[mirror_lxc.git] / src / lxc / start.c

/*
 * lxc: linux Container library
 *
 * (C) Copyright IBM Corp. 2007, 2008
 *
 * Authors:
 * Daniel Lezcano <dlezcano at fr.ibm.com>
 *
 * This library is free software; you can redistribute it and/or
 * modify it under the terms of the GNU Lesser General Public
 * License as published by the Free Software Foundation; either
 * version 2.1 of the License, or (at your option) any later version.
 *
 * This library is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
 * Lesser General Public License for more details.
 *
 * You should have received a copy of the GNU Lesser General Public
 * License along with this library; if not, write to the Free Software
 * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
 */

#include "../config.h"
#include <stdio.h>
#undef _GNU_SOURCE
#include <string.h>
#include <stdlib.h>
#include <dirent.h>
#include <errno.h>
#include <unistd.h>
#include <signal.h>
#include <fcntl.h>
#include <termios.h>
#include <namespace.h>
#include <sys/param.h>
#include <sys/file.h>
#include <sys/mount.h>
#include <sys/types.h>
#include <sys/prctl.h>
#include <sys/types.h>
#include <sys/capability.h>
#include <sys/wait.h>
#include <sys/un.h>
#include <sys/poll.h>

#ifdef HAVE_SYS_SIGNALFD_H 
#  include <sys/signalfd.h>
#else
#  ifndef __NR_signalfd4
/* assume kernel headers are too old */
#    if __i386__
#      define __NR_signalfd4 327
#    elif __x86_64__
#      define __NR_signalfd4 289
#    elif __powerpc__
#      define __NR_signalfd4 313
#    elif __s390x__
#      define __NR_signalfd4 322
#    endif
#endif

#  ifndef __NR_signalfd
/* assume kernel headers are too old */
#    if __i386__
#      define __NR_signalfd 321
#    elif __x86_64__
#      define __NR_signalfd 282
#    elif __powerpc__
#      define __NR_signalfd 305
#    elif __s390x__
#      define __NR_signalfd 316
#    endif
#endif

int signalfd(int fd, const sigset_t *mask, int flags)
{
	int retval;

	retval = syscall (__NR_signalfd4, fd, mask, _NSIG / 8, flags);
	if (errno == ENOSYS && flags == 0)
		retval = syscall (__NR_signalfd, fd, mask, _NSIG / 8);
	return retval;
}
#endif

#if !HAVE_DECL_PR_CAPBSET_DROP
#define PR_CAPBSET_DROP 24
#endif

#include "error.h"
#include "af_unix.h"
#include "mainloop.h"

#include <lxc/lxc.h>
#include <lxc/log.h>

lxc_log_define(lxc_start, lxc);

LXC_TTY_HANDLER(SIGINT);
LXC_TTY_HANDLER(SIGQUIT);

struct lxc_handler {
	int sigfd;
	int lock;
	pid_t pid;
	char tty[MAXPATHLEN];
	sigset_t oldmask;
	struct lxc_tty_info tty_info;
};

static int setup_sigchld_fd(sigset_t *oldmask)
{
	sigset_t mask;
	int fd;

	if (sigprocmask(SIG_BLOCK, NULL, &mask)) {
		SYSERROR("failed to get mask signal");
		return -1;
	}

	if (sigaddset(&mask, SIGCHLD) || sigprocmask(SIG_BLOCK, &mask, oldmask)) {
		SYSERROR("failed to set mask signal");
		return -1;
	}

	fd = signalfd(-1, &mask, 0);
	if (fd < 0) {
		SYSERROR("failed to create the signal fd");
		return -1;
	}

	if (fcntl(fd, F_SETFD, FD_CLOEXEC)) {
		SYSERROR("failed to set sigfd to close-on-exec");
		close(fd);
		return -1;
	}

	return fd;
}

static int setup_tty_service(const char *name, int *ttyfd)
{
	int fd;
	struct sockaddr_un addr = { 0 };
	char *offset = &addr.sun_path[1];
	
	strcpy(offset, name);
	addr.sun_path[0] = '\0';

	fd = lxc_af_unix_open(addr.sun_path, SOCK_STREAM, 0);
	if (fd < 0)
		return -1;

	if (fcntl(fd, F_SETFD, FD_CLOEXEC)) {
		SYSERROR("failed to close-on-exec flag");
		close(fd);
		return -1;
	}

	*ttyfd = fd;

	return 0;
}

static int sigchld_handler(int fd, void *data, 
			   struct lxc_epoll_descr *descr)
{
	return 1;
}

static int ttyclient_handler(int fd, void *data,
			     struct lxc_epoll_descr *descr)
{
	int i;
 	struct lxc_tty_info *tty_info = data;

	for (i = 0; i < tty_info->nbtty; i++) {

		if (tty_info->pty_info[i].busy != fd)
			continue;

		lxc_mainloop_del_handler(descr, fd);
		tty_info->pty_info[i].busy = 0;
		close(fd);
	}

	return 0;
}

static int ttyservice_handler(int fd, void *data,
			      struct lxc_epoll_descr *descr)
{
	int conn, ttynum, val = 1, ret = -1;
	struct lxc_tty_info *tty_info = data;
	
	conn = accept(fd, NULL, 0);
	if (conn < 0) {
		SYSERROR("failed to accept tty client");
		return -1;
	}
	
	if (setsockopt(conn, SOL_SOCKET, SO_PASSCRED, &val, sizeof(val))) {
		SYSERROR("failed to enable credential on socket");
		goto out_close;
	}

	if (lxc_af_unix_rcv_credential(conn, &ttynum, sizeof(ttynum)))
		goto out_close;

	if (ttynum > 0) {
		if (ttynum > tty_info->nbtty)
			goto out_close;

		if (tty_info->pty_info[ttynum - 1].busy)
			goto out_close;

		goto out_send;
	}

	/* fixup index tty1 => [0] */
	for (ttynum = 1;
	     ttynum <= tty_info->nbtty && tty_info->pty_info[ttynum - 1].busy;
	     ttynum++);

	/* we didn't find any available slot for tty */
	if (ttynum > tty_info->nbtty)
		goto out_close;

out_send:
	if (lxc_af_unix_send_fd(conn, tty_info->pty_info[ttynum - 1].master,
				&ttynum, sizeof(ttynum)) < 0) {
		ERROR("failed to send tty to client");
		goto out_close;
	}

	if (lxc_mainloop_add_handler(descr, conn,
				     ttyclient_handler, tty_info)) {
		ERROR("failed to add tty client handler");
		goto out_close;
	}

	tty_info->pty_info[ttynum - 1].busy = conn;

	ret = 0;
out:
	return ret;
out_close:
	close(conn);
	goto out;
}

int lxc_poll(const char *name, struct lxc_handler *handler)
{
	int sigfd = handler->sigfd;
	int pid = handler->pid;
	const struct lxc_tty_info *tty_info = &handler->tty_info;

	int nfds, ttyfd = -1, ret = -1;
	struct lxc_epoll_descr descr;

	if (tty_info->nbtty && setup_tty_service(name, &ttyfd)) {
		ERROR("failed to create the tty service point");
		goto out_sigfd;
	}

	/* sigfd + nb tty + tty service 
	 * if tty is enabled */
	nfds = tty_info->nbtty + 1 + tty_info->nbtty ? 1 : 0;

	if (lxc_mainloop_open(nfds, &descr)) {
		ERROR("failed to create mainloop");
		goto out_ttyfd;
	}

	if (lxc_mainloop_add_handler(&descr, sigfd, sigchld_handler, &pid)) {
		ERROR("failed to add handler for the signal");
		goto out_mainloop_open;
	}

	if (tty_info->nbtty) {
		if (lxc_mainloop_add_handler(&descr, ttyfd, 
					     ttyservice_handler, 
					     (void *)tty_info)) {
			ERROR("failed to add handler for the tty");
			goto out_mainloop_open;
		}
	}

	ret = lxc_mainloop(&descr);

out:
	return ret;

out_mainloop_open:
	lxc_mainloop_close(&descr);
out_ttyfd:
	close(ttyfd);
out_sigfd:
	close(sigfd);
	goto out;
}

static int save_init_pid(const char *name, pid_t pid)
{
	char init[MAXPATHLEN];
	char *val;
	int fd, err = -1;

	snprintf(init, MAXPATHLEN, LXCPATH "/%s/init", name);

	if (!asprintf(&val, "%d\n", pid)) {
		SYSERROR("failed to allocate memory");
		goto out;
	}

	fd = open(init, O_WRONLY|O_CREAT|O_TRUNC, S_IRUSR|S_IWUSR);
	if (fd < 0) {
		SYSERROR("failed to open '%s'", init);
		goto out_free;
	}

	if (write(fd, val, strlen(val)) < 0) {
		SYSERROR("failed to write the init pid");
		goto out_close;
	}

	err = 0;

out_close:
	close(fd);
out_free:
	free(val);
out:
	return err;
}

static void remove_init_pid(const char *name, pid_t pid)
{
	char init[MAXPATHLEN];

	snprintf(init, MAXPATHLEN, LXCPATH "/%s/init", name);
	unlink(init);
}

static int fdname(int fd, char *name, size_t size)
{
	char path[MAXPATHLEN];
	ssize_t len;

	snprintf(path, MAXPATHLEN, "/proc/self/fd/%d", fd);

	len = readlink(path, name, size);
	if (len >  0)
		path[len] = '\0';

	return (len <= 0) ? -1 : 0;
}

static int console_init(char *console, size_t size)
{
	struct stat stat;
	int i;

	for (i = 0; i < 3; i++) {
		if (!isatty(i))
			continue;

		if (ttyname_r(i, console, size)) {
			SYSERROR("failed to retrieve tty name");
			return -1;
		}
		return 0;
	}

	if (!fstat(0, &stat)) {
		if (S_ISREG(stat.st_mode) || S_ISCHR(stat.st_mode) ||
		    S_ISFIFO(stat.st_mode) || S_ISLNK(stat.st_mode))
			return fdname(0, console, size);
	}

	console[0] = '\0';
	return 0;
}

struct lxc_handler *lxc_init(const char *name)
{
	struct lxc_handler *handler;

	handler = malloc(sizeof(*handler));
	if (!handler)
		return NULL;

	memset(handler, 0, sizeof(*handler));

	handler->lock = lxc_get_lock(name);
	if (handler->lock < 0)
		goto out_free;

	/* Begin the set the state to STARTING*/
	if (lxc_setstate(name, STARTING)) {
		ERROR("failed to set state '%s'", lxc_state2str(STARTING));
		goto out_put_lock;
	}

	if (console_init(handler->tty, sizeof(handler->tty))) {
		ERROR("failed to initialize the console");
		goto out_aborting;
	}

	if (lxc_create_tty(name, &handler->tty_info)) {
		ERROR("failed to create the ttys");
		goto out_aborting;
	}

	/* the signal fd has to be created before forking otherwise
	 * if the child process exits before we setup the signal fd,
	 * the event will be lost and the command will be stuck */
	handler->sigfd = setup_sigchld_fd(&handler->oldmask);
	if (handler->sigfd < 0) {
		ERROR("failed to set sigchild fd handler");
		goto out_delete_tty;
	}

	/* Avoid signals from terminal */
	LXC_TTY_ADD_HANDLER(SIGINT);
	LXC_TTY_ADD_HANDLER(SIGQUIT);

out:
	return handler;

out_delete_tty:
	lxc_delete_tty(&handler->tty_info);
out_aborting:
	lxc_setstate(name, ABORTING);
out_put_lock:
	lxc_put_lock(handler->lock);
out_free:
	free(handler);
	handler = NULL;
	goto out;
}

void lxc_fini(const char *name, struct lxc_handler *handler)
{
	/* The STOPPING state is there for future cleanup code
	 * which can take awhile
	 */
	lxc_setstate(name, STOPPING);
	lxc_setstate(name, STOPPED);
	lxc_unlink_nsgroup(name);

	if (handler) {
		remove_init_pid(name, handler->pid);
		lxc_delete_tty(&handler->tty_info);
		lxc_put_lock(handler->lock);
		free(handler);
	}

	LXC_TTY_DEL_HANDLER(SIGQUIT);
	LXC_TTY_DEL_HANDLER(SIGINT);
}

void lxc_abort(const char *name, struct lxc_handler *handler)
{
	lxc_setstate(name, ABORTING);
	kill(handler->pid, SIGKILL);
}

struct start_arg {
	const char *name;
	char *const *argv;
	struct lxc_handler *handler;
	int *sv;
};

static int do_start(void *arg)
{
	struct start_arg *start_arg = arg;
	struct lxc_handler *handler = start_arg->handler;
	const char *name = start_arg->name;
	char *const *argv = start_arg->argv;
	int *sv = start_arg->sv;
	int err = -1, sync;

	if (sigprocmask(SIG_SETMASK, &handler->oldmask, NULL)) {
		SYSERROR("failed to set sigprocmask");
		goto out_child;
	}

	close(sv[1]);

	/* Be sure we don't inherit this after the exec */
	fcntl(sv[0], F_SETFD, FD_CLOEXEC);

	/* Tell our father he can begin to configure the container */
	if (write(sv[0], &sync, sizeof(sync)) < 0) {
		SYSERROR("failed to write socket");
		goto out_child;
	}

	/* Wait for the father to finish the configuration */
	if (read(sv[0], &sync, sizeof(sync)) < 0) {
		SYSERROR("failed to read socket");
		goto out_child;
	}

	/* Setup the container, ip, names, utsname, ... */
	if (lxc_setup(name, handler->tty, &handler->tty_info)) {
		ERROR("failed to setup the container");
		goto out_warn_father;
	}

	if (prctl(PR_CAPBSET_DROP, CAP_SYS_BOOT, 0, 0, 0)) {
		SYSERROR("failed to remove CAP_SYS_BOOT capability");
		goto out_child;
	}

	execvp(argv[0], argv);
	SYSERROR("failed to exec %s", argv[0]);

out_warn_father:
	/* If the exec fails, tell that to our father */
	if (write(sv[0], &err, sizeof(err)) < 0)
		SYSERROR("failed to write the socket");
out_child:
	return -1;
}

int lxc_spawn(const char *name, struct lxc_handler *handler, char *const argv[])
{
	int sv[2];
	int clone_flags;
	int err = -1, sync;

	struct start_arg start_arg = {
		.name = name,
		.argv = argv,
		.handler = handler,
		.sv = sv,
	};

	/* Synchro socketpair */
	if (socketpair(AF_LOCAL, SOCK_STREAM, 0, sv)) {
		SYSERROR("failed to create communication socketpair");
		goto out;
	}

	clone_flags = CLONE_NEWUTS|CLONE_NEWPID|CLONE_NEWIPC|CLONE_NEWNS;
	if (conf_has_network(name))
		clone_flags |= CLONE_NEWNET;

	/* Create a process in a new set of namespaces */
	handler->pid = lxc_clone(do_start, &start_arg, clone_flags);
	if (handler->pid < 0) {
		SYSERROR("failed to fork into a new namespace");
		goto out_close;
	}

	close(sv[0]);
	
	/* Wait for the child to be ready */
	if (read(sv[1], &sync, sizeof(sync)) < 0) {
		SYSERROR("failed to read the socket");
		goto out_abort;
	}

	if (lxc_rename_nsgroup(name, handler->pid) || lxc_link_nsgroup(name))
		goto out_abort;

	/* Create the network configuration */
	if (clone_flags & CLONE_NEWNET &&
	    conf_create_network(name, handler->pid)) {
		ERROR("failed to create the configured network");
		goto out_abort;
	}

	/* Tell the child to continue its initialization */
	if (write(sv[1], &sync, sizeof(sync)) < 0) {
		SYSERROR("failed to write the socket");
		goto out_abort;
	}

	/* Wait for the child to exec or returning an error */
	if (read(sv[1], &sync, sizeof(sync)) < 0) {
		ERROR("failed to read the socket");
		goto out_abort;
	}

	if (save_init_pid(name, handler->pid)) {
		ERROR("failed to save the init pid info");
		goto out_abort;
	}

	if (lxc_setstate(name, RUNNING)) {
		ERROR("failed to set state to %s",
			      lxc_state2str(RUNNING));
		goto out_abort;
	}

	err = 0;

out_close:
	close(sv[0]);
	close(sv[1]);
out:
	return err;

out_abort:
	lxc_abort(name, handler);
	goto out_close;
}

int lxc_start(const char *name, char *const argv[])
{
	struct lxc_handler *handler;
	int err = -1;
	int status;

	handler = lxc_init(name);
	if (!handler) {
		ERROR("failed to initialize the container");
		goto out;
	}

	err = lxc_spawn(name, handler, argv);
	if (err) {
		ERROR("failed to spawn '%s'", argv[0]);
		goto out;
	}

	err = lxc_fd_close_inherited();
	if (err) {
		ERROR("unable to close inherited fds");
		goto out_abort;
	}

	err = lxc_poll(name, handler);
	if (err) {
		ERROR("mainloop exited with an error");
		goto out_abort;
	}

	while (waitpid(handler->pid, &status, 0) < 0 && errno == EINTR)
		continue;

	err =  lxc_error_set_and_log(handler->pid, status);
out:
	lxc_fini(name, handler);
	return err;

out_abort:
	lxc_abort(name, handler);
	goto out;
}
Commit	Line	Data
0ad19a3f	1	/*
	2	* lxc: linux Container library
	3	*
	4	* (C) Copyright IBM Corp. 2007, 2008
	5	*
	6	* Authors:
	7	* Daniel Lezcano <dlezcano at fr.ibm.com>
	8	*
	9	* This library is free software; you can redistribute it and/or
	10	* modify it under the terms of the GNU Lesser General Public
	11	* License as published by the Free Software Foundation; either
	12	* version 2.1 of the License, or (at your option) any later version.
	13	*
	14	* This library is distributed in the hope that it will be useful,
	15	* but WITHOUT ANY WARRANTY; without even the implied warranty of
	16	* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
	17	* Lesser General Public License for more details.
	18	*
	19	* You should have received a copy of the GNU Lesser General Public
	20	* License along with this library; if not, write to the Free Software
	21	* Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
	22	*/
	23
ff218c25	24	#include "../config.h"
0ad19a3f	25	#include <stdio.h>
	26	#undef _GNU_SOURCE
	27	#include <string.h>
	28	#include <stdlib.h>
	29	#include <dirent.h>
	30	#include <errno.h>
	31	#include <unistd.h>
	32	#include <signal.h>
b0a33c1e	33	#include <fcntl.h>
b0a33c1e	34	#include <termios.h>
50e98013	35	#include <namespace.h>
0ad19a3f	36	#include <sys/param.h>
0ad19a3f	37	#include <sys/file.h>
f4d507d5	38	#include <sys/mount.h>
0ad19a3f	39	#include <sys/types.h>
0ad19a3f	40	#include <sys/prctl.h>
ddceb1f9	41	#include <sys/types.h>
42ff343d	42	#include <sys/capability.h>
0ad19a3f	43	#include <sys/wait.h>
b0a33c1e	44	#include <sys/un.h>
b0a33c1e	45	#include <sys/poll.h>
ff218c25	46
ff218c25	47	#ifdef HAVE_SYS_SIGNALFD_H
8ca61733	48	# include <sys/signalfd.h>
ff218c25	49	#else
8ca61733 MJ	50	# ifndef __NR_signalfd4
	51	/* assume kernel headers are too old */
	52	# if __i386__
	53	# define __NR_signalfd4 327
	54	# elif __x86_64__
	55	# define __NR_signalfd4 289
bfa38025 MH	56	# elif __powerpc__
bfa38025 MH	57	# define __NR_signalfd4 313
47f38330 SH	58	# elif __s390x__
47f38330 SH	59	# define __NR_signalfd4 322
8ca61733 MJ	60	# endif
	61	#endif
	62
	63	# ifndef __NR_signalfd
	64	/* assume kernel headers are too old */
	65	# if __i386__
	66	# define __NR_signalfd 321
	67	# elif __x86_64__
	68	# define __NR_signalfd 282
bfa38025 MH	69	# elif __powerpc__
bfa38025 MH	70	# define __NR_signalfd 305
47f38330 SH	71	# elif __s390x__
47f38330 SH	72	# define __NR_signalfd 316
8ca61733 MJ	73	# endif
	74	#endif
	75
	76	int signalfd(int fd, const sigset_t *mask, int flags)
	77	{
	78	int retval;
	79
	80	retval = syscall (__NR_signalfd4, fd, mask, _NSIG / 8, flags);
	81	if (errno == ENOSYS && flags == 0)
	82	retval = syscall (__NR_signalfd, fd, mask, _NSIG / 8);
	83	return retval;
	84	}
ff218c25	85	#endif
0ad19a3f	86
656994bb MH	87	#if !HAVE_DECL_PR_CAPBSET_DROP
	88	#define PR_CAPBSET_DROP 24
	89	#endif
	90
e2bcd7db	91	#include "error.h"
b0a33c1e	92	#include "af_unix.h"
b0a33c1e	93	#include "mainloop.h"
e2bcd7db	94
b113348e	95	#include <lxc/lxc.h>
36eb9bde CLG	96	#include <lxc/log.h>
	97
	98	lxc_log_define(lxc_start, lxc);
	99
0ad19a3f	100	LXC_TTY_HANDLER(SIGINT);
	101	LXC_TTY_HANDLER(SIGQUIT);
	102
3a0f472d DL	103	struct lxc_handler {
	104	int sigfd;
	105	int lock;
	106	pid_t pid;
	107	char tty[MAXPATHLEN];
	108	sigset_t oldmask;
	109	struct lxc_tty_info tty_info;
	110	};
	111
b0a33c1e	112	static int setup_sigchld_fd(sigset_t *oldmask)
	113	{
	114	sigset_t mask;
	115	int fd;
	116
	117	if (sigprocmask(SIG_BLOCK, NULL, &mask)) {
36eb9bde	118	SYSERROR("failed to get mask signal");
b0a33c1e	119	return -1;
	120	}
	121
	122	if (sigaddset(&mask, SIGCHLD) \|\| sigprocmask(SIG_BLOCK, &mask, oldmask)) {
36eb9bde	123	SYSERROR("failed to set mask signal");
b0a33c1e	124	return -1;
	125	}
	126
	127	fd = signalfd(-1, &mask, 0);
	128	if (fd < 0) {
36eb9bde	129	SYSERROR("failed to create the signal fd");
b0a33c1e	130	return -1;
	131	}
	132
	133	if (fcntl(fd, F_SETFD, FD_CLOEXEC)) {
36eb9bde	134	SYSERROR("failed to set sigfd to close-on-exec");
b0a33c1e	135	close(fd);
	136	return -1;
	137	}
	138
	139	return fd;
	140	}
	141
	142	static int setup_tty_service(const char name, int ttyfd)
	143	{
	144	int fd;
	145	struct sockaddr_un addr = { 0 };
	146	char *offset = &addr.sun_path[1];
	147
	148	strcpy(offset, name);
	149	addr.sun_path[0] = '\0';
	150
	151	fd = lxc_af_unix_open(addr.sun_path, SOCK_STREAM, 0);
	152	if (fd < 0)
	153	return -1;
	154
	155	if (fcntl(fd, F_SETFD, FD_CLOEXEC)) {
36eb9bde	156	SYSERROR("failed to close-on-exec flag");
b0a33c1e	157	close(fd);
	158	return -1;
	159	}
	160
	161	*ttyfd = fd;
	162
	163	return 0;
	164	}
	165
	166	static int sigchld_handler(int fd, void *data,
	167	struct lxc_epoll_descr *descr)
	168	{
b0a33c1e	169	return 1;
	170	}
	171
	172	static int ttyclient_handler(int fd, void *data,
	173	struct lxc_epoll_descr *descr)
	174	{
	175	int i;
	176	struct lxc_tty_info *tty_info = data;
	177
	178	for (i = 0; i < tty_info->nbtty; i++) {
	179
	180	if (tty_info->pty_info[i].busy != fd)
	181	continue;
	182
	183	lxc_mainloop_del_handler(descr, fd);
	184	tty_info->pty_info[i].busy = 0;
	185	close(fd);
	186	}
	187
	188	return 0;
	189	}
	190
	191	static int ttyservice_handler(int fd, void *data,
	192	struct lxc_epoll_descr *descr)
	193	{
	194	int conn, ttynum, val = 1, ret = -1;
	195	struct lxc_tty_info *tty_info = data;
	196
	197	conn = accept(fd, NULL, 0);
	198	if (conn < 0) {
36eb9bde	199	SYSERROR("failed to accept tty client");
b0a33c1e	200	return -1;
	201	}
	202
	203	if (setsockopt(conn, SOL_SOCKET, SO_PASSCRED, &val, sizeof(val))) {
36eb9bde	204	SYSERROR("failed to enable credential on socket");
b0a33c1e	205	goto out_close;
	206	}
	207
	208	if (lxc_af_unix_rcv_credential(conn, &ttynum, sizeof(ttynum)))
	209	goto out_close;
	210
be43f17e DL	211	if (ttynum > 0) {
	212	if (ttynum > tty_info->nbtty)
	213	goto out_close;
	214
	215	if (tty_info->pty_info[ttynum - 1].busy)
	216	goto out_close;
b0a33c1e	217
be43f17e DL	218	goto out_send;
be43f17e DL	219	}
b0a33c1e	220
be43f17e DL	221	/* fixup index tty1 => [0] */
	222	for (ttynum = 1;
	223	ttynum <= tty_info->nbtty && tty_info->pty_info[ttynum - 1].busy;
	224	ttynum++);
	225
	226	/* we didn't find any available slot for tty */
	227	if (ttynum > tty_info->nbtty)
b0a33c1e	228	goto out_close;
b0a33c1e	229
be43f17e DL	230	out_send:
	231	if (lxc_af_unix_send_fd(conn, tty_info->pty_info[ttynum - 1].master,
	232	&ttynum, sizeof(ttynum)) < 0) {
36eb9bde	233	ERROR("failed to send tty to client");
b0a33c1e	234	goto out_close;
	235	}
	236
be43f17e	237	if (lxc_mainloop_add_handler(descr, conn,
b0a33c1e	238	ttyclient_handler, tty_info)) {
36eb9bde	239	ERROR("failed to add tty client handler");
b0a33c1e	240	goto out_close;
	241	}
	242
be43f17e	243	tty_info->pty_info[ttynum - 1].busy = conn;
b0a33c1e	244
b0a33c1e	245	ret = 0;
b0a33c1e	246	out:
	247	return ret;
	248	out_close:
	249	close(conn);
	250	goto out;
	251	}
	252
1bc5cc8c	253	int lxc_poll(const char name, struct lxc_handler handler)
b0a33c1e	254	{
ca5f7926 DL	255	int sigfd = handler->sigfd;
	256	int pid = handler->pid;
	257	const struct lxc_tty_info *tty_info = &handler->tty_info;
	258
b0a33c1e	259	int nfds, ttyfd = -1, ret = -1;
	260	struct lxc_epoll_descr descr;
	261
	262	if (tty_info->nbtty && setup_tty_service(name, &ttyfd)) {
36eb9bde	263	ERROR("failed to create the tty service point");
b0a33c1e	264	goto out_sigfd;
	265	}
	266
	267	/* sigfd + nb tty + tty service
	268	* if tty is enabled */
	269	nfds = tty_info->nbtty + 1 + tty_info->nbtty ? 1 : 0;
	270
	271	if (lxc_mainloop_open(nfds, &descr)) {
36eb9bde	272	ERROR("failed to create mainloop");
b0a33c1e	273	goto out_ttyfd;
	274	}
	275
	276	if (lxc_mainloop_add_handler(&descr, sigfd, sigchld_handler, &pid)) {
36eb9bde	277	ERROR("failed to add handler for the signal");
b0a33c1e	278	goto out_mainloop_open;
	279	}
	280
	281	if (tty_info->nbtty) {
	282	if (lxc_mainloop_add_handler(&descr, ttyfd,
	283	ttyservice_handler,
	284	(void *)tty_info)) {
36eb9bde	285	ERROR("failed to add handler for the tty");
b0a33c1e	286	goto out_mainloop_open;
	287	}
	288	}
	289
	290	ret = lxc_mainloop(&descr);
	291
	292	out:
	293	return ret;
	294
	295	out_mainloop_open:
	296	lxc_mainloop_close(&descr);
	297	out_ttyfd:
	298	close(ttyfd);
	299	out_sigfd:
	300	close(sigfd);
	301	goto out;
	302	}
	303
59eb99ba	304	static int save_init_pid(const char *name, pid_t pid)
0ad19a3f	305	{
22ebac19	306	char init[MAXPATHLEN];
59eb99ba DL	307	char *val;
	308	int fd, err = -1;
	309
	310	snprintf(init, MAXPATHLEN, LXCPATH "/%s/init", name);
	311
	312	if (!asprintf(&val, "%d\n", pid)) {
	313	SYSERROR("failed to allocate memory");
	314	goto out;
	315	}
	316
	317	fd = open(init, O_WRONLY\|O_CREAT\|O_TRUNC, S_IRUSR\|S_IWUSR);
	318	if (fd < 0) {
	319	SYSERROR("failed to open '%s'", init);
	320	goto out_free;
	321	}
	322
	323	if (write(fd, val, strlen(val)) < 0) {
	324	SYSERROR("failed to write the init pid");
	325	goto out_close;
	326	}
f4d507d5	327
59eb99ba DL	328	err = 0;
	329
	330	out_close:
	331	close(fd);
	332	out_free:
	333	free(val);
	334	out:
	335	return err;
	336	}
	337
	338	static void remove_init_pid(const char *name, pid_t pid)
	339	{
	340	char init[MAXPATHLEN];
	341
	342	snprintf(init, MAXPATHLEN, LXCPATH "/%s/init", name);
	343	unlink(init);
	344	}
	345
b8f57738 DL	346	static int fdname(int fd, char *name, size_t size)
	347	{
	348	char path[MAXPATHLEN];
acc86941	349	ssize_t len;
b8f57738 DL	350
	351	snprintf(path, MAXPATHLEN, "/proc/self/fd/%d", fd);
	352
acc86941 MN	353	len = readlink(path, name, size);
	354	if (len > 0)
	355	path[len] = '\0';
	356
	357	return (len <= 0) ? -1 : 0;
b8f57738 DL	358	}
	359
	360	static int console_init(char *console, size_t size)
	361	{
	362	struct stat stat;
	363	int i;
	364
	365	for (i = 0; i < 3; i++) {
	366	if (!isatty(i))
	367	continue;
	368
	369	if (ttyname_r(i, console, size)) {
	370	SYSERROR("failed to retrieve tty name");
	371	return -1;
	372	}
	373	return 0;
	374	}
	375
	376	if (!fstat(0, &stat)) {
	377	if (S_ISREG(stat.st_mode) \|\| S_ISCHR(stat.st_mode) \|\|
	378	S_ISFIFO(stat.st_mode) \|\| S_ISLNK(stat.st_mode))
	379	return fdname(0, console, size);
	380	}
	381
	382	console[0] = '\0';
	383	return 0;
	384	}
	385
3a0f472d	386	struct lxc_handler lxc_init(const char name)
59eb99ba	387	{
3a0f472d DL	388	struct lxc_handler *handler;
	389
	390	handler = malloc(sizeof(*handler));
	391	if (!handler)
	392	return NULL;
59eb99ba DL	393
	394	memset(handler, 0, sizeof(*handler));
	395
	396	handler->lock = lxc_get_lock(name);
	397	if (handler->lock < 0)
3a0f472d	398	goto out_free;
0ad19a3f	399
0ad19a3f	400	/* Begin the set the state to STARTING*/
0ad19a3f	401	if (lxc_setstate(name, STARTING)) {
59eb99ba DL	402	ERROR("failed to set state '%s'", lxc_state2str(STARTING));
59eb99ba DL	403	goto out_put_lock;
0ad19a3f	404	}
0ad19a3f	405
b8f57738 DL	406	if (console_init(handler->tty, sizeof(handler->tty))) {
	407	ERROR("failed to initialize the console");
	408	goto out_aborting;
	409	}
939229eb	410
59eb99ba	411	if (lxc_create_tty(name, &handler->tty_info)) {
36eb9bde	412	ERROR("failed to create the ttys");
59eb99ba	413	goto out_aborting;
b0a33c1e	414	}
	415
	416	/* the signal fd has to be created before forking otherwise
	417	* if the child process exits before we setup the signal fd,
	418	* the event will be lost and the command will be stuck */
59eb99ba DL	419	handler->sigfd = setup_sigchld_fd(&handler->oldmask);
59eb99ba DL	420	if (handler->sigfd < 0) {
36eb9bde	421	ERROR("failed to set sigchild fd handler");
59eb99ba	422	goto out_delete_tty;
b0a33c1e	423	}
b0a33c1e	424
59eb99ba DL	425	/* Avoid signals from terminal */
	426	LXC_TTY_ADD_HANDLER(SIGINT);
	427	LXC_TTY_ADD_HANDLER(SIGQUIT);
	428
59eb99ba	429	out:
3a0f472d	430	return handler;
59eb99ba DL	431
	432	out_delete_tty:
	433	lxc_delete_tty(&handler->tty_info);
	434	out_aborting:
	435	lxc_setstate(name, ABORTING);
	436	out_put_lock:
	437	lxc_put_lock(handler->lock);
3a0f472d DL	438	out_free:
	439	free(handler);
	440	handler = NULL;
59eb99ba DL	441	goto out;
	442	}
	443
1bc5cc8c	444	void lxc_fini(const char name, struct lxc_handler handler)
59eb99ba DL	445	{
	446	/* The STOPPING state is there for future cleanup code
	447	* which can take awhile
	448	*/
	449	lxc_setstate(name, STOPPING);
59eb99ba	450	lxc_setstate(name, STOPPED);
59eb99ba DL	451	lxc_unlink_nsgroup(name);
59eb99ba DL	452
3a0f472d DL	453	if (handler) {
	454	remove_init_pid(name, handler->pid);
	455	lxc_delete_tty(&handler->tty_info);
	456	lxc_put_lock(handler->lock);
	457	free(handler);
	458	}
59eb99ba DL	459
	460	LXC_TTY_DEL_HANDLER(SIGQUIT);
	461	LXC_TTY_DEL_HANDLER(SIGINT);
	462	}
	463
1bc5cc8c	464	void lxc_abort(const char name, struct lxc_handler handler)
59eb99ba DL	465	{
	466	lxc_setstate(name, ABORTING);
	467	kill(handler->pid, SIGKILL);
	468	}
	469
50e98013 DL	470	struct start_arg {
	471	const char *name;
	472	char const argv;
	473	struct lxc_handler *handler;
	474	int *sv;
	475	};
	476
	477	static int do_start(void *arg)
	478	{
	479	struct start_arg *start_arg = arg;
	480	struct lxc_handler *handler = start_arg->handler;
	481	const char *name = start_arg->name;
	482	char const argv = start_arg->argv;
	483	int *sv = start_arg->sv;
	484	int err = -1, sync;
	485
	486	if (sigprocmask(SIG_SETMASK, &handler->oldmask, NULL)) {
	487	SYSERROR("failed to set sigprocmask");
	488	goto out_child;
	489	}
	490
	491	close(sv[1]);
	492
	493	/* Be sure we don't inherit this after the exec */
	494	fcntl(sv[0], F_SETFD, FD_CLOEXEC);
	495
	496	/* Tell our father he can begin to configure the container */
	497	if (write(sv[0], &sync, sizeof(sync)) < 0) {
	498	SYSERROR("failed to write socket");
	499	goto out_child;
	500	}
	501
	502	/* Wait for the father to finish the configuration */
	503	if (read(sv[0], &sync, sizeof(sync)) < 0) {
	504	SYSERROR("failed to read socket");
	505	goto out_child;
	506	}
	507
	508	/* Setup the container, ip, names, utsname, ... */
	509	if (lxc_setup(name, handler->tty, &handler->tty_info)) {
	510	ERROR("failed to setup the container");
	511	goto out_warn_father;
	512	}
	513
	514	if (prctl(PR_CAPBSET_DROP, CAP_SYS_BOOT, 0, 0, 0)) {
	515	SYSERROR("failed to remove CAP_SYS_BOOT capability");
	516	goto out_child;
	517	}
	518
	519	execvp(argv[0], argv);
	520	SYSERROR("failed to exec %s", argv[0]);
	521
	522	out_warn_father:
	523	/* If the exec fails, tell that to our father */
	524	if (write(sv[0], &err, sizeof(err)) < 0)
	525	SYSERROR("failed to write the socket");
	526	out_child:
	527	return -1;
	528	}
	529
9618063c	530	int lxc_spawn(const char name, struct lxc_handler handler, char *const argv[])
59eb99ba DL	531	{
	532	int sv[2];
	533	int clone_flags;
	534	int err = -1, sync;
	535
50e98013 DL	536	struct start_arg start_arg = {
	537	.name = name,
	538	.argv = argv,
	539	.handler = handler,
	540	.sv = sv,
	541	};
	542
0ad19a3f	543	/* Synchro socketpair */
0ad19a3f	544	if (socketpair(AF_LOCAL, SOCK_STREAM, 0, sv)) {
36eb9bde	545	SYSERROR("failed to create communication socketpair");
f4d507d5	546	goto out;
0ad19a3f	547	}
0ad19a3f	548
1ea6db29	549	clone_flags = CLONE_NEWUTS\|CLONE_NEWPID\|CLONE_NEWIPC\|CLONE_NEWNS;
0ad19a3f	550	if (conf_has_network(name))
	551	clone_flags \|= CLONE_NEWNET;
	552
	553	/* Create a process in a new set of namespaces */
50e98013	554	handler->pid = lxc_clone(do_start, &start_arg, clone_flags);
59eb99ba	555	if (handler->pid < 0) {
36eb9bde	556	SYSERROR("failed to fork into a new namespace");
59eb99ba	557	goto out_close;
0ad19a3f	558	}
0ad19a3f	559
0ad19a3f	560	close(sv[0]);
	561
	562	/* Wait for the child to be ready */
	563	if (read(sv[1], &sync, sizeof(sync)) < 0) {
36eb9bde	564	SYSERROR("failed to read the socket");
59eb99ba	565	goto out_abort;
0ad19a3f	566	}
0ad19a3f	567
6203de18	568	if (lxc_rename_nsgroup(name, handler->pid) \|\| lxc_link_nsgroup(name))
2b31f553	569	goto out_abort;
218d4250	570
0ad19a3f	571	/* Create the network configuration */
6203de18 DL	572	if (clone_flags & CLONE_NEWNET &&
6203de18 DL	573	conf_create_network(name, handler->pid)) {
36eb9bde	574	ERROR("failed to create the configured network");
59eb99ba	575	goto out_abort;
0ad19a3f	576	}
	577
	578	/* Tell the child to continue its initialization */
	579	if (write(sv[1], &sync, sizeof(sync)) < 0) {
36eb9bde	580	SYSERROR("failed to write the socket");
59eb99ba	581	goto out_abort;
0ad19a3f	582	}
	583
	584	/* Wait for the child to exec or returning an error */
e043236e	585	if (read(sv[1], &sync, sizeof(sync)) < 0) {
36eb9bde	586	ERROR("failed to read the socket");
59eb99ba	587	goto out_abort;
0ad19a3f	588	}
0ad19a3f	589
59eb99ba DL	590	if (save_init_pid(name, handler->pid)) {
	591	ERROR("failed to save the init pid info");
	592	goto out_abort;
0ad19a3f	593	}
0ad19a3f	594
59eb99ba DL	595	if (lxc_setstate(name, RUNNING)) {
	596	ERROR("failed to set state to %s",
	597	lxc_state2str(RUNNING));
	598	goto out_abort;
3f21c114	599	}
22ebac19	600
59eb99ba	601	err = 0;
22ebac19	602
59eb99ba DL	603	out_close:
	604	close(sv[0]);
	605	close(sv[1]);
	606	out:
	607	return err;
0ad19a3f	608
59eb99ba DL	609	out_abort:
	610	lxc_abort(name, handler);
	611	goto out_close;
	612	}
0ad19a3f	613
9618063c	614	int lxc_start(const char name, char const argv[])
59eb99ba	615	{
3a0f472d	616	struct lxc_handler *handler;
e043236e	617	int err = -1;
59eb99ba DL	618	int status;
59eb99ba DL	619
3a0f472d DL	620	handler = lxc_init(name);
3a0f472d DL	621	if (!handler) {
59eb99ba DL	622	ERROR("failed to initialize the container");
59eb99ba DL	623	goto out;
0ad19a3f	624	}
0ad19a3f	625
3a0f472d	626	err = lxc_spawn(name, handler, argv);
59eb99ba DL	627	if (err) {
	628	ERROR("failed to spawn '%s'", argv[0]);
	629	goto out;
0ad19a3f	630	}
0ad19a3f	631
d983b93c MN	632	err = lxc_fd_close_inherited();
	633	if (err) {
	634	ERROR("unable to close inherited fds");
	635	goto out_abort;
	636	}
	637
3a0f472d	638	err = lxc_poll(name, handler);
e043236e	639	if (err) {
59eb99ba DL	640	ERROR("mainloop exited with an error");
	641	goto out_abort;
	642	}
0ad19a3f	643
3a0f472d	644	while (waitpid(handler->pid, &status, 0) < 0 && errno == EINTR)
1bc5cc8c	645	continue;
e043236e	646
3a0f472d	647	err = lxc_error_set_and_log(handler->pid, status);
0ad19a3f	648	out:
3a0f472d	649	lxc_fini(name, handler);
0ad19a3f	650	return err;
0ad19a3f	651
59eb99ba	652	out_abort:
3a0f472d	653	lxc_abort(name, handler);
0ad19a3f	654	goto out;
0ad19a3f	655	}