update to 7.0

config/apparmor/abstractions/container-base.in

@@ -128,6 +128,24 @@
   mount options=(ro,remount,bind,noexec,nodev),
   mount options=(ro,remount,bind,nodev,nosuid),
   mount options=(ro,remount,bind,nosuid,noexec,nodev),
+  mount options=(ro,remount,bind,noatime),
+  mount options=(ro,remount,bind,noatime,nodev),
+  mount options=(ro,remount,bind,noatime,noexec),
+  mount options=(ro,remount,bind,noatime,nosuid),
+  mount options=(ro,remount,bind,noatime,noexec,nodev),
+  mount options=(ro,remount,bind,noatime,nosuid,nodev),
+  mount options=(ro,remount,bind,noatime,nosuid,noexec),
+  mount options=(ro,remount,bind,noatime,nosuid,noexec,nodev),
+  mount options=(ro,remount,bind,nosuid,noexec,strictatime),
+  mount options=(ro,remount,nosuid,noexec,strictatime),
+  mount options=(ro,remount,bind,nosymfollow),
+  mount options=(ro,remount,bind,nosymfollow,nodev),
+  mount options=(ro,remount,bind,nosymfollow,noexec),
+  mount options=(ro,remount,bind,nosymfollow,nosuid),
+  mount options=(ro,remount,bind,nosymfollow,noexec,nodev),
+  mount options=(ro,remount,bind,nosymfollow,nosuid,nodev),
+  mount options=(ro,remount,bind,nosymfollow,nosuid,noexec),
+  mount options=(ro,remount,bind,nosymfollow,nosuid,noexec,nodev),
 
   # allow moving mounts except for /proc, /sys and /dev
   mount options=(rw,move) /[^spd]*{,/**},

config/templates/common.conf.in

@@ -15,35 +15,6 @@ lxc.cap.drop = mac_admin mac_override sys_time sys_module sys_rawio
 # Ensure hostname is changed on clone
 lxc.hook.clone = @LXCHOOKDIR@/clonehostname
 
-# Default legacy cgroup configuration
-#
-# CGroup allowlist
-lxc.cgroup.devices.deny = a
-## Allow any mknod (but not reading/writing the node)
-lxc.cgroup.devices.allow = c *:* m
-lxc.cgroup.devices.allow = b *:* m
-## Allow specific devices
-### /dev/null
-lxc.cgroup.devices.allow = c 1:3 rwm
-### /dev/zero
-lxc.cgroup.devices.allow = c 1:5 rwm
-### /dev/full
-lxc.cgroup.devices.allow = c 1:7 rwm
-### /dev/tty
-lxc.cgroup.devices.allow = c 5:0 rwm
-### /dev/console
-lxc.cgroup.devices.allow = c 5:1 rwm
-### /dev/ptmx
-lxc.cgroup.devices.allow = c 5:2 rwm
-### /dev/random
-lxc.cgroup.devices.allow = c 1:8 rwm
-### /dev/urandom
-lxc.cgroup.devices.allow = c 1:9 rwm
-### /dev/pts/*
-lxc.cgroup.devices.allow = c 136:* rwm
-### fuse
-lxc.cgroup.devices.allow = c 10:229 rwm
-
 # Default unified cgroup configuration
 #
 # CGroup allowlist

config/templates/userns.conf.in

@@ -1,10 +1,5 @@
 # CAP_SYS_ADMIN in init-user-ns is required for cgroup.devices
 #
-# Default legacy cgroup configuration
-#
-lxc.cgroup.devices.deny =
-lxc.cgroup.devices.allow =
-
 # Default unified cgroup configuration
 #
 lxc.cgroup2.devices.deny =

doc/lxc.container.conf.sgml.in

@@ -1558,7 +1558,8 @@
 	ignore <option>lxc.cgroup.</option> settings on systems that only use
 	the unified hierarchy. Conversely, it will ignore
 	<option>lxc.cgroup2.</option> options on systems that only use legacy
-	hierarchies.
+	hierarchies. <option>lxc.cgroup.</option> (legacy and hybrid hierarchy)
+	support is dropped.
       </para>
 
       <para>

meson.build

@@ -4,7 +4,7 @@
 project(
     'lxc',
     'c',
-    version: '6.0.0',
+    version: '7.0.0',
     license: 'LGPLv2+',
     default_options: [
         'b_lto=true',
@@ -26,9 +26,9 @@ liblxc_dependencies = []
 oss_fuzz_dependencies = []
 
 # Version.
-liblxc_version = '1.8.0'
+liblxc_version = '1.9.0'
 version_data = configuration_data()
-version_data.set('LXC_VERSION_MAJOR', '6')
+version_data.set('LXC_VERSION_MAJOR', '7')
 version_data.set('LXC_VERSION_MINOR', '0')
 version_data.set('LXC_VERSION_MICRO', '0')
 version_data.set('LXC_VERSION_BETA', '')