2 * lxc: linux Container library
4 * (C) Copyright IBM Corp. 2007, 2008
7 * Daniel Lezcano <daniel.lezcano at free.fr>
9 * This library is free software; you can redistribute it and/or
10 * modify it under the terms of the GNU Lesser General Public
11 * License as published by the Free Software Foundation; either
12 * version 2.1 of the License, or (at your option) any later version.
14 * This library is distributed in the hope that it will be useful,
15 * but WITHOUT ANY WARRANTY; without even the implied warranty of
16 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
17 * Lesser General Public License for more details.
19 * You should have received a copy of the GNU Lesser General Public
20 * License along with this library; if not, write to the Free Software
21 * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
34 #include <linux/unistd.h>
35 #include <sys/mount.h>
36 #include <sys/param.h>
37 #include <sys/prctl.h>
38 #include <sys/socket.h>
39 #include <sys/syscall.h>
42 #include <lxc/lxccontainer.h>
44 #ifndef HAVE_DECL_PR_CAPBSET_DROP
45 #define PR_CAPBSET_DROP 24
48 #ifndef HAVE_DECL_PR_SET_NO_NEW_PRIVS
49 #define PR_SET_NO_NEW_PRIVS 38
52 #ifndef HAVE_DECL_PR_GET_NO_NEW_PRIVS
53 #define PR_GET_NO_NEW_PRIVS 39
67 #include "lxcseccomp.h"
68 #include "namespace.h"
71 #if HAVE_SYS_PERSONALITY_H
72 #include <sys/personality.h>
76 #define SOCK_CLOEXEC 02000000
84 #define MS_SLAVE (1 << 19)
87 lxc_log_define(lxc_attach
, lxc
);
89 /* /proc/pid-to-str/current\0 = (5 + 21 + 7 + 1) */
90 #define __LSMATTRLEN (5 + (LXC_NUMSTRLEN64) + 7 + 1)
91 static int lsm_open(pid_t pid
, int on_exec
)
94 char path
[__LSMATTRLEN
];
100 if (strcmp(name
, "nop") == 0)
103 if (strcmp(name
, "none") == 0)
106 /* We don't support on-exec with AppArmor */
107 if (strcmp(name
, "AppArmor") == 0)
111 ret
= snprintf(path
, __LSMATTRLEN
, "/proc/%d/attr/exec", pid
);
113 ret
= snprintf(path
, __LSMATTRLEN
, "/proc/%d/attr/current", pid
);
114 if (ret
< 0 || ret
>= __LSMATTRLEN
)
117 labelfd
= open(path
, O_RDWR
);
119 SYSERROR("%s - Unable to open file descriptor to set LSM label",
127 static int lsm_set_label_at(int lsm_labelfd
, int on_exec
, char *lsm_label
)
131 char *command
= NULL
;
135 if (strcmp(name
, "nop") == 0)
138 if (strcmp(name
, "none") == 0)
141 /* We don't support on-exec with AppArmor */
142 if (strcmp(name
, "AppArmor") == 0)
145 if (strcmp(name
, "AppArmor") == 0) {
149 malloc(strlen(lsm_label
) + strlen("changeprofile ") + 1);
151 SYSERROR("Failed to write apparmor profile.");
155 size
= sprintf(command
, "changeprofile %s", lsm_label
);
157 SYSERROR("Failed to write apparmor profile.");
161 if (write(lsm_labelfd
, command
, size
+ 1) < 0) {
162 SYSERROR("Unable to set LSM label: %s.", command
);
165 INFO("Set LSM label to: %s.", command
);
166 } else if (strcmp(name
, "SELinux") == 0) {
167 if (write(lsm_labelfd
, lsm_label
, strlen(lsm_label
) + 1) < 0) {
168 SYSERROR("Unable to set LSM label: %s.", lsm_label
);
171 INFO("Set LSM label to: %s.", lsm_label
);
173 ERROR("Unable to restore label for unknown LSM: %s.", name
);
181 if (lsm_labelfd
!= -1)
187 /* /proc/pid-to-str/status\0 = (5 + 21 + 7 + 1) */
188 #define __PROC_STATUS_LEN (5 + (LXC_NUMSTRLEN64) + 7 + 1)
189 static struct lxc_proc_context_info
*lxc_proc_get_context_info(pid_t pid
)
194 char proc_fn
[__PROC_STATUS_LEN
];
195 size_t line_bufsz
= 0;
197 struct lxc_proc_context_info
*info
= NULL
;
199 /* Read capabilities. */
200 ret
= snprintf(proc_fn
, __PROC_STATUS_LEN
, "/proc/%d/status", pid
);
201 if (ret
< 0 || ret
>= __PROC_STATUS_LEN
)
204 proc_file
= fopen(proc_fn
, "r");
206 SYSERROR("Could not open %s.", proc_fn
);
210 info
= calloc(1, sizeof(*info
));
212 SYSERROR("Could not allocate memory.");
218 while (getline(&line
, &line_bufsz
, proc_file
) != -1) {
219 ret
= sscanf(line
, "CapBnd: %llx", &info
->capability_mask
);
220 if (ret
!= EOF
&& ret
== 1) {
230 SYSERROR("Could not read capability bounding set from %s.",
236 info
->lsm_label
= lsm_process_label_get(pid
);
237 info
->ns_inherited
= 0;
238 memset(info
->ns_fd
, -1, sizeof(int) * LXC_NS_MAX
);
247 static inline void lxc_proc_close_ns_fd(struct lxc_proc_context_info
*ctx
)
251 for (i
= 0; i
< LXC_NS_MAX
; i
++) {
252 if (ctx
->ns_fd
[i
] < 0)
254 close(ctx
->ns_fd
[i
]);
255 ctx
->ns_fd
[i
] = -EBADF
;
259 static void lxc_proc_put_context_info(struct lxc_proc_context_info
*ctx
)
261 free(ctx
->lsm_label
);
263 lxc_container_put(ctx
->container
);
264 lxc_proc_close_ns_fd(ctx
);
269 * in_same_namespace - Check whether two processes are in the same namespace.
270 * @pid1 - PID of the first process.
271 * @pid2 - PID of the second process.
272 * @ns - Name of the namespace to check. Must correspond to one of the names
273 * for the namespaces as shown in /proc/<pid/ns/
275 * If the two processes are not in the same namespace returns an fd to the
276 * namespace of the second process identified by @pid2. If the two processes are
277 * in the same namespace returns -EINVAL, -1 if an error occurred.
279 static int in_same_namespace(pid_t pid1
, pid_t pid2
, const char *ns
)
281 int ns_fd1
= -1, ns_fd2
= -1, ret
= -1;
282 struct stat ns_st1
, ns_st2
;
284 ns_fd1
= lxc_preserve_ns(pid1
, ns
);
286 /* The kernel does not support this namespace. This is not an
295 ns_fd2
= lxc_preserve_ns(pid2
, ns
);
299 ret
= fstat(ns_fd1
, &ns_st1
);
303 ret
= fstat(ns_fd2
, &ns_st2
);
307 /* processes are in the same namespace */
309 if ((ns_st1
.st_dev
== ns_st2
.st_dev
) && (ns_st1
.st_ino
== ns_st2
.st_ino
))
312 /* processes are in different namespaces */
326 static int lxc_attach_to_ns(pid_t pid
, struct lxc_proc_context_info
*ctx
)
330 for (i
= 0; i
< LXC_NS_MAX
; i
++) {
331 if (ctx
->ns_fd
[i
] < 0)
334 ret
= setns(ctx
->ns_fd
[i
], ns_info
[i
].clone_flag
);
336 SYSERROR("Failed to attach to %s namespace of %d",
337 ns_info
[i
].proc_name
, pid
);
341 DEBUG("Attached to %s namespace of %d", ns_info
[i
].proc_name
, pid
);
347 static int lxc_attach_remount_sys_proc(void)
351 ret
= unshare(CLONE_NEWNS
);
353 SYSERROR("Failed to unshare mount namespace.");
357 if (detect_shared_rootfs()) {
358 if (mount(NULL
, "/", NULL
, MS_SLAVE
| MS_REC
, NULL
)) {
359 SYSERROR("Failed to make / rslave.");
360 ERROR("Continuing...");
364 /* Assume /proc is always mounted, so remount it. */
365 ret
= umount2("/proc", MNT_DETACH
);
367 SYSERROR("Failed to unmount /proc.");
371 ret
= mount("none", "/proc", "proc", 0, NULL
);
373 SYSERROR("Failed to remount /proc.");
377 /* Try to umount /sys. If it's not a mount point, we'll get EINVAL, then
378 * we ignore it because it may not have been mounted in the first place.
380 ret
= umount2("/sys", MNT_DETACH
);
381 if (ret
< 0 && errno
!= EINVAL
) {
382 SYSERROR("Failed to unmount /sys.");
384 } else if (ret
== 0) {
386 ret
= mount("none", "/sys", "sysfs", 0, NULL
);
388 SYSERROR("Failed to remount /sys.");
396 static int lxc_attach_drop_privs(struct lxc_proc_context_info
*ctx
)
400 last_cap
= lxc_caps_last_cap();
401 for (cap
= 0; cap
<= last_cap
; cap
++) {
402 if (ctx
->capability_mask
& (1LL << cap
))
405 if (prctl(PR_CAPBSET_DROP
, cap
, 0, 0, 0)) {
406 SYSERROR("Failed to drop capability %d", cap
);
409 TRACE("Dropped capability %d", cap
);
415 static int lxc_attach_set_environment(enum lxc_attach_env_policy_t policy
,
416 char **extra_env
, char **extra_keep
)
418 if (policy
== LXC_ATTACH_CLEAR_ENV
) {
420 char **extra_keep_store
= NULL
;
425 for (count
= 0; extra_keep
[count
]; count
++);
427 extra_keep_store
= calloc(count
, sizeof(char *));
428 if (!extra_keep_store
) {
429 SYSERROR("Failed to allocate memory for storing current "
430 "environment variable values that will be kept.");
433 for (i
= 0; i
< count
; i
++) {
434 char *v
= getenv(extra_keep
[i
]);
436 extra_keep_store
[i
] = strdup(v
);
437 if (!extra_keep_store
[i
]) {
438 SYSERROR("Failed to allocate memory for storing current "
439 "environment variable values that will be kept.");
441 free(extra_keep_store
[--i
]);
442 free(extra_keep_store
);
445 if (strcmp(extra_keep
[i
], "PATH") == 0)
448 /* Calloc sets entire array to zero, so we don't
457 SYSERROR("Failed to clear environment.");
458 if (extra_keep_store
) {
459 for (p
= extra_keep_store
; *p
; p
++)
461 free(extra_keep_store
);
466 if (extra_keep_store
) {
469 for (i
= 0; extra_keep
[i
]; i
++) {
470 if (extra_keep_store
[i
]) {
471 if (setenv(extra_keep
[i
], extra_keep_store
[i
], 1) < 0)
472 SYSERROR("Unable to set environment variable.");
474 free(extra_keep_store
[i
]);
476 free(extra_keep_store
);
479 /* Always set a default path; shells and execlp tend to be fine
480 * without it, but there is a disturbing number of C programs
481 * out there that just assume that getenv("PATH") is never NULL
482 * and then die a painful segfault death.
485 setenv("PATH", "/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", 1);
488 if (putenv("container=lxc")) {
489 SYSERROR("Failed to set environment variable.");
493 /* Set extra environment variables. */
495 for (; *extra_env
; extra_env
++) {
496 /* Duplicate the string, just to be on the safe side,
497 * because putenv does not do it for us.
499 char *p
= strdup(*extra_env
);
500 /* We just assume the user knows what they are doing, so
501 * we don't do any checks.
504 SYSERROR("Failed to allocate memory for additional environment "
515 static char *lxc_attach_getpwshell(uid_t uid
)
522 /* We need to fork off a process that runs the getent program, and we
523 * need to capture its output, so we use a pipe for that purpose.
540 size_t line_bufsz
= 0;
545 pipe_f
= fdopen(pipes
[0], "r");
546 while (getline(&line
, &line_bufsz
, pipe_f
) != -1) {
550 char *endptr
= NULL
, *saveptr
= NULL
;
552 /* If we already found something, just continue to read
553 * until the pipe doesn't deliver any more data, but
554 * don't modify the existing data structure.
559 /* Trim line on the right hand side. */
560 for (i
= strlen(line
); i
> 0 && (line
[i
- 1] == '\n' || line
[i
- 1] == '\r'); --i
)
563 /* Split into tokens: first: user name. */
564 token
= strtok_r(line
, ":", &saveptr
);
567 /* next: dummy password field */
568 token
= strtok_r(NULL
, ":", &saveptr
);
572 token
= strtok_r(NULL
, ":", &saveptr
);
573 value
= token
? strtol(token
, &endptr
, 10) : 0;
574 if (!token
|| !endptr
|| *endptr
|| value
== LONG_MIN
|| value
== LONG_MAX
)
576 /* dummy sanity check: user id matches */
577 if ((uid_t
) value
!= uid
)
579 /* skip fields: gid, gecos, dir, go to next field 'shell' */
580 for (i
= 0; i
< 4; i
++) {
581 token
= strtok_r(NULL
, ":", &saveptr
);
588 result
= strdup(token
);
590 /* Sanity check that there are no fields after that. */
591 token
= strtok_r(NULL
, ":", &saveptr
);
601 if (waitpid(pid
, &status
, 0) < 0) {
608 /* Some sanity checks. If anything even hinted at going wrong,
609 * we can't be sure we have a valid result, so we assume we
613 if (!WIFEXITED(status
)) {
618 if (WEXITSTATUS(status
) != 0) {
631 char *arguments
[] = {
640 /* We want to capture stdout. */
644 /* Get rid of stdin/stderr, so we try to associate it with
647 fd
= open("/dev/null", O_RDWR
);
657 /* Finish argument list. */
658 ret
= snprintf(uid_buf
, sizeof(uid_buf
), "%ld", (long) uid
);
662 /* Try to run getent program. */
663 (void) execvp("getent", arguments
);
668 static void lxc_attach_get_init_uidgid(uid_t
*init_uid
, gid_t
*init_gid
)
671 char proc_fn
[__PROC_STATUS_LEN
];
674 size_t line_bufsz
= 0;
676 uid_t uid
= (uid_t
)-1;
677 gid_t gid
= (gid_t
)-1;
679 /* Read capabilities. */
680 snprintf(proc_fn
, __PROC_STATUS_LEN
, "/proc/%d/status", 1);
682 proc_file
= fopen(proc_fn
, "r");
686 while (getline(&line
, &line_bufsz
, proc_file
) != -1) {
687 /* Format is: real, effective, saved set user, fs we only care
690 ret
= sscanf(line
, "Uid: %ld", &value
);
691 if (ret
!= EOF
&& ret
== 1) {
694 ret
= sscanf(line
, "Gid: %ld", &value
);
695 if (ret
!= EOF
&& ret
== 1)
698 if (uid
!= (uid_t
)-1 && gid
!= (gid_t
)-1)
705 /* Only override arguments if we found something. */
706 if (uid
!= (uid_t
)-1)
708 if (gid
!= (gid_t
)-1)
711 /* TODO: we should also parse supplementary groups and use
712 * setgroups() to set them.
716 struct attach_clone_payload
{
718 lxc_attach_options_t
*options
;
719 struct lxc_proc_context_info
*init_ctx
;
720 lxc_attach_exec_t exec_function
;
724 static int attach_child_main(void *data
);
726 /* Help the optimizer along if it doesn't know that exit always exits. */
734 /* Define default options if no options are supplied by the user. */
735 static lxc_attach_options_t attach_static_default_options
= LXC_ATTACH_OPTIONS_DEFAULT
;
737 static bool fetch_seccomp(struct lxc_container
*c
,
738 lxc_attach_options_t
*options
)
742 if (!(options
->namespaces
& CLONE_NEWNS
) ||
743 !(options
->attach_flags
& LXC_ATTACH_LSM
)) {
744 free(c
->lxc_conf
->seccomp
);
745 c
->lxc_conf
->seccomp
= NULL
;
749 /* Remove current setting. */
750 if (!c
->set_config_item(c
, "lxc.seccomp", "") &&
751 !c
->set_config_item(c
, "lxc.seccomp.profile", "")) {
755 /* Fetch the current profile path over the cmd interface. */
756 path
= c
->get_running_config_item(c
, "lxc.seccomp.profile");
758 INFO("Failed to get running config item for lxc.seccomp.profile");
759 path
= c
->get_running_config_item(c
, "lxc.seccomp");
762 INFO("Failed to get running config item for lxc.seccomp");
766 /* Copy the value into the new lxc_conf. */
767 if (!c
->set_config_item(c
, "lxc.seccomp.profile", path
)) {
773 /* Attempt to parse the resulting config. */
774 if (lxc_read_seccomp_config(c
->lxc_conf
) < 0) {
775 ERROR("Error reading seccomp policy.");
779 INFO("Retrieved seccomp policy.");
783 static bool no_new_privs(struct lxc_container
*c
, lxc_attach_options_t
*options
)
787 /* Remove current setting. */
788 if (!c
->set_config_item(c
, "lxc.no_new_privs", ""))
791 /* Retrieve currently active setting. */
792 val
= c
->get_running_config_item(c
, "lxc.no_new_privs");
794 INFO("Failed to get running config item for lxc.no_new_privs.");
798 /* Set currently active setting. */
799 if (!c
->set_config_item(c
, "lxc.no_new_privs", val
)) {
808 static signed long get_personality(const char *name
, const char *lxcpath
)
813 p
= lxc_cmd_get_config_item(name
, "lxc.arch", lxcpath
);
817 ret
= lxc_config_parse_arch(p
);
823 int lxc_attach(const char *name
, const char *lxcpath
,
824 lxc_attach_exec_t exec_function
, void *exec_payload
,
825 lxc_attach_options_t
*options
, pid_t
*attached_process
)
830 signed long personality
;
831 pid_t attached_pid
, expected
, init_pid
, pid
;
832 struct lxc_proc_context_info
*init_ctx
;
834 ret
= access("/proc/self/ns", X_OK
);
836 ERROR("Does this kernel version support namespaces?");
841 options
= &attach_static_default_options
;
843 init_pid
= lxc_cmd_get_init_pid(name
, lxcpath
);
845 ERROR("Failed to get init pid.");
849 init_ctx
= lxc_proc_get_context_info(init_pid
);
851 ERROR("Failed to get context of init process: %ld", (long)init_pid
);
855 personality
= get_personality(name
, lxcpath
);
856 if (init_ctx
->personality
< 0) {
857 ERROR("Failed to get personality of the container");
858 lxc_proc_put_context_info(init_ctx
);
861 init_ctx
->personality
= personality
;
863 init_ctx
->container
= lxc_container_new(name
, lxcpath
);
864 if (!init_ctx
->container
) {
865 lxc_proc_put_context_info(init_ctx
);
869 if (!init_ctx
->container
->lxc_conf
) {
870 init_ctx
->container
->lxc_conf
= lxc_conf_init();
871 if (!init_ctx
->container
->lxc_conf
) {
872 lxc_proc_put_context_info(init_ctx
);
877 if (!fetch_seccomp(init_ctx
->container
, options
))
878 WARN("Failed to get seccomp policy.");
880 if (!no_new_privs(init_ctx
->container
, options
))
881 WARN("Could not determine whether PR_SET_NO_NEW_PRIVS is set.");
883 cwd
= getcwd(NULL
, 0);
885 /* Determine which namespaces the container was created with
886 * by asking lxc-start, if necessary.
888 if (options
->namespaces
== -1) {
889 options
->namespaces
= lxc_cmd_get_clone_flags(name
, lxcpath
);
891 if (options
->namespaces
== -1) {
892 ERROR("Failed to automatically determine the "
893 "namespaces which the container uses");
895 lxc_proc_put_context_info(init_ctx
);
899 for (i
= 0; i
< LXC_NS_MAX
; i
++) {
900 if (ns_info
[i
].clone_flag
& CLONE_NEWCGROUP
)
901 if (!(options
->attach_flags
& LXC_ATTACH_MOVE_TO_CGROUP
) ||
905 if (ns_info
[i
].clone_flag
& options
->namespaces
)
908 init_ctx
->ns_inherited
|= ns_info
[i
].clone_flag
;
913 for (i
= 0; i
< LXC_NS_MAX
; i
++) {
916 if (options
->namespaces
& ns_info
[i
].clone_flag
)
917 init_ctx
->ns_fd
[i
] = lxc_preserve_ns(init_pid
, ns_info
[i
].proc_name
);
918 else if (init_ctx
->ns_inherited
& ns_info
[i
].clone_flag
)
919 init_ctx
->ns_fd
[i
] = in_same_namespace(pid
, init_pid
, ns_info
[i
].proc_name
);
922 if (init_ctx
->ns_fd
[i
] >= 0)
925 if (init_ctx
->ns_fd
[i
] == -EINVAL
) {
926 DEBUG("Inheriting %s namespace from %d",
927 ns_info
[i
].proc_name
, pid
);
928 init_ctx
->ns_inherited
&= ~ns_info
[i
].clone_flag
;
932 /* We failed to preserve the namespace. */
934 /* Close all already opened file descriptors before we return an
935 * error, so we don't leak them.
937 for (j
= 0; j
< i
; j
++)
938 close(init_ctx
->ns_fd
[j
]);
941 SYSERROR("Failed to attach to %s namespace of %d",
942 ns_info
[i
].proc_name
, pid
);
944 lxc_proc_put_context_info(init_ctx
);
948 /* Create a socket pair for IPC communication; set SOCK_CLOEXEC in order
949 * to make sure we don't irritate other threads that want to fork+exec
952 * IMPORTANT: if the initial process is multithreaded and another call
953 * just fork()s away without exec'ing directly after, the socket fd will
954 * exist in the forked process from the other thread and any close() in
955 * our own child process will not really cause the socket to close
956 * properly, potentiall causing the parent to hang.
958 * For this reason, while IPC is still active, we have to use shutdown()
959 * if the child exits prematurely in order to signal that the socket is
960 * closed and cannot assume that the child exiting will automatically do
963 * IPC mechanism: (X is receiver)
964 * initial process intermediate attached
968 * send 0 ------------------------------------> X
969 * [do initialization]
970 * X <------------------------------------ send 1
971 * [add to cgroup, ...]
972 * send 2 ------------------------------------> X
973 * [set LXC_ATTACH_NO_NEW_PRIVS]
974 * X <------------------------------------ send 3
975 * [open LSM label fd]
976 * send 4 ------------------------------------> X
978 * close socket close socket
981 ret
= socketpair(PF_LOCAL
, SOCK_STREAM
| SOCK_CLOEXEC
, 0, ipc_sockets
);
983 SYSERROR("Could not set up required IPC mechanism for attaching.");
985 lxc_proc_put_context_info(init_ctx
);
989 /* Create intermediate subprocess, three reasons:
990 * 1. Runs all pthread_atfork handlers and the child will no
991 * longer be threaded (we can't properly setns() in a threaded
993 * 2. We can't setns() in the child itself, since we want to make
994 * sure we are properly attached to the pidns.
995 * 3. Also, the initial thread has to put the attached process
996 * into the cgroup, which we can only do if we didn't already
997 * setns() (otherwise, user namespaces will hate us).
1001 SYSERROR("Failed to create first subprocess.");
1003 lxc_proc_put_context_info(init_ctx
);
1008 pid_t to_cleanup_pid
= pid
;
1010 /* Initial thread, we close the socket that is for the
1013 close(ipc_sockets
[1]);
1016 /* Attach to cgroup, if requested. */
1017 if (options
->attach_flags
& LXC_ATTACH_MOVE_TO_CGROUP
) {
1018 if (!cgroup_attach(name
, lxcpath
, pid
))
1020 TRACE("Moved intermediate process %d into container's "
1024 /* Setup resource limits */
1025 if (!lxc_list_empty(&init_ctx
->container
->lxc_conf
->limits
))
1026 if (setup_resource_limits(&init_ctx
->container
->lxc_conf
->limits
, pid
) < 0)
1029 /* Let the child process know to go ahead. */
1031 ret
= lxc_write_nointr(ipc_sockets
[0], &status
, sizeof(status
));
1032 if (ret
!= sizeof(status
))
1034 TRACE("Told intermediate process to start initializing");
1036 /* Get pid of attached process from intermediate process. */
1037 ret
= lxc_read_nointr(ipc_sockets
[0], &attached_pid
, sizeof(attached_pid
));
1038 if (ret
!= sizeof(attached_pid
))
1040 TRACE("Received pid %d of attached process in parent pid namespace", attached_pid
);
1042 /* Ignore SIGKILL (CTRL-C) and SIGQUIT (CTRL-\) - issue #313. */
1043 if (options
->stdin_fd
== 0) {
1044 signal(SIGINT
, SIG_IGN
);
1045 signal(SIGQUIT
, SIG_IGN
);
1048 /* Reap intermediate process. */
1049 ret
= wait_for_pid(pid
);
1052 TRACE("Intermediate process %d exited", pid
);
1054 /* We will always have to reap the attached process now. */
1055 to_cleanup_pid
= attached_pid
;
1057 /* Open LSM fd and send it to child. */
1058 if ((options
->namespaces
& CLONE_NEWNS
) &&
1059 (options
->attach_flags
& LXC_ATTACH_LSM
) &&
1060 init_ctx
->lsm_label
) {
1061 int labelfd
, on_exec
;
1064 on_exec
= options
->attach_flags
& LXC_ATTACH_LSM_EXEC
? 1 : 0;
1065 labelfd
= lsm_open(attached_pid
, on_exec
);
1068 TRACE("Opened LSM label file descriptor %d", labelfd
);
1070 /* Send child fd of the LSM security module to write to. */
1071 ret
= lxc_abstract_unix_send_fds(ipc_sockets
[0], &labelfd
, 1, NULL
, 0);
1074 SYSERROR("%d", (int)ret
);
1077 TRACE("Sent LSM label file descriptor %d to child", labelfd
);
1080 /* Now shut down communication with child, we're done. */
1081 shutdown(ipc_sockets
[0], SHUT_RDWR
);
1082 close(ipc_sockets
[0]);
1083 lxc_proc_put_context_info(init_ctx
);
1085 /* We're done, the child process should now execute whatever it
1086 * is that the user requested. The parent can now track it with
1087 * waitpid() or similar.
1090 *attached_process
= attached_pid
;
1094 /* First shut down the socket, then wait for the pid, otherwise
1095 * the pid we're waiting for may never exit.
1097 shutdown(ipc_sockets
[0], SHUT_RDWR
);
1098 close(ipc_sockets
[0]);
1100 (void)wait_for_pid(to_cleanup_pid
);
1101 lxc_proc_put_context_info(init_ctx
);
1105 /* First subprocess begins here, we close the socket that is for the
1108 close(ipc_sockets
[0]);
1110 /* Wait for the parent to have setup cgroups. */
1112 ret
= lxc_read_nointr(ipc_sockets
[1], &status
, sizeof(status
));
1113 if (ret
!= sizeof(status
) || status
!= expected
) {
1114 shutdown(ipc_sockets
[1], SHUT_RDWR
);
1115 lxc_proc_put_context_info(init_ctx
);
1118 TRACE("Intermediate process starting to initialize");
1120 /* Attach now, create another subprocess later, since pid namespaces
1121 * only really affect the children of the current process.
1123 ret
= lxc_attach_to_ns(init_pid
, init_ctx
);
1125 ERROR("Failed to enter namespaces");
1126 shutdown(ipc_sockets
[1], SHUT_RDWR
);
1127 lxc_proc_put_context_info(init_ctx
);
1130 /* close namespace file descriptors */
1131 lxc_proc_close_ns_fd(init_ctx
);
1133 /* Attach succeeded, try to cwd. */
1134 if (options
->initial_cwd
)
1135 new_cwd
= options
->initial_cwd
;
1139 ret
= chdir(new_cwd
);
1141 WARN("Could not change directory to \"%s\"", new_cwd
);
1145 /* Now create the real child process. */
1147 struct attach_clone_payload payload
= {
1148 .ipc_socket
= ipc_sockets
[1],
1150 .init_ctx
= init_ctx
,
1151 .exec_function
= exec_function
,
1152 .exec_payload
= exec_payload
,
1154 /* We use clone_parent here to make this subprocess a direct
1155 * child of the initial process. Then this intermediate process
1156 * can exit and the parent can directly track the attached
1159 pid
= lxc_clone(attach_child_main
, &payload
, CLONE_PARENT
);
1162 /* Shouldn't happen, clone() should always return positive pid. */
1164 SYSERROR("Failed to clone attached process");
1165 shutdown(ipc_sockets
[1], SHUT_RDWR
);
1166 lxc_proc_put_context_info(init_ctx
);
1169 TRACE("Cloned attached process %d", pid
);
1171 /* Tell grandparent the pid of the pid of the newly created child. */
1172 ret
= lxc_write_nointr(ipc_sockets
[1], &pid
, sizeof(pid
));
1173 if (ret
!= sizeof(pid
)) {
1174 /* If this really happens here, this is very unfortunate, since
1175 * the parent will not know the pid of the attached process and
1176 * will not be able to wait for it (and we won't either due to
1177 * CLONE_PARENT) so the parent won't be able to reap it and the
1178 * attached process will remain a zombie.
1180 shutdown(ipc_sockets
[1], SHUT_RDWR
);
1181 lxc_proc_put_context_info(init_ctx
);
1184 TRACE("Sending pid %d of attached process", pid
);
1186 /* The rest is in the hands of the initial and the attached process. */
1187 lxc_proc_put_context_info(init_ctx
);
1191 static int attach_child_main(void* data
)
1195 #if HAVE_SYS_PERSONALITY_H
1196 long new_personality
;
1200 struct attach_clone_payload
* payload
= (struct attach_clone_payload
*)data
;
1201 int ipc_socket
= payload
->ipc_socket
;
1202 lxc_attach_options_t
* options
= payload
->options
;
1203 struct lxc_proc_context_info
* init_ctx
= payload
->init_ctx
;
1205 /* A description of the purpose of this functionality is provided in the
1206 * lxc-attach(1) manual page. We have to remount here and not in the
1207 * parent process, otherwise /proc may not properly reflect the new pid
1210 if (!(options
->namespaces
& CLONE_NEWNS
) &&
1211 (options
->attach_flags
& LXC_ATTACH_REMOUNT_PROC_SYS
)) {
1212 ret
= lxc_attach_remount_sys_proc();
1214 shutdown(ipc_socket
, SHUT_RDWR
);
1219 /* Now perform additional attachments. */
1220 #if HAVE_SYS_PERSONALITY_H
1221 if (options
->personality
< 0)
1222 new_personality
= init_ctx
->personality
;
1224 new_personality
= options
->personality
;
1226 if (options
->attach_flags
& LXC_ATTACH_SET_PERSONALITY
) {
1227 ret
= personality(new_personality
);
1229 SYSERROR("Could not ensure correct architecture");
1230 shutdown(ipc_socket
, SHUT_RDWR
);
1236 if (options
->attach_flags
& LXC_ATTACH_DROP_CAPABILITIES
) {
1237 ret
= lxc_attach_drop_privs(init_ctx
);
1239 ERROR("Could not drop privileges");
1240 shutdown(ipc_socket
, SHUT_RDWR
);
1245 /* Always set the environment (specify (LXC_ATTACH_KEEP_ENV, NULL, NULL)
1246 * if you want this to be a no-op).
1248 ret
= lxc_attach_set_environment(options
->env_policy
,
1249 options
->extra_env_vars
,
1250 options
->extra_keep_env
);
1252 ERROR("Failed to set initial environment for attached process");
1253 shutdown(ipc_socket
, SHUT_RDWR
);
1260 /* Ignore errors, we will fall back to root in that case (/proc was not
1263 if (options
->namespaces
& CLONE_NEWUSER
)
1264 lxc_attach_get_init_uidgid(&new_uid
, &new_gid
);
1266 if (options
->uid
!= (uid_t
)-1)
1267 new_uid
= options
->uid
;
1268 if (options
->gid
!= (gid_t
)-1)
1269 new_gid
= options
->gid
;
1271 /* Setup the controlling tty. */
1272 if (options
->stdin_fd
&& isatty(options
->stdin_fd
)) {
1274 SYSERROR("Unable to setsid.");
1275 shutdown(ipc_socket
, SHUT_RDWR
);
1279 if (ioctl(options
->stdin_fd
, TIOCSCTTY
, (char *)NULL
) < 0) {
1280 SYSERROR("Unable to set TIOCSTTY.");
1281 shutdown(ipc_socket
, SHUT_RDWR
);
1286 /* Try to set the {u,g}id combination. */
1287 if ((new_gid
!= 0 || options
->namespaces
& CLONE_NEWUSER
)) {
1288 if (setgid(new_gid
) || setgroups(0, NULL
)) {
1289 SYSERROR("Switching to container gid.");
1290 shutdown(ipc_socket
, SHUT_RDWR
);
1294 if ((new_uid
!= 0 || options
->namespaces
& CLONE_NEWUSER
) &&
1296 SYSERROR("Switching to container uid.");
1297 shutdown(ipc_socket
, SHUT_RDWR
);
1301 if ((init_ctx
->container
&& init_ctx
->container
->lxc_conf
&&
1302 init_ctx
->container
->lxc_conf
->no_new_privs
) ||
1303 (options
->attach_flags
& LXC_ATTACH_NO_NEW_PRIVS
)) {
1304 if (prctl(PR_SET_NO_NEW_PRIVS
, 1, 0, 0, 0) < 0) {
1305 SYSERROR("PR_SET_NO_NEW_PRIVS could not be set. "
1306 "Process can use execve() gainable "
1308 shutdown(ipc_socket
, SHUT_RDWR
);
1311 INFO("PR_SET_NO_NEW_PRIVS is set. Process cannot use execve() "
1312 "gainable privileges.");
1315 if ((options
->namespaces
& CLONE_NEWNS
) &&
1316 (options
->attach_flags
& LXC_ATTACH_LSM
) && init_ctx
->lsm_label
) {
1317 int lsm_labelfd
, on_exec
;
1319 /* Receive fd for LSM security module. */
1320 ret
= lxc_abstract_unix_recv_fds(ipc_socket
, &lsm_labelfd
, 1, NULL
, 0);
1322 shutdown(ipc_socket
, SHUT_RDWR
);
1325 TRACE("Received LSM label file descriptor %d from parent", lsm_labelfd
);
1327 /* Change into our new LSM profile. */
1328 on_exec
= options
->attach_flags
& LXC_ATTACH_LSM_EXEC
? 1 : 0;
1329 if (lsm_set_label_at(lsm_labelfd
, on_exec
, init_ctx
->lsm_label
) < 0) {
1330 SYSERROR("Failed to set LSM label.");
1331 shutdown(ipc_socket
, SHUT_RDWR
);
1338 if (init_ctx
->container
&& init_ctx
->container
->lxc_conf
&&
1339 init_ctx
->container
->lxc_conf
->seccomp
&&
1340 (lxc_seccomp_load(init_ctx
->container
->lxc_conf
) != 0)) {
1341 ERROR("Failed to load seccomp policy.");
1342 shutdown(ipc_socket
, SHUT_RDWR
);
1346 shutdown(ipc_socket
, SHUT_RDWR
);
1348 lxc_proc_put_context_info(init_ctx
);
1350 /* The following is done after the communication socket is shut down.
1351 * That way, all errors that might (though unlikely) occur up until this
1352 * point will have their messages printed to the original stderr (if
1353 * logging is so configured) and not the fd the user supplied, if any.
1356 /* Fd handling for stdin, stdout and stderr; ignore errors here, user
1357 * may want to make sure the fds are closed, for example.
1359 if (options
->stdin_fd
>= 0 && options
->stdin_fd
!= 0)
1360 dup2(options
->stdin_fd
, 0);
1361 if (options
->stdout_fd
>= 0 && options
->stdout_fd
!= 1)
1362 dup2(options
->stdout_fd
, 1);
1363 if (options
->stderr_fd
>= 0 && options
->stderr_fd
!= 2)
1364 dup2(options
->stderr_fd
, 2);
1366 /* close the old fds */
1367 if (options
->stdin_fd
> 2)
1368 close(options
->stdin_fd
);
1369 if (options
->stdout_fd
> 2)
1370 close(options
->stdout_fd
);
1371 if (options
->stderr_fd
> 2)
1372 close(options
->stderr_fd
);
1374 /* Try to remove FD_CLOEXEC flag from stdin/stdout/stderr, but also
1375 * here, ignore errors.
1377 for (fd
= 0; fd
<= 2; fd
++) {
1378 flags
= fcntl(fd
, F_GETFL
);
1381 if (flags
& FD_CLOEXEC
)
1382 if (fcntl(fd
, F_SETFL
, flags
& ~FD_CLOEXEC
) < 0)
1383 SYSERROR("Unable to clear FD_CLOEXEC from file descriptor.");
1386 /* We're done, so we can now do whatever the user intended us to do. */
1387 rexit(payload
->exec_function(payload
->exec_payload
));
1390 int lxc_attach_run_command(void* payload
)
1392 lxc_attach_command_t
* cmd
= (lxc_attach_command_t
*)payload
;
1394 execvp(cmd
->program
, cmd
->argv
);
1395 SYSERROR("Failed to exec \"%s\".", cmd
->program
);
1399 int lxc_attach_run_shell(void* payload
)
1402 struct passwd
*passwd
;
1405 /* Ignore payload parameter. */
1409 passwd
= getpwuid(uid
);
1411 /* This probably happens because of incompatible nss implementations in
1412 * host and container (remember, this code is still using the host's
1413 * glibc but our mount namespace is in the container) we may try to get
1414 * the information by spawning a [getent passwd uid] process and parsing
1418 user_shell
= lxc_attach_getpwshell(uid
);
1420 user_shell
= passwd
->pw_shell
;
1422 execlp(user_shell
, user_shell
, (char *)NULL
);
1424 /* Executed if either no passwd entry or execvp fails, we will fall back
1425 * on /bin/sh as a default shell.
1427 execlp("/bin/sh", "/bin/sh", (char *)NULL
);
1428 SYSERROR("Failed to execute shell");