src/lxc/attach_options.h

   1 /*! \file
   2  *
   3  * lxc: linux Container library
   4  *
   5  * (C) Copyright IBM Corp. 2007, 2008
   6  *
   7  * Authors:
   8  * Daniel Lezcano <daniel.lezcano at free.fr>
   9  *
  10  * This library is free software; you can redistribute it and/or
  11  * modify it under the terms of the GNU Lesser General Public
  12  * License as published by the Free Software Foundation; either
  13  * version 2.1 of the License, or (at your option) any later version.
  14  *
  15  * This library is distributed in the hope that it will be useful,
  16  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  17  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  18  * Lesser General Public License for more details.
  19  *
  20  * You should have received a copy of the GNU Lesser General Public
  21  * License along with this library; if not, write to the Free Software
  22  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
  23  */
  24
  25 #ifndef __LXC_ATTACH_OPTIONS_H
  26 #define __LXC_ATTACH_OPTIONS_H
  27
  28 #include <sys/types.h>
  29
  30 #ifdef  __cplusplus
  31 extern "C" {
  32 #endif
  33
  34 /*!
  35  * LXC environment policy.
  36  */
  37 typedef enum lxc_attach_env_policy_t {
  38         LXC_ATTACH_KEEP_ENV,   //!< Retain the environment
  39         LXC_ATTACH_CLEAR_ENV   //!< Clear the environment
  40 } lxc_attach_env_policy_t;
  41
  42 enum {
  43         /* the following are on by default: */
  44         LXC_ATTACH_MOVE_TO_CGROUP        = 0x00000001, //!< Move to cgroup
  45         LXC_ATTACH_DROP_CAPABILITIES     = 0x00000002, //!< Drop capabilities
  46         LXC_ATTACH_SET_PERSONALITY       = 0x00000004, //!< Set personality
  47         LXC_ATTACH_LSM_EXEC              = 0x00000008, //!< Execute under a Linux Security Module
  48
  49         /* the following are off by default */
  50         LXC_ATTACH_REMOUNT_PROC_SYS      = 0x00010000, //!< Remount /proc filesystem
  51         LXC_ATTACH_LSM_NOW               = 0x00020000, //!< FIXME: unknown
  52         /* Set PR_SET_NO_NEW_PRIVS to block execve() gainable privileges. */
  53         LXC_ATTACH_NO_NEW_PRIVS          = 0x00040000, //!< PR_SET_NO_NEW_PRIVS
  54
  55         /* we have 16 bits for things that are on by default
  56          * and 16 bits that are off by default, that should
  57          * be sufficient to keep binary compatibility for
  58          * a while
  59          */
  60         LXC_ATTACH_DEFAULT               = 0x0000FFFF  //!< Mask of flags to apply by default
  61 };
  62
  63 /*! All Linux Security Module flags */
  64 #define LXC_ATTACH_LSM (LXC_ATTACH_LSM_EXEC | LXC_ATTACH_LSM_NOW)
  65
  66 /*! LXC attach function type.
  67  *
  68  * Function to run in container.
  69  *
  70  * \param payload \ref lxc_attach_command_t to run.
  71  *
  72  * \return Function should return \c 0 on success, and any other value to denote failure.
  73  */
  74 typedef int (*lxc_attach_exec_t)(void* payload);
  75
  76 /*!
  77  * LXC attach options for \ref lxc_container \c attach().
  78  */
  79 typedef struct lxc_attach_options_t {
  80         /*! Any combination of LXC_ATTACH_* flags */
  81         int attach_flags;
  82
  83         /*! The namespaces to attach to (CLONE_NEW... flags) */
  84         int namespaces;
  85
  86         /*! Initial personality (\c -1 to autodetect).
  87          * \warning This may be ignored if lxc is compiled without personality support)
  88          */
  89         long personality;
  90
  91         /*! Initial current directory, use \c NULL to use cwd.
  92          * If the current directory does not exist in the container, the
  93          * root directory will be used instead because of kernel defaults.
  94          */
  95         char* initial_cwd;
  96
  97         /*! The user-id to run as.
  98          *
  99          * \note Set to \c -1 for default behaviour (init uid for userns
 100          * containers or \c 0 (super-user) if detection fails).
 101          */
 102         uid_t uid;
 103
 104         /*! The group-id to run as.
 105          *
 106          * \note Set to \c -1 for default behaviour (init gid for userns
 107          * containers or \c 0 (super-user) if detection fails).
 108          */
 109         gid_t gid;
 110
 111         /*! Environment policy */
 112         lxc_attach_env_policy_t env_policy;
 113
 114         /*! Extra environment variables to set in the container environment */
 115         char** extra_env_vars;
 116
 117         /*! Names of environment variables in existing environment to retain
 118          * in container environment.
 119          */
 120         char** extra_keep_env;
 121
 122         /**@{*/
 123         /*! File descriptors for stdin, stdout and stderr,
 124          * \c dup2() will be used before calling exec_function,
 125          * (assuming not \c 0, \c 1 and \c 2 are specified) and the
 126          * original fds are closed before passing control
 127          * over. Any \c O_CLOEXEC flag will be removed after
 128          * that.
 129          */
 130         int stdin_fd; /*!< stdin file descriptor */
 131         int stdout_fd; /*!< stdout file descriptor */
 132         int stderr_fd; /*!< stderr file descriptor */
 133         /**@}*/
 134 } lxc_attach_options_t;
 135
 136 /*! Default attach options to use */
 137 #define LXC_ATTACH_OPTIONS_DEFAULT \
 138         { \
 139                 /* .attach_flags = */   LXC_ATTACH_DEFAULT, \
 140                 /* .namespaces = */     -1, \
 141                 /* .personality = */    -1, \
 142                 /* .initial_cwd = */    NULL, \
 143                 /* .uid = */            (uid_t)-1, \
 144                 /* .gid = */            (gid_t)-1, \
 145                 /* .env_policy = */     LXC_ATTACH_KEEP_ENV, \
 146                 /* .extra_env_vars = */ NULL, \
 147                 /* .extra_keep_env = */ NULL, \
 148                 /* .stdin_fd = */       0, 1, 2 \
 149         }
 150
 151 /*!
 152  * Representation of a command to run in a container.
 153  */
 154 typedef struct lxc_attach_command_t {
 155         char* program; /*!< The program to run (passed to execvp) */
 156         char** argv;   /*!< The argv pointer of that program, including the program itself in argv[0] */
 157 } lxc_attach_command_t;
 158
 159 /*!
 160  * \brief Run a command in the container.
 161  *
 162  * \param payload \ref lxc_attach_command_t to run.
 163  *
 164  * \return \c -1 on error, exit code of lxc_attach_command_t program on success.
 165  */
 166 extern int lxc_attach_run_command(void* payload);
 167
 168 /*!
 169  * \brief Run a shell command in the container.
 170  *
 171  * \param payload Not used.
 172  *
 173  * \return Exit code of shell.
 174  */
 175 extern int lxc_attach_run_shell(void* payload);
 176
 177 #ifdef  __cplusplus
 178 }
 179 #endif
 180
 181 #endif