src/lxc/confile.c

   1 /* SPDX-License-Identifier: LGPL-2.1+ */
   2
   3 #ifndef _GNU_SOURCE
   4 #define _GNU_SOURCE 1
   5 #endif
   6 #define __STDC_FORMAT_MACROS
   7 #include <arpa/inet.h>
   8 #include <ctype.h>
   9 #include <dirent.h>
  10 #include <errno.h>
  11 #include <fcntl.h>
  12 #include <inttypes.h>
  13 #include <net/if.h>
  14 #include <netinet/in.h>
  15 #include <signal.h>
  16 #include <stdio.h>
  17 #include <stdlib.h>
  18 #include <string.h>
  19 #include <sys/param.h>
  20 #include <sys/stat.h>
  21 #include <sys/types.h>
  22 #include <sys/utsname.h>
  23 #include <syslog.h>
  24 #include <time.h>
  25 #include <unistd.h>
  26
  27 #include "af_unix.h"
  28 #include "conf.h"
  29 #include "config.h"
  30 #include "confile.h"
  31 #include "confile_utils.h"
  32 #include "../include/netns_ifaddrs.h"
  33 #include "log.h"
  34 #include "lxcseccomp.h"
  35 #include "macro.h"
  36 #include "memory_utils.h"
  37 #include "network.h"
  38 #include "parse.h"
  39 #include "storage/storage.h"
  40 #include "utils.h"
  41
  42 #ifndef HAVE_STRLCPY
  43 #include "include/strlcpy.h"
  44 #endif
  45
  46 #ifndef HAVE_STRLCAT
  47 #include "include/strlcat.h"
  48 #endif
  49
  50 lxc_log_define(confile, lxc);
  51
  52 #define lxc_config_define(name)                                             \
  53         __hot static int set_config_##name(const char *, const char *,      \
  54                                            struct lxc_conf *, void *);      \
  55         __hot static int get_config_##name(const char *, char *, int,       \
  56                                            struct lxc_conf *, void *);      \
  57         __hot static int clr_config_##name(const char *, struct lxc_conf *, \
  58                                            void *);
  59
  60 lxc_config_define(autodev);
  61 lxc_config_define(autodev_tmpfs_size);
  62 lxc_config_define(apparmor_allow_incomplete);
  63 lxc_config_define(apparmor_allow_nesting);
  64 lxc_config_define(apparmor_profile);
  65 lxc_config_define(apparmor_raw);
  66 lxc_config_define(cap_drop);
  67 lxc_config_define(cap_keep);
  68 lxc_config_define(cgroup_controller);
  69 lxc_config_define(cgroup2_controller);
  70 lxc_config_define(cgroup_dir);
  71 lxc_config_define(cgroup_monitor_dir);
  72 lxc_config_define(cgroup_monitor_pivot_dir);
  73 lxc_config_define(cgroup_container_dir);
  74 lxc_config_define(cgroup_container_inner_dir);
  75 lxc_config_define(cgroup_relative);
  76 lxc_config_define(console_buffer_size);
  77 lxc_config_define(console_logfile);
  78 lxc_config_define(console_path);
  79 lxc_config_define(console_rotate);
  80 lxc_config_define(console_size);
  81 lxc_config_define(unsupported_key);
  82 lxc_config_define(environment);
  83 lxc_config_define(ephemeral);
  84 lxc_config_define(execute_cmd);
  85 lxc_config_define(group);
  86 lxc_config_define(hooks);
  87 lxc_config_define(hooks_version);
  88 lxc_config_define(idmaps);
  89 lxc_config_define(includefiles);
  90 lxc_config_define(init_cmd);
  91 lxc_config_define(init_cwd);
  92 lxc_config_define(init_gid);
  93 lxc_config_define(init_uid);
  94 lxc_config_define(init_groups);
  95 lxc_config_define(jump_table_net);
  96 lxc_config_define(keyring_session);
  97 lxc_config_define(log_file);
  98 lxc_config_define(log_level);
  99 lxc_config_define(log_syslog);
 100 lxc_config_define(monitor);
 101 lxc_config_define(monitor_signal_pdeath);
 102 lxc_config_define(mount);
 103 lxc_config_define(mount_auto);
 104 lxc_config_define(mount_fstab);
 105 lxc_config_define(namespace_clone);
 106 lxc_config_define(namespace_keep);
 107 lxc_config_define(time_offset_boot);
 108 lxc_config_define(time_offset_monotonic);
 109 lxc_config_define(namespace_share);
 110 lxc_config_define(net);
 111 lxc_config_define(net_flags);
 112 lxc_config_define(net_hwaddr);
 113 lxc_config_define(net_ipv4_address);
 114 lxc_config_define(net_ipv4_gateway);
 115 lxc_config_define(net_ipv6_address);
 116 lxc_config_define(net_ipv6_gateway);
 117 lxc_config_define(net_link);
 118 lxc_config_define(net_l2proxy);
 119 lxc_config_define(net_macvlan_mode);
 120 lxc_config_define(net_ipvlan_mode);
 121 lxc_config_define(net_ipvlan_isolation);
 122 lxc_config_define(net_mtu);
 123 lxc_config_define(net_name);
 124 lxc_config_define(net_script_down);
 125 lxc_config_define(net_script_up);
 126 lxc_config_define(net_type);
 127 lxc_config_define(net_veth_mode);
 128 lxc_config_define(net_veth_pair);
 129 lxc_config_define(net_veth_ipv4_route);
 130 lxc_config_define(net_veth_ipv6_route);
 131 lxc_config_define(net_veth_vlan_id);
 132 lxc_config_define(net_veth_vlan_tagged_id);
 133 lxc_config_define(net_vlan_id);
 134 lxc_config_define(no_new_privs);
 135 lxc_config_define(personality);
 136 lxc_config_define(prlimit);
 137 lxc_config_define(pty_max);
 138 lxc_config_define(rootfs_managed);
 139 lxc_config_define(rootfs_mount);
 140 lxc_config_define(rootfs_options);
 141 lxc_config_define(rootfs_path);
 142 lxc_config_define(seccomp_profile);
 143 lxc_config_define(seccomp_allow_nesting);
 144 lxc_config_define(seccomp_notify_cookie);
 145 lxc_config_define(seccomp_notify_proxy);
 146 lxc_config_define(selinux_context);
 147 lxc_config_define(selinux_context_keyring);
 148 lxc_config_define(signal_halt);
 149 lxc_config_define(signal_reboot);
 150 lxc_config_define(signal_stop);
 151 lxc_config_define(start);
 152 lxc_config_define(tty_max);
 153 lxc_config_define(tty_dir);
 154 lxc_config_define(uts_name);
 155 lxc_config_define(sysctl);
 156 lxc_config_define(proc);
 157
 158 static int set_config_unsupported_key(const char *key, const char *value,
 159                                       struct lxc_conf *lxc_conf, void *data)
 160 {
 161         return syserror_set(-EINVAL, "Unsupported config key \"%s\"", key);
 162 }
 163
 164 static int get_config_unsupported_key(const char *key, char *retv, int inlen,
 165                                       struct lxc_conf *c, void *data)
 166 {
 167         return syserror_set(-EINVAL, "Unsupported config key \"%s\"", key);
 168 }
 169
 170 static int clr_config_unsupported_key(const char *key,
 171                                       struct lxc_conf *lxc_conf, void *data)
 172 {
 173         return syserror_set(-EINVAL, "Unsupported config key \"%s\"", key);
 174 }
 175
 176 /*
 177  * Important Note:
 178  * If a new config option is added to this table, be aware that
 179  * the order in which the options are places into the table matters.
 180  * That means that more specific options of a namespace have to be
 181  * placed above more generic ones.
 182  *
 183  * For instance: If lxc.ab is placed before lxc.ab.c, the config option
 184  * lxc.ab.c will always be matched to lxc.ab. That is, the lxc.ab.c option
 185  * has to be placed above lxc.ab.
 186  */
 187 static struct lxc_config_t config_jump_table[] = {
 188         { "lxc.arch",                       true,  set_config_personality,                get_config_personality,                clr_config_personality,                },
 189         { "lxc.apparmor.profile",           true,  set_config_apparmor_profile,           get_config_apparmor_profile,           clr_config_apparmor_profile,           },
 190         { "lxc.apparmor.allow_incomplete",  true,  set_config_apparmor_allow_incomplete,  get_config_apparmor_allow_incomplete,  clr_config_apparmor_allow_incomplete,  },
 191         { "lxc.apparmor.allow_nesting",     true,  set_config_apparmor_allow_nesting,     get_config_apparmor_allow_nesting,     clr_config_apparmor_allow_nesting,     },
 192         { "lxc.apparmor.raw",               true,  set_config_apparmor_raw,               get_config_apparmor_raw,               clr_config_apparmor_raw,               },
 193         { "lxc.autodev.tmpfs.size",         true,  set_config_autodev_tmpfs_size,         get_config_autodev_tmpfs_size,         clr_config_autodev_tmpfs_size,         },
 194         { "lxc.autodev",                    true,  set_config_autodev,                    get_config_autodev,                    clr_config_autodev,                    },
 195         { "lxc.cap.drop",                   true,  set_config_cap_drop,                   get_config_cap_drop,                   clr_config_cap_drop,                   },
 196         { "lxc.cap.keep",                   true,  set_config_cap_keep,                   get_config_cap_keep,                   clr_config_cap_keep,                   },
 197         { "lxc.cgroup2",                    false, set_config_cgroup2_controller,         get_config_cgroup2_controller,         clr_config_cgroup2_controller,         },
 198         { "lxc.cgroup.dir.monitor.pivot",   true,  set_config_cgroup_monitor_pivot_dir,   get_config_cgroup_monitor_pivot_dir,   clr_config_cgroup_monitor_pivot_dir,   },
 199         { "lxc.cgroup.dir.monitor",         true,  set_config_cgroup_monitor_dir,         get_config_cgroup_monitor_dir,         clr_config_cgroup_monitor_dir,         },
 200         { "lxc.cgroup.dir.container.inner", true,  set_config_cgroup_container_inner_dir, get_config_cgroup_container_inner_dir, clr_config_cgroup_container_inner_dir, },
 201         { "lxc.cgroup.dir.container",       true,  set_config_cgroup_container_dir,       get_config_cgroup_container_dir,       clr_config_cgroup_container_dir,       },
 202         { "lxc.cgroup.dir",                 true,  set_config_cgroup_dir,                 get_config_cgroup_dir,                 clr_config_cgroup_dir,                 },
 203         { "lxc.cgroup.relative",            true,  set_config_cgroup_relative,            get_config_cgroup_relative,            clr_config_cgroup_relative,            },
 204         { "lxc.cgroup",                     false, set_config_cgroup_controller,          get_config_cgroup_controller,          clr_config_cgroup_controller,          },
 205         { "lxc.console.buffer.size",        true,  set_config_console_buffer_size,        get_config_console_buffer_size,        clr_config_console_buffer_size,        },
 206         { "lxc.console.logfile",            true,  set_config_console_logfile,            get_config_console_logfile,            clr_config_console_logfile,            },
 207         { "lxc.console.path",               true,  set_config_console_path,               get_config_console_path,               clr_config_console_path,               },
 208         { "lxc.console.rotate",             true,  set_config_console_rotate,             get_config_console_rotate,             clr_config_console_rotate,             },
 209         { "lxc.console.size",               true,  set_config_console_size,               get_config_console_size,               clr_config_console_size,               },
 210         { "lxc.environment",                true,  set_config_environment,                get_config_environment,                clr_config_environment,                },
 211         { "lxc.ephemeral",                  true,  set_config_ephemeral,                  get_config_ephemeral,                  clr_config_ephemeral,                  },
 212         { "lxc.execute.cmd",                true,  set_config_execute_cmd,                get_config_execute_cmd,                clr_config_execute_cmd,                },
 213         { "lxc.group",                      true,  set_config_group,                      get_config_group,                      clr_config_group,                      },
 214         { "lxc.hook.autodev",               true,  set_config_hooks,                      get_config_hooks,                      clr_config_hooks,                      },
 215         { "lxc.hook.clone",                 true,  set_config_hooks,                      get_config_hooks,                      clr_config_hooks,                      },
 216         { "lxc.hook.destroy",               true,  set_config_hooks,                      get_config_hooks,                      clr_config_hooks,                      },
 217         { "lxc.hook.mount",                 true,  set_config_hooks,                      get_config_hooks,                      clr_config_hooks,                      },
 218         { "lxc.hook.post-stop",             true,  set_config_hooks,                      get_config_hooks,                      clr_config_hooks,                      },
 219         { "lxc.hook.pre-mount",             true,  set_config_hooks,                      get_config_hooks,                      clr_config_hooks,                      },
 220         { "lxc.hook.pre-start",             true,  set_config_hooks,                      get_config_hooks,                      clr_config_hooks,                      },
 221         { "lxc.hook.start",                 true,  set_config_hooks,                      get_config_hooks,                      clr_config_hooks,                      },
 222         { "lxc.hook.start-host",            true,  set_config_hooks,                      get_config_hooks,                      clr_config_hooks,                      },
 223         { "lxc.hook.stop",                  true,  set_config_hooks,                      get_config_hooks,                      clr_config_hooks,                      },
 224         { "lxc.hook.version",               true,  set_config_hooks_version,              get_config_hooks_version,              clr_config_hooks_version,              },
 225         { "lxc.hook",                       true,  set_config_hooks,                      get_config_hooks,                      clr_config_hooks,                      },
 226         { "lxc.idmap",                      true,  set_config_idmaps,                     get_config_idmaps,                     clr_config_idmaps,                     },
 227         { "lxc.include",                    true,  set_config_includefiles,               get_config_includefiles,               clr_config_includefiles,               },
 228         { "lxc.init.cmd",                   true,  set_config_init_cmd,                   get_config_init_cmd,                   clr_config_init_cmd,                   },
 229         { "lxc.init.gid",                   true,  set_config_init_gid,                   get_config_init_gid,                   clr_config_init_gid,                   },
 230         { "lxc.init.groups",                true,  set_config_init_groups,                get_config_init_groups,                clr_config_init_groups,                },
 231         { "lxc.init.uid",                   true,  set_config_init_uid,                   get_config_init_uid,                   clr_config_init_uid,                   },
 232         { "lxc.init.cwd",                   true,  set_config_init_cwd,                   get_config_init_cwd,                   clr_config_init_cwd,                   },
 233         { "lxc.keyring.session",            true,  set_config_keyring_session,            get_config_keyring_session,            clr_config_keyring_session             },
 234         { "lxc.log.file",                   true,  set_config_log_file,                   get_config_log_file,                   clr_config_log_file,                   },
 235         { "lxc.log.level",                  true,  set_config_log_level,                  get_config_log_level,                  clr_config_log_level,                  },
 236         { "lxc.log.syslog",                 true,  set_config_log_syslog,                 get_config_log_syslog,                 clr_config_log_syslog,                 },
 237         { "lxc.monitor.unshare",            true,  set_config_monitor,                    get_config_monitor,                    clr_config_monitor,                    },
 238         { "lxc.monitor.signal.pdeath",      true,  set_config_monitor_signal_pdeath,      get_config_monitor_signal_pdeath,      clr_config_monitor_signal_pdeath,      },
 239         { "lxc.mount.auto",                 true,  set_config_mount_auto,                 get_config_mount_auto,                 clr_config_mount_auto,                 },
 240         { "lxc.mount.entry",                true,  set_config_mount,                      get_config_mount,                      clr_config_mount,                      },
 241         { "lxc.mount.fstab",                true,  set_config_mount_fstab,                get_config_mount_fstab,                clr_config_mount_fstab,                },
 242         { "lxc.namespace.clone",            true,  set_config_namespace_clone,            get_config_namespace_clone,            clr_config_namespace_clone,            },
 243         { "lxc.namespace.keep",             true,  set_config_namespace_keep,             get_config_namespace_keep,             clr_config_namespace_keep,             },
 244         { "lxc.namespace.share.",           false, set_config_namespace_share,            get_config_namespace_share,            clr_config_namespace_share,            },
 245         { "lxc.time.offset.boot",           true,  set_config_time_offset_boot,           get_config_time_offset_boot,           clr_config_time_offset_boot,           },
 246         { "lxc.time.offset.monotonic",      true,  set_config_time_offset_monotonic,      get_config_time_offset_monotonic,      clr_config_time_offset_monotonic,      },
 247         { "lxc.net.",                       false, set_config_jump_table_net,             get_config_jump_table_net,             clr_config_jump_table_net,             },
 248         { "lxc.net",                        true,  set_config_net,                        get_config_net,                        clr_config_net,                        },
 249         { "lxc.no_new_privs",               true,  set_config_no_new_privs,               get_config_no_new_privs,               clr_config_no_new_privs,               },
 250         { "lxc.prlimit",                    false, set_config_prlimit,                    get_config_prlimit,                    clr_config_prlimit,                    },
 251         { "lxc.pty.max",                    true,  set_config_pty_max,                    get_config_pty_max,                    clr_config_pty_max,                    },
 252         { "lxc.rootfs.managed",             true,  set_config_rootfs_managed,             get_config_rootfs_managed,             clr_config_rootfs_managed,             },
 253         { "lxc.rootfs.mount",               true,  set_config_rootfs_mount,               get_config_rootfs_mount,               clr_config_rootfs_mount,               },
 254         { "lxc.rootfs.options",             true,  set_config_rootfs_options,             get_config_rootfs_options,             clr_config_rootfs_options,             },
 255         { "lxc.rootfs.path",                true,  set_config_rootfs_path,                get_config_rootfs_path,                clr_config_rootfs_path,                },
 256         { "lxc.seccomp.allow_nesting",      true,  set_config_seccomp_allow_nesting,      get_config_seccomp_allow_nesting,      clr_config_seccomp_allow_nesting,      },
 257         { "lxc.seccomp.notify.cookie",      true,  set_config_seccomp_notify_cookie,      get_config_seccomp_notify_cookie,      clr_config_seccomp_notify_cookie,      },
 258         { "lxc.seccomp.notify.proxy",       true,  set_config_seccomp_notify_proxy,       get_config_seccomp_notify_proxy,       clr_config_seccomp_notify_proxy,       },
 259         { "lxc.seccomp.profile",            true,  set_config_seccomp_profile,            get_config_seccomp_profile,            clr_config_seccomp_profile,            },
 260         { "lxc.selinux.context.keyring",    true,  set_config_selinux_context_keyring,    get_config_selinux_context_keyring,    clr_config_selinux_context_keyring     },
 261         { "lxc.selinux.context",            true,  set_config_selinux_context,            get_config_selinux_context,            clr_config_selinux_context,            },
 262         { "lxc.signal.halt",                true,  set_config_signal_halt,                get_config_signal_halt,                clr_config_signal_halt,                },
 263         { "lxc.signal.reboot",              true,  set_config_signal_reboot,              get_config_signal_reboot,              clr_config_signal_reboot,              },
 264         { "lxc.signal.stop",                true,  set_config_signal_stop,                get_config_signal_stop,                clr_config_signal_stop,                },
 265         { "lxc.start.auto",                 true,  set_config_start,                      get_config_start,                      clr_config_start,                      },
 266         { "lxc.start.delay",                true,  set_config_start,                      get_config_start,                      clr_config_start,                      },
 267         { "lxc.start.order",                true,  set_config_start,                      get_config_start,                      clr_config_start,                      },
 268         { "lxc.tty.dir",                    true,  set_config_tty_dir,                    get_config_tty_dir,                    clr_config_tty_dir,                    },
 269         { "lxc.tty.max",                    true,  set_config_tty_max,                    get_config_tty_max,                    clr_config_tty_max,                    },
 270         { "lxc.uts.name",                   true,  set_config_uts_name,                   get_config_uts_name,                   clr_config_uts_name,                   },
 271         { "lxc.sysctl",                     false, set_config_sysctl,                     get_config_sysctl,                     clr_config_sysctl,                     },
 272         { "lxc.proc",                       false, set_config_proc,                       get_config_proc,                       clr_config_proc,                       },
 273 };
 274
 275 static struct lxc_config_t unsupported_config_key = {
 276         NULL,
 277         false,
 278         set_config_unsupported_key,
 279         get_config_unsupported_key,
 280         clr_config_unsupported_key,
 281 };
 282
 283 struct lxc_config_net_t {
 284         LXC_CONFIG_MEMBERS;
 285 };
 286
 287 static struct lxc_config_net_t config_jump_table_net[] = {
 288         /* If a longer key is added please update. */
 289         #define NETWORK_SUBKEY_SIZE_MAX (STRLITERALLEN("veth.vlan.tagged.id") * 2)
 290         { "flags",                  true,  set_config_net_flags,                  get_config_net_flags,                  clr_config_net_flags,                  },
 291         { "hwaddr",                 true,  set_config_net_hwaddr,                 get_config_net_hwaddr,                 clr_config_net_hwaddr,                 },
 292         { "ipv4.address",           true,  set_config_net_ipv4_address,           get_config_net_ipv4_address,           clr_config_net_ipv4_address,           },
 293         { "ipv4.gateway",           true,  set_config_net_ipv4_gateway,           get_config_net_ipv4_gateway,           clr_config_net_ipv4_gateway,           },
 294         { "ipv6.address",           true,  set_config_net_ipv6_address,           get_config_net_ipv6_address,           clr_config_net_ipv6_address,           },
 295         { "ipv6.gateway",           true,  set_config_net_ipv6_gateway,           get_config_net_ipv6_gateway,           clr_config_net_ipv6_gateway,           },
 296         { "link",                   true,  set_config_net_link,                   get_config_net_link,                   clr_config_net_link,                   },
 297         { "l2proxy",                true,  set_config_net_l2proxy,                get_config_net_l2proxy,                clr_config_net_l2proxy,                },
 298         { "macvlan.mode",           true,  set_config_net_macvlan_mode,           get_config_net_macvlan_mode,           clr_config_net_macvlan_mode,           },
 299         { "ipvlan.mode",            true,  set_config_net_ipvlan_mode,            get_config_net_ipvlan_mode,            clr_config_net_ipvlan_mode,            },
 300         { "ipvlan.isolation",       true,  set_config_net_ipvlan_isolation,       get_config_net_ipvlan_isolation,       clr_config_net_ipvlan_isolation,       },
 301         { "mtu",                    true,  set_config_net_mtu,                    get_config_net_mtu,                    clr_config_net_mtu,                    },
 302         { "name",                   true,  set_config_net_name,                   get_config_net_name,                   clr_config_net_name,                   },
 303         { "script.down",            true,  set_config_net_script_down,            get_config_net_script_down,            clr_config_net_script_down,            },
 304         { "script.up",              true,  set_config_net_script_up,              get_config_net_script_up,              clr_config_net_script_up,              },
 305         { "type",                   true,  set_config_net_type,                   get_config_net_type,                   clr_config_net_type,                   },
 306         { "vlan.id",                true,  set_config_net_vlan_id,                get_config_net_vlan_id,                clr_config_net_vlan_id,                },
 307         { "veth.mode",              true,  set_config_net_veth_mode,              get_config_net_veth_mode,              clr_config_net_veth_mode,              },
 308         { "veth.pair",              true,  set_config_net_veth_pair,              get_config_net_veth_pair,              clr_config_net_veth_pair,              },
 309         { "veth.ipv4.route",        true,  set_config_net_veth_ipv4_route,        get_config_net_veth_ipv4_route,        clr_config_net_veth_ipv4_route,        },
 310         { "veth.ipv6.route",        true,  set_config_net_veth_ipv6_route,        get_config_net_veth_ipv6_route,        clr_config_net_veth_ipv6_route,        },
 311         { "veth.vlan.id",           true,  set_config_net_veth_vlan_id,           get_config_net_veth_vlan_id,           clr_config_net_veth_vlan_id,           },
 312         { "veth.vlan.tagged.id",    true,  set_config_net_veth_vlan_tagged_id,    get_config_net_veth_vlan_tagged_id,    clr_config_net_veth_vlan_tagged_id,    },
 313 };
 314
 315 static struct lxc_config_net_t unsupported_config_net_key = {
 316         NULL,
 317         false,
 318         set_config_unsupported_key,
 319         get_config_unsupported_key,
 320         clr_config_unsupported_key,
 321 };
 322
 323 struct lxc_config_t *lxc_get_config_exact(const char *key)
 324 {
 325         size_t i;
 326
 327         for (i = 0; i < ARRAY_SIZE(config_jump_table); i++)
 328                 if (strequal(config_jump_table[i].name, key))
 329                         return &config_jump_table[i];
 330
 331         return NULL;
 332 }
 333
 334 /* Assume a reasonable subkey size limit. */
 335 #define LXC_SUBKEY_LEN_MAX 256
 336
 337 static inline int match_config_item(const struct lxc_config_t *entry, const char *key)
 338 {
 339         size_t len;
 340
 341         if (entry->strict)
 342                 return strequal(entry->name, key);
 343
 344         /* There should be no subkey longer than this. */
 345         len = strnlen(entry->name, LXC_SUBKEY_LEN_MAX);
 346         if (len == LXC_SUBKEY_LEN_MAX)
 347                 return error_ret(-E2BIG, "Excessive subkey length");
 348
 349         return strnequal(entry->name, key, len);
 350 }
 351
 352 struct lxc_config_t *lxc_get_config(const char *key)
 353 {
 354         for (size_t i = 0; i < ARRAY_SIZE(config_jump_table); i++) {
 355                 struct lxc_config_t *cur = &config_jump_table[i];
 356
 357                 switch (match_config_item(cur, key)) {
 358                 case 0:
 359                         continue;
 360                 case -E2BIG:
 361                         return &unsupported_config_key;
 362                 }
 363
 364                 return cur;
 365         }
 366
 367         return &unsupported_config_key;
 368 }
 369
 370 static inline bool match_config_net_item(const struct lxc_config_net_t *entry,
 371                                          const char *key)
 372 {
 373         if (entry->strict)
 374                 return strequal(entry->name, key);
 375         return strnequal(entry->name, key, strlen(entry->name));
 376 }
 377
 378 static struct lxc_config_net_t *lxc_get_config_net(const char *key)
 379 {
 380         for (size_t i = 0; i < ARRAY_SIZE(config_jump_table_net); i++) {
 381                 struct lxc_config_net_t *cur = &config_jump_table_net[i];
 382
 383                 if (!match_config_net_item(cur, key))
 384                         continue;
 385
 386                 return cur;
 387         }
 388
 389         return &unsupported_config_net_key;
 390 }
 391
 392 static int set_config_net(const char *key, const char *value,
 393                           struct lxc_conf *lxc_conf, void *data)
 394 {
 395         if (!lxc_config_value_empty(value))
 396                 return syserror_set(-EINVAL, "lxc.net must not have a value");
 397
 398         return clr_config_net(key, lxc_conf, data);
 399 }
 400
 401 static int set_config_net_type(const char *key, const char *value,
 402                                struct lxc_conf *lxc_conf, void *data)
 403 {
 404         struct lxc_netdev *netdev = data;
 405
 406         if (!netdev)
 407                 return ret_errno(EINVAL);
 408
 409         clr_config_net_type(key, lxc_conf, data);
 410         if (lxc_config_value_empty(value))
 411                 return 0;
 412
 413         if (strequal(value, "veth")) {
 414                 netdev->type = LXC_NET_VETH;
 415                 INIT_LIST_HEAD(&netdev->priv.veth_attr.ipv4_routes);
 416                 INIT_LIST_HEAD(&netdev->priv.veth_attr.ipv6_routes);
 417                 lxc_list_init(&netdev->priv.veth_attr.vlan_tagged_ids);
 418                 if (!lxc_veth_flag_to_mode(netdev->priv.veth_attr.mode))
 419                         lxc_veth_mode_to_flag(&netdev->priv.veth_attr.mode, "bridge");
 420         } else if (strequal(value, "macvlan")) {
 421                 netdev->type = LXC_NET_MACVLAN;
 422                 if (!lxc_macvlan_flag_to_mode(netdev->priv.veth_attr.mode))
 423                         lxc_macvlan_mode_to_flag(&netdev->priv.macvlan_attr.mode, "private");
 424         } else if (strequal(value, "ipvlan")) {
 425                 netdev->type = LXC_NET_IPVLAN;
 426                 if (!lxc_ipvlan_flag_to_mode(netdev->priv.ipvlan_attr.mode))
 427                         lxc_ipvlan_mode_to_flag(&netdev->priv.ipvlan_attr.mode, "l3");
 428                 if (!lxc_ipvlan_flag_to_isolation(netdev->priv.ipvlan_attr.isolation))
 429                         lxc_ipvlan_isolation_to_flag(&netdev->priv.ipvlan_attr.isolation, "bridge");
 430         } else if (strequal(value, "vlan")) {
 431                 netdev->type = LXC_NET_VLAN;
 432         } else if (strequal(value, "phys")) {
 433                 netdev->type = LXC_NET_PHYS;
 434         } else if (strequal(value, "empty")) {
 435                 netdev->type = LXC_NET_EMPTY;
 436                 /* We don't support custom loopback device names. */
 437                 (void)strlcpy(netdev->name, "lo", IFNAMSIZ);
 438         } else if (strequal(value, "none")) {
 439                 netdev->type = LXC_NET_NONE;
 440         } else {
 441                 return log_error(-1, "Invalid network type %s", value);
 442         }
 443
 444         return 0;
 445 }
 446
 447 static int set_config_net_flags(const char *key, const char *value,
 448                                 struct lxc_conf *lxc_conf, void *data)
 449 {
 450         struct lxc_netdev *netdev = data;
 451
 452         if (!netdev)
 453                 return ret_errno(EINVAL);
 454
 455         if (lxc_config_value_empty(value))
 456                 return clr_config_net_flags(key, lxc_conf, data);
 457
 458         netdev->flags |= IFF_UP;
 459
 460         return 0;
 461 }
 462
 463 static int create_matched_ifnames(const char *value, struct lxc_conf *lxc_conf,
 464                                   struct lxc_netdev *netdev)
 465 {
 466         call_cleaner(netns_freeifaddrs) struct netns_ifaddrs *ifaddr = NULL;
 467         struct netns_ifaddrs *ifa;
 468         int n;
 469         int ret = 0;
 470         const char *type_key = "lxc.net.type";
 471         const char *link_key = "lxc.net.link";
 472         const char *tmpvalue = "phys";
 473
 474         if (netns_getifaddrs(&ifaddr, -1, &(bool){false}) < 0)
 475                 return log_error_errno(-1, errno, "Failed to get network interfaces");
 476
 477         for (ifa = ifaddr, n = 0; ifa != NULL; ifa = ifa->ifa_next, n++) {
 478                 if (!ifa->ifa_addr)
 479                         continue;
 480
 481                 if (ifa->ifa_addr->sa_family != AF_PACKET)
 482                         continue;
 483
 484                 if (strnequal(value, ifa->ifa_name, strlen(value) - 1)) {
 485                         ret = set_config_net_type(type_key, tmpvalue, lxc_conf,
 486                                                   netdev);
 487                         if (!ret) {
 488                                 ret = set_config_net_link(
 489                                     link_key, ifa->ifa_name, lxc_conf, netdev);
 490                                 if (ret) {
 491                                         ERROR("Failed to create matched ifnames");
 492                                         break;
 493                                 }
 494                         } else {
 495                                 ERROR("Failed to create matched ifnames");
 496                                 break;
 497                         }
 498                 }
 499         }
 500
 501         return ret;
 502 }
 503
 504 static int set_config_net_link(const char *key, const char *value,
 505                                struct lxc_conf *lxc_conf, void *data)
 506 {
 507         struct lxc_netdev *netdev = data;
 508         int ret = 0;
 509
 510         if (!netdev)
 511                 return ret_errno(EINVAL);
 512
 513         if (lxc_config_value_empty(value))
 514                 return clr_config_net_link(key, lxc_conf, data);
 515
 516         if (value[strlen(value) - 1] == '+' && netdev->type == LXC_NET_PHYS)
 517                 ret = create_matched_ifnames(value, lxc_conf, netdev);
 518         else
 519                 ret = network_ifname(netdev->link, value, sizeof(netdev->link));
 520
 521         return ret;
 522 }
 523
 524 static int set_config_net_l2proxy(const char *key, const char *value,
 525                                      struct lxc_conf *lxc_conf, void *data)
 526 {
 527         struct lxc_netdev *netdev = data;
 528         unsigned int val = 0;
 529         int ret;
 530
 531         if (!netdev)
 532                 return ret_errno(EINVAL);
 533
 534         if (lxc_config_value_empty(value))
 535                 return clr_config_net_l2proxy(key, lxc_conf, data);
 536
 537         ret = lxc_safe_uint(value, &val);
 538         if (ret < 0)
 539                 return ret_errno(ret);
 540
 541         switch (val) {
 542         case 0:
 543                 netdev->l2proxy = false;
 544                 return 0;
 545         case 1:
 546                 netdev->l2proxy = true;
 547                 return 0;
 548         }
 549
 550         return ret_errno(EINVAL);
 551 }
 552
 553 static int set_config_net_name(const char *key, const char *value,
 554                                struct lxc_conf *lxc_conf, void *data)
 555 {
 556         struct lxc_netdev *netdev = data;
 557
 558         if (!netdev)
 559                 return ret_errno(EINVAL);
 560
 561         if (lxc_config_value_empty(value))
 562                 return clr_config_net_name(key, lxc_conf, data);
 563
 564         return network_ifname(netdev->name, value, sizeof(netdev->name));
 565 }
 566
 567
 568 static int set_config_net_veth_mode(const char *key, const char *value,
 569                                        struct lxc_conf *lxc_conf, void *data)
 570 {
 571         struct lxc_netdev *netdev = data;
 572
 573         if (!netdev)
 574                 return ret_errno(EINVAL);
 575
 576         if (netdev->type != LXC_NET_VETH)
 577                 return ret_errno(EINVAL);
 578
 579         if (lxc_config_value_empty(value))
 580                 return clr_config_net_veth_mode(key, lxc_conf, data);
 581
 582         if (!netdev)
 583                 return ret_errno(EINVAL);
 584
 585         return lxc_veth_mode_to_flag(&netdev->priv.veth_attr.mode, value);
 586 }
 587
 588 static int set_config_net_veth_pair(const char *key, const char *value,
 589                                     struct lxc_conf *lxc_conf, void *data)
 590 {
 591         struct lxc_netdev *netdev = data;
 592
 593         if (!netdev)
 594                 return ret_errno(EINVAL);
 595
 596         if (netdev->type != LXC_NET_VETH)
 597                 return ret_errno(EINVAL);
 598
 599         if (lxc_config_value_empty(value))
 600                 return clr_config_net_veth_pair(key, lxc_conf, data);
 601
 602         return network_ifname(netdev->priv.veth_attr.pair, value,
 603                               sizeof(netdev->priv.veth_attr.pair));
 604 }
 605
 606 static int set_config_net_veth_vlan_id(const char *key, const char *value,
 607                                        struct lxc_conf *lxc_conf, void *data)
 608 {
 609         int ret;
 610         struct lxc_netdev *netdev = data;
 611
 612         if (!netdev)
 613                 return ret_errno(EINVAL);
 614
 615         if (netdev->type != LXC_NET_VETH)
 616                 return ret_errno(EINVAL);
 617
 618         if (lxc_config_value_empty(value))
 619                 return clr_config_net_veth_vlan_id(key, lxc_conf, data);
 620
 621         if (strequal(value, "none")) {
 622                 netdev->priv.veth_attr.vlan_id = BRIDGE_VLAN_NONE;
 623         } else {
 624                 unsigned short vlan_id;
 625
 626                 ret = get_u16(&vlan_id, value, 0);
 627                 if (ret < 0)
 628                         return ret_errno(EINVAL);
 629
 630                 if (vlan_id > BRIDGE_VLAN_ID_MAX)
 631                         return ret_errno(EINVAL);
 632
 633                 netdev->priv.veth_attr.vlan_id = vlan_id;
 634         }
 635
 636         netdev->priv.veth_attr.vlan_id_set = true;
 637         return 0;
 638 }
 639
 640 static int set_config_net_veth_vlan_tagged_id(const char *key, const char *value,
 641                                               struct lxc_conf *lxc_conf,
 642                                               void *data)
 643 {
 644         __do_free struct lxc_list *list = NULL;
 645         int ret;
 646         unsigned short vlan_id;
 647         struct lxc_netdev *netdev = data;
 648
 649         if (!netdev)
 650                 return ret_errno(EINVAL);
 651
 652         if (netdev->type != LXC_NET_VETH)
 653                 return ret_errno(EINVAL);
 654
 655         if (lxc_config_value_empty(value))
 656                 return clr_config_net_veth_vlan_tagged_id(key, lxc_conf, data);
 657
 658         ret = get_u16(&vlan_id, value, 0);
 659         if (ret < 0)
 660                 return ret_errno(EINVAL);
 661
 662         if (vlan_id > BRIDGE_VLAN_ID_MAX)
 663                 return ret_errno(EINVAL);
 664
 665         list = lxc_list_new();
 666         if (!list)
 667                 return ret_errno(ENOMEM);
 668
 669         list->elem = UINT_TO_PTR(vlan_id);
 670
 671         lxc_list_add_tail(&netdev->priv.veth_attr.vlan_tagged_ids, move_ptr(list));
 672
 673         return 0;
 674 }
 675
 676 static int set_config_net_macvlan_mode(const char *key, const char *value,
 677                                        struct lxc_conf *lxc_conf, void *data)
 678 {
 679         struct lxc_netdev *netdev = data;
 680
 681         if (!netdev)
 682                 return ret_errno(EINVAL);
 683
 684         if (netdev->type != LXC_NET_MACVLAN)
 685                 return ret_errno(EINVAL);
 686
 687         if (lxc_config_value_empty(value))
 688                 return clr_config_net_macvlan_mode(key, lxc_conf, data);
 689
 690         return lxc_macvlan_mode_to_flag(&netdev->priv.macvlan_attr.mode, value);
 691 }
 692
 693 static int set_config_net_ipvlan_mode(const char *key, const char *value,
 694                                       struct lxc_conf *lxc_conf, void *data)
 695 {
 696         struct lxc_netdev *netdev = data;
 697
 698         if (!netdev)
 699                 return ret_errno(EINVAL);
 700
 701         if (netdev->type != LXC_NET_IPVLAN)
 702                 return syserror_set(-EINVAL, "Invalid ipvlan mode \"%s\", can only be used with ipvlan network", value);
 703
 704         if (lxc_config_value_empty(value))
 705                 return clr_config_net_ipvlan_mode(key, lxc_conf, data);
 706
 707         return lxc_ipvlan_mode_to_flag(&netdev->priv.ipvlan_attr.mode, value);
 708 }
 709
 710 static int set_config_net_ipvlan_isolation(const char *key, const char *value,
 711                                            struct lxc_conf *lxc_conf, void *data)
 712 {
 713         struct lxc_netdev *netdev = data;
 714
 715         if (!netdev)
 716                 return ret_errno(EINVAL);
 717
 718         if (netdev->type != LXC_NET_IPVLAN)
 719                 return syserror_set(-EINVAL, "Invalid ipvlan isolation \"%s\", can only be used with ipvlan network", value);
 720
 721         if (lxc_config_value_empty(value))
 722                 return clr_config_net_ipvlan_isolation(key, lxc_conf, data);
 723
 724         return lxc_ipvlan_isolation_to_flag(&netdev->priv.ipvlan_attr.isolation, value);
 725 }
 726
 727 static int set_config_net_hwaddr(const char *key, const char *value,
 728                                  struct lxc_conf *lxc_conf, void *data)
 729 {
 730         __do_free char *new_value = NULL;
 731         struct lxc_netdev *netdev = data;
 732
 733         if (!netdev)
 734                 return ret_errno(EINVAL);
 735
 736         clr_config_net_hwaddr(key, lxc_conf, data);
 737         if (lxc_config_value_empty(value))
 738                 return 0;
 739
 740         new_value = strdup(value);
 741         if (!new_value)
 742                 return ret_errno(ENOMEM);
 743
 744         rand_complete_hwaddr(new_value);
 745         if (!lxc_config_value_empty(new_value))
 746                 netdev->hwaddr = move_ptr(new_value);
 747
 748         return 0;
 749 }
 750
 751 static int set_config_net_vlan_id(const char *key, const char *value,
 752                                   struct lxc_conf *lxc_conf, void *data)
 753 {
 754         int ret;
 755         struct lxc_netdev *netdev = data;
 756
 757         if (!netdev)
 758                 return ret_errno(EINVAL);
 759
 760         if (netdev->type != LXC_NET_VLAN)
 761                 return ret_errno(EINVAL);
 762
 763         if (lxc_config_value_empty(value))
 764                 return clr_config_net_vlan_id(key, lxc_conf, data);
 765
 766         ret = get_u16(&netdev->priv.vlan_attr.vid, value, 0);
 767         if (ret < 0)
 768                 return ret;
 769
 770         return 0;
 771 }
 772
 773 static int set_config_net_mtu(const char *key, const char *value,
 774                               struct lxc_conf *lxc_conf, void *data)
 775 {
 776         struct lxc_netdev *netdev = data;
 777
 778         if (!netdev)
 779                 return ret_errno(EINVAL);
 780
 781         clr_config_net_mtu(key, lxc_conf, data);
 782         if (lxc_config_value_empty(value))
 783                 return 0;
 784
 785         return set_config_string_item(&netdev->mtu, value);
 786 }
 787
 788 static int set_config_net_ipv4_address(const char *key, const char *value,
 789                                        struct lxc_conf *lxc_conf, void *data)
 790 {
 791         __do_free char *addr = NULL;
 792         __do_free struct lxc_inetdev *inetdev = NULL;
 793         int ret;
 794         struct lxc_netdev *netdev = data;
 795         char *cursor, *slash;
 796         char *bcast = NULL, *prefix = NULL;
 797
 798         if (!netdev)
 799                 return ret_errno(EINVAL);
 800
 801         if (lxc_config_value_empty(value))
 802                 return clr_config_net_ipv4_address(key, lxc_conf, data);
 803
 804         inetdev = zalloc(sizeof(*inetdev));
 805         if (!inetdev)
 806                 return ret_errno(ENOMEM);
 807
 808         addr = strdup(value);
 809         if (!addr)
 810                 return ret_errno(ENOMEM);
 811
 812         cursor = strstr(addr, " ");
 813         if (cursor) {
 814                 *cursor = '\0';
 815                 bcast = cursor + 1;
 816         }
 817
 818         slash = strstr(addr, "/");
 819         if (slash) {
 820                 *slash = '\0';
 821                 prefix = slash + 1;
 822         }
 823
 824         ret = inet_pton(AF_INET, addr, &inetdev->addr);
 825         if (!ret || ret < 0)
 826                 return log_error_errno(-1, errno, "Invalid ipv4 address \"%s\"", value);
 827
 828         if (bcast) {
 829                 ret = inet_pton(AF_INET, bcast, &inetdev->bcast);
 830                 if (!ret || ret < 0)
 831                         return log_error_errno(-1, errno, "Invalid ipv4 broadcast address \"%s\"", value);
 832
 833         }
 834
 835         /* No prefix specified, determine it from the network class. */
 836         ret = 0;
 837         if (prefix)
 838                 ret = lxc_safe_uint(prefix, &inetdev->prefix);
 839         else
 840                 inetdev->prefix = config_ip_prefix(&inetdev->addr);
 841         if (ret || inetdev->prefix > 32)
 842                 return ret_errno(EINVAL);
 843
 844         /* If no broadcast address, compute one from the prefix and address. */
 845         if (!bcast) {
 846                 unsigned int shift = LAST_BIT_PER_TYPE(inetdev->prefix);
 847
 848                 inetdev->bcast.s_addr = inetdev->addr.s_addr;
 849                 if (inetdev->prefix < shift)
 850                         shift = inetdev->prefix;
 851                 inetdev->bcast.s_addr |= htonl(INADDR_BROADCAST >> shift);
 852         }
 853
 854         list_add_tail(&inetdev->head, &netdev->ipv4_addresses);
 855         move_ptr(inetdev);
 856
 857         return 0;
 858 }
 859
 860 static int set_config_net_ipv4_gateway(const char *key, const char *value,
 861                                        struct lxc_conf *lxc_conf, void *data)
 862 {
 863         struct lxc_netdev *netdev = data;
 864
 865         if (!netdev)
 866                 return ret_errno(EINVAL);
 867
 868         clr_config_net_ipv4_gateway(key, lxc_conf, data);
 869         if (lxc_config_value_empty(value))
 870                 return 0;
 871
 872         if (strequal(value, "auto")) {
 873                 netdev->ipv4_gateway = NULL;
 874                 netdev->ipv4_gateway_auto = true;
 875         } else if (strequal(value, "dev")) {
 876                 netdev->ipv4_gateway = NULL;
 877                 netdev->ipv4_gateway_auto = false;
 878                 netdev->ipv4_gateway_dev = true;
 879         } else {
 880                 __do_free struct in_addr *gw = NULL;
 881                 int ret;
 882
 883                 gw = zalloc(sizeof(*gw));
 884                 if (!gw)
 885                         return ret_errno(ENOMEM);
 886
 887                 ret = inet_pton(AF_INET, value, gw);
 888                 if (!ret || ret < 0)
 889                         return log_error_errno(-1, errno, "Invalid ipv4 gateway address \"%s\"", value);
 890
 891                 netdev->ipv4_gateway = move_ptr(gw);
 892                 netdev->ipv4_gateway_auto = false;
 893         }
 894
 895         return 0;
 896 }
 897
 898 static int set_config_net_veth_ipv4_route(const char *key, const char *value,
 899                                           struct lxc_conf *lxc_conf, void *data)
 900 {
 901         __do_free char *valdup = NULL;
 902         __do_free struct lxc_inetdev *inetdev = NULL;
 903         int ret;
 904         char *netmask, *slash;
 905         struct lxc_netdev *netdev = data;
 906
 907         if (!netdev)
 908                 return ret_errno(EINVAL);
 909
 910         if (netdev->type != LXC_NET_VETH)
 911                 return syserror_set(-EINVAL, "Invalid ipv4 route \"%s\", can only be used with veth network", value);
 912
 913         if (lxc_config_value_empty(value))
 914                 return clr_config_net_veth_ipv4_route(key, lxc_conf, data);
 915
 916         inetdev = zalloc(sizeof(*inetdev));
 917         if (!inetdev)
 918                 return ret_errno(ENOMEM);
 919
 920         valdup = strdup(value);
 921         if (!valdup)
 922                 return ret_errno(ENOMEM);
 923
 924         slash = strchr(valdup, '/');
 925         if (!slash)
 926                 return ret_errno(EINVAL);
 927
 928         *slash = '\0';
 929         slash++;
 930         if (*slash == '\0')
 931                 return ret_errno(EINVAL);
 932
 933         netmask = slash;
 934
 935         ret = lxc_safe_uint(netmask, &inetdev->prefix);
 936         if (ret < 0 || inetdev->prefix > 32)
 937                 return ret_errno(EINVAL);
 938
 939         ret = inet_pton(AF_INET, valdup, &inetdev->addr);
 940         if (!ret || ret < 0)
 941                 return ret_errno(EINVAL);
 942
 943         list_add_tail(&inetdev->head, &netdev->priv.veth_attr.ipv4_routes);
 944         move_ptr(inetdev);
 945
 946         return 0;
 947 }
 948
 949 static int set_config_net_ipv6_address(const char *key, const char *value,
 950                                        struct lxc_conf *lxc_conf, void *data)
 951 {
 952         __do_free char *valdup = NULL;
 953         __do_free struct lxc_inet6dev *inet6dev = NULL;
 954         int ret;
 955         struct lxc_netdev *netdev = data;
 956         char *slash, *netmask;
 957
 958         if (!netdev)
 959                 return ret_errno(EINVAL);
 960
 961         if (lxc_config_value_empty(value))
 962                 return clr_config_net_ipv6_address(key, lxc_conf, data);
 963
 964         inet6dev = zalloc(sizeof(*inet6dev));
 965         if (!inet6dev)
 966                 return ret_errno(ENOMEM);
 967
 968         valdup = strdup(value);
 969         if (!valdup)
 970                 return ret_errno(ENOMEM);
 971
 972         inet6dev->prefix = 64;
 973         slash = strstr(valdup, "/");
 974         if (slash) {
 975                 *slash = '\0';
 976                 netmask = slash + 1;
 977
 978                 ret = lxc_safe_uint(netmask, &inet6dev->prefix);
 979                 if (ret < 0)
 980                         return ret;
 981         }
 982
 983         ret = inet_pton(AF_INET6, valdup, &inet6dev->addr);
 984         if (!ret || ret < 0)
 985                 return log_error_errno(-EINVAL, EINVAL, "Invalid ipv6 address \"%s\"", valdup);
 986
 987         list_add_tail(&inet6dev->head, &netdev->ipv6_addresses);
 988         move_ptr(inet6dev);
 989
 990         return 0;
 991 }
 992
 993 static int set_config_net_ipv6_gateway(const char *key, const char *value,
 994                                        struct lxc_conf *lxc_conf, void *data)
 995 {
 996         struct lxc_netdev *netdev = data;
 997
 998         if (!netdev)
 999                 return ret_errno(EINVAL);
1000
1001         clr_config_net_ipv6_gateway(key, lxc_conf, data);
1002         if (lxc_config_value_empty(value))
1003                 return 0;
1004
1005         if (strequal(value, "auto")) {
1006                 netdev->ipv6_gateway = NULL;
1007                 netdev->ipv6_gateway_auto = true;
1008         } else if (strequal(value, "dev")) {
1009                 netdev->ipv6_gateway = NULL;
1010                 netdev->ipv6_gateway_auto = false;
1011                 netdev->ipv6_gateway_dev = true;
1012         } else {
1013                 int ret;
1014                 __do_free struct in6_addr *gw = NULL;
1015
1016                 gw = zalloc(sizeof(*gw));
1017                 if (!gw)
1018                         return ret_errno(ENOMEM);
1019
1020                 ret = inet_pton(AF_INET6, value, gw);
1021                 if (!ret || ret < 0)
1022                         return log_error_errno(-EINVAL, EINVAL,
1023                                                "Invalid ipv6 gateway address \"%s\"", value);
1024
1025                 netdev->ipv6_gateway = move_ptr(gw);
1026                 netdev->ipv6_gateway_auto = false;
1027         }
1028
1029         return 0;
1030 }
1031
1032 static int set_config_net_veth_ipv6_route(const char *key, const char *value,
1033                                           struct lxc_conf *lxc_conf, void *data)
1034 {
1035         __do_free char *valdup = NULL;
1036         __do_free struct lxc_inet6dev *inet6dev = NULL;
1037         int ret;
1038         char *netmask, *slash;
1039         struct lxc_netdev *netdev = data;
1040
1041         if (!netdev)
1042                 return ret_errno(EINVAL);
1043
1044         if (netdev->type != LXC_NET_VETH)
1045                 return syserror_set(-EINVAL, "Invalid ipv6 route \"%s\", can only be used with veth network", value);
1046
1047         if (lxc_config_value_empty(value))
1048                 return clr_config_net_veth_ipv6_route(key, lxc_conf, data);
1049
1050         inet6dev = zalloc(sizeof(*inet6dev));
1051         if (!inet6dev)
1052                 return ret_errno(ENOMEM);
1053
1054         valdup = strdup(value);
1055         if (!valdup)
1056                 return ret_errno(ENOMEM);
1057
1058         slash = strchr(valdup, '/');
1059         if (!slash)
1060                 return ret_errno(EINVAL);
1061
1062         *slash = '\0';
1063         slash++;
1064         if (*slash == '\0')
1065                 return ret_errno(EINVAL);
1066
1067         netmask = slash;
1068
1069         ret = lxc_safe_uint(netmask, &inet6dev->prefix);
1070         if (ret < 0 || inet6dev->prefix > 128)
1071                 return ret_errno(EINVAL);
1072
1073         ret = inet_pton(AF_INET6, valdup, &inet6dev->addr);
1074         if (!ret || ret < 0)
1075                 return ret_errno(EINVAL);
1076
1077         list_add_tail(&inet6dev->head, &netdev->priv.veth_attr.ipv6_routes);
1078         move_ptr(inet6dev);
1079
1080         return 0;
1081 }
1082
1083 static int set_config_net_script_up(const char *key, const char *value,
1084                                     struct lxc_conf *lxc_conf, void *data)
1085 {
1086         struct lxc_netdev *netdev = data;
1087
1088         if (!netdev)
1089                 return ret_errno(EINVAL);
1090
1091         clr_config_net_script_up(key, lxc_conf, data);
1092         if (lxc_config_value_empty(value))
1093                 return 0;
1094
1095         return set_config_string_item(&netdev->upscript, value);
1096 }
1097
1098 static int set_config_net_script_down(const char *key, const char *value,
1099                                       struct lxc_conf *lxc_conf, void *data)
1100 {
1101         struct lxc_netdev *netdev = data;
1102
1103         if (!netdev)
1104                 return ret_errno(EINVAL);
1105
1106         clr_config_net_script_down(key, lxc_conf, data);
1107         if (lxc_config_value_empty(value))
1108                 return 0;
1109
1110         return set_config_string_item(&netdev->downscript, value);
1111 }
1112
1113 static int add_hook(struct lxc_conf *lxc_conf, int which, __owns char *hook)
1114 {
1115         __do_free char *val = hook;
1116         struct lxc_list *hooklist;
1117
1118         hooklist = lxc_list_new();
1119         if (!hooklist)
1120                 return ret_errno(ENOMEM);
1121
1122         hooklist->elem = move_ptr(val);
1123         lxc_list_add_tail(&lxc_conf->hooks[which], hooklist);
1124
1125         return 0;
1126 }
1127
1128 static int set_config_seccomp_allow_nesting(const char *key, const char *value,
1129                                             struct lxc_conf *lxc_conf, void *data)
1130 {
1131 #ifdef HAVE_SECCOMP
1132         if (lxc_config_value_empty(value))
1133                 return clr_config_seccomp_allow_nesting(key, lxc_conf, NULL);
1134
1135         if (lxc_safe_uint(value, &lxc_conf->seccomp.allow_nesting) < 0)
1136                 return -errno;
1137
1138         if (lxc_conf->seccomp.allow_nesting > 1)
1139                 return ret_errno(EINVAL);
1140
1141         return 0;
1142 #else
1143         return ret_errno(ENOSYS);
1144 #endif
1145 }
1146
1147 static int set_config_seccomp_notify_cookie(const char *key, const char *value,
1148                                             struct lxc_conf *lxc_conf, void *data)
1149 {
1150 #ifdef HAVE_SECCOMP_NOTIFY
1151         return set_config_string_item(&lxc_conf->seccomp.notifier.cookie, value);
1152 #else
1153         return ret_errno(ENOSYS);
1154 #endif
1155 }
1156
1157 static int set_config_seccomp_notify_proxy(const char *key, const char *value,
1158                                            struct lxc_conf *lxc_conf, void *data)
1159 {
1160 #ifdef HAVE_SECCOMP_NOTIFY
1161         const char *offset;
1162
1163         if (lxc_config_value_empty(value))
1164                 return clr_config_seccomp_notify_proxy(key, lxc_conf, NULL);
1165
1166         if (!strnequal(value, "unix:", 5))
1167                 return ret_errno(EINVAL);
1168
1169         offset = value + 5;
1170         if (lxc_unix_sockaddr(&lxc_conf->seccomp.notifier.proxy_addr, offset) < 0)
1171                 return -errno;
1172
1173         return 0;
1174 #else
1175         return ret_errno(ENOSYS);
1176 #endif
1177 }
1178
1179 static int set_config_seccomp_profile(const char *key, const char *value,
1180                                       struct lxc_conf *lxc_conf, void *data)
1181 {
1182 #ifdef HAVE_SECCOMP
1183         return set_config_path_item(&lxc_conf->seccomp.seccomp, value);
1184 #else
1185         return ret_errno(ENOSYS);
1186 #endif
1187 }
1188
1189 static int set_config_execute_cmd(const char *key, const char *value,
1190                                struct lxc_conf *lxc_conf, void *data)
1191 {
1192         return set_config_path_item(&lxc_conf->execute_cmd, value);
1193 }
1194
1195 static int set_config_init_cmd(const char *key, const char *value,
1196                                struct lxc_conf *lxc_conf, void *data)
1197 {
1198         return set_config_path_item(&lxc_conf->init_cmd, value);
1199 }
1200
1201 static int set_config_init_cwd(const char *key, const char *value,
1202                                struct lxc_conf *lxc_conf, void *data)
1203 {
1204         return set_config_path_item(&lxc_conf->init_cwd, value);
1205 }
1206
1207 static int set_config_init_uid(const char *key, const char *value,
1208                                struct lxc_conf *lxc_conf, void *data)
1209 {
1210         unsigned int init_uid;
1211
1212         if (lxc_config_value_empty(value)) {
1213                 lxc_conf->init_uid = 0;
1214                 return 0;
1215         }
1216
1217         if (lxc_safe_uint(value, &init_uid) < 0)
1218                 return -errno;
1219
1220         lxc_conf->init_uid = init_uid;
1221
1222         return 0;
1223 }
1224
1225 static int set_config_init_gid(const char *key, const char *value,
1226                                struct lxc_conf *lxc_conf, void *data)
1227 {
1228         unsigned int init_gid;
1229
1230         if (lxc_config_value_empty(value)) {
1231                 lxc_conf->init_gid = 0;
1232                 return 0;
1233         }
1234
1235         if (lxc_safe_uint(value, &init_gid) < 0)
1236                 return -errno;
1237
1238         lxc_conf->init_gid = init_gid;
1239
1240         return 0;
1241 }
1242
1243 static int set_config_init_groups(const char *key, const char *value,
1244                                   struct lxc_conf *lxc_conf, void *data)
1245 {
1246         __do_free char *value_dup = NULL;
1247         gid_t *init_groups = NULL;
1248         size_t num_groups = 0;
1249         size_t idx;
1250         char *token;
1251
1252         if (lxc_config_value_empty(value))
1253                 return clr_config_init_groups(key, lxc_conf, NULL);
1254
1255         value_dup = strdup(value);
1256         if (!value_dup)
1257                 return -ENOMEM;
1258
1259         lxc_iterate_parts(token, value_dup, ",")
1260                 num_groups++;
1261
1262         if (num_groups == INT_MAX)
1263                 return log_error_errno(-ERANGE, ERANGE, "Excessive number of supplementary groups specified");
1264
1265         /* This means the string wasn't empty and all we found was garbage. */
1266         if (num_groups == 0)
1267                 return log_error_errno(-EINVAL, EINVAL, "No valid groups specified %s", value);
1268
1269         idx = lxc_conf->init_groups.size;
1270         init_groups = realloc(lxc_conf->init_groups.list, sizeof(gid_t) * (idx + num_groups));
1271         if (!init_groups)
1272                 return ret_errno(ENOMEM);
1273
1274         /*
1275          * Once the realloc() succeeded we need to hand control of the memory
1276          * back to the config otherwise we risk a double-free when
1277          * lxc_conf_free() is called.
1278          */
1279         lxc_conf->init_groups.list = init_groups;
1280
1281         /* Restore duplicated value so we can call lxc_iterate_parts() again. */
1282         strcpy(value_dup, value);
1283
1284         lxc_iterate_parts(token, value_dup, ",") {
1285                 int ret;
1286
1287                 gid_t group;
1288
1289                 ret = lxc_safe_uint(token, &group);
1290                 if (ret)
1291                         return log_error_errno(ret, -ret, "Failed to parse group %s", token);
1292
1293                 init_groups[idx++] = group;
1294         }
1295
1296         lxc_conf->init_groups.size += num_groups;
1297
1298         return 0;
1299 }
1300
1301 static int set_config_hooks(const char *key, const char *value,
1302                             struct lxc_conf *lxc_conf, void *data)
1303 {
1304         __do_free char *copy = NULL;
1305
1306         if (lxc_config_value_empty(value))
1307                 return lxc_clear_hooks(lxc_conf, key);
1308
1309         if (strequal(key + 4, "hook"))
1310                 return log_error_errno(-EINVAL, EINVAL, "lxc.hook must not have a value");
1311
1312         copy = strdup(value);
1313         if (!copy)
1314                 return ret_errno(ENOMEM);
1315
1316         if (strequal(key + 9, "pre-start"))
1317                 return add_hook(lxc_conf, LXCHOOK_PRESTART, move_ptr(copy));
1318         else if (strequal(key + 9, "start-host"))
1319                 return add_hook(lxc_conf, LXCHOOK_START_HOST, move_ptr(copy));
1320         else if (strequal(key + 9, "pre-mount"))
1321                 return add_hook(lxc_conf, LXCHOOK_PREMOUNT, move_ptr(copy));
1322         else if (strequal(key + 9, "autodev"))
1323                 return add_hook(lxc_conf, LXCHOOK_AUTODEV, move_ptr(copy));
1324         else if (strequal(key + 9, "mount"))
1325                 return add_hook(lxc_conf, LXCHOOK_MOUNT, move_ptr(copy));
1326         else if (strequal(key + 9, "start"))
1327                 return add_hook(lxc_conf, LXCHOOK_START, move_ptr(copy));
1328         else if (strequal(key + 9, "stop"))
1329                 return add_hook(lxc_conf, LXCHOOK_STOP, move_ptr(copy));
1330         else if (strequal(key + 9, "post-stop"))
1331                 return add_hook(lxc_conf, LXCHOOK_POSTSTOP, move_ptr(copy));
1332         else if (strequal(key + 9, "clone"))
1333                 return add_hook(lxc_conf, LXCHOOK_CLONE, move_ptr(copy));
1334         else if (strequal(key + 9, "destroy"))
1335                 return add_hook(lxc_conf, LXCHOOK_DESTROY, move_ptr(copy));
1336
1337         return ret_errno(EINVAL);
1338 }
1339
1340 static int set_config_hooks_version(const char *key, const char *value,
1341                                     struct lxc_conf *lxc_conf, void *data)
1342 {
1343         int ret;
1344         unsigned int tmp;
1345
1346         if (lxc_config_value_empty(value))
1347                 return clr_config_hooks_version(key, lxc_conf, NULL);
1348
1349         ret = lxc_safe_uint(value, &tmp);
1350         if (ret < 0)
1351                 return -errno;
1352
1353         if (tmp > 1)
1354                 return syserror_set(-EINVAL, "Invalid hook version specified. Currently only 0 (legacy) and 1 are supported");
1355
1356         lxc_conf->hooks_version = tmp;
1357
1358         return 0;
1359 }
1360
1361 static int set_config_personality(const char *key, const char *value,
1362                                   struct lxc_conf *lxc_conf, void *data)
1363 {
1364         int ret;
1365         personality_t personality;
1366
1367         ret = lxc_config_parse_arch(value, &personality);
1368         if (ret < 0)
1369                 return syserror("Unsupported personality \"%s\"", value);
1370
1371         lxc_conf->personality = personality;
1372         return 0;
1373 }
1374
1375 static int set_config_pty_max(const char *key, const char *value,
1376                               struct lxc_conf *lxc_conf, void *data)
1377 {
1378         int ret;
1379         unsigned int max = 0;
1380
1381         if (lxc_config_value_empty(value)) {
1382                 lxc_conf->pty_max = 0;
1383                 return 0;
1384         }
1385
1386         ret = lxc_safe_uint(value, &max);
1387         if (ret < 0)
1388                 return ret_errno(EINVAL);
1389
1390         lxc_conf->pty_max = max;
1391
1392         return 0;
1393 }
1394
1395 /* We only need to check whether the first byte of the key after the lxc.start.
1396  * prefix matches our expectations since they fortunately all start with a
1397  * different letter. If anything was wrong with the key we would have already
1398  * noticed when the callback was called.
1399  */
1400 static int set_config_start(const char *key, const char *value,
1401                             struct lxc_conf *lxc_conf, void *data)
1402 {
1403         int ret;
1404         bool is_empty;
1405
1406         is_empty = lxc_config_value_empty(value);
1407
1408         if (*(key + 10) == 'a') { /* lxc.start.auto */
1409                 if (is_empty) {
1410                         lxc_conf->start_auto = 0;
1411                         return 0;
1412                 }
1413
1414                 ret = lxc_safe_uint(value, &lxc_conf->start_auto);
1415                 if (ret)
1416                         return ret;
1417
1418                 if (lxc_conf->start_auto > 1)
1419                         return ret_errno(EINVAL);
1420
1421                 return 0;
1422         } else if (*(key + 10) == 'd') { /* lxc.start.delay */
1423                 if (is_empty) {
1424                         lxc_conf->start_delay = 0;
1425                         return 0;
1426                 }
1427
1428                 return lxc_safe_uint(value, &lxc_conf->start_delay);
1429         } else if (*(key + 10) == 'o') { /* lxc.start.order */
1430                 if (is_empty) {
1431                         lxc_conf->start_order = 0;
1432                         return 0;
1433                 }
1434
1435                 return lxc_safe_int(value, &lxc_conf->start_order);
1436         }
1437
1438         return ret_errno(EINVAL);
1439 }
1440
1441 static int set_config_monitor(const char *key, const char *value,
1442                               struct lxc_conf *lxc_conf, void *data)
1443 {
1444         if (lxc_config_value_empty(value)) {
1445                 lxc_conf->monitor_unshare = 0;
1446                 return 0;
1447         }
1448
1449         if (strequal(key + 12, "unshare"))
1450                 return lxc_safe_uint(value, &lxc_conf->monitor_unshare);
1451
1452         return ret_errno(EINVAL);
1453 }
1454
1455 static int set_config_monitor_signal_pdeath(const char *key, const char *value,
1456                                             struct lxc_conf *lxc_conf, void *data)
1457 {
1458         if (lxc_config_value_empty(value)) {
1459                 lxc_conf->monitor_signal_pdeath = 0;
1460                 return 0;
1461         }
1462
1463         if (strequal(key + 12, "signal.pdeath")) {
1464                 int sig_n;
1465
1466                 sig_n = sig_parse(value);
1467                 if (sig_n < 0)
1468                         return ret_errno(EINVAL);
1469
1470                 lxc_conf->monitor_signal_pdeath = sig_n;
1471                 return 0;
1472         }
1473
1474         return ret_errno(EINVAL);
1475 }
1476
1477 static int set_config_group(const char *key, const char *value,
1478                             struct lxc_conf *lxc_conf, void *data)
1479 {
1480         __do_free char *groups = NULL;
1481         char *token;
1482
1483         if (lxc_config_value_empty(value))
1484                 return lxc_clear_groups(lxc_conf);
1485
1486         groups = strdup(value);
1487         if (!groups)
1488                 return ret_errno(ENOMEM);
1489
1490         /* In case several groups are specified in a single line split these
1491          * groups in a single element for the list.
1492          */
1493         lxc_iterate_parts(token, groups, " \t") {
1494                 __do_free struct lxc_list *grouplist = NULL;
1495
1496                 grouplist = lxc_list_new();
1497                 if (!grouplist)
1498                         return ret_errno(ENOMEM);
1499
1500                 grouplist->elem = strdup(token);
1501                 if (!grouplist->elem)
1502                         return ret_errno(ENOMEM);
1503
1504                 lxc_list_add_tail(&lxc_conf->groups, move_ptr(grouplist));
1505         }
1506
1507         return 0;
1508 }
1509
1510 static int set_config_environment(const char *key, const char *value,
1511                                   struct lxc_conf *lxc_conf, void *data)
1512 {
1513         __do_free char *dup = NULL, *val = NULL;
1514         __do_free struct environment_entry *new_env = NULL;
1515         char *env_val;
1516
1517         if (lxc_config_value_empty(value))
1518                 return lxc_clear_environment(lxc_conf);
1519
1520         new_env = zalloc(sizeof(struct environment_entry));
1521         if (!new_env)
1522                 return ret_errno(ENOMEM);
1523
1524         dup = strdup(value);
1525         if (!dup)
1526                 return ret_errno(ENOMEM);
1527
1528         env_val = strchr(dup, '=');
1529         if (!env_val) {
1530                 env_val = getenv(dup);
1531         } else {
1532                 *env_val = '\0';
1533                 env_val++;
1534         }
1535         if (!env_val)
1536                 return ret_errno(ENOENT);
1537
1538         val = strdup(env_val);
1539         if (!val)
1540                 return ret_errno(ENOMEM);
1541
1542         new_env->key = move_ptr(dup);
1543         new_env->val = move_ptr(val);
1544
1545         list_add_tail(&new_env->head, &lxc_conf->environment);
1546         move_ptr(new_env);
1547
1548         return 0;
1549 }
1550
1551 static int set_config_tty_max(const char *key, const char *value,
1552                               struct lxc_conf *lxc_conf, void *data)
1553 {
1554         int ret;
1555         unsigned int nbtty = 0;
1556
1557         if (lxc_config_value_empty(value)) {
1558                 lxc_conf->ttys.max = 0;
1559                 return 0;
1560         }
1561
1562         ret = lxc_safe_uint(value, &nbtty);
1563         if (ret < 0)
1564                 return ret;
1565
1566         lxc_conf->ttys.max = nbtty;
1567
1568         return 0;
1569 }
1570
1571 static int set_config_tty_dir(const char *key, const char *value,
1572                              struct lxc_conf *lxc_conf, void *data)
1573 {
1574         return set_config_string_item_max(&lxc_conf->ttys.dir, value,
1575                                           NAME_MAX + 1);
1576 }
1577
1578 static int set_config_apparmor_profile(const char *key, const char *value,
1579                                        struct lxc_conf *lxc_conf, void *data)
1580 {
1581 #if HAVE_APPARMOR
1582         return set_config_string_item(&lxc_conf->lsm_aa_profile, value);
1583 #else
1584         return syserror_set(-EINVAL, "Built without AppArmor support");
1585 #endif
1586 }
1587
1588 static int set_config_apparmor_allow_incomplete(const char *key,
1589                                                 const char *value,
1590                                                 struct lxc_conf *lxc_conf,
1591                                                 void *data)
1592 {
1593 #if HAVE_APPARMOR
1594         int ret;
1595
1596         if (lxc_config_value_empty(value)) {
1597                 lxc_conf->lsm_aa_allow_incomplete = 0;
1598                 return 0;
1599         }
1600
1601         ret = lxc_safe_uint(value, &lxc_conf->lsm_aa_allow_incomplete);
1602         if (ret)
1603                 return ret;
1604
1605         if (lxc_conf->lsm_aa_allow_incomplete > 1)
1606                 return ret_errno(EINVAL);
1607
1608         return 0;
1609 #else
1610         return syserror_set(-EINVAL, "Built without AppArmor support");
1611 #endif
1612 }
1613
1614 static int set_config_apparmor_allow_nesting(const char *key,
1615                                              const char *value,
1616                                              struct lxc_conf *lxc_conf,
1617                                              void *data)
1618 {
1619 #if HAVE_APPARMOR
1620         int ret;
1621
1622         if (lxc_config_value_empty(value))
1623                 return clr_config_apparmor_allow_nesting(key, lxc_conf, NULL);
1624
1625         ret = lxc_safe_uint(value, &lxc_conf->lsm_aa_allow_nesting);
1626         if (ret)
1627                 return ret;
1628
1629         if (lxc_conf->lsm_aa_allow_nesting > 1)
1630                 return ret_errno(EINVAL);
1631
1632         return 0;
1633 #else
1634         return syserror_set(-EINVAL, "Built without AppArmor support");
1635 #endif
1636 }
1637
1638 static int set_config_apparmor_raw(const char *key,
1639                                    const char *value,
1640                                    struct lxc_conf *lxc_conf,
1641                                    void *data)
1642 {
1643 #if HAVE_APPARMOR
1644         __do_free char *elem = NULL;
1645         __do_free struct lxc_list *list = NULL;
1646
1647         if (lxc_config_value_empty(value))
1648                 return lxc_clear_apparmor_raw(lxc_conf);
1649
1650         list = lxc_list_new();
1651         if (!list)
1652                 return ret_errno(ENOMEM);
1653
1654         elem = strdup(value);
1655         if (!elem)
1656                 return ret_errno(ENOMEM);
1657
1658         list->elem = move_ptr(elem);
1659         lxc_list_add_tail(&lxc_conf->lsm_aa_raw, move_ptr(list));
1660
1661         return 0;
1662 #else
1663         return syserror_set(-EINVAL, "Built without AppArmor support");
1664 #endif
1665 }
1666
1667 static int set_config_selinux_context(const char *key, const char *value,
1668                                       struct lxc_conf *lxc_conf, void *data)
1669 {
1670 #if HAVE_SELINUX
1671         return set_config_string_item(&lxc_conf->lsm_se_context, value);
1672 #else
1673         return syserror_set(-EINVAL, "Built without SELinux support");
1674 #endif
1675 }
1676
1677 static int set_config_selinux_context_keyring(const char *key, const char *value,
1678                                               struct lxc_conf *lxc_conf, void *data)
1679 {
1680 #if HAVE_SELINUX
1681         return set_config_string_item(&lxc_conf->lsm_se_keyring_context, value);
1682 #else
1683         return syserror_set(-EINVAL, "Built without SELinux support");
1684 #endif
1685 }
1686
1687 static int set_config_keyring_session(const char *key, const char *value,
1688                                       struct lxc_conf *lxc_conf, void *data)
1689 {
1690         return set_config_bool_item(&lxc_conf->keyring_disable_session, value, false);
1691 }
1692
1693 static int set_config_log_file(const char *key, const char *value,
1694                               struct lxc_conf *c, void *data)
1695 {
1696         int ret;
1697
1698         if (lxc_config_value_empty(value)) {
1699                 free_disarm(c->logfile);
1700                 return 0;
1701         }
1702
1703         /*
1704          * Store these values in the lxc_conf, and then try to set for actual
1705          * current logging.
1706          */
1707         ret = set_config_path_item(&c->logfile, value);
1708         if (ret == 0)
1709                 ret = lxc_log_set_file(&c->logfd, c->logfile);
1710
1711         return ret;
1712 }
1713
1714 static int set_config_log_level(const char *key, const char *value,
1715                                struct lxc_conf *lxc_conf, void *data)
1716 {
1717         int newlevel;
1718
1719         if (lxc_config_value_empty(value)) {
1720                 lxc_conf->loglevel = LXC_LOG_LEVEL_NOTSET;
1721                 return 0;
1722         }
1723
1724         if (value[0] >= '0' && value[0] <= '9') {
1725                 int ret;
1726
1727                 ret = lxc_safe_int(value, &newlevel);
1728                 if (ret)
1729                         return ret_errno(EINVAL);
1730         } else {
1731                 newlevel = lxc_log_priority_to_int(value);
1732         }
1733
1734         /*
1735          * Store these values in the lxc_conf, and then try to set for actual
1736          * current logging.
1737          */
1738         lxc_conf->loglevel = newlevel;
1739
1740         return lxc_log_set_level(&lxc_conf->loglevel, newlevel);
1741 }
1742
1743 static int set_config_autodev(const char *key, const char *value,
1744                               struct lxc_conf *lxc_conf, void *data)
1745 {
1746         int ret;
1747
1748         if (lxc_config_value_empty(value)) {
1749                 lxc_conf->autodev = 0;
1750                 return 0;
1751         }
1752
1753         ret = lxc_safe_uint(value, &lxc_conf->autodev);
1754         if (ret)
1755                 return ret_errno(EINVAL);
1756
1757         if (lxc_conf->autodev > 1)
1758                 return ret_errno(EINVAL);
1759
1760         return 0;
1761 }
1762
1763 static int set_config_autodev_tmpfs_size(const char *key, const char *value,
1764                               struct lxc_conf *lxc_conf, void *data)
1765 {
1766         if (lxc_config_value_empty(value)) {
1767                 lxc_conf->autodevtmpfssize = 500000;
1768                 return 0;
1769         }
1770
1771         if (lxc_safe_int(value, &lxc_conf->autodevtmpfssize) < 0)
1772                 lxc_conf->autodevtmpfssize = 500000;
1773
1774         return 0;
1775 }
1776
1777 static int set_config_signal_halt(const char *key, const char *value,
1778                                  struct lxc_conf *lxc_conf, void *data)
1779 {
1780         int sig_n;
1781
1782         if (lxc_config_value_empty(value)) {
1783                 lxc_conf->haltsignal = 0;
1784                 return 0;
1785         }
1786
1787         sig_n = sig_parse(value);
1788         if (sig_n < 0)
1789                 return ret_errno(EINVAL);
1790
1791         lxc_conf->haltsignal = sig_n;
1792
1793         return 0;
1794 }
1795
1796 static int set_config_signal_reboot(const char *key, const char *value,
1797                                    struct lxc_conf *lxc_conf, void *data)
1798 {
1799         int sig_n;
1800
1801         if (lxc_config_value_empty(value)) {
1802                 lxc_conf->rebootsignal = 0;
1803                 return 0;
1804         }
1805
1806         sig_n = sig_parse(value);
1807         if (sig_n < 0)
1808                 return ret_errno(EINVAL);
1809
1810         lxc_conf->rebootsignal = sig_n;
1811
1812         return 0;
1813 }
1814
1815 static int set_config_signal_stop(const char *key, const char *value,
1816                                  struct lxc_conf *lxc_conf, void *data)
1817 {
1818         int sig_n;
1819
1820         if (lxc_config_value_empty(value)) {
1821                 lxc_conf->stopsignal = 0;
1822                 return 0;
1823         }
1824
1825         sig_n = sig_parse(value);
1826         if (sig_n < 0)
1827                 return ret_errno(EINVAL);
1828
1829         lxc_conf->stopsignal = sig_n;
1830
1831         return 0;
1832 }
1833
1834 static int __set_config_cgroup_controller(const char *key, const char *value,
1835                                           struct lxc_conf *lxc_conf, int version)
1836 {
1837         call_cleaner(free_lxc_cgroup) struct lxc_cgroup *new_cgroup = NULL;
1838         const char *subkey, *token;
1839         size_t token_len;
1840
1841         if (lxc_config_value_empty(value))
1842                 return lxc_clear_cgroups(lxc_conf, key, version);
1843
1844         if (version == CGROUP2_SUPER_MAGIC) {
1845                 token = "lxc.cgroup2.";
1846                 token_len = 12;
1847         } else if (version == CGROUP_SUPER_MAGIC) {
1848                 token = "lxc.cgroup.";
1849                 token_len = 11;
1850         } else {
1851                 return ret_errno(EINVAL);
1852         }
1853
1854         if (!strnequal(key, token, token_len))
1855                 return ret_errno(EINVAL);
1856
1857         subkey = key + token_len;
1858         if (*subkey == '\0')
1859                 return ret_errno(EINVAL);
1860
1861         new_cgroup = zalloc(sizeof(*new_cgroup));
1862         if (!new_cgroup)
1863                 return ret_errno(ENOMEM);
1864
1865         new_cgroup->subsystem = strdup(subkey);
1866         if (!new_cgroup->subsystem)
1867                 return ret_errno(ENOMEM);
1868
1869         new_cgroup->value = strdup(value);
1870         if (!new_cgroup->value)
1871                 return ret_errno(ENOMEM);
1872
1873         new_cgroup->version = version;
1874
1875         if (version == CGROUP2_SUPER_MAGIC)
1876                 list_add_tail(&new_cgroup->head, &lxc_conf->cgroup2);
1877         else
1878                 list_add_tail(&new_cgroup->head, &lxc_conf->cgroup);
1879         move_ptr(new_cgroup);
1880
1881         return 0;
1882 }
1883
1884 static int set_config_cgroup_controller(const char *key, const char *value,
1885                                         struct lxc_conf *lxc_conf, void *data)
1886 {
1887         return __set_config_cgroup_controller(key, value, lxc_conf,
1888                                               CGROUP_SUPER_MAGIC);
1889 }
1890
1891 static int set_config_cgroup2_controller(const char *key, const char *value,
1892                                          struct lxc_conf *lxc_conf, void *data)
1893 {
1894         return __set_config_cgroup_controller(key, value, lxc_conf,
1895                                               CGROUP2_SUPER_MAGIC);
1896 }
1897
1898 static int set_config_cgroup_dir(const char *key, const char *value,
1899                                  struct lxc_conf *lxc_conf, void *data)
1900 {
1901         if (!strequal(key, "lxc.cgroup.dir"))
1902                 return ret_errno(EINVAL);
1903
1904         if (lxc_config_value_empty(value))
1905                 return clr_config_cgroup_dir(key, lxc_conf, NULL);
1906
1907         if (abspath(value))
1908                 return syserror_set(-EINVAL, "%s paths may not be absolute", key);
1909
1910         if (dotdot(value))
1911                 return syserror_set(-EINVAL, "%s paths may not walk upwards via \"../\"", key);
1912
1913         return set_config_path_item(&lxc_conf->cgroup_meta.dir, value);
1914 }
1915
1916 static int set_config_cgroup_monitor_dir(const char *key, const char *value,
1917                                          struct lxc_conf *lxc_conf, void *data)
1918 {
1919         if (lxc_config_value_empty(value))
1920                 return clr_config_cgroup_monitor_dir(key, lxc_conf, NULL);
1921
1922         if (abspath(value))
1923                 return syserror_set(-EINVAL, "%s paths may not be absolute", key);
1924
1925         if (dotdot(value))
1926                 return syserror_set(-EINVAL, "%s paths may not walk upwards via \"../\"", key);
1927
1928         return set_config_path_item(&lxc_conf->cgroup_meta.monitor_dir, value);
1929 }
1930
1931 static int set_config_cgroup_monitor_pivot_dir(const char *key, const char *value,
1932                                          struct lxc_conf *lxc_conf, void *data)
1933 {
1934         if (lxc_config_value_empty(value))
1935                 return clr_config_cgroup_monitor_pivot_dir(key, lxc_conf, NULL);
1936
1937         if (abspath(value))
1938                 return syserror_set(-EINVAL, "%s paths may not be absolute", key);
1939
1940         if (dotdot(value))
1941                 return syserror_set(-EINVAL, "%s paths may not walk upwards via \"../\"", key);
1942
1943         return set_config_path_item(&lxc_conf->cgroup_meta.monitor_pivot_dir, value);
1944 }
1945
1946 static int set_config_cgroup_container_dir(const char *key, const char *value,
1947                                            struct lxc_conf *lxc_conf,
1948                                            void *data)
1949 {
1950         if (lxc_config_value_empty(value))
1951                 return clr_config_cgroup_container_dir(key, lxc_conf, NULL);
1952
1953         if (abspath(value))
1954                 return syserror_set(-EINVAL, "%s paths may not be absolute", key);
1955
1956         if (dotdot(value))
1957                 return syserror_set(-EINVAL, "%s paths may not walk upwards via \"../\"", key);
1958
1959         return set_config_path_item(&lxc_conf->cgroup_meta.container_dir, value);
1960 }
1961
1962 static int set_config_cgroup_container_inner_dir(const char *key,
1963                                                  const char *value,
1964                                                  struct lxc_conf *lxc_conf,
1965                                                  void *data)
1966 {
1967         if (lxc_config_value_empty(value))
1968                 return clr_config_cgroup_container_inner_dir(key, lxc_conf, NULL);
1969
1970         if (abspath(value))
1971                 return syserror_set(-EINVAL, "%s paths may not be absolute", key);
1972
1973         if (strchr(value, '/') || strequal(value, ".") || strequal(value, ".."))
1974                 return log_error_errno(-EINVAL, EINVAL, "lxc.cgroup.dir.container.inner must be a single directory name");
1975
1976         return set_config_string_item(&lxc_conf->cgroup_meta.namespace_dir, value);
1977 }
1978
1979 static int set_config_cgroup_relative(const char *key, const char *value,
1980                                       struct lxc_conf *lxc_conf, void *data)
1981 {
1982         unsigned int converted;
1983         int ret;
1984
1985         if (lxc_config_value_empty(value))
1986                 return clr_config_cgroup_relative(key, lxc_conf, NULL);
1987
1988         ret = lxc_safe_uint(value, &converted);
1989         if (ret)
1990                 return ret;
1991
1992         if (converted == 1) {
1993                 lxc_conf->cgroup_meta.relative = true;
1994                 return 0;
1995         }
1996
1997         if (converted == 0) {
1998                 lxc_conf->cgroup_meta.relative = false;
1999                 return 0;
2000         }
2001
2002         return ret_errno(EINVAL);
2003 }
2004
2005 static bool parse_limit_value(const char **value, rlim_t *res)
2006 {
2007         char *endptr = NULL;
2008
2009         if (strnequal(*value, "unlimited", STRLITERALLEN("unlimited"))) {
2010                 *res = RLIM_INFINITY;
2011                 *value += STRLITERALLEN("unlimited");
2012                 return true;
2013         }
2014
2015         errno = 0;
2016         *res = strtoull(*value, &endptr, 10);
2017         if (errno || !endptr)
2018                 return false;
2019
2020         *value = endptr;
2021
2022         return true;
2023 }
2024
2025 static int set_config_prlimit(const char *key, const char *value,
2026                             struct lxc_conf *lxc_conf, void *data)
2027 {
2028         call_cleaner(free_lxc_limit) struct lxc_limit *new_lim = NULL;
2029         struct rlimit limit;
2030         rlim_t limit_value;
2031         struct lxc_limit *lim;
2032
2033         if (lxc_config_value_empty(value))
2034                 return lxc_clear_limits(lxc_conf, key);
2035
2036         if (!strnequal(key, "lxc.prlimit.", STRLITERALLEN("lxc.prlimit.")))
2037                 return ret_errno(EINVAL);
2038
2039         key += STRLITERALLEN("lxc.prlimit.");
2040
2041         /* soft limit comes first in the value */
2042         if (!parse_limit_value(&value, &limit_value))
2043                 return ret_errno(EINVAL);
2044
2045         limit.rlim_cur = limit_value;
2046
2047         /* skip spaces and a colon */
2048         while (isspace(*value))
2049                 ++value;
2050
2051         if (*value == ':')
2052                 ++value;
2053         else if (*value) /* any other character is an error here */
2054                 return ret_errno(EINVAL);
2055
2056         while (isspace(*value))
2057                 ++value;
2058
2059         /* optional hard limit */
2060         if (*value) {
2061                 if (!parse_limit_value(&value, &limit_value))
2062                         return ret_errno(EINVAL);
2063
2064                 limit.rlim_max = limit_value;
2065
2066                 /* check for trailing garbage */
2067                 while (isspace(*value))
2068                         ++value;
2069
2070                 if (*value)
2071                         return ret_errno(EINVAL);
2072         } else {
2073                 /* a single value sets both hard and soft limit */
2074                 limit.rlim_max = limit.rlim_cur;
2075         }
2076
2077         /* find existing list element */
2078         list_for_each_entry(lim, &lxc_conf->limits, head) {
2079                 if (!strequal(key, lim->resource))
2080                         continue;
2081
2082                 lim->limit = limit;
2083                 return 0;
2084         }
2085
2086         new_lim = zalloc(sizeof(*new_lim));
2087         if (!new_lim)
2088                 return ret_errno(ENOMEM);
2089
2090         new_lim->resource = strdup(key);
2091         if (!new_lim->resource)
2092                 return ret_errno(ENOMEM);
2093
2094         new_lim->limit = limit;
2095         list_add_tail(&new_lim->head, &lxc_conf->limits);
2096         move_ptr(new_lim);
2097
2098         return 0;
2099 }
2100
2101 static int set_config_sysctl(const char *key, const char *value,
2102                             struct lxc_conf *lxc_conf, void *data)
2103 {
2104         call_cleaner(free_lxc_sysctl) struct lxc_sysctl *sysctl_elem = NULL;
2105         struct lxc_sysctl *sysctl, *nsysctl;
2106
2107         if (lxc_config_value_empty(value))
2108                 return clr_config_sysctl(key, lxc_conf, NULL);
2109
2110         if (!strnequal(key, "lxc.sysctl.", STRLITERALLEN("lxc.sysctl.")))
2111                 return ret_errno(EINVAL);
2112
2113         key += STRLITERALLEN("lxc.sysctl.");
2114         if (is_empty_string(key))
2115                 return ret_errno(EINVAL);
2116
2117         /* find existing list element */
2118         list_for_each_entry_safe(sysctl, nsysctl, &lxc_conf->sysctls, head) {
2119                 __do_free char *replace_value = NULL;
2120
2121                 if (!strequal(key, sysctl->key))
2122                         continue;
2123
2124                 replace_value = strdup(value);
2125                 if (!replace_value)
2126                         return ret_errno(EINVAL);
2127
2128                 free(sysctl->value);
2129                 sysctl->value = move_ptr(replace_value);
2130
2131                 return 0;
2132         }
2133
2134         sysctl_elem = zalloc(sizeof(*sysctl_elem));
2135         if (!sysctl_elem)
2136                 return ret_errno(ENOMEM);
2137
2138         sysctl_elem->key = strdup(key);
2139         if (!sysctl_elem->key)
2140                 return ret_errno(ENOMEM);
2141
2142         sysctl_elem->value = strdup(value);
2143         if (!sysctl_elem->value)
2144                 return ret_errno(ENOMEM);
2145
2146         list_add_tail(&sysctl_elem->head, &lxc_conf->sysctls);
2147         move_ptr(sysctl_elem);
2148
2149         return 0;
2150 }
2151
2152 static int set_config_proc(const char *key, const char *value,
2153                             struct lxc_conf *lxc_conf, void *data)
2154 {
2155         call_cleaner(free_lxc_proc) struct lxc_proc *new_proc = NULL;
2156         const char *subkey;
2157
2158         if (lxc_config_value_empty(value))
2159                 return clr_config_proc(key, lxc_conf, NULL);
2160
2161         if (!strnequal(key, "lxc.proc.", STRLITERALLEN("lxc.proc.")))
2162                 return ret_errno(EINVAL);
2163
2164         subkey = key + STRLITERALLEN("lxc.proc.");
2165         if (*subkey == '\0')
2166                 return ret_errno(EINVAL);
2167
2168         new_proc = zalloc(sizeof(*new_proc));
2169         if (!new_proc)
2170                 return ret_errno(ENOMEM);
2171
2172         new_proc->filename = strdup(subkey);
2173         if (!new_proc->filename)
2174                 return ret_errno(ENOMEM);
2175
2176         new_proc->value = strdup(value);
2177         if (!new_proc->value)
2178                 return ret_errno(ENOMEM);
2179
2180         list_add_tail(&new_proc->head, &lxc_conf->procs);
2181         move_ptr(new_proc);
2182
2183         return 0;
2184 }
2185
2186 static int set_config_idmaps(const char *key, const char *value,
2187                              struct lxc_conf *lxc_conf, void *data)
2188 {
2189         __do_free struct id_map *idmap = NULL;
2190         unsigned long hostid, nsid, range;
2191         char type;
2192         int ret;
2193
2194         if (lxc_config_value_empty(value))
2195                 return lxc_clear_idmaps(lxc_conf);
2196
2197         idmap = zalloc(sizeof(*idmap));
2198         if (!idmap)
2199                 return ret_errno(ENOMEM);
2200
2201         ret = parse_idmaps(value, &type, &nsid, &hostid, &range);
2202         if (ret < 0)
2203                 return log_error_errno(-EINVAL, EINVAL, "Failed to parse id mappings");
2204
2205         INFO("Read uid map: type %c nsid %lu hostid %lu range %lu", type, nsid, hostid, range);
2206         if (type == 'u')
2207                 idmap->idtype = ID_TYPE_UID;
2208         else if (type == 'g')
2209                 idmap->idtype = ID_TYPE_GID;
2210         else
2211                 return ret_errno(EINVAL);
2212
2213         idmap->hostid = hostid;
2214         idmap->nsid = nsid;
2215         idmap->range = range;
2216         list_add_tail(&idmap->head, &lxc_conf->id_map);
2217
2218         if (!lxc_conf->root_nsuid_map && idmap->idtype == ID_TYPE_UID)
2219                 if (idmap->nsid == 0)
2220                         lxc_conf->root_nsuid_map = idmap;
2221
2222         if (!lxc_conf->root_nsgid_map && idmap->idtype == ID_TYPE_GID)
2223                 if (idmap->nsid == 0)
2224                         lxc_conf->root_nsgid_map = idmap;
2225
2226         move_ptr(idmap);
2227
2228         return 0;
2229 }
2230
2231 static int set_config_mount_fstab(const char *key, const char *value,
2232                                   struct lxc_conf *lxc_conf, void *data)
2233 {
2234         if (lxc_config_value_empty(value)) {
2235                 clr_config_mount_fstab(key, lxc_conf, NULL);
2236                 return ret_errno(EINVAL);
2237         }
2238
2239         return set_config_path_item(&lxc_conf->fstab, value);
2240 }
2241
2242 static int set_config_mount_auto(const char *key, const char *value,
2243                                  struct lxc_conf *lxc_conf, void *data)
2244 {
2245         __do_free char *autos = NULL;
2246         char *token;
2247         int i;
2248         static struct {
2249                 const char *token;
2250                 int mask;
2251                 int flag;
2252         } allowed_auto_mounts[] = {
2253                 { "proc",                       LXC_AUTO_PROC_MASK,     LXC_AUTO_PROC_MIXED                                     },
2254                 { "proc:mixed",                 LXC_AUTO_PROC_MASK,     LXC_AUTO_PROC_MIXED                                     },
2255                 { "proc:rw",                    LXC_AUTO_PROC_MASK,     LXC_AUTO_PROC_RW                                        },
2256                 { "sys",                        LXC_AUTO_SYS_MASK,      LXC_AUTO_SYS_MIXED                                      },
2257                 { "sys:ro",                     LXC_AUTO_SYS_MASK,      LXC_AUTO_SYS_RO                                         },
2258                 { "sys:mixed",                  LXC_AUTO_SYS_MASK,      LXC_AUTO_SYS_MIXED                                      },
2259                 { "sys:rw",                     LXC_AUTO_SYS_MASK,      LXC_AUTO_SYS_RW                                         },
2260                 { "cgroup",                     LXC_AUTO_CGROUP_MASK,   LXC_AUTO_CGROUP_NOSPEC                                  },
2261                 { "cgroup:mixed",               LXC_AUTO_CGROUP_MASK,   LXC_AUTO_CGROUP_MIXED                                   },
2262                 { "cgroup:ro",                  LXC_AUTO_CGROUP_MASK,   LXC_AUTO_CGROUP_RO                                      },
2263                 { "cgroup:rw",                  LXC_AUTO_CGROUP_MASK,   LXC_AUTO_CGROUP_RW                                      },
2264                 { "cgroup:force",               LXC_AUTO_CGROUP_MASK,   LXC_AUTO_CGROUP_NOSPEC | LXC_AUTO_CGROUP_FORCE          },
2265                 { "cgroup:mixed:force",         LXC_AUTO_CGROUP_MASK,   LXC_AUTO_CGROUP_MIXED | LXC_AUTO_CGROUP_FORCE           },
2266                 { "cgroup:ro:force",            LXC_AUTO_CGROUP_MASK,   LXC_AUTO_CGROUP_RO | LXC_AUTO_CGROUP_FORCE              },
2267                 { "cgroup:rw:force",            LXC_AUTO_CGROUP_MASK,   LXC_AUTO_CGROUP_RW | LXC_AUTO_CGROUP_FORCE              },
2268                 { "cgroup-full",                LXC_AUTO_CGROUP_MASK,   LXC_AUTO_CGROUP_FULL_NOSPEC                             },
2269                 { "cgroup-full:mixed",          LXC_AUTO_CGROUP_MASK,   LXC_AUTO_CGROUP_FULL_MIXED                              },
2270                 { "cgroup-full:ro",             LXC_AUTO_CGROUP_MASK,   LXC_AUTO_CGROUP_FULL_RO                                 },
2271                 { "cgroup-full:rw",             LXC_AUTO_CGROUP_MASK,   LXC_AUTO_CGROUP_FULL_RW                                 },
2272                 { "cgroup-full:force",          LXC_AUTO_CGROUP_MASK,   LXC_AUTO_CGROUP_FULL_NOSPEC | LXC_AUTO_CGROUP_FORCE     },
2273                 { "cgroup-full:mixed:force",    LXC_AUTO_CGROUP_MASK,   LXC_AUTO_CGROUP_FULL_MIXED | LXC_AUTO_CGROUP_FORCE      },
2274                 { "cgroup-full:ro:force",       LXC_AUTO_CGROUP_MASK,   LXC_AUTO_CGROUP_FULL_RO | LXC_AUTO_CGROUP_FORCE         },
2275                 { "cgroup-full:rw:force",       LXC_AUTO_CGROUP_MASK,   LXC_AUTO_CGROUP_FULL_RW | LXC_AUTO_CGROUP_FORCE         },
2276                 { "shmounts:",                  LXC_AUTO_SHMOUNTS_MASK, LXC_AUTO_SHMOUNTS                                       },
2277                 /*
2278                  * For adding anything that is just a single on/off, but has no
2279                  * options: keep mask and flag identical and just define the
2280                  * enum value as an unused bit so far
2281                  */
2282                 { NULL,                         0,                      0                                                       }
2283         };
2284
2285         if (lxc_config_value_empty(value)) {
2286                 lxc_conf->auto_mounts = 0;
2287                 return 0;
2288         }
2289
2290         autos = strdup(value);
2291         if (!autos)
2292                 return ret_errno(ENOMEM);
2293
2294         lxc_iterate_parts(token, autos, " \t") {
2295                 bool is_shmounts = false;
2296
2297                 for (i = 0; allowed_auto_mounts[i].token; i++) {
2298                         if (strequal(allowed_auto_mounts[i].token, token))
2299                                 break;
2300
2301                         if (strequal("shmounts:", allowed_auto_mounts[i].token) &&
2302                             strnequal("shmounts:", token, STRLITERALLEN("shmounts:"))) {
2303                                 is_shmounts = true;
2304                                 break;
2305                         }
2306                 }
2307
2308                 if (!allowed_auto_mounts[i].token)
2309                         return log_error_errno(-EINVAL, EINVAL, "Invalid filesystem to automount \"%s\"", token);
2310
2311                 lxc_conf->auto_mounts &= ~allowed_auto_mounts[i].mask;
2312                 lxc_conf->auto_mounts |= allowed_auto_mounts[i].flag;
2313
2314                 if (is_shmounts) {
2315                         __do_free char *container_path = NULL, *host_path = NULL;
2316                         char *val;
2317
2318                         val = token + STRLITERALLEN("shmounts:");
2319                         if (*val == '\0')
2320                                 return log_error_errno(-EINVAL, EINVAL, "Failed to copy shmounts host path");
2321
2322                         host_path = strdup(val);
2323                         if (!host_path)
2324                                 return log_error_errno(-EINVAL, EINVAL, "Failed to copy shmounts host path");
2325
2326                         val = strchr(host_path, ':');
2327                         if (!val || *(val + 1) == '\0')
2328                                 val = "/dev/.lxc-mounts";
2329                         else
2330                                 *val++ = '\0';
2331
2332                         container_path = strdup(val);
2333                         if(!container_path)
2334                                 return log_error_errno(-EINVAL, EINVAL, "Failed to copy shmounts container path");
2335
2336                         free_disarm(lxc_conf->shmount.path_host);
2337                         lxc_conf->shmount.path_host = move_ptr(host_path);
2338
2339                         free_disarm(lxc_conf->shmount.path_cont);
2340                         lxc_conf->shmount.path_cont = move_ptr(container_path);
2341                 }
2342         }
2343
2344         return 0;
2345 }
2346
2347 static int set_config_mount(const char *key, const char *value,
2348                             struct lxc_conf *lxc_conf, void *data)
2349 {
2350         __do_free char *mntelem = NULL;
2351         __do_free struct string_entry *entry = NULL;
2352
2353         if (lxc_config_value_empty(value))
2354                 return lxc_clear_mount_entries(lxc_conf);
2355
2356         entry = zalloc(sizeof(struct string_entry));
2357         if (!entry)
2358                 return ret_errno(ENOMEM);
2359
2360         mntelem = strdup(value);
2361         if (!mntelem)
2362                 return ret_errno(ENOMEM);
2363
2364         entry->val = move_ptr(mntelem);
2365         list_add_tail(&entry->head, &lxc_conf->mount_entries);
2366         move_ptr(entry);
2367
2368         return 0;
2369 }
2370
2371 int add_elem_to_mount_list(const char *value, struct lxc_conf *lxc_conf) {
2372         return set_config_mount(NULL, value, lxc_conf, NULL);
2373 }
2374
2375 static int add_cap_entry(struct lxc_conf *conf, char *caps, bool keep)
2376 {
2377         char *token;
2378
2379         /*
2380          * In case several capability keep is specified in a single line split
2381          * these caps in a single element for the list.
2382          */
2383         lxc_iterate_parts(token, caps, " \t") {
2384                 __do_free struct cap_entry *new_cap = NULL;
2385                 int cap;
2386
2387                 if (strequal(token, "none")) {
2388                         if (!keep)
2389                                 return syserror_set(-EINVAL, "The \"none\" keyword is only valid when keeping caps");
2390
2391                         lxc_clear_config_caps(conf);
2392                         continue;
2393                 }
2394
2395                 cap = parse_cap(token);
2396                 if (cap < 0) {
2397                         if (cap != -2)
2398                                 return syserror_set(-EINVAL, "Invalid capability specified");
2399
2400                         INFO("Ignoring unknown capability \"%s\"", token);
2401                         continue;
2402                 }
2403
2404                 new_cap = zalloc(sizeof(struct cap_entry));
2405                 if (!new_cap)
2406                         return ret_errno(ENOMEM);
2407
2408                 new_cap->cap_name = strdup(token);
2409                 if (!new_cap->cap_name)
2410                         return ret_errno(ENOMEM);
2411                 new_cap->cap = cap;
2412
2413                 list_add_tail(&new_cap->head, &conf->caps.list);
2414                 move_ptr(new_cap);
2415         }
2416
2417         return 0;
2418 }
2419
2420 static int set_config_cap_keep(const char *key, const char *value,
2421                                struct lxc_conf *lxc_conf, void *data)
2422 {
2423         __do_free char *caps = NULL;
2424         int ret;
2425
2426         if (lxc_config_value_empty(value))
2427                 return lxc_clear_config_caps(lxc_conf);
2428
2429         caps = strdup(value);
2430         if (!caps)
2431                 return ret_errno(ENOMEM);
2432
2433         if (!lxc_conf->caps.keep && !list_empty(&lxc_conf->caps.list))
2434                 return syserror_set(-EINVAL, "Keeping and dropping capabilities are mutually exclusive");
2435
2436         ret = add_cap_entry(lxc_conf, caps, true);
2437         if (ret < 0)
2438                 return ret;
2439
2440         lxc_conf->caps.keep = true;
2441         return 0;
2442 }
2443
2444 static int set_config_cap_drop(const char *key, const char *value,
2445                                struct lxc_conf *lxc_conf, void *data)
2446 {
2447         __do_free char *caps = NULL;
2448         int ret;
2449
2450         if (lxc_config_value_empty(value))
2451                 return lxc_clear_config_caps(lxc_conf);
2452
2453         if (lxc_conf->caps.keep)
2454                 return syserror_set(-EINVAL, "Keeping and dropping capabilities are mutually exclusive");
2455
2456         caps = strdup(value);
2457         if (!caps)
2458                 return ret_errno(ENOMEM);
2459
2460         ret = add_cap_entry(lxc_conf, caps, false);
2461         if (ret < 0)
2462                 return ret;
2463
2464         lxc_conf->caps.keep = false;
2465         return 0;
2466 }
2467
2468 static int set_config_console_path(const char *key, const char *value,
2469                                    struct lxc_conf *lxc_conf, void *data)
2470 {
2471         return set_config_path_item(&lxc_conf->console.path, value);
2472 }
2473
2474 static int set_config_console_rotate(const char *key, const char *value,
2475                                      struct lxc_conf *lxc_conf, void *data)
2476 {
2477         int ret;
2478
2479         if (lxc_config_value_empty(value)) {
2480                 lxc_conf->console.log_rotate = 0;
2481                 return 0;
2482         }
2483
2484         ret = lxc_safe_uint(value, &lxc_conf->console.log_rotate);
2485         if (ret)
2486                 return ret_errno(EINVAL);
2487
2488         if (lxc_conf->console.log_rotate > 1)
2489                 return log_error_errno(-EINVAL, EINVAL, "The \"lxc.console.rotate\" config key can only be set to 0 or 1");
2490
2491         return 0;
2492 }
2493
2494 static int set_config_console_logfile(const char *key, const char *value,
2495                                       struct lxc_conf *lxc_conf, void *data)
2496 {
2497         return set_config_path_item(&lxc_conf->console.log_path, value);
2498 }
2499
2500 static int set_config_console_buffer_size(const char *key, const char *value,
2501                                           struct lxc_conf *lxc_conf, void *data)
2502 {
2503         int ret;
2504         long long int size;
2505         uint64_t buffer_size, pgsz;
2506
2507         if (lxc_config_value_empty(value)) {
2508                 lxc_conf->console.buffer_size = 0;
2509                 return 0;
2510         }
2511
2512         /* If the user specified "auto" the default log size is 2^17 = 128 Kib */
2513         if (strequal(value, "auto")) {
2514                 lxc_conf->console.buffer_size = 1 << 17;
2515                 return 0;
2516         }
2517
2518         ret = parse_byte_size_string(value, &size);
2519         if (ret)
2520                 return ret;
2521
2522         if (size < 0)
2523                 return ret_errno(EINVAL);
2524
2525         /* must be at least a page size */
2526         pgsz = lxc_getpagesize();
2527         if ((uint64_t)size < pgsz) {
2528                 NOTICE("Requested ringbuffer size for the console is %lld but must be at least %" PRId64 " bytes. Setting ringbuffer size to %" PRId64 " bytes",
2529                        size, pgsz, pgsz);
2530                 size = pgsz;
2531         }
2532
2533         buffer_size = lxc_find_next_power2((uint64_t)size);
2534         if (buffer_size == 0)
2535                 return ret_errno(EINVAL);
2536
2537         if (buffer_size != size)
2538                 NOTICE("Passed size was not a power of 2. Rounding log size to next power of two: %" PRIu64 " bytes", buffer_size);
2539
2540         lxc_conf->console.buffer_size = buffer_size;
2541
2542         return 0;
2543 }
2544
2545 static int set_config_console_size(const char *key, const char *value,
2546                                    struct lxc_conf *lxc_conf, void *data)
2547 {
2548         int ret;
2549         long long int size;
2550         uint64_t log_size, pgsz;
2551
2552         if (lxc_config_value_empty(value)) {
2553                 lxc_conf->console.log_size = 0;
2554                 return 0;
2555         }
2556
2557         /* If the user specified "auto" the default log size is 2^17 = 128 Kib */
2558         if (strequal(value, "auto")) {
2559                 lxc_conf->console.log_size = 1 << 17;
2560                 return 0;
2561         }
2562
2563         ret = parse_byte_size_string(value, &size);
2564         if (ret)
2565                 return ret_errno(EINVAL);
2566
2567         if (size < 0)
2568                 return ret_errno(EINVAL);
2569
2570         /* must be at least a page size */
2571         pgsz = lxc_getpagesize();
2572         if ((uint64_t)size < pgsz) {
2573                 NOTICE("Requested ringbuffer size for the console is %lld but must be at least %" PRId64 " bytes. Setting ringbuffer size to %" PRId64 " bytes",
2574                        size, pgsz, pgsz);
2575                 size = pgsz;
2576         }
2577
2578         log_size = lxc_find_next_power2((uint64_t)size);
2579         if (log_size == 0)
2580                 return ret_errno(EINVAL);
2581
2582         if (log_size != size)
2583                 NOTICE("Passed size was not a power of 2. Rounding log size to next power of two: %" PRIu64 " bytes", log_size);
2584
2585         lxc_conf->console.log_size = log_size;
2586
2587         return 0;
2588 }
2589
2590 /*
2591  * If we find a lxc.net.[i].hwaddr or lxc.network.hwaddr in the original config
2592  * file, we expand it in the unexpanded_config, so that after a save_config we
2593  * store the hwaddr for re-use.
2594  * This is only called when reading the config file, not when executing a
2595  * lxc.include.
2596  * 'x' and 'X' are substituted in-place.
2597  */
2598 static void update_hwaddr(const char *line)
2599 {
2600         char *p;
2601
2602         line += lxc_char_left_gc(line, strlen(line));
2603         if (line[0] == '#')
2604                 return;
2605
2606         if (!lxc_config_net_is_hwaddr(line))
2607                 return;
2608
2609         /* Let config_net_hwaddr raise the error. */
2610         p = strchr(line, '=');
2611         if (!p)
2612                 return;
2613         p++;
2614
2615         while (isblank(*p))
2616                 p++;
2617
2618         if (!*p)
2619                 return;
2620
2621         rand_complete_hwaddr(p);
2622 }
2623
2624 int append_unexp_config_line(const char *line, struct lxc_conf *conf)
2625 {
2626         size_t linelen;
2627         size_t len = conf->unexpanded_len;
2628
2629         update_hwaddr(line);
2630
2631         linelen = strlen(line);
2632         while (conf->unexpanded_alloced <= len + linelen + 2) {
2633                 char *tmp;
2634
2635                 tmp = realloc(conf->unexpanded_config, conf->unexpanded_alloced + 1024);
2636                 if (!tmp)
2637                         return ret_errno(EINVAL);
2638
2639                 if (!conf->unexpanded_config)
2640                         *tmp = '\0';
2641
2642                 conf->unexpanded_config = tmp;
2643                 conf->unexpanded_alloced += 1024;
2644         }
2645
2646         memcpy(conf->unexpanded_config + conf->unexpanded_len, line, linelen);
2647         conf->unexpanded_len += linelen;
2648         if (line[linelen - 1] != '\n')
2649                 conf->unexpanded_config[conf->unexpanded_len++] = '\n';
2650         conf->unexpanded_config[conf->unexpanded_len] = '\0';
2651
2652         return 0;
2653 }
2654
2655 static int do_includedir(const char *dirp, struct lxc_conf *lxc_conf)
2656 {
2657         __do_closedir DIR *dir = NULL;
2658         struct dirent *direntp;
2659         int len, ret;
2660
2661         dir = opendir(dirp);
2662         if (!dir)
2663                 return errno == ENOENT ? 0 : -errno;
2664
2665         while ((direntp = readdir(dir))) {
2666                 const char *fnam;
2667                 char path[PATH_MAX];
2668
2669                 fnam = direntp->d_name;
2670                 if (strequal(fnam, "."))
2671                         continue;
2672
2673                 if (strequal(fnam, ".."))
2674                         continue;
2675
2676                 len = strlen(fnam);
2677                 if (len < 6 || !strnequal(fnam + len - 5, ".conf", 5))
2678                         continue;
2679
2680                 len = strnprintf(path, sizeof(path), "%s/%s", dirp, fnam);
2681                 if (len < 0)
2682                         return ret_errno(EIO);
2683
2684                 ret = lxc_config_read(path, lxc_conf, true);
2685                 if (ret < 0)
2686                         return ret;
2687         }
2688
2689         return 0;
2690 }
2691
2692 static int set_config_includefiles(const char *key, const char *value,
2693                                    struct lxc_conf *lxc_conf, void *data)
2694 {
2695         if (lxc_config_value_empty(value)) {
2696                 clr_config_includefiles(key, lxc_conf, NULL);
2697                 return 0;
2698         }
2699
2700         if (value[strlen(value)-1] == '/' || is_dir(value))
2701                 return do_includedir(value, lxc_conf);
2702
2703         return lxc_config_read(value, lxc_conf, true);
2704 }
2705
2706 static int set_config_rootfs_path(const char *key, const char *value,
2707                                   struct lxc_conf *lxc_conf, void *data)
2708 {
2709         __do_free char *dup = NULL;
2710         int ret;
2711         char *tmp;
2712         const char *container_path;
2713
2714         if (lxc_config_value_empty(value)) {
2715                 free(lxc_conf->rootfs.path);
2716                 lxc_conf->rootfs.path = NULL;
2717                 return 0;
2718         }
2719
2720         dup = strdup(value);
2721         if (!dup)
2722                 return ret_errno(ENOMEM);
2723
2724         /* Split <storage type>:<container path> into <storage type> and
2725          * <container path>. Set "rootfs.bdev_type" to <storage type> and
2726          * "rootfs.path" to <container path>.
2727          */
2728         tmp = strchr(dup, ':');
2729         if (tmp) {
2730                 *tmp = '\0';
2731
2732                 ret = set_config_path_item(&lxc_conf->rootfs.bdev_type, dup);
2733                 if (ret < 0)
2734                         return ret_errno(ENOMEM);
2735
2736                 tmp++;
2737                 container_path = tmp;
2738         } else {
2739                 container_path = value;
2740         }
2741
2742         return set_config_path_item(&lxc_conf->rootfs.path, container_path);
2743 }
2744
2745 static int set_config_rootfs_managed(const char *key, const char *value,
2746                                      struct lxc_conf *lxc_conf, void *data)
2747 {
2748         return set_config_bool_item(&lxc_conf->rootfs.managed, value, true);
2749 }
2750
2751 static int set_config_rootfs_mount(const char *key, const char *value,
2752                                    struct lxc_conf *lxc_conf, void *data)
2753 {
2754         return set_config_path_item(&lxc_conf->rootfs.mount, value);
2755 }
2756
2757 static int set_config_rootfs_options(const char *key, const char *value,
2758                                      struct lxc_conf *lxc_conf, void *data)
2759 {
2760         __do_free char *dup = NULL, *raw_options = NULL;
2761         struct lxc_rootfs *rootfs = &lxc_conf->rootfs;
2762         struct lxc_mount_options *mnt_opts = &rootfs->mnt_opts;
2763         int ret;
2764
2765         clr_config_rootfs_options(key, lxc_conf, data);
2766         if (lxc_config_value_empty(value))
2767                 return 0;
2768
2769         ret = set_config_string_item(&raw_options, value);
2770         if (ret < 0)
2771                 return ret_errno(ENOMEM);
2772
2773         dup = strdup(value);
2774         if (!dup)
2775                 return -ENOMEM;
2776
2777         ret = parse_lxc_mount_attrs(mnt_opts, dup);
2778         if (ret < 0)
2779                 return ret;
2780
2781         /* Make sure we're only valid LXC specific mount options. */
2782         if (mnt_opts->create_dir || mnt_opts->create_file ||
2783             mnt_opts->optional || mnt_opts->relative)
2784                 return syserror_set(-EINVAL, "Invalid LXC specific mount option for rootfs mount");
2785
2786         ret = parse_mount_attrs(mnt_opts, dup);
2787         if (ret < 0)
2788                 return ret_errno(EINVAL);
2789
2790         rootfs->mnt_opts.raw_options = move_ptr(raw_options);
2791         return 0;
2792 }
2793
2794 static int set_config_uts_name(const char *key, const char *value,
2795                               struct lxc_conf *lxc_conf, void *data)
2796 {
2797         __do_free struct utsname *utsname = NULL;
2798
2799         if (lxc_config_value_empty(value)) {
2800                 clr_config_uts_name(key, lxc_conf, NULL);
2801                 return 0;
2802         }
2803
2804         utsname = zalloc(sizeof(*utsname));
2805         if (!utsname)
2806                 return ret_errno(ENOMEM);
2807
2808         if (strlen(value) >= sizeof(utsname->nodename))
2809                 return ret_errno(EINVAL);
2810
2811         (void)strlcpy(utsname->nodename, value, sizeof(utsname->nodename));
2812         free(lxc_conf->utsname);
2813         lxc_conf->utsname = move_ptr(utsname);
2814
2815         return 0;
2816 }
2817
2818 static int set_config_namespace_clone(const char *key, const char *value,
2819                                       struct lxc_conf *lxc_conf, void *data)
2820 {
2821         __do_free char *ns = NULL;
2822         char *token;
2823         int cloneflag = 0;
2824
2825         if (lxc_config_value_empty(value))
2826                 return clr_config_namespace_clone(key, lxc_conf, data);
2827
2828         if (lxc_conf->ns_keep != 0)
2829                 return log_error_errno(-EINVAL, EINVAL, "Cannot set both \"lxc.namespace.clone\" and \"lxc.namespace.keep\"");
2830
2831         ns = strdup(value);
2832         if (!ns)
2833                 return ret_errno(ENOMEM);
2834
2835         lxc_iterate_parts(token, ns, " \t") {
2836                 token += lxc_char_left_gc(token, strlen(token));
2837                 token[lxc_char_right_gc(token, strlen(token))] = '\0';
2838                 cloneflag = lxc_namespace_2_cloneflag(token);
2839                 if (cloneflag < 0)
2840                         return ret_errno(EINVAL);
2841                 lxc_conf->ns_clone |= cloneflag;
2842         }
2843
2844         return 0;
2845 }
2846
2847 static int set_config_namespace_keep(const char *key, const char *value,
2848                                      struct lxc_conf *lxc_conf, void *data)
2849 {
2850         __do_free char *ns = NULL;
2851         char *token;
2852         int cloneflag = 0;
2853
2854         if (lxc_config_value_empty(value))
2855                 return clr_config_namespace_keep(key, lxc_conf, data);
2856
2857         if (lxc_conf->ns_clone != 0)
2858                 return log_error_errno(-EINVAL, EINVAL, "Cannot set both \"lxc.namespace.clone\" and \"lxc.namespace.keep\"");
2859
2860         ns = strdup(value);
2861         if (!ns)
2862                 return ret_errno(ENOMEM);
2863
2864         lxc_iterate_parts(token, ns, " \t") {
2865                 token += lxc_char_left_gc(token, strlen(token));
2866                 token[lxc_char_right_gc(token, strlen(token))] = '\0';
2867                 cloneflag = lxc_namespace_2_cloneflag(token);
2868                 if (cloneflag < 0)
2869                         return ret_errno(EINVAL);
2870                 lxc_conf->ns_keep |= cloneflag;
2871         }
2872
2873         return 0;
2874 }
2875
2876 static int set_config_time_offset_boot(const char *key, const char *value,
2877                                        struct lxc_conf *lxc_conf, void *data)
2878 {
2879         int ret;
2880         char *unit;
2881         int64_t offset = 0;
2882         char buf[STRLITERALLEN("ms") + 1];
2883
2884         if (lxc_config_value_empty(value))
2885                 return clr_config_time_offset_boot(key, lxc_conf, data);
2886
2887         ret = lxc_safe_int64_residual(value, &offset, 10, buf, sizeof(buf));
2888         if (ret)
2889                 return ret;
2890
2891         unit = lxc_trim_whitespace_in_place(buf);
2892         if (strequal(unit, "h")) {
2893                 if (!multiply_overflow(offset, 3600, &lxc_conf->timens.s_boot))
2894                         return ret_errno(EOVERFLOW);
2895         } else if (strequal(unit, "m")) {
2896                 if (!multiply_overflow(offset, 60, &lxc_conf->timens.s_boot))
2897                         return ret_errno(EOVERFLOW);
2898         } else if (strequal(unit, "s")) {
2899                 lxc_conf->timens.s_boot = offset;
2900         } else if (strequal(unit, "ms")) {
2901                 if (!multiply_overflow(offset, 1000000, &lxc_conf->timens.ns_boot))
2902                         return ret_errno(EOVERFLOW);
2903         } else if (strequal(unit, "us")) {
2904                 if (!multiply_overflow(offset, 1000, &lxc_conf->timens.ns_boot))
2905                         return ret_errno(EOVERFLOW);
2906         } else if (strequal(unit, "ns")) {
2907                 lxc_conf->timens.ns_boot = offset;
2908         } else {
2909                 return ret_errno(EINVAL);
2910         }
2911
2912         return 0;
2913 }
2914
2915 static int set_config_time_offset_monotonic(const char *key, const char *value,
2916                                             struct lxc_conf *lxc_conf, void *data)
2917 {
2918         int ret;
2919         char *unit;
2920         int64_t offset = 0;
2921         char buf[STRLITERALLEN("ms") + 1];
2922
2923         if (lxc_config_value_empty(value))
2924                 return clr_config_time_offset_monotonic(key, lxc_conf, data);
2925
2926         ret = lxc_safe_int64_residual(value, &offset, 10, buf, sizeof(buf));
2927         if (ret)
2928                 return ret;
2929
2930         unit = lxc_trim_whitespace_in_place(buf);
2931         if (strequal(unit, "h")) {
2932                 if (!multiply_overflow(offset, 3600, &lxc_conf->timens.s_monotonic))
2933                         return ret_errno(EOVERFLOW);
2934         } else if (strequal(unit, "m")) {
2935                 if (!multiply_overflow(offset, 60, &lxc_conf->timens.s_monotonic))
2936                         return ret_errno(EOVERFLOW);
2937         } else if (strequal(unit, "s")) {
2938                 lxc_conf->timens.s_monotonic = offset;
2939         } else if (strequal(unit, "ms")) {
2940                 if (!multiply_overflow(offset, 1000000, &lxc_conf->timens.ns_monotonic))
2941                         return ret_errno(EOVERFLOW);
2942         } else if (strequal(unit, "us")) {
2943                 if (!multiply_overflow(offset, 1000, &lxc_conf->timens.ns_monotonic))
2944                         return ret_errno(EOVERFLOW);
2945         } else if (strequal(unit, "ns")) {
2946                 lxc_conf->timens.ns_monotonic = offset;
2947         } else {
2948                 return ret_errno(EINVAL);
2949         }
2950
2951         return 0;
2952 }
2953
2954 static int set_config_namespace_share(const char *key, const char *value,
2955                                       struct lxc_conf *lxc_conf, void *data)
2956 {
2957         int ns_idx;
2958         const char *namespace;
2959
2960         if (lxc_config_value_empty(value))
2961                 return clr_config_namespace_share(key, lxc_conf, data);
2962
2963         namespace = key + STRLITERALLEN("lxc.namespace.share.");
2964         if (is_empty_string(namespace))
2965                 return ret_errno(EINVAL);
2966
2967         ns_idx = lxc_namespace_2_ns_idx(namespace);
2968         if (ns_idx < 0)
2969                 return ns_idx;
2970
2971         return set_config_string_item(&lxc_conf->ns_share[ns_idx], value);
2972 }
2973
2974 struct parse_line_conf {
2975         struct lxc_conf *conf;
2976         bool from_include;
2977 };
2978
2979 static int parse_line(char *buffer, void *data)
2980 {
2981         __do_free char *linep = NULL;
2982         char *dot, *key, *line, *value;
2983         bool empty_line;
2984         struct lxc_config_t *config;
2985         int ret;
2986         char *dup = buffer;
2987         struct parse_line_conf *plc = data;
2988
2989         if (!plc->conf)
2990                 return syserror_set(-EINVAL, "Missing config");
2991
2992         /* If there are newlines in the config file we should keep them. */
2993         empty_line = lxc_is_line_empty(dup);
2994         if (empty_line)
2995                 dup = "\n";
2996
2997         /* We have to dup the buffer otherwise, at the re-exec for reboot we
2998          * modified the original string on the stack by replacing '=' by '\0'
2999          * below.
3000          */
3001         linep = line = strdup(dup);
3002         if (!line)
3003                 return ret_errno(ENOMEM);
3004
3005         if (!plc->from_include) {
3006                 ret = append_unexp_config_line(line, plc->conf);
3007                 if (ret < 0)
3008                         return ret;
3009         }
3010
3011         if (empty_line)
3012                 return 0;
3013
3014         line += lxc_char_left_gc(line, strlen(line));
3015
3016         /* ignore comments */
3017         if (line[0] == '#')
3018                 return 0;
3019
3020         /* martian option - don't add it to the config itself */
3021         if (!strnequal(line, "lxc.", 4))
3022                 return 0;
3023
3024         dot = strchr(line, '=');
3025         if (!dot)
3026                 return log_error_errno(-EINVAL, EINVAL, "Invalid configuration line: %s", line);
3027
3028         *dot = '\0';
3029         value = dot + 1;
3030
3031         key = line;
3032         key[lxc_char_right_gc(key, strlen(key))] = '\0';
3033
3034         value += lxc_char_left_gc(value, strlen(value));
3035         value[lxc_char_right_gc(value, strlen(value))] = '\0';
3036
3037         if (*value == '\'' || *value == '\"') {
3038                 size_t len;
3039
3040                 len = strlen(value);
3041                 if (len > 1 && value[len - 1] == *value) {
3042                         value[len - 1] = '\0';
3043                         value++;
3044                 }
3045         }
3046
3047         config = lxc_get_config(key);
3048         return config->set(key, value, plc->conf, NULL);
3049 }
3050
3051 static struct new_config_item *parse_new_conf_line(char *buffer)
3052 {
3053         __do_free char *k = NULL, *linep = NULL, *v = NULL;
3054         __do_free struct new_config_item *new = NULL;
3055         char *dup = buffer;
3056         char *dot, *key, *line, *value;
3057
3058         if (is_empty_string(buffer))
3059                 return log_error_errno(NULL, EINVAL, "Empty configuration line");
3060
3061         linep = line = strdup(dup);
3062         if (!line)
3063                 return NULL;
3064
3065         line += lxc_char_left_gc(line, strlen(line));
3066
3067         /* martian option - don't add it to the config itself */
3068         if (!strnequal(line, "lxc.", 4))
3069                 return 0;
3070
3071         dot = strchr(line, '=');
3072         if (!dot)
3073                 return log_error_errno(NULL, EINVAL, "Invalid configuration line: %s", line);
3074
3075         *dot = '\0';
3076         value = dot + 1;
3077
3078         key = line;
3079         key[lxc_char_right_gc(key, strlen(key))] = '\0';
3080
3081         value += lxc_char_left_gc(value, strlen(value));
3082         value[lxc_char_right_gc(value, strlen(value))] = '\0';
3083
3084         if (*value == '\'' || *value == '\"') {
3085                 size_t len;
3086
3087                 len = strlen(value);
3088                 if (len > 1 && value[len - 1] == *value) {
3089                         value[len - 1] = '\0';
3090                         value++;
3091                 }
3092         }
3093
3094         new = zalloc(sizeof(struct new_config_item));
3095         if (!new)
3096                 return NULL;
3097
3098         k = strdup(key);
3099         if (!k)
3100                 return NULL;
3101
3102         v = strdup(value);
3103         if (!v)
3104                 return NULL;
3105
3106         new->key = move_ptr(k);
3107         new->val = move_ptr(v);
3108         return move_ptr(new);
3109 }
3110
3111 int lxc_config_read(const char *file, struct lxc_conf *conf, bool from_include)
3112 {
3113         struct parse_line_conf plc;
3114
3115         if (!conf)
3116                 return syserror_set(-EINVAL, "Missing config");
3117
3118         plc.conf = conf;
3119         plc.from_include = from_include;
3120
3121         /* Catch only the top level config file name in the structure. */
3122         if (!conf->rcfile)
3123                 conf->rcfile = strdup(file);
3124
3125         return lxc_file_for_each_line_mmap(file, parse_line, &plc);
3126 }
3127
3128 int lxc_config_define_add(struct lxc_list *defines, char *arg)
3129 {
3130         __do_free struct lxc_list *dent = NULL;
3131
3132         dent = lxc_list_new();
3133         if (!dent)
3134                 return ret_errno(ENOMEM);
3135
3136         dent->elem = parse_new_conf_line(arg);
3137         if (!dent->elem)
3138                 return ret_errno(ENOMEM);
3139
3140         lxc_list_add_tail(defines, move_ptr(dent));
3141
3142         return 0;
3143 }
3144
3145 bool lxc_config_define_load(struct lxc_list *defines, struct lxc_container *c)
3146 {
3147         struct lxc_list *it;
3148         bool bret = true;
3149
3150         lxc_list_for_each(it, defines) {
3151                 struct new_config_item *new_item = it->elem;
3152                 bret = c->set_config_item(c, new_item->key, new_item->val);
3153                 if (!bret)
3154                         break;
3155         }
3156
3157 #ifndef FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION
3158         lxc_config_define_free(defines);
3159 #endif /* !FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION */
3160
3161         return bret;
3162 }
3163
3164 void lxc_config_define_free(struct lxc_list *defines)
3165 {
3166         struct lxc_list *it, *next;
3167
3168         lxc_list_for_each_safe(it, defines, next) {
3169                 struct new_config_item *new_item = it->elem;
3170                 free(new_item->key);
3171                 free(new_item->val);
3172                 lxc_list_del(it);
3173                 free(it->elem);
3174                 free(it);
3175         }
3176 }
3177
3178 int lxc_config_parse_arch(const char *arch, signed long *persona)
3179 {
3180         static struct per_name {
3181                 char *name;
3182                 unsigned long per;
3183         } pername[] = {
3184                 { "arm",       PER_LINUX32 },
3185                 { "armel",     PER_LINUX32 },
3186                 { "armhf",     PER_LINUX32 },
3187                 { "armv7l",    PER_LINUX32 },
3188                 { "athlon",    PER_LINUX32 },
3189                 { "i386",      PER_LINUX32 },
3190                 { "i486",      PER_LINUX32 },
3191                 { "i586",      PER_LINUX32 },
3192                 { "i686",      PER_LINUX32 },
3193                 { "linux32",   PER_LINUX32 },
3194                 { "mips",      PER_LINUX32 },
3195                 { "mipsel",    PER_LINUX32 },
3196                 { "ppc",       PER_LINUX32 },
3197                 { "powerpc",   PER_LINUX32 },
3198                 { "x86",       PER_LINUX32 },
3199                 { "aarch64",   PER_LINUX   },
3200                 { "amd64",     PER_LINUX   },
3201                 { "arm64",     PER_LINUX   },
3202                 { "linux64",   PER_LINUX   },
3203                 { "mips64",    PER_LINUX   },
3204                 { "mips64el",  PER_LINUX   },
3205                 { "ppc64",     PER_LINUX   },
3206                 { "ppc64el",   PER_LINUX   },
3207                 { "ppc64le",   PER_LINUX   },
3208                 { "powerpc64", PER_LINUX   },
3209                 { "s390x",     PER_LINUX   },
3210                 { "x86_64",    PER_LINUX   },
3211         };
3212
3213         for (int i = 0; i < ARRAY_SIZE(pername); i++) {
3214                 if (!strequal(pername[i].name, arch))
3215                         continue;
3216
3217                 *persona = pername[i].per;
3218                 return 0;
3219         }
3220
3221         return ret_errno(EINVAL);
3222 }
3223
3224 int lxc_fill_elevated_privileges(char *flaglist, unsigned int *flags)
3225 {
3226         unsigned int flags_tmp = 0;
3227         char *token;
3228         struct {
3229                 const char *token;
3230                 int flag;
3231         } all_privs[] = {
3232                 { "CGROUP", LXC_ATTACH_MOVE_TO_CGROUP    },
3233                 { "CAP",    LXC_ATTACH_DROP_CAPABILITIES },
3234                 { "LSM",    LXC_ATTACH_LSM_EXEC          },
3235                 { NULL,     0                            }
3236         };
3237
3238         if (!flaglist) {
3239                 /*
3240                  * For the sake of backward compatibility, keep all privileges
3241                  * if no specific privileges are specified.
3242                  */
3243                 for (unsigned int i = 0; all_privs[i].token; i++)
3244                         flags_tmp |= all_privs[i].flag;
3245
3246                 *flags = flags_tmp;
3247                 return 0;
3248         }
3249
3250         lxc_iterate_parts(token, flaglist, "|") {
3251                 bool valid_token = false;
3252
3253                 for (unsigned int i = 0; all_privs[i].token; i++) {
3254                         if (!strequal(all_privs[i].token, token))
3255                                 continue;
3256
3257                         valid_token = true;
3258                         flags_tmp |= all_privs[i].flag;
3259                 }
3260
3261                 if (!valid_token)
3262                         return syserror_set(-EINVAL, "Invalid elevated privilege \"%s\" requested", token);
3263         }
3264
3265         *flags = flags_tmp;
3266         return 0;
3267 }
3268
3269 /* Write out a configuration file. */
3270 int write_config(int fd, const struct lxc_conf *conf)
3271 {
3272         int ret;
3273         size_t len = conf->unexpanded_len;
3274
3275         if (len == 0)
3276                 return 0;
3277
3278         ret = lxc_write_nointr(fd, conf->unexpanded_config, len);
3279         if (ret < 0)
3280                 return log_error_errno(-errno, errno, "Failed to write configuration file");
3281
3282         return 0;
3283 }
3284
3285 bool do_append_unexp_config_line(struct lxc_conf *conf, const char *key,
3286                                  const char *v)
3287 {
3288         __do_free char *tmp = NULL;
3289         int ret;
3290         size_t len;
3291
3292         len = strlen(key) + strlen(v) + 4;
3293         tmp = must_realloc(NULL, len);
3294
3295         if (lxc_config_value_empty(v))
3296                 ret = strnprintf(tmp, len, "%s =", key);
3297         else
3298                 ret = strnprintf(tmp, len, "%s = %s", key, v);
3299         if (ret < 0)
3300                 return false;
3301
3302         /* Save the line verbatim into unexpanded_conf */
3303         if (append_unexp_config_line(tmp, conf))
3304                 return false;
3305
3306         return true;
3307 }
3308
3309 void clear_unexp_config_line(struct lxc_conf *conf, const char *key,
3310                              bool rm_subkeys)
3311 {
3312         char *lend;
3313         char *lstart = conf->unexpanded_config;
3314
3315         if (!conf->unexpanded_config)
3316                 return;
3317
3318         while (*lstart) {
3319                 lend = strchr(lstart, '\n');
3320                 char v;
3321
3322                 if (!lend)
3323                         lend = lstart + strlen(lstart);
3324                 else
3325                         lend++;
3326
3327                 if (!strnequal(lstart, key, strlen(key))) {
3328                         lstart = lend;
3329                         continue;
3330                 }
3331
3332                 if (!rm_subkeys) {
3333                         v = lstart[strlen(key)];
3334                         if (!isspace(v) && v != '=') {
3335                                 lstart = lend;
3336                                 continue;
3337                         }
3338                 }
3339
3340                 conf->unexpanded_len -= (lend - lstart);
3341
3342                 if (*lend == '\0') {
3343                         *lstart = '\0';
3344                         return;
3345                 }
3346
3347                 memmove(lstart, lend, strlen(lend) + 1);
3348         }
3349 }
3350
3351 bool clone_update_unexp_ovl_paths(struct lxc_conf *conf, const char *oldpath,
3352                                   const char *newpath, const char *oldname,
3353                                   const char *newname, const char *ovldir)
3354 {
3355         __do_free char *newdir = NULL, *olddir = NULL;
3356         char *lstart = conf->unexpanded_config;
3357         const char *key = "lxc.mount.entry";
3358         int ret;
3359         char *lend, *p, *q;
3360         size_t newdirlen, olddirlen;
3361
3362         olddirlen = strlen(ovldir) + strlen(oldpath) + strlen(oldname) + 2;
3363         olddir = must_realloc(NULL, olddirlen + 1);
3364         ret = strnprintf(olddir, olddirlen + 1, "%s=%s/%s", ovldir, oldpath, oldname);
3365         if (ret < 0)
3366                 return false;
3367
3368         newdirlen = strlen(ovldir) + strlen(newpath) + strlen(newname) + 2;
3369         newdir = must_realloc(NULL, newdirlen + 1);
3370         ret = strnprintf(newdir, newdirlen + 1, "%s=%s/%s", ovldir, newpath, newname);
3371         if (ret < 0)
3372                 return false;
3373
3374         if (!conf->unexpanded_config)
3375                 return true;
3376
3377         while (*lstart) {
3378                 lend = strchr(lstart, '\n');
3379                 if (!lend)
3380                         lend = lstart + strlen(lstart);
3381                 else
3382                         lend++;
3383
3384                 if (!strnequal(lstart, key, strlen(key)))
3385                         goto next;
3386
3387                 p = strchr(lstart + strlen(key), '=');
3388                 if (!p)
3389                         goto next;
3390                 p++;
3391
3392                 while (isblank(*p))
3393                         p++;
3394
3395                 if (p >= lend)
3396                         goto next;
3397
3398                 /* Whenever a lxc.mount.entry entry is found in a line we check
3399                 *  if the substring "overlay" is present before doing any
3400                 *  further work. We check for "overlay" because substrings need
3401                 *  to have at least one space before them in a valid overlay
3402                 *  lxc.mount.entry (/A B overlay).  When the space before is
3403                 *  missing it is very likely that these substrings are part of a
3404                 *  path or something else. (Checking q >= lend ensures that we
3405                 *  only count matches in the current line.) */
3406                 q = strstr(p, " overlay");
3407                 if (!q || q >= lend)
3408                         goto next;
3409
3410                 if (!(q = strstr(p, olddir)) || (q >= lend))
3411                         goto next;
3412
3413                 /* replace the olddir with newdir */
3414                 if (olddirlen >= newdirlen) {
3415                         size_t diff = olddirlen - newdirlen;
3416                         memcpy(q, newdir, newdirlen);
3417
3418                         if (olddirlen != newdirlen) {
3419                                 memmove(q + newdirlen, q + newdirlen + diff,
3420                                         strlen(q) - newdirlen - diff + 1);
3421                                 lend -= diff;
3422                                 conf->unexpanded_len -= diff;
3423                         }
3424                 } else {
3425                         char *new;
3426                         size_t diff = newdirlen - olddirlen;
3427                         size_t oldlen = conf->unexpanded_len;
3428                         size_t newlen = oldlen + diff;
3429                         size_t poffset = q - conf->unexpanded_config;
3430
3431                         new = realloc(conf->unexpanded_config, newlen + 1);
3432                         if (!new)
3433                                 return false;
3434
3435                         conf->unexpanded_len = newlen;
3436                         conf->unexpanded_alloced = newlen + 1;
3437                         new[newlen - 1] = '\0';
3438                         lend = new + (lend - conf->unexpanded_config);
3439
3440                         /* Move over the remainder to make room for the newdir.
3441                          */
3442                         memmove(new + poffset + newdirlen,
3443                                 new + poffset + olddirlen,
3444                                 oldlen - poffset - olddirlen + 1);
3445                         conf->unexpanded_config = new;
3446
3447                         memcpy(new + poffset, newdir, newdirlen);
3448                         lend += diff;
3449                 }
3450
3451         next:
3452                 lstart = lend;
3453         }
3454
3455         return true;
3456 }
3457
3458 bool clone_update_unexp_hooks(struct lxc_conf *conf, const char *oldpath,
3459                               const char *newpath, const char *oldname,
3460                               const char *newname)
3461 {
3462         __do_free char *newdir = NULL, *olddir = NULL;
3463         char *lstart = conf->unexpanded_config;
3464         const char *key = "lxc.hook";
3465         int ret;
3466         char *lend, *p;
3467         size_t newdirlen, olddirlen;
3468
3469         olddirlen = strlen(oldpath) + strlen(oldname) + 1;
3470         olddir = must_realloc(NULL, olddirlen + 1);
3471         ret = strnprintf(olddir, olddirlen + 1, "%s/%s", oldpath, oldname);
3472         if (ret < 0)
3473                 return false;
3474
3475         newdirlen = strlen(newpath) + strlen(newname) + 1;
3476         newdir = must_realloc(NULL, newdirlen + 1);
3477         ret = strnprintf(newdir, newdirlen + 1, "%s/%s", newpath, newname);
3478         if (ret < 0)
3479                 return false;
3480
3481         if (!conf->unexpanded_config)
3482                 return true;
3483
3484         while (*lstart) {
3485                 lend = strchr(lstart, '\n');
3486                 if (!lend)
3487                         lend = lstart + strlen(lstart);
3488                 else
3489                         lend++;
3490
3491                 if (!strnequal(lstart, key, strlen(key)))
3492                         goto next;
3493
3494                 p = strchr(lstart + strlen(key), '=');
3495                 if (!p)
3496                         goto next;
3497                 p++;
3498
3499                 while (isblank(*p))
3500                         p++;
3501
3502                 if (p >= lend)
3503                         goto next;
3504
3505                 if (!strnequal(p, olddir, strlen(olddir)))
3506                         goto next;
3507
3508                 /* replace the olddir with newdir */
3509                 if (olddirlen >= newdirlen) {
3510                         size_t diff = olddirlen - newdirlen;
3511                         memcpy(p, newdir, newdirlen);
3512
3513                         if (olddirlen != newdirlen) {
3514                                 memmove(p + newdirlen, p + newdirlen + diff,
3515                                         strlen(p) - newdirlen - diff + 1);
3516                                 lend -= diff;
3517                                 conf->unexpanded_len -= diff;
3518                         }
3519                 } else {
3520                         char *new;
3521                         size_t diff = newdirlen - olddirlen;
3522                         size_t oldlen = conf->unexpanded_len;
3523                         size_t newlen = oldlen + diff;
3524                         size_t poffset = p - conf->unexpanded_config;
3525
3526                         new = realloc(conf->unexpanded_config, newlen + 1);
3527                         if (!new)
3528                                 return false;
3529
3530                         conf->unexpanded_len = newlen;
3531                         conf->unexpanded_alloced = newlen + 1;
3532                         new[newlen - 1] = '\0';
3533                         lend = new + (lend - conf->unexpanded_config);
3534
3535                         /* Move over the remainder to make room for the newdir.
3536                          */
3537                         memmove(new + poffset + newdirlen,
3538                                 new + poffset + olddirlen,
3539                                 oldlen - poffset - olddirlen + 1);
3540                         conf->unexpanded_config = new;
3541
3542                         memcpy(new + poffset, newdir, newdirlen);
3543                         lend += diff;
3544                 }
3545
3546         next:
3547                 lstart = lend;
3548         }
3549
3550         return true;
3551 }
3552
3553 #define DO(cmd)                                                                \
3554         {                                                                      \
3555                 if (!(cmd)) {                                                  \
3556                         ERROR("Error writing to new config");                  \
3557                         return false;                                          \
3558                 }                                                              \
3559         }
3560
3561 /* This is called only from clone.  We wish to update all hwaddrs in the
3562  * unexpanded config file. We can't/don't want to update any which come from
3563  * lxc.includes (there shouldn't be any).
3564  * We can't just walk the c->lxc-conf->network list because that includes netifs
3565  * from the include files.  So we update the ones which we find in the unexp
3566  * config file, then find the original macaddr in the conf->network, and update
3567  * that to the same value.
3568  */
3569 bool network_new_hwaddrs(struct lxc_conf *conf)
3570 {
3571         char *lend, *p, *p2;
3572         char *lstart = conf->unexpanded_config;
3573
3574         if (!conf->unexpanded_config)
3575                 return true;
3576
3577         while (*lstart) {
3578                 char newhwaddr[18], oldhwaddr[17];
3579                 struct lxc_netdev *netdev;
3580
3581                 lend = strchr(lstart, '\n');
3582                 if (!lend)
3583                         lend = lstart + strlen(lstart);
3584                 else
3585                         lend++;
3586
3587                 if (!lxc_config_net_is_hwaddr(lstart)) {
3588                         lstart = lend;
3589                         continue;
3590                 }
3591
3592                 p = strchr(lstart, '=');
3593                 if (!p) {
3594                         lstart = lend;
3595                         continue;
3596                 }
3597
3598                 p++;
3599                 while (isblank(*p))
3600                         p++;
3601                 if (!*p)
3602                         return true;
3603
3604                 p2 = p;
3605                 while (*p2 && !isblank(*p2) && *p2 != '\n')
3606                         p2++;
3607
3608                 if ((p2 - p) != 17) {
3609                         WARN("Bad hwaddr entry");
3610                         lstart = lend;
3611                         continue;
3612                 }
3613
3614                 memcpy(oldhwaddr, p, 17);
3615
3616                 if (!new_hwaddr(newhwaddr))
3617                         return false;
3618
3619                 memcpy(p, newhwaddr, 17);
3620                 list_for_each_entry(netdev, &conf->netdevs, head) {
3621                         if (netdev->hwaddr && memcmp(oldhwaddr, netdev->hwaddr, 17) == 0)
3622                                 memcpy(netdev->hwaddr, newhwaddr, 17);
3623                 }
3624
3625                 lstart = lend;
3626         }
3627
3628         return true;
3629 }
3630
3631 static int set_config_ephemeral(const char *key, const char *value,
3632                                 struct lxc_conf *lxc_conf, void *data)
3633 {
3634         int ret;
3635
3636         if (lxc_config_value_empty(value)) {
3637                 lxc_conf->ephemeral = 0;
3638                 return 0;
3639         }
3640
3641         ret = lxc_safe_uint(value, &lxc_conf->ephemeral);
3642         if (ret < 0)
3643                 return ret;
3644
3645         if (lxc_conf->ephemeral > 1)
3646                 return ret_errno(EINVAL);
3647
3648         return 0;
3649 }
3650
3651 static int set_config_log_syslog(const char *key, const char *value,
3652                              struct lxc_conf *lxc_conf, void *data)
3653 {
3654         int facility;
3655
3656         if (lxc_conf->syslog)
3657                 free_disarm(lxc_conf->syslog);
3658
3659         if (lxc_config_value_empty(value))
3660                 return 0;
3661
3662         facility = lxc_syslog_priority_to_int(value);
3663         if (facility == -EINVAL)
3664                 return ret_errno(EINVAL);
3665
3666         lxc_log_syslog(facility);
3667
3668         return set_config_string_item(&lxc_conf->syslog, value);
3669 }
3670
3671 static int set_config_no_new_privs(const char *key, const char *value,
3672                                    struct lxc_conf *lxc_conf, void *data)
3673 {
3674         int ret;
3675         unsigned int v;
3676
3677         if (lxc_config_value_empty(value)) {
3678                 lxc_conf->no_new_privs = false;
3679                 return 0;
3680         }
3681
3682         ret = lxc_safe_uint(value, &v);
3683         if (ret < 0)
3684                 return ret;
3685
3686         if (v > 1)
3687                 return ret_errno(EINVAL);
3688
3689         lxc_conf->no_new_privs = v ? true : false;
3690
3691         return 0;
3692 }
3693
3694 /* Callbacks to get configuration items. */
3695 static int get_config_personality(const char *key, char *retv, int inlen,
3696                                   struct lxc_conf *c, void *data)
3697 {
3698         int fulllen = 0;
3699
3700         if (!retv)
3701                 inlen = 0;
3702         else
3703                 memset(retv, 0, inlen);
3704
3705         int len = 0;
3706
3707         switch (c->personality) {
3708         case PER_LINUX32:
3709                 strprint(retv, inlen, "i686");
3710                 break;
3711         case PER_LINUX:
3712                 strprint(retv, inlen, "x86_64");
3713                 break;
3714         default:
3715                 break;
3716         }
3717
3718         return fulllen;
3719 }
3720
3721 static int get_config_pty_max(const char *key, char *retv, int inlen,
3722                               struct lxc_conf *c, void *data)
3723 {
3724         return lxc_get_conf_size_t(c, retv, inlen, c->pty_max);
3725 }
3726
3727 static int get_config_tty_max(const char *key, char *retv, int inlen,
3728                               struct lxc_conf *c, void *data)
3729 {
3730         return lxc_get_conf_size_t(c, retv, inlen, c->ttys.max);
3731 }
3732
3733 static int get_config_tty_dir(const char *key, char *retv, int inlen,
3734                              struct lxc_conf *c, void *data)
3735 {
3736         return lxc_get_conf_str(retv, inlen, c->ttys.dir);
3737 }
3738
3739 static int get_config_apparmor_profile(const char *key, char *retv, int inlen,
3740                                        struct lxc_conf *c, void *data)
3741 {
3742 #if HAVE_APPARMOR
3743         return lxc_get_conf_str(retv, inlen, c->lsm_aa_profile);
3744 #else
3745         return syserror_set(-EINVAL, "Built without AppArmor support");
3746 #endif
3747 }
3748
3749 static int get_config_apparmor_allow_incomplete(const char *key, char *retv,
3750                                                 int inlen, struct lxc_conf *c,
3751                                                 void *data)
3752 {
3753 #if HAVE_APPARMOR
3754         return lxc_get_conf_int(c, retv, inlen, c->lsm_aa_allow_incomplete);
3755 #else
3756         return syserror_set(-EINVAL, "Built without AppArmor support");
3757 #endif
3758 }
3759
3760 static int get_config_apparmor_allow_nesting(const char *key, char *retv,
3761                                              int inlen, struct lxc_conf *c,
3762                                              void *data)
3763 {
3764 #if HAVE_APPARMOR
3765         return lxc_get_conf_int(c, retv, inlen, c->lsm_aa_allow_nesting);
3766 #else
3767         return syserror_set(-EINVAL, "Built without AppArmor support");
3768 #endif
3769 }
3770
3771 static int get_config_apparmor_raw(const char *key, char *retv,
3772                                    int inlen, struct lxc_conf *c,
3773                                    void *data)
3774 {
3775 #if HAVE_APPARMOR
3776         int len;
3777         struct lxc_list *it;
3778         int fulllen = 0;
3779
3780         if (!retv)
3781                 inlen = 0;
3782         else
3783                 memset(retv, 0, inlen);
3784
3785         lxc_list_for_each(it, &c->lsm_aa_raw) {
3786                 strprint(retv, inlen, "%s\n", (char *)it->elem);
3787         }
3788
3789         return fulllen;
3790 #else
3791         return syserror_set(-EINVAL, "Built without AppArmor support");
3792 #endif
3793 }
3794
3795 static int get_config_selinux_context(const char *key, char *retv, int inlen,
3796                                       struct lxc_conf *c, void *data)
3797 {
3798 #if HAVE_SELINUX
3799         return lxc_get_conf_str(retv, inlen, c->lsm_se_context);
3800 #else
3801         return syserror_set(-EINVAL, "Built without SELinux support");
3802 #endif
3803 }
3804
3805 static int get_config_selinux_context_keyring(const char *key, char *retv, int inlen,
3806                                               struct lxc_conf *c, void *data)
3807 {
3808 #if HAVE_SELINUX
3809         return lxc_get_conf_str(retv, inlen, c->lsm_se_keyring_context);
3810 #else
3811         return syserror_set(-EINVAL, "Built without SELinux support");
3812 #endif
3813 }
3814
3815 static int get_config_keyring_session(const char *key, char *retv, int inlen,
3816                                       struct lxc_conf *c, void *data)
3817 {
3818         return lxc_get_conf_bool(c, retv, inlen, c->keyring_disable_session);
3819 }
3820
3821
3822 /* If you ask for a specific cgroup value, i.e. lxc.cgroup.devices.list, then
3823  * just the value(s) will be printed. Since there still could be more than one,
3824  * it is newline-separated.
3825  * (Maybe that's ambiguous, since some values, i.e. devices.list, will already
3826  * have newlines?)
3827  * If you ask for 'lxc.cgroup", then all cgroup entries will be printed, in
3828  * 'lxc.cgroup.subsystem.key = value' format.
3829  */
3830 static int __get_config_cgroup_controller(const char *key, char *retv,
3831                                           int inlen, struct lxc_conf *c,
3832                                           int version)
3833 {
3834         int fulllen = 0;
3835         bool get_all = false;
3836         int len;
3837         size_t namespaced_token_len;
3838         char *global_token, *namespaced_token;
3839         struct list_head *list;
3840         struct lxc_cgroup *cgroup;
3841
3842         if (!retv)
3843                 inlen = 0;
3844         else
3845                 memset(retv, 0, inlen);
3846
3847         if (version == CGROUP2_SUPER_MAGIC) {
3848                 global_token = "lxc.cgroup2";
3849                 namespaced_token = "lxc.cgroup2.";
3850                 namespaced_token_len = STRLITERALLEN("lxc.cgroup2.");
3851                 list = &c->cgroup2;
3852         } else if (version == CGROUP_SUPER_MAGIC) {
3853                 global_token = "lxc.cgroup";
3854                 namespaced_token = "lxc.cgroup.";
3855                 namespaced_token_len = STRLITERALLEN("lxc.cgroup.");
3856                 list = &c->cgroup;
3857         } else {
3858                 return ret_errno(EINVAL);
3859         }
3860
3861         if (strequal(key, global_token))
3862                 get_all = true;
3863         else if (strnequal(key, namespaced_token, namespaced_token_len))
3864                 key += namespaced_token_len;
3865         else
3866                 return ret_errno(EINVAL);
3867
3868         list_for_each_entry(cgroup, list, head) {
3869                 if (get_all) {
3870                         if (version != cgroup->version)
3871                                 continue;
3872
3873                         strprint(retv, inlen, "%s.%s = %s\n", global_token,
3874                                  cgroup->subsystem, cgroup->value);
3875                 } else if (strequal(cgroup->subsystem, key)) {
3876                         strprint(retv, inlen, "%s\n", cgroup->value);
3877                 }
3878         }
3879
3880         return fulllen;
3881 }
3882
3883 static int get_config_cgroup_controller(const char *key, char *retv, int inlen,
3884                                         struct lxc_conf *c, void *data)
3885 {
3886         return __get_config_cgroup_controller(key, retv, inlen, c,
3887                                               CGROUP_SUPER_MAGIC);
3888 }
3889
3890 static int get_config_cgroup2_controller(const char *key, char *retv, int inlen,
3891                                          struct lxc_conf *c, void *data)
3892 {
3893         return __get_config_cgroup_controller(key, retv, inlen, c,
3894                                               CGROUP2_SUPER_MAGIC);
3895 }
3896
3897 static int get_config_cgroup_dir(const char *key, char *retv, int inlen,
3898                                  struct lxc_conf *lxc_conf, void *data)
3899 {
3900         int len;
3901         int fulllen = 0;
3902
3903         if (!strequal(key, "lxc.cgroup.dir"))
3904                 return ret_errno(EINVAL);
3905
3906         if (!retv)
3907                 inlen = 0;
3908         else
3909                 memset(retv, 0, inlen);
3910
3911         strprint(retv, inlen, "%s", lxc_conf->cgroup_meta.dir);
3912
3913         return fulllen;
3914 }
3915
3916 static int get_config_cgroup_monitor_dir(const char *key, char *retv, int inlen,
3917                                          struct lxc_conf *lxc_conf, void *data)
3918 {
3919         int len;
3920         int fulllen = 0;
3921
3922         if (!retv)
3923                 inlen = 0;
3924         else
3925                 memset(retv, 0, inlen);
3926
3927         strprint(retv, inlen, "%s", lxc_conf->cgroup_meta.monitor_dir);
3928
3929         return fulllen;
3930 }
3931
3932 static int get_config_cgroup_monitor_pivot_dir(const char *key, char *retv, int inlen,
3933                                          struct lxc_conf *lxc_conf, void *data)
3934 {
3935         int len;
3936         int fulllen = 0;
3937
3938         if (!retv)
3939                 inlen = 0;
3940         else
3941                 memset(retv, 0, inlen);
3942
3943         strprint(retv, inlen, "%s", lxc_conf->cgroup_meta.monitor_pivot_dir);
3944
3945         return fulllen;
3946 }
3947
3948 static int get_config_cgroup_container_dir(const char *key, char *retv,
3949                                            int inlen,
3950                                            struct lxc_conf *lxc_conf,
3951                                            void *data)
3952 {
3953         int len;
3954         int fulllen = 0;
3955
3956         if (!retv)
3957                 inlen = 0;
3958         else
3959                 memset(retv, 0, inlen);
3960
3961         strprint(retv, inlen, "%s", lxc_conf->cgroup_meta.container_dir);
3962
3963         return fulllen;
3964 }
3965
3966 static int get_config_cgroup_container_inner_dir(const char *key, char *retv,
3967                                                  int inlen,
3968                                                  struct lxc_conf *lxc_conf,
3969                                                  void *data)
3970 {
3971         int len;
3972         int fulllen = 0;
3973
3974         if (!retv)
3975                 inlen = 0;
3976         else
3977                 memset(retv, 0, inlen);
3978
3979         strprint(retv, inlen, "%s", lxc_conf->cgroup_meta.namespace_dir);
3980
3981         return fulllen;
3982 }
3983
3984 static inline int get_config_cgroup_relative(const char *key, char *retv,
3985                                              int inlen, struct lxc_conf *lxc_conf,
3986                                              void *data)
3987 {
3988         return lxc_get_conf_int(lxc_conf, retv, inlen,
3989                                 lxc_conf->cgroup_meta.relative);
3990 }
3991
3992 static int get_config_idmaps(const char *key, char *retv, int inlen,
3993                              struct lxc_conf *c, void *data)
3994 {
3995         struct id_map *map;
3996         int len, listlen, ret;
3997         int fulllen = 0;
3998 /* "u 1000 1000000 65536"
3999  *
4000  * let's render this as
4001  *
4002  * sizeof(char)
4003  * +
4004  * sizeof(" ")
4005  * +
4006  * sizeof(uint32_t)
4007  * +
4008  * sizeof(" ")
4009  * +
4010  * sizeof(uint32_t)
4011  * +
4012  * sizeof(" ")
4013  * +
4014  * sizeof(uint32_t)
4015  * +
4016  * \0
4017  */
4018 #define __LXC_IDMAP_STR_BUF (3 * INTTYPE_TO_STRLEN(uint32_t) + 3 + 1 + 1)
4019         char buf[__LXC_IDMAP_STR_BUF];
4020
4021         if (!retv)
4022                 inlen = 0;
4023         else
4024                 memset(retv, 0, inlen);
4025
4026         listlen = list_len(&c->id_map);
4027         list_for_each_entry(map, &c->id_map, head) {
4028                 ret = strnprintf(buf, sizeof(buf), "%c %lu %lu %lu",
4029                                  (map->idtype == ID_TYPE_UID) ? 'u' : 'g',
4030                                  map->nsid, map->hostid, map->range);
4031                 if (ret < 0)
4032                         return ret_errno(EIO);
4033
4034                 strprint(retv, inlen, "%s%s", buf, (listlen-- > 1) ? "\n" : "");
4035         }
4036
4037         return fulllen;
4038 }
4039
4040 static int get_config_log_level(const char *key, char *retv, int inlen,
4041                                struct lxc_conf *c, void *data)
4042 {
4043         const char *v;
4044         v = lxc_log_priority_to_string(c->loglevel);
4045         return lxc_get_conf_str(retv, inlen, v);
4046 }
4047
4048 static int get_config_log_file(const char *key, char *retv, int inlen,
4049                               struct lxc_conf *c, void *data)
4050 {
4051         return lxc_get_conf_str(retv, inlen, c->logfile);
4052 }
4053
4054 static int get_config_mount_fstab(const char *key, char *retv, int inlen,
4055                                   struct lxc_conf *c, void *data)
4056 {
4057         return lxc_get_conf_str(retv, inlen, c->fstab);
4058 }
4059
4060 static int get_config_mount_auto(const char *key, char *retv, int inlen,
4061                                  struct lxc_conf *c, void *data)
4062 {
4063         int len, fulllen = 0;
4064         const char *sep = "";
4065
4066         if (!retv)
4067                 inlen = 0;
4068         else
4069                 memset(retv, 0, inlen);
4070
4071         if (!(c->auto_mounts & LXC_AUTO_ALL_MASK))
4072                 return 0;
4073
4074         switch (c->auto_mounts & LXC_AUTO_PROC_MASK) {
4075         case LXC_AUTO_PROC_MIXED:
4076                 strprint(retv, inlen, "%sproc:mixed", sep);
4077                 sep = " ";
4078                 break;
4079         case LXC_AUTO_PROC_RW:
4080                 strprint(retv, inlen, "%sproc:rw", sep);
4081                 sep = " ";
4082                 break;
4083         default:
4084                 break;
4085         }
4086
4087         switch (c->auto_mounts & LXC_AUTO_SYS_MASK) {
4088         case LXC_AUTO_SYS_RO:
4089                 strprint(retv, inlen, "%ssys:ro", sep);
4090                 sep = " ";
4091                 break;
4092         case LXC_AUTO_SYS_RW:
4093                 strprint(retv, inlen, "%ssys:rw", sep);
4094                 sep = " ";
4095                 break;
4096         case LXC_AUTO_SYS_MIXED:
4097                 strprint(retv, inlen, "%ssys:mixed", sep);
4098                 sep = " ";
4099                 break;
4100         default:
4101                 break;
4102         }
4103
4104         switch (c->auto_mounts & LXC_AUTO_CGROUP_MASK) {
4105         case LXC_AUTO_CGROUP_NOSPEC:
4106                 strprint(retv, inlen, "%scgroup", sep);
4107                 break;
4108         case LXC_AUTO_CGROUP_MIXED:
4109                 strprint(retv, inlen, "%scgroup:mixed", sep);
4110                 break;
4111         case LXC_AUTO_CGROUP_RO:
4112                 strprint(retv, inlen, "%scgroup:ro", sep);
4113                 break;
4114         case LXC_AUTO_CGROUP_RW:
4115                 strprint(retv, inlen, "%scgroup:rw", sep);
4116                 break;
4117         case LXC_AUTO_CGROUP_FULL_NOSPEC:
4118                 strprint(retv, inlen, "%scgroup-full", sep);
4119                 break;
4120         case LXC_AUTO_CGROUP_FULL_MIXED:
4121                 strprint(retv, inlen, "%scgroup-full:mixed", sep);
4122                 break;
4123         case LXC_AUTO_CGROUP_FULL_RO:
4124                 strprint(retv, inlen, "%scgroup-full:ro", sep);
4125                 break;
4126         case LXC_AUTO_CGROUP_FULL_RW:
4127                 strprint(retv, inlen, "%scgroup-full:rw", sep);
4128                 break;
4129         default:
4130                 break;
4131         }
4132
4133         return fulllen;
4134 }
4135
4136 static int get_config_mount(const char *key, char *retv, int inlen,
4137                             struct lxc_conf *c, void *data)
4138 {
4139         int len, fulllen = 0;
4140         struct string_entry *entry;
4141
4142         if (!retv)
4143                 inlen = 0;
4144         else
4145                 memset(retv, 0, inlen);
4146
4147         list_for_each_entry(entry, &c->mount_entries, head) {
4148                 strprint(retv, inlen, "%s\n", entry->val);
4149         }
4150
4151         return fulllen;
4152 }
4153
4154 static int get_config_rootfs_path(const char *key, char *retv, int inlen,
4155                                   struct lxc_conf *c, void *data)
4156 {
4157         return lxc_get_conf_str(retv, inlen, c->rootfs.path);
4158 }
4159
4160 static int get_config_rootfs_managed(const char *key, char *retv, int inlen,
4161                                      struct lxc_conf *c, void *data)
4162 {
4163         return lxc_get_conf_bool(c, retv, inlen, c->rootfs.managed);
4164 }
4165
4166 static int get_config_rootfs_mount(const char *key, char *retv, int inlen,
4167                                    struct lxc_conf *c, void *data)
4168 {
4169         return lxc_get_conf_str(retv, inlen, c->rootfs.mount);
4170 }
4171
4172 static int get_config_rootfs_options(const char *key, char *retv, int inlen,
4173                                      struct lxc_conf *c, void *data)
4174 {
4175         return lxc_get_conf_str(retv, inlen, c->rootfs.mnt_opts.raw_options);
4176 }
4177
4178 static int get_config_uts_name(const char *key, char *retv, int inlen,
4179                               struct lxc_conf *c, void *data)
4180 {
4181         return lxc_get_conf_str(
4182             retv, inlen,
4183             c->utsname ? c->utsname->nodename : NULL);
4184 }
4185
4186 static int get_config_hooks(const char *key, char *retv, int inlen,
4187                             struct lxc_conf *c, void *data)
4188 {
4189         char *subkey;
4190         int len, fulllen = 0, found = -1;
4191         struct lxc_list *it;
4192         int i;
4193
4194         subkey = strchr(key, '.');
4195         if (!subkey)
4196                 return ret_errno(EINVAL);
4197
4198         subkey = strchr(subkey + 1, '.');
4199         if (!subkey)
4200                 return ret_errno(EINVAL);
4201         subkey++;
4202         if (*subkey == '\0')
4203                 return ret_errno(EINVAL);
4204
4205         for (i = 0; i < NUM_LXC_HOOKS; i++) {
4206                 if (strequal(lxchook_names[i], subkey)) {
4207                         found = i;
4208                         break;
4209                 }
4210         }
4211
4212         if (found == -1)
4213                 return ret_errno(EINVAL);
4214
4215         if (!retv)
4216                 inlen = 0;
4217         else
4218                 memset(retv, 0, inlen);
4219
4220         lxc_list_for_each(it, &c->hooks[found]) {
4221                 strprint(retv, inlen, "%s\n", (char *)it->elem);
4222         }
4223
4224         return fulllen;
4225 }
4226
4227 static int get_config_hooks_version(const char *key, char *retv, int inlen,
4228                                     struct lxc_conf *c, void *data)
4229 {
4230         return lxc_get_conf_int(c, retv, inlen, c->hooks_version);
4231 }
4232
4233 static int get_config_net(const char *key, char *retv, int inlen,
4234                           struct lxc_conf *c, void *data)
4235 {
4236         int len, fulllen = 0;
4237         struct lxc_netdev *netdev;
4238
4239         if (!retv)
4240                 inlen = 0;
4241         else
4242                 memset(retv, 0, inlen);
4243
4244         list_for_each_entry(netdev, &c->netdevs, head) {
4245                 const char *t = lxc_net_type_to_str(netdev->type);
4246                 strprint(retv, inlen, "%s\n", t ? t : "(invalid)");
4247         }
4248
4249         return fulllen;
4250 }
4251
4252 static int get_config_cap_drop(const char *key, char *retv, int inlen,
4253                                struct lxc_conf *c, void *data)
4254 {
4255         int len, fulllen = 0;
4256         struct cap_entry *cap;
4257
4258         if (!retv)
4259                 inlen = 0;
4260         else
4261                 memset(retv, 0, inlen);
4262
4263         list_for_each_entry(cap, &c->caps.list, head) {
4264                 strprint(retv, inlen, "%s\n", cap->cap_name);
4265         }
4266
4267         return fulllen;
4268 }
4269
4270 static int get_config_cap_keep(const char *key, char *retv, int inlen,
4271                                struct lxc_conf *c, void *data)
4272 {
4273         int len, fulllen = 0;
4274         struct cap_entry *cap;
4275
4276         if (!retv)
4277                 inlen = 0;
4278         else
4279                 memset(retv, 0, inlen);
4280
4281         list_for_each_entry(cap, &c->caps.list, head) {
4282                 strprint(retv, inlen, "%s\n", cap->cap_name);
4283         }
4284
4285         return fulllen;
4286 }
4287
4288 static int get_config_console_path(const char *key, char *retv, int inlen,
4289                                    struct lxc_conf *c, void *data)
4290 {
4291         return lxc_get_conf_str(retv, inlen, c->console.path);
4292 }
4293
4294 static int get_config_console_logfile(const char *key, char *retv, int inlen,
4295                                       struct lxc_conf *c, void *data)
4296 {
4297         return lxc_get_conf_str(retv, inlen, c->console.log_path);
4298 }
4299
4300 static int get_config_console_rotate(const char *key, char *retv, int inlen,
4301                                      struct lxc_conf *c, void *data)
4302 {
4303         return lxc_get_conf_int(c, retv, inlen, c->console.log_rotate);
4304 }
4305
4306
4307 static int get_config_console_buffer_size(const char *key, char *retv,
4308                                           int inlen, struct lxc_conf *c,
4309                                           void *data)
4310 {
4311         return lxc_get_conf_uint64(c, retv, inlen, c->console.buffer_size);
4312 }
4313
4314 static int get_config_console_size(const char *key, char *retv, int inlen,
4315                                    struct lxc_conf *c, void *data)
4316 {
4317         return lxc_get_conf_uint64(c, retv, inlen, c->console.log_size);
4318 }
4319
4320 static int get_config_seccomp_allow_nesting(const char *key, char *retv,
4321                                             int inlen, struct lxc_conf *c,
4322                                             void *data)
4323 {
4324 #ifdef HAVE_SECCOMP
4325         return lxc_get_conf_int(c, retv, inlen, c->seccomp.allow_nesting);
4326 #else
4327         return ret_errno(ENOSYS);
4328 #endif
4329 }
4330
4331 static int get_config_seccomp_notify_cookie(const char *key, char *retv, int inlen,
4332                                             struct lxc_conf *c, void *data)
4333 {
4334 #ifdef HAVE_SECCOMP_NOTIFY
4335         return lxc_get_conf_str(retv, inlen, c->seccomp.notifier.cookie);
4336 #else
4337         return ret_errno(ENOSYS);
4338 #endif
4339 }
4340
4341 static int get_config_seccomp_notify_proxy(const char *key, char *retv, int inlen,
4342                                            struct lxc_conf *c, void *data)
4343 {
4344 #ifdef HAVE_SECCOMP_NOTIFY
4345         return lxc_get_conf_str(retv, inlen,
4346                                 (c->seccomp.notifier.proxy_addr.sun_path[0]) == '/'
4347                                     ? &c->seccomp.notifier.proxy_addr.sun_path[0]
4348                                     : &c->seccomp.notifier.proxy_addr.sun_path[1]);
4349 #else
4350         return ret_errno(ENOSYS);
4351 #endif
4352 }
4353
4354 static int get_config_seccomp_profile(const char *key, char *retv, int inlen,
4355                                       struct lxc_conf *c, void *data)
4356 {
4357 #ifdef HAVE_SECCOMP
4358         return lxc_get_conf_str(retv, inlen, c->seccomp.seccomp);
4359 #else
4360         return ret_errno(ENOSYS);
4361 #endif
4362 }
4363
4364 static int get_config_autodev(const char *key, char *retv, int inlen,
4365                               struct lxc_conf *c, void *data)
4366 {
4367         return lxc_get_conf_int(c, retv, inlen, c->autodev);
4368 }
4369
4370 static int get_config_autodev_tmpfs_size(const char *key, char *retv, int inlen,
4371                               struct lxc_conf *c, void *data)
4372 {
4373         return lxc_get_conf_int(c, retv, inlen, c->autodevtmpfssize);
4374 }
4375
4376 static int get_config_signal_halt(const char *key, char *retv, int inlen,
4377                                   struct lxc_conf *c, void *data)
4378 {
4379         return lxc_get_conf_int(c, retv, inlen, c->haltsignal);
4380 }
4381
4382 static int get_config_signal_reboot(const char *key, char *retv, int inlen,
4383                                     struct lxc_conf *c, void *data)
4384 {
4385         return lxc_get_conf_int(c, retv, inlen, c->rebootsignal);
4386 }
4387
4388 static int get_config_signal_stop(const char *key, char *retv, int inlen,
4389                                   struct lxc_conf *c, void *data)
4390 {
4391         return lxc_get_conf_int(c, retv, inlen, c->stopsignal);
4392 }
4393
4394 static int get_config_start(const char *key, char *retv, int inlen,
4395                             struct lxc_conf *c, void *data)
4396 {
4397         if (strequal(key + 10, "auto"))
4398                 return lxc_get_conf_int(c, retv, inlen, c->start_auto);
4399         else if (strequal(key + 10, "delay"))
4400                 return lxc_get_conf_int(c, retv, inlen, c->start_delay);
4401         else if (strequal(key + 10, "order"))
4402                 return lxc_get_conf_int(c, retv, inlen, c->start_order);
4403
4404         return ret_errno(EINVAL);
4405 }
4406
4407 static int get_config_log_syslog(const char *key, char *retv, int inlen,
4408                                  struct lxc_conf *c, void *data)
4409 {
4410         return lxc_get_conf_str(retv, inlen, c->syslog);
4411 }
4412
4413 static int get_config_monitor(const char *key, char *retv, int inlen,
4414                               struct lxc_conf *c, void *data)
4415 {
4416         return lxc_get_conf_int(c, retv, inlen, c->monitor_unshare);
4417 }
4418
4419 static int get_config_monitor_signal_pdeath(const char *key, char *retv,
4420                                             int inlen, struct lxc_conf *c,
4421                                             void *data)
4422 {
4423         return lxc_get_conf_int(c, retv, inlen, c->monitor_signal_pdeath);
4424 }
4425
4426 static int get_config_group(const char *key, char *retv, int inlen,
4427                             struct lxc_conf *c, void *data)
4428 {
4429         int len, fulllen = 0;
4430         struct lxc_list *it;
4431
4432         if (!retv)
4433                 inlen = 0;
4434         else
4435                 memset(retv, 0, inlen);
4436
4437         lxc_list_for_each(it, &c->groups) {
4438                 strprint(retv, inlen, "%s\n", (char *)it->elem);
4439         }
4440
4441         return fulllen;
4442 }
4443
4444 static int get_config_environment(const char *key, char *retv, int inlen,
4445                                   struct lxc_conf *c, void *data)
4446 {
4447         int len, fulllen = 0;
4448         struct environment_entry *env;
4449
4450         if (!retv)
4451                 inlen = 0;
4452         else
4453                 memset(retv, 0, inlen);
4454
4455         list_for_each_entry(env, &c->environment, head) {
4456                 strprint(retv, inlen, "%s=%s\n", env->key, env->val);
4457         }
4458
4459         return fulllen;
4460 }
4461
4462 static int get_config_execute_cmd(const char *key, char *retv, int inlen,
4463                                struct lxc_conf *c, void *data)
4464 {
4465         return lxc_get_conf_str(retv, inlen, c->execute_cmd);
4466 }
4467
4468 static int get_config_init_cmd(const char *key, char *retv, int inlen,
4469                                struct lxc_conf *c, void *data)
4470 {
4471         return lxc_get_conf_str(retv, inlen, c->init_cmd);
4472 }
4473
4474 static int get_config_init_cwd(const char *key, char *retv, int inlen,
4475                                struct lxc_conf *c, void *data)
4476 {
4477         return lxc_get_conf_str(retv, inlen, c->init_cwd);
4478 }
4479
4480 static int get_config_init_uid(const char *key, char *retv, int inlen,
4481                                struct lxc_conf *c, void *data)
4482 {
4483         return lxc_get_conf_int(c, retv, inlen, c->init_uid);
4484 }
4485
4486 static int get_config_init_gid(const char *key, char *retv, int inlen,
4487                                struct lxc_conf *c, void *data)
4488 {
4489         return lxc_get_conf_int(c, retv, inlen, c->init_gid);
4490 }
4491
4492 static int get_config_init_groups(const char *key, char *retv, int inlen,
4493                                   struct lxc_conf *c, void *data)
4494 {
4495         int fulllen = 0, len;
4496
4497         if (!retv)
4498                 inlen = 0;
4499         else
4500                 memset(retv, 0, inlen);
4501
4502         if (c->init_groups.size == 0)
4503                 return 0;
4504
4505         for (int i = 0; i < c->init_groups.size; i++)
4506                 strprint(retv, inlen, "%s%d", (i > 0) ? "," : "",
4507                          c->init_groups.list[i]);
4508
4509         return fulllen;
4510 }
4511
4512 static int get_config_ephemeral(const char *key, char *retv, int inlen,
4513                                 struct lxc_conf *c, void *data)
4514 {
4515         return lxc_get_conf_int(c, retv, inlen, c->ephemeral);
4516 }
4517
4518 static int get_config_no_new_privs(const char *key, char *retv, int inlen,
4519                                    struct lxc_conf *c, void *data)
4520 {
4521         return lxc_get_conf_int(c, retv, inlen, c->no_new_privs);
4522 }
4523
4524 /* If you ask for a specific value, i.e. lxc.prlimit.nofile, then just the value
4525  * will be printed. If you ask for 'lxc.prlimit', then all limit entries will be
4526  * printed, in 'lxc.prlimit.resource = value' format.
4527  */
4528 static int get_config_prlimit(const char *key, char *retv, int inlen,
4529                               struct lxc_conf *c, void *data)
4530 {
4531         int fulllen = 0, len;
4532         bool get_all = false;
4533         struct lxc_limit *lim;
4534
4535         if (!retv)
4536                 inlen = 0;
4537         else
4538                 memset(retv, 0, inlen);
4539
4540         if (strequal(key, "lxc.prlimit"))
4541                 get_all = true;
4542         else if (strnequal(key, "lxc.prlimit.", 12))
4543                 key += 12;
4544         else
4545                 return ret_errno(EINVAL);
4546
4547         list_for_each_entry(lim, &c->limits, head) {
4548                 /* 2 colon separated 64 bit integers or the word 'unlimited' */
4549                 char buf[INTTYPE_TO_STRLEN(uint64_t) * 2 + 2];
4550                 int partlen;
4551
4552                 if (lim->limit.rlim_cur == RLIM_INFINITY) {
4553                         memcpy(buf, "unlimited", STRLITERALLEN("unlimited") + 1);
4554                         partlen = STRLITERALLEN("unlimited");
4555                 } else {
4556                         partlen = sprintf(buf, "%" PRIu64,
4557                                           (uint64_t)lim->limit.rlim_cur);
4558                 }
4559
4560                 if (lim->limit.rlim_cur != lim->limit.rlim_max) {
4561                         if (lim->limit.rlim_max == RLIM_INFINITY)
4562                                 memcpy(buf + partlen, ":unlimited",
4563                                        STRLITERALLEN(":unlimited") + 1);
4564                         else
4565                                 sprintf(buf + partlen, ":%" PRIu64,
4566                                         (uint64_t)lim->limit.rlim_max);
4567                 }
4568
4569                 if (get_all) {
4570                         strprint(retv, inlen, "lxc.prlimit.%s = %s\n",
4571                                  lim->resource, buf);
4572                 } else if (strequal(lim->resource, key)) {
4573                         strprint(retv, inlen, "%s", buf);
4574                 }
4575         }
4576
4577         return fulllen;
4578 }
4579
4580 /* If you ask for a specific value, i.e. lxc.sysctl.net.ipv4.ip_forward, then
4581  * just the value will be printed. If you ask for 'lxc.sysctl', then all sysctl
4582  * entries will be printed, in 'lxc.sysctl.key = value' format.
4583  */
4584 static int get_config_sysctl(const char *key, char *retv, int inlen,
4585                              struct lxc_conf *c, void *data)
4586 {
4587         int fulllen = 0;
4588         bool get_all = false;
4589         int len;
4590         struct lxc_sysctl *sysctl;
4591
4592         if (!retv)
4593                 inlen = 0;
4594         else
4595                 memset(retv, 0, inlen);
4596
4597         if (strequal(key, "lxc.sysctl"))
4598                 get_all = true;
4599         else if (strnequal(key, "lxc.sysctl.", STRLITERALLEN("lxc.sysctl.")))
4600                 key += STRLITERALLEN("lxc.sysctl.");
4601         else
4602                 return ret_errno(EINVAL);
4603
4604         list_for_each_entry(sysctl, &c->sysctls, head) {
4605                 if (get_all) {
4606                         strprint(retv, inlen, "lxc.sysctl.%s = %s\n", sysctl->key,
4607                                  sysctl->value);
4608                 } else if (strequal(sysctl->key, key)) {
4609                         strprint(retv, inlen, "%s", sysctl->value);
4610                 }
4611         }
4612
4613         return fulllen;
4614 }
4615
4616 static int get_config_proc(const char *key, char *retv, int inlen,
4617                            struct lxc_conf *c, void *data)
4618 {
4619         int fulllen = 0;
4620         bool get_all = false;
4621         int len;
4622         struct lxc_proc *proc;
4623
4624         if (!retv)
4625                 inlen = 0;
4626         else
4627                 memset(retv, 0, inlen);
4628
4629         if (strequal(key, "lxc.proc"))
4630                 get_all = true;
4631         else if (strnequal(key, "lxc.proc.", STRLITERALLEN("lxc.proc.")))
4632                 key += STRLITERALLEN("lxc.proc.");
4633         else
4634                 return ret_errno(EINVAL);
4635
4636         list_for_each_entry(proc, &c->procs, head) {
4637                 if (get_all) {
4638                         strprint(retv, inlen, "lxc.proc.%s = %s\n",
4639                                  proc->filename, proc->value);
4640                 } else if (strequal(proc->filename, key)) {
4641                         strprint(retv, inlen, "%s", proc->value);
4642                 }
4643         }
4644
4645         return fulllen;
4646 }
4647
4648 static int get_config_namespace_clone(const char *key, char *retv, int inlen,
4649                                       struct lxc_conf *c, void *data)
4650 {
4651         int i, len;
4652         int fulllen = 0;
4653
4654         if (!retv)
4655                 inlen = 0;
4656         else
4657                 memset(retv, 0, inlen);
4658
4659         for (i = 0; i < LXC_NS_MAX; i++) {
4660                 if (c->ns_clone & ns_info[i].clone_flag)
4661                         strprint(retv, inlen, "%s\n", ns_info[i].proc_name);
4662         }
4663
4664         return fulllen;
4665 }
4666
4667 static int get_config_namespace_keep(const char *key, char *retv, int inlen,
4668                                      struct lxc_conf *c, void *data)
4669 {
4670         int i, len;
4671         int fulllen = 0;
4672
4673         if (!retv)
4674                 inlen = 0;
4675         else
4676                 memset(retv, 0, inlen);
4677
4678         for (i = 0; i < LXC_NS_MAX; i++) {
4679                 if (c->ns_keep & ns_info[i].clone_flag)
4680                         strprint(retv, inlen, "%s\n", ns_info[i].proc_name);
4681         }
4682
4683         return fulllen;
4684 }
4685
4686 static int get_config_time_offset_boot(const char *key, char *retv, int inlen, struct lxc_conf *c,
4687                                        void *data)
4688 {
4689         int len;
4690         int fulllen = 0;
4691
4692         if (!retv)
4693                 inlen = 0;
4694         else
4695                 memset(retv, 0, inlen);
4696
4697         if (c->timens.s_boot) {
4698                 strprint(retv, inlen, "%" PRId64 " s\n", c->timens.s_boot);
4699         } else {
4700                 strprint(retv, inlen, "%" PRId64 " ns\n", c->timens.ns_boot);
4701         }
4702
4703         return fulllen;
4704 }
4705
4706 static int get_config_time_offset_monotonic(const char *key, char *retv, int inlen,
4707                                             struct lxc_conf *c, void *data)
4708 {
4709         int len;
4710         int fulllen = 0;
4711
4712         if (!retv)
4713                 inlen = 0;
4714         else
4715                 memset(retv, 0, inlen);
4716
4717         if (c->timens.s_monotonic) {
4718                 strprint(retv, inlen, "%" PRId64 "s\n", c->timens.s_monotonic);
4719         } else {
4720                 strprint(retv, inlen, "%" PRId64 "ns\n", c->timens.ns_monotonic);
4721         }
4722
4723         return fulllen;
4724 }
4725
4726 static int get_config_namespace_share(const char *key, char *retv, int inlen,
4727                                       struct lxc_conf *c, void *data)
4728 {
4729         int len, ns_idx;
4730         const char *namespace;
4731         int fulllen = 0;
4732
4733         if (!retv)
4734                 inlen = 0;
4735         else
4736                 memset(retv, 0, inlen);
4737
4738         namespace = key + STRLITERALLEN("lxc.namespace.share.");
4739         if (is_empty_string(namespace))
4740                 return ret_errno(EINVAL);
4741
4742         ns_idx = lxc_namespace_2_ns_idx(namespace);
4743         if (ns_idx < 0)
4744                 return ns_idx;
4745
4746         strprint(retv, inlen, "%s", c->ns_share[ns_idx]);
4747
4748         return fulllen;
4749 }
4750
4751 /* Callbacks to clear config items. */
4752 static inline int clr_config_personality(const char *key, struct lxc_conf *c,
4753                                          void *data)
4754 {
4755         c->personality = -1;
4756         return 0;
4757 }
4758
4759 static inline int clr_config_pty_max(const char *key, struct lxc_conf *c,
4760                                      void *data)
4761 {
4762         c->pty_max = 0;
4763         return 0;
4764 }
4765
4766 static inline int clr_config_tty_max(const char *key, struct lxc_conf *c,
4767                                      void *data)
4768 {
4769         c->ttys.tty = 0;
4770         return 0;
4771 }
4772
4773 static inline int clr_config_tty_dir(const char *key, struct lxc_conf *c,
4774                                     void *data)
4775 {
4776         free_disarm(c->ttys.dir);
4777         return 0;
4778 }
4779
4780 static inline int clr_config_apparmor_profile(const char *key,
4781                                               struct lxc_conf *c, void *data)
4782 {
4783 #if HAVE_APPARMOR
4784         free_disarm(c->lsm_aa_profile);
4785         return 0;
4786 #else
4787         return syserror_set(-EINVAL, "Built without AppArmor support");
4788 #endif
4789 }
4790
4791 static inline int clr_config_apparmor_allow_incomplete(const char *key,
4792                                                        struct lxc_conf *c,
4793                                                        void *data)
4794 {
4795 #if HAVE_APPARMOR
4796         c->lsm_aa_allow_incomplete = 0;
4797         return 0;
4798 #else
4799         return syserror_set(-EINVAL, "Built without AppArmor support");
4800 #endif
4801 }
4802
4803 static inline int clr_config_apparmor_allow_nesting(const char *key,
4804                                                     struct lxc_conf *c,
4805                                                     void *data)
4806 {
4807 #if HAVE_APPARMOR
4808         c->lsm_aa_allow_nesting = 0;
4809         return 0;
4810 #else
4811         return syserror_set(-EINVAL, "Built without AppArmor support");
4812 #endif
4813 }
4814
4815 static inline int clr_config_apparmor_raw(const char *key,
4816                                           struct lxc_conf *c,
4817                                           void *data)
4818 {
4819 #if HAVE_APPARMOR
4820         return lxc_clear_apparmor_raw(c);
4821 #else
4822         return syserror_set(-EINVAL, "Built without AppArmor support");
4823 #endif
4824 }
4825
4826 static inline int clr_config_selinux_context(const char *key,
4827                                              struct lxc_conf *c, void *data)
4828 {
4829 #if HAVE_SELINUX
4830         free_disarm(c->lsm_se_context);
4831         return 0;
4832 #else
4833         return syserror_set(-EINVAL, "Built without SELinux support");
4834 #endif
4835 }
4836
4837 static inline int clr_config_selinux_context_keyring(const char *key,
4838                                                      struct lxc_conf *c, void *data)
4839 {
4840 #if HAVE_SELINUX
4841         free_disarm(c->lsm_se_keyring_context);
4842         return 0;
4843 #else
4844         return syserror_set(-EINVAL, "Built without SELinux support");
4845 #endif
4846 }
4847
4848 static inline int clr_config_keyring_session(const char *key,
4849                                              struct lxc_conf *c, void *data)
4850 {
4851         c->keyring_disable_session = false;
4852         return 0;
4853 }
4854
4855 static inline int clr_config_cgroup_controller(const char *key,
4856                                                struct lxc_conf *c, void *data)
4857 {
4858         return lxc_clear_cgroups(c, key, CGROUP_SUPER_MAGIC);
4859 }
4860
4861 static inline int clr_config_cgroup2_controller(const char *key,
4862                                                 struct lxc_conf *c, void *data)
4863 {
4864         return lxc_clear_cgroups(c, key, CGROUP2_SUPER_MAGIC);
4865 }
4866
4867 static int clr_config_cgroup_dir(const char *key, struct lxc_conf *lxc_conf,
4868                                  void *data)
4869 {
4870         if (!strequal(key, "lxc.cgroup.dir"))
4871                 return ret_errno(EINVAL);
4872
4873         if (lxc_conf->cgroup_meta.dir)
4874                 free_disarm(lxc_conf->cgroup_meta.dir);
4875
4876         return 0;
4877 }
4878
4879 static int clr_config_cgroup_monitor_dir(const char *key,
4880                                          struct lxc_conf *lxc_conf,
4881                                          void *data)
4882 {
4883         free_disarm(lxc_conf->cgroup_meta.monitor_dir);
4884         return 0;
4885 }
4886
4887 static int clr_config_cgroup_monitor_pivot_dir(const char *key,
4888                                          struct lxc_conf *lxc_conf,
4889                                          void *data)
4890 {
4891         free_disarm(lxc_conf->cgroup_meta.monitor_pivot_dir);
4892         return 0;
4893 }
4894
4895 static int clr_config_cgroup_container_dir(const char *key,
4896                                            struct lxc_conf *lxc_conf,
4897                                            void *data)
4898 {
4899         free_disarm(lxc_conf->cgroup_meta.container_dir);
4900         return 0;
4901 }
4902
4903 static int clr_config_cgroup_container_inner_dir(const char *key,
4904                                                  struct lxc_conf *lxc_conf,
4905                                                  void *data)
4906 {
4907         free_disarm(lxc_conf->cgroup_meta.namespace_dir);
4908         return 0;
4909 }
4910
4911 static inline int clr_config_cgroup_relative(const char *key,
4912                                              struct lxc_conf *lxc_conf,
4913                                              void *data)
4914 {
4915         lxc_conf->cgroup_meta.relative = false;
4916         return 0;
4917 }
4918
4919 static inline int clr_config_idmaps(const char *key, struct lxc_conf *c,
4920                                     void *data)
4921 {
4922         return lxc_clear_idmaps(c);
4923 }
4924
4925 static inline int clr_config_log_level(const char *key, struct lxc_conf *c,
4926                                       void *data)
4927 {
4928         c->loglevel = LXC_LOG_LEVEL_NOTSET;
4929         return 0;
4930 }
4931
4932 static inline int clr_config_log_file(const char *key, struct lxc_conf *c,
4933                                      void *data)
4934 {
4935         free_disarm(c->logfile);
4936         return 0;
4937 }
4938
4939 static inline int clr_config_mount(const char *key, struct lxc_conf *c,
4940                                    void *data)
4941 {
4942         return lxc_clear_mount_entries(c);
4943 }
4944
4945 static inline int clr_config_mount_auto(const char *key, struct lxc_conf *c,
4946                                         void *data)
4947 {
4948         return lxc_clear_automounts(c);
4949 }
4950
4951 static inline int clr_config_mount_fstab(const char *key, struct lxc_conf *c,
4952                                          void *data)
4953 {
4954         free_disarm(c->fstab);
4955         return 0;
4956 }
4957
4958 static inline int clr_config_rootfs_path(const char *key, struct lxc_conf *c,
4959                                          void *data)
4960 {
4961         free_disarm(c->rootfs.path);
4962         return 0;
4963 }
4964
4965 static inline int clr_config_rootfs_managed(const char *key, struct lxc_conf *c,
4966                                             void *data)
4967 {
4968         c->rootfs.managed = true;
4969         return 0;
4970 }
4971
4972 static inline int clr_config_rootfs_mount(const char *key, struct lxc_conf *c,
4973                                           void *data)
4974 {
4975         free_disarm(c->rootfs.mount);
4976         return 0;
4977 }
4978
4979 static inline int clr_config_rootfs_options(const char *key, struct lxc_conf *c,
4980                                             void *data)
4981 {
4982         put_lxc_mount_options(&c->rootfs.mnt_opts);
4983
4984         return 0;
4985 }
4986
4987 static inline int clr_config_uts_name(const char *key, struct lxc_conf *c,
4988                                      void *data)
4989 {
4990         free_disarm(c->utsname);
4991         return 0;
4992 }
4993
4994 static inline int clr_config_hooks(const char *key, struct lxc_conf *c,
4995                                    void *data)
4996 {
4997         return lxc_clear_hooks(c, key);
4998 }
4999
5000 static inline int clr_config_hooks_version(const char *key, struct lxc_conf *c,
5001                                            void *data)
5002 {
5003         /* default to legacy hooks version */
5004         c->hooks_version = 0;
5005         return 0;
5006 }
5007
5008 static inline int clr_config_net(const char *key, struct lxc_conf *c,
5009                                  void *data)
5010 {
5011         lxc_free_networks(c);
5012
5013         return 0;
5014 }
5015
5016 static inline int clr_config_cap_drop(const char *key, struct lxc_conf *c,
5017                                       void *data)
5018 {
5019         return lxc_clear_config_caps(c);
5020 }
5021
5022 static inline int clr_config_cap_keep(const char *key, struct lxc_conf *c,
5023                                       void *data)
5024 {
5025         return lxc_clear_config_caps(c);
5026 }
5027
5028 static inline int clr_config_console_path(const char *key, struct lxc_conf *c,
5029                                           void *data)
5030 {
5031         free_disarm(c->console.path);
5032         return 0;
5033 }
5034
5035 static inline int clr_config_console_logfile(const char *key,
5036                                              struct lxc_conf *c, void *data)
5037 {
5038         free_disarm(c->console.log_path);
5039         return 0;
5040 }
5041
5042 static inline int clr_config_console_rotate(const char *key, struct lxc_conf *c,
5043                                             void *data)
5044 {
5045         c->console.log_rotate = 0;
5046         return 0;
5047 }
5048
5049 static inline int clr_config_console_buffer_size(const char *key,
5050                                                  struct lxc_conf *c, void *data)
5051 {
5052         c->console.buffer_size = 0;
5053         return 0;
5054 }
5055
5056 static inline int clr_config_console_size(const char *key, struct lxc_conf *c,
5057                                           void *data)
5058 {
5059         c->console.log_size = 0;
5060         return 0;
5061 }
5062
5063 static inline int clr_config_seccomp_allow_nesting(const char *key,
5064                                                    struct lxc_conf *c, void *data)
5065 {
5066 #ifdef HAVE_SECCOMP
5067         c->seccomp.allow_nesting = 0;
5068         return 0;
5069 #else
5070         return ret_errno(ENOSYS);
5071 #endif
5072 }
5073
5074 static inline int clr_config_seccomp_notify_cookie(const char *key,
5075                                                    struct lxc_conf *c, void *data)
5076 {
5077 #ifdef HAVE_SECCOMP_NOTIFY
5078         free_disarm(c->seccomp.notifier.cookie);
5079         return 0;
5080 #else
5081         return ret_errno(ENOSYS);
5082 #endif
5083 }
5084
5085 static inline int clr_config_seccomp_notify_proxy(const char *key,
5086                                                    struct lxc_conf *c, void *data)
5087 {
5088 #ifdef HAVE_SECCOMP_NOTIFY
5089         memset(&c->seccomp.notifier.proxy_addr, 0,
5090                sizeof(c->seccomp.notifier.proxy_addr));
5091         return 0;
5092 #else
5093         return ret_errno(ENOSYS);
5094 #endif
5095 }
5096
5097 static inline int clr_config_seccomp_profile(const char *key,
5098                                              struct lxc_conf *c, void *data)
5099 {
5100         free_disarm(c->seccomp.seccomp);
5101         return 0;
5102 }
5103
5104 static inline int clr_config_autodev(const char *key, struct lxc_conf *c,
5105                                      void *data)
5106 {
5107         c->autodev = 1;
5108         return 0;
5109 }
5110
5111 static inline int clr_config_autodev_tmpfs_size(const char *key, struct lxc_conf *c,
5112                                      void *data)
5113 {
5114         c->autodevtmpfssize = 500000;
5115         return 0;
5116 }
5117
5118 static inline int clr_config_signal_halt(const char *key, struct lxc_conf *c,
5119                                         void *data)
5120 {
5121         c->haltsignal = 0;
5122         return 0;
5123 }
5124
5125 static inline int clr_config_signal_reboot(const char *key, struct lxc_conf *c,
5126                                           void *data)
5127 {
5128         c->rebootsignal = 0;
5129         return 0;
5130 }
5131
5132 static inline int clr_config_signal_stop(const char *key, struct lxc_conf *c,
5133                                         void *data)
5134 {
5135         c->stopsignal = 0;
5136         return 0;
5137 }
5138
5139 static inline int clr_config_start(const char *key, struct lxc_conf *c,
5140                                    void *data)
5141 {
5142         if (strequal(key + 10, "auto"))
5143                 c->start_auto = 0;
5144         else if (strequal(key + 10, "delay"))
5145                 c->start_delay = 0;
5146         else if (strequal(key + 10, "order"))
5147                 c->start_order = 0;
5148
5149         return 0;
5150 }
5151
5152 static inline int clr_config_log_syslog(const char *key, struct lxc_conf *c,
5153                                     void *data)
5154 {
5155         free_disarm(c->syslog);
5156         return 0;
5157 }
5158
5159 static inline int clr_config_monitor(const char *key, struct lxc_conf *c,
5160                                      void *data)
5161 {
5162         c->monitor_unshare = 0;
5163         return 0;
5164 }
5165
5166 static inline int clr_config_monitor_signal_pdeath(const char *key,
5167                                                    struct lxc_conf *c, void *data)
5168 {
5169         c->monitor_signal_pdeath = 0;
5170         return 0;
5171 }
5172
5173 static inline int clr_config_group(const char *key, struct lxc_conf *c,
5174                                    void *data)
5175 {
5176         return lxc_clear_groups(c);
5177 }
5178
5179 static inline int clr_config_environment(const char *key, struct lxc_conf *c,
5180                                          void *data)
5181 {
5182         return lxc_clear_environment(c);
5183 }
5184
5185 static inline int clr_config_execute_cmd(const char *key, struct lxc_conf *c,
5186                                       void *data)
5187 {
5188         free_disarm(c->execute_cmd);
5189         return 0;
5190 }
5191
5192 static inline int clr_config_init_cmd(const char *key, struct lxc_conf *c,
5193                                       void *data)
5194 {
5195         free_disarm(c->init_cmd);
5196         return 0;
5197 }
5198
5199 static inline int clr_config_init_cwd(const char *key, struct lxc_conf *c,
5200                                       void *data)
5201 {
5202         free_disarm(c->init_cwd);
5203         return 0;
5204 }
5205
5206 static inline int clr_config_init_uid(const char *key, struct lxc_conf *c,
5207                                       void *data)
5208 {
5209         c->init_uid = 0;
5210         return 0;
5211 }
5212
5213 static inline int clr_config_init_gid(const char *key, struct lxc_conf *c,
5214                                       void *data)
5215 {
5216         c->init_gid = 0;
5217         return 0;
5218 }
5219
5220 static inline int clr_config_init_groups(const char *key, struct lxc_conf *c,
5221                                          void *data)
5222 {
5223         c->init_groups.size = 0;
5224         free_disarm(c->init_groups.list);
5225         return 0;
5226 }
5227
5228 static inline int clr_config_ephemeral(const char *key, struct lxc_conf *c,
5229                                        void *data)
5230 {
5231         c->ephemeral = 0;
5232         return 0;
5233 }
5234
5235 static inline int clr_config_no_new_privs(const char *key, struct lxc_conf *c,
5236                                           void *data)
5237 {
5238         c->no_new_privs = false;
5239         return 0;
5240 }
5241
5242 static inline int clr_config_prlimit(const char *key, struct lxc_conf *c,
5243                                    void *data)
5244 {
5245         return lxc_clear_limits(c, key);
5246 }
5247
5248 static inline int clr_config_sysctl(const char *key, struct lxc_conf *c,
5249                                    void *data)
5250 {
5251         return lxc_clear_sysctls(c, key);
5252 }
5253
5254 static inline int clr_config_proc(const char *key, struct lxc_conf *c,
5255                                    void *data)
5256 {
5257         return lxc_clear_procs(c, key);
5258 }
5259
5260 static inline int clr_config_includefiles(const char *key, struct lxc_conf *c,
5261                                           void *data)
5262 {
5263         return 0;
5264 }
5265
5266 static int clr_config_namespace_clone(const char *key,
5267                                       struct lxc_conf *lxc_conf, void *data)
5268 {
5269         lxc_conf->ns_clone = 0;
5270         return 0;
5271 }
5272
5273 static int clr_config_namespace_keep(const char *key, struct lxc_conf *lxc_conf,
5274                                      void *data)
5275 {
5276         lxc_conf->ns_keep = 0;
5277         return 0;
5278 }
5279
5280 static int clr_config_time_offset_boot(const char *key, struct lxc_conf *lxc_conf, void *data)
5281 {
5282         lxc_conf->timens.s_boot = 0;
5283         lxc_conf->timens.ns_boot = 0;
5284         return 0;
5285 }
5286
5287 static int clr_config_time_offset_monotonic(const char *key, struct lxc_conf *lxc_conf, void *data)
5288 {
5289         lxc_conf->timens.s_monotonic = 0;
5290         lxc_conf->timens.ns_monotonic = 0;
5291         return 0;
5292 }
5293
5294 static int clr_config_namespace_share(const char *key,
5295                                       struct lxc_conf *lxc_conf, void *data)
5296 {
5297         int ns_idx;
5298         const char *namespace;
5299
5300         namespace = key + STRLITERALLEN("lxc.namespace.share.");
5301         if (is_empty_string(namespace))
5302                 return ret_errno(EINVAL);
5303
5304         ns_idx = lxc_namespace_2_ns_idx(namespace);
5305         if (ns_idx < 0)
5306                 return ns_idx;
5307
5308         free(lxc_conf->ns_share[ns_idx]);
5309         lxc_conf->ns_share[ns_idx] = NULL;
5310
5311         return 0;
5312 }
5313
5314 static int get_config_includefiles(const char *key, char *retv, int inlen,
5315                                    struct lxc_conf *c, void *data)
5316 {
5317         return ret_errno(ENOSYS);
5318 }
5319
5320 struct config_net_info {
5321         char buf[NETWORK_SUBKEY_SIZE_MAX];
5322         const char *subkey;
5323         const struct lxc_config_net_t *ops;
5324         struct lxc_netdev *netdev;
5325 };
5326
5327 static int get_network_config_ops(const char *key, struct lxc_conf *lxc_conf,
5328                                   struct config_net_info *info, bool allocate)
5329 {
5330         int ret;
5331         int64_t tmpidx;
5332         unsigned int idx;
5333         const char *idx_start;
5334
5335         if (is_empty_string(key))
5336                 return ret_errno(EINVAL);
5337
5338         /* check that this is a sensible network key */
5339         if (!strnequal("lxc.net.", key, STRLITERALLEN("lxc.net.")))
5340                 return syserror_set(-EINVAL, "Invalid network configuration key \"%s\"", key);
5341
5342         /* lxc.net.<n> */
5343         /* beginning of index string */
5344         idx_start = key + STRLITERALLEN("lxc.net.");
5345         if (!isdigit(*idx_start))
5346                 return syserror_set(-EINVAL, "Failed to detect digit in string \"%s\"", key + 8);
5347
5348         ret = lxc_safe_int64_residual(idx_start, &tmpidx, 10, info->buf, sizeof(info->buf));
5349         if (ret)
5350                 return syserror("Failed to parse network index");
5351
5352         if (tmpidx < 0 || tmpidx >= INT_MAX)
5353                 return syserror_set(-ERANGE, "Number of configured networks would overflow the counter");
5354         idx = (unsigned int)tmpidx;
5355
5356         info->netdev = lxc_get_netdev_by_idx(lxc_conf, idx, allocate);
5357         if (!info->netdev)
5358                 return ret_errno(EINVAL);
5359
5360         /* Make sure subkey points to the empty string. */
5361         info->subkey = info->buf;
5362         if (is_empty_string(info->subkey))
5363                 return ret_errno(ENOENT);
5364
5365         if (info->subkey[0] != '.')
5366                 return syserror_set(-EINVAL, "Invalid subkey");
5367         info->subkey++;
5368
5369         /* lxc.net.<idx>.<subkey> */
5370         info->ops = lxc_get_config_net(info->subkey);
5371         if (info->ops == &unsupported_config_net_key)
5372                 return syserror_set(-ENOENT, "Unknown network configuration key \"%s\"", key);
5373
5374         return 0;
5375 }
5376
5377 /* Config entry is something like "lxc.net.0.ipv4" the key 'lxc.net.' was
5378  * found. So we make sure next comes an integer, find the right callback (by
5379  * rewriting the key), and call it.
5380  */
5381 static int set_config_jump_table_net(const char *key, const char *value,
5382                                      struct lxc_conf *lxc_conf, void *data)
5383 {
5384         struct config_net_info info = {};
5385         int ret;
5386         const char *idxstring;
5387
5388         idxstring = key + STRLITERALLEN("lxc.net.");
5389         if (!isdigit(*idxstring))
5390                 return ret_errno(EINVAL);
5391
5392         if (lxc_config_value_empty(value))
5393                 return clr_config_jump_table_net(key, lxc_conf, data);
5394
5395         ret = get_network_config_ops(key, lxc_conf, &info, true);
5396         if (ret)
5397                 return ret;
5398
5399         return info.ops->set(info.subkey, value, lxc_conf, info.netdev);
5400 }
5401
5402 static int clr_config_jump_table_net(const char *key, struct lxc_conf *lxc_conf,
5403                                      void *data)
5404 {
5405         struct config_net_info info = {};
5406         int ret;
5407         const char *idxstring;
5408
5409         idxstring = key + 8;
5410         if (!isdigit(*idxstring))
5411                 return ret_errno(EINVAL);
5412
5413         /* The left conjunct is pretty self-explanatory. The right conjunct
5414          * checks whether the two pointers are equal. If they are we know that
5415          * this is not a key that is namespaced any further and so we are
5416          * supposed to clear the whole network.
5417          */
5418         if (isdigit(*idxstring) && (strrchr(key, '.') == (idxstring - 1))) {
5419                 unsigned int rmnetdevidx;
5420
5421                 ret = lxc_safe_uint(idxstring, &rmnetdevidx);
5422                 if (ret < 0)
5423                         return ret;
5424
5425                 /* Remove network from network list. */
5426                 lxc_remove_nic_by_idx(lxc_conf, rmnetdevidx);
5427                 return 0;
5428         }
5429
5430         ret = get_network_config_ops(key, lxc_conf, &info, false);
5431         if (ret)
5432                 return ret;
5433
5434         return info.ops->clr(info.subkey, lxc_conf, info.netdev);
5435 }
5436
5437 static int clr_config_net_type(const char *key, struct lxc_conf *lxc_conf,
5438                                void *data)
5439 {
5440         struct lxc_netdev *netdev = data;
5441
5442         if (!netdev)
5443                 return ret_errno(EINVAL);
5444
5445         lxc_clear_netdev(netdev);
5446
5447         return 0;
5448 }
5449
5450 static int clr_config_net_name(const char *key, struct lxc_conf *lxc_conf,
5451                                void *data)
5452 {
5453         struct lxc_netdev *netdev = data;
5454
5455         if (!netdev)
5456                 return ret_errno(EINVAL);
5457
5458         netdev->name[0] = '\0';
5459
5460         return 0;
5461 }
5462
5463 static int clr_config_net_flags(const char *key, struct lxc_conf *lxc_conf,
5464                                 void *data)
5465 {
5466         struct lxc_netdev *netdev = data;
5467
5468         if (!netdev)
5469                 return ret_errno(EINVAL);
5470
5471         netdev->flags = 0;
5472
5473         return 0;
5474 }
5475
5476 static int clr_config_net_link(const char *key, struct lxc_conf *lxc_conf,
5477                                void *data)
5478 {
5479         struct lxc_netdev *netdev = data;
5480
5481         if (!netdev)
5482                 return ret_errno(EINVAL);
5483
5484         netdev->link[0] = '\0';
5485
5486         return 0;
5487 }
5488
5489 static int clr_config_net_l2proxy(const char *key, struct lxc_conf *lxc_conf,
5490                                void *data)
5491 {
5492         struct lxc_netdev *netdev = data;
5493
5494         if (!netdev)
5495                 return ret_errno(EINVAL);
5496
5497         netdev->l2proxy = false;
5498
5499         return 0;
5500 }
5501
5502 static int clr_config_net_macvlan_mode(const char *key,
5503                                        struct lxc_conf *lxc_conf, void *data)
5504 {
5505         struct lxc_netdev *netdev = data;
5506
5507         if (!netdev)
5508                 return ret_errno(EINVAL);
5509
5510         if (netdev->type != LXC_NET_MACVLAN)
5511                 return 0;
5512
5513         netdev->priv.macvlan_attr.mode = -1;
5514
5515         return 0;
5516 }
5517
5518 static int clr_config_net_ipvlan_mode(const char *key,
5519                                        struct lxc_conf *lxc_conf, void *data)
5520 {
5521         struct lxc_netdev *netdev = data;
5522
5523         if (!netdev)
5524                 return ret_errno(EINVAL);
5525
5526         if (netdev->type != LXC_NET_IPVLAN)
5527                 return 0;
5528
5529         netdev->priv.ipvlan_attr.mode = -1;
5530
5531         return 0;
5532 }
5533
5534 static int clr_config_net_ipvlan_isolation(const char *key,
5535                                            struct lxc_conf *lxc_conf, void *data)
5536 {
5537         struct lxc_netdev *netdev = data;
5538
5539         if (!netdev)
5540                 return ret_errno(EINVAL);
5541
5542         if (netdev->type != LXC_NET_IPVLAN)
5543                 return 0;
5544
5545         netdev->priv.ipvlan_attr.isolation = -1;
5546
5547         return 0;
5548 }
5549
5550 static int clr_config_net_veth_mode(const char *key,
5551                                        struct lxc_conf *lxc_conf, void *data)
5552 {
5553         struct lxc_netdev *netdev = data;
5554
5555         if (!netdev)
5556                 return ret_errno(EINVAL);
5557
5558         if (netdev->type != LXC_NET_VETH)
5559                 return 0;
5560
5561         netdev->priv.veth_attr.mode = -1;
5562
5563         return 0;
5564 }
5565
5566 static int clr_config_net_veth_pair(const char *key, struct lxc_conf *lxc_conf,
5567                                     void *data)
5568 {
5569         struct lxc_netdev *netdev = data;
5570
5571         if (!netdev)
5572                 return ret_errno(EINVAL);
5573
5574         if (netdev->type != LXC_NET_VETH)
5575                 return 0;
5576
5577         netdev->priv.veth_attr.pair[0] = '\0';
5578
5579         return 0;
5580 }
5581
5582 static int clr_config_net_veth_vlan_id(const char *key, struct lxc_conf *lxc_conf,
5583                                   void *data)
5584 {
5585         struct lxc_netdev *netdev = data;
5586
5587         if (!netdev)
5588                 return ret_errno(EINVAL);
5589
5590         if (netdev->type != LXC_NET_VETH)
5591                 return 0;
5592
5593         netdev->priv.veth_attr.vlan_id = 0;
5594         netdev->priv.veth_attr.vlan_id_set = false;
5595
5596         return 0;
5597 }
5598
5599 static int clr_config_net_veth_vlan_tagged_id(const char *key,
5600                                        struct lxc_conf *lxc_conf, void *data)
5601 {
5602         struct lxc_netdev *netdev = data;
5603         struct lxc_list *cur, *next;
5604
5605         if (!netdev)
5606                 return ret_errno(EINVAL);
5607
5608         if (netdev->type != LXC_NET_VETH)
5609                 return 0;
5610
5611         lxc_list_for_each_safe(cur, &netdev->priv.veth_attr.vlan_tagged_ids, next) {
5612                 lxc_list_del(cur);
5613                 free(cur);
5614         }
5615
5616         return 0;
5617 }
5618
5619
5620 static int clr_config_net_script_up(const char *key, struct lxc_conf *lxc_conf,
5621                                     void *data)
5622 {
5623         struct lxc_netdev *netdev = data;
5624
5625         if (!netdev)
5626                 return ret_errno(EINVAL);
5627
5628         free_disarm(netdev->upscript);
5629
5630         return 0;
5631 }
5632
5633 static int clr_config_net_script_down(const char *key,
5634                                       struct lxc_conf *lxc_conf, void *data)
5635 {
5636         struct lxc_netdev *netdev = data;
5637
5638         if (!netdev)
5639                 return ret_errno(EINVAL);
5640
5641         free_disarm(netdev->downscript);
5642
5643         return 0;
5644 }
5645
5646 static int clr_config_net_hwaddr(const char *key, struct lxc_conf *lxc_conf,
5647                                  void *data)
5648 {
5649         struct lxc_netdev *netdev = data;
5650
5651         if (!netdev)
5652                 return ret_errno(EINVAL);
5653
5654         free_disarm(netdev->hwaddr);
5655
5656         return 0;
5657 }
5658
5659 static int clr_config_net_mtu(const char *key, struct lxc_conf *lxc_conf,
5660                               void *data)
5661 {
5662         struct lxc_netdev *netdev = data;
5663
5664         if (!netdev)
5665                 return ret_errno(EINVAL);
5666
5667         free_disarm(netdev->mtu);
5668
5669         return 0;
5670 }
5671
5672 static int clr_config_net_vlan_id(const char *key, struct lxc_conf *lxc_conf,
5673                                   void *data)
5674 {
5675         struct lxc_netdev *netdev = data;
5676
5677         if (!netdev)
5678                 return ret_errno(EINVAL);
5679
5680         if (netdev->type != LXC_NET_VLAN)
5681                 return 0;
5682
5683         netdev->priv.vlan_attr.vid = 0;
5684
5685         return 0;
5686 }
5687
5688 static int clr_config_net_ipv4_gateway(const char *key,
5689                                        struct lxc_conf *lxc_conf, void *data)
5690 {
5691         struct lxc_netdev *netdev = data;
5692
5693         if (!netdev)
5694                 return ret_errno(EINVAL);
5695
5696         free_disarm(netdev->ipv4_gateway);
5697
5698         return 0;
5699 }
5700
5701 static int clr_config_net_ipv4_address(const char *key,
5702                                        struct lxc_conf *lxc_conf, void *data)
5703 {
5704         struct lxc_netdev *netdev = data;
5705         struct lxc_inetdev *inetdev, *ninetdev;
5706
5707         if (!netdev)
5708                 return ret_errno(EINVAL);
5709
5710         list_for_each_entry_safe(inetdev, ninetdev, &netdev->ipv4_addresses, head) {
5711                 list_del(&inetdev->head);
5712                 free(inetdev);
5713         }
5714
5715         return 0;
5716 }
5717
5718 static int clr_config_net_veth_ipv4_route(const char *key,
5719                                           struct lxc_conf *lxc_conf, void *data)
5720 {
5721         struct lxc_netdev *netdev = data;
5722         struct lxc_inetdev *inetdev, *ninetdev;
5723
5724         if (!netdev)
5725                 return ret_errno(EINVAL);
5726
5727         if (netdev->type != LXC_NET_VETH)
5728                 return 0;
5729
5730         list_for_each_entry_safe(inetdev, ninetdev, &netdev->priv.veth_attr.ipv4_routes, head) {
5731                 list_del(&inetdev->head);
5732                 free(inetdev);
5733         }
5734
5735         return 0;
5736 }
5737
5738 static int clr_config_net_ipv6_gateway(const char *key,
5739                                        struct lxc_conf *lxc_conf, void *data)
5740 {
5741         struct lxc_netdev *netdev = data;
5742
5743         if (!netdev)
5744                 return ret_errno(EINVAL);
5745
5746         free_disarm(netdev->ipv6_gateway);
5747
5748         return 0;
5749 }
5750
5751 static int clr_config_net_ipv6_address(const char *key,
5752                                        struct lxc_conf *lxc_conf, void *data)
5753 {
5754         struct lxc_netdev *netdev = data;
5755         struct lxc_inet6dev *inet6dev, *ninet6dev;
5756
5757         if (!netdev)
5758                 return ret_errno(EINVAL);
5759
5760         list_for_each_entry_safe(inet6dev, ninet6dev, &netdev->ipv6_addresses, head) {
5761                 list_del(&inet6dev->head);
5762                 free(inet6dev);
5763         }
5764
5765         return 0;
5766 }
5767
5768 static int clr_config_net_veth_ipv6_route(const char *key,
5769                                           struct lxc_conf *lxc_conf, void *data)
5770 {
5771         struct lxc_netdev *netdev = data;
5772         struct lxc_inet6dev *inet6dev, *ninet6dev;
5773
5774         if (!netdev)
5775                 return ret_errno(EINVAL);
5776
5777         if (netdev->type != LXC_NET_VETH)
5778                 return 0;
5779
5780         list_for_each_entry_safe(inet6dev, ninet6dev, &netdev->priv.veth_attr.ipv6_routes, head) {
5781                 list_del(&inet6dev->head);
5782                 free(inet6dev);
5783         }
5784
5785         return 0;
5786 }
5787
5788 static int get_config_jump_table_net(const char *key, char *retv, int inlen,
5789                                      struct lxc_conf *c, void *data)
5790 {
5791         struct config_net_info info = {};
5792         int ret;
5793         const char *idxstring;
5794
5795         idxstring = key + STRLITERALLEN("lxc.net.");
5796         if (!isdigit(*idxstring))
5797                 return ret_errno(EINVAL);
5798
5799         ret = get_network_config_ops(key, c, &info, false);
5800         if (ret)
5801                 return ret;
5802
5803         return info.ops->get(info.subkey, retv, inlen, c, info.netdev);
5804 }
5805
5806 static int get_config_net_type(const char *key, char *retv, int inlen,
5807                                struct lxc_conf *c, void *data)
5808 {
5809         int len;
5810         int fulllen = 0;
5811         struct lxc_netdev *netdev = data;
5812
5813         if (!netdev)
5814                 return ret_errno(EINVAL);
5815
5816         if (!retv)
5817                 inlen = 0;
5818         else
5819                 memset(retv, 0, inlen);
5820
5821         strprint(retv, inlen, "%s", lxc_net_type_to_str(netdev->type));
5822
5823         return fulllen;
5824 }
5825
5826 static int get_config_net_flags(const char *key, char *retv, int inlen,
5827                                 struct lxc_conf *c, void *data)
5828 {
5829         int len;
5830         int fulllen = 0;
5831         struct lxc_netdev *netdev = data;
5832
5833         if (!netdev)
5834                 return ret_errno(EINVAL);
5835
5836         if (!retv)
5837                 inlen = 0;
5838         else
5839                 memset(retv, 0, inlen);
5840
5841         if (netdev->flags & IFF_UP)
5842                 strprint(retv, inlen, "up");
5843
5844         return fulllen;
5845 }
5846
5847 static int get_config_net_link(const char *key, char *retv, int inlen,
5848                                struct lxc_conf *c, void *data)
5849 {
5850         int len;
5851         int fulllen = 0;
5852         struct lxc_netdev *netdev = data;
5853
5854         if (!netdev)
5855                 return ret_errno(EINVAL);
5856
5857         if (!retv)
5858                 inlen = 0;
5859         else
5860                 memset(retv, 0, inlen);
5861
5862         if (netdev->link[0] != '\0')
5863                 strprint(retv, inlen, "%s", netdev->link);
5864
5865         return fulllen;
5866 }
5867
5868 static int get_config_net_l2proxy(const char *key, char *retv, int inlen,
5869                                   struct lxc_conf *c, void *data)
5870 {
5871         struct lxc_netdev *netdev = data;
5872
5873         if (!netdev)
5874                 return ret_errno(EINVAL);
5875
5876         return lxc_get_conf_bool(c, retv, inlen, netdev->l2proxy);
5877 }
5878
5879 static int get_config_net_name(const char *key, char *retv, int inlen,
5880                                struct lxc_conf *c, void *data)
5881 {
5882         int len;
5883         int fulllen = 0;
5884         struct lxc_netdev *netdev = data;
5885
5886         if (!netdev)
5887                 return ret_errno(EINVAL);
5888
5889         if (!retv)
5890                 inlen = 0;
5891         else
5892                 memset(retv, 0, inlen);
5893
5894         if (netdev->name[0] != '\0')
5895                 strprint(retv, inlen, "%s", netdev->name);
5896
5897         return fulllen;
5898 }
5899
5900 static int get_config_net_macvlan_mode(const char *key, char *retv, int inlen,
5901                                        struct lxc_conf *c, void *data)
5902 {
5903         int len;
5904         int fulllen = 0;
5905         const char *mode;
5906         struct lxc_netdev *netdev = data;
5907
5908         if (!netdev)
5909                 return ret_errno(EINVAL);
5910
5911         if (netdev->type != LXC_NET_MACVLAN)
5912                 return ret_errno(EINVAL);
5913
5914         if (!retv)
5915                 inlen = 0;
5916         else
5917                 memset(retv, 0, inlen);
5918
5919         switch (netdev->priv.macvlan_attr.mode) {
5920         case MACVLAN_MODE_PRIVATE:
5921                 mode = "private";
5922                 break;
5923         case MACVLAN_MODE_VEPA:
5924                 mode = "vepa";
5925                 break;
5926         case MACVLAN_MODE_BRIDGE:
5927                 mode = "bridge";
5928                 break;
5929         case MACVLAN_MODE_PASSTHRU:
5930                 mode = "passthru";
5931                 break;
5932         default:
5933                 mode = "(invalid)";
5934                 break;
5935         }
5936
5937         strprint(retv, inlen, "%s", mode);
5938
5939         return fulllen;
5940 }
5941
5942 static int get_config_net_ipvlan_mode(const char *key, char *retv, int inlen,
5943                                        struct lxc_conf *c, void *data)
5944 {
5945         int fulllen = 0;
5946         struct lxc_netdev *netdev = data;
5947         int len;
5948         const char *mode;
5949
5950         if (!netdev)
5951                 return ret_errno(EINVAL);
5952
5953         if (netdev->type != LXC_NET_IPVLAN)
5954                 return ret_errno(EINVAL);
5955
5956         if (!retv)
5957                 inlen = 0;
5958         else
5959                 memset(retv, 0, inlen);
5960
5961         switch (netdev->priv.ipvlan_attr.mode) {
5962         case IPVLAN_MODE_L3:
5963                 mode = "l3";
5964                 break;
5965         case IPVLAN_MODE_L3S:
5966                 mode = "l3s";
5967                 break;
5968         case IPVLAN_MODE_L2:
5969                 mode = "l2";
5970                 break;
5971         default:
5972                 mode = "(invalid)";
5973                 break;
5974         }
5975
5976         strprint(retv, inlen, "%s", mode);
5977
5978         return fulllen;
5979 }
5980
5981 static int get_config_net_ipvlan_isolation(const char *key, char *retv, int inlen,
5982                                        struct lxc_conf *c, void *data)
5983 {
5984         int fulllen = 0;
5985         struct lxc_netdev *netdev = data;
5986         int len;
5987         const char *mode;
5988
5989         if (!netdev)
5990                 return ret_errno(EINVAL);
5991
5992         if (netdev->type != LXC_NET_IPVLAN)
5993                 return ret_errno(EINVAL);
5994
5995         if (!retv)
5996                 inlen = 0;
5997         else
5998                 memset(retv, 0, inlen);
5999
6000         switch (netdev->priv.ipvlan_attr.isolation) {
6001         case IPVLAN_ISOLATION_BRIDGE:
6002                 mode = "bridge";
6003                 break;
6004         case IPVLAN_ISOLATION_PRIVATE:
6005                 mode = "private";
6006                 break;
6007         case IPVLAN_ISOLATION_VEPA:
6008                 mode = "vepa";
6009                 break;
6010         default:
6011                 mode = "(invalid)";
6012                 break;
6013         }
6014
6015         strprint(retv, inlen, "%s", mode);
6016
6017         return fulllen;
6018 }
6019
6020 static int get_config_net_veth_mode(const char *key, char *retv, int inlen,
6021                                     struct lxc_conf *c, void *data)
6022 {
6023         int fulllen = 0;
6024         struct lxc_netdev *netdev = data;
6025         int len;
6026         const char *mode;
6027
6028         if (!netdev)
6029                 return ret_errno(EINVAL);
6030
6031         if (netdev->type != LXC_NET_VETH)
6032                 return ret_errno(EINVAL);
6033
6034         if (!retv)
6035                 inlen = 0;
6036         else
6037                 memset(retv, 0, inlen);
6038
6039         switch (netdev->priv.veth_attr.mode) {
6040         case VETH_MODE_BRIDGE:
6041                 mode = "bridge";
6042                 break;
6043         case VETH_MODE_ROUTER:
6044                 mode = "router";
6045                 break;
6046         default:
6047                 mode = "(invalid)";
6048                 break;
6049         }
6050
6051         strprint(retv, inlen, "%s", mode);
6052
6053         return fulllen;
6054 }
6055
6056 static int get_config_net_veth_pair(const char *key, char *retv, int inlen,
6057                                     struct lxc_conf *c, void *data)
6058 {
6059         int len;
6060         int fulllen = 0;
6061         struct lxc_netdev *netdev = data;
6062
6063         if (!netdev)
6064                 return ret_errno(EINVAL);
6065
6066         if (netdev->type != LXC_NET_VETH)
6067                 return ret_errno(EINVAL);
6068
6069         if (!retv)
6070                 inlen = 0;
6071         else
6072                 memset(retv, 0, inlen);
6073
6074         strprint(retv, inlen, "%s",
6075                  netdev->priv.veth_attr.pair[0] != '\0'
6076                      ? netdev->priv.veth_attr.pair
6077                      : netdev->priv.veth_attr.veth1);
6078
6079         return fulllen;
6080 }
6081
6082 static int get_config_net_veth_vlan_id(const char *key, char *retv, int inlen,
6083                                        struct lxc_conf *c, void *data)
6084 {
6085         int len;
6086         int fulllen = 0;
6087         struct lxc_netdev *netdev = data;
6088
6089         if (!netdev)
6090                 return ret_errno(EINVAL);
6091
6092         if (netdev->type != LXC_NET_VETH)
6093                 return ret_errno(EINVAL);
6094
6095         if (!retv)
6096                 inlen = 0;
6097         else
6098                 memset(retv, 0, inlen);
6099
6100         strprint(retv, inlen, "%d", netdev->priv.veth_attr.vlan_id);
6101
6102         return fulllen;
6103 }
6104
6105 static int get_config_net_veth_vlan_tagged_id(const char *key, char *retv,
6106                                               int inlen, struct lxc_conf *c,
6107                                               void *data)
6108 {
6109         int len;
6110         size_t listlen;
6111         struct lxc_list *it;
6112         int fulllen = 0;
6113         struct lxc_netdev *netdev = data;
6114
6115         if (!netdev)
6116                 return ret_errno(EINVAL);
6117
6118         if (netdev->type != LXC_NET_VETH)
6119                 return ret_errno(EINVAL);
6120
6121         if (!retv)
6122                 inlen = 0;
6123         else
6124                 memset(retv, 0, inlen);
6125
6126         listlen = lxc_list_len(&netdev->priv.veth_attr.vlan_tagged_ids);
6127
6128         lxc_list_for_each(it, &netdev->priv.veth_attr.vlan_tagged_ids) {
6129                 unsigned short i = PTR_TO_USHORT(it->elem);
6130                 strprint(retv, inlen, "%u%s", i, (listlen-- > 1) ? "\n" : "");
6131         }
6132
6133         return fulllen;
6134 }
6135
6136 static int get_config_net_script_up(const char *key, char *retv, int inlen,
6137                                     struct lxc_conf *c, void *data)
6138 {
6139         int len;
6140         int fulllen = 0;
6141         struct lxc_netdev *netdev = data;
6142
6143         if (!netdev)
6144                 return ret_errno(EINVAL);
6145
6146         if (!retv)
6147                 inlen = 0;
6148         else
6149                 memset(retv, 0, inlen);
6150
6151         if (netdev->upscript)
6152                 strprint(retv, inlen, "%s", netdev->upscript);
6153
6154         return fulllen;
6155 }
6156
6157 static int get_config_net_script_down(const char *key, char *retv, int inlen,
6158                                       struct lxc_conf *c, void *data)
6159 {
6160         int len;
6161         int fulllen = 0;
6162         struct lxc_netdev *netdev = data;
6163
6164         if (!netdev)
6165                 return ret_errno(EINVAL);
6166
6167         if (!retv)
6168                 inlen = 0;
6169         else
6170                 memset(retv, 0, inlen);
6171
6172         if (netdev->downscript)
6173                 strprint(retv, inlen, "%s", netdev->downscript);
6174
6175         return fulllen;
6176 }
6177
6178 static int get_config_net_hwaddr(const char *key, char *retv, int inlen,
6179                                  struct lxc_conf *c, void *data)
6180 {
6181         int len;
6182         int fulllen = 0;
6183         struct lxc_netdev *netdev = data;
6184
6185         if (!netdev)
6186                 return ret_errno(EINVAL);
6187
6188         if (!retv)
6189                 inlen = 0;
6190         else
6191                 memset(retv, 0, inlen);
6192
6193         if (netdev->hwaddr)
6194                 strprint(retv, inlen, "%s", netdev->hwaddr);
6195
6196         return fulllen;
6197 }
6198
6199 static int get_config_net_mtu(const char *key, char *retv, int inlen,
6200                               struct lxc_conf *c, void *data)
6201 {
6202         int len;
6203         int fulllen = 0;
6204         struct lxc_netdev *netdev = data;
6205
6206         if (!netdev)
6207                 return ret_errno(EINVAL);
6208
6209         if (!retv)
6210                 inlen = 0;
6211         else
6212                 memset(retv, 0, inlen);
6213
6214         if (netdev->mtu)
6215                 strprint(retv, inlen, "%s", netdev->mtu);
6216
6217         return fulllen;
6218 }
6219
6220 static int get_config_net_vlan_id(const char *key, char *retv, int inlen,
6221                                   struct lxc_conf *c, void *data)
6222 {
6223         int len;
6224         int fulllen = 0;
6225         struct lxc_netdev *netdev = data;
6226
6227         if (!netdev)
6228                 return ret_errno(EINVAL);
6229
6230         if (netdev->type != LXC_NET_VLAN)
6231                 return ret_errno(EINVAL);
6232
6233         if (!retv)
6234                 inlen = 0;
6235         else
6236                 memset(retv, 0, inlen);
6237
6238         strprint(retv, inlen, "%d", netdev->priv.vlan_attr.vid);
6239
6240         return fulllen;
6241 }
6242
6243 static int get_config_net_ipv4_gateway(const char *key, char *retv, int inlen,
6244                                        struct lxc_conf *c, void *data)
6245 {
6246         int len;
6247         char buf[INET_ADDRSTRLEN];
6248         int fulllen = 0;
6249         struct lxc_netdev *netdev = data;
6250
6251         if (!netdev)
6252                 return ret_errno(EINVAL);
6253
6254         if (!retv)
6255                 inlen = 0;
6256         else
6257                 memset(retv, 0, inlen);
6258
6259         if (netdev->ipv4_gateway_auto) {
6260                 strprint(retv, inlen, "auto");
6261         } else if (netdev->ipv4_gateway_dev) {
6262                 strprint(retv, inlen, "dev");
6263         } else if (netdev->ipv4_gateway) {
6264                 if (!inet_ntop(AF_INET, netdev->ipv4_gateway, buf, sizeof(buf)))
6265                         return -errno;
6266                 strprint(retv, inlen, "%s", buf);
6267         }
6268
6269         return fulllen;
6270 }
6271
6272 static int get_config_net_ipv4_address(const char *key, char *retv, int inlen,
6273                                        struct lxc_conf *c, void *data)
6274 {
6275         int fulllen = 0;
6276         struct lxc_netdev *netdev = data;
6277         int len;
6278         size_t listlen;
6279         char buf[INET_ADDRSTRLEN];
6280         struct lxc_inetdev *inetdev;
6281
6282         if (!netdev)
6283                 return ret_errno(EINVAL);
6284
6285         if (!retv)
6286                 inlen = 0;
6287         else
6288                 memset(retv, 0, inlen);
6289
6290         listlen = list_len(&netdev->ipv4_addresses);
6291
6292         list_for_each_entry(inetdev, &netdev->ipv4_addresses, head) {
6293                 if (!inet_ntop(AF_INET, &inetdev->addr, buf, sizeof(buf)))
6294                         return -errno;
6295                 strprint(retv, inlen, "%s/%u%s", buf, inetdev->prefix,
6296                          (listlen-- > 1) ? "\n" : "");
6297         }
6298
6299         return fulllen;
6300 }
6301
6302 static int get_config_net_veth_ipv4_route(const char *key, char *retv, int inlen,
6303                                           struct lxc_conf *c, void *data)
6304 {
6305         int len;
6306         size_t listlen;
6307         char buf[INET_ADDRSTRLEN];
6308         struct lxc_inetdev *inetdev;
6309         int fulllen = 0;
6310         struct lxc_netdev *netdev = data;
6311
6312         if (!netdev)
6313                 return ret_errno(EINVAL);
6314
6315         if (netdev->type != LXC_NET_VETH)
6316                 return ret_errno(EINVAL);
6317
6318         if (!retv)
6319                 inlen = 0;
6320         else
6321                 memset(retv, 0, inlen);
6322
6323         listlen = list_len(&netdev->priv.veth_attr.ipv4_routes);
6324         list_for_each_entry(inetdev, &netdev->priv.veth_attr.ipv4_routes, head) {
6325                 if (!inet_ntop(AF_INET, &inetdev->addr, buf, sizeof(buf)))
6326                         return -errno;
6327                 strprint(retv, inlen, "%s/%u%s", buf, inetdev->prefix,
6328                          (listlen-- > 1) ? "\n" : "");
6329         }
6330
6331         return fulllen;
6332 }
6333
6334 static int get_config_net_ipv6_gateway(const char *key, char *retv, int inlen,
6335                                        struct lxc_conf *c, void *data)
6336 {
6337         int len;
6338         char buf[INET6_ADDRSTRLEN];
6339         int fulllen = 0;
6340         struct lxc_netdev *netdev = data;
6341
6342         if (!netdev)
6343                 return ret_errno(EINVAL);
6344
6345         if (!retv)
6346                 inlen = 0;
6347         else
6348                 memset(retv, 0, inlen);
6349
6350         if (netdev->ipv6_gateway_auto) {
6351                 strprint(retv, inlen, "auto");
6352         } else if (netdev->ipv6_gateway_dev) {
6353                 strprint(retv, inlen, "dev");
6354         } else if (netdev->ipv6_gateway) {
6355                 if (!inet_ntop(AF_INET6, netdev->ipv6_gateway, buf, sizeof(buf)))
6356                         return -errno;
6357                 strprint(retv, inlen, "%s", buf);
6358         }
6359
6360         return fulllen;
6361 }
6362
6363 static int get_config_net_ipv6_address(const char *key, char *retv, int inlen,
6364                                        struct lxc_conf *c, void *data)
6365 {
6366         int len;
6367         size_t listlen;
6368         char buf[INET6_ADDRSTRLEN];
6369         int fulllen = 0;
6370         struct lxc_netdev *netdev = data;
6371         struct lxc_inet6dev *inet6dev;
6372
6373         if (!netdev)
6374                 return ret_errno(EINVAL);
6375
6376         if (!retv)
6377                 inlen = 0;
6378         else
6379                 memset(retv, 0, inlen);
6380
6381         listlen = list_len(&netdev->ipv6_addresses);
6382         list_for_each_entry(inet6dev, &netdev->ipv6_addresses, head) {
6383                 if (!inet_ntop(AF_INET6, &inet6dev->addr, buf, sizeof(buf)))
6384                         return -errno;
6385                 strprint(retv, inlen, "%s/%u%s", buf, inet6dev->prefix,
6386                          (listlen-- > 1) ? "\n" : "");
6387         }
6388
6389         return fulllen;
6390 }
6391
6392 static int get_config_net_veth_ipv6_route(const char *key, char *retv, int inlen,
6393                                           struct lxc_conf *c, void *data)
6394 {
6395         int len;
6396         size_t listlen;
6397         char buf[INET6_ADDRSTRLEN];
6398         struct lxc_inet6dev *inet6dev;
6399         int fulllen = 0;
6400         struct lxc_netdev *netdev = data;
6401
6402         if (!netdev)
6403                 return ret_errno(EINVAL);
6404
6405         if (netdev->type != LXC_NET_VETH)
6406                 return ret_errno(EINVAL);
6407
6408         if (!retv)
6409                 inlen = 0;
6410         else
6411                 memset(retv, 0, inlen);
6412
6413         listlen = list_len(&netdev->priv.veth_attr.ipv6_routes);
6414         list_for_each_entry(inet6dev, &netdev->priv.veth_attr.ipv6_routes, head) {
6415                 if (!inet_ntop(AF_INET6, &inet6dev->addr, buf, sizeof(buf)))
6416                         return -errno;
6417                 strprint(retv, inlen, "%s/%u%s", buf, inet6dev->prefix,
6418                          (listlen-- > 1) ? "\n" : "");
6419         }
6420
6421         return fulllen;
6422 }
6423
6424 int lxc_list_config_items(char *retv, int inlen)
6425 {
6426         size_t i;
6427         int len;
6428         int fulllen = 0;
6429
6430         if (!retv)
6431                 inlen = 0;
6432         else
6433                 memset(retv, 0, inlen);
6434
6435         for (i = 0; i < ARRAY_SIZE(config_jump_table); i++) {
6436                 char *s = config_jump_table[i].name;
6437
6438                 if (s[strlen(s) - 1] == '.')
6439                         continue;
6440
6441                 strprint(retv, inlen, "%s\n", s);
6442         }
6443
6444         return fulllen;
6445 }
6446
6447 int lxc_list_subkeys(struct lxc_conf *conf, const char *key, char *retv,
6448                      int inlen)
6449 {
6450         int len;
6451         int fulllen = 0;
6452
6453         if (!retv)
6454                 inlen = 0;
6455         else
6456                 memset(retv, 0, inlen);
6457
6458         if (strequal(key, "lxc.apparmor")) {
6459                 strprint(retv, inlen, "allow_incomplete\n");
6460                 strprint(retv, inlen, "allow_nesting\n");
6461                 strprint(retv, inlen, "profile\n");
6462                 strprint(retv, inlen, "raw\n");
6463         } else if (strequal(key, "lxc.cgroup")) {
6464                 strprint(retv, inlen, "dir\n");
6465         } else if (strequal(key, "lxc.selinux")) {
6466                 strprint(retv, inlen, "context\n");
6467                 strprint(retv, inlen, "context.keyring\n");
6468         } else if (strequal(key, "lxc.mount")) {
6469                 strprint(retv, inlen, "auto\n");
6470                 strprint(retv, inlen, "entry\n");
6471                 strprint(retv, inlen, "fstab\n");
6472         } else if (strequal(key, "lxc.rootfs")) {
6473                 strprint(retv, inlen, "mount\n");
6474                 strprint(retv, inlen, "options\n");
6475                 strprint(retv, inlen, "path\n");
6476         } else if (strequal(key, "lxc.uts")) {
6477                 strprint(retv, inlen, "name\n");
6478         } else if (strequal(key, "lxc.hook")) {
6479                 strprint(retv, inlen, "autodev\n");
6480                 strprint(retv, inlen, "autodevtmpfssize\n");
6481                 strprint(retv, inlen, "clone\n");
6482                 strprint(retv, inlen, "destroy\n");
6483                 strprint(retv, inlen, "mount\n");
6484                 strprint(retv, inlen, "post-stop\n");
6485                 strprint(retv, inlen, "pre-mount\n");
6486                 strprint(retv, inlen, "pre-start\n");
6487                 strprint(retv, inlen, "start-host\n");
6488                 strprint(retv, inlen, "start\n");
6489                 strprint(retv, inlen, "stop\n");
6490         } else if (strequal(key, "lxc.cap")) {
6491                 strprint(retv, inlen, "drop\n");
6492                 strprint(retv, inlen, "keep\n");
6493         } else if (strequal(key, "lxc.console")) {
6494                 strprint(retv, inlen, "logfile\n");
6495                 strprint(retv, inlen, "path\n");
6496         } else if (strequal(key, "lxc.seccomp")) {
6497                 strprint(retv, inlen, "profile\n");
6498         } else if (strequal(key, "lxc.signal")) {
6499                 strprint(retv, inlen, "halt\n");
6500                 strprint(retv, inlen, "reboot\n");
6501                 strprint(retv, inlen, "stop\n");
6502         } else if (strequal(key, "lxc.start")) {
6503                 strprint(retv, inlen, "auto\n");
6504                 strprint(retv, inlen, "delay\n");
6505                 strprint(retv, inlen, "order\n");
6506         } else if (strequal(key, "lxc.monitor")) {
6507                 strprint(retv, inlen, "unshare\n");
6508         } else if (strequal(key, "lxc.keyring")) {
6509                 strprint(retv, inlen, "session\n");
6510         } else {
6511                 fulllen = ret_errno(EINVAL);
6512         }
6513
6514         return fulllen;
6515 }
6516
6517 int lxc_list_net(struct lxc_conf *c, const char *key, char *retv, int inlen)
6518 {
6519         struct config_net_info info = {};
6520         struct lxc_netdev *netdev;
6521         int len, ret;
6522         const char *idxstring;
6523         int fulllen = 0;
6524
6525         idxstring = key + STRLITERALLEN("lxc.net.");
6526         if (!isdigit(*idxstring))
6527                 return ret_errno(EINVAL);
6528
6529         ret = get_network_config_ops(key, c, &info, false);
6530         if (ret) {
6531                 if (ret != -ENOENT)
6532                         return ret_errno(EINVAL);
6533         }
6534         netdev = info.netdev;
6535
6536         if (!retv)
6537                 inlen = 0;
6538         else
6539                 memset(retv, 0, inlen);
6540
6541         strprint(retv, inlen, "type\n");
6542         strprint(retv, inlen, "script.up\n");
6543         strprint(retv, inlen, "script.down\n");
6544
6545         if (netdev->type != LXC_NET_EMPTY) {
6546                 strprint(retv, inlen, "flags\n");
6547                 strprint(retv, inlen, "link\n");
6548                 strprint(retv, inlen, "name\n");
6549                 strprint(retv, inlen, "hwaddr\n");
6550                 strprint(retv, inlen, "mtu\n");
6551                 strprint(retv, inlen, "ipv6.address\n");
6552                 strprint(retv, inlen, "ipv6.gateway\n");
6553                 strprint(retv, inlen, "ipv4.address\n");
6554                 strprint(retv, inlen, "ipv4.gateway\n");
6555         }
6556
6557         switch (netdev->type) {
6558         case LXC_NET_VETH:
6559                 strprint(retv, inlen, "veth.pair\n");
6560                 strprint(retv, inlen, "veth.ipv4.route\n");
6561                 strprint(retv, inlen, "veth.ipv6.route\n");
6562                 strprint(retv, inlen, "veth.vlan.id\n");
6563                 break;
6564         case LXC_NET_MACVLAN:
6565                 strprint(retv, inlen, "macvlan.mode\n");
6566                 break;
6567         case LXC_NET_IPVLAN:
6568                 strprint(retv, inlen, "ipvlan.mode\n");
6569                 strprint(retv, inlen, "ipvlan.isolation\n");
6570                 break;
6571         case LXC_NET_VLAN:
6572                 strprint(retv, inlen, "vlan.id\n");
6573                 break;
6574         case LXC_NET_PHYS:
6575                 break;
6576         }
6577
6578         return fulllen;
6579 }