]> git.proxmox.com Git - mirror_lxc.git/blame - src/lxc/conf.c
projects / mirror_lxc.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
Merge pull request #1513 from brauner/2017-04-17/skip_cap_get_file_on_android
[mirror_lxc.git] / src / lxc / conf.c
CommitLineData
0ad19a3f 1/*
2 * lxc: linux Container library
3 *
4 * (C) Copyright IBM Corp. 2007, 2008
5 *
6 * Authors:
9afe19d6 7 * Daniel Lezcano <daniel.lezcano at free.fr>
0ad19a3f 8 *
9 * This library is free software; you can redistribute it and/or
10 * modify it under the terms of the GNU Lesser General Public
11 * License as published by the Free Software Foundation; either
12 * version 2.1 of the License, or (at your option) any later version.
13 *
14 * This library is distributed in the hope that it will be useful,
15 * but WITHOUT ANY WARRANTY; without even the implied warranty of
16 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
17 * Lesser General Public License for more details.
18 *
19 * You should have received a copy of the GNU Lesser General Public
20 * License along with this library; if not, write to the Free Software
250b1eec 21 * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
0ad19a3f 22 */
1d52bdf7
CB		 23
24#define _GNU_SOURCE
d06245b8
NC		 25#include "config.h"
26
8f3e280e
CB		 27#include <dirent.h>
28#include <errno.h>
29#include <fcntl.h>
30#include <grp.h>
31#include <inttypes.h>
32#include <libgen.h>
33#include <pwd.h>
34#include <stdarg.h>
0ad19a3f 35#include <stdio.h>
0ad19a3f 36#include <stdlib.h>
0ad19a3f 37#include <string.h>
8f3e280e 38#include <time.h>
0ad19a3f 39#include <unistd.h>
8f3e280e
CB		 40#include <arpa/inet.h>
41#include <linux/loop.h>
8f3e280e
CB		 42#include <net/if.h>
43#include <netinet/in.h>
44#include <sys/mman.h>
45#include <sys/mount.h>
46#include <sys/param.h>
47#include <sys/prctl.h>
48#include <sys/stat.h>
49#include <sys/socket.h>
ce831b3b 50#include <sys/sysmacros.h>
2d76d1d7 51#include <sys/syscall.h>
97e9cfa0 52#include <sys/types.h>
8f3e280e
CB		 53#include <sys/utsname.h>
54#include <sys/wait.h>
1d52bdf7 55
af6824fc
ST		 56/* makedev() */
57#ifdef MAJOR_IN_MKDEV
58# include <sys/mkdev.h>
59#endif
af6824fc 60
614305f3 61#ifdef HAVE_STATVFS
2938f7c8 62#include <sys/statvfs.h>
614305f3 63#endif
e827ff7e
SG		 64
65#if HAVE_PTY_H
b0a33c1e 66#include <pty.h>
e827ff7e
SG		 67#else
68#include <../include/openpty.h>
69#endif
0ad19a3f 70
5ef5c9a3
CB		 71#ifdef HAVE_LINUX_MEMFD_H
72#include <linux/memfd.h>
73#endif
74
e8bd4e43 75#include "af_unix.h"
8f3e280e
CB		 76#include "bdev.h"
77#include "caps.h" /* for lxc_caps_last_cap() */
78#include "cgroup.h"
1b09f2c0 79#include "conf.h"
8f3e280e 80#include "error.h"
1b09f2c0 81#include "log.h"
d8e48992 82#include "lxcaufs.h"
025ed0f3 83#include "lxclock.h"
8f3e280e
CB		 84#include "lxcoverlay.h"
85#include "lxcseccomp.h"
4355ab5f 86#include "namespace.h"
8f3e280e
CB		 87#include "network.h"
88#include "parse.h"
89#include "utils.h"
fe4de9a6 90#include "lsm/lsm.h"
d0a36f2c 91
e37dda71 92#if HAVE_LIBCAP
495d2046
SG		 93#include <sys/capability.h>
94#endif
95
6ff05e18
SG		 96#if HAVE_SYS_PERSONALITY_H
97#include <sys/personality.h>
98#endif
99
edaf8b1b
SG		 100#if IS_BIONIC
101#include <../include/lxcmntent.h>
a04f5407
CB		 102#ifndef HAVE_PRLIMIT
103#include <../include/prlimit.h>
104#endif
edaf8b1b
SG		 105#else
106#include <mntent.h>
107#endif
108
36eb9bde 109lxc_log_define(lxc_conf, lxc);
e5bda9ee 110
e37dda71 111#if HAVE_LIBCAP
b09094da
MN		 112#ifndef CAP_SETFCAP
113#define CAP_SETFCAP 31
114#endif
115
116#ifndef CAP_MAC_OVERRIDE
117#define CAP_MAC_OVERRIDE 32
118#endif
119
120#ifndef CAP_MAC_ADMIN
121#define CAP_MAC_ADMIN 33
122#endif
495d2046 123#endif
b09094da
MN		 124
125#ifndef PR_CAPBSET_DROP
126#define PR_CAPBSET_DROP 24
127#endif
128
9818cae4
SG		 129#ifndef LO_FLAGS_AUTOCLEAR
130#define LO_FLAGS_AUTOCLEAR 4
131#endif
132
0769b82a
CS		 133/* needed for cgroup automount checks, regardless of whether we
134 * have included linux/capability.h or not */
135#ifndef CAP_SYS_ADMIN
136#define CAP_SYS_ADMIN 21
137#endif
138
2d76d1d7
SG		 139/* Define pivot_root() if missing from the C library */
140#ifndef HAVE_PIVOT_ROOT
141static int pivot_root(const char * new_root, const char * put_old)
142{
143#ifdef __NR_pivot_root
8f3e280e 144 return syscall(__NR_pivot_root, new_root, put_old);
2d76d1d7 145#else
8f3e280e
CB		 146 errno = ENOSYS;
147 return -1;
2d76d1d7
SG		 148#endif
149}
150#else
151extern int pivot_root(const char * new_root, const char * put_old);
152#endif
153
154/* Define sethostname() if missing from the C library */
155#ifndef HAVE_SETHOSTNAME
156static int sethostname(const char * name, size_t len)
157{
158#ifdef __NR_sethostname
8f3e280e 159 return syscall(__NR_sethostname, name, len);
2d76d1d7 160#else
8f3e280e
CB		 161 errno = ENOSYS;
162 return -1;
2d76d1d7
SG		 163#endif
164}
165#endif
166
72f919c4
SG		 167/* Define __S_ISTYPE if missing from the C library */
168#ifndef __S_ISTYPE
169#define __S_ISTYPE(mode, mask) (((mode) & S_IFMT) == (mask))
170#endif
171
ecec0126
SG		 172#ifndef MS_PRIVATE
173#define MS_PRIVATE (1<<18)
174#endif
175
5ef5c9a3
CB		 176/* memfd_create() */
177#ifndef MFD_CLOEXEC
178#define MFD_CLOEXEC 0x0001U
179#endif
180
181#ifndef MFD_ALLOW_SEALING
182#define MFD_ALLOW_SEALING 0x0002U
183#endif
184
185#ifndef HAVE_MEMFD_CREATE
186static int memfd_create(const char *name, unsigned int flags) {
187 #ifndef __NR_memfd_create
188 #if defined __i386__
189 #define __NR_memfd_create 356
190 #elif defined __x86_64__
191 #define __NR_memfd_create 319
192 #elif defined __arm__
193 #define __NR_memfd_create 385
194 #elif defined __aarch64__
195 #define __NR_memfd_create 279
196 #elif defined __s390__
197 #define __NR_memfd_create 350
198 #elif defined __powerpc__
199 #define __NR_memfd_create 360
200 #elif defined __sparc__
201 #define __NR_memfd_create 348
202 #elif defined __blackfin__
203 #define __NR_memfd_create 390
204 #elif defined __ia64__
205 #define __NR_memfd_create 1340
206 #elif defined _MIPS_SIM
207 #if _MIPS_SIM == _MIPS_SIM_ABI32
208 #define __NR_memfd_create 4354
209 #endif
210 #if _MIPS_SIM == _MIPS_SIM_NABI32
211 #define __NR_memfd_create 6318
212 #endif
213 #if _MIPS_SIM == _MIPS_SIM_ABI64
214 #define __NR_memfd_create 5314
215 #endif
216 #endif
217 #endif
218 #ifdef __NR_memfd_create
219 return syscall(__NR_memfd_create, name, flags);
220 #else
221 errno = ENOSYS;
222 return -1;
223 #endif
224}
225#else
226extern int memfd_create(const char *name, unsigned int flags);
227#endif
228
72d0e1cb 229char *lxchook_names[NUM_LXC_HOOKS] = {
52492063 230 "pre-start", "pre-mount", "mount", "autodev", "start", "stop", "post-stop", "clone", "destroy" };
72d0e1cb 231
a589434e 232typedef int (*instantiate_cb)(struct lxc_handler *, struct lxc_netdev *);
0ad19a3f 233
998ac676
RT		 234struct mount_opt {
235 char *name;
236 int clear;
237 int flag;
238};
239
81810dd1
DL		 240struct caps_opt {
241 char *name;
242 int value;
243};
244
c6d09e15
WB		 245struct limit_opt {
246 char *name;
247 int value;
248};
249
858377e4
SH		 250/*
251 * The lxc_conf of the container currently being worked on in an
252 * API call
253 * This is used in the error calls
254 */
255#ifdef HAVE_TLS
256__thread struct lxc_conf *current_config;
257#else
258struct lxc_conf *current_config;
259#endif
260
0769b82a
CS		 261/* Declare this here, since we don't want to reshuffle the whole file. */
262static int in_caplist(int cap, struct lxc_list *caps);
263
a589434e
JN		 264static int instantiate_veth(struct lxc_handler *, struct lxc_netdev *);
265static int instantiate_macvlan(struct lxc_handler *, struct lxc_netdev *);
266static int instantiate_vlan(struct lxc_handler *, struct lxc_netdev *);
267static int instantiate_phys(struct lxc_handler *, struct lxc_netdev *);
268static int instantiate_empty(struct lxc_handler *, struct lxc_netdev *);
269static int instantiate_none(struct lxc_handler *, struct lxc_netdev *);
270
271static instantiate_cb netdev_conf[LXC_NET_MAXCONFTYPE + 1] = {
272 [LXC_NET_VETH] = instantiate_veth,
273 [LXC_NET_MACVLAN] = instantiate_macvlan,
274 [LXC_NET_VLAN] = instantiate_vlan,
275 [LXC_NET_PHYS] = instantiate_phys,
276 [LXC_NET_EMPTY] = instantiate_empty,
277 [LXC_NET_NONE] = instantiate_none,
0ad19a3f 278};
279
74a2b586
JK		 280static int shutdown_veth(struct lxc_handler *, struct lxc_netdev *);
281static int shutdown_macvlan(struct lxc_handler *, struct lxc_netdev *);
282static int shutdown_vlan(struct lxc_handler *, struct lxc_netdev *);
283static int shutdown_phys(struct lxc_handler *, struct lxc_netdev *);
284static int shutdown_empty(struct lxc_handler *, struct lxc_netdev *);
26b797f3 285static int shutdown_none(struct lxc_handler *, struct lxc_netdev *);
74a2b586 286
a589434e 287static instantiate_cb netdev_deconf[LXC_NET_MAXCONFTYPE + 1] = {
74a2b586
JK		 288 [LXC_NET_VETH] = shutdown_veth,
289 [LXC_NET_MACVLAN] = shutdown_macvlan,
290 [LXC_NET_VLAN] = shutdown_vlan,
291 [LXC_NET_PHYS] = shutdown_phys,
292 [LXC_NET_EMPTY] = shutdown_empty,
26b797f3 293 [LXC_NET_NONE] = shutdown_none,
74a2b586
JK		 294};
295
998ac676 296static struct mount_opt mount_opt[] = {
88d413d5
SW		 297 { "defaults", 0, 0 },
298 { "ro", 0, MS_RDONLY },
299 { "rw", 1, MS_RDONLY },
300 { "suid", 1, MS_NOSUID },
301 { "nosuid", 0, MS_NOSUID },
302 { "dev", 1, MS_NODEV },
303 { "nodev", 0, MS_NODEV },
304 { "exec", 1, MS_NOEXEC },
305 { "noexec", 0, MS_NOEXEC },
306 { "sync", 0, MS_SYNCHRONOUS },
307 { "async", 1, MS_SYNCHRONOUS },
308 { "dirsync", 0, MS_DIRSYNC },
309 { "remount", 0, MS_REMOUNT },
310 { "mand", 0, MS_MANDLOCK },
311 { "nomand", 1, MS_MANDLOCK },
312 { "atime", 1, MS_NOATIME },
313 { "noatime", 0, MS_NOATIME },
314 { "diratime", 1, MS_NODIRATIME },
315 { "nodiratime", 0, MS_NODIRATIME },
316 { "bind", 0, MS_BIND },
317 { "rbind", 0, MS_BIND|MS_REC },
318 { "relatime", 0, MS_RELATIME },
319 { "norelatime", 1, MS_RELATIME },
320 { "strictatime", 0, MS_STRICTATIME },
321 { "nostrictatime", 1, MS_STRICTATIME },
322 { NULL, 0, 0 },
998ac676
RT		 323};
324
e37dda71 325#if HAVE_LIBCAP
81810dd1 326static struct caps_opt caps_opt[] = {
a6afdde9 327 { "chown", CAP_CHOWN },
1e11be34
DL		 328 { "dac_override", CAP_DAC_OVERRIDE },
329 { "dac_read_search", CAP_DAC_READ_SEARCH },
330 { "fowner", CAP_FOWNER },
331 { "fsetid", CAP_FSETID },
81810dd1
DL		 332 { "kill", CAP_KILL },
333 { "setgid", CAP_SETGID },
334 { "setuid", CAP_SETUID },
335 { "setpcap", CAP_SETPCAP },
336 { "linux_immutable", CAP_LINUX_IMMUTABLE },
337 { "net_bind_service", CAP_NET_BIND_SERVICE },
338 { "net_broadcast", CAP_NET_BROADCAST },
339 { "net_admin", CAP_NET_ADMIN },
340 { "net_raw", CAP_NET_RAW },
341 { "ipc_lock", CAP_IPC_LOCK },
342 { "ipc_owner", CAP_IPC_OWNER },
343 { "sys_module", CAP_SYS_MODULE },
344 { "sys_rawio", CAP_SYS_RAWIO },
345 { "sys_chroot", CAP_SYS_CHROOT },
346 { "sys_ptrace", CAP_SYS_PTRACE },
347 { "sys_pacct", CAP_SYS_PACCT },
348 { "sys_admin", CAP_SYS_ADMIN },
349 { "sys_boot", CAP_SYS_BOOT },
350 { "sys_nice", CAP_SYS_NICE },
351 { "sys_resource", CAP_SYS_RESOURCE },
352 { "sys_time", CAP_SYS_TIME },
353 { "sys_tty_config", CAP_SYS_TTY_CONFIG },
354 { "mknod", CAP_MKNOD },
355 { "lease", CAP_LEASE },
57b837e2
CB		 356#ifdef CAP_AUDIT_READ
357 { "audit_read", CAP_AUDIT_READ },
358#endif
9527e566 359#ifdef CAP_AUDIT_WRITE
81810dd1 360 { "audit_write", CAP_AUDIT_WRITE },
9527e566
FW		 361#endif
362#ifdef CAP_AUDIT_CONTROL
81810dd1 363 { "audit_control", CAP_AUDIT_CONTROL },
9527e566 364#endif
81810dd1
DL		 365 { "setfcap", CAP_SETFCAP },
366 { "mac_override", CAP_MAC_OVERRIDE },
367 { "mac_admin", CAP_MAC_ADMIN },
5170c716
CS		 368#ifdef CAP_SYSLOG
369 { "syslog", CAP_SYSLOG },
370#endif
371#ifdef CAP_WAKE_ALARM
372 { "wake_alarm", CAP_WAKE_ALARM },
373#endif
2b54359b
CB		 374#ifdef CAP_BLOCK_SUSPEND
375 { "block_suspend", CAP_BLOCK_SUSPEND },
376#endif
81810dd1 377};
495d2046
SG		 378#else
379static struct caps_opt caps_opt[] = {};
380#endif
81810dd1 381
c6d09e15
WB		 382static struct limit_opt limit_opt[] = {
383#ifdef RLIMIT_AS
384 { "as", RLIMIT_AS },
385#endif
386#ifdef RLIMIT_CORE
387 { "core", RLIMIT_CORE },
388#endif
389#ifdef RLIMIT_CPU
390 { "cpu", RLIMIT_CPU },
391#endif
392#ifdef RLIMIT_DATA
393 { "data", RLIMIT_DATA },
394#endif
395#ifdef RLIMIT_FSIZE
396 { "fsize", RLIMIT_FSIZE },
397#endif
398#ifdef RLIMIT_LOCKS
399 { "locks", RLIMIT_LOCKS },
400#endif
401#ifdef RLIMIT_MEMLOCK
402 { "memlock", RLIMIT_MEMLOCK },
403#endif
404#ifdef RLIMIT_MSGQUEUE
405 { "msgqueue", RLIMIT_MSGQUEUE },
406#endif
407#ifdef RLIMIT_NICE
408 { "nice", RLIMIT_NICE },
409#endif
410#ifdef RLIMIT_NOFILE
411 { "nofile", RLIMIT_NOFILE },
412#endif
413#ifdef RLIMIT_NPROC
414 { "nproc", RLIMIT_NPROC },
415#endif
416#ifdef RLIMIT_RSS
417 { "rss", RLIMIT_RSS },
418#endif
419#ifdef RLIMIT_RTPRIO
420 { "rtprio", RLIMIT_RTPRIO },
421#endif
422#ifdef RLIMIT_RTTIME
423 { "rttime", RLIMIT_RTTIME },
424#endif
425#ifdef RLIMIT_SIGPENDING
426 { "sigpending", RLIMIT_SIGPENDING },
427#endif
428#ifdef RLIMIT_STACK
429 { "stack", RLIMIT_STACK },
430#endif
431};
432
91c3830e
SH		 433static int run_buffer(char *buffer)
434{
ebec9176 435 struct lxc_popen_FILE *f;
91c3830e 436 char *output;
8e7da691 437 int ret;
91c3830e 438
ebec9176 439 f = lxc_popen(buffer);
91c3830e 440 if (!f) {
062b72c6 441 SYSERROR("Failed to popen() %s.", buffer);
91c3830e
SH		 442 return -1;
443 }
444
445 output = malloc(LXC_LOG_BUFFER_SIZE);
446 if (!output) {
062b72c6 447 ERROR("Failed to allocate memory for %s.", buffer);
ebec9176 448 lxc_pclose(f);
91c3830e
SH		 449 return -1;
450 }
451
062b72c6
CB		 452 while (fgets(output, LXC_LOG_BUFFER_SIZE, f->f))
453 DEBUG("Script %s with output: %s.", buffer, output);
91c3830e
SH		 454
455 free(output);
456
ebec9176 457 ret = lxc_pclose(f);
8e7da691 458 if (ret == -1) {
062b72c6 459 SYSERROR("Script exited with error.");
91c3830e 460 return -1;
8e7da691 461 } else if (WIFEXITED(ret) && WEXITSTATUS(ret) != 0) {
062b72c6 462 ERROR("Script exited with status %d.", WEXITSTATUS(ret));
8e7da691
DE		 463 return -1;
464 } else if (WIFSIGNALED(ret)) {
062b72c6 465 ERROR("Script terminated by signal %d.", WTERMSIG(ret));
8e7da691 466 return -1;
91c3830e
SH		 467 }
468
469 return 0;
470}
471
148e91f5 472static int run_script_argv(const char *name, const char *section,
062b72c6
CB		 473 const char *script, const char *hook,
474 const char *lxcpath, char **argsin)
148e91f5
SH		 475{
476 int ret, i;
477 char *buffer;
478 size_t size = 0;
479
062b72c6 480 INFO("Executing script \"%s\" for container \"%s\", config section \"%s\".",
148e91f5
SH		 481 script, name, section);
482
062b72c6 483 for (i = 0; argsin && argsin[i]; i++)
148e91f5
SH		 484 size += strlen(argsin[i]) + 1;
485
486 size += strlen(hook) + 1;
487
488 size += strlen(script);
489 size += strlen(name);
490 size += strlen(section);
491 size += 3;
492
493 if (size > INT_MAX)
494 return -1;
495
496 buffer = alloca(size);
497 if (!buffer) {
062b72c6 498 ERROR("Failed to allocate memory.");
148e91f5
SH		 499 return -1;
500 }
501
062b72c6
CB		 502 ret =
503 snprintf(buffer, size, "%s %s %s %s", script, name, section, hook);
504 if (ret < 0 || (size_t)ret >= size) {
505 ERROR("Script name too long.");
148e91f5
SH		 506 return -1;
507 }
508
062b72c6
CB		 509 for (i = 0; argsin && argsin[i]; i++) {
510 int len = size - ret;
148e91f5
SH		 511 int rc;
512 rc = snprintf(buffer + ret, len, " %s", argsin[i]);
513 if (rc < 0 || rc >= len) {
062b72c6 514 ERROR("Script args too long.");
148e91f5
SH		 515 return -1;
516 }
517 ret += rc;
518 }
519
520 return run_buffer(buffer);
521}
522
062b72c6
CB		 523static int run_script(const char *name, const char *section, const char *script,
524 ...)
e3b4c4c4 525{
abbfd20b 526 int ret;
91c3830e 527 char *buffer, *p;
abbfd20b
DL		 528 size_t size = 0;
529 va_list ap;
751d9dcd 530
062b72c6 531 INFO("Executing script \"%s\" for container \"%s\", config section \"%s\".",
751d9dcd 532 script, name, section);
e3b4c4c4 533
abbfd20b
DL		 534 va_start(ap, script);
535 while ((p = va_arg(ap, char *)))
95642a10 536 size += strlen(p) + 1;
abbfd20b
DL		 537 va_end(ap);
538
539 size += strlen(script);
540 size += strlen(name);
541 size += strlen(section);
95642a10 542 size += 3;
abbfd20b 543
95642a10
MS		 544 if (size > INT_MAX)
545 return -1;
546
547 buffer = alloca(size);
abbfd20b 548 if (!buffer) {
062b72c6 549 ERROR("Failed to allocate memory.");
751d9dcd
DL		 550 return -1;
551 }
552
9ba8130c
SH		 553 ret = snprintf(buffer, size, "%s %s %s", script, name, section);
554 if (ret < 0 || ret >= size) {
062b72c6 555 ERROR("Script name too long.");
9ba8130c
SH		 556 return -1;
557 }
751d9dcd 558
abbfd20b 559 va_start(ap, script);
9ba8130c 560 while ((p = va_arg(ap, char *))) {
062b72c6 561 int len = size - ret;
9ba8130c
SH		 562 int rc;
563 rc = snprintf(buffer + ret, len, " %s", p);
564 if (rc < 0 || rc >= len) {
062b72c6 565 ERROR("Script args too long.");
9ba8130c
SH		 566 return -1;
567 }
568 ret += rc;
569 }
abbfd20b 570 va_end(ap);
751d9dcd 571
91c3830e 572 return run_buffer(buffer);
e3b4c4c4
ST		 573}
574
a17b1e65
SG		 575static int mount_rootfs_dir(const char *rootfs, const char *target,
576 const char *options)
a6afdde9 577{
a17b1e65
SG		 578 unsigned long mntflags;
579 char *mntdata;
580 int ret;
581
582 if (parse_mntopts(options, &mntflags, &mntdata) < 0) {
583 free(mntdata);
584 return -1;
585 }
586
587 ret = mount(rootfs, target, "none", MS_BIND | MS_REC | mntflags, mntdata);
588 free(mntdata);
589
590 return ret;
a6afdde9
DL		 591}
592
593static int setup_lodev(const char *rootfs, int fd, struct loop_info64 *loinfo)
594{
595 int rfd;
596 int ret = -1;
597
598 rfd = open(rootfs, O_RDWR);
599 if (rfd < 0) {
600 SYSERROR("failed to open '%s'", rootfs);
78ae2fcc 601 return -1;
602 }
603
a6afdde9 604 memset(loinfo, 0, sizeof(*loinfo));
78ae2fcc 605
a6afdde9 606 loinfo->lo_flags = LO_FLAGS_AUTOCLEAR;
78ae2fcc 607
a6afdde9
DL		 608 if (ioctl(fd, LOOP_SET_FD, rfd)) {
609 SYSERROR("failed to LOOP_SET_FD");
610 goto out;
78ae2fcc 611 }
612
a6afdde9
DL		 613 if (ioctl(fd, LOOP_SET_STATUS64, loinfo)) {
614 SYSERROR("failed to LOOP_SET_STATUS64");
78ae2fcc 615 goto out;
616 }
617
a6afdde9 618 ret = 0;
78ae2fcc 619out:
a6afdde9 620 close(rfd);
78ae2fcc 621
a6afdde9 622 return ret;
78ae2fcc 623}
624
a17b1e65
SG		 625static int mount_rootfs_file(const char *rootfs, const char *target,
626 const char *options)
78ae2fcc 627{
74f96976 628 struct dirent *direntp;
a6afdde9 629 struct loop_info64 loinfo;
9ba8130c 630 int ret = -1, fd = -1, rc;
a6afdde9
DL		 631 DIR *dir;
632 char path[MAXPATHLEN];
78ae2fcc 633
a6afdde9
DL		 634 dir = opendir("/dev");
635 if (!dir) {
636 SYSERROR("failed to open '/dev'");
78ae2fcc 637 return -1;
638 }
639
74f96976 640 while ((direntp = readdir(dir))) {
a6afdde9
DL		 641
642 if (!direntp)
643 break;
644
645 if (!strcmp(direntp->d_name, "."))
646 continue;
647
648 if (!strcmp(direntp->d_name, ".."))
649 continue;
650
651 if (strncmp(direntp->d_name, "loop", 4))
652 continue;
653
9ba8130c
SH		 654 rc = snprintf(path, MAXPATHLEN, "/dev/%s", direntp->d_name);
655 if (rc < 0 || rc >= MAXPATHLEN)
656 continue;
657
a6afdde9
DL		 658 fd = open(path, O_RDWR);
659 if (fd < 0)
660 continue;
661
662 if (ioctl(fd, LOOP_GET_STATUS64, &loinfo) == 0) {
663 close(fd);
664 continue;
665 }
666
667 if (errno != ENXIO) {
668 WARN("unexpected error for ioctl on '%s': %m",
669 direntp->d_name);
00b6be44 670 close(fd);
a6afdde9
DL		 671 continue;
672 }
673
674 DEBUG("found '%s' free lodev", path);
675
676 ret = setup_lodev(rootfs, fd, &loinfo);
677 if (!ret)
a17b1e65 678 ret = mount_unknown_fs(path, target, options);
a6afdde9
DL		 679 close(fd);
680
681 break;
682 }
683
684 if (closedir(dir))
685 WARN("failed to close directory");
686
687 return ret;
78ae2fcc 688}
689
a17b1e65
SG		 690static int mount_rootfs_block(const char *rootfs, const char *target,
691 const char *options)
a6afdde9 692{
a17b1e65 693 return mount_unknown_fs(rootfs, target, options);
a6afdde9
DL		 694}
695
0c547523
SH		 696/*
697 * pin_rootfs
b7ed4bf0
CS		 698 * if rootfs is a directory, then open ${rootfs}/lxc.hold for writing for
699 * the duration of the container run, to prevent the container from marking
700 * the underlying fs readonly on shutdown. unlink the file immediately so
701 * no name pollution is happens
0c547523
SH		 702 * return -1 on error.
703 * return -2 if nothing needed to be pinned.
704 * return an open fd (>=0) if we pinned it.
705 */
706int pin_rootfs(const char *rootfs)
707{
708 char absrootfs[MAXPATHLEN];
709 char absrootfspin[MAXPATHLEN];
710 struct stat s;
711 int ret, fd;
712
e99ee0de 713 if (rootfs == NULL || strlen(rootfs) == 0)
0d03360a 714 return -2;
e99ee0de 715
00ec333b 716 if (!realpath(rootfs, absrootfs))
9be53773 717 return -2;
0c547523 718
00ec333b 719 if (access(absrootfs, F_OK))
0c547523 720 return -1;
0c547523 721
00ec333b 722 if (stat(absrootfs, &s))
0c547523 723 return -1;
0c547523 724
72f919c4 725 if (!S_ISDIR(s.st_mode))
0c547523
SH		 726 return -2;
727
b7ed4bf0 728 ret = snprintf(absrootfspin, MAXPATHLEN, "%s/lxc.hold", absrootfs);
00ec333b 729 if (ret >= MAXPATHLEN)
0c547523 730 return -1;
0c547523
SH		 731
732 fd = open(absrootfspin, O_CREAT | O_RDWR, S_IWUSR|S_IRUSR);
b7ed4bf0
CS		 733 if (fd < 0)
734 return fd;
735 (void)unlink(absrootfspin);
0c547523
SH		 736 return fd;
737}
738
e2a7e8dc
SH		 739/*
740 * If we are asking to remount something, make sure that any
741 * NOEXEC etc are honored.
742 */
743static unsigned long add_required_remount_flags(const char *s, const char *d,
744 unsigned long flags)
745{
614305f3 746#ifdef HAVE_STATVFS
e2a7e8dc
SH		 747 struct statvfs sb;
748 unsigned long required_flags = 0;
749
750 if (!(flags & MS_REMOUNT))
751 return flags;
752
753 if (!s)
754 s = d;
755
756 if (!s)
757 return flags;
758 if (statvfs(s, &sb) < 0)
759 return flags;
760
761 if (sb.f_flag & MS_NOSUID)
762 required_flags |= MS_NOSUID;
763 if (sb.f_flag & MS_NODEV)
764 required_flags |= MS_NODEV;
765 if (sb.f_flag & MS_RDONLY)
766 required_flags |= MS_RDONLY;
767 if (sb.f_flag & MS_NOEXEC)
768 required_flags |= MS_NOEXEC;
769
770 return flags | required_flags;
614305f3
SH		 771#else
772 return flags;
773#endif
e2a7e8dc
SH		 774}
775
4fb3cba5 776static int lxc_mount_auto_mounts(struct lxc_conf *conf, int flags, struct lxc_handler *handler)
368bbc02 777{
368bbc02 778 int r;
80e80c40 779 int i;
b06b8511
CS		 780 static struct {
781 int match_mask;
782 int match_flag;
783 const char *source;
784 const char *destination;
785 const char *fstype;
786 unsigned long flags;
787 const char *options;
788 } default_mounts[] = {
789 /* Read-only bind-mounting... In older kernels, doing that required
790 * to do one MS_BIND mount and then MS_REMOUNT|MS_RDONLY the same
791 * one. According to mount(2) manpage, MS_BIND honors MS_RDONLY from
792 * kernel 2.6.26 onwards. However, this apparently does not work on
793 * kernel 3.8. Unfortunately, on that very same kernel, doing the
794 * same trick as above doesn't seem to work either, there one needs
795 * to ALSO specify MS_BIND for the remount, otherwise the entire
796 * fs is remounted read-only or the mount fails because it's busy...
797 * MS_REMOUNT|MS_BIND|MS_RDONLY seems to work for kernels as low as
798 * 2.6.32...
368bbc02 799 */
f24a52d5 800 { LXC_AUTO_PROC_MASK, LXC_AUTO_PROC_MIXED, "proc", "%r/proc", "proc", MS_NODEV|MS_NOEXEC|MS_NOSUID, NULL },
592fd47a
SH		 801 /* proc/tty is used as a temporary placeholder for proc/sys/net which we'll move back in a few steps */
802 { LXC_AUTO_PROC_MASK, LXC_AUTO_PROC_MIXED, "%r/proc/sys/net", "%r/proc/tty", NULL, MS_BIND, NULL },
f24a52d5
SG		 803 { LXC_AUTO_PROC_MASK, LXC_AUTO_PROC_MIXED, "%r/proc/sys", "%r/proc/sys", NULL, MS_BIND, NULL },
804 { LXC_AUTO_PROC_MASK, LXC_AUTO_PROC_MIXED, NULL, "%r/proc/sys", NULL, MS_REMOUNT|MS_BIND|MS_RDONLY, NULL },
592fd47a 805 { LXC_AUTO_PROC_MASK, LXC_AUTO_PROC_MIXED, "%r/proc/tty", "%r/proc/sys/net", NULL, MS_MOVE, NULL },
f24a52d5
SG		 806 { LXC_AUTO_PROC_MASK, LXC_AUTO_PROC_MIXED, "%r/proc/sysrq-trigger", "%r/proc/sysrq-trigger", NULL, MS_BIND, NULL },
807 { LXC_AUTO_PROC_MASK, LXC_AUTO_PROC_MIXED, NULL, "%r/proc/sysrq-trigger", NULL, MS_REMOUNT|MS_BIND|MS_RDONLY, NULL },
808 { LXC_AUTO_PROC_MASK, LXC_AUTO_PROC_RW, "proc", "%r/proc", "proc", MS_NODEV|MS_NOEXEC|MS_NOSUID, NULL },
809 { LXC_AUTO_SYS_MASK, LXC_AUTO_SYS_RW, "sysfs", "%r/sys", "sysfs", 0, NULL },
810 { LXC_AUTO_SYS_MASK, LXC_AUTO_SYS_RO, "sysfs", "%r/sys", "sysfs", MS_RDONLY, NULL },
811 { LXC_AUTO_SYS_MASK, LXC_AUTO_SYS_MIXED, "sysfs", "%r/sys", "sysfs", MS_NODEV|MS_NOEXEC|MS_NOSUID, NULL },
812 { LXC_AUTO_SYS_MASK, LXC_AUTO_SYS_MIXED, "%r/sys", "%r/sys", NULL, MS_BIND, NULL },
813 { LXC_AUTO_SYS_MASK, LXC_AUTO_SYS_MIXED, NULL, "%r/sys", NULL, MS_REMOUNT|MS_BIND|MS_RDONLY, NULL },
814 { LXC_AUTO_SYS_MASK, LXC_AUTO_SYS_MIXED, "sysfs", "%r/sys/devices/virtual/net", "sysfs", 0, NULL },
815 { LXC_AUTO_SYS_MASK, LXC_AUTO_SYS_MIXED, "%r/sys/devices/virtual/net/devices/virtual/net", "%r/sys/devices/virtual/net", NULL, MS_BIND, NULL },
816 { LXC_AUTO_SYS_MASK, LXC_AUTO_SYS_MIXED, NULL, "%r/sys/devices/virtual/net", NULL, MS_REMOUNT|MS_BIND|MS_NOSUID|MS_NODEV|MS_NOEXEC, NULL },
817 { 0, 0, NULL, NULL, NULL, 0, NULL }
b06b8511 818 };
368bbc02 819
b06b8511
CS		 820 for (i = 0; default_mounts[i].match_mask; i++) {
821 if ((flags & default_mounts[i].match_mask) == default_mounts[i].match_flag) {
822 char *source = NULL;
823 char *destination = NULL;
824 int saved_errno;
e2a7e8dc 825 unsigned long mflags;
b06b8511
CS		 826
827 if (default_mounts[i].source) {
828 /* will act like strdup if %r is not present */
8ede5f4c 829 source = lxc_string_replace("%r", conf->rootfs.path ? conf->rootfs.mount : "", default_mounts[i].source);
b06b8511
CS		 830 if (!source) {
831 SYSERROR("memory allocation error");
832 return -1;
833 }
834 }
cc4fd506
SH		 835 if (!default_mounts[i].destination) {
836 ERROR("BUG: auto mounts destination %d was NULL", i);
b2f44b4d 837 free(source);
cc4fd506
SH		 838 return -1;
839 }
840 /* will act like strdup if %r is not present */
841 destination = lxc_string_replace("%r", conf->rootfs.path ? conf->rootfs.mount : "", default_mounts[i].destination);
842 if (!destination) {
843 saved_errno = errno;
844 SYSERROR("memory allocation error");
845 free(source);
846 errno = saved_errno;
847 return -1;
b06b8511 848 }
e2a7e8dc
SH		 849 mflags = add_required_remount_flags(source, destination,
850 default_mounts[i].flags);
592fd47a 851 r = safe_mount(source, destination, default_mounts[i].fstype, mflags, default_mounts[i].options, conf->rootfs.path ? conf->rootfs.mount : NULL);
b06b8511 852 saved_errno = errno;
b88ff9a0
SG		 853 if (r < 0 && errno == ENOENT) {
854 INFO("Mount source or target for %s on %s doesn't exist. Skipping.", source, destination);
855 r = 0;
856 }
857 else if (r < 0)
e2a7e8dc 858 SYSERROR("error mounting %s on %s flags %lu", source, destination, mflags);
f24a52d5 859
b06b8511
CS		 860 free(source);
861 free(destination);
862 if (r < 0) {
b06b8511
CS		 863 errno = saved_errno;
864 return -1;
865 }
368bbc02 866 }
368bbc02
CS		 867 }
868
b06b8511 869 if (flags & LXC_AUTO_CGROUP_MASK) {
0769b82a
CS		 870 int cg_flags;
871
872 cg_flags = flags & LXC_AUTO_CGROUP_MASK;
873 /* If the type of cgroup mount was not specified, it depends on the
874 * container's capabilities as to what makes sense: if we have
875 * CAP_SYS_ADMIN, the read-only part can be remounted read-write
876 * anyway, so we may as well default to read-write; then the admin
877 * will not be given a false sense of security. (And if they really
878 * want mixed r/o r/w, then they can explicitly specify :mixed.)
879 * OTOH, if the container lacks CAP_SYS_ADMIN, do only default to
880 * :mixed, because then the container can't remount it read-write. */
881 if (cg_flags == LXC_AUTO_CGROUP_NOSPEC || cg_flags == LXC_AUTO_CGROUP_FULL_NOSPEC) {
882 int has_sys_admin = 0;
883 if (!lxc_list_empty(&conf->keepcaps)) {
884 has_sys_admin = in_caplist(CAP_SYS_ADMIN, &conf->keepcaps);
885 } else {
886 has_sys_admin = !in_caplist(CAP_SYS_ADMIN, &conf->caps);
887 }
888 if (cg_flags == LXC_AUTO_CGROUP_NOSPEC) {
889 cg_flags = has_sys_admin ? LXC_AUTO_CGROUP_RW : LXC_AUTO_CGROUP_MIXED;
890 } else {
891 cg_flags = has_sys_admin ? LXC_AUTO_CGROUP_FULL_RW : LXC_AUTO_CGROUP_FULL_MIXED;
892 }
893 }
894
8ede5f4c 895 if (!cgroup_mount(conf->rootfs.path ? conf->rootfs.mount : "", handler, cg_flags)) {
368bbc02 896 SYSERROR("error mounting /sys/fs/cgroup");
b06b8511 897 return -1;
368bbc02
CS		 898 }
899 }
900
368bbc02 901 return 0;
368bbc02
CS		 902}
903
a17b1e65 904static int mount_rootfs(const char *rootfs, const char *target, const char *options)
0ad19a3f 905{
b09ef133 906 char absrootfs[MAXPATHLEN];
78ae2fcc 907 struct stat s;
a6afdde9 908 int i;
78ae2fcc 909
a17b1e65 910 typedef int (*rootfs_cb)(const char *, const char *, const char *);
78ae2fcc 911
912 struct rootfs_type {
913 int type;
914 rootfs_cb cb;
915 } rtfs_type[] = {
2656d231
DL		 916 { S_IFDIR, mount_rootfs_dir },
917 { S_IFBLK, mount_rootfs_block },
918 { S_IFREG, mount_rootfs_file },
78ae2fcc 919 };
0ad19a3f 920
4c8ab83b 921 if (!realpath(rootfs, absrootfs)) {
91c3e281 922 SYSERROR("Failed to get real path for \"%s\".", rootfs);
4c8ab83b 923 return -1;
924 }
b09ef133 925
b09ef133 926 if (access(absrootfs, F_OK)) {
d26582c1 927 SYSERROR("The rootfs \"%s\" is not accessible.", absrootfs);
b09ef133 928 return -1;
929 }
930
78ae2fcc 931 if (stat(absrootfs, &s)) {
91c3e281 932 SYSERROR("Failed to stat the rootfs \"%s\".", absrootfs);
9b0f0477 933 return -1;
934 }
935
78ae2fcc 936 for (i = 0; i < sizeof(rtfs_type)/sizeof(rtfs_type[0]); i++) {
78ae2fcc 937 if (!__S_ISTYPE(s.st_mode, rtfs_type[i].type))
938 continue;
9b0f0477 939
a17b1e65 940 return rtfs_type[i].cb(absrootfs, target, options);
78ae2fcc 941 }
9b0f0477 942
91c3e281 943 ERROR("Unsupported rootfs type for rootfs \"%s\".", absrootfs);
78ae2fcc 944 return -1;
0ad19a3f 945}
946
4e5440c6 947static int setup_utsname(struct utsname *utsname)
0ad19a3f 948{
4e5440c6
DL		 949 if (!utsname)
950 return 0;
0ad19a3f 951
4e5440c6
DL		 952 if (sethostname(utsname->nodename, strlen(utsname->nodename))) {
953 SYSERROR("failed to set the hostname to '%s'", utsname->nodename);
0ad19a3f 954 return -1;
955 }
956
4e5440c6 957 INFO("'%s' hostname has been setup", utsname->nodename);
cd54d859 958
0ad19a3f 959 return 0;
960}
961
69aa6655
DE		 962struct dev_symlinks {
963 const char *oldpath;
964 const char *name;
965};
966
967static const struct dev_symlinks dev_symlinks[] = {
968 {"/proc/self/fd", "fd"},
969 {"/proc/self/fd/0", "stdin"},
970 {"/proc/self/fd/1", "stdout"},
971 {"/proc/self/fd/2", "stderr"},
972};
973
974static int setup_dev_symlinks(const struct lxc_rootfs *rootfs)
975{
976 char path[MAXPATHLEN];
977 int ret,i;
09227be2 978 struct stat s;
69aa6655
DE		 979
980
981 for (i = 0; i < sizeof(dev_symlinks) / sizeof(dev_symlinks[0]); i++) {
982 const struct dev_symlinks *d = &dev_symlinks[i];
ec50007f 983 ret = snprintf(path, sizeof(path), "%s/dev/%s", rootfs->path ? rootfs->mount : "", d->name);
69aa6655
DE		 984 if (ret < 0 || ret >= MAXPATHLEN)
985 return -1;
09227be2
MW		 986
987 /*
988 * Stat the path first. If we don't get an error
989 * accept it as is and don't try to create it
990 */
991 if (!stat(path, &s)) {
992 continue;
993 }
994
69aa6655 995 ret = symlink(d->oldpath, path);
09227be2 996
69aa6655 997 if (ret && errno != EEXIST) {
09227be2
MW		 998 if ( errno == EROFS ) {
999 WARN("Warning: Read Only file system while creating %s", path);
1000 } else {
1001 SYSERROR("Error creating %s", path);
1002 return -1;
1003 }
69aa6655
DE		 1004 }
1005 }
1006 return 0;
1007}
1008
393903d1
SH		 1009/*
1010 * Build a space-separate list of ptys to pass to systemd.
1011 */
1012static bool append_ptyname(char **pp, char *name)
b0a33c1e 1013{
393903d1
SH		 1014 char *p;
1015
1016 if (!*pp) {
1017 *pp = malloc(strlen(name) + strlen("container_ttys=") + 1);
1018 if (!*pp)
1019 return false;
1020 sprintf(*pp, "container_ttys=%s", name);
1021 return true;
1022 }
1023 p = realloc(*pp, strlen(*pp) + strlen(name) + 2);
1024 if (!p)
1025 return false;
1026 *pp = p;
1027 strcat(p, " ");
1028 strcat(p, name);
1029 return true;
1030}
1031
1032static int setup_tty(struct lxc_conf *conf)
1033{
393903d1
SH		 1034 const struct lxc_tty_info *tty_info = &conf->tty_info;
1035 char *ttydir = conf->ttydir;
7c6ef2a2
SH		 1036 char path[MAXPATHLEN], lxcpath[MAXPATHLEN];
1037 int i, ret;
b0a33c1e 1038
e8bd4e43 1039 if (!conf->rootfs.path)
bc9bd0e3
DL		 1040 return 0;
1041
b0a33c1e 1042 for (i = 0; i < tty_info->nbtty; i++) {
1043
1044 struct lxc_pty_info *pty_info = &tty_info->pty_info[i];
1045
e8bd4e43 1046 ret = snprintf(path, sizeof(path), "/dev/tty%d", i + 1);
7c6ef2a2
SH		 1047 if (ret >= sizeof(path)) {
1048 ERROR("pathname too long for ttys");
1049 return -1;
1050 }
1051 if (ttydir) {
1052 /* create dev/lxc/tty%d" */
e8bd4e43 1053 ret = snprintf(lxcpath, sizeof(lxcpath), "/dev/%s/tty%d", ttydir, i + 1);
7c6ef2a2
SH		 1054 if (ret >= sizeof(lxcpath)) {
1055 ERROR("pathname too long for ttys");
1056 return -1;
1057 }
1058 ret = creat(lxcpath, 0660);
1059 if (ret==-1 && errno != EEXIST) {
959aee9c 1060 SYSERROR("error creating %s", lxcpath);
7c6ef2a2
SH		 1061 return -1;
1062 }
4d44e274
SH		 1063 if (ret >= 0)
1064 close(ret);
7c6ef2a2
SH		 1065 ret = unlink(path);
1066 if (ret && errno != ENOENT) {
959aee9c 1067 SYSERROR("error unlinking %s", path);
7c6ef2a2
SH		 1068 return -1;
1069 }
b0a33c1e 1070
7c6ef2a2
SH		 1071 if (mount(pty_info->name, lxcpath, "none", MS_BIND, 0)) {
1072 WARN("failed to mount '%s'->'%s'",
1073 pty_info->name, path);
1074 continue;
1075 }
13954cce 1076
9ba8130c
SH		 1077 ret = snprintf(lxcpath, sizeof(lxcpath), "%s/tty%d", ttydir, i+1);
1078 if (ret >= sizeof(lxcpath)) {
1079 ERROR("tty pathname too long");
1080 return -1;
1081 }
7c6ef2a2
SH		 1082 ret = symlink(lxcpath, path);
1083 if (ret) {
959aee9c 1084 SYSERROR("failed to create symlink for tty %d", i+1);
7c6ef2a2
SH		 1085 return -1;
1086 }
1087 } else {
c6883f38
SH		 1088 /* If we populated /dev, then we need to create /dev/ttyN */
1089 if (access(path, F_OK)) {
1090 ret = creat(path, 0660);
1091 if (ret==-1) {
959aee9c 1092 SYSERROR("error creating %s", path);
c6883f38 1093 /* this isn't fatal, continue */
025ed0f3 1094 } else {
c6883f38 1095 close(ret);
025ed0f3 1096 }
c6883f38 1097 }
7c6ef2a2 1098 if (mount(pty_info->name, path, "none", MS_BIND, 0)) {
e8bd4e43 1099 SYSERROR("failed to mount '%s'->'%s'", pty_info->name, path);
7c6ef2a2
SH		 1100 continue;
1101 }
393903d1 1102 }
e8bd4e43 1103 if (!append_ptyname(&conf->pty_names, pty_info->name)) {
393903d1
SH		 1104 ERROR("Error setting up container_ttys string");
1105 return -1;
b0a33c1e 1106 }
1107 }
1108
cd54d859
DL		 1109 INFO("%d tty(s) has been setup", tty_info->nbtty);
1110
b0a33c1e 1111 return 0;
1112}
1113
bf601689 1114
59bb8698 1115static int setup_rootfs_pivot_root(const char *rootfs)
bf601689 1116{
2d489f9e 1117 int oldroot = -1, newroot = -1;
bf601689 1118
2d489f9e
SH		 1119 oldroot = open("/", O_DIRECTORY | O_RDONLY);
1120 if (oldroot < 0) {
1121 SYSERROR("Error opening old-/ for fchdir");
9ba8130c
SH		 1122 return -1;
1123 }
2d489f9e
SH		 1124 newroot = open(rootfs, O_DIRECTORY | O_RDONLY);
1125 if (newroot < 0) {
1126 SYSERROR("Error opening new-/ for fchdir");
1127 goto fail;
c08556c6 1128 }
bf601689 1129
cc6f6dd7 1130 /* change into new root fs */
2d489f9e 1131 if (fchdir(newroot)) {
cc6f6dd7 1132 SYSERROR("can't chdir to new rootfs '%s'", rootfs);
2d489f9e 1133 goto fail;
cc6f6dd7
DL		 1134 }
1135
cc6f6dd7 1136 /* pivot_root into our new root fs */
2d489f9e 1137 if (pivot_root(".", ".")) {
cc6f6dd7 1138 SYSERROR("pivot_root syscall failed");
2d489f9e 1139 goto fail;
bf601689 1140 }
cc6f6dd7 1141
2d489f9e
SH		 1142 /*
1143 * at this point the old-root is mounted on top of our new-root
1144 * To unmounted it we must not be chdir'd into it, so escape back
1145 * to old-root
1146 */
1147 if (fchdir(oldroot) < 0) {
1148 SYSERROR("Error entering oldroot");
1149 goto fail;
1150 }
7981ea46 1151 if (umount2(".", MNT_DETACH) < 0) {
2d489f9e
SH		 1152 SYSERROR("Error detaching old root");
1153 goto fail;
cc6f6dd7
DL		 1154 }
1155
2d489f9e
SH		 1156 if (fchdir(newroot) < 0) {
1157 SYSERROR("Error re-entering newroot");
1158 goto fail;
1159 }
cc6f6dd7 1160
2d489f9e
SH		 1161 close(oldroot);
1162 close(newroot);
bf601689 1163
2d489f9e 1164 DEBUG("pivot_root syscall to '%s' successful", rootfs);
bf601689 1165
bf601689 1166 return 0;
2d489f9e
SH		 1167
1168fail:
1169 if (oldroot != -1)
1170 close(oldroot);
1171 if (newroot != -1)
1172 close(newroot);
1173 return -1;
bf601689
MH		 1174}
1175
bc6928ff 1176/*
87da4ec3
SH		 1177 * Just create a path for /dev under $lxcpath/$name and in rootfs
1178 * If we hit an error, log it but don't fail yet.
91c3830e 1179 */
14221cbb 1180static int mount_autodev(const char *name, const struct lxc_rootfs *rootfs, const char *lxcpath)
91c3830e
SH		 1181{
1182 int ret;
87da4ec3
SH		 1183 size_t clen;
1184 char *path;
91c3830e 1185
14221cbb 1186 INFO("Mounting container /dev");
bc6928ff 1187
14221cbb 1188 /* $(rootfs->mount) + "/dev/pts" + '\0' */
ec50007f 1189 clen = (rootfs->path ? strlen(rootfs->mount) : 0) + 9;
87da4ec3 1190 path = alloca(clen);
bc6928ff 1191
ec50007f 1192 ret = snprintf(path, clen, "%s/dev", rootfs->path ? rootfs->mount : "");
87da4ec3 1193 if (ret < 0 || ret >= clen)
91c3830e 1194 return -1;
bc6928ff 1195
87da4ec3 1196 if (!dir_exists(path)) {
14221cbb 1197 WARN("No /dev in container.");
87da4ec3
SH		 1198 WARN("Proceeding without autodev setup");
1199 return 0;
bc6928ff 1200 }
87da4ec3 1201
1ec0e8e3 1202 ret = safe_mount("none", path, "tmpfs", 0, "size=500000,mode=755",
ec50007f 1203 rootfs->path ? rootfs->mount : NULL);
1ec0e8e3 1204 if (ret != 0) {
87da4ec3 1205 SYSERROR("Failed mounting tmpfs onto %s\n", path);
1ec0e8e3 1206 return -1;
91c3830e 1207 }
87da4ec3
SH		 1208
1209 INFO("Mounted tmpfs onto %s", path);
1210
ec50007f 1211 ret = snprintf(path, clen, "%s/dev/pts", rootfs->path ? rootfs->mount : "");
87da4ec3 1212 if (ret < 0 || ret >= clen)
91c3830e 1213 return -1;
87da4ec3 1214
bc6928ff
MW		 1215 /*
1216 * If we are running on a devtmpfs mapping, dev/pts may already exist.
1217 * If not, then create it and exit if that fails...
1218 */
87da4ec3 1219 if (!dir_exists(path)) {
bc6928ff
MW		 1220 ret = mkdir(path, S_IRWXU | S_IRGRP | S_IXGRP | S_IROTH | S_IXOTH);
1221 if (ret) {
1222 SYSERROR("Failed to create /dev/pts in container");
1223 return -1;
1224 }
91c3830e
SH		 1225 }
1226
14221cbb 1227 INFO("Mounted container /dev");
91c3830e
SH		 1228 return 0;
1229}
1230
c6883f38 1231struct lxc_devs {
74a3920a 1232 const char *name;
c6883f38
SH		 1233 mode_t mode;
1234 int maj;
1235 int min;
1236};
1237
74a3920a 1238static const struct lxc_devs lxc_devs[] = {
c6883f38
SH		 1239 { "null", S_IFCHR | S_IRWXU | S_IRWXG | S_IRWXO, 1, 3 },
1240 { "zero", S_IFCHR | S_IRWXU | S_IRWXG | S_IRWXO, 1, 5 },
1241 { "full", S_IFCHR | S_IRWXU | S_IRWXG | S_IRWXO, 1, 7 },
1242 { "urandom", S_IFCHR | S_IRWXU | S_IRWXG | S_IRWXO, 1, 9 },
1243 { "random", S_IFCHR | S_IRWXU | S_IRWXG | S_IRWXO, 1, 8 },
1244 { "tty", S_IFCHR | S_IRWXU | S_IRWXG | S_IRWXO, 5, 0 },
1245 { "console", S_IFCHR | S_IRUSR | S_IWUSR, 5, 1 },
1246};
1247
0728ebf4 1248static int fill_autodev(const struct lxc_rootfs *rootfs, bool mount_console)
c6883f38
SH		 1249{
1250 int ret;
c6883f38
SH		 1251 char path[MAXPATHLEN];
1252 int i;
3a32201c 1253 mode_t cmask;
c6883f38 1254
14221cbb 1255 INFO("Creating initial consoles under container /dev");
91c3830e 1256
ec50007f 1257 ret = snprintf(path, MAXPATHLEN, "%s/dev", rootfs->path ? rootfs->mount : "");
91c3830e
SH		 1258 if (ret < 0 || ret >= MAXPATHLEN) {
1259 ERROR("Error calculating container /dev location");
c6883f38 1260 return -1;
f7bee6c6 1261 }
91c3830e 1262
9769034f 1263 if (!dir_exists(path)) // ignore, just don't try to fill in
9cb4d183
SH		 1264 return 0;
1265
14221cbb 1266 INFO("Populating container /dev");
3a32201c 1267 cmask = umask(S_IXUSR | S_IXGRP | S_IXOTH);
c6883f38 1268 for (i = 0; i < sizeof(lxc_devs) / sizeof(lxc_devs[0]); i++) {
74a3920a 1269 const struct lxc_devs *d = &lxc_devs[i];
0728ebf4
TA		 1270
1271 if (!strcmp(d->name, "console") && !mount_console)
1272 continue;
1273
ec50007f 1274 ret = snprintf(path, MAXPATHLEN, "%s/dev/%s", rootfs->path ? rootfs->mount : "", d->name);
c6883f38
SH		 1275 if (ret < 0 || ret >= MAXPATHLEN)
1276 return -1;
1277 ret = mknod(path, d->mode, makedev(d->maj, d->min));
91c3830e 1278 if (ret && errno != EEXIST) {
9cb4d183
SH		 1279 char hostpath[MAXPATHLEN];
1280 FILE *pathfile;
1281
1282 // Unprivileged containers cannot create devices, so
1283 // bind mount the device from the host
1284 ret = snprintf(hostpath, MAXPATHLEN, "/dev/%s", d->name);
1285 if (ret < 0 || ret >= MAXPATHLEN)
1286 return -1;
1287 pathfile = fopen(path, "wb");
1288 if (!pathfile) {
1289 SYSERROR("Failed to create device mount target '%s'", path);
1290 return -1;
1291 }
1292 fclose(pathfile);
592fd47a 1293 if (safe_mount(hostpath, path, 0, MS_BIND, NULL,
ec50007f 1294 rootfs->path ? rootfs->mount : NULL) != 0) {
9cb4d183
SH		 1295 SYSERROR("Failed bind mounting device %s from host into container",
1296 d->name);
1297 return -1;
1298 }
c6883f38
SH		 1299 }
1300 }
3a32201c 1301 umask(cmask);
c6883f38 1302
14221cbb 1303 INFO("Populated container /dev");
c6883f38
SH		 1304 return 0;
1305}
1306
cc28d0b0 1307static int setup_rootfs(struct lxc_conf *conf)
0ad19a3f 1308{
91c3e281
CB		 1309 struct bdev *bdev;
1310 const struct lxc_rootfs *rootfs;
cc28d0b0 1311
91c3e281 1312 rootfs = &conf->rootfs;
a0f379bf 1313 if (!rootfs->path) {
91c3e281
CB		 1314 if (mount("", "/", NULL, MS_SLAVE | MS_REC, 0)) {
1315 SYSERROR("Failed to make / rslave.");
a0f379bf
DW		 1316 return -1;
1317 }
c69bd12f 1318 return 0;
a0f379bf 1319 }
0ad19a3f 1320
12297168 1321 if (access(rootfs->mount, F_OK)) {
91c3e281 1322 SYSERROR("Failed to access to \"%s\". Check it is present.",
12297168 1323 rootfs->mount);
b1789442
DL		 1324 return -1;
1325 }
1326
91c3e281
CB		 1327 /* First try mounting rootfs using a bdev. */
1328 bdev = bdev_init(conf, rootfs->path, rootfs->mount, rootfs->options);
1329 if (bdev && !bdev->ops->mount(bdev)) {
59d66af2 1330 bdev_put(bdev);
91c3e281
CB		 1331 DEBUG("Mounted rootfs \"%s\" onto \"%s\" with options \"%s\".",
1332 rootfs->path, rootfs->mount,
1333 rootfs->options ? rootfs->options : "(null)");
9be53773
SH		 1334 return 0;
1335 }
59d66af2
SH		 1336 if (bdev)
1337 bdev_put(bdev);
a17b1e65 1338 if (mount_rootfs(rootfs->path, rootfs->mount, rootfs->options)) {
91c3e281
CB		 1339 ERROR("Failed to mount rootfs \"%s\" onto \"%s\" with options \"%s\".",
1340 rootfs->path, rootfs->mount,
1341 rootfs->options ? rootfs->options : "(null)");
c3f0a28c 1342 return -1;
1343 }
0ad19a3f 1344
91c3e281
CB		 1345 DEBUG("Mounted rootfs \"%s\" onto \"%s\" with options \"%s\".",
1346 rootfs->path, rootfs->mount,
1347 rootfs->options ? rootfs->options : "(null)");
ac778708
DL		 1348 return 0;
1349}
1350
91e93c71
AV		 1351int prepare_ramfs_root(char *root)
1352{
eab15c1e 1353 char buf[LXC_LINELEN], *p;
91e93c71
AV		 1354 char nroot[PATH_MAX];
1355 FILE *f;
1356 int i;
1357 char *p2;
1358
1359 if (realpath(root, nroot) == NULL)
1360 return -1;
1361
1362 if (chdir("/") == -1)
1363 return -1;
1364
1365 /*
1366 * We could use here MS_MOVE, but in userns this mount is
1367 * locked and can't be moved.
1368 */
1369 if (mount(root, "/", NULL, MS_REC | MS_BIND, NULL)) {
1370 SYSERROR("Failed to move %s into /", root);
1371 return -1;
1372 }
1373
88322f77 1374 if (mount(NULL, "/", NULL, MS_REC | MS_PRIVATE, NULL)) {
91e93c71
AV		 1375 SYSERROR("Failed to make . rprivate");
1376 return -1;
1377 }
1378
1379 /*
1380 * The following code cleans up inhereted mounts which are not
1381 * required for CT.
1382 *
1383 * The mountinfo file shows not all mounts, if a few points have been
1384 * unmounted between read operations from the mountinfo. So we need to
1385 * read mountinfo a few times.
1386 *
1387 * This loop can be skipped if a container uses unserns, because all
1388 * inherited mounts are locked and we should live with all this trash.
1389 */
1390 while (1) {
1391 int progress = 0;
1392
1393 f = fopen("./proc/self/mountinfo", "r");
1394 if (!f) {
1395 SYSERROR("Unable to open /proc/self/mountinfo");
1396 return -1;
1397 }
eab15c1e 1398 while (fgets(buf, LXC_LINELEN, f)) {
91e93c71
AV		 1399 for (p = buf, i=0; p && i < 4; i++)
1400 p = strchr(p+1, ' ');
1401 if (!p)
1402 continue;
1403 p2 = strchr(p+1, ' ');
1404 if (!p2)
1405 continue;
1406
1407 *p2 = '\0';
1408 *p = '.';
1409
1410 if (strcmp(p + 1, "/") == 0)
1411 continue;
1412 if (strcmp(p + 1, "/proc") == 0)
1413 continue;
1414
1415 if (umount2(p, MNT_DETACH) == 0)
1416 progress++;
1417 }
1418 fclose(f);
1419 if (!progress)
1420 break;
1421 }
1422
8bea9fae
PR		 1423 /* This also can be skipped if a container uses unserns */
1424 umount2("./proc", MNT_DETACH);
91e93c71
AV		 1425
1426 /* It is weird, but chdir("..") moves us in a new root */
1427 if (chdir("..") == -1) {
1428 SYSERROR("Unable to change working directory");
1429 return -1;
1430 }
1431
1432 if (chroot(".") == -1) {
1433 SYSERROR("Unable to chroot");
1434 return -1;
1435 }
1436
1437 return 0;
1438}
1439
74a3920a 1440static int setup_pivot_root(const struct lxc_rootfs *rootfs)
ac778708 1441{
ac778708
DL		 1442 if (!rootfs->path)
1443 return 0;
1444
91e93c71
AV		 1445 if (detect_ramfs_rootfs()) {
1446 if (prepare_ramfs_root(rootfs->mount))
1447 return -1;
59bb8698 1448 } else if (setup_rootfs_pivot_root(rootfs->mount)) {
cc6f6dd7 1449 ERROR("failed to setup pivot root");
25368b52 1450 return -1;
c69bd12f
DL		 1451 }
1452
25368b52 1453 return 0;
0ad19a3f 1454}
1455
d852c78c 1456static int setup_pts(int pts)
3c26f34e 1457{
77890c6d
SW		 1458 char target[PATH_MAX];
1459
d852c78c
DL		 1460 if (!pts)
1461 return 0;
3c26f34e 1462
1463 if (!access("/dev/pts/ptmx", F_OK) && umount("/dev/pts")) {
36eb9bde 1464 SYSERROR("failed to umount 'dev/pts'");
3c26f34e 1465 return -1;
1466 }
1467
7e40254a
JTLB		 1468 if (mkdir("/dev/pts", 0755)) {
1469 if ( errno != EEXIST ) {
1470 SYSERROR("failed to create '/dev/pts'");
1471 return -1;
1472 }
1473 }
1474
a6afdde9 1475 if (mount("devpts", "/dev/pts", "devpts", MS_MGC_VAL,
67e5a20a 1476 "newinstance,ptmxmode=0666,mode=0620,gid=5")) {
36eb9bde 1477 SYSERROR("failed to mount a new instance of '/dev/pts'");
3c26f34e 1478 return -1;
1479 }
1480
3c26f34e 1481 if (access("/dev/ptmx", F_OK)) {
1482 if (!symlink("/dev/pts/ptmx", "/dev/ptmx"))
1483 goto out;
36eb9bde 1484 SYSERROR("failed to symlink '/dev/pts/ptmx'->'/dev/ptmx'");
3c26f34e 1485 return -1;
1486 }
1487
77890c6d
SW		 1488 if (realpath("/dev/ptmx", target) && !strcmp(target, "/dev/pts/ptmx"))
1489 goto out;
1490
3c26f34e 1491 /* fallback here, /dev/pts/ptmx exists just mount bind */
1492 if (mount("/dev/pts/ptmx", "/dev/ptmx", "none", MS_BIND, 0)) {
36eb9bde 1493 SYSERROR("mount failed '/dev/pts/ptmx'->'/dev/ptmx'");
3c26f34e 1494 return -1;
1495 }
cd54d859
DL		 1496
1497 INFO("created new pts instance");
d852c78c 1498
3c26f34e 1499out:
1500 return 0;
1501}
1502
cccc74b5
DL		 1503static int setup_personality(int persona)
1504{
6ff05e18 1505 #if HAVE_SYS_PERSONALITY_H
cccc74b5
DL		 1506 if (persona == -1)
1507 return 0;
1508
1509 if (personality(persona) < 0) {
1510 SYSERROR("failed to set personality to '0x%x'", persona);
1511 return -1;
1512 }
1513
1514 INFO("set personality to '0x%x'", persona);
6ff05e18 1515 #endif
cccc74b5
DL		 1516
1517 return 0;
1518}
1519
7c6ef2a2 1520static int setup_dev_console(const struct lxc_rootfs *rootfs,
33fcb7a0 1521 const struct lxc_console *console)
6e590161 1522{
63376d7d 1523 char path[MAXPATHLEN];
0728ebf4 1524 int ret, fd;
52e35957 1525
7c6ef2a2
SH		 1526 ret = snprintf(path, sizeof(path), "%s/dev/console", rootfs->mount);
1527 if (ret >= sizeof(path)) {
959aee9c 1528 ERROR("console path too long");
7c6ef2a2
SH		 1529 return -1;
1530 }
52e35957 1531
0728ebf4
TA		 1532 fd = open(path, O_CREAT | O_EXCL, S_IXUSR | S_IXGRP | S_IXOTH);
1533 if (fd < 0) {
1534 if (errno != EEXIST) {
1535 SYSERROR("failed to create console");
1536 return -1;
1537 }
1538 } else {
1539 close(fd);
52e35957
DL		 1540 }
1541
b5159817
DE		 1542 if (console->master < 0) {
1543 INFO("no console");
f78a1f32
DL		 1544 return 0;
1545 }
ed502555 1546
0728ebf4 1547 if (chmod(console->name, S_IXUSR | S_IXGRP | S_IXOTH)) {
63376d7d 1548 SYSERROR("failed to set mode '0%o' to '%s'",
0728ebf4 1549 S_IXUSR | S_IXGRP | S_IXOTH, console->name);
63376d7d
DL		 1550 return -1;
1551 }
13954cce 1552
592fd47a 1553 if (safe_mount(console->name, path, "none", MS_BIND, 0, rootfs->mount)) {
63376d7d 1554 ERROR("failed to mount '%s' on '%s'", console->name, path);
6e590161 1555 return -1;
1556 }
1557
63376d7d 1558 INFO("console has been setup");
7c6ef2a2
SH		 1559 return 0;
1560}
1561
1562static int setup_ttydir_console(const struct lxc_rootfs *rootfs,
1563 const struct lxc_console *console,
1564 char *ttydir)
1565{
1566 char path[MAXPATHLEN], lxcpath[MAXPATHLEN];
1567 int ret;
1568
1569 /* create rootfs/dev/<ttydir> directory */
1570 ret = snprintf(path, sizeof(path), "%s/dev/%s", rootfs->mount,
1571 ttydir);
1572 if (ret >= sizeof(path))
1573 return -1;
1574 ret = mkdir(path, 0755);
1575 if (ret && errno != EEXIST) {
959aee9c 1576 SYSERROR("failed with errno %d to create %s", errno, path);
7c6ef2a2
SH		 1577 return -1;
1578 }
959aee9c 1579 INFO("created %s", path);
7c6ef2a2
SH		 1580
1581 ret = snprintf(lxcpath, sizeof(lxcpath), "%s/dev/%s/console",
1582 rootfs->mount, ttydir);
1583 if (ret >= sizeof(lxcpath)) {
959aee9c 1584 ERROR("console path too long");
7c6ef2a2
SH		 1585 return -1;
1586 }
1587
1588 snprintf(path, sizeof(path), "%s/dev/console", rootfs->mount);
1589 ret = unlink(path);
1590 if (ret && errno != ENOENT) {
959aee9c 1591 SYSERROR("error unlinking %s", path);
7c6ef2a2
SH		 1592 return -1;
1593 }
1594
1595 ret = creat(lxcpath, 0660);
1596 if (ret==-1 && errno != EEXIST) {
959aee9c 1597 SYSERROR("error %d creating %s", errno, lxcpath);
7c6ef2a2
SH		 1598 return -1;
1599 }
4d44e274
SH		 1600 if (ret >= 0)
1601 close(ret);
7c6ef2a2 1602
b5159817
DE		 1603 if (console->master < 0) {
1604 INFO("no console");
7c6ef2a2
SH		 1605 return 0;
1606 }
1607
592fd47a 1608 if (safe_mount(console->name, lxcpath, "none", MS_BIND, 0, rootfs->mount)) {
7c6ef2a2
SH		 1609 ERROR("failed to mount '%s' on '%s'", console->name, lxcpath);
1610 return -1;
1611 }
1612
1613 /* create symlink from rootfs/dev/console to 'lxc/console' */
9ba8130c
SH		 1614 ret = snprintf(lxcpath, sizeof(lxcpath), "%s/console", ttydir);
1615 if (ret >= sizeof(lxcpath)) {
1616 ERROR("lxc/console path too long");
1617 return -1;
1618 }
7c6ef2a2
SH		 1619 ret = symlink(lxcpath, path);
1620 if (ret) {
1621 SYSERROR("failed to create symlink for console");
1622 return -1;
1623 }
1624
1625 INFO("console has been setup on %s", lxcpath);
cd54d859 1626
6e590161 1627 return 0;
1628}
1629
7c6ef2a2
SH		 1630static int setup_console(const struct lxc_rootfs *rootfs,
1631 const struct lxc_console *console,
1632 char *ttydir)
1633{
1634 /* We don't have a rootfs, /dev/console will be shared */
1635 if (!rootfs->path)
1636 return 0;
1637 if (!ttydir)
1638 return setup_dev_console(rootfs, console);
1639
1640 return setup_ttydir_console(rootfs, console, ttydir);
1641}
1642
1bd051a6
SH		 1643static int setup_kmsg(const struct lxc_rootfs *rootfs,
1644 const struct lxc_console *console)
1645{
1646 char kpath[MAXPATHLEN];
1647 int ret;
1648
222fea5a
DE		 1649 if (!rootfs->path)
1650 return 0;
1bd051a6
SH		 1651 ret = snprintf(kpath, sizeof(kpath), "%s/dev/kmsg", rootfs->mount);
1652 if (ret < 0 || ret >= sizeof(kpath))
1653 return -1;
1654
1655 ret = unlink(kpath);
1656 if (ret && errno != ENOENT) {
959aee9c 1657 SYSERROR("error unlinking %s", kpath);
1bd051a6
SH		 1658 return -1;
1659 }
1660
1661 ret = symlink("console", kpath);
1662 if (ret) {
1663 SYSERROR("failed to create symlink for kmsg");
1664 return -1;
1665 }
1666
1667 return 0;
1668}
1669
998ac676
RT		 1670static void parse_mntopt(char *opt, unsigned long *flags, char **data)
1671{
1672 struct mount_opt *mo;
1673
1674 /* If opt is found in mount_opt, set or clear flags.
1675 * Otherwise append it to data. */
1676
1677 for (mo = &mount_opt[0]; mo->name != NULL; mo++) {
1678 if (!strncmp(opt, mo->name, strlen(mo->name))) {
1679 if (mo->clear)
1680 *flags &= ~mo->flag;
1681 else
1682 *flags |= mo->flag;
1683 return;
1684 }
1685 }
1686
1687 if (strlen(*data))
1688 strcat(*data, ",");
1689 strcat(*data, opt);
1690}
1691
a17b1e65 1692int parse_mntopts(const char *mntopts, unsigned long *mntflags,
998ac676
RT		 1693 char **mntdata)
1694{
1695 char *s, *data;
1696 char *p, *saveptr = NULL;
1697
911324ef 1698 *mntdata = NULL;
91656ce5 1699 *mntflags = 0L;
911324ef
DL		 1700
1701 if (!mntopts)
998ac676
RT		 1702 return 0;
1703
911324ef 1704 s = strdup(mntopts);
998ac676 1705 if (!s) {
36eb9bde 1706 SYSERROR("failed to allocate memory");
998ac676
RT		 1707 return -1;
1708 }
1709
1710 data = malloc(strlen(s) + 1);
1711 if (!data) {
36eb9bde 1712 SYSERROR("failed to allocate memory");
998ac676
RT		 1713 free(s);
1714 return -1;
1715 }
1716 *data = 0;
1717
1718 for (p = strtok_r(s, ",", &saveptr); p != NULL;
1719 p = strtok_r(NULL, ",", &saveptr))
1720 parse_mntopt(p, mntflags, &data);
1721
1722 if (*data)
1723 *mntdata = data;
1724 else
1725 free(data);
1726 free(s);
1727
1728 return 0;
1729}
1730
6fd5e769
SH		 1731static void null_endofword(char *word)
1732{
1733 while (*word && *word != ' ' && *word != '\t')
1734 word++;
1735 *word = '\0';
1736}
1737
1738/*
1739 * skip @nfields spaces in @src
1740 */
1741static char *get_field(char *src, int nfields)
1742{
1743 char *p = src;
1744 int i;
1745
1746 for (i = 0; i < nfields; i++) {
1747 while (*p && *p != ' ' && *p != '\t')
1748 p++;
1749 if (!*p)
1750 break;
1751 p++;
1752 }
1753 return p;
1754}
1755
911324ef
DL		 1756static int mount_entry(const char *fsname, const char *target,
1757 const char *fstype, unsigned long mountflags,
ae7a770e 1758 const char *data, int optional, int dev, const char *rootfs)
911324ef 1759{
614305f3 1760#ifdef HAVE_STATVFS
2938f7c8 1761 struct statvfs sb;
614305f3 1762#endif
2938f7c8 1763
592fd47a 1764 if (safe_mount(fsname, target, fstype, mountflags & ~MS_REMOUNT, data, rootfs)) {
1fc64d22
SG		 1765 if (optional) {
1766 INFO("failed to mount '%s' on '%s' (optional): %s", fsname,
1767 target, strerror(errno));
1768 return 0;
1769 }
1770 else {
1771 SYSERROR("failed to mount '%s' on '%s'", fsname, target);
1772 return -1;
1773 }
911324ef
DL		 1774 }
1775
1776 if ((mountflags & MS_REMOUNT) || (mountflags & MS_BIND)) {
2938f7c8
SH		 1777 DEBUG("remounting %s on %s to respect bind or remount options",
1778 fsname ? fsname : "(none)", target ? target : "(none)");
7c5b6e7c
AS		 1779 unsigned long rqd_flags = 0;
1780 if (mountflags & MS_RDONLY)
1781 rqd_flags |= MS_RDONLY;
614305f3 1782#ifdef HAVE_STATVFS
2938f7c8 1783 if (statvfs(fsname, &sb) == 0) {
7c5b6e7c 1784 unsigned long required_flags = rqd_flags;
2938f7c8
SH		 1785 if (sb.f_flag & MS_NOSUID)
1786 required_flags |= MS_NOSUID;
ae7a770e 1787 if (sb.f_flag & MS_NODEV && !dev)
2938f7c8
SH		 1788 required_flags |= MS_NODEV;
1789 if (sb.f_flag & MS_RDONLY)
1790 required_flags |= MS_RDONLY;
1791 if (sb.f_flag & MS_NOEXEC)
1792 required_flags |= MS_NOEXEC;
1793 DEBUG("(at remount) flags for %s was %lu, required extra flags are %lu", fsname, sb.f_flag, required_flags);
1794 /*
1795 * If this was a bind mount request, and required_flags
1796 * does not have any flags which are not already in
1797 * mountflags, then skip the remount
1798 */
1799 if (!(mountflags & MS_REMOUNT)) {
7c5b6e7c 1800 if (!(required_flags & ~mountflags) && rqd_flags == 0) {
2938f7c8
SH		 1801 DEBUG("mountflags already was %lu, skipping remount",
1802 mountflags);
1803 goto skipremount;
1804 }
1805 }
1806 mountflags |= required_flags;
6fd5e769 1807 }
614305f3 1808#endif
911324ef
DL		 1809
1810 if (mount(fsname, target, fstype,
592fd47a 1811 mountflags | MS_REMOUNT, data) < 0) {
1fc64d22
SG		 1812 if (optional) {
1813 INFO("failed to mount '%s' on '%s' (optional): %s",
1814 fsname, target, strerror(errno));
1815 return 0;
1816 }
1817 else {
1818 SYSERROR("failed to mount '%s' on '%s'",
1819 fsname, target);
1820 return -1;
1821 }
911324ef
DL		 1822 }
1823 }
1824
614305f3 1825#ifdef HAVE_STATVFS
6fd5e769 1826skipremount:
614305f3 1827#endif
911324ef
DL		 1828 DEBUG("mounted '%s' on '%s', type '%s'", fsname, target, fstype);
1829
1830 return 0;
1831}
1832
4e4ca161
SH		 1833/*
1834 * Remove 'optional', 'create=dir', and 'create=file' from mntopt
1835 */
1836static void cull_mntent_opt(struct mntent *mntent)
1837{
1838 int i;
1839 char *p, *p2;
1840 char *list[] = {"create=dir",
1841 "create=file",
1842 "optional",
1843 NULL };
1844
1845 for (i=0; list[i]; i++) {
1846 if (!(p = strstr(mntent->mnt_opts, list[i])))
1847 continue;
1848 p2 = strchr(p, ',');
1849 if (!p2) {
1850 /* no more mntopts, so just chop it here */
1851 *p = '\0';
1852 continue;
1853 }
1854 memmove(p, p2+1, strlen(p2+1)+1);
1855 }
1856}
1857
4d5b72a1 1858static int mount_entry_create_dir_file(const struct mntent *mntent,
0a2dddd4
CB		 1859 const char* path, const struct lxc_rootfs *rootfs,
1860 const char *lxc_name, const char *lxc_path)
0ad19a3f 1861{
4d5b72a1 1862 char *pathdirname = NULL;
608e3567 1863 int ret = 0;
34cfffb3 1864 FILE *pathfile = NULL;
911324ef 1865
6e46cc0d 1866 if (strncmp(mntent->mnt_type, "overlay", 7) == 0) {
5c484f79 1867 if (ovl_mkdir(mntent, rootfs, lxc_name, lxc_path) < 0)
6e46cc0d
CB		 1868 return -1;
1869 } else if (strncmp(mntent->mnt_type, "aufs", 4) == 0) {
1d52bdf7 1870 if (aufs_mkdir(mntent, rootfs, lxc_name, lxc_path) < 0)
6e46cc0d
CB		 1871 return -1;
1872 }
1873
34cfffb3 1874 if (hasmntopt(mntent, "create=dir")) {
4d5b72a1
NC		 1875 if (mkdir_p(path, 0755) < 0) {
1876 WARN("Failed to create mount target '%s'", path);
34cfffb3
SG		 1877 ret = -1;
1878 }
1879 }
1880
4d5b72a1
NC		 1881 if (hasmntopt(mntent, "create=file") && access(path, F_OK)) {
1882 pathdirname = strdup(path);
34cfffb3 1883 pathdirname = dirname(pathdirname);
119126b6
SG		 1884 if (mkdir_p(pathdirname, 0755) < 0) {
1885 WARN("Failed to create target directory");
1886 }
4d5b72a1 1887 pathfile = fopen(path, "wb");
34cfffb3 1888 if (!pathfile) {
4d5b72a1 1889 WARN("Failed to create mount target '%s'", path);
34cfffb3 1890 ret = -1;
6e46cc0d 1891 } else {
34cfffb3 1892 fclose(pathfile);
6e46cc0d 1893 }
34cfffb3 1894 }
4d5b72a1
NC		 1895 free(pathdirname);
1896 return ret;
1897}
1898
ec50007f
CB		 1899/* rootfs, lxc_name, and lxc_path can be NULL when the container is created
1900 * without a rootfs. */
db4aba38 1901static inline int mount_entry_on_generic(struct mntent *mntent,
0a2dddd4
CB		 1902 const char* path, const struct lxc_rootfs *rootfs,
1903 const char *lxc_name, const char *lxc_path)
4d5b72a1
NC		 1904{
1905 unsigned long mntflags;
1906 char *mntdata;
1907 int ret;
1908 bool optional = hasmntopt(mntent, "optional") != NULL;
ae7a770e 1909 bool dev = hasmntopt(mntent, "dev") != NULL;
4d5b72a1 1910
ec50007f
CB		 1911 char *rootfs_path = NULL;
1912 if (rootfs && rootfs->path)
1913 rootfs_path = rootfs->mount;
1914
0a2dddd4 1915 ret = mount_entry_create_dir_file(mntent, path, rootfs, lxc_name, lxc_path);
34cfffb3 1916
608e3567
SH		 1917 if (ret < 0)
1918 return optional ? 0 : -1;
1919
4e4ca161
SH		 1920 cull_mntent_opt(mntent);
1921
a17b1e65
SG		 1922 if (parse_mntopts(mntent->mnt_opts, &mntflags, &mntdata) < 0) {
1923 free(mntdata);
1924 return -1;
1925 }
1926
6e46cc0d 1927 ret = mount_entry(mntent->mnt_fsname, path, mntent->mnt_type, mntflags,
ae7a770e 1928 mntdata, optional, dev, rootfs_path);
68c152ef 1929
911324ef 1930 free(mntdata);
911324ef
DL		 1931 return ret;
1932}
1933
db4aba38
NC		 1934static inline int mount_entry_on_systemfs(struct mntent *mntent)
1935{
1433c9f9
CB		 1936 char path[MAXPATHLEN];
1937 int ret;
1938
1939 /* For containers created without a rootfs all mounts are treated as
1940 * absolute paths starting at / on the host. */
1941 if (mntent->mnt_dir[0] != '/')
1942 ret = snprintf(path, sizeof(path), "/%s", mntent->mnt_dir);
1943 else
1944 ret = snprintf(path, sizeof(path), "%s", mntent->mnt_dir);
1945
1946 if (ret < 0 || ret >= sizeof(path)) {
1947 ERROR("path name too long");
1948 return -1;
1949 }
1950
1951 return mount_entry_on_generic(mntent, path, NULL, NULL, NULL);
db4aba38
NC		 1952}
1953
4e4ca161 1954static int mount_entry_on_absolute_rootfs(struct mntent *mntent,
80a881b2 1955 const struct lxc_rootfs *rootfs,
0a2dddd4
CB		 1956 const char *lxc_name,
1957 const char *lxc_path)
911324ef 1958{
013bd428 1959 char *aux;
59760f5d 1960 char path[MAXPATHLEN];
80a881b2 1961 int r, ret = 0, offset;
67e571de 1962 const char *lxcpath;
0ad19a3f 1963
593e8478 1964 lxcpath = lxc_global_config_value("lxc.lxcpath");
2a59a681
SH		 1965 if (!lxcpath) {
1966 ERROR("Out of memory");
1967 return -1;
1968 }
1969
80a881b2 1970 /* if rootfs->path is a blockdev path, allow container fstab to
2a59a681
SH		 1971 * use $lxcpath/CN/rootfs as the target prefix */
1972 r = snprintf(path, MAXPATHLEN, "%s/%s/rootfs", lxcpath, lxc_name);
80a881b2
SH		 1973 if (r < 0 || r >= MAXPATHLEN)
1974 goto skipvarlib;
1975
1976 aux = strstr(mntent->mnt_dir, path);
1977 if (aux) {
1978 offset = strlen(path);
1979 goto skipabs;
1980 }
1981
1982skipvarlib:
013bd428
DL		 1983 aux = strstr(mntent->mnt_dir, rootfs->path);
1984 if (!aux) {
1985 WARN("ignoring mount point '%s'", mntent->mnt_dir);
db4aba38 1986 return ret;
013bd428 1987 }
80a881b2
SH		 1988 offset = strlen(rootfs->path);
1989
1990skipabs:
013bd428 1991
9ba8130c 1992 r = snprintf(path, MAXPATHLEN, "%s/%s", rootfs->mount,
80a881b2
SH		 1993 aux + offset);
1994 if (r < 0 || r >= MAXPATHLEN) {
1995 WARN("pathnme too long for '%s'", mntent->mnt_dir);
a17b1e65
SG		 1996 return -1;
1997 }
1998
0a2dddd4 1999 return mount_entry_on_generic(mntent, path, rootfs, lxc_name, lxc_path);
911324ef 2000}
d330fe7b 2001
4e4ca161 2002static int mount_entry_on_relative_rootfs(struct mntent *mntent,
0a2dddd4
CB		 2003 const struct lxc_rootfs *rootfs,
2004 const char *lxc_name,
2005 const char *lxc_path)
911324ef
DL		 2006{
2007 char path[MAXPATHLEN];
911324ef 2008 int ret;
d330fe7b 2009
34cfffb3 2010 /* relative to root mount point */
6e46cc0d 2011 ret = snprintf(path, sizeof(path), "%s/%s", rootfs->mount, mntent->mnt_dir);
1433c9f9 2012 if (ret < 0 || ret >= sizeof(path)) {
9ba8130c
SH		 2013 ERROR("path name too long");
2014 return -1;
2015 }
911324ef 2016
0a2dddd4 2017 return mount_entry_on_generic(mntent, path, rootfs, lxc_name, lxc_path);
911324ef
DL		 2018}
2019
80a881b2 2020static int mount_file_entries(const struct lxc_rootfs *rootfs, FILE *file,
0a2dddd4 2021 const char *lxc_name, const char *lxc_path)
911324ef 2022{
aaf901be
AM		 2023 struct mntent mntent;
2024 char buf[4096];
911324ef 2025 int ret = -1;
e76b8764 2026
aaf901be 2027 while (getmntent_r(file, &mntent, buf, sizeof(buf))) {
e76b8764 2028
911324ef 2029 if (!rootfs->path) {
aaf901be 2030 if (mount_entry_on_systemfs(&mntent))
e76b8764 2031 goto out;
911324ef 2032 continue;
e76b8764
CDC		 2033 }
2034
911324ef 2035 /* We have a separate root, mounts are relative to it */
aaf901be 2036 if (mntent.mnt_dir[0] != '/') {
0a2dddd4 2037 if (mount_entry_on_relative_rootfs(&mntent, rootfs, lxc_name, lxc_path))
911324ef
DL		 2038 goto out;
2039 continue;
2040 }
cd54d859 2041
0a2dddd4 2042 if (mount_entry_on_absolute_rootfs(&mntent, rootfs, lxc_name, lxc_path))
911324ef 2043 goto out;
0ad19a3f 2044 }
cd54d859 2045
0ad19a3f 2046 ret = 0;
cd54d859
DL		 2047
2048 INFO("mount points have been setup");
0ad19a3f 2049out:
e7938e9e
MN		 2050 return ret;
2051}
2052
80a881b2 2053static int setup_mount(const struct lxc_rootfs *rootfs, const char *fstab,
0a2dddd4 2054 const char *lxc_name, const char *lxc_path)
e7938e9e
MN		 2055{
2056 FILE *file;
2057 int ret;
2058
2059 if (!fstab)
2060 return 0;
2061
2062 file = setmntent(fstab, "r");
2063 if (!file) {
2064 SYSERROR("failed to use '%s'", fstab);
2065 return -1;
2066 }
2067
0a2dddd4 2068 ret = mount_file_entries(rootfs, file, lxc_name, lxc_path);
e7938e9e 2069
0ad19a3f 2070 endmntent(file);
2071 return ret;
2072}
2073
5ef5c9a3 2074FILE *make_anonymous_mount_file(struct lxc_list *mount)
e7938e9e 2075{
5ef5c9a3 2076 int ret;
e7938e9e 2077 char *mount_entry;
5ef5c9a3
CB		 2078 struct lxc_list *iterator;
2079 FILE *file;
2080 int fd = -1;
2081
2082 fd = memfd_create("lxc_mount_file", MFD_CLOEXEC);
2083 if (fd < 0) {
2084 if (errno != ENOSYS)
2085 return NULL;
2086 file = tmpfile();
2087 } else {
2088 file = fdopen(fd, "r+");
2089 }
e7938e9e 2090
e7938e9e 2091 if (!file) {
fad6ef95 2092 int saved_errno = errno;
5ef5c9a3
CB		 2093 if (fd != -1)
2094 close(fd);
fad6ef95 2095 ERROR("Could not create mount entry file: %s.", strerror(saved_errno));
9fc7f8c0 2096 return NULL;
e7938e9e
MN		 2097 }
2098
2099 lxc_list_for_each(iterator, mount) {
2100 mount_entry = iterator->elem;
5ef5c9a3
CB		 2101 ret = fprintf(file, "%s\n", mount_entry);
2102 if (ret < strlen(mount_entry))
2103 WARN("Could not write mount entry to anonymous mount file.");
2104 }
2105
2106 if (fseek(file, 0, SEEK_SET) < 0) {
2107 fclose(file);
2108 return NULL;
e7938e9e
MN		 2109 }
2110
9fc7f8c0
TA		 2111 return file;
2112}
2113
5ef5c9a3
CB		 2114static int setup_mount_entries(const struct lxc_rootfs *rootfs,
2115 struct lxc_list *mount, const char *lxc_name,
2116 const char *lxc_path)
9fc7f8c0
TA		 2117{
2118 FILE *file;
2119 int ret;
2120
5ef5c9a3 2121 file = make_anonymous_mount_file(mount);
9fc7f8c0
TA		 2122 if (!file)
2123 return -1;
e7938e9e 2124
0a2dddd4 2125 ret = mount_file_entries(rootfs, file, lxc_name, lxc_path);
e7938e9e
MN		 2126
2127 fclose(file);
2128 return ret;
2129}
2130
bab88e68
CS		 2131static int parse_cap(const char *cap)
2132{
2133 char *ptr = NULL;
84760c11 2134 size_t i;
2135 int capid = -1;
bab88e68 2136
7035407c
DE		 2137 if (!strcmp(cap, "none"))
2138 return -2;
2139
bab88e68
CS		 2140 for (i = 0; i < sizeof(caps_opt)/sizeof(caps_opt[0]); i++) {
2141
2142 if (strcmp(cap, caps_opt[i].name))
2143 continue;
2144
2145 capid = caps_opt[i].value;
2146 break;
2147 }
2148
2149 if (capid < 0) {
2150 /* try to see if it's numeric, so the user may specify
2151 * capabilities that the running kernel knows about but
2152 * we don't */
2153 errno = 0;
2154 capid = strtol(cap, &ptr, 10);
2155 if (!ptr || *ptr != '\0' || errno != 0)
2156 /* not a valid number */
2157 capid = -1;
2158 else if (capid > lxc_caps_last_cap())
2159 /* we have a number but it's not a valid
2160 * capability */
2161 capid = -1;
2162 }
2163
2164 return capid;
2165}
2166
0769b82a
CS		 2167int in_caplist(int cap, struct lxc_list *caps)
2168{
2169 struct lxc_list *iterator;
2170 int capid;
2171
2172 lxc_list_for_each(iterator, caps) {
2173 capid = parse_cap(iterator->elem);
2174 if (capid == cap)
2175 return 1;
2176 }
2177
2178 return 0;
2179}
2180
81810dd1
DL		 2181static int setup_caps(struct lxc_list *caps)
2182{
2183 struct lxc_list *iterator;
2184 char *drop_entry;
bab88e68 2185 int capid;
81810dd1
DL		 2186
2187 lxc_list_for_each(iterator, caps) {
2188
2189 drop_entry = iterator->elem;
2190
bab88e68 2191 capid = parse_cap(drop_entry);
d55bc1ad 2192
81810dd1 2193 if (capid < 0) {
1e11be34
DL		 2194 ERROR("unknown capability %s", drop_entry);
2195 return -1;
81810dd1
DL		 2196 }
2197
2198 DEBUG("drop capability '%s' (%d)", drop_entry, capid);
2199
2200 if (prctl(PR_CAPBSET_DROP, capid, 0, 0, 0)) {
3ec1648d
SH		 2201 SYSERROR("failed to remove %s capability", drop_entry);
2202 return -1;
2203 }
81810dd1
DL		 2204
2205 }
2206
1fb86a7c
SH		 2207 DEBUG("capabilities have been setup");
2208
2209 return 0;
2210}
2211
2212static int dropcaps_except(struct lxc_list *caps)
2213{
2214 struct lxc_list *iterator;
2215 char *keep_entry;
1fb86a7c
SH		 2216 int i, capid;
2217 int numcaps = lxc_caps_last_cap() + 1;
959aee9c 2218 INFO("found %d capabilities", numcaps);
1fb86a7c 2219
2caf9a97
SH		 2220 if (numcaps <= 0 || numcaps > 200)
2221 return -1;
2222
1fb86a7c
SH		 2223 // caplist[i] is 1 if we keep capability i
2224 int *caplist = alloca(numcaps * sizeof(int));
2225 memset(caplist, 0, numcaps * sizeof(int));
2226
2227 lxc_list_for_each(iterator, caps) {
2228
2229 keep_entry = iterator->elem;
2230
bab88e68 2231 capid = parse_cap(keep_entry);
1fb86a7c 2232
7035407c
DE		 2233 if (capid == -2)
2234 continue;
2235
1fb86a7c
SH		 2236 if (capid < 0) {
2237 ERROR("unknown capability %s", keep_entry);
2238 return -1;
2239 }
2240
8255688a 2241 DEBUG("keep capability '%s' (%d)", keep_entry, capid);
1fb86a7c
SH		 2242
2243 caplist[capid] = 1;
2244 }
2245 for (i=0; i<numcaps; i++) {
2246 if (caplist[i])
2247 continue;
2248 if (prctl(PR_CAPBSET_DROP, i, 0, 0, 0)) {
3ec1648d
SH		 2249 SYSERROR("failed to remove capability %d", i);
2250 return -1;
2251 }
1fb86a7c
SH		 2252 }
2253
2254 DEBUG("capabilities have been setup");
81810dd1
DL		 2255
2256 return 0;
2257}
2258
0ad19a3f 2259static int setup_hw_addr(char *hwaddr, const char *ifname)
2260{
2261 struct sockaddr sockaddr;
2262 struct ifreq ifr;
fad6ef95 2263 int ret, fd, saved_errno;
0ad19a3f 2264
3cfc0f3a
MN		 2265 ret = lxc_convert_mac(hwaddr, &sockaddr);
2266 if (ret) {
2267 ERROR("mac address '%s' conversion failed : %s",
2268 hwaddr, strerror(-ret));
0ad19a3f 2269 return -1;
2270 }
2271
2272 memcpy(ifr.ifr_name, ifname, IFNAMSIZ);
5da6aa8c 2273 ifr.ifr_name[IFNAMSIZ-1] = '\0';
0ad19a3f 2274 memcpy((char *) &ifr.ifr_hwaddr, (char *) &sockaddr, sizeof(sockaddr));
2275
2276 fd = socket(AF_INET, SOCK_DGRAM, 0);
2277 if (fd < 0) {
3ab87b66 2278 ERROR("socket failure : %s", strerror(errno));
0ad19a3f 2279 return -1;
2280 }
2281
2282 ret = ioctl(fd, SIOCSIFHWADDR, &ifr);
fad6ef95 2283 saved_errno = errno;
0ad19a3f 2284 close(fd);
2285 if (ret)
fad6ef95 2286 ERROR("ioctl failure : %s", strerror(saved_errno));
0ad19a3f 2287
5da6aa8c 2288 DEBUG("mac address '%s' on '%s' has been setup", hwaddr, ifr.ifr_name);
cd54d859 2289
0ad19a3f 2290 return ret;
2291}
2292
82d5ae15 2293static int setup_ipv4_addr(struct lxc_list *ip, int ifindex)
0ad19a3f 2294{
82d5ae15
DL		 2295 struct lxc_list *iterator;
2296 struct lxc_inetdev *inetdev;
3cfc0f3a 2297 int err;
0ad19a3f 2298
82d5ae15
DL		 2299 lxc_list_for_each(iterator, ip) {
2300
2301 inetdev = iterator->elem;
2302
0093bb8c
DL		 2303 err = lxc_ipv4_addr_add(ifindex, &inetdev->addr,
2304 &inetdev->bcast, inetdev->prefix);
3cfc0f3a
MN		 2305 if (err) {
2306 ERROR("failed to setup_ipv4_addr ifindex %d : %s",
2307 ifindex, strerror(-err));
82d5ae15
DL		 2308 return -1;
2309 }
2310 }
2311
2312 return 0;
0ad19a3f 2313}
2314
82d5ae15 2315static int setup_ipv6_addr(struct lxc_list *ip, int ifindex)
0ad19a3f 2316{
82d5ae15 2317 struct lxc_list *iterator;
7fa9074f 2318 struct lxc_inet6dev *inet6dev;
3cfc0f3a 2319 int err;
0ad19a3f 2320
82d5ae15
DL		 2321 lxc_list_for_each(iterator, ip) {
2322
2323 inet6dev = iterator->elem;
2324
b3df193c 2325 err = lxc_ipv6_addr_add(ifindex, &inet6dev->addr,
0093bb8c
DL		 2326 &inet6dev->mcast, &inet6dev->acast,
2327 inet6dev->prefix);
3cfc0f3a
MN		 2328 if (err) {
2329 ERROR("failed to setup_ipv6_addr ifindex %d : %s",
2330 ifindex, strerror(-err));
82d5ae15 2331 return -1;
3cfc0f3a 2332 }
82d5ae15
DL		 2333 }
2334
2335 return 0;
0ad19a3f 2336}
2337
82d5ae15 2338static int setup_netdev(struct lxc_netdev *netdev)
0ad19a3f 2339{
0ad19a3f 2340 char ifname[IFNAMSIZ];
0ad19a3f 2341 char *current_ifname = ifname;
3cfc0f3a 2342 int err;
0ad19a3f 2343
82d5ae15
DL		 2344 /* empty network namespace */
2345 if (!netdev->ifindex) {
b0efbac4 2346 if (netdev->flags & IFF_UP) {
d472214b 2347 err = lxc_netdev_up("lo");
3cfc0f3a
MN		 2348 if (err) {
2349 ERROR("failed to set the loopback up : %s",
2350 strerror(-err));
82d5ae15
DL		 2351 return -1;
2352 }
82d5ae15 2353 }
40790553
SH		 2354 if (netdev->type != LXC_NET_VETH)
2355 return 0;
2356 netdev->ifindex = if_nametoindex(netdev->name);
0ad19a3f 2357 }
13954cce 2358
b466dc33 2359 /* get the new ifindex in case of physical netdev */
40790553 2360 if (netdev->type == LXC_NET_PHYS) {
b466dc33
BP		 2361 if (!(netdev->ifindex = if_nametoindex(netdev->link))) {
2362 ERROR("failed to get ifindex for %s",
2363 netdev->link);
2364 return -1;
2365 }
40790553 2366 }
b466dc33 2367
82d5ae15
DL		 2368 /* retrieve the name of the interface */
2369 if (!if_indextoname(netdev->ifindex, current_ifname)) {
36eb9bde 2370 ERROR("no interface corresponding to index '%d'",
82d5ae15 2371 netdev->ifindex);
0ad19a3f 2372 return -1;
2373 }
13954cce 2374
018ef520 2375 /* default: let the system to choose one interface name */
9d083402 2376 if (!netdev->name)
fb6d9b2f
DL		 2377 netdev->name = netdev->type == LXC_NET_PHYS ?
2378 netdev->link : "eth%d";
018ef520 2379
82d5ae15 2380 /* rename the interface name */
40790553
SH		 2381 if (strcmp(ifname, netdev->name) != 0) {
2382 err = lxc_netdev_rename_by_name(ifname, netdev->name);
2383 if (err) {
2384 ERROR("failed to rename %s->%s : %s", ifname, netdev->name,
2385 strerror(-err));
2386 return -1;
2387 }
018ef520
DL		 2388 }
2389
2390 /* Re-read the name of the interface because its name has changed
2391 * and would be automatically allocated by the system
2392 */
82d5ae15 2393 if (!if_indextoname(netdev->ifindex, current_ifname)) {
018ef520 2394 ERROR("no interface corresponding to index '%d'",
82d5ae15 2395 netdev->ifindex);
018ef520 2396 return -1;
0ad19a3f 2397 }
2398
82d5ae15
DL		 2399 /* set a mac address */
2400 if (netdev->hwaddr) {
2401 if (setup_hw_addr(netdev->hwaddr, current_ifname)) {
36eb9bde 2402 ERROR("failed to setup hw address for '%s'",
82d5ae15 2403 current_ifname);
0ad19a3f 2404 return -1;
2405 }
2406 }
2407
82d5ae15
DL		 2408 /* setup ipv4 addresses on the interface */
2409 if (setup_ipv4_addr(&netdev->ipv4, netdev->ifindex)) {
36eb9bde 2410 ERROR("failed to setup ip addresses for '%s'",
0ad19a3f 2411 ifname);
2412 return -1;
2413 }
2414
82d5ae15
DL		 2415 /* setup ipv6 addresses on the interface */
2416 if (setup_ipv6_addr(&netdev->ipv6, netdev->ifindex)) {
36eb9bde 2417 ERROR("failed to setup ipv6 addresses for '%s'",
0ad19a3f 2418 ifname);
2419 return -1;
2420 }
2421
82d5ae15 2422 /* set the network device up */
b0efbac4 2423 if (netdev->flags & IFF_UP) {
3cfc0f3a
MN		 2424 int err;
2425
d472214b 2426 err = lxc_netdev_up(current_ifname);
3cfc0f3a
MN		 2427 if (err) {
2428 ERROR("failed to set '%s' up : %s", current_ifname,
2429 strerror(-err));
0ad19a3f 2430 return -1;
2431 }
2432
2433 /* the network is up, make the loopback up too */
d472214b 2434 err = lxc_netdev_up("lo");
3cfc0f3a
MN		 2435 if (err) {
2436 ERROR("failed to set the loopback up : %s",
2437 strerror(-err));
0ad19a3f 2438 return -1;
2439 }
2440 }
2441
f8fee0e2
MK		 2442 /* We can only set up the default routes after bringing
2443 * up the interface, sine bringing up the interface adds
2444 * the link-local routes and we can't add a default
2445 * route if the gateway is not reachable. */
2446
2447 /* setup ipv4 gateway on the interface */
2448 if (netdev->ipv4_gateway) {
2449 if (!(netdev->flags & IFF_UP)) {
2450 ERROR("Cannot add ipv4 gateway for %s when not bringing up the interface", ifname);
2451 return -1;
2452 }
2453
2454 if (lxc_list_empty(&netdev->ipv4)) {
2455 ERROR("Cannot add ipv4 gateway for %s when not assigning an address", ifname);
2456 return -1;
2457 }
2458
2459 err = lxc_ipv4_gateway_add(netdev->ifindex, netdev->ipv4_gateway);
2460 if (err) {
fc739df5
SG		 2461 err = lxc_ipv4_dest_add(netdev->ifindex, netdev->ipv4_gateway);
2462 if (err) {
2463 ERROR("failed to add ipv4 dest for '%s': %s",
2464 ifname, strerror(-err));
2465 }
2466
2467 err = lxc_ipv4_gateway_add(netdev->ifindex, netdev->ipv4_gateway);
2468 if (err) {
2469 ERROR("failed to setup ipv4 gateway for '%s': %s",
2470 ifname, strerror(-err));
2471 if (netdev->ipv4_gateway_auto) {
2472 char buf[INET_ADDRSTRLEN];
2473 inet_ntop(AF_INET, netdev->ipv4_gateway, buf, sizeof(buf));
2474 ERROR("tried to set autodetected ipv4 gateway '%s'", buf);
2475 }
2476 return -1;
19a26f82 2477 }
f8fee0e2
MK		 2478 }
2479 }
2480
2481 /* setup ipv6 gateway on the interface */
2482 if (netdev->ipv6_gateway) {
2483 if (!(netdev->flags & IFF_UP)) {
2484 ERROR("Cannot add ipv6 gateway for %s when not bringing up the interface", ifname);
2485 return -1;
2486 }
2487
2488 if (lxc_list_empty(&netdev->ipv6) && !IN6_IS_ADDR_LINKLOCAL(netdev->ipv6_gateway)) {
2489 ERROR("Cannot add ipv6 gateway for %s when not assigning an address", ifname);
2490 return -1;
2491 }
2492
2493 err = lxc_ipv6_gateway_add(netdev->ifindex, netdev->ipv6_gateway);
2494 if (err) {
fc739df5
SG		 2495 err = lxc_ipv6_dest_add(netdev->ifindex, netdev->ipv6_gateway);
2496 if (err) {
2497 ERROR("failed to add ipv6 dest for '%s': %s",
f8fee0e2 2498 ifname, strerror(-err));
19a26f82 2499 }
fc739df5
SG		 2500
2501 err = lxc_ipv6_gateway_add(netdev->ifindex, netdev->ipv6_gateway);
2502 if (err) {
2503 ERROR("failed to setup ipv6 gateway for '%s': %s",
2504 ifname, strerror(-err));
2505 if (netdev->ipv6_gateway_auto) {
2506 char buf[INET6_ADDRSTRLEN];
2507 inet_ntop(AF_INET6, netdev->ipv6_gateway, buf, sizeof(buf));
2508 ERROR("tried to set autodetected ipv6 gateway '%s'", buf);
2509 }
2510 return -1;
2511 }
f8fee0e2
MK		 2512 }
2513 }
2514
cd54d859
DL		 2515 DEBUG("'%s' has been setup", current_ifname);
2516
0ad19a3f 2517 return 0;
2518}
2519
5f4535a3 2520static int setup_network(struct lxc_list *network)
0ad19a3f 2521{
82d5ae15 2522 struct lxc_list *iterator;
82d5ae15 2523 struct lxc_netdev *netdev;
0ad19a3f 2524
5f4535a3 2525 lxc_list_for_each(iterator, network) {
cd54d859 2526
5f4535a3 2527 netdev = iterator->elem;
82d5ae15
DL		 2528
2529 if (setup_netdev(netdev)) {
2530 ERROR("failed to setup netdev");
2531 return -1;
2532 }
2533 }
cd54d859 2534
5f4535a3
DL		 2535 if (!lxc_list_empty(network))
2536 INFO("network has been setup");
cd54d859
DL		 2537
2538 return 0;
0ad19a3f 2539}
2540
c6d09e15
WB		 2541static int parse_resource(const char *res) {
2542 size_t i;
2543 int resid = -1;
2544
2545 for (i = 0; i < sizeof(limit_opt)/sizeof(limit_opt[0]); ++i) {
2546 if (strcmp(res, limit_opt[i].name) == 0)
2547 return limit_opt[i].value;
2548 }
2549
2550 /* try to see if it's numeric, so the user may specify
2551 * resources that the running kernel knows about but
2552 * we don't */
2553 if (lxc_safe_int(res, &resid) == 0)
2554 return resid;
2555 return -1;
2556}
2557
2558int setup_resource_limits(struct lxc_list *limits, pid_t pid) {
2559 struct lxc_list *it;
2560 struct lxc_limit *lim;
2561 int resid;
2562
2563 lxc_list_for_each(it, limits) {
2564 lim = it->elem;
2565
2566 resid = parse_resource(lim->resource);
2567 if (resid < 0) {
2568 ERROR("unknown resource %s", lim->resource);
2569 return -1;
2570 }
2571
2572 if (prlimit(pid, resid, &lim->limit, NULL) != 0) {
2573 ERROR("failed to set limit %s: %s", lim->resource, strerror(errno));
2574 return -1;
2575 }
2576 }
2577 return 0;
2578}
2579
2af6bd1b 2580/* try to move physical nics to the init netns */
5610055a 2581void lxc_restore_phys_nics_to_netns(int netnsfd, struct lxc_conf *conf)
2af6bd1b 2582{
64d2fcb5 2583 int i, oldfd;
4ec31c52 2584 char ifname[IFNAMSIZ];
2af6bd1b 2585
5610055a 2586 if (netnsfd < 0 || conf->num_savednics == 0)
2af6bd1b
SH		 2587 return;
2588
64d2fcb5 2589 INFO("Running to reset %d nic names.", conf->num_savednics);
5610055a 2590
64d2fcb5
CB		 2591 oldfd = lxc_preserve_ns(getpid(), "net");
2592 if (oldfd < 0) {
2593 SYSERROR("Failed to open monitor netns fd.");
2af6bd1b
SH		 2594 return;
2595 }
64d2fcb5 2596
2af6bd1b
SH		 2597 if (setns(netnsfd, 0) != 0) {
2598 SYSERROR("Failed to enter container netns to reset nics");
2599 close(oldfd);
2600 return;
2601 }
2602 for (i=0; i<conf->num_savednics; i++) {
2603 struct saved_nic *s = &conf->saved_nics[i];
f2e206ff 2604 /* retrieve the name of the interface */
2605 if (!if_indextoname(s->ifindex, ifname)) {
2606 WARN("no interface corresponding to index '%d'", s->ifindex);
2607 continue;
2608 }
5610055a 2609 if (lxc_netdev_move_by_name(ifname, 1, s->orig_name))
f2e206ff 2610 WARN("Error moving nic name:%s back to host netns", ifname);
5610055a 2611 free(s->orig_name);
2af6bd1b 2612 }
5610055a
WB		 2613 conf->num_savednics = 0;
2614
2af6bd1b
SH		 2615 if (setns(oldfd, 0) != 0)
2616 SYSERROR("Failed to re-enter monitor's netns");
2617 close(oldfd);
2618}
2619
ae9242c8
SH		 2620static char *default_rootfs_mount = LXCROOTFSMOUNT;
2621
7b379ab3 2622struct lxc_conf *lxc_conf_init(void)
089cd8b8 2623{
7b379ab3 2624 struct lxc_conf *new;
26ddeedd 2625 int i;
7b379ab3
MN		 2626
2627 new = malloc(sizeof(*new));
2628 if (!new) {
2629 ERROR("lxc_conf_init : %m");
2630 return NULL;
2631 }
2632 memset(new, 0, sizeof(*new));
2633
b40a606e 2634 new->loglevel = LXC_LOG_PRIORITY_NOTSET;
cccc74b5 2635 new->personality = -1;
124fa0a8 2636 new->autodev = 1;
596a818d
DE		 2637 new->console.log_path = NULL;
2638 new->console.log_fd = -1;
28a4b0e5 2639 new->console.path = NULL;
63376d7d 2640 new->console.peer = -1;
b5159817
DE		 2641 new->console.peerpty.busy = -1;
2642 new->console.peerpty.master = -1;
2643 new->console.peerpty.slave = -1;
63376d7d
DL		 2644 new->console.master = -1;
2645 new->console.slave = -1;
2646 new->console.name[0] = '\0';
d2e30e99 2647 new->maincmd_fd = -1;
76a26f55 2648 new->nbd_idx = -1;
54c30e29 2649 new->rootfs.mount = strdup(default_rootfs_mount);
53f3f048
SH		 2650 if (!new->rootfs.mount) {
2651 ERROR("lxc_conf_init : %m");
2652 free(new);
2653 return NULL;
2654 }
d89de239 2655 new->kmsg = 0;
858377e4 2656 new->logfd = -1;
7b379ab3
MN		 2657 lxc_list_init(&new->cgroup);
2658 lxc_list_init(&new->network);
2659 lxc_list_init(&new->mount_list);
81810dd1 2660 lxc_list_init(&new->caps);
1fb86a7c 2661 lxc_list_init(&new->keepcaps);
f6d3e3e4 2662 lxc_list_init(&new->id_map);
f979ac15 2663 lxc_list_init(&new->includes);
4184c3e1 2664 lxc_list_init(&new->aliens);
7c661726 2665 lxc_list_init(&new->environment);
c6d09e15 2666 lxc_list_init(&new->limits);
26ddeedd
SH		 2667 for (i=0; i<NUM_LXC_HOOKS; i++)
2668 lxc_list_init(&new->hooks[i]);
ee1e7aa0 2669 lxc_list_init(&new->groups);
fe4de9a6
DE		 2670 new->lsm_aa_profile = NULL;
2671 new->lsm_se_context = NULL;
5112cd70 2672 new->tmp_umount_proc = 0;
7b379ab3 2673
9f30a190
MM		 2674 for (i = 0; i < LXC_NS_MAX; i++)
2675 new->inherit_ns_fd[i] = -1;
2676
72bb04e4
PT		 2677 /* if running in a new user namespace, init and COMMAND
2678 * default to running as UID/GID 0 when using lxc-execute */
2679 new->init_uid = 0;
2680 new->init_gid = 0;
2681
7b379ab3 2682 return new;
089cd8b8
DL		 2683}
2684
a589434e 2685static int instantiate_veth(struct lxc_handler *handler, struct lxc_netdev *netdev)
0ad19a3f 2686{
8634bc19 2687 char veth1buf[IFNAMSIZ], *veth1;
0e391e57 2688 char veth2buf[IFNAMSIZ], *veth2;
b7b2fde4
CB		 2689 int bridge_index, err;
2690 unsigned int mtu = 0;
13954cce 2691
8bee8851 2692 if (netdev->priv.veth_attr.pair) {
e892973e 2693 veth1 = netdev->priv.veth_attr.pair;
8bee8851
WB		 2694 if (handler->conf->reboot)
2695 lxc_netdev_delete_by_name(veth1);
2696 } else {
9ba8130c
SH		 2697 err = snprintf(veth1buf, sizeof(veth1buf), "vethXXXXXX");
2698 if (err >= sizeof(veth1buf)) { /* can't *really* happen, but... */
2699 ERROR("veth1 name too long");
2700 return -1;
2701 }
a0265685 2702 veth1 = lxc_mkifname(veth1buf);
ad40563e
ÇO		 2703 if (!veth1) {
2704 ERROR("failed to allocate a temporary name");
2705 return -1;
2706 }
74a2b586
JK		 2707 /* store away for deconf */
2708 memcpy(netdev->priv.veth_attr.veth1, veth1, IFNAMSIZ);
8634bc19 2709 }
82d5ae15 2710
0e391e57 2711 snprintf(veth2buf, sizeof(veth2buf), "vethXXXXXX");
a0265685 2712 veth2 = lxc_mkifname(veth2buf);
ad40563e 2713 if (!veth2) {
82d5ae15 2714 ERROR("failed to allocate a temporary name");
ad40563e 2715 goto out_delete;
0ad19a3f 2716 }
2717
3cfc0f3a
MN		 2718 err = lxc_veth_create(veth1, veth2);
2719 if (err) {
2e2d6a7b 2720 ERROR("failed to create veth pair (%s and %s): %s", veth1, veth2,
3cfc0f3a 2721 strerror(-err));
ad40563e 2722 goto out_delete;
0ad19a3f 2723 }
13954cce 2724
49684c0b
CS		 2725 /* changing the high byte of the mac address to 0xfe, the bridge interface
2726 * will always keep the host's mac address and not take the mac address
2727 * of a container */
2728 err = setup_private_host_hw_addr(veth1);
2729 if (err) {
2e2d6a7b 2730 ERROR("failed to change mac address of host interface '%s': %s",
49684c0b
CS		 2731 veth1, strerror(-err));
2732 goto out_delete;
2733 }
2734
af651aa9
SN		 2735 netdev->ifindex = if_nametoindex(veth2);
2736 if (!netdev->ifindex) {
2737 ERROR("failed to retrieve the index for %s", veth2);
2738 goto out_delete;
2739 }
2740
82d5ae15 2741 if (netdev->mtu) {
b7b2fde4
CB		 2742 if (lxc_safe_uint(netdev->mtu, &mtu) < 0)
2743 WARN("Failed to parse mtu from.");
2744 else
2745 INFO("Retrieved mtu %d", mtu);
e54864d3 2746 } else if (netdev->link) {
e9280f65 2747 bridge_index = if_nametoindex(netdev->link);
729e8bf6
CB		 2748 if (bridge_index) {
2749 mtu = netdev_get_mtu(bridge_index);
2750 INFO("Retrieved mtu %d from %s", mtu, netdev->link);
2751 } else {
2752 mtu = netdev_get_mtu(netdev->ifindex);
2753 INFO("Retrieved mtu %d from %s", mtu, veth2);
2754 }
e54864d3
NC		 2755 }
2756
2757 if (mtu) {
2758 err = lxc_netdev_set_mtu(veth1, mtu);
3cfc0f3a 2759 if (!err)
e54864d3 2760 err = lxc_netdev_set_mtu(veth2, mtu);
3cfc0f3a 2761 if (err) {
e54864d3
NC		 2762 ERROR("failed to set mtu '%i' for veth pair (%s and %s): %s",
2763 mtu, veth1, veth2, strerror(-err));
eb14c10a 2764 goto out_delete;
75d09f83
DL		 2765 }
2766 }
2767
3cfc0f3a 2768 if (netdev->link) {
c43cbc04 2769 err = lxc_bridge_attach(handler->lxcpath, handler->name, netdev->link, veth1);
3cfc0f3a 2770 if (err) {
2e2d6a7b 2771 ERROR("failed to attach '%s' to the bridge '%s': %s",
3cfc0f3a
MN		 2772 veth1, netdev->link, strerror(-err));
2773 goto out_delete;
2774 }
738d0deb 2775 INFO("Attached '%s': to the bridge '%s': ", veth1, netdev->link);
eb14c10a
DL		 2776 }
2777
d472214b 2778 err = lxc_netdev_up(veth1);
6e35af2e
DL		 2779 if (err) {
2780 ERROR("failed to set %s up : %s", veth1, strerror(-err));
2781 goto out_delete;
0ad19a3f 2782 }
2783
e3b4c4c4 2784 if (netdev->upscript) {
751d9dcd
DL		 2785 err = run_script(handler->name, "net", netdev->upscript, "up",
2786 "veth", veth1, (char*) NULL);
2787 if (err)
e3b4c4c4 2788 goto out_delete;
e3b4c4c4
ST		 2789 }
2790
a589434e 2791 DEBUG("instantiated veth '%s/%s', index is '%d'",
82d5ae15
DL		 2792 veth1, veth2, netdev->ifindex);
2793
6ab9ab6d 2794 return 0;
eb14c10a
DL		 2795
2796out_delete:
b84f58b9 2797 lxc_netdev_delete_by_name(veth1);
f10fad2f 2798 if (!netdev->priv.veth_attr.pair)
ad40563e 2799 free(veth1);
f10fad2f 2800 free(veth2);
6ab9ab6d 2801 return -1;
13954cce 2802}
d957ae2d 2803
74a2b586
JK		 2804static int shutdown_veth(struct lxc_handler *handler, struct lxc_netdev *netdev)
2805{
2806 char *veth1;
2807 int err;
2808
2809 if (netdev->priv.veth_attr.pair)
2810 veth1 = netdev->priv.veth_attr.pair;
2811 else
2812 veth1 = netdev->priv.veth_attr.veth1;
2813
2814 if (netdev->downscript) {
2815 err = run_script(handler->name, "net", netdev->downscript,
2816 "down", "veth", veth1, (char*) NULL);
2817 if (err)
2818 return -1;
2819 }
2820 return 0;
2821}
2822
a589434e 2823static int instantiate_macvlan(struct lxc_handler *handler, struct lxc_netdev *netdev)
0ad19a3f 2824{
0e391e57 2825 char peerbuf[IFNAMSIZ], *peer;
3cfc0f3a 2826 int err;
d957ae2d
MT		 2827
2828 if (!netdev->link) {
2829 ERROR("no link specified for macvlan netdev");
2830 return -1;
2831 }
13954cce 2832
9ba8130c
SH		 2833 err = snprintf(peerbuf, sizeof(peerbuf), "mcXXXXXX");
2834 if (err >= sizeof(peerbuf))
2835 return -1;
82d5ae15 2836
a0265685 2837 peer = lxc_mkifname(peerbuf);
ad40563e 2838 if (!peer) {
82d5ae15
DL		 2839 ERROR("failed to make a temporary name");
2840 return -1;
0ad19a3f 2841 }
2842
3cfc0f3a
MN		 2843 err = lxc_macvlan_create(netdev->link, peer,
2844 netdev->priv.macvlan_attr.mode);
2845 if (err) {
2846 ERROR("failed to create macvlan interface '%s' on '%s' : %s",
2847 peer, netdev->link, strerror(-err));
ad40563e 2848 goto out;
0ad19a3f 2849 }
2850
82d5ae15
DL		 2851 netdev->ifindex = if_nametoindex(peer);
2852 if (!netdev->ifindex) {
36eb9bde 2853 ERROR("failed to retrieve the index for %s", peer);
ad40563e 2854 goto out;
22ebac19 2855 }
2856
e3b4c4c4 2857 if (netdev->upscript) {
751d9dcd
DL		 2858 err = run_script(handler->name, "net", netdev->upscript, "up",
2859 "macvlan", netdev->link, (char*) NULL);
2860 if (err)
ad40563e 2861 goto out;
e3b4c4c4
ST		 2862 }
2863
a589434e 2864 DEBUG("instantiated macvlan '%s', index is '%d' and mode '%d'",
e892973e 2865 peer, netdev->ifindex, netdev->priv.macvlan_attr.mode);
0ad19a3f 2866
d957ae2d 2867 return 0;
ad40563e
ÇO		 2868out:
2869 lxc_netdev_delete_by_name(peer);
2870 free(peer);
2871 return -1;
0ad19a3f 2872}
2873
74a2b586
JK		 2874static int shutdown_macvlan(struct lxc_handler *handler, struct lxc_netdev *netdev)
2875{
2876 int err;
2877
2878 if (netdev->downscript) {
2879 err = run_script(handler->name, "net", netdev->downscript,
2880 "down", "macvlan", netdev->link,
2881 (char*) NULL);
2882 if (err)
2883 return -1;
2884 }
2885 return 0;
2886}
2887
a589434e
JN		 2888/* XXX: merge with instantiate_macvlan */
2889static int instantiate_vlan(struct lxc_handler *handler, struct lxc_netdev *netdev)
26c39028
JHS		 2890{
2891 char peer[IFNAMSIZ];
3cfc0f3a 2892 int err;
82f58d03 2893 static uint16_t vlan_cntr = 0;
b7b2fde4 2894 unsigned int mtu = 0;
26c39028
JHS		 2895
2896 if (!netdev->link) {
2897 ERROR("no link specified for vlan netdev");
2898 return -1;
2899 }
2900
82f58d03 2901 err = snprintf(peer, sizeof(peer), "vlan%d-%d", netdev->priv.vlan_attr.vid, vlan_cntr++);
9ba8130c
SH		 2902 if (err >= sizeof(peer)) {
2903 ERROR("peer name too long");
2904 return -1;
2905 }
26c39028 2906
3cfc0f3a
MN		 2907 err = lxc_vlan_create(netdev->link, peer, netdev->priv.vlan_attr.vid);
2908 if (err) {
2909 ERROR("failed to create vlan interface '%s' on '%s' : %s",
2910 peer, netdev->link, strerror(-err));
26c39028
JHS		 2911 return -1;
2912 }
2913
2914 netdev->ifindex = if_nametoindex(peer);
2915 if (!netdev->ifindex) {
2916 ERROR("failed to retrieve the ifindex for %s", peer);
b84f58b9 2917 lxc_netdev_delete_by_name(peer);
26c39028
JHS		 2918 return -1;
2919 }
2920
a589434e 2921 DEBUG("instantiated vlan '%s', ifindex is '%d'", " vlan1000",
e892973e 2922 netdev->ifindex);
b4fb7de1 2923 if (netdev->mtu) {
b7b2fde4
CB		 2924 if (lxc_safe_uint(netdev->mtu, &mtu) < 0) {
2925 ERROR("Failed to retrieve mtu from: '%d'/'%s'.",
2926 netdev->ifindex, netdev->name);
2927 return -1;
2928 }
2929 err = lxc_netdev_set_mtu(peer, mtu);
b4fb7de1
VL		 2930 if (err) {
2931 ERROR("failed to set mtu '%s' for %s : %s",
2932 netdev->mtu, peer, strerror(-err));
2933 lxc_netdev_delete_by_name(peer);
2934 return -1;
2935 }
2936 }
e892973e 2937
26c39028
JHS		 2938 return 0;
2939}
2940
74a2b586
JK		 2941static int shutdown_vlan(struct lxc_handler *handler, struct lxc_netdev *netdev)
2942{
2943 return 0;
2944}
2945
a589434e 2946static int instantiate_phys(struct lxc_handler *handler, struct lxc_netdev *netdev)
0ad19a3f 2947{
6168e99f
DL		 2948 if (!netdev->link) {
2949 ERROR("no link specified for the physical interface");
2950 return -1;
2951 }
2952
9d083402 2953 netdev->ifindex = if_nametoindex(netdev->link);
82d5ae15 2954 if (!netdev->ifindex) {
9d083402 2955 ERROR("failed to retrieve the index for %s", netdev->link);
0ad19a3f 2956 return -1;
2957 }
2958
e3b4c4c4
ST		 2959 if (netdev->upscript) {
2960 int err;
751d9dcd
DL		 2961 err = run_script(handler->name, "net", netdev->upscript,
2962 "up", "phys", netdev->link, (char*) NULL);
2963 if (err)
e3b4c4c4 2964 return -1;
e3b4c4c4
ST		 2965 }
2966
82d5ae15 2967 return 0;
0ad19a3f 2968}
2969
74a2b586
JK		 2970static int shutdown_phys(struct lxc_handler *handler, struct lxc_netdev *netdev)
2971{
2972 int err;
2973
2974 if (netdev->downscript) {
2975 err = run_script(handler->name, "net", netdev->downscript,
2976 "down", "phys", netdev->link, (char*) NULL);
2977 if (err)
2978 return -1;
2979 }
2980 return 0;
2981}
2982
a589434e 2983static int instantiate_none(struct lxc_handler *handler, struct lxc_netdev *netdev)
26b797f3
SH		 2984{
2985 netdev->ifindex = 0;
2986 return 0;
2987}
2988
a589434e 2989static int instantiate_empty(struct lxc_handler *handler, struct lxc_netdev *netdev)
0ad19a3f 2990{
82d5ae15 2991 netdev->ifindex = 0;
e3b4c4c4
ST		 2992 if (netdev->upscript) {
2993 int err;
751d9dcd
DL		 2994 err = run_script(handler->name, "net", netdev->upscript,
2995 "up", "empty", (char*) NULL);
2996 if (err)
e3b4c4c4 2997 return -1;
e3b4c4c4 2998 }
82d5ae15 2999 return 0;
0ad19a3f 3000}
3001
74a2b586
JK		 3002static int shutdown_empty(struct lxc_handler *handler, struct lxc_netdev *netdev)
3003{
3004 int err;
3005
3006 if (netdev->downscript) {
3007 err = run_script(handler->name, "net", netdev->downscript,
3008 "down", "empty", (char*) NULL);
3009 if (err)
3010 return -1;
3011 }
3012 return 0;
3013}
3014
26b797f3
SH		 3015static int shutdown_none(struct lxc_handler *handler, struct lxc_netdev *netdev)
3016{
3017 return 0;
3018}
3019
3020int lxc_requests_empty_network(struct lxc_handler *handler)
3021{
3022 struct lxc_list *network = &handler->conf->network;
3023 struct lxc_list *iterator;
3024 struct lxc_netdev *netdev;
3025 bool found_none = false, found_nic = false;
3026
3027 if (lxc_list_empty(network))
3028 return 0;
3029
3030 lxc_list_for_each(iterator, network) {
3031
3032 netdev = iterator->elem;
3033
3034 if (netdev->type == LXC_NET_NONE)
3035 found_none = true;
3036 else
3037 found_nic = true;
3038 }
3039 if (found_none && !found_nic)
3040 return 1;
3041 return 0;
3042}
3043
e3b4c4c4 3044int lxc_create_network(struct lxc_handler *handler)
0ad19a3f 3045{
e3b4c4c4 3046 struct lxc_list *network = &handler->conf->network;
82d5ae15 3047 struct lxc_list *iterator;
82d5ae15 3048 struct lxc_netdev *netdev;
cbef6c52
SH		 3049 int am_root = (getuid() == 0);
3050
3051 if (!am_root)
3052 return 0;
0ad19a3f 3053
5f4535a3 3054 lxc_list_for_each(iterator, network) {
0ad19a3f 3055
5f4535a3 3056 netdev = iterator->elem;
13954cce 3057
24654103 3058 if (netdev->type < 0 || netdev->type > LXC_NET_MAXCONFTYPE) {
82d5ae15 3059 ERROR("invalid network configuration type '%d'",
5f4535a3 3060 netdev->type);
82d5ae15
DL		 3061 return -1;
3062 }
0ad19a3f 3063
e3b4c4c4 3064 if (netdev_conf[netdev->type](handler, netdev)) {
82d5ae15
DL		 3065 ERROR("failed to create netdev");
3066 return -1;
3067 }
e3b4c4c4 3068
0ad19a3f 3069 }
3070
3071 return 0;
3072}
3073
358daf49 3074bool lxc_delete_network(struct lxc_handler *handler)
7fef7a06 3075{
e97946ae 3076 int ret;
74a2b586 3077 struct lxc_list *network = &handler->conf->network;
7fef7a06
DL		 3078 struct lxc_list *iterator;
3079 struct lxc_netdev *netdev;
358daf49 3080 bool deleted_all = true;
7fef7a06
DL		 3081
3082 lxc_list_for_each(iterator, network) {
3083 netdev = iterator->elem;
d472214b 3084
74a2b586 3085 if (netdev->ifindex != 0 && netdev->type == LXC_NET_PHYS) {
d8f8e352 3086 if (lxc_netdev_rename_by_index(netdev->ifindex, netdev->link))
358daf49
CB		 3087 WARN("Failed to rename interface with index %d "
3088 "to its initial name \"%s\".",
3089 netdev->ifindex, netdev->link);
d472214b 3090 continue;
d8f8e352 3091 }
d472214b 3092
74a2b586 3093 if (netdev_deconf[netdev->type](handler, netdev)) {
e97946ae 3094 WARN("Failed to destroy netdev");
74a2b586
JK		 3095 }
3096
d8f8e352
DL		 3097 /* Recent kernel remove the virtual interfaces when the network
3098 * namespace is destroyed but in case we did not moved the
3099 * interface to the network namespace, we have to destroy it
3100 */
e97946ae
CB		 3101 if (netdev->ifindex != 0) {
3102 ret = lxc_netdev_delete_by_index(netdev->ifindex);
358daf49
CB		 3103 if (-ret == ENODEV) {
3104 INFO("Interface \"%s\" with index %d already "
3105 "deleted or existing in different network "
3106 "namespace.",
3107 netdev->name ? netdev->name : "(null)",
3108 netdev->ifindex);
3109 } else if (ret < 0) {
3110 deleted_all = false;
3111 WARN("Failed to remove interface \"%s\" with "
3112 "index %d: %s.",
3113 netdev->name ? netdev->name : "(null)",
3114 netdev->ifindex, strerror(-ret));
3115 } else {
3116 INFO("Removed interface \"%s\" with index %d.",
3117 netdev->name ? netdev->name : "(null)",
3118 netdev->ifindex);
3119 }
e97946ae
CB		 3120 }
3121
3122 /* Explicitly delete host veth device to prevent lingering
3123 * devices. We had issues in LXD around this.
3124 */
9aaaad30 3125 if (netdev->type == LXC_NET_VETH && !am_unpriv()) {
358daf49
CB		 3126 char *hostveth;
3127 if (netdev->priv.veth_attr.pair) {
e97946ae 3128 hostveth = netdev->priv.veth_attr.pair;
358daf49
CB		 3129 ret = lxc_netdev_delete_by_name(hostveth);
3130 if (ret < 0) {
3131 WARN("Failed to remove interface \"%s\" from host: %s.", hostveth, strerror(-ret));
3132 } else {
3133 INFO("Removed interface \"%s\" from host.", hostveth);
358daf49
CB		 3134 }
3135 } else if (strlen(netdev->priv.veth_attr.veth1) > 0) {
e97946ae 3136 hostveth = netdev->priv.veth_attr.veth1;
e97946ae 3137 ret = lxc_netdev_delete_by_name(hostveth);
358daf49
CB		 3138 if (ret < 0) {
3139 WARN("Failed to remove \"%s\" from host: %s.", hostveth, strerror(-ret));
3140 } else {
3141 INFO("Removed interface \"%s\" from host.", hostveth);
3142 memset((void *)&netdev->priv.veth_attr.veth1, 0, sizeof(netdev->priv.veth_attr.veth1));
3143 }
e97946ae
CB		 3144 }
3145 }
7fef7a06 3146 }
358daf49
CB		 3147
3148 return deleted_all;
7fef7a06
DL		 3149}
3150
45e854dc
SG		 3151#define LXC_USERNIC_PATH LIBEXECDIR "/lxc/lxc-user-nic"
3152
fe1f672f 3153/* lxc-user-nic returns "interface_name:interface_name\n" */
eab15c1e 3154#define MAX_BUFFER_SIZE IFNAMSIZ * 2 + 2
c43cbc04
SH		 3155static int unpriv_assign_nic(const char *lxcpath, char *lxcname,
3156 struct lxc_netdev *netdev, pid_t pid)
cbef6c52
SH		 3157{
3158 pid_t child;
a7242d9a
ÇO		 3159 int bytes, pipefd[2];
3160 char *token, *saveptr = NULL;
fe1f672f 3161 char buffer[MAX_BUFFER_SIZE];
091045f8 3162 char netdev_link[IFNAMSIZ + 1];
cbef6c52
SH		 3163
3164 if (netdev->type != LXC_NET_VETH) {
3165 ERROR("nic type %d not support for unprivileged use",
091045f8 3166 netdev->type);
cbef6c52
SH		 3167 return -1;
3168 }
3169
091045f8 3170 if (pipe(pipefd) < 0) {
a7242d9a
ÇO		 3171 SYSERROR("pipe failed");
3172 return -1;
3173 }
3174
091045f8
CB		 3175 child = fork();
3176 if (child < 0) {
cbef6c52 3177 SYSERROR("fork");
a7242d9a
ÇO		 3178 close(pipefd[0]);
3179 close(pipefd[1]);
3180 return -1;
3181 }
3182
3183 if (child == 0) { // child
091045f8
CB		 3184 /* Call lxc-user-nic pid type bridge. */
3185 int ret;
3186 char pidstr[LXC_NUMSTRLEN64];
3187
3188 close(pipefd[0]); /* Close the read-end of the pipe. */
3189
3190 /* Redirect stdout to write-end of the pipe. */
3191 ret = dup2(pipefd[1], STDOUT_FILENO);
3192 close(pipefd[1]); /* Close the write-end of the pipe. */
3193 if (ret < 0) {
3194 SYSERROR("Failed to dup2() to redirect stdout to pipe file descriptor.");
3195 exit(EXIT_FAILURE);
3196 }
a7242d9a 3197
091045f8 3198 if (netdev->link)
cff7b5eb 3199 strncpy(netdev_link, netdev->link, IFNAMSIZ);
091045f8 3200 else
cff7b5eb 3201 strncpy(netdev_link, "none", IFNAMSIZ);
091045f8
CB		 3202
3203 ret = snprintf(pidstr, LXC_NUMSTRLEN64, "%d", pid);
3204 if (ret < 0 || ret >= LXC_NUMSTRLEN64)
3205 exit(EXIT_FAILURE);
3206 pidstr[LXC_NUMSTRLEN64 - 1] = '\0';
3207
3208 INFO("Execing lxc-user-nic %s %s %s veth %s %s", lxcpath,
3209 lxcname, pidstr, netdev_link, netdev->name);
c43cbc04 3210 execlp(LXC_USERNIC_PATH, LXC_USERNIC_PATH, lxcpath, lxcname,
091045f8
CB		 3211 pidstr, "veth", netdev_link, netdev->name, NULL);
3212
3213 SYSERROR("Failed to exec lxc-user-nic.");
3214 exit(EXIT_FAILURE);
a7242d9a
ÇO		 3215 }
3216
3217 /* close the write-end of the pipe */
3218 close(pipefd[1]);
3219
fe1f672f 3220 bytes = read(pipefd[0], &buffer, MAX_BUFFER_SIZE);
091045f8
CB		 3221 if (bytes < 0)
3222 SYSERROR("Failed to read from pipe file descriptor.");
a7242d9a
ÇO		 3223 buffer[bytes - 1] = '\0';
3224
3225 if (wait_for_pid(child) != 0) {
3226 close(pipefd[0]);
cbef6c52
SH		 3227 return -1;
3228 }
3229
a7242d9a
ÇO		 3230 /* close the read-end of the pipe */
3231 close(pipefd[0]);
cbef6c52 3232
a7242d9a
ÇO		 3233 /* fill netdev->name field */
3234 token = strtok_r(buffer, ":", &saveptr);
3235 if (!token)
3236 return -1;
091045f8
CB		 3237
3238 netdev->name = malloc(IFNAMSIZ + 1);
658979c5 3239 if (!netdev->name) {
091045f8 3240 SYSERROR("Failed to allocate memory.");
658979c5
SH		 3241 return -1;
3242 }
091045f8 3243 memset(netdev->name, 0, IFNAMSIZ + 1);
658979c5 3244 strncpy(netdev->name, token, IFNAMSIZ);
a7242d9a
ÇO		 3245
3246 /* fill netdev->veth_attr.pair field */
3247 token = strtok_r(NULL, ":", &saveptr);
3248 if (!token)
3249 return -1;
091045f8 3250
a7242d9a 3251 netdev->priv.veth_attr.pair = strdup(token);
658979c5 3252 if (!netdev->priv.veth_attr.pair) {
091045f8 3253 ERROR("Failed to allocate memory.");
658979c5
SH		 3254 return -1;
3255 }
45e854dc 3256
a7242d9a 3257 return 0;
cbef6c52
SH		 3258}
3259
c43cbc04
SH		 3260int lxc_assign_network(const char *lxcpath, char *lxcname,
3261 struct lxc_list *network, pid_t pid)
0ad19a3f 3262{
82d5ae15 3263 struct lxc_list *iterator;
82d5ae15 3264 struct lxc_netdev *netdev;
f2e206ff 3265 char ifname[IFNAMSIZ];
cbef6c52 3266 int am_root = (getuid() == 0);
3cfc0f3a 3267 int err;
0ad19a3f 3268
5f4535a3 3269 lxc_list_for_each(iterator, network) {
82d5ae15 3270
5f4535a3 3271 netdev = iterator->elem;
82d5ae15 3272
fbb16259 3273 if (netdev->type == LXC_NET_VETH && !am_root) {
c43cbc04 3274 if (unpriv_assign_nic(lxcpath, lxcname, netdev, pid))
cbef6c52 3275 return -1;
658979c5
SH		 3276 // lxc-user-nic has moved the nic to the new ns.
3277 // unpriv_assign_nic() fills in netdev->name.
3278 // netdev->ifindex will be filed in at setup_netdev.
cbef6c52
SH		 3279 continue;
3280 }
236087a6 3281
fbb16259
SH		 3282 /* empty network namespace, nothing to move */
3283 if (!netdev->ifindex)
3284 continue;
3285
f2e206ff 3286 /* retrieve the name of the interface */
3287 if (!if_indextoname(netdev->ifindex, ifname)) {
3288 ERROR("no interface corresponding to index '%d'", netdev->ifindex);
3289 return -1;
3290 }
3291
3292 err = lxc_netdev_move_by_name(ifname, pid, NULL);
3cfc0f3a
MN		 3293 if (err) {
3294 ERROR("failed to move '%s' to the container : %s",
3295 netdev->link, strerror(-err));
82d5ae15
DL		 3296 return -1;
3297 }
3298
198cbbaa 3299 DEBUG("move '%s'/'%s' to '%d': .", ifname, netdev->name, pid);
0ad19a3f 3300 }
3301
3302 return 0;
3303}
3304
251d0d2a
DE		 3305static int write_id_mapping(enum idtype idtype, pid_t pid, const char *buf,
3306 size_t buf_size)
f6d3e3e4
SH		 3307{
3308 char path[PATH_MAX];
e4ccd113 3309 int ret, closeret;
f6d3e3e4
SH		 3310 FILE *f;
3311
3312 ret = snprintf(path, PATH_MAX, "/proc/%d/%cid_map", pid, idtype == ID_TYPE_UID ? 'u' : 'g');
3313 if (ret < 0 || ret >= PATH_MAX) {
03fadd16 3314 fprintf(stderr, "%s: path name too long\n", __func__);
f6d3e3e4
SH		 3315 return -E2BIG;
3316 }
3317 f = fopen(path, "w");
3318 if (!f) {
3319 perror("open");
3320 return -EINVAL;
3321 }
251d0d2a 3322 ret = fwrite(buf, buf_size, 1, f);
f6d3e3e4 3323 if (ret < 0)
e4ccd113
SH		 3324 SYSERROR("writing id mapping");
3325 closeret = fclose(f);
3326 if (closeret)
3327 SYSERROR("writing id mapping");
3328 return ret < 0 ? ret : closeret;
f6d3e3e4
SH		 3329}
3330
df6a2945
CB		 3331/* Check whether a binary exist and has either CAP_SETUID, CAP_SETGID or both. */
3332static int idmaptool_on_path_and_privileged(const char *binary, cap_value_t cap)
3333{
3334 char *path;
3335 int ret;
3336 struct stat st;
3337 int fret = 0;
3338
3339 path = on_path(binary, NULL);
3340 if (!path)
3341 return -ENOENT;
3342
3343 ret = stat(path, &st);
3344 if (ret < 0) {
3345 fret = -errno;
3346 goto cleanup;
3347 }
3348
3349 /* Check if the binary is setuid. */
3350 if (st.st_mode & S_ISUID) {
3351 DEBUG("The binary \"%s\" does have the setuid bit set.", path);
3352 fret = 1;
3353 goto cleanup;
3354 }
3355
d6018f88 3356 #if HAVE_LIBCAP && !IS_BIONIC
df6a2945
CB		 3357 /* Check if it has the CAP_SETUID capability. */
3358 if ((cap & CAP_SETUID) &&
3359 lxc_file_cap_is_set(path, CAP_SETUID, CAP_EFFECTIVE) &&
3360 lxc_file_cap_is_set(path, CAP_SETUID, CAP_PERMITTED)) {
3361 DEBUG("The binary \"%s\" has CAP_SETUID in its CAP_EFFECTIVE "
3362 "and CAP_PERMITTED sets.", path);
3363 fret = 1;
3364 goto cleanup;
3365 }
3366
3367 /* Check if it has the CAP_SETGID capability. */
3368 if ((cap & CAP_SETGID) &&
3369 lxc_file_cap_is_set(path, CAP_SETGID, CAP_EFFECTIVE) &&
3370 lxc_file_cap_is_set(path, CAP_SETGID, CAP_PERMITTED)) {
3371 DEBUG("The binary \"%s\" has CAP_SETGID in its CAP_EFFECTIVE "
3372 "and CAP_PERMITTED sets.", path);
3373 fret = 1;
3374 goto cleanup;
3375 }
d6018f88
CB		 3376 #else
3377 DEBUG("Cannot check for file capabilites as full capability support is "
3378 "missing. Manual intervention needed.");
3379 fret = 1;
df6a2945
CB		 3380 #endif
3381
3382cleanup:
3383 free(path);
3384 return fret;
3385}
3386
f6d3e3e4
SH		 3387int lxc_map_ids(struct lxc_list *idmap, pid_t pid)
3388{
f6d3e3e4 3389 struct id_map *map;
4bc3b759 3390 struct lxc_list *iterator;
251d0d2a 3391 enum idtype type;
4bc3b759 3392 char *pos;
df6a2945
CB		 3393 int euid;
3394 int ret = 0, use_shadow = 0;
3395 int uidmap = 0, gidmap = 0;
3396 char *buf = NULL;
8afb3e61 3397
df6a2945
CB		 3398 euid = geteuid();
3399
3400 /* If new{g,u}idmap exists, that is, if shadow is handing out subuid
3401 * ranges, then insist that root also reserve ranges in subuid. This
22038de5
SH		 3402 * will protected it by preventing another user from being handed the
3403 * range by shadow.
3404 */
df6a2945
CB		 3405 uidmap = idmaptool_on_path_and_privileged("newuidmap", CAP_SETUID);
3406 gidmap = idmaptool_on_path_and_privileged("newgidmap", CAP_SETGID);
3407 if (uidmap > 0 && gidmap > 0) {
3408 DEBUG("Functional newuidmap and newgidmap binary found.");
4bc3b759 3409 use_shadow = true;
df6a2945
CB		 3410 } else if (uidmap == -ENOENT && gidmap == -ENOENT && !euid) {
3411 DEBUG("No newuidmap and newgidmap binary found. Trying to "
3412 "write directly with euid 0.");
3413 use_shadow = false;
3414 } else {
3415 DEBUG("Either one or both of the newuidmap and newgidmap "
3416 "binaries do not exist or are missing necessary "
3417 "privilege.");
0e6e3a41
SG		 3418 return -1;
3419 }
251d0d2a 3420
4bc3b759 3421 for (type = ID_TYPE_UID; type <= ID_TYPE_GID; type++) {
4f7521b4 3422 int left, fill;
4bc3b759 3423 bool had_entry = false;
cf3ef16d 3424 if (!buf) {
4bc3b759 3425 buf = pos = malloc(LXC_IDMAPLEN);
4f7521b4
SH		 3426 if (!buf)
3427 return -ENOMEM;
cf3ef16d
SH		 3428 }
3429 pos = buf;
0e6e3a41 3430 if (use_shadow)
4bc3b759 3431 pos += sprintf(buf, "new%cidmap %d", type == ID_TYPE_UID ? 'u' : 'g', pid);
4f7521b4 3432
cf3ef16d 3433 lxc_list_for_each(iterator, idmap) {
4bc3b759
CB		 3434 /* The kernel only takes <= 4k for writes to
3435 * /proc/<nr>/[ug]id_map
3436 */
251d0d2a 3437 map = iterator->elem;
cf3ef16d
SH		 3438 if (map->idtype != type)
3439 continue;
3440
4bc3b759
CB		 3441 had_entry = true;
3442
3443 left = LXC_IDMAPLEN - (pos - buf);
d1838f34 3444 fill = snprintf(pos, left, "%s%lu %lu %lu%s",
4bc3b759
CB		 3445 use_shadow ? " " : "", map->nsid,
3446 map->hostid, map->range,
0e6e3a41 3447 use_shadow ? "" : "\n");
cf3ef16d 3448 if (fill <= 0 || fill >= left)
4bc3b759
CB		 3449 SYSERROR("Too many {g,u}id mappings defined.");
3450
cf3ef16d 3451 pos += fill;
251d0d2a 3452 }
cf3ef16d 3453 if (!had_entry)
4f7521b4 3454 continue;
cf3ef16d 3455
0e6e3a41 3456 if (!use_shadow) {
4bc3b759 3457 ret = write_id_mapping(type, pid, buf, pos - buf);
d1838f34 3458 } else {
4bc3b759 3459 left = LXC_IDMAPLEN - (pos - buf);
d1838f34
MS		 3460 fill = snprintf(pos, left, "\n");
3461 if (fill <= 0 || fill >= left)
4bc3b759 3462 SYSERROR("Too many {g,u}id mappings defined.");
d1838f34 3463 pos += fill;
cf3ef16d 3464 ret = system(buf);
d1838f34 3465 }
f6d3e3e4
SH		 3466 if (ret)
3467 break;
3468 }
251d0d2a 3469
f10fad2f 3470 free(buf);
f6d3e3e4
SH		 3471 return ret;
3472}
3473
cf3ef16d 3474/*
7b50c609
TS		 3475 * return the host uid/gid to which the container root is mapped in
3476 * *val.
0b3a6504 3477 * Return true if id was found, false otherwise.
cf3ef16d 3478 */
2a9a80cb 3479bool get_mapped_rootid(struct lxc_conf *conf, enum idtype idtype,
3ec1648d 3480 unsigned long *val)
cf3ef16d
SH		 3481{
3482 struct lxc_list *it;
3483 struct id_map *map;
3484
3485 lxc_list_for_each(it, &conf->id_map) {
3486 map = it->elem;
7b50c609 3487 if (map->idtype != idtype)
cf3ef16d
SH		 3488 continue;
3489 if (map->nsid != 0)
3490 continue;
2a9a80cb
SH		 3491 *val = map->hostid;
3492 return true;
cf3ef16d 3493 }
2a9a80cb 3494 return false;
cf3ef16d
SH		 3495}
3496
2133f58c 3497int mapped_hostid(unsigned id, struct lxc_conf *conf, enum idtype idtype)
cf3ef16d
SH		 3498{
3499 struct lxc_list *it;
3500 struct id_map *map;
3501 lxc_list_for_each(it, &conf->id_map) {
3502 map = it->elem;
2133f58c 3503 if (map->idtype != idtype)
cf3ef16d
SH		 3504 continue;
3505 if (id >= map->hostid && id < map->hostid + map->range)
57d116ab 3506 return (id - map->hostid) + map->nsid;
cf3ef16d 3507 }
57d116ab 3508 return -1;
cf3ef16d
SH		 3509}
3510
2133f58c 3511int find_unmapped_nsuid(struct lxc_conf *conf, enum idtype idtype)
cf3ef16d
SH		 3512{
3513 struct lxc_list *it;
3514 struct id_map *map;
2133f58c 3515 unsigned int freeid = 0;
cf3ef16d
SH		 3516again:
3517 lxc_list_for_each(it, &conf->id_map) {
3518 map = it->elem;
2133f58c 3519 if (map->idtype != idtype)
cf3ef16d
SH		 3520 continue;
3521 if (freeid >= map->nsid && freeid < map->nsid + map->range) {
3522 freeid = map->nsid + map->range;
3523 goto again;
3524 }
3525 }
3526 return freeid;
3527}
3528
19a26f82
MK		 3529int lxc_find_gateway_addresses(struct lxc_handler *handler)
3530{
3531 struct lxc_list *network = &handler->conf->network;
3532 struct lxc_list *iterator;
3533 struct lxc_netdev *netdev;
3534 int link_index;
3535
3536 lxc_list_for_each(iterator, network) {
3537 netdev = iterator->elem;
3538
3539 if (!netdev->ipv4_gateway_auto && !netdev->ipv6_gateway_auto)
3540 continue;
3541
3542 if (netdev->type != LXC_NET_VETH && netdev->type != LXC_NET_MACVLAN) {
3543 ERROR("gateway = auto only supported for "
3544 "veth and macvlan");
3545 return -1;
3546 }
3547
3548 if (!netdev->link) {
3549 ERROR("gateway = auto needs a link interface");
3550 return -1;
3551 }
3552
3553 link_index = if_nametoindex(netdev->link);
3554 if (!link_index)
3555 return -EINVAL;
3556
3557 if (netdev->ipv4_gateway_auto) {
3558 if (lxc_ipv4_addr_get(link_index, &netdev->ipv4_gateway)) {
3559 ERROR("failed to automatically find ipv4 gateway "
3560 "address from link interface '%s'", netdev->link);
3561 return -1;
3562 }
3563 }
3564
3565 if (netdev->ipv6_gateway_auto) {
3566 if (lxc_ipv6_addr_get(link_index, &netdev->ipv6_gateway)) {
3567 ERROR("failed to automatically find ipv6 gateway "
3568 "address from link interface '%s'", netdev->link);
3569 return -1;
3570 }
3571 }
3572 }
3573
3574 return 0;
3575}
3576
5e4a62bf 3577int lxc_create_tty(const char *name, struct lxc_conf *conf)
b0a33c1e 3578{
5e4a62bf 3579 struct lxc_tty_info *tty_info = &conf->tty_info;
025ed0f3 3580 int i, ret;
b0a33c1e 3581
5e4a62bf
DL		 3582 /* no tty in the configuration */
3583 if (!conf->tty)
b0a33c1e 3584 return 0;
3585
13954cce 3586 tty_info->pty_info =
e4e7d59d 3587 malloc(sizeof(*tty_info->pty_info)*conf->tty);
b0a33c1e 3588 if (!tty_info->pty_info) {
36eb9bde 3589 SYSERROR("failed to allocate pty_info");
985d15b1 3590 return -1;
b0a33c1e 3591 }
3592
985d15b1 3593 for (i = 0; i < conf->tty; i++) {
13954cce 3594
b0a33c1e 3595 struct lxc_pty_info *pty_info = &tty_info->pty_info[i];
3596
025ed0f3
SH		 3597 process_lock();
3598 ret = openpty(&pty_info->master, &pty_info->slave,
3599 pty_info->name, NULL, NULL);
3600 process_unlock();
3601 if (ret) {
36eb9bde 3602 SYSERROR("failed to create pty #%d", i);
985d15b1
MT		 3603 tty_info->nbtty = i;
3604 lxc_delete_tty(tty_info);
3605 return -1;
b0a33c1e 3606 }
3607
5332bb84
DL		 3608 DEBUG("allocated pty '%s' (%d/%d)",
3609 pty_info->name, pty_info->master, pty_info->slave);
3610
3ec1648d 3611 /* Prevent leaking the file descriptors to the container */
b035ad62
MS		 3612 fcntl(pty_info->master, F_SETFD, FD_CLOEXEC);
3613 fcntl(pty_info->slave, F_SETFD, FD_CLOEXEC);
3614
b0a33c1e 3615 pty_info->busy = 0;
3616 }
3617
985d15b1 3618 tty_info->nbtty = conf->tty;
1ac470c0
DL		 3619
3620 INFO("tty's configured");
3621
985d15b1 3622 return 0;
b0a33c1e 3623}
3624
3625void lxc_delete_tty(struct lxc_tty_info *tty_info)
3626{
3627 int i;
3628
3629 for (i = 0; i < tty_info->nbtty; i++) {
3630 struct lxc_pty_info *pty_info = &tty_info->pty_info[i];
3631
3632 close(pty_info->master);
3633 close(pty_info->slave);
3634 }
3635
3636 free(tty_info->pty_info);
e00c0242 3637 tty_info->pty_info = NULL;
b0a33c1e 3638 tty_info->nbtty = 0;
3639}
3640
f6d3e3e4 3641/*
7b50c609
TS		 3642 * chown_mapped_root: for an unprivileged user with uid/gid X to
3643 * chown a dir to subuid/subgid Y, he needs to run chown as root
3644 * in a userns where nsid 0 is mapped to hostuid/hostgid Y, and
3645 * nsid Y is mapped to hostuid/hostgid X. That way, the container
3646 * root is privileged with respect to hostuid/hostgid X, allowing
3647 * him to do the chown.
f6d3e3e4 3648 */
c4d10a05 3649int chown_mapped_root(char *path, struct lxc_conf *conf)
f6d3e3e4 3650{
7b50c609
TS		 3651 uid_t rootuid;
3652 gid_t rootgid;
c4d10a05 3653 pid_t pid;
2a9a80cb 3654 unsigned long val;
a7ef8753 3655 char *chownpath = path;
f6d3e3e4 3656
2a9a80cb 3657 if (!get_mapped_rootid(conf, ID_TYPE_UID, &val)) {
c4d10a05
SH		 3658 ERROR("No mapping for container root");
3659 return -1;
f6d3e3e4 3660 }
7b50c609
TS		 3661 rootuid = (uid_t) val;
3662 if (!get_mapped_rootid(conf, ID_TYPE_GID, &val)) {
3663 ERROR("No mapping for container root");
3664 return -1;
3665 }
3666 rootgid = (gid_t) val;
2a9a80cb 3667
a7ef8753
SH		 3668 /*
3669 * In case of overlay, we want only the writeable layer
3670 * to be chowned
3671 */
1f92162d 3672 if (strncmp(path, "overlayfs:", 10) == 0 || strncmp(path, "aufs:", 5) == 0) {
a7ef8753
SH		 3673 chownpath = strchr(path, ':');
3674 if (!chownpath) {
3675 ERROR("Bad overlay path: %s", path);
3676 return -1;
3677 }
3678 chownpath = strchr(chownpath+1, ':');
3679 if (!chownpath) {
3680 ERROR("Bad overlay path: %s", path);
3681 return -1;
3682 }
3683 chownpath++;
3684 }
3685 path = chownpath;
c4d10a05 3686 if (geteuid() == 0) {
7b50c609 3687 if (chown(path, rootuid, rootgid) < 0) {
c4d10a05
SH		 3688 ERROR("Error chowning %s", path);
3689 return -1;
3690 }
3691 return 0;
3692 }
f3d7e4ca 3693
7b50c609 3694 if (rootuid == geteuid()) {
f3d7e4ca
SH		 3695 // nothing to do
3696 INFO("%s: container root is our uid; no need to chown" ,__func__);
3697 return 0;
3698 }
3699
c4d10a05
SH		 3700 pid = fork();
3701 if (pid < 0) {
3702 SYSERROR("Failed forking");
f6d3e3e4
SH		 3703 return -1;
3704 }
c4d10a05 3705 if (!pid) {
7b50c609
TS		 3706 int hostuid = geteuid(), hostgid = getegid(), ret;
3707 struct stat sb;
3708 char map1[100], map2[100], map3[100], map4[100], map5[100];
3709 char ugid[100];
3710 char *args1[] = { "lxc-usernsexec", "-m", map1, "-m", map2,
3711 "-m", map3, "-m", map5,
3712 "--", "chown", ugid, path, NULL };
3713 char *args2[] = { "lxc-usernsexec", "-m", map1, "-m", map2,
3714 "-m", map3, "-m", map4, "-m", map5,
3715 "--", "chown", ugid, path, NULL };
3716
3717 // save the current gid of "path"
3718 if (stat(path, &sb) < 0) {
3719 ERROR("Error stat %s", path);
3720 return -1;
3721 }
f6d3e3e4 3722
9a7c2aba
SH		 3723 /*
3724 * A file has to be group-owned by a gid mapped into the
3725 * container, or the container won't be privileged over it.
3726 */
3727 if (sb.st_uid == geteuid() &&
3728 mapped_hostid(sb.st_gid, conf, ID_TYPE_GID) < 0 &&
3729 chown(path, -1, hostgid) < 0) {
3730 ERROR("Failed chgrping %s", path);
7b50c609
TS		 3731 return -1;
3732 }
3733
3734 // "u:0:rootuid:1"
3735 ret = snprintf(map1, 100, "u:0:%d:1", rootuid);
c4d10a05
SH		 3736 if (ret < 0 || ret >= 100) {
3737 ERROR("Error uid printing map string");
f6d3e3e4
SH		 3738 return -1;
3739 }
c4d10a05 3740
98e5ba51
SH		 3741 // "u:hostuid:hostuid:1"
3742 ret = snprintf(map2, 100, "u:%d:%d:1", hostuid, hostuid);
3743 if (ret < 0 || ret >= 100) {
3744 ERROR("Error uid printing map string");
3745 return -1;
3746 }
3747
7b50c609
TS		 3748 // "g:0:rootgid:1"
3749 ret = snprintf(map3, 100, "g:0:%d:1", rootgid);
c4d10a05 3750 if (ret < 0 || ret >= 100) {
7b50c609 3751 ERROR("Error gid printing map string");
c4d10a05
SH		 3752 return -1;
3753 }
3754
7b50c609 3755 // "g:pathgid:rootgid+pathgid:1"
b4c1e35d
SG		 3756 ret = snprintf(map4, 100, "g:%d:%d:1", (gid_t)sb.st_gid,
3757 rootgid + (gid_t)sb.st_gid);
7b50c609
TS		 3758 if (ret < 0 || ret >= 100) {
3759 ERROR("Error gid printing map string");
3760 return -1;
3761 }
3762
3763 // "g:hostgid:hostgid:1"
3764 ret = snprintf(map5, 100, "g:%d:%d:1", hostgid, hostgid);
3765 if (ret < 0 || ret >= 100) {
3766 ERROR("Error gid printing map string");
3767 return -1;
3768 }
3769
3770 // "0:pathgid" (chown)
b4c1e35d 3771 ret = snprintf(ugid, 100, "0:%d", (gid_t)sb.st_gid);
7b50c609
TS		 3772 if (ret < 0 || ret >= 100) {
3773 ERROR("Error owner printing format string for chown");
3774 return -1;
3775 }
3776
3777 if (hostgid == sb.st_gid)
3778 ret = execvp("lxc-usernsexec", args1);
3779 else
3780 ret = execvp("lxc-usernsexec", args2);
c4d10a05
SH		 3781 SYSERROR("Failed executing usernsexec");
3782 exit(1);
f6d3e3e4 3783 }
c4d10a05 3784 return wait_for_pid(pid);
f6d3e3e4
SH		 3785}
3786
c4d10a05 3787int ttys_shift_ids(struct lxc_conf *c)
f6d3e3e4 3788{
c4d10a05 3789 if (lxc_list_empty(&c->id_map))
f6d3e3e4 3790 return 0;
c4d10a05 3791
29b10e4f 3792 if (strcmp(c->console.name, "") !=0 && chown_mapped_root(c->console.name, c) < 0) {
c4d10a05
SH		 3793 ERROR("Failed to chown %s", c->console.name);
3794 return -1;
3795 }
3796
f6d3e3e4
SH		 3797 return 0;
3798}
3799
f267d666 3800/* NOTE: not to be called from inside the container namespace! */
5112cd70
SH		 3801int tmp_proc_mount(struct lxc_conf *lxc_conf)
3802{
3803 int mounted;
3804
01958b1f 3805 mounted = mount_proc_if_needed(lxc_conf->rootfs.path ? lxc_conf->rootfs.mount : "");
5112cd70
SH		 3806 if (mounted == -1) {
3807 SYSERROR("failed to mount /proc in the container.");
01958b1f
DW		 3808 /* continue only if there is no rootfs */
3809 if (lxc_conf->rootfs.path)
3810 return -1;
5112cd70
SH		 3811 } else if (mounted == 1) {
3812 lxc_conf->tmp_umount_proc = 1;
3813 }
3814 return 0;
3815}
3816
3817void tmp_proc_unmount(struct lxc_conf *lxc_conf)
3818{
3819 if (lxc_conf->tmp_umount_proc == 1) {
3820 umount("/proc");
3821 lxc_conf->tmp_umount_proc = 0;
3822 }
3823}
3824
6a0c909a 3825void remount_all_slave(void)
e995d7a2
SH		 3826{
3827 /* walk /proc/mounts and change any shared entries to slave */
3828 FILE *f = fopen("/proc/self/mountinfo", "r");
3829 char *line = NULL;
3830 size_t len = 0;
3831
3832 if (!f) {
3833 SYSERROR("Failed to open /proc/self/mountinfo to mark all shared");
3834 ERROR("Continuing container startup...");
3835 return;
3836 }
3837
3838 while (getline(&line, &len, f) != -1) {
3839 char *target, *opts;
3840 target = get_field(line, 4);
3841 if (!target)
3842 continue;
3843 opts = get_field(target, 2);
3844 if (!opts)
3845 continue;
3846 null_endofword(opts);
3847 if (!strstr(opts, "shared"))
3848 continue;
3849 null_endofword(target);
3850 if (mount(NULL, target, NULL, MS_SLAVE, NULL)) {
3851 SYSERROR("Failed to make %s rslave", target);
3852 ERROR("Continuing...");
3853 }
3854 }
3855 fclose(f);
f10fad2f 3856 free(line);
e995d7a2
SH		 3857}
3858
2322903b
SH		 3859void lxc_execute_bind_init(struct lxc_conf *conf)
3860{
3861 int ret;
9d9c111c
SH		 3862 char path[PATH_MAX], destpath[PATH_MAX], *p;
3863
3864 /* If init exists in the container, don't bind mount a static one */
3865 p = choose_init(conf->rootfs.mount);
3866 if (p) {
3867 free(p);
3868 return;
3869 }
2322903b
SH		 3870
3871 ret = snprintf(path, PATH_MAX, SBINDIR "/init.lxc.static");
3872 if (ret < 0 || ret >= PATH_MAX) {
3873 WARN("Path name too long searching for lxc.init.static");
3874 return;
3875 }
3876
3877 if (!file_exists(path)) {
3878 INFO("%s does not exist on host", path);
3879 return;
3880 }
3881
3882 ret = snprintf(destpath, PATH_MAX, "%s%s", conf->rootfs.mount, "/init.lxc.static");
3883 if (ret < 0 || ret >= PATH_MAX) {
3884 WARN("Path name too long for container's lxc.init.static");
3885 return;
3886 }
3887
3888 if (!file_exists(destpath)) {
3889 FILE * pathfile = fopen(destpath, "wb");
3890 if (!pathfile) {
3891 SYSERROR("Failed to create mount target '%s'", destpath);
3892 return;
3893 }
3894 fclose(pathfile);
3895 }
3896
592fd47a 3897 ret = safe_mount(path, destpath, "none", MS_BIND, NULL, conf->rootfs.mount);
2322903b
SH		 3898 if (ret < 0)
3899 SYSERROR("Failed to bind lxc.init.static into container");
3900 INFO("lxc.init.static bound into container at %s", path);
3901}
3902
35120d9c
SH		 3903/*
3904 * This does the work of remounting / if it is shared, calling the
3905 * container pre-mount hooks, and mounting the rootfs.
3906 */
3907int do_rootfs_setup(struct lxc_conf *conf, const char *name, const char *lxcpath)
0ad19a3f 3908{
35120d9c
SH		 3909 if (conf->rootfs_setup) {
3910 /*
3911 * rootfs was set up in another namespace. bind-mount it
3912 * to give us a mount in our own ns so we can pivot_root to it
3913 */
3914 const char *path = conf->rootfs.mount;
3915 if (mount(path, path, "rootfs", MS_BIND, NULL) < 0) {
3916 ERROR("Failed to bind-mount container / onto itself");
145832ba 3917 return -1;
35120d9c 3918 }
145832ba 3919 return 0;
35120d9c 3920 }
d4ef7c50 3921
e995d7a2
SH		 3922 remount_all_slave();
3923
35120d9c
SH		 3924 if (run_lxc_hooks(name, "pre-mount", conf, lxcpath, NULL)) {
3925 ERROR("failed to run pre-mount hooks for container '%s'.", name);
3926 return -1;
3927 }
3928
3929 if (setup_rootfs(conf)) {
3930 ERROR("failed to setup rootfs for '%s'", name);
3931 return -1;
3932 }
3933
3934 conf->rootfs_setup = true;
3935 return 0;
3936}
3937
1c1c7051
SH		 3938static bool verify_start_hooks(struct lxc_conf *conf)
3939{
3940 struct lxc_list *it;
3941 char path[MAXPATHLEN];
3942 lxc_list_for_each(it, &conf->hooks[LXCHOOK_START]) {
3943 char *hookname = it->elem;
3944 struct stat st;
3945 int ret;
3946
3947 ret = snprintf(path, MAXPATHLEN, "%s%s",
7b6753e7 3948 conf->rootfs.path ? conf->rootfs.mount : "", hookname);
1c1c7051
SH		 3949 if (ret < 0 || ret >= MAXPATHLEN)
3950 return false;
3951 ret = stat(path, &st);
3952 if (ret) {
7b6753e7 3953 SYSERROR("Start hook %s not found in container",
1c1c7051
SH		 3954 hookname);
3955 return false;
3956 }
6a0c909a 3957 return true;
1c1c7051
SH		 3958 }
3959
3960 return true;
3961}
3962
e8bd4e43
SH		 3963static int send_fd(int sock, int fd)
3964{
3965 int ret = lxc_abstract_unix_send_fd(sock, fd, NULL, 0);
3966
3967
3968 if (ret < 0) {
3969 SYSERROR("Error sending tty fd to parent");
3970 return -1;
3971 }
3972
3973 return 0;
3974}
3975
3976static int send_ttys_to_parent(struct lxc_handler *handler)
3977{
3978 struct lxc_conf *conf = handler->conf;
3979 const struct lxc_tty_info *tty_info = &conf->tty_info;
3980 int i;
3981 int sock = handler->ttysock[0];
3982
3983 for (i = 0; i < tty_info->nbtty; i++) {
3984 struct lxc_pty_info *pty_info = &tty_info->pty_info[i];
3985 if (send_fd(sock, pty_info->slave) < 0)
3986 goto bad;
3987 close(pty_info->slave);
3988 pty_info->slave = -1;
3989 if (send_fd(sock, pty_info->master) < 0)
3990 goto bad;
3991 close(pty_info->master);
3992 pty_info->master = -1;
3993 }
3994
3995 close(handler->ttysock[0]);
3996 close(handler->ttysock[1]);
3997
3998 return 0;
3999
4000bad:
4001 ERROR("Error writing tty fd to parent");
4002 return -1;
4003}
4004
35120d9c
SH		 4005int lxc_setup(struct lxc_handler *handler)
4006{
4007 const char *name = handler->name;
4008 struct lxc_conf *lxc_conf = handler->conf;
4009 const char *lxcpath = handler->lxcpath;
35120d9c
SH		 4010
4011 if (do_rootfs_setup(lxc_conf, name, lxcpath) < 0) {
4012 ERROR("Error setting up rootfs mount after spawn");
4013 return -1;
4014 }
4015
6c544cb3
MM		 4016 if (lxc_conf->inherit_ns_fd[LXC_NS_UTS] == -1) {
4017 if (setup_utsname(lxc_conf->utsname)) {
4018 ERROR("failed to setup the utsname for '%s'", name);
4019 return -1;
4020 }
0ad19a3f 4021 }
4022
5f4535a3 4023 if (setup_network(&lxc_conf->network)) {
36eb9bde 4024 ERROR("failed to setup the network for '%s'", name);
95b5ffaf 4025 return -1;
0ad19a3f 4026 }
4027
bc6928ff 4028 if (lxc_conf->autodev > 0) {
14221cbb 4029 if (mount_autodev(name, &lxc_conf->rootfs, lxcpath)) {
91c3830e 4030 ERROR("failed to mount /dev in the container");
c6883f38
SH		 4031 return -1;
4032 }
4033 }
4034
368bbc02
CS		 4035 /* do automatic mounts (mainly /proc and /sys), but exclude
4036 * those that need to wait until other stuff has finished
4037 */
4fb3cba5 4038 if (lxc_mount_auto_mounts(lxc_conf, lxc_conf->auto_mounts & ~LXC_AUTO_CGROUP_MASK, handler) < 0) {
368bbc02
CS		 4039 ERROR("failed to setup the automatic mounts for '%s'", name);
4040 return -1;
4041 }
4042
0a2dddd4 4043 if (setup_mount(&lxc_conf->rootfs, lxc_conf->fstab, name, lxcpath)) {
36eb9bde 4044 ERROR("failed to setup the mounts for '%s'", name);
95b5ffaf 4045 return -1;
576f946d 4046 }
4047
0a2dddd4 4048 if (!lxc_list_empty(&lxc_conf->mount_list) && setup_mount_entries(&lxc_conf->rootfs, &lxc_conf->mount_list, name, lxcpath)) {
e7938e9e
MN		 4049 ERROR("failed to setup the mount entries for '%s'", name);
4050 return -1;
4051 }
4052
7b6753e7 4053 /* Make sure any start hooks are in the container */
1c1c7051
SH		 4054 if (!verify_start_hooks(lxc_conf))
4055 return -1;
4056
2322903b
SH		 4057 if (lxc_conf->is_execute)
4058 lxc_execute_bind_init(lxc_conf);
4059
368bbc02
CS		 4060 /* now mount only cgroup, if wanted;
4061 * before, /sys could not have been mounted
4062 * (is either mounted automatically or via fstab entries)
4063 */
4fb3cba5 4064 if (lxc_mount_auto_mounts(lxc_conf, lxc_conf->auto_mounts & LXC_AUTO_CGROUP_MASK, handler) < 0) {
368bbc02
CS		 4065 ERROR("failed to setup the automatic mounts for '%s'", name);
4066 return -1;
4067 }
4068
283678ed 4069 if (run_lxc_hooks(name, "mount", lxc_conf, lxcpath, NULL)) {
773fb9ca
SH		 4070 ERROR("failed to run mount hooks for container '%s'.", name);
4071 return -1;
4072 }
4073
bc6928ff 4074 if (lxc_conf->autodev > 0) {
0728ebf4
TA		 4075 bool mount_console = lxc_conf->console.path && !strcmp(lxc_conf->console.path, "none");
4076
283678ed 4077 if (run_lxc_hooks(name, "autodev", lxc_conf, lxcpath, NULL)) {
f7bee6c6
MW		 4078 ERROR("failed to run autodev hooks for container '%s'.", name);
4079 return -1;
4080 }
0728ebf4 4081 if (fill_autodev(&lxc_conf->rootfs, mount_console)) {
91c3830e
SH		 4082 ERROR("failed to populate /dev in the container");
4083 return -1;
4084 }
4085 }
368bbc02 4086
37903589 4087 if (!lxc_conf->is_execute && setup_console(&lxc_conf->rootfs, &lxc_conf->console, lxc_conf->ttydir)) {
36eb9bde 4088 ERROR("failed to setup the console for '%s'", name);
95b5ffaf 4089 return -1;
6e590161 4090 }
4091
7e0e1d94
AV		 4092 if (lxc_conf->kmsg) {
4093 if (setup_kmsg(&lxc_conf->rootfs, &lxc_conf->console)) // don't fail
4094 ERROR("failed to setup kmsg for '%s'", name);
4095 }
1bd051a6 4096
69aa6655
DE		 4097 if (!lxc_conf->is_execute && setup_dev_symlinks(&lxc_conf->rootfs)) {
4098 ERROR("failed to setup /dev symlinks for '%s'", name);
4099 return -1;
4100 }
4101
5112cd70
SH		 4102 /* mount /proc if it's not already there */
4103 if (tmp_proc_mount(lxc_conf) < 0) {
fe4de9a6 4104 ERROR("failed to LSM mount proc for '%s'", name);
e075f5d9 4105 return -1;
e075f5d9 4106 }
e075f5d9 4107
ac778708 4108 if (setup_pivot_root(&lxc_conf->rootfs)) {
36eb9bde 4109 ERROR("failed to set rootfs for '%s'", name);
95b5ffaf 4110 return -1;
ed502555 4111 }
4112
571e6ec8 4113 if (setup_pts(lxc_conf->pts)) {
36eb9bde 4114 ERROR("failed to setup the new pts instance");
95b5ffaf 4115 return -1;
3c26f34e 4116 }
4117
e8bd4e43
SH		 4118 if (lxc_create_tty(name, lxc_conf)) {
4119 ERROR("failed to create the ttys");
4120 return -1;
4121 }
4122
4123 if (send_ttys_to_parent(handler) < 0) {
4124 ERROR("failure sending console info to parent");
4125 return -1;
4126 }
4127
4128
4129 if (!lxc_conf->is_execute && setup_tty(lxc_conf)) {
4130 ERROR("failed to setup the ttys for '%s'", name);
4131 return -1;
4132 }
4133
4134 if (lxc_conf->pty_names && setenv("container_ttys", lxc_conf->pty_names, 1))
4135 SYSERROR("failed to set environment variable for container ptys");
4136
4137
cccc74b5
DL		 4138 if (setup_personality(lxc_conf->personality)) {
4139 ERROR("failed to setup personality");
4140 return -1;
4141 }
4142
97a8f74f
SG		 4143 if (!lxc_list_empty(&lxc_conf->keepcaps)) {
4144 if (!lxc_list_empty(&lxc_conf->caps)) {
7389ca26 4145 ERROR("Container requests lxc.cap.drop and lxc.cap.keep: either use lxc.cap.drop or lxc.cap.keep, not both.");
f6d3e3e4
SH		 4146 return -1;
4147 }
97a8f74f
SG		 4148 if (dropcaps_except(&lxc_conf->keepcaps)) {
4149 ERROR("failed to keep requested caps");
4150 return -1;
4151 }
4152 } else if (setup_caps(&lxc_conf->caps)) {
4153 ERROR("failed to drop capabilities");
4154 return -1;
81810dd1
DL		 4155 }
4156
cd54d859
DL		 4157 NOTICE("'%s' is setup.", name);
4158
0ad19a3f 4159 return 0;
4160}
26ddeedd 4161
283678ed
SH		 4162int run_lxc_hooks(const char *name, char *hook, struct lxc_conf *conf,
4163 const char *lxcpath, char *argv[])
26ddeedd
SH		 4164{
4165 int which = -1;
4166 struct lxc_list *it;
4167
4168 if (strcmp(hook, "pre-start") == 0)
4169 which = LXCHOOK_PRESTART;
5ea6163a
SH		 4170 else if (strcmp(hook, "pre-mount") == 0)
4171 which = LXCHOOK_PREMOUNT;
26ddeedd
SH		 4172 else if (strcmp(hook, "mount") == 0)
4173 which = LXCHOOK_MOUNT;
f7bee6c6
MW		 4174 else if (strcmp(hook, "autodev") == 0)
4175 which = LXCHOOK_AUTODEV;
26ddeedd
SH		 4176 else if (strcmp(hook, "start") == 0)
4177 which = LXCHOOK_START;
52492063
WB		 4178 else if (strcmp(hook, "stop") == 0)
4179 which = LXCHOOK_STOP;
26ddeedd
SH		 4180 else if (strcmp(hook, "post-stop") == 0)
4181 which = LXCHOOK_POSTSTOP;
148e91f5
SH		 4182 else if (strcmp(hook, "clone") == 0)
4183 which = LXCHOOK_CLONE;
37cf711b
SY		 4184 else if (strcmp(hook, "destroy") == 0)
4185 which = LXCHOOK_DESTROY;
26ddeedd
SH		 4186 else
4187 return -1;
4188 lxc_list_for_each(it, &conf->hooks[which]) {
4189 int ret;
4190 char *hookname = it->elem;
283678ed 4191 ret = run_script_argv(name, "lxc", hookname, hook, lxcpath, argv);
26ddeedd
SH		 4192 if (ret)
4193 return ret;
4194 }
4195 return 0;
4196}
72d0e1cb 4197
427b3a21 4198static void lxc_remove_nic(struct lxc_list *it)
72d0e1cb
SG		 4199{
4200 struct lxc_netdev *netdev = it->elem;
9ebb03ad 4201 struct lxc_list *it2,*next;
72d0e1cb
SG		 4202
4203 lxc_list_del(it);
4204
f10fad2f
ME		 4205 free(netdev->link);
4206 free(netdev->name);
4207 if (netdev->type == LXC_NET_VETH)
c9bb9a85 4208 free(netdev->priv.veth_attr.pair);
f10fad2f
ME		 4209 free(netdev->upscript);
4210 free(netdev->hwaddr);
4211 free(netdev->mtu);
4212 free(netdev->ipv4_gateway);
4213 free(netdev->ipv6_gateway);
9ebb03ad 4214 lxc_list_for_each_safe(it2, &netdev->ipv4, next) {
72d0e1cb
SG		 4215 lxc_list_del(it2);
4216 free(it2->elem);
4217 free(it2);
4218 }
9ebb03ad 4219 lxc_list_for_each_safe(it2, &netdev->ipv6, next) {
72d0e1cb
SG		 4220 lxc_list_del(it2);
4221 free(it2->elem);
4222 free(it2);
4223 }
d95db067 4224 free(netdev);
72d0e1cb
SG		 4225 free(it);
4226}
4227
4228/* we get passed in something like '0', '0.ipv4' or '1.ipv6' */
12a50cc6 4229int lxc_clear_nic(struct lxc_conf *c, const char *key)
72d0e1cb
SG		 4230{
4231 char *p1;
4232 int ret, idx, i;
4233 struct lxc_list *it;
4234 struct lxc_netdev *netdev;
4235
46cd2845 4236 p1 = strchr(key, '.');
72d0e1cb
SG		 4237 if (!p1 || *(p1+1) == '\0')
4238 p1 = NULL;
4239
4240 ret = sscanf(key, "%d", &idx);
4241 if (ret != 1) return -1;
4242 if (idx < 0)
4243 return -1;
4244
4245 i = 0;
4246 lxc_list_for_each(it, &c->network) {
4247 if (i == idx)
4248 break;
4249 i++;
4250 }
4251 if (i < idx) // we don't have that many nics defined
4252 return -1;
4253
4254 if (!it || !it->elem)
4255 return -1;
4256
4257 netdev = it->elem;
4258
4259 if (!p1) {
4260 lxc_remove_nic(it);
52d21d40 4261 } else if (strcmp(p1, ".ipv4") == 0) {
9ebb03ad
DE		 4262 struct lxc_list *it2,*next;
4263 lxc_list_for_each_safe(it2, &netdev->ipv4, next) {
72d0e1cb
SG		 4264 lxc_list_del(it2);
4265 free(it2->elem);
4266 free(it2);
4267 }
52d21d40 4268 } else if (strcmp(p1, ".ipv6") == 0) {
9ebb03ad
DE		 4269 struct lxc_list *it2,*next;
4270 lxc_list_for_each_safe(it2, &netdev->ipv6, next) {
72d0e1cb
SG		 4271 lxc_list_del(it2);
4272 free(it2->elem);
4273 free(it2);
4274 }
72d0e1cb
SG		 4275 }
4276 else return -1;
4277
4278 return 0;
4279}
4280
4281int lxc_clear_config_network(struct lxc_conf *c)
4282{
9ebb03ad
DE		 4283 struct lxc_list *it,*next;
4284 lxc_list_for_each_safe(it, &c->network, next) {
72d0e1cb
SG		 4285 lxc_remove_nic(it);
4286 }
4287 return 0;
4288}
4289
4290int lxc_clear_config_caps(struct lxc_conf *c)
4291{
9ebb03ad 4292 struct lxc_list *it,*next;
72d0e1cb 4293
9ebb03ad 4294 lxc_list_for_each_safe(it, &c->caps, next) {
72d0e1cb
SG		 4295 lxc_list_del(it);
4296 free(it->elem);
4297 free(it);
4298 }
4299 return 0;
4300}
4301
74a3920a 4302static int lxc_free_idmap(struct lxc_list *id_map) {
27c27d73
SH		 4303 struct lxc_list *it, *next;
4304
4355ab5f 4305 lxc_list_for_each_safe(it, id_map, next) {
27c27d73
SH		 4306 lxc_list_del(it);
4307 free(it->elem);
4308 free(it);
4309 }
4310 return 0;
4311}
4312
4355ab5f
SH		 4313int lxc_clear_idmaps(struct lxc_conf *c)
4314{
4315 return lxc_free_idmap(&c->id_map);
4316}
4317
1fb86a7c
SH		 4318int lxc_clear_config_keepcaps(struct lxc_conf *c)
4319{
4320 struct lxc_list *it,*next;
4321
4322 lxc_list_for_each_safe(it, &c->keepcaps, next) {
4323 lxc_list_del(it);
4324 free(it->elem);
4325 free(it);
4326 }
4327 return 0;
4328}
4329
12a50cc6 4330int lxc_clear_cgroups(struct lxc_conf *c, const char *key)
72d0e1cb 4331{
9ebb03ad 4332 struct lxc_list *it,*next;
72d0e1cb 4333 bool all = false;
a6390f01 4334 const char *k = NULL;
72d0e1cb
SG		 4335
4336 if (strcmp(key, "lxc.cgroup") == 0)
4337 all = true;
a6390f01
WB		 4338 else if (strncmp(key, "lxc.cgroup.", sizeof("lxc.cgroup.")-1) == 0)
4339 k = key + sizeof("lxc.cgroup.")-1;
4340 else
4341 return -1;
72d0e1cb 4342
9ebb03ad 4343 lxc_list_for_each_safe(it, &c->cgroup, next) {
72d0e1cb
SG		 4344 struct lxc_cgroup *cg = it->elem;
4345 if (!all && strcmp(cg->subsystem, k) != 0)
4346 continue;
4347 lxc_list_del(it);
4348 free(cg->subsystem);
4349 free(cg->value);
4350 free(cg);
4351 free(it);
4352 }
4353 return 0;
4354}
4355
c6d09e15
WB		 4356int lxc_clear_limits(struct lxc_conf *c, const char *key)
4357{
4358 struct lxc_list *it, *next;
4359 bool all = false;
4360 const char *k = NULL;
4361
4362 if (strcmp(key, "lxc.limit") == 0)
4363 all = true;
4364 else if (strncmp(key, "lxc.limit.", sizeof("lxc.limit.")-1) == 0)
4365 k = key + sizeof("lxc.limit.")-1;
4366 else
4367 return -1;
4368
4369 lxc_list_for_each_safe(it, &c->limits, next) {
4370 struct lxc_limit *lim = it->elem;
4371 if (!all && strcmp(lim->resource, k) != 0)
4372 continue;
4373 lxc_list_del(it);
4374 free(lim->resource);
4375 free(lim);
4376 free(it);
4377 }
4378 return 0;
4379}
4380
ee1e7aa0
SG		 4381int lxc_clear_groups(struct lxc_conf *c)
4382{
4383 struct lxc_list *it,*next;
4384
4385 lxc_list_for_each_safe(it, &c->groups, next) {
4386 lxc_list_del(it);
4387 free(it->elem);
4388 free(it);
4389 }
4390 return 0;
4391}
4392
ab799c0b
SG		 4393int lxc_clear_environment(struct lxc_conf *c)
4394{
4395 struct lxc_list *it,*next;
4396
4397 lxc_list_for_each_safe(it, &c->environment, next) {
4398 lxc_list_del(it);
4399 free(it->elem);
4400 free(it);
4401 }
4402 return 0;
4403}
4404
4405
72d0e1cb
SG		 4406int lxc_clear_mount_entries(struct lxc_conf *c)
4407{
9ebb03ad 4408 struct lxc_list *it,*next;
72d0e1cb 4409
9ebb03ad 4410 lxc_list_for_each_safe(it, &c->mount_list, next) {
72d0e1cb
SG		 4411 lxc_list_del(it);
4412 free(it->elem);
4413 free(it);
4414 }
4415 return 0;
4416}
4417
b099e9e9
SH		 4418int lxc_clear_automounts(struct lxc_conf *c)
4419{
4420 c->auto_mounts = 0;
4421 return 0;
4422}
4423
12a50cc6 4424int lxc_clear_hooks(struct lxc_conf *c, const char *key)
72d0e1cb 4425{
9ebb03ad 4426 struct lxc_list *it,*next;
17ed13a3 4427 bool all = false, done = false;
a6390f01 4428 const char *k = NULL;
72d0e1cb
SG		 4429 int i;
4430
17ed13a3
SH		 4431 if (strcmp(key, "lxc.hook") == 0)
4432 all = true;
a6390f01
WB		 4433 else if (strncmp(key, "lxc.hook.", sizeof("lxc.hook.")-1) == 0)
4434 k = key + sizeof("lxc.hook.")-1;
4435 else
4436 return -1;
17ed13a3 4437
72d0e1cb 4438 for (i=0; i<NUM_LXC_HOOKS; i++) {
17ed13a3 4439 if (all || strcmp(k, lxchook_names[i]) == 0) {
9ebb03ad 4440 lxc_list_for_each_safe(it, &c->hooks[i], next) {
17ed13a3
SH		 4441 lxc_list_del(it);
4442 free(it->elem);
4443 free(it);
4444 }
4445 done = true;
72d0e1cb
SG		 4446 }
4447 }
17ed13a3
SH		 4448
4449 if (!done) {
4450 ERROR("Invalid hook key: %s", key);
4451 return -1;
4452 }
72d0e1cb
SG		 4453 return 0;
4454}
8eb5694b 4455
74a3920a 4456static void lxc_clear_saved_nics(struct lxc_conf *conf)
7b35f3d6
SH		 4457{
4458 int i;
4459
0cf45501 4460 if (!conf->saved_nics)
7b35f3d6
SH		 4461 return;
4462 for (i=0; i < conf->num_savednics; i++)
4463 free(conf->saved_nics[i].orig_name);
7b35f3d6
SH		 4464 free(conf->saved_nics);
4465}
4466
4184c3e1
SH		 4467static inline void lxc_clear_aliens(struct lxc_conf *conf)
4468{
4469 struct lxc_list *it,*next;
4470
4471 lxc_list_for_each_safe(it, &conf->aliens, next) {
4472 lxc_list_del(it);
4473 free(it->elem);
4474 free(it);
4475 }
4476}
4477
f979ac15
SH		 4478static inline void lxc_clear_includes(struct lxc_conf *conf)
4479{
4480 struct lxc_list *it,*next;
4481
4482 lxc_list_for_each_safe(it, &conf->includes, next) {
4483 lxc_list_del(it);
4484 free(it->elem);
4485 free(it);
4486 }
4487}
4488
8eb5694b
SH		 4489void lxc_conf_free(struct lxc_conf *conf)
4490{
4491 if (!conf)
4492 return;
858377e4
SH		 4493 if (current_config == conf)
4494 current_config = NULL;
f10fad2f
ME		 4495 free(conf->console.log_path);
4496 free(conf->console.path);
4497 free(conf->rootfs.mount);
b3b8c97f 4498 free(conf->rootfs.bdev_type);
f10fad2f
ME		 4499 free(conf->rootfs.options);
4500 free(conf->rootfs.path);
f10fad2f 4501 free(conf->logfile);
858377e4
SH		 4502 if (conf->logfd != -1)
4503 close(conf->logfd);
f10fad2f
ME		 4504 free(conf->utsname);
4505 free(conf->ttydir);
4506 free(conf->fstab);
4507 free(conf->rcfile);
4508 free(conf->init_cmd);
6b0d5538 4509 free(conf->unexpanded_config);
393903d1 4510 free(conf->pty_names);
76d0127f 4511 free(conf->syslog);
8eb5694b 4512 lxc_clear_config_network(conf);
f10fad2f
ME		 4513 free(conf->lsm_aa_profile);
4514 free(conf->lsm_se_context);
769872f9 4515 lxc_seccomp_free(conf);
8eb5694b 4516 lxc_clear_config_caps(conf);
1fb86a7c 4517 lxc_clear_config_keepcaps(conf);
8eb5694b 4518 lxc_clear_cgroups(conf, "lxc.cgroup");
17ed13a3 4519 lxc_clear_hooks(conf, "lxc.hook");
8eb5694b 4520 lxc_clear_mount_entries(conf);
7b35f3d6 4521 lxc_clear_saved_nics(conf);
27c27d73 4522 lxc_clear_idmaps(conf);
ee1e7aa0 4523 lxc_clear_groups(conf);
f979ac15 4524 lxc_clear_includes(conf);
761d81ca 4525 lxc_clear_aliens(conf);
ab799c0b 4526 lxc_clear_environment(conf);
c6d09e15 4527 lxc_clear_limits(conf, "lxc.limit");
8eb5694b
SH		 4528 free(conf);
4529}
4355ab5f
SH		 4530
4531struct userns_fn_data {
4532 int (*fn)(void *);
4533 void *arg;
4534 int p[2];
4535};
4536
4537static int run_userns_fn(void *data)
4538{
4539 struct userns_fn_data *d = data;
4540 char c;
4541 // we're not sharing with the parent any more, if it was a thread
4542
4543 close(d->p[1]);
4544 if (read(d->p[0], &c, 1) != 1)
4545 return -1;
4546 close(d->p[0]);
4547 return d->fn(d->arg);
4548}
4549
4550/*
8b227008
TS		 4551 * Add ID_TYPE_UID/ID_TYPE_GID entries to an existing lxc_conf,
4552 * if they are not already there.
4355ab5f 4553 */
8b227008
TS		 4554static struct lxc_list *idmap_add_id(struct lxc_conf *conf,
4555 uid_t uid, gid_t gid)
4355ab5f 4556{
8b227008
TS		 4557 int hostuid_mapped = mapped_hostid(uid, conf, ID_TYPE_UID);
4558 int hostgid_mapped = mapped_hostid(gid, conf, ID_TYPE_GID);
4355ab5f
SH		 4559 struct lxc_list *new = NULL, *tmp, *it, *next;
4560 struct id_map *entry;
4561
3ec1648d
SH		 4562 new = malloc(sizeof(*new));
4563 if (!new) {
4564 ERROR("Out of memory building id map");
4565 return NULL;
4566 }
4567 lxc_list_init(new);
4568
8b227008
TS		 4569 if (hostuid_mapped < 0) {
4570 hostuid_mapped = find_unmapped_nsuid(conf, ID_TYPE_UID);
4571 if (hostuid_mapped < 0)
3ec1648d
SH		 4572 goto err;
4573 tmp = malloc(sizeof(*tmp));
4574 if (!tmp)
4575 goto err;
4355ab5f
SH		 4576 entry = malloc(sizeof(*entry));
4577 if (!entry) {
3ec1648d
SH		 4578 free(tmp);
4579 goto err;
4355ab5f 4580 }
3ec1648d 4581 tmp->elem = entry;
4355ab5f 4582 entry->idtype = ID_TYPE_UID;
8b227008
TS		 4583 entry->nsid = hostuid_mapped;
4584 entry->hostid = (unsigned long) uid;
4585 entry->range = 1;
4586 lxc_list_add_tail(new, tmp);
4587 }
4588 if (hostgid_mapped < 0) {
4589 hostgid_mapped = find_unmapped_nsuid(conf, ID_TYPE_GID);
4590 if (hostgid_mapped < 0)
4591 goto err;
4592 tmp = malloc(sizeof(*tmp));
4593 if (!tmp)
4594 goto err;
4595 entry = malloc(sizeof(*entry));
4596 if (!entry) {
4597 free(tmp);
4598 goto err;
4599 }
4600 tmp->elem = entry;
4601 entry->idtype = ID_TYPE_GID;
4602 entry->nsid = hostgid_mapped;
4603 entry->hostid = (unsigned long) gid;
4355ab5f 4604 entry->range = 1;
3ec1648d 4605 lxc_list_add_tail(new, tmp);
4355ab5f
SH		 4606 }
4607 lxc_list_for_each_safe(it, &conf->id_map, next) {
4608 tmp = malloc(sizeof(*tmp));
4609 if (!tmp)
4610 goto err;
4611 entry = malloc(sizeof(*entry));
4612 if (!entry) {
4613 free(tmp);
4614 goto err;
4615 }
4616 memset(entry, 0, sizeof(*entry));
4617 memcpy(entry, it->elem, sizeof(*entry));
4618 tmp->elem = entry;
3ec1648d 4619 lxc_list_add_tail(new, tmp);
4355ab5f
SH		 4620 }
4621
4622 return new;
4623
4624err:
8b227008 4625 ERROR("Out of memory building a new uid/gid map");
908fde6a
SH		 4626 if (new)
4627 lxc_free_idmap(new);
c30ac545 4628 free(new);
4355ab5f
SH		 4629 return NULL;
4630}
4631
4632/*
4633 * Run a function in a new user namespace.
8b227008 4634 * The caller's euid/egid will be mapped in if it is not already.
4355ab5f
SH		 4635 */
4636int userns_exec_1(struct lxc_conf *conf, int (*fn)(void *), void *data)
4637{
4638 int ret, pid;
4639 struct userns_fn_data d;
4640 char c = '1';
4641 int p[2];
4642 struct lxc_list *idmap;
4643
4355ab5f 4644 ret = pipe(p);
4355ab5f
SH		 4645 if (ret < 0) {
4646 SYSERROR("opening pipe");
4647 return -1;
4648 }
4649 d.fn = fn;
4650 d.arg = data;
4651 d.p[0] = p[0];
4652 d.p[1] = p[1];
4653 pid = lxc_clone(run_userns_fn, &d, CLONE_NEWUSER);
4654 if (pid < 0)
4655 goto err;
4355ab5f 4656 close(p[0]);
4355ab5f
SH		 4657 p[0] = -1;
4658
8b227008
TS		 4659 if ((idmap = idmap_add_id(conf, geteuid(), getegid())) == NULL) {
4660 ERROR("Error adding self to container uid/gid map");
4355ab5f
SH		 4661 goto err;
4662 }
4663
4664 ret = lxc_map_ids(idmap, pid);
4665 lxc_free_idmap(idmap);
88dd66fc 4666 free(idmap);
565e571c 4667 if (ret) {
4355ab5f
SH		 4668 ERROR("Error setting up child mappings");
4669 goto err;
4670 }
4671
4672 // kick the child
4673 if (write(p[1], &c, 1) != 1) {
4674 SYSERROR("writing to pipe to child");
4675 goto err;
4676 }
4677
3139aead
SG		 4678 ret = wait_for_pid(pid);
4679
4680 close(p[1]);
4681 return ret;
4682
4355ab5f 4683err:
4355ab5f
SH		 4684 if (p[0] != -1)
4685 close(p[0]);
4686 close(p[1]);
4355ab5f
SH		 4687 return -1;
4688}
97e9cfa0 4689
a96a8e8c 4690/* not thread-safe, do not use from api without first forking */
97e9cfa0
SH		 4691static char* getuname(void)
4692{
a96a8e8c 4693 struct passwd *result;
97e9cfa0 4694
a96a8e8c
SH		 4695 result = getpwuid(geteuid());
4696 if (!result)
97e9cfa0
SH		 4697 return NULL;
4698
a96a8e8c 4699 return strdup(result->pw_name);
97e9cfa0
SH		 4700}
4701
a96a8e8c 4702/* not thread-safe, do not use from api without first forking */
97e9cfa0
SH		 4703static char *getgname(void)
4704{
a96a8e8c 4705 struct group *result;
97e9cfa0 4706
a96a8e8c
SH		 4707 result = getgrgid(getegid());
4708 if (!result)
97e9cfa0
SH		 4709 return NULL;
4710
a96a8e8c 4711 return strdup(result->gr_name);
97e9cfa0
SH		 4712}
4713
a96a8e8c 4714/* not thread-safe, do not use from api without first forking */
97e9cfa0
SH		 4715void suggest_default_idmap(void)
4716{
4717 FILE *f;
4718 unsigned int uid = 0, urange = 0, gid = 0, grange = 0;
4719 char *line = NULL;
4720 char *uname, *gname;
4721 size_t len = 0;
4722
4723 if (!(uname = getuname()))
4724 return;
4725
4726 if (!(gname = getgname())) {
4727 free(uname);
4728 return;
4729 }
4730
4731 f = fopen(subuidfile, "r");
4732 if (!f) {
4733 ERROR("Your system is not configured with subuids");
4734 free(gname);
4735 free(uname);
4736 return;
4737 }
4738 while (getline(&line, &len, f) != -1) {
b7930180 4739 size_t no_newline = 0;
97e9cfa0
SH		 4740 char *p = strchr(line, ':'), *p2;
4741 if (*line == '#')
4742 continue;
4743 if (!p)
4744 continue;
4745 *p = '\0';
4746 p++;
4747 if (strcmp(line, uname))
4748 continue;
4749 p2 = strchr(p, ':');
4750 if (!p2)
4751 continue;
4752 *p2 = '\0';
4753 p2++;
4754 if (!*p2)
4755 continue;
b7930180
CB		 4756 no_newline = strcspn(p2, "\n");
4757 p2[no_newline] = '\0';
4758
b7b2fde4
CB		 4759 if (lxc_safe_uint(p, &uid) < 0)
4760 WARN("Could not parse UID.");
4761 if (lxc_safe_uint(p2, &urange) < 0)
4762 WARN("Could not parse UID range.");
97e9cfa0
SH		 4763 }
4764 fclose(f);
4765
6be7389a 4766 f = fopen(subgidfile, "r");
97e9cfa0
SH		 4767 if (!f) {
4768 ERROR("Your system is not configured with subgids");
4769 free(gname);
4770 free(uname);
4771 return;
4772 }
4773 while (getline(&line, &len, f) != -1) {
b7930180 4774 size_t no_newline = 0;
97e9cfa0
SH		 4775 char *p = strchr(line, ':'), *p2;
4776 if (*line == '#')
4777 continue;
4778 if (!p)
4779 continue;
4780 *p = '\0';
4781 p++;
4782 if (strcmp(line, uname))
4783 continue;
4784 p2 = strchr(p, ':');
4785 if (!p2)
4786 continue;
4787 *p2 = '\0';
4788 p2++;
4789 if (!*p2)
4790 continue;
b7930180
CB		 4791 no_newline = strcspn(p2, "\n");
4792 p2[no_newline] = '\0';
4793
b7b2fde4
CB		 4794 if (lxc_safe_uint(p, &gid) < 0)
4795 WARN("Could not parse GID.");
4796 if (lxc_safe_uint(p2, &grange) < 0)
4797 WARN("Could not parse GID range.");
97e9cfa0
SH		 4798 }
4799 fclose(f);
4800
f10fad2f 4801 free(line);
97e9cfa0
SH		 4802
4803 if (!urange || !grange) {
4804 ERROR("You do not have subuids or subgids allocated");
4805 ERROR("Unprivileged containers require subuids and subgids");
4806 return;
4807 }
4808
4809 ERROR("You must either run as root, or define uid mappings");
4810 ERROR("To pass uid mappings to lxc-create, you could create");
4811 ERROR("~/.config/lxc/default.conf:");
4812 ERROR("lxc.include = %s", LXC_DEFAULT_CONFIG);
4813 ERROR("lxc.id_map = u 0 %u %u", uid, urange);
4814 ERROR("lxc.id_map = g 0 %u %u", gid, grange);
4815
4816 free(gname);
4817 free(uname);
4818}
aaf26830 4819
a7307747
SH		 4820static void free_cgroup_settings(struct lxc_list *result)
4821{
4822 struct lxc_list *iterator, *next;
4823
4824 lxc_list_for_each_safe(iterator, result, next) {
4825 lxc_list_del(iterator);
4826 free(iterator);
4827 }
4828 free(result);
4829}
4830
aaf26830
KT		 4831/*
4832 * Return the list of cgroup_settings sorted according to the following rules
4833 * 1. Put memory.limit_in_bytes before memory.memsw.limit_in_bytes
4834 */
4835struct lxc_list *sort_cgroup_settings(struct lxc_list* cgroup_settings)
4836{
4837 struct lxc_list *result;
4838 struct lxc_list *memsw_limit = NULL;
4839 struct lxc_list *it = NULL;
4840 struct lxc_cgroup *cg = NULL;
4841 struct lxc_list *item = NULL;
4842
4843 result = malloc(sizeof(*result));
fac7c663
KT		 4844 if (!result) {
4845 ERROR("failed to allocate memory to sort cgroup settings");
4846 return NULL;
4847 }
aaf26830
KT		 4848 lxc_list_init(result);
4849
4850 /*Iterate over the cgroup settings and copy them to the output list*/
4851 lxc_list_for_each(it, cgroup_settings) {
4852 item = malloc(sizeof(*item));
fac7c663
KT		 4853 if (!item) {
4854 ERROR("failed to allocate memory to sort cgroup settings");
a7307747 4855 free_cgroup_settings(result);
fac7c663
KT		 4856 return NULL;
4857 }
aaf26830
KT		 4858 item->elem = it->elem;
4859 cg = it->elem;
4860 if (strcmp(cg->subsystem, "memory.memsw.limit_in_bytes") == 0) {
4861 /* Store the memsw_limit location */
4862 memsw_limit = item;
4863 } else if (strcmp(cg->subsystem, "memory.limit_in_bytes") == 0 && memsw_limit != NULL) {
4d5b72a1 4864 /* lxc.cgroup.memory.memsw.limit_in_bytes is found before
aaf26830
KT		 4865 * lxc.cgroup.memory.limit_in_bytes, swap these two items */
4866 item->elem = memsw_limit->elem;
4867 memsw_limit->elem = it->elem;
4868 }
4869 lxc_list_add_tail(result, item);
4870 }
4871
4872 return result;
a7307747 4873}
LXC mirror