]> git.proxmox.com Git - mirror_lxc.git/blob - src/lxc/lxccontainer.c
projects / mirror_lxc.git / blob
? search:
summary | shortlog | log | commit | commitdiff | tree
blame | history | raw | HEAD
caps: fix includes
[mirror_lxc.git] / src / lxc / lxccontainer.c
1 /* SPDX-License-Identifier: LGPL-2.1+ */
2
3 #ifndef _GNU_SOURCE
4 #define _GNU_SOURCE 1
5 #endif
6 #include <arpa/inet.h>
7 #include <dirent.h>
8 #include <errno.h>
9 #include <fcntl.h>
10 #include <grp.h>
11 #include <libgen.h>
12 #include <pthread.h>
13 #include <sched.h>
14 #include <stdarg.h>
15 #include <stdint.h>
16 #include <stdio.h>
17 #include <stdlib.h>
18 #include <sys/file.h>
19 #include <sys/mman.h>
20 #include <sys/mount.h>
21 #include <sys/stat.h>
22 #include <sys/syscall.h>
23 #include <sys/sysmacros.h>
24 #include <sys/types.h>
25 #include <sys/wait.h>
26 #include <unistd.h>
27
28 #include "netns_ifaddrs.h"
29 #include "af_unix.h"
30 #include "api_extensions.h"
31 #include "attach.h"
32 #include "cgroup.h"
33 #include "macro.h"
34 #include "commands.h"
35 #include "commands_utils.h"
36 #include "conf.h"
37 #include "config.h"
38 #include "confile.h"
39 #include "confile_utils.h"
40 #include "criu.h"
41 #include "error.h"
42 #include "initutils.h"
43 #include "log.h"
44 #include "lxc.h"
45 #include "lxccontainer.h"
46 #include "lxclock.h"
47 #include "memory_utils.h"
48 #include "monitor.h"
49 #include "namespace.h"
50 #include "network.h"
51 #include "parse.h"
52 #include "process_utils.h"
53 #include "start.h"
54 #include "state.h"
55 #include "storage.h"
56 #include "storage/btrfs.h"
57 #include "storage/overlay.h"
58 #include "storage_utils.h"
59 #include "sync.h"
60 #include "syscall_wrappers.h"
61 #include "terminal.h"
62 #include "utils.h"
63 #include "version.h"
64
65 #if HAVE_OPENSSL
66 #include <openssl/evp.h>
67 #endif
68
69 /* major()/minor() */
70 #ifdef MAJOR_IN_MKDEV
71 #include <sys/mkdev.h>
72 #endif
73
74 #if IS_BIONIC
75 #include <../include/lxcmntent.h>
76 #else
77 #include <mntent.h>
78 #endif
79
80 #ifndef HAVE_STRLCPY
81 #include "include/strlcpy.h"
82 #endif
83
84 lxc_log_define(lxccontainer, lxc);
85
86 static bool do_lxcapi_destroy(struct lxc_container *c);
87 static const char *lxcapi_get_config_path(struct lxc_container *c);
88 #define do_lxcapi_get_config_path(c) lxcapi_get_config_path(c)
89 static bool do_lxcapi_set_config_item(struct lxc_container *c, const char *key, const char *v);
90 static bool container_destroy(struct lxc_container *c,
91 struct lxc_storage *storage);
92 static bool get_snappath_dir(struct lxc_container *c, char *snappath);
93 static bool lxcapi_snapshot_destroy_all(struct lxc_container *c);
94 static bool do_lxcapi_save_config(struct lxc_container *c, const char *alt_file);
95
96 static bool config_file_exists(const char *lxcpath, const char *cname)
97 {
98 __do_free char *fname = NULL;
99 int ret;
100 size_t len;
101
102 /* $lxcpath + '/' + $cname + '/config' + \0 */
103 len = strlen(lxcpath) + 1 + strlen(cname) + 1 + strlen(LXC_CONFIG_FNAME) + 1;
104 fname = must_realloc(NULL, len);
105 ret = strnprintf(fname, len, "%s/%s/%s", lxcpath, cname, LXC_CONFIG_FNAME);
106 if (ret < 0)
107 return false;
108
109 return file_exists(fname);
110 }
111
112 /*
113 * A few functions to help detect when a container creation failed. If a
114 * container creation was killed partway through, then trying to actually start
115 * that container could harm the host. We detect this by creating a 'partial'
116 * file under the container directory, and keeping an advisory lock. When
117 * container creation completes, we remove that file. When we load or try to
118 * start a container, if we find that file, without a flock, we remove the
119 * container.
120 */
121 enum {
122 LXC_CREATE_FAILED = -1,
123 LXC_CREATE_SUCCESS = 0,
124 LXC_CREATE_ONGOING = 1,
125 LXC_CREATE_INCOMPLETE = 2,
126 };
127
128 static int ongoing_create(struct lxc_container *c)
129 {
130 __do_close int fd = -EBADF;
131 __do_free char *path = NULL;
132 struct flock lk = {0};
133 int ret;
134 size_t len;
135
136 len = strlen(c->config_path) + 1 + strlen(c->name) + 1 + strlen(LXC_PARTIAL_FNAME) + 1;
137 path = must_realloc(NULL, len);
138 ret = strnprintf(path, len, "%s/%s/%s", c->config_path, c->name, LXC_PARTIAL_FNAME);
139 if (ret < 0)
140 return LXC_CREATE_FAILED;
141
142 fd = open(path, O_RDWR | O_CLOEXEC);
143 if (fd < 0) {
144 if (errno != ENOENT)
145 return LXC_CREATE_FAILED;
146
147 return LXC_CREATE_SUCCESS;
148 }
149
150 lk.l_type = F_WRLCK;
151 lk.l_whence = SEEK_SET;
152 /*
153 * F_OFD_GETLK requires that l_pid be set to 0 otherwise the kernel
154 * will EINVAL us.
155 */
156 lk.l_pid = 0;
157
158 ret = fcntl(fd, F_OFD_GETLK, &lk);
159 if (ret < 0 && errno == EINVAL) {
160 ret = flock(fd, LOCK_EX | LOCK_NB);
161 if (ret < 0 && errno == EWOULDBLOCK)
162 ret = 0;
163 }
164
165 /* F_OFD_GETLK will not send us back a pid so don't check it. */
166 if (ret == 0)
167 /* Create is still ongoing. */
168 return LXC_CREATE_ONGOING;
169
170 /* Create completed but partial is still there. */
171 return LXC_CREATE_INCOMPLETE;
172 }
173
174 static int create_partial(struct lxc_container *c)
175 {
176 __do_free char *path = NULL;
177 int fd, ret;
178 size_t len;
179 struct flock lk = {0};
180
181 /* $lxcpath + '/' + $name + '/partial' + \0 */
182 len = strlen(c->config_path) + 1 + strlen(c->name) + 1 + strlen(LXC_PARTIAL_FNAME) + 1;
183 path = must_realloc(NULL, len);
184 ret = strnprintf(path, len, "%s/%s/%s", c->config_path, c->name, LXC_PARTIAL_FNAME);
185 if (ret < 0)
186 return -1;
187
188 fd = open(path, O_RDWR | O_CREAT | O_EXCL | O_CLOEXEC, 0000);
189 if (fd < 0)
190 return -1;
191
192 lk.l_type = F_WRLCK;
193 lk.l_whence = SEEK_SET;
194
195 ret = fcntl(fd, F_OFD_SETLKW, &lk);
196 if (ret < 0) {
197 if (errno == EINVAL) {
198 ret = flock(fd, LOCK_EX);
199 if (ret == 0)
200 return fd;
201 }
202
203 SYSERROR("Failed to lock partial file %s", path);
204 close(fd);
205 return -1;
206 }
207
208 return fd;
209 }
210
211 static void remove_partial(struct lxc_container *c, int fd)
212 {
213 __do_free char *path = NULL;
214 int ret;
215 size_t len;
216
217 close(fd);
218
219 /* $lxcpath + '/' + $name + '/partial' + \0 */
220 len = strlen(c->config_path) + 1 + strlen(c->name) + 1 + strlen(LXC_PARTIAL_FNAME) + 1;
221 path = must_realloc(NULL, len);
222 ret = strnprintf(path, len, "%s/%s/%s", c->config_path, c->name, LXC_PARTIAL_FNAME);
223 if (ret < 0)
224 return;
225
226 ret = unlink(path);
227 if (ret < 0)
228 SYSERROR("Failed to remove partial file %s", path);
229 }
230
231 /* LOCKING
232 * 1. container_mem_lock(c) protects the struct lxc_container from multiple threads.
233 * 2. container_disk_lock(c) protects the on-disk container data - in particular the
234 * container configuration file.
235 * The container_disk_lock also takes the container_mem_lock.
236 * 3. thread_mutex protects process data (ex: fd table) from multiple threads.
237 * NOTHING mutexes two independent programs with their own struct
238 * lxc_container for the same c->name, between API calls. For instance,
239 * c->config_read(); c->start(); Between those calls, data on disk
240 * could change (which shouldn't bother the caller unless for instance
241 * the rootfs get moved). c->config_read(); update; c->config_write();
242 * Two such updaters could race. The callers should therefore check their
243 * results. Trying to prevent that would necessarily expose us to deadlocks
244 * due to hung callers. So I prefer to keep the locks only within our own
245 * functions, not across functions.
246 *
247 * If you're going to clone while holding a lxccontainer, increment
248 * c->numthreads (under privlock) before forking. When deleting,
249 * decrement numthreads under privlock, then if it hits 0 you can delete.
250 * Do not ever use a lxccontainer whose numthreads you did not bump.
251 */
252 static void lxc_container_free(struct lxc_container *c)
253 {
254 if (!c)
255 return;
256
257 free(c->configfile);
258 c->configfile = NULL;
259
260 free(c->error_string);
261 c->error_string = NULL;
262
263 if (c->slock) {
264 lxc_putlock(c->slock);
265 c->slock = NULL;
266 }
267
268 if (c->privlock) {
269 lxc_putlock(c->privlock);
270 c->privlock = NULL;
271 }
272
273 free(c->name);
274 c->name = NULL;
275
276 if (c->lxc_conf) {
277 lxc_conf_free(c->lxc_conf);
278 c->lxc_conf = NULL;
279 }
280
281 free(c->config_path);
282 c->config_path = NULL;
283
284 free(c);
285 }
286
287 /* Consider the following case:
288 *
289 * |====================================================================|
290 * | freer | racing get()er |
291 * |====================================================================|
292 * | lxc_container_put() | lxc_container_get() |
293 * | \ lxclock(c->privlock) | c->numthreads < 1? (no) |
294 * | \ c->numthreads = 0 | \ lxclock(c->privlock) -> waits |
295 * | \ lxcunlock() | \ |
296 * | \ lxc_container_free() | \ lxclock() returns |
297 * | | \ c->numthreads < 1 -> return 0 |
298 * | \ \ (free stuff) | |
299 * | \ \ sem_destroy(privlock) | |
300 * |_______________________________|____________________________________|
301 *
302 * When the get()er checks numthreads the first time, one of the following
303 * is true:
304 * 1. freer has set numthreads = 0. get() returns 0
305 * 2. freer is between lxclock and setting numthreads to 0. get()er will
306 * sem_wait on privlock, get lxclock after freer() drops it, then see
307 * numthreads is 0 and exit without touching lxclock again..
308 * 3. freer has not yet locked privlock. If get()er runs first, then put()er
309 * will see --numthreads = 1 and not call lxc_container_free().
310 */
311
312 int lxc_container_get(struct lxc_container *c)
313 {
314 if (!c)
315 return 0;
316
317 /* If someone else has already started freeing the container, don't try
318 * to take the lock, which may be invalid.
319 */
320 if (c->numthreads < 1)
321 return 0;
322
323 if (container_mem_lock(c))
324 return 0;
325
326 /* Bail without trying to unlock, bc the privlock is now probably in
327 * freed memory.
328 */
329 if (c->numthreads < 1)
330 return 0;
331
332 c->numthreads++;
333 container_mem_unlock(c);
334
335 return 1;
336 }
337
338 int lxc_container_put(struct lxc_container *c)
339 {
340 if (!c)
341 return -1;
342
343 if (container_mem_lock(c))
344 return -1;
345
346 c->numthreads--;
347
348 if (c->numthreads < 1) {
349 container_mem_unlock(c);
350 lxc_container_free(c);
351 return 1;
352 }
353
354 container_mem_unlock(c);
355 return 0;
356 }
357
358 static bool do_lxcapi_is_defined(struct lxc_container *c)
359 {
360 int statret;
361 struct stat statbuf;
362 bool ret = false;
363
364 if (!c)
365 return false;
366
367 if (container_mem_lock(c))
368 return false;
369
370 if (!c->configfile)
371 goto on_error;
372
373 statret = stat(c->configfile, &statbuf);
374 if (statret != 0)
375 goto on_error;
376
377 ret = true;
378
379 on_error:
380 container_mem_unlock(c);
381 return ret;
382 }
383
384 #define WRAP_API(rettype, fnname) \
385 static rettype fnname(struct lxc_container *c) \
386 { \
387 rettype ret; \
388 bool reset_config = false; \
389 \
390 if (!current_config && c && c->lxc_conf) { \
391 current_config = c->lxc_conf; \
392 reset_config = true; \
393 } \
394 \
395 ret = do_##fnname(c); \
396 if (reset_config) \
397 current_config = NULL; \
398 \
399 return ret; \
400 }
401
402 #define WRAP_API_1(rettype, fnname, t1) \
403 static rettype fnname(struct lxc_container *c, t1 a1) \
404 { \
405 rettype ret; \
406 bool reset_config = false; \
407 \
408 if (!current_config && c && c->lxc_conf) { \
409 current_config = c->lxc_conf; \
410 reset_config = true; \
411 } \
412 \
413 ret = do_##fnname(c, a1); \
414 if (reset_config) \
415 current_config = NULL; \
416 \
417 return ret; \
418 }
419
420 #define WRAP_API_2(rettype, fnname, t1, t2) \
421 static rettype fnname(struct lxc_container *c, t1 a1, t2 a2) \
422 { \
423 rettype ret; \
424 bool reset_config = false; \
425 \
426 if (!current_config && c && c->lxc_conf) { \
427 current_config = c->lxc_conf; \
428 reset_config = true; \
429 } \
430 \
431 ret = do_##fnname(c, a1, a2); \
432 if (reset_config) \
433 current_config = NULL; \
434 \
435 return ret; \
436 }
437
438 #define WRAP_API_3(rettype, fnname, t1, t2, t3) \
439 static rettype fnname(struct lxc_container *c, t1 a1, t2 a2, t3 a3) \
440 { \
441 rettype ret; \
442 bool reset_config = false; \
443 \
444 if (!current_config && c && c->lxc_conf) { \
445 current_config = c->lxc_conf; \
446 reset_config = true; \
447 } \
448 \
449 ret = do_##fnname(c, a1, a2, a3); \
450 if (reset_config) \
451 current_config = NULL; \
452 \
453 return ret; \
454 }
455
456 #define WRAP_API_6(rettype, fnname, t1, t2, t3, t4, t5, t6) \
457 static rettype fnname(struct lxc_container *c, t1 a1, t2 a2, t3 a3, \
458 t4 a4, t5 a5, t6 a6) \
459 { \
460 rettype ret; \
461 bool reset_config = false; \
462 \
463 if (!current_config && c && c->lxc_conf) { \
464 current_config = c->lxc_conf; \
465 reset_config = true; \
466 } \
467 \
468 ret = do_##fnname(c, a1, a2, a3, a4, a5, a6); \
469 if (reset_config) \
470 current_config = NULL; \
471 \
472 return ret; \
473 }
474
475 WRAP_API(bool, lxcapi_is_defined)
476
477 static const char *do_lxcapi_state(struct lxc_container *c)
478 {
479 lxc_state_t s;
480
481 if (!c)
482 return NULL;
483
484 s = lxc_getstate(c->name, c->config_path);
485 return lxc_state2str(s);
486 }
487
488 WRAP_API(const char *, lxcapi_state)
489
490 static bool is_stopped(struct lxc_container *c)
491 {
492 lxc_state_t s;
493
494 s = lxc_getstate(c->name, c->config_path);
495 return (s == STOPPED);
496 }
497
498 static bool do_lxcapi_is_running(struct lxc_container *c)
499 {
500 if (!c)
501 return false;
502
503 return !is_stopped(c);
504 }
505
506 WRAP_API(bool, lxcapi_is_running)
507
508 static bool do_lxcapi_freeze(struct lxc_container *c)
509 {
510 int ret = 0;
511 lxc_state_t s;
512
513 if (!c || !c->lxc_conf)
514 return false;
515
516 s = lxc_getstate(c->name, c->config_path);
517 if (s != FROZEN) {
518 ret = cgroup_freeze(c->name, c->config_path, -1);
519 if (ret == -ENOCGROUP2)
520 ret = lxc_freeze(c->lxc_conf, c->name, c->config_path);
521 }
522
523 return ret == 0;
524 }
525
526 WRAP_API(bool, lxcapi_freeze)
527
528 static bool do_lxcapi_unfreeze(struct lxc_container *c)
529 {
530 int ret = 0;
531 lxc_state_t s;
532
533 if (!c || !c->lxc_conf)
534 return false;
535
536 s = lxc_getstate(c->name, c->config_path);
537 if (s == FROZEN) {
538 ret = cgroup_unfreeze(c->name, c->config_path, -1);
539 if (ret == -ENOCGROUP2)
540 ret = lxc_unfreeze(c->lxc_conf, c->name, c->config_path);
541 }
542
543
544 return ret == 0;
545 }
546
547 WRAP_API(bool, lxcapi_unfreeze)
548
549 static int do_lxcapi_console_getfd(struct lxc_container *c, int *ttynum, int *ptxfd)
550 {
551 if (!c)
552 return -1;
553
554 return lxc_terminal_getfd(c, ttynum, ptxfd);
555 }
556
557 WRAP_API_2(int, lxcapi_console_getfd, int *, int *)
558
559 static int lxcapi_console(struct lxc_container *c, int ttynum, int stdinfd,
560 int stdoutfd, int stderrfd, int escape)
561 {
562 int ret;
563
564 if (!c)
565 return -1;
566
567 current_config = c->lxc_conf;
568 ret = lxc_console(c, ttynum, stdinfd, stdoutfd, stderrfd, escape);
569 current_config = NULL;
570
571 return ret;
572 }
573
574 static int do_lxcapi_console_log(struct lxc_container *c, struct lxc_console_log *log)
575 {
576 int ret;
577
578 if (!c)
579 return -EINVAL;
580
581 ret = lxc_cmd_console_log(c->name, do_lxcapi_get_config_path(c), log);
582 if (ret < 0) {
583 if (ret == -ENODATA)
584 NOTICE("The console log is empty");
585 else if (ret == -EFAULT)
586 NOTICE("The container does not keep a console log");
587 else if (ret == -ENOENT)
588 NOTICE("The container does not keep a console log file");
589 else if (ret == -EIO)
590 NOTICE("Failed to write console log to log file");
591 else
592 ERROR("Failed to retrieve console log");
593 }
594
595 return ret;
596 }
597
598 WRAP_API_1(int, lxcapi_console_log, struct lxc_console_log *)
599
600 static pid_t do_lxcapi_init_pid(struct lxc_container *c)
601 {
602 if (!c)
603 return -1;
604
605 return lxc_cmd_get_init_pid(c->name, c->config_path);
606 }
607
608 WRAP_API(pid_t, lxcapi_init_pid)
609
610 static int do_lxcapi_init_pidfd(struct lxc_container *c)
611 {
612 if (!c)
613 return ret_errno(EBADF);
614
615 return lxc_cmd_get_init_pidfd(c->name, c->config_path);
616 }
617
618 WRAP_API(int, lxcapi_init_pidfd)
619
620 static int do_lxcapi_devpts_fd(struct lxc_container *c)
621 {
622 if (!c)
623 return ret_errno(EBADF);
624
625 return lxc_cmd_get_devpts_fd(c->name, c->config_path);
626 }
627
628 WRAP_API(int, lxcapi_devpts_fd)
629
630 static bool load_config_locked(struct lxc_container *c, const char *fname)
631 {
632 if (!c->lxc_conf)
633 c->lxc_conf = lxc_conf_init();
634
635 if (!c->lxc_conf)
636 return false;
637
638 if (lxc_config_read(fname, c->lxc_conf, false) != 0)
639 return false;
640
641 c->lxc_conf->name = c->name;
642 return true;
643 }
644
645 static bool do_lxcapi_load_config(struct lxc_container *c, const char *alt_file)
646 {
647 int lret;
648 const char *fname;
649 bool need_disklock = false, ret = false;
650
651 if (!c)
652 return false;
653
654 fname = c->configfile;
655
656 if (alt_file)
657 fname = alt_file;
658
659 if (!fname)
660 return false;
661
662 /* If we're reading something other than the container's config, we only
663 * need to lock the in-memory container. If loading the container's
664 * config file, take the disk lock.
665 */
666 if (strequal(fname, c->configfile))
667 need_disklock = true;
668
669 if (need_disklock)
670 lret = container_disk_lock(c);
671 else
672 lret = container_mem_lock(c);
673 if (lret)
674 return false;
675
676 ret = load_config_locked(c, fname);
677
678 if (need_disklock)
679 container_disk_unlock(c);
680 else
681 container_mem_unlock(c);
682
683 return ret;
684 }
685
686 WRAP_API_1(bool, lxcapi_load_config, const char *)
687
688 static bool do_lxcapi_want_daemonize(struct lxc_container *c, bool state)
689 {
690 if (!c || !c->lxc_conf)
691 return false;
692
693 if (container_mem_lock(c))
694 return false;
695
696 c->daemonize = state;
697
698 container_mem_unlock(c);
699
700 return true;
701 }
702
703 WRAP_API_1(bool, lxcapi_want_daemonize, bool)
704
705 static bool do_lxcapi_want_close_all_fds(struct lxc_container *c, bool state)
706 {
707 if (!c || !c->lxc_conf)
708 return false;
709
710 if (container_mem_lock(c))
711 return false;
712
713 c->lxc_conf->close_all_fds = state;
714
715 container_mem_unlock(c);
716
717 return true;
718 }
719
720 WRAP_API_1(bool, lxcapi_want_close_all_fds, bool)
721
722 static bool do_lxcapi_wait(struct lxc_container *c, const char *state,
723 int timeout)
724 {
725 int ret;
726
727 if (!c)
728 return false;
729
730 ret = lxc_wait(c->name, state, timeout, c->config_path);
731 return ret == 0;
732 }
733
734 WRAP_API_2(bool, lxcapi_wait, const char *, int)
735
736 static bool am_single_threaded(void)
737 {
738 __do_closedir DIR *dir = NULL;
739 struct dirent *direntp;
740 int count = 0;
741
742 dir = opendir("/proc/self/task");
743 if (!dir)
744 return false;
745
746 while ((direntp = readdir(dir))) {
747 if (strequal(direntp->d_name, "."))
748 continue;
749
750 if (strequal(direntp->d_name, ".."))
751 continue;
752
753 count++;
754 if (count > 1)
755 break;
756 }
757
758 return count == 1;
759 }
760
761 static void push_arg(char ***argp, char *arg, int *nargs)
762 {
763 char *copy;
764 char **argv;
765
766 copy = must_copy_string(arg);
767
768 do {
769 argv = realloc(*argp, (*nargs + 2) * sizeof(char *));
770 } while (!argv);
771
772 *argp = argv;
773 argv[*nargs] = copy;
774 (*nargs)++;
775 argv[*nargs] = NULL;
776 }
777
778 static char **split_init_cmd(const char *incmd)
779 {
780 __do_free char *copy = NULL;
781 char *p;
782 char **argv;
783 int nargs = 0;
784
785 if (!incmd)
786 return NULL;
787
788 copy = must_copy_string(incmd);
789
790 do {
791 argv = malloc(sizeof(char *));
792 } while (!argv);
793
794 argv[0] = NULL;
795 lxc_iterate_parts (p, copy, " ")
796 push_arg(&argv, p, &nargs);
797
798 if (nargs == 0) {
799 free(argv);
800 return NULL;
801 }
802
803 return argv;
804 }
805
806 static void free_init_cmd(char **argv)
807 {
808 int i = 0;
809
810 if (!argv)
811 return;
812
813 while (argv[i])
814 free(argv[i++]);
815
816 free(argv);
817 }
818
819 static int lxc_rcv_status(int state_socket)
820 {
821 int ret;
822 int state = -1;
823
824 again:
825 /* Receive container state. */
826 ret = lxc_abstract_unix_rcv_credential(state_socket, &state, sizeof(int));
827 if (ret <= 0) {
828 if (errno != EINTR)
829 return -1;
830
831 TRACE("Caught EINTR; retrying");
832 goto again;
833 }
834
835 return state;
836 }
837
838 static bool wait_on_daemonized_start(struct lxc_handler *handler, int pid)
839 {
840 int ret, state;
841
842 /* The first child is going to fork() again and then exits. So we reap
843 * the first child here.
844 */
845 ret = wait_for_pid(pid);
846 if (ret < 0)
847 DEBUG("Failed waiting on first child %d", pid);
848 else
849 DEBUG("First child %d exited", pid);
850
851 /* Close write end of the socket pair. */
852 close_prot_errno_disarm(handler->state_socket_pair[1]);
853
854 state = lxc_rcv_status(handler->state_socket_pair[0]);
855
856 /* Close read end of the socket pair. */
857 close_prot_errno_disarm(handler->state_socket_pair[0]);
858
859 if (state < 0) {
860 SYSERROR("Failed to receive the container state");
861 return false;
862 }
863
864 /* If we receive anything else then running we know that the container
865 * failed to start.
866 */
867 if (state != RUNNING) {
868 ERROR("Received container state \"%s\" instead of \"RUNNING\"",
869 lxc_state2str(state));
870 return false;
871 }
872
873 TRACE("Container is in \"RUNNING\" state");
874 return true;
875 }
876
877 static bool do_lxcapi_start(struct lxc_container *c, int useinit, char * const argv[])
878 {
879 int ret;
880 struct lxc_handler *handler;
881 struct lxc_conf *conf;
882 char *default_args[] = {
883 "/sbin/init",
884 NULL,
885 };
886 char **init_cmd = NULL;
887
888 /* container does exist */
889 if (!c)
890 return false;
891
892 /* If anything fails before we set error_num, we want an error in there.
893 */
894 c->error_num = 1;
895
896 /* Container has not been setup. */
897 if (!c->lxc_conf)
898 return false;
899
900 ret = ongoing_create(c);
901 switch (ret) {
902 case LXC_CREATE_FAILED:
903 ERROR("Failed checking for incomplete container creation");
904 return false;
905 case LXC_CREATE_ONGOING:
906 ERROR("Ongoing container creation detected");
907 return false;
908 case LXC_CREATE_INCOMPLETE:
909 ERROR("Failed to create container");
910 do_lxcapi_destroy(c);
911 return false;
912 }
913
914 if (container_mem_lock(c))
915 return false;
916
917 conf = c->lxc_conf;
918
919 /* initialize handler */
920 handler = lxc_init_handler(NULL, c->name, conf, c->config_path, c->daemonize);
921
922 container_mem_unlock(c);
923 if (!handler)
924 return false;
925
926 if (!argv) {
927 if (useinit && conf->execute_cmd)
928 argv = init_cmd = split_init_cmd(conf->execute_cmd);
929 else
930 argv = init_cmd = split_init_cmd(conf->init_cmd);
931 }
932
933 /* ... otherwise use default_args. */
934 if (!argv) {
935 if (useinit) {
936 ERROR("No valid init detected");
937 lxc_put_handler(handler);
938 return false;
939 }
940 argv = default_args;
941 }
942
943 /* I'm not sure what locks we want here.Any? Is liblxc's locking enough
944 * here to protect the on disk container? We don't want to exclude
945 * things like lxc_info while the container is running.
946 */
947 if (c->daemonize) {
948 bool started;
949 char title[2048];
950 pid_t pid_first, pid_second;
951
952 pid_first = fork();
953 if (pid_first < 0) {
954 free_init_cmd(init_cmd);
955 lxc_put_handler(handler);
956 return false;
957 }
958
959 /* first parent */
960 if (pid_first != 0) {
961 /* Set to NULL because we don't want father unlink
962 * the PID file, child will do the free and unlink.
963 */
964 c->pidfile = NULL;
965
966 /* Wait for container to tell us whether it started
967 * successfully.
968 */
969 started = wait_on_daemonized_start(handler, pid_first);
970
971 free_init_cmd(init_cmd);
972 lxc_put_handler(handler);
973 return started;
974 }
975
976 /* first child */
977
978 /* We don't really care if this doesn't print all the
979 * characters. All that it means is that the proctitle will be
980 * ugly. Similarly, we also don't care if setproctitle() fails.
981 */
982 ret = strnprintf(title, sizeof(title), "[lxc monitor] %s %s", c->config_path, c->name);
983 if (ret > 0) {
984 ret = setproctitle(title);
985 if (ret < 0)
986 INFO("Failed to set process title to %s", title);
987 else
988 INFO("Set process title to %s", title);
989 }
990
991 /* We fork() a second time to be reparented to init. Like
992 * POSIX's daemon() function we change to "/" and redirect
993 * std{in,out,err} to /dev/null.
994 */
995 pid_second = fork();
996 if (pid_second < 0) {
997 SYSERROR("Failed to fork first child process");
998 _exit(EXIT_FAILURE);
999 }
1000
1001 /* second parent */
1002 if (pid_second != 0) {
1003 free_init_cmd(init_cmd);
1004 lxc_put_handler(handler);
1005 _exit(EXIT_SUCCESS);
1006 }
1007
1008 /* second child */
1009
1010 /* change to / directory */
1011 ret = chdir("/");
1012 if (ret < 0) {
1013 SYSERROR("Failed to change to \"/\" directory");
1014 _exit(EXIT_FAILURE);
1015 }
1016
1017 ret = inherit_fds(handler, true);
1018 if (ret < 0)
1019 _exit(EXIT_FAILURE);
1020
1021 /* redirect std{in,out,err} to /dev/null */
1022 ret = null_stdfds();
1023 if (ret < 0) {
1024 ERROR("Failed to redirect std{in,out,err} to /dev/null");
1025 _exit(EXIT_FAILURE);
1026 }
1027
1028 /* become session leader */
1029 ret = setsid();
1030 if (ret < 0)
1031 TRACE("Process %d is already process group leader", lxc_raw_getpid());
1032 } else if (!am_single_threaded()) {
1033 ERROR("Cannot start non-daemonized container when threaded");
1034 free_init_cmd(init_cmd);
1035 lxc_put_handler(handler);
1036 return false;
1037 }
1038
1039 /* We need to write PID file after daemonize, so we always write the
1040 * right PID.
1041 */
1042 if (c->pidfile) {
1043 int w;
1044 char pidstr[INTTYPE_TO_STRLEN(pid_t)];
1045
1046 w = strnprintf(pidstr, sizeof(pidstr), "%d", lxc_raw_getpid());
1047 if (w < 0) {
1048 free_init_cmd(init_cmd);
1049 lxc_put_handler(handler);
1050
1051 SYSERROR("Failed to write monitor pid to \"%s\"", c->pidfile);
1052
1053 if (c->daemonize)
1054 _exit(EXIT_FAILURE);
1055
1056 return false;
1057 }
1058
1059 ret = lxc_write_to_file(c->pidfile, pidstr, w, false, 0600);
1060 if (ret < 0) {
1061 free_init_cmd(init_cmd);
1062 lxc_put_handler(handler);
1063
1064 SYSERROR("Failed to write monitor pid to \"%s\"", c->pidfile);
1065
1066 if (c->daemonize)
1067 _exit(EXIT_FAILURE);
1068
1069 return false;
1070 }
1071 }
1072
1073 conf->reboot = REBOOT_NONE;
1074
1075 /* Unshare the mount namespace if requested */
1076 if (conf->monitor_unshare) {
1077 ret = unshare(CLONE_NEWNS);
1078 if (ret < 0) {
1079 SYSERROR("Failed to unshare mount namespace");
1080 lxc_put_handler(handler);
1081 ret = 1;
1082 goto on_error;
1083 }
1084
1085 ret = mount(NULL, "/", NULL, MS_SLAVE|MS_REC, NULL);
1086 if (ret < 0) {
1087 SYSERROR("Failed to recursively turn root mount tree into dependent mount. Continuing...");
1088 lxc_put_handler(handler);
1089 ret = 1;
1090 goto on_error;
1091 }
1092 }
1093
1094 reboot:
1095 if (conf->reboot == REBOOT_INIT) {
1096 /* initialize handler */
1097 handler = lxc_init_handler(handler, c->name, conf, c->config_path, c->daemonize);
1098 if (!handler) {
1099 ret = 1;
1100 goto on_error;
1101 }
1102 }
1103
1104 ret = inherit_fds(handler, c->daemonize);
1105 if (ret < 0) {
1106 lxc_put_handler(handler);
1107 ret = 1;
1108 goto on_error;
1109 }
1110
1111 if (useinit)
1112 ret = lxc_execute(c->name, argv, 1, handler, c->config_path,
1113 c->daemonize, &c->error_num);
1114 else
1115 ret = lxc_start(argv, handler, c->config_path, c->daemonize,
1116 &c->error_num);
1117
1118 if (conf->reboot == REBOOT_REQ) {
1119 INFO("Container requested reboot");
1120 conf->reboot = REBOOT_INIT;
1121 goto reboot;
1122 }
1123
1124 on_error:
1125 if (c->pidfile) {
1126 unlink(c->pidfile);
1127 free(c->pidfile);
1128 c->pidfile = NULL;
1129 }
1130 free_init_cmd(init_cmd);
1131
1132 if (c->daemonize && ret != 0)
1133 _exit(EXIT_FAILURE);
1134 else if (c->daemonize)
1135 _exit(EXIT_SUCCESS);
1136
1137 if (ret != 0)
1138 return false;
1139
1140 return true;
1141 }
1142
1143 static bool lxcapi_start(struct lxc_container *c, int useinit,
1144 char *const argv[])
1145 {
1146 bool ret;
1147
1148 current_config = c ? c->lxc_conf : NULL;
1149 ret = do_lxcapi_start(c, useinit, argv);
1150 current_config = NULL;
1151
1152 return ret;
1153 }
1154
1155 /* Note, there MUST be an ending NULL. */
1156 static bool lxcapi_startl(struct lxc_container *c, int useinit, ...)
1157 {
1158 va_list ap;
1159 char **inargs = NULL;
1160 bool bret = false;
1161
1162 /* container exists */
1163 if (!c)
1164 return false;
1165
1166 current_config = c->lxc_conf;
1167
1168 va_start(ap, useinit);
1169 inargs = lxc_va_arg_list_to_argv(ap, 0, 1);
1170 va_end(ap);
1171 if (!inargs)
1172 goto on_error;
1173
1174 /* pass NULL if no arguments were supplied */
1175 bret = do_lxcapi_start(c, useinit, *inargs ? inargs : NULL);
1176
1177 on_error:
1178 if (inargs) {
1179 char **arg;
1180
1181 for (arg = inargs; *arg; arg++)
1182 free(*arg);
1183 free(inargs);
1184 }
1185
1186 current_config = NULL;
1187
1188 return bret;
1189 }
1190
1191 static bool do_lxcapi_stop(struct lxc_container *c)
1192 {
1193 int ret;
1194
1195 if (!c)
1196 return false;
1197
1198 ret = lxc_cmd_stop(c->name, c->config_path);
1199
1200 return ret == 0;
1201 }
1202
1203 WRAP_API(bool, lxcapi_stop)
1204
1205 static int do_create_container_dir(const char *path, struct lxc_conf *conf)
1206 {
1207 int lasterr;
1208 int ret = -1;
1209
1210 mode_t mask = umask(0002);
1211 ret = mkdir(path, 0770);
1212 lasterr = errno;
1213 umask(mask);
1214 errno = lasterr;
1215 if (ret) {
1216 if (errno != EEXIST)
1217 return -1;
1218
1219 ret = 0;
1220 }
1221
1222 if (!list_empty(&conf->id_map)) {
1223 ret = chown_mapped_root(path, conf);
1224 if (ret < 0)
1225 ret = -1;
1226 }
1227
1228 return ret;
1229 }
1230
1231 /* Create the standard expected container dir. */
1232 static bool create_container_dir(struct lxc_container *c)
1233 {
1234 __do_free char *s = NULL;
1235 int ret;
1236 size_t len;
1237
1238 len = strlen(c->config_path) + strlen(c->name) + 2;
1239 s = malloc(len);
1240 if (!s)
1241 return false;
1242
1243 ret = strnprintf(s, len, "%s/%s", c->config_path, c->name);
1244 if (ret < 0)
1245 return false;
1246
1247 return do_create_container_dir(s, c->lxc_conf) == 0;
1248 }
1249
1250 /* do_storage_create: thin wrapper around storage_create(). Like
1251 * storage_create(), it returns a mounted bdev on success, NULL on error.
1252 */
1253 static struct lxc_storage *do_storage_create(struct lxc_container *c,
1254 const char *type,
1255 struct bdev_specs *specs)
1256 {
1257 __do_free char *dest = NULL;
1258 int ret;
1259 size_t len;
1260 struct lxc_storage *bdev;
1261
1262 /* rootfs.path or lxcpath/lxcname/rootfs */
1263 if (c->lxc_conf->rootfs.path &&
1264 (access(c->lxc_conf->rootfs.path, F_OK) == 0)) {
1265 const char *rpath = c->lxc_conf->rootfs.path;
1266 len = strlen(rpath) + 1;
1267 dest = must_realloc(NULL, len);
1268 ret = strnprintf(dest, len, "%s", rpath);
1269 } else {
1270 const char *lxcpath = do_lxcapi_get_config_path(c);
1271 len = strlen(c->name) + 1 + strlen(lxcpath) + 1 + strlen(LXC_ROOTFS_DNAME) + 1;
1272 dest = must_realloc(NULL, len);
1273 ret = strnprintf(dest, len, "%s/%s/%s", lxcpath, c->name, LXC_ROOTFS_DNAME);
1274 }
1275 if (ret < 0)
1276 return NULL;
1277
1278 bdev = storage_create(dest, type, c->name, specs, c->lxc_conf);
1279 if (!bdev) {
1280 ERROR("Failed to create \"%s\" storage", type);
1281 return NULL;
1282 }
1283
1284 if (!c->set_config_item(c, "lxc.rootfs.path", bdev->src)) {
1285 ERROR("Failed to set \"lxc.rootfs.path = %s\"", bdev->src);
1286 storage_put(bdev);
1287 return NULL;
1288 }
1289
1290 /* If we are not root, chown the rootfs dir to root in the target user
1291 * namespace.
1292 */
1293 if (am_guest_unpriv() || !list_empty(&c->lxc_conf->id_map)) {
1294 ret = chown_mapped_root(bdev->dest, c->lxc_conf);
1295 if (ret < 0) {
1296 ERROR("Error chowning \"%s\" to container root", bdev->dest);
1297 suggest_default_idmap();
1298 storage_put(bdev);
1299 return NULL;
1300 }
1301 }
1302
1303 return bdev;
1304 }
1305
1306 /* Strip path and return name of file for argv[0] passed to execvp */
1307 static char *lxctemplatefilename(char *tpath)
1308 {
1309 char *p;
1310
1311 p = tpath + strlen(tpath) - 1;
1312 while ( (p-1) >= tpath && *(p-1) != '/')
1313 p--;
1314
1315 return p;
1316 }
1317
1318 static bool create_run_template(struct lxc_container *c, char *tpath,
1319 bool need_null_stdfds, char *const argv[])
1320 {
1321 int ret;
1322 pid_t pid;
1323
1324 if (!tpath)
1325 return true;
1326
1327 pid = fork();
1328 if (pid < 0) {
1329 SYSERROR("Failed to fork task for container creation template");
1330 return false;
1331 }
1332
1333 if (pid == 0) { /* child */
1334 int i, len;
1335 char *namearg, *patharg, *rootfsarg;
1336 char **newargv;
1337 int nargs = 0;
1338 struct lxc_storage *bdev = NULL;
1339 struct lxc_conf *conf = c->lxc_conf;
1340 uid_t euid;
1341
1342 if (need_null_stdfds) {
1343 ret = null_stdfds();
1344 if (ret < 0)
1345 _exit(EXIT_FAILURE);
1346 }
1347
1348 ret = lxc_storage_prepare(conf);
1349 if (ret) {
1350 ERROR("Failed to initialize storage");
1351 _exit(EXIT_FAILURE);
1352 }
1353 bdev = conf->rootfs.storage;
1354
1355 euid = geteuid();
1356 if (euid == 0) {
1357 ret = unshare(CLONE_NEWNS);
1358 if (ret < 0) {
1359 ERROR("Failed to unshare CLONE_NEWNS");
1360 _exit(EXIT_FAILURE);
1361 }
1362
1363 if (detect_shared_rootfs() && mount(NULL, "/", NULL, MS_SLAVE | MS_REC, NULL))
1364 SYSERROR("Failed to recursively turn root mount tree into dependent mount. Continuing...");
1365 }
1366
1367 if (!strequal(bdev->type, "dir") && !strequal(bdev->type, "btrfs")) {
1368 if (euid != 0) {
1369 ERROR("Unprivileged users can only create "
1370 "btrfs and directory-backed containers");
1371 _exit(EXIT_FAILURE);
1372 }
1373
1374 if (strequal(bdev->type, "overlay") ||
1375 strequal(bdev->type, "overlayfs")) {
1376 /* If we create an overlay container we need to
1377 * rsync the contents into
1378 * <container-path>/<container-name>/rootfs.
1379 * However, the overlay mount function will
1380 * mount
1381 * <container-path>/<container-name>/delta0
1382 * over
1383 * <container-path>/<container-name>/rootfs
1384 * which means we would rsync the rootfs into
1385 * the delta directory. That doesn't make sense
1386 * since the delta directory only exists to
1387 * record the differences to
1388 * <container-path>/<container-name>/rootfs. So
1389 * let's simply bind-mount here and then rsync
1390 * directly into
1391 * <container-path>/<container-name>/rootfs.
1392 */
1393 char *src;
1394
1395 src = ovl_get_rootfs(bdev->src, &(size_t){0});
1396 if (!src) {
1397 ERROR("Failed to get rootfs");
1398 _exit(EXIT_FAILURE);
1399 }
1400
1401 ret = mount(src, bdev->dest, "bind", MS_BIND | MS_REC, NULL);
1402 if (ret < 0) {
1403 ERROR("Failed to mount rootfs");
1404 _exit(EXIT_FAILURE);
1405 }
1406 } else {
1407 ret = bdev->ops->mount(bdev);
1408 if (ret < 0) {
1409 ERROR("Failed to mount rootfs");
1410 _exit(EXIT_FAILURE);
1411 }
1412 }
1413 } else { /* TODO come up with a better way here! */
1414 const char *src;
1415 free(bdev->dest);
1416 src = lxc_storage_get_path(bdev->src, bdev->type);
1417 bdev->dest = strdup(src);
1418 }
1419
1420 /* Create our new array, pre-pend the template name and base
1421 * args.
1422 */
1423 if (argv)
1424 for (nargs = 0; argv[nargs]; nargs++)
1425 ;
1426
1427 /* template, path, rootfs and name args */
1428 nargs += 4;
1429
1430 newargv = malloc(nargs * sizeof(*newargv));
1431 if (!newargv)
1432 _exit(EXIT_FAILURE);
1433 newargv[0] = lxctemplatefilename(tpath);
1434
1435 /* --path */
1436 len = strlen(c->config_path) + strlen(c->name) + strlen("--path=") + 2;
1437 patharg = malloc(len);
1438 if (!patharg)
1439 _exit(EXIT_FAILURE);
1440
1441 ret = strnprintf(patharg, len, "--path=%s/%s", c->config_path, c->name);
1442 if (ret < 0)
1443 _exit(EXIT_FAILURE);
1444 newargv[1] = patharg;
1445
1446 /* --name */
1447 len = strlen("--name=") + strlen(c->name) + 1;
1448 namearg = malloc(len);
1449 if (!namearg)
1450 _exit(EXIT_FAILURE);
1451
1452 ret = strnprintf(namearg, len, "--name=%s", c->name);
1453 if (ret < 0)
1454 _exit(EXIT_FAILURE);
1455 newargv[2] = namearg;
1456
1457 /* --rootfs */
1458 len = strlen("--rootfs=") + 1 + strlen(bdev->dest);
1459 rootfsarg = malloc(len);
1460 if (!rootfsarg)
1461 _exit(EXIT_FAILURE);
1462
1463 ret = strnprintf(rootfsarg, len, "--rootfs=%s", bdev->dest);
1464 if (ret < 0)
1465 _exit(EXIT_FAILURE);
1466 newargv[3] = rootfsarg;
1467
1468 /* add passed-in args */
1469 if (argv)
1470 for (i = 4; i < nargs; i++)
1471 newargv[i] = argv[i - 4];
1472
1473 /* add trailing NULL */
1474 nargs++;
1475 newargv = realloc(newargv, nargs * sizeof(*newargv));
1476 if (!newargv)
1477 _exit(EXIT_FAILURE);
1478 newargv[nargs - 1] = NULL;
1479
1480 /* If we're running the template in a mapped userns, then we
1481 * prepend the template command with: lxc-usernsexec <-m map1>
1482 * ... <-m mapn> -- and we append "--mapped-uid x", where x is
1483 * the mapped uid for our geteuid()
1484 */
1485 if (!list_empty(&conf->id_map)) {
1486 int extraargs, hostuid_mapped, hostgid_mapped;
1487 char **n2;
1488 char txtuid[20], txtgid[20];
1489 struct id_map *map;
1490 int n2args = 1;
1491
1492 n2 = malloc(n2args * sizeof(*n2));
1493 if (!n2)
1494 _exit(EXIT_FAILURE);
1495
1496 newargv[0] = tpath;
1497 tpath = "lxc-usernsexec";
1498 n2[0] = "lxc-usernsexec";
1499
1500 list_for_each_entry(map, &conf->id_map, head) {
1501 n2args += 2;
1502 n2 = realloc(n2, n2args * sizeof(char *));
1503 if (!n2)
1504 _exit(EXIT_FAILURE);
1505
1506 n2[n2args - 2] = "-m";
1507 n2[n2args - 1] = malloc(200);
1508 if (!n2[n2args - 1])
1509 _exit(EXIT_FAILURE);
1510
1511 ret = strnprintf(n2[n2args - 1], 200, "%c:%lu:%lu:%lu",
1512 map->idtype == ID_TYPE_UID ? 'u' : 'g',
1513 map->nsid, map->hostid, map->range);
1514 if (ret < 0)
1515 _exit(EXIT_FAILURE);
1516 }
1517
1518 hostuid_mapped = mapped_hostid(geteuid(), conf, ID_TYPE_UID);
1519 extraargs = hostuid_mapped >= 0 ? 1 : 3;
1520
1521 n2 = realloc(n2, (nargs + n2args + extraargs) * sizeof(char *));
1522 if (!n2)
1523 _exit(EXIT_FAILURE);
1524
1525 if (hostuid_mapped < 0) {
1526 hostuid_mapped = find_unmapped_nsid(conf, ID_TYPE_UID);
1527 n2[n2args++] = "-m";
1528 if (hostuid_mapped < 0) {
1529 ERROR("Failed to find free uid to map");
1530 _exit(EXIT_FAILURE);
1531 }
1532
1533 n2[n2args++] = malloc(200);
1534 if (!n2[n2args - 1]) {
1535 SYSERROR("out of memory");
1536 _exit(EXIT_FAILURE);
1537 }
1538
1539 ret = strnprintf(n2[n2args - 1], 200, "u:%d:%d:1",
1540 hostuid_mapped, geteuid());
1541 if (ret < 0)
1542 _exit(EXIT_FAILURE);
1543 }
1544
1545 hostgid_mapped = mapped_hostid(getegid(), conf, ID_TYPE_GID);
1546 extraargs = hostgid_mapped >= 0 ? 1 : 3;
1547
1548 n2 = realloc(n2, (nargs + n2args + extraargs) * sizeof(char *));
1549 if (!n2)
1550 _exit(EXIT_FAILURE);
1551
1552 if (hostgid_mapped < 0) {
1553 hostgid_mapped = find_unmapped_nsid(conf, ID_TYPE_GID);
1554 n2[n2args++] = "-m";
1555 if (hostgid_mapped < 0) {
1556 ERROR("Failed to find free gid to map");
1557 _exit(EXIT_FAILURE);
1558 }
1559
1560 n2[n2args++] = malloc(200);
1561 if (!n2[n2args - 1]) {
1562 SYSERROR("out of memory");
1563 _exit(EXIT_FAILURE);
1564 }
1565
1566 ret = strnprintf(n2[n2args - 1], 200, "g:%d:%d:1",
1567 hostgid_mapped, getegid());
1568 if (ret < 0)
1569 _exit(EXIT_FAILURE);
1570 }
1571
1572 n2[n2args++] = "--";
1573
1574 for (i = 0; i < nargs; i++)
1575 n2[i + n2args] = newargv[i];
1576 n2args += nargs;
1577
1578 /* Finally add "--mapped-uid $uid" to tell template what
1579 * to chown cached images to.
1580 */
1581 n2args += 4;
1582 n2 = realloc(n2, n2args * sizeof(char *));
1583 if (!n2)
1584 _exit(EXIT_FAILURE);
1585
1586 /* note n2[n2args-1] is NULL */
1587 n2[n2args - 5] = "--mapped-uid";
1588
1589 ret = strnprintf(txtuid, 20, "%d", hostuid_mapped);
1590 if (ret < 0) {
1591 free(newargv);
1592 free(n2);
1593 _exit(EXIT_FAILURE);
1594 }
1595
1596 n2[n2args - 4] = txtuid;
1597 n2[n2args - 3] = "--mapped-gid";
1598
1599 ret = strnprintf(txtgid, 20, "%d", hostgid_mapped);
1600 if (ret < 0) {
1601 free(newargv);
1602 free(n2);
1603 _exit(EXIT_FAILURE);
1604 }
1605
1606 n2[n2args - 2] = txtgid;
1607 n2[n2args - 1] = NULL;
1608 free(newargv);
1609 newargv = n2;
1610 }
1611
1612 execvp(tpath, newargv);
1613 SYSERROR("Failed to execute template %s", tpath);
1614 _exit(EXIT_FAILURE);
1615 }
1616
1617 ret = wait_for_pid(pid);
1618 if (ret != 0) {
1619 ERROR("Failed to create container from template");
1620 return false;
1621 }
1622
1623 return true;
1624 }
1625
1626 static bool prepend_lxc_header(char *path, const char *t, char *const argv[])
1627 {
1628 ssize_t len, flen;
1629 char *contents;
1630 FILE *f;
1631 int ret = -1;
1632 ssize_t nbytes;
1633 #if HAVE_OPENSSL
1634 unsigned int md_len = 0;
1635 unsigned char md_value[EVP_MAX_MD_SIZE];
1636 char *tpath;
1637 #endif
1638
1639 f = fopen(path, "re");
1640 if (f == NULL)
1641 return false;
1642
1643 ret = fseek(f, 0, SEEK_END);
1644 if (ret < 0)
1645 goto out_error;
1646
1647 ret = -1;
1648 flen = ftell(f);
1649 if (flen < 0)
1650 goto out_error;
1651
1652 ret = fseek(f, 0, SEEK_SET);
1653 if (ret < 0)
1654 goto out_error;
1655
1656 ret = fseek(f, 0, SEEK_SET);
1657 if (ret < 0)
1658 goto out_error;
1659
1660 ret = -1;
1661 contents = malloc(flen + 1);
1662 if (!contents)
1663 goto out_error;
1664
1665 len = fread(contents, 1, flen, f);
1666 if (len != flen)
1667 goto out_free_contents;
1668
1669 contents[flen] = '\0';
1670
1671 ret = fclose(f);
1672 f = NULL;
1673 if (ret < 0)
1674 goto out_free_contents;
1675
1676 #if HAVE_OPENSSL
1677 tpath = get_template_path(t);
1678 if (!tpath) {
1679 ERROR("Invalid template \"%s\" specified", t);
1680 goto out_free_contents;
1681 }
1682
1683 ret = sha1sum_file(tpath, md_value, &md_len);
1684 if (ret < 0) {
1685 ERROR("Failed to get sha1sum of %s", tpath);
1686 free(tpath);
1687 goto out_free_contents;
1688 }
1689 free(tpath);
1690 #endif
1691
1692 f = fopen(path, "we");
1693 if (f == NULL) {
1694 SYSERROR("Reopening config for writing");
1695 free(contents);
1696 return false;
1697 }
1698
1699 fprintf(f, "# Template used to create this container: %s\n", t);
1700 if (argv) {
1701 fprintf(f, "# Parameters passed to the template:");
1702 while (*argv) {
1703 fprintf(f, " %s", *argv);
1704 argv++;
1705 }
1706 fprintf(f, "\n");
1707 }
1708
1709 #if HAVE_OPENSSL
1710 fprintf(f, "# Template script checksum (SHA-1): ");
1711 for (size_t i = 0; i < md_len; i++)
1712 fprintf(f, "%02x", md_value[i]);
1713 fprintf(f, "\n");
1714 #endif
1715 fprintf(f, "# For additional config options, please look at lxc.container.conf(5)\n");
1716 fprintf(f, "\n# Uncomment the following line to support nesting containers:\n");
1717 fprintf(f, "#lxc.include = " LXCTEMPLATECONFIG "/nesting.conf\n");
1718 fprintf(f, "# (Be aware this has security implications)\n\n");
1719 nbytes = fwrite(contents, 1, flen, f);
1720 if (nbytes < 0 || nbytes != flen) {
1721 SYSERROR("Writing original contents");
1722 free(contents);
1723 fclose(f);
1724 return false;
1725 }
1726
1727 ret = 0;
1728
1729 out_free_contents:
1730 free(contents);
1731
1732 out_error:
1733 if (f) {
1734 int newret;
1735 newret = fclose(f);
1736 if (ret == 0)
1737 ret = newret;
1738 }
1739
1740 if (ret < 0) {
1741 SYSERROR("Error prepending header");
1742 return false;
1743 }
1744
1745 return true;
1746 }
1747
1748 static void lxcapi_clear_config(struct lxc_container *c)
1749 {
1750 if (!c || !c->lxc_conf)
1751 return;
1752
1753 lxc_conf_free(c->lxc_conf);
1754 c->lxc_conf = NULL;
1755 }
1756
1757 #define do_lxcapi_clear_config(c) lxcapi_clear_config(c)
1758
1759 /*
1760 * lxcapi_create:
1761 * create a container with the given parameters.
1762 * @c: container to be created. It has the lxcpath, name, and a starting
1763 * configuration already set
1764 * @t: the template to execute to instantiate the root filesystem and
1765 * adjust the configuration.
1766 * @bdevtype: backing store type to use. If NULL, dir will be used.
1767 * @specs: additional parameters for the backing store, i.e. LVM vg to
1768 * use.
1769 *
1770 * @argv: the arguments to pass to the template, terminated by NULL. If no
1771 * arguments, you can just pass NULL.
1772 */
1773 static bool do_lxcapi_create(struct lxc_container *c, const char *t,
1774 const char *bdevtype, struct bdev_specs *specs,
1775 int flags, char *const argv[])
1776 {
1777 __do_free char *path_template = NULL;
1778 int partial_fd;
1779 mode_t mask;
1780 pid_t pid;
1781 bool ret = false, rootfs_managed = true;
1782
1783 if (!c)
1784 return false;
1785
1786 if (t) {
1787 path_template = get_template_path(t);
1788 if (!path_template)
1789 return syserror_set(ENOENT, "Template \"%s\" not found", t);
1790 }
1791
1792 /* If a template is passed in, and the rootfs already is defined in the
1793 * container config and exists, then the caller is trying to create an
1794 * existing container. Return an error, but do NOT delete the container.
1795 */
1796 if (do_lxcapi_is_defined(c) && c->lxc_conf && c->lxc_conf->rootfs.path &&
1797 access(c->lxc_conf->rootfs.path, F_OK) == 0 && path_template)
1798 return syserror_set(EEXIST, "Container \"%s\" already exists in \"%s\"", c->name, c->config_path);
1799
1800 if (!c->lxc_conf &&
1801 !do_lxcapi_load_config(c, lxc_global_config_value("lxc.default_config")))
1802 return syserror_set(EINVAL, "Failed to load default configuration file %s",
1803 lxc_global_config_value("lxc.default_config"));
1804
1805 if (!create_container_dir(c))
1806 return syserror_set(EINVAL, "Failed to create container %s", c->name);
1807
1808 if (c->lxc_conf->rootfs.path)
1809 rootfs_managed = false;
1810
1811 /* If both template and rootfs.path are set, template is setup as
1812 * rootfs.path. The container is already created if we have a config and
1813 * rootfs.path is accessible
1814 */
1815 if (!c->lxc_conf->rootfs.path && !path_template) {
1816 /* No template passed in and rootfs does not exist. */
1817 if (!c->save_config(c, NULL)) {
1818 ERROR("Failed to save initial config for \"%s\"", c->name);
1819 goto out;
1820 }
1821 ret = true;
1822 goto out;
1823 }
1824
1825 /* Rootfs passed into configuration, but does not exist. */
1826 if (c->lxc_conf->rootfs.path && access(c->lxc_conf->rootfs.path, F_OK) != 0)
1827 goto out;
1828
1829 if (do_lxcapi_is_defined(c) && c->lxc_conf->rootfs.path && !path_template) {
1830 /* Rootfs already existed, user just wanted to save the loaded
1831 * configuration.
1832 */
1833 if (!c->save_config(c, NULL))
1834 ERROR("Failed to save initial config for \"%s\"", c->name);
1835
1836 ret = true;
1837 goto out;
1838 }
1839
1840 /* Mark that this container is being created */
1841 partial_fd = create_partial(c);
1842 if (partial_fd < 0)
1843 goto out;
1844
1845 /* No need to get disk lock bc we have the partial lock. */
1846
1847 mask = umask(0022);
1848
1849 /* Create the storage.
1850 * Note we can't do this in the same task as we use to execute the
1851 * template because of the way zfs works.
1852 * After you 'zfs create', zfs mounts the fs only in the initial
1853 * namespace.
1854 */
1855 pid = fork();
1856 if (pid < 0) {
1857 SYSERROR("Failed to fork task for container creation template");
1858 goto out_unlock;
1859 }
1860
1861 if (pid == 0) { /* child */
1862 struct lxc_storage *bdev = NULL;
1863
1864 bdev = do_storage_create(c, bdevtype, specs);
1865 if (!bdev) {
1866 ERROR("Failed to create %s storage for %s",
1867 bdevtype ? bdevtype : "(none)", c->name);
1868 _exit(EXIT_FAILURE);
1869 }
1870
1871 /* Save config file again to store the new rootfs location. */
1872 if (!do_lxcapi_save_config(c, NULL)) {
1873 ERROR("Failed to save initial config for %s", c->name);
1874 /* Parent task won't see the storage driver in the
1875 * config so we delete it.
1876 */
1877 bdev->ops->umount(bdev);
1878 bdev->ops->destroy(bdev);
1879 _exit(EXIT_FAILURE);
1880 }
1881
1882 _exit(EXIT_SUCCESS);
1883 }
1884
1885 if (wait_for_pid(pid) != 0)
1886 goto out_unlock;
1887
1888 /* Reload config to get the rootfs. */
1889 lxc_conf_free(c->lxc_conf);
1890 c->lxc_conf = NULL;
1891
1892 if (!load_config_locked(c, c->configfile))
1893 goto out_unlock;
1894
1895 if (!create_run_template(c, path_template, !!(flags & LXC_CREATE_QUIET), argv))
1896 goto out_unlock;
1897
1898 /* Now clear out the lxc_conf we have, reload from the created
1899 * container.
1900 */
1901 do_lxcapi_clear_config(c);
1902
1903 if (t) {
1904 if (!prepend_lxc_header(c->configfile, path_template, argv)) {
1905 ERROR("Failed to prepend header to config file");
1906 goto out_unlock;
1907 }
1908 }
1909
1910 ret = load_config_locked(c, c->configfile);
1911
1912 out_unlock:
1913 umask(mask);
1914 remove_partial(c, partial_fd);
1915
1916 out:
1917 if (!ret) {
1918 bool reset_managed = c->lxc_conf->rootfs.managed;
1919
1920 /*
1921 * Ensure that we don't destroy storage we didn't create
1922 * ourselves.
1923 */
1924 if (!rootfs_managed)
1925 c->lxc_conf->rootfs.managed = false;
1926 container_destroy(c, NULL);
1927 c->lxc_conf->rootfs.managed = reset_managed;
1928 }
1929
1930 return ret;
1931 }
1932
1933 static bool lxcapi_create(struct lxc_container *c, const char *t,
1934 const char *bdevtype, struct bdev_specs *specs,
1935 int flags, char *const argv[])
1936 {
1937 bool ret;
1938
1939 current_config = c ? c->lxc_conf : NULL;
1940
1941 ret = do_lxcapi_create(c, t, bdevtype, specs, flags, argv);
1942 current_config = NULL;
1943 return ret;
1944 }
1945
1946 static bool do_lxcapi_reboot(struct lxc_container *c)
1947 {
1948 __do_close int pidfd = -EBADF;
1949 pid_t pid = -1;
1950 int ret;
1951 int rebootsignal = SIGINT;
1952
1953 if (!c)
1954 return false;
1955
1956 if (!do_lxcapi_is_running(c))
1957 return false;
1958
1959 pidfd = do_lxcapi_init_pidfd(c);
1960 if (pidfd < 0) {
1961 pid = do_lxcapi_init_pid(c);
1962 if (pid <= 0)
1963 return false;
1964 }
1965
1966 if (c->lxc_conf && c->lxc_conf->rebootsignal)
1967 rebootsignal = c->lxc_conf->rebootsignal;
1968
1969 if (pidfd >= 0)
1970 ret = lxc_raw_pidfd_send_signal(pidfd, rebootsignal, NULL, 0);
1971 else
1972 ret = kill(pid, rebootsignal);
1973 if (ret < 0)
1974 return log_warn(false, "Failed to send signal %d to pid %d",
1975 rebootsignal, pid);
1976
1977 return true;
1978 }
1979
1980 WRAP_API(bool, lxcapi_reboot)
1981
1982 static bool do_lxcapi_reboot2(struct lxc_container *c, int timeout)
1983 {
1984 __do_close int pidfd = -EBADF, state_client_fd = -EBADF;
1985 int rebootsignal = SIGINT;
1986 pid_t pid = -1;
1987 lxc_state_t states[MAX_STATE] = {0};
1988 int killret, ret;
1989
1990 if (!c)
1991 return false;
1992
1993 if (!do_lxcapi_is_running(c))
1994 return true;
1995
1996 pidfd = do_lxcapi_init_pidfd(c);
1997 if (pidfd < 0) {
1998 pid = do_lxcapi_init_pid(c);
1999 if (pid <= 0)
2000 return true;
2001 }
2002
2003 if (c->lxc_conf && c->lxc_conf->rebootsignal)
2004 rebootsignal = c->lxc_conf->rebootsignal;
2005
2006 /* Add a new state client before sending the shutdown signal so that we
2007 * don't miss a state.
2008 */
2009 if (timeout != 0) {
2010 states[RUNNING] = 2;
2011 ret = lxc_cmd_add_state_client(c->name, c->config_path, states,
2012 &state_client_fd);
2013 if (ret < 0)
2014 return false;
2015
2016 if (state_client_fd < 0)
2017 return false;
2018
2019 if (ret == RUNNING)
2020 return true;
2021
2022 if (ret < MAX_STATE)
2023 return false;
2024 }
2025
2026 /* Send reboot signal to container. */
2027 if (pidfd >= 0)
2028 killret = lxc_raw_pidfd_send_signal(pidfd, rebootsignal, NULL, 0);
2029 else
2030 killret = kill(pid, rebootsignal);
2031 if (killret < 0)
2032 return log_warn(false, "Failed to send signal %d to pidfd(%d)/pid(%d)", rebootsignal, pidfd, pid);
2033 TRACE("Sent signal %d to pidfd(%d)/pid(%d)", rebootsignal, pidfd, pid);
2034
2035 if (timeout == 0)
2036 return true;
2037
2038 ret = lxc_cmd_sock_rcv_state(state_client_fd, timeout);
2039 if (ret < 0)
2040 return false;
2041
2042 TRACE("Received state \"%s\"", lxc_state2str(ret));
2043 if (ret != RUNNING)
2044 return false;
2045
2046 return true;
2047 }
2048
2049 WRAP_API_1(bool, lxcapi_reboot2, int)
2050
2051 static bool do_lxcapi_shutdown(struct lxc_container *c, int timeout)
2052 {
2053 __do_close int pidfd = -EBADF, state_client_fd = -EBADF;
2054 int haltsignal = SIGPWR;
2055 pid_t pid = -1;
2056 lxc_state_t states[MAX_STATE] = {0};
2057 int killret, ret;
2058
2059 if (!c)
2060 return false;
2061
2062 if (!do_lxcapi_is_running(c))
2063 return true;
2064
2065 pidfd = do_lxcapi_init_pidfd(c);
2066 pid = do_lxcapi_init_pid(c);
2067 if (pid <= 0)
2068 return true;
2069
2070 /* Detect whether we should send SIGRTMIN + 3 (e.g. systemd). */
2071 if (c->lxc_conf && c->lxc_conf->haltsignal)
2072 haltsignal = c->lxc_conf->haltsignal;
2073 else if (task_blocks_signal(pid, (SIGRTMIN + 3)))
2074 haltsignal = (SIGRTMIN + 3);
2075
2076
2077 /*
2078 * Add a new state client before sending the shutdown signal so
2079 * that we don't miss a state.
2080 */
2081 if (timeout != 0) {
2082 states[STOPPED] = 1;
2083 ret = lxc_cmd_add_state_client(c->name, c->config_path, states,
2084 &state_client_fd);
2085 if (ret < 0)
2086 return false;
2087
2088 if (state_client_fd < 0)
2089 return false;
2090
2091 if (ret == STOPPED)
2092 return true;
2093
2094 if (ret < MAX_STATE)
2095 return false;
2096 }
2097
2098 if (pidfd >= 0) {
2099 struct pollfd pidfd_poll = {
2100 .events = POLLIN,
2101 .fd = pidfd,
2102 };
2103
2104 killret = lxc_raw_pidfd_send_signal(pidfd, haltsignal,
2105 NULL, 0);
2106 if (killret < 0)
2107 return log_warn(false, "Failed to send signal %d to pidfd %d",
2108 haltsignal, pidfd);
2109
2110 TRACE("Sent signal %d to pidfd %d", haltsignal, pidfd);
2111
2112 /*
2113 * No need for going through all of the state server
2114 * complications anymore. We can just poll on pidfds. :)
2115 */
2116
2117 if (timeout != 0) {
2118 ret = poll(&pidfd_poll, 1, timeout * 1000);
2119 if (ret < 0 || !(pidfd_poll.revents & POLLIN))
2120 return false;
2121
2122 TRACE("Pidfd polling detected container exit");
2123 }
2124 } else {
2125 killret = kill(pid, haltsignal);
2126 if (killret < 0)
2127 return log_warn(false, "Failed to send signal %d to pid %d",
2128 haltsignal, pid);
2129
2130 TRACE("Sent signal %d to pid %d", haltsignal, pid);
2131 }
2132
2133 if (timeout == 0)
2134 return true;
2135
2136 ret = lxc_cmd_sock_rcv_state(state_client_fd, timeout);
2137 if (ret < 0)
2138 return false;
2139
2140 TRACE("Received state \"%s\"", lxc_state2str(ret));
2141 if (ret != STOPPED)
2142 return false;
2143
2144 return true;
2145 }
2146
2147 WRAP_API_1(bool, lxcapi_shutdown, int)
2148
2149 static bool lxcapi_createl(struct lxc_container *c, const char *t,
2150 const char *bdevtype, struct bdev_specs *specs, int flags, ...)
2151 {
2152 bool bret = false;
2153 char **args = NULL;
2154 va_list ap;
2155
2156 if (!c)
2157 return false;
2158
2159 current_config = c->lxc_conf;
2160
2161 /*
2162 * since we're going to wait for create to finish, I don't think we
2163 * need to get a copy of the arguments.
2164 */
2165 va_start(ap, flags);
2166 args = lxc_va_arg_list_to_argv(ap, 0, 0);
2167 va_end(ap);
2168 if (!args) {
2169 ERROR("Failed to allocate memory");
2170 goto out;
2171 }
2172
2173 bret = do_lxcapi_create(c, t, bdevtype, specs, flags, args);
2174
2175 out:
2176 free(args);
2177 current_config = NULL;
2178 return bret;
2179 }
2180
2181 static void do_clear_unexp_config_line(struct lxc_conf *conf, const char *key)
2182 {
2183 if (strequal(key, "lxc.cgroup"))
2184 return clear_unexp_config_line(conf, key, true);
2185
2186 if (strequal(key, "lxc.network"))
2187 return clear_unexp_config_line(conf, key, true);
2188
2189 if (strequal(key, "lxc.net"))
2190 return clear_unexp_config_line(conf, key, true);
2191
2192 /* Clear a network with a specific index. */
2193 if (strnequal(key, "lxc.net.", 8)) {
2194 int ret;
2195 const char *idx;
2196
2197 idx = key + 8;
2198 ret = lxc_safe_uint(idx, &(unsigned int){0});
2199 if (!ret)
2200 return clear_unexp_config_line(conf, key, true);
2201 }
2202
2203 if (strequal(key, "lxc.hook"))
2204 return clear_unexp_config_line(conf, key, true);
2205
2206 return clear_unexp_config_line(conf, key, false);
2207 }
2208
2209 static bool do_lxcapi_clear_config_item(struct lxc_container *c,
2210 const char *key)
2211 {
2212 int ret = 1;
2213 struct lxc_config_t *config;
2214
2215 if (!c || !c->lxc_conf)
2216 return false;
2217
2218 if (container_mem_lock(c))
2219 return false;
2220
2221 config = lxc_get_config(key);
2222
2223 ret = config->clr(key, c->lxc_conf, NULL);
2224 if (!ret)
2225 do_clear_unexp_config_line(c->lxc_conf, key);
2226
2227 container_mem_unlock(c);
2228 return ret == 0;
2229 }
2230
2231 WRAP_API_1(bool, lxcapi_clear_config_item, const char *)
2232
2233 static inline bool enter_net_ns(struct lxc_container *c)
2234 {
2235 pid_t pid = do_lxcapi_init_pid(c);
2236
2237 if (pid < 0)
2238 return false;
2239
2240 if ((geteuid() != 0 || (c->lxc_conf && !list_empty(&c->lxc_conf->id_map))) &&
2241 (access("/proc/self/ns/user", F_OK) == 0))
2242 if (!switch_to_ns(pid, "user"))
2243 return false;
2244
2245 return switch_to_ns(pid, "net");
2246 }
2247
2248 /* Used by qsort and bsearch functions for comparing names. */
2249 static inline int string_cmp(char **first, char **second)
2250 {
2251 return strcmp(*first, *second);
2252 }
2253
2254 /* Used by qsort and bsearch functions for comparing container names. */
2255 static inline int container_cmp(struct lxc_container **first,
2256 struct lxc_container **second)
2257 {
2258 return strcmp((*first)->name, (*second)->name);
2259 }
2260
2261 static bool add_to_array(char ***names, char *cname, int pos)
2262 {
2263 __do_free char *dup_cname = NULL;
2264 char **newnames;
2265
2266 dup_cname = strdup(cname);
2267 if (!dup_cname)
2268 return false;
2269
2270 newnames = realloc(*names, (pos + 1) * sizeof(char *));
2271 if (!newnames)
2272 return ret_set_errno(false, ENOMEM);
2273
2274 newnames[pos] = move_ptr(dup_cname);
2275
2276 /* Sort the array as we will use binary search on it. */
2277 qsort(newnames, pos + 1, sizeof(char *),
2278 (int (*)(const void *, const void *))string_cmp);
2279
2280 *names = newnames;
2281 return true;
2282 }
2283
2284 static bool add_to_clist(struct lxc_container ***list, struct lxc_container *c,
2285 int pos, bool sort)
2286 {
2287 struct lxc_container **newlist;
2288
2289 newlist = realloc(*list, (pos + 1) * sizeof(struct lxc_container *));
2290 if (!newlist)
2291 return ret_set_errno(false, ENOMEM);
2292
2293 newlist[pos] = c;
2294
2295 /* Sort the array as we will use binary search on it. */
2296 if (sort)
2297 qsort(newlist, pos + 1, sizeof(struct lxc_container *),
2298 (int (*)(const void *, const void *))container_cmp);
2299
2300 *list = newlist;
2301 return true;
2302 }
2303
2304 static char **get_from_array(char ***names, char *cname, int size)
2305 {
2306 if (!*names)
2307 return NULL;
2308
2309 return bsearch(&cname, *names, size, sizeof(char *),
2310 (int (*)(const void *, const void *))string_cmp);
2311 }
2312
2313 static bool array_contains(char ***names, char *cname, int size)
2314 {
2315 if (get_from_array(names, cname, size))
2316 return true;
2317
2318 return false;
2319 }
2320
2321 static char **do_lxcapi_get_interfaces(struct lxc_container *c)
2322 {
2323 pid_t pid;
2324 int i, count = 0, pipefd[2];
2325 char **interfaces = NULL;
2326 char interface[IFNAMSIZ];
2327
2328 if (pipe2(pipefd, O_CLOEXEC))
2329 return log_error_errno(NULL, errno, "Failed to create pipe");
2330
2331 pid = fork();
2332 if (pid < 0) {
2333 close(pipefd[0]);
2334 close(pipefd[1]);
2335 return log_error_errno(NULL, errno, "Failed to fork task to get interfaces information");
2336 }
2337
2338 if (pid == 0) {
2339 call_cleaner(netns_freeifaddrs) struct netns_ifaddrs *ifaddrs = NULL;
2340 struct netns_ifaddrs *ifa = NULL;
2341 int ret = 1;
2342 int nbytes;
2343
2344 /* close the read-end of the pipe */
2345 close(pipefd[0]);
2346
2347 if (!enter_net_ns(c)) {
2348 SYSERROR("Failed to enter network namespace");
2349 goto out;
2350 }
2351
2352 /* Grab the list of interfaces */
2353 if (netns_getifaddrs(&ifaddrs, -1, &(bool){false})) {
2354 SYSERROR("Failed to get interfaces list");
2355 goto out;
2356 }
2357
2358 /* Iterate through the interfaces */
2359 for (ifa = ifaddrs; ifa != NULL;
2360 ifa = ifa->ifa_next) {
2361 nbytes = lxc_write_nointr(pipefd[1], ifa->ifa_name, IFNAMSIZ);
2362 if (nbytes < 0)
2363 goto out;
2364
2365 count++;
2366 }
2367
2368 ret = 0;
2369
2370 out:
2371 /* close the write-end of the pipe, thus sending EOF to the reader */
2372 close(pipefd[1]);
2373 _exit(ret);
2374 }
2375
2376 /* close the write-end of the pipe */
2377 close(pipefd[1]);
2378
2379 while (lxc_read_nointr(pipefd[0], &interface, IFNAMSIZ) == IFNAMSIZ) {
2380 interface[IFNAMSIZ - 1] = '\0';
2381
2382 if (array_contains(&interfaces, interface, count))
2383 continue;
2384
2385 if (!add_to_array(&interfaces, interface, count))
2386 ERROR("Failed to add \"%s\" to array", interface);
2387
2388 count++;
2389 }
2390
2391 if (wait_for_pid(pid)) {
2392 for (i = 0; i < count; i++)
2393 free(interfaces[i]);
2394
2395 free(interfaces);
2396 interfaces = NULL;
2397 }
2398
2399 /* close the read-end of the pipe */
2400 close(pipefd[0]);
2401
2402 /* Append NULL to the array */
2403 if (interfaces)
2404 interfaces = (char **)lxc_append_null_to_array((void **)interfaces, count);
2405
2406 return interfaces;
2407 }
2408
2409 WRAP_API(char **, lxcapi_get_interfaces)
2410
2411 static char **do_lxcapi_get_ips(struct lxc_container *c, const char *interface,
2412 const char *family, int scope)
2413 {
2414 int i, ret;
2415 pid_t pid;
2416 int pipefd[2];
2417 char address[INET6_ADDRSTRLEN];
2418 int count = 0;
2419 char **addresses = NULL;
2420
2421 ret = pipe2(pipefd, O_CLOEXEC);
2422 if (ret < 0)
2423 return log_error_errno(NULL, errno, "Failed to create pipe");
2424
2425 pid = fork();
2426 if (pid < 0) {
2427 SYSERROR("Failed to create new process");
2428 close(pipefd[0]);
2429 close(pipefd[1]);
2430 return NULL;
2431 }
2432
2433 if (pid == 0) {
2434 call_cleaner(netns_freeifaddrs) struct netns_ifaddrs *ifaddrs = NULL;
2435 struct netns_ifaddrs *ifa = NULL;
2436 ssize_t nbytes;
2437 char addressOutputBuffer[INET6_ADDRSTRLEN];
2438 char *address_ptr = NULL;
2439 void *address_ptr_tmp = NULL;
2440
2441 /* close the read-end of the pipe */
2442 close(pipefd[0]);
2443
2444 if (!enter_net_ns(c)) {
2445 SYSERROR("Failed to attach to network namespace");
2446 goto out;
2447 }
2448
2449 /* Grab the list of interfaces */
2450 if (netns_getifaddrs(&ifaddrs, -1, &(bool){false})) {
2451 SYSERROR("Failed to get interfaces list");
2452 goto out;
2453 }
2454
2455 /* Iterate through the interfaces */
2456 for (ifa = ifaddrs; ifa; ifa = ifa->ifa_next) {
2457 if (ifa->ifa_addr == NULL)
2458 continue;
2459
2460 #pragma GCC diagnostic push
2461 #pragma GCC diagnostic ignored "-Wcast-align"
2462
2463 if (ifa->ifa_addr->sa_family == AF_INET) {
2464 if (family && !strequal(family, "inet"))
2465 continue;
2466
2467 address_ptr_tmp = &((struct sockaddr_in *)ifa->ifa_addr)->sin_addr;
2468 } else {
2469 if (family && !strequal(family, "inet6"))
2470 continue;
2471
2472 if (((struct sockaddr_in6 *)ifa->ifa_addr)->sin6_scope_id != (uint32_t)scope)
2473 continue;
2474
2475 address_ptr_tmp = &((struct sockaddr_in6 *)ifa->ifa_addr)->sin6_addr;
2476 }
2477
2478 #pragma GCC diagnostic pop
2479
2480 if (interface && !strequal(interface, ifa->ifa_name))
2481 continue;
2482 else if (!interface && strequal("lo", ifa->ifa_name))
2483 continue;
2484
2485 address_ptr = (char *)inet_ntop(ifa->ifa_addr->sa_family, address_ptr_tmp,
2486 addressOutputBuffer,
2487 sizeof(addressOutputBuffer));
2488 if (!address_ptr)
2489 continue;
2490
2491 nbytes = lxc_write_nointr(pipefd[1], address_ptr, INET6_ADDRSTRLEN);
2492 if (nbytes != INET6_ADDRSTRLEN) {
2493 SYSERROR("Failed to send ipv6 address \"%s\"", address_ptr);
2494 goto out;
2495 }
2496
2497 count++;
2498 }
2499
2500 ret = 0;
2501
2502 out:
2503 /* close the write-end of the pipe, thus sending EOF to the reader */
2504 close(pipefd[1]);
2505 _exit(ret);
2506 }
2507
2508 /* close the write-end of the pipe */
2509 close(pipefd[1]);
2510
2511 while (lxc_read_nointr(pipefd[0], &address, INET6_ADDRSTRLEN) == INET6_ADDRSTRLEN) {
2512 address[INET6_ADDRSTRLEN - 1] = '\0';
2513
2514 if (!add_to_array(&addresses, address, count))
2515 ERROR("PARENT: add_to_array failed");
2516
2517 count++;
2518 }
2519
2520 if (wait_for_pid(pid)) {
2521 for (i = 0; i < count; i++)
2522 free(addresses[i]);
2523
2524 free(addresses);
2525 addresses = NULL;
2526 }
2527
2528 /* close the read-end of the pipe */
2529 close(pipefd[0]);
2530
2531 /* Append NULL to the array */
2532 if (addresses)
2533 addresses = (char **)lxc_append_null_to_array((void **)addresses, count);
2534
2535 return addresses;
2536 }
2537
2538 WRAP_API_3(char **, lxcapi_get_ips, const char *, const char *, int)
2539
2540 static int do_lxcapi_get_config_item(struct lxc_container *c, const char *key, char *retv, int inlen)
2541 {
2542 int ret = -1;
2543 struct lxc_config_t *config;
2544
2545 if (!c || !c->lxc_conf)
2546 return -1;
2547
2548 if (container_mem_lock(c))
2549 return -1;
2550
2551 config = lxc_get_config(key);
2552
2553 ret = config->get(key, retv, inlen, c->lxc_conf, NULL);
2554
2555 container_mem_unlock(c);
2556 return ret;
2557 }
2558
2559 WRAP_API_3(int, lxcapi_get_config_item, const char *, char *, int)
2560
2561 static char* do_lxcapi_get_running_config_item(struct lxc_container *c, const char *key)
2562 {
2563 char *ret;
2564
2565 if (!c || !c->lxc_conf)
2566 return NULL;
2567
2568 if (container_mem_lock(c))
2569 return NULL;
2570
2571 ret = lxc_cmd_get_config_item(c->name, key, do_lxcapi_get_config_path(c));
2572 container_mem_unlock(c);
2573 return ret;
2574 }
2575
2576 WRAP_API_1(char *, lxcapi_get_running_config_item, const char *)
2577
2578 static int do_lxcapi_get_keys(struct lxc_container *c, const char *key, char *retv, int inlen)
2579 {
2580 int ret = -1;
2581
2582 /* List all config items. */
2583 if (!key)
2584 return lxc_list_config_items(retv, inlen);
2585
2586 if (!c || !c->lxc_conf)
2587 return -1;
2588
2589 if (container_mem_lock(c))
2590 return -1;
2591
2592 /* Support 'lxc.net.<idx>', i.e. 'lxc.net.0'
2593 * This is an intelligent result to show which keys are valid given the
2594 * type of nic it is.
2595 */
2596 if (strnequal(key, "lxc.net.", 8))
2597 ret = lxc_list_net(c->lxc_conf, key, retv, inlen);
2598 else
2599 ret = lxc_list_subkeys(c->lxc_conf, key, retv, inlen);
2600
2601 container_mem_unlock(c);
2602 return ret;
2603 }
2604
2605 WRAP_API_3(int, lxcapi_get_keys, const char *, char *, int)
2606
2607 static bool do_lxcapi_save_config(struct lxc_container *c, const char *alt_file)
2608 {
2609 int fd, lret;
2610 bool ret = false, need_disklock = false;
2611
2612 if (!alt_file)
2613 alt_file = c->configfile;
2614
2615 if (!alt_file)
2616 return false;
2617
2618 /* If we haven't yet loaded a config, load the stock config. */
2619 if (!c->lxc_conf) {
2620 if (!do_lxcapi_load_config(c, lxc_global_config_value("lxc.default_config"))) {
2621 ERROR("Error loading default configuration file %s "
2622 "while saving %s",
2623 lxc_global_config_value("lxc.default_config"),
2624 c->name);
2625 return false;
2626 }
2627 }
2628
2629 if (!create_container_dir(c))
2630 return false;
2631
2632 /* If we're writing to the container's config file, take the disk lock.
2633 * Otherwise just take the memlock to protect the struct lxc_container
2634 * while we're traversing it.
2635 */
2636 if (strequal(c->configfile, alt_file))
2637 need_disklock = true;
2638
2639 if (need_disklock)
2640 lret = container_disk_lock(c);
2641 else
2642 lret = container_mem_lock(c);
2643 if (lret)
2644 return false;
2645
2646 fd = open(alt_file, O_WRONLY | O_CREAT | O_TRUNC | O_CLOEXEC,
2647 S_IRUSR | S_IWUSR | S_IRGRP | S_IWGRP);
2648 if (fd < 0)
2649 goto on_error;
2650
2651 lret = write_config(fd, c->lxc_conf);
2652 close(fd);
2653 if (lret < 0)
2654 goto on_error;
2655
2656 ret = true;
2657
2658 on_error:
2659 if (need_disklock)
2660 container_disk_unlock(c);
2661 else
2662 container_mem_unlock(c);
2663
2664 return ret;
2665 }
2666
2667 WRAP_API_1(bool, lxcapi_save_config, const char *)
2668
2669
2670 static bool mod_rdep(struct lxc_container *c0, struct lxc_container *c, bool inc)
2671 {
2672 FILE *f1;
2673 struct stat fbuf;
2674 void *buf = NULL;
2675 char *del = NULL;
2676 char path[PATH_MAX];
2677 char newpath[PATH_MAX];
2678 int fd, ret, n = 0, v = 0;
2679 bool bret = false;
2680 size_t len = 0, bytes = 0;
2681
2682 if (container_disk_lock(c0))
2683 return false;
2684
2685 ret = strnprintf(path, sizeof(path), "%s/%s/lxc_snapshots", c0->config_path, c0->name);
2686 if (ret < 0)
2687 goto out;
2688
2689 ret = strnprintf(newpath, sizeof(newpath), "%s\n%s\n", c->config_path, c->name);
2690 if (ret < 0)
2691 goto out;
2692
2693 /* If we find an lxc-snapshot file using the old format only listing the
2694 * number of snapshots we will keep using it. */
2695 f1 = fopen(path, "re");
2696 if (f1) {
2697 n = fscanf(f1, "%d", &v);
2698 fclose(f1);
2699 if (n == 1 && v == 0) {
2700 ret = remove(path);
2701 if (ret < 0)
2702 SYSERROR("Failed to remove \"%s\"", path);
2703
2704 n = 0;
2705 }
2706 }
2707
2708 if (n == 1) {
2709 v += inc ? 1 : -1;
2710 f1 = fopen(path, "we");
2711 if (!f1)
2712 goto out;
2713
2714 if (fprintf(f1, "%d\n", v) < 0) {
2715 ERROR("Error writing new snapshots value");
2716 fclose(f1);
2717 goto out;
2718 }
2719
2720 ret = fclose(f1);
2721 if (ret != 0) {
2722 SYSERROR("Error writing to or closing snapshots file");
2723 goto out;
2724 }
2725 } else {
2726 /* Here we know that we have or can use an lxc-snapshot file
2727 * using the new format. */
2728 if (inc) {
2729 f1 = fopen(path, "ae");
2730 if (!f1)
2731 goto out;
2732
2733 if (fprintf(f1, "%s", newpath) < 0) {
2734 ERROR("Error writing new snapshots entry");
2735 ret = fclose(f1);
2736 if (ret != 0)
2737 SYSERROR("Error writing to or closing snapshots file");
2738 goto out;
2739 }
2740
2741 ret = fclose(f1);
2742 if (ret != 0) {
2743 SYSERROR("Error writing to or closing snapshots file");
2744 goto out;
2745 }
2746 } else if (!inc) {
2747 if ((fd = open(path, O_RDWR | O_CLOEXEC)) < 0)
2748 goto out;
2749
2750 if (fstat(fd, &fbuf) < 0) {
2751 close(fd);
2752 goto out;
2753 }
2754
2755 if (fbuf.st_size != 0) {
2756 buf = lxc_strmmap(NULL, fbuf.st_size, PROT_READ | PROT_WRITE, MAP_SHARED, fd, 0);
2757 if (buf == MAP_FAILED) {
2758 SYSERROR("Failed to create mapping %s", path);
2759 close(fd);
2760 goto out;
2761 }
2762
2763 len = strlen(newpath);
2764 while ((del = strstr((char *)buf, newpath))) {
2765 memmove(del, del + len, strlen(del) - len + 1);
2766 bytes += len;
2767 }
2768
2769 lxc_strmunmap(buf, fbuf.st_size);
2770 if (ftruncate(fd, fbuf.st_size - bytes) < 0) {
2771 SYSERROR("Failed to truncate file %s", path);
2772 close(fd);
2773 goto out;
2774 }
2775 }
2776
2777 close(fd);
2778 }
2779
2780 /* If the lxc-snapshot file is empty, remove it. */
2781 if (stat(path, &fbuf) < 0)
2782 goto out;
2783
2784 if (!fbuf.st_size) {
2785 ret = remove(path);
2786 if (ret < 0)
2787 SYSERROR("Failed to remove \"%s\"", path);
2788 }
2789 }
2790
2791 bret = true;
2792
2793 out:
2794 container_disk_unlock(c0);
2795 return bret;
2796 }
2797
2798 void mod_all_rdeps(struct lxc_container *c, bool inc)
2799 {
2800 __do_free char *lxcpath = NULL, *lxcname = NULL;
2801 __do_fclose FILE *f = NULL;
2802 size_t pathlen = 0, namelen = 0;
2803 struct lxc_container *p;
2804 char path[PATH_MAX];
2805 int ret;
2806
2807 ret = strnprintf(path, sizeof(path), "%s/%s/lxc_rdepends",
2808 c->config_path, c->name);
2809 if (ret < 0) {
2810 ERROR("Path name too long");
2811 return;
2812 }
2813
2814 f = fopen(path, "re");
2815 if (!f)
2816 return;
2817
2818 while (getline(&lxcpath, &pathlen, f) != -1) {
2819 if (getline(&lxcname, &namelen, f) == -1) {
2820 ERROR("badly formatted file %s", path);
2821 return;
2822 }
2823
2824 remove_trailing_newlines(lxcpath);
2825 remove_trailing_newlines(lxcname);
2826
2827 if ((p = lxc_container_new(lxcname, lxcpath)) == NULL) {
2828 ERROR("Unable to find dependent container %s:%s",
2829 lxcpath, lxcname);
2830 continue;
2831 }
2832
2833 if (!mod_rdep(p, c, inc))
2834 ERROR("Failed to update snapshots file for %s:%s",
2835 lxcpath, lxcname);
2836
2837 lxc_container_put(p);
2838 }
2839 }
2840
2841 static bool has_fs_snapshots(struct lxc_container *c)
2842 {
2843 __do_fclose FILE *f = NULL;
2844 char path[PATH_MAX];
2845 int ret, v;
2846 struct stat fbuf;
2847
2848 ret = strnprintf(path, sizeof(path), "%s/%s/lxc_snapshots", c->config_path,
2849 c->name);
2850 if (ret < 0)
2851 return false;
2852
2853 /* If the file doesn't exist there are no snapshots. */
2854 if (stat(path, &fbuf) < 0)
2855 return false;
2856
2857 v = fbuf.st_size;
2858 if (v != 0) {
2859 f = fopen(path, "re");
2860 if (!f)
2861 return false;
2862
2863 ret = fscanf(f, "%d", &v);
2864 if (ret != 1)
2865 INFO("Container uses new lxc-snapshots format %s", path);
2866 }
2867
2868 return v != 0;
2869 }
2870
2871 static bool has_snapshots(struct lxc_container *c)
2872 {
2873 __do_closedir DIR *dir = NULL;
2874 char path[PATH_MAX];
2875 struct dirent *direntp;
2876 int count = 0;
2877
2878 if (!get_snappath_dir(c, path))
2879 return false;
2880
2881 dir = opendir(path);
2882 if (!dir)
2883 return false;
2884
2885 while ((direntp = readdir(dir))) {
2886 if (strequal(direntp->d_name, "."))
2887 continue;
2888
2889 if (strequal(direntp->d_name, ".."))
2890 continue;
2891 count++;
2892 break;
2893 }
2894
2895 return count > 0;
2896 }
2897
2898 static bool do_destroy_container(struct lxc_conf *conf) {
2899 int ret;
2900
2901 if (am_guest_unpriv()) {
2902 ret = userns_exec_full(conf, storage_destroy_wrapper, conf,
2903 "storage_destroy_wrapper");
2904 if (ret < 0)
2905 return false;
2906
2907 return true;
2908 }
2909
2910 return storage_destroy(conf);
2911 }
2912
2913 static int lxc_rmdir_onedev_wrapper(void *data)
2914 {
2915 char *arg = (char *) data;
2916 return lxc_rmdir_onedev(arg, "snaps");
2917 }
2918
2919 static int lxc_unlink_exec_wrapper(void *data)
2920 {
2921 char *arg = data;
2922 return unlink(arg);
2923 }
2924
2925 static bool container_destroy(struct lxc_container *c,
2926 struct lxc_storage *storage)
2927 {
2928 const char *p1;
2929 size_t len;
2930 struct lxc_conf *conf;
2931 char *path = NULL;
2932 bool bret = false;
2933 int ret = 0;
2934
2935 if (!c || !do_lxcapi_is_defined(c))
2936 return false;
2937
2938 conf = c->lxc_conf;
2939 if (container_disk_lock(c))
2940 return false;
2941
2942 if (!is_stopped(c)) {
2943 /* We should queue some sort of error - in c->error_string? */
2944 ERROR("container %s is not stopped", c->name);
2945 goto out;
2946 }
2947
2948 if (conf && !list_empty(&conf->hooks[LXCHOOK_DESTROY])) {
2949 /* Start of environment variable setup for hooks */
2950 if (setenv("LXC_NAME", c->name, 1))
2951 SYSERROR("Failed to set environment variable for container name");
2952
2953 if (conf->rcfile && setenv("LXC_CONFIG_FILE", conf->rcfile, 1))
2954 SYSERROR("Failed to set environment variable for config path");
2955
2956 if (conf->rootfs.mount && setenv("LXC_ROOTFS_MOUNT", conf->rootfs.mount, 1))
2957 SYSERROR("Failed to set environment variable for rootfs mount");
2958
2959 if (conf->rootfs.path && setenv("LXC_ROOTFS_PATH", conf->rootfs.path, 1))
2960 SYSERROR("Failed to set environment variable for rootfs mount");
2961
2962 if (conf->console.path && setenv("LXC_CONSOLE", conf->console.path, 1))
2963 SYSERROR("Failed to set environment variable for console path");
2964
2965 if (conf->console.log_path && setenv("LXC_CONSOLE_LOGPATH", conf->console.log_path, 1))
2966 SYSERROR("Failed to set environment variable for console log");
2967 /* End of environment variable setup for hooks */
2968
2969 if (run_lxc_hooks(c->name, "destroy", conf, NULL)) {
2970 ERROR("Failed to execute clone hook for \"%s\"", c->name);
2971 goto out;
2972 }
2973 }
2974
2975 if (current_config && conf == current_config) {
2976 current_config = NULL;
2977
2978 if (conf->logfd != -1) {
2979 close(conf->logfd);
2980 conf->logfd = -1;
2981 }
2982 }
2983
2984 /* LXC is not managing the storage of the container. */
2985 if (conf && !conf->rootfs.managed)
2986 goto on_success;
2987
2988 if (conf && conf->rootfs.path && conf->rootfs.mount) {
2989 if (!do_destroy_container(conf)) {
2990 ERROR("Error destroying rootfs for %s", c->name);
2991 goto out;
2992 }
2993 INFO("Destroyed rootfs for %s", c->name);
2994 }
2995
2996 mod_all_rdeps(c, false);
2997
2998 p1 = do_lxcapi_get_config_path(c);
2999 /* strlen(p1)
3000 * +
3001 * /
3002 * +
3003 * strlen(c->name)
3004 * +
3005 * /
3006 * +
3007 * strlen("config") = 6
3008 * +
3009 * \0
3010 */
3011 len = strlen(p1) + 1 + strlen(c->name) + 1 + strlen(LXC_CONFIG_FNAME) + 1;
3012 path = malloc(len);
3013 if (!path) {
3014 ERROR("Failed to allocate memory");
3015 goto out;
3016 }
3017
3018 /* For an overlay container the rootfs is considered immutable and
3019 * cannot be removed when restoring from a snapshot.
3020 */
3021 if (storage && (strequal(storage->type, "overlay") ||
3022 strequal(storage->type, "overlayfs")) &&
3023 (storage->flags & LXC_STORAGE_INTERNAL_OVERLAY_RESTORE)) {
3024 ret = strnprintf(path, len, "%s/%s/%s", p1, c->name, LXC_CONFIG_FNAME);
3025 if (ret < 0)
3026 goto out;
3027
3028 if (am_guest_unpriv())
3029 ret = userns_exec_1(conf, lxc_unlink_exec_wrapper, path,
3030 "lxc_unlink_exec_wrapper");
3031 else
3032 ret = unlink(path);
3033 if (ret < 0) {
3034 SYSERROR("Failed to destroy config file \"%s\" for \"%s\"",
3035 path, c->name);
3036 goto out;
3037 }
3038 INFO("Destroyed config file \"%s\" for \"%s\"", path, c->name);
3039
3040 bret = true;
3041 goto out;
3042 }
3043
3044 ret = strnprintf(path, len, "%s/%s", p1, c->name);
3045 if (ret < 0)
3046 goto out;
3047
3048 if (am_guest_unpriv())
3049 ret = userns_exec_full(conf, lxc_rmdir_onedev_wrapper, path,
3050 "lxc_rmdir_onedev_wrapper");
3051 else
3052 ret = lxc_rmdir_onedev(path, "snaps");
3053 if (ret < 0) {
3054 ERROR("Failed to destroy directory \"%s\" for \"%s\"", path,
3055 c->name);
3056 goto out;
3057 }
3058 INFO("Destroyed directory \"%s\" for \"%s\"", path, c->name);
3059
3060 on_success:
3061 bret = true;
3062
3063 out:
3064 if (path)
3065 free(path);
3066
3067 container_disk_unlock(c);
3068 return bret;
3069 }
3070
3071 static bool do_lxcapi_destroy(struct lxc_container *c)
3072 {
3073 if (!c || !lxcapi_is_defined(c))
3074 return false;
3075
3076 if (c->lxc_conf && c->lxc_conf->rootfs.managed) {
3077 if (has_snapshots(c)) {
3078 ERROR("Container %s has snapshots; not removing", c->name);
3079 return false;
3080 }
3081
3082 if (has_fs_snapshots(c)) {
3083 ERROR("container %s has snapshots on its rootfs", c->name);
3084 return false;
3085 }
3086 }
3087
3088 return container_destroy(c, NULL);
3089 }
3090
3091 WRAP_API(bool, lxcapi_destroy)
3092
3093 static bool do_lxcapi_destroy_with_snapshots(struct lxc_container *c)
3094 {
3095 if (!c || !lxcapi_is_defined(c))
3096 return false;
3097
3098 if (!lxcapi_snapshot_destroy_all(c)) {
3099 ERROR("Error deleting all snapshots");
3100 return false;
3101 }
3102
3103 return lxcapi_destroy(c);
3104 }
3105
3106 WRAP_API(bool, lxcapi_destroy_with_snapshots)
3107
3108 int lxc_set_config_item_locked(struct lxc_conf *conf, const char *key,
3109 const char *v)
3110 {
3111 int ret;
3112 struct lxc_config_t *config;
3113 bool bret = true;
3114
3115 config = lxc_get_config(key);
3116
3117 ret = config->set(key, v, conf, NULL);
3118 if (ret < 0)
3119 return -EINVAL;
3120
3121 if (lxc_config_value_empty(v))
3122 do_clear_unexp_config_line(conf, key);
3123 else
3124 bret = do_append_unexp_config_line(conf, key, v);
3125 if (!bret)
3126 return -ENOMEM;
3127
3128 return 0;
3129 }
3130
3131 static bool do_set_config_item_locked(struct lxc_container *c, const char *key,
3132 const char *v)
3133 {
3134 int ret;
3135
3136 if (!c->lxc_conf)
3137 c->lxc_conf = lxc_conf_init();
3138
3139 if (!c->lxc_conf)
3140 return false;
3141
3142 ret = lxc_set_config_item_locked(c->lxc_conf, key, v);
3143 if (ret < 0)
3144 return false;
3145
3146 return true;
3147 }
3148
3149 static bool do_lxcapi_set_config_item(struct lxc_container *c, const char *key, const char *v)
3150 {
3151 bool b = false;
3152
3153 if (!c)
3154 return false;
3155
3156 if (container_mem_lock(c))
3157 return false;
3158
3159 b = do_set_config_item_locked(c, key, v);
3160
3161 container_mem_unlock(c);
3162 return b;
3163 }
3164
3165 WRAP_API_2(bool, lxcapi_set_config_item, const char *, const char *)
3166
3167 static char *lxcapi_config_file_name(struct lxc_container *c)
3168 {
3169 if (!c || !c->configfile)
3170 return NULL;
3171
3172 return strdup(c->configfile);
3173 }
3174
3175 static const char *lxcapi_get_config_path(struct lxc_container *c)
3176 {
3177 if (!c || !c->config_path)
3178 return NULL;
3179
3180 return (const char *)(c->config_path);
3181 }
3182
3183 /*
3184 * not for export
3185 * Just recalculate the c->configfile based on the
3186 * c->config_path, which must be set.
3187 * The lxc_container must be locked or not yet public.
3188 */
3189 static bool set_config_filename(struct lxc_container *c)
3190 {
3191 char *newpath;
3192 int len, ret;
3193
3194 if (!c->config_path)
3195 return false;
3196
3197 /* $lxc_path + "/" + c->name + "/" + "config" + '\0' */
3198 len = strlen(c->config_path) + 1 + strlen(c->name) + 1 + strlen(LXC_CONFIG_FNAME) + 1;
3199 newpath = malloc(len);
3200 if (!newpath)
3201 return false;
3202
3203 ret = strnprintf(newpath, len, "%s/%s/%s", c->config_path, c->name, LXC_CONFIG_FNAME);
3204 if (ret < 0) {
3205 fprintf(stderr, "Error printing out config file name\n");
3206 free(newpath);
3207 return false;
3208 }
3209
3210 free(c->configfile);
3211 c->configfile = newpath;
3212
3213 return true;
3214 }
3215
3216 static bool do_lxcapi_set_config_path(struct lxc_container *c, const char *path)
3217 {
3218 char *p;
3219 bool b = false;
3220 char *oldpath = NULL;
3221
3222 if (!c)
3223 return b;
3224
3225 if (container_mem_lock(c))
3226 return b;
3227
3228 p = strdup(path);
3229 if (!p) {
3230 ERROR("Out of memory setting new lxc path");
3231 goto err;
3232 }
3233
3234 b = true;
3235 if (c->config_path)
3236 oldpath = c->config_path;
3237 c->config_path = p;
3238
3239 /* Since we've changed the config path, we have to change the
3240 * config file name too */
3241 if (!set_config_filename(c)) {
3242 ERROR("Out of memory setting new config filename");
3243 b = false;
3244 free(c->config_path);
3245 c->config_path = oldpath;
3246 oldpath = NULL;
3247 }
3248
3249 err:
3250 free(oldpath);
3251 container_mem_unlock(c);
3252 return b;
3253 }
3254
3255 WRAP_API_1(bool, lxcapi_set_config_path, const char *)
3256
3257 static bool do_lxcapi_set_cgroup_item(struct lxc_container *c, const char *subsys, const char *value)
3258 {
3259 call_cleaner(cgroup_exit) struct cgroup_ops *cgroup_ops = NULL;
3260 int ret;
3261
3262 if (!c)
3263 return false;
3264
3265 if (is_stopped(c))
3266 return false;
3267
3268 ret = cgroup_set(c->name, c->config_path, subsys, value);
3269 if (ret < 0 && ERRNO_IS_NOT_SUPPORTED(ret)) {
3270 cgroup_ops = cgroup_init(c->lxc_conf);
3271 if (!cgroup_ops)
3272 return false;
3273
3274 ret = cgroup_ops->set(cgroup_ops, subsys, value, c->name, c->config_path);
3275 }
3276
3277 return ret == 0;
3278 }
3279
3280 WRAP_API_2(bool, lxcapi_set_cgroup_item, const char *, const char *)
3281
3282 static int do_lxcapi_get_cgroup_item(struct lxc_container *c, const char *subsys, char *retv, int inlen)
3283 {
3284 call_cleaner(cgroup_exit) struct cgroup_ops *cgroup_ops = NULL;
3285 int ret;
3286
3287 if (!c)
3288 return -1;
3289
3290 if (is_stopped(c))
3291 return -1;
3292
3293 ret = cgroup_get(c->name, c->config_path, subsys, retv, inlen);
3294 if (ret < 0 && ERRNO_IS_NOT_SUPPORTED(ret)) {
3295 cgroup_ops = cgroup_init(c->lxc_conf);
3296 if (!cgroup_ops)
3297 return -1;
3298
3299 return cgroup_ops->get(cgroup_ops, subsys, retv, inlen, c->name, c->config_path);
3300 }
3301
3302 return ret;
3303 }
3304
3305 WRAP_API_3(int, lxcapi_get_cgroup_item, const char *, char *, int)
3306
3307 const char *lxc_get_global_config_item(const char *key)
3308 {
3309 return lxc_global_config_value(key);
3310 }
3311
3312 const char *lxc_get_version(void)
3313 {
3314 return LXC_VERSION;
3315 }
3316
3317 static int copy_file(const char *old, const char *new)
3318 {
3319 int in, out;
3320 ssize_t len, ret;
3321 char buf[8096];
3322 struct stat sbuf;
3323
3324 if (file_exists(new)) {
3325 ERROR("copy destination %s exists", new);
3326 return -1;
3327 }
3328
3329 ret = stat(old, &sbuf);
3330 if (ret < 0) {
3331 INFO("Error stat'ing %s", old);
3332 return -1;
3333 }
3334
3335 in = open(old, O_RDONLY);
3336 if (in < 0) {
3337 SYSERROR("Error opening original file %s", old);
3338 return -1;
3339 }
3340
3341 out = open(new, O_CREAT | O_EXCL | O_WRONLY, 0644);
3342 if (out < 0) {
3343 SYSERROR("Error opening new file %s", new);
3344 close(in);
3345 return -1;
3346 }
3347
3348 for (;;) {
3349 len = lxc_read_nointr(in, buf, 8096);
3350 if (len < 0) {
3351 SYSERROR("Error reading old file %s", old);
3352 goto err;
3353 }
3354
3355 if (len == 0)
3356 break;
3357
3358 ret = lxc_write_nointr(out, buf, len);
3359 if (ret < len) { /* should we retry? */
3360 SYSERROR("Error: write to new file %s was interrupted", new);
3361 goto err;
3362 }
3363 }
3364
3365 close(in);
3366 close(out);
3367
3368 /* We set mode, but not owner/group. */
3369 ret = chmod(new, sbuf.st_mode);
3370 if (ret) {
3371 SYSERROR("Error setting mode on %s", new);
3372 return -1;
3373 }
3374
3375 return 0;
3376
3377 err:
3378 close(in);
3379 close(out);
3380 return -1;
3381 }
3382
3383 static int copyhooks(struct lxc_container *oldc, struct lxc_container *c)
3384 {
3385 __do_free char *cpath = NULL;
3386 int i, len, ret;
3387 struct string_entry *entry;
3388
3389 len = strlen(oldc->config_path) + strlen(oldc->name) + 3;
3390 cpath = malloc(len);
3391 if (!cpath)
3392 return ret_errno(ENOMEM);
3393
3394 ret = strnprintf(cpath, len, "%s/%s/", oldc->config_path, oldc->name);
3395 if (ret < 0)
3396 return -1;
3397
3398 for (i = 0; i < NUM_LXC_HOOKS; i++) {
3399 list_for_each_entry(entry, &c->lxc_conf->hooks[i], head) {
3400 __do_free char *hookname = NULL;
3401 char *fname, *new_hook;
3402 char tmppath[PATH_MAX];
3403
3404 fname = strrchr(entry->val, '/');
3405 if (!fname)
3406 return 0;
3407
3408 /* If this hook is public - ignore. */
3409 if (!strnequal(entry->val, cpath, len - 1))
3410 continue;
3411
3412 /* copy the script, and change the entry in confile */
3413 ret = strnprintf(tmppath, sizeof(tmppath), "%s/%s/%s",
3414 c->config_path, c->name, fname+1);
3415 if (ret < 0)
3416 return -1;
3417
3418 ret = copy_file(entry->val, tmppath);
3419 if (ret < 0)
3420 return -1;
3421
3422 new_hook = strdup(tmppath);
3423 if (!new_hook)
3424 return syserror("out of memory copying hook path");
3425
3426 hookname = move_ptr(entry->val);
3427 entry->val = move_ptr(new_hook);
3428 }
3429 }
3430
3431 if (!clone_update_unexp_hooks(c->lxc_conf, oldc->config_path,
3432 c->config_path, oldc->name, c->name)) {
3433 return syserror_ret(-1, "Error saving new hooks in clone");
3434 }
3435
3436 do_lxcapi_save_config(c, NULL);
3437 return 0;
3438 }
3439
3440 static int copy_fstab(struct lxc_container *oldc, struct lxc_container *c)
3441 {
3442 char newpath[PATH_MAX];
3443 char *oldpath = oldc->lxc_conf->fstab;
3444 int ret;
3445
3446 if (!oldpath)
3447 return 0;
3448
3449 clear_unexp_config_line(c->lxc_conf, "lxc.mount.fstab", false);
3450
3451 char *p = strrchr(oldpath, '/');
3452 if (!p)
3453 return -1;
3454
3455 ret = strnprintf(newpath, sizeof(newpath), "%s/%s%s",
3456 c->config_path, c->name, p);
3457 if (ret < 0) {
3458 ERROR("error printing new path for %s", oldpath);
3459 return -1;
3460 }
3461
3462 if (file_exists(newpath)) {
3463 ERROR("error: fstab file %s exists", newpath);
3464 return -1;
3465 }
3466
3467 if (copy_file(oldpath, newpath) < 0) {
3468 ERROR("error: copying %s to %s", oldpath, newpath);
3469 return -1;
3470 }
3471
3472 free(c->lxc_conf->fstab);
3473
3474 c->lxc_conf->fstab = strdup(newpath);
3475 if (!c->lxc_conf->fstab) {
3476 ERROR("error: allocating pathname");
3477 return -1;
3478 }
3479
3480 if (!do_append_unexp_config_line(c->lxc_conf, "lxc.mount.fstab", newpath)) {
3481 ERROR("error saving new lxctab");
3482 return -1;
3483 }
3484
3485 return 0;
3486 }
3487
3488 static void copy_rdepends(struct lxc_container *c, struct lxc_container *c0)
3489 {
3490 char path0[PATH_MAX], path1[PATH_MAX];
3491 int ret;
3492
3493 ret = strnprintf(path0, sizeof(path0), "%s/%s/lxc_rdepends", c0->config_path,
3494 c0->name);
3495 if (ret < 0) {
3496 WARN("Error copying reverse dependencies");
3497 return;
3498 }
3499
3500 ret = strnprintf(path1, sizeof(path1), "%s/%s/lxc_rdepends", c->config_path,
3501 c->name);
3502 if (ret < 0) {
3503 WARN("Error copying reverse dependencies");
3504 return;
3505 }
3506
3507 if (copy_file(path0, path1) < 0) {
3508 INFO("Error copying reverse dependencies");
3509 return;
3510 }
3511 }
3512
3513 static bool add_rdepends(struct lxc_container *c, struct lxc_container *c0)
3514 {
3515 __do_fclose FILE *f = NULL;
3516 int ret;
3517 char path[PATH_MAX];
3518
3519 ret = strnprintf(path, sizeof(path), "%s/%s/lxc_rdepends", c->config_path, c->name);
3520 if (ret < 0)
3521 return false;
3522
3523 f = fopen(path, "ae");
3524 if (!f)
3525 return false;
3526
3527 /* If anything goes wrong, just return an error. */
3528 return fprintf(f, "%s\n%s\n", c0->config_path, c0->name) > 0;
3529 }
3530
3531 /*
3532 * If the fs natively supports snapshot clones with no penalty,
3533 * then default to those even if not requested.
3534 * Currently we only do this for btrfs.
3535 */
3536 static bool should_default_to_snapshot(struct lxc_container *c0,
3537 struct lxc_container *c1)
3538 {
3539 __do_free char *p0 = NULL, *p1 = NULL;
3540 int ret;
3541 size_t l0 = strlen(c0->config_path) + strlen(c0->name) + 2;
3542 size_t l1 = strlen(c1->config_path) + strlen(c1->name) + 2;
3543 char *rootfs = c0->lxc_conf->rootfs.path;
3544
3545 p0 = must_realloc(NULL, l0 + 1);
3546 p1 = must_realloc(NULL, l1 + 1);
3547 ret = strnprintf(p0, l0, "%s/%s", c0->config_path, c0->name);
3548 if (ret < 0)
3549 return false;
3550
3551 ret = strnprintf(p1, l1, "%s/%s", c1->config_path, c1->name);
3552 if (ret < 0)
3553 return false;
3554
3555 if (!is_btrfs_fs(p0) || !is_btrfs_fs(p1))
3556 return false;
3557
3558 if (is_btrfs_subvol(rootfs) <= 0)
3559 return false;
3560
3561 return btrfs_same_fs(p0, p1) == 0;
3562 }
3563
3564 static int copy_storage(struct lxc_container *c0, struct lxc_container *c,
3565 const char *newtype, int flags, const char *bdevdata,
3566 uint64_t newsize)
3567 {
3568 struct lxc_storage *bdev;
3569 bool need_rdep;
3570
3571 if (should_default_to_snapshot(c0, c))
3572 flags |= LXC_CLONE_SNAPSHOT;
3573
3574 bdev = storage_copy(c0, c->name, c->config_path, newtype, flags,
3575 bdevdata, newsize, &need_rdep);
3576 if (!bdev) {
3577 ERROR("Error copying storage.");
3578 return -1;
3579 }
3580
3581 /* Set new rootfs. */
3582 free(c->lxc_conf->rootfs.path);
3583 c->lxc_conf->rootfs.path = strdup(bdev->src);
3584 storage_put(bdev);
3585
3586 if (!c->lxc_conf->rootfs.path) {
3587 ERROR("Out of memory while setting storage path.");
3588 return -1;
3589 }
3590
3591 /* Append a new lxc.rootfs.path entry to the unexpanded config. */
3592 clear_unexp_config_line(c->lxc_conf, "lxc.rootfs.path", false);
3593 if (!do_append_unexp_config_line(c->lxc_conf, "lxc.rootfs.path",
3594 c->lxc_conf->rootfs.path)) {
3595 ERROR("Error saving new rootfs to cloned config.");
3596 return -1;
3597 }
3598
3599 if (flags & LXC_CLONE_SNAPSHOT)
3600 copy_rdepends(c, c0);
3601
3602 if (need_rdep) {
3603 if (!add_rdepends(c, c0))
3604 WARN("Error adding reverse dependency from %s to %s",
3605 c->name, c0->name);
3606 }
3607
3608 mod_all_rdeps(c, true);
3609
3610 return 0;
3611 }
3612
3613 struct clone_update_data {
3614 struct lxc_container *c0;
3615 struct lxc_container *c1;
3616 int flags;
3617 char **hookargs;
3618 };
3619
3620 static int clone_update_rootfs(struct clone_update_data *data)
3621 {
3622 struct lxc_container *c0 = data->c0;
3623 struct lxc_container *c = data->c1;
3624 int flags = data->flags;
3625 char **hookargs = data->hookargs;
3626 int ret = -1;
3627 char path[PATH_MAX];
3628 struct lxc_storage *bdev;
3629 FILE *fout;
3630 struct lxc_conf *conf = c->lxc_conf;
3631
3632 /* update hostname in rootfs */
3633 /* we're going to mount, so run in a clean namespace to simplify cleanup */
3634
3635 (void)lxc_drop_groups();
3636
3637 if (setgid(0) < 0) {
3638 ERROR("Failed to setgid to 0");
3639 return -1;
3640 }
3641
3642 if (setuid(0) < 0) {
3643 ERROR("Failed to setuid to 0");
3644 return -1;
3645 }
3646
3647 if (unshare(CLONE_NEWNS) < 0)
3648 return -1;
3649
3650 ret = lxc_storage_prepare(conf);
3651 if (ret)
3652 return -1;
3653 bdev = conf->rootfs.storage;
3654
3655 if (!strequal(bdev->type, "dir")) {
3656 if (unshare(CLONE_NEWNS) < 0) {
3657 ERROR("error unsharing mounts");
3658 lxc_storage_put(conf);
3659 return -1;
3660 }
3661
3662 if (detect_shared_rootfs() && mount(NULL, "/", NULL, MS_SLAVE | MS_REC, NULL))
3663 SYSERROR("Failed to recursively turn root mount tree into dependent mount. Continuing...");
3664
3665 if (bdev->ops->mount(bdev) < 0) {
3666 lxc_storage_put(conf);
3667 return -1;
3668 }
3669 } else { /* TODO come up with a better way */
3670 free(bdev->dest);
3671 bdev->dest = strdup(lxc_storage_get_path(bdev->src, bdev->type));
3672 }
3673
3674 if (!list_empty(&conf->hooks[LXCHOOK_CLONE])) {
3675 /* Start of environment variable setup for hooks */
3676 if (c0->name && setenv("LXC_SRC_NAME", c0->name, 1))
3677 SYSERROR("failed to set environment variable for source container name");
3678
3679 if (setenv("LXC_NAME", c->name, 1))
3680 SYSERROR("failed to set environment variable for container name");
3681
3682 if (conf->rcfile && setenv("LXC_CONFIG_FILE", conf->rcfile, 1))
3683 SYSERROR("failed to set environment variable for config path");
3684
3685 if (bdev->dest && setenv("LXC_ROOTFS_MOUNT", bdev->dest, 1))
3686 SYSERROR("failed to set environment variable for rootfs mount");
3687
3688 if (conf->rootfs.path && setenv("LXC_ROOTFS_PATH", conf->rootfs.path, 1))
3689 SYSERROR("failed to set environment variable for rootfs mount");
3690
3691 if (run_lxc_hooks(c->name, "clone", conf, hookargs)) {
3692 ERROR("Error executing clone hook for %s", c->name);
3693 lxc_storage_put(conf);
3694 return -1;
3695 }
3696 }
3697
3698 if (!(flags & LXC_CLONE_KEEPNAME)) {
3699 ret = strnprintf(path, sizeof(path), "%s/etc/hostname", bdev->dest);
3700 lxc_storage_put(conf);
3701
3702 if (ret < 0)
3703 return -1;
3704
3705 if (!file_exists(path))
3706 return 0;
3707
3708 if (!(fout = fopen(path, "we"))) {
3709 SYSERROR("unable to open %s: ignoring", path);
3710 return 0;
3711 }
3712
3713 if (fprintf(fout, "%s", c->name) < 0) {
3714 fclose(fout);
3715 return -1;
3716 }
3717
3718 if (fclose(fout) < 0)
3719 return -1;
3720 } else {
3721 lxc_storage_put(conf);
3722 }
3723
3724 return 0;
3725 }
3726
3727 static int clone_update_rootfs_wrapper(void *data)
3728 {
3729 struct clone_update_data *arg = (struct clone_update_data *) data;
3730 return clone_update_rootfs(arg);
3731 }
3732
3733 /*
3734 * We want to support:
3735 sudo lxc-clone -o o1 -n n1 -s -L|-fssize fssize -v|--vgname vgname \
3736 -p|--lvprefix lvprefix -t|--fstype fstype -B backingstore
3737
3738 -s [ implies overlay]
3739 -s -B overlay
3740
3741 only rootfs gets converted (copied/snapshotted) on clone.
3742 */
3743
3744 static int create_file_dirname(char *path, struct lxc_conf *conf)
3745 {
3746 char *p = strrchr(path, '/');
3747 int ret = -1;
3748
3749 if (!p)
3750 return -1;
3751
3752 *p = '\0';
3753 ret = do_create_container_dir(path, conf);
3754 *p = '/';
3755
3756 return ret;
3757 }
3758
3759 static struct lxc_container *do_lxcapi_clone(struct lxc_container *c, const char *newname,
3760 const char *lxcpath, int flags,
3761 const char *bdevtype, const char *bdevdata, uint64_t newsize,
3762 char **hookargs)
3763 {
3764 char newpath[PATH_MAX];
3765 int fd, ret;
3766 struct clone_update_data data;
3767 size_t saved_unexp_len;
3768 pid_t pid;
3769 int storage_copied = 0;
3770 char *origroot = NULL, *saved_unexp_conf = NULL;
3771 struct lxc_container *c2 = NULL;
3772
3773 if (!c || !do_lxcapi_is_defined(c))
3774 return NULL;
3775
3776 if (container_mem_lock(c))
3777 return NULL;
3778 if (!is_stopped(c) && !(flags & LXC_CLONE_ALLOW_RUNNING)) {
3779 ERROR("error: Original container (%s) is running. Use --allowrunning if you want to force a snapshot of the running container.", c->name);
3780 goto out;
3781 }
3782
3783 /* Make sure the container doesn't yet exist. */
3784 if (!newname)
3785 newname = c->name;
3786
3787 if (!lxcpath)
3788 lxcpath = do_lxcapi_get_config_path(c);
3789
3790 ret = strnprintf(newpath, sizeof(newpath), "%s/%s/%s", lxcpath, newname, LXC_CONFIG_FNAME);
3791 if (ret < 0) {
3792 SYSERROR("clone: failed making config pathname");
3793 goto out;
3794 }
3795
3796 if (file_exists(newpath)) {
3797 ERROR("error: clone: %s exists", newpath);
3798 goto out;
3799 }
3800
3801 ret = create_file_dirname(newpath, c->lxc_conf);
3802 if (ret < 0 && errno != EEXIST) {
3803 ERROR("Error creating container dir for %s", newpath);
3804 goto out;
3805 }
3806
3807 /* Copy the configuration. Tweak it as needed. */
3808 if (c->lxc_conf->rootfs.path) {
3809 origroot = c->lxc_conf->rootfs.path;
3810 c->lxc_conf->rootfs.path = NULL;
3811 }
3812
3813 fd = open(newpath, O_WRONLY | O_CREAT | O_CLOEXEC,
3814 S_IRUSR | S_IWUSR | S_IRGRP | S_IWGRP);
3815 if (fd < 0) {
3816 SYSERROR("Failed to open \"%s\"", newpath);
3817 goto out;
3818 }
3819
3820 saved_unexp_conf = c->lxc_conf->unexpanded_config;
3821 saved_unexp_len = c->lxc_conf->unexpanded_len;
3822 c->lxc_conf->unexpanded_config = strdup(saved_unexp_conf);
3823 if (!c->lxc_conf->unexpanded_config) {
3824 close(fd);
3825 goto out;
3826 }
3827
3828 clear_unexp_config_line(c->lxc_conf, "lxc.rootfs.path", false);
3829 write_config(fd, c->lxc_conf);
3830 close(fd);
3831
3832 c->lxc_conf->rootfs.path = origroot;
3833
3834 free(c->lxc_conf->unexpanded_config);
3835 c->lxc_conf->unexpanded_config = saved_unexp_conf;
3836 saved_unexp_conf = NULL;
3837 c->lxc_conf->unexpanded_len = saved_unexp_len;
3838
3839 ret = strnprintf(newpath, sizeof(newpath), "%s/%s/%s", lxcpath, newname, LXC_ROOTFS_DNAME);
3840 if (ret < 0) {
3841 SYSERROR("clone: failed making rootfs pathname");
3842 goto out;
3843 }
3844
3845 ret = mkdir(newpath, 0755);
3846 if (ret < 0) {
3847 /* For an overlay container the rootfs is considered immutable
3848 * and will not have been removed when restoring from a
3849 * snapshot.
3850 */
3851 if (errno != ENOENT &&
3852 !(flags & LXC_STORAGE_INTERNAL_OVERLAY_RESTORE)) {
3853 SYSERROR("Failed to create directory \"%s\"", newpath);
3854 goto out;
3855 }
3856 }
3857
3858 if (am_guest_unpriv()) {
3859 if (chown_mapped_root(newpath, c->lxc_conf) < 0) {
3860 ERROR("Error chowning %s to container root", newpath);
3861 goto out;
3862 }
3863 }
3864
3865 c2 = lxc_container_new(newname, lxcpath);
3866 if (!c2) {
3867 ERROR("clone: failed to create new container (%s %s)", newname,
3868 lxcpath);
3869 goto out;
3870 }
3871
3872 /* copy/snapshot rootfs's */
3873 ret = copy_storage(c, c2, bdevtype, flags, bdevdata, newsize);
3874 if (ret < 0)
3875 goto out;
3876
3877 /* update utsname */
3878 if (!(flags & LXC_CLONE_KEEPNAME)) {
3879 clear_unexp_config_line(c2->lxc_conf, "lxc.utsname", false);
3880 clear_unexp_config_line(c2->lxc_conf, "lxc.uts.name", false);
3881
3882 if (!do_set_config_item_locked(c2, "lxc.uts.name", newname)) {
3883 ERROR("Error setting new hostname");
3884 goto out;
3885 }
3886 }
3887
3888 /* copy hooks */
3889 ret = copyhooks(c, c2);
3890 if (ret < 0) {
3891 ERROR("error copying hooks");
3892 goto out;
3893 }
3894
3895 if (copy_fstab(c, c2) < 0) {
3896 ERROR("error copying fstab");
3897 goto out;
3898 }
3899
3900 /* update macaddrs */
3901 if (!(flags & LXC_CLONE_KEEPMACADDR)) {
3902 if (!network_new_hwaddrs(c2->lxc_conf)) {
3903 ERROR("Error updating mac addresses");
3904 goto out;
3905 }
3906 }
3907
3908 /* Update absolute paths for overlay mount directories. */
3909 if (ovl_update_abs_paths(c2->lxc_conf, c->config_path, c->name, lxcpath, newname) < 0)
3910 goto out;
3911
3912 /* We've now successfully created c2's storage, so clear it out if we
3913 * fail after this.
3914 */
3915 storage_copied = 1;
3916
3917 if (!c2->save_config(c2, NULL))
3918 goto out;
3919
3920 if ((pid = fork()) < 0) {
3921 SYSERROR("fork");
3922 goto out;
3923 }
3924
3925 if (pid > 0) {
3926 ret = wait_for_pid(pid);
3927 if (ret)
3928 goto out;
3929
3930 container_mem_unlock(c);
3931 return c2;
3932 }
3933
3934 data.c0 = c;
3935 data.c1 = c2;
3936 data.flags = flags;
3937 data.hookargs = hookargs;
3938
3939 if (am_guest_unpriv())
3940 ret = userns_exec_full(c->lxc_conf, clone_update_rootfs_wrapper,
3941 &data, "clone_update_rootfs_wrapper");
3942 else
3943 ret = clone_update_rootfs(&data);
3944 if (ret < 0)
3945 _exit(EXIT_FAILURE);
3946
3947 container_mem_unlock(c);
3948 _exit(EXIT_SUCCESS);
3949
3950 out:
3951 container_mem_unlock(c);
3952 if (c2) {
3953 if (!storage_copied)
3954 c2->lxc_conf->rootfs.path = NULL;
3955
3956 c2->destroy(c2);
3957 lxc_container_put(c2);
3958 }
3959
3960 return NULL;
3961 }
3962
3963 static struct lxc_container *lxcapi_clone(struct lxc_container *c, const char *newname,
3964 const char *lxcpath, int flags,
3965 const char *bdevtype, const char *bdevdata, uint64_t newsize,
3966 char **hookargs)
3967 {
3968 struct lxc_container * ret;
3969
3970 current_config = c ? c->lxc_conf : NULL;
3971 ret = do_lxcapi_clone(c, newname, lxcpath, flags, bdevtype, bdevdata, newsize, hookargs);
3972 current_config = NULL;
3973
3974 return ret;
3975 }
3976
3977 static bool do_lxcapi_rename(struct lxc_container *c, const char *newname)
3978 {
3979 struct lxc_storage *bdev;
3980 struct lxc_container *newc;
3981
3982 if (!c || !c->name || !c->config_path || !c->lxc_conf)
3983 return false;
3984
3985 if (has_fs_snapshots(c) || has_snapshots(c)) {
3986 ERROR("Renaming a container with snapshots is not supported");
3987 return false;
3988 }
3989
3990 if (lxc_storage_prepare(c->lxc_conf)) {
3991 ERROR("Failed to find original backing store type");
3992 return false;
3993 }
3994 bdev = c->lxc_conf->rootfs.storage;
3995
3996 newc = lxcapi_clone(c, newname, c->config_path, LXC_CLONE_KEEPMACADDR, NULL, bdev->type, 0, NULL);
3997 lxc_storage_put(c->lxc_conf);
3998 if (!newc) {
3999 lxc_container_put(newc);
4000 return false;
4001 }
4002
4003 if (newc && lxcapi_is_defined(newc))
4004 lxc_container_put(newc);
4005
4006 if (!container_destroy(c, NULL)) {
4007 ERROR("Could not destroy existing container %s", c->name);
4008 return false;
4009 }
4010
4011 return true;
4012 }
4013
4014 WRAP_API_1(bool, lxcapi_rename, const char *)
4015
4016 static int lxcapi_attach(struct lxc_container *c,
4017 lxc_attach_exec_t exec_function, void *exec_payload,
4018 lxc_attach_options_t *options, pid_t *attached_process)
4019 {
4020 int ret;
4021
4022 if (!c)
4023 return -1;
4024
4025 current_config = c->lxc_conf;
4026
4027 ret = lxc_attach(c, exec_function, exec_payload, options,
4028 attached_process);
4029 current_config = NULL;
4030 return ret;
4031 }
4032
4033 static int do_lxcapi_attach_run_wait(struct lxc_container *c,
4034 lxc_attach_options_t *options,
4035 const char *program,
4036 const char *const argv[])
4037 {
4038 lxc_attach_command_t command;
4039 pid_t pid;
4040 int ret;
4041
4042 if (!c)
4043 return -1;
4044
4045 command.program = (char *)program;
4046 command.argv = (char **)argv;
4047
4048 ret = lxc_attach(c, lxc_attach_run_command, &command, options, &pid);
4049 if (ret < 0)
4050 return ret;
4051
4052 return lxc_wait_for_pid_status(pid);
4053 }
4054
4055 static int lxcapi_attach_run_wait(struct lxc_container *c,
4056 lxc_attach_options_t *options,
4057 const char *program, const char *const argv[])
4058 {
4059 int ret;
4060
4061 current_config = c ? c->lxc_conf : NULL;
4062 ret = do_lxcapi_attach_run_wait(c, options, program, argv);
4063 current_config = NULL;
4064
4065 return ret;
4066 }
4067
4068 static int get_next_index(const char *lxcpath, char *cname)
4069 {
4070 __do_free char *fname = NULL;
4071 struct stat sb;
4072 int i = 0, ret;
4073
4074 fname = must_realloc(NULL, strlen(lxcpath) + 20);
4075
4076 for (;;) {
4077 sprintf(fname, "%s/snap%d", lxcpath, i);
4078
4079 ret = stat(fname, &sb);
4080 if (ret != 0)
4081 return i;
4082
4083 i++;
4084 }
4085 }
4086
4087 static bool get_snappath_dir(struct lxc_container *c, char *snappath)
4088 {
4089 int ret;
4090
4091 /*
4092 * If the old style snapshot path exists, use it
4093 * /var/lib/lxc -> /var/lib/lxcsnaps
4094 */
4095 ret = strnprintf(snappath, PATH_MAX, "%ssnaps", c->config_path);
4096 if (ret < 0)
4097 return false;
4098
4099 if (dir_exists(snappath)) {
4100 ret = strnprintf(snappath, PATH_MAX, "%ssnaps/%s", c->config_path, c->name);
4101 if (ret < 0)
4102 return false;
4103
4104 return true;
4105 }
4106
4107 /*
4108 * Use the new style path
4109 * /var/lib/lxc -> /var/lib/lxc + c->name + /snaps + \0
4110 */
4111 ret = strnprintf(snappath, PATH_MAX, "%s/%s/snaps", c->config_path, c->name);
4112 if (ret < 0)
4113 return false;
4114
4115 return true;
4116 }
4117
4118 static int do_lxcapi_snapshot(struct lxc_container *c, const char *commentfile)
4119 {
4120 __do_free char *dfnam = NULL;
4121 int len;
4122 int i, flags, ret;
4123 time_t timer;
4124 struct tm tm_info;
4125 struct lxc_container *c2;
4126 char snappath[PATH_MAX], newname[20];
4127 char buffer[25];
4128 FILE *f;
4129
4130 if (!c || !lxcapi_is_defined(c))
4131 return -1;
4132
4133 if (!storage_can_backup(c->lxc_conf)) {
4134 ERROR("%s's backing store cannot be backed up", c->name);
4135 ERROR("Your container must use another backing store type");
4136 return -1;
4137 }
4138
4139 if (!get_snappath_dir(c, snappath))
4140 return -1;
4141
4142 i = get_next_index(snappath, c->name);
4143
4144 if (mkdir_p(snappath, 0755) < 0) {
4145 ERROR("Failed to create snapshot directory %s", snappath);
4146 return -1;
4147 }
4148
4149 ret = strnprintf(newname, 20, "snap%d", i);
4150 if (ret < 0)
4151 return -1;
4152
4153 /*
4154 * We pass LXC_CLONE_SNAPSHOT to make sure that a rdepends file entry is
4155 * created in the original container
4156 */
4157 flags = LXC_CLONE_SNAPSHOT | LXC_CLONE_KEEPMACADDR | LXC_CLONE_KEEPNAME |
4158 LXC_CLONE_KEEPBDEVTYPE | LXC_CLONE_MAYBE_SNAPSHOT;
4159 if (storage_is_dir(c->lxc_conf)) {
4160 ERROR("Snapshot of directory-backed container requested");
4161 ERROR("Making a copy-clone. If you do want snapshots, then");
4162 ERROR("please create overlay clone first, snapshot that");
4163 ERROR("and keep the original container pristine");
4164 flags &= ~LXC_CLONE_SNAPSHOT | LXC_CLONE_MAYBE_SNAPSHOT;
4165 }
4166
4167 c2 = do_lxcapi_clone(c, newname, snappath, flags, NULL, NULL, 0, NULL);
4168 if (!c2) {
4169 ERROR("Failed to clone of %s:%s", c->config_path, c->name);
4170 return -1;
4171 }
4172
4173 lxc_container_put(c2);
4174
4175 /* Now write down the creation time. */
4176 time(&timer);
4177
4178 if (!localtime_r(&timer, &tm_info)) {
4179 ERROR("Failed to get localtime");
4180 return -1;
4181 }
4182
4183 strftime(buffer, 25, "%Y:%m:%d %H:%M:%S", &tm_info);
4184
4185 len = strlen(snappath) + 1 + strlen(newname) + 1 + strlen(LXC_TIMESTAMP_FNAME) + 1;
4186 dfnam = must_realloc(NULL, len);
4187 ret = strnprintf(dfnam, len, "%s/%s/%s", snappath, newname, LXC_TIMESTAMP_FNAME);
4188 if (ret < 0)
4189 return -1;
4190 f = fopen(dfnam, "we");
4191 if (!f) {
4192 ERROR("Failed to open %s", dfnam);
4193 return -1;
4194 }
4195
4196 if (fprintf(f, "%s", buffer) < 0) {
4197 SYSERROR("Writing timestamp");
4198 fclose(f);
4199 return -1;
4200 }
4201
4202 ret = fclose(f);
4203 if (ret != 0) {
4204 SYSERROR("Writing timestamp");
4205 return -1;
4206 }
4207
4208 if (commentfile) {
4209 __do_free char *path = NULL;
4210 /* $p / $name / comment \0 */
4211 len = strlen(snappath) + 1 + strlen(newname) + 1 + strlen(LXC_COMMENT_FNAME) + 1;
4212
4213 path = must_realloc(NULL, len);
4214 ret = strnprintf(path, len, "%s/%s/%s", snappath, newname, LXC_COMMENT_FNAME);
4215 if (ret < 0)
4216 return -1;
4217 return copy_file(commentfile, path) < 0 ? -1 : i;
4218 }
4219
4220 return i;
4221 }
4222
4223 WRAP_API_1(int, lxcapi_snapshot, const char *)
4224
4225 static void lxcsnap_free(struct lxc_snapshot *s)
4226 {
4227 free(s->name);
4228 free(s->comment_pathname);
4229 free(s->timestamp);
4230 free(s->lxcpath);
4231 }
4232
4233 static char *get_snapcomment_path(char *snappath, char *name)
4234 {
4235 __do_free char *s = NULL;
4236 /* $snappath/$name/comment */
4237 int ret, len = strlen(snappath) + strlen(name) + 10;
4238
4239 s = malloc(len);
4240 if (!s)
4241 return NULL;
4242
4243 ret = strnprintf(s, len, "%s/%s/comment", snappath, name);
4244 if (ret < 0)
4245 return NULL;
4246
4247 return move_ptr(s);
4248 }
4249
4250 static char *get_timestamp(char* snappath, char *name)
4251 {
4252 __do_free char *s = NULL;
4253 __do_fclose FILE *fin = NULL;
4254 char path[PATH_MAX];
4255 int ret, len;
4256
4257 ret = strnprintf(path, sizeof(path), "%s/%s/ts", snappath, name);
4258 if (ret < 0)
4259 return NULL;
4260
4261 fin = fopen(path, "re");
4262 if (!fin)
4263 return NULL;
4264
4265 (void) fseek(fin, 0, SEEK_END);
4266 len = ftell(fin);
4267 (void) fseek(fin, 0, SEEK_SET);
4268 if (len > 0) {
4269 s = malloc(len+1);
4270 if (s) {
4271 ssize_t nbytes;
4272
4273 s[len] = '\0';
4274 nbytes = fread(s, 1, len, fin);
4275 if (nbytes < 0 || nbytes != (ssize_t)len)
4276 return log_error_errno(NULL, errno, "reading timestamp");
4277 }
4278 }
4279
4280 return move_ptr(s);
4281 }
4282
4283 static int do_lxcapi_snapshot_list(struct lxc_container *c, struct lxc_snapshot **ret_snaps)
4284 {
4285 __do_closedir DIR *dir = NULL;
4286 char snappath[PATH_MAX], path2[PATH_MAX];
4287 int count = 0, ret;
4288 struct dirent *direntp;
4289 struct lxc_snapshot *snaps =NULL, *nsnaps;
4290
4291 if (!c || !lxcapi_is_defined(c))
4292 return -1;
4293
4294 if (!get_snappath_dir(c, snappath)) {
4295 ERROR("path name too long");
4296 return -1;
4297 }
4298
4299 dir = opendir(snappath);
4300 if (!dir) {
4301 INFO("Failed to open %s - assuming no snapshots", snappath);
4302 return 0;
4303 }
4304
4305 while ((direntp = readdir(dir))) {
4306 if (strequal(direntp->d_name, "."))
4307 continue;
4308
4309 if (strequal(direntp->d_name, ".."))
4310 continue;
4311
4312 ret = strnprintf(path2, sizeof(path2), "%s/%s/%s", snappath, direntp->d_name, LXC_CONFIG_FNAME);
4313 if (ret < 0) {
4314 ERROR("pathname too long");
4315 goto out_free;
4316 }
4317
4318 if (!file_exists(path2))
4319 continue;
4320
4321 nsnaps = realloc(snaps, (count + 1)*sizeof(*snaps));
4322 if (!nsnaps) {
4323 SYSERROR("Out of memory");
4324 goto out_free;
4325 }
4326
4327 snaps = nsnaps;
4328 snaps[count].free = lxcsnap_free;
4329 snaps[count].name = strdup(direntp->d_name);
4330 if (!snaps[count].name)
4331 goto out_free;
4332
4333 snaps[count].lxcpath = strdup(snappath);
4334 if (!snaps[count].lxcpath) {
4335 free(snaps[count].name);
4336 goto out_free;
4337 }
4338
4339 snaps[count].comment_pathname = get_snapcomment_path(snappath, direntp->d_name);
4340 snaps[count].timestamp = get_timestamp(snappath, direntp->d_name);
4341 count++;
4342 }
4343
4344 *ret_snaps = snaps;
4345 return count;
4346
4347 out_free:
4348 if (snaps) {
4349 for (int i = 0; i < count; i++)
4350 lxcsnap_free(&snaps[i]);
4351
4352 free(snaps);
4353 }
4354
4355 return -1;
4356 }
4357
4358 WRAP_API_1(int, lxcapi_snapshot_list, struct lxc_snapshot **)
4359
4360 static bool do_lxcapi_snapshot_restore(struct lxc_container *c, const char *snapname, const char *newname)
4361 {
4362 char clonelxcpath[PATH_MAX];
4363 int flags = 0;
4364 struct lxc_container *snap, *rest;
4365 struct lxc_storage *bdev;
4366 bool b = false;
4367
4368 if (!c || !c->name || !c->config_path)
4369 return false;
4370
4371 if (has_fs_snapshots(c)) {
4372 ERROR("container rootfs has dependent snapshots");
4373 return false;
4374 }
4375
4376 if (lxc_storage_prepare(c->lxc_conf)) {
4377 ERROR("Failed to find original backing store type");
4378 return false;
4379 }
4380 bdev = c->lxc_conf->rootfs.storage;
4381
4382 /* For an overlay container the rootfs is considered immutable
4383 * and cannot be removed when restoring from a snapshot. We pass this
4384 * internal flag along to communicate this to various parts of the
4385 * codebase.
4386 */
4387 if (strequal(bdev->type, "overlay") || strequal(bdev->type, "overlayfs"))
4388 bdev->flags |= LXC_STORAGE_INTERNAL_OVERLAY_RESTORE;
4389
4390 if (!newname)
4391 newname = c->name;
4392
4393 if (!get_snappath_dir(c, clonelxcpath)) {
4394 lxc_storage_put(c->lxc_conf);
4395 return false;
4396 }
4397 /* how should we lock this? */
4398
4399 snap = lxc_container_new(snapname, clonelxcpath);
4400 if (!snap || !lxcapi_is_defined(snap)) {
4401 ERROR("Could not open snapshot %s", snapname);
4402
4403 if (snap)
4404 lxc_container_put(snap);
4405
4406 lxc_storage_put(c->lxc_conf);
4407 return false;
4408 }
4409
4410 if (strequal(c->name, newname)) {
4411 if (!container_destroy(c, bdev)) {
4412 ERROR("Could not destroy existing container %s", newname);
4413 lxc_container_put(snap);
4414 lxc_storage_put(c->lxc_conf);
4415 return false;
4416 }
4417 }
4418
4419 if (!strequal(bdev->type, "dir") && !strequal(bdev->type, "loop"))
4420 flags = LXC_CLONE_SNAPSHOT | LXC_CLONE_MAYBE_SNAPSHOT;
4421
4422 if (strequal(bdev->type, "overlay") || strequal(bdev->type, "overlayfs"))
4423 flags |= LXC_STORAGE_INTERNAL_OVERLAY_RESTORE;
4424
4425 rest = lxcapi_clone(snap, newname, c->config_path, flags, bdev->type,
4426 NULL, 0, NULL);
4427 lxc_storage_put(c->lxc_conf);
4428 if (rest && lxcapi_is_defined(rest))
4429 b = true;
4430
4431 if (rest)
4432 lxc_container_put(rest);
4433
4434 lxc_container_put(snap);
4435 return b;
4436 }
4437
4438 WRAP_API_2(bool, lxcapi_snapshot_restore, const char *, const char *)
4439
4440 static bool do_snapshot_destroy(const char *snapname, const char *clonelxcpath)
4441 {
4442 struct lxc_container *snap = NULL;
4443 bool bret = false;
4444
4445 snap = lxc_container_new(snapname, clonelxcpath);
4446 if (!snap) {
4447 ERROR("Could not find snapshot %s", snapname);
4448 goto err;
4449 }
4450
4451 if (!do_lxcapi_destroy(snap)) {
4452 ERROR("Could not destroy snapshot %s", snapname);
4453 goto err;
4454 }
4455
4456 bret = true;
4457
4458 err:
4459 if (snap)
4460 lxc_container_put(snap);
4461
4462 return bret;
4463 }
4464
4465 static bool remove_all_snapshots(const char *path)
4466 {
4467 __do_closedir DIR *dir = NULL;
4468 struct dirent *direntp;
4469 bool bret = true;
4470
4471 dir = opendir(path);
4472 if (!dir) {
4473 SYSERROR("opendir on snapshot path %s", path);
4474 return false;
4475 }
4476
4477 while ((direntp = readdir(dir))) {
4478 if (strequal(direntp->d_name, "."))
4479 continue;
4480
4481 if (strequal(direntp->d_name, ".."))
4482 continue;
4483
4484 if (!do_snapshot_destroy(direntp->d_name, path)) {
4485 bret = false;
4486 continue;
4487 }
4488 }
4489
4490 if (rmdir(path))
4491 SYSERROR("Error removing directory %s", path);
4492
4493 return bret;
4494 }
4495
4496 static bool do_lxcapi_snapshot_destroy(struct lxc_container *c, const char *snapname)
4497 {
4498 char clonelxcpath[PATH_MAX];
4499
4500 if (!c || !c->name || !c->config_path || !snapname)
4501 return false;
4502
4503 if (!get_snappath_dir(c, clonelxcpath))
4504 return false;
4505
4506 return do_snapshot_destroy(snapname, clonelxcpath);
4507 }
4508
4509 WRAP_API_1(bool, lxcapi_snapshot_destroy, const char *)
4510
4511 static bool do_lxcapi_snapshot_destroy_all(struct lxc_container *c)
4512 {
4513 char clonelxcpath[PATH_MAX];
4514
4515 if (!c || !c->name || !c->config_path)
4516 return false;
4517
4518 if (!get_snappath_dir(c, clonelxcpath))
4519 return false;
4520
4521 return remove_all_snapshots(clonelxcpath);
4522 }
4523
4524 WRAP_API(bool, lxcapi_snapshot_destroy_all)
4525
4526 static bool do_lxcapi_may_control(struct lxc_container *c)
4527 {
4528 if (!c)
4529 return false;
4530
4531 return lxc_try_cmd(c->name, c->config_path) == 0;
4532 }
4533
4534 WRAP_API(bool, lxcapi_may_control)
4535
4536 static bool do_add_remove_node(pid_t init_pid, const char *path, bool add,
4537 struct stat *st)
4538 {
4539 int ret;
4540 char *tmp;
4541 pid_t pid;
4542 char chrootpath[PATH_MAX];
4543 char *directory_path = NULL;
4544
4545 pid = fork();
4546 if (pid < 0) {
4547 SYSERROR("Failed to fork()");
4548 return false;
4549 }
4550
4551 if (pid) {
4552 ret = wait_for_pid(pid);
4553 if (ret != 0) {
4554 ERROR("Failed to create device node");
4555 return false;
4556 }
4557
4558 return true;
4559 }
4560
4561 /* prepare the path */
4562 ret = strnprintf(chrootpath, sizeof(chrootpath), "/proc/%d/root", init_pid);
4563 if (ret < 0)
4564 return false;
4565
4566 ret = chroot(chrootpath);
4567 if (ret < 0)
4568 _exit(EXIT_FAILURE);
4569
4570 ret = chdir("/");
4571 if (ret < 0)
4572 _exit(EXIT_FAILURE);
4573
4574 /* remove path if it exists */
4575 ret = faccessat(AT_FDCWD, path, F_OK, AT_SYMLINK_NOFOLLOW);
4576 if(ret == 0) {
4577 ret = unlink(path);
4578 if (ret < 0) {
4579 SYSERROR("Failed to remove \"%s\"", path);
4580 _exit(EXIT_FAILURE);
4581 }
4582 }
4583
4584 if (!add)
4585 _exit(EXIT_SUCCESS);
4586
4587 /* create any missing directories */
4588 tmp = strdup(path);
4589 if (!tmp)
4590 _exit(EXIT_FAILURE);
4591
4592 directory_path = dirname(tmp);
4593 ret = mkdir_p(directory_path, 0755);
4594 if (ret < 0 && errno != EEXIST) {
4595 SYSERROR("Failed to create path \"%s\"", directory_path);
4596 free(tmp);
4597 _exit(EXIT_FAILURE);
4598 }
4599
4600 /* create the device node */
4601 ret = mknod(path, st->st_mode, st->st_rdev);
4602 free(tmp);
4603 if (ret < 0) {
4604 SYSERROR("Failed to create device node at \"%s\"", path);
4605 _exit(EXIT_FAILURE);
4606 }
4607
4608 _exit(EXIT_SUCCESS);
4609 }
4610
4611 static bool add_remove_device_node(struct lxc_container *c, const char *src_path, const char *dest_path, bool add)
4612 {
4613 int ret;
4614 struct stat st;
4615 char value[LXC_MAX_BUFFER];
4616 const char *p;
4617 pid_t init_pid;
4618
4619 /* make sure container is running */
4620 if (!do_lxcapi_is_running(c)) {
4621 ERROR("container is not running");
4622 return false;
4623 }
4624
4625 /* use src_path if dest_path is NULL otherwise use dest_path */
4626 p = dest_path ? dest_path : src_path;
4627
4628 /* make sure we can access p */
4629 if(access(p, F_OK) < 0 || stat(p, &st) < 0)
4630 return false;
4631
4632 /* continue if path is character device or block device */
4633 if (S_ISCHR(st.st_mode))
4634 ret = strnprintf(value, sizeof(value), "c %d:%d rwm", major(st.st_rdev), minor(st.st_rdev));
4635 else if (S_ISBLK(st.st_mode))
4636 ret = strnprintf(value, sizeof(value), "b %d:%d rwm", major(st.st_rdev), minor(st.st_rdev));
4637 else
4638 return false;
4639 if (ret < 0)
4640 return false;
4641
4642 init_pid = do_lxcapi_init_pid(c);
4643 if (init_pid < 0) {
4644 ERROR("Failed to get init pid");
4645 return false;
4646 }
4647
4648 if (!do_add_remove_node(init_pid, p, add, &st))
4649 return false;
4650
4651 /* add or remove device to/from cgroup access list */
4652 if (add) {
4653 if (!do_lxcapi_set_cgroup_item(c, "devices.allow", value)) {
4654 ERROR("set_cgroup_item failed while adding the device node");
4655 return false;
4656 }
4657 } else {
4658 if (!do_lxcapi_set_cgroup_item(c, "devices.deny", value)) {
4659 ERROR("set_cgroup_item failed while removing the device node");
4660 return false;
4661 }
4662 }
4663
4664 return true;
4665 }
4666
4667 static bool do_lxcapi_add_device_node(struct lxc_container *c, const char *src_path, const char *dest_path)
4668 {
4669 // cannot mknod if we're not privileged wrt init_user_ns
4670 if (am_host_unpriv()) {
4671 ERROR(LXC_UNPRIV_EOPNOTSUPP, __FUNCTION__);
4672 return false;
4673 }
4674
4675 return add_remove_device_node(c, src_path, dest_path, true);
4676 }
4677
4678 WRAP_API_2(bool, lxcapi_add_device_node, const char *, const char *)
4679
4680 static bool do_lxcapi_remove_device_node(struct lxc_container *c, const char *src_path, const char *dest_path)
4681 {
4682 if (am_guest_unpriv()) {
4683 ERROR(LXC_UNPRIV_EOPNOTSUPP, __FUNCTION__);
4684 return false;
4685 }
4686
4687 return add_remove_device_node(c, src_path, dest_path, false);
4688 }
4689
4690 WRAP_API_2(bool, lxcapi_remove_device_node, const char *, const char *)
4691
4692 static bool do_lxcapi_attach_interface(struct lxc_container *c,
4693 const char *ifname,
4694 const char *dst_ifname)
4695 {
4696 pid_t init_pid;
4697 int ret = 0;
4698
4699 if (am_guest_unpriv()) {
4700 ERROR(LXC_UNPRIV_EOPNOTSUPP, __FUNCTION__);
4701 return false;
4702 }
4703
4704 if (!ifname) {
4705 ERROR("No source interface name given");
4706 return false;
4707 }
4708
4709 ret = lxc_netdev_isup(ifname);
4710 if (ret > 0) {
4711 /* netdev of ifname is up. */
4712 ret = lxc_netdev_down(ifname);
4713 if (ret)
4714 goto err;
4715 }
4716
4717 init_pid = do_lxcapi_init_pid(c);
4718 if (init_pid < 0) {
4719 ERROR("Failed to get init pid");
4720 goto err;
4721 }
4722
4723 ret = lxc_netdev_move_by_name(ifname, init_pid, dst_ifname);
4724 if (ret)
4725 goto err;
4726
4727 INFO("Moved network device \"%s\" to network namespace of %d", ifname, init_pid);
4728 return true;
4729
4730 err:
4731 return false;
4732 }
4733
4734 WRAP_API_2(bool, lxcapi_attach_interface, const char *, const char *)
4735
4736 static bool do_lxcapi_detach_interface(struct lxc_container *c,
4737 const char *ifname,
4738 const char *dst_ifname)
4739 {
4740 int ret;
4741 pid_t pid, pid_outside;
4742 __do_free char *physname = NULL;
4743
4744 /*
4745 * TODO - if this is a physical device, then we need am_host_unpriv.
4746 * But for other types guest privilege suffices.
4747 */
4748 if (am_guest_unpriv()) {
4749 ERROR(LXC_UNPRIV_EOPNOTSUPP, __FUNCTION__);
4750 return false;
4751 }
4752
4753 if (!ifname) {
4754 ERROR("No source interface name given");
4755 return false;
4756 }
4757
4758 pid_outside = lxc_raw_getpid();
4759 pid = fork();
4760 if (pid < 0) {
4761 ERROR("Failed to fork");
4762 return false;
4763 }
4764
4765 if (pid == 0) { /* child */
4766 pid_t init_pid;
4767
4768 init_pid = do_lxcapi_init_pid(c);
4769 if (init_pid < 0) {
4770 ERROR("Failed to get init pid");
4771 _exit(EXIT_FAILURE);
4772 }
4773 if (!switch_to_ns(init_pid, "net")) {
4774 ERROR("Failed to enter network namespace");
4775 _exit(EXIT_FAILURE);
4776 }
4777
4778 /* create new mount namespace for use with remounting /sys and is_wlan() below. */
4779 ret = unshare(CLONE_NEWNS);
4780 if (ret < 0) {
4781 ERROR("Failed to unshare mount namespace");
4782 _exit(EXIT_FAILURE);
4783 }
4784
4785 /* set / recursively as private so that mount propagation doesn't affect us. */
4786 if (mount(NULL, "/", NULL, MS_REC | MS_PRIVATE, 0) < 0) {
4787 ERROR("Failed to recursively set / as private in mount namespace");
4788 _exit(EXIT_FAILURE);
4789 }
4790
4791 ret = lxc_netdev_isup(ifname);
4792 if (ret < 0) {
4793 ERROR("Failed to determine whether network device \"%s\" is up", ifname);
4794 _exit(EXIT_FAILURE);
4795 }
4796
4797 /* netdev of ifname is up. */
4798 if (ret) {
4799 ret = lxc_netdev_down(ifname);
4800 if (ret) {
4801 ERROR("Failed to set network device \"%s\" down", ifname);
4802 _exit(EXIT_FAILURE);
4803 }
4804 }
4805
4806 /* remount /sys so is_wlan() can check if this device is a wlan device. */
4807 lxc_attach_remount_sys_proc();
4808 physname = is_wlan(ifname);
4809 if (physname)
4810 ret = lxc_netdev_move_wlan(physname, ifname, pid_outside, dst_ifname);
4811 else
4812 ret = lxc_netdev_move_by_name(ifname, pid_outside, dst_ifname);
4813
4814 /* -EINVAL means there is no netdev named as ifname. */
4815 if (ret < 0) {
4816 if (ret == -EINVAL)
4817 ERROR("Network device \"%s\" not found", ifname);
4818 else
4819 ERROR("Failed to remove network device \"%s\"", ifname);
4820
4821 _exit(EXIT_FAILURE);
4822 }
4823
4824 _exit(EXIT_SUCCESS);
4825 }
4826
4827 ret = wait_for_pid(pid);
4828 if (ret != 0)
4829 return false;
4830
4831 INFO("Moved network device \"%s\" to network namespace of %d", ifname, pid_outside);
4832 return true;
4833 }
4834
4835 WRAP_API_2(bool, lxcapi_detach_interface, const char *, const char *)
4836
4837 static int do_lxcapi_migrate(struct lxc_container *c, unsigned int cmd,
4838 struct migrate_opts *opts, unsigned int size)
4839 {
4840 int ret = -1;
4841 struct migrate_opts *valid_opts = opts;
4842 uint64_t features_to_check = 0;
4843
4844 /* If the caller has a bigger (newer) struct migrate_opts, let's make
4845 * sure that the stuff on the end is zero, i.e. that they didn't ask us
4846 * to do anything special.
4847 */
4848 if (size > sizeof(*opts)) {
4849 unsigned char *addr;
4850 unsigned char *end;
4851
4852 addr = (void *)opts + sizeof(*opts);
4853 end = (void *)opts + size;
4854
4855 for (; addr < end; addr++)
4856 if (*addr)
4857 return -E2BIG;
4858 }
4859
4860 /* If the caller has a smaller struct, let's zero out the end for them
4861 * so we don't accidentally use bits of it that they didn't know about
4862 * to initialize.
4863 */
4864 if (size < sizeof(*opts)) {
4865 valid_opts = malloc(sizeof(*opts));
4866 if (!valid_opts)
4867 return -ENOMEM;
4868
4869 memset(valid_opts, 0, sizeof(*opts));
4870 memcpy(valid_opts, opts, size);
4871 }
4872
4873 switch (cmd) {
4874 case MIGRATE_PRE_DUMP:
4875 if (!do_lxcapi_is_running(c)) {
4876 ERROR("container is not running");
4877 goto on_error;
4878 }
4879
4880 ret = !__criu_pre_dump(c, valid_opts);
4881 break;
4882 case MIGRATE_DUMP:
4883 if (!do_lxcapi_is_running(c)) {
4884 ERROR("container is not running");
4885 goto on_error;
4886 }
4887
4888 ret = !__criu_dump(c, valid_opts);
4889 break;
4890 case MIGRATE_RESTORE:
4891 if (do_lxcapi_is_running(c)) {
4892 ERROR("container is already running");
4893 goto on_error;
4894 }
4895
4896 ret = !__criu_restore(c, valid_opts);
4897 break;
4898 case MIGRATE_FEATURE_CHECK:
4899 features_to_check = valid_opts->features_to_check;
4900 ret = !__criu_check_feature(&features_to_check);
4901 if (ret) {
4902 /* Something went wrong. Let's let the caller
4903 * know which feature checks failed. */
4904 valid_opts->features_to_check = features_to_check;
4905 }
4906 break;
4907 default:
4908 ERROR("invalid migrate command %u", cmd);
4909 ret = -EINVAL;
4910 }
4911
4912 on_error:
4913 if (size < sizeof(*opts))
4914 free(valid_opts);
4915
4916 return ret;
4917 }
4918
4919 WRAP_API_3(int, lxcapi_migrate, unsigned int, struct migrate_opts *, unsigned int)
4920
4921 static bool do_lxcapi_checkpoint(struct lxc_container *c, char *directory, bool stop, bool verbose)
4922 {
4923 struct migrate_opts opts;
4924
4925 memset(&opts, 0, sizeof(opts));
4926
4927 opts.directory = directory;
4928 opts.stop = stop;
4929 opts.verbose = verbose;
4930
4931 return !do_lxcapi_migrate(c, MIGRATE_DUMP, &opts, sizeof(opts));
4932 }
4933
4934 WRAP_API_3(bool, lxcapi_checkpoint, char *, bool, bool)
4935
4936 static bool do_lxcapi_restore(struct lxc_container *c, char *directory, bool verbose)
4937 {
4938 struct migrate_opts opts;
4939
4940 memset(&opts, 0, sizeof(opts));
4941
4942 opts.directory = directory;
4943 opts.verbose = verbose;
4944
4945 return !do_lxcapi_migrate(c, MIGRATE_RESTORE, &opts, sizeof(opts));
4946 }
4947
4948 WRAP_API_2(bool, lxcapi_restore, char *, bool)
4949
4950 /* @st_mode is the st_mode field of the stat(source) return struct */
4951 static int create_mount_target(const char *dest, mode_t st_mode)
4952 {
4953 char *dirdup, *destdirname;
4954 int ret;
4955
4956 dirdup = strdup(dest);
4957 if (!dirdup) {
4958 SYSERROR("Failed to duplicate target name \"%s\"", dest);
4959 return -1;
4960 }
4961 destdirname = dirname(dirdup);
4962
4963 ret = mkdir_p(destdirname, 0755);
4964 if (ret < 0) {
4965 SYSERROR("Failed to create \"%s\"", destdirname);
4966 free(dirdup);
4967 return ret;
4968 }
4969 free(dirdup);
4970
4971 (void)remove(dest);
4972
4973 if (S_ISDIR(st_mode))
4974 ret = mkdir(dest, 0000);
4975 else
4976 ret = mknod(dest, S_IFREG | 0000, 0);
4977
4978 if (ret == 0)
4979 TRACE("Created mount target \"%s\"", dest);
4980 else if (ret < 0 && errno != EEXIST) {
4981 SYSERROR("Failed to create mount target \"%s\"", dest);
4982 return -1;
4983 }
4984
4985 return 0;
4986 }
4987
4988 static int do_lxcapi_mount(struct lxc_container *c, const char *source,
4989 const char *target, const char *filesystemtype,
4990 unsigned long mountflags, const void *data,
4991 struct lxc_mount *mnt)
4992 {
4993 char *suff, *sret;
4994 char template[PATH_MAX], path[PATH_MAX];
4995 pid_t pid, init_pid;
4996 struct stat sb;
4997 bool is_dir;
4998 int ret = -1, fd = -EBADF;
4999
5000 if (!c || !c->lxc_conf) {
5001 ERROR("Container or configuration is NULL");
5002 return -EINVAL;
5003 }
5004
5005 if (!c->lxc_conf->shmount.path_host) {
5006 ERROR("Host path to shared mountpoint must be specified in the config\n");
5007 return -EINVAL;
5008 }
5009
5010 ret = strnprintf(template, sizeof(template), "%s/.lxcmount_XXXXXX", c->lxc_conf->shmount.path_host);
5011 if (ret < 0) {
5012 SYSERROR("Error writing shmounts tempdir name");
5013 goto out;
5014 }
5015
5016 /* Create a temporary file / dir under the shared mountpoint */
5017 if (!source || strequal(source, "")) {
5018 /* If source is not specified, maybe we want to mount a filesystem? */
5019 sb.st_mode = S_IFDIR;
5020 } else {
5021 ret = stat(source, &sb);
5022 if (ret < 0) {
5023 SYSERROR("Error getting stat info about the source \"%s\"", source);
5024 goto out;
5025 }
5026 }
5027
5028 is_dir = (S_ISDIR(sb.st_mode) != 0);
5029 if (is_dir) {
5030 sret = mkdtemp(template);
5031 if (!sret) {
5032 SYSERROR("Could not create shmounts temporary dir");
5033 goto out;
5034 }
5035 } else {
5036 fd = lxc_make_tmpfile(template, false);
5037 if (fd < 0) {
5038 SYSERROR("Could not create shmounts temporary file");
5039 goto out;
5040 }
5041 }
5042
5043 /* Do the fork */
5044 pid = fork();
5045 if (pid < 0) {
5046 SYSERROR("Could not fork");
5047 goto out;
5048 }
5049
5050 if (pid == 0) {
5051 /* Do the mount */
5052 ret = mount(source, template, filesystemtype, mountflags, data);
5053 if (ret < 0) {
5054 SYSERROR("Failed to mount onto \"%s\"", template);
5055 _exit(EXIT_FAILURE);
5056 }
5057 TRACE("Mounted \"%s\" onto \"%s\"", source, template);
5058
5059 init_pid = do_lxcapi_init_pid(c);
5060 if (init_pid < 0) {
5061 ERROR("Failed to obtain container's init pid");
5062 _exit(EXIT_FAILURE);
5063 }
5064
5065 /* Enter the container namespaces */
5066 if (!list_empty(&c->lxc_conf->id_map)) {
5067 if (!switch_to_ns(init_pid, "user")) {
5068 ERROR("Failed to enter user namespace");
5069 _exit(EXIT_FAILURE);
5070 }
5071
5072 if (!lxc_switch_uid_gid(0, 0))
5073 _exit(EXIT_FAILURE);
5074 }
5075
5076 if (!switch_to_ns(init_pid, "mnt")) {
5077 ERROR("Failed to enter mount namespace");
5078 _exit(EXIT_FAILURE);
5079 }
5080
5081 ret = create_mount_target(target, sb.st_mode);
5082 if (ret < 0)
5083 _exit(EXIT_FAILURE);
5084
5085 suff = strrchr(template, '/');
5086 if (!suff)
5087 goto cleanup_target_in_child;
5088
5089 ret = strnprintf(path, sizeof(path), "%s%s", c->lxc_conf->shmount.path_cont, suff);
5090 if (ret < 0) {
5091 SYSERROR("Error writing container mountpoint name");
5092 goto cleanup_target_in_child;
5093 }
5094
5095 ret = mount(path, target, NULL, MS_MOVE | MS_REC, NULL);
5096 if (ret < 0) {
5097 SYSERROR("Failed to move the mount from \"%s\" to \"%s\"", path, target);
5098 goto cleanup_target_in_child;
5099 }
5100 TRACE("Moved mount from \"%s\" to \"%s\"", path, target);
5101
5102 _exit(EXIT_SUCCESS);
5103
5104 cleanup_target_in_child:
5105 (void)remove(target);
5106 _exit(EXIT_FAILURE);
5107 }
5108
5109 ret = wait_for_pid(pid);
5110 if (ret < 0)
5111 SYSERROR("Wait for the child with pid %ld failed", (long)pid);
5112 else
5113 ret = 0;
5114
5115 if (umount2(template, MNT_DETACH))
5116 SYSWARN("Failed to remove temporary mount \"%s\"", template);
5117
5118 if (is_dir)
5119 (void)rmdir(template);
5120 else
5121 (void)unlink(template);
5122
5123 out:
5124 if (fd >= 0)
5125 close(fd);
5126
5127 return ret;
5128 }
5129
5130 WRAP_API_6(int, lxcapi_mount, const char *, const char *, const char *,
5131 unsigned long, const void *, struct lxc_mount *)
5132
5133 static int do_lxcapi_umount(struct lxc_container *c, const char *target,
5134 unsigned long flags, struct lxc_mount *mnt)
5135 {
5136 pid_t pid, init_pid;
5137 int ret = -1;
5138
5139 if (!c || !c->lxc_conf) {
5140 ERROR("Container or configuration is NULL");
5141 return -EINVAL;
5142 }
5143
5144 /* Do the fork */
5145 pid = fork();
5146 if (pid < 0) {
5147 SYSERROR("Could not fork");
5148 return -1;
5149 }
5150
5151 if (pid == 0) {
5152 init_pid = do_lxcapi_init_pid(c);
5153 if (init_pid < 0) {
5154 ERROR("Failed to obtain container's init pid");
5155 _exit(EXIT_FAILURE);
5156 }
5157
5158 /* Enter the container namespaces */
5159 if (!list_empty(&c->lxc_conf->id_map)) {
5160 if (!switch_to_ns(init_pid, "user")) {
5161 ERROR("Failed to enter user namespace");
5162 _exit(EXIT_FAILURE);
5163 }
5164 }
5165
5166 if (!switch_to_ns(init_pid, "mnt")) {
5167 ERROR("Failed to enter mount namespace");
5168 _exit(EXIT_FAILURE);
5169 }
5170
5171 /* Do the unmount */
5172 ret = umount2(target, flags);
5173 if (ret < 0) {
5174 SYSERROR("Failed to umount \"%s\"", target);
5175 _exit(EXIT_FAILURE);
5176 }
5177
5178 _exit(EXIT_SUCCESS);
5179 }
5180
5181 ret = wait_for_pid(pid);
5182 if (ret < 0) {
5183 SYSERROR("Wait for the child with pid %ld failed", (long)pid);
5184 return -ret;
5185 }
5186
5187 return 0;
5188 }
5189
5190 WRAP_API_3(int, lxcapi_umount, const char *, unsigned long, struct lxc_mount*)
5191
5192 static int lxcapi_attach_run_waitl(struct lxc_container *c, lxc_attach_options_t *options, const char *program, const char *arg, ...)
5193 {
5194 va_list ap;
5195 const char **argv;
5196 int ret;
5197
5198 if (!c)
5199 return -1;
5200
5201 current_config = c->lxc_conf;
5202
5203 va_start(ap, arg);
5204 argv = lxc_va_arg_list_to_argv_const(ap, 1);
5205 va_end(ap);
5206
5207 if (!argv) {
5208 ERROR("Memory allocation error.");
5209 ret = -1;
5210 goto out;
5211 }
5212 argv[0] = arg;
5213
5214 ret = do_lxcapi_attach_run_wait(c, options, program, (const char * const *)argv);
5215 free((void*)argv);
5216
5217 out:
5218 current_config = NULL;
5219 return ret;
5220 }
5221
5222 static int do_lxcapi_seccomp_notify_fd(struct lxc_container *c)
5223 {
5224 if (!c || !c->lxc_conf)
5225 return ret_set_errno(-1, -EINVAL);
5226
5227 return lxc_seccomp_get_notify_fd(&c->lxc_conf->seccomp);
5228 }
5229
5230 WRAP_API(int, lxcapi_seccomp_notify_fd)
5231
5232 static int do_lxcapi_seccomp_notify_fd_active(struct lxc_container *c)
5233 {
5234 if (!c || !c->lxc_conf)
5235 return ret_set_errno(-1, -EINVAL);
5236
5237 return lxc_cmd_get_seccomp_notify_fd(c->name, c->config_path);
5238 }
5239
5240 WRAP_API(int, lxcapi_seccomp_notify_fd_active)
5241
5242 struct lxc_container *lxc_container_new(const char *name, const char *configpath)
5243 {
5244 struct lxc_container *c;
5245 size_t len;
5246 int rc;
5247
5248 if (!name)
5249 return NULL;
5250
5251 c = malloc(sizeof(*c));
5252 if (!c) {
5253 fprintf(stderr, "Failed to allocate memory for %s\n", name);
5254 return NULL;
5255 }
5256 memset(c, 0, sizeof(*c));
5257
5258 if (configpath)
5259 c->config_path = strdup(configpath);
5260 else
5261 c->config_path = strdup(lxc_global_config_value("lxc.lxcpath"));
5262 if (!c->config_path) {
5263 fprintf(stderr, "Failed to allocate memory for %s\n", name);
5264 goto err;
5265 }
5266
5267 remove_trailing_slashes(c->config_path);
5268
5269 len = strlen(name);
5270 c->name = malloc(len + 1);
5271 if (!c->name) {
5272 fprintf(stderr, "Failed to allocate memory for %s\n", name);
5273 goto err;
5274 }
5275 (void)strlcpy(c->name, name, len + 1);
5276
5277 c->numthreads = 1;
5278 c->slock = lxc_newlock(c->config_path, name);
5279 if (!c->slock) {
5280 fprintf(stderr, "Failed to create lock for %s\n", name);
5281 goto err;
5282 }
5283
5284 c->privlock = lxc_newlock(NULL, NULL);
5285 if (!c->privlock) {
5286 fprintf(stderr, "Failed to create private lock for %s\n", name);
5287 goto err;
5288 }
5289
5290 if (!set_config_filename(c)) {
5291 fprintf(stderr, "Failed to create config file name for %s\n", name);
5292 goto err;
5293 }
5294
5295 if (file_exists(c->configfile) && !lxcapi_load_config(c, NULL)) {
5296 fprintf(stderr, "Failed to load config for %s\n", name);
5297 goto err;
5298 }
5299
5300 rc = ongoing_create(c);
5301 switch (rc) {
5302 case LXC_CREATE_INCOMPLETE:
5303 SYSERROR("Failed to complete container creation for %s", c->name);
5304 container_destroy(c, NULL);
5305 lxcapi_clear_config(c);
5306 break;
5307 case LXC_CREATE_ONGOING:
5308 /* container creation going on */
5309 break;
5310 case LXC_CREATE_FAILED:
5311 /* container creation failed */
5312 if (errno != EACCES && errno != EPERM) {
5313 /* insufficient privileges */
5314 SYSERROR("Failed checking for incomplete container %s creation", c->name);
5315 goto err;
5316 }
5317 break;
5318 }
5319
5320 c->daemonize = true;
5321 c->pidfile = NULL;
5322
5323 /* Assign the member functions. */
5324 c->is_defined = lxcapi_is_defined;
5325 c->state = lxcapi_state;
5326 c->is_running = lxcapi_is_running;
5327 c->freeze = lxcapi_freeze;
5328 c->unfreeze = lxcapi_unfreeze;
5329 c->console = lxcapi_console;
5330 c->console_getfd = lxcapi_console_getfd;
5331 c->devpts_fd = lxcapi_devpts_fd;
5332 c->init_pid = lxcapi_init_pid;
5333 c->init_pidfd = lxcapi_init_pidfd;
5334 c->load_config = lxcapi_load_config;
5335 c->want_daemonize = lxcapi_want_daemonize;
5336 c->want_close_all_fds = lxcapi_want_close_all_fds;
5337 c->start = lxcapi_start;
5338 c->startl = lxcapi_startl;
5339 c->stop = lxcapi_stop;
5340 c->config_file_name = lxcapi_config_file_name;
5341 c->wait = lxcapi_wait;
5342 c->set_config_item = lxcapi_set_config_item;
5343 c->destroy = lxcapi_destroy;
5344 c->destroy_with_snapshots = lxcapi_destroy_with_snapshots;
5345 c->rename = lxcapi_rename;
5346 c->save_config = lxcapi_save_config;
5347 c->get_keys = lxcapi_get_keys;
5348 c->create = lxcapi_create;
5349 c->createl = lxcapi_createl;
5350 c->shutdown = lxcapi_shutdown;
5351 c->reboot = lxcapi_reboot;
5352 c->reboot2 = lxcapi_reboot2;
5353 c->clear_config = lxcapi_clear_config;
5354 c->clear_config_item = lxcapi_clear_config_item;
5355 c->get_config_item = lxcapi_get_config_item;
5356 c->get_running_config_item = lxcapi_get_running_config_item;
5357 c->get_cgroup_item = lxcapi_get_cgroup_item;
5358 c->set_cgroup_item = lxcapi_set_cgroup_item;
5359 c->get_config_path = lxcapi_get_config_path;
5360 c->set_config_path = lxcapi_set_config_path;
5361 c->clone = lxcapi_clone;
5362 c->get_interfaces = lxcapi_get_interfaces;
5363 c->get_ips = lxcapi_get_ips;
5364 c->attach = lxcapi_attach;
5365 c->attach_run_wait = lxcapi_attach_run_wait;
5366 c->attach_run_waitl = lxcapi_attach_run_waitl;
5367 c->snapshot = lxcapi_snapshot;
5368 c->snapshot_list = lxcapi_snapshot_list;
5369 c->snapshot_restore = lxcapi_snapshot_restore;
5370 c->snapshot_destroy = lxcapi_snapshot_destroy;
5371 c->snapshot_destroy_all = lxcapi_snapshot_destroy_all;
5372 c->may_control = lxcapi_may_control;
5373 c->add_device_node = lxcapi_add_device_node;
5374 c->remove_device_node = lxcapi_remove_device_node;
5375 c->attach_interface = lxcapi_attach_interface;
5376 c->detach_interface = lxcapi_detach_interface;
5377 c->checkpoint = lxcapi_checkpoint;
5378 c->restore = lxcapi_restore;
5379 c->migrate = lxcapi_migrate;
5380 c->console_log = lxcapi_console_log;
5381 c->mount = lxcapi_mount;
5382 c->umount = lxcapi_umount;
5383 c->seccomp_notify_fd = lxcapi_seccomp_notify_fd;
5384 c->seccomp_notify_fd_active = lxcapi_seccomp_notify_fd_active;
5385
5386 return c;
5387
5388 err:
5389 lxc_container_free(c);
5390 return NULL;
5391 }
5392
5393 int lxc_get_wait_states(const char **states)
5394 {
5395 int i;
5396
5397 if (states)
5398 for (i=0; i<MAX_STATE; i++)
5399 states[i] = lxc_state2str(i);
5400
5401 return MAX_STATE;
5402 }
5403
5404 /*
5405 * These next two could probably be done smarter with reusing a common function
5406 * with different iterators and tests...
5407 */
5408 int list_defined_containers(const char *lxcpath, char ***names,
5409 struct lxc_container ***cret)
5410 {
5411 __do_closedir DIR *dir = NULL;
5412 size_t array_len = 0, name_array_len = 0, ct_array_len = 0;
5413 struct dirent *direntp;
5414 struct lxc_container *c;
5415
5416 if (!lxcpath)
5417 lxcpath = lxc_global_config_value("lxc.lxcpath");
5418
5419 dir = opendir(lxcpath);
5420 if (!dir) {
5421 SYSERROR("opendir on lxcpath");
5422 return -1;
5423 }
5424
5425 if (cret)
5426 *cret = NULL;
5427
5428 if (names)
5429 *names = NULL;
5430
5431 while ((direntp = readdir(dir))) {
5432 /* Ignore '.', '..' and any hidden directory. */
5433 if (strnequal(direntp->d_name, ".", 1))
5434 continue;
5435
5436 if (!config_file_exists(lxcpath, direntp->d_name))
5437 continue;
5438
5439 if (cret) {
5440 c = lxc_container_new(direntp->d_name, lxcpath);
5441 if (!c) {
5442 INFO("Container %s:%s has a config but could not be loaded",
5443 lxcpath, direntp->d_name);
5444 continue;
5445 }
5446
5447 if (!do_lxcapi_is_defined(c)) {
5448 INFO("Container %s:%s has a config but is not defined",
5449 lxcpath, direntp->d_name);
5450
5451 lxc_container_put(c);
5452 continue;
5453 }
5454 }
5455
5456 if (names) {
5457 if (!add_to_array(names, direntp->d_name, array_len))
5458 goto free_bad;
5459 name_array_len++;
5460 }
5461
5462 if (cret) {
5463 if (!add_to_clist(cret, c, array_len, true)) {
5464 lxc_container_put(c);
5465 goto free_bad;
5466 }
5467 ct_array_len++;
5468 }
5469
5470 array_len++;
5471 }
5472
5473 return array_len;
5474
5475 free_bad:
5476 if (names && *names) {
5477 for (size_t i = 0; i < name_array_len; i++)
5478 free((*names)[i]);
5479 free(*names);
5480 }
5481
5482 if (cret && *cret) {
5483 for (size_t i = 0; i < ct_array_len; i++)
5484 lxc_container_put((*cret)[i]);
5485 free(*cret);
5486 }
5487
5488 return -1;
5489 }
5490
5491 int list_active_containers(const char *lxcpath, char ***nret,
5492 struct lxc_container ***cret)
5493 {
5494 __do_free char *line = NULL;
5495 __do_fclose FILE *f = NULL;
5496 int i, ret = -1, cret_cnt = 0, ct_name_cnt = 0;
5497 int lxcpath_len;
5498 char **ct_name = NULL;
5499 size_t len = 0;
5500 struct lxc_container *c = NULL;
5501 bool is_hashed;
5502
5503 if (!lxcpath)
5504 lxcpath = lxc_global_config_value("lxc.lxcpath");
5505 lxcpath_len = strlen(lxcpath);
5506
5507 if (cret)
5508 *cret = NULL;
5509
5510 if (nret)
5511 *nret = NULL;
5512
5513 f = fopen("/proc/net/unix", "re");
5514 if (!f)
5515 return -1;
5516
5517 while (getline(&line, &len, f) != -1) {
5518 char *p = strrchr(line, ' '), *p2;
5519 if (!p)
5520 continue;
5521 p++;
5522
5523 if (*p != 0x40)
5524 continue;
5525 p++;
5526
5527 is_hashed = false;
5528
5529 if (strnequal(p, lxcpath, lxcpath_len)) {
5530 p += lxcpath_len;
5531 } else if (strnequal(p, "lxc/", 4)) {
5532 p += 4;
5533 is_hashed = true;
5534 } else {
5535 continue;
5536 }
5537
5538 while (*p == '/')
5539 p++;
5540
5541 /* Now p is the start of lxc_name. */
5542 p2 = strchr(p, '/');
5543 if (!p2 || !strnequal(p2, "/command", 8))
5544 continue;
5545 *p2 = '\0';
5546
5547 if (is_hashed) {
5548 char *recvpath = lxc_cmd_get_lxcpath(p);
5549 if (!recvpath)
5550 continue;
5551
5552 if (!strnequal(lxcpath, recvpath, lxcpath_len)) {
5553 free(recvpath);
5554 continue;
5555 }
5556 free(recvpath);
5557
5558 p = lxc_cmd_get_name(p);
5559 if (!p)
5560 continue;
5561 }
5562
5563 if (array_contains(&ct_name, p, ct_name_cnt)) {
5564 if (is_hashed)
5565 free(p);
5566 continue;
5567 }
5568
5569 if (!add_to_array(&ct_name, p, ct_name_cnt)) {
5570 if (is_hashed)
5571 free(p);
5572 goto free_cret_list;
5573 }
5574
5575 ct_name_cnt++;
5576
5577 if (!cret) {
5578 if (is_hashed)
5579 free(p);
5580 continue;
5581 }
5582
5583 c = lxc_container_new(p, lxcpath);
5584 if (!c) {
5585 INFO("Container %s:%s is running but could not be loaded", lxcpath, p);
5586 if (is_hashed)
5587 free(p);
5588
5589 goto free_cret_list;
5590 }
5591
5592 if (is_hashed)
5593 free(p);
5594
5595 /*
5596 * If this is an anonymous container, then is_defined *can*
5597 * return false. So we don't do that check. Count on the
5598 * fact that the command socket exists.
5599 */
5600
5601 if (!add_to_clist(cret, c, cret_cnt, true)) {
5602 lxc_container_put(c);
5603 goto free_cret_list;
5604 }
5605
5606 cret_cnt++;
5607 }
5608
5609 if (nret && cret && cret_cnt != ct_name_cnt) {
5610 if (c)
5611 lxc_container_put(c);
5612 goto free_cret_list;
5613 }
5614
5615 ret = ct_name_cnt;
5616 if (nret)
5617 *nret = ct_name;
5618 else
5619 goto free_ct_name;
5620
5621 goto out;
5622
5623 free_cret_list:
5624 if (cret && *cret) {
5625 for (i = 0; i < cret_cnt; i++)
5626 lxc_container_put((*cret)[i]);
5627 free(*cret);
5628 }
5629
5630 free_ct_name:
5631 if (ct_name) {
5632 for (i = 0; i < ct_name_cnt; i++)
5633 free(ct_name[i]);
5634 free(ct_name);
5635 }
5636
5637 out:
5638 return ret;
5639 }
5640
5641 int list_all_containers(const char *lxcpath, char ***nret,
5642 struct lxc_container ***cret)
5643 {
5644 int active_cnt, ct_cnt, ct_list_cnt, ret;
5645 char **active_name = NULL, **ct_name = NULL;
5646 struct lxc_container **ct_list = NULL;
5647
5648 ct_cnt = list_defined_containers(lxcpath, &ct_name, NULL);
5649 if (ct_cnt < 0)
5650 return ct_cnt;
5651
5652 active_cnt = list_active_containers(lxcpath, &active_name, NULL);
5653 if (active_cnt < 0) {
5654 ret = active_cnt;
5655 goto free_ct_name;
5656 }
5657
5658 ret = -EINVAL;
5659 for (int i = 0; i < active_cnt; i++) {
5660 if (array_contains(&ct_name, active_name[i], ct_cnt))
5661 continue;
5662
5663 if (!add_to_array(&ct_name, active_name[i], ct_cnt))
5664 goto free_active_name;
5665
5666 ct_cnt++;
5667 }
5668
5669 if (cret) {
5670 ct_list_cnt = 0;
5671 for (int i = 0; i < ct_cnt; i++) {
5672 __put_lxc_container struct lxc_container *c = NULL;
5673
5674 c = lxc_container_new(ct_name[i], lxcpath);
5675 if (!c) {
5676 WARN("Container %s:%s could not be loaded", lxcpath, ct_name[i]);
5677 goto free_ct_list;
5678 }
5679
5680 if (!add_to_clist(&ct_list, c, ct_list_cnt, false))
5681 goto free_ct_list;
5682
5683 ct_list_cnt++;
5684 move_ptr(c);
5685 }
5686
5687 *cret = ct_list;
5688 }
5689
5690 for (int i = 0; i < active_cnt; i++)
5691 free(active_name[i]);
5692 free(active_name);
5693
5694 if (nret) {
5695 *nret = ct_name;
5696 } else {
5697 for (int i = 0; i < ct_cnt; i++)
5698 free(ct_name[i]);
5699 free(ct_name);
5700 }
5701
5702 return ct_cnt;
5703
5704 free_ct_list:
5705 for (int i = 0; i < ct_list_cnt; i++)
5706 lxc_container_put(ct_list[i]);
5707 free(ct_list);
5708
5709 free_active_name:
5710 for (int i = 0; i < active_cnt; i++)
5711 free(active_name[i]);
5712 free(active_name);
5713
5714 free_ct_name:
5715 for (int i = 0; i < ct_cnt; i++)
5716 free(ct_name[i]);
5717 free(ct_name);
5718
5719 return ret;
5720 }
5721
5722 bool lxc_config_item_is_supported(const char *key)
5723 {
5724 return !!lxc_get_config_exact(key);
5725 }
5726
5727 bool lxc_has_api_extension(const char *extension)
5728 {
5729 /* The NULL API extension is always present. :) */
5730 if (!extension)
5731 return true;
5732
5733 for (size_t i = 0; i < nr_api_extensions; i++)
5734 if (strequal(api_extensions[i], extension))
5735 return true;
5736
5737 return false;
5738 }
LXC mirror