]> git.proxmox.com Git - mirror_lxc.git/blame - src/lxc/conf.c
projects / mirror_lxc.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
storage: constify where possible
[mirror_lxc.git] / src / lxc / conf.c
CommitLineData
0ad19a3f 1/*
2 * lxc: linux Container library
3 *
4 * (C) Copyright IBM Corp. 2007, 2008
5 *
6 * Authors:
9afe19d6 7 * Daniel Lezcano <daniel.lezcano at free.fr>
0ad19a3f 8 *
9 * This library is free software; you can redistribute it and/or
10 * modify it under the terms of the GNU Lesser General Public
11 * License as published by the Free Software Foundation; either
12 * version 2.1 of the License, or (at your option) any later version.
13 *
14 * This library is distributed in the hope that it will be useful,
15 * but WITHOUT ANY WARRANTY; without even the implied warranty of
16 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
17 * Lesser General Public License for more details.
18 *
19 * You should have received a copy of the GNU Lesser General Public
20 * License along with this library; if not, write to the Free Software
250b1eec 21 * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
0ad19a3f 22 */
1d52bdf7
CB		 23
24#define _GNU_SOURCE
d06245b8
NC		 25#include "config.h"
26
8f3e280e
CB		 27#include <dirent.h>
28#include <errno.h>
29#include <fcntl.h>
30#include <grp.h>
31#include <inttypes.h>
32#include <libgen.h>
33#include <pwd.h>
34#include <stdarg.h>
0ad19a3f 35#include <stdio.h>
0ad19a3f 36#include <stdlib.h>
0ad19a3f 37#include <string.h>
8f3e280e 38#include <time.h>
0ad19a3f 39#include <unistd.h>
8f3e280e
CB		 40#include <arpa/inet.h>
41#include <linux/loop.h>
8f3e280e
CB		 42#include <net/if.h>
43#include <netinet/in.h>
44#include <sys/mman.h>
45#include <sys/mount.h>
46#include <sys/param.h>
47#include <sys/prctl.h>
48#include <sys/stat.h>
49#include <sys/socket.h>
ce831b3b 50#include <sys/sysmacros.h>
2d76d1d7 51#include <sys/syscall.h>
97e9cfa0 52#include <sys/types.h>
8f3e280e
CB		 53#include <sys/utsname.h>
54#include <sys/wait.h>
1d52bdf7 55
af6824fc
ST		 56/* makedev() */
57#ifdef MAJOR_IN_MKDEV
58# include <sys/mkdev.h>
59#endif
af6824fc 60
614305f3 61#ifdef HAVE_STATVFS
2938f7c8 62#include <sys/statvfs.h>
614305f3 63#endif
e827ff7e
SG		 64
65#if HAVE_PTY_H
b0a33c1e 66#include <pty.h>
e827ff7e
SG		 67#else
68#include <../include/openpty.h>
69#endif
0ad19a3f 70
e8bd4e43 71#include "af_unix.h"
8f3e280e
CB		 72#include "caps.h" /* for lxc_caps_last_cap() */
73#include "cgroup.h"
1b09f2c0 74#include "conf.h"
1ed6ba91 75#include "confile_utils.h"
8f3e280e 76#include "error.h"
1b09f2c0 77#include "log.h"
025ed0f3 78#include "lxclock.h"
8f3e280e 79#include "lxcseccomp.h"
4355ab5f 80#include "namespace.h"
8f3e280e
CB		 81#include "network.h"
82#include "parse.h"
732375f5 83#include "ringbuf.h"
28d832c4
CB		 84#include "storage.h"
85#include "storage/aufs.h"
86#include "storage/overlay.h"
8f3e280e 87#include "utils.h"
fe4de9a6 88#include "lsm/lsm.h"
d0a36f2c 89
e37dda71 90#if HAVE_LIBCAP
495d2046
SG		 91#include <sys/capability.h>
92#endif
93
6ff05e18
SG		 94#if HAVE_SYS_PERSONALITY_H
95#include <sys/personality.h>
96#endif
97
edaf8b1b
SG		 98#if IS_BIONIC
99#include <../include/lxcmntent.h>
100#else
101#include <mntent.h>
102#endif
103
f48b5fd8
FF		 104#if !defined(HAVE_PRLIMIT) && defined(HAVE_PRLIMIT64)
105#include <../include/prlimit.h>
106#endif
107
36eb9bde 108lxc_log_define(lxc_conf, lxc);
e5bda9ee 109
2d76d1d7
SG		 110/* Define pivot_root() if missing from the C library */
111#ifndef HAVE_PIVOT_ROOT
112static int pivot_root(const char * new_root, const char * put_old)
113{
114#ifdef __NR_pivot_root
8f3e280e 115 return syscall(__NR_pivot_root, new_root, put_old);
2d76d1d7 116#else
8f3e280e
CB		 117 errno = ENOSYS;
118 return -1;
2d76d1d7
SG		 119#endif
120}
121#else
122extern int pivot_root(const char * new_root, const char * put_old);
123#endif
124
125/* Define sethostname() if missing from the C library */
126#ifndef HAVE_SETHOSTNAME
127static int sethostname(const char * name, size_t len)
128{
129#ifdef __NR_sethostname
8f3e280e 130 return syscall(__NR_sethostname, name, len);
2d76d1d7 131#else
8f3e280e
CB		 132 errno = ENOSYS;
133 return -1;
2d76d1d7
SG		 134#endif
135}
136#endif
137
ecec0126
SG		 138#ifndef MS_PRIVATE
139#define MS_PRIVATE (1<<18)
140#endif
141
8912711c
CB		 142#ifndef MS_LAZYTIME
143#define MS_LAZYTIME (1<<25)
144#endif
145
2b9ae35a
CB		 146char *lxchook_names[NUM_LXC_HOOKS] = {"pre-start", "pre-mount", "mount",
147 "autodev", "start", "stop",
08dd2805
SH		 148 "post-stop", "clone", "destroy",
149 "start-host"};
72d0e1cb 150
998ac676
RT		 151struct mount_opt {
152 char *name;
153 int clear;
154 int flag;
155};
156
81810dd1
DL		 157struct caps_opt {
158 char *name;
159 int value;
160};
161
c6d09e15
WB		 162struct limit_opt {
163 char *name;
164 int value;
165};
166
858377e4
SH		 167/*
168 * The lxc_conf of the container currently being worked on in an
169 * API call
170 * This is used in the error calls
171 */
172#ifdef HAVE_TLS
173__thread struct lxc_conf *current_config;
174#else
175struct lxc_conf *current_config;
176#endif
177
998ac676 178static struct mount_opt mount_opt[] = {
470b359b
CB		 179 { "async", 1, MS_SYNCHRONOUS },
180 { "atime", 1, MS_NOATIME },
181 { "bind", 0, MS_BIND },
88d413d5 182 { "defaults", 0, 0 },
88d413d5 183 { "dev", 1, MS_NODEV },
470b359b 184 { "diratime", 1, MS_NODIRATIME },
88d413d5 185 { "dirsync", 0, MS_DIRSYNC },
470b359b 186 { "exec", 1, MS_NOEXEC },
8912711c 187 { "lazytime", 0, MS_LAZYTIME },
88d413d5 188 { "mand", 0, MS_MANDLOCK },
88d413d5 189 { "noatime", 0, MS_NOATIME },
470b359b 190 { "nodev", 0, MS_NODEV },
88d413d5 191 { "nodiratime", 0, MS_NODIRATIME },
470b359b
CB		 192 { "noexec", 0, MS_NOEXEC },
193 { "nomand", 1, MS_MANDLOCK },
194 { "norelatime", 1, MS_RELATIME },
195 { "nostrictatime", 1, MS_STRICTATIME },
196 { "nosuid", 0, MS_NOSUID },
88d413d5
SW		 197 { "rbind", 0, MS_BIND|MS_REC },
198 { "relatime", 0, MS_RELATIME },
470b359b
CB		 199 { "remount", 0, MS_REMOUNT },
200 { "ro", 0, MS_RDONLY },
201 { "rw", 1, MS_RDONLY },
88d413d5 202 { "strictatime", 0, MS_STRICTATIME },
470b359b
CB		 203 { "suid", 1, MS_NOSUID },
204 { "sync", 0, MS_SYNCHRONOUS },
88d413d5 205 { NULL, 0, 0 },
998ac676
RT		 206};
207
e37dda71 208#if HAVE_LIBCAP
81810dd1 209static struct caps_opt caps_opt[] = {
a6afdde9 210 { "chown", CAP_CHOWN },
1e11be34
DL		 211 { "dac_override", CAP_DAC_OVERRIDE },
212 { "dac_read_search", CAP_DAC_READ_SEARCH },
213 { "fowner", CAP_FOWNER },
214 { "fsetid", CAP_FSETID },
81810dd1
DL		 215 { "kill", CAP_KILL },
216 { "setgid", CAP_SETGID },
217 { "setuid", CAP_SETUID },
218 { "setpcap", CAP_SETPCAP },
219 { "linux_immutable", CAP_LINUX_IMMUTABLE },
220 { "net_bind_service", CAP_NET_BIND_SERVICE },
221 { "net_broadcast", CAP_NET_BROADCAST },
222 { "net_admin", CAP_NET_ADMIN },
223 { "net_raw", CAP_NET_RAW },
224 { "ipc_lock", CAP_IPC_LOCK },
225 { "ipc_owner", CAP_IPC_OWNER },
226 { "sys_module", CAP_SYS_MODULE },
227 { "sys_rawio", CAP_SYS_RAWIO },
228 { "sys_chroot", CAP_SYS_CHROOT },
229 { "sys_ptrace", CAP_SYS_PTRACE },
230 { "sys_pacct", CAP_SYS_PACCT },
231 { "sys_admin", CAP_SYS_ADMIN },
232 { "sys_boot", CAP_SYS_BOOT },
233 { "sys_nice", CAP_SYS_NICE },
234 { "sys_resource", CAP_SYS_RESOURCE },
235 { "sys_time", CAP_SYS_TIME },
236 { "sys_tty_config", CAP_SYS_TTY_CONFIG },
237 { "mknod", CAP_MKNOD },
238 { "lease", CAP_LEASE },
57b837e2
CB		 239#ifdef CAP_AUDIT_READ
240 { "audit_read", CAP_AUDIT_READ },
241#endif
9527e566 242#ifdef CAP_AUDIT_WRITE
81810dd1 243 { "audit_write", CAP_AUDIT_WRITE },
9527e566
FW		 244#endif
245#ifdef CAP_AUDIT_CONTROL
81810dd1 246 { "audit_control", CAP_AUDIT_CONTROL },
9527e566 247#endif
81810dd1
DL		 248 { "setfcap", CAP_SETFCAP },
249 { "mac_override", CAP_MAC_OVERRIDE },
250 { "mac_admin", CAP_MAC_ADMIN },
5170c716
CS		 251#ifdef CAP_SYSLOG
252 { "syslog", CAP_SYSLOG },
253#endif
254#ifdef CAP_WAKE_ALARM
255 { "wake_alarm", CAP_WAKE_ALARM },
256#endif
2b54359b
CB		 257#ifdef CAP_BLOCK_SUSPEND
258 { "block_suspend", CAP_BLOCK_SUSPEND },
259#endif
81810dd1 260};
495d2046
SG		 261#else
262static struct caps_opt caps_opt[] = {};
263#endif
81810dd1 264
c6d09e15
WB		 265static struct limit_opt limit_opt[] = {
266#ifdef RLIMIT_AS
267 { "as", RLIMIT_AS },
268#endif
269#ifdef RLIMIT_CORE
270 { "core", RLIMIT_CORE },
271#endif
272#ifdef RLIMIT_CPU
273 { "cpu", RLIMIT_CPU },
274#endif
275#ifdef RLIMIT_DATA
276 { "data", RLIMIT_DATA },
277#endif
278#ifdef RLIMIT_FSIZE
279 { "fsize", RLIMIT_FSIZE },
280#endif
281#ifdef RLIMIT_LOCKS
282 { "locks", RLIMIT_LOCKS },
283#endif
284#ifdef RLIMIT_MEMLOCK
285 { "memlock", RLIMIT_MEMLOCK },
286#endif
287#ifdef RLIMIT_MSGQUEUE
288 { "msgqueue", RLIMIT_MSGQUEUE },
289#endif
290#ifdef RLIMIT_NICE
291 { "nice", RLIMIT_NICE },
292#endif
293#ifdef RLIMIT_NOFILE
294 { "nofile", RLIMIT_NOFILE },
295#endif
296#ifdef RLIMIT_NPROC
297 { "nproc", RLIMIT_NPROC },
298#endif
299#ifdef RLIMIT_RSS
300 { "rss", RLIMIT_RSS },
301#endif
302#ifdef RLIMIT_RTPRIO
303 { "rtprio", RLIMIT_RTPRIO },
304#endif
305#ifdef RLIMIT_RTTIME
306 { "rttime", RLIMIT_RTTIME },
307#endif
308#ifdef RLIMIT_SIGPENDING
309 { "sigpending", RLIMIT_SIGPENDING },
310#endif
311#ifdef RLIMIT_STACK
312 { "stack", RLIMIT_STACK },
313#endif
314};
315
91c3830e
SH		 316static int run_buffer(char *buffer)
317{
ebec9176 318 struct lxc_popen_FILE *f;
91c3830e 319 char *output;
8e7da691 320 int ret;
91c3830e 321
ebec9176 322 f = lxc_popen(buffer);
91c3830e 323 if (!f) {
062b72c6 324 SYSERROR("Failed to popen() %s.", buffer);
91c3830e
SH		 325 return -1;
326 }
327
328 output = malloc(LXC_LOG_BUFFER_SIZE);
329 if (!output) {
062b72c6 330 ERROR("Failed to allocate memory for %s.", buffer);
ebec9176 331 lxc_pclose(f);
91c3830e
SH		 332 return -1;
333 }
334
062b72c6
CB		 335 while (fgets(output, LXC_LOG_BUFFER_SIZE, f->f))
336 DEBUG("Script %s with output: %s.", buffer, output);
91c3830e
SH		 337
338 free(output);
339
ebec9176 340 ret = lxc_pclose(f);
8e7da691 341 if (ret == -1) {
062b72c6 342 SYSERROR("Script exited with error.");
91c3830e 343 return -1;
8e7da691 344 } else if (WIFEXITED(ret) && WEXITSTATUS(ret) != 0) {
062b72c6 345 ERROR("Script exited with status %d.", WEXITSTATUS(ret));
8e7da691
DE		 346 return -1;
347 } else if (WIFSIGNALED(ret)) {
062b72c6 348 ERROR("Script terminated by signal %d.", WTERMSIG(ret));
8e7da691 349 return -1;
91c3830e
SH		 350 }
351
352 return 0;
353}
354
148e91f5 355static int run_script_argv(const char *name, const char *section,
062b72c6
CB		 356 const char *script, const char *hook,
357 const char *lxcpath, char **argsin)
148e91f5
SH		 358{
359 int ret, i;
360 char *buffer;
361 size_t size = 0;
362
062b72c6 363 INFO("Executing script \"%s\" for container \"%s\", config section \"%s\".",
148e91f5
SH		 364 script, name, section);
365
062b72c6 366 for (i = 0; argsin && argsin[i]; i++)
148e91f5
SH		 367 size += strlen(argsin[i]) + 1;
368
369 size += strlen(hook) + 1;
370
371 size += strlen(script);
372 size += strlen(name);
373 size += strlen(section);
374 size += 3;
375
376 if (size > INT_MAX)
377 return -1;
378
379 buffer = alloca(size);
380 if (!buffer) {
062b72c6 381 ERROR("Failed to allocate memory.");
148e91f5
SH		 382 return -1;
383 }
384
062b72c6
CB		 385 ret =
386 snprintf(buffer, size, "%s %s %s %s", script, name, section, hook);
387 if (ret < 0 || (size_t)ret >= size) {
388 ERROR("Script name too long.");
148e91f5
SH		 389 return -1;
390 }
391
062b72c6
CB		 392 for (i = 0; argsin && argsin[i]; i++) {
393 int len = size - ret;
148e91f5
SH		 394 int rc;
395 rc = snprintf(buffer + ret, len, " %s", argsin[i]);
396 if (rc < 0 || rc >= len) {
062b72c6 397 ERROR("Script args too long.");
148e91f5
SH		 398 return -1;
399 }
400 ret += rc;
401 }
402
403 return run_buffer(buffer);
404}
405
811ef482 406int run_script(const char *name, const char *section, const char *script, ...)
e3b4c4c4 407{
abbfd20b 408 int ret;
91c3830e 409 char *buffer, *p;
abbfd20b
DL		 410 size_t size = 0;
411 va_list ap;
751d9dcd 412
062b72c6 413 INFO("Executing script \"%s\" for container \"%s\", config section \"%s\".",
751d9dcd 414 script, name, section);
e3b4c4c4 415
abbfd20b
DL		 416 va_start(ap, script);
417 while ((p = va_arg(ap, char *)))
95642a10 418 size += strlen(p) + 1;
abbfd20b
DL		 419 va_end(ap);
420
421 size += strlen(script);
422 size += strlen(name);
423 size += strlen(section);
95642a10 424 size += 3;
abbfd20b 425
95642a10
MS		 426 if (size > INT_MAX)
427 return -1;
428
429 buffer = alloca(size);
abbfd20b 430 if (!buffer) {
062b72c6 431 ERROR("Failed to allocate memory.");
751d9dcd
DL		 432 return -1;
433 }
434
9ba8130c
SH		 435 ret = snprintf(buffer, size, "%s %s %s", script, name, section);
436 if (ret < 0 || ret >= size) {
062b72c6 437 ERROR("Script name too long.");
9ba8130c
SH		 438 return -1;
439 }
751d9dcd 440
abbfd20b 441 va_start(ap, script);
9ba8130c 442 while ((p = va_arg(ap, char *))) {
062b72c6 443 int len = size - ret;
9ba8130c
SH		 444 int rc;
445 rc = snprintf(buffer + ret, len, " %s", p);
446 if (rc < 0 || rc >= len) {
062b72c6 447 ERROR("Script args too long.");
9ba8130c
SH		 448 return -1;
449 }
450 ret += rc;
451 }
abbfd20b 452 va_end(ap);
751d9dcd 453
91c3830e 454 return run_buffer(buffer);
e3b4c4c4
ST		 455}
456
0c547523
SH		 457/*
458 * pin_rootfs
b7ed4bf0
CS		 459 * if rootfs is a directory, then open ${rootfs}/lxc.hold for writing for
460 * the duration of the container run, to prevent the container from marking
461 * the underlying fs readonly on shutdown. unlink the file immediately so
462 * no name pollution is happens
0c547523
SH		 463 * return -1 on error.
464 * return -2 if nothing needed to be pinned.
465 * return an open fd (>=0) if we pinned it.
466 */
467int pin_rootfs(const char *rootfs)
468{
469 char absrootfs[MAXPATHLEN];
470 char absrootfspin[MAXPATHLEN];
471 struct stat s;
472 int ret, fd;
473
e99ee0de 474 if (rootfs == NULL || strlen(rootfs) == 0)
0d03360a 475 return -2;
e99ee0de 476
00ec333b 477 if (!realpath(rootfs, absrootfs))
9be53773 478 return -2;
0c547523 479
00ec333b 480 if (access(absrootfs, F_OK))
0c547523 481 return -1;
0c547523 482
00ec333b 483 if (stat(absrootfs, &s))
0c547523 484 return -1;
0c547523 485
72f919c4 486 if (!S_ISDIR(s.st_mode))
0c547523
SH		 487 return -2;
488
b7ed4bf0 489 ret = snprintf(absrootfspin, MAXPATHLEN, "%s/lxc.hold", absrootfs);
00ec333b 490 if (ret >= MAXPATHLEN)
0c547523 491 return -1;
0c547523
SH		 492
493 fd = open(absrootfspin, O_CREAT | O_RDWR, S_IWUSR|S_IRUSR);
b7ed4bf0
CS		 494 if (fd < 0)
495 return fd;
496 (void)unlink(absrootfspin);
0c547523
SH		 497 return fd;
498}
499
e2a7e8dc
SH		 500/*
501 * If we are asking to remount something, make sure that any
502 * NOEXEC etc are honored.
503 */
5ae72b98 504unsigned long add_required_remount_flags(const char *s, const char *d,
e2a7e8dc
SH		 505 unsigned long flags)
506{
614305f3 507#ifdef HAVE_STATVFS
e2a7e8dc
SH		 508 struct statvfs sb;
509 unsigned long required_flags = 0;
510
511 if (!(flags & MS_REMOUNT))
512 return flags;
513
514 if (!s)
515 s = d;
516
517 if (!s)
518 return flags;
519 if (statvfs(s, &sb) < 0)
520 return flags;
521
522 if (sb.f_flag & MS_NOSUID)
523 required_flags |= MS_NOSUID;
524 if (sb.f_flag & MS_NODEV)
525 required_flags |= MS_NODEV;
526 if (sb.f_flag & MS_RDONLY)
527 required_flags |= MS_RDONLY;
528 if (sb.f_flag & MS_NOEXEC)
529 required_flags |= MS_NOEXEC;
530
531 return flags | required_flags;
614305f3
SH		 532#else
533 return flags;
534#endif
e2a7e8dc
SH		 535}
536
4fb3cba5 537static int lxc_mount_auto_mounts(struct lxc_conf *conf, int flags, struct lxc_handler *handler)
368bbc02 538{
368bbc02 539 int r;
80e80c40 540 int i;
b06b8511
CS		 541 static struct {
542 int match_mask;
543 int match_flag;
544 const char *source;
545 const char *destination;
546 const char *fstype;
547 unsigned long flags;
548 const char *options;
549 } default_mounts[] = {
550 /* Read-only bind-mounting... In older kernels, doing that required
551 * to do one MS_BIND mount and then MS_REMOUNT|MS_RDONLY the same
552 * one. According to mount(2) manpage, MS_BIND honors MS_RDONLY from
553 * kernel 2.6.26 onwards. However, this apparently does not work on
554 * kernel 3.8. Unfortunately, on that very same kernel, doing the
555 * same trick as above doesn't seem to work either, there one needs
556 * to ALSO specify MS_BIND for the remount, otherwise the entire
557 * fs is remounted read-only or the mount fails because it's busy...
558 * MS_REMOUNT|MS_BIND|MS_RDONLY seems to work for kernels as low as
559 * 2.6.32...
368bbc02 560 */
f24a52d5 561 { LXC_AUTO_PROC_MASK, LXC_AUTO_PROC_MIXED, "proc", "%r/proc", "proc", MS_NODEV|MS_NOEXEC|MS_NOSUID, NULL },
592fd47a
SH		 562 /* proc/tty is used as a temporary placeholder for proc/sys/net which we'll move back in a few steps */
563 { LXC_AUTO_PROC_MASK, LXC_AUTO_PROC_MIXED, "%r/proc/sys/net", "%r/proc/tty", NULL, MS_BIND, NULL },
f24a52d5
SG		 564 { LXC_AUTO_PROC_MASK, LXC_AUTO_PROC_MIXED, "%r/proc/sys", "%r/proc/sys", NULL, MS_BIND, NULL },
565 { LXC_AUTO_PROC_MASK, LXC_AUTO_PROC_MIXED, NULL, "%r/proc/sys", NULL, MS_REMOUNT|MS_BIND|MS_RDONLY, NULL },
592fd47a 566 { LXC_AUTO_PROC_MASK, LXC_AUTO_PROC_MIXED, "%r/proc/tty", "%r/proc/sys/net", NULL, MS_MOVE, NULL },
f24a52d5
SG		 567 { LXC_AUTO_PROC_MASK, LXC_AUTO_PROC_MIXED, "%r/proc/sysrq-trigger", "%r/proc/sysrq-trigger", NULL, MS_BIND, NULL },
568 { LXC_AUTO_PROC_MASK, LXC_AUTO_PROC_MIXED, NULL, "%r/proc/sysrq-trigger", NULL, MS_REMOUNT|MS_BIND|MS_RDONLY, NULL },
569 { LXC_AUTO_PROC_MASK, LXC_AUTO_PROC_RW, "proc", "%r/proc", "proc", MS_NODEV|MS_NOEXEC|MS_NOSUID, NULL },
570 { LXC_AUTO_SYS_MASK, LXC_AUTO_SYS_RW, "sysfs", "%r/sys", "sysfs", 0, NULL },
571 { LXC_AUTO_SYS_MASK, LXC_AUTO_SYS_RO, "sysfs", "%r/sys", "sysfs", MS_RDONLY, NULL },
572 { LXC_AUTO_SYS_MASK, LXC_AUTO_SYS_MIXED, "sysfs", "%r/sys", "sysfs", MS_NODEV|MS_NOEXEC|MS_NOSUID, NULL },
573 { LXC_AUTO_SYS_MASK, LXC_AUTO_SYS_MIXED, "%r/sys", "%r/sys", NULL, MS_BIND, NULL },
574 { LXC_AUTO_SYS_MASK, LXC_AUTO_SYS_MIXED, NULL, "%r/sys", NULL, MS_REMOUNT|MS_BIND|MS_RDONLY, NULL },
575 { LXC_AUTO_SYS_MASK, LXC_AUTO_SYS_MIXED, "sysfs", "%r/sys/devices/virtual/net", "sysfs", 0, NULL },
576 { LXC_AUTO_SYS_MASK, LXC_AUTO_SYS_MIXED, "%r/sys/devices/virtual/net/devices/virtual/net", "%r/sys/devices/virtual/net", NULL, MS_BIND, NULL },
577 { LXC_AUTO_SYS_MASK, LXC_AUTO_SYS_MIXED, NULL, "%r/sys/devices/virtual/net", NULL, MS_REMOUNT|MS_BIND|MS_NOSUID|MS_NODEV|MS_NOEXEC, NULL },
578 { 0, 0, NULL, NULL, NULL, 0, NULL }
b06b8511 579 };
368bbc02 580
b06b8511
CS		 581 for (i = 0; default_mounts[i].match_mask; i++) {
582 if ((flags & default_mounts[i].match_mask) == default_mounts[i].match_flag) {
583 char *source = NULL;
584 char *destination = NULL;
585 int saved_errno;
e2a7e8dc 586 unsigned long mflags;
b06b8511
CS		 587
588 if (default_mounts[i].source) {
589 /* will act like strdup if %r is not present */
8ede5f4c 590 source = lxc_string_replace("%r", conf->rootfs.path ? conf->rootfs.mount : "", default_mounts[i].source);
b06b8511
CS		 591 if (!source) {
592 SYSERROR("memory allocation error");
593 return -1;
594 }
595 }
cc4fd506
SH		 596 if (!default_mounts[i].destination) {
597 ERROR("BUG: auto mounts destination %d was NULL", i);
b2f44b4d 598 free(source);
cc4fd506
SH		 599 return -1;
600 }
601 /* will act like strdup if %r is not present */
602 destination = lxc_string_replace("%r", conf->rootfs.path ? conf->rootfs.mount : "", default_mounts[i].destination);
603 if (!destination) {
604 saved_errno = errno;
605 SYSERROR("memory allocation error");
606 free(source);
607 errno = saved_errno;
608 return -1;
b06b8511 609 }
e2a7e8dc
SH		 610 mflags = add_required_remount_flags(source, destination,
611 default_mounts[i].flags);
592fd47a 612 r = safe_mount(source, destination, default_mounts[i].fstype, mflags, default_mounts[i].options, conf->rootfs.path ? conf->rootfs.mount : NULL);
b06b8511 613 saved_errno = errno;
b88ff9a0
SG		 614 if (r < 0 && errno == ENOENT) {
615 INFO("Mount source or target for %s on %s doesn't exist. Skipping.", source, destination);
616 r = 0;
617 }
618 else if (r < 0)
e2a7e8dc 619 SYSERROR("error mounting %s on %s flags %lu", source, destination, mflags);
f24a52d5 620
b06b8511
CS		 621 free(source);
622 free(destination);
623 if (r < 0) {
b06b8511
CS		 624 errno = saved_errno;
625 return -1;
626 }
368bbc02 627 }
368bbc02
CS		 628 }
629
b06b8511 630 if (flags & LXC_AUTO_CGROUP_MASK) {
0769b82a
CS		 631 int cg_flags;
632
633 cg_flags = flags & LXC_AUTO_CGROUP_MASK;
634 /* If the type of cgroup mount was not specified, it depends on the
635 * container's capabilities as to what makes sense: if we have
636 * CAP_SYS_ADMIN, the read-only part can be remounted read-write
637 * anyway, so we may as well default to read-write; then the admin
638 * will not be given a false sense of security. (And if they really
639 * want mixed r/o r/w, then they can explicitly specify :mixed.)
640 * OTOH, if the container lacks CAP_SYS_ADMIN, do only default to
641 * :mixed, because then the container can't remount it read-write. */
642 if (cg_flags == LXC_AUTO_CGROUP_NOSPEC || cg_flags == LXC_AUTO_CGROUP_FULL_NOSPEC) {
643 int has_sys_admin = 0;
b0ee5983
CB		 644
645 if (!lxc_list_empty(&conf->keepcaps))
0769b82a 646 has_sys_admin = in_caplist(CAP_SYS_ADMIN, &conf->keepcaps);
b0ee5983 647 else
0769b82a 648 has_sys_admin = !in_caplist(CAP_SYS_ADMIN, &conf->caps);
b0ee5983
CB		 649
650 if (cg_flags == LXC_AUTO_CGROUP_NOSPEC)
0769b82a 651 cg_flags = has_sys_admin ? LXC_AUTO_CGROUP_RW : LXC_AUTO_CGROUP_MIXED;
b0ee5983 652 else
0769b82a 653 cg_flags = has_sys_admin ? LXC_AUTO_CGROUP_FULL_RW : LXC_AUTO_CGROUP_FULL_MIXED;
0769b82a
CS		 654 }
655
8ede5f4c 656 if (!cgroup_mount(conf->rootfs.path ? conf->rootfs.mount : "", handler, cg_flags)) {
368bbc02 657 SYSERROR("error mounting /sys/fs/cgroup");
b06b8511 658 return -1;
368bbc02
CS		 659 }
660 }
661
368bbc02 662 return 0;
368bbc02
CS		 663}
664
4e5440c6 665static int setup_utsname(struct utsname *utsname)
0ad19a3f 666{
4e5440c6
DL		 667 if (!utsname)
668 return 0;
0ad19a3f 669
4e5440c6
DL		 670 if (sethostname(utsname->nodename, strlen(utsname->nodename))) {
671 SYSERROR("failed to set the hostname to '%s'", utsname->nodename);
0ad19a3f 672 return -1;
673 }
674
4e5440c6 675 INFO("'%s' hostname has been setup", utsname->nodename);
cd54d859 676
0ad19a3f 677 return 0;
678}
679
69aa6655
DE		 680struct dev_symlinks {
681 const char *oldpath;
682 const char *name;
683};
684
685static const struct dev_symlinks dev_symlinks[] = {
686 {"/proc/self/fd", "fd"},
687 {"/proc/self/fd/0", "stdin"},
688 {"/proc/self/fd/1", "stdout"},
689 {"/proc/self/fd/2", "stderr"},
690};
691
ed8704d0 692static int lxc_setup_dev_symlinks(const struct lxc_rootfs *rootfs)
69aa6655
DE		 693{
694 char path[MAXPATHLEN];
695 int ret,i;
09227be2 696 struct stat s;
69aa6655
DE		 697
698
699 for (i = 0; i < sizeof(dev_symlinks) / sizeof(dev_symlinks[0]); i++) {
700 const struct dev_symlinks *d = &dev_symlinks[i];
ec50007f 701 ret = snprintf(path, sizeof(path), "%s/dev/%s", rootfs->path ? rootfs->mount : "", d->name);
69aa6655
DE		 702 if (ret < 0 || ret >= MAXPATHLEN)
703 return -1;
09227be2
MW		 704
705 /*
706 * Stat the path first. If we don't get an error
707 * accept it as is and don't try to create it
708 */
709 if (!stat(path, &s)) {
710 continue;
711 }
712
69aa6655 713 ret = symlink(d->oldpath, path);
09227be2 714
69aa6655 715 if (ret && errno != EEXIST) {
09227be2
MW		 716 if ( errno == EROFS ) {
717 WARN("Warning: Read Only file system while creating %s", path);
718 } else {
719 SYSERROR("Error creating %s", path);
720 return -1;
721 }
69aa6655
DE		 722 }
723 }
724 return 0;
725}
726
2187efd3 727/* Build a space-separate list of ptys to pass to systemd. */
393903d1 728static bool append_ptyname(char **pp, char *name)
b0a33c1e 729{
393903d1
SH		 730 char *p;
731
732 if (!*pp) {
733 *pp = malloc(strlen(name) + strlen("container_ttys=") + 1);
734 if (!*pp)
735 return false;
736 sprintf(*pp, "container_ttys=%s", name);
737 return true;
738 }
739 p = realloc(*pp, strlen(*pp) + strlen(name) + 2);
740 if (!p)
741 return false;
742 *pp = p;
743 strcat(p, " ");
744 strcat(p, name);
745 return true;
746}
747
2187efd3 748static int lxc_setup_ttys(struct lxc_conf *conf)
393903d1 749{
9e1045e3 750 int i, ret;
393903d1
SH		 751 const struct lxc_tty_info *tty_info = &conf->tty_info;
752 char *ttydir = conf->ttydir;
7c6ef2a2 753 char path[MAXPATHLEN], lxcpath[MAXPATHLEN];
b0a33c1e 754
e8bd4e43 755 if (!conf->rootfs.path)
bc9bd0e3
DL		 756 return 0;
757
b0a33c1e 758 for (i = 0; i < tty_info->nbtty; i++) {
b0a33c1e 759 struct lxc_pty_info *pty_info = &tty_info->pty_info[i];
760
e8bd4e43 761 ret = snprintf(path, sizeof(path), "/dev/tty%d", i + 1);
73363c61 762 if (ret < 0 || (size_t)ret >= sizeof(path))
7c6ef2a2 763 return -1;
9e1045e3 764
7c6ef2a2
SH		 765 if (ttydir) {
766 /* create dev/lxc/tty%d" */
9e1045e3
CB		 767 ret = snprintf(lxcpath, sizeof(lxcpath),
768 "/dev/%s/tty%d", ttydir, i + 1);
73363c61 769 if (ret < 0 || (size_t)ret >= sizeof(lxcpath))
7c6ef2a2 770 return -1;
9e1045e3 771
7c6ef2a2 772 ret = creat(lxcpath, 0660);
9e1045e3 773 if (ret < 0 && errno != EEXIST) {
73363c61 774 SYSERROR("Failed to create \"%s\"", lxcpath);
7c6ef2a2
SH		 775 return -1;
776 }
4d44e274
SH		 777 if (ret >= 0)
778 close(ret);
9e1045e3 779
7c6ef2a2 780 ret = unlink(path);
9e1045e3 781 if (ret < 0 && errno != ENOENT) {
73363c61 782 SYSERROR("Failed to unlink \"%s\"", path);
7c6ef2a2
SH		 783 return -1;
784 }
b0a33c1e 785
9e1045e3
CB		 786 ret = mount(pty_info->name, lxcpath, "none", MS_BIND, 0);
787 if (ret < 0) {
73363c61 788 WARN("Failed to bind mount \"%s\" onto \"%s\"",
7c6ef2a2
SH		 789 pty_info->name, path);
790 continue;
791 }
9e1045e3
CB		 792 DEBUG("bind mounted \"%s\" onto \"%s\"", pty_info->name,
793 path);
13954cce 794
9e1045e3
CB		 795 ret = snprintf(lxcpath, sizeof(lxcpath), "%s/tty%d",
796 ttydir, i + 1);
73363c61 797 if (ret < 0 || (size_t)ret >= sizeof(lxcpath))
9ba8130c 798 return -1;
9e1045e3 799
7c6ef2a2 800 ret = symlink(lxcpath, path);
9e1045e3 801 if (ret < 0) {
73363c61 802 SYSERROR("Failed to create symlink \"%s\" -> \"%s\"",
9e1045e3 803 path, lxcpath);
7c6ef2a2
SH		 804 return -1;
805 }
806 } else {
9e1045e3
CB		 807 /* If we populated /dev, then we need to create
808 * /dev/ttyN
809 */
810 ret = access(path, F_OK);
811 if (ret < 0) {
c6883f38 812 ret = creat(path, 0660);
9e1045e3 813 if (ret < 0) {
73363c61 814 SYSERROR("Failed to create \"%s\"", path);
c6883f38 815 /* this isn't fatal, continue */
025ed0f3 816 } else {
c6883f38 817 close(ret);
025ed0f3 818 }
c6883f38 819 }
9e1045e3
CB		 820
821 ret = mount(pty_info->name, path, "none", MS_BIND, 0);
822 if (ret < 0) {
73363c61 823 SYSERROR("Failed to mount '%s'->'%s'", pty_info->name, path);
7c6ef2a2
SH		 824 continue;
825 }
9e1045e3 826
73363c61 827 DEBUG("Bind mounted \"%s\" onto \"%s\"", pty_info->name,
9e1045e3 828 path);
393903d1 829 }
9e1045e3 830
e8bd4e43 831 if (!append_ptyname(&conf->pty_names, pty_info->name)) {
393903d1
SH		 832 ERROR("Error setting up container_ttys string");
833 return -1;
b0a33c1e 834 }
835 }
836
73363c61 837 INFO("Finished setting up %d /dev/tty<N> device(s)", tty_info->nbtty);
b0a33c1e 838 return 0;
839}
840
2187efd3
CB		 841int lxc_allocate_ttys(const char *name, struct lxc_conf *conf)
842{
843 struct lxc_tty_info *tty_info = &conf->tty_info;
844 int i, ret;
845
846 /* no tty in the configuration */
847 if (!conf->tty)
848 return 0;
849
850 tty_info->pty_info = malloc(sizeof(*tty_info->pty_info) * conf->tty);
851 if (!tty_info->pty_info) {
852 SYSERROR("failed to allocate struct *pty_info");
853 return -ENOMEM;
854 }
855
856 for (i = 0; i < conf->tty; i++) {
857 struct lxc_pty_info *pty_info = &tty_info->pty_info[i];
858
859 process_lock();
860 ret = openpty(&pty_info->master, &pty_info->slave,
861 pty_info->name, NULL, NULL);
862 process_unlock();
863 if (ret) {
864 SYSERROR("failed to create pty device number %d", i);
865 tty_info->nbtty = i;
866 lxc_delete_tty(tty_info);
867 return -ENOTTY;
868 }
869
870 DEBUG("allocated pty \"%s\" with master fd %d and slave fd %d",
871 pty_info->name, pty_info->master, pty_info->slave);
872
873 /* Prevent leaking the file descriptors to the container */
874 ret = fcntl(pty_info->master, F_SETFD, FD_CLOEXEC);
875 if (ret < 0)
876 WARN("failed to set FD_CLOEXEC flag on master fd %d of "
877 "pty device \"%s\": %s",
878 pty_info->master, pty_info->name, strerror(errno));
879
880 ret = fcntl(pty_info->slave, F_SETFD, FD_CLOEXEC);
881 if (ret < 0)
882 WARN("failed to set FD_CLOEXEC flag on slave fd %d of "
883 "pty device \"%s\": %s",
884 pty_info->slave, pty_info->name, strerror(errno));
885
886 pty_info->busy = 0;
887 }
888
889 tty_info->nbtty = conf->tty;
890
891 INFO("finished allocating %d pts devices", conf->tty);
892 return 0;
893}
894
895void lxc_delete_tty(struct lxc_tty_info *tty_info)
896{
897 int i;
898
899 for (i = 0; i < tty_info->nbtty; i++) {
900 struct lxc_pty_info *pty_info = &tty_info->pty_info[i];
901
902 close(pty_info->master);
903 close(pty_info->slave);
904 }
905
906 free(tty_info->pty_info);
907 tty_info->pty_info = NULL;
908 tty_info->nbtty = 0;
909}
910
911static int lxc_send_ttys_to_parent(struct lxc_handler *handler)
912{
913 int i;
914 struct lxc_conf *conf = handler->conf;
915 struct lxc_tty_info *tty_info = &conf->tty_info;
916 int sock = handler->data_sock[0];
917 int ret = -1;
918
919 if (!conf->tty)
920 return 0;
921
922 for (i = 0; i < conf->tty; i++) {
923 int ttyfds[2];
924 struct lxc_pty_info *pty_info = &tty_info->pty_info[i];
925
926 ttyfds[0] = pty_info->master;
927 ttyfds[1] = pty_info->slave;
928
929 ret = lxc_abstract_unix_send_fds(sock, ttyfds, 2, NULL, 0);
930 if (ret < 0)
931 break;
932
933 TRACE("Send pty \"%s\" with master fd %d and slave fd %d to "
934 "parent", pty_info->name, pty_info->master, pty_info->slave);
935 }
936
937 if (ret < 0)
938 ERROR("Failed to send %d ttys to parent: %s", conf->tty,
939 strerror(errno));
940 else
941 TRACE("Sent %d ttys to parent", conf->tty);
942
943 return ret;
944}
945
946static int lxc_create_ttys(struct lxc_handler *handler)
947{
948 int ret = -1;
949 struct lxc_conf *conf = handler->conf;
950
951 ret = lxc_allocate_ttys(handler->name, conf);
952 if (ret < 0) {
953 ERROR("Failed to allocate ttys");
954 goto on_error;
955 }
956
957 ret = lxc_send_ttys_to_parent(handler);
958 if (ret < 0) {
959 ERROR("Failed to send ttys to parent");
960 goto on_error;
961 }
962
963 if (!conf->is_execute) {
964 ret = lxc_setup_ttys(conf);
965 if (ret < 0) {
966 ERROR("Failed to setup ttys");
967 goto on_error;
968 }
969 }
970
971 if (conf->pty_names) {
972 ret = setenv("container_ttys", conf->pty_names, 1);
973 if (ret < 0)
974 SYSERROR("Failed to set \"container_ttys=%s\"", conf->pty_names);
975 }
976
977 ret = 0;
978
979on_error:
980 lxc_delete_tty(&conf->tty_info);
981
982 return ret;
983}
984
59bb8698 985static int setup_rootfs_pivot_root(const char *rootfs)
bf601689 986{
2d489f9e 987 int oldroot = -1, newroot = -1;
bf601689 988
2d489f9e
SH		 989 oldroot = open("/", O_DIRECTORY | O_RDONLY);
990 if (oldroot < 0) {
991 SYSERROR("Error opening old-/ for fchdir");
9ba8130c
SH		 992 return -1;
993 }
2d489f9e
SH		 994 newroot = open(rootfs, O_DIRECTORY | O_RDONLY);
995 if (newroot < 0) {
996 SYSERROR("Error opening new-/ for fchdir");
997 goto fail;
c08556c6 998 }
bf601689 999
cc6f6dd7 1000 /* change into new root fs */
2d489f9e 1001 if (fchdir(newroot)) {
cc6f6dd7 1002 SYSERROR("can't chdir to new rootfs '%s'", rootfs);
2d489f9e 1003 goto fail;
cc6f6dd7
DL		 1004 }
1005
cc6f6dd7 1006 /* pivot_root into our new root fs */
2d489f9e 1007 if (pivot_root(".", ".")) {
cc6f6dd7 1008 SYSERROR("pivot_root syscall failed");
2d489f9e 1009 goto fail;
bf601689 1010 }
cc6f6dd7 1011
2d489f9e
SH		 1012 /*
1013 * at this point the old-root is mounted on top of our new-root
1014 * To unmounted it we must not be chdir'd into it, so escape back
1015 * to old-root
1016 */
1017 if (fchdir(oldroot) < 0) {
1018 SYSERROR("Error entering oldroot");
1019 goto fail;
1020 }
7981ea46 1021 if (umount2(".", MNT_DETACH) < 0) {
2d489f9e
SH		 1022 SYSERROR("Error detaching old root");
1023 goto fail;
cc6f6dd7
DL		 1024 }
1025
2d489f9e
SH		 1026 if (fchdir(newroot) < 0) {
1027 SYSERROR("Error re-entering newroot");
1028 goto fail;
1029 }
cc6f6dd7 1030
2d489f9e
SH		 1031 close(oldroot);
1032 close(newroot);
bf601689 1033
2d489f9e 1034 DEBUG("pivot_root syscall to '%s' successful", rootfs);
bf601689 1035
bf601689 1036 return 0;
2d489f9e
SH		 1037
1038fail:
1039 if (oldroot != -1)
1040 close(oldroot);
1041 if (newroot != -1)
1042 close(newroot);
1043 return -1;
bf601689
MH		 1044}
1045
7133b912
CB		 1046/* Just create a path for /dev under $lxcpath/$name and in rootfs If we hit an
1047 * error, log it but don't fail yet.
91c3830e 1048 */
7133b912
CB		 1049static int mount_autodev(const char *name, const struct lxc_rootfs *rootfs,
1050 const char *lxcpath)
91c3830e
SH		 1051{
1052 int ret;
87da4ec3
SH		 1053 size_t clen;
1054 char *path;
91c3830e 1055
7133b912 1056 INFO("Preparing \"/dev\"");
bc6928ff 1057
14221cbb 1058 /* $(rootfs->mount) + "/dev/pts" + '\0' */
ec50007f 1059 clen = (rootfs->path ? strlen(rootfs->mount) : 0) + 9;
87da4ec3 1060 path = alloca(clen);
bc6928ff 1061
ec50007f 1062 ret = snprintf(path, clen, "%s/dev", rootfs->path ? rootfs->mount : "");
7133b912 1063 if (ret < 0 || (size_t)ret >= clen)
91c3830e 1064 return -1;
bc6928ff 1065
87da4ec3 1066 if (!dir_exists(path)) {
7133b912
CB		 1067 WARN("\"/dev\" directory does not exist. Proceeding without "
1068 "autodev being set up");
87da4ec3 1069 return 0;
bc6928ff 1070 }
87da4ec3 1071
1ec0e8e3 1072 ret = safe_mount("none", path, "tmpfs", 0, "size=500000,mode=755",
7133b912
CB		 1073 rootfs->path ? rootfs->mount : NULL);
1074 if (ret < 0) {
1075 SYSERROR("Failed to mount tmpfs on \"%s\"", path);
1ec0e8e3 1076 return -1;
91c3830e 1077 }
7133b912 1078 INFO("Mounted tmpfs on \"%s\"", path);
87da4ec3 1079
ec50007f 1080 ret = snprintf(path, clen, "%s/dev/pts", rootfs->path ? rootfs->mount : "");
7133b912 1081 if (ret < 0 || (size_t)ret >= clen)
91c3830e 1082 return -1;
87da4ec3 1083
7133b912 1084 /* If we are running on a devtmpfs mapping, dev/pts may already exist.
bc6928ff
MW		 1085 * If not, then create it and exit if that fails...
1086 */
87da4ec3 1087 if (!dir_exists(path)) {
bc6928ff 1088 ret = mkdir(path, S_IRWXU | S_IRGRP | S_IXGRP | S_IROTH | S_IXOTH);
7133b912
CB		 1089 if (ret < 0) {
1090 SYSERROR("Failed to create directory \"%s\"", path);
bc6928ff
MW		 1091 return -1;
1092 }
91c3830e
SH		 1093 }
1094
7133b912 1095 INFO("Prepared \"/dev\"");
91c3830e
SH		 1096 return 0;
1097}
1098
c6883f38 1099struct lxc_devs {
74a3920a 1100 const char *name;
c6883f38
SH		 1101 mode_t mode;
1102 int maj;
1103 int min;
1104};
1105
74a3920a 1106static const struct lxc_devs lxc_devs[] = {
06749971
CB		 1107 { "null", S_IFCHR | S_IRWXU | S_IRWXG | S_IRWXO, 1, 3 },
1108 { "zero", S_IFCHR | S_IRWXU | S_IRWXG | S_IRWXO, 1, 5 },
1109 { "full", S_IFCHR | S_IRWXU | S_IRWXG | S_IRWXO, 1, 7 },
1110 { "urandom", S_IFCHR | S_IRWXU | S_IRWXG | S_IRWXO, 1, 9 },
1111 { "random", S_IFCHR | S_IRWXU | S_IRWXG | S_IRWXO, 1, 8 },
1112 { "tty", S_IFCHR | S_IRWXU | S_IRWXG | S_IRWXO, 5, 0 },
c6883f38
SH		 1113};
1114
27245ff7 1115static int lxc_fill_autodev(const struct lxc_rootfs *rootfs)
c6883f38
SH		 1116{
1117 int ret;
c6883f38
SH		 1118 char path[MAXPATHLEN];
1119 int i;
3a32201c 1120 mode_t cmask;
c6883f38 1121
3999be0a
CB		 1122 ret = snprintf(path, MAXPATHLEN, "%s/dev",
1123 rootfs->path ? rootfs->mount : "");
1124 if (ret < 0 || ret >= MAXPATHLEN)
c6883f38 1125 return -1;
91c3830e 1126
0bbf8572
CB		 1127 /* ignore, just don't try to fill in */
1128 if (!dir_exists(path))
9cb4d183
SH		 1129 return 0;
1130
3999be0a
CB		 1131 INFO("Populating \"/dev\"");
1132
3a32201c 1133 cmask = umask(S_IXUSR | S_IXGRP | S_IXOTH);
c6883f38 1134 for (i = 0; i < sizeof(lxc_devs) / sizeof(lxc_devs[0]); i++) {
74a3920a 1135 const struct lxc_devs *d = &lxc_devs[i];
0728ebf4 1136
3999be0a
CB		 1137 ret = snprintf(path, MAXPATHLEN, "%s/dev/%s",
1138 rootfs->path ? rootfs->mount : "", d->name);
c6883f38
SH		 1139 if (ret < 0 || ret >= MAXPATHLEN)
1140 return -1;
0bbf8572 1141
c6883f38 1142 ret = mknod(path, d->mode, makedev(d->maj, d->min));
0bbf8572 1143 if (ret < 0) {
9cb4d183 1144 FILE *pathfile;
3999be0a 1145 char hostpath[MAXPATHLEN];
9cb4d183 1146
0bbf8572
CB		 1147 if (errno == EEXIST) {
1148 DEBUG("\"%s\" device already existed", path);
1149 continue;
1150 }
1151
1152 /* Unprivileged containers cannot create devices, so
1153 * bind mount the device from the host.
1154 */
9cb4d183
SH		 1155 ret = snprintf(hostpath, MAXPATHLEN, "/dev/%s", d->name);
1156 if (ret < 0 || ret >= MAXPATHLEN)
1157 return -1;
3999be0a 1158
9cb4d183
SH		 1159 pathfile = fopen(path, "wb");
1160 if (!pathfile) {
3999be0a 1161 SYSERROR("Failed to create file \"%s\"", path);
9cb4d183
SH		 1162 return -1;
1163 }
1164 fclose(pathfile);
3999be0a
CB		 1165
1166 ret = safe_mount(hostpath, path, 0, MS_BIND, NULL,
1167 rootfs->path ? rootfs->mount : NULL);
1168 if (ret < 0) {
1169 SYSERROR("Failed to bind mount \"%s\" from "
1170 "host into container",
1171 d->name);
9cb4d183
SH		 1172 return -1;
1173 }
3999be0a
CB		 1174 DEBUG("Bind mounted \"%s\" onto \"%s\"", hostpath,
1175 path);
0bbf8572 1176 } else {
3999be0a 1177 DEBUG("Created device node \"%s\"", path);
c6883f38
SH		 1178 }
1179 }
3a32201c 1180 umask(cmask);
c6883f38 1181
3999be0a 1182 INFO("Populated \"/dev\"");
c6883f38
SH		 1183 return 0;
1184}
1185
9aa76a17 1186static int lxc_setup_rootfs(struct lxc_conf *conf)
0ad19a3f 1187{
9aa76a17 1188 int ret;
10bc1861 1189 struct lxc_storage *bdev;
91c3e281 1190 const struct lxc_rootfs *rootfs;
cc28d0b0 1191
91c3e281 1192 rootfs = &conf->rootfs;
a0f379bf 1193 if (!rootfs->path) {
91c3e281
CB		 1194 if (mount("", "/", NULL, MS_SLAVE | MS_REC, 0)) {
1195 SYSERROR("Failed to make / rslave.");
a0f379bf
DW		 1196 return -1;
1197 }
c69bd12f 1198 return 0;
a0f379bf 1199 }
0ad19a3f 1200
12297168 1201 if (access(rootfs->mount, F_OK)) {
91c3e281 1202 SYSERROR("Failed to access to \"%s\". Check it is present.",
12297168 1203 rootfs->mount);
b1789442
DL		 1204 return -1;
1205 }
1206
8a388ed4 1207 bdev = storage_init(conf);
9aa76a17
CB		 1208 if (!bdev) {
1209 ERROR("Failed to mount rootfs \"%s\" onto \"%s\" with options \"%s\".",
91c3e281
CB		 1210 rootfs->path, rootfs->mount,
1211 rootfs->options ? rootfs->options : "(null)");
9aa76a17 1212 return -1;
9be53773 1213 }
9aa76a17
CB		 1214
1215 ret = bdev->ops->mount(bdev);
10bc1861 1216 storage_put(bdev);
9aa76a17 1217 if (ret < 0) {
91c3e281
CB		 1218 ERROR("Failed to mount rootfs \"%s\" onto \"%s\" with options \"%s\".",
1219 rootfs->path, rootfs->mount,
1220 rootfs->options ? rootfs->options : "(null)");
c3f0a28c 1221 return -1;
1222 }
0ad19a3f 1223
91c3e281
CB		 1224 DEBUG("Mounted rootfs \"%s\" onto \"%s\" with options \"%s\".",
1225 rootfs->path, rootfs->mount,
1226 rootfs->options ? rootfs->options : "(null)");
9aa76a17 1227
ac778708
DL		 1228 return 0;
1229}
1230
91e93c71
AV		 1231int prepare_ramfs_root(char *root)
1232{
eab15c1e 1233 char buf[LXC_LINELEN], *p;
91e93c71
AV		 1234 char nroot[PATH_MAX];
1235 FILE *f;
1236 int i;
1237 char *p2;
1238
1239 if (realpath(root, nroot) == NULL)
39c7b795 1240 return -errno;
91e93c71
AV		 1241
1242 if (chdir("/") == -1)
39c7b795 1243 return -errno;
91e93c71
AV		 1244
1245 /*
1246 * We could use here MS_MOVE, but in userns this mount is
1247 * locked and can't be moved.
1248 */
39c7b795 1249 if (mount(root, "/", NULL, MS_REC | MS_BIND, NULL) < 0) {
91e93c71 1250 SYSERROR("Failed to move %s into /", root);
39c7b795 1251 return -errno;
91e93c71
AV		 1252 }
1253
39c7b795 1254 if (mount(NULL, "/", NULL, MS_REC | MS_PRIVATE, NULL) < 0) {
91e93c71 1255 SYSERROR("Failed to make . rprivate");
39c7b795 1256 return -errno;
91e93c71
AV		 1257 }
1258
1259 /*
1260 * The following code cleans up inhereted mounts which are not
1261 * required for CT.
1262 *
1263 * The mountinfo file shows not all mounts, if a few points have been
1264 * unmounted between read operations from the mountinfo. So we need to
1265 * read mountinfo a few times.
1266 *
1267 * This loop can be skipped if a container uses unserns, because all
1268 * inherited mounts are locked and we should live with all this trash.
1269 */
1270 while (1) {
1271 int progress = 0;
1272
1273 f = fopen("./proc/self/mountinfo", "r");
1274 if (!f) {
1275 SYSERROR("Unable to open /proc/self/mountinfo");
1276 return -1;
1277 }
eab15c1e 1278 while (fgets(buf, LXC_LINELEN, f)) {
91e93c71
AV		 1279 for (p = buf, i=0; p && i < 4; i++)
1280 p = strchr(p+1, ' ');
1281 if (!p)
1282 continue;
1283 p2 = strchr(p+1, ' ');
1284 if (!p2)
1285 continue;
1286
1287 *p2 = '\0';
1288 *p = '.';
1289
1290 if (strcmp(p + 1, "/") == 0)
1291 continue;
1292 if (strcmp(p + 1, "/proc") == 0)
1293 continue;
1294
1295 if (umount2(p, MNT_DETACH) == 0)
1296 progress++;
1297 }
1298 fclose(f);
1299 if (!progress)
1300 break;
1301 }
1302
8bea9fae
PR		 1303 /* This also can be skipped if a container uses unserns */
1304 umount2("./proc", MNT_DETACH);
91e93c71
AV		 1305
1306 /* It is weird, but chdir("..") moves us in a new root */
1307 if (chdir("..") == -1) {
1308 SYSERROR("Unable to change working directory");
1309 return -1;
1310 }
1311
1312 if (chroot(".") == -1) {
1313 SYSERROR("Unable to chroot");
1314 return -1;
1315 }
1316
1317 return 0;
1318}
1319
74a3920a 1320static int setup_pivot_root(const struct lxc_rootfs *rootfs)
ac778708 1321{
39c7b795
CB		 1322 if (!rootfs->path) {
1323 DEBUG("container does not have a rootfs, so not doing pivot root");
ac778708 1324 return 0;
39c7b795 1325 }
ac778708 1326
91e93c71 1327 if (detect_ramfs_rootfs()) {
39c7b795
CB		 1328 DEBUG("detected that container is on ramfs");
1329 if (prepare_ramfs_root(rootfs->mount)) {
1330 ERROR("failed to prepare minimal ramfs root");
91e93c71 1331 return -1;
39c7b795
CB		 1332 }
1333
1334 DEBUG("prepared ramfs root for container");
1335 return 0;
1336 }
1337
1338 if (setup_rootfs_pivot_root(rootfs->mount) < 0) {
1339 ERROR("failed to pivot root");
25368b52 1340 return -1;
c69bd12f
DL		 1341 }
1342
39c7b795 1343 DEBUG("finished pivot root");
25368b52 1344 return 0;
0ad19a3f 1345}
1346
70761e5e 1347static int lxc_setup_devpts(int num_pts)
3c26f34e 1348{
70761e5e 1349 int ret;
9d28c4f9
CB		 1350 const char *default_devpts_mntopts = "newinstance,ptmxmode=0666,mode=0620,gid=5";
1351 char devpts_mntopts[256];
77890c6d 1352
70761e5e
CB		 1353 if (!num_pts) {
1354 DEBUG("no new devpts instance will be mounted since no pts "
1355 "devices are requested");
d852c78c 1356 return 0;
3c26f34e 1357 }
1358
9d28c4f9
CB		 1359 ret = snprintf(devpts_mntopts, sizeof(devpts_mntopts), "%s,max=%d",
1360 default_devpts_mntopts, num_pts);
1361 if (ret < 0 || (size_t)ret >= sizeof(devpts_mntopts))
1362 return -1;
1363
d5cb35d6 1364 /* Unmount old devpts instance. */
70761e5e
CB		 1365 ret = access("/dev/pts/ptmx", F_OK);
1366 if (!ret) {
70761e5e
CB		 1367 ret = umount("/dev/pts");
1368 if (ret < 0) {
1369 SYSERROR("failed to unmount old devpts instance");
1370 return -1;
7e40254a 1371 }
70761e5e 1372 DEBUG("unmounted old /dev/pts instance");
7e40254a
JTLB		 1373 }
1374
70761e5e
CB		 1375 /* Create mountpoint for devpts instance. */
1376 ret = mkdir("/dev/pts", 0755);
1377 if (ret < 0 && errno != EEXIST) {
1378 SYSERROR("failed to create the \"/dev/pts\" directory");
3c26f34e 1379 return -1;
1380 }
1381
70761e5e
CB		 1382 /* Mount new devpts instance. */
1383 ret = mount("devpts", "/dev/pts", "devpts", MS_MGC_VAL, devpts_mntopts);
1384 if (ret < 0) {
1385 SYSERROR("failed to mount new devpts instance");
1386 return -1;
1387 }
f4f52cb5 1388 DEBUG("mount new devpts instance with options \"%s\"", devpts_mntopts);
70761e5e 1389
d5cb35d6 1390 /* Remove any pre-existing /dev/ptmx file. */
70761e5e 1391 ret = access("/dev/ptmx", F_OK);
d5cb35d6
CB		 1392 if (!ret) {
1393 ret = remove("/dev/ptmx");
1394 if (ret < 0) {
1395 SYSERROR("failed to remove existing \"/dev/ptmx\"");
1396 return -1;
70761e5e 1397 }
d5cb35d6 1398 DEBUG("removed existing \"/dev/ptmx\"");
3c26f34e 1399 }
1400
d5cb35d6
CB		 1401 /* Create dummy /dev/ptmx file as bind mountpoint for /dev/pts/ptmx. */
1402 ret = open("/dev/ptmx", O_CREAT, 0666);
1403 if (ret < 0) {
1404 SYSERROR("failed to create dummy \"/dev/ptmx\" file as bind mount target");
1405 return -1;
1406 }
e87bd19c 1407 close(ret);
d5cb35d6 1408 DEBUG("created dummy \"/dev/ptmx\" file as bind mount target");
77890c6d 1409
d5cb35d6 1410 /* Fallback option: create symlink /dev/ptmx -> /dev/pts/ptmx */
e87bd19c 1411 ret = mount("/dev/pts/ptmx", "/dev/ptmx", NULL, MS_BIND, NULL);
d5cb35d6
CB		 1412 if (!ret) {
1413 DEBUG("bind mounted \"/dev/pts/ptmx\" to \"/dev/ptmx\"");
1414 return 0;
1415 } else {
1416 /* Fallthrough and try to create a symlink. */
1417 ERROR("failed to bind mount \"/dev/pts/ptmx\" to \"/dev/ptmx\"");
1418 }
1419
1420 /* Remove the dummy /dev/ptmx file we created above. */
1421 ret = remove("/dev/ptmx");
70761e5e 1422 if (ret < 0) {
d5cb35d6
CB		 1423 SYSERROR("failed to remove existing \"/dev/ptmx\"");
1424 return -1;
1425 }
1426
1427 /* Fallback option: Create symlink /dev/ptmx -> /dev/pts/ptmx. */
1428 ret = symlink("/dev/pts/ptmx", "/dev/ptmx");
1429 if (ret < 0) {
1430 SYSERROR("failed to create symlink \"/dev/ptmx\" -> \"/dev/pts/ptmx\"");
3c26f34e 1431 return -1;
1432 }
d5cb35d6 1433 DEBUG("created symlink \"/dev/ptmx\" -> \"/dev/pts/ptmx\"");
cd54d859 1434
3c26f34e 1435 return 0;
1436}
1437
cccc74b5
DL		 1438static int setup_personality(int persona)
1439{
6ff05e18 1440 #if HAVE_SYS_PERSONALITY_H
cccc74b5
DL		 1441 if (persona == -1)
1442 return 0;
1443
1444 if (personality(persona) < 0) {
1445 SYSERROR("failed to set personality to '0x%x'", persona);
1446 return -1;
1447 }
1448
1449 INFO("set personality to '0x%x'", persona);
6ff05e18 1450 #endif
cccc74b5
DL		 1451
1452 return 0;
1453}
1454
3d7d929a
CB		 1455static int lxc_setup_dev_console(const struct lxc_rootfs *rootfs,
1456 const struct lxc_console *console)
6e590161 1457{
63376d7d 1458 char path[MAXPATHLEN];
0728ebf4 1459 int ret, fd;
52e35957 1460
8b1b1210
CB		 1461 if (console->path && !strcmp(console->path, "none"))
1462 return 0;
1463
7c6ef2a2 1464 ret = snprintf(path, sizeof(path), "%s/dev/console", rootfs->mount);
3d7d929a 1465 if (ret < 0 || (size_t)ret >= sizeof(path))
7c6ef2a2 1466 return -1;
52e35957 1467
8b1b1210
CB		 1468 /* When we are asked to setup a console we remove any previous
1469 * /dev/console bind-mounts.
1470 */
a7ba3c7f
CB		 1471 if (file_exists(path)) {
1472 ret = lxc_unstack_mountpoint(path, false);
1473 if (ret < 0) {
8b1b1210 1474 ERROR("failed to unmount \"%s\": %s", path, strerror(errno));
a7ba3c7f
CB		 1475 return -ret;
1476 } else {
1477 DEBUG("cleared all (%d) mounts from \"%s\"", ret, path);
1478 }
953fe44f 1479
a7ba3c7f
CB		 1480 ret = unlink(path);
1481 if (ret < 0) {
1482 SYSERROR("error unlinking %s", path);
8b1b1210
CB		 1483 return -errno;
1484 }
8b1b1210
CB		 1485 }
1486
1487 /* For unprivileged containers autodev or automounts will already have
1488 * taken care of creating /dev/console.
1489 */
0728ebf4
TA		 1490 fd = open(path, O_CREAT | O_EXCL, S_IXUSR | S_IXGRP | S_IXOTH);
1491 if (fd < 0) {
1492 if (errno != EEXIST) {
1493 SYSERROR("failed to create console");
3d7d929a 1494 return -errno;
0728ebf4
TA		 1495 }
1496 } else {
1497 close(fd);
52e35957
DL		 1498 }
1499
0728ebf4 1500 if (chmod(console->name, S_IXUSR | S_IXGRP | S_IXOTH)) {
3d7d929a
CB		 1501 SYSERROR("failed to set mode '0%o' to '%s'", S_IXUSR | S_IXGRP | S_IXOTH, console->name);
1502 return -errno;
63376d7d 1503 }
13954cce 1504
3d7d929a 1505 if (safe_mount(console->name, path, "none", MS_BIND, 0, rootfs->mount) < 0) {
63376d7d 1506 ERROR("failed to mount '%s' on '%s'", console->name, path);
6e590161 1507 return -1;
1508 }
1509
3d7d929a 1510 DEBUG("mounted pts device \"%s\" onto \"%s\"", console->name, path);
7c6ef2a2
SH		 1511 return 0;
1512}
1513
3d7d929a
CB		 1514static int lxc_setup_ttydir_console(const struct lxc_rootfs *rootfs,
1515 const struct lxc_console *console,
1516 char *ttydir)
7c6ef2a2 1517{
7c6ef2a2 1518 int ret;
3d7d929a 1519 char path[MAXPATHLEN], lxcpath[MAXPATHLEN];
7c6ef2a2
SH		 1520
1521 /* create rootfs/dev/<ttydir> directory */
3d7d929a
CB		 1522 ret = snprintf(path, sizeof(path), "%s/dev/%s", rootfs->mount, ttydir);
1523 if (ret < 0 || (size_t)ret >= sizeof(path))
7c6ef2a2 1524 return -1;
3d7d929a 1525
7c6ef2a2
SH		 1526 ret = mkdir(path, 0755);
1527 if (ret && errno != EEXIST) {
959aee9c 1528 SYSERROR("failed with errno %d to create %s", errno, path);
3d7d929a 1529 return -errno;
7c6ef2a2 1530 }
4742cd9a 1531 DEBUG("Created directory for console and tty devices at \"%s\"", path);
7c6ef2a2 1532
3d7d929a
CB		 1533 ret = snprintf(lxcpath, sizeof(lxcpath), "%s/dev/%s/console", rootfs->mount, ttydir);
1534 if (ret < 0 || (size_t)ret >= sizeof(lxcpath))
1535 return -1;
1536
7c6ef2a2 1537 ret = creat(lxcpath, 0660);
3d7d929a 1538 if (ret == -1 && errno != EEXIST) {
959aee9c 1539 SYSERROR("error %d creating %s", errno, lxcpath);
3d7d929a 1540 return -errno;
7c6ef2a2 1541 }
4d44e274
SH		 1542 if (ret >= 0)
1543 close(ret);
7c6ef2a2 1544
2a12fefd
CB		 1545 ret = snprintf(path, sizeof(path), "%s/dev/console", rootfs->mount);
1546 if (ret < 0 || (size_t)ret >= sizeof(lxcpath))
7c6ef2a2 1547 return -1;
2a12fefd
CB		 1548
1549 /* When we are asked to setup a console we remove any previous
1550 * /dev/console bind-mounts.
1551 */
1552 if (console->path && !strcmp(console->path, "none")) {
1553 struct stat st;
1554 ret = stat(path, &st);
1555 if (ret < 0) {
1556 if (errno == ENOENT)
1557 return 0;
1558 SYSERROR("failed stat() \"%s\"", path);
1559 return -errno;
1560 }
1561
1562 /* /dev/console must be character device with major number 5 and
1563 * minor number 1. If not, give benefit of the doubt and assume
1564 * the user has mounted something else right there on purpose.
1565 */
1566 if (((st.st_mode & S_IFMT) != S_IFCHR) || major(st.st_rdev) != 5 || minor(st.st_rdev) != 1)
1567 return 0;
1568
1569 /* In case the user requested a bind-mount for /dev/console and
1570 * requests a ttydir we move the mount to the
a7ba3c7f
CB		 1571 * /dev/<ttydir/console.
1572 * Note, we only move the uppermost mount and clear all other
1573 * mounts underneath for safety.
1574 * If it is a character device created via mknod() we simply
1575 * rename it.
2a12fefd
CB		 1576 */
1577 ret = safe_mount(path, lxcpath, "none", MS_MOVE, NULL, rootfs->mount);
1578 if (ret < 0) {
1579 if (errno != EINVAL) {
1580 ERROR("failed to MS_MOVE \"%s\" to \"%s\": %s", path, lxcpath, strerror(errno));
1581 return -errno;
1582 }
1583 /* path was not a mountpoint */
1584 ret = rename(path, lxcpath);
1585 if (ret < 0) {
1586 ERROR("failed to rename \"%s\" to \"%s\": %s", path, lxcpath, strerror(errno));
1587 return -errno;
1588 }
1589 DEBUG("renamed \"%s\" to \"%s\"", path, lxcpath);
1590 } else {
1591 DEBUG("moved mount \"%s\" to \"%s\"", path, lxcpath);
1592 }
a7ba3c7f
CB		 1593
1594 /* Clear all remaining bind-mounts. */
1595 ret = lxc_unstack_mountpoint(path, false);
2a12fefd 1596 if (ret < 0) {
a7ba3c7f
CB		 1597 ERROR("failed to unmount \"%s\": %s", path, strerror(errno));
1598 return -ret;
1599 } else {
1600 DEBUG("cleared all (%d) mounts from \"%s\"", ret, path);
1601 }
1602 } else {
1603 if (file_exists(path)) {
1604 ret = lxc_unstack_mountpoint(path, false);
1605 if (ret < 0) {
2a12fefd 1606 ERROR("failed to unmount \"%s\": %s", path, strerror(errno));
a7ba3c7f
CB		 1607 return -ret;
1608 } else {
1609 DEBUG("cleared all (%d) mounts from \"%s\"", ret, path);
2a12fefd 1610 }
2a12fefd
CB		 1611 }
1612
1613 if (safe_mount(console->name, lxcpath, "none", MS_BIND, 0, rootfs->mount) < 0) {
1614 ERROR("failed to mount '%s' on '%s'", console->name, lxcpath);
1615 return -1;
1616 }
1617 DEBUG("mounted \"%s\" onto \"%s\"", console->name, lxcpath);
7c6ef2a2
SH		 1618 }
1619
2a12fefd 1620 /* create symlink from rootfs /dev/console to '<ttydir>/console' */
9ba8130c 1621 ret = snprintf(lxcpath, sizeof(lxcpath), "%s/console", ttydir);
3d7d929a 1622 if (ret < 0 || (size_t)ret >= sizeof(lxcpath))
9ba8130c 1623 return -1;
3d7d929a 1624
2a12fefd
CB		 1625 ret = unlink(path);
1626 if (ret && errno != ENOENT) {
1627 SYSERROR("error unlinking %s", path);
1628 return -errno;
1629 }
1630
7c6ef2a2 1631 ret = symlink(lxcpath, path);
3d7d929a
CB		 1632 if (ret < 0) {
1633 SYSERROR("failed to create symlink for console from \"%s\" to \"%s\"", lxcpath, path);
7c6ef2a2
SH		 1634 return -1;
1635 }
1636
3d7d929a 1637 DEBUG("console has been setup under \"%s\" and symlinked to \"%s\"", lxcpath, path);
6e590161 1638 return 0;
1639}
1640
3d7d929a
CB		 1641static int lxc_setup_console(const struct lxc_rootfs *rootfs,
1642 const struct lxc_console *console, char *ttydir)
7c6ef2a2 1643{
3d7d929a
CB		 1644 /* We don't have a rootfs, /dev/console will be shared. */
1645 if (!rootfs->path) {
1646 DEBUG("/dev/console will be shared with the host");
7c6ef2a2 1647 return 0;
3d7d929a
CB		 1648 }
1649
7c6ef2a2 1650 if (!ttydir)
3d7d929a 1651 return lxc_setup_dev_console(rootfs, console);
7c6ef2a2 1652
3d7d929a 1653 return lxc_setup_ttydir_console(rootfs, console, ttydir);
7c6ef2a2
SH		 1654}
1655
998ac676
RT		 1656static void parse_mntopt(char *opt, unsigned long *flags, char **data)
1657{
1658 struct mount_opt *mo;
1659
1660 /* If opt is found in mount_opt, set or clear flags.
1661 * Otherwise append it to data. */
1662
1663 for (mo = &mount_opt[0]; mo->name != NULL; mo++) {
1664 if (!strncmp(opt, mo->name, strlen(mo->name))) {
1665 if (mo->clear)
1666 *flags &= ~mo->flag;
1667 else
1668 *flags |= mo->flag;
1669 return;
1670 }
1671 }
1672
1673 if (strlen(*data))
1674 strcat(*data, ",");
1675 strcat(*data, opt);
1676}
1677
a17b1e65 1678int parse_mntopts(const char *mntopts, unsigned long *mntflags,
998ac676
RT		 1679 char **mntdata)
1680{
1681 char *s, *data;
1682 char *p, *saveptr = NULL;
1683
911324ef 1684 *mntdata = NULL;
91656ce5 1685 *mntflags = 0L;
911324ef
DL		 1686
1687 if (!mntopts)
998ac676
RT		 1688 return 0;
1689
911324ef 1690 s = strdup(mntopts);
998ac676 1691 if (!s) {
36eb9bde 1692 SYSERROR("failed to allocate memory");
998ac676
RT		 1693 return -1;
1694 }
1695
1696 data = malloc(strlen(s) + 1);
1697 if (!data) {
36eb9bde 1698 SYSERROR("failed to allocate memory");
998ac676
RT		 1699 free(s);
1700 return -1;
1701 }
1702 *data = 0;
1703
1704 for (p = strtok_r(s, ",", &saveptr); p != NULL;
1705 p = strtok_r(NULL, ",", &saveptr))
1706 parse_mntopt(p, mntflags, &data);
1707
1708 if (*data)
1709 *mntdata = data;
1710 else
1711 free(data);
1712 free(s);
1713
1714 return 0;
1715}
1716
6fd5e769
SH		 1717static void null_endofword(char *word)
1718{
1719 while (*word && *word != ' ' && *word != '\t')
1720 word++;
1721 *word = '\0';
1722}
1723
1724/*
1725 * skip @nfields spaces in @src
1726 */
1727static char *get_field(char *src, int nfields)
1728{
1729 char *p = src;
1730 int i;
1731
1732 for (i = 0; i < nfields; i++) {
1733 while (*p && *p != ' ' && *p != '\t')
1734 p++;
1735 if (!*p)
1736 break;
1737 p++;
1738 }
1739 return p;
1740}
1741
911324ef
DL		 1742static int mount_entry(const char *fsname, const char *target,
1743 const char *fstype, unsigned long mountflags,
0ac4b28a
CB		 1744 const char *data, int optional, int dev,
1745 const char *rootfs)
911324ef 1746{
0ac4b28a 1747 int ret;
614305f3 1748#ifdef HAVE_STATVFS
2938f7c8 1749 struct statvfs sb;
614305f3 1750#endif
2938f7c8 1751
0ac4b28a
CB		 1752 ret = safe_mount(fsname, target, fstype, mountflags & ~MS_REMOUNT, data,
1753 rootfs);
1754 if (ret < 0) {
1fc64d22 1755 if (optional) {
0ac4b28a
CB		 1756 INFO("Failed to mount \"%s\" on \"%s\" (optional): %s",
1757 fsname, target, strerror(errno));
1fc64d22
SG		 1758 return 0;
1759 }
0ac4b28a
CB		 1760
1761 SYSERROR("Failed to mount \"%s\" on \"%s\"", fsname, target);
1762 return -1;
911324ef
DL		 1763 }
1764
1765 if ((mountflags & MS_REMOUNT) || (mountflags & MS_BIND)) {
7c5b6e7c 1766 unsigned long rqd_flags = 0;
0ac4b28a
CB		 1767
1768 DEBUG("Remounting \"%s\" on \"%s\" to respect bind or remount "
1769 "options",
1770 fsname ? fsname : "(none)", target ? target : "(none)");
1771
7c5b6e7c
AS		 1772 if (mountflags & MS_RDONLY)
1773 rqd_flags |= MS_RDONLY;
614305f3 1774#ifdef HAVE_STATVFS
2938f7c8 1775 if (statvfs(fsname, &sb) == 0) {
7c5b6e7c 1776 unsigned long required_flags = rqd_flags;
0ac4b28a 1777
2938f7c8
SH		 1778 if (sb.f_flag & MS_NOSUID)
1779 required_flags |= MS_NOSUID;
0ac4b28a 1780
ae7a770e 1781 if (sb.f_flag & MS_NODEV && !dev)
2938f7c8 1782 required_flags |= MS_NODEV;
0ac4b28a 1783
2938f7c8
SH		 1784 if (sb.f_flag & MS_RDONLY)
1785 required_flags |= MS_RDONLY;
0ac4b28a 1786
2938f7c8
SH		 1787 if (sb.f_flag & MS_NOEXEC)
1788 required_flags |= MS_NOEXEC;
0ac4b28a
CB		 1789
1790 DEBUG("Flags for \"%s\" were %lu, required extra flags "
1791 "are %lu", fsname, sb.f_flag, required_flags);
1792
1793 /* If this was a bind mount request, and required_flags
2938f7c8 1794 * does not have any flags which are not already in
0ac4b28a 1795 * mountflags, then skip the remount.
2938f7c8
SH		 1796 */
1797 if (!(mountflags & MS_REMOUNT)) {
0ac4b28a
CB		 1798 if (!(required_flags & ~mountflags) &&
1799 rqd_flags == 0) {
1800 DEBUG("Mountflags already were %lu, "
1801 "skipping remount", mountflags);
2938f7c8
SH		 1802 goto skipremount;
1803 }
1804 }
0ac4b28a 1805
2938f7c8 1806 mountflags |= required_flags;
6fd5e769 1807 }
614305f3 1808#endif
911324ef 1809
0ac4b28a
CB		 1810 ret = mount(fsname, target, fstype, mountflags | MS_REMOUNT, data);
1811 if (ret < 0) {
1fc64d22 1812 if (optional) {
0ac4b28a
CB		 1813 INFO("Failed to mount \"%s\" on \"%s\" "
1814 "(optional): %s", fsname, target,
1815 strerror(errno));
1fc64d22
SG		 1816 return 0;
1817 }
0ac4b28a
CB		 1818
1819 SYSERROR("Failed to mount \"%s\" on \"%s\"", fsname, target);
1820 return -1;
911324ef
DL		 1821 }
1822 }
1823
614305f3 1824#ifdef HAVE_STATVFS
6fd5e769 1825skipremount:
614305f3 1826#endif
0ac4b28a
CB		 1827 DEBUG("Mounted \"%s\" on \"%s\" with filesystem type \"%s\"", fsname,
1828 target, fstype);
911324ef
DL		 1829
1830 return 0;
1831}
1832
c5e30de4 1833/* Remove "optional", "create=dir", and "create=file" from mntopt */
4e4ca161
SH		 1834static void cull_mntent_opt(struct mntent *mntent)
1835{
1836 int i;
c5e30de4
CB		 1837 char *list[] = {"create=dir", "create=file", "optional", NULL};
1838
1839 for (i = 0; list[i]; i++) {
1840 char *p, *p2;
1841
1842 p = strstr(mntent->mnt_opts, list[i]);
1843 if (!p)
4e4ca161 1844 continue;
c5e30de4 1845
4e4ca161
SH		 1846 p2 = strchr(p, ',');
1847 if (!p2) {
1848 /* no more mntopts, so just chop it here */
1849 *p = '\0';
1850 continue;
1851 }
c5e30de4
CB		 1852
1853 memmove(p, p2 + 1, strlen(p2 + 1) + 1);
4e4ca161
SH		 1854 }
1855}
1856
4d5b72a1 1857static int mount_entry_create_dir_file(const struct mntent *mntent,
749f98d9
CB		 1858 const char *path,
1859 const struct lxc_rootfs *rootfs,
1860 const char *lxc_name,
1861 const char *lxc_path)
0ad19a3f 1862{
608e3567 1863 int ret = 0;
911324ef 1864
749f98d9
CB		 1865 if (!strncmp(mntent->mnt_type, "overlay", 7))
1866 ret = ovl_mkdir(mntent, rootfs, lxc_name, lxc_path);
1867 else if (!strncmp(mntent->mnt_type, "aufs", 4))
1868 ret = aufs_mkdir(mntent, rootfs, lxc_name, lxc_path);
1869 if (ret < 0)
1870 return -1;
6e46cc0d 1871
34cfffb3 1872 if (hasmntopt(mntent, "create=dir")) {
749f98d9
CB		 1873 ret = mkdir_p(path, 0755);
1874 if (ret < 0 && errno != EEXIST) {
1875 SYSERROR("Failed to create directory \"%s\"", path);
1876 return -1;
34cfffb3
SG		 1877 }
1878 }
1879
4d5b72a1 1880 if (hasmntopt(mntent, "create=file") && access(path, F_OK)) {
749f98d9
CB		 1881 int fd;
1882 char *p1, *p2;
1883
1884 p1 = strdup(path);
1885 if (!p1)
1886 return -1;
1887
1888 p2 = dirname(p1);
1889
1890 ret = mkdir_p(p2, 0755);
1891 free(p1);
1892 if (ret < 0 && errno != EEXIST) {
1893 SYSERROR("Failed to create directory \"%s\"", path);
1894 return -1;
6e46cc0d 1895 }
749f98d9
CB		 1896
1897 fd = open(path, O_CREAT, 0644);
1898 if (fd < 0)
1899 return -1;
1900 close(fd);
34cfffb3 1901 }
749f98d9
CB		 1902
1903 return 0;
4d5b72a1
NC		 1904}
1905
ec50007f
CB		 1906/* rootfs, lxc_name, and lxc_path can be NULL when the container is created
1907 * without a rootfs. */
db4aba38 1908static inline int mount_entry_on_generic(struct mntent *mntent,
d8b712bc
CB		 1909 const char *path,
1910 const struct lxc_rootfs *rootfs,
1911 const char *lxc_name,
1912 const char *lxc_path)
4d5b72a1 1913{
d8b712bc 1914 int ret;
4d5b72a1
NC		 1915 unsigned long mntflags;
1916 char *mntdata;
d8b712bc 1917 bool dev, optional;
ec50007f 1918 char *rootfs_path = NULL;
d8b712bc
CB		 1919
1920 optional = hasmntopt(mntent, "optional") != NULL;
1921 dev = hasmntopt(mntent, "dev") != NULL;
1922
ec50007f
CB		 1923 if (rootfs && rootfs->path)
1924 rootfs_path = rootfs->mount;
1925
d8b712bc
CB		 1926 ret = mount_entry_create_dir_file(mntent, path, rootfs, lxc_name,
1927 lxc_path);
1928 if (ret < 0) {
1929 if (optional)
1930 return 0;
608e3567 1931
d8b712bc
CB		 1932 return -1;
1933 }
4e4ca161
SH		 1934 cull_mntent_opt(mntent);
1935
d8b712bc
CB		 1936 ret = parse_mntopts(mntent->mnt_opts, &mntflags, &mntdata);
1937 if (ret < 0)
a17b1e65 1938 return -1;
a17b1e65 1939
6e46cc0d 1940 ret = mount_entry(mntent->mnt_fsname, path, mntent->mnt_type, mntflags,
ae7a770e 1941 mntdata, optional, dev, rootfs_path);
68c152ef 1942
911324ef 1943 free(mntdata);
911324ef
DL		 1944 return ret;
1945}
1946
db4aba38
NC		 1947static inline int mount_entry_on_systemfs(struct mntent *mntent)
1948{
1433c9f9 1949 int ret;
07667a6a 1950 char path[MAXPATHLEN];
1433c9f9
CB		 1951
1952 /* For containers created without a rootfs all mounts are treated as
07667a6a
CB		 1953 * absolute paths starting at / on the host.
1954 */
1433c9f9
CB		 1955 if (mntent->mnt_dir[0] != '/')
1956 ret = snprintf(path, sizeof(path), "/%s", mntent->mnt_dir);
1957 else
1958 ret = snprintf(path, sizeof(path), "%s", mntent->mnt_dir);
07667a6a 1959 if (ret < 0 || ret >= sizeof(path))
1433c9f9 1960 return -1;
1433c9f9
CB		 1961
1962 return mount_entry_on_generic(mntent, path, NULL, NULL, NULL);
db4aba38
NC		 1963}
1964
4e4ca161 1965static int mount_entry_on_absolute_rootfs(struct mntent *mntent,
80a881b2 1966 const struct lxc_rootfs *rootfs,
0a2dddd4
CB		 1967 const char *lxc_name,
1968 const char *lxc_path)
911324ef 1969{
bdd2b34c 1970 int offset;
013bd428 1971 char *aux;
67e571de 1972 const char *lxcpath;
bdd2b34c
CB		 1973 char path[MAXPATHLEN];
1974 int ret = 0;
0ad19a3f 1975
593e8478 1976 lxcpath = lxc_global_config_value("lxc.lxcpath");
bdd2b34c 1977 if (!lxcpath)
2a59a681 1978 return -1;
2a59a681 1979
bdd2b34c
CB		 1980 /* If rootfs->path is a blockdev path, allow container fstab to use
1981 * <lxcpath>/<name>/rootfs" as the target prefix.
1982 */
1983 ret = snprintf(path, MAXPATHLEN, "%s/%s/rootfs", lxcpath, lxc_name);
1984 if (ret < 0 || ret >= MAXPATHLEN)
80a881b2
SH		 1985 goto skipvarlib;
1986
1987 aux = strstr(mntent->mnt_dir, path);
1988 if (aux) {
1989 offset = strlen(path);
1990 goto skipabs;
1991 }
1992
1993skipvarlib:
013bd428
DL		 1994 aux = strstr(mntent->mnt_dir, rootfs->path);
1995 if (!aux) {
bdd2b34c 1996 WARN("Ignoring mount point \"%s\"", mntent->mnt_dir);
db4aba38 1997 return ret;
013bd428 1998 }
80a881b2
SH		 1999 offset = strlen(rootfs->path);
2000
2001skipabs:
bdd2b34c
CB		 2002 ret = snprintf(path, MAXPATHLEN, "%s/%s", rootfs->mount, aux + offset);
2003 if (ret < 0 || ret >= MAXPATHLEN)
a17b1e65 2004 return -1;
a17b1e65 2005
0a2dddd4 2006 return mount_entry_on_generic(mntent, path, rootfs, lxc_name, lxc_path);
911324ef 2007}
d330fe7b 2008
4e4ca161 2009static int mount_entry_on_relative_rootfs(struct mntent *mntent,
0a2dddd4
CB		 2010 const struct lxc_rootfs *rootfs,
2011 const char *lxc_name,
2012 const char *lxc_path)
911324ef
DL		 2013{
2014 char path[MAXPATHLEN];
911324ef 2015 int ret;
d330fe7b 2016
34cfffb3 2017 /* relative to root mount point */
6e46cc0d 2018 ret = snprintf(path, sizeof(path), "%s/%s", rootfs->mount, mntent->mnt_dir);
1433c9f9 2019 if (ret < 0 || ret >= sizeof(path)) {
9ba8130c
SH		 2020 ERROR("path name too long");
2021 return -1;
2022 }
911324ef 2023
0a2dddd4 2024 return mount_entry_on_generic(mntent, path, rootfs, lxc_name, lxc_path);
911324ef
DL		 2025}
2026
06749971
CB		 2027/* This logs a NOTICE() when a user specifies mounts that would conflict with
2028 * devices liblxc sets up automatically.
2029 */
2030static void log_notice_on_conflict(const struct lxc_conf *conf, const char *src,
2031 const char *dest)
2032{
2033 char *clean_mnt_fsname, *clean_mnt_dir, *tmp;
2034 bool needs_warning = false;
2035
2036 clean_mnt_fsname = lxc_deslashify(src);
2037 if (!clean_mnt_fsname)
2038 return;
2039
2040 clean_mnt_dir = lxc_deslashify(dest);
2041 if (!clean_mnt_dir) {
2042 free(clean_mnt_fsname);
2043 return;
2044 }
2045
2046 tmp = clean_mnt_dir;
2047 if (*tmp == '/')
2048 tmp++;
2049
2050 if (strncmp(src, "/dev", 4) || strncmp(tmp, "dev", 3)) {
2051 free(clean_mnt_dir);
2052 free(clean_mnt_fsname);
2053 return;
2054 }
2055
2056 if (!conf->autodev && !conf->pts && !conf->tty &&
2057 (!conf->console.path || !strcmp(conf->console.path, "none"))) {
2058 free(clean_mnt_dir);
2059 free(clean_mnt_fsname);
2060 return;
2061 }
2062
2063 if (!strcmp(tmp, "dev") && conf->autodev > 0)
2064 needs_warning = true;
2065 else if (!strcmp(tmp, "dev/pts") && (conf->autodev > 0 || conf->pts > 0))
2066 needs_warning = true;
2067 else if (!strcmp(tmp, "dev/ptmx") && (conf->autodev > 0 || conf->pts > 0))
2068 needs_warning = true;
2069 else if (!strcmp(tmp, "dev/pts/ptmx") && (conf->autodev > 0 || conf->pts > 0))
2070 needs_warning = true;
2071 else if (!strcmp(tmp, "dev/null") && conf->autodev > 0)
2072 needs_warning = true;
2073 else if (!strcmp(tmp, "dev/zero") && conf->autodev > 0)
2074 needs_warning = true;
2075 else if (!strcmp(tmp, "dev/full") && conf->autodev > 0)
2076 needs_warning = true;
2077 else if (!strcmp(tmp, "dev/urandom") && conf->autodev > 0)
2078 needs_warning = true;
2079 else if (!strcmp(tmp, "dev/random") && conf->autodev > 0)
2080 needs_warning = true;
2081 else if (!strcmp(tmp, "dev/tty") && conf->autodev > 0)
2082 needs_warning = true;
2083 else if (!strncmp(tmp, "dev/tty", 7) && (conf->autodev > 0 || conf->tty > 0))
2084 needs_warning = true;
2085
2086 if (needs_warning)
2087 NOTICE("Requesting to mount \"%s\" on \"%s\" while requesting "
2088 "automatic device setup under \"/dev\"",
2089 clean_mnt_fsname, clean_mnt_dir);
2090
2091 free(clean_mnt_dir);
2092 free(clean_mnt_fsname);
2093}
2094
2095static int mount_file_entries(const struct lxc_conf *conf,
2096 const struct lxc_rootfs *rootfs, FILE *file,
1ae3c19f 2097 const char *lxc_name, const char *lxc_path)
911324ef 2098{
aaf901be
AM		 2099 struct mntent mntent;
2100 char buf[4096];
911324ef 2101 int ret = -1;
e76b8764 2102
aaf901be 2103 while (getmntent_r(file, &mntent, buf, sizeof(buf))) {
06749971
CB		 2104 log_notice_on_conflict(conf, mntent.mnt_fsname, mntent.mnt_dir);
2105
1ae3c19f
CB		 2106 if (!rootfs->path)
2107 ret = mount_entry_on_systemfs(&mntent);
2108 else if (mntent.mnt_dir[0] != '/')
2109 ret = mount_entry_on_relative_rootfs(&mntent, rootfs,
2110 lxc_name, lxc_path);
2111 else
2112 ret = mount_entry_on_absolute_rootfs(&mntent, rootfs,
2113 lxc_name, lxc_path);
2114 if (ret < 0)
2115 return -1;
0ad19a3f 2116 }
2117 ret = 0;
cd54d859 2118
1ae3c19f 2119 INFO("Set up mount entries");
e7938e9e
MN		 2120 return ret;
2121}
2122
06749971
CB		 2123static int setup_mount(const struct lxc_conf *conf,
2124 const struct lxc_rootfs *rootfs, const char *fstab,
42dff448 2125 const char *lxc_name, const char *lxc_path)
e7938e9e 2126{
42dff448 2127 FILE *f;
e7938e9e
MN		 2128 int ret;
2129
2130 if (!fstab)
2131 return 0;
2132
42dff448
CB		 2133 f = setmntent(fstab, "r");
2134 if (!f) {
2135 SYSERROR("Failed to open \"%s\"", fstab);
e7938e9e
MN		 2136 return -1;
2137 }
2138
06749971 2139 ret = mount_file_entries(conf, rootfs, f, lxc_name, lxc_path);
42dff448
CB		 2140 if (ret < 0)
2141 ERROR("Failed to set up mount entries");
e7938e9e 2142
42dff448 2143 endmntent(f);
0ad19a3f 2144 return ret;
2145}
2146
5ef5c9a3 2147FILE *make_anonymous_mount_file(struct lxc_list *mount)
e7938e9e 2148{
5ef5c9a3 2149 int ret;
e7938e9e 2150 char *mount_entry;
5ef5c9a3 2151 struct lxc_list *iterator;
6bd04140 2152 FILE *f;
5ef5c9a3
CB		 2153 int fd = -1;
2154
2155 fd = memfd_create("lxc_mount_file", MFD_CLOEXEC);
2156 if (fd < 0) {
2157 if (errno != ENOSYS)
2158 return NULL;
6bd04140
CB		 2159 f = tmpfile();
2160 TRACE("Created temporary mount file");
5ef5c9a3 2161 } else {
6bd04140
CB		 2162 f = fdopen(fd, "r+");
2163 TRACE("Created anonymous mount file");
5ef5c9a3 2164 }
e7938e9e 2165
6bd04140
CB		 2166 if (!f) {
2167 SYSERROR("Could not create mount file");
5ef5c9a3
CB		 2168 if (fd != -1)
2169 close(fd);
9fc7f8c0 2170 return NULL;
e7938e9e
MN		 2171 }
2172
2173 lxc_list_for_each(iterator, mount) {
2174 mount_entry = iterator->elem;
6bd04140 2175 ret = fprintf(f, "%s\n", mount_entry);
5ef5c9a3 2176 if (ret < strlen(mount_entry))
6bd04140 2177 WARN("Could not write mount entry to mount file");
5ef5c9a3
CB		 2178 }
2179
6bd04140
CB		 2180 ret = fseek(f, 0, SEEK_SET);
2181 if (ret < 0) {
2182 SYSERROR("Failed to seek mount file");
2183 fclose(f);
5ef5c9a3 2184 return NULL;
e7938e9e
MN		 2185 }
2186
6bd04140 2187 return f;
9fc7f8c0
TA		 2188}
2189
06749971
CB		 2190static int setup_mount_entries(const struct lxc_conf *conf,
2191 const struct lxc_rootfs *rootfs,
5ef5c9a3
CB		 2192 struct lxc_list *mount, const char *lxc_name,
2193 const char *lxc_path)
9fc7f8c0 2194{
19b5d755 2195 FILE *f;
9fc7f8c0
TA		 2196 int ret;
2197
19b5d755
CB		 2198 f = make_anonymous_mount_file(mount);
2199 if (!f)
9fc7f8c0 2200 return -1;
e7938e9e 2201
06749971 2202 ret = mount_file_entries(conf, rootfs, f, lxc_name, lxc_path);
e7938e9e 2203
19b5d755 2204 fclose(f);
e7938e9e
MN		 2205 return ret;
2206}
2207
bab88e68
CS		 2208static int parse_cap(const char *cap)
2209{
2210 char *ptr = NULL;
84760c11 2211 size_t i;
2212 int capid = -1;
bab88e68 2213
7035407c
DE		 2214 if (!strcmp(cap, "none"))
2215 return -2;
2216
bab88e68
CS		 2217 for (i = 0; i < sizeof(caps_opt)/sizeof(caps_opt[0]); i++) {
2218
2219 if (strcmp(cap, caps_opt[i].name))
2220 continue;
2221
2222 capid = caps_opt[i].value;
2223 break;
2224 }
2225
2226 if (capid < 0) {
2227 /* try to see if it's numeric, so the user may specify
2228 * capabilities that the running kernel knows about but
2229 * we don't */
2230 errno = 0;
2231 capid = strtol(cap, &ptr, 10);
2232 if (!ptr || *ptr != '\0' || errno != 0)
2233 /* not a valid number */
2234 capid = -1;
2235 else if (capid > lxc_caps_last_cap())
2236 /* we have a number but it's not a valid
2237 * capability */
2238 capid = -1;
2239 }
2240
2241 return capid;
2242}
2243
0769b82a
CS		 2244int in_caplist(int cap, struct lxc_list *caps)
2245{
2246 struct lxc_list *iterator;
2247 int capid;
2248
2249 lxc_list_for_each(iterator, caps) {
2250 capid = parse_cap(iterator->elem);
2251 if (capid == cap)
2252 return 1;
2253 }
2254
2255 return 0;
2256}
2257
81810dd1
DL		 2258static int setup_caps(struct lxc_list *caps)
2259{
2260 struct lxc_list *iterator;
2261 char *drop_entry;
bab88e68 2262 int capid;
81810dd1
DL		 2263
2264 lxc_list_for_each(iterator, caps) {
2265
2266 drop_entry = iterator->elem;
2267
bab88e68 2268 capid = parse_cap(drop_entry);
d55bc1ad 2269
81810dd1 2270 if (capid < 0) {
1e11be34
DL		 2271 ERROR("unknown capability %s", drop_entry);
2272 return -1;
81810dd1
DL		 2273 }
2274
2275 DEBUG("drop capability '%s' (%d)", drop_entry, capid);
2276
2277 if (prctl(PR_CAPBSET_DROP, capid, 0, 0, 0)) {
3ec1648d
SH		 2278 SYSERROR("failed to remove %s capability", drop_entry);
2279 return -1;
2280 }
81810dd1
DL		 2281
2282 }
2283
1fb86a7c
SH		 2284 DEBUG("capabilities have been setup");
2285
2286 return 0;
2287}
2288
2289static int dropcaps_except(struct lxc_list *caps)
2290{
2291 struct lxc_list *iterator;
2292 char *keep_entry;
1fb86a7c
SH		 2293 int i, capid;
2294 int numcaps = lxc_caps_last_cap() + 1;
959aee9c 2295 INFO("found %d capabilities", numcaps);
1fb86a7c 2296
2caf9a97
SH		 2297 if (numcaps <= 0 || numcaps > 200)
2298 return -1;
2299
1a0e70ac 2300 /* caplist[i] is 1 if we keep capability i */
1fb86a7c
SH		 2301 int *caplist = alloca(numcaps * sizeof(int));
2302 memset(caplist, 0, numcaps * sizeof(int));
2303
2304 lxc_list_for_each(iterator, caps) {
2305
2306 keep_entry = iterator->elem;
2307
bab88e68 2308 capid = parse_cap(keep_entry);
1fb86a7c 2309
7035407c
DE		 2310 if (capid == -2)
2311 continue;
2312
1fb86a7c
SH		 2313 if (capid < 0) {
2314 ERROR("unknown capability %s", keep_entry);
2315 return -1;
2316 }
2317
8255688a 2318 DEBUG("keep capability '%s' (%d)", keep_entry, capid);
1fb86a7c
SH		 2319
2320 caplist[capid] = 1;
2321 }
2322 for (i=0; i<numcaps; i++) {
2323 if (caplist[i])
2324 continue;
2325 if (prctl(PR_CAPBSET_DROP, i, 0, 0, 0)) {
3ec1648d
SH		 2326 SYSERROR("failed to remove capability %d", i);
2327 return -1;
2328 }
1fb86a7c
SH		 2329 }
2330
2331 DEBUG("capabilities have been setup");
81810dd1
DL		 2332
2333 return 0;
2334}
2335
c6d09e15
WB		 2336static int parse_resource(const char *res) {
2337 size_t i;
2338 int resid = -1;
2339
2340 for (i = 0; i < sizeof(limit_opt)/sizeof(limit_opt[0]); ++i) {
2341 if (strcmp(res, limit_opt[i].name) == 0)
2342 return limit_opt[i].value;
2343 }
2344
2345 /* try to see if it's numeric, so the user may specify
2346 * resources that the running kernel knows about but
2347 * we don't */
2348 if (lxc_safe_int(res, &resid) == 0)
2349 return resid;
2350 return -1;
2351}
2352
2353int setup_resource_limits(struct lxc_list *limits, pid_t pid) {
2354 struct lxc_list *it;
2355 struct lxc_limit *lim;
2356 int resid;
2357
2358 lxc_list_for_each(it, limits) {
2359 lim = it->elem;
2360
2361 resid = parse_resource(lim->resource);
2362 if (resid < 0) {
2363 ERROR("unknown resource %s", lim->resource);
2364 return -1;
2365 }
2366
f48b5fd8 2367#if HAVE_PRLIMIT || HAVE_PRLIMIT64
c6d09e15
WB		 2368 if (prlimit(pid, resid, &lim->limit, NULL) != 0) {
2369 ERROR("failed to set limit %s: %s", lim->resource, strerror(errno));
2370 return -1;
2371 }
f48b5fd8
FF		 2372#else
2373 ERROR("Cannot set limit %s as prlimit is missing", lim->resource);
2374 return -1;
2375#endif
c6d09e15
WB		 2376 }
2377 return 0;
2378}
2379
ae9242c8
SH		 2380static char *default_rootfs_mount = LXCROOTFSMOUNT;
2381
7b379ab3 2382struct lxc_conf *lxc_conf_init(void)
089cd8b8 2383{
7b379ab3 2384 struct lxc_conf *new;
26ddeedd 2385 int i;
7b379ab3 2386
13277ec4 2387 new = malloc(sizeof(*new));
7b379ab3 2388 if (!new) {
13277ec4 2389 ERROR("lxc_conf_init : %s", strerror(errno));
7b379ab3
MN		 2390 return NULL;
2391 }
2392 memset(new, 0, sizeof(*new));
2393
4b73005c 2394 new->loglevel = LXC_LOG_LEVEL_NOTSET;
cccc74b5 2395 new->personality = -1;
124fa0a8 2396 new->autodev = 1;
3a784510
CB		 2397 new->console.buffer_log_file = NULL;
2398 new->console.buffer_log_file_fd = -1;
2399 new->console.buffer_size = 0;
596a818d
DE		 2400 new->console.log_path = NULL;
2401 new->console.log_fd = -1;
28a4b0e5 2402 new->console.path = NULL;
63376d7d 2403 new->console.peer = -1;
b5159817
DE		 2404 new->console.peerpty.busy = -1;
2405 new->console.peerpty.master = -1;
2406 new->console.peerpty.slave = -1;
63376d7d
DL		 2407 new->console.master = -1;
2408 new->console.slave = -1;
2409 new->console.name[0] = '\0';
732375f5 2410 memset(&new->console.ringbuf, 0, sizeof(struct lxc_ringbuf));
d2e30e99 2411 new->maincmd_fd = -1;
76a26f55 2412 new->nbd_idx = -1;
54c30e29 2413 new->rootfs.mount = strdup(default_rootfs_mount);
53f3f048 2414 if (!new->rootfs.mount) {
13277ec4 2415 ERROR("lxc_conf_init : %s", strerror(errno));
53f3f048
SH		 2416 free(new);
2417 return NULL;
2418 }
858377e4 2419 new->logfd = -1;
7b379ab3
MN		 2420 lxc_list_init(&new->cgroup);
2421 lxc_list_init(&new->network);
2422 lxc_list_init(&new->mount_list);
81810dd1 2423 lxc_list_init(&new->caps);
1fb86a7c 2424 lxc_list_init(&new->keepcaps);
f6d3e3e4 2425 lxc_list_init(&new->id_map);
f979ac15 2426 lxc_list_init(&new->includes);
4184c3e1 2427 lxc_list_init(&new->aliens);
7c661726 2428 lxc_list_init(&new->environment);
c6d09e15 2429 lxc_list_init(&new->limits);
28d9e29e 2430 for (i = 0; i < NUM_LXC_HOOKS; i++)
26ddeedd 2431 lxc_list_init(&new->hooks[i]);
ee1e7aa0 2432 lxc_list_init(&new->groups);
fe4de9a6
DE		 2433 new->lsm_aa_profile = NULL;
2434 new->lsm_se_context = NULL;
5112cd70 2435 new->tmp_umount_proc = 0;
7b379ab3 2436
72bb04e4
PT		 2437 /* if running in a new user namespace, init and COMMAND
2438 * default to running as UID/GID 0 when using lxc-execute */
2439 new->init_uid = 0;
2440 new->init_gid = 0;
43654d34 2441 memset(&new->cgroup_meta, 0, sizeof(struct lxc_cgroup));
28d9e29e 2442 memset(&new->inherit_ns, 0, sizeof(char *) * LXC_NS_MAX);
72bb04e4 2443
7b379ab3 2444 return new;
089cd8b8
DL		 2445}
2446
251d0d2a
DE		 2447static int write_id_mapping(enum idtype idtype, pid_t pid, const char *buf,
2448 size_t buf_size)
f6d3e3e4 2449{
29053180
CB		 2450 char path[MAXPATHLEN];
2451 int fd, ret;
f6d3e3e4 2452
29053180
CB		 2453 ret = snprintf(path, MAXPATHLEN, "/proc/%d/%cid_map", pid,
2454 idtype == ID_TYPE_UID ? 'u' : 'g');
2455 if (ret < 0 || ret >= MAXPATHLEN) {
2456 ERROR("failed to create path \"%s\"", path);
f6d3e3e4
SH		 2457 return -E2BIG;
2458 }
29053180
CB		 2459
2460 fd = open(path, O_WRONLY);
2461 if (fd < 0) {
2462 SYSERROR("failed to open \"%s\"", path);
2463 return -1;
f6d3e3e4 2464 }
29053180
CB		 2465
2466 errno = 0;
2467 ret = lxc_write_nointr(fd, buf, buf_size);
2468 if (ret != buf_size) {
2469 SYSERROR("failed to write %cid mapping to \"%s\"",
2470 idtype == ID_TYPE_UID ? 'u' : 'g', path);
2471 close(fd);
2472 return -1;
2473 }
2474 close(fd);
2475
2476 return 0;
f6d3e3e4
SH		 2477}
2478
6e50e704
CB		 2479/* Check whether a binary exist and has either CAP_SETUID, CAP_SETGID or both.
2480 *
2481 * @return 1 if functional binary was found
2482 * @return 0 if binary exists but is lacking privilege
2483 * @return -ENOENT if binary does not exist
2484 * @return -EINVAL if cap to check is neither CAP_SETUID nor CAP_SETGID
2485 *
2486 */
df6a2945
CB		 2487static int idmaptool_on_path_and_privileged(const char *binary, cap_value_t cap)
2488{
2489 char *path;
2490 int ret;
2491 struct stat st;
2492 int fret = 0;
2493
6e50e704
CB		 2494 if (cap != CAP_SETUID && cap != CAP_SETGID)
2495 return -EINVAL;
2496
df6a2945
CB		 2497 path = on_path(binary, NULL);
2498 if (!path)
2499 return -ENOENT;
2500
2501 ret = stat(path, &st);
2502 if (ret < 0) {
2503 fret = -errno;
2504 goto cleanup;
2505 }
2506
2507 /* Check if the binary is setuid. */
2508 if (st.st_mode & S_ISUID) {
2509 DEBUG("The binary \"%s\" does have the setuid bit set.", path);
2510 fret = 1;
2511 goto cleanup;
2512 }
2513
69924fff 2514 #if HAVE_LIBCAP && LIBCAP_SUPPORTS_FILE_CAPABILITIES
df6a2945
CB		 2515 /* Check if it has the CAP_SETUID capability. */
2516 if ((cap & CAP_SETUID) &&
2517 lxc_file_cap_is_set(path, CAP_SETUID, CAP_EFFECTIVE) &&
2518 lxc_file_cap_is_set(path, CAP_SETUID, CAP_PERMITTED)) {
2519 DEBUG("The binary \"%s\" has CAP_SETUID in its CAP_EFFECTIVE "
2520 "and CAP_PERMITTED sets.", path);
2521 fret = 1;
2522 goto cleanup;
2523 }
2524
2525 /* Check if it has the CAP_SETGID capability. */
2526 if ((cap & CAP_SETGID) &&
2527 lxc_file_cap_is_set(path, CAP_SETGID, CAP_EFFECTIVE) &&
2528 lxc_file_cap_is_set(path, CAP_SETGID, CAP_PERMITTED)) {
2529 DEBUG("The binary \"%s\" has CAP_SETGID in its CAP_EFFECTIVE "
2530 "and CAP_PERMITTED sets.", path);
2531 fret = 1;
2532 goto cleanup;
2533 }
d6018f88 2534 #else
69924fff
CB		 2535 /* If we cannot check for file capabilities we need to give the benefit
2536 * of the doubt. Otherwise we might fail even though all the necessary
2537 * file capabilities are set.
2538 */
d6018f88
CB		 2539 DEBUG("Cannot check for file capabilites as full capability support is "
2540 "missing. Manual intervention needed.");
2541 fret = 1;
df6a2945
CB		 2542 #endif
2543
2544cleanup:
2545 free(path);
2546 return fret;
2547}
2548
986ef930
CB		 2549int lxc_map_ids_exec_wrapper(void *args)
2550{
2551 execl("/bin/sh", "sh", "-c", (char *)args, (char *)NULL);
2552 return -1;
2553}
2554
f6d3e3e4
SH		 2555int lxc_map_ids(struct lxc_list *idmap, pid_t pid)
2556{
f6d3e3e4 2557 struct id_map *map;
4bc3b759 2558 struct lxc_list *iterator;
251d0d2a 2559 enum idtype type;
986ef930 2560 char u_or_g;
4bc3b759 2561 char *pos;
99d43365 2562 int fill, left;
986ef930
CB		 2563 char cmd_output[MAXPATHLEN];
2564 /* strlen("new@idmap") = 9
2565 * +
2566 * strlen(" ") = 1
2567 * +
2568 * LXC_NUMSTRLEN64
2569 * +
2570 * strlen(" ") = 1
2571 *
2572 * We add some additional space to make sure that we really have
2573 * LXC_IDMAPLEN bytes available for our the {g,u]id mapping.
2574 */
2575 char mapbuf[9 + 1 + LXC_NUMSTRLEN64 + 1 + LXC_IDMAPLEN] = {0};
2576 int ret = 0, uidmap = 0, gidmap = 0;
2577 bool use_shadow = false, had_entry = false;
df6a2945
CB		 2578
2579 /* If new{g,u}idmap exists, that is, if shadow is handing out subuid
2580 * ranges, then insist that root also reserve ranges in subuid. This
22038de5
SH		 2581 * will protected it by preventing another user from being handed the
2582 * range by shadow.
2583 */
df6a2945 2584 uidmap = idmaptool_on_path_and_privileged("newuidmap", CAP_SETUID);
6e50e704
CB		 2585 if (uidmap == -ENOENT)
2586 WARN("newuidmap binary is missing");
2587 else if (!uidmap)
2588 WARN("newuidmap is lacking necessary privileges");
2589
df6a2945 2590 gidmap = idmaptool_on_path_and_privileged("newgidmap", CAP_SETGID);
6e50e704
CB		 2591 if (gidmap == -ENOENT)
2592 WARN("newgidmap binary is missing");
2593 else if (!gidmap)
2594 WARN("newgidmap is lacking necessary privileges");
2595
df6a2945
CB		 2596 if (uidmap > 0 && gidmap > 0) {
2597 DEBUG("Functional newuidmap and newgidmap binary found.");
4bc3b759 2598 use_shadow = true;
df6a2945 2599 } else {
99d43365
CB		 2600 /* In case unprivileged users run application containers via
2601 * execute() or a start*() there are valid cases where they may
2602 * only want to map their own {g,u}id. Let's not block them from
2603 * doing so by requiring geteuid() == 0.
2604 */
2605 DEBUG("No newuidmap and newgidmap binary found. Trying to "
2606 "write directly with euid %d.", geteuid());
0e6e3a41 2607 }
251d0d2a 2608
986ef930
CB		 2609 for (type = ID_TYPE_UID, u_or_g = 'u'; type <= ID_TYPE_GID;
2610 type++, u_or_g = 'g') {
2611 pos = mapbuf;
2612
0e6e3a41 2613 if (use_shadow)
986ef930 2614 pos += sprintf(mapbuf, "new%cidmap %d", u_or_g, pid);
4f7521b4 2615
cf3ef16d 2616 lxc_list_for_each(iterator, idmap) {
251d0d2a 2617 map = iterator->elem;
cf3ef16d
SH		 2618 if (map->idtype != type)
2619 continue;
2620
4bc3b759
CB		 2621 had_entry = true;
2622
986ef930 2623 left = LXC_IDMAPLEN - (pos - mapbuf);
d1838f34 2624 fill = snprintf(pos, left, "%s%lu %lu %lu%s",
4bc3b759
CB		 2625 use_shadow ? " " : "", map->nsid,
2626 map->hostid, map->range,
0e6e3a41 2627 use_shadow ? "" : "\n");
a427e268
CB		 2628 if (fill <= 0 || fill >= left) {
2629 /* The kernel only takes <= 4k for writes to
2630 * /proc/<pid>/{g,u}id_map
2631 */
2632 SYSERROR("Too many %cid mappings defined", u_or_g);
2633 return -1;
2634 }
4bc3b759 2635
cf3ef16d 2636 pos += fill;
251d0d2a 2637 }
cf3ef16d 2638 if (!had_entry)
4f7521b4 2639 continue;
cf3ef16d 2640
986ef930
CB		 2641 /* Try to catch the ouput of new{g,u}idmap to make debugging
2642 * easier.
2643 */
2644 if (use_shadow) {
2645 ret = run_command(cmd_output, sizeof(cmd_output),
2646 lxc_map_ids_exec_wrapper,
2647 (void *)mapbuf);
2648 if (ret < 0) {
54fbbeb5
CB		 2649 ERROR("new%cidmap failed to write mapping \"%s\": %s",
2650 u_or_g, cmd_output, mapbuf);
986ef930
CB		 2651 return -1;
2652 }
54fbbeb5 2653 TRACE("new%cidmap wrote mapping \"%s\"", u_or_g, mapbuf);
d1838f34 2654 } else {
986ef930 2655 ret = write_id_mapping(type, pid, mapbuf, pos - mapbuf);
54fbbeb5 2656 if (ret < 0) {
da0f9977 2657 ERROR("Failed to write mapping: %s", mapbuf);
986ef930 2658 return -1;
54fbbeb5
CB		 2659 }
2660 TRACE("Wrote mapping \"%s\"", mapbuf);
d1838f34 2661 }
986ef930
CB		 2662
2663 memset(mapbuf, 0, sizeof(mapbuf));
f6d3e3e4 2664 }
251d0d2a 2665
986ef930 2666 return 0;
f6d3e3e4
SH		 2667}
2668
cf3ef16d 2669/*
7b50c609
TS		 2670 * return the host uid/gid to which the container root is mapped in
2671 * *val.
0b3a6504 2672 * Return true if id was found, false otherwise.
cf3ef16d 2673 */
2a9a80cb 2674bool get_mapped_rootid(struct lxc_conf *conf, enum idtype idtype,
3ec1648d 2675 unsigned long *val)
cf3ef16d
SH		 2676{
2677 struct lxc_list *it;
2678 struct id_map *map;
2679
2680 lxc_list_for_each(it, &conf->id_map) {
2681 map = it->elem;
7b50c609 2682 if (map->idtype != idtype)
cf3ef16d
SH		 2683 continue;
2684 if (map->nsid != 0)
2685 continue;
2a9a80cb
SH		 2686 *val = map->hostid;
2687 return true;
cf3ef16d 2688 }
2a9a80cb 2689 return false;
cf3ef16d
SH		 2690}
2691
2133f58c 2692int mapped_hostid(unsigned id, struct lxc_conf *conf, enum idtype idtype)
cf3ef16d
SH		 2693{
2694 struct lxc_list *it;
2695 struct id_map *map;
2696 lxc_list_for_each(it, &conf->id_map) {
2697 map = it->elem;
2133f58c 2698 if (map->idtype != idtype)
cf3ef16d
SH		 2699 continue;
2700 if (id >= map->hostid && id < map->hostid + map->range)
57d116ab 2701 return (id - map->hostid) + map->nsid;
cf3ef16d 2702 }
57d116ab 2703 return -1;
cf3ef16d
SH		 2704}
2705
339efad9 2706int find_unmapped_nsid(struct lxc_conf *conf, enum idtype idtype)
cf3ef16d
SH		 2707{
2708 struct lxc_list *it;
2709 struct id_map *map;
2133f58c 2710 unsigned int freeid = 0;
cf3ef16d
SH		 2711again:
2712 lxc_list_for_each(it, &conf->id_map) {
2713 map = it->elem;
2133f58c 2714 if (map->idtype != idtype)
cf3ef16d
SH		 2715 continue;
2716 if (freeid >= map->nsid && freeid < map->nsid + map->range) {
2717 freeid = map->nsid + map->range;
2718 goto again;
2719 }
2720 }
2721 return freeid;
2722}
2723
f4f52cb5
CB		 2724int chown_mapped_root_exec_wrapper(void *args)
2725{
2726 execvp("lxc-usernsexec", args);
2727 return -1;
2728}
2729
f6d3e3e4 2730/*
7b50c609
TS		 2731 * chown_mapped_root: for an unprivileged user with uid/gid X to
2732 * chown a dir to subuid/subgid Y, he needs to run chown as root
2733 * in a userns where nsid 0 is mapped to hostuid/hostgid Y, and
2734 * nsid Y is mapped to hostuid/hostgid X. That way, the container
2735 * root is privileged with respect to hostuid/hostgid X, allowing
2736 * him to do the chown.
f6d3e3e4 2737 */
41dc7155 2738int chown_mapped_root(const char *path, struct lxc_conf *conf)
f6d3e3e4 2739{
f4f52cb5 2740 uid_t rootuid, rootgid;
2a9a80cb 2741 unsigned long val;
f4f52cb5
CB		 2742 int hostuid, hostgid, ret;
2743 struct stat sb;
2744 char map1[100], map2[100], map3[100], map4[100], map5[100];
2745 char ugid[100];
41dc7155 2746 const char *args1[] = {"lxc-usernsexec",
f4f52cb5
CB		 2747 "-m", map1,
2748 "-m", map2,
2749 "-m", map3,
2750 "-m", map5,
2751 "--", "chown", ugid, path,
2752 NULL};
41dc7155 2753 const char *args2[] = {"lxc-usernsexec",
f4f52cb5
CB		 2754 "-m", map1,
2755 "-m", map2,
2756 "-m", map3,
2757 "-m", map4,
2758 "-m", map5,
2759 "--", "chown", ugid, path,
2760 NULL};
2761 char cmd_output[MAXPATHLEN];
2762
2763 hostuid = geteuid();
2764 hostgid = getegid();
f6d3e3e4 2765
2a9a80cb 2766 if (!get_mapped_rootid(conf, ID_TYPE_UID, &val)) {
bc80f098 2767 ERROR("No uid mapping for container root");
c4d10a05 2768 return -1;
f6d3e3e4 2769 }
f4f52cb5 2770 rootuid = (uid_t)val;
7b50c609 2771 if (!get_mapped_rootid(conf, ID_TYPE_GID, &val)) {
bc80f098 2772 ERROR("No gid mapping for container root");
7b50c609
TS		 2773 return -1;
2774 }
f4f52cb5 2775 rootgid = (gid_t)val;
2a9a80cb 2776
f4f52cb5 2777 if (hostuid == 0) {
7b50c609 2778 if (chown(path, rootuid, rootgid) < 0) {
c4d10a05
SH		 2779 ERROR("Error chowning %s", path);
2780 return -1;
2781 }
2782 return 0;
2783 }
f3d7e4ca 2784
f4f52cb5 2785 if (rootuid == hostuid) {
1a0e70ac 2786 /* nothing to do */
b103ceac 2787 INFO("Container root is our uid; no need to chown");
f3d7e4ca
SH		 2788 return 0;
2789 }
2790
bbdbf8f0 2791 /* save the current gid of "path" */
f4f52cb5
CB		 2792 if (stat(path, &sb) < 0) {
2793 ERROR("Error stat %s", path);
f6d3e3e4
SH		 2794 return -1;
2795 }
7b50c609 2796
bbdbf8f0
CB		 2797 /* Update the path argument in case this was overlayfs. */
2798 args1[sizeof(args1) / sizeof(args1[0]) - 2] = path;
2799 args2[sizeof(args2) / sizeof(args2[0]) - 2] = path;
2800
f4f52cb5
CB		 2801 /*
2802 * A file has to be group-owned by a gid mapped into the
2803 * container, or the container won't be privileged over it.
2804 */
2805 DEBUG("trying to chown \"%s\" to %d", path, hostgid);
2806 if (sb.st_uid == hostuid &&
2807 mapped_hostid(sb.st_gid, conf, ID_TYPE_GID) < 0 &&
2808 chown(path, -1, hostgid) < 0) {
2809 ERROR("Failed chgrping %s", path);
2810 return -1;
2811 }
f6d3e3e4 2812
1a0e70ac 2813 /* "u:0:rootuid:1" */
f4f52cb5
CB		 2814 ret = snprintf(map1, 100, "u:0:%d:1", rootuid);
2815 if (ret < 0 || ret >= 100) {
2816 ERROR("Error uid printing map string");
2817 return -1;
2818 }
7b50c609 2819
1a0e70ac 2820 /* "u:hostuid:hostuid:1" */
f4f52cb5
CB		 2821 ret = snprintf(map2, 100, "u:%d:%d:1", hostuid, hostuid);
2822 if (ret < 0 || ret >= 100) {
2823 ERROR("Error uid printing map string");
2824 return -1;
2825 }
c4d10a05 2826
1a0e70ac 2827 /* "g:0:rootgid:1" */
f4f52cb5
CB		 2828 ret = snprintf(map3, 100, "g:0:%d:1", rootgid);
2829 if (ret < 0 || ret >= 100) {
2830 ERROR("Error gid printing map string");
2831 return -1;
2832 }
98e5ba51 2833
1a0e70ac 2834 /* "g:pathgid:rootgid+pathgid:1" */
f4f52cb5
CB		 2835 ret = snprintf(map4, 100, "g:%d:%d:1", (gid_t)sb.st_gid,
2836 rootgid + (gid_t)sb.st_gid);
2837 if (ret < 0 || ret >= 100) {
2838 ERROR("Error gid printing map string");
2839 return -1;
2840 }
c4d10a05 2841
1a0e70ac 2842 /* "g:hostgid:hostgid:1" */
f4f52cb5
CB		 2843 ret = snprintf(map5, 100, "g:%d:%d:1", hostgid, hostgid);
2844 if (ret < 0 || ret >= 100) {
2845 ERROR("Error gid printing map string");
2846 return -1;
2847 }
7b50c609 2848
1a0e70ac 2849 /* "0:pathgid" (chown) */
f4f52cb5
CB		 2850 ret = snprintf(ugid, 100, "0:%d", (gid_t)sb.st_gid);
2851 if (ret < 0 || ret >= 100) {
2852 ERROR("Error owner printing format string for chown");
2853 return -1;
2854 }
7b50c609 2855
f4f52cb5
CB		 2856 if (hostgid == sb.st_gid)
2857 ret = run_command(cmd_output, sizeof(cmd_output),
2858 chown_mapped_root_exec_wrapper,
2859 (void *)args1);
2860 else
2861 ret = run_command(cmd_output, sizeof(cmd_output),
2862 chown_mapped_root_exec_wrapper,
2863 (void *)args2);
2864 if (ret < 0)
2865 ERROR("lxc-usernsexec failed: %s", cmd_output);
7b50c609 2866
f4f52cb5 2867 return ret;
f6d3e3e4
SH		 2868}
2869
54117de5 2870int lxc_ttys_shift_ids(struct lxc_conf *c)
f6d3e3e4 2871{
c4d10a05 2872 if (lxc_list_empty(&c->id_map))
f6d3e3e4 2873 return 0;
c4d10a05 2874
54117de5
CB		 2875 if (!strcmp(c->console.name, ""))
2876 return 0;
2877
2878 if (chown_mapped_root(c->console.name, c) < 0) {
2879 ERROR("failed to chown console \"%s\"", c->console.name);
c4d10a05
SH		 2880 return -1;
2881 }
2882
54117de5
CB		 2883 TRACE("chowned console \"%s\"", c->console.name);
2884
f6d3e3e4
SH		 2885 return 0;
2886}
2887
943144d9
CB		 2888/* NOTE: Must not be called from inside the container namespace! */
2889int lxc_create_tmp_proc_mount(struct lxc_conf *conf)
5112cd70
SH		 2890{
2891 int mounted;
2892
943144d9 2893 mounted = lxc_mount_proc_if_needed(conf->rootfs.path ? conf->rootfs.mount : "");
5112cd70 2894 if (mounted == -1) {
943144d9 2895 SYSERROR("failed to mount /proc in the container");
01958b1f 2896 /* continue only if there is no rootfs */
943144d9 2897 if (conf->rootfs.path)
01958b1f 2898 return -1;
5112cd70 2899 } else if (mounted == 1) {
943144d9 2900 conf->tmp_umount_proc = 1;
5112cd70 2901 }
943144d9 2902
5112cd70
SH		 2903 return 0;
2904}
2905
2906void tmp_proc_unmount(struct lxc_conf *lxc_conf)
2907{
2908 if (lxc_conf->tmp_umount_proc == 1) {
2909 umount("/proc");
2910 lxc_conf->tmp_umount_proc = 0;
2911 }
2912}
2913
6a0c909a 2914void remount_all_slave(void)
e995d7a2
SH		 2915{
2916 /* walk /proc/mounts and change any shared entries to slave */
2917 FILE *f = fopen("/proc/self/mountinfo", "r");
2918 char *line = NULL;
2919 size_t len = 0;
2920
2921 if (!f) {
2922 SYSERROR("Failed to open /proc/self/mountinfo to mark all shared");
2923 ERROR("Continuing container startup...");
2924 return;
2925 }
2926
2927 while (getline(&line, &len, f) != -1) {
2928 char *target, *opts;
2929 target = get_field(line, 4);
2930 if (!target)
2931 continue;
2932 opts = get_field(target, 2);
2933 if (!opts)
2934 continue;
2935 null_endofword(opts);
2936 if (!strstr(opts, "shared"))
2937 continue;
2938 null_endofword(target);
2939 if (mount(NULL, target, NULL, MS_SLAVE, NULL)) {
2940 SYSERROR("Failed to make %s rslave", target);
2941 ERROR("Continuing...");
2942 }
2943 }
2944 fclose(f);
f10fad2f 2945 free(line);
e995d7a2
SH		 2946}
2947
2322903b
SH		 2948void lxc_execute_bind_init(struct lxc_conf *conf)
2949{
2950 int ret;
9d9c111c
SH		 2951 char path[PATH_MAX], destpath[PATH_MAX], *p;
2952
2953 /* If init exists in the container, don't bind mount a static one */
2954 p = choose_init(conf->rootfs.mount);
2955 if (p) {
2956 free(p);
2957 return;
2958 }
2322903b
SH		 2959
2960 ret = snprintf(path, PATH_MAX, SBINDIR "/init.lxc.static");
2961 if (ret < 0 || ret >= PATH_MAX) {
2962 WARN("Path name too long searching for lxc.init.static");
2963 return;
2964 }
2965
2966 if (!file_exists(path)) {
2967 INFO("%s does not exist on host", path);
2968 return;
2969 }
2970
2971 ret = snprintf(destpath, PATH_MAX, "%s%s", conf->rootfs.mount, "/init.lxc.static");
2972 if (ret < 0 || ret >= PATH_MAX) {
2973 WARN("Path name too long for container's lxc.init.static");
2974 return;
2975 }
2976
2977 if (!file_exists(destpath)) {
2978 FILE * pathfile = fopen(destpath, "wb");
2979 if (!pathfile) {
2980 SYSERROR("Failed to create mount target '%s'", destpath);
2981 return;
2982 }
2983 fclose(pathfile);
2984 }
2985
592fd47a 2986 ret = safe_mount(path, destpath, "none", MS_BIND, NULL, conf->rootfs.mount);
2322903b
SH		 2987 if (ret < 0)
2988 SYSERROR("Failed to bind lxc.init.static into container");
2989 INFO("lxc.init.static bound into container at %s", path);
2990}
2991
35120d9c
SH		 2992/*
2993 * This does the work of remounting / if it is shared, calling the
2994 * container pre-mount hooks, and mounting the rootfs.
2995 */
2996int do_rootfs_setup(struct lxc_conf *conf, const char *name, const char *lxcpath)
0ad19a3f 2997{
35120d9c
SH		 2998 if (conf->rootfs_setup) {
2999 /*
3000 * rootfs was set up in another namespace. bind-mount it
3001 * to give us a mount in our own ns so we can pivot_root to it
3002 */
3003 const char *path = conf->rootfs.mount;
3004 if (mount(path, path, "rootfs", MS_BIND, NULL) < 0) {
3005 ERROR("Failed to bind-mount container / onto itself");
145832ba 3006 return -1;
35120d9c 3007 }
145832ba 3008 return 0;
35120d9c 3009 }
d4ef7c50 3010
e995d7a2
SH		 3011 remount_all_slave();
3012
35120d9c
SH		 3013 if (run_lxc_hooks(name, "pre-mount", conf, lxcpath, NULL)) {
3014 ERROR("failed to run pre-mount hooks for container '%s'.", name);
3015 return -1;
3016 }
3017
9aa76a17 3018 if (lxc_setup_rootfs(conf)) {
35120d9c
SH		 3019 ERROR("failed to setup rootfs for '%s'", name);
3020 return -1;
3021 }
3022
3023 conf->rootfs_setup = true;
3024 return 0;
3025}
3026
1c1c7051
SH		 3027static bool verify_start_hooks(struct lxc_conf *conf)
3028{
3029 struct lxc_list *it;
3030 char path[MAXPATHLEN];
3031 lxc_list_for_each(it, &conf->hooks[LXCHOOK_START]) {
3032 char *hookname = it->elem;
3033 struct stat st;
3034 int ret;
3035
3036 ret = snprintf(path, MAXPATHLEN, "%s%s",
7b6753e7 3037 conf->rootfs.path ? conf->rootfs.mount : "", hookname);
1c1c7051
SH		 3038 if (ret < 0 || ret >= MAXPATHLEN)
3039 return false;
3040 ret = stat(path, &st);
3041 if (ret) {
7b6753e7 3042 SYSERROR("Start hook %s not found in container",
1c1c7051
SH		 3043 hookname);
3044 return false;
3045 }
6a0c909a 3046 return true;
1c1c7051
SH		 3047 }
3048
3049 return true;
3050}
3051
3b988b33 3052int lxc_setup(struct lxc_handler *handler)
35120d9c 3053{
2187efd3 3054 int ret;
35120d9c
SH		 3055 const char *name = handler->name;
3056 struct lxc_conf *lxc_conf = handler->conf;
3057 const char *lxcpath = handler->lxcpath;
35120d9c
SH		 3058
3059 if (do_rootfs_setup(lxc_conf, name, lxcpath) < 0) {
3060 ERROR("Error setting up rootfs mount after spawn");
3061 return -1;
3062 }
3063
28d9e29e 3064 if (handler->nsfd[LXC_NS_UTS] == -1) {
6c544cb3
MM		 3065 if (setup_utsname(lxc_conf->utsname)) {
3066 ERROR("failed to setup the utsname for '%s'", name);
3067 return -1;
3068 }
0ad19a3f 3069 }
3070
811ef482 3071 if (lxc_setup_network_in_child_namespaces(lxc_conf, &lxc_conf->network)) {
36eb9bde 3072 ERROR("failed to setup the network for '%s'", name);
95b5ffaf 3073 return -1;
0ad19a3f 3074 }
3075
790255cf
CB		 3076 if (lxc_network_send_name_and_ifindex_to_parent(handler) < 0) {
3077 ERROR("Failed to network device names and ifindices to parent");
3078 return -1;
3079 }
3080
bc6928ff 3081 if (lxc_conf->autodev > 0) {
14221cbb 3082 if (mount_autodev(name, &lxc_conf->rootfs, lxcpath)) {
91c3830e 3083 ERROR("failed to mount /dev in the container");
c6883f38
SH		 3084 return -1;
3085 }
3086 }
3087
368bbc02
CS		 3088 /* do automatic mounts (mainly /proc and /sys), but exclude
3089 * those that need to wait until other stuff has finished
3090 */
4fb3cba5 3091 if (lxc_mount_auto_mounts(lxc_conf, lxc_conf->auto_mounts & ~LXC_AUTO_CGROUP_MASK, handler) < 0) {
368bbc02
CS		 3092 ERROR("failed to setup the automatic mounts for '%s'", name);
3093 return -1;
3094 }
3095
06749971 3096 if (setup_mount(lxc_conf, &lxc_conf->rootfs, lxc_conf->fstab, name, lxcpath)) {
36eb9bde 3097 ERROR("failed to setup the mounts for '%s'", name);
95b5ffaf 3098 return -1;
576f946d 3099 }
3100
06749971 3101 if (!lxc_list_empty(&lxc_conf->mount_list) && setup_mount_entries(lxc_conf, &lxc_conf->rootfs, &lxc_conf->mount_list, name, lxcpath)) {
e7938e9e
MN		 3102 ERROR("failed to setup the mount entries for '%s'", name);
3103 return -1;
3104 }
3105
7b6753e7 3106 /* Make sure any start hooks are in the container */
1c1c7051
SH		 3107 if (!verify_start_hooks(lxc_conf))
3108 return -1;
3109
2322903b
SH		 3110 if (lxc_conf->is_execute)
3111 lxc_execute_bind_init(lxc_conf);
3112
368bbc02
CS		 3113 /* now mount only cgroup, if wanted;
3114 * before, /sys could not have been mounted
3115 * (is either mounted automatically or via fstab entries)
3116 */
4fb3cba5 3117 if (lxc_mount_auto_mounts(lxc_conf, lxc_conf->auto_mounts & LXC_AUTO_CGROUP_MASK, handler) < 0) {
368bbc02
CS		 3118 ERROR("failed to setup the automatic mounts for '%s'", name);
3119 return -1;
3120 }
3121
283678ed 3122 if (run_lxc_hooks(name, "mount", lxc_conf, lxcpath, NULL)) {
773fb9ca
SH		 3123 ERROR("failed to run mount hooks for container '%s'.", name);
3124 return -1;
3125 }
3126
bc6928ff 3127 if (lxc_conf->autodev > 0) {
283678ed 3128 if (run_lxc_hooks(name, "autodev", lxc_conf, lxcpath, NULL)) {
f7bee6c6
MW		 3129 ERROR("failed to run autodev hooks for container '%s'.", name);
3130 return -1;
3131 }
06749971 3132
27245ff7 3133 if (lxc_fill_autodev(&lxc_conf->rootfs)) {
91c3830e
SH		 3134 ERROR("failed to populate /dev in the container");
3135 return -1;
3136 }
3137 }
368bbc02 3138
ed8704d0
CB		 3139 ret = lxc_setup_console(&lxc_conf->rootfs, &lxc_conf->console,
3140 lxc_conf->ttydir);
3141 if (ret < 0) {
3142 ERROR("Failed to setup console");
95b5ffaf 3143 return -1;
6e590161 3144 }
3145
ed8704d0
CB		 3146 ret = lxc_setup_dev_symlinks(&lxc_conf->rootfs);
3147 if (ret < 0) {
3148 ERROR("Failed to setup /dev symlinks");
69aa6655
DE		 3149 return -1;
3150 }
3151
5112cd70 3152 /* mount /proc if it's not already there */
943144d9 3153 if (lxc_create_tmp_proc_mount(lxc_conf) < 0) {
fe4de9a6 3154 ERROR("failed to LSM mount proc for '%s'", name);
e075f5d9 3155 return -1;
e075f5d9 3156 }
e075f5d9 3157
ac778708 3158 if (setup_pivot_root(&lxc_conf->rootfs)) {
36eb9bde 3159 ERROR("failed to set rootfs for '%s'", name);
95b5ffaf 3160 return -1;
ed502555 3161 }
3162
70761e5e 3163 if (lxc_setup_devpts(lxc_conf->pts)) {
36eb9bde 3164 ERROR("failed to setup the new pts instance");
95b5ffaf 3165 return -1;
3c26f34e 3166 }
3167
2187efd3
CB		 3168 ret = lxc_create_ttys(handler);
3169 if (ret < 0)
e8bd4e43 3170 return -1;
e8bd4e43 3171
cccc74b5
DL		 3172 if (setup_personality(lxc_conf->personality)) {
3173 ERROR("failed to setup personality");
3174 return -1;
3175 }
3176
97a8f74f
SG		 3177 if (!lxc_list_empty(&lxc_conf->keepcaps)) {
3178 if (!lxc_list_empty(&lxc_conf->caps)) {
7389ca26 3179 ERROR("Container requests lxc.cap.drop and lxc.cap.keep: either use lxc.cap.drop or lxc.cap.keep, not both.");
f6d3e3e4
SH		 3180 return -1;
3181 }
97a8f74f
SG		 3182 if (dropcaps_except(&lxc_conf->keepcaps)) {
3183 ERROR("failed to keep requested caps");
3184 return -1;
3185 }
3186 } else if (setup_caps(&lxc_conf->caps)) {
3187 ERROR("failed to drop capabilities");
3188 return -1;
81810dd1
DL		 3189 }
3190
f4152036 3191 NOTICE("Container \"%s\" is set up", name);
cd54d859 3192
0ad19a3f 3193 return 0;
3194}
26ddeedd 3195
283678ed
SH		 3196int run_lxc_hooks(const char *name, char *hook, struct lxc_conf *conf,
3197 const char *lxcpath, char *argv[])
26ddeedd
SH		 3198{
3199 int which = -1;
3200 struct lxc_list *it;
3201
3202 if (strcmp(hook, "pre-start") == 0)
3203 which = LXCHOOK_PRESTART;
08dd2805
SH		 3204 else if (strcmp(hook, "start-host") == 0)
3205 which = LXCHOOK_START_HOST;
5ea6163a
SH		 3206 else if (strcmp(hook, "pre-mount") == 0)
3207 which = LXCHOOK_PREMOUNT;
26ddeedd
SH		 3208 else if (strcmp(hook, "mount") == 0)
3209 which = LXCHOOK_MOUNT;
f7bee6c6
MW		 3210 else if (strcmp(hook, "autodev") == 0)
3211 which = LXCHOOK_AUTODEV;
26ddeedd
SH		 3212 else if (strcmp(hook, "start") == 0)
3213 which = LXCHOOK_START;
52492063
WB		 3214 else if (strcmp(hook, "stop") == 0)
3215 which = LXCHOOK_STOP;
26ddeedd
SH		 3216 else if (strcmp(hook, "post-stop") == 0)
3217 which = LXCHOOK_POSTSTOP;
148e91f5
SH		 3218 else if (strcmp(hook, "clone") == 0)
3219 which = LXCHOOK_CLONE;
37cf711b
SY		 3220 else if (strcmp(hook, "destroy") == 0)
3221 which = LXCHOOK_DESTROY;
26ddeedd
SH		 3222 else
3223 return -1;
3224 lxc_list_for_each(it, &conf->hooks[which]) {
3225 int ret;
3226 char *hookname = it->elem;
283678ed 3227 ret = run_script_argv(name, "lxc", hookname, hook, lxcpath, argv);
26ddeedd
SH		 3228 if (ret)
3229 return ret;
3230 }
3231 return 0;
3232}
72d0e1cb 3233
72d0e1cb
SG		 3234int lxc_clear_config_caps(struct lxc_conf *c)
3235{
1a0e70ac 3236 struct lxc_list *it, *next;
72d0e1cb 3237
9ebb03ad 3238 lxc_list_for_each_safe(it, &c->caps, next) {
72d0e1cb
SG		 3239 lxc_list_del(it);
3240 free(it->elem);
3241 free(it);
3242 }
3243 return 0;
3244}
3245
74a3920a 3246static int lxc_free_idmap(struct lxc_list *id_map) {
27c27d73
SH		 3247 struct lxc_list *it, *next;
3248
4355ab5f 3249 lxc_list_for_each_safe(it, id_map, next) {
27c27d73
SH		 3250 lxc_list_del(it);
3251 free(it->elem);
3252 free(it);
3253 }
3254 return 0;
3255}
3256
4355ab5f
SH		 3257int lxc_clear_idmaps(struct lxc_conf *c)
3258{
3259 return lxc_free_idmap(&c->id_map);
3260}
3261
1fb86a7c
SH		 3262int lxc_clear_config_keepcaps(struct lxc_conf *c)
3263{
3264 struct lxc_list *it,*next;
3265
3266 lxc_list_for_each_safe(it, &c->keepcaps, next) {
3267 lxc_list_del(it);
3268 free(it->elem);
3269 free(it);
3270 }
3271 return 0;
3272}
3273
12a50cc6 3274int lxc_clear_cgroups(struct lxc_conf *c, const char *key)
72d0e1cb 3275{
9ebb03ad 3276 struct lxc_list *it,*next;
72d0e1cb 3277 bool all = false;
a6390f01 3278 const char *k = NULL;
72d0e1cb
SG		 3279
3280 if (strcmp(key, "lxc.cgroup") == 0)
3281 all = true;
a6390f01
WB		 3282 else if (strncmp(key, "lxc.cgroup.", sizeof("lxc.cgroup.")-1) == 0)
3283 k = key + sizeof("lxc.cgroup.")-1;
3284 else
3285 return -1;
72d0e1cb 3286
9ebb03ad 3287 lxc_list_for_each_safe(it, &c->cgroup, next) {
72d0e1cb
SG		 3288 struct lxc_cgroup *cg = it->elem;
3289 if (!all && strcmp(cg->subsystem, k) != 0)
3290 continue;
3291 lxc_list_del(it);
3292 free(cg->subsystem);
3293 free(cg->value);
3294 free(cg);
3295 free(it);
3296 }
3297 return 0;
3298}
3299
c6d09e15
WB		 3300int lxc_clear_limits(struct lxc_conf *c, const char *key)
3301{
3302 struct lxc_list *it, *next;
3303 bool all = false;
3304 const char *k = NULL;
3305
240d4b74 3306 if (strcmp(key, "lxc.limit") == 0
3307 || strcmp(key, "lxc.prlimit"))
c6d09e15
WB		 3308 all = true;
3309 else if (strncmp(key, "lxc.limit.", sizeof("lxc.limit.")-1) == 0)
3310 k = key + sizeof("lxc.limit.")-1;
240d4b74 3311 else if (strncmp(key, "lxc.prlimit.", sizeof("lxc.prlimit.")-1) == 0)
3312 k = key + sizeof("lxc.prlimit.")-1;
c6d09e15
WB		 3313 else
3314 return -1;
3315
3316 lxc_list_for_each_safe(it, &c->limits, next) {
3317 struct lxc_limit *lim = it->elem;
3318 if (!all && strcmp(lim->resource, k) != 0)
3319 continue;
3320 lxc_list_del(it);
3321 free(lim->resource);
3322 free(lim);
3323 free(it);
3324 }
3325 return 0;
3326}
3327
ee1e7aa0
SG		 3328int lxc_clear_groups(struct lxc_conf *c)
3329{
3330 struct lxc_list *it,*next;
3331
3332 lxc_list_for_each_safe(it, &c->groups, next) {
3333 lxc_list_del(it);
3334 free(it->elem);
3335 free(it);
3336 }
3337 return 0;
3338}
3339
ab799c0b
SG		 3340int lxc_clear_environment(struct lxc_conf *c)
3341{
3342 struct lxc_list *it,*next;
3343
3344 lxc_list_for_each_safe(it, &c->environment, next) {
3345 lxc_list_del(it);
3346 free(it->elem);
3347 free(it);
3348 }
3349 return 0;
3350}
3351
72d0e1cb
SG		 3352int lxc_clear_mount_entries(struct lxc_conf *c)
3353{
9ebb03ad 3354 struct lxc_list *it,*next;
72d0e1cb 3355
9ebb03ad 3356 lxc_list_for_each_safe(it, &c->mount_list, next) {
72d0e1cb
SG		 3357 lxc_list_del(it);
3358 free(it->elem);
3359 free(it);
3360 }
3361 return 0;
3362}
3363
b099e9e9
SH		 3364int lxc_clear_automounts(struct lxc_conf *c)
3365{
3366 c->auto_mounts = 0;
3367 return 0;
3368}
3369
12a50cc6 3370int lxc_clear_hooks(struct lxc_conf *c, const char *key)
72d0e1cb 3371{
9ebb03ad 3372 struct lxc_list *it,*next;
17ed13a3 3373 bool all = false, done = false;
a6390f01 3374 const char *k = NULL;
72d0e1cb
SG		 3375 int i;
3376
17ed13a3
SH		 3377 if (strcmp(key, "lxc.hook") == 0)
3378 all = true;
a6390f01
WB		 3379 else if (strncmp(key, "lxc.hook.", sizeof("lxc.hook.")-1) == 0)
3380 k = key + sizeof("lxc.hook.")-1;
3381 else
3382 return -1;
17ed13a3 3383
72d0e1cb 3384 for (i=0; i<NUM_LXC_HOOKS; i++) {
17ed13a3 3385 if (all || strcmp(k, lxchook_names[i]) == 0) {
9ebb03ad 3386 lxc_list_for_each_safe(it, &c->hooks[i], next) {
17ed13a3
SH		 3387 lxc_list_del(it);
3388 free(it->elem);
3389 free(it);
3390 }
3391 done = true;
72d0e1cb
SG		 3392 }
3393 }
17ed13a3
SH		 3394
3395 if (!done) {
3396 ERROR("Invalid hook key: %s", key);
3397 return -1;
3398 }
72d0e1cb
SG		 3399 return 0;
3400}
8eb5694b 3401
4184c3e1
SH		 3402static inline void lxc_clear_aliens(struct lxc_conf *conf)
3403{
3404 struct lxc_list *it,*next;
3405
3406 lxc_list_for_each_safe(it, &conf->aliens, next) {
3407 lxc_list_del(it);
3408 free(it->elem);
3409 free(it);
3410 }
3411}
3412
c7b15d1e 3413void lxc_clear_includes(struct lxc_conf *conf)
f979ac15
SH		 3414{
3415 struct lxc_list *it,*next;
3416
3417 lxc_list_for_each_safe(it, &conf->includes, next) {
3418 lxc_list_del(it);
3419 free(it->elem);
3420 free(it);
3421 }
3422}
3423
8eb5694b
SH		 3424void lxc_conf_free(struct lxc_conf *conf)
3425{
3426 if (!conf)
3427 return;
858377e4
SH		 3428 if (current_config == conf)
3429 current_config = NULL;
3a784510 3430 free(conf->console.buffer_log_file);
f10fad2f
ME		 3431 free(conf->console.log_path);
3432 free(conf->console.path);
28f3b1cd 3433 if (conf->console.buffer_size > 0 && conf->console.ringbuf.addr)
732375f5 3434 lxc_ringbuf_release(&conf->console.ringbuf);
f10fad2f 3435 free(conf->rootfs.mount);
b3b8c97f 3436 free(conf->rootfs.bdev_type);
f10fad2f
ME		 3437 free(conf->rootfs.options);
3438 free(conf->rootfs.path);
f10fad2f 3439 free(conf->logfile);
858377e4
SH		 3440 if (conf->logfd != -1)
3441 close(conf->logfd);
f10fad2f
ME		 3442 free(conf->utsname);
3443 free(conf->ttydir);
3444 free(conf->fstab);
3445 free(conf->rcfile);
5cda27c1 3446 free(conf->execute_cmd);
f10fad2f 3447 free(conf->init_cmd);
6b0d5538 3448 free(conf->unexpanded_config);
393903d1 3449 free(conf->pty_names);
76d0127f 3450 free(conf->syslog);
c302b476 3451 lxc_free_networks(&conf->network);
f10fad2f
ME		 3452 free(conf->lsm_aa_profile);
3453 free(conf->lsm_se_context);
769872f9 3454 lxc_seccomp_free(conf);
8eb5694b 3455 lxc_clear_config_caps(conf);
1fb86a7c 3456 lxc_clear_config_keepcaps(conf);
8eb5694b 3457 lxc_clear_cgroups(conf, "lxc.cgroup");
17ed13a3 3458 lxc_clear_hooks(conf, "lxc.hook");
8eb5694b 3459 lxc_clear_mount_entries(conf);
27c27d73 3460 lxc_clear_idmaps(conf);
ee1e7aa0 3461 lxc_clear_groups(conf);
f979ac15 3462 lxc_clear_includes(conf);
761d81ca 3463 lxc_clear_aliens(conf);
ab799c0b 3464 lxc_clear_environment(conf);
240d4b74 3465 lxc_clear_limits(conf, "lxc.prlimit");
43654d34
CB		 3466 free(conf->cgroup_meta.dir);
3467 free(conf->cgroup_meta.controllers);
8eb5694b
SH		 3468 free(conf);
3469}
4355ab5f
SH		 3470
3471struct userns_fn_data {
3472 int (*fn)(void *);
c9b7c33e 3473 const char *fn_name;
4355ab5f
SH		 3474 void *arg;
3475 int p[2];
3476};
3477
3478static int run_userns_fn(void *data)
3479{
3480 struct userns_fn_data *d = data;
3481 char c;
4355ab5f 3482
f8aa4bf3 3483 /* Close write end of the pipe. */
4355ab5f 3484 close(d->p[1]);
f8aa4bf3
CB		 3485
3486 /* Wait for parent to finish establishing a new mapping in the user
3487 * namespace we are executing in.
3488 */
4355ab5f
SH		 3489 if (read(d->p[0], &c, 1) != 1)
3490 return -1;
f8aa4bf3
CB		 3491
3492 /* Close read end of the pipe. */
4355ab5f 3493 close(d->p[0]);
f8aa4bf3 3494
c9b7c33e
CB		 3495 if (d->fn_name)
3496 TRACE("calling function \"%s\"", d->fn_name);
f8aa4bf3 3497 /* Call function to run. */
4355ab5f
SH		 3498 return d->fn(d->arg);
3499}
3500
339efad9 3501static struct id_map *mapped_hostid_entry(struct lxc_conf *conf, unsigned id,
f8aa4bf3
CB		 3502 enum idtype idtype)
3503{
3504 struct lxc_list *it;
3505 struct id_map *map;
3506 struct id_map *retmap = NULL;
3507
3508 lxc_list_for_each(it, &conf->id_map) {
3509 map = it->elem;
3510 if (map->idtype != idtype)
3511 continue;
3512
3513 if (id >= map->hostid && id < map->hostid + map->range) {
3514 retmap = map;
3515 break;
3516 }
3517 }
3518
3519 if (!retmap)
3520 return NULL;
3521
3522 retmap = malloc(sizeof(*retmap));
3523 if (!retmap)
3524 return NULL;
3525
3526 memcpy(retmap, map, sizeof(*retmap));
3527 return retmap;
3528}
3529
4355ab5f 3530/*
f8aa4bf3
CB		 3531 * Allocate a new {g,u}id mapping for the given {g,u}id. Re-use an already
3532 * existing one or establish a new one.
4355ab5f 3533 */
28a2d9e7 3534static struct id_map *idmap_add(struct lxc_conf *conf, uid_t id, enum idtype type)
4355ab5f 3535{
28a2d9e7 3536 int hostid_mapped;
f8aa4bf3 3537 struct id_map *entry = NULL;
f8aa4bf3 3538
28a2d9e7
CB		 3539 /* Reuse existing mapping. */
3540 entry = mapped_hostid_entry(conf, id, type);
3541 if (entry)
3542 return entry;
f8aa4bf3 3543
28a2d9e7
CB		 3544 /* Find new mapping. */
3545 hostid_mapped = find_unmapped_nsid(conf, type);
3546 if (hostid_mapped < 0) {
3547 DEBUG("failed to find free mapping for id %d", id);
3548 return NULL;
f8aa4bf3 3549 }
f8aa4bf3 3550
28a2d9e7
CB		 3551 entry = malloc(sizeof(*entry));
3552 if (!entry)
3553 return NULL;
4355ab5f 3554
28a2d9e7
CB		 3555 entry->idtype = type;
3556 entry->nsid = hostid_mapped;
3557 entry->hostid = (unsigned long)id;
3558 entry->range = 1;
4355ab5f 3559
28a2d9e7 3560 return entry;
4355ab5f
SH		 3561}
3562
f8aa4bf3
CB		 3563/* Run a function in a new user namespace.
3564 * The caller's euid/egid will be mapped if it is not already.
3565 * Afaict, userns_exec_1() is only used to operate based on privileges for the
3566 * user's own {g,u}id on the host and for the container root's unmapped {g,u}id.
3567 * This means we require only to establish a mapping from:
3568 * - the container root {g,u}id as seen from the host > user's host {g,u}id
3569 * - the container root -> some sub{g,u}id
3570 * The former we add, if the user did not specifiy a mapping. The latter we
3571 * retrieve from the ontainer's configured {g,u}id mappings as it must have been
3572 * there to start the container in the first place.
4355ab5f 3573 */
c9b7c33e
CB		 3574int userns_exec_1(struct lxc_conf *conf, int (*fn)(void *), void *data,
3575 const char *fn_name)
4355ab5f 3576{
f8aa4bf3
CB		 3577 pid_t pid;
3578 uid_t euid, egid;
4355ab5f 3579 struct userns_fn_data d;
4355ab5f 3580 int p[2];
f8aa4bf3
CB		 3581 struct lxc_list *it;
3582 struct id_map *map;
3583 char c = '1';
686dd5d1 3584 int ret = -1, status = -1;
f8aa4bf3 3585 struct lxc_list *idmap = NULL, *tmplist = NULL;
28a2d9e7
CB		 3586 struct id_map *container_root_uid = NULL, *container_root_gid = NULL,
3587 *host_uid_map = NULL, *host_gid_map = NULL;
4355ab5f 3588
4355ab5f 3589 ret = pipe(p);
4355ab5f
SH		 3590 if (ret < 0) {
3591 SYSERROR("opening pipe");
3592 return -1;
3593 }
3594 d.fn = fn;
c9b7c33e 3595 d.fn_name = fn_name;
4355ab5f
SH		 3596 d.arg = data;
3597 d.p[0] = p[0];
3598 d.p[1] = p[1];
f8aa4bf3
CB		 3599
3600 /* Clone child in new user namespace. */
4355ab5f 3601 pid = lxc_clone(run_userns_fn, &d, CLONE_NEWUSER);
f8aa4bf3
CB		 3602 if (pid < 0) {
3603 ERROR("failed to clone child process in new user namespace");
3604 goto on_error;
3605 }
3606
4355ab5f 3607 close(p[0]);
4355ab5f
SH		 3608 p[0] = -1;
3609
954b7d9b
CB		 3610 euid = geteuid();
3611 egid = getegid();
3612
f8aa4bf3
CB		 3613 /* Find container root. */
3614 lxc_list_for_each(it, &conf->id_map) {
3615 map = it->elem;
3616
3617 if (map->nsid != 0)
3618 continue;
3619
3620 if (map->idtype == ID_TYPE_UID && container_root_uid == NULL) {
3621 container_root_uid = malloc(sizeof(*container_root_uid));
3622 if (!container_root_uid)
3623 goto on_error;
3624 container_root_uid->idtype = map->idtype;
3625 container_root_uid->hostid = map->hostid;
3626 container_root_uid->nsid = 0;
3627 container_root_uid->range = map->range;
954b7d9b
CB		 3628
3629 /* Check if container root mapping contains a mapping
3630 * for user's uid.
3631 */
3632 if (euid >= map->hostid && euid < map->hostid + map->range)
3633 host_uid_map = container_root_uid;
f8aa4bf3
CB		 3634 } else if (map->idtype == ID_TYPE_GID && container_root_gid == NULL) {
3635 container_root_gid = malloc(sizeof(*container_root_gid));
3636 if (!container_root_gid)
3637 goto on_error;
3638 container_root_gid->idtype = map->idtype;
3639 container_root_gid->hostid = map->hostid;
3640 container_root_gid->nsid = 0;
3641 container_root_gid->range = map->range;
954b7d9b
CB		 3642
3643 /* Check if container root mapping contains a mapping
3644 * for user's gid.
3645 */
3646 if (egid >= map->hostid && egid < map->hostid + map->range)
3647 host_gid_map = container_root_gid;
f8aa4bf3
CB		 3648 }
3649
3650 /* Found container root. */
3651 if (container_root_uid && container_root_gid)
3652 break;
3653 }
3654
3655 /* This is actually checked earlier but it can't hurt. */
3656 if (!container_root_uid || !container_root_gid) {
3657 ERROR("no mapping for container root found");
3658 goto on_error;
3659 }
3660
3661 /* Check whether the {g,u}id of the user has a mapping. */
954b7d9b 3662 if (!host_uid_map)
28a2d9e7
CB		 3663 host_uid_map = idmap_add(conf, euid, ID_TYPE_UID);
3664
954b7d9b 3665 if (!host_gid_map)
28a2d9e7
CB		 3666 host_gid_map = idmap_add(conf, egid, ID_TYPE_GID);
3667
3668 if (!host_uid_map) {
3669 DEBUG("failed to find mapping for uid %d", euid);
f8aa4bf3
CB		 3670 goto on_error;
3671 }
3672
28a2d9e7
CB		 3673 if (!host_gid_map) {
3674 DEBUG("failed to find mapping for gid %d", egid);
3675 goto on_error;
3676 }
3677
3678 /* Allocate new {g,u}id map list. */
3679 idmap = malloc(sizeof(*idmap));
3680 if (!idmap)
3681 goto on_error;
3682 lxc_list_init(idmap);
3683
f8aa4bf3
CB		 3684 /* Add container root to the map. */
3685 tmplist = malloc(sizeof(*tmplist));
3686 if (!tmplist)
3687 goto on_error;
3688 lxc_list_add_elem(tmplist, container_root_uid);
3689 lxc_list_add_tail(idmap, tmplist);
28a2d9e7 3690
1d90e064 3691 if (host_uid_map && (host_uid_map != container_root_uid)) {
28a2d9e7
CB		 3692 /* idmap will now keep track of that memory. */
3693 container_root_uid = NULL;
3694
3695 /* Add container root to the map. */
3696 tmplist = malloc(sizeof(*tmplist));
3697 if (!tmplist)
3698 goto on_error;
3699 lxc_list_add_elem(tmplist, host_uid_map);
3700 lxc_list_add_tail(idmap, tmplist);
28a2d9e7 3701 }
1d90e064
CB		 3702 /* idmap will now keep track of that memory. */
3703 container_root_uid = NULL;
3704 /* idmap will now keep track of that memory. */
3705 host_uid_map = NULL;
f8aa4bf3
CB		 3706
3707 tmplist = malloc(sizeof(*tmplist));
3708 if (!tmplist)
3709 goto on_error;
3710 lxc_list_add_elem(tmplist, container_root_gid);
3711 lxc_list_add_tail(idmap, tmplist);
28a2d9e7 3712
1d90e064 3713 if (host_gid_map && (host_gid_map != container_root_gid)) {
28a2d9e7
CB		 3714 /* idmap will now keep track of that memory. */
3715 container_root_gid = NULL;
3716
3717 tmplist = malloc(sizeof(*tmplist));
3718 if (!tmplist)
3719 goto on_error;
3720 lxc_list_add_elem(tmplist, host_gid_map);
3721 lxc_list_add_tail(idmap, tmplist);
28a2d9e7 3722 }
1d90e064
CB		 3723 /* idmap will now keep track of that memory. */
3724 container_root_gid = NULL;
3725 /* idmap will now keep track of that memory. */
3726 host_gid_map = NULL;
f8aa4bf3 3727
4b73005c
CB		 3728 if (lxc_log_get_level() == LXC_LOG_LEVEL_TRACE ||
3729 conf->loglevel == LXC_LOG_LEVEL_TRACE) {
f8aa4bf3
CB		 3730 lxc_list_for_each(it, idmap) {
3731 map = it->elem;
3732 TRACE("establishing %cid mapping for \"%d\" in new "
3733 "user namespace: nsuid %lu - hostid %lu - range "
3734 "%lu",
3735 (map->idtype == ID_TYPE_UID) ? 'u' : 'g', pid,
3736 map->nsid, map->hostid, map->range);
3737 }
4355ab5f
SH		 3738 }
3739
f8aa4bf3 3740 /* Set up {g,u}id mapping for user namespace of child process. */
4355ab5f 3741 ret = lxc_map_ids(idmap, pid);
f8aa4bf3
CB		 3742 if (ret < 0) {
3743 ERROR("error setting up {g,u}id mappings for child process "
415a8851 3744 "\"%d\"", pid);
f8aa4bf3 3745 goto on_error;
4355ab5f
SH		 3746 }
3747
f8aa4bf3 3748 /* Tell child to proceed. */
4355ab5f 3749 if (write(p[1], &c, 1) != 1) {
f8aa4bf3
CB		 3750 SYSERROR("failed telling child process \"%d\" to proceed", pid);
3751 goto on_error;
4355ab5f
SH		 3752 }
3753
686dd5d1 3754on_error:
f8aa4bf3 3755 /* Wait for child to finish. */
686dd5d1
CB		 3756 if (pid > 0)
3757 status = wait_for_pid(pid);
3139aead 3758
1d90e064
CB		 3759 if (idmap)
3760 lxc_free_idmap(idmap);
3761 if (container_root_uid)
3762 free(container_root_uid);
3763 if (container_root_gid)
3764 free(container_root_gid);
3765 if (host_uid_map && (host_uid_map != container_root_uid))
3766 free(host_uid_map);
3767 if (host_gid_map && (host_gid_map != container_root_gid))
3768 free(host_gid_map);
3139aead 3769
4355ab5f
SH		 3770 if (p[0] != -1)
3771 close(p[0]);
3772 close(p[1]);
f8aa4bf3 3773
686dd5d1
CB		 3774 if (status < 0)
3775 ret = -1;
3776
f8aa4bf3 3777 return ret;
4355ab5f 3778}
97e9cfa0 3779
415a8851
CB		 3780int userns_exec_full(struct lxc_conf *conf, int (*fn)(void *), void *data,
3781 const char *fn_name)
3782{
3783 pid_t pid;
3784 uid_t euid, egid;
3785 struct userns_fn_data d;
3786 int p[2];
3787 struct id_map *map;
3788 struct lxc_list *cur;
3789 char c = '1';
3790 int ret = -1;
3791 struct lxc_list *idmap = NULL, *tmplist = NULL;
3792 struct id_map *container_root_uid = NULL, *container_root_gid = NULL,
3793 *host_uid_map = NULL, *host_gid_map = NULL;
3794
3795 ret = pipe(p);
3796 if (ret < 0) {
3797 SYSERROR("opening pipe");
3798 return -1;
3799 }
3800 d.fn = fn;
3801 d.fn_name = fn_name;
3802 d.arg = data;
3803 d.p[0] = p[0];
3804 d.p[1] = p[1];
3805
3806 /* Clone child in new user namespace. */
3807 pid = lxc_clone(run_userns_fn, &d, CLONE_NEWUSER);
3808 if (pid < 0) {
3809 ERROR("failed to clone child process in new user namespace");
3810 goto on_error;
3811 }
3812
3813 close(p[0]);
3814 p[0] = -1;
3815
3816 euid = geteuid();
3817 egid = getegid();
3818
3819 /* Allocate new {g,u}id map list. */
3820 idmap = malloc(sizeof(*idmap));
3821 if (!idmap)
3822 goto on_error;
3823 lxc_list_init(idmap);
3824
3825 /* Find container root. */
3826 lxc_list_for_each(cur, &conf->id_map) {
3827 struct id_map *tmpmap;
3828
3829 tmplist = malloc(sizeof(*tmplist));
3830 if (!tmplist)
3831 goto on_error;
3832
3833 tmpmap = malloc(sizeof(*tmpmap));
3834 if (!tmpmap) {
3835 free(tmplist);
3836 goto on_error;
3837 }
3838
3839 memset(tmpmap, 0, sizeof(*tmpmap));
3840 memcpy(tmpmap, cur->elem, sizeof(*tmpmap));
3841 tmplist->elem = tmpmap;
3842
3843 lxc_list_add_tail(idmap, tmplist);
3844
3845 map = cur->elem;
3846
3847 if (map->idtype == ID_TYPE_UID)
3848 if (euid >= map->hostid && euid < map->hostid + map->range)
3849 host_uid_map = map;
3850
3851 if (map->idtype == ID_TYPE_GID)
3852 if (egid >= map->hostid && egid < map->hostid + map->range)
3853 host_gid_map = map;
3854
3855 if (map->nsid != 0)
3856 continue;
3857
3858 if (map->idtype == ID_TYPE_UID)
3859 if (container_root_uid == NULL)
3860 container_root_uid = map;
3861
3862 if (map->idtype == ID_TYPE_GID)
3863 if (container_root_gid == NULL)
3864 container_root_gid = map;
3865 }
3866
3867 if (!container_root_uid || !container_root_gid) {
3868 ERROR("No mapping for container root found");
3869 goto on_error;
3870 }
3871
3872 /* Check whether the {g,u}id of the user has a mapping. */
3873 if (!host_uid_map)
3874 host_uid_map = idmap_add(conf, euid, ID_TYPE_UID);
3875 else
3876 host_uid_map = container_root_uid;
3877
3878 if (!host_gid_map)
3879 host_gid_map = idmap_add(conf, egid, ID_TYPE_GID);
3880 else
3881 host_gid_map = container_root_gid;
3882
3883 if (!host_uid_map) {
3884 DEBUG("Failed to find mapping for uid %d", euid);
3885 goto on_error;
3886 }
3887
3888 if (!host_gid_map) {
3889 DEBUG("Failed to find mapping for gid %d", egid);
3890 goto on_error;
3891 }
3892
3893 if (host_uid_map && (host_uid_map != container_root_uid)) {
3894 /* Add container root to the map. */
3895 tmplist = malloc(sizeof(*tmplist));
3896 if (!tmplist)
3897 goto on_error;
3898 lxc_list_add_elem(tmplist, host_uid_map);
3899 lxc_list_add_tail(idmap, tmplist);
3900 }
3901 /* idmap will now keep track of that memory. */
3902 host_uid_map = NULL;
3903
3904 if (host_gid_map && (host_gid_map != container_root_gid)) {
3905 tmplist = malloc(sizeof(*tmplist));
3906 if (!tmplist)
3907 goto on_error;
3908 lxc_list_add_elem(tmplist, host_gid_map);
3909 lxc_list_add_tail(idmap, tmplist);
3910 }
3911 /* idmap will now keep track of that memory. */
3912 host_gid_map = NULL;
3913
3914 if (lxc_log_get_level() == LXC_LOG_LEVEL_TRACE ||
3915 conf->loglevel == LXC_LOG_LEVEL_TRACE) {
3916 lxc_list_for_each(cur, idmap) {
3917 map = cur->elem;
3918 TRACE("establishing %cid mapping for \"%d\" in new "
3919 "user namespace: nsuid %lu - hostid %lu - range "
3920 "%lu",
3921 (map->idtype == ID_TYPE_UID) ? 'u' : 'g', pid,
3922 map->nsid, map->hostid, map->range);
3923 }
3924 }
3925
3926 /* Set up {g,u}id mapping for user namespace of child process. */
3927 ret = lxc_map_ids(idmap, pid);
3928 if (ret < 0) {
3929 ERROR("error setting up {g,u}id mappings for child process "
3930 "\"%d\"", pid);
3931 goto on_error;
3932 }
3933
3934 /* Tell child to proceed. */
3935 if (write(p[1], &c, 1) != 1) {
3936 SYSERROR("failed telling child process \"%d\" to proceed", pid);
3937 goto on_error;
3938 }
3939
686dd5d1 3940on_error:
415a8851 3941 /* Wait for child to finish. */
686dd5d1
CB		 3942 if (pid > 0)
3943 ret = wait_for_pid(pid);
415a8851 3944
415a8851
CB		 3945 if (idmap)
3946 lxc_free_idmap(idmap);
3947 if (host_uid_map && (host_uid_map != container_root_uid))
3948 free(host_uid_map);
3949 if (host_gid_map && (host_gid_map != container_root_gid))
3950 free(host_gid_map);
3951
3952 if (p[0] != -1)
3953 close(p[0]);
3954 close(p[1]);
3955
3956 return ret;
3957}
3958
a96a8e8c 3959/* not thread-safe, do not use from api without first forking */
97e9cfa0
SH		 3960static char* getuname(void)
3961{
a96a8e8c 3962 struct passwd *result;
97e9cfa0 3963
a96a8e8c
SH		 3964 result = getpwuid(geteuid());
3965 if (!result)
97e9cfa0
SH		 3966 return NULL;
3967
a96a8e8c 3968 return strdup(result->pw_name);
97e9cfa0
SH		 3969}
3970
a96a8e8c 3971/* not thread-safe, do not use from api without first forking */
97e9cfa0
SH		 3972static char *getgname(void)
3973{
a96a8e8c 3974 struct group *result;
97e9cfa0 3975
a96a8e8c
SH		 3976 result = getgrgid(getegid());
3977 if (!result)
97e9cfa0
SH		 3978 return NULL;
3979
a96a8e8c 3980 return strdup(result->gr_name);
97e9cfa0
SH		 3981}
3982
a96a8e8c 3983/* not thread-safe, do not use from api without first forking */
97e9cfa0
SH		 3984void suggest_default_idmap(void)
3985{
3986 FILE *f;
3987 unsigned int uid = 0, urange = 0, gid = 0, grange = 0;
3988 char *line = NULL;
3989 char *uname, *gname;
3990 size_t len = 0;
3991
3992 if (!(uname = getuname()))
3993 return;
3994
3995 if (!(gname = getgname())) {
3996 free(uname);
3997 return;
3998 }
3999
4000 f = fopen(subuidfile, "r");
4001 if (!f) {
4002 ERROR("Your system is not configured with subuids");
4003 free(gname);
4004 free(uname);
4005 return;
4006 }
4007 while (getline(&line, &len, f) != -1) {
b7930180 4008 size_t no_newline = 0;
97e9cfa0
SH		 4009 char *p = strchr(line, ':'), *p2;
4010 if (*line == '#')
4011 continue;
4012 if (!p)
4013 continue;
4014 *p = '\0';
4015 p++;
4016 if (strcmp(line, uname))
4017 continue;
4018 p2 = strchr(p, ':');
4019 if (!p2)
4020 continue;
4021 *p2 = '\0';
4022 p2++;
4023 if (!*p2)
4024 continue;
b7930180
CB		 4025 no_newline = strcspn(p2, "\n");
4026 p2[no_newline] = '\0';
4027
b7b2fde4
CB		 4028 if (lxc_safe_uint(p, &uid) < 0)
4029 WARN("Could not parse UID.");
4030 if (lxc_safe_uint(p2, &urange) < 0)
4031 WARN("Could not parse UID range.");
97e9cfa0
SH		 4032 }
4033 fclose(f);
4034
6be7389a 4035 f = fopen(subgidfile, "r");
97e9cfa0
SH		 4036 if (!f) {
4037 ERROR("Your system is not configured with subgids");
4038 free(gname);
4039 free(uname);
4040 return;
4041 }
4042 while (getline(&line, &len, f) != -1) {
b7930180 4043 size_t no_newline = 0;
97e9cfa0
SH		 4044 char *p = strchr(line, ':'), *p2;
4045 if (*line == '#')
4046 continue;
4047 if (!p)
4048 continue;
4049 *p = '\0';
4050 p++;
4051 if (strcmp(line, uname))
4052 continue;
4053 p2 = strchr(p, ':');
4054 if (!p2)
4055 continue;
4056 *p2 = '\0';
4057 p2++;
4058 if (!*p2)
4059 continue;
b7930180
CB		 4060 no_newline = strcspn(p2, "\n");
4061 p2[no_newline] = '\0';
4062
b7b2fde4
CB		 4063 if (lxc_safe_uint(p, &gid) < 0)
4064 WARN("Could not parse GID.");
4065 if (lxc_safe_uint(p2, &grange) < 0)
4066 WARN("Could not parse GID range.");
97e9cfa0
SH		 4067 }
4068 fclose(f);
4069
f10fad2f 4070 free(line);
97e9cfa0
SH		 4071
4072 if (!urange || !grange) {
4073 ERROR("You do not have subuids or subgids allocated");
4074 ERROR("Unprivileged containers require subuids and subgids");
4075 return;
4076 }
4077
4078 ERROR("You must either run as root, or define uid mappings");
4079 ERROR("To pass uid mappings to lxc-create, you could create");
4080 ERROR("~/.config/lxc/default.conf:");
4081 ERROR("lxc.include = %s", LXC_DEFAULT_CONFIG);
bdcbb6b3
CB		 4082 ERROR("lxc.idmap = u 0 %u %u", uid, urange);
4083 ERROR("lxc.idmap = g 0 %u %u", gid, grange);
97e9cfa0
SH		 4084
4085 free(gname);
4086 free(uname);
4087}
aaf26830 4088
a7307747
SH		 4089static void free_cgroup_settings(struct lxc_list *result)
4090{
4091 struct lxc_list *iterator, *next;
4092
4093 lxc_list_for_each_safe(iterator, result, next) {
4094 lxc_list_del(iterator);
4095 free(iterator);
4096 }
4097 free(result);
4098}
4099
aaf26830
KT		 4100/*
4101 * Return the list of cgroup_settings sorted according to the following rules
4102 * 1. Put memory.limit_in_bytes before memory.memsw.limit_in_bytes
4103 */
4104struct lxc_list *sort_cgroup_settings(struct lxc_list* cgroup_settings)
4105{
4106 struct lxc_list *result;
4107 struct lxc_list *memsw_limit = NULL;
4108 struct lxc_list *it = NULL;
4109 struct lxc_cgroup *cg = NULL;
4110 struct lxc_list *item = NULL;
4111
4112 result = malloc(sizeof(*result));
fac7c663
KT		 4113 if (!result) {
4114 ERROR("failed to allocate memory to sort cgroup settings");
4115 return NULL;
4116 }
aaf26830
KT		 4117 lxc_list_init(result);
4118
4119 /*Iterate over the cgroup settings and copy them to the output list*/
4120 lxc_list_for_each(it, cgroup_settings) {
4121 item = malloc(sizeof(*item));
fac7c663
KT		 4122 if (!item) {
4123 ERROR("failed to allocate memory to sort cgroup settings");
a7307747 4124 free_cgroup_settings(result);
fac7c663
KT		 4125 return NULL;
4126 }
aaf26830
KT		 4127 item->elem = it->elem;
4128 cg = it->elem;
4129 if (strcmp(cg->subsystem, "memory.memsw.limit_in_bytes") == 0) {
4130 /* Store the memsw_limit location */
4131 memsw_limit = item;
4132 } else if (strcmp(cg->subsystem, "memory.limit_in_bytes") == 0 && memsw_limit != NULL) {
4d5b72a1 4133 /* lxc.cgroup.memory.memsw.limit_in_bytes is found before
aaf26830
KT		 4134 * lxc.cgroup.memory.limit_in_bytes, swap these two items */
4135 item->elem = memsw_limit->elem;
4136 memsw_limit->elem = it->elem;
4137 }
4138 lxc_list_add_tail(result, item);
4139 }
4140
4141 return result;
a7307747 4142}
LXC mirror