]> git.proxmox.com Git - mirror_lxc.git/blob - src/lxc/lxccontainer.c
projects / mirror_lxc.git / blob
? search:


253f07f68316f518e0a8b2381c0aef7627f028d4
[mirror_lxc.git] / src / lxc / lxccontainer.c
1 /* liblxcapi
2 *
3 * Copyright © 2012 Serge Hallyn <serge.hallyn@ubuntu.com>.
4 * Copyright © 2012 Canonical Ltd.
5 *
6 * This library is free software; you can redistribute it and/or
7 * modify it under the terms of the GNU Lesser General Public
8 * License as published by the Free Software Foundation; either
9 * version 2.1 of the License, or (at your option) any later version.
10
11 * This library is distributed in the hope that it will be useful,
12 * but WITHOUT ANY WARRANTY; without even the implied warranty of
13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
14 * Lesser General Public License for more details.
15
16 * You should have received a copy of the GNU Lesser General Public
17 * License along with this library; if not, write to the Free Software
18 * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
19 */
20
21 #ifndef _GNU_SOURCE
22 #define _GNU_SOURCE 1
23 #endif
24 #include <arpa/inet.h>
25 #include <dirent.h>
26 #include <errno.h>
27 #include <fcntl.h>
28 #include <grp.h>
29 #include <libgen.h>
30 #include <pthread.h>
31 #include <sched.h>
32 #include <stdarg.h>
33 #include <stdint.h>
34 #include <stdio.h>
35 #include <stdlib.h>
36 #include <sys/file.h>
37 #include <sys/mman.h>
38 #include <sys/mount.h>
39 #include <sys/stat.h>
40 #include <sys/syscall.h>
41 #include <sys/sysmacros.h>
42 #include <sys/types.h>
43 #include <sys/wait.h>
44 #include <unistd.h>
45
46 #include "../include/netns_ifaddrs.h"
47 #include "af_unix.h"
48 #include "api_extensions.h"
49 #include "attach.h"
50 #include "cgroup.h"
51 #include "commands.h"
52 #include "commands_utils.h"
53 #include "conf.h"
54 #include "config.h"
55 #include "confile.h"
56 #include "confile_utils.h"
57 #include "criu.h"
58 #include "error.h"
59 #include "initutils.h"
60 #include "log.h"
61 #include "lxc.h"
62 #include "lxccontainer.h"
63 #include "lxclock.h"
64 #include "memory_utils.h"
65 #include "monitor.h"
66 #include "namespace.h"
67 #include "network.h"
68 #include "parse.h"
69 #include "raw_syscalls.h"
70 #include "start.h"
71 #include "state.h"
72 #include "storage.h"
73 #include "storage/btrfs.h"
74 #include "storage/overlay.h"
75 #include "storage_utils.h"
76 #include "sync.h"
77 #include "syscall_wrappers.h"
78 #include "terminal.h"
79 #include "utils.h"
80 #include "version.h"
81
82 /* major()/minor() */
83 #ifdef MAJOR_IN_MKDEV
84 #include <sys/mkdev.h>
85 #endif
86
87 #if IS_BIONIC
88 #include <../include/lxcmntent.h>
89 #else
90 #include <mntent.h>
91 #endif
92
93 #ifndef HAVE_STRLCPY
94 #include "include/strlcpy.h"
95 #endif
96
97 /* Define faccessat() if missing from the C library */
98 #ifndef HAVE_FACCESSAT
99 static int faccessat(int __fd, const char *__file, int __type, int __flag)
100 {
101 #ifdef __NR_faccessat
102 return syscall(__NR_faccessat, __fd, __file, __type, __flag);
103 #else
104 errno = ENOSYS;
105 return -1;
106 #endif
107 }
108 #endif
109
110 lxc_log_define(lxccontainer, lxc);
111
112 static bool do_lxcapi_destroy(struct lxc_container *c);
113 static const char *lxcapi_get_config_path(struct lxc_container *c);
114 #define do_lxcapi_get_config_path(c) lxcapi_get_config_path(c)
115 static bool do_lxcapi_set_config_item(struct lxc_container *c, const char *key, const char *v);
116 static bool container_destroy(struct lxc_container *c,
117 struct lxc_storage *storage);
118 static bool get_snappath_dir(struct lxc_container *c, char *snappath);
119 static bool lxcapi_snapshot_destroy_all(struct lxc_container *c);
120 static bool do_lxcapi_save_config(struct lxc_container *c, const char *alt_file);
121
122 static bool config_file_exists(const char *lxcpath, const char *cname)
123 {
124 __do_free char *fname = NULL;
125 int ret;
126 size_t len;
127
128 /* $lxcpath + '/' + $cname + '/config' + \0 */
129 len = strlen(lxcpath) + strlen(cname) + 9;
130 fname = must_realloc(NULL, len);
131 ret = snprintf(fname, len, "%s/%s/config", lxcpath, cname);
132 if (ret < 0 || (size_t)ret >= len)
133 return false;
134
135 return file_exists(fname);
136 }
137
138 /*
139 * A few functions to help detect when a container creation failed. If a
140 * container creation was killed partway through, then trying to actually start
141 * that container could harm the host. We detect this by creating a 'partial'
142 * file under the container directory, and keeping an advisory lock. When
143 * container creation completes, we remove that file. When we load or try to
144 * start a container, if we find that file, without a flock, we remove the
145 * container.
146 */
147 enum {
148 LXC_CREATE_FAILED = -1,
149 LXC_CREATE_SUCCESS = 0,
150 LXC_CREATE_ONGOING = 1,
151 LXC_CREATE_INCOMPLETE = 2,
152 };
153
154 static int ongoing_create(struct lxc_container *c)
155 {
156 __do_close_prot_errno int fd = -EBADF;
157 __do_free char *path = NULL;
158 struct flock lk = {0};
159 int ret;
160 size_t len;
161
162 len = strlen(c->config_path) + strlen(c->name) + 10;
163 path = must_realloc(NULL, len);
164 ret = snprintf(path, len, "%s/%s/partial", c->config_path, c->name);
165 if (ret < 0 || (size_t)ret >= len)
166 return LXC_CREATE_FAILED;
167
168 fd = open(path, O_RDWR | O_CLOEXEC);
169 if (fd < 0) {
170 if (errno != ENOENT)
171 return LXC_CREATE_FAILED;
172
173 return LXC_CREATE_SUCCESS;
174 }
175
176 lk.l_type = F_WRLCK;
177 lk.l_whence = SEEK_SET;
178 /*
179 * F_OFD_GETLK requires that l_pid be set to 0 otherwise the kernel
180 * will EINVAL us.
181 */
182 lk.l_pid = 0;
183
184 ret = fcntl(fd, F_OFD_GETLK, &lk);
185 if (ret < 0 && errno == EINVAL) {
186 ret = flock(fd, LOCK_EX | LOCK_NB);
187 if (ret < 0 && errno == EWOULDBLOCK)
188 ret = 0;
189 }
190
191 /* F_OFD_GETLK will not send us back a pid so don't check it. */
192 if (ret == 0)
193 /* Create is still ongoing. */
194 return LXC_CREATE_ONGOING;
195
196 /* Create completed but partial is still there. */
197 return LXC_CREATE_INCOMPLETE;
198 }
199
200 static int create_partial(struct lxc_container *c)
201 {
202 __do_free char *path = NULL;
203 int fd, ret;
204 size_t len;
205 struct flock lk = {0};
206
207 /* $lxcpath + '/' + $name + '/partial' + \0 */
208 len = strlen(c->config_path) + strlen(c->name) + 10;
209 path = must_realloc(NULL, len);
210 ret = snprintf(path, len, "%s/%s/partial", c->config_path, c->name);
211 if (ret < 0 || (size_t)ret >= len)
212 return -1;
213
214 fd = open(path, O_RDWR | O_CREAT | O_EXCL | O_CLOEXEC, 0000);
215 if (fd < 0)
216 return -1;
217
218 lk.l_type = F_WRLCK;
219 lk.l_whence = SEEK_SET;
220
221 ret = fcntl(fd, F_OFD_SETLKW, &lk);
222 if (ret < 0) {
223 if (errno == EINVAL) {
224 ret = flock(fd, LOCK_EX);
225 if (ret == 0)
226 return fd;
227 }
228
229 SYSERROR("Failed to lock partial file %s", path);
230 close(fd);
231 return -1;
232 }
233
234 return fd;
235 }
236
237 static void remove_partial(struct lxc_container *c, int fd)
238 {
239 __do_free char *path = NULL;
240 int ret;
241 size_t len;
242
243 close(fd);
244
245 /* $lxcpath + '/' + $name + '/partial' + \0 */
246 len = strlen(c->config_path) + strlen(c->name) + 10;
247 path = must_realloc(NULL, len);
248 ret = snprintf(path, len, "%s/%s/partial", c->config_path, c->name);
249 if (ret < 0 || (size_t)ret >= len)
250 return;
251
252 ret = unlink(path);
253 if (ret < 0)
254 SYSERROR("Failed to remove partial file %s", path);
255 }
256
257 /* LOCKING
258 * 1. container_mem_lock(c) protects the struct lxc_container from multiple threads.
259 * 2. container_disk_lock(c) protects the on-disk container data - in particular the
260 * container configuration file.
261 * The container_disk_lock also takes the container_mem_lock.
262 * 3. thread_mutex protects process data (ex: fd table) from multiple threads.
263 * NOTHING mutexes two independent programs with their own struct
264 * lxc_container for the same c->name, between API calls. For instance,
265 * c->config_read(); c->start(); Between those calls, data on disk
266 * could change (which shouldn't bother the caller unless for instance
267 * the rootfs get moved). c->config_read(); update; c->config_write();
268 * Two such updaters could race. The callers should therefore check their
269 * results. Trying to prevent that would necessarily expose us to deadlocks
270 * due to hung callers. So I prefer to keep the locks only within our own
271 * functions, not across functions.
272 *
273 * If you're going to clone while holding a lxccontainer, increment
274 * c->numthreads (under privlock) before forking. When deleting,
275 * decrement numthreads under privlock, then if it hits 0 you can delete.
276 * Do not ever use a lxccontainer whose numthreads you did not bump.
277 */
278 static void lxc_container_free(struct lxc_container *c)
279 {
280 if (!c)
281 return;
282
283 free(c->configfile);
284 c->configfile = NULL;
285
286 free(c->error_string);
287 c->error_string = NULL;
288
289 if (c->slock) {
290 lxc_putlock(c->slock);
291 c->slock = NULL;
292 }
293
294 if (c->privlock) {
295 lxc_putlock(c->privlock);
296 c->privlock = NULL;
297 }
298
299 free(c->name);
300 c->name = NULL;
301
302 if (c->lxc_conf) {
303 lxc_conf_free(c->lxc_conf);
304 c->lxc_conf = NULL;
305 }
306
307 free(c->config_path);
308 c->config_path = NULL;
309
310 free(c);
311 }
312
313 /* Consider the following case:
314 *
315 * |====================================================================|
316 * | freer | racing get()er |
317 * |====================================================================|
318 * | lxc_container_put() | lxc_container_get() |
319 * | \ lxclock(c->privlock) | c->numthreads < 1? (no) |
320 * | \ c->numthreads = 0 | \ lxclock(c->privlock) -> waits |
321 * | \ lxcunlock() | \ |
322 * | \ lxc_container_free() | \ lxclock() returns |
323 * | | \ c->numthreads < 1 -> return 0 |
324 * | \ \ (free stuff) | |
325 * | \ \ sem_destroy(privlock) | |
326 * |_______________________________|____________________________________|
327 *
328 * When the get()er checks numthreads the first time, one of the following
329 * is true:
330 * 1. freer has set numthreads = 0. get() returns 0
331 * 2. freer is between lxclock and setting numthreads to 0. get()er will
332 * sem_wait on privlock, get lxclock after freer() drops it, then see
333 * numthreads is 0 and exit without touching lxclock again..
334 * 3. freer has not yet locked privlock. If get()er runs first, then put()er
335 * will see --numthreads = 1 and not call lxc_container_free().
336 */
337
338 int lxc_container_get(struct lxc_container *c)
339 {
340 if (!c)
341 return 0;
342
343 /* If someone else has already started freeing the container, don't try
344 * to take the lock, which may be invalid.
345 */
346 if (c->numthreads < 1)
347 return 0;
348
349 if (container_mem_lock(c))
350 return 0;
351
352 /* Bail without trying to unlock, bc the privlock is now probably in
353 * freed memory.
354 */
355 if (c->numthreads < 1)
356 return 0;
357
358 c->numthreads++;
359 container_mem_unlock(c);
360
361 return 1;
362 }
363
364 int lxc_container_put(struct lxc_container *c)
365 {
366 if (!c)
367 return -1;
368
369 if (container_mem_lock(c))
370 return -1;
371
372 c->numthreads--;
373
374 if (c->numthreads < 1) {
375 container_mem_unlock(c);
376 lxc_container_free(c);
377 return 1;
378 }
379
380 container_mem_unlock(c);
381 return 0;
382 }
383
384 static bool do_lxcapi_is_defined(struct lxc_container *c)
385 {
386 int statret;
387 struct stat statbuf;
388 bool ret = false;
389
390 if (!c)
391 return false;
392
393 if (container_mem_lock(c))
394 return false;
395
396 if (!c->configfile)
397 goto on_error;
398
399 statret = stat(c->configfile, &statbuf);
400 if (statret != 0)
401 goto on_error;
402
403 ret = true;
404
405 on_error:
406 container_mem_unlock(c);
407 return ret;
408 }
409
410 #define WRAP_API(rettype, fnname) \
411 static rettype fnname(struct lxc_container *c) \
412 { \
413 rettype ret; \
414 bool reset_config = false; \
415 \
416 if (!current_config && c && c->lxc_conf) { \
417 current_config = c->lxc_conf; \
418 reset_config = true; \
419 } \
420 \
421 ret = do_##fnname(c); \
422 if (reset_config) \
423 current_config = NULL; \
424 \
425 return ret; \
426 }
427
428 #define WRAP_API_1(rettype, fnname, t1) \
429 static rettype fnname(struct lxc_container *c, t1 a1) \
430 { \
431 rettype ret; \
432 bool reset_config = false; \
433 \
434 if (!current_config && c && c->lxc_conf) { \
435 current_config = c->lxc_conf; \
436 reset_config = true; \
437 } \
438 \
439 ret = do_##fnname(c, a1); \
440 if (reset_config) \
441 current_config = NULL; \
442 \
443 return ret; \
444 }
445
446 #define WRAP_API_2(rettype, fnname, t1, t2) \
447 static rettype fnname(struct lxc_container *c, t1 a1, t2 a2) \
448 { \
449 rettype ret; \
450 bool reset_config = false; \
451 \
452 if (!current_config && c && c->lxc_conf) { \
453 current_config = c->lxc_conf; \
454 reset_config = true; \
455 } \
456 \
457 ret = do_##fnname(c, a1, a2); \
458 if (reset_config) \
459 current_config = NULL; \
460 \
461 return ret; \
462 }
463
464 #define WRAP_API_3(rettype, fnname, t1, t2, t3) \
465 static rettype fnname(struct lxc_container *c, t1 a1, t2 a2, t3 a3) \
466 { \
467 rettype ret; \
468 bool reset_config = false; \
469 \
470 if (!current_config && c && c->lxc_conf) { \
471 current_config = c->lxc_conf; \
472 reset_config = true; \
473 } \
474 \
475 ret = do_##fnname(c, a1, a2, a3); \
476 if (reset_config) \
477 current_config = NULL; \
478 \
479 return ret; \
480 }
481
482 #define WRAP_API_6(rettype, fnname, t1, t2, t3, t4, t5, t6) \
483 static rettype fnname(struct lxc_container *c, t1 a1, t2 a2, t3 a3, \
484 t4 a4, t5 a5, t6 a6) \
485 { \
486 rettype ret; \
487 bool reset_config = false; \
488 \
489 if (!current_config && c && c->lxc_conf) { \
490 current_config = c->lxc_conf; \
491 reset_config = true; \
492 } \
493 \
494 ret = do_##fnname(c, a1, a2, a3, a4, a5, a6); \
495 if (reset_config) \
496 current_config = NULL; \
497 \
498 return ret; \
499 }
500
501 WRAP_API(bool, lxcapi_is_defined)
502
503 static const char *do_lxcapi_state(struct lxc_container *c)
504 {
505 lxc_state_t s;
506
507 if (!c)
508 return NULL;
509
510 s = lxc_getstate(c->name, c->config_path);
511 return lxc_state2str(s);
512 }
513
514 WRAP_API(const char *, lxcapi_state)
515
516 static bool is_stopped(struct lxc_container *c)
517 {
518 lxc_state_t s;
519
520 s = lxc_getstate(c->name, c->config_path);
521 return (s == STOPPED);
522 }
523
524 static bool do_lxcapi_is_running(struct lxc_container *c)
525 {
526 if (!c)
527 return false;
528
529 return !is_stopped(c);
530 }
531
532 WRAP_API(bool, lxcapi_is_running)
533
534 static bool do_lxcapi_freeze(struct lxc_container *c)
535 {
536 lxc_state_t s;
537
538 if (!c || !c->lxc_conf)
539 return false;
540
541 s = lxc_getstate(c->name, c->config_path);
542 if (s != FROZEN)
543 return lxc_freeze(c->lxc_conf, c->name, c->config_path) == 0;
544
545 return true;
546 }
547
548 WRAP_API(bool, lxcapi_freeze)
549
550 static bool do_lxcapi_unfreeze(struct lxc_container *c)
551 {
552 lxc_state_t s;
553
554 if (!c || !c->lxc_conf)
555 return false;
556
557 s = lxc_getstate(c->name, c->config_path);
558 if (s == FROZEN)
559 return lxc_unfreeze(c->lxc_conf, c->name, c->config_path) == 0;
560
561 return true;
562 }
563
564 WRAP_API(bool, lxcapi_unfreeze)
565
566 static int do_lxcapi_console_getfd(struct lxc_container *c, int *ttynum, int *masterfd)
567 {
568 if (!c)
569 return -1;
570
571 return lxc_terminal_getfd(c, ttynum, masterfd);
572 }
573
574 WRAP_API_2(int, lxcapi_console_getfd, int *, int *)
575
576 static int lxcapi_console(struct lxc_container *c, int ttynum, int stdinfd,
577 int stdoutfd, int stderrfd, int escape)
578 {
579 int ret;
580
581 if (!c)
582 return -1;
583
584 current_config = c->lxc_conf;
585 ret = lxc_console(c, ttynum, stdinfd, stdoutfd, stderrfd, escape);
586 current_config = NULL;
587
588 return ret;
589 }
590
591 static int do_lxcapi_console_log(struct lxc_container *c, struct lxc_console_log *log)
592 {
593 int ret;
594
595 if (!c)
596 return -EINVAL;
597
598 ret = lxc_cmd_console_log(c->name, do_lxcapi_get_config_path(c), log);
599 if (ret < 0) {
600 if (ret == -ENODATA)
601 NOTICE("The console log is empty");
602 else if (ret == -EFAULT)
603 NOTICE("The container does not keep a console log");
604 else if (ret == -ENOENT)
605 NOTICE("The container does not keep a console log file");
606 else if (ret == -EIO)
607 NOTICE("Failed to write console log to log file");
608 else
609 ERROR("Failed to retrieve console log");
610 }
611
612 return ret;
613 }
614
615 WRAP_API_1(int, lxcapi_console_log, struct lxc_console_log *)
616
617 static pid_t do_lxcapi_init_pid(struct lxc_container *c)
618 {
619 if (!c)
620 return -1;
621
622 return lxc_cmd_get_init_pid(c->name, c->config_path);
623 }
624
625 WRAP_API(pid_t, lxcapi_init_pid)
626
627 static bool load_config_locked(struct lxc_container *c, const char *fname)
628 {
629 if (!c->lxc_conf)
630 c->lxc_conf = lxc_conf_init();
631
632 if (!c->lxc_conf)
633 return false;
634
635 if (lxc_config_read(fname, c->lxc_conf, false) != 0)
636 return false;
637
638 c->lxc_conf->name = c->name;
639 return true;
640 }
641
642 static bool do_lxcapi_load_config(struct lxc_container *c, const char *alt_file)
643 {
644 int lret;
645 const char *fname;
646 bool need_disklock = false, ret = false;
647
648 if (!c)
649 return false;
650
651 fname = c->configfile;
652
653 if (alt_file)
654 fname = alt_file;
655
656 if (!fname)
657 return false;
658
659 /* If we're reading something other than the container's config, we only
660 * need to lock the in-memory container. If loading the container's
661 * config file, take the disk lock.
662 */
663 if (strcmp(fname, c->configfile) == 0)
664 need_disklock = true;
665
666 if (need_disklock)
667 lret = container_disk_lock(c);
668 else
669 lret = container_mem_lock(c);
670 if (lret)
671 return false;
672
673 ret = load_config_locked(c, fname);
674
675 if (need_disklock)
676 container_disk_unlock(c);
677 else
678 container_mem_unlock(c);
679
680 return ret;
681 }
682
683 WRAP_API_1(bool, lxcapi_load_config, const char *)
684
685 static bool do_lxcapi_want_daemonize(struct lxc_container *c, bool state)
686 {
687 if (!c || !c->lxc_conf)
688 return false;
689
690 if (container_mem_lock(c))
691 return false;
692
693 c->daemonize = state;
694
695 container_mem_unlock(c);
696
697 return true;
698 }
699
700 WRAP_API_1(bool, lxcapi_want_daemonize, bool)
701
702 static bool do_lxcapi_want_close_all_fds(struct lxc_container *c, bool state)
703 {
704 if (!c || !c->lxc_conf)
705 return false;
706
707 if (container_mem_lock(c))
708 return false;
709
710 c->lxc_conf->close_all_fds = state;
711
712 container_mem_unlock(c);
713
714 return true;
715 }
716
717 WRAP_API_1(bool, lxcapi_want_close_all_fds, bool)
718
719 static bool do_lxcapi_wait(struct lxc_container *c, const char *state,
720 int timeout)
721 {
722 int ret;
723
724 if (!c)
725 return false;
726
727 ret = lxc_wait(c->name, state, timeout, c->config_path);
728 return ret == 0;
729 }
730
731 WRAP_API_2(bool, lxcapi_wait, const char *, int)
732
733 static bool am_single_threaded(void)
734 {
735 DIR *dir;
736 struct dirent *direntp;
737 int count = 0;
738
739 dir = opendir("/proc/self/task");
740 if (!dir)
741 return false;
742
743 while ((direntp = readdir(dir))) {
744 if (strcmp(direntp->d_name, ".") == 0)
745 continue;
746
747 if (strcmp(direntp->d_name, "..") == 0)
748 continue;
749
750 count++;
751 if (count > 1)
752 break;
753 }
754 closedir(dir);
755
756 return count == 1;
757 }
758
759 static void push_arg(char ***argp, char *arg, int *nargs)
760 {
761 char *copy;
762 char **argv;
763
764 copy = must_copy_string(arg);
765
766 do {
767 argv = realloc(*argp, (*nargs + 2) * sizeof(char *));
768 } while (!argv);
769
770 *argp = argv;
771 argv[*nargs] = copy;
772 (*nargs)++;
773 argv[*nargs] = NULL;
774 }
775
776 static char **split_init_cmd(const char *incmd)
777 {
778 __do_free char *copy = NULL;
779 char *p;
780 char **argv;
781 int nargs = 0;
782
783 if (!incmd)
784 return NULL;
785
786 copy = must_copy_string(incmd);
787
788 do {
789 argv = malloc(sizeof(char *));
790 } while (!argv);
791
792 argv[0] = NULL;
793 lxc_iterate_parts (p, copy, " ")
794 push_arg(&argv, p, &nargs);
795
796 if (nargs == 0) {
797 free(argv);
798 return NULL;
799 }
800
801 return argv;
802 }
803
804 static void free_init_cmd(char **argv)
805 {
806 int i = 0;
807
808 if (!argv)
809 return;
810
811 while (argv[i])
812 free(argv[i++]);
813
814 free(argv);
815 }
816
817 static int lxc_rcv_status(int state_socket)
818 {
819 int ret;
820 int state = -1;
821
822 again:
823 /* Receive container state. */
824 ret = lxc_abstract_unix_rcv_credential(state_socket, &state, sizeof(int));
825 if (ret <= 0) {
826 if (errno != EINTR)
827 return -1;
828
829 TRACE("Caught EINTR; retrying");
830 goto again;
831 }
832
833 return state;
834 }
835
836 static bool wait_on_daemonized_start(struct lxc_handler *handler, int pid)
837 {
838 int ret, state;
839
840 /* Close write end of the socket pair. */
841 close(handler->state_socket_pair[1]);
842 handler->state_socket_pair[1] = -1;
843
844 state = lxc_rcv_status(handler->state_socket_pair[0]);
845
846 /* Close read end of the socket pair. */
847 close(handler->state_socket_pair[0]);
848 handler->state_socket_pair[0] = -1;
849
850 /* The first child is going to fork() again and then exits. So we reap
851 * the first child here.
852 */
853 ret = wait_for_pid(pid);
854 if (ret < 0)
855 DEBUG("Failed waiting on first child %d", pid);
856 else
857 DEBUG("First child %d exited", pid);
858
859 if (state < 0) {
860 SYSERROR("Failed to receive the container state");
861 return false;
862 }
863
864 /* If we receive anything else then running we know that the container
865 * failed to start.
866 */
867 if (state != RUNNING) {
868 ERROR("Received container state \"%s\" instead of \"RUNNING\"",
869 lxc_state2str(state));
870 return false;
871 }
872
873 TRACE("Container is in \"RUNNING\" state");
874 return true;
875 }
876
877 static bool do_lxcapi_start(struct lxc_container *c, int useinit, char * const argv[])
878 {
879 int ret;
880 struct lxc_handler *handler;
881 struct lxc_conf *conf;
882 char *default_args[] = {
883 "/sbin/init",
884 NULL,
885 };
886 char **init_cmd = NULL;
887 int keepfds[3] = {-1, -1, -1};
888
889 /* container does exist */
890 if (!c)
891 return false;
892
893 /* If anything fails before we set error_num, we want an error in there.
894 */
895 c->error_num = 1;
896
897 /* Container has not been setup. */
898 if (!c->lxc_conf)
899 return false;
900
901 ret = ongoing_create(c);
902 switch (ret) {
903 case LXC_CREATE_FAILED:
904 ERROR("Failed checking for incomplete container creation");
905 return false;
906 case LXC_CREATE_ONGOING:
907 ERROR("Ongoing container creation detected");
908 return false;
909 case LXC_CREATE_INCOMPLETE:
910 ERROR("Failed to create container");
911 do_lxcapi_destroy(c);
912 return false;
913 }
914
915 if (container_mem_lock(c))
916 return false;
917
918 conf = c->lxc_conf;
919
920 /* initialize handler */
921 handler = lxc_init_handler(c->name, conf, c->config_path, c->daemonize);
922
923 container_mem_unlock(c);
924 if (!handler)
925 return false;
926
927 if (!argv) {
928 if (useinit && conf->execute_cmd)
929 argv = init_cmd = split_init_cmd(conf->execute_cmd);
930 else
931 argv = init_cmd = split_init_cmd(conf->init_cmd);
932 }
933
934 /* ... otherwise use default_args. */
935 if (!argv) {
936 if (useinit) {
937 ERROR("No valid init detected");
938 lxc_free_handler(handler);
939 return false;
940 }
941 argv = default_args;
942 }
943
944 /* I'm not sure what locks we want here.Any? Is liblxc's locking enough
945 * here to protect the on disk container? We don't want to exclude
946 * things like lxc_info while the container is running.
947 */
948 if (c->daemonize) {
949 bool started;
950 char title[2048];
951 pid_t pid;
952
953 pid = fork();
954 if (pid < 0) {
955 free_init_cmd(init_cmd);
956 lxc_free_handler(handler);
957 return false;
958 }
959
960 /* first parent */
961 if (pid != 0) {
962 /* Set to NULL because we don't want father unlink
963 * the PID file, child will do the free and unlink.
964 */
965 c->pidfile = NULL;
966
967 /* Wait for container to tell us whether it started
968 * successfully.
969 */
970 started = wait_on_daemonized_start(handler, pid);
971
972 free_init_cmd(init_cmd);
973 lxc_free_handler(handler);
974 return started;
975 }
976
977 /* first child */
978
979 /* We don't really care if this doesn't print all the
980 * characters. All that it means is that the proctitle will be
981 * ugly. Similarly, we also don't care if setproctitle() fails.
982 */
983 ret = snprintf(title, sizeof(title), "[lxc monitor] %s %s", c->config_path, c->name);
984 if (ret > 0) {
985 ret = setproctitle(title);
986 if (ret < 0)
987 INFO("Failed to set process title to %s", title);
988 else
989 INFO("Set process title to %s", title);
990 }
991
992 /* We fork() a second time to be reparented to init. Like
993 * POSIX's daemon() function we change to "/" and redirect
994 * std{in,out,err} to /dev/null.
995 */
996 pid = fork();
997 if (pid < 0) {
998 SYSERROR("Failed to fork first child process");
999 _exit(EXIT_FAILURE);
1000 }
1001
1002 /* second parent */
1003 if (pid != 0) {
1004 free_init_cmd(init_cmd);
1005 lxc_free_handler(handler);
1006 _exit(EXIT_SUCCESS);
1007 }
1008
1009 /* second child */
1010
1011 /* change to / directory */
1012 ret = chdir("/");
1013 if (ret < 0) {
1014 SYSERROR("Failed to change to \"/\" directory");
1015 _exit(EXIT_FAILURE);
1016 }
1017
1018 keepfds[0] = handler->conf->maincmd_fd;
1019 keepfds[1] = handler->state_socket_pair[0];
1020 keepfds[2] = handler->state_socket_pair[1];
1021 ret = lxc_check_inherited(conf, true, keepfds,
1022 sizeof(keepfds) / sizeof(keepfds[0]));
1023 if (ret < 0)
1024 _exit(EXIT_FAILURE);
1025
1026 /* redirect std{in,out,err} to /dev/null */
1027 ret = null_stdfds();
1028 if (ret < 0) {
1029 ERROR("Failed to redirect std{in,out,err} to /dev/null");
1030 _exit(EXIT_FAILURE);
1031 }
1032
1033 /* become session leader */
1034 ret = setsid();
1035 if (ret < 0)
1036 TRACE("Process %d is already process group leader", lxc_raw_getpid());
1037 } else if (!am_single_threaded()) {
1038 ERROR("Cannot start non-daemonized container when threaded");
1039 free_init_cmd(init_cmd);
1040 lxc_free_handler(handler);
1041 return false;
1042 }
1043
1044 /* We need to write PID file after daemonize, so we always write the
1045 * right PID.
1046 */
1047 if (c->pidfile) {
1048 int w;
1049 char pidstr[INTTYPE_TO_STRLEN(pid_t)];
1050
1051 w = snprintf(pidstr, sizeof(pidstr), "%d", lxc_raw_getpid());
1052 if (w < 0 || (size_t)w >= sizeof(pidstr)) {
1053 free_init_cmd(init_cmd);
1054 lxc_free_handler(handler);
1055
1056 SYSERROR("Failed to write monitor pid to \"%s\"", c->pidfile);
1057
1058 if (c->daemonize)
1059 _exit(EXIT_FAILURE);
1060
1061 return false;
1062 }
1063
1064 ret = lxc_write_to_file(c->pidfile, pidstr, w, false, 0600);
1065 if (ret < 0) {
1066 free_init_cmd(init_cmd);
1067 lxc_free_handler(handler);
1068
1069 SYSERROR("Failed to write monitor pid to \"%s\"", c->pidfile);
1070
1071 if (c->daemonize)
1072 _exit(EXIT_FAILURE);
1073
1074 return false;
1075 }
1076 }
1077
1078 conf->reboot = REBOOT_NONE;
1079
1080 /* Unshare the mount namespace if requested */
1081 if (conf->monitor_unshare) {
1082 ret = unshare(CLONE_NEWNS);
1083 if (ret < 0) {
1084 SYSERROR("Failed to unshare mount namespace");
1085 lxc_free_handler(handler);
1086 ret = 1;
1087 goto on_error;
1088 }
1089
1090 ret = mount(NULL, "/", NULL, MS_SLAVE|MS_REC, NULL);
1091 if (ret < 0) {
1092 SYSERROR("Failed to make / rslave at startup");
1093 lxc_free_handler(handler);
1094 ret = 1;
1095 goto on_error;
1096 }
1097 }
1098
1099 reboot:
1100 if (conf->reboot == REBOOT_INIT) {
1101 /* initialize handler */
1102 handler = lxc_init_handler(c->name, conf, c->config_path, c->daemonize);
1103 if (!handler) {
1104 ret = 1;
1105 goto on_error;
1106 }
1107 }
1108
1109 keepfds[0] = handler->conf->maincmd_fd;
1110 keepfds[1] = handler->state_socket_pair[0];
1111 keepfds[2] = handler->state_socket_pair[1];
1112 ret = lxc_check_inherited(conf, c->daemonize, keepfds,
1113 sizeof(keepfds) / sizeof(keepfds[0]));
1114 if (ret < 0) {
1115 lxc_free_handler(handler);
1116 ret = 1;
1117 goto on_error;
1118 }
1119
1120 if (useinit)
1121 ret = lxc_execute(c->name, argv, 1, handler, c->config_path,
1122 c->daemonize, &c->error_num);
1123 else
1124 ret = lxc_start(c->name, argv, handler, c->config_path,
1125 c->daemonize, &c->error_num);
1126
1127 if (conf->reboot == REBOOT_REQ) {
1128 INFO("Container requested reboot");
1129 conf->reboot = REBOOT_INIT;
1130 goto reboot;
1131 }
1132
1133 on_error:
1134 if (c->pidfile) {
1135 unlink(c->pidfile);
1136 free(c->pidfile);
1137 c->pidfile = NULL;
1138 }
1139 free_init_cmd(init_cmd);
1140
1141 if (c->daemonize && ret != 0)
1142 _exit(EXIT_FAILURE);
1143 else if (c->daemonize)
1144 _exit(EXIT_SUCCESS);
1145
1146 if (ret != 0)
1147 return false;
1148
1149 return true;
1150 }
1151
1152 static bool lxcapi_start(struct lxc_container *c, int useinit,
1153 char *const argv[])
1154 {
1155 bool ret;
1156
1157 current_config = c ? c->lxc_conf : NULL;
1158 ret = do_lxcapi_start(c, useinit, argv);
1159 current_config = NULL;
1160
1161 return ret;
1162 }
1163
1164 /* Note, there MUST be an ending NULL. */
1165 static bool lxcapi_startl(struct lxc_container *c, int useinit, ...)
1166 {
1167 va_list ap;
1168 char **inargs = NULL;
1169 bool bret = false;
1170
1171 /* container exists */
1172 if (!c)
1173 return false;
1174
1175 current_config = c->lxc_conf;
1176
1177 va_start(ap, useinit);
1178 inargs = lxc_va_arg_list_to_argv(ap, 0, 1);
1179 va_end(ap);
1180 if (!inargs)
1181 goto on_error;
1182
1183 /* pass NULL if no arguments were supplied */
1184 bret = do_lxcapi_start(c, useinit, *inargs ? inargs : NULL);
1185
1186 on_error:
1187 if (inargs) {
1188 char **arg;
1189
1190 for (arg = inargs; *arg; arg++)
1191 free(*arg);
1192 free(inargs);
1193 }
1194
1195 current_config = NULL;
1196
1197 return bret;
1198 }
1199
1200 static bool do_lxcapi_stop(struct lxc_container *c)
1201 {
1202 int ret;
1203
1204 if (!c)
1205 return false;
1206
1207 ret = lxc_cmd_stop(c->name, c->config_path);
1208
1209 return ret == 0;
1210 }
1211
1212 WRAP_API(bool, lxcapi_stop)
1213
1214 static int do_create_container_dir(const char *path, struct lxc_conf *conf)
1215 {
1216 __do_free char *p = NULL;
1217 int lasterr;
1218 int ret = -1;
1219
1220 mode_t mask = umask(0002);
1221 ret = mkdir(path, 0770);
1222 lasterr = errno;
1223 umask(mask);
1224 errno = lasterr;
1225 if (ret) {
1226 if (errno != EEXIST)
1227 return -1;
1228
1229 ret = 0;
1230 }
1231
1232 p = must_copy_string(path);
1233
1234 if (!lxc_list_empty(&conf->id_map)) {
1235 ret = chown_mapped_root(p, conf);
1236 if (ret < 0)
1237 ret = -1;
1238 }
1239
1240 return ret;
1241 }
1242
1243 /* Create the standard expected container dir. */
1244 static bool create_container_dir(struct lxc_container *c)
1245 {
1246 int ret;
1247 size_t len;
1248 char *s;
1249
1250 len = strlen(c->config_path) + strlen(c->name) + 2;
1251 s = malloc(len);
1252 if (!s)
1253 return false;
1254
1255 ret = snprintf(s, len, "%s/%s", c->config_path, c->name);
1256 if (ret < 0 || (size_t)ret >= len) {
1257 free(s);
1258 return false;
1259 }
1260
1261 ret = do_create_container_dir(s, c->lxc_conf);
1262 free(s);
1263
1264 return ret == 0;
1265 }
1266
1267 /* do_storage_create: thin wrapper around storage_create(). Like
1268 * storage_create(), it returns a mounted bdev on success, NULL on error.
1269 */
1270 static struct lxc_storage *do_storage_create(struct lxc_container *c,
1271 const char *type,
1272 struct bdev_specs *specs)
1273 {
1274 __do_free char *dest = NULL;
1275 int ret;
1276 size_t len;
1277 struct lxc_storage *bdev;
1278
1279 /* rootfs.path or lxcpath/lxcname/rootfs */
1280 if (c->lxc_conf->rootfs.path &&
1281 (access(c->lxc_conf->rootfs.path, F_OK) == 0)) {
1282 const char *rpath = c->lxc_conf->rootfs.path;
1283 len = strlen(rpath) + 1;
1284 dest = must_realloc(NULL, len);
1285 ret = snprintf(dest, len, "%s", rpath);
1286 } else {
1287 const char *lxcpath = do_lxcapi_get_config_path(c);
1288 len = strlen(c->name) + strlen(lxcpath) + 9;
1289 dest = must_realloc(NULL, len);
1290 ret = snprintf(dest, len, "%s/%s/rootfs", lxcpath, c->name);
1291 }
1292 if (ret < 0 || (size_t)ret >= len)
1293 return NULL;
1294
1295 bdev = storage_create(dest, type, c->name, specs);
1296 if (!bdev) {
1297 ERROR("Failed to create \"%s\" storage", type);
1298 return NULL;
1299 }
1300
1301 if (!c->set_config_item(c, "lxc.rootfs.path", bdev->src)) {
1302 ERROR("Failed to set \"lxc.rootfs.path = %s\"", bdev->src);
1303 return NULL;
1304 }
1305
1306 /* If we are not root, chown the rootfs dir to root in the target user
1307 * namespace.
1308 */
1309 ret = geteuid();
1310 if (ret != 0 || (c->lxc_conf && !lxc_list_empty(&c->lxc_conf->id_map))) {
1311 ret = chown_mapped_root(bdev->dest, c->lxc_conf);
1312 if (ret < 0) {
1313 ERROR("Error chowning \"%s\" to container root", bdev->dest);
1314 suggest_default_idmap();
1315 storage_put(bdev);
1316 return NULL;
1317 }
1318 }
1319
1320 return bdev;
1321 }
1322
1323 /* Strip path and return name of file for argv[0] passed to execvp */
1324 static char *lxctemplatefilename(char *tpath)
1325 {
1326 char *p;
1327
1328 p = tpath + strlen(tpath) - 1;
1329 while ( (p-1) >= tpath && *(p-1) != '/')
1330 p--;
1331
1332 return p;
1333 }
1334
1335 static bool create_run_template(struct lxc_container *c, char *tpath,
1336 bool need_null_stdfds, char *const argv[])
1337 {
1338 int ret;
1339 pid_t pid;
1340
1341 if (!tpath)
1342 return true;
1343
1344 pid = fork();
1345 if (pid < 0) {
1346 SYSERROR("Failed to fork task for container creation template");
1347 return false;
1348 }
1349
1350 if (pid == 0) { /* child */
1351 int i, len;
1352 char *namearg, *patharg, *rootfsarg;
1353 char **newargv;
1354 int nargs = 0;
1355 struct lxc_storage *bdev = NULL;
1356 struct lxc_conf *conf = c->lxc_conf;
1357 uid_t euid;
1358
1359 if (need_null_stdfds) {
1360 ret = null_stdfds();
1361 if (ret < 0)
1362 _exit(EXIT_FAILURE);
1363 }
1364
1365 bdev = storage_init(c->lxc_conf);
1366 if (!bdev) {
1367 ERROR("Failed to initialize storage");
1368 _exit(EXIT_FAILURE);
1369 }
1370
1371 euid = geteuid();
1372 if (euid == 0) {
1373 ret = unshare(CLONE_NEWNS);
1374 if (ret < 0) {
1375 ERROR("Failed to unshare CLONE_NEWNS");
1376 _exit(EXIT_FAILURE);
1377 }
1378
1379 ret = detect_shared_rootfs();
1380 if (ret == 1) {
1381 ret = mount(NULL, "/", NULL, MS_SLAVE | MS_REC, NULL);
1382 if (ret < 0) {
1383 SYSERROR("Failed to make \"/\" rslave");
1384 ERROR("Continuing...");
1385 }
1386 }
1387 }
1388
1389 if (strcmp(bdev->type, "dir") != 0 && strcmp(bdev->type, "btrfs") != 0) {
1390 if (euid != 0) {
1391 ERROR("Unprivileged users can only create "
1392 "btrfs and directory-backed containers");
1393 _exit(EXIT_FAILURE);
1394 }
1395
1396 if (strcmp(bdev->type, "overlay") == 0 ||
1397 strcmp(bdev->type, "overlayfs") == 0) {
1398 /* If we create an overlay container we need to
1399 * rsync the contents into
1400 * <container-path>/<container-name>/rootfs.
1401 * However, the overlay mount function will
1402 * mount will mount
1403 * <container-path>/<container-name>/delta0
1404 * over
1405 * <container-path>/<container-name>/rootfs
1406 * which means we would rsync the rootfs into
1407 * the delta directory. That doesn't make sense
1408 * since the delta directory only exists to
1409 * record the differences to
1410 * <container-path>/<container-name>/rootfs. So
1411 * let's simply bind-mount here and then rsync
1412 * directly into
1413 * <container-path>/<container-name>/rootfs.
1414 */
1415 char *src;
1416
1417 src = ovl_get_rootfs(bdev->src, &(size_t){0});
1418 if (!src) {
1419 ERROR("Failed to get rootfs");
1420 _exit(EXIT_FAILURE);
1421 }
1422
1423 ret = mount(src, bdev->dest, "bind", MS_BIND | MS_REC, NULL);
1424 if (ret < 0) {
1425 ERROR("Failed to mount rootfs");
1426 _exit(EXIT_FAILURE);
1427 }
1428 } else {
1429 ret = bdev->ops->mount(bdev);
1430 if (ret < 0) {
1431 ERROR("Failed to mount rootfs");
1432 _exit(EXIT_FAILURE);
1433 }
1434 }
1435 } else { /* TODO come up with a better way here! */
1436 const char *src;
1437 free(bdev->dest);
1438 src = lxc_storage_get_path(bdev->src, bdev->type);
1439 bdev->dest = strdup(src);
1440 }
1441
1442 /* Create our new array, pre-pend the template name and base
1443 * args.
1444 */
1445 if (argv)
1446 for (nargs = 0; argv[nargs]; nargs++)
1447 ;
1448
1449 /* template, path, rootfs and name args */
1450 nargs += 4;
1451
1452 newargv = malloc(nargs * sizeof(*newargv));
1453 if (!newargv)
1454 _exit(EXIT_FAILURE);
1455 newargv[0] = lxctemplatefilename(tpath);
1456
1457 /* --path */
1458 len = strlen(c->config_path) + strlen(c->name) + strlen("--path=") + 2;
1459 patharg = malloc(len);
1460 if (!patharg)
1461 _exit(EXIT_FAILURE);
1462
1463 ret = snprintf(patharg, len, "--path=%s/%s", c->config_path, c->name);
1464 if (ret < 0 || ret >= len)
1465 _exit(EXIT_FAILURE);
1466 newargv[1] = patharg;
1467
1468 /* --name */
1469 len = strlen("--name=") + strlen(c->name) + 1;
1470 namearg = malloc(len);
1471 if (!namearg)
1472 _exit(EXIT_FAILURE);
1473
1474 ret = snprintf(namearg, len, "--name=%s", c->name);
1475 if (ret < 0 || ret >= len)
1476 _exit(EXIT_FAILURE);
1477 newargv[2] = namearg;
1478
1479 /* --rootfs */
1480 len = strlen("--rootfs=") + 1 + strlen(bdev->dest);
1481 rootfsarg = malloc(len);
1482 if (!rootfsarg)
1483 _exit(EXIT_FAILURE);
1484
1485 ret = snprintf(rootfsarg, len, "--rootfs=%s", bdev->dest);
1486 if (ret < 0 || ret >= len)
1487 _exit(EXIT_FAILURE);
1488 newargv[3] = rootfsarg;
1489
1490 /* add passed-in args */
1491 if (argv)
1492 for (i = 4; i < nargs; i++)
1493 newargv[i] = argv[i - 4];
1494
1495 /* add trailing NULL */
1496 nargs++;
1497 newargv = realloc(newargv, nargs * sizeof(*newargv));
1498 if (!newargv)
1499 _exit(EXIT_FAILURE);
1500 newargv[nargs - 1] = NULL;
1501
1502 /* If we're running the template in a mapped userns, then we
1503 * prepend the template command with: lxc-usernsexec <-m map1>
1504 * ... <-m mapn> -- and we append "--mapped-uid x", where x is
1505 * the mapped uid for our geteuid()
1506 */
1507 if (!lxc_list_empty(&conf->id_map)) {
1508 int extraargs, hostuid_mapped, hostgid_mapped;
1509 char **n2;
1510 char txtuid[20], txtgid[20];
1511 struct lxc_list *it;
1512 struct id_map *map;
1513 int n2args = 1;
1514
1515 n2 = malloc(n2args * sizeof(*n2));
1516 if (!n2)
1517 _exit(EXIT_FAILURE);
1518
1519 newargv[0] = tpath;
1520 tpath = "lxc-usernsexec";
1521 n2[0] = "lxc-usernsexec";
1522
1523 lxc_list_for_each(it, &conf->id_map) {
1524 map = it->elem;
1525 n2args += 2;
1526 n2 = realloc(n2, n2args * sizeof(char *));
1527 if (!n2)
1528 _exit(EXIT_FAILURE);
1529
1530 n2[n2args - 2] = "-m";
1531 n2[n2args - 1] = malloc(200);
1532 if (!n2[n2args - 1])
1533 _exit(EXIT_FAILURE);
1534
1535 ret = snprintf(n2[n2args - 1], 200, "%c:%lu:%lu:%lu",
1536 map->idtype == ID_TYPE_UID ? 'u' : 'g',
1537 map->nsid, map->hostid, map->range);
1538 if (ret < 0 || ret >= 200)
1539 _exit(EXIT_FAILURE);
1540 }
1541
1542 hostuid_mapped = mapped_hostid(geteuid(), conf, ID_TYPE_UID);
1543 extraargs = hostuid_mapped >= 0 ? 1 : 3;
1544
1545 n2 = realloc(n2, (nargs + n2args + extraargs) * sizeof(char *));
1546 if (!n2)
1547 _exit(EXIT_FAILURE);
1548
1549 if (hostuid_mapped < 0) {
1550 hostuid_mapped = find_unmapped_nsid(conf, ID_TYPE_UID);
1551 n2[n2args++] = "-m";
1552 if (hostuid_mapped < 0) {
1553 ERROR("Failed to find free uid to map");
1554 _exit(EXIT_FAILURE);
1555 }
1556
1557 n2[n2args++] = malloc(200);
1558 if (!n2[n2args - 1]) {
1559 SYSERROR("out of memory");
1560 _exit(EXIT_FAILURE);
1561 }
1562
1563 ret = snprintf(n2[n2args - 1], 200, "u:%d:%d:1",
1564 hostuid_mapped, geteuid());
1565 if (ret < 0 || ret >= 200)
1566 _exit(EXIT_FAILURE);
1567 }
1568
1569 hostgid_mapped = mapped_hostid(getegid(), conf, ID_TYPE_GID);
1570 extraargs = hostgid_mapped >= 0 ? 1 : 3;
1571
1572 n2 = realloc(n2, (nargs + n2args + extraargs) * sizeof(char *));
1573 if (!n2)
1574 _exit(EXIT_FAILURE);
1575
1576 if (hostgid_mapped < 0) {
1577 hostgid_mapped = find_unmapped_nsid(conf, ID_TYPE_GID);
1578 n2[n2args++] = "-m";
1579 if (hostgid_mapped < 0) {
1580 ERROR("Failed to find free gid to map");
1581 _exit(EXIT_FAILURE);
1582 }
1583
1584 n2[n2args++] = malloc(200);
1585 if (!n2[n2args - 1]) {
1586 SYSERROR("out of memory");
1587 _exit(EXIT_FAILURE);
1588 }
1589
1590 ret = snprintf(n2[n2args - 1], 200, "g:%d:%d:1",
1591 hostgid_mapped, getegid());
1592 if (ret < 0 || ret >= 200)
1593 _exit(EXIT_FAILURE);
1594 }
1595
1596 n2[n2args++] = "--";
1597
1598 for (i = 0; i < nargs; i++)
1599 n2[i + n2args] = newargv[i];
1600 n2args += nargs;
1601
1602 /* Finally add "--mapped-uid $uid" to tell template what
1603 * to chown cached images to.
1604 */
1605 n2args += 4;
1606 n2 = realloc(n2, n2args * sizeof(char *));
1607 if (!n2)
1608 _exit(EXIT_FAILURE);
1609
1610 /* note n2[n2args-1] is NULL */
1611 n2[n2args - 5] = "--mapped-uid";
1612
1613 ret = snprintf(txtuid, 20, "%d", hostuid_mapped);
1614 if (ret < 0 || ret >= 20) {
1615 free(newargv);
1616 free(n2);
1617 _exit(EXIT_FAILURE);
1618 }
1619
1620 n2[n2args - 4] = txtuid;
1621 n2[n2args - 3] = "--mapped-gid";
1622
1623 ret = snprintf(txtgid, 20, "%d", hostgid_mapped);
1624 if (ret < 0 || ret >= 20) {
1625 free(newargv);
1626 free(n2);
1627 _exit(EXIT_FAILURE);
1628 }
1629
1630 n2[n2args - 2] = txtgid;
1631 n2[n2args - 1] = NULL;
1632 free(newargv);
1633 newargv = n2;
1634 }
1635
1636 execvp(tpath, newargv);
1637 SYSERROR("Failed to execute template %s", tpath);
1638 _exit(EXIT_FAILURE);
1639 }
1640
1641 ret = wait_for_pid(pid);
1642 if (ret != 0) {
1643 ERROR("Failed to create container from template");
1644 return false;
1645 }
1646
1647 return true;
1648 }
1649
1650 static bool prepend_lxc_header(char *path, const char *t, char *const argv[])
1651 {
1652 long flen;
1653 size_t len;
1654 char *contents;
1655 FILE *f;
1656 int ret = -1;
1657 #if HAVE_LIBGNUTLS
1658 int i;
1659 unsigned char md_value[SHA_DIGEST_LENGTH];
1660 char *tpath;
1661 #endif
1662
1663 f = fopen(path, "r");
1664 if (f == NULL)
1665 return false;
1666
1667 ret = fseek(f, 0, SEEK_END);
1668 if (ret < 0)
1669 goto out_error;
1670
1671 ret = -1;
1672 flen = ftell(f);
1673 if (flen < 0)
1674 goto out_error;
1675
1676 ret = fseek(f, 0, SEEK_SET);
1677 if (ret < 0)
1678 goto out_error;
1679
1680 ret = fseek(f, 0, SEEK_SET);
1681 if (ret < 0)
1682 goto out_error;
1683
1684 ret = -1;
1685 contents = malloc(flen + 1);
1686 if (!contents)
1687 goto out_error;
1688
1689 len = fread(contents, 1, flen, f);
1690 if (len != flen)
1691 goto out_free_contents;
1692
1693 contents[flen] = '\0';
1694
1695 ret = fclose(f);
1696 f = NULL;
1697 if (ret < 0)
1698 goto out_free_contents;
1699
1700 #if HAVE_LIBGNUTLS
1701 tpath = get_template_path(t);
1702 if (!tpath) {
1703 ERROR("Invalid template \"%s\" specified", t);
1704 goto out_free_contents;
1705 }
1706
1707 ret = sha1sum_file(tpath, md_value);
1708 if (ret < 0) {
1709 ERROR("Failed to get sha1sum of %s", tpath);
1710 free(tpath);
1711 goto out_free_contents;
1712 }
1713 free(tpath);
1714 #endif
1715
1716 f = fopen(path, "w");
1717 if (f == NULL) {
1718 SYSERROR("Reopening config for writing");
1719 free(contents);
1720 return false;
1721 }
1722
1723 fprintf(f, "# Template used to create this container: %s\n", t);
1724 if (argv) {
1725 fprintf(f, "# Parameters passed to the template:");
1726 while (*argv) {
1727 fprintf(f, " %s", *argv);
1728 argv++;
1729 }
1730 fprintf(f, "\n");
1731 }
1732
1733 #if HAVE_LIBGNUTLS
1734 fprintf(f, "# Template script checksum (SHA-1): ");
1735 for (i=0; i<SHA_DIGEST_LENGTH; i++)
1736 fprintf(f, "%02x", md_value[i]);
1737 fprintf(f, "\n");
1738 #endif
1739 fprintf(f, "# For additional config options, please look at lxc.container.conf(5)\n");
1740 fprintf(f, "\n# Uncomment the following line to support nesting containers:\n");
1741 fprintf(f, "#lxc.include = " LXCTEMPLATECONFIG "/nesting.conf\n");
1742 fprintf(f, "# (Be aware this has security implications)\n\n");
1743 if (fwrite(contents, 1, flen, f) != flen) {
1744 SYSERROR("Writing original contents");
1745 free(contents);
1746 fclose(f);
1747 return false;
1748 }
1749
1750 ret = 0;
1751
1752 out_free_contents:
1753 free(contents);
1754
1755 out_error:
1756 if (f) {
1757 int newret;
1758 newret = fclose(f);
1759 if (ret == 0)
1760 ret = newret;
1761 }
1762
1763 if (ret < 0) {
1764 SYSERROR("Error prepending header");
1765 return false;
1766 }
1767
1768 return true;
1769 }
1770
1771 static void lxcapi_clear_config(struct lxc_container *c)
1772 {
1773 if (!c || !c->lxc_conf)
1774 return;
1775
1776 lxc_conf_free(c->lxc_conf);
1777 c->lxc_conf = NULL;
1778 }
1779
1780 #define do_lxcapi_clear_config(c) lxcapi_clear_config(c)
1781
1782 /*
1783 * lxcapi_create:
1784 * create a container with the given parameters.
1785 * @c: container to be created. It has the lxcpath, name, and a starting
1786 * configuration already set
1787 * @t: the template to execute to instantiate the root filesystem and
1788 * adjust the configuration.
1789 * @bdevtype: backing store type to use. If NULL, dir will be used.
1790 * @specs: additional parameters for the backing store, i.e. LVM vg to
1791 * use.
1792 *
1793 * @argv: the arguments to pass to the template, terminated by NULL. If no
1794 * arguments, you can just pass NULL.
1795 */
1796 static bool do_lxcapi_create(struct lxc_container *c, const char *t,
1797 const char *bdevtype, struct bdev_specs *specs,
1798 int flags, char *const argv[])
1799 {
1800 int partial_fd;
1801 mode_t mask;
1802 pid_t pid;
1803 bool ret = false, rootfs_managed = true;
1804 char *tpath = NULL;
1805
1806 if (!c)
1807 return false;
1808
1809 if (t) {
1810 tpath = get_template_path(t);
1811 if (!tpath) {
1812 ERROR("Unknown template \"%s\"", t);
1813 goto out;
1814 }
1815 }
1816
1817 /* If a template is passed in, and the rootfs already is defined in the
1818 * container config and exists, then the caller is trying to create an
1819 * existing container. Return an error, but do NOT delete the container.
1820 */
1821 if (do_lxcapi_is_defined(c) && c->lxc_conf && c->lxc_conf->rootfs.path &&
1822 access(c->lxc_conf->rootfs.path, F_OK) == 0 && tpath) {
1823 ERROR("Container \"%s\" already exists in \"%s\"", c->name,
1824 c->config_path);
1825 goto free_tpath;
1826 }
1827
1828 if (!c->lxc_conf) {
1829 if (!do_lxcapi_load_config(c, lxc_global_config_value("lxc.default_config"))) {
1830 ERROR("Error loading default configuration file %s",
1831 lxc_global_config_value("lxc.default_config"));
1832 goto free_tpath;
1833 }
1834 }
1835
1836 if (!create_container_dir(c))
1837 goto free_tpath;
1838
1839 if (c->lxc_conf->rootfs.path)
1840 rootfs_managed = false;
1841
1842 /* If both template and rootfs.path are set, template is setup as
1843 * rootfs.path. The container is already created if we have a config and
1844 * rootfs.path is accessible
1845 */
1846 if (!c->lxc_conf->rootfs.path && !tpath) {
1847 /* No template passed in and rootfs does not exist. */
1848 if (!c->save_config(c, NULL)) {
1849 ERROR("Failed to save initial config for \"%s\"", c->name);
1850 goto out;
1851 }
1852 ret = true;
1853 goto out;
1854 }
1855
1856 /* Rootfs passed into configuration, but does not exist. */
1857 if (c->lxc_conf->rootfs.path && access(c->lxc_conf->rootfs.path, F_OK) != 0)
1858 goto out;
1859
1860 if (do_lxcapi_is_defined(c) && c->lxc_conf->rootfs.path && !tpath) {
1861 /* Rootfs already existed, user just wanted to save the loaded
1862 * configuration.
1863 */
1864 if (!c->save_config(c, NULL))
1865 ERROR("Failed to save initial config for \"%s\"", c->name);
1866
1867 ret = true;
1868 goto out;
1869 }
1870
1871 /* Mark that this container is being created */
1872 partial_fd = create_partial(c);
1873 if (partial_fd < 0)
1874 goto out;
1875
1876 /* No need to get disk lock bc we have the partial lock. */
1877
1878 mask = umask(0022);
1879
1880 /* Create the storage.
1881 * Note we can't do this in the same task as we use to execute the
1882 * template because of the way zfs works.
1883 * After you 'zfs create', zfs mounts the fs only in the initial
1884 * namespace.
1885 */
1886 pid = fork();
1887 if (pid < 0) {
1888 SYSERROR("Failed to fork task for container creation template");
1889 goto out_unlock;
1890 }
1891
1892 if (pid == 0) { /* child */
1893 struct lxc_storage *bdev = NULL;
1894
1895 bdev = do_storage_create(c, bdevtype, specs);
1896 if (!bdev) {
1897 ERROR("Failed to create %s storage for %s",
1898 bdevtype ? bdevtype : "(none)", c->name);
1899 _exit(EXIT_FAILURE);
1900 }
1901
1902 /* Save config file again to store the new rootfs location. */
1903 if (!do_lxcapi_save_config(c, NULL)) {
1904 ERROR("Failed to save initial config for %s", c->name);
1905 /* Parent task won't see the storage driver in the
1906 * config so we delete it.
1907 */
1908 bdev->ops->umount(bdev);
1909 bdev->ops->destroy(bdev);
1910 _exit(EXIT_FAILURE);
1911 }
1912
1913 _exit(EXIT_SUCCESS);
1914 }
1915
1916 if (wait_for_pid(pid) != 0)
1917 goto out_unlock;
1918
1919 /* Reload config to get the rootfs. */
1920 lxc_conf_free(c->lxc_conf);
1921 c->lxc_conf = NULL;
1922
1923 if (!load_config_locked(c, c->configfile))
1924 goto out_unlock;
1925
1926 if (!create_run_template(c, tpath, !!(flags & LXC_CREATE_QUIET), argv))
1927 goto out_unlock;
1928
1929 /* Now clear out the lxc_conf we have, reload from the created
1930 * container.
1931 */
1932 do_lxcapi_clear_config(c);
1933
1934 if (t) {
1935 if (!prepend_lxc_header(c->configfile, tpath, argv)) {
1936 ERROR("Failed to prepend header to config file");
1937 goto out_unlock;
1938 }
1939 }
1940
1941 ret = load_config_locked(c, c->configfile);
1942
1943 out_unlock:
1944 umask(mask);
1945 remove_partial(c, partial_fd);
1946
1947 out:
1948 if (!ret) {
1949 bool reset_managed = c->lxc_conf->rootfs.managed;
1950
1951 /*
1952 * Ensure that we don't destroy storage we didn't create
1953 * ourselves.
1954 */
1955 if (!rootfs_managed)
1956 c->lxc_conf->rootfs.managed = false;
1957 container_destroy(c, NULL);
1958 c->lxc_conf->rootfs.managed = reset_managed;
1959 }
1960
1961 free_tpath:
1962 free(tpath);
1963 return ret;
1964 }
1965
1966 static bool lxcapi_create(struct lxc_container *c, const char *t,
1967 const char *bdevtype, struct bdev_specs *specs,
1968 int flags, char *const argv[])
1969 {
1970 bool ret;
1971
1972 current_config = c ? c->lxc_conf : NULL;
1973
1974 ret = do_lxcapi_create(c, t, bdevtype, specs, flags, argv);
1975 current_config = NULL;
1976 return ret;
1977 }
1978
1979 static bool do_lxcapi_reboot(struct lxc_container *c)
1980 {
1981 int ret;
1982 pid_t pid;
1983 int rebootsignal = SIGINT;
1984
1985 if (!c)
1986 return false;
1987
1988 if (!do_lxcapi_is_running(c))
1989 return false;
1990
1991 pid = do_lxcapi_init_pid(c);
1992 if (pid <= 0)
1993 return false;
1994
1995 if (c->lxc_conf && c->lxc_conf->rebootsignal)
1996 rebootsignal = c->lxc_conf->rebootsignal;
1997
1998 ret = kill(pid, rebootsignal);
1999 if (ret < 0) {
2000 WARN("Failed to send signal %d to pid %d", rebootsignal, pid);
2001 return false;
2002 }
2003
2004 return true;
2005 }
2006
2007 WRAP_API(bool, lxcapi_reboot)
2008
2009 static bool do_lxcapi_reboot2(struct lxc_container *c, int timeout)
2010 {
2011 int killret, ret;
2012 pid_t pid;
2013 int rebootsignal = SIGINT, state_client_fd = -1;
2014 lxc_state_t states[MAX_STATE] = {0};
2015
2016 if (!c)
2017 return false;
2018
2019 if (!do_lxcapi_is_running(c))
2020 return true;
2021
2022 pid = do_lxcapi_init_pid(c);
2023 if (pid <= 0)
2024 return true;
2025
2026 if (c->lxc_conf && c->lxc_conf->rebootsignal)
2027 rebootsignal = c->lxc_conf->rebootsignal;
2028
2029 /* Add a new state client before sending the shutdown signal so that we
2030 * don't miss a state.
2031 */
2032 if (timeout != 0) {
2033 states[RUNNING] = 2;
2034 ret = lxc_cmd_add_state_client(c->name, c->config_path, states,
2035 &state_client_fd);
2036 if (ret < 0)
2037 return false;
2038
2039 if (state_client_fd < 0)
2040 return false;
2041
2042 if (ret == RUNNING)
2043 return true;
2044
2045 if (ret < MAX_STATE)
2046 return false;
2047 }
2048
2049 /* Send reboot signal to container. */
2050 killret = kill(pid, rebootsignal);
2051 if (killret < 0) {
2052 if (state_client_fd >= 0)
2053 close(state_client_fd);
2054
2055 WARN("Failed to send signal %d to pid %d", rebootsignal, pid);
2056 return false;
2057 }
2058 TRACE("Sent signal %d to pid %d", rebootsignal, pid);
2059
2060 if (timeout == 0)
2061 return true;
2062
2063 ret = lxc_cmd_sock_rcv_state(state_client_fd, timeout);
2064 close(state_client_fd);
2065 if (ret < 0)
2066 return false;
2067
2068 TRACE("Received state \"%s\"", lxc_state2str(ret));
2069 if (ret != RUNNING)
2070 return false;
2071
2072 return true;
2073 }
2074
2075 WRAP_API_1(bool, lxcapi_reboot2, int)
2076
2077 static bool do_lxcapi_shutdown(struct lxc_container *c, int timeout)
2078 {
2079 int killret, ret;
2080 pid_t pid;
2081 int haltsignal = SIGPWR, state_client_fd = -EBADF;
2082 lxc_state_t states[MAX_STATE] = {0};
2083
2084 if (!c)
2085 return false;
2086
2087 if (!do_lxcapi_is_running(c))
2088 return true;
2089
2090 pid = do_lxcapi_init_pid(c);
2091 if (pid <= 0)
2092 return true;
2093
2094 /* Detect whether we should send SIGRTMIN + 3 (e.g. systemd). */
2095 if (c->lxc_conf && c->lxc_conf->haltsignal)
2096 haltsignal = c->lxc_conf->haltsignal;
2097 else if (task_blocks_signal(pid, (SIGRTMIN + 3)))
2098 haltsignal = (SIGRTMIN + 3);
2099
2100 /* Add a new state client before sending the shutdown signal so that we
2101 * don't miss a state.
2102 */
2103 if (timeout != 0) {
2104 states[STOPPED] = 1;
2105 ret = lxc_cmd_add_state_client(c->name, c->config_path, states,
2106 &state_client_fd);
2107 if (ret < 0)
2108 return false;
2109
2110 if (state_client_fd < 0)
2111 return false;
2112
2113 if (ret == STOPPED)
2114 return true;
2115
2116 if (ret < MAX_STATE)
2117 return false;
2118 }
2119
2120 /* Send shutdown signal to container. */
2121 killret = kill(pid, haltsignal);
2122 if (killret < 0) {
2123 if (state_client_fd >= 0)
2124 close(state_client_fd);
2125
2126 WARN("Failed to send signal %d to pid %d", haltsignal, pid);
2127 return false;
2128 }
2129 TRACE("Sent signal %d to pid %d", haltsignal, pid);
2130
2131 if (timeout == 0)
2132 return true;
2133
2134 ret = lxc_cmd_sock_rcv_state(state_client_fd, timeout);
2135 close(state_client_fd);
2136 if (ret < 0)
2137 return false;
2138
2139 TRACE("Received state \"%s\"", lxc_state2str(ret));
2140 if (ret != STOPPED)
2141 return false;
2142
2143 return true;
2144 }
2145
2146 WRAP_API_1(bool, lxcapi_shutdown, int)
2147
2148 static bool lxcapi_createl(struct lxc_container *c, const char *t,
2149 const char *bdevtype, struct bdev_specs *specs, int flags, ...)
2150 {
2151 bool bret = false;
2152 char **args = NULL;
2153 va_list ap;
2154
2155 if (!c)
2156 return false;
2157
2158 current_config = c->lxc_conf;
2159
2160 /*
2161 * since we're going to wait for create to finish, I don't think we
2162 * need to get a copy of the arguments.
2163 */
2164 va_start(ap, flags);
2165 args = lxc_va_arg_list_to_argv(ap, 0, 0);
2166 va_end(ap);
2167 if (!args) {
2168 ERROR("Failed to allocate memory");
2169 goto out;
2170 }
2171
2172 bret = do_lxcapi_create(c, t, bdevtype, specs, flags, args);
2173
2174 out:
2175 free(args);
2176 current_config = NULL;
2177 return bret;
2178 }
2179
2180 static void do_clear_unexp_config_line(struct lxc_conf *conf, const char *key)
2181 {
2182 if (!strcmp(key, "lxc.cgroup"))
2183 return clear_unexp_config_line(conf, key, true);
2184
2185 if (!strcmp(key, "lxc.network"))
2186 return clear_unexp_config_line(conf, key, true);
2187
2188 if (!strcmp(key, "lxc.net"))
2189 return clear_unexp_config_line(conf, key, true);
2190
2191 /* Clear a network with a specific index. */
2192 if (!strncmp(key, "lxc.net.", 8)) {
2193 int ret;
2194 const char *idx;
2195
2196 idx = key + 8;
2197 ret = lxc_safe_uint(idx, &(unsigned int){0});
2198 if (!ret)
2199 return clear_unexp_config_line(conf, key, true);
2200 }
2201
2202 if (!strcmp(key, "lxc.hook"))
2203 return clear_unexp_config_line(conf, key, true);
2204
2205 return clear_unexp_config_line(conf, key, false);
2206 }
2207
2208 static bool do_lxcapi_clear_config_item(struct lxc_container *c,
2209 const char *key)
2210 {
2211 int ret = 1;
2212 struct lxc_config_t *config;
2213
2214 if (!c || !c->lxc_conf)
2215 return false;
2216
2217 if (container_mem_lock(c))
2218 return false;
2219
2220 config = lxc_get_config(key);
2221 /* Verify that the config key exists and that it has a callback
2222 * implemented.
2223 */
2224 if (config && config->clr)
2225 ret = config->clr(key, c->lxc_conf, NULL);
2226
2227 if (!ret)
2228 do_clear_unexp_config_line(c->lxc_conf, key);
2229
2230 container_mem_unlock(c);
2231 return ret == 0;
2232 }
2233
2234 WRAP_API_1(bool, lxcapi_clear_config_item, const char *)
2235
2236 static inline bool enter_net_ns(struct lxc_container *c)
2237 {
2238 pid_t pid = do_lxcapi_init_pid(c);
2239
2240 if (pid < 0)
2241 return false;
2242
2243 if ((geteuid() != 0 || (c->lxc_conf && !lxc_list_empty(&c->lxc_conf->id_map))) &&
2244 (access("/proc/self/ns/user", F_OK) == 0))
2245 if (!switch_to_ns(pid, "user"))
2246 return false;
2247
2248 return switch_to_ns(pid, "net");
2249 }
2250
2251 /* Used by qsort and bsearch functions for comparing names. */
2252 static inline int string_cmp(char **first, char **second)
2253 {
2254 return strcmp(*first, *second);
2255 }
2256
2257 /* Used by qsort and bsearch functions for comparing container names. */
2258 static inline int container_cmp(struct lxc_container **first,
2259 struct lxc_container **second)
2260 {
2261 return strcmp((*first)->name, (*second)->name);
2262 }
2263
2264 static bool add_to_array(char ***names, char *cname, int pos)
2265 {
2266 char **newnames = realloc(*names, (pos+1) * sizeof(char *));
2267 if (!newnames) {
2268 ERROR("Out of memory");
2269 return false;
2270 }
2271
2272 *names = newnames;
2273 newnames[pos] = strdup(cname);
2274 if (!newnames[pos])
2275 return false;
2276
2277 /* Sort the array as we will use binary search on it. */
2278 qsort(newnames, pos + 1, sizeof(char *),
2279 (int (*)(const void *, const void *))string_cmp);
2280
2281 return true;
2282 }
2283
2284 static bool add_to_clist(struct lxc_container ***list, struct lxc_container *c,
2285 int pos, bool sort)
2286 {
2287 struct lxc_container **newlist = realloc(*list, (pos + 1) * sizeof(struct lxc_container *));
2288 if (!newlist) {
2289 ERROR("Out of memory");
2290 return false;
2291 }
2292
2293 *list = newlist;
2294 newlist[pos] = c;
2295
2296 /* Sort the array as we will use binary search on it. */
2297 if (sort)
2298 qsort(newlist, pos + 1, sizeof(struct lxc_container *),
2299 (int (*)(const void *, const void *))container_cmp);
2300
2301 return true;
2302 }
2303
2304 static char** get_from_array(char ***names, char *cname, int size)
2305 {
2306 return (char **)bsearch(&cname, *names, size, sizeof(char *), (int (*)(const void *, const void *))string_cmp);
2307 }
2308
2309 static bool array_contains(char ***names, char *cname, int size)
2310 {
2311 if(get_from_array(names, cname, size) != NULL)
2312 return true;
2313
2314 return false;
2315 }
2316
2317 static bool remove_from_array(char ***names, char *cname, int size)
2318 {
2319 char **result = get_from_array(names, cname, size);
2320 if (result != NULL) {
2321 free(result);
2322 return true;
2323 }
2324
2325 return false;
2326 }
2327
2328 static char **do_lxcapi_get_interfaces(struct lxc_container *c)
2329 {
2330 pid_t pid;
2331 int i, count = 0, pipefd[2];
2332 char **interfaces = NULL;
2333 char interface[IFNAMSIZ];
2334
2335 if (pipe2(pipefd, O_CLOEXEC) < 0)
2336 return NULL;
2337
2338 pid = fork();
2339 if (pid < 0) {
2340 SYSERROR("Failed to fork task to get interfaces information");
2341 close(pipefd[0]);
2342 close(pipefd[1]);
2343 return NULL;
2344 }
2345
2346 if (pid == 0) { /* child */
2347 int ret = 1, nbytes;
2348 struct netns_ifaddrs *interfaceArray = NULL, *tempIfAddr = NULL;
2349
2350 /* close the read-end of the pipe */
2351 close(pipefd[0]);
2352
2353 if (!enter_net_ns(c)) {
2354 SYSERROR("Failed to enter network namespace");
2355 goto out;
2356 }
2357
2358 /* Grab the list of interfaces */
2359 if (netns_getifaddrs(&interfaceArray, -1, &(bool){false})) {
2360 SYSERROR("Failed to get interfaces list");
2361 goto out;
2362 }
2363
2364 /* Iterate through the interfaces */
2365 for (tempIfAddr = interfaceArray; tempIfAddr != NULL;
2366 tempIfAddr = tempIfAddr->ifa_next) {
2367 nbytes = lxc_write_nointr(pipefd[1], tempIfAddr->ifa_name, IFNAMSIZ);
2368 if (nbytes < 0)
2369 goto out;
2370
2371 count++;
2372 }
2373
2374 ret = 0;
2375
2376 out:
2377 if (interfaceArray)
2378 netns_freeifaddrs(interfaceArray);
2379
2380 /* close the write-end of the pipe, thus sending EOF to the reader */
2381 close(pipefd[1]);
2382 _exit(ret);
2383 }
2384
2385 /* close the write-end of the pipe */
2386 close(pipefd[1]);
2387
2388 while (lxc_read_nointr(pipefd[0], &interface, IFNAMSIZ) == IFNAMSIZ) {
2389 interface[IFNAMSIZ - 1] = '\0';
2390
2391 if (array_contains(&interfaces, interface, count))
2392 continue;
2393
2394 if (!add_to_array(&interfaces, interface, count))
2395 ERROR("Failed to add \"%s\" to array", interface);
2396
2397 count++;
2398 }
2399
2400 if (wait_for_pid(pid) != 0) {
2401 for (i = 0; i < count; i++)
2402 free(interfaces[i]);
2403
2404 free(interfaces);
2405 interfaces = NULL;
2406 }
2407
2408 /* close the read-end of the pipe */
2409 close(pipefd[0]);
2410
2411 /* Append NULL to the array */
2412 if (interfaces)
2413 interfaces = (char **)lxc_append_null_to_array((void **)interfaces, count);
2414
2415 return interfaces;
2416 }
2417
2418 WRAP_API(char **, lxcapi_get_interfaces)
2419
2420 static char **do_lxcapi_get_ips(struct lxc_container *c, const char *interface,
2421 const char *family, int scope)
2422 {
2423 int i, ret;
2424 pid_t pid;
2425 int pipefd[2];
2426 char address[INET6_ADDRSTRLEN];
2427 int count = 0;
2428 char **addresses = NULL;
2429
2430 ret = pipe2(pipefd, O_CLOEXEC);
2431 if (ret < 0) {
2432 SYSERROR("Failed to create pipe");
2433 return NULL;
2434 }
2435
2436 pid = fork();
2437 if (pid < 0) {
2438 SYSERROR("Failed to create new process");
2439 close(pipefd[0]);
2440 close(pipefd[1]);
2441 return NULL;
2442 }
2443
2444 if (pid == 0) {
2445 ssize_t nbytes;
2446 char addressOutputBuffer[INET6_ADDRSTRLEN];
2447 char *address_ptr = NULL;
2448 void *tempAddrPtr = NULL;
2449 struct netns_ifaddrs *interfaceArray = NULL, *tempIfAddr = NULL;
2450
2451 /* close the read-end of the pipe */
2452 close(pipefd[0]);
2453
2454 if (!enter_net_ns(c)) {
2455 SYSERROR("Failed to attach to network namespace");
2456 goto out;
2457 }
2458
2459 /* Grab the list of interfaces */
2460 if (netns_getifaddrs(&interfaceArray, -1, &(bool){false})) {
2461 SYSERROR("Failed to get interfaces list");
2462 goto out;
2463 }
2464
2465 /* Iterate through the interfaces */
2466 for (tempIfAddr = interfaceArray; tempIfAddr;
2467 tempIfAddr = tempIfAddr->ifa_next) {
2468 if (tempIfAddr->ifa_addr == NULL)
2469 continue;
2470
2471 #pragma GCC diagnostic push
2472 #pragma GCC diagnostic ignored "-Wcast-align"
2473
2474 if (tempIfAddr->ifa_addr->sa_family == AF_INET) {
2475 if (family && strcmp(family, "inet"))
2476 continue;
2477
2478 tempAddrPtr = &((struct sockaddr_in *)tempIfAddr->ifa_addr)->sin_addr;
2479 } else {
2480 if (family && strcmp(family, "inet6"))
2481 continue;
2482
2483 if (((struct sockaddr_in6 *)tempIfAddr->ifa_addr)->sin6_scope_id != scope)
2484 continue;
2485
2486 tempAddrPtr = &((struct sockaddr_in6 *)tempIfAddr->ifa_addr)->sin6_addr;
2487 }
2488
2489 #pragma GCC diagnostic pop
2490
2491 if (interface && strcmp(interface, tempIfAddr->ifa_name))
2492 continue;
2493 else if (!interface && strcmp("lo", tempIfAddr->ifa_name) == 0)
2494 continue;
2495
2496 address_ptr = (char *)inet_ntop(tempIfAddr->ifa_addr->sa_family,
2497 tempAddrPtr, addressOutputBuffer,
2498 sizeof(addressOutputBuffer));
2499 if (!address_ptr)
2500 continue;
2501
2502 nbytes = lxc_write_nointr(pipefd[1], address_ptr, INET6_ADDRSTRLEN);
2503 if (nbytes != INET6_ADDRSTRLEN) {
2504 SYSERROR("Failed to send ipv6 address \"%s\"",
2505 address_ptr);
2506 goto out;
2507 }
2508
2509 count++;
2510 }
2511
2512 ret = 0;
2513
2514 out:
2515 if (interfaceArray)
2516 netns_freeifaddrs(interfaceArray);
2517
2518 /* close the write-end of the pipe, thus sending EOF to the reader */
2519 close(pipefd[1]);
2520 _exit(ret);
2521 }
2522
2523 /* close the write-end of the pipe */
2524 close(pipefd[1]);
2525
2526 while (lxc_read_nointr(pipefd[0], &address, INET6_ADDRSTRLEN) == INET6_ADDRSTRLEN) {
2527 address[INET6_ADDRSTRLEN - 1] = '\0';
2528
2529 if (!add_to_array(&addresses, address, count))
2530 ERROR("PARENT: add_to_array failed");
2531
2532 count++;
2533 }
2534
2535 if (wait_for_pid(pid) != 0) {
2536 for (i = 0; i < count; i++)
2537 free(addresses[i]);
2538
2539 free(addresses);
2540 addresses = NULL;
2541 }
2542
2543 /* close the read-end of the pipe */
2544 close(pipefd[0]);
2545
2546 /* Append NULL to the array */
2547 if (addresses)
2548 addresses = (char **)lxc_append_null_to_array((void **)addresses, count);
2549
2550 return addresses;
2551 }
2552
2553 WRAP_API_3(char **, lxcapi_get_ips, const char *, const char *, int)
2554
2555 static int do_lxcapi_get_config_item(struct lxc_container *c, const char *key, char *retv, int inlen)
2556 {
2557 int ret = -1;
2558 struct lxc_config_t *config;
2559
2560 if (!c || !c->lxc_conf)
2561 return -1;
2562
2563 if (container_mem_lock(c))
2564 return -1;
2565
2566 config = lxc_get_config(key);
2567 /* Verify that the config key exists and that it has a callback
2568 * implemented.
2569 */
2570 if (config && config->get)
2571 ret = config->get(key, retv, inlen, c->lxc_conf, NULL);
2572
2573 container_mem_unlock(c);
2574 return ret;
2575 }
2576
2577 WRAP_API_3(int, lxcapi_get_config_item, const char *, char *, int)
2578
2579 static char* do_lxcapi_get_running_config_item(struct lxc_container *c, const char *key)
2580 {
2581 char *ret;
2582
2583 if (!c || !c->lxc_conf)
2584 return NULL;
2585
2586 if (container_mem_lock(c))
2587 return NULL;
2588
2589 ret = lxc_cmd_get_config_item(c->name, key, do_lxcapi_get_config_path(c));
2590 container_mem_unlock(c);
2591 return ret;
2592 }
2593
2594 WRAP_API_1(char *, lxcapi_get_running_config_item, const char *)
2595
2596 static int do_lxcapi_get_keys(struct lxc_container *c, const char *key, char *retv, int inlen)
2597 {
2598 int ret = -1;
2599
2600 /* List all config items. */
2601 if (!key)
2602 return lxc_list_config_items(retv, inlen);
2603
2604 if (!c || !c->lxc_conf)
2605 return -1;
2606
2607 if (container_mem_lock(c))
2608 return -1;
2609
2610 /* Support 'lxc.net.<idx>', i.e. 'lxc.net.0'
2611 * This is an intelligent result to show which keys are valid given the
2612 * type of nic it is.
2613 */
2614 if (strncmp(key, "lxc.net.", 8) == 0)
2615 ret = lxc_list_net(c->lxc_conf, key, retv, inlen);
2616 else
2617 ret = lxc_list_subkeys(c->lxc_conf, key, retv, inlen);
2618
2619 container_mem_unlock(c);
2620 return ret;
2621 }
2622
2623 WRAP_API_3(int, lxcapi_get_keys, const char *, char *, int)
2624
2625 static bool do_lxcapi_save_config(struct lxc_container *c, const char *alt_file)
2626 {
2627 int fd, lret;
2628 bool ret = false, need_disklock = false;
2629
2630 if (!alt_file)
2631 alt_file = c->configfile;
2632
2633 if (!alt_file)
2634 return false;
2635
2636 /* If we haven't yet loaded a config, load the stock config. */
2637 if (!c->lxc_conf) {
2638 if (!do_lxcapi_load_config(c, lxc_global_config_value("lxc.default_config"))) {
2639 ERROR("Error loading default configuration file %s "
2640 "while saving %s",
2641 lxc_global_config_value("lxc.default_config"),
2642 c->name);
2643 return false;
2644 }
2645 }
2646
2647 if (!create_container_dir(c))
2648 return false;
2649
2650 /* If we're writing to the container's config file, take the disk lock.
2651 * Otherwise just take the memlock to protect the struct lxc_container
2652 * while we're traversing it.
2653 */
2654 if (strcmp(c->configfile, alt_file) == 0)
2655 need_disklock = true;
2656
2657 if (need_disklock)
2658 lret = container_disk_lock(c);
2659 else
2660 lret = container_mem_lock(c);
2661 if (lret)
2662 return false;
2663
2664 fd = open(alt_file, O_WRONLY | O_CREAT | O_TRUNC | O_CLOEXEC,
2665 S_IRUSR | S_IWUSR | S_IRGRP | S_IWGRP);
2666 if (fd < 0)
2667 goto on_error;
2668
2669 lret = write_config(fd, c->lxc_conf);
2670 close(fd);
2671 if (lret < 0)
2672 goto on_error;
2673
2674 ret = true;
2675
2676 on_error:
2677 if (need_disklock)
2678 container_disk_unlock(c);
2679 else
2680 container_mem_unlock(c);
2681
2682 return ret;
2683 }
2684
2685 WRAP_API_1(bool, lxcapi_save_config, const char *)
2686
2687
2688 static bool mod_rdep(struct lxc_container *c0, struct lxc_container *c, bool inc)
2689 {
2690 FILE *f1;
2691 struct stat fbuf;
2692 void *buf = NULL;
2693 char *del = NULL;
2694 char path[PATH_MAX];
2695 char newpath[PATH_MAX];
2696 int fd, ret, n = 0, v = 0;
2697 bool bret = false;
2698 size_t len = 0, bytes = 0;
2699
2700 if (container_disk_lock(c0))
2701 return false;
2702
2703 ret = snprintf(path, PATH_MAX, "%s/%s/lxc_snapshots", c0->config_path, c0->name);
2704 if (ret < 0 || ret > PATH_MAX)
2705 goto out;
2706
2707 ret = snprintf(newpath, PATH_MAX, "%s\n%s\n", c->config_path, c->name);
2708 if (ret < 0 || ret > PATH_MAX)
2709 goto out;
2710
2711 /* If we find an lxc-snapshot file using the old format only listing the
2712 * number of snapshots we will keep using it. */
2713 f1 = fopen(path, "r");
2714 if (f1) {
2715 n = fscanf(f1, "%d", &v);
2716 fclose(f1);
2717 if (n == 1 && v == 0) {
2718 ret = remove(path);
2719 if (ret < 0)
2720 SYSERROR("Failed to remove \"%s\"", path);
2721
2722 n = 0;
2723 }
2724 }
2725
2726 if (n == 1) {
2727 v += inc ? 1 : -1;
2728 f1 = fopen(path, "w");
2729 if (!f1)
2730 goto out;
2731
2732 if (fprintf(f1, "%d\n", v) < 0) {
2733 ERROR("Error writing new snapshots value");
2734 fclose(f1);
2735 goto out;
2736 }
2737
2738 ret = fclose(f1);
2739 if (ret != 0) {
2740 SYSERROR("Error writing to or closing snapshots file");
2741 goto out;
2742 }
2743 } else {
2744 /* Here we know that we have or can use an lxc-snapshot file
2745 * using the new format. */
2746 if (inc) {
2747 f1 = fopen(path, "a");
2748 if (!f1)
2749 goto out;
2750
2751 if (fprintf(f1, "%s", newpath) < 0) {
2752 ERROR("Error writing new snapshots entry");
2753 ret = fclose(f1);
2754 if (ret != 0)
2755 SYSERROR("Error writing to or closing snapshots file");
2756 goto out;
2757 }
2758
2759 ret = fclose(f1);
2760 if (ret != 0) {
2761 SYSERROR("Error writing to or closing snapshots file");
2762 goto out;
2763 }
2764 } else if (!inc) {
2765 if ((fd = open(path, O_RDWR | O_CLOEXEC)) < 0)
2766 goto out;
2767
2768 if (fstat(fd, &fbuf) < 0) {
2769 close(fd);
2770 goto out;
2771 }
2772
2773 if (fbuf.st_size != 0) {
2774 buf = lxc_strmmap(NULL, fbuf.st_size, PROT_READ | PROT_WRITE, MAP_SHARED, fd, 0);
2775 if (buf == MAP_FAILED) {
2776 SYSERROR("Failed to create mapping %s", path);
2777 close(fd);
2778 goto out;
2779 }
2780
2781 len = strlen(newpath);
2782 while ((del = strstr((char *)buf, newpath))) {
2783 memmove(del, del + len, strlen(del) - len + 1);
2784 bytes += len;
2785 }
2786
2787 lxc_strmunmap(buf, fbuf.st_size);
2788 if (ftruncate(fd, fbuf.st_size - bytes) < 0) {
2789 SYSERROR("Failed to truncate file %s", path);
2790 close(fd);
2791 goto out;
2792 }
2793 }
2794
2795 close(fd);
2796 }
2797
2798 /* If the lxc-snapshot file is empty, remove it. */
2799 if (stat(path, &fbuf) < 0)
2800 goto out;
2801
2802 if (!fbuf.st_size) {
2803 ret = remove(path);
2804 if (ret < 0)
2805 SYSERROR("Failed to remove \"%s\"", path);
2806 }
2807 }
2808
2809 bret = true;
2810
2811 out:
2812 container_disk_unlock(c0);
2813 return bret;
2814 }
2815
2816 void mod_all_rdeps(struct lxc_container *c, bool inc)
2817 {
2818 struct lxc_container *p;
2819 char *lxcpath = NULL, *lxcname = NULL, path[PATH_MAX];
2820 size_t pathlen = 0, namelen = 0;
2821 FILE *f;
2822 int ret;
2823
2824 ret = snprintf(path, PATH_MAX, "%s/%s/lxc_rdepends",
2825 c->config_path, c->name);
2826 if (ret < 0 || ret >= PATH_MAX) {
2827 ERROR("Path name too long");
2828 return;
2829 }
2830
2831 f = fopen(path, "r");
2832 if (f == NULL)
2833 return;
2834
2835 while (getline(&lxcpath, &pathlen, f) != -1) {
2836 if (getline(&lxcname, &namelen, f) == -1) {
2837 ERROR("badly formatted file %s", path);
2838 goto out;
2839 }
2840
2841 remove_trailing_newlines(lxcpath);
2842 remove_trailing_newlines(lxcname);
2843
2844 if ((p = lxc_container_new(lxcname, lxcpath)) == NULL) {
2845 ERROR("Unable to find dependent container %s:%s",
2846 lxcpath, lxcname);
2847 continue;
2848 }
2849
2850 if (!mod_rdep(p, c, inc))
2851 ERROR("Failed to update snapshots file for %s:%s",
2852 lxcpath, lxcname);
2853
2854 lxc_container_put(p);
2855 }
2856
2857 out:
2858 free(lxcpath);
2859 free(lxcname);
2860 fclose(f);
2861 }
2862
2863 static bool has_fs_snapshots(struct lxc_container *c)
2864 {
2865 FILE *f;
2866 char path[PATH_MAX];
2867 int ret, v;
2868 struct stat fbuf;
2869 bool bret = false;
2870
2871 ret = snprintf(path, PATH_MAX, "%s/%s/lxc_snapshots", c->config_path,
2872 c->name);
2873 if (ret < 0 || ret > PATH_MAX)
2874 goto out;
2875
2876 /* If the file doesn't exist there are no snapshots. */
2877 if (stat(path, &fbuf) < 0)
2878 goto out;
2879
2880 v = fbuf.st_size;
2881 if (v != 0) {
2882 f = fopen(path, "r");
2883 if (!f)
2884 goto out;
2885
2886 ret = fscanf(f, "%d", &v);
2887 fclose(f);
2888 /* TODO: Figure out what to do with the return value of fscanf. */
2889 if (ret != 1)
2890 INFO("Container uses new lxc-snapshots format %s", path);
2891 }
2892
2893 bret = v != 0;
2894
2895 out:
2896 return bret;
2897 }
2898
2899 static bool has_snapshots(struct lxc_container *c)
2900 {
2901 char path[PATH_MAX];
2902 struct dirent *direntp;
2903 int count=0;
2904 DIR *dir;
2905
2906 if (!get_snappath_dir(c, path))
2907 return false;
2908
2909 dir = opendir(path);
2910 if (!dir)
2911 return false;
2912
2913 while ((direntp = readdir(dir))) {
2914 if (!strcmp(direntp->d_name, "."))
2915 continue;
2916
2917 if (!strcmp(direntp->d_name, ".."))
2918 continue;
2919 count++;
2920 break;
2921 }
2922
2923 closedir(dir);
2924 return count > 0;
2925 }
2926
2927 static bool do_destroy_container(struct lxc_conf *conf) {
2928 int ret;
2929
2930 if (am_guest_unpriv()) {
2931 ret = userns_exec_full(conf, storage_destroy_wrapper, conf,
2932 "storage_destroy_wrapper");
2933 if (ret < 0)
2934 return false;
2935
2936 return true;
2937 }
2938
2939 return storage_destroy(conf);
2940 }
2941
2942 static int lxc_rmdir_onedev_wrapper(void *data)
2943 {
2944 char *arg = (char *) data;
2945 return lxc_rmdir_onedev(arg, "snaps");
2946 }
2947
2948 static int lxc_unlink_exec_wrapper(void *data)
2949 {
2950 char *arg = data;
2951 return unlink(arg);
2952 }
2953
2954 static bool container_destroy(struct lxc_container *c,
2955 struct lxc_storage *storage)
2956 {
2957 const char *p1;
2958 size_t len;
2959 struct lxc_conf *conf;
2960 char *path = NULL;
2961 bool bret = false;
2962 int ret = 0;
2963
2964 if (!c || !do_lxcapi_is_defined(c))
2965 return false;
2966
2967 conf = c->lxc_conf;
2968 if (container_disk_lock(c))
2969 return false;
2970
2971 if (!is_stopped(c)) {
2972 /* We should queue some sort of error - in c->error_string? */
2973 ERROR("container %s is not stopped", c->name);
2974 goto out;
2975 }
2976
2977 if (conf && !lxc_list_empty(&conf->hooks[LXCHOOK_DESTROY])) {
2978 /* Start of environment variable setup for hooks */
2979 if (setenv("LXC_NAME", c->name, 1))
2980 SYSERROR("Failed to set environment variable for container name");
2981
2982 if (conf->rcfile && setenv("LXC_CONFIG_FILE", conf->rcfile, 1))
2983 SYSERROR("Failed to set environment variable for config path");
2984
2985 if (conf->rootfs.mount && setenv("LXC_ROOTFS_MOUNT", conf->rootfs.mount, 1))
2986 SYSERROR("Failed to set environment variable for rootfs mount");
2987
2988 if (conf->rootfs.path && setenv("LXC_ROOTFS_PATH", conf->rootfs.path, 1))
2989 SYSERROR("Failed to set environment variable for rootfs mount");
2990
2991 if (conf->console.path && setenv("LXC_CONSOLE", conf->console.path, 1))
2992 SYSERROR("Failed to set environment variable for console path");
2993
2994 if (conf->console.log_path && setenv("LXC_CONSOLE_LOGPATH", conf->console.log_path, 1))
2995 SYSERROR("Failed to set environment variable for console log");
2996 /* End of environment variable setup for hooks */
2997
2998 if (run_lxc_hooks(c->name, "destroy", conf, NULL)) {
2999 ERROR("Failed to execute clone hook for \"%s\"", c->name);
3000 goto out;
3001 }
3002 }
3003
3004 if (current_config && conf == current_config) {
3005 current_config = NULL;
3006
3007 if (conf->logfd != -1) {
3008 close(conf->logfd);
3009 conf->logfd = -1;
3010 }
3011 }
3012
3013 /* LXC is not managing the storage of the container. */
3014 if (conf && !conf->rootfs.managed)
3015 goto on_success;
3016
3017 if (conf && conf->rootfs.path && conf->rootfs.mount) {
3018 if (!do_destroy_container(conf)) {
3019 ERROR("Error destroying rootfs for %s", c->name);
3020 goto out;
3021 }
3022 INFO("Destroyed rootfs for %s", c->name);
3023 }
3024
3025 mod_all_rdeps(c, false);
3026
3027 p1 = do_lxcapi_get_config_path(c);
3028 /* strlen(p1)
3029 * +
3030 * /
3031 * +
3032 * strlen(c->name)
3033 * +
3034 * /
3035 * +
3036 * strlen("config") = 6
3037 * +
3038 * \0
3039 */
3040 len = strlen(p1) + 1 + strlen(c->name) + 1 + 6 + 1;
3041 path = malloc(len);
3042 if (!path) {
3043 ERROR("Failed to allocate memory");
3044 goto out;
3045 }
3046
3047 /* For an overlay container the rootfs is considered immutable and
3048 * cannot be removed when restoring from a snapshot.
3049 */
3050 if (storage && (!strcmp(storage->type, "overlay") ||
3051 !strcmp(storage->type, "overlayfs")) &&
3052 (storage->flags & LXC_STORAGE_INTERNAL_OVERLAY_RESTORE)) {
3053 ret = snprintf(path, len, "%s/%s/config", p1, c->name);
3054 if (ret < 0 || (size_t)ret >= len)
3055 goto out;
3056
3057 if (am_guest_unpriv())
3058 ret = userns_exec_1(conf, lxc_unlink_exec_wrapper, path,
3059 "lxc_unlink_exec_wrapper");
3060 else
3061 ret = unlink(path);
3062 if (ret < 0) {
3063 SYSERROR("Failed to destroy config file \"%s\" for \"%s\"",
3064 path, c->name);
3065 goto out;
3066 }
3067 INFO("Destroyed config file \"%s\" for \"%s\"", path, c->name);
3068
3069 bret = true;
3070 goto out;
3071 }
3072
3073 ret = snprintf(path, len, "%s/%s", p1, c->name);
3074 if (ret < 0 || (size_t)ret >= len)
3075 goto out;
3076
3077 if (am_guest_unpriv())
3078 ret = userns_exec_full(conf, lxc_rmdir_onedev_wrapper, path,
3079 "lxc_rmdir_onedev_wrapper");
3080 else
3081 ret = lxc_rmdir_onedev(path, "snaps");
3082 if (ret < 0) {
3083 ERROR("Failed to destroy directory \"%s\" for \"%s\"", path,
3084 c->name);
3085 goto out;
3086 }
3087 INFO("Destroyed directory \"%s\" for \"%s\"", path, c->name);
3088
3089 on_success:
3090 bret = true;
3091
3092 out:
3093 if (path)
3094 free(path);
3095
3096 container_disk_unlock(c);
3097 return bret;
3098 }
3099
3100 static bool do_lxcapi_destroy(struct lxc_container *c)
3101 {
3102 if (!c || !lxcapi_is_defined(c))
3103 return false;
3104
3105 if (c->lxc_conf && c->lxc_conf->rootfs.managed) {
3106 if (has_snapshots(c)) {
3107 ERROR("Container %s has snapshots; not removing", c->name);
3108 return false;
3109 }
3110
3111 if (has_fs_snapshots(c)) {
3112 ERROR("container %s has snapshots on its rootfs", c->name);
3113 return false;
3114 }
3115 }
3116
3117 return container_destroy(c, NULL);
3118 }
3119
3120 WRAP_API(bool, lxcapi_destroy)
3121
3122 static bool do_lxcapi_destroy_with_snapshots(struct lxc_container *c)
3123 {
3124 if (!c || !lxcapi_is_defined(c))
3125 return false;
3126
3127 if (!lxcapi_snapshot_destroy_all(c)) {
3128 ERROR("Error deleting all snapshots");
3129 return false;
3130 }
3131
3132 return lxcapi_destroy(c);
3133 }
3134
3135 WRAP_API(bool, lxcapi_destroy_with_snapshots)
3136
3137 int lxc_set_config_item_locked(struct lxc_conf *conf, const char *key,
3138 const char *v)
3139 {
3140 int ret;
3141 struct lxc_config_t *config;
3142 bool bret = true;
3143
3144 config = lxc_get_config(key);
3145 if (!config)
3146 return -EINVAL;
3147
3148 ret = config->set(key, v, conf, NULL);
3149 if (ret < 0)
3150 return -EINVAL;
3151
3152 if (lxc_config_value_empty(v))
3153 do_clear_unexp_config_line(conf, key);
3154 else
3155 bret = do_append_unexp_config_line(conf, key, v);
3156 if (!bret)
3157 return -ENOMEM;
3158
3159 return 0;
3160 }
3161
3162 static bool do_set_config_item_locked(struct lxc_container *c, const char *key,
3163 const char *v)
3164 {
3165 int ret;
3166
3167 if (!c->lxc_conf)
3168 c->lxc_conf = lxc_conf_init();
3169
3170 if (!c->lxc_conf)
3171 return false;
3172
3173 ret = lxc_set_config_item_locked(c->lxc_conf, key, v);
3174 if (ret < 0)
3175 return false;
3176
3177 return true;
3178 }
3179
3180 static bool do_lxcapi_set_config_item(struct lxc_container *c, const char *key, const char *v)
3181 {
3182 bool b = false;
3183
3184 if (!c)
3185 return false;
3186
3187 if (container_mem_lock(c))
3188 return false;
3189
3190 b = do_set_config_item_locked(c, key, v);
3191
3192 container_mem_unlock(c);
3193 return b;
3194 }
3195
3196 WRAP_API_2(bool, lxcapi_set_config_item, const char *, const char *)
3197
3198 static char *lxcapi_config_file_name(struct lxc_container *c)
3199 {
3200 if (!c || !c->configfile)
3201 return NULL;
3202
3203 return strdup(c->configfile);
3204 }
3205
3206 static const char *lxcapi_get_config_path(struct lxc_container *c)
3207 {
3208 if (!c || !c->config_path)
3209 return NULL;
3210
3211 return (const char *)(c->config_path);
3212 }
3213
3214 /*
3215 * not for export
3216 * Just recalculate the c->configfile based on the
3217 * c->config_path, which must be set.
3218 * The lxc_container must be locked or not yet public.
3219 */
3220 static bool set_config_filename(struct lxc_container *c)
3221 {
3222 char *newpath;
3223 int len, ret;
3224
3225 if (!c->config_path)
3226 return false;
3227
3228 /* $lxc_path + "/" + c->name + "/" + "config" + '\0' */
3229 len = strlen(c->config_path) + strlen(c->name) + strlen("config") + 3;
3230 newpath = malloc(len);
3231 if (!newpath)
3232 return false;
3233
3234 ret = snprintf(newpath, len, "%s/%s/config", c->config_path, c->name);
3235 if (ret < 0 || ret >= len) {
3236 fprintf(stderr, "Error printing out config file name\n");
3237 free(newpath);
3238 return false;
3239 }
3240
3241 free(c->configfile);
3242 c->configfile = newpath;
3243
3244 return true;
3245 }
3246
3247 static bool do_lxcapi_set_config_path(struct lxc_container *c, const char *path)
3248 {
3249 char *p;
3250 bool b = false;
3251 char *oldpath = NULL;
3252
3253 if (!c)
3254 return b;
3255
3256 if (container_mem_lock(c))
3257 return b;
3258
3259 p = strdup(path);
3260 if (!p) {
3261 ERROR("Out of memory setting new lxc path");
3262 goto err;
3263 }
3264
3265 b = true;
3266 if (c->config_path)
3267 oldpath = c->config_path;
3268 c->config_path = p;
3269
3270 /* Since we've changed the config path, we have to change the
3271 * config file name too */
3272 if (!set_config_filename(c)) {
3273 ERROR("Out of memory setting new config filename");
3274 b = false;
3275 free(c->config_path);
3276 c->config_path = oldpath;
3277 oldpath = NULL;
3278 }
3279
3280 err:
3281 free(oldpath);
3282 container_mem_unlock(c);
3283 return b;
3284 }
3285
3286 WRAP_API_1(bool, lxcapi_set_config_path, const char *)
3287
3288 static bool do_lxcapi_set_cgroup_item(struct lxc_container *c, const char *subsys, const char *value)
3289 {
3290 int ret;
3291 struct cgroup_ops *cgroup_ops;
3292
3293 if (!c)
3294 return false;
3295
3296 if (is_stopped(c))
3297 return false;
3298
3299 cgroup_ops = cgroup_init(c->lxc_conf);
3300 if (!cgroup_ops)
3301 return false;
3302
3303 ret = cgroup_ops->set(cgroup_ops, subsys, value, c->name, c->config_path);
3304
3305 cgroup_exit(cgroup_ops);
3306
3307 return ret == 0;
3308 }
3309
3310 WRAP_API_2(bool, lxcapi_set_cgroup_item, const char *, const char *)
3311
3312 static int do_lxcapi_get_cgroup_item(struct lxc_container *c, const char *subsys, char *retv, int inlen)
3313 {
3314 int ret;
3315 struct cgroup_ops *cgroup_ops;
3316
3317 if (!c)
3318 return -1;
3319
3320 if (is_stopped(c))
3321 return -1;
3322
3323 cgroup_ops = cgroup_init(c->lxc_conf);
3324 if (!cgroup_ops)
3325 return -1;
3326
3327 ret = cgroup_ops->get(cgroup_ops, subsys, retv, inlen, c->name,
3328 c->config_path);
3329
3330 cgroup_exit(cgroup_ops);
3331
3332 return ret;
3333 }
3334
3335 WRAP_API_3(int, lxcapi_get_cgroup_item, const char *, char *, int)
3336
3337 const char *lxc_get_global_config_item(const char *key)
3338 {
3339 return lxc_global_config_value(key);
3340 }
3341
3342 const char *lxc_get_version(void)
3343 {
3344 return LXC_VERSION;
3345 }
3346
3347 static int copy_file(const char *old, const char *new)
3348 {
3349 int in, out;
3350 ssize_t len, ret;
3351 char buf[8096];
3352 struct stat sbuf;
3353
3354 if (file_exists(new)) {
3355 ERROR("copy destination %s exists", new);
3356 return -1;
3357 }
3358
3359 ret = stat(old, &sbuf);
3360 if (ret < 0) {
3361 INFO("Error stat'ing %s", old);
3362 return -1;
3363 }
3364
3365 in = open(old, O_RDONLY);
3366 if (in < 0) {
3367 SYSERROR("Error opening original file %s", old);
3368 return -1;
3369 }
3370
3371 out = open(new, O_CREAT | O_EXCL | O_WRONLY, 0644);
3372 if (out < 0) {
3373 SYSERROR("Error opening new file %s", new);
3374 close(in);
3375 return -1;
3376 }
3377
3378 for (;;) {
3379 len = lxc_read_nointr(in, buf, 8096);
3380 if (len < 0) {
3381 SYSERROR("Error reading old file %s", old);
3382 goto err;
3383 }
3384
3385 if (len == 0)
3386 break;
3387
3388 ret = lxc_write_nointr(out, buf, len);
3389 if (ret < len) { /* should we retry? */
3390 SYSERROR("Error: write to new file %s was interrupted", new);
3391 goto err;
3392 }
3393 }
3394
3395 close(in);
3396 close(out);
3397
3398 /* We set mode, but not owner/group. */
3399 ret = chmod(new, sbuf.st_mode);
3400 if (ret) {
3401 SYSERROR("Error setting mode on %s", new);
3402 return -1;
3403 }
3404
3405 return 0;
3406
3407 err:
3408 close(in);
3409 close(out);
3410 return -1;
3411 }
3412
3413 static int copyhooks(struct lxc_container *oldc, struct lxc_container *c)
3414 {
3415 __do_free char *cpath = NULL;
3416 int i, len, ret;
3417 struct lxc_list *it;
3418
3419 len = strlen(oldc->config_path) + strlen(oldc->name) + 3;
3420 cpath = must_realloc(NULL, len);
3421 ret = snprintf(cpath, len, "%s/%s/", oldc->config_path, oldc->name);
3422 if (ret < 0 || ret >= len)
3423 return -1;
3424
3425 for (i=0; i<NUM_LXC_HOOKS; i++) {
3426 lxc_list_for_each(it, &c->lxc_conf->hooks[i]) {
3427 char *hookname = it->elem;
3428 char *fname = strrchr(hookname, '/');
3429 char tmppath[PATH_MAX];
3430 if (!fname) /* relative path - we don't support, but maybe we should */
3431 return 0;
3432
3433 if (strncmp(hookname, cpath, len - 1) != 0) {
3434 /* this hook is public - ignore */
3435 continue;
3436 }
3437
3438 /* copy the script, and change the entry in confile */
3439 ret = snprintf(tmppath, PATH_MAX, "%s/%s/%s",
3440 c->config_path, c->name, fname+1);
3441 if (ret < 0 || ret >= PATH_MAX)
3442 return -1;
3443
3444 ret = copy_file(it->elem, tmppath);
3445 if (ret < 0)
3446 return -1;
3447
3448 free(it->elem);
3449
3450 it->elem = strdup(tmppath);
3451 if (!it->elem) {
3452 ERROR("out of memory copying hook path");
3453 return -1;
3454 }
3455 }
3456 }
3457
3458 if (!clone_update_unexp_hooks(c->lxc_conf, oldc->config_path,
3459 c->config_path, oldc->name, c->name)) {
3460 ERROR("Error saving new hooks in clone");
3461 return -1;
3462 }
3463
3464 do_lxcapi_save_config(c, NULL);
3465 return 0;
3466 }
3467
3468
3469 static int copy_fstab(struct lxc_container *oldc, struct lxc_container *c)
3470 {
3471 char newpath[PATH_MAX];
3472 char *oldpath = oldc->lxc_conf->fstab;
3473 int ret;
3474
3475 if (!oldpath)
3476 return 0;
3477
3478 clear_unexp_config_line(c->lxc_conf, "lxc.mount.fstab", false);
3479
3480 char *p = strrchr(oldpath, '/');
3481 if (!p)
3482 return -1;
3483
3484 ret = snprintf(newpath, PATH_MAX, "%s/%s%s",
3485 c->config_path, c->name, p);
3486 if (ret < 0 || ret >= PATH_MAX) {
3487 ERROR("error printing new path for %s", oldpath);
3488 return -1;
3489 }
3490
3491 if (file_exists(newpath)) {
3492 ERROR("error: fstab file %s exists", newpath);
3493 return -1;
3494 }
3495
3496 if (copy_file(oldpath, newpath) < 0) {
3497 ERROR("error: copying %s to %s", oldpath, newpath);
3498 return -1;
3499 }
3500
3501 free(c->lxc_conf->fstab);
3502
3503 c->lxc_conf->fstab = strdup(newpath);
3504 if (!c->lxc_conf->fstab) {
3505 ERROR("error: allocating pathname");
3506 return -1;
3507 }
3508
3509 if (!do_append_unexp_config_line(c->lxc_conf, "lxc.mount.fstab", newpath)) {
3510 ERROR("error saving new lxctab");
3511 return -1;
3512 }
3513
3514 return 0;
3515 }
3516
3517 static void copy_rdepends(struct lxc_container *c, struct lxc_container *c0)
3518 {
3519 char path0[PATH_MAX], path1[PATH_MAX];
3520 int ret;
3521
3522 ret = snprintf(path0, PATH_MAX, "%s/%s/lxc_rdepends", c0->config_path,
3523 c0->name);
3524 if (ret < 0 || ret >= PATH_MAX) {
3525 WARN("Error copying reverse dependencies");
3526 return;
3527 }
3528
3529 ret = snprintf(path1, PATH_MAX, "%s/%s/lxc_rdepends", c->config_path,
3530 c->name);
3531 if (ret < 0 || ret >= PATH_MAX) {
3532 WARN("Error copying reverse dependencies");
3533 return;
3534 }
3535
3536 if (copy_file(path0, path1) < 0) {
3537 INFO("Error copying reverse dependencies");
3538 return;
3539 }
3540 }
3541
3542 static bool add_rdepends(struct lxc_container *c, struct lxc_container *c0)
3543 {
3544 int ret;
3545 char path[PATH_MAX];
3546 FILE *f;
3547 bool bret;
3548
3549 ret = snprintf(path, PATH_MAX, "%s/%s/lxc_rdepends", c->config_path,
3550 c->name);
3551 if (ret < 0 || ret >= PATH_MAX)
3552 return false;
3553
3554 f = fopen(path, "a");
3555 if (!f)
3556 return false;
3557
3558 bret = true;
3559
3560 /* If anything goes wrong, just return an error. */
3561 if (fprintf(f, "%s\n%s\n", c0->config_path, c0->name) < 0)
3562 bret = false;
3563
3564 if (fclose(f) != 0)
3565 bret = false;
3566
3567 return bret;
3568 }
3569
3570 /*
3571 * If the fs natively supports snapshot clones with no penalty,
3572 * then default to those even if not requested.
3573 * Currently we only do this for btrfs.
3574 */
3575 bool should_default_to_snapshot(struct lxc_container *c0,
3576 struct lxc_container *c1)
3577 {
3578 __do_free char *p0 = NULL, *p1 = NULL;
3579 int ret;
3580 size_t l0 = strlen(c0->config_path) + strlen(c0->name) + 2;
3581 size_t l1 = strlen(c1->config_path) + strlen(c1->name) + 2;
3582 char *rootfs = c0->lxc_conf->rootfs.path;
3583
3584 p0 = must_realloc(NULL, l0 + 1);
3585 p1 = must_realloc(NULL, l1 + 1);
3586 ret = snprintf(p0, l0, "%s/%s", c0->config_path, c0->name);
3587 if (ret < 0 || ret >= l0)
3588 return false;
3589
3590 ret = snprintf(p1, l1, "%s/%s", c1->config_path, c1->name);
3591 if (ret < 0 || ret >= l1)
3592 return false;
3593
3594 if (!is_btrfs_fs(p0) || !is_btrfs_fs(p1))
3595 return false;
3596
3597 if (is_btrfs_subvol(rootfs) <= 0)
3598 return false;
3599
3600 return btrfs_same_fs(p0, p1) == 0;
3601 }
3602
3603 static int copy_storage(struct lxc_container *c0, struct lxc_container *c,
3604 const char *newtype, int flags, const char *bdevdata,
3605 uint64_t newsize)
3606 {
3607 struct lxc_storage *bdev;
3608 bool need_rdep;
3609
3610 if (should_default_to_snapshot(c0, c))
3611 flags |= LXC_CLONE_SNAPSHOT;
3612
3613 bdev = storage_copy(c0, c->name, c->config_path, newtype, flags,
3614 bdevdata, newsize, &need_rdep);
3615 if (!bdev) {
3616 ERROR("Error copying storage.");
3617 return -1;
3618 }
3619
3620 /* Set new rootfs. */
3621 free(c->lxc_conf->rootfs.path);
3622 c->lxc_conf->rootfs.path = strdup(bdev->src);
3623 storage_put(bdev);
3624
3625 if (!c->lxc_conf->rootfs.path) {
3626 ERROR("Out of memory while setting storage path.");
3627 return -1;
3628 }
3629
3630 /* Append a new lxc.rootfs.path entry to the unexpanded config. */
3631 clear_unexp_config_line(c->lxc_conf, "lxc.rootfs.path", false);
3632 if (!do_append_unexp_config_line(c->lxc_conf, "lxc.rootfs.path",
3633 c->lxc_conf->rootfs.path)) {
3634 ERROR("Error saving new rootfs to cloned config.");
3635 return -1;
3636 }
3637
3638 if (flags & LXC_CLONE_SNAPSHOT)
3639 copy_rdepends(c, c0);
3640
3641 if (need_rdep) {
3642 if (!add_rdepends(c, c0))
3643 WARN("Error adding reverse dependency from %s to %s",
3644 c->name, c0->name);
3645 }
3646
3647 mod_all_rdeps(c, true);
3648
3649 return 0;
3650 }
3651
3652 struct clone_update_data {
3653 struct lxc_container *c0;
3654 struct lxc_container *c1;
3655 int flags;
3656 char **hookargs;
3657 };
3658
3659 static int clone_update_rootfs(struct clone_update_data *data)
3660 {
3661 struct lxc_container *c0 = data->c0;
3662 struct lxc_container *c = data->c1;
3663 int flags = data->flags;
3664 char **hookargs = data->hookargs;
3665 int ret = -1;
3666 char path[PATH_MAX];
3667 struct lxc_storage *bdev;
3668 FILE *fout;
3669 struct lxc_conf *conf = c->lxc_conf;
3670
3671 /* update hostname in rootfs */
3672 /* we're going to mount, so run in a clean namespace to simplify cleanup */
3673
3674 if (setgid(0) < 0) {
3675 ERROR("Failed to setgid to 0");
3676 return -1;
3677 }
3678
3679 if (setuid(0) < 0) {
3680 ERROR("Failed to setuid to 0");
3681 return -1;
3682 }
3683
3684 if (setgroups(0, NULL) < 0)
3685 WARN("Failed to clear groups");
3686
3687 if (unshare(CLONE_NEWNS) < 0)
3688 return -1;
3689
3690 bdev = storage_init(c->lxc_conf);
3691 if (!bdev)
3692 return -1;
3693
3694 if (strcmp(bdev->type, "dir") != 0) {
3695 if (unshare(CLONE_NEWNS) < 0) {
3696 ERROR("error unsharing mounts");
3697 storage_put(bdev);
3698 return -1;
3699 }
3700
3701 if (detect_shared_rootfs()) {
3702 if (mount(NULL, "/", NULL, MS_SLAVE|MS_REC, NULL)) {
3703 SYSERROR("Failed to make / rslave");
3704 ERROR("Continuing...");
3705 }
3706 }
3707
3708 if (bdev->ops->mount(bdev) < 0) {
3709 storage_put(bdev);
3710 return -1;
3711 }
3712 } else { /* TODO come up with a better way */
3713 free(bdev->dest);
3714 bdev->dest = strdup(lxc_storage_get_path(bdev->src, bdev->type));
3715 }
3716
3717 if (!lxc_list_empty(&conf->hooks[LXCHOOK_CLONE])) {
3718 /* Start of environment variable setup for hooks */
3719 if (c0->name && setenv("LXC_SRC_NAME", c0->name, 1))
3720 SYSERROR("failed to set environment variable for source container name");
3721
3722 if (setenv("LXC_NAME", c->name, 1))
3723 SYSERROR("failed to set environment variable for container name");
3724
3725 if (conf->rcfile && setenv("LXC_CONFIG_FILE", conf->rcfile, 1))
3726 SYSERROR("failed to set environment variable for config path");
3727
3728 if (bdev->dest && setenv("LXC_ROOTFS_MOUNT", bdev->dest, 1))
3729 SYSERROR("failed to set environment variable for rootfs mount");
3730
3731 if (conf->rootfs.path && setenv("LXC_ROOTFS_PATH", conf->rootfs.path, 1))
3732 SYSERROR("failed to set environment variable for rootfs mount");
3733
3734 if (run_lxc_hooks(c->name, "clone", conf, hookargs)) {
3735 ERROR("Error executing clone hook for %s", c->name);
3736 storage_put(bdev);
3737 return -1;
3738 }
3739 }
3740
3741 if (!(flags & LXC_CLONE_KEEPNAME)) {
3742 ret = snprintf(path, PATH_MAX, "%s/etc/hostname", bdev->dest);
3743 storage_put(bdev);
3744
3745 if (ret < 0 || ret >= PATH_MAX)
3746 return -1;
3747
3748 if (!file_exists(path))
3749 return 0;
3750
3751 if (!(fout = fopen(path, "w"))) {
3752 SYSERROR("unable to open %s: ignoring", path);
3753 return 0;
3754 }
3755
3756 if (fprintf(fout, "%s", c->name) < 0) {
3757 fclose(fout);
3758 return -1;
3759 }
3760
3761 if (fclose(fout) < 0)
3762 return -1;
3763 } else {
3764 storage_put(bdev);
3765 }
3766
3767 return 0;
3768 }
3769
3770 static int clone_update_rootfs_wrapper(void *data)
3771 {
3772 struct clone_update_data *arg = (struct clone_update_data *) data;
3773 return clone_update_rootfs(arg);
3774 }
3775
3776 /*
3777 * We want to support:
3778 sudo lxc-clone -o o1 -n n1 -s -L|-fssize fssize -v|--vgname vgname \
3779 -p|--lvprefix lvprefix -t|--fstype fstype -B backingstore
3780
3781 -s [ implies overlay]
3782 -s -B overlay
3783
3784 only rootfs gets converted (copied/snapshotted) on clone.
3785 */
3786
3787 static int create_file_dirname(char *path, struct lxc_conf *conf)
3788 {
3789 char *p = strrchr(path, '/');
3790 int ret = -1;
3791
3792 if (!p)
3793 return -1;
3794
3795 *p = '\0';
3796 ret = do_create_container_dir(path, conf);
3797 *p = '/';
3798
3799 return ret;
3800 }
3801
3802 static struct lxc_container *do_lxcapi_clone(struct lxc_container *c, const char *newname,
3803 const char *lxcpath, int flags,
3804 const char *bdevtype, const char *bdevdata, uint64_t newsize,
3805 char **hookargs)
3806 {
3807 char newpath[PATH_MAX];
3808 int fd, ret;
3809 struct clone_update_data data;
3810 size_t saved_unexp_len;
3811 pid_t pid;
3812 int storage_copied = 0;
3813 char *origroot = NULL, *saved_unexp_conf = NULL;
3814 struct lxc_container *c2 = NULL;
3815
3816 if (!c || !do_lxcapi_is_defined(c))
3817 return NULL;
3818
3819 if (container_mem_lock(c))
3820 return NULL;
3821 if (!is_stopped(c) && !(flags & LXC_CLONE_ALLOW_RUNNING)) {
3822 ERROR("error: Original container (%s) is running. Use --allowrunning if you want to force a snapshot of the running container.", c->name);
3823 goto out;
3824 }
3825
3826 /* Make sure the container doesn't yet exist. */
3827 if (!newname)
3828 newname = c->name;
3829
3830 if (!lxcpath)
3831 lxcpath = do_lxcapi_get_config_path(c);
3832
3833 ret = snprintf(newpath, PATH_MAX, "%s/%s/config", lxcpath, newname);
3834 if (ret < 0 || ret >= PATH_MAX) {
3835 SYSERROR("clone: failed making config pathname");
3836 goto out;
3837 }
3838
3839 if (file_exists(newpath)) {
3840 ERROR("error: clone: %s exists", newpath);
3841 goto out;
3842 }
3843
3844 ret = create_file_dirname(newpath, c->lxc_conf);
3845 if (ret < 0 && errno != EEXIST) {
3846 ERROR("Error creating container dir for %s", newpath);
3847 goto out;
3848 }
3849
3850 /* Copy the configuration. Tweak it as needed. */
3851 if (c->lxc_conf->rootfs.path) {
3852 origroot = c->lxc_conf->rootfs.path;
3853 c->lxc_conf->rootfs.path = NULL;
3854 }
3855
3856 fd = open(newpath, O_WRONLY | O_CREAT | O_CLOEXEC,
3857 S_IRUSR | S_IWUSR | S_IRGRP | S_IWGRP);
3858 if (fd < 0) {
3859 SYSERROR("Failed to open \"%s\"", newpath);
3860 goto out;
3861 }
3862
3863 saved_unexp_conf = c->lxc_conf->unexpanded_config;
3864 saved_unexp_len = c->lxc_conf->unexpanded_len;
3865 c->lxc_conf->unexpanded_config = strdup(saved_unexp_conf);
3866 if (!c->lxc_conf->unexpanded_config) {
3867 close(fd);
3868 goto out;
3869 }
3870
3871 clear_unexp_config_line(c->lxc_conf, "lxc.rootfs.path", false);
3872 write_config(fd, c->lxc_conf);
3873 close(fd);
3874
3875 c->lxc_conf->rootfs.path = origroot;
3876
3877 free(c->lxc_conf->unexpanded_config);
3878 c->lxc_conf->unexpanded_config = saved_unexp_conf;
3879 saved_unexp_conf = NULL;
3880 c->lxc_conf->unexpanded_len = saved_unexp_len;
3881
3882 ret = snprintf(newpath, PATH_MAX, "%s/%s/rootfs", lxcpath, newname);
3883 if (ret < 0 || ret >= PATH_MAX) {
3884 SYSERROR("clone: failed making rootfs pathname");
3885 goto out;
3886 }
3887
3888 ret = mkdir(newpath, 0755);
3889 if (ret < 0) {
3890 /* For an overlay container the rootfs is considered immutable
3891 * and will not have been removed when restoring from a
3892 * snapshot.
3893 */
3894 if (errno != ENOENT &&
3895 !(flags & LXC_STORAGE_INTERNAL_OVERLAY_RESTORE)) {
3896 SYSERROR("Failed to create directory \"%s\"", newpath);
3897 goto out;
3898 }
3899 }
3900
3901 if (am_guest_unpriv()) {
3902 if (chown_mapped_root(newpath, c->lxc_conf) < 0) {
3903 ERROR("Error chowning %s to container root", newpath);
3904 goto out;
3905 }
3906 }
3907
3908 c2 = lxc_container_new(newname, lxcpath);
3909 if (!c2) {
3910 ERROR("clone: failed to create new container (%s %s)", newname,
3911 lxcpath);
3912 goto out;
3913 }
3914
3915 /* copy/snapshot rootfs's */
3916 ret = copy_storage(c, c2, bdevtype, flags, bdevdata, newsize);
3917 if (ret < 0)
3918 goto out;
3919
3920 /* update utsname */
3921 if (!(flags & LXC_CLONE_KEEPNAME)) {
3922 clear_unexp_config_line(c2->lxc_conf, "lxc.utsname", false);
3923 clear_unexp_config_line(c2->lxc_conf, "lxc.uts.name", false);
3924
3925 if (!do_set_config_item_locked(c2, "lxc.uts.name", newname)) {
3926 ERROR("Error setting new hostname");
3927 goto out;
3928 }
3929 }
3930
3931 /* copy hooks */
3932 ret = copyhooks(c, c2);
3933 if (ret < 0) {
3934 ERROR("error copying hooks");
3935 goto out;
3936 }
3937
3938 if (copy_fstab(c, c2) < 0) {
3939 ERROR("error copying fstab");
3940 goto out;
3941 }
3942
3943 /* update macaddrs */
3944 if (!(flags & LXC_CLONE_KEEPMACADDR)) {
3945 if (!network_new_hwaddrs(c2->lxc_conf)) {
3946 ERROR("Error updating mac addresses");
3947 goto out;
3948 }
3949 }
3950
3951 /* Update absolute paths for overlay mount directories. */
3952 if (ovl_update_abs_paths(c2->lxc_conf, c->config_path, c->name, lxcpath, newname) < 0)
3953 goto out;
3954
3955 /* We've now successfully created c2's storage, so clear it out if we
3956 * fail after this.
3957 */
3958 storage_copied = 1;
3959
3960 if (!c2->save_config(c2, NULL))
3961 goto out;
3962
3963 if ((pid = fork()) < 0) {
3964 SYSERROR("fork");
3965 goto out;
3966 }
3967
3968 if (pid > 0) {
3969 ret = wait_for_pid(pid);
3970 if (ret)
3971 goto out;
3972
3973 container_mem_unlock(c);
3974 return c2;
3975 }
3976
3977 data.c0 = c;
3978 data.c1 = c2;
3979 data.flags = flags;
3980 data.hookargs = hookargs;
3981
3982 if (am_guest_unpriv())
3983 ret = userns_exec_full(c->lxc_conf, clone_update_rootfs_wrapper,
3984 &data, "clone_update_rootfs_wrapper");
3985 else
3986 ret = clone_update_rootfs(&data);
3987 if (ret < 0)
3988 _exit(EXIT_FAILURE);
3989
3990 container_mem_unlock(c);
3991 _exit(EXIT_SUCCESS);
3992
3993 out:
3994 container_mem_unlock(c);
3995 if (c2) {
3996 if (!storage_copied)
3997 c2->lxc_conf->rootfs.path = NULL;
3998
3999 c2->destroy(c2);
4000 lxc_container_put(c2);
4001 }
4002
4003 return NULL;
4004 }
4005
4006 static struct lxc_container *lxcapi_clone(struct lxc_container *c, const char *newname,
4007 const char *lxcpath, int flags,
4008 const char *bdevtype, const char *bdevdata, uint64_t newsize,
4009 char **hookargs)
4010 {
4011 struct lxc_container * ret;
4012
4013 current_config = c ? c->lxc_conf : NULL;
4014 ret = do_lxcapi_clone(c, newname, lxcpath, flags, bdevtype, bdevdata, newsize, hookargs);
4015 current_config = NULL;
4016
4017 return ret;
4018 }
4019
4020 static bool do_lxcapi_rename(struct lxc_container *c, const char *newname)
4021 {
4022 struct lxc_storage *bdev;
4023 struct lxc_container *newc;
4024
4025 if (!c || !c->name || !c->config_path || !c->lxc_conf)
4026 return false;
4027
4028 if (has_fs_snapshots(c) || has_snapshots(c)) {
4029 ERROR("Renaming a container with snapshots is not supported");
4030 return false;
4031 }
4032
4033 bdev = storage_init(c->lxc_conf);
4034 if (!bdev) {
4035 ERROR("Failed to find original backing store type");
4036 return false;
4037 }
4038
4039 newc = lxcapi_clone(c, newname, c->config_path, LXC_CLONE_KEEPMACADDR, NULL, bdev->type, 0, NULL);
4040 storage_put(bdev);
4041 if (!newc) {
4042 lxc_container_put(newc);
4043 return false;
4044 }
4045
4046 if (newc && lxcapi_is_defined(newc))
4047 lxc_container_put(newc);
4048
4049 if (!container_destroy(c, NULL)) {
4050 ERROR("Could not destroy existing container %s", c->name);
4051 return false;
4052 }
4053
4054 return true;
4055 }
4056
4057 WRAP_API_1(bool, lxcapi_rename, const char *)
4058
4059 static int lxcapi_attach(struct lxc_container *c,
4060 lxc_attach_exec_t exec_function, void *exec_payload,
4061 lxc_attach_options_t *options, pid_t *attached_process)
4062 {
4063 int ret;
4064
4065 if (!c)
4066 return -1;
4067
4068 current_config = c->lxc_conf;
4069
4070 ret = lxc_attach(c, exec_function, exec_payload, options,
4071 attached_process);
4072 current_config = NULL;
4073 return ret;
4074 }
4075
4076 static int do_lxcapi_attach_run_wait(struct lxc_container *c,
4077 lxc_attach_options_t *options,
4078 const char *program,
4079 const char *const argv[])
4080 {
4081 lxc_attach_command_t command;
4082 pid_t pid;
4083 int ret;
4084
4085 if (!c)
4086 return -1;
4087
4088 command.program = (char *)program;
4089 command.argv = (char **)argv;
4090
4091 ret = lxc_attach(c, lxc_attach_run_command, &command, options, &pid);
4092 if (ret < 0)
4093 return ret;
4094
4095 return lxc_wait_for_pid_status(pid);
4096 }
4097
4098 static int lxcapi_attach_run_wait(struct lxc_container *c,
4099 lxc_attach_options_t *options,
4100 const char *program, const char *const argv[])
4101 {
4102 int ret;
4103
4104 current_config = c ? c->lxc_conf : NULL;
4105 ret = do_lxcapi_attach_run_wait(c, options, program, argv);
4106 current_config = NULL;
4107
4108 return ret;
4109 }
4110
4111 static int get_next_index(const char *lxcpath, char *cname)
4112 {
4113 __do_free char *fname = NULL;
4114 struct stat sb;
4115 int i = 0, ret;
4116
4117 fname = must_realloc(NULL, strlen(lxcpath) + 20);
4118
4119 for (;;) {
4120 sprintf(fname, "%s/snap%d", lxcpath, i);
4121
4122 ret = stat(fname, &sb);
4123 if (ret != 0)
4124 return i;
4125
4126 i++;
4127 }
4128 }
4129
4130 static bool get_snappath_dir(struct lxc_container *c, char *snappath)
4131 {
4132 int ret;
4133
4134 /*
4135 * If the old style snapshot path exists, use it
4136 * /var/lib/lxc -> /var/lib/lxcsnaps
4137 */
4138 ret = snprintf(snappath, PATH_MAX, "%ssnaps", c->config_path);
4139 if (ret < 0 || ret >= PATH_MAX)
4140 return false;
4141
4142 if (dir_exists(snappath)) {
4143 ret = snprintf(snappath, PATH_MAX, "%ssnaps/%s", c->config_path, c->name);
4144 if (ret < 0 || ret >= PATH_MAX)
4145 return false;
4146
4147 return true;
4148 }
4149
4150 /*
4151 * Use the new style path
4152 * /var/lib/lxc -> /var/lib/lxc + c->name + /snaps + \0
4153 */
4154 ret = snprintf(snappath, PATH_MAX, "%s/%s/snaps", c->config_path, c->name);
4155 if (ret < 0 || ret >= PATH_MAX)
4156 return false;
4157
4158 return true;
4159 }
4160
4161 static int do_lxcapi_snapshot(struct lxc_container *c, const char *commentfile)
4162 {
4163 __do_free char *dfnam = NULL;
4164 int i, flags, ret;
4165 time_t timer;
4166 struct tm tm_info;
4167 struct lxc_container *c2;
4168 char snappath[PATH_MAX], newname[20];
4169 char buffer[25];
4170 FILE *f;
4171
4172 if (!c || !lxcapi_is_defined(c))
4173 return -1;
4174
4175 if (!storage_can_backup(c->lxc_conf)) {
4176 ERROR("%s's backing store cannot be backed up", c->name);
4177 ERROR("Your container must use another backing store type");
4178 return -1;
4179 }
4180
4181 if (!get_snappath_dir(c, snappath))
4182 return -1;
4183
4184 i = get_next_index(snappath, c->name);
4185
4186 if (mkdir_p(snappath, 0755) < 0) {
4187 ERROR("Failed to create snapshot directory %s", snappath);
4188 return -1;
4189 }
4190
4191 ret = snprintf(newname, 20, "snap%d", i);
4192 if (ret < 0 || ret >= 20)
4193 return -1;
4194
4195 /*
4196 * We pass LXC_CLONE_SNAPSHOT to make sure that a rdepends file entry is
4197 * created in the original container
4198 */
4199 flags = LXC_CLONE_SNAPSHOT | LXC_CLONE_KEEPMACADDR | LXC_CLONE_KEEPNAME |
4200 LXC_CLONE_KEEPBDEVTYPE | LXC_CLONE_MAYBE_SNAPSHOT;
4201 if (storage_is_dir(c->lxc_conf)) {
4202 ERROR("Snapshot of directory-backed container requested");
4203 ERROR("Making a copy-clone. If you do want snapshots, then");
4204 ERROR("please create overlay clone first, snapshot that");
4205 ERROR("and keep the original container pristine");
4206 flags &= ~LXC_CLONE_SNAPSHOT | LXC_CLONE_MAYBE_SNAPSHOT;
4207 }
4208
4209 c2 = do_lxcapi_clone(c, newname, snappath, flags, NULL, NULL, 0, NULL);
4210 if (!c2) {
4211 ERROR("Failed to clone of %s:%s", c->config_path, c->name);
4212 return -1;
4213 }
4214
4215 lxc_container_put(c2);
4216
4217 /* Now write down the creation time. */
4218 time(&timer);
4219
4220 if (!localtime_r(&timer, &tm_info)) {
4221 ERROR("Failed to get localtime");
4222 return -1;
4223 }
4224
4225 strftime(buffer, 25, "%Y:%m:%d %H:%M:%S", &tm_info);
4226
4227 dfnam = must_realloc(NULL, strlen(snappath) + strlen(newname) + 5);
4228 sprintf(dfnam, "%s/%s/ts", snappath, newname);
4229 f = fopen(dfnam, "w");
4230 if (!f) {
4231 ERROR("Failed to open %s", dfnam);
4232 return -1;
4233 }
4234
4235 if (fprintf(f, "%s", buffer) < 0) {
4236 SYSERROR("Writing timestamp");
4237 fclose(f);
4238 return -1;
4239 }
4240
4241 ret = fclose(f);
4242 if (ret != 0) {
4243 SYSERROR("Writing timestamp");
4244 return -1;
4245 }
4246
4247 if (commentfile) {
4248 __do_free char *path = NULL;
4249 /* $p / $name / comment \0 */
4250 int len = strlen(snappath) + strlen(newname) + 10;
4251
4252 path = must_realloc(NULL, len);
4253 sprintf(path, "%s/%s/comment", snappath, newname);
4254 return copy_file(commentfile, path) < 0 ? -1 : i;
4255 }
4256
4257 return i;
4258 }
4259
4260 WRAP_API_1(int, lxcapi_snapshot, const char *)
4261
4262 static void lxcsnap_free(struct lxc_snapshot *s)
4263 {
4264 free(s->name);
4265 free(s->comment_pathname);
4266 free(s->timestamp);
4267 free(s->lxcpath);
4268 }
4269
4270 static char *get_snapcomment_path(char* snappath, char *name)
4271 {
4272 /* $snappath/$name/comment */
4273 int ret, len = strlen(snappath) + strlen(name) + 10;
4274 char *s = malloc(len);
4275
4276 if (s) {
4277 ret = snprintf(s, len, "%s/%s/comment", snappath, name);
4278 if (ret < 0 || ret >= len) {
4279 free(s);
4280 s = NULL;
4281 }
4282 }
4283
4284 return s;
4285 }
4286
4287 static char *get_timestamp(char* snappath, char *name)
4288 {
4289 char path[PATH_MAX], *s = NULL;
4290 int ret, len;
4291 FILE *fin;
4292
4293 ret = snprintf(path, PATH_MAX, "%s/%s/ts", snappath, name);
4294 if (ret < 0 || ret >= PATH_MAX)
4295 return NULL;
4296
4297 fin = fopen(path, "r");
4298 if (!fin)
4299 return NULL;
4300
4301 (void) fseek(fin, 0, SEEK_END);
4302 len = ftell(fin);
4303 (void) fseek(fin, 0, SEEK_SET);
4304 if (len > 0) {
4305 s = malloc(len+1);
4306 if (s) {
4307 s[len] = '\0';
4308 if (fread(s, 1, len, fin) != len) {
4309 SYSERROR("reading timestamp");
4310 free(s);
4311 s = NULL;
4312 }
4313 }
4314 }
4315
4316 fclose(fin);
4317 return s;
4318 }
4319
4320 static int do_lxcapi_snapshot_list(struct lxc_container *c, struct lxc_snapshot **ret_snaps)
4321 {
4322 char snappath[PATH_MAX], path2[PATH_MAX];
4323 int count = 0, ret;
4324 struct dirent *direntp;
4325 struct lxc_snapshot *snaps =NULL, *nsnaps;
4326 DIR *dir;
4327
4328 if (!c || !lxcapi_is_defined(c))
4329 return -1;
4330
4331 if (!get_snappath_dir(c, snappath)) {
4332 ERROR("path name too long");
4333 return -1;
4334 }
4335
4336 dir = opendir(snappath);
4337 if (!dir) {
4338 INFO("Failed to open %s - assuming no snapshots", snappath);
4339 return 0;
4340 }
4341
4342 while ((direntp = readdir(dir))) {
4343 if (!strcmp(direntp->d_name, "."))
4344 continue;
4345
4346 if (!strcmp(direntp->d_name, ".."))
4347 continue;
4348
4349 ret = snprintf(path2, PATH_MAX, "%s/%s/config", snappath, direntp->d_name);
4350 if (ret < 0 || ret >= PATH_MAX) {
4351 ERROR("pathname too long");
4352 goto out_free;
4353 }
4354
4355 if (!file_exists(path2))
4356 continue;
4357
4358 nsnaps = realloc(snaps, (count + 1)*sizeof(*snaps));
4359 if (!nsnaps) {
4360 SYSERROR("Out of memory");
4361 goto out_free;
4362 }
4363
4364 snaps = nsnaps;
4365 snaps[count].free = lxcsnap_free;
4366 snaps[count].name = strdup(direntp->d_name);
4367 if (!snaps[count].name)
4368 goto out_free;
4369
4370 snaps[count].lxcpath = strdup(snappath);
4371 if (!snaps[count].lxcpath) {
4372 free(snaps[count].name);
4373 goto out_free;
4374 }
4375
4376 snaps[count].comment_pathname = get_snapcomment_path(snappath, direntp->d_name);
4377 snaps[count].timestamp = get_timestamp(snappath, direntp->d_name);
4378 count++;
4379 }
4380
4381 if (closedir(dir))
4382 WARN("Failed to close directory");
4383
4384 *ret_snaps = snaps;
4385 return count;
4386
4387 out_free:
4388 if (snaps) {
4389 int i;
4390
4391 for (i=0; i<count; i++)
4392 lxcsnap_free(&snaps[i]);
4393
4394 free(snaps);
4395 }
4396
4397 if (closedir(dir))
4398 WARN("Failed to close directory");
4399
4400 return -1;
4401 }
4402
4403 WRAP_API_1(int, lxcapi_snapshot_list, struct lxc_snapshot **)
4404
4405 static bool do_lxcapi_snapshot_restore(struct lxc_container *c, const char *snapname, const char *newname)
4406 {
4407 char clonelxcpath[PATH_MAX];
4408 int flags = 0;
4409 struct lxc_container *snap, *rest;
4410 struct lxc_storage *bdev;
4411 bool b = false;
4412
4413 if (!c || !c->name || !c->config_path)
4414 return false;
4415
4416 if (has_fs_snapshots(c)) {
4417 ERROR("container rootfs has dependent snapshots");
4418 return false;
4419 }
4420
4421 bdev = storage_init(c->lxc_conf);
4422 if (!bdev) {
4423 ERROR("Failed to find original backing store type");
4424 return false;
4425 }
4426
4427 /* For an overlay container the rootfs is considered immutable
4428 * and cannot be removed when restoring from a snapshot. We pass this
4429 * internal flag along to communicate this to various parts of the
4430 * codebase.
4431 */
4432 if (!strcmp(bdev->type, "overlay") || !strcmp(bdev->type, "overlayfs"))
4433 bdev->flags |= LXC_STORAGE_INTERNAL_OVERLAY_RESTORE;
4434
4435 if (!newname)
4436 newname = c->name;
4437
4438 if (!get_snappath_dir(c, clonelxcpath)) {
4439 storage_put(bdev);
4440 return false;
4441 }
4442 /* how should we lock this? */
4443
4444 snap = lxc_container_new(snapname, clonelxcpath);
4445 if (!snap || !lxcapi_is_defined(snap)) {
4446 ERROR("Could not open snapshot %s", snapname);
4447
4448 if (snap)
4449 lxc_container_put(snap);
4450
4451 storage_put(bdev);
4452 return false;
4453 }
4454
4455 if (!strcmp(c->name, newname)) {
4456 if (!container_destroy(c, bdev)) {
4457 ERROR("Could not destroy existing container %s", newname);
4458 lxc_container_put(snap);
4459 storage_put(bdev);
4460 return false;
4461 }
4462 }
4463
4464 if (strcmp(bdev->type, "dir") != 0 && strcmp(bdev->type, "loop") != 0)
4465 flags = LXC_CLONE_SNAPSHOT | LXC_CLONE_MAYBE_SNAPSHOT;
4466
4467 if (!strcmp(bdev->type, "overlay") || !strcmp(bdev->type, "overlayfs"))
4468 flags |= LXC_STORAGE_INTERNAL_OVERLAY_RESTORE;
4469
4470 rest = lxcapi_clone(snap, newname, c->config_path, flags, bdev->type,
4471 NULL, 0, NULL);
4472 storage_put(bdev);
4473 if (rest && lxcapi_is_defined(rest))
4474 b = true;
4475
4476 if (rest)
4477 lxc_container_put(rest);
4478
4479 lxc_container_put(snap);
4480 return b;
4481 }
4482
4483 WRAP_API_2(bool, lxcapi_snapshot_restore, const char *, const char *)
4484
4485 static bool do_snapshot_destroy(const char *snapname, const char *clonelxcpath)
4486 {
4487 struct lxc_container *snap = NULL;
4488 bool bret = false;
4489
4490 snap = lxc_container_new(snapname, clonelxcpath);
4491 if (!snap) {
4492 ERROR("Could not find snapshot %s", snapname);
4493 goto err;
4494 }
4495
4496 if (!do_lxcapi_destroy(snap)) {
4497 ERROR("Could not destroy snapshot %s", snapname);
4498 goto err;
4499 }
4500
4501 bret = true;
4502
4503 err:
4504 if (snap)
4505 lxc_container_put(snap);
4506
4507 return bret;
4508 }
4509
4510 static bool remove_all_snapshots(const char *path)
4511 {
4512 DIR *dir;
4513 struct dirent *direntp;
4514 bool bret = true;
4515
4516 dir = opendir(path);
4517 if (!dir) {
4518 SYSERROR("opendir on snapshot path %s", path);
4519 return false;
4520 }
4521
4522 while ((direntp = readdir(dir))) {
4523 if (!strcmp(direntp->d_name, "."))
4524 continue;
4525
4526 if (!strcmp(direntp->d_name, ".."))
4527 continue;
4528
4529 if (!do_snapshot_destroy(direntp->d_name, path)) {
4530 bret = false;
4531 continue;
4532 }
4533 }
4534
4535 closedir(dir);
4536
4537 if (rmdir(path))
4538 SYSERROR("Error removing directory %s", path);
4539
4540 return bret;
4541 }
4542
4543 static bool do_lxcapi_snapshot_destroy(struct lxc_container *c, const char *snapname)
4544 {
4545 char clonelxcpath[PATH_MAX];
4546
4547 if (!c || !c->name || !c->config_path || !snapname)
4548 return false;
4549
4550 if (!get_snappath_dir(c, clonelxcpath))
4551 return false;
4552
4553 return do_snapshot_destroy(snapname, clonelxcpath);
4554 }
4555
4556 WRAP_API_1(bool, lxcapi_snapshot_destroy, const char *)
4557
4558 static bool do_lxcapi_snapshot_destroy_all(struct lxc_container *c)
4559 {
4560 char clonelxcpath[PATH_MAX];
4561
4562 if (!c || !c->name || !c->config_path)
4563 return false;
4564
4565 if (!get_snappath_dir(c, clonelxcpath))
4566 return false;
4567
4568 return remove_all_snapshots(clonelxcpath);
4569 }
4570
4571 WRAP_API(bool, lxcapi_snapshot_destroy_all)
4572
4573 static bool do_lxcapi_may_control(struct lxc_container *c)
4574 {
4575 if (!c)
4576 return false;
4577
4578 return lxc_try_cmd(c->name, c->config_path) == 0;
4579 }
4580
4581 WRAP_API(bool, lxcapi_may_control)
4582
4583 static bool do_add_remove_node(pid_t init_pid, const char *path, bool add,
4584 struct stat *st)
4585 {
4586 int ret;
4587 char *tmp;
4588 pid_t pid;
4589 char chrootpath[PATH_MAX];
4590 char *directory_path = NULL;
4591
4592 pid = fork();
4593 if (pid < 0) {
4594 SYSERROR("Failed to fork()");
4595 return false;
4596 }
4597
4598 if (pid) {
4599 ret = wait_for_pid(pid);
4600 if (ret != 0) {
4601 ERROR("Failed to create device node");
4602 return false;
4603 }
4604
4605 return true;
4606 }
4607
4608 /* prepare the path */
4609 ret = snprintf(chrootpath, PATH_MAX, "/proc/%d/root", init_pid);
4610 if (ret < 0 || ret >= PATH_MAX)
4611 return false;
4612
4613 ret = chroot(chrootpath);
4614 if (ret < 0)
4615 _exit(EXIT_FAILURE);
4616
4617 ret = chdir("/");
4618 if (ret < 0)
4619 _exit(EXIT_FAILURE);
4620
4621 /* remove path if it exists */
4622 ret = faccessat(AT_FDCWD, path, F_OK, AT_SYMLINK_NOFOLLOW);
4623 if(ret == 0) {
4624 ret = unlink(path);
4625 if (ret < 0) {
4626 SYSERROR("Failed to remove \"%s\"", path);
4627 _exit(EXIT_FAILURE);
4628 }
4629 }
4630
4631 if (!add)
4632 _exit(EXIT_SUCCESS);
4633
4634 /* create any missing directories */
4635 tmp = strdup(path);
4636 if (!tmp)
4637 _exit(EXIT_FAILURE);
4638
4639 directory_path = dirname(tmp);
4640 ret = mkdir_p(directory_path, 0755);
4641 if (ret < 0 && errno != EEXIST) {
4642 SYSERROR("Failed to create path \"%s\"", directory_path);
4643 free(tmp);
4644 _exit(EXIT_FAILURE);
4645 }
4646
4647 /* create the device node */
4648 ret = mknod(path, st->st_mode, st->st_rdev);
4649 free(tmp);
4650 if (ret < 0) {
4651 SYSERROR("Failed to create device node at \"%s\"", path);
4652 _exit(EXIT_FAILURE);
4653 }
4654
4655 _exit(EXIT_SUCCESS);
4656 }
4657
4658 static bool add_remove_device_node(struct lxc_container *c, const char *src_path, const char *dest_path, bool add)
4659 {
4660 int ret;
4661 struct stat st;
4662 char value[LXC_MAX_BUFFER];
4663 const char *p;
4664 pid_t init_pid;
4665
4666 /* make sure container is running */
4667 if (!do_lxcapi_is_running(c)) {
4668 ERROR("container is not running");
4669 return false;
4670 }
4671
4672 /* use src_path if dest_path is NULL otherwise use dest_path */
4673 p = dest_path ? dest_path : src_path;
4674
4675 /* make sure we can access p */
4676 if(access(p, F_OK) < 0 || stat(p, &st) < 0)
4677 return false;
4678
4679 /* continue if path is character device or block device */
4680 if (S_ISCHR(st.st_mode))
4681 ret = snprintf(value, LXC_MAX_BUFFER, "c %d:%d rwm", major(st.st_rdev), minor(st.st_rdev));
4682 else if (S_ISBLK(st.st_mode))
4683 ret = snprintf(value, LXC_MAX_BUFFER, "b %d:%d rwm", major(st.st_rdev), minor(st.st_rdev));
4684 else
4685 return false;
4686
4687 /* check snprintf return code */
4688 if (ret < 0 || ret >= LXC_MAX_BUFFER)
4689 return false;
4690
4691 init_pid = do_lxcapi_init_pid(c);
4692 if (init_pid < 0) {
4693 ERROR("Failed to get init pid");
4694 return false;
4695 }
4696
4697 if (!do_add_remove_node(init_pid, p, add, &st))
4698 return false;
4699
4700 /* add or remove device to/from cgroup access list */
4701 if (add) {
4702 if (!do_lxcapi_set_cgroup_item(c, "devices.allow", value)) {
4703 ERROR("set_cgroup_item failed while adding the device node");
4704 return false;
4705 }
4706 } else {
4707 if (!do_lxcapi_set_cgroup_item(c, "devices.deny", value)) {
4708 ERROR("set_cgroup_item failed while removing the device node");
4709 return false;
4710 }
4711 }
4712
4713 return true;
4714 }
4715
4716 static bool do_lxcapi_add_device_node(struct lxc_container *c, const char *src_path, const char *dest_path)
4717 {
4718 // cannot mknod if we're not privileged wrt init_user_ns
4719 if (am_host_unpriv()) {
4720 ERROR(LXC_UNPRIV_EOPNOTSUPP, __FUNCTION__);
4721 return false;
4722 }
4723
4724 return add_remove_device_node(c, src_path, dest_path, true);
4725 }
4726
4727 WRAP_API_2(bool, lxcapi_add_device_node, const char *, const char *)
4728
4729 static bool do_lxcapi_remove_device_node(struct lxc_container *c, const char *src_path, const char *dest_path)
4730 {
4731 if (am_guest_unpriv()) {
4732 ERROR(LXC_UNPRIV_EOPNOTSUPP, __FUNCTION__);
4733 return false;
4734 }
4735
4736 return add_remove_device_node(c, src_path, dest_path, false);
4737 }
4738
4739 WRAP_API_2(bool, lxcapi_remove_device_node, const char *, const char *)
4740
4741 static bool do_lxcapi_attach_interface(struct lxc_container *c,
4742 const char *ifname,
4743 const char *dst_ifname)
4744 {
4745 pid_t init_pid;
4746 int ret = 0;
4747
4748 if (am_guest_unpriv()) {
4749 ERROR(LXC_UNPRIV_EOPNOTSUPP, __FUNCTION__);
4750 return false;
4751 }
4752
4753 if (!ifname) {
4754 ERROR("No source interface name given");
4755 return false;
4756 }
4757
4758 ret = lxc_netdev_isup(ifname);
4759 if (ret > 0) {
4760 /* netdev of ifname is up. */
4761 ret = lxc_netdev_down(ifname);
4762 if (ret)
4763 goto err;
4764 }
4765
4766 init_pid = do_lxcapi_init_pid(c);
4767 if (init_pid < 0) {
4768 ERROR("Failed to get init pid");
4769 goto err;
4770 }
4771
4772 ret = lxc_netdev_move_by_name(ifname, init_pid, dst_ifname);
4773 if (ret)
4774 goto err;
4775
4776 INFO("Moved network device \"%s\" to network namespace of %d", ifname, init_pid);
4777 return true;
4778
4779 err:
4780 return false;
4781 }
4782
4783 WRAP_API_2(bool, lxcapi_attach_interface, const char *, const char *)
4784
4785 static bool do_lxcapi_detach_interface(struct lxc_container *c,
4786 const char *ifname,
4787 const char *dst_ifname)
4788 {
4789 int ret;
4790 pid_t pid, pid_outside;
4791
4792 /*
4793 * TODO - if this is a physical device, then we need am_host_unpriv.
4794 * But for other types guest privilege suffices.
4795 */
4796 if (am_guest_unpriv()) {
4797 ERROR(LXC_UNPRIV_EOPNOTSUPP, __FUNCTION__);
4798 return false;
4799 }
4800
4801 if (!ifname) {
4802 ERROR("No source interface name given");
4803 return false;
4804 }
4805
4806 pid_outside = lxc_raw_getpid();
4807 pid = fork();
4808 if (pid < 0) {
4809 ERROR("Failed to fork");
4810 return false;
4811 }
4812
4813 if (pid == 0) { /* child */
4814 pid_t init_pid;
4815
4816 init_pid = do_lxcapi_init_pid(c);
4817 if (init_pid < 0) {
4818 ERROR("Failed to get init pid");
4819 _exit(EXIT_FAILURE);
4820 }
4821 if (!switch_to_ns(init_pid, "net")) {
4822 ERROR("Failed to enter network namespace");
4823 _exit(EXIT_FAILURE);
4824 }
4825
4826 ret = lxc_netdev_isup(ifname);
4827 if (ret < 0) {
4828 ERROR("Failed to determine whether network device \"%s\" is up", ifname);
4829 _exit(EXIT_FAILURE);
4830 }
4831
4832 /* netdev of ifname is up. */
4833 if (ret) {
4834 ret = lxc_netdev_down(ifname);
4835 if (ret) {
4836 ERROR("Failed to set network device \"%s\" down", ifname);
4837 _exit(EXIT_FAILURE);
4838 }
4839 }
4840
4841 ret = lxc_netdev_move_by_name(ifname, pid_outside, dst_ifname);
4842 /* -EINVAL means there is no netdev named as ifname. */
4843 if (ret < 0) {
4844 if (ret == -EINVAL)
4845 ERROR("Network device \"%s\" not found", ifname);
4846 else
4847 ERROR("Failed to remove network device \"%s\"", ifname);
4848
4849 _exit(EXIT_FAILURE);
4850 }
4851
4852 _exit(EXIT_SUCCESS);
4853 }
4854
4855 ret = wait_for_pid(pid);
4856 if (ret != 0)
4857 return false;
4858
4859 INFO("Moved network device \"%s\" to network namespace of %d", ifname, pid_outside);
4860 return true;
4861 }
4862
4863 WRAP_API_2(bool, lxcapi_detach_interface, const char *, const char *)
4864
4865 static int do_lxcapi_migrate(struct lxc_container *c, unsigned int cmd,
4866 struct migrate_opts *opts, unsigned int size)
4867 {
4868 int ret = -1;
4869 struct migrate_opts *valid_opts = opts;
4870 uint64_t features_to_check = 0;
4871
4872 /* If the caller has a bigger (newer) struct migrate_opts, let's make
4873 * sure that the stuff on the end is zero, i.e. that they didn't ask us
4874 * to do anything special.
4875 */
4876 if (size > sizeof(*opts)) {
4877 unsigned char *addr;
4878 unsigned char *end;
4879
4880 addr = (void *)opts + sizeof(*opts);
4881 end = (void *)opts + size;
4882
4883 for (; addr < end; addr++)
4884 if (*addr)
4885 return -E2BIG;
4886 }
4887
4888 /* If the caller has a smaller struct, let's zero out the end for them
4889 * so we don't accidentally use bits of it that they didn't know about
4890 * to initialize.
4891 */
4892 if (size < sizeof(*opts)) {
4893 valid_opts = malloc(sizeof(*opts));
4894 if (!valid_opts)
4895 return -ENOMEM;
4896
4897 memset(valid_opts, 0, sizeof(*opts));
4898 memcpy(valid_opts, opts, size);
4899 }
4900
4901 switch (cmd) {
4902 case MIGRATE_PRE_DUMP:
4903 if (!do_lxcapi_is_running(c)) {
4904 ERROR("container is not running");
4905 goto on_error;
4906 }
4907
4908 ret = !__criu_pre_dump(c, valid_opts);
4909 break;
4910 case MIGRATE_DUMP:
4911 if (!do_lxcapi_is_running(c)) {
4912 ERROR("container is not running");
4913 goto on_error;
4914 }
4915
4916 ret = !__criu_dump(c, valid_opts);
4917 break;
4918 case MIGRATE_RESTORE:
4919 if (do_lxcapi_is_running(c)) {
4920 ERROR("container is already running");
4921 goto on_error;
4922 }
4923
4924 ret = !__criu_restore(c, valid_opts);
4925 break;
4926 case MIGRATE_FEATURE_CHECK:
4927 features_to_check = valid_opts->features_to_check;
4928 ret = !__criu_check_feature(&features_to_check);
4929 if (ret) {
4930 /* Something went wrong. Let's let the caller
4931 * know which feature checks failed. */
4932 valid_opts->features_to_check = features_to_check;
4933 }
4934 break;
4935 default:
4936 ERROR("invalid migrate command %u", cmd);
4937 ret = -EINVAL;
4938 }
4939
4940 on_error:
4941 if (size < sizeof(*opts))
4942 free(valid_opts);
4943
4944 return ret;
4945 }
4946
4947 WRAP_API_3(int, lxcapi_migrate, unsigned int, struct migrate_opts *, unsigned int)
4948
4949 static bool do_lxcapi_checkpoint(struct lxc_container *c, char *directory, bool stop, bool verbose)
4950 {
4951 struct migrate_opts opts;
4952
4953 memset(&opts, 0, sizeof(opts));
4954
4955 opts.directory = directory;
4956 opts.stop = stop;
4957 opts.verbose = verbose;
4958
4959 return !do_lxcapi_migrate(c, MIGRATE_DUMP, &opts, sizeof(opts));
4960 }
4961
4962 WRAP_API_3(bool, lxcapi_checkpoint, char *, bool, bool)
4963
4964 static bool do_lxcapi_restore(struct lxc_container *c, char *directory, bool verbose)
4965 {
4966 struct migrate_opts opts;
4967
4968 memset(&opts, 0, sizeof(opts));
4969
4970 opts.directory = directory;
4971 opts.verbose = verbose;
4972
4973 return !do_lxcapi_migrate(c, MIGRATE_RESTORE, &opts, sizeof(opts));
4974 }
4975
4976 WRAP_API_2(bool, lxcapi_restore, char *, bool)
4977
4978 /* @st_mode is the st_mode field of the stat(source) return struct */
4979 static int create_mount_target(const char *dest, mode_t st_mode)
4980 {
4981 char *dirdup, *destdirname;
4982 int ret;
4983
4984 dirdup = strdup(dest);
4985 if (!dirdup) {
4986 SYSERROR("Failed to duplicate target name \"%s\"", dest);
4987 return -1;
4988 }
4989 destdirname = dirname(dirdup);
4990
4991 ret = mkdir_p(destdirname, 0755);
4992 if (ret < 0) {
4993 SYSERROR("Failed to create \"%s\"", destdirname);
4994 free(dirdup);
4995 return ret;
4996 }
4997 free(dirdup);
4998
4999 (void)remove(dest);
5000
5001 if (S_ISDIR(st_mode))
5002 ret = mkdir(dest, 0000);
5003 else
5004 ret = mknod(dest, S_IFREG | 0000, 0);
5005
5006 if (ret == 0)
5007 TRACE("Created mount target \"%s\"", dest);
5008 else if (ret < 0 && errno != EEXIST) {
5009 SYSERROR("Failed to create mount target \"%s\"", dest);
5010 return -1;
5011 }
5012
5013 return 0;
5014 }
5015
5016 static int do_lxcapi_mount(struct lxc_container *c, const char *source,
5017 const char *target, const char *filesystemtype,
5018 unsigned long mountflags, const void *data,
5019 struct lxc_mount *mnt)
5020 {
5021 char *suff, *sret;
5022 char template[PATH_MAX], path[PATH_MAX];
5023 pid_t pid, init_pid;
5024 struct stat sb;
5025 bool is_dir;
5026 int ret = -1, fd = -EBADF;
5027
5028 if (!c || !c->lxc_conf) {
5029 ERROR("Container or configuration is NULL");
5030 return -EINVAL;
5031 }
5032
5033 if (!c->lxc_conf->shmount.path_host) {
5034 ERROR("Host path to shared mountpoint must be specified in the config\n");
5035 return -EINVAL;
5036 }
5037
5038 ret = snprintf(template, sizeof(template), "%s/.lxcmount_XXXXXX", c->lxc_conf->shmount.path_host);
5039 if (ret < 0 || (size_t)ret >= sizeof(template)) {
5040 SYSERROR("Error writing shmounts tempdir name");
5041 goto out;
5042 }
5043
5044 /* Create a temporary file / dir under the shared mountpoint */
5045 if (!source || strcmp(source, "") == 0) {
5046 /* If source is not specified, maybe we want to mount a filesystem? */
5047 sb.st_mode = S_IFDIR;
5048 } else {
5049 ret = stat(source, &sb);
5050 if (ret < 0) {
5051 SYSERROR("Error getting stat info about the source \"%s\"", source);
5052 goto out;
5053 }
5054 }
5055
5056 is_dir = (S_ISDIR(sb.st_mode) != 0);
5057 if (is_dir) {
5058 sret = mkdtemp(template);
5059 if (!sret) {
5060 SYSERROR("Could not create shmounts temporary dir");
5061 goto out;
5062 }
5063 } else {
5064 fd = lxc_make_tmpfile(template, false);
5065 if (fd < 0) {
5066 SYSERROR("Could not create shmounts temporary file");
5067 goto out;
5068 }
5069 }
5070
5071 /* Do the fork */
5072 pid = fork();
5073 if (pid < 0) {
5074 SYSERROR("Could not fork");
5075 goto out;
5076 }
5077
5078 if (pid == 0) {
5079 /* Do the mount */
5080 ret = mount(source, template, filesystemtype, mountflags, data);
5081 if (ret < 0) {
5082 SYSERROR("Failed to mount onto \"%s\"", template);
5083 _exit(EXIT_FAILURE);
5084 }
5085 TRACE("Mounted \"%s\" onto \"%s\"", source, template);
5086
5087 init_pid = do_lxcapi_init_pid(c);
5088 if (init_pid < 0) {
5089 ERROR("Failed to obtain container's init pid");
5090 _exit(EXIT_FAILURE);
5091 }
5092
5093 /* Enter the container namespaces */
5094 if (!lxc_list_empty(&c->lxc_conf->id_map)) {
5095 if (!switch_to_ns(init_pid, "user")) {
5096 ERROR("Failed to enter user namespace");
5097 _exit(EXIT_FAILURE);
5098 }
5099
5100 if (!lxc_switch_uid_gid(0, 0))
5101 _exit(EXIT_FAILURE);
5102 }
5103
5104 if (!switch_to_ns(init_pid, "mnt")) {
5105 ERROR("Failed to enter mount namespace");
5106 _exit(EXIT_FAILURE);
5107 }
5108
5109 ret = create_mount_target(target, sb.st_mode);
5110 if (ret < 0)
5111 _exit(EXIT_FAILURE);
5112
5113 suff = strrchr(template, '/');
5114 if (!suff)
5115 _exit(EXIT_FAILURE);
5116
5117 ret = snprintf(path, sizeof(path), "%s%s", c->lxc_conf->shmount.path_cont, suff);
5118 if (ret < 0 || (size_t)ret >= sizeof(path)) {
5119 SYSERROR("Error writing container mountpoint name");
5120 _exit(EXIT_FAILURE);
5121 }
5122
5123 ret = mount(path, target, NULL, MS_MOVE | MS_REC, NULL);
5124 if (ret < 0) {
5125 SYSERROR("Failed to move the mount from \"%s\" to \"%s\"", path, target);
5126 _exit(EXIT_FAILURE);
5127 }
5128 TRACE("Moved mount from \"%s\" to \"%s\"", path, target);
5129
5130 _exit(EXIT_SUCCESS);
5131 }
5132
5133 ret = wait_for_pid(pid);
5134 if (ret < 0) {
5135 SYSERROR("Wait for the child with pid %ld failed", (long) pid);
5136 goto out;
5137 }
5138
5139 ret = 0;
5140
5141 (void)umount2(template, MNT_DETACH);
5142 if (is_dir)
5143 (void)rmdir(template);
5144 else
5145 (void)unlink(template);
5146
5147 out:
5148 if (fd >= 0)
5149 close(fd);
5150
5151 return ret;
5152 }
5153
5154 WRAP_API_6(int, lxcapi_mount, const char *, const char *, const char *,
5155 unsigned long, const void *, struct lxc_mount *)
5156
5157 static int do_lxcapi_umount(struct lxc_container *c, const char *target,
5158 unsigned long flags, struct lxc_mount *mnt)
5159 {
5160 pid_t pid, init_pid;
5161 int ret = -1;
5162
5163 if (!c || !c->lxc_conf) {
5164 ERROR("Container or configuration is NULL");
5165 return -EINVAL;
5166 }
5167
5168 /* Do the fork */
5169 pid = fork();
5170 if (pid < 0) {
5171 SYSERROR("Could not fork");
5172 return -1;
5173 }
5174
5175 if (pid == 0) {
5176 init_pid = do_lxcapi_init_pid(c);
5177 if (init_pid < 0) {
5178 ERROR("Failed to obtain container's init pid");
5179 _exit(EXIT_FAILURE);
5180 }
5181
5182 /* Enter the container namespaces */
5183 if (!lxc_list_empty(&c->lxc_conf->id_map)) {
5184 if (!switch_to_ns(init_pid, "user")) {
5185 ERROR("Failed to enter user namespace");
5186 _exit(EXIT_FAILURE);
5187 }
5188 }
5189
5190 if (!switch_to_ns(init_pid, "mnt")) {
5191 ERROR("Failed to enter mount namespace");
5192 _exit(EXIT_FAILURE);
5193 }
5194
5195 /* Do the unmount */
5196 ret = umount2(target, flags);
5197 if (ret < 0) {
5198 SYSERROR("Failed to umount \"%s\"", target);
5199 _exit(EXIT_FAILURE);
5200 }
5201
5202 _exit(EXIT_SUCCESS);
5203 }
5204
5205 ret = wait_for_pid(pid);
5206 if (ret < 0) {
5207 SYSERROR("Wait for the child with pid %ld failed", (long)pid);
5208 return -ret;
5209 }
5210
5211 return 0;
5212 }
5213
5214 WRAP_API_3(int, lxcapi_umount, const char *, unsigned long, struct lxc_mount*)
5215
5216 static int lxcapi_attach_run_waitl(struct lxc_container *c, lxc_attach_options_t *options, const char *program, const char *arg, ...)
5217 {
5218 va_list ap;
5219 const char **argv;
5220 int ret;
5221
5222 if (!c)
5223 return -1;
5224
5225 current_config = c->lxc_conf;
5226
5227 va_start(ap, arg);
5228 argv = lxc_va_arg_list_to_argv_const(ap, 1);
5229 va_end(ap);
5230
5231 if (!argv) {
5232 ERROR("Memory allocation error.");
5233 ret = -1;
5234 goto out;
5235 }
5236 argv[0] = arg;
5237
5238 ret = do_lxcapi_attach_run_wait(c, options, program, (const char * const *)argv);
5239 free((void*)argv);
5240
5241 out:
5242 current_config = NULL;
5243 return ret;
5244 }
5245
5246 static int do_lxcapi_seccomp_notify(struct lxc_container *c, unsigned int cmd, int fd)
5247 {
5248 if (!c || !c->lxc_conf)
5249 return minus_one_set_errno(-EINVAL);
5250
5251 switch (cmd) {
5252 case LXC_SECCOMP_NOTIFY_GET_FD:
5253 if (fd)
5254 return minus_one_set_errno(EINVAL);
5255
5256 return lxc_seccomp_get_notify_fd(&c->lxc_conf->seccomp);
5257 }
5258
5259 return minus_one_set_errno(EINVAL);
5260 }
5261
5262 WRAP_API_2(int, lxcapi_seccomp_notify, unsigned int, int)
5263
5264 struct lxc_container *lxc_container_new(const char *name, const char *configpath)
5265 {
5266 struct lxc_container *c;
5267 size_t len;
5268 int rc;
5269
5270 if (!name)
5271 return NULL;
5272
5273 c = malloc(sizeof(*c));
5274 if (!c) {
5275 fprintf(stderr, "Failed to allocate memory for %s\n", name);
5276 return NULL;
5277 }
5278 memset(c, 0, sizeof(*c));
5279
5280 if (configpath)
5281 c->config_path = strdup(configpath);
5282 else
5283 c->config_path = strdup(lxc_global_config_value("lxc.lxcpath"));
5284 if (!c->config_path) {
5285 fprintf(stderr, "Failed to allocate memory for %s\n", name);
5286 goto err;
5287 }
5288
5289 remove_trailing_slashes(c->config_path);
5290
5291 len = strlen(name);
5292 c->name = malloc(len + 1);
5293 if (!c->name) {
5294 fprintf(stderr, "Failed to allocate memory for %s\n", name);
5295 goto err;
5296 }
5297 (void)strlcpy(c->name, name, len + 1);
5298
5299 c->numthreads = 1;
5300 c->slock = lxc_newlock(c->config_path, name);
5301 if (!c->slock) {
5302 fprintf(stderr, "Failed to create lock for %s\n", name);
5303 goto err;
5304 }
5305
5306 c->privlock = lxc_newlock(NULL, NULL);
5307 if (!c->privlock) {
5308 fprintf(stderr, "Failed to create private lock for %s\n", name);
5309 goto err;
5310 }
5311
5312 if (!set_config_filename(c)) {
5313 fprintf(stderr, "Failed to create config file name for %s\n", name);
5314 goto err;
5315 }
5316
5317 if (file_exists(c->configfile) && !lxcapi_load_config(c, NULL)) {
5318 fprintf(stderr, "Failed to load config for %s\n", name);
5319 goto err;
5320 }
5321
5322 rc = ongoing_create(c);
5323 switch (rc) {
5324 case LXC_CREATE_INCOMPLETE:
5325 SYSERROR("Failed to complete container creation for %s", c->name);
5326 container_destroy(c, NULL);
5327 lxcapi_clear_config(c);
5328 break;
5329 case LXC_CREATE_ONGOING:
5330 /* container creation going on */
5331 break;
5332 case LXC_CREATE_FAILED:
5333 /* container creation failed */
5334 if (errno != EACCES && errno != EPERM) {
5335 /* insufficient privileges */
5336 SYSERROR("Failed checking for incomplete container %s creation", c->name);
5337 goto err;
5338 }
5339 break;
5340 }
5341
5342 c->daemonize = true;
5343 c->pidfile = NULL;
5344
5345 /* Assign the member functions. */
5346 c->is_defined = lxcapi_is_defined;
5347 c->state = lxcapi_state;
5348 c->is_running = lxcapi_is_running;
5349 c->freeze = lxcapi_freeze;
5350 c->unfreeze = lxcapi_unfreeze;
5351 c->console = lxcapi_console;
5352 c->console_getfd = lxcapi_console_getfd;
5353 c->init_pid = lxcapi_init_pid;
5354 c->load_config = lxcapi_load_config;
5355 c->want_daemonize = lxcapi_want_daemonize;
5356 c->want_close_all_fds = lxcapi_want_close_all_fds;
5357 c->start = lxcapi_start;
5358 c->startl = lxcapi_startl;
5359 c->stop = lxcapi_stop;
5360 c->config_file_name = lxcapi_config_file_name;
5361 c->wait = lxcapi_wait;
5362 c->set_config_item = lxcapi_set_config_item;
5363 c->destroy = lxcapi_destroy;
5364 c->destroy_with_snapshots = lxcapi_destroy_with_snapshots;
5365 c->rename = lxcapi_rename;
5366 c->save_config = lxcapi_save_config;
5367 c->get_keys = lxcapi_get_keys;
5368 c->create = lxcapi_create;
5369 c->createl = lxcapi_createl;
5370 c->shutdown = lxcapi_shutdown;
5371 c->reboot = lxcapi_reboot;
5372 c->reboot2 = lxcapi_reboot2;
5373 c->clear_config = lxcapi_clear_config;
5374 c->clear_config_item = lxcapi_clear_config_item;
5375 c->get_config_item = lxcapi_get_config_item;
5376 c->get_running_config_item = lxcapi_get_running_config_item;
5377 c->get_cgroup_item = lxcapi_get_cgroup_item;
5378 c->set_cgroup_item = lxcapi_set_cgroup_item;
5379 c->get_config_path = lxcapi_get_config_path;
5380 c->set_config_path = lxcapi_set_config_path;
5381 c->clone = lxcapi_clone;
5382 c->get_interfaces = lxcapi_get_interfaces;
5383 c->get_ips = lxcapi_get_ips;
5384 c->attach = lxcapi_attach;
5385 c->attach_run_wait = lxcapi_attach_run_wait;
5386 c->attach_run_waitl = lxcapi_attach_run_waitl;
5387 c->snapshot = lxcapi_snapshot;
5388 c->snapshot_list = lxcapi_snapshot_list;
5389 c->snapshot_restore = lxcapi_snapshot_restore;
5390 c->snapshot_destroy = lxcapi_snapshot_destroy;
5391 c->snapshot_destroy_all = lxcapi_snapshot_destroy_all;
5392 c->may_control = lxcapi_may_control;
5393 c->add_device_node = lxcapi_add_device_node;
5394 c->remove_device_node = lxcapi_remove_device_node;
5395 c->attach_interface = lxcapi_attach_interface;
5396 c->detach_interface = lxcapi_detach_interface;
5397 c->checkpoint = lxcapi_checkpoint;
5398 c->restore = lxcapi_restore;
5399 c->migrate = lxcapi_migrate;
5400 c->console_log = lxcapi_console_log;
5401 c->mount = lxcapi_mount;
5402 c->umount = lxcapi_umount;
5403 c->seccomp_notify = lxcapi_seccomp_notify;
5404
5405 return c;
5406
5407 err:
5408 lxc_container_free(c);
5409 return NULL;
5410 }
5411
5412 int lxc_get_wait_states(const char **states)
5413 {
5414 int i;
5415
5416 if (states)
5417 for (i=0; i<MAX_STATE; i++)
5418 states[i] = lxc_state2str(i);
5419
5420 return MAX_STATE;
5421 }
5422
5423 /*
5424 * These next two could probably be done smarter with reusing a common function
5425 * with different iterators and tests...
5426 */
5427 int list_defined_containers(const char *lxcpath, char ***names, struct lxc_container ***cret)
5428 {
5429 DIR *dir;
5430 int i, cfound = 0, nfound = 0;
5431 struct dirent *direntp;
5432 struct lxc_container *c;
5433
5434 if (!lxcpath)
5435 lxcpath = lxc_global_config_value("lxc.lxcpath");
5436
5437 dir = opendir(lxcpath);
5438 if (!dir) {
5439 SYSERROR("opendir on lxcpath");
5440 return -1;
5441 }
5442
5443 if (cret)
5444 *cret = NULL;
5445
5446 if (names)
5447 *names = NULL;
5448
5449 while ((direntp = readdir(dir))) {
5450 /* Ignore '.', '..' and any hidden directory. */
5451 if (!strncmp(direntp->d_name, ".", 1))
5452 continue;
5453
5454 if (!config_file_exists(lxcpath, direntp->d_name))
5455 continue;
5456
5457 if (names)
5458 if (!add_to_array(names, direntp->d_name, cfound))
5459 goto free_bad;
5460
5461 cfound++;
5462
5463 if (!cret) {
5464 nfound++;
5465 continue;
5466 }
5467
5468 c = lxc_container_new(direntp->d_name, lxcpath);
5469 if (!c) {
5470 INFO("Container %s:%s has a config but could not be loaded",
5471 lxcpath, direntp->d_name);
5472
5473 if (names)
5474 if(!remove_from_array(names, direntp->d_name, cfound--))
5475 goto free_bad;
5476
5477 continue;
5478 }
5479
5480 if (!do_lxcapi_is_defined(c)) {
5481 INFO("Container %s:%s has a config but is not defined",
5482 lxcpath, direntp->d_name);
5483
5484 if (names)
5485 if(!remove_from_array(names, direntp->d_name, cfound--))
5486 goto free_bad;
5487
5488 lxc_container_put(c);
5489 continue;
5490 }
5491
5492 if (!add_to_clist(cret, c, nfound, true)) {
5493 lxc_container_put(c);
5494 goto free_bad;
5495 }
5496
5497 nfound++;
5498 }
5499
5500 closedir(dir);
5501 return nfound;
5502
5503 free_bad:
5504 if (names && *names) {
5505 for (i=0; i<cfound; i++)
5506 free((*names)[i]);
5507 free(*names);
5508 }
5509
5510 if (cret && *cret) {
5511 for (i=0; i<nfound; i++)
5512 lxc_container_put((*cret)[i]);
5513 free(*cret);
5514 }
5515
5516 closedir(dir);
5517 return -1;
5518 }
5519
5520 int list_active_containers(const char *lxcpath, char ***nret,
5521 struct lxc_container ***cret)
5522 {
5523 int i, ret = -1, cret_cnt = 0, ct_name_cnt = 0;
5524 int lxcpath_len;
5525 char *line = NULL;
5526 char **ct_name = NULL;
5527 size_t len = 0;
5528 struct lxc_container *c = NULL;
5529 bool is_hashed;
5530
5531 if (!lxcpath)
5532 lxcpath = lxc_global_config_value("lxc.lxcpath");
5533 lxcpath_len = strlen(lxcpath);
5534
5535 if (cret)
5536 *cret = NULL;
5537
5538 if (nret)
5539 *nret = NULL;
5540
5541 FILE *f = fopen("/proc/net/unix", "r");
5542 if (!f)
5543 return -1;
5544
5545 while (getline(&line, &len, f) != -1) {
5546 char *p = strrchr(line, ' '), *p2;
5547 if (!p)
5548 continue;
5549 p++;
5550
5551 if (*p != 0x40)
5552 continue;
5553 p++;
5554
5555 is_hashed = false;
5556
5557 if (strncmp(p, lxcpath, lxcpath_len) == 0) {
5558 p += lxcpath_len;
5559 } else if (strncmp(p, "lxc/", 4) == 0) {
5560 p += 4;
5561 is_hashed = true;
5562 } else {
5563 continue;
5564 }
5565
5566 while (*p == '/')
5567 p++;
5568
5569 /* Now p is the start of lxc_name. */
5570 p2 = strchr(p, '/');
5571 if (!p2 || strncmp(p2, "/command", 8) != 0)
5572 continue;
5573 *p2 = '\0';
5574
5575 if (is_hashed) {
5576 char *recvpath = lxc_cmd_get_lxcpath(p);
5577 if (!recvpath)
5578 continue;
5579
5580 if (strncmp(lxcpath, recvpath, lxcpath_len) != 0) {
5581 free(recvpath);
5582 continue;
5583 }
5584 free(recvpath);
5585
5586 p = lxc_cmd_get_name(p);
5587 if (!p)
5588 continue;
5589 }
5590
5591 if (array_contains(&ct_name, p, ct_name_cnt)) {
5592 if (is_hashed)
5593 free(p);
5594 continue;
5595 }
5596
5597 if (!add_to_array(&ct_name, p, ct_name_cnt)) {
5598 if (is_hashed)
5599 free(p);
5600 goto free_cret_list;
5601 }
5602
5603 ct_name_cnt++;
5604
5605 if (!cret) {
5606 if (is_hashed)
5607 free(p);
5608 continue;
5609 }
5610
5611 c = lxc_container_new(p, lxcpath);
5612 if (!c) {
5613 INFO("Container %s:%s is running but could not be loaded",
5614 lxcpath, p);
5615
5616 remove_from_array(&ct_name, p, ct_name_cnt--);
5617 if (is_hashed)
5618 free(p);
5619
5620 continue;
5621 }
5622
5623 if (is_hashed)
5624 free(p);
5625
5626 /*
5627 * If this is an anonymous container, then is_defined *can*
5628 * return false. So we don't do that check. Count on the
5629 * fact that the command socket exists.
5630 */
5631
5632 if (!add_to_clist(cret, c, cret_cnt, true)) {
5633 lxc_container_put(c);
5634 goto free_cret_list;
5635 }
5636
5637 cret_cnt++;
5638 }
5639
5640 if (nret && cret && cret_cnt != ct_name_cnt) {
5641 if (c)
5642 lxc_container_put(c);
5643 goto free_cret_list;
5644 }
5645
5646 ret = ct_name_cnt;
5647 if (nret)
5648 *nret = ct_name;
5649 else
5650 goto free_ct_name;
5651
5652 goto out;
5653
5654 free_cret_list:
5655 if (cret && *cret) {
5656 for (i = 0; i < cret_cnt; i++)
5657 lxc_container_put((*cret)[i]);
5658 free(*cret);
5659 }
5660
5661 free_ct_name:
5662 if (ct_name) {
5663 for (i = 0; i < ct_name_cnt; i++)
5664 free(ct_name[i]);
5665 free(ct_name);
5666 }
5667
5668 out:
5669 free(line);
5670 fclose(f);
5671 return ret;
5672 }
5673
5674 int list_all_containers(const char *lxcpath, char ***nret,
5675 struct lxc_container ***cret)
5676 {
5677 int i, ret, active_cnt, ct_cnt, ct_list_cnt;
5678 char **active_name;
5679 char **ct_name;
5680 struct lxc_container **ct_list = NULL;
5681
5682 ct_cnt = list_defined_containers(lxcpath, &ct_name, NULL);
5683 if (ct_cnt < 0)
5684 return ct_cnt;
5685
5686 active_cnt = list_active_containers(lxcpath, &active_name, NULL);
5687 if (active_cnt < 0) {
5688 ret = active_cnt;
5689 goto free_ct_name;
5690 }
5691
5692 for (i = 0; i < active_cnt; i++) {
5693 if (!array_contains(&ct_name, active_name[i], ct_cnt)) {
5694 if (!add_to_array(&ct_name, active_name[i], ct_cnt)) {
5695 ret = -1;
5696 goto free_active_name;
5697 }
5698
5699 ct_cnt++;
5700 }
5701
5702 free(active_name[i]);
5703 active_name[i] = NULL;
5704 }
5705
5706 free(active_name);
5707 active_name = NULL;
5708 active_cnt = 0;
5709
5710 for (i = 0, ct_list_cnt = 0; i < ct_cnt && cret; i++) {
5711 struct lxc_container *c;
5712
5713 c = lxc_container_new(ct_name[i], lxcpath);
5714 if (!c) {
5715 WARN("Container %s:%s could not be loaded", lxcpath, ct_name[i]);
5716 remove_from_array(&ct_name, ct_name[i], ct_cnt--);
5717 continue;
5718 }
5719
5720 if (!add_to_clist(&ct_list, c, ct_list_cnt, false)) {
5721 lxc_container_put(c);
5722 ret = -1;
5723 goto free_ct_list;
5724 }
5725
5726 ct_list_cnt++;
5727 }
5728
5729 if (cret)
5730 *cret = ct_list;
5731
5732 if (nret) {
5733 *nret = ct_name;
5734 } else {
5735 ret = ct_cnt;
5736 goto free_ct_name;
5737 }
5738
5739 return ct_cnt;
5740
5741 free_ct_list:
5742 for (i = 0; i < ct_list_cnt; i++) {
5743 lxc_container_put(ct_list[i]);
5744 }
5745 free(ct_list);
5746
5747 free_active_name:
5748 for (i = 0; i < active_cnt; i++) {
5749 free(active_name[i]);
5750 }
5751 free(active_name);
5752
5753 free_ct_name:
5754 for (i = 0; i < ct_cnt; i++) {
5755 free(ct_name[i]);
5756 }
5757 free(ct_name);
5758 return ret;
5759 }
5760
5761 bool lxc_config_item_is_supported(const char *key)
5762 {
5763 return !!lxc_get_config(key);
5764 }
5765
5766 bool lxc_has_api_extension(const char *extension)
5767 {
5768 /* The NULL API extension is always present. :) */
5769 if (!extension)
5770 return true;
5771
5772 for (size_t i = 0; i < nr_api_extensions; i++)
5773 if (strcmp(api_extensions[i], extension) == 0)
5774 return true;
5775
5776 return false;
5777 }
LXC mirror