]> git.proxmox.com Git - mirror_lxc.git/blob - src/lxc/criu.c
projects / mirror_lxc.git / blob
? search:


9b0ccacb6af7a136603a3d4e569dd223e9e74e91
[mirror_lxc.git] / src / lxc / criu.c
1 /*
2 * lxc: linux Container library
3 *
4 * Copyright © 2014-2015 Canonical Ltd.
5 *
6 * Authors:
7 * Tycho Andersen <tycho.andersen@canonical.com>
8 *
9 * This library is free software; you can redistribute it and/or
10 * modify it under the terms of the GNU Lesser General Public
11 * License as published by the Free Software Foundation; either
12 * version 2.1 of the License, or (at your option) any later version.
13 *
14 * This library is distributed in the hope that it will be useful,
15 * but WITHOUT ANY WARRANTY; without even the implied warranty of
16 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
17 * Lesser General Public License for more details.
18 *
19 * You should have received a copy of the GNU Lesser General Public
20 * License along with this library; if not, write to the Free Software
21 * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
22 */
23 #define _GNU_SOURCE
24 #include <inttypes.h>
25 #include <linux/limits.h>
26 #include <sched.h>
27 #include <stdio.h>
28 #include <stdlib.h>
29 #include <string.h>
30 #include <sys/mount.h>
31 #include <sys/types.h>
32 #include <sys/wait.h>
33 #include <unistd.h>
34
35 #include "config.h"
36
37 #include "bdev.h"
38 #include "cgroup.h"
39 #include "conf.h"
40 #include "commands.h"
41 #include "criu.h"
42 #include "log.h"
43 #include "lxc.h"
44 #include "lxclock.h"
45 #include "network.h"
46 #include "utils.h"
47
48 #if IS_BIONIC
49 #include <../include/lxcmntent.h>
50 #else
51 #include <mntent.h>
52 #endif
53
54 #define CRIU_VERSION "2.0"
55
56 #define CRIU_GITID_VERSION "2.0"
57 #define CRIU_GITID_PATCHLEVEL 0
58
59 #define CRIU_IN_FLIGHT_SUPPORT "2.4"
60 #define CRIU_EXTERNAL_NOT_VETH "2.8"
61
62 lxc_log_define(lxc_criu, lxc);
63
64 struct criu_opts {
65 /* the thing to hook to stdout and stderr for logging */
66 int pipefd;
67
68 /* The type of criu invocation, one of "dump" or "restore" */
69 char *action;
70
71 /* the user-provided migrate options relevant to this action */
72 struct migrate_opts *user;
73
74 /* The container to dump */
75 struct lxc_container *c;
76
77 /* dump: stop the container or not after dumping? */
78 char tty_id[32]; /* the criu tty id for /dev/console, i.e. "tty[${rdev}:${dev}]" */
79
80 /* restore: the file to write the init process' pid into */
81 struct lxc_handler *handler;
82 int console_fd;
83 /* The path that is bind mounted from /dev/console, if any. We don't
84 * want to use `--ext-mount-map auto`'s result here because the pts
85 * device may have a different path (e.g. if the pty number is
86 * different) on the target host. NULL if lxc.console = "none".
87 */
88 char *console_name;
89
90 /* The detected version of criu */
91 char *criu_version;
92 };
93
94 static int load_tty_major_minor(char *directory, char *output, int len)
95 {
96 FILE *f;
97 char path[PATH_MAX];
98 int ret;
99
100 ret = snprintf(path, sizeof(path), "%s/tty.info", directory);
101 if (ret < 0 || ret >= sizeof(path)) {
102 ERROR("snprintf'd too many chacters: %d", ret);
103 return -1;
104 }
105
106 f = fopen(path, "r");
107 if (!f) {
108 /* This means we're coming from a liblxc which didn't export
109 * the tty info. In this case they had to have lxc.console =
110 * none, so there's no problem restoring.
111 */
112 if (errno == ENOENT)
113 return 0;
114
115 SYSERROR("couldn't open %s", path);
116 return -1;
117 }
118
119 if (!fgets(output, len, f)) {
120 fclose(f);
121 SYSERROR("couldn't read %s", path);
122 return -1;
123 }
124
125 fclose(f);
126 return 0;
127 }
128
129 static void exec_criu(struct criu_opts *opts)
130 {
131 char **argv, log[PATH_MAX];
132 int static_args = 23, argc = 0, i, ret;
133 int netnr = 0;
134 struct lxc_list *it;
135 FILE *mnts;
136 struct mntent mntent;
137
138 char buf[4096], tty_info[32];
139 size_t pos;
140
141 /* If we are currently in a cgroup /foo/bar, and the container is in a
142 * cgroup /lxc/foo, lxcfs will give us an ENOENT if some task in the
143 * container has an open fd that points to one of the cgroup files
144 * (systemd always opens its "root" cgroup). So, let's escape to the
145 * /actual/ root cgroup so that lxcfs thinks criu has enough rights to
146 * see all cgroups.
147 */
148 if (!cgroup_escape()) {
149 ERROR("failed to escape cgroups");
150 return;
151 }
152
153 /* The command line always looks like:
154 * criu $(action) --tcp-established --file-locks --link-remap \
155 * --manage-cgroups=full --action-script foo.sh -D $(directory) \
156 * -o $(directory)/$(action).log --ext-mount-map auto
157 * --enable-external-sharing --enable-external-masters
158 * --enable-fs hugetlbfs --enable-fs tracefs --ext-mount-map console:/dev/pts/n
159 * +1 for final NULL */
160
161 if (strcmp(opts->action, "dump") == 0 || strcmp(opts->action, "pre-dump") == 0) {
162 /* -t pid --freeze-cgroup /lxc/ct */
163 static_args += 4;
164
165 /* --prev-images-dir <path-to-directory-A-relative-to-B> */
166 if (opts->user->predump_dir)
167 static_args += 2;
168
169 /* --page-server --address <address> --port <port> */
170 if (opts->user->pageserver_address && opts->user->pageserver_port)
171 static_args += 5;
172
173 /* --leave-running (only for final dump) */
174 if (strcmp(opts->action, "dump") == 0 && !opts->user->stop)
175 static_args++;
176
177 /* --external tty[88,4] */
178 if (opts->tty_id[0])
179 static_args += 2;
180
181 /* --force-irmap */
182 if (!opts->user->preserves_inodes)
183 static_args++;
184
185 /* --ghost-limit 1024 */
186 if (opts->user->ghost_limit)
187 static_args += 2;
188 } else if (strcmp(opts->action, "restore") == 0) {
189 /* --root $(lxc_mount_point) --restore-detached
190 * --restore-sibling
191 * --lsm-profile apparmor:whatever
192 */
193 static_args += 6;
194
195 tty_info[0] = 0;
196 if (load_tty_major_minor(opts->user->directory, tty_info, sizeof(tty_info)))
197 return;
198
199 /* --inherit-fd fd[%d]:tty[%s] */
200 if (tty_info[0])
201 static_args += 2;
202 } else {
203 return;
204 }
205
206 if (cgroup_num_hierarchies() > 0)
207 static_args += 2 * cgroup_num_hierarchies();
208
209 if (opts->user->verbose)
210 static_args++;
211
212 if (opts->user->action_script)
213 static_args += 2;
214
215 static_args += 2 * lxc_list_len(&opts->c->lxc_conf->mount_list);
216
217 ret = snprintf(log, PATH_MAX, "%s/%s.log", opts->user->directory, opts->action);
218 if (ret < 0 || ret >= PATH_MAX) {
219 ERROR("logfile name too long");
220 return;
221 }
222
223 argv = malloc(static_args * sizeof(*argv));
224 if (!argv)
225 return;
226
227 memset(argv, 0, static_args * sizeof(*argv));
228
229 #define DECLARE_ARG(arg) \
230 do { \
231 if (arg == NULL) { \
232 ERROR("Got NULL argument for criu"); \
233 goto err; \
234 } \
235 argv[argc++] = strdup(arg); \
236 if (!argv[argc-1]) \
237 goto err; \
238 } while (0)
239
240 argv[argc++] = on_path("criu", NULL);
241 if (!argv[argc-1]) {
242 ERROR("Couldn't find criu binary");
243 goto err;
244 }
245
246 DECLARE_ARG(opts->action);
247 DECLARE_ARG("--tcp-established");
248 DECLARE_ARG("--file-locks");
249 DECLARE_ARG("--link-remap");
250 DECLARE_ARG("--manage-cgroups=full");
251 DECLARE_ARG("--ext-mount-map");
252 DECLARE_ARG("auto");
253 DECLARE_ARG("--enable-external-sharing");
254 DECLARE_ARG("--enable-external-masters");
255 DECLARE_ARG("--enable-fs");
256 DECLARE_ARG("hugetlbfs");
257 DECLARE_ARG("--enable-fs");
258 DECLARE_ARG("tracefs");
259 DECLARE_ARG("-D");
260 DECLARE_ARG(opts->user->directory);
261 DECLARE_ARG("-o");
262 DECLARE_ARG(log);
263
264 for (i = 0; i < cgroup_num_hierarchies(); i++) {
265 char **controllers = NULL, *fullname;
266 char *path;
267
268 if (!cgroup_get_hierarchies(i, &controllers)) {
269 ERROR("failed to get hierarchy %d", i);
270 goto err;
271 }
272
273 /* if we are in a dump, we have to ask the monitor process what
274 * the right cgroup is. if this is a restore, we can just use
275 * the handler the restore task created.
276 */
277 if (!strcmp(opts->action, "dump") || !strcmp(opts->action, "pre-dump")) {
278 path = lxc_cmd_get_cgroup_path(opts->c->name, opts->c->config_path, controllers[0]);
279 if (!path) {
280 ERROR("failed to get cgroup path for %s", controllers[0]);
281 goto err;
282 }
283 } else {
284 const char *p;
285
286 p = cgroup_get_cgroup(opts->handler, controllers[0]);
287 if (!p) {
288 ERROR("failed to get cgroup path for %s", controllers[0]);
289 goto err;
290 }
291
292 path = strdup(p);
293 if (!path) {
294 ERROR("strdup failed");
295 goto err;
296 }
297 }
298
299 if (!lxc_deslashify(&path)) {
300 ERROR("failed to deslashify %s", path);
301 free(path);
302 goto err;
303 }
304
305 fullname = lxc_string_join(",", (const char **) controllers, false);
306 if (!fullname) {
307 ERROR("failed to join controllers");
308 free(path);
309 goto err;
310 }
311
312 ret = sprintf(buf, "%s:%s", fullname, path);
313 free(path);
314 free(fullname);
315 if (ret < 0 || ret >= sizeof(buf)) {
316 ERROR("sprintf of cgroup root arg failed");
317 goto err;
318 }
319
320 DECLARE_ARG("--cgroup-root");
321 DECLARE_ARG(buf);
322 }
323
324 if (opts->user->verbose)
325 DECLARE_ARG("-vvvvvv");
326
327 if (opts->user->action_script) {
328 DECLARE_ARG("--action-script");
329 DECLARE_ARG(opts->user->action_script);
330 }
331
332 mnts = make_anonymous_mount_file(&opts->c->lxc_conf->mount_list);
333 if (!mnts)
334 goto err;
335
336 while (getmntent_r(mnts, &mntent, buf, sizeof(buf))) {
337 char *fmt, *key, *val, *mntdata;
338 char arg[2 * PATH_MAX + 2];
339 unsigned long flags;
340
341 if (parse_mntopts(mntent.mnt_opts, &flags, &mntdata) < 0)
342 goto err;
343
344 free(mntdata);
345
346 /* only add --ext-mount-map for actual bind mounts */
347 if (!(flags & MS_BIND))
348 continue;
349
350 if (strcmp(opts->action, "dump") == 0) {
351 fmt = "/%s:%s";
352 key = mntent.mnt_dir;
353 val = mntent.mnt_dir;
354 } else {
355 fmt = "%s:%s";
356 key = mntent.mnt_dir;
357 val = mntent.mnt_fsname;
358 }
359
360 ret = snprintf(arg, sizeof(arg), fmt, key, val);
361 if (ret < 0 || ret >= sizeof(arg)) {
362 fclose(mnts);
363 ERROR("snprintf failed");
364 goto err;
365 }
366
367 DECLARE_ARG("--ext-mount-map");
368 DECLARE_ARG(arg);
369 }
370 fclose(mnts);
371
372 if (strcmp(opts->action, "dump") == 0 || strcmp(opts->action, "pre-dump") == 0) {
373 char pid[32], *freezer_relative;
374
375 if (sprintf(pid, "%d", opts->c->init_pid(opts->c)) < 0)
376 goto err;
377
378 DECLARE_ARG("-t");
379 DECLARE_ARG(pid);
380
381 freezer_relative = lxc_cmd_get_cgroup_path(opts->c->name,
382 opts->c->config_path,
383 "freezer");
384 if (!freezer_relative) {
385 ERROR("failed getting freezer path");
386 goto err;
387 }
388
389 ret = snprintf(log, sizeof(log), "/sys/fs/cgroup/freezer/%s", freezer_relative);
390 if (ret < 0 || ret >= sizeof(log))
391 goto err;
392
393 if (!opts->user->disable_skip_in_flight &&
394 strcmp(opts->criu_version, CRIU_IN_FLIGHT_SUPPORT) >= 0)
395 DECLARE_ARG("--skip-in-flight");
396
397 DECLARE_ARG("--freeze-cgroup");
398 DECLARE_ARG(log);
399
400 if (opts->tty_id[0]) {
401 DECLARE_ARG("--ext-mount-map");
402 DECLARE_ARG("/dev/console:console");
403
404 DECLARE_ARG("--external");
405 DECLARE_ARG(opts->tty_id);
406 }
407
408 if (opts->user->predump_dir) {
409 DECLARE_ARG("--prev-images-dir");
410 DECLARE_ARG(opts->user->predump_dir);
411 DECLARE_ARG("--track-mem");
412 }
413
414 if (opts->user->pageserver_address && opts->user->pageserver_port) {
415 DECLARE_ARG("--page-server");
416 DECLARE_ARG("--address");
417 DECLARE_ARG(opts->user->pageserver_address);
418 DECLARE_ARG("--port");
419 DECLARE_ARG(opts->user->pageserver_port);
420 }
421
422 if (!opts->user->preserves_inodes)
423 DECLARE_ARG("--force-irmap");
424
425 if (opts->user->ghost_limit) {
426 char ghost_limit[32];
427
428 ret = sprintf(ghost_limit, "%"PRIu64, opts->user->ghost_limit);
429 if (ret < 0 || ret >= sizeof(ghost_limit)) {
430 ERROR("failed to print ghost limit %"PRIu64, opts->user->ghost_limit);
431 goto err;
432 }
433
434 DECLARE_ARG("--ghost-limit");
435 DECLARE_ARG(ghost_limit);
436 }
437
438 /* only for final dump */
439 if (strcmp(opts->action, "dump") == 0 && !opts->user->stop)
440 DECLARE_ARG("--leave-running");
441 } else if (strcmp(opts->action, "restore") == 0) {
442 void *m;
443 int additional;
444 struct lxc_conf *lxc_conf = opts->c->lxc_conf;
445
446 DECLARE_ARG("--root");
447 DECLARE_ARG(opts->c->lxc_conf->rootfs.mount);
448 DECLARE_ARG("--restore-detached");
449 DECLARE_ARG("--restore-sibling");
450
451 if (tty_info[0]) {
452 if (opts->console_fd < 0) {
453 ERROR("lxc.console configured on source host but not target");
454 goto err;
455 }
456
457 ret = snprintf(buf, sizeof(buf), "fd[%d]:%s", opts->console_fd, tty_info);
458 if (ret < 0 || ret >= sizeof(buf))
459 goto err;
460
461 DECLARE_ARG("--inherit-fd");
462 DECLARE_ARG(buf);
463 }
464 if (opts->console_name) {
465 if (snprintf(buf, sizeof(buf), "console:%s", opts->console_name) < 0) {
466 SYSERROR("sprintf'd too many bytes");
467 }
468 DECLARE_ARG("--ext-mount-map");
469 DECLARE_ARG(buf);
470 }
471
472 if (lxc_conf->lsm_aa_profile || lxc_conf->lsm_se_context) {
473
474 if (lxc_conf->lsm_aa_profile)
475 ret = snprintf(buf, sizeof(buf), "apparmor:%s", lxc_conf->lsm_aa_profile);
476 else
477 ret = snprintf(buf, sizeof(buf), "selinux:%s", lxc_conf->lsm_se_context);
478
479 if (ret < 0 || ret >= sizeof(buf))
480 goto err;
481
482 DECLARE_ARG("--lsm-profile");
483 DECLARE_ARG(buf);
484 }
485
486 additional = lxc_list_len(&opts->c->lxc_conf->network) * 2;
487
488 m = realloc(argv, (argc + additional + 1) * sizeof(*argv));
489 if (!m)
490 goto err;
491 argv = m;
492
493 lxc_list_for_each(it, &opts->c->lxc_conf->network) {
494 char eth[128], *veth;
495 char *fmt;
496 struct lxc_netdev *n = it->elem;
497 bool external_not_veth;
498
499 if (strcmp(opts->criu_version, CRIU_EXTERNAL_NOT_VETH) >= 0) {
500 /* Since criu version 2.8 the usage of --veth-pair
501 * has been deprecated:
502 * git tag --contains f2037e6d3445fc400
503 * v2.8 */
504 external_not_veth = true;
505 } else {
506 external_not_veth = false;
507 }
508
509 if (n->name) {
510 if (strlen(n->name) >= sizeof(eth))
511 goto err;
512 strncpy(eth, n->name, sizeof(eth));
513 } else {
514 ret = snprintf(eth, sizeof(eth), "eth%d", netnr);
515 if (ret < 0 || ret >= sizeof(eth))
516 goto err;
517 }
518
519 switch (n->type) {
520 case LXC_NET_VETH:
521 veth = n->priv.veth_attr.pair;
522
523 if (n->link) {
524 if (external_not_veth)
525 fmt = "veth[%s]:%s@%s";
526 else
527 fmt = "%s=%s@%s";
528
529 ret = snprintf(buf, sizeof(buf), fmt, eth, veth, n->link);
530 } else {
531 if (external_not_veth)
532 fmt = "veth[%s]:%s";
533 else
534 fmt = "%s=%s";
535
536 ret = snprintf(buf, sizeof(buf), fmt, eth, veth);
537 }
538 if (ret < 0 || ret >= sizeof(buf))
539 goto err;
540 break;
541 case LXC_NET_MACVLAN:
542 if (!n->link) {
543 ERROR("no host interface for macvlan %s", n->name);
544 goto err;
545 }
546
547 ret = snprintf(buf, sizeof(buf), "macvlan[%s]:%s", eth, n->link);
548 if (ret < 0 || ret >= sizeof(buf))
549 goto err;
550 break;
551 case LXC_NET_NONE:
552 case LXC_NET_EMPTY:
553 break;
554 default:
555 /* we have screened for this earlier... */
556 ERROR("unexpected network type %d", n->type);
557 goto err;
558 }
559
560 if (external_not_veth)
561 DECLARE_ARG("--external");
562 else
563 DECLARE_ARG("--veth-pair");
564 DECLARE_ARG(buf);
565 netnr++;
566 }
567
568 }
569
570 argv[argc] = NULL;
571
572 buf[0] = 0;
573 pos = 0;
574
575 for (i = 0; argv[i]; i++) {
576 ret = snprintf(buf + pos, sizeof(buf) - pos, "%s ", argv[i]);
577 if (ret < 0 || ret >= sizeof(buf) - pos)
578 goto err;
579 else
580 pos += ret;
581 }
582
583 INFO("execing: %s", buf);
584
585 /* before criu inits its log, it sometimes prints things to stdout/err;
586 * let's be sure we capture that.
587 */
588 if (dup2(opts->pipefd, STDOUT_FILENO) < 0) {
589 SYSERROR("dup2 stdout failed");
590 goto err;
591 }
592
593 if (dup2(opts->pipefd, STDERR_FILENO) < 0) {
594 SYSERROR("dup2 stderr failed");
595 goto err;
596 }
597
598 close(opts->pipefd);
599
600 #undef DECLARE_ARG
601 execv(argv[0], argv);
602 err:
603 for (i = 0; argv[i]; i++)
604 free(argv[i]);
605 free(argv);
606 }
607
608 /*
609 * Check to see if the criu version is recent enough for all the features we
610 * use. This version allows either CRIU_VERSION or (CRIU_GITID_VERSION and
611 * CRIU_GITID_PATCHLEVEL) to work, enabling users building from git to c/r
612 * things potentially before a version is released with a particular feature.
613 *
614 * The intent is that when criu development slows down, we can drop this, but
615 * for now we shouldn't attempt to c/r with versions that we know won't work.
616 *
617 * Note: If version != NULL criu_version() stores the detected criu version in
618 * version. Allocates memory for version which must be freed by caller.
619 */
620 static bool criu_version_ok(char **version)
621 {
622 int pipes[2];
623 pid_t pid;
624
625 if (pipe(pipes) < 0) {
626 SYSERROR("pipe() failed");
627 return false;
628 }
629
630 pid = fork();
631 if (pid < 0) {
632 SYSERROR("fork() failed");
633 return false;
634 }
635
636 if (pid == 0) {
637 char *args[] = { "criu", "--version", NULL };
638 char *path;
639 close(pipes[0]);
640
641 close(STDERR_FILENO);
642 if (dup2(pipes[1], STDOUT_FILENO) < 0)
643 exit(1);
644
645 path = on_path("criu", NULL);
646 if (!path)
647 exit(1);
648
649 execv(path, args);
650 exit(1);
651 } else {
652 FILE *f;
653 char *tmp;
654 int patch;
655
656 close(pipes[1]);
657 if (wait_for_pid(pid) < 0) {
658 close(pipes[0]);
659 SYSERROR("execing criu failed, is it installed?");
660 return false;
661 }
662
663 f = fdopen(pipes[0], "r");
664 if (!f) {
665 close(pipes[0]);
666 return false;
667 }
668
669 tmp = malloc(1024);
670 if (!tmp) {
671 fclose(f);
672 return false;
673 }
674
675 if (fscanf(f, "Version: %1023[^\n]s", tmp) != 1)
676 goto version_error;
677
678 if (fgetc(f) != '\n')
679 goto version_error;
680
681 if (strcmp(tmp, CRIU_VERSION) >= 0)
682 goto version_match;
683
684 if (fscanf(f, "GitID: v%1023[^-]s", tmp) != 1)
685 goto version_error;
686
687 if (fgetc(f) != '-')
688 goto version_error;
689
690 if (fscanf(f, "%d", &patch) != 1)
691 goto version_error;
692
693 if (strcmp(tmp, CRIU_GITID_VERSION) < 0)
694 goto version_error;
695
696 if (patch < CRIU_GITID_PATCHLEVEL)
697 goto version_error;
698
699 version_match:
700 fclose(f);
701 if (!version)
702 free(tmp);
703 else
704 *version = tmp;
705 return true;
706
707 version_error:
708 fclose(f);
709 free(tmp);
710 ERROR("must have criu " CRIU_VERSION " or greater to checkpoint/restore");
711 return false;
712 }
713 }
714
715 /* Check and make sure the container has a configuration that we know CRIU can
716 * dump. */
717 static bool criu_ok(struct lxc_container *c, char **criu_version)
718 {
719 struct lxc_list *it;
720
721 if (!criu_version_ok(criu_version))
722 return false;
723
724 if (geteuid()) {
725 ERROR("Must be root to checkpoint");
726 return false;
727 }
728
729 /* We only know how to restore containers with veth networks. */
730 lxc_list_for_each(it, &c->lxc_conf->network) {
731 struct lxc_netdev *n = it->elem;
732 switch(n->type) {
733 case LXC_NET_VETH:
734 case LXC_NET_NONE:
735 case LXC_NET_EMPTY:
736 case LXC_NET_MACVLAN:
737 break;
738 default:
739 ERROR("Found un-dumpable network: %s (%s)", lxc_net_type_to_str(n->type), n->name);
740 return false;
741 }
742 }
743
744 return true;
745 }
746
747 static bool restore_net_info(struct lxc_container *c)
748 {
749 struct lxc_list *it;
750 bool has_error = true;
751
752 if (container_mem_lock(c))
753 return false;
754
755 lxc_list_for_each(it, &c->lxc_conf->network) {
756 struct lxc_netdev *netdev = it->elem;
757 char template[IFNAMSIZ];
758
759 if (netdev->type != LXC_NET_VETH)
760 continue;
761
762 snprintf(template, sizeof(template), "vethXXXXXX");
763
764 if (!netdev->priv.veth_attr.pair)
765 netdev->priv.veth_attr.pair = lxc_mkifname(template);
766
767 if (!netdev->priv.veth_attr.pair)
768 goto out_unlock;
769 }
770
771 has_error = false;
772
773 out_unlock:
774 container_mem_unlock(c);
775 return !has_error;
776 }
777
778 // do_restore never returns, the calling process is used as the
779 // monitor process. do_restore calls exit() if it fails.
780 static void do_restore(struct lxc_container *c, int status_pipe, struct migrate_opts *opts, char *criu_version)
781 {
782 pid_t pid;
783 struct lxc_handler *handler;
784 int status, fd;
785 int pipes[2] = {-1, -1};
786
787 /* Try to detach from the current controlling tty if it exists.
788 * Othwerise, lxc_init (via lxc_console) will attach the container's
789 * console output to the current tty, which is probably not what any
790 * library user wants, and if they do, they can just manually configure
791 * it :)
792 */
793 fd = open("/dev/tty", O_RDWR);
794 if (fd >= 0) {
795 if (ioctl(fd, TIOCNOTTY, NULL) < 0)
796 SYSERROR("couldn't detach from tty");
797 close(fd);
798 }
799
800 handler = lxc_init(c->name, c->lxc_conf, c->config_path);
801 if (!handler)
802 goto out;
803
804 if (!cgroup_init(handler)) {
805 ERROR("failed initing cgroups");
806 goto out_fini_handler;
807 }
808
809 if (!cgroup_create(handler)) {
810 ERROR("failed creating groups");
811 goto out_fini_handler;
812 }
813
814 if (!restore_net_info(c)) {
815 ERROR("failed restoring network info");
816 goto out_fini_handler;
817 }
818
819 resolve_clone_flags(handler);
820
821 if (pipe(pipes) < 0) {
822 SYSERROR("pipe() failed");
823 goto out_fini_handler;
824 }
825
826 pid = fork();
827 if (pid < 0)
828 goto out_fini_handler;
829
830 if (pid == 0) {
831 struct criu_opts os;
832 struct lxc_rootfs *rootfs;
833 int flags;
834
835 close(status_pipe);
836 status_pipe = -1;
837
838 close(pipes[0]);
839 pipes[0] = -1;
840
841 if (unshare(CLONE_NEWNS))
842 goto out_fini_handler;
843
844 /* CRIU needs the lxc root bind mounted so that it is the root of some
845 * mount. */
846 rootfs = &c->lxc_conf->rootfs;
847
848 if (rootfs_is_blockdev(c->lxc_conf)) {
849 if (do_rootfs_setup(c->lxc_conf, c->name, c->config_path) < 0)
850 goto out_fini_handler;
851 } else {
852 if (mkdir(rootfs->mount, 0755) < 0 && errno != EEXIST)
853 goto out_fini_handler;
854
855 if (mount(NULL, "/", NULL, MS_SLAVE | MS_REC, NULL) < 0) {
856 SYSERROR("remount / to private failed");
857 goto out_fini_handler;
858 }
859
860 if (mount(rootfs->path, rootfs->mount, NULL, MS_BIND, NULL) < 0) {
861 rmdir(rootfs->mount);
862 goto out_fini_handler;
863 }
864 }
865
866 os.pipefd = pipes[1];
867 os.action = "restore";
868 os.user = opts;
869 os.c = c;
870 os.console_fd = c->lxc_conf->console.slave;
871 os.criu_version = criu_version;
872 os.handler = handler;
873
874 if (os.console_fd >= 0) {
875 /* Twiddle the FD_CLOEXEC bit. We want to pass this FD to criu
876 * via --inherit-fd, so we don't want it to close.
877 */
878 flags = fcntl(os.console_fd, F_GETFD);
879 if (flags < 0) {
880 SYSERROR("F_GETFD failed: %d", os.console_fd);
881 goto out_fini_handler;
882 }
883
884 flags &= ~FD_CLOEXEC;
885
886 if (fcntl(os.console_fd, F_SETFD, flags) < 0) {
887 SYSERROR("F_SETFD failed");
888 goto out_fini_handler;
889 }
890 }
891 os.console_name = c->lxc_conf->console.name;
892
893 /* exec_criu() returning is an error */
894 exec_criu(&os);
895 umount(rootfs->mount);
896 rmdir(rootfs->mount);
897 goto out_fini_handler;
898 } else {
899 int ret;
900 char title[2048];
901
902 close(pipes[1]);
903 pipes[1] = -1;
904
905 pid_t w = waitpid(pid, &status, 0);
906 if (w == -1) {
907 SYSERROR("waitpid");
908 goto out_fini_handler;
909 }
910
911 if (WIFEXITED(status)) {
912 char buf[4096];
913
914 if (WEXITSTATUS(status)) {
915 int n;
916
917 n = read(pipes[0], buf, sizeof(buf));
918 if (n < 0) {
919 SYSERROR("failed reading from criu stderr");
920 goto out_fini_handler;
921 }
922
923 if (n == sizeof(buf))
924 n--;
925 buf[n] = 0;
926
927 ERROR("criu process exited %d, output:\n%s", WEXITSTATUS(status), buf);
928 goto out_fini_handler;
929 } else {
930 ret = snprintf(buf, sizeof(buf), "/proc/self/task/%lu/children", (unsigned long)syscall(__NR_gettid));
931 if (ret < 0 || ret >= sizeof(buf)) {
932 ERROR("snprintf'd too many characters: %d", ret);
933 goto out_fini_handler;
934 }
935
936 FILE *f = fopen(buf, "r");
937 if (!f) {
938 SYSERROR("couldn't read restore's children file %s", buf);
939 goto out_fini_handler;
940 }
941
942 ret = fscanf(f, "%d", (int*) &handler->pid);
943 fclose(f);
944 if (ret != 1) {
945 ERROR("reading restore pid failed");
946 goto out_fini_handler;
947 }
948
949 if (lxc_set_state(c->name, handler, RUNNING)) {
950 ERROR("error setting running state after restore");
951 goto out_fini_handler;
952 }
953 }
954 } else {
955 ERROR("CRIU was killed with signal %d", WTERMSIG(status));
956 goto out_fini_handler;
957 }
958
959 close(pipes[0]);
960
961 ret = write(status_pipe, &status, sizeof(status));
962 close(status_pipe);
963 status_pipe = -1;
964
965 if (sizeof(status) != ret) {
966 SYSERROR("failed to write all of status");
967 goto out_fini_handler;
968 }
969
970 /*
971 * See comment in lxcapi_start; we don't care if these
972 * fail because it's just a beauty thing. We just
973 * assign the return here to silence potential.
974 */
975 ret = snprintf(title, sizeof(title), "[lxc monitor] %s %s", c->config_path, c->name);
976 ret = setproctitle(title);
977
978 ret = lxc_poll(c->name, handler);
979 if (ret)
980 lxc_abort(c->name, handler);
981 lxc_fini(c->name, handler);
982 exit(ret);
983 }
984
985 out_fini_handler:
986 if (pipes[0] >= 0)
987 close(pipes[0]);
988 if (pipes[1] >= 0)
989 close(pipes[1]);
990
991 lxc_fini(c->name, handler);
992
993 out:
994 if (status_pipe >= 0) {
995 /* ensure getting here was a failure, e.g. if we failed to
996 * parse the child pid or something, even after a successful
997 * restore
998 */
999 if (!status)
1000 status = 1;
1001 if (write(status_pipe, &status, sizeof(status)) != sizeof(status)) {
1002 SYSERROR("writing status failed");
1003 }
1004 close(status_pipe);
1005 }
1006
1007 exit(1);
1008 }
1009
1010 static int save_tty_major_minor(char *directory, struct lxc_container *c, char *tty_id, int len)
1011 {
1012 FILE *f;
1013 char path[PATH_MAX];
1014 int ret;
1015 struct stat sb;
1016
1017 if (c->lxc_conf->console.path && !strcmp(c->lxc_conf->console.path, "none")) {
1018 tty_id[0] = 0;
1019 return 0;
1020 }
1021
1022 ret = snprintf(path, sizeof(path), "/proc/%d/root/dev/console", c->init_pid(c));
1023 if (ret < 0 || ret >= sizeof(path)) {
1024 ERROR("snprintf'd too many chacters: %d", ret);
1025 return -1;
1026 }
1027
1028 ret = stat(path, &sb);
1029 if (ret < 0) {
1030 SYSERROR("stat of %s failed", path);
1031 return -1;
1032 }
1033
1034 ret = snprintf(path, sizeof(path), "%s/tty.info", directory);
1035 if (ret < 0 || ret >= sizeof(path)) {
1036 ERROR("snprintf'd too many characters: %d", ret);
1037 return -1;
1038 }
1039
1040 ret = snprintf(tty_id, len, "tty[%llx:%llx]",
1041 (long long unsigned) sb.st_rdev,
1042 (long long unsigned) sb.st_dev);
1043 if (ret < 0 || ret >= sizeof(path)) {
1044 ERROR("snprintf'd too many characters: %d", ret);
1045 return -1;
1046 }
1047
1048 f = fopen(path, "w");
1049 if (!f) {
1050 SYSERROR("failed to open %s", path);
1051 return -1;
1052 }
1053
1054 ret = fprintf(f, "%s", tty_id);
1055 fclose(f);
1056 if (ret < 0)
1057 SYSERROR("failed to write to %s", path);
1058 return ret;
1059 }
1060
1061 /* do one of either predump or a regular dump */
1062 static bool do_dump(struct lxc_container *c, char *mode, struct migrate_opts *opts)
1063 {
1064 pid_t pid;
1065 char *criu_version = NULL;
1066 int criuout[2];
1067
1068 if (!criu_ok(c, &criu_version))
1069 return false;
1070
1071 if (pipe(criuout) < 0) {
1072 SYSERROR("pipe() failed");
1073 return false;
1074 }
1075
1076 if (mkdir_p(opts->directory, 0700) < 0)
1077 goto fail;
1078
1079 pid = fork();
1080 if (pid < 0) {
1081 SYSERROR("fork failed");
1082 goto fail;
1083 }
1084
1085 if (pid == 0) {
1086 struct criu_opts os;
1087 struct lxc_handler h;
1088
1089 close(criuout[0]);
1090
1091 h.name = c->name;
1092 if (!cgroup_init(&h)) {
1093 ERROR("failed to cgroup_init()");
1094 exit(1);
1095 }
1096
1097 os.pipefd = criuout[1];
1098 os.action = mode;
1099 os.user = opts;
1100 os.c = c;
1101 os.console_name = c->lxc_conf->console.path;
1102 os.criu_version = criu_version;
1103
1104 if (save_tty_major_minor(opts->directory, c, os.tty_id, sizeof(os.tty_id)) < 0)
1105 exit(1);
1106
1107 /* exec_criu() returning is an error */
1108 exec_criu(&os);
1109 exit(1);
1110 } else {
1111 int status;
1112 ssize_t n;
1113 char buf[4096];
1114 bool ret;
1115
1116 close(criuout[1]);
1117
1118 pid_t w = waitpid(pid, &status, 0);
1119 if (w == -1) {
1120 SYSERROR("waitpid");
1121 close(criuout[0]);
1122 return false;
1123 }
1124
1125 n = read(criuout[0], buf, sizeof(buf));
1126 close(criuout[0]);
1127 if (n < 0) {
1128 SYSERROR("read");
1129 n = 0;
1130 }
1131 buf[n] = 0;
1132
1133 if (WIFEXITED(status)) {
1134 if (WEXITSTATUS(status)) {
1135 ERROR("dump failed with %d", WEXITSTATUS(status));
1136 ret = false;
1137 } else {
1138 ret = true;
1139 }
1140 } else if (WIFSIGNALED(status)) {
1141 ERROR("dump signaled with %d", WTERMSIG(status));
1142 ret = false;
1143 } else {
1144 ERROR("unknown dump exit %d", status);
1145 ret = false;
1146 }
1147
1148 if (!ret)
1149 ERROR("criu output: %s", buf);
1150 return ret;
1151 }
1152 fail:
1153 close(criuout[0]);
1154 close(criuout[1]);
1155 rmdir(opts->directory);
1156 return false;
1157 }
1158
1159 bool __criu_pre_dump(struct lxc_container *c, struct migrate_opts *opts)
1160 {
1161 return do_dump(c, "pre-dump", opts);
1162 }
1163
1164 bool __criu_dump(struct lxc_container *c, struct migrate_opts *opts)
1165 {
1166 char path[PATH_MAX];
1167 int ret;
1168
1169 ret = snprintf(path, sizeof(path), "%s/inventory.img", opts->directory);
1170 if (ret < 0 || ret >= sizeof(path))
1171 return false;
1172
1173 if (access(path, F_OK) == 0) {
1174 ERROR("please use a fresh directory for the dump directory");
1175 return false;
1176 }
1177
1178 return do_dump(c, "dump", opts);
1179 }
1180
1181 bool __criu_restore(struct lxc_container *c, struct migrate_opts *opts)
1182 {
1183 pid_t pid;
1184 int status, nread;
1185 int pipefd[2];
1186 char *criu_version = NULL;
1187
1188 if (!criu_ok(c, &criu_version))
1189 return false;
1190
1191 if (geteuid()) {
1192 ERROR("Must be root to restore");
1193 return false;
1194 }
1195
1196 if (pipe(pipefd)) {
1197 ERROR("failed to create pipe");
1198 return false;
1199 }
1200
1201 pid = fork();
1202 if (pid < 0) {
1203 close(pipefd[0]);
1204 close(pipefd[1]);
1205 return false;
1206 }
1207
1208 if (pid == 0) {
1209 close(pipefd[0]);
1210 // this never returns
1211 do_restore(c, pipefd[1], opts, criu_version);
1212 }
1213
1214 close(pipefd[1]);
1215
1216 nread = read(pipefd[0], &status, sizeof(status));
1217 close(pipefd[0]);
1218 if (sizeof(status) != nread) {
1219 ERROR("reading status from pipe failed");
1220 goto err_wait;
1221 }
1222
1223 // If the criu process was killed or exited nonzero, wait() for the
1224 // handler, since the restore process died. Otherwise, we don't need to
1225 // wait, since the child becomes the monitor process.
1226 if (!WIFEXITED(status) || WEXITSTATUS(status))
1227 goto err_wait;
1228 return true;
1229
1230 err_wait:
1231 if (wait_for_pid(pid))
1232 ERROR("restore process died");
1233 return false;
1234 }
LXC mirror