[mirror_lxc.git] / src / lxc / start.c

/*
 * lxc: linux Container library
 *
 * (C) Copyright IBM Corp. 2007, 2008
 *
 * Authors:
 * Daniel Lezcano <dlezcano at fr.ibm.com>
 *
 * This library is free software; you can redistribute it and/or
 * modify it under the terms of the GNU Lesser General Public
 * License as published by the Free Software Foundation; either
 * version 2.1 of the License, or (at your option) any later version.
 *
 * This library is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
 * Lesser General Public License for more details.
 *
 * You should have received a copy of the GNU Lesser General Public
 * License along with this library; if not, write to the Free Software
 * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
 */

#include "../config.h"
#include <stdio.h>
#undef _GNU_SOURCE
#include <string.h>
#include <stdlib.h>
#include <dirent.h>
#include <errno.h>
#include <unistd.h>
#include <signal.h>
#include <fcntl.h>
#include <termios.h>
#include <sys/param.h>
#include <sys/file.h>
#include <sys/mount.h>
#include <sys/types.h>
#include <sys/prctl.h>
#include <sys/capability.h>
#include <sys/wait.h>
#include <sys/un.h>
#include <sys/poll.h>

#ifdef HAVE_SYS_SIGNALFD_H 
#include <sys/signalfd.h>
#else
extern int signalfd (int fd, const sigset_t *mask, int flags);
#endif

#include "error.h"
#include "af_unix.h"
#include "mainloop.h"

#include <lxc/lxc.h>

LXC_TTY_HANDLER(SIGINT);
LXC_TTY_HANDLER(SIGQUIT);

static int setup_sigchld_fd(sigset_t *oldmask)
{
	sigset_t mask;
	int fd;

	if (sigprocmask(SIG_BLOCK, NULL, &mask)) {
		lxc_log_syserror("failed to get mask signal");
		return -1;
	}

	if (sigaddset(&mask, SIGCHLD) || sigprocmask(SIG_BLOCK, &mask, oldmask)) {
		lxc_log_syserror("failed to set mask signal");
		return -1;
	}

	fd = signalfd(-1, &mask, 0);
	if (fd < 0) {
		lxc_log_syserror("failed to create the signal fd");
		return -1;
	}

	if (fcntl(fd, F_SETFD, FD_CLOEXEC)) {
		lxc_log_syserror("failed to set sigfd to close-on-exec");
		close(fd);
		return -1;
	}

	return fd;
}

static int setup_tty_service(const char *name, int *ttyfd)
{
	int fd;
	struct sockaddr_un addr = { 0 };
	char *offset = &addr.sun_path[1];
	
	strcpy(offset, name);
	addr.sun_path[0] = '\0';

	fd = lxc_af_unix_open(addr.sun_path, SOCK_STREAM, 0);
	if (fd < 0)
		return -1;

	if (fcntl(fd, F_SETFD, FD_CLOEXEC)) {
		lxc_log_syserror("failed to close-on-exec flag");
		close(fd);
		return -1;
	}

	*ttyfd = fd;

	return 0;
}

static int sigchld_handler(int fd, void *data, 
			   struct lxc_epoll_descr *descr)
{
	pid_t *pid = data;

	waitpid(*pid, NULL, 0);

	return 1;
}

static int ttyclient_handler(int fd, void *data,
			     struct lxc_epoll_descr *descr)
{
	int i;
 	struct lxc_tty_info *tty_info = data;

	for (i = 0; i < tty_info->nbtty; i++) {

		if (tty_info->pty_info[i].busy != fd)
			continue;

		lxc_mainloop_del_handler(descr, fd);
		tty_info->pty_info[i].busy = 0;
		close(fd);
	}

	return 0;
}

static int ttyservice_handler(int fd, void *data,
			      struct lxc_epoll_descr *descr)
{
	int conn, ttynum, val = 1, ret = -1;
	struct lxc_tty_info *tty_info = data;
	
	conn = accept(fd, NULL, 0);
	if (conn < 0) {
		lxc_log_syserror("failed to accept tty client");
		return -1;
	}
	
	if (setsockopt(conn, SOL_SOCKET, SO_PASSCRED, &val, sizeof(val))) {
		lxc_log_syserror("failed to enable credential on socket");
		goto out_close;
	}

	if (lxc_af_unix_rcv_credential(conn, &ttynum, sizeof(ttynum)))
		goto out_close;

	if (ttynum <= 0 || ttynum > tty_info->nbtty)
		goto out_close;

	/* fixup index array (eg. tty1 is index 0) */
	ttynum--;

	if (tty_info->pty_info[ttynum].busy)
		goto out_close;

	if (lxc_af_unix_send_fd(conn, tty_info->pty_info[ttynum].master, 
				NULL, 0) < 0) {
		lxc_log_error("failed to send tty to client");
		goto out_close;
	}

	if (lxc_mainloop_add_handler(descr, conn, 
				     ttyclient_handler, tty_info)) {
		lxc_log_error("failed to add tty client handler");
		goto out_close;
	}

	tty_info->pty_info[ttynum].busy = conn;

	ret = 0;

out:
	return ret;
out_close:
	close(conn);
	goto out;
}

static int mainloop(const char *name, pid_t pid, int sigfd,
		    const struct lxc_tty_info *tty_info)
{
	int nfds, ttyfd = -1, ret = -1;
	struct lxc_epoll_descr descr;

	if (tty_info->nbtty && setup_tty_service(name, &ttyfd)) {
		lxc_log_error("failed to create the tty service point");
		goto out_sigfd;
	}

	/* sigfd + nb tty + tty service 
	 * if tty is enabled */
	nfds = tty_info->nbtty + 1 + tty_info->nbtty ? 1 : 0;

	if (lxc_mainloop_open(nfds, &descr)) {
		lxc_log_error("failed to create mainloop");
		goto out_ttyfd;
	}

	if (lxc_mainloop_add_handler(&descr, sigfd, sigchld_handler, &pid)) {
		lxc_log_error("failed to add handler for the signal");
		goto out_mainloop_open;
	}

	if (tty_info->nbtty) {
		if (lxc_mainloop_add_handler(&descr, ttyfd, 
					     ttyservice_handler, 
					     (void *)tty_info)) {
			lxc_log_error("failed to add handler for the tty");
			goto out_mainloop_open;
		}
	}

	ret = lxc_mainloop(&descr);

out:
	return ret;

out_mainloop_open:
	lxc_mainloop_close(&descr);
out_ttyfd:
	close(ttyfd);
out_sigfd:
	close(sigfd);
	goto out;
}

int lxc_start(const char *name, char *argv[])
{
	struct lxc_tty_info tty_info = { 0 };
	sigset_t oldmask;
	char init[MAXPATHLEN];
	char tty[MAXPATHLEN];
	char *val = NULL;
	int fd, sigfd, lock, sv[2], sync = 0, err = -LXC_ERROR_INTERNAL;
	pid_t pid;
	int clone_flags;

	lock = lxc_get_lock(name);
	if (lock < 0)
		return lock;

	/* Begin the set the state to STARTING*/
	if (lxc_setstate(name, STARTING)) {
		lxc_log_error("failed to set state '%s'", 
			      lxc_state2str(STARTING));
		goto out;
	}

	/* If we are not attached to a tty, disable it */
	if (ttyname_r(0, tty, sizeof(tty))) 
		tty[0] = '\0';

	if (lxc_create_tty(name, &tty_info)) {
		lxc_log_error("failed to create the ttys");
		goto out;
	}

	/* the signal fd has to be created before forking otherwise
	 * if the child process exits before we setup the signal fd,
	 * the event will be lost and the command will be stuck */
	sigfd = setup_sigchld_fd(&oldmask);
	if (sigfd < 0) {
		lxc_log_error("failed to set sigchild fd handler");
		return -1;
	}

	/* Synchro socketpair */
	if (socketpair(AF_LOCAL, SOCK_STREAM, 0, sv)) {
		lxc_log_syserror("failed to create communication socketpair");
		goto out;
	}

	/* Avoid signals from terminal */
	LXC_TTY_ADD_HANDLER(SIGINT);
	LXC_TTY_ADD_HANDLER(SIGQUIT);

	clone_flags = CLONE_NEWPID|CLONE_NEWIPC|CLONE_NEWNS;
	if (conf_has_utsname(name))
		clone_flags |= CLONE_NEWUTS;
	if (conf_has_network(name))
		clone_flags |= CLONE_NEWNET;

	/* Create a process in a new set of namespaces */
	pid = fork_ns(clone_flags);
	if (pid < 0) {
		lxc_log_syserror("failed to fork into a new namespace");
		goto err_fork_ns;
	}

	if (!pid) {

		if (sigprocmask(SIG_SETMASK, &oldmask, NULL)) {
			lxc_log_syserror("failed to set sigprocmask");
			return -1;
		}

		close(sv[1]);

		/* Be sure we don't inherit this after the exec */
		fcntl(sv[0], F_SETFD, FD_CLOEXEC);
		
		/* Tell our father he can begin to configure the container */
		if (write(sv[0], &sync, sizeof(sync)) < 0) {
			lxc_log_syserror("failed to write socket");
			goto out_child;
		}

		/* Wait for the father to finish the configuration */
		if (read(sv[0], &sync, sizeof(sync)) < 0) {
			lxc_log_syserror("failed to read socket");
			goto out_child;
		}

		/* Setup the container, ip, names, utsname, ... */
		err = lxc_setup(name, tty, &tty_info);
		if (err) {
			lxc_log_error("failed to setup the container");
			if (write(sv[0], &err, sizeof(err)) < 0)
				lxc_log_syserror("failed to write the socket");
			goto out_child;
		}

		if (prctl(PR_CAPBSET_DROP, CAP_SYS_BOOT, 0, 0, 0)) {
			lxc_log_syserror("failed to remove CAP_SYS_BOOT capability");
			goto out_child;
		}

		execvp(argv[0], argv);
		lxc_log_syserror("failed to exec %s", argv[0]);

		err = LXC_ERROR_WRONG_COMMAND;
		/* If the exec fails, tell that to our father */
		if (write(sv[0], &err, sizeof(err)) < 0)
			lxc_log_syserror("failed to write the socket");
		
	out_child:
		exit(err);
	}

	close(sv[0]);
	
	/* Wait for the child to be ready */
	if (read(sv[1], &sync, sizeof(sync)) < 0) {
		lxc_log_syserror("failed to read the socket");
		goto err_pipe_read;
	}

	if (lxc_link_nsgroup(name, pid))
		lxc_log_warning("cgroupfs not found: cgroup disabled");

	/* Create the network configuration */
	if (clone_flags & CLONE_NEWNET && conf_create_network(name, pid)) {
		lxc_log_error("failed to create the configured network");
		goto err_create_network;
	}

	/* Tell the child to continue its initialization */
	if (write(sv[1], &sync, sizeof(sync)) < 0) {
		lxc_log_syserror("failed to write the socket");
		goto err_pipe_write;
	}

	/* Wait for the child to exec or returning an error */
	err = read(sv[1], &sync, sizeof(sync));
	if (err < 0) {
		lxc_log_error("failed to read the socket");
		goto err_pipe_read2;
	}

	if (err > 0) {
		err = sync;
		waitpid(pid, NULL, 0);
		goto err_child_failed;
	}

	asprintf(&val, "%d\n", pid);

	snprintf(init, MAXPATHLEN, LXCPATH "/%s/init", name);

	fd = open(init, O_WRONLY|O_CREAT|O_TRUNC, S_IRUSR|S_IWUSR);
	if (fd < 0) {
		lxc_log_syserror("failed to open '%s'", init);
		goto err_write;
	}
	
	if (write(fd, val, strlen(val)) < 0) {
		lxc_log_syserror("failed to write the init pid");
		goto err_write;
	}

	close(fd);

	if (lxc_setstate(name, RUNNING)) {
		lxc_log_error("failed to set state to %s", 
			      lxc_state2str(RUNNING));
		goto err_state_failed;
	}

	if (mainloop(name, pid, sigfd, &tty_info)) {
		lxc_log_error("mainloop exited with an error");
		goto err_mailoop_failed;
	}

	if (lxc_setstate(name, STOPPING))
		lxc_log_error("failed to set state %s", lxc_state2str(STOPPING));

	if (clone_flags & CLONE_NEWNET && conf_destroy_network(name))
		lxc_log_error("failed to destroy the network");

	err = 0;
out:
	if (lxc_setstate(name, STOPPED))
		lxc_log_error("failed to set state %s", lxc_state2str(STOPPED));

	lxc_delete_tty(&tty_info);
	lxc_unlink_nsgroup(name);
	unlink(init);
	free(val);
	lxc_put_lock(lock);
	LXC_TTY_DEL_HANDLER(SIGQUIT);
	LXC_TTY_DEL_HANDLER(SIGINT);

	return err;

err_write:
	close(fd);

err_state_failed:
err_child_failed:
err_pipe_read2:
err_pipe_write:
	if (clone_flags & CLONE_NEWNET)
		conf_destroy_network(name);
err_create_network:
err_pipe_read:
err_mailoop_failed:
	if (lxc_setstate(name, ABORTING))
		lxc_log_error("failed to set state %s", lxc_state2str(STOPPED));

	kill(pid, SIGKILL);
err_fork_ns:
	close(sv[0]);
	close(sv[1]);
	goto out;
}
Commit	Line	Data
0ad19a3f	1	/*
	2	* lxc: linux Container library
	3	*
	4	* (C) Copyright IBM Corp. 2007, 2008
	5	*
	6	* Authors:
	7	* Daniel Lezcano <dlezcano at fr.ibm.com>
	8	*
	9	* This library is free software; you can redistribute it and/or
	10	* modify it under the terms of the GNU Lesser General Public
	11	* License as published by the Free Software Foundation; either
	12	* version 2.1 of the License, or (at your option) any later version.
	13	*
	14	* This library is distributed in the hope that it will be useful,
	15	* but WITHOUT ANY WARRANTY; without even the implied warranty of
	16	* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
	17	* Lesser General Public License for more details.
	18	*
	19	* You should have received a copy of the GNU Lesser General Public
	20	* License along with this library; if not, write to the Free Software
	21	* Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
	22	*/
	23
ff218c25	24	#include "../config.h"
0ad19a3f	25	#include <stdio.h>
	26	#undef _GNU_SOURCE
	27	#include <string.h>
	28	#include <stdlib.h>
	29	#include <dirent.h>
	30	#include <errno.h>
	31	#include <unistd.h>
	32	#include <signal.h>
b0a33c1e	33	#include <fcntl.h>
b0a33c1e	34	#include <termios.h>
0ad19a3f	35	#include <sys/param.h>
0ad19a3f	36	#include <sys/file.h>
f4d507d5	37	#include <sys/mount.h>
0ad19a3f	38	#include <sys/types.h>
0ad19a3f	39	#include <sys/prctl.h>
42ff343d	40	#include <sys/capability.h>
0ad19a3f	41	#include <sys/wait.h>
b0a33c1e	42	#include <sys/un.h>
b0a33c1e	43	#include <sys/poll.h>
ff218c25	44
ff218c25	45	#ifdef HAVE_SYS_SIGNALFD_H
b0a33c1e	46	#include <sys/signalfd.h>
ff218c25	47	#else
	48	extern int signalfd (int fd, const sigset_t *mask, int flags);
	49	#endif
0ad19a3f	50
e2bcd7db	51	#include "error.h"
b0a33c1e	52	#include "af_unix.h"
b0a33c1e	53	#include "mainloop.h"
e2bcd7db	54
b113348e	55	#include <lxc/lxc.h>
0ad19a3f	56
	57	LXC_TTY_HANDLER(SIGINT);
	58	LXC_TTY_HANDLER(SIGQUIT);
	59
b0a33c1e	60	static int setup_sigchld_fd(sigset_t *oldmask)
	61	{
	62	sigset_t mask;
	63	int fd;
	64
	65	if (sigprocmask(SIG_BLOCK, NULL, &mask)) {
	66	lxc_log_syserror("failed to get mask signal");
	67	return -1;
	68	}
	69
	70	if (sigaddset(&mask, SIGCHLD) \|\| sigprocmask(SIG_BLOCK, &mask, oldmask)) {
	71	lxc_log_syserror("failed to set mask signal");
	72	return -1;
	73	}
	74
	75	fd = signalfd(-1, &mask, 0);
	76	if (fd < 0) {
	77	lxc_log_syserror("failed to create the signal fd");
	78	return -1;
	79	}
	80
	81	if (fcntl(fd, F_SETFD, FD_CLOEXEC)) {
	82	lxc_log_syserror("failed to set sigfd to close-on-exec");
	83	close(fd);
	84	return -1;
	85	}
	86
	87	return fd;
	88	}
	89
	90	static int setup_tty_service(const char name, int ttyfd)
	91	{
	92	int fd;
	93	struct sockaddr_un addr = { 0 };
	94	char *offset = &addr.sun_path[1];
	95
	96	strcpy(offset, name);
	97	addr.sun_path[0] = '\0';
	98
	99	fd = lxc_af_unix_open(addr.sun_path, SOCK_STREAM, 0);
	100	if (fd < 0)
	101	return -1;
	102
	103	if (fcntl(fd, F_SETFD, FD_CLOEXEC)) {
	104	lxc_log_syserror("failed to close-on-exec flag");
	105	close(fd);
	106	return -1;
	107	}
	108
	109	*ttyfd = fd;
	110
	111	return 0;
	112	}
	113
	114	static int sigchld_handler(int fd, void *data,
	115	struct lxc_epoll_descr *descr)
	116	{
	117	pid_t *pid = data;
	118
	119	waitpid(*pid, NULL, 0);
	120
	121	return 1;
	122	}
	123
124	static int ttyclient_handler(int fd, void *data,
125	struct lxc_epoll_descr *descr)
126	{
127	int i;
128	struct lxc_tty_info *tty_info = data;
129
130	for (i = 0; i < tty_info->nbtty; i++) {
131
132	if (tty_info->pty_info[i].busy != fd)
133	continue;
134
135	lxc_mainloop_del_handler(descr, fd);
136	tty_info->pty_info[i].busy = 0;
137	close(fd);
138	}
139
140	return 0;
141	}
142
143	static int ttyservice_handler(int fd, void *data,
144	struct lxc_epoll_descr *descr)
145	{
146	int conn, ttynum, val = 1, ret = -1;
147	struct lxc_tty_info *tty_info = data;
148
149	conn = accept(fd, NULL, 0);
150	if (conn < 0) {
151	lxc_log_syserror("failed to accept tty client");
152	return -1;
153	}
154
155	if (setsockopt(conn, SOL_SOCKET, SO_PASSCRED, &val, sizeof(val))) {
156	lxc_log_syserror("failed to enable credential on socket");
157	goto out_close;
158	}
159
160	if (lxc_af_unix_rcv_credential(conn, &ttynum, sizeof(ttynum)))
161	goto out_close;
162
163	if (ttynum <= 0 \|\| ttynum > tty_info->nbtty)
164	goto out_close;
165
166	/* fixup index array (eg. tty1 is index 0) */
167	ttynum--;
168
169	if (tty_info->pty_info[ttynum].busy)
170	goto out_close;
171
172	if (lxc_af_unix_send_fd(conn, tty_info->pty_info[ttynum].master,
173	NULL, 0) < 0) {
174	lxc_log_error("failed to send tty to client");
175	goto out_close;
176	}
177
178	if (lxc_mainloop_add_handler(descr, conn,
179	ttyclient_handler, tty_info)) {
180	lxc_log_error("failed to add tty client handler");
181	goto out_close;
182	}
183
184	tty_info->pty_info[ttynum].busy = conn;
185
186	ret = 0;
187
188	out:
189	return ret;
190	out_close:
191	close(conn);
192	goto out;
193	}
194
195	static int mainloop(const char *name, pid_t pid, int sigfd,
196	const struct lxc_tty_info *tty_info)
197	{
198	int nfds, ttyfd = -1, ret = -1;
199	struct lxc_epoll_descr descr;
200
201	if (tty_info->nbtty && setup_tty_service(name, &ttyfd)) {
202	lxc_log_error("failed to create the tty service point");
203	goto out_sigfd;
204	}
205
206	/* sigfd + nb tty + tty service
207	* if tty is enabled */
208	nfds = tty_info->nbtty + 1 + tty_info->nbtty ? 1 : 0;
209
210	if (lxc_mainloop_open(nfds, &descr)) {
211	lxc_log_error("failed to create mainloop");
212	goto out_ttyfd;
213	}
214
215	if (lxc_mainloop_add_handler(&descr, sigfd, sigchld_handler, &pid)) {
216	lxc_log_error("failed to add handler for the signal");
217	goto out_mainloop_open;
218	}
219
220	if (tty_info->nbtty) {
221	if (lxc_mainloop_add_handler(&descr, ttyfd,
222	ttyservice_handler,
223	(void *)tty_info)) {
224	lxc_log_error("failed to add handler for the tty");
225	goto out_mainloop_open;
226	}
227	}
228
229	ret = lxc_mainloop(&descr);
230
231	out:
232	return ret;
233
234	out_mainloop_open:
235	lxc_mainloop_close(&descr);
236	out_ttyfd:
237	close(ttyfd);
238	out_sigfd:
239	close(sigfd);
240	goto out;
241	}
242
05f05512	243	int lxc_start(const char name, char argv[])
0ad19a3f	244	{
b0a33c1e	245	struct lxc_tty_info tty_info = { 0 };
b0a33c1e	246	sigset_t oldmask;
22ebac19	247	char init[MAXPATHLEN];
939229eb	248	char tty[MAXPATHLEN];
22ebac19	249	char *val = NULL;
b0a33c1e	250	int fd, sigfd, lock, sv[2], sync = 0, err = -LXC_ERROR_INTERNAL;
0ad19a3f	251	pid_t pid;
0ad19a3f	252	int clone_flags;
f4d507d5	253
0ad19a3f	254	lock = lxc_get_lock(name);
b0a33c1e	255	if (lock < 0)
b0a33c1e	256	return lock;
0ad19a3f	257
0ad19a3f	258	/* Begin the set the state to STARTING*/
0ad19a3f	259	if (lxc_setstate(name, STARTING)) {
8b8b04f8	260	lxc_log_error("failed to set state '%s'",
8b8b04f8	261	lxc_state2str(STARTING));
0ad19a3f	262	goto out;
	263	}
	264
caf249f4	265	/* If we are not attached to a tty, disable it */
caf249f4	266	if (ttyname_r(0, tty, sizeof(tty)))
939229eb	267	tty[0] = '\0';
939229eb	268
b0a33c1e	269	if (lxc_create_tty(name, &tty_info)) {
	270	lxc_log_error("failed to create the ttys");
	271	goto out;
	272	}
	273
	274	/* the signal fd has to be created before forking otherwise
	275	* if the child process exits before we setup the signal fd,
	276	* the event will be lost and the command will be stuck */
	277	sigfd = setup_sigchld_fd(&oldmask);
	278	if (sigfd < 0) {
	279	lxc_log_error("failed to set sigchild fd handler");
	280	return -1;
	281	}
	282
0ad19a3f	283	/* Synchro socketpair */
	284	if (socketpair(AF_LOCAL, SOCK_STREAM, 0, sv)) {
	285	lxc_log_syserror("failed to create communication socketpair");
f4d507d5	286	goto out;
0ad19a3f	287	}
	288
	289	/* Avoid signals from terminal */
	290	LXC_TTY_ADD_HANDLER(SIGINT);
	291	LXC_TTY_ADD_HANDLER(SIGQUIT);
	292
f4d507d5	293	clone_flags = CLONE_NEWPID\|CLONE_NEWIPC\|CLONE_NEWNS;
0ad19a3f	294	if (conf_has_utsname(name))
	295	clone_flags \|= CLONE_NEWUTS;
	296	if (conf_has_network(name))
	297	clone_flags \|= CLONE_NEWNET;
	298
	299	/* Create a process in a new set of namespaces */
	300	pid = fork_ns(clone_flags);
	301	if (pid < 0) {
	302	lxc_log_syserror("failed to fork into a new namespace");
	303	goto err_fork_ns;
	304	}
	305
	306	if (!pid) {
	307
b0a33c1e	308	if (sigprocmask(SIG_SETMASK, &oldmask, NULL)) {
	309	lxc_log_syserror("failed to set sigprocmask");
	310	return -1;
	311	}
	312
0ad19a3f	313	close(sv[1]);
	314
	315	/* Be sure we don't inherit this after the exec */
	316	fcntl(sv[0], F_SETFD, FD_CLOEXEC);
	317
	318	/* Tell our father he can begin to configure the container */
	319	if (write(sv[0], &sync, sizeof(sync)) < 0) {
	320	lxc_log_syserror("failed to write socket");
57545890	321	goto out_child;
0ad19a3f	322	}
	323
	324	/* Wait for the father to finish the configuration */
	325	if (read(sv[0], &sync, sizeof(sync)) < 0) {
	326	lxc_log_syserror("failed to read socket");
57545890	327	goto out_child;
0ad19a3f	328	}
	329
	330	/* Setup the container, ip, names, utsname, ... */
b0a33c1e	331	err = lxc_setup(name, tty, &tty_info);
e5bda9ee	332	if (err) {
0ad19a3f	333	lxc_log_error("failed to setup the container");
e5bda9ee	334	if (write(sv[0], &err, sizeof(err)) < 0)
0ad19a3f	335	lxc_log_syserror("failed to write the socket");
57545890	336	goto out_child;
0ad19a3f	337	}
0ad19a3f	338
42ff343d	339	if (prctl(PR_CAPBSET_DROP, CAP_SYS_BOOT, 0, 0, 0)) {
	340	lxc_log_syserror("failed to remove CAP_SYS_BOOT capability");
	341	goto out_child;
	342	}
	343
0ad19a3f	344	execvp(argv[0], argv);
	345	lxc_log_syserror("failed to exec %s", argv[0]);
	346
b3223262	347	err = LXC_ERROR_WRONG_COMMAND;
0ad19a3f	348	/* If the exec fails, tell that to our father */
e5bda9ee	349	if (write(sv[0], &err, sizeof(err)) < 0)
0ad19a3f	350	lxc_log_syserror("failed to write the socket");
0ad19a3f	351
57545890	352	out_child:
e5bda9ee	353	exit(err);
0ad19a3f	354	}
	355
	356	close(sv[0]);
	357
	358	/* Wait for the child to be ready */
	359	if (read(sv[1], &sync, sizeof(sync)) < 0) {
	360	lxc_log_syserror("failed to read the socket");
	361	goto err_pipe_read;
	362	}
	363
218d4250	364	if (lxc_link_nsgroup(name, pid))
	365	lxc_log_warning("cgroupfs not found: cgroup disabled");
	366
0ad19a3f	367	/* Create the network configuration */
	368	if (clone_flags & CLONE_NEWNET && conf_create_network(name, pid)) {
	369	lxc_log_error("failed to create the configured network");
	370	goto err_create_network;
	371	}
	372
	373	/* Tell the child to continue its initialization */
	374	if (write(sv[1], &sync, sizeof(sync)) < 0) {
	375	lxc_log_syserror("failed to write the socket");
	376	goto err_pipe_write;
	377	}
	378
	379	/* Wait for the child to exec or returning an error */
	380	err = read(sv[1], &sync, sizeof(sync));
	381	if (err < 0) {
	382	lxc_log_error("failed to read the socket");
	383	goto err_pipe_read2;
	384	}
	385
	386	if (err > 0) {
e5bda9ee	387	err = sync;
0ad19a3f	388	waitpid(pid, NULL, 0);
	389	goto err_child_failed;
	390	}
	391
	392	asprintf(&val, "%d\n", pid);
22ebac19	393
	394	snprintf(init, MAXPATHLEN, LXCPATH "/%s/init", name);
	395
0ad19a3f	396	fd = open(init, O_WRONLY\|O_CREAT\|O_TRUNC, S_IRUSR\|S_IWUSR);
	397	if (fd < 0) {
	398	lxc_log_syserror("failed to open '%s'", init);
	399	goto err_write;
	400	}
	401
	402	if (write(fd, val, strlen(val)) < 0) {
	403	lxc_log_syserror("failed to write the init pid");
	404	goto err_write;
	405	}
	406
	407	close(fd);
	408
0ad19a3f	409	if (lxc_setstate(name, RUNNING)) {
	410	lxc_log_error("failed to set state to %s",
	411	lxc_state2str(RUNNING));
	412	goto err_state_failed;
	413	}
	414
b0a33c1e	415	if (mainloop(name, pid, sigfd, &tty_info)) {
	416	lxc_log_error("mainloop exited with an error");
	417	goto err_mailoop_failed;
0ad19a3f	418	}
	419
	420	if (lxc_setstate(name, STOPPING))
	421	lxc_log_error("failed to set state %s", lxc_state2str(STOPPING));
	422
	423	if (clone_flags & CLONE_NEWNET && conf_destroy_network(name))
	424	lxc_log_error("failed to destroy the network");
	425
	426	err = 0;
	427	out:
	428	if (lxc_setstate(name, STOPPED))
	429	lxc_log_error("failed to set state %s", lxc_state2str(STOPPED));
	430
b0a33c1e	431	lxc_delete_tty(&tty_info);
0ad19a3f	432	lxc_unlink_nsgroup(name);
0ad19a3f	433	unlink(init);
0ad19a3f	434	free(val);
0ad19a3f	435	lxc_put_lock(lock);
536b97f0	436	LXC_TTY_DEL_HANDLER(SIGQUIT);
536b97f0	437	LXC_TTY_DEL_HANDLER(SIGINT);
0ad19a3f	438
	439	return err;
	440
	441	err_write:
	442	close(fd);
	443
	444	err_state_failed:
	445	err_child_failed:
	446	err_pipe_read2:
	447	err_pipe_write:
	448	if (clone_flags & CLONE_NEWNET)
	449	conf_destroy_network(name);
	450	err_create_network:
	451	err_pipe_read:
b0a33c1e	452	err_mailoop_failed:
0ad19a3f	453	if (lxc_setstate(name, ABORTING))
	454	lxc_log_error("failed to set state %s", lxc_state2str(STOPPED));
	455
	456	kill(pid, SIGKILL);
	457	err_fork_ns:
0ad19a3f	458	close(sv[0]);
0ad19a3f	459	close(sv[1]);
0ad19a3f	460	goto out;
0ad19a3f	461	}