src/lxc/confile.c

   1 /* SPDX-License-Identifier: LGPL-2.1+ */
   2
   3 #include "config.h"
   4
   5 #include <arpa/inet.h>
   6 #include <ctype.h>
   7 #include <dirent.h>
   8 #include <errno.h>
   9 #include <fcntl.h>
  10 #include <inttypes.h>
  11 #include <net/if.h>
  12 #include <netinet/in.h>
  13 #include <signal.h>
  14 #include <stdio.h>
  15 #include <stdlib.h>
  16 #include <string.h>
  17 #include <sys/param.h>
  18 #include <sys/stat.h>
  19 #include <sys/types.h>
  20 #include <sys/utsname.h>
  21 #include <syslog.h>
  22 #include <sys/time.h>
  23 #include <unistd.h>
  24
  25 #include "af_unix.h"
  26 #include "conf.h"
  27 #include "confile.h"
  28 #include "confile_utils.h"
  29 #include "netns_ifaddrs.h"
  30 #include "log.h"
  31 #include "lxcseccomp.h"
  32 #include "macro.h"
  33 #include "memory_utils.h"
  34 #include "network.h"
  35 #include "parse.h"
  36 #include "utils.h"
  37
  38 #if !HAVE_STRLCPY
  39 #include "strlcpy.h"
  40 #endif
  41
  42 #if !HAVE_STRLCAT
  43 #include "strlcat.h"
  44 #endif
  45
  46 #if HAVE_SYS_RESOURCE_H
  47 #include <sys/resource.h>
  48 #endif
  49
  50 lxc_log_define(confile, lxc);
  51
  52 #define lxc_config_define(name)                                             \
  53         __hot static int set_config_##name(const char *, const char *,      \
  54                                            struct lxc_conf *, void *);      \
  55         __hot static int get_config_##name(const char *, char *, int,       \
  56                                            struct lxc_conf *, void *);      \
  57         __hot static int clr_config_##name(const char *, struct lxc_conf *, \
  58                                            void *);
  59
  60 lxc_config_define(autodev);
  61 lxc_config_define(autodev_tmpfs_size);
  62 lxc_config_define(apparmor_allow_incomplete);
  63 lxc_config_define(apparmor_allow_nesting);
  64 lxc_config_define(apparmor_profile);
  65 lxc_config_define(apparmor_raw);
  66 lxc_config_define(cap_drop);
  67 lxc_config_define(cap_keep);
  68 lxc_config_define(cgroup_controller);
  69 lxc_config_define(cgroup2_controller);
  70 lxc_config_define(cgroup_dir);
  71 lxc_config_define(cgroup_monitor_dir);
  72 lxc_config_define(cgroup_monitor_pivot_dir);
  73 lxc_config_define(cgroup_container_dir);
  74 lxc_config_define(cgroup_container_inner_dir);
  75 lxc_config_define(cgroup_relative);
  76 lxc_config_define(console_buffer_size);
  77 lxc_config_define(console_logfile);
  78 lxc_config_define(console_path);
  79 lxc_config_define(console_rotate);
  80 lxc_config_define(console_size);
  81 lxc_config_define(unsupported_key);
  82 lxc_config_define(environment);
  83 lxc_config_define(ephemeral);
  84 lxc_config_define(execute_cmd);
  85 lxc_config_define(group);
  86 lxc_config_define(hooks);
  87 lxc_config_define(hooks_version);
  88 lxc_config_define(idmaps);
  89 lxc_config_define(includefiles);
  90 lxc_config_define(init_cmd);
  91 lxc_config_define(init_cwd);
  92 lxc_config_define(init_gid);
  93 lxc_config_define(init_uid);
  94 lxc_config_define(init_groups);
  95 lxc_config_define(jump_table_net);
  96 lxc_config_define(keyring_session);
  97 lxc_config_define(log_file);
  98 lxc_config_define(log_level);
  99 lxc_config_define(log_syslog);
 100 lxc_config_define(monitor);
 101 lxc_config_define(monitor_signal_pdeath);
 102 lxc_config_define(mount);
 103 lxc_config_define(mount_auto);
 104 lxc_config_define(mount_fstab);
 105 lxc_config_define(namespace_clone);
 106 lxc_config_define(namespace_keep);
 107 lxc_config_define(time_offset_boot);
 108 lxc_config_define(time_offset_monotonic);
 109 lxc_config_define(namespace_share);
 110 lxc_config_define(net);
 111 lxc_config_define(net_flags);
 112 lxc_config_define(net_hwaddr);
 113 lxc_config_define(net_ipv4_address);
 114 lxc_config_define(net_ipv4_gateway);
 115 lxc_config_define(net_ipv6_address);
 116 lxc_config_define(net_ipv6_gateway);
 117 lxc_config_define(net_link);
 118 lxc_config_define(net_l2proxy);
 119 lxc_config_define(net_macvlan_mode);
 120 lxc_config_define(net_ipvlan_mode);
 121 lxc_config_define(net_ipvlan_isolation);
 122 lxc_config_define(net_mtu);
 123 lxc_config_define(net_name);
 124 lxc_config_define(net_script_down);
 125 lxc_config_define(net_script_up);
 126 lxc_config_define(net_type);
 127 lxc_config_define(net_veth_mode);
 128 lxc_config_define(net_veth_pair);
 129 lxc_config_define(net_veth_ipv4_route);
 130 lxc_config_define(net_veth_ipv6_route);
 131 lxc_config_define(net_veth_vlan_id);
 132 lxc_config_define(net_veth_vlan_tagged_id);
 133 lxc_config_define(net_vlan_id);
 134 lxc_config_define(no_new_privs);
 135 lxc_config_define(personality);
 136 lxc_config_define(prlimit);
 137 lxc_config_define(pty_max);
 138 lxc_config_define(rootfs_managed);
 139 lxc_config_define(rootfs_mount);
 140 lxc_config_define(rootfs_options);
 141 lxc_config_define(rootfs_path);
 142 lxc_config_define(seccomp_profile);
 143 lxc_config_define(seccomp_allow_nesting);
 144 lxc_config_define(seccomp_notify_cookie);
 145 lxc_config_define(seccomp_notify_proxy);
 146 lxc_config_define(selinux_context);
 147 lxc_config_define(selinux_context_keyring);
 148 lxc_config_define(signal_halt);
 149 lxc_config_define(signal_reboot);
 150 lxc_config_define(signal_stop);
 151 lxc_config_define(start);
 152 lxc_config_define(tty_max);
 153 lxc_config_define(tty_dir);
 154 lxc_config_define(uts_name);
 155 lxc_config_define(sysctl);
 156 lxc_config_define(proc);
 157 lxc_config_define(sched_core);
 158
 159 static int set_config_unsupported_key(const char *key, const char *value,
 160                                       struct lxc_conf *lxc_conf, void *data)
 161 {
 162         return syserror_set(-EINVAL, "Unsupported config key \"%s\"", key);
 163 }
 164
 165 static int get_config_unsupported_key(const char *key, char *retv, int inlen,
 166                                       struct lxc_conf *c, void *data)
 167 {
 168         return syserror_set(-EINVAL, "Unsupported config key \"%s\"", key);
 169 }
 170
 171 static int clr_config_unsupported_key(const char *key,
 172                                       struct lxc_conf *lxc_conf, void *data)
 173 {
 174         return syserror_set(-EINVAL, "Unsupported config key \"%s\"", key);
 175 }
 176
 177 /*
 178  * Important Note:
 179  * If a new config option is added to this table, be aware that
 180  * the order in which the options are places into the table matters.
 181  * That means that more specific options of a namespace have to be
 182  * placed above more generic ones.
 183  *
 184  * For instance: If lxc.ab is placed before lxc.ab.c, the config option
 185  * lxc.ab.c will always be matched to lxc.ab. That is, the lxc.ab.c option
 186  * has to be placed above lxc.ab.
 187  */
 188 static struct lxc_config_t config_jump_table[] = {
 189         { "lxc.arch",                       true,  set_config_personality,                get_config_personality,                clr_config_personality,                },
 190         { "lxc.apparmor.profile",           true,  set_config_apparmor_profile,           get_config_apparmor_profile,           clr_config_apparmor_profile,           },
 191         { "lxc.apparmor.allow_incomplete",  true,  set_config_apparmor_allow_incomplete,  get_config_apparmor_allow_incomplete,  clr_config_apparmor_allow_incomplete,  },
 192         { "lxc.apparmor.allow_nesting",     true,  set_config_apparmor_allow_nesting,     get_config_apparmor_allow_nesting,     clr_config_apparmor_allow_nesting,     },
 193         { "lxc.apparmor.raw",               true,  set_config_apparmor_raw,               get_config_apparmor_raw,               clr_config_apparmor_raw,               },
 194         { "lxc.autodev.tmpfs.size",         true,  set_config_autodev_tmpfs_size,         get_config_autodev_tmpfs_size,         clr_config_autodev_tmpfs_size,         },
 195         { "lxc.autodev",                    true,  set_config_autodev,                    get_config_autodev,                    clr_config_autodev,                    },
 196         { "lxc.cap.drop",                   true,  set_config_cap_drop,                   get_config_cap_drop,                   clr_config_cap_drop,                   },
 197         { "lxc.cap.keep",                   true,  set_config_cap_keep,                   get_config_cap_keep,                   clr_config_cap_keep,                   },
 198         { "lxc.cgroup2",                    false, set_config_cgroup2_controller,         get_config_cgroup2_controller,         clr_config_cgroup2_controller,         },
 199         { "lxc.cgroup.dir.monitor.pivot",   true,  set_config_cgroup_monitor_pivot_dir,   get_config_cgroup_monitor_pivot_dir,   clr_config_cgroup_monitor_pivot_dir,   },
 200         { "lxc.cgroup.dir.monitor",         true,  set_config_cgroup_monitor_dir,         get_config_cgroup_monitor_dir,         clr_config_cgroup_monitor_dir,         },
 201         { "lxc.cgroup.dir.container.inner", true,  set_config_cgroup_container_inner_dir, get_config_cgroup_container_inner_dir, clr_config_cgroup_container_inner_dir, },
 202         { "lxc.cgroup.dir.container",       true,  set_config_cgroup_container_dir,       get_config_cgroup_container_dir,       clr_config_cgroup_container_dir,       },
 203         { "lxc.cgroup.dir",                 true,  set_config_cgroup_dir,                 get_config_cgroup_dir,                 clr_config_cgroup_dir,                 },
 204         { "lxc.cgroup.relative",            true,  set_config_cgroup_relative,            get_config_cgroup_relative,            clr_config_cgroup_relative,            },
 205         { "lxc.cgroup",                     false, set_config_cgroup_controller,          get_config_cgroup_controller,          clr_config_cgroup_controller,          },
 206         { "lxc.console.buffer.size",        true,  set_config_console_buffer_size,        get_config_console_buffer_size,        clr_config_console_buffer_size,        },
 207         { "lxc.console.logfile",            true,  set_config_console_logfile,            get_config_console_logfile,            clr_config_console_logfile,            },
 208         { "lxc.console.path",               true,  set_config_console_path,               get_config_console_path,               clr_config_console_path,               },
 209         { "lxc.console.rotate",             true,  set_config_console_rotate,             get_config_console_rotate,             clr_config_console_rotate,             },
 210         { "lxc.console.size",               true,  set_config_console_size,               get_config_console_size,               clr_config_console_size,               },
 211         { "lxc.sched.core",                 true,  set_config_sched_core,                 get_config_sched_core,                 clr_config_sched_core,                 },
 212         { "lxc.environment",                true,  set_config_environment,                get_config_environment,                clr_config_environment,                },
 213         { "lxc.ephemeral",                  true,  set_config_ephemeral,                  get_config_ephemeral,                  clr_config_ephemeral,                  },
 214         { "lxc.execute.cmd",                true,  set_config_execute_cmd,                get_config_execute_cmd,                clr_config_execute_cmd,                },
 215         { "lxc.group",                      true,  set_config_group,                      get_config_group,                      clr_config_group,                      },
 216         { "lxc.hook.autodev",               true,  set_config_hooks,                      get_config_hooks,                      clr_config_hooks,                      },
 217         { "lxc.hook.clone",                 true,  set_config_hooks,                      get_config_hooks,                      clr_config_hooks,                      },
 218         { "lxc.hook.destroy",               true,  set_config_hooks,                      get_config_hooks,                      clr_config_hooks,                      },
 219         { "lxc.hook.mount",                 true,  set_config_hooks,                      get_config_hooks,                      clr_config_hooks,                      },
 220         { "lxc.hook.post-stop",             true,  set_config_hooks,                      get_config_hooks,                      clr_config_hooks,                      },
 221         { "lxc.hook.pre-mount",             true,  set_config_hooks,                      get_config_hooks,                      clr_config_hooks,                      },
 222         { "lxc.hook.pre-start",             true,  set_config_hooks,                      get_config_hooks,                      clr_config_hooks,                      },
 223         { "lxc.hook.start",                 true,  set_config_hooks,                      get_config_hooks,                      clr_config_hooks,                      },
 224         { "lxc.hook.start-host",            true,  set_config_hooks,                      get_config_hooks,                      clr_config_hooks,                      },
 225         { "lxc.hook.stop",                  true,  set_config_hooks,                      get_config_hooks,                      clr_config_hooks,                      },
 226         { "lxc.hook.version",               true,  set_config_hooks_version,              get_config_hooks_version,              clr_config_hooks_version,              },
 227         { "lxc.hook",                       true,  set_config_hooks,                      get_config_hooks,                      clr_config_hooks,                      },
 228         { "lxc.idmap",                      true,  set_config_idmaps,                     get_config_idmaps,                     clr_config_idmaps,                     },
 229         { "lxc.include",                    true,  set_config_includefiles,               get_config_includefiles,               clr_config_includefiles,               },
 230         { "lxc.init.cmd",                   true,  set_config_init_cmd,                   get_config_init_cmd,                   clr_config_init_cmd,                   },
 231         { "lxc.init.gid",                   true,  set_config_init_gid,                   get_config_init_gid,                   clr_config_init_gid,                   },
 232         { "lxc.init.groups",                true,  set_config_init_groups,                get_config_init_groups,                clr_config_init_groups,                },
 233         { "lxc.init.uid",                   true,  set_config_init_uid,                   get_config_init_uid,                   clr_config_init_uid,                   },
 234         { "lxc.init.cwd",                   true,  set_config_init_cwd,                   get_config_init_cwd,                   clr_config_init_cwd,                   },
 235         { "lxc.keyring.session",            true,  set_config_keyring_session,            get_config_keyring_session,            clr_config_keyring_session             },
 236         { "lxc.log.file",                   true,  set_config_log_file,                   get_config_log_file,                   clr_config_log_file,                   },
 237         { "lxc.log.level",                  true,  set_config_log_level,                  get_config_log_level,                  clr_config_log_level,                  },
 238         { "lxc.log.syslog",                 true,  set_config_log_syslog,                 get_config_log_syslog,                 clr_config_log_syslog,                 },
 239         { "lxc.monitor.unshare",            true,  set_config_monitor,                    get_config_monitor,                    clr_config_monitor,                    },
 240         { "lxc.monitor.signal.pdeath",      true,  set_config_monitor_signal_pdeath,      get_config_monitor_signal_pdeath,      clr_config_monitor_signal_pdeath,      },
 241         { "lxc.mount.auto",                 true,  set_config_mount_auto,                 get_config_mount_auto,                 clr_config_mount_auto,                 },
 242         { "lxc.mount.entry",                true,  set_config_mount,                      get_config_mount,                      clr_config_mount,                      },
 243         { "lxc.mount.fstab",                true,  set_config_mount_fstab,                get_config_mount_fstab,                clr_config_mount_fstab,                },
 244         { "lxc.namespace.clone",            true,  set_config_namespace_clone,            get_config_namespace_clone,            clr_config_namespace_clone,            },
 245         { "lxc.namespace.keep",             true,  set_config_namespace_keep,             get_config_namespace_keep,             clr_config_namespace_keep,             },
 246         { "lxc.namespace.share.",           false, set_config_namespace_share,            get_config_namespace_share,            clr_config_namespace_share,            },
 247         { "lxc.time.offset.boot",           true,  set_config_time_offset_boot,           get_config_time_offset_boot,           clr_config_time_offset_boot,           },
 248         { "lxc.time.offset.monotonic",      true,  set_config_time_offset_monotonic,      get_config_time_offset_monotonic,      clr_config_time_offset_monotonic,      },
 249         { "lxc.net.",                       false, set_config_jump_table_net,             get_config_jump_table_net,             clr_config_jump_table_net,             },
 250         { "lxc.net",                        true,  set_config_net,                        get_config_net,                        clr_config_net,                        },
 251         { "lxc.no_new_privs",               true,  set_config_no_new_privs,               get_config_no_new_privs,               clr_config_no_new_privs,               },
 252         { "lxc.prlimit",                    false, set_config_prlimit,                    get_config_prlimit,                    clr_config_prlimit,                    },
 253         { "lxc.pty.max",                    true,  set_config_pty_max,                    get_config_pty_max,                    clr_config_pty_max,                    },
 254         { "lxc.rootfs.managed",             true,  set_config_rootfs_managed,             get_config_rootfs_managed,             clr_config_rootfs_managed,             },
 255         { "lxc.rootfs.mount",               true,  set_config_rootfs_mount,               get_config_rootfs_mount,               clr_config_rootfs_mount,               },
 256         { "lxc.rootfs.options",             true,  set_config_rootfs_options,             get_config_rootfs_options,             clr_config_rootfs_options,             },
 257         { "lxc.rootfs.path",                true,  set_config_rootfs_path,                get_config_rootfs_path,                clr_config_rootfs_path,                },
 258         { "lxc.seccomp.allow_nesting",      true,  set_config_seccomp_allow_nesting,      get_config_seccomp_allow_nesting,      clr_config_seccomp_allow_nesting,      },
 259         { "lxc.seccomp.notify.cookie",      true,  set_config_seccomp_notify_cookie,      get_config_seccomp_notify_cookie,      clr_config_seccomp_notify_cookie,      },
 260         { "lxc.seccomp.notify.proxy",       true,  set_config_seccomp_notify_proxy,       get_config_seccomp_notify_proxy,       clr_config_seccomp_notify_proxy,       },
 261         { "lxc.seccomp.profile",            true,  set_config_seccomp_profile,            get_config_seccomp_profile,            clr_config_seccomp_profile,            },
 262         { "lxc.selinux.context.keyring",    true,  set_config_selinux_context_keyring,    get_config_selinux_context_keyring,    clr_config_selinux_context_keyring     },
 263         { "lxc.selinux.context",            true,  set_config_selinux_context,            get_config_selinux_context,            clr_config_selinux_context,            },
 264         { "lxc.signal.halt",                true,  set_config_signal_halt,                get_config_signal_halt,                clr_config_signal_halt,                },
 265         { "lxc.signal.reboot",              true,  set_config_signal_reboot,              get_config_signal_reboot,              clr_config_signal_reboot,              },
 266         { "lxc.signal.stop",                true,  set_config_signal_stop,                get_config_signal_stop,                clr_config_signal_stop,                },
 267         { "lxc.start.auto",                 true,  set_config_start,                      get_config_start,                      clr_config_start,                      },
 268         { "lxc.start.delay",                true,  set_config_start,                      get_config_start,                      clr_config_start,                      },
 269         { "lxc.start.order",                true,  set_config_start,                      get_config_start,                      clr_config_start,                      },
 270         { "lxc.tty.dir",                    true,  set_config_tty_dir,                    get_config_tty_dir,                    clr_config_tty_dir,                    },
 271         { "lxc.tty.max",                    true,  set_config_tty_max,                    get_config_tty_max,                    clr_config_tty_max,                    },
 272         { "lxc.uts.name",                   true,  set_config_uts_name,                   get_config_uts_name,                   clr_config_uts_name,                   },
 273         { "lxc.sysctl",                     false, set_config_sysctl,                     get_config_sysctl,                     clr_config_sysctl,                     },
 274         { "lxc.proc",                       false, set_config_proc,                       get_config_proc,                       clr_config_proc,                       },
 275 };
 276
 277 static struct lxc_config_t unsupported_config_key = {
 278         NULL,
 279         false,
 280         set_config_unsupported_key,
 281         get_config_unsupported_key,
 282         clr_config_unsupported_key,
 283 };
 284
 285 struct lxc_config_net_t {
 286         LXC_CONFIG_MEMBERS;
 287 };
 288
 289 static struct lxc_config_net_t config_jump_table_net[] = {
 290         /* If a longer key is added please update. */
 291         #define NETWORK_SUBKEY_SIZE_MAX (STRLITERALLEN("veth.vlan.tagged.id") * 2)
 292         { "flags",                  true,  set_config_net_flags,                  get_config_net_flags,                  clr_config_net_flags,                  },
 293         { "hwaddr",                 true,  set_config_net_hwaddr,                 get_config_net_hwaddr,                 clr_config_net_hwaddr,                 },
 294         { "ipv4.address",           true,  set_config_net_ipv4_address,           get_config_net_ipv4_address,           clr_config_net_ipv4_address,           },
 295         { "ipv4.gateway",           true,  set_config_net_ipv4_gateway,           get_config_net_ipv4_gateway,           clr_config_net_ipv4_gateway,           },
 296         { "ipv6.address",           true,  set_config_net_ipv6_address,           get_config_net_ipv6_address,           clr_config_net_ipv6_address,           },
 297         { "ipv6.gateway",           true,  set_config_net_ipv6_gateway,           get_config_net_ipv6_gateway,           clr_config_net_ipv6_gateway,           },
 298         { "link",                   true,  set_config_net_link,                   get_config_net_link,                   clr_config_net_link,                   },
 299         { "l2proxy",                true,  set_config_net_l2proxy,                get_config_net_l2proxy,                clr_config_net_l2proxy,                },
 300         { "macvlan.mode",           true,  set_config_net_macvlan_mode,           get_config_net_macvlan_mode,           clr_config_net_macvlan_mode,           },
 301         { "ipvlan.mode",            true,  set_config_net_ipvlan_mode,            get_config_net_ipvlan_mode,            clr_config_net_ipvlan_mode,            },
 302         { "ipvlan.isolation",       true,  set_config_net_ipvlan_isolation,       get_config_net_ipvlan_isolation,       clr_config_net_ipvlan_isolation,       },
 303         { "mtu",                    true,  set_config_net_mtu,                    get_config_net_mtu,                    clr_config_net_mtu,                    },
 304         { "name",                   true,  set_config_net_name,                   get_config_net_name,                   clr_config_net_name,                   },
 305         { "script.down",            true,  set_config_net_script_down,            get_config_net_script_down,            clr_config_net_script_down,            },
 306         { "script.up",              true,  set_config_net_script_up,              get_config_net_script_up,              clr_config_net_script_up,              },
 307         { "type",                   true,  set_config_net_type,                   get_config_net_type,                   clr_config_net_type,                   },
 308         { "vlan.id",                true,  set_config_net_vlan_id,                get_config_net_vlan_id,                clr_config_net_vlan_id,                },
 309         { "veth.mode",              true,  set_config_net_veth_mode,              get_config_net_veth_mode,              clr_config_net_veth_mode,              },
 310         { "veth.pair",              true,  set_config_net_veth_pair,              get_config_net_veth_pair,              clr_config_net_veth_pair,              },
 311         { "veth.ipv4.route",        true,  set_config_net_veth_ipv4_route,        get_config_net_veth_ipv4_route,        clr_config_net_veth_ipv4_route,        },
 312         { "veth.ipv6.route",        true,  set_config_net_veth_ipv6_route,        get_config_net_veth_ipv6_route,        clr_config_net_veth_ipv6_route,        },
 313         { "veth.vlan.id",           true,  set_config_net_veth_vlan_id,           get_config_net_veth_vlan_id,           clr_config_net_veth_vlan_id,           },
 314         { "veth.vlan.tagged.id",    true,  set_config_net_veth_vlan_tagged_id,    get_config_net_veth_vlan_tagged_id,    clr_config_net_veth_vlan_tagged_id,    },
 315 };
 316
 317 static struct lxc_config_net_t unsupported_config_net_key = {
 318         NULL,
 319         false,
 320         set_config_unsupported_key,
 321         get_config_unsupported_key,
 322         clr_config_unsupported_key,
 323 };
 324
 325 struct lxc_config_t *lxc_get_config_exact(const char *key)
 326 {
 327         size_t i;
 328
 329         for (i = 0; i < ARRAY_SIZE(config_jump_table); i++)
 330                 if (strequal(config_jump_table[i].name, key))
 331                         return &config_jump_table[i];
 332
 333         return NULL;
 334 }
 335
 336 /* Assume a reasonable subkey size limit. */
 337 #define LXC_SUBKEY_LEN_MAX 256
 338
 339 static inline int match_config_item(const struct lxc_config_t *entry, const char *key)
 340 {
 341         size_t len;
 342
 343         if (entry->strict)
 344                 return strequal(entry->name, key);
 345
 346         /* There should be no subkey longer than this. */
 347         len = strnlen(entry->name, LXC_SUBKEY_LEN_MAX);
 348         if (len == LXC_SUBKEY_LEN_MAX)
 349                 return error_ret(-E2BIG, "Excessive subkey length");
 350
 351         return strnequal(entry->name, key, len);
 352 }
 353
 354 struct lxc_config_t *lxc_get_config(const char *key)
 355 {
 356         for (size_t i = 0; i < ARRAY_SIZE(config_jump_table); i++) {
 357                 struct lxc_config_t *cur = &config_jump_table[i];
 358
 359                 switch (match_config_item(cur, key)) {
 360                 case 0:
 361                         continue;
 362                 case -E2BIG:
 363                         return &unsupported_config_key;
 364                 }
 365
 366                 return cur;
 367         }
 368
 369         return &unsupported_config_key;
 370 }
 371
 372 static inline bool match_config_net_item(const struct lxc_config_net_t *entry,
 373                                          const char *key)
 374 {
 375         if (entry->strict)
 376                 return strequal(entry->name, key);
 377         return strnequal(entry->name, key, strlen(entry->name));
 378 }
 379
 380 static struct lxc_config_net_t *lxc_get_config_net(const char *key)
 381 {
 382         for (size_t i = 0; i < ARRAY_SIZE(config_jump_table_net); i++) {
 383                 struct lxc_config_net_t *cur = &config_jump_table_net[i];
 384
 385                 if (!match_config_net_item(cur, key))
 386                         continue;
 387
 388                 return cur;
 389         }
 390
 391         return &unsupported_config_net_key;
 392 }
 393
 394 static int set_config_net(const char *key, const char *value,
 395                           struct lxc_conf *lxc_conf, void *data)
 396 {
 397         if (!lxc_config_value_empty(value))
 398                 return syserror_set(-EINVAL, "lxc.net must not have a value");
 399
 400         return clr_config_net(key, lxc_conf, data);
 401 }
 402
 403 static int set_config_net_type(const char *key, const char *value,
 404                                struct lxc_conf *lxc_conf, void *data)
 405 {
 406         struct lxc_netdev *netdev = data;
 407
 408         if (!netdev)
 409                 return ret_errno(EINVAL);
 410
 411         clr_config_net_type(key, lxc_conf, data);
 412         if (lxc_config_value_empty(value))
 413                 return 0;
 414
 415         if (strequal(value, "veth")) {
 416                 netdev->type = LXC_NET_VETH;
 417                 INIT_LIST_HEAD(&netdev->priv.veth_attr.ipv4_routes);
 418                 INIT_LIST_HEAD(&netdev->priv.veth_attr.ipv6_routes);
 419                 lxc_list_init(&netdev->priv.veth_attr.vlan_tagged_ids);
 420                 if (!lxc_veth_flag_to_mode(netdev->priv.veth_attr.mode))
 421                         lxc_veth_mode_to_flag(&netdev->priv.veth_attr.mode, "bridge");
 422         } else if (strequal(value, "macvlan")) {
 423                 netdev->type = LXC_NET_MACVLAN;
 424                 if (!lxc_macvlan_flag_to_mode(netdev->priv.veth_attr.mode))
 425                         lxc_macvlan_mode_to_flag(&netdev->priv.macvlan_attr.mode, "private");
 426         } else if (strequal(value, "ipvlan")) {
 427                 netdev->type = LXC_NET_IPVLAN;
 428                 if (!lxc_ipvlan_flag_to_mode(netdev->priv.ipvlan_attr.mode))
 429                         lxc_ipvlan_mode_to_flag(&netdev->priv.ipvlan_attr.mode, "l3");
 430                 if (!lxc_ipvlan_flag_to_isolation(netdev->priv.ipvlan_attr.isolation))
 431                         lxc_ipvlan_isolation_to_flag(&netdev->priv.ipvlan_attr.isolation, "bridge");
 432         } else if (strequal(value, "vlan")) {
 433                 netdev->type = LXC_NET_VLAN;
 434         } else if (strequal(value, "phys")) {
 435                 netdev->type = LXC_NET_PHYS;
 436         } else if (strequal(value, "empty")) {
 437                 netdev->type = LXC_NET_EMPTY;
 438                 /* We don't support custom loopback device names. */
 439                 (void)strlcpy(netdev->name, "lo", IFNAMSIZ);
 440         } else if (strequal(value, "none")) {
 441                 netdev->type = LXC_NET_NONE;
 442         } else {
 443                 return log_error(-1, "Invalid network type %s", value);
 444         }
 445
 446         return 0;
 447 }
 448
 449 static int set_config_net_flags(const char *key, const char *value,
 450                                 struct lxc_conf *lxc_conf, void *data)
 451 {
 452         struct lxc_netdev *netdev = data;
 453
 454         if (!netdev)
 455                 return ret_errno(EINVAL);
 456
 457         if (lxc_config_value_empty(value))
 458                 return clr_config_net_flags(key, lxc_conf, data);
 459
 460         netdev->flags |= IFF_UP;
 461
 462         return 0;
 463 }
 464
 465 static int create_matched_ifnames(const char *value, struct lxc_conf *lxc_conf,
 466                                   struct lxc_netdev *netdev)
 467 {
 468         call_cleaner(netns_freeifaddrs) struct netns_ifaddrs *ifaddr = NULL;
 469         struct netns_ifaddrs *ifa;
 470         int n;
 471         int ret = 0;
 472         const char *type_key = "lxc.net.type";
 473         const char *link_key = "lxc.net.link";
 474         const char *tmpvalue = "phys";
 475
 476         if (netns_getifaddrs(&ifaddr, -1, &(bool){false}) < 0)
 477                 return log_error_errno(-1, errno, "Failed to get network interfaces");
 478
 479         for (ifa = ifaddr, n = 0; ifa != NULL; ifa = ifa->ifa_next, n++) {
 480                 if (!ifa->ifa_addr)
 481                         continue;
 482
 483                 if (ifa->ifa_addr->sa_family != AF_PACKET)
 484                         continue;
 485
 486                 if (strnequal(value, ifa->ifa_name, strlen(value) - 1)) {
 487                         ret = set_config_net_type(type_key, tmpvalue, lxc_conf,
 488                                                   netdev);
 489                         if (!ret) {
 490                                 ret = set_config_net_link(
 491                                     link_key, ifa->ifa_name, lxc_conf, netdev);
 492                                 if (ret) {
 493                                         ERROR("Failed to create matched ifnames");
 494                                         break;
 495                                 }
 496                         } else {
 497                                 ERROR("Failed to create matched ifnames");
 498                                 break;
 499                         }
 500                 }
 501         }
 502
 503         return ret;
 504 }
 505
 506 static int set_config_net_link(const char *key, const char *value,
 507                                struct lxc_conf *lxc_conf, void *data)
 508 {
 509         struct lxc_netdev *netdev = data;
 510         int ret = 0;
 511
 512         if (!netdev)
 513                 return ret_errno(EINVAL);
 514
 515         if (lxc_config_value_empty(value))
 516                 return clr_config_net_link(key, lxc_conf, data);
 517
 518         if (value[strlen(value) - 1] == '+' && netdev->type == LXC_NET_PHYS)
 519                 ret = create_matched_ifnames(value, lxc_conf, netdev);
 520         else
 521                 ret = network_ifname(netdev->link, value, sizeof(netdev->link));
 522
 523         return ret;
 524 }
 525
 526 static int set_config_net_l2proxy(const char *key, const char *value,
 527                                      struct lxc_conf *lxc_conf, void *data)
 528 {
 529         struct lxc_netdev *netdev = data;
 530         unsigned int val = 0;
 531         int ret;
 532
 533         if (!netdev)
 534                 return ret_errno(EINVAL);
 535
 536         if (lxc_config_value_empty(value))
 537                 return clr_config_net_l2proxy(key, lxc_conf, data);
 538
 539         ret = lxc_safe_uint(value, &val);
 540         if (ret < 0)
 541                 return ret_errno(ret);
 542
 543         switch (val) {
 544         case 0:
 545                 netdev->l2proxy = false;
 546                 return 0;
 547         case 1:
 548                 netdev->l2proxy = true;
 549                 return 0;
 550         }
 551
 552         return ret_errno(EINVAL);
 553 }
 554
 555 static int set_config_net_name(const char *key, const char *value,
 556                                struct lxc_conf *lxc_conf, void *data)
 557 {
 558         struct lxc_netdev *netdev = data;
 559
 560         if (!netdev)
 561                 return ret_errno(EINVAL);
 562
 563         if (lxc_config_value_empty(value))
 564                 return clr_config_net_name(key, lxc_conf, data);
 565
 566         return network_ifname(netdev->name, value, sizeof(netdev->name));
 567 }
 568
 569
 570 static int set_config_net_veth_mode(const char *key, const char *value,
 571                                        struct lxc_conf *lxc_conf, void *data)
 572 {
 573         struct lxc_netdev *netdev = data;
 574
 575         if (!netdev)
 576                 return ret_errno(EINVAL);
 577
 578         if (netdev->type != LXC_NET_VETH)
 579                 return ret_errno(EINVAL);
 580
 581         if (lxc_config_value_empty(value))
 582                 return clr_config_net_veth_mode(key, lxc_conf, data);
 583
 584         if (!netdev)
 585                 return ret_errno(EINVAL);
 586
 587         return lxc_veth_mode_to_flag(&netdev->priv.veth_attr.mode, value);
 588 }
 589
 590 static int set_config_net_veth_pair(const char *key, const char *value,
 591                                     struct lxc_conf *lxc_conf, void *data)
 592 {
 593         struct lxc_netdev *netdev = data;
 594
 595         if (!netdev)
 596                 return ret_errno(EINVAL);
 597
 598         if (netdev->type != LXC_NET_VETH)
 599                 return ret_errno(EINVAL);
 600
 601         if (lxc_config_value_empty(value))
 602                 return clr_config_net_veth_pair(key, lxc_conf, data);
 603
 604         return network_ifname(netdev->priv.veth_attr.pair, value,
 605                               sizeof(netdev->priv.veth_attr.pair));
 606 }
 607
 608 static int set_config_net_veth_vlan_id(const char *key, const char *value,
 609                                        struct lxc_conf *lxc_conf, void *data)
 610 {
 611         int ret;
 612         struct lxc_netdev *netdev = data;
 613
 614         if (!netdev)
 615                 return ret_errno(EINVAL);
 616
 617         if (netdev->type != LXC_NET_VETH)
 618                 return ret_errno(EINVAL);
 619
 620         if (lxc_config_value_empty(value))
 621                 return clr_config_net_veth_vlan_id(key, lxc_conf, data);
 622
 623         if (strequal(value, "none")) {
 624                 netdev->priv.veth_attr.vlan_id = BRIDGE_VLAN_NONE;
 625         } else {
 626                 unsigned short vlan_id;
 627
 628                 ret = get_u16(&vlan_id, value, 0);
 629                 if (ret < 0)
 630                         return ret_errno(EINVAL);
 631
 632                 if (vlan_id > BRIDGE_VLAN_ID_MAX)
 633                         return ret_errno(EINVAL);
 634
 635                 netdev->priv.veth_attr.vlan_id = vlan_id;
 636         }
 637
 638         netdev->priv.veth_attr.vlan_id_set = true;
 639         return 0;
 640 }
 641
 642 static int set_config_net_veth_vlan_tagged_id(const char *key, const char *value,
 643                                               struct lxc_conf *lxc_conf,
 644                                               void *data)
 645 {
 646         __do_free struct lxc_list *list = NULL;
 647         int ret;
 648         unsigned short vlan_id;
 649         struct lxc_netdev *netdev = data;
 650
 651         if (!netdev)
 652                 return ret_errno(EINVAL);
 653
 654         if (netdev->type != LXC_NET_VETH)
 655                 return ret_errno(EINVAL);
 656
 657         if (lxc_config_value_empty(value))
 658                 return clr_config_net_veth_vlan_tagged_id(key, lxc_conf, data);
 659
 660         ret = get_u16(&vlan_id, value, 0);
 661         if (ret < 0)
 662                 return ret_errno(EINVAL);
 663
 664         if (vlan_id > BRIDGE_VLAN_ID_MAX)
 665                 return ret_errno(EINVAL);
 666
 667         list = lxc_list_new();
 668         if (!list)
 669                 return ret_errno(ENOMEM);
 670
 671         list->elem = UINT_TO_PTR(vlan_id);
 672
 673         lxc_list_add_tail(&netdev->priv.veth_attr.vlan_tagged_ids, move_ptr(list));
 674
 675         return 0;
 676 }
 677
 678 static int set_config_net_macvlan_mode(const char *key, const char *value,
 679                                        struct lxc_conf *lxc_conf, void *data)
 680 {
 681         struct lxc_netdev *netdev = data;
 682
 683         if (!netdev)
 684                 return ret_errno(EINVAL);
 685
 686         if (netdev->type != LXC_NET_MACVLAN)
 687                 return ret_errno(EINVAL);
 688
 689         if (lxc_config_value_empty(value))
 690                 return clr_config_net_macvlan_mode(key, lxc_conf, data);
 691
 692         return lxc_macvlan_mode_to_flag(&netdev->priv.macvlan_attr.mode, value);
 693 }
 694
 695 static int set_config_net_ipvlan_mode(const char *key, const char *value,
 696                                       struct lxc_conf *lxc_conf, void *data)
 697 {
 698         struct lxc_netdev *netdev = data;
 699
 700         if (!netdev)
 701                 return ret_errno(EINVAL);
 702
 703         if (netdev->type != LXC_NET_IPVLAN)
 704                 return syserror_set(-EINVAL, "Invalid ipvlan mode \"%s\", can only be used with ipvlan network", value);
 705
 706         if (lxc_config_value_empty(value))
 707                 return clr_config_net_ipvlan_mode(key, lxc_conf, data);
 708
 709         return lxc_ipvlan_mode_to_flag(&netdev->priv.ipvlan_attr.mode, value);
 710 }
 711
 712 static int set_config_net_ipvlan_isolation(const char *key, const char *value,
 713                                            struct lxc_conf *lxc_conf, void *data)
 714 {
 715         struct lxc_netdev *netdev = data;
 716
 717         if (!netdev)
 718                 return ret_errno(EINVAL);
 719
 720         if (netdev->type != LXC_NET_IPVLAN)
 721                 return syserror_set(-EINVAL, "Invalid ipvlan isolation \"%s\", can only be used with ipvlan network", value);
 722
 723         if (lxc_config_value_empty(value))
 724                 return clr_config_net_ipvlan_isolation(key, lxc_conf, data);
 725
 726         return lxc_ipvlan_isolation_to_flag(&netdev->priv.ipvlan_attr.isolation, value);
 727 }
 728
 729 static int set_config_net_hwaddr(const char *key, const char *value,
 730                                  struct lxc_conf *lxc_conf, void *data)
 731 {
 732         __do_free char *new_value = NULL;
 733         struct lxc_netdev *netdev = data;
 734
 735         if (!netdev)
 736                 return ret_errno(EINVAL);
 737
 738         clr_config_net_hwaddr(key, lxc_conf, data);
 739         if (lxc_config_value_empty(value))
 740                 return 0;
 741
 742         new_value = strdup(value);
 743         if (!new_value)
 744                 return ret_errno(ENOMEM);
 745
 746         rand_complete_hwaddr(new_value);
 747         if (!lxc_config_value_empty(new_value))
 748                 netdev->hwaddr = move_ptr(new_value);
 749
 750         return 0;
 751 }
 752
 753 static int set_config_net_vlan_id(const char *key, const char *value,
 754                                   struct lxc_conf *lxc_conf, void *data)
 755 {
 756         int ret;
 757         struct lxc_netdev *netdev = data;
 758
 759         if (!netdev)
 760                 return ret_errno(EINVAL);
 761
 762         if (netdev->type != LXC_NET_VLAN)
 763                 return ret_errno(EINVAL);
 764
 765         if (lxc_config_value_empty(value))
 766                 return clr_config_net_vlan_id(key, lxc_conf, data);
 767
 768         ret = get_u16(&netdev->priv.vlan_attr.vid, value, 0);
 769         if (ret < 0)
 770                 return ret;
 771
 772         return 0;
 773 }
 774
 775 static int set_config_net_mtu(const char *key, const char *value,
 776                               struct lxc_conf *lxc_conf, void *data)
 777 {
 778         struct lxc_netdev *netdev = data;
 779
 780         if (!netdev)
 781                 return ret_errno(EINVAL);
 782
 783         clr_config_net_mtu(key, lxc_conf, data);
 784         if (lxc_config_value_empty(value))
 785                 return 0;
 786
 787         return set_config_string_item(&netdev->mtu, value);
 788 }
 789
 790 static int set_config_net_ipv4_address(const char *key, const char *value,
 791                                        struct lxc_conf *lxc_conf, void *data)
 792 {
 793         __do_free char *addr = NULL;
 794         __do_free struct lxc_inetdev *inetdev = NULL;
 795         int ret;
 796         struct lxc_netdev *netdev = data;
 797         char *cursor, *slash;
 798         char *bcast = NULL, *prefix = NULL;
 799
 800         if (!netdev)
 801                 return ret_errno(EINVAL);
 802
 803         if (lxc_config_value_empty(value))
 804                 return clr_config_net_ipv4_address(key, lxc_conf, data);
 805
 806         inetdev = zalloc(sizeof(*inetdev));
 807         if (!inetdev)
 808                 return ret_errno(ENOMEM);
 809
 810         addr = strdup(value);
 811         if (!addr)
 812                 return ret_errno(ENOMEM);
 813
 814         cursor = strstr(addr, " ");
 815         if (cursor) {
 816                 *cursor = '\0';
 817                 bcast = cursor + 1;
 818         }
 819
 820         slash = strstr(addr, "/");
 821         if (slash) {
 822                 *slash = '\0';
 823                 prefix = slash + 1;
 824         }
 825
 826         ret = inet_pton(AF_INET, addr, &inetdev->addr);
 827         if (!ret || ret < 0)
 828                 return log_error_errno(-1, errno, "Invalid ipv4 address \"%s\"", value);
 829
 830         if (bcast) {
 831                 ret = inet_pton(AF_INET, bcast, &inetdev->bcast);
 832                 if (!ret || ret < 0)
 833                         return log_error_errno(-1, errno, "Invalid ipv4 broadcast address \"%s\"", value);
 834
 835         }
 836
 837         /* No prefix specified, determine it from the network class. */
 838         ret = 0;
 839         if (prefix)
 840                 ret = lxc_safe_uint(prefix, &inetdev->prefix);
 841         else
 842                 inetdev->prefix = config_ip_prefix(&inetdev->addr);
 843         if (ret || inetdev->prefix > 32)
 844                 return ret_errno(EINVAL);
 845
 846         /* If no broadcast address, compute one from the prefix and address. */
 847         if (!bcast) {
 848                 unsigned int shift = LAST_BIT_PER_TYPE(inetdev->prefix);
 849
 850                 inetdev->bcast.s_addr = inetdev->addr.s_addr;
 851                 if (inetdev->prefix < shift)
 852                         shift = inetdev->prefix;
 853                 inetdev->bcast.s_addr |= htonl(INADDR_BROADCAST >> shift);
 854         }
 855
 856         list_add_tail(&inetdev->head, &netdev->ipv4_addresses);
 857         move_ptr(inetdev);
 858
 859         return 0;
 860 }
 861
 862 static int set_config_net_ipv4_gateway(const char *key, const char *value,
 863                                        struct lxc_conf *lxc_conf, void *data)
 864 {
 865         struct lxc_netdev *netdev = data;
 866
 867         if (!netdev)
 868                 return ret_errno(EINVAL);
 869
 870         clr_config_net_ipv4_gateway(key, lxc_conf, data);
 871         if (lxc_config_value_empty(value))
 872                 return 0;
 873
 874         if (strequal(value, "auto")) {
 875                 netdev->ipv4_gateway = NULL;
 876                 netdev->ipv4_gateway_auto = true;
 877         } else if (strequal(value, "dev")) {
 878                 netdev->ipv4_gateway = NULL;
 879                 netdev->ipv4_gateway_auto = false;
 880                 netdev->ipv4_gateway_dev = true;
 881         } else {
 882                 __do_free struct in_addr *gw = NULL;
 883                 int ret;
 884
 885                 gw = zalloc(sizeof(*gw));
 886                 if (!gw)
 887                         return ret_errno(ENOMEM);
 888
 889                 ret = inet_pton(AF_INET, value, gw);
 890                 if (!ret || ret < 0)
 891                         return log_error_errno(-1, errno, "Invalid ipv4 gateway address \"%s\"", value);
 892
 893                 netdev->ipv4_gateway = move_ptr(gw);
 894                 netdev->ipv4_gateway_auto = false;
 895         }
 896
 897         return 0;
 898 }
 899
 900 static int set_config_net_veth_ipv4_route(const char *key, const char *value,
 901                                           struct lxc_conf *lxc_conf, void *data)
 902 {
 903         __do_free char *valdup = NULL;
 904         __do_free struct lxc_inetdev *inetdev = NULL;
 905         int ret;
 906         char *netmask, *slash;
 907         struct lxc_netdev *netdev = data;
 908
 909         if (!netdev)
 910                 return ret_errno(EINVAL);
 911
 912         if (netdev->type != LXC_NET_VETH)
 913                 return syserror_set(-EINVAL, "Invalid ipv4 route \"%s\", can only be used with veth network", value);
 914
 915         if (lxc_config_value_empty(value))
 916                 return clr_config_net_veth_ipv4_route(key, lxc_conf, data);
 917
 918         inetdev = zalloc(sizeof(*inetdev));
 919         if (!inetdev)
 920                 return ret_errno(ENOMEM);
 921
 922         valdup = strdup(value);
 923         if (!valdup)
 924                 return ret_errno(ENOMEM);
 925
 926         slash = strchr(valdup, '/');
 927         if (!slash)
 928                 return ret_errno(EINVAL);
 929
 930         *slash = '\0';
 931         slash++;
 932         if (*slash == '\0')
 933                 return ret_errno(EINVAL);
 934
 935         netmask = slash;
 936
 937         ret = lxc_safe_uint(netmask, &inetdev->prefix);
 938         if (ret < 0 || inetdev->prefix > 32)
 939                 return ret_errno(EINVAL);
 940
 941         ret = inet_pton(AF_INET, valdup, &inetdev->addr);
 942         if (!ret || ret < 0)
 943                 return ret_errno(EINVAL);
 944
 945         list_add_tail(&inetdev->head, &netdev->priv.veth_attr.ipv4_routes);
 946         move_ptr(inetdev);
 947
 948         return 0;
 949 }
 950
 951 static int set_config_net_ipv6_address(const char *key, const char *value,
 952                                        struct lxc_conf *lxc_conf, void *data)
 953 {
 954         __do_free char *valdup = NULL;
 955         __do_free struct lxc_inet6dev *inet6dev = NULL;
 956         int ret;
 957         struct lxc_netdev *netdev = data;
 958         char *slash, *netmask;
 959
 960         if (!netdev)
 961                 return ret_errno(EINVAL);
 962
 963         if (lxc_config_value_empty(value))
 964                 return clr_config_net_ipv6_address(key, lxc_conf, data);
 965
 966         inet6dev = zalloc(sizeof(*inet6dev));
 967         if (!inet6dev)
 968                 return ret_errno(ENOMEM);
 969
 970         valdup = strdup(value);
 971         if (!valdup)
 972                 return ret_errno(ENOMEM);
 973
 974         inet6dev->prefix = 64;
 975         slash = strstr(valdup, "/");
 976         if (slash) {
 977                 *slash = '\0';
 978                 netmask = slash + 1;
 979
 980                 ret = lxc_safe_uint(netmask, &inet6dev->prefix);
 981                 if (ret < 0)
 982                         return ret;
 983         }
 984
 985         ret = inet_pton(AF_INET6, valdup, &inet6dev->addr);
 986         if (!ret || ret < 0)
 987                 return log_error_errno(-EINVAL, EINVAL, "Invalid ipv6 address \"%s\"", valdup);
 988
 989         list_add_tail(&inet6dev->head, &netdev->ipv6_addresses);
 990         move_ptr(inet6dev);
 991
 992         return 0;
 993 }
 994
 995 static int set_config_net_ipv6_gateway(const char *key, const char *value,
 996                                        struct lxc_conf *lxc_conf, void *data)
 997 {
 998         struct lxc_netdev *netdev = data;
 999
1000         if (!netdev)
1001                 return ret_errno(EINVAL);
1002
1003         clr_config_net_ipv6_gateway(key, lxc_conf, data);
1004         if (lxc_config_value_empty(value))
1005                 return 0;
1006
1007         if (strequal(value, "auto")) {
1008                 netdev->ipv6_gateway = NULL;
1009                 netdev->ipv6_gateway_auto = true;
1010         } else if (strequal(value, "dev")) {
1011                 netdev->ipv6_gateway = NULL;
1012                 netdev->ipv6_gateway_auto = false;
1013                 netdev->ipv6_gateway_dev = true;
1014         } else {
1015                 int ret;
1016                 __do_free struct in6_addr *gw = NULL;
1017
1018                 gw = zalloc(sizeof(*gw));
1019                 if (!gw)
1020                         return ret_errno(ENOMEM);
1021
1022                 ret = inet_pton(AF_INET6, value, gw);
1023                 if (!ret || ret < 0)
1024                         return log_error_errno(-EINVAL, EINVAL,
1025                                                "Invalid ipv6 gateway address \"%s\"", value);
1026
1027                 netdev->ipv6_gateway = move_ptr(gw);
1028                 netdev->ipv6_gateway_auto = false;
1029         }
1030
1031         return 0;
1032 }
1033
1034 static int set_config_net_veth_ipv6_route(const char *key, const char *value,
1035                                           struct lxc_conf *lxc_conf, void *data)
1036 {
1037         __do_free char *valdup = NULL;
1038         __do_free struct lxc_inet6dev *inet6dev = NULL;
1039         int ret;
1040         char *netmask, *slash;
1041         struct lxc_netdev *netdev = data;
1042
1043         if (!netdev)
1044                 return ret_errno(EINVAL);
1045
1046         if (netdev->type != LXC_NET_VETH)
1047                 return syserror_set(-EINVAL, "Invalid ipv6 route \"%s\", can only be used with veth network", value);
1048
1049         if (lxc_config_value_empty(value))
1050                 return clr_config_net_veth_ipv6_route(key, lxc_conf, data);
1051
1052         inet6dev = zalloc(sizeof(*inet6dev));
1053         if (!inet6dev)
1054                 return ret_errno(ENOMEM);
1055
1056         valdup = strdup(value);
1057         if (!valdup)
1058                 return ret_errno(ENOMEM);
1059
1060         slash = strchr(valdup, '/');
1061         if (!slash)
1062                 return ret_errno(EINVAL);
1063
1064         *slash = '\0';
1065         slash++;
1066         if (*slash == '\0')
1067                 return ret_errno(EINVAL);
1068
1069         netmask = slash;
1070
1071         ret = lxc_safe_uint(netmask, &inet6dev->prefix);
1072         if (ret < 0 || inet6dev->prefix > 128)
1073                 return ret_errno(EINVAL);
1074
1075         ret = inet_pton(AF_INET6, valdup, &inet6dev->addr);
1076         if (!ret || ret < 0)
1077                 return ret_errno(EINVAL);
1078
1079         list_add_tail(&inet6dev->head, &netdev->priv.veth_attr.ipv6_routes);
1080         move_ptr(inet6dev);
1081
1082         return 0;
1083 }
1084
1085 static int set_config_net_script_up(const char *key, const char *value,
1086                                     struct lxc_conf *lxc_conf, void *data)
1087 {
1088         struct lxc_netdev *netdev = data;
1089
1090         if (!netdev)
1091                 return ret_errno(EINVAL);
1092
1093         clr_config_net_script_up(key, lxc_conf, data);
1094         if (lxc_config_value_empty(value))
1095                 return 0;
1096
1097         return set_config_string_item(&netdev->upscript, value);
1098 }
1099
1100 static int set_config_net_script_down(const char *key, const char *value,
1101                                       struct lxc_conf *lxc_conf, void *data)
1102 {
1103         struct lxc_netdev *netdev = data;
1104
1105         if (!netdev)
1106                 return ret_errno(EINVAL);
1107
1108         clr_config_net_script_down(key, lxc_conf, data);
1109         if (lxc_config_value_empty(value))
1110                 return 0;
1111
1112         return set_config_string_item(&netdev->downscript, value);
1113 }
1114
1115 static int add_hook(struct lxc_conf *lxc_conf, int which, __owns char *hook)
1116 {
1117         __do_free char *val = hook;
1118         __do_free struct string_entry *entry;
1119
1120         entry = zalloc(sizeof(struct string_entry));
1121         if (!entry)
1122                 return ret_errno(ENOMEM);
1123
1124         entry->val = move_ptr(val);
1125         list_add_tail(&entry->head, &lxc_conf->hooks[which]);
1126         move_ptr(entry);
1127
1128         return 0;
1129 }
1130
1131 static int set_config_seccomp_allow_nesting(const char *key, const char *value,
1132                                             struct lxc_conf *lxc_conf, void *data)
1133 {
1134 #ifdef HAVE_SECCOMP
1135         if (lxc_config_value_empty(value))
1136                 return clr_config_seccomp_allow_nesting(key, lxc_conf, NULL);
1137
1138         if (lxc_safe_uint(value, &lxc_conf->seccomp.allow_nesting) < 0)
1139                 return -errno;
1140
1141         if (lxc_conf->seccomp.allow_nesting > 1)
1142                 return ret_errno(EINVAL);
1143
1144         return 0;
1145 #else
1146         return ret_errno(ENOSYS);
1147 #endif
1148 }
1149
1150 static int set_config_seccomp_notify_cookie(const char *key, const char *value,
1151                                             struct lxc_conf *lxc_conf, void *data)
1152 {
1153 #ifdef HAVE_SECCOMP_NOTIFY
1154         return set_config_string_item(&lxc_conf->seccomp.notifier.cookie, value);
1155 #else
1156         return ret_errno(ENOSYS);
1157 #endif
1158 }
1159
1160 static int set_config_seccomp_notify_proxy(const char *key, const char *value,
1161                                            struct lxc_conf *lxc_conf, void *data)
1162 {
1163 #ifdef HAVE_SECCOMP_NOTIFY
1164         const char *offset;
1165
1166         if (lxc_config_value_empty(value))
1167                 return clr_config_seccomp_notify_proxy(key, lxc_conf, NULL);
1168
1169         if (!strnequal(value, "unix:", 5))
1170                 return ret_errno(EINVAL);
1171
1172         offset = value + 5;
1173         if (lxc_unix_sockaddr(&lxc_conf->seccomp.notifier.proxy_addr, offset) < 0)
1174                 return -errno;
1175
1176         return 0;
1177 #else
1178         return ret_errno(ENOSYS);
1179 #endif
1180 }
1181
1182 static int set_config_seccomp_profile(const char *key, const char *value,
1183                                       struct lxc_conf *lxc_conf, void *data)
1184 {
1185 #ifdef HAVE_SECCOMP
1186         return set_config_path_item(&lxc_conf->seccomp.seccomp, value);
1187 #else
1188         return ret_errno(ENOSYS);
1189 #endif
1190 }
1191
1192 static int set_config_execute_cmd(const char *key, const char *value,
1193                                struct lxc_conf *lxc_conf, void *data)
1194 {
1195         return set_config_path_item(&lxc_conf->execute_cmd, value);
1196 }
1197
1198 static int set_config_init_cmd(const char *key, const char *value,
1199                                struct lxc_conf *lxc_conf, void *data)
1200 {
1201         return set_config_path_item(&lxc_conf->init_cmd, value);
1202 }
1203
1204 static int set_config_init_cwd(const char *key, const char *value,
1205                                struct lxc_conf *lxc_conf, void *data)
1206 {
1207         return set_config_path_item(&lxc_conf->init_cwd, value);
1208 }
1209
1210 static int set_config_init_uid(const char *key, const char *value,
1211                                struct lxc_conf *lxc_conf, void *data)
1212 {
1213         unsigned int init_uid;
1214
1215         if (lxc_config_value_empty(value)) {
1216                 lxc_conf->init_uid = 0;
1217                 return 0;
1218         }
1219
1220         if (lxc_safe_uint(value, &init_uid) < 0)
1221                 return -errno;
1222
1223         lxc_conf->init_uid = init_uid;
1224
1225         return 0;
1226 }
1227
1228 static int set_config_init_gid(const char *key, const char *value,
1229                                struct lxc_conf *lxc_conf, void *data)
1230 {
1231         unsigned int init_gid;
1232
1233         if (lxc_config_value_empty(value)) {
1234                 lxc_conf->init_gid = 0;
1235                 return 0;
1236         }
1237
1238         if (lxc_safe_uint(value, &init_gid) < 0)
1239                 return -errno;
1240
1241         lxc_conf->init_gid = init_gid;
1242
1243         return 0;
1244 }
1245
1246 static int set_config_init_groups(const char *key, const char *value,
1247                                   struct lxc_conf *lxc_conf, void *data)
1248 {
1249         __do_free char *value_dup = NULL;
1250         gid_t *init_groups = NULL;
1251         size_t num_groups = 0;
1252         size_t idx;
1253         char *token;
1254
1255         if (lxc_config_value_empty(value))
1256                 return clr_config_init_groups(key, lxc_conf, NULL);
1257
1258         value_dup = strdup(value);
1259         if (!value_dup)
1260                 return -ENOMEM;
1261
1262         lxc_iterate_parts(token, value_dup, ",")
1263                 num_groups++;
1264
1265         if (num_groups == INT_MAX)
1266                 return log_error_errno(-ERANGE, ERANGE, "Excessive number of supplementary groups specified");
1267
1268         /* This means the string wasn't empty and all we found was garbage. */
1269         if (num_groups == 0)
1270                 return log_error_errno(-EINVAL, EINVAL, "No valid groups specified %s", value);
1271
1272         idx = lxc_conf->init_groups.size;
1273         init_groups = realloc(lxc_conf->init_groups.list, sizeof(gid_t) * (idx + num_groups));
1274         if (!init_groups)
1275                 return ret_errno(ENOMEM);
1276
1277         /*
1278          * Once the realloc() succeeded we need to hand control of the memory
1279          * back to the config otherwise we risk a double-free when
1280          * lxc_conf_free() is called.
1281          */
1282         lxc_conf->init_groups.list = init_groups;
1283
1284         /* Restore duplicated value so we can call lxc_iterate_parts() again. */
1285         strcpy(value_dup, value);
1286
1287         lxc_iterate_parts(token, value_dup, ",") {
1288                 int ret;
1289
1290                 gid_t group;
1291
1292                 ret = lxc_safe_uint(token, &group);
1293                 if (ret)
1294                         return log_error_errno(ret, -ret, "Failed to parse group %s", token);
1295
1296                 init_groups[idx++] = group;
1297         }
1298
1299         lxc_conf->init_groups.size += num_groups;
1300
1301         return 0;
1302 }
1303
1304 static int set_config_hooks(const char *key, const char *value,
1305                             struct lxc_conf *lxc_conf, void *data)
1306 {
1307         __do_free char *copy = NULL;
1308
1309         if (lxc_config_value_empty(value))
1310                 return lxc_clear_hooks(lxc_conf, key);
1311
1312         if (strequal(key + 4, "hook"))
1313                 return log_error_errno(-EINVAL, EINVAL, "lxc.hook must not have a value");
1314
1315         copy = strdup(value);
1316         if (!copy)
1317                 return ret_errno(ENOMEM);
1318
1319         if (strequal(key + 9, "pre-start"))
1320                 return add_hook(lxc_conf, LXCHOOK_PRESTART, move_ptr(copy));
1321         else if (strequal(key + 9, "start-host"))
1322                 return add_hook(lxc_conf, LXCHOOK_START_HOST, move_ptr(copy));
1323         else if (strequal(key + 9, "pre-mount"))
1324                 return add_hook(lxc_conf, LXCHOOK_PREMOUNT, move_ptr(copy));
1325         else if (strequal(key + 9, "autodev"))
1326                 return add_hook(lxc_conf, LXCHOOK_AUTODEV, move_ptr(copy));
1327         else if (strequal(key + 9, "mount"))
1328                 return add_hook(lxc_conf, LXCHOOK_MOUNT, move_ptr(copy));
1329         else if (strequal(key + 9, "start"))
1330                 return add_hook(lxc_conf, LXCHOOK_START, move_ptr(copy));
1331         else if (strequal(key + 9, "stop"))
1332                 return add_hook(lxc_conf, LXCHOOK_STOP, move_ptr(copy));
1333         else if (strequal(key + 9, "post-stop"))
1334                 return add_hook(lxc_conf, LXCHOOK_POSTSTOP, move_ptr(copy));
1335         else if (strequal(key + 9, "clone"))
1336                 return add_hook(lxc_conf, LXCHOOK_CLONE, move_ptr(copy));
1337         else if (strequal(key + 9, "destroy"))
1338                 return add_hook(lxc_conf, LXCHOOK_DESTROY, move_ptr(copy));
1339
1340         return ret_errno(EINVAL);
1341 }
1342
1343 static int set_config_hooks_version(const char *key, const char *value,
1344                                     struct lxc_conf *lxc_conf, void *data)
1345 {
1346         int ret;
1347         unsigned int tmp;
1348
1349         if (lxc_config_value_empty(value))
1350                 return clr_config_hooks_version(key, lxc_conf, NULL);
1351
1352         ret = lxc_safe_uint(value, &tmp);
1353         if (ret < 0)
1354                 return -errno;
1355
1356         if (tmp > 1)
1357                 return syserror_set(-EINVAL, "Invalid hook version specified. Currently only 0 (legacy) and 1 are supported");
1358
1359         lxc_conf->hooks_version = tmp;
1360
1361         return 0;
1362 }
1363
1364 static int set_config_personality(const char *key, const char *value,
1365                                   struct lxc_conf *lxc_conf, void *data)
1366 {
1367         int ret;
1368         personality_t personality;
1369
1370         ret = lxc_config_parse_arch(value, &personality);
1371         if (ret < 0)
1372                 return syserror("Unsupported personality \"%s\"", value);
1373
1374         lxc_conf->personality = personality;
1375         return 0;
1376 }
1377
1378 static int set_config_pty_max(const char *key, const char *value,
1379                               struct lxc_conf *lxc_conf, void *data)
1380 {
1381         int ret;
1382         unsigned int max = 0;
1383
1384         if (lxc_config_value_empty(value)) {
1385                 lxc_conf->pty_max = 0;
1386                 return 0;
1387         }
1388
1389         ret = lxc_safe_uint(value, &max);
1390         if (ret < 0)
1391                 return ret_errno(EINVAL);
1392
1393         lxc_conf->pty_max = max;
1394
1395         return 0;
1396 }
1397
1398 /* We only need to check whether the first byte of the key after the lxc.start.
1399  * prefix matches our expectations since they fortunately all start with a
1400  * different letter. If anything was wrong with the key we would have already
1401  * noticed when the callback was called.
1402  */
1403 static int set_config_start(const char *key, const char *value,
1404                             struct lxc_conf *lxc_conf, void *data)
1405 {
1406         int ret;
1407         bool is_empty;
1408
1409         is_empty = lxc_config_value_empty(value);
1410
1411         if (*(key + 10) == 'a') { /* lxc.start.auto */
1412                 if (is_empty) {
1413                         lxc_conf->start_auto = 0;
1414                         return 0;
1415                 }
1416
1417                 ret = lxc_safe_uint(value, &lxc_conf->start_auto);
1418                 if (ret)
1419                         return ret;
1420
1421                 if (lxc_conf->start_auto > 1)
1422                         return ret_errno(EINVAL);
1423
1424                 return 0;
1425         } else if (*(key + 10) == 'd') { /* lxc.start.delay */
1426                 if (is_empty) {
1427                         lxc_conf->start_delay = 0;
1428                         return 0;
1429                 }
1430
1431                 return lxc_safe_uint(value, &lxc_conf->start_delay);
1432         } else if (*(key + 10) == 'o') { /* lxc.start.order */
1433                 if (is_empty) {
1434                         lxc_conf->start_order = 0;
1435                         return 0;
1436                 }
1437
1438                 return lxc_safe_int(value, &lxc_conf->start_order);
1439         }
1440
1441         return ret_errno(EINVAL);
1442 }
1443
1444 static int set_config_monitor(const char *key, const char *value,
1445                               struct lxc_conf *lxc_conf, void *data)
1446 {
1447         if (lxc_config_value_empty(value)) {
1448                 lxc_conf->monitor_unshare = 0;
1449                 return 0;
1450         }
1451
1452         if (strequal(key + 12, "unshare"))
1453                 return lxc_safe_uint(value, &lxc_conf->monitor_unshare);
1454
1455         return ret_errno(EINVAL);
1456 }
1457
1458 static int set_config_monitor_signal_pdeath(const char *key, const char *value,
1459                                             struct lxc_conf *lxc_conf, void *data)
1460 {
1461         if (lxc_config_value_empty(value)) {
1462                 lxc_conf->monitor_signal_pdeath = 0;
1463                 return 0;
1464         }
1465
1466         if (strequal(key + 12, "signal.pdeath")) {
1467                 int sig_n;
1468
1469                 sig_n = sig_parse(value);
1470                 if (sig_n < 0)
1471                         return ret_errno(EINVAL);
1472
1473                 lxc_conf->monitor_signal_pdeath = sig_n;
1474                 return 0;
1475         }
1476
1477         return ret_errno(EINVAL);
1478 }
1479
1480 static int set_config_group(const char *key, const char *value,
1481                             struct lxc_conf *lxc_conf, void *data)
1482 {
1483         __do_free char *groups = NULL;
1484         char *token;
1485
1486         if (lxc_config_value_empty(value))
1487                 return lxc_clear_groups(lxc_conf);
1488
1489         groups = strdup(value);
1490         if (!groups)
1491                 return ret_errno(ENOMEM);
1492
1493         /*
1494          * In case several groups are specified in a single line split these
1495          * groups in a single element for the list.
1496          */
1497         lxc_iterate_parts(token, groups, " \t") {
1498                 __do_free char *val = NULL;
1499                 __do_free struct string_entry *entry = NULL;
1500
1501                 entry = zalloc(sizeof(struct string_entry));
1502                 if (!entry)
1503                         return ret_errno(ENOMEM);
1504
1505                 val = strdup(token);
1506                 if (!val)
1507                         return ret_errno(ENOMEM);
1508
1509                 entry->val = move_ptr(val);
1510                 list_add_tail(&entry->head, &lxc_conf->groups);
1511                 move_ptr(entry);
1512         }
1513
1514         return 0;
1515 }
1516
1517 static int set_config_environment(const char *key, const char *value,
1518                                   struct lxc_conf *lxc_conf, void *data)
1519 {
1520         __do_free char *dup = NULL, *val = NULL;
1521         __do_free struct environment_entry *new_env = NULL;
1522         char *env_val;
1523
1524         if (lxc_config_value_empty(value))
1525                 return lxc_clear_environment(lxc_conf);
1526
1527         new_env = zalloc(sizeof(struct environment_entry));
1528         if (!new_env)
1529                 return ret_errno(ENOMEM);
1530
1531         dup = strdup(value);
1532         if (!dup)
1533                 return ret_errno(ENOMEM);
1534
1535         env_val = strchr(dup, '=');
1536         if (!env_val) {
1537                 env_val = getenv(dup);
1538         } else {
1539                 *env_val = '\0';
1540                 env_val++;
1541         }
1542         if (!env_val)
1543                 return ret_errno(ENOENT);
1544
1545         val = strdup(env_val);
1546         if (!val)
1547                 return ret_errno(ENOMEM);
1548
1549         new_env->key = move_ptr(dup);
1550         new_env->val = move_ptr(val);
1551
1552         list_add_tail(&new_env->head, &lxc_conf->environment);
1553         move_ptr(new_env);
1554
1555         return 0;
1556 }
1557
1558 static int set_config_tty_max(const char *key, const char *value,
1559                               struct lxc_conf *lxc_conf, void *data)
1560 {
1561         int ret;
1562         unsigned int nbtty = 0;
1563
1564         if (lxc_config_value_empty(value)) {
1565                 lxc_conf->ttys.max = 0;
1566                 return 0;
1567         }
1568
1569         ret = lxc_safe_uint(value, &nbtty);
1570         if (ret < 0)
1571                 return ret;
1572
1573         lxc_conf->ttys.max = nbtty;
1574
1575         return 0;
1576 }
1577
1578 static int set_config_tty_dir(const char *key, const char *value,
1579                              struct lxc_conf *lxc_conf, void *data)
1580 {
1581         return set_config_string_item_max(&lxc_conf->ttys.dir, value,
1582                                           NAME_MAX + 1);
1583 }
1584
1585 static int set_config_apparmor_profile(const char *key, const char *value,
1586                                        struct lxc_conf *lxc_conf, void *data)
1587 {
1588 #if HAVE_APPARMOR
1589         return set_config_string_item(&lxc_conf->lsm_aa_profile, value);
1590 #else
1591         return syserror_set(-EINVAL, "Built without AppArmor support");
1592 #endif
1593 }
1594
1595 static int set_config_apparmor_allow_incomplete(const char *key,
1596                                                 const char *value,
1597                                                 struct lxc_conf *lxc_conf,
1598                                                 void *data)
1599 {
1600 #if HAVE_APPARMOR
1601         int ret;
1602
1603         if (lxc_config_value_empty(value)) {
1604                 lxc_conf->lsm_aa_allow_incomplete = 0;
1605                 return 0;
1606         }
1607
1608         ret = lxc_safe_uint(value, &lxc_conf->lsm_aa_allow_incomplete);
1609         if (ret)
1610                 return ret;
1611
1612         if (lxc_conf->lsm_aa_allow_incomplete > 1)
1613                 return ret_errno(EINVAL);
1614
1615         return 0;
1616 #else
1617         return syserror_set(-EINVAL, "Built without AppArmor support");
1618 #endif
1619 }
1620
1621 static int set_config_apparmor_allow_nesting(const char *key,
1622                                              const char *value,
1623                                              struct lxc_conf *lxc_conf,
1624                                              void *data)
1625 {
1626 #if HAVE_APPARMOR
1627         int ret;
1628
1629         if (lxc_config_value_empty(value))
1630                 return clr_config_apparmor_allow_nesting(key, lxc_conf, NULL);
1631
1632         ret = lxc_safe_uint(value, &lxc_conf->lsm_aa_allow_nesting);
1633         if (ret)
1634                 return ret;
1635
1636         if (lxc_conf->lsm_aa_allow_nesting > 1)
1637                 return ret_errno(EINVAL);
1638
1639         return 0;
1640 #else
1641         return syserror_set(-EINVAL, "Built without AppArmor support");
1642 #endif
1643 }
1644
1645 static int set_config_apparmor_raw(const char *key,
1646                                    const char *value,
1647                                    struct lxc_conf *lxc_conf,
1648                                    void *data)
1649 {
1650 #if HAVE_APPARMOR
1651         __do_free char *elem = NULL;
1652         __do_free struct string_entry *entry = NULL;
1653
1654         if (lxc_config_value_empty(value))
1655                 return lxc_clear_apparmor_raw(lxc_conf);
1656
1657         entry = zalloc(sizeof(struct string_entry));
1658         if (!entry)
1659                 return ret_errno(ENOMEM);
1660
1661         elem = strdup(value);
1662         if (!elem)
1663                 return ret_errno(ENOMEM);
1664
1665         entry->val = move_ptr(elem);
1666         list_add_tail(&entry->head, &lxc_conf->lsm_aa_raw);
1667         move_ptr(entry);
1668
1669         return 0;
1670 #else
1671         return syserror_set(-EINVAL, "Built without AppArmor support");
1672 #endif
1673 }
1674
1675 static int set_config_selinux_context(const char *key, const char *value,
1676                                       struct lxc_conf *lxc_conf, void *data)
1677 {
1678 #if HAVE_SELINUX
1679         return set_config_string_item(&lxc_conf->lsm_se_context, value);
1680 #else
1681         return syserror_set(-EINVAL, "Built without SELinux support");
1682 #endif
1683 }
1684
1685 static int set_config_selinux_context_keyring(const char *key, const char *value,
1686                                               struct lxc_conf *lxc_conf, void *data)
1687 {
1688 #if HAVE_SELINUX
1689         return set_config_string_item(&lxc_conf->lsm_se_keyring_context, value);
1690 #else
1691         return syserror_set(-EINVAL, "Built without SELinux support");
1692 #endif
1693 }
1694
1695 static int set_config_keyring_session(const char *key, const char *value,
1696                                       struct lxc_conf *lxc_conf, void *data)
1697 {
1698         return set_config_bool_item(&lxc_conf->keyring_disable_session, value, false);
1699 }
1700
1701 static int set_config_log_file(const char *key, const char *value,
1702                               struct lxc_conf *c, void *data)
1703 {
1704         int ret;
1705
1706         if (lxc_config_value_empty(value)) {
1707                 free_disarm(c->logfile);
1708                 return 0;
1709         }
1710
1711         /*
1712          * Store these values in the lxc_conf, and then try to set for actual
1713          * current logging.
1714          */
1715         ret = set_config_path_item(&c->logfile, value);
1716         if (ret == 0)
1717                 ret = lxc_log_set_file(&c->logfd, c->logfile);
1718
1719         return ret;
1720 }
1721
1722 static int set_config_log_level(const char *key, const char *value,
1723                                struct lxc_conf *lxc_conf, void *data)
1724 {
1725         int newlevel;
1726
1727         if (lxc_config_value_empty(value)) {
1728                 lxc_conf->loglevel = LXC_LOG_LEVEL_NOTSET;
1729                 return 0;
1730         }
1731
1732         if (value[0] >= '0' && value[0] <= '9') {
1733                 int ret;
1734
1735                 ret = lxc_safe_int(value, &newlevel);
1736                 if (ret)
1737                         return ret_errno(EINVAL);
1738         } else {
1739                 newlevel = lxc_log_priority_to_int(value);
1740         }
1741
1742         /*
1743          * Store these values in the lxc_conf, and then try to set for actual
1744          * current logging.
1745          */
1746         lxc_conf->loglevel = newlevel;
1747
1748         return lxc_log_set_level(&lxc_conf->loglevel, newlevel);
1749 }
1750
1751 static int set_config_autodev(const char *key, const char *value,
1752                               struct lxc_conf *lxc_conf, void *data)
1753 {
1754         int ret;
1755
1756         if (lxc_config_value_empty(value)) {
1757                 lxc_conf->autodev = 0;
1758                 return 0;
1759         }
1760
1761         ret = lxc_safe_uint(value, &lxc_conf->autodev);
1762         if (ret)
1763                 return ret_errno(EINVAL);
1764
1765         if (lxc_conf->autodev > 1)
1766                 return ret_errno(EINVAL);
1767
1768         return 0;
1769 }
1770
1771 static int set_config_autodev_tmpfs_size(const char *key, const char *value,
1772                               struct lxc_conf *lxc_conf, void *data)
1773 {
1774         if (lxc_config_value_empty(value)) {
1775                 lxc_conf->autodevtmpfssize = 500000;
1776                 return 0;
1777         }
1778
1779         if (lxc_safe_int(value, &lxc_conf->autodevtmpfssize) < 0)
1780                 lxc_conf->autodevtmpfssize = 500000;
1781
1782         return 0;
1783 }
1784
1785 static int set_config_signal_halt(const char *key, const char *value,
1786                                  struct lxc_conf *lxc_conf, void *data)
1787 {
1788         int sig_n;
1789
1790         if (lxc_config_value_empty(value)) {
1791                 lxc_conf->haltsignal = 0;
1792                 return 0;
1793         }
1794
1795         sig_n = sig_parse(value);
1796         if (sig_n < 0)
1797                 return ret_errno(EINVAL);
1798
1799         lxc_conf->haltsignal = sig_n;
1800
1801         return 0;
1802 }
1803
1804 static int set_config_signal_reboot(const char *key, const char *value,
1805                                    struct lxc_conf *lxc_conf, void *data)
1806 {
1807         int sig_n;
1808
1809         if (lxc_config_value_empty(value)) {
1810                 lxc_conf->rebootsignal = 0;
1811                 return 0;
1812         }
1813
1814         sig_n = sig_parse(value);
1815         if (sig_n < 0)
1816                 return ret_errno(EINVAL);
1817
1818         lxc_conf->rebootsignal = sig_n;
1819
1820         return 0;
1821 }
1822
1823 static int set_config_signal_stop(const char *key, const char *value,
1824                                  struct lxc_conf *lxc_conf, void *data)
1825 {
1826         int sig_n;
1827
1828         if (lxc_config_value_empty(value)) {
1829                 lxc_conf->stopsignal = 0;
1830                 return 0;
1831         }
1832
1833         sig_n = sig_parse(value);
1834         if (sig_n < 0)
1835                 return ret_errno(EINVAL);
1836
1837         lxc_conf->stopsignal = sig_n;
1838
1839         return 0;
1840 }
1841
1842 static int __set_config_cgroup_controller(const char *key, const char *value,
1843                                           struct lxc_conf *lxc_conf, int version)
1844 {
1845         call_cleaner(free_lxc_cgroup) struct lxc_cgroup *new_cgroup = NULL;
1846         const char *subkey, *token;
1847         size_t token_len;
1848
1849         if (lxc_config_value_empty(value))
1850                 return lxc_clear_cgroups(lxc_conf, key, version);
1851
1852         if (version == CGROUP2_SUPER_MAGIC) {
1853                 token = "lxc.cgroup2.";
1854                 token_len = 12;
1855         } else if (version == CGROUP_SUPER_MAGIC) {
1856                 token = "lxc.cgroup.";
1857                 token_len = 11;
1858         } else {
1859                 return ret_errno(EINVAL);
1860         }
1861
1862         if (!strnequal(key, token, token_len))
1863                 return ret_errno(EINVAL);
1864
1865         subkey = key + token_len;
1866         if (*subkey == '\0')
1867                 return ret_errno(EINVAL);
1868
1869         new_cgroup = zalloc(sizeof(*new_cgroup));
1870         if (!new_cgroup)
1871                 return ret_errno(ENOMEM);
1872
1873         new_cgroup->subsystem = strdup(subkey);
1874         if (!new_cgroup->subsystem)
1875                 return ret_errno(ENOMEM);
1876
1877         new_cgroup->value = strdup(value);
1878         if (!new_cgroup->value)
1879                 return ret_errno(ENOMEM);
1880
1881         new_cgroup->version = version;
1882
1883         if (version == CGROUP2_SUPER_MAGIC)
1884                 list_add_tail(&new_cgroup->head, &lxc_conf->cgroup2);
1885         else
1886                 list_add_tail(&new_cgroup->head, &lxc_conf->cgroup);
1887         move_ptr(new_cgroup);
1888
1889         return 0;
1890 }
1891
1892 static int set_config_cgroup_controller(const char *key, const char *value,
1893                                         struct lxc_conf *lxc_conf, void *data)
1894 {
1895         return __set_config_cgroup_controller(key, value, lxc_conf,
1896                                               CGROUP_SUPER_MAGIC);
1897 }
1898
1899 static int set_config_cgroup2_controller(const char *key, const char *value,
1900                                          struct lxc_conf *lxc_conf, void *data)
1901 {
1902         return __set_config_cgroup_controller(key, value, lxc_conf,
1903                                               CGROUP2_SUPER_MAGIC);
1904 }
1905
1906 static int set_config_cgroup_dir(const char *key, const char *value,
1907                                  struct lxc_conf *lxc_conf, void *data)
1908 {
1909         if (!strequal(key, "lxc.cgroup.dir"))
1910                 return ret_errno(EINVAL);
1911
1912         if (lxc_config_value_empty(value))
1913                 return clr_config_cgroup_dir(key, lxc_conf, NULL);
1914
1915         if (abspath(value))
1916                 return syserror_set(-EINVAL, "%s paths may not be absolute", key);
1917
1918         if (dotdot(value))
1919                 return syserror_set(-EINVAL, "%s paths may not walk upwards via \"../\"", key);
1920
1921         return set_config_path_item(&lxc_conf->cgroup_meta.dir, value);
1922 }
1923
1924 static int set_config_cgroup_monitor_dir(const char *key, const char *value,
1925                                          struct lxc_conf *lxc_conf, void *data)
1926 {
1927         if (lxc_config_value_empty(value))
1928                 return clr_config_cgroup_monitor_dir(key, lxc_conf, NULL);
1929
1930         if (abspath(value))
1931                 return syserror_set(-EINVAL, "%s paths may not be absolute", key);
1932
1933         if (dotdot(value))
1934                 return syserror_set(-EINVAL, "%s paths may not walk upwards via \"../\"", key);
1935
1936         return set_config_path_item(&lxc_conf->cgroup_meta.monitor_dir, value);
1937 }
1938
1939 static int set_config_cgroup_monitor_pivot_dir(const char *key, const char *value,
1940                                          struct lxc_conf *lxc_conf, void *data)
1941 {
1942         if (lxc_config_value_empty(value))
1943                 return clr_config_cgroup_monitor_pivot_dir(key, lxc_conf, NULL);
1944
1945         if (abspath(value))
1946                 return syserror_set(-EINVAL, "%s paths may not be absolute", key);
1947
1948         if (dotdot(value))
1949                 return syserror_set(-EINVAL, "%s paths may not walk upwards via \"../\"", key);
1950
1951         return set_config_path_item(&lxc_conf->cgroup_meta.monitor_pivot_dir, value);
1952 }
1953
1954 static int set_config_cgroup_container_dir(const char *key, const char *value,
1955                                            struct lxc_conf *lxc_conf,
1956                                            void *data)
1957 {
1958         if (lxc_config_value_empty(value))
1959                 return clr_config_cgroup_container_dir(key, lxc_conf, NULL);
1960
1961         if (abspath(value))
1962                 return syserror_set(-EINVAL, "%s paths may not be absolute", key);
1963
1964         if (dotdot(value))
1965                 return syserror_set(-EINVAL, "%s paths may not walk upwards via \"../\"", key);
1966
1967         return set_config_path_item(&lxc_conf->cgroup_meta.container_dir, value);
1968 }
1969
1970 static int set_config_cgroup_container_inner_dir(const char *key,
1971                                                  const char *value,
1972                                                  struct lxc_conf *lxc_conf,
1973                                                  void *data)
1974 {
1975         if (lxc_config_value_empty(value))
1976                 return clr_config_cgroup_container_inner_dir(key, lxc_conf, NULL);
1977
1978         if (abspath(value))
1979                 return syserror_set(-EINVAL, "%s paths may not be absolute", key);
1980
1981         if (strchr(value, '/') || strequal(value, ".") || strequal(value, ".."))
1982                 return log_error_errno(-EINVAL, EINVAL, "lxc.cgroup.dir.container.inner must be a single directory name");
1983
1984         return set_config_string_item(&lxc_conf->cgroup_meta.namespace_dir, value);
1985 }
1986
1987 static int set_config_cgroup_relative(const char *key, const char *value,
1988                                       struct lxc_conf *lxc_conf, void *data)
1989 {
1990         unsigned int converted;
1991         int ret;
1992
1993         if (lxc_config_value_empty(value))
1994                 return clr_config_cgroup_relative(key, lxc_conf, NULL);
1995
1996         ret = lxc_safe_uint(value, &converted);
1997         if (ret)
1998                 return ret;
1999
2000         if (converted == 1) {
2001                 lxc_conf->cgroup_meta.relative = true;
2002                 return 0;
2003         }
2004
2005         if (converted == 0) {
2006                 lxc_conf->cgroup_meta.relative = false;
2007                 return 0;
2008         }
2009
2010         return ret_errno(EINVAL);
2011 }
2012
2013 static bool parse_limit_value(const char **value, rlim_t *res)
2014 {
2015         char *endptr = NULL;
2016
2017         if (strnequal(*value, "unlimited", STRLITERALLEN("unlimited"))) {
2018                 *res = RLIM_INFINITY;
2019                 *value += STRLITERALLEN("unlimited");
2020                 return true;
2021         }
2022
2023         errno = 0;
2024         *res = strtoull(*value, &endptr, 10);
2025         if (errno || !endptr)
2026                 return false;
2027
2028         *value = endptr;
2029
2030         return true;
2031 }
2032
2033 static int set_config_prlimit(const char *key, const char *value,
2034                             struct lxc_conf *lxc_conf, void *data)
2035 {
2036         call_cleaner(free_lxc_limit) struct lxc_limit *new_lim = NULL;
2037         struct rlimit limit;
2038         rlim_t limit_value;
2039         struct lxc_limit *lim;
2040
2041         if (lxc_config_value_empty(value))
2042                 return lxc_clear_limits(lxc_conf, key);
2043
2044         if (!strnequal(key, "lxc.prlimit.", STRLITERALLEN("lxc.prlimit.")))
2045                 return ret_errno(EINVAL);
2046
2047         key += STRLITERALLEN("lxc.prlimit.");
2048
2049         /* soft limit comes first in the value */
2050         if (!parse_limit_value(&value, &limit_value))
2051                 return ret_errno(EINVAL);
2052
2053         limit.rlim_cur = limit_value;
2054
2055         /* skip spaces and a colon */
2056         while (isspace(*value))
2057                 ++value;
2058
2059         if (*value == ':')
2060                 ++value;
2061         else if (*value) /* any other character is an error here */
2062                 return ret_errno(EINVAL);
2063
2064         while (isspace(*value))
2065                 ++value;
2066
2067         /* optional hard limit */
2068         if (*value) {
2069                 if (!parse_limit_value(&value, &limit_value))
2070                         return ret_errno(EINVAL);
2071
2072                 limit.rlim_max = limit_value;
2073
2074                 /* check for trailing garbage */
2075                 while (isspace(*value))
2076                         ++value;
2077
2078                 if (*value)
2079                         return ret_errno(EINVAL);
2080         } else {
2081                 /* a single value sets both hard and soft limit */
2082                 limit.rlim_max = limit.rlim_cur;
2083         }
2084
2085         /* find existing list element */
2086         list_for_each_entry(lim, &lxc_conf->limits, head) {
2087                 if (!strequal(key, lim->resource))
2088                         continue;
2089
2090                 lim->limit = limit;
2091                 return 0;
2092         }
2093
2094         new_lim = zalloc(sizeof(*new_lim));
2095         if (!new_lim)
2096                 return ret_errno(ENOMEM);
2097
2098         new_lim->resource = strdup(key);
2099         if (!new_lim->resource)
2100                 return ret_errno(ENOMEM);
2101
2102         new_lim->limit = limit;
2103         list_add_tail(&new_lim->head, &lxc_conf->limits);
2104         move_ptr(new_lim);
2105
2106         return 0;
2107 }
2108
2109 static int set_config_sysctl(const char *key, const char *value,
2110                             struct lxc_conf *lxc_conf, void *data)
2111 {
2112         call_cleaner(free_lxc_sysctl) struct lxc_sysctl *sysctl_elem = NULL;
2113         struct lxc_sysctl *sysctl, *nsysctl;
2114
2115         if (lxc_config_value_empty(value))
2116                 return clr_config_sysctl(key, lxc_conf, NULL);
2117
2118         if (!strnequal(key, "lxc.sysctl.", STRLITERALLEN("lxc.sysctl.")))
2119                 return ret_errno(EINVAL);
2120
2121         key += STRLITERALLEN("lxc.sysctl.");
2122         if (is_empty_string(key))
2123                 return ret_errno(EINVAL);
2124
2125         /* find existing list element */
2126         list_for_each_entry_safe(sysctl, nsysctl, &lxc_conf->sysctls, head) {
2127                 __do_free char *replace_value = NULL;
2128
2129                 if (!strequal(key, sysctl->key))
2130                         continue;
2131
2132                 replace_value = strdup(value);
2133                 if (!replace_value)
2134                         return ret_errno(EINVAL);
2135
2136                 free(sysctl->value);
2137                 sysctl->value = move_ptr(replace_value);
2138
2139                 return 0;
2140         }
2141
2142         sysctl_elem = zalloc(sizeof(*sysctl_elem));
2143         if (!sysctl_elem)
2144                 return ret_errno(ENOMEM);
2145
2146         sysctl_elem->key = strdup(key);
2147         if (!sysctl_elem->key)
2148                 return ret_errno(ENOMEM);
2149
2150         sysctl_elem->value = strdup(value);
2151         if (!sysctl_elem->value)
2152                 return ret_errno(ENOMEM);
2153
2154         list_add_tail(&sysctl_elem->head, &lxc_conf->sysctls);
2155         move_ptr(sysctl_elem);
2156
2157         return 0;
2158 }
2159
2160 static int set_config_proc(const char *key, const char *value,
2161                             struct lxc_conf *lxc_conf, void *data)
2162 {
2163         call_cleaner(free_lxc_proc) struct lxc_proc *new_proc = NULL;
2164         const char *subkey;
2165
2166         if (lxc_config_value_empty(value))
2167                 return clr_config_proc(key, lxc_conf, NULL);
2168
2169         if (!strnequal(key, "lxc.proc.", STRLITERALLEN("lxc.proc.")))
2170                 return ret_errno(EINVAL);
2171
2172         subkey = key + STRLITERALLEN("lxc.proc.");
2173         if (*subkey == '\0')
2174                 return ret_errno(EINVAL);
2175
2176         new_proc = zalloc(sizeof(*new_proc));
2177         if (!new_proc)
2178                 return ret_errno(ENOMEM);
2179
2180         new_proc->filename = strdup(subkey);
2181         if (!new_proc->filename)
2182                 return ret_errno(ENOMEM);
2183
2184         new_proc->value = strdup(value);
2185         if (!new_proc->value)
2186                 return ret_errno(ENOMEM);
2187
2188         list_add_tail(&new_proc->head, &lxc_conf->procs);
2189         move_ptr(new_proc);
2190
2191         return 0;
2192 }
2193
2194 static int set_config_idmaps(const char *key, const char *value,
2195                              struct lxc_conf *lxc_conf, void *data)
2196 {
2197         __do_free struct id_map *idmap = NULL;
2198         unsigned long hostid, nsid, range;
2199         char type;
2200         int ret;
2201
2202         if (lxc_config_value_empty(value))
2203                 return lxc_clear_idmaps(lxc_conf);
2204
2205         idmap = zalloc(sizeof(*idmap));
2206         if (!idmap)
2207                 return ret_errno(ENOMEM);
2208
2209         ret = parse_idmaps(value, &type, &nsid, &hostid, &range);
2210         if (ret < 0)
2211                 return log_error_errno(-EINVAL, EINVAL, "Failed to parse id mappings");
2212
2213         INFO("Read uid map: type %c nsid %lu hostid %lu range %lu", type, nsid, hostid, range);
2214         if (type == 'u')
2215                 idmap->idtype = ID_TYPE_UID;
2216         else if (type == 'g')
2217                 idmap->idtype = ID_TYPE_GID;
2218         else
2219                 return ret_errno(EINVAL);
2220
2221         idmap->hostid = hostid;
2222         idmap->nsid = nsid;
2223         idmap->range = range;
2224         list_add_tail(&idmap->head, &lxc_conf->id_map);
2225
2226         if (!lxc_conf->root_nsuid_map && idmap->idtype == ID_TYPE_UID)
2227                 if (idmap->nsid == 0)
2228                         lxc_conf->root_nsuid_map = idmap;
2229
2230         if (!lxc_conf->root_nsgid_map && idmap->idtype == ID_TYPE_GID)
2231                 if (idmap->nsid == 0)
2232                         lxc_conf->root_nsgid_map = idmap;
2233
2234         move_ptr(idmap);
2235
2236         return 0;
2237 }
2238
2239 static int set_config_mount_fstab(const char *key, const char *value,
2240                                   struct lxc_conf *lxc_conf, void *data)
2241 {
2242         if (lxc_config_value_empty(value)) {
2243                 clr_config_mount_fstab(key, lxc_conf, NULL);
2244                 return ret_errno(EINVAL);
2245         }
2246
2247         return set_config_path_item(&lxc_conf->fstab, value);
2248 }
2249
2250 static int set_config_mount_auto(const char *key, const char *value,
2251                                  struct lxc_conf *lxc_conf, void *data)
2252 {
2253         __do_free char *autos = NULL;
2254         char *token;
2255         int i;
2256         static struct {
2257                 const char *token;
2258                 int mask;
2259                 int flag;
2260         } allowed_auto_mounts[] = {
2261                 { "proc",                       LXC_AUTO_PROC_MASK,     LXC_AUTO_PROC_MIXED                                     },
2262                 { "proc:mixed",                 LXC_AUTO_PROC_MASK,     LXC_AUTO_PROC_MIXED                                     },
2263                 { "proc:rw",                    LXC_AUTO_PROC_MASK,     LXC_AUTO_PROC_RW                                        },
2264                 { "sys",                        LXC_AUTO_SYS_MASK,      LXC_AUTO_SYS_MIXED                                      },
2265                 { "sys:ro",                     LXC_AUTO_SYS_MASK,      LXC_AUTO_SYS_RO                                         },
2266                 { "sys:mixed",                  LXC_AUTO_SYS_MASK,      LXC_AUTO_SYS_MIXED                                      },
2267                 { "sys:rw",                     LXC_AUTO_SYS_MASK,      LXC_AUTO_SYS_RW                                         },
2268                 { "cgroup",                     LXC_AUTO_CGROUP_MASK,   LXC_AUTO_CGROUP_NOSPEC                                  },
2269                 { "cgroup:mixed",               LXC_AUTO_CGROUP_MASK,   LXC_AUTO_CGROUP_MIXED                                   },
2270                 { "cgroup:ro",                  LXC_AUTO_CGROUP_MASK,   LXC_AUTO_CGROUP_RO                                      },
2271                 { "cgroup:rw",                  LXC_AUTO_CGROUP_MASK,   LXC_AUTO_CGROUP_RW                                      },
2272                 { "cgroup:force",               LXC_AUTO_CGROUP_MASK,   LXC_AUTO_CGROUP_NOSPEC | LXC_AUTO_CGROUP_FORCE          },
2273                 { "cgroup:mixed:force",         LXC_AUTO_CGROUP_MASK,   LXC_AUTO_CGROUP_MIXED | LXC_AUTO_CGROUP_FORCE           },
2274                 { "cgroup:ro:force",            LXC_AUTO_CGROUP_MASK,   LXC_AUTO_CGROUP_RO | LXC_AUTO_CGROUP_FORCE              },
2275                 { "cgroup:rw:force",            LXC_AUTO_CGROUP_MASK,   LXC_AUTO_CGROUP_RW | LXC_AUTO_CGROUP_FORCE              },
2276                 { "cgroup-full",                LXC_AUTO_CGROUP_MASK,   LXC_AUTO_CGROUP_FULL_NOSPEC                             },
2277                 { "cgroup-full:mixed",          LXC_AUTO_CGROUP_MASK,   LXC_AUTO_CGROUP_FULL_MIXED                              },
2278                 { "cgroup-full:ro",             LXC_AUTO_CGROUP_MASK,   LXC_AUTO_CGROUP_FULL_RO                                 },
2279                 { "cgroup-full:rw",             LXC_AUTO_CGROUP_MASK,   LXC_AUTO_CGROUP_FULL_RW                                 },
2280                 { "cgroup-full:force",          LXC_AUTO_CGROUP_MASK,   LXC_AUTO_CGROUP_FULL_NOSPEC | LXC_AUTO_CGROUP_FORCE     },
2281                 { "cgroup-full:mixed:force",    LXC_AUTO_CGROUP_MASK,   LXC_AUTO_CGROUP_FULL_MIXED | LXC_AUTO_CGROUP_FORCE      },
2282                 { "cgroup-full:ro:force",       LXC_AUTO_CGROUP_MASK,   LXC_AUTO_CGROUP_FULL_RO | LXC_AUTO_CGROUP_FORCE         },
2283                 { "cgroup-full:rw:force",       LXC_AUTO_CGROUP_MASK,   LXC_AUTO_CGROUP_FULL_RW | LXC_AUTO_CGROUP_FORCE         },
2284                 { "shmounts:",                  LXC_AUTO_SHMOUNTS_MASK, LXC_AUTO_SHMOUNTS                                       },
2285                 /*
2286                  * For adding anything that is just a single on/off, but has no
2287                  * options: keep mask and flag identical and just define the
2288                  * enum value as an unused bit so far
2289                  */
2290                 { NULL,                         0,                      0                                                       }
2291         };
2292
2293         if (lxc_config_value_empty(value)) {
2294                 lxc_conf->auto_mounts = 0;
2295                 return 0;
2296         }
2297
2298         autos = strdup(value);
2299         if (!autos)
2300                 return ret_errno(ENOMEM);
2301
2302         lxc_iterate_parts(token, autos, " \t") {
2303                 bool is_shmounts = false;
2304
2305                 for (i = 0; allowed_auto_mounts[i].token; i++) {
2306                         if (strequal(allowed_auto_mounts[i].token, token))
2307                                 break;
2308
2309                         if (strequal("shmounts:", allowed_auto_mounts[i].token) &&
2310                             strnequal("shmounts:", token, STRLITERALLEN("shmounts:"))) {
2311                                 is_shmounts = true;
2312                                 break;
2313                         }
2314                 }
2315
2316                 if (!allowed_auto_mounts[i].token)
2317                         return log_error_errno(-EINVAL, EINVAL, "Invalid filesystem to automount \"%s\"", token);
2318
2319                 lxc_conf->auto_mounts &= ~allowed_auto_mounts[i].mask;
2320                 lxc_conf->auto_mounts |= allowed_auto_mounts[i].flag;
2321
2322                 if (is_shmounts) {
2323                         __do_free char *container_path = NULL, *host_path = NULL;
2324                         char *val;
2325
2326                         val = token + STRLITERALLEN("shmounts:");
2327                         if (*val == '\0')
2328                                 return log_error_errno(-EINVAL, EINVAL, "Failed to copy shmounts host path");
2329
2330                         host_path = strdup(val);
2331                         if (!host_path)
2332                                 return log_error_errno(-EINVAL, EINVAL, "Failed to copy shmounts host path");
2333
2334                         val = strchr(host_path, ':');
2335                         if (!val || *(val + 1) == '\0')
2336                                 val = "/dev/.lxc-mounts";
2337                         else
2338                                 *val++ = '\0';
2339
2340                         container_path = strdup(val);
2341                         if(!container_path)
2342                                 return log_error_errno(-EINVAL, EINVAL, "Failed to copy shmounts container path");
2343
2344                         free_disarm(lxc_conf->shmount.path_host);
2345                         lxc_conf->shmount.path_host = move_ptr(host_path);
2346
2347                         free_disarm(lxc_conf->shmount.path_cont);
2348                         lxc_conf->shmount.path_cont = move_ptr(container_path);
2349                 }
2350         }
2351
2352         return 0;
2353 }
2354
2355 static int set_config_mount(const char *key, const char *value,
2356                             struct lxc_conf *lxc_conf, void *data)
2357 {
2358         __do_free char *mntelem = NULL;
2359         __do_free struct string_entry *entry = NULL;
2360
2361         if (lxc_config_value_empty(value))
2362                 return lxc_clear_mount_entries(lxc_conf);
2363
2364         entry = zalloc(sizeof(struct string_entry));
2365         if (!entry)
2366                 return ret_errno(ENOMEM);
2367
2368         mntelem = strdup(value);
2369         if (!mntelem)
2370                 return ret_errno(ENOMEM);
2371
2372         entry->val = move_ptr(mntelem);
2373         list_add_tail(&entry->head, &lxc_conf->mount_entries);
2374         move_ptr(entry);
2375
2376         return 0;
2377 }
2378
2379 int add_elem_to_mount_list(const char *value, struct lxc_conf *lxc_conf) {
2380         return set_config_mount(NULL, value, lxc_conf, NULL);
2381 }
2382
2383 static int add_cap_entry(struct lxc_conf *conf, char *caps, bool keep)
2384 {
2385         char *token;
2386
2387         /*
2388          * In case several capability keep is specified in a single line split
2389          * these caps in a single element for the list.
2390          */
2391         lxc_iterate_parts(token, caps, " \t") {
2392                 __do_free struct cap_entry *new_cap = NULL;
2393                 int cap;
2394
2395                 if (strequal(token, "none")) {
2396                         if (!keep)
2397                                 return syserror_set(-EINVAL, "The \"none\" keyword is only valid when keeping caps");
2398
2399                         lxc_clear_config_caps(conf);
2400                         continue;
2401                 }
2402
2403                 cap = parse_cap(token);
2404                 if (cap < 0) {
2405                         if (cap != -2)
2406                                 return syserror_set(-EINVAL, "Invalid capability specified");
2407
2408                         INFO("Ignoring unknown capability \"%s\"", token);
2409                         continue;
2410                 }
2411
2412                 new_cap = zalloc(sizeof(struct cap_entry));
2413                 if (!new_cap)
2414                         return ret_errno(ENOMEM);
2415
2416                 new_cap->cap_name = strdup(token);
2417                 if (!new_cap->cap_name)
2418                         return ret_errno(ENOMEM);
2419                 new_cap->cap = cap;
2420
2421                 list_add_tail(&new_cap->head, &conf->caps.list);
2422                 move_ptr(new_cap);
2423         }
2424
2425         return 0;
2426 }
2427
2428 static int set_config_cap_keep(const char *key, const char *value,
2429                                struct lxc_conf *lxc_conf, void *data)
2430 {
2431         __do_free char *caps = NULL;
2432         int ret;
2433
2434         if (lxc_config_value_empty(value))
2435                 return lxc_clear_config_caps(lxc_conf);
2436
2437         caps = strdup(value);
2438         if (!caps)
2439                 return ret_errno(ENOMEM);
2440
2441         if (!lxc_conf->caps.keep && !list_empty(&lxc_conf->caps.list))
2442                 return syserror_set(-EINVAL, "Keeping and dropping capabilities are mutually exclusive");
2443
2444         ret = add_cap_entry(lxc_conf, caps, true);
2445         if (ret < 0)
2446                 return ret;
2447
2448         lxc_conf->caps.keep = true;
2449         return 0;
2450 }
2451
2452 static int set_config_cap_drop(const char *key, const char *value,
2453                                struct lxc_conf *lxc_conf, void *data)
2454 {
2455         __do_free char *caps = NULL;
2456         int ret;
2457
2458         if (lxc_config_value_empty(value))
2459                 return lxc_clear_config_caps(lxc_conf);
2460
2461         if (lxc_conf->caps.keep)
2462                 return syserror_set(-EINVAL, "Keeping and dropping capabilities are mutually exclusive");
2463
2464         caps = strdup(value);
2465         if (!caps)
2466                 return ret_errno(ENOMEM);
2467
2468         ret = add_cap_entry(lxc_conf, caps, false);
2469         if (ret < 0)
2470                 return ret;
2471
2472         lxc_conf->caps.keep = false;
2473         return 0;
2474 }
2475
2476 static int set_config_console_path(const char *key, const char *value,
2477                                    struct lxc_conf *lxc_conf, void *data)
2478 {
2479         return set_config_path_item(&lxc_conf->console.path, value);
2480 }
2481
2482 static int set_config_console_rotate(const char *key, const char *value,
2483                                      struct lxc_conf *lxc_conf, void *data)
2484 {
2485         int ret;
2486
2487         if (lxc_config_value_empty(value)) {
2488                 lxc_conf->console.log_rotate = 0;
2489                 return 0;
2490         }
2491
2492         ret = lxc_safe_uint(value, &lxc_conf->console.log_rotate);
2493         if (ret)
2494                 return ret_errno(EINVAL);
2495
2496         if (lxc_conf->console.log_rotate > 1)
2497                 return log_error_errno(-EINVAL, EINVAL, "The \"lxc.console.rotate\" config key can only be set to 0 or 1");
2498
2499         return 0;
2500 }
2501
2502 static int set_config_console_logfile(const char *key, const char *value,
2503                                       struct lxc_conf *lxc_conf, void *data)
2504 {
2505         return set_config_path_item(&lxc_conf->console.log_path, value);
2506 }
2507
2508 static int set_config_console_buffer_size(const char *key, const char *value,
2509                                           struct lxc_conf *lxc_conf, void *data)
2510 {
2511         int ret;
2512         long long int size;
2513         uint64_t buffer_size, pgsz;
2514
2515         if (lxc_config_value_empty(value)) {
2516                 lxc_conf->console.buffer_size = 0;
2517                 return 0;
2518         }
2519
2520         /* If the user specified "auto" the default log size is 2^17 = 128 Kib */
2521         if (strequal(value, "auto")) {
2522                 lxc_conf->console.buffer_size = 1 << 17;
2523                 return 0;
2524         }
2525
2526         ret = parse_byte_size_string(value, &size);
2527         if (ret)
2528                 return ret;
2529
2530         if (size < 0)
2531                 return ret_errno(EINVAL);
2532
2533         /* must be at least a page size */
2534         pgsz = lxc_getpagesize();
2535         if ((uint64_t)size < pgsz) {
2536                 NOTICE("Requested ringbuffer size for the console is %lld but must be at least %" PRId64 " bytes. Setting ringbuffer size to %" PRId64 " bytes",
2537                        size, pgsz, pgsz);
2538                 size = pgsz;
2539         }
2540
2541         buffer_size = lxc_find_next_power2((uint64_t)size);
2542         if (buffer_size == 0)
2543                 return ret_errno(EINVAL);
2544
2545         if (buffer_size != (uint64_t)size)
2546                 NOTICE("Passed size was not a power of 2. Rounding log size to next power of two: %" PRIu64 " bytes", buffer_size);
2547
2548         lxc_conf->console.buffer_size = buffer_size;
2549
2550         return 0;
2551 }
2552
2553 static int set_config_console_size(const char *key, const char *value,
2554                                    struct lxc_conf *lxc_conf, void *data)
2555 {
2556         int ret;
2557         long long int size;
2558         uint64_t log_size, pgsz;
2559
2560         if (lxc_config_value_empty(value)) {
2561                 lxc_conf->console.log_size = 0;
2562                 return 0;
2563         }
2564
2565         /* If the user specified "auto" the default log size is 2^17 = 128 Kib */
2566         if (strequal(value, "auto")) {
2567                 lxc_conf->console.log_size = 1 << 17;
2568                 return 0;
2569         }
2570
2571         ret = parse_byte_size_string(value, &size);
2572         if (ret)
2573                 return ret_errno(EINVAL);
2574
2575         if (size < 0)
2576                 return ret_errno(EINVAL);
2577
2578         /* must be at least a page size */
2579         pgsz = lxc_getpagesize();
2580         if ((uint64_t)size < pgsz) {
2581                 NOTICE("Requested ringbuffer size for the console is %lld but must be at least %" PRId64 " bytes. Setting ringbuffer size to %" PRId64 " bytes",
2582                        size, pgsz, pgsz);
2583                 size = pgsz;
2584         }
2585
2586         log_size = lxc_find_next_power2((uint64_t)size);
2587         if (log_size == 0)
2588                 return ret_errno(EINVAL);
2589
2590         if (log_size != (uint64_t)size)
2591                 NOTICE("Passed size was not a power of 2. Rounding log size to next power of two: %" PRIu64 " bytes", log_size);
2592
2593         lxc_conf->console.log_size = log_size;
2594
2595         return 0;
2596 }
2597
2598 /*
2599  * If we find a lxc.net.[i].hwaddr or lxc.network.hwaddr in the original config
2600  * file, we expand it in the unexpanded_config, so that after a save_config we
2601  * store the hwaddr for re-use.
2602  * This is only called when reading the config file, not when executing a
2603  * lxc.include.
2604  * 'x' and 'X' are substituted in-place.
2605  */
2606 static void update_hwaddr(const char *line)
2607 {
2608         char *p;
2609
2610         line += lxc_char_left_gc(line, strlen(line));
2611         if (line[0] == '#')
2612                 return;
2613
2614         if (!lxc_config_net_is_hwaddr(line))
2615                 return;
2616
2617         /* Let config_net_hwaddr raise the error. */
2618         p = strchr(line, '=');
2619         if (!p)
2620                 return;
2621         p++;
2622
2623         while (isblank(*p))
2624                 p++;
2625
2626         if (!*p)
2627                 return;
2628
2629         rand_complete_hwaddr(p);
2630 }
2631
2632 int append_unexp_config_line(const char *line, struct lxc_conf *conf)
2633 {
2634         size_t linelen;
2635         size_t len = conf->unexpanded_len;
2636
2637         update_hwaddr(line);
2638
2639         linelen = strlen(line);
2640         while (conf->unexpanded_alloced <= len + linelen + 2) {
2641                 char *tmp;
2642
2643                 tmp = realloc(conf->unexpanded_config, conf->unexpanded_alloced + 1024);
2644                 if (!tmp)
2645                         return ret_errno(EINVAL);
2646
2647                 if (!conf->unexpanded_config)
2648                         *tmp = '\0';
2649
2650                 conf->unexpanded_config = tmp;
2651                 conf->unexpanded_alloced += 1024;
2652         }
2653
2654         memcpy(conf->unexpanded_config + conf->unexpanded_len, line, linelen);
2655         conf->unexpanded_len += linelen;
2656         if (line[linelen - 1] != '\n')
2657                 conf->unexpanded_config[conf->unexpanded_len++] = '\n';
2658         conf->unexpanded_config[conf->unexpanded_len] = '\0';
2659
2660         return 0;
2661 }
2662
2663 static int do_includedir(const char *dirp, struct lxc_conf *lxc_conf)
2664 {
2665         __do_closedir DIR *dir = NULL;
2666         struct dirent *direntp;
2667         int len, ret;
2668
2669         dir = opendir(dirp);
2670         if (!dir)
2671                 return errno == ENOENT ? 0 : -errno;
2672
2673         while ((direntp = readdir(dir))) {
2674                 const char *fnam;
2675                 char path[PATH_MAX];
2676
2677                 fnam = direntp->d_name;
2678                 if (strequal(fnam, "."))
2679                         continue;
2680
2681                 if (strequal(fnam, ".."))
2682                         continue;
2683
2684                 len = strlen(fnam);
2685                 if (len < 6 || !strnequal(fnam + len - 5, ".conf", 5))
2686                         continue;
2687
2688                 len = strnprintf(path, sizeof(path), "%s/%s", dirp, fnam);
2689                 if (len < 0)
2690                         return ret_errno(EIO);
2691
2692                 ret = lxc_config_read(path, lxc_conf, true);
2693                 if (ret < 0)
2694                         return ret;
2695         }
2696
2697         return 0;
2698 }
2699
2700 static int set_config_includefiles(const char *key, const char *value,
2701                                    struct lxc_conf *lxc_conf, void *data)
2702 {
2703         if (lxc_config_value_empty(value)) {
2704                 clr_config_includefiles(key, lxc_conf, NULL);
2705                 return 0;
2706         }
2707
2708         if (value[strlen(value)-1] == '/' || is_dir(value))
2709                 return do_includedir(value, lxc_conf);
2710
2711         return lxc_config_read(value, lxc_conf, true);
2712 }
2713
2714 static int set_config_rootfs_path(const char *key, const char *value,
2715                                   struct lxc_conf *lxc_conf, void *data)
2716 {
2717         __do_free char *dup = NULL;
2718         int ret;
2719         char *tmp;
2720         const char *container_path;
2721
2722         if (lxc_config_value_empty(value)) {
2723                 free(lxc_conf->rootfs.path);
2724                 lxc_conf->rootfs.path = NULL;
2725                 return 0;
2726         }
2727
2728         dup = strdup(value);
2729         if (!dup)
2730                 return ret_errno(ENOMEM);
2731
2732         /* Split <storage type>:<container path> into <storage type> and
2733          * <container path>. Set "rootfs.bdev_type" to <storage type> and
2734          * "rootfs.path" to <container path>.
2735          */
2736         tmp = strchr(dup, ':');
2737         if (tmp) {
2738                 *tmp = '\0';
2739
2740                 ret = set_config_path_item(&lxc_conf->rootfs.bdev_type, dup);
2741                 if (ret < 0)
2742                         return ret_errno(ENOMEM);
2743
2744                 tmp++;
2745                 container_path = tmp;
2746         } else {
2747                 container_path = value;
2748         }
2749
2750         return set_config_path_item(&lxc_conf->rootfs.path, container_path);
2751 }
2752
2753 static int set_config_rootfs_managed(const char *key, const char *value,
2754                                      struct lxc_conf *lxc_conf, void *data)
2755 {
2756         return set_config_bool_item(&lxc_conf->rootfs.managed, value, true);
2757 }
2758
2759 static int set_config_rootfs_mount(const char *key, const char *value,
2760                                    struct lxc_conf *lxc_conf, void *data)
2761 {
2762         return set_config_path_item(&lxc_conf->rootfs.mount, value);
2763 }
2764
2765 static int set_config_rootfs_options(const char *key, const char *value,
2766                                      struct lxc_conf *lxc_conf, void *data)
2767 {
2768         __do_free char *dup = NULL, *raw_options = NULL;
2769         struct lxc_rootfs *rootfs = &lxc_conf->rootfs;
2770         struct lxc_mount_options *mnt_opts = &rootfs->mnt_opts;
2771         int ret;
2772
2773         clr_config_rootfs_options(key, lxc_conf, data);
2774         if (lxc_config_value_empty(value))
2775                 return 0;
2776
2777         ret = set_config_string_item(&raw_options, value);
2778         if (ret < 0)
2779                 return ret_errno(ENOMEM);
2780
2781         dup = strdup(value);
2782         if (!dup)
2783                 return -ENOMEM;
2784
2785         ret = parse_lxc_mount_attrs(mnt_opts, dup);
2786         if (ret < 0)
2787                 return ret;
2788
2789         /* Make sure we're only valid LXC specific mount options. */
2790         if (mnt_opts->create_dir || mnt_opts->create_file ||
2791             mnt_opts->optional || mnt_opts->relative)
2792                 return syserror_set(-EINVAL, "Invalid LXC specific mount option for rootfs mount");
2793
2794         ret = parse_mount_attrs(mnt_opts, dup);
2795         if (ret < 0)
2796                 return ret_errno(EINVAL);
2797
2798         rootfs->mnt_opts.raw_options = move_ptr(raw_options);
2799         return 0;
2800 }
2801
2802 static int set_config_uts_name(const char *key, const char *value,
2803                               struct lxc_conf *lxc_conf, void *data)
2804 {
2805         __do_free struct utsname *utsname = NULL;
2806
2807         if (lxc_config_value_empty(value)) {
2808                 clr_config_uts_name(key, lxc_conf, NULL);
2809                 return 0;
2810         }
2811
2812         utsname = zalloc(sizeof(*utsname));
2813         if (!utsname)
2814                 return ret_errno(ENOMEM);
2815
2816         if (strlen(value) >= sizeof(utsname->nodename))
2817                 return ret_errno(EINVAL);
2818
2819         (void)strlcpy(utsname->nodename, value, sizeof(utsname->nodename));
2820         free(lxc_conf->utsname);
2821         lxc_conf->utsname = move_ptr(utsname);
2822
2823         return 0;
2824 }
2825
2826 static int set_config_namespace_clone(const char *key, const char *value,
2827                                       struct lxc_conf *lxc_conf, void *data)
2828 {
2829         __do_free char *ns = NULL;
2830         char *token;
2831         int cloneflag = 0;
2832
2833         if (lxc_config_value_empty(value))
2834                 return clr_config_namespace_clone(key, lxc_conf, data);
2835
2836         if (lxc_conf->ns_keep != 0)
2837                 return log_error_errno(-EINVAL, EINVAL, "Cannot set both \"lxc.namespace.clone\" and \"lxc.namespace.keep\"");
2838
2839         ns = strdup(value);
2840         if (!ns)
2841                 return ret_errno(ENOMEM);
2842
2843         lxc_iterate_parts(token, ns, " \t") {
2844                 token += lxc_char_left_gc(token, strlen(token));
2845                 token[lxc_char_right_gc(token, strlen(token))] = '\0';
2846                 cloneflag = lxc_namespace_2_cloneflag(token);
2847                 if (cloneflag < 0)
2848                         return ret_errno(EINVAL);
2849                 lxc_conf->ns_clone |= cloneflag;
2850         }
2851
2852         return 0;
2853 }
2854
2855 static int set_config_namespace_keep(const char *key, const char *value,
2856                                      struct lxc_conf *lxc_conf, void *data)
2857 {
2858         __do_free char *ns = NULL;
2859         char *token;
2860         int cloneflag = 0;
2861
2862         if (lxc_config_value_empty(value))
2863                 return clr_config_namespace_keep(key, lxc_conf, data);
2864
2865         if (lxc_conf->ns_clone != 0)
2866                 return log_error_errno(-EINVAL, EINVAL, "Cannot set both \"lxc.namespace.clone\" and \"lxc.namespace.keep\"");
2867
2868         ns = strdup(value);
2869         if (!ns)
2870                 return ret_errno(ENOMEM);
2871
2872         lxc_iterate_parts(token, ns, " \t") {
2873                 token += lxc_char_left_gc(token, strlen(token));
2874                 token[lxc_char_right_gc(token, strlen(token))] = '\0';
2875                 cloneflag = lxc_namespace_2_cloneflag(token);
2876                 if (cloneflag < 0)
2877                         return ret_errno(EINVAL);
2878                 lxc_conf->ns_keep |= cloneflag;
2879         }
2880
2881         return 0;
2882 }
2883
2884 static int set_config_time_offset_boot(const char *key, const char *value,
2885                                        struct lxc_conf *lxc_conf, void *data)
2886 {
2887         int ret;
2888         char *unit;
2889         int64_t offset = 0;
2890         char buf[STRLITERALLEN("ms") + 1];
2891
2892         if (lxc_config_value_empty(value))
2893                 return clr_config_time_offset_boot(key, lxc_conf, data);
2894
2895         ret = lxc_safe_int64_residual(value, &offset, 10, buf, sizeof(buf));
2896         if (ret)
2897                 return ret;
2898
2899         unit = lxc_trim_whitespace_in_place(buf);
2900         if (strequal(unit, "h")) {
2901                 if (!multiply_overflow(offset, 3600, &lxc_conf->timens.s_boot))
2902                         return ret_errno(EOVERFLOW);
2903         } else if (strequal(unit, "m")) {
2904                 if (!multiply_overflow(offset, 60, &lxc_conf->timens.s_boot))
2905                         return ret_errno(EOVERFLOW);
2906         } else if (strequal(unit, "s")) {
2907                 lxc_conf->timens.s_boot = offset;
2908         } else if (strequal(unit, "ms")) {
2909                 if (!multiply_overflow(offset, 1000000, &lxc_conf->timens.ns_boot))
2910                         return ret_errno(EOVERFLOW);
2911         } else if (strequal(unit, "us")) {
2912                 if (!multiply_overflow(offset, 1000, &lxc_conf->timens.ns_boot))
2913                         return ret_errno(EOVERFLOW);
2914         } else if (strequal(unit, "ns")) {
2915                 lxc_conf->timens.ns_boot = offset;
2916         } else {
2917                 return ret_errno(EINVAL);
2918         }
2919
2920         return 0;
2921 }
2922
2923 static int set_config_time_offset_monotonic(const char *key, const char *value,
2924                                             struct lxc_conf *lxc_conf, void *data)
2925 {
2926         int ret;
2927         char *unit;
2928         int64_t offset = 0;
2929         char buf[STRLITERALLEN("ms") + 1];
2930
2931         if (lxc_config_value_empty(value))
2932                 return clr_config_time_offset_monotonic(key, lxc_conf, data);
2933
2934         ret = lxc_safe_int64_residual(value, &offset, 10, buf, sizeof(buf));
2935         if (ret)
2936                 return ret;
2937
2938         unit = lxc_trim_whitespace_in_place(buf);
2939         if (strequal(unit, "h")) {
2940                 if (!multiply_overflow(offset, 3600, &lxc_conf->timens.s_monotonic))
2941                         return ret_errno(EOVERFLOW);
2942         } else if (strequal(unit, "m")) {
2943                 if (!multiply_overflow(offset, 60, &lxc_conf->timens.s_monotonic))
2944                         return ret_errno(EOVERFLOW);
2945         } else if (strequal(unit, "s")) {
2946                 lxc_conf->timens.s_monotonic = offset;
2947         } else if (strequal(unit, "ms")) {
2948                 if (!multiply_overflow(offset, 1000000, &lxc_conf->timens.ns_monotonic))
2949                         return ret_errno(EOVERFLOW);
2950         } else if (strequal(unit, "us")) {
2951                 if (!multiply_overflow(offset, 1000, &lxc_conf->timens.ns_monotonic))
2952                         return ret_errno(EOVERFLOW);
2953         } else if (strequal(unit, "ns")) {
2954                 lxc_conf->timens.ns_monotonic = offset;
2955         } else {
2956                 return ret_errno(EINVAL);
2957         }
2958
2959         return 0;
2960 }
2961
2962 static int set_config_namespace_share(const char *key, const char *value,
2963                                       struct lxc_conf *lxc_conf, void *data)
2964 {
2965         int ns_idx;
2966         const char *namespace;
2967
2968         if (lxc_config_value_empty(value))
2969                 return clr_config_namespace_share(key, lxc_conf, data);
2970
2971         namespace = key + STRLITERALLEN("lxc.namespace.share.");
2972         if (is_empty_string(namespace))
2973                 return ret_errno(EINVAL);
2974
2975         ns_idx = lxc_namespace_2_ns_idx(namespace);
2976         if (ns_idx < 0)
2977                 return ns_idx;
2978
2979         return set_config_string_item(&lxc_conf->ns_share[ns_idx], value);
2980 }
2981
2982 struct parse_line_conf {
2983         struct lxc_conf *conf;
2984         bool from_include;
2985 };
2986
2987 static int parse_line(char *buffer, void *data)
2988 {
2989         __do_free char *linep = NULL;
2990         char *dot, *key, *line, *value;
2991         bool empty_line;
2992         struct lxc_config_t *config;
2993         int ret;
2994         char *dup = buffer;
2995         struct parse_line_conf *plc = data;
2996
2997         if (!plc->conf)
2998                 return syserror_set(-EINVAL, "Missing config");
2999
3000         /* If there are newlines in the config file we should keep them. */
3001         empty_line = lxc_is_line_empty(dup);
3002         if (empty_line)
3003                 dup = "\n";
3004
3005         /* We have to dup the buffer otherwise, at the re-exec for reboot we
3006          * modified the original string on the stack by replacing '=' by '\0'
3007          * below.
3008          */
3009         linep = line = strdup(dup);
3010         if (!line)
3011                 return ret_errno(ENOMEM);
3012
3013         if (!plc->from_include) {
3014                 ret = append_unexp_config_line(line, plc->conf);
3015                 if (ret < 0)
3016                         return ret;
3017         }
3018
3019         if (empty_line)
3020                 return 0;
3021
3022         line += lxc_char_left_gc(line, strlen(line));
3023
3024         /* ignore comments */
3025         if (line[0] == '#')
3026                 return 0;
3027
3028         /* martian option - don't add it to the config itself */
3029         if (!strnequal(line, "lxc.", 4))
3030                 return 0;
3031
3032         dot = strchr(line, '=');
3033         if (!dot)
3034                 return log_error_errno(-EINVAL, EINVAL, "Invalid configuration line: %s", line);
3035
3036         *dot = '\0';
3037         value = dot + 1;
3038
3039         key = line;
3040         key[lxc_char_right_gc(key, strlen(key))] = '\0';
3041
3042         value += lxc_char_left_gc(value, strlen(value));
3043         value[lxc_char_right_gc(value, strlen(value))] = '\0';
3044
3045         if (*value == '\'' || *value == '\"') {
3046                 size_t len;
3047
3048                 len = strlen(value);
3049                 if (len > 1 && value[len - 1] == *value) {
3050                         value[len - 1] = '\0';
3051                         value++;
3052                 }
3053         }
3054
3055         config = lxc_get_config(key);
3056         return config->set(key, value, plc->conf, NULL);
3057 }
3058
3059 static struct new_config_item *parse_new_conf_line(char *buffer)
3060 {
3061         __do_free char *k = NULL, *linep = NULL, *v = NULL;
3062         __do_free struct new_config_item *new = NULL;
3063         char *dup = buffer;
3064         char *dot, *key, *line, *value;
3065
3066         if (is_empty_string(buffer))
3067                 return log_error_errno(NULL, EINVAL, "Empty configuration line");
3068
3069         linep = line = strdup(dup);
3070         if (!line)
3071                 return NULL;
3072
3073         line += lxc_char_left_gc(line, strlen(line));
3074
3075         /* martian option - don't add it to the config itself */
3076         if (!strnequal(line, "lxc.", 4))
3077                 return 0;
3078
3079         dot = strchr(line, '=');
3080         if (!dot)
3081                 return log_error_errno(NULL, EINVAL, "Invalid configuration line: %s", line);
3082
3083         *dot = '\0';
3084         value = dot + 1;
3085
3086         key = line;
3087         key[lxc_char_right_gc(key, strlen(key))] = '\0';
3088
3089         value += lxc_char_left_gc(value, strlen(value));
3090         value[lxc_char_right_gc(value, strlen(value))] = '\0';
3091
3092         if (*value == '\'' || *value == '\"') {
3093                 size_t len;
3094
3095                 len = strlen(value);
3096                 if (len > 1 && value[len - 1] == *value) {
3097                         value[len - 1] = '\0';
3098                         value++;
3099                 }
3100         }
3101
3102         new = zalloc(sizeof(struct new_config_item));
3103         if (!new)
3104                 return NULL;
3105
3106         k = strdup(key);
3107         if (!k)
3108                 return NULL;
3109
3110         v = strdup(value);
3111         if (!v)
3112                 return NULL;
3113
3114         new->key = move_ptr(k);
3115         new->val = move_ptr(v);
3116         return move_ptr(new);
3117 }
3118
3119 int lxc_config_read(const char *file, struct lxc_conf *conf, bool from_include)
3120 {
3121         struct parse_line_conf plc;
3122
3123         if (!conf)
3124                 return syserror_set(-EINVAL, "Missing config");
3125
3126         plc.conf = conf;
3127         plc.from_include = from_include;
3128
3129         /* Catch only the top level config file name in the structure. */
3130         if (!conf->rcfile)
3131                 conf->rcfile = strdup(file);
3132
3133         return lxc_file_for_each_line_mmap(file, parse_line, &plc);
3134 }
3135
3136 int lxc_config_define_add(struct lxc_list *defines, char *arg)
3137 {
3138         __do_free struct lxc_list *dent = NULL;
3139
3140         dent = lxc_list_new();
3141         if (!dent)
3142                 return ret_errno(ENOMEM);
3143
3144         dent->elem = parse_new_conf_line(arg);
3145         if (!dent->elem)
3146                 return ret_errno(ENOMEM);
3147
3148         lxc_list_add_tail(defines, move_ptr(dent));
3149
3150         return 0;
3151 }
3152
3153 bool lxc_config_define_load(struct lxc_list *defines, struct lxc_container *c)
3154 {
3155         struct lxc_list *it;
3156         bool bret = true;
3157
3158         lxc_list_for_each(it, defines) {
3159                 struct new_config_item *new_item = it->elem;
3160                 bret = c->set_config_item(c, new_item->key, new_item->val);
3161                 if (!bret)
3162                         break;
3163         }
3164
3165 #ifndef FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION
3166         lxc_config_define_free(defines);
3167 #endif /* !FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION */
3168
3169         return bret;
3170 }
3171
3172 void lxc_config_define_free(struct lxc_list *defines)
3173 {
3174         struct lxc_list *it, *next;
3175
3176         lxc_list_for_each_safe(it, defines, next) {
3177                 struct new_config_item *new_item = it->elem;
3178                 free(new_item->key);
3179                 free(new_item->val);
3180                 lxc_list_del(it);
3181                 free(it->elem);
3182                 free(it);
3183         }
3184 }
3185
3186 int lxc_config_parse_arch(const char *arch, signed long *persona)
3187 {
3188         static struct per_name {
3189                 char *name;
3190                 unsigned long per;
3191         } pername[] = {
3192                 { "arm",       PER_LINUX32 },
3193                 { "armel",     PER_LINUX32 },
3194                 { "armhf",     PER_LINUX32 },
3195                 { "armv7l",    PER_LINUX32 },
3196                 { "athlon",    PER_LINUX32 },
3197                 { "i386",      PER_LINUX32 },
3198                 { "i486",      PER_LINUX32 },
3199                 { "i586",      PER_LINUX32 },
3200                 { "i686",      PER_LINUX32 },
3201                 { "linux32",   PER_LINUX32 },
3202                 { "mips",      PER_LINUX32 },
3203                 { "mipsel",    PER_LINUX32 },
3204                 { "ppc",       PER_LINUX32 },
3205                 { "powerpc",   PER_LINUX32 },
3206                 { "x86",       PER_LINUX32 },
3207                 { "aarch64",   PER_LINUX   },
3208                 { "amd64",     PER_LINUX   },
3209                 { "arm64",     PER_LINUX   },
3210                 { "linux64",   PER_LINUX   },
3211                 { "mips64",    PER_LINUX   },
3212                 { "mips64el",  PER_LINUX   },
3213                 { "ppc64",     PER_LINUX   },
3214                 { "ppc64el",   PER_LINUX   },
3215                 { "ppc64le",   PER_LINUX   },
3216                 { "powerpc64", PER_LINUX   },
3217                 { "s390x",     PER_LINUX   },
3218                 { "x86_64",    PER_LINUX   },
3219         };
3220
3221         for (size_t i = 0; i < ARRAY_SIZE(pername); i++) {
3222                 if (!strequal(pername[i].name, arch))
3223                         continue;
3224
3225                 *persona = pername[i].per;
3226                 return 0;
3227         }
3228
3229         return ret_errno(EINVAL);
3230 }
3231
3232 int lxc_fill_elevated_privileges(char *flaglist, unsigned int *flags)
3233 {
3234         unsigned int flags_tmp = 0;
3235         char *token;
3236         struct {
3237                 const char *token;
3238                 int flag;
3239         } all_privs[] = {
3240                 { "CGROUP", LXC_ATTACH_MOVE_TO_CGROUP    },
3241                 { "CAP",    LXC_ATTACH_DROP_CAPABILITIES },
3242                 { "LSM",    LXC_ATTACH_LSM_EXEC          },
3243                 { NULL,     0                            }
3244         };
3245
3246         if (!flaglist) {
3247                 /*
3248                  * For the sake of backward compatibility, keep all privileges
3249                  * if no specific privileges are specified.
3250                  */
3251                 for (unsigned int i = 0; all_privs[i].token; i++)
3252                         flags_tmp |= all_privs[i].flag;
3253
3254                 *flags = flags_tmp;
3255                 return 0;
3256         }
3257
3258         lxc_iterate_parts(token, flaglist, "|") {
3259                 bool valid_token = false;
3260
3261                 for (unsigned int i = 0; all_privs[i].token; i++) {
3262                         if (!strequal(all_privs[i].token, token))
3263                                 continue;
3264
3265                         valid_token = true;
3266                         flags_tmp |= all_privs[i].flag;
3267                 }
3268
3269                 if (!valid_token)
3270                         return syserror_set(-EINVAL, "Invalid elevated privilege \"%s\" requested", token);
3271         }
3272
3273         *flags = flags_tmp;
3274         return 0;
3275 }
3276
3277 /* Write out a configuration file. */
3278 int write_config(int fd, const struct lxc_conf *conf)
3279 {
3280         int ret;
3281         size_t len = conf->unexpanded_len;
3282
3283         if (len == 0)
3284                 return 0;
3285
3286         ret = lxc_write_nointr(fd, conf->unexpanded_config, len);
3287         if (ret < 0)
3288                 return log_error_errno(-errno, errno, "Failed to write configuration file");
3289
3290         return 0;
3291 }
3292
3293 bool do_append_unexp_config_line(struct lxc_conf *conf, const char *key,
3294                                  const char *v)
3295 {
3296         __do_free char *tmp = NULL;
3297         int ret;
3298         size_t len;
3299
3300         len = strlen(key) + strlen(v) + 4;
3301         tmp = must_realloc(NULL, len);
3302
3303         if (lxc_config_value_empty(v))
3304                 ret = strnprintf(tmp, len, "%s =", key);
3305         else
3306                 ret = strnprintf(tmp, len, "%s = %s", key, v);
3307         if (ret < 0)
3308                 return false;
3309
3310         /* Save the line verbatim into unexpanded_conf */
3311         if (append_unexp_config_line(tmp, conf))
3312                 return false;
3313
3314         return true;
3315 }
3316
3317 void clear_unexp_config_line(struct lxc_conf *conf, const char *key,
3318                              bool rm_subkeys)
3319 {
3320         char *lend;
3321         char *lstart = conf->unexpanded_config;
3322
3323         if (!conf->unexpanded_config)
3324                 return;
3325
3326         while (*lstart) {
3327                 lend = strchr(lstart, '\n');
3328                 char v;
3329
3330                 if (!lend)
3331                         lend = lstart + strlen(lstart);
3332                 else
3333                         lend++;
3334
3335                 if (!strnequal(lstart, key, strlen(key))) {
3336                         lstart = lend;
3337                         continue;
3338                 }
3339
3340                 if (!rm_subkeys) {
3341                         v = lstart[strlen(key)];
3342                         if (!isspace(v) && v != '=') {
3343                                 lstart = lend;
3344                                 continue;
3345                         }
3346                 }
3347
3348                 conf->unexpanded_len -= (lend - lstart);
3349
3350                 if (*lend == '\0') {
3351                         *lstart = '\0';
3352                         return;
3353                 }
3354
3355                 memmove(lstart, lend, strlen(lend) + 1);
3356         }
3357 }
3358
3359 bool clone_update_unexp_ovl_paths(struct lxc_conf *conf, const char *oldpath,
3360                                   const char *newpath, const char *oldname,
3361                                   const char *newname, const char *ovldir)
3362 {
3363         __do_free char *newdir = NULL, *olddir = NULL;
3364         char *lstart = conf->unexpanded_config;
3365         const char *key = "lxc.mount.entry";
3366         int ret;
3367         char *lend, *p, *q;
3368         size_t newdirlen, olddirlen;
3369
3370         olddirlen = strlen(ovldir) + strlen(oldpath) + strlen(oldname) + 2;
3371         olddir = must_realloc(NULL, olddirlen + 1);
3372         ret = strnprintf(olddir, olddirlen + 1, "%s=%s/%s", ovldir, oldpath, oldname);
3373         if (ret < 0)
3374                 return false;
3375
3376         newdirlen = strlen(ovldir) + strlen(newpath) + strlen(newname) + 2;
3377         newdir = must_realloc(NULL, newdirlen + 1);
3378         ret = strnprintf(newdir, newdirlen + 1, "%s=%s/%s", ovldir, newpath, newname);
3379         if (ret < 0)
3380                 return false;
3381
3382         if (!conf->unexpanded_config)
3383                 return true;
3384
3385         while (*lstart) {
3386                 lend = strchr(lstart, '\n');
3387                 if (!lend)
3388                         lend = lstart + strlen(lstart);
3389                 else
3390                         lend++;
3391
3392                 if (!strnequal(lstart, key, strlen(key)))
3393                         goto next;
3394
3395                 p = strchr(lstart + strlen(key), '=');
3396                 if (!p)
3397                         goto next;
3398                 p++;
3399
3400                 while (isblank(*p))
3401                         p++;
3402
3403                 if (p >= lend)
3404                         goto next;
3405
3406                 /* Whenever a lxc.mount.entry entry is found in a line we check
3407                 *  if the substring "overlay" is present before doing any
3408                 *  further work. We check for "overlay" because substrings need
3409                 *  to have at least one space before them in a valid overlay
3410                 *  lxc.mount.entry (/A B overlay).  When the space before is
3411                 *  missing it is very likely that these substrings are part of a
3412                 *  path or something else. (Checking q >= lend ensures that we
3413                 *  only count matches in the current line.) */
3414                 q = strstr(p, " overlay");
3415                 if (!q || q >= lend)
3416                         goto next;
3417
3418                 if (!(q = strstr(p, olddir)) || (q >= lend))
3419                         goto next;
3420
3421                 /* replace the olddir with newdir */
3422                 if (olddirlen >= newdirlen) {
3423                         size_t diff = olddirlen - newdirlen;
3424                         memcpy(q, newdir, newdirlen);
3425
3426                         if (olddirlen != newdirlen) {
3427                                 memmove(q + newdirlen, q + newdirlen + diff,
3428                                         strlen(q) - newdirlen - diff + 1);
3429                                 lend -= diff;
3430                                 conf->unexpanded_len -= diff;
3431                         }
3432                 } else {
3433                         char *new;
3434                         size_t diff = newdirlen - olddirlen;
3435                         size_t oldlen = conf->unexpanded_len;
3436                         size_t newlen = oldlen + diff;
3437                         size_t poffset = q - conf->unexpanded_config;
3438
3439                         new = realloc(conf->unexpanded_config, newlen + 1);
3440                         if (!new)
3441                                 return false;
3442
3443                         conf->unexpanded_len = newlen;
3444                         conf->unexpanded_alloced = newlen + 1;
3445                         new[newlen - 1] = '\0';
3446                         lend = new + (lend - conf->unexpanded_config);
3447
3448                         /* Move over the remainder to make room for the newdir.
3449                          */
3450                         memmove(new + poffset + newdirlen,
3451                                 new + poffset + olddirlen,
3452                                 oldlen - poffset - olddirlen + 1);
3453                         conf->unexpanded_config = new;
3454
3455                         memcpy(new + poffset, newdir, newdirlen);
3456                         lend += diff;
3457                 }
3458
3459         next:
3460                 lstart = lend;
3461         }
3462
3463         return true;
3464 }
3465
3466 bool clone_update_unexp_hooks(struct lxc_conf *conf, const char *oldpath,
3467                               const char *newpath, const char *oldname,
3468                               const char *newname)
3469 {
3470         __do_free char *newdir = NULL, *olddir = NULL;
3471         char *lstart = conf->unexpanded_config;
3472         const char *key = "lxc.hook";
3473         int ret;
3474         char *lend, *p;
3475         size_t newdirlen, olddirlen;
3476
3477         olddirlen = strlen(oldpath) + strlen(oldname) + 1;
3478         olddir = must_realloc(NULL, olddirlen + 1);
3479         ret = strnprintf(olddir, olddirlen + 1, "%s/%s", oldpath, oldname);
3480         if (ret < 0)
3481                 return false;
3482
3483         newdirlen = strlen(newpath) + strlen(newname) + 1;
3484         newdir = must_realloc(NULL, newdirlen + 1);
3485         ret = strnprintf(newdir, newdirlen + 1, "%s/%s", newpath, newname);
3486         if (ret < 0)
3487                 return false;
3488
3489         if (!conf->unexpanded_config)
3490                 return true;
3491
3492         while (*lstart) {
3493                 lend = strchr(lstart, '\n');
3494                 if (!lend)
3495                         lend = lstart + strlen(lstart);
3496                 else
3497                         lend++;
3498
3499                 if (!strnequal(lstart, key, strlen(key)))
3500                         goto next;
3501
3502                 p = strchr(lstart + strlen(key), '=');
3503                 if (!p)
3504                         goto next;
3505                 p++;
3506
3507                 while (isblank(*p))
3508                         p++;
3509
3510                 if (p >= lend)
3511                         goto next;
3512
3513                 if (!strnequal(p, olddir, strlen(olddir)))
3514                         goto next;
3515
3516                 /* replace the olddir with newdir */
3517                 if (olddirlen >= newdirlen) {
3518                         size_t diff = olddirlen - newdirlen;
3519                         memcpy(p, newdir, newdirlen);
3520
3521                         if (olddirlen != newdirlen) {
3522                                 memmove(p + newdirlen, p + newdirlen + diff,
3523                                         strlen(p) - newdirlen - diff + 1);
3524                                 lend -= diff;
3525                                 conf->unexpanded_len -= diff;
3526                         }
3527                 } else {
3528                         char *new;
3529                         size_t diff = newdirlen - olddirlen;
3530                         size_t oldlen = conf->unexpanded_len;
3531                         size_t newlen = oldlen + diff;
3532                         size_t poffset = p - conf->unexpanded_config;
3533
3534                         new = realloc(conf->unexpanded_config, newlen + 1);
3535                         if (!new)
3536                                 return false;
3537
3538                         conf->unexpanded_len = newlen;
3539                         conf->unexpanded_alloced = newlen + 1;
3540                         new[newlen - 1] = '\0';
3541                         lend = new + (lend - conf->unexpanded_config);
3542
3543                         /* Move over the remainder to make room for the newdir.
3544                          */
3545                         memmove(new + poffset + newdirlen,
3546                                 new + poffset + olddirlen,
3547                                 oldlen - poffset - olddirlen + 1);
3548                         conf->unexpanded_config = new;
3549
3550                         memcpy(new + poffset, newdir, newdirlen);
3551                         lend += diff;
3552                 }
3553
3554         next:
3555                 lstart = lend;
3556         }
3557
3558         return true;
3559 }
3560
3561 #define DO(cmd)                                                                \
3562         {                                                                      \
3563                 if (!(cmd)) {                                                  \
3564                         ERROR("Error writing to new config");                  \
3565                         return false;                                          \
3566                 }                                                              \
3567         }
3568
3569 /* This is called only from clone.  We wish to update all hwaddrs in the
3570  * unexpanded config file. We can't/don't want to update any which come from
3571  * lxc.includes (there shouldn't be any).
3572  * We can't just walk the c->lxc-conf->network list because that includes netifs
3573  * from the include files.  So we update the ones which we find in the unexp
3574  * config file, then find the original macaddr in the conf->network, and update
3575  * that to the same value.
3576  */
3577 bool network_new_hwaddrs(struct lxc_conf *conf)
3578 {
3579         char *lend, *p, *p2;
3580         char *lstart = conf->unexpanded_config;
3581
3582         if (!conf->unexpanded_config)
3583                 return true;
3584
3585         while (*lstart) {
3586                 char newhwaddr[18], oldhwaddr[17];
3587                 struct lxc_netdev *netdev;
3588
3589                 lend = strchr(lstart, '\n');
3590                 if (!lend)
3591                         lend = lstart + strlen(lstart);
3592                 else
3593                         lend++;
3594
3595                 if (!lxc_config_net_is_hwaddr(lstart)) {
3596                         lstart = lend;
3597                         continue;
3598                 }
3599
3600                 p = strchr(lstart, '=');
3601                 if (!p) {
3602                         lstart = lend;
3603                         continue;
3604                 }
3605
3606                 p++;
3607                 while (isblank(*p))
3608                         p++;
3609                 if (!*p)
3610                         return true;
3611
3612                 p2 = p;
3613                 while (*p2 && !isblank(*p2) && *p2 != '\n')
3614                         p2++;
3615
3616                 if ((p2 - p) != 17) {
3617                         WARN("Bad hwaddr entry");
3618                         lstart = lend;
3619                         continue;
3620                 }
3621
3622                 memcpy(oldhwaddr, p, 17);
3623
3624                 if (!new_hwaddr(newhwaddr))
3625                         return false;
3626
3627                 memcpy(p, newhwaddr, 17);
3628                 list_for_each_entry(netdev, &conf->netdevs, head) {
3629                         if (netdev->hwaddr && memcmp(oldhwaddr, netdev->hwaddr, 17) == 0)
3630                                 memcpy(netdev->hwaddr, newhwaddr, 17);
3631                 }
3632
3633                 lstart = lend;
3634         }
3635
3636         return true;
3637 }
3638
3639 static int set_config_ephemeral(const char *key, const char *value,
3640                                 struct lxc_conf *lxc_conf, void *data)
3641 {
3642         int ret;
3643
3644         if (lxc_config_value_empty(value)) {
3645                 lxc_conf->ephemeral = 0;
3646                 return 0;
3647         }
3648
3649         ret = lxc_safe_uint(value, &lxc_conf->ephemeral);
3650         if (ret < 0)
3651                 return ret;
3652
3653         if (lxc_conf->ephemeral > 1)
3654                 return ret_errno(EINVAL);
3655
3656         return 0;
3657 }
3658
3659 static int set_config_log_syslog(const char *key, const char *value,
3660                              struct lxc_conf *lxc_conf, void *data)
3661 {
3662         int facility;
3663
3664         if (lxc_conf->syslog)
3665                 free_disarm(lxc_conf->syslog);
3666
3667         if (lxc_config_value_empty(value))
3668                 return 0;
3669
3670         facility = lxc_syslog_priority_to_int(value);
3671         if (facility == -EINVAL)
3672                 return ret_errno(EINVAL);
3673
3674         lxc_log_syslog(facility);
3675
3676         return set_config_string_item(&lxc_conf->syslog, value);
3677 }
3678
3679 static int set_config_no_new_privs(const char *key, const char *value,
3680                                    struct lxc_conf *lxc_conf, void *data)
3681 {
3682         int ret;
3683         unsigned int v;
3684
3685         if (lxc_config_value_empty(value)) {
3686                 lxc_conf->no_new_privs = false;
3687                 return 0;
3688         }
3689
3690         ret = lxc_safe_uint(value, &v);
3691         if (ret < 0)
3692                 return ret;
3693
3694         if (v > 1)
3695                 return ret_errno(EINVAL);
3696
3697         lxc_conf->no_new_privs = v ? true : false;
3698
3699         return 0;
3700 }
3701
3702 /* Callbacks to get configuration items. */
3703 static int get_config_personality(const char *key, char *retv, int inlen,
3704                                   struct lxc_conf *c, void *data)
3705 {
3706         int fulllen = 0;
3707
3708         if (!retv)
3709                 inlen = 0;
3710         else
3711                 memset(retv, 0, inlen);
3712
3713         int len = 0;
3714
3715         switch (c->personality) {
3716         case PER_LINUX32:
3717                 strprint(retv, inlen, "i686");
3718                 break;
3719         case PER_LINUX:
3720                 strprint(retv, inlen, "x86_64");
3721                 break;
3722         default:
3723                 break;
3724         }
3725
3726         return fulllen;
3727 }
3728
3729 static int get_config_pty_max(const char *key, char *retv, int inlen,
3730                               struct lxc_conf *c, void *data)
3731 {
3732         return lxc_get_conf_size_t(c, retv, inlen, c->pty_max);
3733 }
3734
3735 static int get_config_tty_max(const char *key, char *retv, int inlen,
3736                               struct lxc_conf *c, void *data)
3737 {
3738         return lxc_get_conf_size_t(c, retv, inlen, c->ttys.max);
3739 }
3740
3741 static int get_config_tty_dir(const char *key, char *retv, int inlen,
3742                              struct lxc_conf *c, void *data)
3743 {
3744         return lxc_get_conf_str(retv, inlen, c->ttys.dir);
3745 }
3746
3747 static int get_config_apparmor_profile(const char *key, char *retv, int inlen,
3748                                        struct lxc_conf *c, void *data)
3749 {
3750 #if HAVE_APPARMOR
3751         return lxc_get_conf_str(retv, inlen, c->lsm_aa_profile);
3752 #else
3753         return syserror_set(-EINVAL, "Built without AppArmor support");
3754 #endif
3755 }
3756
3757 static int get_config_apparmor_allow_incomplete(const char *key, char *retv,
3758                                                 int inlen, struct lxc_conf *c,
3759                                                 void *data)
3760 {
3761 #if HAVE_APPARMOR
3762         return lxc_get_conf_int(c, retv, inlen, c->lsm_aa_allow_incomplete);
3763 #else
3764         return syserror_set(-EINVAL, "Built without AppArmor support");
3765 #endif
3766 }
3767
3768 static int get_config_apparmor_allow_nesting(const char *key, char *retv,
3769                                              int inlen, struct lxc_conf *c,
3770                                              void *data)
3771 {
3772 #if HAVE_APPARMOR
3773         return lxc_get_conf_int(c, retv, inlen, c->lsm_aa_allow_nesting);
3774 #else
3775         return syserror_set(-EINVAL, "Built without AppArmor support");
3776 #endif
3777 }
3778
3779 static int get_config_apparmor_raw(const char *key, char *retv,
3780                                    int inlen, struct lxc_conf *c,
3781                                    void *data)
3782 {
3783 #if HAVE_APPARMOR
3784         int len;
3785         struct string_entry *entry;
3786         int fulllen = 0;
3787
3788         if (!retv)
3789                 inlen = 0;
3790         else
3791                 memset(retv, 0, inlen);
3792
3793         list_for_each_entry(entry, &c->lsm_aa_raw, head) {
3794                 strprint(retv, inlen, "%s\n", entry->val);
3795         }
3796
3797         return fulllen;
3798 #else
3799         return syserror_set(-EINVAL, "Built without AppArmor support");
3800 #endif
3801 }
3802
3803 static int get_config_selinux_context(const char *key, char *retv, int inlen,
3804                                       struct lxc_conf *c, void *data)
3805 {
3806 #if HAVE_SELINUX
3807         return lxc_get_conf_str(retv, inlen, c->lsm_se_context);
3808 #else
3809         return syserror_set(-EINVAL, "Built without SELinux support");
3810 #endif
3811 }
3812
3813 static int get_config_selinux_context_keyring(const char *key, char *retv, int inlen,
3814                                               struct lxc_conf *c, void *data)
3815 {
3816 #if HAVE_SELINUX
3817         return lxc_get_conf_str(retv, inlen, c->lsm_se_keyring_context);
3818 #else
3819         return syserror_set(-EINVAL, "Built without SELinux support");
3820 #endif
3821 }
3822
3823 static int get_config_keyring_session(const char *key, char *retv, int inlen,
3824                                       struct lxc_conf *c, void *data)
3825 {
3826         return lxc_get_conf_bool(c, retv, inlen, c->keyring_disable_session);
3827 }
3828
3829
3830 /* If you ask for a specific cgroup value, i.e. lxc.cgroup.devices.list, then
3831  * just the value(s) will be printed. Since there still could be more than one,
3832  * it is newline-separated.
3833  * (Maybe that's ambiguous, since some values, i.e. devices.list, will already
3834  * have newlines?)
3835  * If you ask for 'lxc.cgroup", then all cgroup entries will be printed, in
3836  * 'lxc.cgroup.subsystem.key = value' format.
3837  */
3838 static int __get_config_cgroup_controller(const char *key, char *retv,
3839                                           int inlen, struct lxc_conf *c,
3840                                           int version)
3841 {
3842         int fulllen = 0;
3843         bool get_all = false;
3844         int len;
3845         size_t namespaced_token_len;
3846         char *global_token, *namespaced_token;
3847         struct list_head *list;
3848         struct lxc_cgroup *cgroup;
3849
3850         if (!retv)
3851                 inlen = 0;
3852         else
3853                 memset(retv, 0, inlen);
3854
3855         if (version == CGROUP2_SUPER_MAGIC) {
3856                 global_token = "lxc.cgroup2";
3857                 namespaced_token = "lxc.cgroup2.";
3858                 namespaced_token_len = STRLITERALLEN("lxc.cgroup2.");
3859                 list = &c->cgroup2;
3860         } else if (version == CGROUP_SUPER_MAGIC) {
3861                 global_token = "lxc.cgroup";
3862                 namespaced_token = "lxc.cgroup.";
3863                 namespaced_token_len = STRLITERALLEN("lxc.cgroup.");
3864                 list = &c->cgroup;
3865         } else {
3866                 return ret_errno(EINVAL);
3867         }
3868
3869         if (strequal(key, global_token))
3870                 get_all = true;
3871         else if (strnequal(key, namespaced_token, namespaced_token_len))
3872                 key += namespaced_token_len;
3873         else
3874                 return ret_errno(EINVAL);
3875
3876         list_for_each_entry(cgroup, list, head) {
3877                 if (get_all) {
3878                         if (version != cgroup->version)
3879                                 continue;
3880
3881                         strprint(retv, inlen, "%s.%s = %s\n", global_token,
3882                                  cgroup->subsystem, cgroup->value);
3883                 } else if (strequal(cgroup->subsystem, key)) {
3884                         strprint(retv, inlen, "%s\n", cgroup->value);
3885                 }
3886         }
3887
3888         return fulllen;
3889 }
3890
3891 static int get_config_cgroup_controller(const char *key, char *retv, int inlen,
3892                                         struct lxc_conf *c, void *data)
3893 {
3894         return __get_config_cgroup_controller(key, retv, inlen, c,
3895                                               CGROUP_SUPER_MAGIC);
3896 }
3897
3898 static int get_config_cgroup2_controller(const char *key, char *retv, int inlen,
3899                                          struct lxc_conf *c, void *data)
3900 {
3901         return __get_config_cgroup_controller(key, retv, inlen, c,
3902                                               CGROUP2_SUPER_MAGIC);
3903 }
3904
3905 static int get_config_cgroup_dir(const char *key, char *retv, int inlen,
3906                                  struct lxc_conf *lxc_conf, void *data)
3907 {
3908         int len;
3909         int fulllen = 0;
3910
3911         if (!strequal(key, "lxc.cgroup.dir"))
3912                 return ret_errno(EINVAL);
3913
3914         if (!retv)
3915                 inlen = 0;
3916         else
3917                 memset(retv, 0, inlen);
3918
3919         strprint(retv, inlen, "%s", lxc_conf->cgroup_meta.dir);
3920
3921         return fulllen;
3922 }
3923
3924 static int get_config_cgroup_monitor_dir(const char *key, char *retv, int inlen,
3925                                          struct lxc_conf *lxc_conf, void *data)
3926 {
3927         int len;
3928         int fulllen = 0;
3929
3930         if (!retv)
3931                 inlen = 0;
3932         else
3933                 memset(retv, 0, inlen);
3934
3935         strprint(retv, inlen, "%s", lxc_conf->cgroup_meta.monitor_dir);
3936
3937         return fulllen;
3938 }
3939
3940 static int get_config_cgroup_monitor_pivot_dir(const char *key, char *retv, int inlen,
3941                                          struct lxc_conf *lxc_conf, void *data)
3942 {
3943         int len;
3944         int fulllen = 0;
3945
3946         if (!retv)
3947                 inlen = 0;
3948         else
3949                 memset(retv, 0, inlen);
3950
3951         strprint(retv, inlen, "%s", lxc_conf->cgroup_meta.monitor_pivot_dir);
3952
3953         return fulllen;
3954 }
3955
3956 static int get_config_cgroup_container_dir(const char *key, char *retv,
3957                                            int inlen,
3958                                            struct lxc_conf *lxc_conf,
3959                                            void *data)
3960 {
3961         int len;
3962         int fulllen = 0;
3963
3964         if (!retv)
3965                 inlen = 0;
3966         else
3967                 memset(retv, 0, inlen);
3968
3969         strprint(retv, inlen, "%s", lxc_conf->cgroup_meta.container_dir);
3970
3971         return fulllen;
3972 }
3973
3974 static int get_config_cgroup_container_inner_dir(const char *key, char *retv,
3975                                                  int inlen,
3976                                                  struct lxc_conf *lxc_conf,
3977                                                  void *data)
3978 {
3979         int len;
3980         int fulllen = 0;
3981
3982         if (!retv)
3983                 inlen = 0;
3984         else
3985                 memset(retv, 0, inlen);
3986
3987         strprint(retv, inlen, "%s", lxc_conf->cgroup_meta.namespace_dir);
3988
3989         return fulllen;
3990 }
3991
3992 static inline int get_config_cgroup_relative(const char *key, char *retv,
3993                                              int inlen, struct lxc_conf *lxc_conf,
3994                                              void *data)
3995 {
3996         return lxc_get_conf_int(lxc_conf, retv, inlen,
3997                                 lxc_conf->cgroup_meta.relative);
3998 }
3999
4000 static int get_config_idmaps(const char *key, char *retv, int inlen,
4001                              struct lxc_conf *c, void *data)
4002 {
4003         struct id_map *map;
4004         int len, listlen, ret;
4005         int fulllen = 0;
4006 /* "u 1000 1000000 65536"
4007  *
4008  * let's render this as
4009  *
4010  * sizeof(char)
4011  * +
4012  * sizeof(" ")
4013  * +
4014  * sizeof(uint32_t)
4015  * +
4016  * sizeof(" ")
4017  * +
4018  * sizeof(uint32_t)
4019  * +
4020  * sizeof(" ")
4021  * +
4022  * sizeof(uint32_t)
4023  * +
4024  * \0
4025  */
4026 #define __LXC_IDMAP_STR_BUF (3 * INTTYPE_TO_STRLEN(uint32_t) + 3 + 1 + 1)
4027         char buf[__LXC_IDMAP_STR_BUF];
4028
4029         if (!retv)
4030                 inlen = 0;
4031         else
4032                 memset(retv, 0, inlen);
4033
4034         listlen = list_len(map, &c->id_map, head);
4035         list_for_each_entry(map, &c->id_map, head) {
4036                 ret = strnprintf(buf, sizeof(buf), "%c %lu %lu %lu",
4037                                  (map->idtype == ID_TYPE_UID) ? 'u' : 'g',
4038                                  map->nsid, map->hostid, map->range);
4039                 if (ret < 0)
4040                         return ret_errno(EIO);
4041
4042                 strprint(retv, inlen, "%s%s", buf, (listlen-- > 1) ? "\n" : "");
4043         }
4044
4045         return fulllen;
4046 }
4047
4048 static int get_config_log_level(const char *key, char *retv, int inlen,
4049                                struct lxc_conf *c, void *data)
4050 {
4051         const char *v;
4052         v = lxc_log_priority_to_string(c->loglevel);
4053         return lxc_get_conf_str(retv, inlen, v);
4054 }
4055
4056 static int get_config_log_file(const char *key, char *retv, int inlen,
4057                               struct lxc_conf *c, void *data)
4058 {
4059         return lxc_get_conf_str(retv, inlen, c->logfile);
4060 }
4061
4062 static int get_config_mount_fstab(const char *key, char *retv, int inlen,
4063                                   struct lxc_conf *c, void *data)
4064 {
4065         return lxc_get_conf_str(retv, inlen, c->fstab);
4066 }
4067
4068 static int get_config_mount_auto(const char *key, char *retv, int inlen,
4069                                  struct lxc_conf *c, void *data)
4070 {
4071         int len, fulllen = 0;
4072         const char *sep = "";
4073
4074         if (!retv)
4075                 inlen = 0;
4076         else
4077                 memset(retv, 0, inlen);
4078
4079         if (!(c->auto_mounts & LXC_AUTO_ALL_MASK))
4080                 return 0;
4081
4082         switch (c->auto_mounts & LXC_AUTO_PROC_MASK) {
4083         case LXC_AUTO_PROC_MIXED:
4084                 strprint(retv, inlen, "%sproc:mixed", sep);
4085                 sep = " ";
4086                 break;
4087         case LXC_AUTO_PROC_RW:
4088                 strprint(retv, inlen, "%sproc:rw", sep);
4089                 sep = " ";
4090                 break;
4091         default:
4092                 break;
4093         }
4094
4095         switch (c->auto_mounts & LXC_AUTO_SYS_MASK) {
4096         case LXC_AUTO_SYS_RO:
4097                 strprint(retv, inlen, "%ssys:ro", sep);
4098                 sep = " ";
4099                 break;
4100         case LXC_AUTO_SYS_RW:
4101                 strprint(retv, inlen, "%ssys:rw", sep);
4102                 sep = " ";
4103                 break;
4104         case LXC_AUTO_SYS_MIXED:
4105                 strprint(retv, inlen, "%ssys:mixed", sep);
4106                 sep = " ";
4107                 break;
4108         default:
4109                 break;
4110         }
4111
4112         switch (c->auto_mounts & LXC_AUTO_CGROUP_MASK) {
4113         case LXC_AUTO_CGROUP_NOSPEC:
4114                 strprint(retv, inlen, "%scgroup", sep);
4115                 break;
4116         case LXC_AUTO_CGROUP_MIXED:
4117                 strprint(retv, inlen, "%scgroup:mixed", sep);
4118                 break;
4119         case LXC_AUTO_CGROUP_RO:
4120                 strprint(retv, inlen, "%scgroup:ro", sep);
4121                 break;
4122         case LXC_AUTO_CGROUP_RW:
4123                 strprint(retv, inlen, "%scgroup:rw", sep);
4124                 break;
4125         case LXC_AUTO_CGROUP_FULL_NOSPEC:
4126                 strprint(retv, inlen, "%scgroup-full", sep);
4127                 break;
4128         case LXC_AUTO_CGROUP_FULL_MIXED:
4129                 strprint(retv, inlen, "%scgroup-full:mixed", sep);
4130                 break;
4131         case LXC_AUTO_CGROUP_FULL_RO:
4132                 strprint(retv, inlen, "%scgroup-full:ro", sep);
4133                 break;
4134         case LXC_AUTO_CGROUP_FULL_RW:
4135                 strprint(retv, inlen, "%scgroup-full:rw", sep);
4136                 break;
4137         default:
4138                 break;
4139         }
4140
4141         return fulllen;
4142 }
4143
4144 static int get_config_mount(const char *key, char *retv, int inlen,
4145                             struct lxc_conf *c, void *data)
4146 {
4147         int len, fulllen = 0;
4148         struct string_entry *entry;
4149
4150         if (!retv)
4151                 inlen = 0;
4152         else
4153                 memset(retv, 0, inlen);
4154
4155         list_for_each_entry(entry, &c->mount_entries, head) {
4156                 strprint(retv, inlen, "%s\n", entry->val);
4157         }
4158
4159         return fulllen;
4160 }
4161
4162 static int get_config_rootfs_path(const char *key, char *retv, int inlen,
4163                                   struct lxc_conf *c, void *data)
4164 {
4165         return lxc_get_conf_str(retv, inlen, c->rootfs.path);
4166 }
4167
4168 static int get_config_rootfs_managed(const char *key, char *retv, int inlen,
4169                                      struct lxc_conf *c, void *data)
4170 {
4171         return lxc_get_conf_bool(c, retv, inlen, c->rootfs.managed);
4172 }
4173
4174 static int get_config_rootfs_mount(const char *key, char *retv, int inlen,
4175                                    struct lxc_conf *c, void *data)
4176 {
4177         return lxc_get_conf_str(retv, inlen, c->rootfs.mount);
4178 }
4179
4180 static int get_config_rootfs_options(const char *key, char *retv, int inlen,
4181                                      struct lxc_conf *c, void *data)
4182 {
4183         return lxc_get_conf_str(retv, inlen, c->rootfs.mnt_opts.raw_options);
4184 }
4185
4186 static int get_config_uts_name(const char *key, char *retv, int inlen,
4187                               struct lxc_conf *c, void *data)
4188 {
4189         return lxc_get_conf_str(
4190             retv, inlen,
4191             c->utsname ? c->utsname->nodename : NULL);
4192 }
4193
4194 static int get_config_hooks(const char *key, char *retv, int inlen,
4195                             struct lxc_conf *c, void *data)
4196 {
4197         char *subkey;
4198         int len, fulllen = 0, found = -1;
4199         struct string_entry *entry;
4200         int i;
4201
4202         subkey = strchr(key, '.');
4203         if (!subkey)
4204                 return ret_errno(EINVAL);
4205
4206         subkey = strchr(subkey + 1, '.');
4207         if (!subkey)
4208                 return ret_errno(EINVAL);
4209         subkey++;
4210         if (*subkey == '\0')
4211                 return ret_errno(EINVAL);
4212
4213         for (i = 0; i < NUM_LXC_HOOKS; i++) {
4214                 if (strequal(lxchook_names[i], subkey)) {
4215                         found = i;
4216                         break;
4217                 }
4218         }
4219
4220         if (found == -1)
4221                 return ret_errno(EINVAL);
4222
4223         if (!retv)
4224                 inlen = 0;
4225         else
4226                 memset(retv, 0, inlen);
4227
4228         list_for_each_entry(entry, &c->hooks[found], head) {
4229                 strprint(retv, inlen, "%s\n", entry->val);
4230         }
4231
4232         return fulllen;
4233 }
4234
4235 static int get_config_hooks_version(const char *key, char *retv, int inlen,
4236                                     struct lxc_conf *c, void *data)
4237 {
4238         return lxc_get_conf_int(c, retv, inlen, c->hooks_version);
4239 }
4240
4241 static int get_config_net(const char *key, char *retv, int inlen,
4242                           struct lxc_conf *c, void *data)
4243 {
4244         int len, fulllen = 0;
4245         struct lxc_netdev *netdev;
4246
4247         if (!retv)
4248                 inlen = 0;
4249         else
4250                 memset(retv, 0, inlen);
4251
4252         list_for_each_entry(netdev, &c->netdevs, head) {
4253                 const char *t = lxc_net_type_to_str(netdev->type);
4254                 strprint(retv, inlen, "%s\n", t ? t : "(invalid)");
4255         }
4256
4257         return fulllen;
4258 }
4259
4260 static int get_config_cap_drop(const char *key, char *retv, int inlen,
4261                                struct lxc_conf *c, void *data)
4262 {
4263         int len, fulllen = 0;
4264         struct cap_entry *cap;
4265
4266         if (!retv)
4267                 inlen = 0;
4268         else
4269                 memset(retv, 0, inlen);
4270
4271         list_for_each_entry(cap, &c->caps.list, head) {
4272                 strprint(retv, inlen, "%s\n", cap->cap_name);
4273         }
4274
4275         return fulllen;
4276 }
4277
4278 static int get_config_cap_keep(const char *key, char *retv, int inlen,
4279                                struct lxc_conf *c, void *data)
4280 {
4281         int len, fulllen = 0;
4282         struct cap_entry *cap;
4283
4284         if (!retv)
4285                 inlen = 0;
4286         else
4287                 memset(retv, 0, inlen);
4288
4289         list_for_each_entry(cap, &c->caps.list, head) {
4290                 strprint(retv, inlen, "%s\n", cap->cap_name);
4291         }
4292
4293         return fulllen;
4294 }
4295
4296 static int get_config_console_path(const char *key, char *retv, int inlen,
4297                                    struct lxc_conf *c, void *data)
4298 {
4299         return lxc_get_conf_str(retv, inlen, c->console.path);
4300 }
4301
4302 static int get_config_console_logfile(const char *key, char *retv, int inlen,
4303                                       struct lxc_conf *c, void *data)
4304 {
4305         return lxc_get_conf_str(retv, inlen, c->console.log_path);
4306 }
4307
4308 static int get_config_console_rotate(const char *key, char *retv, int inlen,
4309                                      struct lxc_conf *c, void *data)
4310 {
4311         return lxc_get_conf_int(c, retv, inlen, c->console.log_rotate);
4312 }
4313
4314
4315 static int get_config_console_buffer_size(const char *key, char *retv,
4316                                           int inlen, struct lxc_conf *c,
4317                                           void *data)
4318 {
4319         return lxc_get_conf_uint64(c, retv, inlen, c->console.buffer_size);
4320 }
4321
4322 static int get_config_console_size(const char *key, char *retv, int inlen,
4323                                    struct lxc_conf *c, void *data)
4324 {
4325         return lxc_get_conf_uint64(c, retv, inlen, c->console.log_size);
4326 }
4327
4328 static int get_config_seccomp_allow_nesting(const char *key, char *retv,
4329                                             int inlen, struct lxc_conf *c,
4330                                             void *data)
4331 {
4332 #ifdef HAVE_SECCOMP
4333         return lxc_get_conf_int(c, retv, inlen, c->seccomp.allow_nesting);
4334 #else
4335         return ret_errno(ENOSYS);
4336 #endif
4337 }
4338
4339 static int get_config_seccomp_notify_cookie(const char *key, char *retv, int inlen,
4340                                             struct lxc_conf *c, void *data)
4341 {
4342 #ifdef HAVE_SECCOMP_NOTIFY
4343         return lxc_get_conf_str(retv, inlen, c->seccomp.notifier.cookie);
4344 #else
4345         return ret_errno(ENOSYS);
4346 #endif
4347 }
4348
4349 static int get_config_seccomp_notify_proxy(const char *key, char *retv, int inlen,
4350                                            struct lxc_conf *c, void *data)
4351 {
4352 #ifdef HAVE_SECCOMP_NOTIFY
4353         return lxc_get_conf_str(retv, inlen,
4354                                 (c->seccomp.notifier.proxy_addr.sun_path[0]) == '/'
4355                                     ? &c->seccomp.notifier.proxy_addr.sun_path[0]
4356                                     : &c->seccomp.notifier.proxy_addr.sun_path[1]);
4357 #else
4358         return ret_errno(ENOSYS);
4359 #endif
4360 }
4361
4362 static int get_config_seccomp_profile(const char *key, char *retv, int inlen,
4363                                       struct lxc_conf *c, void *data)
4364 {
4365 #ifdef HAVE_SECCOMP
4366         return lxc_get_conf_str(retv, inlen, c->seccomp.seccomp);
4367 #else
4368         return ret_errno(ENOSYS);
4369 #endif
4370 }
4371
4372 static int get_config_autodev(const char *key, char *retv, int inlen,
4373                               struct lxc_conf *c, void *data)
4374 {
4375         return lxc_get_conf_int(c, retv, inlen, c->autodev);
4376 }
4377
4378 static int get_config_autodev_tmpfs_size(const char *key, char *retv, int inlen,
4379                               struct lxc_conf *c, void *data)
4380 {
4381         return lxc_get_conf_int(c, retv, inlen, c->autodevtmpfssize);
4382 }
4383
4384 static int get_config_signal_halt(const char *key, char *retv, int inlen,
4385                                   struct lxc_conf *c, void *data)
4386 {
4387         return lxc_get_conf_int(c, retv, inlen, c->haltsignal);
4388 }
4389
4390 static int get_config_signal_reboot(const char *key, char *retv, int inlen,
4391                                     struct lxc_conf *c, void *data)
4392 {
4393         return lxc_get_conf_int(c, retv, inlen, c->rebootsignal);
4394 }
4395
4396 static int get_config_signal_stop(const char *key, char *retv, int inlen,
4397                                   struct lxc_conf *c, void *data)
4398 {
4399         return lxc_get_conf_int(c, retv, inlen, c->stopsignal);
4400 }
4401
4402 static int get_config_start(const char *key, char *retv, int inlen,
4403                             struct lxc_conf *c, void *data)
4404 {
4405         if (strequal(key + 10, "auto"))
4406                 return lxc_get_conf_int(c, retv, inlen, c->start_auto);
4407         else if (strequal(key + 10, "delay"))
4408                 return lxc_get_conf_int(c, retv, inlen, c->start_delay);
4409         else if (strequal(key + 10, "order"))
4410                 return lxc_get_conf_int(c, retv, inlen, c->start_order);
4411
4412         return ret_errno(EINVAL);
4413 }
4414
4415 static int get_config_log_syslog(const char *key, char *retv, int inlen,
4416                                  struct lxc_conf *c, void *data)
4417 {
4418         return lxc_get_conf_str(retv, inlen, c->syslog);
4419 }
4420
4421 static int get_config_monitor(const char *key, char *retv, int inlen,
4422                               struct lxc_conf *c, void *data)
4423 {
4424         return lxc_get_conf_int(c, retv, inlen, c->monitor_unshare);
4425 }
4426
4427 static int get_config_monitor_signal_pdeath(const char *key, char *retv,
4428                                             int inlen, struct lxc_conf *c,
4429                                             void *data)
4430 {
4431         return lxc_get_conf_int(c, retv, inlen, c->monitor_signal_pdeath);
4432 }
4433
4434 static int get_config_group(const char *key, char *retv, int inlen,
4435                             struct lxc_conf *c, void *data)
4436 {
4437         int len, fulllen = 0;
4438         struct string_entry *entry;
4439
4440         if (!retv)
4441                 inlen = 0;
4442         else
4443                 memset(retv, 0, inlen);
4444
4445         list_for_each_entry(entry, &c->groups, head) {
4446                 strprint(retv, inlen, "%s\n", entry->val);
4447         }
4448
4449         return fulllen;
4450 }
4451
4452 static int get_config_environment(const char *key, char *retv, int inlen,
4453                                   struct lxc_conf *c, void *data)
4454 {
4455         int len, fulllen = 0;
4456         struct environment_entry *env;
4457
4458         if (!retv)
4459                 inlen = 0;
4460         else
4461                 memset(retv, 0, inlen);
4462
4463         list_for_each_entry(env, &c->environment, head) {
4464                 strprint(retv, inlen, "%s=%s\n", env->key, env->val);
4465         }
4466
4467         return fulllen;
4468 }
4469
4470 static int get_config_execute_cmd(const char *key, char *retv, int inlen,
4471                                struct lxc_conf *c, void *data)
4472 {
4473         return lxc_get_conf_str(retv, inlen, c->execute_cmd);
4474 }
4475
4476 static int get_config_init_cmd(const char *key, char *retv, int inlen,
4477                                struct lxc_conf *c, void *data)
4478 {
4479         return lxc_get_conf_str(retv, inlen, c->init_cmd);
4480 }
4481
4482 static int get_config_init_cwd(const char *key, char *retv, int inlen,
4483                                struct lxc_conf *c, void *data)
4484 {
4485         return lxc_get_conf_str(retv, inlen, c->init_cwd);
4486 }
4487
4488 static int get_config_init_uid(const char *key, char *retv, int inlen,
4489                                struct lxc_conf *c, void *data)
4490 {
4491         return lxc_get_conf_int(c, retv, inlen, c->init_uid);
4492 }
4493
4494 static int get_config_init_gid(const char *key, char *retv, int inlen,
4495                                struct lxc_conf *c, void *data)
4496 {
4497         return lxc_get_conf_int(c, retv, inlen, c->init_gid);
4498 }
4499
4500 static int get_config_init_groups(const char *key, char *retv, int inlen,
4501                                   struct lxc_conf *c, void *data)
4502 {
4503         int fulllen = 0, len;
4504
4505         if (!retv)
4506                 inlen = 0;
4507         else
4508                 memset(retv, 0, inlen);
4509
4510         if (c->init_groups.size == 0)
4511                 return 0;
4512
4513         for (size_t i = 0; i < c->init_groups.size; i++)
4514                 strprint(retv, inlen, "%s%d", (i > 0) ? "," : "",
4515                          c->init_groups.list[i]);
4516
4517         return fulllen;
4518 }
4519
4520 static int get_config_ephemeral(const char *key, char *retv, int inlen,
4521                                 struct lxc_conf *c, void *data)
4522 {
4523         return lxc_get_conf_int(c, retv, inlen, c->ephemeral);
4524 }
4525
4526 static int get_config_no_new_privs(const char *key, char *retv, int inlen,
4527                                    struct lxc_conf *c, void *data)
4528 {
4529         return lxc_get_conf_int(c, retv, inlen, c->no_new_privs);
4530 }
4531
4532 /* If you ask for a specific value, i.e. lxc.prlimit.nofile, then just the value
4533  * will be printed. If you ask for 'lxc.prlimit', then all limit entries will be
4534  * printed, in 'lxc.prlimit.resource = value' format.
4535  */
4536 static int get_config_prlimit(const char *key, char *retv, int inlen,
4537                               struct lxc_conf *c, void *data)
4538 {
4539         int fulllen = 0, len;
4540         bool get_all = false;
4541         struct lxc_limit *lim;
4542
4543         if (!retv)
4544                 inlen = 0;
4545         else
4546                 memset(retv, 0, inlen);
4547
4548         if (strequal(key, "lxc.prlimit"))
4549                 get_all = true;
4550         else if (strnequal(key, "lxc.prlimit.", 12))
4551                 key += 12;
4552         else
4553                 return ret_errno(EINVAL);
4554
4555         list_for_each_entry(lim, &c->limits, head) {
4556                 /* 2 colon separated 64 bit integers or the word 'unlimited' */
4557                 char buf[INTTYPE_TO_STRLEN(uint64_t) * 2 + 2];
4558                 int partlen;
4559
4560                 if (lim->limit.rlim_cur == RLIM_INFINITY) {
4561                         memcpy(buf, "unlimited", STRLITERALLEN("unlimited") + 1);
4562                         partlen = STRLITERALLEN("unlimited");
4563                 } else {
4564                         partlen = sprintf(buf, "%" PRIu64,
4565                                           (uint64_t)lim->limit.rlim_cur);
4566                 }
4567
4568                 if (lim->limit.rlim_cur != lim->limit.rlim_max) {
4569                         if (lim->limit.rlim_max == RLIM_INFINITY)
4570                                 memcpy(buf + partlen, ":unlimited",
4571                                        STRLITERALLEN(":unlimited") + 1);
4572                         else
4573                                 sprintf(buf + partlen, ":%" PRIu64,
4574                                         (uint64_t)lim->limit.rlim_max);
4575                 }
4576
4577                 if (get_all) {
4578                         strprint(retv, inlen, "lxc.prlimit.%s = %s\n",
4579                                  lim->resource, buf);
4580                 } else if (strequal(lim->resource, key)) {
4581                         strprint(retv, inlen, "%s", buf);
4582                 }
4583         }
4584
4585         return fulllen;
4586 }
4587
4588 /* If you ask for a specific value, i.e. lxc.sysctl.net.ipv4.ip_forward, then
4589  * just the value will be printed. If you ask for 'lxc.sysctl', then all sysctl
4590  * entries will be printed, in 'lxc.sysctl.key = value' format.
4591  */
4592 static int get_config_sysctl(const char *key, char *retv, int inlen,
4593                              struct lxc_conf *c, void *data)
4594 {
4595         int fulllen = 0;
4596         bool get_all = false;
4597         int len;
4598         struct lxc_sysctl *sysctl;
4599
4600         if (!retv)
4601                 inlen = 0;
4602         else
4603                 memset(retv, 0, inlen);
4604
4605         if (strequal(key, "lxc.sysctl"))
4606                 get_all = true;
4607         else if (strnequal(key, "lxc.sysctl.", STRLITERALLEN("lxc.sysctl.")))
4608                 key += STRLITERALLEN("lxc.sysctl.");
4609         else
4610                 return ret_errno(EINVAL);
4611
4612         list_for_each_entry(sysctl, &c->sysctls, head) {
4613                 if (get_all) {
4614                         strprint(retv, inlen, "lxc.sysctl.%s = %s\n", sysctl->key,
4615                                  sysctl->value);
4616                 } else if (strequal(sysctl->key, key)) {
4617                         strprint(retv, inlen, "%s", sysctl->value);
4618                 }
4619         }
4620
4621         return fulllen;
4622 }
4623
4624 static int get_config_proc(const char *key, char *retv, int inlen,
4625                            struct lxc_conf *c, void *data)
4626 {
4627         int fulllen = 0;
4628         bool get_all = false;
4629         int len;
4630         struct lxc_proc *proc;
4631
4632         if (!retv)
4633                 inlen = 0;
4634         else
4635                 memset(retv, 0, inlen);
4636
4637         if (strequal(key, "lxc.proc"))
4638                 get_all = true;
4639         else if (strnequal(key, "lxc.proc.", STRLITERALLEN("lxc.proc.")))
4640                 key += STRLITERALLEN("lxc.proc.");
4641         else
4642                 return ret_errno(EINVAL);
4643
4644         list_for_each_entry(proc, &c->procs, head) {
4645                 if (get_all) {
4646                         strprint(retv, inlen, "lxc.proc.%s = %s\n",
4647                                  proc->filename, proc->value);
4648                 } else if (strequal(proc->filename, key)) {
4649                         strprint(retv, inlen, "%s", proc->value);
4650                 }
4651         }
4652
4653         return fulllen;
4654 }
4655
4656 static int get_config_namespace_clone(const char *key, char *retv, int inlen,
4657                                       struct lxc_conf *c, void *data)
4658 {
4659         int i, len;
4660         int fulllen = 0;
4661
4662         if (!retv)
4663                 inlen = 0;
4664         else
4665                 memset(retv, 0, inlen);
4666
4667         for (i = 0; i < LXC_NS_MAX; i++) {
4668                 if (c->ns_clone & ns_info[i].clone_flag)
4669                         strprint(retv, inlen, "%s\n", ns_info[i].proc_name);
4670         }
4671
4672         return fulllen;
4673 }
4674
4675 static int get_config_namespace_keep(const char *key, char *retv, int inlen,
4676                                      struct lxc_conf *c, void *data)
4677 {
4678         int i, len;
4679         int fulllen = 0;
4680
4681         if (!retv)
4682                 inlen = 0;
4683         else
4684                 memset(retv, 0, inlen);
4685
4686         for (i = 0; i < LXC_NS_MAX; i++) {
4687                 if (c->ns_keep & ns_info[i].clone_flag)
4688                         strprint(retv, inlen, "%s\n", ns_info[i].proc_name);
4689         }
4690
4691         return fulllen;
4692 }
4693
4694 static int get_config_time_offset_boot(const char *key, char *retv, int inlen, struct lxc_conf *c,
4695                                        void *data)
4696 {
4697         int len;
4698         int fulllen = 0;
4699
4700         if (!retv)
4701                 inlen = 0;
4702         else
4703                 memset(retv, 0, inlen);
4704
4705         if (c->timens.s_boot) {
4706                 strprint(retv, inlen, "%" PRId64 " s\n", c->timens.s_boot);
4707         } else {
4708                 strprint(retv, inlen, "%" PRId64 " ns\n", c->timens.ns_boot);
4709         }
4710
4711         return fulllen;
4712 }
4713
4714 static int get_config_time_offset_monotonic(const char *key, char *retv, int inlen,
4715                                             struct lxc_conf *c, void *data)
4716 {
4717         int len;
4718         int fulllen = 0;
4719
4720         if (!retv)
4721                 inlen = 0;
4722         else
4723                 memset(retv, 0, inlen);
4724
4725         if (c->timens.s_monotonic) {
4726                 strprint(retv, inlen, "%" PRId64 "s\n", c->timens.s_monotonic);
4727         } else {
4728                 strprint(retv, inlen, "%" PRId64 "ns\n", c->timens.ns_monotonic);
4729         }
4730
4731         return fulllen;
4732 }
4733
4734 static int get_config_namespace_share(const char *key, char *retv, int inlen,
4735                                       struct lxc_conf *c, void *data)
4736 {
4737         int len, ns_idx;
4738         const char *namespace;
4739         int fulllen = 0;
4740
4741         if (!retv)
4742                 inlen = 0;
4743         else
4744                 memset(retv, 0, inlen);
4745
4746         namespace = key + STRLITERALLEN("lxc.namespace.share.");
4747         if (is_empty_string(namespace))
4748                 return ret_errno(EINVAL);
4749
4750         ns_idx = lxc_namespace_2_ns_idx(namespace);
4751         if (ns_idx < 0)
4752                 return ns_idx;
4753
4754         strprint(retv, inlen, "%s", c->ns_share[ns_idx]);
4755
4756         return fulllen;
4757 }
4758
4759 /* Callbacks to clear config items. */
4760 static inline int clr_config_personality(const char *key, struct lxc_conf *c,
4761                                          void *data)
4762 {
4763         c->personality = -1;
4764         return 0;
4765 }
4766
4767 static inline int clr_config_pty_max(const char *key, struct lxc_conf *c,
4768                                      void *data)
4769 {
4770         c->pty_max = 0;
4771         return 0;
4772 }
4773
4774 static inline int clr_config_tty_max(const char *key, struct lxc_conf *c,
4775                                      void *data)
4776 {
4777         c->ttys.tty = 0;
4778         return 0;
4779 }
4780
4781 static inline int clr_config_tty_dir(const char *key, struct lxc_conf *c,
4782                                     void *data)
4783 {
4784         free_disarm(c->ttys.dir);
4785         return 0;
4786 }
4787
4788 static inline int clr_config_apparmor_profile(const char *key,
4789                                               struct lxc_conf *c, void *data)
4790 {
4791 #if HAVE_APPARMOR
4792         free_disarm(c->lsm_aa_profile);
4793         return 0;
4794 #else
4795         return syserror_set(-EINVAL, "Built without AppArmor support");
4796 #endif
4797 }
4798
4799 static inline int clr_config_apparmor_allow_incomplete(const char *key,
4800                                                        struct lxc_conf *c,
4801                                                        void *data)
4802 {
4803 #if HAVE_APPARMOR
4804         c->lsm_aa_allow_incomplete = 0;
4805         return 0;
4806 #else
4807         return syserror_set(-EINVAL, "Built without AppArmor support");
4808 #endif
4809 }
4810
4811 static inline int clr_config_apparmor_allow_nesting(const char *key,
4812                                                     struct lxc_conf *c,
4813                                                     void *data)
4814 {
4815 #if HAVE_APPARMOR
4816         c->lsm_aa_allow_nesting = 0;
4817         return 0;
4818 #else
4819         return syserror_set(-EINVAL, "Built without AppArmor support");
4820 #endif
4821 }
4822
4823 static inline int clr_config_apparmor_raw(const char *key,
4824                                           struct lxc_conf *c,
4825                                           void *data)
4826 {
4827 #if HAVE_APPARMOR
4828         return lxc_clear_apparmor_raw(c);
4829 #else
4830         return syserror_set(-EINVAL, "Built without AppArmor support");
4831 #endif
4832 }
4833
4834 static inline int clr_config_selinux_context(const char *key,
4835                                              struct lxc_conf *c, void *data)
4836 {
4837 #if HAVE_SELINUX
4838         free_disarm(c->lsm_se_context);
4839         return 0;
4840 #else
4841         return syserror_set(-EINVAL, "Built without SELinux support");
4842 #endif
4843 }
4844
4845 static inline int clr_config_selinux_context_keyring(const char *key,
4846                                                      struct lxc_conf *c, void *data)
4847 {
4848 #if HAVE_SELINUX
4849         free_disarm(c->lsm_se_keyring_context);
4850         return 0;
4851 #else
4852         return syserror_set(-EINVAL, "Built without SELinux support");
4853 #endif
4854 }
4855
4856 static inline int clr_config_keyring_session(const char *key,
4857                                              struct lxc_conf *c, void *data)
4858 {
4859         c->keyring_disable_session = false;
4860         return 0;
4861 }
4862
4863 static inline int clr_config_cgroup_controller(const char *key,
4864                                                struct lxc_conf *c, void *data)
4865 {
4866         return lxc_clear_cgroups(c, key, CGROUP_SUPER_MAGIC);
4867 }
4868
4869 static inline int clr_config_cgroup2_controller(const char *key,
4870                                                 struct lxc_conf *c, void *data)
4871 {
4872         return lxc_clear_cgroups(c, key, CGROUP2_SUPER_MAGIC);
4873 }
4874
4875 static int clr_config_cgroup_dir(const char *key, struct lxc_conf *lxc_conf,
4876                                  void *data)
4877 {
4878         if (!strequal(key, "lxc.cgroup.dir"))
4879                 return ret_errno(EINVAL);
4880
4881         if (lxc_conf->cgroup_meta.dir)
4882                 free_disarm(lxc_conf->cgroup_meta.dir);
4883
4884         return 0;
4885 }
4886
4887 static int clr_config_cgroup_monitor_dir(const char *key,
4888                                          struct lxc_conf *lxc_conf,
4889                                          void *data)
4890 {
4891         free_disarm(lxc_conf->cgroup_meta.monitor_dir);
4892         return 0;
4893 }
4894
4895 static int clr_config_cgroup_monitor_pivot_dir(const char *key,
4896                                          struct lxc_conf *lxc_conf,
4897                                          void *data)
4898 {
4899         free_disarm(lxc_conf->cgroup_meta.monitor_pivot_dir);
4900         return 0;
4901 }
4902
4903 static int clr_config_cgroup_container_dir(const char *key,
4904                                            struct lxc_conf *lxc_conf,
4905                                            void *data)
4906 {
4907         free_disarm(lxc_conf->cgroup_meta.container_dir);
4908         return 0;
4909 }
4910
4911 static int clr_config_cgroup_container_inner_dir(const char *key,
4912                                                  struct lxc_conf *lxc_conf,
4913                                                  void *data)
4914 {
4915         free_disarm(lxc_conf->cgroup_meta.namespace_dir);
4916         return 0;
4917 }
4918
4919 static inline int clr_config_cgroup_relative(const char *key,
4920                                              struct lxc_conf *lxc_conf,
4921                                              void *data)
4922 {
4923         lxc_conf->cgroup_meta.relative = false;
4924         return 0;
4925 }
4926
4927 static inline int clr_config_idmaps(const char *key, struct lxc_conf *c,
4928                                     void *data)
4929 {
4930         return lxc_clear_idmaps(c);
4931 }
4932
4933 static inline int clr_config_log_level(const char *key, struct lxc_conf *c,
4934                                       void *data)
4935 {
4936         c->loglevel = LXC_LOG_LEVEL_NOTSET;
4937         return 0;
4938 }
4939
4940 static inline int clr_config_log_file(const char *key, struct lxc_conf *c,
4941                                      void *data)
4942 {
4943         free_disarm(c->logfile);
4944         return 0;
4945 }
4946
4947 static inline int clr_config_mount(const char *key, struct lxc_conf *c,
4948                                    void *data)
4949 {
4950         return lxc_clear_mount_entries(c);
4951 }
4952
4953 static inline int clr_config_mount_auto(const char *key, struct lxc_conf *c,
4954                                         void *data)
4955 {
4956         return lxc_clear_automounts(c);
4957 }
4958
4959 static inline int clr_config_mount_fstab(const char *key, struct lxc_conf *c,
4960                                          void *data)
4961 {
4962         free_disarm(c->fstab);
4963         return 0;
4964 }
4965
4966 static inline int clr_config_rootfs_path(const char *key, struct lxc_conf *c,
4967                                          void *data)
4968 {
4969         free_disarm(c->rootfs.path);
4970         return 0;
4971 }
4972
4973 static inline int clr_config_rootfs_managed(const char *key, struct lxc_conf *c,
4974                                             void *data)
4975 {
4976         c->rootfs.managed = true;
4977         return 0;
4978 }
4979
4980 static inline int clr_config_rootfs_mount(const char *key, struct lxc_conf *c,
4981                                           void *data)
4982 {
4983         free_disarm(c->rootfs.mount);
4984         return 0;
4985 }
4986
4987 static inline int clr_config_rootfs_options(const char *key, struct lxc_conf *c,
4988                                             void *data)
4989 {
4990         put_lxc_mount_options(&c->rootfs.mnt_opts);
4991
4992         return 0;
4993 }
4994
4995 static inline int clr_config_uts_name(const char *key, struct lxc_conf *c,
4996                                      void *data)
4997 {
4998         free_disarm(c->utsname);
4999         return 0;
5000 }
5001
5002 static inline int clr_config_hooks(const char *key, struct lxc_conf *c,
5003                                    void *data)
5004 {
5005         return lxc_clear_hooks(c, key);
5006 }
5007
5008 static inline int clr_config_hooks_version(const char *key, struct lxc_conf *c,
5009                                            void *data)
5010 {
5011         /* default to legacy hooks version */
5012         c->hooks_version = 0;
5013         return 0;
5014 }
5015
5016 static inline int clr_config_net(const char *key, struct lxc_conf *c,
5017                                  void *data)
5018 {
5019         lxc_free_networks(c);
5020
5021         return 0;
5022 }
5023
5024 static inline int clr_config_cap_drop(const char *key, struct lxc_conf *c,
5025                                       void *data)
5026 {
5027         return lxc_clear_config_caps(c);
5028 }
5029
5030 static inline int clr_config_cap_keep(const char *key, struct lxc_conf *c,
5031                                       void *data)
5032 {
5033         return lxc_clear_config_caps(c);
5034 }
5035
5036 static inline int clr_config_console_path(const char *key, struct lxc_conf *c,
5037                                           void *data)
5038 {
5039         free_disarm(c->console.path);
5040         return 0;
5041 }
5042
5043 static inline int clr_config_console_logfile(const char *key,
5044                                              struct lxc_conf *c, void *data)
5045 {
5046         free_disarm(c->console.log_path);
5047         return 0;
5048 }
5049
5050 static inline int clr_config_console_rotate(const char *key, struct lxc_conf *c,
5051                                             void *data)
5052 {
5053         c->console.log_rotate = 0;
5054         return 0;
5055 }
5056
5057 static inline int clr_config_console_buffer_size(const char *key,
5058                                                  struct lxc_conf *c, void *data)
5059 {
5060         c->console.buffer_size = 0;
5061         return 0;
5062 }
5063
5064 static inline int clr_config_console_size(const char *key, struct lxc_conf *c,
5065                                           void *data)
5066 {
5067         c->console.log_size = 0;
5068         return 0;
5069 }
5070
5071 static inline int clr_config_seccomp_allow_nesting(const char *key,
5072                                                    struct lxc_conf *c, void *data)
5073 {
5074 #ifdef HAVE_SECCOMP
5075         c->seccomp.allow_nesting = 0;
5076         return 0;
5077 #else
5078         return ret_errno(ENOSYS);
5079 #endif
5080 }
5081
5082 static inline int clr_config_seccomp_notify_cookie(const char *key,
5083                                                    struct lxc_conf *c, void *data)
5084 {
5085 #ifdef HAVE_SECCOMP_NOTIFY
5086         free_disarm(c->seccomp.notifier.cookie);
5087         return 0;
5088 #else
5089         return ret_errno(ENOSYS);
5090 #endif
5091 }
5092
5093 static inline int clr_config_seccomp_notify_proxy(const char *key,
5094                                                    struct lxc_conf *c, void *data)
5095 {
5096 #ifdef HAVE_SECCOMP_NOTIFY
5097         memset(&c->seccomp.notifier.proxy_addr, 0,
5098                sizeof(c->seccomp.notifier.proxy_addr));
5099         return 0;
5100 #else
5101         return ret_errno(ENOSYS);
5102 #endif
5103 }
5104
5105 static inline int clr_config_seccomp_profile(const char *key,
5106                                              struct lxc_conf *c, void *data)
5107 {
5108         free_disarm(c->seccomp.seccomp);
5109         return 0;
5110 }
5111
5112 static inline int clr_config_autodev(const char *key, struct lxc_conf *c,
5113                                      void *data)
5114 {
5115         c->autodev = 1;
5116         return 0;
5117 }
5118
5119 static inline int clr_config_autodev_tmpfs_size(const char *key, struct lxc_conf *c,
5120                                      void *data)
5121 {
5122         c->autodevtmpfssize = 500000;
5123         return 0;
5124 }
5125
5126 static inline int clr_config_signal_halt(const char *key, struct lxc_conf *c,
5127                                         void *data)
5128 {
5129         c->haltsignal = 0;
5130         return 0;
5131 }
5132
5133 static inline int clr_config_signal_reboot(const char *key, struct lxc_conf *c,
5134                                           void *data)
5135 {
5136         c->rebootsignal = 0;
5137         return 0;
5138 }
5139
5140 static inline int clr_config_signal_stop(const char *key, struct lxc_conf *c,
5141                                         void *data)
5142 {
5143         c->stopsignal = 0;
5144         return 0;
5145 }
5146
5147 static inline int clr_config_start(const char *key, struct lxc_conf *c,
5148                                    void *data)
5149 {
5150         if (strequal(key + 10, "auto"))
5151                 c->start_auto = 0;
5152         else if (strequal(key + 10, "delay"))
5153                 c->start_delay = 0;
5154         else if (strequal(key + 10, "order"))
5155                 c->start_order = 0;
5156
5157         return 0;
5158 }
5159
5160 static inline int clr_config_log_syslog(const char *key, struct lxc_conf *c,
5161                                     void *data)
5162 {
5163         free_disarm(c->syslog);
5164         return 0;
5165 }
5166
5167 static inline int clr_config_monitor(const char *key, struct lxc_conf *c,
5168                                      void *data)
5169 {
5170         c->monitor_unshare = 0;
5171         return 0;
5172 }
5173
5174 static inline int clr_config_monitor_signal_pdeath(const char *key,
5175                                                    struct lxc_conf *c, void *data)
5176 {
5177         c->monitor_signal_pdeath = 0;
5178         return 0;
5179 }
5180
5181 static inline int clr_config_group(const char *key, struct lxc_conf *c,
5182                                    void *data)
5183 {
5184         return lxc_clear_groups(c);
5185 }
5186
5187 static inline int clr_config_environment(const char *key, struct lxc_conf *c,
5188                                          void *data)
5189 {
5190         return lxc_clear_environment(c);
5191 }
5192
5193 static inline int clr_config_execute_cmd(const char *key, struct lxc_conf *c,
5194                                       void *data)
5195 {
5196         free_disarm(c->execute_cmd);
5197         return 0;
5198 }
5199
5200 static inline int clr_config_init_cmd(const char *key, struct lxc_conf *c,
5201                                       void *data)
5202 {
5203         free_disarm(c->init_cmd);
5204         return 0;
5205 }
5206
5207 static inline int clr_config_init_cwd(const char *key, struct lxc_conf *c,
5208                                       void *data)
5209 {
5210         free_disarm(c->init_cwd);
5211         return 0;
5212 }
5213
5214 static inline int clr_config_init_uid(const char *key, struct lxc_conf *c,
5215                                       void *data)
5216 {
5217         c->init_uid = 0;
5218         return 0;
5219 }
5220
5221 static inline int clr_config_init_gid(const char *key, struct lxc_conf *c,
5222                                       void *data)
5223 {
5224         c->init_gid = 0;
5225         return 0;
5226 }
5227
5228 static inline int clr_config_init_groups(const char *key, struct lxc_conf *c,
5229                                          void *data)
5230 {
5231         c->init_groups.size = 0;
5232         free_disarm(c->init_groups.list);
5233         return 0;
5234 }
5235
5236 static inline int clr_config_ephemeral(const char *key, struct lxc_conf *c,
5237                                        void *data)
5238 {
5239         c->ephemeral = 0;
5240         return 0;
5241 }
5242
5243 static inline int clr_config_no_new_privs(const char *key, struct lxc_conf *c,
5244                                           void *data)
5245 {
5246         c->no_new_privs = false;
5247         return 0;
5248 }
5249
5250 static inline int clr_config_prlimit(const char *key, struct lxc_conf *c,
5251                                    void *data)
5252 {
5253         return lxc_clear_limits(c, key);
5254 }
5255
5256 static inline int clr_config_sysctl(const char *key, struct lxc_conf *c,
5257                                    void *data)
5258 {
5259         return lxc_clear_sysctls(c, key);
5260 }
5261
5262 static inline int clr_config_proc(const char *key, struct lxc_conf *c,
5263                                    void *data)
5264 {
5265         return lxc_clear_procs(c, key);
5266 }
5267
5268 static inline int clr_config_includefiles(const char *key, struct lxc_conf *c,
5269                                           void *data)
5270 {
5271         return 0;
5272 }
5273
5274 static int clr_config_namespace_clone(const char *key,
5275                                       struct lxc_conf *lxc_conf, void *data)
5276 {
5277         lxc_conf->ns_clone = 0;
5278         return 0;
5279 }
5280
5281 static int clr_config_namespace_keep(const char *key, struct lxc_conf *lxc_conf,
5282                                      void *data)
5283 {
5284         lxc_conf->ns_keep = 0;
5285         return 0;
5286 }
5287
5288 static int clr_config_time_offset_boot(const char *key, struct lxc_conf *lxc_conf, void *data)
5289 {
5290         lxc_conf->timens.s_boot = 0;
5291         lxc_conf->timens.ns_boot = 0;
5292         return 0;
5293 }
5294
5295 static int clr_config_time_offset_monotonic(const char *key, struct lxc_conf *lxc_conf, void *data)
5296 {
5297         lxc_conf->timens.s_monotonic = 0;
5298         lxc_conf->timens.ns_monotonic = 0;
5299         return 0;
5300 }
5301
5302 static int clr_config_namespace_share(const char *key,
5303                                       struct lxc_conf *lxc_conf, void *data)
5304 {
5305         int ns_idx;
5306         const char *namespace;
5307
5308         namespace = key + STRLITERALLEN("lxc.namespace.share.");
5309         if (is_empty_string(namespace))
5310                 return ret_errno(EINVAL);
5311
5312         ns_idx = lxc_namespace_2_ns_idx(namespace);
5313         if (ns_idx < 0)
5314                 return ns_idx;
5315
5316         free(lxc_conf->ns_share[ns_idx]);
5317         lxc_conf->ns_share[ns_idx] = NULL;
5318
5319         return 0;
5320 }
5321
5322 static int get_config_includefiles(const char *key, char *retv, int inlen,
5323                                    struct lxc_conf *c, void *data)
5324 {
5325         return ret_errno(ENOSYS);
5326 }
5327
5328 struct config_net_info {
5329         char buf[NETWORK_SUBKEY_SIZE_MAX];
5330         const char *subkey;
5331         const struct lxc_config_net_t *ops;
5332         struct lxc_netdev *netdev;
5333 };
5334
5335 static int get_network_config_ops(const char *key, struct lxc_conf *lxc_conf,
5336                                   struct config_net_info *info, bool allocate)
5337 {
5338         int ret;
5339         int64_t tmpidx;
5340         unsigned int idx;
5341         const char *idx_start;
5342
5343         if (is_empty_string(key))
5344                 return ret_errno(EINVAL);
5345
5346         /* check that this is a sensible network key */
5347         if (!strnequal("lxc.net.", key, STRLITERALLEN("lxc.net.")))
5348                 return syserror_set(-EINVAL, "Invalid network configuration key \"%s\"", key);
5349
5350         /* lxc.net.<n> */
5351         /* beginning of index string */
5352         idx_start = key + STRLITERALLEN("lxc.net.");
5353         if (!isdigit(*idx_start))
5354                 return syserror_set(-EINVAL, "Failed to detect digit in string \"%s\"", key + 8);
5355
5356         ret = lxc_safe_int64_residual(idx_start, &tmpidx, 10, info->buf, sizeof(info->buf));
5357         if (ret)
5358                 return syserror("Failed to parse network index");
5359
5360         if (tmpidx < 0 || tmpidx >= INT_MAX)
5361                 return syserror_set(-ERANGE, "Number of configured networks would overflow the counter");
5362         idx = (unsigned int)tmpidx;
5363
5364         info->netdev = lxc_get_netdev_by_idx(lxc_conf, idx, allocate);
5365         if (!info->netdev)
5366                 return ret_errno(EINVAL);
5367
5368         /* Make sure subkey points to the empty string. */
5369         info->subkey = info->buf;
5370         if (is_empty_string(info->subkey))
5371                 return ret_errno(ENOENT);
5372
5373         if (info->subkey[0] != '.')
5374                 return syserror_set(-EINVAL, "Invalid subkey");
5375         info->subkey++;
5376
5377         /* lxc.net.<idx>.<subkey> */
5378         info->ops = lxc_get_config_net(info->subkey);
5379         if (info->ops == &unsupported_config_net_key)
5380                 return syserror_set(-ENOENT, "Unknown network configuration key \"%s\"", key);
5381
5382         return 0;
5383 }
5384
5385 /* Config entry is something like "lxc.net.0.ipv4" the key 'lxc.net.' was
5386  * found. So we make sure next comes an integer, find the right callback (by
5387  * rewriting the key), and call it.
5388  */
5389 static int set_config_jump_table_net(const char *key, const char *value,
5390                                      struct lxc_conf *lxc_conf, void *data)
5391 {
5392         struct config_net_info info = {};
5393         int ret;
5394         const char *idxstring;
5395
5396         idxstring = key + STRLITERALLEN("lxc.net.");
5397         if (!isdigit(*idxstring))
5398                 return ret_errno(EINVAL);
5399
5400         if (lxc_config_value_empty(value))
5401                 return clr_config_jump_table_net(key, lxc_conf, data);
5402
5403         ret = get_network_config_ops(key, lxc_conf, &info, true);
5404         if (ret)
5405                 return ret;
5406
5407         return info.ops->set(info.subkey, value, lxc_conf, info.netdev);
5408 }
5409
5410 static int clr_config_jump_table_net(const char *key, struct lxc_conf *lxc_conf,
5411                                      void *data)
5412 {
5413         struct config_net_info info = {};
5414         int ret;
5415         const char *idxstring;
5416
5417         idxstring = key + 8;
5418         if (!isdigit(*idxstring))
5419                 return ret_errno(EINVAL);
5420
5421         /* The left conjunct is pretty self-explanatory. The right conjunct
5422          * checks whether the two pointers are equal. If they are we know that
5423          * this is not a key that is namespaced any further and so we are
5424          * supposed to clear the whole network.
5425          */
5426         if (isdigit(*idxstring) && (strrchr(key, '.') == (idxstring - 1))) {
5427                 unsigned int rmnetdevidx;
5428
5429                 ret = lxc_safe_uint(idxstring, &rmnetdevidx);
5430                 if (ret < 0)
5431                         return ret;
5432
5433                 /* Remove network from network list. */
5434                 lxc_remove_nic_by_idx(lxc_conf, rmnetdevidx);
5435                 return 0;
5436         }
5437
5438         ret = get_network_config_ops(key, lxc_conf, &info, false);
5439         if (ret)
5440                 return ret;
5441
5442         return info.ops->clr(info.subkey, lxc_conf, info.netdev);
5443 }
5444
5445 static int clr_config_net_type(const char *key, struct lxc_conf *lxc_conf,
5446                                void *data)
5447 {
5448         struct lxc_netdev *netdev = data;
5449
5450         if (!netdev)
5451                 return ret_errno(EINVAL);
5452
5453         lxc_clear_netdev(netdev);
5454
5455         return 0;
5456 }
5457
5458 static int clr_config_net_name(const char *key, struct lxc_conf *lxc_conf,
5459                                void *data)
5460 {
5461         struct lxc_netdev *netdev = data;
5462
5463         if (!netdev)
5464                 return ret_errno(EINVAL);
5465
5466         netdev->name[0] = '\0';
5467
5468         return 0;
5469 }
5470
5471 static int clr_config_net_flags(const char *key, struct lxc_conf *lxc_conf,
5472                                 void *data)
5473 {
5474         struct lxc_netdev *netdev = data;
5475
5476         if (!netdev)
5477                 return ret_errno(EINVAL);
5478
5479         netdev->flags = 0;
5480
5481         return 0;
5482 }
5483
5484 static int clr_config_net_link(const char *key, struct lxc_conf *lxc_conf,
5485                                void *data)
5486 {
5487         struct lxc_netdev *netdev = data;
5488
5489         if (!netdev)
5490                 return ret_errno(EINVAL);
5491
5492         netdev->link[0] = '\0';
5493
5494         return 0;
5495 }
5496
5497 static int clr_config_net_l2proxy(const char *key, struct lxc_conf *lxc_conf,
5498                                void *data)
5499 {
5500         struct lxc_netdev *netdev = data;
5501
5502         if (!netdev)
5503                 return ret_errno(EINVAL);
5504
5505         netdev->l2proxy = false;
5506
5507         return 0;
5508 }
5509
5510 static int clr_config_net_macvlan_mode(const char *key,
5511                                        struct lxc_conf *lxc_conf, void *data)
5512 {
5513         struct lxc_netdev *netdev = data;
5514
5515         if (!netdev)
5516                 return ret_errno(EINVAL);
5517
5518         if (netdev->type != LXC_NET_MACVLAN)
5519                 return 0;
5520
5521         netdev->priv.macvlan_attr.mode = -1;
5522
5523         return 0;
5524 }
5525
5526 static int clr_config_net_ipvlan_mode(const char *key,
5527                                        struct lxc_conf *lxc_conf, void *data)
5528 {
5529         struct lxc_netdev *netdev = data;
5530
5531         if (!netdev)
5532                 return ret_errno(EINVAL);
5533
5534         if (netdev->type != LXC_NET_IPVLAN)
5535                 return 0;
5536
5537         netdev->priv.ipvlan_attr.mode = -1;
5538
5539         return 0;
5540 }
5541
5542 static int clr_config_net_ipvlan_isolation(const char *key,
5543                                            struct lxc_conf *lxc_conf, void *data)
5544 {
5545         struct lxc_netdev *netdev = data;
5546
5547         if (!netdev)
5548                 return ret_errno(EINVAL);
5549
5550         if (netdev->type != LXC_NET_IPVLAN)
5551                 return 0;
5552
5553         netdev->priv.ipvlan_attr.isolation = -1;
5554
5555         return 0;
5556 }
5557
5558 static int clr_config_net_veth_mode(const char *key,
5559                                        struct lxc_conf *lxc_conf, void *data)
5560 {
5561         struct lxc_netdev *netdev = data;
5562
5563         if (!netdev)
5564                 return ret_errno(EINVAL);
5565
5566         if (netdev->type != LXC_NET_VETH)
5567                 return 0;
5568
5569         netdev->priv.veth_attr.mode = -1;
5570
5571         return 0;
5572 }
5573
5574 static int clr_config_net_veth_pair(const char *key, struct lxc_conf *lxc_conf,
5575                                     void *data)
5576 {
5577         struct lxc_netdev *netdev = data;
5578
5579         if (!netdev)
5580                 return ret_errno(EINVAL);
5581
5582         if (netdev->type != LXC_NET_VETH)
5583                 return 0;
5584
5585         netdev->priv.veth_attr.pair[0] = '\0';
5586
5587         return 0;
5588 }
5589
5590 static int clr_config_net_veth_vlan_id(const char *key, struct lxc_conf *lxc_conf,
5591                                   void *data)
5592 {
5593         struct lxc_netdev *netdev = data;
5594
5595         if (!netdev)
5596                 return ret_errno(EINVAL);
5597
5598         if (netdev->type != LXC_NET_VETH)
5599                 return 0;
5600
5601         netdev->priv.veth_attr.vlan_id = 0;
5602         netdev->priv.veth_attr.vlan_id_set = false;
5603
5604         return 0;
5605 }
5606
5607 static int clr_config_net_veth_vlan_tagged_id(const char *key,
5608                                        struct lxc_conf *lxc_conf, void *data)
5609 {
5610         struct lxc_netdev *netdev = data;
5611         struct lxc_list *cur, *next;
5612
5613         if (!netdev)
5614                 return ret_errno(EINVAL);
5615
5616         if (netdev->type != LXC_NET_VETH)
5617                 return 0;
5618
5619         lxc_list_for_each_safe(cur, &netdev->priv.veth_attr.vlan_tagged_ids, next) {
5620                 lxc_list_del(cur);
5621                 free(cur);
5622         }
5623
5624         return 0;
5625 }
5626
5627
5628 static int clr_config_net_script_up(const char *key, struct lxc_conf *lxc_conf,
5629                                     void *data)
5630 {
5631         struct lxc_netdev *netdev = data;
5632
5633         if (!netdev)
5634                 return ret_errno(EINVAL);
5635
5636         free_disarm(netdev->upscript);
5637
5638         return 0;
5639 }
5640
5641 static int clr_config_net_script_down(const char *key,
5642                                       struct lxc_conf *lxc_conf, void *data)
5643 {
5644         struct lxc_netdev *netdev = data;
5645
5646         if (!netdev)
5647                 return ret_errno(EINVAL);
5648
5649         free_disarm(netdev->downscript);
5650
5651         return 0;
5652 }
5653
5654 static int clr_config_net_hwaddr(const char *key, struct lxc_conf *lxc_conf,
5655                                  void *data)
5656 {
5657         struct lxc_netdev *netdev = data;
5658
5659         if (!netdev)
5660                 return ret_errno(EINVAL);
5661
5662         free_disarm(netdev->hwaddr);
5663
5664         return 0;
5665 }
5666
5667 static int clr_config_net_mtu(const char *key, struct lxc_conf *lxc_conf,
5668                               void *data)
5669 {
5670         struct lxc_netdev *netdev = data;
5671
5672         if (!netdev)
5673                 return ret_errno(EINVAL);
5674
5675         free_disarm(netdev->mtu);
5676
5677         return 0;
5678 }
5679
5680 static int clr_config_net_vlan_id(const char *key, struct lxc_conf *lxc_conf,
5681                                   void *data)
5682 {
5683         struct lxc_netdev *netdev = data;
5684
5685         if (!netdev)
5686                 return ret_errno(EINVAL);
5687
5688         if (netdev->type != LXC_NET_VLAN)
5689                 return 0;
5690
5691         netdev->priv.vlan_attr.vid = 0;
5692
5693         return 0;
5694 }
5695
5696 static int clr_config_net_ipv4_gateway(const char *key,
5697                                        struct lxc_conf *lxc_conf, void *data)
5698 {
5699         struct lxc_netdev *netdev = data;
5700
5701         if (!netdev)
5702                 return ret_errno(EINVAL);
5703
5704         free_disarm(netdev->ipv4_gateway);
5705
5706         return 0;
5707 }
5708
5709 static int clr_config_net_ipv4_address(const char *key,
5710                                        struct lxc_conf *lxc_conf, void *data)
5711 {
5712         struct lxc_netdev *netdev = data;
5713         struct lxc_inetdev *inetdev, *ninetdev;
5714
5715         if (!netdev)
5716                 return ret_errno(EINVAL);
5717
5718         list_for_each_entry_safe(inetdev, ninetdev, &netdev->ipv4_addresses, head) {
5719                 list_del(&inetdev->head);
5720                 free(inetdev);
5721         }
5722
5723         return 0;
5724 }
5725
5726 static int clr_config_net_veth_ipv4_route(const char *key,
5727                                           struct lxc_conf *lxc_conf, void *data)
5728 {
5729         struct lxc_netdev *netdev = data;
5730         struct lxc_inetdev *inetdev, *ninetdev;
5731
5732         if (!netdev)
5733                 return ret_errno(EINVAL);
5734
5735         if (netdev->type != LXC_NET_VETH)
5736                 return 0;
5737
5738         list_for_each_entry_safe(inetdev, ninetdev, &netdev->priv.veth_attr.ipv4_routes, head) {
5739                 list_del(&inetdev->head);
5740                 free(inetdev);
5741         }
5742
5743         return 0;
5744 }
5745
5746 static int clr_config_net_ipv6_gateway(const char *key,
5747                                        struct lxc_conf *lxc_conf, void *data)
5748 {
5749         struct lxc_netdev *netdev = data;
5750
5751         if (!netdev)
5752                 return ret_errno(EINVAL);
5753
5754         free_disarm(netdev->ipv6_gateway);
5755
5756         return 0;
5757 }
5758
5759 static int clr_config_net_ipv6_address(const char *key,
5760                                        struct lxc_conf *lxc_conf, void *data)
5761 {
5762         struct lxc_netdev *netdev = data;
5763         struct lxc_inet6dev *inet6dev, *ninet6dev;
5764
5765         if (!netdev)
5766                 return ret_errno(EINVAL);
5767
5768         list_for_each_entry_safe(inet6dev, ninet6dev, &netdev->ipv6_addresses, head) {
5769                 list_del(&inet6dev->head);
5770                 free(inet6dev);
5771         }
5772
5773         return 0;
5774 }
5775
5776 static int clr_config_net_veth_ipv6_route(const char *key,
5777                                           struct lxc_conf *lxc_conf, void *data)
5778 {
5779         struct lxc_netdev *netdev = data;
5780         struct lxc_inet6dev *inet6dev, *ninet6dev;
5781
5782         if (!netdev)
5783                 return ret_errno(EINVAL);
5784
5785         if (netdev->type != LXC_NET_VETH)
5786                 return 0;
5787
5788         list_for_each_entry_safe(inet6dev, ninet6dev, &netdev->priv.veth_attr.ipv6_routes, head) {
5789                 list_del(&inet6dev->head);
5790                 free(inet6dev);
5791         }
5792
5793         return 0;
5794 }
5795
5796 static int get_config_jump_table_net(const char *key, char *retv, int inlen,
5797                                      struct lxc_conf *c, void *data)
5798 {
5799         struct config_net_info info = {};
5800         int ret;
5801         const char *idxstring;
5802
5803         idxstring = key + STRLITERALLEN("lxc.net.");
5804         if (!isdigit(*idxstring))
5805                 return ret_errno(EINVAL);
5806
5807         ret = get_network_config_ops(key, c, &info, false);
5808         if (ret)
5809                 return ret;
5810
5811         return info.ops->get(info.subkey, retv, inlen, c, info.netdev);
5812 }
5813
5814 static int get_config_net_type(const char *key, char *retv, int inlen,
5815                                struct lxc_conf *c, void *data)
5816 {
5817         int len;
5818         int fulllen = 0;
5819         struct lxc_netdev *netdev = data;
5820
5821         if (!netdev)
5822                 return ret_errno(EINVAL);
5823
5824         if (!retv)
5825                 inlen = 0;
5826         else
5827                 memset(retv, 0, inlen);
5828
5829         strprint(retv, inlen, "%s", lxc_net_type_to_str(netdev->type));
5830
5831         return fulllen;
5832 }
5833
5834 static int get_config_net_flags(const char *key, char *retv, int inlen,
5835                                 struct lxc_conf *c, void *data)
5836 {
5837         int len;
5838         int fulllen = 0;
5839         struct lxc_netdev *netdev = data;
5840
5841         if (!netdev)
5842                 return ret_errno(EINVAL);
5843
5844         if (!retv)
5845                 inlen = 0;
5846         else
5847                 memset(retv, 0, inlen);
5848
5849         if (netdev->flags & IFF_UP)
5850                 strprint(retv, inlen, "up");
5851
5852         return fulllen;
5853 }
5854
5855 static int get_config_net_link(const char *key, char *retv, int inlen,
5856                                struct lxc_conf *c, void *data)
5857 {
5858         int len;
5859         int fulllen = 0;
5860         struct lxc_netdev *netdev = data;
5861
5862         if (!netdev)
5863                 return ret_errno(EINVAL);
5864
5865         if (!retv)
5866                 inlen = 0;
5867         else
5868                 memset(retv, 0, inlen);
5869
5870         if (netdev->link[0] != '\0')
5871                 strprint(retv, inlen, "%s", netdev->link);
5872
5873         return fulllen;
5874 }
5875
5876 static int get_config_net_l2proxy(const char *key, char *retv, int inlen,
5877                                   struct lxc_conf *c, void *data)
5878 {
5879         struct lxc_netdev *netdev = data;
5880
5881         if (!netdev)
5882                 return ret_errno(EINVAL);
5883
5884         return lxc_get_conf_bool(c, retv, inlen, netdev->l2proxy);
5885 }
5886
5887 static int get_config_net_name(const char *key, char *retv, int inlen,
5888                                struct lxc_conf *c, void *data)
5889 {
5890         int len;
5891         int fulllen = 0;
5892         struct lxc_netdev *netdev = data;
5893
5894         if (!netdev)
5895                 return ret_errno(EINVAL);
5896
5897         if (!retv)
5898                 inlen = 0;
5899         else
5900                 memset(retv, 0, inlen);
5901
5902         if (netdev->name[0] != '\0')
5903                 strprint(retv, inlen, "%s", netdev->name);
5904
5905         return fulllen;
5906 }
5907
5908 static int get_config_net_macvlan_mode(const char *key, char *retv, int inlen,
5909                                        struct lxc_conf *c, void *data)
5910 {
5911         int len;
5912         int fulllen = 0;
5913         const char *mode;
5914         struct lxc_netdev *netdev = data;
5915
5916         if (!netdev)
5917                 return ret_errno(EINVAL);
5918
5919         if (netdev->type != LXC_NET_MACVLAN)
5920                 return ret_errno(EINVAL);
5921
5922         if (!retv)
5923                 inlen = 0;
5924         else
5925                 memset(retv, 0, inlen);
5926
5927         switch (netdev->priv.macvlan_attr.mode) {
5928         case MACVLAN_MODE_PRIVATE:
5929                 mode = "private";
5930                 break;
5931         case MACVLAN_MODE_VEPA:
5932                 mode = "vepa";
5933                 break;
5934         case MACVLAN_MODE_BRIDGE:
5935                 mode = "bridge";
5936                 break;
5937         case MACVLAN_MODE_PASSTHRU:
5938                 mode = "passthru";
5939                 break;
5940         default:
5941                 mode = "(invalid)";
5942                 break;
5943         }
5944
5945         strprint(retv, inlen, "%s", mode);
5946
5947         return fulllen;
5948 }
5949
5950 static int get_config_net_ipvlan_mode(const char *key, char *retv, int inlen,
5951                                        struct lxc_conf *c, void *data)
5952 {
5953         int fulllen = 0;
5954         struct lxc_netdev *netdev = data;
5955         int len;
5956         const char *mode;
5957
5958         if (!netdev)
5959                 return ret_errno(EINVAL);
5960
5961         if (netdev->type != LXC_NET_IPVLAN)
5962                 return ret_errno(EINVAL);
5963
5964         if (!retv)
5965                 inlen = 0;
5966         else
5967                 memset(retv, 0, inlen);
5968
5969         switch (netdev->priv.ipvlan_attr.mode) {
5970         case IPVLAN_MODE_L3:
5971                 mode = "l3";
5972                 break;
5973         case IPVLAN_MODE_L3S:
5974                 mode = "l3s";
5975                 break;
5976         case IPVLAN_MODE_L2:
5977                 mode = "l2";
5978                 break;
5979         default:
5980                 mode = "(invalid)";
5981                 break;
5982         }
5983
5984         strprint(retv, inlen, "%s", mode);
5985
5986         return fulllen;
5987 }
5988
5989 static int get_config_net_ipvlan_isolation(const char *key, char *retv, int inlen,
5990                                        struct lxc_conf *c, void *data)
5991 {
5992         int fulllen = 0;
5993         struct lxc_netdev *netdev = data;
5994         int len;
5995         const char *mode;
5996
5997         if (!netdev)
5998                 return ret_errno(EINVAL);
5999
6000         if (netdev->type != LXC_NET_IPVLAN)
6001                 return ret_errno(EINVAL);
6002
6003         if (!retv)
6004                 inlen = 0;
6005         else
6006                 memset(retv, 0, inlen);
6007
6008         switch (netdev->priv.ipvlan_attr.isolation) {
6009         case IPVLAN_ISOLATION_BRIDGE:
6010                 mode = "bridge";
6011                 break;
6012         case IPVLAN_ISOLATION_PRIVATE:
6013                 mode = "private";
6014                 break;
6015         case IPVLAN_ISOLATION_VEPA:
6016                 mode = "vepa";
6017                 break;
6018         default:
6019                 mode = "(invalid)";
6020                 break;
6021         }
6022
6023         strprint(retv, inlen, "%s", mode);
6024
6025         return fulllen;
6026 }
6027
6028 static int get_config_net_veth_mode(const char *key, char *retv, int inlen,
6029                                     struct lxc_conf *c, void *data)
6030 {
6031         int fulllen = 0;
6032         struct lxc_netdev *netdev = data;
6033         int len;
6034         const char *mode;
6035
6036         if (!netdev)
6037                 return ret_errno(EINVAL);
6038
6039         if (netdev->type != LXC_NET_VETH)
6040                 return ret_errno(EINVAL);
6041
6042         if (!retv)
6043                 inlen = 0;
6044         else
6045                 memset(retv, 0, inlen);
6046
6047         switch (netdev->priv.veth_attr.mode) {
6048         case VETH_MODE_BRIDGE:
6049                 mode = "bridge";
6050                 break;
6051         case VETH_MODE_ROUTER:
6052                 mode = "router";
6053                 break;
6054         default:
6055                 mode = "(invalid)";
6056                 break;
6057         }
6058
6059         strprint(retv, inlen, "%s", mode);
6060
6061         return fulllen;
6062 }
6063
6064 static int get_config_net_veth_pair(const char *key, char *retv, int inlen,
6065                                     struct lxc_conf *c, void *data)
6066 {
6067         int len;
6068         int fulllen = 0;
6069         struct lxc_netdev *netdev = data;
6070
6071         if (!netdev)
6072                 return ret_errno(EINVAL);
6073
6074         if (netdev->type != LXC_NET_VETH)
6075                 return ret_errno(EINVAL);
6076
6077         if (!retv)
6078                 inlen = 0;
6079         else
6080                 memset(retv, 0, inlen);
6081
6082         strprint(retv, inlen, "%s",
6083                  netdev->priv.veth_attr.pair[0] != '\0'
6084                      ? netdev->priv.veth_attr.pair
6085                      : netdev->priv.veth_attr.veth1);
6086
6087         return fulllen;
6088 }
6089
6090 static int get_config_net_veth_vlan_id(const char *key, char *retv, int inlen,
6091                                        struct lxc_conf *c, void *data)
6092 {
6093         int len;
6094         int fulllen = 0;
6095         struct lxc_netdev *netdev = data;
6096
6097         if (!netdev)
6098                 return ret_errno(EINVAL);
6099
6100         if (netdev->type != LXC_NET_VETH)
6101                 return ret_errno(EINVAL);
6102
6103         if (!retv)
6104                 inlen = 0;
6105         else
6106                 memset(retv, 0, inlen);
6107
6108         strprint(retv, inlen, "%d", netdev->priv.veth_attr.vlan_id);
6109
6110         return fulllen;
6111 }
6112
6113 static int get_config_net_veth_vlan_tagged_id(const char *key, char *retv,
6114                                               int inlen, struct lxc_conf *c,
6115                                               void *data)
6116 {
6117         int len;
6118         size_t listlen;
6119         struct lxc_list *it;
6120         int fulllen = 0;
6121         struct lxc_netdev *netdev = data;
6122
6123         if (!netdev)
6124                 return ret_errno(EINVAL);
6125
6126         if (netdev->type != LXC_NET_VETH)
6127                 return ret_errno(EINVAL);
6128
6129         if (!retv)
6130                 inlen = 0;
6131         else
6132                 memset(retv, 0, inlen);
6133
6134         listlen = lxc_list_len(&netdev->priv.veth_attr.vlan_tagged_ids);
6135
6136         lxc_list_for_each(it, &netdev->priv.veth_attr.vlan_tagged_ids) {
6137                 unsigned short i = PTR_TO_USHORT(it->elem);
6138                 strprint(retv, inlen, "%u%s", i, (listlen-- > 1) ? "\n" : "");
6139         }
6140
6141         return fulllen;
6142 }
6143
6144 static int get_config_net_script_up(const char *key, char *retv, int inlen,
6145                                     struct lxc_conf *c, void *data)
6146 {
6147         int len;
6148         int fulllen = 0;
6149         struct lxc_netdev *netdev = data;
6150
6151         if (!netdev)
6152                 return ret_errno(EINVAL);
6153
6154         if (!retv)
6155                 inlen = 0;
6156         else
6157                 memset(retv, 0, inlen);
6158
6159         if (netdev->upscript)
6160                 strprint(retv, inlen, "%s", netdev->upscript);
6161
6162         return fulllen;
6163 }
6164
6165 static int get_config_net_script_down(const char *key, char *retv, int inlen,
6166                                       struct lxc_conf *c, void *data)
6167 {
6168         int len;
6169         int fulllen = 0;
6170         struct lxc_netdev *netdev = data;
6171
6172         if (!netdev)
6173                 return ret_errno(EINVAL);
6174
6175         if (!retv)
6176                 inlen = 0;
6177         else
6178                 memset(retv, 0, inlen);
6179
6180         if (netdev->downscript)
6181                 strprint(retv, inlen, "%s", netdev->downscript);
6182
6183         return fulllen;
6184 }
6185
6186 static int get_config_net_hwaddr(const char *key, char *retv, int inlen,
6187                                  struct lxc_conf *c, void *data)
6188 {
6189         int len;
6190         int fulllen = 0;
6191         struct lxc_netdev *netdev = data;
6192
6193         if (!netdev)
6194                 return ret_errno(EINVAL);
6195
6196         if (!retv)
6197                 inlen = 0;
6198         else
6199                 memset(retv, 0, inlen);
6200
6201         if (netdev->hwaddr)
6202                 strprint(retv, inlen, "%s", netdev->hwaddr);
6203
6204         return fulllen;
6205 }
6206
6207 static int get_config_net_mtu(const char *key, char *retv, int inlen,
6208                               struct lxc_conf *c, void *data)
6209 {
6210         int len;
6211         int fulllen = 0;
6212         struct lxc_netdev *netdev = data;
6213
6214         if (!netdev)
6215                 return ret_errno(EINVAL);
6216
6217         if (!retv)
6218                 inlen = 0;
6219         else
6220                 memset(retv, 0, inlen);
6221
6222         if (netdev->mtu)
6223                 strprint(retv, inlen, "%s", netdev->mtu);
6224
6225         return fulllen;
6226 }
6227
6228 static int get_config_net_vlan_id(const char *key, char *retv, int inlen,
6229                                   struct lxc_conf *c, void *data)
6230 {
6231         int len;
6232         int fulllen = 0;
6233         struct lxc_netdev *netdev = data;
6234
6235         if (!netdev)
6236                 return ret_errno(EINVAL);
6237
6238         if (netdev->type != LXC_NET_VLAN)
6239                 return ret_errno(EINVAL);
6240
6241         if (!retv)
6242                 inlen = 0;
6243         else
6244                 memset(retv, 0, inlen);
6245
6246         strprint(retv, inlen, "%d", netdev->priv.vlan_attr.vid);
6247
6248         return fulllen;
6249 }
6250
6251 static int get_config_net_ipv4_gateway(const char *key, char *retv, int inlen,
6252                                        struct lxc_conf *c, void *data)
6253 {
6254         int len;
6255         char buf[INET_ADDRSTRLEN];
6256         int fulllen = 0;
6257         struct lxc_netdev *netdev = data;
6258
6259         if (!netdev)
6260                 return ret_errno(EINVAL);
6261
6262         if (!retv)
6263                 inlen = 0;
6264         else
6265                 memset(retv, 0, inlen);
6266
6267         if (netdev->ipv4_gateway_auto) {
6268                 strprint(retv, inlen, "auto");
6269         } else if (netdev->ipv4_gateway_dev) {
6270                 strprint(retv, inlen, "dev");
6271         } else if (netdev->ipv4_gateway) {
6272                 if (!inet_ntop(AF_INET, netdev->ipv4_gateway, buf, sizeof(buf)))
6273                         return -errno;
6274                 strprint(retv, inlen, "%s", buf);
6275         }
6276
6277         return fulllen;
6278 }
6279
6280 static int get_config_net_ipv4_address(const char *key, char *retv, int inlen,
6281                                        struct lxc_conf *c, void *data)
6282 {
6283         int fulllen = 0;
6284         struct lxc_netdev *netdev = data;
6285         int len;
6286         size_t listlen;
6287         char buf[INET_ADDRSTRLEN];
6288         struct lxc_inetdev *inetdev;
6289
6290         if (!netdev)
6291                 return ret_errno(EINVAL);
6292
6293         if (!retv)
6294                 inlen = 0;
6295         else
6296                 memset(retv, 0, inlen);
6297
6298         listlen = list_len(inetdev, &netdev->ipv4_addresses, head);
6299
6300         list_for_each_entry(inetdev, &netdev->ipv4_addresses, head) {
6301                 if (!inet_ntop(AF_INET, &inetdev->addr, buf, sizeof(buf)))
6302                         return -errno;
6303                 strprint(retv, inlen, "%s/%u%s", buf, inetdev->prefix,
6304                          (listlen-- > 1) ? "\n" : "");
6305         }
6306
6307         return fulllen;
6308 }
6309
6310 static int get_config_net_veth_ipv4_route(const char *key, char *retv, int inlen,
6311                                           struct lxc_conf *c, void *data)
6312 {
6313         int len;
6314         size_t listlen;
6315         char buf[INET_ADDRSTRLEN];
6316         struct lxc_inetdev *inetdev;
6317         int fulllen = 0;
6318         struct lxc_netdev *netdev = data;
6319
6320         if (!netdev)
6321                 return ret_errno(EINVAL);
6322
6323         if (netdev->type != LXC_NET_VETH)
6324                 return ret_errno(EINVAL);
6325
6326         if (!retv)
6327                 inlen = 0;
6328         else
6329                 memset(retv, 0, inlen);
6330
6331         listlen = list_len(inetdev, &netdev->priv.veth_attr.ipv4_routes, head);
6332         list_for_each_entry(inetdev, &netdev->priv.veth_attr.ipv4_routes, head) {
6333                 if (!inet_ntop(AF_INET, &inetdev->addr, buf, sizeof(buf)))
6334                         return -errno;
6335                 strprint(retv, inlen, "%s/%u%s", buf, inetdev->prefix,
6336                          (listlen-- > 1) ? "\n" : "");
6337         }
6338
6339         return fulllen;
6340 }
6341
6342 static int get_config_net_ipv6_gateway(const char *key, char *retv, int inlen,
6343                                        struct lxc_conf *c, void *data)
6344 {
6345         int len;
6346         char buf[INET6_ADDRSTRLEN];
6347         int fulllen = 0;
6348         struct lxc_netdev *netdev = data;
6349
6350         if (!netdev)
6351                 return ret_errno(EINVAL);
6352
6353         if (!retv)
6354                 inlen = 0;
6355         else
6356                 memset(retv, 0, inlen);
6357
6358         if (netdev->ipv6_gateway_auto) {
6359                 strprint(retv, inlen, "auto");
6360         } else if (netdev->ipv6_gateway_dev) {
6361                 strprint(retv, inlen, "dev");
6362         } else if (netdev->ipv6_gateway) {
6363                 if (!inet_ntop(AF_INET6, netdev->ipv6_gateway, buf, sizeof(buf)))
6364                         return -errno;
6365                 strprint(retv, inlen, "%s", buf);
6366         }
6367
6368         return fulllen;
6369 }
6370
6371 static int get_config_net_ipv6_address(const char *key, char *retv, int inlen,
6372                                        struct lxc_conf *c, void *data)
6373 {
6374         int len;
6375         size_t listlen;
6376         char buf[INET6_ADDRSTRLEN];
6377         int fulllen = 0;
6378         struct lxc_netdev *netdev = data;
6379         struct lxc_inet6dev *inet6dev;
6380
6381         if (!netdev)
6382                 return ret_errno(EINVAL);
6383
6384         if (!retv)
6385                 inlen = 0;
6386         else
6387                 memset(retv, 0, inlen);
6388
6389         listlen = list_len(inet6dev, &netdev->ipv6_addresses, head);
6390         list_for_each_entry(inet6dev, &netdev->ipv6_addresses, head) {
6391                 if (!inet_ntop(AF_INET6, &inet6dev->addr, buf, sizeof(buf)))
6392                         return -errno;
6393                 strprint(retv, inlen, "%s/%u%s", buf, inet6dev->prefix,
6394                          (listlen-- > 1) ? "\n" : "");
6395         }
6396
6397         return fulllen;
6398 }
6399
6400 static int get_config_net_veth_ipv6_route(const char *key, char *retv, int inlen,
6401                                           struct lxc_conf *c, void *data)
6402 {
6403         int len;
6404         size_t listlen;
6405         char buf[INET6_ADDRSTRLEN];
6406         struct lxc_inet6dev *inet6dev;
6407         int fulllen = 0;
6408         struct lxc_netdev *netdev = data;
6409
6410         if (!netdev)
6411                 return ret_errno(EINVAL);
6412
6413         if (netdev->type != LXC_NET_VETH)
6414                 return ret_errno(EINVAL);
6415
6416         if (!retv)
6417                 inlen = 0;
6418         else
6419                 memset(retv, 0, inlen);
6420
6421         listlen = list_len(inet6dev, &netdev->priv.veth_attr.ipv6_routes, head);
6422         list_for_each_entry(inet6dev, &netdev->priv.veth_attr.ipv6_routes, head) {
6423                 if (!inet_ntop(AF_INET6, &inet6dev->addr, buf, sizeof(buf)))
6424                         return -errno;
6425                 strprint(retv, inlen, "%s/%u%s", buf, inet6dev->prefix,
6426                          (listlen-- > 1) ? "\n" : "");
6427         }
6428
6429         return fulllen;
6430 }
6431
6432 int lxc_list_config_items(char *retv, int inlen)
6433 {
6434         size_t i;
6435         int len;
6436         int fulllen = 0;
6437
6438         if (!retv)
6439                 inlen = 0;
6440         else
6441                 memset(retv, 0, inlen);
6442
6443         for (i = 0; i < ARRAY_SIZE(config_jump_table); i++) {
6444                 char *s = config_jump_table[i].name;
6445
6446                 if (s[strlen(s) - 1] == '.')
6447                         continue;
6448
6449                 strprint(retv, inlen, "%s\n", s);
6450         }
6451
6452         return fulllen;
6453 }
6454
6455 int lxc_list_subkeys(struct lxc_conf *conf, const char *key, char *retv,
6456                      int inlen)
6457 {
6458         int len;
6459         int fulllen = 0;
6460
6461         if (!retv)
6462                 inlen = 0;
6463         else
6464                 memset(retv, 0, inlen);
6465
6466         if (strequal(key, "lxc.apparmor")) {
6467                 strprint(retv, inlen, "allow_incomplete\n");
6468                 strprint(retv, inlen, "allow_nesting\n");
6469                 strprint(retv, inlen, "profile\n");
6470                 strprint(retv, inlen, "raw\n");
6471         } else if (strequal(key, "lxc.cgroup")) {
6472                 strprint(retv, inlen, "dir\n");
6473         } else if (strequal(key, "lxc.selinux")) {
6474                 strprint(retv, inlen, "context\n");
6475                 strprint(retv, inlen, "context.keyring\n");
6476         } else if (strequal(key, "lxc.mount")) {
6477                 strprint(retv, inlen, "auto\n");
6478                 strprint(retv, inlen, "entry\n");
6479                 strprint(retv, inlen, "fstab\n");
6480         } else if (strequal(key, "lxc.rootfs")) {
6481                 strprint(retv, inlen, "mount\n");
6482                 strprint(retv, inlen, "options\n");
6483                 strprint(retv, inlen, "path\n");
6484         } else if (strequal(key, "lxc.uts")) {
6485                 strprint(retv, inlen, "name\n");
6486         } else if (strequal(key, "lxc.hook")) {
6487                 strprint(retv, inlen, "autodev\n");
6488                 strprint(retv, inlen, "autodevtmpfssize\n");
6489                 strprint(retv, inlen, "clone\n");
6490                 strprint(retv, inlen, "destroy\n");
6491                 strprint(retv, inlen, "mount\n");
6492                 strprint(retv, inlen, "post-stop\n");
6493                 strprint(retv, inlen, "pre-mount\n");
6494                 strprint(retv, inlen, "pre-start\n");
6495                 strprint(retv, inlen, "start-host\n");
6496                 strprint(retv, inlen, "start\n");
6497                 strprint(retv, inlen, "stop\n");
6498         } else if (strequal(key, "lxc.cap")) {
6499                 strprint(retv, inlen, "drop\n");
6500                 strprint(retv, inlen, "keep\n");
6501         } else if (strequal(key, "lxc.console")) {
6502                 strprint(retv, inlen, "logfile\n");
6503                 strprint(retv, inlen, "path\n");
6504         } else if (strequal(key, "lxc.seccomp")) {
6505                 strprint(retv, inlen, "profile\n");
6506         } else if (strequal(key, "lxc.signal")) {
6507                 strprint(retv, inlen, "halt\n");
6508                 strprint(retv, inlen, "reboot\n");
6509                 strprint(retv, inlen, "stop\n");
6510         } else if (strequal(key, "lxc.start")) {
6511                 strprint(retv, inlen, "auto\n");
6512                 strprint(retv, inlen, "delay\n");
6513                 strprint(retv, inlen, "order\n");
6514         } else if (strequal(key, "lxc.monitor")) {
6515                 strprint(retv, inlen, "unshare\n");
6516         } else if (strequal(key, "lxc.keyring")) {
6517                 strprint(retv, inlen, "session\n");
6518         } else {
6519                 fulllen = ret_errno(EINVAL);
6520         }
6521
6522         return fulllen;
6523 }
6524
6525 int lxc_list_net(struct lxc_conf *c, const char *key, char *retv, int inlen)
6526 {
6527         struct config_net_info info = {};
6528         struct lxc_netdev *netdev;
6529         int len, ret;
6530         const char *idxstring;
6531         int fulllen = 0;
6532
6533         idxstring = key + STRLITERALLEN("lxc.net.");
6534         if (!isdigit(*idxstring))
6535                 return ret_errno(EINVAL);
6536
6537         ret = get_network_config_ops(key, c, &info, false);
6538         if (ret) {
6539                 if (ret != -ENOENT)
6540                         return ret_errno(EINVAL);
6541         }
6542         netdev = info.netdev;
6543
6544         if (!retv)
6545                 inlen = 0;
6546         else
6547                 memset(retv, 0, inlen);
6548
6549         strprint(retv, inlen, "type\n");
6550         strprint(retv, inlen, "script.up\n");
6551         strprint(retv, inlen, "script.down\n");
6552
6553         if (netdev->type != LXC_NET_EMPTY) {
6554                 strprint(retv, inlen, "flags\n");
6555                 strprint(retv, inlen, "link\n");
6556                 strprint(retv, inlen, "name\n");
6557                 strprint(retv, inlen, "hwaddr\n");
6558                 strprint(retv, inlen, "mtu\n");
6559                 strprint(retv, inlen, "ipv6.address\n");
6560                 strprint(retv, inlen, "ipv6.gateway\n");
6561                 strprint(retv, inlen, "ipv4.address\n");
6562                 strprint(retv, inlen, "ipv4.gateway\n");
6563         }
6564
6565         switch (netdev->type) {
6566         case LXC_NET_VETH:
6567                 strprint(retv, inlen, "veth.pair\n");
6568                 strprint(retv, inlen, "veth.ipv4.route\n");
6569                 strprint(retv, inlen, "veth.ipv6.route\n");
6570                 strprint(retv, inlen, "veth.vlan.id\n");
6571                 break;
6572         case LXC_NET_MACVLAN:
6573                 strprint(retv, inlen, "macvlan.mode\n");
6574                 break;
6575         case LXC_NET_IPVLAN:
6576                 strprint(retv, inlen, "ipvlan.mode\n");
6577                 strprint(retv, inlen, "ipvlan.isolation\n");
6578                 break;
6579         case LXC_NET_VLAN:
6580                 strprint(retv, inlen, "vlan.id\n");
6581                 break;
6582         case LXC_NET_PHYS:
6583                 break;
6584         }
6585
6586         return fulllen;
6587 }
6588
6589 static int set_config_sched_core(const char *key, const char *value,
6590                                  struct lxc_conf *lxc_conf, void *data)
6591 {
6592         int ret;
6593         unsigned int nr;
6594
6595         if (lxc_config_value_empty(value))
6596                 return clr_config_sched_core(key, lxc_conf, data);
6597
6598         ret = lxc_safe_uint(value, &nr);
6599         if (ret)
6600                 return ret_errno(EINVAL);
6601
6602         if (nr != 0 && nr != 1)
6603                 return ret_errno(EINVAL);
6604
6605         lxc_conf->sched_core = (nr == 1);
6606         return 0;
6607 }
6608
6609 static int get_config_sched_core(const char *key, char *retv, int inlen,
6610                                  struct lxc_conf *c, void *data)
6611 {
6612         return lxc_get_conf_bool(c, retv, inlen, c->sched_core);
6613 }
6614
6615 static int clr_config_sched_core(const char *key, struct lxc_conf *c, void *data)
6616 {
6617         c->sched_core = false;
6618         return 0;
6619 }