]> git.proxmox.com Git - mirror_lxc.git/blame - src/lxc/conf.c
projects / mirror_lxc.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
confile: add lxc.console.buffer.size
[mirror_lxc.git] / src / lxc / conf.c
CommitLineData
0ad19a3f 1/*
2 * lxc: linux Container library
3 *
4 * (C) Copyright IBM Corp. 2007, 2008
5 *
6 * Authors:
9afe19d6 7 * Daniel Lezcano <daniel.lezcano at free.fr>
0ad19a3f 8 *
9 * This library is free software; you can redistribute it and/or
10 * modify it under the terms of the GNU Lesser General Public
11 * License as published by the Free Software Foundation; either
12 * version 2.1 of the License, or (at your option) any later version.
13 *
14 * This library is distributed in the hope that it will be useful,
15 * but WITHOUT ANY WARRANTY; without even the implied warranty of
16 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
17 * Lesser General Public License for more details.
18 *
19 * You should have received a copy of the GNU Lesser General Public
20 * License along with this library; if not, write to the Free Software
250b1eec 21 * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
0ad19a3f 22 */
1d52bdf7
CB		 23
24#define _GNU_SOURCE
d06245b8
NC		 25#include "config.h"
26
8f3e280e
CB		 27#include <dirent.h>
28#include <errno.h>
29#include <fcntl.h>
30#include <grp.h>
31#include <inttypes.h>
32#include <libgen.h>
33#include <pwd.h>
34#include <stdarg.h>
0ad19a3f 35#include <stdio.h>
0ad19a3f 36#include <stdlib.h>
0ad19a3f 37#include <string.h>
8f3e280e 38#include <time.h>
0ad19a3f 39#include <unistd.h>
8f3e280e
CB		 40#include <arpa/inet.h>
41#include <linux/loop.h>
8f3e280e
CB		 42#include <net/if.h>
43#include <netinet/in.h>
44#include <sys/mman.h>
45#include <sys/mount.h>
46#include <sys/param.h>
47#include <sys/prctl.h>
48#include <sys/stat.h>
49#include <sys/socket.h>
ce831b3b 50#include <sys/sysmacros.h>
2d76d1d7 51#include <sys/syscall.h>
97e9cfa0 52#include <sys/types.h>
8f3e280e
CB		 53#include <sys/utsname.h>
54#include <sys/wait.h>
1d52bdf7 55
af6824fc
ST		 56/* makedev() */
57#ifdef MAJOR_IN_MKDEV
58# include <sys/mkdev.h>
59#endif
af6824fc 60
614305f3 61#ifdef HAVE_STATVFS
2938f7c8 62#include <sys/statvfs.h>
614305f3 63#endif
e827ff7e
SG		 64
65#if HAVE_PTY_H
b0a33c1e 66#include <pty.h>
e827ff7e
SG		 67#else
68#include <../include/openpty.h>
69#endif
0ad19a3f 70
e8bd4e43 71#include "af_unix.h"
8f3e280e
CB		 72#include "caps.h" /* for lxc_caps_last_cap() */
73#include "cgroup.h"
1b09f2c0 74#include "conf.h"
1ed6ba91 75#include "confile_utils.h"
8f3e280e 76#include "error.h"
1b09f2c0 77#include "log.h"
025ed0f3 78#include "lxclock.h"
8f3e280e 79#include "lxcseccomp.h"
4355ab5f 80#include "namespace.h"
8f3e280e
CB		 81#include "network.h"
82#include "parse.h"
732375f5 83#include "ringbuf.h"
28d832c4
CB		 84#include "storage.h"
85#include "storage/aufs.h"
86#include "storage/overlay.h"
8f3e280e 87#include "utils.h"
fe4de9a6 88#include "lsm/lsm.h"
d0a36f2c 89
e37dda71 90#if HAVE_LIBCAP
495d2046
SG		 91#include <sys/capability.h>
92#endif
93
6ff05e18
SG		 94#if HAVE_SYS_PERSONALITY_H
95#include <sys/personality.h>
96#endif
97
edaf8b1b
SG		 98#if IS_BIONIC
99#include <../include/lxcmntent.h>
100#else
101#include <mntent.h>
102#endif
103
f48b5fd8
FF		 104#if !defined(HAVE_PRLIMIT) && defined(HAVE_PRLIMIT64)
105#include <../include/prlimit.h>
106#endif
107
36eb9bde 108lxc_log_define(lxc_conf, lxc);
e5bda9ee 109
e37dda71 110#if HAVE_LIBCAP
b09094da
MN		 111#ifndef CAP_SETFCAP
112#define CAP_SETFCAP 31
113#endif
114
115#ifndef CAP_MAC_OVERRIDE
116#define CAP_MAC_OVERRIDE 32
117#endif
118
119#ifndef CAP_MAC_ADMIN
120#define CAP_MAC_ADMIN 33
121#endif
495d2046 122#endif
b09094da
MN		 123
124#ifndef PR_CAPBSET_DROP
125#define PR_CAPBSET_DROP 24
126#endif
127
9818cae4
SG		 128#ifndef LO_FLAGS_AUTOCLEAR
129#define LO_FLAGS_AUTOCLEAR 4
130#endif
131
bc5b27d6
DK		 132#ifndef CAP_SETUID
133#define CAP_SETUID 7
134#endif
135
136#ifndef CAP_SETGID
137#define CAP_SETGID 6
138#endif
139
0769b82a
CS		 140/* needed for cgroup automount checks, regardless of whether we
141 * have included linux/capability.h or not */
142#ifndef CAP_SYS_ADMIN
143#define CAP_SYS_ADMIN 21
144#endif
145
2d76d1d7
SG		 146/* Define pivot_root() if missing from the C library */
147#ifndef HAVE_PIVOT_ROOT
148static int pivot_root(const char * new_root, const char * put_old)
149{
150#ifdef __NR_pivot_root
8f3e280e 151 return syscall(__NR_pivot_root, new_root, put_old);
2d76d1d7 152#else
8f3e280e
CB		 153 errno = ENOSYS;
154 return -1;
2d76d1d7
SG		 155#endif
156}
157#else
158extern int pivot_root(const char * new_root, const char * put_old);
159#endif
160
161/* Define sethostname() if missing from the C library */
162#ifndef HAVE_SETHOSTNAME
163static int sethostname(const char * name, size_t len)
164{
165#ifdef __NR_sethostname
8f3e280e 166 return syscall(__NR_sethostname, name, len);
2d76d1d7 167#else
8f3e280e
CB		 168 errno = ENOSYS;
169 return -1;
2d76d1d7
SG		 170#endif
171}
172#endif
173
ecec0126
SG		 174#ifndef MS_PRIVATE
175#define MS_PRIVATE (1<<18)
176#endif
177
8912711c
CB		 178#ifndef MS_LAZYTIME
179#define MS_LAZYTIME (1<<25)
180#endif
181
2b9ae35a
CB		 182char *lxchook_names[NUM_LXC_HOOKS] = {"pre-start", "pre-mount", "mount",
183 "autodev", "start", "stop",
08dd2805
SH		 184 "post-stop", "clone", "destroy",
185 "start-host"};
72d0e1cb 186
998ac676
RT		 187struct mount_opt {
188 char *name;
189 int clear;
190 int flag;
191};
192
81810dd1
DL		 193struct caps_opt {
194 char *name;
195 int value;
196};
197
c6d09e15
WB		 198struct limit_opt {
199 char *name;
200 int value;
201};
202
858377e4
SH		 203/*
204 * The lxc_conf of the container currently being worked on in an
205 * API call
206 * This is used in the error calls
207 */
208#ifdef HAVE_TLS
209__thread struct lxc_conf *current_config;
210#else
211struct lxc_conf *current_config;
212#endif
213
998ac676 214static struct mount_opt mount_opt[] = {
470b359b
CB		 215 { "async", 1, MS_SYNCHRONOUS },
216 { "atime", 1, MS_NOATIME },
217 { "bind", 0, MS_BIND },
88d413d5 218 { "defaults", 0, 0 },
88d413d5 219 { "dev", 1, MS_NODEV },
470b359b 220 { "diratime", 1, MS_NODIRATIME },
88d413d5 221 { "dirsync", 0, MS_DIRSYNC },
470b359b 222 { "exec", 1, MS_NOEXEC },
8912711c 223 { "lazytime", 0, MS_LAZYTIME },
88d413d5 224 { "mand", 0, MS_MANDLOCK },
88d413d5 225 { "noatime", 0, MS_NOATIME },
470b359b 226 { "nodev", 0, MS_NODEV },
88d413d5 227 { "nodiratime", 0, MS_NODIRATIME },
470b359b
CB		 228 { "noexec", 0, MS_NOEXEC },
229 { "nomand", 1, MS_MANDLOCK },
230 { "norelatime", 1, MS_RELATIME },
231 { "nostrictatime", 1, MS_STRICTATIME },
232 { "nosuid", 0, MS_NOSUID },
88d413d5
SW		 233 { "rbind", 0, MS_BIND|MS_REC },
234 { "relatime", 0, MS_RELATIME },
470b359b
CB		 235 { "remount", 0, MS_REMOUNT },
236 { "ro", 0, MS_RDONLY },
237 { "rw", 1, MS_RDONLY },
88d413d5 238 { "strictatime", 0, MS_STRICTATIME },
470b359b
CB		 239 { "suid", 1, MS_NOSUID },
240 { "sync", 0, MS_SYNCHRONOUS },
88d413d5 241 { NULL, 0, 0 },
998ac676
RT		 242};
243
e37dda71 244#if HAVE_LIBCAP
81810dd1 245static struct caps_opt caps_opt[] = {
a6afdde9 246 { "chown", CAP_CHOWN },
1e11be34
DL		 247 { "dac_override", CAP_DAC_OVERRIDE },
248 { "dac_read_search", CAP_DAC_READ_SEARCH },
249 { "fowner", CAP_FOWNER },
250 { "fsetid", CAP_FSETID },
81810dd1
DL		 251 { "kill", CAP_KILL },
252 { "setgid", CAP_SETGID },
253 { "setuid", CAP_SETUID },
254 { "setpcap", CAP_SETPCAP },
255 { "linux_immutable", CAP_LINUX_IMMUTABLE },
256 { "net_bind_service", CAP_NET_BIND_SERVICE },
257 { "net_broadcast", CAP_NET_BROADCAST },
258 { "net_admin", CAP_NET_ADMIN },
259 { "net_raw", CAP_NET_RAW },
260 { "ipc_lock", CAP_IPC_LOCK },
261 { "ipc_owner", CAP_IPC_OWNER },
262 { "sys_module", CAP_SYS_MODULE },
263 { "sys_rawio", CAP_SYS_RAWIO },
264 { "sys_chroot", CAP_SYS_CHROOT },
265 { "sys_ptrace", CAP_SYS_PTRACE },
266 { "sys_pacct", CAP_SYS_PACCT },
267 { "sys_admin", CAP_SYS_ADMIN },
268 { "sys_boot", CAP_SYS_BOOT },
269 { "sys_nice", CAP_SYS_NICE },
270 { "sys_resource", CAP_SYS_RESOURCE },
271 { "sys_time", CAP_SYS_TIME },
272 { "sys_tty_config", CAP_SYS_TTY_CONFIG },
273 { "mknod", CAP_MKNOD },
274 { "lease", CAP_LEASE },
57b837e2
CB		 275#ifdef CAP_AUDIT_READ
276 { "audit_read", CAP_AUDIT_READ },
277#endif
9527e566 278#ifdef CAP_AUDIT_WRITE
81810dd1 279 { "audit_write", CAP_AUDIT_WRITE },
9527e566
FW		 280#endif
281#ifdef CAP_AUDIT_CONTROL
81810dd1 282 { "audit_control", CAP_AUDIT_CONTROL },
9527e566 283#endif
81810dd1
DL		 284 { "setfcap", CAP_SETFCAP },
285 { "mac_override", CAP_MAC_OVERRIDE },
286 { "mac_admin", CAP_MAC_ADMIN },
5170c716
CS		 287#ifdef CAP_SYSLOG
288 { "syslog", CAP_SYSLOG },
289#endif
290#ifdef CAP_WAKE_ALARM
291 { "wake_alarm", CAP_WAKE_ALARM },
292#endif
2b54359b
CB		 293#ifdef CAP_BLOCK_SUSPEND
294 { "block_suspend", CAP_BLOCK_SUSPEND },
295#endif
81810dd1 296};
495d2046
SG		 297#else
298static struct caps_opt caps_opt[] = {};
299#endif
81810dd1 300
c6d09e15
WB		 301static struct limit_opt limit_opt[] = {
302#ifdef RLIMIT_AS
303 { "as", RLIMIT_AS },
304#endif
305#ifdef RLIMIT_CORE
306 { "core", RLIMIT_CORE },
307#endif
308#ifdef RLIMIT_CPU
309 { "cpu", RLIMIT_CPU },
310#endif
311#ifdef RLIMIT_DATA
312 { "data", RLIMIT_DATA },
313#endif
314#ifdef RLIMIT_FSIZE
315 { "fsize", RLIMIT_FSIZE },
316#endif
317#ifdef RLIMIT_LOCKS
318 { "locks", RLIMIT_LOCKS },
319#endif
320#ifdef RLIMIT_MEMLOCK
321 { "memlock", RLIMIT_MEMLOCK },
322#endif
323#ifdef RLIMIT_MSGQUEUE
324 { "msgqueue", RLIMIT_MSGQUEUE },
325#endif
326#ifdef RLIMIT_NICE
327 { "nice", RLIMIT_NICE },
328#endif
329#ifdef RLIMIT_NOFILE
330 { "nofile", RLIMIT_NOFILE },
331#endif
332#ifdef RLIMIT_NPROC
333 { "nproc", RLIMIT_NPROC },
334#endif
335#ifdef RLIMIT_RSS
336 { "rss", RLIMIT_RSS },
337#endif
338#ifdef RLIMIT_RTPRIO
339 { "rtprio", RLIMIT_RTPRIO },
340#endif
341#ifdef RLIMIT_RTTIME
342 { "rttime", RLIMIT_RTTIME },
343#endif
344#ifdef RLIMIT_SIGPENDING
345 { "sigpending", RLIMIT_SIGPENDING },
346#endif
347#ifdef RLIMIT_STACK
348 { "stack", RLIMIT_STACK },
349#endif
350};
351
91c3830e
SH		 352static int run_buffer(char *buffer)
353{
ebec9176 354 struct lxc_popen_FILE *f;
91c3830e 355 char *output;
8e7da691 356 int ret;
91c3830e 357
ebec9176 358 f = lxc_popen(buffer);
91c3830e 359 if (!f) {
062b72c6 360 SYSERROR("Failed to popen() %s.", buffer);
91c3830e
SH		 361 return -1;
362 }
363
364 output = malloc(LXC_LOG_BUFFER_SIZE);
365 if (!output) {
062b72c6 366 ERROR("Failed to allocate memory for %s.", buffer);
ebec9176 367 lxc_pclose(f);
91c3830e
SH		 368 return -1;
369 }
370
062b72c6
CB		 371 while (fgets(output, LXC_LOG_BUFFER_SIZE, f->f))
372 DEBUG("Script %s with output: %s.", buffer, output);
91c3830e
SH		 373
374 free(output);
375
ebec9176 376 ret = lxc_pclose(f);
8e7da691 377 if (ret == -1) {
062b72c6 378 SYSERROR("Script exited with error.");
91c3830e 379 return -1;
8e7da691 380 } else if (WIFEXITED(ret) && WEXITSTATUS(ret) != 0) {
062b72c6 381 ERROR("Script exited with status %d.", WEXITSTATUS(ret));
8e7da691
DE		 382 return -1;
383 } else if (WIFSIGNALED(ret)) {
062b72c6 384 ERROR("Script terminated by signal %d.", WTERMSIG(ret));
8e7da691 385 return -1;
91c3830e
SH		 386 }
387
388 return 0;
389}
390
148e91f5 391static int run_script_argv(const char *name, const char *section,
062b72c6
CB		 392 const char *script, const char *hook,
393 const char *lxcpath, char **argsin)
148e91f5
SH		 394{
395 int ret, i;
396 char *buffer;
397 size_t size = 0;
398
062b72c6 399 INFO("Executing script \"%s\" for container \"%s\", config section \"%s\".",
148e91f5
SH		 400 script, name, section);
401
062b72c6 402 for (i = 0; argsin && argsin[i]; i++)
148e91f5
SH		 403 size += strlen(argsin[i]) + 1;
404
405 size += strlen(hook) + 1;
406
407 size += strlen(script);
408 size += strlen(name);
409 size += strlen(section);
410 size += 3;
411
412 if (size > INT_MAX)
413 return -1;
414
415 buffer = alloca(size);
416 if (!buffer) {
062b72c6 417 ERROR("Failed to allocate memory.");
148e91f5
SH		 418 return -1;
419 }
420
062b72c6
CB		 421 ret =
422 snprintf(buffer, size, "%s %s %s %s", script, name, section, hook);
423 if (ret < 0 || (size_t)ret >= size) {
424 ERROR("Script name too long.");
148e91f5
SH		 425 return -1;
426 }
427
062b72c6
CB		 428 for (i = 0; argsin && argsin[i]; i++) {
429 int len = size - ret;
148e91f5
SH		 430 int rc;
431 rc = snprintf(buffer + ret, len, " %s", argsin[i]);
432 if (rc < 0 || rc >= len) {
062b72c6 433 ERROR("Script args too long.");
148e91f5
SH		 434 return -1;
435 }
436 ret += rc;
437 }
438
439 return run_buffer(buffer);
440}
441
811ef482 442int run_script(const char *name, const char *section, const char *script, ...)
e3b4c4c4 443{
abbfd20b 444 int ret;
91c3830e 445 char *buffer, *p;
abbfd20b
DL		 446 size_t size = 0;
447 va_list ap;
751d9dcd 448
062b72c6 449 INFO("Executing script \"%s\" for container \"%s\", config section \"%s\".",
751d9dcd 450 script, name, section);
e3b4c4c4 451
abbfd20b
DL		 452 va_start(ap, script);
453 while ((p = va_arg(ap, char *)))
95642a10 454 size += strlen(p) + 1;
abbfd20b
DL		 455 va_end(ap);
456
457 size += strlen(script);
458 size += strlen(name);
459 size += strlen(section);
95642a10 460 size += 3;
abbfd20b 461
95642a10
MS		 462 if (size > INT_MAX)
463 return -1;
464
465 buffer = alloca(size);
abbfd20b 466 if (!buffer) {
062b72c6 467 ERROR("Failed to allocate memory.");
751d9dcd
DL		 468 return -1;
469 }
470
9ba8130c
SH		 471 ret = snprintf(buffer, size, "%s %s %s", script, name, section);
472 if (ret < 0 || ret >= size) {
062b72c6 473 ERROR("Script name too long.");
9ba8130c
SH		 474 return -1;
475 }
751d9dcd 476
abbfd20b 477 va_start(ap, script);
9ba8130c 478 while ((p = va_arg(ap, char *))) {
062b72c6 479 int len = size - ret;
9ba8130c
SH		 480 int rc;
481 rc = snprintf(buffer + ret, len, " %s", p);
482 if (rc < 0 || rc >= len) {
062b72c6 483 ERROR("Script args too long.");
9ba8130c
SH		 484 return -1;
485 }
486 ret += rc;
487 }
abbfd20b 488 va_end(ap);
751d9dcd 489
91c3830e 490 return run_buffer(buffer);
e3b4c4c4
ST		 491}
492
0c547523
SH		 493/*
494 * pin_rootfs
b7ed4bf0
CS		 495 * if rootfs is a directory, then open ${rootfs}/lxc.hold for writing for
496 * the duration of the container run, to prevent the container from marking
497 * the underlying fs readonly on shutdown. unlink the file immediately so
498 * no name pollution is happens
0c547523
SH		 499 * return -1 on error.
500 * return -2 if nothing needed to be pinned.
501 * return an open fd (>=0) if we pinned it.
502 */
503int pin_rootfs(const char *rootfs)
504{
505 char absrootfs[MAXPATHLEN];
506 char absrootfspin[MAXPATHLEN];
507 struct stat s;
508 int ret, fd;
509
e99ee0de 510 if (rootfs == NULL || strlen(rootfs) == 0)
0d03360a 511 return -2;
e99ee0de 512
00ec333b 513 if (!realpath(rootfs, absrootfs))
9be53773 514 return -2;
0c547523 515
00ec333b 516 if (access(absrootfs, F_OK))
0c547523 517 return -1;
0c547523 518
00ec333b 519 if (stat(absrootfs, &s))
0c547523 520 return -1;
0c547523 521
72f919c4 522 if (!S_ISDIR(s.st_mode))
0c547523
SH		 523 return -2;
524
b7ed4bf0 525 ret = snprintf(absrootfspin, MAXPATHLEN, "%s/lxc.hold", absrootfs);
00ec333b 526 if (ret >= MAXPATHLEN)
0c547523 527 return -1;
0c547523
SH		 528
529 fd = open(absrootfspin, O_CREAT | O_RDWR, S_IWUSR|S_IRUSR);
b7ed4bf0
CS		 530 if (fd < 0)
531 return fd;
532 (void)unlink(absrootfspin);
0c547523
SH		 533 return fd;
534}
535
e2a7e8dc
SH		 536/*
537 * If we are asking to remount something, make sure that any
538 * NOEXEC etc are honored.
539 */
5ae72b98 540unsigned long add_required_remount_flags(const char *s, const char *d,
e2a7e8dc
SH		 541 unsigned long flags)
542{
614305f3 543#ifdef HAVE_STATVFS
e2a7e8dc
SH		 544 struct statvfs sb;
545 unsigned long required_flags = 0;
546
547 if (!(flags & MS_REMOUNT))
548 return flags;
549
550 if (!s)
551 s = d;
552
553 if (!s)
554 return flags;
555 if (statvfs(s, &sb) < 0)
556 return flags;
557
558 if (sb.f_flag & MS_NOSUID)
559 required_flags |= MS_NOSUID;
560 if (sb.f_flag & MS_NODEV)
561 required_flags |= MS_NODEV;
562 if (sb.f_flag & MS_RDONLY)
563 required_flags |= MS_RDONLY;
564 if (sb.f_flag & MS_NOEXEC)
565 required_flags |= MS_NOEXEC;
566
567 return flags | required_flags;
614305f3
SH		 568#else
569 return flags;
570#endif
e2a7e8dc
SH		 571}
572
4fb3cba5 573static int lxc_mount_auto_mounts(struct lxc_conf *conf, int flags, struct lxc_handler *handler)
368bbc02 574{
368bbc02 575 int r;
80e80c40 576 int i;
b06b8511
CS		 577 static struct {
578 int match_mask;
579 int match_flag;
580 const char *source;
581 const char *destination;
582 const char *fstype;
583 unsigned long flags;
584 const char *options;
585 } default_mounts[] = {
586 /* Read-only bind-mounting... In older kernels, doing that required
587 * to do one MS_BIND mount and then MS_REMOUNT|MS_RDONLY the same
588 * one. According to mount(2) manpage, MS_BIND honors MS_RDONLY from
589 * kernel 2.6.26 onwards. However, this apparently does not work on
590 * kernel 3.8. Unfortunately, on that very same kernel, doing the
591 * same trick as above doesn't seem to work either, there one needs
592 * to ALSO specify MS_BIND for the remount, otherwise the entire
593 * fs is remounted read-only or the mount fails because it's busy...
594 * MS_REMOUNT|MS_BIND|MS_RDONLY seems to work for kernels as low as
595 * 2.6.32...
368bbc02 596 */
f24a52d5 597 { LXC_AUTO_PROC_MASK, LXC_AUTO_PROC_MIXED, "proc", "%r/proc", "proc", MS_NODEV|MS_NOEXEC|MS_NOSUID, NULL },
592fd47a
SH		 598 /* proc/tty is used as a temporary placeholder for proc/sys/net which we'll move back in a few steps */
599 { LXC_AUTO_PROC_MASK, LXC_AUTO_PROC_MIXED, "%r/proc/sys/net", "%r/proc/tty", NULL, MS_BIND, NULL },
f24a52d5
SG		 600 { LXC_AUTO_PROC_MASK, LXC_AUTO_PROC_MIXED, "%r/proc/sys", "%r/proc/sys", NULL, MS_BIND, NULL },
601 { LXC_AUTO_PROC_MASK, LXC_AUTO_PROC_MIXED, NULL, "%r/proc/sys", NULL, MS_REMOUNT|MS_BIND|MS_RDONLY, NULL },
592fd47a 602 { LXC_AUTO_PROC_MASK, LXC_AUTO_PROC_MIXED, "%r/proc/tty", "%r/proc/sys/net", NULL, MS_MOVE, NULL },
f24a52d5
SG		 603 { LXC_AUTO_PROC_MASK, LXC_AUTO_PROC_MIXED, "%r/proc/sysrq-trigger", "%r/proc/sysrq-trigger", NULL, MS_BIND, NULL },
604 { LXC_AUTO_PROC_MASK, LXC_AUTO_PROC_MIXED, NULL, "%r/proc/sysrq-trigger", NULL, MS_REMOUNT|MS_BIND|MS_RDONLY, NULL },
605 { LXC_AUTO_PROC_MASK, LXC_AUTO_PROC_RW, "proc", "%r/proc", "proc", MS_NODEV|MS_NOEXEC|MS_NOSUID, NULL },
606 { LXC_AUTO_SYS_MASK, LXC_AUTO_SYS_RW, "sysfs", "%r/sys", "sysfs", 0, NULL },
607 { LXC_AUTO_SYS_MASK, LXC_AUTO_SYS_RO, "sysfs", "%r/sys", "sysfs", MS_RDONLY, NULL },
608 { LXC_AUTO_SYS_MASK, LXC_AUTO_SYS_MIXED, "sysfs", "%r/sys", "sysfs", MS_NODEV|MS_NOEXEC|MS_NOSUID, NULL },
609 { LXC_AUTO_SYS_MASK, LXC_AUTO_SYS_MIXED, "%r/sys", "%r/sys", NULL, MS_BIND, NULL },
610 { LXC_AUTO_SYS_MASK, LXC_AUTO_SYS_MIXED, NULL, "%r/sys", NULL, MS_REMOUNT|MS_BIND|MS_RDONLY, NULL },
611 { LXC_AUTO_SYS_MASK, LXC_AUTO_SYS_MIXED, "sysfs", "%r/sys/devices/virtual/net", "sysfs", 0, NULL },
612 { LXC_AUTO_SYS_MASK, LXC_AUTO_SYS_MIXED, "%r/sys/devices/virtual/net/devices/virtual/net", "%r/sys/devices/virtual/net", NULL, MS_BIND, NULL },
613 { LXC_AUTO_SYS_MASK, LXC_AUTO_SYS_MIXED, NULL, "%r/sys/devices/virtual/net", NULL, MS_REMOUNT|MS_BIND|MS_NOSUID|MS_NODEV|MS_NOEXEC, NULL },
614 { 0, 0, NULL, NULL, NULL, 0, NULL }
b06b8511 615 };
368bbc02 616
b06b8511
CS		 617 for (i = 0; default_mounts[i].match_mask; i++) {
618 if ((flags & default_mounts[i].match_mask) == default_mounts[i].match_flag) {
619 char *source = NULL;
620 char *destination = NULL;
621 int saved_errno;
e2a7e8dc 622 unsigned long mflags;
b06b8511
CS		 623
624 if (default_mounts[i].source) {
625 /* will act like strdup if %r is not present */
8ede5f4c 626 source = lxc_string_replace("%r", conf->rootfs.path ? conf->rootfs.mount : "", default_mounts[i].source);
b06b8511
CS		 627 if (!source) {
628 SYSERROR("memory allocation error");
629 return -1;
630 }
631 }
cc4fd506
SH		 632 if (!default_mounts[i].destination) {
633 ERROR("BUG: auto mounts destination %d was NULL", i);
b2f44b4d 634 free(source);
cc4fd506
SH		 635 return -1;
636 }
637 /* will act like strdup if %r is not present */
638 destination = lxc_string_replace("%r", conf->rootfs.path ? conf->rootfs.mount : "", default_mounts[i].destination);
639 if (!destination) {
640 saved_errno = errno;
641 SYSERROR("memory allocation error");
642 free(source);
643 errno = saved_errno;
644 return -1;
b06b8511 645 }
e2a7e8dc
SH		 646 mflags = add_required_remount_flags(source, destination,
647 default_mounts[i].flags);
592fd47a 648 r = safe_mount(source, destination, default_mounts[i].fstype, mflags, default_mounts[i].options, conf->rootfs.path ? conf->rootfs.mount : NULL);
b06b8511 649 saved_errno = errno;
b88ff9a0
SG		 650 if (r < 0 && errno == ENOENT) {
651 INFO("Mount source or target for %s on %s doesn't exist. Skipping.", source, destination);
652 r = 0;
653 }
654 else if (r < 0)
e2a7e8dc 655 SYSERROR("error mounting %s on %s flags %lu", source, destination, mflags);
f24a52d5 656
b06b8511
CS		 657 free(source);
658 free(destination);
659 if (r < 0) {
b06b8511
CS		 660 errno = saved_errno;
661 return -1;
662 }
368bbc02 663 }
368bbc02
CS		 664 }
665
b06b8511 666 if (flags & LXC_AUTO_CGROUP_MASK) {
0769b82a
CS		 667 int cg_flags;
668
669 cg_flags = flags & LXC_AUTO_CGROUP_MASK;
670 /* If the type of cgroup mount was not specified, it depends on the
671 * container's capabilities as to what makes sense: if we have
672 * CAP_SYS_ADMIN, the read-only part can be remounted read-write
673 * anyway, so we may as well default to read-write; then the admin
674 * will not be given a false sense of security. (And if they really
675 * want mixed r/o r/w, then they can explicitly specify :mixed.)
676 * OTOH, if the container lacks CAP_SYS_ADMIN, do only default to
677 * :mixed, because then the container can't remount it read-write. */
678 if (cg_flags == LXC_AUTO_CGROUP_NOSPEC || cg_flags == LXC_AUTO_CGROUP_FULL_NOSPEC) {
679 int has_sys_admin = 0;
b0ee5983
CB		 680
681 if (!lxc_list_empty(&conf->keepcaps))
0769b82a 682 has_sys_admin = in_caplist(CAP_SYS_ADMIN, &conf->keepcaps);
b0ee5983 683 else
0769b82a 684 has_sys_admin = !in_caplist(CAP_SYS_ADMIN, &conf->caps);
b0ee5983
CB		 685
686 if (cg_flags == LXC_AUTO_CGROUP_NOSPEC)
0769b82a 687 cg_flags = has_sys_admin ? LXC_AUTO_CGROUP_RW : LXC_AUTO_CGROUP_MIXED;
b0ee5983 688 else
0769b82a 689 cg_flags = has_sys_admin ? LXC_AUTO_CGROUP_FULL_RW : LXC_AUTO_CGROUP_FULL_MIXED;
0769b82a
CS		 690 }
691
8ede5f4c 692 if (!cgroup_mount(conf->rootfs.path ? conf->rootfs.mount : "", handler, cg_flags)) {
368bbc02 693 SYSERROR("error mounting /sys/fs/cgroup");
b06b8511 694 return -1;
368bbc02
CS		 695 }
696 }
697
368bbc02 698 return 0;
368bbc02
CS		 699}
700
4e5440c6 701static int setup_utsname(struct utsname *utsname)
0ad19a3f 702{
4e5440c6
DL		 703 if (!utsname)
704 return 0;
0ad19a3f 705
4e5440c6
DL		 706 if (sethostname(utsname->nodename, strlen(utsname->nodename))) {
707 SYSERROR("failed to set the hostname to '%s'", utsname->nodename);
0ad19a3f 708 return -1;
709 }
710
4e5440c6 711 INFO("'%s' hostname has been setup", utsname->nodename);
cd54d859 712
0ad19a3f 713 return 0;
714}
715
69aa6655
DE		 716struct dev_symlinks {
717 const char *oldpath;
718 const char *name;
719};
720
721static const struct dev_symlinks dev_symlinks[] = {
722 {"/proc/self/fd", "fd"},
723 {"/proc/self/fd/0", "stdin"},
724 {"/proc/self/fd/1", "stdout"},
725 {"/proc/self/fd/2", "stderr"},
726};
727
ed8704d0 728static int lxc_setup_dev_symlinks(const struct lxc_rootfs *rootfs)
69aa6655
DE		 729{
730 char path[MAXPATHLEN];
731 int ret,i;
09227be2 732 struct stat s;
69aa6655
DE		 733
734
735 for (i = 0; i < sizeof(dev_symlinks) / sizeof(dev_symlinks[0]); i++) {
736 const struct dev_symlinks *d = &dev_symlinks[i];
ec50007f 737 ret = snprintf(path, sizeof(path), "%s/dev/%s", rootfs->path ? rootfs->mount : "", d->name);
69aa6655
DE		 738 if (ret < 0 || ret >= MAXPATHLEN)
739 return -1;
09227be2
MW		 740
741 /*
742 * Stat the path first. If we don't get an error
743 * accept it as is and don't try to create it
744 */
745 if (!stat(path, &s)) {
746 continue;
747 }
748
69aa6655 749 ret = symlink(d->oldpath, path);
09227be2 750
69aa6655 751 if (ret && errno != EEXIST) {
09227be2
MW		 752 if ( errno == EROFS ) {
753 WARN("Warning: Read Only file system while creating %s", path);
754 } else {
755 SYSERROR("Error creating %s", path);
756 return -1;
757 }
69aa6655
DE		 758 }
759 }
760 return 0;
761}
762
2187efd3 763/* Build a space-separate list of ptys to pass to systemd. */
393903d1 764static bool append_ptyname(char **pp, char *name)
b0a33c1e 765{
393903d1
SH		 766 char *p;
767
768 if (!*pp) {
769 *pp = malloc(strlen(name) + strlen("container_ttys=") + 1);
770 if (!*pp)
771 return false;
772 sprintf(*pp, "container_ttys=%s", name);
773 return true;
774 }
775 p = realloc(*pp, strlen(*pp) + strlen(name) + 2);
776 if (!p)
777 return false;
778 *pp = p;
779 strcat(p, " ");
780 strcat(p, name);
781 return true;
782}
783
2187efd3 784static int lxc_setup_ttys(struct lxc_conf *conf)
393903d1 785{
9e1045e3 786 int i, ret;
393903d1
SH		 787 const struct lxc_tty_info *tty_info = &conf->tty_info;
788 char *ttydir = conf->ttydir;
7c6ef2a2 789 char path[MAXPATHLEN], lxcpath[MAXPATHLEN];
b0a33c1e 790
e8bd4e43 791 if (!conf->rootfs.path)
bc9bd0e3
DL		 792 return 0;
793
b0a33c1e 794 for (i = 0; i < tty_info->nbtty; i++) {
b0a33c1e 795 struct lxc_pty_info *pty_info = &tty_info->pty_info[i];
796
e8bd4e43 797 ret = snprintf(path, sizeof(path), "/dev/tty%d", i + 1);
73363c61 798 if (ret < 0 || (size_t)ret >= sizeof(path))
7c6ef2a2 799 return -1;
9e1045e3 800
7c6ef2a2
SH		 801 if (ttydir) {
802 /* create dev/lxc/tty%d" */
9e1045e3
CB		 803 ret = snprintf(lxcpath, sizeof(lxcpath),
804 "/dev/%s/tty%d", ttydir, i + 1);
73363c61 805 if (ret < 0 || (size_t)ret >= sizeof(lxcpath))
7c6ef2a2 806 return -1;
9e1045e3 807
7c6ef2a2 808 ret = creat(lxcpath, 0660);
9e1045e3 809 if (ret < 0 && errno != EEXIST) {
73363c61 810 SYSERROR("Failed to create \"%s\"", lxcpath);
7c6ef2a2
SH		 811 return -1;
812 }
4d44e274
SH		 813 if (ret >= 0)
814 close(ret);
9e1045e3 815
7c6ef2a2 816 ret = unlink(path);
9e1045e3 817 if (ret < 0 && errno != ENOENT) {
73363c61 818 SYSERROR("Failed to unlink \"%s\"", path);
7c6ef2a2
SH		 819 return -1;
820 }
b0a33c1e 821
9e1045e3
CB		 822 ret = mount(pty_info->name, lxcpath, "none", MS_BIND, 0);
823 if (ret < 0) {
73363c61 824 WARN("Failed to bind mount \"%s\" onto \"%s\"",
7c6ef2a2
SH		 825 pty_info->name, path);
826 continue;
827 }
9e1045e3
CB		 828 DEBUG("bind mounted \"%s\" onto \"%s\"", pty_info->name,
829 path);
13954cce 830
9e1045e3
CB		 831 ret = snprintf(lxcpath, sizeof(lxcpath), "%s/tty%d",
832 ttydir, i + 1);
73363c61 833 if (ret < 0 || (size_t)ret >= sizeof(lxcpath))
9ba8130c 834 return -1;
9e1045e3 835
7c6ef2a2 836 ret = symlink(lxcpath, path);
9e1045e3 837 if (ret < 0) {
73363c61 838 SYSERROR("Failed to create symlink \"%s\" -> \"%s\"",
9e1045e3 839 path, lxcpath);
7c6ef2a2
SH		 840 return -1;
841 }
842 } else {
9e1045e3
CB		 843 /* If we populated /dev, then we need to create
844 * /dev/ttyN
845 */
846 ret = access(path, F_OK);
847 if (ret < 0) {
c6883f38 848 ret = creat(path, 0660);
9e1045e3 849 if (ret < 0) {
73363c61 850 SYSERROR("Failed to create \"%s\"", path);
c6883f38 851 /* this isn't fatal, continue */
025ed0f3 852 } else {
c6883f38 853 close(ret);
025ed0f3 854 }
c6883f38 855 }
9e1045e3
CB		 856
857 ret = mount(pty_info->name, path, "none", MS_BIND, 0);
858 if (ret < 0) {
73363c61 859 SYSERROR("Failed to mount '%s'->'%s'", pty_info->name, path);
7c6ef2a2
SH		 860 continue;
861 }
9e1045e3 862
73363c61 863 DEBUG("Bind mounted \"%s\" onto \"%s\"", pty_info->name,
9e1045e3 864 path);
393903d1 865 }
9e1045e3 866
e8bd4e43 867 if (!append_ptyname(&conf->pty_names, pty_info->name)) {
393903d1
SH		 868 ERROR("Error setting up container_ttys string");
869 return -1;
b0a33c1e 870 }
871 }
872
73363c61 873 INFO("Finished setting up %d /dev/tty<N> device(s)", tty_info->nbtty);
b0a33c1e 874 return 0;
875}
876
2187efd3
CB		 877int lxc_allocate_ttys(const char *name, struct lxc_conf *conf)
878{
879 struct lxc_tty_info *tty_info = &conf->tty_info;
880 int i, ret;
881
882 /* no tty in the configuration */
883 if (!conf->tty)
884 return 0;
885
886 tty_info->pty_info = malloc(sizeof(*tty_info->pty_info) * conf->tty);
887 if (!tty_info->pty_info) {
888 SYSERROR("failed to allocate struct *pty_info");
889 return -ENOMEM;
890 }
891
892 for (i = 0; i < conf->tty; i++) {
893 struct lxc_pty_info *pty_info = &tty_info->pty_info[i];
894
895 process_lock();
896 ret = openpty(&pty_info->master, &pty_info->slave,
897 pty_info->name, NULL, NULL);
898 process_unlock();
899 if (ret) {
900 SYSERROR("failed to create pty device number %d", i);
901 tty_info->nbtty = i;
902 lxc_delete_tty(tty_info);
903 return -ENOTTY;
904 }
905
906 DEBUG("allocated pty \"%s\" with master fd %d and slave fd %d",
907 pty_info->name, pty_info->master, pty_info->slave);
908
909 /* Prevent leaking the file descriptors to the container */
910 ret = fcntl(pty_info->master, F_SETFD, FD_CLOEXEC);
911 if (ret < 0)
912 WARN("failed to set FD_CLOEXEC flag on master fd %d of "
913 "pty device \"%s\": %s",
914 pty_info->master, pty_info->name, strerror(errno));
915
916 ret = fcntl(pty_info->slave, F_SETFD, FD_CLOEXEC);
917 if (ret < 0)
918 WARN("failed to set FD_CLOEXEC flag on slave fd %d of "
919 "pty device \"%s\": %s",
920 pty_info->slave, pty_info->name, strerror(errno));
921
922 pty_info->busy = 0;
923 }
924
925 tty_info->nbtty = conf->tty;
926
927 INFO("finished allocating %d pts devices", conf->tty);
928 return 0;
929}
930
931void lxc_delete_tty(struct lxc_tty_info *tty_info)
932{
933 int i;
934
935 for (i = 0; i < tty_info->nbtty; i++) {
936 struct lxc_pty_info *pty_info = &tty_info->pty_info[i];
937
938 close(pty_info->master);
939 close(pty_info->slave);
940 }
941
942 free(tty_info->pty_info);
943 tty_info->pty_info = NULL;
944 tty_info->nbtty = 0;
945}
946
947static int lxc_send_ttys_to_parent(struct lxc_handler *handler)
948{
949 int i;
950 struct lxc_conf *conf = handler->conf;
951 struct lxc_tty_info *tty_info = &conf->tty_info;
952 int sock = handler->data_sock[0];
953 int ret = -1;
954
955 if (!conf->tty)
956 return 0;
957
958 for (i = 0; i < conf->tty; i++) {
959 int ttyfds[2];
960 struct lxc_pty_info *pty_info = &tty_info->pty_info[i];
961
962 ttyfds[0] = pty_info->master;
963 ttyfds[1] = pty_info->slave;
964
965 ret = lxc_abstract_unix_send_fds(sock, ttyfds, 2, NULL, 0);
966 if (ret < 0)
967 break;
968
969 TRACE("Send pty \"%s\" with master fd %d and slave fd %d to "
970 "parent", pty_info->name, pty_info->master, pty_info->slave);
971 }
972
973 if (ret < 0)
974 ERROR("Failed to send %d ttys to parent: %s", conf->tty,
975 strerror(errno));
976 else
977 TRACE("Sent %d ttys to parent", conf->tty);
978
979 return ret;
980}
981
982static int lxc_create_ttys(struct lxc_handler *handler)
983{
984 int ret = -1;
985 struct lxc_conf *conf = handler->conf;
986
987 ret = lxc_allocate_ttys(handler->name, conf);
988 if (ret < 0) {
989 ERROR("Failed to allocate ttys");
990 goto on_error;
991 }
992
993 ret = lxc_send_ttys_to_parent(handler);
994 if (ret < 0) {
995 ERROR("Failed to send ttys to parent");
996 goto on_error;
997 }
998
999 if (!conf->is_execute) {
1000 ret = lxc_setup_ttys(conf);
1001 if (ret < 0) {
1002 ERROR("Failed to setup ttys");
1003 goto on_error;
1004 }
1005 }
1006
1007 if (conf->pty_names) {
1008 ret = setenv("container_ttys", conf->pty_names, 1);
1009 if (ret < 0)
1010 SYSERROR("Failed to set \"container_ttys=%s\"", conf->pty_names);
1011 }
1012
1013 ret = 0;
1014
1015on_error:
1016 lxc_delete_tty(&conf->tty_info);
1017
1018 return ret;
1019}
1020
59bb8698 1021static int setup_rootfs_pivot_root(const char *rootfs)
bf601689 1022{
2d489f9e 1023 int oldroot = -1, newroot = -1;
bf601689 1024
2d489f9e
SH		 1025 oldroot = open("/", O_DIRECTORY | O_RDONLY);
1026 if (oldroot < 0) {
1027 SYSERROR("Error opening old-/ for fchdir");
9ba8130c
SH		 1028 return -1;
1029 }
2d489f9e
SH		 1030 newroot = open(rootfs, O_DIRECTORY | O_RDONLY);
1031 if (newroot < 0) {
1032 SYSERROR("Error opening new-/ for fchdir");
1033 goto fail;
c08556c6 1034 }
bf601689 1035
cc6f6dd7 1036 /* change into new root fs */
2d489f9e 1037 if (fchdir(newroot)) {
cc6f6dd7 1038 SYSERROR("can't chdir to new rootfs '%s'", rootfs);
2d489f9e 1039 goto fail;
cc6f6dd7
DL		 1040 }
1041
cc6f6dd7 1042 /* pivot_root into our new root fs */
2d489f9e 1043 if (pivot_root(".", ".")) {
cc6f6dd7 1044 SYSERROR("pivot_root syscall failed");
2d489f9e 1045 goto fail;
bf601689 1046 }
cc6f6dd7 1047
2d489f9e
SH		 1048 /*
1049 * at this point the old-root is mounted on top of our new-root
1050 * To unmounted it we must not be chdir'd into it, so escape back
1051 * to old-root
1052 */
1053 if (fchdir(oldroot) < 0) {
1054 SYSERROR("Error entering oldroot");
1055 goto fail;
1056 }
7981ea46 1057 if (umount2(".", MNT_DETACH) < 0) {
2d489f9e
SH		 1058 SYSERROR("Error detaching old root");
1059 goto fail;
cc6f6dd7
DL		 1060 }
1061
2d489f9e
SH		 1062 if (fchdir(newroot) < 0) {
1063 SYSERROR("Error re-entering newroot");
1064 goto fail;
1065 }
cc6f6dd7 1066
2d489f9e
SH		 1067 close(oldroot);
1068 close(newroot);
bf601689 1069
2d489f9e 1070 DEBUG("pivot_root syscall to '%s' successful", rootfs);
bf601689 1071
bf601689 1072 return 0;
2d489f9e
SH		 1073
1074fail:
1075 if (oldroot != -1)
1076 close(oldroot);
1077 if (newroot != -1)
1078 close(newroot);
1079 return -1;
bf601689
MH		 1080}
1081
7133b912
CB		 1082/* Just create a path for /dev under $lxcpath/$name and in rootfs If we hit an
1083 * error, log it but don't fail yet.
91c3830e 1084 */
7133b912
CB		 1085static int mount_autodev(const char *name, const struct lxc_rootfs *rootfs,
1086 const char *lxcpath)
91c3830e
SH		 1087{
1088 int ret;
87da4ec3
SH		 1089 size_t clen;
1090 char *path;
91c3830e 1091
7133b912 1092 INFO("Preparing \"/dev\"");
bc6928ff 1093
14221cbb 1094 /* $(rootfs->mount) + "/dev/pts" + '\0' */
ec50007f 1095 clen = (rootfs->path ? strlen(rootfs->mount) : 0) + 9;
87da4ec3 1096 path = alloca(clen);
bc6928ff 1097
ec50007f 1098 ret = snprintf(path, clen, "%s/dev", rootfs->path ? rootfs->mount : "");
7133b912 1099 if (ret < 0 || (size_t)ret >= clen)
91c3830e 1100 return -1;
bc6928ff 1101
87da4ec3 1102 if (!dir_exists(path)) {
7133b912
CB		 1103 WARN("\"/dev\" directory does not exist. Proceeding without "
1104 "autodev being set up");
87da4ec3 1105 return 0;
bc6928ff 1106 }
87da4ec3 1107
1ec0e8e3 1108 ret = safe_mount("none", path, "tmpfs", 0, "size=500000,mode=755",
7133b912
CB		 1109 rootfs->path ? rootfs->mount : NULL);
1110 if (ret < 0) {
1111 SYSERROR("Failed to mount tmpfs on \"%s\"", path);
1ec0e8e3 1112 return -1;
91c3830e 1113 }
7133b912 1114 INFO("Mounted tmpfs on \"%s\"", path);
87da4ec3 1115
ec50007f 1116 ret = snprintf(path, clen, "%s/dev/pts", rootfs->path ? rootfs->mount : "");
7133b912 1117 if (ret < 0 || (size_t)ret >= clen)
91c3830e 1118 return -1;
87da4ec3 1119
7133b912 1120 /* If we are running on a devtmpfs mapping, dev/pts may already exist.
bc6928ff
MW		 1121 * If not, then create it and exit if that fails...
1122 */
87da4ec3 1123 if (!dir_exists(path)) {
bc6928ff 1124 ret = mkdir(path, S_IRWXU | S_IRGRP | S_IXGRP | S_IROTH | S_IXOTH);
7133b912
CB		 1125 if (ret < 0) {
1126 SYSERROR("Failed to create directory \"%s\"", path);
bc6928ff
MW		 1127 return -1;
1128 }
91c3830e
SH		 1129 }
1130
7133b912 1131 INFO("Prepared \"/dev\"");
91c3830e
SH		 1132 return 0;
1133}
1134
c6883f38 1135struct lxc_devs {
74a3920a 1136 const char *name;
c6883f38
SH		 1137 mode_t mode;
1138 int maj;
1139 int min;
1140};
1141
74a3920a 1142static const struct lxc_devs lxc_devs[] = {
06749971
CB		 1143 { "null", S_IFCHR | S_IRWXU | S_IRWXG | S_IRWXO, 1, 3 },
1144 { "zero", S_IFCHR | S_IRWXU | S_IRWXG | S_IRWXO, 1, 5 },
1145 { "full", S_IFCHR | S_IRWXU | S_IRWXG | S_IRWXO, 1, 7 },
1146 { "urandom", S_IFCHR | S_IRWXU | S_IRWXG | S_IRWXO, 1, 9 },
1147 { "random", S_IFCHR | S_IRWXU | S_IRWXG | S_IRWXO, 1, 8 },
1148 { "tty", S_IFCHR | S_IRWXU | S_IRWXG | S_IRWXO, 5, 0 },
c6883f38
SH		 1149};
1150
27245ff7 1151static int lxc_fill_autodev(const struct lxc_rootfs *rootfs)
c6883f38
SH		 1152{
1153 int ret;
c6883f38
SH		 1154 char path[MAXPATHLEN];
1155 int i;
3a32201c 1156 mode_t cmask;
c6883f38 1157
3999be0a
CB		 1158 ret = snprintf(path, MAXPATHLEN, "%s/dev",
1159 rootfs->path ? rootfs->mount : "");
1160 if (ret < 0 || ret >= MAXPATHLEN)
c6883f38 1161 return -1;
91c3830e 1162
0bbf8572
CB		 1163 /* ignore, just don't try to fill in */
1164 if (!dir_exists(path))
9cb4d183
SH		 1165 return 0;
1166
3999be0a
CB		 1167 INFO("Populating \"/dev\"");
1168
3a32201c 1169 cmask = umask(S_IXUSR | S_IXGRP | S_IXOTH);
c6883f38 1170 for (i = 0; i < sizeof(lxc_devs) / sizeof(lxc_devs[0]); i++) {
74a3920a 1171 const struct lxc_devs *d = &lxc_devs[i];
0728ebf4 1172
3999be0a
CB		 1173 ret = snprintf(path, MAXPATHLEN, "%s/dev/%s",
1174 rootfs->path ? rootfs->mount : "", d->name);
c6883f38
SH		 1175 if (ret < 0 || ret >= MAXPATHLEN)
1176 return -1;
0bbf8572 1177
c6883f38 1178 ret = mknod(path, d->mode, makedev(d->maj, d->min));
0bbf8572 1179 if (ret < 0) {
9cb4d183 1180 FILE *pathfile;
3999be0a 1181 char hostpath[MAXPATHLEN];
9cb4d183 1182
0bbf8572
CB		 1183 if (errno == EEXIST) {
1184 DEBUG("\"%s\" device already existed", path);
1185 continue;
1186 }
1187
1188 /* Unprivileged containers cannot create devices, so
1189 * bind mount the device from the host.
1190 */
9cb4d183
SH		 1191 ret = snprintf(hostpath, MAXPATHLEN, "/dev/%s", d->name);
1192 if (ret < 0 || ret >= MAXPATHLEN)
1193 return -1;
3999be0a 1194
9cb4d183
SH		 1195 pathfile = fopen(path, "wb");
1196 if (!pathfile) {
3999be0a 1197 SYSERROR("Failed to create file \"%s\"", path);
9cb4d183
SH		 1198 return -1;
1199 }
1200 fclose(pathfile);
3999be0a
CB		 1201
1202 ret = safe_mount(hostpath, path, 0, MS_BIND, NULL,
1203 rootfs->path ? rootfs->mount : NULL);
1204 if (ret < 0) {
1205 SYSERROR("Failed to bind mount \"%s\" from "
1206 "host into container",
1207 d->name);
9cb4d183
SH		 1208 return -1;
1209 }
3999be0a
CB		 1210 DEBUG("Bind mounted \"%s\" onto \"%s\"", hostpath,
1211 path);
0bbf8572 1212 } else {
3999be0a 1213 DEBUG("Created device node \"%s\"", path);
c6883f38
SH		 1214 }
1215 }
3a32201c 1216 umask(cmask);
c6883f38 1217
3999be0a 1218 INFO("Populated \"/dev\"");
c6883f38
SH		 1219 return 0;
1220}
1221
9aa76a17 1222static int lxc_setup_rootfs(struct lxc_conf *conf)
0ad19a3f 1223{
9aa76a17 1224 int ret;
10bc1861 1225 struct lxc_storage *bdev;
91c3e281 1226 const struct lxc_rootfs *rootfs;
cc28d0b0 1227
91c3e281 1228 rootfs = &conf->rootfs;
a0f379bf 1229 if (!rootfs->path) {
91c3e281
CB		 1230 if (mount("", "/", NULL, MS_SLAVE | MS_REC, 0)) {
1231 SYSERROR("Failed to make / rslave.");
a0f379bf
DW		 1232 return -1;
1233 }
c69bd12f 1234 return 0;
a0f379bf 1235 }
0ad19a3f 1236
12297168 1237 if (access(rootfs->mount, F_OK)) {
91c3e281 1238 SYSERROR("Failed to access to \"%s\". Check it is present.",
12297168 1239 rootfs->mount);
b1789442
DL		 1240 return -1;
1241 }
1242
10bc1861 1243 bdev = storage_init(conf, rootfs->path, rootfs->mount, rootfs->options);
9aa76a17
CB		 1244 if (!bdev) {
1245 ERROR("Failed to mount rootfs \"%s\" onto \"%s\" with options \"%s\".",
91c3e281
CB		 1246 rootfs->path, rootfs->mount,
1247 rootfs->options ? rootfs->options : "(null)");
9aa76a17 1248 return -1;
9be53773 1249 }
9aa76a17
CB		 1250
1251 ret = bdev->ops->mount(bdev);
10bc1861 1252 storage_put(bdev);
9aa76a17 1253 if (ret < 0) {
91c3e281
CB		 1254 ERROR("Failed to mount rootfs \"%s\" onto \"%s\" with options \"%s\".",
1255 rootfs->path, rootfs->mount,
1256 rootfs->options ? rootfs->options : "(null)");
c3f0a28c 1257 return -1;
1258 }
0ad19a3f 1259
91c3e281
CB		 1260 DEBUG("Mounted rootfs \"%s\" onto \"%s\" with options \"%s\".",
1261 rootfs->path, rootfs->mount,
1262 rootfs->options ? rootfs->options : "(null)");
9aa76a17 1263
ac778708
DL		 1264 return 0;
1265}
1266
91e93c71
AV		 1267int prepare_ramfs_root(char *root)
1268{
eab15c1e 1269 char buf[LXC_LINELEN], *p;
91e93c71
AV		 1270 char nroot[PATH_MAX];
1271 FILE *f;
1272 int i;
1273 char *p2;
1274
1275 if (realpath(root, nroot) == NULL)
39c7b795 1276 return -errno;
91e93c71
AV		 1277
1278 if (chdir("/") == -1)
39c7b795 1279 return -errno;
91e93c71
AV		 1280
1281 /*
1282 * We could use here MS_MOVE, but in userns this mount is
1283 * locked and can't be moved.
1284 */
39c7b795 1285 if (mount(root, "/", NULL, MS_REC | MS_BIND, NULL) < 0) {
91e93c71 1286 SYSERROR("Failed to move %s into /", root);
39c7b795 1287 return -errno;
91e93c71
AV		 1288 }
1289
39c7b795 1290 if (mount(NULL, "/", NULL, MS_REC | MS_PRIVATE, NULL) < 0) {
91e93c71 1291 SYSERROR("Failed to make . rprivate");
39c7b795 1292 return -errno;
91e93c71
AV		 1293 }
1294
1295 /*
1296 * The following code cleans up inhereted mounts which are not
1297 * required for CT.
1298 *
1299 * The mountinfo file shows not all mounts, if a few points have been
1300 * unmounted between read operations from the mountinfo. So we need to
1301 * read mountinfo a few times.
1302 *
1303 * This loop can be skipped if a container uses unserns, because all
1304 * inherited mounts are locked and we should live with all this trash.
1305 */
1306 while (1) {
1307 int progress = 0;
1308
1309 f = fopen("./proc/self/mountinfo", "r");
1310 if (!f) {
1311 SYSERROR("Unable to open /proc/self/mountinfo");
1312 return -1;
1313 }
eab15c1e 1314 while (fgets(buf, LXC_LINELEN, f)) {
91e93c71
AV		 1315 for (p = buf, i=0; p && i < 4; i++)
1316 p = strchr(p+1, ' ');
1317 if (!p)
1318 continue;
1319 p2 = strchr(p+1, ' ');
1320 if (!p2)
1321 continue;
1322
1323 *p2 = '\0';
1324 *p = '.';
1325
1326 if (strcmp(p + 1, "/") == 0)
1327 continue;
1328 if (strcmp(p + 1, "/proc") == 0)
1329 continue;
1330
1331 if (umount2(p, MNT_DETACH) == 0)
1332 progress++;
1333 }
1334 fclose(f);
1335 if (!progress)
1336 break;
1337 }
1338
8bea9fae
PR		 1339 /* This also can be skipped if a container uses unserns */
1340 umount2("./proc", MNT_DETACH);
91e93c71
AV		 1341
1342 /* It is weird, but chdir("..") moves us in a new root */
1343 if (chdir("..") == -1) {
1344 SYSERROR("Unable to change working directory");
1345 return -1;
1346 }
1347
1348 if (chroot(".") == -1) {
1349 SYSERROR("Unable to chroot");
1350 return -1;
1351 }
1352
1353 return 0;
1354}
1355
74a3920a 1356static int setup_pivot_root(const struct lxc_rootfs *rootfs)
ac778708 1357{
39c7b795
CB		 1358 if (!rootfs->path) {
1359 DEBUG("container does not have a rootfs, so not doing pivot root");
ac778708 1360 return 0;
39c7b795 1361 }
ac778708 1362
91e93c71 1363 if (detect_ramfs_rootfs()) {
39c7b795
CB		 1364 DEBUG("detected that container is on ramfs");
1365 if (prepare_ramfs_root(rootfs->mount)) {
1366 ERROR("failed to prepare minimal ramfs root");
91e93c71 1367 return -1;
39c7b795
CB		 1368 }
1369
1370 DEBUG("prepared ramfs root for container");
1371 return 0;
1372 }
1373
1374 if (setup_rootfs_pivot_root(rootfs->mount) < 0) {
1375 ERROR("failed to pivot root");
25368b52 1376 return -1;
c69bd12f
DL		 1377 }
1378
39c7b795 1379 DEBUG("finished pivot root");
25368b52 1380 return 0;
0ad19a3f 1381}
1382
70761e5e 1383static int lxc_setup_devpts(int num_pts)
3c26f34e 1384{
70761e5e 1385 int ret;
9d28c4f9
CB		 1386 const char *default_devpts_mntopts = "newinstance,ptmxmode=0666,mode=0620,gid=5";
1387 char devpts_mntopts[256];
77890c6d 1388
70761e5e
CB		 1389 if (!num_pts) {
1390 DEBUG("no new devpts instance will be mounted since no pts "
1391 "devices are requested");
d852c78c 1392 return 0;
3c26f34e 1393 }
1394
9d28c4f9
CB		 1395 ret = snprintf(devpts_mntopts, sizeof(devpts_mntopts), "%s,max=%d",
1396 default_devpts_mntopts, num_pts);
1397 if (ret < 0 || (size_t)ret >= sizeof(devpts_mntopts))
1398 return -1;
1399
d5cb35d6 1400 /* Unmount old devpts instance. */
70761e5e
CB		 1401 ret = access("/dev/pts/ptmx", F_OK);
1402 if (!ret) {
70761e5e
CB		 1403 ret = umount("/dev/pts");
1404 if (ret < 0) {
1405 SYSERROR("failed to unmount old devpts instance");
1406 return -1;
7e40254a 1407 }
70761e5e 1408 DEBUG("unmounted old /dev/pts instance");
7e40254a
JTLB		 1409 }
1410
70761e5e
CB		 1411 /* Create mountpoint for devpts instance. */
1412 ret = mkdir("/dev/pts", 0755);
1413 if (ret < 0 && errno != EEXIST) {
1414 SYSERROR("failed to create the \"/dev/pts\" directory");
3c26f34e 1415 return -1;
1416 }
1417
70761e5e
CB		 1418 /* Mount new devpts instance. */
1419 ret = mount("devpts", "/dev/pts", "devpts", MS_MGC_VAL, devpts_mntopts);
1420 if (ret < 0) {
1421 SYSERROR("failed to mount new devpts instance");
1422 return -1;
1423 }
f4f52cb5 1424 DEBUG("mount new devpts instance with options \"%s\"", devpts_mntopts);
70761e5e 1425
d5cb35d6 1426 /* Remove any pre-existing /dev/ptmx file. */
70761e5e 1427 ret = access("/dev/ptmx", F_OK);
d5cb35d6
CB		 1428 if (!ret) {
1429 ret = remove("/dev/ptmx");
1430 if (ret < 0) {
1431 SYSERROR("failed to remove existing \"/dev/ptmx\"");
1432 return -1;
70761e5e 1433 }
d5cb35d6 1434 DEBUG("removed existing \"/dev/ptmx\"");
3c26f34e 1435 }
1436
d5cb35d6
CB		 1437 /* Create dummy /dev/ptmx file as bind mountpoint for /dev/pts/ptmx. */
1438 ret = open("/dev/ptmx", O_CREAT, 0666);
1439 if (ret < 0) {
1440 SYSERROR("failed to create dummy \"/dev/ptmx\" file as bind mount target");
1441 return -1;
1442 }
e87bd19c 1443 close(ret);
d5cb35d6 1444 DEBUG("created dummy \"/dev/ptmx\" file as bind mount target");
77890c6d 1445
d5cb35d6 1446 /* Fallback option: create symlink /dev/ptmx -> /dev/pts/ptmx */
e87bd19c 1447 ret = mount("/dev/pts/ptmx", "/dev/ptmx", NULL, MS_BIND, NULL);
d5cb35d6
CB		 1448 if (!ret) {
1449 DEBUG("bind mounted \"/dev/pts/ptmx\" to \"/dev/ptmx\"");
1450 return 0;
1451 } else {
1452 /* Fallthrough and try to create a symlink. */
1453 ERROR("failed to bind mount \"/dev/pts/ptmx\" to \"/dev/ptmx\"");
1454 }
1455
1456 /* Remove the dummy /dev/ptmx file we created above. */
1457 ret = remove("/dev/ptmx");
70761e5e 1458 if (ret < 0) {
d5cb35d6
CB		 1459 SYSERROR("failed to remove existing \"/dev/ptmx\"");
1460 return -1;
1461 }
1462
1463 /* Fallback option: Create symlink /dev/ptmx -> /dev/pts/ptmx. */
1464 ret = symlink("/dev/pts/ptmx", "/dev/ptmx");
1465 if (ret < 0) {
1466 SYSERROR("failed to create symlink \"/dev/ptmx\" -> \"/dev/pts/ptmx\"");
3c26f34e 1467 return -1;
1468 }
d5cb35d6 1469 DEBUG("created symlink \"/dev/ptmx\" -> \"/dev/pts/ptmx\"");
cd54d859 1470
3c26f34e 1471 return 0;
1472}
1473
cccc74b5
DL		 1474static int setup_personality(int persona)
1475{
6ff05e18 1476 #if HAVE_SYS_PERSONALITY_H
cccc74b5
DL		 1477 if (persona == -1)
1478 return 0;
1479
1480 if (personality(persona) < 0) {
1481 SYSERROR("failed to set personality to '0x%x'", persona);
1482 return -1;
1483 }
1484
1485 INFO("set personality to '0x%x'", persona);
6ff05e18 1486 #endif
cccc74b5
DL		 1487
1488 return 0;
1489}
1490
3d7d929a
CB		 1491static int lxc_setup_dev_console(const struct lxc_rootfs *rootfs,
1492 const struct lxc_console *console)
6e590161 1493{
63376d7d 1494 char path[MAXPATHLEN];
0728ebf4 1495 int ret, fd;
52e35957 1496
8b1b1210
CB		 1497 if (console->path && !strcmp(console->path, "none"))
1498 return 0;
1499
7c6ef2a2 1500 ret = snprintf(path, sizeof(path), "%s/dev/console", rootfs->mount);
3d7d929a 1501 if (ret < 0 || (size_t)ret >= sizeof(path))
7c6ef2a2 1502 return -1;
52e35957 1503
8b1b1210
CB		 1504 /* When we are asked to setup a console we remove any previous
1505 * /dev/console bind-mounts.
1506 */
a7ba3c7f
CB		 1507 if (file_exists(path)) {
1508 ret = lxc_unstack_mountpoint(path, false);
1509 if (ret < 0) {
8b1b1210 1510 ERROR("failed to unmount \"%s\": %s", path, strerror(errno));
a7ba3c7f
CB		 1511 return -ret;
1512 } else {
1513 DEBUG("cleared all (%d) mounts from \"%s\"", ret, path);
1514 }
953fe44f 1515
a7ba3c7f
CB		 1516 ret = unlink(path);
1517 if (ret < 0) {
1518 SYSERROR("error unlinking %s", path);
8b1b1210
CB		 1519 return -errno;
1520 }
8b1b1210
CB		 1521 }
1522
1523 /* For unprivileged containers autodev or automounts will already have
1524 * taken care of creating /dev/console.
1525 */
0728ebf4
TA		 1526 fd = open(path, O_CREAT | O_EXCL, S_IXUSR | S_IXGRP | S_IXOTH);
1527 if (fd < 0) {
1528 if (errno != EEXIST) {
1529 SYSERROR("failed to create console");
3d7d929a 1530 return -errno;
0728ebf4
TA		 1531 }
1532 } else {
1533 close(fd);
52e35957
DL		 1534 }
1535
0728ebf4 1536 if (chmod(console->name, S_IXUSR | S_IXGRP | S_IXOTH)) {
3d7d929a
CB		 1537 SYSERROR("failed to set mode '0%o' to '%s'", S_IXUSR | S_IXGRP | S_IXOTH, console->name);
1538 return -errno;
63376d7d 1539 }
13954cce 1540
3d7d929a 1541 if (safe_mount(console->name, path, "none", MS_BIND, 0, rootfs->mount) < 0) {
63376d7d 1542 ERROR("failed to mount '%s' on '%s'", console->name, path);
6e590161 1543 return -1;
1544 }
1545
3d7d929a 1546 DEBUG("mounted pts device \"%s\" onto \"%s\"", console->name, path);
7c6ef2a2
SH		 1547 return 0;
1548}
1549
3d7d929a
CB		 1550static int lxc_setup_ttydir_console(const struct lxc_rootfs *rootfs,
1551 const struct lxc_console *console,
1552 char *ttydir)
7c6ef2a2 1553{
7c6ef2a2 1554 int ret;
3d7d929a 1555 char path[MAXPATHLEN], lxcpath[MAXPATHLEN];
7c6ef2a2
SH		 1556
1557 /* create rootfs/dev/<ttydir> directory */
3d7d929a
CB		 1558 ret = snprintf(path, sizeof(path), "%s/dev/%s", rootfs->mount, ttydir);
1559 if (ret < 0 || (size_t)ret >= sizeof(path))
7c6ef2a2 1560 return -1;
3d7d929a 1561
7c6ef2a2
SH		 1562 ret = mkdir(path, 0755);
1563 if (ret && errno != EEXIST) {
959aee9c 1564 SYSERROR("failed with errno %d to create %s", errno, path);
3d7d929a 1565 return -errno;
7c6ef2a2 1566 }
4742cd9a 1567 DEBUG("Created directory for console and tty devices at \"%s\"", path);
7c6ef2a2 1568
3d7d929a
CB		 1569 ret = snprintf(lxcpath, sizeof(lxcpath), "%s/dev/%s/console", rootfs->mount, ttydir);
1570 if (ret < 0 || (size_t)ret >= sizeof(lxcpath))
1571 return -1;
1572
7c6ef2a2 1573 ret = creat(lxcpath, 0660);
3d7d929a 1574 if (ret == -1 && errno != EEXIST) {
959aee9c 1575 SYSERROR("error %d creating %s", errno, lxcpath);
3d7d929a 1576 return -errno;
7c6ef2a2 1577 }
4d44e274
SH		 1578 if (ret >= 0)
1579 close(ret);
7c6ef2a2 1580
2a12fefd
CB		 1581 ret = snprintf(path, sizeof(path), "%s/dev/console", rootfs->mount);
1582 if (ret < 0 || (size_t)ret >= sizeof(lxcpath))
7c6ef2a2 1583 return -1;
2a12fefd
CB		 1584
1585 /* When we are asked to setup a console we remove any previous
1586 * /dev/console bind-mounts.
1587 */
1588 if (console->path && !strcmp(console->path, "none")) {
1589 struct stat st;
1590 ret = stat(path, &st);
1591 if (ret < 0) {
1592 if (errno == ENOENT)
1593 return 0;
1594 SYSERROR("failed stat() \"%s\"", path);
1595 return -errno;
1596 }
1597
1598 /* /dev/console must be character device with major number 5 and
1599 * minor number 1. If not, give benefit of the doubt and assume
1600 * the user has mounted something else right there on purpose.
1601 */
1602 if (((st.st_mode & S_IFMT) != S_IFCHR) || major(st.st_rdev) != 5 || minor(st.st_rdev) != 1)
1603 return 0;
1604
1605 /* In case the user requested a bind-mount for /dev/console and
1606 * requests a ttydir we move the mount to the
a7ba3c7f
CB		 1607 * /dev/<ttydir/console.
1608 * Note, we only move the uppermost mount and clear all other
1609 * mounts underneath for safety.
1610 * If it is a character device created via mknod() we simply
1611 * rename it.
2a12fefd
CB		 1612 */
1613 ret = safe_mount(path, lxcpath, "none", MS_MOVE, NULL, rootfs->mount);
1614 if (ret < 0) {
1615 if (errno != EINVAL) {
1616 ERROR("failed to MS_MOVE \"%s\" to \"%s\": %s", path, lxcpath, strerror(errno));
1617 return -errno;
1618 }
1619 /* path was not a mountpoint */
1620 ret = rename(path, lxcpath);
1621 if (ret < 0) {
1622 ERROR("failed to rename \"%s\" to \"%s\": %s", path, lxcpath, strerror(errno));
1623 return -errno;
1624 }
1625 DEBUG("renamed \"%s\" to \"%s\"", path, lxcpath);
1626 } else {
1627 DEBUG("moved mount \"%s\" to \"%s\"", path, lxcpath);
1628 }
a7ba3c7f
CB		 1629
1630 /* Clear all remaining bind-mounts. */
1631 ret = lxc_unstack_mountpoint(path, false);
2a12fefd 1632 if (ret < 0) {
a7ba3c7f
CB		 1633 ERROR("failed to unmount \"%s\": %s", path, strerror(errno));
1634 return -ret;
1635 } else {
1636 DEBUG("cleared all (%d) mounts from \"%s\"", ret, path);
1637 }
1638 } else {
1639 if (file_exists(path)) {
1640 ret = lxc_unstack_mountpoint(path, false);
1641 if (ret < 0) {
2a12fefd 1642 ERROR("failed to unmount \"%s\": %s", path, strerror(errno));
a7ba3c7f
CB		 1643 return -ret;
1644 } else {
1645 DEBUG("cleared all (%d) mounts from \"%s\"", ret, path);
2a12fefd 1646 }
2a12fefd
CB		 1647 }
1648
1649 if (safe_mount(console->name, lxcpath, "none", MS_BIND, 0, rootfs->mount) < 0) {
1650 ERROR("failed to mount '%s' on '%s'", console->name, lxcpath);
1651 return -1;
1652 }
1653 DEBUG("mounted \"%s\" onto \"%s\"", console->name, lxcpath);
7c6ef2a2
SH		 1654 }
1655
2a12fefd 1656 /* create symlink from rootfs /dev/console to '<ttydir>/console' */
9ba8130c 1657 ret = snprintf(lxcpath, sizeof(lxcpath), "%s/console", ttydir);
3d7d929a 1658 if (ret < 0 || (size_t)ret >= sizeof(lxcpath))
9ba8130c 1659 return -1;
3d7d929a 1660
2a12fefd
CB		 1661 ret = unlink(path);
1662 if (ret && errno != ENOENT) {
1663 SYSERROR("error unlinking %s", path);
1664 return -errno;
1665 }
1666
7c6ef2a2 1667 ret = symlink(lxcpath, path);
3d7d929a
CB		 1668 if (ret < 0) {
1669 SYSERROR("failed to create symlink for console from \"%s\" to \"%s\"", lxcpath, path);
7c6ef2a2
SH		 1670 return -1;
1671 }
1672
3d7d929a 1673 DEBUG("console has been setup under \"%s\" and symlinked to \"%s\"", lxcpath, path);
6e590161 1674 return 0;
1675}
1676
3d7d929a
CB		 1677static int lxc_setup_console(const struct lxc_rootfs *rootfs,
1678 const struct lxc_console *console, char *ttydir)
7c6ef2a2 1679{
3d7d929a
CB		 1680 /* We don't have a rootfs, /dev/console will be shared. */
1681 if (!rootfs->path) {
1682 DEBUG("/dev/console will be shared with the host");
7c6ef2a2 1683 return 0;
3d7d929a
CB		 1684 }
1685
7c6ef2a2 1686 if (!ttydir)
3d7d929a 1687 return lxc_setup_dev_console(rootfs, console);
7c6ef2a2 1688
3d7d929a 1689 return lxc_setup_ttydir_console(rootfs, console, ttydir);
7c6ef2a2
SH		 1690}
1691
998ac676
RT		 1692static void parse_mntopt(char *opt, unsigned long *flags, char **data)
1693{
1694 struct mount_opt *mo;
1695
1696 /* If opt is found in mount_opt, set or clear flags.
1697 * Otherwise append it to data. */
1698
1699 for (mo = &mount_opt[0]; mo->name != NULL; mo++) {
1700 if (!strncmp(opt, mo->name, strlen(mo->name))) {
1701 if (mo->clear)
1702 *flags &= ~mo->flag;
1703 else
1704 *flags |= mo->flag;
1705 return;
1706 }
1707 }
1708
1709 if (strlen(*data))
1710 strcat(*data, ",");
1711 strcat(*data, opt);
1712}
1713
a17b1e65 1714int parse_mntopts(const char *mntopts, unsigned long *mntflags,
998ac676
RT		 1715 char **mntdata)
1716{
1717 char *s, *data;
1718 char *p, *saveptr = NULL;
1719
911324ef 1720 *mntdata = NULL;
91656ce5 1721 *mntflags = 0L;
911324ef
DL		 1722
1723 if (!mntopts)
998ac676
RT		 1724 return 0;
1725
911324ef 1726 s = strdup(mntopts);
998ac676 1727 if (!s) {
36eb9bde 1728 SYSERROR("failed to allocate memory");
998ac676
RT		 1729 return -1;
1730 }
1731
1732 data = malloc(strlen(s) + 1);
1733 if (!data) {
36eb9bde 1734 SYSERROR("failed to allocate memory");
998ac676
RT		 1735 free(s);
1736 return -1;
1737 }
1738 *data = 0;
1739
1740 for (p = strtok_r(s, ",", &saveptr); p != NULL;
1741 p = strtok_r(NULL, ",", &saveptr))
1742 parse_mntopt(p, mntflags, &data);
1743
1744 if (*data)
1745 *mntdata = data;
1746 else
1747 free(data);
1748 free(s);
1749
1750 return 0;
1751}
1752
6fd5e769
SH		 1753static void null_endofword(char *word)
1754{
1755 while (*word && *word != ' ' && *word != '\t')
1756 word++;
1757 *word = '\0';
1758}
1759
1760/*
1761 * skip @nfields spaces in @src
1762 */
1763static char *get_field(char *src, int nfields)
1764{
1765 char *p = src;
1766 int i;
1767
1768 for (i = 0; i < nfields; i++) {
1769 while (*p && *p != ' ' && *p != '\t')
1770 p++;
1771 if (!*p)
1772 break;
1773 p++;
1774 }
1775 return p;
1776}
1777
911324ef
DL		 1778static int mount_entry(const char *fsname, const char *target,
1779 const char *fstype, unsigned long mountflags,
0ac4b28a
CB		 1780 const char *data, int optional, int dev,
1781 const char *rootfs)
911324ef 1782{
0ac4b28a 1783 int ret;
614305f3 1784#ifdef HAVE_STATVFS
2938f7c8 1785 struct statvfs sb;
614305f3 1786#endif
2938f7c8 1787
0ac4b28a
CB		 1788 ret = safe_mount(fsname, target, fstype, mountflags & ~MS_REMOUNT, data,
1789 rootfs);
1790 if (ret < 0) {
1fc64d22 1791 if (optional) {
0ac4b28a
CB		 1792 INFO("Failed to mount \"%s\" on \"%s\" (optional): %s",
1793 fsname, target, strerror(errno));
1fc64d22
SG		 1794 return 0;
1795 }
0ac4b28a
CB		 1796
1797 SYSERROR("Failed to mount \"%s\" on \"%s\"", fsname, target);
1798 return -1;
911324ef
DL		 1799 }
1800
1801 if ((mountflags & MS_REMOUNT) || (mountflags & MS_BIND)) {
7c5b6e7c 1802 unsigned long rqd_flags = 0;
0ac4b28a
CB		 1803
1804 DEBUG("Remounting \"%s\" on \"%s\" to respect bind or remount "
1805 "options",
1806 fsname ? fsname : "(none)", target ? target : "(none)");
1807
7c5b6e7c
AS		 1808 if (mountflags & MS_RDONLY)
1809 rqd_flags |= MS_RDONLY;
614305f3 1810#ifdef HAVE_STATVFS
2938f7c8 1811 if (statvfs(fsname, &sb) == 0) {
7c5b6e7c 1812 unsigned long required_flags = rqd_flags;
0ac4b28a 1813
2938f7c8
SH		 1814 if (sb.f_flag & MS_NOSUID)
1815 required_flags |= MS_NOSUID;
0ac4b28a 1816
ae7a770e 1817 if (sb.f_flag & MS_NODEV && !dev)
2938f7c8 1818 required_flags |= MS_NODEV;
0ac4b28a 1819
2938f7c8
SH		 1820 if (sb.f_flag & MS_RDONLY)
1821 required_flags |= MS_RDONLY;
0ac4b28a 1822
2938f7c8
SH		 1823 if (sb.f_flag & MS_NOEXEC)
1824 required_flags |= MS_NOEXEC;
0ac4b28a
CB		 1825
1826 DEBUG("Flags for \"%s\" were %lu, required extra flags "
1827 "are %lu", fsname, sb.f_flag, required_flags);
1828
1829 /* If this was a bind mount request, and required_flags
2938f7c8 1830 * does not have any flags which are not already in
0ac4b28a 1831 * mountflags, then skip the remount.
2938f7c8
SH		 1832 */
1833 if (!(mountflags & MS_REMOUNT)) {
0ac4b28a
CB		 1834 if (!(required_flags & ~mountflags) &&
1835 rqd_flags == 0) {
1836 DEBUG("Mountflags already were %lu, "
1837 "skipping remount", mountflags);
2938f7c8
SH		 1838 goto skipremount;
1839 }
1840 }
0ac4b28a 1841
2938f7c8 1842 mountflags |= required_flags;
6fd5e769 1843 }
614305f3 1844#endif
911324ef 1845
0ac4b28a
CB		 1846 ret = mount(fsname, target, fstype, mountflags | MS_REMOUNT, data);
1847 if (ret < 0) {
1fc64d22 1848 if (optional) {
0ac4b28a
CB		 1849 INFO("Failed to mount \"%s\" on \"%s\" "
1850 "(optional): %s", fsname, target,
1851 strerror(errno));
1fc64d22
SG		 1852 return 0;
1853 }
0ac4b28a
CB		 1854
1855 SYSERROR("Failed to mount \"%s\" on \"%s\"", fsname, target);
1856 return -1;
911324ef
DL		 1857 }
1858 }
1859
614305f3 1860#ifdef HAVE_STATVFS
6fd5e769 1861skipremount:
614305f3 1862#endif
0ac4b28a
CB		 1863 DEBUG("Mounted \"%s\" on \"%s\" with filesystem type \"%s\"", fsname,
1864 target, fstype);
911324ef
DL		 1865
1866 return 0;
1867}
1868
c5e30de4 1869/* Remove "optional", "create=dir", and "create=file" from mntopt */
4e4ca161
SH		 1870static void cull_mntent_opt(struct mntent *mntent)
1871{
1872 int i;
c5e30de4
CB		 1873 char *list[] = {"create=dir", "create=file", "optional", NULL};
1874
1875 for (i = 0; list[i]; i++) {
1876 char *p, *p2;
1877
1878 p = strstr(mntent->mnt_opts, list[i]);
1879 if (!p)
4e4ca161 1880 continue;
c5e30de4 1881
4e4ca161
SH		 1882 p2 = strchr(p, ',');
1883 if (!p2) {
1884 /* no more mntopts, so just chop it here */
1885 *p = '\0';
1886 continue;
1887 }
c5e30de4
CB		 1888
1889 memmove(p, p2 + 1, strlen(p2 + 1) + 1);
4e4ca161
SH		 1890 }
1891}
1892
4d5b72a1 1893static int mount_entry_create_dir_file(const struct mntent *mntent,
749f98d9
CB		 1894 const char *path,
1895 const struct lxc_rootfs *rootfs,
1896 const char *lxc_name,
1897 const char *lxc_path)
0ad19a3f 1898{
608e3567 1899 int ret = 0;
911324ef 1900
749f98d9
CB		 1901 if (!strncmp(mntent->mnt_type, "overlay", 7))
1902 ret = ovl_mkdir(mntent, rootfs, lxc_name, lxc_path);
1903 else if (!strncmp(mntent->mnt_type, "aufs", 4))
1904 ret = aufs_mkdir(mntent, rootfs, lxc_name, lxc_path);
1905 if (ret < 0)
1906 return -1;
6e46cc0d 1907
34cfffb3 1908 if (hasmntopt(mntent, "create=dir")) {
749f98d9
CB		 1909 ret = mkdir_p(path, 0755);
1910 if (ret < 0 && errno != EEXIST) {
1911 SYSERROR("Failed to create directory \"%s\"", path);
1912 return -1;
34cfffb3
SG		 1913 }
1914 }
1915
4d5b72a1 1916 if (hasmntopt(mntent, "create=file") && access(path, F_OK)) {
749f98d9
CB		 1917 int fd;
1918 char *p1, *p2;
1919
1920 p1 = strdup(path);
1921 if (!p1)
1922 return -1;
1923
1924 p2 = dirname(p1);
1925
1926 ret = mkdir_p(p2, 0755);
1927 free(p1);
1928 if (ret < 0 && errno != EEXIST) {
1929 SYSERROR("Failed to create directory \"%s\"", path);
1930 return -1;
6e46cc0d 1931 }
749f98d9
CB		 1932
1933 fd = open(path, O_CREAT, 0644);
1934 if (fd < 0)
1935 return -1;
1936 close(fd);
34cfffb3 1937 }
749f98d9
CB		 1938
1939 return 0;
4d5b72a1
NC		 1940}
1941
ec50007f
CB		 1942/* rootfs, lxc_name, and lxc_path can be NULL when the container is created
1943 * without a rootfs. */
db4aba38 1944static inline int mount_entry_on_generic(struct mntent *mntent,
d8b712bc
CB		 1945 const char *path,
1946 const struct lxc_rootfs *rootfs,
1947 const char *lxc_name,
1948 const char *lxc_path)
4d5b72a1 1949{
d8b712bc 1950 int ret;
4d5b72a1
NC		 1951 unsigned long mntflags;
1952 char *mntdata;
d8b712bc 1953 bool dev, optional;
ec50007f 1954 char *rootfs_path = NULL;
d8b712bc
CB		 1955
1956 optional = hasmntopt(mntent, "optional") != NULL;
1957 dev = hasmntopt(mntent, "dev") != NULL;
1958
ec50007f
CB		 1959 if (rootfs && rootfs->path)
1960 rootfs_path = rootfs->mount;
1961
d8b712bc
CB		 1962 ret = mount_entry_create_dir_file(mntent, path, rootfs, lxc_name,
1963 lxc_path);
1964 if (ret < 0) {
1965 if (optional)
1966 return 0;
608e3567 1967
d8b712bc
CB		 1968 return -1;
1969 }
4e4ca161
SH		 1970 cull_mntent_opt(mntent);
1971
d8b712bc
CB		 1972 ret = parse_mntopts(mntent->mnt_opts, &mntflags, &mntdata);
1973 if (ret < 0)
a17b1e65 1974 return -1;
a17b1e65 1975
6e46cc0d 1976 ret = mount_entry(mntent->mnt_fsname, path, mntent->mnt_type, mntflags,
ae7a770e 1977 mntdata, optional, dev, rootfs_path);
68c152ef 1978
911324ef 1979 free(mntdata);
911324ef
DL		 1980 return ret;
1981}
1982
db4aba38
NC		 1983static inline int mount_entry_on_systemfs(struct mntent *mntent)
1984{
1433c9f9 1985 int ret;
07667a6a 1986 char path[MAXPATHLEN];
1433c9f9
CB		 1987
1988 /* For containers created without a rootfs all mounts are treated as
07667a6a
CB		 1989 * absolute paths starting at / on the host.
1990 */
1433c9f9
CB		 1991 if (mntent->mnt_dir[0] != '/')
1992 ret = snprintf(path, sizeof(path), "/%s", mntent->mnt_dir);
1993 else
1994 ret = snprintf(path, sizeof(path), "%s", mntent->mnt_dir);
07667a6a 1995 if (ret < 0 || ret >= sizeof(path))
1433c9f9 1996 return -1;
1433c9f9
CB		 1997
1998 return mount_entry_on_generic(mntent, path, NULL, NULL, NULL);
db4aba38
NC		 1999}
2000
4e4ca161 2001static int mount_entry_on_absolute_rootfs(struct mntent *mntent,
80a881b2 2002 const struct lxc_rootfs *rootfs,
0a2dddd4
CB		 2003 const char *lxc_name,
2004 const char *lxc_path)
911324ef 2005{
bdd2b34c 2006 int offset;
013bd428 2007 char *aux;
67e571de 2008 const char *lxcpath;
bdd2b34c
CB		 2009 char path[MAXPATHLEN];
2010 int ret = 0;
0ad19a3f 2011
593e8478 2012 lxcpath = lxc_global_config_value("lxc.lxcpath");
bdd2b34c 2013 if (!lxcpath)
2a59a681 2014 return -1;
2a59a681 2015
bdd2b34c
CB		 2016 /* If rootfs->path is a blockdev path, allow container fstab to use
2017 * <lxcpath>/<name>/rootfs" as the target prefix.
2018 */
2019 ret = snprintf(path, MAXPATHLEN, "%s/%s/rootfs", lxcpath, lxc_name);
2020 if (ret < 0 || ret >= MAXPATHLEN)
80a881b2
SH		 2021 goto skipvarlib;
2022
2023 aux = strstr(mntent->mnt_dir, path);
2024 if (aux) {
2025 offset = strlen(path);
2026 goto skipabs;
2027 }
2028
2029skipvarlib:
013bd428
DL		 2030 aux = strstr(mntent->mnt_dir, rootfs->path);
2031 if (!aux) {
bdd2b34c 2032 WARN("Ignoring mount point \"%s\"", mntent->mnt_dir);
db4aba38 2033 return ret;
013bd428 2034 }
80a881b2
SH		 2035 offset = strlen(rootfs->path);
2036
2037skipabs:
bdd2b34c
CB		 2038 ret = snprintf(path, MAXPATHLEN, "%s/%s", rootfs->mount, aux + offset);
2039 if (ret < 0 || ret >= MAXPATHLEN)
a17b1e65 2040 return -1;
a17b1e65 2041
0a2dddd4 2042 return mount_entry_on_generic(mntent, path, rootfs, lxc_name, lxc_path);
911324ef 2043}
d330fe7b 2044
4e4ca161 2045static int mount_entry_on_relative_rootfs(struct mntent *mntent,
0a2dddd4
CB		 2046 const struct lxc_rootfs *rootfs,
2047 const char *lxc_name,
2048 const char *lxc_path)
911324ef
DL		 2049{
2050 char path[MAXPATHLEN];
911324ef 2051 int ret;
d330fe7b 2052
34cfffb3 2053 /* relative to root mount point */
6e46cc0d 2054 ret = snprintf(path, sizeof(path), "%s/%s", rootfs->mount, mntent->mnt_dir);
1433c9f9 2055 if (ret < 0 || ret >= sizeof(path)) {
9ba8130c
SH		 2056 ERROR("path name too long");
2057 return -1;
2058 }
911324ef 2059
0a2dddd4 2060 return mount_entry_on_generic(mntent, path, rootfs, lxc_name, lxc_path);
911324ef
DL		 2061}
2062
06749971
CB		 2063/* This logs a NOTICE() when a user specifies mounts that would conflict with
2064 * devices liblxc sets up automatically.
2065 */
2066static void log_notice_on_conflict(const struct lxc_conf *conf, const char *src,
2067 const char *dest)
2068{
2069 char *clean_mnt_fsname, *clean_mnt_dir, *tmp;
2070 bool needs_warning = false;
2071
2072 clean_mnt_fsname = lxc_deslashify(src);
2073 if (!clean_mnt_fsname)
2074 return;
2075
2076 clean_mnt_dir = lxc_deslashify(dest);
2077 if (!clean_mnt_dir) {
2078 free(clean_mnt_fsname);
2079 return;
2080 }
2081
2082 tmp = clean_mnt_dir;
2083 if (*tmp == '/')
2084 tmp++;
2085
2086 if (strncmp(src, "/dev", 4) || strncmp(tmp, "dev", 3)) {
2087 free(clean_mnt_dir);
2088 free(clean_mnt_fsname);
2089 return;
2090 }
2091
2092 if (!conf->autodev && !conf->pts && !conf->tty &&
2093 (!conf->console.path || !strcmp(conf->console.path, "none"))) {
2094 free(clean_mnt_dir);
2095 free(clean_mnt_fsname);
2096 return;
2097 }
2098
2099 if (!strcmp(tmp, "dev") && conf->autodev > 0)
2100 needs_warning = true;
2101 else if (!strcmp(tmp, "dev/pts") && (conf->autodev > 0 || conf->pts > 0))
2102 needs_warning = true;
2103 else if (!strcmp(tmp, "dev/ptmx") && (conf->autodev > 0 || conf->pts > 0))
2104 needs_warning = true;
2105 else if (!strcmp(tmp, "dev/pts/ptmx") && (conf->autodev > 0 || conf->pts > 0))
2106 needs_warning = true;
2107 else if (!strcmp(tmp, "dev/null") && conf->autodev > 0)
2108 needs_warning = true;
2109 else if (!strcmp(tmp, "dev/zero") && conf->autodev > 0)
2110 needs_warning = true;
2111 else if (!strcmp(tmp, "dev/full") && conf->autodev > 0)
2112 needs_warning = true;
2113 else if (!strcmp(tmp, "dev/urandom") && conf->autodev > 0)
2114 needs_warning = true;
2115 else if (!strcmp(tmp, "dev/random") && conf->autodev > 0)
2116 needs_warning = true;
2117 else if (!strcmp(tmp, "dev/tty") && conf->autodev > 0)
2118 needs_warning = true;
2119 else if (!strncmp(tmp, "dev/tty", 7) && (conf->autodev > 0 || conf->tty > 0))
2120 needs_warning = true;
2121
2122 if (needs_warning)
2123 NOTICE("Requesting to mount \"%s\" on \"%s\" while requesting "
2124 "automatic device setup under \"/dev\"",
2125 clean_mnt_fsname, clean_mnt_dir);
2126
2127 free(clean_mnt_dir);
2128 free(clean_mnt_fsname);
2129}
2130
2131static int mount_file_entries(const struct lxc_conf *conf,
2132 const struct lxc_rootfs *rootfs, FILE *file,
1ae3c19f 2133 const char *lxc_name, const char *lxc_path)
911324ef 2134{
aaf901be
AM		 2135 struct mntent mntent;
2136 char buf[4096];
911324ef 2137 int ret = -1;
e76b8764 2138
aaf901be 2139 while (getmntent_r(file, &mntent, buf, sizeof(buf))) {
06749971
CB		 2140 log_notice_on_conflict(conf, mntent.mnt_fsname, mntent.mnt_dir);
2141
1ae3c19f
CB		 2142 if (!rootfs->path)
2143 ret = mount_entry_on_systemfs(&mntent);
2144 else if (mntent.mnt_dir[0] != '/')
2145 ret = mount_entry_on_relative_rootfs(&mntent, rootfs,
2146 lxc_name, lxc_path);
2147 else
2148 ret = mount_entry_on_absolute_rootfs(&mntent, rootfs,
2149 lxc_name, lxc_path);
2150 if (ret < 0)
2151 return -1;
0ad19a3f 2152 }
2153 ret = 0;
cd54d859 2154
1ae3c19f 2155 INFO("Set up mount entries");
e7938e9e
MN		 2156 return ret;
2157}
2158
06749971
CB		 2159static int setup_mount(const struct lxc_conf *conf,
2160 const struct lxc_rootfs *rootfs, const char *fstab,
42dff448 2161 const char *lxc_name, const char *lxc_path)
e7938e9e 2162{
42dff448 2163 FILE *f;
e7938e9e
MN		 2164 int ret;
2165
2166 if (!fstab)
2167 return 0;
2168
42dff448
CB		 2169 f = setmntent(fstab, "r");
2170 if (!f) {
2171 SYSERROR("Failed to open \"%s\"", fstab);
e7938e9e
MN		 2172 return -1;
2173 }
2174
06749971 2175 ret = mount_file_entries(conf, rootfs, f, lxc_name, lxc_path);
42dff448
CB		 2176 if (ret < 0)
2177 ERROR("Failed to set up mount entries");
e7938e9e 2178
42dff448 2179 endmntent(f);
0ad19a3f 2180 return ret;
2181}
2182
5ef5c9a3 2183FILE *make_anonymous_mount_file(struct lxc_list *mount)
e7938e9e 2184{
5ef5c9a3 2185 int ret;
e7938e9e 2186 char *mount_entry;
5ef5c9a3 2187 struct lxc_list *iterator;
6bd04140 2188 FILE *f;
5ef5c9a3
CB		 2189 int fd = -1;
2190
2191 fd = memfd_create("lxc_mount_file", MFD_CLOEXEC);
2192 if (fd < 0) {
2193 if (errno != ENOSYS)
2194 return NULL;
6bd04140
CB		 2195 f = tmpfile();
2196 TRACE("Created temporary mount file");
5ef5c9a3 2197 } else {
6bd04140
CB		 2198 f = fdopen(fd, "r+");
2199 TRACE("Created anonymous mount file");
5ef5c9a3 2200 }
e7938e9e 2201
6bd04140
CB		 2202 if (!f) {
2203 SYSERROR("Could not create mount file");
5ef5c9a3
CB		 2204 if (fd != -1)
2205 close(fd);
9fc7f8c0 2206 return NULL;
e7938e9e
MN		 2207 }
2208
2209 lxc_list_for_each(iterator, mount) {
2210 mount_entry = iterator->elem;
6bd04140 2211 ret = fprintf(f, "%s\n", mount_entry);
5ef5c9a3 2212 if (ret < strlen(mount_entry))
6bd04140 2213 WARN("Could not write mount entry to mount file");
5ef5c9a3
CB		 2214 }
2215
6bd04140
CB		 2216 ret = fseek(f, 0, SEEK_SET);
2217 if (ret < 0) {
2218 SYSERROR("Failed to seek mount file");
2219 fclose(f);
5ef5c9a3 2220 return NULL;
e7938e9e
MN		 2221 }
2222
6bd04140 2223 return f;
9fc7f8c0
TA		 2224}
2225
06749971
CB		 2226static int setup_mount_entries(const struct lxc_conf *conf,
2227 const struct lxc_rootfs *rootfs,
5ef5c9a3
CB		 2228 struct lxc_list *mount, const char *lxc_name,
2229 const char *lxc_path)
9fc7f8c0 2230{
19b5d755 2231 FILE *f;
9fc7f8c0
TA		 2232 int ret;
2233
19b5d755
CB		 2234 f = make_anonymous_mount_file(mount);
2235 if (!f)
9fc7f8c0 2236 return -1;
e7938e9e 2237
06749971 2238 ret = mount_file_entries(conf, rootfs, f, lxc_name, lxc_path);
e7938e9e 2239
19b5d755 2240 fclose(f);
e7938e9e
MN		 2241 return ret;
2242}
2243
bab88e68
CS		 2244static int parse_cap(const char *cap)
2245{
2246 char *ptr = NULL;
84760c11 2247 size_t i;
2248 int capid = -1;
bab88e68 2249
7035407c
DE		 2250 if (!strcmp(cap, "none"))
2251 return -2;
2252
bab88e68
CS		 2253 for (i = 0; i < sizeof(caps_opt)/sizeof(caps_opt[0]); i++) {
2254
2255 if (strcmp(cap, caps_opt[i].name))
2256 continue;
2257
2258 capid = caps_opt[i].value;
2259 break;
2260 }
2261
2262 if (capid < 0) {
2263 /* try to see if it's numeric, so the user may specify
2264 * capabilities that the running kernel knows about but
2265 * we don't */
2266 errno = 0;
2267 capid = strtol(cap, &ptr, 10);
2268 if (!ptr || *ptr != '\0' || errno != 0)
2269 /* not a valid number */
2270 capid = -1;
2271 else if (capid > lxc_caps_last_cap())
2272 /* we have a number but it's not a valid
2273 * capability */
2274 capid = -1;
2275 }
2276
2277 return capid;
2278}
2279
0769b82a
CS		 2280int in_caplist(int cap, struct lxc_list *caps)
2281{
2282 struct lxc_list *iterator;
2283 int capid;
2284
2285 lxc_list_for_each(iterator, caps) {
2286 capid = parse_cap(iterator->elem);
2287 if (capid == cap)
2288 return 1;
2289 }
2290
2291 return 0;
2292}
2293
81810dd1
DL		 2294static int setup_caps(struct lxc_list *caps)
2295{
2296 struct lxc_list *iterator;
2297 char *drop_entry;
bab88e68 2298 int capid;
81810dd1
DL		 2299
2300 lxc_list_for_each(iterator, caps) {
2301
2302 drop_entry = iterator->elem;
2303
bab88e68 2304 capid = parse_cap(drop_entry);
d55bc1ad 2305
81810dd1 2306 if (capid < 0) {
1e11be34
DL		 2307 ERROR("unknown capability %s", drop_entry);
2308 return -1;
81810dd1
DL		 2309 }
2310
2311 DEBUG("drop capability '%s' (%d)", drop_entry, capid);
2312
2313 if (prctl(PR_CAPBSET_DROP, capid, 0, 0, 0)) {
3ec1648d
SH		 2314 SYSERROR("failed to remove %s capability", drop_entry);
2315 return -1;
2316 }
81810dd1
DL		 2317
2318 }
2319
1fb86a7c
SH		 2320 DEBUG("capabilities have been setup");
2321
2322 return 0;
2323}
2324
2325static int dropcaps_except(struct lxc_list *caps)
2326{
2327 struct lxc_list *iterator;
2328 char *keep_entry;
1fb86a7c
SH		 2329 int i, capid;
2330 int numcaps = lxc_caps_last_cap() + 1;
959aee9c 2331 INFO("found %d capabilities", numcaps);
1fb86a7c 2332
2caf9a97
SH		 2333 if (numcaps <= 0 || numcaps > 200)
2334 return -1;
2335
1a0e70ac 2336 /* caplist[i] is 1 if we keep capability i */
1fb86a7c
SH		 2337 int *caplist = alloca(numcaps * sizeof(int));
2338 memset(caplist, 0, numcaps * sizeof(int));
2339
2340 lxc_list_for_each(iterator, caps) {
2341
2342 keep_entry = iterator->elem;
2343
bab88e68 2344 capid = parse_cap(keep_entry);
1fb86a7c 2345
7035407c
DE		 2346 if (capid == -2)
2347 continue;
2348
1fb86a7c
SH		 2349 if (capid < 0) {
2350 ERROR("unknown capability %s", keep_entry);
2351 return -1;
2352 }
2353
8255688a 2354 DEBUG("keep capability '%s' (%d)", keep_entry, capid);
1fb86a7c
SH		 2355
2356 caplist[capid] = 1;
2357 }
2358 for (i=0; i<numcaps; i++) {
2359 if (caplist[i])
2360 continue;
2361 if (prctl(PR_CAPBSET_DROP, i, 0, 0, 0)) {
3ec1648d
SH		 2362 SYSERROR("failed to remove capability %d", i);
2363 return -1;
2364 }
1fb86a7c
SH		 2365 }
2366
2367 DEBUG("capabilities have been setup");
81810dd1
DL		 2368
2369 return 0;
2370}
2371
c6d09e15
WB		 2372static int parse_resource(const char *res) {
2373 size_t i;
2374 int resid = -1;
2375
2376 for (i = 0; i < sizeof(limit_opt)/sizeof(limit_opt[0]); ++i) {
2377 if (strcmp(res, limit_opt[i].name) == 0)
2378 return limit_opt[i].value;
2379 }
2380
2381 /* try to see if it's numeric, so the user may specify
2382 * resources that the running kernel knows about but
2383 * we don't */
2384 if (lxc_safe_int(res, &resid) == 0)
2385 return resid;
2386 return -1;
2387}
2388
2389int setup_resource_limits(struct lxc_list *limits, pid_t pid) {
2390 struct lxc_list *it;
2391 struct lxc_limit *lim;
2392 int resid;
2393
2394 lxc_list_for_each(it, limits) {
2395 lim = it->elem;
2396
2397 resid = parse_resource(lim->resource);
2398 if (resid < 0) {
2399 ERROR("unknown resource %s", lim->resource);
2400 return -1;
2401 }
2402
f48b5fd8 2403#if HAVE_PRLIMIT || HAVE_PRLIMIT64
c6d09e15
WB		 2404 if (prlimit(pid, resid, &lim->limit, NULL) != 0) {
2405 ERROR("failed to set limit %s: %s", lim->resource, strerror(errno));
2406 return -1;
2407 }
f48b5fd8
FF		 2408#else
2409 ERROR("Cannot set limit %s as prlimit is missing", lim->resource);
2410 return -1;
2411#endif
c6d09e15
WB		 2412 }
2413 return 0;
2414}
2415
ae9242c8
SH		 2416static char *default_rootfs_mount = LXCROOTFSMOUNT;
2417
7b379ab3 2418struct lxc_conf *lxc_conf_init(void)
089cd8b8 2419{
7b379ab3 2420 struct lxc_conf *new;
26ddeedd 2421 int i;
7b379ab3 2422
13277ec4 2423 new = malloc(sizeof(*new));
7b379ab3 2424 if (!new) {
13277ec4 2425 ERROR("lxc_conf_init : %s", strerror(errno));
7b379ab3
MN		 2426 return NULL;
2427 }
2428 memset(new, 0, sizeof(*new));
2429
4b73005c 2430 new->loglevel = LXC_LOG_LEVEL_NOTSET;
cccc74b5 2431 new->personality = -1;
124fa0a8 2432 new->autodev = 1;
596a818d
DE		 2433 new->console.log_path = NULL;
2434 new->console.log_fd = -1;
28f3b1cd 2435 new->console.buffer_size = 0;
28a4b0e5 2436 new->console.path = NULL;
63376d7d 2437 new->console.peer = -1;
b5159817
DE		 2438 new->console.peerpty.busy = -1;
2439 new->console.peerpty.master = -1;
2440 new->console.peerpty.slave = -1;
63376d7d
DL		 2441 new->console.master = -1;
2442 new->console.slave = -1;
2443 new->console.name[0] = '\0';
732375f5 2444 memset(&new->console.ringbuf, 0, sizeof(struct lxc_ringbuf));
d2e30e99 2445 new->maincmd_fd = -1;
76a26f55 2446 new->nbd_idx = -1;
54c30e29 2447 new->rootfs.mount = strdup(default_rootfs_mount);
53f3f048 2448 if (!new->rootfs.mount) {
13277ec4 2449 ERROR("lxc_conf_init : %s", strerror(errno));
53f3f048
SH		 2450 free(new);
2451 return NULL;
2452 }
858377e4 2453 new->logfd = -1;
7b379ab3
MN		 2454 lxc_list_init(&new->cgroup);
2455 lxc_list_init(&new->network);
2456 lxc_list_init(&new->mount_list);
81810dd1 2457 lxc_list_init(&new->caps);
1fb86a7c 2458 lxc_list_init(&new->keepcaps);
f6d3e3e4 2459 lxc_list_init(&new->id_map);
f979ac15 2460 lxc_list_init(&new->includes);
4184c3e1 2461 lxc_list_init(&new->aliens);
7c661726 2462 lxc_list_init(&new->environment);
c6d09e15 2463 lxc_list_init(&new->limits);
28d9e29e 2464 for (i = 0; i < NUM_LXC_HOOKS; i++)
26ddeedd 2465 lxc_list_init(&new->hooks[i]);
ee1e7aa0 2466 lxc_list_init(&new->groups);
fe4de9a6
DE		 2467 new->lsm_aa_profile = NULL;
2468 new->lsm_se_context = NULL;
5112cd70 2469 new->tmp_umount_proc = 0;
7b379ab3 2470
72bb04e4
PT		 2471 /* if running in a new user namespace, init and COMMAND
2472 * default to running as UID/GID 0 when using lxc-execute */
2473 new->init_uid = 0;
2474 new->init_gid = 0;
43654d34 2475 memset(&new->cgroup_meta, 0, sizeof(struct lxc_cgroup));
28d9e29e 2476 memset(&new->inherit_ns, 0, sizeof(char *) * LXC_NS_MAX);
72bb04e4 2477
7b379ab3 2478 return new;
089cd8b8
DL		 2479}
2480
251d0d2a
DE		 2481static int write_id_mapping(enum idtype idtype, pid_t pid, const char *buf,
2482 size_t buf_size)
f6d3e3e4 2483{
29053180
CB		 2484 char path[MAXPATHLEN];
2485 int fd, ret;
f6d3e3e4 2486
29053180
CB		 2487 ret = snprintf(path, MAXPATHLEN, "/proc/%d/%cid_map", pid,
2488 idtype == ID_TYPE_UID ? 'u' : 'g');
2489 if (ret < 0 || ret >= MAXPATHLEN) {
2490 ERROR("failed to create path \"%s\"", path);
f6d3e3e4
SH		 2491 return -E2BIG;
2492 }
29053180
CB		 2493
2494 fd = open(path, O_WRONLY);
2495 if (fd < 0) {
2496 SYSERROR("failed to open \"%s\"", path);
2497 return -1;
f6d3e3e4 2498 }
29053180
CB		 2499
2500 errno = 0;
2501 ret = lxc_write_nointr(fd, buf, buf_size);
2502 if (ret != buf_size) {
2503 SYSERROR("failed to write %cid mapping to \"%s\"",
2504 idtype == ID_TYPE_UID ? 'u' : 'g', path);
2505 close(fd);
2506 return -1;
2507 }
2508 close(fd);
2509
2510 return 0;
f6d3e3e4
SH		 2511}
2512
6e50e704
CB		 2513/* Check whether a binary exist and has either CAP_SETUID, CAP_SETGID or both.
2514 *
2515 * @return 1 if functional binary was found
2516 * @return 0 if binary exists but is lacking privilege
2517 * @return -ENOENT if binary does not exist
2518 * @return -EINVAL if cap to check is neither CAP_SETUID nor CAP_SETGID
2519 *
2520 */
df6a2945
CB		 2521static int idmaptool_on_path_and_privileged(const char *binary, cap_value_t cap)
2522{
2523 char *path;
2524 int ret;
2525 struct stat st;
2526 int fret = 0;
2527
6e50e704
CB		 2528 if (cap != CAP_SETUID && cap != CAP_SETGID)
2529 return -EINVAL;
2530
df6a2945
CB		 2531 path = on_path(binary, NULL);
2532 if (!path)
2533 return -ENOENT;
2534
2535 ret = stat(path, &st);
2536 if (ret < 0) {
2537 fret = -errno;
2538 goto cleanup;
2539 }
2540
2541 /* Check if the binary is setuid. */
2542 if (st.st_mode & S_ISUID) {
2543 DEBUG("The binary \"%s\" does have the setuid bit set.", path);
2544 fret = 1;
2545 goto cleanup;
2546 }
2547
69924fff 2548 #if HAVE_LIBCAP && LIBCAP_SUPPORTS_FILE_CAPABILITIES
df6a2945
CB		 2549 /* Check if it has the CAP_SETUID capability. */
2550 if ((cap & CAP_SETUID) &&
2551 lxc_file_cap_is_set(path, CAP_SETUID, CAP_EFFECTIVE) &&
2552 lxc_file_cap_is_set(path, CAP_SETUID, CAP_PERMITTED)) {
2553 DEBUG("The binary \"%s\" has CAP_SETUID in its CAP_EFFECTIVE "
2554 "and CAP_PERMITTED sets.", path);
2555 fret = 1;
2556 goto cleanup;
2557 }
2558
2559 /* Check if it has the CAP_SETGID capability. */
2560 if ((cap & CAP_SETGID) &&
2561 lxc_file_cap_is_set(path, CAP_SETGID, CAP_EFFECTIVE) &&
2562 lxc_file_cap_is_set(path, CAP_SETGID, CAP_PERMITTED)) {
2563 DEBUG("The binary \"%s\" has CAP_SETGID in its CAP_EFFECTIVE "
2564 "and CAP_PERMITTED sets.", path);
2565 fret = 1;
2566 goto cleanup;
2567 }
d6018f88 2568 #else
69924fff
CB		 2569 /* If we cannot check for file capabilities we need to give the benefit
2570 * of the doubt. Otherwise we might fail even though all the necessary
2571 * file capabilities are set.
2572 */
d6018f88
CB		 2573 DEBUG("Cannot check for file capabilites as full capability support is "
2574 "missing. Manual intervention needed.");
2575 fret = 1;
df6a2945
CB		 2576 #endif
2577
2578cleanup:
2579 free(path);
2580 return fret;
2581}
2582
986ef930
CB		 2583int lxc_map_ids_exec_wrapper(void *args)
2584{
2585 execl("/bin/sh", "sh", "-c", (char *)args, (char *)NULL);
2586 return -1;
2587}
2588
f6d3e3e4
SH		 2589int lxc_map_ids(struct lxc_list *idmap, pid_t pid)
2590{
f6d3e3e4 2591 struct id_map *map;
4bc3b759 2592 struct lxc_list *iterator;
251d0d2a 2593 enum idtype type;
986ef930 2594 char u_or_g;
4bc3b759 2595 char *pos;
99d43365 2596 int fill, left;
986ef930
CB		 2597 char cmd_output[MAXPATHLEN];
2598 /* strlen("new@idmap") = 9
2599 * +
2600 * strlen(" ") = 1
2601 * +
2602 * LXC_NUMSTRLEN64
2603 * +
2604 * strlen(" ") = 1
2605 *
2606 * We add some additional space to make sure that we really have
2607 * LXC_IDMAPLEN bytes available for our the {g,u]id mapping.
2608 */
2609 char mapbuf[9 + 1 + LXC_NUMSTRLEN64 + 1 + LXC_IDMAPLEN] = {0};
2610 int ret = 0, uidmap = 0, gidmap = 0;
2611 bool use_shadow = false, had_entry = false;
df6a2945
CB		 2612
2613 /* If new{g,u}idmap exists, that is, if shadow is handing out subuid
2614 * ranges, then insist that root also reserve ranges in subuid. This
22038de5
SH		 2615 * will protected it by preventing another user from being handed the
2616 * range by shadow.
2617 */
df6a2945 2618 uidmap = idmaptool_on_path_and_privileged("newuidmap", CAP_SETUID);
6e50e704
CB		 2619 if (uidmap == -ENOENT)
2620 WARN("newuidmap binary is missing");
2621 else if (!uidmap)
2622 WARN("newuidmap is lacking necessary privileges");
2623
df6a2945 2624 gidmap = idmaptool_on_path_and_privileged("newgidmap", CAP_SETGID);
6e50e704
CB		 2625 if (gidmap == -ENOENT)
2626 WARN("newgidmap binary is missing");
2627 else if (!gidmap)
2628 WARN("newgidmap is lacking necessary privileges");
2629
df6a2945
CB		 2630 if (uidmap > 0 && gidmap > 0) {
2631 DEBUG("Functional newuidmap and newgidmap binary found.");
4bc3b759 2632 use_shadow = true;
df6a2945 2633 } else {
99d43365
CB		 2634 /* In case unprivileged users run application containers via
2635 * execute() or a start*() there are valid cases where they may
2636 * only want to map their own {g,u}id. Let's not block them from
2637 * doing so by requiring geteuid() == 0.
2638 */
2639 DEBUG("No newuidmap and newgidmap binary found. Trying to "
2640 "write directly with euid %d.", geteuid());
0e6e3a41 2641 }
251d0d2a 2642
986ef930
CB		 2643 for (type = ID_TYPE_UID, u_or_g = 'u'; type <= ID_TYPE_GID;
2644 type++, u_or_g = 'g') {
2645 pos = mapbuf;
2646
0e6e3a41 2647 if (use_shadow)
986ef930 2648 pos += sprintf(mapbuf, "new%cidmap %d", u_or_g, pid);
4f7521b4 2649
cf3ef16d 2650 lxc_list_for_each(iterator, idmap) {
251d0d2a 2651 map = iterator->elem;
cf3ef16d
SH		 2652 if (map->idtype != type)
2653 continue;
2654
4bc3b759
CB		 2655 had_entry = true;
2656
986ef930 2657 left = LXC_IDMAPLEN - (pos - mapbuf);
d1838f34 2658 fill = snprintf(pos, left, "%s%lu %lu %lu%s",
4bc3b759
CB		 2659 use_shadow ? " " : "", map->nsid,
2660 map->hostid, map->range,
0e6e3a41 2661 use_shadow ? "" : "\n");
a427e268
CB		 2662 if (fill <= 0 || fill >= left) {
2663 /* The kernel only takes <= 4k for writes to
2664 * /proc/<pid>/{g,u}id_map
2665 */
2666 SYSERROR("Too many %cid mappings defined", u_or_g);
2667 return -1;
2668 }
4bc3b759 2669
cf3ef16d 2670 pos += fill;
251d0d2a 2671 }
cf3ef16d 2672 if (!had_entry)
4f7521b4 2673 continue;
cf3ef16d 2674
986ef930
CB		 2675 /* Try to catch the ouput of new{g,u}idmap to make debugging
2676 * easier.
2677 */
2678 if (use_shadow) {
2679 ret = run_command(cmd_output, sizeof(cmd_output),
2680 lxc_map_ids_exec_wrapper,
2681 (void *)mapbuf);
2682 if (ret < 0) {
54fbbeb5
CB		 2683 ERROR("new%cidmap failed to write mapping \"%s\": %s",
2684 u_or_g, cmd_output, mapbuf);
986ef930
CB		 2685 return -1;
2686 }
54fbbeb5 2687 TRACE("new%cidmap wrote mapping \"%s\"", u_or_g, mapbuf);
d1838f34 2688 } else {
986ef930 2689 ret = write_id_mapping(type, pid, mapbuf, pos - mapbuf);
54fbbeb5 2690 if (ret < 0) {
da0f9977 2691 ERROR("Failed to write mapping: %s", mapbuf);
986ef930 2692 return -1;
54fbbeb5
CB		 2693 }
2694 TRACE("Wrote mapping \"%s\"", mapbuf);
d1838f34 2695 }
986ef930
CB		 2696
2697 memset(mapbuf, 0, sizeof(mapbuf));
f6d3e3e4 2698 }
251d0d2a 2699
986ef930 2700 return 0;
f6d3e3e4
SH		 2701}
2702
cf3ef16d 2703/*
7b50c609
TS		 2704 * return the host uid/gid to which the container root is mapped in
2705 * *val.
0b3a6504 2706 * Return true if id was found, false otherwise.
cf3ef16d 2707 */
2a9a80cb 2708bool get_mapped_rootid(struct lxc_conf *conf, enum idtype idtype,
3ec1648d 2709 unsigned long *val)
cf3ef16d
SH		 2710{
2711 struct lxc_list *it;
2712 struct id_map *map;
2713
2714 lxc_list_for_each(it, &conf->id_map) {
2715 map = it->elem;
7b50c609 2716 if (map->idtype != idtype)
cf3ef16d
SH		 2717 continue;
2718 if (map->nsid != 0)
2719 continue;
2a9a80cb
SH		 2720 *val = map->hostid;
2721 return true;
cf3ef16d 2722 }
2a9a80cb 2723 return false;
cf3ef16d
SH		 2724}
2725
2133f58c 2726int mapped_hostid(unsigned id, struct lxc_conf *conf, enum idtype idtype)
cf3ef16d
SH		 2727{
2728 struct lxc_list *it;
2729 struct id_map *map;
2730 lxc_list_for_each(it, &conf->id_map) {
2731 map = it->elem;
2133f58c 2732 if (map->idtype != idtype)
cf3ef16d
SH		 2733 continue;
2734 if (id >= map->hostid && id < map->hostid + map->range)
57d116ab 2735 return (id - map->hostid) + map->nsid;
cf3ef16d 2736 }
57d116ab 2737 return -1;
cf3ef16d
SH		 2738}
2739
339efad9 2740int find_unmapped_nsid(struct lxc_conf *conf, enum idtype idtype)
cf3ef16d
SH		 2741{
2742 struct lxc_list *it;
2743 struct id_map *map;
2133f58c 2744 unsigned int freeid = 0;
cf3ef16d
SH		 2745again:
2746 lxc_list_for_each(it, &conf->id_map) {
2747 map = it->elem;
2133f58c 2748 if (map->idtype != idtype)
cf3ef16d
SH		 2749 continue;
2750 if (freeid >= map->nsid && freeid < map->nsid + map->range) {
2751 freeid = map->nsid + map->range;
2752 goto again;
2753 }
2754 }
2755 return freeid;
2756}
2757
f4f52cb5
CB		 2758int chown_mapped_root_exec_wrapper(void *args)
2759{
2760 execvp("lxc-usernsexec", args);
2761 return -1;
2762}
2763
f6d3e3e4 2764/*
7b50c609
TS		 2765 * chown_mapped_root: for an unprivileged user with uid/gid X to
2766 * chown a dir to subuid/subgid Y, he needs to run chown as root
2767 * in a userns where nsid 0 is mapped to hostuid/hostgid Y, and
2768 * nsid Y is mapped to hostuid/hostgid X. That way, the container
2769 * root is privileged with respect to hostuid/hostgid X, allowing
2770 * him to do the chown.
f6d3e3e4 2771 */
c4d10a05 2772int chown_mapped_root(char *path, struct lxc_conf *conf)
f6d3e3e4 2773{
f4f52cb5 2774 uid_t rootuid, rootgid;
2a9a80cb 2775 unsigned long val;
f4f52cb5
CB		 2776 int hostuid, hostgid, ret;
2777 struct stat sb;
2778 char map1[100], map2[100], map3[100], map4[100], map5[100];
2779 char ugid[100];
2780 char *args1[] = {"lxc-usernsexec",
2781 "-m", map1,
2782 "-m", map2,
2783 "-m", map3,
2784 "-m", map5,
2785 "--", "chown", ugid, path,
2786 NULL};
2787 char *args2[] = {"lxc-usernsexec",
2788 "-m", map1,
2789 "-m", map2,
2790 "-m", map3,
2791 "-m", map4,
2792 "-m", map5,
2793 "--", "chown", ugid, path,
2794 NULL};
2795 char cmd_output[MAXPATHLEN];
2796
2797 hostuid = geteuid();
2798 hostgid = getegid();
f6d3e3e4 2799
2a9a80cb 2800 if (!get_mapped_rootid(conf, ID_TYPE_UID, &val)) {
bc80f098 2801 ERROR("No uid mapping for container root");
c4d10a05 2802 return -1;
f6d3e3e4 2803 }
f4f52cb5 2804 rootuid = (uid_t)val;
7b50c609 2805 if (!get_mapped_rootid(conf, ID_TYPE_GID, &val)) {
bc80f098 2806 ERROR("No gid mapping for container root");
7b50c609
TS		 2807 return -1;
2808 }
f4f52cb5 2809 rootgid = (gid_t)val;
2a9a80cb 2810
f4f52cb5 2811 if (hostuid == 0) {
7b50c609 2812 if (chown(path, rootuid, rootgid) < 0) {
c4d10a05
SH		 2813 ERROR("Error chowning %s", path);
2814 return -1;
2815 }
2816 return 0;
2817 }
f3d7e4ca 2818
f4f52cb5 2819 if (rootuid == hostuid) {
1a0e70ac 2820 /* nothing to do */
b103ceac 2821 INFO("Container root is our uid; no need to chown");
f3d7e4ca
SH		 2822 return 0;
2823 }
2824
bbdbf8f0 2825 /* save the current gid of "path" */
f4f52cb5
CB		 2826 if (stat(path, &sb) < 0) {
2827 ERROR("Error stat %s", path);
f6d3e3e4
SH		 2828 return -1;
2829 }
7b50c609 2830
bbdbf8f0
CB		 2831 /* Update the path argument in case this was overlayfs. */
2832 args1[sizeof(args1) / sizeof(args1[0]) - 2] = path;
2833 args2[sizeof(args2) / sizeof(args2[0]) - 2] = path;
2834
f4f52cb5
CB		 2835 /*
2836 * A file has to be group-owned by a gid mapped into the
2837 * container, or the container won't be privileged over it.
2838 */
2839 DEBUG("trying to chown \"%s\" to %d", path, hostgid);
2840 if (sb.st_uid == hostuid &&
2841 mapped_hostid(sb.st_gid, conf, ID_TYPE_GID) < 0 &&
2842 chown(path, -1, hostgid) < 0) {
2843 ERROR("Failed chgrping %s", path);
2844 return -1;
2845 }
f6d3e3e4 2846
1a0e70ac 2847 /* "u:0:rootuid:1" */
f4f52cb5
CB		 2848 ret = snprintf(map1, 100, "u:0:%d:1", rootuid);
2849 if (ret < 0 || ret >= 100) {
2850 ERROR("Error uid printing map string");
2851 return -1;
2852 }
7b50c609 2853
1a0e70ac 2854 /* "u:hostuid:hostuid:1" */
f4f52cb5
CB		 2855 ret = snprintf(map2, 100, "u:%d:%d:1", hostuid, hostuid);
2856 if (ret < 0 || ret >= 100) {
2857 ERROR("Error uid printing map string");
2858 return -1;
2859 }
c4d10a05 2860
1a0e70ac 2861 /* "g:0:rootgid:1" */
f4f52cb5
CB		 2862 ret = snprintf(map3, 100, "g:0:%d:1", rootgid);
2863 if (ret < 0 || ret >= 100) {
2864 ERROR("Error gid printing map string");
2865 return -1;
2866 }
98e5ba51 2867
1a0e70ac 2868 /* "g:pathgid:rootgid+pathgid:1" */
f4f52cb5
CB		 2869 ret = snprintf(map4, 100, "g:%d:%d:1", (gid_t)sb.st_gid,
2870 rootgid + (gid_t)sb.st_gid);
2871 if (ret < 0 || ret >= 100) {
2872 ERROR("Error gid printing map string");
2873 return -1;
2874 }
c4d10a05 2875
1a0e70ac 2876 /* "g:hostgid:hostgid:1" */
f4f52cb5
CB		 2877 ret = snprintf(map5, 100, "g:%d:%d:1", hostgid, hostgid);
2878 if (ret < 0 || ret >= 100) {
2879 ERROR("Error gid printing map string");
2880 return -1;
2881 }
7b50c609 2882
1a0e70ac 2883 /* "0:pathgid" (chown) */
f4f52cb5
CB		 2884 ret = snprintf(ugid, 100, "0:%d", (gid_t)sb.st_gid);
2885 if (ret < 0 || ret >= 100) {
2886 ERROR("Error owner printing format string for chown");
2887 return -1;
2888 }
7b50c609 2889
f4f52cb5
CB		 2890 if (hostgid == sb.st_gid)
2891 ret = run_command(cmd_output, sizeof(cmd_output),
2892 chown_mapped_root_exec_wrapper,
2893 (void *)args1);
2894 else
2895 ret = run_command(cmd_output, sizeof(cmd_output),
2896 chown_mapped_root_exec_wrapper,
2897 (void *)args2);
2898 if (ret < 0)
2899 ERROR("lxc-usernsexec failed: %s", cmd_output);
7b50c609 2900
f4f52cb5 2901 return ret;
f6d3e3e4
SH		 2902}
2903
54117de5 2904int lxc_ttys_shift_ids(struct lxc_conf *c)
f6d3e3e4 2905{
c4d10a05 2906 if (lxc_list_empty(&c->id_map))
f6d3e3e4 2907 return 0;
c4d10a05 2908
54117de5
CB		 2909 if (!strcmp(c->console.name, ""))
2910 return 0;
2911
2912 if (chown_mapped_root(c->console.name, c) < 0) {
2913 ERROR("failed to chown console \"%s\"", c->console.name);
c4d10a05
SH		 2914 return -1;
2915 }
2916
54117de5
CB		 2917 TRACE("chowned console \"%s\"", c->console.name);
2918
f6d3e3e4
SH		 2919 return 0;
2920}
2921
943144d9
CB		 2922/* NOTE: Must not be called from inside the container namespace! */
2923int lxc_create_tmp_proc_mount(struct lxc_conf *conf)
5112cd70
SH		 2924{
2925 int mounted;
2926
943144d9 2927 mounted = lxc_mount_proc_if_needed(conf->rootfs.path ? conf->rootfs.mount : "");
5112cd70 2928 if (mounted == -1) {
943144d9 2929 SYSERROR("failed to mount /proc in the container");
01958b1f 2930 /* continue only if there is no rootfs */
943144d9 2931 if (conf->rootfs.path)
01958b1f 2932 return -1;
5112cd70 2933 } else if (mounted == 1) {
943144d9 2934 conf->tmp_umount_proc = 1;
5112cd70 2935 }
943144d9 2936
5112cd70
SH		 2937 return 0;
2938}
2939
2940void tmp_proc_unmount(struct lxc_conf *lxc_conf)
2941{
2942 if (lxc_conf->tmp_umount_proc == 1) {
2943 umount("/proc");
2944 lxc_conf->tmp_umount_proc = 0;
2945 }
2946}
2947
6a0c909a 2948void remount_all_slave(void)
e995d7a2
SH		 2949{
2950 /* walk /proc/mounts and change any shared entries to slave */
2951 FILE *f = fopen("/proc/self/mountinfo", "r");
2952 char *line = NULL;
2953 size_t len = 0;
2954
2955 if (!f) {
2956 SYSERROR("Failed to open /proc/self/mountinfo to mark all shared");
2957 ERROR("Continuing container startup...");
2958 return;
2959 }
2960
2961 while (getline(&line, &len, f) != -1) {
2962 char *target, *opts;
2963 target = get_field(line, 4);
2964 if (!target)
2965 continue;
2966 opts = get_field(target, 2);
2967 if (!opts)
2968 continue;
2969 null_endofword(opts);
2970 if (!strstr(opts, "shared"))
2971 continue;
2972 null_endofword(target);
2973 if (mount(NULL, target, NULL, MS_SLAVE, NULL)) {
2974 SYSERROR("Failed to make %s rslave", target);
2975 ERROR("Continuing...");
2976 }
2977 }
2978 fclose(f);
f10fad2f 2979 free(line);
e995d7a2
SH		 2980}
2981
2322903b
SH		 2982void lxc_execute_bind_init(struct lxc_conf *conf)
2983{
2984 int ret;
9d9c111c
SH		 2985 char path[PATH_MAX], destpath[PATH_MAX], *p;
2986
2987 /* If init exists in the container, don't bind mount a static one */
2988 p = choose_init(conf->rootfs.mount);
2989 if (p) {
2990 free(p);
2991 return;
2992 }
2322903b
SH		 2993
2994 ret = snprintf(path, PATH_MAX, SBINDIR "/init.lxc.static");
2995 if (ret < 0 || ret >= PATH_MAX) {
2996 WARN("Path name too long searching for lxc.init.static");
2997 return;
2998 }
2999
3000 if (!file_exists(path)) {
3001 INFO("%s does not exist on host", path);
3002 return;
3003 }
3004
3005 ret = snprintf(destpath, PATH_MAX, "%s%s", conf->rootfs.mount, "/init.lxc.static");
3006 if (ret < 0 || ret >= PATH_MAX) {
3007 WARN("Path name too long for container's lxc.init.static");
3008 return;
3009 }
3010
3011 if (!file_exists(destpath)) {
3012 FILE * pathfile = fopen(destpath, "wb");
3013 if (!pathfile) {
3014 SYSERROR("Failed to create mount target '%s'", destpath);
3015 return;
3016 }
3017 fclose(pathfile);
3018 }
3019
592fd47a 3020 ret = safe_mount(path, destpath, "none", MS_BIND, NULL, conf->rootfs.mount);
2322903b
SH		 3021 if (ret < 0)
3022 SYSERROR("Failed to bind lxc.init.static into container");
3023 INFO("lxc.init.static bound into container at %s", path);
3024}
3025
35120d9c
SH		 3026/*
3027 * This does the work of remounting / if it is shared, calling the
3028 * container pre-mount hooks, and mounting the rootfs.
3029 */
3030int do_rootfs_setup(struct lxc_conf *conf, const char *name, const char *lxcpath)
0ad19a3f 3031{
35120d9c
SH		 3032 if (conf->rootfs_setup) {
3033 /*
3034 * rootfs was set up in another namespace. bind-mount it
3035 * to give us a mount in our own ns so we can pivot_root to it
3036 */
3037 const char *path = conf->rootfs.mount;
3038 if (mount(path, path, "rootfs", MS_BIND, NULL) < 0) {
3039 ERROR("Failed to bind-mount container / onto itself");
145832ba 3040 return -1;
35120d9c 3041 }
145832ba 3042 return 0;
35120d9c 3043 }
d4ef7c50 3044
e995d7a2
SH		 3045 remount_all_slave();
3046
35120d9c
SH		 3047 if (run_lxc_hooks(name, "pre-mount", conf, lxcpath, NULL)) {
3048 ERROR("failed to run pre-mount hooks for container '%s'.", name);
3049 return -1;
3050 }
3051
9aa76a17 3052 if (lxc_setup_rootfs(conf)) {
35120d9c
SH		 3053 ERROR("failed to setup rootfs for '%s'", name);
3054 return -1;
3055 }
3056
3057 conf->rootfs_setup = true;
3058 return 0;
3059}
3060
1c1c7051
SH		 3061static bool verify_start_hooks(struct lxc_conf *conf)
3062{
3063 struct lxc_list *it;
3064 char path[MAXPATHLEN];
3065 lxc_list_for_each(it, &conf->hooks[LXCHOOK_START]) {
3066 char *hookname = it->elem;
3067 struct stat st;
3068 int ret;
3069
3070 ret = snprintf(path, MAXPATHLEN, "%s%s",
7b6753e7 3071 conf->rootfs.path ? conf->rootfs.mount : "", hookname);
1c1c7051
SH		 3072 if (ret < 0 || ret >= MAXPATHLEN)
3073 return false;
3074 ret = stat(path, &st);
3075 if (ret) {
7b6753e7 3076 SYSERROR("Start hook %s not found in container",
1c1c7051
SH		 3077 hookname);
3078 return false;
3079 }
6a0c909a 3080 return true;
1c1c7051
SH		 3081 }
3082
3083 return true;
3084}
3085
3b988b33 3086int lxc_setup(struct lxc_handler *handler)
35120d9c 3087{
2187efd3 3088 int ret;
35120d9c
SH		 3089 const char *name = handler->name;
3090 struct lxc_conf *lxc_conf = handler->conf;
3091 const char *lxcpath = handler->lxcpath;
35120d9c
SH		 3092
3093 if (do_rootfs_setup(lxc_conf, name, lxcpath) < 0) {
3094 ERROR("Error setting up rootfs mount after spawn");
3095 return -1;
3096 }
3097
28d9e29e 3098 if (handler->nsfd[LXC_NS_UTS] == -1) {
6c544cb3
MM		 3099 if (setup_utsname(lxc_conf->utsname)) {
3100 ERROR("failed to setup the utsname for '%s'", name);
3101 return -1;
3102 }
0ad19a3f 3103 }
3104
811ef482 3105 if (lxc_setup_network_in_child_namespaces(lxc_conf, &lxc_conf->network)) {
36eb9bde 3106 ERROR("failed to setup the network for '%s'", name);
95b5ffaf 3107 return -1;
0ad19a3f 3108 }
3109
790255cf
CB		 3110 if (lxc_network_send_name_and_ifindex_to_parent(handler) < 0) {
3111 ERROR("Failed to network device names and ifindices to parent");
3112 return -1;
3113 }
3114
bc6928ff 3115 if (lxc_conf->autodev > 0) {
14221cbb 3116 if (mount_autodev(name, &lxc_conf->rootfs, lxcpath)) {
91c3830e 3117 ERROR("failed to mount /dev in the container");
c6883f38
SH		 3118 return -1;
3119 }
3120 }
3121
368bbc02
CS		 3122 /* do automatic mounts (mainly /proc and /sys), but exclude
3123 * those that need to wait until other stuff has finished
3124 */
4fb3cba5 3125 if (lxc_mount_auto_mounts(lxc_conf, lxc_conf->auto_mounts & ~LXC_AUTO_CGROUP_MASK, handler) < 0) {
368bbc02
CS		 3126 ERROR("failed to setup the automatic mounts for '%s'", name);
3127 return -1;
3128 }
3129
06749971 3130 if (setup_mount(lxc_conf, &lxc_conf->rootfs, lxc_conf->fstab, name, lxcpath)) {
36eb9bde 3131 ERROR("failed to setup the mounts for '%s'", name);
95b5ffaf 3132 return -1;
576f946d 3133 }
3134
06749971 3135 if (!lxc_list_empty(&lxc_conf->mount_list) && setup_mount_entries(lxc_conf, &lxc_conf->rootfs, &lxc_conf->mount_list, name, lxcpath)) {
e7938e9e
MN		 3136 ERROR("failed to setup the mount entries for '%s'", name);
3137 return -1;
3138 }
3139
7b6753e7 3140 /* Make sure any start hooks are in the container */
1c1c7051
SH		 3141 if (!verify_start_hooks(lxc_conf))
3142 return -1;
3143
2322903b
SH		 3144 if (lxc_conf->is_execute)
3145 lxc_execute_bind_init(lxc_conf);
3146
368bbc02
CS		 3147 /* now mount only cgroup, if wanted;
3148 * before, /sys could not have been mounted
3149 * (is either mounted automatically or via fstab entries)
3150 */
4fb3cba5 3151 if (lxc_mount_auto_mounts(lxc_conf, lxc_conf->auto_mounts & LXC_AUTO_CGROUP_MASK, handler) < 0) {
368bbc02
CS		 3152 ERROR("failed to setup the automatic mounts for '%s'", name);
3153 return -1;
3154 }
3155
283678ed 3156 if (run_lxc_hooks(name, "mount", lxc_conf, lxcpath, NULL)) {
773fb9ca
SH		 3157 ERROR("failed to run mount hooks for container '%s'.", name);
3158 return -1;
3159 }
3160
bc6928ff 3161 if (lxc_conf->autodev > 0) {
283678ed 3162 if (run_lxc_hooks(name, "autodev", lxc_conf, lxcpath, NULL)) {
f7bee6c6
MW		 3163 ERROR("failed to run autodev hooks for container '%s'.", name);
3164 return -1;
3165 }
06749971 3166
27245ff7 3167 if (lxc_fill_autodev(&lxc_conf->rootfs)) {
91c3830e
SH		 3168 ERROR("failed to populate /dev in the container");
3169 return -1;
3170 }
3171 }
368bbc02 3172
ed8704d0
CB		 3173 ret = lxc_setup_console(&lxc_conf->rootfs, &lxc_conf->console,
3174 lxc_conf->ttydir);
3175 if (ret < 0) {
3176 ERROR("Failed to setup console");
95b5ffaf 3177 return -1;
6e590161 3178 }
3179
ed8704d0
CB		 3180 ret = lxc_setup_dev_symlinks(&lxc_conf->rootfs);
3181 if (ret < 0) {
3182 ERROR("Failed to setup /dev symlinks");
69aa6655
DE		 3183 return -1;
3184 }
3185
5112cd70 3186 /* mount /proc if it's not already there */
943144d9 3187 if (lxc_create_tmp_proc_mount(lxc_conf) < 0) {
fe4de9a6 3188 ERROR("failed to LSM mount proc for '%s'", name);
e075f5d9 3189 return -1;
e075f5d9 3190 }
e075f5d9 3191
ac778708 3192 if (setup_pivot_root(&lxc_conf->rootfs)) {
36eb9bde 3193 ERROR("failed to set rootfs for '%s'", name);
95b5ffaf 3194 return -1;
ed502555 3195 }
3196
70761e5e 3197 if (lxc_setup_devpts(lxc_conf->pts)) {
36eb9bde 3198 ERROR("failed to setup the new pts instance");
95b5ffaf 3199 return -1;
3c26f34e 3200 }
3201
2187efd3
CB		 3202 ret = lxc_create_ttys(handler);
3203 if (ret < 0)
e8bd4e43 3204 return -1;
e8bd4e43 3205
cccc74b5
DL		 3206 if (setup_personality(lxc_conf->personality)) {
3207 ERROR("failed to setup personality");
3208 return -1;
3209 }
3210
97a8f74f
SG		 3211 if (!lxc_list_empty(&lxc_conf->keepcaps)) {
3212 if (!lxc_list_empty(&lxc_conf->caps)) {
7389ca26 3213 ERROR("Container requests lxc.cap.drop and lxc.cap.keep: either use lxc.cap.drop or lxc.cap.keep, not both.");
f6d3e3e4
SH		 3214 return -1;
3215 }
97a8f74f
SG		 3216 if (dropcaps_except(&lxc_conf->keepcaps)) {
3217 ERROR("failed to keep requested caps");
3218 return -1;
3219 }
3220 } else if (setup_caps(&lxc_conf->caps)) {
3221 ERROR("failed to drop capabilities");
3222 return -1;
81810dd1
DL		 3223 }
3224
f4152036 3225 NOTICE("Container \"%s\" is set up", name);
cd54d859 3226
0ad19a3f 3227 return 0;
3228}
26ddeedd 3229
283678ed
SH		 3230int run_lxc_hooks(const char *name, char *hook, struct lxc_conf *conf,
3231 const char *lxcpath, char *argv[])
26ddeedd
SH		 3232{
3233 int which = -1;
3234 struct lxc_list *it;
3235
3236 if (strcmp(hook, "pre-start") == 0)
3237 which = LXCHOOK_PRESTART;
08dd2805
SH		 3238 else if (strcmp(hook, "start-host") == 0)
3239 which = LXCHOOK_START_HOST;
5ea6163a
SH		 3240 else if (strcmp(hook, "pre-mount") == 0)
3241 which = LXCHOOK_PREMOUNT;
26ddeedd
SH		 3242 else if (strcmp(hook, "mount") == 0)
3243 which = LXCHOOK_MOUNT;
f7bee6c6
MW		 3244 else if (strcmp(hook, "autodev") == 0)
3245 which = LXCHOOK_AUTODEV;
26ddeedd
SH		 3246 else if (strcmp(hook, "start") == 0)
3247 which = LXCHOOK_START;
52492063
WB		 3248 else if (strcmp(hook, "stop") == 0)
3249 which = LXCHOOK_STOP;
26ddeedd
SH		 3250 else if (strcmp(hook, "post-stop") == 0)
3251 which = LXCHOOK_POSTSTOP;
148e91f5
SH		 3252 else if (strcmp(hook, "clone") == 0)
3253 which = LXCHOOK_CLONE;
37cf711b
SY		 3254 else if (strcmp(hook, "destroy") == 0)
3255 which = LXCHOOK_DESTROY;
26ddeedd
SH		 3256 else
3257 return -1;
3258 lxc_list_for_each(it, &conf->hooks[which]) {
3259 int ret;
3260 char *hookname = it->elem;
283678ed 3261 ret = run_script_argv(name, "lxc", hookname, hook, lxcpath, argv);
26ddeedd
SH		 3262 if (ret)
3263 return ret;
3264 }
3265 return 0;
3266}
72d0e1cb 3267
72d0e1cb
SG		 3268int lxc_clear_config_caps(struct lxc_conf *c)
3269{
1a0e70ac 3270 struct lxc_list *it, *next;
72d0e1cb 3271
9ebb03ad 3272 lxc_list_for_each_safe(it, &c->caps, next) {
72d0e1cb
SG		 3273 lxc_list_del(it);
3274 free(it->elem);
3275 free(it);
3276 }
3277 return 0;
3278}
3279
74a3920a 3280static int lxc_free_idmap(struct lxc_list *id_map) {
27c27d73
SH		 3281 struct lxc_list *it, *next;
3282
4355ab5f 3283 lxc_list_for_each_safe(it, id_map, next) {
27c27d73
SH		 3284 lxc_list_del(it);
3285 free(it->elem);
3286 free(it);
3287 }
3288 return 0;
3289}
3290
4355ab5f
SH		 3291int lxc_clear_idmaps(struct lxc_conf *c)
3292{
3293 return lxc_free_idmap(&c->id_map);
3294}
3295
1fb86a7c
SH		 3296int lxc_clear_config_keepcaps(struct lxc_conf *c)
3297{
3298 struct lxc_list *it,*next;
3299
3300 lxc_list_for_each_safe(it, &c->keepcaps, next) {
3301 lxc_list_del(it);
3302 free(it->elem);
3303 free(it);
3304 }
3305 return 0;
3306}
3307
12a50cc6 3308int lxc_clear_cgroups(struct lxc_conf *c, const char *key)
72d0e1cb 3309{
9ebb03ad 3310 struct lxc_list *it,*next;
72d0e1cb 3311 bool all = false;
a6390f01 3312 const char *k = NULL;
72d0e1cb
SG		 3313
3314 if (strcmp(key, "lxc.cgroup") == 0)
3315 all = true;
a6390f01
WB		 3316 else if (strncmp(key, "lxc.cgroup.", sizeof("lxc.cgroup.")-1) == 0)
3317 k = key + sizeof("lxc.cgroup.")-1;
3318 else
3319 return -1;
72d0e1cb 3320
9ebb03ad 3321 lxc_list_for_each_safe(it, &c->cgroup, next) {
72d0e1cb
SG		 3322 struct lxc_cgroup *cg = it->elem;
3323 if (!all && strcmp(cg->subsystem, k) != 0)
3324 continue;
3325 lxc_list_del(it);
3326 free(cg->subsystem);
3327 free(cg->value);
3328 free(cg);
3329 free(it);
3330 }
3331 return 0;
3332}
3333
c6d09e15
WB		 3334int lxc_clear_limits(struct lxc_conf *c, const char *key)
3335{
3336 struct lxc_list *it, *next;
3337 bool all = false;
3338 const char *k = NULL;
3339
240d4b74 3340 if (strcmp(key, "lxc.limit") == 0
3341 || strcmp(key, "lxc.prlimit"))
c6d09e15
WB		 3342 all = true;
3343 else if (strncmp(key, "lxc.limit.", sizeof("lxc.limit.")-1) == 0)
3344 k = key + sizeof("lxc.limit.")-1;
240d4b74 3345 else if (strncmp(key, "lxc.prlimit.", sizeof("lxc.prlimit.")-1) == 0)
3346 k = key + sizeof("lxc.prlimit.")-1;
c6d09e15
WB		 3347 else
3348 return -1;
3349
3350 lxc_list_for_each_safe(it, &c->limits, next) {
3351 struct lxc_limit *lim = it->elem;
3352 if (!all && strcmp(lim->resource, k) != 0)
3353 continue;
3354 lxc_list_del(it);
3355 free(lim->resource);
3356 free(lim);
3357 free(it);
3358 }
3359 return 0;
3360}
3361
ee1e7aa0
SG		 3362int lxc_clear_groups(struct lxc_conf *c)
3363{
3364 struct lxc_list *it,*next;
3365
3366 lxc_list_for_each_safe(it, &c->groups, next) {
3367 lxc_list_del(it);
3368 free(it->elem);
3369 free(it);
3370 }
3371 return 0;
3372}
3373
ab799c0b
SG		 3374int lxc_clear_environment(struct lxc_conf *c)
3375{
3376 struct lxc_list *it,*next;
3377
3378 lxc_list_for_each_safe(it, &c->environment, next) {
3379 lxc_list_del(it);
3380 free(it->elem);
3381 free(it);
3382 }
3383 return 0;
3384}
3385
72d0e1cb
SG		 3386int lxc_clear_mount_entries(struct lxc_conf *c)
3387{
9ebb03ad 3388 struct lxc_list *it,*next;
72d0e1cb 3389
9ebb03ad 3390 lxc_list_for_each_safe(it, &c->mount_list, next) {
72d0e1cb
SG		 3391 lxc_list_del(it);
3392 free(it->elem);
3393 free(it);
3394 }
3395 return 0;
3396}
3397
b099e9e9
SH		 3398int lxc_clear_automounts(struct lxc_conf *c)
3399{
3400 c->auto_mounts = 0;
3401 return 0;
3402}
3403
12a50cc6 3404int lxc_clear_hooks(struct lxc_conf *c, const char *key)
72d0e1cb 3405{
9ebb03ad 3406 struct lxc_list *it,*next;
17ed13a3 3407 bool all = false, done = false;
a6390f01 3408 const char *k = NULL;
72d0e1cb
SG		 3409 int i;
3410
17ed13a3
SH		 3411 if (strcmp(key, "lxc.hook") == 0)
3412 all = true;
a6390f01
WB		 3413 else if (strncmp(key, "lxc.hook.", sizeof("lxc.hook.")-1) == 0)
3414 k = key + sizeof("lxc.hook.")-1;
3415 else
3416 return -1;
17ed13a3 3417
72d0e1cb 3418 for (i=0; i<NUM_LXC_HOOKS; i++) {
17ed13a3 3419 if (all || strcmp(k, lxchook_names[i]) == 0) {
9ebb03ad 3420 lxc_list_for_each_safe(it, &c->hooks[i], next) {
17ed13a3
SH		 3421 lxc_list_del(it);
3422 free(it->elem);
3423 free(it);
3424 }
3425 done = true;
72d0e1cb
SG		 3426 }
3427 }
17ed13a3
SH		 3428
3429 if (!done) {
3430 ERROR("Invalid hook key: %s", key);
3431 return -1;
3432 }
72d0e1cb
SG		 3433 return 0;
3434}
8eb5694b 3435
4184c3e1
SH		 3436static inline void lxc_clear_aliens(struct lxc_conf *conf)
3437{
3438 struct lxc_list *it,*next;
3439
3440 lxc_list_for_each_safe(it, &conf->aliens, next) {
3441 lxc_list_del(it);
3442 free(it->elem);
3443 free(it);
3444 }
3445}
3446
c7b15d1e 3447void lxc_clear_includes(struct lxc_conf *conf)
f979ac15
SH		 3448{
3449 struct lxc_list *it,*next;
3450
3451 lxc_list_for_each_safe(it, &conf->includes, next) {
3452 lxc_list_del(it);
3453 free(it->elem);
3454 free(it);
3455 }
3456}
3457
8eb5694b
SH		 3458void lxc_conf_free(struct lxc_conf *conf)
3459{
3460 if (!conf)
3461 return;
858377e4
SH		 3462 if (current_config == conf)
3463 current_config = NULL;
f10fad2f
ME		 3464 free(conf->console.log_path);
3465 free(conf->console.path);
28f3b1cd 3466 if (conf->console.buffer_size > 0 && conf->console.ringbuf.addr)
732375f5 3467 lxc_ringbuf_release(&conf->console.ringbuf);
f10fad2f 3468 free(conf->rootfs.mount);
b3b8c97f 3469 free(conf->rootfs.bdev_type);
f10fad2f
ME		 3470 free(conf->rootfs.options);
3471 free(conf->rootfs.path);
f10fad2f 3472 free(conf->logfile);
858377e4
SH		 3473 if (conf->logfd != -1)
3474 close(conf->logfd);
f10fad2f
ME		 3475 free(conf->utsname);
3476 free(conf->ttydir);
3477 free(conf->fstab);
3478 free(conf->rcfile);
5cda27c1 3479 free(conf->execute_cmd);
f10fad2f 3480 free(conf->init_cmd);
6b0d5538 3481 free(conf->unexpanded_config);
393903d1 3482 free(conf->pty_names);
76d0127f 3483 free(conf->syslog);
c302b476 3484 lxc_free_networks(&conf->network);
f10fad2f
ME		 3485 free(conf->lsm_aa_profile);
3486 free(conf->lsm_se_context);
769872f9 3487 lxc_seccomp_free(conf);
8eb5694b 3488 lxc_clear_config_caps(conf);
1fb86a7c 3489 lxc_clear_config_keepcaps(conf);
8eb5694b 3490 lxc_clear_cgroups(conf, "lxc.cgroup");
17ed13a3 3491 lxc_clear_hooks(conf, "lxc.hook");
8eb5694b 3492 lxc_clear_mount_entries(conf);
27c27d73 3493 lxc_clear_idmaps(conf);
ee1e7aa0 3494 lxc_clear_groups(conf);
f979ac15 3495 lxc_clear_includes(conf);
761d81ca 3496 lxc_clear_aliens(conf);
ab799c0b 3497 lxc_clear_environment(conf);
240d4b74 3498 lxc_clear_limits(conf, "lxc.prlimit");
43654d34
CB		 3499 free(conf->cgroup_meta.dir);
3500 free(conf->cgroup_meta.controllers);
8eb5694b
SH		 3501 free(conf);
3502}
4355ab5f
SH		 3503
3504struct userns_fn_data {
3505 int (*fn)(void *);
c9b7c33e 3506 const char *fn_name;
4355ab5f
SH		 3507 void *arg;
3508 int p[2];
3509};
3510
3511static int run_userns_fn(void *data)
3512{
3513 struct userns_fn_data *d = data;
3514 char c;
4355ab5f 3515
f8aa4bf3 3516 /* Close write end of the pipe. */
4355ab5f 3517 close(d->p[1]);
f8aa4bf3
CB		 3518
3519 /* Wait for parent to finish establishing a new mapping in the user
3520 * namespace we are executing in.
3521 */
4355ab5f
SH		 3522 if (read(d->p[0], &c, 1) != 1)
3523 return -1;
f8aa4bf3
CB		 3524
3525 /* Close read end of the pipe. */
4355ab5f 3526 close(d->p[0]);
f8aa4bf3 3527
c9b7c33e
CB		 3528 if (d->fn_name)
3529 TRACE("calling function \"%s\"", d->fn_name);
f8aa4bf3 3530 /* Call function to run. */
4355ab5f
SH		 3531 return d->fn(d->arg);
3532}
3533
339efad9 3534static struct id_map *mapped_hostid_entry(struct lxc_conf *conf, unsigned id,
f8aa4bf3
CB		 3535 enum idtype idtype)
3536{
3537 struct lxc_list *it;
3538 struct id_map *map;
3539 struct id_map *retmap = NULL;
3540
3541 lxc_list_for_each(it, &conf->id_map) {
3542 map = it->elem;
3543 if (map->idtype != idtype)
3544 continue;
3545
3546 if (id >= map->hostid && id < map->hostid + map->range) {
3547 retmap = map;
3548 break;
3549 }
3550 }
3551
3552 if (!retmap)
3553 return NULL;
3554
3555 retmap = malloc(sizeof(*retmap));
3556 if (!retmap)
3557 return NULL;
3558
3559 memcpy(retmap, map, sizeof(*retmap));
3560 return retmap;
3561}
3562
4355ab5f 3563/*
f8aa4bf3
CB		 3564 * Allocate a new {g,u}id mapping for the given {g,u}id. Re-use an already
3565 * existing one or establish a new one.
4355ab5f 3566 */
28a2d9e7 3567static struct id_map *idmap_add(struct lxc_conf *conf, uid_t id, enum idtype type)
4355ab5f 3568{
28a2d9e7 3569 int hostid_mapped;
f8aa4bf3 3570 struct id_map *entry = NULL;
f8aa4bf3 3571
28a2d9e7
CB		 3572 /* Reuse existing mapping. */
3573 entry = mapped_hostid_entry(conf, id, type);
3574 if (entry)
3575 return entry;
f8aa4bf3 3576
28a2d9e7
CB		 3577 /* Find new mapping. */
3578 hostid_mapped = find_unmapped_nsid(conf, type);
3579 if (hostid_mapped < 0) {
3580 DEBUG("failed to find free mapping for id %d", id);
3581 return NULL;
f8aa4bf3 3582 }
f8aa4bf3 3583
28a2d9e7
CB		 3584 entry = malloc(sizeof(*entry));
3585 if (!entry)
3586 return NULL;
4355ab5f 3587
28a2d9e7
CB		 3588 entry->idtype = type;
3589 entry->nsid = hostid_mapped;
3590 entry->hostid = (unsigned long)id;
3591 entry->range = 1;
4355ab5f 3592
28a2d9e7 3593 return entry;
4355ab5f
SH		 3594}
3595
f8aa4bf3
CB		 3596/* Run a function in a new user namespace.
3597 * The caller's euid/egid will be mapped if it is not already.
3598 * Afaict, userns_exec_1() is only used to operate based on privileges for the
3599 * user's own {g,u}id on the host and for the container root's unmapped {g,u}id.
3600 * This means we require only to establish a mapping from:
3601 * - the container root {g,u}id as seen from the host > user's host {g,u}id
3602 * - the container root -> some sub{g,u}id
3603 * The former we add, if the user did not specifiy a mapping. The latter we
3604 * retrieve from the ontainer's configured {g,u}id mappings as it must have been
3605 * there to start the container in the first place.
4355ab5f 3606 */
c9b7c33e
CB		 3607int userns_exec_1(struct lxc_conf *conf, int (*fn)(void *), void *data,
3608 const char *fn_name)
4355ab5f 3609{
f8aa4bf3
CB		 3610 pid_t pid;
3611 uid_t euid, egid;
4355ab5f 3612 struct userns_fn_data d;
4355ab5f 3613 int p[2];
f8aa4bf3
CB		 3614 struct lxc_list *it;
3615 struct id_map *map;
3616 char c = '1';
686dd5d1 3617 int ret = -1, status = -1;
f8aa4bf3 3618 struct lxc_list *idmap = NULL, *tmplist = NULL;
28a2d9e7
CB		 3619 struct id_map *container_root_uid = NULL, *container_root_gid = NULL,
3620 *host_uid_map = NULL, *host_gid_map = NULL;
4355ab5f 3621
4355ab5f 3622 ret = pipe(p);
4355ab5f
SH		 3623 if (ret < 0) {
3624 SYSERROR("opening pipe");
3625 return -1;
3626 }
3627 d.fn = fn;
c9b7c33e 3628 d.fn_name = fn_name;
4355ab5f
SH		 3629 d.arg = data;
3630 d.p[0] = p[0];
3631 d.p[1] = p[1];
f8aa4bf3
CB		 3632
3633 /* Clone child in new user namespace. */
4355ab5f 3634 pid = lxc_clone(run_userns_fn, &d, CLONE_NEWUSER);
f8aa4bf3
CB		 3635 if (pid < 0) {
3636 ERROR("failed to clone child process in new user namespace");
3637 goto on_error;
3638 }
3639
4355ab5f 3640 close(p[0]);
4355ab5f
SH		 3641 p[0] = -1;
3642
954b7d9b
CB		 3643 euid = geteuid();
3644 egid = getegid();
3645
f8aa4bf3
CB		 3646 /* Find container root. */
3647 lxc_list_for_each(it, &conf->id_map) {
3648 map = it->elem;
3649
3650 if (map->nsid != 0)
3651 continue;
3652
3653 if (map->idtype == ID_TYPE_UID && container_root_uid == NULL) {
3654 container_root_uid = malloc(sizeof(*container_root_uid));
3655 if (!container_root_uid)
3656 goto on_error;
3657 container_root_uid->idtype = map->idtype;
3658 container_root_uid->hostid = map->hostid;
3659 container_root_uid->nsid = 0;
3660 container_root_uid->range = map->range;
954b7d9b
CB		 3661
3662 /* Check if container root mapping contains a mapping
3663 * for user's uid.
3664 */
3665 if (euid >= map->hostid && euid < map->hostid + map->range)
3666 host_uid_map = container_root_uid;
f8aa4bf3
CB		 3667 } else if (map->idtype == ID_TYPE_GID && container_root_gid == NULL) {
3668 container_root_gid = malloc(sizeof(*container_root_gid));
3669 if (!container_root_gid)
3670 goto on_error;
3671 container_root_gid->idtype = map->idtype;
3672 container_root_gid->hostid = map->hostid;
3673 container_root_gid->nsid = 0;
3674 container_root_gid->range = map->range;
954b7d9b
CB		 3675
3676 /* Check if container root mapping contains a mapping
3677 * for user's gid.
3678 */
3679 if (egid >= map->hostid && egid < map->hostid + map->range)
3680 host_gid_map = container_root_gid;
f8aa4bf3
CB		 3681 }
3682
3683 /* Found container root. */
3684 if (container_root_uid && container_root_gid)
3685 break;
3686 }
3687
3688 /* This is actually checked earlier but it can't hurt. */
3689 if (!container_root_uid || !container_root_gid) {
3690 ERROR("no mapping for container root found");
3691 goto on_error;
3692 }
3693
3694 /* Check whether the {g,u}id of the user has a mapping. */
954b7d9b 3695 if (!host_uid_map)
28a2d9e7
CB		 3696 host_uid_map = idmap_add(conf, euid, ID_TYPE_UID);
3697
954b7d9b 3698 if (!host_gid_map)
28a2d9e7
CB		 3699 host_gid_map = idmap_add(conf, egid, ID_TYPE_GID);
3700
3701 if (!host_uid_map) {
3702 DEBUG("failed to find mapping for uid %d", euid);
f8aa4bf3
CB		 3703 goto on_error;
3704 }
3705
28a2d9e7
CB		 3706 if (!host_gid_map) {
3707 DEBUG("failed to find mapping for gid %d", egid);
3708 goto on_error;
3709 }
3710
3711 /* Allocate new {g,u}id map list. */
3712 idmap = malloc(sizeof(*idmap));
3713 if (!idmap)
3714 goto on_error;
3715 lxc_list_init(idmap);
3716
f8aa4bf3
CB		 3717 /* Add container root to the map. */
3718 tmplist = malloc(sizeof(*tmplist));
3719 if (!tmplist)
3720 goto on_error;
3721 lxc_list_add_elem(tmplist, container_root_uid);
3722 lxc_list_add_tail(idmap, tmplist);
28a2d9e7 3723
1d90e064 3724 if (host_uid_map && (host_uid_map != container_root_uid)) {
28a2d9e7
CB		 3725 /* idmap will now keep track of that memory. */
3726 container_root_uid = NULL;
3727
3728 /* Add container root to the map. */
3729 tmplist = malloc(sizeof(*tmplist));
3730 if (!tmplist)
3731 goto on_error;
3732 lxc_list_add_elem(tmplist, host_uid_map);
3733 lxc_list_add_tail(idmap, tmplist);
28a2d9e7 3734 }
1d90e064
CB		 3735 /* idmap will now keep track of that memory. */
3736 container_root_uid = NULL;
3737 /* idmap will now keep track of that memory. */
3738 host_uid_map = NULL;
f8aa4bf3
CB		 3739
3740 tmplist = malloc(sizeof(*tmplist));
3741 if (!tmplist)
3742 goto on_error;
3743 lxc_list_add_elem(tmplist, container_root_gid);
3744 lxc_list_add_tail(idmap, tmplist);
28a2d9e7 3745
1d90e064 3746 if (host_gid_map && (host_gid_map != container_root_gid)) {
28a2d9e7
CB		 3747 /* idmap will now keep track of that memory. */
3748 container_root_gid = NULL;
3749
3750 tmplist = malloc(sizeof(*tmplist));
3751 if (!tmplist)
3752 goto on_error;
3753 lxc_list_add_elem(tmplist, host_gid_map);
3754 lxc_list_add_tail(idmap, tmplist);
28a2d9e7 3755 }
1d90e064
CB		 3756 /* idmap will now keep track of that memory. */
3757 container_root_gid = NULL;
3758 /* idmap will now keep track of that memory. */
3759 host_gid_map = NULL;
f8aa4bf3 3760
4b73005c
CB		 3761 if (lxc_log_get_level() == LXC_LOG_LEVEL_TRACE ||
3762 conf->loglevel == LXC_LOG_LEVEL_TRACE) {
f8aa4bf3
CB		 3763 lxc_list_for_each(it, idmap) {
3764 map = it->elem;
3765 TRACE("establishing %cid mapping for \"%d\" in new "
3766 "user namespace: nsuid %lu - hostid %lu - range "
3767 "%lu",
3768 (map->idtype == ID_TYPE_UID) ? 'u' : 'g', pid,
3769 map->nsid, map->hostid, map->range);
3770 }
4355ab5f
SH		 3771 }
3772
f8aa4bf3 3773 /* Set up {g,u}id mapping for user namespace of child process. */
4355ab5f 3774 ret = lxc_map_ids(idmap, pid);
f8aa4bf3
CB		 3775 if (ret < 0) {
3776 ERROR("error setting up {g,u}id mappings for child process "
415a8851 3777 "\"%d\"", pid);
f8aa4bf3 3778 goto on_error;
4355ab5f
SH		 3779 }
3780
f8aa4bf3 3781 /* Tell child to proceed. */
4355ab5f 3782 if (write(p[1], &c, 1) != 1) {
f8aa4bf3
CB		 3783 SYSERROR("failed telling child process \"%d\" to proceed", pid);
3784 goto on_error;
4355ab5f
SH		 3785 }
3786
686dd5d1 3787on_error:
f8aa4bf3 3788 /* Wait for child to finish. */
686dd5d1
CB		 3789 if (pid > 0)
3790 status = wait_for_pid(pid);
3139aead 3791
1d90e064
CB		 3792 if (idmap)
3793 lxc_free_idmap(idmap);
3794 if (container_root_uid)
3795 free(container_root_uid);
3796 if (container_root_gid)
3797 free(container_root_gid);
3798 if (host_uid_map && (host_uid_map != container_root_uid))
3799 free(host_uid_map);
3800 if (host_gid_map && (host_gid_map != container_root_gid))
3801 free(host_gid_map);
3139aead 3802
4355ab5f
SH		 3803 if (p[0] != -1)
3804 close(p[0]);
3805 close(p[1]);
f8aa4bf3 3806
686dd5d1
CB		 3807 if (status < 0)
3808 ret = -1;
3809
f8aa4bf3 3810 return ret;
4355ab5f 3811}
97e9cfa0 3812
415a8851
CB		 3813int userns_exec_full(struct lxc_conf *conf, int (*fn)(void *), void *data,
3814 const char *fn_name)
3815{
3816 pid_t pid;
3817 uid_t euid, egid;
3818 struct userns_fn_data d;
3819 int p[2];
3820 struct id_map *map;
3821 struct lxc_list *cur;
3822 char c = '1';
3823 int ret = -1;
3824 struct lxc_list *idmap = NULL, *tmplist = NULL;
3825 struct id_map *container_root_uid = NULL, *container_root_gid = NULL,
3826 *host_uid_map = NULL, *host_gid_map = NULL;
3827
3828 ret = pipe(p);
3829 if (ret < 0) {
3830 SYSERROR("opening pipe");
3831 return -1;
3832 }
3833 d.fn = fn;
3834 d.fn_name = fn_name;
3835 d.arg = data;
3836 d.p[0] = p[0];
3837 d.p[1] = p[1];
3838
3839 /* Clone child in new user namespace. */
3840 pid = lxc_clone(run_userns_fn, &d, CLONE_NEWUSER);
3841 if (pid < 0) {
3842 ERROR("failed to clone child process in new user namespace");
3843 goto on_error;
3844 }
3845
3846 close(p[0]);
3847 p[0] = -1;
3848
3849 euid = geteuid();
3850 egid = getegid();
3851
3852 /* Allocate new {g,u}id map list. */
3853 idmap = malloc(sizeof(*idmap));
3854 if (!idmap)
3855 goto on_error;
3856 lxc_list_init(idmap);
3857
3858 /* Find container root. */
3859 lxc_list_for_each(cur, &conf->id_map) {
3860 struct id_map *tmpmap;
3861
3862 tmplist = malloc(sizeof(*tmplist));
3863 if (!tmplist)
3864 goto on_error;
3865
3866 tmpmap = malloc(sizeof(*tmpmap));
3867 if (!tmpmap) {
3868 free(tmplist);
3869 goto on_error;
3870 }
3871
3872 memset(tmpmap, 0, sizeof(*tmpmap));
3873 memcpy(tmpmap, cur->elem, sizeof(*tmpmap));
3874 tmplist->elem = tmpmap;
3875
3876 lxc_list_add_tail(idmap, tmplist);
3877
3878 map = cur->elem;
3879
3880 if (map->idtype == ID_TYPE_UID)
3881 if (euid >= map->hostid && euid < map->hostid + map->range)
3882 host_uid_map = map;
3883
3884 if (map->idtype == ID_TYPE_GID)
3885 if (egid >= map->hostid && egid < map->hostid + map->range)
3886 host_gid_map = map;
3887
3888 if (map->nsid != 0)
3889 continue;
3890
3891 if (map->idtype == ID_TYPE_UID)
3892 if (container_root_uid == NULL)
3893 container_root_uid = map;
3894
3895 if (map->idtype == ID_TYPE_GID)
3896 if (container_root_gid == NULL)
3897 container_root_gid = map;
3898 }
3899
3900 if (!container_root_uid || !container_root_gid) {
3901 ERROR("No mapping for container root found");
3902 goto on_error;
3903 }
3904
3905 /* Check whether the {g,u}id of the user has a mapping. */
3906 if (!host_uid_map)
3907 host_uid_map = idmap_add(conf, euid, ID_TYPE_UID);
3908 else
3909 host_uid_map = container_root_uid;
3910
3911 if (!host_gid_map)
3912 host_gid_map = idmap_add(conf, egid, ID_TYPE_GID);
3913 else
3914 host_gid_map = container_root_gid;
3915
3916 if (!host_uid_map) {
3917 DEBUG("Failed to find mapping for uid %d", euid);
3918 goto on_error;
3919 }
3920
3921 if (!host_gid_map) {
3922 DEBUG("Failed to find mapping for gid %d", egid);
3923 goto on_error;
3924 }
3925
3926 if (host_uid_map && (host_uid_map != container_root_uid)) {
3927 /* Add container root to the map. */
3928 tmplist = malloc(sizeof(*tmplist));
3929 if (!tmplist)
3930 goto on_error;
3931 lxc_list_add_elem(tmplist, host_uid_map);
3932 lxc_list_add_tail(idmap, tmplist);
3933 }
3934 /* idmap will now keep track of that memory. */
3935 host_uid_map = NULL;
3936
3937 if (host_gid_map && (host_gid_map != container_root_gid)) {
3938 tmplist = malloc(sizeof(*tmplist));
3939 if (!tmplist)
3940 goto on_error;
3941 lxc_list_add_elem(tmplist, host_gid_map);
3942 lxc_list_add_tail(idmap, tmplist);
3943 }
3944 /* idmap will now keep track of that memory. */
3945 host_gid_map = NULL;
3946
3947 if (lxc_log_get_level() == LXC_LOG_LEVEL_TRACE ||
3948 conf->loglevel == LXC_LOG_LEVEL_TRACE) {
3949 lxc_list_for_each(cur, idmap) {
3950 map = cur->elem;
3951 TRACE("establishing %cid mapping for \"%d\" in new "
3952 "user namespace: nsuid %lu - hostid %lu - range "
3953 "%lu",
3954 (map->idtype == ID_TYPE_UID) ? 'u' : 'g', pid,
3955 map->nsid, map->hostid, map->range);
3956 }
3957 }
3958
3959 /* Set up {g,u}id mapping for user namespace of child process. */
3960 ret = lxc_map_ids(idmap, pid);
3961 if (ret < 0) {
3962 ERROR("error setting up {g,u}id mappings for child process "
3963 "\"%d\"", pid);
3964 goto on_error;
3965 }
3966
3967 /* Tell child to proceed. */
3968 if (write(p[1], &c, 1) != 1) {
3969 SYSERROR("failed telling child process \"%d\" to proceed", pid);
3970 goto on_error;
3971 }
3972
686dd5d1 3973on_error:
415a8851 3974 /* Wait for child to finish. */
686dd5d1
CB		 3975 if (pid > 0)
3976 ret = wait_for_pid(pid);
415a8851 3977
415a8851
CB		 3978 if (idmap)
3979 lxc_free_idmap(idmap);
3980 if (host_uid_map && (host_uid_map != container_root_uid))
3981 free(host_uid_map);
3982 if (host_gid_map && (host_gid_map != container_root_gid))
3983 free(host_gid_map);
3984
3985 if (p[0] != -1)
3986 close(p[0]);
3987 close(p[1]);
3988
3989 return ret;
3990}
3991
a96a8e8c 3992/* not thread-safe, do not use from api without first forking */
97e9cfa0
SH		 3993static char* getuname(void)
3994{
a96a8e8c 3995 struct passwd *result;
97e9cfa0 3996
a96a8e8c
SH		 3997 result = getpwuid(geteuid());
3998 if (!result)
97e9cfa0
SH		 3999 return NULL;
4000
a96a8e8c 4001 return strdup(result->pw_name);
97e9cfa0
SH		 4002}
4003
a96a8e8c 4004/* not thread-safe, do not use from api without first forking */
97e9cfa0
SH		 4005static char *getgname(void)
4006{
a96a8e8c 4007 struct group *result;
97e9cfa0 4008
a96a8e8c
SH		 4009 result = getgrgid(getegid());
4010 if (!result)
97e9cfa0
SH		 4011 return NULL;
4012
a96a8e8c 4013 return strdup(result->gr_name);
97e9cfa0
SH		 4014}
4015
a96a8e8c 4016/* not thread-safe, do not use from api without first forking */
97e9cfa0
SH		 4017void suggest_default_idmap(void)
4018{
4019 FILE *f;
4020 unsigned int uid = 0, urange = 0, gid = 0, grange = 0;
4021 char *line = NULL;
4022 char *uname, *gname;
4023 size_t len = 0;
4024
4025 if (!(uname = getuname()))
4026 return;
4027
4028 if (!(gname = getgname())) {
4029 free(uname);
4030 return;
4031 }
4032
4033 f = fopen(subuidfile, "r");
4034 if (!f) {
4035 ERROR("Your system is not configured with subuids");
4036 free(gname);
4037 free(uname);
4038 return;
4039 }
4040 while (getline(&line, &len, f) != -1) {
b7930180 4041 size_t no_newline = 0;
97e9cfa0
SH		 4042 char *p = strchr(line, ':'), *p2;
4043 if (*line == '#')
4044 continue;
4045 if (!p)
4046 continue;
4047 *p = '\0';
4048 p++;
4049 if (strcmp(line, uname))
4050 continue;
4051 p2 = strchr(p, ':');
4052 if (!p2)
4053 continue;
4054 *p2 = '\0';
4055 p2++;
4056 if (!*p2)
4057 continue;
b7930180
CB		 4058 no_newline = strcspn(p2, "\n");
4059 p2[no_newline] = '\0';
4060
b7b2fde4
CB		 4061 if (lxc_safe_uint(p, &uid) < 0)
4062 WARN("Could not parse UID.");
4063 if (lxc_safe_uint(p2, &urange) < 0)
4064 WARN("Could not parse UID range.");
97e9cfa0
SH		 4065 }
4066 fclose(f);
4067
6be7389a 4068 f = fopen(subgidfile, "r");
97e9cfa0
SH		 4069 if (!f) {
4070 ERROR("Your system is not configured with subgids");
4071 free(gname);
4072 free(uname);
4073 return;
4074 }
4075 while (getline(&line, &len, f) != -1) {
b7930180 4076 size_t no_newline = 0;
97e9cfa0
SH		 4077 char *p = strchr(line, ':'), *p2;
4078 if (*line == '#')
4079 continue;
4080 if (!p)
4081 continue;
4082 *p = '\0';
4083 p++;
4084 if (strcmp(line, uname))
4085 continue;
4086 p2 = strchr(p, ':');
4087 if (!p2)
4088 continue;
4089 *p2 = '\0';
4090 p2++;
4091 if (!*p2)
4092 continue;
b7930180
CB		 4093 no_newline = strcspn(p2, "\n");
4094 p2[no_newline] = '\0';
4095
b7b2fde4
CB		 4096 if (lxc_safe_uint(p, &gid) < 0)
4097 WARN("Could not parse GID.");
4098 if (lxc_safe_uint(p2, &grange) < 0)
4099 WARN("Could not parse GID range.");
97e9cfa0
SH		 4100 }
4101 fclose(f);
4102
f10fad2f 4103 free(line);
97e9cfa0
SH		 4104
4105 if (!urange || !grange) {
4106 ERROR("You do not have subuids or subgids allocated");
4107 ERROR("Unprivileged containers require subuids and subgids");
4108 return;
4109 }
4110
4111 ERROR("You must either run as root, or define uid mappings");
4112 ERROR("To pass uid mappings to lxc-create, you could create");
4113 ERROR("~/.config/lxc/default.conf:");
4114 ERROR("lxc.include = %s", LXC_DEFAULT_CONFIG);
bdcbb6b3
CB		 4115 ERROR("lxc.idmap = u 0 %u %u", uid, urange);
4116 ERROR("lxc.idmap = g 0 %u %u", gid, grange);
97e9cfa0
SH		 4117
4118 free(gname);
4119 free(uname);
4120}
aaf26830 4121
a7307747
SH		 4122static void free_cgroup_settings(struct lxc_list *result)
4123{
4124 struct lxc_list *iterator, *next;
4125
4126 lxc_list_for_each_safe(iterator, result, next) {
4127 lxc_list_del(iterator);
4128 free(iterator);
4129 }
4130 free(result);
4131}
4132
aaf26830
KT		 4133/*
4134 * Return the list of cgroup_settings sorted according to the following rules
4135 * 1. Put memory.limit_in_bytes before memory.memsw.limit_in_bytes
4136 */
4137struct lxc_list *sort_cgroup_settings(struct lxc_list* cgroup_settings)
4138{
4139 struct lxc_list *result;
4140 struct lxc_list *memsw_limit = NULL;
4141 struct lxc_list *it = NULL;
4142 struct lxc_cgroup *cg = NULL;
4143 struct lxc_list *item = NULL;
4144
4145 result = malloc(sizeof(*result));
fac7c663
KT		 4146 if (!result) {
4147 ERROR("failed to allocate memory to sort cgroup settings");
4148 return NULL;
4149 }
aaf26830
KT		 4150 lxc_list_init(result);
4151
4152 /*Iterate over the cgroup settings and copy them to the output list*/
4153 lxc_list_for_each(it, cgroup_settings) {
4154 item = malloc(sizeof(*item));
fac7c663
KT		 4155 if (!item) {
4156 ERROR("failed to allocate memory to sort cgroup settings");
a7307747 4157 free_cgroup_settings(result);
fac7c663
KT		 4158 return NULL;
4159 }
aaf26830
KT		 4160 item->elem = it->elem;
4161 cg = it->elem;
4162 if (strcmp(cg->subsystem, "memory.memsw.limit_in_bytes") == 0) {
4163 /* Store the memsw_limit location */
4164 memsw_limit = item;
4165 } else if (strcmp(cg->subsystem, "memory.limit_in_bytes") == 0 && memsw_limit != NULL) {
4d5b72a1 4166 /* lxc.cgroup.memory.memsw.limit_in_bytes is found before
aaf26830
KT		 4167 * lxc.cgroup.memory.limit_in_bytes, swap these two items */
4168 item->elem = memsw_limit->elem;
4169 memsw_limit->elem = it->elem;
4170 }
4171 lxc_list_add_tail(result, item);
4172 }
4173
4174 return result;
a7307747 4175}
LXC mirror