]>
Commit | Line | Data |
---|---|---|
5bb3ba8a DL |
1 | /* |
2 | * lxc: linux Container library | |
3 | * | |
4 | * (C) Copyright IBM Corp. 2007, 2009 | |
5 | * | |
6 | * Authors: | |
9afe19d6 | 7 | * Daniel Lezcano <daniel.lezcano at free.fr> |
5bb3ba8a DL |
8 | * |
9 | * This library is free software; you can redistribute it and/or | |
10 | * modify it under the terms of the GNU Lesser General Public | |
11 | * License as published by the Free Software Foundation; either | |
12 | * version 2.1 of the License, or (at your option) any later version. | |
13 | * | |
14 | * This library is distributed in the hope that it will be useful, | |
15 | * but WITHOUT ANY WARRANTY; without even the implied warranty of | |
16 | * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU | |
17 | * Lesser General Public License for more details. | |
18 | * | |
19 | * You should have received a copy of the GNU Lesser General Public | |
20 | * License along with this library; if not, write to the Free Software | |
250b1eec | 21 | * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA |
5bb3ba8a DL |
22 | */ |
23 | ||
d38dd64a CB |
24 | #ifndef _GNU_SOURCE |
25 | #define _GNU_SOURCE 1 | |
26 | #endif | |
5bb3ba8a DL |
27 | #include <alloca.h> |
28 | #include <errno.h> | |
a2028b8f | 29 | #include <fcntl.h> |
8ab93249 | 30 | #include <sched.h> |
5bb3ba8a | 31 | #include <signal.h> |
81c75799 | 32 | #include <sys/param.h> |
81c75799 | 33 | #include <sys/stat.h> |
8ab93249 | 34 | #include <sys/syscall.h> |
a2028b8f | 35 | #include <sys/types.h> |
d38dd64a | 36 | #include <unistd.h> |
5bb3ba8a | 37 | |
d38dd64a | 38 | #include "config.h" |
81c75799 | 39 | #include "log.h" |
a2028b8f CB |
40 | #include "namespace.h" |
41 | #include "utils.h" | |
81c75799 | 42 | |
ac2cecc4 | 43 | lxc_log_define(namespace, lxc); |
5bb3ba8a DL |
44 | |
45 | struct clone_arg { | |
46 | int (*fn)(void *); | |
47 | void *arg; | |
48 | }; | |
49 | ||
50 | static int do_clone(void *arg) | |
51 | { | |
52 | struct clone_arg *clone_arg = arg; | |
53 | return clone_arg->fn(clone_arg->arg); | |
54 | } | |
55 | ||
56 | pid_t lxc_clone(int (*fn)(void *), void *arg, int flags) | |
57 | { | |
58 | struct clone_arg clone_arg = { | |
59 | .fn = fn, | |
60 | .arg = arg, | |
61 | }; | |
62 | ||
a2028b8f | 63 | size_t stack_size = lxc_getpagesize(); |
92c64f7e | 64 | void *stack = alloca(stack_size); |
5bb3ba8a DL |
65 | pid_t ret; |
66 | ||
246091b9 | 67 | #ifdef __ia64__ |
8ab93249 | 68 | ret = __clone2(do_clone, stack, stack_size, flags | SIGCHLD, &clone_arg); |
246091b9 | 69 | #else |
6e055cce | 70 | ret = clone(do_clone, stack + stack_size, flags | SIGCHLD, &clone_arg); |
246091b9 | 71 | #endif |
5bb3ba8a | 72 | if (ret < 0) |
6d1400b5 | 73 | SYSERROR("Failed to clone (%#x)", flags); |
5bb3ba8a DL |
74 | |
75 | return ret; | |
76 | } | |
39a5d5fe | 77 | |
29ed9c13 CB |
78 | /* Leave the user namespace at the first position in the array of structs so |
79 | * that we always attach to it first when iterating over the struct and using | |
80 | * setns() to switch namespaces. This especially affects lxc_attach(): Suppose | |
81 | * you cloned a new user namespace and mount namespace as an unprivileged user | |
82 | * on the host and want to setns() to the mount namespace. This requires you to | |
83 | * attach to the user namespace first otherwise the kernel will fail this check: | |
84 | * | |
85 | * if (!ns_capable(mnt_ns->user_ns, CAP_SYS_ADMIN) || | |
86 | * !ns_capable(current_user_ns(), CAP_SYS_CHROOT) || | |
87 | * !ns_capable(current_user_ns(), CAP_SYS_ADMIN)) | |
88 | * return -EPERM; | |
89 | * | |
90 | * in | |
91 | * | |
92 | * linux/fs/namespace.c:mntns_install(). | |
93 | */ | |
9662e444 | 94 | const struct ns_info ns_info[LXC_NS_MAX] = { |
18b3b9c1 CB |
95 | [LXC_NS_USER] = { "user", CLONE_NEWUSER, "CLONE_NEWUSER", "LXC_USER_NS" }, |
96 | [LXC_NS_MNT] = { "mnt", CLONE_NEWNS, "CLONE_NEWNS", "LXC_MNT_NS" }, | |
97 | [LXC_NS_PID] = { "pid", CLONE_NEWPID, "CLONE_NEWPID", "LXC_PID_NS" }, | |
98 | [LXC_NS_UTS] = { "uts", CLONE_NEWUTS, "CLONE_NEWUTS", "LXC_UTS_NS" }, | |
99 | [LXC_NS_IPC] = { "ipc", CLONE_NEWIPC, "CLONE_NEWIPC", "LXC_IPC_NS" }, | |
100 | [LXC_NS_NET] = { "net", CLONE_NEWNET, "CLONE_NEWNET", "LXC_NET_NS" }, | |
101 | [LXC_NS_CGROUP] = { "cgroup", CLONE_NEWCGROUP, "CLONE_NEWCGROUP", "LXC_CGROUP_NS" } | |
39a5d5fe CS |
102 | }; |
103 | ||
28d9e29e | 104 | int lxc_namespace_2_cloneflag(const char *namespace) |
39a5d5fe | 105 | { |
9662e444 | 106 | int i; |
727b9b16 | 107 | |
9662e444 CB |
108 | for (i = 0; i < LXC_NS_MAX; i++) |
109 | if (!strcasecmp(ns_info[i].proc_name, namespace)) | |
110 | return ns_info[i].clone_flag; | |
39a5d5fe | 111 | |
28d9e29e CB |
112 | ERROR("Invalid namespace name \"%s\"", namespace); |
113 | return -EINVAL; | |
114 | } | |
115 | ||
116 | int lxc_namespace_2_ns_idx(const char *namespace) | |
117 | { | |
118 | int i; | |
727b9b16 | 119 | |
28d9e29e CB |
120 | for (i = 0; i < LXC_NS_MAX; i++) |
121 | if (!strcmp(ns_info[i].proc_name, namespace)) | |
122 | return i; | |
123 | ||
124 | ERROR("Invalid namespace name \"%s\"", namespace); | |
125 | return -EINVAL; | |
39a5d5fe CS |
126 | } |
127 | ||
42067d18 | 128 | extern int lxc_namespace_2_std_identifiers(char *namespaces) |
129 | { | |
130 | char **it; | |
131 | char *del; | |
132 | ||
133 | /* The identifiers for namespaces used with lxc-attach and lxc-unshare | |
134 | * as given on the manpage do not align with the standard identifiers. | |
135 | * This affects network, mount, and uts namespaces. The standard identifiers | |
136 | * are: "mnt", "uts", and "net" whereas lxc-attach and lxc-unshare uses | |
137 | * "MOUNT", "UTSNAME", and "NETWORK". So let's use some cheap memmove()s | |
138 | * to replace them by their standard identifiers. | |
139 | * Let's illustrate this with an example: | |
140 | * Assume the string: | |
141 | * | |
142 | * "IPC|MOUNT|PID" | |
143 | * | |
144 | * then we memmove() | |
145 | * | |
146 | * dest: del + 1 == OUNT|PID | |
147 | * src: del + 3 == NT|PID | |
148 | */ | |
149 | if (!namespaces) | |
150 | return -1; | |
151 | ||
152 | while ((del = strstr(namespaces, "MOUNT"))) | |
153 | memmove(del + 1, del + 3, strlen(del) - 2); | |
154 | ||
155 | for (it = (char *[]){"NETWORK", "UTSNAME", NULL}; it && *it; it++) | |
156 | while ((del = strstr(namespaces, *it))) | |
157 | memmove(del + 3, del + 7, strlen(del) - 6); | |
158 | ||
159 | return 0; | |
160 | } | |
161 | ||
39a5d5fe CS |
162 | int lxc_fill_namespace_flags(char *flaglist, int *flags) |
163 | { | |
803fd7bf | 164 | char *token; |
39a5d5fe CS |
165 | int aflag; |
166 | ||
167 | if (!flaglist) { | |
9662e444 | 168 | ERROR("At least one namespace is needed."); |
39a5d5fe CS |
169 | return -1; |
170 | } | |
171 | ||
803fd7bf | 172 | lxc_iterate_parts(token, flaglist, "|") { |
39a5d5fe CS |
173 | aflag = lxc_namespace_2_cloneflag(token); |
174 | if (aflag < 0) | |
175 | return -1; | |
176 | ||
177 | *flags |= aflag; | |
39a5d5fe | 178 | } |
727b9b16 | 179 | |
39a5d5fe CS |
180 | return 0; |
181 | } |