lxc (1:5.0.3-2ubuntu7.3) noble; urgency=medium

  * Cherry-pick upstream fix for cap_to_text() memory cleanup (LP: #2158643)
    - d/p/lp2158643-lxc-caps-fix-cap_to_text-memory-cleanup.patch 

 -- Leah Goldberg <leah.goldberg@canonical.com>  Mon, 17 Aug 2026 11:55:35 -0400

lxc (1:5.0.3-2ubuntu7.2) noble; urgency=medium

  * d/p/0016-set-container-ttys-env-var.patch: fix setting the
    container_ttys environment variable for container's init process.
    Fixes `lxc-console` without explicitly specified TTY.
    (LP: #2109890)

 -- Roman Azarenko <rocko@ubuntu.com>  Sun, 11 May 2025 01:36:45 +0200

lxc (1:5.0.3-2ubuntu7.1) noble; urgency=medium

  * d/p/0015-lxc-avoid-null-pointer.patch: Use upstream patch to avoid
    null pointer dereference. (LP: #2081762) 

 -- Sudip Mukherjee <sudipm.mukherjee@gmail.com>  Wed, 30 Oct 2024 17:20:06 +0000

lxc (1:5.0.3-2ubuntu7) noble; urgency=medium

  * Fixup typo in Depends field in time64_t transition

 -- Gianfranco Costamagna <locutusofborg@debian.org>  Wed, 17 Apr 2024 23:07:01 +0200

lxc (1:5.0.3-2ubuntu6) noble; urgency=medium

  * Manually apply the changes from 1:5.0.3-2.1 in Debian (the renaming for
    the 64-bit time_t transition) which somehow never got merged into the
    Ubuntu packaging.

 -- Michael Hudson-Doyle <michael.hudson@ubuntu.com>  Wed, 17 Apr 2024 15:06:46 +1200

lxc (1:5.0.3-2ubuntu5) noble; urgency=medium

  * Temporarily skip some buggy tests (LP: #2059550)
    - debian/tests/exercise: skip "lxc-test-unpriv" test (attempt #2)

 -- Alexander Mikhalitsyn <aleksandr.mikhalitsyn@canonical.com>  Wed, 10 Apr 2024 17:23:26 +0200

lxc (1:5.0.3-2ubuntu4) noble; urgency=medium

  * Temporarily skip some buggy tests (LP: #2059550)
    - d/tests/control: remove "unprivileged-containers" autopkgtest
    - debian/tests/exercise: skip "lxc-test-unpriv" test
  * debian/rules
    - apply Ubuntu-specific patches in override_dh_auto_configure
      step instead of override_dh_clean. Otherwise, debuild fails
      to build source package if run from Ubuntu.

 -- Alexander Mikhalitsyn <aleksandr.mikhalitsyn@canonical.com>  Tue, 09 Apr 2024 20:37:44 +0200

lxc (1:5.0.3-2ubuntu3) noble; urgency=medium

  * No-change rebuild for CVE-2024-3094

 -- Steve Langasek <steve.langasek@ubuntu.com>  Sun, 31 Mar 2024 20:01:40 +0000

lxc (1:5.0.3-2ubuntu2) noble; urgency=medium

  * Merge with unrelated Debian packaging, remaining changes:
    - debian/control: Add transitional packages
      This is to allow for upgrades from 23.10 to 24.04.
      Those changes can go away once 24.10 opens.
  * The changes below are those that are set to be included in the next
    Debian upload.

  [ Aleksandr Mikhalitsyn ]
  * debian/tests: Addition of the "no-devel" test
  * debian/tests/unprivileged-containers: Fix and make work on Ubuntu

  [ Mathias Gibbens ]
  * d/control:
    - Update Build-Depends from systemd -> systemd-dev (Closes: #1060614)
    - Update Build-Depends from pkg-config -> pkgconf
  * Cherry-pick upstream fixes for d/tests/test-usernic
  * Update years in d/copyright

  [ Michael Biebl ]
  * Install PAM modules into /usr. (Closes: #1061490)
  * Drop Build-Depends on dh-exec, no longer necessary.

  [ Stéphane Graber ]
  * Cherry-pick upstream bugfixes:
    - 0013-cherry-pick-remove-broken-cgroup-tests.patch
    - 0014-cherry-pick-lxc-copy-apparmor.patch
  * Add Ubuntu-specific patch (for now):
    - Handle AppArmor ABI 4 with userns extension
  * debian/rules
    - Add lxc-copy apparmor profile
    - Apply Ubuntu-specific patch

 -- Stéphane Graber <stgraber@stgraber.org>  Thu, 21 Mar 2024 12:54:38 -0400

lxc (1:5.0.3-2ubuntu1) noble; urgency=medium

  [ Aleksandr Mikhalitsyn ]
  * Merge with Debian, remaining changes:
    - debian/control: Add transitional packages
      This is to allow for upgrades from 23.10 to 24.04.
      Those changes can go away once 24.10 opens.
    - debian/patches:
      - 1000-ubuntu-apparmor-userns.patch
        Handles Ubuntu-specific divergance in userns behavior.
      - 1001-test-usernic-fixes.patch
        Remove deprecated logic from usernic test.
    - debian/tests: Addition of the "no-devel" test

 -- Stéphane Graber <stgraber@stgraber.org>  Tue, 13 Feb 2024 10:19:47 -0500

lxc (1:5.0.3-2) unstable; urgency=medium

  * Switch default branch to debian/sid
  * Add criu as a Suggests for bin:lxc (Closes: #947334)
  * Cherry-pick upstream fix for creating ephemeral copies (Closes: #1001713)

 -- Mathias Gibbens <gibmat@debian.org>  Thu, 30 Nov 2023 01:04:13 +0000

lxc (1:5.0.3-1) unstable; urgency=medium

  [ Ceppo ]
  * Add Italian debconf translation (Closes: #1050106)

  [ Gioele Barabucci ]
  * d/tests/control: Remove unnecessary dependency on lsb-release

  [ Helmut Grohne ]
  * Fix FTBFS when systemdsystemunitdir changes in systemd.pc (Closes: #1052379)

  [ Mathias Gibbens ]
  * New upstream release
  * Add translator information to d/copyright
  * d/control:
    - Remove liblua5.2-dev from Build-Depends (Closes: #1050519)
    - Remove lsb-base from Depends
  * Add d/clean to fix failing to build twice in a row (Closes: #1046733)

  [ Remus-Gabriel Chelu ]
  * Add Romanian debconf translation (Closes: #1032345)

 -- Mathias Gibbens <gibmat@debian.org>  Fri, 22 Sep 2023 14:53:31 +0000

lxc (1:5.0.2-1) unstable; urgency=medium

  * New upstream release
    - Fixes CVE-2022-47952
    - Drop glibc 2.36 patch applied upstream
  * Bump Standards-Version in d/control (no changes needed)
  * Refresh d/copyright

 -- Mathias Gibbens <gibmat@debian.org>  Tue, 17 Jan 2023 02:53:00 +0000

lxc (1:5.0.1-2) unstable; urgency=medium

  * d/control:
    - Add myself to Uploaders
    - Bump Standards-Version (no changes needed)
    - Set minimum required meson version in Build-Depends (Closes: #1016523)
    - Update list of architectures missing libseccomp-dev
    - Add Rules-Requires-Root: binary-targets
  * Add myself to d/copyright
  * d/liblxc1.symbols:
    - Avoid build failure due to missing symbols on architectures without
      libseccomp-dev (Closes: #922545)
  * Drop d/patches/0006-adjust-pam-dir.patch and modify d/libpam-cgfs.install
    to directly install pam_cgfs.so
  * Cherry-pick upstream fixes for building with glibc 2.36 (Closes: #1023437)
  * Add d/upstream/metadata
  * Remove asterisk from NEWS file to silence lintian tag

 -- Mathias Gibbens <gibmat@debian.org>  Fri, 04 Nov 2022 19:54:47 +0000

lxc (1:5.0.1-1) unstable; urgency=medium

  * Team upload

  [ Mathias Gibbens ]
  * New upstream release 5.0.1 (Closes: #1005099, #1010843, #1006353)
    - Switch to meson build system and update d/rules as needed
    - Update Build-Depends and Depends in d/control
    - Drop patches no longer needed / applied upstream
    - Add patch to fix installed location of libpam_cgfs.so
    - Update d/liblxc-common.lintian-overrides
    - Update d/liblxc1.symbols

  [ Antonio Terceiro ]
  * debian/rules: drop handling of bash completion links

  [ Pierre-Elliott Bécue ]
  * Apply Janitor's changes on d/control constraints.
  * Fix debian/liblxc1.symbols
  * d/p/0004: Add a patch to make systemd security features working in nesting
    apparmor profile.
    This can cause security risks in privileged containers, so it's only in
    nesting profile. (Closes: #995350)

 -- Mathias Gibbens <mathias@calenhad.com>  Mon, 01 Aug 2022 22:46:52 +0200

lxc (1:5.0.1-0ubuntu8) noble; urgency=medium

  * Fix the LXC_DEVEL value to be 0 (LP: #2039873)
    - d/p/0003-meson-Set-DEVEL-flag-post-release.patch was dropped
      as it should not be in the production builds
  * Added autopkgtest to ensure that LXC_DEVEL is always 0
    - debian/tests/no-devel: add "no-devel" autopkgtest script
    - debian/tests/control: declare "no-devel" autopkgtest
  * d/lxc-utils.install: Fixed lib/systemd path (to usr/lib/systemd)

 -- Alexander Mikhalitsyn <aleksandr.mikhalitsyn@canonical.com>  Thu, 18 Jan 2024 16:20:47 +0100

lxc (1:5.0.1-0ubuntu7) mantic; urgency=medium

  * Update apparmor profile to support new userns feature (LP: #2035315)
    - d/p/apparmor-userns.patch: Add userns permission to
      start-container abstraction and declare new 4.0 ABI in
      the usr.bin.lxc-start apparmor profile
    - debian/control: Declare Breaks on anything less than apparmor
      4.0.0~alpha2-0ubuntu4 for liblxc-common to ensure if apparmor is
      installed that it supports the new 4.0 ABI and add systemd-dev to
      Build-Depends to fix local build failure.

 -- Alex Murray <alex.murray@canonical.com>  Mon, 18 Sep 2023 13:28:16 +0930

lxc (1:5.0.1-0ubuntu6) lunar; urgency=medium

  * debian/control: add libcap-dev, libselinux1-dev, and libseccomp-dev to
    depends for liblxc-dev, to fix go-lxc autopktest failure.

 -- Serge Hallyn <serge.hallyn@ubuntu.com>  Thu, 19 Jan 2023 17:53:14 -0600

lxc (1:5.0.1-0ubuntu5) lunar; urgency=medium

  * disable lxc-test-fuzzers - the test is failing to download external
    artifacts

 -- Serge Hallyn <serge.hallyn@ubuntu.com>  Tue, 17 Jan 2023 21:44:40 -0600

lxc (1:5.0.1-0ubuntu4) lunar; urgency=medium

  * Fix meson build in debian/tests/exercise: specify the rest of the
    required configuration parameters.
  * d/p/test-usernic-fixes:
    - drop the hunks dealing with cgroups.  lxc uses the systemd api
      to do that.
    - ifconfig is not available, use ip

 -- Serge Hallyn <serge.hallyn@ubuntu.com>  Mon, 16 Jan 2023 21:32:01 -0600

lxc (1:5.0.1-0ubuntu3) lunar; urgency=medium

  * fix meson reconfiguration usage: the build/ directory doesn't exist
    yet when tests/exercise runs, so use meson setup to create it.

 -- Serge Hallyn <serge.hallyn@ubuntu.com>  Sun, 15 Jan 2023 22:53:15 -0600

lxc (1:5.0.1-0ubuntu2) lunar; urgency=medium

  * Fix autopkg tests to use meson instead of autoconf

 -- Serge Hallyn <serge.hallyn@ubuntu.com>  Tue, 10 Jan 2023 16:21:26 -0600

lxc (1:5.0.1-0ubuntu1) lunar; urgency=medium

  * Update to lxc-5.0.1 (using the orig tarball from debian)
  * d/p: add all patches up to current git master
  * d/control: add libsystemd-dev and meson
  * d/rules: follow guidance from daily packaging
  * remove d/.git-dpm
  * update paths in liblxc1.install and liblxc.lintian-overrides

 -- Serge Hallyn <serge.hallyn@ubuntu.com>  Wed, 16 Nov 2022 09:31:08 -0600

lxc (1:5.0.0~git2209-g5a7b9ce67-0ubuntu3) kinetic; urgency=medium

  * d/p/ppc64el-gcc12-warning.patch: refine the patch to be less brittle in
    case of upstream changes

 -- Simon Chopin <schopin@ubuntu.com>  Wed, 07 Sep 2022 10:19:55 +0200

lxc (1:5.0.0~git2209-g5a7b9ce67-0ubuntu2) kinetic; urgency=medium

  * d/p/lp1987625/*.patch: cherry-picked to fix FTBFS against glibc 2.36
    (LP: #1987625)
  * d/p/ppc64el-gcc12-warning.patch: work around a false positive warning in
    GCC 12 on ppc64el due to it defaulting to -O3

 -- Simon Chopin <schopin@ubuntu.com>  Fri, 26 Aug 2022 11:18:18 +0200

lxc (1:5.0.0~git2209-g5a7b9ce67-0ubuntu1) jammy; urgency=medium

  * Pre-release snapshot of LXC 5.0 LTS (LP: #1967620)
    - New configuration keys:
      - lxc.cgroup.dir.monitor.pivot
      - lxc.cgroup.dir.monitor
      - lxc.cgroup.dir.container.inner
      - lxc.cgroup.dir.container
      - lxc.time.offset.boot
      - lxc.time.offset.monotonic
      - veth.n_rxqueues
      - veth.n_txqueues
      - veth.vlan.id
      - veth.vlan.tagged.id
  * Drop patches (now upstreamed):
    - 0002-lxc-checkconfig-Fix-bashism.patch
    - 0003-doc-Fix-reverse-allowlist-denylist.patch
  * Update lintian overrides for current lintian version
  * debian/control: Switch to debhelper-compat

 -- Stéphane Graber <stgraber@ubuntu.com>  Tue, 05 Apr 2022 18:07:22 -0400

lxc (1:4.0.12-0ubuntu2) jammy; urgency=medium

  * No-change rebuild to update maintainer scripts, see LP: 1959054

 -- Dave Jones <dave.jones@canonical.com>  Wed, 16 Feb 2022 17:06:54 +0000

lxc (1:4.0.12-0ubuntu1) jammy; urgency=medium
  * Cherry-pick upstream bugfixes (stable-4.0):
    - 0002-lxc-checkconfig-Fix-bashism.patch
    - 0003-doc-Fix-reverse-allowlist-denylist.patch (LP: #1957934)

  * New upstream bugfix release (4.0.12):
    (https://discuss.linuxcontainers.org/t/lxc-4-0-12-has-been-released/13288)
    - Fixed CRIU restoration of containers with pre-created veth interfaces
    - Fixed issue with kernels lacking SMT support
    - Extended cgroup2 config options in lxc.mount.auto (cgroup2)
    - lxc-download now relies on HTTPS for validation (avoids GPG issues)

  * New upstream bugfix release (4.0.11)
    (LP: #1943441, LP: #1938771, LP: #1891903):
    (https://discuss.linuxcontainers.org/t/lxc-4-0-11-has-been-released/12427)
    - Core scheduling support (lxc.sched.core)
    - riscv64 support in lxc.arch
    - Significantly improved bash completion profile
    - Greater use of the new VFS mount API (when supported by the kernel)
    - Fix containers with empty network namespaces
    - Handle kernels that lack TIOCGPTPEER
    - Improve CPU bitmask/id handling (handle skipped CPU numbers)
    - Reworked the tests to run offline

  * Bump to debhelper 12 (allows focal SRUs)
  * Bump standards to 4.6.0.1
  * Add lintian overrides for incorrect bashism detection
  * Remove bash completion install logic (now done upstream)

 -- Stéphane Graber <stgraber@ubuntu.com>  Wed, 02 Feb 2022 20:48:39 -0500

lxc (1:4.0.11-1) unstable; urgency=medium

  * Backporting changes from experimental to unstable
  * d/control: Move from Conflicts + Breaks to Breaks + Replaces

 -- Pierre-Elliott Bécue <peb@debian.org>  Mon, 14 Feb 2022 00:22:35 +0100

lxc (1:4.0.11-1~exp4) experimental; urgency=medium

  * d/copyright: Clean the mess and extract as much as possible from the files
    in the repo (Closes: #1004978)
  * wrap-and-sort

 -- Pierre-Elliott Bécue <peb@debian.org>  Fri, 04 Feb 2022 23:06:35 +0100

lxc (1:4.0.11-1~exp3) experimental; urgency=medium

  * d/control: Update the dependency of lxc from liblxc1 to liblxc-common.

 -- Pierre-Elliott Bécue <peb@debian.org>  Wed, 02 Feb 2022 22:37:20 +0100

lxc (1:4.0.11-1~exp2) experimental; urgency=medium

  * d/control:
    - Fix some architecture screwups on liblxc-common
  * d/{liblxc-common,lxc}.install: Move /usr/lib/*/lxc/rootfs to the former

 -- Pierre-Elliott Bécue <peb@debian.org>  Sat, 29 Jan 2022 11:10:23 +0100

lxc (1:4.0.11-1~exp1) experimental; urgency=medium

  [ Pierre-Elliott Bécue ]
  * New upstream release 4.0.11
  * d/control:
    - Remove bridge-utils from lxc's dependencies and prioritize nftables over
      iptables as a firewalling dependency (Closes: #908050)
    - Bumps Standards-Version to 4.6.0
  * Create a new binary package liblxc-common to host the shared components
    needed by both bin:lxc and a potential future bin:lxd (Closes: #1002564)
  * d/liblxc1.symbols: updated
  * d/README.Debian: fix a misleading comment
  * d/copyright: updated years, and added missing copyright holders

  [ Antonio Terceiro ]
  * d/rules: re-enable installation of lxc-top (Closes: #1003591)

  [ Diederik de Haas ]
  * d/lxc.postinst: replace the use of which by a call to command -v

 -- Pierre-Elliott Bécue <peb@debian.org>  Fri, 28 Jan 2022 20:23:34 +0100

lxc (1:4.0.10-2) unstable; urgency=medium

  [ Antonio Terceiro ]
  * debian/rules: re-enable installation of lxc-top (Closes: #1003591)
  * Drop dependency on bridge-utils (Closes: #1004733)
  * lxc-net: don't start by default inside lxc
  * autopkgtest: add basic create/destroy test

  [ Diederik de Haas ]
  * Replace deprecated 'which' with 'command -v'

 -- Antonio Terceiro <terceiro@debian.org>  Wed, 02 Feb 2022 15:45:10 -0300

lxc (1:4.0.10-1) unstable; urgency=medium

  * New upstream version 4.0.10
    - Builds fine against autoconf 2.70 (Closes: #978862)
  * Refresh patches.
    0007-conf-fix-containers-retaining-CAP_NET_ADMIN.patch dropped, applied
    upstream.
  * Update debian/liblxc1.symbols

 -- Antonio Terceiro <terceiro@debian.org>  Fri, 27 Aug 2021 09:15:30 -0300

lxc (1:4.0.10-0ubuntu5) impish; urgency=medium

  * d/t/exercise: Skip tests that are incompatible with cgroups v2
    (LP: #1943704)

 -- Lukas Märdian <slyon@ubuntu.com>  Fri, 17 Sep 2021 15:00:26 +0200

lxc (1:4.0.10-0ubuntu4) impish; urgency=medium

  * Cherry-pick upstream bugfixes (stable-4.0):
    - 0002-cgroups-populate-hierarchy-for-device-cgroup.patch
    - 0003-cgroups-remove-unneeded-variables-from-cgroup_tree_c.patch
    - 0004-lxc_setup_ttys-Handle-existing-ttyN-file-without-und.patch
    - 0005-bpf-bpf_devices_cgroup_supported-should-check-if-bpf.patch
    - 0006-conf-use-new-mount-api-for-devpts-setup.patch
    - 0007-terminal-ttyname_r-returns-an-error-number-on-failur.patch
    - 0008-conf-ensure-devpts_fd-is-set-to-EBADF.patch
    - 0009-Fix-typos.patch
    - 0010-conf-surface-failures-to-setup-console.patch
    - 0011-conf-set-source-property-for-devpts.patch
    - 0012-conf-attach-devpts-mount-directly-when-new-mount-api.patch
    - 0013-conf-s-lxc_setup_devpts_parent-lxc_recv_devpts_from_.patch
    - 0014-conf-use-a-relative-path-in-symlinkat.patch
    - 0015-conf-update-comment.patch
    - 0016-conf-add-and-use-mount_beneath_fd.patch
    - 0017-terminal-don-t-use-ttyname_r-for-native-terminal-all.patch
    - 0018-conf-merge-devpts-setup-and-move-before-pivot-root.patch
    - 0019-string_utils-cast-__s64-to-long-long-signed-int.patch
    - 0020-terminal-split-out-lxc_devpts_terminal-helper.patch
    - 0021-conf-move-lxc_create_ttys-before-pivot-root.patch
    - 0022-conf-stash-pty_nr-in-struct-lxc_terminal.patch
    - 0023-mount_utils-add-mount_fd.patch
    - 0024-conf-use-mount_fd-helper-when-mounting-ttys.patch
    - 0025-conf-use-mount_fd-in-lxc_setup_dev_console.patch
    - 0026-conf-use-mount_fd-during-console-mounting.patch
    - 0027-file_utils-add-open_at_same.patch
    - 0028-conf-rework-console-setup.patch
    - 0029-terminal-remove-unused-argument-from-lxc_devpts_term.patch
    - 0030-start-allow-containers-to-use-a-native-console.patch
    - 0031-conf-handle-kernels-without-TIOCGPTPEER.patch
    - 0032-terminal-move-native-terminal-allocation-from-error-.patch
    - 0033-terminal-fail-on-unknown-error-during-TIOCGPTPEER.patch
    - 0034-mount_utils-introduce-mount_at.patch
    - 0035-conf-fix-logging-in-lxc_idmapped_mounts_child.patch
    - 0036-conf-refactor-lxc_recv_ttys_from_child.patch
    - 0037-conf-log-failure-to-create-tty-mountpoint.patch
    - 0038-conf-let-parse_vfs_attr-handle-legacy-mount-flags-as.patch
    - 0039-mount_utils-make-some-mount-helpers-static-inline.patch
    - 0040-conf-allow-mount-options-for-rootfs-when-using-new-m.patch
    - 0041-tests-add-test-for-rootfs-mount-options.patch
    - 0042-network-fix-container-with-empty-network-namespaces.patch
    - 0043-lsm-apparmor-log-failure-to-write-AppArmor-profile.patch
    - 0044-lsm-apparmor-use-cleanup-macro.patch
    - 0045-doc-api-extensions-Grammar-fix.patch

 -- Stéphane Graber <stgraber@ubuntu.com>  Mon, 09 Aug 2021 13:45:59 -0400

lxc (1:4.0.10-0ubuntu3) impish; urgency=medium

  * debian/rules: Fix setuid bit handling for lxc-user-nic

 -- Stéphane Graber <stgraber@ubuntu.com>  Fri, 30 Jul 2021 14:52:48 -0400

lxc (1:4.0.10-0ubuntu2) impish; urgency=medium

  * debian/patches: Re-introduce default lxcbr0 configuration.
    0001-Ubuntu-default-lxcbr0-configuration.patch

 -- Stéphane Graber <stgraber@ubuntu.com>  Thu, 29 Jul 2021 17:42:39 -0400

lxc (1:4.0.10-0ubuntu1) impish; urgency=medium

  * New upstream bugfix release (4.0.10):
    - Fix issues with less common architectures
    - Support for additional idmap mounts
    - nft support in lxc-net
    - Cleaner mount entries for sys:mixed
    - Switched GPG server to keyserver.ubuntu.com

  * New upstream bugfix release (4.0.9):
    - Fix incorrect personality setting when running 32bit containers on 64bit

  * New upstream bugfix release (4.0.8):
    - Fix CGroup attach against older running containers

  * New upstream bugfix release (4.0.7):
    - Testing improvements including fixes from oss-fuzz
    - Rework of the attach codepath
    - Cgroup handling rework

  * Drop all patches:
    - Cherry-picks are all now included
    - "Allocate new lxcbr0 subnet at startup time" is no longer needed
      as LXC isn't pre-installed in Ubuntu images, so going with the
      upstream init script simplifies maintenance.

  * Bump standards to 4.5.1
    - Tweak lintian overrides (renames, cleanups, ...)
    - Drop --with systemd (built-in now)
    - Update debian/watch regexp and version

 -- Stéphane Graber <stgraber@ubuntu.com>  Wed, 28 Jul 2021 15:42:28 -0400

lxc (1:4.0.6-2) unstable; urgency=medium

  * d/contrib/lxc-net: Add a commented dnsmasq reference for the users to be
    able to use this configuration if needed.
  * d/contrib/bin/lxc-unpriv-{start,attach} helper scripts to make
    unprivileged containers easier to start manually
  * d/README.Debian: Added some intel about how to handle properly
    unprivileged containers and systemd user sessions, and potential
    filesystem ACL issues/implications
    (Closes: #989317, 987293)
  * d/p/0007: Makes the containers able to have /proc/sys/net rw
    (Closes: #981980)

 -- Pierre-Elliott Bécue <peb@debian.org>  Fri, 11 Jun 2021 21:43:41 +0200

lxc (1:4.0.6-1) unstable; urgency=medium

  * New upstream version 4.0.6
  * Refresh patches; drop patches applied upstream
  * Remove unreliable test for unprivileged containers
  * Move lxc-net dependencies from Recommends to Depends
    - Moved from Recommends: to Depends bridge-utils, dnsmasq-base,
      iptables, iproute2
    - Recommends: drop nftables; lxc-net uses iptables only, and nothing in
      lxc even references nftables.
  * Document and add new autopkgtest for unprivileged containers
  * Recommends: add wget, needed by the download template

 -- Antonio Terceiro <terceiro@debian.org>  Sun, 31 Jan 2021 14:29:40 -0300

lxc (1:4.0.6-0ubuntu1) hirsute; urgency=medium

  * New upstream bugfix release (4.0.6):
    - Improve handling for compatibility architectures for seccomp
    - Harden seccomp notifier implementation
    - Rework parsing of /proc/<pid>/mountinfo to handle kernel regression
    - Improve network device restoration
    - Significantly cleanup and harden config file parsing
    - Support new capabilities CAP_PERFORM, CAP_BPF, and CAP_CHECKPOINT_RESTORE
    - Harden containers started without CAP_NET_ADMIN
  * New upstream bugfix release (4.0.5):
    - Support allocating PTS devices from within the container
    - Harden more path/mount handling logics
    - Rework LSM logic to limit initializer use
  * Cherry-pick upstream fixes:
    - 0002-commands-fix-check-for-seccomp-notify-support.patch
    - 0003-configure-skip-libseccomp-tests-if-it-is-disabled.patch
    - 0004-conf-fix-containers-retaining-CAP_NET_ADMIN.patch
    - 0005-cgroups-fix-cgroup-mounting.patch
    - 0006-lsm-remove-obsolute-comment-about-constructor.patch
    - 0007-lxc_attach-include-rexec-conditionally.patch
    - 0008-tree-wide-fix-some-header-inclusions.patch
    - 0009-initutils-fix-missing-includes.patch
    - 0010-configure-support-static-binaries.patch
    - 0011-autotools-enable-static-builds-for-tools.patch
    - 0012-autotools-enable-static-builds-for-commands.patch
    - 0013-tree-wide-fix-compilation-with-Wstrict-prototypes-Wo.patch
    - 0014-config-update-ax_pthread.m4.patch
    - 0015-configure-add-AC_SYS_LARGEFILE-checking.patch
    - 0016-autotools-update-build.patch
    - 0017-file_utils-introduce-read_file_at.patch
    - 0018-string_utils-add-must_make_path_relative.patch
    - 0019-cgroups-coding-style-fixes.patch
    - 0020-cgroups-rework-cg_unified_init.patch
    - 0021-cgroups-detect-and-record-cgroup2-freezer-support.patch
    - 0022-criu-handle-cgroup2-freezer.patch
    - 0023-mkdir-p-proc-sys-on-container-startup.patch
    - 0024-conf-fix-coding-style.patch
    - 0025-conf-coding-style-fixes.patch
    - 0026-conf-move-proc-and-sys-mountpoint-creation-int-lxc_m.patch
    - 0027-attach-invert-child-parent-handling.patch
    - 0028-attach-use-__do_free-cleanup-macro-for-cwd.patch
    - 0029-attach-tweak-logging.patch
    - 0030-attach-use-__do_close-for-labelfd.patch
    - 0031-attach-coding-style-fixes.patch
    - 0032-attach-use-free_disarm.patch
    - 0033-attach-s-attach_child_main-do_attach-g.patch
    - 0034-attach-mark-do_attach-as-__noreturn.patch
    - 0035-attach-make-do_attach-void.patch
    - 0036-attach-use-close_prot_errno_disarm.patch
    - 0037-attach-add-some-DEBUG-logging-to-stdfd-dpulication.patch
    - 0038-cgroups-fix-cgroup-mounting.patch
    - 0039-utils-fix-mount_at.patch
    - 0040-configure-fix-static-builds-with-clang-12-and-LTO.patch
    - 0041-cgroups-bpf-fixes.patch
    - 0042-croups-improve-__do_bpf_program_free.patch
    - 0043-cgroups-coding-style-fixes.patch
    - 0044-cgroups-don-t-initiliaze-NULL-log.patch
    - 0045-cgroups-ensure-all-memory-is-zeroed.patch
    - 0046-cgroups-use-zalloc.patch
    - 0047-cgroups-tweak-cgroup-initialization.patch
    - 0048-log-remove-pointless-inline.patch
    - 0049-log-add-lxc_log_get_fd.patch
    - 0050-seccomp-use-lxc_log_get_fd.patch
    - 0051-log-rework-lxc_log_get_level.patch
    - 0052-seccomp-use-lxc_log_get_level.patch
    - 0053-cgroups-use-bpf-log-when-logging-at-trace-level.patch
    - 0054-log-add-lxc_log_trace-helper.patch
    - 0055-cgroups-use-PTR_TO_U64.patch
    - 0056-cgroups-align-methods.patch
    - 0057-utils-use-SYSTRACE-when-logging-stdio-permission-fix.patch
    - 0058-attach-log-failues-to-dup2-with-SYSDEBUG.patch
    - 0059-attach-fix-logging-for-stdfd-replacement.patch
    - 0060-attach-fix-error-checking-for-dup2.patch
    - 0061-cgroups-initialize-variable.patch
    - 0062-commands_utils-don-t-leak-memory.patch
    - 0063-conf-use-lxc_log_trace.patch
    - 0064-confile_utils-use-lxc_log_trace.patch
    - 0065-rexec-check-lseek-return-value.patch

 -- Stéphane Graber <stgraber@ubuntu.com>  Thu, 11 Feb 2021 16:34:13 -0500

lxc (1:4.0.5-2) unstable; urgency=medium

  * Add upstream patch to fix reboots in autopkgtest under cgroupv2
    (Closes: #978425)

 -- Antonio Terceiro <terceiro@debian.org>  Wed, 30 Dec 2020 10:17:51 -0300

lxc (1:4.0.5-1) unstable; urgency=medium

  * New upstream version 4.0.5
  * Refresh patches; drop patches already applied upstream
  * Add upstream patch to fix container startup on Linux 5.10 (Closes: #977923)
  * liblxc1.symbols: update

 -- Antonio Terceiro <terceiro@debian.org>  Tue, 22 Dec 2020 21:50:20 -0300

lxc (1:4.0.4-6) unstable; urgency=medium

  * autopkgtest: switch unpriv test to the new Architecture: field

 -- Antonio Terceiro <terceiro@debian.org>  Wed, 28 Oct 2020 16:59:41 -0300

lxc (1:4.0.4-5) unstable; urgency=medium

  * Team upload.
  * d/tests/unpriv: skip on arm64 as the test (right now) only works on amd64

 -- Johannes 'josch' Schauer <josch@debian.org>  Fri, 02 Oct 2020 21:34:46 +0200

lxc (1:4.0.4-4) unstable; urgency=medium

  * d/tests/unpriv: Adds dnsmasq-base to the qemu VM filesystem hosting the
    unprivileged containers tested

 -- Pierre-Elliott Bécue <peb@debian.org>  Thu, 01 Oct 2020 18:54:52 +0200

lxc (1:4.0.4-3) unstable; urgency=medium

  * d/p/0007: patch to avoid compilers complaints regarding short writes in
    the cgroup cgfsng, mitigating security risks of a buffer overrun.
  * d/control: For liblxc1: demote cgroupfs-mount | systemd from Depends to
    Suggests. Closes: #968404

 -- Pierre-Elliott Bécue <peb@debian.org>  Fri, 25 Sep 2020 14:12:38 +0200

lxc (1:4.0.4-2) unstable; urgency=medium

  * d/p/0005: patch to avoid lxc_stop failure if cgroup unfreeze fails
    Closes: #961584
  * d/lxc.lintian-overrides: Drop postinst-has-useless-call-to-ldconfig which
    is not a valid tag anymore

 -- Pierre-Elliott Bécue <peb@debian.org>  Sat, 19 Sep 2020 23:18:02 +0200

lxc (1:4.0.4-1) unstable; urgency=medium

  * New upstream release 4.0.4-1
    Closes: #969229, #966998
  * d/p/0003: Remove obsolete configurations from lxc.service.
    Closes: #968169
  * d/liblxc1.symbols: updated
  * d/lxc-test.lintian-overrides updated

 -- Pierre-Elliott Bécue <peb@debian.org>  Sat, 05 Sep 2020 23:21:40 +0200

lxc (1:4.0.4-0ubuntu3) groovy; urgency=medium

  * Cherry-pick upstream bugfix:
    - cgroups: fix armhf builds

 -- Stéphane Graber <stgraber@ubuntu.com>  Tue, 25 Aug 2020 09:45:30 -0400

lxc (1:4.0.4-0ubuntu2) groovy; urgency=medium

  * Cherry-pick upstream bugfix:
    - cgfsng: fix cgroup attach cgroup creation

 -- Stéphane Graber <stgraber@ubuntu.com>  Fri, 21 Aug 2020 14:09:35 -0400

lxc (1:4.0.4-0ubuntu1) groovy; urgency=medium

  * New upstream bugfix release (4.0.4):
    - Support for new Linux clone flags (clone into cgroup)
    - Support for new Linux VFS system calls
    - Internal symbols are now properly hidden from external consumers
  * New upstream bugfix release (4.0.3):
    - Improvement to cgroupv1/cgroupv2 handling
    - Various improvements and tests for lxc-usernsexec

 -- Stéphane Graber <stgraber@ubuntu.com>  Thu, 20 Aug 2020 18:07:53 -0400

lxc (1:4.0.2-1) unstable; urgency=medium

  * Rebuild for unstable

  [ Pierre-Elliott Bécue ]
  * Enable lxc-test-apparmor in autopkgtest (Closes: #958406)
  * Bump debhelper-compat level to 13
  * Add a debian-branch entry in debian/gbp.conf

  [ Antonio Terceiro ]
  * Enable LXC networking by default

  [ Johannes Schauer ]
  * Add autopkgtest testing unprivileged containers

  [ Camaleón ]
  * Add Spanish translation for the Debconf template (Closes: #959080)

 -- Pierre-Elliott Bécue <peb@debian.org>  Mon, 25 May 2020 18:15:10 +0200

lxc (1:4.0.2-1~1) experimental; urgency=medium

  * New upstream release 4.0.2 (Closes: #956014)
    - CGroup2 support (Closes: #944389, #946172, #947335)
    - Infrastructure for system call interception
    - PIDfd support
    - Improved network handling
    - Hardening and refactoring throughout the codebase, fixing very many issues

    + Patches rebased accordingly
  * Bump Standards-Version to 4.5.0
  * Labels liblxc1 and libpam-cgfs as Multi-Arch: same

 -- Pierre-Elliott Bécue <peb@debian.org>  Sun, 19 Apr 2020 00:31:46 +0200

lxc (1:4.0.2-0ubuntu1) focal; urgency=medium

  * New ypstream bugfix release (4.0.2):
    - RISC-V 64bit support
    - Better group handling in lxc-user-nic
    - Seccomp syscall interception fix for newer kernels
    - CGroup v1 limits are now automatically skipped on v2 systems
    - Fix a variety of issues identified by the Coverity Scan service

 -- Stéphane Graber <stgraber@ubuntu.com>  Thu, 16 Apr 2020 15:52:36 -0400

lxc (1:4.0.1-0ubuntu2) focal; urgency=medium

  * Cherry-pick upstream fixes:
    - 0001-Allocate-new-lxcbr0-subnet-at-startup-time.patch
    - 0002-start-ensure-all-file-descriptors-are-closed-during-.patch
    - 0003-syscall_numbers-handle-riscv.patch
    - 0004-lxc_user_nic-simplify-group-retrieval.patch
    - 0005-lxc_user_nic-continue-when-we-failed-to-find-a-group.patch
    - 0006-cgroups-whitespace-fixes.patch
    - 0007-seccomp-newer-kernels-require-the-buffer-to-be-zeroe.patch

 -- Stéphane Graber <stgraber@ubuntu.com>  Wed, 08 Apr 2020 23:33:44 -0400

lxc (1:4.0.1-0ubuntu1) focal; urgency=medium

  * New upstream bugfix release (4.0.1):
    - Tweak systemd ordering (start after remote-fs.target)
    - Fix various issues around attach and cgroups
    - Fix shutdown timeout not working on pidfd systems
    - Fix cgroup issue on 4.9 kernel
    - Fix write issues in /dev/stdout
  * Fix upgrade ordering (LP: #1870483)
  * Update lintian overrides:
    - Drop epoch bump override (no longer detecting it)
    - Add /usr/libexec override (LXC only uses /usr/lib)

 -- Stéphane Graber <stgraber@ubuntu.com>  Mon, 06 Apr 2020 16:24:28 -0400

lxc (1:4.0.0-0ubuntu2) focal; urgency=medium

  * Cherry-pick upstream bugfixes:
    - 0036-fix-non-root-user-cannot-write-dev-stdout.patch
    - 0037-cgroups-fix-uninitialized-transient_len-warning.patch
    - 0038-utils-rework-fix_stdio_permissions.patch
    - 0039-utils-use-setres-u-g-id-in-lxc_switch_uid_gid.patch
    - 0040-cgroups-fix-build-warning-on-GCC-7.patch
    - 0041-lxccontainer-poll-takes-millisecond-not-seconds.patch

 -- Stéphane Graber <stgraber@ubuntu.com>  Thu, 02 Apr 2020 12:25:20 -0400

lxc (1:4.0.0-0ubuntu1) focal; urgency=medium

  * Bump epoch to match Debian. (LP: #1837537)
  * New upstream release (4.0.0):
    - Fixes (LP: #1867535, LP: #1861880, LP: #1858799, LP: #1831258)
    - cgroups: Full cgroup2 support
    - cgroups: Freezer support in CGroup2
    - cgroups: eBPF device controller support in CGroup2
    - config: Add lxc.autodev.tmpfs.size configuration key
    - config: Add lxc.selinux.context.keyring key
    - config: Add lxc.keyring.session
    - file utils: Add fopen_cached() and fdopen_cached
    - api: Add new init_pidfd() member
    - memory utils: Add new cleanup api
    - lxc-usernsexec: Make it easy to map own uid
    - seccomp: Add s390 support
    - syscalls: Improve manual syscall implementations
    - network: Improved network device creation and removal
    - network: Allow moving wireless devices
  * Cherry-pick upstream bugfixes:
    - 0002-lxc_init-move-main-down.patch
    - 0003-lxc_init-add-missing-O_CLOEXEC.patch
    - 0004-lxc.service-Starts-after-remote-fs.target-to-allow-c.patch
    - 0005-tree-wide-harden-mount-option-parsing.patch
    - 0006-dir-use-cleanup-macro-in-dir_mount.patch
    - 0007-dir-improve-dir-backend.patch
    - 0008-cgroups-fix-attaching-to-the-unified-cgroup.patch
    - 0009-conf-rework-and-fix-leak-in-userns_exec_1.patch
    - 0010-commands-log-actual-errno-when-lxc_cmd_get_cgroup2_f.patch
    - 0011-cgroups-move-pointer-dereference-after-check.patch
    - 0012-cgroups-rework-__cg_unified_attach.patch
    - 0013-attach-use-close_prot_errno_disarm.patch
    - 0014-cgroups-remove-unused-variable.patch
    - 0015-cgroups-fix-unified-cgroup-attach.patch
    - 0016-fixup-i-o-handler-return-values.patch
    - 0017-Revert-cgroups-fix-unified-cgroup-attach.patch
    - 0018-conf-introduce-and-use-userns_exec_minimal.patch
    - 0019-conf-simplify-userns_exec_minimal.patch
    - 0020-cgroups-use-hidden-directory-for-attaching-cgroup.patch
    - 0021-cgroups-please-compilers.patch
    - 0022-monitor-process-exited-by-signal-SIGKILL-clean-cgrou.patch
    - 0023-cgroups-move-check-for-valid-monitor-process-up.patch
    - 0024-cgroups-better-helper-naming.patch
    - 0025-tree-wide-s-recursive_destroy-lxc_rm_rf-g.patch
    - 0026-verify-cgroup-controller-name.patch
    - 0027-cgroups-handle-older-kernels-e.g.-v4.9.patch
    - 0028-start-log-error-when-failing-to-create-cgroup.patch
    - 0029-cgroups-send-two-attach-fds.patch
    - 0030-cgroups-send-two-fds-to-attach-to-unified-cgroup.patch
    - 0031-start-remove-unnecessary-check-for-valid-cgroup_ops.patch
    - 0032-init-add-ExecReload-to-lxc.service-to-only-reload-pr.patch
    - 0033-apparmor-generate-ro-bind-remount-rule-list.patch
    - 0034-autotools-don-t-install-run-coccinelle.sh.patch
    - 0035-systemd-Add-Documentation-key.patch
  * Bump to new standards (4.5.0)
  * Move manpages to the correct packages (libpam-cgfs, libpam-common)
  * Refresh lintian overrides (lxc-utils)

 -- Stéphane Graber <stgraber@ubuntu.com>  Wed, 01 Apr 2020 17:35:58 -0400

lxc (1:3.1.0+really3.0.4-3) unstable; urgency=medium

  * Apply upstream patch to fix removal of containers that contain imutable
    files when using the plain directory backend.

 -- Antonio Terceiro <terceiro@debian.org>  Sat, 11 Apr 2020 17:20:29 -0300

lxc (1:3.1.0+really3.0.4-2) unstable; urgency=medium

  * 0009-lxc-attach-make-sure-exit-status-of-command-is-retur.patch: ensure
    lxc-attach returns the exit status of executed command (Closes: 934983)
  * debian/rules: fix dh_fixperms exception for lxc-user-nic (Closes: #934155)
  * debian/liblxc1.symbols: fix versioning information for sha1sum_file

 -- Antonio Terceiro <terceiro@debian.org>  Mon, 19 Aug 2019 21:42:25 -0300

lxc (1:3.1.0+really3.0.4-1.1) unstable; urgency=medium

  * Non-maintainer upload.
  * cgroups: Properly handle cpuset initialization
    d/p/0007: cgroups: hande cpuset initialization race
    d/p/0008: cgroups: initialize cpuset properly
   (Closes: #934387)

 -- Salvatore Bonaccorso <carnil@debian.org>  Wed, 14 Aug 2019 16:40:03 +0200

lxc (1:3.1.0+really3.0.4-1) unstable; urgency=medium

  * New upstream release 3.0.4
    + Drop patches 0004 and 0005 as the fix for runC CVE-2019-5736 is now
      upstream.
    + Fixes lxc-cgroup giving no output. (Closes: #929926)
  * d/p/0004: Prevent access to /proc/acpi via apparmor. (Closes: #906805)
  * d/p/0005: lxc.service: starts after remote-fs.target to avoid some
    failures for containers with their FS accessible via a remote fs
  * d/p/0006: Strips a non-expanded tag from lxc.pc.in
  * d/control:
    - Bump Standards-Version to 4.4.0
    - Update debheler-compat to 12
  * d/rules: Drop dh_strip override as it's not needed anymore.

 -- Pierre-Elliott Bécue <peb@debian.org>  Tue, 06 Aug 2019 15:33:36 +0200

# Older entries have been removed from this changelog.
# To read the complete changelog use `apt changelog libpam-cgfs`.
