]>
Commit | Line | Data |
---|---|---|
cc73685d CB |
1 | /* SPDX-License-Identifier: LGPL-2.1+ */ |
2 | ||
f1a4a029 ÇO |
3 | #ifndef __LXC_START_H |
4 | #define __LXC_START_H | |
00b3c2e2 | 5 | |
1160ce89 CB |
6 | #include "config.h" |
7 | ||
0aff04e0 | 8 | #include <sched.h> |
9dc56d32 | 9 | #include <signal.h> |
35a02107 | 10 | #include <stdbool.h> |
872e1899 | 11 | #include <sys/param.h> |
5e5576a4 CB |
12 | #include <sys/socket.h> |
13 | #include <sys/un.h> | |
f2363e38 | 14 | |
8c8cd087 | 15 | #include "compiler.h" |
aa460476 | 16 | #include "conf.h" |
85c279bb | 17 | #include "macro.h" |
9f30a190 | 18 | #include "namespace.h" |
35a02107 | 19 | #include "state.h" |
1bc5cc8c | 20 | |
872e1899 | 21 | struct lxc_handler { |
becad0ec CB |
22 | /* Record the clone for namespaces flags that the container requested. |
23 | * | |
24 | * @ns_clone_flags | |
25 | * - All clone flags that were requested. | |
26 | * | |
27 | * @ns_on_clone_flags | |
28 | * - The clone flags for namespaces to actually use when calling | |
29 | * lxc_clone(): After the container has started ns_on_clone_flags will | |
30 | * list the clone flags that were unshare()ed rather then clone()ed | |
31 | * because of ordering requirements (e.g. e.g. CLONE_NEWNET and | |
32 | * CLONE_NEWUSER) or implementation details. | |
becad0ec | 33 | * |
f7176c3e CB |
34 | * @ns_unshare_flags |
35 | * - Flags for namespaces that were unshared, not cloned. | |
36 | * | |
37 | * @clone_flags | |
38 | * - ns_on_clone flags | other flags used to create container. | |
8deca6c9 | 39 | */ |
becad0ec | 40 | struct /* lxc_ns */ { |
f7176c3e CB |
41 | unsigned int ns_clone_flags; |
42 | unsigned int ns_on_clone_flags; | |
43 | unsigned int ns_unshare_flags; | |
0aff04e0 | 44 | __aligned_u64 clone_flags; |
becad0ec | 45 | }; |
8deca6c9 | 46 | |
35a02107 CB |
47 | /* Signal file descriptor. */ |
48 | int sigfd; | |
49 | ||
50 | /* List of file descriptors referring to the namespaces of the | |
51 | * container. Note that these are not necessarily identical to | |
52 | * the "clone_flags" handler field in case namespace inheritance is | |
53 | * requested. | |
54 | */ | |
55 | int nsfd[LXC_NS_MAX]; | |
1a0e70ac | 56 | |
c6012571 CB |
57 | /* Abstract unix domain SOCK_DGRAM socketpair to pass arbitrary data |
58 | * between child and parent. | |
59 | */ | |
60 | int data_sock[2]; | |
1a0e70ac | 61 | |
1a0e70ac | 62 | /* The socketpair() fds used to wait on successful daemonized startup. */ |
5e5576a4 | 63 | int state_socket_pair[2]; |
35a02107 CB |
64 | |
65 | /* Socketpair to synchronize processes during container creation. */ | |
66 | int sync_sock[2]; | |
67 | ||
f0ecc19d CB |
68 | /* Pointer to the name of the container. Do not free! */ |
69 | const char *name; | |
35a02107 | 70 | |
f0ecc19d | 71 | /* Pointer to the path the container. Do not free! */ |
35a02107 CB |
72 | const char *lxcpath; |
73 | ||
74 | /* Whether the container's startup process euid is 0. */ | |
75 | bool am_root; | |
76 | ||
77 | /* Indicates whether should we close std{in,out,err} on start. */ | |
bb955810 | 78 | bool daemonize; |
35a02107 CB |
79 | |
80 | /* The child's pid. */ | |
81 | pid_t pid; | |
82 | ||
33942046 CB |
83 | /* The child's pidfd. */ |
84 | int pidfd; | |
85 | ||
c581d2a6 CB |
86 | /* The grandfather's pid when double-forking. */ |
87 | pid_t transient_pid; | |
88 | ||
434c8e15 CB |
89 | /* The monitor's pid. */ |
90 | pid_t monitor_pid; | |
91 | ||
4d8bdfa0 CB |
92 | int monitor_status_fd; |
93 | ||
3c319edb CB |
94 | /* Whether the child has already exited. */ |
95 | bool init_died; | |
96 | ||
35a02107 CB |
97 | /* The signal mask prior to setting up the signal file descriptor. */ |
98 | sigset_t oldmask; | |
99 | ||
100 | /* The container's in-memory configuration. */ | |
101 | struct lxc_conf *conf; | |
102 | ||
35a02107 CB |
103 | /* A set of operations to be performed at various stages of the |
104 | * container's life. | |
105 | */ | |
106 | struct lxc_operations *ops; | |
107 | ||
108 | /* This holds the cgroup information. Note that the data here is | |
109 | * specific to the cgroup driver used. | |
110 | */ | |
111 | void *cgroup_data; | |
112 | ||
113 | /* Data to be passed to handler ops. */ | |
114 | void *data; | |
115 | ||
116 | /* Current state of the container. */ | |
117 | lxc_state_t state; | |
cd5177e9 TA |
118 | |
119 | /* The exit status of the container; not defined unless ->init_died == | |
120 | * true. | |
121 | */ | |
122 | int exit_status; | |
2202afc9 CB |
123 | |
124 | struct cgroup_ops *cgroup_ops; | |
85c279bb CB |
125 | |
126 | /* Internal fds that always need to stay open. */ | |
127 | int keep_fds[3]; | |
d701d729 | 128 | |
af04d847 CB |
129 | /* Static memory, don't free. */ |
130 | struct lsm_ops *lsm_ops; | |
8db6be1b CB |
131 | |
132 | /* The namespace idx is guaranteed to match the stashed namespace path. */ | |
133 | char nsfd_paths[LXC_NS_MAX + 1][LXC_EXPOSE_NAMESPACE_LEN]; | |
134 | /* The namesace idx is _not_ guaranteed to match the stashed namespace path. */ | |
135 | lxc_namespace_t hook_argc; | |
136 | char *hook_argv[LXC_NS_MAX + 1]; | |
fc25b815 MN |
137 | }; |
138 | ||
794248d0 | 139 | struct execute_args { |
794248d0 CB |
140 | char *const *argv; |
141 | int quiet; | |
142 | }; | |
143 | ||
dbc9832d CB |
144 | struct lxc_operations { |
145 | int (*start)(struct lxc_handler *, void *); | |
146 | int (*post_start)(struct lxc_handler *, void *); | |
147 | }; | |
148 | ||
8c8cd087 CB |
149 | __hidden extern int lxc_poll(const char *name, struct lxc_handler *handler); |
150 | __hidden extern int lxc_set_state(const char *name, struct lxc_handler *handler, lxc_state_t state); | |
151 | __hidden extern int lxc_serve_state_clients(const char *name, struct lxc_handler *handler, | |
152 | lxc_state_t state); | |
153 | __hidden extern void lxc_abort(struct lxc_handler *handler); | |
154 | __hidden extern struct lxc_handler *lxc_init_handler(struct lxc_handler *old, const char *name, | |
155 | struct lxc_conf *conf, const char *lxcpath, | |
156 | bool daemonize); | |
157 | __hidden extern void lxc_put_handler(struct lxc_handler *handler); | |
158 | __hidden extern int lxc_init(const char *name, struct lxc_handler *handler); | |
159 | __hidden extern void lxc_end(struct lxc_handler *handler); | |
1bc5cc8c | 160 | |
47a46cf1 CB |
161 | /* lxc_check_inherited: Check for any open file descriptors and close them if |
162 | * requested. | |
163 | * @param[in] conf The container's configuration. | |
164 | * @param[in] closeall Whether we should close all open file descriptors. | |
165 | * @param[in] fds_to_ignore Array of file descriptors to ignore. | |
166 | * @param[in] len_fds Length of fds_to_ignore array. | |
167 | */ | |
8c8cd087 CB |
168 | __hidden extern int lxc_check_inherited(struct lxc_conf *conf, bool closeall, int *fds_to_ignore, |
169 | size_t len_fds); | |
85c279bb CB |
170 | static inline int inherit_fds(struct lxc_handler *handler, bool closeall) |
171 | { | |
172 | return lxc_check_inherited(handler->conf, closeall, handler->keep_fds, | |
173 | ARRAY_SIZE(handler->keep_fds)); | |
174 | } | |
1bc5cc8c | 175 | |
8c8cd087 CB |
176 | __hidden extern int __lxc_start(struct lxc_handler *, struct lxc_operations *, void *, const char *, |
177 | bool, int *); | |
178 | ||
179 | __hidden extern int resolve_clone_flags(struct lxc_handler *handler); | |
8db6be1b | 180 | __hidden extern void lxc_expose_namespace_environment(const struct lxc_handler *handler); |
1bc5cc8c | 181 | |
937a3af9 CB |
182 | static inline bool container_uses_namespace(const struct lxc_handler *handler, |
183 | unsigned int ns_flag) | |
184 | { | |
185 | return (handler->ns_clone_flags & ns_flag); | |
186 | } | |
187 | ||
a529bc25 | 188 | #endif |