src/lxc/cmd/lxc_monitord.c

   1 /* SPDX-License-Identifier: LGPL-2.1+ */
   2
   3 #ifndef _GNU_SOURCE
   4 #define _GNU_SOURCE 1
   5 #endif
   6 #include <errno.h>
   7 #include <fcntl.h>
   8 #include <net/if.h>
   9 #include <netinet/in.h>
  10 #include <pthread.h>
  11 #include <setjmp.h>
  12 #include <signal.h>
  13 #include <stdio.h>
  14 #include <stdlib.h>
  15 #include <string.h>
  16 #include <sys/epoll.h>
  17 #include <sys/param.h>
  18 #include <sys/socket.h>
  19 #include <sys/stat.h>
  20 #include <sys/types.h>
  21 #include <sys/un.h>
  22 #include <unistd.h>
  23
  24 #include <lxc/lxccontainer.h>
  25
  26 #include "af_unix.h"
  27 #include "config.h"
  28 #include "log.h"
  29 #include "mainloop.h"
  30 #include "monitor.h"
  31 #include "raw_syscalls.h"
  32 #include "utils.h"
  33
  34 #define CLIENTFDS_CHUNK 64
  35
  36 lxc_log_define(lxc_monitord, lxc);
  37
  38 sigjmp_buf mark;
  39
  40 static void lxc_monitord_cleanup(void);
  41
  42 /*
  43  * Defines the structure to store the monitor information
  44  * @lxcpath        : the path being monitored
  45  * @fifofd         : the file descriptor for publishers (containers) to write state
  46  * @listenfd       : the file descriptor for subscribers (lxc-monitors) to connect
  47  * @clientfds      : accepted client file descriptors
  48  * @clientfds_size : number of file descriptors clientfds can hold
  49  * @clientfds_cnt  : the count of valid fds in clientfds
  50  * @descr          : the lxc_mainloop state
  51  */
  52 struct lxc_monitor {
  53         const char *lxcpath;
  54         int fifofd;
  55         int listenfd;
  56         int *clientfds;
  57         int clientfds_size;
  58         int clientfds_cnt;
  59         struct lxc_epoll_descr descr;
  60 };
  61
  62 static struct lxc_monitor monitor;
  63 static int quit;
  64
  65 static int lxc_monitord_fifo_create(struct lxc_monitor *mon)
  66 {
  67         struct flock lk;
  68         char fifo_path[PATH_MAX];
  69         int ret;
  70
  71         ret = lxc_monitor_fifo_name(mon->lxcpath, fifo_path, sizeof(fifo_path), 1);
  72         if (ret < 0)
  73                 return ret;
  74
  75         ret = mknod(fifo_path, S_IFIFO | S_IRUSR | S_IWUSR, 0);
  76         if (ret < 0 && errno != EEXIST) {
  77                 SYSINFO("Failed to mknod monitor fifo %s", fifo_path);
  78                 return -1;
  79         }
  80
  81         mon->fifofd = open(fifo_path, O_RDWR);
  82         if (mon->fifofd < 0) {
  83                 SYSERROR("Failed to open monitor fifo %s", fifo_path);
  84                 unlink(fifo_path);
  85                 return -1;
  86         }
  87
  88         lk.l_type = F_WRLCK;
  89         lk.l_whence = SEEK_SET;
  90         lk.l_start = 0;
  91         lk.l_len = 0;
  92
  93         if (fcntl(mon->fifofd, F_SETLK, &lk) != 0) {
  94                 /* another lxc-monitord is already running, don't start up */
  95                 SYSDEBUG("lxc-monitord already running on lxcpath %s", mon->lxcpath);
  96                 close(mon->fifofd);
  97                 return -1;
  98         }
  99
 100         return 0;
 101 }
 102
 103 static int lxc_monitord_fifo_delete(struct lxc_monitor *mon)
 104 {
 105         char fifo_path[PATH_MAX];
 106         int ret;
 107
 108         ret = lxc_monitor_fifo_name(mon->lxcpath, fifo_path, sizeof(fifo_path), 0);
 109         if (ret < 0)
 110                 return ret;
 111
 112         unlink(fifo_path);
 113         return 0;
 114 }
 115
 116 static void lxc_monitord_sockfd_remove(struct lxc_monitor *mon, int fd)
 117 {
 118         int i;
 119
 120         if (lxc_mainloop_del_handler(&mon->descr, fd))
 121                 CRIT("File descriptor %d not found in mainloop", fd);
 122         close(fd);
 123
 124         for (i = 0; i < mon->clientfds_cnt; i++)
 125                 if (mon->clientfds[i] == fd)
 126                         break;
 127
 128         if (i >= mon->clientfds_cnt) {
 129                 CRIT("File descriptor %d not found in clients array", fd);
 130                 lxc_monitord_cleanup();
 131                 exit(EXIT_FAILURE);
 132         }
 133
 134         memmove(&mon->clientfds[i], &mon->clientfds[i+1],
 135                 (mon->clientfds_cnt - i - 1) * sizeof(mon->clientfds[0]));
 136         mon->clientfds_cnt--;
 137 }
 138
 139 static int lxc_monitord_sock_handler(int fd, uint32_t events, void *data,
 140                                      struct lxc_epoll_descr *descr)
 141 {
 142         struct lxc_monitor *mon = data;
 143
 144         if (events & EPOLLIN) {
 145                 int rc;
 146                 char buf[4];
 147
 148                 rc = lxc_read_nointr(fd, buf, sizeof(buf));
 149                 if (rc > 0 && !strncmp(buf, "quit", 4))
 150                         quit = LXC_MAINLOOP_CLOSE;
 151         }
 152
 153         if (events & EPOLLHUP)
 154                 lxc_monitord_sockfd_remove(mon, fd);
 155
 156         return quit;
 157 }
 158
 159 static int lxc_monitord_sock_accept(int fd, uint32_t events, void *data,
 160                                     struct lxc_epoll_descr *descr)
 161 {
 162         int ret, clientfd;
 163         struct lxc_monitor *mon = data;
 164         struct ucred cred;
 165         socklen_t credsz = sizeof(cred);
 166
 167         ret = LXC_MAINLOOP_ERROR;
 168         clientfd = accept(fd, NULL, 0);
 169         if (clientfd < 0) {
 170                 SYSERROR("Failed to accept connection for client file descriptor %d", fd);
 171                 goto out;
 172         }
 173
 174         if (fcntl(clientfd, F_SETFD, FD_CLOEXEC)) {
 175                 SYSERROR("Failed to set FD_CLOEXEC on client socket connection %d", clientfd);
 176                 goto err1;
 177         }
 178
 179         if (getsockopt(clientfd, SOL_SOCKET, SO_PEERCRED, &cred, &credsz)) {
 180                 SYSERROR("Failed to get credentials on client socket connection %d", clientfd);
 181                 goto err1;
 182         }
 183
 184         if (cred.uid && cred.uid != geteuid()) {
 185                 WARN("Monitor denied for uid %d on client socket connection %d", cred.uid, clientfd);
 186                 goto err1;
 187         }
 188
 189         if (mon->clientfds_cnt + 1 > mon->clientfds_size) {
 190                 int *clientfds;
 191
 192                 clientfds = realloc(mon->clientfds,
 193                                     (mon->clientfds_size + CLIENTFDS_CHUNK) * sizeof(mon->clientfds[0]));
 194                 if (!clientfds) {
 195                         ERROR("Failed to realloc memory for %d client file descriptors",
 196                               mon->clientfds_size + CLIENTFDS_CHUNK);
 197                         goto err1;
 198                 }
 199
 200                 mon->clientfds = clientfds;
 201                 mon->clientfds_size += CLIENTFDS_CHUNK;
 202         }
 203
 204         ret = lxc_mainloop_add_handler(&mon->descr, clientfd,
 205                                        lxc_monitord_sock_handler, mon);
 206         if (ret < 0) {
 207                 ERROR("Failed to add socket handler");
 208                 goto err1;
 209         }
 210
 211         mon->clientfds[mon->clientfds_cnt++] = clientfd;
 212         INFO("Accepted client file descriptor %d. Number of accepted file descriptors is now %d",
 213              clientfd, mon->clientfds_cnt);
 214         goto out;
 215
 216 err1:
 217         close(clientfd);
 218
 219 out:
 220         return ret;
 221 }
 222
 223 static int lxc_monitord_sock_create(struct lxc_monitor *mon)
 224 {
 225         struct sockaddr_un addr;
 226         int fd;
 227
 228         if (lxc_monitor_sock_name(mon->lxcpath, &addr) < 0)
 229                 return -1;
 230
 231         fd = lxc_abstract_unix_open(addr.sun_path, SOCK_STREAM, O_TRUNC);
 232         if (fd < 0) {
 233                 SYSERROR("Failed to open unix socket");
 234                 return -1;
 235         }
 236
 237         mon->listenfd = fd;
 238         return 0;
 239 }
 240
 241 static int lxc_monitord_sock_delete(struct lxc_monitor *mon)
 242 {
 243         struct sockaddr_un addr;
 244
 245         if (lxc_monitor_sock_name(mon->lxcpath, &addr) < 0)
 246                 return -1;
 247
 248         if (addr.sun_path[0])
 249                 unlink(addr.sun_path);
 250
 251         return 0;
 252 }
 253
 254 static int lxc_monitord_create(struct lxc_monitor *mon)
 255 {
 256         int ret;
 257
 258         ret = lxc_monitord_fifo_create(mon);
 259         if (ret < 0)
 260                 return ret;
 261
 262         return lxc_monitord_sock_create(mon);
 263 }
 264
 265 static void lxc_monitord_delete(struct lxc_monitor *mon)
 266 {
 267         int i;
 268
 269         lxc_mainloop_del_handler(&mon->descr, mon->listenfd);
 270         lxc_abstract_unix_close(mon->listenfd);
 271         lxc_monitord_sock_delete(mon);
 272
 273         lxc_mainloop_del_handler(&mon->descr, mon->fifofd);
 274         lxc_monitord_fifo_delete(mon);
 275         close(mon->fifofd);
 276
 277         for (i = 0; i < mon->clientfds_cnt; i++) {
 278                 lxc_mainloop_del_handler(&mon->descr, mon->clientfds[i]);
 279                 close(mon->clientfds[i]);
 280         }
 281
 282         mon->clientfds_cnt = 0;
 283 }
 284
 285 static int lxc_monitord_fifo_handler(int fd, uint32_t events, void *data,
 286                                      struct lxc_epoll_descr *descr)
 287 {
 288         int ret, i;
 289         struct lxc_msg msglxc;
 290         struct lxc_monitor *mon = data;
 291
 292         ret = lxc_read_nointr(fd, &msglxc, sizeof(msglxc));
 293         if (ret != sizeof(msglxc)) {
 294                 SYSERROR("Reading from fifo failed");
 295                 return LXC_MAINLOOP_CLOSE;
 296         }
 297
 298         for (i = 0; i < mon->clientfds_cnt; i++) {
 299                 ret = lxc_write_nointr(mon->clientfds[i], &msglxc, sizeof(msglxc));
 300                 if (ret < 0)
 301                         SYSERROR("Failed to send message to client file descriptor %d",
 302                                  mon->clientfds[i]);
 303         }
 304
 305         return LXC_MAINLOOP_CONTINUE;
 306 }
 307
 308 static int lxc_monitord_mainloop_add(struct lxc_monitor *mon)
 309 {
 310         int ret;
 311
 312         ret = lxc_mainloop_add_handler(&mon->descr, mon->fifofd,
 313                                        lxc_monitord_fifo_handler, mon);
 314         if (ret < 0) {
 315                 ERROR("Failed to add to mainloop monitor handler for fifo");
 316                 return -1;
 317         }
 318
 319         ret = lxc_mainloop_add_handler(&mon->descr, mon->listenfd,
 320                                        lxc_monitord_sock_accept, mon);
 321         if (ret < 0) {
 322                 ERROR("Failed to add to mainloop monitor handler for listen socket");
 323                 return -1;
 324         }
 325
 326         return 0;
 327 }
 328
 329 static void lxc_monitord_cleanup(void)
 330 {
 331         lxc_monitord_delete(&monitor);
 332 }
 333
 334 static void lxc_monitord_sig_handler(int sig)
 335 {
 336         siglongjmp(mark, 1);
 337 }
 338
 339 int main(int argc, char *argv[])
 340 {
 341         int ret, pipefd;
 342         char logpath[PATH_MAX];
 343         sigset_t mask;
 344         char *lxcpath = argv[1];
 345         bool mainloop_opened = false;
 346         bool monitord_created = false;
 347         struct lxc_log log;
 348
 349         if (argc != 3) {
 350                 fprintf(stderr,
 351                         "Usage: lxc-monitord lxcpath sync-pipe-fd\n\n"
 352                         "NOTE: lxc-monitord is intended for use by lxc internally\n"
 353                         "      and does not need to be run by hand\n\n");
 354                 exit(EXIT_FAILURE);
 355         }
 356
 357         ret = snprintf(logpath, sizeof(logpath), "%s/lxc-monitord.log",
 358                        (strcmp(LXCPATH, lxcpath) ? lxcpath : LOGPATH));
 359         if (ret < 0 || ret >= sizeof(logpath))
 360                 exit(EXIT_FAILURE);
 361
 362         log.name = NULL;
 363         log.file = logpath;
 364         log.level = "DEBUG";
 365         log.prefix = "lxc-monitord";
 366         log.quiet = 0;
 367         log.lxcpath = lxcpath;
 368
 369         ret = lxc_log_init(&log);
 370         if (ret)
 371                 INFO("Failed to open log file %s, log will be lost", lxcpath);
 372         lxc_log_options_no_override();
 373
 374         if (lxc_safe_int(argv[2], &pipefd) < 0)
 375                 exit(EXIT_FAILURE);
 376
 377         if (sigfillset(&mask) ||
 378             sigdelset(&mask, SIGILL)  ||
 379             sigdelset(&mask, SIGSEGV) ||
 380             sigdelset(&mask, SIGBUS)  ||
 381             sigdelset(&mask, SIGTERM) ||
 382             pthread_sigmask(SIG_BLOCK, &mask, NULL)) {
 383                 SYSERROR("Failed to set signal mask");
 384                 exit(EXIT_FAILURE);
 385         }
 386
 387         signal(SIGILL,  lxc_monitord_sig_handler);
 388         signal(SIGSEGV, lxc_monitord_sig_handler);
 389         signal(SIGBUS,  lxc_monitord_sig_handler);
 390         signal(SIGTERM, lxc_monitord_sig_handler);
 391
 392         if (sigsetjmp(mark, 1) != 0)
 393                 goto on_signal;
 394
 395         ret = EXIT_FAILURE;
 396
 397         memset(&monitor, 0, sizeof(monitor));
 398         monitor.lxcpath = lxcpath;
 399         if (lxc_mainloop_open(&monitor.descr)) {
 400                 ERROR("Failed to create mainloop");
 401                 goto on_error;
 402         }
 403         mainloop_opened = true;
 404
 405         if (lxc_monitord_create(&monitor))
 406                 goto on_error;
 407         monitord_created = true;
 408
 409         /* sync with parent, we're ignoring the return from write
 410          * because regardless if it works or not, the following
 411          * close will sync us with the parent process. the
 412          * if-empty-statement construct is to quiet the
 413          * warn-unused-result warning.
 414          */
 415         if (lxc_write_nointr(pipefd, "S", 1))
 416                 ;
 417         close(pipefd);
 418
 419         if (lxc_monitord_mainloop_add(&monitor)) {
 420                 ERROR("Failed to add mainloop handlers");
 421                 goto on_error;
 422         }
 423
 424         NOTICE("lxc-monitord with pid %d is now monitoring lxcpath %s",
 425                lxc_raw_getpid(), monitor.lxcpath);
 426
 427         for (;;) {
 428                 ret = lxc_mainloop(&monitor.descr, 1000 * 30);
 429                 if (ret) {
 430                         ERROR("mainloop returned an error");
 431                         break;
 432                 }
 433
 434                 if (monitor.clientfds_cnt <= 0) {
 435                         NOTICE("No remaining clients. lxc-monitord is exiting");
 436                         break;
 437                 }
 438
 439                 if (quit == LXC_MAINLOOP_CLOSE) {
 440                         NOTICE("Got quit command. lxc-monitord is exiting");
 441                         break;
 442                 }
 443         }
 444
 445 on_signal:
 446         ret = EXIT_SUCCESS;
 447
 448 on_error:
 449         if (monitord_created)
 450                 lxc_monitord_cleanup();
 451
 452         if (mainloop_opened)
 453                 lxc_mainloop_close(&monitor.descr);
 454
 455         exit(ret);
 456 }