]> git.proxmox.com Git - mirror_lxc.git/blame - src/lxc/conf.h
Add test script to test the ro option of lxc.rootfs.options
[mirror_lxc.git] / src / lxc / conf.h
CommitLineData
0ad19a3f 1/*
2 * lxc: linux Container library
3 *
4 * (C) Copyright IBM Corp. 2007, 2008
5 *
6 * Authors:
9afe19d6 7 * Daniel Lezcano <daniel.lezcano at free.fr>
0ad19a3f 8 *
9 * This library is free software; you can redistribute it and/or
10 * modify it under the terms of the GNU Lesser General Public
11 * License as published by the Free Software Foundation; either
12 * version 2.1 of the License, or (at your option) any later version.
13 *
14 * This library is distributed in the hope that it will be useful,
15 * but WITHOUT ANY WARRANTY; without even the implied warranty of
16 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
17 * Lesser General Public License for more details.
18 *
19 * You should have received a copy of the GNU Lesser General Public
20 * License along with this library; if not, write to the Free Software
250b1eec 21 * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
0ad19a3f 22 */
f1a4a029
ÇO
23#ifndef __LXC_CONF_H
24#define __LXC_CONF_H
0ad19a3f 25
f424fa8f
SG
26#include "config.h"
27
9fc7f8c0 28#include <stdio.h>
0ad19a3f 29#include <netinet/in.h>
74a2b586 30#include <net/if.h>
b0a33c1e 31#include <sys/param.h>
8173e600 32#include <sys/types.h>
c6d09e15
WB
33#if HAVE_SYS_RESOURCE_H
34#include <sys/resource.h>
35#endif
19a26f82 36#include <stdbool.h>
0ad19a3f 37
f2363e38
ÇO
38#include "list.h"
39#include "start.h" /* for lxc_handler */
e3b4c4c4 40
769872f9
SH
41#if HAVE_SCMP_FILTER_CTX
42typedef void * scmp_filter_ctx;
43#endif
44
97e9cfa0
SH
45/* worth moving to configure.ac? */
46#define subuidfile "/etc/subuid"
47#define subgidfile "/etc/subgid"
48
13954cce 49enum {
24654103
DL
50 LXC_NET_EMPTY,
51 LXC_NET_VETH,
52 LXC_NET_MACVLAN,
53 LXC_NET_PHYS,
54 LXC_NET_VLAN,
26b797f3 55 LXC_NET_NONE,
24654103 56 LXC_NET_MAXCONFTYPE,
0ad19a3f 57};
58
59/*
60 * Defines the structure to configure an ipv4 address
61 * @address : ipv4 address
62 * @broadcast : ipv4 broadcast address
63 * @mask : network mask
64 */
65struct lxc_inetdev {
66 struct in_addr addr;
67 struct in_addr bcast;
1c633398 68 unsigned int prefix;
0ad19a3f 69};
70
71struct lxc_route {
72 struct in_addr addr;
73};
74
75/*
76 * Defines the structure to configure an ipv6 address
77 * @flags : set the address up
78 * @address : ipv6 address
79 * @broadcast : ipv6 broadcast address
80 * @mask : network mask
81 */
82struct lxc_inet6dev {
83 struct in6_addr addr;
0093bb8c 84 struct in6_addr mcast;
0ad19a3f 85 struct in6_addr acast;
1c633398 86 unsigned int prefix;
0ad19a3f 87};
88
89struct lxc_route6 {
90 struct in6_addr addr;
91};
26c39028 92
e892973e
DL
93struct ifla_veth {
94 char *pair; /* pair name */
74a2b586 95 char veth1[IFNAMSIZ]; /* needed for deconf */
e892973e
DL
96};
97
26c39028 98struct ifla_vlan {
85dce4a5
NC
99 unsigned int flags;
100 unsigned int fmask;
7c11d57a
SG
101 unsigned short vid;
102 unsigned short pad;
26c39028
JHS
103};
104
e892973e 105struct ifla_macvlan {
99854161 106 int mode; /* private, vepa, bridge, passthru */
e892973e
DL
107};
108
f6cc1de1 109union netdev_p {
e892973e 110 struct ifla_veth veth_attr;
f6cc1de1 111 struct ifla_vlan vlan_attr;
e892973e 112 struct ifla_macvlan macvlan_attr;
f6cc1de1
JHS
113};
114
0ad19a3f 115/*
116 * Defines a structure to configure a network device
7fa3f2e9 117 * @link : lxc.net.[i].link, name of bridge or host iface to attach if any
118 * @name : lxc.net.[i].name, name of iface on the container side
e3b4c4c4
ST
119 * @flags : flag of the network device (IFF_UP, ... )
120 * @ipv4 : a list of ipv4 addresses to be set on the network device
121 * @ipv6 : a list of ipv6 addresses to be set on the network device
122 * @upscript : a script filename to be executed during interface configuration
74a2b586 123 * @downscript : a script filename to be executed during interface destruction
5c35a8f1 124 * @idx : network counter
0ad19a3f 125 */
126struct lxc_netdev {
c302b476 127 ssize_t idx;
5f4535a3 128 int type;
0ad19a3f 129 int flags;
82d5ae15 130 int ifindex;
9d083402
MT
131 char *link;
132 char *name;
0ad19a3f 133 char *hwaddr;
442cbbe6 134 char *mtu;
f6cc1de1 135 union netdev_p priv;
0ad19a3f 136 struct lxc_list ipv4;
137 struct lxc_list ipv6;
f8fee0e2 138 struct in_addr *ipv4_gateway;
19a26f82 139 bool ipv4_gateway_auto;
f8fee0e2 140 struct in6_addr *ipv6_gateway;
19a26f82 141 bool ipv6_gateway_auto;
e3b4c4c4 142 char *upscript;
74a2b586 143 char *downscript;
0ad19a3f 144};
145
146/*
576f946d 147 * Defines a generic struct to configure the control group.
148 * It is up to the programmer to specify the right subsystem.
ec64264d 149 * @subsystem : the targeted subsystem
576f946d 150 * @value : the value to set
0ad19a3f 151 */
152struct lxc_cgroup {
576f946d 153 char *subsystem;
154 char *value;
0ad19a3f 155};
156
c6d09e15
WB
157#if !HAVE_SYS_RESOURCE_H
158# define RLIM_INFINITY ((unsigned long)-1)
159struct rlimit {
160 unsigned long rlim_cur;
161 unsigned long rlim_max;
162};
163#endif
164/*
165 * Defines a structure to configure resource limits to set via setrlimit().
166 * @resource : the resource name in lowercase without the RLIMIT_ prefix
167 * @limit : the limit to set
168 */
169struct lxc_limit {
170 char *resource;
171 struct rlimit limit;
172};
173
f6d3e3e4
SH
174enum idtype {
175 ID_TYPE_UID,
176 ID_TYPE_GID
177};
178
179/*
180 * id_map is an id map entry. Form in confile is:
251d0d2a
DE
181 * lxc.id_map = u 0 9800 100
182 * lxc.id_map = u 1000 9900 100
183 * lxc.id_map = g 0 9800 100
184 * lxc.id_map = g 1000 9900 100
185 * meaning the container can use uids and gids 0-99 and 1000-1099,
186 * with [ug]id 0 mapping to [ug]id 9800 on the host, and [ug]id 1000 to
187 * [ug]id 9900 on the host.
f6d3e3e4
SH
188 */
189struct id_map {
190 enum idtype idtype;
251d0d2a 191 unsigned long hostid, nsid, range;
f6d3e3e4
SH
192};
193
b0a33c1e 194/*
195 * Defines a structure containing a pty information for
196 * virtualizing a tty
197 * @name : the path name of the slave pty side
198 * @master : the file descriptor of the master
199 * @slave : the file descriptor of the slave
200 */
201struct lxc_pty_info {
202 char name[MAXPATHLEN];
203 int master;
204 int slave;
205 int busy;
206};
207
208/*
209 * Defines the number of tty configured and contains the
a589434e 210 * instantiated ptys
b0a33c1e 211 * @nbtty = number of configured ttys
212 */
213struct lxc_tty_info {
214 int nbtty;
215 struct lxc_pty_info *pty_info;
216};
217
b5159817
DE
218struct lxc_tty_state;
219
63376d7d
DL
220/*
221 * Defines the structure to store the console information
222 * @peer : the file descriptor put/get console traffic
223 * @name : the file name of the slave pty
224 */
225struct lxc_console {
226 int slave;
227 int master;
228 int peer;
b5159817
DE
229 struct lxc_pty_info peerpty;
230 struct lxc_epoll_descr *descr;
28a4b0e5 231 char *path;
596a818d
DE
232 char *log_path;
233 int log_fd;
63376d7d 234 char name[MAXPATHLEN];
e0dc0de7 235 struct termios *tios;
b5159817 236 struct lxc_tty_state *tty_state;
63376d7d
DL
237};
238
33fcb7a0
DL
239/*
240 * Defines a structure to store the rootfs location, the
241 * optionals pivot_root, rootfs mount paths
59bb8698
SH
242 * @path : the rootfs source (directory or device)
243 * @mount : where it is mounted
244 * @options : mount options
b3b8c97f 245 * @bev_type : optional backing store type
33fcb7a0
DL
246 */
247struct lxc_rootfs {
248 char *path;
23b7ea69 249 char *mount;
a17b1e65 250 char *options;
b3b8c97f 251 char *bdev_type;
33fcb7a0
DL
252};
253
368bbc02
CS
254/*
255 * Automatic mounts for LXC to perform inside the container
256 */
257enum {
b06b8511
CS
258 LXC_AUTO_PROC_RW = 0x001, /* /proc read-write */
259 LXC_AUTO_PROC_MIXED = 0x002, /* /proc/sys and /proc/sysrq-trigger read-only */
260 LXC_AUTO_PROC_MASK = 0x003,
261
262 LXC_AUTO_SYS_RW = 0x004, /* /sys */
263 LXC_AUTO_SYS_RO = 0x008, /* /sys read-only */
f24a52d5 264 LXC_AUTO_SYS_MIXED = 0x00C, /* /sys read-only and /sys/class/net read-write */
b06b8511
CS
265 LXC_AUTO_SYS_MASK = 0x00C,
266
267 LXC_AUTO_CGROUP_RO = 0x010, /* /sys/fs/cgroup (partial mount, read-only) */
268 LXC_AUTO_CGROUP_RW = 0x020, /* /sys/fs/cgroup (partial mount, read-write) */
269 LXC_AUTO_CGROUP_MIXED = 0x030, /* /sys/fs/cgroup (partial mount, paths r/o, cgroup r/w) */
270 LXC_AUTO_CGROUP_FULL_RO = 0x040, /* /sys/fs/cgroup (full mount, read-only) */
271 LXC_AUTO_CGROUP_FULL_RW = 0x050, /* /sys/fs/cgroup (full mount, read-write) */
272 LXC_AUTO_CGROUP_FULL_MIXED = 0x060, /* /sys/fs/cgroup (full mount, parent r/o, own r/w) */
0769b82a
CS
273 /* These are defined in such a way as to retain
274 * binary compatibility with earlier versions of
275 * this code. If the previous mask is applied,
276 * both of these will default back to the _MIXED
277 * variants, which is safe. */
278 LXC_AUTO_CGROUP_NOSPEC = 0x0B0, /* /sys/fs/cgroup (partial mount, r/w or mixed, depending on caps) */
279 LXC_AUTO_CGROUP_FULL_NOSPEC = 0x0E0, /* /sys/fs/cgroup (full mount, r/w or mixed, depending on caps) */
280 LXC_AUTO_CGROUP_MASK = 0x0F0,
b06b8511 281
0769b82a 282 LXC_AUTO_ALL_MASK = 0x0FF, /* all known settings */
368bbc02
CS
283};
284
571e6ec8
DL
285/*
286 * Defines the global container configuration
63376d7d 287 * @rootfs : root directory to run the container
63376d7d
DL
288 * @mount : list of mount points
289 * @tty : numbers of tty
290 * @pts : new pts instance
291 * @mount_list : list of mount point (alternative to fstab file)
292 * @network : network configuration
293 * @utsname : container utsname
294 * @fstab : path to a fstab file format
1fb86a7c
SH
295 * @caps : list of the capabilities to drop
296 * @keepcaps : list of the capabilities to keep
63376d7d
DL
297 * @tty_info : tty data
298 * @console : console data
7c6ef2a2 299 * @ttydir : directory (under /dev) in which to create console and ttys
fe4de9a6
DE
300 * @lsm_aa_profile : apparmor profile to switch to or NULL
301 * @lsm_se_context : selinux type to switch to or NULL
571e6ec8 302 */
26ddeedd 303enum lxchooks {
f7bee6c6 304 LXCHOOK_PRESTART, LXCHOOK_PREMOUNT, LXCHOOK_MOUNT, LXCHOOK_AUTODEV,
52492063 305 LXCHOOK_START, LXCHOOK_STOP, LXCHOOK_POSTSTOP, LXCHOOK_CLONE, LXCHOOK_DESTROY,
37cf711b 306 NUM_LXC_HOOKS};
72d0e1cb
SG
307extern char *lxchook_names[NUM_LXC_HOOKS];
308
7b35f3d6
SH
309struct saved_nic {
310 int ifindex;
311 char *orig_name;
312};
313
571e6ec8 314struct lxc_conf {
37903589 315 int is_execute;
571e6ec8 316 char *fstab;
1c30b4ad 317 unsigned int tty;
17919969 318 unsigned int pts;
91480a0f 319 int reboot;
828695d9 320 int need_utmp_watch;
9b8e3c96 321 signed long personality;
571e6ec8
DL
322 struct utsname *utsname;
323 struct lxc_list cgroup;
f6d3e3e4 324 struct lxc_list id_map;
5f4535a3 325 struct lxc_list network;
7b35f3d6
SH
326 struct saved_nic *saved_nics;
327 int num_savednics;
368bbc02 328 int auto_mounts;
e7938e9e 329 struct lxc_list mount_list;
81810dd1 330 struct lxc_list caps;
1fb86a7c 331 struct lxc_list keepcaps;
571e6ec8 332 struct lxc_tty_info tty_info;
fe1c5887
CB
333 /* Comma-separated list of lxc.tty.max pty names. */
334 char *pty_names;
63376d7d 335 struct lxc_console console;
33fcb7a0 336 struct lxc_rootfs rootfs;
7c6ef2a2 337 char *ttydir;
b119f362 338 int close_all_fds;
26ddeedd 339 struct lxc_list hooks[NUM_LXC_HOOKS];
4a85ce2a 340
fe4de9a6 341 char *lsm_aa_profile;
a56e2df9 342 unsigned int lsm_aa_allow_incomplete;
fe4de9a6 343 char *lsm_se_context;
5112cd70 344 int tmp_umount_proc;
8f2c3a70 345 char *seccomp; // filename with the seccomp rules
769872f9 346#if HAVE_SCMP_FILTER_CTX
d58c6ad0 347 scmp_filter_ctx seccomp_ctx;
769872f9 348#endif
72d0e1cb 349 int maincmd_fd;
ff6cb4ed 350 unsigned int autodev; // if 1, mount and fill a /dev at start
f0f1d8c0 351 int haltsignal; // signal used to halt container
dd267776 352 int rebootsignal; // signal used to reboot container
f0f1d8c0 353 int stopsignal; // signal used to hard stop container
f7bee6c6 354 char *rcfile; // Copy of the top level rcfile we read
b40a606e
SH
355
356 // Logfile and logleve can be set in a container config file.
357 // Those function as defaults. The defaults can be overriden
358 // by command line. However we don't want the command line
359 // specified values to be saved on c->save_config(). So we
360 // store the config file specified values here.
361 char *logfile; // the logfile as specifed in config
362 int loglevel; // loglevel as specifed in config (if any)
858377e4 363 int logfd;
9f30a190
MM
364
365 int inherit_ns_fd[LXC_NS_MAX];
ee1e7aa0 366
3590152f
CB
367 unsigned int start_auto;
368 unsigned int start_delay;
ee1e7aa0
SG
369 int start_order;
370 struct lxc_list groups;
76a26f55 371 int nbd_idx;
35120d9c 372
a8dfe4e0 373 /* unshare the mount namespace in the monitor */
226dc30e 374 unsigned int monitor_unshare;
a8dfe4e0 375
35120d9c
SH
376 /* set to true when rootfs has been setup */
377 bool rootfs_setup;
f979ac15
SH
378
379 /* list of included files */
380 struct lxc_list includes;
4184c3e1
SH
381 /* config entries which are not "lxc.*" are aliens */
382 struct lxc_list aliens;
7c661726
MP
383
384 /* list of environment variables we'll add to the container when
385 * started */
386 struct lxc_list environment;
6b0d5538
SH
387
388 /* text representation of the config file */
389 char *unexpanded_config;
390 size_t unexpanded_len, unexpanded_alloced;
67c660d0
SG
391
392 /* init command */
393 char *init_cmd;
56f8ff00 394
72bb04e4
PT
395 /* if running in a new user namespace, the UID/GID that init and COMMAND
396 * should run under when using lxc-execute */
c5cd20ce
PT
397 uid_t init_uid;
398 gid_t init_gid;
8796becf
CB
399
400 /* indicator if the container will be destroyed on shutdown */
66ffdb1a 401 unsigned int ephemeral;
76d0127f
CB
402
403 /* The facility to pass to syslog. Let's users establish as what type of
404 * program liblxc is supposed to write to the syslog. */
405 char *syslog;
5a46f283
CB
406
407 /* Whether PR_SET_NO_NEW_PRIVS will be set for the container. */
408 bool no_new_privs;
c6d09e15
WB
409
410 /* RLIMIT_* limits */
411 struct lxc_list limits;
571e6ec8
DL
412};
413
858377e4
SH
414#ifdef HAVE_TLS
415extern __thread struct lxc_conf *current_config;
416#else
417extern struct lxc_conf *current_config;
418#endif
419
283678ed
SH
420int run_lxc_hooks(const char *name, char *hook, struct lxc_conf *conf,
421 const char *lxcpath, char *argv[]);
26ddeedd 422
cc28d0b0
SH
423extern int detect_shared_rootfs(void);
424
089cd8b8
DL
425/*
426 * Initialize the lxc configuration structure
427 */
7b379ab3 428extern struct lxc_conf *lxc_conf_init(void);
8eb5694b 429extern void lxc_conf_free(struct lxc_conf *conf);
089cd8b8 430
0c547523
SH
431extern int pin_rootfs(const char *rootfs);
432
26b797f3 433extern int lxc_requests_empty_network(struct lxc_handler *handler);
e337179a 434extern int lxc_setup_networks_in_parent_namespaces(struct lxc_handler *handler);
358daf49 435extern bool lxc_delete_network(struct lxc_handler *handler);
c43cbc04
SH
436extern int lxc_assign_network(const char *lxcpath, char *lxcname,
437 struct lxc_list *networks, pid_t pid);
f6d3e3e4 438extern int lxc_map_ids(struct lxc_list *idmap, pid_t pid);
19a26f82 439extern int lxc_find_gateway_addresses(struct lxc_handler *handler);
0ad19a3f 440
5e4a62bf 441extern int lxc_create_tty(const char *name, struct lxc_conf *conf);
b0a33c1e 442extern void lxc_delete_tty(struct lxc_tty_info *tty_info);
443
72d0e1cb 444extern int lxc_clear_config_caps(struct lxc_conf *c);
1fb86a7c 445extern int lxc_clear_config_keepcaps(struct lxc_conf *c);
12a50cc6 446extern int lxc_clear_cgroups(struct lxc_conf *c, const char *key);
72d0e1cb 447extern int lxc_clear_mount_entries(struct lxc_conf *c);
b099e9e9 448extern int lxc_clear_automounts(struct lxc_conf *c);
12a50cc6 449extern int lxc_clear_hooks(struct lxc_conf *c, const char *key);
7d0eb87e 450extern int lxc_clear_idmaps(struct lxc_conf *c);
ee1e7aa0 451extern int lxc_clear_groups(struct lxc_conf *c);
ab799c0b 452extern int lxc_clear_environment(struct lxc_conf *c);
c6d09e15 453extern int lxc_clear_limits(struct lxc_conf *c, const char *key);
f0d02950 454extern int lxc_delete_autodev(struct lxc_handler *handler);
c7b15d1e 455extern void lxc_clear_includes(struct lxc_conf *conf);
72d0e1cb 456
35120d9c
SH
457extern int do_rootfs_setup(struct lxc_conf *conf, const char *name,
458 const char *lxcpath);
459
0ad19a3f 460/*
461 * Configure the container from inside
462 */
88d5514d 463
368bbc02 464struct cgroup_process_info;
d4ef7c50 465extern int lxc_setup(struct lxc_handler *handler);
7b35f3d6 466
c6d09e15
WB
467extern int setup_resource_limits(struct lxc_list *limits, pid_t pid);
468
5610055a 469extern void lxc_restore_phys_nics_to_netns(int netnsfd, struct lxc_conf *conf);
cf3ef16d 470
339efad9 471extern int find_unmapped_nsid(struct lxc_conf *conf, enum idtype idtype);
2133f58c 472extern int mapped_hostid(unsigned id, struct lxc_conf *conf, enum idtype idtype);
c4d10a05 473extern int chown_mapped_root(char *path, struct lxc_conf *conf);
54117de5 474extern int lxc_ttys_shift_ids(struct lxc_conf *c);
c9b7c33e
CB
475extern int userns_exec_1(struct lxc_conf *conf, int (*fn)(void *), void *data,
476 const char *fn_name);
a17b1e65
SG
477extern int parse_mntopts(const char *mntopts, unsigned long *mntflags,
478 char **mntdata);
5112cd70 479extern void tmp_proc_unmount(struct lxc_conf *lxc_conf);
6a0c909a 480void remount_all_slave(void);
97e9cfa0 481extern void suggest_default_idmap(void);
5ef5c9a3 482FILE *make_anonymous_mount_file(struct lxc_list *mount);
aaf26830 483struct lxc_list *sort_cgroup_settings(struct lxc_list* cgroup_settings);
0ad19a3f 484#endif