app-containers/lxc: add 7.0.0

- add new use flag "landlock",
 - bump subslot due to new SONAME bump.

Bug: https://bugs.gentoo.org/973573
Signed-off-by: Joonas Niilola <juippis@gentoo.org>

app-containers/lxc/Manifest

@@ -4,3 +4,5 @@ DIST lxc-6.0.5.tar.gz 958966 BLAKE2B 74ee775f8a23467049f38f0973a24eb12b34b7c7585
 DIST lxc-6.0.5.tar.gz.asc 833 BLAKE2B ac1480c0b5588b290ab1ec81bf7bf85990df98a650832363529e9ede8afb7594bd21b58a4a79e7fe9519c381d4860d7a33f4090582612ffff7c448c77e641929 SHA512 8c28da0ebc280ae491bab815105f3c58f2c9cd742586ce86f9b1d2032724db4893811d689f7278bfc8c5570dc45ca6071e4c25b77647d762c77eca59249a15b5
 DIST lxc-6.0.6.tar.gz 963412 BLAKE2B 3bd9575f4c1a4b96ce5bea767e6a6b3c15a3021c62ebaf7421065ca55d2093ca467a8e9e86ce5d8316dab4fc9cde0c96dc1acedb73ccf167bd5c3e5484e5ceff SHA512 1d28aa749711be8a439de5e76019960d78e21bf576724bce7e8973ba4f6a3995c040cdc184e3c3a30814eb4cd2daec6851d26422c7d6d9d64ccd95add6c2eb30
 DIST lxc-6.0.6.tar.gz.asc 833 BLAKE2B 622a7c53629b3e5117bad956923824662073955ca8c6b3c6fba61b9d37c3b76fa48d55ecfd460fad4a5fe88c074264ad4c97b4193342d9c3a5fa322814a212fd SHA512 3ddaf0796e6888c15a5124141439ffa09c2d611f185cf3c8b2106eea530485a013846548bf9bd5ea9d0b69ee52aad2de9281b293a323ba2510db925c38cce98f
+DIST lxc-7.0.0.tar.gz 962710 BLAKE2B 025583e58ba2613bced13fbc7929ecbbf0eb0cd373cc59c80d1794b9398db109ecf35a2797cd08092d72e5718c406dd953d676ca0f29390fc139817c49886bee SHA512 5c7a9fba7313e2d19be649bf906067d99240cf5700e88892dcdb09a216206671db73d647fabad558af3a594ec24054f69627ea5e44638c187c4a0c07067e441a
+DIST lxc-7.0.0.tar.gz.asc 833 BLAKE2B e76eef4ca3485f88b1033ff2e044fc89806dfb11b1d0cfe6b73ab7b5ebb487818e2426f8fb21e8165e6633bc16186664cf0a5af6c72f0dc9e41df75c4cd92727 SHA512 6bb8cd64a73ef828275b98ac1657a9d8a4de878fff9fb6f63123974efec17e5143f4829f1d5275a47155005a28b4ea23774a9e5713f930cd4ed4cd951cc1fb06

app-containers/lxc/lxc-7.0.0.ebuild

@@ -0,0 +1,180 @@
+# Copyright 2022-2026 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit bash-completion-r1 linux-info meson optfeature systemd verify-sig
+
+DESCRIPTION="A userspace interface for the Linux kernel containment features"
+HOMEPAGE="https://linuxcontainers.org/ https://github.com/lxc/lxc"
+SRC_URI="https://linuxcontainers.org/downloads/lxc/${P}.tar.gz
+	verify-sig? ( https://linuxcontainers.org/downloads/lxc/${P}.tar.gz.asc )"
+
+LICENSE="GPL-2 LGPL-2.1 LGPL-3" # LGPL-2.1+ is listed, but it's covered by "LGPL-3"
+SLOT="0/1.700" # SONAME liblxc.so.1 + ${PV//./} _if_ breaking ABI change while bumping.
+KEYWORDS="~amd64 ~arm ~arm64 ~ppc64 ~riscv ~x86"
+IUSE="apparmor +caps doc examples io-uring landlock man pam seccomp selinux ssl systemd test +tools"
+
+REQUIRED_USE="landlock? ( seccomp )"
+
+RDEPEND="acct-group/lxc
+	acct-user/lxc
+	apparmor? ( sys-libs/libapparmor )
+	caps? ( sys-libs/libcap )
+	io-uring? ( >=sys-libs/liburing-2:= )
+	pam? ( sys-libs/pam )
+	seccomp? ( sys-libs/libseccomp )
+	selinux? ( sys-libs/libselinux )
+	ssl? ( dev-libs/openssl:0= )
+	systemd? (
+		sys-apps/dbus
+		sys-apps/systemd:=
+	)
+	tools? ( sys-libs/libcap )"
+DEPEND="${RDEPEND}
+	caps? ( sys-libs/libcap[static-libs] )
+	tools? ( sys-libs/libcap[static-libs] )
+	sys-kernel/linux-headers"
+BDEPEND="virtual/pkgconfig
+	doc? ( app-text/doxygen )
+	man? ( app-text/docbook2X )
+	verify-sig? ( sec-keys/openpgp-keys-linuxcontainers )"
+
+RESTRICT="!test? ( test )"
+
+CONFIG_CHECK="~!NETPRIO_CGROUP
+	~CGROUPS
+	~CGROUP_CPUACCT
+	~CGROUP_DEVICE
+	~CGROUP_FREEZER
+
+	~CGROUP_SCHED
+	~CPUSETS
+	~IPC_NS
+	~MACVLAN
+
+	~MEMCG
+	~NAMESPACES
+	~NET_NS
+	~PID_NS
+
+	~POSIX_MQUEUE
+	~USER_NS
+	~UTS_NS
+	~VETH"
+
+ERROR_CGROUP_FREEZER="CONFIG_CGROUP_FREEZER: needed to freeze containers"
+ERROR_MACVLAN="CONFIG_MACVLAN: needed for internal (inter-container) networking"
+ERROR_MEMCG="CONFIG_MEMCG: needed for memory resource control in containers"
+ERROR_NET_NS="CONFIG_NET_NS: needed for unshared network"
+ERROR_POSIX_MQUEUE="CONFIG_POSIX_MQUEUE: needed for lxc-execute command"
+ERROR_UTS_NS="CONFIG_UTS_NS: needed to unshare hostnames and uname info"
+ERROR_VETH="CONFIG_VETH: needed for internal (host-to-container) networking"
+
+VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/linuxcontainers.asc
+
+DOCS=( AUTHORS MAINTAINERS README.md doc/FAQ.txt )
+
+pkg_setup() {
+	if use landlock ; then
+		WARNING_SECURITY_LANDLOCK="CONFIG_SECURITY_LANDLOCK: needed with landlock"
+	fi
+	linux-info_pkg_setup
+}
+
+src_configure() {
+
+	# -Dtools-multicall=false: will create a single binary called 'lxc' that conflicts with LXD.
+	local emesonargs=(
+		--localstatedir "${EPREFIX}/var"
+
+		-Dcoverity-build=false
+		-Dinstall-state-dirs=false
+		-Doss-fuzz=false
+		-Dspecfile=false
+		-Dtools-multicall=false
+
+		-Dcommands=true
+		-Dinstall-init-files=true
+		-Dmemfd-rexec=true
+		-Dthread-safety=true
+
+		$(meson_use apparmor)
+		$(meson_use caps capabilities)
+		$(meson_use doc api-docs)
+		$(meson_use examples)
+		$(meson_use io-uring io-uring-event-loop)
+		$(meson_use landlock landlock-monitor)
+		$(meson_use man)
+		$(meson_use pam pam-cgroup)
+		$(meson_use seccomp)
+		$(meson_use selinux)
+		$(meson_use ssl openssl)
+		$(meson_use test tests)
+		$(meson_use tools)
+
+		$(usex systemd -Ddbus=true -Ddbus=false)
+		$(usex systemd -Dinit-script="systemd" -Dinit-script="openrc")
+
+		-Ddata-path=/var/lib/lxc
+		-Ddoc-path=/usr/share/doc/${PF}
+		-Dlog-path=/var/log/lxc
+		-Drootfs-mount-path=/var/lib/lxc/rootfs
+		-Druntime-path=/run
+	)
+
+	use tools && local emesonargs+=( -Dcapabilities=true )
+
+	meson_src_configure
+}
+
+src_install() {
+	if use doc ; then
+		local HTML_DOCS=( "${BUILD_DIR}/html/"* )
+	fi
+	meson_src_install
+
+	# The main bash-completion file will collide with lxd, need to relocate and update symlinks.
+	local lxcbashcompdir="${D}/$(get_bashcompdir)"
+	mkdir -p "${lxcbashcompdir}" || die "Failed to create bashcompdir."
+	mv "${lxcbashcompdir}"/_lxc "${lxcbashcompdir}"/lxc-start || die "Failed to move _lxc bash completion file."
+
+	# Build system will install all bash completion files regardless of our 'tools' use flag.
+	# Though installing them all will add bash completions for commands that don't exist, it's
+	# cleaner than dealing with individual files based on the use flag status.
+	bashcomp_alias lxc-start lxc-{attach,autostart,cgroup,checkpoint,config,console,copy,create,destroy,device,execute,freeze,info,ls,monitor,snapshot,stop,top,unfreeze,unshare,update-config,usernsexec,wait}
+
+	find "${ED}" -name '*.la' -delete -o -name '*.a' -delete || die
+
+	# Replace upstream systemd files.
+	if use systemd ; then
+		rm -r "${D}$(systemd_get_systemunitdir)" || die "Failed to remove systemd lib dir"
+	else
+		# The openrc files aren't installed with correct permissions.
+		fperms 0755 /etc/init.d/lxc-{containers,net}
+	fi
+
+	newinitd "${FILESDIR}/${PN}.initd.9" ${PN}
+	systemd_newunit "${FILESDIR}"/lxc-monitord.service.5.0.0 lxc-monitord.service
+	systemd_newunit "${FILESDIR}"/lxc-net.service.5.0.0 lxc-net.service
+	systemd_newunit "${FILESDIR}"/lxc.service-5.0.0 lxc.service
+	systemd_newunit "${FILESDIR}"/lxc_at.service.5.0.0 "lxc@.service"
+
+	if ! use apparmor; then
+		sed -i '/lxc-apparmor-load/d' "${D}$(systemd_get_systemunitdir)/lxc.service" ||
+			die "Failed to remove apparmor references from lxc.service systemd unit."
+	fi
+}
+
+pkg_postinst() {
+	elog "Please refer to "
+	elog "https://wiki.gentoo.org/wiki/LXC for introduction and usage guide."
+	elog
+	elog "Run 'lxc-checkconfig' to see optional kernel features."
+	elog
+
+	optfeature "creating your own LXC containers" app-containers/distrobuilder
+	optfeature "automatic template scripts" app-containers/lxc-templates
+	optfeature "Debian-based distribution container image support" dev-util/debootstrap
+	optfeature "snapshot & restore functionality" sys-process/criu
+}

app-containers/lxc/metadata.xml

@@ -10,6 +10,7 @@
     <name>Gentoo Virtualization Project</name>
   </maintainer>
   <use>
+    <flag name="landlock">Use Landlock to restrict what the monitor API handlers can do on the system</flag>
     <flag name="tools">Build and install additional command line tools</flag>
   </use>
   <upstream>