'true',
++       description: 'enable adapt to iSulad')
++
++# was --{disable,enable}-securecomplie in autotools
++option('securecomplie', type: 'boolean', value: 'true',
++       description: 'enable secure compile')
+\ No newline at end of file
+diff --git a/src/lxc/af_unix.c b/src/lxc/af_unix.c
+index 6f05b70..6db1864 100644
+--- a/src/lxc/af_unix.c
++++ b/src/lxc/af_unix.c
+@@ -516,7 +516,11 @@ int lxc_unix_connect_type(struct sockaddr_un *addr, int type)
+ 	ret = connect(fd, (struct sockaddr *)addr,
+ 		      offsetof(struct sockaddr_un, sun_path) + len);
+ 	if (ret < 0)
++#ifdef HAVE_ISULAD
++		return syswarn("Failed to connect AF_UNIX socket");
++#else
+ 		return syserror("Failed to connect AF_UNIX socket");
++#endif
+ 
+ 	return move_fd(fd);
+ }
+@@ -545,3 +549,49 @@ int lxc_socket_set_timeout(int fd, int rcv_timeout, int snd_timeout)
+ 
+ 	return 0;
+ }
++
++#ifdef HAVE_ISULAD
++int lxc_named_unix_open(const char *path, int type, int flags)
++{
++	__do_close int fd = -EBADF;
++	int ret;
++	ssize_t len;
++	struct sockaddr_un addr;
++
++	fd = socket(PF_UNIX, type | SOCK_CLOEXEC, 0);
++	if (fd < 0)
++		return -1;
++
++	if (!path)
++		return move_fd(fd);
++
++	len = lxc_unix_sockaddr(&addr, path);
++	if (len < 0)
++		return -1;
++
++	ret = bind(fd, (struct sockaddr *)&addr, len);
++	if (ret < 0)
++		return -1;
++
++	if (chmod(path, 0600) < 0)
++		return -1;
++
++	if (type == SOCK_STREAM) {
++		ret = listen(fd, 100);
++		if (ret < 0)
++			return -1;
++	}
++
++	return move_fd(fd);
++}
++
++int lxc_named_unix_connect(const char *path)

_service:tar_scm:0001-refactor-patch-code-of-utils-commands-and-so-on.patch Deleted

@@ -1,2368 +0,0 @@
-From d6745a42729f4704a0d9913676bf6d8b03c21903 Mon Sep 17 00:00:00 2001
-From: zhangxiaoyu <zhangxiaoyu58@huawei.com>
-Date: Fri, 15 Jul 2022 17:06:09 +0800
-Subject: PATCH refactor patch code of utils commands and so on
-
-Signed-off-by: zhangxiaoyu <zhangxiaoyu58@huawei.com>
----
- src/lxc/cgroups/isulad_cgroup2_devices.c | 575 +++++++++++++++++++++++
- src/lxc/commands.c                       | 185 +++++++-
- src/lxc/commands.h                       |  10 +
- src/lxc/conf.h                           |  95 ++++
- src/lxc/isulad_utils.c                   | 319 +++++++++++++
- src/lxc/isulad_utils.h                   |  99 ++++
- src/lxc/lsm/lsm.c                        |  20 +
- src/lxc/lxc.h                            |  19 +
- src/lxc/lxccontainer.h                   | 194 ++++++++
- src/lxc/network.c                        |   8 +
- src/lxc/tools/lxc_ls.c                   |   8 +
- src/lxc/tools/lxc_start.c                | 109 ++++-
- src/lxc/utils.c                          | 173 +++++++
- src/lxc/utils.h                          |  11 +
- 14 files changed, 1822 insertions(+), 3 deletions(-)
- create mode 100644 src/lxc/cgroups/isulad_cgroup2_devices.c
- create mode 100644 src/lxc/isulad_utils.c
- create mode 100644 src/lxc/isulad_utils.h
-
-diff --git a/src/lxc/cgroups/isulad_cgroup2_devices.c b/src/lxc/cgroups/isulad_cgroup2_devices.c
-new file mode 100644
-index 0000000..05613c5
---- /dev/null
-+++ b/src/lxc/cgroups/isulad_cgroup2_devices.c
-@@ -0,0 +1,575 @@
-+/* SPDX-License-Identifier: LGPL-2.1+ */
-+
-+/* Parts of this taken from systemd's implementation. */
-+
-+#ifndef _GNU_SOURCE
-+#define _GNU_SOURCE 1
-+#endif
-+#include <errno.h>
-+#include <fcntl.h>
-+#include <stdbool.h>
-+#include <stddef.h>
-+#include <stdint.h>
-+#include <sys/stat.h>
-+#include <sys/syscall.h>
-+#include <sys/types.h>
-+#include <unistd.h>
-+
-+#include "cgroup2_devices.h"
-+#include "config.h"
-+#include "log.h"
-+#include "macro.h"
-+#include "memory_utils.h"
-+
-+#ifdef HAVE_STRUCT_BPF_CGROUP_DEV_CTX
-+#include <linux/bpf.h>
-+#include <linux/filter.h>
-+
-+#define BPF_LOG_BUF_SIZE (1 << 23) /* 8MB */
-+#ifndef BPF_LOG_LEVEL1
-+#define BPF_LOG_LEVEL1 1
-+#endif
-+
-+#ifndef BPF_LOG_LEVEL2
-+#define BPF_LOG_LEVEL2 2
-+#endif
-+
-+#ifndef BPF_LOG_LEVEL
-+#define BPF_LOG_LEVEL (BPF_LOG_LEVEL1 | BPF_LOG_LEVEL2)
-+#endif
-+
-+lxc_log_define(cgroup2_devices, cgroup);
-+
-+static int bpf_program_add_instructions(struct bpf_program *prog,
-+					const struct bpf_insn *instructions,
-+					size_t count)
-+{
-+
-+	struct bpf_insn *new_insn;
-+
-+	if (prog->kernel_fd >= 0)
-+		return log_error_errno(-1, EBUSY, "Refusing to update bpf cgroup program that's already loaded");
-+
-+	new_insn = realloc(prog->instructions, sizeof(struct bpf_insn) * (count + prog->n_instructions));
-+	if (!new_insn)
-+		return log_error_errno(-1, ENOMEM, "Failed to reallocate bpf cgroup program");
-+
-+	prog->instructions = new_insn;
-+	memset(prog->instructions + prog->n_instructions, 0,
-+	       sizeof(struct bpf_insn) * count);
-+	memcpy(prog->instructions + prog->n_instructions, instructions,
-+	       sizeof(struct bpf_insn) * count);
-+	prog->n_instructions += count;
-+
-+	return 0;
-+}
-+
-+void bpf_program_free(struct bpf_program *prog)
-+{
-+	if (!prog)
-+		return;
-+
-+	(void)bpf_program_cgroup_detach(prog);
-+
-+	if (prog->kernel_fd >= 0)
-+		close(prog->kernel_fd);
-+	free(prog->instructions);
-+	free(prog->attached_path);
-+	free(prog);
-+}
-+
-+/* Memory load, dst_reg = *(uint *) (src_reg + off16) */
-+#define BPF_LDX_MEM(SIZE, DST, SRC, OFF)                               \
-+	((struct bpf_insn){.code = BPF_LDX | BPF_SIZE(SIZE) | BPF_MEM, \
-+			   .dst_reg = DST,                             \
-+			   .src_reg = SRC,                             \
-+			   .off = OFF,                                 \
-+			   .imm = 0})
-+
-+/* ALU ops on immediates, bpf_add|sub|...: dst_reg += imm32 */
-+#define BPF_ALU32_IMM(OP, DST, IMM)                              \
-+	((struct bpf_insn){.code = BPF_ALU | BPF_OP(OP) | BPF_K, \
-+			   .dst_reg = DST,                       \
-+			   .src_reg = 0,                         \
-+			   .off = 0,                             \
-+			   .imm = IMM})
-+
-+/* Short form of mov, dst_reg = src_reg */
-+#define BPF_MOV64_IMM(DST, IMM)                                 \
-+	((struct bpf_insn){.code = BPF_ALU64 | BPF_MOV | BPF_K, \
-+			   .dst_reg = DST,                      \
-+			   .src_reg = 0,                        \
-+			   .off = 0,                            \
-+			   .imm = IMM})
-+
-+#define BPF_MOV32_REG(DST, SRC)                               \
-+	((struct bpf_insn){.code = BPF_ALU | BPF_MOV | BPF_X, \
-+			   .dst_reg = DST,                    \
-+			   .src_reg = SRC,                    \
-+			   .off = 0,                          \
-+			   .imm = 0})
-+
-+/* Conditional jumps against registers, if (dst_reg 'op' src_reg) goto pc + off16 */
-+#define BPF_JMP_REG(OP, DST, SRC, OFF)                           \
-+	((struct bpf_insn){.code = BPF_JMP | BPF_OP(OP) | BPF_X, \
-+			   .dst_reg = DST,                       \
-+			   .src_reg = SRC,                       \
-+			   .off = OFF,                           \
-+			   .imm = 0})
-+
-+/* Conditional jumps against immediates, if (dst_reg 'op' imm32) goto pc + off16 */
-+#define BPF_JMP_IMM(OP, DST, IMM, OFF)                           \
-+	((struct bpf_insn){.code = BPF_JMP | BPF_OP(OP) | BPF_K, \
-+			   .dst_reg = DST,                       \
-+			   .src_reg = 0,                         \
-+			   .off = OFF,                           \
-+			   .imm = IMM})
-+
-+/* Program exit */
-+#define BPF_EXIT_INSN()                                \
-+	((struct bpf_insn){.code = BPF_JMP | BPF_EXIT, \
-+			   .dst_reg = 0,               \
-+			   .src_reg = 0,               \
-+			   .off = 0,                   \
-+			   .imm = 0})
-+
-+static int bpf_access_mask(const char *acc, __u32 *mask)
-+{
-+	if (!acc)
-+		return 0;
-+
-+	for (; *acc; acc++)
-+		switch (*acc) {
-+		case 'r':
-+			*mask |= BPF_DEVCG_ACC_READ;
-+			break;
-+		case 'w':
-+			*mask |= BPF_DEVCG_ACC_WRITE;
-+			break;
-+		case 'm':
-+			*mask |= BPF_DEVCG_ACC_MKNOD;
-+			break;
-+		default:
-+			return -EINVAL;
-+		}
-+
-+	return 0;
-+}
-+
-+static int bpf_device_type(char type)
-+{
-+	switch (type) {
-+	case 'a':
-+		return 0;
-+	case 'b':
-+		return BPF_DEVCG_DEV_BLOCK;
-+	case 'c':
-+		return BPF_DEVCG_DEV_CHAR;

_service:tar_scm:0002-iSulad-adapt-security-conf-attach-cgroup-and-start.patch Added

@@ -0,0 +1,4485 @@
+From ef27d69db952dc64fc3c476a89c3e822c891e663 Mon Sep 17 00:00:00 2001
+From: haozi007 <liuhao27@huawei.com>
+Date: Mon, 17 Jul 2023 20:40:48 +0800
+Subject: PATCH 2/3 iSulad adapt security conf attach cgroup and start
+
+Signed-off-by: haozi007 <liuhao27@huawei.com>
+---
+ src/lxc/attach.c           |  503 ++++++++++-
+ src/lxc/attach.h           |    6 +
+ src/lxc/attach_options.h   |   25 +
+ src/lxc/cgroups/cgroup.c   |    5 +-
+ src/lxc/cgroups/cgroup.h   |    7 +
+ src/lxc/conf.c             | 1703 +++++++++++++++++++++++++++++++++++-
+ src/lxc/conf.h             |   82 ++
+ src/lxc/isulad_utils.c     |   25 +
+ src/lxc/isulad_utils.h     |   26 +-
+ src/lxc/lsm/apparmor.c     |   14 +
+ src/lxc/lsm/lsm.h          |    4 +
+ src/lxc/lsm/nop.c          |   14 +
+ src/lxc/lsm/selinux.c      |  256 ++++++
+ src/lxc/lxc.h              |    7 +
+ src/lxc/lxclock.c          |   27 +
+ src/lxc/lxclock.h          |    4 +
+ src/lxc/mainloop.c         |   16 +
+ src/lxc/mainloop.h         |    4 +
+ src/lxc/mount_utils.c      |    5 +
+ src/lxc/seccomp.c          |   32 +
+ src/lxc/start.h            |   11 +
+ src/lxc/tools/arguments.h  |   28 +
+ src/lxc/tools/lxc_attach.c |  490 ++++++++++-
+ src/lxc/tools/lxc_start.c  |  107 ++-
+ 24 files changed, 3376 insertions(+), 25 deletions(-)
+
+diff --git a/src/lxc/attach.c b/src/lxc/attach.c
+index f086e96..1a89001 100644
+--- a/src/lxc/attach.c
++++ b/src/lxc/attach.c
+@@ -47,6 +47,24 @@
+ #include "terminal.h"
+ #include "utils.h"
+ 
++#ifdef HAVE_ISULAD
++#include "exec_commands.h"
++
++typedef enum {
++	ATTACH_INIT,
++	ATTACH_TIMEOUT,
++	ATTACH_MAX,
++} attach_timeout_t;
++
++static volatile attach_timeout_t g_attach_timeout_state = ATTACH_INIT;
++
++struct attach_timeout_conf {
++	int64_t timeout;
++	unsigned long long start_time;
++	pid_t pid;
++};
++#endif
++
+ lxc_log_define(attach, lxc);
+ 
+ /* Define default options if no options are supplied by the user. */
+@@ -1115,6 +1133,9 @@ struct attach_payload {
+ 	struct attach_context *ctx;
+ 	lxc_attach_exec_t exec_function;
+ 	void *exec_payload;
++#ifdef HAVE_ISULAD
++	struct lxc_terminal *terminal;
++#endif
+ };
+ 
+ static void put_attach_payload(struct attach_payload *p)
+@@ -1127,6 +1148,48 @@ static void put_attach_payload(struct attach_payload *p)
+ 	}
+ }
+ 
++#ifdef HAVE_ISULAD
++static int isulad_set_attach_pipes(struct lxc_terminal *terminal)
++{
++	int ret = 0;
++	if (terminal->pipes01 >= 0) {
++		close(terminal->pipes01);
++		terminal->pipes01 = -1;
++	}
++
++	if (terminal->pipes00 >= 0) {
++		ret = dup2(terminal->pipes00, STDIN_FILENO);
++		if (ret < 0)
++			goto out;
++	}
++
++	if (terminal->pipes10 >= 0) {
++		close(terminal->pipes10);
++		terminal->pipes10 = -1;
++	}
++
++	if (terminal->pipes11 >= 0) {
++		ret = dup2(terminal->pipes11, STDOUT_FILENO);
++		if (ret < 0)
++			goto out;
++	}
++	if (terminal->pipes20 >= 0) {
++		close(terminal->pipes20);
++		terminal->pipes20 = -1;
++	}
++
++	if (terminal->pipes21 >= 0) {
++		ret = dup2(terminal->pipes21, STDERR_FILENO);
++		if (ret < 0)
++			goto out;
++	}
++
++	setsid();
++out:
++	return ret;
++}
++#endif
++
+ __noreturn static void do_attach(struct attach_payload *ap)
+ {
+ 	lxc_attach_exec_t attach_function = move_ptr(ap->exec_function);
+@@ -1135,6 +1198,31 @@ __noreturn static void do_attach(struct attach_payload *ap)
+ 	lxc_attach_options_t* options = ap->options;
+         struct attach_context *ctx = ap->ctx;
+         struct lxc_conf *conf = ctx->container->lxc_conf;
++#ifdef HAVE_ISULAD
++	int msg_fd = -1;
++	sigset_t mask;
++
++	/*isulad: record errpipe fd*/
++	msg_fd = init_ctx->container->lxc_conf->errpipe1;
++	init_ctx->container->lxc_conf->errpipe1 = -1;
++	/*isulad: set system umask */
++	umask(init_ctx->container->lxc_conf->umask);
++
++	/*isulad: restore default signal handlers and unblock all signals*/
++	for (int i = 1; i < NSIG; i++)
++		signal(i, SIG_DFL);
++
++	ret = sigfillset(&mask);
++	if (ret < 0) {
++		SYSERROR("Failed to fill signal mask");
++		goto on_error;;
++	}
++	ret = sigprocmask(SIG_UNBLOCK, &mask, NULL);
++	if (ret < 0) {
++		SYSERROR("Failed to set signal mask");
++		goto on_error;
++	}
++#endif
+ 
+ 	/*
+ 	 * We currently artificially restrict core scheduling to be a pid
+@@ -1209,6 +1297,27 @@ __noreturn static void do_attach(struct attach_payload *ap)
+ 		TRACE("Dropped capabilities");
+ 	}
+ 
++#ifdef HAVE_ISULAD
++	/* isulad: set workdir */
++	if (options->initial_cwd || conf->init_cwd) {
++		char *init_cwd;
++		init_cwd = options->initial_cwd ? options->initial_cwd : conf->init_cwd;
++		/* try to create workdir if not exist */
++		struct stat st;
++		if (stat(init_cwd, &st) < 0 && mkdir_p(init_cwd, 0750) < 0) {
++			SYSERROR("Try to create directory \"%s\" as workdir failed when attach", init_cwd);
++			lxc_write_error_message(msg_fd, "Try to create directory \"%s\" as workdir failed when attach: %s",
++						init_cwd, strerror(errno));
++			goto on_error;
++		}
++		if (chdir(init_cwd)) {
++			SYSERROR("Could not change directory to \"%s\" when attach", init_cwd);
++			lxc_write_error_message(msg_fd, "Could not change directory to \"%s\" when attach: %s",
++						init_cwd, strerror(errno));
++			goto on_error;
++		}
++	}
++#endif
+ 	/* Always set the environment (specify (LXC_ATTACH_KEEP_ENV, NULL, NULL)
+ 	 * if you want this to be a no-op).
+ 	 */
+@@ -1248,6 +1357,7 @@ __noreturn static void do_attach(struct attach_payload *ap)
+ 			goto on_error;
+ 	}
+ 
++#ifndef HAVE_ISULAD
+ 	if ((options->attach_flags & LXC_ATTACH_SETGROUPS) &&
+ 	    options->groups.size > 0) {
+ 		if (!lxc_setgroups(options->groups.list, options->groups.size))
+@@ -1256,6 +1366,7 @@ __noreturn static void do_attach(struct attach_payload *ap)
+ 		if (!lxc_drop_groups() && errno != EPERM)
+ 			goto on_error;
+ 	}
++#endif
+ 
+ 	if (options->namespaces & CLONE_NEWUSER)
+ 		if (!lxc_switch_uid_gid(ctx->setup_ns_uid, ctx->setup_ns_gid))
+@@ -1274,6 +1385,13 @@ __noreturn static void do_attach(struct attach_payload *ap)
+ 		TRACE("Set %s LSM label to \"%s\"", ctx->lsm_ops->name, ctx->lsm_label);

_service:tar_scm:0002-refactor-patch-code-of-isulad-for-conf-exec-attach.patch Deleted

@@ -1,2856 +0,0 @@
-From 7166cf40250f00544e204a33da668b56ed4b13ca Mon Sep 17 00:00:00 2001
-From: haozi007 <liuhao27@huawei.com>
-Date: Mon, 18 Jul 2022 11:30:33 +0800
-Subject: PATCH refactor patch code of isulad for conf/exec/attach
-
-Signed-off-by: haozi007 <liuhao27@huawei.com>
----
- src/lxc/attach_options.h  |   41 +-
- src/lxc/conf.c            | 1993 ++++++++++++++++++++++++++++++++++++-
- src/lxc/criu.c            |    8 +-
- src/lxc/execute.c         |   19 +
- src/lxc/file_utils.c      |   27 +
- src/lxc/lsm/apparmor.c    |   14 +
- src/lxc/tools/arguments.h |   24 +
- 7 files changed, 2122 insertions(+), 4 deletions(-)
-
-diff --git a/src/lxc/attach_options.h b/src/lxc/attach_options.h
-index 63e62d4..16b4e21 100644
---- a/src/lxc/attach_options.h
-+++ b/src/lxc/attach_options.h
-@@ -49,7 +49,11 @@ enum {
-  *
-  * \return Function should return \c 0 on success, and any other value to denote failure.
-  */
-+#ifdef HAVE_ISULAD
-+typedef int (*lxc_attach_exec_t)(void* payload, int msg_fd);
-+#else
- typedef int (*lxc_attach_exec_t)(void* payload);
-+#endif
- 
- /*!
-  * LXC attach options for \ref lxc_container \c attach().
-@@ -113,9 +117,18 @@ typedef struct lxc_attach_options_t {
- 
- 	/*! File descriptor to log output. */
- 	int log_fd;
-+
-+#ifdef HAVE_ISULAD
-+	char *init_fifo3; /* isulad: default fifos for the start */
-+	int64_t timeout;/* isulad: Seconds for waiting on a container to attach/exec before it is killed*/
-+	const char *suffix;
-+	bool disable_pty;
-+	bool open_stdin;
-+#endif
- } lxc_attach_options_t;
- 
- /*! Default attach options to use */
-+#ifndef HAVE_ISULAD
- #define LXC_ATTACH_OPTIONS_DEFAULT                                             \
- 	{                                                                      \
- 		/* .attach_flags = */   LXC_ATTACH_DEFAULT,                    \
-@@ -132,7 +145,25 @@ typedef struct lxc_attach_options_t {
- 		/* .stderr_fd = */      2,                                     \
- 		/* .log_fd    = */      -EBADF,                                \
- 	}
--
-+#else
-+#define LXC_ATTACH_OPTIONS_DEFAULT                                             \
-+	{                                                                      \
-+		/* .attach_flags = */   LXC_ATTACH_DEFAULT,                    \
-+		/* .namespaces = */     -1,                                    \
-+		/* .personality = */    -1,                                    \
-+		/* .initial_cwd = */    NULL,                                  \
-+		/* .uid = */            (uid_t)-1,                             \
-+		/* .gid = */            (gid_t)-1,                             \
-+		/* .env_policy = */     LXC_ATTACH_KEEP_ENV,                   \
-+		/* .extra_env_vars = */ NULL,                                  \
-+		/* .extra_keep_env = */ NULL,                                  \
-+		/* .stdin_fd = */       0,                                     \
-+		/* .stdout_fd = */      1,                                     \
-+		/* .stderr_fd = */      2,                                     \
-+		/* .log_fd    = */      -EBADF,                                \
-+		/* .init_fifo = */  	{NULL, NULL, NULL},                    \
-+	}
-+#endif
- /*!
-  * Representation of a command to run in a container.
-  */
-@@ -148,7 +179,11 @@ typedef struct lxc_attach_command_t {
-  *
-  * \return \c -1 on error, exit code of lxc_attach_command_t program on success.
-  */
-+#ifdef HAVE_ISULAD
-+extern int lxc_attach_run_command(void* payload, int msg_fd);
-+#else
- extern int lxc_attach_run_command(void* payload);
-+#endif
- 
- /*!
-  * \brief Run a shell command in the container.
-@@ -157,7 +192,11 @@ extern int lxc_attach_run_command(void* payload);
-  *
-  * \return Exit code of shell.
-  */
-+#ifdef HAVE_ISULAD
-+extern int lxc_attach_run_shell(void* payload, int msg_fd);
-+#else
- extern int lxc_attach_run_shell(void* payload);
-+#endif
- 
- #ifdef  __cplusplus
- }
-diff --git a/src/lxc/conf.c b/src/lxc/conf.c
-index 0078996..378cf9f 100644
---- a/src/lxc/conf.c
-+++ b/src/lxc/conf.c
-@@ -33,6 +33,14 @@
- #include <time.h>
- #include <unistd.h>
- 
-+#ifdef HAVE_ISULAD
-+#include <pthread.h>
-+#include "sync.h"
-+#include "path.h"
-+#include "utils.h"
-+#include "loop.h"
-+#endif
-+
- #include "af_unix.h"
- #include "caps.h"
- #include "cgroup.h"
-@@ -118,7 +126,14 @@ char *lxchook_namesNUM_LXC_HOOKS = {
- 	"post-stop",
- 	"clone",
- 	"destroy",
-+#ifdef HAVE_ISULAD
-+	"start-host",
-+	"oci-prestart",
-+	"oci-poststart",
-+	"oci-poststop"
-+#else
- 	"start-host"
-+#endif
- };
- 
- struct mount_opt {
-@@ -285,6 +300,22 @@ static struct limit_opt limit_opt = {
- #endif
- };
- 
-+#ifdef HAVE_ISULAD
-+static int rootfs_parent_mount_private(char *rootfs);
-+static int setup_rootfs_ropaths(struct lxc_list *ropaths);
-+static int setup_rootfs_maskedpaths(struct lxc_list *maskedpaths);
-+static int remount_proc_sys_mount_entries(struct lxc_list *mount_list, bool lsm_aa_allow_nesting);
-+static int check_mount_destination(const char *rootfs, const char *dest, const char *src);
-+static int mount_entry_with_loop_dev(const char *src, const char *dest, const char *fstype,
-+		char *mnt_opts, const char *rootfs);
-+static bool need_setup_proc(const struct lxc_conf *conf, struct lxc_list *mount);
-+static bool need_setup_dev(const struct lxc_conf *conf, struct lxc_list *mount);
-+static int setup_populate_devs(const struct lxc_rootfs *rootfs, struct lxc_list *devs, const char *mount_label);
-+static int setup_rootfs_mountopts(const struct lxc_rootfs *rootfs);
-+static int create_mtab_link();
-+
-+#endif
-+
- static int run_buffer(char *buffer)
- {
- 	__do_free char *output = NULL;
-@@ -637,8 +668,13 @@ static int lxc_mount_auto_mounts(struct lxc_conf *conf, int flags, struct lxc_ha
- 		{ LXC_AUTO_PROC_MASK, LXC_AUTO_PROC_MIXED, "%r/proc/sysrq-trigger",                          "%r/proc/sysrq-trigger",      NULL,    MS_BIND,                                         NULL },
- 		{ LXC_AUTO_PROC_MASK, LXC_AUTO_PROC_MIXED, NULL,                                             "%r/proc/sysrq-trigger",      NULL,    MS_REMOUNT|MS_BIND|MS_RDONLY,                    NULL },
- 		{ LXC_AUTO_PROC_MASK, LXC_AUTO_PROC_RW,    "proc",                                           "%r/proc",                    "proc",  MS_NODEV|MS_NOEXEC|MS_NOSUID,                    NULL },
-+#ifdef HAVE_ISULAD
-+		{ LXC_AUTO_SYS_MASK,  LXC_AUTO_SYS_RW,     "sysfs",                                          "%r/sys",                     "sysfs", MS_NODEV|MS_NOEXEC|MS_NOSUID,                    NULL },
-+		{ LXC_AUTO_SYS_MASK,  LXC_AUTO_SYS_RO,     "sysfs",                                          "%r/sys",                     "sysfs", MS_RDONLY|MS_NODEV|MS_NOEXEC|MS_NOSUID,          NULL },
-+#else
- 		{ LXC_AUTO_SYS_MASK,  LXC_AUTO_SYS_RW,     "sysfs",                                          "%r/sys",                     "sysfs", 0,                                               NULL },
- 		{ LXC_AUTO_SYS_MASK,  LXC_AUTO_SYS_RO,     "sysfs",                                          "%r/sys",                     "sysfs", MS_RDONLY,                                       NULL },
-+#endif
- 		{ LXC_AUTO_SYS_MASK,  LXC_AUTO_SYS_MIXED,  "sysfs",                                          "%r/sys",                     "sysfs", MS_NODEV|MS_NOEXEC|MS_NOSUID,                    NULL },
- 		{ LXC_AUTO_SYS_MASK,  LXC_AUTO_SYS_MIXED,  "%r/sys",                                         "%r/sys",                     NULL,    MS_BIND,                                         NULL },
- 		{ LXC_AUTO_SYS_MASK,  LXC_AUTO_SYS_MIXED,  NULL,                                             "%r/sys",                     NULL,    MS_REMOUNT|MS_BIND|MS_RDONLY,                    NULL },
-@@ -670,11 +706,24 @@ static int lxc_mount_auto_mounts(struct lxc_conf *conf, int flags, struct lxc_ha
- 		if (!destination)
- 			return -1;
- 
-+#ifdef HAVE_ISULAD
-+		if (mkdir_p(destination, 0755) < 0) {
-+			SYSERROR("Failed to create mount target '%s'", destination);
-+			return log_error(-1, "Failed to mkdir destination %s", destination);
-+		}
-+#endif
-+
- 		mflags = add_required_remount_flags(source, destination,
- 						    default_mountsi.flags);
-+#ifdef HAVE_ISULAD
-+		r = safe_mount(source, destination, default_mountsi.fstype,
-+			       mflags, default_mountsi.options,
-+			       conf->rootfs.path ? conf->rootfs.mount : NULL, NULL);
-+#else
- 		r = safe_mount(source, destination, default_mountsi.fstype,
- 			       mflags, default_mountsi.options,
- 			       conf->rootfs.path ? conf->rootfs.mount : NULL);
-+#endif
- 		saved_errno = errno;
- 		if (r < 0 && errno == ENOENT) {
- 			INFO("Mount source or target for \"%s\" on \"%s\" does not exist. Skipping", source, destination);
-@@ -1047,8 +1096,13 @@ on_error:

_service:tar_scm:0003-iSulad-adapt-conf-network-storage-and-termianl.patch Added

@@ -0,0 +1,1901 @@
+From 0015fbf989f5f1837f9588f8385b16dd38dbd29f Mon Sep 17 00:00:00 2001
+From: haozi007 <liuhao27@huawei.com>
+Date: Fri, 21 Jul 2023 17:35:52 +0800
+Subject: PATCH 3/3 iSulad adapt conf network storage and termianl
+
+Signed-off-by: haozi007 <liuhao27@huawei.com>
+---
+ src/lxc/attach_options.h        |  26 +-
+ src/lxc/cgroups/isulad_cgfsng.c | 114 +++---
+ src/lxc/conf.c                  |   2 +-
+ src/lxc/log.c                   |  58 +++
+ src/lxc/network.c               |   8 +
+ src/lxc/storage/dir.c           |   4 +
+ src/lxc/storage/loop.c          |  41 +++
+ src/lxc/storage/storage.c       |   7 +
+ src/lxc/sync.h                  |   9 +
+ src/lxc/terminal.c              | 610 ++++++++++++++++++++++++++++++++
+ src/lxc/terminal.h              |  37 ++
+ src/lxc/tools/lxc_ls.c          |   8 +
+ src/lxc/utils.c                 | 143 ++++++++
+ src/lxc/utils.h                 |   7 +
+ src/tests/attach.c              |  11 +
+ 15 files changed, 1026 insertions(+), 59 deletions(-)
+
+diff --git a/src/lxc/attach_options.h b/src/lxc/attach_options.h
+index d09dfce..a4052fb 100644
+--- a/src/lxc/attach_options.h
++++ b/src/lxc/attach_options.h
+@@ -172,6 +172,28 @@ typedef struct lxc_attach_options_t {
+ } lxc_attach_options_t;
+ 
+ /*! Default attach options to use */
++
++#ifdef HAVE_ISULAD
++#define LXC_ATTACH_OPTIONS_DEFAULT					\
++	{                                               		\
++		.attach_flags	= LXC_ATTACH_DEFAULT,   		\
++		.namespaces	= -1,					\
++		.personality	= LXC_ATTACH_DETECT_PERSONALITY,	\
++		.initial_cwd	= NULL,					\
++		.uid		= (uid_t)-1,            		\
++		.gid		= (gid_t)-1,            		\
++		.env_policy	= LXC_ATTACH_KEEP_ENV,  		\
++		.extra_env_vars = NULL,                 		\
++		.extra_keep_env = NULL,                 		\
++		.stdin_fd	= 0,                    		\
++		.stdout_fd	= 1,                    		\
++		.stderr_fd	= 2,                    		\
++		.log_fd		= -EBADF,               		\
++		.lsm_label	= NULL,					\
++		.groups		= {},					\
++		.init_fifo =   {NULL, NULL, NULL},  \
++	}
++#else
+ #define LXC_ATTACH_OPTIONS_DEFAULT					\
+ 	{                                               		\
+ 		.attach_flags	= LXC_ATTACH_DEFAULT,   		\
+@@ -189,10 +211,8 @@ typedef struct lxc_attach_options_t {
+ 		.log_fd		= -EBADF,               		\
+ 		.lsm_label	= NULL,					\
+ 		.groups		= {},					\
+-#ifdef HAVE_ISULAD
+-		/* .init_fifo = */  	{NULL, NULL, NULL},  \
+-#endif
+ 	}
++#endif
+ 
+ /*!
+  * Representation of a command to run in a container.
+diff --git a/src/lxc/cgroups/isulad_cgfsng.c b/src/lxc/cgroups/isulad_cgfsng.c
+index dcaa229..38ad677 100644
+--- a/src/lxc/cgroups/isulad_cgfsng.c
++++ b/src/lxc/cgroups/isulad_cgfsng.c
+@@ -385,11 +385,11 @@ static struct hierarchy *add_hierarchy(struct hierarchy ***h, char **clist, char
+ 
+ 	new = zalloc(sizeof(*new));
+ 	new->controllers = clist;
+-	new->mountpoint = mountpoint;
+-	new->container_base_path = container_base_path;
+-	new->version = type;
+-	new->cgfd_con = -EBADF;
+-	new->cgfd_mon = -EBADF;
++	new->at_mnt = mountpoint;
++	new->at_base = container_base_path;
++	new->fs_type = type;
++	new->dfd_con = -EBADF;
++	new->dfd_mon = -EBADF;
+ 
+ 	newentry = append_null_to_list((void ***)h);
+ 	(*h)newentry = new;
+@@ -586,8 +586,8 @@ static void lxc_cgfsng_print_hierarchies(struct cgroup_ops *ops)
+ 		int j;
+ 		char **cit;
+ 
+-		TRACE("  %d: base_cgroup: %s", i, (*it)->container_base_path ? (*it)->container_base_path : "(null)");
+-		TRACE("      mountpoint:  %s", (*it)->mountpoint ? (*it)->mountpoint : "(null)");
++		TRACE("  %d: base_cgroup: %s", i, (*it)->at_base ? (*it)->at_base : "(null)");
++		TRACE("      at_mnt:  %s", (*it)->at_mnt ? (*it)->at_mnt : "(null)");
+ 		TRACE("      controllers:");
+ 		for (j = 0, cit = (*it)->controllers; cit && *cit; cit++, j++)
+ 			TRACE("      %d: %s", j, *cit);
+@@ -628,17 +628,21 @@ static int isulad_cgroup_tree_remove(struct hierarchy **hierarchies,
+ 		struct hierarchy *h = hierarchiesi;
+ 		int ret;
+ 
+-		if (!h->container_full_path) {
+-			h->container_full_path = must_make_path(h->mountpoint, h->container_base_path, container_cgroup, NULL);
++		if (!h->path_con) {
++			h->path_con = must_make_path(h->at_mnt, h->at_base, container_cgroup, NULL);
+ 		}
+ 
+-		ret = lxc_rm_rf(h->container_full_path);
++		ret = lxc_rm_rf(h->path_con);
+ 		if (ret < 0) {
+-			SYSERROR("Failed to destroy \"%s\"", h->container_full_path);
++			if (errno == ENOENT) {
++				WARN("Destroy path: \"%s\" do not exist", h->path_con);
++				return 0;
++			}
++			SYSERROR("Failed to destroy \"%s\"", h->path_con);
+ 			return -1;
+ 		}
+ 
+-		free_disarm(h->container_full_path);
++		free_disarm(h->path_con);
+ 	}
+ 
+ 	return 0;
+@@ -842,7 +846,7 @@ static bool isulad_cg_legacy_handle_cpuset_hierarchy(struct hierarchy *h, char *
+ 	if (slash != NULL) {
+ 		while (slash) {
+ 			*slash = '\0';
+-			cgpath = must_make_path(h->mountpoint, h->container_base_path, cgname, NULL);
++			cgpath = must_make_path(h->at_mnt, h->at_base, cgname, NULL);
+ 			sub_mk_success = build_sub_cpuset_cgroup_dir(cgpath);
+ 			free(cgpath);
+ 			*slash = '/';
+@@ -853,7 +857,7 @@ static bool isulad_cg_legacy_handle_cpuset_hierarchy(struct hierarchy *h, char *
+ 		}
+ 	}
+ 
+-	cgpath = must_make_path(h->mountpoint, h->container_base_path, cgname, NULL);
++	cgpath = must_make_path(h->at_mnt, h->at_base, cgname, NULL);
+ 	sub_mk_success = build_sub_cpuset_cgroup_dir(cgpath);
+ 	free(cgpath);
+ 	if (!sub_mk_success) {
+@@ -902,7 +906,7 @@ static bool create_path_for_hierarchy(struct hierarchy *h, char *cgname, int err
+ 	int ret;
+ 	__do_free char *path = NULL;
+ 
+-	path = must_make_path(h->mountpoint, h->container_base_path, cgname, NULL);
++	path = must_make_path(h->at_mnt, h->at_base, cgname, NULL);
+ 
+ 	if (file_exists(path)) { // it must not already exist
+ 		ERROR("Cgroup path \"%s\" already exist.", path);
+@@ -926,8 +930,8 @@ static bool create_path_for_hierarchy(struct hierarchy *h, char *cgname, int err
+ 	if (h->cgfd_con < 0)
+ 		return log_error_errno(false, errno, "Failed to open %s", path);
+ 
+-	if (h->container_full_path == NULL) {
+-		h->container_full_path = move_ptr(path);
++	if (h->path_con == NULL) {
++		h->path_con = move_ptr(path);
+ 	}
+ 
+ 	return true;
+@@ -961,7 +965,7 @@ __cgfsng_ops static inline bool isulad_cgfsng_payload_create(struct cgroup_ops *
+ 
+ 	for (i = 0; ops->hierarchiesi; i++) {
+ 		if (!create_path_for_hierarchy(ops->hierarchiesi, container_cgroup, ops->errfd)) {
+-			SYSERROR("Failed to create %s", ops->hierarchiesi->container_full_path);
++			SYSERROR("Failed to create %s", ops->hierarchiesi->path_con);
+ 			return false;
+ 		}
+ 	}
+@@ -1008,7 +1012,7 @@ __cgfsng_ops static bool isulad_cgfsng_payload_enter(struct cgroup_ops *ops,
+ 		int retry_count = 0;
+ 		int max_retry = 10;
+ 
+-		fullpath = must_make_path(ops->hierarchiesi->container_full_path,
++		fullpath = must_make_path(ops->hierarchiesi->path_con,
+ 		                          "cgroup.procs", NULL);
+ retry:
+ 		ret = lxc_write_to_file(fullpath, pidstr, len, false, 0666);
+@@ -1016,7 +1020,7 @@ retry:
+ 			if (retry_count < max_retry) {
+ 				SYSERROR("Failed to enter cgroup \"%s\" with retry count:%d", fullpath, retry_count);
+ 				(void)isulad_cg_legacy_handle_cpuset_hierarchy(ops->hierarchiesi, ops->container_cgroup);
+-				(void)isulad_mkdir_eexist_on_last(ops->hierarchiesi->container_full_path, 0755);
++				(void)isulad_mkdir_eexist_on_last(ops->hierarchiesi->path_con, 0755);
+ 				usleep(100 * 1000); /* 100 millisecond */
+ 				retry_count++;
+ 				goto retry;
+@@ -1097,12 +1101,12 @@ static int chown_cgroup_wrapper(void *data)
+ 		 * files (which systemd in wily insists on doing).
+ 		 */
+ 
+-		if (arg->hierarchiesi->version == CGROUP_SUPER_MAGIC)
++		if (arg->hierarchiesi->fs_type == CGROUP_SUPER_MAGIC)

_service:tar_scm:0003-refactor-patch-code-of-isulad-for-selinux-attach.patch Deleted

@@ -1,1243 +0,0 @@
-From 44dd71a4d76eb464b81890ea3cfa2ac9c6c3d990 Mon Sep 17 00:00:00 2001
-From: haozi007 <liuhao27@huawei.com>
-Date: Tue, 19 Jul 2022 14:40:59 +0800
-Subject: PATCH refactor patch code of isulad for selinux/attach
-
-Signed-off-by: haozi007 <liuhao27@huawei.com>
----
- src/lxc/exec_commands.c    | 471 +++++++++++++++++++++++++++++++++++++
- src/lxc/lsm/selinux.c      | 258 ++++++++++++++++++++
- src/lxc/tools/lxc_attach.c | 413 +++++++++++++++++++++++++++++++-
- 3 files changed, 1141 insertions(+), 1 deletion(-)
- create mode 100644 src/lxc/exec_commands.c
-
-diff --git a/src/lxc/exec_commands.c b/src/lxc/exec_commands.c
-new file mode 100644
-index 0000000..50246fa
---- /dev/null
-+++ b/src/lxc/exec_commands.c
-@@ -0,0 +1,471 @@
-+/******************************************************************************
-+ * Copyright (c) Huawei Technologies Co., Ltd. 2019. All rights reserved.
-+ * Author: lifeng
-+ * Create: 2019-12-08
-+ * Description: provide container definition
-+ * lxc: linux Container library
-+ * This library is free software; you can redistribute it and/or
-+ * modify it under the terms of the GNU Lesser General Public
-+ * License as published by the Free Software Foundation; either
-+ * version 2.1 of the License, or (at your option) any later version.
-+ *
-+ * This library is distributed in the hope that it will be useful,
-+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
-+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
-+ * Lesser General Public License for more details.
-+ *
-+ * You should have received a copy of the GNU Lesser General Public
-+ * License along with this library; if not, write to the Free Software
-+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
-+  ******************************************************************************/
-+
-+#ifndef _GNU_SOURCE
-+#define _GNU_SOURCE 1
-+#endif
-+#include <caps.h>
-+#include <errno.h>
-+#include <fcntl.h>
-+#include <malloc.h>
-+#include <poll.h>
-+#include <signal.h>
-+#include <stdio.h>
-+#include <stdlib.h>
-+#include <sys/param.h>
-+#include <sys/socket.h>
-+#include <sys/un.h>
-+#include <unistd.h>
-+
-+#include "af_unix.h"
-+#include "cgroup.h"
-+#include "exec_commands.h"
-+#include "commands_utils.h"
-+#include "conf.h"
-+#include "config.h"
-+#include "confile.h"
-+#include "log.h"
-+#include "lxc.h"
-+#include "lxclock.h"
-+#include "mainloop.h"
-+#include "monitor.h"
-+#include "terminal.h"
-+#include "utils.h"
-+
-+lxc_log_define(commands_exec, lxc);
-+
-+static const char *lxc_exec_cmd_str(lxc_exec_cmd_t cmd)
-+{
-+	static const char *const cmdnameLXC_EXEC_CMD_MAX = {
-+		LXC_EXEC_CMD_SET_TERMINAL_WINCH  = "set_exec_terminal_winch",
-+	};
-+
-+	if (cmd >= LXC_EXEC_CMD_MAX)
-+		return "Invalid request";
-+
-+	return cmdnamecmd;
-+}
-+
-+static int lxc_exec_cmd_rsp_recv(int sock, struct lxc_exec_cmd_rr *cmd)
-+{
-+	int ret, rspfd;
-+	struct lxc_exec_cmd_rsp *rsp = &cmd->rsp;
-+
-+	ret = lxc_abstract_unix_recv_fds_timeout(sock, &rspfd, 1, rsp, sizeof(*rsp), 1000 * 1000);
-+	if (ret < 0) {
-+		SYSERROR("Failed to receive response for command \"%s\"",
-+		        lxc_exec_cmd_str(cmd->req.cmd));
-+
-+		if (errno == ECONNRESET || errno == EAGAIN || errno == EWOULDBLOCK) {
-+			errno = ECONNRESET; /*isulad set errno ECONNRESET when timeout */
-+			return -1;
-+		}
-+
-+		return -1;
-+	}
-+	TRACE("Command \"%s\" received response", lxc_exec_cmd_str(cmd->req.cmd));
-+
-+	if (rsp->datalen == 0) {
-+		DEBUG("Response data length for command \"%s\" is 0",
-+		      lxc_exec_cmd_str(cmd->req.cmd));
-+		return ret;
-+	}
-+
-+	if (rsp->datalen > LXC_CMD_DATA_MAX) {
-+		ERROR("Response data for command \"%s\" is too long: %d bytes > %d",
-+		      lxc_exec_cmd_str(cmd->req.cmd), rsp->datalen, LXC_CMD_DATA_MAX);
-+		return -1;
-+	}
-+
-+	rsp->data = malloc(rsp->datalen);
-+	if (!rsp->data) {
-+		errno = ENOMEM;
-+		ERROR("Failed to allocate response buffer for command \"%s\"",
-+		      lxc_exec_cmd_str(cmd->req.cmd));
-+		return -1;
-+	}
-+
-+	ret = lxc_recv_nointr(sock, rsp->data, rsp->datalen, 0);
-+	if (ret != rsp->datalen) {
-+		SYSERROR("Failed to receive response data for command \"%s\"",
-+		         lxc_exec_cmd_str(cmd->req.cmd));
-+		return -1;
-+	}
-+
-+	return ret;
-+}
-+
-+static int lxc_exec_cmd_rsp_send(int fd, struct lxc_exec_cmd_rsp *rsp)
-+{
-+	ssize_t ret;
-+
-+	errno = EMSGSIZE;
-+	ret = lxc_send_nointr(fd, rsp, sizeof(*rsp), MSG_NOSIGNAL);
-+	if (ret < 0 || (size_t)ret != sizeof(*rsp)) {
-+		SYSERROR("Failed to send command response %zd", ret);
-+		return -1;
-+	}
-+
-+	if (!rsp->data || rsp->datalen <= 0)
-+		return 0;
-+
-+	errno = EMSGSIZE;
-+	ret = lxc_send_nointr(fd, rsp->data, rsp->datalen, MSG_NOSIGNAL);
-+	if (ret < 0 || ret != (ssize_t)rsp->datalen) {
-+		SYSWARN("Failed to send command response data %zd", ret);
-+		return -1;
-+	}
-+
-+	return 0;
-+}
-+
-+static int lxc_exec_cmd_send(const char *name, struct lxc_exec_cmd_rr *cmd,
-+			const char *lxcpath, const char *hashed_sock_name, const char *suffix)
-+{
-+	int client_fd, saved_errno;
-+	ssize_t ret = -1;
-+
-+	client_fd = lxc_cmd_connect(name, lxcpath, hashed_sock_name, suffix);
-+	if (client_fd < 0)
-+		return -1;
-+
-+	ret = lxc_abstract_unix_send_credential(client_fd, &cmd->req,
-+						sizeof(cmd->req));
-+	if (ret < 0 || (size_t)ret != sizeof(cmd->req))
-+		goto on_error;
-+
-+	if (cmd->req.datalen <= 0)
-+		return client_fd;
-+
-+	errno = EMSGSIZE;
-+	ret = lxc_send_nointr(client_fd, (void *)cmd->req.data,
-+			      cmd->req.datalen, MSG_NOSIGNAL);
-+	if (ret < 0 || ret != (ssize_t)cmd->req.datalen)
-+		goto on_error;
-+
-+	return client_fd;
-+
-+on_error:
-+	saved_errno = errno;
-+	close(client_fd);
-+	errno = saved_errno;
-+
-+	return -1;
-+}
-+
-+static int lxc_exec_cmd(const char *name, struct lxc_exec_cmd_rr *cmd, const char *lxcpath, const char *hashed_sock_name, const char *suffix)
-+{
-+	int client_fd = -1;
-+	int saved_errno;
-+	int ret = -1;
-+
-+	client_fd = lxc_exec_cmd_send(name, cmd, lxcpath, hashed_sock_name, suffix);

_service:tar_scm:0004-iSulad-adapt-confile-lxccontainer-and-start.patch Added

@@ -0,0 +1,3310 @@
+From 3e7fb35a35cff34be2bb7ace0b239d540fe0657f Mon Sep 17 00:00:00 2001
+From: zhangxiaoyu <zhangxiaoyu58@huawei.com>
+Date: Wed, 26 Jul 2023 14:57:33 +0800
+Subject: PATCH iSulad adapt confile lxccontainer and start
+
+Signed-off-by: zhangxiaoyu <zhangxiaoyu58@huawei.com>
+---
+ src/lxc/conf.c         |  11 -
+ src/lxc/conf.h         |   4 -
+ src/lxc/confile.c      | 558 +++++++++++++++++++++++++
+ src/lxc/lxccontainer.c | 899 +++++++++++++++++++++++++++++++++++++++-
+ src/lxc/lxccontainer.h | 197 +++++++++
+ src/lxc/start.c        | 902 +++++++++++++++++++++++++++++++++++++++++
+ src/lxc/start.h        |  18 +
+ 7 files changed, 2573 insertions(+), 16 deletions(-)
+
+diff --git a/src/lxc/conf.c b/src/lxc/conf.c
+index a0e0375..187e60e 100644
+--- a/src/lxc/conf.c
++++ b/src/lxc/conf.c
+@@ -5242,7 +5242,6 @@ void lxc_conf_free(struct lxc_conf *conf)
+ 	}
+ 	free(conf->systemd);
+ 	lxc_clear_init_args(conf);
+-	lxc_clear_init_groups(conf);
+ 	lxc_clear_populate_devices(conf);
+ 	lxc_clear_rootfs_masked_paths(conf);
+ 	lxc_clear_rootfs_ro_paths(conf);
+@@ -7427,16 +7426,6 @@ int lxc_clear_init_args(struct lxc_conf *lxc_conf)
+ 	return 0;
+ }
+ 
+-/*isulad clear init groups*/
+-int lxc_clear_init_groups(struct lxc_conf *lxc_conf)
+-{
+-	free(lxc_conf->init_groups);
+-	lxc_conf->init_groups = NULL;
+-	lxc_conf->init_groups_len = 0;
+-
+-	return 0;
+-}
+-
+ /*isulad: clear populate devices*/
+ int lxc_clear_populate_devices(struct lxc_conf *c)
+ {
+diff --git a/src/lxc/conf.h b/src/lxc/conf.h
+index 683b8ba..108e05b 100644
+--- a/src/lxc/conf.h
++++ b/src/lxc/conf.h
+@@ -622,9 +622,6 @@ struct lxc_conf {
+ 	char **init_argv;
+ 	size_t init_argc;
+ 
+-	gid_t *init_groups;
+-	size_t init_groups_len;
+-
+ 	/* populate devices */
+ 	struct lxc_list populate_devs;
+ 	mode_t umask;  // umask value
+@@ -794,7 +791,6 @@ __hidden extern int parse_cap(const char *cap_name, __u32 *cap);
+ #ifdef HAVE_ISULAD
+ // isulad add
+ __hidden int lxc_clear_init_args(struct lxc_conf *lxc_conf);
+-__hidden int lxc_clear_init_groups(struct lxc_conf *lxc_conf);
+ __hidden int lxc_clear_populate_devices(struct lxc_conf *c);
+ __hidden int lxc_clear_rootfs_masked_paths(struct lxc_conf *c);
+ __hidden int lxc_clear_rootfs_ro_paths(struct lxc_conf *c);
+diff --git a/src/lxc/confile.c b/src/lxc/confile.c
+index 7966d32..1492776 100644
+--- a/src/lxc/confile.c
++++ b/src/lxc/confile.c
+@@ -157,6 +157,18 @@ lxc_config_define(uts_name);
+ lxc_config_define(sysctl);
+ lxc_config_define(proc);
+ lxc_config_define(sched_core);
++#ifdef HAVE_ISULAD
++lxc_config_define(init_args);
++lxc_config_define(populate_device);
++lxc_config_define(umask);
++lxc_config_define(rootfs_masked_paths);
++lxc_config_define(rootfs_ro_paths);
++lxc_config_define(systemd);
++lxc_config_define(console_log_driver);
++lxc_config_define(console_syslog_tag);
++lxc_config_define(console_syslog_facility);
++lxc_config_define(selinux_mount_context);
++#endif
+ 
+ static int set_config_unsupported_key(const char *key, const char *value,
+ 				      struct lxc_conf *lxc_conf, void *data)
+@@ -274,6 +286,18 @@ static struct lxc_config_t config_jump_table = {
+ 	{ "lxc.uts.name",                   true,  set_config_uts_name,                   get_config_uts_name,                   clr_config_uts_name,                   },
+ 	{ "lxc.sysctl",                     false, set_config_sysctl,                     get_config_sysctl,                     clr_config_sysctl,                     },
+ 	{ "lxc.proc",                       false, set_config_proc,                       get_config_proc,                       clr_config_proc,                       },
++#ifdef HAVE_ISULAD
++	{ "lxc.isulad.init.args",          set_config_init_args,                   get_config_init_args,                   clr_config_init_args,                 },
++	{ "lxc.isulad.populate.device",    set_config_populate_device,             get_config_populate_device,             clr_config_populate_device,           },
++	{ "lxc.isulad.umask",              set_config_umask,                       get_config_umask,                       clr_config_umask,                     },
++	{ "lxc.isulad.rootfs.maskedpaths", set_config_rootfs_masked_paths,         get_config_rootfs_masked_paths,         clr_config_rootfs_masked_paths,       },
++	{ "lxc.isulad.rootfs.ropaths",     set_config_rootfs_ro_paths,             get_config_rootfs_ro_paths,             clr_config_rootfs_ro_paths,           },
++	{ "lxc.isulad.systemd",            set_config_systemd,                     get_config_systemd,                     clr_config_systemd,                   },
++	{ "lxc.console.logdriver",         set_config_console_log_driver,          get_config_console_log_driver,          clr_config_console_log_driver,        },
++	{ "lxc.console.syslog_tag",        set_config_console_syslog_tag,          get_config_console_syslog_tag,          clr_config_console_syslog_tag,        },
++	{ "lxc.console.syslog_facility",   set_config_console_syslog_facility,     get_config_console_syslog_facility,     clr_config_console_syslog_facility,   },
++	{ "lxc.selinux.mount_context",     set_config_selinux_mount_context,       get_config_selinux_mount_context,       clr_config_selinux_mount_context,     },
++#endif
+ };
+ 
+ static struct lxc_config_t unsupported_config_key = {
+@@ -1588,7 +1612,12 @@ static int set_config_environment(const char *key, const char *value,
+ 	if (!new_env)
+ 		return ret_errno(ENOMEM);
+ 
++#ifdef HAVE_ISULAD
++	/* isulad: recover space replaced by SPACE_MAGIC_STR */
++	dup = lxc_string_replace(SPACE_MAGIC_STR, " ", value);
++#else
+ 	dup = strdup(value);
++#endif
+ 	if (!dup)
+ 		return ret_errno(ENOMEM);
+ 
+@@ -2558,8 +2587,11 @@ static int set_config_console_rotate(const char *key, const char *value,
+ 	if (ret)
+ 		return ret_errno(EINVAL);
+ 
++#ifndef HAVE_ISULAD
++	/* isulad: support rotate muti-files */
+ 	if (lxc_conf->console.log_rotate > 1)
+ 		return log_error_errno(-EINVAL, EINVAL, "The \"lxc.console.rotate\" config key can only be set to 0 or 1");
++#endif
+ 
+ 	return 0;
+ }
+@@ -3049,6 +3081,54 @@ struct parse_line_conf {
+ 	bool from_include;
+ };
+ 
++#ifdef HAVE_ISULAD
++// escape_string_decode compress some escape characters
++static char *escape_string_decode(const char *src)
++{
++	size_t src_end = 0;
++	size_t dst_end = 0;
++	size_t len = 0;
++	char *dst = NULL;
++
++	if (src == NULL) {
++		return NULL;
++	}
++
++	len = strlen(src);
++	if (len == 0) {
++		return NULL;
++	}
++
++	dst = calloc(1, len + 1);
++	if (dst == NULL) {
++		ERROR("Out of memory");
++		return NULL;
++	}
++
++	while(src_end < len) {
++		if (srcsrc_end == '\\') {
++			switch (src++src_end)
++			{
++				case 'r': dstdst_end = '\r'; break;
++				case 'n': dstdst_end = '\n'; break;
++				case 'f': dstdst_end = '\f'; break;
++				case 'b': dstdst_end = '\b'; break;
++				case 't': dstdst_end = '\t'; break;
++				case '\\': dstdst_end = '\\'; break;
++				// default do not decode
++				default: dstdst_end++ = '\\'; dstdst_end = srcsrc_end; break;
++			}
++		} else {
++			dstdst_end = srcsrc_end;
++		}
++		dst_end++;
++		src_end++;
++	}
++
++	return dst;
++}
++#endif
++
+ static int parse_line(char *buffer, void *data)
+ {
+ 	__do_free char *linep = NULL;
+@@ -3058,6 +3138,9 @@ static int parse_line(char *buffer, void *data)
+ 	int ret;
+ 	char *dup = buffer;
+ 	struct parse_line_conf *plc = data;
++#ifdef HAVE_ISULAD
++	__do_free char *value_decode = NULL;
++#endif
+ 
+ 	if (!plc->conf)
+ 		return syserror_set(-EINVAL, "Missing config");

_service:tar_scm:0004-refactor-patch-code-of-lxccontianer-and-so-on.patch Deleted

@@ -1,2947 +0,0 @@
-From 281d09f2dcd4dfd105b41d8da558d4a126ca190b Mon Sep 17 00:00:00 2001
-From: WangFengTu <wangfengtu@huawei.com>
-Date: Mon, 18 Jul 2022 14:14:14 +0800
-Subject: PATCH refactor patch code of lxccontianer and so on
-
-Signed-off-by: WangFengTu <wangfengtu@huawei.com>
----
- src/lxc/af_unix.h         |   6 +
- src/lxc/cgroups/cgroup.h  |  13 +
- src/lxc/confile.c         | 639 +++++++++++++++++++++++++++
- src/lxc/lxccontainer.c    | 898 +++++++++++++++++++++++++++++++++++++-
- src/lxc/lxclock.c         |  31 ++
- src/lxc/mainloop.c        |  16 +
- src/lxc/path.c            | 655 +++++++++++++++++++++++++++
- src/lxc/storage/dir.c     |  34 ++
- src/lxc/storage/loop.c    |  48 +-
- src/lxc/storage/storage.c |  31 +-
- 10 files changed, 2367 insertions(+), 4 deletions(-)
- create mode 100644 src/lxc/path.c
-
-diff --git a/src/lxc/af_unix.h b/src/lxc/af_unix.h
-index 5a1482c..be26ff0 100644
---- a/src/lxc/af_unix.h
-+++ b/src/lxc/af_unix.h
-@@ -41,4 +41,10 @@ extern int lxc_unix_connect(struct sockaddr_un *addr);
- extern int lxc_unix_connect_type(struct sockaddr_un *addr, int type);
- extern int lxc_socket_set_timeout(int fd, int rcv_timeout, int snd_timeout);
- 
-+#ifdef HAVE_ISULAD
-+extern int lxc_abstract_unix_recv_fds_timeout(int fd, int *recvfds, int num_recvfds,
-+                                       void *data, size_t size, unsigned int timeout);
-+extern int lxc_named_unix_open(const char *path, int type, int flags);
-+extern int lxc_named_unix_connect(const char *path);
-+#endif
- #endif /* __LXC_AF_UNIX_H */
-diff --git a/src/lxc/cgroups/cgroup.h b/src/lxc/cgroups/cgroup.h
-index c5bf794..4791112 100644
---- a/src/lxc/cgroups/cgroup.h
-+++ b/src/lxc/cgroups/cgroup.h
-@@ -109,6 +109,11 @@ struct cgroup_ops {
- 	char *container_cgroup;
- 	char *monitor_cgroup;
- 
-+#ifdef HAVE_ISULAD
-+	int errfd;
-+	bool no_controller;
-+#endif
-+
- 	/* @hierarchies
- 	 * - A NULL-terminated array of struct hierarchy, one per legacy
- 	 *   hierarchy. No duplicates. First sufficient, writeable mounted
-@@ -146,14 +151,22 @@ struct cgroup_ops {
- 	 */
- 	cgroup_layout_t cgroup_layout;
- 
-+#ifdef HAVE_ISULAD
-+	int (*data_init)(struct cgroup_ops *ops, struct lxc_conf *conf);
-+	bool (*payload_destroy)(struct cgroup_ops *ops, struct lxc_handler *handler);
-+#else
- 	int (*data_init)(struct cgroup_ops *ops);
- 	void (*payload_destroy)(struct cgroup_ops *ops, struct lxc_handler *handler);
-+#endif
- 	void (*monitor_destroy)(struct cgroup_ops *ops, struct lxc_handler *handler);
- 	bool (*monitor_create)(struct cgroup_ops *ops, struct lxc_handler *handler);
- 	bool (*monitor_enter)(struct cgroup_ops *ops, struct lxc_handler *handler);
- 	bool (*payload_create)(struct cgroup_ops *ops, struct lxc_handler *handler);
- 	bool (*payload_enter)(struct cgroup_ops *ops, struct lxc_handler *handler);
- 	const char *(*get_cgroup)(struct cgroup_ops *ops, const char *controller);
-+#ifdef HAVE_ISULAD
-+	const char *(*get_cgroup_full_path)(struct cgroup_ops *ops, const char *controller);
-+#endif
- 	bool (*escape)(const struct cgroup_ops *ops, struct lxc_conf *conf);
- 	int (*num_hierarchies)(struct cgroup_ops *ops);
- 	bool (*get_hierarchies)(struct cgroup_ops *ops, int n, char ***out);
-diff --git a/src/lxc/confile.c b/src/lxc/confile.c
-index 4c27e7d..22d7255 100644
---- a/src/lxc/confile.c
-+++ b/src/lxc/confile.c
-@@ -147,6 +147,19 @@ lxc_config_define(tty_dir);
- lxc_config_define(uts_name);
- lxc_config_define(sysctl);
- lxc_config_define(proc);
-+#ifdef HAVE_ISULAD
-+lxc_config_define(init_args);
-+lxc_config_define(init_groups);
-+lxc_config_define(populate_device);
-+lxc_config_define(umask);
-+lxc_config_define(rootfs_masked_paths);
-+lxc_config_define(rootfs_ro_paths);
-+lxc_config_define(systemd);
-+lxc_config_define(console_log_driver);
-+lxc_config_define(console_syslog_tag);
-+lxc_config_define(console_syslog_facility);
-+lxc_config_define(selinux_mount_context);
-+#endif
- 
- /*
-  * Important Note:
-@@ -259,6 +272,19 @@ static struct lxc_config_t config_jump_table = {
- 	{ "lxc.uts.name",                  set_config_uts_name,                    get_config_uts_name,                    clr_config_uts_name,                  },
- 	{ "lxc.sysctl",                    set_config_sysctl,                      get_config_sysctl,                      clr_config_sysctl,                    },
- 	{ "lxc.proc",                      set_config_proc,                        get_config_proc,                        clr_config_proc,                      },
-+#ifdef HAVE_ISULAD
-+	{ "lxc.isulad.init.args",          set_config_init_args,                   get_config_init_args,                   clr_config_init_args,                 },
-+	{ "lxc.isulad.init.groups",        set_config_init_groups,                 get_config_init_groups,                 clr_config_init_groups,               },
-+	{ "lxc.isulad.populate.device",    set_config_populate_device,             get_config_populate_device,             clr_config_populate_device,           },
-+	{ "lxc.isulad.umask",              set_config_umask,                       get_config_umask,                       clr_config_umask,                     },
-+	{ "lxc.isulad.rootfs.maskedpaths", set_config_rootfs_masked_paths,         get_config_rootfs_masked_paths,         clr_config_rootfs_masked_paths,       },
-+	{ "lxc.isulad.rootfs.ropaths",     set_config_rootfs_ro_paths,             get_config_rootfs_ro_paths,             clr_config_rootfs_ro_paths,           },
-+	{ "lxc.isulad.systemd",            set_config_systemd,                     get_config_systemd,                     clr_config_systemd,                   },
-+	{ "lxc.console.logdriver",         set_config_console_log_driver,          get_config_console_log_driver,          clr_config_console_log_driver,        },
-+	{ "lxc.console.syslog_tag",        set_config_console_syslog_tag,          get_config_console_syslog_tag,          clr_config_console_syslog_tag,        },
-+	{ "lxc.console.syslog_facility",   set_config_console_syslog_facility,     get_config_console_syslog_facility,     clr_config_console_syslog_facility,   },
-+	{ "lxc.selinux.mount_context",     set_config_selinux_mount_context,       get_config_selinux_mount_context,       clr_config_selinux_mount_context,     },
-+#endif
- };
- 
- static const size_t config_jump_table_size = sizeof(config_jump_table) / sizeof(struct lxc_config_t);
-@@ -1348,6 +1374,10 @@ static int set_config_environment(const char *key, const char *value,
- {
- 	struct lxc_list *list_item = NULL;
- 
-+#ifdef HAVE_ISULAD
-+	char *replaced = NULL;
-+#endif
-+
- 	if (lxc_config_value_empty(value))
- 		return lxc_clear_environment(lxc_conf);
- 
-@@ -1368,7 +1398,16 @@ static int set_config_environment(const char *key, const char *value,
- 		env_var1 = env_val;
- 		list_item->elem = lxc_string_join("=", env_var, false);
- 	} else {
-+#ifdef HAVE_ISULAD
-+		/* isulad: recover space replaced by SPACE_MAGIC_STR */
-+		replaced = lxc_string_replace(SPACE_MAGIC_STR, " ", value);
-+		if(!replaced)
-+			goto on_error;
-+
-+		list_item->elem = replaced;
-+#else
- 		list_item->elem = strdup(value);
-+#endif
- 	}
- 
- 	if (!list_item->elem)
-@@ -2291,11 +2330,14 @@ static int set_config_console_rotate(const char *key, const char *value,
- 	if (lxc_safe_uint(value, &lxc_conf->console.log_rotate) < 0)
- 		return -1;
- 
-+#ifndef HAVE_ISULAD
-+	/* isulad: support rotate muti-files */
- 	if (lxc_conf->console.log_rotate > 1) {
- 		ERROR("The \"lxc.console.rotate\" config key can only be set "
- 		      "to 0 or 1");
- 		return -1;
- 	}
-+#endif
- 
- 	return 0;
- }
-@@ -2581,6 +2623,11 @@ static int set_config_rootfs_options(const char *key, const char *value,
- 	int ret;
- 	struct lxc_rootfs *rootfs = &lxc_conf->rootfs;
- 
-+#ifdef HAVE_ISULAD
-+	ret = parse_mntopts(value, &mflags, &pflags, &mdata);
-+	if (ret < 0)
-+		return -EINVAL;
-+#else
- 	ret = parse_mntopts(value, &mflags, &mdata);
- 	if (ret < 0)
- 		return -EINVAL;
-@@ -2590,6 +2637,7 @@ static int set_config_rootfs_options(const char *key, const char *value,
- 		free(mdata);
- 		return -EINVAL;
- 	}
-+#endif
- 
- 	ret = set_config_string_item(&opts, value);
- 	if (ret < 0) {
-@@ -2722,6 +2770,54 @@ struct parse_line_conf {
- 	bool from_include;
- };
- 
-+#ifdef HAVE_ISULAD
-+// escape_string_decode compress some escape characters
-+static char *escape_string_decode(const char *src)
-+{
-+	size_t src_end = 0;
-+	size_t dst_end = 0;
-+	size_t len = 0;
-+	char *dst = NULL;
-+
-+	if (src == NULL) {
-+		return NULL;
-+	}
-+
-+	len = strlen(src);

_service:tar_scm:0005-fix-compile-error.patch Added

@@ -0,0 +1,5774 @@
+From edc766541e03d457ce61cda5f4e8e201a6d2a738 Mon Sep 17 00:00:00 2001
+From: zhangxiaoyu <zhangxiaoyu58@huawei.com>
+Date: Tue, 1 Aug 2023 09:36:57 +0800
+Subject: PATCH fix compile error
+
+Signed-off-by: zhangxiaoyu <zhangxiaoyu58@huawei.com>
+---
+ meson.build                     |    2 +-
+ src/lxc/af_unix.c               |   66 +
+ src/lxc/af_unix.h               |    2 +
+ src/lxc/attach.c                |   27 +-
+ src/lxc/attach_options.h        |    3 +
+ src/lxc/cgroups/cgfsng.c        |    3 +
+ src/lxc/cgroups/cgroup.h        |    5 +
+ src/lxc/cgroups/isulad_cgfsng.c | 2784 ++++++++++++++++++++-----------
+ src/lxc/commands.c              |    4 +-
+ src/lxc/conf.c                  |  197 ++-
+ src/lxc/conf.h                  |    4 +
+ src/lxc/confile.c               |   35 +-
+ src/lxc/exec_commands.c         |   23 +-
+ src/lxc/exec_commands.h         |    4 +-
+ src/lxc/execute.c               |   15 +
+ src/lxc/isulad_utils.c          |    6 +-
+ src/lxc/isulad_utils.h          |    8 +-
+ src/lxc/lsm/lsm.c               |   28 +
+ src/lxc/lsm/lsm.h               |    5 +
+ src/lxc/lsm/selinux.c           |    2 +-
+ src/lxc/lxc.h                   |   11 +
+ src/lxc/lxccontainer.c          |    4 +
+ src/lxc/mainloop.c              |    2 +-
+ src/lxc/mainloop.h              |    2 +-
+ src/lxc/seccomp.c               |   52 +
+ src/lxc/start.c                 |   56 +-
+ src/lxc/sync.c                  |    6 +
+ src/lxc/sync.h                  |   13 +-
+ src/lxc/terminal.c              |  373 ++++-
+ src/lxc/tools/lxc_ls.c          |    2 +-
+ src/lxc/utils.c                 |    3 +
+ src/tests/aa.c                  |    4 +
+ src/tests/capabilities.c        |   12 +
+ src/tests/mount_injection.c     |    4 +
+ src/tests/proc_pid.c            |    4 +
+ src/tests/rootfs_options.c      |    4 +
+ src/tests/sys_mixed.c           |    4 +
+ src/tests/sysctls.c             |    4 +
+ 38 files changed, 2700 insertions(+), 1083 deletions(-)
+
+diff --git a/meson.build b/meson.build
+index fda8045..05bcbb2 100644
+--- a/meson.build
++++ b/meson.build
+@@ -231,7 +231,7 @@ possible_link_flags = 
+ 
+ 
+ if want_isulad
+-    possible_cc_flags += '-D_FORTIFY_SOURCE=2'
++    possible_cc_flags += '-D_FORTIFY_SOURCE=2', '-O2'
+     yajldep = dependency('yajl', version : '>=2')
+     srcconf.set('HAVE_ISULAD', yajldep.found())
+     liblxc_dependencies += yajldep
+diff --git a/src/lxc/af_unix.c b/src/lxc/af_unix.c
+index 6db1864..e0a4892 100644
+--- a/src/lxc/af_unix.c
++++ b/src/lxc/af_unix.c
+@@ -175,10 +175,18 @@ int __lxc_abstract_unix_send_two_fds(int fd, int fd_first, int fd_second,
+ 	return lxc_abstract_unix_send_fds(fd, fd_send, 2, data, size);
+ }
+ 
++#ifdef HAVE_ISULAD
++static ssize_t lxc_abstract_unix_recv_fds_iov(int fd,
++					      struct unix_fds *ret_fds,
++					      struct iovec *ret_iov,
++					      size_t size_ret_iov,
++						  unsigned int timeout)
++#else
+ static ssize_t lxc_abstract_unix_recv_fds_iov(int fd,
+ 					      struct unix_fds *ret_fds,
+ 					      struct iovec *ret_iov,
+ 					      size_t size_ret_iov)
++#endif
+ {
+ 	__do_free char *cmsgbuf = NULL;
+ 	ssize_t ret;
+@@ -209,6 +217,22 @@ static ssize_t lxc_abstract_unix_recv_fds_iov(int fd,
+ 	msg.msg_iov	= ret_iov;
+ 	msg.msg_iovlen	= size_ret_iov;
+ 
++#ifdef HAVE_ISULAD
++	struct timeval out;
++	if (timeout > 0) {
++		memset(&out, 0, sizeof(out));
++		out.tv_sec = timeout / 1000000;
++		out.tv_usec = timeout % 1000000;
++		ret = setsockopt(fd, SOL_SOCKET, SO_RCVTIMEO,
++		                 (const void *)&out, sizeof(out));
++		if (ret < 0) {
++			ERROR("Failed to set %u timeout on containter "
++			      "state socket", timeout);
++			return -1;
++		}
++	}
++#endif
++
+ again:
+ 	ret = recvmsg(fd, &msg, MSG_CMSG_CLOEXEC);
+ 	if (ret < 0) {
+@@ -329,7 +353,11 @@ ssize_t lxc_abstract_unix_recv_fds(int fd, struct unix_fds *ret_fds,
+ 	};
+ 	ssize_t ret;
+ 
++#ifdef HAVE_ISULAD
++	ret = lxc_abstract_unix_recv_fds_iov(fd, ret_fds, &iov, 1, 0);
++#else
+ 	ret = lxc_abstract_unix_recv_fds_iov(fd, ret_fds, &iov, 1);
++#endif
+ 	if (ret < 0)
+ 		return ret;
+ 
+@@ -351,7 +379,11 @@ ssize_t lxc_abstract_unix_recv_one_fd(int fd, int *ret_fd, void *ret_data,
+ 		.fd_count_max = 1,
+ 	};
+ 
++#ifdef HAVE_ISULAD
++	ret = lxc_abstract_unix_recv_fds_iov(fd, fds, &iov, 1, 0);
++#else
+ 	ret = lxc_abstract_unix_recv_fds_iov(fd, fds, &iov, 1);
++#endif
+ 	if (ret < 0)
+ 		return ret;
+ 
+@@ -381,7 +413,11 @@ ssize_t __lxc_abstract_unix_recv_two_fds(int fd, int *fd_first, int *fd_second,
+ 		.fd_count_max = 2,
+ 	};
+ 
++#ifdef HAVE_ISULAD
++	ret = lxc_abstract_unix_recv_fds_iov(fd, fds, &iov, 1, 0);
++#else
+ 	ret = lxc_abstract_unix_recv_fds_iov(fd, fds, &iov, 1);
++#endif
+ 	if (ret < 0)
+ 		return ret;
+ 
+@@ -551,6 +587,36 @@ int lxc_socket_set_timeout(int fd, int rcv_timeout, int snd_timeout)
+ }
+ 
+ #ifdef HAVE_ISULAD
++ssize_t lxc_abstract_unix_recv_one_fd_timeout(int fd, int *ret_fd, void *ret_data,
++				      size_t size_ret_data, unsigned int timeout)
++{
++	call_cleaner(put_unix_fds) struct unix_fds *fds = NULL;
++	char buf1 = {};
++	struct iovec iov = {
++		.iov_base	= ret_data ? ret_data : buf,
++		.iov_len	= ret_data ? size_ret_data : sizeof(buf),
++	};
++	ssize_t ret;
++
++	fds = &(struct unix_fds){
++		.fd_count_max = 1,
++	};
++
++	ret = lxc_abstract_unix_recv_fds_iov(fd, fds, &iov, 1, timeout);
++	if (ret < 0)
++		return ret;
++
++	if (ret == 0)
++		return ret_errno(ENODATA);
++
++	if (fds->fd_count_ret != fds->fd_count_max)
++		*ret_fd = -EBADF;
++	else
++		*ret_fd = move_fd(fds->fd0);
++
++	return ret;
++}
++
+ int lxc_named_unix_open(const char *path, int type, int flags)
+ {
+ 	__do_close int fd = -EBADF;
+diff --git a/src/lxc/af_unix.h b/src/lxc/af_unix.h
+index 605afc2..de5731f 100644
+--- a/src/lxc/af_unix.h
++++ b/src/lxc/af_unix.h
+@@ -169,6 +169,8 @@ static inline void put_unix_fds(struct unix_fds *fds)
+ define_cleanup_function(struct unix_fds *, put_unix_fds);
+ 
+ #ifdef HAVE_ISULAD
++__hidden extern ssize_t lxc_abstract_unix_recv_one_fd_timeout(int fd, int *ret_fd, void *ret_data,
++				     			 							  size_t size_ret_data, unsigned int timeout);
+ __hidden extern int lxc_named_unix_open(const char *path, int type, int flags);
+ __hidden extern int lxc_named_unix_connect(const char *path);
+ #endif
+diff --git a/src/lxc/attach.c b/src/lxc/attach.c
+index 1a89001..066eb5c 100644
+--- a/src/lxc/attach.c
++++ b/src/lxc/attach.c
+@@ -1203,10 +1203,10 @@ __noreturn static void do_attach(struct attach_payload *ap)
+ 	sigset_t mask;
+

_service:tar_scm:0005-refactor-patch-code-of-attach-and-seccomp.patch Deleted

@@ -1,1517 +0,0 @@
-From ad33756d6190df4f1aad9b6468b0b59086e916b5 Mon Sep 17 00:00:00 2001
-From: zhangxiaoyu <zhangxiaoyu58@huawei.com>
-Date: Tue, 19 Jul 2022 15:23:34 +0800
-Subject: PATCH refactor patch code of attach and seccomp
-
-Signed-off-by: zhangxiaoyu <zhangxiaoyu58@huawei.com>
----
- src/lxc/attach.c      | 517 +++++++++++++++++++++++++++++++++++++++
- src/lxc/lsm/nop.c     |  14 ++
- src/lxc/seccomp.c     | 555 ++++++++++++++++++++++++++++++++++++++++++
- src/lxc/storage/zfs.c |   9 +
- 4 files changed, 1095 insertions(+)
-
-diff --git a/src/lxc/attach.c b/src/lxc/attach.c
-index 38e16f2..8a2c52a 100644
---- a/src/lxc/attach.c
-+++ b/src/lxc/attach.c
-@@ -49,6 +49,25 @@
- #include <sys/personality.h>
- #endif
- 
-+#ifdef HAVE_ISULAD
-+#include "exec_commands.h"
-+
-+typedef enum {
-+	ATTACH_INIT,
-+	ATTACH_TIMEOUT,
-+	ATTACH_MAX,
-+} attach_timeout_t;
-+
-+static volatile attach_timeout_t g_attach_timeout_state = ATTACH_INIT;
-+
-+struct attach_timeout_conf {
-+	int64_t timeout;
-+	unsigned long long start_time;
-+	pid_t pid;
-+};
-+
-+#endif
-+
- lxc_log_define(attach, lxc);
- 
- /* Define default options if no options are supplied by the user. */
-@@ -630,6 +649,9 @@ struct attach_clone_payload {
- 	struct lxc_proc_context_info *init_ctx;
- 	lxc_attach_exec_t exec_function;
- 	void *exec_payload;
-+#ifdef HAVE_ISULAD
-+	struct lxc_terminal *terminal;
-+#endif
- };
- 
- static void lxc_put_attach_clone_payload(struct attach_clone_payload *p)
-@@ -642,6 +664,48 @@ static void lxc_put_attach_clone_payload(struct attach_clone_payload *p)
- 	}
- }
- 
-+#ifdef HAVE_ISULAD
-+static int isulad_set_attach_pipes(struct lxc_terminal *terminal)
-+{
-+	int ret = 0;
-+	if (terminal->pipes01 >= 0) {
-+		close(terminal->pipes01);
-+		terminal->pipes01 = -1;
-+	}
-+
-+	if (terminal->pipes00 >= 0) {
-+		ret = dup2(terminal->pipes00, STDIN_FILENO);
-+		if (ret < 0)
-+			goto out;
-+	}
-+
-+	if (terminal->pipes10 >= 0) {
-+		close(terminal->pipes10);
-+		terminal->pipes10 = -1;
-+	}
-+
-+	if (terminal->pipes11 >= 0) {
-+		ret = dup2(terminal->pipes11, STDOUT_FILENO);
-+		if (ret < 0)
-+			goto out;
-+	}
-+	if (terminal->pipes20 >= 0) {
-+		close(terminal->pipes20);
-+		terminal->pipes20 = -1;
-+	}
-+
-+	if (terminal->pipes21 >= 0) {
-+		ret = dup2(terminal->pipes21, STDERR_FILENO);
-+		if (ret < 0)
-+			goto out;
-+	}
-+
-+	setsid();
-+out:
-+	return ret;
-+}
-+#endif
-+
- static int attach_child_main(struct attach_clone_payload *payload)
- {
- 	int lsm_fd, ret;
-@@ -654,6 +718,31 @@ static int attach_child_main(struct attach_clone_payload *payload)
- 	bool needs_lsm = (options->namespaces & CLONE_NEWNS) &&
- 			 (options->attach_flags & LXC_ATTACH_LSM) &&
- 			 init_ctx->lsm_label;
-+#ifdef HAVE_ISULAD
-+	int msg_fd = -1;
-+	sigset_t mask;
-+
-+	/*isulad: record errpipe fd*/
-+	msg_fd = init_ctx->container->lxc_conf->errpipe1;
-+	init_ctx->container->lxc_conf->errpipe1 = -1;
-+	/*isulad: set system umask */
-+	umask(init_ctx->container->lxc_conf->umask);
-+
-+	/*isulad: restore default signal handlers and unblock all signals*/
-+	for (int i = 1; i < NSIG; i++)
-+		signal(i, SIG_DFL);
-+
-+	ret = sigfillset(&mask);
-+	if (ret < 0) {
-+		SYSERROR("Failed to fill signal mask");
-+		goto on_error;;
-+	}
-+	ret = sigprocmask(SIG_UNBLOCK, &mask, NULL);
-+	if (ret < 0) {
-+		SYSERROR("Failed to set signal mask");
-+		goto on_error;
-+	}
-+#endif
- 
- 	/* A description of the purpose of this functionality is provided in the
- 	 * lxc-attach(1) manual page. We have to remount here and not in the
-@@ -695,6 +784,28 @@ static int attach_child_main(struct attach_clone_payload *payload)
- 		TRACE("Dropped capabilities");
- 	}
- 
-+#ifdef HAVE_ISULAD
-+	/* isulad: set workdir */
-+	if (options->initial_cwd || init_ctx->container->lxc_conf->init_cwd) {
-+		char *init_cwd;
-+		init_cwd = options->initial_cwd ? options->initial_cwd : init_ctx->container->lxc_conf->init_cwd;
-+		/* try to create workdir if not exist */
-+		struct stat st;
-+		if (stat(init_cwd, &st) < 0 && mkdir_p(init_cwd, 0750) < 0) {
-+			SYSERROR("Try to create directory \"%s\" as workdir failed when attach", init_cwd);
-+			lxc_write_error_message(msg_fd, "Try to create directory \"%s\" as workdir failed when attach: %s",
-+						init_cwd, strerror(errno));
-+			goto on_error;
-+		}
-+		if (chdir(init_cwd)) {
-+			SYSERROR("Could not change directory to \"%s\" when attach", init_cwd);
-+			lxc_write_error_message(msg_fd, "Could not change directory to \"%s\" when attach: %s",
-+						init_cwd, strerror(errno));
-+			goto on_error;
-+		}
-+	}
-+#endif
-+
- 	/* Always set the environment (specify (LXC_ATTACH_KEEP_ENV, NULL, NULL)
- 	 * if you want this to be a no-op).
- 	 */
-@@ -736,8 +847,10 @@ static int attach_child_main(struct attach_clone_payload *payload)
- 			goto on_error;
- 	}
- 
-+#ifndef HAVE_ISULAD
- 	if (!lxc_setgroups(0, NULL) && errno != EPERM)
- 		goto on_error;
-+#endif
- 
- 	if (options->namespaces & CLONE_NEWUSER) {
- 		/* Check whether nsuid 0 has a mapping. */
-@@ -770,6 +883,13 @@ static int attach_child_main(struct attach_clone_payload *payload)
- 	else
- 		new_gid = ns_root_gid;
- 
-+#ifdef HAVE_ISULAD
-+	// isulad: set env home in container
-+	if (lxc_setup_env_home(new_uid) < 0) {
-+		goto on_error;
-+	}
-+#endif
-+
- 	if ((init_ctx->container && init_ctx->container->lxc_conf &&
- 	     init_ctx->container->lxc_conf->no_new_privs) ||
- 	    (options->attach_flags & LXC_ATTACH_NO_NEW_PRIVS)) {
-@@ -810,10 +930,12 @@ static int attach_child_main(struct attach_clone_payload *payload)
- 			goto on_error;
- 	}
- 
-+#ifndef HAVE_ISULAD
- 	close(payload->ipc_socket);
- 	payload->ipc_socket = -EBADF;
- 	lxc_proc_put_context_info(init_ctx);
- 	payload->init_ctx = NULL;
-+#endif
-

_service:tar_scm:0006-fix-run-container-failed-by-isulad.patch Deleted

@@ -1,86 +0,0 @@
-From e7fc0b635c8f964bd139aae47d9debb77c39cc3f Mon Sep 17 00:00:00 2001
-From: zhangxiaoyu <zhangxiaoyu58@huawei.com>
-Date: Tue, 1 Aug 2023 14:59:16 +0800
-Subject: PATCH fix run container failed by isulad
-
-Signed-off-by: zhangxiaoyu <zhangxiaoyu58@huawei.com>
----
- src/lxc/confile.c | 34 ++++++++++++++++++++++------------
- 1 file changed, 22 insertions(+), 12 deletions(-)
-
-diff --git a/src/lxc/confile.c b/src/lxc/confile.c
-index 0d0d66c..ae1a264 100644
---- a/src/lxc/confile.c
-+++ b/src/lxc/confile.c
-@@ -287,16 +287,18 @@ static struct lxc_config_t config_jump_table = {
- 	{ "lxc.sysctl",                     false, set_config_sysctl,                     get_config_sysctl,                     clr_config_sysctl,                     },
- 	{ "lxc.proc",                       false, set_config_proc,                       get_config_proc,                       clr_config_proc,                       },
- #ifdef HAVE_ISULAD
--	{ "lxc.isulad.init.args",          	true,	set_config_init_args,                   get_config_init_args,                   clr_config_init_args,                 },
--	{ "lxc.isulad.populate.device",    	true,	set_config_populate_device,             get_config_populate_device,             clr_config_populate_device,           },
--	{ "lxc.isulad.umask",              	true,	set_config_umask,                       get_config_umask,                       clr_config_umask,                     },
--	{ "lxc.isulad.rootfs.maskedpaths", 	true,	set_config_rootfs_masked_paths,         get_config_rootfs_masked_paths,         clr_config_rootfs_masked_paths,       },
--	{ "lxc.isulad.rootfs.ropaths",     	true,	set_config_rootfs_ro_paths,             get_config_rootfs_ro_paths,             clr_config_rootfs_ro_paths,           },
--	{ "lxc.isulad.systemd",            	true,	set_config_systemd,                     get_config_systemd,                     clr_config_systemd,                   },
--	{ "lxc.console.logdriver",         	true,	set_config_console_log_driver,          get_config_console_log_driver,          clr_config_console_log_driver,        },
--	{ "lxc.console.syslog_tag",        	true,	set_config_console_syslog_tag,          get_config_console_syslog_tag,          clr_config_console_syslog_tag,        },
--	{ "lxc.console.syslog_facility",   	true,	set_config_console_syslog_facility,     get_config_console_syslog_facility,     clr_config_console_syslog_facility,   },
--	{ "lxc.selinux.mount_context",     	true,	set_config_selinux_mount_context,       get_config_selinux_mount_context,       clr_config_selinux_mount_context,     },
-+	{ "lxc.isulad.init.args",          	true,	set_config_init_args,                   get_config_init_args,                   clr_config_init_args,       		},
-+	{ "lxc.isulad.populate.device",    	true,	set_config_populate_device,             get_config_populate_device,             clr_config_populate_device,  		},
-+	{ "lxc.isulad.umask",              	true,	set_config_umask,                       get_config_umask,                       clr_config_umask,           		},
-+	{ "lxc.isulad.rootfs.maskedpaths", 	true,	set_config_rootfs_masked_paths,         get_config_rootfs_masked_paths,         clr_config_rootfs_masked_paths, 	},
-+	{ "lxc.isulad.rootfs.ropaths",     	true,	set_config_rootfs_ro_paths,             get_config_rootfs_ro_paths,             clr_config_rootfs_ro_paths,   		},
-+	{ "lxc.isulad.systemd",            	true,	set_config_systemd,                     get_config_systemd,                     clr_config_systemd,           		},
-+	{ "lxc.console.logdriver",         	true,	set_config_console_log_driver,          get_config_console_log_driver,          clr_config_console_log_driver, 		},
-+	{ "lxc.console.syslog_tag",        	true,	set_config_console_syslog_tag,          get_config_console_syslog_tag,          clr_config_console_syslog_tag,   	},
-+	{ "lxc.console.syslog_facility",   	true,	set_config_console_syslog_facility,     get_config_console_syslog_facility,     clr_config_console_syslog_facility,	},
-+	{ "lxc.selinux.mount_context",     	true,	set_config_selinux_mount_context,       get_config_selinux_mount_context,       clr_config_selinux_mount_context,	},
-+	// same to lxc.init.groups
-+	{ "lxc.isulad.init.groups",         true,  	set_config_init_groups,          		get_config_init_groups,          		clr_config_init_groups,      		},
- #endif
- };
- 
-@@ -1343,7 +1345,11 @@ static int set_config_init_groups(const char *key, const char *value,
- 	if (!value_dup)
- 		return -ENOMEM;
- 
-+#ifdef HAVE_ISULAD
-+	lxc_iterate_parts(token, value_dup, " \t")
-+#else
- 	lxc_iterate_parts(token, value_dup, ",")
-+#endif
- 		num_groups++;
- 
- 	if (num_groups == INT_MAX)
-@@ -1368,7 +1374,11 @@ static int set_config_init_groups(const char *key, const char *value,
- 	/* Restore duplicated value so we can call lxc_iterate_parts() again. */
- 	strcpy(value_dup, value);
- 
-+#ifdef HAVE_ISULAD
-+	lxc_iterate_parts(token, value_dup, " \t") {
-+#else
- 	lxc_iterate_parts(token, value_dup, ",") {
-+#endif
- 		int ret;
- 
- 		gid_t group;
-@@ -2000,13 +2010,13 @@ static int set_config_cgroup_dir(const char *key, const char *value,
- 
- 	if (lxc_config_value_empty(value))
- 		return clr_config_cgroup_dir(key, lxc_conf, NULL);
--
-+#ifndef HAVE_ISULAD
- 	if (abspath(value))
- 		return syserror_set(-EINVAL, "%s paths may not be absolute", key);
- 
- 	if (dotdot(value))
- 		return syserror_set(-EINVAL, "%s paths may not walk upwards via \"../\"", key);
--
-+#endif
- 	return set_config_path_item(&lxc_conf->cgroup_meta.dir, value);
- }
- 
--- 
-2.25.1
-

_service:tar_scm:0006-refactor-patch-about-namespace-log-terminal.patch Deleted

@@ -1,1164 +0,0 @@
-From 2b4dbd3fc30be08459b8ab34f84935e37ceb34ec Mon Sep 17 00:00:00 2001
-From: "Neil.wrz" <wangrunze13@huawei.com>
-Date: Tue, 19 Jul 2022 04:02:57 -0700
-Subject: PATCH refactor patch about namespace log terminal
-
-Signed-off-by: Neil.wrz <wangrunze13@huawei.com>
----
- configure.ac                    | 30 ++++++++++-
- src/lxc/Makefile.am             | 44 ++++++++++++++-
- src/lxc/af_unix.c               | 89 ++++++++++++++++++++++++++++++
- src/lxc/commands_utils.c        | 57 ++++++++++++++++++++
- src/lxc/exec_commands.h         | 77 ++++++++++++++++++++++++++
- src/lxc/file_utils.h            |  4 ++
- src/lxc/json/read-file.c        | 95 +++++++++++++++++++++++++++++++++
- src/lxc/log.c                   | 56 +++++++++++++++++++
- src/lxc/path.h                  | 65 ++++++++++++++++++++++
- src/lxc/start.h                 | 30 +++++++++++
- src/lxc/storage/block.c         | 86 +++++++++++++++++++++++++++++
- src/lxc/storage/block.h         | 41 ++++++++++++++
- src/lxc/storage/storage_utils.c | 60 +++++++++++++++++++++
- src/lxc/terminal.h              | 35 ++++++++++++
- 14 files changed, 766 insertions(+), 3 deletions(-)
- create mode 100644 src/lxc/exec_commands.h
- create mode 100644 src/lxc/json/read-file.c
- create mode 100644 src/lxc/path.h
- create mode 100644 src/lxc/storage/block.c
- create mode 100644 src/lxc/storage/block.h
-
-diff --git a/configure.ac b/configure.ac
-index 059d57d..ce8854e 100644
---- a/configure.ac
-+++ b/configure.ac
-@@ -43,6 +43,7 @@ AM_INIT_AUTOMAKE(-Wall -Werror -Wno-portability subdir-objects)
- AC_CANONICAL_HOST
- AM_PROG_CC_C_O
- AC_USE_SYSTEM_EXTENSIONS
-+CFLAGS=`echo "${CFLAGS#\-g}"`
- 
- # Test if we have a new enough compiler.
- AC_COMPILE_IFELSE(AC_LANG_PROGRAM(
-@@ -119,6 +120,9 @@ AM_CONDITIONAL(DISTRO_UBUNTU, test "x$with_distro" = "xubuntu")
- 
- AC_CONFIG_LINKS(config/etc/default.conf:config/etc/${distroconf})
- 
-+# Check yajl
-+PKG_CHECK_MODULES(YAJL, yajl >= 2,,AC_MSG_ERROR(You must install yajl >= 2))
-+
- # Check for init system type
- AC_MSG_CHECKING(for init system type)
- AC_ARG_WITH(init-script,
-@@ -187,6 +191,11 @@ AC_ARG_ENABLE(werror,
- 	AS_HELP_STRING(--disable-werror, do not treat warnings as errors),
- 	enable_werror=$enableval, enable_werror=yes)
- 
-+AC_ARG_ENABLE(debug,
-+	AC_HELP_STRING(--enable-debug,
-+	set -g into cflags default=no),
-+	, enable_debug=no)
-+
- # Allow disabling rpath
- AC_ARG_ENABLE(rpath,
- 	AS_HELP_STRING(--enable-rpath, set rpath in executables default=no),
-@@ -756,6 +765,7 @@ AX_CHECK_COMPILE_FLAG(-Wnested-externs, CFLAGS="$CFLAGS -Wnested-externs",,
- AX_CHECK_COMPILE_FLAG(-fasynchronous-unwind-tables, CFLAGS="$CFLAGS -fasynchronous-unwind-tables",,-Werror)
- AX_CHECK_COMPILE_FLAG(-pipe, CFLAGS="$CFLAGS -pipe",,-Werror)
- AX_CHECK_COMPILE_FLAG(-fexceptions, CFLAGS="$CFLAGS -fexceptions",,-Werror)
-+AX_CHECK_COMPILE_FLAG(-g, CFLAGS="$CFLAGS -g",,-Werror)
- AX_CHECK_COMPILE_FLAG(-Warray-bounds, CFLAGS="$CFLAGS -Warray-bounds",,-Werror)
- AX_CHECK_COMPILE_FLAG(-Wrestrict, CFLAGS="$CFLAGS -Wrestrict",,-Werror)
- AX_CHECK_COMPILE_FLAG(-Wreturn-local-addr, CFLAGS="$CFLAGS -Wreturn-local-addr",,-Werror)
-@@ -763,12 +773,18 @@ AX_CHECK_COMPILE_FLAG(-Wstringop-overflow, CFLAGS="$CFLAGS -Wstringop-overflo
- 
- AX_CHECK_LINK_FLAG(-z relro, LDFLAGS="$LDFLAGS -z relro",,)
- AX_CHECK_LINK_FLAG(-z now, LDFLAGS="$LDFLAGS -z now",,)
-+AX_CHECK_LINK_FLAG(-z noexecstack, LDFLAGS="$LDFLAGS -z noexecstack",,)
- 
--CFLAGS="$CFLAGS -Wvla -std=gnu11 -fms-extensions"
-+CFLAGS="$CFLAGS -Wvla -std=gnu11 -D_FORTIFY_SOURCE=2 -Wall -fPIC -fPIE"
-+LDFLAGS="$LDFLAGS -pie"
- if test "x$enable_werror" = "xyes"; then
- 	CFLAGS="$CFLAGS -Werror"
- fi
- 
-+if test "x$enable_debug" = "xyes"; then
-+    CFLAGS="$CFLAGS -g"
-+fi
-+
- AC_ARG_ENABLE(thread-safety,
- 	AS_HELP_STRING(--enable-thread-safety, enforce thread-safety otherwise fail the build default=yes),
- 	enable_thread_safety=$enableval, enable_thread_safety=yes)
-@@ -815,6 +831,18 @@ else
- 	AC_MSG_RESULT(no)
- fi
- 
-+AC_MSG_CHECKING(Whether adapt to iSulad)
-+AC_ARG_ENABLE(isulad,
-+	AC_HELP_STRING(--enable-isulad, enable adapt to iSulad default=yes),
-+	adapt_isulad=$enableval, adapt_isulad=yes)
-+AM_CONDITIONAL(HAVE_ISULAD, test "x$adapt_isulad" = "xyes")
-+if test "x$adapt_isulad" = "xyes"; then
-+	AC_DEFINE(HAVE_ISULAD, 1, adapt to iSulad)
-+	AC_MSG_RESULT(yes)
-+else
-+	AC_MSG_RESULT(no)
-+fi
-+
- # Files requiring some variable expansion
- AC_CONFIG_FILES(
- 	Makefile
-diff --git a/src/lxc/Makefile.am b/src/lxc/Makefile.am
-index d1e2364..b9a8750 100644
---- a/src/lxc/Makefile.am
-+++ b/src/lxc/Makefile.am
-@@ -52,6 +52,16 @@ noinst_HEADERS = api_extensions.h \
- 		 utils.h \
- 		 uuid.h
- 
-+if HAVE_ISULAD
-+noinst_HEADERS += isulad_utils.h path.h \
-+				  json/json_common.h json/defs.h \
-+				  json/oci_runtime_hooks.h \
-+				  json/logger_json_file.h \
-+				  json/oci_runtime_spec.h \
-+				  json/read-file.h \
-+				  exec_commands.h
-+endif
-+
- if IS_BIONIC
- noinst_HEADERS += ../include/fexecve.h \
- 		  ../include/lxcmntent.h \
-@@ -97,7 +107,6 @@ liblxc_la_SOURCES = af_unix.c af_unix.h \
- 		    api_extensions.h \
- 		    attach.c attach.h \
- 		    caps.c caps.h \
--		    cgroups/cgfsng.c \
- 		    cgroups/cgroup.c cgroups/cgroup.h \
- 		    cgroups/cgroup2_devices.c cgroups/cgroup2_devices.h \
- 		    cgroups/cgroup_utils.c cgroups/cgroup_utils.h \
-@@ -154,6 +163,22 @@ liblxc_la_SOURCES = af_unix.c af_unix.h \
- 		    version.h \
- 		    $(LSM_SOURCES)
- 
-+if HAVE_ISULAD
-+liblxc_la_SOURCES += isulad_utils.c isulad_utils.h \
-+			storage/block.c storage/block.h \
-+			path.c path.h \
-+			json/json_common.c json/json_common.h \
-+			json/defs.h json/defs.c \
-+			json/oci_runtime_hooks.c json/oci_runtime_hooks.h \
-+			json/logger_json_file.c json/logger_json_file.h \
-+			json/oci_runtime_spec.c json/oci_runtime_spec.h \
-+			json/read-file.c json/read-file.h \
-+			cgroups/isulad_cgfsng.c \
-+			exec_commands.c exec_commands.h
-+else
-+liblxc_la_SOURCES += cgroups/cgfsng.c
-+endif
-+
- if IS_BIONIC
- liblxc_la_SOURCES += ../include/fexecve.c ../include/fexecve.h \
- 		     ../include/lxcmntent.c ../include/lxcmntent.h \
-@@ -212,6 +237,10 @@ AM_CFLAGS = -DLXCROOTFSMOUNT=\"$(LXCROOTFSMOUNT)\" \
- 	    -I $(top_srcdir)/src/lxc/storage \
- 	    -I $(top_srcdir)/src/lxc/cgroups
- 
-+if HAVE_ISULAD
-+AM_CFLAGS += -I $(top_srcdir)/src/lxc/json
-+AM_CFLAGS += -DHAVE_ISULAD
-+endif
- if ENABLE_APPARMOR
- AM_CFLAGS += -DHAVE_APPARMOR
- endif
-@@ -249,6 +278,10 @@ liblxc_la_CFLAGS += -fsanitize=address \
- 		    -fno-omit-frame-pointer
- endif
- 
-+if HAVE_ISULAD
-+liblxc_la_CFLAGS += -D_FORTIFY_SOURCE=2 -Wall
-+endif
-+
- if ENABLE_UBSAN
- liblxc_la_CFLAGS += -fsanitize=undefined
- endif
-@@ -258,6 +291,12 @@ liblxc_la_LDFLAGS = -pthread \
- 		    -Wl,-soname,liblxc.so.$(firstword $(subst ., ,@LXC_ABI@)) \
- 		    -version-info @LXC_ABI_MAJOR@
- 
-+if HAVE_ISULAD
-+liblxc_la_LDFLAGS += @YAJL_LIBS@ -Wl,-z,relro \
-+		    -Wl,-z,now \
-+		    -Wl,-z,noexecstack
-+endif
-+
- liblxc_la_LIBADD = $(CAP_LIBS) \
- 		   $(OPENSSL_LIBS) \
- 		   $(SELINUX_LIBS) \
-@@ -321,7 +360,8 @@ LDADD = liblxc.la \
- 	@OPENSSL_LIBS@ \
- 	@SECCOMP_LIBS@ \

_service:tar_scm:0006-remove-isulad_cgfsng.patch Added

@@ -0,0 +1,4157 @@
+From 8db83e2f87cc5377b7a0d3a895d05df37c4abba1 Mon Sep 17 00:00:00 2001
+From: zhangxiaoyu <zhangxiaoyu58@huawei.com>
+Date: Wed, 18 Oct 2023 11:01:26 +0800
+Subject: PATCH 1/2 remove isulad_cgfsng
+
+Signed-off-by: zhangxiaoyu <zhangxiaoyu58@huawei.com>
+---
+ src/lxc/cgroups/isulad_cgfsng.c | 4137 -------------------------------
+ 1 file changed, 4137 deletions(-)
+ delete mode 100644 src/lxc/cgroups/isulad_cgfsng.c
+
+diff --git a/src/lxc/cgroups/isulad_cgfsng.c b/src/lxc/cgroups/isulad_cgfsng.c
+deleted file mode 100644
+index 1160af5..0000000
+--- a/src/lxc/cgroups/isulad_cgfsng.c
++++ /dev/null
+@@ -1,4137 +0,0 @@
+-/******************************************************************************
+- * Copyright (c) Huawei Technologies Co., Ltd. 2019. All rights reserved.
+- * Author: lifeng
+- * Create: 2020-11-02
+- * Description: provide container definition
+- * lxc: linux Container library
+- * This library is free software; you can redistribute it and/or
+- * modify it under the terms of the GNU Lesser General Public
+- * License as published by the Free Software Foundation; either
+- * version 2.1 of the License, or (at your option) any later version.
+- *
+- * This library is distributed in the hope that it will be useful,
+- * but WITHOUT ANY WARRANTY; without even the implied warranty of
+- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+- * Lesser General Public License for more details.
+- *
+- * You should have received a copy of the GNU Lesser General Public
+- * License along with this library; if not, write to the Free Software
+- * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
+-  ******************************************************************************/
+-
+-#ifndef _GNU_SOURCE
+-#define _GNU_SOURCE 1
+-#endif
+-#include <ctype.h>
+-#include <dirent.h>
+-#include <errno.h>
+-#include <grp.h>
+-#include <linux/kdev_t.h>
+-#include <linux/types.h>
+-#include <poll.h>
+-#include <signal.h>
+-#include <stdint.h>
+-#include <stdio.h>
+-#include <stdlib.h>
+-#include <string.h>
+-#include <sys/epoll.h>
+-#include <sys/types.h>
+-#include <unistd.h>
+-
+-#include "af_unix.h"
+-#include "caps.h"
+-#include "cgroup.h"
+-#include "cgroup2_devices.h"
+-#include "cgroup_utils.h"
+-#include "commands.h"
+-#include "commands_utils.h"
+-#include "conf.h"
+-#include "config.h"
+-#include "log.h"
+-#include "macro.h"
+-#include "mainloop.h"
+-#include "memory_utils.h"
+-#include "open_utils.h"
+-#include "storage/storage.h"
+-#include "utils.h"
+-
+-#if !HAVE_STRLCPY
+-#include "include/strlcpy.h"
+-#endif
+-
+-#if !HAVE_STRLCAT
+-#include "include/strlcat.h"
+-#endif
+-
+-#if HAVE_LIBSYSTEMD
+-#include <systemd/sd-bus.h>
+-#include <systemd/sd-event.h>
+-#endif
+-
+-lxc_log_define(isulad_cgfsng, cgroup);
+-
+-/*
+- * Given a pointer to a null-terminated array of pointers, realloc to add one
+- * entry, and point the new entry to NULL. Do not fail. Return the index to the
+- * second-to-last entry - that is, the one which is now available for use
+- * (keeping the list null-terminated).
+- */
+-static int cg_list_add(void ***list)
+-{
+-	int idx = 0;
+-	void **p;
+-
+-	if (*list)
+-		for (; (*list)idx; idx++)
+-			;
+-
+-	p = realloc(*list, (idx + 2) * sizeof(void **));
+-	if (!p)
+-		return ret_errno(ENOMEM);
+-
+-	pidx + 1 = NULL;
+-	*list = p;
+-
+-	return idx;
+-}
+-
+-/* Given a null-terminated array of strings, check whether @entry is one of the
+- * strings.
+- */
+-static bool string_in_list(char **list, const char *entry)
+-{
+-	if (!list)
+-		return false;
+-
+-	for (int i = 0; listi; i++)
+-		if (strcmp(listi, entry) == 0)
+-			return true;
+-
+-	return false;
+-}
+-
+-/* Given a handler's cgroup data, return the struct hierarchy for the controller
+- * @c, or NULL if there is none.
+- */
+-static struct hierarchy *get_hierarchy(const struct cgroup_ops *ops, const char *controller)
+-{
+-	if (!ops->hierarchies)
+-		return log_trace_errno(NULL, errno, "There are no useable cgroup controllers");
+-
+-	for (int i = 0; ops->hierarchiesi; i++) {
+-		if (!controller) {
+-			/* This is the empty unified hierarchy. */
+-			if (ops->hierarchiesi->controllers && !ops->hierarchiesi->controllers0)
+-				return ops->hierarchiesi;
+-
+-			continue;
+-		}
+-
+-		/*
+-		 * Handle controllers with significant implementation changes
+-		 * from cgroup to cgroup2.
+-		 */
+-		if (pure_unified_layout(ops)) {
+-			if (strequal(controller, "devices")) {
+-				if (device_utility_controller(ops->unified))
+-					return ops->unified;
+-
+-				break;
+-			} else if (strequal(controller, "freezer")) {
+-				if (freezer_utility_controller(ops->unified))
+-					return ops->unified;
+-
+-				break;
+-			}
+-		}
+-
+-		if (string_in_list(ops->hierarchiesi->controllers, controller))
+-			return ops->hierarchiesi;
+-	}
+-
+-	if (controller)
+-		WARN("There is no useable %s controller", controller);
+-	else
+-		WARN("There is no empty unified cgroup hierarchy");
+-
+-	return ret_set_errno(NULL, ENOENT);
+-}
+-
+-int prepare_cgroup_fd(const struct cgroup_ops *ops, struct cgroup_fd *fd, bool limit)
+-{
+-	int dfd;
+-	const struct hierarchy *h;
+-
+-	h = get_hierarchy(ops, fd->controller);
+-	if (!h)
+-		return ret_errno(ENOENT);
+-
+-	/*
+-	 * The client requested that the controller must be in a specific
+-	 * cgroup version.
+-	 */
+-	if (fd->type != 0 && (cgroupfs_type_magic_t)fd->type != h->fs_type)
+-		return ret_errno(EINVAL);
+-
+-	if (limit)
+-		dfd = h->dfd_con;
+-	else
+-		dfd = h->dfd_lim;
+-	if (dfd < 0)
+-		return ret_errno(EBADF);
+-

_service:tar_scm:0007-fix-run-container-failed-when-enable-isulad.patch Added

@@ -0,0 +1,1060 @@
+From d743d299c37b71d0990d0a68ad492a0ec76a7886 Mon Sep 17 00:00:00 2001
+From: zhangxiaoyu <zhangxiaoyu58@huawei.com>
+Date: Wed, 18 Oct 2023 11:01:49 +0800
+Subject: PATCH fix run container failed when enable isulad
+
+Signed-off-by: zhangxiaoyu <zhangxiaoyu58@huawei.com>
+---
+ src/lxc/attach.c         |  11 +-
+ src/lxc/cgroups/cgfsng.c | 581 +++++++++++++++++++++++++++++++++++++++
+ src/lxc/cgroups/cgroup.h |   4 +
+ src/lxc/conf.c           |  17 +-
+ src/lxc/confile.c        |  34 ++-
+ src/lxc/meson.build      |   4 +-
+ src/lxc/start.c          |  11 +-
+ 7 files changed, 628 insertions(+), 34 deletions(-)
+
+diff --git a/src/lxc/attach.c b/src/lxc/attach.c
+index 066eb5c..ae12da3 100644
+--- a/src/lxc/attach.c
++++ b/src/lxc/attach.c
+@@ -1454,18 +1454,17 @@ __noreturn static void do_attach(struct attach_payload *ap)
+ 				goto on_error;
+ 			}
+ 		} else {
+-#else
+-		ret = lxc_terminal_prepare_login(ap->terminal_pts_fd);
+-#endif
+-#ifdef HAVE_ISULAD
+-		}
+ #endif
++		ret = lxc_terminal_prepare_login(ap->terminal_pts_fd);
+ 		if (ret < 0) {
+ 			SYSERROR("Failed to prepare terminal file descriptor %d", ap->terminal_pts_fd);
+ 			goto on_error;
+ 		}
+ 
+ 		TRACE("Prepared terminal file descriptor %d", ap->terminal_pts_fd);
++#ifdef HAVE_ISULAD
++		}
++#endif
+ 	}
+ 
+ 	/* Avoid unnecessary syscalls. */
+@@ -2264,7 +2263,7 @@ int lxc_attach(struct lxc_container *container, lxc_attach_exec_t exec_function,
+ 
+ 	if (options->attach_flags & LXC_ATTACH_TERMINAL) {
+ #ifdef HAVE_ISULAD
+-			ret = isulad_safe_mainloop(&descr, -1);
++		ret = isulad_safe_mainloop(&descr, -1);
+ #else
+ 		ret = lxc_mainloop(&descr, -1);
+ #endif
+diff --git a/src/lxc/cgroups/cgfsng.c b/src/lxc/cgroups/cgfsng.c
+index 4e4ae0c..0aaafa8 100644
+--- a/src/lxc/cgroups/cgfsng.c
++++ b/src/lxc/cgroups/cgfsng.c
+@@ -528,32 +528,64 @@ static int cgroup_tree_remove_wrapper(void *data)
+ 	return cgroup_tree_remove(arg->hierarchies, arg->path_prune);
+ }
+ 
++#ifdef HAVE_ISULAD
++__cgfsng_ops static bool cgfsng_payload_destroy(struct cgroup_ops *ops,
++						struct lxc_handler *handler)
++#else
+ __cgfsng_ops static void cgfsng_payload_destroy(struct cgroup_ops *ops,
+ 						struct lxc_handler *handler)
++#endif
+ {
+ 	int ret;
+ 
+ 	if (!ops) {
+ 		ERROR("Called with uninitialized cgroup operations");
++#ifdef HAVE_ISULAD
++		return false;
++#else
+ 		return;
++#endif
++	}
++
++#ifdef HAVE_ISULAD
++	if (ops->no_controller) {
++		DEBUG("no controller found, ignore isulad_cgfsng_payload_destroy");
++		return true;
+ 	}
++#endif
+ 
+ 	if (!ops->hierarchies)
++#ifdef HAVE_ISULAD
++		return true;
++#else
+ 		return;
++#endif
+ 
+ 	if (!handler) {
+ 		ERROR("Called with uninitialized handler");
++#ifdef HAVE_ISULAD
++		return false;
++#else
+ 		return;
++#endif
+ 	}
+ 
+ 	if (!handler->conf) {
+ 		ERROR("Called with uninitialized conf");
++#ifdef HAVE_ISULAD
++		return false;
++#else
+ 		return;
++#endif
+ 	}
+ 
+ 	if (!ops->container_limit_cgroup) {
+ 		WARN("Uninitialized limit cgroup");
++#ifdef HAVE_ISULAD
++		return true;
++#else
+ 		return;
++#endif
+ 	}
+ 
+ 	ret = bpf_program_cgroup_detach(handler->cgroup_ops->cgroup2_devices);
+@@ -579,6 +611,9 @@ __cgfsng_ops static void cgfsng_payload_destroy(struct cgroup_ops *ops,
+ 	}
+ 	if (ret < 0)
+ 		SYSWARN("Failed to destroy cgroups");
++#ifdef HAVE_ISULAD
++	return ret >= 0;
++#endif
+ }
+ 
+ #define __ISOL_CPUS "/sys/devices/system/cpu/isolated"
+@@ -854,6 +889,10 @@ static void cgroup_tree_prune_leaf(struct hierarchy *h, const char *path_prune,
+ __cgfsng_ops static void cgfsng_monitor_destroy(struct cgroup_ops *ops,
+ 						struct lxc_handler *handler)
+ {
++#ifdef HAVE_ISULAD
++	// ignore destroy monitor cgroup
++	return;
++#endif
+ 	int len;
+ 	char pidstrINTTYPE_TO_STRLEN(pid_t);
+ 	const struct lxc_conf *conf;
+@@ -1311,6 +1350,10 @@ static char *cgroup_relpath(char *cg)
+ 
+ __cgfsng_ops static bool cgfsng_monitor_create(struct cgroup_ops *ops, struct lxc_handler *handler)
+ {
++#ifdef HAVE_ISULAD
++	// skip create monitor cgroup
++	return true;
++#endif
+ 	__do_free char *monitor_cgroup = NULL;
+ 	int idx = 0;
+ 	int i;
+@@ -1411,6 +1454,17 @@ __cgfsng_ops static bool cgfsng_payload_create(struct cgroup_ops *ops, struct lx
+ 	if (!ops->hierarchies)
+ 		return true;
+ 
++#ifdef HAVE_ISULAD
++	if (ops->no_controller) {
++		DEBUG("no controller found, isgnore isulad_cgfsng_payload_create");
++		return true;
++	}
++	if (ops->container_cgroup) {
++		free(ops->container_cgroup);
++		ops->container_cgroup = NULL;
++	}
++#endif
++
+ 	if (ops->container_cgroup || ops->container_limit_cgroup)
+ 		return ret_set_errno(false, EEXIST);
+ 
+@@ -1504,6 +1558,10 @@ __cgfsng_ops static bool cgfsng_payload_create(struct cgroup_ops *ops, struct lx
+ __cgfsng_ops static bool cgfsng_monitor_enter(struct cgroup_ops *ops,
+ 					      struct lxc_handler *handler)
+ {
++#ifdef HAVE_ISULAD
++	// ignore enter monitor cgroup
++	return true;
++#endif
+ 	int monitor_len, transient_len = 0;
+ 	char monitorINTTYPE_TO_STRLEN(pid_t),
+ 	    transientINTTYPE_TO_STRLEN(pid_t);
+@@ -1577,6 +1635,13 @@ __cgfsng_ops static bool cgfsng_payload_enter(struct cgroup_ops *ops,
+ 	if (!ops)
+ 		return ret_set_errno(false, ENOENT);
+ 
++#ifdef HAVE_ISULAD
++	if (ops->no_controller) {
++		DEBUG("no controller found, isgnore isulad_cgfsng_payload_enter");
++		return true;
++	}
++#endif
++
+ 	if (!ops->hierarchies)
+ 		return true;
+ 
+@@ -1728,6 +1793,13 @@ __cgfsng_ops static void cgfsng_finalize(struct cgroup_ops *ops)
+ 	if (!ops)
+ 		return;

_service:tar_scm:0007-refactor-patches-on-terminal.c-start.c-and-so-on.patch Deleted

@@ -1,2726 +0,0 @@
-From 06b071d6bc7683023d3131d4e428210005333c8c Mon Sep 17 00:00:00 2001
-From: chengzrz <czrzrichard@gmail.com>
-Date: Wed, 20 Jul 2022 15:03:45 +0800
-Subject: PATCH refactor patches on terminal.c, start.c and so on
-
-Signed-off-by: chengzrz <czrzrichard@gmail.com>
----
- hooks/Makefile.am         |   3 +
- src/lxc/attach.h          |   6 +
- src/lxc/cgroups/cgroup.c  |   4 +
- src/lxc/commands_utils.h  |   6 +
- src/lxc/initutils.c       |   4 +
- src/lxc/lsm/lsm.h         |   8 +
- src/lxc/lxclock.h         |   4 +
- src/lxc/mainloop.h        |   4 +
- src/lxc/start.c           | 958 ++++++++++++++++++++++++++++++++++++
- src/lxc/storage/btrfs.c   |  11 +
- src/lxc/storage/overlay.c |   8 +
- src/lxc/sync.h            |   4 +
- src/lxc/terminal.c        | 990 ++++++++++++++++++++++++++++++++++++++
- src/tests/Makefile.am     |   4 +
- src/tests/attach.c        |  11 +
- 15 files changed, 2025 insertions(+)
-
-diff --git a/hooks/Makefile.am b/hooks/Makefile.am
-index 5ae73d7..ddfd4bc 100644
---- a/hooks/Makefile.am
-+++ b/hooks/Makefile.am
-@@ -10,6 +10,8 @@ hooks_SCRIPTS = \
- 	squid-deb-proxy-client \
- 	nvidia
- 
-+
-+if !HAVE_ISULAD
- binhooks_PROGRAMS = \
- 	unmount-namespace
- 
-@@ -20,5 +22,6 @@ if IS_BIONIC
- unmount_namespace_SOURCES += \
- 	../src/include/lxcmntent.c ../src/include/lxcmntent.h
- endif
-+endif
- 
- EXTRA_DIST=$(hooks_SCRIPTS)
-diff --git a/src/lxc/attach.h b/src/lxc/attach.h
-index ef5a6c1..8316344 100644
---- a/src/lxc/attach.h
-+++ b/src/lxc/attach.h
-@@ -20,9 +20,15 @@ struct lxc_proc_context_info {
- 	int ns_fdLXC_NS_MAX;
- };
- 
-+#ifdef HAVE_ISULAD
-+extern int lxc_attach(struct lxc_container *container,
-+		      lxc_attach_exec_t exec_function, void *exec_payload,
-+		      lxc_attach_options_t *options, pid_t *attached_process, char **err_msg);
-+#else
- extern int lxc_attach(struct lxc_container *container,
- 		      lxc_attach_exec_t exec_function, void *exec_payload,
- 		      lxc_attach_options_t *options, pid_t *attached_process);
-+#endif
- 
- extern int lxc_attach_remount_sys_proc(void);
- 
-diff --git a/src/lxc/cgroups/cgroup.c b/src/lxc/cgroups/cgroup.c
-index 7c94fd8..5aa2c3c 100644
---- a/src/lxc/cgroups/cgroup.c
-+++ b/src/lxc/cgroups/cgroup.c
-@@ -31,7 +31,11 @@ struct cgroup_ops *cgroup_init(struct lxc_conf *conf)
- 	if (!cgroup_ops)
- 		return log_error_errno(NULL, errno, "Failed to initialize cgroup driver");
- 
-+#ifdef HAVE_ISULAD
-+	if (cgroup_ops->data_init(cgroup_ops, conf)) {
-+#else
- 	if (cgroup_ops->data_init(cgroup_ops)) {
-+#endif
- 		cgroup_exit(cgroup_ops);
- 		return log_error_errno(NULL, errno,
- 				       "Failed to initialize cgroup data");
-diff --git a/src/lxc/commands_utils.h b/src/lxc/commands_utils.h
-index 3ef7920..c836ead 100644
---- a/src/lxc/commands_utils.h
-+++ b/src/lxc/commands_utils.h
-@@ -65,4 +65,10 @@ extern int lxc_add_state_client(int state_client_fd,
- extern int lxc_cmd_connect(const char *name, const char *lxcpath,
- 			   const char *hashed_sock_name, const char *suffix);
- 
-+#ifdef HAVE_ISULAD
-+extern char *generate_named_unix_sock_dir(const char *name);
-+extern int generate_named_unix_sock_path(const char *container_name,
-+				const char *sock_name, char *out_path, size_t len);
-+#endif
-+
- #endif /* __LXC_COMMANDS_UTILS_H */
-diff --git a/src/lxc/initutils.c b/src/lxc/initutils.c
-index 5549c2e..76f0048 100644
---- a/src/lxc/initutils.c
-+++ b/src/lxc/initutils.c
-@@ -54,11 +54,15 @@ const char *lxc_global_config_value(const char *option_name)
- 		{ NULL, NULL },
- 	};
- 
-+#ifdef HAVE_ISULAD
-+	static const char *valuessizeof(options) / sizeof(options0) = {0};
-+#else
- 	/* placed in the thread local storage pool for non-bionic targets */
- #ifdef HAVE_TLS
- 	static thread_local const char *valuessizeof(options) / sizeof(options0) = {0};
- #else
- 	static const char *valuessizeof(options) / sizeof(options0) = {0};
-+#endif
- #endif
- 
- 	/* user_config_path is freed as soon as it is used */
-diff --git a/src/lxc/lsm/lsm.h b/src/lxc/lsm/lsm.h
-index ee578bb..4872f55 100644
---- a/src/lxc/lsm/lsm.h
-+++ b/src/lxc/lsm/lsm.h
-@@ -17,6 +17,10 @@ struct lsm_drv {
- 	char *(*process_label_get)(pid_t pid);
- 	int (*process_label_set)(const char *label, struct lxc_conf *conf,
- 				 bool on_exec);
-+#ifdef HAVE_ISULAD
-+	int (*file_label_set)(const char *path, const char *label);
-+	int (*relabel)(const char *path, const char *label, bool share);
-+#endif
- 	int (*keyring_label_set)(char* label);
- 	int (*prepare)(struct lxc_conf *conf, const char *lxcpath);
- 	void (*cleanup)(struct lxc_conf *conf, const char *lxcpath);
-@@ -32,6 +36,10 @@ extern int lsm_process_label_set(const char *label, struct lxc_conf *conf,
- extern int lsm_process_label_fd_get(pid_t pid, bool on_exec);
- extern int lsm_process_label_set_at(int label_fd, const char *label,
- 				    bool on_exec);
-+#ifdef HAVE_ISULAD
-+extern int lsm_file_label_set(const char *path, const char *label);
-+extern int lsm_relabel(const char *path, const char *label, bool share);
-+#endif
- extern void lsm_process_cleanup(struct lxc_conf *conf, const char *lxcpath);
- extern int lsm_keyring_label_set(char *label);
- 
-diff --git a/src/lxc/lxclock.h b/src/lxc/lxclock.h
-index 9f9bc3b..6a71d7c 100644
---- a/src/lxc/lxclock.h
-+++ b/src/lxc/lxclock.h
-@@ -154,4 +154,8 @@ extern int container_disk_lock(struct lxc_container *c);
-  */
- extern void container_disk_unlock(struct lxc_container *c);
- 
-+#ifdef HAVE_ISULAD
-+int container_disk_removelock(struct lxc_container *c);
-+#endif
-+
- #endif
-diff --git a/src/lxc/mainloop.h b/src/lxc/mainloop.h
-index e6ab9a6..aa41a93 100644
---- a/src/lxc/mainloop.h
-+++ b/src/lxc/mainloop.h
-@@ -38,4 +38,8 @@ extern void lxc_mainloop_close(struct lxc_epoll_descr *descr);
- 
- define_cleanup_function(struct lxc_epoll_descr *, lxc_mainloop_close);
- 
-+#ifdef HAVE_ISULAD
-+extern int isulad_safe_mainloop(struct lxc_epoll_descr *descr, int timeout_ms);
-+#endif
-+
- #endif
-diff --git a/src/lxc/start.c b/src/lxc/start.c
-index fd969c4..f82df34 100644
---- a/src/lxc/start.c
-+++ b/src/lxc/start.c
-@@ -304,7 +304,11 @@ static int setup_signal_fd(sigset_t *oldmask)
- {
- 	int ret;
- 	sigset_t mask;
-+#ifdef HAVE_ISULAD
-+	const int signals = {SIGBUS, SIGILL, SIGSEGV, SIGWINCH, SIGTERM};
-+#else
- 	const int signals = {SIGBUS, SIGILL, SIGSEGV, SIGWINCH};
-+#endif
- 
- 	/* Block everything except serious error signals. */
- 	ret = sigfillset(&mask);
-@@ -590,13 +594,27 @@ int lxc_poll(const char *name, struct lxc_handler *handler)
- 
- 	TRACE("Mainloop is ready");
- 
-+#ifdef HAVE_ISULAD
-+	// iSulad: close stdin pipe if we do not want open_stdin with container stdin
-+	if (!handler->conf->console.open_stdin) {
-+		if (handler->conf->console.pipes01 > 0) {
-+			close(handler->conf->console.pipes01);
-+			handler->conf->console.pipes01 = -1;
-+		}
-+	}
-+#endif
-+
- 	ret = lxc_mainloop(&descr, -1);
- 	close_prot_errno_disarm(descr.epfd);

_service:tar_scm:0008-bugfix-for-system-container-and-stream.patch Added

@@ -0,0 +1,490 @@
+From 4cdfab3356a95e7bd7063adcb54604c8f1f4c439 Mon Sep 17 00:00:00 2001
+From: zhangxiaoyu <zhangxiaoyu58@huawei.com>
+Date: Tue, 7 Nov 2023 16:24:53 +0800
+Subject: PATCH bugfix for system container and stream
+
+Signed-off-by: zhangxiaoyu <zhangxiaoyu58@huawei.com>
+---
+ src/lxc/attach.c         |  6 +--
+ src/lxc/cgroups/cgfsng.c |  4 +-
+ src/lxc/conf.c           | 65 ++++++++++++++++------------
+ src/lxc/confile.c        |  9 +++-
+ src/lxc/start.c          | 78 ++++++++++++++++++----------------
+ src/lxc/storage/dir.c    |  4 ++
+ src/lxc/terminal.c       | 92 +++++++++++++++++++++++++---------------
+ 7 files changed, 150 insertions(+), 108 deletions(-)
+
+diff --git a/src/lxc/attach.c b/src/lxc/attach.c
+index ae12da3..9550e6d 100644
+--- a/src/lxc/attach.c
++++ b/src/lxc/attach.c
+@@ -1453,7 +1453,7 @@ __noreturn static void do_attach(struct attach_payload *ap)
+ 				SYSERROR("Failed to prepare terminal file pipes");
+ 				goto on_error;
+ 			}
+-		} else {
++		} else if (ap->terminal_pts_fd >= 0) {
+ #endif
+ 		ret = lxc_terminal_prepare_login(ap->terminal_pts_fd);
+ 		if (ret < 0) {
+@@ -2009,11 +2009,7 @@ int lxc_attach(struct lxc_container *container, lxc_attach_exec_t exec_function,
+ 				.terminal = &terminal,
+ #endif
+ 			};
+-#ifdef HAVE_ISULAD
+-			if (options->attach_flags & LXC_ATTACH_TERMINAL && terminal.tty_state) {
+-#else
+ 			if (options->attach_flags & LXC_ATTACH_TERMINAL) {
+-#endif
+ 				ret = lxc_terminal_signal_sigmask_safe_blocked(&terminal);
+ 				if (ret < 0) {
+ 					SYSERROR("Failed to reset signal mask");
+diff --git a/src/lxc/cgroups/cgfsng.c b/src/lxc/cgroups/cgfsng.c
+index 0aaafa8..a9a8f2c 100644
+--- a/src/lxc/cgroups/cgfsng.c
++++ b/src/lxc/cgroups/cgfsng.c
+@@ -612,7 +612,7 @@ __cgfsng_ops static void cgfsng_payload_destroy(struct cgroup_ops *ops,
+ 	if (ret < 0)
+ 		SYSWARN("Failed to destroy cgroups");
+ #ifdef HAVE_ISULAD
+-	return ret >= 0;
++	return ret == 0;
+ #endif
+ }
+ 
+@@ -3370,8 +3370,6 @@ static bool isulad_cg_legacy_handle_cpuset_hierarchy(struct hierarchy *h, char *
+ 	if (!string_in_list(h->controllers, "cpuset"))
+ 		return true;
+ 
+-	cgname += strspn(cgname, "/");
+-
+ 	slash = strchr(cgname, '/');
+ 
+ 	if (slash != NULL) {
+diff --git a/src/lxc/conf.c b/src/lxc/conf.c
+index ff5cefc..7a70bca 100644
+--- a/src/lxc/conf.c
++++ b/src/lxc/conf.c
+@@ -1281,7 +1281,13 @@ static int mount_autodev(const char *name, const struct lxc_rootfs *rootfs,
+ 
+ #ifdef HAVE_ISULAD
+ 	if (systemd != NULL && !strcmp(systemd, "true")) {
+-		ret = mount(path, path, "", MS_BIND, NULL);
++		__do_free char *fallback_path = NULL;
++		if (path) {
++			fallback_path = must_make_path(path, "/dev", NULL);
++		} else {
++			fallback_path = must_make_path("dev", NULL);
++		}
++		ret = mount(fallback_path, fallback_path, "", MS_BIND, NULL);
+ #else
+ 	if (can_use_mount_api()) {
+ 		fd_fs = fs_prepare("tmpfs", -EBADF, "", 0, 0);
+@@ -2349,7 +2355,18 @@ static int lxc_setup_console(const struct lxc_handler *handler,
+ 	 * setup on its console ie. the pty allocated in lxc_terminal_setup() so
+ 	 * make sure that that pty is stdin,stdout,stderr.
+ 	 */
++#ifdef HAVE_ISULAD
++	setsid();
++	if (!handler->disable_pty && handler->conf->console.pty >= 0) {
++		/* isulad:make the given terminal as controlling terminal to avoid warning
++		* sh: cannot set terminal process group (-1): Inappropriate ioctl for device
++		* sh: no job control in this shell */
++		if (ioctl(handler->conf->console.pty, TIOCSCTTY, NULL) < 0) {
++			return syserror("Faild to make the given terminal the controlling terminal of the calling process");
++		}
++#else
+ 	if (console->pty >= 0) {
++#endif
+ 		if (handler->daemonize || !handler->conf->is_execute)
+ 			ret = set_stdfds(console->pty);
+ 		else
+@@ -4678,20 +4695,21 @@ int lxc_setup(struct lxc_handler *handler)
+ #endif
+ 
+ 	ret = lxc_rootfs_prepare_child(handler);
++	if (ret < 0)
++		return syserror("Failed to prepare rootfs");
++
++
++	ret = lxc_setup_rootfs_prepare_root(lxc_conf, name, lxcpath);
+ 	if (ret < 0)
+ #ifdef HAVE_ISULAD
+ 	{
+ 		lxc_write_error_message(lxc_conf->errpipe1, "%s:%d: failed to setup rootfs %s.",
+ 				__FILE__, __LINE__, lxc_conf->rootfs.path);
+-		return syserror("Failed to prepare rootfs");
++		return log_error(-1, "Failed to setup rootfs");
+ 	}
+ #else
+-		return syserror("Failed to prepare rootfs");
+-#endif
+-
+-	ret = lxc_setup_rootfs_prepare_root(lxc_conf, name, lxcpath);
+-	if (ret < 0)
+ 		return log_error(-1, "Failed to setup rootfs");
++#endif
+ 
+ 	if (handler->nsfdLXC_NS_UTS == -EBADF) {
+ 		ret = setup_utsname(lxc_conf->utsname);
+@@ -4820,9 +4838,6 @@ int lxc_setup(struct lxc_handler *handler)
+ 			return log_error(-1, "Failed to mount transient procfs instance for LSMs");
+ 	}
+ 
+-	if (setup_rootfs_mountopts(&lxc_conf->rootfs)) {
+-			return log_error(-1, "failed to set rootfs for '%s'", name);
+-	}
+ 	if (lxc_conf->rootfs.path != NULL && setup_dev) {
+ 		ret = lxc_setup_devpts_child(handler);
+ 		if (ret < 0) {
+@@ -4866,6 +4881,12 @@ int lxc_setup(struct lxc_handler *handler)
+ 	if (ret < 0)
+ 		return log_error(-1, "Failed to pivot root into rootfs");
+ 
++#ifdef HAVE_ISULAD
++	if (setup_rootfs_mountopts(&lxc_conf->rootfs)) {
++		return log_error(-1, "failed to set rootfs for '%s'", name);
++	}
++#endif
++
+ 	ret = make_shmount_dependent_mount(lxc_conf);
+ 	if (ret < 0)
+ 		return log_error(-1, "Failed to turn mount tunnel \"%s\" into dependent mount",
+@@ -6926,28 +6947,18 @@ int parse_propagationopts(const char *mntopts, unsigned long *pflags)
+ // isulad: setup rootfs mountopts
+ static int setup_rootfs_mountopts(const struct lxc_rootfs *rootfs)
+ {
+-	unsigned long mflags, mntflags, pflags;
+-	__do_free char *mntdata = NULL;
++	unsigned long mflags;
+ 
+-	if(!rootfs || !rootfs->mnt_opts.raw_options)
++	if(!rootfs || !(rootfs->mnt_opts.mnt_flags & MS_RDONLY))
+ 		return 0;
+ 
+-	if (parse_mntopts_legacy(rootfs->mnt_opts.raw_options, &mntflags, &mntdata) < 0) {
++	mflags = add_required_remount_flags("/", NULL, MS_BIND | MS_REC | rootfs->mnt_opts.mnt_flags |
++										rootfs->mnt_opts.prop_flags | MS_REMOUNT);
++	DEBUG("remounting / as readonly");
++	if (mount("/", "/", NULL, mflags, 0) < 0) {
++		SYSERROR("Failed to make / readonly.");
+ 		return -1;
+ 	}
+-
+-	if (parse_propagationopts(rootfs->mnt_opts.raw_options, &pflags) < 0) {
+-		return -EINVAL;
+-	}
+-
+-	if (mntflags & MS_RDONLY) {
+-		mflags = add_required_remount_flags("/", NULL, MS_BIND | MS_REC | mntflags | pflags | MS_REMOUNT);
+-		DEBUG("remounting / as readonly");
+-		if (mount("/", "/", NULL, mflags, 0) < 0) {
+-			SYSERROR("Failed to make / readonly.");
+-			return -1;
+-		}
+-	}
+ 	return 0;
+ }
+ 
+diff --git a/src/lxc/confile.c b/src/lxc/confile.c
+index ae1a264..aa5c790 100644
+--- a/src/lxc/confile.c
++++ b/src/lxc/confile.c
+@@ -2010,14 +2010,19 @@ static int set_config_cgroup_dir(const char *key, const char *value,
+ 
+ 	if (lxc_config_value_empty(value))
+ 		return clr_config_cgroup_dir(key, lxc_conf, NULL);
+-#ifndef HAVE_ISULAD
++
++#ifdef HAVE_ISULAD

_service:tar_scm:0008-refactor-patch-code-of-json.patch Deleted

@@ -1,5513 +0,0 @@
-From 4c68aefb92800112f48aa73a55f80b368b09c69f Mon Sep 17 00:00:00 2001
-From: zhangxiaoyu <zhangxiaoyu58@huawei.com>
-Date: Wed, 20 Jul 2022 11:00:13 +0800
-Subject: PATCH refactor patch code of json
-
-Signed-off-by: zhangxiaoyu <zhangxiaoyu58@huawei.com>
----
- src/lxc/cgroups/isulad_cgfsng.c  | 3223 ++++++++++++++++++++++++++++++
- src/lxc/json/defs.c              |  205 ++
- src/lxc/json/defs.h              |   37 +
- src/lxc/json/json_common.c       | 1153 +++++++++++
- src/lxc/json/json_common.h       |  185 ++
- src/lxc/json/logger_json_file.c  |  246 +++
- src/lxc/json/logger_json_file.h  |   45 +
- src/lxc/json/oci_runtime_hooks.c |   52 +
- src/lxc/json/oci_runtime_hooks.h |   15 +
- src/lxc/json/oci_runtime_spec.c  |  195 ++
- src/lxc/json/oci_runtime_spec.h  |   37 +
- src/lxc/json/read-file.h         |   11 +
- 12 files changed, 5404 insertions(+)
- create mode 100644 src/lxc/cgroups/isulad_cgfsng.c
- create mode 100644 src/lxc/json/defs.c
- create mode 100644 src/lxc/json/defs.h
- create mode 100755 src/lxc/json/json_common.c
- create mode 100755 src/lxc/json/json_common.h
- create mode 100644 src/lxc/json/logger_json_file.c
- create mode 100644 src/lxc/json/logger_json_file.h
- create mode 100644 src/lxc/json/oci_runtime_hooks.c
- create mode 100644 src/lxc/json/oci_runtime_hooks.h
- create mode 100644 src/lxc/json/oci_runtime_spec.c
- create mode 100644 src/lxc/json/oci_runtime_spec.h
- create mode 100644 src/lxc/json/read-file.h
-
-diff --git a/src/lxc/cgroups/isulad_cgfsng.c b/src/lxc/cgroups/isulad_cgfsng.c
-new file mode 100644
-index 0000000..8a9656a
---- /dev/null
-+++ b/src/lxc/cgroups/isulad_cgfsng.c
-@@ -0,0 +1,3223 @@
-+/******************************************************************************
-+ * Copyright (c) Huawei Technologies Co., Ltd. 2019. All rights reserved.
-+ * Author: lifeng
-+ * Create: 2020-11-02
-+ * Description: provide container definition
-+ * lxc: linux Container library
-+ * This library is free software; you can redistribute it and/or
-+ * modify it under the terms of the GNU Lesser General Public
-+ * License as published by the Free Software Foundation; either
-+ * version 2.1 of the License, or (at your option) any later version.
-+ *
-+ * This library is distributed in the hope that it will be useful,
-+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
-+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
-+ * Lesser General Public License for more details.
-+ *
-+ * You should have received a copy of the GNU Lesser General Public
-+ * License along with this library; if not, write to the Free Software
-+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
-+  ******************************************************************************/
-+
-+#ifndef _GNU_SOURCE
-+#define _GNU_SOURCE 1
-+#endif
-+#include <ctype.h>
-+#include <dirent.h>
-+#include <errno.h>
-+#include <grp.h>
-+#include <linux/kdev_t.h>
-+#include <linux/types.h>
-+#include <poll.h>
-+#include <signal.h>
-+#include <stdint.h>
-+#include <stdio.h>
-+#include <stdlib.h>
-+#include <string.h>
-+#include <sys/types.h>
-+#include <unistd.h>
-+
-+#include "af_unix.h"
-+#include "caps.h"
-+#include "cgroup.h"
-+#include "cgroup2_devices.h"
-+#include "cgroup_utils.h"
-+#include "commands.h"
-+#include "conf.h"
-+#include "config.h"
-+#include "log.h"
-+#include "macro.h"
-+#include "mainloop.h"
-+#include "memory_utils.h"
-+#include "storage/storage.h"
-+#include "utils.h"
-+
-+#ifndef HAVE_STRLCPY
-+#include "include/strlcpy.h"
-+#endif
-+
-+#ifndef HAVE_STRLCAT
-+#include "include/strlcat.h"
-+#endif
-+
-+lxc_log_define(isulad_cgfsng, cgroup);
-+
-+/* Given a pointer to a null-terminated array of pointers, realloc to add one
-+ * entry, and point the new entry to NULL. Do not fail. Return the index to the
-+ * second-to-last entry - that is, the one which is now available for use
-+ * (keeping the list null-terminated).
-+ */
-+static int append_null_to_list(void ***list)
-+{
-+	int newentry = 0;
-+
-+	if (*list)
-+		for (; (*list)newentry; newentry++)
-+			;
-+
-+	*list = must_realloc(*list, (newentry + 2) * sizeof(void **));
-+	(*list)newentry + 1 = NULL;
-+	return newentry;
-+}
-+
-+/* Given a null-terminated array of strings, check whether @entry is one of the
-+ * strings.
-+ */
-+static bool string_in_list(char **list, const char *entry)
-+{
-+	if (!list)
-+		return false;
-+
-+	for (int i = 0; listi; i++)
-+		if (strcmp(listi, entry) == 0)
-+			return true;
-+
-+	return false;
-+}
-+
-+/* Return a copy of @entry prepending "name=", i.e.  turn "systemd" into
-+ * "name=systemd". Do not fail.
-+ */
-+static char *cg_legacy_must_prefix_named(char *entry)
-+{
-+	size_t len;
-+	char *prefixed;
-+
-+	len = strlen(entry);
-+	prefixed = must_realloc(NULL, len + 6);
-+
-+	memcpy(prefixed, "name=", STRLITERALLEN("name="));
-+	memcpy(prefixed + STRLITERALLEN("name="), entry, len);
-+	prefixedlen + 5 = '\0';
-+
-+	return prefixed;
-+}
-+
-+/* Append an entry to the clist. Do not fail. @clist must be NULL the first time
-+ * we are called.
-+ *
-+ * We also handle named subsystems here. Any controller which is not a kernel
-+ * subsystem, we prefix "name=". Any which is both a kernel and named subsystem,
-+ * we refuse to use because we're not sure which we have here.
-+ * (TODO: We could work around this in some cases by just remounting to be
-+ * unambiguous, or by comparing mountpoint contents with current cgroup.)
-+ *
-+ * The last entry will always be NULL.
-+ */
-+static void must_append_controller(char **klist, char **nlist, char ***clist,
-+				   char *entry)
-+{
-+	int newentry;
-+	char *copy;
-+
-+	if (string_in_list(klist, entry) && string_in_list(nlist, entry)) {
-+		ERROR("Refusing to use ambiguous controller \"%s\"", entry);
-+		ERROR("It is both a named and kernel subsystem");
-+		return;
-+	}
-+
-+	newentry = append_null_to_list((void ***)clist);
-+
-+	if (strncmp(entry, "name=", 5) == 0)
-+		copy = must_copy_string(entry);
-+	else if (string_in_list(klist, entry))
-+		copy = must_copy_string(entry);
-+	else
-+		copy = cg_legacy_must_prefix_named(entry);
-+
-+	(*clist)newentry = copy;
-+}
-+
-+/* Given a handler's cgroup data, return the struct hierarchy for the controller
-+ * @c, or NULL if there is none.
-+ */
-+struct hierarchy *get_hierarchy(struct cgroup_ops *ops, const char *controller)
-+{
-+	if (!ops->hierarchies)
-+		return log_trace_errno(NULL, errno, "There are no useable cgroup controllers");
-+
-+	for (int i = 0; ops->hierarchiesi; i++) {
-+		if (!controller) {

_service:tar_scm:0009-bugfix-about-cgroup-mount-propagation-and-capabiliti.patch Added

@@ -0,0 +1,254 @@
+From a719de928649384d63b903fb0036aafd5fa78822 Mon Sep 17 00:00:00 2001
+From: zhangxiaoyu <zhangxiaoyu58@huawei.com>
+Date: Thu, 7 Dec 2023 11:11:31 +0800
+Subject: PATCH bugfix about cgroup, mount propagation and capabilities
+
+Signed-off-by: zhangxiaoyu <zhangxiaoyu58@huawei.com>
+---
+ src/lxc/attach_options.h       |  2 --
+ src/lxc/cgroups/cgfsng.c       | 15 +++++++----
+ src/lxc/cgroups/cgroup_utils.c | 10 ++++++++
+ src/lxc/conf.c                 | 47 +++++++++-------------------------
+ src/lxc/confile.c              | 12 +++++++++
+ src/lxc/start.c                |  8 +++++-
+ src/lxc/tools/lxc_attach.c     |  5 ++--
+ 7 files changed, 54 insertions(+), 45 deletions(-)
+
+diff --git a/src/lxc/attach_options.h b/src/lxc/attach_options.h
+index fe8bf6d..c1627d7 100644
+--- a/src/lxc/attach_options.h
++++ b/src/lxc/attach_options.h
+@@ -169,8 +169,6 @@ typedef struct lxc_attach_options_t {
+ 	const char *suffix;
+ 	bool disable_pty;
+ 	bool open_stdin;
+-	gid_t *add_gids; /* attach user additional gids */
+-	size_t add_gids_len; // iSulad TODO: shoud replace by lxc_groups_t groups;
+ #endif
+ } lxc_attach_options_t;
+ 
+diff --git a/src/lxc/cgroups/cgfsng.c b/src/lxc/cgroups/cgfsng.c
+index a9a8f2c..5fd12ff 100644
+--- a/src/lxc/cgroups/cgfsng.c
++++ b/src/lxc/cgroups/cgfsng.c
+@@ -486,8 +486,15 @@ static int cgroup_tree_remove(struct hierarchy **hierarchies, const char *path_p
+ 		int ret;
+ 
+ 		ret = cgroup_tree_prune(h->dfd_base, path_prune);
++#ifdef HAVE_ISULAD
++		if (ret < 0) {
++			SYSWARN("Failed to destroy %d(%s)", h->dfd_base, path_prune);
++			return -1;
++		}
++#else
+ 		if (ret < 0)
+ 			SYSWARN("Failed to destroy %d(%s)", h->dfd_base, path_prune);
++#endif
+ 		else
+ 			TRACE("Removed cgroup tree %d(%s)", h->dfd_base, path_prune);
+ 
+@@ -1459,10 +1466,7 @@ __cgfsng_ops static bool cgfsng_payload_create(struct cgroup_ops *ops, struct lx
+ 		DEBUG("no controller found, isgnore isulad_cgfsng_payload_create");
+ 		return true;
+ 	}
+-	if (ops->container_cgroup) {
+-		free(ops->container_cgroup);
+-		ops->container_cgroup = NULL;
+-	}
++	free_equal(ops->container_cgroup, ops->container_limit_cgroup);
+ #endif
+ 
+ 	if (ops->container_cgroup || ops->container_limit_cgroup)
+@@ -4408,6 +4412,7 @@ __cgfsng_ops static int cgfsng_data_init(struct cgroup_ops *ops)
+ 		return ret_set_errno(-1, ENOMEM);
+ 
+ 	ops->container_cgroup = move_ptr(container_cgroup);
++	ops->container_limit_cgroup = ops->container_cgroup;
+ #endif
+ 
+ 	return 0;
+@@ -4425,7 +4430,7 @@ __cgfsng_ops static const char *isulad_cgfsng_get_cgroup_full_path(struct cgroup
+ 				      controller ? controller : "(null)");
+ 
+ 	if (!h->path_con)
+-		h->path_con = must_make_path(h->at_mnt, h->at_base, ops->container_cgroup, NULL);
++		h->path_con = make_cgroup_path(h, h->at_base, ops->container_cgroup, NULL);
+ 
+ 	return h->path_con;
+ }
+diff --git a/src/lxc/cgroups/cgroup_utils.c b/src/lxc/cgroups/cgroup_utils.c
+index dc2fbec..252799e 100644
+--- a/src/lxc/cgroups/cgroup_utils.c
++++ b/src/lxc/cgroups/cgroup_utils.c
+@@ -52,8 +52,18 @@ int cgroup_tree_prune(int dfd, const char *path)
+ 	 */
+ 	dfd_disown = open_at(dfd, path, PROTECT_OPEN,
+ 			     PROTECT_LOOKUP_BENEATH_WITH_SYMLINKS, 0);
++#ifdef HAVE_ISULAD
++	if (dfd_disown < 0) {
++		if (errno == ENOENT) {
++			WARN("Destroy %d(%s) do not exist", dfd, path);
++			return 0;
++		}
++		return -errno;
++	}
++#else
+ 	if (dfd_disown < 0)
+ 		return -errno;
++#endif
+ 
+ 	dfd_dup = dup_cloexec(dfd_disown);
+ 	if (dfd_dup < 0)
+diff --git a/src/lxc/conf.c b/src/lxc/conf.c
+index 7a70bca..84b8baf 100644
+--- a/src/lxc/conf.c
++++ b/src/lxc/conf.c
+@@ -590,6 +590,13 @@ int lxc_rootfs_init(struct lxc_conf *conf, bool userns)
+ 			return log_trace_errno(0, EINVAL, "Not pinning on ZFS filesystem");
+ 	}
+ 
++#ifdef HAVE_ISULAD
++	// isulad rootfs type is null
++	if (!rootfs->bdev_type) {
++		return log_trace_errno(0, EINVAL, "Not pinning on rootfs");
++	}
++#endif
++
+ 	dfd_path = open_at(-EBADF, rootfs->path, PROTECT_OPATH_FILE, 0, 0);
+ 	if (dfd_path < 0)
+ 		return syserror("Failed to open \"%s\"", rootfs->path);
+@@ -1767,9 +1774,12 @@ static int lxc_pivot_root(const struct lxc_rootfs *rootfs)
+ 	 * nearly all relevant use-cases. Instead, establish the container's
+ 	 * rootfs as a separate peer group mirroring the behavior on the host.
+ 	 */
++#ifndef HAVE_ISULAD
++	// shared mount propagation will cause maskedpath mount twice
+ 	ret = mount("", ".", "", MS_SHARED | MS_REC, NULL);
+ 	if (ret < 0)
+ 		return log_error_errno(-errno, errno, "Failed to turn new root mount tree into shared mount tree");
++#endif
+ 
+ 	TRACE("Changed into new rootfs \"%s\"", rootfs->mount);
+ 	return 0;
+@@ -3530,17 +3540,6 @@ static int capabilities_allow(struct lxc_conf *conf)
+ 		if (cap->cap > last_cap)
+ 			continue;
+ 
+-#ifdef HAVE_ISULAD
+-		/* Do not keep any cap*/
+-		if (strcmp(cap->cap_name, "ISULAD_KEEP_NONE") == 0) {
+-			DEBUG("Do not keep any capability");
+-			__u32 i;
+-			for(i = 0; i < nr_u32; i++) {
+-				keep_bitsi = 0;
+-			}
+-			break;
+-		}
+-#endif
+ 		set_bit(cap->cap, keep_bits);
+ 		DEBUG("Keeping %s (%d) capability", cap->cap_name, cap->cap);
+ 	}
+@@ -6267,9 +6266,7 @@ int lxc_drop_caps(struct lxc_conf *conf)
+ #define __DEF_CAP_TO_MASK(x) (1U << ((x) & 31))
+ #if HAVE_LIBCAP
+ 	int ret = 0;
+-	int nret = 0;
+ 	size_t i = 0;
+-	__u32 capid;
+ 	__u32 last_cap;
+ 	size_t numcaps;
+ 	struct cap_entry *cap_entry;
+@@ -6295,28 +6292,8 @@ int lxc_drop_caps(struct lxc_conf *conf)
+ 	(void)memset(caplist, 0, numcaps * sizeof(int));
+ 
+ 	list_for_each_entry(cap_entry, &conf->caps.list, head) {
+-		/* isulad: Do not keep any cap*/
+-		if (strcmp(cap_entry->cap_name, "ISULAD_KEEP_NONE") == 0) {
+-			DEBUG("Do not keep any capability");
+-			for(i = 0; i < numcaps; i++) {
+-				caplisti = 0;
+-			}
+-			break;
+-		}
+-
+-		nret = parse_cap(cap_entry->cap_name, &capid);
+-		if (nret == -2)
+-			continue;
+-
+-		if (nret < 0) {
+-			ERROR("unknown capability %s", cap_entry->cap_name);
+-			ret = -1;
+-			goto out;
+-		}
+-
+-		DEBUG("keep capability '%s' (%d)", cap_entry->cap_name, capid);
+-
+-		caplistcapid = 1;
++		DEBUG("keep capability '%s' (%d)", cap_entry->cap_name, cap_entry->cap);
++		caplistcap_entry->cap = 1;
+ 	}
+ 
+ 	struct __user_cap_header_struct cap_header_data;
+diff --git a/src/lxc/confile.c b/src/lxc/confile.c
+index aa5c790..d0984b0 100644
+--- a/src/lxc/confile.c
++++ b/src/lxc/confile.c
+@@ -2509,6 +2509,18 @@ static int add_cap_entry(struct lxc_conf *conf, char *caps, bool keep)
+ 			continue;
+ 		}
+

_service:tar_scm:0009-fix-HOME-env-of-container-unset-error.patch Deleted

@@ -1,316 +0,0 @@
-From 043b2483585a2d8168e0fde8b37054733a31f263 Mon Sep 17 00:00:00 2001
-From: haozi007 <liuhao27@huawei.com>
-Date: Mon, 25 Jul 2022 15:36:23 +0800
-Subject: PATCH fix HOME env of container unset error
-
-Signed-off-by: haozi007 <liuhao27@huawei.com>
----
- src/lxc/isulad_utils.c | 210 ++++++++++++++++++++++++++++++++++++++++-
- src/lxc/isulad_utils.h |   3 +
- src/lxc/start.c        |  14 +--
- 3 files changed, 216 insertions(+), 11 deletions(-)
-
-diff --git a/src/lxc/isulad_utils.c b/src/lxc/isulad_utils.c
-index 15d9323..cd7fca8 100644
---- a/src/lxc/isulad_utils.c
-+++ b/src/lxc/isulad_utils.c
-@@ -6,6 +6,10 @@
-  * Create: 2020-04-11
- ******************************************************************************/
- 
-+#ifndef _GNU_SOURCE
-+#define _GNU_SOURCE 1
-+#endif
-+
- #include <stdlib.h>
- #include <string.h>
- #include <sys/types.h>
-@@ -13,6 +17,10 @@
- #include <fcntl.h>
- #include <pwd.h>
- #include <ctype.h>
-+#include <stdio.h>
-+#include <unistd.h>
-+#include <errno.h>
-+#include <stdio_ext.h>
- 
- #include "isulad_utils.h"
- #include "log.h"
-@@ -244,20 +252,34 @@ out:
- // isulad: set env home in container
- int lxc_setup_env_home(uid_t uid)
- {
-+#define __PASSWD_FILE__ "/etc/passwd"
- 	char *homedir = "/"; // default home dir is /
-+	FILE *stream = NULL;
- 	struct passwd pw, *pwbufp = NULL;
- 	char bufBUFSIZ;
--	int ret;
- 
--	ret = getpwuid_r(uid, &pw, buf, sizeof(buf), &pwbufp);
--	if ((ret == 0) && (pwbufp != NULL) && (pwbufp->pw_uid == uid)) {
--		homedir = pwbufp->pw_dir;
-+	stream = fopen_cloexec(__PASSWD_FILE__, "r");
-+	if (stream == NULL) {
-+		SYSWARN("Failed to open %s", __PASSWD_FILE__);
- 		goto set_env;
- 	}
- 
-+#if IS_BIONIC
-+	while (util_getpwent_r(stream, &pw, buf, sizeof(buf), &pwbufp) == 0 && pwbufp != NULL) {
-+#else
-+	while (fgetpwent_r(stream, &pw, buf, sizeof(buf), &pwbufp) == 0 && pwbufp != NULL) {
-+#endif
-+		if (pwbufp->pw_uid == uid) {
-+			homedir = pwbufp->pw_dir;
-+			goto set_env;
-+		}
-+	}
- 	WARN("User invalid, can not find user '%u'", uid);
- 
- set_env:
-+	if (stream)
-+		fclose(stream);
-+
- 	// if we didn't configure HOME, set it based on uid
- 	if (setenv("HOME", homedir, 0) < 0) {
- 		SYSERROR("Unable to set env 'HOME'");
-@@ -317,3 +339,183 @@ bool is_non_negative_num(const char *s)
- 	}
- 	return true;
- }
-+
-+static int hold_int(const char delim, bool required, char **src, unsigned int *dst)
-+{
-+    unsigned long long int res = 0;
-+    char *err_str = NULL;
-+
-+    // ensure *src not a empty string
-+    if (**src == '\0') {
-+        ERROR("Empty subject on given entrie is not allowed.");
-+        return -1;
-+    }
-+
-+    errno = 0;
-+    // covert string to long long
-+    res = strtoull(*src, &err_str, 0);
-+    if (errno != 0 && errno != ERANGE) {
-+        ERROR("Parse int from string failed.");
-+        return -1;
-+    }
-+
-+    // **src is not a digit
-+    if (err_str == *src) {
-+        if (!required) {
-+            ERROR("Integer part is missing.");
-+            return -1;
-+        }
-+        // if required, just set 0
-+        *dst = 0;
-+    } else {
-+        if (sizeof(void *) > 4 && res > UINT_MAX) { // make sure 64-bit platform behave same as 32-bit
-+            res = UINT_MAX;
-+        }
-+        res = res & UINT_MAX;
-+        *dst = (uint32_t)res;
-+    }
-+
-+    // normal case
-+    if (*err_str == delim) {
-+        err_str++;
-+    } else if (*err_str != '\0') {
-+        ERROR("Invalid digit string.");
-+        return -1;
-+    }
-+
-+    *src = err_str; // update src to next valid context in line.
-+    return 0;
-+}
-+
-+static void hold_string(const char delim, char **src, char **dst)
-+{
-+    for (*dst = *src; **src != delim; ++(*src)) {
-+        if (**src == '\0') {
-+            break;
-+        }
-+    }
-+
-+    if (**src == delim) {
-+        **src = '\0';
-+        ++(*src);
-+    }
-+}
-+
-+static int parse_line_pw(const char delim, char *line, struct passwd *result)
-+{
-+    int ret = 0;
-+    bool required = false;
-+    char *walker = NULL;
-+
-+    walker = strpbrk(line, "\n");
-+    if (walker != NULL) {
-+        // clear newline char
-+        *walker = '\0';
-+    }
-+
-+    hold_string(delim, &line, &result->pw_name);
-+
-+    required = (result->pw_name0 == '+' || result->pw_name0 == '-') ? true : false;
-+
-+    hold_string(delim, &line, &result->pw_passwd);
-+
-+    ret = hold_int(delim, required, &line, &result->pw_uid);
-+    if (ret != 0) {
-+        // a legitimate line must have uid
-+        ERROR("Parse uid error.");
-+        return ret;
-+    }
-+
-+    ret = hold_int(delim, required, &line, &result->pw_gid);
-+    if (ret != 0) {
-+        // it's ok to not provide gid
-+        ERROR("Parse gid error.");
-+        return ret;
-+    }
-+
-+    hold_string(delim, &line, &result->pw_gecos);
-+
-+    hold_string(delim, &line, &result->pw_dir);
-+
-+    result->pw_shell = line;
-+    return 0;
-+}
-+
-+char *util_left_trim_space(char *str)
-+{
-+    char *begin = str;
-+    char *tmp = str;
-+    while (isspace(*begin)) {
-+        begin++;
-+    }
-+    while ((*tmp++ = *begin++)) {
-+    }
-+    return str;
-+}
-+
-+int util_getpwent_r(FILE *stream, struct passwd *resbuf, char *buffer, size_t buflen, struct passwd **result)
-+{
-+    const char delim = ':';
-+    char *buff_end = NULL;

_service:tar_scm:0010-add-storage-block-code-for-embedded-image.patch Added

@@ -0,0 +1,219 @@
+From c0324e29b4494560ed68af50f7be814838e2bfc3 Mon Sep 17 00:00:00 2001
+From: zhangxiaoyu <zhangxiaoyu58@huawei.com>
+Date: Fri, 29 Dec 2023 16:26:13 +0800
+Subject: PATCH add storage block code for embedded image
+
+Signed-off-by: zhangxiaoyu <zhangxiaoyu58@huawei.com>
+---
+ src/lxc/meson.build       |  2 +
+ src/lxc/storage/block.c   | 86 +++++++++++++++++++++++++++++++++++++++
+ src/lxc/storage/block.h   | 41 +++++++++++++++++++
+ src/lxc/storage/storage.c | 24 +++++++++++
+ 4 files changed, 153 insertions(+)
+ create mode 100644 src/lxc/storage/block.c
+ create mode 100644 src/lxc/storage/block.h
+
+diff --git a/src/lxc/meson.build b/src/lxc/meson.build
+index 6c4ba6a..bffed73 100644
+--- a/src/lxc/meson.build
++++ b/src/lxc/meson.build
+@@ -145,6 +145,8 @@ if want_isulad
+         'exec_commands.h',
+         'isulad_utils.c',
+         'isulad_utils.h',
++        'storage/block.c',
++        'storage/block.h',
+         'path.c',
+         'path.h',
+         'json/defs.c',
+diff --git a/src/lxc/storage/block.c b/src/lxc/storage/block.c
+new file mode 100644
+index 0000000..eb75e70
+--- /dev/null
++++ b/src/lxc/storage/block.c
+@@ -0,0 +1,86 @@
++/*
++ * lxc: linux Container library
++ *
++ * (C) Copyright IBM Corp. 2007, 2008
++ *
++ * Authors:
++ * Daniel Lezcano <daniel.lezcano at free.fr>
++ *
++ * This library is free software; you can redistribute it and/or
++ * modify it under the terms of the GNU Lesser General Public
++ * License as published by the Free Software Foundation; either
++ * version 2.1 of the License, or (at your option) any later version.
++ *
++ * This library is distributed in the hope that it will be useful,
++ * but WITHOUT ANY WARRANTY; without even the implied warranty of
++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
++ * Lesser General Public License for more details.
++ *
++ * You should have received a copy of the GNU Lesser General Public
++ * License along with this library; if not, write to the Free Software
++ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
++ */
++
++#ifndef _GNU_SOURCE
++#define _GNU_SOURCE 1
++#endif
++#include <stdint.h>
++#include <string.h>
++
++#include "config.h"
++#include "log.h"
++#include "storage.h"
++#include "storage_utils.h"
++#include "utils.h"
++
++lxc_log_define(blk, lxc);
++
++int blk_destroy(struct lxc_storage *orig)
++{
++	return 0;
++}
++
++bool blk_detect(const char *path)
++{
++	struct stat statbuf;
++	int ret;
++
++	if (!strncmp(path, "blk:", 4))
++		return true;
++
++	ret = stat(path, &statbuf);
++	if (ret == -1 && errno == EPERM) {
++		SYSERROR("blk_detect: failed to look at \"%s\"", path);
++		return false;
++	}
++
++	if (ret == 0 && S_ISBLK(statbuf.st_mode))
++		return true;
++
++	return false;
++}
++
++int blk_mount(struct lxc_storage *bdev)
++{
++	const char *src;
++	if (strcmp(bdev->type, "blk"))
++		return -22;
++
++	if (!bdev->src || !bdev->dest)
++		return -22;
++
++	src = lxc_storage_get_path(bdev->src, bdev->type);
++
++	return mount_unknown_fs(src, bdev->dest, bdev->mntopts);
++}
++
++int blk_umount(struct lxc_storage *bdev)
++{
++	if (strcmp(bdev->type, "blk"))
++		return -22;
++
++	if (!bdev->src || !bdev->dest)
++		return -22;
++
++	return umount(bdev->dest);
++}
+diff --git a/src/lxc/storage/block.h b/src/lxc/storage/block.h
+new file mode 100644
+index 0000000..2fa7565
+--- /dev/null
++++ b/src/lxc/storage/block.h
+@@ -0,0 +1,41 @@
++/*
++ * lxc: linux Container library
++ *
++ * (C) Copyright IBM Corp. 2007, 2008
++ *
++ * Authors:
++ * Daniel Lezcano <daniel.lezcano at free.fr>
++ *
++ * This library is free software; you can redistribute it and/or
++ * modify it under the terms of the GNU Lesser General Public
++ * License as published by the Free Software Foundation; either
++ * version 2.1 of the License, or (at your option) any later version.
++ *
++ * This library is distributed in the hope that it will be useful,
++ * but WITHOUT ANY WARRANTY; without even the implied warranty of
++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
++ * Lesser General Public License for more details.
++ *
++ * You should have received a copy of the GNU Lesser General Public
++ * License along with this library; if not, write to the Free Software
++ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
++ */
++
++#ifndef __LXC_BLK_H
++#define __LXC_BLK_H
++
++#include <stdbool.h>
++#include <stdint.h>
++
++struct lxc_storage;
++
++struct bdev_specs;
++
++struct lxc_conf;
++
++extern int blk_destroy(struct lxc_storage *orig);
++extern bool blk_detect(const char *path);
++extern int blk_mount(struct lxc_storage *bdev);
++extern int blk_umount(struct lxc_storage *bdev);
++
++#endif /* __LXC_BLK_H */
+diff --git a/src/lxc/storage/storage.c b/src/lxc/storage/storage.c
+index 39756d0..2aa26f9 100644
+--- a/src/lxc/storage/storage.c
++++ b/src/lxc/storage/storage.c
+@@ -39,6 +39,10 @@
+ #include "storage_utils.h"
+ #include "utils.h"
+ #include "zfs.h"
++#ifdef HAVE_ISULAD
++#include "block.h"
++#endif
++
+ 
+ #if !HAVE_STRLCPY
+ #include "strlcpy.h"
+@@ -162,6 +166,22 @@ static const struct lxc_storage_ops zfs_ops = {
+     .can_backup = true,
+ };
+ 
++#ifdef HAVE_ISULAD
++/* block */
++static const struct lxc_storage_ops blk_ops = {
++    .detect = &blk_detect,
++    .mount = &blk_mount,
++    .umount = &blk_umount,
++    .clone_paths = NULL,
++    .destroy = &blk_destroy,
++    .create = NULL,
++    .copy = NULL,
++    .snapshot = NULL,
++    .can_snapshot = false,
++    .can_backup = true,

_service:tar_scm:0010-check-yajl-only-when-have-isulad.patch Deleted

@@ -1,70 +0,0 @@
-From d4cb8f6a8f46a3f5d72f22d7f79df83ad82215e0 Mon Sep 17 00:00:00 2001
-From: zhangxiaoyu <zhangxiaoyu58@huawei.com>
-Date: Mon, 25 Jul 2022 16:42:03 +0800
-Subject: PATCH check yajl only when have isulad
-
-Signed-off-by: zhangxiaoyu <zhangxiaoyu58@huawei.com>
----
- configure.ac        | 6 +++---
- src/lxc/Makefile.am | 7 +++++--
- src/lxc/af_unix.c   | 2 +-
- 3 files changed, 9 insertions(+), 6 deletions(-)
-
-diff --git a/configure.ac b/configure.ac
-index ce8854e..2180586 100644
---- a/configure.ac
-+++ b/configure.ac
-@@ -120,9 +120,6 @@ AM_CONDITIONAL(DISTRO_UBUNTU, test "x$with_distro" = "xubuntu")
- 
- AC_CONFIG_LINKS(config/etc/default.conf:config/etc/${distroconf})
- 
--# Check yajl
--PKG_CHECK_MODULES(YAJL, yajl >= 2,,AC_MSG_ERROR(You must install yajl >= 2))
--
- # Check for init system type
- AC_MSG_CHECKING(for init system type)
- AC_ARG_WITH(init-script,
-@@ -839,6 +836,9 @@ AM_CONDITIONAL(HAVE_ISULAD, test "x$adapt_isulad" = "xyes")
- if test "x$adapt_isulad" = "xyes"; then
- 	AC_DEFINE(HAVE_ISULAD, 1, adapt to iSulad)
- 	AC_MSG_RESULT(yes)
-+
-+	# Check yajl
-+	PKG_CHECK_MODULES(YAJL, yajl >= 2,,AC_MSG_ERROR(You must install yajl >= 2))
- else
- 	AC_MSG_RESULT(no)
- fi
-diff --git a/src/lxc/Makefile.am b/src/lxc/Makefile.am
-index b9a8750..61a229f 100644
---- a/src/lxc/Makefile.am
-+++ b/src/lxc/Makefile.am
-@@ -360,8 +360,11 @@ LDADD = liblxc.la \
- 	@OPENSSL_LIBS@ \
- 	@SECCOMP_LIBS@ \
- 	@SELINUX_LIBS@ \
--	@DLOG_LIBS@ \
--	@YAJL_LIBS@
-+	@DLOG_LIBS@
-+
-+if HAVE_ISULAD
-+	LDADD += @YAJL_LIBS@
-+endif
- 
- if ENABLE_TOOLS
- lxc_attach_SOURCES = tools/lxc_attach.c \
-diff --git a/src/lxc/af_unix.c b/src/lxc/af_unix.c
-index cb4233e..0be9368 100644
---- a/src/lxc/af_unix.c
-+++ b/src/lxc/af_unix.c
-@@ -382,7 +382,7 @@ int lxc_unix_connect_type(struct sockaddr_un *addr, int type)
- 		      offsetof(struct sockaddr_un, sun_path) + len);
- 	if (ret < 0)
- #ifdef HAVE_ISULAD
--		return log_error_errno(-1, errno,
-+		return log_warn_errno(-1, errno,
- 				       "Failed to connect new AF_UNIX socket");
- #else
- 		return log_error_errno(-1, errno,
--- 
-2.25.1
-

_service:tar_scm:0011-drop-security_context_t.patch Deleted

_service:tar_scm:0011-skip-setup-console-if-disable-pty-and-fix-syscontain.patch Added

@@ -0,0 +1,177 @@
+From 0d4216ef2cae2cc10b755b0403bfff0f377bdf17 Mon Sep 17 00:00:00 2001
+From: zhangxiaoyu <zhangxiaoyu58@huawei.com>
+Date: Thu, 4 Jan 2024 09:35:41 +0800
+Subject: PATCH skip setup console if disable pty and fix syscontainer-hooks
+ write devices rule useless
+
+Signed-off-by: zhangxiaoyu <zhangxiaoyu58@huawei.com>
+---
+ src/lxc/conf.c  | 16 +++++++++-----
+ src/lxc/start.c | 59 ++++++++++++++++++++++++++++---------------------
+ src/lxc/sync.h  | 10 ++++-----
+ 3 files changed, 48 insertions(+), 37 deletions(-)
+
+diff --git a/src/lxc/conf.c b/src/lxc/conf.c
+index 84b8baf..c73ba04 100644
+--- a/src/lxc/conf.c
++++ b/src/lxc/conf.c
+@@ -2318,6 +2318,12 @@ static int lxc_setup_console(const struct lxc_handler *handler,
+ 	if (!wants_console(console))
+ 		return log_trace(0, "Skipping console setup");
+ 
++#ifdef HAVE_ISULAD
++	if (handler->disable_pty) {
++		return 0;
++	}
++#endif
++
+ 	if (console->pty < 0)  {
+ 		/*
+ 		 * Allocate a console from the container's devpts instance. We
+@@ -4583,7 +4589,11 @@ static int lxc_recv_console_from_child(struct lxc_handler *handler)
+ 		return 0;
+ 
+ 	/* We've already allocated a console from the host's devpts instance. */
++#ifdef HAVE_ISULAD
++	if (console->disable_pty || console->pty >= 0)
++#else
+ 	if (console->pty >= 0)
++#endif
+ 		return 0;
+ 
+ 	ret = __lxc_abstract_unix_recv_two_fds(handler->data_sock1,
+@@ -4870,12 +4880,6 @@ int lxc_setup(struct lxc_handler *handler)
+ 	if (ret < 0)
+ 		return log_error(-1, "Failed to setup \"/dev\" symlinks");
+ 
+-#ifdef HAVE_ISULAD
+-	/* Ask father to run oci prestart hooks and wait for him to finish. */
+-	if (!lxc_sync_barrier_parent(handler, START_SYNC_OCI_PRESTART_HOOK)) {
+-		return log_error(-1, "Failed to sync parent to start host hook");
+-	}
+-#endif
+ 	ret = lxc_setup_rootfs_switch_root(&lxc_conf->rootfs);
+ 	if (ret < 0)
+ 		return log_error(-1, "Failed to pivot root into rootfs");
+diff --git a/src/lxc/start.c b/src/lxc/start.c
+index 1c8e258..0a5cb26 100644
+--- a/src/lxc/start.c
++++ b/src/lxc/start.c
+@@ -1608,10 +1608,11 @@ static int do_start(void *data)
+ 
+ 	close_prot_errno_disarm(devnull_fd);
+ 
+-#ifndef HAVE_ISULAD
++#ifdef HAVE_ISULAD
++	if (handler->disable_pty)
+ 	// setsid in lxc_setup() -> lxc_setup_console()
+-	setsid();
+ #endif
++	setsid();
+ 
+ 	if (handler->conf->init_cwd) {
+ #ifdef HAVE_ISULAD
+@@ -1642,6 +1643,11 @@ static int do_start(void *data)
+ 	}
+ 
+ #ifdef HAVE_ISULAD
++	/* Ask father to run oci prestart hooks and wait for him to finish. */
++	if (!lxc_sync_barrier_parent(handler, START_SYNC_OCI_PRESTART_HOOK)) {
++		return log_error(-1, "Failed to sync parent to start host hook");
++	}
++
+ 	/* close pipes after sync fds */
+ 	/* isulad: dup2 pipe00 to container stdin, pipe11 to container stdout, pipe21 to container stderr */
+ 	if (handler->disable_pty) {
+@@ -2377,29 +2383,6 @@ static int lxc_spawn(struct lxc_handler *handler)
+ 		goto out_delete_net;
+ 	}
+ 
+-#ifdef HAVE_ISULAD
+-	if (!lxc_sync_wait_child(handler, START_SYNC_OCI_PRESTART_HOOK))
+-		goto out_delete_net;
+-
+-	/* isulad: Run oci prestart hook at here */
+-	ret = run_oci_hooks(name, "oci-prestart", conf, lxcpath);
+-	if (ret < 0) {
+-		ERROR("Failed to run oci prestart hooks");
+-		goto out_delete_net;
+-	}
+-
+-	if (START_TIMEOUT == global_timeout_state) {
+-		lxc_write_error_message(conf->errpipe1, "Starting the container \"%s\" timeout.", name);
+-		ERROR("Starting the container \"%s\" timeout.", name);
+-		goto out_delete_net;
+-	}
+-
+-	/* Tell the child to continue its initialization. We'll get
+-	 * START_SYNC_POST_OCI_PRESTART_HOOK when it is ready for us to run oci prestart hooks.
+-	 */
+-	if (!lxc_sync_wake_child(handler, START_SYNC_POST_OCI_PRESTART_HOOK))
+-		goto out_delete_net;
+-#endif
+ 	if (!lxc_sync_wait_child(handler, START_SYNC_CGROUP_LIMITS))
+ 		goto out_delete_net;
+ 
+@@ -2433,6 +2416,32 @@ static int lxc_spawn(struct lxc_handler *handler)
+ 	if (!lxc_sync_wake_child(handler, START_SYNC_FDS))
+ 		goto out_delete_net;
+ 
++#ifdef HAVE_ISULAD
++	// OCI prestart hook should run after setup_limits_legacy.
++	// Otherwise 'syscontainer-hooks' write devices rule will be useless.
++	if (!lxc_sync_wait_child(handler, START_SYNC_OCI_PRESTART_HOOK))
++		goto out_delete_net;
++
++	/* isulad: Run oci prestart hook at here */
++	ret = run_oci_hooks(name, "oci-prestart", conf, lxcpath);
++	if (ret < 0) {
++		ERROR("Failed to run oci prestart hooks");
++		goto out_delete_net;
++	}
++
++	if (START_TIMEOUT == global_timeout_state) {
++		lxc_write_error_message(conf->errpipe1, "Starting the container \"%s\" timeout.", name);
++		ERROR("Starting the container \"%s\" timeout.", name);
++		goto out_delete_net;
++	}
++
++	/* Tell the child to continue its initialization. We'll get
++	 * START_SYNC_POST_OCI_PRESTART_HOOK when it is ready for us to run oci prestart hooks.
++	 */
++	if (!lxc_sync_wake_child(handler, START_SYNC_POST_OCI_PRESTART_HOOK))
++		goto out_delete_net;
++#endif
++
+ 	if (handler->ns_unshare_flags & CLONE_NEWCGROUP) {
+ 		/* Now we're ready to preserve the cgroup namespace */
+ 		ret = lxc_try_preserve_namespace(handler, LXC_NS_CGROUP, "cgroup");
+diff --git a/src/lxc/sync.h b/src/lxc/sync.h
+index 6802d32..b6080dd 100644
+--- a/src/lxc/sync.h
++++ b/src/lxc/sync.h
+@@ -20,17 +20,15 @@ enum /* start */ {
+ 	START_SYNC_CONFIGURE		=  1,
+ 	START_SYNC_POST_CONFIGURE	=  2,
+ 	START_SYNC_IDMAPPED_MOUNTS	=  3,
++	START_SYNC_CGROUP_LIMITS	=  4,
++	START_SYNC_FDS			=  5,
+ #ifdef HAVE_ISULAD
+-	START_SYNC_OCI_PRESTART_HOOK = 4,
+-	START_SYNC_POST_OCI_PRESTART_HOOK = 5,
+-	START_SYNC_CGROUP_LIMITS	=  6,
+-	START_SYNC_FDS			=  7,
++	START_SYNC_OCI_PRESTART_HOOK = 6,
++	START_SYNC_POST_OCI_PRESTART_HOOK = 7,
+ 	START_SYNC_READY_START		=  8,
+ 	START_SYNC_RESTART		=  9,
+ 	START_SYNC_POST_RESTART		=  10,
+ #else
+-	START_SYNC_CGROUP_LIMITS	=  4,
+-	START_SYNC_FDS			=  5,
+ 	START_SYNC_READY_START		=  6,
+ 	START_SYNC_RESTART		=  7,
+ 	START_SYNC_POST_RESTART		=  8,
+-- 
+2.25.1
+

_service:tar_scm:0012-fix-dev-mount-failed-and-skip-send-recv-devpts_fd-if.patch Added

@@ -0,0 +1,56 @@
+From 47513b0bd34217bb2032285ea03ae7e4508ba24d Mon Sep 17 00:00:00 2001
+From: zhangxiaoyu <zhangxiaoyu58@huawei.com>
+Date: Fri, 12 Jan 2024 16:40:32 +0800
+Subject: PATCH fix dev mount failed and skip send/recv devpts_fd if
+ disable_pty
+
+Signed-off-by: zhangxiaoyu <zhangxiaoyu58@huawei.com>
+---
+ src/lxc/conf.c | 17 +++++++++++++++++
+ 1 file changed, 17 insertions(+)
+
+diff --git a/src/lxc/conf.c b/src/lxc/conf.c
+index c73ba04..b61615d 100644
+--- a/src/lxc/conf.c
++++ b/src/lxc/conf.c
+@@ -1829,6 +1829,12 @@ static int lxc_recv_devpts_from_child(struct lxc_handler *handler)
+ {
+ 	int ret;
+ 
++#ifdef HAVE_ISULAD
++	if (handler->disable_pty) {
++		return 0;
++	}
++#endif
++
+ 	if (handler->conf->pty_max <= 0)
+ 		return 0;
+ 
+@@ -2066,6 +2072,12 @@ static int lxc_send_devpts_to_parent(struct lxc_handler *handler)
+ {
+ 	int ret;
+ 
++#ifdef HAVE_ISULAD
++	if (handler->disable_pty) {
++		return 0;
++	}
++#endif
++
+ 	if (handler->conf->pty_max <= 0)
+ 		return log_debug(0, "No devpts file descriptor will be sent since no pts devices are requested");
+ 
+@@ -4852,6 +4864,11 @@ int lxc_setup(struct lxc_handler *handler)
+ 		if (ret < 0) {
+ 			return log_error(-1, "Failed to setup new devpts instance for '%s'", name);
+ 		}
++	} else {
++		lxc_conf->devpts_fd = open_at(lxc_conf->rootfs.dfd_dev, "pts", PROTECT_OPATH_DIRECTORY, PROTECT_LOOKUP_BENEATH_XDEV, 0);
++		if (lxc_conf->devpts_fd < 0) {
++			return log_error(-1, "Failed to allocate console from container's devpts instance");
++		}
+ 	}
+ #else
+ 	ret = lxc_create_tmp_proc_mount(lxc_conf);
+-- 
+2.25.1
+

_service:tar_scm:0012-only-set-user-or-image-set-non-empty-HOME.patch Deleted

@@ -1,50 +0,0 @@
-From 7273c6631f692872384cce83cc04b4084ee98f73 Mon Sep 17 00:00:00 2001
-From: haozi007 <liuhao27@huawei.com>
-Date: Tue, 9 Aug 2022 17:30:59 +0800
-Subject: PATCH only set user or image set non-empty HOME
-
-Signed-off-by: haozi007 <liuhao27@huawei.com>
----
- src/lxc/isulad_utils.c | 14 +++++++++++---
- 1 file changed, 11 insertions(+), 3 deletions(-)
-
-diff --git a/src/lxc/isulad_utils.c b/src/lxc/isulad_utils.c
-index cd7fca8..067e1c9 100644
---- a/src/lxc/isulad_utils.c
-+++ b/src/lxc/isulad_utils.c
-@@ -257,6 +257,13 @@ int lxc_setup_env_home(uid_t uid)
- 	FILE *stream = NULL;
- 	struct passwd pw, *pwbufp = NULL;
- 	char bufBUFSIZ;
-+	const char *curr_home = NULL;
-+
-+	curr_home = getenv("HOME");
-+	// if user set or image set, just use it.
-+	if (curr_home != NULL && strcmp(curr_home, "") != 0) {
-+		return 0;
-+	}
- 
- 	stream = fopen_cloexec(__PASSWD_FILE__, "r");
- 	if (stream == NULL) {
-@@ -280,8 +287,9 @@ set_env:
- 	if (stream)
- 		fclose(stream);
- 
--	// if we didn't configure HOME, set it based on uid
--	if (setenv("HOME", homedir, 0) < 0) {
-+	// if we didn't configure HOME, set it based on uid;
-+	// override it if reach here.
-+	if (setenv("HOME", homedir, 1) < 0) {
- 		SYSERROR("Unable to set env 'HOME'");
- 		return -1;
- 	}
-@@ -518,4 +526,4 @@ int util_getpwent_r(FILE *stream, struct passwd *resbuf, char *buffer, size_t bu
- out:
-     funlockfile(stream);
-     return ret;
--}
-\ No newline at end of file
-+}
--- 
-2.25.1
-

_service:tar_scm:0013-return-fail-if-no-args-or-no-rootfs-path-found.patch Deleted

@@ -1,38 +0,0 @@
-From a2aff3425a6f35bdb9f83880a1545b89606bf7c9 Mon Sep 17 00:00:00 2001
-From: WangFengTu <wangfengtu@huawei.com>
-Date: Fri, 19 Aug 2022 14:32:22 +0800
-Subject: PATCH return fail if no args or no rootfs path found
-
-Signed-off-by: WangFengTu <wangfengtu@huawei.com>
----
- src/lxc/lxccontainer.c | 14 ++++++++++++++
- 1 file changed, 14 insertions(+)
-
-diff --git a/src/lxc/lxccontainer.c b/src/lxc/lxccontainer.c
-index 3f75184..4b669bb 100644
---- a/src/lxc/lxccontainer.c
-+++ b/src/lxc/lxccontainer.c
-@@ -1030,6 +1030,20 @@ static bool do_lxcapi_start(struct lxc_container *c, int useinit, char * const a
- 		argv = init_cmd = use_init_args(conf->init_argv, conf->init_argc);
- 	}
- 
-+	// do not allow using default rootfs path when isulad
-+	if (conf->rootfs.mount == NULL) {
-+		ERROR("Empty rootfs path detected");
-+		lxc_put_handler(handler);
-+		return false;
-+	}
-+
-+	// do not allow using default args when isulad
-+	if (!argv) {
-+		ERROR("Empty args detected");
-+		lxc_put_handler(handler);
-+		return false;
-+	}
-+
- 	if (c->image_type_oci) {
- 		handler->image_type_oci = true;
- 	}
--- 
-2.25.1
-

_service:tar_scm:0014-fix-tools-using-option-give-error-message.patch Deleted

@@ -1,25 +0,0 @@
-From cce266a71a8998e17abada2a7e716298c2169208 Mon Sep 17 00:00:00 2001
-From: Neil.wrz<wangrunze13@huawei.com>
-Date: Thu, 1 Sep 2022 05:04:56 -0700
-Subject: PATCH fix tools using '-?' option give error message
-
-Signed-off-by: Neil.wrz<wangrunze13@huawei.com> 
----
- src/lxc/tools/arguments.h | 1 +
- 1 file changed, 1 insertion(+)
-
-diff --git a/src/lxc/tools/arguments.h b/src/lxc/tools/arguments.h
-index c16d99f..80c2083 100644
---- a/src/lxc/tools/arguments.h
-+++ b/src/lxc/tools/arguments.h
-@@ -145,6 +145,7 @@ struct lxc_arguments {
- #define LXC_COMMON_OPTIONS                                                     \
- 	    { "name",        required_argument, 0, 'n'         },              \
- 	    { "help",        no_argument,       0, 'h'         },              \
-+	    { "help",        no_argument,       0, '?'         },              \
- 	    { "usage",       no_argument,       0, OPT_USAGE   },              \
- 	    { "version",     no_argument,       0, OPT_VERSION },              \
- 	    { "quiet",       no_argument,       0, 'q'         },              \
--- 
-2.25.1
-

_service:tar_scm:0015-fix-do-mask-pathes-after-parent-mounted.patch Deleted

@@ -1,44 +0,0 @@
-From 96a35e077d21a1abf1cc3819fb842b8089ee268d Mon Sep 17 00:00:00 2001
-From: isuladci <isulad@ci.com>
-Date: Tue, 20 Sep 2022 01:40:18 -0700
-Subject: PATCH fix do mask pathes after parent mounted
-
-Signed-off-by: isuladci <isulad@ci.com>
----
- src/lxc/conf.c | 14 +++++++-------
- 1 file changed, 7 insertions(+), 7 deletions(-)
-
-diff --git a/src/lxc/conf.c b/src/lxc/conf.c
-index 378cf9f..439601a 100644
---- a/src/lxc/conf.c
-+++ b/src/lxc/conf.c
-@@ -3975,19 +3975,19 @@ int lxc_setup(struct lxc_handler *handler)
- 	}
- 
- #ifdef HAVE_ISULAD
--	// isulad: setup rootfs masked paths
--	if (!lxc_list_empty(&lxc_conf->rootfs.maskedpaths)) {
--		if (setup_rootfs_maskedpaths(&lxc_conf->rootfs.maskedpaths)) {
--			return log_error(-1, "failed to setup maskedpaths");
--		}
--	}
--
- 	// isulad: setup rootfs ro paths
- 	if (!lxc_list_empty(&lxc_conf->rootfs.ropaths)) {
- 		if (setup_rootfs_ropaths(&lxc_conf->rootfs.ropaths)) {
- 			return log_error(-1, "failed to setup readonlypaths");
- 		}
- 	}
-+	
-+	// isulad: setup rootfs masked paths
-+	if (!lxc_list_empty(&lxc_conf->rootfs.maskedpaths)) {
-+		if (setup_rootfs_maskedpaths(&lxc_conf->rootfs.maskedpaths)) {
-+			return log_error(-1, "failed to setup maskedpaths");
-+		}
-+	}
- 
- 	//isulad: system container, remount /proc/sys/xxx by mount_list
- 	if (lxc_conf->systemd != NULL && strcmp(lxc_conf->systemd, "true") == 0) {
--- 
-2.25.1
-

_service:tar_scm:0016-skip-kill-cgroup-processes-if-no-hierarchies.patch Deleted

@@ -1,36 +0,0 @@
-From 2aa9204b74c96413944a715408cfd5d2f3a34d66 Mon Sep 17 00:00:00 2001
-From: isuladci <isulad@ci.com>
-Date: Thu, 22 Sep 2022 10:44:26 +0800
-Subject: PATCH skip kill cgroup processes if no hierarchies
-
-Signed-off-by: isuladci <isulad@ci.com>
----
- src/lxc/cgroups/isulad_cgfsng.c | 7 +++----
- 1 file changed, 3 insertions(+), 4 deletions(-)
-
-diff --git a/src/lxc/cgroups/isulad_cgfsng.c b/src/lxc/cgroups/isulad_cgfsng.c
-index 8a9656a..f5cf81c 100644
---- a/src/lxc/cgroups/isulad_cgfsng.c
-+++ b/src/lxc/cgroups/isulad_cgfsng.c
-@@ -677,15 +677,14 @@ __cgfsng_ops static bool isulad_cgfsng_payload_destroy(struct cgroup_ops *ops,
- 		return false;
- 	}
- 
--#ifdef HAVE_ISULAD
- 	if (ops->no_controller) {
--		DEBUG("no controller found, isgnore isulad_cgfsng_payload_destroy");
-+		DEBUG("no controller found, ignore isulad_cgfsng_payload_destroy");
- 		return true;
- 	}
--#endif
- 
- 	if (!ops->hierarchies) {
--		return false;
-+		DEBUG("no hierarchies found, ignore isulad_cgfsng_payload_destroy");
-+		return true;
- 	}
- 
- 	if (!handler) {
--- 
-2.25.1
-

_service:tar_scm:0017-lxc-Add-sw64-architecture.patch Deleted

_service:tar_scm:0018-add-macro-to-adapt-musl-libc.patch Deleted

_service:tar_scm:0019-add-lxc-attach-add-gids-option.patch Deleted

@@ -1,178 +0,0 @@
-From 90512fd67873600a490d2432e6c9429771f719be Mon Sep 17 00:00:00 2001
-From: isuladci <isulad@ci.com>
-Date: Fri, 2 Dec 2022 18:52:39 +0800
-Subject: PATCH add lxc-attach add-gids option
-
-Signed-off-by: isuladci <isulad@ci.com>
----
- src/lxc/attach.c           | 13 ++++++--
- src/lxc/attach_options.h   |  2 ++
- src/lxc/tools/arguments.h  |  3 ++
- src/lxc/tools/lxc_attach.c | 65 ++++++++++++++++++++++++++++++++++++++
- 4 files changed, 80 insertions(+), 3 deletions(-)
-
-diff --git a/src/lxc/attach.c b/src/lxc/attach.c
-index 8a2c52a..24d020d 100644
---- a/src/lxc/attach.c
-+++ b/src/lxc/attach.c
-@@ -1019,9 +1019,16 @@ static int attach_child_main(struct attach_clone_payload *payload)
- 		goto on_error;
- 	}
- 
--	if (!lxc_setgroups(init_ctx->container->lxc_conf->init_groups_len,
--			init_ctx->container->lxc_conf->init_groups))
--		goto on_error;
-+	if (options->add_gids != NULL && options->add_gids_len != 0) {
-+		if (!lxc_setgroups(options->add_gids_len, options->add_gids)) {
-+			goto on_error;
-+		}
-+	} else {
-+		if (!lxc_setgroups(init_ctx->container->lxc_conf->init_groups_len,
-+				init_ctx->container->lxc_conf->init_groups)) {
-+			goto on_error;
-+		}
-+	}
- #endif
- 
- 	/* Make sure that the processes STDIO is correctly owned by the user that we are switching to */
-diff --git a/src/lxc/attach_options.h b/src/lxc/attach_options.h
-index 16b4e21..4591d65 100644
---- a/src/lxc/attach_options.h
-+++ b/src/lxc/attach_options.h
-@@ -124,6 +124,8 @@ typedef struct lxc_attach_options_t {
- 	const char *suffix;
- 	bool disable_pty;
- 	bool open_stdin;
-+	gid_t *add_gids; /* attach user additional gids */
-+	size_t add_gids_len;
- #endif
- } lxc_attach_options_t;
- 
-diff --git a/src/lxc/tools/arguments.h b/src/lxc/tools/arguments.h
-index 80c2083..583390a 100644
---- a/src/lxc/tools/arguments.h
-+++ b/src/lxc/tools/arguments.h
-@@ -50,6 +50,8 @@ struct lxc_arguments {
- 	int open_stdin;
- 	unsigned int start_timeout; /* isulad: Seconds for waiting on a container to start before it is killed*/
- 	int64_t attach_timeout; /* for lxc-attach */
-+	gid_t *add_gids;
-+	size_t add_gids_len;
- #endif
- 
- 	/* for lxc-console */
-@@ -175,6 +177,7 @@ struct lxc_arguments {
- #define OPT_OPEN_STDIN OPT_USAGE - 14
- #define OPT_ATTACH_TIMEOUT OPT_USAGE - 15
- #define OPT_ATTACH_SUFFIX OPT_USAGE - 16
-+#define OPT_ADDITIONAL_GIDS OPT_USAGE - 17
- #endif
- 
- extern int lxc_arguments_parse(struct lxc_arguments *args, int argc,
-diff --git a/src/lxc/tools/lxc_attach.c b/src/lxc/tools/lxc_attach.c
-index 1a5a241..f6ddf2d 100644
---- a/src/lxc/tools/lxc_attach.c
-+++ b/src/lxc/tools/lxc_attach.c
-@@ -78,6 +78,7 @@ static const struct option my_longopts = {
- #else
- 	{"workdir", required_argument, 0, 'w'},
- 	{"user", required_argument, 0, 'u'},
-+	{"add-gids", required_argument, 0, OPT_ADDITIONAL_GIDS},
- 	{"in-fifo", required_argument, 0, OPT_INPUT_FIFO}, /* isulad add terminal fifos*/
- 	{"out-fifo", required_argument, 0, OPT_OUTPUT_FIFO},
- 	{"err-fifo", required_argument, 0, OPT_STDERR_FIFO},
-@@ -146,6 +147,7 @@ Options :\n\
- "\
-   -w, --workdir     Working directory inside the container.\n\
-   -u, --user        User ID (format: UID:GID)\n\
-+      --add-gids    Additional gids (format: GID,GID)\n\
-       --in-fifo     Stdin fifo path\n\
-       --out-fifo    Stdout fifo path\n\
-       --err-fifo    Stderr fifo path\n\
-@@ -228,6 +230,58 @@ static int get_attach_uid_gid(const char *username, uid_t *user_id, gid_t *group
- 	free(tmp);
- 	return 0;
- }
-+
-+static int get_attach_add_gids(const char *add_gids, gid_t **gids, size_t *gids_len)
-+{
-+	long long int readvalue;
-+	size_t i, len;
-+	const size_t max_gids = 100;
-+	gid_t *g = NULL;
-+	__do_free_string_list char **gids_str = NULL;
-+
-+	if (add_gids == NULL || strlen(add_gids) == 0) {
-+		ERROR("None additional gids");
-+		return -1;
-+	}
-+
-+	gids_str = lxc_string_split(add_gids, ',');
-+	if (gids_str == NULL) {
-+		ERROR("Failed to split additional gids");
-+		return -1;
-+	}
-+
-+	len = lxc_array_len((void **)gids_str);
-+	if (len > max_gids) {
-+		ERROR("Too many gids");
-+		return -1;
-+	}
-+
-+	g = calloc(len, sizeof(gid_t));
-+	if (g == NULL) {
-+		ERROR("Out of memory");
-+		return -1;
-+	}
-+
-+	for (i = 0; i < len; i++) {
-+		if (lxc_safe_long_long(gids_stri, &readvalue) != 0) {
-+			SYSERROR("Invalid gid value %s", gids_stri);
-+			goto err_out;
-+		}
-+		if (readvalue < 0) {
-+			ERROR("Invalid gid value: %lld", readvalue);
-+			goto err_out;
-+		}
-+		gi = (unsigned int)readvalue;
-+	}
-+
-+	*gids = g;
-+	*gids_len = len;
-+	return 0;
-+
-+err_out:
-+	free(g);
-+	return -1;
-+}
- #endif
- 
- static int my_parser(struct lxc_arguments *args, int c, char *arg)
-@@ -331,6 +385,12 @@ static int my_parser(struct lxc_arguments *args, int c, char *arg)
- 	case OPT_OPEN_STDIN:
- 		args->open_stdin = 1;
- 		break;
-+	case OPT_ADDITIONAL_GIDS:
-+		if (get_attach_add_gids(arg, &args->add_gids, &args->add_gids_len) != 0) {
-+			ERROR("Failed to get attach additional gids");
-+			return -1;
-+		}
-+		break;
- #endif
- 	}
- 
-@@ -655,6 +715,11 @@ int main(int argc, char *argv)
- 		attach_options.initial_cwd = my_args.workdir;
- 	}
- 
-+	if (my_args.add_gids) {
-+		attach_options.add_gids = my_args.add_gids;
-+		attach_options.add_gids_len = my_args.add_gids_len;
-+	}
-+
- 	/* isulad: add do attach background */
- 	if (attach_options.attach_flags & LXC_ATTACH_TERMINAL)
- 		wexit = do_attach_foreground(c, &command, &attach_options, &errmsg);
--- 
-2.25.1
-

_service:tar_scm:0020-add-sscanf-adapation-code-for-musl.patch Deleted

@@ -1,31 +0,0 @@
-From 3cefa43ec2f5f0366c470290d48bdcd88690cf90 Mon Sep 17 00:00:00 2001
-From: isuladci <isulad@ci.com>
-Date: Thu, 8 Dec 2022 09:48:29 +0800
-Subject: PATCH add sscanf adapation code for musl
-
-Signed-off-by: isuladci <isulad@ci.com>
----
- src/lxc/isulad_utils.c | 6 ++++++
- 1 file changed, 6 insertions(+)
-
-diff --git a/src/lxc/isulad_utils.c b/src/lxc/isulad_utils.c
-index 067e1c9..ee39302 100644
---- a/src/lxc/isulad_utils.c
-+++ b/src/lxc/isulad_utils.c
-@@ -173,7 +173,13 @@ static proc_t *lxc_stat2proc(const char *S)
-     (void)memset(P, 0x00, sizeof(proc_t));
- 
-     /* parse these two strings separately, skipping the leading "(". */
-+    /* https://www.openwall.com/lists/musl/2013/11/15/5: musl's sscanf("%15c",cmd) 
-+       requires exactly 15 characters; anything shorter is a matching failure. */
-+#ifdef __MUSL__
-+    num = sscanf(S, "%d (%15s", &P->pid, P->cmd);   /* comm16 in kernel */
-+#else
-     num = sscanf(S, "%d (%15c", &P->pid, P->cmd);   /* comm16 in kernel */
-+#endif
-     if (num != 2) {
-         ERROR("Call sscanf error: %s", errno ? strerror(errno) : "");
-         free(P);
--- 
-2.25.1
-

_service:tar_scm:0021-change-the-suffi-parameter-in-lxc-attach-help-output.patch Deleted

_service:tar_scm:0022-fix-cve-CVE-2022-47952-log-leaks-root-information.patch Deleted

@@ -1,51 +0,0 @@
-From 2b4d27ef9b5d9f38654277f021fabdda2d5f8e36 Mon Sep 17 00:00:00 2001
-From: isuladci <isulad@ci.com>
-Date: Thu, 12 Jan 2023 19:20:43 -0800
-Subject: PATCH fix cve CVE-2022-47952: log leaks root information
-
-Signed-off-by: isuladci <isulad@ci.com>
----
- src/lxc/cmd/lxc_user_nic.c | 14 +++++---------
- 1 file changed, 5 insertions(+), 9 deletions(-)
-
-diff --git a/src/lxc/cmd/lxc_user_nic.c b/src/lxc/cmd/lxc_user_nic.c
-index 4160565..5b848da 100644
---- a/src/lxc/cmd/lxc_user_nic.c
-+++ b/src/lxc/cmd/lxc_user_nic.c
-@@ -1087,20 +1087,16 @@ int main(int argc, char *argv)
- 	} else if (request == LXC_USERNIC_DELETE) {
- 		char opathLXC_PROC_PID_FD_LEN;
- 
--		/* Open the path with O_PATH which will not trigger an actual
--		 * open(). Don't report an errno to the caller to not leak
--		 * information whether the path exists or not.
--		 * When stracing setuid is stripped so this is not a concern
--		 * either.
--		 */
-+		// Keep in mind CVE-2022-47952: It's crucial not to leak any
-+		// information whether open() succeeded or failed.
- 		netns_fd = open(args.pid, O_PATH | O_CLOEXEC);
- 		if (netns_fd < 0) {
--			usernic_error("Failed to open \"%s\"\n", args.pid);
-+			usernic_error("Failed while opening netns file for \"%s\"\n", args.pid);
- 			_exit(EXIT_FAILURE);
- 		}
- 
- 		if (!fhas_fs_type(netns_fd, NSFS_MAGIC)) {
--			usernic_error("Path \"%s\" does not refer to a network namespace path\n", args.pid);
-+			usernic_error("Failed while opening netns file for \"%s\"\n", args.pid);
- 			close(netns_fd);
- 			_exit(EXIT_FAILURE);
- 		}
-@@ -1114,7 +1110,7 @@ int main(int argc, char *argv)
- 		/* Now get an fd that we can use in setns() calls. */
- 		ret = open(opath, O_RDONLY | O_CLOEXEC);
- 		if (ret < 0) {
--			CMD_SYSERROR("Failed to open \"%s\"\n", args.pid);
-+			CMD_SYSERROR("Failed while opening netns file for \"%s\"\n", args.pid);
- 			close(netns_fd);
- 			_exit(EXIT_FAILURE);
- 		}
--- 
-2.25.1
-

_service:tar_scm:0023-fix-lxc-write-error-message.patch Deleted

_service:tar_scm:0024-remove-process-inheritable-capability.patch Deleted

@@ -1,27 +0,0 @@
-From d232c098c9a75fce2b7e6da55faa89cd546d3dc9 Mon Sep 17 00:00:00 2001
-From: isuladci <isulad@ci.com>
-Date: Tue, 31 Jan 2023 19:14:57 +0800
-Subject: PATCH remove process inheritable capability
-
-Signed-off-by: zhangxiaoyu <zhangxiaoyu58@huawei.com>
----
- src/lxc/conf.c | 3 ++-
- 1 file changed, 2 insertions(+), 1 deletion(-)
-
-diff --git a/src/lxc/conf.c b/src/lxc/conf.c
-index 439601a..c478bf2 100644
---- a/src/lxc/conf.c
-+++ b/src/lxc/conf.c
-@@ -5528,7 +5528,8 @@ int lxc_drop_caps(struct lxc_conf *conf)
- 		if (caplisti) {
- 			cap_dataCAP_TO_INDEX(i).effective = cap_dataCAP_TO_INDEX(i).effective | (i > 31 ? __DEF_CAP_TO_MASK(i % 32) : __DEF_CAP_TO_MASK(i));
- 			cap_dataCAP_TO_INDEX(i).permitted = cap_dataCAP_TO_INDEX(i).permitted | (i > 31 ? __DEF_CAP_TO_MASK(i % 32) : __DEF_CAP_TO_MASK(i));
--			cap_dataCAP_TO_INDEX(i).inheritable = cap_dataCAP_TO_INDEX(i).inheritable | (i > 31 ? __DEF_CAP_TO_MASK(i % 32) : __DEF_CAP_TO_MASK(i));
-+			// fix CVE-2022-24769
-+			// inheritable capability should be empty
- 		}
- 	}
- 
--- 
-2.25.1
-

_service:tar_scm:0025-fix-ops-hierarchies-cause-coredump.patch Deleted

_service:tar_scm:0026-meminfo-cri-1.25.patch Deleted

@@ -1,55 +0,0 @@
-From d8bf23cac765af4bededef26e56f7cde7bafd4fe Mon Sep 17 00:00:00 2001
-From: "ilya.kuksenok" <ilya.kuksenok@huawei.com>
-Date: Mon, 27 Feb 2023 14:39:39 +0300
-Subject: PATCH Add metrics
-
-Signed-off-by: ilya.kuksenok <ilya.kuksenok@huawei.com>
----
- src/lxc/lxccontainer.c | 14 ++++++++++++++
- src/lxc/lxccontainer.h |  5 +++++
- 2 files changed, 19 insertions(+)
-
-diff --git a/src/lxc/lxccontainer.c b/src/lxc/lxccontainer.c
-index 4b669bb..afbeb3c 100644
---- a/src/lxc/lxccontainer.c
-+++ b/src/lxc/lxccontainer.c
-@@ -6053,6 +6053,20 @@ static bool do_lxcapi_get_container_metrics(struct lxc_container *c,  struct lxc
- 	metrics->cpu_use_nanos = metrics_get_ull(c, cgroup_ops, "cpuacct.usage");
- 	metrics->pids_current = metrics_get_ull(c, cgroup_ops, "pids.current");
- 
-+	uint64_t usage_bytes; 
-+	uint64_t workingset;
-+	usage_bytes = metrics_match_get_ull(c,cgroup_ops, "memory.stat", "rss", 1) +  
-+					    metrics_match_get_ull(c, cgroup_ops, "memory.stat", "cache", 1) + 
-+					    metrics_match_get_ull(c, cgroup_ops, "memory.stat", "swap", 1);
-+	// workingset = usage - inactive_file
-+	workingset = usage_bytes - metrics_match_get_ull(c, cgroup_ops, "memory.stat", "total_inactive_file", 1);
-+	// Avaliable bytes = limit - workingset 
-+	metrics->avaliable_bytes = metrics_get_ull(c, cgroup_ops, "memory.limit_in_bytes") - workingset;
-+	metrics->usage_bytes = usage_bytes;
-+	metrics->rss_bytes = metrics_match_get_ull(c,cgroup_ops, "memory.stat", "rss", 1);
-+	metrics->page_faults = metrics_match_get_ull(c,cgroup_ops, "memory.stat", "pgfault", 1);
-+	metrics->major_page_faults = metrics_match_get_ull(c,cgroup_ops, "memory.stat", "pgmajfault", 1);
-+
- 	metrics->cpu_use_user = metrics_match_get_ull(c, cgroup_ops, "cpuacct.stat", "user", 1);
- 	metrics->cpu_use_sys = metrics_match_get_ull(c, cgroup_ops, "cpuacct.stat", "system", 1);
- 
-diff --git a/src/lxc/lxccontainer.h b/src/lxc/lxccontainer.h
-index 3680ade..68dfec9 100644
---- a/src/lxc/lxccontainer.h
-+++ b/src/lxc/lxccontainer.h
-@@ -68,6 +68,11 @@ struct lxc_container_metrics {
-     /* Memory usage */
-     uint64_t mem_used;
-     uint64_t mem_limit;
-+    uint64_t avaliable_bytes;
-+    uint64_t usage_bytes;
-+    uint64_t rss_bytes;
-+    uint64_t page_faults;
-+    uint64_t major_page_faults;
-     /* Kernel Memory usage */
-     uint64_t kmem_used;
-     uint64_t kmem_limit;
--- 
-2.34.1
-

_service:tar_scm:0027-add-loongarch64-support-for-lxc.patch Deleted

@@ -1,238 +0,0 @@
-From 477ecc390bf4d62e8e02b98699b377b848b043de Mon Sep 17 00:00:00 2001
-From: Wenlong Zhang <zhangwenlong@loongson.cn>
-Date: Thu, 9 Feb 2023 08:18:35 +0000
-Subject: PATCH add loongarch64 support for lxc
-
----
- src/lxc/seccomp.c         | 51 +++++++++++++++++++++++++++++++++++++++
- src/lxc/syscall_numbers.h | 26 ++++++++++++++++++++
- 2 files changed, 77 insertions(+)
-
-diff --git a/src/lxc/seccomp.c b/src/lxc/seccomp.c
-index ebbba80..94dc23a 100644
---- a/src/lxc/seccomp.c
-+++ b/src/lxc/seccomp.c
-@@ -310,6 +310,7 @@ enum lxc_hostarch_t {
- 	lxc_seccomp_arch_ppc64,
- 	lxc_seccomp_arch_ppc64le,
- 	lxc_seccomp_arch_ppc,
-+	lxc_seccomp_arch_loongarch64,
- 	lxc_seccomp_arch_mips,
- 	lxc_seccomp_arch_mips64,
- 	lxc_seccomp_arch_mips64n32,
-@@ -344,6 +345,8 @@ int get_hostarch(void)
- 		return lxc_seccomp_arch_ppc64;
- 	else if (strncmp(uts.machine, "ppc", 3) == 0)
- 		return lxc_seccomp_arch_ppc;
-+	else if (strncmp(uts.machine, "loongarch64", 11) == 0)
-+		return lxc_seccomp_arch_loongarch64;
- 	else if (strncmp(uts.machine, "mips64", 6) == 0)
- 		return MIPS_ARCH_N64;
- 	else if (strncmp(uts.machine, "mips", 4) == 0)
-@@ -400,6 +403,11 @@ scmp_filter_ctx get_new_ctx(enum lxc_hostarch_t n_arch,
- 		arch = SCMP_ARCH_PPC;
- 		break;
- #endif
-+#ifdef SCMP_ARCH_LOONGARCH64
-+        case lxc_seccomp_arch_loongarch64:
-+                arch = SCMP_ARCH_LOONGARCH64;
-+                break;
-+#endif
- #ifdef SCMP_ARCH_MIPS
- 	case lxc_seccomp_arch_mips:
- 		arch = SCMP_ARCH_MIPS;
-@@ -738,6 +746,16 @@ static int parse_config_v2(FILE *f, char *line, size_t *line_bufsz, struct lxc_c
- 			goto bad;
- #endif
- #endif
-+#ifdef SCMP_ARCH_LOONGARCH64
-+	} else if (native_arch == lxc_seccomp_arch_loongarch64) {
-+		cur_rule_arch = lxc_seccomp_arch_all;
-+
-+		ctx.lxc_arch0 = lxc_seccomp_arch_loongarch64;
-+		ctx.contexts0 = get_new_ctx(lxc_seccomp_arch_loongarch64,
-+						  default_policy_action, &ctx.architectures0);
-+		if (!ctx.contexts0)
-+			goto bad;
-+#endif
- #ifdef SCMP_ARCH_MIPS
- 	} else if (native_arch == lxc_seccomp_arch_mips64) {
- 		cur_rule_arch = lxc_seccomp_arch_all;
-@@ -906,6 +924,17 @@ static int parse_config_v2(FILE *f, char *line, size_t *line_bufsz, struct lxc_c
- 				cur_rule_arch = lxc_seccomp_arch_ppc;
- 			}
- #endif
-+#ifdef SCMP_ARCH_LOONGARCH64
-+			else if (strcmp(line, "loongarch64") == 0 ||
-+				 strcmp(line, "LOONGARCH64") == 0) {
-+				if (native_arch != lxc_seccomp_arch_loongarch64) {
-+					cur_rule_arch = lxc_seccomp_arch_unknown;
-+					continue;
-+				}
-+
-+				cur_rule_arch = lxc_seccomp_arch_loongarch64;
-+			}
-+#endif
- #ifdef SCMP_ARCH_MIPS
- 			else if (strcmp(line, "mips64") == 0 ||
- 				 strcmp(line, "MIPS64") == 0) {
-@@ -1263,6 +1292,17 @@ static int parse_config_v2(FILE *f, char *line, size_t *line_bufsz, struct lxc_c
- 			goto bad;
- #endif
- #endif
-+#ifdef SCMP_ARCH_LOONGARCH64
-+	} else if (native_arch == lxc_seccomp_arch_loongarch64) {
-+		cur_rule_arch = lxc_seccomp_arch_all;
-+
-+		ctx.architectures0 = SCMP_ARCH_LOONGARCH64;
-+		ctx.contexts0 = get_new_ctx(lxc_seccomp_arch_loongarch64,
-+					      default_policy_action,
-+					      &ctx.needs_merge0);
-+		if (!ctx.contexts0)
-+			goto bad;
-+#endif
- #ifdef SCMP_ARCH_MIPS
- 	} else if (native_arch == lxc_seccomp_arch_mips64) {
- 		cur_rule_arch = lxc_seccomp_arch_all;
-@@ -1434,6 +1474,17 @@ static int parse_config_v2(FILE *f, char *line, size_t *line_bufsz, struct lxc_c
- 				cur_rule_arch = lxc_seccomp_arch_ppc;
- 			}
- #endif
-+#ifdef SCMP_ARCH_LOONGRCH64
-+			else if (strcmp(line, "loongarch64") == 0 ||
-+				 strcmp(line, "LOONGARCH64") == 0) {
-+				if (native_arch != lxc_seccomp_arch_loongarch64) {
-+					cur_rule_arch = lxc_seccomp_arch_unknown;
-+					continue;
-+				}
-+
-+				cur_rule_arch = lxc_seccomp_arch_loongarch64;
-+			}
-+#endif
- #ifdef SCMP_ARCH_MIPS
- 			else if (strcmp(line, "mips64") == 0 ||
- 				 strcmp(line, "MIPS64") == 0) {
-diff --git a/src/lxc/syscall_numbers.h b/src/lxc/syscall_numbers.h
-index c68cf24..01aa68d 100644
---- a/src/lxc/syscall_numbers.h
-+++ b/src/lxc/syscall_numbers.h
-@@ -49,6 +49,8 @@
- 		#if _MIPS_SIM == _MIPS_SIM_ABI64	/* n64 */
- 			#define __NR_keyctl 5241
- 		#endif
-+	#elif defined __loongarch64
-+		#define __NR_keyctl 219
- 	#else
- 		#define -1
- 		#warning "__NR_keyctl not defined for your architecture"
-@@ -84,6 +86,8 @@
- 		#if _MIPS_SIM == _MIPS_SIM_ABI64
- 			#define __NR_memfd_create 5314
- 		#endif
-+	#elif defined __loongarch64
-+		#define __NR_memfd_create 279
- 	#else
- 		#define -1
- 		#warning "__NR_memfd_create not defined for your architecture"
-@@ -117,6 +121,8 @@
- 		#if _MIPS_SIM == _MIPS_SIM_ABI64	/* n64 */
- 			#define __NR_pivot_root 5151
- 		#endif
-+	#elif defined __loongarch64
-+		#define __NR_pivot_root 41
- 	#else
- 		#define -1
- 		#warning "__NR_pivot_root not defined for your architecture"
-@@ -150,6 +156,8 @@
- 		#if _MIPS_SIM == _MIPS_SIM_ABI64	/* n64 */
- 			#define __NR_setns 5303
- 		#endif
-+	#elif defined __loongarch64
-+		#define __NR_setns 268
- 	#else
- 		#define -1
- 		#warning "__NR_setns not defined for your architecture"
-@@ -183,6 +191,8 @@
- 		#if _MIPS_SIM == _MIPS_SIM_ABI64	/* n64 */
- 			#define __NR_sethostname 5165
- 		#endif
-+	#elif defined __loongarch64
-+		#define __NR_sethostname 161
- 	#else
- 		#define -1
- 		#warning "__NR_sethostname not defined for your architecture"
-@@ -216,6 +226,8 @@
- 		#if _MIPS_SIM == _MIPS_SIM_ABI64	/* n64 */
- 			#define __NR_signalfd 5276
- 		#endif
-+	#elif defined __loongarch64
-+		#define __NR_signalfd -1		/* doesn't exist in loongarch64 */
- 	#else
- 		#define -1
- 		#warning "__NR_signalfd not defined for your architecture"
-@@ -249,6 +261,8 @@
- 		#if _MIPS_SIM == _MIPS_SIM_ABI64	/* n64 */
- 			#define __NR_signalfd4 5283
- 		#endif
-+	#elif defined __loongarch64
-+		#define __NR_signalfd4 74
- 	#else
- 		#define -1
- 		#warning "__NR_signalfd4 not defined for your architecture"
-@@ -282,6 +296,8 @@
- 		#if _MIPS_SIM == _MIPS_SIM_ABI64	/* n64 */
- 			#define __NR_unshare 5262
- 		#endif
-+	#elif defined __loongarch64
-+		#define __NR_unshare 97
- 	#else
- 		#define -1
- 		#warning "__NR_unshare not defined for your architecture"
-@@ -315,6 +331,8 @@
- 		#if _MIPS_SIM == _MIPS_SIM_ABI64	/* n64 */
- 			#define __NR_bpf 5315
- 		#endif
-+	#elif defined __loongarch64
-+		#define __NR_bpf 280
- 	#else
- 		#define -1
- 		#warning "__NR_bpf not defined for your architecture"

_service:tar_scm:0028-use-ocihooks-env-after-getenv.patch Deleted

@@ -1,51 +0,0 @@
-From 9c82e7c0d345eba3cc0514a536eb8438f328164e Mon Sep 17 00:00:00 2001
-From: zhangxiaoyu <zhangxiaoyu58@huawei.com>
-Date: Thu, 30 Mar 2023 11:38:45 +0800
-Subject: PATCH use ocihooks env after getenv
-
-Signed-off-by: zhangxiaoyu <zhangxiaoyu58@huawei.com>
----
- src/lxc/conf.c | 13 +++++++------
- 1 file changed, 7 insertions(+), 6 deletions(-)
-
-diff --git a/src/lxc/conf.c b/src/lxc/conf.c
-index c478bf2..3335b0d 100644
---- a/src/lxc/conf.c
-+++ b/src/lxc/conf.c
-@@ -6224,7 +6224,8 @@ static char **merge_ocihook_env(char **oldenvs, size_t env_len, size_t *merge_en
- {
- 	char **result  = NULL;
- 	size_t result_len = env_len;
--	size_t i, j;
-+	size_t i = 0;
-+	size_t j, k;
- 	char *tmpenv = NULL;
- 	char *lxc_envs = {"LD_LIBRARY_PATH", "PATH", "LXC_CGNS_AWARE", "LXC_PID", "LXC_ROOTFS_MOUNT",
- 	                    "LXC_CONFIG_FILE", "LXC_CGROUP_PATH", "LXC_ROOTFS_PATH", "LXC_NAME"
-@@ -6239,11 +6240,6 @@ static char **merge_ocihook_env(char **oldenvs, size_t env_len, size_t *merge_en
- 		return NULL;
- 	memset(result, 0, sizeof(char *) * result_len);
- 
--	for(i = 0; i < env_len; i++) {
--		if (oldenvsi)
--			resulti = safe_strdup(oldenvsi);
--	}
--
- 	for(j = 0; j < (sizeof(lxc_envs) / sizeof(char *)); j++) {
- 		size_t env_buf_len = 0;
- 		tmpenv = getenv(lxc_envsj);
-@@ -6267,6 +6263,11 @@ static char **merge_ocihook_env(char **oldenvs, size_t env_len, size_t *merge_en
- 		}
- 	}
- 
-+	for(k = 0; k < env_len; k++) {
-+		if (oldenvsk && i < (result_len - 1))
-+			resulti++ = safe_strdup(oldenvsk);
-+	}
-+
- 	*merge_env_len = i;
- 	return result;
- }
--- 
-2.25.1
-

_service:tar_scm:0029-fix-mixed-use-of-signed-and-unsigned-type.patch Deleted

@@ -1,51 +0,0 @@
-From 573aae0ba3b76067e76206b78c8243b34e3f40e3 Mon Sep 17 00:00:00 2001
-From: "Neil.wrz" <wangrunze13@huawei.com>
-Date: Tue, 18 Apr 2023 00:05:27 -0700
-Subject: PATCH fix mixed use of signed and unsigned type
-
-Signed-off-by: Neil.wrz <wangrunze13@huawei.com>
----
- src/lxc/path.c | 8 ++++----
- 1 file changed, 4 insertions(+), 4 deletions(-)
-
-diff --git a/src/lxc/path.c b/src/lxc/path.c
-index 46256cb..c0529b7 100644
---- a/src/lxc/path.c
-+++ b/src/lxc/path.c
-@@ -101,7 +101,7 @@ bool filepath_split(const char *path, char **dir, char **base)
- 		ERROR("Invalid path");
- 		return false;
- 	}
--	i = len - 1;
-+	i = (ssize_t)(len - 1);
- 	while (i >= 0 && pathi != '/')
- 		i--;
- 
-@@ -326,7 +326,7 @@ static int do_get_symlinks(const char **fullpath, const char *prefix, size_t pre
- 	}
- 
- 	len = strlen(*end);
--	if (len >= PATH_MAX - n) {
-+	if (len >= (size_t)(PATH_MAX - n)) {
- 		ERROR("Path is too long");
- 		goto out;
- 	}
-@@ -619,7 +619,7 @@ char *path_relative(const char *basepath, const char *targpath)
- 
- 	if (b0 != bl) {
- 		// Base elements left. Must go up before going down.
--		int seps = 0, i;
-+		size_t seps = 0, i;
- 		size_t ncopyed = 0, seps_size;
- 		char *buf = NULL;
- 
-@@ -652,4 +652,4 @@ char *path_relative(const char *basepath, const char *targpath)
- 	}
- 
- 	return safe_strdup(targ + t0);
--}
-\ No newline at end of file
-+}
--- 
-2.25.1
-

_service:tar_scm:0030-remove-unused-meminfo-stats.patch Deleted

@@ -1,48 +0,0 @@
-From 4daa1572b9f129ba46cefb13683de90b49404872 Mon Sep 17 00:00:00 2001
-From: zhangxiaoyu <zhangxiaoyu58@huawei.com>
-Date: Tue, 18 Apr 2023 15:22:21 +0800
-Subject: PATCH remove unused meminfo stats
-
-Signed-off-by: zhangxiaoyu <zhangxiaoyu58@huawei.com>
----
- src/lxc/lxccontainer.c | 10 ----------
- src/lxc/lxccontainer.h |  2 --
- 2 files changed, 12 deletions(-)
-
-diff --git a/src/lxc/lxccontainer.c b/src/lxc/lxccontainer.c
-index afbeb3c..cc6c5cd 100644
---- a/src/lxc/lxccontainer.c
-+++ b/src/lxc/lxccontainer.c
-@@ -6053,16 +6053,6 @@ static bool do_lxcapi_get_container_metrics(struct lxc_container *c,  struct lxc
- 	metrics->cpu_use_nanos = metrics_get_ull(c, cgroup_ops, "cpuacct.usage");
- 	metrics->pids_current = metrics_get_ull(c, cgroup_ops, "pids.current");
- 
--	uint64_t usage_bytes; 
--	uint64_t workingset;
--	usage_bytes = metrics_match_get_ull(c,cgroup_ops, "memory.stat", "rss", 1) +  
--					    metrics_match_get_ull(c, cgroup_ops, "memory.stat", "cache", 1) + 
--					    metrics_match_get_ull(c, cgroup_ops, "memory.stat", "swap", 1);
--	// workingset = usage - inactive_file
--	workingset = usage_bytes - metrics_match_get_ull(c, cgroup_ops, "memory.stat", "total_inactive_file", 1);
--	// Avaliable bytes = limit - workingset 
--	metrics->avaliable_bytes = metrics_get_ull(c, cgroup_ops, "memory.limit_in_bytes") - workingset;
--	metrics->usage_bytes = usage_bytes;
- 	metrics->rss_bytes = metrics_match_get_ull(c,cgroup_ops, "memory.stat", "rss", 1);
- 	metrics->page_faults = metrics_match_get_ull(c,cgroup_ops, "memory.stat", "pgfault", 1);
- 	metrics->major_page_faults = metrics_match_get_ull(c,cgroup_ops, "memory.stat", "pgmajfault", 1);
-diff --git a/src/lxc/lxccontainer.h b/src/lxc/lxccontainer.h
-index 68dfec9..96db5e6 100644
---- a/src/lxc/lxccontainer.h
-+++ b/src/lxc/lxccontainer.h
-@@ -68,8 +68,6 @@ struct lxc_container_metrics {
-     /* Memory usage */
-     uint64_t mem_used;
-     uint64_t mem_limit;
--    uint64_t avaliable_bytes;
--    uint64_t usage_bytes;
-     uint64_t rss_bytes;
-     uint64_t page_faults;
-     uint64_t major_page_faults;
--- 
-2.25.1
-

_service:tar_scm:0031-lxc-attach-Fix-lost-return-codes-of-spawned-processe.patch Deleted

@@ -1,39 +0,0 @@
-From 4ebca5a005afbc19c08f663e24d3e76518d12fa8 Mon Sep 17 00:00:00 2001
-From: Mohammed Ajmal Siddiqui <ajmalsiddiqui21@gmail.com>
-Date: Wed, 5 Oct 2022 12:20:58 +0530
-Subject: PATCH lxc-attach: Fix lost return codes of spawned processes that
- are killed
-
-lxc-attach swallows the return codes of processes that are terminated
-via a signal, and by default exits with a return code of 0 (i.e.
-indicating success) even if the command it tried to execute was
-terminated.
-
-This patch fixes it by explicitly checking if the process was terminated
-via a signal, and returning an appropriate exit code.
-
-Note that we add 128 to the signal value to generate the exit code
-because by convention the exit code is 128 + signal number. e.g. if a
-process is killed via signal 9, then the error code is 9 + 128 = 137.
-
-Signed-off-by: Mohammed Ajmal Siddiqui <ajmalsiddiqui21@gmail.com>
----
- src/lxc/tools/lxc_attach.c | 2 ++
- 1 file changed, 2 insertions(+)
-
-diff --git a/src/lxc/tools/lxc_attach.c b/src/lxc/tools/lxc_attach.c
-index fa303c7b4..6482b0aee 100644
---- a/src/lxc/tools/lxc_attach.c
-+++ b/src/lxc/tools/lxc_attach.c
-@@ -399,6 +399,8 @@ int lxc_attach_main(int argc, char *argv)
- 	}
- 	if (WIFEXITED(ret))
- 		wexit = WEXITSTATUS(ret);
-+	else if (WIFSIGNALED(ret))
-+		wexit = WTERMSIG(ret) + 128;
- 
- out:
- 	lxc_container_put(c);
--- 
-2.33.0
-

_service:tar_scm:0032-fix-load-bpf-failed.patch Deleted

_service:tar_scm:0033-fix-mount-device-path-incorrect.patch Deleted

_service:tar_scm:0034-add-secure-compile-macro.patch Deleted

@@ -1,65 +0,0 @@
-From 728d921b36f07833470a284a55cbfea4baaab268 Mon Sep 17 00:00:00 2001
-From: mzzhou <1362843687@qq.com>
-Date: Mon, 10 Jul 2023 21:28:10 +0800
-Subject: PATCH add secure compile marco
-
----
- configure.ac        | 20 ++++++++++++++++++++
- src/lxc/Makefile.am |  6 +++++-
- 2 files changed, 25 insertions(+), 1 deletion(-)
-
-diff --git a/configure.ac b/configure.ac
-index 2180586..e66bdf1 100644
---- a/configure.ac
-+++ b/configure.ac
-@@ -837,10 +837,30 @@ if test "x$adapt_isulad" = "xyes"; then
- 	AC_DEFINE(HAVE_ISULAD, 1, adapt to iSulad)
- 	AC_MSG_RESULT(yes)
- 
-+	AC_MSG_CHECKING(Whether enable secure compile)
-+	AC_ARG_ENABLE(secure-compile,
-+		AC_HELP_STRING(--enable-secure-compile, enable secure compile default=no),
-+		secure_compile=$enableval, secure_compile=yes)
-+	AM_CONDITIONAL(HAVE_SECURE_COMPILE, test "x$secure_compile" = "xyes")
-+	AC_DEFINE(HAVE_SECURE_COMPILE, 1, enable secure compile)
-+	AC_MSG_RESULT(yes)
-+
- 	# Check yajl
- 	PKG_CHECK_MODULES(YAJL, yajl >= 2,,AC_MSG_ERROR(You must install yajl >= 2))
- else
- 	AC_MSG_RESULT(no)
-+
-+	AC_MSG_CHECKING(Whether enable secure compile)
-+	AC_ARG_ENABLE(secure-compile,
-+		AC_HELP_STRING(--enable-secure-compile, enable secure compile default=no),
-+		secure_compile=$enableval, secure_compile=yes)
-+	AM_CONDITIONAL(HAVE_SECURE_COMPILE, test "x$secure_compile" = "xyes")
-+	if test "x$secure_compile" = "xyes"; then
-+		AC_DEFINE(HAVE_SECURE_COMPILE, 1, enable secure compile)
-+		AC_MSG_RESULT(yes)
-+	else
-+		AC_MSG_RESULT(no)
-+	fi
- fi
- 
- # Files requiring some variable expansion
-diff --git a/src/lxc/Makefile.am b/src/lxc/Makefile.am
-index 61a229f..c1d20f6 100644
---- a/src/lxc/Makefile.am
-+++ b/src/lxc/Makefile.am
-@@ -292,7 +292,11 @@ liblxc_la_LDFLAGS = -pthread \
- 		    -version-info @LXC_ABI_MAJOR@
- 
- if HAVE_ISULAD
--liblxc_la_LDFLAGS += @YAJL_LIBS@ -Wl,-z,relro \
-+liblxc_la_LDFLAGS += @YAJL_LIBS@
-+endif
-+
-+if HAVE_SECURE_COMPILE
-+liblxc_la_LDFLAGS += -Wl,-z,relro \
- 		    -Wl,-z,now \
- 		    -Wl,-z,noexecstack
- endif
--- 
-2.41.0.windows.2
-

_service:tar_scm:0035-codecheck-fix.patch Deleted

@@ -1,650 +0,0 @@
-From 103aff2c11b16a2b53b0339b0033a77b3348fec3 Mon Sep 17 00:00:00 2001
-From: zhangxiaoyu <zhangxiaoyu58@huawei.com>
-Date: Wed, 6 Sep 2023 15:14:06 +0800
-Subject: PATCH codecheck fix
-
-Signed-off-by: zhangxiaoyu <zhangxiaoyu58@huawei.com>
----
- src/lxc/af_unix.c          |  4 +--
- src/lxc/attach.c           |  2 +-
- src/lxc/commands.c         | 27 +++++++++++++----
- src/lxc/conf.c             | 46 +++++++++++++++++++++++++++--
- src/lxc/exec_commands.c    |  2 +-
- src/lxc/file_utils.c       |  2 +-
- src/lxc/isulad_utils.c     | 23 ++++++++++-----
- src/lxc/json/json_common.c |  4 +--
- src/lxc/path.c             | 32 ++++++++++++++++++--
- src/lxc/start.c            | 60 +++++++++++++++++++++++++++++++-------
- src/lxc/terminal.c         | 24 ++++++++++++---
- 11 files changed, 186 insertions(+), 40 deletions(-)
-
-diff --git a/src/lxc/af_unix.c b/src/lxc/af_unix.c
-index 0be9368..d98a1f9 100644
---- a/src/lxc/af_unix.c
-+++ b/src/lxc/af_unix.c
-@@ -170,10 +170,10 @@ int lxc_unix_send_fds(int fd, int *sendfds, int num_sendfds, void *data,
- #ifdef HAVE_ISULAD
- static int lxc_abstract_unix_recv_fds_iov(int fd, int *recvfds, int num_recvfds,
- 			          struct iovec *iov, size_t iovlen, unsigned int timeout)
--#else 
-+#else
- static int lxc_abstract_unix_recv_fds_iov(int fd, int *recvfds, int num_recvfds,
- 					  struct iovec *iov, size_t iovlen)
--#endif 
-+#endif
- {
- 	__do_free char *cmsgbuf = NULL;
- 	int ret;
-diff --git a/src/lxc/attach.c b/src/lxc/attach.c
-index 24d020d..0ac37cc 100644
---- a/src/lxc/attach.c
-+++ b/src/lxc/attach.c
-@@ -735,7 +735,7 @@ static int attach_child_main(struct attach_clone_payload *payload)
- 	ret = sigfillset(&mask);
- 	if (ret < 0) {
- 		SYSERROR("Failed to fill signal mask");
--		goto on_error;;
-+		goto on_error;
- 	}
- 	ret = sigprocmask(SIG_UNBLOCK, &mask, NULL);
- 	if (ret < 0) {
-diff --git a/src/lxc/commands.c b/src/lxc/commands.c
-index c2a5665..d6b9939 100644
---- a/src/lxc/commands.c
-+++ b/src/lxc/commands.c
-@@ -1504,17 +1504,32 @@ int lxc_cmd_set_terminal_fifos(const char *name, const char *lxcpath, const char
- 				const char *out_fifo, const char *err_fifo)
- {
- 	int ret = 0, stopped = 0;
--	int len = 0;
-+	size_t len = 0;
- 	char *tmp = NULL;
- 	const char *split = "&&&&", *none_fifo_name = "none";
- 	const char *cmd_in_fifo = in_fifo ? in_fifo : none_fifo_name;
- 	const char *cmd_out_fifo = out_fifo ? out_fifo : none_fifo_name;
- 	const char *cmd_err_fifo = err_fifo ? err_fifo : none_fifo_name;
- 
--	if (len + strlen(cmd_in_fifo) + strlen(split) + strlen(cmd_out_fifo) +
--	     strlen(split) + strlen(cmd_err_fifo) == SIZE_MAX)
-+	if (name == NULL) {
- 		return -1;
--	len += strlen(cmd_in_fifo) + strlen(split) + strlen(cmd_out_fifo) + strlen(split) + strlen(cmd_err_fifo) + 1;
-+	}
-+
-+	// format: cmd_in_fifo + split + cmd_out_fifo + split + cmd_err_fifo + '\0'
-+	if (strlen(cmd_in_fifo) > SIZE_MAX - strlen(split) - strlen(split) - 1) {
-+		return -1;
-+	}
-+	len += strlen(cmd_in_fifo) + strlen(split) + strlen(split) + 1;
-+
-+	if (strlen(cmd_out_fifo) > SIZE_MAX - len) {
-+		return -1;
-+	}
-+	len += strlen(cmd_out_fifo);
-+
-+	if (strlen(cmd_err_fifo) > SIZE_MAX - len) {
-+		return -1;
-+	}
-+	len += strlen(cmd_err_fifo);
- 	tmp = malloc(len);
- 	if (tmp == NULL)
- 		return -1;
-@@ -1556,7 +1571,7 @@ static int lxc_cmd_set_terminal_fifos_callback(int fd, struct lxc_cmd_req *req,
- 	struct lxc_cmd_rsp rsp;
- 	memset(&rsp, 0, sizeof(rsp));
- 
--	rsp.ret = lxc_terminal_add_fifos(handler->conf, req->data);;
-+	rsp.ret = lxc_terminal_add_fifos(handler->conf, req->data);
- 
- 	return lxc_cmd_rsp_send(fd, &rsp);
- }
-@@ -1602,7 +1617,7 @@ static int lxc_cmd_set_terminal_winch_callback(int fd, struct lxc_cmd_req *req,
- 	struct lxc_cmd_set_terminal_winch_request *data = (struct lxc_cmd_set_terminal_winch_request *)(req->data);
- 	memset(&rsp, 0, sizeof(rsp));
- 
--	rsp.ret = lxc_set_terminal_winsz(&handler->conf->console, data->height, data->width);;
-+	rsp.ret = lxc_set_terminal_winsz(&handler->conf->console, data->height, data->width);
- 
- 	return lxc_cmd_rsp_send(fd, &rsp);
- 
-diff --git a/src/lxc/conf.c b/src/lxc/conf.c
-index a5573ac..3e31691 100644
---- a/src/lxc/conf.c
-+++ b/src/lxc/conf.c
-@@ -4640,7 +4640,11 @@ static struct lxc_list *get_minimal_idmap(const struct lxc_conf *conf,
- int userns_exec_1(const struct lxc_conf *conf, int (*fn)(void *), void *data,
- 		  const char *fn_name)
- {
-+#ifdef HAVE_ISULAD
-+	struct lxc_list *idmap = NULL;
-+#else
- 	call_cleaner(lxc_free_idmap) struct lxc_list *idmap = NULL;
-+#endif
- 	int ret = -1, status = -1;
- 	char c = '1';
- 	struct userns_fn_data d = {
-@@ -4659,8 +4663,16 @@ int userns_exec_1(const struct lxc_conf *conf, int (*fn)(void *), void *data,
- 		return ret_errno(ENOENT);
- 
- 	ret = pipe2(pipe_fds, O_CLOEXEC);
-+#ifdef HAVE_ISULAD
-+	if (ret < 0) {
-+		lxc_free_idmap(idmap);
-+		free(idmap);
-+		return -errno;
-+	}
-+#else
- 	if (ret < 0)
- 		return -errno;
-+#endif
- 
- 	d.p0		= pipe_fds0;
- 	d.p1		= pipe_fds1;
-@@ -4710,6 +4722,11 @@ on_error:
- 	if (status < 0)
- 		ret = -1;
- 
-+#ifdef HAVE_ISULAD
-+	lxc_free_idmap(idmap);
-+	free(idmap);
-+#endif
-+
- 	return ret;
- }
- 
-@@ -4717,7 +4734,11 @@ int userns_exec_minimal(const struct lxc_conf *conf,
- 			int (*fn_parent)(void *), void *fn_parent_data,
- 			int (*fn_child)(void *), void *fn_child_data)
- {
-+#ifdef HAVE_ISULAD
-+	struct lxc_list *idmap = NULL;
-+#else
- 	call_cleaner(lxc_free_idmap) struct lxc_list *idmap = NULL;
-+#endif
- 	uid_t resuid = LXC_INVALID_UID;
- 	gid_t resgid = LXC_INVALID_GID;
- 	char c = '1';
-@@ -4733,8 +4754,16 @@ int userns_exec_minimal(const struct lxc_conf *conf,
- 		return ret_errno(ENOENT);
- 
- 	ret = socketpair(PF_LOCAL, SOCK_STREAM | SOCK_CLOEXEC, 0, sock_fds);
-+#ifdef HAVE_ISULAD
-+	if (ret < 0) {
-+		lxc_free_idmap(idmap);
-+		free(idmap);
-+		return -errno;
-+	}
-+#else
- 	if (ret < 0)
- 		return -errno;
-+#endif
- 
- 	pid = fork();
- 	if (pid < 0) {
-@@ -4830,6 +4859,11 @@ on_error:
- 	close_prot_errno_disarm(sock_fds0);
- 	close_prot_errno_disarm(sock_fds1);
- 
-+#ifdef HAVE_ISULAD
-+	lxc_free_idmap(idmap);
-+	free(idmap);
-+#endif
-+
- 	/* Wait for child to finish. */
- 	if (pid < 0)
- 		return -1;
-@@ -5468,6 +5502,10 @@ int lxc_drop_caps(struct lxc_conf *conf)
- 	struct lxc_list *caps = NULL;
- 	int *caplist = NULL;
-

_service:tar_scm:apply-patches Changed

_service Changed

_service:tar_scm:lxc-4.0.3.tar.gz -> _service:tar_scm:lxc-5.0.2.tar.gz Changed