src/lxc/confile.c

   1 /* SPDX-License-Identifier: LGPL-2.1+ */
   2
   3 #ifndef _GNU_SOURCE
   4 #define _GNU_SOURCE 1
   5 #endif
   6 #define __STDC_FORMAT_MACROS
   7 #include <arpa/inet.h>
   8 #include <ctype.h>
   9 #include <dirent.h>
  10 #include <errno.h>
  11 #include <fcntl.h>
  12 #include <inttypes.h>
  13 #include <net/if.h>
  14 #include <netinet/in.h>
  15 #include <signal.h>
  16 #include <stdio.h>
  17 #include <stdlib.h>
  18 #include <string.h>
  19 #include <sys/param.h>
  20 #include <sys/stat.h>
  21 #include <sys/types.h>
  22 #include <sys/utsname.h>
  23 #include <syslog.h>
  24 #include <time.h>
  25 #include <unistd.h>
  26
  27 #include "af_unix.h"
  28 #include "conf.h"
  29 #include "config.h"
  30 #include "confile.h"
  31 #include "confile_utils.h"
  32 #include "../include/netns_ifaddrs.h"
  33 #include "log.h"
  34 #include "lxcseccomp.h"
  35 #include "macro.h"
  36 #include "memory_utils.h"
  37 #include "network.h"
  38 #include "parse.h"
  39 #include "storage/storage.h"
  40 #include "utils.h"
  41
  42 #ifndef HAVE_STRLCPY
  43 #include "include/strlcpy.h"
  44 #endif
  45
  46 #ifndef HAVE_STRLCAT
  47 #include "include/strlcat.h"
  48 #endif
  49
  50 lxc_log_define(confile, lxc);
  51
  52 #define lxc_config_define(name)                                             \
  53         __hot static int set_config_##name(const char *, const char *,      \
  54                                            struct lxc_conf *, void *);      \
  55         __hot static int get_config_##name(const char *, char *, int,       \
  56                                            struct lxc_conf *, void *);      \
  57         __hot static int clr_config_##name(const char *, struct lxc_conf *, \
  58                                            void *);
  59
  60 lxc_config_define(autodev);
  61 lxc_config_define(autodev_tmpfs_size);
  62 lxc_config_define(apparmor_allow_incomplete);
  63 lxc_config_define(apparmor_allow_nesting);
  64 lxc_config_define(apparmor_profile);
  65 lxc_config_define(apparmor_raw);
  66 lxc_config_define(cap_drop);
  67 lxc_config_define(cap_keep);
  68 lxc_config_define(cgroup_controller);
  69 lxc_config_define(cgroup2_controller);
  70 lxc_config_define(cgroup_dir);
  71 lxc_config_define(cgroup_monitor_dir);
  72 lxc_config_define(cgroup_monitor_pivot_dir);
  73 lxc_config_define(cgroup_container_dir);
  74 lxc_config_define(cgroup_container_inner_dir);
  75 lxc_config_define(cgroup_relative);
  76 lxc_config_define(console_buffer_size);
  77 lxc_config_define(console_logfile);
  78 lxc_config_define(console_path);
  79 lxc_config_define(console_rotate);
  80 lxc_config_define(console_size);
  81 lxc_config_define(unsupported_key);
  82 lxc_config_define(environment);
  83 lxc_config_define(ephemeral);
  84 lxc_config_define(execute_cmd);
  85 lxc_config_define(group);
  86 lxc_config_define(hooks);
  87 lxc_config_define(hooks_version);
  88 lxc_config_define(idmaps);
  89 lxc_config_define(includefiles);
  90 lxc_config_define(init_cmd);
  91 lxc_config_define(init_cwd);
  92 lxc_config_define(init_gid);
  93 lxc_config_define(init_uid);
  94 lxc_config_define(init_groups);
  95 lxc_config_define(jump_table_net);
  96 lxc_config_define(keyring_session);
  97 lxc_config_define(log_file);
  98 lxc_config_define(log_level);
  99 lxc_config_define(log_syslog);
 100 lxc_config_define(monitor);
 101 lxc_config_define(monitor_signal_pdeath);
 102 lxc_config_define(mount);
 103 lxc_config_define(mount_auto);
 104 lxc_config_define(mount_fstab);
 105 lxc_config_define(namespace_clone);
 106 lxc_config_define(namespace_keep);
 107 lxc_config_define(time_offset_boot);
 108 lxc_config_define(time_offset_monotonic);
 109 lxc_config_define(namespace_share);
 110 lxc_config_define(net);
 111 lxc_config_define(net_flags);
 112 lxc_config_define(net_hwaddr);
 113 lxc_config_define(net_ipv4_address);
 114 lxc_config_define(net_ipv4_gateway);
 115 lxc_config_define(net_ipv6_address);
 116 lxc_config_define(net_ipv6_gateway);
 117 lxc_config_define(net_link);
 118 lxc_config_define(net_l2proxy);
 119 lxc_config_define(net_macvlan_mode);
 120 lxc_config_define(net_ipvlan_mode);
 121 lxc_config_define(net_ipvlan_isolation);
 122 lxc_config_define(net_mtu);
 123 lxc_config_define(net_name);
 124 lxc_config_define(net_script_down);
 125 lxc_config_define(net_script_up);
 126 lxc_config_define(net_type);
 127 lxc_config_define(net_veth_mode);
 128 lxc_config_define(net_veth_pair);
 129 lxc_config_define(net_veth_ipv4_route);
 130 lxc_config_define(net_veth_ipv6_route);
 131 lxc_config_define(net_veth_vlan_id);
 132 lxc_config_define(net_veth_vlan_tagged_id);
 133 lxc_config_define(net_vlan_id);
 134 lxc_config_define(no_new_privs);
 135 lxc_config_define(personality);
 136 lxc_config_define(prlimit);
 137 lxc_config_define(pty_max);
 138 lxc_config_define(rootfs_managed);
 139 lxc_config_define(rootfs_mount);
 140 lxc_config_define(rootfs_options);
 141 lxc_config_define(rootfs_path);
 142 lxc_config_define(seccomp_profile);
 143 lxc_config_define(seccomp_allow_nesting);
 144 lxc_config_define(seccomp_notify_cookie);
 145 lxc_config_define(seccomp_notify_proxy);
 146 lxc_config_define(selinux_context);
 147 lxc_config_define(selinux_context_keyring);
 148 lxc_config_define(signal_halt);
 149 lxc_config_define(signal_reboot);
 150 lxc_config_define(signal_stop);
 151 lxc_config_define(start);
 152 lxc_config_define(tty_max);
 153 lxc_config_define(tty_dir);
 154 lxc_config_define(uts_name);
 155 lxc_config_define(sysctl);
 156 lxc_config_define(proc);
 157
 158 static int set_config_unsupported_key(const char *key, const char *value,
 159                                       struct lxc_conf *lxc_conf, void *data)
 160 {
 161         return syserror_set(-EINVAL, "Unsupported config key \"%s\"", key);
 162 }
 163
 164 static int get_config_unsupported_key(const char *key, char *retv, int inlen,
 165                                       struct lxc_conf *c, void *data)
 166 {
 167         return syserror_set(-EINVAL, "Unsupported config key \"%s\"", key);
 168 }
 169
 170 static int clr_config_unsupported_key(const char *key,
 171                                       struct lxc_conf *lxc_conf, void *data)
 172 {
 173         return syserror_set(-EINVAL, "Unsupported config key \"%s\"", key);
 174 }
 175
 176 /*
 177  * Important Note:
 178  * If a new config option is added to this table, be aware that
 179  * the order in which the options are places into the table matters.
 180  * That means that more specific options of a namespace have to be
 181  * placed above more generic ones.
 182  *
 183  * For instance: If lxc.ab is placed before lxc.ab.c, the config option
 184  * lxc.ab.c will always be matched to lxc.ab. That is, the lxc.ab.c option
 185  * has to be placed above lxc.ab.
 186  */
 187 static struct lxc_config_t config_jump_table[] = {
 188         { "lxc.arch",                       true,  set_config_personality,                get_config_personality,                clr_config_personality,                },
 189         { "lxc.apparmor.profile",           true,  set_config_apparmor_profile,           get_config_apparmor_profile,           clr_config_apparmor_profile,           },
 190         { "lxc.apparmor.allow_incomplete",  true,  set_config_apparmor_allow_incomplete,  get_config_apparmor_allow_incomplete,  clr_config_apparmor_allow_incomplete,  },
 191         { "lxc.apparmor.allow_nesting",     true,  set_config_apparmor_allow_nesting,     get_config_apparmor_allow_nesting,     clr_config_apparmor_allow_nesting,     },
 192         { "lxc.apparmor.raw",               true,  set_config_apparmor_raw,               get_config_apparmor_raw,               clr_config_apparmor_raw,               },
 193         { "lxc.autodev.tmpfs.size",         true,  set_config_autodev_tmpfs_size,         get_config_autodev_tmpfs_size,         clr_config_autodev_tmpfs_size,         },
 194         { "lxc.autodev",                    true,  set_config_autodev,                    get_config_autodev,                    clr_config_autodev,                    },
 195         { "lxc.cap.drop",                   true,  set_config_cap_drop,                   get_config_cap_drop,                   clr_config_cap_drop,                   },
 196         { "lxc.cap.keep",                   true,  set_config_cap_keep,                   get_config_cap_keep,                   clr_config_cap_keep,                   },
 197         { "lxc.cgroup2",                    false, set_config_cgroup2_controller,         get_config_cgroup2_controller,         clr_config_cgroup2_controller,         },
 198         { "lxc.cgroup.dir.monitor.pivot",   true,  set_config_cgroup_monitor_pivot_dir,   get_config_cgroup_monitor_pivot_dir,   clr_config_cgroup_monitor_pivot_dir,   },
 199         { "lxc.cgroup.dir.monitor",         true,  set_config_cgroup_monitor_dir,         get_config_cgroup_monitor_dir,         clr_config_cgroup_monitor_dir,         },
 200         { "lxc.cgroup.dir.container.inner", true,  set_config_cgroup_container_inner_dir, get_config_cgroup_container_inner_dir, clr_config_cgroup_container_inner_dir, },
 201         { "lxc.cgroup.dir.container",       true,  set_config_cgroup_container_dir,       get_config_cgroup_container_dir,       clr_config_cgroup_container_dir,       },
 202         { "lxc.cgroup.dir",                 true,  set_config_cgroup_dir,                 get_config_cgroup_dir,                 clr_config_cgroup_dir,                 },
 203         { "lxc.cgroup.relative",            true,  set_config_cgroup_relative,            get_config_cgroup_relative,            clr_config_cgroup_relative,            },
 204         { "lxc.cgroup",                     false, set_config_cgroup_controller,          get_config_cgroup_controller,          clr_config_cgroup_controller,          },
 205         { "lxc.console.buffer.size",        true,  set_config_console_buffer_size,        get_config_console_buffer_size,        clr_config_console_buffer_size,        },
 206         { "lxc.console.logfile",            true,  set_config_console_logfile,            get_config_console_logfile,            clr_config_console_logfile,            },
 207         { "lxc.console.path",               true,  set_config_console_path,               get_config_console_path,               clr_config_console_path,               },
 208         { "lxc.console.rotate",             true,  set_config_console_rotate,             get_config_console_rotate,             clr_config_console_rotate,             },
 209         { "lxc.console.size",               true,  set_config_console_size,               get_config_console_size,               clr_config_console_size,               },
 210         { "lxc.environment",                true,  set_config_environment,                get_config_environment,                clr_config_environment,                },
 211         { "lxc.ephemeral",                  true,  set_config_ephemeral,                  get_config_ephemeral,                  clr_config_ephemeral,                  },
 212         { "lxc.execute.cmd",                true,  set_config_execute_cmd,                get_config_execute_cmd,                clr_config_execute_cmd,                },
 213         { "lxc.group",                      true,  set_config_group,                      get_config_group,                      clr_config_group,                      },
 214         { "lxc.hook.autodev",               true,  set_config_hooks,                      get_config_hooks,                      clr_config_hooks,                      },
 215         { "lxc.hook.clone",                 true,  set_config_hooks,                      get_config_hooks,                      clr_config_hooks,                      },
 216         { "lxc.hook.destroy",               true,  set_config_hooks,                      get_config_hooks,                      clr_config_hooks,                      },
 217         { "lxc.hook.mount",                 true,  set_config_hooks,                      get_config_hooks,                      clr_config_hooks,                      },
 218         { "lxc.hook.post-stop",             true,  set_config_hooks,                      get_config_hooks,                      clr_config_hooks,                      },
 219         { "lxc.hook.pre-mount",             true,  set_config_hooks,                      get_config_hooks,                      clr_config_hooks,                      },
 220         { "lxc.hook.pre-start",             true,  set_config_hooks,                      get_config_hooks,                      clr_config_hooks,                      },
 221         { "lxc.hook.start",                 true,  set_config_hooks,                      get_config_hooks,                      clr_config_hooks,                      },
 222         { "lxc.hook.start-host",            true,  set_config_hooks,                      get_config_hooks,                      clr_config_hooks,                      },
 223         { "lxc.hook.stop",                  true,  set_config_hooks,                      get_config_hooks,                      clr_config_hooks,                      },
 224         { "lxc.hook.version",               true,  set_config_hooks_version,              get_config_hooks_version,              clr_config_hooks_version,              },
 225         { "lxc.hook",                       true,  set_config_hooks,                      get_config_hooks,                      clr_config_hooks,                      },
 226         { "lxc.idmap",                      true,  set_config_idmaps,                     get_config_idmaps,                     clr_config_idmaps,                     },
 227         { "lxc.include",                    true,  set_config_includefiles,               get_config_includefiles,               clr_config_includefiles,               },
 228         { "lxc.init.cmd",                   true,  set_config_init_cmd,                   get_config_init_cmd,                   clr_config_init_cmd,                   },
 229         { "lxc.init.gid",                   true,  set_config_init_gid,                   get_config_init_gid,                   clr_config_init_gid,                   },
 230         { "lxc.init.groups",                true,  set_config_init_groups,                get_config_init_groups,                clr_config_init_groups,                },
 231         { "lxc.init.uid",                   true,  set_config_init_uid,                   get_config_init_uid,                   clr_config_init_uid,                   },
 232         { "lxc.init.cwd",                   true,  set_config_init_cwd,                   get_config_init_cwd,                   clr_config_init_cwd,                   },
 233         { "lxc.keyring.session",            true,  set_config_keyring_session,            get_config_keyring_session,            clr_config_keyring_session             },
 234         { "lxc.log.file",                   true,  set_config_log_file,                   get_config_log_file,                   clr_config_log_file,                   },
 235         { "lxc.log.level",                  true,  set_config_log_level,                  get_config_log_level,                  clr_config_log_level,                  },
 236         { "lxc.log.syslog",                 true,  set_config_log_syslog,                 get_config_log_syslog,                 clr_config_log_syslog,                 },
 237         { "lxc.monitor.unshare",            true,  set_config_monitor,                    get_config_monitor,                    clr_config_monitor,                    },
 238         { "lxc.monitor.signal.pdeath",      true,  set_config_monitor_signal_pdeath,      get_config_monitor_signal_pdeath,      clr_config_monitor_signal_pdeath,      },
 239         { "lxc.mount.auto",                 true,  set_config_mount_auto,                 get_config_mount_auto,                 clr_config_mount_auto,                 },
 240         { "lxc.mount.entry",                true,  set_config_mount,                      get_config_mount,                      clr_config_mount,                      },
 241         { "lxc.mount.fstab",                true,  set_config_mount_fstab,                get_config_mount_fstab,                clr_config_mount_fstab,                },
 242         { "lxc.namespace.clone",            true,  set_config_namespace_clone,            get_config_namespace_clone,            clr_config_namespace_clone,            },
 243         { "lxc.namespace.keep",             true,  set_config_namespace_keep,             get_config_namespace_keep,             clr_config_namespace_keep,             },
 244         { "lxc.namespace.share.",           false, set_config_namespace_share,            get_config_namespace_share,            clr_config_namespace_share,            },
 245         { "lxc.time.offset.boot",           true,  set_config_time_offset_boot,           get_config_time_offset_boot,           clr_config_time_offset_boot,           },
 246         { "lxc.time.offset.monotonic",      true,  set_config_time_offset_monotonic,      get_config_time_offset_monotonic,      clr_config_time_offset_monotonic,      },
 247         { "lxc.net.",                       false, set_config_jump_table_net,             get_config_jump_table_net,             clr_config_jump_table_net,             },
 248         { "lxc.net",                        true,  set_config_net,                        get_config_net,                        clr_config_net,                        },
 249         { "lxc.no_new_privs",               true,  set_config_no_new_privs,               get_config_no_new_privs,               clr_config_no_new_privs,               },
 250         { "lxc.prlimit",                    false, set_config_prlimit,                    get_config_prlimit,                    clr_config_prlimit,                    },
 251         { "lxc.pty.max",                    true,  set_config_pty_max,                    get_config_pty_max,                    clr_config_pty_max,                    },
 252         { "lxc.rootfs.managed",             true,  set_config_rootfs_managed,             get_config_rootfs_managed,             clr_config_rootfs_managed,             },
 253         { "lxc.rootfs.mount",               true,  set_config_rootfs_mount,               get_config_rootfs_mount,               clr_config_rootfs_mount,               },
 254         { "lxc.rootfs.options",             true,  set_config_rootfs_options,             get_config_rootfs_options,             clr_config_rootfs_options,             },
 255         { "lxc.rootfs.path",                true,  set_config_rootfs_path,                get_config_rootfs_path,                clr_config_rootfs_path,                },
 256         { "lxc.seccomp.allow_nesting",      true,  set_config_seccomp_allow_nesting,      get_config_seccomp_allow_nesting,      clr_config_seccomp_allow_nesting,      },
 257         { "lxc.seccomp.notify.cookie",      true,  set_config_seccomp_notify_cookie,      get_config_seccomp_notify_cookie,      clr_config_seccomp_notify_cookie,      },
 258         { "lxc.seccomp.notify.proxy",       true,  set_config_seccomp_notify_proxy,       get_config_seccomp_notify_proxy,       clr_config_seccomp_notify_proxy,       },
 259         { "lxc.seccomp.profile",            true,  set_config_seccomp_profile,            get_config_seccomp_profile,            clr_config_seccomp_profile,            },
 260         { "lxc.selinux.context.keyring",    true,  set_config_selinux_context_keyring,    get_config_selinux_context_keyring,    clr_config_selinux_context_keyring     },
 261         { "lxc.selinux.context",            true,  set_config_selinux_context,            get_config_selinux_context,            clr_config_selinux_context,            },
 262         { "lxc.signal.halt",                true,  set_config_signal_halt,                get_config_signal_halt,                clr_config_signal_halt,                },
 263         { "lxc.signal.reboot",              true,  set_config_signal_reboot,              get_config_signal_reboot,              clr_config_signal_reboot,              },
 264         { "lxc.signal.stop",                true,  set_config_signal_stop,                get_config_signal_stop,                clr_config_signal_stop,                },
 265         { "lxc.start.auto",                 true,  set_config_start,                      get_config_start,                      clr_config_start,                      },
 266         { "lxc.start.delay",                true,  set_config_start,                      get_config_start,                      clr_config_start,                      },
 267         { "lxc.start.order",                true,  set_config_start,                      get_config_start,                      clr_config_start,                      },
 268         { "lxc.tty.dir",                    true,  set_config_tty_dir,                    get_config_tty_dir,                    clr_config_tty_dir,                    },
 269         { "lxc.tty.max",                    true,  set_config_tty_max,                    get_config_tty_max,                    clr_config_tty_max,                    },
 270         { "lxc.uts.name",                   true,  set_config_uts_name,                   get_config_uts_name,                   clr_config_uts_name,                   },
 271         { "lxc.sysctl",                     false, set_config_sysctl,                     get_config_sysctl,                     clr_config_sysctl,                     },
 272         { "lxc.proc",                       false, set_config_proc,                       get_config_proc,                       clr_config_proc,                       },
 273 };
 274
 275 static struct lxc_config_t unsupported_config_key = {
 276         NULL,
 277         false,
 278         set_config_unsupported_key,
 279         get_config_unsupported_key,
 280         clr_config_unsupported_key,
 281 };
 282
 283 struct lxc_config_net_t {
 284         LXC_CONFIG_MEMBERS;
 285 };
 286
 287 static struct lxc_config_net_t config_jump_table_net[] = {
 288         /* If a longer key is added please update. */
 289         #define NETWORK_SUBKEY_SIZE_MAX (STRLITERALLEN("veth.vlan.tagged.id") * 2)
 290         { "flags",                  true,  set_config_net_flags,                  get_config_net_flags,                  clr_config_net_flags,                  },
 291         { "hwaddr",                 true,  set_config_net_hwaddr,                 get_config_net_hwaddr,                 clr_config_net_hwaddr,                 },
 292         { "ipv4.address",           true,  set_config_net_ipv4_address,           get_config_net_ipv4_address,           clr_config_net_ipv4_address,           },
 293         { "ipv4.gateway",           true,  set_config_net_ipv4_gateway,           get_config_net_ipv4_gateway,           clr_config_net_ipv4_gateway,           },
 294         { "ipv6.address",           true,  set_config_net_ipv6_address,           get_config_net_ipv6_address,           clr_config_net_ipv6_address,           },
 295         { "ipv6.gateway",           true,  set_config_net_ipv6_gateway,           get_config_net_ipv6_gateway,           clr_config_net_ipv6_gateway,           },
 296         { "link",                   true,  set_config_net_link,                   get_config_net_link,                   clr_config_net_link,                   },
 297         { "l2proxy",                true,  set_config_net_l2proxy,                get_config_net_l2proxy,                clr_config_net_l2proxy,                },
 298         { "macvlan.mode",           true,  set_config_net_macvlan_mode,           get_config_net_macvlan_mode,           clr_config_net_macvlan_mode,           },
 299         { "ipvlan.mode",            true,  set_config_net_ipvlan_mode,            get_config_net_ipvlan_mode,            clr_config_net_ipvlan_mode,            },
 300         { "ipvlan.isolation",       true,  set_config_net_ipvlan_isolation,       get_config_net_ipvlan_isolation,       clr_config_net_ipvlan_isolation,       },
 301         { "mtu",                    true,  set_config_net_mtu,                    get_config_net_mtu,                    clr_config_net_mtu,                    },
 302         { "name",                   true,  set_config_net_name,                   get_config_net_name,                   clr_config_net_name,                   },
 303         { "script.down",            true,  set_config_net_script_down,            get_config_net_script_down,            clr_config_net_script_down,            },
 304         { "script.up",              true,  set_config_net_script_up,              get_config_net_script_up,              clr_config_net_script_up,              },
 305         { "type",                   true,  set_config_net_type,                   get_config_net_type,                   clr_config_net_type,                   },
 306         { "vlan.id",                true,  set_config_net_vlan_id,                get_config_net_vlan_id,                clr_config_net_vlan_id,                },
 307         { "veth.mode",              true,  set_config_net_veth_mode,              get_config_net_veth_mode,              clr_config_net_veth_mode,              },
 308         { "veth.pair",              true,  set_config_net_veth_pair,              get_config_net_veth_pair,              clr_config_net_veth_pair,              },
 309         { "veth.ipv4.route",        true,  set_config_net_veth_ipv4_route,        get_config_net_veth_ipv4_route,        clr_config_net_veth_ipv4_route,        },
 310         { "veth.ipv6.route",        true,  set_config_net_veth_ipv6_route,        get_config_net_veth_ipv6_route,        clr_config_net_veth_ipv6_route,        },
 311         { "veth.vlan.id",           true,  set_config_net_veth_vlan_id,           get_config_net_veth_vlan_id,           clr_config_net_veth_vlan_id,           },
 312         { "veth.vlan.tagged.id",    true,  set_config_net_veth_vlan_tagged_id,    get_config_net_veth_vlan_tagged_id,    clr_config_net_veth_vlan_tagged_id,    },
 313 };
 314
 315 static struct lxc_config_net_t unsupported_config_net_key = {
 316         NULL,
 317         false,
 318         set_config_unsupported_key,
 319         get_config_unsupported_key,
 320         clr_config_unsupported_key,
 321 };
 322
 323 struct lxc_config_t *lxc_get_config_exact(const char *key)
 324 {
 325         size_t i;
 326
 327         for (i = 0; i < ARRAY_SIZE(config_jump_table); i++)
 328                 if (strequal(config_jump_table[i].name, key))
 329                         return &config_jump_table[i];
 330
 331         return NULL;
 332 }
 333
 334 /* Assume a reasonable subkey size limit. */
 335 #define LXC_SUBKEY_LEN_MAX 256
 336
 337 static inline int match_config_item(const struct lxc_config_t *entry, const char *key)
 338 {
 339         size_t len;
 340
 341         if (entry->strict)
 342                 return strequal(entry->name, key);
 343
 344         /* There should be no subkey longer than this. */
 345         len = strnlen(entry->name, LXC_SUBKEY_LEN_MAX);
 346         if (len == LXC_SUBKEY_LEN_MAX)
 347                 return error_ret(-E2BIG, "Excessive subkey length");
 348
 349         return strnequal(entry->name, key, len);
 350 }
 351
 352 struct lxc_config_t *lxc_get_config(const char *key)
 353 {
 354         for (size_t i = 0; i < ARRAY_SIZE(config_jump_table); i++) {
 355                 struct lxc_config_t *cur = &config_jump_table[i];
 356
 357                 switch (match_config_item(cur, key)) {
 358                 case 0:
 359                         continue;
 360                 case -E2BIG:
 361                         return &unsupported_config_key;
 362                 }
 363
 364                 return cur;
 365         }
 366
 367         return &unsupported_config_key;
 368 }
 369
 370 static inline bool match_config_net_item(const struct lxc_config_net_t *entry,
 371                                          const char *key)
 372 {
 373         if (entry->strict)
 374                 return strequal(entry->name, key);
 375         return strnequal(entry->name, key, strlen(entry->name));
 376 }
 377
 378 static struct lxc_config_net_t *lxc_get_config_net(const char *key)
 379 {
 380         for (size_t i = 0; i < ARRAY_SIZE(config_jump_table_net); i++) {
 381                 struct lxc_config_net_t *cur = &config_jump_table_net[i];
 382
 383                 if (!match_config_net_item(cur, key))
 384                         continue;
 385
 386                 return cur;
 387         }
 388
 389         return &unsupported_config_net_key;
 390 }
 391
 392 static int set_config_net(const char *key, const char *value,
 393                           struct lxc_conf *lxc_conf, void *data)
 394 {
 395         if (!lxc_config_value_empty(value))
 396                 return syserror_set(-EINVAL, "lxc.net must not have a value");
 397
 398         return clr_config_net(key, lxc_conf, data);
 399 }
 400
 401 static int set_config_net_type(const char *key, const char *value,
 402                                struct lxc_conf *lxc_conf, void *data)
 403 {
 404         struct lxc_netdev *netdev = data;
 405
 406         if (!netdev)
 407                 return ret_errno(EINVAL);
 408
 409         clr_config_net_type(key, lxc_conf, data);
 410         if (lxc_config_value_empty(value))
 411                 return 0;
 412
 413         if (strequal(value, "veth")) {
 414                 netdev->type = LXC_NET_VETH;
 415                 INIT_LIST_HEAD(&netdev->priv.veth_attr.ipv4_routes);
 416                 INIT_LIST_HEAD(&netdev->priv.veth_attr.ipv6_routes);
 417                 lxc_list_init(&netdev->priv.veth_attr.vlan_tagged_ids);
 418                 if (!lxc_veth_flag_to_mode(netdev->priv.veth_attr.mode))
 419                         lxc_veth_mode_to_flag(&netdev->priv.veth_attr.mode, "bridge");
 420         } else if (strequal(value, "macvlan")) {
 421                 netdev->type = LXC_NET_MACVLAN;
 422                 if (!lxc_macvlan_flag_to_mode(netdev->priv.veth_attr.mode))
 423                         lxc_macvlan_mode_to_flag(&netdev->priv.macvlan_attr.mode, "private");
 424         } else if (strequal(value, "ipvlan")) {
 425                 netdev->type = LXC_NET_IPVLAN;
 426                 if (!lxc_ipvlan_flag_to_mode(netdev->priv.ipvlan_attr.mode))
 427                         lxc_ipvlan_mode_to_flag(&netdev->priv.ipvlan_attr.mode, "l3");
 428                 if (!lxc_ipvlan_flag_to_isolation(netdev->priv.ipvlan_attr.isolation))
 429                         lxc_ipvlan_isolation_to_flag(&netdev->priv.ipvlan_attr.isolation, "bridge");
 430         } else if (strequal(value, "vlan")) {
 431                 netdev->type = LXC_NET_VLAN;
 432         } else if (strequal(value, "phys")) {
 433                 netdev->type = LXC_NET_PHYS;
 434         } else if (strequal(value, "empty")) {
 435                 netdev->type = LXC_NET_EMPTY;
 436                 /* We don't support custom loopback device names. */
 437                 (void)strlcpy(netdev->name, "lo", IFNAMSIZ);
 438         } else if (strequal(value, "none")) {
 439                 netdev->type = LXC_NET_NONE;
 440         } else {
 441                 return log_error(-1, "Invalid network type %s", value);
 442         }
 443
 444         return 0;
 445 }
 446
 447 static int set_config_net_flags(const char *key, const char *value,
 448                                 struct lxc_conf *lxc_conf, void *data)
 449 {
 450         struct lxc_netdev *netdev = data;
 451
 452         if (!netdev)
 453                 return ret_errno(EINVAL);
 454
 455         if (lxc_config_value_empty(value))
 456                 return clr_config_net_flags(key, lxc_conf, data);
 457
 458         netdev->flags |= IFF_UP;
 459
 460         return 0;
 461 }
 462
 463 static int create_matched_ifnames(const char *value, struct lxc_conf *lxc_conf,
 464                                   struct lxc_netdev *netdev)
 465 {
 466         call_cleaner(netns_freeifaddrs) struct netns_ifaddrs *ifaddr = NULL;
 467         struct netns_ifaddrs *ifa;
 468         int n;
 469         int ret = 0;
 470         const char *type_key = "lxc.net.type";
 471         const char *link_key = "lxc.net.link";
 472         const char *tmpvalue = "phys";
 473
 474         if (netns_getifaddrs(&ifaddr, -1, &(bool){false}) < 0)
 475                 return log_error_errno(-1, errno, "Failed to get network interfaces");
 476
 477         for (ifa = ifaddr, n = 0; ifa != NULL; ifa = ifa->ifa_next, n++) {
 478                 if (!ifa->ifa_addr)
 479                         continue;
 480
 481                 if (ifa->ifa_addr->sa_family != AF_PACKET)
 482                         continue;
 483
 484                 if (strnequal(value, ifa->ifa_name, strlen(value) - 1)) {
 485                         ret = set_config_net_type(type_key, tmpvalue, lxc_conf,
 486                                                   netdev);
 487                         if (!ret) {
 488                                 ret = set_config_net_link(
 489                                     link_key, ifa->ifa_name, lxc_conf, netdev);
 490                                 if (ret) {
 491                                         ERROR("Failed to create matched ifnames");
 492                                         break;
 493                                 }
 494                         } else {
 495                                 ERROR("Failed to create matched ifnames");
 496                                 break;
 497                         }
 498                 }
 499         }
 500
 501         return ret;
 502 }
 503
 504 static int set_config_net_link(const char *key, const char *value,
 505                                struct lxc_conf *lxc_conf, void *data)
 506 {
 507         struct lxc_netdev *netdev = data;
 508         int ret = 0;
 509
 510         if (!netdev)
 511                 return ret_errno(EINVAL);
 512
 513         if (lxc_config_value_empty(value))
 514                 return clr_config_net_link(key, lxc_conf, data);
 515
 516         if (value[strlen(value) - 1] == '+' && netdev->type == LXC_NET_PHYS)
 517                 ret = create_matched_ifnames(value, lxc_conf, netdev);
 518         else
 519                 ret = network_ifname(netdev->link, value, sizeof(netdev->link));
 520
 521         return ret;
 522 }
 523
 524 static int set_config_net_l2proxy(const char *key, const char *value,
 525                                      struct lxc_conf *lxc_conf, void *data)
 526 {
 527         struct lxc_netdev *netdev = data;
 528         unsigned int val = 0;
 529         int ret;
 530
 531         if (!netdev)
 532                 return ret_errno(EINVAL);
 533
 534         if (lxc_config_value_empty(value))
 535                 return clr_config_net_l2proxy(key, lxc_conf, data);
 536
 537         ret = lxc_safe_uint(value, &val);
 538         if (ret < 0)
 539                 return ret_errno(ret);
 540
 541         switch (val) {
 542         case 0:
 543                 netdev->l2proxy = false;
 544                 return 0;
 545         case 1:
 546                 netdev->l2proxy = true;
 547                 return 0;
 548         }
 549
 550         return ret_errno(EINVAL);
 551 }
 552
 553 static int set_config_net_name(const char *key, const char *value,
 554                                struct lxc_conf *lxc_conf, void *data)
 555 {
 556         struct lxc_netdev *netdev = data;
 557
 558         if (!netdev)
 559                 return ret_errno(EINVAL);
 560
 561         if (lxc_config_value_empty(value))
 562                 return clr_config_net_name(key, lxc_conf, data);
 563
 564         return network_ifname(netdev->name, value, sizeof(netdev->name));
 565 }
 566
 567
 568 static int set_config_net_veth_mode(const char *key, const char *value,
 569                                        struct lxc_conf *lxc_conf, void *data)
 570 {
 571         struct lxc_netdev *netdev = data;
 572
 573         if (!netdev)
 574                 return ret_errno(EINVAL);
 575
 576         if (netdev->type != LXC_NET_VETH)
 577                 return ret_errno(EINVAL);
 578
 579         if (lxc_config_value_empty(value))
 580                 return clr_config_net_veth_mode(key, lxc_conf, data);
 581
 582         if (!netdev)
 583                 return ret_errno(EINVAL);
 584
 585         return lxc_veth_mode_to_flag(&netdev->priv.veth_attr.mode, value);
 586 }
 587
 588 static int set_config_net_veth_pair(const char *key, const char *value,
 589                                     struct lxc_conf *lxc_conf, void *data)
 590 {
 591         struct lxc_netdev *netdev = data;
 592
 593         if (!netdev)
 594                 return ret_errno(EINVAL);
 595
 596         if (netdev->type != LXC_NET_VETH)
 597                 return ret_errno(EINVAL);
 598
 599         if (lxc_config_value_empty(value))
 600                 return clr_config_net_veth_pair(key, lxc_conf, data);
 601
 602         return network_ifname(netdev->priv.veth_attr.pair, value,
 603                               sizeof(netdev->priv.veth_attr.pair));
 604 }
 605
 606 static int set_config_net_veth_vlan_id(const char *key, const char *value,
 607                                        struct lxc_conf *lxc_conf, void *data)
 608 {
 609         int ret;
 610         struct lxc_netdev *netdev = data;
 611
 612         if (!netdev)
 613                 return ret_errno(EINVAL);
 614
 615         if (netdev->type != LXC_NET_VETH)
 616                 return ret_errno(EINVAL);
 617
 618         if (lxc_config_value_empty(value))
 619                 return clr_config_net_veth_vlan_id(key, lxc_conf, data);
 620
 621         if (strequal(value, "none")) {
 622                 netdev->priv.veth_attr.vlan_id = BRIDGE_VLAN_NONE;
 623         } else {
 624                 unsigned short vlan_id;
 625
 626                 ret = get_u16(&vlan_id, value, 0);
 627                 if (ret < 0)
 628                         return ret_errno(EINVAL);
 629
 630                 if (vlan_id > BRIDGE_VLAN_ID_MAX)
 631                         return ret_errno(EINVAL);
 632
 633                 netdev->priv.veth_attr.vlan_id = vlan_id;
 634         }
 635
 636         netdev->priv.veth_attr.vlan_id_set = true;
 637         return 0;
 638 }
 639
 640 static int set_config_net_veth_vlan_tagged_id(const char *key, const char *value,
 641                                               struct lxc_conf *lxc_conf,
 642                                               void *data)
 643 {
 644         __do_free struct lxc_list *list = NULL;
 645         int ret;
 646         unsigned short vlan_id;
 647         struct lxc_netdev *netdev = data;
 648
 649         if (!netdev)
 650                 return ret_errno(EINVAL);
 651
 652         if (netdev->type != LXC_NET_VETH)
 653                 return ret_errno(EINVAL);
 654
 655         if (lxc_config_value_empty(value))
 656                 return clr_config_net_veth_vlan_tagged_id(key, lxc_conf, data);
 657
 658         ret = get_u16(&vlan_id, value, 0);
 659         if (ret < 0)
 660                 return ret_errno(EINVAL);
 661
 662         if (vlan_id > BRIDGE_VLAN_ID_MAX)
 663                 return ret_errno(EINVAL);
 664
 665         list = lxc_list_new();
 666         if (!list)
 667                 return ret_errno(ENOMEM);
 668
 669         list->elem = UINT_TO_PTR(vlan_id);
 670
 671         lxc_list_add_tail(&netdev->priv.veth_attr.vlan_tagged_ids, move_ptr(list));
 672
 673         return 0;
 674 }
 675
 676 static int set_config_net_macvlan_mode(const char *key, const char *value,
 677                                        struct lxc_conf *lxc_conf, void *data)
 678 {
 679         struct lxc_netdev *netdev = data;
 680
 681         if (!netdev)
 682                 return ret_errno(EINVAL);
 683
 684         if (netdev->type != LXC_NET_MACVLAN)
 685                 return ret_errno(EINVAL);
 686
 687         if (lxc_config_value_empty(value))
 688                 return clr_config_net_macvlan_mode(key, lxc_conf, data);
 689
 690         return lxc_macvlan_mode_to_flag(&netdev->priv.macvlan_attr.mode, value);
 691 }
 692
 693 static int set_config_net_ipvlan_mode(const char *key, const char *value,
 694                                       struct lxc_conf *lxc_conf, void *data)
 695 {
 696         struct lxc_netdev *netdev = data;
 697
 698         if (!netdev)
 699                 return ret_errno(EINVAL);
 700
 701         if (netdev->type != LXC_NET_IPVLAN)
 702                 return syserror_set(-EINVAL, "Invalid ipvlan mode \"%s\", can only be used with ipvlan network", value);
 703
 704         if (lxc_config_value_empty(value))
 705                 return clr_config_net_ipvlan_mode(key, lxc_conf, data);
 706
 707         return lxc_ipvlan_mode_to_flag(&netdev->priv.ipvlan_attr.mode, value);
 708 }
 709
 710 static int set_config_net_ipvlan_isolation(const char *key, const char *value,
 711                                            struct lxc_conf *lxc_conf, void *data)
 712 {
 713         struct lxc_netdev *netdev = data;
 714
 715         if (!netdev)
 716                 return ret_errno(EINVAL);
 717
 718         if (netdev->type != LXC_NET_IPVLAN)
 719                 return syserror_set(-EINVAL, "Invalid ipvlan isolation \"%s\", can only be used with ipvlan network", value);
 720
 721         if (lxc_config_value_empty(value))
 722                 return clr_config_net_ipvlan_isolation(key, lxc_conf, data);
 723
 724         return lxc_ipvlan_isolation_to_flag(&netdev->priv.ipvlan_attr.isolation, value);
 725 }
 726
 727 static int set_config_net_hwaddr(const char *key, const char *value,
 728                                  struct lxc_conf *lxc_conf, void *data)
 729 {
 730         __do_free char *new_value = NULL;
 731         struct lxc_netdev *netdev = data;
 732
 733         if (!netdev)
 734                 return ret_errno(EINVAL);
 735
 736         clr_config_net_hwaddr(key, lxc_conf, data);
 737         if (lxc_config_value_empty(value))
 738                 return 0;
 739
 740         new_value = strdup(value);
 741         if (!new_value)
 742                 return ret_errno(ENOMEM);
 743
 744         rand_complete_hwaddr(new_value);
 745         if (!lxc_config_value_empty(new_value))
 746                 netdev->hwaddr = move_ptr(new_value);
 747
 748         return 0;
 749 }
 750
 751 static int set_config_net_vlan_id(const char *key, const char *value,
 752                                   struct lxc_conf *lxc_conf, void *data)
 753 {
 754         int ret;
 755         struct lxc_netdev *netdev = data;
 756
 757         if (!netdev)
 758                 return ret_errno(EINVAL);
 759
 760         if (netdev->type != LXC_NET_VLAN)
 761                 return ret_errno(EINVAL);
 762
 763         if (lxc_config_value_empty(value))
 764                 return clr_config_net_vlan_id(key, lxc_conf, data);
 765
 766         ret = get_u16(&netdev->priv.vlan_attr.vid, value, 0);
 767         if (ret < 0)
 768                 return ret;
 769
 770         return 0;
 771 }
 772
 773 static int set_config_net_mtu(const char *key, const char *value,
 774                               struct lxc_conf *lxc_conf, void *data)
 775 {
 776         struct lxc_netdev *netdev = data;
 777
 778         if (!netdev)
 779                 return ret_errno(EINVAL);
 780
 781         clr_config_net_mtu(key, lxc_conf, data);
 782         if (lxc_config_value_empty(value))
 783                 return 0;
 784
 785         return set_config_string_item(&netdev->mtu, value);
 786 }
 787
 788 static int set_config_net_ipv4_address(const char *key, const char *value,
 789                                        struct lxc_conf *lxc_conf, void *data)
 790 {
 791         __do_free char *addr = NULL;
 792         __do_free struct lxc_inetdev *inetdev = NULL;
 793         int ret;
 794         struct lxc_netdev *netdev = data;
 795         char *cursor, *slash;
 796         char *bcast = NULL, *prefix = NULL;
 797
 798         if (!netdev)
 799                 return ret_errno(EINVAL);
 800
 801         if (lxc_config_value_empty(value))
 802                 return clr_config_net_ipv4_address(key, lxc_conf, data);
 803
 804         inetdev = zalloc(sizeof(*inetdev));
 805         if (!inetdev)
 806                 return ret_errno(ENOMEM);
 807
 808         addr = strdup(value);
 809         if (!addr)
 810                 return ret_errno(ENOMEM);
 811
 812         cursor = strstr(addr, " ");
 813         if (cursor) {
 814                 *cursor = '\0';
 815                 bcast = cursor + 1;
 816         }
 817
 818         slash = strstr(addr, "/");
 819         if (slash) {
 820                 *slash = '\0';
 821                 prefix = slash + 1;
 822         }
 823
 824         ret = inet_pton(AF_INET, addr, &inetdev->addr);
 825         if (!ret || ret < 0)
 826                 return log_error_errno(-1, errno, "Invalid ipv4 address \"%s\"", value);
 827
 828         if (bcast) {
 829                 ret = inet_pton(AF_INET, bcast, &inetdev->bcast);
 830                 if (!ret || ret < 0)
 831                         return log_error_errno(-1, errno, "Invalid ipv4 broadcast address \"%s\"", value);
 832
 833         }
 834
 835         /* No prefix specified, determine it from the network class. */
 836         ret = 0;
 837         if (prefix)
 838                 ret = lxc_safe_uint(prefix, &inetdev->prefix);
 839         else
 840                 inetdev->prefix = config_ip_prefix(&inetdev->addr);
 841         if (ret || inetdev->prefix > 32)
 842                 return ret_errno(EINVAL);
 843
 844         /* If no broadcast address, compute one from the prefix and address. */
 845         if (!bcast) {
 846                 unsigned int shift = LAST_BIT_PER_TYPE(inetdev->prefix);
 847
 848                 inetdev->bcast.s_addr = inetdev->addr.s_addr;
 849                 if (inetdev->prefix < shift)
 850                         shift = inetdev->prefix;
 851                 inetdev->bcast.s_addr |= htonl(INADDR_BROADCAST >> shift);
 852         }
 853
 854         list_add_tail(&inetdev->head, &netdev->ipv4_addresses);
 855         move_ptr(inetdev);
 856
 857         return 0;
 858 }
 859
 860 static int set_config_net_ipv4_gateway(const char *key, const char *value,
 861                                        struct lxc_conf *lxc_conf, void *data)
 862 {
 863         struct lxc_netdev *netdev = data;
 864
 865         if (!netdev)
 866                 return ret_errno(EINVAL);
 867
 868         clr_config_net_ipv4_gateway(key, lxc_conf, data);
 869         if (lxc_config_value_empty(value))
 870                 return 0;
 871
 872         if (strequal(value, "auto")) {
 873                 netdev->ipv4_gateway = NULL;
 874                 netdev->ipv4_gateway_auto = true;
 875         } else if (strequal(value, "dev")) {
 876                 netdev->ipv4_gateway = NULL;
 877                 netdev->ipv4_gateway_auto = false;
 878                 netdev->ipv4_gateway_dev = true;
 879         } else {
 880                 __do_free struct in_addr *gw = NULL;
 881                 int ret;
 882
 883                 gw = zalloc(sizeof(*gw));
 884                 if (!gw)
 885                         return ret_errno(ENOMEM);
 886
 887                 ret = inet_pton(AF_INET, value, gw);
 888                 if (!ret || ret < 0)
 889                         return log_error_errno(-1, errno, "Invalid ipv4 gateway address \"%s\"", value);
 890
 891                 netdev->ipv4_gateway = move_ptr(gw);
 892                 netdev->ipv4_gateway_auto = false;
 893         }
 894
 895         return 0;
 896 }
 897
 898 static int set_config_net_veth_ipv4_route(const char *key, const char *value,
 899                                           struct lxc_conf *lxc_conf, void *data)
 900 {
 901         __do_free char *valdup = NULL;
 902         __do_free struct lxc_inetdev *inetdev = NULL;
 903         int ret;
 904         char *netmask, *slash;
 905         struct lxc_netdev *netdev = data;
 906
 907         if (!netdev)
 908                 return ret_errno(EINVAL);
 909
 910         if (netdev->type != LXC_NET_VETH)
 911                 return syserror_set(-EINVAL, "Invalid ipv4 route \"%s\", can only be used with veth network", value);
 912
 913         if (lxc_config_value_empty(value))
 914                 return clr_config_net_veth_ipv4_route(key, lxc_conf, data);
 915
 916         inetdev = zalloc(sizeof(*inetdev));
 917         if (!inetdev)
 918                 return ret_errno(ENOMEM);
 919
 920         valdup = strdup(value);
 921         if (!valdup)
 922                 return ret_errno(ENOMEM);
 923
 924         slash = strchr(valdup, '/');
 925         if (!slash)
 926                 return ret_errno(EINVAL);
 927
 928         *slash = '\0';
 929         slash++;
 930         if (*slash == '\0')
 931                 return ret_errno(EINVAL);
 932
 933         netmask = slash;
 934
 935         ret = lxc_safe_uint(netmask, &inetdev->prefix);
 936         if (ret < 0 || inetdev->prefix > 32)
 937                 return ret_errno(EINVAL);
 938
 939         ret = inet_pton(AF_INET, valdup, &inetdev->addr);
 940         if (!ret || ret < 0)
 941                 return ret_errno(EINVAL);
 942
 943         list_add_tail(&inetdev->head, &netdev->priv.veth_attr.ipv4_routes);
 944         move_ptr(inetdev);
 945
 946         return 0;
 947 }
 948
 949 static int set_config_net_ipv6_address(const char *key, const char *value,
 950                                        struct lxc_conf *lxc_conf, void *data)
 951 {
 952         __do_free char *valdup = NULL;
 953         __do_free struct lxc_inet6dev *inet6dev = NULL;
 954         int ret;
 955         struct lxc_netdev *netdev = data;
 956         char *slash, *netmask;
 957
 958         if (!netdev)
 959                 return ret_errno(EINVAL);
 960
 961         if (lxc_config_value_empty(value))
 962                 return clr_config_net_ipv6_address(key, lxc_conf, data);
 963
 964         inet6dev = zalloc(sizeof(*inet6dev));
 965         if (!inet6dev)
 966                 return ret_errno(ENOMEM);
 967
 968         valdup = strdup(value);
 969         if (!valdup)
 970                 return ret_errno(ENOMEM);
 971
 972         inet6dev->prefix = 64;
 973         slash = strstr(valdup, "/");
 974         if (slash) {
 975                 *slash = '\0';
 976                 netmask = slash + 1;
 977
 978                 ret = lxc_safe_uint(netmask, &inet6dev->prefix);
 979                 if (ret < 0)
 980                         return ret;
 981         }
 982
 983         ret = inet_pton(AF_INET6, valdup, &inet6dev->addr);
 984         if (!ret || ret < 0)
 985                 return log_error_errno(-EINVAL, EINVAL, "Invalid ipv6 address \"%s\"", valdup);
 986
 987         list_add_tail(&inet6dev->head, &netdev->ipv6_addresses);
 988         move_ptr(inet6dev);
 989
 990         return 0;
 991 }
 992
 993 static int set_config_net_ipv6_gateway(const char *key, const char *value,
 994                                        struct lxc_conf *lxc_conf, void *data)
 995 {
 996         struct lxc_netdev *netdev = data;
 997
 998         if (!netdev)
 999                 return ret_errno(EINVAL);
1000
1001         clr_config_net_ipv6_gateway(key, lxc_conf, data);
1002         if (lxc_config_value_empty(value))
1003                 return 0;
1004
1005         if (strequal(value, "auto")) {
1006                 netdev->ipv6_gateway = NULL;
1007                 netdev->ipv6_gateway_auto = true;
1008         } else if (strequal(value, "dev")) {
1009                 netdev->ipv6_gateway = NULL;
1010                 netdev->ipv6_gateway_auto = false;
1011                 netdev->ipv6_gateway_dev = true;
1012         } else {
1013                 int ret;
1014                 __do_free struct in6_addr *gw = NULL;
1015
1016                 gw = zalloc(sizeof(*gw));
1017                 if (!gw)
1018                         return ret_errno(ENOMEM);
1019
1020                 ret = inet_pton(AF_INET6, value, gw);
1021                 if (!ret || ret < 0)
1022                         return log_error_errno(-EINVAL, EINVAL,
1023                                                "Invalid ipv6 gateway address \"%s\"", value);
1024
1025                 netdev->ipv6_gateway = move_ptr(gw);
1026                 netdev->ipv6_gateway_auto = false;
1027         }
1028
1029         return 0;
1030 }
1031
1032 static int set_config_net_veth_ipv6_route(const char *key, const char *value,
1033                                           struct lxc_conf *lxc_conf, void *data)
1034 {
1035         __do_free char *valdup = NULL;
1036         __do_free struct lxc_inet6dev *inet6dev = NULL;
1037         int ret;
1038         char *netmask, *slash;
1039         struct lxc_netdev *netdev = data;
1040
1041         if (!netdev)
1042                 return ret_errno(EINVAL);
1043
1044         if (netdev->type != LXC_NET_VETH)
1045                 return syserror_set(-EINVAL, "Invalid ipv6 route \"%s\", can only be used with veth network", value);
1046
1047         if (lxc_config_value_empty(value))
1048                 return clr_config_net_veth_ipv6_route(key, lxc_conf, data);
1049
1050         inet6dev = zalloc(sizeof(*inet6dev));
1051         if (!inet6dev)
1052                 return ret_errno(ENOMEM);
1053
1054         valdup = strdup(value);
1055         if (!valdup)
1056                 return ret_errno(ENOMEM);
1057
1058         slash = strchr(valdup, '/');
1059         if (!slash)
1060                 return ret_errno(EINVAL);
1061
1062         *slash = '\0';
1063         slash++;
1064         if (*slash == '\0')
1065                 return ret_errno(EINVAL);
1066
1067         netmask = slash;
1068
1069         ret = lxc_safe_uint(netmask, &inet6dev->prefix);
1070         if (ret < 0 || inet6dev->prefix > 128)
1071                 return ret_errno(EINVAL);
1072
1073         ret = inet_pton(AF_INET6, valdup, &inet6dev->addr);
1074         if (!ret || ret < 0)
1075                 return ret_errno(EINVAL);
1076
1077         list_add_tail(&inet6dev->head, &netdev->priv.veth_attr.ipv6_routes);
1078         move_ptr(inet6dev);
1079
1080         return 0;
1081 }
1082
1083 static int set_config_net_script_up(const char *key, const char *value,
1084                                     struct lxc_conf *lxc_conf, void *data)
1085 {
1086         struct lxc_netdev *netdev = data;
1087
1088         if (!netdev)
1089                 return ret_errno(EINVAL);
1090
1091         clr_config_net_script_up(key, lxc_conf, data);
1092         if (lxc_config_value_empty(value))
1093                 return 0;
1094
1095         return set_config_string_item(&netdev->upscript, value);
1096 }
1097
1098 static int set_config_net_script_down(const char *key, const char *value,
1099                                       struct lxc_conf *lxc_conf, void *data)
1100 {
1101         struct lxc_netdev *netdev = data;
1102
1103         if (!netdev)
1104                 return ret_errno(EINVAL);
1105
1106         clr_config_net_script_down(key, lxc_conf, data);
1107         if (lxc_config_value_empty(value))
1108                 return 0;
1109
1110         return set_config_string_item(&netdev->downscript, value);
1111 }
1112
1113 static int add_hook(struct lxc_conf *lxc_conf, int which, __owns char *hook)
1114 {
1115         __do_free char *val = hook;
1116         struct lxc_list *hooklist;
1117
1118         hooklist = lxc_list_new();
1119         if (!hooklist)
1120                 return ret_errno(ENOMEM);
1121
1122         hooklist->elem = move_ptr(val);
1123         lxc_list_add_tail(&lxc_conf->hooks[which], hooklist);
1124
1125         return 0;
1126 }
1127
1128 static int set_config_seccomp_allow_nesting(const char *key, const char *value,
1129                                             struct lxc_conf *lxc_conf, void *data)
1130 {
1131 #ifdef HAVE_SECCOMP
1132         if (lxc_config_value_empty(value))
1133                 return clr_config_seccomp_allow_nesting(key, lxc_conf, NULL);
1134
1135         if (lxc_safe_uint(value, &lxc_conf->seccomp.allow_nesting) < 0)
1136                 return -errno;
1137
1138         if (lxc_conf->seccomp.allow_nesting > 1)
1139                 return ret_errno(EINVAL);
1140
1141         return 0;
1142 #else
1143         return ret_errno(ENOSYS);
1144 #endif
1145 }
1146
1147 static int set_config_seccomp_notify_cookie(const char *key, const char *value,
1148                                             struct lxc_conf *lxc_conf, void *data)
1149 {
1150 #ifdef HAVE_SECCOMP_NOTIFY
1151         return set_config_string_item(&lxc_conf->seccomp.notifier.cookie, value);
1152 #else
1153         return ret_errno(ENOSYS);
1154 #endif
1155 }
1156
1157 static int set_config_seccomp_notify_proxy(const char *key, const char *value,
1158                                            struct lxc_conf *lxc_conf, void *data)
1159 {
1160 #ifdef HAVE_SECCOMP_NOTIFY
1161         const char *offset;
1162
1163         if (lxc_config_value_empty(value))
1164                 return clr_config_seccomp_notify_proxy(key, lxc_conf, NULL);
1165
1166         if (!strnequal(value, "unix:", 5))
1167                 return ret_errno(EINVAL);
1168
1169         offset = value + 5;
1170         if (lxc_unix_sockaddr(&lxc_conf->seccomp.notifier.proxy_addr, offset) < 0)
1171                 return -errno;
1172
1173         return 0;
1174 #else
1175         return ret_errno(ENOSYS);
1176 #endif
1177 }
1178
1179 static int set_config_seccomp_profile(const char *key, const char *value,
1180                                       struct lxc_conf *lxc_conf, void *data)
1181 {
1182 #ifdef HAVE_SECCOMP
1183         return set_config_path_item(&lxc_conf->seccomp.seccomp, value);
1184 #else
1185         return ret_errno(ENOSYS);
1186 #endif
1187 }
1188
1189 static int set_config_execute_cmd(const char *key, const char *value,
1190                                struct lxc_conf *lxc_conf, void *data)
1191 {
1192         return set_config_path_item(&lxc_conf->execute_cmd, value);
1193 }
1194
1195 static int set_config_init_cmd(const char *key, const char *value,
1196                                struct lxc_conf *lxc_conf, void *data)
1197 {
1198         return set_config_path_item(&lxc_conf->init_cmd, value);
1199 }
1200
1201 static int set_config_init_cwd(const char *key, const char *value,
1202                                struct lxc_conf *lxc_conf, void *data)
1203 {
1204         return set_config_path_item(&lxc_conf->init_cwd, value);
1205 }
1206
1207 static int set_config_init_uid(const char *key, const char *value,
1208                                struct lxc_conf *lxc_conf, void *data)
1209 {
1210         unsigned int init_uid;
1211
1212         if (lxc_config_value_empty(value)) {
1213                 lxc_conf->init_uid = 0;
1214                 return 0;
1215         }
1216
1217         if (lxc_safe_uint(value, &init_uid) < 0)
1218                 return -errno;
1219
1220         lxc_conf->init_uid = init_uid;
1221
1222         return 0;
1223 }
1224
1225 static int set_config_init_gid(const char *key, const char *value,
1226                                struct lxc_conf *lxc_conf, void *data)
1227 {
1228         unsigned int init_gid;
1229
1230         if (lxc_config_value_empty(value)) {
1231                 lxc_conf->init_gid = 0;
1232                 return 0;
1233         }
1234
1235         if (lxc_safe_uint(value, &init_gid) < 0)
1236                 return -errno;
1237
1238         lxc_conf->init_gid = init_gid;
1239
1240         return 0;
1241 }
1242
1243 static int set_config_init_groups(const char *key, const char *value,
1244                                   struct lxc_conf *lxc_conf, void *data)
1245 {
1246         __do_free char *value_dup = NULL;
1247         gid_t *init_groups = NULL;
1248         size_t num_groups = 0;
1249         size_t idx;
1250         char *token;
1251
1252         if (lxc_config_value_empty(value))
1253                 return clr_config_init_groups(key, lxc_conf, NULL);
1254
1255         value_dup = strdup(value);
1256         if (!value_dup)
1257                 return -ENOMEM;
1258
1259         lxc_iterate_parts(token, value_dup, ",")
1260                 num_groups++;
1261
1262         if (num_groups == INT_MAX)
1263                 return log_error_errno(-ERANGE, ERANGE, "Excessive number of supplementary groups specified");
1264
1265         /* This means the string wasn't empty and all we found was garbage. */
1266         if (num_groups == 0)
1267                 return log_error_errno(-EINVAL, EINVAL, "No valid groups specified %s", value);
1268
1269         idx = lxc_conf->init_groups.size;
1270         init_groups = realloc(lxc_conf->init_groups.list, sizeof(gid_t) * (idx + num_groups));
1271         if (!init_groups)
1272                 return ret_errno(ENOMEM);
1273
1274         /*
1275          * Once the realloc() succeeded we need to hand control of the memory
1276          * back to the config otherwise we risk a double-free when
1277          * lxc_conf_free() is called.
1278          */
1279         lxc_conf->init_groups.list = init_groups;
1280
1281         /* Restore duplicated value so we can call lxc_iterate_parts() again. */
1282         strcpy(value_dup, value);
1283
1284         lxc_iterate_parts(token, value_dup, ",") {
1285                 int ret;
1286
1287                 gid_t group;
1288
1289                 ret = lxc_safe_uint(token, &group);
1290                 if (ret)
1291                         return log_error_errno(ret, -ret, "Failed to parse group %s", token);
1292
1293                 init_groups[idx++] = group;
1294         }
1295
1296         lxc_conf->init_groups.size += num_groups;
1297
1298         return 0;
1299 }
1300
1301 static int set_config_hooks(const char *key, const char *value,
1302                             struct lxc_conf *lxc_conf, void *data)
1303 {
1304         __do_free char *copy = NULL;
1305
1306         if (lxc_config_value_empty(value))
1307                 return lxc_clear_hooks(lxc_conf, key);
1308
1309         if (strequal(key + 4, "hook"))
1310                 return log_error_errno(-EINVAL, EINVAL, "lxc.hook must not have a value");
1311
1312         copy = strdup(value);
1313         if (!copy)
1314                 return ret_errno(ENOMEM);
1315
1316         if (strequal(key + 9, "pre-start"))
1317                 return add_hook(lxc_conf, LXCHOOK_PRESTART, move_ptr(copy));
1318         else if (strequal(key + 9, "start-host"))
1319                 return add_hook(lxc_conf, LXCHOOK_START_HOST, move_ptr(copy));
1320         else if (strequal(key + 9, "pre-mount"))
1321                 return add_hook(lxc_conf, LXCHOOK_PREMOUNT, move_ptr(copy));
1322         else if (strequal(key + 9, "autodev"))
1323                 return add_hook(lxc_conf, LXCHOOK_AUTODEV, move_ptr(copy));
1324         else if (strequal(key + 9, "mount"))
1325                 return add_hook(lxc_conf, LXCHOOK_MOUNT, move_ptr(copy));
1326         else if (strequal(key + 9, "start"))
1327                 return add_hook(lxc_conf, LXCHOOK_START, move_ptr(copy));
1328         else if (strequal(key + 9, "stop"))
1329                 return add_hook(lxc_conf, LXCHOOK_STOP, move_ptr(copy));
1330         else if (strequal(key + 9, "post-stop"))
1331                 return add_hook(lxc_conf, LXCHOOK_POSTSTOP, move_ptr(copy));
1332         else if (strequal(key + 9, "clone"))
1333                 return add_hook(lxc_conf, LXCHOOK_CLONE, move_ptr(copy));
1334         else if (strequal(key + 9, "destroy"))
1335                 return add_hook(lxc_conf, LXCHOOK_DESTROY, move_ptr(copy));
1336
1337         return ret_errno(EINVAL);
1338 }
1339
1340 static int set_config_hooks_version(const char *key, const char *value,
1341                                     struct lxc_conf *lxc_conf, void *data)
1342 {
1343         int ret;
1344         unsigned int tmp;
1345
1346         if (lxc_config_value_empty(value))
1347                 return clr_config_hooks_version(key, lxc_conf, NULL);
1348
1349         ret = lxc_safe_uint(value, &tmp);
1350         if (ret < 0)
1351                 return -errno;
1352
1353         if (tmp > 1)
1354                 return syserror_set(-EINVAL, "Invalid hook version specified. Currently only 0 (legacy) and 1 are supported");
1355
1356         lxc_conf->hooks_version = tmp;
1357
1358         return 0;
1359 }
1360
1361 static int set_config_personality(const char *key, const char *value,
1362                                   struct lxc_conf *lxc_conf, void *data)
1363 {
1364         int ret;
1365         personality_t personality;
1366
1367         ret = lxc_config_parse_arch(value, &personality);
1368         if (ret < 0)
1369                 return syserror("Unsupported personality \"%s\"", value);
1370
1371         lxc_conf->personality = personality;
1372         return 0;
1373 }
1374
1375 static int set_config_pty_max(const char *key, const char *value,
1376                               struct lxc_conf *lxc_conf, void *data)
1377 {
1378         int ret;
1379         unsigned int max = 0;
1380
1381         if (lxc_config_value_empty(value)) {
1382                 lxc_conf->pty_max = 0;
1383                 return 0;
1384         }
1385
1386         ret = lxc_safe_uint(value, &max);
1387         if (ret < 0)
1388                 return ret_errno(EINVAL);
1389
1390         lxc_conf->pty_max = max;
1391
1392         return 0;
1393 }
1394
1395 /* We only need to check whether the first byte of the key after the lxc.start.
1396  * prefix matches our expectations since they fortunately all start with a
1397  * different letter. If anything was wrong with the key we would have already
1398  * noticed when the callback was called.
1399  */
1400 static int set_config_start(const char *key, const char *value,
1401                             struct lxc_conf *lxc_conf, void *data)
1402 {
1403         int ret;
1404         bool is_empty;
1405
1406         is_empty = lxc_config_value_empty(value);
1407
1408         if (*(key + 10) == 'a') { /* lxc.start.auto */
1409                 if (is_empty) {
1410                         lxc_conf->start_auto = 0;
1411                         return 0;
1412                 }
1413
1414                 ret = lxc_safe_uint(value, &lxc_conf->start_auto);
1415                 if (ret)
1416                         return ret;
1417
1418                 if (lxc_conf->start_auto > 1)
1419                         return ret_errno(EINVAL);
1420
1421                 return 0;
1422         } else if (*(key + 10) == 'd') { /* lxc.start.delay */
1423                 if (is_empty) {
1424                         lxc_conf->start_delay = 0;
1425                         return 0;
1426                 }
1427
1428                 return lxc_safe_uint(value, &lxc_conf->start_delay);
1429         } else if (*(key + 10) == 'o') { /* lxc.start.order */
1430                 if (is_empty) {
1431                         lxc_conf->start_order = 0;
1432                         return 0;
1433                 }
1434
1435                 return lxc_safe_int(value, &lxc_conf->start_order);
1436         }
1437
1438         return ret_errno(EINVAL);
1439 }
1440
1441 static int set_config_monitor(const char *key, const char *value,
1442                               struct lxc_conf *lxc_conf, void *data)
1443 {
1444         if (lxc_config_value_empty(value)) {
1445                 lxc_conf->monitor_unshare = 0;
1446                 return 0;
1447         }
1448
1449         if (strequal(key + 12, "unshare"))
1450                 return lxc_safe_uint(value, &lxc_conf->monitor_unshare);
1451
1452         return ret_errno(EINVAL);
1453 }
1454
1455 static int set_config_monitor_signal_pdeath(const char *key, const char *value,
1456                                             struct lxc_conf *lxc_conf, void *data)
1457 {
1458         if (lxc_config_value_empty(value)) {
1459                 lxc_conf->monitor_signal_pdeath = 0;
1460                 return 0;
1461         }
1462
1463         if (strequal(key + 12, "signal.pdeath")) {
1464                 int sig_n;
1465
1466                 sig_n = sig_parse(value);
1467                 if (sig_n < 0)
1468                         return ret_errno(EINVAL);
1469
1470                 lxc_conf->monitor_signal_pdeath = sig_n;
1471                 return 0;
1472         }
1473
1474         return ret_errno(EINVAL);
1475 }
1476
1477 static int set_config_group(const char *key, const char *value,
1478                             struct lxc_conf *lxc_conf, void *data)
1479 {
1480         __do_free char *groups = NULL;
1481         char *token;
1482
1483         if (lxc_config_value_empty(value))
1484                 return lxc_clear_groups(lxc_conf);
1485
1486         groups = strdup(value);
1487         if (!groups)
1488                 return ret_errno(ENOMEM);
1489
1490         /* In case several groups are specified in a single line split these
1491          * groups in a single element for the list.
1492          */
1493         lxc_iterate_parts(token, groups, " \t") {
1494                 __do_free struct lxc_list *grouplist = NULL;
1495
1496                 grouplist = lxc_list_new();
1497                 if (!grouplist)
1498                         return ret_errno(ENOMEM);
1499
1500                 grouplist->elem = strdup(token);
1501                 if (!grouplist->elem)
1502                         return ret_errno(ENOMEM);
1503
1504                 lxc_list_add_tail(&lxc_conf->groups, move_ptr(grouplist));
1505         }
1506
1507         return 0;
1508 }
1509
1510 static int set_config_environment(const char *key, const char *value,
1511                                   struct lxc_conf *lxc_conf, void *data)
1512 {
1513         __do_free char *dup = NULL, *val = NULL;
1514         __do_free struct environment_entry *new_env = NULL;
1515         char *env_val;
1516
1517         if (lxc_config_value_empty(value))
1518                 return lxc_clear_environment(lxc_conf);
1519
1520         new_env = zalloc(sizeof(struct environment_entry));
1521         if (!new_env)
1522                 return ret_errno(ENOMEM);
1523
1524         dup = strdup(value);
1525         if (!dup)
1526                 return ret_errno(ENOMEM);
1527
1528         env_val = strchr(dup, '=');
1529         if (!env_val) {
1530                 env_val = getenv(dup);
1531         } else {
1532                 *env_val = '\0';
1533                 env_val++;
1534         }
1535         if (!env_val)
1536                 return ret_errno(ENOENT);
1537
1538         val = strdup(env_val);
1539         if (!val)
1540                 return ret_errno(ENOMEM);
1541
1542         new_env->key = move_ptr(dup);
1543         new_env->val = move_ptr(val);
1544
1545         list_add_tail(&new_env->head, &lxc_conf->environment);
1546         move_ptr(new_env);
1547
1548         return 0;
1549 }
1550
1551 static int set_config_tty_max(const char *key, const char *value,
1552                               struct lxc_conf *lxc_conf, void *data)
1553 {
1554         int ret;
1555         unsigned int nbtty = 0;
1556
1557         if (lxc_config_value_empty(value)) {
1558                 lxc_conf->ttys.max = 0;
1559                 return 0;
1560         }
1561
1562         ret = lxc_safe_uint(value, &nbtty);
1563         if (ret < 0)
1564                 return ret;
1565
1566         lxc_conf->ttys.max = nbtty;
1567
1568         return 0;
1569 }
1570
1571 static int set_config_tty_dir(const char *key, const char *value,
1572                              struct lxc_conf *lxc_conf, void *data)
1573 {
1574         return set_config_string_item_max(&lxc_conf->ttys.dir, value,
1575                                           NAME_MAX + 1);
1576 }
1577
1578 static int set_config_apparmor_profile(const char *key, const char *value,
1579                                        struct lxc_conf *lxc_conf, void *data)
1580 {
1581 #if HAVE_APPARMOR
1582         return set_config_string_item(&lxc_conf->lsm_aa_profile, value);
1583 #else
1584         return syserror_set(-EINVAL, "Built without AppArmor support");
1585 #endif
1586 }
1587
1588 static int set_config_apparmor_allow_incomplete(const char *key,
1589                                                 const char *value,
1590                                                 struct lxc_conf *lxc_conf,
1591                                                 void *data)
1592 {
1593 #if HAVE_APPARMOR
1594         int ret;
1595
1596         if (lxc_config_value_empty(value)) {
1597                 lxc_conf->lsm_aa_allow_incomplete = 0;
1598                 return 0;
1599         }
1600
1601         ret = lxc_safe_uint(value, &lxc_conf->lsm_aa_allow_incomplete);
1602         if (ret)
1603                 return ret;
1604
1605         if (lxc_conf->lsm_aa_allow_incomplete > 1)
1606                 return ret_errno(EINVAL);
1607
1608         return 0;
1609 #else
1610         return syserror_set(-EINVAL, "Built without AppArmor support");
1611 #endif
1612 }
1613
1614 static int set_config_apparmor_allow_nesting(const char *key,
1615                                              const char *value,
1616                                              struct lxc_conf *lxc_conf,
1617                                              void *data)
1618 {
1619 #if HAVE_APPARMOR
1620         int ret;
1621
1622         if (lxc_config_value_empty(value))
1623                 return clr_config_apparmor_allow_nesting(key, lxc_conf, NULL);
1624
1625         ret = lxc_safe_uint(value, &lxc_conf->lsm_aa_allow_nesting);
1626         if (ret)
1627                 return ret;
1628
1629         if (lxc_conf->lsm_aa_allow_nesting > 1)
1630                 return ret_errno(EINVAL);
1631
1632         return 0;
1633 #else
1634         return syserror_set(-EINVAL, "Built without AppArmor support");
1635 #endif
1636 }
1637
1638 static int set_config_apparmor_raw(const char *key,
1639                                    const char *value,
1640                                    struct lxc_conf *lxc_conf,
1641                                    void *data)
1642 {
1643 #if HAVE_APPARMOR
1644         __do_free char *elem = NULL;
1645         __do_free struct lxc_list *list = NULL;
1646
1647         if (lxc_config_value_empty(value))
1648                 return lxc_clear_apparmor_raw(lxc_conf);
1649
1650         list = lxc_list_new();
1651         if (!list)
1652                 return ret_errno(ENOMEM);
1653
1654         elem = strdup(value);
1655         if (!elem)
1656                 return ret_errno(ENOMEM);
1657
1658         list->elem = move_ptr(elem);
1659         lxc_list_add_tail(&lxc_conf->lsm_aa_raw, move_ptr(list));
1660
1661         return 0;
1662 #else
1663         return syserror_set(-EINVAL, "Built without AppArmor support");
1664 #endif
1665 }
1666
1667 static int set_config_selinux_context(const char *key, const char *value,
1668                                       struct lxc_conf *lxc_conf, void *data)
1669 {
1670 #if HAVE_SELINUX
1671         return set_config_string_item(&lxc_conf->lsm_se_context, value);
1672 #else
1673         return syserror_set(-EINVAL, "Built without SELinux support");
1674 #endif
1675 }
1676
1677 static int set_config_selinux_context_keyring(const char *key, const char *value,
1678                                               struct lxc_conf *lxc_conf, void *data)
1679 {
1680 #if HAVE_SELINUX
1681         return set_config_string_item(&lxc_conf->lsm_se_keyring_context, value);
1682 #else
1683         return syserror_set(-EINVAL, "Built without SELinux support");
1684 #endif
1685 }
1686
1687 static int set_config_keyring_session(const char *key, const char *value,
1688                                       struct lxc_conf *lxc_conf, void *data)
1689 {
1690         return set_config_bool_item(&lxc_conf->keyring_disable_session, value, false);
1691 }
1692
1693 static int set_config_log_file(const char *key, const char *value,
1694                               struct lxc_conf *c, void *data)
1695 {
1696         int ret;
1697
1698         if (lxc_config_value_empty(value)) {
1699                 free_disarm(c->logfile);
1700                 return 0;
1701         }
1702
1703         /*
1704          * Store these values in the lxc_conf, and then try to set for actual
1705          * current logging.
1706          */
1707         ret = set_config_path_item(&c->logfile, value);
1708         if (ret == 0)
1709                 ret = lxc_log_set_file(&c->logfd, c->logfile);
1710
1711         return ret;
1712 }
1713
1714 static int set_config_log_level(const char *key, const char *value,
1715                                struct lxc_conf *lxc_conf, void *data)
1716 {
1717         int newlevel;
1718
1719         if (lxc_config_value_empty(value)) {
1720                 lxc_conf->loglevel = LXC_LOG_LEVEL_NOTSET;
1721                 return 0;
1722         }
1723
1724         if (value[0] >= '0' && value[0] <= '9') {
1725                 int ret;
1726
1727                 ret = lxc_safe_int(value, &newlevel);
1728                 if (ret)
1729                         return ret_errno(EINVAL);
1730         } else {
1731                 newlevel = lxc_log_priority_to_int(value);
1732         }
1733
1734         /*
1735          * Store these values in the lxc_conf, and then try to set for actual
1736          * current logging.
1737          */
1738         lxc_conf->loglevel = newlevel;
1739
1740         return lxc_log_set_level(&lxc_conf->loglevel, newlevel);
1741 }
1742
1743 static int set_config_autodev(const char *key, const char *value,
1744                               struct lxc_conf *lxc_conf, void *data)
1745 {
1746         int ret;
1747
1748         if (lxc_config_value_empty(value)) {
1749                 lxc_conf->autodev = 0;
1750                 return 0;
1751         }
1752
1753         ret = lxc_safe_uint(value, &lxc_conf->autodev);
1754         if (ret)
1755                 return ret_errno(EINVAL);
1756
1757         if (lxc_conf->autodev > 1)
1758                 return ret_errno(EINVAL);
1759
1760         return 0;
1761 }
1762
1763 static int set_config_autodev_tmpfs_size(const char *key, const char *value,
1764                               struct lxc_conf *lxc_conf, void *data)
1765 {
1766         if (lxc_config_value_empty(value)) {
1767                 lxc_conf->autodevtmpfssize = 500000;
1768                 return 0;
1769         }
1770
1771         if (lxc_safe_int(value, &lxc_conf->autodevtmpfssize) < 0)
1772                 lxc_conf->autodevtmpfssize = 500000;
1773
1774         return 0;
1775 }
1776
1777 static int set_config_signal_halt(const char *key, const char *value,
1778                                  struct lxc_conf *lxc_conf, void *data)
1779 {
1780         int sig_n;
1781
1782         if (lxc_config_value_empty(value)) {
1783                 lxc_conf->haltsignal = 0;
1784                 return 0;
1785         }
1786
1787         sig_n = sig_parse(value);
1788         if (sig_n < 0)
1789                 return ret_errno(EINVAL);
1790
1791         lxc_conf->haltsignal = sig_n;
1792
1793         return 0;
1794 }
1795
1796 static int set_config_signal_reboot(const char *key, const char *value,
1797                                    struct lxc_conf *lxc_conf, void *data)
1798 {
1799         int sig_n;
1800
1801         if (lxc_config_value_empty(value)) {
1802                 lxc_conf->rebootsignal = 0;
1803                 return 0;
1804         }
1805
1806         sig_n = sig_parse(value);
1807         if (sig_n < 0)
1808                 return ret_errno(EINVAL);
1809
1810         lxc_conf->rebootsignal = sig_n;
1811
1812         return 0;
1813 }
1814
1815 static int set_config_signal_stop(const char *key, const char *value,
1816                                  struct lxc_conf *lxc_conf, void *data)
1817 {
1818         int sig_n;
1819
1820         if (lxc_config_value_empty(value)) {
1821                 lxc_conf->stopsignal = 0;
1822                 return 0;
1823         }
1824
1825         sig_n = sig_parse(value);
1826         if (sig_n < 0)
1827                 return ret_errno(EINVAL);
1828
1829         lxc_conf->stopsignal = sig_n;
1830
1831         return 0;
1832 }
1833
1834 static int __set_config_cgroup_controller(const char *key, const char *value,
1835                                           struct lxc_conf *lxc_conf, int version)
1836 {
1837         call_cleaner(free_lxc_cgroup) struct lxc_cgroup *new_cgroup = NULL;
1838         const char *subkey, *token;
1839         size_t token_len;
1840
1841         if (lxc_config_value_empty(value))
1842                 return lxc_clear_cgroups(lxc_conf, key, version);
1843
1844         if (version == CGROUP2_SUPER_MAGIC) {
1845                 token = "lxc.cgroup2.";
1846                 token_len = 12;
1847         } else if (version == CGROUP_SUPER_MAGIC) {
1848                 token = "lxc.cgroup.";
1849                 token_len = 11;
1850         } else {
1851                 return ret_errno(EINVAL);
1852         }
1853
1854         if (!strnequal(key, token, token_len))
1855                 return ret_errno(EINVAL);
1856
1857         subkey = key + token_len;
1858         if (*subkey == '\0')
1859                 return ret_errno(EINVAL);
1860
1861         new_cgroup = zalloc(sizeof(*new_cgroup));
1862         if (!new_cgroup)
1863                 return ret_errno(ENOMEM);
1864
1865         new_cgroup->subsystem = strdup(subkey);
1866         if (!new_cgroup->subsystem)
1867                 return ret_errno(ENOMEM);
1868
1869         new_cgroup->value = strdup(value);
1870         if (!new_cgroup->value)
1871                 return ret_errno(ENOMEM);
1872
1873         new_cgroup->version = version;
1874
1875         if (version == CGROUP2_SUPER_MAGIC)
1876                 list_add_tail(&new_cgroup->head, &lxc_conf->cgroup2);
1877         else
1878                 list_add_tail(&new_cgroup->head, &lxc_conf->cgroup);
1879         move_ptr(new_cgroup);
1880
1881         return 0;
1882 }
1883
1884 static int set_config_cgroup_controller(const char *key, const char *value,
1885                                         struct lxc_conf *lxc_conf, void *data)
1886 {
1887         return __set_config_cgroup_controller(key, value, lxc_conf,
1888                                               CGROUP_SUPER_MAGIC);
1889 }
1890
1891 static int set_config_cgroup2_controller(const char *key, const char *value,
1892                                          struct lxc_conf *lxc_conf, void *data)
1893 {
1894         return __set_config_cgroup_controller(key, value, lxc_conf,
1895                                               CGROUP2_SUPER_MAGIC);
1896 }
1897
1898 static int set_config_cgroup_dir(const char *key, const char *value,
1899                                  struct lxc_conf *lxc_conf, void *data)
1900 {
1901         if (!strequal(key, "lxc.cgroup.dir"))
1902                 return ret_errno(EINVAL);
1903
1904         if (lxc_config_value_empty(value))
1905                 return clr_config_cgroup_dir(key, lxc_conf, NULL);
1906
1907         if (abspath(value))
1908                 return syserror_set(-EINVAL, "%s paths may not be absolute", key);
1909
1910         if (dotdot(value))
1911                 return syserror_set(-EINVAL, "%s paths may not walk upwards via \"../\"", key);
1912
1913         return set_config_path_item(&lxc_conf->cgroup_meta.dir, value);
1914 }
1915
1916 static int set_config_cgroup_monitor_dir(const char *key, const char *value,
1917                                          struct lxc_conf *lxc_conf, void *data)
1918 {
1919         if (lxc_config_value_empty(value))
1920                 return clr_config_cgroup_monitor_dir(key, lxc_conf, NULL);
1921
1922         if (abspath(value))
1923                 return syserror_set(-EINVAL, "%s paths may not be absolute", key);
1924
1925         if (dotdot(value))
1926                 return syserror_set(-EINVAL, "%s paths may not walk upwards via \"../\"", key);
1927
1928         return set_config_path_item(&lxc_conf->cgroup_meta.monitor_dir, value);
1929 }
1930
1931 static int set_config_cgroup_monitor_pivot_dir(const char *key, const char *value,
1932                                          struct lxc_conf *lxc_conf, void *data)
1933 {
1934         if (lxc_config_value_empty(value))
1935                 return clr_config_cgroup_monitor_pivot_dir(key, lxc_conf, NULL);
1936
1937         if (abspath(value))
1938                 return syserror_set(-EINVAL, "%s paths may not be absolute", key);
1939
1940         if (dotdot(value))
1941                 return syserror_set(-EINVAL, "%s paths may not walk upwards via \"../\"", key);
1942
1943         return set_config_path_item(&lxc_conf->cgroup_meta.monitor_pivot_dir, value);
1944 }
1945
1946 static int set_config_cgroup_container_dir(const char *key, const char *value,
1947                                            struct lxc_conf *lxc_conf,
1948                                            void *data)
1949 {
1950         if (lxc_config_value_empty(value))
1951                 return clr_config_cgroup_container_dir(key, lxc_conf, NULL);
1952
1953         if (abspath(value))
1954                 return syserror_set(-EINVAL, "%s paths may not be absolute", key);
1955
1956         if (dotdot(value))
1957                 return syserror_set(-EINVAL, "%s paths may not walk upwards via \"../\"", key);
1958
1959         return set_config_path_item(&lxc_conf->cgroup_meta.container_dir, value);
1960 }
1961
1962 static int set_config_cgroup_container_inner_dir(const char *key,
1963                                                  const char *value,
1964                                                  struct lxc_conf *lxc_conf,
1965                                                  void *data)
1966 {
1967         if (lxc_config_value_empty(value))
1968                 return clr_config_cgroup_container_inner_dir(key, lxc_conf, NULL);
1969
1970         if (abspath(value))
1971                 return syserror_set(-EINVAL, "%s paths may not be absolute", key);
1972
1973         if (strchr(value, '/') || strequal(value, ".") || strequal(value, ".."))
1974                 return log_error_errno(-EINVAL, EINVAL, "lxc.cgroup.dir.container.inner must be a single directory name");
1975
1976         return set_config_string_item(&lxc_conf->cgroup_meta.namespace_dir, value);
1977 }
1978
1979 static int set_config_cgroup_relative(const char *key, const char *value,
1980                                       struct lxc_conf *lxc_conf, void *data)
1981 {
1982         unsigned int converted;
1983         int ret;
1984
1985         if (lxc_config_value_empty(value))
1986                 return clr_config_cgroup_relative(key, lxc_conf, NULL);
1987
1988         ret = lxc_safe_uint(value, &converted);
1989         if (ret)
1990                 return ret;
1991
1992         if (converted == 1) {
1993                 lxc_conf->cgroup_meta.relative = true;
1994                 return 0;
1995         }
1996
1997         if (converted == 0) {
1998                 lxc_conf->cgroup_meta.relative = false;
1999                 return 0;
2000         }
2001
2002         return ret_errno(EINVAL);
2003 }
2004
2005 static bool parse_limit_value(const char **value, rlim_t *res)
2006 {
2007         char *endptr = NULL;
2008
2009         if (strnequal(*value, "unlimited", STRLITERALLEN("unlimited"))) {
2010                 *res = RLIM_INFINITY;
2011                 *value += STRLITERALLEN("unlimited");
2012                 return true;
2013         }
2014
2015         errno = 0;
2016         *res = strtoull(*value, &endptr, 10);
2017         if (errno || !endptr)
2018                 return false;
2019
2020         *value = endptr;
2021
2022         return true;
2023 }
2024
2025 static int set_config_prlimit(const char *key, const char *value,
2026                             struct lxc_conf *lxc_conf, void *data)
2027 {
2028         call_cleaner(free_lxc_limit) struct lxc_limit *new_lim = NULL;
2029         struct rlimit limit;
2030         rlim_t limit_value;
2031         struct lxc_limit *lim;
2032
2033         if (lxc_config_value_empty(value))
2034                 return lxc_clear_limits(lxc_conf, key);
2035
2036         if (!strnequal(key, "lxc.prlimit.", STRLITERALLEN("lxc.prlimit.")))
2037                 return ret_errno(EINVAL);
2038
2039         key += STRLITERALLEN("lxc.prlimit.");
2040
2041         /* soft limit comes first in the value */
2042         if (!parse_limit_value(&value, &limit_value))
2043                 return ret_errno(EINVAL);
2044
2045         limit.rlim_cur = limit_value;
2046
2047         /* skip spaces and a colon */
2048         while (isspace(*value))
2049                 ++value;
2050
2051         if (*value == ':')
2052                 ++value;
2053         else if (*value) /* any other character is an error here */
2054                 return ret_errno(EINVAL);
2055
2056         while (isspace(*value))
2057                 ++value;
2058
2059         /* optional hard limit */
2060         if (*value) {
2061                 if (!parse_limit_value(&value, &limit_value))
2062                         return ret_errno(EINVAL);
2063
2064                 limit.rlim_max = limit_value;
2065
2066                 /* check for trailing garbage */
2067                 while (isspace(*value))
2068                         ++value;
2069
2070                 if (*value)
2071                         return ret_errno(EINVAL);
2072         } else {
2073                 /* a single value sets both hard and soft limit */
2074                 limit.rlim_max = limit.rlim_cur;
2075         }
2076
2077         /* find existing list element */
2078         list_for_each_entry(lim, &lxc_conf->limits, head) {
2079                 if (!strequal(key, lim->resource))
2080                         continue;
2081
2082                 lim->limit = limit;
2083                 return 0;
2084         }
2085
2086         new_lim = zalloc(sizeof(*new_lim));
2087         if (!new_lim)
2088                 return ret_errno(ENOMEM);
2089
2090         new_lim->resource = strdup(key);
2091         if (!new_lim->resource)
2092                 return ret_errno(ENOMEM);
2093
2094         new_lim->limit = limit;
2095         list_add_tail(&new_lim->head, &lxc_conf->limits);
2096         move_ptr(new_lim);
2097
2098         return 0;
2099 }
2100
2101 static int set_config_sysctl(const char *key, const char *value,
2102                             struct lxc_conf *lxc_conf, void *data)
2103 {
2104         call_cleaner(free_lxc_sysctl) struct lxc_sysctl *sysctl_elem = NULL;
2105         struct lxc_sysctl *sysctl, *nsysctl;
2106
2107         if (lxc_config_value_empty(value))
2108                 return clr_config_sysctl(key, lxc_conf, NULL);
2109
2110         if (!strnequal(key, "lxc.sysctl.", STRLITERALLEN("lxc.sysctl.")))
2111                 return ret_errno(EINVAL);
2112
2113         key += STRLITERALLEN("lxc.sysctl.");
2114         if (is_empty_string(key))
2115                 return ret_errno(EINVAL);
2116
2117         /* find existing list element */
2118         list_for_each_entry_safe(sysctl, nsysctl, &lxc_conf->sysctls, head) {
2119                 __do_free char *replace_value = NULL;
2120
2121                 if (!strequal(key, sysctl->key))
2122                         continue;
2123
2124                 replace_value = strdup(value);
2125                 if (!replace_value)
2126                         return ret_errno(EINVAL);
2127
2128                 free(sysctl->value);
2129                 sysctl->value = move_ptr(replace_value);
2130
2131                 return 0;
2132         }
2133
2134         sysctl_elem = zalloc(sizeof(*sysctl_elem));
2135         if (!sysctl_elem)
2136                 return ret_errno(ENOMEM);
2137
2138         sysctl_elem->key = strdup(key);
2139         if (!sysctl_elem->key)
2140                 return ret_errno(ENOMEM);
2141
2142         sysctl_elem->value = strdup(value);
2143         if (!sysctl_elem->value)
2144                 return ret_errno(ENOMEM);
2145
2146         list_add_tail(&sysctl_elem->head, &lxc_conf->sysctls);
2147         move_ptr(sysctl_elem);
2148
2149         return 0;
2150 }
2151
2152 static int set_config_proc(const char *key, const char *value,
2153                             struct lxc_conf *lxc_conf, void *data)
2154 {
2155         call_cleaner(free_lxc_proc) struct lxc_proc *new_proc = NULL;
2156         const char *subkey;
2157
2158         if (lxc_config_value_empty(value))
2159                 return clr_config_proc(key, lxc_conf, NULL);
2160
2161         if (!strnequal(key, "lxc.proc.", STRLITERALLEN("lxc.proc.")))
2162                 return ret_errno(EINVAL);
2163
2164         subkey = key + STRLITERALLEN("lxc.proc.");
2165         if (*subkey == '\0')
2166                 return ret_errno(EINVAL);
2167
2168         new_proc = zalloc(sizeof(*new_proc));
2169         if (!new_proc)
2170                 return ret_errno(ENOMEM);
2171
2172         new_proc->filename = strdup(subkey);
2173         if (!new_proc->filename)
2174                 return ret_errno(ENOMEM);
2175
2176         new_proc->value = strdup(value);
2177         if (!new_proc->value)
2178                 return ret_errno(ENOMEM);
2179
2180         list_add_tail(&new_proc->head, &lxc_conf->procs);
2181         move_ptr(new_proc);
2182
2183         return 0;
2184 }
2185
2186 static int set_config_idmaps(const char *key, const char *value,
2187                              struct lxc_conf *lxc_conf, void *data)
2188 {
2189         __do_free struct id_map *idmap = NULL;
2190         unsigned long hostid, nsid, range;
2191         char type;
2192         int ret;
2193
2194         if (lxc_config_value_empty(value))
2195                 return lxc_clear_idmaps(lxc_conf);
2196
2197         idmap = zalloc(sizeof(*idmap));
2198         if (!idmap)
2199                 return ret_errno(ENOMEM);
2200
2201         ret = parse_idmaps(value, &type, &nsid, &hostid, &range);
2202         if (ret < 0)
2203                 return log_error_errno(-EINVAL, EINVAL, "Failed to parse id mappings");
2204
2205         INFO("Read uid map: type %c nsid %lu hostid %lu range %lu", type, nsid, hostid, range);
2206         if (type == 'u')
2207                 idmap->idtype = ID_TYPE_UID;
2208         else if (type == 'g')
2209                 idmap->idtype = ID_TYPE_GID;
2210         else
2211                 return ret_errno(EINVAL);
2212
2213         idmap->hostid = hostid;
2214         idmap->nsid = nsid;
2215         idmap->range = range;
2216         list_add_tail(&idmap->head, &lxc_conf->id_map);
2217
2218         if (!lxc_conf->root_nsuid_map && idmap->idtype == ID_TYPE_UID)
2219                 if (idmap->nsid == 0)
2220                         lxc_conf->root_nsuid_map = idmap;
2221
2222         if (!lxc_conf->root_nsgid_map && idmap->idtype == ID_TYPE_GID)
2223                 if (idmap->nsid == 0)
2224                         lxc_conf->root_nsgid_map = idmap;
2225
2226         move_ptr(idmap);
2227
2228         return 0;
2229 }
2230
2231 static int set_config_mount_fstab(const char *key, const char *value,
2232                                   struct lxc_conf *lxc_conf, void *data)
2233 {
2234         if (lxc_config_value_empty(value)) {
2235                 clr_config_mount_fstab(key, lxc_conf, NULL);
2236                 return ret_errno(EINVAL);
2237         }
2238
2239         return set_config_path_item(&lxc_conf->fstab, value);
2240 }
2241
2242 static int set_config_mount_auto(const char *key, const char *value,
2243                                  struct lxc_conf *lxc_conf, void *data)
2244 {
2245         __do_free char *autos = NULL;
2246         char *token;
2247         int i;
2248         static struct {
2249                 const char *token;
2250                 int mask;
2251                 int flag;
2252         } allowed_auto_mounts[] = {
2253                 { "proc",                       LXC_AUTO_PROC_MASK,     LXC_AUTO_PROC_MIXED                                     },
2254                 { "proc:mixed",                 LXC_AUTO_PROC_MASK,     LXC_AUTO_PROC_MIXED                                     },
2255                 { "proc:rw",                    LXC_AUTO_PROC_MASK,     LXC_AUTO_PROC_RW                                        },
2256                 { "sys",                        LXC_AUTO_SYS_MASK,      LXC_AUTO_SYS_MIXED                                      },
2257                 { "sys:ro",                     LXC_AUTO_SYS_MASK,      LXC_AUTO_SYS_RO                                         },
2258                 { "sys:mixed",                  LXC_AUTO_SYS_MASK,      LXC_AUTO_SYS_MIXED                                      },
2259                 { "sys:rw",                     LXC_AUTO_SYS_MASK,      LXC_AUTO_SYS_RW                                         },
2260                 { "cgroup",                     LXC_AUTO_CGROUP_MASK,   LXC_AUTO_CGROUP_NOSPEC                                  },
2261                 { "cgroup:mixed",               LXC_AUTO_CGROUP_MASK,   LXC_AUTO_CGROUP_MIXED                                   },
2262                 { "cgroup:ro",                  LXC_AUTO_CGROUP_MASK,   LXC_AUTO_CGROUP_RO                                      },
2263                 { "cgroup:rw",                  LXC_AUTO_CGROUP_MASK,   LXC_AUTO_CGROUP_RW                                      },
2264                 { "cgroup:force",               LXC_AUTO_CGROUP_MASK,   LXC_AUTO_CGROUP_NOSPEC | LXC_AUTO_CGROUP_FORCE          },
2265                 { "cgroup:mixed:force",         LXC_AUTO_CGROUP_MASK,   LXC_AUTO_CGROUP_MIXED | LXC_AUTO_CGROUP_FORCE           },
2266                 { "cgroup:ro:force",            LXC_AUTO_CGROUP_MASK,   LXC_AUTO_CGROUP_RO | LXC_AUTO_CGROUP_FORCE              },
2267                 { "cgroup:rw:force",            LXC_AUTO_CGROUP_MASK,   LXC_AUTO_CGROUP_RW | LXC_AUTO_CGROUP_FORCE              },
2268                 { "cgroup-full",                LXC_AUTO_CGROUP_MASK,   LXC_AUTO_CGROUP_FULL_NOSPEC                             },
2269                 { "cgroup-full:mixed",          LXC_AUTO_CGROUP_MASK,   LXC_AUTO_CGROUP_FULL_MIXED                              },
2270                 { "cgroup-full:ro",             LXC_AUTO_CGROUP_MASK,   LXC_AUTO_CGROUP_FULL_RO                                 },
2271                 { "cgroup-full:rw",             LXC_AUTO_CGROUP_MASK,   LXC_AUTO_CGROUP_FULL_RW                                 },
2272                 { "cgroup-full:force",          LXC_AUTO_CGROUP_MASK,   LXC_AUTO_CGROUP_FULL_NOSPEC | LXC_AUTO_CGROUP_FORCE     },
2273                 { "cgroup-full:mixed:force",    LXC_AUTO_CGROUP_MASK,   LXC_AUTO_CGROUP_FULL_MIXED | LXC_AUTO_CGROUP_FORCE      },
2274                 { "cgroup-full:ro:force",       LXC_AUTO_CGROUP_MASK,   LXC_AUTO_CGROUP_FULL_RO | LXC_AUTO_CGROUP_FORCE         },
2275                 { "cgroup-full:rw:force",       LXC_AUTO_CGROUP_MASK,   LXC_AUTO_CGROUP_FULL_RW | LXC_AUTO_CGROUP_FORCE         },
2276                 { "shmounts:",                  LXC_AUTO_SHMOUNTS_MASK, LXC_AUTO_SHMOUNTS                                       },
2277                 /*
2278                  * For adding anything that is just a single on/off, but has no
2279                  * options: keep mask and flag identical and just define the
2280                  * enum value as an unused bit so far
2281                  */
2282                 { NULL,                         0,                      0                                                       }
2283         };
2284
2285         if (lxc_config_value_empty(value)) {
2286                 lxc_conf->auto_mounts = 0;
2287                 return 0;
2288         }
2289
2290         autos = strdup(value);
2291         if (!autos)
2292                 return ret_errno(ENOMEM);
2293
2294         lxc_iterate_parts(token, autos, " \t") {
2295                 bool is_shmounts = false;
2296
2297                 for (i = 0; allowed_auto_mounts[i].token; i++) {
2298                         if (strequal(allowed_auto_mounts[i].token, token))
2299                                 break;
2300
2301                         if (strequal("shmounts:", allowed_auto_mounts[i].token) &&
2302                             strnequal("shmounts:", token, STRLITERALLEN("shmounts:"))) {
2303                                 is_shmounts = true;
2304                                 break;
2305                         }
2306                 }
2307
2308                 if (!allowed_auto_mounts[i].token)
2309                         return log_error_errno(-EINVAL, EINVAL, "Invalid filesystem to automount \"%s\"", token);
2310
2311                 lxc_conf->auto_mounts &= ~allowed_auto_mounts[i].mask;
2312                 lxc_conf->auto_mounts |= allowed_auto_mounts[i].flag;
2313
2314                 if (is_shmounts) {
2315                         __do_free char *container_path = NULL, *host_path = NULL;
2316                         char *val;
2317
2318                         val = token + STRLITERALLEN("shmounts:");
2319                         if (*val == '\0')
2320                                 return log_error_errno(-EINVAL, EINVAL, "Failed to copy shmounts host path");
2321
2322                         host_path = strdup(val);
2323                         if (!host_path)
2324                                 return log_error_errno(-EINVAL, EINVAL, "Failed to copy shmounts host path");
2325
2326                         val = strchr(host_path, ':');
2327                         if (!val || *(val + 1) == '\0')
2328                                 val = "/dev/.lxc-mounts";
2329                         else
2330                                 *val++ = '\0';
2331
2332                         container_path = strdup(val);
2333                         if(!container_path)
2334                                 return log_error_errno(-EINVAL, EINVAL, "Failed to copy shmounts container path");
2335
2336                         free_disarm(lxc_conf->shmount.path_host);
2337                         lxc_conf->shmount.path_host = move_ptr(host_path);
2338
2339                         free_disarm(lxc_conf->shmount.path_cont);
2340                         lxc_conf->shmount.path_cont = move_ptr(container_path);
2341                 }
2342         }
2343
2344         return 0;
2345 }
2346
2347 static int set_config_mount(const char *key, const char *value,
2348                             struct lxc_conf *lxc_conf, void *data)
2349 {
2350         __do_free char *mntelem = NULL;
2351         __do_free struct lxc_list *mntlist = NULL;
2352
2353         if (lxc_config_value_empty(value))
2354                 return lxc_clear_mount_entries(lxc_conf);
2355
2356         mntlist = lxc_list_new();
2357         if (!mntlist)
2358                 return ret_errno(ENOMEM);
2359
2360         mntelem = strdup(value);
2361         if (!mntelem)
2362                 return ret_errno(ENOMEM);
2363
2364         mntlist->elem = move_ptr(mntelem);
2365         lxc_list_add_tail(&lxc_conf->mount_list, move_ptr(mntlist));
2366
2367         return 0;
2368 }
2369
2370 int add_elem_to_mount_list(const char *value, struct lxc_conf *lxc_conf) {
2371         return set_config_mount(NULL, value, lxc_conf, NULL);
2372 }
2373
2374 static int add_cap_entry(struct lxc_conf *conf, char *caps, bool keep)
2375 {
2376         char *token;
2377
2378         /*
2379          * In case several capability keep is specified in a single line split
2380          * these caps in a single element for the list.
2381          */
2382         lxc_iterate_parts(token, caps, " \t") {
2383                 __do_free struct cap_entry *new_cap = NULL;
2384                 int cap;
2385
2386                 if (strequal(token, "none")) {
2387                         if (!keep)
2388                                 return syserror_set(-EINVAL, "The \"none\" keyword is only valid when keeping caps");
2389
2390                         lxc_clear_config_caps(conf);
2391                         continue;
2392                 }
2393
2394                 cap = parse_cap(token);
2395                 if (cap < 0) {
2396                         if (cap != -2)
2397                                 return syserror_set(-EINVAL, "Invalid capability specified");
2398
2399                         INFO("Ignoring unknown capability \"%s\"", token);
2400                         continue;
2401                 }
2402
2403                 new_cap = zalloc(sizeof(struct cap_entry));
2404                 if (!new_cap)
2405                         return ret_errno(ENOMEM);
2406
2407                 new_cap->cap_name = strdup(token);
2408                 if (!new_cap->cap_name)
2409                         return ret_errno(ENOMEM);
2410                 new_cap->cap = cap;
2411
2412                 list_add_tail(&new_cap->head, &conf->caps.list);
2413                 move_ptr(new_cap);
2414         }
2415
2416         return 0;
2417 }
2418
2419 static int set_config_cap_keep(const char *key, const char *value,
2420                                struct lxc_conf *lxc_conf, void *data)
2421 {
2422         __do_free char *caps = NULL;
2423         int ret;
2424
2425         if (lxc_config_value_empty(value))
2426                 return lxc_clear_config_caps(lxc_conf);
2427
2428         caps = strdup(value);
2429         if (!caps)
2430                 return ret_errno(ENOMEM);
2431
2432         if (!lxc_conf->caps.keep && !list_empty(&lxc_conf->caps.list))
2433                 return syserror_set(-EINVAL, "Keeping and dropping capabilities are mutually exclusive");
2434
2435         ret = add_cap_entry(lxc_conf, caps, true);
2436         if (ret < 0)
2437                 return ret;
2438
2439         lxc_conf->caps.keep = true;
2440         return 0;
2441 }
2442
2443 static int set_config_cap_drop(const char *key, const char *value,
2444                                struct lxc_conf *lxc_conf, void *data)
2445 {
2446         __do_free char *caps = NULL;
2447         int ret;
2448
2449         if (lxc_config_value_empty(value))
2450                 return lxc_clear_config_caps(lxc_conf);
2451
2452         if (lxc_conf->caps.keep)
2453                 return syserror_set(-EINVAL, "Keeping and dropping capabilities are mutually exclusive");
2454
2455         caps = strdup(value);
2456         if (!caps)
2457                 return ret_errno(ENOMEM);
2458
2459         ret = add_cap_entry(lxc_conf, caps, false);
2460         if (ret < 0)
2461                 return ret;
2462
2463         lxc_conf->caps.keep = false;
2464         return 0;
2465 }
2466
2467 static int set_config_console_path(const char *key, const char *value,
2468                                    struct lxc_conf *lxc_conf, void *data)
2469 {
2470         return set_config_path_item(&lxc_conf->console.path, value);
2471 }
2472
2473 static int set_config_console_rotate(const char *key, const char *value,
2474                                      struct lxc_conf *lxc_conf, void *data)
2475 {
2476         int ret;
2477
2478         if (lxc_config_value_empty(value)) {
2479                 lxc_conf->console.log_rotate = 0;
2480                 return 0;
2481         }
2482
2483         ret = lxc_safe_uint(value, &lxc_conf->console.log_rotate);
2484         if (ret)
2485                 return ret_errno(EINVAL);
2486
2487         if (lxc_conf->console.log_rotate > 1)
2488                 return log_error_errno(-EINVAL, EINVAL, "The \"lxc.console.rotate\" config key can only be set to 0 or 1");
2489
2490         return 0;
2491 }
2492
2493 static int set_config_console_logfile(const char *key, const char *value,
2494                                       struct lxc_conf *lxc_conf, void *data)
2495 {
2496         return set_config_path_item(&lxc_conf->console.log_path, value);
2497 }
2498
2499 static int set_config_console_buffer_size(const char *key, const char *value,
2500                                           struct lxc_conf *lxc_conf, void *data)
2501 {
2502         int ret;
2503         long long int size;
2504         uint64_t buffer_size, pgsz;
2505
2506         if (lxc_config_value_empty(value)) {
2507                 lxc_conf->console.buffer_size = 0;
2508                 return 0;
2509         }
2510
2511         /* If the user specified "auto" the default log size is 2^17 = 128 Kib */
2512         if (strequal(value, "auto")) {
2513                 lxc_conf->console.buffer_size = 1 << 17;
2514                 return 0;
2515         }
2516
2517         ret = parse_byte_size_string(value, &size);
2518         if (ret)
2519                 return ret;
2520
2521         if (size < 0)
2522                 return ret_errno(EINVAL);
2523
2524         /* must be at least a page size */
2525         pgsz = lxc_getpagesize();
2526         if ((uint64_t)size < pgsz) {
2527                 NOTICE("Requested ringbuffer size for the console is %lld but must be at least %" PRId64 " bytes. Setting ringbuffer size to %" PRId64 " bytes",
2528                        size, pgsz, pgsz);
2529                 size = pgsz;
2530         }
2531
2532         buffer_size = lxc_find_next_power2((uint64_t)size);
2533         if (buffer_size == 0)
2534                 return ret_errno(EINVAL);
2535
2536         if (buffer_size != size)
2537                 NOTICE("Passed size was not a power of 2. Rounding log size to next power of two: %" PRIu64 " bytes", buffer_size);
2538
2539         lxc_conf->console.buffer_size = buffer_size;
2540
2541         return 0;
2542 }
2543
2544 static int set_config_console_size(const char *key, const char *value,
2545                                    struct lxc_conf *lxc_conf, void *data)
2546 {
2547         int ret;
2548         long long int size;
2549         uint64_t log_size, pgsz;
2550
2551         if (lxc_config_value_empty(value)) {
2552                 lxc_conf->console.log_size = 0;
2553                 return 0;
2554         }
2555
2556         /* If the user specified "auto" the default log size is 2^17 = 128 Kib */
2557         if (strequal(value, "auto")) {
2558                 lxc_conf->console.log_size = 1 << 17;
2559                 return 0;
2560         }
2561
2562         ret = parse_byte_size_string(value, &size);
2563         if (ret)
2564                 return ret_errno(EINVAL);
2565
2566         if (size < 0)
2567                 return ret_errno(EINVAL);
2568
2569         /* must be at least a page size */
2570         pgsz = lxc_getpagesize();
2571         if ((uint64_t)size < pgsz) {
2572                 NOTICE("Requested ringbuffer size for the console is %lld but must be at least %" PRId64 " bytes. Setting ringbuffer size to %" PRId64 " bytes",
2573                        size, pgsz, pgsz);
2574                 size = pgsz;
2575         }
2576
2577         log_size = lxc_find_next_power2((uint64_t)size);
2578         if (log_size == 0)
2579                 return ret_errno(EINVAL);
2580
2581         if (log_size != size)
2582                 NOTICE("Passed size was not a power of 2. Rounding log size to next power of two: %" PRIu64 " bytes", log_size);
2583
2584         lxc_conf->console.log_size = log_size;
2585
2586         return 0;
2587 }
2588
2589 /*
2590  * If we find a lxc.net.[i].hwaddr or lxc.network.hwaddr in the original config
2591  * file, we expand it in the unexpanded_config, so that after a save_config we
2592  * store the hwaddr for re-use.
2593  * This is only called when reading the config file, not when executing a
2594  * lxc.include.
2595  * 'x' and 'X' are substituted in-place.
2596  */
2597 static void update_hwaddr(const char *line)
2598 {
2599         char *p;
2600
2601         line += lxc_char_left_gc(line, strlen(line));
2602         if (line[0] == '#')
2603                 return;
2604
2605         if (!lxc_config_net_is_hwaddr(line))
2606                 return;
2607
2608         /* Let config_net_hwaddr raise the error. */
2609         p = strchr(line, '=');
2610         if (!p)
2611                 return;
2612         p++;
2613
2614         while (isblank(*p))
2615                 p++;
2616
2617         if (!*p)
2618                 return;
2619
2620         rand_complete_hwaddr(p);
2621 }
2622
2623 int append_unexp_config_line(const char *line, struct lxc_conf *conf)
2624 {
2625         size_t linelen;
2626         size_t len = conf->unexpanded_len;
2627
2628         update_hwaddr(line);
2629
2630         linelen = strlen(line);
2631         while (conf->unexpanded_alloced <= len + linelen + 2) {
2632                 char *tmp;
2633
2634                 tmp = realloc(conf->unexpanded_config, conf->unexpanded_alloced + 1024);
2635                 if (!tmp)
2636                         return ret_errno(EINVAL);
2637
2638                 if (!conf->unexpanded_config)
2639                         *tmp = '\0';
2640
2641                 conf->unexpanded_config = tmp;
2642                 conf->unexpanded_alloced += 1024;
2643         }
2644
2645         memcpy(conf->unexpanded_config + conf->unexpanded_len, line, linelen);
2646         conf->unexpanded_len += linelen;
2647         if (line[linelen - 1] != '\n')
2648                 conf->unexpanded_config[conf->unexpanded_len++] = '\n';
2649         conf->unexpanded_config[conf->unexpanded_len] = '\0';
2650
2651         return 0;
2652 }
2653
2654 static int do_includedir(const char *dirp, struct lxc_conf *lxc_conf)
2655 {
2656         __do_closedir DIR *dir = NULL;
2657         struct dirent *direntp;
2658         int len, ret;
2659
2660         dir = opendir(dirp);
2661         if (!dir)
2662                 return errno == ENOENT ? 0 : -errno;
2663
2664         while ((direntp = readdir(dir))) {
2665                 const char *fnam;
2666                 char path[PATH_MAX];
2667
2668                 fnam = direntp->d_name;
2669                 if (strequal(fnam, "."))
2670                         continue;
2671
2672                 if (strequal(fnam, ".."))
2673                         continue;
2674
2675                 len = strlen(fnam);
2676                 if (len < 6 || !strnequal(fnam + len - 5, ".conf", 5))
2677                         continue;
2678
2679                 len = strnprintf(path, sizeof(path), "%s/%s", dirp, fnam);
2680                 if (len < 0)
2681                         return ret_errno(EIO);
2682
2683                 ret = lxc_config_read(path, lxc_conf, true);
2684                 if (ret < 0)
2685                         return ret;
2686         }
2687
2688         return 0;
2689 }
2690
2691 static int set_config_includefiles(const char *key, const char *value,
2692                                    struct lxc_conf *lxc_conf, void *data)
2693 {
2694         if (lxc_config_value_empty(value)) {
2695                 clr_config_includefiles(key, lxc_conf, NULL);
2696                 return 0;
2697         }
2698
2699         if (value[strlen(value)-1] == '/' || is_dir(value))
2700                 return do_includedir(value, lxc_conf);
2701
2702         return lxc_config_read(value, lxc_conf, true);
2703 }
2704
2705 static int set_config_rootfs_path(const char *key, const char *value,
2706                                   struct lxc_conf *lxc_conf, void *data)
2707 {
2708         __do_free char *dup = NULL;
2709         int ret;
2710         char *tmp;
2711         const char *container_path;
2712
2713         if (lxc_config_value_empty(value)) {
2714                 free(lxc_conf->rootfs.path);
2715                 lxc_conf->rootfs.path = NULL;
2716                 return 0;
2717         }
2718
2719         dup = strdup(value);
2720         if (!dup)
2721                 return ret_errno(ENOMEM);
2722
2723         /* Split <storage type>:<container path> into <storage type> and
2724          * <container path>. Set "rootfs.bdev_type" to <storage type> and
2725          * "rootfs.path" to <container path>.
2726          */
2727         tmp = strchr(dup, ':');
2728         if (tmp) {
2729                 *tmp = '\0';
2730
2731                 ret = set_config_path_item(&lxc_conf->rootfs.bdev_type, dup);
2732                 if (ret < 0)
2733                         return ret_errno(ENOMEM);
2734
2735                 tmp++;
2736                 container_path = tmp;
2737         } else {
2738                 container_path = value;
2739         }
2740
2741         return set_config_path_item(&lxc_conf->rootfs.path, container_path);
2742 }
2743
2744 static int set_config_rootfs_managed(const char *key, const char *value,
2745                                      struct lxc_conf *lxc_conf, void *data)
2746 {
2747         return set_config_bool_item(&lxc_conf->rootfs.managed, value, true);
2748 }
2749
2750 static int set_config_rootfs_mount(const char *key, const char *value,
2751                                    struct lxc_conf *lxc_conf, void *data)
2752 {
2753         return set_config_path_item(&lxc_conf->rootfs.mount, value);
2754 }
2755
2756 static int set_config_rootfs_options(const char *key, const char *value,
2757                                      struct lxc_conf *lxc_conf, void *data)
2758 {
2759         __do_free char *dup = NULL, *raw_options = NULL;
2760         struct lxc_rootfs *rootfs = &lxc_conf->rootfs;
2761         struct lxc_mount_options *mnt_opts = &rootfs->mnt_opts;
2762         int ret;
2763
2764         clr_config_rootfs_options(key, lxc_conf, data);
2765         if (lxc_config_value_empty(value))
2766                 return 0;
2767
2768         ret = set_config_string_item(&raw_options, value);
2769         if (ret < 0)
2770                 return ret_errno(ENOMEM);
2771
2772         dup = strdup(value);
2773         if (!dup)
2774                 return -ENOMEM;
2775
2776         ret = parse_lxc_mount_attrs(mnt_opts, dup);
2777         if (ret < 0)
2778                 return ret;
2779
2780         /* Make sure we're only valid LXC specific mount options. */
2781         if (mnt_opts->create_dir || mnt_opts->create_file ||
2782             mnt_opts->optional || mnt_opts->relative)
2783                 return syserror_set(-EINVAL, "Invalid LXC specific mount option for rootfs mount");
2784
2785         ret = parse_mount_attrs(mnt_opts, dup);
2786         if (ret < 0)
2787                 return ret_errno(EINVAL);
2788
2789         rootfs->mnt_opts.raw_options = move_ptr(raw_options);
2790         return 0;
2791 }
2792
2793 static int set_config_uts_name(const char *key, const char *value,
2794                               struct lxc_conf *lxc_conf, void *data)
2795 {
2796         __do_free struct utsname *utsname = NULL;
2797
2798         if (lxc_config_value_empty(value)) {
2799                 clr_config_uts_name(key, lxc_conf, NULL);
2800                 return 0;
2801         }
2802
2803         utsname = zalloc(sizeof(*utsname));
2804         if (!utsname)
2805                 return ret_errno(ENOMEM);
2806
2807         if (strlen(value) >= sizeof(utsname->nodename))
2808                 return ret_errno(EINVAL);
2809
2810         (void)strlcpy(utsname->nodename, value, sizeof(utsname->nodename));
2811         free(lxc_conf->utsname);
2812         lxc_conf->utsname = move_ptr(utsname);
2813
2814         return 0;
2815 }
2816
2817 static int set_config_namespace_clone(const char *key, const char *value,
2818                                       struct lxc_conf *lxc_conf, void *data)
2819 {
2820         __do_free char *ns = NULL;
2821         char *token;
2822         int cloneflag = 0;
2823
2824         if (lxc_config_value_empty(value))
2825                 return clr_config_namespace_clone(key, lxc_conf, data);
2826
2827         if (lxc_conf->ns_keep != 0)
2828                 return log_error_errno(-EINVAL, EINVAL, "Cannot set both \"lxc.namespace.clone\" and \"lxc.namespace.keep\"");
2829
2830         ns = strdup(value);
2831         if (!ns)
2832                 return ret_errno(ENOMEM);
2833
2834         lxc_iterate_parts(token, ns, " \t") {
2835                 token += lxc_char_left_gc(token, strlen(token));
2836                 token[lxc_char_right_gc(token, strlen(token))] = '\0';
2837                 cloneflag = lxc_namespace_2_cloneflag(token);
2838                 if (cloneflag < 0)
2839                         return ret_errno(EINVAL);
2840                 lxc_conf->ns_clone |= cloneflag;
2841         }
2842
2843         return 0;
2844 }
2845
2846 static int set_config_namespace_keep(const char *key, const char *value,
2847                                      struct lxc_conf *lxc_conf, void *data)
2848 {
2849         __do_free char *ns = NULL;
2850         char *token;
2851         int cloneflag = 0;
2852
2853         if (lxc_config_value_empty(value))
2854                 return clr_config_namespace_keep(key, lxc_conf, data);
2855
2856         if (lxc_conf->ns_clone != 0)
2857                 return log_error_errno(-EINVAL, EINVAL, "Cannot set both \"lxc.namespace.clone\" and \"lxc.namespace.keep\"");
2858
2859         ns = strdup(value);
2860         if (!ns)
2861                 return ret_errno(ENOMEM);
2862
2863         lxc_iterate_parts(token, ns, " \t") {
2864                 token += lxc_char_left_gc(token, strlen(token));
2865                 token[lxc_char_right_gc(token, strlen(token))] = '\0';
2866                 cloneflag = lxc_namespace_2_cloneflag(token);
2867                 if (cloneflag < 0)
2868                         return ret_errno(EINVAL);
2869                 lxc_conf->ns_keep |= cloneflag;
2870         }
2871
2872         return 0;
2873 }
2874
2875 static int set_config_time_offset_boot(const char *key, const char *value,
2876                                        struct lxc_conf *lxc_conf, void *data)
2877 {
2878         int ret;
2879         char *unit;
2880         int64_t offset = 0;
2881         char buf[STRLITERALLEN("ms") + 1];
2882
2883         if (lxc_config_value_empty(value))
2884                 return clr_config_time_offset_boot(key, lxc_conf, data);
2885
2886         ret = lxc_safe_int64_residual(value, &offset, 10, buf, sizeof(buf));
2887         if (ret)
2888                 return ret;
2889
2890         unit = lxc_trim_whitespace_in_place(buf);
2891         if (strequal(unit, "h")) {
2892                 if (!multiply_overflow(offset, 3600, &lxc_conf->timens.s_boot))
2893                         return ret_errno(EOVERFLOW);
2894         } else if (strequal(unit, "m")) {
2895                 if (!multiply_overflow(offset, 60, &lxc_conf->timens.s_boot))
2896                         return ret_errno(EOVERFLOW);
2897         } else if (strequal(unit, "s")) {
2898                 lxc_conf->timens.s_boot = offset;
2899         } else if (strequal(unit, "ms")) {
2900                 if (!multiply_overflow(offset, 1000000, &lxc_conf->timens.ns_boot))
2901                         return ret_errno(EOVERFLOW);
2902         } else if (strequal(unit, "us")) {
2903                 if (!multiply_overflow(offset, 1000, &lxc_conf->timens.ns_boot))
2904                         return ret_errno(EOVERFLOW);
2905         } else if (strequal(unit, "ns")) {
2906                 lxc_conf->timens.ns_boot = offset;
2907         } else {
2908                 return ret_errno(EINVAL);
2909         }
2910
2911         return 0;
2912 }
2913
2914 static int set_config_time_offset_monotonic(const char *key, const char *value,
2915                                             struct lxc_conf *lxc_conf, void *data)
2916 {
2917         int ret;
2918         char *unit;
2919         int64_t offset = 0;
2920         char buf[STRLITERALLEN("ms") + 1];
2921
2922         if (lxc_config_value_empty(value))
2923                 return clr_config_time_offset_monotonic(key, lxc_conf, data);
2924
2925         ret = lxc_safe_int64_residual(value, &offset, 10, buf, sizeof(buf));
2926         if (ret)
2927                 return ret;
2928
2929         unit = lxc_trim_whitespace_in_place(buf);
2930         if (strequal(unit, "h")) {
2931                 if (!multiply_overflow(offset, 3600, &lxc_conf->timens.s_monotonic))
2932                         return ret_errno(EOVERFLOW);
2933         } else if (strequal(unit, "m")) {
2934                 if (!multiply_overflow(offset, 60, &lxc_conf->timens.s_monotonic))
2935                         return ret_errno(EOVERFLOW);
2936         } else if (strequal(unit, "s")) {
2937                 lxc_conf->timens.s_monotonic = offset;
2938         } else if (strequal(unit, "ms")) {
2939                 if (!multiply_overflow(offset, 1000000, &lxc_conf->timens.ns_monotonic))
2940                         return ret_errno(EOVERFLOW);
2941         } else if (strequal(unit, "us")) {
2942                 if (!multiply_overflow(offset, 1000, &lxc_conf->timens.ns_monotonic))
2943                         return ret_errno(EOVERFLOW);
2944         } else if (strequal(unit, "ns")) {
2945                 lxc_conf->timens.ns_monotonic = offset;
2946         } else {
2947                 return ret_errno(EINVAL);
2948         }
2949
2950         return 0;
2951 }
2952
2953 static int set_config_namespace_share(const char *key, const char *value,
2954                                       struct lxc_conf *lxc_conf, void *data)
2955 {
2956         int ns_idx;
2957         const char *namespace;
2958
2959         if (lxc_config_value_empty(value))
2960                 return clr_config_namespace_share(key, lxc_conf, data);
2961
2962         namespace = key + STRLITERALLEN("lxc.namespace.share.");
2963         if (is_empty_string(namespace))
2964                 return ret_errno(EINVAL);
2965
2966         ns_idx = lxc_namespace_2_ns_idx(namespace);
2967         if (ns_idx < 0)
2968                 return ns_idx;
2969
2970         return set_config_string_item(&lxc_conf->ns_share[ns_idx], value);
2971 }
2972
2973 struct parse_line_conf {
2974         struct lxc_conf *conf;
2975         bool from_include;
2976 };
2977
2978 static int parse_line(char *buffer, void *data)
2979 {
2980         __do_free char *linep = NULL;
2981         char *dot, *key, *line, *value;
2982         bool empty_line;
2983         struct lxc_config_t *config;
2984         int ret;
2985         char *dup = buffer;
2986         struct parse_line_conf *plc = data;
2987
2988         if (!plc->conf)
2989                 return syserror_set(-EINVAL, "Missing config");
2990
2991         /* If there are newlines in the config file we should keep them. */
2992         empty_line = lxc_is_line_empty(dup);
2993         if (empty_line)
2994                 dup = "\n";
2995
2996         /* We have to dup the buffer otherwise, at the re-exec for reboot we
2997          * modified the original string on the stack by replacing '=' by '\0'
2998          * below.
2999          */
3000         linep = line = strdup(dup);
3001         if (!line)
3002                 return ret_errno(ENOMEM);
3003
3004         if (!plc->from_include) {
3005                 ret = append_unexp_config_line(line, plc->conf);
3006                 if (ret < 0)
3007                         return ret;
3008         }
3009
3010         if (empty_line)
3011                 return 0;
3012
3013         line += lxc_char_left_gc(line, strlen(line));
3014
3015         /* ignore comments */
3016         if (line[0] == '#')
3017                 return 0;
3018
3019         /* martian option - don't add it to the config itself */
3020         if (!strnequal(line, "lxc.", 4))
3021                 return 0;
3022
3023         dot = strchr(line, '=');
3024         if (!dot)
3025                 return log_error_errno(-EINVAL, EINVAL, "Invalid configuration line: %s", line);
3026
3027         *dot = '\0';
3028         value = dot + 1;
3029
3030         key = line;
3031         key[lxc_char_right_gc(key, strlen(key))] = '\0';
3032
3033         value += lxc_char_left_gc(value, strlen(value));
3034         value[lxc_char_right_gc(value, strlen(value))] = '\0';
3035
3036         if (*value == '\'' || *value == '\"') {
3037                 size_t len;
3038
3039                 len = strlen(value);
3040                 if (len > 1 && value[len - 1] == *value) {
3041                         value[len - 1] = '\0';
3042                         value++;
3043                 }
3044         }
3045
3046         config = lxc_get_config(key);
3047         return config->set(key, value, plc->conf, NULL);
3048 }
3049
3050 static struct new_config_item *parse_new_conf_line(char *buffer)
3051 {
3052         __do_free char *k = NULL, *linep = NULL, *v = NULL;
3053         __do_free struct new_config_item *new = NULL;
3054         char *dup = buffer;
3055         char *dot, *key, *line, *value;
3056
3057         if (is_empty_string(buffer))
3058                 return log_error_errno(NULL, EINVAL, "Empty configuration line");
3059
3060         linep = line = strdup(dup);
3061         if (!line)
3062                 return NULL;
3063
3064         line += lxc_char_left_gc(line, strlen(line));
3065
3066         /* martian option - don't add it to the config itself */
3067         if (!strnequal(line, "lxc.", 4))
3068                 return 0;
3069
3070         dot = strchr(line, '=');
3071         if (!dot)
3072                 return log_error_errno(NULL, EINVAL, "Invalid configuration line: %s", line);
3073
3074         *dot = '\0';
3075         value = dot + 1;
3076
3077         key = line;
3078         key[lxc_char_right_gc(key, strlen(key))] = '\0';
3079
3080         value += lxc_char_left_gc(value, strlen(value));
3081         value[lxc_char_right_gc(value, strlen(value))] = '\0';
3082
3083         if (*value == '\'' || *value == '\"') {
3084                 size_t len;
3085
3086                 len = strlen(value);
3087                 if (len > 1 && value[len - 1] == *value) {
3088                         value[len - 1] = '\0';
3089                         value++;
3090                 }
3091         }
3092
3093         new = zalloc(sizeof(struct new_config_item));
3094         if (!new)
3095                 return NULL;
3096
3097         k = strdup(key);
3098         if (!k)
3099                 return NULL;
3100
3101         v = strdup(value);
3102         if (!v)
3103                 return NULL;
3104
3105         new->key = move_ptr(k);
3106         new->val = move_ptr(v);
3107         return move_ptr(new);
3108 }
3109
3110 int lxc_config_read(const char *file, struct lxc_conf *conf, bool from_include)
3111 {
3112         struct parse_line_conf plc;
3113
3114         if (!conf)
3115                 return syserror_set(-EINVAL, "Missing config");
3116
3117         plc.conf = conf;
3118         plc.from_include = from_include;
3119
3120         /* Catch only the top level config file name in the structure. */
3121         if (!conf->rcfile)
3122                 conf->rcfile = strdup(file);
3123
3124         return lxc_file_for_each_line_mmap(file, parse_line, &plc);
3125 }
3126
3127 int lxc_config_define_add(struct lxc_list *defines, char *arg)
3128 {
3129         __do_free struct lxc_list *dent = NULL;
3130
3131         dent = lxc_list_new();
3132         if (!dent)
3133                 return ret_errno(ENOMEM);
3134
3135         dent->elem = parse_new_conf_line(arg);
3136         if (!dent->elem)
3137                 return ret_errno(ENOMEM);
3138
3139         lxc_list_add_tail(defines, move_ptr(dent));
3140
3141         return 0;
3142 }
3143
3144 bool lxc_config_define_load(struct lxc_list *defines, struct lxc_container *c)
3145 {
3146         struct lxc_list *it;
3147         bool bret = true;
3148
3149         lxc_list_for_each(it, defines) {
3150                 struct new_config_item *new_item = it->elem;
3151                 bret = c->set_config_item(c, new_item->key, new_item->val);
3152                 if (!bret)
3153                         break;
3154         }
3155
3156 #ifndef FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION
3157         lxc_config_define_free(defines);
3158 #endif /* !FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION */
3159
3160         return bret;
3161 }
3162
3163 void lxc_config_define_free(struct lxc_list *defines)
3164 {
3165         struct lxc_list *it, *next;
3166
3167         lxc_list_for_each_safe(it, defines, next) {
3168                 struct new_config_item *new_item = it->elem;
3169                 free(new_item->key);
3170                 free(new_item->val);
3171                 lxc_list_del(it);
3172                 free(it->elem);
3173                 free(it);
3174         }
3175 }
3176
3177 int lxc_config_parse_arch(const char *arch, signed long *persona)
3178 {
3179         static struct per_name {
3180                 char *name;
3181                 unsigned long per;
3182         } pername[] = {
3183                 { "arm",       PER_LINUX32 },
3184                 { "armel",     PER_LINUX32 },
3185                 { "armhf",     PER_LINUX32 },
3186                 { "armv7l",    PER_LINUX32 },
3187                 { "athlon",    PER_LINUX32 },
3188                 { "i386",      PER_LINUX32 },
3189                 { "i486",      PER_LINUX32 },
3190                 { "i586",      PER_LINUX32 },
3191                 { "i686",      PER_LINUX32 },
3192                 { "linux32",   PER_LINUX32 },
3193                 { "mips",      PER_LINUX32 },
3194                 { "mipsel",    PER_LINUX32 },
3195                 { "ppc",       PER_LINUX32 },
3196                 { "powerpc",   PER_LINUX32 },
3197                 { "x86",       PER_LINUX32 },
3198                 { "aarch64",   PER_LINUX   },
3199                 { "amd64",     PER_LINUX   },
3200                 { "arm64",     PER_LINUX   },
3201                 { "linux64",   PER_LINUX   },
3202                 { "mips64",    PER_LINUX   },
3203                 { "mips64el",  PER_LINUX   },
3204                 { "ppc64",     PER_LINUX   },
3205                 { "ppc64el",   PER_LINUX   },
3206                 { "ppc64le",   PER_LINUX   },
3207                 { "powerpc64", PER_LINUX   },
3208                 { "s390x",     PER_LINUX   },
3209                 { "x86_64",    PER_LINUX   },
3210         };
3211
3212         for (int i = 0; i < ARRAY_SIZE(pername); i++) {
3213                 if (!strequal(pername[i].name, arch))
3214                         continue;
3215
3216                 *persona = pername[i].per;
3217                 return 0;
3218         }
3219
3220         return ret_errno(EINVAL);
3221 }
3222
3223 int lxc_fill_elevated_privileges(char *flaglist, unsigned int *flags)
3224 {
3225         unsigned int flags_tmp = 0;
3226         char *token;
3227         struct {
3228                 const char *token;
3229                 int flag;
3230         } all_privs[] = {
3231                 { "CGROUP", LXC_ATTACH_MOVE_TO_CGROUP    },
3232                 { "CAP",    LXC_ATTACH_DROP_CAPABILITIES },
3233                 { "LSM",    LXC_ATTACH_LSM_EXEC          },
3234                 { NULL,     0                            }
3235         };
3236
3237         if (!flaglist) {
3238                 /*
3239                  * For the sake of backward compatibility, keep all privileges
3240                  * if no specific privileges are specified.
3241                  */
3242                 for (unsigned int i = 0; all_privs[i].token; i++)
3243                         flags_tmp |= all_privs[i].flag;
3244
3245                 *flags = flags_tmp;
3246                 return 0;
3247         }
3248
3249         lxc_iterate_parts(token, flaglist, "|") {
3250                 bool valid_token = false;
3251
3252                 for (unsigned int i = 0; all_privs[i].token; i++) {
3253                         if (!strequal(all_privs[i].token, token))
3254                                 continue;
3255
3256                         valid_token = true;
3257                         flags_tmp |= all_privs[i].flag;
3258                 }
3259
3260                 if (!valid_token)
3261                         return syserror_set(-EINVAL, "Invalid elevated privilege \"%s\" requested", token);
3262         }
3263
3264         *flags = flags_tmp;
3265         return 0;
3266 }
3267
3268 /* Write out a configuration file. */
3269 int write_config(int fd, const struct lxc_conf *conf)
3270 {
3271         int ret;
3272         size_t len = conf->unexpanded_len;
3273
3274         if (len == 0)
3275                 return 0;
3276
3277         ret = lxc_write_nointr(fd, conf->unexpanded_config, len);
3278         if (ret < 0)
3279                 return log_error_errno(-errno, errno, "Failed to write configuration file");
3280
3281         return 0;
3282 }
3283
3284 bool do_append_unexp_config_line(struct lxc_conf *conf, const char *key,
3285                                  const char *v)
3286 {
3287         __do_free char *tmp = NULL;
3288         int ret;
3289         size_t len;
3290
3291         len = strlen(key) + strlen(v) + 4;
3292         tmp = must_realloc(NULL, len);
3293
3294         if (lxc_config_value_empty(v))
3295                 ret = strnprintf(tmp, len, "%s =", key);
3296         else
3297                 ret = strnprintf(tmp, len, "%s = %s", key, v);
3298         if (ret < 0)
3299                 return false;
3300
3301         /* Save the line verbatim into unexpanded_conf */
3302         if (append_unexp_config_line(tmp, conf))
3303                 return false;
3304
3305         return true;
3306 }
3307
3308 void clear_unexp_config_line(struct lxc_conf *conf, const char *key,
3309                              bool rm_subkeys)
3310 {
3311         char *lend;
3312         char *lstart = conf->unexpanded_config;
3313
3314         if (!conf->unexpanded_config)
3315                 return;
3316
3317         while (*lstart) {
3318                 lend = strchr(lstart, '\n');
3319                 char v;
3320
3321                 if (!lend)
3322                         lend = lstart + strlen(lstart);
3323                 else
3324                         lend++;
3325
3326                 if (!strnequal(lstart, key, strlen(key))) {
3327                         lstart = lend;
3328                         continue;
3329                 }
3330
3331                 if (!rm_subkeys) {
3332                         v = lstart[strlen(key)];
3333                         if (!isspace(v) && v != '=') {
3334                                 lstart = lend;
3335                                 continue;
3336                         }
3337                 }
3338
3339                 conf->unexpanded_len -= (lend - lstart);
3340
3341                 if (*lend == '\0') {
3342                         *lstart = '\0';
3343                         return;
3344                 }
3345
3346                 memmove(lstart, lend, strlen(lend) + 1);
3347         }
3348 }
3349
3350 bool clone_update_unexp_ovl_paths(struct lxc_conf *conf, const char *oldpath,
3351                                   const char *newpath, const char *oldname,
3352                                   const char *newname, const char *ovldir)
3353 {
3354         __do_free char *newdir = NULL, *olddir = NULL;
3355         char *lstart = conf->unexpanded_config;
3356         const char *key = "lxc.mount.entry";
3357         int ret;
3358         char *lend, *p, *q;
3359         size_t newdirlen, olddirlen;
3360
3361         olddirlen = strlen(ovldir) + strlen(oldpath) + strlen(oldname) + 2;
3362         olddir = must_realloc(NULL, olddirlen + 1);
3363         ret = strnprintf(olddir, olddirlen + 1, "%s=%s/%s", ovldir, oldpath, oldname);
3364         if (ret < 0)
3365                 return false;
3366
3367         newdirlen = strlen(ovldir) + strlen(newpath) + strlen(newname) + 2;
3368         newdir = must_realloc(NULL, newdirlen + 1);
3369         ret = strnprintf(newdir, newdirlen + 1, "%s=%s/%s", ovldir, newpath, newname);
3370         if (ret < 0)
3371                 return false;
3372
3373         if (!conf->unexpanded_config)
3374                 return true;
3375
3376         while (*lstart) {
3377                 lend = strchr(lstart, '\n');
3378                 if (!lend)
3379                         lend = lstart + strlen(lstart);
3380                 else
3381                         lend++;
3382
3383                 if (!strnequal(lstart, key, strlen(key)))
3384                         goto next;
3385
3386                 p = strchr(lstart + strlen(key), '=');
3387                 if (!p)
3388                         goto next;
3389                 p++;
3390
3391                 while (isblank(*p))
3392                         p++;
3393
3394                 if (p >= lend)
3395                         goto next;
3396
3397                 /* Whenever a lxc.mount.entry entry is found in a line we check
3398                 *  if the substring "overlay" is present before doing any
3399                 *  further work. We check for "overlay" because substrings need
3400                 *  to have at least one space before them in a valid overlay
3401                 *  lxc.mount.entry (/A B overlay).  When the space before is
3402                 *  missing it is very likely that these substrings are part of a
3403                 *  path or something else. (Checking q >= lend ensures that we
3404                 *  only count matches in the current line.) */
3405                 q = strstr(p, " overlay");
3406                 if (!q || q >= lend)
3407                         goto next;
3408
3409                 if (!(q = strstr(p, olddir)) || (q >= lend))
3410                         goto next;
3411
3412                 /* replace the olddir with newdir */
3413                 if (olddirlen >= newdirlen) {
3414                         size_t diff = olddirlen - newdirlen;
3415                         memcpy(q, newdir, newdirlen);
3416
3417                         if (olddirlen != newdirlen) {
3418                                 memmove(q + newdirlen, q + newdirlen + diff,
3419                                         strlen(q) - newdirlen - diff + 1);
3420                                 lend -= diff;
3421                                 conf->unexpanded_len -= diff;
3422                         }
3423                 } else {
3424                         char *new;
3425                         size_t diff = newdirlen - olddirlen;
3426                         size_t oldlen = conf->unexpanded_len;
3427                         size_t newlen = oldlen + diff;
3428                         size_t poffset = q - conf->unexpanded_config;
3429
3430                         new = realloc(conf->unexpanded_config, newlen + 1);
3431                         if (!new)
3432                                 return false;
3433
3434                         conf->unexpanded_len = newlen;
3435                         conf->unexpanded_alloced = newlen + 1;
3436                         new[newlen - 1] = '\0';
3437                         lend = new + (lend - conf->unexpanded_config);
3438
3439                         /* Move over the remainder to make room for the newdir.
3440                          */
3441                         memmove(new + poffset + newdirlen,
3442                                 new + poffset + olddirlen,
3443                                 oldlen - poffset - olddirlen + 1);
3444                         conf->unexpanded_config = new;
3445
3446                         memcpy(new + poffset, newdir, newdirlen);
3447                         lend += diff;
3448                 }
3449
3450         next:
3451                 lstart = lend;
3452         }
3453
3454         return true;
3455 }
3456
3457 bool clone_update_unexp_hooks(struct lxc_conf *conf, const char *oldpath,
3458                               const char *newpath, const char *oldname,
3459                               const char *newname)
3460 {
3461         __do_free char *newdir = NULL, *olddir = NULL;
3462         char *lstart = conf->unexpanded_config;
3463         const char *key = "lxc.hook";
3464         int ret;
3465         char *lend, *p;
3466         size_t newdirlen, olddirlen;
3467
3468         olddirlen = strlen(oldpath) + strlen(oldname) + 1;
3469         olddir = must_realloc(NULL, olddirlen + 1);
3470         ret = strnprintf(olddir, olddirlen + 1, "%s/%s", oldpath, oldname);
3471         if (ret < 0)
3472                 return false;
3473
3474         newdirlen = strlen(newpath) + strlen(newname) + 1;
3475         newdir = must_realloc(NULL, newdirlen + 1);
3476         ret = strnprintf(newdir, newdirlen + 1, "%s/%s", newpath, newname);
3477         if (ret < 0)
3478                 return false;
3479
3480         if (!conf->unexpanded_config)
3481                 return true;
3482
3483         while (*lstart) {
3484                 lend = strchr(lstart, '\n');
3485                 if (!lend)
3486                         lend = lstart + strlen(lstart);
3487                 else
3488                         lend++;
3489
3490                 if (!strnequal(lstart, key, strlen(key)))
3491                         goto next;
3492
3493                 p = strchr(lstart + strlen(key), '=');
3494                 if (!p)
3495                         goto next;
3496                 p++;
3497
3498                 while (isblank(*p))
3499                         p++;
3500
3501                 if (p >= lend)
3502                         goto next;
3503
3504                 if (!strnequal(p, olddir, strlen(olddir)))
3505                         goto next;
3506
3507                 /* replace the olddir with newdir */
3508                 if (olddirlen >= newdirlen) {
3509                         size_t diff = olddirlen - newdirlen;
3510                         memcpy(p, newdir, newdirlen);
3511
3512                         if (olddirlen != newdirlen) {
3513                                 memmove(p + newdirlen, p + newdirlen + diff,
3514                                         strlen(p) - newdirlen - diff + 1);
3515                                 lend -= diff;
3516                                 conf->unexpanded_len -= diff;
3517                         }
3518                 } else {
3519                         char *new;
3520                         size_t diff = newdirlen - olddirlen;
3521                         size_t oldlen = conf->unexpanded_len;
3522                         size_t newlen = oldlen + diff;
3523                         size_t poffset = p - conf->unexpanded_config;
3524
3525                         new = realloc(conf->unexpanded_config, newlen + 1);
3526                         if (!new)
3527                                 return false;
3528
3529                         conf->unexpanded_len = newlen;
3530                         conf->unexpanded_alloced = newlen + 1;
3531                         new[newlen - 1] = '\0';
3532                         lend = new + (lend - conf->unexpanded_config);
3533
3534                         /* Move over the remainder to make room for the newdir.
3535                          */
3536                         memmove(new + poffset + newdirlen,
3537                                 new + poffset + olddirlen,
3538                                 oldlen - poffset - olddirlen + 1);
3539                         conf->unexpanded_config = new;
3540
3541                         memcpy(new + poffset, newdir, newdirlen);
3542                         lend += diff;
3543                 }
3544
3545         next:
3546                 lstart = lend;
3547         }
3548
3549         return true;
3550 }
3551
3552 #define DO(cmd)                                                                \
3553         {                                                                      \
3554                 if (!(cmd)) {                                                  \
3555                         ERROR("Error writing to new config");                  \
3556                         return false;                                          \
3557                 }                                                              \
3558         }
3559
3560 /* This is called only from clone.  We wish to update all hwaddrs in the
3561  * unexpanded config file. We can't/don't want to update any which come from
3562  * lxc.includes (there shouldn't be any).
3563  * We can't just walk the c->lxc-conf->network list because that includes netifs
3564  * from the include files.  So we update the ones which we find in the unexp
3565  * config file, then find the original macaddr in the conf->network, and update
3566  * that to the same value.
3567  */
3568 bool network_new_hwaddrs(struct lxc_conf *conf)
3569 {
3570         char *lend, *p, *p2;
3571         char *lstart = conf->unexpanded_config;
3572
3573         if (!conf->unexpanded_config)
3574                 return true;
3575
3576         while (*lstart) {
3577                 char newhwaddr[18], oldhwaddr[17];
3578                 struct lxc_netdev *netdev;
3579
3580                 lend = strchr(lstart, '\n');
3581                 if (!lend)
3582                         lend = lstart + strlen(lstart);
3583                 else
3584                         lend++;
3585
3586                 if (!lxc_config_net_is_hwaddr(lstart)) {
3587                         lstart = lend;
3588                         continue;
3589                 }
3590
3591                 p = strchr(lstart, '=');
3592                 if (!p) {
3593                         lstart = lend;
3594                         continue;
3595                 }
3596
3597                 p++;
3598                 while (isblank(*p))
3599                         p++;
3600                 if (!*p)
3601                         return true;
3602
3603                 p2 = p;
3604                 while (*p2 && !isblank(*p2) && *p2 != '\n')
3605                         p2++;
3606
3607                 if ((p2 - p) != 17) {
3608                         WARN("Bad hwaddr entry");
3609                         lstart = lend;
3610                         continue;
3611                 }
3612
3613                 memcpy(oldhwaddr, p, 17);
3614
3615                 if (!new_hwaddr(newhwaddr))
3616                         return false;
3617
3618                 memcpy(p, newhwaddr, 17);
3619                 list_for_each_entry(netdev, &conf->netdevs, head) {
3620                         if (netdev->hwaddr && memcmp(oldhwaddr, netdev->hwaddr, 17) == 0)
3621                                 memcpy(netdev->hwaddr, newhwaddr, 17);
3622                 }
3623
3624                 lstart = lend;
3625         }
3626
3627         return true;
3628 }
3629
3630 static int set_config_ephemeral(const char *key, const char *value,
3631                                 struct lxc_conf *lxc_conf, void *data)
3632 {
3633         int ret;
3634
3635         if (lxc_config_value_empty(value)) {
3636                 lxc_conf->ephemeral = 0;
3637                 return 0;
3638         }
3639
3640         ret = lxc_safe_uint(value, &lxc_conf->ephemeral);
3641         if (ret < 0)
3642                 return ret;
3643
3644         if (lxc_conf->ephemeral > 1)
3645                 return ret_errno(EINVAL);
3646
3647         return 0;
3648 }
3649
3650 static int set_config_log_syslog(const char *key, const char *value,
3651                              struct lxc_conf *lxc_conf, void *data)
3652 {
3653         int facility;
3654
3655         if (lxc_conf->syslog)
3656                 free_disarm(lxc_conf->syslog);
3657
3658         if (lxc_config_value_empty(value))
3659                 return 0;
3660
3661         facility = lxc_syslog_priority_to_int(value);
3662         if (facility == -EINVAL)
3663                 return ret_errno(EINVAL);
3664
3665         lxc_log_syslog(facility);
3666
3667         return set_config_string_item(&lxc_conf->syslog, value);
3668 }
3669
3670 static int set_config_no_new_privs(const char *key, const char *value,
3671                                    struct lxc_conf *lxc_conf, void *data)
3672 {
3673         int ret;
3674         unsigned int v;
3675
3676         if (lxc_config_value_empty(value)) {
3677                 lxc_conf->no_new_privs = false;
3678                 return 0;
3679         }
3680
3681         ret = lxc_safe_uint(value, &v);
3682         if (ret < 0)
3683                 return ret;
3684
3685         if (v > 1)
3686                 return ret_errno(EINVAL);
3687
3688         lxc_conf->no_new_privs = v ? true : false;
3689
3690         return 0;
3691 }
3692
3693 /* Callbacks to get configuration items. */
3694 static int get_config_personality(const char *key, char *retv, int inlen,
3695                                   struct lxc_conf *c, void *data)
3696 {
3697         int fulllen = 0;
3698
3699         if (!retv)
3700                 inlen = 0;
3701         else
3702                 memset(retv, 0, inlen);
3703
3704         int len = 0;
3705
3706         switch (c->personality) {
3707         case PER_LINUX32:
3708                 strprint(retv, inlen, "i686");
3709                 break;
3710         case PER_LINUX:
3711                 strprint(retv, inlen, "x86_64");
3712                 break;
3713         default:
3714                 break;
3715         }
3716
3717         return fulllen;
3718 }
3719
3720 static int get_config_pty_max(const char *key, char *retv, int inlen,
3721                               struct lxc_conf *c, void *data)
3722 {
3723         return lxc_get_conf_size_t(c, retv, inlen, c->pty_max);
3724 }
3725
3726 static int get_config_tty_max(const char *key, char *retv, int inlen,
3727                               struct lxc_conf *c, void *data)
3728 {
3729         return lxc_get_conf_size_t(c, retv, inlen, c->ttys.max);
3730 }
3731
3732 static int get_config_tty_dir(const char *key, char *retv, int inlen,
3733                              struct lxc_conf *c, void *data)
3734 {
3735         return lxc_get_conf_str(retv, inlen, c->ttys.dir);
3736 }
3737
3738 static int get_config_apparmor_profile(const char *key, char *retv, int inlen,
3739                                        struct lxc_conf *c, void *data)
3740 {
3741 #if HAVE_APPARMOR
3742         return lxc_get_conf_str(retv, inlen, c->lsm_aa_profile);
3743 #else
3744         return syserror_set(-EINVAL, "Built without AppArmor support");
3745 #endif
3746 }
3747
3748 static int get_config_apparmor_allow_incomplete(const char *key, char *retv,
3749                                                 int inlen, struct lxc_conf *c,
3750                                                 void *data)
3751 {
3752 #if HAVE_APPARMOR
3753         return lxc_get_conf_int(c, retv, inlen, c->lsm_aa_allow_incomplete);
3754 #else
3755         return syserror_set(-EINVAL, "Built without AppArmor support");
3756 #endif
3757 }
3758
3759 static int get_config_apparmor_allow_nesting(const char *key, char *retv,
3760                                              int inlen, struct lxc_conf *c,
3761                                              void *data)
3762 {
3763 #if HAVE_APPARMOR
3764         return lxc_get_conf_int(c, retv, inlen, c->lsm_aa_allow_nesting);
3765 #else
3766         return syserror_set(-EINVAL, "Built without AppArmor support");
3767 #endif
3768 }
3769
3770 static int get_config_apparmor_raw(const char *key, char *retv,
3771                                    int inlen, struct lxc_conf *c,
3772                                    void *data)
3773 {
3774 #if HAVE_APPARMOR
3775         int len;
3776         struct lxc_list *it;
3777         int fulllen = 0;
3778
3779         if (!retv)
3780                 inlen = 0;
3781         else
3782                 memset(retv, 0, inlen);
3783
3784         lxc_list_for_each(it, &c->lsm_aa_raw) {
3785                 strprint(retv, inlen, "%s\n", (char *)it->elem);
3786         }
3787
3788         return fulllen;
3789 #else
3790         return syserror_set(-EINVAL, "Built without AppArmor support");
3791 #endif
3792 }
3793
3794 static int get_config_selinux_context(const char *key, char *retv, int inlen,
3795                                       struct lxc_conf *c, void *data)
3796 {
3797 #if HAVE_SELINUX
3798         return lxc_get_conf_str(retv, inlen, c->lsm_se_context);
3799 #else
3800         return syserror_set(-EINVAL, "Built without SELinux support");
3801 #endif
3802 }
3803
3804 static int get_config_selinux_context_keyring(const char *key, char *retv, int inlen,
3805                                               struct lxc_conf *c, void *data)
3806 {
3807 #if HAVE_SELINUX
3808         return lxc_get_conf_str(retv, inlen, c->lsm_se_keyring_context);
3809 #else
3810         return syserror_set(-EINVAL, "Built without SELinux support");
3811 #endif
3812 }
3813
3814 static int get_config_keyring_session(const char *key, char *retv, int inlen,
3815                                       struct lxc_conf *c, void *data)
3816 {
3817         return lxc_get_conf_bool(c, retv, inlen, c->keyring_disable_session);
3818 }
3819
3820
3821 /* If you ask for a specific cgroup value, i.e. lxc.cgroup.devices.list, then
3822  * just the value(s) will be printed. Since there still could be more than one,
3823  * it is newline-separated.
3824  * (Maybe that's ambiguous, since some values, i.e. devices.list, will already
3825  * have newlines?)
3826  * If you ask for 'lxc.cgroup", then all cgroup entries will be printed, in
3827  * 'lxc.cgroup.subsystem.key = value' format.
3828  */
3829 static int __get_config_cgroup_controller(const char *key, char *retv,
3830                                           int inlen, struct lxc_conf *c,
3831                                           int version)
3832 {
3833         int fulllen = 0;
3834         bool get_all = false;
3835         int len;
3836         size_t namespaced_token_len;
3837         char *global_token, *namespaced_token;
3838         struct list_head *list;
3839         struct lxc_cgroup *cgroup;
3840
3841         if (!retv)
3842                 inlen = 0;
3843         else
3844                 memset(retv, 0, inlen);
3845
3846         if (version == CGROUP2_SUPER_MAGIC) {
3847                 global_token = "lxc.cgroup2";
3848                 namespaced_token = "lxc.cgroup2.";
3849                 namespaced_token_len = STRLITERALLEN("lxc.cgroup2.");
3850                 list = &c->cgroup2;
3851         } else if (version == CGROUP_SUPER_MAGIC) {
3852                 global_token = "lxc.cgroup";
3853                 namespaced_token = "lxc.cgroup.";
3854                 namespaced_token_len = STRLITERALLEN("lxc.cgroup.");
3855                 list = &c->cgroup;
3856         } else {
3857                 return ret_errno(EINVAL);
3858         }
3859
3860         if (strequal(key, global_token))
3861                 get_all = true;
3862         else if (strnequal(key, namespaced_token, namespaced_token_len))
3863                 key += namespaced_token_len;
3864         else
3865                 return ret_errno(EINVAL);
3866
3867         list_for_each_entry(cgroup, list, head) {
3868                 if (get_all) {
3869                         if (version != cgroup->version)
3870                                 continue;
3871
3872                         strprint(retv, inlen, "%s.%s = %s\n", global_token,
3873                                  cgroup->subsystem, cgroup->value);
3874                 } else if (strequal(cgroup->subsystem, key)) {
3875                         strprint(retv, inlen, "%s\n", cgroup->value);
3876                 }
3877         }
3878
3879         return fulllen;
3880 }
3881
3882 static int get_config_cgroup_controller(const char *key, char *retv, int inlen,
3883                                         struct lxc_conf *c, void *data)
3884 {
3885         return __get_config_cgroup_controller(key, retv, inlen, c,
3886                                               CGROUP_SUPER_MAGIC);
3887 }
3888
3889 static int get_config_cgroup2_controller(const char *key, char *retv, int inlen,
3890                                          struct lxc_conf *c, void *data)
3891 {
3892         return __get_config_cgroup_controller(key, retv, inlen, c,
3893                                               CGROUP2_SUPER_MAGIC);
3894 }
3895
3896 static int get_config_cgroup_dir(const char *key, char *retv, int inlen,
3897                                  struct lxc_conf *lxc_conf, void *data)
3898 {
3899         int len;
3900         int fulllen = 0;
3901
3902         if (!strequal(key, "lxc.cgroup.dir"))
3903                 return ret_errno(EINVAL);
3904
3905         if (!retv)
3906                 inlen = 0;
3907         else
3908                 memset(retv, 0, inlen);
3909
3910         strprint(retv, inlen, "%s", lxc_conf->cgroup_meta.dir);
3911
3912         return fulllen;
3913 }
3914
3915 static int get_config_cgroup_monitor_dir(const char *key, char *retv, int inlen,
3916                                          struct lxc_conf *lxc_conf, void *data)
3917 {
3918         int len;
3919         int fulllen = 0;
3920
3921         if (!retv)
3922                 inlen = 0;
3923         else
3924                 memset(retv, 0, inlen);
3925
3926         strprint(retv, inlen, "%s", lxc_conf->cgroup_meta.monitor_dir);
3927
3928         return fulllen;
3929 }
3930
3931 static int get_config_cgroup_monitor_pivot_dir(const char *key, char *retv, int inlen,
3932                                          struct lxc_conf *lxc_conf, void *data)
3933 {
3934         int len;
3935         int fulllen = 0;
3936
3937         if (!retv)
3938                 inlen = 0;
3939         else
3940                 memset(retv, 0, inlen);
3941
3942         strprint(retv, inlen, "%s", lxc_conf->cgroup_meta.monitor_pivot_dir);
3943
3944         return fulllen;
3945 }
3946
3947 static int get_config_cgroup_container_dir(const char *key, char *retv,
3948                                            int inlen,
3949                                            struct lxc_conf *lxc_conf,
3950                                            void *data)
3951 {
3952         int len;
3953         int fulllen = 0;
3954
3955         if (!retv)
3956                 inlen = 0;
3957         else
3958                 memset(retv, 0, inlen);
3959
3960         strprint(retv, inlen, "%s", lxc_conf->cgroup_meta.container_dir);
3961
3962         return fulllen;
3963 }
3964
3965 static int get_config_cgroup_container_inner_dir(const char *key, char *retv,
3966                                                  int inlen,
3967                                                  struct lxc_conf *lxc_conf,
3968                                                  void *data)
3969 {
3970         int len;
3971         int fulllen = 0;
3972
3973         if (!retv)
3974                 inlen = 0;
3975         else
3976                 memset(retv, 0, inlen);
3977
3978         strprint(retv, inlen, "%s", lxc_conf->cgroup_meta.namespace_dir);
3979
3980         return fulllen;
3981 }
3982
3983 static inline int get_config_cgroup_relative(const char *key, char *retv,
3984                                              int inlen, struct lxc_conf *lxc_conf,
3985                                              void *data)
3986 {
3987         return lxc_get_conf_int(lxc_conf, retv, inlen,
3988                                 lxc_conf->cgroup_meta.relative);
3989 }
3990
3991 static int get_config_idmaps(const char *key, char *retv, int inlen,
3992                              struct lxc_conf *c, void *data)
3993 {
3994         struct id_map *map;
3995         int len, listlen, ret;
3996         int fulllen = 0;
3997 /* "u 1000 1000000 65536"
3998  *
3999  * let's render this as
4000  *
4001  * sizeof(char)
4002  * +
4003  * sizeof(" ")
4004  * +
4005  * sizeof(uint32_t)
4006  * +
4007  * sizeof(" ")
4008  * +
4009  * sizeof(uint32_t)
4010  * +
4011  * sizeof(" ")
4012  * +
4013  * sizeof(uint32_t)
4014  * +
4015  * \0
4016  */
4017 #define __LXC_IDMAP_STR_BUF (3 * INTTYPE_TO_STRLEN(uint32_t) + 3 + 1 + 1)
4018         char buf[__LXC_IDMAP_STR_BUF];
4019
4020         if (!retv)
4021                 inlen = 0;
4022         else
4023                 memset(retv, 0, inlen);
4024
4025         listlen = list_len(&c->id_map);
4026         list_for_each_entry(map, &c->id_map, head) {
4027                 ret = strnprintf(buf, sizeof(buf), "%c %lu %lu %lu",
4028                                  (map->idtype == ID_TYPE_UID) ? 'u' : 'g',
4029                                  map->nsid, map->hostid, map->range);
4030                 if (ret < 0)
4031                         return ret_errno(EIO);
4032
4033                 strprint(retv, inlen, "%s%s", buf, (listlen-- > 1) ? "\n" : "");
4034         }
4035
4036         return fulllen;
4037 }
4038
4039 static int get_config_log_level(const char *key, char *retv, int inlen,
4040                                struct lxc_conf *c, void *data)
4041 {
4042         const char *v;
4043         v = lxc_log_priority_to_string(c->loglevel);
4044         return lxc_get_conf_str(retv, inlen, v);
4045 }
4046
4047 static int get_config_log_file(const char *key, char *retv, int inlen,
4048                               struct lxc_conf *c, void *data)
4049 {
4050         return lxc_get_conf_str(retv, inlen, c->logfile);
4051 }
4052
4053 static int get_config_mount_fstab(const char *key, char *retv, int inlen,
4054                                   struct lxc_conf *c, void *data)
4055 {
4056         return lxc_get_conf_str(retv, inlen, c->fstab);
4057 }
4058
4059 static int get_config_mount_auto(const char *key, char *retv, int inlen,
4060                                  struct lxc_conf *c, void *data)
4061 {
4062         int len, fulllen = 0;
4063         const char *sep = "";
4064
4065         if (!retv)
4066                 inlen = 0;
4067         else
4068                 memset(retv, 0, inlen);
4069
4070         if (!(c->auto_mounts & LXC_AUTO_ALL_MASK))
4071                 return 0;
4072
4073         switch (c->auto_mounts & LXC_AUTO_PROC_MASK) {
4074         case LXC_AUTO_PROC_MIXED:
4075                 strprint(retv, inlen, "%sproc:mixed", sep);
4076                 sep = " ";
4077                 break;
4078         case LXC_AUTO_PROC_RW:
4079                 strprint(retv, inlen, "%sproc:rw", sep);
4080                 sep = " ";
4081                 break;
4082         default:
4083                 break;
4084         }
4085
4086         switch (c->auto_mounts & LXC_AUTO_SYS_MASK) {
4087         case LXC_AUTO_SYS_RO:
4088                 strprint(retv, inlen, "%ssys:ro", sep);
4089                 sep = " ";
4090                 break;
4091         case LXC_AUTO_SYS_RW:
4092                 strprint(retv, inlen, "%ssys:rw", sep);
4093                 sep = " ";
4094                 break;
4095         case LXC_AUTO_SYS_MIXED:
4096                 strprint(retv, inlen, "%ssys:mixed", sep);
4097                 sep = " ";
4098                 break;
4099         default:
4100                 break;
4101         }
4102
4103         switch (c->auto_mounts & LXC_AUTO_CGROUP_MASK) {
4104         case LXC_AUTO_CGROUP_NOSPEC:
4105                 strprint(retv, inlen, "%scgroup", sep);
4106                 break;
4107         case LXC_AUTO_CGROUP_MIXED:
4108                 strprint(retv, inlen, "%scgroup:mixed", sep);
4109                 break;
4110         case LXC_AUTO_CGROUP_RO:
4111                 strprint(retv, inlen, "%scgroup:ro", sep);
4112                 break;
4113         case LXC_AUTO_CGROUP_RW:
4114                 strprint(retv, inlen, "%scgroup:rw", sep);
4115                 break;
4116         case LXC_AUTO_CGROUP_FULL_NOSPEC:
4117                 strprint(retv, inlen, "%scgroup-full", sep);
4118                 break;
4119         case LXC_AUTO_CGROUP_FULL_MIXED:
4120                 strprint(retv, inlen, "%scgroup-full:mixed", sep);
4121                 break;
4122         case LXC_AUTO_CGROUP_FULL_RO:
4123                 strprint(retv, inlen, "%scgroup-full:ro", sep);
4124                 break;
4125         case LXC_AUTO_CGROUP_FULL_RW:
4126                 strprint(retv, inlen, "%scgroup-full:rw", sep);
4127                 break;
4128         default:
4129                 break;
4130         }
4131
4132         return fulllen;
4133 }
4134
4135 static int get_config_mount(const char *key, char *retv, int inlen,
4136                             struct lxc_conf *c, void *data)
4137 {
4138         int len, fulllen = 0;
4139         struct lxc_list *it;
4140
4141         if (!retv)
4142                 inlen = 0;
4143         else
4144                 memset(retv, 0, inlen);
4145
4146         lxc_list_for_each(it, &c->mount_list) {
4147                 strprint(retv, inlen, "%s\n", (char *)it->elem);
4148         }
4149
4150         return fulllen;
4151 }
4152
4153 static int get_config_rootfs_path(const char *key, char *retv, int inlen,
4154                                   struct lxc_conf *c, void *data)
4155 {
4156         return lxc_get_conf_str(retv, inlen, c->rootfs.path);
4157 }
4158
4159 static int get_config_rootfs_managed(const char *key, char *retv, int inlen,
4160                                      struct lxc_conf *c, void *data)
4161 {
4162         return lxc_get_conf_bool(c, retv, inlen, c->rootfs.managed);
4163 }
4164
4165 static int get_config_rootfs_mount(const char *key, char *retv, int inlen,
4166                                    struct lxc_conf *c, void *data)
4167 {
4168         return lxc_get_conf_str(retv, inlen, c->rootfs.mount);
4169 }
4170
4171 static int get_config_rootfs_options(const char *key, char *retv, int inlen,
4172                                      struct lxc_conf *c, void *data)
4173 {
4174         return lxc_get_conf_str(retv, inlen, c->rootfs.mnt_opts.raw_options);
4175 }
4176
4177 static int get_config_uts_name(const char *key, char *retv, int inlen,
4178                               struct lxc_conf *c, void *data)
4179 {
4180         return lxc_get_conf_str(
4181             retv, inlen,
4182             c->utsname ? c->utsname->nodename : NULL);
4183 }
4184
4185 static int get_config_hooks(const char *key, char *retv, int inlen,
4186                             struct lxc_conf *c, void *data)
4187 {
4188         char *subkey;
4189         int len, fulllen = 0, found = -1;
4190         struct lxc_list *it;
4191         int i;
4192
4193         subkey = strchr(key, '.');
4194         if (!subkey)
4195                 return ret_errno(EINVAL);
4196
4197         subkey = strchr(subkey + 1, '.');
4198         if (!subkey)
4199                 return ret_errno(EINVAL);
4200         subkey++;
4201         if (*subkey == '\0')
4202                 return ret_errno(EINVAL);
4203
4204         for (i = 0; i < NUM_LXC_HOOKS; i++) {
4205                 if (strequal(lxchook_names[i], subkey)) {
4206                         found = i;
4207                         break;
4208                 }
4209         }
4210
4211         if (found == -1)
4212                 return ret_errno(EINVAL);
4213
4214         if (!retv)
4215                 inlen = 0;
4216         else
4217                 memset(retv, 0, inlen);
4218
4219         lxc_list_for_each(it, &c->hooks[found]) {
4220                 strprint(retv, inlen, "%s\n", (char *)it->elem);
4221         }
4222
4223         return fulllen;
4224 }
4225
4226 static int get_config_hooks_version(const char *key, char *retv, int inlen,
4227                                     struct lxc_conf *c, void *data)
4228 {
4229         return lxc_get_conf_int(c, retv, inlen, c->hooks_version);
4230 }
4231
4232 static int get_config_net(const char *key, char *retv, int inlen,
4233                           struct lxc_conf *c, void *data)
4234 {
4235         int len, fulllen = 0;
4236         struct lxc_netdev *netdev;
4237
4238         if (!retv)
4239                 inlen = 0;
4240         else
4241                 memset(retv, 0, inlen);
4242
4243         list_for_each_entry(netdev, &c->netdevs, head) {
4244                 const char *t = lxc_net_type_to_str(netdev->type);
4245                 strprint(retv, inlen, "%s\n", t ? t : "(invalid)");
4246         }
4247
4248         return fulllen;
4249 }
4250
4251 static int get_config_cap_drop(const char *key, char *retv, int inlen,
4252                                struct lxc_conf *c, void *data)
4253 {
4254         int len, fulllen = 0;
4255         struct cap_entry *cap;
4256
4257         if (!retv)
4258                 inlen = 0;
4259         else
4260                 memset(retv, 0, inlen);
4261
4262         list_for_each_entry(cap, &c->caps.list, head) {
4263                 strprint(retv, inlen, "%s\n", cap->cap_name);
4264         }
4265
4266         return fulllen;
4267 }
4268
4269 static int get_config_cap_keep(const char *key, char *retv, int inlen,
4270                                struct lxc_conf *c, void *data)
4271 {
4272         int len, fulllen = 0;
4273         struct cap_entry *cap;
4274
4275         if (!retv)
4276                 inlen = 0;
4277         else
4278                 memset(retv, 0, inlen);
4279
4280         list_for_each_entry(cap, &c->caps.list, head) {
4281                 strprint(retv, inlen, "%s\n", cap->cap_name);
4282         }
4283
4284         return fulllen;
4285 }
4286
4287 static int get_config_console_path(const char *key, char *retv, int inlen,
4288                                    struct lxc_conf *c, void *data)
4289 {
4290         return lxc_get_conf_str(retv, inlen, c->console.path);
4291 }
4292
4293 static int get_config_console_logfile(const char *key, char *retv, int inlen,
4294                                       struct lxc_conf *c, void *data)
4295 {
4296         return lxc_get_conf_str(retv, inlen, c->console.log_path);
4297 }
4298
4299 static int get_config_console_rotate(const char *key, char *retv, int inlen,
4300                                      struct lxc_conf *c, void *data)
4301 {
4302         return lxc_get_conf_int(c, retv, inlen, c->console.log_rotate);
4303 }
4304
4305
4306 static int get_config_console_buffer_size(const char *key, char *retv,
4307                                           int inlen, struct lxc_conf *c,
4308                                           void *data)
4309 {
4310         return lxc_get_conf_uint64(c, retv, inlen, c->console.buffer_size);
4311 }
4312
4313 static int get_config_console_size(const char *key, char *retv, int inlen,
4314                                    struct lxc_conf *c, void *data)
4315 {
4316         return lxc_get_conf_uint64(c, retv, inlen, c->console.log_size);
4317 }
4318
4319 static int get_config_seccomp_allow_nesting(const char *key, char *retv,
4320                                             int inlen, struct lxc_conf *c,
4321                                             void *data)
4322 {
4323 #ifdef HAVE_SECCOMP
4324         return lxc_get_conf_int(c, retv, inlen, c->seccomp.allow_nesting);
4325 #else
4326         return ret_errno(ENOSYS);
4327 #endif
4328 }
4329
4330 static int get_config_seccomp_notify_cookie(const char *key, char *retv, int inlen,
4331                                             struct lxc_conf *c, void *data)
4332 {
4333 #ifdef HAVE_SECCOMP_NOTIFY
4334         return lxc_get_conf_str(retv, inlen, c->seccomp.notifier.cookie);
4335 #else
4336         return ret_errno(ENOSYS);
4337 #endif
4338 }
4339
4340 static int get_config_seccomp_notify_proxy(const char *key, char *retv, int inlen,
4341                                            struct lxc_conf *c, void *data)
4342 {
4343 #ifdef HAVE_SECCOMP_NOTIFY
4344         return lxc_get_conf_str(retv, inlen,
4345                                 (c->seccomp.notifier.proxy_addr.sun_path[0]) == '/'
4346                                     ? &c->seccomp.notifier.proxy_addr.sun_path[0]
4347                                     : &c->seccomp.notifier.proxy_addr.sun_path[1]);
4348 #else
4349         return ret_errno(ENOSYS);
4350 #endif
4351 }
4352
4353 static int get_config_seccomp_profile(const char *key, char *retv, int inlen,
4354                                       struct lxc_conf *c, void *data)
4355 {
4356 #ifdef HAVE_SECCOMP
4357         return lxc_get_conf_str(retv, inlen, c->seccomp.seccomp);
4358 #else
4359         return ret_errno(ENOSYS);
4360 #endif
4361 }
4362
4363 static int get_config_autodev(const char *key, char *retv, int inlen,
4364                               struct lxc_conf *c, void *data)
4365 {
4366         return lxc_get_conf_int(c, retv, inlen, c->autodev);
4367 }
4368
4369 static int get_config_autodev_tmpfs_size(const char *key, char *retv, int inlen,
4370                               struct lxc_conf *c, void *data)
4371 {
4372         return lxc_get_conf_int(c, retv, inlen, c->autodevtmpfssize);
4373 }
4374
4375 static int get_config_signal_halt(const char *key, char *retv, int inlen,
4376                                   struct lxc_conf *c, void *data)
4377 {
4378         return lxc_get_conf_int(c, retv, inlen, c->haltsignal);
4379 }
4380
4381 static int get_config_signal_reboot(const char *key, char *retv, int inlen,
4382                                     struct lxc_conf *c, void *data)
4383 {
4384         return lxc_get_conf_int(c, retv, inlen, c->rebootsignal);
4385 }
4386
4387 static int get_config_signal_stop(const char *key, char *retv, int inlen,
4388                                   struct lxc_conf *c, void *data)
4389 {
4390         return lxc_get_conf_int(c, retv, inlen, c->stopsignal);
4391 }
4392
4393 static int get_config_start(const char *key, char *retv, int inlen,
4394                             struct lxc_conf *c, void *data)
4395 {
4396         if (strequal(key + 10, "auto"))
4397                 return lxc_get_conf_int(c, retv, inlen, c->start_auto);
4398         else if (strequal(key + 10, "delay"))
4399                 return lxc_get_conf_int(c, retv, inlen, c->start_delay);
4400         else if (strequal(key + 10, "order"))
4401                 return lxc_get_conf_int(c, retv, inlen, c->start_order);
4402
4403         return ret_errno(EINVAL);
4404 }
4405
4406 static int get_config_log_syslog(const char *key, char *retv, int inlen,
4407                                  struct lxc_conf *c, void *data)
4408 {
4409         return lxc_get_conf_str(retv, inlen, c->syslog);
4410 }
4411
4412 static int get_config_monitor(const char *key, char *retv, int inlen,
4413                               struct lxc_conf *c, void *data)
4414 {
4415         return lxc_get_conf_int(c, retv, inlen, c->monitor_unshare);
4416 }
4417
4418 static int get_config_monitor_signal_pdeath(const char *key, char *retv,
4419                                             int inlen, struct lxc_conf *c,
4420                                             void *data)
4421 {
4422         return lxc_get_conf_int(c, retv, inlen, c->monitor_signal_pdeath);
4423 }
4424
4425 static int get_config_group(const char *key, char *retv, int inlen,
4426                             struct lxc_conf *c, void *data)
4427 {
4428         int len, fulllen = 0;
4429         struct lxc_list *it;
4430
4431         if (!retv)
4432                 inlen = 0;
4433         else
4434                 memset(retv, 0, inlen);
4435
4436         lxc_list_for_each(it, &c->groups) {
4437                 strprint(retv, inlen, "%s\n", (char *)it->elem);
4438         }
4439
4440         return fulllen;
4441 }
4442
4443 static int get_config_environment(const char *key, char *retv, int inlen,
4444                                   struct lxc_conf *c, void *data)
4445 {
4446         int len, fulllen = 0;
4447         struct environment_entry *env;
4448
4449         if (!retv)
4450                 inlen = 0;
4451         else
4452                 memset(retv, 0, inlen);
4453
4454         list_for_each_entry(env, &c->environment, head) {
4455                 strprint(retv, inlen, "%s=%s\n", env->key, env->val);
4456         }
4457
4458         return fulllen;
4459 }
4460
4461 static int get_config_execute_cmd(const char *key, char *retv, int inlen,
4462                                struct lxc_conf *c, void *data)
4463 {
4464         return lxc_get_conf_str(retv, inlen, c->execute_cmd);
4465 }
4466
4467 static int get_config_init_cmd(const char *key, char *retv, int inlen,
4468                                struct lxc_conf *c, void *data)
4469 {
4470         return lxc_get_conf_str(retv, inlen, c->init_cmd);
4471 }
4472
4473 static int get_config_init_cwd(const char *key, char *retv, int inlen,
4474                                struct lxc_conf *c, void *data)
4475 {
4476         return lxc_get_conf_str(retv, inlen, c->init_cwd);
4477 }
4478
4479 static int get_config_init_uid(const char *key, char *retv, int inlen,
4480                                struct lxc_conf *c, void *data)
4481 {
4482         return lxc_get_conf_int(c, retv, inlen, c->init_uid);
4483 }
4484
4485 static int get_config_init_gid(const char *key, char *retv, int inlen,
4486                                struct lxc_conf *c, void *data)
4487 {
4488         return lxc_get_conf_int(c, retv, inlen, c->init_gid);
4489 }
4490
4491 static int get_config_init_groups(const char *key, char *retv, int inlen,
4492                                   struct lxc_conf *c, void *data)
4493 {
4494         int fulllen = 0, len;
4495
4496         if (!retv)
4497                 inlen = 0;
4498         else
4499                 memset(retv, 0, inlen);
4500
4501         if (c->init_groups.size == 0)
4502                 return 0;
4503
4504         for (int i = 0; i < c->init_groups.size; i++)
4505                 strprint(retv, inlen, "%s%d", (i > 0) ? "," : "",
4506                          c->init_groups.list[i]);
4507
4508         return fulllen;
4509 }
4510
4511 static int get_config_ephemeral(const char *key, char *retv, int inlen,
4512                                 struct lxc_conf *c, void *data)
4513 {
4514         return lxc_get_conf_int(c, retv, inlen, c->ephemeral);
4515 }
4516
4517 static int get_config_no_new_privs(const char *key, char *retv, int inlen,
4518                                    struct lxc_conf *c, void *data)
4519 {
4520         return lxc_get_conf_int(c, retv, inlen, c->no_new_privs);
4521 }
4522
4523 /* If you ask for a specific value, i.e. lxc.prlimit.nofile, then just the value
4524  * will be printed. If you ask for 'lxc.prlimit', then all limit entries will be
4525  * printed, in 'lxc.prlimit.resource = value' format.
4526  */
4527 static int get_config_prlimit(const char *key, char *retv, int inlen,
4528                               struct lxc_conf *c, void *data)
4529 {
4530         int fulllen = 0, len;
4531         bool get_all = false;
4532         struct lxc_limit *lim;
4533
4534         if (!retv)
4535                 inlen = 0;
4536         else
4537                 memset(retv, 0, inlen);
4538
4539         if (strequal(key, "lxc.prlimit"))
4540                 get_all = true;
4541         else if (strnequal(key, "lxc.prlimit.", 12))
4542                 key += 12;
4543         else
4544                 return ret_errno(EINVAL);
4545
4546         list_for_each_entry(lim, &c->limits, head) {
4547                 /* 2 colon separated 64 bit integers or the word 'unlimited' */
4548                 char buf[INTTYPE_TO_STRLEN(uint64_t) * 2 + 2];
4549                 int partlen;
4550
4551                 if (lim->limit.rlim_cur == RLIM_INFINITY) {
4552                         memcpy(buf, "unlimited", STRLITERALLEN("unlimited") + 1);
4553                         partlen = STRLITERALLEN("unlimited");
4554                 } else {
4555                         partlen = sprintf(buf, "%" PRIu64,
4556                                           (uint64_t)lim->limit.rlim_cur);
4557                 }
4558
4559                 if (lim->limit.rlim_cur != lim->limit.rlim_max) {
4560                         if (lim->limit.rlim_max == RLIM_INFINITY)
4561                                 memcpy(buf + partlen, ":unlimited",
4562                                        STRLITERALLEN(":unlimited") + 1);
4563                         else
4564                                 sprintf(buf + partlen, ":%" PRIu64,
4565                                         (uint64_t)lim->limit.rlim_max);
4566                 }
4567
4568                 if (get_all) {
4569                         strprint(retv, inlen, "lxc.prlimit.%s = %s\n",
4570                                  lim->resource, buf);
4571                 } else if (strequal(lim->resource, key)) {
4572                         strprint(retv, inlen, "%s", buf);
4573                 }
4574         }
4575
4576         return fulllen;
4577 }
4578
4579 /* If you ask for a specific value, i.e. lxc.sysctl.net.ipv4.ip_forward, then
4580  * just the value will be printed. If you ask for 'lxc.sysctl', then all sysctl
4581  * entries will be printed, in 'lxc.sysctl.key = value' format.
4582  */
4583 static int get_config_sysctl(const char *key, char *retv, int inlen,
4584                              struct lxc_conf *c, void *data)
4585 {
4586         int fulllen = 0;
4587         bool get_all = false;
4588         int len;
4589         struct lxc_sysctl *sysctl;
4590
4591         if (!retv)
4592                 inlen = 0;
4593         else
4594                 memset(retv, 0, inlen);
4595
4596         if (strequal(key, "lxc.sysctl"))
4597                 get_all = true;
4598         else if (strnequal(key, "lxc.sysctl.", STRLITERALLEN("lxc.sysctl.")))
4599                 key += STRLITERALLEN("lxc.sysctl.");
4600         else
4601                 return ret_errno(EINVAL);
4602
4603         list_for_each_entry(sysctl, &c->sysctls, head) {
4604                 if (get_all) {
4605                         strprint(retv, inlen, "lxc.sysctl.%s = %s\n", sysctl->key,
4606                                  sysctl->value);
4607                 } else if (strequal(sysctl->key, key)) {
4608                         strprint(retv, inlen, "%s", sysctl->value);
4609                 }
4610         }
4611
4612         return fulllen;
4613 }
4614
4615 static int get_config_proc(const char *key, char *retv, int inlen,
4616                            struct lxc_conf *c, void *data)
4617 {
4618         int fulllen = 0;
4619         bool get_all = false;
4620         int len;
4621         struct lxc_proc *proc;
4622
4623         if (!retv)
4624                 inlen = 0;
4625         else
4626                 memset(retv, 0, inlen);
4627
4628         if (strequal(key, "lxc.proc"))
4629                 get_all = true;
4630         else if (strnequal(key, "lxc.proc.", STRLITERALLEN("lxc.proc.")))
4631                 key += STRLITERALLEN("lxc.proc.");
4632         else
4633                 return ret_errno(EINVAL);
4634
4635         list_for_each_entry(proc, &c->procs, head) {
4636                 if (get_all) {
4637                         strprint(retv, inlen, "lxc.proc.%s = %s\n",
4638                                  proc->filename, proc->value);
4639                 } else if (strequal(proc->filename, key)) {
4640                         strprint(retv, inlen, "%s", proc->value);
4641                 }
4642         }
4643
4644         return fulllen;
4645 }
4646
4647 static int get_config_namespace_clone(const char *key, char *retv, int inlen,
4648                                       struct lxc_conf *c, void *data)
4649 {
4650         int i, len;
4651         int fulllen = 0;
4652
4653         if (!retv)
4654                 inlen = 0;
4655         else
4656                 memset(retv, 0, inlen);
4657
4658         for (i = 0; i < LXC_NS_MAX; i++) {
4659                 if (c->ns_clone & ns_info[i].clone_flag)
4660                         strprint(retv, inlen, "%s\n", ns_info[i].proc_name);
4661         }
4662
4663         return fulllen;
4664 }
4665
4666 static int get_config_namespace_keep(const char *key, char *retv, int inlen,
4667                                      struct lxc_conf *c, void *data)
4668 {
4669         int i, len;
4670         int fulllen = 0;
4671
4672         if (!retv)
4673                 inlen = 0;
4674         else
4675                 memset(retv, 0, inlen);
4676
4677         for (i = 0; i < LXC_NS_MAX; i++) {
4678                 if (c->ns_keep & ns_info[i].clone_flag)
4679                         strprint(retv, inlen, "%s\n", ns_info[i].proc_name);
4680         }
4681
4682         return fulllen;
4683 }
4684
4685 static int get_config_time_offset_boot(const char *key, char *retv, int inlen, struct lxc_conf *c,
4686                                        void *data)
4687 {
4688         int len;
4689         int fulllen = 0;
4690
4691         if (!retv)
4692                 inlen = 0;
4693         else
4694                 memset(retv, 0, inlen);
4695
4696         if (c->timens.s_boot) {
4697                 strprint(retv, inlen, "%" PRId64 " s\n", c->timens.s_boot);
4698         } else {
4699                 strprint(retv, inlen, "%" PRId64 " ns\n", c->timens.ns_boot);
4700         }
4701
4702         return fulllen;
4703 }
4704
4705 static int get_config_time_offset_monotonic(const char *key, char *retv, int inlen,
4706                                             struct lxc_conf *c, void *data)
4707 {
4708         int len;
4709         int fulllen = 0;
4710
4711         if (!retv)
4712                 inlen = 0;
4713         else
4714                 memset(retv, 0, inlen);
4715
4716         if (c->timens.s_monotonic) {
4717                 strprint(retv, inlen, "%" PRId64 "s\n", c->timens.s_monotonic);
4718         } else {
4719                 strprint(retv, inlen, "%" PRId64 "ns\n", c->timens.ns_monotonic);
4720         }
4721
4722         return fulllen;
4723 }
4724
4725 static int get_config_namespace_share(const char *key, char *retv, int inlen,
4726                                       struct lxc_conf *c, void *data)
4727 {
4728         int len, ns_idx;
4729         const char *namespace;
4730         int fulllen = 0;
4731
4732         if (!retv)
4733                 inlen = 0;
4734         else
4735                 memset(retv, 0, inlen);
4736
4737         namespace = key + STRLITERALLEN("lxc.namespace.share.");
4738         if (is_empty_string(namespace))
4739                 return ret_errno(EINVAL);
4740
4741         ns_idx = lxc_namespace_2_ns_idx(namespace);
4742         if (ns_idx < 0)
4743                 return ns_idx;
4744
4745         strprint(retv, inlen, "%s", c->ns_share[ns_idx]);
4746
4747         return fulllen;
4748 }
4749
4750 /* Callbacks to clear config items. */
4751 static inline int clr_config_personality(const char *key, struct lxc_conf *c,
4752                                          void *data)
4753 {
4754         c->personality = -1;
4755         return 0;
4756 }
4757
4758 static inline int clr_config_pty_max(const char *key, struct lxc_conf *c,
4759                                      void *data)
4760 {
4761         c->pty_max = 0;
4762         return 0;
4763 }
4764
4765 static inline int clr_config_tty_max(const char *key, struct lxc_conf *c,
4766                                      void *data)
4767 {
4768         c->ttys.tty = 0;
4769         return 0;
4770 }
4771
4772 static inline int clr_config_tty_dir(const char *key, struct lxc_conf *c,
4773                                     void *data)
4774 {
4775         free_disarm(c->ttys.dir);
4776         return 0;
4777 }
4778
4779 static inline int clr_config_apparmor_profile(const char *key,
4780                                               struct lxc_conf *c, void *data)
4781 {
4782 #if HAVE_APPARMOR
4783         free_disarm(c->lsm_aa_profile);
4784         return 0;
4785 #else
4786         return syserror_set(-EINVAL, "Built without AppArmor support");
4787 #endif
4788 }
4789
4790 static inline int clr_config_apparmor_allow_incomplete(const char *key,
4791                                                        struct lxc_conf *c,
4792                                                        void *data)
4793 {
4794 #if HAVE_APPARMOR
4795         c->lsm_aa_allow_incomplete = 0;
4796         return 0;
4797 #else
4798         return syserror_set(-EINVAL, "Built without AppArmor support");
4799 #endif
4800 }
4801
4802 static inline int clr_config_apparmor_allow_nesting(const char *key,
4803                                                     struct lxc_conf *c,
4804                                                     void *data)
4805 {
4806 #if HAVE_APPARMOR
4807         c->lsm_aa_allow_nesting = 0;
4808         return 0;
4809 #else
4810         return syserror_set(-EINVAL, "Built without AppArmor support");
4811 #endif
4812 }
4813
4814 static inline int clr_config_apparmor_raw(const char *key,
4815                                           struct lxc_conf *c,
4816                                           void *data)
4817 {
4818 #if HAVE_APPARMOR
4819         return lxc_clear_apparmor_raw(c);
4820 #else
4821         return syserror_set(-EINVAL, "Built without AppArmor support");
4822 #endif
4823 }
4824
4825 static inline int clr_config_selinux_context(const char *key,
4826                                              struct lxc_conf *c, void *data)
4827 {
4828 #if HAVE_SELINUX
4829         free_disarm(c->lsm_se_context);
4830         return 0;
4831 #else
4832         return syserror_set(-EINVAL, "Built without SELinux support");
4833 #endif
4834 }
4835
4836 static inline int clr_config_selinux_context_keyring(const char *key,
4837                                                      struct lxc_conf *c, void *data)
4838 {
4839 #if HAVE_SELINUX
4840         free_disarm(c->lsm_se_keyring_context);
4841         return 0;
4842 #else
4843         return syserror_set(-EINVAL, "Built without SELinux support");
4844 #endif
4845 }
4846
4847 static inline int clr_config_keyring_session(const char *key,
4848                                              struct lxc_conf *c, void *data)
4849 {
4850         c->keyring_disable_session = false;
4851         return 0;
4852 }
4853
4854 static inline int clr_config_cgroup_controller(const char *key,
4855                                                struct lxc_conf *c, void *data)
4856 {
4857         return lxc_clear_cgroups(c, key, CGROUP_SUPER_MAGIC);
4858 }
4859
4860 static inline int clr_config_cgroup2_controller(const char *key,
4861                                                 struct lxc_conf *c, void *data)
4862 {
4863         return lxc_clear_cgroups(c, key, CGROUP2_SUPER_MAGIC);
4864 }
4865
4866 static int clr_config_cgroup_dir(const char *key, struct lxc_conf *lxc_conf,
4867                                  void *data)
4868 {
4869         if (!strequal(key, "lxc.cgroup.dir"))
4870                 return ret_errno(EINVAL);
4871
4872         if (lxc_conf->cgroup_meta.dir)
4873                 free_disarm(lxc_conf->cgroup_meta.dir);
4874
4875         return 0;
4876 }
4877
4878 static int clr_config_cgroup_monitor_dir(const char *key,
4879                                          struct lxc_conf *lxc_conf,
4880                                          void *data)
4881 {
4882         free_disarm(lxc_conf->cgroup_meta.monitor_dir);
4883         return 0;
4884 }
4885
4886 static int clr_config_cgroup_monitor_pivot_dir(const char *key,
4887                                          struct lxc_conf *lxc_conf,
4888                                          void *data)
4889 {
4890         free_disarm(lxc_conf->cgroup_meta.monitor_pivot_dir);
4891         return 0;
4892 }
4893
4894 static int clr_config_cgroup_container_dir(const char *key,
4895                                            struct lxc_conf *lxc_conf,
4896                                            void *data)
4897 {
4898         free_disarm(lxc_conf->cgroup_meta.container_dir);
4899         return 0;
4900 }
4901
4902 static int clr_config_cgroup_container_inner_dir(const char *key,
4903                                                  struct lxc_conf *lxc_conf,
4904                                                  void *data)
4905 {
4906         free_disarm(lxc_conf->cgroup_meta.namespace_dir);
4907         return 0;
4908 }
4909
4910 static inline int clr_config_cgroup_relative(const char *key,
4911                                              struct lxc_conf *lxc_conf,
4912                                              void *data)
4913 {
4914         lxc_conf->cgroup_meta.relative = false;
4915         return 0;
4916 }
4917
4918 static inline int clr_config_idmaps(const char *key, struct lxc_conf *c,
4919                                     void *data)
4920 {
4921         return lxc_clear_idmaps(c);
4922 }
4923
4924 static inline int clr_config_log_level(const char *key, struct lxc_conf *c,
4925                                       void *data)
4926 {
4927         c->loglevel = LXC_LOG_LEVEL_NOTSET;
4928         return 0;
4929 }
4930
4931 static inline int clr_config_log_file(const char *key, struct lxc_conf *c,
4932                                      void *data)
4933 {
4934         free_disarm(c->logfile);
4935         return 0;
4936 }
4937
4938 static inline int clr_config_mount(const char *key, struct lxc_conf *c,
4939                                    void *data)
4940 {
4941         return lxc_clear_mount_entries(c);
4942 }
4943
4944 static inline int clr_config_mount_auto(const char *key, struct lxc_conf *c,
4945                                         void *data)
4946 {
4947         return lxc_clear_automounts(c);
4948 }
4949
4950 static inline int clr_config_mount_fstab(const char *key, struct lxc_conf *c,
4951                                          void *data)
4952 {
4953         free_disarm(c->fstab);
4954         return 0;
4955 }
4956
4957 static inline int clr_config_rootfs_path(const char *key, struct lxc_conf *c,
4958                                          void *data)
4959 {
4960         free_disarm(c->rootfs.path);
4961         return 0;
4962 }
4963
4964 static inline int clr_config_rootfs_managed(const char *key, struct lxc_conf *c,
4965                                             void *data)
4966 {
4967         c->rootfs.managed = true;
4968         return 0;
4969 }
4970
4971 static inline int clr_config_rootfs_mount(const char *key, struct lxc_conf *c,
4972                                           void *data)
4973 {
4974         free_disarm(c->rootfs.mount);
4975         return 0;
4976 }
4977
4978 static inline int clr_config_rootfs_options(const char *key, struct lxc_conf *c,
4979                                             void *data)
4980 {
4981         put_lxc_mount_options(&c->rootfs.mnt_opts);
4982
4983         return 0;
4984 }
4985
4986 static inline int clr_config_uts_name(const char *key, struct lxc_conf *c,
4987                                      void *data)
4988 {
4989         free_disarm(c->utsname);
4990         return 0;
4991 }
4992
4993 static inline int clr_config_hooks(const char *key, struct lxc_conf *c,
4994                                    void *data)
4995 {
4996         return lxc_clear_hooks(c, key);
4997 }
4998
4999 static inline int clr_config_hooks_version(const char *key, struct lxc_conf *c,
5000                                            void *data)
5001 {
5002         /* default to legacy hooks version */
5003         c->hooks_version = 0;
5004         return 0;
5005 }
5006
5007 static inline int clr_config_net(const char *key, struct lxc_conf *c,
5008                                  void *data)
5009 {
5010         lxc_free_networks(c);
5011
5012         return 0;
5013 }
5014
5015 static inline int clr_config_cap_drop(const char *key, struct lxc_conf *c,
5016                                       void *data)
5017 {
5018         return lxc_clear_config_caps(c);
5019 }
5020
5021 static inline int clr_config_cap_keep(const char *key, struct lxc_conf *c,
5022                                       void *data)
5023 {
5024         return lxc_clear_config_caps(c);
5025 }
5026
5027 static inline int clr_config_console_path(const char *key, struct lxc_conf *c,
5028                                           void *data)
5029 {
5030         free_disarm(c->console.path);
5031         return 0;
5032 }
5033
5034 static inline int clr_config_console_logfile(const char *key,
5035                                              struct lxc_conf *c, void *data)
5036 {
5037         free_disarm(c->console.log_path);
5038         return 0;
5039 }
5040
5041 static inline int clr_config_console_rotate(const char *key, struct lxc_conf *c,
5042                                             void *data)
5043 {
5044         c->console.log_rotate = 0;
5045         return 0;
5046 }
5047
5048 static inline int clr_config_console_buffer_size(const char *key,
5049                                                  struct lxc_conf *c, void *data)
5050 {
5051         c->console.buffer_size = 0;
5052         return 0;
5053 }
5054
5055 static inline int clr_config_console_size(const char *key, struct lxc_conf *c,
5056                                           void *data)
5057 {
5058         c->console.log_size = 0;
5059         return 0;
5060 }
5061
5062 static inline int clr_config_seccomp_allow_nesting(const char *key,
5063                                                    struct lxc_conf *c, void *data)
5064 {
5065 #ifdef HAVE_SECCOMP
5066         c->seccomp.allow_nesting = 0;
5067         return 0;
5068 #else
5069         return ret_errno(ENOSYS);
5070 #endif
5071 }
5072
5073 static inline int clr_config_seccomp_notify_cookie(const char *key,
5074                                                    struct lxc_conf *c, void *data)
5075 {
5076 #ifdef HAVE_SECCOMP_NOTIFY
5077         free_disarm(c->seccomp.notifier.cookie);
5078         return 0;
5079 #else
5080         return ret_errno(ENOSYS);
5081 #endif
5082 }
5083
5084 static inline int clr_config_seccomp_notify_proxy(const char *key,
5085                                                    struct lxc_conf *c, void *data)
5086 {
5087 #ifdef HAVE_SECCOMP_NOTIFY
5088         memset(&c->seccomp.notifier.proxy_addr, 0,
5089                sizeof(c->seccomp.notifier.proxy_addr));
5090         return 0;
5091 #else
5092         return ret_errno(ENOSYS);
5093 #endif
5094 }
5095
5096 static inline int clr_config_seccomp_profile(const char *key,
5097                                              struct lxc_conf *c, void *data)
5098 {
5099         free_disarm(c->seccomp.seccomp);
5100         return 0;
5101 }
5102
5103 static inline int clr_config_autodev(const char *key, struct lxc_conf *c,
5104                                      void *data)
5105 {
5106         c->autodev = 1;
5107         return 0;
5108 }
5109
5110 static inline int clr_config_autodev_tmpfs_size(const char *key, struct lxc_conf *c,
5111                                      void *data)
5112 {
5113         c->autodevtmpfssize = 500000;
5114         return 0;
5115 }
5116
5117 static inline int clr_config_signal_halt(const char *key, struct lxc_conf *c,
5118                                         void *data)
5119 {
5120         c->haltsignal = 0;
5121         return 0;
5122 }
5123
5124 static inline int clr_config_signal_reboot(const char *key, struct lxc_conf *c,
5125                                           void *data)
5126 {
5127         c->rebootsignal = 0;
5128         return 0;
5129 }
5130
5131 static inline int clr_config_signal_stop(const char *key, struct lxc_conf *c,
5132                                         void *data)
5133 {
5134         c->stopsignal = 0;
5135         return 0;
5136 }
5137
5138 static inline int clr_config_start(const char *key, struct lxc_conf *c,
5139                                    void *data)
5140 {
5141         if (strequal(key + 10, "auto"))
5142                 c->start_auto = 0;
5143         else if (strequal(key + 10, "delay"))
5144                 c->start_delay = 0;
5145         else if (strequal(key + 10, "order"))
5146                 c->start_order = 0;
5147
5148         return 0;
5149 }
5150
5151 static inline int clr_config_log_syslog(const char *key, struct lxc_conf *c,
5152                                     void *data)
5153 {
5154         free_disarm(c->syslog);
5155         return 0;
5156 }
5157
5158 static inline int clr_config_monitor(const char *key, struct lxc_conf *c,
5159                                      void *data)
5160 {
5161         c->monitor_unshare = 0;
5162         return 0;
5163 }
5164
5165 static inline int clr_config_monitor_signal_pdeath(const char *key,
5166                                                    struct lxc_conf *c, void *data)
5167 {
5168         c->monitor_signal_pdeath = 0;
5169         return 0;
5170 }
5171
5172 static inline int clr_config_group(const char *key, struct lxc_conf *c,
5173                                    void *data)
5174 {
5175         return lxc_clear_groups(c);
5176 }
5177
5178 static inline int clr_config_environment(const char *key, struct lxc_conf *c,
5179                                          void *data)
5180 {
5181         return lxc_clear_environment(c);
5182 }
5183
5184 static inline int clr_config_execute_cmd(const char *key, struct lxc_conf *c,
5185                                       void *data)
5186 {
5187         free_disarm(c->execute_cmd);
5188         return 0;
5189 }
5190
5191 static inline int clr_config_init_cmd(const char *key, struct lxc_conf *c,
5192                                       void *data)
5193 {
5194         free_disarm(c->init_cmd);
5195         return 0;
5196 }
5197
5198 static inline int clr_config_init_cwd(const char *key, struct lxc_conf *c,
5199                                       void *data)
5200 {
5201         free_disarm(c->init_cwd);
5202         return 0;
5203 }
5204
5205 static inline int clr_config_init_uid(const char *key, struct lxc_conf *c,
5206                                       void *data)
5207 {
5208         c->init_uid = 0;
5209         return 0;
5210 }
5211
5212 static inline int clr_config_init_gid(const char *key, struct lxc_conf *c,
5213                                       void *data)
5214 {
5215         c->init_gid = 0;
5216         return 0;
5217 }
5218
5219 static inline int clr_config_init_groups(const char *key, struct lxc_conf *c,
5220                                          void *data)
5221 {
5222         c->init_groups.size = 0;
5223         free_disarm(c->init_groups.list);
5224         return 0;
5225 }
5226
5227 static inline int clr_config_ephemeral(const char *key, struct lxc_conf *c,
5228                                        void *data)
5229 {
5230         c->ephemeral = 0;
5231         return 0;
5232 }
5233
5234 static inline int clr_config_no_new_privs(const char *key, struct lxc_conf *c,
5235                                           void *data)
5236 {
5237         c->no_new_privs = false;
5238         return 0;
5239 }
5240
5241 static inline int clr_config_prlimit(const char *key, struct lxc_conf *c,
5242                                    void *data)
5243 {
5244         return lxc_clear_limits(c, key);
5245 }
5246
5247 static inline int clr_config_sysctl(const char *key, struct lxc_conf *c,
5248                                    void *data)
5249 {
5250         return lxc_clear_sysctls(c, key);
5251 }
5252
5253 static inline int clr_config_proc(const char *key, struct lxc_conf *c,
5254                                    void *data)
5255 {
5256         return lxc_clear_procs(c, key);
5257 }
5258
5259 static inline int clr_config_includefiles(const char *key, struct lxc_conf *c,
5260                                           void *data)
5261 {
5262         return 0;
5263 }
5264
5265 static int clr_config_namespace_clone(const char *key,
5266                                       struct lxc_conf *lxc_conf, void *data)
5267 {
5268         lxc_conf->ns_clone = 0;
5269         return 0;
5270 }
5271
5272 static int clr_config_namespace_keep(const char *key, struct lxc_conf *lxc_conf,
5273                                      void *data)
5274 {
5275         lxc_conf->ns_keep = 0;
5276         return 0;
5277 }
5278
5279 static int clr_config_time_offset_boot(const char *key, struct lxc_conf *lxc_conf, void *data)
5280 {
5281         lxc_conf->timens.s_boot = 0;
5282         lxc_conf->timens.ns_boot = 0;
5283         return 0;
5284 }
5285
5286 static int clr_config_time_offset_monotonic(const char *key, struct lxc_conf *lxc_conf, void *data)
5287 {
5288         lxc_conf->timens.s_monotonic = 0;
5289         lxc_conf->timens.ns_monotonic = 0;
5290         return 0;
5291 }
5292
5293 static int clr_config_namespace_share(const char *key,
5294                                       struct lxc_conf *lxc_conf, void *data)
5295 {
5296         int ns_idx;
5297         const char *namespace;
5298
5299         namespace = key + STRLITERALLEN("lxc.namespace.share.");
5300         if (is_empty_string(namespace))
5301                 return ret_errno(EINVAL);
5302
5303         ns_idx = lxc_namespace_2_ns_idx(namespace);
5304         if (ns_idx < 0)
5305                 return ns_idx;
5306
5307         free(lxc_conf->ns_share[ns_idx]);
5308         lxc_conf->ns_share[ns_idx] = NULL;
5309
5310         return 0;
5311 }
5312
5313 static int get_config_includefiles(const char *key, char *retv, int inlen,
5314                                    struct lxc_conf *c, void *data)
5315 {
5316         return ret_errno(ENOSYS);
5317 }
5318
5319 struct config_net_info {
5320         char buf[NETWORK_SUBKEY_SIZE_MAX];
5321         const char *subkey;
5322         const struct lxc_config_net_t *ops;
5323         struct lxc_netdev *netdev;
5324 };
5325
5326 static int get_network_config_ops(const char *key, struct lxc_conf *lxc_conf,
5327                                   struct config_net_info *info, bool allocate)
5328 {
5329         int ret;
5330         int64_t tmpidx;
5331         unsigned int idx;
5332         const char *idx_start;
5333
5334         if (is_empty_string(key))
5335                 return ret_errno(EINVAL);
5336
5337         /* check that this is a sensible network key */
5338         if (!strnequal("lxc.net.", key, STRLITERALLEN("lxc.net.")))
5339                 return syserror_set(-EINVAL, "Invalid network configuration key \"%s\"", key);
5340
5341         /* lxc.net.<n> */
5342         /* beginning of index string */
5343         idx_start = key + STRLITERALLEN("lxc.net.");
5344         if (!isdigit(*idx_start))
5345                 return syserror_set(-EINVAL, "Failed to detect digit in string \"%s\"", key + 8);
5346
5347         ret = lxc_safe_int64_residual(idx_start, &tmpidx, 10, info->buf, sizeof(info->buf));
5348         if (ret)
5349                 return syserror("Failed to parse network index");
5350
5351         if (tmpidx < 0 || tmpidx >= INT_MAX)
5352                 return syserror_set(-ERANGE, "Number of configured networks would overflow the counter");
5353         idx = (unsigned int)tmpidx;
5354
5355         info->netdev = lxc_get_netdev_by_idx(lxc_conf, idx, allocate);
5356         if (!info->netdev)
5357                 return ret_errno(EINVAL);
5358
5359         /* Make sure subkey points to the empty string. */
5360         info->subkey = info->buf;
5361         if (is_empty_string(info->subkey))
5362                 return ret_errno(ENOENT);
5363
5364         if (info->subkey[0] != '.')
5365                 return syserror_set(-EINVAL, "Invalid subkey");
5366         info->subkey++;
5367
5368         /* lxc.net.<idx>.<subkey> */
5369         info->ops = lxc_get_config_net(info->subkey);
5370         if (info->ops == &unsupported_config_net_key)
5371                 return syserror_set(-ENOENT, "Unknown network configuration key \"%s\"", key);
5372
5373         return 0;
5374 }
5375
5376 /* Config entry is something like "lxc.net.0.ipv4" the key 'lxc.net.' was
5377  * found. So we make sure next comes an integer, find the right callback (by
5378  * rewriting the key), and call it.
5379  */
5380 static int set_config_jump_table_net(const char *key, const char *value,
5381                                      struct lxc_conf *lxc_conf, void *data)
5382 {
5383         struct config_net_info info = {};
5384         int ret;
5385         const char *idxstring;
5386
5387         idxstring = key + STRLITERALLEN("lxc.net.");
5388         if (!isdigit(*idxstring))
5389                 return ret_errno(EINVAL);
5390
5391         if (lxc_config_value_empty(value))
5392                 return clr_config_jump_table_net(key, lxc_conf, data);
5393
5394         ret = get_network_config_ops(key, lxc_conf, &info, true);
5395         if (ret)
5396                 return ret;
5397
5398         return info.ops->set(info.subkey, value, lxc_conf, info.netdev);
5399 }
5400
5401 static int clr_config_jump_table_net(const char *key, struct lxc_conf *lxc_conf,
5402                                      void *data)
5403 {
5404         struct config_net_info info = {};
5405         int ret;
5406         const char *idxstring;
5407
5408         idxstring = key + 8;
5409         if (!isdigit(*idxstring))
5410                 return ret_errno(EINVAL);
5411
5412         /* The left conjunct is pretty self-explanatory. The right conjunct
5413          * checks whether the two pointers are equal. If they are we know that
5414          * this is not a key that is namespaced any further and so we are
5415          * supposed to clear the whole network.
5416          */
5417         if (isdigit(*idxstring) && (strrchr(key, '.') == (idxstring - 1))) {
5418                 unsigned int rmnetdevidx;
5419
5420                 ret = lxc_safe_uint(idxstring, &rmnetdevidx);
5421                 if (ret < 0)
5422                         return ret;
5423
5424                 /* Remove network from network list. */
5425                 lxc_remove_nic_by_idx(lxc_conf, rmnetdevidx);
5426                 return 0;
5427         }
5428
5429         ret = get_network_config_ops(key, lxc_conf, &info, false);
5430         if (ret)
5431                 return ret;
5432
5433         return info.ops->clr(info.subkey, lxc_conf, info.netdev);
5434 }
5435
5436 static int clr_config_net_type(const char *key, struct lxc_conf *lxc_conf,
5437                                void *data)
5438 {
5439         struct lxc_netdev *netdev = data;
5440
5441         if (!netdev)
5442                 return ret_errno(EINVAL);
5443
5444         lxc_clear_netdev(netdev);
5445
5446         return 0;
5447 }
5448
5449 static int clr_config_net_name(const char *key, struct lxc_conf *lxc_conf,
5450                                void *data)
5451 {
5452         struct lxc_netdev *netdev = data;
5453
5454         if (!netdev)
5455                 return ret_errno(EINVAL);
5456
5457         netdev->name[0] = '\0';
5458
5459         return 0;
5460 }
5461
5462 static int clr_config_net_flags(const char *key, struct lxc_conf *lxc_conf,
5463                                 void *data)
5464 {
5465         struct lxc_netdev *netdev = data;
5466
5467         if (!netdev)
5468                 return ret_errno(EINVAL);
5469
5470         netdev->flags = 0;
5471
5472         return 0;
5473 }
5474
5475 static int clr_config_net_link(const char *key, struct lxc_conf *lxc_conf,
5476                                void *data)
5477 {
5478         struct lxc_netdev *netdev = data;
5479
5480         if (!netdev)
5481                 return ret_errno(EINVAL);
5482
5483         netdev->link[0] = '\0';
5484
5485         return 0;
5486 }
5487
5488 static int clr_config_net_l2proxy(const char *key, struct lxc_conf *lxc_conf,
5489                                void *data)
5490 {
5491         struct lxc_netdev *netdev = data;
5492
5493         if (!netdev)
5494                 return ret_errno(EINVAL);
5495
5496         netdev->l2proxy = false;
5497
5498         return 0;
5499 }
5500
5501 static int clr_config_net_macvlan_mode(const char *key,
5502                                        struct lxc_conf *lxc_conf, void *data)
5503 {
5504         struct lxc_netdev *netdev = data;
5505
5506         if (!netdev)
5507                 return ret_errno(EINVAL);
5508
5509         if (netdev->type != LXC_NET_MACVLAN)
5510                 return 0;
5511
5512         netdev->priv.macvlan_attr.mode = -1;
5513
5514         return 0;
5515 }
5516
5517 static int clr_config_net_ipvlan_mode(const char *key,
5518                                        struct lxc_conf *lxc_conf, void *data)
5519 {
5520         struct lxc_netdev *netdev = data;
5521
5522         if (!netdev)
5523                 return ret_errno(EINVAL);
5524
5525         if (netdev->type != LXC_NET_IPVLAN)
5526                 return 0;
5527
5528         netdev->priv.ipvlan_attr.mode = -1;
5529
5530         return 0;
5531 }
5532
5533 static int clr_config_net_ipvlan_isolation(const char *key,
5534                                            struct lxc_conf *lxc_conf, void *data)
5535 {
5536         struct lxc_netdev *netdev = data;
5537
5538         if (!netdev)
5539                 return ret_errno(EINVAL);
5540
5541         if (netdev->type != LXC_NET_IPVLAN)
5542                 return 0;
5543
5544         netdev->priv.ipvlan_attr.isolation = -1;
5545
5546         return 0;
5547 }
5548
5549 static int clr_config_net_veth_mode(const char *key,
5550                                        struct lxc_conf *lxc_conf, void *data)
5551 {
5552         struct lxc_netdev *netdev = data;
5553
5554         if (!netdev)
5555                 return ret_errno(EINVAL);
5556
5557         if (netdev->type != LXC_NET_VETH)
5558                 return 0;
5559
5560         netdev->priv.veth_attr.mode = -1;
5561
5562         return 0;
5563 }
5564
5565 static int clr_config_net_veth_pair(const char *key, struct lxc_conf *lxc_conf,
5566                                     void *data)
5567 {
5568         struct lxc_netdev *netdev = data;
5569
5570         if (!netdev)
5571                 return ret_errno(EINVAL);
5572
5573         if (netdev->type != LXC_NET_VETH)
5574                 return 0;
5575
5576         netdev->priv.veth_attr.pair[0] = '\0';
5577
5578         return 0;
5579 }
5580
5581 static int clr_config_net_veth_vlan_id(const char *key, struct lxc_conf *lxc_conf,
5582                                   void *data)
5583 {
5584         struct lxc_netdev *netdev = data;
5585
5586         if (!netdev)
5587                 return ret_errno(EINVAL);
5588
5589         if (netdev->type != LXC_NET_VETH)
5590                 return 0;
5591
5592         netdev->priv.veth_attr.vlan_id = 0;
5593         netdev->priv.veth_attr.vlan_id_set = false;
5594
5595         return 0;
5596 }
5597
5598 static int clr_config_net_veth_vlan_tagged_id(const char *key,
5599                                        struct lxc_conf *lxc_conf, void *data)
5600 {
5601         struct lxc_netdev *netdev = data;
5602         struct lxc_list *cur, *next;
5603
5604         if (!netdev)
5605                 return ret_errno(EINVAL);
5606
5607         if (netdev->type != LXC_NET_VETH)
5608                 return 0;
5609
5610         lxc_list_for_each_safe(cur, &netdev->priv.veth_attr.vlan_tagged_ids, next) {
5611                 lxc_list_del(cur);
5612                 free(cur);
5613         }
5614
5615         return 0;
5616 }
5617
5618
5619 static int clr_config_net_script_up(const char *key, struct lxc_conf *lxc_conf,
5620                                     void *data)
5621 {
5622         struct lxc_netdev *netdev = data;
5623
5624         if (!netdev)
5625                 return ret_errno(EINVAL);
5626
5627         free_disarm(netdev->upscript);
5628
5629         return 0;
5630 }
5631
5632 static int clr_config_net_script_down(const char *key,
5633                                       struct lxc_conf *lxc_conf, void *data)
5634 {
5635         struct lxc_netdev *netdev = data;
5636
5637         if (!netdev)
5638                 return ret_errno(EINVAL);
5639
5640         free_disarm(netdev->downscript);
5641
5642         return 0;
5643 }
5644
5645 static int clr_config_net_hwaddr(const char *key, struct lxc_conf *lxc_conf,
5646                                  void *data)
5647 {
5648         struct lxc_netdev *netdev = data;
5649
5650         if (!netdev)
5651                 return ret_errno(EINVAL);
5652
5653         free_disarm(netdev->hwaddr);
5654
5655         return 0;
5656 }
5657
5658 static int clr_config_net_mtu(const char *key, struct lxc_conf *lxc_conf,
5659                               void *data)
5660 {
5661         struct lxc_netdev *netdev = data;
5662
5663         if (!netdev)
5664                 return ret_errno(EINVAL);
5665
5666         free_disarm(netdev->mtu);
5667
5668         return 0;
5669 }
5670
5671 static int clr_config_net_vlan_id(const char *key, struct lxc_conf *lxc_conf,
5672                                   void *data)
5673 {
5674         struct lxc_netdev *netdev = data;
5675
5676         if (!netdev)
5677                 return ret_errno(EINVAL);
5678
5679         if (netdev->type != LXC_NET_VLAN)
5680                 return 0;
5681
5682         netdev->priv.vlan_attr.vid = 0;
5683
5684         return 0;
5685 }
5686
5687 static int clr_config_net_ipv4_gateway(const char *key,
5688                                        struct lxc_conf *lxc_conf, void *data)
5689 {
5690         struct lxc_netdev *netdev = data;
5691
5692         if (!netdev)
5693                 return ret_errno(EINVAL);
5694
5695         free_disarm(netdev->ipv4_gateway);
5696
5697         return 0;
5698 }
5699
5700 static int clr_config_net_ipv4_address(const char *key,
5701                                        struct lxc_conf *lxc_conf, void *data)
5702 {
5703         struct lxc_netdev *netdev = data;
5704         struct lxc_inetdev *inetdev, *ninetdev;
5705
5706         if (!netdev)
5707                 return ret_errno(EINVAL);
5708
5709         list_for_each_entry_safe(inetdev, ninetdev, &netdev->ipv4_addresses, head) {
5710                 list_del(&inetdev->head);
5711                 free(inetdev);
5712         }
5713
5714         return 0;
5715 }
5716
5717 static int clr_config_net_veth_ipv4_route(const char *key,
5718                                           struct lxc_conf *lxc_conf, void *data)
5719 {
5720         struct lxc_netdev *netdev = data;
5721         struct lxc_inetdev *inetdev, *ninetdev;
5722
5723         if (!netdev)
5724                 return ret_errno(EINVAL);
5725
5726         if (netdev->type != LXC_NET_VETH)
5727                 return 0;
5728
5729         list_for_each_entry_safe(inetdev, ninetdev, &netdev->priv.veth_attr.ipv4_routes, head) {
5730                 list_del(&inetdev->head);
5731                 free(inetdev);
5732         }
5733
5734         return 0;
5735 }
5736
5737 static int clr_config_net_ipv6_gateway(const char *key,
5738                                        struct lxc_conf *lxc_conf, void *data)
5739 {
5740         struct lxc_netdev *netdev = data;
5741
5742         if (!netdev)
5743                 return ret_errno(EINVAL);
5744
5745         free_disarm(netdev->ipv6_gateway);
5746
5747         return 0;
5748 }
5749
5750 static int clr_config_net_ipv6_address(const char *key,
5751                                        struct lxc_conf *lxc_conf, void *data)
5752 {
5753         struct lxc_netdev *netdev = data;
5754         struct lxc_inet6dev *inet6dev, *ninet6dev;
5755
5756         if (!netdev)
5757                 return ret_errno(EINVAL);
5758
5759         list_for_each_entry_safe(inet6dev, ninet6dev, &netdev->ipv6_addresses, head) {
5760                 list_del(&inet6dev->head);
5761                 free(inet6dev);
5762         }
5763
5764         return 0;
5765 }
5766
5767 static int clr_config_net_veth_ipv6_route(const char *key,
5768                                           struct lxc_conf *lxc_conf, void *data)
5769 {
5770         struct lxc_netdev *netdev = data;
5771         struct lxc_inet6dev *inet6dev, *ninet6dev;
5772
5773         if (!netdev)
5774                 return ret_errno(EINVAL);
5775
5776         if (netdev->type != LXC_NET_VETH)
5777                 return 0;
5778
5779         list_for_each_entry_safe(inet6dev, ninet6dev, &netdev->priv.veth_attr.ipv6_routes, head) {
5780                 list_del(&inet6dev->head);
5781                 free(inet6dev);
5782         }
5783
5784         return 0;
5785 }
5786
5787 static int get_config_jump_table_net(const char *key, char *retv, int inlen,
5788                                      struct lxc_conf *c, void *data)
5789 {
5790         struct config_net_info info = {};
5791         int ret;
5792         const char *idxstring;
5793
5794         idxstring = key + STRLITERALLEN("lxc.net.");
5795         if (!isdigit(*idxstring))
5796                 return ret_errno(EINVAL);
5797
5798         ret = get_network_config_ops(key, c, &info, false);
5799         if (ret)
5800                 return ret;
5801
5802         return info.ops->get(info.subkey, retv, inlen, c, info.netdev);
5803 }
5804
5805 static int get_config_net_type(const char *key, char *retv, int inlen,
5806                                struct lxc_conf *c, void *data)
5807 {
5808         int len;
5809         int fulllen = 0;
5810         struct lxc_netdev *netdev = data;
5811
5812         if (!netdev)
5813                 return ret_errno(EINVAL);
5814
5815         if (!retv)
5816                 inlen = 0;
5817         else
5818                 memset(retv, 0, inlen);
5819
5820         strprint(retv, inlen, "%s", lxc_net_type_to_str(netdev->type));
5821
5822         return fulllen;
5823 }
5824
5825 static int get_config_net_flags(const char *key, char *retv, int inlen,
5826                                 struct lxc_conf *c, void *data)
5827 {
5828         int len;
5829         int fulllen = 0;
5830         struct lxc_netdev *netdev = data;
5831
5832         if (!netdev)
5833                 return ret_errno(EINVAL);
5834
5835         if (!retv)
5836                 inlen = 0;
5837         else
5838                 memset(retv, 0, inlen);
5839
5840         if (netdev->flags & IFF_UP)
5841                 strprint(retv, inlen, "up");
5842
5843         return fulllen;
5844 }
5845
5846 static int get_config_net_link(const char *key, char *retv, int inlen,
5847                                struct lxc_conf *c, void *data)
5848 {
5849         int len;
5850         int fulllen = 0;
5851         struct lxc_netdev *netdev = data;
5852
5853         if (!netdev)
5854                 return ret_errno(EINVAL);
5855
5856         if (!retv)
5857                 inlen = 0;
5858         else
5859                 memset(retv, 0, inlen);
5860
5861         if (netdev->link[0] != '\0')
5862                 strprint(retv, inlen, "%s", netdev->link);
5863
5864         return fulllen;
5865 }
5866
5867 static int get_config_net_l2proxy(const char *key, char *retv, int inlen,
5868                                   struct lxc_conf *c, void *data)
5869 {
5870         struct lxc_netdev *netdev = data;
5871
5872         if (!netdev)
5873                 return ret_errno(EINVAL);
5874
5875         return lxc_get_conf_bool(c, retv, inlen, netdev->l2proxy);
5876 }
5877
5878 static int get_config_net_name(const char *key, char *retv, int inlen,
5879                                struct lxc_conf *c, void *data)
5880 {
5881         int len;
5882         int fulllen = 0;
5883         struct lxc_netdev *netdev = data;
5884
5885         if (!netdev)
5886                 return ret_errno(EINVAL);
5887
5888         if (!retv)
5889                 inlen = 0;
5890         else
5891                 memset(retv, 0, inlen);
5892
5893         if (netdev->name[0] != '\0')
5894                 strprint(retv, inlen, "%s", netdev->name);
5895
5896         return fulllen;
5897 }
5898
5899 static int get_config_net_macvlan_mode(const char *key, char *retv, int inlen,
5900                                        struct lxc_conf *c, void *data)
5901 {
5902         int len;
5903         int fulllen = 0;
5904         const char *mode;
5905         struct lxc_netdev *netdev = data;
5906
5907         if (!netdev)
5908                 return ret_errno(EINVAL);
5909
5910         if (netdev->type != LXC_NET_MACVLAN)
5911                 return ret_errno(EINVAL);
5912
5913         if (!retv)
5914                 inlen = 0;
5915         else
5916                 memset(retv, 0, inlen);
5917
5918         switch (netdev->priv.macvlan_attr.mode) {
5919         case MACVLAN_MODE_PRIVATE:
5920                 mode = "private";
5921                 break;
5922         case MACVLAN_MODE_VEPA:
5923                 mode = "vepa";
5924                 break;
5925         case MACVLAN_MODE_BRIDGE:
5926                 mode = "bridge";
5927                 break;
5928         case MACVLAN_MODE_PASSTHRU:
5929                 mode = "passthru";
5930                 break;
5931         default:
5932                 mode = "(invalid)";
5933                 break;
5934         }
5935
5936         strprint(retv, inlen, "%s", mode);
5937
5938         return fulllen;
5939 }
5940
5941 static int get_config_net_ipvlan_mode(const char *key, char *retv, int inlen,
5942                                        struct lxc_conf *c, void *data)
5943 {
5944         int fulllen = 0;
5945         struct lxc_netdev *netdev = data;
5946         int len;
5947         const char *mode;
5948
5949         if (!netdev)
5950                 return ret_errno(EINVAL);
5951
5952         if (netdev->type != LXC_NET_IPVLAN)
5953                 return ret_errno(EINVAL);
5954
5955         if (!retv)
5956                 inlen = 0;
5957         else
5958                 memset(retv, 0, inlen);
5959
5960         switch (netdev->priv.ipvlan_attr.mode) {
5961         case IPVLAN_MODE_L3:
5962                 mode = "l3";
5963                 break;
5964         case IPVLAN_MODE_L3S:
5965                 mode = "l3s";
5966                 break;
5967         case IPVLAN_MODE_L2:
5968                 mode = "l2";
5969                 break;
5970         default:
5971                 mode = "(invalid)";
5972                 break;
5973         }
5974
5975         strprint(retv, inlen, "%s", mode);
5976
5977         return fulllen;
5978 }
5979
5980 static int get_config_net_ipvlan_isolation(const char *key, char *retv, int inlen,
5981                                        struct lxc_conf *c, void *data)
5982 {
5983         int fulllen = 0;
5984         struct lxc_netdev *netdev = data;
5985         int len;
5986         const char *mode;
5987
5988         if (!netdev)
5989                 return ret_errno(EINVAL);
5990
5991         if (netdev->type != LXC_NET_IPVLAN)
5992                 return ret_errno(EINVAL);
5993
5994         if (!retv)
5995                 inlen = 0;
5996         else
5997                 memset(retv, 0, inlen);
5998
5999         switch (netdev->priv.ipvlan_attr.isolation) {
6000         case IPVLAN_ISOLATION_BRIDGE:
6001                 mode = "bridge";
6002                 break;
6003         case IPVLAN_ISOLATION_PRIVATE:
6004                 mode = "private";
6005                 break;
6006         case IPVLAN_ISOLATION_VEPA:
6007                 mode = "vepa";
6008                 break;
6009         default:
6010                 mode = "(invalid)";
6011                 break;
6012         }
6013
6014         strprint(retv, inlen, "%s", mode);
6015
6016         return fulllen;
6017 }
6018
6019 static int get_config_net_veth_mode(const char *key, char *retv, int inlen,
6020                                     struct lxc_conf *c, void *data)
6021 {
6022         int fulllen = 0;
6023         struct lxc_netdev *netdev = data;
6024         int len;
6025         const char *mode;
6026
6027         if (!netdev)
6028                 return ret_errno(EINVAL);
6029
6030         if (netdev->type != LXC_NET_VETH)
6031                 return ret_errno(EINVAL);
6032
6033         if (!retv)
6034                 inlen = 0;
6035         else
6036                 memset(retv, 0, inlen);
6037
6038         switch (netdev->priv.veth_attr.mode) {
6039         case VETH_MODE_BRIDGE:
6040                 mode = "bridge";
6041                 break;
6042         case VETH_MODE_ROUTER:
6043                 mode = "router";
6044                 break;
6045         default:
6046                 mode = "(invalid)";
6047                 break;
6048         }
6049
6050         strprint(retv, inlen, "%s", mode);
6051
6052         return fulllen;
6053 }
6054
6055 static int get_config_net_veth_pair(const char *key, char *retv, int inlen,
6056                                     struct lxc_conf *c, void *data)
6057 {
6058         int len;
6059         int fulllen = 0;
6060         struct lxc_netdev *netdev = data;
6061
6062         if (!netdev)
6063                 return ret_errno(EINVAL);
6064
6065         if (netdev->type != LXC_NET_VETH)
6066                 return ret_errno(EINVAL);
6067
6068         if (!retv)
6069                 inlen = 0;
6070         else
6071                 memset(retv, 0, inlen);
6072
6073         strprint(retv, inlen, "%s",
6074                  netdev->priv.veth_attr.pair[0] != '\0'
6075                      ? netdev->priv.veth_attr.pair
6076                      : netdev->priv.veth_attr.veth1);
6077
6078         return fulllen;
6079 }
6080
6081 static int get_config_net_veth_vlan_id(const char *key, char *retv, int inlen,
6082                                        struct lxc_conf *c, void *data)
6083 {
6084         int len;
6085         int fulllen = 0;
6086         struct lxc_netdev *netdev = data;
6087
6088         if (!netdev)
6089                 return ret_errno(EINVAL);
6090
6091         if (netdev->type != LXC_NET_VETH)
6092                 return ret_errno(EINVAL);
6093
6094         if (!retv)
6095                 inlen = 0;
6096         else
6097                 memset(retv, 0, inlen);
6098
6099         strprint(retv, inlen, "%d", netdev->priv.veth_attr.vlan_id);
6100
6101         return fulllen;
6102 }
6103
6104 static int get_config_net_veth_vlan_tagged_id(const char *key, char *retv,
6105                                               int inlen, struct lxc_conf *c,
6106                                               void *data)
6107 {
6108         int len;
6109         size_t listlen;
6110         struct lxc_list *it;
6111         int fulllen = 0;
6112         struct lxc_netdev *netdev = data;
6113
6114         if (!netdev)
6115                 return ret_errno(EINVAL);
6116
6117         if (netdev->type != LXC_NET_VETH)
6118                 return ret_errno(EINVAL);
6119
6120         if (!retv)
6121                 inlen = 0;
6122         else
6123                 memset(retv, 0, inlen);
6124
6125         listlen = lxc_list_len(&netdev->priv.veth_attr.vlan_tagged_ids);
6126
6127         lxc_list_for_each(it, &netdev->priv.veth_attr.vlan_tagged_ids) {
6128                 unsigned short i = PTR_TO_USHORT(it->elem);
6129                 strprint(retv, inlen, "%u%s", i, (listlen-- > 1) ? "\n" : "");
6130         }
6131
6132         return fulllen;
6133 }
6134
6135 static int get_config_net_script_up(const char *key, char *retv, int inlen,
6136                                     struct lxc_conf *c, void *data)
6137 {
6138         int len;
6139         int fulllen = 0;
6140         struct lxc_netdev *netdev = data;
6141
6142         if (!netdev)
6143                 return ret_errno(EINVAL);
6144
6145         if (!retv)
6146                 inlen = 0;
6147         else
6148                 memset(retv, 0, inlen);
6149
6150         if (netdev->upscript)
6151                 strprint(retv, inlen, "%s", netdev->upscript);
6152
6153         return fulllen;
6154 }
6155
6156 static int get_config_net_script_down(const char *key, char *retv, int inlen,
6157                                       struct lxc_conf *c, void *data)
6158 {
6159         int len;
6160         int fulllen = 0;
6161         struct lxc_netdev *netdev = data;
6162
6163         if (!netdev)
6164                 return ret_errno(EINVAL);
6165
6166         if (!retv)
6167                 inlen = 0;
6168         else
6169                 memset(retv, 0, inlen);
6170
6171         if (netdev->downscript)
6172                 strprint(retv, inlen, "%s", netdev->downscript);
6173
6174         return fulllen;
6175 }
6176
6177 static int get_config_net_hwaddr(const char *key, char *retv, int inlen,
6178                                  struct lxc_conf *c, void *data)
6179 {
6180         int len;
6181         int fulllen = 0;
6182         struct lxc_netdev *netdev = data;
6183
6184         if (!netdev)
6185                 return ret_errno(EINVAL);
6186
6187         if (!retv)
6188                 inlen = 0;
6189         else
6190                 memset(retv, 0, inlen);
6191
6192         if (netdev->hwaddr)
6193                 strprint(retv, inlen, "%s", netdev->hwaddr);
6194
6195         return fulllen;
6196 }
6197
6198 static int get_config_net_mtu(const char *key, char *retv, int inlen,
6199                               struct lxc_conf *c, void *data)
6200 {
6201         int len;
6202         int fulllen = 0;
6203         struct lxc_netdev *netdev = data;
6204
6205         if (!netdev)
6206                 return ret_errno(EINVAL);
6207
6208         if (!retv)
6209                 inlen = 0;
6210         else
6211                 memset(retv, 0, inlen);
6212
6213         if (netdev->mtu)
6214                 strprint(retv, inlen, "%s", netdev->mtu);
6215
6216         return fulllen;
6217 }
6218
6219 static int get_config_net_vlan_id(const char *key, char *retv, int inlen,
6220                                   struct lxc_conf *c, void *data)
6221 {
6222         int len;
6223         int fulllen = 0;
6224         struct lxc_netdev *netdev = data;
6225
6226         if (!netdev)
6227                 return ret_errno(EINVAL);
6228
6229         if (netdev->type != LXC_NET_VLAN)
6230                 return ret_errno(EINVAL);
6231
6232         if (!retv)
6233                 inlen = 0;
6234         else
6235                 memset(retv, 0, inlen);
6236
6237         strprint(retv, inlen, "%d", netdev->priv.vlan_attr.vid);
6238
6239         return fulllen;
6240 }
6241
6242 static int get_config_net_ipv4_gateway(const char *key, char *retv, int inlen,
6243                                        struct lxc_conf *c, void *data)
6244 {
6245         int len;
6246         char buf[INET_ADDRSTRLEN];
6247         int fulllen = 0;
6248         struct lxc_netdev *netdev = data;
6249
6250         if (!netdev)
6251                 return ret_errno(EINVAL);
6252
6253         if (!retv)
6254                 inlen = 0;
6255         else
6256                 memset(retv, 0, inlen);
6257
6258         if (netdev->ipv4_gateway_auto) {
6259                 strprint(retv, inlen, "auto");
6260         } else if (netdev->ipv4_gateway_dev) {
6261                 strprint(retv, inlen, "dev");
6262         } else if (netdev->ipv4_gateway) {
6263                 if (!inet_ntop(AF_INET, netdev->ipv4_gateway, buf, sizeof(buf)))
6264                         return -errno;
6265                 strprint(retv, inlen, "%s", buf);
6266         }
6267
6268         return fulllen;
6269 }
6270
6271 static int get_config_net_ipv4_address(const char *key, char *retv, int inlen,
6272                                        struct lxc_conf *c, void *data)
6273 {
6274         int fulllen = 0;
6275         struct lxc_netdev *netdev = data;
6276         int len;
6277         size_t listlen;
6278         char buf[INET_ADDRSTRLEN];
6279         struct lxc_inetdev *inetdev;
6280
6281         if (!netdev)
6282                 return ret_errno(EINVAL);
6283
6284         if (!retv)
6285                 inlen = 0;
6286         else
6287                 memset(retv, 0, inlen);
6288
6289         listlen = list_len(&netdev->ipv4_addresses);
6290
6291         list_for_each_entry(inetdev, &netdev->ipv4_addresses, head) {
6292                 if (!inet_ntop(AF_INET, &inetdev->addr, buf, sizeof(buf)))
6293                         return -errno;
6294                 strprint(retv, inlen, "%s/%u%s", buf, inetdev->prefix,
6295                          (listlen-- > 1) ? "\n" : "");
6296         }
6297
6298         return fulllen;
6299 }
6300
6301 static int get_config_net_veth_ipv4_route(const char *key, char *retv, int inlen,
6302                                           struct lxc_conf *c, void *data)
6303 {
6304         int len;
6305         size_t listlen;
6306         char buf[INET_ADDRSTRLEN];
6307         struct lxc_inetdev *inetdev;
6308         int fulllen = 0;
6309         struct lxc_netdev *netdev = data;
6310
6311         if (!netdev)
6312                 return ret_errno(EINVAL);
6313
6314         if (netdev->type != LXC_NET_VETH)
6315                 return ret_errno(EINVAL);
6316
6317         if (!retv)
6318                 inlen = 0;
6319         else
6320                 memset(retv, 0, inlen);
6321
6322         listlen = list_len(&netdev->priv.veth_attr.ipv4_routes);
6323         list_for_each_entry(inetdev, &netdev->priv.veth_attr.ipv4_routes, head) {
6324                 if (!inet_ntop(AF_INET, &inetdev->addr, buf, sizeof(buf)))
6325                         return -errno;
6326                 strprint(retv, inlen, "%s/%u%s", buf, inetdev->prefix,
6327                          (listlen-- > 1) ? "\n" : "");
6328         }
6329
6330         return fulllen;
6331 }
6332
6333 static int get_config_net_ipv6_gateway(const char *key, char *retv, int inlen,
6334                                        struct lxc_conf *c, void *data)
6335 {
6336         int len;
6337         char buf[INET6_ADDRSTRLEN];
6338         int fulllen = 0;
6339         struct lxc_netdev *netdev = data;
6340
6341         if (!netdev)
6342                 return ret_errno(EINVAL);
6343
6344         if (!retv)
6345                 inlen = 0;
6346         else
6347                 memset(retv, 0, inlen);
6348
6349         if (netdev->ipv6_gateway_auto) {
6350                 strprint(retv, inlen, "auto");
6351         } else if (netdev->ipv6_gateway_dev) {
6352                 strprint(retv, inlen, "dev");
6353         } else if (netdev->ipv6_gateway) {
6354                 if (!inet_ntop(AF_INET6, netdev->ipv6_gateway, buf, sizeof(buf)))
6355                         return -errno;
6356                 strprint(retv, inlen, "%s", buf);
6357         }
6358
6359         return fulllen;
6360 }
6361
6362 static int get_config_net_ipv6_address(const char *key, char *retv, int inlen,
6363                                        struct lxc_conf *c, void *data)
6364 {
6365         int len;
6366         size_t listlen;
6367         char buf[INET6_ADDRSTRLEN];
6368         int fulllen = 0;
6369         struct lxc_netdev *netdev = data;
6370         struct lxc_inet6dev *inet6dev;
6371
6372         if (!netdev)
6373                 return ret_errno(EINVAL);
6374
6375         if (!retv)
6376                 inlen = 0;
6377         else
6378                 memset(retv, 0, inlen);
6379
6380         listlen = list_len(&netdev->ipv6_addresses);
6381         list_for_each_entry(inet6dev, &netdev->ipv6_addresses, head) {
6382                 if (!inet_ntop(AF_INET6, &inet6dev->addr, buf, sizeof(buf)))
6383                         return -errno;
6384                 strprint(retv, inlen, "%s/%u%s", buf, inet6dev->prefix,
6385                          (listlen-- > 1) ? "\n" : "");
6386         }
6387
6388         return fulllen;
6389 }
6390
6391 static int get_config_net_veth_ipv6_route(const char *key, char *retv, int inlen,
6392                                           struct lxc_conf *c, void *data)
6393 {
6394         int len;
6395         size_t listlen;
6396         char buf[INET6_ADDRSTRLEN];
6397         struct lxc_inet6dev *inet6dev;
6398         int fulllen = 0;
6399         struct lxc_netdev *netdev = data;
6400
6401         if (!netdev)
6402                 return ret_errno(EINVAL);
6403
6404         if (netdev->type != LXC_NET_VETH)
6405                 return ret_errno(EINVAL);
6406
6407         if (!retv)
6408                 inlen = 0;
6409         else
6410                 memset(retv, 0, inlen);
6411
6412         listlen = list_len(&netdev->priv.veth_attr.ipv6_routes);
6413         list_for_each_entry(inet6dev, &netdev->priv.veth_attr.ipv6_routes, head) {
6414                 if (!inet_ntop(AF_INET6, &inet6dev->addr, buf, sizeof(buf)))
6415                         return -errno;
6416                 strprint(retv, inlen, "%s/%u%s", buf, inet6dev->prefix,
6417                          (listlen-- > 1) ? "\n" : "");
6418         }
6419
6420         return fulllen;
6421 }
6422
6423 int lxc_list_config_items(char *retv, int inlen)
6424 {
6425         size_t i;
6426         int len;
6427         int fulllen = 0;
6428
6429         if (!retv)
6430                 inlen = 0;
6431         else
6432                 memset(retv, 0, inlen);
6433
6434         for (i = 0; i < ARRAY_SIZE(config_jump_table); i++) {
6435                 char *s = config_jump_table[i].name;
6436
6437                 if (s[strlen(s) - 1] == '.')
6438                         continue;
6439
6440                 strprint(retv, inlen, "%s\n", s);
6441         }
6442
6443         return fulllen;
6444 }
6445
6446 int lxc_list_subkeys(struct lxc_conf *conf, const char *key, char *retv,
6447                      int inlen)
6448 {
6449         int len;
6450         int fulllen = 0;
6451
6452         if (!retv)
6453                 inlen = 0;
6454         else
6455                 memset(retv, 0, inlen);
6456
6457         if (strequal(key, "lxc.apparmor")) {
6458                 strprint(retv, inlen, "allow_incomplete\n");
6459                 strprint(retv, inlen, "allow_nesting\n");
6460                 strprint(retv, inlen, "profile\n");
6461                 strprint(retv, inlen, "raw\n");
6462         } else if (strequal(key, "lxc.cgroup")) {
6463                 strprint(retv, inlen, "dir\n");
6464         } else if (strequal(key, "lxc.selinux")) {
6465                 strprint(retv, inlen, "context\n");
6466                 strprint(retv, inlen, "context.keyring\n");
6467         } else if (strequal(key, "lxc.mount")) {
6468                 strprint(retv, inlen, "auto\n");
6469                 strprint(retv, inlen, "entry\n");
6470                 strprint(retv, inlen, "fstab\n");
6471         } else if (strequal(key, "lxc.rootfs")) {
6472                 strprint(retv, inlen, "mount\n");
6473                 strprint(retv, inlen, "options\n");
6474                 strprint(retv, inlen, "path\n");
6475         } else if (strequal(key, "lxc.uts")) {
6476                 strprint(retv, inlen, "name\n");
6477         } else if (strequal(key, "lxc.hook")) {
6478                 strprint(retv, inlen, "autodev\n");
6479                 strprint(retv, inlen, "autodevtmpfssize\n");
6480                 strprint(retv, inlen, "clone\n");
6481                 strprint(retv, inlen, "destroy\n");
6482                 strprint(retv, inlen, "mount\n");
6483                 strprint(retv, inlen, "post-stop\n");
6484                 strprint(retv, inlen, "pre-mount\n");
6485                 strprint(retv, inlen, "pre-start\n");
6486                 strprint(retv, inlen, "start-host\n");
6487                 strprint(retv, inlen, "start\n");
6488                 strprint(retv, inlen, "stop\n");
6489         } else if (strequal(key, "lxc.cap")) {
6490                 strprint(retv, inlen, "drop\n");
6491                 strprint(retv, inlen, "keep\n");
6492         } else if (strequal(key, "lxc.console")) {
6493                 strprint(retv, inlen, "logfile\n");
6494                 strprint(retv, inlen, "path\n");
6495         } else if (strequal(key, "lxc.seccomp")) {
6496                 strprint(retv, inlen, "profile\n");
6497         } else if (strequal(key, "lxc.signal")) {
6498                 strprint(retv, inlen, "halt\n");
6499                 strprint(retv, inlen, "reboot\n");
6500                 strprint(retv, inlen, "stop\n");
6501         } else if (strequal(key, "lxc.start")) {
6502                 strprint(retv, inlen, "auto\n");
6503                 strprint(retv, inlen, "delay\n");
6504                 strprint(retv, inlen, "order\n");
6505         } else if (strequal(key, "lxc.monitor")) {
6506                 strprint(retv, inlen, "unshare\n");
6507         } else if (strequal(key, "lxc.keyring")) {
6508                 strprint(retv, inlen, "session\n");
6509         } else {
6510                 fulllen = ret_errno(EINVAL);
6511         }
6512
6513         return fulllen;
6514 }
6515
6516 int lxc_list_net(struct lxc_conf *c, const char *key, char *retv, int inlen)
6517 {
6518         struct config_net_info info = {};
6519         struct lxc_netdev *netdev;
6520         int len, ret;
6521         const char *idxstring;
6522         int fulllen = 0;
6523
6524         idxstring = key + STRLITERALLEN("lxc.net.");
6525         if (!isdigit(*idxstring))
6526                 return ret_errno(EINVAL);
6527
6528         ret = get_network_config_ops(key, c, &info, false);
6529         if (ret) {
6530                 if (ret != -ENOENT)
6531                         return ret_errno(EINVAL);
6532         }
6533         netdev = info.netdev;
6534
6535         if (!retv)
6536                 inlen = 0;
6537         else
6538                 memset(retv, 0, inlen);
6539
6540         strprint(retv, inlen, "type\n");
6541         strprint(retv, inlen, "script.up\n");
6542         strprint(retv, inlen, "script.down\n");
6543
6544         if (netdev->type != LXC_NET_EMPTY) {
6545                 strprint(retv, inlen, "flags\n");
6546                 strprint(retv, inlen, "link\n");
6547                 strprint(retv, inlen, "name\n");
6548                 strprint(retv, inlen, "hwaddr\n");
6549                 strprint(retv, inlen, "mtu\n");
6550                 strprint(retv, inlen, "ipv6.address\n");
6551                 strprint(retv, inlen, "ipv6.gateway\n");
6552                 strprint(retv, inlen, "ipv4.address\n");
6553                 strprint(retv, inlen, "ipv4.gateway\n");
6554         }
6555
6556         switch (netdev->type) {
6557         case LXC_NET_VETH:
6558                 strprint(retv, inlen, "veth.pair\n");
6559                 strprint(retv, inlen, "veth.ipv4.route\n");
6560                 strprint(retv, inlen, "veth.ipv6.route\n");
6561                 strprint(retv, inlen, "veth.vlan.id\n");
6562                 break;
6563         case LXC_NET_MACVLAN:
6564                 strprint(retv, inlen, "macvlan.mode\n");
6565                 break;
6566         case LXC_NET_IPVLAN:
6567                 strprint(retv, inlen, "ipvlan.mode\n");
6568                 strprint(retv, inlen, "ipvlan.isolation\n");
6569                 break;
6570         case LXC_NET_VLAN:
6571                 strprint(retv, inlen, "vlan.id\n");
6572                 break;
6573         case LXC_NET_PHYS:
6574                 break;
6575         }
6576
6577         return fulllen;
6578 }