]> git.proxmox.com Git - mirror_lxc.git/blame - src/lxc/conf.c
projects / mirror_lxc.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
conf: cleanup macros setup_mount_entries
[mirror_lxc.git] / src / lxc / conf.c
CommitLineData
0ad19a3f 1/*
2 * lxc: linux Container library
3 *
4 * (C) Copyright IBM Corp. 2007, 2008
5 *
6 * Authors:
9afe19d6 7 * Daniel Lezcano <daniel.lezcano at free.fr>
0ad19a3f 8 *
9 * This library is free software; you can redistribute it and/or
10 * modify it under the terms of the GNU Lesser General Public
11 * License as published by the Free Software Foundation; either
12 * version 2.1 of the License, or (at your option) any later version.
13 *
14 * This library is distributed in the hope that it will be useful,
15 * but WITHOUT ANY WARRANTY; without even the implied warranty of
16 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
17 * Lesser General Public License for more details.
18 *
19 * You should have received a copy of the GNU Lesser General Public
20 * License along with this library; if not, write to the Free Software
250b1eec 21 * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
0ad19a3f 22 */
1d52bdf7 23
d38dd64a
CB		 24#ifndef _GNU_SOURCE
25#define _GNU_SOURCE 1
26#endif
9d257a2a 27#include <arpa/inet.h>
8f3e280e
CB		 28#include <dirent.h>
29#include <errno.h>
30#include <fcntl.h>
31#include <grp.h>
32#include <inttypes.h>
33#include <libgen.h>
9d257a2a
CB		 34#include <linux/loop.h>
35#include <net/if.h>
36#include <netinet/in.h>
8f3e280e
CB		 37#include <pwd.h>
38#include <stdarg.h>
0ad19a3f 39#include <stdio.h>
0ad19a3f 40#include <stdlib.h>
0ad19a3f 41#include <string.h>
8f3e280e
CB		 42#include <sys/mman.h>
43#include <sys/mount.h>
44#include <sys/param.h>
45#include <sys/prctl.h>
6a49f05e 46#include <sys/sendfile.h>
8f3e280e 47#include <sys/socket.h>
9d257a2a 48#include <sys/stat.h>
2d76d1d7 49#include <sys/syscall.h>
9d257a2a 50#include <sys/sysmacros.h>
97e9cfa0 51#include <sys/types.h>
8f3e280e
CB		 52#include <sys/utsname.h>
53#include <sys/wait.h>
9d257a2a
CB		 54#include <time.h>
55#include <unistd.h>
1d52bdf7 56
d38dd64a
CB		 57#include "af_unix.h"
58#include "caps.h"
59#include "cgroup.h"
60#include "conf.h"
61#include "config.h"
62#include "confile.h"
63#include "confile_utils.h"
64#include "error.h"
65#include "log.h"
66#include "lsm/lsm.h"
67#include "lxclock.h"
68#include "lxcseccomp.h"
69#include "macro.h"
2f443e88 70#include "memory_utils.h"
d38dd64a
CB		 71#include "namespace.h"
72#include "network.h"
73#include "parse.h"
13be2733 74#include "raw_syscalls.h"
d38dd64a
CB		 75#include "ringbuf.h"
76#include "start.h"
77#include "storage.h"
78#include "storage/overlay.h"
6b3d24d7 79#include "syscall_wrappers.h"
d38dd64a
CB		 80#include "terminal.h"
81#include "utils.h"
82
af6824fc 83#ifdef MAJOR_IN_MKDEV
9d257a2a 84#include <sys/mkdev.h>
af6824fc 85#endif
af6824fc 86
614305f3 87#ifdef HAVE_STATVFS
2938f7c8 88#include <sys/statvfs.h>
614305f3 89#endif
e827ff7e
SG		 90
91#if HAVE_PTY_H
b0a33c1e 92#include <pty.h>
e827ff7e
SG		 93#else
94#include <../include/openpty.h>
95#endif
0ad19a3f 96
9d257a2a
CB		 97#if HAVE_LIBCAP
98#include <sys/capability.h>
99#endif
100
101#if HAVE_SYS_PERSONALITY_H
102#include <sys/personality.h>
103#endif
104
f1e05b90
DJ		 105#ifndef HAVE_STRLCAT
106#include "include/strlcat.h"
107#endif
108
9d257a2a
CB		 109#if IS_BIONIC
110#include <../include/lxcmntent.h>
111#else
112#include <mntent.h>
113#endif
114
115#if !defined(HAVE_PRLIMIT) && defined(HAVE_PRLIMIT64)
116#include <../include/prlimit.h>
117#endif
118
ac2cecc4 119lxc_log_define(conf, lxc);
e5bda9ee 120
0fd73091
CB		 121/* The lxc_conf of the container currently being worked on in an API call.
122 * This is used in the error calls.
123 */
124#ifdef HAVE_TLS
d7f19646 125thread_local struct lxc_conf *current_config;
0fd73091
CB		 126#else
127struct lxc_conf *current_config;
128#endif
8912711c 129
0fd73091
CB		 130char *lxchook_names[NUM_LXC_HOOKS] = {
131 "pre-start",
132 "pre-mount",
133 "mount",
134 "autodev",
135 "start",
136 "stop",
137 "post-stop",
138 "clone",
139 "destroy",
140 "start-host"
141};
72d0e1cb 142
998ac676
RT		 143struct mount_opt {
144 char *name;
145 int clear;
146 int flag;
147};
148
81810dd1
DL		 149struct caps_opt {
150 char *name;
151 int value;
152};
153
c6d09e15
WB		 154struct limit_opt {
155 char *name;
156 int value;
157};
158
998ac676 159static struct mount_opt mount_opt[] = {
470b359b
CB		 160 { "async", 1, MS_SYNCHRONOUS },
161 { "atime", 1, MS_NOATIME },
162 { "bind", 0, MS_BIND },
88d413d5 163 { "defaults", 0, 0 },
88d413d5 164 { "dev", 1, MS_NODEV },
470b359b 165 { "diratime", 1, MS_NODIRATIME },
88d413d5 166 { "dirsync", 0, MS_DIRSYNC },
470b359b 167 { "exec", 1, MS_NOEXEC },
8912711c 168 { "lazytime", 0, MS_LAZYTIME },
88d413d5 169 { "mand", 0, MS_MANDLOCK },
88d413d5 170 { "noatime", 0, MS_NOATIME },
470b359b 171 { "nodev", 0, MS_NODEV },
88d413d5 172 { "nodiratime", 0, MS_NODIRATIME },
470b359b
CB		 173 { "noexec", 0, MS_NOEXEC },
174 { "nomand", 1, MS_MANDLOCK },
175 { "norelatime", 1, MS_RELATIME },
176 { "nostrictatime", 1, MS_STRICTATIME },
177 { "nosuid", 0, MS_NOSUID },
88d413d5
SW		 178 { "rbind", 0, MS_BIND|MS_REC },
179 { "relatime", 0, MS_RELATIME },
470b359b
CB		 180 { "remount", 0, MS_REMOUNT },
181 { "ro", 0, MS_RDONLY },
182 { "rw", 1, MS_RDONLY },
88d413d5 183 { "strictatime", 0, MS_STRICTATIME },
470b359b
CB		 184 { "suid", 1, MS_NOSUID },
185 { "sync", 0, MS_SYNCHRONOUS },
88d413d5 186 { NULL, 0, 0 },
998ac676
RT		 187};
188
d840039e 189static struct mount_opt propagation_opt[] = {
0fd73091
CB		 190 { "private", 0, MS_PRIVATE },
191 { "shared", 0, MS_SHARED },
192 { "slave", 0, MS_SLAVE },
193 { "unbindable", 0, MS_UNBINDABLE },
194 { "rprivate", 0, MS_PRIVATE|MS_REC },
195 { "rshared", 0, MS_SHARED|MS_REC },
196 { "rslave", 0, MS_SLAVE|MS_REC },
197 { "runbindable", 0, MS_UNBINDABLE|MS_REC },
198 { NULL, 0, 0 },
d840039e
YT		 199};
200
81810dd1 201static struct caps_opt caps_opt[] = {
8560cd36 202#if HAVE_LIBCAP
0fd73091
CB		 203 { "chown", CAP_CHOWN },
204 { "dac_override", CAP_DAC_OVERRIDE },
205 { "dac_read_search", CAP_DAC_READ_SEARCH },
206 { "fowner", CAP_FOWNER },
207 { "fsetid", CAP_FSETID },
208 { "kill", CAP_KILL },
209 { "setgid", CAP_SETGID },
210 { "setuid", CAP_SETUID },
211 { "setpcap", CAP_SETPCAP },
212 { "linux_immutable", CAP_LINUX_IMMUTABLE },
213 { "net_bind_service", CAP_NET_BIND_SERVICE },
214 { "net_broadcast", CAP_NET_BROADCAST },
215 { "net_admin", CAP_NET_ADMIN },
216 { "net_raw", CAP_NET_RAW },
217 { "ipc_lock", CAP_IPC_LOCK },
218 { "ipc_owner", CAP_IPC_OWNER },
219 { "sys_module", CAP_SYS_MODULE },
220 { "sys_rawio", CAP_SYS_RAWIO },
221 { "sys_chroot", CAP_SYS_CHROOT },
222 { "sys_ptrace", CAP_SYS_PTRACE },
223 { "sys_pacct", CAP_SYS_PACCT },
224 { "sys_admin", CAP_SYS_ADMIN },
225 { "sys_boot", CAP_SYS_BOOT },
226 { "sys_nice", CAP_SYS_NICE },
227 { "sys_resource", CAP_SYS_RESOURCE },
228 { "sys_time", CAP_SYS_TIME },
229 { "sys_tty_config", CAP_SYS_TTY_CONFIG },
230 { "mknod", CAP_MKNOD },
231 { "lease", CAP_LEASE },
57b837e2 232#ifdef CAP_AUDIT_READ
0fd73091 233 { "audit_read", CAP_AUDIT_READ },
57b837e2 234#endif
9527e566 235#ifdef CAP_AUDIT_WRITE
0fd73091 236 { "audit_write", CAP_AUDIT_WRITE },
9527e566
FW		 237#endif
238#ifdef CAP_AUDIT_CONTROL
0fd73091 239 { "audit_control", CAP_AUDIT_CONTROL },
9527e566 240#endif
0fd73091
CB		 241 { "setfcap", CAP_SETFCAP },
242 { "mac_override", CAP_MAC_OVERRIDE },
243 { "mac_admin", CAP_MAC_ADMIN },
5170c716 244#ifdef CAP_SYSLOG
0fd73091 245 { "syslog", CAP_SYSLOG },
5170c716
CS		 246#endif
247#ifdef CAP_WAKE_ALARM
0fd73091 248 { "wake_alarm", CAP_WAKE_ALARM },
5170c716 249#endif
2b54359b 250#ifdef CAP_BLOCK_SUSPEND
0fd73091 251 { "block_suspend", CAP_BLOCK_SUSPEND },
2b54359b 252#endif
495d2046 253#endif
8560cd36 254};
81810dd1 255
c6d09e15
WB		 256static struct limit_opt limit_opt[] = {
257#ifdef RLIMIT_AS
258 { "as", RLIMIT_AS },
259#endif
260#ifdef RLIMIT_CORE
261 { "core", RLIMIT_CORE },
262#endif
263#ifdef RLIMIT_CPU
264 { "cpu", RLIMIT_CPU },
265#endif
266#ifdef RLIMIT_DATA
267 { "data", RLIMIT_DATA },
268#endif
269#ifdef RLIMIT_FSIZE
270 { "fsize", RLIMIT_FSIZE },
271#endif
272#ifdef RLIMIT_LOCKS
273 { "locks", RLIMIT_LOCKS },
274#endif
275#ifdef RLIMIT_MEMLOCK
276 { "memlock", RLIMIT_MEMLOCK },
277#endif
278#ifdef RLIMIT_MSGQUEUE
279 { "msgqueue", RLIMIT_MSGQUEUE },
280#endif
281#ifdef RLIMIT_NICE
282 { "nice", RLIMIT_NICE },
283#endif
284#ifdef RLIMIT_NOFILE
285 { "nofile", RLIMIT_NOFILE },
286#endif
287#ifdef RLIMIT_NPROC
288 { "nproc", RLIMIT_NPROC },
289#endif
290#ifdef RLIMIT_RSS
291 { "rss", RLIMIT_RSS },
292#endif
293#ifdef RLIMIT_RTPRIO
294 { "rtprio", RLIMIT_RTPRIO },
295#endif
296#ifdef RLIMIT_RTTIME
297 { "rttime", RLIMIT_RTTIME },
298#endif
299#ifdef RLIMIT_SIGPENDING
300 { "sigpending", RLIMIT_SIGPENDING },
301#endif
302#ifdef RLIMIT_STACK
303 { "stack", RLIMIT_STACK },
304#endif
305};
306
91c3830e
SH		 307static int run_buffer(char *buffer)
308{
cc6a0e78 309 __do_free char *output = NULL;
8e7da691 310 int ret;
0fd73091 311 struct lxc_popen_FILE *f;
91c3830e 312
ebec9176 313 f = lxc_popen(buffer);
91c3830e 314 if (!f) {
3f60c2f7 315 SYSERROR("Failed to popen() %s", buffer);
91c3830e
SH		 316 return -1;
317 }
318
319 output = malloc(LXC_LOG_BUFFER_SIZE);
320 if (!output) {
3f60c2f7 321 ERROR("Failed to allocate memory for %s", buffer);
ebec9176 322 lxc_pclose(f);
91c3830e
SH		 323 return -1;
324 }
325
062b72c6 326 while (fgets(output, LXC_LOG_BUFFER_SIZE, f->f))
3f60c2f7 327 DEBUG("Script %s with output: %s", buffer, output);
91c3830e 328
ebec9176 329 ret = lxc_pclose(f);
8e7da691 330 if (ret == -1) {
3f60c2f7 331 SYSERROR("Script exited with error");
91c3830e 332 return -1;
8e7da691 333 } else if (WIFEXITED(ret) && WEXITSTATUS(ret) != 0) {
3f60c2f7 334 ERROR("Script exited with status %d", WEXITSTATUS(ret));
8e7da691
DE		 335 return -1;
336 } else if (WIFSIGNALED(ret)) {
3f60c2f7 337 ERROR("Script terminated by signal %d", WTERMSIG(ret));
8e7da691 338 return -1;
91c3830e
SH		 339 }
340
341 return 0;
342}
343
14a7b0f9
CB		 344int run_script_argv(const char *name, unsigned int hook_version,
345 const char *section, const char *script,
586b1ce7 346 const char *hookname, char **argv)
148e91f5 347{
e1a94937 348 __do_free char *buffer = NULL;
3f60c2f7 349 int buf_pos, i, ret;
d08e5708 350 size_t size = 0;
148e91f5 351
3f60c2f7
CB		 352 if (hook_version == 0)
353 INFO("Executing script \"%s\" for container \"%s\", config "
354 "section \"%s\"", script, name, section);
355 else
356 INFO("Executing script \"%s\" for container \"%s\"", script, name);
148e91f5 357
586b1ce7
CB		 358 for (i = 0; argv && argv[i]; i++)
359 size += strlen(argv[i]) + 1;
148e91f5 360
6333c915
CB		 361 size += STRLITERALLEN("exec");
362 size++;
148e91f5 363 size += strlen(script);
3f60c2f7
CB		 364 size++;
365
148e91f5 366 if (size > INT_MAX)
3f60c2f7 367 return -EFBIG;
148e91f5 368
3f60c2f7 369 if (hook_version == 0) {
d08e5708
CB		 370 size += strlen(hookname);
371 size++;
372
373 size += strlen(name);
374 size++;
375
376 size += strlen(section);
377 size++;
378
379 if (size > INT_MAX)
380 return -EFBIG;
327cce76 381 }
3f60c2f7 382
6f8d00d2
CB		 383 buffer = malloc(size);
384 if (!buffer)
385 return -ENOMEM;
386
327cce76 387 if (hook_version == 0)
3f60c2f7 388 buf_pos = snprintf(buffer, size, "exec %s %s %s %s", script, name, section, hookname);
327cce76 389 else
3f60c2f7 390 buf_pos = snprintf(buffer, size, "exec %s", script);
327cce76
CB		 391 if (buf_pos < 0 || (size_t)buf_pos >= size) {
392 ERROR("Failed to create command line for script \"%s\"", script);
e1a94937 393 return -1;
327cce76 394 }
3f60c2f7 395
327cce76 396 if (hook_version == 1) {
3f60c2f7
CB		 397 ret = setenv("LXC_HOOK_TYPE", hookname, 1);
398 if (ret < 0) {
399 SYSERROR("Failed to set environment variable: "
400 "LXC_HOOK_TYPE=%s", hookname);
e1a94937 401 return -1;
3f60c2f7 402 }
90f20466 403 TRACE("Set environment variable: LXC_HOOK_TYPE=%s", hookname);
3f60c2f7
CB		 404
405 ret = setenv("LXC_HOOK_SECTION", section, 1);
406 if (ret < 0) {
407 SYSERROR("Failed to set environment variable: "
408 "LXC_HOOK_SECTION=%s", section);
e1a94937 409 return -1;
3f60c2f7
CB		 410 }
411 TRACE("Set environment variable: LXC_HOOK_SECTION=%s", section);
14a7b0f9
CB		 412
413 if (strcmp(section, "net") == 0) {
414 char *parent;
415
586b1ce7 416 if (!argv || !argv[0])
e1a94937 417 return -1;
14a7b0f9 418
586b1ce7 419 ret = setenv("LXC_NET_TYPE", argv[0], 1);
14a7b0f9
CB		 420 if (ret < 0) {
421 SYSERROR("Failed to set environment variable: "
586b1ce7 422 "LXC_NET_TYPE=%s", argv[0]);
e1a94937 423 return -1;
14a7b0f9 424 }
586b1ce7 425 TRACE("Set environment variable: LXC_NET_TYPE=%s", argv[0]);
14a7b0f9 426
586b1ce7 427 parent = argv[1] ? argv[1] : "";
14a7b0f9 428
a8144263 429 if (strcmp(argv[0], "macvlan") == 0) {
14a7b0f9
CB		 430 ret = setenv("LXC_NET_PARENT", parent, 1);
431 if (ret < 0) {
432 SYSERROR("Failed to set environment "
433 "variable: LXC_NET_PARENT=%s", parent);
e1a94937 434 return -1;
14a7b0f9
CB		 435 }
436 TRACE("Set environment variable: LXC_NET_PARENT=%s", parent);
a8144263 437 } else if (strcmp(argv[0], "phys") == 0) {
14a7b0f9
CB		 438 ret = setenv("LXC_NET_PARENT", parent, 1);
439 if (ret < 0) {
440 SYSERROR("Failed to set environment "
441 "variable: LXC_NET_PARENT=%s", parent);
e1a94937 442 return -1;
14a7b0f9
CB		 443 }
444 TRACE("Set environment variable: LXC_NET_PARENT=%s", parent);
a8144263 445 } else if (strcmp(argv[0], "veth") == 0) {
586b1ce7 446 char *peer = argv[2] ? argv[2] : "";
14a7b0f9
CB		 447
448 ret = setenv("LXC_NET_PEER", peer, 1);
449 if (ret < 0) {
450 SYSERROR("Failed to set environment "
451 "variable: LXC_NET_PEER=%s", peer);
e1a94937 452 return -1;
14a7b0f9
CB		 453 }
454 TRACE("Set environment variable: LXC_NET_PEER=%s", peer);
455
456 ret = setenv("LXC_NET_PARENT", parent, 1);
457 if (ret < 0) {
458 SYSERROR("Failed to set environment "
459 "variable: LXC_NET_PARENT=%s", parent);
e1a94937 460 return -1;
14a7b0f9
CB		 461 }
462 TRACE("Set environment variable: LXC_NET_PARENT=%s", parent);
463 }
464 }
148e91f5
SH		 465 }
466
586b1ce7 467 for (i = 0; argv && argv[i]; i++) {
3f60c2f7
CB		 468 size_t len = size - buf_pos;
469
586b1ce7 470 ret = snprintf(buffer + buf_pos, len, " %s", argv[i]);
3f60c2f7
CB		 471 if (ret < 0 || (size_t)ret >= len) {
472 ERROR("Failed to create command line for script \"%s\"", script);
e1a94937 473 return -1;
148e91f5 474 }
3f60c2f7 475 buf_pos += ret;
148e91f5
SH		 476 }
477
e1a94937 478 return run_buffer(buffer);
148e91f5
SH		 479}
480
811ef482 481int run_script(const char *name, const char *section, const char *script, ...)
e3b4c4c4 482{
2f443e88 483 __do_free char *buffer = NULL;
abbfd20b 484 int ret;
2f443e88 485 char *p;
abbfd20b 486 va_list ap;
0fd73091 487 size_t size = 0;
751d9dcd 488
0fd73091 489 INFO("Executing script \"%s\" for container \"%s\", config section \"%s\"",
751d9dcd 490 script, name, section);
e3b4c4c4 491
abbfd20b
DL		 492 va_start(ap, script);
493 while ((p = va_arg(ap, char *)))
95642a10 494 size += strlen(p) + 1;
abbfd20b
DL		 495 va_end(ap);
496
6333c915 497 size += STRLITERALLEN("exec");
abbfd20b
DL		 498 size += strlen(script);
499 size += strlen(name);
500 size += strlen(section);
6d1a5f93 501 size += 4;
abbfd20b 502
95642a10
MS		 503 if (size > INT_MAX)
504 return -1;
505
2f443e88 506 buffer = must_realloc(NULL, size);
6d1a5f93 507 ret = snprintf(buffer, size, "exec %s %s %s", script, name, section);
0fd73091 508 if (ret < 0 || ret >= size)
9ba8130c 509 return -1;
751d9dcd 510
abbfd20b 511 va_start(ap, script);
9ba8130c 512 while ((p = va_arg(ap, char *))) {
062b72c6 513 int len = size - ret;
9ba8130c
SH		 514 int rc;
515 rc = snprintf(buffer + ret, len, " %s", p);
7b5a2435
DJ		 516 if (rc < 0 || rc >= len) {
517 va_end(ap);
9ba8130c 518 return -1;
7b5a2435 519 }
9ba8130c
SH		 520 ret += rc;
521 }
abbfd20b 522 va_end(ap);
751d9dcd 523
91c3830e 524 return run_buffer(buffer);
e3b4c4c4
ST		 525}
526
0fd73091 527/* pin_rootfs
63fc76c3 528 * if rootfs is a directory, then open ${rootfs}/.lxc-keep for writing for
b7ed4bf0
CS		 529 * the duration of the container run, to prevent the container from marking
530 * the underlying fs readonly on shutdown. unlink the file immediately so
63fc76c3
GJ		 531 * no name pollution is happens.
532 * don't unlink on NFS to avoid random named stale handles.
0c547523
SH		 533 * return -1 on error.
534 * return -2 if nothing needed to be pinned.
535 * return an open fd (>=0) if we pinned it.
536 */
537int pin_rootfs(const char *rootfs)
538{
957c4704 539 __do_free char *absrootfs = NULL;
0fd73091 540 int fd, ret;
6b5a54cd 541 char absrootfspin[PATH_MAX];
0c547523 542 struct stat s;
63fc76c3 543 struct statfs sfs;
0c547523 544
e99ee0de 545 if (rootfs == NULL || strlen(rootfs) == 0)
0d03360a 546 return -2;
e99ee0de 547
74e7b662 548 absrootfs = realpath(rootfs, NULL);
549 if (!absrootfs)
9be53773 550 return -2;
0c547523 551
0fd73091 552 ret = stat(absrootfs, &s);
957c4704 553 if (ret < 0)
0c547523 554 return -1;
0c547523 555
957c4704 556 if (!S_ISDIR(s.st_mode))
0c547523
SH		 557 return -2;
558
6b5a54cd 559 ret = snprintf(absrootfspin, PATH_MAX, "%s/.lxc-keep", absrootfs);
6b5a54cd 560 if (ret < 0 || ret >= PATH_MAX)
0c547523 561 return -1;
0c547523 562
0fd73091 563 fd = open(absrootfspin, O_CREAT | O_RDWR, S_IWUSR | S_IRUSR);
b7ed4bf0
CS		 564 if (fd < 0)
565 return fd;
0fd73091 566
205fc010
CB		 567 ret = fstatfs (fd, &sfs);
568 if (ret < 0)
569 return fd;
63fc76c3
GJ		 570
571 if (sfs.f_type == NFS_SUPER_MAGIC) {
205fc010 572 DEBUG("Rootfs on NFS, not unlinking pin file \"%s\"", absrootfspin);
63fc76c3
GJ		 573 return fd;
574 }
575
b7ed4bf0 576 (void)unlink(absrootfspin);
0fd73091 577
0c547523
SH		 578 return fd;
579}
580
0fd73091
CB		 581/* If we are asking to remount something, make sure that any NOEXEC etc are
582 * honored.
e2a7e8dc 583 */
5ae72b98 584unsigned long add_required_remount_flags(const char *s, const char *d,
5285689c 585 unsigned long flags)
e2a7e8dc 586{
614305f3 587#ifdef HAVE_STATVFS
0fd73091 588 int ret;
e2a7e8dc
SH		 589 struct statvfs sb;
590 unsigned long required_flags = 0;
591
e2a7e8dc
SH		 592 if (!s)
593 s = d;
594
595 if (!s)
596 return flags;
0fd73091
CB		 597
598 ret = statvfs(s, &sb);
599 if (ret < 0)
e2a7e8dc
SH		 600 return flags;
601
69eadddb
CB		 602 if (flags & MS_REMOUNT) {
603 if (sb.f_flag & MS_NOSUID)
604 required_flags |= MS_NOSUID;
605 if (sb.f_flag & MS_NODEV)
606 required_flags |= MS_NODEV;
607 if (sb.f_flag & MS_RDONLY)
608 required_flags |= MS_RDONLY;
609 if (sb.f_flag & MS_NOEXEC)
610 required_flags |= MS_NOEXEC;
611 }
612
613 if (sb.f_flag & MS_NOATIME)
614 required_flags |= MS_NOATIME;
615 if (sb.f_flag & MS_NODIRATIME)
616 required_flags |= MS_NODIRATIME;
617 if (sb.f_flag & MS_LAZYTIME)
618 required_flags |= MS_LAZYTIME;
619 if (sb.f_flag & MS_RELATIME)
620 required_flags |= MS_RELATIME;
621 if (sb.f_flag & MS_STRICTATIME)
622 required_flags |= MS_STRICTATIME;
e2a7e8dc
SH		 623
624 return flags | required_flags;
614305f3
SH		 625#else
626 return flags;
627#endif
e2a7e8dc
SH		 628}
629
6b741397
CB		 630static int add_shmount_to_list(struct lxc_conf *conf)
631{
6b5a54cd 632 char new_mount[PATH_MAX];
0d190408 633 /* Offset for the leading '/' since the path_cont
6b741397
CB		 634 * is absolute inside the container.
635 */
636 int offset = 1, ret = -1;
0d190408 637
6b741397
CB		 638 ret = snprintf(new_mount, sizeof(new_mount),
639 "%s %s none bind,create=dir 0 0", conf->shmount.path_host,
640 conf->shmount.path_cont + offset);
60534030 641 if (ret < 0 || (size_t)ret >= sizeof(new_mount))
0d190408
LT		 642 return -1;
643
6b741397 644 return add_elem_to_mount_list(new_mount, conf);
0d190408
LT		 645}
646
4fb3cba5 647static int lxc_mount_auto_mounts(struct lxc_conf *conf, int flags, struct lxc_handler *handler)
368bbc02 648{
0fd73091 649 int i, r;
b06b8511
CS		 650 static struct {
651 int match_mask;
652 int match_flag;
653 const char *source;
654 const char *destination;
655 const char *fstype;
656 unsigned long flags;
657 const char *options;
658 } default_mounts[] = {
0fd73091
CB		 659 /* Read-only bind-mounting... In older kernels, doing that
660 * required to do one MS_BIND mount and then
661 * MS_REMOUNT|MS_RDONLY the same one. According to mount(2)
662 * manpage, MS_BIND honors MS_RDONLY from kernel 2.6.26
663 * onwards. However, this apparently does not work on kernel
664 * 3.8. Unfortunately, on that very same kernel, doing the same
665 * trick as above doesn't seem to work either, there one needs
666 * to ALSO specify MS_BIND for the remount, otherwise the
667 * entire fs is remounted read-only or the mount fails because
668 * it's busy... MS_REMOUNT|MS_BIND|MS_RDONLY seems to work for
669 * kernels as low as 2.6.32...
368bbc02 670 */
0fd73091 671 { LXC_AUTO_PROC_MASK, LXC_AUTO_PROC_MIXED, "proc", "%r/proc", "proc", MS_NODEV|MS_NOEXEC|MS_NOSUID, NULL },
592fd47a 672 /* proc/tty is used as a temporary placeholder for proc/sys/net which we'll move back in a few steps */
0fd73091
CB		 673 { LXC_AUTO_PROC_MASK, LXC_AUTO_PROC_MIXED, "%r/proc/sys/net", "%r/proc/tty", NULL, MS_BIND, NULL },
674 { LXC_AUTO_PROC_MASK, LXC_AUTO_PROC_MIXED, "%r/proc/sys", "%r/proc/sys", NULL, MS_BIND, NULL },
675 { LXC_AUTO_PROC_MASK, LXC_AUTO_PROC_MIXED, NULL, "%r/proc/sys", NULL, MS_REMOUNT|MS_BIND|MS_RDONLY, NULL },
676 { LXC_AUTO_PROC_MASK, LXC_AUTO_PROC_MIXED, "%r/proc/tty", "%r/proc/sys/net", NULL, MS_MOVE, NULL },
677 { LXC_AUTO_PROC_MASK, LXC_AUTO_PROC_MIXED, "%r/proc/sysrq-trigger", "%r/proc/sysrq-trigger", NULL, MS_BIND, NULL },
678 { LXC_AUTO_PROC_MASK, LXC_AUTO_PROC_MIXED, NULL, "%r/proc/sysrq-trigger", NULL, MS_REMOUNT|MS_BIND|MS_RDONLY, NULL },
679 { LXC_AUTO_PROC_MASK, LXC_AUTO_PROC_RW, "proc", "%r/proc", "proc", MS_NODEV|MS_NOEXEC|MS_NOSUID, NULL },
680 { LXC_AUTO_SYS_MASK, LXC_AUTO_SYS_RW, "sysfs", "%r/sys", "sysfs", 0, NULL },
681 { LXC_AUTO_SYS_MASK, LXC_AUTO_SYS_RO, "sysfs", "%r/sys", "sysfs", MS_RDONLY, NULL },
682 { LXC_AUTO_SYS_MASK, LXC_AUTO_SYS_MIXED, "sysfs", "%r/sys", "sysfs", MS_NODEV|MS_NOEXEC|MS_NOSUID, NULL },
d1c203f4 683 { LXC_AUTO_SYS_MASK, LXC_AUTO_SYS_MIXED, "%r/sys", "%r/sys", NULL, MS_BIND, NULL },
0fd73091
CB		 684 { LXC_AUTO_SYS_MASK, LXC_AUTO_SYS_MIXED, NULL, "%r/sys", NULL, MS_REMOUNT|MS_BIND|MS_RDONLY, NULL },
685 { LXC_AUTO_SYS_MASK, LXC_AUTO_SYS_MIXED, "sysfs", "%r/sys/devices/virtual/net", "sysfs", 0, NULL },
686 { LXC_AUTO_SYS_MASK, LXC_AUTO_SYS_MIXED, "%r/sys/devices/virtual/net/devices/virtual/net", "%r/sys/devices/virtual/net", NULL, MS_BIND, NULL },
687 { LXC_AUTO_SYS_MASK, LXC_AUTO_SYS_MIXED, NULL, "%r/sys/devices/virtual/net", NULL, MS_REMOUNT|MS_BIND|MS_NOSUID|MS_NODEV|MS_NOEXEC, NULL },
688 { 0, 0, NULL, NULL, NULL, 0, NULL }
b06b8511 689 };
368bbc02 690
b06b8511 691 for (i = 0; default_mounts[i].match_mask; i++) {
8db92302 692 __do_free char *destination = NULL, *source = NULL;
0fd73091
CB		 693 int saved_errno;
694 unsigned long mflags;
0fd73091
CB		 695 if ((flags & default_mounts[i].match_mask) != default_mounts[i].match_flag)
696 continue;
697
698 if (default_mounts[i].source) {
cc4fd506 699 /* will act like strdup if %r is not present */
0fd73091
CB		 700 source = lxc_string_replace("%r", conf->rootfs.path ? conf->rootfs.mount : "", default_mounts[i].source);
701 if (!source)
cc4fd506 702 return -1;
0fd73091 703 }
f24a52d5 704
0fd73091
CB		 705 if (!default_mounts[i].destination) {
706 ERROR("BUG: auto mounts destination %d was NULL", i);
0fd73091
CB		 707 return -1;
708 }
709
710 /* will act like strdup if %r is not present */
711 destination = lxc_string_replace("%r", conf->rootfs.path ? conf->rootfs.mount : "", default_mounts[i].destination);
712 if (!destination) {
0fd73091
CB		 713 return -1;
714 }
715
716 mflags = add_required_remount_flags(source, destination,
717 default_mounts[i].flags);
718 r = safe_mount(source, destination, default_mounts[i].fstype,
719 mflags, default_mounts[i].options,
720 conf->rootfs.path ? conf->rootfs.mount : NULL);
721 saved_errno = errno;
722 if (r < 0 && errno == ENOENT) {
723 INFO("Mount source or target for \"%s\" on \"%s\" does "
724 "not exist. Skipping", source, destination);
725 r = 0;
726 } else if (r < 0) {
727 SYSERROR("Failed to mount \"%s\" on \"%s\" with flags %lu", source, destination, mflags);
728 }
729
0fd73091
CB		 730 if (r < 0) {
731 errno = saved_errno;
732 return -1;
368bbc02 733 }
368bbc02
CS		 734 }
735
b06b8511 736 if (flags & LXC_AUTO_CGROUP_MASK) {
0769b82a
CS		 737 int cg_flags;
738
3f69fb12 739 cg_flags = flags & (LXC_AUTO_CGROUP_MASK & ~LXC_AUTO_CGROUP_FORCE);
0fd73091
CB		 740 /* If the type of cgroup mount was not specified, it depends on
741 * the container's capabilities as to what makes sense: if we
742 * have CAP_SYS_ADMIN, the read-only part can be remounted
743 * read-write anyway, so we may as well default to read-write;
744 * then the admin will not be given a false sense of security.
745 * (And if they really want mixed r/o r/w, then they can
746 * explicitly specify :mixed.) OTOH, if the container lacks
747 * CAP_SYS_ADMIN, do only default to :mixed, because then the
748 * container can't remount it read-write.
749 */
0769b82a
CS		 750 if (cg_flags == LXC_AUTO_CGROUP_NOSPEC || cg_flags == LXC_AUTO_CGROUP_FULL_NOSPEC) {
751 int has_sys_admin = 0;
b0ee5983
CB		 752
753 if (!lxc_list_empty(&conf->keepcaps))
0769b82a 754 has_sys_admin = in_caplist(CAP_SYS_ADMIN, &conf->keepcaps);
b0ee5983 755 else
0769b82a 756 has_sys_admin = !in_caplist(CAP_SYS_ADMIN, &conf->caps);
b0ee5983
CB		 757
758 if (cg_flags == LXC_AUTO_CGROUP_NOSPEC)
0769b82a 759 cg_flags = has_sys_admin ? LXC_AUTO_CGROUP_RW : LXC_AUTO_CGROUP_MIXED;
b0ee5983 760 else
0769b82a 761 cg_flags = has_sys_admin ? LXC_AUTO_CGROUP_FULL_RW : LXC_AUTO_CGROUP_FULL_MIXED;
0769b82a 762 }
0fd73091 763
3f69fb12 764 if (flags & LXC_AUTO_CGROUP_FORCE)
0fd73091
CB		 765 cg_flags |= LXC_AUTO_CGROUP_FORCE;
766
2202afc9
CB		 767 if (!handler->cgroup_ops->mount(handler->cgroup_ops,
768 handler,
769 conf->rootfs.path ? conf->rootfs.mount : "",
770 cg_flags)) {
0fd73091 771 SYSERROR("Failed to mount \"/sys/fs/cgroup\"");
b06b8511 772 return -1;
368bbc02
CS		 773 }
774 }
775
0d190408
LT		 776 if (flags & LXC_AUTO_SHMOUNTS_MASK) {
777 int ret = add_shmount_to_list(conf);
778 if (ret < 0) {
779 ERROR("Failed to add shmount entry to container config");
6b741397 780 return -1;
0d190408
LT		 781 }
782 }
783
368bbc02 784 return 0;
368bbc02
CS		 785}
786
4e5440c6 787static int setup_utsname(struct utsname *utsname)
0ad19a3f 788{
0fd73091
CB		 789 int ret;
790
4e5440c6
DL		 791 if (!utsname)
792 return 0;
0ad19a3f 793
0fd73091
CB		 794 ret = sethostname(utsname->nodename, strlen(utsname->nodename));
795 if (ret < 0) {
796 SYSERROR("Failed to set the hostname to \"%s\"", utsname->nodename);
0ad19a3f 797 return -1;
798 }
799
0fd73091 800 INFO("Set hostname to \"%s\"", utsname->nodename);
cd54d859 801
0ad19a3f 802 return 0;
803}
804
69aa6655
DE		 805struct dev_symlinks {
806 const char *oldpath;
807 const char *name;
808};
809
810static const struct dev_symlinks dev_symlinks[] = {
0fd73091
CB		 811 { "/proc/self/fd", "fd" },
812 { "/proc/self/fd/0", "stdin" },
813 { "/proc/self/fd/1", "stdout" },
814 { "/proc/self/fd/2", "stderr" },
69aa6655
DE		 815};
816
ed8704d0 817static int lxc_setup_dev_symlinks(const struct lxc_rootfs *rootfs)
69aa6655 818{
0fd73091 819 int i, ret;
6b5a54cd 820 char path[PATH_MAX];
09227be2 821 struct stat s;
69aa6655 822
69aa6655
DE		 823 for (i = 0; i < sizeof(dev_symlinks) / sizeof(dev_symlinks[0]); i++) {
824 const struct dev_symlinks *d = &dev_symlinks[i];
0fd73091
CB		 825
826 ret = snprintf(path, sizeof(path), "%s/dev/%s",
827 rootfs->path ? rootfs->mount : "", d->name);
6b5a54cd 828 if (ret < 0 || ret >= PATH_MAX)
69aa6655 829 return -1;
09227be2 830
0fd73091
CB		 831 /* Stat the path first. If we don't get an error accept it as
832 * is and don't try to create it
09227be2 833 */
0fd73091
CB		 834 ret = stat(path, &s);
835 if (ret == 0)
09227be2 836 continue;
09227be2 837
69aa6655
DE		 838 ret = symlink(d->oldpath, path);
839 if (ret && errno != EEXIST) {
0fd73091
CB		 840 if (errno == EROFS) {
841 WARN("Failed to create \"%s\". Read-only filesystem", path);
09227be2 842 } else {
0fd73091 843 SYSERROR("Failed to create \"%s\"", path);
09227be2
MW		 844 return -1;
845 }
69aa6655
DE		 846 }
847 }
0fd73091 848
69aa6655
DE		 849 return 0;
850}
851
2187efd3 852/* Build a space-separate list of ptys to pass to systemd. */
885766f5 853static bool append_ttyname(char **pp, char *name)
b0a33c1e 854{
393903d1 855 char *p;
f1e05b90 856 size_t size;
393903d1
SH		 857
858 if (!*pp) {
859 *pp = malloc(strlen(name) + strlen("container_ttys=") + 1);
860 if (!*pp)
861 return false;
0fd73091 862
393903d1
SH		 863 sprintf(*pp, "container_ttys=%s", name);
864 return true;
865 }
0fd73091 866
f1e05b90
DJ		 867 size = strlen(*pp) + strlen(name) + 2;
868 p = realloc(*pp, size);
393903d1
SH		 869 if (!p)
870 return false;
0fd73091 871
393903d1 872 *pp = p;
f1e05b90
DJ		 873 (void)strlcat(p, " ", size);
874 (void)strlcat(p, name, size);
0fd73091 875
393903d1
SH		 876 return true;
877}
878
2187efd3 879static int lxc_setup_ttys(struct lxc_conf *conf)
393903d1 880{
9e1045e3 881 int i, ret;
0e4be3cf 882 const struct lxc_tty_info *ttys = &conf->ttys;
885766f5 883 char *ttydir = ttys->dir;
6b5a54cd 884 char path[PATH_MAX], lxcpath[PATH_MAX];
b0a33c1e 885
e8bd4e43 886 if (!conf->rootfs.path)
bc9bd0e3
DL		 887 return 0;
888
885766f5 889 for (i = 0; i < ttys->max; i++) {
0e4be3cf 890 struct lxc_terminal_info *tty = &ttys->tty[i];
b0a33c1e 891
e8bd4e43 892 ret = snprintf(path, sizeof(path), "/dev/tty%d", i + 1);
73363c61 893 if (ret < 0 || (size_t)ret >= sizeof(path))
7c6ef2a2 894 return -1;
9e1045e3 895
7c6ef2a2
SH		 896 if (ttydir) {
897 /* create dev/lxc/tty%d" */
9e1045e3
CB		 898 ret = snprintf(lxcpath, sizeof(lxcpath),
899 "/dev/%s/tty%d", ttydir, i + 1);
73363c61 900 if (ret < 0 || (size_t)ret >= sizeof(lxcpath))
7c6ef2a2 901 return -1;
9e1045e3 902
adc1c715 903 ret = mknod(lxcpath, S_IFREG | 0000, 0);
9e1045e3 904 if (ret < 0 && errno != EEXIST) {
73363c61 905 SYSERROR("Failed to create \"%s\"", lxcpath);
7c6ef2a2
SH		 906 return -1;
907 }
9e1045e3 908
7c6ef2a2 909 ret = unlink(path);
9e1045e3 910 if (ret < 0 && errno != ENOENT) {
73363c61 911 SYSERROR("Failed to unlink \"%s\"", path);
7c6ef2a2
SH		 912 return -1;
913 }
b0a33c1e 914
2520facd 915 ret = mount(tty->name, lxcpath, "none", MS_BIND, 0);
9e1045e3 916 if (ret < 0) {
adc1c715
WB		 917 SYSWARN("Failed to bind mount \"%s\" onto \"%s\"",
918 tty->name, lxcpath);
7c6ef2a2
SH		 919 continue;
920 }
0fd73091 921 DEBUG("Bind mounted \"%s\" onto \"%s\"", tty->name,
adc1c715 922 lxcpath);
13954cce 923
9e1045e3
CB		 924 ret = snprintf(lxcpath, sizeof(lxcpath), "%s/tty%d",
925 ttydir, i + 1);
73363c61 926 if (ret < 0 || (size_t)ret >= sizeof(lxcpath))
9ba8130c 927 return -1;
9e1045e3 928
7c6ef2a2 929 ret = symlink(lxcpath, path);
9e1045e3 930 if (ret < 0) {
73363c61 931 SYSERROR("Failed to create symlink \"%s\" -> \"%s\"",
9e1045e3 932 path, lxcpath);
7c6ef2a2
SH		 933 return -1;
934 }
935 } else {
9e1045e3
CB		 936 /* If we populated /dev, then we need to create
937 * /dev/ttyN
938 */
d3ccc04e
CB		 939 ret = mknod(path, S_IFREG | 0000, 0);
940 if (ret < 0) /* this isn't fatal, continue */
6d1400b5 941 SYSERROR("Failed to create \"%s\"", path);
9e1045e3 942
2520facd 943 ret = mount(tty->name, path, "none", MS_BIND, 0);
9e1045e3 944 if (ret < 0) {
2520facd 945 SYSERROR("Failed to mount '%s'->'%s'", tty->name, path);
7c6ef2a2
SH		 946 continue;
947 }
9e1045e3 948
d3ccc04e 949 DEBUG("Bind mounted \"%s\" onto \"%s\"", tty->name, path);
393903d1 950 }
9e1045e3 951
885766f5 952 if (!append_ttyname(&conf->ttys.tty_names, tty->name)) {
393903d1
SH		 953 ERROR("Error setting up container_ttys string");
954 return -1;
b0a33c1e 955 }
956 }
957
885766f5 958 INFO("Finished setting up %zu /dev/tty<N> device(s)", ttys->max);
b0a33c1e 959 return 0;
960}
961
663014ee 962int lxc_allocate_ttys(struct lxc_conf *conf)
2187efd3 963{
fca23691 964 size_t i;
965 int ret;
0fd73091 966 struct lxc_tty_info *ttys = &conf->ttys;
2187efd3
CB		 967
968 /* no tty in the configuration */
885766f5 969 if (ttys->max == 0)
2187efd3
CB		 970 return 0;
971
885766f5 972 ttys->tty = malloc(sizeof(*ttys->tty) * ttys->max);
0e4be3cf 973 if (!ttys->tty)
2187efd3 974 return -ENOMEM;
2187efd3 975
885766f5 976 for (i = 0; i < ttys->max; i++) {
0e4be3cf 977 struct lxc_terminal_info *tty = &ttys->tty[i];
2187efd3 978
386e6768
CB		 979 tty->master = -EBADF;
980 tty->slave = -EBADF;
77a39805
CB		 981 ret = openpty(&tty->master, &tty->slave, NULL, NULL, NULL);
982 if (ret < 0) {
fca23691 983 SYSERROR("Failed to create tty %zu", i);
885766f5 984 ttys->max = i;
0e4be3cf 985 lxc_delete_tty(ttys);
2187efd3
CB		 986 return -ENOTTY;
987 }
988
77a39805
CB		 989 ret = ttyname_r(tty->slave, tty->name, sizeof(tty->name));
990 if (ret < 0) {
fca23691 991 SYSERROR("Failed to retrieve name of tty %zu slave", i);
77a39805
CB		 992 ttys->max = i;
993 lxc_delete_tty(ttys);
994 return -ENOTTY;
995 }
996
0fd73091 997 DEBUG("Created tty \"%s\" with master fd %d and slave fd %d",
2520facd 998 tty->name, tty->master, tty->slave);
2187efd3
CB		 999
1000 /* Prevent leaking the file descriptors to the container */
615f24ff 1001 ret = fd_cloexec(tty->master, true);
2187efd3 1002 if (ret < 0)
a24c5678 1003 SYSWARN("Failed to set FD_CLOEXEC flag on master fd %d of "
1004 "tty device \"%s\"", tty->master, tty->name);
2187efd3 1005
615f24ff 1006 ret = fd_cloexec(tty->slave, true);
2187efd3 1007 if (ret < 0)
a24c5678 1008 SYSWARN("Failed to set FD_CLOEXEC flag on slave fd %d of "
1009 "tty device \"%s\"", tty->slave, tty->name);
2187efd3 1010
2520facd 1011 tty->busy = 0;
2187efd3
CB		 1012 }
1013
885766f5 1014 INFO("Finished creating %zu tty devices", ttys->max);
2187efd3
CB		 1015 return 0;
1016}
1017
0e4be3cf 1018void lxc_delete_tty(struct lxc_tty_info *ttys)
2187efd3
CB		 1019{
1020 int i;
1021
386e6768
CB		 1022 if (!ttys->tty)
1023 return;
1024
885766f5 1025 for (i = 0; i < ttys->max; i++) {
0e4be3cf 1026 struct lxc_terminal_info *tty = &ttys->tty[i];
2187efd3 1027
386e6768
CB		 1028 if (tty->master >= 0) {
1029 close(tty->master);
1030 tty->master = -EBADF;
1031 }
1032
1033 if (tty->slave >= 0) {
1034 close(tty->slave);
1035 tty->slave = -EBADF;
1036 }
2187efd3
CB		 1037 }
1038
0e4be3cf
CB		 1039 free(ttys->tty);
1040 ttys->tty = NULL;
2187efd3
CB		 1041}
1042
1043static int lxc_send_ttys_to_parent(struct lxc_handler *handler)
1044{
1045 int i;
0fd73091 1046 int ret = -1;
2187efd3 1047 struct lxc_conf *conf = handler->conf;
0e4be3cf 1048 struct lxc_tty_info *ttys = &conf->ttys;
2187efd3 1049 int sock = handler->data_sock[0];
2187efd3 1050
885766f5 1051 if (ttys->max == 0)
2187efd3
CB		 1052 return 0;
1053
885766f5 1054 for (i = 0; i < ttys->max; i++) {
2187efd3 1055 int ttyfds[2];
0e4be3cf 1056 struct lxc_terminal_info *tty = &ttys->tty[i];
2187efd3 1057
2520facd
CB		 1058 ttyfds[0] = tty->master;
1059 ttyfds[1] = tty->slave;
2187efd3
CB		 1060
1061 ret = lxc_abstract_unix_send_fds(sock, ttyfds, 2, NULL, 0);
1062 if (ret < 0)
1063 break;
1064
7d7333b3 1065 TRACE("Sent tty \"%s\" with master fd %d and slave fd %d to "
2520facd 1066 "parent", tty->name, tty->master, tty->slave);
2187efd3
CB		 1067 }
1068
1069 if (ret < 0)
6d1400b5 1070 SYSERROR("Failed to send %zu ttys to parent", ttys->max);
2187efd3 1071 else
885766f5 1072 TRACE("Sent %zu ttys to parent", ttys->max);
2187efd3
CB		 1073
1074 return ret;
1075}
1076
1077static int lxc_create_ttys(struct lxc_handler *handler)
1078{
1079 int ret = -1;
1080 struct lxc_conf *conf = handler->conf;
1081
663014ee 1082 ret = lxc_allocate_ttys(conf);
2187efd3
CB		 1083 if (ret < 0) {
1084 ERROR("Failed to allocate ttys");
1085 goto on_error;
1086 }
1087
1088 ret = lxc_send_ttys_to_parent(handler);
1089 if (ret < 0) {
1090 ERROR("Failed to send ttys to parent");
1091 goto on_error;
1092 }
1093
1094 if (!conf->is_execute) {
1095 ret = lxc_setup_ttys(conf);
1096 if (ret < 0) {
1097 ERROR("Failed to setup ttys");
1098 goto on_error;
1099 }
1100 }
1101
885766f5
CB		 1102 if (conf->ttys.tty_names) {
1103 ret = setenv("container_ttys", conf->ttys.tty_names, 1);
2187efd3 1104 if (ret < 0)
885766f5 1105 SYSERROR("Failed to set \"container_ttys=%s\"", conf->ttys.tty_names);
2187efd3
CB		 1106 }
1107
1108 ret = 0;
1109
1110on_error:
0e4be3cf 1111 lxc_delete_tty(&conf->ttys);
2187efd3
CB		 1112
1113 return ret;
1114}
1115
7133b912
CB		 1116/* Just create a path for /dev under $lxcpath/$name and in rootfs If we hit an
1117 * error, log it but don't fail yet.
91c3830e 1118 */
7133b912
CB		 1119static int mount_autodev(const char *name, const struct lxc_rootfs *rootfs,
1120 const char *lxcpath)
91c3830e 1121{
2f443e88 1122 __do_free char *path = NULL;
91c3830e 1123 int ret;
87da4ec3 1124 size_t clen;
87e0e273 1125 mode_t cur_mask;
91c3830e 1126
7133b912 1127 INFO("Preparing \"/dev\"");
bc6928ff 1128
14221cbb 1129 /* $(rootfs->mount) + "/dev/pts" + '\0' */
ec50007f 1130 clen = (rootfs->path ? strlen(rootfs->mount) : 0) + 9;
2f443e88 1131 path = must_realloc(NULL, clen);
bc6928ff 1132
ec50007f 1133 ret = snprintf(path, clen, "%s/dev", rootfs->path ? rootfs->mount : "");
7133b912 1134 if (ret < 0 || (size_t)ret >= clen)
91c3830e 1135 return -1;
bc6928ff 1136
87e0e273
CB		 1137 cur_mask = umask(S_IXUSR | S_IXGRP | S_IXOTH);
1138 ret = mkdir(path, S_IRWXU | S_IRGRP | S_IXGRP | S_IROTH | S_IXOTH);
1139 if (ret < 0 && errno != EEXIST) {
1140 SYSERROR("Failed to create \"/dev\" directory");
1141 ret = -errno;
1142 goto reset_umask;
bc6928ff 1143 }
87da4ec3 1144
1ec0e8e3 1145 ret = safe_mount("none", path, "tmpfs", 0, "size=500000,mode=755",
7133b912
CB		 1146 rootfs->path ? rootfs->mount : NULL);
1147 if (ret < 0) {
1148 SYSERROR("Failed to mount tmpfs on \"%s\"", path);
87e0e273 1149 goto reset_umask;
91c3830e 1150 }
87e0e273 1151 TRACE("Mounted tmpfs on \"%s\"", path);
87da4ec3 1152
ec50007f 1153 ret = snprintf(path, clen, "%s/dev/pts", rootfs->path ? rootfs->mount : "");
87e0e273
CB		 1154 if (ret < 0 || (size_t)ret >= clen) {
1155 ret = -1;
1156 goto reset_umask;
1157 }
87da4ec3 1158
7133b912 1159 /* If we are running on a devtmpfs mapping, dev/pts may already exist.
bc6928ff
MW		 1160 * If not, then create it and exit if that fails...
1161 */
87e0e273
CB		 1162 ret = mkdir(path, S_IRWXU | S_IRGRP | S_IXGRP | S_IROTH | S_IXOTH);
1163 if (ret < 0 && errno != EEXIST) {
1164 SYSERROR("Failed to create directory \"%s\"", path);
1165 ret = -errno;
1166 goto reset_umask;
91c3830e
SH		 1167 }
1168
87e0e273
CB		 1169 ret = 0;
1170
1171reset_umask:
1172 (void)umask(cur_mask);
1173
7133b912 1174 INFO("Prepared \"/dev\"");
87e0e273 1175 return ret;
91c3830e
SH		 1176}
1177
5e73416f 1178struct lxc_device_node {
74a3920a 1179 const char *name;
5e73416f
CB		 1180 const mode_t mode;
1181 const int maj;
1182 const int min;
c6883f38
SH		 1183};
1184
5e73416f 1185static const struct lxc_device_node lxc_devices[] = {
06749971 1186 { "full", S_IFCHR | S_IRWXU | S_IRWXG | S_IRWXO, 1, 7 },
5e73416f 1187 { "null", S_IFCHR | S_IRWXU | S_IRWXG | S_IRWXO, 1, 3 },
06749971
CB		 1188 { "random", S_IFCHR | S_IRWXU | S_IRWXG | S_IRWXO, 1, 8 },
1189 { "tty", S_IFCHR | S_IRWXU | S_IRWXG | S_IRWXO, 5, 0 },
5e73416f
CB		 1190 { "urandom", S_IFCHR | S_IRWXU | S_IRWXG | S_IRWXO, 1, 9 },
1191 { "zero", S_IFCHR | S_IRWXU | S_IRWXG | S_IRWXO, 1, 5 },
c6883f38
SH		 1192};
1193
5067e4dd
CB		 1194
1195enum {
1196 LXC_DEVNODE_BIND,
1197 LXC_DEVNODE_MKNOD,
1198 LXC_DEVNODE_PARTIAL,
1199 LXC_DEVNODE_OPEN,
1200};
1201
27245ff7 1202static int lxc_fill_autodev(const struct lxc_rootfs *rootfs)
c6883f38 1203{
5e73416f 1204 int i, ret;
6b5a54cd 1205 char path[PATH_MAX];
3a32201c 1206 mode_t cmask;
5067e4dd 1207 int use_mknod = LXC_DEVNODE_MKNOD;
c6883f38 1208
6b5a54cd 1209 ret = snprintf(path, PATH_MAX, "%s/dev",
3999be0a 1210 rootfs->path ? rootfs->mount : "");
6b5a54cd 1211 if (ret < 0 || ret >= PATH_MAX)
c6883f38 1212 return -1;
91c3830e 1213
0bbf8572
CB		 1214 /* ignore, just don't try to fill in */
1215 if (!dir_exists(path))
9cb4d183
SH		 1216 return 0;
1217
3999be0a
CB		 1218 INFO("Populating \"/dev\"");
1219
3a32201c 1220 cmask = umask(S_IXUSR | S_IXGRP | S_IXOTH);
5e73416f 1221 for (i = 0; i < sizeof(lxc_devices) / sizeof(lxc_devices[0]); i++) {
6b5a54cd 1222 char hostpath[PATH_MAX];
5e73416f 1223 const struct lxc_device_node *device = &lxc_devices[i];
0728ebf4 1224
6b5a54cd 1225 ret = snprintf(path, PATH_MAX, "%s/dev/%s",
5e73416f 1226 rootfs->path ? rootfs->mount : "", device->name);
6b5a54cd 1227 if (ret < 0 || ret >= PATH_MAX)
c6883f38 1228 return -1;
0bbf8572 1229
5067e4dd 1230 if (use_mknod >= LXC_DEVNODE_MKNOD) {
5e73416f
CB		 1231 ret = mknod(path, device->mode, makedev(device->maj, device->min));
1232 if (ret == 0 || (ret < 0 && errno == EEXIST)) {
1233 DEBUG("Created device node \"%s\"", path);
5067e4dd
CB		 1234 } else if (ret < 0) {
1235 if (errno != EPERM) {
1236 SYSERROR("Failed to create device node \"%s\"", path);
1237 return -1;
1238 }
0bbf8572 1239
5067e4dd 1240 use_mknod = LXC_DEVNODE_BIND;
9cb4d183 1241 }
3999be0a 1242
5067e4dd
CB		 1243 /* Device nodes are fully useable. */
1244 if (use_mknod == LXC_DEVNODE_OPEN)
1245 continue;
1246
1247 if (use_mknod == LXC_DEVNODE_MKNOD) {
1248 /* See
1249 * - https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=55956b59df336f6738da916dbb520b6e37df9fbd
1250 * - https://lists.linuxfoundation.org/pipermail/containers/2018-June/039176.html
1251 */
1252 ret = open(path, O_RDONLY | O_CLOEXEC);
1253 if (ret >= 0) {
ae2a3d81 1254 close_prot_errno_disarm(ret);
5067e4dd
CB		 1255 /* Device nodes are fully useable. */
1256 use_mknod = LXC_DEVNODE_OPEN;
1257 continue;
1258 }
1259
1260 SYSTRACE("Failed to open \"%s\" device", path);
1261 /* Device nodes are only partially useable. */
1262 use_mknod = LXC_DEVNODE_PARTIAL;
1263 }
5e73416f
CB		 1264 }
1265
5067e4dd
CB		 1266 if (use_mknod != LXC_DEVNODE_PARTIAL) {
1267 /* If we are dealing with partially functional device
1268 * nodes the prio mknod() call will have created the
1269 * device node so we can use it as a bind-mount target.
1270 */
1271 ret = mknod(path, S_IFREG | 0000, 0);
1272 if (ret < 0 && errno != EEXIST) {
1273 SYSERROR("Failed to create file \"%s\"", path);
1274 return -1;
1275 }
5e73416f
CB		 1276 }
1277
1278 /* Fallback to bind-mounting the device from the host. */
6b5a54cd
CB		 1279 ret = snprintf(hostpath, PATH_MAX, "/dev/%s", device->name);
1280 if (ret < 0 || ret >= PATH_MAX)
5e73416f
CB		 1281 return -1;
1282
1283 ret = safe_mount(hostpath, path, 0, MS_BIND, NULL,
1284 rootfs->path ? rootfs->mount : NULL);
1285 if (ret < 0) {
1286 SYSERROR("Failed to bind mount host device node \"%s\" "
1287 "onto \"%s\"", hostpath, path);
1288 return -1;
c6883f38 1289 }
5e73416f
CB		 1290 DEBUG("Bind mounted host device node \"%s\" onto \"%s\"",
1291 hostpath, path);
c6883f38 1292 }
5e73416f 1293 (void)umask(cmask);
c6883f38 1294
3999be0a 1295 INFO("Populated \"/dev\"");
c6883f38
SH		 1296 return 0;
1297}
1298
8ce1abc2 1299static int lxc_mount_rootfs(struct lxc_conf *conf)
0ad19a3f 1300{
9aa76a17 1301 int ret;
10bc1861 1302 struct lxc_storage *bdev;
8ce1abc2 1303 const struct lxc_rootfs *rootfs = &conf->rootfs;
cc28d0b0 1304
a0f379bf 1305 if (!rootfs->path) {
0fd73091
CB		 1306 ret = mount("", "/", NULL, MS_SLAVE | MS_REC, 0);
1307 if (ret < 0) {
8ce1abc2 1308 SYSERROR("Failed to remount \"/\" MS_REC | MS_SLAVE");
a0f379bf
DW		 1309 return -1;
1310 }
0fd73091 1311
c69bd12f 1312 return 0;
a0f379bf 1313 }
0ad19a3f 1314
0fd73091
CB		 1315 ret = access(rootfs->mount, F_OK);
1316 if (ret != 0) {
1317 SYSERROR("Failed to access to \"%s\". Check it is present",
12297168 1318 rootfs->mount);
b1789442
DL		 1319 return -1;
1320 }
1321
8a388ed4 1322 bdev = storage_init(conf);
9aa76a17 1323 if (!bdev) {
0fd73091 1324 ERROR("Failed to mount rootfs \"%s\" onto \"%s\" with options \"%s\"",
91c3e281
CB		 1325 rootfs->path, rootfs->mount,
1326 rootfs->options ? rootfs->options : "(null)");
9aa76a17 1327 return -1;
9be53773 1328 }
9aa76a17
CB		 1329
1330 ret = bdev->ops->mount(bdev);
10bc1861 1331 storage_put(bdev);
9aa76a17 1332 if (ret < 0) {
0fd73091 1333 ERROR("Failed to mount rootfs \"%s\" onto \"%s\" with options \"%s\"",
91c3e281
CB		 1334 rootfs->path, rootfs->mount,
1335 rootfs->options ? rootfs->options : "(null)");
c3f0a28c 1336 return -1;
1337 }
0ad19a3f 1338
0fd73091 1339 DEBUG("Mounted rootfs \"%s\" onto \"%s\" with options \"%s\"",
91c3e281
CB		 1340 rootfs->path, rootfs->mount,
1341 rootfs->options ? rootfs->options : "(null)");
9aa76a17 1342
ac778708
DL		 1343 return 0;
1344}
1345
8ce1abc2 1346int lxc_chroot(const struct lxc_rootfs *rootfs)
91e93c71 1347{
b8d88764 1348 __do_free char *nroot = NULL;
0fd73091
CB		 1349 int i, ret;
1350 char *p, *p2;
74e7b662 1351 char buf[LXC_LINELEN];
8ce1abc2 1352 char *root = rootfs->mount;
91e93c71 1353
74e7b662 1354 nroot = realpath(root, NULL);
1355 if (!nroot) {
8ce1abc2 1356 SYSERROR("Failed to resolve \"%s\"", root);
0fd73091 1357 return -1;
8ce1abc2 1358 }
91e93c71 1359
0fd73091 1360 ret = chdir("/");
b8d88764 1361 if (ret < 0)
0fd73091 1362 return -1;
91e93c71 1363
0fd73091
CB		 1364 /* We could use here MS_MOVE, but in userns this mount is locked and
1365 * can't be moved.
91e93c71 1366 */
8ce1abc2 1367 ret = mount(nroot, "/", NULL, MS_REC | MS_BIND, NULL);
0fd73091 1368 if (ret < 0) {
8ce1abc2 1369 SYSERROR("Failed to mount \"%s\" onto \"/\" as MS_REC | MS_BIND", nroot);
0fd73091 1370 return -1;
91e93c71
AV		 1371 }
1372
0fd73091
CB		 1373 ret = mount(NULL, "/", NULL, MS_REC | MS_PRIVATE, NULL);
1374 if (ret < 0) {
8ce1abc2 1375 SYSERROR("Failed to remount \"/\"");
0fd73091 1376 return -1;
91e93c71
AV		 1377 }
1378
aa899945 1379 /* The following code cleans up inherited mounts which are not required
0fd73091 1380 * for CT.
91e93c71
AV		 1381 *
1382 * The mountinfo file shows not all mounts, if a few points have been
1383 * unmounted between read operations from the mountinfo. So we need to
1384 * read mountinfo a few times.
1385 *
7ded5fa7 1386 * This loop can be skipped if a container uses userns, because all
91e93c71
AV		 1387 * inherited mounts are locked and we should live with all this trash.
1388 */
0fd73091 1389 for (;;) {
4fdd1f72 1390 __do_fclose FILE *f = NULL;
91e93c71
AV		 1391 int progress = 0;
1392
1393 f = fopen("./proc/self/mountinfo", "r");
1394 if (!f) {
8ce1abc2 1395 SYSERROR("Failed to open \"/proc/self/mountinfo\"");
91e93c71
AV		 1396 return -1;
1397 }
0fd73091 1398
eab15c1e 1399 while (fgets(buf, LXC_LINELEN, f)) {
91e93c71
AV		 1400 for (p = buf, i=0; p && i < 4; i++)
1401 p = strchr(p+1, ' ');
0fd73091 1402
91e93c71
AV		 1403 if (!p)
1404 continue;
0fd73091 1405
91e93c71
AV		 1406 p2 = strchr(p+1, ' ');
1407 if (!p2)
1408 continue;
1409
1410 *p2 = '\0';
1411 *p = '.';
1412
1413 if (strcmp(p + 1, "/") == 0)
1414 continue;
0fd73091 1415
91e93c71
AV		 1416 if (strcmp(p + 1, "/proc") == 0)
1417 continue;
1418
0fd73091
CB		 1419 ret = umount2(p, MNT_DETACH);
1420 if (ret == 0)
91e93c71
AV		 1421 progress++;
1422 }
0fd73091 1423
91e93c71
AV		 1424 if (!progress)
1425 break;
1426 }
1427
7ded5fa7 1428 /* This also can be skipped if a container uses userns. */
0fd73091 1429 (void)umount2("./proc", MNT_DETACH);
91e93c71
AV		 1430
1431 /* It is weird, but chdir("..") moves us in a new root */
0fd73091
CB		 1432 ret = chdir("..");
1433 if (ret < 0) {
8ce1abc2 1434 SYSERROR("Failed to chdir(\"..\")");
91e93c71
AV		 1435 return -1;
1436 }
1437
0fd73091
CB		 1438 ret = chroot(".");
1439 if (ret < 0) {
8ce1abc2 1440 SYSERROR("Failed to chroot(\".\")");
91e93c71
AV		 1441 return -1;
1442 }
1443
1444 return 0;
1445}
1446
8ce1abc2
CB		 1447/* (The following explanation is copied verbatim from the kernel.)
1448 *
1449 * pivot_root Semantics:
1450 * Moves the root file system of the current process to the directory put_old,
1451 * makes new_root as the new root file system of the current process, and sets
1452 * root/cwd of all processes which had them on the current root to new_root.
1453 *
1454 * Restrictions:
1455 * The new_root and put_old must be directories, and must not be on the
1456 * same file system as the current process root. The put_old must be
1457 * underneath new_root, i.e. adding a non-zero number of /.. to the string
1458 * pointed to by put_old must yield the same directory as new_root. No other
1459 * file system may be mounted on put_old. After all, new_root is a mountpoint.
1460 *
1461 * Also, the current root cannot be on the 'rootfs' (initial ramfs) filesystem.
1462 * See Documentation/filesystems/ramfs-rootfs-initramfs.txt for alternatives
1463 * in this situation.
1464 *
1465 * Notes:
1466 * - we don't move root/cwd if they are not at the root (reason: if something
1467 * cared enough to change them, it's probably wrong to force them elsewhere)
1468 * - it's okay to pick a root that isn't the root of a file system, e.g.
1469 * /nfs/my_root where /nfs is the mount point. It must be a mountpoint,
1470 * though, so you may need to say mount --bind /nfs/my_root /nfs/my_root
1471 * first.
1472 */
1473static int lxc_pivot_root(const char *rootfs)
ac778708 1474{
b0d7aac4
CB		 1475 __do_close_prot_errno int oldroot = -EBADF, newroot = -EBADF;
1476 int ret;
0fd73091 1477
7806ebd7 1478 oldroot = open("/", O_DIRECTORY | O_RDONLY | O_CLOEXEC);
8ce1abc2
CB		 1479 if (oldroot < 0) {
1480 SYSERROR("Failed to open old root directory");
1481 return -1;
39c7b795 1482 }
ac778708 1483
7806ebd7 1484 newroot = open(rootfs, O_DIRECTORY | O_RDONLY | O_CLOEXEC);
8ce1abc2
CB		 1485 if (newroot < 0) {
1486 SYSERROR("Failed to open new root directory");
b0d7aac4 1487 return -1;
8ce1abc2 1488 }
0fd73091 1489
8ce1abc2
CB		 1490 /* change into new root fs */
1491 ret = fchdir(newroot);
1492 if (ret < 0) {
8ce1abc2 1493 SYSERROR("Failed to change to new rootfs \"%s\"", rootfs);
b0d7aac4 1494 return -1;
8ce1abc2 1495 }
39c7b795 1496
8ce1abc2
CB		 1497 /* pivot_root into our new root fs */
1498 ret = pivot_root(".", ".");
1499 if (ret < 0) {
8ce1abc2 1500 SYSERROR("Failed to pivot_root()");
b0d7aac4 1501 return -1;
39c7b795
CB		 1502 }
1503
8ce1abc2
CB		 1504 /* At this point the old-root is mounted on top of our new-root. To
1505 * unmounted it we must not be chdir'd into it, so escape back to
1506 * old-root.
1507 */
1508 ret = fchdir(oldroot);
0fd73091 1509 if (ret < 0) {
8ce1abc2 1510 SYSERROR("Failed to enter old root directory");
b0d7aac4 1511 return -1;
c69bd12f
DL		 1512 }
1513
8ce1abc2
CB		 1514 /* Make oldroot rslave to make sure our umounts don't propagate to the
1515 * host.
1516 */
1517 ret = mount("", ".", "", MS_SLAVE | MS_REC, NULL);
1518 if (ret < 0) {
8ce1abc2 1519 SYSERROR("Failed to make oldroot rslave");
b0d7aac4 1520 return -1;
8ce1abc2
CB		 1521 }
1522
1523 ret = umount2(".", MNT_DETACH);
1524 if (ret < 0) {
8ce1abc2 1525 SYSERROR("Failed to detach old root directory");
b0d7aac4 1526 return -1;
8ce1abc2
CB		 1527 }
1528
1529 ret = fchdir(newroot);
1530 if (ret < 0) {
8ce1abc2 1531 SYSERROR("Failed to re-enter new root directory");
b0d7aac4 1532 return -1;
8ce1abc2
CB		 1533 }
1534
8ce1abc2
CB		 1535 TRACE("pivot_root(\"%s\") successful", rootfs);
1536
b0d7aac4 1537 return 0;
0ad19a3f 1538}
1539
8ce1abc2
CB		 1540static int lxc_setup_rootfs_switch_root(const struct lxc_rootfs *rootfs)
1541{
1542 if (!rootfs->path) {
1543 DEBUG("Container does not have a rootfs");
1544 return 0;
1545 }
1546
1547 if (detect_ramfs_rootfs())
1548 return lxc_chroot(rootfs);
1549
1550 return lxc_pivot_root(rootfs->mount);
0ad19a3f 1551}
1552
8ce1abc2
CB		 1553static const struct id_map *find_mapped_nsid_entry(struct lxc_conf *conf,
1554 unsigned id,
1555 enum idtype idtype)
f4900711
CB		 1556{
1557 struct lxc_list *it;
1558 struct id_map *map;
1559 struct id_map *retmap = NULL;
1560
dcf0ffdf
CB		 1561 /* Shortcut for container's root mappings. */
1562 if (id == 0) {
1563 if (idtype == ID_TYPE_UID)
1564 return conf->root_nsuid_map;
1565
1566 if (idtype == ID_TYPE_GID)
1567 return conf->root_nsgid_map;
1568 }
1569
f4900711
CB		 1570 lxc_list_for_each(it, &conf->id_map) {
1571 map = it->elem;
1572 if (map->idtype != idtype)
1573 continue;
1574
1575 if (id >= map->nsid && id < map->nsid + map->range) {
1576 retmap = map;
1577 break;
1578 }
1579 }
1580
1581 return retmap;
1582}
1583
1584static int lxc_setup_devpts(struct lxc_conf *conf)
3c26f34e 1585{
70761e5e 1586 int ret;
ce155c60 1587 char **opts;
9d28c4f9 1588 char devpts_mntopts[256];
ce155c60
CB		 1589 char *mntopt_sets[5];
1590 char default_devpts_mntopts[256] = "gid=5,newinstance,ptmxmode=0666,mode=0620";
77890c6d 1591
e528c735 1592 if (conf->pty_max <= 0) {
0fd73091 1593 DEBUG("No new devpts instance will be mounted since no pts "
70761e5e 1594 "devices are requested");
d852c78c 1595 return 0;
3c26f34e 1596 }
1597
e528c735
CB		 1598 ret = snprintf(devpts_mntopts, sizeof(devpts_mntopts), "%s,max=%zu",
1599 default_devpts_mntopts, conf->pty_max);
9d28c4f9
CB		 1600 if (ret < 0 || (size_t)ret >= sizeof(devpts_mntopts))
1601 return -1;
1602
29a7b484 1603 (void)umount2("/dev/pts", MNT_DETACH);
7e40254a 1604
70761e5e
CB		 1605 /* Create mountpoint for devpts instance. */
1606 ret = mkdir("/dev/pts", 0755);
1607 if (ret < 0 && errno != EEXIST) {
0fd73091 1608 SYSERROR("Failed to create \"/dev/pts\" directory");
3c26f34e 1609 return -1;
1610 }
1611
ce155c60
CB		 1612 /* gid=5 && max= */
1613 mntopt_sets[0] = devpts_mntopts;
dfbd4730 1614
ce155c60 1615 /* !gid=5 && max= */
6333c915 1616 mntopt_sets[1] = devpts_mntopts + STRLITERALLEN("gid=5") + 1;
ce155c60
CB		 1617
1618 /* gid=5 && !max= */
1619 mntopt_sets[2] = default_devpts_mntopts;
1620
1621 /* !gid=5 && !max= */
6333c915 1622 mntopt_sets[3] = default_devpts_mntopts + STRLITERALLEN("gid=5") + 1;
ce155c60
CB		 1623
1624 /* end */
1625 mntopt_sets[4] = NULL;
1626
1627 for (ret = -1, opts = mntopt_sets; opts && *opts; opts++) {
1628 /* mount new devpts instance */
1629 ret = mount("devpts", "/dev/pts", "devpts", MS_NOSUID | MS_NOEXEC, *opts);
1630 if (ret == 0)
1631 break;
1632 }
1633
1634 if (ret < 0) {
1635 SYSERROR("Failed to mount new devpts instance");
1636 return -1;
70761e5e 1637 }
ce155c60 1638 DEBUG("Mount new devpts instance with options \"%s\"", *opts);
70761e5e 1639
d5cb35d6 1640 /* Remove any pre-existing /dev/ptmx file. */
b29e05d6
CB		 1641 ret = remove("/dev/ptmx");
1642 if (ret < 0) {
1643 if (errno != ENOENT) {
0fd73091 1644 SYSERROR("Failed to remove existing \"/dev/ptmx\" file");
d5cb35d6 1645 return -1;
70761e5e 1646 }
b29e05d6 1647 } else {
0fd73091 1648 DEBUG("Removed existing \"/dev/ptmx\" file");
3c26f34e 1649 }
1650
d5cb35d6 1651 /* Create dummy /dev/ptmx file as bind mountpoint for /dev/pts/ptmx. */
3b7e332f
CB		 1652 ret = mknod("/dev/ptmx", S_IFREG | 0000, 0);
1653 if (ret < 0 && errno != EEXIST) {
0fd73091 1654 SYSERROR("Failed to create dummy \"/dev/ptmx\" file as bind mount target");
d5cb35d6
CB		 1655 return -1;
1656 }
0fd73091 1657 DEBUG("Created dummy \"/dev/ptmx\" file as bind mount target");
77890c6d 1658
d5cb35d6 1659 /* Fallback option: create symlink /dev/ptmx -> /dev/pts/ptmx */
e87bd19c 1660 ret = mount("/dev/pts/ptmx", "/dev/ptmx", NULL, MS_BIND, NULL);
d5cb35d6 1661 if (!ret) {
0fd73091 1662 DEBUG("Bind mounted \"/dev/pts/ptmx\" to \"/dev/ptmx\"");
d5cb35d6
CB		 1663 return 0;
1664 } else {
1665 /* Fallthrough and try to create a symlink. */
0fd73091 1666 ERROR("Failed to bind mount \"/dev/pts/ptmx\" to \"/dev/ptmx\"");
d5cb35d6
CB		 1667 }
1668
1669 /* Remove the dummy /dev/ptmx file we created above. */
1670 ret = remove("/dev/ptmx");
70761e5e 1671 if (ret < 0) {
0fd73091 1672 SYSERROR("Failed to remove existing \"/dev/ptmx\"");
d5cb35d6
CB		 1673 return -1;
1674 }
1675
1676 /* Fallback option: Create symlink /dev/ptmx -> /dev/pts/ptmx. */
1677 ret = symlink("/dev/pts/ptmx", "/dev/ptmx");
1678 if (ret < 0) {
0fd73091 1679 SYSERROR("Failed to create symlink from \"/dev/ptmx\" to \"/dev/pts/ptmx\"");
3c26f34e 1680 return -1;
1681 }
0fd73091 1682 DEBUG("Created symlink from \"/dev/ptmx\" to \"/dev/pts/ptmx\"");
cd54d859 1683
3c26f34e 1684 return 0;
1685}
1686
cccc74b5
DL		 1687static int setup_personality(int persona)
1688{
0fd73091
CB		 1689 int ret;
1690
1691#if HAVE_SYS_PERSONALITY_H
cccc74b5
DL		 1692 if (persona == -1)
1693 return 0;
1694
0fd73091
CB		 1695 ret = personality(persona);
1696 if (ret < 0) {
1697 SYSERROR("Failed to set personality to \"0x%x\"", persona);
cccc74b5
DL		 1698 return -1;
1699 }
1700
0fd73091
CB		 1701 INFO("Set personality to \"0x%x\"", persona);
1702#endif
cccc74b5
DL		 1703
1704 return 0;
1705}
1706
3d7d929a 1707static int lxc_setup_dev_console(const struct lxc_rootfs *rootfs,
dcad02f8 1708 const struct lxc_terminal *console)
6e590161 1709{
882671aa 1710 int ret;
6b5a54cd 1711 char path[PATH_MAX];
86530b0a 1712 char *rootfs_path = rootfs->path ? rootfs->mount : "";
52e35957 1713
8b1b1210
CB		 1714 if (console->path && !strcmp(console->path, "none"))
1715 return 0;
1716
86530b0a 1717 ret = snprintf(path, sizeof(path), "%s/dev/console", rootfs_path);
3d7d929a 1718 if (ret < 0 || (size_t)ret >= sizeof(path))
7c6ef2a2 1719 return -1;
52e35957 1720
8b1b1210
CB		 1721 /* When we are asked to setup a console we remove any previous
1722 * /dev/console bind-mounts.
1723 */
a7ba3c7f
CB		 1724 if (file_exists(path)) {
1725 ret = lxc_unstack_mountpoint(path, false);
1726 if (ret < 0) {
6d1400b5 1727 SYSERROR("Failed to unmount \"%s\"", path);
a7ba3c7f
CB		 1728 return -ret;
1729 } else {
86530b0a 1730 DEBUG("Cleared all (%d) mounts from \"%s\"", ret, path);
a7ba3c7f 1731 }
8b1b1210
CB		 1732 }
1733
1734 /* For unprivileged containers autodev or automounts will already have
1735 * taken care of creating /dev/console.
1736 */
882671aa 1737 ret = mknod(path, S_IFREG | 0000, 0);
3b7e332f
CB		 1738 if (ret < 0 && errno != EEXIST) {
1739 SYSERROR("Failed to create console");
1740 return -errno;
52e35957
DL		 1741 }
1742
e581b9b5 1743 ret = fchmod(console->slave, S_IXUSR | S_IXGRP);
86530b0a 1744 if (ret < 0) {
0fd73091 1745 SYSERROR("Failed to set mode \"0%o\" to \"%s\"",
e581b9b5 1746 S_IXUSR | S_IXGRP, console->name);
3d7d929a 1747 return -errno;
63376d7d 1748 }
13954cce 1749
86530b0a
L		 1750 ret = safe_mount(console->name, path, "none", MS_BIND, 0, rootfs_path);
1751 if (ret < 0) {
0fd73091 1752 ERROR("Failed to mount \"%s\" on \"%s\"", console->name, path);
6e590161 1753 return -1;
1754 }
1755
86530b0a 1756 DEBUG("Mounted pts device \"%s\" onto \"%s\"", console->name, path);
7c6ef2a2
SH		 1757 return 0;
1758}
1759
3d7d929a 1760static int lxc_setup_ttydir_console(const struct lxc_rootfs *rootfs,
dcad02f8 1761 const struct lxc_terminal *console,
3d7d929a 1762 char *ttydir)
7c6ef2a2 1763{
3b7e332f 1764 int ret;
6b5a54cd 1765 char path[PATH_MAX], lxcpath[PATH_MAX];
86530b0a 1766 char *rootfs_path = rootfs->path ? rootfs->mount : "";
7c6ef2a2 1767
3dc035f1
L		 1768 if (console->path && !strcmp(console->path, "none"))
1769 return 0;
1770
7c6ef2a2 1771 /* create rootfs/dev/<ttydir> directory */
86530b0a 1772 ret = snprintf(path, sizeof(path), "%s/dev/%s", rootfs_path, ttydir);
3d7d929a 1773 if (ret < 0 || (size_t)ret >= sizeof(path))
7c6ef2a2 1774 return -1;
3d7d929a 1775
7c6ef2a2
SH		 1776 ret = mkdir(path, 0755);
1777 if (ret && errno != EEXIST) {
0fd73091 1778 SYSERROR("Failed to create \"%s\"", path);
3d7d929a 1779 return -errno;
7c6ef2a2 1780 }
4742cd9a 1781 DEBUG("Created directory for console and tty devices at \"%s\"", path);
7c6ef2a2 1782
86530b0a 1783 ret = snprintf(lxcpath, sizeof(lxcpath), "%s/dev/%s/console", rootfs_path, ttydir);
3d7d929a
CB		 1784 if (ret < 0 || (size_t)ret >= sizeof(lxcpath))
1785 return -1;
1786
3b7e332f
CB		 1787 ret = mknod(lxcpath, S_IFREG | 0000, 0);
1788 if (ret < 0 && errno != EEXIST) {
0fd73091 1789 SYSERROR("Failed to create \"%s\"", lxcpath);
3d7d929a 1790 return -errno;
7c6ef2a2 1791 }
7c6ef2a2 1792
86530b0a 1793 ret = snprintf(path, sizeof(path), "%s/dev/console", rootfs_path);
3dc035f1 1794 if (ret < 0 || (size_t)ret >= sizeof(path))
7c6ef2a2 1795 return -1;
2a12fefd 1796
3dc035f1 1797 if (file_exists(path)) {
a7ba3c7f 1798 ret = lxc_unstack_mountpoint(path, false);
2a12fefd 1799 if (ret < 0) {
6d1400b5 1800 SYSERROR("Failed to unmount \"%s\"", path);
a7ba3c7f
CB		 1801 return -ret;
1802 } else {
86530b0a 1803 DEBUG("Cleared all (%d) mounts from \"%s\"", ret, path);
a7ba3c7f 1804 }
3dc035f1 1805 }
2a12fefd 1806
3b7e332f
CB		 1807 ret = mknod(path, S_IFREG | 0000, 0);
1808 if (ret < 0 && errno != EEXIST) {
1809 SYSERROR("Failed to create console");
1810 return -errno;
7c6ef2a2
SH		 1811 }
1812
e581b9b5 1813 ret = fchmod(console->slave, S_IXUSR | S_IXGRP);
86530b0a 1814 if (ret < 0) {
0fd73091 1815 SYSERROR("Failed to set mode \"0%o\" to \"%s\"",
e581b9b5 1816 S_IXUSR | S_IXGRP, console->name);
2a12fefd
CB		 1817 return -errno;
1818 }
1819
3dc035f1 1820 /* bind mount console->name to '/dev/<ttydir>/console' */
86530b0a
L		 1821 ret = safe_mount(console->name, lxcpath, "none", MS_BIND, 0, rootfs_path);
1822 if (ret < 0) {
0fd73091 1823 ERROR("Failed to mount \"%s\" on \"%s\"", console->name, lxcpath);
7c6ef2a2
SH		 1824 return -1;
1825 }
86530b0a 1826 DEBUG("Mounted \"%s\" onto \"%s\"", console->name, lxcpath);
3dc035f1
L		 1827
1828 /* bind mount '/dev/<ttydir>/console' to '/dev/console' */
86530b0a
L		 1829 ret = safe_mount(lxcpath, path, "none", MS_BIND, 0, rootfs_path);
1830 if (ret < 0) {
0fd73091 1831 ERROR("Failed to mount \"%s\" on \"%s\"", console->name, lxcpath);
3dc035f1
L		 1832 return -1;
1833 }
86530b0a 1834 DEBUG("Mounted \"%s\" onto \"%s\"", console->name, lxcpath);
3dc035f1 1835
86530b0a 1836 DEBUG("Console has been setup under \"%s\" and mounted to \"%s\"", lxcpath, path);
6e590161 1837 return 0;
1838}
1839
3d7d929a 1840static int lxc_setup_console(const struct lxc_rootfs *rootfs,
dcad02f8 1841 const struct lxc_terminal *console, char *ttydir)
7c6ef2a2 1842{
3d7d929a 1843
7c6ef2a2 1844 if (!ttydir)
3d7d929a 1845 return lxc_setup_dev_console(rootfs, console);
7c6ef2a2 1846
3d7d929a 1847 return lxc_setup_ttydir_console(rootfs, console, ttydir);
7c6ef2a2
SH		 1848}
1849
efed99a4 1850static void parse_mntopt(char *opt, unsigned long *flags, char **data, size_t size)
998ac676
RT		 1851{
1852 struct mount_opt *mo;
1853
1854 /* If opt is found in mount_opt, set or clear flags.
1855 * Otherwise append it to data. */
1856
1857 for (mo = &mount_opt[0]; mo->name != NULL; mo++) {
0fd73091 1858 if (strncmp(opt, mo->name, strlen(mo->name)) == 0) {
998ac676
RT		 1859 if (mo->clear)
1860 *flags &= ~mo->flag;
1861 else
1862 *flags |= mo->flag;
1863 return;
1864 }
1865 }
1866
f1e05b90
DJ		 1867 if (strlen(*data))
1868 (void)strlcat(*data, ",", size);
efed99a4 1869
f1e05b90 1870 (void)strlcat(*data, opt, size);
998ac676
RT		 1871}
1872
0fd73091 1873int parse_mntopts(const char *mntopts, unsigned long *mntflags, char **mntdata)
998ac676 1874{
a71f619c
CB		 1875 __do_free char *data = NULL, *s = NULL;
1876 char *p;
efed99a4 1877 size_t size;
998ac676 1878
911324ef 1879 *mntdata = NULL;
91656ce5 1880 *mntflags = 0L;
911324ef
DL		 1881
1882 if (!mntopts)
998ac676
RT		 1883 return 0;
1884
911324ef 1885 s = strdup(mntopts);
0fd73091 1886 if (!s)
998ac676 1887 return -1;
998ac676 1888
efed99a4
DJ		 1889 size = strlen(s) + 1;
1890 data = malloc(size);
a71f619c 1891 if (!data)
998ac676 1892 return -1;
998ac676
RT		 1893 *data = 0;
1894
8db9d26f 1895 lxc_iterate_parts(p, s, ",")
efed99a4 1896 parse_mntopt(p, mntflags, &data, size);
998ac676
RT		 1897
1898 if (*data)
a71f619c 1899 *mntdata = move_ptr(data);
998ac676
RT		 1900
1901 return 0;
1902}
1903
d840039e
YT		 1904static void parse_propagationopt(char *opt, unsigned long *flags)
1905{
1906 struct mount_opt *mo;
1907
1908 /* If opt is found in propagation_opt, set or clear flags. */
d840039e 1909 for (mo = &propagation_opt[0]; mo->name != NULL; mo++) {
0fd73091
CB		 1910 if (strncmp(opt, mo->name, strlen(mo->name)) != 0)
1911 continue;
1912
1913 if (mo->clear)
1914 *flags &= ~mo->flag;
1915 else
1916 *flags |= mo->flag;
1917
1918 return;
d840039e
YT		 1919 }
1920}
1921
8ce1abc2 1922int parse_propagationopts(const char *mntopts, unsigned long *pflags)
d840039e 1923{
dfd2e059
CB		 1924 __do_free char *s = NULL;
1925 char *p;
d840039e
YT		 1926
1927 if (!mntopts)
1928 return 0;
1929
1930 s = strdup(mntopts);
1931 if (!s) {
1932 SYSERROR("Failed to allocate memory");
1933 return -ENOMEM;
1934 }
1935
0fd73091 1936 *pflags = 0L;
8db9d26f 1937 lxc_iterate_parts(p, s, ",")
d840039e 1938 parse_propagationopt(p, pflags);
0fd73091 1939
d840039e
YT		 1940 return 0;
1941}
1942
6fd5e769
SH		 1943static void null_endofword(char *word)
1944{
1945 while (*word && *word != ' ' && *word != '\t')
1946 word++;
1947 *word = '\0';
1948}
1949
0fd73091 1950/* skip @nfields spaces in @src */
6fd5e769
SH		 1951static char *get_field(char *src, int nfields)
1952{
6fd5e769 1953 int i;
0fd73091 1954 char *p = src;
6fd5e769
SH		 1955
1956 for (i = 0; i < nfields; i++) {
1957 while (*p && *p != ' ' && *p != '\t')
1958 p++;
0fd73091 1959
6fd5e769
SH		 1960 if (!*p)
1961 break;
0fd73091 1962
6fd5e769
SH		 1963 p++;
1964 }
0fd73091 1965
6fd5e769
SH		 1966 return p;
1967}
1968
911324ef
DL		 1969static int mount_entry(const char *fsname, const char *target,
1970 const char *fstype, unsigned long mountflags,
d840039e
YT		 1971 unsigned long pflags, const char *data, bool optional,
1972 bool dev, bool relative, const char *rootfs)
911324ef 1973{
0ac4b28a 1974 int ret;
6b5a54cd 1975 char srcbuf[PATH_MAX];
181437fd 1976 const char *srcpath = fsname;
614305f3 1977#ifdef HAVE_STATVFS
2938f7c8 1978 struct statvfs sb;
614305f3 1979#endif
2938f7c8 1980
181437fd 1981 if (relative) {
6b5a54cd
CB		 1982 ret = snprintf(srcbuf, PATH_MAX, "%s/%s", rootfs ? rootfs : "/", fsname ? fsname : "");
1983 if (ret < 0 || ret >= PATH_MAX) {
181437fd
YT		 1984 ERROR("source path is too long");
1985 return -1;
1986 }
1987 srcpath = srcbuf;
1988 }
1989
1990 ret = safe_mount(srcpath, target, fstype, mountflags & ~MS_REMOUNT, data,
0ac4b28a
CB		 1991 rootfs);
1992 if (ret < 0) {
1fc64d22 1993 if (optional) {
7874d81a 1994 SYSINFO("Failed to mount \"%s\" on \"%s\" (optional)",
1995 srcpath ? srcpath : "(null)", target);
1fc64d22
SG		 1996 return 0;
1997 }
0ac4b28a 1998
0103eb53 1999 SYSERROR("Failed to mount \"%s\" on \"%s\"",
181437fd 2000 srcpath ? srcpath : "(null)", target);
0ac4b28a 2001 return -1;
911324ef
DL		 2002 }
2003
2004 if ((mountflags & MS_REMOUNT) || (mountflags & MS_BIND)) {
7c5b6e7c 2005 unsigned long rqd_flags = 0;
0ac4b28a
CB		 2006
2007 DEBUG("Remounting \"%s\" on \"%s\" to respect bind or remount "
181437fd 2008 "options", srcpath ? srcpath : "(none)", target ? target : "(none)");
0ac4b28a 2009
7c5b6e7c
AS		 2010 if (mountflags & MS_RDONLY)
2011 rqd_flags |= MS_RDONLY;
614305f3 2012#ifdef HAVE_STATVFS
181437fd 2013 if (srcpath && statvfs(srcpath, &sb) == 0) {
7c5b6e7c 2014 unsigned long required_flags = rqd_flags;
0ac4b28a 2015
2938f7c8
SH		 2016 if (sb.f_flag & MS_NOSUID)
2017 required_flags |= MS_NOSUID;
0ac4b28a 2018
ae7a770e 2019 if (sb.f_flag & MS_NODEV && !dev)
2938f7c8 2020 required_flags |= MS_NODEV;
0ac4b28a 2021
2938f7c8
SH		 2022 if (sb.f_flag & MS_RDONLY)
2023 required_flags |= MS_RDONLY;
0ac4b28a 2024
2938f7c8
SH		 2025 if (sb.f_flag & MS_NOEXEC)
2026 required_flags |= MS_NOEXEC;
0ac4b28a
CB		 2027
2028 DEBUG("Flags for \"%s\" were %lu, required extra flags "
181437fd 2029 "are %lu", srcpath, sb.f_flag, required_flags);
0ac4b28a
CB		 2030
2031 /* If this was a bind mount request, and required_flags
2938f7c8 2032 * does not have any flags which are not already in
0ac4b28a 2033 * mountflags, then skip the remount.
2938f7c8
SH		 2034 */
2035 if (!(mountflags & MS_REMOUNT)) {
0ac4b28a
CB		 2036 if (!(required_flags & ~mountflags) &&
2037 rqd_flags == 0) {
2038 DEBUG("Mountflags already were %lu, "
2039 "skipping remount", mountflags);
2938f7c8
SH		 2040 goto skipremount;
2041 }
2042 }
0ac4b28a 2043
2938f7c8 2044 mountflags |= required_flags;
6fd5e769 2045 }
614305f3 2046#endif
911324ef 2047
181437fd 2048 ret = mount(srcpath, target, fstype, mountflags | MS_REMOUNT, data);
0ac4b28a 2049 if (ret < 0) {
1fc64d22 2050 if (optional) {
7874d81a 2051 SYSINFO("Failed to mount \"%s\" on \"%s\" (optional)",
2052 srcpath ? srcpath : "(null)", target);
1fc64d22
SG		 2053 return 0;
2054 }
0ac4b28a 2055
0103eb53 2056 SYSERROR("Failed to mount \"%s\" on \"%s\"",
181437fd 2057 srcpath ? srcpath : "(null)", target);
0ac4b28a 2058 return -1;
911324ef
DL		 2059 }
2060 }
2061
a3ed9b81 2062#ifdef HAVE_STATVFS
2063skipremount:
2064#endif
d840039e
YT		 2065 if (pflags) {
2066 ret = mount(NULL, target, NULL, pflags, NULL);
2067 if (ret < 0) {
2068 if (optional) {
7874d81a 2069 SYSINFO("Failed to change mount propagation "
2070 "for \"%s\" (optional)", target);
d840039e
YT		 2071 return 0;
2072 } else {
2073 SYSERROR("Failed to change mount propagation "
2074 "for \"%s\" (optional)", target);
2075 return -1;
2076 }
2077 }
2078 DEBUG("Changed mount propagation for \"%s\"", target);
2079 }
2080
0103eb53 2081 DEBUG("Mounted \"%s\" on \"%s\" with filesystem type \"%s\"",
181437fd 2082 srcpath ? srcpath : "(null)", target, fstype);
911324ef
DL		 2083
2084 return 0;
2085}
2086
c5e30de4 2087/* Remove "optional", "create=dir", and "create=file" from mntopt */
4e4ca161
SH		 2088static void cull_mntent_opt(struct mntent *mntent)
2089{
2090 int i;
0fd73091
CB		 2091 char *list[] = {
2092 "create=dir",
2093 "create=file",
2094 "optional",
2095 "relative",
2096 NULL
2097 };
c5e30de4
CB		 2098
2099 for (i = 0; list[i]; i++) {
2100 char *p, *p2;
2101
2102 p = strstr(mntent->mnt_opts, list[i]);
2103 if (!p)
4e4ca161 2104 continue;
c5e30de4 2105
4e4ca161
SH		 2106 p2 = strchr(p, ',');
2107 if (!p2) {
2108 /* no more mntopts, so just chop it here */
2109 *p = '\0';
2110 continue;
2111 }
c5e30de4
CB		 2112
2113 memmove(p, p2 + 1, strlen(p2 + 1) + 1);
4e4ca161
SH		 2114 }
2115}
2116
4d5b72a1 2117static int mount_entry_create_dir_file(const struct mntent *mntent,
749f98d9
CB		 2118 const char *path,
2119 const struct lxc_rootfs *rootfs,
0fd73091 2120 const char *lxc_name, const char *lxc_path)
0ad19a3f 2121{
7a76eeaa 2122 __do_free char *p1 = NULL;
3b7e332f 2123 int ret;
7a76eeaa 2124 char *p2;
911324ef 2125
12e6ab5d 2126 if (strncmp(mntent->mnt_type, "overlay", 7) == 0) {
749f98d9 2127 ret = ovl_mkdir(mntent, rootfs, lxc_name, lxc_path);
12e6ab5d
CB		 2128 if (ret < 0)
2129 return -1;
2130 }
6e46cc0d 2131
34cfffb3 2132 if (hasmntopt(mntent, "create=dir")) {
749f98d9
CB		 2133 ret = mkdir_p(path, 0755);
2134 if (ret < 0 && errno != EEXIST) {
2135 SYSERROR("Failed to create directory \"%s\"", path);
2136 return -1;
34cfffb3
SG		 2137 }
2138 }
2139
0fd73091
CB		 2140 if (!hasmntopt(mntent, "create=file"))
2141 return 0;
749f98d9 2142
0fd73091
CB		 2143 ret = access(path, F_OK);
2144 if (ret == 0)
2145 return 0;
749f98d9 2146
0fd73091
CB		 2147 p1 = strdup(path);
2148 if (!p1)
2149 return -1;
749f98d9 2150
0fd73091 2151 p2 = dirname(p1);
749f98d9 2152
0fd73091 2153 ret = mkdir_p(p2, 0755);
0fd73091
CB		 2154 if (ret < 0 && errno != EEXIST) {
2155 SYSERROR("Failed to create directory \"%s\"", path);
2156 return -1;
34cfffb3 2157 }
749f98d9 2158
3b7e332f
CB		 2159 ret = mknod(path, S_IFREG | 0000, 0);
2160 if (ret < 0 && errno != EEXIST)
2161 return -errno;
0fd73091 2162
749f98d9 2163 return 0;
4d5b72a1
NC		 2164}
2165
ec50007f
CB		 2166/* rootfs, lxc_name, and lxc_path can be NULL when the container is created
2167 * without a rootfs. */
db4aba38 2168static inline int mount_entry_on_generic(struct mntent *mntent,
d8b712bc
CB		 2169 const char *path,
2170 const struct lxc_rootfs *rootfs,
2171 const char *lxc_name,
2172 const char *lxc_path)
4d5b72a1 2173{
fd214f37 2174 __do_free char *mntdata = NULL;
d8b712bc 2175 int ret;
949d0338 2176 unsigned long mntflags;
181437fd 2177 bool dev, optional, relative;
949d0338 2178 unsigned long pflags = 0;
ec50007f 2179 char *rootfs_path = NULL;
d8b712bc
CB		 2180
2181 optional = hasmntopt(mntent, "optional") != NULL;
2182 dev = hasmntopt(mntent, "dev") != NULL;
181437fd 2183 relative = hasmntopt(mntent, "relative") != NULL;
d8b712bc 2184
ec50007f
CB		 2185 if (rootfs && rootfs->path)
2186 rootfs_path = rootfs->mount;
2187
d8b712bc
CB		 2188 ret = mount_entry_create_dir_file(mntent, path, rootfs, lxc_name,
2189 lxc_path);
2190 if (ret < 0) {
2191 if (optional)
2192 return 0;
608e3567 2193
d8b712bc
CB		 2194 return -1;
2195 }
4e4ca161
SH		 2196 cull_mntent_opt(mntent);
2197
d840039e
YT		 2198 ret = parse_propagationopts(mntent->mnt_opts, &pflags);
2199 if (ret < 0)
2200 return -1;
2201
d8b712bc
CB		 2202 ret = parse_mntopts(mntent->mnt_opts, &mntflags, &mntdata);
2203 if (ret < 0)
a17b1e65 2204 return -1;
a17b1e65 2205
6e46cc0d 2206 ret = mount_entry(mntent->mnt_fsname, path, mntent->mnt_type, mntflags,
d840039e 2207 pflags, mntdata, optional, dev, relative, rootfs_path);
68c152ef 2208
911324ef
DL		 2209 return ret;
2210}
2211
db4aba38
NC		 2212static inline int mount_entry_on_systemfs(struct mntent *mntent)
2213{
1433c9f9 2214 int ret;
6b5a54cd 2215 char path[PATH_MAX];
1433c9f9
CB		 2216
2217 /* For containers created without a rootfs all mounts are treated as
07667a6a
CB		 2218 * absolute paths starting at / on the host.
2219 */
1433c9f9
CB		 2220 if (mntent->mnt_dir[0] != '/')
2221 ret = snprintf(path, sizeof(path), "/%s", mntent->mnt_dir);
2222 else
2223 ret = snprintf(path, sizeof(path), "%s", mntent->mnt_dir);
07667a6a 2224 if (ret < 0 || ret >= sizeof(path))
1433c9f9 2225 return -1;
1433c9f9
CB		 2226
2227 return mount_entry_on_generic(mntent, path, NULL, NULL, NULL);
db4aba38
NC		 2228}
2229
4e4ca161 2230static int mount_entry_on_absolute_rootfs(struct mntent *mntent,
80a881b2 2231 const struct lxc_rootfs *rootfs,
0a2dddd4
CB		 2232 const char *lxc_name,
2233 const char *lxc_path)
911324ef 2234{
bdd2b34c 2235 int offset;
013bd428 2236 char *aux;
67e571de 2237 const char *lxcpath;
6b5a54cd 2238 char path[PATH_MAX];
bdd2b34c 2239 int ret = 0;
0ad19a3f 2240
593e8478 2241 lxcpath = lxc_global_config_value("lxc.lxcpath");
bdd2b34c 2242 if (!lxcpath)
2a59a681 2243 return -1;
2a59a681 2244
bdd2b34c
CB		 2245 /* If rootfs->path is a blockdev path, allow container fstab to use
2246 * <lxcpath>/<name>/rootfs" as the target prefix.
2247 */
6b5a54cd
CB		 2248 ret = snprintf(path, PATH_MAX, "%s/%s/rootfs", lxcpath, lxc_name);
2249 if (ret < 0 || ret >= PATH_MAX)
80a881b2
SH		 2250 goto skipvarlib;
2251
2252 aux = strstr(mntent->mnt_dir, path);
2253 if (aux) {
2254 offset = strlen(path);
2255 goto skipabs;
2256 }
2257
2258skipvarlib:
013bd428
DL		 2259 aux = strstr(mntent->mnt_dir, rootfs->path);
2260 if (!aux) {
bdd2b34c 2261 WARN("Ignoring mount point \"%s\"", mntent->mnt_dir);
db4aba38 2262 return ret;
013bd428 2263 }
80a881b2
SH		 2264 offset = strlen(rootfs->path);
2265
2266skipabs:
6b5a54cd
CB		 2267 ret = snprintf(path, PATH_MAX, "%s/%s", rootfs->mount, aux + offset);
2268 if (ret < 0 || ret >= PATH_MAX)
a17b1e65 2269 return -1;
a17b1e65 2270
0a2dddd4 2271 return mount_entry_on_generic(mntent, path, rootfs, lxc_name, lxc_path);
911324ef 2272}
d330fe7b 2273
4e4ca161 2274static int mount_entry_on_relative_rootfs(struct mntent *mntent,
0a2dddd4
CB		 2275 const struct lxc_rootfs *rootfs,
2276 const char *lxc_name,
2277 const char *lxc_path)
911324ef 2278{
911324ef 2279 int ret;
6b5a54cd 2280 char path[PATH_MAX];
d330fe7b 2281
34cfffb3 2282 /* relative to root mount point */
6e46cc0d 2283 ret = snprintf(path, sizeof(path), "%s/%s", rootfs->mount, mntent->mnt_dir);
0fd73091 2284 if (ret < 0 || (size_t)ret >= sizeof(path))
9ba8130c 2285 return -1;
911324ef 2286
0a2dddd4 2287 return mount_entry_on_generic(mntent, path, rootfs, lxc_name, lxc_path);
911324ef
DL		 2288}
2289
06749971
CB		 2290static int mount_file_entries(const struct lxc_conf *conf,
2291 const struct lxc_rootfs *rootfs, FILE *file,
1ae3c19f 2292 const char *lxc_name, const char *lxc_path)
911324ef 2293{
9d03d857 2294 char buf[PATH_MAX];
0fd73091 2295 struct mntent mntent;
e76b8764 2296
aaf901be 2297 while (getmntent_r(file, &mntent, buf, sizeof(buf))) {
9d03d857
CB		 2298 int ret;
2299
1ae3c19f
CB		 2300 if (!rootfs->path)
2301 ret = mount_entry_on_systemfs(&mntent);
2302 else if (mntent.mnt_dir[0] != '/')
2303 ret = mount_entry_on_relative_rootfs(&mntent, rootfs,
2304 lxc_name, lxc_path);
2305 else
2306 ret = mount_entry_on_absolute_rootfs(&mntent, rootfs,
9d03d857 2307 lxc_name, lxc_path);
1ae3c19f
CB		 2308 if (ret < 0)
2309 return -1;
0ad19a3f 2310 }
cd54d859 2311
9d03d857
CB		 2312 if (!feof(file) || ferror(file)) {
2313 ERROR("Failed to parse mount entries");
2314 return -1;
2315 }
2316
2317 return 0;
e7938e9e
MN		 2318}
2319
06749971
CB		 2320static int setup_mount(const struct lxc_conf *conf,
2321 const struct lxc_rootfs *rootfs, const char *fstab,
42dff448 2322 const char *lxc_name, const char *lxc_path)
e7938e9e 2323{
42dff448 2324 FILE *f;
e7938e9e
MN		 2325 int ret;
2326
2327 if (!fstab)
2328 return 0;
2329
42dff448
CB		 2330 f = setmntent(fstab, "r");
2331 if (!f) {
2332 SYSERROR("Failed to open \"%s\"", fstab);
e7938e9e
MN		 2333 return -1;
2334 }
2335
06749971 2336 ret = mount_file_entries(conf, rootfs, f, lxc_name, lxc_path);
42dff448
CB		 2337 if (ret < 0)
2338 ERROR("Failed to set up mount entries");
e7938e9e 2339
42dff448 2340 endmntent(f);
0ad19a3f 2341 return ret;
2342}
2343
1800f924
WB		 2344/*
2345 * In order for nested containers to be able to mount /proc and /sys they need
2346 * to see a "pure" proc and sysfs mount points with nothing mounted on top
2347 * (like lxcfs).
2348 * For this we provide proc and sysfs in /dev/.lxc/{proc,sys} while using an
2349 * apparmor rule to deny access to them. This is mostly for convenience: The
2350 * container's root user can mount them anyway and thus has access to the two
2351 * file systems. But a non-root user in the container should not be allowed to
2352 * access them as a side effect without explicitly allowing it.
2353 */
2354static const char nesting_helpers[] =
dc691e34
CB		 2355"proc dev/.lxc/proc proc create=dir,optional 0 0\n"
2356"sys dev/.lxc/sys sysfs create=dir,optional 0 0\n";
1800f924
WB		 2357
2358FILE *make_anonymous_mount_file(struct lxc_list *mount,
2359 bool include_nesting_helpers)
e7938e9e 2360{
79bcf5ee 2361 __do_close_prot_errno int fd = -EBADF;
5ef5c9a3 2362 int ret;
e7938e9e 2363 char *mount_entry;
5ef5c9a3 2364 struct lxc_list *iterator;
5ef5c9a3 2365
0fd73091 2366 fd = memfd_create(".lxc_mount_file", MFD_CLOEXEC);
5ef5c9a3 2367 if (fd < 0) {
a324e7eb
CB		 2368 char template[] = P_tmpdir "/.lxc_mount_file_XXXXXX";
2369
5ef5c9a3
CB		 2370 if (errno != ENOSYS)
2371 return NULL;
a324e7eb
CB		 2372
2373 fd = lxc_make_tmpfile(template, true);
0fd73091
CB		 2374 if (fd < 0) {
2375 SYSERROR("Could not create temporary mount file");
2376 return NULL;
2377 }
2378
6bd04140 2379 TRACE("Created temporary mount file");
5ef5c9a3 2380 }
e7938e9e 2381
0fd73091
CB		 2382 lxc_list_for_each (iterator, mount) {
2383 size_t len;
2384
e7938e9e 2385 mount_entry = iterator->elem;
0fd73091 2386 len = strlen(mount_entry);
5ef5c9a3 2387
489f39be 2388 ret = lxc_write_nointr(fd, mount_entry, len);
0fd73091 2389 if (ret != len)
79bcf5ee 2390 return NULL;
0fd73091 2391
489f39be 2392 ret = lxc_write_nointr(fd, "\n", 1);
0fd73091 2393 if (ret != 1)
79bcf5ee 2394 return NULL;
e7938e9e
MN		 2395 }
2396
1800f924
WB		 2397 if (include_nesting_helpers) {
2398 ret = lxc_write_nointr(fd, nesting_helpers,
6333c915
CB		 2399 STRARRAYLEN(nesting_helpers));
2400 if (ret != STRARRAYLEN(nesting_helpers))
79bcf5ee 2401 return NULL;
1800f924
WB		 2402 }
2403
0fd73091
CB		 2404 ret = lseek(fd, 0, SEEK_SET);
2405 if (ret < 0)
79bcf5ee 2406 return NULL;
0fd73091 2407
79bcf5ee 2408 return fdopen(move_fd(fd), "r+");
9fc7f8c0
TA		 2409}
2410
06749971
CB		 2411static int setup_mount_entries(const struct lxc_conf *conf,
2412 const struct lxc_rootfs *rootfs,
5ef5c9a3
CB		 2413 struct lxc_list *mount, const char *lxc_name,
2414 const char *lxc_path)
9fc7f8c0 2415{
c85ced65 2416 __do_fclose FILE *f = NULL;
9fc7f8c0 2417
1800f924 2418 f = make_anonymous_mount_file(mount, conf->lsm_aa_allow_nesting);
19b5d755 2419 if (!f)
9fc7f8c0 2420 return -1;
e7938e9e 2421
c85ced65 2422 return mount_file_entries(conf, rootfs, f, lxc_name, lxc_path);
e7938e9e
MN		 2423}
2424
bab88e68
CS		 2425static int parse_cap(const char *cap)
2426{
84760c11 2427 size_t i;
2428 int capid = -1;
0fd73091
CB		 2429 size_t end = sizeof(caps_opt) / sizeof(caps_opt[0]);
2430 char *ptr = NULL;
bab88e68 2431
0fd73091 2432 if (strcmp(cap, "none") == 0)
7035407c
DE		 2433 return -2;
2434
8560cd36 2435 for (i = 0; i < end; i++) {
bab88e68
CS		 2436 if (strcmp(cap, caps_opt[i].name))
2437 continue;
2438
2439 capid = caps_opt[i].value;
2440 break;
2441 }
2442
2443 if (capid < 0) {
0fd73091
CB		 2444 /* Try to see if it's numeric, so the user may specify
2445 * capabilities that the running kernel knows about but we
2446 * don't
2447 */
bab88e68
CS		 2448 errno = 0;
2449 capid = strtol(cap, &ptr, 10);
2450 if (!ptr || *ptr != '\0' || errno != 0)
2451 /* not a valid number */
2452 capid = -1;
2453 else if (capid > lxc_caps_last_cap())
2454 /* we have a number but it's not a valid
2455 * capability */
2456 capid = -1;
2457 }
2458
2459 return capid;
2460}
2461
0769b82a
CS		 2462int in_caplist(int cap, struct lxc_list *caps)
2463{
0769b82a 2464 int capid;
0fd73091 2465 struct lxc_list *iterator;
0769b82a 2466
0fd73091 2467 lxc_list_for_each (iterator, caps) {
0769b82a
CS		 2468 capid = parse_cap(iterator->elem);
2469 if (capid == cap)
2470 return 1;
2471 }
2472
2473 return 0;
2474}
2475
81810dd1
DL		 2476static int setup_caps(struct lxc_list *caps)
2477{
bab88e68 2478 int capid;
0fd73091
CB		 2479 char *drop_entry;
2480 struct lxc_list *iterator;
81810dd1 2481
0fd73091
CB		 2482 lxc_list_for_each (iterator, caps) {
2483 int ret;
81810dd1
DL		 2484
2485 drop_entry = iterator->elem;
2486
bab88e68 2487 capid = parse_cap(drop_entry);
0fd73091 2488 if (capid < 0) {
1e11be34
DL		 2489 ERROR("unknown capability %s", drop_entry);
2490 return -1;
81810dd1
DL		 2491 }
2492
b81689a1
CB		 2493 ret = prctl(PR_CAPBSET_DROP, prctl_arg(capid), prctl_arg(0),
2494 prctl_arg(0), prctl_arg(0));
0fd73091
CB		 2495 if (ret < 0) {
2496 SYSERROR("Failed to remove %s capability", drop_entry);
3ec1648d
SH		 2497 return -1;
2498 }
0fd73091 2499 DEBUG("Dropped %s (%d) capability", drop_entry, capid);
81810dd1
DL		 2500 }
2501
0fd73091 2502 DEBUG("Capabilities have been setup");
1fb86a7c
SH		 2503 return 0;
2504}
2505
2506static int dropcaps_except(struct lxc_list *caps)
2507{
2f443e88 2508 __do_free int *caplist = NULL;
0fd73091 2509 int i, capid, numcaps;
1fb86a7c 2510 char *keep_entry;
0fd73091 2511 struct lxc_list *iterator;
1fb86a7c 2512
0fd73091 2513 numcaps = lxc_caps_last_cap() + 1;
2caf9a97
SH		 2514 if (numcaps <= 0 || numcaps > 200)
2515 return -1;
0fd73091 2516 TRACE("Found %d capabilities", numcaps);
2caf9a97 2517
1a0e70ac 2518 /* caplist[i] is 1 if we keep capability i */
2f443e88 2519 caplist = must_realloc(NULL, numcaps * sizeof(int));
1fb86a7c
SH		 2520 memset(caplist, 0, numcaps * sizeof(int));
2521
0fd73091 2522 lxc_list_for_each (iterator, caps) {
1fb86a7c
SH		 2523 keep_entry = iterator->elem;
2524
bab88e68 2525 capid = parse_cap(keep_entry);
7035407c
DE		 2526 if (capid == -2)
2527 continue;
2528
0fd73091
CB		 2529 if (capid < 0) {
2530 ERROR("Unknown capability %s", keep_entry);
1fb86a7c
SH		 2531 return -1;
2532 }
2533
0fd73091 2534 DEBUG("Keep capability %s (%d)", keep_entry, capid);
1fb86a7c
SH		 2535 caplist[capid] = 1;
2536 }
0fd73091
CB		 2537
2538 for (i = 0; i < numcaps; i++) {
2539 int ret;
2540
1fb86a7c
SH		 2541 if (caplist[i])
2542 continue;
0fd73091 2543
b81689a1
CB		 2544 ret = prctl(PR_CAPBSET_DROP, prctl_arg(i), prctl_arg(0),
2545 prctl_arg(0), prctl_arg(0));
0fd73091
CB		 2546 if (ret < 0) {
2547 SYSERROR("Failed to remove capability %d", i);
3ec1648d
SH		 2548 return -1;
2549 }
1fb86a7c
SH		 2550 }
2551
0fd73091 2552 DEBUG("Capabilities have been setup");
81810dd1
DL		 2553 return 0;
2554}
2555
0fd73091
CB		 2556static int parse_resource(const char *res)
2557{
2558 int ret;
c6d09e15
WB		 2559 size_t i;
2560 int resid = -1;
2561
0fd73091 2562 for (i = 0; i < sizeof(limit_opt) / sizeof(limit_opt[0]); ++i)
c6d09e15
WB		 2563 if (strcmp(res, limit_opt[i].name) == 0)
2564 return limit_opt[i].value;
c6d09e15 2565
0fd73091 2566 /* Try to see if it's numeric, so the user may specify
c6d09e15 2567 * resources that the running kernel knows about but
0fd73091
CB		 2568 * we don't.
2569 */
2570 ret = lxc_safe_int(res, &resid);
2571 if (ret < 0)
2572 return -1;
2573
2574 return resid;
c6d09e15
WB		 2575}
2576
0fd73091
CB		 2577int setup_resource_limits(struct lxc_list *limits, pid_t pid)
2578{
2579 int resid;
c6d09e15
WB		 2580 struct lxc_list *it;
2581 struct lxc_limit *lim;
c6d09e15 2582
0fd73091 2583 lxc_list_for_each (it, limits) {
c6d09e15
WB		 2584 lim = it->elem;
2585
2586 resid = parse_resource(lim->resource);
2587 if (resid < 0) {
0fd73091 2588 ERROR("Unknown resource %s", lim->resource);
c6d09e15
WB		 2589 return -1;
2590 }
2591
f48b5fd8 2592#if HAVE_PRLIMIT || HAVE_PRLIMIT64
c6d09e15 2593 if (prlimit(pid, resid, &lim->limit, NULL) != 0) {
6d1400b5 2594 SYSERROR("Failed to set limit %s", lim->resource);
c6d09e15
WB		 2595 return -1;
2596 }
2de12765
CB		 2597
2598 TRACE("Setup \"%s\" limit", lim->resource);
f48b5fd8 2599#else
2de12765 2600 ERROR("Cannot set limit \"%s\" as prlimit is missing", lim->resource);
f48b5fd8
FF		 2601 return -1;
2602#endif
c6d09e15 2603 }
0fd73091 2604
c6d09e15
WB		 2605 return 0;
2606}
2607
7edd0540
L		 2608int setup_sysctl_parameters(struct lxc_list *sysctls)
2609{
e6f76452 2610 __do_free char *tmp = NULL;
7edd0540
L		 2611 struct lxc_list *it;
2612 struct lxc_sysctl *elem;
0fd73091 2613 int ret = 0;
6b5a54cd 2614 char filename[PATH_MAX] = {0};
7edd0540 2615
0fd73091 2616 lxc_list_for_each (it, sysctls) {
7edd0540
L		 2617 elem = it->elem;
2618 tmp = lxc_string_replace(".", "/", elem->key);
2619 if (!tmp) {
2620 ERROR("Failed to replace key %s", elem->key);
2621 return -1;
2622 }
2623
2624 ret = snprintf(filename, sizeof(filename), "/proc/sys/%s", tmp);
7edd0540
L		 2625 if (ret < 0 || (size_t)ret >= sizeof(filename)) {
2626 ERROR("Error setting up sysctl parameters path");
2627 return -1;
2628 }
2629
0fd73091 2630 ret = lxc_write_to_file(filename, elem->value,
7cea5905 2631 strlen(elem->value), false, 0666);
7edd0540 2632 if (ret < 0) {
688e8982
WB		 2633 SYSERROR("Failed to setup sysctl parameters %s to %s",
2634 elem->key, elem->value);
7edd0540
L		 2635 return -1;
2636 }
2637 }
0fd73091 2638
7edd0540
L		 2639 return 0;
2640}
2641
61d7a733
YT		 2642int setup_proc_filesystem(struct lxc_list *procs, pid_t pid)
2643{
0c669152 2644 __do_free char *tmp = NULL;
61d7a733
YT		 2645 struct lxc_list *it;
2646 struct lxc_proc *elem;
0fd73091 2647 int ret = 0;
6b5a54cd 2648 char filename[PATH_MAX] = {0};
61d7a733 2649
0fd73091 2650 lxc_list_for_each (it, procs) {
61d7a733
YT		 2651 elem = it->elem;
2652 tmp = lxc_string_replace(".", "/", elem->filename);
2653 if (!tmp) {
2654 ERROR("Failed to replace key %s", elem->filename);
2655 return -1;
2656 }
2657
2658 ret = snprintf(filename, sizeof(filename), "/proc/%d/%s", pid, tmp);
61d7a733
YT		 2659 if (ret < 0 || (size_t)ret >= sizeof(filename)) {
2660 ERROR("Error setting up proc filesystem path");
2661 return -1;
2662 }
2663
0fd73091 2664 ret = lxc_write_to_file(filename, elem->value,
7cea5905 2665 strlen(elem->value), false, 0666);
61d7a733 2666 if (ret < 0) {
688e8982
WB		 2667 SYSERROR("Failed to setup proc filesystem %s to %s",
2668 elem->filename, elem->value);
61d7a733
YT		 2669 return -1;
2670 }
2671 }
0fd73091 2672
61d7a733
YT		 2673 return 0;
2674}
2675
ae9242c8
SH		 2676static char *default_rootfs_mount = LXCROOTFSMOUNT;
2677
7b379ab3 2678struct lxc_conf *lxc_conf_init(void)
089cd8b8 2679{
26ddeedd 2680 int i;
0fd73091 2681 struct lxc_conf *new;
7b379ab3 2682
13277ec4 2683 new = malloc(sizeof(*new));
0fd73091 2684 if (!new)
7b379ab3 2685 return NULL;
7b379ab3
MN		 2686 memset(new, 0, sizeof(*new));
2687
4b73005c 2688 new->loglevel = LXC_LOG_LEVEL_NOTSET;
cccc74b5 2689 new->personality = -1;
124fa0a8 2690 new->autodev = 1;
3a784510 2691 new->console.buffer_size = 0;
596a818d
DE		 2692 new->console.log_path = NULL;
2693 new->console.log_fd = -1;
861813e5 2694 new->console.log_size = 0;
28a4b0e5 2695 new->console.path = NULL;
63376d7d 2696 new->console.peer = -1;
fb87aa6a
CB		 2697 new->console.proxy.busy = -1;
2698 new->console.proxy.master = -1;
2699 new->console.proxy.slave = -1;
63376d7d
DL		 2700 new->console.master = -1;
2701 new->console.slave = -1;
2702 new->console.name[0] = '\0';
732375f5 2703 memset(&new->console.ringbuf, 0, sizeof(struct lxc_ringbuf));
d2e30e99 2704 new->maincmd_fd = -1;
258f8051 2705 new->monitor_signal_pdeath = SIGKILL;
76a26f55 2706 new->nbd_idx = -1;
54c30e29 2707 new->rootfs.mount = strdup(default_rootfs_mount);
53f3f048 2708 if (!new->rootfs.mount) {
53f3f048
SH		 2709 free(new);
2710 return NULL;
2711 }
6e54330c 2712 new->rootfs.managed = true;
858377e4 2713 new->logfd = -1;
7b379ab3 2714 lxc_list_init(&new->cgroup);
54860ed0 2715 lxc_list_init(&new->cgroup2);
7b379ab3
MN		 2716 lxc_list_init(&new->network);
2717 lxc_list_init(&new->mount_list);
81810dd1 2718 lxc_list_init(&new->caps);
1fb86a7c 2719 lxc_list_init(&new->keepcaps);
f6d3e3e4 2720 lxc_list_init(&new->id_map);
46ad64ab
CB		 2721 new->root_nsuid_map = NULL;
2722 new->root_nsgid_map = NULL;
f979ac15 2723 lxc_list_init(&new->includes);
4184c3e1 2724 lxc_list_init(&new->aliens);
7c661726 2725 lxc_list_init(&new->environment);
c6d09e15 2726 lxc_list_init(&new->limits);
7edd0540 2727 lxc_list_init(&new->sysctls);
61d7a733 2728 lxc_list_init(&new->procs);
44ae0fb6 2729 new->hooks_version = 0;
28d9e29e 2730 for (i = 0; i < NUM_LXC_HOOKS; i++)
26ddeedd 2731 lxc_list_init(&new->hooks[i]);
ee1e7aa0 2732 lxc_list_init(&new->groups);
d39b10eb 2733 lxc_list_init(&new->state_clients);
fe4de9a6 2734 new->lsm_aa_profile = NULL;
1800f924 2735 lxc_list_init(&new->lsm_aa_raw);
fe4de9a6 2736 new->lsm_se_context = NULL;
7a0bcca3 2737 new->tmp_umount_proc = false;
7a41e857
LT		 2738 new->tmp_umount_proc = 0;
2739 new->shmount.path_host = NULL;
2740 new->shmount.path_cont = NULL;
7b379ab3 2741
72bb04e4
PT		 2742 /* if running in a new user namespace, init and COMMAND
2743 * default to running as UID/GID 0 when using lxc-execute */
2744 new->init_uid = 0;
2745 new->init_gid = 0;
43654d34 2746 memset(&new->cgroup_meta, 0, sizeof(struct lxc_cgroup));
b074bbf1 2747 memset(&new->ns_share, 0, sizeof(char *) * LXC_NS_MAX);
72bb04e4 2748
7b379ab3 2749 return new;
089cd8b8
DL		 2750}
2751
344c9d81 2752int write_id_mapping(enum idtype idtype, pid_t pid, const char *buf,
a19b974f 2753 size_t buf_size)
f6d3e3e4 2754{
29053180 2755 int fd, ret;
6b5a54cd 2756 char path[PATH_MAX];
f6d3e3e4 2757
a19b974f
CB		 2758 if (geteuid() != 0 && idtype == ID_TYPE_GID) {
2759 size_t buflen;
2760
6b5a54cd
CB		 2761 ret = snprintf(path, PATH_MAX, "/proc/%d/setgroups", pid);
2762 if (ret < 0 || ret >= PATH_MAX)
a19b974f 2763 return -E2BIG;
a19b974f
CB		 2764
2765 fd = open(path, O_WRONLY);
2766 if (fd < 0 && errno != ENOENT) {
2767 SYSERROR("Failed to open \"%s\"", path);
2768 return -1;
2769 }
2770
2388737b 2771 if (fd >= 0) {
6333c915 2772 buflen = STRLITERALLEN("deny\n");
2388737b
CB		 2773 errno = 0;
2774 ret = lxc_write_nointr(fd, "deny\n", buflen);
395b1a3e 2775 close(fd);
2388737b 2776 if (ret != buflen) {
0fd73091
CB		 2777 SYSERROR("Failed to write \"deny\" to "
2778 "\"/proc/%d/setgroups\"", pid);
2388737b
CB		 2779 return -1;
2780 }
395b1a3e 2781 TRACE("Wrote \"deny\" to \"/proc/%d/setgroups\"", pid);
a19b974f 2782 }
a19b974f
CB		 2783 }
2784
6b5a54cd 2785 ret = snprintf(path, PATH_MAX, "/proc/%d/%cid_map", pid,
29053180 2786 idtype == ID_TYPE_UID ? 'u' : 'g');
6b5a54cd 2787 if (ret < 0 || ret >= PATH_MAX)
f6d3e3e4 2788 return -E2BIG;
29053180
CB		 2789
2790 fd = open(path, O_WRONLY);
2791 if (fd < 0) {
a19b974f 2792 SYSERROR("Failed to open \"%s\"", path);
29053180 2793 return -1;
f6d3e3e4 2794 }
29053180
CB		 2795
2796 errno = 0;
2797 ret = lxc_write_nointr(fd, buf, buf_size);
395b1a3e 2798 close(fd);
29053180 2799 if (ret != buf_size) {
a19b974f 2800 SYSERROR("Failed to write %cid mapping to \"%s\"",
29053180 2801 idtype == ID_TYPE_UID ? 'u' : 'g', path);
29053180
CB		 2802 return -1;
2803 }
29053180
CB		 2804
2805 return 0;
f6d3e3e4
SH		 2806}
2807
6e50e704
CB		 2808/* Check whether a binary exist and has either CAP_SETUID, CAP_SETGID or both.
2809 *
2810 * @return 1 if functional binary was found
2811 * @return 0 if binary exists but is lacking privilege
2812 * @return -ENOENT if binary does not exist
2813 * @return -EINVAL if cap to check is neither CAP_SETUID nor CAP_SETGID
6e50e704 2814 */
df6a2945
CB		 2815static int idmaptool_on_path_and_privileged(const char *binary, cap_value_t cap)
2816{
48411df2 2817 __do_free char *path = NULL;
df6a2945
CB		 2818 int ret;
2819 struct stat st;
2820 int fret = 0;
2821
3275932b 2822 errno = EINVAL;
6e50e704 2823 if (cap != CAP_SETUID && cap != CAP_SETGID)
3275932b 2824 return -1;
6e50e704 2825
3275932b 2826 errno = ENOENT;
df6a2945
CB		 2827 path = on_path(binary, NULL);
2828 if (!path)
3275932b 2829 return -1;
df6a2945
CB		 2830
2831 ret = stat(path, &st);
3275932b
CB		 2832 if (ret < 0)
2833 return -1;
df6a2945
CB		 2834
2835 /* Check if the binary is setuid. */
2836 if (st.st_mode & S_ISUID) {
0fd73091 2837 DEBUG("The binary \"%s\" does have the setuid bit set", path);
3275932b 2838 return 1;
df6a2945
CB		 2839 }
2840
0fd73091 2841#if HAVE_LIBCAP && LIBCAP_SUPPORTS_FILE_CAPABILITIES
df6a2945
CB		 2842 /* Check if it has the CAP_SETUID capability. */
2843 if ((cap & CAP_SETUID) &&
2844 lxc_file_cap_is_set(path, CAP_SETUID, CAP_EFFECTIVE) &&
2845 lxc_file_cap_is_set(path, CAP_SETUID, CAP_PERMITTED)) {
2846 DEBUG("The binary \"%s\" has CAP_SETUID in its CAP_EFFECTIVE "
0fd73091 2847 "and CAP_PERMITTED sets", path);
3275932b 2848 return 1;
df6a2945
CB		 2849 }
2850
2851 /* Check if it has the CAP_SETGID capability. */
2852 if ((cap & CAP_SETGID) &&
2853 lxc_file_cap_is_set(path, CAP_SETGID, CAP_EFFECTIVE) &&
2854 lxc_file_cap_is_set(path, CAP_SETGID, CAP_PERMITTED)) {
2855 DEBUG("The binary \"%s\" has CAP_SETGID in its CAP_EFFECTIVE "
0fd73091 2856 "and CAP_PERMITTED sets", path);
3275932b 2857 return 1;
df6a2945 2858 }
0fd73091 2859#else
69924fff
CB		 2860 /* If we cannot check for file capabilities we need to give the benefit
2861 * of the doubt. Otherwise we might fail even though all the necessary
2862 * file capabilities are set.
2863 */
ffc40301 2864 DEBUG("Cannot check for file capabilities as full capability support is "
0fd73091 2865 "missing. Manual intervention needed");
0fd73091 2866#endif
df6a2945 2867
3275932b 2868 return 1;
df6a2945
CB		 2869}
2870
986ef930
CB		 2871int lxc_map_ids_exec_wrapper(void *args)
2872{
2873 execl("/bin/sh", "sh", "-c", (char *)args, (char *)NULL);
2874 return -1;
2875}
2876
f6d3e3e4
SH		 2877int lxc_map_ids(struct lxc_list *idmap, pid_t pid)
2878{
0fd73091 2879 int fill, left;
986ef930 2880 char u_or_g;
4bc3b759 2881 char *pos;
6b5a54cd 2882 char cmd_output[PATH_MAX];
0fd73091
CB		 2883 struct id_map *map;
2884 struct lxc_list *iterator;
2885 enum idtype type;
986ef930
CB		 2886 /* strlen("new@idmap") = 9
2887 * +
2888 * strlen(" ") = 1
2889 * +
d33968ad 2890 * INTTYPE_TO_STRLEN(uint32_t)
986ef930
CB		 2891 * +
2892 * strlen(" ") = 1
2893 *
2894 * We add some additional space to make sure that we really have
2895 * LXC_IDMAPLEN bytes available for our the {g,u]id mapping.
2896 */
0fd73091 2897 int ret = 0, gidmap = 0, uidmap = 0;
d33968ad 2898 char mapbuf[9 + 1 + INTTYPE_TO_STRLEN(uint32_t) + 1 + LXC_IDMAPLEN] = {0};
0fd73091 2899 bool had_entry = false, use_shadow = false;
c724025c
JC		 2900 int hostuid, hostgid;
2901
2902 hostuid = geteuid();
2903 hostgid = getegid();
df6a2945
CB		 2904
2905 /* If new{g,u}idmap exists, that is, if shadow is handing out subuid
2906 * ranges, then insist that root also reserve ranges in subuid. This
22038de5
SH		 2907 * will protected it by preventing another user from being handed the
2908 * range by shadow.
2909 */
df6a2945 2910 uidmap = idmaptool_on_path_and_privileged("newuidmap", CAP_SETUID);
6e50e704
CB		 2911 if (uidmap == -ENOENT)
2912 WARN("newuidmap binary is missing");
2913 else if (!uidmap)
2914 WARN("newuidmap is lacking necessary privileges");
2915
df6a2945 2916 gidmap = idmaptool_on_path_and_privileged("newgidmap", CAP_SETGID);
6e50e704
CB		 2917 if (gidmap == -ENOENT)
2918 WARN("newgidmap binary is missing");
2919 else if (!gidmap)
2920 WARN("newgidmap is lacking necessary privileges");
2921
df6a2945 2922 if (uidmap > 0 && gidmap > 0) {
0fd73091 2923 DEBUG("Functional newuidmap and newgidmap binary found");
4bc3b759 2924 use_shadow = true;
df6a2945 2925 } else {
99d43365
CB		 2926 /* In case unprivileged users run application containers via
2927 * execute() or a start*() there are valid cases where they may
2928 * only want to map their own {g,u}id. Let's not block them from
2929 * doing so by requiring geteuid() == 0.
2930 */
2931 DEBUG("No newuidmap and newgidmap binary found. Trying to "
c724025c
JC		 2932 "write directly with euid %d", hostuid);
2933 }
2934
2935 /* Check if we really need to use newuidmap and newgidmap.
2936 * If the user is only remapping his own {g,u}id, we don't need it.
2937 */
2938 if (use_shadow && lxc_list_len(idmap) == 2) {
2939 use_shadow = false;
2940 lxc_list_for_each(iterator, idmap) {
2941 map = iterator->elem;
2942 if (map->idtype == ID_TYPE_UID && map->range == 1 &&
2943 map->nsid == hostuid && map->hostid == hostuid)
2944 continue;
2945 if (map->idtype == ID_TYPE_GID && map->range == 1 &&
2946 map->nsid == hostgid && map->hostid == hostgid)
2947 continue;
2948 use_shadow = true;
2949 break;
2950 }
0e6e3a41 2951 }
251d0d2a 2952
986ef930
CB		 2953 for (type = ID_TYPE_UID, u_or_g = 'u'; type <= ID_TYPE_GID;
2954 type++, u_or_g = 'g') {
2955 pos = mapbuf;
2956
0e6e3a41 2957 if (use_shadow)
986ef930 2958 pos += sprintf(mapbuf, "new%cidmap %d", u_or_g, pid);
4f7521b4 2959
cf3ef16d 2960 lxc_list_for_each(iterator, idmap) {
251d0d2a 2961 map = iterator->elem;
cf3ef16d
SH		 2962 if (map->idtype != type)
2963 continue;
2964
4bc3b759
CB		 2965 had_entry = true;
2966
986ef930 2967 left = LXC_IDMAPLEN - (pos - mapbuf);
d1838f34 2968 fill = snprintf(pos, left, "%s%lu %lu %lu%s",
4bc3b759
CB		 2969 use_shadow ? " " : "", map->nsid,
2970 map->hostid, map->range,
0e6e3a41 2971 use_shadow ? "" : "\n");
a427e268
CB		 2972 if (fill <= 0 || fill >= left) {
2973 /* The kernel only takes <= 4k for writes to
2974 * /proc/<pid>/{g,u}id_map
2975 */
2976 SYSERROR("Too many %cid mappings defined", u_or_g);
2977 return -1;
2978 }
4bc3b759 2979
cf3ef16d 2980 pos += fill;
251d0d2a 2981 }
cf3ef16d 2982 if (!had_entry)
4f7521b4 2983 continue;
cf3ef16d 2984
d85813cd 2985 /* Try to catch the output of new{g,u}idmap to make debugging
986ef930
CB		 2986 * easier.
2987 */
2988 if (use_shadow) {
2989 ret = run_command(cmd_output, sizeof(cmd_output),
2990 lxc_map_ids_exec_wrapper,
2991 (void *)mapbuf);
2992 if (ret < 0) {
54fbbeb5
CB		 2993 ERROR("new%cidmap failed to write mapping \"%s\": %s",
2994 u_or_g, cmd_output, mapbuf);
986ef930
CB		 2995 return -1;
2996 }
54fbbeb5 2997 TRACE("new%cidmap wrote mapping \"%s\"", u_or_g, mapbuf);
d1838f34 2998 } else {
986ef930 2999 ret = write_id_mapping(type, pid, mapbuf, pos - mapbuf);
54fbbeb5 3000 if (ret < 0) {
da0f9977 3001 ERROR("Failed to write mapping: %s", mapbuf);
986ef930 3002 return -1;
54fbbeb5
CB		 3003 }
3004 TRACE("Wrote mapping \"%s\"", mapbuf);
d1838f34 3005 }
986ef930
CB		 3006
3007 memset(mapbuf, 0, sizeof(mapbuf));
f6d3e3e4 3008 }
251d0d2a 3009
986ef930 3010 return 0;
f6d3e3e4
SH		 3011}
3012
0fd73091 3013/* Return the host uid/gid to which the container root is mapped in val.
0b3a6504 3014 * Return true if id was found, false otherwise.
cf3ef16d 3015 */
2a9a80cb 3016bool get_mapped_rootid(struct lxc_conf *conf, enum idtype idtype,
4160c3a0 3017 unsigned long *val)
cf3ef16d 3018{
4160c3a0 3019 unsigned nsid;
0fd73091
CB		 3020 struct id_map *map;
3021 struct lxc_list *it;
4160c3a0
CB		 3022
3023 if (idtype == ID_TYPE_UID)
3024 nsid = (conf->root_nsuid_map != NULL) ? 0 : conf->init_uid;
3025 else
3026 nsid = (conf->root_nsgid_map != NULL) ? 0 : conf->init_gid;
cf3ef16d 3027
0fd73091 3028 lxc_list_for_each (it, &conf->id_map) {
cf3ef16d 3029 map = it->elem;
7b50c609 3030 if (map->idtype != idtype)
cf3ef16d 3031 continue;
4160c3a0 3032 if (map->nsid != nsid)
cf3ef16d 3033 continue;
2a9a80cb
SH		 3034 *val = map->hostid;
3035 return true;
cf3ef16d 3036 }
4160c3a0 3037
2a9a80cb 3038 return false;
cf3ef16d
SH		 3039}
3040
2133f58c 3041int mapped_hostid(unsigned id, struct lxc_conf *conf, enum idtype idtype)
cf3ef16d 3042{
cf3ef16d 3043 struct id_map *map;
0fd73091
CB		 3044 struct lxc_list *it;
3045
3046 lxc_list_for_each (it, &conf->id_map) {
cf3ef16d 3047 map = it->elem;
2133f58c 3048 if (map->idtype != idtype)
cf3ef16d 3049 continue;
0fd73091 3050
cf3ef16d 3051 if (id >= map->hostid && id < map->hostid + map->range)
57d116ab 3052 return (id - map->hostid) + map->nsid;
cf3ef16d 3053 }
0fd73091 3054
57d116ab 3055 return -1;
cf3ef16d
SH		 3056}
3057
339efad9 3058int find_unmapped_nsid(struct lxc_conf *conf, enum idtype idtype)
cf3ef16d 3059{
cf3ef16d 3060 struct id_map *map;
0fd73091 3061 struct lxc_list *it;
2133f58c 3062 unsigned int freeid = 0;
0fd73091 3063
cf3ef16d 3064again:
0fd73091 3065 lxc_list_for_each (it, &conf->id_map) {
cf3ef16d 3066 map = it->elem;
2133f58c 3067 if (map->idtype != idtype)
cf3ef16d 3068 continue;
0fd73091 3069
cf3ef16d
SH		 3070 if (freeid >= map->nsid && freeid < map->nsid + map->range) {
3071 freeid = map->nsid + map->range;
3072 goto again;
3073 }
3074 }
0fd73091 3075
cf3ef16d
SH		 3076 return freeid;
3077}
3078
f4f52cb5
CB		 3079int chown_mapped_root_exec_wrapper(void *args)
3080{
3081 execvp("lxc-usernsexec", args);
3082 return -1;
3083}
3084
0fd73091 3085/* chown_mapped_root: for an unprivileged user with uid/gid X to
7b50c609
TS		 3086 * chown a dir to subuid/subgid Y, he needs to run chown as root
3087 * in a userns where nsid 0 is mapped to hostuid/hostgid Y, and
3088 * nsid Y is mapped to hostuid/hostgid X. That way, the container
3089 * root is privileged with respect to hostuid/hostgid X, allowing
3090 * him to do the chown.
f6d3e3e4 3091 */
41dc7155 3092int chown_mapped_root(const char *path, struct lxc_conf *conf)
f6d3e3e4 3093{
f4f52cb5 3094 uid_t rootuid, rootgid;
2a9a80cb 3095 unsigned long val;
f4f52cb5
CB		 3096 int hostuid, hostgid, ret;
3097 struct stat sb;
3098 char map1[100], map2[100], map3[100], map4[100], map5[100];
3099 char ugid[100];
41dc7155 3100 const char *args1[] = {"lxc-usernsexec",
f4f52cb5
CB		 3101 "-m", map1,
3102 "-m", map2,
3103 "-m", map3,
3104 "-m", map5,
3105 "--", "chown", ugid, path,
3106 NULL};
41dc7155 3107 const char *args2[] = {"lxc-usernsexec",
f4f52cb5
CB		 3108 "-m", map1,
3109 "-m", map2,
3110 "-m", map3,
3111 "-m", map4,
3112 "-m", map5,
3113 "--", "chown", ugid, path,
3114 NULL};
6b5a54cd 3115 char cmd_output[PATH_MAX];
f4f52cb5
CB		 3116
3117 hostuid = geteuid();
3118 hostgid = getegid();
f6d3e3e4 3119
2a9a80cb 3120 if (!get_mapped_rootid(conf, ID_TYPE_UID, &val)) {
bc80f098 3121 ERROR("No uid mapping for container root");
c4d10a05 3122 return -1;
f6d3e3e4 3123 }
f4f52cb5 3124 rootuid = (uid_t)val;
0fd73091 3125
7b50c609 3126 if (!get_mapped_rootid(conf, ID_TYPE_GID, &val)) {
bc80f098 3127 ERROR("No gid mapping for container root");
7b50c609
TS		 3128 return -1;
3129 }
f4f52cb5 3130 rootgid = (gid_t)val;
2a9a80cb 3131
f4f52cb5 3132 if (hostuid == 0) {
7b50c609 3133 if (chown(path, rootuid, rootgid) < 0) {
c4d10a05
SH		 3134 ERROR("Error chowning %s", path);
3135 return -1;
3136 }
0fd73091 3137
c4d10a05
SH		 3138 return 0;
3139 }
f3d7e4ca 3140
f4f52cb5 3141 if (rootuid == hostuid) {
1a0e70ac 3142 /* nothing to do */
b103ceac 3143 INFO("Container root is our uid; no need to chown");
f3d7e4ca
SH		 3144 return 0;
3145 }
3146
bbdbf8f0 3147 /* save the current gid of "path" */
f4f52cb5
CB		 3148 if (stat(path, &sb) < 0) {
3149 ERROR("Error stat %s", path);
f6d3e3e4
SH		 3150 return -1;
3151 }
7b50c609 3152
bbdbf8f0
CB		 3153 /* Update the path argument in case this was overlayfs. */
3154 args1[sizeof(args1) / sizeof(args1[0]) - 2] = path;
3155 args2[sizeof(args2) / sizeof(args2[0]) - 2] = path;
3156
f4f52cb5
CB		 3157 /*
3158 * A file has to be group-owned by a gid mapped into the
3159 * container, or the container won't be privileged over it.
3160 */
3161 DEBUG("trying to chown \"%s\" to %d", path, hostgid);
3162 if (sb.st_uid == hostuid &&
3163 mapped_hostid(sb.st_gid, conf, ID_TYPE_GID) < 0 &&
3164 chown(path, -1, hostgid) < 0) {
3165 ERROR("Failed chgrping %s", path);
3166 return -1;
3167 }
f6d3e3e4 3168
1a0e70ac 3169 /* "u:0:rootuid:1" */
f4f52cb5
CB		 3170 ret = snprintf(map1, 100, "u:0:%d:1", rootuid);
3171 if (ret < 0 || ret >= 100) {
3172 ERROR("Error uid printing map string");
3173 return -1;
3174 }
7b50c609 3175
1a0e70ac 3176 /* "u:hostuid:hostuid:1" */
f4f52cb5
CB		 3177 ret = snprintf(map2, 100, "u:%d:%d:1", hostuid, hostuid);
3178 if (ret < 0 || ret >= 100) {
3179 ERROR("Error uid printing map string");
3180 return -1;
3181 }
c4d10a05 3182
1a0e70ac 3183 /* "g:0:rootgid:1" */
f4f52cb5
CB		 3184 ret = snprintf(map3, 100, "g:0:%d:1", rootgid);
3185 if (ret < 0 || ret >= 100) {
3186 ERROR("Error gid printing map string");
3187 return -1;
3188 }
98e5ba51 3189
1a0e70ac 3190 /* "g:pathgid:rootgid+pathgid:1" */
f4f52cb5
CB		 3191 ret = snprintf(map4, 100, "g:%d:%d:1", (gid_t)sb.st_gid,
3192 rootgid + (gid_t)sb.st_gid);
3193 if (ret < 0 || ret >= 100) {
3194 ERROR("Error gid printing map string");
3195 return -1;
3196 }
c4d10a05 3197
1a0e70ac 3198 /* "g:hostgid:hostgid:1" */
f4f52cb5
CB		 3199 ret = snprintf(map5, 100, "g:%d:%d:1", hostgid, hostgid);
3200 if (ret < 0 || ret >= 100) {
3201 ERROR("Error gid printing map string");
3202 return -1;
3203 }
7b50c609 3204
1a0e70ac 3205 /* "0:pathgid" (chown) */
f4f52cb5
CB		 3206 ret = snprintf(ugid, 100, "0:%d", (gid_t)sb.st_gid);
3207 if (ret < 0 || ret >= 100) {
3208 ERROR("Error owner printing format string for chown");
3209 return -1;
3210 }
7b50c609 3211
f4f52cb5
CB		 3212 if (hostgid == sb.st_gid)
3213 ret = run_command(cmd_output, sizeof(cmd_output),
3214 chown_mapped_root_exec_wrapper,
3215 (void *)args1);
3216 else
3217 ret = run_command(cmd_output, sizeof(cmd_output),
3218 chown_mapped_root_exec_wrapper,
3219 (void *)args2);
3220 if (ret < 0)
3221 ERROR("lxc-usernsexec failed: %s", cmd_output);
7b50c609 3222
f4f52cb5 3223 return ret;
f6d3e3e4
SH		 3224}
3225
943144d9
CB		 3226/* NOTE: Must not be called from inside the container namespace! */
3227int lxc_create_tmp_proc_mount(struct lxc_conf *conf)
5112cd70
SH		 3228{
3229 int mounted;
3230
943144d9 3231 mounted = lxc_mount_proc_if_needed(conf->rootfs.path ? conf->rootfs.mount : "");
5112cd70 3232 if (mounted == -1) {
0fd73091 3233 SYSERROR("Failed to mount proc in the container");
01958b1f 3234 /* continue only if there is no rootfs */
943144d9 3235 if (conf->rootfs.path)
01958b1f 3236 return -1;
5112cd70 3237 } else if (mounted == 1) {
7a0bcca3 3238 conf->tmp_umount_proc = true;
5112cd70 3239 }
943144d9 3240
5112cd70
SH		 3241 return 0;
3242}
3243
3244void tmp_proc_unmount(struct lxc_conf *lxc_conf)
3245{
7a0bcca3 3246 if (!lxc_conf->tmp_umount_proc)
0fd73091
CB		 3247 return;
3248
7a0bcca3
CB		 3249 (void)umount2("/proc", MNT_DETACH);
3250 lxc_conf->tmp_umount_proc = false;
5112cd70
SH		 3251}
3252
0fd73091 3253/* Walk /proc/mounts and change any shared entries to slave. */
6a0c909a 3254void remount_all_slave(void)
e995d7a2 3255{
7969675f 3256 __do_free char *line = NULL;
003be47b
CB		 3257 __do_fclose FILE *f = NULL;
3258 __do_close_prot_errno int memfd = -EBADF, mntinfo_fd = -EBADF;
3259 int ret;
6a49f05e 3260 ssize_t copied;
e995d7a2
SH		 3261 size_t len = 0;
3262
6a49f05e 3263 mntinfo_fd = open("/proc/self/mountinfo", O_RDONLY | O_CLOEXEC);
fea3b91d
DJ		 3264 if (mntinfo_fd < 0) {
3265 SYSERROR("Failed to open \"/proc/self/mountinfo\"");
6a49f05e 3266 return;
fea3b91d 3267 }
6a49f05e
CB		 3268
3269 memfd = memfd_create(".lxc_mountinfo", MFD_CLOEXEC);
3270 if (memfd < 0) {
3271 char template[] = P_tmpdir "/.lxc_mountinfo_XXXXXX";
3272
3273 if (errno != ENOSYS) {
fea3b91d 3274 SYSERROR("Failed to create temporary in-memory file");
6a49f05e
CB		 3275 return;
3276 }
3277
3278 memfd = lxc_make_tmpfile(template, true);
fea3b91d 3279 if (memfd < 0) {
fea3b91d
DJ		 3280 WARN("Failed to create temporary file");
3281 return;
3282 }
6a49f05e
CB		 3283 }
3284
6a49f05e 3285again:
7c4d9466 3286 copied = lxc_sendfile_nointr(memfd, mntinfo_fd, NULL, LXC_SENDFILE_MAX);
6a49f05e
CB		 3287 if (copied < 0) {
3288 if (errno == EINTR)
3289 goto again;
3290
fea3b91d 3291 SYSERROR("Failed to copy \"/proc/self/mountinfo\"");
6a49f05e
CB		 3292 return;
3293 }
6a49f05e 3294
6a49f05e
CB		 3295 ret = lseek(memfd, 0, SEEK_SET);
3296 if (ret < 0) {
fea3b91d 3297 SYSERROR("Failed to reset file descriptor offset");
6a49f05e
CB		 3298 return;
3299 }
3300
3301 f = fdopen(memfd, "r");
e995d7a2 3302 if (!f) {
003be47b 3303 SYSERROR("Failed to open copy of \"/proc/self/mountinfo\" to mark all shared. Continuing");
e995d7a2
SH		 3304 return;
3305 }
3306
003be47b
CB		 3307 /*
3308 * After a successful fdopen() memfd will be closed when calling
3309 * fclose(f). Calling close(memfd) afterwards is undefined.
3310 */
3311 move_fd(memfd);
3312
e995d7a2 3313 while (getline(&line, &len, f) != -1) {
0fd73091
CB		 3314 char *opts, *target;
3315
e995d7a2
SH		 3316 target = get_field(line, 4);
3317 if (!target)
3318 continue;
0fd73091 3319
e995d7a2
SH		 3320 opts = get_field(target, 2);
3321 if (!opts)
3322 continue;
0fd73091 3323
e995d7a2
SH		 3324 null_endofword(opts);
3325 if (!strstr(opts, "shared"))
3326 continue;
0fd73091 3327
e995d7a2 3328 null_endofword(target);
0fd73091
CB		 3329 ret = mount(NULL, target, NULL, MS_SLAVE, NULL);
3330 if (ret < 0) {
3331 SYSERROR("Failed to make \"%s\" MS_SLAVE", target);
e995d7a2 3332 ERROR("Continuing...");
6a49f05e 3333 continue;
e995d7a2 3334 }
6a49f05e 3335 TRACE("Remounted \"%s\" as MS_SLAVE", target);
e995d7a2 3336 }
6a49f05e 3337 TRACE("Remounted all mount table entries as MS_SLAVE");
e995d7a2
SH		 3338}
3339
794248d0 3340static int lxc_execute_bind_init(struct lxc_handler *handler)
2322903b
SH		 3341{
3342 int ret;
794248d0
CB		 3343 char *p;
3344 char path[PATH_MAX], destpath[PATH_MAX];
3345 struct lxc_conf *conf = handler->conf;
9d9c111c
SH		 3346
3347 /* If init exists in the container, don't bind mount a static one */
3348 p = choose_init(conf->rootfs.mount);
3349 if (p) {
22f835ba 3350 __do_free char *old = p;
41089848
TA		 3351
3352 p = strdup(old + strlen(conf->rootfs.mount));
41089848
TA		 3353 if (!p)
3354 return -ENOMEM;
3355
3356 INFO("Found existing init at \"%s\"", p);
3357 goto out;
9d9c111c 3358 }
2322903b
SH		 3359
3360 ret = snprintf(path, PATH_MAX, SBINDIR "/init.lxc.static");
0fd73091 3361 if (ret < 0 || ret >= PATH_MAX)
8353b4c9 3362 return -1;
2322903b
SH		 3363
3364 if (!file_exists(path)) {
0fd73091 3365 ERROR("The file \"%s\" does not exist on host", path);
8353b4c9 3366 return -1;
2322903b
SH		 3367 }
3368
794248d0 3369 ret = snprintf(destpath, PATH_MAX, "%s" P_tmpdir "%s", conf->rootfs.mount, "/.lxc-init");
0fd73091 3370 if (ret < 0 || ret >= PATH_MAX)
8353b4c9 3371 return -1;
2322903b
SH		 3372
3373 if (!file_exists(destpath)) {
794248d0
CB		 3374 ret = mknod(destpath, S_IFREG | 0000, 0);
3375 if (ret < 0 && errno != EEXIST) {
3376 SYSERROR("Failed to create dummy \"%s\" file as bind mount target", destpath);
8353b4c9 3377 return -1;
2322903b 3378 }
2322903b
SH		 3379 }
3380
592fd47a 3381 ret = safe_mount(path, destpath, "none", MS_BIND, NULL, conf->rootfs.mount);
8353b4c9 3382 if (ret < 0) {
0fd73091 3383 SYSERROR("Failed to bind mount lxc.init.static into container");
8353b4c9
CB		 3384 return -1;
3385 }
3386
794248d0
CB		 3387 p = strdup(destpath + strlen(conf->rootfs.mount));
3388 if (!p)
3389 return -ENOMEM;
794248d0 3390
8353b4c9 3391 INFO("Bind mounted lxc.init.static into container at \"%s\"", path);
41089848 3392out:
4b5b3a2a 3393 ((struct execute_args *)handler->data)->init_fd = -1;
41089848 3394 ((struct execute_args *)handler->data)->init_path = p;
8353b4c9 3395 return 0;
2322903b
SH		 3396}
3397
0fd73091
CB		 3398/* This does the work of remounting / if it is shared, calling the container
3399 * pre-mount hooks, and mounting the rootfs.
35120d9c 3400 */
8ce1abc2
CB		 3401int lxc_setup_rootfs_prepare_root(struct lxc_conf *conf, const char *name,
3402 const char *lxcpath)
0ad19a3f 3403{
0fd73091
CB		 3404 int ret;
3405
35120d9c 3406 if (conf->rootfs_setup) {
35120d9c 3407 const char *path = conf->rootfs.mount;
0fd73091
CB		 3408
3409 /* The rootfs was set up in another namespace. bind-mount it to
3410 * give us a mount in our own ns so we can pivot_root to it
3411 */
3412 ret = mount(path, path, "rootfs", MS_BIND, NULL);
3413 if (ret < 0) {
3414 ERROR("Failed to bind mount container / onto itself");
145832ba 3415 return -1;
35120d9c 3416 }
0fd73091
CB		 3417
3418 TRACE("Bind mounted container / onto itself");
145832ba 3419 return 0;
35120d9c 3420 }
d4ef7c50 3421
e995d7a2
SH		 3422 remount_all_slave();
3423
0fd73091
CB		 3424 ret = run_lxc_hooks(name, "pre-mount", conf, NULL);
3425 if (ret < 0) {
3426 ERROR("Failed to run pre-mount hooks");
35120d9c
SH		 3427 return -1;
3428 }
3429
8ce1abc2 3430 ret = lxc_mount_rootfs(conf);
0fd73091
CB		 3431 if (ret < 0) {
3432 ERROR("Failed to setup rootfs for");
35120d9c
SH		 3433 return -1;
3434 }
3435
3436 conf->rootfs_setup = true;
3437 return 0;
3438}
3439
1c1c7051
SH		 3440static bool verify_start_hooks(struct lxc_conf *conf)
3441{
6b5a54cd 3442 char path[PATH_MAX];
0fd73091
CB		 3443 struct lxc_list *it;
3444
3445 lxc_list_for_each (it, &conf->hooks[LXCHOOK_START]) {
1c1c7051 3446 int ret;
0fd73091 3447 char *hookname = it->elem;
1c1c7051 3448
6b5a54cd 3449 ret = snprintf(path, PATH_MAX, "%s%s",
0fd73091
CB		 3450 conf->rootfs.path ? conf->rootfs.mount : "",
3451 hookname);
6b5a54cd 3452 if (ret < 0 || ret >= PATH_MAX)
1c1c7051 3453 return false;
0fd73091 3454
75193660 3455 ret = access(path, X_OK);
0fd73091 3456 if (ret < 0) {
75193660 3457 SYSERROR("Start hook \"%s\" not found in container",
0fd73091 3458 hookname);
1c1c7051
SH		 3459 return false;
3460 }
0fd73091 3461
6a0c909a 3462 return true;
1c1c7051
SH		 3463 }
3464
3465 return true;
3466}
3467
4b5b3a2a
TA		 3468static bool execveat_supported(void)
3469{
13be2733 3470 lxc_raw_execveat(-1, "", NULL, NULL, AT_EMPTY_PATH);
4b5b3a2a
TA		 3471 if (errno == ENOSYS)
3472 return false;
3473
3474 return true;
4b5b3a2a
TA		 3475}
3476
3b988b33 3477int lxc_setup(struct lxc_handler *handler)
35120d9c 3478{
2187efd3 3479 int ret;
0fd73091 3480 const char *lxcpath = handler->lxcpath, *name = handler->name;
35120d9c 3481 struct lxc_conf *lxc_conf = handler->conf;
35120d9c 3482
8ce1abc2 3483 ret = lxc_setup_rootfs_prepare_root(lxc_conf, name, lxcpath);
8353b4c9
CB		 3484 if (ret < 0) {
3485 ERROR("Failed to setup rootfs");
35120d9c
SH		 3486 return -1;
3487 }
3488
28d9e29e 3489 if (handler->nsfd[LXC_NS_UTS] == -1) {
8353b4c9
CB		 3490 ret = setup_utsname(lxc_conf->utsname);
3491 if (ret < 0) {
0fd73091 3492 ERROR("Failed to setup the utsname %s", name);
6c544cb3
MM		 3493 return -1;
3494 }
0ad19a3f 3495 }
3496
b25291da
CB		 3497 ret = lxc_setup_keyring();
3498 if (ret < 0)
3499 return -1;
3500
8353b4c9
CB		 3501 ret = lxc_setup_network_in_child_namespaces(lxc_conf, &lxc_conf->network);
3502 if (ret < 0) {
3503 ERROR("Failed to setup network");
95b5ffaf 3504 return -1;
0ad19a3f 3505 }
3506
8353b4c9
CB		 3507 ret = lxc_network_send_name_and_ifindex_to_parent(handler);
3508 if (ret < 0) {
3509 ERROR("Failed to send network device names and ifindices to parent");
790255cf
CB		 3510 return -1;
3511 }
3512
bc6928ff 3513 if (lxc_conf->autodev > 0) {
8353b4c9
CB		 3514 ret = mount_autodev(name, &lxc_conf->rootfs, lxcpath);
3515 if (ret < 0) {
3516 ERROR("Failed to mount \"/dev\"");
c6883f38
SH		 3517 return -1;
3518 }
3519 }
3520
8353b4c9
CB		 3521 /* Do automatic mounts (mainly /proc and /sys), but exclude those that
3522 * need to wait until other stuff has finished.
368bbc02 3523 */
8353b4c9
CB		 3524 ret = lxc_mount_auto_mounts(lxc_conf, lxc_conf->auto_mounts & ~LXC_AUTO_CGROUP_MASK, handler);
3525 if (ret < 0) {
3526 ERROR("Failed to setup first automatic mounts");
368bbc02
CS		 3527 return -1;
3528 }
3529
8353b4c9
CB		 3530 ret = setup_mount(lxc_conf, &lxc_conf->rootfs, lxc_conf->fstab, name, lxcpath);
3531 if (ret < 0) {
3532 ERROR("Failed to setup mounts");
95b5ffaf 3533 return -1;
576f946d 3534 }
3535
8353b4c9 3536 if (lxc_conf->is_execute) {
4b5b3a2a
TA		 3537 if (execveat_supported()) {
3538 int fd;
3539 char path[PATH_MAX];
3540
3541 ret = snprintf(path, PATH_MAX, SBINDIR "/init.lxc.static");
3542 if (ret < 0 || ret >= PATH_MAX) {
3543 ERROR("Path to init.lxc.static too long");
3544 return -1;
3545 }
3546
3547 fd = open(path, O_PATH | O_CLOEXEC);
3548 if (fd < 0) {
3549 SYSERROR("Unable to open lxc.init.static");
3550 return -1;
3551 }
3552
3553 ((struct execute_args *)handler->data)->init_fd = fd;
3554 ((struct execute_args *)handler->data)->init_path = NULL;
3555 } else {
3556 ret = lxc_execute_bind_init(handler);
3557 if (ret < 0) {
3558 ERROR("Failed to bind-mount the lxc init system");
3559 return -1;
3560 }
8353b4c9
CB		 3561 }
3562 }
2322903b 3563
8353b4c9
CB		 3564 /* Now mount only cgroups, if wanted. Before, /sys could not have been
3565 * mounted. It is guaranteed to be mounted now either through
3566 * automatically or via fstab entries.
368bbc02 3567 */
8353b4c9
CB		 3568 ret = lxc_mount_auto_mounts(lxc_conf, lxc_conf->auto_mounts & LXC_AUTO_CGROUP_MASK, handler);
3569 if (ret < 0) {
3570 ERROR("Failed to setup remaining automatic mounts");
368bbc02
CS		 3571 return -1;
3572 }
3573
8353b4c9 3574 ret = run_lxc_hooks(name, "mount", lxc_conf, NULL);
1a2cf89d 3575 if (ret < 0) {
8353b4c9 3576 ERROR("Failed to run mount hooks");
773fb9ca
SH		 3577 return -1;
3578 }
3579
bc6928ff 3580 if (lxc_conf->autodev > 0) {
8353b4c9
CB		 3581 ret = run_lxc_hooks(name, "autodev", lxc_conf, NULL);
3582 if (ret < 0) {
3583 ERROR("Failed to run autodev hooks");
f7bee6c6
MW		 3584 return -1;
3585 }
06749971 3586
8353b4c9
CB		 3587 ret = lxc_fill_autodev(&lxc_conf->rootfs);
3588 if (ret < 0) {
3589 ERROR("Failed to populate \"/dev\"");
91c3830e
SH		 3590 return -1;
3591 }
3592 }
368bbc02 3593
8353b4c9
CB		 3594 if (!lxc_list_empty(&lxc_conf->mount_list)) {
3595 ret = setup_mount_entries(lxc_conf, &lxc_conf->rootfs,
3596 &lxc_conf->mount_list, name, lxcpath);
3597 if (ret < 0) {
3598 ERROR("Failed to setup mount entries");
3599 return -1;
3600 }
181437fd
YT		 3601 }
3602
75193660
CB		 3603 /* Make sure any start hooks are in the container */
3604 if (!verify_start_hooks(lxc_conf)) {
3605 ERROR("Failed to verify start hooks");
3606 return -1;
3607 }
3608
ed8704d0 3609 ret = lxc_setup_console(&lxc_conf->rootfs, &lxc_conf->console,
885766f5 3610 lxc_conf->ttys.dir);
ed8704d0
CB		 3611 if (ret < 0) {
3612 ERROR("Failed to setup console");
95b5ffaf 3613 return -1;
6e590161 3614 }
3615
ed8704d0
CB		 3616 ret = lxc_setup_dev_symlinks(&lxc_conf->rootfs);
3617 if (ret < 0) {
8353b4c9 3618 ERROR("Failed to setup \"/dev\" symlinks");
69aa6655
DE		 3619 return -1;
3620 }
3621
8353b4c9
CB		 3622 ret = lxc_create_tmp_proc_mount(lxc_conf);
3623 if (ret < 0) {
3624 ERROR("Failed to \"/proc\" LSMs");
e075f5d9 3625 return -1;
e075f5d9 3626 }
e075f5d9 3627
8ce1abc2 3628 ret = lxc_setup_rootfs_switch_root(&lxc_conf->rootfs);
8353b4c9
CB		 3629 if (ret < 0) {
3630 ERROR("Failed to pivot root into rootfs");
95b5ffaf 3631 return -1;
ed502555 3632 }
3633
8353b4c9
CB		 3634 ret = lxc_setup_devpts(lxc_conf);
3635 if (ret < 0) {
3636 ERROR("Failed to setup new devpts instance");
95b5ffaf 3637 return -1;
3c26f34e 3638 }
3639
2187efd3
CB		 3640 ret = lxc_create_ttys(handler);
3641 if (ret < 0)
e8bd4e43 3642 return -1;
e8bd4e43 3643
8353b4c9
CB		 3644 ret = setup_personality(lxc_conf->personality);
3645 if (ret < 0) {
3646 ERROR("Failed to set personality");
cccc74b5
DL		 3647 return -1;
3648 }
3649
8353b4c9
CB		 3650 /* Set sysctl value to a path under /proc/sys as determined from the
3651 * key. For e.g. net.ipv4.ip_forward translated to
3652 * /proc/sys/net/ipv4/ip_forward.
7edd0540
L		 3653 */
3654 if (!lxc_list_empty(&lxc_conf->sysctls)) {
3655 ret = setup_sysctl_parameters(&lxc_conf->sysctls);
8353b4c9
CB		 3656 if (ret < 0) {
3657 ERROR("Failed to setup sysctl parameters");
7edd0540 3658 return -1;
8353b4c9 3659 }
7edd0540
L		 3660 }
3661
97a8f74f
SG		 3662 if (!lxc_list_empty(&lxc_conf->keepcaps)) {
3663 if (!lxc_list_empty(&lxc_conf->caps)) {
8353b4c9
CB		 3664 ERROR("Container requests lxc.cap.drop and "
3665 "lxc.cap.keep: either use lxc.cap.drop or "
3666 "lxc.cap.keep, not both");
f6d3e3e4
SH		 3667 return -1;
3668 }
8353b4c9 3669
97a8f74f 3670 if (dropcaps_except(&lxc_conf->keepcaps)) {
8353b4c9 3671 ERROR("Failed to keep capabilities");
97a8f74f
SG		 3672 return -1;
3673 }
3674 } else if (setup_caps(&lxc_conf->caps)) {
8353b4c9 3675 ERROR("Failed to drop capabilities");
97a8f74f 3676 return -1;
81810dd1
DL		 3677 }
3678
8353b4c9 3679 NOTICE("The container \"%s\" is set up", name);
cd54d859 3680
0ad19a3f 3681 return 0;
3682}
26ddeedd 3683
3f60c2f7 3684int run_lxc_hooks(const char *name, char *hookname, struct lxc_conf *conf,
14a7b0f9 3685 char *argv[])
26ddeedd 3686{
26ddeedd 3687 struct lxc_list *it;
3f60c2f7 3688 int which = -1;
26ddeedd 3689
3f60c2f7 3690 if (strcmp(hookname, "pre-start") == 0)
26ddeedd 3691 which = LXCHOOK_PRESTART;
3f60c2f7 3692 else if (strcmp(hookname, "start-host") == 0)
08dd2805 3693 which = LXCHOOK_START_HOST;
3f60c2f7 3694 else if (strcmp(hookname, "pre-mount") == 0)
5ea6163a 3695 which = LXCHOOK_PREMOUNT;
3f60c2f7 3696 else if (strcmp(hookname, "mount") == 0)
26ddeedd 3697 which = LXCHOOK_MOUNT;
3f60c2f7 3698 else if (strcmp(hookname, "autodev") == 0)
f7bee6c6 3699 which = LXCHOOK_AUTODEV;
3f60c2f7 3700 else if (strcmp(hookname, "start") == 0)
26ddeedd 3701 which = LXCHOOK_START;
3f60c2f7 3702 else if (strcmp(hookname, "stop") == 0)
52492063 3703 which = LXCHOOK_STOP;
3f60c2f7 3704 else if (strcmp(hookname, "post-stop") == 0)
26ddeedd 3705 which = LXCHOOK_POSTSTOP;
3f60c2f7 3706 else if (strcmp(hookname, "clone") == 0)
148e91f5 3707 which = LXCHOOK_CLONE;
3f60c2f7 3708 else if (strcmp(hookname, "destroy") == 0)
37cf711b 3709 which = LXCHOOK_DESTROY;
26ddeedd
SH		 3710 else
3711 return -1;
3f60c2f7 3712
0fd73091 3713 lxc_list_for_each (it, &conf->hooks[which]) {
26ddeedd 3714 int ret;
3f60c2f7
CB		 3715 char *hook = it->elem;
3716
3717 ret = run_script_argv(name, conf->hooks_version, "lxc", hook,
14a7b0f9 3718 hookname, argv);
3f60c2f7
CB		 3719 if (ret < 0)
3720 return -1;
26ddeedd 3721 }
3f60c2f7 3722
26ddeedd
SH		 3723 return 0;
3724}
72d0e1cb 3725
72d0e1cb
SG		 3726int lxc_clear_config_caps(struct lxc_conf *c)
3727{
1a0e70ac 3728 struct lxc_list *it, *next;
72d0e1cb 3729
0fd73091 3730 lxc_list_for_each_safe (it, &c->caps, next) {
72d0e1cb
SG		 3731 lxc_list_del(it);
3732 free(it->elem);
3733 free(it);
3734 }
0fd73091 3735
72d0e1cb
SG		 3736 return 0;
3737}
3738
c7e345ae
CB		 3739static int lxc_free_idmap(struct lxc_list *id_map)
3740{
27c27d73
SH		 3741 struct lxc_list *it, *next;
3742
0fd73091 3743 lxc_list_for_each_safe (it, id_map, next) {
27c27d73
SH		 3744 lxc_list_del(it);
3745 free(it->elem);
3746 free(it);
3747 }
c7e345ae 3748
27c27d73
SH		 3749 return 0;
3750}
3751
4355ab5f
SH		 3752int lxc_clear_idmaps(struct lxc_conf *c)
3753{
3754 return lxc_free_idmap(&c->id_map);
3755}
3756
1fb86a7c
SH		 3757int lxc_clear_config_keepcaps(struct lxc_conf *c)
3758{
0fd73091 3759 struct lxc_list *it, *next;
1fb86a7c 3760
0fd73091 3761 lxc_list_for_each_safe (it, &c->keepcaps, next) {
1fb86a7c
SH		 3762 lxc_list_del(it);
3763 free(it->elem);
3764 free(it);
3765 }
0fd73091 3766
1fb86a7c
SH		 3767 return 0;
3768}
3769
a3ed9b81 3770int lxc_clear_namespace(struct lxc_conf *c)
3771{
3772 int i;
3773 for (i = 0; i < LXC_NS_MAX; i++) {
3774 free(c->ns_share[i]);
3775 c->ns_share[i] = NULL;
3776 }
3777 return 0;
3778}
3779
54860ed0 3780int lxc_clear_cgroups(struct lxc_conf *c, const char *key, int version)
72d0e1cb 3781{
54860ed0 3782 char *global_token, *namespaced_token;
ab1a6cac 3783 size_t namespaced_token_len;
54860ed0 3784 struct lxc_list *it, *next, *list;
ab1a6cac 3785 const char *k = key;
54860ed0 3786 bool all = false;
72d0e1cb 3787
54860ed0
CB		 3788 if (version == CGROUP2_SUPER_MAGIC) {
3789 global_token = "lxc.cgroup2";
3790 namespaced_token = "lxc.cgroup2.";
6333c915 3791 namespaced_token_len = STRLITERALLEN("lxc.cgroup2.");
54860ed0
CB		 3792 list = &c->cgroup2;
3793 } else if (version == CGROUP_SUPER_MAGIC) {
3794 global_token = "lxc.cgroup";
3795 namespaced_token = "lxc.cgroup.";
6333c915 3796 namespaced_token_len = STRLITERALLEN("lxc.cgroup.");
54860ed0
CB		 3797 list = &c->cgroup;
3798 } else {
ab1a6cac 3799 return -EINVAL;
54860ed0
CB		 3800 }
3801
3802 if (strcmp(key, global_token) == 0)
72d0e1cb 3803 all = true;
6333c915 3804 else if (strncmp(key, namespaced_token, namespaced_token_len) == 0)
ab1a6cac 3805 k += namespaced_token_len;
a6390f01 3806 else
ab1a6cac 3807 return -EINVAL;
72d0e1cb 3808
0fd73091 3809 lxc_list_for_each_safe (it, list, next) {
72d0e1cb 3810 struct lxc_cgroup *cg = it->elem;
54860ed0 3811
72d0e1cb
SG		 3812 if (!all && strcmp(cg->subsystem, k) != 0)
3813 continue;
54860ed0 3814
72d0e1cb
SG		 3815 lxc_list_del(it);
3816 free(cg->subsystem);
3817 free(cg->value);
3818 free(cg);
3819 free(it);
3820 }
e409b214 3821
72d0e1cb
SG		 3822 return 0;
3823}
3824
c6d09e15
WB		 3825int lxc_clear_limits(struct lxc_conf *c, const char *key)
3826{
3827 struct lxc_list *it, *next;
c6d09e15 3828 const char *k = NULL;
0fd73091 3829 bool all = false;
c6d09e15 3830
b668653c 3831 if (strcmp(key, "lxc.limit") == 0 || strcmp(key, "lxc.prlimit") == 0)
c6d09e15 3832 all = true;
6333c915
CB		 3833 else if (strncmp(key, "lxc.limit.", STRLITERALLEN("lxc.limit.")) == 0)
3834 k = key + STRLITERALLEN("lxc.limit.");
3835 else if (strncmp(key, "lxc.prlimit.", STRLITERALLEN("lxc.prlimit.")) == 0)
3836 k = key + STRLITERALLEN("lxc.prlimit.");
c6d09e15
WB		 3837 else
3838 return -1;
3839
0fd73091 3840 lxc_list_for_each_safe (it, &c->limits, next) {
c6d09e15 3841 struct lxc_limit *lim = it->elem;
0fd73091 3842
c6d09e15
WB		 3843 if (!all && strcmp(lim->resource, k) != 0)
3844 continue;
0fd73091 3845
c6d09e15
WB		 3846 lxc_list_del(it);
3847 free(lim->resource);
3848 free(lim);
3849 free(it);
3850 }
b668653c 3851
c6d09e15
WB		 3852 return 0;
3853}
3854
7edd0540
L		 3855int lxc_clear_sysctls(struct lxc_conf *c, const char *key)
3856{
3857 struct lxc_list *it, *next;
7edd0540 3858 const char *k = NULL;
0fd73091 3859 bool all = false;
7edd0540
L		 3860
3861 if (strcmp(key, "lxc.sysctl") == 0)
3862 all = true;
6333c915
CB		 3863 else if (strncmp(key, "lxc.sysctl.", STRLITERALLEN("lxc.sysctl.")) == 0)
3864 k = key + STRLITERALLEN("lxc.sysctl.");
7edd0540
L		 3865 else
3866 return -1;
3867
0fd73091 3868 lxc_list_for_each_safe (it, &c->sysctls, next) {
7edd0540 3869 struct lxc_sysctl *elem = it->elem;
0fd73091 3870
7edd0540
L		 3871 if (!all && strcmp(elem->key, k) != 0)
3872 continue;
0fd73091 3873
7edd0540
L		 3874 lxc_list_del(it);
3875 free(elem->key);
3876 free(elem->value);
3877 free(elem);
3878 free(it);
3879 }
0fd73091 3880
7edd0540
L		 3881 return 0;
3882}
3883
61d7a733
YT		 3884int lxc_clear_procs(struct lxc_conf *c, const char *key)
3885{
0fd73091 3886 struct lxc_list *it, *next;
61d7a733 3887 const char *k = NULL;
0fd73091 3888 bool all = false;
61d7a733
YT		 3889
3890 if (strcmp(key, "lxc.proc") == 0)
3891 all = true;
6333c915
CB		 3892 else if (strncmp(key, "lxc.proc.", STRLITERALLEN("lxc.proc.")) == 0)
3893 k = key + STRLITERALLEN("lxc.proc.");
61d7a733
YT		 3894 else
3895 return -1;
3896
0fd73091 3897 lxc_list_for_each_safe (it, &c->procs, next) {
61d7a733 3898 struct lxc_proc *proc = it->elem;
0fd73091 3899
61d7a733
YT		 3900 if (!all && strcmp(proc->filename, k) != 0)
3901 continue;
0fd73091 3902
61d7a733
YT		 3903 lxc_list_del(it);
3904 free(proc->filename);
3905 free(proc->value);
3906 free(proc);
3907 free(it);
3908 }
3909
3910 return 0;
3911}
3912
ee1e7aa0
SG		 3913int lxc_clear_groups(struct lxc_conf *c)
3914{
0fd73091 3915 struct lxc_list *it, *next;
ee1e7aa0 3916
0fd73091 3917 lxc_list_for_each_safe (it, &c->groups, next) {
ee1e7aa0
SG		 3918 lxc_list_del(it);
3919 free(it->elem);
3920 free(it);
3921 }
0fd73091 3922
ee1e7aa0
SG		 3923 return 0;
3924}
3925
ab799c0b
SG		 3926int lxc_clear_environment(struct lxc_conf *c)
3927{
0fd73091 3928 struct lxc_list *it, *next;
ab799c0b 3929
0fd73091 3930 lxc_list_for_each_safe (it, &c->environment, next) {
ab799c0b
SG		 3931 lxc_list_del(it);
3932 free(it->elem);
3933 free(it);
3934 }
0fd73091 3935
ab799c0b
SG		 3936 return 0;
3937}
3938
72d0e1cb
SG		 3939int lxc_clear_mount_entries(struct lxc_conf *c)
3940{
0fd73091 3941 struct lxc_list *it, *next;
72d0e1cb 3942
0fd73091 3943 lxc_list_for_each_safe (it, &c->mount_list, next) {
72d0e1cb
SG		 3944 lxc_list_del(it);
3945 free(it->elem);
3946 free(it);
3947 }
0fd73091 3948
72d0e1cb
SG		 3949 return 0;
3950}
3951
b099e9e9
SH		 3952int lxc_clear_automounts(struct lxc_conf *c)
3953{
3954 c->auto_mounts = 0;
3955 return 0;
3956}
3957
12a50cc6 3958int lxc_clear_hooks(struct lxc_conf *c, const char *key)
72d0e1cb 3959{
72d0e1cb 3960 int i;
0fd73091
CB		 3961 struct lxc_list *it, *next;
3962 const char *k = NULL;
3963 bool all = false, done = false;
72d0e1cb 3964
17ed13a3
SH		 3965 if (strcmp(key, "lxc.hook") == 0)
3966 all = true;
6333c915
CB		 3967 else if (strncmp(key, "lxc.hook.", STRLITERALLEN("lxc.hook.")) == 0)
3968 k = key + STRLITERALLEN("lxc.hook.");
a6390f01
WB		 3969 else
3970 return -1;
17ed13a3 3971
0fd73091 3972 for (i = 0; i < NUM_LXC_HOOKS; i++) {
17ed13a3 3973 if (all || strcmp(k, lxchook_names[i]) == 0) {
0fd73091 3974 lxc_list_for_each_safe (it, &c->hooks[i], next) {
17ed13a3
SH		 3975 lxc_list_del(it);
3976 free(it->elem);
3977 free(it);
3978 }
0fd73091 3979
17ed13a3 3980 done = true;
72d0e1cb
SG		 3981 }
3982 }
17ed13a3
SH		 3983
3984 if (!done) {
3985 ERROR("Invalid hook key: %s", key);
3986 return -1;
3987 }
0fd73091 3988
72d0e1cb
SG		 3989 return 0;
3990}
8eb5694b 3991
4184c3e1
SH		 3992static inline void lxc_clear_aliens(struct lxc_conf *conf)
3993{
0fd73091 3994 struct lxc_list *it, *next;
4184c3e1 3995
0fd73091 3996 lxc_list_for_each_safe (it, &conf->aliens, next) {
4184c3e1
SH		 3997 lxc_list_del(it);
3998 free(it->elem);
3999 free(it);
4000 }
4001}
4002
c7b15d1e 4003void lxc_clear_includes(struct lxc_conf *conf)
f979ac15 4004{
0fd73091 4005 struct lxc_list *it, *next;
f979ac15 4006
0fd73091 4007 lxc_list_for_each_safe (it, &conf->includes, next) {
f979ac15
SH		 4008 lxc_list_del(it);
4009 free(it->elem);
4010 free(it);
4011 }
4012}
4013
1800f924
WB		 4014int lxc_clear_apparmor_raw(struct lxc_conf *c)
4015{
4016 struct lxc_list *it, *next;
4017
4018 lxc_list_for_each_safe (it, &c->lsm_aa_raw, next) {
4019 lxc_list_del(it);
4020 free(it->elem);
4021 free(it);
4022 }
4023
4024 return 0;
4025}
4026
8eb5694b
SH		 4027void lxc_conf_free(struct lxc_conf *conf)
4028{
4029 if (!conf)
4030 return;
0fd73091 4031
858377e4
SH		 4032 if (current_config == conf)
4033 current_config = NULL;
aed105d5 4034 lxc_terminal_conf_free(&conf->console);
f10fad2f 4035 free(conf->rootfs.mount);
b3b8c97f 4036 free(conf->rootfs.bdev_type);
f10fad2f
ME		 4037 free(conf->rootfs.options);
4038 free(conf->rootfs.path);
f10fad2f 4039 free(conf->logfile);
858377e4
SH		 4040 if (conf->logfd != -1)
4041 close(conf->logfd);
f10fad2f 4042 free(conf->utsname);
885766f5
CB		 4043 free(conf->ttys.dir);
4044 free(conf->ttys.tty_names);
f10fad2f
ME		 4045 free(conf->fstab);
4046 free(conf->rcfile);
5cda27c1 4047 free(conf->execute_cmd);
f10fad2f 4048 free(conf->init_cmd);
3c491553 4049 free(conf->init_cwd);
6b0d5538 4050 free(conf->unexpanded_config);
76d0127f 4051 free(conf->syslog);
c302b476 4052 lxc_free_networks(&conf->network);
f10fad2f 4053 free(conf->lsm_aa_profile);
1800f924 4054 free(conf->lsm_aa_profile_computed);
f10fad2f 4055 free(conf->lsm_se_context);
769872f9 4056 lxc_seccomp_free(conf);
8eb5694b 4057 lxc_clear_config_caps(conf);
1fb86a7c 4058 lxc_clear_config_keepcaps(conf);
54860ed0
CB		 4059 lxc_clear_cgroups(conf, "lxc.cgroup", CGROUP_SUPER_MAGIC);
4060 lxc_clear_cgroups(conf, "lxc.cgroup2", CGROUP2_SUPER_MAGIC);
17ed13a3 4061 lxc_clear_hooks(conf, "lxc.hook");
8eb5694b 4062 lxc_clear_mount_entries(conf);
27c27d73 4063 lxc_clear_idmaps(conf);
ee1e7aa0 4064 lxc_clear_groups(conf);
f979ac15 4065 lxc_clear_includes(conf);
761d81ca 4066 lxc_clear_aliens(conf);
ab799c0b 4067 lxc_clear_environment(conf);
240d4b74 4068 lxc_clear_limits(conf, "lxc.prlimit");
7edd0540 4069 lxc_clear_sysctls(conf, "lxc.sysctl");
61d7a733 4070 lxc_clear_procs(conf, "lxc.proc");
1800f924 4071 lxc_clear_apparmor_raw(conf);
a3ed9b81 4072 lxc_clear_namespace(conf);
43654d34
CB		 4073 free(conf->cgroup_meta.dir);
4074 free(conf->cgroup_meta.controllers);
7a41e857
LT		 4075 free(conf->shmount.path_host);
4076 free(conf->shmount.path_cont);
8eb5694b
SH		 4077 free(conf);
4078}
4355ab5f
SH		 4079
4080struct userns_fn_data {
4081 int (*fn)(void *);
c9b7c33e 4082 const char *fn_name;
4355ab5f
SH		 4083 void *arg;
4084 int p[2];
4085};
4086
4087static int run_userns_fn(void *data)
4088{
adaffdd7 4089 int ret;
4355ab5f 4090 char c;
0fd73091 4091 struct userns_fn_data *d = data;
4355ab5f 4092
f8aa4bf3 4093 /* Close write end of the pipe. */
4355ab5f 4094 close(d->p[1]);
f8aa4bf3
CB		 4095
4096 /* Wait for parent to finish establishing a new mapping in the user
4097 * namespace we are executing in.
4098 */
adaffdd7 4099 ret = lxc_read_nointr(d->p[0], &c, 1);
f8aa4bf3 4100 /* Close read end of the pipe. */
4355ab5f 4101 close(d->p[0]);
adaffdd7
CB		 4102 if (ret != 1)
4103 return -1;
f8aa4bf3 4104
c9b7c33e 4105 if (d->fn_name)
adaffdd7 4106 TRACE("Calling function \"%s\"", d->fn_name);
0fd73091 4107
f8aa4bf3 4108 /* Call function to run. */
4355ab5f
SH		 4109 return d->fn(d->arg);
4110}
4111
db7cfe23
CB		 4112static struct id_map *mapped_nsid_add(struct lxc_conf *conf, unsigned id,
4113 enum idtype idtype)
4114{
5173b710
CB		 4115 const struct id_map *map;
4116 struct id_map *retmap;
db7cfe23
CB		 4117
4118 map = find_mapped_nsid_entry(conf, id, idtype);
4119 if (!map)
4120 return NULL;
4121
4122 retmap = malloc(sizeof(*retmap));
4123 if (!retmap)
4124 return NULL;
4125
4126 memcpy(retmap, map, sizeof(*retmap));
4127 return retmap;
4128}
4129
c4333195
CB		 4130static struct id_map *find_mapped_hostid_entry(struct lxc_conf *conf,
4131 unsigned id, enum idtype idtype)
f8aa4bf3 4132{
f8aa4bf3 4133 struct id_map *map;
0fd73091 4134 struct lxc_list *it;
f8aa4bf3
CB		 4135 struct id_map *retmap = NULL;
4136
0fd73091 4137 lxc_list_for_each (it, &conf->id_map) {
f8aa4bf3
CB		 4138 map = it->elem;
4139 if (map->idtype != idtype)
4140 continue;
4141
4142 if (id >= map->hostid && id < map->hostid + map->range) {
4143 retmap = map;
4144 break;
4145 }
4146 }
4147
f8aa4bf3
CB		 4148 return retmap;
4149}
4150
0fd73091 4151/* Allocate a new {g,u}id mapping for the given {g,u}id. Re-use an already
f8aa4bf3 4152 * existing one or establish a new one.
4355ab5f 4153 */
0fd73091
CB		 4154static struct id_map *mapped_hostid_add(struct lxc_conf *conf, uid_t id,
4155 enum idtype type)
4355ab5f 4156{
28a2d9e7 4157 int hostid_mapped;
c4333195
CB		 4158 struct id_map *entry = NULL, *tmp = NULL;
4159
4160 entry = malloc(sizeof(*entry));
4161 if (!entry)
4162 return NULL;
f8aa4bf3 4163
28a2d9e7 4164 /* Reuse existing mapping. */
c4333195
CB		 4165 tmp = find_mapped_hostid_entry(conf, id, type);
4166 if (tmp)
4167 return memcpy(entry, tmp, sizeof(*entry));
f8aa4bf3 4168
28a2d9e7
CB		 4169 /* Find new mapping. */
4170 hostid_mapped = find_unmapped_nsid(conf, type);
4171 if (hostid_mapped < 0) {
c4333195
CB		 4172 DEBUG("Failed to find free mapping for id %d", id);
4173 free(entry);
28a2d9e7 4174 return NULL;
f8aa4bf3 4175 }
f8aa4bf3 4176
28a2d9e7
CB		 4177 entry->idtype = type;
4178 entry->nsid = hostid_mapped;
4179 entry->hostid = (unsigned long)id;
4180 entry->range = 1;
4355ab5f 4181
28a2d9e7 4182 return entry;
4355ab5f
SH		 4183}
4184
dcf0ffdf 4185struct lxc_list *get_minimal_idmap(struct lxc_conf *conf)
4355ab5f 4186{
00d6cfe2
CB		 4187 __do_free struct id_map *container_root_uid = NULL,
4188 *container_root_gid = NULL,
4189 *host_uid_map = NULL, *host_gid_map = NULL;
4190 __do_free struct lxc_list *idmap = NULL;
f8aa4bf3 4191 uid_t euid, egid;
4160c3a0
CB		 4192 uid_t nsuid = (conf->root_nsuid_map != NULL) ? 0 : conf->init_uid;
4193 gid_t nsgid = (conf->root_nsgid_map != NULL) ? 0 : conf->init_gid;
00d6cfe2 4194 struct lxc_list *tmplist = NULL;
4355ab5f 4195
db7cfe23 4196 /* Find container root mappings. */
4160c3a0 4197 container_root_uid = mapped_nsid_add(conf, nsuid, ID_TYPE_UID);
db7cfe23 4198 if (!container_root_uid) {
dcf0ffdf 4199 DEBUG("Failed to find mapping for namespace uid %d", 0);
00d6cfe2 4200 return NULL;
f8aa4bf3 4201 }
dcf0ffdf
CB		 4202 euid = geteuid();
4203 if (euid >= container_root_uid->hostid &&
4204 euid < (container_root_uid->hostid + container_root_uid->range))
db7cfe23 4205 host_uid_map = container_root_uid;
f8aa4bf3 4206
4160c3a0 4207 container_root_gid = mapped_nsid_add(conf, nsgid, ID_TYPE_GID);
db7cfe23 4208 if (!container_root_gid) {
dcf0ffdf 4209 DEBUG("Failed to find mapping for namespace gid %d", 0);
00d6cfe2 4210 return NULL;
f8aa4bf3 4211 }
dcf0ffdf
CB		 4212 egid = getegid();
4213 if (egid >= container_root_gid->hostid &&
4214 egid < (container_root_gid->hostid + container_root_gid->range))
db7cfe23 4215 host_gid_map = container_root_gid;
f8aa4bf3
CB		 4216
4217 /* Check whether the {g,u}id of the user has a mapping. */
954b7d9b 4218 if (!host_uid_map)
c4333195 4219 host_uid_map = mapped_hostid_add(conf, euid, ID_TYPE_UID);
28a2d9e7 4220 if (!host_uid_map) {
db7cfe23 4221 DEBUG("Failed to find mapping for uid %d", euid);
00d6cfe2 4222 return NULL;
f8aa4bf3
CB		 4223 }
4224
dcf0ffdf
CB		 4225 if (!host_gid_map)
4226 host_gid_map = mapped_hostid_add(conf, egid, ID_TYPE_GID);
28a2d9e7 4227 if (!host_gid_map) {
db7cfe23 4228 DEBUG("Failed to find mapping for gid %d", egid);
00d6cfe2 4229 return NULL;
28a2d9e7
CB		 4230 }
4231
4232 /* Allocate new {g,u}id map list. */
4233 idmap = malloc(sizeof(*idmap));
4234 if (!idmap)
00d6cfe2 4235 return NULL;
28a2d9e7
CB		 4236 lxc_list_init(idmap);
4237
f8aa4bf3
CB		 4238 /* Add container root to the map. */
4239 tmplist = malloc(sizeof(*tmplist));
4240 if (!tmplist)
00d6cfe2 4241 return NULL;
f8aa4bf3
CB		 4242 lxc_list_add_elem(tmplist, container_root_uid);
4243 lxc_list_add_tail(idmap, tmplist);
28a2d9e7 4244
1d90e064 4245 if (host_uid_map && (host_uid_map != container_root_uid)) {
28a2d9e7 4246 /* idmap will now keep track of that memory. */
00d6cfe2 4247 move_ptr(container_root_uid);
28a2d9e7
CB		 4248
4249 /* Add container root to the map. */
4250 tmplist = malloc(sizeof(*tmplist));
4251 if (!tmplist)
00d6cfe2 4252 return NULL;
28a2d9e7
CB		 4253 lxc_list_add_elem(tmplist, host_uid_map);
4254 lxc_list_add_tail(idmap, tmplist);
28a2d9e7 4255 }
1d90e064 4256 /* idmap will now keep track of that memory. */
00d6cfe2 4257 move_ptr(container_root_uid);
1d90e064 4258 /* idmap will now keep track of that memory. */
00d6cfe2 4259 move_ptr(host_uid_map);
f8aa4bf3
CB		 4260
4261 tmplist = malloc(sizeof(*tmplist));
4262 if (!tmplist)
00d6cfe2 4263 return NULL;
f8aa4bf3
CB		 4264 lxc_list_add_elem(tmplist, container_root_gid);
4265 lxc_list_add_tail(idmap, tmplist);
28a2d9e7 4266
1d90e064 4267 if (host_gid_map && (host_gid_map != container_root_gid)) {
28a2d9e7 4268 /* idmap will now keep track of that memory. */
00d6cfe2 4269 move_ptr(container_root_gid);
28a2d9e7
CB		 4270
4271 tmplist = malloc(sizeof(*tmplist));
4272 if (!tmplist)
00d6cfe2 4273 return NULL;
28a2d9e7
CB		 4274 lxc_list_add_elem(tmplist, host_gid_map);
4275 lxc_list_add_tail(idmap, tmplist);
28a2d9e7 4276 }
1d90e064 4277 /* idmap will now keep track of that memory. */
00d6cfe2 4278 move_ptr(container_root_gid);
1d90e064 4279 /* idmap will now keep track of that memory. */
00d6cfe2 4280 move_ptr(host_gid_map);
f8aa4bf3 4281
dcf0ffdf 4282 TRACE("Allocated minimal idmapping");
00d6cfe2 4283 return move_ptr(idmap);
dcf0ffdf
CB		 4284}
4285
4286/* Run a function in a new user namespace.
4287 * The caller's euid/egid will be mapped if it is not already.
4288 * Afaict, userns_exec_1() is only used to operate based on privileges for the
4289 * user's own {g,u}id on the host and for the container root's unmapped {g,u}id.
4290 * This means we require only to establish a mapping from:
4291 * - the container root {g,u}id as seen from the host > user's host {g,u}id
4292 * - the container root -> some sub{g,u}id
915e3dbd 4293 * The former we add, if the user did not specify a mapping. The latter we
6f3fd27f 4294 * retrieve from the container's configured {g,u}id mappings as it must have been
dcf0ffdf
CB		 4295 * there to start the container in the first place.
4296 */
4297int userns_exec_1(struct lxc_conf *conf, int (*fn)(void *), void *data,
4298 const char *fn_name)
4299{
4300 pid_t pid;
dcf0ffdf 4301 int p[2];
0fd73091 4302 struct userns_fn_data d;
dcf0ffdf 4303 struct lxc_list *idmap;
0fd73091
CB		 4304 int ret = -1, status = -1;
4305 char c = '1';
dcf0ffdf 4306
2b2655a8
CB		 4307 if (!conf)
4308 return -EINVAL;
4309
dcf0ffdf
CB		 4310 idmap = get_minimal_idmap(conf);
4311 if (!idmap)
4312 return -1;
4313
979f9e34 4314 ret = pipe2(p, O_CLOEXEC);
dcf0ffdf
CB		 4315 if (ret < 0) {
4316 SYSERROR("Failed to create pipe");
4317 return -1;
4318 }
4319 d.fn = fn;
4320 d.fn_name = fn_name;
4321 d.arg = data;
4322 d.p[0] = p[0];
4323 d.p[1] = p[1];
4324
4325 /* Clone child in new user namespace. */
4326 pid = lxc_raw_clone_cb(run_userns_fn, &d, CLONE_NEWUSER);
4327 if (pid < 0) {
0fd73091 4328 ERROR("Failed to clone process in new user namespace");
dcf0ffdf
CB		 4329 goto on_error;
4330 }
4331
4332 close(p[0]);
4333 p[0] = -1;
4334
4b73005c
CB		 4335 if (lxc_log_get_level() == LXC_LOG_LEVEL_TRACE ||
4336 conf->loglevel == LXC_LOG_LEVEL_TRACE) {
dcf0ffdf 4337 struct id_map *map;
0fd73091 4338 struct lxc_list *it;
dcf0ffdf 4339
0fd73091 4340 lxc_list_for_each (it, idmap) {
f8aa4bf3 4341 map = it->elem;
dcf0ffdf 4342 TRACE("Establishing %cid mapping for \"%d\" in new "
f8aa4bf3 4343 "user namespace: nsuid %lu - hostid %lu - range "
0fd73091
CB		 4344 "%lu",
4345 (map->idtype == ID_TYPE_UID) ? 'u' : 'g', pid,
4346 map->nsid, map->hostid, map->range);
f8aa4bf3 4347 }
4355ab5f
SH		 4348 }
4349
f8aa4bf3 4350 /* Set up {g,u}id mapping for user namespace of child process. */
4355ab5f 4351 ret = lxc_map_ids(idmap, pid);
f8aa4bf3 4352 if (ret < 0) {
0fd73091 4353 ERROR("Error setting up {g,u}id mappings for child process \"%d\"", pid);
f8aa4bf3 4354 goto on_error;
4355ab5f
SH		 4355 }
4356
f8aa4bf3 4357 /* Tell child to proceed. */
489f39be 4358 if (lxc_write_nointr(p[1], &c, 1) != 1) {
dcf0ffdf 4359 SYSERROR("Failed telling child process \"%d\" to proceed", pid);
f8aa4bf3 4360 goto on_error;
4355ab5f
SH		 4361 }
4362
686dd5d1 4363on_error:
4355ab5f
SH		 4364 if (p[0] != -1)
4365 close(p[0]);
4366 close(p[1]);
f8aa4bf3 4367
ee1b16bc
TA		 4368 /* Wait for child to finish. */
4369 if (pid > 0)
4370 status = wait_for_pid(pid);
4371
686dd5d1
CB		 4372 if (status < 0)
4373 ret = -1;
4374
f8aa4bf3 4375 return ret;
4355ab5f 4376}
97e9cfa0 4377
415a8851
CB		 4378int userns_exec_full(struct lxc_conf *conf, int (*fn)(void *), void *data,
4379 const char *fn_name)
4380{
4381 pid_t pid;
4382 uid_t euid, egid;
415a8851
CB		 4383 int p[2];
4384 struct id_map *map;
4385 struct lxc_list *cur;
0fd73091 4386 struct userns_fn_data d;
415a8851 4387 int ret = -1;
0fd73091 4388 char c = '1';
415a8851
CB		 4389 struct lxc_list *idmap = NULL, *tmplist = NULL;
4390 struct id_map *container_root_uid = NULL, *container_root_gid = NULL,
4391 *host_uid_map = NULL, *host_gid_map = NULL;
4392
2b2655a8
CB		 4393 if (!conf)
4394 return -EINVAL;
4395
979f9e34 4396 ret = pipe2(p, O_CLOEXEC);
415a8851
CB		 4397 if (ret < 0) {
4398 SYSERROR("opening pipe");
4399 return -1;
4400 }
4401 d.fn = fn;
4402 d.fn_name = fn_name;
4403 d.arg = data;
4404 d.p[0] = p[0];
4405 d.p[1] = p[1];
4406
4407 /* Clone child in new user namespace. */
4408 pid = lxc_clone(run_userns_fn, &d, CLONE_NEWUSER);
4409 if (pid < 0) {
0fd73091 4410 ERROR("Failed to clone process in new user namespace");
415a8851
CB		 4411 goto on_error;
4412 }
4413
4414 close(p[0]);
4415 p[0] = -1;
4416
4417 euid = geteuid();
4418 egid = getegid();
4419
4420 /* Allocate new {g,u}id map list. */
4421 idmap = malloc(sizeof(*idmap));
4422 if (!idmap)
4423 goto on_error;
4424 lxc_list_init(idmap);
4425
4426 /* Find container root. */
0fd73091 4427 lxc_list_for_each (cur, &conf->id_map) {
415a8851
CB		 4428 struct id_map *tmpmap;
4429
4430 tmplist = malloc(sizeof(*tmplist));
4431 if (!tmplist)
4432 goto on_error;
4433
4434 tmpmap = malloc(sizeof(*tmpmap));
4435 if (!tmpmap) {
4436 free(tmplist);
4437 goto on_error;
4438 }
4439
4440 memset(tmpmap, 0, sizeof(*tmpmap));
4441 memcpy(tmpmap, cur->elem, sizeof(*tmpmap));
4442 tmplist->elem = tmpmap;
4443
4444 lxc_list_add_tail(idmap, tmplist);
4445
4446 map = cur->elem;
4447
4448 if (map->idtype == ID_TYPE_UID)
4449 if (euid >= map->hostid && euid < map->hostid + map->range)
4450 host_uid_map = map;
4451
4452 if (map->idtype == ID_TYPE_GID)
4453 if (egid >= map->hostid && egid < map->hostid + map->range)
4454 host_gid_map = map;
4455
4456 if (map->nsid != 0)
4457 continue;
4458
4459 if (map->idtype == ID_TYPE_UID)
4460 if (container_root_uid == NULL)
4461 container_root_uid = map;
4462
4463 if (map->idtype == ID_TYPE_GID)
4464 if (container_root_gid == NULL)
4465 container_root_gid = map;
4466 }
4467
4468 if (!container_root_uid || !container_root_gid) {
4469 ERROR("No mapping for container root found");
4470 goto on_error;
4471 }
4472
4473 /* Check whether the {g,u}id of the user has a mapping. */
4474 if (!host_uid_map)
c4333195 4475 host_uid_map = mapped_hostid_add(conf, euid, ID_TYPE_UID);
415a8851
CB		 4476 else
4477 host_uid_map = container_root_uid;
4478
4479 if (!host_gid_map)
c4333195 4480 host_gid_map = mapped_hostid_add(conf, egid, ID_TYPE_GID);
415a8851
CB		 4481 else
4482 host_gid_map = container_root_gid;
4483
4484 if (!host_uid_map) {
4485 DEBUG("Failed to find mapping for uid %d", euid);
4486 goto on_error;
4487 }
4488
4489 if (!host_gid_map) {
4490 DEBUG("Failed to find mapping for gid %d", egid);
4491 goto on_error;
4492 }
4493
4494 if (host_uid_map && (host_uid_map != container_root_uid)) {
4495 /* Add container root to the map. */
4496 tmplist = malloc(sizeof(*tmplist));
4497 if (!tmplist)
4498 goto on_error;
4499 lxc_list_add_elem(tmplist, host_uid_map);
4500 lxc_list_add_tail(idmap, tmplist);
4501 }
4502 /* idmap will now keep track of that memory. */
4503 host_uid_map = NULL;
4504
4505 if (host_gid_map && (host_gid_map != container_root_gid)) {
4506 tmplist = malloc(sizeof(*tmplist));
4507 if (!tmplist)
4508 goto on_error;
4509 lxc_list_add_elem(tmplist, host_gid_map);
4510 lxc_list_add_tail(idmap, tmplist);
4511 }
4512 /* idmap will now keep track of that memory. */
4513 host_gid_map = NULL;
4514
4515 if (lxc_log_get_level() == LXC_LOG_LEVEL_TRACE ||
4516 conf->loglevel == LXC_LOG_LEVEL_TRACE) {
0fd73091 4517 lxc_list_for_each (cur, idmap) {
415a8851
CB		 4518 map = cur->elem;
4519 TRACE("establishing %cid mapping for \"%d\" in new "
4520 "user namespace: nsuid %lu - hostid %lu - range "
4521 "%lu",
4522 (map->idtype == ID_TYPE_UID) ? 'u' : 'g', pid,
4523 map->nsid, map->hostid, map->range);
4524 }
4525 }
4526
4527 /* Set up {g,u}id mapping for user namespace of child process. */
4528 ret = lxc_map_ids(idmap, pid);
4529 if (ret < 0) {
0fd73091 4530 ERROR("error setting up {g,u}id mappings for child process \"%d\"", pid);
415a8851
CB		 4531 goto on_error;
4532 }
4533
4534 /* Tell child to proceed. */
489f39be 4535 if (lxc_write_nointr(p[1], &c, 1) != 1) {
0fd73091 4536 SYSERROR("Failed telling child process \"%d\" to proceed", pid);
415a8851
CB		 4537 goto on_error;
4538 }
4539
686dd5d1 4540on_error:
ee1b16bc
TA		 4541 if (p[0] != -1)
4542 close(p[0]);
4543 close(p[1]);
4544
415a8851 4545 /* Wait for child to finish. */
686dd5d1
CB		 4546 if (pid > 0)
4547 ret = wait_for_pid(pid);
415a8851 4548
80758b4b 4549 if (idmap) {
415a8851 4550 lxc_free_idmap(idmap);
80758b4b
DJ		 4551 free(idmap);
4552 }
4553
415a8851
CB		 4554 if (host_uid_map && (host_uid_map != container_root_uid))
4555 free(host_uid_map);
4556 if (host_gid_map && (host_gid_map != container_root_gid))
4557 free(host_gid_map);
4558
415a8851
CB		 4559 return ret;
4560}
4561
a96a8e8c 4562/* not thread-safe, do not use from api without first forking */
0fd73091 4563static char *getuname(void)
97e9cfa0 4564{
4f410b2a 4565 __do_free char *buf = NULL;
cb7aa5e8
DJ		 4566 struct passwd pwent;
4567 struct passwd *pwentp = NULL;
cb7aa5e8
DJ		 4568 size_t bufsize;
4569 int ret;
97e9cfa0 4570
cb7aa5e8
DJ		 4571 bufsize = sysconf(_SC_GETPW_R_SIZE_MAX);
4572 if (bufsize == -1)
4573 bufsize = 1024;
4574
4575 buf = malloc(bufsize);
4576 if (!buf)
97e9cfa0
SH		 4577 return NULL;
4578
cb7aa5e8
DJ		 4579 ret = getpwuid_r(geteuid(), &pwent, buf, bufsize, &pwentp);
4580 if (!pwentp) {
4581 if (ret == 0)
4582 WARN("Could not find matched password record.");
4583
4584 ERROR("Failed to get password record - %u", geteuid());
cb7aa5e8
DJ		 4585 return NULL;
4586 }
4587
4f410b2a 4588 return strdup(pwent.pw_name);
97e9cfa0
SH		 4589}
4590
a96a8e8c 4591/* not thread-safe, do not use from api without first forking */
97e9cfa0
SH		 4592static char *getgname(void)
4593{
4f410b2a 4594 __do_free char *buf = NULL;
3de9fb4c
DJ		 4595 struct group grent;
4596 struct group *grentp = NULL;
3de9fb4c
DJ		 4597 size_t bufsize;
4598 int ret;
4599
4600 bufsize = sysconf(_SC_GETGR_R_SIZE_MAX);
4601 if (bufsize == -1)
4602 bufsize = 1024;
4603
4604 buf = malloc(bufsize);
4605 if (!buf)
4606 return NULL;
4607
4608 ret = getgrgid_r(getegid(), &grent, buf, bufsize, &grentp);
4609 if (!grentp) {
4610 if (ret == 0)
4611 WARN("Could not find matched group record");
97e9cfa0 4612
3de9fb4c 4613 ERROR("Failed to get group record - %u", getegid());
97e9cfa0 4614 return NULL;
3de9fb4c
DJ		 4615 }
4616
4f410b2a 4617 return strdup(grent.gr_name);
97e9cfa0
SH		 4618}
4619
a96a8e8c 4620/* not thread-safe, do not use from api without first forking */
97e9cfa0
SH		 4621void suggest_default_idmap(void)
4622{
3a6e3bf5 4623 __do_free char *gname = NULL, *line = NULL, *uname = NULL;
97e9cfa0
SH		 4624 FILE *f;
4625 unsigned int uid = 0, urange = 0, gid = 0, grange = 0;
97e9cfa0
SH		 4626 size_t len = 0;
4627
0fd73091
CB		 4628 uname = getuname();
4629 if (!uname)
97e9cfa0
SH		 4630 return;
4631
0fd73091 4632 gname = getgname();
3a6e3bf5 4633 if (!gname)
97e9cfa0 4634 return;
97e9cfa0
SH		 4635
4636 f = fopen(subuidfile, "r");
4637 if (!f) {
4638 ERROR("Your system is not configured with subuids");
97e9cfa0
SH		 4639 return;
4640 }
0fd73091 4641
97e9cfa0 4642 while (getline(&line, &len, f) != -1) {
0fd73091 4643 char *p, *p2;
b7930180 4644 size_t no_newline = 0;
0fd73091
CB		 4645
4646 p = strchr(line, ':');
97e9cfa0
SH		 4647 if (*line == '#')
4648 continue;
4649 if (!p)
4650 continue;
4651 *p = '\0';
4652 p++;
0fd73091 4653
97e9cfa0
SH		 4654 if (strcmp(line, uname))
4655 continue;
0fd73091 4656
97e9cfa0
SH		 4657 p2 = strchr(p, ':');
4658 if (!p2)
4659 continue;
4660 *p2 = '\0';
4661 p2++;
4662 if (!*p2)
4663 continue;
b7930180
CB		 4664 no_newline = strcspn(p2, "\n");
4665 p2[no_newline] = '\0';
4666
b7b2fde4 4667 if (lxc_safe_uint(p, &uid) < 0)
0fd73091 4668 WARN("Could not parse UID");
b7b2fde4 4669 if (lxc_safe_uint(p2, &urange) < 0)
0fd73091 4670 WARN("Could not parse UID range");
97e9cfa0
SH		 4671 }
4672 fclose(f);
4673
6be7389a 4674 f = fopen(subgidfile, "r");
97e9cfa0
SH		 4675 if (!f) {
4676 ERROR("Your system is not configured with subgids");
97e9cfa0
SH		 4677 return;
4678 }
0fd73091 4679
97e9cfa0 4680 while (getline(&line, &len, f) != -1) {
0fd73091 4681 char *p, *p2;
b7930180 4682 size_t no_newline = 0;
0fd73091
CB		 4683
4684 p = strchr(line, ':');
97e9cfa0
SH		 4685 if (*line == '#')
4686 continue;
4687 if (!p)
4688 continue;
4689 *p = '\0';
4690 p++;
0fd73091 4691
97e9cfa0
SH		 4692 if (strcmp(line, uname))
4693 continue;
0fd73091 4694
97e9cfa0
SH		 4695 p2 = strchr(p, ':');
4696 if (!p2)
4697 continue;
4698 *p2 = '\0';
4699 p2++;
4700 if (!*p2)
4701 continue;
b7930180
CB		 4702 no_newline = strcspn(p2, "\n");
4703 p2[no_newline] = '\0';
4704
b7b2fde4 4705 if (lxc_safe_uint(p, &gid) < 0)
0fd73091 4706 WARN("Could not parse GID");
b7b2fde4 4707 if (lxc_safe_uint(p2, &grange) < 0)
0fd73091 4708 WARN("Could not parse GID range");
97e9cfa0
SH		 4709 }
4710 fclose(f);
4711
97e9cfa0
SH		 4712 if (!urange || !grange) {
4713 ERROR("You do not have subuids or subgids allocated");
4714 ERROR("Unprivileged containers require subuids and subgids");
4715 return;
4716 }
4717
4718 ERROR("You must either run as root, or define uid mappings");
4719 ERROR("To pass uid mappings to lxc-create, you could create");
4720 ERROR("~/.config/lxc/default.conf:");
4721 ERROR("lxc.include = %s", LXC_DEFAULT_CONFIG);
bdcbb6b3
CB		 4722 ERROR("lxc.idmap = u 0 %u %u", uid, urange);
4723 ERROR("lxc.idmap = g 0 %u %u", gid, grange);
97e9cfa0 4724}
aaf26830 4725
a7307747
SH		 4726static void free_cgroup_settings(struct lxc_list *result)
4727{
4728 struct lxc_list *iterator, *next;
4729
0fd73091 4730 lxc_list_for_each_safe (iterator, result, next) {
a7307747
SH		 4731 lxc_list_del(iterator);
4732 free(iterator);
4733 }
4734 free(result);
4735}
4736
0fd73091 4737/* Return the list of cgroup_settings sorted according to the following rules
aaf26830
KT		 4738 * 1. Put memory.limit_in_bytes before memory.memsw.limit_in_bytes
4739 */
0fd73091 4740struct lxc_list *sort_cgroup_settings(struct lxc_list *cgroup_settings)
aaf26830
KT		 4741{
4742 struct lxc_list *result;
aaf26830 4743 struct lxc_cgroup *cg = NULL;
0fd73091 4744 struct lxc_list *it = NULL, *item = NULL, *memsw_limit = NULL;
aaf26830
KT		 4745
4746 result = malloc(sizeof(*result));
0fd73091 4747 if (!result)
fac7c663 4748 return NULL;
aaf26830
KT		 4749 lxc_list_init(result);
4750
0fd73091
CB		 4751 /* Iterate over the cgroup settings and copy them to the output list. */
4752 lxc_list_for_each (it, cgroup_settings) {
aaf26830 4753 item = malloc(sizeof(*item));
fac7c663 4754 if (!item) {
a7307747 4755 free_cgroup_settings(result);
fac7c663
KT		 4756 return NULL;
4757 }
0fd73091 4758
aaf26830
KT		 4759 item->elem = it->elem;
4760 cg = it->elem;
4761 if (strcmp(cg->subsystem, "memory.memsw.limit_in_bytes") == 0) {
4762 /* Store the memsw_limit location */
4763 memsw_limit = item;
0fd73091
CB		 4764 } else if (strcmp(cg->subsystem, "memory.limit_in_bytes") == 0 &&
4765 memsw_limit != NULL) {
4766 /* lxc.cgroup.memory.memsw.limit_in_bytes is found
4767 * before lxc.cgroup.memory.limit_in_bytes, swap these
4768 * two items */
aaf26830
KT		 4769 item->elem = memsw_limit->elem;
4770 memsw_limit->elem = it->elem;
4771 }
4772 lxc_list_add_tail(result, item);
4773 }
4774
4775 return result;
a7307747 4776}
LXC mirror