link-remap: Add --keep-link-remaps option

.cirrus.yml

@@ -19,6 +19,34 @@ task:
   build_script: |
     make -C scripts/ci vagrant-fedora-no-vdso
 
+task:
+  name: CentOS Stream 9 based test
+  environment:
+    HOME: "/root"
+    CIRRUS_WORKING_DIR: "/tmp/criu"
+
+  compute_engine_instance:
+    image_project: centos-cloud
+    image: family/centos-stream-9
+    platform: linux
+    cpu: 4
+    memory: 8G
+
+  setup_script: |
+    ln -sf /usr/include/google/protobuf/descriptor.proto images/google/protobuf/descriptor.proto
+    dnf config-manager --set-enabled crb # Same as CentOS 8 powertools
+    dnf -y install epel-release epel-next-release
+    dnf -y install --allowerasing asciidoc gcc git gnutls-devel libaio-devel libasan libcap-devel libnet-devel libnl3-devel libbsd-devel libselinux-devel make protobuf-c-devel protobuf-devel python-devel python-PyYAML python-future python-protobuf python-junit_xml python-flake8 xmlto
+    systemctl stop sssd
+    # Even with selinux in permissive mode the selinux tests will be executed.
+    # The Cirrus CI user runs as a service from selinux point of view and is
+    # much more restricted than a normal shell (system_u:system_r:unconfined_service_t:s0).
+    # The test case above (vagrant-fedora-no-vdso) should run selinux tests in enforcing mode.
+    setenforce 0
+
+  build_script: |
+    make -C scripts/ci local SKIP_CI_PREP=1 CC=gcc CD_TO_TOP=1 ZDTM_OPTS="-x zdtm/static/socket-raw"
+
 task:
   name: Vagrant Fedora Rawhide based test
   environment:
@@ -41,7 +69,28 @@ task:
     make -C scripts/ci vagrant-fedora-rawhide
 
 task:
-  name: CentOS 8 based test
+  name: Vagrant Fedora based test (non-root)
+  environment:
+    HOME: "/root"
+    CIRRUS_WORKING_DIR: "/tmp/criu"
+
+  compute_engine_instance:
+    image_project: cirrus-images
+    image: family/docker-kvm
+    platform: linux
+    cpu: 4
+    memory: 16G
+    nested_virtualization: true
+
+  setup_script: |
+    scripts/ci/apt-install make gcc pkg-config git perl-modules iproute2 kmod wget cpu-checker
+    sudo kvm-ok
+    ln -sf /usr/include/google/protobuf/descriptor.proto images/google/protobuf/descriptor.proto
+  build_script: |
+    make -C scripts/ci vagrant-fedora-non-root
+
+task:
+  name: CentOS Stream 8 based test
   environment:
     HOME: "/root"
     CIRRUS_WORKING_DIR: "/tmp/criu"
@@ -55,17 +104,18 @@ task:
 
   setup_script: |
     ln -sf /usr/include/google/protobuf/descriptor.proto images/google/protobuf/descriptor.proto
-    yum install -y https://dl.fedoraproject.org/pub/epel/epel-release-latest-8.noarch.rpm dnf-plugins-core
+    # Do not fail if latest epel repository definition is already installed
+    yum install -y https://dl.fedoraproject.org/pub/epel/epel-release-latest-8.noarch.rpm || :
+    yum install -y dnf-plugins-core
     yum config-manager --set-enabled powertools
-    yum install -y --allowerasing asciidoc gcc git gnutls-devel libaio-devel libasan libcap-devel libnet-devel libnl3-devel libbsd-devel libselinux-devel make protobuf-c-devel protobuf-devel python3-devel python3-flake8 python3-PyYAML python3-future python3-protobuf xmlto
+    yum install -y --allowerasing asciidoc gcc git gnutls-devel libaio-devel libasan libcap-devel libnet-devel libnl3-devel libbsd-devel libselinux-devel make protobuf-c-devel protobuf-devel python3-devel python3-flake8 python3-PyYAML python3-future python3-protobuf python3-junit_xml xmlto
     alternatives --set python /usr/bin/python3
     systemctl stop sssd
     # Even with selinux in permissive mode the selinux tests will be executed
     # The Cirrus CI user runs as a service from selinux point of view and is
     # much more restricted than a normal shell (system_u:system_r:unconfined_service_t:s0)
     # The test case above (vagrant-fedora-no-vdso) should run selinux tests in enforcing mode
     setenforce 0
-    pip3 install junit_xml
 
   build_script: |
     make -C scripts/ci local SKIP_CI_PREP=1 CC=gcc CD_TO_TOP=1 ZDTM_OPTS="-x zdtm/static/socket-raw"
@@ -84,6 +134,9 @@ task:
     memory: 8G
 
   setup_script: |
+    # EPEL is needed for python2-future, python2-junit_xml, python-flake8 and libbsd-devel.
+    # Do not fail if latest epel repository definition is already installed
+    yum install -y https://dl.fedoraproject.org/pub/epel/epel-release-latest-7.noarch.rpm || :
     ln -sf /usr/include/google/protobuf/descriptor.proto images/google/protobuf/descriptor.proto
     yum install -y findutils gcc git gnutls-devel iproute iptables libaio-devel libasan libcap-devel libnet-devel libnl3-devel libbsd-devel make procps-ng protobuf-c-devel protobuf-devel protobuf-python python python-flake8 python-ipaddress python2-future python2-junit_xml python-yaml python-six sudo tar which e2fsprogs python2-pip rubygem-asciidoctor libselinux-devel
     # Even with selinux in permissive mode the selinux tests will be executed
@@ -98,3 +151,40 @@ task:
 
   build_script: |
     make -C scripts/ci local SKIP_CI_PREP=1 CC=gcc CD_TO_TOP=1 ZDTM_IGNORE_TAINT=1 ZDTM_OPTS="-x zdtm/static/socket-raw -x zdtm/static/child_subreaper_existing_child -x zdtm/static/fifo_upon_unix_socket01 -x zdtm/static/overmount_sock -x zdtm/static/tempfs_overmounted"
+
+task:
+  name: aarch64 build GCC (native)
+  arm_container:
+    image: docker.io/library/ubuntu:jammy
+    cpu: 4
+    memory: 4G
+  script: uname -a
+  build_script: |
+    scripts/ci/apt-install make
+    ln -sf /usr/include/google/protobuf/descriptor.proto images/google/protobuf/descriptor.proto
+    make -C scripts/ci local
+
+task:
+  name: aarch64 build CLANG (native)
+  arm_container:
+    image: docker.io/library/ubuntu:jammy
+    cpu: 4
+    memory: 4G
+  script: uname -a
+  build_script: |
+    scripts/ci/apt-install make
+    ln -sf /usr/include/google/protobuf/descriptor.proto images/google/protobuf/descriptor.proto
+    make -C scripts/ci local CLANG=1
+
+task:
+  name: aarch64 Fedora Rawhide
+  arm_container:
+    image: registry.fedoraproject.org/fedora:rawhide
+    cpu: 4
+    memory: 4G
+  script: uname -a
+  build_script: |
+    scripts/ci/prepare-for-fedora-rawhide.sh
+    ln -sf /usr/include/google/protobuf/descriptor.proto images/google/protobuf/descriptor.proto
+    make -C scripts/ci/ local CC=gcc SKIP_CI_PREP=1 SKIP_CI_TEST=1 CD_TO_TOP=1
+    make -C test/zdtm -j 4

.github/workflows/fedora-rawhide-test.yml

@@ -9,4 +9,8 @@ jobs:
     steps:
     - uses: actions/checkout@v2
     - name: Run Fedora Rawhide Test
-      run: sudo -E make -C scripts/ci fedora-rawhide CONTAINER_RUNTIME=podman BUILD_OPTIONS="--security-opt seccomp=unconfined"
+      # We need to pass environment variables from the CI environment to
+      # distinguish between CI environments. However, we need to make sure that
+      # XDG_RUNTIME_DIR environment variable is not set due to a bug in Podman.
+      # FIXME: https://github.com/containers/podman/issues/14920
+      run: sudo -E XDG_RUNTIME_DIR= make -C scripts/ci fedora-rawhide CONTAINER_RUNTIME=podman BUILD_OPTIONS="--security-opt seccomp=unconfined"

.github/workflows/openj9-test.yml → .github/workflows/java-test.yml

@@ -1,4 +1,4 @@
-name: OpenJ9 Test
+name: Java Test
 
 on: [push, pull_request]
 
@@ -7,5 +7,5 @@ jobs:
     runs-on: ubuntu-20.04
     steps:
     - uses: actions/checkout@v2
-    - name: Run OpenJ9 Test
-      run: sudo make -C scripts/ci openj9-test
+    - name: Run Java Test
+      run: sudo make -C scripts/ci java-test

.github/workflows/lint.yml

@@ -9,13 +9,25 @@ jobs:
       image: registry.fedoraproject.org/fedora:latest
     steps:
     - name: Install tools
-      run: sudo dnf -y install git make python3-flake8 ShellCheck clang-tools-extra which findutils codespell
+      run: sudo dnf -y install git make python3-flake8 xz clang-tools-extra which codespell git-clang-format ShellCheck
+
     - uses: actions/checkout@v2
+
+    - name: Set git safe directory
+      # https://github.com/actions/checkout/issues/760
+      run: git config --global --add safe.directory "$GITHUB_WORKSPACE"
+
     - name: Run make lint
       run: make lint
+
     - name: Run make indent
       run: >
-        make indent &&
+        if [ -z "${{github.base_ref}}" ]; then
+          make indent
+        else
+          git fetch origin ${{github.base_ref}} &&
+          git clang-format --style file --extensions c,h --quiet origin/${{github.base_ref}}
+        fi &&
         STATUS=$(git status --porcelain) &&
         if [ ! -z "$STATUS" ]; then
           echo "FAIL: some files are not correctly formatted.";

.gitignore

@@ -42,4 +42,4 @@ lib/.crit-setup.files
 compel/include/asm
 include/common/asm
 include/common/config.h
-build/
+build/**

Documentation/compel.txt

@@ -97,7 +97,10 @@ Following steps are performed to infect the victim process:
     - execute system call: *int compel_syscall(ctl, int syscall_nr, long *ret, int arg ...);*
     - infect victim: *int compel_infect(ctl, nr_thread, size_of_args_area);*
     - cure the victim: *int compel_cure(ctl);* //ctl pointer is freed by this call
-    - Resume victim: *int compel_resume_task(pid, orig_state, state);*
+    - Resume victim: *int compel_resume_task(pid, orig_state, state)* or
+    *int compel_resume_task_sig(pid, orig_state, state, stop_signo).*
+    //compel_resume_task_sig() could be used in case when victim is in stopped state.
+    stop_signo could be read by calling compel_parse_stop_signo().
 
 *ctl* must be configured with blob information by calling *PREFIX_setup_c_header()*, with ctl as its argument.
 *PREFIX* is the argument given to *-p* when calling hgen, else it is deduced from file name.

Documentation/criu.txt

@@ -155,6 +155,12 @@ not compatible with *--external* *dev*.
             notification message contains a file descriptor for
             the master pty
 
+*--unprivileged*::
+    This option tells *criu* to accept the limitations when running
+    as non-root. Running as non-root requires *criu* at least to have
+    *CAP_SYS_ADMIN* or *CAP_CHECKPOINT_RESTORE*. For details about running
+    *criu* as non-root please consult the *NON-ROOT* section.
+
 *-V*, *--version*::
     Print program version and exit.
 
@@ -668,6 +674,9 @@ The 'mode' may be one of the following:
                 build-ID cannot be obtained, 'chksm-first' method will be
                 used. This is the default if mode is unspecified.
 
+*--skip-file-rwx-check*::
+    Skip checking file permissions (r/w/x for u/g/o) on restore.
+
 *check*
 ~~~~~~~
 Checks whether the kernel supports the features needed by *criu* to
@@ -874,6 +883,32 @@ configuration file will overwrite all other configuration file settings
 or RPC options. *This can lead to undesired behavior of criu and
 should only be used carefully.*
 
+NON-ROOT
+--------
+*criu* can be used as non-root with either the *CAP_SYS_ADMIN* capability
+or with the *CAP_CHECKPOINT_RESTORE* capability introduces in Linux kernel 5.9.
+*CAP_CHECKPOINT_RESTORE* is the minimum that is required.
+
+*criu* also needs either *CAP_SYS_PTRACE* or a value of 0 in
+*/proc/sys/kernel/yama/ptrace_scope* (see *ptrace*(2)) to be able to interrupt
+the process for dumping.
+
+Running *criu* as non-root has many limitations and depending on the process
+to checkpoint and restore it may not be possible.
+
+In addition to *CAP_CHECKPOINT_RESTORE* it is possible to give *criu* additional
+capabilities to enable additional features in non-root mode.
+
+Currently *criu* can benefit from the following additional capabilities:
+
+    - *CAP_NET_ADMIN*
+    - *CAP_SYS_CHROOT*
+    - *CAP_SETUID*
+    - *CAP_SYS_RESOURCE*
+
+Independent of the capabilities it is always necessary to use "*--unprivileged*" to
+accept *criu*'s limitation in non-root mode.
+
 EXAMPLES
 --------
 To checkpoint a program with pid of *1234* and write all image files into

MAINTAINERS

@@ -4,3 +4,5 @@ Mike Rapoport <rppt@kernel.org>
 Dmitry Safonov <0x7f454c46@gmail.com>
 Adrian Reber <areber@redhat.com>
 Pavel Tikhomirov <ptikhomirov@virtuozzo.com>
+Radostin Stoyanov <rstoyanov@fedoraproject.org>
+Alexander Mikhalitsyn <alexander@mihalicyn.com>