]> git.proxmox.com Git - mirror_lxc.git/blob - src/lxc/conf.c
projects / mirror_lxc.git / blob
? search:
summary | shortlog | log | commit | commitdiff | tree
blame | history | raw | HEAD
Merge git://github.com/lxc/lxc
[mirror_lxc.git] / src / lxc / conf.c
1 /*
2 * lxc: linux Container library
3 *
4 * (C) Copyright IBM Corp. 2007, 2008
5 *
6 * Authors:
7 * Daniel Lezcano <dlezcano at fr.ibm.com>
8 *
9 * This library is free software; you can redistribute it and/or
10 * modify it under the terms of the GNU Lesser General Public
11 * License as published by the Free Software Foundation; either
12 * version 2.1 of the License, or (at your option) any later version.
13 *
14 * This library is distributed in the hope that it will be useful,
15 * but WITHOUT ANY WARRANTY; without even the implied warranty of
16 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
17 * Lesser General Public License for more details.
18 *
19 * You should have received a copy of the GNU Lesser General Public
20 * License along with this library; if not, write to the Free Software
21 * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
22 */
23 #define _GNU_SOURCE
24 #include <stdio.h>
25 #undef _GNU_SOURCE
26 #include <stdlib.h>
27 #include <stdarg.h>
28 #include <errno.h>
29 #include <string.h>
30 #include <dirent.h>
31 #include <unistd.h>
32 #include <sys/wait.h>
33 #include <sys/syscall.h>
34
35 #if HAVE_PTY_H
36 #include <pty.h>
37 #else
38 #include <../include/openpty.h>
39 #endif
40
41 #include <linux/loop.h>
42
43 #include <sys/types.h>
44 #include <sys/utsname.h>
45 #include <sys/param.h>
46 #include <sys/stat.h>
47 #include <sys/socket.h>
48 #include <sys/mount.h>
49 #include <sys/mman.h>
50 #include <sys/prctl.h>
51
52 #include <arpa/inet.h>
53 #include <fcntl.h>
54 #include <netinet/in.h>
55 #include <net/if.h>
56 #include <libgen.h>
57
58 #include "network.h"
59 #include "error.h"
60 #include "parse.h"
61 #include "config.h"
62 #include "utils.h"
63 #include "conf.h"
64 #include "log.h"
65 #include "lxc.h" /* for lxc_cgroup_set() */
66 #include "caps.h" /* for lxc_caps_last_cap() */
67
68 #if HAVE_APPARMOR
69 #include <apparmor.h>
70 #endif
71
72 #if HAVE_SYS_CAPABILITY_H
73 #include <sys/capability.h>
74 #endif
75
76 #if HAVE_SYS_PERSONALITY_H
77 #include <sys/personality.h>
78 #endif
79
80 #if IS_BIONIC
81 #include <../include/lxcmntent.h>
82 #else
83 #include <mntent.h>
84 #endif
85
86 #include "lxcseccomp.h"
87
88 lxc_log_define(lxc_conf, lxc);
89
90 #define MAXHWLEN 18
91 #define MAXINDEXLEN 20
92 #define MAXMTULEN 16
93 #define MAXLINELEN 128
94
95 #ifndef MS_DIRSYNC
96 #define MS_DIRSYNC 128
97 #endif
98
99 #ifndef MS_REC
100 #define MS_REC 16384
101 #endif
102
103 #ifndef MNT_DETACH
104 #define MNT_DETACH 2
105 #endif
106
107 #ifndef MS_SLAVE
108 #define MS_SLAVE (1<<19)
109 #endif
110
111 #ifndef MS_RELATIME
112 #define MS_RELATIME (1 << 21)
113 #endif
114
115 #ifndef MS_STRICTATIME
116 #define MS_STRICTATIME (1 << 24)
117 #endif
118
119 #if HAVE_SYS_CAPABILITY_H
120 #ifndef CAP_SETFCAP
121 #define CAP_SETFCAP 31
122 #endif
123
124 #ifndef CAP_MAC_OVERRIDE
125 #define CAP_MAC_OVERRIDE 32
126 #endif
127
128 #ifndef CAP_MAC_ADMIN
129 #define CAP_MAC_ADMIN 33
130 #endif
131 #endif
132
133 #ifndef PR_CAPBSET_DROP
134 #define PR_CAPBSET_DROP 24
135 #endif
136
137 #ifndef LO_FLAGS_AUTOCLEAR
138 #define LO_FLAGS_AUTOCLEAR 4
139 #endif
140
141 /* Define pivot_root() if missing from the C library */
142 #ifndef HAVE_PIVOT_ROOT
143 static int pivot_root(const char * new_root, const char * put_old)
144 {
145 #ifdef __NR_pivot_root
146 return syscall(__NR_pivot_root, new_root, put_old);
147 #else
148 errno = ENOSYS;
149 return -1;
150 #endif
151 }
152 #else
153 extern int pivot_root(const char * new_root, const char * put_old);
154 #endif
155
156 /* Define sethostname() if missing from the C library */
157 #ifndef HAVE_SETHOSTNAME
158 static int sethostname(const char * name, size_t len)
159 {
160 #ifdef __NR_sethostname
161 return syscall(__NR_sethostname, name, len);
162 #else
163 errno = ENOSYS;
164 return -1;
165 #endif
166 }
167 #endif
168
169 /* Define __S_ISTYPE if missing from the C library */
170 #ifndef __S_ISTYPE
171 #define __S_ISTYPE(mode, mask) (((mode) & S_IFMT) == (mask))
172 #endif
173
174 char *lxchook_names[NUM_LXC_HOOKS] = {
175 "pre-start", "pre-mount", "mount", "autodev", "start", "post-stop" };
176
177 typedef int (*instanciate_cb)(struct lxc_handler *, struct lxc_netdev *);
178
179 struct mount_opt {
180 char *name;
181 int clear;
182 int flag;
183 };
184
185 struct caps_opt {
186 char *name;
187 int value;
188 };
189
190 static int instanciate_veth(struct lxc_handler *, struct lxc_netdev *);
191 static int instanciate_macvlan(struct lxc_handler *, struct lxc_netdev *);
192 static int instanciate_vlan(struct lxc_handler *, struct lxc_netdev *);
193 static int instanciate_phys(struct lxc_handler *, struct lxc_netdev *);
194 static int instanciate_empty(struct lxc_handler *, struct lxc_netdev *);
195
196 static instanciate_cb netdev_conf[LXC_NET_MAXCONFTYPE + 1] = {
197 [LXC_NET_VETH] = instanciate_veth,
198 [LXC_NET_MACVLAN] = instanciate_macvlan,
199 [LXC_NET_VLAN] = instanciate_vlan,
200 [LXC_NET_PHYS] = instanciate_phys,
201 [LXC_NET_EMPTY] = instanciate_empty,
202 };
203
204 static int shutdown_veth(struct lxc_handler *, struct lxc_netdev *);
205 static int shutdown_macvlan(struct lxc_handler *, struct lxc_netdev *);
206 static int shutdown_vlan(struct lxc_handler *, struct lxc_netdev *);
207 static int shutdown_phys(struct lxc_handler *, struct lxc_netdev *);
208 static int shutdown_empty(struct lxc_handler *, struct lxc_netdev *);
209
210 static instanciate_cb netdev_deconf[LXC_NET_MAXCONFTYPE + 1] = {
211 [LXC_NET_VETH] = shutdown_veth,
212 [LXC_NET_MACVLAN] = shutdown_macvlan,
213 [LXC_NET_VLAN] = shutdown_vlan,
214 [LXC_NET_PHYS] = shutdown_phys,
215 [LXC_NET_EMPTY] = shutdown_empty,
216 };
217
218 static struct mount_opt mount_opt[] = {
219 { "defaults", 0, 0 },
220 { "ro", 0, MS_RDONLY },
221 { "rw", 1, MS_RDONLY },
222 { "suid", 1, MS_NOSUID },
223 { "nosuid", 0, MS_NOSUID },
224 { "dev", 1, MS_NODEV },
225 { "nodev", 0, MS_NODEV },
226 { "exec", 1, MS_NOEXEC },
227 { "noexec", 0, MS_NOEXEC },
228 { "sync", 0, MS_SYNCHRONOUS },
229 { "async", 1, MS_SYNCHRONOUS },
230 { "dirsync", 0, MS_DIRSYNC },
231 { "remount", 0, MS_REMOUNT },
232 { "mand", 0, MS_MANDLOCK },
233 { "nomand", 1, MS_MANDLOCK },
234 { "atime", 1, MS_NOATIME },
235 { "noatime", 0, MS_NOATIME },
236 { "diratime", 1, MS_NODIRATIME },
237 { "nodiratime", 0, MS_NODIRATIME },
238 { "bind", 0, MS_BIND },
239 { "rbind", 0, MS_BIND|MS_REC },
240 { "relatime", 0, MS_RELATIME },
241 { "norelatime", 1, MS_RELATIME },
242 { "strictatime", 0, MS_STRICTATIME },
243 { "nostrictatime", 1, MS_STRICTATIME },
244 { NULL, 0, 0 },
245 };
246
247 #if HAVE_SYS_CAPABILITY_H
248 static struct caps_opt caps_opt[] = {
249 { "chown", CAP_CHOWN },
250 { "dac_override", CAP_DAC_OVERRIDE },
251 { "dac_read_search", CAP_DAC_READ_SEARCH },
252 { "fowner", CAP_FOWNER },
253 { "fsetid", CAP_FSETID },
254 { "kill", CAP_KILL },
255 { "setgid", CAP_SETGID },
256 { "setuid", CAP_SETUID },
257 { "setpcap", CAP_SETPCAP },
258 { "linux_immutable", CAP_LINUX_IMMUTABLE },
259 { "net_bind_service", CAP_NET_BIND_SERVICE },
260 { "net_broadcast", CAP_NET_BROADCAST },
261 { "net_admin", CAP_NET_ADMIN },
262 { "net_raw", CAP_NET_RAW },
263 { "ipc_lock", CAP_IPC_LOCK },
264 { "ipc_owner", CAP_IPC_OWNER },
265 { "sys_module", CAP_SYS_MODULE },
266 { "sys_rawio", CAP_SYS_RAWIO },
267 { "sys_chroot", CAP_SYS_CHROOT },
268 { "sys_ptrace", CAP_SYS_PTRACE },
269 { "sys_pacct", CAP_SYS_PACCT },
270 { "sys_admin", CAP_SYS_ADMIN },
271 { "sys_boot", CAP_SYS_BOOT },
272 { "sys_nice", CAP_SYS_NICE },
273 { "sys_resource", CAP_SYS_RESOURCE },
274 { "sys_time", CAP_SYS_TIME },
275 { "sys_tty_config", CAP_SYS_TTY_CONFIG },
276 { "mknod", CAP_MKNOD },
277 { "lease", CAP_LEASE },
278 #ifdef CAP_AUDIT_WRITE
279 { "audit_write", CAP_AUDIT_WRITE },
280 #endif
281 #ifdef CAP_AUDIT_CONTROL
282 { "audit_control", CAP_AUDIT_CONTROL },
283 #endif
284 { "setfcap", CAP_SETFCAP },
285 { "mac_override", CAP_MAC_OVERRIDE },
286 { "mac_admin", CAP_MAC_ADMIN },
287 #ifdef CAP_SYSLOG
288 { "syslog", CAP_SYSLOG },
289 #endif
290 #ifdef CAP_WAKE_ALARM
291 { "wake_alarm", CAP_WAKE_ALARM },
292 #endif
293 };
294 #else
295 static struct caps_opt caps_opt[] = {};
296 #endif
297
298 static int run_buffer(char *buffer)
299 {
300 FILE *f;
301 char *output;
302
303 f = popen(buffer, "r");
304 if (!f) {
305 SYSERROR("popen failed");
306 return -1;
307 }
308
309 output = malloc(LXC_LOG_BUFFER_SIZE);
310 if (!output) {
311 ERROR("failed to allocate memory for script output");
312 return -1;
313 }
314
315 while(fgets(output, LXC_LOG_BUFFER_SIZE, f))
316 DEBUG("script output: %s", output);
317
318 free(output);
319
320 if (pclose(f) == -1) {
321 SYSERROR("Script exited on error");
322 return -1;
323 }
324
325 return 0;
326 }
327
328 static int run_script(const char *name, const char *section,
329 const char *script, ...)
330 {
331 int ret;
332 char *buffer, *p;
333 size_t size = 0;
334 va_list ap;
335
336 INFO("Executing script '%s' for container '%s', config section '%s'",
337 script, name, section);
338
339 va_start(ap, script);
340 while ((p = va_arg(ap, char *)))
341 size += strlen(p) + 1;
342 va_end(ap);
343
344 size += strlen(script);
345 size += strlen(name);
346 size += strlen(section);
347 size += 3;
348
349 if (size > INT_MAX)
350 return -1;
351
352 buffer = alloca(size);
353 if (!buffer) {
354 ERROR("failed to allocate memory");
355 return -1;
356 }
357
358 ret = snprintf(buffer, size, "%s %s %s", script, name, section);
359 if (ret < 0 || ret >= size) {
360 ERROR("Script name too long");
361 free(buffer);
362 return -1;
363 }
364
365 va_start(ap, script);
366 while ((p = va_arg(ap, char *))) {
367 int len = size-ret;
368 int rc;
369 rc = snprintf(buffer + ret, len, " %s", p);
370 if (rc < 0 || rc >= len) {
371 free(buffer);
372 ERROR("Script args too long");
373 return -1;
374 }
375 ret += rc;
376 }
377 va_end(ap);
378
379 return run_buffer(buffer);
380 }
381
382 static int find_fstype_cb(char* buffer, void *data)
383 {
384 struct cbarg {
385 const char *rootfs;
386 const char *target;
387 int mntopt;
388 } *cbarg = data;
389
390 char *fstype;
391
392 /* we don't try 'nodev' entries */
393 if (strstr(buffer, "nodev"))
394 return 0;
395
396 fstype = buffer;
397 fstype += lxc_char_left_gc(fstype, strlen(fstype));
398 fstype[lxc_char_right_gc(fstype, strlen(fstype))] = '\0';
399
400 DEBUG("trying to mount '%s'->'%s' with fstype '%s'",
401 cbarg->rootfs, cbarg->target, fstype);
402
403 if (mount(cbarg->rootfs, cbarg->target, fstype, cbarg->mntopt, NULL)) {
404 DEBUG("mount failed with error: %s", strerror(errno));
405 return 0;
406 }
407
408 INFO("mounted '%s' on '%s', with fstype '%s'",
409 cbarg->rootfs, cbarg->target, fstype);
410
411 return 1;
412 }
413
414 static int mount_unknow_fs(const char *rootfs, const char *target, int mntopt)
415 {
416 int i;
417
418 struct cbarg {
419 const char *rootfs;
420 const char *target;
421 int mntopt;
422 } cbarg = {
423 .rootfs = rootfs,
424 .target = target,
425 .mntopt = mntopt,
426 };
427
428 /*
429 * find the filesystem type with brute force:
430 * first we check with /etc/filesystems, in case the modules
431 * are auto-loaded and fall back to the supported kernel fs
432 */
433 char *fsfile[] = {
434 "/etc/filesystems",
435 "/proc/filesystems",
436 };
437
438 for (i = 0; i < sizeof(fsfile)/sizeof(fsfile[0]); i++) {
439
440 int ret;
441
442 if (access(fsfile[i], F_OK))
443 continue;
444
445 ret = lxc_file_for_each_line(fsfile[i], find_fstype_cb, &cbarg);
446 if (ret < 0) {
447 ERROR("failed to parse '%s'", fsfile[i]);
448 return -1;
449 }
450
451 if (ret)
452 return 0;
453 }
454
455 ERROR("failed to determine fs type for '%s'", rootfs);
456 return -1;
457 }
458
459 static int mount_rootfs_dir(const char *rootfs, const char *target)
460 {
461 return mount(rootfs, target, "none", MS_BIND | MS_REC, NULL);
462 }
463
464 static int setup_lodev(const char *rootfs, int fd, struct loop_info64 *loinfo)
465 {
466 int rfd;
467 int ret = -1;
468
469 rfd = open(rootfs, O_RDWR);
470 if (rfd < 0) {
471 SYSERROR("failed to open '%s'", rootfs);
472 return -1;
473 }
474
475 memset(loinfo, 0, sizeof(*loinfo));
476
477 loinfo->lo_flags = LO_FLAGS_AUTOCLEAR;
478
479 if (ioctl(fd, LOOP_SET_FD, rfd)) {
480 SYSERROR("failed to LOOP_SET_FD");
481 goto out;
482 }
483
484 if (ioctl(fd, LOOP_SET_STATUS64, loinfo)) {
485 SYSERROR("failed to LOOP_SET_STATUS64");
486 goto out;
487 }
488
489 ret = 0;
490 out:
491 close(rfd);
492
493 return ret;
494 }
495
496 static int mount_rootfs_file(const char *rootfs, const char *target)
497 {
498 struct dirent dirent, *direntp;
499 struct loop_info64 loinfo;
500 int ret = -1, fd = -1, rc;
501 DIR *dir;
502 char path[MAXPATHLEN];
503
504 dir = opendir("/dev");
505 if (!dir) {
506 SYSERROR("failed to open '/dev'");
507 return -1;
508 }
509
510 while (!readdir_r(dir, &dirent, &direntp)) {
511
512 if (!direntp)
513 break;
514
515 if (!strcmp(direntp->d_name, "."))
516 continue;
517
518 if (!strcmp(direntp->d_name, ".."))
519 continue;
520
521 if (strncmp(direntp->d_name, "loop", 4))
522 continue;
523
524 rc = snprintf(path, MAXPATHLEN, "/dev/%s", direntp->d_name);
525 if (rc < 0 || rc >= MAXPATHLEN)
526 continue;
527
528 fd = open(path, O_RDWR);
529 if (fd < 0)
530 continue;
531
532 if (ioctl(fd, LOOP_GET_STATUS64, &loinfo) == 0) {
533 close(fd);
534 continue;
535 }
536
537 if (errno != ENXIO) {
538 WARN("unexpected error for ioctl on '%s': %m",
539 direntp->d_name);
540 continue;
541 }
542
543 DEBUG("found '%s' free lodev", path);
544
545 ret = setup_lodev(rootfs, fd, &loinfo);
546 if (!ret)
547 ret = mount_unknow_fs(path, target, 0);
548 close(fd);
549
550 break;
551 }
552
553 if (closedir(dir))
554 WARN("failed to close directory");
555
556 return ret;
557 }
558
559 static int mount_rootfs_block(const char *rootfs, const char *target)
560 {
561 return mount_unknow_fs(rootfs, target, 0);
562 }
563
564 /*
565 * pin_rootfs
566 * if rootfs is a directory, then open ${rootfs}.hold for writing for the
567 * duration of the container run, to prevent the container from marking the
568 * underlying fs readonly on shutdown.
569 * return -1 on error.
570 * return -2 if nothing needed to be pinned.
571 * return an open fd (>=0) if we pinned it.
572 */
573 int pin_rootfs(const char *rootfs)
574 {
575 char absrootfs[MAXPATHLEN];
576 char absrootfspin[MAXPATHLEN];
577 struct stat s;
578 int ret, fd;
579
580 if (rootfs == NULL || strlen(rootfs) == 0)
581 return 0;
582
583 if (!realpath(rootfs, absrootfs)) {
584 SYSERROR("failed to get real path for '%s'", rootfs);
585 return -1;
586 }
587
588 if (access(absrootfs, F_OK)) {
589 SYSERROR("'%s' is not accessible", absrootfs);
590 return -1;
591 }
592
593 if (stat(absrootfs, &s)) {
594 SYSERROR("failed to stat '%s'", absrootfs);
595 return -1;
596 }
597
598 if (!S_ISDIR(s.st_mode))
599 return -2;
600
601 ret = snprintf(absrootfspin, MAXPATHLEN, "%s%s", absrootfs, ".hold");
602 if (ret >= MAXPATHLEN) {
603 SYSERROR("pathname too long for rootfs hold file");
604 return -1;
605 }
606
607 fd = open(absrootfspin, O_CREAT | O_RDWR, S_IWUSR|S_IRUSR);
608 INFO("opened %s as fd %d\n", absrootfspin, fd);
609 return fd;
610 }
611
612 static int mount_rootfs(const char *rootfs, const char *target)
613 {
614 char absrootfs[MAXPATHLEN];
615 struct stat s;
616 int i;
617
618 typedef int (*rootfs_cb)(const char *, const char *);
619
620 struct rootfs_type {
621 int type;
622 rootfs_cb cb;
623 } rtfs_type[] = {
624 { S_IFDIR, mount_rootfs_dir },
625 { S_IFBLK, mount_rootfs_block },
626 { S_IFREG, mount_rootfs_file },
627 };
628
629 if (!realpath(rootfs, absrootfs)) {
630 SYSERROR("failed to get real path for '%s'", rootfs);
631 return -1;
632 }
633
634 if (access(absrootfs, F_OK)) {
635 SYSERROR("'%s' is not accessible", absrootfs);
636 return -1;
637 }
638
639 if (stat(absrootfs, &s)) {
640 SYSERROR("failed to stat '%s'", absrootfs);
641 return -1;
642 }
643
644 for (i = 0; i < sizeof(rtfs_type)/sizeof(rtfs_type[0]); i++) {
645
646 if (!__S_ISTYPE(s.st_mode, rtfs_type[i].type))
647 continue;
648
649 return rtfs_type[i].cb(absrootfs, target);
650 }
651
652 ERROR("unsupported rootfs type for '%s'", absrootfs);
653 return -1;
654 }
655
656 static int setup_utsname(struct utsname *utsname)
657 {
658 if (!utsname)
659 return 0;
660
661 if (sethostname(utsname->nodename, strlen(utsname->nodename))) {
662 SYSERROR("failed to set the hostname to '%s'", utsname->nodename);
663 return -1;
664 }
665
666 INFO("'%s' hostname has been setup", utsname->nodename);
667
668 return 0;
669 }
670
671 static int setup_tty(const struct lxc_rootfs *rootfs,
672 const struct lxc_tty_info *tty_info, char *ttydir)
673 {
674 char path[MAXPATHLEN], lxcpath[MAXPATHLEN];
675 int i, ret;
676
677 if (!rootfs->path)
678 return 0;
679
680 for (i = 0; i < tty_info->nbtty; i++) {
681
682 struct lxc_pty_info *pty_info = &tty_info->pty_info[i];
683
684 ret = snprintf(path, sizeof(path), "%s/dev/tty%d",
685 rootfs->mount, i + 1);
686 if (ret >= sizeof(path)) {
687 ERROR("pathname too long for ttys");
688 return -1;
689 }
690 if (ttydir) {
691 /* create dev/lxc/tty%d" */
692 ret = snprintf(lxcpath, sizeof(lxcpath), "%s/dev/%s/tty%d",
693 rootfs->mount, ttydir, i + 1);
694 if (ret >= sizeof(lxcpath)) {
695 ERROR("pathname too long for ttys");
696 return -1;
697 }
698 ret = creat(lxcpath, 0660);
699 if (ret==-1 && errno != EEXIST) {
700 SYSERROR("error creating %s\n", lxcpath);
701 return -1;
702 }
703 close(ret);
704 ret = unlink(path);
705 if (ret && errno != ENOENT) {
706 SYSERROR("error unlinking %s\n", path);
707 return -1;
708 }
709
710 if (mount(pty_info->name, lxcpath, "none", MS_BIND, 0)) {
711 WARN("failed to mount '%s'->'%s'",
712 pty_info->name, path);
713 continue;
714 }
715
716 ret = snprintf(lxcpath, sizeof(lxcpath), "%s/tty%d", ttydir, i+1);
717 if (ret >= sizeof(lxcpath)) {
718 ERROR("tty pathname too long");
719 return -1;
720 }
721 ret = symlink(lxcpath, path);
722 if (ret) {
723 SYSERROR("failed to create symlink for tty %d\n", i+1);
724 return -1;
725 }
726 } else {
727 /* If we populated /dev, then we need to create /dev/ttyN */
728 if (access(path, F_OK)) {
729 ret = creat(path, 0660);
730 if (ret==-1) {
731 SYSERROR("error creating %s\n", path);
732 /* this isn't fatal, continue */
733 } else
734 close(ret);
735 }
736 if (mount(pty_info->name, path, "none", MS_BIND, 0)) {
737 WARN("failed to mount '%s'->'%s'",
738 pty_info->name, path);
739 continue;
740 }
741 }
742 }
743
744 INFO("%d tty(s) has been setup", tty_info->nbtty);
745
746 return 0;
747 }
748
749 static int setup_rootfs_pivot_root_cb(char *buffer, void *data)
750 {
751 struct lxc_list *mountlist, *listentry, *iterator;
752 char *pivotdir, *mountpoint, *mountentry;
753 int found;
754 void **cbparm;
755
756 mountentry = buffer;
757 cbparm = (void **)data;
758
759 mountlist = cbparm[0];
760 pivotdir = cbparm[1];
761
762 /* parse entry, first field is mountname, ignore */
763 mountpoint = strtok(mountentry, " ");
764 if (!mountpoint)
765 return -1;
766
767 /* second field is mountpoint */
768 mountpoint = strtok(NULL, " ");
769 if (!mountpoint)
770 return -1;
771
772 /* only consider mountpoints below old root fs */
773 if (strncmp(mountpoint, pivotdir, strlen(pivotdir)))
774 return 0;
775
776 /* filter duplicate mountpoints */
777 found = 0;
778 lxc_list_for_each(iterator, mountlist) {
779 if (!strcmp(iterator->elem, mountpoint)) {
780 found = 1;
781 break;
782 }
783 }
784 if (found)
785 return 0;
786
787 /* add entry to list */
788 listentry = malloc(sizeof(*listentry));
789 if (!listentry) {
790 SYSERROR("malloc for mountpoint listentry failed");
791 return -1;
792 }
793
794 listentry->elem = strdup(mountpoint);
795 if (!listentry->elem) {
796 SYSERROR("strdup failed");
797 return -1;
798 }
799 lxc_list_add_tail(mountlist, listentry);
800
801 return 0;
802 }
803
804 static int umount_oldrootfs(const char *oldrootfs)
805 {
806 char path[MAXPATHLEN];
807 void *cbparm[2];
808 struct lxc_list mountlist, *iterator, *next;
809 int ok, still_mounted, last_still_mounted;
810 int rc;
811
812 /* read and parse /proc/mounts in old root fs */
813 lxc_list_init(&mountlist);
814
815 /* oldrootfs is on the top tree directory now */
816 rc = snprintf(path, sizeof(path), "/%s", oldrootfs);
817 if (rc >= sizeof(path)) {
818 ERROR("rootfs name too long");
819 return -1;
820 }
821 cbparm[0] = &mountlist;
822
823 cbparm[1] = strdup(path);
824 if (!cbparm[1]) {
825 SYSERROR("strdup failed");
826 return -1;
827 }
828
829 rc = snprintf(path, sizeof(path), "%s/proc/mounts", oldrootfs);
830 if (rc >= sizeof(path)) {
831 ERROR("container proc/mounts name too long");
832 return -1;
833 }
834
835 ok = lxc_file_for_each_line(path,
836 setup_rootfs_pivot_root_cb, &cbparm);
837 if (ok < 0) {
838 SYSERROR("failed to read or parse mount list '%s'", path);
839 return -1;
840 }
841
842 /* umount filesystems until none left or list no longer shrinks */
843 still_mounted = 0;
844 do {
845 last_still_mounted = still_mounted;
846 still_mounted = 0;
847
848 lxc_list_for_each_safe(iterator, &mountlist, next) {
849
850 /* umount normally */
851 if (!umount(iterator->elem)) {
852 DEBUG("umounted '%s'", (char *)iterator->elem);
853 lxc_list_del(iterator);
854 continue;
855 }
856
857 still_mounted++;
858 }
859
860 } while (still_mounted > 0 && still_mounted != last_still_mounted);
861
862
863 lxc_list_for_each(iterator, &mountlist) {
864
865 /* let's try a lazy umount */
866 if (!umount2(iterator->elem, MNT_DETACH)) {
867 INFO("lazy unmount of '%s'", (char *)iterator->elem);
868 continue;
869 }
870
871 /* be more brutal (nfs) */
872 if (!umount2(iterator->elem, MNT_FORCE)) {
873 INFO("forced unmount of '%s'", (char *)iterator->elem);
874 continue;
875 }
876
877 WARN("failed to unmount '%s'", (char *)iterator->elem);
878 }
879
880 return 0;
881 }
882
883 static int setup_rootfs_pivot_root(const char *rootfs, const char *pivotdir)
884 {
885 char path[MAXPATHLEN];
886 int remove_pivotdir = 0;
887 int rc;
888
889 /* change into new root fs */
890 if (chdir(rootfs)) {
891 SYSERROR("can't chdir to new rootfs '%s'", rootfs);
892 return -1;
893 }
894
895 if (!pivotdir)
896 pivotdir = "lxc_putold";
897
898 /* compute the full path to pivotdir under rootfs */
899 rc = snprintf(path, sizeof(path), "%s/%s", rootfs, pivotdir);
900 if (rc >= sizeof(path)) {
901 ERROR("pivot dir name too long");
902 return -1;
903 }
904
905 if (access(path, F_OK)) {
906
907 if (mkdir_p(path, 0755)) {
908 SYSERROR("failed to create pivotdir '%s'", path);
909 return -1;
910 }
911
912 remove_pivotdir = 1;
913 DEBUG("created '%s' directory", path);
914 }
915
916 DEBUG("mountpoint for old rootfs is '%s'", path);
917
918 /* pivot_root into our new root fs */
919 if (pivot_root(".", path)) {
920 SYSERROR("pivot_root syscall failed");
921 return -1;
922 }
923
924 if (chdir("/")) {
925 SYSERROR("can't chdir to / after pivot_root");
926 return -1;
927 }
928
929 DEBUG("pivot_root syscall to '%s' successful", rootfs);
930
931 /* we switch from absolute path to relative path */
932 if (umount_oldrootfs(pivotdir))
933 return -1;
934
935 /* remove temporary mount point, we don't consider the removing
936 * as fatal */
937 if (remove_pivotdir && rmdir(pivotdir))
938 WARN("can't remove mountpoint '%s': %m", pivotdir);
939
940 return 0;
941 }
942
943 /*
944 * Do we want to add options for max size of /dev and a file to
945 * specify which devices to create?
946 */
947 static int mount_autodev(char *root)
948 {
949 int ret;
950 char path[MAXPATHLEN];
951
952 INFO("Mounting /dev under %s\n", root);
953 ret = snprintf(path, MAXPATHLEN, "%s/dev", root);
954 if (ret < 0 || ret > MAXPATHLEN)
955 return -1;
956 ret = mount("none", path, "tmpfs", 0, "size=100000");
957 if (ret) {
958 SYSERROR("Failed to mount /dev at %s\n", root);
959 return -1;
960 }
961 ret = snprintf(path, MAXPATHLEN, "%s/dev/pts", root);
962 if (ret < 0 || ret >= MAXPATHLEN)
963 return -1;
964 ret = mkdir(path, S_IRWXU | S_IRGRP | S_IXGRP | S_IROTH | S_IXOTH);
965 if (ret) {
966 SYSERROR("Failed to create /dev/pts in container");
967 return -1;
968 }
969
970 INFO("Mounted /dev under %s\n", root);
971 return 0;
972 }
973
974 struct lxc_devs {
975 char *name;
976 mode_t mode;
977 int maj;
978 int min;
979 };
980
981 struct lxc_devs lxc_devs[] = {
982 { "null", S_IFCHR | S_IRWXU | S_IRWXG | S_IRWXO, 1, 3 },
983 { "zero", S_IFCHR | S_IRWXU | S_IRWXG | S_IRWXO, 1, 5 },
984 { "full", S_IFCHR | S_IRWXU | S_IRWXG | S_IRWXO, 1, 7 },
985 { "urandom", S_IFCHR | S_IRWXU | S_IRWXG | S_IRWXO, 1, 9 },
986 { "random", S_IFCHR | S_IRWXU | S_IRWXG | S_IRWXO, 1, 8 },
987 { "tty", S_IFCHR | S_IRWXU | S_IRWXG | S_IRWXO, 5, 0 },
988 { "console", S_IFCHR | S_IRUSR | S_IWUSR, 5, 1 },
989 };
990
991 static int setup_autodev(char *root)
992 {
993 int ret;
994 struct lxc_devs *d;
995 char path[MAXPATHLEN];
996 int i;
997 mode_t cmask;
998
999 INFO("Creating initial consoles under %s/dev\n", root);
1000
1001 ret = snprintf(path, MAXPATHLEN, "%s/dev", root);
1002 if (ret < 0 || ret >= MAXPATHLEN) {
1003 ERROR("Error calculating container /dev location");
1004 return -1;
1005 }
1006
1007 INFO("Populating /dev under %s\n", root);
1008 cmask = umask(S_IXUSR | S_IXGRP | S_IXOTH);
1009 for (i = 0; i < sizeof(lxc_devs) / sizeof(lxc_devs[0]); i++) {
1010 d = &lxc_devs[i];
1011 ret = snprintf(path, MAXPATHLEN, "%s/dev/%s", root, d->name);
1012 if (ret < 0 || ret >= MAXPATHLEN)
1013 return -1;
1014 ret = mknod(path, d->mode, makedev(d->maj, d->min));
1015 if (ret && errno != EEXIST) {
1016 SYSERROR("Error creating %s\n", d->name);
1017 return -1;
1018 }
1019 }
1020 umask(cmask);
1021
1022 INFO("Populated /dev under %s\n", root);
1023 return 0;
1024 }
1025
1026 /*
1027 * Detect whether / is mounted MS_SHARED. The only way I know of to
1028 * check that is through /proc/self/mountinfo.
1029 * I'm only checking for /. If the container rootfs or mount location
1030 * is MS_SHARED, but not '/', then you're out of luck - figuring that
1031 * out would be too much work to be worth it.
1032 */
1033 #define LINELEN 4096
1034 int detect_shared_rootfs(void)
1035 {
1036 char buf[LINELEN], *p;
1037 FILE *f;
1038 int i;
1039 char *p2;
1040
1041 f = fopen("/proc/self/mountinfo", "r");
1042 if (!f)
1043 return 0;
1044 while ((p = fgets(buf, LINELEN, f))) {
1045 INFO("looking at .%s.", p);
1046 for (p = buf, i=0; p && i < 4; i++)
1047 p = index(p+1, ' ');
1048 if (!p)
1049 continue;
1050 p2 = index(p+1, ' ');
1051 if (!p2)
1052 continue;
1053 *p2 = '\0';
1054 INFO("now p is .%s.", p);
1055 if (strcmp(p+1, "/") == 0) {
1056 // this is '/'. is it shared?
1057 p = index(p2+1, ' ');
1058 if (strstr(p, "shared:"))
1059 return 1;
1060 }
1061 }
1062 fclose(f);
1063 return 0;
1064 }
1065
1066 /*
1067 * I'll forgive you for asking whether all of this is needed :) The
1068 * answer is yes.
1069 * pivot_root will fail if the new root, the put_old dir, or the parent
1070 * of current->fs->root are MS_SHARED. (parent of current->fs_root may
1071 * or may not be current->fs_root - if we assumed it always was, we could
1072 * just mount --make-rslave /). So,
1073 * 1. mount a tiny tmpfs to be parent of current->fs->root.
1074 * 2. make that MS_SLAVE
1075 * 3. make a 'root' directory under that
1076 * 4. mount --rbind / under the $tinyroot/root.
1077 * 5. make that rslave
1078 * 6. chdir and chroot into $tinyroot/root
1079 * 7. $tinyroot will be unmounted by our parent in start.c
1080 */
1081 static int chroot_into_slave(struct lxc_conf *conf)
1082 {
1083 char path[MAXPATHLEN];
1084 const char *destpath = conf->rootfs.mount;
1085 int ret;
1086
1087 if (mount(destpath, destpath, NULL, MS_BIND, 0)) {
1088 SYSERROR("failed to mount %s bind", destpath);
1089 return -1;
1090 }
1091 if (mount("", destpath, NULL, MS_SLAVE, 0)) {
1092 SYSERROR("failed to make %s slave", destpath);
1093 return -1;
1094 }
1095 if (mount("none", destpath, "tmpfs", 0, "size=10000")) {
1096 SYSERROR("Failed to mount tmpfs / at %s", destpath);
1097 return -1;
1098 }
1099 ret = snprintf(path, MAXPATHLEN, "%s/root", destpath);
1100 if (ret < 0 || ret >= MAXPATHLEN) {
1101 ERROR("out of memory making root path");
1102 return -1;
1103 }
1104 if (mkdir(path, S_IRWXU | S_IRGRP | S_IXGRP | S_IROTH | S_IXOTH)) {
1105 SYSERROR("Failed to create /dev/pts in container");
1106 return -1;
1107 }
1108 if (mount("/", path, NULL, MS_BIND|MS_REC, 0)) {
1109 SYSERROR("Failed to rbind mount / to %s", path);
1110 return -1;
1111 }
1112 if (mount("", destpath, NULL, MS_SLAVE|MS_REC, 0)) {
1113 SYSERROR("Failed to make tmp-/ at %s rslave", path);
1114 return -1;
1115 }
1116 if (chdir(path)) {
1117 SYSERROR("Failed to chdir into tmp-/");
1118 return -1;
1119 }
1120 if (chroot(path)) {
1121 SYSERROR("Failed to chroot into tmp-/");
1122 return -1;
1123 }
1124 INFO("Chrooted into tmp-/ at %s\n", path);
1125 return 0;
1126 }
1127
1128 static int setup_rootfs(struct lxc_conf *conf)
1129 {
1130 const struct lxc_rootfs *rootfs = &conf->rootfs;
1131
1132 if (!rootfs->path)
1133 return 0;
1134
1135 if (access(rootfs->mount, F_OK)) {
1136 SYSERROR("failed to access to '%s', check it is present",
1137 rootfs->mount);
1138 return -1;
1139 }
1140
1141 if (detect_shared_rootfs()) {
1142 if (chroot_into_slave(conf)) {
1143 ERROR("Failed to chroot into slave /");
1144 return -1;
1145 }
1146 }
1147
1148 if (mount_rootfs(rootfs->path, rootfs->mount)) {
1149 ERROR("failed to mount rootfs");
1150 return -1;
1151 }
1152
1153 DEBUG("mounted '%s' on '%s'", rootfs->path, rootfs->mount);
1154
1155 return 0;
1156 }
1157
1158 int setup_pivot_root(const struct lxc_rootfs *rootfs)
1159 {
1160 if (!rootfs->path)
1161 return 0;
1162
1163 if (setup_rootfs_pivot_root(rootfs->mount, rootfs->pivot)) {
1164 ERROR("failed to setup pivot root");
1165 return -1;
1166 }
1167
1168 return 0;
1169 }
1170
1171 static int setup_pts(int pts)
1172 {
1173 char target[PATH_MAX];
1174
1175 if (!pts)
1176 return 0;
1177
1178 if (!access("/dev/pts/ptmx", F_OK) && umount("/dev/pts")) {
1179 SYSERROR("failed to umount 'dev/pts'");
1180 return -1;
1181 }
1182
1183 if (mount("devpts", "/dev/pts", "devpts", MS_MGC_VAL,
1184 "newinstance,ptmxmode=0666")) {
1185 SYSERROR("failed to mount a new instance of '/dev/pts'");
1186 return -1;
1187 }
1188
1189 if (access("/dev/ptmx", F_OK)) {
1190 if (!symlink("/dev/pts/ptmx", "/dev/ptmx"))
1191 goto out;
1192 SYSERROR("failed to symlink '/dev/pts/ptmx'->'/dev/ptmx'");
1193 return -1;
1194 }
1195
1196 if (realpath("/dev/ptmx", target) && !strcmp(target, "/dev/pts/ptmx"))
1197 goto out;
1198
1199 /* fallback here, /dev/pts/ptmx exists just mount bind */
1200 if (mount("/dev/pts/ptmx", "/dev/ptmx", "none", MS_BIND, 0)) {
1201 SYSERROR("mount failed '/dev/pts/ptmx'->'/dev/ptmx'");
1202 return -1;
1203 }
1204
1205 INFO("created new pts instance");
1206
1207 out:
1208 return 0;
1209 }
1210
1211 static int setup_personality(int persona)
1212 {
1213 #if HAVE_SYS_PERSONALITY_H
1214 if (persona == -1)
1215 return 0;
1216
1217 if (personality(persona) < 0) {
1218 SYSERROR("failed to set personality to '0x%x'", persona);
1219 return -1;
1220 }
1221
1222 INFO("set personality to '0x%x'", persona);
1223 #endif
1224
1225 return 0;
1226 }
1227
1228 static int setup_dev_console(const struct lxc_rootfs *rootfs,
1229 const struct lxc_console *console)
1230 {
1231 char path[MAXPATHLEN];
1232 struct stat s;
1233 int ret;
1234
1235 ret = snprintf(path, sizeof(path), "%s/dev/console", rootfs->mount);
1236 if (ret >= sizeof(path)) {
1237 ERROR("console path too long\n");
1238 return -1;
1239 }
1240
1241 if (access(path, F_OK)) {
1242 WARN("rootfs specified but no console found at '%s'", path);
1243 return 0;
1244 }
1245
1246 if (console->peer == -1) {
1247 INFO("no console output required");
1248 return 0;
1249 }
1250
1251 if (stat(path, &s)) {
1252 SYSERROR("failed to stat '%s'", path);
1253 return -1;
1254 }
1255
1256 if (chmod(console->name, s.st_mode)) {
1257 SYSERROR("failed to set mode '0%o' to '%s'",
1258 s.st_mode, console->name);
1259 return -1;
1260 }
1261
1262 if (mount(console->name, path, "none", MS_BIND, 0)) {
1263 ERROR("failed to mount '%s' on '%s'", console->name, path);
1264 return -1;
1265 }
1266
1267 INFO("console has been setup");
1268 return 0;
1269 }
1270
1271 static int setup_ttydir_console(const struct lxc_rootfs *rootfs,
1272 const struct lxc_console *console,
1273 char *ttydir)
1274 {
1275 char path[MAXPATHLEN], lxcpath[MAXPATHLEN];
1276 int ret;
1277
1278 /* create rootfs/dev/<ttydir> directory */
1279 ret = snprintf(path, sizeof(path), "%s/dev/%s", rootfs->mount,
1280 ttydir);
1281 if (ret >= sizeof(path))
1282 return -1;
1283 ret = mkdir(path, 0755);
1284 if (ret && errno != EEXIST) {
1285 SYSERROR("failed with errno %d to create %s\n", errno, path);
1286 return -1;
1287 }
1288 INFO("created %s\n", path);
1289
1290 ret = snprintf(lxcpath, sizeof(lxcpath), "%s/dev/%s/console",
1291 rootfs->mount, ttydir);
1292 if (ret >= sizeof(lxcpath)) {
1293 ERROR("console path too long\n");
1294 return -1;
1295 }
1296
1297 snprintf(path, sizeof(path), "%s/dev/console", rootfs->mount);
1298 ret = unlink(path);
1299 if (ret && errno != ENOENT) {
1300 SYSERROR("error unlinking %s\n", path);
1301 return -1;
1302 }
1303
1304 ret = creat(lxcpath, 0660);
1305 if (ret==-1 && errno != EEXIST) {
1306 SYSERROR("error %d creating %s\n", errno, lxcpath);
1307 return -1;
1308 }
1309 close(ret);
1310
1311 if (console->peer == -1) {
1312 INFO("no console output required");
1313 return 0;
1314 }
1315
1316 if (mount(console->name, lxcpath, "none", MS_BIND, 0)) {
1317 ERROR("failed to mount '%s' on '%s'", console->name, lxcpath);
1318 return -1;
1319 }
1320
1321 /* create symlink from rootfs/dev/console to 'lxc/console' */
1322 ret = snprintf(lxcpath, sizeof(lxcpath), "%s/console", ttydir);
1323 if (ret >= sizeof(lxcpath)) {
1324 ERROR("lxc/console path too long");
1325 return -1;
1326 }
1327 ret = symlink(lxcpath, path);
1328 if (ret) {
1329 SYSERROR("failed to create symlink for console");
1330 return -1;
1331 }
1332
1333 INFO("console has been setup on %s", lxcpath);
1334
1335 return 0;
1336 }
1337
1338 static int setup_console(const struct lxc_rootfs *rootfs,
1339 const struct lxc_console *console,
1340 char *ttydir)
1341 {
1342 /* We don't have a rootfs, /dev/console will be shared */
1343 if (!rootfs->path)
1344 return 0;
1345 if (!ttydir)
1346 return setup_dev_console(rootfs, console);
1347
1348 return setup_ttydir_console(rootfs, console, ttydir);
1349 }
1350
1351 static int setup_kmsg(const struct lxc_rootfs *rootfs,
1352 const struct lxc_console *console)
1353 {
1354 char kpath[MAXPATHLEN];
1355 int ret;
1356
1357 if (!rootfs->path)
1358 return 0;
1359 ret = snprintf(kpath, sizeof(kpath), "%s/dev/kmsg", rootfs->mount);
1360 if (ret < 0 || ret >= sizeof(kpath))
1361 return -1;
1362
1363 ret = unlink(kpath);
1364 if (ret && errno != ENOENT) {
1365 SYSERROR("error unlinking %s\n", kpath);
1366 return -1;
1367 }
1368
1369 ret = symlink("console", kpath);
1370 if (ret) {
1371 SYSERROR("failed to create symlink for kmsg");
1372 return -1;
1373 }
1374
1375 return 0;
1376 }
1377
1378 int setup_cgroup(const char *name, struct lxc_list *cgroups)
1379 {
1380 struct lxc_list *iterator;
1381 struct lxc_cgroup *cg;
1382 int ret = -1;
1383
1384 if (lxc_list_empty(cgroups))
1385 return 0;
1386
1387 lxc_list_for_each(iterator, cgroups) {
1388
1389 cg = iterator->elem;
1390
1391 if (lxc_cgroup_set(name, cg->subsystem, cg->value))
1392 goto out;
1393
1394 DEBUG("cgroup '%s' set to '%s'", cg->subsystem, cg->value);
1395 }
1396
1397 ret = 0;
1398 INFO("cgroup has been setup");
1399 out:
1400 return ret;
1401 }
1402
1403 static void parse_mntopt(char *opt, unsigned long *flags, char **data)
1404 {
1405 struct mount_opt *mo;
1406
1407 /* If opt is found in mount_opt, set or clear flags.
1408 * Otherwise append it to data. */
1409
1410 for (mo = &mount_opt[0]; mo->name != NULL; mo++) {
1411 if (!strncmp(opt, mo->name, strlen(mo->name))) {
1412 if (mo->clear)
1413 *flags &= ~mo->flag;
1414 else
1415 *flags |= mo->flag;
1416 return;
1417 }
1418 }
1419
1420 if (strlen(*data))
1421 strcat(*data, ",");
1422 strcat(*data, opt);
1423 }
1424
1425 static int parse_mntopts(const char *mntopts, unsigned long *mntflags,
1426 char **mntdata)
1427 {
1428 char *s, *data;
1429 char *p, *saveptr = NULL;
1430
1431 *mntdata = NULL;
1432 *mntflags = 0L;
1433
1434 if (!mntopts)
1435 return 0;
1436
1437 s = strdup(mntopts);
1438 if (!s) {
1439 SYSERROR("failed to allocate memory");
1440 return -1;
1441 }
1442
1443 data = malloc(strlen(s) + 1);
1444 if (!data) {
1445 SYSERROR("failed to allocate memory");
1446 free(s);
1447 return -1;
1448 }
1449 *data = 0;
1450
1451 for (p = strtok_r(s, ",", &saveptr); p != NULL;
1452 p = strtok_r(NULL, ",", &saveptr))
1453 parse_mntopt(p, mntflags, &data);
1454
1455 if (*data)
1456 *mntdata = data;
1457 else
1458 free(data);
1459 free(s);
1460
1461 return 0;
1462 }
1463
1464 static int mount_entry(const char *fsname, const char *target,
1465 const char *fstype, unsigned long mountflags,
1466 const char *data)
1467 {
1468 if (mount(fsname, target, fstype, mountflags & ~MS_REMOUNT, data)) {
1469 SYSERROR("failed to mount '%s' on '%s'", fsname, target);
1470 return -1;
1471 }
1472
1473 if ((mountflags & MS_REMOUNT) || (mountflags & MS_BIND)) {
1474
1475 DEBUG("remounting %s on %s to respect bind or remount options",
1476 fsname, target);
1477
1478 if (mount(fsname, target, fstype,
1479 mountflags | MS_REMOUNT, data)) {
1480 SYSERROR("failed to mount '%s' on '%s'",
1481 fsname, target);
1482 return -1;
1483 }
1484 }
1485
1486 DEBUG("mounted '%s' on '%s', type '%s'", fsname, target, fstype);
1487
1488 return 0;
1489 }
1490
1491 static inline int mount_entry_on_systemfs(struct mntent *mntent)
1492 {
1493 unsigned long mntflags;
1494 char *mntdata;
1495 int ret;
1496
1497 if (parse_mntopts(mntent->mnt_opts, &mntflags, &mntdata) < 0) {
1498 ERROR("failed to parse mount option '%s'", mntent->mnt_opts);
1499 return -1;
1500 }
1501
1502 ret = mount_entry(mntent->mnt_fsname, mntent->mnt_dir,
1503 mntent->mnt_type, mntflags, mntdata);
1504
1505 if (hasmntopt(mntent, "optional") != NULL)
1506 ret = 0;
1507
1508 free(mntdata);
1509
1510 return ret;
1511 }
1512
1513 static int mount_entry_on_absolute_rootfs(struct mntent *mntent,
1514 const struct lxc_rootfs *rootfs,
1515 const char *lxc_name)
1516 {
1517 char *aux;
1518 char path[MAXPATHLEN];
1519 unsigned long mntflags;
1520 char *mntdata;
1521 int r, ret = 0, offset;
1522 char *lxcpath;
1523
1524 if (parse_mntopts(mntent->mnt_opts, &mntflags, &mntdata) < 0) {
1525 ERROR("failed to parse mount option '%s'", mntent->mnt_opts);
1526 return -1;
1527 }
1528
1529 lxcpath = default_lxc_path();
1530 if (!lxcpath) {
1531 ERROR("Out of memory");
1532 return -1;
1533 }
1534
1535 /* if rootfs->path is a blockdev path, allow container fstab to
1536 * use $lxcpath/CN/rootfs as the target prefix */
1537 r = snprintf(path, MAXPATHLEN, "%s/%s/rootfs", lxcpath, lxc_name);
1538 free(lxcpath);
1539 if (r < 0 || r >= MAXPATHLEN)
1540 goto skipvarlib;
1541
1542 aux = strstr(mntent->mnt_dir, path);
1543 if (aux) {
1544 offset = strlen(path);
1545 goto skipabs;
1546 }
1547
1548 skipvarlib:
1549 aux = strstr(mntent->mnt_dir, rootfs->path);
1550 if (!aux) {
1551 WARN("ignoring mount point '%s'", mntent->mnt_dir);
1552 goto out;
1553 }
1554 offset = strlen(rootfs->path);
1555
1556 skipabs:
1557
1558 r = snprintf(path, MAXPATHLEN, "%s/%s", rootfs->mount,
1559 aux + offset);
1560 if (r < 0 || r >= MAXPATHLEN) {
1561 WARN("pathnme too long for '%s'", mntent->mnt_dir);
1562 ret = -1;
1563 goto out;
1564 }
1565
1566
1567 ret = mount_entry(mntent->mnt_fsname, path, mntent->mnt_type,
1568 mntflags, mntdata);
1569
1570 if (hasmntopt(mntent, "optional") != NULL)
1571 ret = 0;
1572
1573 out:
1574 free(mntdata);
1575 return ret;
1576 }
1577
1578 static int mount_entry_on_relative_rootfs(struct mntent *mntent,
1579 const char *rootfs)
1580 {
1581 char path[MAXPATHLEN];
1582 unsigned long mntflags;
1583 char *mntdata;
1584 int ret;
1585
1586 if (parse_mntopts(mntent->mnt_opts, &mntflags, &mntdata) < 0) {
1587 ERROR("failed to parse mount option '%s'", mntent->mnt_opts);
1588 return -1;
1589 }
1590
1591 /* relative to root mount point */
1592 ret = snprintf(path, sizeof(path), "%s/%s", rootfs, mntent->mnt_dir);
1593 if (ret >= sizeof(path)) {
1594 ERROR("path name too long");
1595 return -1;
1596 }
1597
1598 ret = mount_entry(mntent->mnt_fsname, path, mntent->mnt_type,
1599 mntflags, mntdata);
1600
1601 if (hasmntopt(mntent, "optional") != NULL)
1602 ret = 0;
1603
1604 free(mntdata);
1605
1606 return ret;
1607 }
1608
1609 static int mount_file_entries(const struct lxc_rootfs *rootfs, FILE *file,
1610 const char *lxc_name)
1611 {
1612 struct mntent *mntent;
1613 int ret = -1;
1614
1615 while ((mntent = getmntent(file))) {
1616
1617 if (!rootfs->path) {
1618 if (mount_entry_on_systemfs(mntent))
1619 goto out;
1620 continue;
1621 }
1622
1623 /* We have a separate root, mounts are relative to it */
1624 if (mntent->mnt_dir[0] != '/') {
1625 if (mount_entry_on_relative_rootfs(mntent,
1626 rootfs->mount))
1627 goto out;
1628 continue;
1629 }
1630
1631 if (mount_entry_on_absolute_rootfs(mntent, rootfs, lxc_name))
1632 goto out;
1633 }
1634
1635 ret = 0;
1636
1637 INFO("mount points have been setup");
1638 out:
1639 return ret;
1640 }
1641
1642 static int setup_mount(const struct lxc_rootfs *rootfs, const char *fstab,
1643 const char *lxc_name)
1644 {
1645 FILE *file;
1646 int ret;
1647
1648 if (!fstab)
1649 return 0;
1650
1651 file = setmntent(fstab, "r");
1652 if (!file) {
1653 SYSERROR("failed to use '%s'", fstab);
1654 return -1;
1655 }
1656
1657 ret = mount_file_entries(rootfs, file, lxc_name);
1658
1659 endmntent(file);
1660 return ret;
1661 }
1662
1663 static int setup_mount_entries(const struct lxc_rootfs *rootfs, struct lxc_list *mount,
1664 const char *lxc_name)
1665 {
1666 FILE *file;
1667 struct lxc_list *iterator;
1668 char *mount_entry;
1669 int ret;
1670
1671 file = tmpfile();
1672 if (!file) {
1673 ERROR("tmpfile error: %m");
1674 return -1;
1675 }
1676
1677 lxc_list_for_each(iterator, mount) {
1678 mount_entry = iterator->elem;
1679 fprintf(file, "%s\n", mount_entry);
1680 }
1681
1682 rewind(file);
1683
1684 ret = mount_file_entries(rootfs, file, lxc_name);
1685
1686 fclose(file);
1687 return ret;
1688 }
1689
1690 static int setup_caps(struct lxc_list *caps)
1691 {
1692 struct lxc_list *iterator;
1693 char *drop_entry;
1694 char *ptr;
1695 int i, capid;
1696
1697 lxc_list_for_each(iterator, caps) {
1698
1699 drop_entry = iterator->elem;
1700
1701 capid = -1;
1702
1703 for (i = 0; i < sizeof(caps_opt)/sizeof(caps_opt[0]); i++) {
1704
1705 if (strcmp(drop_entry, caps_opt[i].name))
1706 continue;
1707
1708 capid = caps_opt[i].value;
1709 break;
1710 }
1711
1712 if (capid < 0) {
1713 /* try to see if it's numeric, so the user may specify
1714 * capabilities that the running kernel knows about but
1715 * we don't */
1716 capid = strtol(drop_entry, &ptr, 10);
1717 if (!ptr || *ptr != '\0' ||
1718 capid == LONG_MIN || capid == LONG_MAX)
1719 /* not a valid number */
1720 capid = -1;
1721 else if (capid > lxc_caps_last_cap())
1722 /* we have a number but it's not a valid
1723 * capability */
1724 capid = -1;
1725 }
1726
1727 if (capid < 0) {
1728 ERROR("unknown capability %s", drop_entry);
1729 return -1;
1730 }
1731
1732 DEBUG("drop capability '%s' (%d)", drop_entry, capid);
1733
1734 if (prctl(PR_CAPBSET_DROP, capid, 0, 0, 0)) {
1735 SYSERROR("failed to remove %s capability", drop_entry);
1736 return -1;
1737 }
1738
1739 }
1740
1741 DEBUG("capabilities has been setup");
1742
1743 return 0;
1744 }
1745
1746 static int setup_hw_addr(char *hwaddr, const char *ifname)
1747 {
1748 struct sockaddr sockaddr;
1749 struct ifreq ifr;
1750 int ret, fd;
1751
1752 ret = lxc_convert_mac(hwaddr, &sockaddr);
1753 if (ret) {
1754 ERROR("mac address '%s' conversion failed : %s",
1755 hwaddr, strerror(-ret));
1756 return -1;
1757 }
1758
1759 memcpy(ifr.ifr_name, ifname, IFNAMSIZ);
1760 memcpy((char *) &ifr.ifr_hwaddr, (char *) &sockaddr, sizeof(sockaddr));
1761
1762 fd = socket(AF_INET, SOCK_DGRAM, 0);
1763 if (fd < 0) {
1764 ERROR("socket failure : %s", strerror(errno));
1765 return -1;
1766 }
1767
1768 ret = ioctl(fd, SIOCSIFHWADDR, &ifr);
1769 close(fd);
1770 if (ret)
1771 ERROR("ioctl failure : %s", strerror(errno));
1772
1773 DEBUG("mac address '%s' on '%s' has been setup", hwaddr, ifname);
1774
1775 return ret;
1776 }
1777
1778 static int setup_ipv4_addr(struct lxc_list *ip, int ifindex)
1779 {
1780 struct lxc_list *iterator;
1781 struct lxc_inetdev *inetdev;
1782 int err;
1783
1784 lxc_list_for_each(iterator, ip) {
1785
1786 inetdev = iterator->elem;
1787
1788 err = lxc_ipv4_addr_add(ifindex, &inetdev->addr,
1789 &inetdev->bcast, inetdev->prefix);
1790 if (err) {
1791 ERROR("failed to setup_ipv4_addr ifindex %d : %s",
1792 ifindex, strerror(-err));
1793 return -1;
1794 }
1795 }
1796
1797 return 0;
1798 }
1799
1800 static int setup_ipv6_addr(struct lxc_list *ip, int ifindex)
1801 {
1802 struct lxc_list *iterator;
1803 struct lxc_inet6dev *inet6dev;
1804 int err;
1805
1806 lxc_list_for_each(iterator, ip) {
1807
1808 inet6dev = iterator->elem;
1809
1810 err = lxc_ipv6_addr_add(ifindex, &inet6dev->addr,
1811 &inet6dev->mcast, &inet6dev->acast,
1812 inet6dev->prefix);
1813 if (err) {
1814 ERROR("failed to setup_ipv6_addr ifindex %d : %s",
1815 ifindex, strerror(-err));
1816 return -1;
1817 }
1818 }
1819
1820 return 0;
1821 }
1822
1823 static int setup_netdev(struct lxc_netdev *netdev)
1824 {
1825 char ifname[IFNAMSIZ];
1826 char *current_ifname = ifname;
1827 int err;
1828
1829 /* empty network namespace */
1830 if (!netdev->ifindex) {
1831 if (netdev->flags & IFF_UP) {
1832 err = lxc_netdev_up("lo");
1833 if (err) {
1834 ERROR("failed to set the loopback up : %s",
1835 strerror(-err));
1836 return -1;
1837 }
1838 }
1839 return 0;
1840 }
1841
1842 /* retrieve the name of the interface */
1843 if (!if_indextoname(netdev->ifindex, current_ifname)) {
1844 ERROR("no interface corresponding to index '%d'",
1845 netdev->ifindex);
1846 return -1;
1847 }
1848
1849 /* default: let the system to choose one interface name */
1850 if (!netdev->name)
1851 netdev->name = netdev->type == LXC_NET_PHYS ?
1852 netdev->link : "eth%d";
1853
1854 /* rename the interface name */
1855 err = lxc_netdev_rename_by_name(ifname, netdev->name);
1856 if (err) {
1857 ERROR("failed to rename %s->%s : %s", ifname, netdev->name,
1858 strerror(-err));
1859 return -1;
1860 }
1861
1862 /* Re-read the name of the interface because its name has changed
1863 * and would be automatically allocated by the system
1864 */
1865 if (!if_indextoname(netdev->ifindex, current_ifname)) {
1866 ERROR("no interface corresponding to index '%d'",
1867 netdev->ifindex);
1868 return -1;
1869 }
1870
1871 /* set a mac address */
1872 if (netdev->hwaddr) {
1873 if (setup_hw_addr(netdev->hwaddr, current_ifname)) {
1874 ERROR("failed to setup hw address for '%s'",
1875 current_ifname);
1876 return -1;
1877 }
1878 }
1879
1880 /* setup ipv4 addresses on the interface */
1881 if (setup_ipv4_addr(&netdev->ipv4, netdev->ifindex)) {
1882 ERROR("failed to setup ip addresses for '%s'",
1883 ifname);
1884 return -1;
1885 }
1886
1887 /* setup ipv6 addresses on the interface */
1888 if (setup_ipv6_addr(&netdev->ipv6, netdev->ifindex)) {
1889 ERROR("failed to setup ipv6 addresses for '%s'",
1890 ifname);
1891 return -1;
1892 }
1893
1894 /* set the network device up */
1895 if (netdev->flags & IFF_UP) {
1896 int err;
1897
1898 err = lxc_netdev_up(current_ifname);
1899 if (err) {
1900 ERROR("failed to set '%s' up : %s", current_ifname,
1901 strerror(-err));
1902 return -1;
1903 }
1904
1905 /* the network is up, make the loopback up too */
1906 err = lxc_netdev_up("lo");
1907 if (err) {
1908 ERROR("failed to set the loopback up : %s",
1909 strerror(-err));
1910 return -1;
1911 }
1912 }
1913
1914 /* We can only set up the default routes after bringing
1915 * up the interface, sine bringing up the interface adds
1916 * the link-local routes and we can't add a default
1917 * route if the gateway is not reachable. */
1918
1919 /* setup ipv4 gateway on the interface */
1920 if (netdev->ipv4_gateway) {
1921 if (!(netdev->flags & IFF_UP)) {
1922 ERROR("Cannot add ipv4 gateway for %s when not bringing up the interface", ifname);
1923 return -1;
1924 }
1925
1926 if (lxc_list_empty(&netdev->ipv4)) {
1927 ERROR("Cannot add ipv4 gateway for %s when not assigning an address", ifname);
1928 return -1;
1929 }
1930
1931 err = lxc_ipv4_gateway_add(netdev->ifindex, netdev->ipv4_gateway);
1932 if (err) {
1933 ERROR("failed to setup ipv4 gateway for '%s': %s",
1934 ifname, strerror(-err));
1935 if (netdev->ipv4_gateway_auto) {
1936 char buf[INET_ADDRSTRLEN];
1937 inet_ntop(AF_INET, netdev->ipv4_gateway, buf, sizeof(buf));
1938 ERROR("tried to set autodetected ipv4 gateway '%s'", buf);
1939 }
1940 return -1;
1941 }
1942 }
1943
1944 /* setup ipv6 gateway on the interface */
1945 if (netdev->ipv6_gateway) {
1946 if (!(netdev->flags & IFF_UP)) {
1947 ERROR("Cannot add ipv6 gateway for %s when not bringing up the interface", ifname);
1948 return -1;
1949 }
1950
1951 if (lxc_list_empty(&netdev->ipv6) && !IN6_IS_ADDR_LINKLOCAL(netdev->ipv6_gateway)) {
1952 ERROR("Cannot add ipv6 gateway for %s when not assigning an address", ifname);
1953 return -1;
1954 }
1955
1956 err = lxc_ipv6_gateway_add(netdev->ifindex, netdev->ipv6_gateway);
1957 if (err) {
1958 ERROR("failed to setup ipv6 gateway for '%s': %s",
1959 ifname, strerror(-err));
1960 if (netdev->ipv6_gateway_auto) {
1961 char buf[INET6_ADDRSTRLEN];
1962 inet_ntop(AF_INET6, netdev->ipv6_gateway, buf, sizeof(buf));
1963 ERROR("tried to set autodetected ipv6 gateway '%s'", buf);
1964 }
1965 return -1;
1966 }
1967 }
1968
1969 DEBUG("'%s' has been setup", current_ifname);
1970
1971 return 0;
1972 }
1973
1974 static int setup_network(struct lxc_list *network)
1975 {
1976 struct lxc_list *iterator;
1977 struct lxc_netdev *netdev;
1978
1979 lxc_list_for_each(iterator, network) {
1980
1981 netdev = iterator->elem;
1982
1983 if (setup_netdev(netdev)) {
1984 ERROR("failed to setup netdev");
1985 return -1;
1986 }
1987 }
1988
1989 if (!lxc_list_empty(network))
1990 INFO("network has been setup");
1991
1992 return 0;
1993 }
1994
1995 void lxc_rename_phys_nics_on_shutdown(struct lxc_conf *conf)
1996 {
1997 int i;
1998
1999 INFO("running to reset %d nic names", conf->num_savednics);
2000 for (i=0; i<conf->num_savednics; i++) {
2001 struct saved_nic *s = &conf->saved_nics[i];
2002 INFO("resetting nic %d to %s\n", s->ifindex, s->orig_name);
2003 lxc_netdev_rename_by_index(s->ifindex, s->orig_name);
2004 free(s->orig_name);
2005 }
2006 conf->num_savednics = 0;
2007 free(conf->saved_nics);
2008 }
2009
2010 static int setup_private_host_hw_addr(char *veth1)
2011 {
2012 struct ifreq ifr;
2013 int err;
2014 int sockfd;
2015
2016 sockfd = socket(AF_INET, SOCK_DGRAM, 0);
2017 if (sockfd < 0)
2018 return -errno;
2019
2020 snprintf((char *)ifr.ifr_name, IFNAMSIZ, "%s", veth1);
2021 err = ioctl(sockfd, SIOCGIFHWADDR, &ifr);
2022 if (err < 0) {
2023 close(sockfd);
2024 return -errno;
2025 }
2026
2027 ifr.ifr_hwaddr.sa_data[0] = 0xfe;
2028 err = ioctl(sockfd, SIOCSIFHWADDR, &ifr);
2029 close(sockfd);
2030 if (err < 0)
2031 return -errno;
2032
2033 DEBUG("mac address of host interface '%s' changed to private "
2034 "%02x:%02x:%02x:%02x:%02x:%02x", veth1,
2035 ifr.ifr_hwaddr.sa_data[0] & 0xff,
2036 ifr.ifr_hwaddr.sa_data[1] & 0xff,
2037 ifr.ifr_hwaddr.sa_data[2] & 0xff,
2038 ifr.ifr_hwaddr.sa_data[3] & 0xff,
2039 ifr.ifr_hwaddr.sa_data[4] & 0xff,
2040 ifr.ifr_hwaddr.sa_data[5] & 0xff);
2041
2042 return 0;
2043 }
2044
2045 static char *default_rootfs_mount = LXCROOTFSMOUNT;
2046
2047 struct lxc_conf *lxc_conf_init(void)
2048 {
2049 struct lxc_conf *new;
2050 int i;
2051
2052 new = malloc(sizeof(*new));
2053 if (!new) {
2054 ERROR("lxc_conf_init : %m");
2055 return NULL;
2056 }
2057 memset(new, 0, sizeof(*new));
2058
2059 new->personality = -1;
2060 new->console.log_path = NULL;
2061 new->console.log_fd = -1;
2062 new->console.path = NULL;
2063 new->console.peer = -1;
2064 new->console.master = -1;
2065 new->console.slave = -1;
2066 new->console.name[0] = '\0';
2067 new->maincmd_fd = -1;
2068 new->rootfs.mount = default_rootfs_mount;
2069 lxc_list_init(&new->cgroup);
2070 lxc_list_init(&new->network);
2071 lxc_list_init(&new->mount_list);
2072 lxc_list_init(&new->caps);
2073 lxc_list_init(&new->id_map);
2074 for (i=0; i<NUM_LXC_HOOKS; i++)
2075 lxc_list_init(&new->hooks[i]);
2076 #if HAVE_APPARMOR
2077 new->aa_profile = NULL;
2078 #endif
2079 #if HAVE_APPARMOR /* || HAVE_SMACK || HAVE_SELINUX */
2080 new->lsm_umount_proc = 0;
2081 #endif
2082
2083 return new;
2084 }
2085
2086 static int instanciate_veth(struct lxc_handler *handler, struct lxc_netdev *netdev)
2087 {
2088 char veth1buf[IFNAMSIZ], *veth1;
2089 char veth2buf[IFNAMSIZ], *veth2;
2090 int err;
2091
2092 if (netdev->priv.veth_attr.pair)
2093 veth1 = netdev->priv.veth_attr.pair;
2094 else {
2095 err = snprintf(veth1buf, sizeof(veth1buf), "vethXXXXXX");
2096 if (err >= sizeof(veth1buf)) { /* can't *really* happen, but... */
2097 ERROR("veth1 name too long");
2098 return -1;
2099 }
2100 veth1 = mktemp(veth1buf);
2101 /* store away for deconf */
2102 memcpy(netdev->priv.veth_attr.veth1, veth1, IFNAMSIZ);
2103 }
2104
2105 snprintf(veth2buf, sizeof(veth2buf), "vethXXXXXX");
2106 veth2 = mktemp(veth2buf);
2107
2108 if (!strlen(veth1) || !strlen(veth2)) {
2109 ERROR("failed to allocate a temporary name");
2110 return -1;
2111 }
2112
2113 err = lxc_veth_create(veth1, veth2);
2114 if (err) {
2115 ERROR("failed to create %s-%s : %s", veth1, veth2,
2116 strerror(-err));
2117 return -1;
2118 }
2119
2120 /* changing the high byte of the mac address to 0xfe, the bridge interface
2121 * will always keep the host's mac address and not take the mac address
2122 * of a container */
2123 err = setup_private_host_hw_addr(veth1);
2124 if (err) {
2125 ERROR("failed to change mac address of host interface '%s' : %s",
2126 veth1, strerror(-err));
2127 goto out_delete;
2128 }
2129
2130 if (netdev->mtu) {
2131 err = lxc_netdev_set_mtu(veth1, atoi(netdev->mtu));
2132 if (!err)
2133 err = lxc_netdev_set_mtu(veth2, atoi(netdev->mtu));
2134 if (err) {
2135 ERROR("failed to set mtu '%s' for %s-%s : %s",
2136 netdev->mtu, veth1, veth2, strerror(-err));
2137 goto out_delete;
2138 }
2139 }
2140
2141 if (netdev->link) {
2142 err = lxc_bridge_attach(netdev->link, veth1);
2143 if (err) {
2144 ERROR("failed to attach '%s' to the bridge '%s' : %s",
2145 veth1, netdev->link, strerror(-err));
2146 goto out_delete;
2147 }
2148 }
2149
2150 netdev->ifindex = if_nametoindex(veth2);
2151 if (!netdev->ifindex) {
2152 ERROR("failed to retrieve the index for %s", veth2);
2153 goto out_delete;
2154 }
2155
2156 err = lxc_netdev_up(veth1);
2157 if (err) {
2158 ERROR("failed to set %s up : %s", veth1, strerror(-err));
2159 goto out_delete;
2160 }
2161
2162 if (netdev->upscript) {
2163 err = run_script(handler->name, "net", netdev->upscript, "up",
2164 "veth", veth1, (char*) NULL);
2165 if (err)
2166 goto out_delete;
2167 }
2168
2169 DEBUG("instanciated veth '%s/%s', index is '%d'",
2170 veth1, veth2, netdev->ifindex);
2171
2172 return 0;
2173
2174 out_delete:
2175 lxc_netdev_delete_by_name(veth1);
2176 return -1;
2177 }
2178
2179 static int shutdown_veth(struct lxc_handler *handler, struct lxc_netdev *netdev)
2180 {
2181 char *veth1;
2182 int err;
2183
2184 if (netdev->priv.veth_attr.pair)
2185 veth1 = netdev->priv.veth_attr.pair;
2186 else
2187 veth1 = netdev->priv.veth_attr.veth1;
2188
2189 if (netdev->downscript) {
2190 err = run_script(handler->name, "net", netdev->downscript,
2191 "down", "veth", veth1, (char*) NULL);
2192 if (err)
2193 return -1;
2194 }
2195 return 0;
2196 }
2197
2198 static int instanciate_macvlan(struct lxc_handler *handler, struct lxc_netdev *netdev)
2199 {
2200 char peerbuf[IFNAMSIZ], *peer;
2201 int err;
2202
2203 if (!netdev->link) {
2204 ERROR("no link specified for macvlan netdev");
2205 return -1;
2206 }
2207
2208 err = snprintf(peerbuf, sizeof(peerbuf), "mcXXXXXX");
2209 if (err >= sizeof(peerbuf))
2210 return -1;
2211
2212 peer = mktemp(peerbuf);
2213 if (!strlen(peer)) {
2214 ERROR("failed to make a temporary name");
2215 return -1;
2216 }
2217
2218 err = lxc_macvlan_create(netdev->link, peer,
2219 netdev->priv.macvlan_attr.mode);
2220 if (err) {
2221 ERROR("failed to create macvlan interface '%s' on '%s' : %s",
2222 peer, netdev->link, strerror(-err));
2223 return -1;
2224 }
2225
2226 netdev->ifindex = if_nametoindex(peer);
2227 if (!netdev->ifindex) {
2228 ERROR("failed to retrieve the index for %s", peer);
2229 lxc_netdev_delete_by_name(peer);
2230 return -1;
2231 }
2232
2233 if (netdev->upscript) {
2234 err = run_script(handler->name, "net", netdev->upscript, "up",
2235 "macvlan", netdev->link, (char*) NULL);
2236 if (err)
2237 return -1;
2238 }
2239
2240 DEBUG("instanciated macvlan '%s', index is '%d' and mode '%d'",
2241 peer, netdev->ifindex, netdev->priv.macvlan_attr.mode);
2242
2243 return 0;
2244 }
2245
2246 static int shutdown_macvlan(struct lxc_handler *handler, struct lxc_netdev *netdev)
2247 {
2248 int err;
2249
2250 if (netdev->downscript) {
2251 err = run_script(handler->name, "net", netdev->downscript,
2252 "down", "macvlan", netdev->link,
2253 (char*) NULL);
2254 if (err)
2255 return -1;
2256 }
2257 return 0;
2258 }
2259
2260 /* XXX: merge with instanciate_macvlan */
2261 static int instanciate_vlan(struct lxc_handler *handler, struct lxc_netdev *netdev)
2262 {
2263 char peer[IFNAMSIZ];
2264 int err;
2265
2266 if (!netdev->link) {
2267 ERROR("no link specified for vlan netdev");
2268 return -1;
2269 }
2270
2271 err = snprintf(peer, sizeof(peer), "vlan%d", netdev->priv.vlan_attr.vid);
2272 if (err >= sizeof(peer)) {
2273 ERROR("peer name too long");
2274 return -1;
2275 }
2276
2277 err = lxc_vlan_create(netdev->link, peer, netdev->priv.vlan_attr.vid);
2278 if (err) {
2279 ERROR("failed to create vlan interface '%s' on '%s' : %s",
2280 peer, netdev->link, strerror(-err));
2281 return -1;
2282 }
2283
2284 netdev->ifindex = if_nametoindex(peer);
2285 if (!netdev->ifindex) {
2286 ERROR("failed to retrieve the ifindex for %s", peer);
2287 lxc_netdev_delete_by_name(peer);
2288 return -1;
2289 }
2290
2291 DEBUG("instanciated vlan '%s', ifindex is '%d'", " vlan1000",
2292 netdev->ifindex);
2293
2294 return 0;
2295 }
2296
2297 static int shutdown_vlan(struct lxc_handler *handler, struct lxc_netdev *netdev)
2298 {
2299 return 0;
2300 }
2301
2302 static int instanciate_phys(struct lxc_handler *handler, struct lxc_netdev *netdev)
2303 {
2304 if (!netdev->link) {
2305 ERROR("no link specified for the physical interface");
2306 return -1;
2307 }
2308
2309 netdev->ifindex = if_nametoindex(netdev->link);
2310 if (!netdev->ifindex) {
2311 ERROR("failed to retrieve the index for %s", netdev->link);
2312 return -1;
2313 }
2314
2315 if (netdev->upscript) {
2316 int err;
2317 err = run_script(handler->name, "net", netdev->upscript,
2318 "up", "phys", netdev->link, (char*) NULL);
2319 if (err)
2320 return -1;
2321 }
2322
2323 return 0;
2324 }
2325
2326 static int shutdown_phys(struct lxc_handler *handler, struct lxc_netdev *netdev)
2327 {
2328 int err;
2329
2330 if (netdev->downscript) {
2331 err = run_script(handler->name, "net", netdev->downscript,
2332 "down", "phys", netdev->link, (char*) NULL);
2333 if (err)
2334 return -1;
2335 }
2336 return 0;
2337 }
2338
2339 static int instanciate_empty(struct lxc_handler *handler, struct lxc_netdev *netdev)
2340 {
2341 netdev->ifindex = 0;
2342 if (netdev->upscript) {
2343 int err;
2344 err = run_script(handler->name, "net", netdev->upscript,
2345 "up", "empty", (char*) NULL);
2346 if (err)
2347 return -1;
2348 }
2349 return 0;
2350 }
2351
2352 static int shutdown_empty(struct lxc_handler *handler, struct lxc_netdev *netdev)
2353 {
2354 int err;
2355
2356 if (netdev->downscript) {
2357 err = run_script(handler->name, "net", netdev->downscript,
2358 "down", "empty", (char*) NULL);
2359 if (err)
2360 return -1;
2361 }
2362 return 0;
2363 }
2364
2365 int lxc_create_network(struct lxc_handler *handler)
2366 {
2367 struct lxc_list *network = &handler->conf->network;
2368 struct lxc_list *iterator;
2369 struct lxc_netdev *netdev;
2370
2371 lxc_list_for_each(iterator, network) {
2372
2373 netdev = iterator->elem;
2374
2375 if (netdev->type < 0 || netdev->type > LXC_NET_MAXCONFTYPE) {
2376 ERROR("invalid network configuration type '%d'",
2377 netdev->type);
2378 return -1;
2379 }
2380
2381 if (netdev_conf[netdev->type](handler, netdev)) {
2382 ERROR("failed to create netdev");
2383 return -1;
2384 }
2385
2386 }
2387
2388 return 0;
2389 }
2390
2391 void lxc_delete_network(struct lxc_handler *handler)
2392 {
2393 struct lxc_list *network = &handler->conf->network;
2394 struct lxc_list *iterator;
2395 struct lxc_netdev *netdev;
2396
2397 lxc_list_for_each(iterator, network) {
2398 netdev = iterator->elem;
2399
2400 if (netdev->ifindex != 0 && netdev->type == LXC_NET_PHYS) {
2401 if (lxc_netdev_rename_by_index(netdev->ifindex, netdev->link))
2402 WARN("failed to rename to the initial name the " \
2403 "netdev '%s'", netdev->link);
2404 continue;
2405 }
2406
2407 if (netdev_deconf[netdev->type](handler, netdev)) {
2408 WARN("failed to destroy netdev");
2409 }
2410
2411 /* Recent kernel remove the virtual interfaces when the network
2412 * namespace is destroyed but in case we did not moved the
2413 * interface to the network namespace, we have to destroy it
2414 */
2415 if (netdev->ifindex != 0 &&
2416 lxc_netdev_delete_by_index(netdev->ifindex))
2417 WARN("failed to remove interface '%s'", netdev->name);
2418 }
2419 }
2420
2421 int lxc_assign_network(struct lxc_list *network, pid_t pid)
2422 {
2423 struct lxc_list *iterator;
2424 struct lxc_netdev *netdev;
2425 int err;
2426
2427 lxc_list_for_each(iterator, network) {
2428
2429 netdev = iterator->elem;
2430
2431 /* empty network namespace, nothing to move */
2432 if (!netdev->ifindex)
2433 continue;
2434
2435 err = lxc_netdev_move_by_index(netdev->ifindex, pid);
2436 if (err) {
2437 ERROR("failed to move '%s' to the container : %s",
2438 netdev->link, strerror(-err));
2439 return -1;
2440 }
2441
2442 DEBUG("move '%s' to '%d'", netdev->name, pid);
2443 }
2444
2445 return 0;
2446 }
2447
2448 int add_id_mapping(enum idtype idtype, pid_t pid, uid_t host_start, uid_t ns_start, int range)
2449 {
2450 char path[PATH_MAX];
2451 int ret;
2452 FILE *f;
2453
2454 ret = snprintf(path, PATH_MAX, "/proc/%d/%cid_map", pid, idtype == ID_TYPE_UID ? 'u' : 'g');
2455 if (ret < 0 || ret >= PATH_MAX) {
2456 fprintf(stderr, "%s: path name too long", __func__);
2457 return -E2BIG;
2458 }
2459 f = fopen(path, "w");
2460 if (!f) {
2461 perror("open");
2462 return -EINVAL;
2463 }
2464 ret = fprintf(f, "%d %d %d", ns_start, host_start, range);
2465 if (ret < 0)
2466 perror("write");
2467 fclose(f);
2468 return ret < 0 ? ret : 0;
2469 }
2470
2471 int lxc_map_ids(struct lxc_list *idmap, pid_t pid)
2472 {
2473 struct lxc_list *iterator;
2474 struct id_map *map;
2475 int ret = 0;
2476
2477 lxc_list_for_each(iterator, idmap) {
2478 map = iterator->elem;
2479 ret = add_id_mapping(map->idtype, pid, map->hostid, map->nsid, map->range);
2480 if (ret)
2481 break;
2482 }
2483 return ret;
2484 }
2485
2486 int lxc_find_gateway_addresses(struct lxc_handler *handler)
2487 {
2488 struct lxc_list *network = &handler->conf->network;
2489 struct lxc_list *iterator;
2490 struct lxc_netdev *netdev;
2491 int link_index;
2492
2493 lxc_list_for_each(iterator, network) {
2494 netdev = iterator->elem;
2495
2496 if (!netdev->ipv4_gateway_auto && !netdev->ipv6_gateway_auto)
2497 continue;
2498
2499 if (netdev->type != LXC_NET_VETH && netdev->type != LXC_NET_MACVLAN) {
2500 ERROR("gateway = auto only supported for "
2501 "veth and macvlan");
2502 return -1;
2503 }
2504
2505 if (!netdev->link) {
2506 ERROR("gateway = auto needs a link interface");
2507 return -1;
2508 }
2509
2510 link_index = if_nametoindex(netdev->link);
2511 if (!link_index)
2512 return -EINVAL;
2513
2514 if (netdev->ipv4_gateway_auto) {
2515 if (lxc_ipv4_addr_get(link_index, &netdev->ipv4_gateway)) {
2516 ERROR("failed to automatically find ipv4 gateway "
2517 "address from link interface '%s'", netdev->link);
2518 return -1;
2519 }
2520 }
2521
2522 if (netdev->ipv6_gateway_auto) {
2523 if (lxc_ipv6_addr_get(link_index, &netdev->ipv6_gateway)) {
2524 ERROR("failed to automatically find ipv6 gateway "
2525 "address from link interface '%s'", netdev->link);
2526 return -1;
2527 }
2528 }
2529 }
2530
2531 return 0;
2532 }
2533
2534 int lxc_create_tty(const char *name, struct lxc_conf *conf)
2535 {
2536 struct lxc_tty_info *tty_info = &conf->tty_info;
2537 int i;
2538
2539 /* no tty in the configuration */
2540 if (!conf->tty)
2541 return 0;
2542
2543 tty_info->pty_info =
2544 malloc(sizeof(*tty_info->pty_info)*conf->tty);
2545 if (!tty_info->pty_info) {
2546 SYSERROR("failed to allocate pty_info");
2547 return -1;
2548 }
2549
2550 for (i = 0; i < conf->tty; i++) {
2551
2552 struct lxc_pty_info *pty_info = &tty_info->pty_info[i];
2553
2554 if (openpty(&pty_info->master, &pty_info->slave,
2555 pty_info->name, NULL, NULL)) {
2556 SYSERROR("failed to create pty #%d", i);
2557 tty_info->nbtty = i;
2558 lxc_delete_tty(tty_info);
2559 return -1;
2560 }
2561
2562 DEBUG("allocated pty '%s' (%d/%d)",
2563 pty_info->name, pty_info->master, pty_info->slave);
2564
2565 /* Prevent leaking the file descriptors to the container */
2566 fcntl(pty_info->master, F_SETFD, FD_CLOEXEC);
2567 fcntl(pty_info->slave, F_SETFD, FD_CLOEXEC);
2568
2569 pty_info->busy = 0;
2570 }
2571
2572 tty_info->nbtty = conf->tty;
2573
2574 INFO("tty's configured");
2575
2576 return 0;
2577 }
2578
2579 void lxc_delete_tty(struct lxc_tty_info *tty_info)
2580 {
2581 int i;
2582
2583 for (i = 0; i < tty_info->nbtty; i++) {
2584 struct lxc_pty_info *pty_info = &tty_info->pty_info[i];
2585
2586 close(pty_info->master);
2587 close(pty_info->slave);
2588 }
2589
2590 free(tty_info->pty_info);
2591 tty_info->nbtty = 0;
2592 }
2593
2594 /*
2595 * given a host uid, return the ns uid if it is mapped.
2596 * if it is not mapped, return the original host id.
2597 */
2598 static int shiftid(struct lxc_conf *c, int uid, enum idtype w)
2599 {
2600 struct lxc_list *iterator;
2601 struct id_map *map;
2602 int low, high;
2603
2604 lxc_list_for_each(iterator, &c->id_map) {
2605 map = iterator->elem;
2606 if (map->idtype != w)
2607 continue;
2608
2609 low = map->nsid;
2610 high = map->nsid + map->range;
2611 if (uid < low || uid >= high)
2612 continue;
2613
2614 return uid - low + map->hostid;
2615 }
2616
2617 return uid;
2618 }
2619
2620 /*
2621 * Take a pathname for a file created on the host, and map the uid and gid
2622 * into the container if needed. (Used for ttys)
2623 */
2624 static int uid_shift_file(char *path, struct lxc_conf *c)
2625 {
2626 struct stat statbuf;
2627 int newuid, newgid;
2628
2629 if (stat(path, &statbuf)) {
2630 SYSERROR("stat(%s)", path);
2631 return -1;
2632 }
2633
2634 newuid = shiftid(c, statbuf.st_uid, ID_TYPE_UID);
2635 newgid = shiftid(c, statbuf.st_gid, ID_TYPE_GID);
2636 if (newuid != statbuf.st_uid || newgid != statbuf.st_gid) {
2637 DEBUG("chowning %s from %d:%d to %d:%d\n", path, (int)statbuf.st_uid, (int)statbuf.st_gid, newuid, newgid);
2638 if (chown(path, newuid, newgid)) {
2639 SYSERROR("chown(%s)", path);
2640 return -1;
2641 }
2642 }
2643 return 0;
2644 }
2645
2646 int uid_shift_ttys(int pid, struct lxc_conf *conf)
2647 {
2648 int i, ret;
2649 struct lxc_tty_info *tty_info = &conf->tty_info;
2650 char path[MAXPATHLEN];
2651 char *ttydir = conf->ttydir;
2652
2653 if (!conf->rootfs.path)
2654 return 0;
2655 /* first the console */
2656 ret = snprintf(path, sizeof(path), "/proc/%d/root/dev/%s/console", pid, ttydir ? ttydir : "");
2657 if (ret < 0 || ret >= sizeof(path)) {
2658 ERROR("console path too long\n");
2659 return -1;
2660 }
2661 if (uid_shift_file(path, conf)) {
2662 DEBUG("Failed to chown the console %s.\n", path);
2663 return -1;
2664 }
2665 for (i=0; i< tty_info->nbtty; i++) {
2666 ret = snprintf(path, sizeof(path), "/proc/%d/root/dev/%s/tty%d",
2667 pid, ttydir ? ttydir : "", i + 1);
2668 if (ret < 0 || ret >= sizeof(path)) {
2669 ERROR("pathname too long for ttys");
2670 return -1;
2671 }
2672 if (uid_shift_file(path, conf)) {
2673 DEBUG("Failed to chown pty %s.\n", path);
2674 return -1;
2675 }
2676 }
2677
2678 return 0;
2679 }
2680
2681 int lxc_setup(const char *name, struct lxc_conf *lxc_conf)
2682 {
2683 #if HAVE_APPARMOR /* || HAVE_SMACK || HAVE_SELINUX */
2684 int mounted;
2685 #endif
2686
2687 if (setup_utsname(lxc_conf->utsname)) {
2688 ERROR("failed to setup the utsname for '%s'", name);
2689 return -1;
2690 }
2691
2692 if (setup_network(&lxc_conf->network)) {
2693 ERROR("failed to setup the network for '%s'", name);
2694 return -1;
2695 }
2696
2697 if (run_lxc_hooks(name, "pre-mount", lxc_conf)) {
2698 ERROR("failed to run pre-mount hooks for container '%s'.", name);
2699 return -1;
2700 }
2701
2702 if (setup_rootfs(lxc_conf)) {
2703 ERROR("failed to setup rootfs for '%s'", name);
2704 return -1;
2705 }
2706
2707 if (lxc_conf->autodev) {
2708 if (mount_autodev(lxc_conf->rootfs.mount)) {
2709 ERROR("failed to mount /dev in the container");
2710 return -1;
2711 }
2712 }
2713
2714 if (setup_mount(&lxc_conf->rootfs, lxc_conf->fstab, name)) {
2715 ERROR("failed to setup the mounts for '%s'", name);
2716 return -1;
2717 }
2718
2719 if (!lxc_list_empty(&lxc_conf->mount_list) && setup_mount_entries(&lxc_conf->rootfs, &lxc_conf->mount_list, name)) {
2720 ERROR("failed to setup the mount entries for '%s'", name);
2721 return -1;
2722 }
2723
2724 if (run_lxc_hooks(name, "mount", lxc_conf)) {
2725 ERROR("failed to run mount hooks for container '%s'.", name);
2726 return -1;
2727 }
2728
2729 if (lxc_conf->autodev) {
2730 if (run_lxc_hooks(name, "autodev", lxc_conf)) {
2731 ERROR("failed to run autodev hooks for container '%s'.", name);
2732 return -1;
2733 }
2734 if (setup_autodev(lxc_conf->rootfs.mount)) {
2735 ERROR("failed to populate /dev in the container");
2736 return -1;
2737 }
2738 }
2739
2740 if (setup_console(&lxc_conf->rootfs, &lxc_conf->console, lxc_conf->ttydir)) {
2741 ERROR("failed to setup the console for '%s'", name);
2742 return -1;
2743 }
2744
2745 if (setup_kmsg(&lxc_conf->rootfs, &lxc_conf->console)) // don't fail
2746 ERROR("failed to setup kmsg for '%s'", name);
2747
2748 if (setup_tty(&lxc_conf->rootfs, &lxc_conf->tty_info, lxc_conf->ttydir)) {
2749 ERROR("failed to setup the ttys for '%s'", name);
2750 return -1;
2751 }
2752
2753 #if HAVE_APPARMOR /* || HAVE_SMACK || HAVE_SELINUX */
2754 INFO("rootfs path is .%s., mount is .%s.", lxc_conf->rootfs.path,
2755 lxc_conf->rootfs.mount);
2756 if (lxc_conf->rootfs.path == NULL || strlen(lxc_conf->rootfs.path) == 0)
2757 mounted = 0;
2758 else
2759 mounted = lsm_mount_proc_if_needed(lxc_conf->rootfs.path, lxc_conf->rootfs.mount);
2760 if (mounted == -1) {
2761 SYSERROR("failed to mount /proc in the container.");
2762 return -1;
2763 } else if (mounted == 1) {
2764 lxc_conf->lsm_umount_proc = 1;
2765 }
2766 #endif
2767
2768 if (setup_pivot_root(&lxc_conf->rootfs)) {
2769 ERROR("failed to set rootfs for '%s'", name);
2770 return -1;
2771 }
2772
2773 if (setup_pts(lxc_conf->pts)) {
2774 ERROR("failed to setup the new pts instance");
2775 return -1;
2776 }
2777
2778 if (setup_personality(lxc_conf->personality)) {
2779 ERROR("failed to setup personality");
2780 return -1;
2781 }
2782
2783 if (lxc_list_empty(&lxc_conf->id_map)) {
2784 if (setup_caps(&lxc_conf->caps)) {
2785 ERROR("failed to drop capabilities");
2786 return -1;
2787 }
2788 }
2789
2790 NOTICE("'%s' is setup.", name);
2791
2792 return 0;
2793 }
2794
2795 int run_lxc_hooks(const char *name, char *hook, struct lxc_conf *conf)
2796 {
2797 int which = -1;
2798 struct lxc_list *it;
2799
2800 if (strcmp(hook, "pre-start") == 0)
2801 which = LXCHOOK_PRESTART;
2802 else if (strcmp(hook, "pre-mount") == 0)
2803 which = LXCHOOK_PREMOUNT;
2804 else if (strcmp(hook, "mount") == 0)
2805 which = LXCHOOK_MOUNT;
2806 else if (strcmp(hook, "autodev") == 0)
2807 which = LXCHOOK_AUTODEV;
2808 else if (strcmp(hook, "start") == 0)
2809 which = LXCHOOK_START;
2810 else if (strcmp(hook, "post-stop") == 0)
2811 which = LXCHOOK_POSTSTOP;
2812 else
2813 return -1;
2814 lxc_list_for_each(it, &conf->hooks[which]) {
2815 int ret;
2816 char *hookname = it->elem;
2817 ret = run_script(name, "lxc", hookname, hook, NULL);
2818 if (ret)
2819 return ret;
2820 }
2821 return 0;
2822 }
2823
2824 static void lxc_remove_nic(struct lxc_list *it)
2825 {
2826 struct lxc_netdev *netdev = it->elem;
2827 struct lxc_list *it2,*next;
2828
2829 lxc_list_del(it);
2830
2831 if (netdev->link)
2832 free(netdev->link);
2833 if (netdev->name)
2834 free(netdev->name);
2835 if (netdev->upscript)
2836 free(netdev->upscript);
2837 if (netdev->hwaddr)
2838 free(netdev->hwaddr);
2839 if (netdev->mtu)
2840 free(netdev->mtu);
2841 if (netdev->ipv4_gateway)
2842 free(netdev->ipv4_gateway);
2843 if (netdev->ipv6_gateway)
2844 free(netdev->ipv6_gateway);
2845 lxc_list_for_each_safe(it2, &netdev->ipv4, next) {
2846 lxc_list_del(it2);
2847 free(it2->elem);
2848 free(it2);
2849 }
2850 lxc_list_for_each_safe(it2, &netdev->ipv6, next) {
2851 lxc_list_del(it2);
2852 free(it2->elem);
2853 free(it2);
2854 }
2855 free(netdev);
2856 free(it);
2857 }
2858
2859 /* we get passed in something like '0', '0.ipv4' or '1.ipv6' */
2860 int lxc_clear_nic(struct lxc_conf *c, const char *key)
2861 {
2862 char *p1;
2863 int ret, idx, i;
2864 struct lxc_list *it;
2865 struct lxc_netdev *netdev;
2866
2867 p1 = index(key, '.');
2868 if (!p1 || *(p1+1) == '\0')
2869 p1 = NULL;
2870
2871 ret = sscanf(key, "%d", &idx);
2872 if (ret != 1) return -1;
2873 if (idx < 0)
2874 return -1;
2875
2876 i = 0;
2877 lxc_list_for_each(it, &c->network) {
2878 if (i == idx)
2879 break;
2880 i++;
2881 }
2882 if (i < idx) // we don't have that many nics defined
2883 return -1;
2884
2885 if (!it || !it->elem)
2886 return -1;
2887
2888 netdev = it->elem;
2889
2890 if (!p1) {
2891 lxc_remove_nic(it);
2892 } else if (strcmp(p1, "ipv4") == 0) {
2893 struct lxc_list *it2,*next;
2894 lxc_list_for_each_safe(it2, &netdev->ipv4, next) {
2895 lxc_list_del(it2);
2896 free(it2->elem);
2897 free(it2);
2898 }
2899 } else if (strcmp(p1, "ipv6") == 0) {
2900 struct lxc_list *it2,*next;
2901 lxc_list_for_each_safe(it2, &netdev->ipv6, next) {
2902 lxc_list_del(it2);
2903 free(it2->elem);
2904 free(it2);
2905 }
2906 } else if (strcmp(p1, "link") == 0) {
2907 if (netdev->link) {
2908 free(netdev->link);
2909 netdev->link = NULL;
2910 }
2911 } else if (strcmp(p1, "name") == 0) {
2912 if (netdev->name) {
2913 free(netdev->name);
2914 netdev->name = NULL;
2915 }
2916 } else if (strcmp(p1, "script.up") == 0) {
2917 if (netdev->upscript) {
2918 free(netdev->upscript);
2919 netdev->upscript = NULL;
2920 }
2921 } else if (strcmp(p1, "hwaddr") == 0) {
2922 if (netdev->hwaddr) {
2923 free(netdev->hwaddr);
2924 netdev->hwaddr = NULL;
2925 }
2926 } else if (strcmp(p1, "mtu") == 0) {
2927 if (netdev->mtu) {
2928 free(netdev->mtu);
2929 netdev->mtu = NULL;
2930 }
2931 } else if (strcmp(p1, "ipv4_gateway") == 0) {
2932 if (netdev->ipv4_gateway) {
2933 free(netdev->ipv4_gateway);
2934 netdev->ipv4_gateway = NULL;
2935 }
2936 } else if (strcmp(p1, "ipv6_gateway") == 0) {
2937 if (netdev->ipv6_gateway) {
2938 free(netdev->ipv6_gateway);
2939 netdev->ipv6_gateway = NULL;
2940 }
2941 }
2942 else return -1;
2943
2944 return 0;
2945 }
2946
2947 int lxc_clear_config_network(struct lxc_conf *c)
2948 {
2949 struct lxc_list *it,*next;
2950 lxc_list_for_each_safe(it, &c->network, next) {
2951 lxc_remove_nic(it);
2952 }
2953 return 0;
2954 }
2955
2956 int lxc_clear_config_caps(struct lxc_conf *c)
2957 {
2958 struct lxc_list *it,*next;
2959
2960 lxc_list_for_each_safe(it, &c->caps, next) {
2961 lxc_list_del(it);
2962 free(it->elem);
2963 free(it);
2964 }
2965 return 0;
2966 }
2967
2968 int lxc_clear_cgroups(struct lxc_conf *c, const char *key)
2969 {
2970 struct lxc_list *it,*next;
2971 bool all = false;
2972 const char *k = key + 11;
2973
2974 if (strcmp(key, "lxc.cgroup") == 0)
2975 all = true;
2976
2977 lxc_list_for_each_safe(it, &c->cgroup, next) {
2978 struct lxc_cgroup *cg = it->elem;
2979 if (!all && strcmp(cg->subsystem, k) != 0)
2980 continue;
2981 lxc_list_del(it);
2982 free(cg->subsystem);
2983 free(cg->value);
2984 free(cg);
2985 free(it);
2986 }
2987 return 0;
2988 }
2989
2990 int lxc_clear_mount_entries(struct lxc_conf *c)
2991 {
2992 struct lxc_list *it,*next;
2993
2994 lxc_list_for_each_safe(it, &c->mount_list, next) {
2995 lxc_list_del(it);
2996 free(it->elem);
2997 free(it);
2998 }
2999 return 0;
3000 }
3001
3002 int lxc_clear_hooks(struct lxc_conf *c, const char *key)
3003 {
3004 struct lxc_list *it,*next;
3005 bool all = false, done = false;
3006 const char *k = key + 9;
3007 int i;
3008
3009 if (strcmp(key, "lxc.hook") == 0)
3010 all = true;
3011
3012 for (i=0; i<NUM_LXC_HOOKS; i++) {
3013 if (all || strcmp(k, lxchook_names[i]) == 0) {
3014 lxc_list_for_each_safe(it, &c->hooks[i], next) {
3015 lxc_list_del(it);
3016 free(it->elem);
3017 free(it);
3018 }
3019 done = true;
3020 }
3021 }
3022
3023 if (!done) {
3024 ERROR("Invalid hook key: %s", key);
3025 return -1;
3026 }
3027 return 0;
3028 }
3029
3030 void lxc_clear_saved_nics(struct lxc_conf *conf)
3031 {
3032 int i;
3033
3034 if (!conf->num_savednics)
3035 return;
3036 for (i=0; i < conf->num_savednics; i++)
3037 free(conf->saved_nics[i].orig_name);
3038 conf->saved_nics = 0;
3039 free(conf->saved_nics);
3040 }
3041
3042 void lxc_conf_free(struct lxc_conf *conf)
3043 {
3044 if (!conf)
3045 return;
3046 if (conf->console.path)
3047 free(conf->console.path);
3048 if (conf->rootfs.mount != default_rootfs_mount)
3049 free(conf->rootfs.mount);
3050 if (conf->rootfs.path)
3051 free(conf->rootfs.path);
3052 if (conf->utsname)
3053 free(conf->utsname);
3054 if (conf->ttydir)
3055 free(conf->ttydir);
3056 if (conf->fstab)
3057 free(conf->fstab);
3058 lxc_clear_config_network(conf);
3059 #if HAVE_APPARMOR
3060 if (conf->aa_profile)
3061 free(conf->aa_profile);
3062 #endif
3063 lxc_seccomp_free(conf);
3064 lxc_clear_config_caps(conf);
3065 lxc_clear_cgroups(conf, "lxc.cgroup");
3066 lxc_clear_hooks(conf, "lxc.hook");
3067 lxc_clear_mount_entries(conf);
3068 lxc_clear_saved_nics(conf);
3069 free(conf);
3070 }
LXC mirror