[mirror_lxc.git] / src / lxc / start.c

/*
 * lxc: linux Container library
 *
 * (C) Copyright IBM Corp. 2007, 2008
 *
 * Authors:
 * Daniel Lezcano <dlezcano at fr.ibm.com>
 *
 * This library is free software; you can redistribute it and/or
 * modify it under the terms of the GNU Lesser General Public
 * License as published by the Free Software Foundation; either
 * version 2.1 of the License, or (at your option) any later version.
 *
 * This library is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
 * Lesser General Public License for more details.
 *
 * You should have received a copy of the GNU Lesser General Public
 * License along with this library; if not, write to the Free Software
 * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
 */

#include "../config.h"
#include <stdio.h>
#undef _GNU_SOURCE
#include <string.h>
#include <stdlib.h>
#include <dirent.h>
#include <errno.h>
#include <unistd.h>
#include <signal.h>
#include <fcntl.h>
#include <termios.h>
#include <namespace.h>
#include <sys/param.h>
#include <sys/file.h>
#include <sys/mount.h>
#include <sys/types.h>
#include <sys/prctl.h>
#include <sys/types.h>
#include <sys/capability.h>
#include <sys/wait.h>
#include <sys/un.h>
#include <sys/poll.h>

#ifdef HAVE_SYS_SIGNALFD_H 
#  include <sys/signalfd.h>
#else
#  ifndef __NR_signalfd4
/* assume kernel headers are too old */
#    if __i386__
#      define __NR_signalfd4 327
#    elif __x86_64__
#      define __NR_signalfd4 289
#    elif __powerpc__
#      define __NR_signalfd4 313
#    elif __s390x__
#      define __NR_signalfd4 322
#    endif
#endif

#  ifndef __NR_signalfd
/* assume kernel headers are too old */
#    if __i386__
#      define __NR_signalfd 321
#    elif __x86_64__
#      define __NR_signalfd 282
#    elif __powerpc__
#      define __NR_signalfd 305
#    elif __s390x__
#      define __NR_signalfd 316
#    endif
#endif

int signalfd(int fd, const sigset_t *mask, int flags)
{
	int retval;

	retval = syscall (__NR_signalfd4, fd, mask, _NSIG / 8, flags);
	if (errno == ENOSYS && flags == 0)
		retval = syscall (__NR_signalfd, fd, mask, _NSIG / 8);
	return retval;
}
#endif

#if !HAVE_DECL_PR_CAPBSET_DROP
#define PR_CAPBSET_DROP 24
#endif

#include <lxc/log.h>
#include <lxc/conf.h>
#include <lxc/confile.h>
#include <lxc/start.h>
#include <lxc/utils.h>
#include <lxc/cgroup.h>
#include <lxc/monitor.h>

#include "error.h"
#include "af_unix.h"
#include "mainloop.h"
#include "commands.h"


lxc_log_define(lxc_start, lxc);

LXC_TTY_HANDLER(SIGINT);
LXC_TTY_HANDLER(SIGQUIT);

static int setup_sigchld_fd(sigset_t *oldmask)
{
	sigset_t mask;
	int fd;

	if (sigprocmask(SIG_BLOCK, NULL, &mask)) {
		SYSERROR("failed to get mask signal");
		return -1;
	}

	if (sigaddset(&mask, SIGCHLD) || sigprocmask(SIG_BLOCK, &mask, oldmask)) {
		SYSERROR("failed to set mask signal");
		return -1;
	}

	fd = signalfd(-1, &mask, 0);
	if (fd < 0) {
		SYSERROR("failed to create the signal fd");
		return -1;
	}

	if (fcntl(fd, F_SETFD, FD_CLOEXEC)) {
		SYSERROR("failed to set sigfd to close-on-exec");
		close(fd);
		return -1;
	}

	DEBUG("sigchild handler set");

	return fd;
}

static int sigchld_handler(int fd, void *data, 
			   struct lxc_epoll_descr *descr)
{
	DEBUG("child exited");

	return 1;
}

int lxc_set_state(const char *name, struct lxc_handler *handler, lxc_state_t state)
{
	handler->state = state;
	lxc_monitor_send_state(name, state);
	return 0;
}

int lxc_poll(const char *name, struct lxc_handler *handler)
{
	int sigfd = handler->sigfd;
	int pid = handler->pid;
	int ret = -1;
	struct lxc_epoll_descr descr;

	if (lxc_mainloop_open(&descr)) {
		ERROR("failed to create mainloop");
		goto out_sigfd;
	}

	if (lxc_mainloop_add_handler(&descr, sigfd, sigchld_handler, &pid)) {
		ERROR("failed to add handler for the signal");
		goto out_mainloop_open;
	}

	if (lxc_command_mainloop_add(name, &descr, handler))
		goto out_mainloop_open;

	ret = lxc_mainloop(&descr);

out:
	return ret;

out_mainloop_open:
	lxc_mainloop_close(&descr);
out_sigfd:
	close(sigfd);
	goto out;
}

static int fdname(int fd, char *name, size_t size)
{
	char path[MAXPATHLEN];
	ssize_t len;

	snprintf(path, MAXPATHLEN, "/proc/self/fd/%d", fd);

	len = readlink(path, name, size);
	if (len >  0)
		path[len] = '\0';

	return (len <= 0) ? -1 : 0;
}

static int console_init(char *console, size_t size)
{
	struct stat stat;
	int i;

	for (i = 0; i < 3; i++) {
		if (!isatty(i))
			continue;

		if (ttyname_r(i, console, size)) {
			SYSERROR("failed to retrieve tty name");
			return -1;
		}

		return 0;
	}

	if (!fstat(0, &stat)) {
		if (S_ISREG(stat.st_mode) || S_ISCHR(stat.st_mode) ||
		    S_ISFIFO(stat.st_mode) || S_ISLNK(stat.st_mode))
			return fdname(0, console, size);
	}

	console[0] = '\0';

	DEBUG("console initialized");

	return 0;
}

struct lxc_handler *lxc_init(const char *name, struct lxc_conf *conf)
{
	struct lxc_handler *handler;

	handler = malloc(sizeof(*handler));
	if (!handler)
		return NULL;

	memset(handler, 0, sizeof(*handler));

	handler->conf = conf;

	/* Begin the set the state to STARTING*/
	if (lxc_set_state(name, handler, STARTING)) {
		ERROR("failed to set state '%s'", lxc_state2str(STARTING));
		goto out_free;
	}

	if (console_init(conf->console, sizeof(conf->console))) {
		ERROR("failed to initialize the console");
		goto out_aborting;
	}

	if (lxc_create_tty(name, conf)) {
		ERROR("failed to create the ttys");
		goto out_aborting;
	}

	/* the signal fd has to be created before forking otherwise
	 * if the child process exits before we setup the signal fd,
	 * the event will be lost and the command will be stuck */
	handler->sigfd = setup_sigchld_fd(&handler->oldmask);
	if (handler->sigfd < 0) {
		ERROR("failed to set sigchild fd handler");
		goto out_delete_tty;
	}

	/* Avoid signals from terminal */
	LXC_TTY_ADD_HANDLER(SIGINT);
	LXC_TTY_ADD_HANDLER(SIGQUIT);

out:
	if (handler)
		INFO("'%s' is initialized", name);

	return handler;

out_delete_tty:
	lxc_delete_tty(&conf->tty_info);
out_aborting:
	lxc_set_state(name, handler, ABORTING);
out_free:
	free(handler);
	handler = NULL;
	goto out;
}

void lxc_fini(const char *name, struct lxc_handler *handler)
{
	/* The STOPPING state is there for future cleanup code
	 * which can take awhile
	 */
	lxc_set_state(name, handler, STOPPING);
	lxc_set_state(name, handler, STOPPED);
	lxc_unlink_nsgroup(name);

	if (handler) {
		lxc_delete_tty(&handler->conf->tty_info);
		free(handler);
	}

	LXC_TTY_DEL_HANDLER(SIGQUIT);
	LXC_TTY_DEL_HANDLER(SIGINT);
}

void lxc_abort(const char *name, struct lxc_handler *handler)
{
	lxc_set_state(name, handler, ABORTING);
	kill(handler->pid, SIGKILL);
}

struct start_arg {
	const char *name;
	char *const *argv;
	struct lxc_handler *handler;
	int *sv;
};

static int do_start(void *arg)
{
	struct start_arg *start_arg = arg;
	struct lxc_handler *handler = start_arg->handler;
	const char *name = start_arg->name;
	char *const *argv = start_arg->argv;
	int *sv = start_arg->sv;
	int err = -1, sync;

	if (sigprocmask(SIG_SETMASK, &handler->oldmask, NULL)) {
		SYSERROR("failed to set sigprocmask");
		goto out_child;
	}

	close(sv[1]);

	/* Be sure we don't inherit this after the exec */
	fcntl(sv[0], F_SETFD, FD_CLOEXEC);

	/* Tell our father he can begin to configure the container */
	if (write(sv[0], &sync, sizeof(sync)) < 0) {
		SYSERROR("failed to write socket");
		goto out_child;
	}

	/* Wait for the father to finish the configuration */
	if (read(sv[0], &sync, sizeof(sync)) < 0) {
		SYSERROR("failed to read socket");
		goto out_child;
	}

	/* Setup the container, ip, names, utsname, ... */
	if (lxc_setup(name, handler->conf)) {
		ERROR("failed to setup the container");
		goto out_warn_father;
	}

	if (prctl(PR_CAPBSET_DROP, CAP_SYS_BOOT, 0, 0, 0)) {
		SYSERROR("failed to remove CAP_SYS_BOOT capability");
		goto out_child;
	}

	if (prctl(PR_SET_PDEATHSIG, SIGKILL, 0, 0, 0)) {
		SYSERROR("failed to set pdeath signal");
		goto out_child;
	}

	NOTICE("exec'ing '%s'", argv[0]);

	execvp(argv[0], argv);
	SYSERROR("failed to exec %s", argv[0]);

out_warn_father:
	/* If the exec fails, tell that to our father */
	if (write(sv[0], &err, sizeof(err)) < 0)
		SYSERROR("failed to write the socket");
out_child:
	return -1;
}

int lxc_spawn(const char *name, struct lxc_handler *handler, char *const argv[])
{
	int sv[2];
	int clone_flags;
	int err = -1, sync;

	struct start_arg start_arg = {
		.name = name,
		.argv = argv,
		.handler = handler,
		.sv = sv,
	};

	/* Synchro socketpair */
	if (socketpair(AF_LOCAL, SOCK_STREAM, 0, sv)) {
		SYSERROR("failed to create communication socketpair");
		goto out;
	}

	clone_flags = CLONE_NEWUTS|CLONE_NEWPID|CLONE_NEWIPC|CLONE_NEWNS;
	if (!lxc_list_empty(&handler->conf->network)) {

		clone_flags |= CLONE_NEWNET;

		/* that should be done before the clone because we will
		 * fill the netdev index and use them in the child
		 */
		if (lxc_create_network(&handler->conf->network)) {
			ERROR("failed to create the network");
			goto out_close;
		}
	}

	/* Create a process in a new set of namespaces */
	handler->pid = lxc_clone(do_start, &start_arg, clone_flags);
	if (handler->pid < 0) {
		SYSERROR("failed to fork into a new namespace");
		goto out_close;
	}

	close(sv[0]);
	
	/* Wait for the child to be ready */
	if (read(sv[1], &sync, sizeof(sync)) < 0) {
		SYSERROR("failed to read the socket");
		goto out_abort;
	}

	if (lxc_rename_nsgroup(name, handler))
		goto out_abort;

	/* Create the network configuration */
	if (clone_flags & CLONE_NEWNET) {
		if (lxc_assign_network(&handler->conf->network, handler->pid)) {
			ERROR("failed to create the configured network");
			goto out_abort;
		}
	}

	/* Tell the child to continue its initialization */
	if (write(sv[1], &sync, sizeof(sync)) < 0) {
		SYSERROR("failed to write the socket");
		goto out_abort;
	}

	/* Wait for the child to exec or returning an error */
	if (read(sv[1], &sync, sizeof(sync)) < 0) {
		ERROR("failed to read the socket");
		goto out_abort;
	}

	if (lxc_set_state(name, handler, RUNNING)) {
		ERROR("failed to set state to %s",
			      lxc_state2str(RUNNING));
		goto out_abort;
	}

	err = 0;

	NOTICE("'%s' started with pid '%d'", argv[0], handler->pid);

out_close:
	close(sv[0]);
	close(sv[1]);
out:
	return err;

out_abort:
	lxc_abort(name, handler);
	goto out_close;
}

int lxc_start(const char *name, char *const argv[], struct lxc_conf *conf)
{
	struct lxc_handler *handler;
	int err = -1;
	int status;

	handler = lxc_init(name, conf);
	if (!handler) {
		ERROR("failed to initialize the container");
		return -1;
	}

	err = lxc_spawn(name, handler, argv);
	if (err) {
		ERROR("failed to spawn '%s'", argv[0]);
		goto out;
	}

	err = lxc_close_all_inherited_fd();
	if (err) {
		ERROR("unable to close inherited fds");
		goto out_abort;
	}

	err = lxc_poll(name, handler);
	if (err) {
		ERROR("mainloop exited with an error");
		goto out_abort;
	}

	while (waitpid(handler->pid, &status, 0) < 0 && errno == EINTR)
		continue;

	err =  lxc_error_set_and_log(handler->pid, status);
out:
	lxc_fini(name, handler);
	return err;

out_abort:
	lxc_abort(name, handler);
	goto out;
}
Commit	Line	Data
0ad19a3f	1	/*
	2	* lxc: linux Container library
	3	*
	4	* (C) Copyright IBM Corp. 2007, 2008
	5	*
	6	* Authors:
	7	* Daniel Lezcano <dlezcano at fr.ibm.com>
	8	*
	9	* This library is free software; you can redistribute it and/or
	10	* modify it under the terms of the GNU Lesser General Public
	11	* License as published by the Free Software Foundation; either
	12	* version 2.1 of the License, or (at your option) any later version.
	13	*
	14	* This library is distributed in the hope that it will be useful,
	15	* but WITHOUT ANY WARRANTY; without even the implied warranty of
	16	* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
	17	* Lesser General Public License for more details.
	18	*
	19	* You should have received a copy of the GNU Lesser General Public
	20	* License along with this library; if not, write to the Free Software
	21	* Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
	22	*/
	23
ff218c25	24	#include "../config.h"
0ad19a3f	25	#include <stdio.h>
	26	#undef _GNU_SOURCE
	27	#include <string.h>
	28	#include <stdlib.h>
	29	#include <dirent.h>
	30	#include <errno.h>
	31	#include <unistd.h>
	32	#include <signal.h>
b0a33c1e	33	#include <fcntl.h>
b0a33c1e	34	#include <termios.h>
50e98013	35	#include <namespace.h>
0ad19a3f	36	#include <sys/param.h>
0ad19a3f	37	#include <sys/file.h>
f4d507d5	38	#include <sys/mount.h>
0ad19a3f	39	#include <sys/types.h>
0ad19a3f	40	#include <sys/prctl.h>
ddceb1f9	41	#include <sys/types.h>
42ff343d	42	#include <sys/capability.h>
0ad19a3f	43	#include <sys/wait.h>
b0a33c1e	44	#include <sys/un.h>
b0a33c1e	45	#include <sys/poll.h>
ff218c25	46
ff218c25	47	#ifdef HAVE_SYS_SIGNALFD_H
8ca61733	48	# include <sys/signalfd.h>
ff218c25	49	#else
8ca61733 MJ	50	# ifndef __NR_signalfd4
	51	/* assume kernel headers are too old */
	52	# if __i386__
	53	# define __NR_signalfd4 327
	54	# elif __x86_64__
	55	# define __NR_signalfd4 289
bfa38025 MH	56	# elif __powerpc__
bfa38025 MH	57	# define __NR_signalfd4 313
47f38330 SH	58	# elif __s390x__
47f38330 SH	59	# define __NR_signalfd4 322
8ca61733 MJ	60	# endif
	61	#endif
	62
	63	# ifndef __NR_signalfd
	64	/* assume kernel headers are too old */
	65	# if __i386__
	66	# define __NR_signalfd 321
	67	# elif __x86_64__
	68	# define __NR_signalfd 282
bfa38025 MH	69	# elif __powerpc__
bfa38025 MH	70	# define __NR_signalfd 305
47f38330 SH	71	# elif __s390x__
47f38330 SH	72	# define __NR_signalfd 316
8ca61733 MJ	73	# endif
	74	#endif
	75
	76	int signalfd(int fd, const sigset_t *mask, int flags)
	77	{
	78	int retval;
	79
	80	retval = syscall (__NR_signalfd4, fd, mask, _NSIG / 8, flags);
	81	if (errno == ENOSYS && flags == 0)
	82	retval = syscall (__NR_signalfd, fd, mask, _NSIG / 8);
	83	return retval;
	84	}
ff218c25	85	#endif
0ad19a3f	86
656994bb MH	87	#if !HAVE_DECL_PR_CAPBSET_DROP
	88	#define PR_CAPBSET_DROP 24
	89	#endif
	90
00b3c2e2 CLG	91	#include <lxc/log.h>
	92	#include <lxc/conf.h>
	93	#include <lxc/confile.h>
	94	#include <lxc/start.h>
	95	#include <lxc/utils.h>
	96	#include <lxc/cgroup.h>
	97	#include <lxc/monitor.h>
	98
e2bcd7db	99	#include "error.h"
b0a33c1e	100	#include "af_unix.h"
b0a33c1e	101	#include "mainloop.h"
96fa1ff0	102	#include "commands.h"
e2bcd7db	103
36eb9bde CLG	104
	105	lxc_log_define(lxc_start, lxc);
	106
0ad19a3f	107	LXC_TTY_HANDLER(SIGINT);
	108	LXC_TTY_HANDLER(SIGQUIT);
	109
b0a33c1e	110	static int setup_sigchld_fd(sigset_t *oldmask)
	111	{
	112	sigset_t mask;
	113	int fd;
	114
	115	if (sigprocmask(SIG_BLOCK, NULL, &mask)) {
36eb9bde	116	SYSERROR("failed to get mask signal");
b0a33c1e	117	return -1;
	118	}
	119
	120	if (sigaddset(&mask, SIGCHLD) \|\| sigprocmask(SIG_BLOCK, &mask, oldmask)) {
36eb9bde	121	SYSERROR("failed to set mask signal");
b0a33c1e	122	return -1;
	123	}
	124
	125	fd = signalfd(-1, &mask, 0);
	126	if (fd < 0) {
36eb9bde	127	SYSERROR("failed to create the signal fd");
b0a33c1e	128	return -1;
	129	}
	130
	131	if (fcntl(fd, F_SETFD, FD_CLOEXEC)) {
36eb9bde	132	SYSERROR("failed to set sigfd to close-on-exec");
b0a33c1e	133	close(fd);
	134	return -1;
	135	}
	136
1ac470c0 DL	137	DEBUG("sigchild handler set");
1ac470c0 DL	138
b0a33c1e	139	return fd;
	140	}
	141
b0a33c1e	142	static int sigchld_handler(int fd, void *data,
	143	struct lxc_epoll_descr *descr)
	144	{
1ac470c0 DL	145	DEBUG("child exited");
1ac470c0 DL	146
b0a33c1e	147	return 1;
	148	}
	149
25c2aca5	150	int lxc_set_state(const char name, struct lxc_handler handler, lxc_state_t state)
66aeffc7 DL	151	{
	152	handler->state = state;
	153	lxc_monitor_send_state(name, state);
	154	return 0;
	155	}
	156
1bc5cc8c	157	int lxc_poll(const char name, struct lxc_handler handler)
b0a33c1e	158	{
ca5f7926 DL	159	int sigfd = handler->sigfd;
ca5f7926 DL	160	int pid = handler->pid;
a9e61274	161	int ret = -1;
b0a33c1e	162	struct lxc_epoll_descr descr;
b0a33c1e	163
a9e61274	164	if (lxc_mainloop_open(&descr)) {
36eb9bde	165	ERROR("failed to create mainloop");
50c8bf05	166	goto out_sigfd;
b0a33c1e	167	}
	168
	169	if (lxc_mainloop_add_handler(&descr, sigfd, sigchld_handler, &pid)) {
36eb9bde	170	ERROR("failed to add handler for the signal");
b0a33c1e	171	goto out_mainloop_open;
	172	}
	173
724e753c	174	if (lxc_command_mainloop_add(name, &descr, handler))
96fa1ff0	175	goto out_mainloop_open;
b0a33c1e	176
	177	ret = lxc_mainloop(&descr);
	178
	179	out:
	180	return ret;
	181
	182	out_mainloop_open:
	183	lxc_mainloop_close(&descr);
b0a33c1e	184	out_sigfd:
	185	close(sigfd);
	186	goto out;
	187	}
	188
b8f57738 DL	189	static int fdname(int fd, char *name, size_t size)
	190	{
	191	char path[MAXPATHLEN];
acc86941	192	ssize_t len;
b8f57738 DL	193
	194	snprintf(path, MAXPATHLEN, "/proc/self/fd/%d", fd);
	195
acc86941 MN	196	len = readlink(path, name, size);
	197	if (len > 0)
	198	path[len] = '\0';
	199
	200	return (len <= 0) ? -1 : 0;
b8f57738 DL	201	}
	202
	203	static int console_init(char *console, size_t size)
	204	{
	205	struct stat stat;
	206	int i;
	207
	208	for (i = 0; i < 3; i++) {
	209	if (!isatty(i))
	210	continue;
	211
	212	if (ttyname_r(i, console, size)) {
	213	SYSERROR("failed to retrieve tty name");
	214	return -1;
	215	}
af795875	216
b8f57738 DL	217	return 0;
	218	}
	219
	220	if (!fstat(0, &stat)) {
	221	if (S_ISREG(stat.st_mode) \|\| S_ISCHR(stat.st_mode) \|\|
	222	S_ISFIFO(stat.st_mode) \|\| S_ISLNK(stat.st_mode))
	223	return fdname(0, console, size);
	224	}
	225
	226	console[0] = '\0';
1ac470c0 DL	227
	228	DEBUG("console initialized");
	229
b8f57738 DL	230	return 0;
	231	}
	232
fae349da	233	struct lxc_handler lxc_init(const char name, struct lxc_conf *conf)
59eb99ba	234	{
3a0f472d DL	235	struct lxc_handler *handler;
	236
	237	handler = malloc(sizeof(*handler));
	238	if (!handler)
	239	return NULL;
59eb99ba DL	240
	241	memset(handler, 0, sizeof(*handler));
	242
fae349da DL	243	handler->conf = conf;
fae349da DL	244
0ad19a3f	245	/* Begin the set the state to STARTING*/
25c2aca5	246	if (lxc_set_state(name, handler, STARTING)) {
59eb99ba	247	ERROR("failed to set state '%s'", lxc_state2str(STARTING));
884866b3	248	goto out_free;
0ad19a3f	249	}
0ad19a3f	250
fae349da	251	if (console_init(conf->console, sizeof(conf->console))) {
b8f57738 DL	252	ERROR("failed to initialize the console");
	253	goto out_aborting;
	254	}
939229eb	255
fae349da	256	if (lxc_create_tty(name, conf)) {
36eb9bde	257	ERROR("failed to create the ttys");
59eb99ba	258	goto out_aborting;
b0a33c1e	259	}
	260
	261	/* the signal fd has to be created before forking otherwise
	262	* if the child process exits before we setup the signal fd,
	263	* the event will be lost and the command will be stuck */
59eb99ba DL	264	handler->sigfd = setup_sigchld_fd(&handler->oldmask);
59eb99ba DL	265	if (handler->sigfd < 0) {
36eb9bde	266	ERROR("failed to set sigchild fd handler");
59eb99ba	267	goto out_delete_tty;
b0a33c1e	268	}
b0a33c1e	269
59eb99ba DL	270	/* Avoid signals from terminal */
	271	LXC_TTY_ADD_HANDLER(SIGINT);
	272	LXC_TTY_ADD_HANDLER(SIGQUIT);
	273
59eb99ba	274	out:
1ac470c0 DL	275	if (handler)
	276	INFO("'%s' is initialized", name);
	277
3a0f472d	278	return handler;
59eb99ba DL	279
59eb99ba DL	280	out_delete_tty:
fae349da	281	lxc_delete_tty(&conf->tty_info);
59eb99ba	282	out_aborting:
25c2aca5	283	lxc_set_state(name, handler, ABORTING);
3a0f472d DL	284	out_free:
	285	free(handler);
	286	handler = NULL;
59eb99ba DL	287	goto out;
	288	}
	289
1bc5cc8c	290	void lxc_fini(const char name, struct lxc_handler handler)
59eb99ba DL	291	{
	292	/* The STOPPING state is there for future cleanup code
	293	* which can take awhile
	294	*/
25c2aca5 MN	295	lxc_set_state(name, handler, STOPPING);
25c2aca5 MN	296	lxc_set_state(name, handler, STOPPED);
59eb99ba DL	297	lxc_unlink_nsgroup(name);
59eb99ba DL	298
3a0f472d	299	if (handler) {
fae349da	300	lxc_delete_tty(&handler->conf->tty_info);
3a0f472d DL	301	free(handler);
3a0f472d DL	302	}
59eb99ba DL	303
	304	LXC_TTY_DEL_HANDLER(SIGQUIT);
	305	LXC_TTY_DEL_HANDLER(SIGINT);
	306	}
	307
1bc5cc8c	308	void lxc_abort(const char name, struct lxc_handler handler)
59eb99ba	309	{
25c2aca5	310	lxc_set_state(name, handler, ABORTING);
59eb99ba DL	311	kill(handler->pid, SIGKILL);
	312	}
	313
50e98013 DL	314	struct start_arg {
	315	const char *name;
	316	char const argv;
	317	struct lxc_handler *handler;
	318	int *sv;
	319	};
	320
	321	static int do_start(void *arg)
	322	{
	323	struct start_arg *start_arg = arg;
	324	struct lxc_handler *handler = start_arg->handler;
	325	const char *name = start_arg->name;
	326	char const argv = start_arg->argv;
	327	int *sv = start_arg->sv;
	328	int err = -1, sync;
	329
	330	if (sigprocmask(SIG_SETMASK, &handler->oldmask, NULL)) {
	331	SYSERROR("failed to set sigprocmask");
	332	goto out_child;
	333	}
	334
	335	close(sv[1]);
	336
	337	/* Be sure we don't inherit this after the exec */
	338	fcntl(sv[0], F_SETFD, FD_CLOEXEC);
	339
	340	/* Tell our father he can begin to configure the container */
	341	if (write(sv[0], &sync, sizeof(sync)) < 0) {
	342	SYSERROR("failed to write socket");
	343	goto out_child;
	344	}
	345
	346	/* Wait for the father to finish the configuration */
	347	if (read(sv[0], &sync, sizeof(sync)) < 0) {
	348	SYSERROR("failed to read socket");
	349	goto out_child;
	350	}
	351
	352	/* Setup the container, ip, names, utsname, ... */
fae349da	353	if (lxc_setup(name, handler->conf)) {
50e98013 DL	354	ERROR("failed to setup the container");
	355	goto out_warn_father;
	356	}
	357
	358	if (prctl(PR_CAPBSET_DROP, CAP_SYS_BOOT, 0, 0, 0)) {
	359	SYSERROR("failed to remove CAP_SYS_BOOT capability");
	360	goto out_child;
	361	}
	362
6a6ad7af DL	363	if (prctl(PR_SET_PDEATHSIG, SIGKILL, 0, 0, 0)) {
	364	SYSERROR("failed to set pdeath signal");
	365	goto out_child;
	366	}
	367
1ac470c0 DL	368	NOTICE("exec'ing '%s'", argv[0]);
1ac470c0 DL	369
50e98013 DL	370	execvp(argv[0], argv);
	371	SYSERROR("failed to exec %s", argv[0]);
	372
	373	out_warn_father:
	374	/* If the exec fails, tell that to our father */
	375	if (write(sv[0], &err, sizeof(err)) < 0)
	376	SYSERROR("failed to write the socket");
	377	out_child:
	378	return -1;
	379	}
	380
9618063c	381	int lxc_spawn(const char name, struct lxc_handler handler, char *const argv[])
59eb99ba DL	382	{
	383	int sv[2];
	384	int clone_flags;
	385	int err = -1, sync;
	386
50e98013 DL	387	struct start_arg start_arg = {
	388	.name = name,
	389	.argv = argv,
	390	.handler = handler,
	391	.sv = sv,
	392	};
	393
0ad19a3f	394	/* Synchro socketpair */
0ad19a3f	395	if (socketpair(AF_LOCAL, SOCK_STREAM, 0, sv)) {
36eb9bde	396	SYSERROR("failed to create communication socketpair");
f4d507d5	397	goto out;
0ad19a3f	398	}
0ad19a3f	399
1ea6db29	400	clone_flags = CLONE_NEWUTS\|CLONE_NEWPID\|CLONE_NEWIPC\|CLONE_NEWNS;
fae349da	401	if (!lxc_list_empty(&handler->conf->network)) {
82d5ae15	402
0ad19a3f	403	clone_flags \|= CLONE_NEWNET;
0ad19a3f	404
82d5ae15 DL	405	/* that should be done before the clone because we will
	406	* fill the netdev index and use them in the child
	407	*/
fae349da	408	if (lxc_create_network(&handler->conf->network)) {
82d5ae15 DL	409	ERROR("failed to create the network");
	410	goto out_close;
	411	}
	412	}
	413
0ad19a3f	414	/* Create a process in a new set of namespaces */
50e98013	415	handler->pid = lxc_clone(do_start, &start_arg, clone_flags);
59eb99ba	416	if (handler->pid < 0) {
36eb9bde	417	SYSERROR("failed to fork into a new namespace");
59eb99ba	418	goto out_close;
0ad19a3f	419	}
0ad19a3f	420
0ad19a3f	421	close(sv[0]);
	422
	423	/* Wait for the child to be ready */
	424	if (read(sv[1], &sync, sizeof(sync)) < 0) {
36eb9bde	425	SYSERROR("failed to read the socket");
59eb99ba	426	goto out_abort;
0ad19a3f	427	}
0ad19a3f	428
9f44c578	429	if (lxc_rename_nsgroup(name, handler))
2b31f553	430	goto out_abort;
218d4250	431
0ad19a3f	432	/* Create the network configuration */
82d5ae15	433	if (clone_flags & CLONE_NEWNET) {
fae349da	434	if (lxc_assign_network(&handler->conf->network, handler->pid)) {
82d5ae15 DL	435	ERROR("failed to create the configured network");
	436	goto out_abort;
	437	}
0ad19a3f	438	}
	439
	440	/* Tell the child to continue its initialization */
	441	if (write(sv[1], &sync, sizeof(sync)) < 0) {
36eb9bde	442	SYSERROR("failed to write the socket");
59eb99ba	443	goto out_abort;
0ad19a3f	444	}
	445
	446	/* Wait for the child to exec or returning an error */
e043236e	447	if (read(sv[1], &sync, sizeof(sync)) < 0) {
36eb9bde	448	ERROR("failed to read the socket");
59eb99ba	449	goto out_abort;
0ad19a3f	450	}
0ad19a3f	451
25c2aca5	452	if (lxc_set_state(name, handler, RUNNING)) {
59eb99ba DL	453	ERROR("failed to set state to %s",
	454	lxc_state2str(RUNNING));
	455	goto out_abort;
3f21c114	456	}
22ebac19	457
59eb99ba	458	err = 0;
22ebac19	459
1ac470c0 DL	460	NOTICE("'%s' started with pid '%d'", argv[0], handler->pid);
1ac470c0 DL	461
59eb99ba DL	462	out_close:
	463	close(sv[0]);
	464	close(sv[1]);
	465	out:
	466	return err;
0ad19a3f	467
59eb99ba DL	468	out_abort:
	469	lxc_abort(name, handler);
	470	goto out_close;
	471	}
0ad19a3f	472
fae349da	473	int lxc_start(const char name, char const argv[], struct lxc_conf *conf)
59eb99ba	474	{
3a0f472d	475	struct lxc_handler *handler;
e043236e	476	int err = -1;
59eb99ba DL	477	int status;
59eb99ba DL	478
fae349da	479	handler = lxc_init(name, conf);
3a0f472d	480	if (!handler) {
59eb99ba	481	ERROR("failed to initialize the container");
66aeffc7	482	return -1;
0ad19a3f	483	}
0ad19a3f	484
3a0f472d	485	err = lxc_spawn(name, handler, argv);
59eb99ba DL	486	if (err) {
	487	ERROR("failed to spawn '%s'", argv[0]);
	488	goto out;
0ad19a3f	489	}
0ad19a3f	490
af795875	491	err = lxc_close_all_inherited_fd();
d983b93c MN	492	if (err) {
	493	ERROR("unable to close inherited fds");
	494	goto out_abort;
	495	}
	496
3a0f472d	497	err = lxc_poll(name, handler);
e043236e	498	if (err) {
59eb99ba DL	499	ERROR("mainloop exited with an error");
	500	goto out_abort;
	501	}
0ad19a3f	502
3a0f472d	503	while (waitpid(handler->pid, &status, 0) < 0 && errno == EINTR)
1bc5cc8c	504	continue;
e043236e	505
3a0f472d	506	err = lxc_error_set_and_log(handler->pid, status);
0ad19a3f	507	out:
3a0f472d	508	lxc_fini(name, handler);
0ad19a3f	509	return err;
0ad19a3f	510
59eb99ba	511	out_abort:
3a0f472d	512	lxc_abort(name, handler);
0ad19a3f	513	goto out;
0ad19a3f	514	}