[mirror_lxc.git] / src / lxc / start.c

/*
 * lxc: linux Container library
 *
 * (C) Copyright IBM Corp. 2007, 2008
 *
 * Authors:
 * Daniel Lezcano <dlezcano at fr.ibm.com>
 *
 * This library is free software; you can redistribute it and/or
 * modify it under the terms of the GNU Lesser General Public
 * License as published by the Free Software Foundation; either
 * version 2.1 of the License, or (at your option) any later version.
 *
 * This library is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
 * Lesser General Public License for more details.
 *
 * You should have received a copy of the GNU Lesser General Public
 * License along with this library; if not, write to the Free Software
 * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
 */

#include "../config.h"
#include <stdio.h>
#undef _GNU_SOURCE
#include <string.h>
#include <stdlib.h>
#include <dirent.h>
#include <errno.h>
#include <unistd.h>
#include <signal.h>
#include <fcntl.h>
#include <termios.h>
#include <sys/param.h>
#include <sys/file.h>
#include <sys/mount.h>
#include <sys/types.h>
#include <sys/prctl.h>
#include <sys/types.h>
#include <sys/capability.h>
#include <sys/wait.h>
#include <sys/un.h>
#include <sys/poll.h>

#ifdef HAVE_SYS_SIGNALFD_H 
#  include <sys/signalfd.h>
#else
#  ifndef __NR_signalfd4
/* assume kernel headers are too old */
#    if __i386__
#      define __NR_signalfd4 327
#    elif __x86_64__
#      define __NR_signalfd4 289
#    elif __powerpc__
#      define __NR_signalfd4 313
#    elif __s390x__
#      define __NR_signalfd4 322
#    endif
#endif

#  ifndef __NR_signalfd
/* assume kernel headers are too old */
#    if __i386__
#      define __NR_signalfd 321
#    elif __x86_64__
#      define __NR_signalfd 282
#    elif __powerpc__
#      define __NR_signalfd 305
#    elif __s390x__
#      define __NR_signalfd 316
#    endif
#endif

int signalfd(int fd, const sigset_t *mask, int flags)
{
	int retval;

	retval = syscall (__NR_signalfd4, fd, mask, _NSIG / 8, flags);
	if (errno == ENOSYS && flags == 0)
		retval = syscall (__NR_signalfd, fd, mask, _NSIG / 8);
	return retval;
}
#endif

#if !HAVE_DECL_PR_CAPBSET_DROP
#define PR_CAPBSET_DROP 24
#endif

#include "error.h"
#include "af_unix.h"
#include "mainloop.h"

#include <lxc/lxc.h>
#include <lxc/log.h>

lxc_log_define(lxc_start, lxc);

LXC_TTY_HANDLER(SIGINT);
LXC_TTY_HANDLER(SIGQUIT);

static int setup_sigchld_fd(sigset_t *oldmask)
{
	sigset_t mask;
	int fd;

	if (sigprocmask(SIG_BLOCK, NULL, &mask)) {
		SYSERROR("failed to get mask signal");
		return -1;
	}

	if (sigaddset(&mask, SIGCHLD) || sigprocmask(SIG_BLOCK, &mask, oldmask)) {
		SYSERROR("failed to set mask signal");
		return -1;
	}

	fd = signalfd(-1, &mask, 0);
	if (fd < 0) {
		SYSERROR("failed to create the signal fd");
		return -1;
	}

	if (fcntl(fd, F_SETFD, FD_CLOEXEC)) {
		SYSERROR("failed to set sigfd to close-on-exec");
		close(fd);
		return -1;
	}

	return fd;
}

static int setup_tty_service(const char *name, int *ttyfd)
{
	int fd;
	struct sockaddr_un addr = { 0 };
	char *offset = &addr.sun_path[1];
	
	strcpy(offset, name);
	addr.sun_path[0] = '\0';

	fd = lxc_af_unix_open(addr.sun_path, SOCK_STREAM, 0);
	if (fd < 0)
		return -1;

	if (fcntl(fd, F_SETFD, FD_CLOEXEC)) {
		SYSERROR("failed to close-on-exec flag");
		close(fd);
		return -1;
	}

	*ttyfd = fd;

	return 0;
}

static int sigchld_handler(int fd, void *data, 
			   struct lxc_epoll_descr *descr)
{
	return 1;
}

static int ttyclient_handler(int fd, void *data,
			     struct lxc_epoll_descr *descr)
{
	int i;
 	struct lxc_tty_info *tty_info = data;

	for (i = 0; i < tty_info->nbtty; i++) {

		if (tty_info->pty_info[i].busy != fd)
			continue;

		lxc_mainloop_del_handler(descr, fd);
		tty_info->pty_info[i].busy = 0;
		close(fd);
	}

	return 0;
}

static int ttyservice_handler(int fd, void *data,
			      struct lxc_epoll_descr *descr)
{
	int conn, ttynum, val = 1, ret = -1;
	struct lxc_tty_info *tty_info = data;
	
	conn = accept(fd, NULL, 0);
	if (conn < 0) {
		SYSERROR("failed to accept tty client");
		return -1;
	}
	
	if (setsockopt(conn, SOL_SOCKET, SO_PASSCRED, &val, sizeof(val))) {
		SYSERROR("failed to enable credential on socket");
		goto out_close;
	}

	if (lxc_af_unix_rcv_credential(conn, &ttynum, sizeof(ttynum)))
		goto out_close;

	if (ttynum > 0) {
		if (ttynum > tty_info->nbtty)
			goto out_close;

		if (tty_info->pty_info[ttynum - 1].busy)
			goto out_close;

		goto out_send;
	}

	/* fixup index tty1 => [0] */
	for (ttynum = 1;
	     ttynum <= tty_info->nbtty && tty_info->pty_info[ttynum - 1].busy;
	     ttynum++);

	/* we didn't find any available slot for tty */
	if (ttynum > tty_info->nbtty)
		goto out_close;

out_send:
	if (lxc_af_unix_send_fd(conn, tty_info->pty_info[ttynum - 1].master,
				&ttynum, sizeof(ttynum)) < 0) {
		ERROR("failed to send tty to client");
		goto out_close;
	}

	if (lxc_mainloop_add_handler(descr, conn,
				     ttyclient_handler, tty_info)) {
		ERROR("failed to add tty client handler");
		goto out_close;
	}

	tty_info->pty_info[ttynum - 1].busy = conn;

	ret = 0;
out:
	return ret;
out_close:
	close(conn);
	goto out;
}

int lxc_poll(const char *name, struct lxc_handler *handler)
{
	int sigfd = handler->sigfd;
	int pid = handler->pid;
	const struct lxc_tty_info *tty_info = &handler->tty_info;

	int nfds, ttyfd = -1, ret = -1;
	struct lxc_epoll_descr descr;

	if (tty_info->nbtty && setup_tty_service(name, &ttyfd)) {
		ERROR("failed to create the tty service point");
		goto out_sigfd;
	}

	/* sigfd + nb tty + tty service 
	 * if tty is enabled */
	nfds = tty_info->nbtty + 1 + tty_info->nbtty ? 1 : 0;

	if (lxc_mainloop_open(nfds, &descr)) {
		ERROR("failed to create mainloop");
		goto out_ttyfd;
	}

	if (lxc_mainloop_add_handler(&descr, sigfd, sigchld_handler, &pid)) {
		ERROR("failed to add handler for the signal");
		goto out_mainloop_open;
	}

	if (tty_info->nbtty) {
		if (lxc_mainloop_add_handler(&descr, ttyfd, 
					     ttyservice_handler, 
					     (void *)tty_info)) {
			ERROR("failed to add handler for the tty");
			goto out_mainloop_open;
		}
	}

	ret = lxc_mainloop(&descr);

out:
	return ret;

out_mainloop_open:
	lxc_mainloop_close(&descr);
out_ttyfd:
	close(ttyfd);
out_sigfd:
	close(sigfd);
	goto out;
}

static int save_init_pid(const char *name, pid_t pid)
{
	char init[MAXPATHLEN];
	char *val;
	int fd, err = -1;

	snprintf(init, MAXPATHLEN, LXCPATH "/%s/init", name);

	if (!asprintf(&val, "%d\n", pid)) {
		SYSERROR("failed to allocate memory");
		goto out;
	}

	fd = open(init, O_WRONLY|O_CREAT|O_TRUNC, S_IRUSR|S_IWUSR);
	if (fd < 0) {
		SYSERROR("failed to open '%s'", init);
		goto out_free;
	}

	if (write(fd, val, strlen(val)) < 0) {
		SYSERROR("failed to write the init pid");
		goto out_close;
	}

	err = 0;

out_close:
	close(fd);
out_free:
	free(val);
out:
	return err;
}

static void remove_init_pid(const char *name, pid_t pid)
{
	char init[MAXPATHLEN];

	snprintf(init, MAXPATHLEN, LXCPATH "/%s/init", name);
	unlink(init);
}

static int fdname(int fd, char *name, size_t size)
{
	char path[MAXPATHLEN];

	snprintf(path, MAXPATHLEN, "/proc/self/fd/%d", fd);

	return readlink(path, name, size) < 0 ? -1 : 0;
}

static int console_init(char *console, size_t size)
{
	struct stat stat;
	int i;

	for (i = 0; i < 3; i++) {
		if (!isatty(i))
			continue;

		if (ttyname_r(i, console, size)) {
			SYSERROR("failed to retrieve tty name");
			return -1;
		}
		return 0;
	}

	if (!fstat(0, &stat)) {
		if (S_ISREG(stat.st_mode) || S_ISCHR(stat.st_mode) ||
		    S_ISFIFO(stat.st_mode) || S_ISLNK(stat.st_mode))
			return fdname(0, console, size);
	}

	console[0] = '\0';
	return 0;
}

int lxc_init(const char *name, struct lxc_handler *handler)
{
	int err = -1;

	memset(handler, 0, sizeof(*handler));

	handler->lock = lxc_get_lock(name);
	if (handler->lock < 0)
		goto out;

	/* Begin the set the state to STARTING*/
	if (lxc_setstate(name, STARTING)) {
		ERROR("failed to set state '%s'", lxc_state2str(STARTING));
		goto out_put_lock;
	}

	if (console_init(handler->tty, sizeof(handler->tty))) {
		ERROR("failed to initialize the console");
		goto out_aborting;
	}

	if (lxc_create_tty(name, &handler->tty_info)) {
		ERROR("failed to create the ttys");
		goto out_aborting;
	}

	/* the signal fd has to be created before forking otherwise
	 * if the child process exits before we setup the signal fd,
	 * the event will be lost and the command will be stuck */
	handler->sigfd = setup_sigchld_fd(&handler->oldmask);
	if (handler->sigfd < 0) {
		ERROR("failed to set sigchild fd handler");
		goto out_delete_tty;
	}

	/* Avoid signals from terminal */
	LXC_TTY_ADD_HANDLER(SIGINT);
	LXC_TTY_ADD_HANDLER(SIGQUIT);

	err = 0;
out:
	return err;

out_delete_tty:
	lxc_delete_tty(&handler->tty_info);
out_aborting:
	lxc_setstate(name, ABORTING);
out_put_lock:
	lxc_put_lock(handler->lock);
	goto out;
}

void lxc_fini(const char *name, struct lxc_handler *handler)
{
	/* The STOPPING state is there for future cleanup code
	 * which can take awhile
	 */
	lxc_setstate(name, STOPPING);

	lxc_setstate(name, STOPPED);

	remove_init_pid(name, handler->pid);

	lxc_delete_tty(&handler->tty_info);

	lxc_unlink_nsgroup(name);

	lxc_put_lock(handler->lock);

	LXC_TTY_DEL_HANDLER(SIGQUIT);
	LXC_TTY_DEL_HANDLER(SIGINT);
}

void lxc_abort(const char *name, struct lxc_handler *handler)
{
	lxc_setstate(name, ABORTING);
	kill(handler->pid, SIGKILL);
}

int lxc_spawn(const char *name, struct lxc_handler *handler, char *const argv[])
{
	int sv[2];
	int clone_flags;
	int err = -1, sync;

	/* Synchro socketpair */
	if (socketpair(AF_LOCAL, SOCK_STREAM, 0, sv)) {
		SYSERROR("failed to create communication socketpair");
		goto out;
	}

	clone_flags = CLONE_NEWPID|CLONE_NEWIPC|CLONE_NEWNS;
	if (conf_has_utsname(name))
		clone_flags |= CLONE_NEWUTS;
	if (conf_has_network(name))
		clone_flags |= CLONE_NEWNET;

	/* Create a process in a new set of namespaces */
	handler->pid = fork_ns(clone_flags);
	if (handler->pid < 0) {
		SYSERROR("failed to fork into a new namespace");
		goto out_close;
	}

	if (!handler->pid) {

		if (sigprocmask(SIG_SETMASK, &handler->oldmask, NULL)) {
			SYSERROR("failed to set sigprocmask");
			goto out_child;
		}

		close(sv[1]);

		/* Be sure we don't inherit this after the exec */
		fcntl(sv[0], F_SETFD, FD_CLOEXEC);
		
		/* Tell our father he can begin to configure the container */
		if (write(sv[0], &sync, sizeof(sync)) < 0) {
			SYSERROR("failed to write socket");
			goto out_child;
		}

		/* Wait for the father to finish the configuration */
		if (read(sv[0], &sync, sizeof(sync)) < 0) {
			SYSERROR("failed to read socket");
			goto out_child;
		}

		/* Setup the container, ip, names, utsname, ... */
		if (lxc_setup(name, handler->tty, &handler->tty_info)) {
			ERROR("failed to setup the container");
			goto out_warn_father;
		}

		if (prctl(PR_CAPBSET_DROP, CAP_SYS_BOOT, 0, 0, 0)) {
			SYSERROR("failed to remove CAP_SYS_BOOT capability");
			goto out_child;
		}

		execvp(argv[0], argv);
		SYSERROR("failed to exec %s", argv[0]);

	out_warn_father:
		/* If the exec fails, tell that to our father */
		if (write(sv[0], &err, sizeof(err)) < 0)
			SYSERROR("failed to write the socket");
	out_child:
		exit(err);
	}

	close(sv[0]);
	
	/* Wait for the child to be ready */
	if (read(sv[1], &sync, sizeof(sync)) < 0) {
		SYSERROR("failed to read the socket");
		goto out_abort;
	}

	if (lxc_rename_nsgroup(name, handler->pid) || lxc_link_nsgroup(name))
		WARN("cgroupfs not found: cgroup disabled");

	/* Create the network configuration */
	if (clone_flags & CLONE_NEWNET &&
	    conf_create_network(name, handler->pid)) {
		ERROR("failed to create the configured network");
		goto out_abort;
	}

	/* Tell the child to continue its initialization */
	if (write(sv[1], &sync, sizeof(sync)) < 0) {
		SYSERROR("failed to write the socket");
		goto out_abort;
	}

	/* Wait for the child to exec or returning an error */
	if (read(sv[1], &sync, sizeof(sync)) < 0) {
		ERROR("failed to read the socket");
		goto out_abort;
	}

	if (save_init_pid(name, handler->pid)) {
		ERROR("failed to save the init pid info");
		goto out_abort;
	}

	if (lxc_setstate(name, RUNNING)) {
		ERROR("failed to set state to %s",
			      lxc_state2str(RUNNING));
		goto out_abort;
	}

	err = 0;

out_close:
	close(sv[0]);
	close(sv[1]);
out:
	return err;

out_abort:
	lxc_abort(name, handler);
	goto out_close;
}

int lxc_start(const char *name, char *const argv[])
{
	struct lxc_handler handler = { 0 };
	int err = -1;
	int status;

	if (lxc_init(name, &handler)) {
		ERROR("failed to initialize the container");
		goto out;
	}

	err = lxc_spawn(name, &handler, argv);
	if (err) {
		ERROR("failed to spawn '%s'", argv[0]);
		goto out;
	}

	err = lxc_poll(name, &handler);
	if (err) {
		ERROR("mainloop exited with an error");
		goto out_abort;
	}

	while (waitpid(handler.pid, &status, 0) < 0 && errno == EINTR)
		continue;

	err =  lxc_error_set_and_log(handler.pid, status);
out:
	lxc_fini(name, &handler);
	return err;

out_abort:
	lxc_abort(name, &handler);
	goto out;
}
Commit	Line	Data
0ad19a3f	1	/*
	2	* lxc: linux Container library
	3	*
	4	* (C) Copyright IBM Corp. 2007, 2008
	5	*
	6	* Authors:
	7	* Daniel Lezcano <dlezcano at fr.ibm.com>
	8	*
	9	* This library is free software; you can redistribute it and/or
	10	* modify it under the terms of the GNU Lesser General Public
	11	* License as published by the Free Software Foundation; either
	12	* version 2.1 of the License, or (at your option) any later version.
	13	*
	14	* This library is distributed in the hope that it will be useful,
	15	* but WITHOUT ANY WARRANTY; without even the implied warranty of
	16	* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
	17	* Lesser General Public License for more details.
	18	*
	19	* You should have received a copy of the GNU Lesser General Public
	20	* License along with this library; if not, write to the Free Software
	21	* Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
	22	*/
	23
ff218c25	24	#include "../config.h"
0ad19a3f	25	#include <stdio.h>
	26	#undef _GNU_SOURCE
	27	#include <string.h>
	28	#include <stdlib.h>
	29	#include <dirent.h>
	30	#include <errno.h>
	31	#include <unistd.h>
	32	#include <signal.h>
b0a33c1e	33	#include <fcntl.h>
b0a33c1e	34	#include <termios.h>
0ad19a3f	35	#include <sys/param.h>
0ad19a3f	36	#include <sys/file.h>
f4d507d5	37	#include <sys/mount.h>
0ad19a3f	38	#include <sys/types.h>
0ad19a3f	39	#include <sys/prctl.h>
ddceb1f9	40	#include <sys/types.h>
42ff343d	41	#include <sys/capability.h>
0ad19a3f	42	#include <sys/wait.h>
b0a33c1e	43	#include <sys/un.h>
b0a33c1e	44	#include <sys/poll.h>
ff218c25	45
ff218c25	46	#ifdef HAVE_SYS_SIGNALFD_H
8ca61733	47	# include <sys/signalfd.h>
ff218c25	48	#else
8ca61733 MJ	49	# ifndef __NR_signalfd4
	50	/* assume kernel headers are too old */
	51	# if __i386__
	52	# define __NR_signalfd4 327
	53	# elif __x86_64__
	54	# define __NR_signalfd4 289
bfa38025 MH	55	# elif __powerpc__
bfa38025 MH	56	# define __NR_signalfd4 313
47f38330 SH	57	# elif __s390x__
47f38330 SH	58	# define __NR_signalfd4 322
8ca61733 MJ	59	# endif
	60	#endif
	61
	62	# ifndef __NR_signalfd
	63	/* assume kernel headers are too old */
	64	# if __i386__
	65	# define __NR_signalfd 321
	66	# elif __x86_64__
	67	# define __NR_signalfd 282
bfa38025 MH	68	# elif __powerpc__
bfa38025 MH	69	# define __NR_signalfd 305
47f38330 SH	70	# elif __s390x__
47f38330 SH	71	# define __NR_signalfd 316
8ca61733 MJ	72	# endif
	73	#endif
	74
	75	int signalfd(int fd, const sigset_t *mask, int flags)
	76	{
	77	int retval;
	78
	79	retval = syscall (__NR_signalfd4, fd, mask, _NSIG / 8, flags);
	80	if (errno == ENOSYS && flags == 0)
	81	retval = syscall (__NR_signalfd, fd, mask, _NSIG / 8);
	82	return retval;
	83	}
ff218c25	84	#endif
0ad19a3f	85
656994bb MH	86	#if !HAVE_DECL_PR_CAPBSET_DROP
	87	#define PR_CAPBSET_DROP 24
	88	#endif
	89
e2bcd7db	90	#include "error.h"
b0a33c1e	91	#include "af_unix.h"
b0a33c1e	92	#include "mainloop.h"
e2bcd7db	93
b113348e	94	#include <lxc/lxc.h>
36eb9bde CLG	95	#include <lxc/log.h>
	96
	97	lxc_log_define(lxc_start, lxc);
	98
0ad19a3f	99	LXC_TTY_HANDLER(SIGINT);
	100	LXC_TTY_HANDLER(SIGQUIT);
	101
b0a33c1e	102	static int setup_sigchld_fd(sigset_t *oldmask)
	103	{
	104	sigset_t mask;
	105	int fd;
	106
	107	if (sigprocmask(SIG_BLOCK, NULL, &mask)) {
36eb9bde	108	SYSERROR("failed to get mask signal");
b0a33c1e	109	return -1;
	110	}
	111
	112	if (sigaddset(&mask, SIGCHLD) \|\| sigprocmask(SIG_BLOCK, &mask, oldmask)) {
36eb9bde	113	SYSERROR("failed to set mask signal");
b0a33c1e	114	return -1;
	115	}
	116
	117	fd = signalfd(-1, &mask, 0);
	118	if (fd < 0) {
36eb9bde	119	SYSERROR("failed to create the signal fd");
b0a33c1e	120	return -1;
	121	}
	122
	123	if (fcntl(fd, F_SETFD, FD_CLOEXEC)) {
36eb9bde	124	SYSERROR("failed to set sigfd to close-on-exec");
b0a33c1e	125	close(fd);
	126	return -1;
	127	}
	128
	129	return fd;
	130	}
	131
	132	static int setup_tty_service(const char name, int ttyfd)
	133	{
	134	int fd;
	135	struct sockaddr_un addr = { 0 };
	136	char *offset = &addr.sun_path[1];
	137
	138	strcpy(offset, name);
	139	addr.sun_path[0] = '\0';
	140
	141	fd = lxc_af_unix_open(addr.sun_path, SOCK_STREAM, 0);
	142	if (fd < 0)
	143	return -1;
	144
	145	if (fcntl(fd, F_SETFD, FD_CLOEXEC)) {
36eb9bde	146	SYSERROR("failed to close-on-exec flag");
b0a33c1e	147	close(fd);
	148	return -1;
	149	}
	150
	151	*ttyfd = fd;
	152
	153	return 0;
	154	}
	155
	156	static int sigchld_handler(int fd, void *data,
	157	struct lxc_epoll_descr *descr)
	158	{
b0a33c1e	159	return 1;
	160	}
	161
	162	static int ttyclient_handler(int fd, void *data,
	163	struct lxc_epoll_descr *descr)
	164	{
	165	int i;
	166	struct lxc_tty_info *tty_info = data;
	167
	168	for (i = 0; i < tty_info->nbtty; i++) {
	169
	170	if (tty_info->pty_info[i].busy != fd)
	171	continue;
	172
	173	lxc_mainloop_del_handler(descr, fd);
	174	tty_info->pty_info[i].busy = 0;
	175	close(fd);
	176	}
	177
	178	return 0;
	179	}
	180
	181	static int ttyservice_handler(int fd, void *data,
	182	struct lxc_epoll_descr *descr)
	183	{
	184	int conn, ttynum, val = 1, ret = -1;
	185	struct lxc_tty_info *tty_info = data;
	186
	187	conn = accept(fd, NULL, 0);
	188	if (conn < 0) {
36eb9bde	189	SYSERROR("failed to accept tty client");
b0a33c1e	190	return -1;
	191	}
	192
	193	if (setsockopt(conn, SOL_SOCKET, SO_PASSCRED, &val, sizeof(val))) {
36eb9bde	194	SYSERROR("failed to enable credential on socket");
b0a33c1e	195	goto out_close;
	196	}
	197
	198	if (lxc_af_unix_rcv_credential(conn, &ttynum, sizeof(ttynum)))
	199	goto out_close;
	200
be43f17e DL	201	if (ttynum > 0) {
	202	if (ttynum > tty_info->nbtty)
	203	goto out_close;
	204
	205	if (tty_info->pty_info[ttynum - 1].busy)
	206	goto out_close;
b0a33c1e	207
be43f17e DL	208	goto out_send;
be43f17e DL	209	}
b0a33c1e	210
be43f17e DL	211	/* fixup index tty1 => [0] */
	212	for (ttynum = 1;
	213	ttynum <= tty_info->nbtty && tty_info->pty_info[ttynum - 1].busy;
	214	ttynum++);
	215
	216	/* we didn't find any available slot for tty */
	217	if (ttynum > tty_info->nbtty)
b0a33c1e	218	goto out_close;
b0a33c1e	219
be43f17e DL	220	out_send:
	221	if (lxc_af_unix_send_fd(conn, tty_info->pty_info[ttynum - 1].master,
	222	&ttynum, sizeof(ttynum)) < 0) {
36eb9bde	223	ERROR("failed to send tty to client");
b0a33c1e	224	goto out_close;
	225	}
	226
be43f17e	227	if (lxc_mainloop_add_handler(descr, conn,
b0a33c1e	228	ttyclient_handler, tty_info)) {
36eb9bde	229	ERROR("failed to add tty client handler");
b0a33c1e	230	goto out_close;
	231	}
	232
be43f17e	233	tty_info->pty_info[ttynum - 1].busy = conn;
b0a33c1e	234
b0a33c1e	235	ret = 0;
b0a33c1e	236	out:
	237	return ret;
	238	out_close:
	239	close(conn);
	240	goto out;
	241	}
	242
1bc5cc8c	243	int lxc_poll(const char name, struct lxc_handler handler)
b0a33c1e	244	{
ca5f7926 DL	245	int sigfd = handler->sigfd;
	246	int pid = handler->pid;
	247	const struct lxc_tty_info *tty_info = &handler->tty_info;
	248
b0a33c1e	249	int nfds, ttyfd = -1, ret = -1;
	250	struct lxc_epoll_descr descr;
	251
	252	if (tty_info->nbtty && setup_tty_service(name, &ttyfd)) {
36eb9bde	253	ERROR("failed to create the tty service point");
b0a33c1e	254	goto out_sigfd;
	255	}
	256
	257	/* sigfd + nb tty + tty service
	258	* if tty is enabled */
	259	nfds = tty_info->nbtty + 1 + tty_info->nbtty ? 1 : 0;
	260
	261	if (lxc_mainloop_open(nfds, &descr)) {
36eb9bde	262	ERROR("failed to create mainloop");
b0a33c1e	263	goto out_ttyfd;
	264	}
	265
	266	if (lxc_mainloop_add_handler(&descr, sigfd, sigchld_handler, &pid)) {
36eb9bde	267	ERROR("failed to add handler for the signal");
b0a33c1e	268	goto out_mainloop_open;
	269	}
	270
	271	if (tty_info->nbtty) {
	272	if (lxc_mainloop_add_handler(&descr, ttyfd,
	273	ttyservice_handler,
	274	(void *)tty_info)) {
36eb9bde	275	ERROR("failed to add handler for the tty");
b0a33c1e	276	goto out_mainloop_open;
	277	}
	278	}
	279
	280	ret = lxc_mainloop(&descr);
	281
	282	out:
	283	return ret;
	284
	285	out_mainloop_open:
	286	lxc_mainloop_close(&descr);
	287	out_ttyfd:
	288	close(ttyfd);
	289	out_sigfd:
	290	close(sigfd);
	291	goto out;
	292	}
	293
59eb99ba	294	static int save_init_pid(const char *name, pid_t pid)
0ad19a3f	295	{
22ebac19	296	char init[MAXPATHLEN];
59eb99ba DL	297	char *val;
	298	int fd, err = -1;
	299
	300	snprintf(init, MAXPATHLEN, LXCPATH "/%s/init", name);
	301
	302	if (!asprintf(&val, "%d\n", pid)) {
	303	SYSERROR("failed to allocate memory");
	304	goto out;
	305	}
	306
	307	fd = open(init, O_WRONLY\|O_CREAT\|O_TRUNC, S_IRUSR\|S_IWUSR);
	308	if (fd < 0) {
	309	SYSERROR("failed to open '%s'", init);
	310	goto out_free;
	311	}
	312
	313	if (write(fd, val, strlen(val)) < 0) {
	314	SYSERROR("failed to write the init pid");
	315	goto out_close;
	316	}
f4d507d5	317
59eb99ba DL	318	err = 0;
	319
	320	out_close:
	321	close(fd);
	322	out_free:
	323	free(val);
	324	out:
	325	return err;
	326	}
	327
	328	static void remove_init_pid(const char *name, pid_t pid)
	329	{
	330	char init[MAXPATHLEN];
	331
	332	snprintf(init, MAXPATHLEN, LXCPATH "/%s/init", name);
	333	unlink(init);
	334	}
	335
b8f57738 DL	336	static int fdname(int fd, char *name, size_t size)
	337	{
	338	char path[MAXPATHLEN];
	339
	340	snprintf(path, MAXPATHLEN, "/proc/self/fd/%d", fd);
	341
	342	return readlink(path, name, size) < 0 ? -1 : 0;
	343	}
	344
	345	static int console_init(char *console, size_t size)
	346	{
	347	struct stat stat;
	348	int i;
	349
	350	for (i = 0; i < 3; i++) {
	351	if (!isatty(i))
	352	continue;
	353
	354	if (ttyname_r(i, console, size)) {
	355	SYSERROR("failed to retrieve tty name");
	356	return -1;
	357	}
	358	return 0;
	359	}
	360
	361	if (!fstat(0, &stat)) {
	362	if (S_ISREG(stat.st_mode) \|\| S_ISCHR(stat.st_mode) \|\|
	363	S_ISFIFO(stat.st_mode) \|\| S_ISLNK(stat.st_mode))
	364	return fdname(0, console, size);
	365	}
	366
	367	console[0] = '\0';
	368	return 0;
	369	}
	370
1bc5cc8c	371	int lxc_init(const char name, struct lxc_handler handler)
59eb99ba DL	372	{
	373	int err = -1;
	374
	375	memset(handler, 0, sizeof(*handler));
	376
	377	handler->lock = lxc_get_lock(name);
	378	if (handler->lock < 0)
	379	goto out;
0ad19a3f	380
0ad19a3f	381	/* Begin the set the state to STARTING*/
0ad19a3f	382	if (lxc_setstate(name, STARTING)) {
59eb99ba DL	383	ERROR("failed to set state '%s'", lxc_state2str(STARTING));
59eb99ba DL	384	goto out_put_lock;
0ad19a3f	385	}
0ad19a3f	386
b8f57738 DL	387	if (console_init(handler->tty, sizeof(handler->tty))) {
	388	ERROR("failed to initialize the console");
	389	goto out_aborting;
	390	}
939229eb	391
59eb99ba	392	if (lxc_create_tty(name, &handler->tty_info)) {
36eb9bde	393	ERROR("failed to create the ttys");
59eb99ba	394	goto out_aborting;
b0a33c1e	395	}
	396
	397	/* the signal fd has to be created before forking otherwise
	398	* if the child process exits before we setup the signal fd,
	399	* the event will be lost and the command will be stuck */
59eb99ba DL	400	handler->sigfd = setup_sigchld_fd(&handler->oldmask);
59eb99ba DL	401	if (handler->sigfd < 0) {
36eb9bde	402	ERROR("failed to set sigchild fd handler");
59eb99ba	403	goto out_delete_tty;
b0a33c1e	404	}
b0a33c1e	405
59eb99ba DL	406	/* Avoid signals from terminal */
	407	LXC_TTY_ADD_HANDLER(SIGINT);
	408	LXC_TTY_ADD_HANDLER(SIGQUIT);
	409
	410	err = 0;
	411	out:
	412	return err;
	413
	414	out_delete_tty:
	415	lxc_delete_tty(&handler->tty_info);
	416	out_aborting:
	417	lxc_setstate(name, ABORTING);
	418	out_put_lock:
	419	lxc_put_lock(handler->lock);
	420	goto out;
	421	}
	422
1bc5cc8c	423	void lxc_fini(const char name, struct lxc_handler handler)
59eb99ba DL	424	{
	425	/* The STOPPING state is there for future cleanup code
	426	* which can take awhile
	427	*/
	428	lxc_setstate(name, STOPPING);
	429
	430	lxc_setstate(name, STOPPED);
	431
	432	remove_init_pid(name, handler->pid);
	433
	434	lxc_delete_tty(&handler->tty_info);
	435
	436	lxc_unlink_nsgroup(name);
	437
	438	lxc_put_lock(handler->lock);
	439
	440	LXC_TTY_DEL_HANDLER(SIGQUIT);
	441	LXC_TTY_DEL_HANDLER(SIGINT);
	442	}
	443
1bc5cc8c	444	void lxc_abort(const char name, struct lxc_handler handler)
59eb99ba DL	445	{
	446	lxc_setstate(name, ABORTING);
	447	kill(handler->pid, SIGKILL);
	448	}
	449
9618063c	450	int lxc_spawn(const char name, struct lxc_handler handler, char *const argv[])
59eb99ba DL	451	{
	452	int sv[2];
	453	int clone_flags;
	454	int err = -1, sync;
	455
0ad19a3f	456	/* Synchro socketpair */
0ad19a3f	457	if (socketpair(AF_LOCAL, SOCK_STREAM, 0, sv)) {
36eb9bde	458	SYSERROR("failed to create communication socketpair");
f4d507d5	459	goto out;
0ad19a3f	460	}
0ad19a3f	461
f4d507d5	462	clone_flags = CLONE_NEWPID\|CLONE_NEWIPC\|CLONE_NEWNS;
0ad19a3f	463	if (conf_has_utsname(name))
	464	clone_flags \|= CLONE_NEWUTS;
	465	if (conf_has_network(name))
	466	clone_flags \|= CLONE_NEWNET;
	467
	468	/* Create a process in a new set of namespaces */
59eb99ba DL	469	handler->pid = fork_ns(clone_flags);
59eb99ba DL	470	if (handler->pid < 0) {
36eb9bde	471	SYSERROR("failed to fork into a new namespace");
59eb99ba	472	goto out_close;
0ad19a3f	473	}
0ad19a3f	474
59eb99ba	475	if (!handler->pid) {
0ad19a3f	476
59eb99ba	477	if (sigprocmask(SIG_SETMASK, &handler->oldmask, NULL)) {
36eb9bde	478	SYSERROR("failed to set sigprocmask");
e043236e	479	goto out_child;
b0a33c1e	480	}
b0a33c1e	481
0ad19a3f	482	close(sv[1]);
	483
	484	/* Be sure we don't inherit this after the exec */
	485	fcntl(sv[0], F_SETFD, FD_CLOEXEC);
	486
	487	/* Tell our father he can begin to configure the container */
	488	if (write(sv[0], &sync, sizeof(sync)) < 0) {
36eb9bde	489	SYSERROR("failed to write socket");
57545890	490	goto out_child;
0ad19a3f	491	}
	492
	493	/* Wait for the father to finish the configuration */
	494	if (read(sv[0], &sync, sizeof(sync)) < 0) {
36eb9bde	495	SYSERROR("failed to read socket");
57545890	496	goto out_child;
0ad19a3f	497	}
	498
	499	/* Setup the container, ip, names, utsname, ... */
e043236e	500	if (lxc_setup(name, handler->tty, &handler->tty_info)) {
36eb9bde	501	ERROR("failed to setup the container");
e043236e	502	goto out_warn_father;
0ad19a3f	503	}
0ad19a3f	504
42ff343d	505	if (prctl(PR_CAPBSET_DROP, CAP_SYS_BOOT, 0, 0, 0)) {
36eb9bde	506	SYSERROR("failed to remove CAP_SYS_BOOT capability");
42ff343d	507	goto out_child;
	508	}
	509
0ad19a3f	510	execvp(argv[0], argv);
36eb9bde	511	SYSERROR("failed to exec %s", argv[0]);
0ad19a3f	512
e043236e	513	out_warn_father:
0ad19a3f	514	/* If the exec fails, tell that to our father */
e5bda9ee	515	if (write(sv[0], &err, sizeof(err)) < 0)
36eb9bde	516	SYSERROR("failed to write the socket");
57545890	517	out_child:
e5bda9ee	518	exit(err);
0ad19a3f	519	}
	520
	521	close(sv[0]);
	522
	523	/* Wait for the child to be ready */
	524	if (read(sv[1], &sync, sizeof(sync)) < 0) {
36eb9bde	525	SYSERROR("failed to read the socket");
59eb99ba	526	goto out_abort;
0ad19a3f	527	}
0ad19a3f	528
6203de18	529	if (lxc_rename_nsgroup(name, handler->pid) \|\| lxc_link_nsgroup(name))
36eb9bde	530	WARN("cgroupfs not found: cgroup disabled");
218d4250	531
0ad19a3f	532	/* Create the network configuration */
6203de18 DL	533	if (clone_flags & CLONE_NEWNET &&
6203de18 DL	534	conf_create_network(name, handler->pid)) {
36eb9bde	535	ERROR("failed to create the configured network");
59eb99ba	536	goto out_abort;
0ad19a3f	537	}
	538
	539	/* Tell the child to continue its initialization */
	540	if (write(sv[1], &sync, sizeof(sync)) < 0) {
36eb9bde	541	SYSERROR("failed to write the socket");
59eb99ba	542	goto out_abort;
0ad19a3f	543	}
	544
	545	/* Wait for the child to exec or returning an error */
e043236e	546	if (read(sv[1], &sync, sizeof(sync)) < 0) {
36eb9bde	547	ERROR("failed to read the socket");
59eb99ba	548	goto out_abort;
0ad19a3f	549	}
0ad19a3f	550
59eb99ba DL	551	if (save_init_pid(name, handler->pid)) {
	552	ERROR("failed to save the init pid info");
	553	goto out_abort;
0ad19a3f	554	}
0ad19a3f	555
59eb99ba DL	556	if (lxc_setstate(name, RUNNING)) {
	557	ERROR("failed to set state to %s",
	558	lxc_state2str(RUNNING));
	559	goto out_abort;
3f21c114	560	}
22ebac19	561
59eb99ba	562	err = 0;
22ebac19	563
59eb99ba DL	564	out_close:
	565	close(sv[0]);
	566	close(sv[1]);
	567	out:
	568	return err;
0ad19a3f	569
59eb99ba DL	570	out_abort:
	571	lxc_abort(name, handler);
	572	goto out_close;
	573	}
0ad19a3f	574
9618063c	575	int lxc_start(const char name, char const argv[])
59eb99ba DL	576	{
59eb99ba DL	577	struct lxc_handler handler = { 0 };
e043236e	578	int err = -1;
59eb99ba DL	579	int status;
	580
	581	if (lxc_init(name, &handler)) {
	582	ERROR("failed to initialize the container");
	583	goto out;
0ad19a3f	584	}
0ad19a3f	585
59eb99ba DL	586	err = lxc_spawn(name, &handler, argv);
	587	if (err) {
	588	ERROR("failed to spawn '%s'", argv[0]);
	589	goto out;
0ad19a3f	590	}
0ad19a3f	591
e043236e MN	592	err = lxc_poll(name, &handler);
e043236e MN	593	if (err) {
59eb99ba DL	594	ERROR("mainloop exited with an error");
	595	goto out_abort;
	596	}
0ad19a3f	597
1bc5cc8c DL	598	while (waitpid(handler.pid, &status, 0) < 0 && errno == EINTR)
1bc5cc8c DL	599	continue;
e043236e MN	600
e043236e MN	601	err = lxc_error_set_and_log(handler.pid, status);
0ad19a3f	602	out:
59eb99ba	603	lxc_fini(name, &handler);
0ad19a3f	604	return err;
0ad19a3f	605
59eb99ba DL	606	out_abort:
59eb99ba DL	607	lxc_abort(name, &handler);
0ad19a3f	608	goto out;
0ad19a3f	609	}