[mirror_lxc.git] / src / lxc / start.c

/*
 * lxc: linux Container library
 *
 * (C) Copyright IBM Corp. 2007, 2008
 *
 * Authors:
 * Daniel Lezcano <dlezcano at fr.ibm.com>
 *
 * This library is free software; you can redistribute it and/or
 * modify it under the terms of the GNU Lesser General Public
 * License as published by the Free Software Foundation; either
 * version 2.1 of the License, or (at your option) any later version.
 *
 * This library is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
 * Lesser General Public License for more details.
 *
 * You should have received a copy of the GNU Lesser General Public
 * License along with this library; if not, write to the Free Software
 * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
 */

#include "../config.h"
#include <stdio.h>
#undef _GNU_SOURCE
#include <string.h>
#include <stdlib.h>
#include <dirent.h>
#include <errno.h>
#include <unistd.h>
#include <signal.h>
#include <fcntl.h>
#include <termios.h>
#include <namespace.h>
#include <sys/param.h>
#include <sys/file.h>
#include <sys/mount.h>
#include <sys/types.h>
#include <sys/prctl.h>
#include <sys/types.h>
#include <sys/capability.h>
#include <sys/wait.h>
#include <sys/un.h>
#include <sys/poll.h>

#ifdef HAVE_SYS_SIGNALFD_H 
#  include <sys/signalfd.h>
#else
#  ifndef __NR_signalfd4
/* assume kernel headers are too old */
#    if __i386__
#      define __NR_signalfd4 327
#    elif __x86_64__
#      define __NR_signalfd4 289
#    elif __powerpc__
#      define __NR_signalfd4 313
#    elif __s390x__
#      define __NR_signalfd4 322
#    endif
#endif

#  ifndef __NR_signalfd
/* assume kernel headers are too old */
#    if __i386__
#      define __NR_signalfd 321
#    elif __x86_64__
#      define __NR_signalfd 282
#    elif __powerpc__
#      define __NR_signalfd 305
#    elif __s390x__
#      define __NR_signalfd 316
#    endif
#endif

int signalfd(int fd, const sigset_t *mask, int flags)
{
	int retval;

	retval = syscall (__NR_signalfd4, fd, mask, _NSIG / 8, flags);
	if (errno == ENOSYS && flags == 0)
		retval = syscall (__NR_signalfd, fd, mask, _NSIG / 8);
	return retval;
}
#endif

#if !HAVE_DECL_PR_CAPBSET_DROP
#define PR_CAPBSET_DROP 24
#endif

#include "error.h"
#include "af_unix.h"
#include "mainloop.h"

#include <lxc/lxc.h>
#include <lxc/log.h>

lxc_log_define(lxc_start, lxc);

LXC_TTY_HANDLER(SIGINT);
LXC_TTY_HANDLER(SIGQUIT);

static int setup_sigchld_fd(sigset_t *oldmask)
{
	sigset_t mask;
	int fd;

	if (sigprocmask(SIG_BLOCK, NULL, &mask)) {
		SYSERROR("failed to get mask signal");
		return -1;
	}

	if (sigaddset(&mask, SIGCHLD) || sigprocmask(SIG_BLOCK, &mask, oldmask)) {
		SYSERROR("failed to set mask signal");
		return -1;
	}

	fd = signalfd(-1, &mask, 0);
	if (fd < 0) {
		SYSERROR("failed to create the signal fd");
		return -1;
	}

	if (fcntl(fd, F_SETFD, FD_CLOEXEC)) {
		SYSERROR("failed to set sigfd to close-on-exec");
		close(fd);
		return -1;
	}

	DEBUG("sigchild handler set");

	return fd;
}

static int ttyservice_handler(int fd, void *data,
			      struct lxc_epoll_descr *descr);

static int tty_mainloop_add(const char *name, struct lxc_epoll_descr *descr,
			     struct lxc_handler *handler)
{
	int ret, fd;
	struct sockaddr_un addr = { 0 };
	char *offset = &addr.sun_path[1];

	strcpy(offset, name);
	addr.sun_path[0] = '\0';

	fd = lxc_af_unix_open(addr.sun_path, SOCK_STREAM, 0);
	if (fd < 0) {
		ERROR("failed to create the tty service point");
		return -1;
	}

	if (fcntl(fd, F_SETFD, FD_CLOEXEC)) {
		SYSERROR("failed to close-on-exec flag");
		close(fd);
		return -1;
	}

	ret = lxc_mainloop_add_handler(descr, fd, ttyservice_handler,
					handler);
	if (ret) {
		ERROR("failed to add handler for command socket");
		close(fd);
	}

	return ret;
}

static int sigchld_handler(int fd, void *data, 
			   struct lxc_epoll_descr *descr)
{
	DEBUG("child exited");

	return 1;
}

static void ttyinfo_remove_fd(int fd, struct lxc_tty_info *tty_info)
{
	int i;

	for (i = 0; i < tty_info->nbtty; i++) {

		if (tty_info->pty_info[i].busy != fd)
			continue;

		tty_info->pty_info[i].busy = 0;
	}

	return;
}

static void command_fd_cleanup(int fd, struct lxc_tty_info *tty_info,
			struct lxc_epoll_descr *descr)
{
	ttyinfo_remove_fd(fd, tty_info);
	lxc_mainloop_del_handler(descr, fd);
	close(fd);
}

static int ttyclient_handler(int fd, void *data,
			     struct lxc_epoll_descr *descr)
{
	struct lxc_tty_info *tty_info = data;

	command_fd_cleanup(fd, tty_info, descr);
}

static int ttyservice_handler(int fd, void *data,
			      struct lxc_epoll_descr *descr)
{
	int conn, ttynum, val = 1, ret = -1;
	struct lxc_handler *handler = data;
	struct lxc_tty_info *tty_info = &handler->tty_info;
	
	conn = accept(fd, NULL, 0);
	if (conn < 0) {
		SYSERROR("failed to accept tty client");
		return -1;
	}
	
	if (setsockopt(conn, SOL_SOCKET, SO_PASSCRED, &val, sizeof(val))) {
		SYSERROR("failed to enable credential on socket");
		goto out_close;
	}

	ret = lxc_af_unix_rcv_credential(conn, &ttynum, sizeof(ttynum));
	if (ret < 0) {
		SYSERROR("failed to receive data on tty socket");
		goto out_close;
	}

	if (!ret) {
		DEBUG("peer has disconnected");
		goto out_close;
	}

	if (ret != sizeof(ttynum)) {
		WARN("partial request, ignored");
		goto out_close;
	}

	if (ttynum > 0) {
		if (ttynum > tty_info->nbtty)
			goto out_close;

		if (tty_info->pty_info[ttynum - 1].busy)
			goto out_close;

		goto out_send;
	}

	/* fixup index tty1 => [0] */
	for (ttynum = 1;
	     ttynum <= tty_info->nbtty && tty_info->pty_info[ttynum - 1].busy;
	     ttynum++);

	/* we didn't find any available slot for tty */
	if (ttynum > tty_info->nbtty)
		goto out_close;

out_send:
	if (lxc_af_unix_send_fd(conn, tty_info->pty_info[ttynum - 1].master,
				&ttynum, sizeof(ttynum)) < 0) {
		ERROR("failed to send tty to client");
		goto out_close;
	}

	if (lxc_mainloop_add_handler(descr, conn,
				     ttyclient_handler, tty_info)) {
		ERROR("failed to add tty client handler");
		goto out_close;
	}

	tty_info->pty_info[ttynum - 1].busy = conn;

	ret = 0;
out:
	return ret;
out_close:
	close(conn);
	goto out;
}

int lxc_poll(const char *name, struct lxc_handler *handler)
{
	int sigfd = handler->sigfd;
	int pid = handler->pid;
	const struct lxc_tty_info *tty_info = &handler->tty_info;

	int nfds, ret = -1;
	struct lxc_epoll_descr descr;

	/* sigfd + nb tty + tty service 
	 * if tty is enabled */
	nfds = tty_info->nbtty + 1 + tty_info->nbtty ? 1 : 0;

	if (lxc_mainloop_open(nfds, &descr)) {
		ERROR("failed to create mainloop");
		goto out_sigfd;
	}

	if (lxc_mainloop_add_handler(&descr, sigfd, sigchld_handler, &pid)) {
		ERROR("failed to add handler for the signal");
		goto out_mainloop_open;
	}

	if (tty_info->nbtty) {
		if (tty_mainloop_add(name, &descr, handler))
			goto out_mainloop_open;
	}

	ret = lxc_mainloop(&descr);

out:
	return ret;

out_mainloop_open:
	lxc_mainloop_close(&descr);
out_sigfd:
	close(sigfd);
	goto out;
}

static int save_init_pid(const char *name, pid_t pid)
{
	char init[MAXPATHLEN];
	char *val;
	int fd, err = -1;

	snprintf(init, MAXPATHLEN, LXCPATH "/%s/init", name);

	if (!asprintf(&val, "%d\n", pid)) {
		SYSERROR("failed to allocate memory");
		goto out;
	}

	fd = open(init, O_WRONLY|O_CREAT|O_TRUNC, S_IRUSR|S_IWUSR);
	if (fd < 0) {
		SYSERROR("failed to open '%s'", init);
		goto out_free;
	}

	if (write(fd, val, strlen(val)) < 0) {
		SYSERROR("failed to write the init pid");
		goto out_close;
	}

	err = 0;

out_close:
	close(fd);
out_free:
	free(val);
out:
	return err;
}

static void remove_init_pid(const char *name, pid_t pid)
{
	char init[MAXPATHLEN];

	snprintf(init, MAXPATHLEN, LXCPATH "/%s/init", name);
	unlink(init);
}

static int fdname(int fd, char *name, size_t size)
{
	char path[MAXPATHLEN];
	ssize_t len;

	snprintf(path, MAXPATHLEN, "/proc/self/fd/%d", fd);

	len = readlink(path, name, size);
	if (len >  0)
		path[len] = '\0';

	return (len <= 0) ? -1 : 0;
}

static int console_init(char *console, size_t size)
{
	struct stat stat;
	int i;

	for (i = 0; i < 3; i++) {
		if (!isatty(i))
			continue;

		if (ttyname_r(i, console, size)) {
			SYSERROR("failed to retrieve tty name");
			return -1;
		}

		return 0;
	}

	if (!fstat(0, &stat)) {
		if (S_ISREG(stat.st_mode) || S_ISCHR(stat.st_mode) ||
		    S_ISFIFO(stat.st_mode) || S_ISLNK(stat.st_mode))
			return fdname(0, console, size);
	}

	console[0] = '\0';

	DEBUG("console initialized");

	return 0;
}

struct lxc_handler *lxc_init(const char *name)
{
	struct lxc_handler *handler;

	handler = malloc(sizeof(*handler));
	if (!handler)
		return NULL;

	memset(handler, 0, sizeof(*handler));

	handler->lock = lxc_get_lock(name);
	if (handler->lock < 0)
		goto out_free;

	/* Begin the set the state to STARTING*/
	if (lxc_setstate(name, STARTING)) {
		ERROR("failed to set state '%s'", lxc_state2str(STARTING));
		goto out_put_lock;
	}

	if (console_init(handler->tty, sizeof(handler->tty))) {
		ERROR("failed to initialize the console");
		goto out_aborting;
	}

	if (lxc_create_tty(name, &handler->tty_info)) {
		ERROR("failed to create the ttys");
		goto out_aborting;
	}

	/* the signal fd has to be created before forking otherwise
	 * if the child process exits before we setup the signal fd,
	 * the event will be lost and the command will be stuck */
	handler->sigfd = setup_sigchld_fd(&handler->oldmask);
	if (handler->sigfd < 0) {
		ERROR("failed to set sigchild fd handler");
		goto out_delete_tty;
	}

	/* Avoid signals from terminal */
	LXC_TTY_ADD_HANDLER(SIGINT);
	LXC_TTY_ADD_HANDLER(SIGQUIT);

out:
	if (handler)
		INFO("'%s' is initialized", name);

	return handler;

out_delete_tty:
	lxc_delete_tty(&handler->tty_info);
out_aborting:
	lxc_setstate(name, ABORTING);
out_put_lock:
	lxc_put_lock(handler->lock);
out_free:
	free(handler);
	handler = NULL;
	goto out;
}

void lxc_fini(const char *name, struct lxc_handler *handler)
{
	/* The STOPPING state is there for future cleanup code
	 * which can take awhile
	 */
	lxc_setstate(name, STOPPING);
	lxc_setstate(name, STOPPED);
	lxc_unlink_nsgroup(name);

	if (handler) {
		remove_init_pid(name, handler->pid);
		lxc_delete_tty(&handler->tty_info);
		lxc_put_lock(handler->lock);
		free(handler);
	}

	LXC_TTY_DEL_HANDLER(SIGQUIT);
	LXC_TTY_DEL_HANDLER(SIGINT);
}

void lxc_abort(const char *name, struct lxc_handler *handler)
{
	lxc_setstate(name, ABORTING);
	kill(handler->pid, SIGKILL);
}

struct start_arg {
	const char *name;
	char *const *argv;
	struct lxc_handler *handler;
	int *sv;
};

static int do_start(void *arg)
{
	struct start_arg *start_arg = arg;
	struct lxc_handler *handler = start_arg->handler;
	const char *name = start_arg->name;
	char *const *argv = start_arg->argv;
	int *sv = start_arg->sv;
	int err = -1, sync;

	if (sigprocmask(SIG_SETMASK, &handler->oldmask, NULL)) {
		SYSERROR("failed to set sigprocmask");
		goto out_child;
	}

	close(sv[1]);

	/* Be sure we don't inherit this after the exec */
	fcntl(sv[0], F_SETFD, FD_CLOEXEC);

	/* Tell our father he can begin to configure the container */
	if (write(sv[0], &sync, sizeof(sync)) < 0) {
		SYSERROR("failed to write socket");
		goto out_child;
	}

	/* Wait for the father to finish the configuration */
	if (read(sv[0], &sync, sizeof(sync)) < 0) {
		SYSERROR("failed to read socket");
		goto out_child;
	}

	/* Setup the container, ip, names, utsname, ... */
	if (lxc_setup(name, handler->tty, &handler->tty_info)) {
		ERROR("failed to setup the container");
		goto out_warn_father;
	}

	if (prctl(PR_CAPBSET_DROP, CAP_SYS_BOOT, 0, 0, 0)) {
		SYSERROR("failed to remove CAP_SYS_BOOT capability");
		goto out_child;
	}

	NOTICE("exec'ing '%s'", argv[0]);

	execvp(argv[0], argv);
	SYSERROR("failed to exec %s", argv[0]);

out_warn_father:
	/* If the exec fails, tell that to our father */
	if (write(sv[0], &err, sizeof(err)) < 0)
		SYSERROR("failed to write the socket");
out_child:
	return -1;
}

int lxc_spawn(const char *name, struct lxc_handler *handler, char *const argv[])
{
	int sv[2];
	int clone_flags;
	int err = -1, sync;

	struct start_arg start_arg = {
		.name = name,
		.argv = argv,
		.handler = handler,
		.sv = sv,
	};

	/* Synchro socketpair */
	if (socketpair(AF_LOCAL, SOCK_STREAM, 0, sv)) {
		SYSERROR("failed to create communication socketpair");
		goto out;
	}

	clone_flags = CLONE_NEWUTS|CLONE_NEWPID|CLONE_NEWIPC|CLONE_NEWNS;
	if (conf_has_network(name))
		clone_flags |= CLONE_NEWNET;

	/* Create a process in a new set of namespaces */
	handler->pid = lxc_clone(do_start, &start_arg, clone_flags);
	if (handler->pid < 0) {
		SYSERROR("failed to fork into a new namespace");
		goto out_close;
	}

	close(sv[0]);
	
	/* Wait for the child to be ready */
	if (read(sv[1], &sync, sizeof(sync)) < 0) {
		SYSERROR("failed to read the socket");
		goto out_abort;
	}

	if (lxc_rename_nsgroup(name, handler->pid) || lxc_link_nsgroup(name))
		goto out_abort;

	/* Create the network configuration */
	if (clone_flags & CLONE_NEWNET &&
	    conf_create_network(name, handler->pid)) {
		ERROR("failed to create the configured network");
		goto out_abort;
	}

	/* Tell the child to continue its initialization */
	if (write(sv[1], &sync, sizeof(sync)) < 0) {
		SYSERROR("failed to write the socket");
		goto out_abort;
	}

	/* Wait for the child to exec or returning an error */
	if (read(sv[1], &sync, sizeof(sync)) < 0) {
		ERROR("failed to read the socket");
		goto out_abort;
	}

	if (save_init_pid(name, handler->pid)) {
		ERROR("failed to save the init pid info");
		goto out_abort;
	}

	if (lxc_setstate(name, RUNNING)) {
		ERROR("failed to set state to %s",
			      lxc_state2str(RUNNING));
		goto out_abort;
	}

	err = 0;

	NOTICE("'%s' started with pid '%d'", argv[0], handler->pid);

out_close:
	close(sv[0]);
	close(sv[1]);
out:
	return err;

out_abort:
	lxc_abort(name, handler);
	goto out_close;
}

int lxc_start(const char *name, char *const argv[])
{
	struct lxc_handler *handler;
	int err = -1;
	int status;

	handler = lxc_init(name);
	if (!handler) {
		ERROR("failed to initialize the container");
		goto out;
	}

	err = lxc_spawn(name, handler, argv);
	if (err) {
		ERROR("failed to spawn '%s'", argv[0]);
		goto out;
	}

	err = lxc_close_all_inherited_fd();
	if (err) {
		ERROR("unable to close inherited fds");
		goto out_abort;
	}

	err = lxc_poll(name, handler);
	if (err) {
		ERROR("mainloop exited with an error");
		goto out_abort;
	}

	while (waitpid(handler->pid, &status, 0) < 0 && errno == EINTR)
		continue;

	err =  lxc_error_set_and_log(handler->pid, status);
out:
	lxc_fini(name, handler);
	return err;

out_abort:
	lxc_abort(name, handler);
	goto out;
}
Commit	Line	Data
	1	/*
	2	* lxc: linux Container library
	3	*
	4	* (C) Copyright IBM Corp. 2007, 2008
	5	*
	6	* Authors:
	7	* Daniel Lezcano <dlezcano at fr.ibm.com>
	8	*
	9	* This library is free software; you can redistribute it and/or
	10	* modify it under the terms of the GNU Lesser General Public
	11	* License as published by the Free Software Foundation; either
	12	* version 2.1 of the License, or (at your option) any later version.
	13	*
	14	* This library is distributed in the hope that it will be useful,
	15	* but WITHOUT ANY WARRANTY; without even the implied warranty of
	16	* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
	17	* Lesser General Public License for more details.
	18	*
	19	* You should have received a copy of the GNU Lesser General Public
	20	* License along with this library; if not, write to the Free Software
	21	* Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
	22	*/
	23
	24	#include "../config.h"
	25	#include <stdio.h>
	26	#undef _GNU_SOURCE
	27	#include <string.h>
	28	#include <stdlib.h>
	29	#include <dirent.h>
	30	#include <errno.h>
	31	#include <unistd.h>
	32	#include <signal.h>
	33	#include <fcntl.h>
	34	#include <termios.h>
	35	#include <namespace.h>
	36	#include <sys/param.h>
	37	#include <sys/file.h>
	38	#include <sys/mount.h>
	39	#include <sys/types.h>
	40	#include <sys/prctl.h>
	41	#include <sys/types.h>
	42	#include <sys/capability.h>
	43	#include <sys/wait.h>
	44	#include <sys/un.h>
	45	#include <sys/poll.h>
	46
	47	#ifdef HAVE_SYS_SIGNALFD_H
	48	# include <sys/signalfd.h>
	49	#else
	50	# ifndef __NR_signalfd4
	51	/* assume kernel headers are too old */
	52	# if __i386__
	53	# define __NR_signalfd4 327
	54	# elif __x86_64__
	55	# define __NR_signalfd4 289
	56	# elif __powerpc__
	57	# define __NR_signalfd4 313
	58	# elif __s390x__
	59	# define __NR_signalfd4 322
	60	# endif
	61	#endif
	62
	63	# ifndef __NR_signalfd
	64	/* assume kernel headers are too old */
	65	# if __i386__
	66	# define __NR_signalfd 321
	67	# elif __x86_64__
	68	# define __NR_signalfd 282
	69	# elif __powerpc__
	70	# define __NR_signalfd 305
	71	# elif __s390x__
	72	# define __NR_signalfd 316
	73	# endif
	74	#endif
	75
	76	int signalfd(int fd, const sigset_t *mask, int flags)
	77	{
	78	int retval;
	79
	80	retval = syscall (__NR_signalfd4, fd, mask, _NSIG / 8, flags);
	81	if (errno == ENOSYS && flags == 0)
	82	retval = syscall (__NR_signalfd, fd, mask, _NSIG / 8);
	83	return retval;
	84	}
	85	#endif
	86
	87	#if !HAVE_DECL_PR_CAPBSET_DROP
	88	#define PR_CAPBSET_DROP 24
	89	#endif
	90
	91	#include "error.h"
	92	#include "af_unix.h"
	93	#include "mainloop.h"
	94
	95	#include <lxc/lxc.h>
	96	#include <lxc/log.h>
	97
	98	lxc_log_define(lxc_start, lxc);
	99
	100	LXC_TTY_HANDLER(SIGINT);
	101	LXC_TTY_HANDLER(SIGQUIT);
	102
	103	static int setup_sigchld_fd(sigset_t *oldmask)
	104	{
	105	sigset_t mask;
	106	int fd;
	107
	108	if (sigprocmask(SIG_BLOCK, NULL, &mask)) {
	109	SYSERROR("failed to get mask signal");
	110	return -1;
	111	}
	112
	113	if (sigaddset(&mask, SIGCHLD) \|\| sigprocmask(SIG_BLOCK, &mask, oldmask)) {
	114	SYSERROR("failed to set mask signal");
	115	return -1;
	116	}
	117
	118	fd = signalfd(-1, &mask, 0);
	119	if (fd < 0) {
	120	SYSERROR("failed to create the signal fd");
	121	return -1;
	122	}
	123
	124	if (fcntl(fd, F_SETFD, FD_CLOEXEC)) {
	125	SYSERROR("failed to set sigfd to close-on-exec");
	126	close(fd);
	127	return -1;
	128	}
	129
	130	DEBUG("sigchild handler set");
	131
	132	return fd;
	133	}
	134
	135	static int ttyservice_handler(int fd, void *data,
	136	struct lxc_epoll_descr *descr);
	137
	138	static int tty_mainloop_add(const char name, struct lxc_epoll_descr descr,
	139	struct lxc_handler *handler)
	140	{
	141	int ret, fd;
	142	struct sockaddr_un addr = { 0 };
	143	char *offset = &addr.sun_path[1];
	144
	145	strcpy(offset, name);
	146	addr.sun_path[0] = '\0';
	147
	148	fd = lxc_af_unix_open(addr.sun_path, SOCK_STREAM, 0);
	149	if (fd < 0) {
	150	ERROR("failed to create the tty service point");
	151	return -1;
	152	}
	153
	154	if (fcntl(fd, F_SETFD, FD_CLOEXEC)) {
	155	SYSERROR("failed to close-on-exec flag");
	156	close(fd);
	157	return -1;
	158	}
	159
	160	ret = lxc_mainloop_add_handler(descr, fd, ttyservice_handler,
	161	handler);
	162	if (ret) {
	163	ERROR("failed to add handler for command socket");
	164	close(fd);
	165	}
	166
	167	return ret;
	168	}
	169
	170	static int sigchld_handler(int fd, void *data,
	171	struct lxc_epoll_descr *descr)
	172	{
	173	DEBUG("child exited");
	174
	175	return 1;
	176	}
	177
	178	static void ttyinfo_remove_fd(int fd, struct lxc_tty_info *tty_info)
	179	{
	180	int i;
	181
	182	for (i = 0; i < tty_info->nbtty; i++) {
	183
	184	if (tty_info->pty_info[i].busy != fd)
	185	continue;
	186
	187	tty_info->pty_info[i].busy = 0;
	188	}
	189
	190	return;
	191	}
	192
	193	static void command_fd_cleanup(int fd, struct lxc_tty_info *tty_info,
	194	struct lxc_epoll_descr *descr)
	195	{
	196	ttyinfo_remove_fd(fd, tty_info);
	197	lxc_mainloop_del_handler(descr, fd);
	198	close(fd);
	199	}
	200
	201	static int ttyclient_handler(int fd, void *data,
	202	struct lxc_epoll_descr *descr)
	203	{
	204	struct lxc_tty_info *tty_info = data;
	205
	206	command_fd_cleanup(fd, tty_info, descr);
	207	}
	208
	209	static int ttyservice_handler(int fd, void *data,
	210	struct lxc_epoll_descr *descr)
	211	{
	212	int conn, ttynum, val = 1, ret = -1;
	213	struct lxc_handler *handler = data;
	214	struct lxc_tty_info *tty_info = &handler->tty_info;
	215
	216	conn = accept(fd, NULL, 0);
	217	if (conn < 0) {
	218	SYSERROR("failed to accept tty client");
	219	return -1;
	220	}
	221
	222	if (setsockopt(conn, SOL_SOCKET, SO_PASSCRED, &val, sizeof(val))) {
	223	SYSERROR("failed to enable credential on socket");
	224	goto out_close;
	225	}
	226
	227	ret = lxc_af_unix_rcv_credential(conn, &ttynum, sizeof(ttynum));
	228	if (ret < 0) {
	229	SYSERROR("failed to receive data on tty socket");
	230	goto out_close;
	231	}
	232
	233	if (!ret) {
	234	DEBUG("peer has disconnected");
	235	goto out_close;
	236	}
	237
	238	if (ret != sizeof(ttynum)) {
	239	WARN("partial request, ignored");
	240	goto out_close;
	241	}
	242
	243	if (ttynum > 0) {
	244	if (ttynum > tty_info->nbtty)
	245	goto out_close;
	246
	247	if (tty_info->pty_info[ttynum - 1].busy)
	248	goto out_close;
	249
	250	goto out_send;
	251	}
	252
	253	/* fixup index tty1 => [0] */
	254	for (ttynum = 1;
	255	ttynum <= tty_info->nbtty && tty_info->pty_info[ttynum - 1].busy;
	256	ttynum++);
	257
	258	/* we didn't find any available slot for tty */
	259	if (ttynum > tty_info->nbtty)
	260	goto out_close;
	261
	262	out_send:
	263	if (lxc_af_unix_send_fd(conn, tty_info->pty_info[ttynum - 1].master,
	264	&ttynum, sizeof(ttynum)) < 0) {
	265	ERROR("failed to send tty to client");
	266	goto out_close;
	267	}
	268
	269	if (lxc_mainloop_add_handler(descr, conn,
	270	ttyclient_handler, tty_info)) {
	271	ERROR("failed to add tty client handler");
	272	goto out_close;
	273	}
	274
	275	tty_info->pty_info[ttynum - 1].busy = conn;
	276
	277	ret = 0;
	278	out:
	279	return ret;
	280	out_close:
	281	close(conn);
	282	goto out;
	283	}
	284
	285	int lxc_poll(const char name, struct lxc_handler handler)
	286	{
	287	int sigfd = handler->sigfd;
	288	int pid = handler->pid;
	289	const struct lxc_tty_info *tty_info = &handler->tty_info;
	290
	291	int nfds, ret = -1;
	292	struct lxc_epoll_descr descr;
	293
	294	/* sigfd + nb tty + tty service
	295	* if tty is enabled */
	296	nfds = tty_info->nbtty + 1 + tty_info->nbtty ? 1 : 0;
	297
	298	if (lxc_mainloop_open(nfds, &descr)) {
	299	ERROR("failed to create mainloop");
	300	goto out_sigfd;
	301	}
	302
	303	if (lxc_mainloop_add_handler(&descr, sigfd, sigchld_handler, &pid)) {
	304	ERROR("failed to add handler for the signal");
	305	goto out_mainloop_open;
	306	}
	307
	308	if (tty_info->nbtty) {
	309	if (tty_mainloop_add(name, &descr, handler))
	310	goto out_mainloop_open;
	311	}
	312
	313	ret = lxc_mainloop(&descr);
	314
	315	out:
	316	return ret;
	317
	318	out_mainloop_open:
	319	lxc_mainloop_close(&descr);
	320	out_sigfd:
	321	close(sigfd);
	322	goto out;
	323	}
	324
	325	static int save_init_pid(const char *name, pid_t pid)
	326	{
	327	char init[MAXPATHLEN];
	328	char *val;
	329	int fd, err = -1;
	330
	331	snprintf(init, MAXPATHLEN, LXCPATH "/%s/init", name);
	332
	333	if (!asprintf(&val, "%d\n", pid)) {
	334	SYSERROR("failed to allocate memory");
	335	goto out;
	336	}
	337
	338	fd = open(init, O_WRONLY\|O_CREAT\|O_TRUNC, S_IRUSR\|S_IWUSR);
	339	if (fd < 0) {
	340	SYSERROR("failed to open '%s'", init);
	341	goto out_free;
	342	}
	343
	344	if (write(fd, val, strlen(val)) < 0) {
	345	SYSERROR("failed to write the init pid");
	346	goto out_close;
	347	}
	348
	349	err = 0;
	350
	351	out_close:
	352	close(fd);
	353	out_free:
	354	free(val);
	355	out:
	356	return err;
	357	}
	358
	359	static void remove_init_pid(const char *name, pid_t pid)
	360	{
	361	char init[MAXPATHLEN];
	362
	363	snprintf(init, MAXPATHLEN, LXCPATH "/%s/init", name);
	364	unlink(init);
	365	}
	366
	367	static int fdname(int fd, char *name, size_t size)
	368	{
	369	char path[MAXPATHLEN];
	370	ssize_t len;
	371
	372	snprintf(path, MAXPATHLEN, "/proc/self/fd/%d", fd);
	373
	374	len = readlink(path, name, size);
	375	if (len > 0)
	376	path[len] = '\0';
	377
	378	return (len <= 0) ? -1 : 0;
	379	}
	380
	381	static int console_init(char *console, size_t size)
	382	{
	383	struct stat stat;
	384	int i;
	385
	386	for (i = 0; i < 3; i++) {
	387	if (!isatty(i))
	388	continue;
	389
	390	if (ttyname_r(i, console, size)) {
	391	SYSERROR("failed to retrieve tty name");
	392	return -1;
	393	}
	394
	395	return 0;
	396	}
	397
	398	if (!fstat(0, &stat)) {
	399	if (S_ISREG(stat.st_mode) \|\| S_ISCHR(stat.st_mode) \|\|
	400	S_ISFIFO(stat.st_mode) \|\| S_ISLNK(stat.st_mode))
	401	return fdname(0, console, size);
	402	}
	403
	404	console[0] = '\0';
	405
	406	DEBUG("console initialized");
	407
	408	return 0;
	409	}
	410
	411	struct lxc_handler lxc_init(const char name)
	412	{
	413	struct lxc_handler *handler;
	414
	415	handler = malloc(sizeof(*handler));
	416	if (!handler)
	417	return NULL;
	418
	419	memset(handler, 0, sizeof(*handler));
	420
	421	handler->lock = lxc_get_lock(name);
	422	if (handler->lock < 0)
	423	goto out_free;
	424
	425	/* Begin the set the state to STARTING*/
	426	if (lxc_setstate(name, STARTING)) {
	427	ERROR("failed to set state '%s'", lxc_state2str(STARTING));
	428	goto out_put_lock;
	429	}
	430
	431	if (console_init(handler->tty, sizeof(handler->tty))) {
	432	ERROR("failed to initialize the console");
	433	goto out_aborting;
	434	}
	435
	436	if (lxc_create_tty(name, &handler->tty_info)) {
	437	ERROR("failed to create the ttys");
	438	goto out_aborting;
	439	}
	440
	441	/* the signal fd has to be created before forking otherwise
	442	* if the child process exits before we setup the signal fd,
	443	* the event will be lost and the command will be stuck */
	444	handler->sigfd = setup_sigchld_fd(&handler->oldmask);
	445	if (handler->sigfd < 0) {
	446	ERROR("failed to set sigchild fd handler");
	447	goto out_delete_tty;
	448	}
	449
	450	/* Avoid signals from terminal */
	451	LXC_TTY_ADD_HANDLER(SIGINT);
	452	LXC_TTY_ADD_HANDLER(SIGQUIT);
	453
	454	out:
	455	if (handler)
	456	INFO("'%s' is initialized", name);
	457
	458	return handler;
	459
	460	out_delete_tty:
	461	lxc_delete_tty(&handler->tty_info);
	462	out_aborting:
	463	lxc_setstate(name, ABORTING);
	464	out_put_lock:
	465	lxc_put_lock(handler->lock);
	466	out_free:
	467	free(handler);
	468	handler = NULL;
	469	goto out;
	470	}
	471
	472	void lxc_fini(const char name, struct lxc_handler handler)
	473	{
	474	/* The STOPPING state is there for future cleanup code
	475	* which can take awhile
	476	*/
	477	lxc_setstate(name, STOPPING);
	478	lxc_setstate(name, STOPPED);
	479	lxc_unlink_nsgroup(name);
	480
	481	if (handler) {
	482	remove_init_pid(name, handler->pid);
	483	lxc_delete_tty(&handler->tty_info);
	484	lxc_put_lock(handler->lock);
	485	free(handler);
	486	}
	487
	488	LXC_TTY_DEL_HANDLER(SIGQUIT);
	489	LXC_TTY_DEL_HANDLER(SIGINT);
	490	}
	491
	492	void lxc_abort(const char name, struct lxc_handler handler)
	493	{
	494	lxc_setstate(name, ABORTING);
	495	kill(handler->pid, SIGKILL);
	496	}
	497
	498	struct start_arg {
	499	const char *name;
	500	char const argv;
	501	struct lxc_handler *handler;
	502	int *sv;
	503	};
	504
	505	static int do_start(void *arg)
	506	{
	507	struct start_arg *start_arg = arg;
	508	struct lxc_handler *handler = start_arg->handler;
	509	const char *name = start_arg->name;
	510	char const argv = start_arg->argv;
	511	int *sv = start_arg->sv;
	512	int err = -1, sync;
	513
	514	if (sigprocmask(SIG_SETMASK, &handler->oldmask, NULL)) {
	515	SYSERROR("failed to set sigprocmask");
	516	goto out_child;
	517	}
	518
	519	close(sv[1]);
	520
	521	/* Be sure we don't inherit this after the exec */
	522	fcntl(sv[0], F_SETFD, FD_CLOEXEC);
	523
	524	/* Tell our father he can begin to configure the container */
	525	if (write(sv[0], &sync, sizeof(sync)) < 0) {
	526	SYSERROR("failed to write socket");
	527	goto out_child;
	528	}
	529
	530	/* Wait for the father to finish the configuration */
	531	if (read(sv[0], &sync, sizeof(sync)) < 0) {
	532	SYSERROR("failed to read socket");
	533	goto out_child;
	534	}
	535
	536	/* Setup the container, ip, names, utsname, ... */
	537	if (lxc_setup(name, handler->tty, &handler->tty_info)) {
	538	ERROR("failed to setup the container");
	539	goto out_warn_father;
	540	}
	541
	542	if (prctl(PR_CAPBSET_DROP, CAP_SYS_BOOT, 0, 0, 0)) {
	543	SYSERROR("failed to remove CAP_SYS_BOOT capability");
	544	goto out_child;
	545	}
	546
	547	NOTICE("exec'ing '%s'", argv[0]);
	548
	549	execvp(argv[0], argv);
	550	SYSERROR("failed to exec %s", argv[0]);
	551
	552	out_warn_father:
	553	/* If the exec fails, tell that to our father */
	554	if (write(sv[0], &err, sizeof(err)) < 0)
	555	SYSERROR("failed to write the socket");
	556	out_child:
	557	return -1;
	558	}
	559
	560	int lxc_spawn(const char name, struct lxc_handler handler, char *const argv[])
	561	{
	562	int sv[2];
	563	int clone_flags;
	564	int err = -1, sync;
	565
	566	struct start_arg start_arg = {
	567	.name = name,
	568	.argv = argv,
	569	.handler = handler,
	570	.sv = sv,
	571	};
	572
	573	/* Synchro socketpair */
	574	if (socketpair(AF_LOCAL, SOCK_STREAM, 0, sv)) {
	575	SYSERROR("failed to create communication socketpair");
	576	goto out;
	577	}
	578
	579	clone_flags = CLONE_NEWUTS\|CLONE_NEWPID\|CLONE_NEWIPC\|CLONE_NEWNS;
	580	if (conf_has_network(name))
	581	clone_flags \|= CLONE_NEWNET;
	582
	583	/* Create a process in a new set of namespaces */
	584	handler->pid = lxc_clone(do_start, &start_arg, clone_flags);
	585	if (handler->pid < 0) {
	586	SYSERROR("failed to fork into a new namespace");
	587	goto out_close;
	588	}
	589
	590	close(sv[0]);
	591
	592	/* Wait for the child to be ready */
	593	if (read(sv[1], &sync, sizeof(sync)) < 0) {
	594	SYSERROR("failed to read the socket");
	595	goto out_abort;
	596	}
	597
	598	if (lxc_rename_nsgroup(name, handler->pid) \|\| lxc_link_nsgroup(name))
	599	goto out_abort;
	600
	601	/* Create the network configuration */
	602	if (clone_flags & CLONE_NEWNET &&
	603	conf_create_network(name, handler->pid)) {
	604	ERROR("failed to create the configured network");
	605	goto out_abort;
	606	}
	607
	608	/* Tell the child to continue its initialization */
	609	if (write(sv[1], &sync, sizeof(sync)) < 0) {
	610	SYSERROR("failed to write the socket");
	611	goto out_abort;
	612	}
	613
	614	/* Wait for the child to exec or returning an error */
	615	if (read(sv[1], &sync, sizeof(sync)) < 0) {
	616	ERROR("failed to read the socket");
	617	goto out_abort;
	618	}
	619
	620	if (save_init_pid(name, handler->pid)) {
	621	ERROR("failed to save the init pid info");
	622	goto out_abort;
	623	}
	624
	625	if (lxc_setstate(name, RUNNING)) {
	626	ERROR("failed to set state to %s",
	627	lxc_state2str(RUNNING));
	628	goto out_abort;
	629	}
	630
	631	err = 0;
	632
	633	NOTICE("'%s' started with pid '%d'", argv[0], handler->pid);
	634
	635	out_close:
	636	close(sv[0]);
	637	close(sv[1]);
	638	out:
	639	return err;
	640
	641	out_abort:
	642	lxc_abort(name, handler);
	643	goto out_close;
	644	}
	645
	646	int lxc_start(const char name, char const argv[])
	647	{
	648	struct lxc_handler *handler;
	649	int err = -1;
	650	int status;
	651
	652	handler = lxc_init(name);
	653	if (!handler) {
	654	ERROR("failed to initialize the container");
	655	goto out;
	656	}
	657
	658	err = lxc_spawn(name, handler, argv);
	659	if (err) {
	660	ERROR("failed to spawn '%s'", argv[0]);
	661	goto out;
	662	}
	663
	664	err = lxc_close_all_inherited_fd();
	665	if (err) {
	666	ERROR("unable to close inherited fds");
	667	goto out_abort;
	668	}
	669
	670	err = lxc_poll(name, handler);
	671	if (err) {
	672	ERROR("mainloop exited with an error");
	673	goto out_abort;
	674	}
	675
	676	while (waitpid(handler->pid, &status, 0) < 0 && errno == EINTR)
	677	continue;
	678
	679	err = lxc_error_set_and_log(handler->pid, status);
	680	out:
	681	lxc_fini(name, handler);
	682	return err;
	683
	684	out_abort:
	685	lxc_abort(name, handler);
	686	goto out;
	687	}