3 * lxc: linux Container library
5 * (C) Copyright IBM Corp. 2007, 2008
8 * Daniel Lezcano <daniel.lezcano at free.fr>
10 * This library is free software; you can redistribute it and/or
11 * modify it under the terms of the GNU Lesser General Public
12 * License as published by the Free Software Foundation; either
13 * version 2.1 of the License, or (at your option) any later version.
15 * This library is distributed in the hope that it will be useful,
16 * but WITHOUT ANY WARRANTY; without even the implied warranty of
17 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
18 * Lesser General Public License for more details.
20 * You should have received a copy of the GNU Lesser General Public
21 * License along with this library; if not, write to the Free Software
22 * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
25 #ifndef __LXC_ATTACH_OPTIONS_H
26 #define __LXC_ATTACH_OPTIONS_H
28 #include <sys/types.h>
35 * LXC environment policy.
37 typedef enum lxc_attach_env_policy_t
{
38 LXC_ATTACH_KEEP_ENV
, /*!< Retain the environment */
39 LXC_ATTACH_CLEAR_ENV
/*!< Clear the environment */
40 } lxc_attach_env_policy_t
;
43 /* The following are on by default: */
44 LXC_ATTACH_MOVE_TO_CGROUP
= 0x00000001, /*!< Move to cgroup */
45 LXC_ATTACH_DROP_CAPABILITIES
= 0x00000002, /*!< Drop capabilities */
46 LXC_ATTACH_SET_PERSONALITY
= 0x00000004, /*!< Set personality */
47 LXC_ATTACH_LSM_EXEC
= 0x00000008, /*!< Execute under a Linux Security Module */
49 /* The following are off by default: */
50 LXC_ATTACH_REMOUNT_PROC_SYS
= 0x00010000, /*!< Remount /proc filesystem */
51 LXC_ATTACH_LSM_NOW
= 0x00020000, /*!< FIXME: unknown */
52 /* Set PR_SET_NO_NEW_PRIVS to block execve() gainable privileges. */
53 LXC_ATTACH_NO_NEW_PRIVS
= 0x00040000, /*!< PR_SET_NO_NEW_PRIVS */
55 /* We have 16 bits for things that are on by default and 16 bits that
56 * are off by default, that should be sufficient to keep binary
57 * compatibility for a while
59 LXC_ATTACH_DEFAULT
= 0x0000FFFF /*!< Mask of flags to apply by default */
62 /*! All Linux Security Module flags */
63 #define LXC_ATTACH_LSM (LXC_ATTACH_LSM_EXEC | LXC_ATTACH_LSM_NOW)
65 /*! LXC attach function type.
67 * Function to run in container.
69 * \param payload \ref lxc_attach_command_t to run.
71 * \return Function should return \c 0 on success, and any other value to denote failure.
73 typedef int (*lxc_attach_exec_t
)(void* payload
);
76 * LXC attach options for \ref lxc_container \c attach().
78 typedef struct lxc_attach_options_t
{
79 /*! Any combination of LXC_ATTACH_* flags */
82 /*! The namespaces to attach to (CLONE_NEW... flags) */
85 /*! Initial personality (\c -1 to autodetect).
86 * \warning This may be ignored if lxc is compiled without personality
91 /*! Initial current directory, use \c NULL to use cwd.
92 * If the current directory does not exist in the container, the root
93 * directory will be used instead because of kernel defaults.
97 /*! The user-id to run as.
99 * \note Set to \c -1 for default behaviour (init uid for userns
100 * containers or \c 0 (super-user) if detection fails).
104 /*! The group-id to run as.
106 * \note Set to \c -1 for default behaviour (init gid for userns
107 * containers or \c 0 (super-user) if detection fails).
111 /*! Environment policy */
112 lxc_attach_env_policy_t env_policy
;
114 /*! Extra environment variables to set in the container environment */
115 char** extra_env_vars
;
117 /*! Names of environment variables in existing environment to retain
118 * in container environment.
120 char** extra_keep_env
;
123 /*! File descriptors for stdin, stdout and stderr,
124 * \c dup2() will be used before calling exec_function,
125 * (assuming not \c 0, \c 1 and \c 2 are specified) and the
126 * original fds are closed before passing control
127 * over. Any \c O_CLOEXEC flag will be removed after
130 int stdin_fd
; /*!< stdin file descriptor */
131 int stdout_fd
; /*!< stdout file descriptor */
132 int stderr_fd
; /*!< stderr file descriptor */
135 /*! File descriptor to log output. */
137 } lxc_attach_options_t
;
139 /*! Default attach options to use */
140 #define LXC_ATTACH_OPTIONS_DEFAULT \
142 /* .attach_flags = */ LXC_ATTACH_DEFAULT, \
143 /* .namespaces = */ -1, \
144 /* .personality = */ -1, \
145 /* .initial_cwd = */ NULL, \
146 /* .uid = */ (uid_t)-1, \
147 /* .gid = */ (gid_t)-1, \
148 /* .env_policy = */ LXC_ATTACH_KEEP_ENV, \
149 /* .extra_env_vars = */ NULL, \
150 /* .extra_keep_env = */ NULL, \
151 /* .stdin_fd = */ 0, \
152 /* .stdout_fd = */ 1, \
153 /* .stderr_fd = */ 2, \
154 /* .log_fd = */ -EBADF, \
158 * Representation of a command to run in a container.
160 typedef struct lxc_attach_command_t
{
161 char* program
; /*!< The program to run (passed to execvp) */
162 char** argv
; /*!< The argv pointer of that program, including the program itself in argv[0] */
163 } lxc_attach_command_t
;
166 * \brief Run a command in the container.
168 * \param payload \ref lxc_attach_command_t to run.
170 * \return \c -1 on error, exit code of lxc_attach_command_t program on success.
172 extern int lxc_attach_run_command(void* payload
);
175 * \brief Run a shell command in the container.
177 * \param payload Not used.
179 * \return Exit code of shell.
181 extern int lxc_attach_run_shell(void* payload
);