]> git.proxmox.com Git - mirror_lxc.git/blob - src/lxc/lxccontainer.c
projects / mirror_lxc.git / blob
? search:
summary | shortlog | log | commit | commitdiff | tree
blame | history | raw | HEAD
confile: cleanup parse_line()
[mirror_lxc.git] / src / lxc / lxccontainer.c
1 /* SPDX-License-Identifier: LGPL-2.1+ */
2
3 #ifndef _GNU_SOURCE
4 #define _GNU_SOURCE 1
5 #endif
6 #include <arpa/inet.h>
7 #include <dirent.h>
8 #include <errno.h>
9 #include <fcntl.h>
10 #include <grp.h>
11 #include <libgen.h>
12 #include <pthread.h>
13 #include <sched.h>
14 #include <stdarg.h>
15 #include <stdint.h>
16 #include <stdio.h>
17 #include <stdlib.h>
18 #include <sys/file.h>
19 #include <sys/mman.h>
20 #include <sys/mount.h>
21 #include <sys/stat.h>
22 #include <sys/syscall.h>
23 #include <sys/sysmacros.h>
24 #include <sys/types.h>
25 #include <sys/wait.h>
26 #include <unistd.h>
27
28 #include "../include/netns_ifaddrs.h"
29 #include "af_unix.h"
30 #include "api_extensions.h"
31 #include "attach.h"
32 #include "cgroup.h"
33 #include "macro.h"
34 #include "commands.h"
35 #include "commands_utils.h"
36 #include "conf.h"
37 #include "config.h"
38 #include "confile.h"
39 #include "confile_utils.h"
40 #include "criu.h"
41 #include "error.h"
42 #include "initutils.h"
43 #include "log.h"
44 #include "lxc.h"
45 #include "lxccontainer.h"
46 #include "lxclock.h"
47 #include "memory_utils.h"
48 #include "monitor.h"
49 #include "namespace.h"
50 #include "network.h"
51 #include "parse.h"
52 #include "process_utils.h"
53 #include "start.h"
54 #include "state.h"
55 #include "storage.h"
56 #include "storage/btrfs.h"
57 #include "storage/overlay.h"
58 #include "storage_utils.h"
59 #include "sync.h"
60 #include "syscall_wrappers.h"
61 #include "terminal.h"
62 #include "utils.h"
63 #include "version.h"
64
65 #if HAVE_OPENSSL
66 #include <openssl/evp.h>
67 #endif
68
69 /* major()/minor() */
70 #ifdef MAJOR_IN_MKDEV
71 #include <sys/mkdev.h>
72 #endif
73
74 #if IS_BIONIC
75 #include <../include/lxcmntent.h>
76 #else
77 #include <mntent.h>
78 #endif
79
80 #ifndef HAVE_STRLCPY
81 #include "include/strlcpy.h"
82 #endif
83
84 lxc_log_define(lxccontainer, lxc);
85
86 static bool do_lxcapi_destroy(struct lxc_container *c);
87 static const char *lxcapi_get_config_path(struct lxc_container *c);
88 #define do_lxcapi_get_config_path(c) lxcapi_get_config_path(c)
89 static bool do_lxcapi_set_config_item(struct lxc_container *c, const char *key, const char *v);
90 static bool container_destroy(struct lxc_container *c,
91 struct lxc_storage *storage);
92 static bool get_snappath_dir(struct lxc_container *c, char *snappath);
93 static bool lxcapi_snapshot_destroy_all(struct lxc_container *c);
94 static bool do_lxcapi_save_config(struct lxc_container *c, const char *alt_file);
95
96 static bool config_file_exists(const char *lxcpath, const char *cname)
97 {
98 __do_free char *fname = NULL;
99 int ret;
100 size_t len;
101
102 /* $lxcpath + '/' + $cname + '/config' + \0 */
103 len = strlen(lxcpath) + 1 + strlen(cname) + 1 + strlen(LXC_CONFIG_FNAME) + 1;
104 fname = must_realloc(NULL, len);
105 ret = snprintf(fname, len, "%s/%s/%s", lxcpath, cname, LXC_CONFIG_FNAME);
106 if (ret < 0 || (size_t)ret >= len)
107 return false;
108
109 return file_exists(fname);
110 }
111
112 /*
113 * A few functions to help detect when a container creation failed. If a
114 * container creation was killed partway through, then trying to actually start
115 * that container could harm the host. We detect this by creating a 'partial'
116 * file under the container directory, and keeping an advisory lock. When
117 * container creation completes, we remove that file. When we load or try to
118 * start a container, if we find that file, without a flock, we remove the
119 * container.
120 */
121 enum {
122 LXC_CREATE_FAILED = -1,
123 LXC_CREATE_SUCCESS = 0,
124 LXC_CREATE_ONGOING = 1,
125 LXC_CREATE_INCOMPLETE = 2,
126 };
127
128 static int ongoing_create(struct lxc_container *c)
129 {
130 __do_close int fd = -EBADF;
131 __do_free char *path = NULL;
132 struct flock lk = {0};
133 int ret;
134 size_t len;
135
136 len = strlen(c->config_path) + 1 + strlen(c->name) + 1 + strlen(LXC_PARTIAL_FNAME) + 1;
137 path = must_realloc(NULL, len);
138 ret = snprintf(path, len, "%s/%s/%s", c->config_path, c->name, LXC_PARTIAL_FNAME);
139 if (ret < 0 || (size_t)ret >= len)
140 return LXC_CREATE_FAILED;
141
142 fd = open(path, O_RDWR | O_CLOEXEC);
143 if (fd < 0) {
144 if (errno != ENOENT)
145 return LXC_CREATE_FAILED;
146
147 return LXC_CREATE_SUCCESS;
148 }
149
150 lk.l_type = F_WRLCK;
151 lk.l_whence = SEEK_SET;
152 /*
153 * F_OFD_GETLK requires that l_pid be set to 0 otherwise the kernel
154 * will EINVAL us.
155 */
156 lk.l_pid = 0;
157
158 ret = fcntl(fd, F_OFD_GETLK, &lk);
159 if (ret < 0 && errno == EINVAL) {
160 ret = flock(fd, LOCK_EX | LOCK_NB);
161 if (ret < 0 && errno == EWOULDBLOCK)
162 ret = 0;
163 }
164
165 /* F_OFD_GETLK will not send us back a pid so don't check it. */
166 if (ret == 0)
167 /* Create is still ongoing. */
168 return LXC_CREATE_ONGOING;
169
170 /* Create completed but partial is still there. */
171 return LXC_CREATE_INCOMPLETE;
172 }
173
174 static int create_partial(struct lxc_container *c)
175 {
176 __do_free char *path = NULL;
177 int fd, ret;
178 size_t len;
179 struct flock lk = {0};
180
181 /* $lxcpath + '/' + $name + '/partial' + \0 */
182 len = strlen(c->config_path) + 1 + strlen(c->name) + 1 + strlen(LXC_PARTIAL_FNAME) + 1;
183 path = must_realloc(NULL, len);
184 ret = snprintf(path, len, "%s/%s/%s", c->config_path, c->name, LXC_PARTIAL_FNAME);
185 if (ret < 0 || (size_t)ret >= len)
186 return -1;
187
188 fd = open(path, O_RDWR | O_CREAT | O_EXCL | O_CLOEXEC, 0000);
189 if (fd < 0)
190 return -1;
191
192 lk.l_type = F_WRLCK;
193 lk.l_whence = SEEK_SET;
194
195 ret = fcntl(fd, F_OFD_SETLKW, &lk);
196 if (ret < 0) {
197 if (errno == EINVAL) {
198 ret = flock(fd, LOCK_EX);
199 if (ret == 0)
200 return fd;
201 }
202
203 SYSERROR("Failed to lock partial file %s", path);
204 close(fd);
205 return -1;
206 }
207
208 return fd;
209 }
210
211 static void remove_partial(struct lxc_container *c, int fd)
212 {
213 __do_free char *path = NULL;
214 int ret;
215 size_t len;
216
217 close(fd);
218
219 /* $lxcpath + '/' + $name + '/partial' + \0 */
220 len = strlen(c->config_path) + 1 + strlen(c->name) + 1 + strlen(LXC_PARTIAL_FNAME) + 1;
221 path = must_realloc(NULL, len);
222 ret = snprintf(path, len, "%s/%s/%s", c->config_path, c->name, LXC_PARTIAL_FNAME);
223 if (ret < 0 || (size_t)ret >= len)
224 return;
225
226 ret = unlink(path);
227 if (ret < 0)
228 SYSERROR("Failed to remove partial file %s", path);
229 }
230
231 /* LOCKING
232 * 1. container_mem_lock(c) protects the struct lxc_container from multiple threads.
233 * 2. container_disk_lock(c) protects the on-disk container data - in particular the
234 * container configuration file.
235 * The container_disk_lock also takes the container_mem_lock.
236 * 3. thread_mutex protects process data (ex: fd table) from multiple threads.
237 * NOTHING mutexes two independent programs with their own struct
238 * lxc_container for the same c->name, between API calls. For instance,
239 * c->config_read(); c->start(); Between those calls, data on disk
240 * could change (which shouldn't bother the caller unless for instance
241 * the rootfs get moved). c->config_read(); update; c->config_write();
242 * Two such updaters could race. The callers should therefore check their
243 * results. Trying to prevent that would necessarily expose us to deadlocks
244 * due to hung callers. So I prefer to keep the locks only within our own
245 * functions, not across functions.
246 *
247 * If you're going to clone while holding a lxccontainer, increment
248 * c->numthreads (under privlock) before forking. When deleting,
249 * decrement numthreads under privlock, then if it hits 0 you can delete.
250 * Do not ever use a lxccontainer whose numthreads you did not bump.
251 */
252 static void lxc_container_free(struct lxc_container *c)
253 {
254 if (!c)
255 return;
256
257 free(c->configfile);
258 c->configfile = NULL;
259
260 free(c->error_string);
261 c->error_string = NULL;
262
263 if (c->slock) {
264 lxc_putlock(c->slock);
265 c->slock = NULL;
266 }
267
268 if (c->privlock) {
269 lxc_putlock(c->privlock);
270 c->privlock = NULL;
271 }
272
273 free(c->name);
274 c->name = NULL;
275
276 if (c->lxc_conf) {
277 lxc_conf_free(c->lxc_conf);
278 c->lxc_conf = NULL;
279 }
280
281 free(c->config_path);
282 c->config_path = NULL;
283
284 free(c);
285 }
286
287 /* Consider the following case:
288 *
289 * |====================================================================|
290 * | freer | racing get()er |
291 * |====================================================================|
292 * | lxc_container_put() | lxc_container_get() |
293 * | \ lxclock(c->privlock) | c->numthreads < 1? (no) |
294 * | \ c->numthreads = 0 | \ lxclock(c->privlock) -> waits |
295 * | \ lxcunlock() | \ |
296 * | \ lxc_container_free() | \ lxclock() returns |
297 * | | \ c->numthreads < 1 -> return 0 |
298 * | \ \ (free stuff) | |
299 * | \ \ sem_destroy(privlock) | |
300 * |_______________________________|____________________________________|
301 *
302 * When the get()er checks numthreads the first time, one of the following
303 * is true:
304 * 1. freer has set numthreads = 0. get() returns 0
305 * 2. freer is between lxclock and setting numthreads to 0. get()er will
306 * sem_wait on privlock, get lxclock after freer() drops it, then see
307 * numthreads is 0 and exit without touching lxclock again..
308 * 3. freer has not yet locked privlock. If get()er runs first, then put()er
309 * will see --numthreads = 1 and not call lxc_container_free().
310 */
311
312 int lxc_container_get(struct lxc_container *c)
313 {
314 if (!c)
315 return 0;
316
317 /* If someone else has already started freeing the container, don't try
318 * to take the lock, which may be invalid.
319 */
320 if (c->numthreads < 1)
321 return 0;
322
323 if (container_mem_lock(c))
324 return 0;
325
326 /* Bail without trying to unlock, bc the privlock is now probably in
327 * freed memory.
328 */
329 if (c->numthreads < 1)
330 return 0;
331
332 c->numthreads++;
333 container_mem_unlock(c);
334
335 return 1;
336 }
337
338 int lxc_container_put(struct lxc_container *c)
339 {
340 if (!c)
341 return -1;
342
343 if (container_mem_lock(c))
344 return -1;
345
346 c->numthreads--;
347
348 if (c->numthreads < 1) {
349 container_mem_unlock(c);
350 lxc_container_free(c);
351 return 1;
352 }
353
354 container_mem_unlock(c);
355 return 0;
356 }
357
358 static bool do_lxcapi_is_defined(struct lxc_container *c)
359 {
360 int statret;
361 struct stat statbuf;
362 bool ret = false;
363
364 if (!c)
365 return false;
366
367 if (container_mem_lock(c))
368 return false;
369
370 if (!c->configfile)
371 goto on_error;
372
373 statret = stat(c->configfile, &statbuf);
374 if (statret != 0)
375 goto on_error;
376
377 ret = true;
378
379 on_error:
380 container_mem_unlock(c);
381 return ret;
382 }
383
384 #define WRAP_API(rettype, fnname) \
385 static rettype fnname(struct lxc_container *c) \
386 { \
387 rettype ret; \
388 bool reset_config = false; \
389 \
390 if (!current_config && c && c->lxc_conf) { \
391 current_config = c->lxc_conf; \
392 reset_config = true; \
393 } \
394 \
395 ret = do_##fnname(c); \
396 if (reset_config) \
397 current_config = NULL; \
398 \
399 return ret; \
400 }
401
402 #define WRAP_API_1(rettype, fnname, t1) \
403 static rettype fnname(struct lxc_container *c, t1 a1) \
404 { \
405 rettype ret; \
406 bool reset_config = false; \
407 \
408 if (!current_config && c && c->lxc_conf) { \
409 current_config = c->lxc_conf; \
410 reset_config = true; \
411 } \
412 \
413 ret = do_##fnname(c, a1); \
414 if (reset_config) \
415 current_config = NULL; \
416 \
417 return ret; \
418 }
419
420 #define WRAP_API_2(rettype, fnname, t1, t2) \
421 static rettype fnname(struct lxc_container *c, t1 a1, t2 a2) \
422 { \
423 rettype ret; \
424 bool reset_config = false; \
425 \
426 if (!current_config && c && c->lxc_conf) { \
427 current_config = c->lxc_conf; \
428 reset_config = true; \
429 } \
430 \
431 ret = do_##fnname(c, a1, a2); \
432 if (reset_config) \
433 current_config = NULL; \
434 \
435 return ret; \
436 }
437
438 #define WRAP_API_3(rettype, fnname, t1, t2, t3) \
439 static rettype fnname(struct lxc_container *c, t1 a1, t2 a2, t3 a3) \
440 { \
441 rettype ret; \
442 bool reset_config = false; \
443 \
444 if (!current_config && c && c->lxc_conf) { \
445 current_config = c->lxc_conf; \
446 reset_config = true; \
447 } \
448 \
449 ret = do_##fnname(c, a1, a2, a3); \
450 if (reset_config) \
451 current_config = NULL; \
452 \
453 return ret; \
454 }
455
456 #define WRAP_API_6(rettype, fnname, t1, t2, t3, t4, t5, t6) \
457 static rettype fnname(struct lxc_container *c, t1 a1, t2 a2, t3 a3, \
458 t4 a4, t5 a5, t6 a6) \
459 { \
460 rettype ret; \
461 bool reset_config = false; \
462 \
463 if (!current_config && c && c->lxc_conf) { \
464 current_config = c->lxc_conf; \
465 reset_config = true; \
466 } \
467 \
468 ret = do_##fnname(c, a1, a2, a3, a4, a5, a6); \
469 if (reset_config) \
470 current_config = NULL; \
471 \
472 return ret; \
473 }
474
475 WRAP_API(bool, lxcapi_is_defined)
476
477 static const char *do_lxcapi_state(struct lxc_container *c)
478 {
479 lxc_state_t s;
480
481 if (!c)
482 return NULL;
483
484 s = lxc_getstate(c->name, c->config_path);
485 return lxc_state2str(s);
486 }
487
488 WRAP_API(const char *, lxcapi_state)
489
490 static bool is_stopped(struct lxc_container *c)
491 {
492 lxc_state_t s;
493
494 s = lxc_getstate(c->name, c->config_path);
495 return (s == STOPPED);
496 }
497
498 static bool do_lxcapi_is_running(struct lxc_container *c)
499 {
500 if (!c)
501 return false;
502
503 return !is_stopped(c);
504 }
505
506 WRAP_API(bool, lxcapi_is_running)
507
508 static bool do_lxcapi_freeze(struct lxc_container *c)
509 {
510 lxc_state_t s;
511
512 if (!c || !c->lxc_conf)
513 return false;
514
515 s = lxc_getstate(c->name, c->config_path);
516 if (s != FROZEN)
517 return lxc_freeze(c->lxc_conf, c->name, c->config_path) == 0;
518
519 return true;
520 }
521
522 WRAP_API(bool, lxcapi_freeze)
523
524 static bool do_lxcapi_unfreeze(struct lxc_container *c)
525 {
526 lxc_state_t s;
527
528 if (!c || !c->lxc_conf)
529 return false;
530
531 s = lxc_getstate(c->name, c->config_path);
532 if (s == FROZEN)
533 return lxc_unfreeze(c->lxc_conf, c->name, c->config_path) == 0;
534
535 return true;
536 }
537
538 WRAP_API(bool, lxcapi_unfreeze)
539
540 static int do_lxcapi_console_getfd(struct lxc_container *c, int *ttynum, int *ptxfd)
541 {
542 if (!c)
543 return -1;
544
545 return lxc_terminal_getfd(c, ttynum, ptxfd);
546 }
547
548 WRAP_API_2(int, lxcapi_console_getfd, int *, int *)
549
550 static int lxcapi_console(struct lxc_container *c, int ttynum, int stdinfd,
551 int stdoutfd, int stderrfd, int escape)
552 {
553 int ret;
554
555 if (!c)
556 return -1;
557
558 current_config = c->lxc_conf;
559 ret = lxc_console(c, ttynum, stdinfd, stdoutfd, stderrfd, escape);
560 current_config = NULL;
561
562 return ret;
563 }
564
565 static int do_lxcapi_console_log(struct lxc_container *c, struct lxc_console_log *log)
566 {
567 int ret;
568
569 if (!c)
570 return -EINVAL;
571
572 ret = lxc_cmd_console_log(c->name, do_lxcapi_get_config_path(c), log);
573 if (ret < 0) {
574 if (ret == -ENODATA)
575 NOTICE("The console log is empty");
576 else if (ret == -EFAULT)
577 NOTICE("The container does not keep a console log");
578 else if (ret == -ENOENT)
579 NOTICE("The container does not keep a console log file");
580 else if (ret == -EIO)
581 NOTICE("Failed to write console log to log file");
582 else
583 ERROR("Failed to retrieve console log");
584 }
585
586 return ret;
587 }
588
589 WRAP_API_1(int, lxcapi_console_log, struct lxc_console_log *)
590
591 static pid_t do_lxcapi_init_pid(struct lxc_container *c)
592 {
593 if (!c)
594 return -1;
595
596 return lxc_cmd_get_init_pid(c->name, c->config_path);
597 }
598
599 WRAP_API(pid_t, lxcapi_init_pid)
600
601 static int do_lxcapi_init_pidfd(struct lxc_container *c)
602 {
603 if (!c)
604 return ret_errno(EBADF);
605
606 return lxc_cmd_get_init_pidfd(c->name, c->config_path);
607 }
608
609 WRAP_API(int, lxcapi_init_pidfd)
610
611 static int do_lxcapi_devpts_fd(struct lxc_container *c)
612 {
613 if (!c)
614 return ret_errno(EBADF);
615
616 return lxc_cmd_get_devpts_fd(c->name, c->config_path);
617 }
618
619 WRAP_API(int, lxcapi_devpts_fd)
620
621 static bool load_config_locked(struct lxc_container *c, const char *fname)
622 {
623 if (!c->lxc_conf)
624 c->lxc_conf = lxc_conf_init();
625
626 if (!c->lxc_conf)
627 return false;
628
629 if (lxc_config_read(fname, c->lxc_conf, false) != 0)
630 return false;
631
632 c->lxc_conf->name = c->name;
633 return true;
634 }
635
636 static bool do_lxcapi_load_config(struct lxc_container *c, const char *alt_file)
637 {
638 int lret;
639 const char *fname;
640 bool need_disklock = false, ret = false;
641
642 if (!c)
643 return false;
644
645 fname = c->configfile;
646
647 if (alt_file)
648 fname = alt_file;
649
650 if (!fname)
651 return false;
652
653 /* If we're reading something other than the container's config, we only
654 * need to lock the in-memory container. If loading the container's
655 * config file, take the disk lock.
656 */
657 if (strcmp(fname, c->configfile) == 0)
658 need_disklock = true;
659
660 if (need_disklock)
661 lret = container_disk_lock(c);
662 else
663 lret = container_mem_lock(c);
664 if (lret)
665 return false;
666
667 ret = load_config_locked(c, fname);
668
669 if (need_disklock)
670 container_disk_unlock(c);
671 else
672 container_mem_unlock(c);
673
674 return ret;
675 }
676
677 WRAP_API_1(bool, lxcapi_load_config, const char *)
678
679 static bool do_lxcapi_want_daemonize(struct lxc_container *c, bool state)
680 {
681 if (!c || !c->lxc_conf)
682 return false;
683
684 if (container_mem_lock(c))
685 return false;
686
687 c->daemonize = state;
688
689 container_mem_unlock(c);
690
691 return true;
692 }
693
694 WRAP_API_1(bool, lxcapi_want_daemonize, bool)
695
696 static bool do_lxcapi_want_close_all_fds(struct lxc_container *c, bool state)
697 {
698 if (!c || !c->lxc_conf)
699 return false;
700
701 if (container_mem_lock(c))
702 return false;
703
704 c->lxc_conf->close_all_fds = state;
705
706 container_mem_unlock(c);
707
708 return true;
709 }
710
711 WRAP_API_1(bool, lxcapi_want_close_all_fds, bool)
712
713 static bool do_lxcapi_wait(struct lxc_container *c, const char *state,
714 int timeout)
715 {
716 int ret;
717
718 if (!c)
719 return false;
720
721 ret = lxc_wait(c->name, state, timeout, c->config_path);
722 return ret == 0;
723 }
724
725 WRAP_API_2(bool, lxcapi_wait, const char *, int)
726
727 static bool am_single_threaded(void)
728 {
729 __do_closedir DIR *dir = NULL;
730 struct dirent *direntp;
731 int count = 0;
732
733 dir = opendir("/proc/self/task");
734 if (!dir)
735 return false;
736
737 while ((direntp = readdir(dir))) {
738 if (strcmp(direntp->d_name, ".") == 0)
739 continue;
740
741 if (strcmp(direntp->d_name, "..") == 0)
742 continue;
743
744 count++;
745 if (count > 1)
746 break;
747 }
748
749 return count == 1;
750 }
751
752 static void push_arg(char ***argp, char *arg, int *nargs)
753 {
754 char *copy;
755 char **argv;
756
757 copy = must_copy_string(arg);
758
759 do {
760 argv = realloc(*argp, (*nargs + 2) * sizeof(char *));
761 } while (!argv);
762
763 *argp = argv;
764 argv[*nargs] = copy;
765 (*nargs)++;
766 argv[*nargs] = NULL;
767 }
768
769 static char **split_init_cmd(const char *incmd)
770 {
771 __do_free char *copy = NULL;
772 char *p;
773 char **argv;
774 int nargs = 0;
775
776 if (!incmd)
777 return NULL;
778
779 copy = must_copy_string(incmd);
780
781 do {
782 argv = malloc(sizeof(char *));
783 } while (!argv);
784
785 argv[0] = NULL;
786 lxc_iterate_parts (p, copy, " ")
787 push_arg(&argv, p, &nargs);
788
789 if (nargs == 0) {
790 free(argv);
791 return NULL;
792 }
793
794 return argv;
795 }
796
797 static void free_init_cmd(char **argv)
798 {
799 int i = 0;
800
801 if (!argv)
802 return;
803
804 while (argv[i])
805 free(argv[i++]);
806
807 free(argv);
808 }
809
810 static int lxc_rcv_status(int state_socket)
811 {
812 int ret;
813 int state = -1;
814
815 again:
816 /* Receive container state. */
817 ret = lxc_abstract_unix_rcv_credential(state_socket, &state, sizeof(int));
818 if (ret <= 0) {
819 if (errno != EINTR)
820 return -1;
821
822 TRACE("Caught EINTR; retrying");
823 goto again;
824 }
825
826 return state;
827 }
828
829 static bool wait_on_daemonized_start(struct lxc_handler *handler, int pid)
830 {
831 int ret, state;
832
833 /* The first child is going to fork() again and then exits. So we reap
834 * the first child here.
835 */
836 ret = wait_for_pid(pid);
837 if (ret < 0)
838 DEBUG("Failed waiting on first child %d", pid);
839 else
840 DEBUG("First child %d exited", pid);
841
842 /* Close write end of the socket pair. */
843 close_prot_errno_disarm(handler->state_socket_pair[1]);
844
845 state = lxc_rcv_status(handler->state_socket_pair[0]);
846
847 /* Close read end of the socket pair. */
848 close_prot_errno_disarm(handler->state_socket_pair[0]);
849
850 if (state < 0) {
851 SYSERROR("Failed to receive the container state");
852 return false;
853 }
854
855 /* If we receive anything else then running we know that the container
856 * failed to start.
857 */
858 if (state != RUNNING) {
859 ERROR("Received container state \"%s\" instead of \"RUNNING\"",
860 lxc_state2str(state));
861 return false;
862 }
863
864 TRACE("Container is in \"RUNNING\" state");
865 return true;
866 }
867
868 static bool do_lxcapi_start(struct lxc_container *c, int useinit, char * const argv[])
869 {
870 int ret;
871 struct lxc_handler *handler;
872 struct lxc_conf *conf;
873 char *default_args[] = {
874 "/sbin/init",
875 NULL,
876 };
877 char **init_cmd = NULL;
878
879 /* container does exist */
880 if (!c)
881 return false;
882
883 /* If anything fails before we set error_num, we want an error in there.
884 */
885 c->error_num = 1;
886
887 /* Container has not been setup. */
888 if (!c->lxc_conf)
889 return false;
890
891 ret = ongoing_create(c);
892 switch (ret) {
893 case LXC_CREATE_FAILED:
894 ERROR("Failed checking for incomplete container creation");
895 return false;
896 case LXC_CREATE_ONGOING:
897 ERROR("Ongoing container creation detected");
898 return false;
899 case LXC_CREATE_INCOMPLETE:
900 ERROR("Failed to create container");
901 do_lxcapi_destroy(c);
902 return false;
903 }
904
905 if (container_mem_lock(c))
906 return false;
907
908 conf = c->lxc_conf;
909
910 /* initialize handler */
911 handler = lxc_init_handler(NULL, c->name, conf, c->config_path, c->daemonize);
912
913 container_mem_unlock(c);
914 if (!handler)
915 return false;
916
917 if (!argv) {
918 if (useinit && conf->execute_cmd)
919 argv = init_cmd = split_init_cmd(conf->execute_cmd);
920 else
921 argv = init_cmd = split_init_cmd(conf->init_cmd);
922 }
923
924 /* ... otherwise use default_args. */
925 if (!argv) {
926 if (useinit) {
927 ERROR("No valid init detected");
928 lxc_put_handler(handler);
929 return false;
930 }
931 argv = default_args;
932 }
933
934 /* I'm not sure what locks we want here.Any? Is liblxc's locking enough
935 * here to protect the on disk container? We don't want to exclude
936 * things like lxc_info while the container is running.
937 */
938 if (c->daemonize) {
939 bool started;
940 char title[2048];
941 pid_t pid_first, pid_second;
942
943 pid_first = fork();
944 if (pid_first < 0) {
945 free_init_cmd(init_cmd);
946 lxc_put_handler(handler);
947 return false;
948 }
949
950 /* first parent */
951 if (pid_first != 0) {
952 /* Set to NULL because we don't want father unlink
953 * the PID file, child will do the free and unlink.
954 */
955 c->pidfile = NULL;
956
957 /* Wait for container to tell us whether it started
958 * successfully.
959 */
960 started = wait_on_daemonized_start(handler, pid_first);
961
962 free_init_cmd(init_cmd);
963 lxc_put_handler(handler);
964 return started;
965 }
966
967 /* first child */
968
969 /* We don't really care if this doesn't print all the
970 * characters. All that it means is that the proctitle will be
971 * ugly. Similarly, we also don't care if setproctitle() fails.
972 */
973 ret = snprintf(title, sizeof(title), "[lxc monitor] %s %s", c->config_path, c->name);
974 if (ret > 0) {
975 ret = setproctitle(title);
976 if (ret < 0)
977 INFO("Failed to set process title to %s", title);
978 else
979 INFO("Set process title to %s", title);
980 }
981
982 /* We fork() a second time to be reparented to init. Like
983 * POSIX's daemon() function we change to "/" and redirect
984 * std{in,out,err} to /dev/null.
985 */
986 pid_second = fork();
987 if (pid_second < 0) {
988 SYSERROR("Failed to fork first child process");
989 _exit(EXIT_FAILURE);
990 }
991
992 /* second parent */
993 if (pid_second != 0) {
994 free_init_cmd(init_cmd);
995 lxc_put_handler(handler);
996 _exit(EXIT_SUCCESS);
997 }
998
999 /* second child */
1000
1001 /* change to / directory */
1002 ret = chdir("/");
1003 if (ret < 0) {
1004 SYSERROR("Failed to change to \"/\" directory");
1005 _exit(EXIT_FAILURE);
1006 }
1007
1008 ret = inherit_fds(handler, true);
1009 if (ret < 0)
1010 _exit(EXIT_FAILURE);
1011
1012 /* redirect std{in,out,err} to /dev/null */
1013 ret = null_stdfds();
1014 if (ret < 0) {
1015 ERROR("Failed to redirect std{in,out,err} to /dev/null");
1016 _exit(EXIT_FAILURE);
1017 }
1018
1019 /* become session leader */
1020 ret = setsid();
1021 if (ret < 0)
1022 TRACE("Process %d is already process group leader", lxc_raw_getpid());
1023 } else if (!am_single_threaded()) {
1024 ERROR("Cannot start non-daemonized container when threaded");
1025 free_init_cmd(init_cmd);
1026 lxc_put_handler(handler);
1027 return false;
1028 }
1029
1030 /* We need to write PID file after daemonize, so we always write the
1031 * right PID.
1032 */
1033 if (c->pidfile) {
1034 int w;
1035 char pidstr[INTTYPE_TO_STRLEN(pid_t)];
1036
1037 w = snprintf(pidstr, sizeof(pidstr), "%d", lxc_raw_getpid());
1038 if (w < 0 || (size_t)w >= sizeof(pidstr)) {
1039 free_init_cmd(init_cmd);
1040 lxc_put_handler(handler);
1041
1042 SYSERROR("Failed to write monitor pid to \"%s\"", c->pidfile);
1043
1044 if (c->daemonize)
1045 _exit(EXIT_FAILURE);
1046
1047 return false;
1048 }
1049
1050 ret = lxc_write_to_file(c->pidfile, pidstr, w, false, 0600);
1051 if (ret < 0) {
1052 free_init_cmd(init_cmd);
1053 lxc_put_handler(handler);
1054
1055 SYSERROR("Failed to write monitor pid to \"%s\"", c->pidfile);
1056
1057 if (c->daemonize)
1058 _exit(EXIT_FAILURE);
1059
1060 return false;
1061 }
1062 }
1063
1064 conf->reboot = REBOOT_NONE;
1065
1066 /* Unshare the mount namespace if requested */
1067 if (conf->monitor_unshare) {
1068 ret = unshare(CLONE_NEWNS);
1069 if (ret < 0) {
1070 SYSERROR("Failed to unshare mount namespace");
1071 lxc_put_handler(handler);
1072 ret = 1;
1073 goto on_error;
1074 }
1075
1076 ret = mount(NULL, "/", NULL, MS_SLAVE|MS_REC, NULL);
1077 if (ret < 0) {
1078 SYSERROR("Failed to recursively turn root mount tree into dependent mount. Continuing...");
1079 lxc_put_handler(handler);
1080 ret = 1;
1081 goto on_error;
1082 }
1083 }
1084
1085 reboot:
1086 if (conf->reboot == REBOOT_INIT) {
1087 /* initialize handler */
1088 handler = lxc_init_handler(handler, c->name, conf, c->config_path, c->daemonize);
1089 if (!handler) {
1090 ret = 1;
1091 goto on_error;
1092 }
1093 }
1094
1095 ret = inherit_fds(handler, c->daemonize);
1096 if (ret < 0) {
1097 lxc_put_handler(handler);
1098 ret = 1;
1099 goto on_error;
1100 }
1101
1102 if (useinit)
1103 ret = lxc_execute(c->name, argv, 1, handler, c->config_path,
1104 c->daemonize, &c->error_num);
1105 else
1106 ret = lxc_start(argv, handler, c->config_path, c->daemonize,
1107 &c->error_num);
1108
1109 if (conf->reboot == REBOOT_REQ) {
1110 INFO("Container requested reboot");
1111 conf->reboot = REBOOT_INIT;
1112 goto reboot;
1113 }
1114
1115 on_error:
1116 if (c->pidfile) {
1117 unlink(c->pidfile);
1118 free(c->pidfile);
1119 c->pidfile = NULL;
1120 }
1121 free_init_cmd(init_cmd);
1122
1123 if (c->daemonize && ret != 0)
1124 _exit(EXIT_FAILURE);
1125 else if (c->daemonize)
1126 _exit(EXIT_SUCCESS);
1127
1128 if (ret != 0)
1129 return false;
1130
1131 return true;
1132 }
1133
1134 static bool lxcapi_start(struct lxc_container *c, int useinit,
1135 char *const argv[])
1136 {
1137 bool ret;
1138
1139 current_config = c ? c->lxc_conf : NULL;
1140 ret = do_lxcapi_start(c, useinit, argv);
1141 current_config = NULL;
1142
1143 return ret;
1144 }
1145
1146 /* Note, there MUST be an ending NULL. */
1147 static bool lxcapi_startl(struct lxc_container *c, int useinit, ...)
1148 {
1149 va_list ap;
1150 char **inargs = NULL;
1151 bool bret = false;
1152
1153 /* container exists */
1154 if (!c)
1155 return false;
1156
1157 current_config = c->lxc_conf;
1158
1159 va_start(ap, useinit);
1160 inargs = lxc_va_arg_list_to_argv(ap, 0, 1);
1161 va_end(ap);
1162 if (!inargs)
1163 goto on_error;
1164
1165 /* pass NULL if no arguments were supplied */
1166 bret = do_lxcapi_start(c, useinit, *inargs ? inargs : NULL);
1167
1168 on_error:
1169 if (inargs) {
1170 char **arg;
1171
1172 for (arg = inargs; *arg; arg++)
1173 free(*arg);
1174 free(inargs);
1175 }
1176
1177 current_config = NULL;
1178
1179 return bret;
1180 }
1181
1182 static bool do_lxcapi_stop(struct lxc_container *c)
1183 {
1184 int ret;
1185
1186 if (!c)
1187 return false;
1188
1189 ret = lxc_cmd_stop(c->name, c->config_path);
1190
1191 return ret == 0;
1192 }
1193
1194 WRAP_API(bool, lxcapi_stop)
1195
1196 static int do_create_container_dir(const char *path, struct lxc_conf *conf)
1197 {
1198 int lasterr;
1199 int ret = -1;
1200
1201 mode_t mask = umask(0002);
1202 ret = mkdir(path, 0770);
1203 lasterr = errno;
1204 umask(mask);
1205 errno = lasterr;
1206 if (ret) {
1207 if (errno != EEXIST)
1208 return -1;
1209
1210 ret = 0;
1211 }
1212
1213 if (!lxc_list_empty(&conf->id_map)) {
1214 ret = chown_mapped_root(path, conf);
1215 if (ret < 0)
1216 ret = -1;
1217 }
1218
1219 return ret;
1220 }
1221
1222 /* Create the standard expected container dir. */
1223 static bool create_container_dir(struct lxc_container *c)
1224 {
1225 int ret;
1226 size_t len;
1227 char *s;
1228
1229 len = strlen(c->config_path) + strlen(c->name) + 2;
1230 s = malloc(len);
1231 if (!s)
1232 return false;
1233
1234 ret = snprintf(s, len, "%s/%s", c->config_path, c->name);
1235 if (ret < 0 || (size_t)ret >= len) {
1236 free(s);
1237 return false;
1238 }
1239
1240 ret = do_create_container_dir(s, c->lxc_conf);
1241 free(s);
1242
1243 return ret == 0;
1244 }
1245
1246 /* do_storage_create: thin wrapper around storage_create(). Like
1247 * storage_create(), it returns a mounted bdev on success, NULL on error.
1248 */
1249 static struct lxc_storage *do_storage_create(struct lxc_container *c,
1250 const char *type,
1251 struct bdev_specs *specs)
1252 {
1253 __do_free char *dest = NULL;
1254 int ret;
1255 size_t len;
1256 struct lxc_storage *bdev;
1257
1258 /* rootfs.path or lxcpath/lxcname/rootfs */
1259 if (c->lxc_conf->rootfs.path &&
1260 (access(c->lxc_conf->rootfs.path, F_OK) == 0)) {
1261 const char *rpath = c->lxc_conf->rootfs.path;
1262 len = strlen(rpath) + 1;
1263 dest = must_realloc(NULL, len);
1264 ret = snprintf(dest, len, "%s", rpath);
1265 } else {
1266 const char *lxcpath = do_lxcapi_get_config_path(c);
1267 len = strlen(c->name) + 1 + strlen(lxcpath) + 1 + strlen(LXC_ROOTFS_DNAME) + 1;
1268 dest = must_realloc(NULL, len);
1269 ret = snprintf(dest, len, "%s/%s/%s", lxcpath, c->name, LXC_ROOTFS_DNAME);
1270 }
1271 if (ret < 0 || (size_t)ret >= len)
1272 return NULL;
1273
1274 bdev = storage_create(dest, type, c->name, specs, c->lxc_conf);
1275 if (!bdev) {
1276 ERROR("Failed to create \"%s\" storage", type);
1277 return NULL;
1278 }
1279
1280 if (!c->set_config_item(c, "lxc.rootfs.path", bdev->src)) {
1281 ERROR("Failed to set \"lxc.rootfs.path = %s\"", bdev->src);
1282 storage_put(bdev);
1283 return NULL;
1284 }
1285
1286 /* If we are not root, chown the rootfs dir to root in the target user
1287 * namespace.
1288 */
1289 if (am_guest_unpriv() || !lxc_list_empty(&c->lxc_conf->id_map)) {
1290 ret = chown_mapped_root(bdev->dest, c->lxc_conf);
1291 if (ret < 0) {
1292 ERROR("Error chowning \"%s\" to container root", bdev->dest);
1293 suggest_default_idmap();
1294 storage_put(bdev);
1295 return NULL;
1296 }
1297 }
1298
1299 return bdev;
1300 }
1301
1302 /* Strip path and return name of file for argv[0] passed to execvp */
1303 static char *lxctemplatefilename(char *tpath)
1304 {
1305 char *p;
1306
1307 p = tpath + strlen(tpath) - 1;
1308 while ( (p-1) >= tpath && *(p-1) != '/')
1309 p--;
1310
1311 return p;
1312 }
1313
1314 static bool create_run_template(struct lxc_container *c, char *tpath,
1315 bool need_null_stdfds, char *const argv[])
1316 {
1317 int ret;
1318 pid_t pid;
1319
1320 if (!tpath)
1321 return true;
1322
1323 pid = fork();
1324 if (pid < 0) {
1325 SYSERROR("Failed to fork task for container creation template");
1326 return false;
1327 }
1328
1329 if (pid == 0) { /* child */
1330 int i, len;
1331 char *namearg, *patharg, *rootfsarg;
1332 char **newargv;
1333 int nargs = 0;
1334 struct lxc_storage *bdev = NULL;
1335 struct lxc_conf *conf = c->lxc_conf;
1336 uid_t euid;
1337
1338 if (need_null_stdfds) {
1339 ret = null_stdfds();
1340 if (ret < 0)
1341 _exit(EXIT_FAILURE);
1342 }
1343
1344 bdev = storage_init(c->lxc_conf);
1345 if (!bdev) {
1346 ERROR("Failed to initialize storage");
1347 _exit(EXIT_FAILURE);
1348 }
1349
1350 euid = geteuid();
1351 if (euid == 0) {
1352 ret = unshare(CLONE_NEWNS);
1353 if (ret < 0) {
1354 ERROR("Failed to unshare CLONE_NEWNS");
1355 _exit(EXIT_FAILURE);
1356 }
1357
1358 if (detect_shared_rootfs() && mount(NULL, "/", NULL, MS_SLAVE | MS_REC, NULL))
1359 SYSERROR("Failed to recursively turn root mount tree into dependent mount. Continuing...");
1360 }
1361
1362 if (strcmp(bdev->type, "dir") != 0 && strcmp(bdev->type, "btrfs") != 0) {
1363 if (euid != 0) {
1364 ERROR("Unprivileged users can only create "
1365 "btrfs and directory-backed containers");
1366 _exit(EXIT_FAILURE);
1367 }
1368
1369 if (strcmp(bdev->type, "overlay") == 0 ||
1370 strcmp(bdev->type, "overlayfs") == 0) {
1371 /* If we create an overlay container we need to
1372 * rsync the contents into
1373 * <container-path>/<container-name>/rootfs.
1374 * However, the overlay mount function will
1375 * mount
1376 * <container-path>/<container-name>/delta0
1377 * over
1378 * <container-path>/<container-name>/rootfs
1379 * which means we would rsync the rootfs into
1380 * the delta directory. That doesn't make sense
1381 * since the delta directory only exists to
1382 * record the differences to
1383 * <container-path>/<container-name>/rootfs. So
1384 * let's simply bind-mount here and then rsync
1385 * directly into
1386 * <container-path>/<container-name>/rootfs.
1387 */
1388 char *src;
1389
1390 src = ovl_get_rootfs(bdev->src, &(size_t){0});
1391 if (!src) {
1392 ERROR("Failed to get rootfs");
1393 _exit(EXIT_FAILURE);
1394 }
1395
1396 ret = mount(src, bdev->dest, "bind", MS_BIND | MS_REC, NULL);
1397 if (ret < 0) {
1398 ERROR("Failed to mount rootfs");
1399 _exit(EXIT_FAILURE);
1400 }
1401 } else {
1402 ret = bdev->ops->mount(bdev);
1403 if (ret < 0) {
1404 ERROR("Failed to mount rootfs");
1405 _exit(EXIT_FAILURE);
1406 }
1407 }
1408 } else { /* TODO come up with a better way here! */
1409 const char *src;
1410 free(bdev->dest);
1411 src = lxc_storage_get_path(bdev->src, bdev->type);
1412 bdev->dest = strdup(src);
1413 }
1414
1415 /* Create our new array, pre-pend the template name and base
1416 * args.
1417 */
1418 if (argv)
1419 for (nargs = 0; argv[nargs]; nargs++)
1420 ;
1421
1422 /* template, path, rootfs and name args */
1423 nargs += 4;
1424
1425 newargv = malloc(nargs * sizeof(*newargv));
1426 if (!newargv)
1427 _exit(EXIT_FAILURE);
1428 newargv[0] = lxctemplatefilename(tpath);
1429
1430 /* --path */
1431 len = strlen(c->config_path) + strlen(c->name) + strlen("--path=") + 2;
1432 patharg = malloc(len);
1433 if (!patharg)
1434 _exit(EXIT_FAILURE);
1435
1436 ret = snprintf(patharg, len, "--path=%s/%s", c->config_path, c->name);
1437 if (ret < 0 || ret >= len)
1438 _exit(EXIT_FAILURE);
1439 newargv[1] = patharg;
1440
1441 /* --name */
1442 len = strlen("--name=") + strlen(c->name) + 1;
1443 namearg = malloc(len);
1444 if (!namearg)
1445 _exit(EXIT_FAILURE);
1446
1447 ret = snprintf(namearg, len, "--name=%s", c->name);
1448 if (ret < 0 || ret >= len)
1449 _exit(EXIT_FAILURE);
1450 newargv[2] = namearg;
1451
1452 /* --rootfs */
1453 len = strlen("--rootfs=") + 1 + strlen(bdev->dest);
1454 rootfsarg = malloc(len);
1455 if (!rootfsarg)
1456 _exit(EXIT_FAILURE);
1457
1458 ret = snprintf(rootfsarg, len, "--rootfs=%s", bdev->dest);
1459 if (ret < 0 || ret >= len)
1460 _exit(EXIT_FAILURE);
1461 newargv[3] = rootfsarg;
1462
1463 /* add passed-in args */
1464 if (argv)
1465 for (i = 4; i < nargs; i++)
1466 newargv[i] = argv[i - 4];
1467
1468 /* add trailing NULL */
1469 nargs++;
1470 newargv = realloc(newargv, nargs * sizeof(*newargv));
1471 if (!newargv)
1472 _exit(EXIT_FAILURE);
1473 newargv[nargs - 1] = NULL;
1474
1475 /* If we're running the template in a mapped userns, then we
1476 * prepend the template command with: lxc-usernsexec <-m map1>
1477 * ... <-m mapn> -- and we append "--mapped-uid x", where x is
1478 * the mapped uid for our geteuid()
1479 */
1480 if (!lxc_list_empty(&conf->id_map)) {
1481 int extraargs, hostuid_mapped, hostgid_mapped;
1482 char **n2;
1483 char txtuid[20], txtgid[20];
1484 struct lxc_list *it;
1485 struct id_map *map;
1486 int n2args = 1;
1487
1488 n2 = malloc(n2args * sizeof(*n2));
1489 if (!n2)
1490 _exit(EXIT_FAILURE);
1491
1492 newargv[0] = tpath;
1493 tpath = "lxc-usernsexec";
1494 n2[0] = "lxc-usernsexec";
1495
1496 lxc_list_for_each(it, &conf->id_map) {
1497 map = it->elem;
1498 n2args += 2;
1499 n2 = realloc(n2, n2args * sizeof(char *));
1500 if (!n2)
1501 _exit(EXIT_FAILURE);
1502
1503 n2[n2args - 2] = "-m";
1504 n2[n2args - 1] = malloc(200);
1505 if (!n2[n2args - 1])
1506 _exit(EXIT_FAILURE);
1507
1508 ret = snprintf(n2[n2args - 1], 200, "%c:%lu:%lu:%lu",
1509 map->idtype == ID_TYPE_UID ? 'u' : 'g',
1510 map->nsid, map->hostid, map->range);
1511 if (ret < 0 || ret >= 200)
1512 _exit(EXIT_FAILURE);
1513 }
1514
1515 hostuid_mapped = mapped_hostid(geteuid(), conf, ID_TYPE_UID);
1516 extraargs = hostuid_mapped >= 0 ? 1 : 3;
1517
1518 n2 = realloc(n2, (nargs + n2args + extraargs) * sizeof(char *));
1519 if (!n2)
1520 _exit(EXIT_FAILURE);
1521
1522 if (hostuid_mapped < 0) {
1523 hostuid_mapped = find_unmapped_nsid(conf, ID_TYPE_UID);
1524 n2[n2args++] = "-m";
1525 if (hostuid_mapped < 0) {
1526 ERROR("Failed to find free uid to map");
1527 _exit(EXIT_FAILURE);
1528 }
1529
1530 n2[n2args++] = malloc(200);
1531 if (!n2[n2args - 1]) {
1532 SYSERROR("out of memory");
1533 _exit(EXIT_FAILURE);
1534 }
1535
1536 ret = snprintf(n2[n2args - 1], 200, "u:%d:%d:1",
1537 hostuid_mapped, geteuid());
1538 if (ret < 0 || ret >= 200)
1539 _exit(EXIT_FAILURE);
1540 }
1541
1542 hostgid_mapped = mapped_hostid(getegid(), conf, ID_TYPE_GID);
1543 extraargs = hostgid_mapped >= 0 ? 1 : 3;
1544
1545 n2 = realloc(n2, (nargs + n2args + extraargs) * sizeof(char *));
1546 if (!n2)
1547 _exit(EXIT_FAILURE);
1548
1549 if (hostgid_mapped < 0) {
1550 hostgid_mapped = find_unmapped_nsid(conf, ID_TYPE_GID);
1551 n2[n2args++] = "-m";
1552 if (hostgid_mapped < 0) {
1553 ERROR("Failed to find free gid to map");
1554 _exit(EXIT_FAILURE);
1555 }
1556
1557 n2[n2args++] = malloc(200);
1558 if (!n2[n2args - 1]) {
1559 SYSERROR("out of memory");
1560 _exit(EXIT_FAILURE);
1561 }
1562
1563 ret = snprintf(n2[n2args - 1], 200, "g:%d:%d:1",
1564 hostgid_mapped, getegid());
1565 if (ret < 0 || ret >= 200)
1566 _exit(EXIT_FAILURE);
1567 }
1568
1569 n2[n2args++] = "--";
1570
1571 for (i = 0; i < nargs; i++)
1572 n2[i + n2args] = newargv[i];
1573 n2args += nargs;
1574
1575 /* Finally add "--mapped-uid $uid" to tell template what
1576 * to chown cached images to.
1577 */
1578 n2args += 4;
1579 n2 = realloc(n2, n2args * sizeof(char *));
1580 if (!n2)
1581 _exit(EXIT_FAILURE);
1582
1583 /* note n2[n2args-1] is NULL */
1584 n2[n2args - 5] = "--mapped-uid";
1585
1586 ret = snprintf(txtuid, 20, "%d", hostuid_mapped);
1587 if (ret < 0 || ret >= 20) {
1588 free(newargv);
1589 free(n2);
1590 _exit(EXIT_FAILURE);
1591 }
1592
1593 n2[n2args - 4] = txtuid;
1594 n2[n2args - 3] = "--mapped-gid";
1595
1596 ret = snprintf(txtgid, 20, "%d", hostgid_mapped);
1597 if (ret < 0 || ret >= 20) {
1598 free(newargv);
1599 free(n2);
1600 _exit(EXIT_FAILURE);
1601 }
1602
1603 n2[n2args - 2] = txtgid;
1604 n2[n2args - 1] = NULL;
1605 free(newargv);
1606 newargv = n2;
1607 }
1608
1609 execvp(tpath, newargv);
1610 SYSERROR("Failed to execute template %s", tpath);
1611 _exit(EXIT_FAILURE);
1612 }
1613
1614 ret = wait_for_pid(pid);
1615 if (ret != 0) {
1616 ERROR("Failed to create container from template");
1617 return false;
1618 }
1619
1620 return true;
1621 }
1622
1623 static bool prepend_lxc_header(char *path, const char *t, char *const argv[])
1624 {
1625 long flen;
1626 size_t len;
1627 char *contents;
1628 FILE *f;
1629 int ret = -1;
1630 #if HAVE_OPENSSL
1631 int i;
1632 unsigned int md_len = 0;
1633 unsigned char md_value[EVP_MAX_MD_SIZE];
1634 char *tpath;
1635 #endif
1636
1637 f = fopen(path, "re");
1638 if (f == NULL)
1639 return false;
1640
1641 ret = fseek(f, 0, SEEK_END);
1642 if (ret < 0)
1643 goto out_error;
1644
1645 ret = -1;
1646 flen = ftell(f);
1647 if (flen < 0)
1648 goto out_error;
1649
1650 ret = fseek(f, 0, SEEK_SET);
1651 if (ret < 0)
1652 goto out_error;
1653
1654 ret = fseek(f, 0, SEEK_SET);
1655 if (ret < 0)
1656 goto out_error;
1657
1658 ret = -1;
1659 contents = malloc(flen + 1);
1660 if (!contents)
1661 goto out_error;
1662
1663 len = fread(contents, 1, flen, f);
1664 if (len != flen)
1665 goto out_free_contents;
1666
1667 contents[flen] = '\0';
1668
1669 ret = fclose(f);
1670 f = NULL;
1671 if (ret < 0)
1672 goto out_free_contents;
1673
1674 #if HAVE_OPENSSL
1675 tpath = get_template_path(t);
1676 if (!tpath) {
1677 ERROR("Invalid template \"%s\" specified", t);
1678 goto out_free_contents;
1679 }
1680
1681 ret = sha1sum_file(tpath, md_value, &md_len);
1682 if (ret < 0) {
1683 ERROR("Failed to get sha1sum of %s", tpath);
1684 free(tpath);
1685 goto out_free_contents;
1686 }
1687 free(tpath);
1688 #endif
1689
1690 f = fopen(path, "we");
1691 if (f == NULL) {
1692 SYSERROR("Reopening config for writing");
1693 free(contents);
1694 return false;
1695 }
1696
1697 fprintf(f, "# Template used to create this container: %s\n", t);
1698 if (argv) {
1699 fprintf(f, "# Parameters passed to the template:");
1700 while (*argv) {
1701 fprintf(f, " %s", *argv);
1702 argv++;
1703 }
1704 fprintf(f, "\n");
1705 }
1706
1707 #if HAVE_OPENSSL
1708 fprintf(f, "# Template script checksum (SHA-1): ");
1709 for (i=0; i<md_len; i++)
1710 fprintf(f, "%02x", md_value[i]);
1711 fprintf(f, "\n");
1712 #endif
1713 fprintf(f, "# For additional config options, please look at lxc.container.conf(5)\n");
1714 fprintf(f, "\n# Uncomment the following line to support nesting containers:\n");
1715 fprintf(f, "#lxc.include = " LXCTEMPLATECONFIG "/nesting.conf\n");
1716 fprintf(f, "# (Be aware this has security implications)\n\n");
1717 if (fwrite(contents, 1, flen, f) != flen) {
1718 SYSERROR("Writing original contents");
1719 free(contents);
1720 fclose(f);
1721 return false;
1722 }
1723
1724 ret = 0;
1725
1726 out_free_contents:
1727 free(contents);
1728
1729 out_error:
1730 if (f) {
1731 int newret;
1732 newret = fclose(f);
1733 if (ret == 0)
1734 ret = newret;
1735 }
1736
1737 if (ret < 0) {
1738 SYSERROR("Error prepending header");
1739 return false;
1740 }
1741
1742 return true;
1743 }
1744
1745 static void lxcapi_clear_config(struct lxc_container *c)
1746 {
1747 if (!c || !c->lxc_conf)
1748 return;
1749
1750 lxc_conf_free(c->lxc_conf);
1751 c->lxc_conf = NULL;
1752 }
1753
1754 #define do_lxcapi_clear_config(c) lxcapi_clear_config(c)
1755
1756 /*
1757 * lxcapi_create:
1758 * create a container with the given parameters.
1759 * @c: container to be created. It has the lxcpath, name, and a starting
1760 * configuration already set
1761 * @t: the template to execute to instantiate the root filesystem and
1762 * adjust the configuration.
1763 * @bdevtype: backing store type to use. If NULL, dir will be used.
1764 * @specs: additional parameters for the backing store, i.e. LVM vg to
1765 * use.
1766 *
1767 * @argv: the arguments to pass to the template, terminated by NULL. If no
1768 * arguments, you can just pass NULL.
1769 */
1770 static bool do_lxcapi_create(struct lxc_container *c, const char *t,
1771 const char *bdevtype, struct bdev_specs *specs,
1772 int flags, char *const argv[])
1773 {
1774 int partial_fd;
1775 mode_t mask;
1776 pid_t pid;
1777 bool ret = false, rootfs_managed = true;
1778 char *tpath = NULL;
1779
1780 if (!c)
1781 return false;
1782
1783 if (t) {
1784 tpath = get_template_path(t);
1785 if (!tpath) {
1786 ERROR("Unknown template \"%s\"", t);
1787 goto out;
1788 }
1789 }
1790
1791 /* If a template is passed in, and the rootfs already is defined in the
1792 * container config and exists, then the caller is trying to create an
1793 * existing container. Return an error, but do NOT delete the container.
1794 */
1795 if (do_lxcapi_is_defined(c) && c->lxc_conf && c->lxc_conf->rootfs.path &&
1796 access(c->lxc_conf->rootfs.path, F_OK) == 0 && tpath) {
1797 ERROR("Container \"%s\" already exists in \"%s\"", c->name,
1798 c->config_path);
1799 goto free_tpath;
1800 }
1801
1802 if (!c->lxc_conf) {
1803 if (!do_lxcapi_load_config(c, lxc_global_config_value("lxc.default_config"))) {
1804 ERROR("Error loading default configuration file %s",
1805 lxc_global_config_value("lxc.default_config"));
1806 goto free_tpath;
1807 }
1808 }
1809
1810 if (!create_container_dir(c))
1811 goto free_tpath;
1812
1813 if (c->lxc_conf->rootfs.path)
1814 rootfs_managed = false;
1815
1816 /* If both template and rootfs.path are set, template is setup as
1817 * rootfs.path. The container is already created if we have a config and
1818 * rootfs.path is accessible
1819 */
1820 if (!c->lxc_conf->rootfs.path && !tpath) {
1821 /* No template passed in and rootfs does not exist. */
1822 if (!c->save_config(c, NULL)) {
1823 ERROR("Failed to save initial config for \"%s\"", c->name);
1824 goto out;
1825 }
1826 ret = true;
1827 goto out;
1828 }
1829
1830 /* Rootfs passed into configuration, but does not exist. */
1831 if (c->lxc_conf->rootfs.path && access(c->lxc_conf->rootfs.path, F_OK) != 0)
1832 goto out;
1833
1834 if (do_lxcapi_is_defined(c) && c->lxc_conf->rootfs.path && !tpath) {
1835 /* Rootfs already existed, user just wanted to save the loaded
1836 * configuration.
1837 */
1838 if (!c->save_config(c, NULL))
1839 ERROR("Failed to save initial config for \"%s\"", c->name);
1840
1841 ret = true;
1842 goto out;
1843 }
1844
1845 /* Mark that this container is being created */
1846 partial_fd = create_partial(c);
1847 if (partial_fd < 0)
1848 goto out;
1849
1850 /* No need to get disk lock bc we have the partial lock. */
1851
1852 mask = umask(0022);
1853
1854 /* Create the storage.
1855 * Note we can't do this in the same task as we use to execute the
1856 * template because of the way zfs works.
1857 * After you 'zfs create', zfs mounts the fs only in the initial
1858 * namespace.
1859 */
1860 pid = fork();
1861 if (pid < 0) {
1862 SYSERROR("Failed to fork task for container creation template");
1863 goto out_unlock;
1864 }
1865
1866 if (pid == 0) { /* child */
1867 struct lxc_storage *bdev = NULL;
1868
1869 bdev = do_storage_create(c, bdevtype, specs);
1870 if (!bdev) {
1871 ERROR("Failed to create %s storage for %s",
1872 bdevtype ? bdevtype : "(none)", c->name);
1873 _exit(EXIT_FAILURE);
1874 }
1875
1876 /* Save config file again to store the new rootfs location. */
1877 if (!do_lxcapi_save_config(c, NULL)) {
1878 ERROR("Failed to save initial config for %s", c->name);
1879 /* Parent task won't see the storage driver in the
1880 * config so we delete it.
1881 */
1882 bdev->ops->umount(bdev);
1883 bdev->ops->destroy(bdev);
1884 _exit(EXIT_FAILURE);
1885 }
1886
1887 _exit(EXIT_SUCCESS);
1888 }
1889
1890 if (wait_for_pid(pid) != 0)
1891 goto out_unlock;
1892
1893 /* Reload config to get the rootfs. */
1894 lxc_conf_free(c->lxc_conf);
1895 c->lxc_conf = NULL;
1896
1897 if (!load_config_locked(c, c->configfile))
1898 goto out_unlock;
1899
1900 if (!create_run_template(c, tpath, !!(flags & LXC_CREATE_QUIET), argv))
1901 goto out_unlock;
1902
1903 /* Now clear out the lxc_conf we have, reload from the created
1904 * container.
1905 */
1906 do_lxcapi_clear_config(c);
1907
1908 if (t) {
1909 if (!prepend_lxc_header(c->configfile, tpath, argv)) {
1910 ERROR("Failed to prepend header to config file");
1911 goto out_unlock;
1912 }
1913 }
1914
1915 ret = load_config_locked(c, c->configfile);
1916
1917 out_unlock:
1918 umask(mask);
1919 remove_partial(c, partial_fd);
1920
1921 out:
1922 if (!ret) {
1923 bool reset_managed = c->lxc_conf->rootfs.managed;
1924
1925 /*
1926 * Ensure that we don't destroy storage we didn't create
1927 * ourselves.
1928 */
1929 if (!rootfs_managed)
1930 c->lxc_conf->rootfs.managed = false;
1931 container_destroy(c, NULL);
1932 c->lxc_conf->rootfs.managed = reset_managed;
1933 }
1934
1935 free_tpath:
1936 free(tpath);
1937 return ret;
1938 }
1939
1940 static bool lxcapi_create(struct lxc_container *c, const char *t,
1941 const char *bdevtype, struct bdev_specs *specs,
1942 int flags, char *const argv[])
1943 {
1944 bool ret;
1945
1946 current_config = c ? c->lxc_conf : NULL;
1947
1948 ret = do_lxcapi_create(c, t, bdevtype, specs, flags, argv);
1949 current_config = NULL;
1950 return ret;
1951 }
1952
1953 static bool do_lxcapi_reboot(struct lxc_container *c)
1954 {
1955 __do_close int pidfd = -EBADF;
1956 pid_t pid = -1;
1957 int ret;
1958 int rebootsignal = SIGINT;
1959
1960 if (!c)
1961 return false;
1962
1963 if (!do_lxcapi_is_running(c))
1964 return false;
1965
1966 pidfd = do_lxcapi_init_pidfd(c);
1967 if (pidfd < 0) {
1968 pid = do_lxcapi_init_pid(c);
1969 if (pid <= 0)
1970 return false;
1971 }
1972
1973 if (c->lxc_conf && c->lxc_conf->rebootsignal)
1974 rebootsignal = c->lxc_conf->rebootsignal;
1975
1976 if (pidfd >= 0)
1977 ret = lxc_raw_pidfd_send_signal(pidfd, rebootsignal, NULL, 0);
1978 else
1979 ret = kill(pid, rebootsignal);
1980 if (ret < 0)
1981 return log_warn(false, "Failed to send signal %d to pid %d",
1982 rebootsignal, pid);
1983
1984 return true;
1985 }
1986
1987 WRAP_API(bool, lxcapi_reboot)
1988
1989 static bool do_lxcapi_reboot2(struct lxc_container *c, int timeout)
1990 {
1991 __do_close int pidfd = -EBADF, state_client_fd = -EBADF;
1992 int rebootsignal = SIGINT;
1993 pid_t pid = -1;
1994 lxc_state_t states[MAX_STATE] = {0};
1995 int killret, ret;
1996
1997 if (!c)
1998 return false;
1999
2000 if (!do_lxcapi_is_running(c))
2001 return true;
2002
2003 pidfd = do_lxcapi_init_pidfd(c);
2004 if (pidfd < 0) {
2005 pid = do_lxcapi_init_pid(c);
2006 if (pid <= 0)
2007 return true;
2008 }
2009
2010 if (c->lxc_conf && c->lxc_conf->rebootsignal)
2011 rebootsignal = c->lxc_conf->rebootsignal;
2012
2013 /* Add a new state client before sending the shutdown signal so that we
2014 * don't miss a state.
2015 */
2016 if (timeout != 0) {
2017 states[RUNNING] = 2;
2018 ret = lxc_cmd_add_state_client(c->name, c->config_path, states,
2019 &state_client_fd);
2020 if (ret < 0)
2021 return false;
2022
2023 if (state_client_fd < 0)
2024 return false;
2025
2026 if (ret == RUNNING)
2027 return true;
2028
2029 if (ret < MAX_STATE)
2030 return false;
2031 }
2032
2033 /* Send reboot signal to container. */
2034 if (pidfd >= 0)
2035 killret = lxc_raw_pidfd_send_signal(pidfd, rebootsignal, NULL, 0);
2036 else
2037 killret = kill(pid, rebootsignal);
2038 if (killret < 0)
2039 return log_warn(false, "Failed to send signal %d to pid %d", rebootsignal, pid);
2040 TRACE("Sent signal %d to pid %d", rebootsignal, pid);
2041
2042 if (timeout == 0)
2043 return true;
2044
2045 ret = lxc_cmd_sock_rcv_state(state_client_fd, timeout);
2046 if (ret < 0)
2047 return false;
2048
2049 TRACE("Received state \"%s\"", lxc_state2str(ret));
2050 if (ret != RUNNING)
2051 return false;
2052
2053 return true;
2054 }
2055
2056 WRAP_API_1(bool, lxcapi_reboot2, int)
2057
2058 static bool do_lxcapi_shutdown(struct lxc_container *c, int timeout)
2059 {
2060 __do_close int pidfd = -EBADF, state_client_fd = -EBADF;
2061 int haltsignal = SIGPWR;
2062 pid_t pid = -1;
2063 lxc_state_t states[MAX_STATE] = {0};
2064 int killret, ret;
2065
2066 if (!c)
2067 return false;
2068
2069 if (!do_lxcapi_is_running(c))
2070 return true;
2071
2072 pidfd = do_lxcapi_init_pidfd(c);
2073 pid = do_lxcapi_init_pid(c);
2074 if (pid <= 0)
2075 return true;
2076
2077 /* Detect whether we should send SIGRTMIN + 3 (e.g. systemd). */
2078 if (c->lxc_conf && c->lxc_conf->haltsignal)
2079 haltsignal = c->lxc_conf->haltsignal;
2080 else if (task_blocks_signal(pid, (SIGRTMIN + 3)))
2081 haltsignal = (SIGRTMIN + 3);
2082
2083
2084 /*
2085 * Add a new state client before sending the shutdown signal so
2086 * that we don't miss a state.
2087 */
2088 if (timeout != 0) {
2089 states[STOPPED] = 1;
2090 ret = lxc_cmd_add_state_client(c->name, c->config_path, states,
2091 &state_client_fd);
2092 if (ret < 0)
2093 return false;
2094
2095 if (state_client_fd < 0)
2096 return false;
2097
2098 if (ret == STOPPED)
2099 return true;
2100
2101 if (ret < MAX_STATE)
2102 return false;
2103 }
2104
2105 if (pidfd >= 0) {
2106 struct pollfd pidfd_poll = {
2107 .events = POLLIN,
2108 .fd = pidfd,
2109 };
2110
2111 killret = lxc_raw_pidfd_send_signal(pidfd, haltsignal,
2112 NULL, 0);
2113 if (killret < 0)
2114 return log_warn(false, "Failed to send signal %d to pidfd %d",
2115 haltsignal, pidfd);
2116
2117 TRACE("Sent signal %d to pidfd %d", haltsignal, pidfd);
2118
2119 /*
2120 * No need for going through all of the state server
2121 * complications anymore. We can just poll on pidfds. :)
2122 */
2123
2124 if (timeout != 0) {
2125 ret = poll(&pidfd_poll, 1, timeout * 1000);
2126 if (ret < 0 || !(pidfd_poll.revents & POLLIN))
2127 return false;
2128
2129 TRACE("Pidfd polling detected container exit");
2130 }
2131 } else {
2132 killret = kill(pid, haltsignal);
2133 if (killret < 0)
2134 return log_warn(false, "Failed to send signal %d to pid %d",
2135 haltsignal, pid);
2136
2137 TRACE("Sent signal %d to pid %d", haltsignal, pid);
2138 }
2139
2140 if (timeout == 0)
2141 return true;
2142
2143 ret = lxc_cmd_sock_rcv_state(state_client_fd, timeout);
2144 if (ret < 0)
2145 return false;
2146
2147 TRACE("Received state \"%s\"", lxc_state2str(ret));
2148 if (ret != STOPPED)
2149 return false;
2150
2151 return true;
2152 }
2153
2154 WRAP_API_1(bool, lxcapi_shutdown, int)
2155
2156 static bool lxcapi_createl(struct lxc_container *c, const char *t,
2157 const char *bdevtype, struct bdev_specs *specs, int flags, ...)
2158 {
2159 bool bret = false;
2160 char **args = NULL;
2161 va_list ap;
2162
2163 if (!c)
2164 return false;
2165
2166 current_config = c->lxc_conf;
2167
2168 /*
2169 * since we're going to wait for create to finish, I don't think we
2170 * need to get a copy of the arguments.
2171 */
2172 va_start(ap, flags);
2173 args = lxc_va_arg_list_to_argv(ap, 0, 0);
2174 va_end(ap);
2175 if (!args) {
2176 ERROR("Failed to allocate memory");
2177 goto out;
2178 }
2179
2180 bret = do_lxcapi_create(c, t, bdevtype, specs, flags, args);
2181
2182 out:
2183 free(args);
2184 current_config = NULL;
2185 return bret;
2186 }
2187
2188 static void do_clear_unexp_config_line(struct lxc_conf *conf, const char *key)
2189 {
2190 if (!strcmp(key, "lxc.cgroup"))
2191 return clear_unexp_config_line(conf, key, true);
2192
2193 if (!strcmp(key, "lxc.network"))
2194 return clear_unexp_config_line(conf, key, true);
2195
2196 if (!strcmp(key, "lxc.net"))
2197 return clear_unexp_config_line(conf, key, true);
2198
2199 /* Clear a network with a specific index. */
2200 if (!strncmp(key, "lxc.net.", 8)) {
2201 int ret;
2202 const char *idx;
2203
2204 idx = key + 8;
2205 ret = lxc_safe_uint(idx, &(unsigned int){0});
2206 if (!ret)
2207 return clear_unexp_config_line(conf, key, true);
2208 }
2209
2210 if (!strcmp(key, "lxc.hook"))
2211 return clear_unexp_config_line(conf, key, true);
2212
2213 return clear_unexp_config_line(conf, key, false);
2214 }
2215
2216 static bool do_lxcapi_clear_config_item(struct lxc_container *c,
2217 const char *key)
2218 {
2219 int ret = 1;
2220 struct lxc_config_t *config;
2221
2222 if (!c || !c->lxc_conf)
2223 return false;
2224
2225 if (container_mem_lock(c))
2226 return false;
2227
2228 config = lxc_get_config(key);
2229 /* Verify that the config key exists and that it has a callback
2230 * implemented.
2231 */
2232 if (config && config->clr)
2233 ret = config->clr(key, c->lxc_conf, NULL);
2234
2235 if (!ret)
2236 do_clear_unexp_config_line(c->lxc_conf, key);
2237
2238 container_mem_unlock(c);
2239 return ret == 0;
2240 }
2241
2242 WRAP_API_1(bool, lxcapi_clear_config_item, const char *)
2243
2244 static inline bool enter_net_ns(struct lxc_container *c)
2245 {
2246 pid_t pid = do_lxcapi_init_pid(c);
2247
2248 if (pid < 0)
2249 return false;
2250
2251 if ((geteuid() != 0 || (c->lxc_conf && !lxc_list_empty(&c->lxc_conf->id_map))) &&
2252 (access("/proc/self/ns/user", F_OK) == 0))
2253 if (!switch_to_ns(pid, "user"))
2254 return false;
2255
2256 return switch_to_ns(pid, "net");
2257 }
2258
2259 /* Used by qsort and bsearch functions for comparing names. */
2260 static inline int string_cmp(char **first, char **second)
2261 {
2262 return strcmp(*first, *second);
2263 }
2264
2265 /* Used by qsort and bsearch functions for comparing container names. */
2266 static inline int container_cmp(struct lxc_container **first,
2267 struct lxc_container **second)
2268 {
2269 return strcmp((*first)->name, (*second)->name);
2270 }
2271
2272 static bool add_to_array(char ***names, char *cname, int pos)
2273 {
2274 char **newnames = realloc(*names, (pos+1) * sizeof(char *));
2275 if (!newnames) {
2276 ERROR("Out of memory");
2277 return false;
2278 }
2279
2280 *names = newnames;
2281 newnames[pos] = strdup(cname);
2282 if (!newnames[pos])
2283 return false;
2284
2285 /* Sort the array as we will use binary search on it. */
2286 qsort(newnames, pos + 1, sizeof(char *),
2287 (int (*)(const void *, const void *))string_cmp);
2288
2289 return true;
2290 }
2291
2292 static bool add_to_clist(struct lxc_container ***list, struct lxc_container *c,
2293 int pos, bool sort)
2294 {
2295 struct lxc_container **newlist = realloc(*list, (pos + 1) * sizeof(struct lxc_container *));
2296 if (!newlist) {
2297 ERROR("Out of memory");
2298 return false;
2299 }
2300
2301 *list = newlist;
2302 newlist[pos] = c;
2303
2304 /* Sort the array as we will use binary search on it. */
2305 if (sort)
2306 qsort(newlist, pos + 1, sizeof(struct lxc_container *),
2307 (int (*)(const void *, const void *))container_cmp);
2308
2309 return true;
2310 }
2311
2312 static char** get_from_array(char ***names, char *cname, int size)
2313 {
2314 return (char **)bsearch(&cname, *names, size, sizeof(char *), (int (*)(const void *, const void *))string_cmp);
2315 }
2316
2317 static bool array_contains(char ***names, char *cname, int size)
2318 {
2319 if(get_from_array(names, cname, size) != NULL)
2320 return true;
2321
2322 return false;
2323 }
2324
2325 static bool remove_from_array(char ***names, char *cname, int size)
2326 {
2327 char **result = get_from_array(names, cname, size);
2328 if (result != NULL) {
2329 free(result);
2330 return true;
2331 }
2332
2333 return false;
2334 }
2335
2336 static char **do_lxcapi_get_interfaces(struct lxc_container *c)
2337 {
2338 pid_t pid;
2339 int i, count = 0, pipefd[2];
2340 char **interfaces = NULL;
2341 char interface[IFNAMSIZ];
2342
2343 if (pipe2(pipefd, O_CLOEXEC))
2344 return log_error_errno(NULL, errno, "Failed to create pipe");
2345
2346 pid = fork();
2347 if (pid < 0) {
2348 close(pipefd[0]);
2349 close(pipefd[1]);
2350 return log_error_errno(NULL, errno, "Failed to fork task to get interfaces information");
2351 }
2352
2353 if (pid == 0) {
2354 call_cleaner(netns_freeifaddrs) struct netns_ifaddrs *ifaddrs = NULL;
2355 struct netns_ifaddrs *ifa = NULL;
2356 int ret = 1;
2357 int nbytes;
2358
2359 /* close the read-end of the pipe */
2360 close(pipefd[0]);
2361
2362 if (!enter_net_ns(c)) {
2363 SYSERROR("Failed to enter network namespace");
2364 goto out;
2365 }
2366
2367 /* Grab the list of interfaces */
2368 if (netns_getifaddrs(&ifaddrs, -1, &(bool){false})) {
2369 SYSERROR("Failed to get interfaces list");
2370 goto out;
2371 }
2372
2373 /* Iterate through the interfaces */
2374 for (ifa = ifaddrs; ifa != NULL;
2375 ifa = ifa->ifa_next) {
2376 nbytes = lxc_write_nointr(pipefd[1], ifa->ifa_name, IFNAMSIZ);
2377 if (nbytes < 0)
2378 goto out;
2379
2380 count++;
2381 }
2382
2383 ret = 0;
2384
2385 out:
2386 /* close the write-end of the pipe, thus sending EOF to the reader */
2387 close(pipefd[1]);
2388 _exit(ret);
2389 }
2390
2391 /* close the write-end of the pipe */
2392 close(pipefd[1]);
2393
2394 while (lxc_read_nointr(pipefd[0], &interface, IFNAMSIZ) == IFNAMSIZ) {
2395 interface[IFNAMSIZ - 1] = '\0';
2396
2397 if (array_contains(&interfaces, interface, count))
2398 continue;
2399
2400 if (!add_to_array(&interfaces, interface, count))
2401 ERROR("Failed to add \"%s\" to array", interface);
2402
2403 count++;
2404 }
2405
2406 if (wait_for_pid(pid)) {
2407 for (i = 0; i < count; i++)
2408 free(interfaces[i]);
2409
2410 free(interfaces);
2411 interfaces = NULL;
2412 }
2413
2414 /* close the read-end of the pipe */
2415 close(pipefd[0]);
2416
2417 /* Append NULL to the array */
2418 if (interfaces)
2419 interfaces = (char **)lxc_append_null_to_array((void **)interfaces, count);
2420
2421 return interfaces;
2422 }
2423
2424 WRAP_API(char **, lxcapi_get_interfaces)
2425
2426 static char **do_lxcapi_get_ips(struct lxc_container *c, const char *interface,
2427 const char *family, int scope)
2428 {
2429 int i, ret;
2430 pid_t pid;
2431 int pipefd[2];
2432 char address[INET6_ADDRSTRLEN];
2433 int count = 0;
2434 char **addresses = NULL;
2435
2436 ret = pipe2(pipefd, O_CLOEXEC);
2437 if (ret < 0)
2438 return log_error_errno(NULL, errno, "Failed to create pipe");
2439
2440 pid = fork();
2441 if (pid < 0) {
2442 SYSERROR("Failed to create new process");
2443 close(pipefd[0]);
2444 close(pipefd[1]);
2445 return NULL;
2446 }
2447
2448 if (pid == 0) {
2449 call_cleaner(netns_freeifaddrs) struct netns_ifaddrs *ifaddrs = NULL;
2450 struct netns_ifaddrs *ifa = NULL;
2451 ssize_t nbytes;
2452 char addressOutputBuffer[INET6_ADDRSTRLEN];
2453 char *address_ptr = NULL;
2454 void *address_ptr_tmp = NULL;
2455
2456 /* close the read-end of the pipe */
2457 close(pipefd[0]);
2458
2459 if (!enter_net_ns(c)) {
2460 SYSERROR("Failed to attach to network namespace");
2461 goto out;
2462 }
2463
2464 /* Grab the list of interfaces */
2465 if (netns_getifaddrs(&ifaddrs, -1, &(bool){false})) {
2466 SYSERROR("Failed to get interfaces list");
2467 goto out;
2468 }
2469
2470 /* Iterate through the interfaces */
2471 for (ifa = ifaddrs; ifa; ifa = ifa->ifa_next) {
2472 if (ifa->ifa_addr == NULL)
2473 continue;
2474
2475 #pragma GCC diagnostic push
2476 #pragma GCC diagnostic ignored "-Wcast-align"
2477
2478 if (ifa->ifa_addr->sa_family == AF_INET) {
2479 if (family && strcmp(family, "inet"))
2480 continue;
2481
2482 address_ptr_tmp = &((struct sockaddr_in *)ifa->ifa_addr)->sin_addr;
2483 } else {
2484 if (family && strcmp(family, "inet6"))
2485 continue;
2486
2487 if (((struct sockaddr_in6 *)ifa->ifa_addr)->sin6_scope_id != scope)
2488 continue;
2489
2490 address_ptr_tmp = &((struct sockaddr_in6 *)ifa->ifa_addr)->sin6_addr;
2491 }
2492
2493 #pragma GCC diagnostic pop
2494
2495 if (interface && strcmp(interface, ifa->ifa_name))
2496 continue;
2497 else if (!interface && strcmp("lo", ifa->ifa_name) == 0)
2498 continue;
2499
2500 address_ptr = (char *)inet_ntop(ifa->ifa_addr->sa_family, address_ptr_tmp,
2501 addressOutputBuffer,
2502 sizeof(addressOutputBuffer));
2503 if (!address_ptr)
2504 continue;
2505
2506 nbytes = lxc_write_nointr(pipefd[1], address_ptr, INET6_ADDRSTRLEN);
2507 if (nbytes != INET6_ADDRSTRLEN) {
2508 SYSERROR("Failed to send ipv6 address \"%s\"", address_ptr);
2509 goto out;
2510 }
2511
2512 count++;
2513 }
2514
2515 ret = 0;
2516
2517 out:
2518 /* close the write-end of the pipe, thus sending EOF to the reader */
2519 close(pipefd[1]);
2520 _exit(ret);
2521 }
2522
2523 /* close the write-end of the pipe */
2524 close(pipefd[1]);
2525
2526 while (lxc_read_nointr(pipefd[0], &address, INET6_ADDRSTRLEN) == INET6_ADDRSTRLEN) {
2527 address[INET6_ADDRSTRLEN - 1] = '\0';
2528
2529 if (!add_to_array(&addresses, address, count))
2530 ERROR("PARENT: add_to_array failed");
2531
2532 count++;
2533 }
2534
2535 if (wait_for_pid(pid)) {
2536 for (i = 0; i < count; i++)
2537 free(addresses[i]);
2538
2539 free(addresses);
2540 addresses = NULL;
2541 }
2542
2543 /* close the read-end of the pipe */
2544 close(pipefd[0]);
2545
2546 /* Append NULL to the array */
2547 if (addresses)
2548 addresses = (char **)lxc_append_null_to_array((void **)addresses, count);
2549
2550 return addresses;
2551 }
2552
2553 WRAP_API_3(char **, lxcapi_get_ips, const char *, const char *, int)
2554
2555 static int do_lxcapi_get_config_item(struct lxc_container *c, const char *key, char *retv, int inlen)
2556 {
2557 int ret = -1;
2558 struct lxc_config_t *config;
2559
2560 if (!c || !c->lxc_conf)
2561 return -1;
2562
2563 if (container_mem_lock(c))
2564 return -1;
2565
2566 config = lxc_get_config(key);
2567 /* Verify that the config key exists and that it has a callback
2568 * implemented.
2569 */
2570 if (config && config->get)
2571 ret = config->get(key, retv, inlen, c->lxc_conf, NULL);
2572
2573 container_mem_unlock(c);
2574 return ret;
2575 }
2576
2577 WRAP_API_3(int, lxcapi_get_config_item, const char *, char *, int)
2578
2579 static char* do_lxcapi_get_running_config_item(struct lxc_container *c, const char *key)
2580 {
2581 char *ret;
2582
2583 if (!c || !c->lxc_conf)
2584 return NULL;
2585
2586 if (container_mem_lock(c))
2587 return NULL;
2588
2589 ret = lxc_cmd_get_config_item(c->name, key, do_lxcapi_get_config_path(c));
2590 container_mem_unlock(c);
2591 return ret;
2592 }
2593
2594 WRAP_API_1(char *, lxcapi_get_running_config_item, const char *)
2595
2596 static int do_lxcapi_get_keys(struct lxc_container *c, const char *key, char *retv, int inlen)
2597 {
2598 int ret = -1;
2599
2600 /* List all config items. */
2601 if (!key)
2602 return lxc_list_config_items(retv, inlen);
2603
2604 if (!c || !c->lxc_conf)
2605 return -1;
2606
2607 if (container_mem_lock(c))
2608 return -1;
2609
2610 /* Support 'lxc.net.<idx>', i.e. 'lxc.net.0'
2611 * This is an intelligent result to show which keys are valid given the
2612 * type of nic it is.
2613 */
2614 if (strncmp(key, "lxc.net.", 8) == 0)
2615 ret = lxc_list_net(c->lxc_conf, key, retv, inlen);
2616 else
2617 ret = lxc_list_subkeys(c->lxc_conf, key, retv, inlen);
2618
2619 container_mem_unlock(c);
2620 return ret;
2621 }
2622
2623 WRAP_API_3(int, lxcapi_get_keys, const char *, char *, int)
2624
2625 static bool do_lxcapi_save_config(struct lxc_container *c, const char *alt_file)
2626 {
2627 int fd, lret;
2628 bool ret = false, need_disklock = false;
2629
2630 if (!alt_file)
2631 alt_file = c->configfile;
2632
2633 if (!alt_file)
2634 return false;
2635
2636 /* If we haven't yet loaded a config, load the stock config. */
2637 if (!c->lxc_conf) {
2638 if (!do_lxcapi_load_config(c, lxc_global_config_value("lxc.default_config"))) {
2639 ERROR("Error loading default configuration file %s "
2640 "while saving %s",
2641 lxc_global_config_value("lxc.default_config"),
2642 c->name);
2643 return false;
2644 }
2645 }
2646
2647 if (!create_container_dir(c))
2648 return false;
2649
2650 /* If we're writing to the container's config file, take the disk lock.
2651 * Otherwise just take the memlock to protect the struct lxc_container
2652 * while we're traversing it.
2653 */
2654 if (strcmp(c->configfile, alt_file) == 0)
2655 need_disklock = true;
2656
2657 if (need_disklock)
2658 lret = container_disk_lock(c);
2659 else
2660 lret = container_mem_lock(c);
2661 if (lret)
2662 return false;
2663
2664 fd = open(alt_file, O_WRONLY | O_CREAT | O_TRUNC | O_CLOEXEC,
2665 S_IRUSR | S_IWUSR | S_IRGRP | S_IWGRP);
2666 if (fd < 0)
2667 goto on_error;
2668
2669 lret = write_config(fd, c->lxc_conf);
2670 close(fd);
2671 if (lret < 0)
2672 goto on_error;
2673
2674 ret = true;
2675
2676 on_error:
2677 if (need_disklock)
2678 container_disk_unlock(c);
2679 else
2680 container_mem_unlock(c);
2681
2682 return ret;
2683 }
2684
2685 WRAP_API_1(bool, lxcapi_save_config, const char *)
2686
2687
2688 static bool mod_rdep(struct lxc_container *c0, struct lxc_container *c, bool inc)
2689 {
2690 FILE *f1;
2691 struct stat fbuf;
2692 void *buf = NULL;
2693 char *del = NULL;
2694 char path[PATH_MAX];
2695 char newpath[PATH_MAX];
2696 int fd, ret, n = 0, v = 0;
2697 bool bret = false;
2698 size_t len = 0, bytes = 0;
2699
2700 if (container_disk_lock(c0))
2701 return false;
2702
2703 ret = snprintf(path, PATH_MAX, "%s/%s/lxc_snapshots", c0->config_path, c0->name);
2704 if (ret < 0 || ret > PATH_MAX)
2705 goto out;
2706
2707 ret = snprintf(newpath, PATH_MAX, "%s\n%s\n", c->config_path, c->name);
2708 if (ret < 0 || ret > PATH_MAX)
2709 goto out;
2710
2711 /* If we find an lxc-snapshot file using the old format only listing the
2712 * number of snapshots we will keep using it. */
2713 f1 = fopen(path, "re");
2714 if (f1) {
2715 n = fscanf(f1, "%d", &v);
2716 fclose(f1);
2717 if (n == 1 && v == 0) {
2718 ret = remove(path);
2719 if (ret < 0)
2720 SYSERROR("Failed to remove \"%s\"", path);
2721
2722 n = 0;
2723 }
2724 }
2725
2726 if (n == 1) {
2727 v += inc ? 1 : -1;
2728 f1 = fopen(path, "we");
2729 if (!f1)
2730 goto out;
2731
2732 if (fprintf(f1, "%d\n", v) < 0) {
2733 ERROR("Error writing new snapshots value");
2734 fclose(f1);
2735 goto out;
2736 }
2737
2738 ret = fclose(f1);
2739 if (ret != 0) {
2740 SYSERROR("Error writing to or closing snapshots file");
2741 goto out;
2742 }
2743 } else {
2744 /* Here we know that we have or can use an lxc-snapshot file
2745 * using the new format. */
2746 if (inc) {
2747 f1 = fopen(path, "ae");
2748 if (!f1)
2749 goto out;
2750
2751 if (fprintf(f1, "%s", newpath) < 0) {
2752 ERROR("Error writing new snapshots entry");
2753 ret = fclose(f1);
2754 if (ret != 0)
2755 SYSERROR("Error writing to or closing snapshots file");
2756 goto out;
2757 }
2758
2759 ret = fclose(f1);
2760 if (ret != 0) {
2761 SYSERROR("Error writing to or closing snapshots file");
2762 goto out;
2763 }
2764 } else if (!inc) {
2765 if ((fd = open(path, O_RDWR | O_CLOEXEC)) < 0)
2766 goto out;
2767
2768 if (fstat(fd, &fbuf) < 0) {
2769 close(fd);
2770 goto out;
2771 }
2772
2773 if (fbuf.st_size != 0) {
2774 buf = lxc_strmmap(NULL, fbuf.st_size, PROT_READ | PROT_WRITE, MAP_SHARED, fd, 0);
2775 if (buf == MAP_FAILED) {
2776 SYSERROR("Failed to create mapping %s", path);
2777 close(fd);
2778 goto out;
2779 }
2780
2781 len = strlen(newpath);
2782 while ((del = strstr((char *)buf, newpath))) {
2783 memmove(del, del + len, strlen(del) - len + 1);
2784 bytes += len;
2785 }
2786
2787 lxc_strmunmap(buf, fbuf.st_size);
2788 if (ftruncate(fd, fbuf.st_size - bytes) < 0) {
2789 SYSERROR("Failed to truncate file %s", path);
2790 close(fd);
2791 goto out;
2792 }
2793 }
2794
2795 close(fd);
2796 }
2797
2798 /* If the lxc-snapshot file is empty, remove it. */
2799 if (stat(path, &fbuf) < 0)
2800 goto out;
2801
2802 if (!fbuf.st_size) {
2803 ret = remove(path);
2804 if (ret < 0)
2805 SYSERROR("Failed to remove \"%s\"", path);
2806 }
2807 }
2808
2809 bret = true;
2810
2811 out:
2812 container_disk_unlock(c0);
2813 return bret;
2814 }
2815
2816 void mod_all_rdeps(struct lxc_container *c, bool inc)
2817 {
2818 __do_free char *lxcpath = NULL, *lxcname = NULL;
2819 __do_fclose FILE *f = NULL;
2820 size_t pathlen = 0, namelen = 0;
2821 struct lxc_container *p;
2822 char path[PATH_MAX];
2823 int ret;
2824
2825 ret = snprintf(path, PATH_MAX, "%s/%s/lxc_rdepends",
2826 c->config_path, c->name);
2827 if (ret < 0 || ret >= PATH_MAX) {
2828 ERROR("Path name too long");
2829 return;
2830 }
2831
2832 f = fopen(path, "re");
2833 if (!f)
2834 return;
2835
2836 while (getline(&lxcpath, &pathlen, f) != -1) {
2837 if (getline(&lxcname, &namelen, f) == -1) {
2838 ERROR("badly formatted file %s", path);
2839 return;
2840 }
2841
2842 remove_trailing_newlines(lxcpath);
2843 remove_trailing_newlines(lxcname);
2844
2845 if ((p = lxc_container_new(lxcname, lxcpath)) == NULL) {
2846 ERROR("Unable to find dependent container %s:%s",
2847 lxcpath, lxcname);
2848 continue;
2849 }
2850
2851 if (!mod_rdep(p, c, inc))
2852 ERROR("Failed to update snapshots file for %s:%s",
2853 lxcpath, lxcname);
2854
2855 lxc_container_put(p);
2856 }
2857 }
2858
2859 static bool has_fs_snapshots(struct lxc_container *c)
2860 {
2861 __do_fclose FILE *f = NULL;
2862 char path[PATH_MAX];
2863 int ret, v;
2864 struct stat fbuf;
2865
2866 ret = snprintf(path, PATH_MAX, "%s/%s/lxc_snapshots", c->config_path,
2867 c->name);
2868 if (ret < 0 || ret > PATH_MAX)
2869 return false;
2870
2871 /* If the file doesn't exist there are no snapshots. */
2872 if (stat(path, &fbuf) < 0)
2873 return false;
2874
2875 v = fbuf.st_size;
2876 if (v != 0) {
2877 f = fopen(path, "re");
2878 if (!f)
2879 return false;
2880
2881 ret = fscanf(f, "%d", &v);
2882 if (ret != 1)
2883 INFO("Container uses new lxc-snapshots format %s", path);
2884 }
2885
2886 return v != 0;
2887 }
2888
2889 static bool has_snapshots(struct lxc_container *c)
2890 {
2891 __do_closedir DIR *dir = NULL;
2892 char path[PATH_MAX];
2893 struct dirent *direntp;
2894 int count = 0;
2895
2896 if (!get_snappath_dir(c, path))
2897 return false;
2898
2899 dir = opendir(path);
2900 if (!dir)
2901 return false;
2902
2903 while ((direntp = readdir(dir))) {
2904 if (!strcmp(direntp->d_name, "."))
2905 continue;
2906
2907 if (!strcmp(direntp->d_name, ".."))
2908 continue;
2909 count++;
2910 break;
2911 }
2912
2913 return count > 0;
2914 }
2915
2916 static bool do_destroy_container(struct lxc_conf *conf) {
2917 int ret;
2918
2919 if (am_guest_unpriv()) {
2920 ret = userns_exec_full(conf, storage_destroy_wrapper, conf,
2921 "storage_destroy_wrapper");
2922 if (ret < 0)
2923 return false;
2924
2925 return true;
2926 }
2927
2928 return storage_destroy(conf);
2929 }
2930
2931 static int lxc_rmdir_onedev_wrapper(void *data)
2932 {
2933 char *arg = (char *) data;
2934 return lxc_rmdir_onedev(arg, "snaps");
2935 }
2936
2937 static int lxc_unlink_exec_wrapper(void *data)
2938 {
2939 char *arg = data;
2940 return unlink(arg);
2941 }
2942
2943 static bool container_destroy(struct lxc_container *c,
2944 struct lxc_storage *storage)
2945 {
2946 const char *p1;
2947 size_t len;
2948 struct lxc_conf *conf;
2949 char *path = NULL;
2950 bool bret = false;
2951 int ret = 0;
2952
2953 if (!c || !do_lxcapi_is_defined(c))
2954 return false;
2955
2956 conf = c->lxc_conf;
2957 if (container_disk_lock(c))
2958 return false;
2959
2960 if (!is_stopped(c)) {
2961 /* We should queue some sort of error - in c->error_string? */
2962 ERROR("container %s is not stopped", c->name);
2963 goto out;
2964 }
2965
2966 if (conf && !lxc_list_empty(&conf->hooks[LXCHOOK_DESTROY])) {
2967 /* Start of environment variable setup for hooks */
2968 if (setenv("LXC_NAME", c->name, 1))
2969 SYSERROR("Failed to set environment variable for container name");
2970
2971 if (conf->rcfile && setenv("LXC_CONFIG_FILE", conf->rcfile, 1))
2972 SYSERROR("Failed to set environment variable for config path");
2973
2974 if (conf->rootfs.mount && setenv("LXC_ROOTFS_MOUNT", conf->rootfs.mount, 1))
2975 SYSERROR("Failed to set environment variable for rootfs mount");
2976
2977 if (conf->rootfs.path && setenv("LXC_ROOTFS_PATH", conf->rootfs.path, 1))
2978 SYSERROR("Failed to set environment variable for rootfs mount");
2979
2980 if (conf->console.path && setenv("LXC_CONSOLE", conf->console.path, 1))
2981 SYSERROR("Failed to set environment variable for console path");
2982
2983 if (conf->console.log_path && setenv("LXC_CONSOLE_LOGPATH", conf->console.log_path, 1))
2984 SYSERROR("Failed to set environment variable for console log");
2985 /* End of environment variable setup for hooks */
2986
2987 if (run_lxc_hooks(c->name, "destroy", conf, NULL)) {
2988 ERROR("Failed to execute clone hook for \"%s\"", c->name);
2989 goto out;
2990 }
2991 }
2992
2993 if (current_config && conf == current_config) {
2994 current_config = NULL;
2995
2996 if (conf->logfd != -1) {
2997 close(conf->logfd);
2998 conf->logfd = -1;
2999 }
3000 }
3001
3002 /* LXC is not managing the storage of the container. */
3003 if (conf && !conf->rootfs.managed)
3004 goto on_success;
3005
3006 if (conf && conf->rootfs.path && conf->rootfs.mount) {
3007 if (!do_destroy_container(conf)) {
3008 ERROR("Error destroying rootfs for %s", c->name);
3009 goto out;
3010 }
3011 INFO("Destroyed rootfs for %s", c->name);
3012 }
3013
3014 mod_all_rdeps(c, false);
3015
3016 p1 = do_lxcapi_get_config_path(c);
3017 /* strlen(p1)
3018 * +
3019 * /
3020 * +
3021 * strlen(c->name)
3022 * +
3023 * /
3024 * +
3025 * strlen("config") = 6
3026 * +
3027 * \0
3028 */
3029 len = strlen(p1) + 1 + strlen(c->name) + 1 + strlen(LXC_CONFIG_FNAME) + 1;
3030 path = malloc(len);
3031 if (!path) {
3032 ERROR("Failed to allocate memory");
3033 goto out;
3034 }
3035
3036 /* For an overlay container the rootfs is considered immutable and
3037 * cannot be removed when restoring from a snapshot.
3038 */
3039 if (storage && (!strcmp(storage->type, "overlay") ||
3040 !strcmp(storage->type, "overlayfs")) &&
3041 (storage->flags & LXC_STORAGE_INTERNAL_OVERLAY_RESTORE)) {
3042 ret = snprintf(path, len, "%s/%s/%s", p1, c->name, LXC_CONFIG_FNAME);
3043 if (ret < 0 || (size_t)ret >= len)
3044 goto out;
3045
3046 if (am_guest_unpriv())
3047 ret = userns_exec_1(conf, lxc_unlink_exec_wrapper, path,
3048 "lxc_unlink_exec_wrapper");
3049 else
3050 ret = unlink(path);
3051 if (ret < 0) {
3052 SYSERROR("Failed to destroy config file \"%s\" for \"%s\"",
3053 path, c->name);
3054 goto out;
3055 }
3056 INFO("Destroyed config file \"%s\" for \"%s\"", path, c->name);
3057
3058 bret = true;
3059 goto out;
3060 }
3061
3062 ret = snprintf(path, len, "%s/%s", p1, c->name);
3063 if (ret < 0 || (size_t)ret >= len)
3064 goto out;
3065
3066 if (am_guest_unpriv())
3067 ret = userns_exec_full(conf, lxc_rmdir_onedev_wrapper, path,
3068 "lxc_rmdir_onedev_wrapper");
3069 else
3070 ret = lxc_rmdir_onedev(path, "snaps");
3071 if (ret < 0) {
3072 ERROR("Failed to destroy directory \"%s\" for \"%s\"", path,
3073 c->name);
3074 goto out;
3075 }
3076 INFO("Destroyed directory \"%s\" for \"%s\"", path, c->name);
3077
3078 on_success:
3079 bret = true;
3080
3081 out:
3082 if (path)
3083 free(path);
3084
3085 container_disk_unlock(c);
3086 return bret;
3087 }
3088
3089 static bool do_lxcapi_destroy(struct lxc_container *c)
3090 {
3091 if (!c || !lxcapi_is_defined(c))
3092 return false;
3093
3094 if (c->lxc_conf && c->lxc_conf->rootfs.managed) {
3095 if (has_snapshots(c)) {
3096 ERROR("Container %s has snapshots; not removing", c->name);
3097 return false;
3098 }
3099
3100 if (has_fs_snapshots(c)) {
3101 ERROR("container %s has snapshots on its rootfs", c->name);
3102 return false;
3103 }
3104 }
3105
3106 return container_destroy(c, NULL);
3107 }
3108
3109 WRAP_API(bool, lxcapi_destroy)
3110
3111 static bool do_lxcapi_destroy_with_snapshots(struct lxc_container *c)
3112 {
3113 if (!c || !lxcapi_is_defined(c))
3114 return false;
3115
3116 if (!lxcapi_snapshot_destroy_all(c)) {
3117 ERROR("Error deleting all snapshots");
3118 return false;
3119 }
3120
3121 return lxcapi_destroy(c);
3122 }
3123
3124 WRAP_API(bool, lxcapi_destroy_with_snapshots)
3125
3126 int lxc_set_config_item_locked(struct lxc_conf *conf, const char *key,
3127 const char *v)
3128 {
3129 int ret;
3130 struct lxc_config_t *config;
3131 bool bret = true;
3132
3133 config = lxc_get_config(key);
3134 if (!config)
3135 return -EINVAL;
3136
3137 ret = config->set(key, v, conf, NULL);
3138 if (ret < 0)
3139 return -EINVAL;
3140
3141 if (lxc_config_value_empty(v))
3142 do_clear_unexp_config_line(conf, key);
3143 else
3144 bret = do_append_unexp_config_line(conf, key, v);
3145 if (!bret)
3146 return -ENOMEM;
3147
3148 return 0;
3149 }
3150
3151 static bool do_set_config_item_locked(struct lxc_container *c, const char *key,
3152 const char *v)
3153 {
3154 int ret;
3155
3156 if (!c->lxc_conf)
3157 c->lxc_conf = lxc_conf_init();
3158
3159 if (!c->lxc_conf)
3160 return false;
3161
3162 ret = lxc_set_config_item_locked(c->lxc_conf, key, v);
3163 if (ret < 0)
3164 return false;
3165
3166 return true;
3167 }
3168
3169 static bool do_lxcapi_set_config_item(struct lxc_container *c, const char *key, const char *v)
3170 {
3171 bool b = false;
3172
3173 if (!c)
3174 return false;
3175
3176 if (container_mem_lock(c))
3177 return false;
3178
3179 b = do_set_config_item_locked(c, key, v);
3180
3181 container_mem_unlock(c);
3182 return b;
3183 }
3184
3185 WRAP_API_2(bool, lxcapi_set_config_item, const char *, const char *)
3186
3187 static char *lxcapi_config_file_name(struct lxc_container *c)
3188 {
3189 if (!c || !c->configfile)
3190 return NULL;
3191
3192 return strdup(c->configfile);
3193 }
3194
3195 static const char *lxcapi_get_config_path(struct lxc_container *c)
3196 {
3197 if (!c || !c->config_path)
3198 return NULL;
3199
3200 return (const char *)(c->config_path);
3201 }
3202
3203 /*
3204 * not for export
3205 * Just recalculate the c->configfile based on the
3206 * c->config_path, which must be set.
3207 * The lxc_container must be locked or not yet public.
3208 */
3209 static bool set_config_filename(struct lxc_container *c)
3210 {
3211 char *newpath;
3212 int len, ret;
3213
3214 if (!c->config_path)
3215 return false;
3216
3217 /* $lxc_path + "/" + c->name + "/" + "config" + '\0' */
3218 len = strlen(c->config_path) + 1 + strlen(c->name) + 1 + strlen(LXC_CONFIG_FNAME) + 1;
3219 newpath = malloc(len);
3220 if (!newpath)
3221 return false;
3222
3223 ret = snprintf(newpath, len, "%s/%s/%s", c->config_path, c->name, LXC_CONFIG_FNAME);
3224 if (ret < 0 || ret >= len) {
3225 fprintf(stderr, "Error printing out config file name\n");
3226 free(newpath);
3227 return false;
3228 }
3229
3230 free(c->configfile);
3231 c->configfile = newpath;
3232
3233 return true;
3234 }
3235
3236 static bool do_lxcapi_set_config_path(struct lxc_container *c, const char *path)
3237 {
3238 char *p;
3239 bool b = false;
3240 char *oldpath = NULL;
3241
3242 if (!c)
3243 return b;
3244
3245 if (container_mem_lock(c))
3246 return b;
3247
3248 p = strdup(path);
3249 if (!p) {
3250 ERROR("Out of memory setting new lxc path");
3251 goto err;
3252 }
3253
3254 b = true;
3255 if (c->config_path)
3256 oldpath = c->config_path;
3257 c->config_path = p;
3258
3259 /* Since we've changed the config path, we have to change the
3260 * config file name too */
3261 if (!set_config_filename(c)) {
3262 ERROR("Out of memory setting new config filename");
3263 b = false;
3264 free(c->config_path);
3265 c->config_path = oldpath;
3266 oldpath = NULL;
3267 }
3268
3269 err:
3270 free(oldpath);
3271 container_mem_unlock(c);
3272 return b;
3273 }
3274
3275 WRAP_API_1(bool, lxcapi_set_config_path, const char *)
3276
3277 static bool do_lxcapi_set_cgroup_item(struct lxc_container *c, const char *subsys, const char *value)
3278 {
3279 call_cleaner(cgroup_exit) struct cgroup_ops *cgroup_ops = NULL;
3280
3281 if (!c)
3282 return false;
3283
3284 if (is_stopped(c))
3285 return false;
3286
3287 cgroup_ops = cgroup_init(c->lxc_conf);
3288 if (!cgroup_ops)
3289 return false;
3290
3291 return cgroup_ops->set(cgroup_ops, subsys, value, c->name,
3292 c->config_path) == 0;
3293 }
3294
3295 WRAP_API_2(bool, lxcapi_set_cgroup_item, const char *, const char *)
3296
3297 static int do_lxcapi_get_cgroup_item(struct lxc_container *c, const char *subsys, char *retv, int inlen)
3298 {
3299 call_cleaner(cgroup_exit) struct cgroup_ops *cgroup_ops = NULL;
3300
3301 if (!c)
3302 return -1;
3303
3304 if (is_stopped(c))
3305 return -1;
3306
3307 cgroup_ops = cgroup_init(c->lxc_conf);
3308 if (!cgroup_ops)
3309 return -1;
3310
3311 return cgroup_ops->get(cgroup_ops, subsys, retv, inlen, c->name,
3312 c->config_path);
3313 }
3314
3315 WRAP_API_3(int, lxcapi_get_cgroup_item, const char *, char *, int)
3316
3317 const char *lxc_get_global_config_item(const char *key)
3318 {
3319 return lxc_global_config_value(key);
3320 }
3321
3322 const char *lxc_get_version(void)
3323 {
3324 return LXC_VERSION;
3325 }
3326
3327 static int copy_file(const char *old, const char *new)
3328 {
3329 int in, out;
3330 ssize_t len, ret;
3331 char buf[8096];
3332 struct stat sbuf;
3333
3334 if (file_exists(new)) {
3335 ERROR("copy destination %s exists", new);
3336 return -1;
3337 }
3338
3339 ret = stat(old, &sbuf);
3340 if (ret < 0) {
3341 INFO("Error stat'ing %s", old);
3342 return -1;
3343 }
3344
3345 in = open(old, O_RDONLY);
3346 if (in < 0) {
3347 SYSERROR("Error opening original file %s", old);
3348 return -1;
3349 }
3350
3351 out = open(new, O_CREAT | O_EXCL | O_WRONLY, 0644);
3352 if (out < 0) {
3353 SYSERROR("Error opening new file %s", new);
3354 close(in);
3355 return -1;
3356 }
3357
3358 for (;;) {
3359 len = lxc_read_nointr(in, buf, 8096);
3360 if (len < 0) {
3361 SYSERROR("Error reading old file %s", old);
3362 goto err;
3363 }
3364
3365 if (len == 0)
3366 break;
3367
3368 ret = lxc_write_nointr(out, buf, len);
3369 if (ret < len) { /* should we retry? */
3370 SYSERROR("Error: write to new file %s was interrupted", new);
3371 goto err;
3372 }
3373 }
3374
3375 close(in);
3376 close(out);
3377
3378 /* We set mode, but not owner/group. */
3379 ret = chmod(new, sbuf.st_mode);
3380 if (ret) {
3381 SYSERROR("Error setting mode on %s", new);
3382 return -1;
3383 }
3384
3385 return 0;
3386
3387 err:
3388 close(in);
3389 close(out);
3390 return -1;
3391 }
3392
3393 static int copyhooks(struct lxc_container *oldc, struct lxc_container *c)
3394 {
3395 __do_free char *cpath = NULL;
3396 int i, len, ret;
3397 struct lxc_list *it;
3398
3399 len = strlen(oldc->config_path) + strlen(oldc->name) + 3;
3400 cpath = must_realloc(NULL, len);
3401 ret = snprintf(cpath, len, "%s/%s/", oldc->config_path, oldc->name);
3402 if (ret < 0 || ret >= len)
3403 return -1;
3404
3405 for (i=0; i<NUM_LXC_HOOKS; i++) {
3406 lxc_list_for_each(it, &c->lxc_conf->hooks[i]) {
3407 char *hookname = it->elem;
3408 char *fname = strrchr(hookname, '/');
3409 char tmppath[PATH_MAX];
3410 if (!fname) /* relative path - we don't support, but maybe we should */
3411 return 0;
3412
3413 if (strncmp(hookname, cpath, len - 1) != 0) {
3414 /* this hook is public - ignore */
3415 continue;
3416 }
3417
3418 /* copy the script, and change the entry in confile */
3419 ret = snprintf(tmppath, PATH_MAX, "%s/%s/%s",
3420 c->config_path, c->name, fname+1);
3421 if (ret < 0 || ret >= PATH_MAX)
3422 return -1;
3423
3424 ret = copy_file(it->elem, tmppath);
3425 if (ret < 0)
3426 return -1;
3427
3428 free(it->elem);
3429
3430 it->elem = strdup(tmppath);
3431 if (!it->elem) {
3432 ERROR("out of memory copying hook path");
3433 return -1;
3434 }
3435 }
3436 }
3437
3438 if (!clone_update_unexp_hooks(c->lxc_conf, oldc->config_path,
3439 c->config_path, oldc->name, c->name)) {
3440 ERROR("Error saving new hooks in clone");
3441 return -1;
3442 }
3443
3444 do_lxcapi_save_config(c, NULL);
3445 return 0;
3446 }
3447
3448
3449 static int copy_fstab(struct lxc_container *oldc, struct lxc_container *c)
3450 {
3451 char newpath[PATH_MAX];
3452 char *oldpath = oldc->lxc_conf->fstab;
3453 int ret;
3454
3455 if (!oldpath)
3456 return 0;
3457
3458 clear_unexp_config_line(c->lxc_conf, "lxc.mount.fstab", false);
3459
3460 char *p = strrchr(oldpath, '/');
3461 if (!p)
3462 return -1;
3463
3464 ret = snprintf(newpath, PATH_MAX, "%s/%s%s",
3465 c->config_path, c->name, p);
3466 if (ret < 0 || ret >= PATH_MAX) {
3467 ERROR("error printing new path for %s", oldpath);
3468 return -1;
3469 }
3470
3471 if (file_exists(newpath)) {
3472 ERROR("error: fstab file %s exists", newpath);
3473 return -1;
3474 }
3475
3476 if (copy_file(oldpath, newpath) < 0) {
3477 ERROR("error: copying %s to %s", oldpath, newpath);
3478 return -1;
3479 }
3480
3481 free(c->lxc_conf->fstab);
3482
3483 c->lxc_conf->fstab = strdup(newpath);
3484 if (!c->lxc_conf->fstab) {
3485 ERROR("error: allocating pathname");
3486 return -1;
3487 }
3488
3489 if (!do_append_unexp_config_line(c->lxc_conf, "lxc.mount.fstab", newpath)) {
3490 ERROR("error saving new lxctab");
3491 return -1;
3492 }
3493
3494 return 0;
3495 }
3496
3497 static void copy_rdepends(struct lxc_container *c, struct lxc_container *c0)
3498 {
3499 char path0[PATH_MAX], path1[PATH_MAX];
3500 int ret;
3501
3502 ret = snprintf(path0, PATH_MAX, "%s/%s/lxc_rdepends", c0->config_path,
3503 c0->name);
3504 if (ret < 0 || ret >= PATH_MAX) {
3505 WARN("Error copying reverse dependencies");
3506 return;
3507 }
3508
3509 ret = snprintf(path1, PATH_MAX, "%s/%s/lxc_rdepends", c->config_path,
3510 c->name);
3511 if (ret < 0 || ret >= PATH_MAX) {
3512 WARN("Error copying reverse dependencies");
3513 return;
3514 }
3515
3516 if (copy_file(path0, path1) < 0) {
3517 INFO("Error copying reverse dependencies");
3518 return;
3519 }
3520 }
3521
3522 static bool add_rdepends(struct lxc_container *c, struct lxc_container *c0)
3523 {
3524 __do_fclose FILE *f = NULL;
3525 int ret;
3526 char path[PATH_MAX];
3527
3528 ret = snprintf(path, sizeof(path), "%s/%s/lxc_rdepends", c->config_path, c->name);
3529 if (ret < 0 || ret >= sizeof(path))
3530 return false;
3531
3532 f = fopen(path, "ae");
3533 if (!f)
3534 return false;
3535
3536 /* If anything goes wrong, just return an error. */
3537 return fprintf(f, "%s\n%s\n", c0->config_path, c0->name) > 0;
3538 }
3539
3540 /*
3541 * If the fs natively supports snapshot clones with no penalty,
3542 * then default to those even if not requested.
3543 * Currently we only do this for btrfs.
3544 */
3545 static bool should_default_to_snapshot(struct lxc_container *c0,
3546 struct lxc_container *c1)
3547 {
3548 __do_free char *p0 = NULL, *p1 = NULL;
3549 int ret;
3550 size_t l0 = strlen(c0->config_path) + strlen(c0->name) + 2;
3551 size_t l1 = strlen(c1->config_path) + strlen(c1->name) + 2;
3552 char *rootfs = c0->lxc_conf->rootfs.path;
3553
3554 p0 = must_realloc(NULL, l0 + 1);
3555 p1 = must_realloc(NULL, l1 + 1);
3556 ret = snprintf(p0, l0, "%s/%s", c0->config_path, c0->name);
3557 if (ret < 0 || ret >= l0)
3558 return false;
3559
3560 ret = snprintf(p1, l1, "%s/%s", c1->config_path, c1->name);
3561 if (ret < 0 || ret >= l1)
3562 return false;
3563
3564 if (!is_btrfs_fs(p0) || !is_btrfs_fs(p1))
3565 return false;
3566
3567 if (is_btrfs_subvol(rootfs) <= 0)
3568 return false;
3569
3570 return btrfs_same_fs(p0, p1) == 0;
3571 }
3572
3573 static int copy_storage(struct lxc_container *c0, struct lxc_container *c,
3574 const char *newtype, int flags, const char *bdevdata,
3575 uint64_t newsize)
3576 {
3577 struct lxc_storage *bdev;
3578 bool need_rdep;
3579
3580 if (should_default_to_snapshot(c0, c))
3581 flags |= LXC_CLONE_SNAPSHOT;
3582
3583 bdev = storage_copy(c0, c->name, c->config_path, newtype, flags,
3584 bdevdata, newsize, &need_rdep);
3585 if (!bdev) {
3586 ERROR("Error copying storage.");
3587 return -1;
3588 }
3589
3590 /* Set new rootfs. */
3591 free(c->lxc_conf->rootfs.path);
3592 c->lxc_conf->rootfs.path = strdup(bdev->src);
3593 storage_put(bdev);
3594
3595 if (!c->lxc_conf->rootfs.path) {
3596 ERROR("Out of memory while setting storage path.");
3597 return -1;
3598 }
3599
3600 /* Append a new lxc.rootfs.path entry to the unexpanded config. */
3601 clear_unexp_config_line(c->lxc_conf, "lxc.rootfs.path", false);
3602 if (!do_append_unexp_config_line(c->lxc_conf, "lxc.rootfs.path",
3603 c->lxc_conf->rootfs.path)) {
3604 ERROR("Error saving new rootfs to cloned config.");
3605 return -1;
3606 }
3607
3608 if (flags & LXC_CLONE_SNAPSHOT)
3609 copy_rdepends(c, c0);
3610
3611 if (need_rdep) {
3612 if (!add_rdepends(c, c0))
3613 WARN("Error adding reverse dependency from %s to %s",
3614 c->name, c0->name);
3615 }
3616
3617 mod_all_rdeps(c, true);
3618
3619 return 0;
3620 }
3621
3622 struct clone_update_data {
3623 struct lxc_container *c0;
3624 struct lxc_container *c1;
3625 int flags;
3626 char **hookargs;
3627 };
3628
3629 static int clone_update_rootfs(struct clone_update_data *data)
3630 {
3631 struct lxc_container *c0 = data->c0;
3632 struct lxc_container *c = data->c1;
3633 int flags = data->flags;
3634 char **hookargs = data->hookargs;
3635 int ret = -1;
3636 char path[PATH_MAX];
3637 struct lxc_storage *bdev;
3638 FILE *fout;
3639 struct lxc_conf *conf = c->lxc_conf;
3640
3641 /* update hostname in rootfs */
3642 /* we're going to mount, so run in a clean namespace to simplify cleanup */
3643
3644 (void)lxc_setgroups(0, NULL);
3645
3646 if (setgid(0) < 0) {
3647 ERROR("Failed to setgid to 0");
3648 return -1;
3649 }
3650
3651 if (setuid(0) < 0) {
3652 ERROR("Failed to setuid to 0");
3653 return -1;
3654 }
3655
3656 if (unshare(CLONE_NEWNS) < 0)
3657 return -1;
3658
3659 bdev = storage_init(c->lxc_conf);
3660 if (!bdev)
3661 return -1;
3662
3663 if (strcmp(bdev->type, "dir") != 0) {
3664 if (unshare(CLONE_NEWNS) < 0) {
3665 ERROR("error unsharing mounts");
3666 storage_put(bdev);
3667 return -1;
3668 }
3669
3670 if (detect_shared_rootfs() && mount(NULL, "/", NULL, MS_SLAVE | MS_REC, NULL))
3671 SYSERROR("Failed to recursively turn root mount tree into dependent mount. Continuing...");
3672
3673 if (bdev->ops->mount(bdev) < 0) {
3674 storage_put(bdev);
3675 return -1;
3676 }
3677 } else { /* TODO come up with a better way */
3678 free(bdev->dest);
3679 bdev->dest = strdup(lxc_storage_get_path(bdev->src, bdev->type));
3680 }
3681
3682 if (!lxc_list_empty(&conf->hooks[LXCHOOK_CLONE])) {
3683 /* Start of environment variable setup for hooks */
3684 if (c0->name && setenv("LXC_SRC_NAME", c0->name, 1))
3685 SYSERROR("failed to set environment variable for source container name");
3686
3687 if (setenv("LXC_NAME", c->name, 1))
3688 SYSERROR("failed to set environment variable for container name");
3689
3690 if (conf->rcfile && setenv("LXC_CONFIG_FILE", conf->rcfile, 1))
3691 SYSERROR("failed to set environment variable for config path");
3692
3693 if (bdev->dest && setenv("LXC_ROOTFS_MOUNT", bdev->dest, 1))
3694 SYSERROR("failed to set environment variable for rootfs mount");
3695
3696 if (conf->rootfs.path && setenv("LXC_ROOTFS_PATH", conf->rootfs.path, 1))
3697 SYSERROR("failed to set environment variable for rootfs mount");
3698
3699 if (run_lxc_hooks(c->name, "clone", conf, hookargs)) {
3700 ERROR("Error executing clone hook for %s", c->name);
3701 storage_put(bdev);
3702 return -1;
3703 }
3704 }
3705
3706 if (!(flags & LXC_CLONE_KEEPNAME)) {
3707 ret = snprintf(path, PATH_MAX, "%s/etc/hostname", bdev->dest);
3708 storage_put(bdev);
3709
3710 if (ret < 0 || ret >= PATH_MAX)
3711 return -1;
3712
3713 if (!file_exists(path))
3714 return 0;
3715
3716 if (!(fout = fopen(path, "we"))) {
3717 SYSERROR("unable to open %s: ignoring", path);
3718 return 0;
3719 }
3720
3721 if (fprintf(fout, "%s", c->name) < 0) {
3722 fclose(fout);
3723 return -1;
3724 }
3725
3726 if (fclose(fout) < 0)
3727 return -1;
3728 } else {
3729 storage_put(bdev);
3730 }
3731
3732 return 0;
3733 }
3734
3735 static int clone_update_rootfs_wrapper(void *data)
3736 {
3737 struct clone_update_data *arg = (struct clone_update_data *) data;
3738 return clone_update_rootfs(arg);
3739 }
3740
3741 /*
3742 * We want to support:
3743 sudo lxc-clone -o o1 -n n1 -s -L|-fssize fssize -v|--vgname vgname \
3744 -p|--lvprefix lvprefix -t|--fstype fstype -B backingstore
3745
3746 -s [ implies overlay]
3747 -s -B overlay
3748
3749 only rootfs gets converted (copied/snapshotted) on clone.
3750 */
3751
3752 static int create_file_dirname(char *path, struct lxc_conf *conf)
3753 {
3754 char *p = strrchr(path, '/');
3755 int ret = -1;
3756
3757 if (!p)
3758 return -1;
3759
3760 *p = '\0';
3761 ret = do_create_container_dir(path, conf);
3762 *p = '/';
3763
3764 return ret;
3765 }
3766
3767 static struct lxc_container *do_lxcapi_clone(struct lxc_container *c, const char *newname,
3768 const char *lxcpath, int flags,
3769 const char *bdevtype, const char *bdevdata, uint64_t newsize,
3770 char **hookargs)
3771 {
3772 char newpath[PATH_MAX];
3773 int fd, ret;
3774 struct clone_update_data data;
3775 size_t saved_unexp_len;
3776 pid_t pid;
3777 int storage_copied = 0;
3778 char *origroot = NULL, *saved_unexp_conf = NULL;
3779 struct lxc_container *c2 = NULL;
3780
3781 if (!c || !do_lxcapi_is_defined(c))
3782 return NULL;
3783
3784 if (container_mem_lock(c))
3785 return NULL;
3786 if (!is_stopped(c) && !(flags & LXC_CLONE_ALLOW_RUNNING)) {
3787 ERROR("error: Original container (%s) is running. Use --allowrunning if you want to force a snapshot of the running container.", c->name);
3788 goto out;
3789 }
3790
3791 /* Make sure the container doesn't yet exist. */
3792 if (!newname)
3793 newname = c->name;
3794
3795 if (!lxcpath)
3796 lxcpath = do_lxcapi_get_config_path(c);
3797
3798 ret = snprintf(newpath, PATH_MAX, "%s/%s/%s", lxcpath, newname, LXC_CONFIG_FNAME);
3799 if (ret < 0 || ret >= PATH_MAX) {
3800 SYSERROR("clone: failed making config pathname");
3801 goto out;
3802 }
3803
3804 if (file_exists(newpath)) {
3805 ERROR("error: clone: %s exists", newpath);
3806 goto out;
3807 }
3808
3809 ret = create_file_dirname(newpath, c->lxc_conf);
3810 if (ret < 0 && errno != EEXIST) {
3811 ERROR("Error creating container dir for %s", newpath);
3812 goto out;
3813 }
3814
3815 /* Copy the configuration. Tweak it as needed. */
3816 if (c->lxc_conf->rootfs.path) {
3817 origroot = c->lxc_conf->rootfs.path;
3818 c->lxc_conf->rootfs.path = NULL;
3819 }
3820
3821 fd = open(newpath, O_WRONLY | O_CREAT | O_CLOEXEC,
3822 S_IRUSR | S_IWUSR | S_IRGRP | S_IWGRP);
3823 if (fd < 0) {
3824 SYSERROR("Failed to open \"%s\"", newpath);
3825 goto out;
3826 }
3827
3828 saved_unexp_conf = c->lxc_conf->unexpanded_config;
3829 saved_unexp_len = c->lxc_conf->unexpanded_len;
3830 c->lxc_conf->unexpanded_config = strdup(saved_unexp_conf);
3831 if (!c->lxc_conf->unexpanded_config) {
3832 close(fd);
3833 goto out;
3834 }
3835
3836 clear_unexp_config_line(c->lxc_conf, "lxc.rootfs.path", false);
3837 write_config(fd, c->lxc_conf);
3838 close(fd);
3839
3840 c->lxc_conf->rootfs.path = origroot;
3841
3842 free(c->lxc_conf->unexpanded_config);
3843 c->lxc_conf->unexpanded_config = saved_unexp_conf;
3844 saved_unexp_conf = NULL;
3845 c->lxc_conf->unexpanded_len = saved_unexp_len;
3846
3847 ret = snprintf(newpath, PATH_MAX, "%s/%s/%s", lxcpath, newname, LXC_ROOTFS_DNAME);
3848 if (ret < 0 || ret >= PATH_MAX) {
3849 SYSERROR("clone: failed making rootfs pathname");
3850 goto out;
3851 }
3852
3853 ret = mkdir(newpath, 0755);
3854 if (ret < 0) {
3855 /* For an overlay container the rootfs is considered immutable
3856 * and will not have been removed when restoring from a
3857 * snapshot.
3858 */
3859 if (errno != ENOENT &&
3860 !(flags & LXC_STORAGE_INTERNAL_OVERLAY_RESTORE)) {
3861 SYSERROR("Failed to create directory \"%s\"", newpath);
3862 goto out;
3863 }
3864 }
3865
3866 if (am_guest_unpriv()) {
3867 if (chown_mapped_root(newpath, c->lxc_conf) < 0) {
3868 ERROR("Error chowning %s to container root", newpath);
3869 goto out;
3870 }
3871 }
3872
3873 c2 = lxc_container_new(newname, lxcpath);
3874 if (!c2) {
3875 ERROR("clone: failed to create new container (%s %s)", newname,
3876 lxcpath);
3877 goto out;
3878 }
3879
3880 /* copy/snapshot rootfs's */
3881 ret = copy_storage(c, c2, bdevtype, flags, bdevdata, newsize);
3882 if (ret < 0)
3883 goto out;
3884
3885 /* update utsname */
3886 if (!(flags & LXC_CLONE_KEEPNAME)) {
3887 clear_unexp_config_line(c2->lxc_conf, "lxc.utsname", false);
3888 clear_unexp_config_line(c2->lxc_conf, "lxc.uts.name", false);
3889
3890 if (!do_set_config_item_locked(c2, "lxc.uts.name", newname)) {
3891 ERROR("Error setting new hostname");
3892 goto out;
3893 }
3894 }
3895
3896 /* copy hooks */
3897 ret = copyhooks(c, c2);
3898 if (ret < 0) {
3899 ERROR("error copying hooks");
3900 goto out;
3901 }
3902
3903 if (copy_fstab(c, c2) < 0) {
3904 ERROR("error copying fstab");
3905 goto out;
3906 }
3907
3908 /* update macaddrs */
3909 if (!(flags & LXC_CLONE_KEEPMACADDR)) {
3910 if (!network_new_hwaddrs(c2->lxc_conf)) {
3911 ERROR("Error updating mac addresses");
3912 goto out;
3913 }
3914 }
3915
3916 /* Update absolute paths for overlay mount directories. */
3917 if (ovl_update_abs_paths(c2->lxc_conf, c->config_path, c->name, lxcpath, newname) < 0)
3918 goto out;
3919
3920 /* We've now successfully created c2's storage, so clear it out if we
3921 * fail after this.
3922 */
3923 storage_copied = 1;
3924
3925 if (!c2->save_config(c2, NULL))
3926 goto out;
3927
3928 if ((pid = fork()) < 0) {
3929 SYSERROR("fork");
3930 goto out;
3931 }
3932
3933 if (pid > 0) {
3934 ret = wait_for_pid(pid);
3935 if (ret)
3936 goto out;
3937
3938 container_mem_unlock(c);
3939 return c2;
3940 }
3941
3942 data.c0 = c;
3943 data.c1 = c2;
3944 data.flags = flags;
3945 data.hookargs = hookargs;
3946
3947 if (am_guest_unpriv())
3948 ret = userns_exec_full(c->lxc_conf, clone_update_rootfs_wrapper,
3949 &data, "clone_update_rootfs_wrapper");
3950 else
3951 ret = clone_update_rootfs(&data);
3952 if (ret < 0)
3953 _exit(EXIT_FAILURE);
3954
3955 container_mem_unlock(c);
3956 _exit(EXIT_SUCCESS);
3957
3958 out:
3959 container_mem_unlock(c);
3960 if (c2) {
3961 if (!storage_copied)
3962 c2->lxc_conf->rootfs.path = NULL;
3963
3964 c2->destroy(c2);
3965 lxc_container_put(c2);
3966 }
3967
3968 return NULL;
3969 }
3970
3971 static struct lxc_container *lxcapi_clone(struct lxc_container *c, const char *newname,
3972 const char *lxcpath, int flags,
3973 const char *bdevtype, const char *bdevdata, uint64_t newsize,
3974 char **hookargs)
3975 {
3976 struct lxc_container * ret;
3977
3978 current_config = c ? c->lxc_conf : NULL;
3979 ret = do_lxcapi_clone(c, newname, lxcpath, flags, bdevtype, bdevdata, newsize, hookargs);
3980 current_config = NULL;
3981
3982 return ret;
3983 }
3984
3985 static bool do_lxcapi_rename(struct lxc_container *c, const char *newname)
3986 {
3987 struct lxc_storage *bdev;
3988 struct lxc_container *newc;
3989
3990 if (!c || !c->name || !c->config_path || !c->lxc_conf)
3991 return false;
3992
3993 if (has_fs_snapshots(c) || has_snapshots(c)) {
3994 ERROR("Renaming a container with snapshots is not supported");
3995 return false;
3996 }
3997
3998 bdev = storage_init(c->lxc_conf);
3999 if (!bdev) {
4000 ERROR("Failed to find original backing store type");
4001 return false;
4002 }
4003
4004 newc = lxcapi_clone(c, newname, c->config_path, LXC_CLONE_KEEPMACADDR, NULL, bdev->type, 0, NULL);
4005 storage_put(bdev);
4006 if (!newc) {
4007 lxc_container_put(newc);
4008 return false;
4009 }
4010
4011 if (newc && lxcapi_is_defined(newc))
4012 lxc_container_put(newc);
4013
4014 if (!container_destroy(c, NULL)) {
4015 ERROR("Could not destroy existing container %s", c->name);
4016 return false;
4017 }
4018
4019 return true;
4020 }
4021
4022 WRAP_API_1(bool, lxcapi_rename, const char *)
4023
4024 static int lxcapi_attach(struct lxc_container *c,
4025 lxc_attach_exec_t exec_function, void *exec_payload,
4026 lxc_attach_options_t *options, pid_t *attached_process)
4027 {
4028 int ret;
4029
4030 if (!c)
4031 return -1;
4032
4033 current_config = c->lxc_conf;
4034
4035 ret = lxc_attach(c, exec_function, exec_payload, options,
4036 attached_process);
4037 current_config = NULL;
4038 return ret;
4039 }
4040
4041 static int do_lxcapi_attach_run_wait(struct lxc_container *c,
4042 lxc_attach_options_t *options,
4043 const char *program,
4044 const char *const argv[])
4045 {
4046 lxc_attach_command_t command;
4047 pid_t pid;
4048 int ret;
4049
4050 if (!c)
4051 return -1;
4052
4053 command.program = (char *)program;
4054 command.argv = (char **)argv;
4055
4056 ret = lxc_attach(c, lxc_attach_run_command, &command, options, &pid);
4057 if (ret < 0)
4058 return ret;
4059
4060 return lxc_wait_for_pid_status(pid);
4061 }
4062
4063 static int lxcapi_attach_run_wait(struct lxc_container *c,
4064 lxc_attach_options_t *options,
4065 const char *program, const char *const argv[])
4066 {
4067 int ret;
4068
4069 current_config = c ? c->lxc_conf : NULL;
4070 ret = do_lxcapi_attach_run_wait(c, options, program, argv);
4071 current_config = NULL;
4072
4073 return ret;
4074 }
4075
4076 static int get_next_index(const char *lxcpath, char *cname)
4077 {
4078 __do_free char *fname = NULL;
4079 struct stat sb;
4080 int i = 0, ret;
4081
4082 fname = must_realloc(NULL, strlen(lxcpath) + 20);
4083
4084 for (;;) {
4085 sprintf(fname, "%s/snap%d", lxcpath, i);
4086
4087 ret = stat(fname, &sb);
4088 if (ret != 0)
4089 return i;
4090
4091 i++;
4092 }
4093 }
4094
4095 static bool get_snappath_dir(struct lxc_container *c, char *snappath)
4096 {
4097 int ret;
4098
4099 /*
4100 * If the old style snapshot path exists, use it
4101 * /var/lib/lxc -> /var/lib/lxcsnaps
4102 */
4103 ret = snprintf(snappath, PATH_MAX, "%ssnaps", c->config_path);
4104 if (ret < 0 || ret >= PATH_MAX)
4105 return false;
4106
4107 if (dir_exists(snappath)) {
4108 ret = snprintf(snappath, PATH_MAX, "%ssnaps/%s", c->config_path, c->name);
4109 if (ret < 0 || ret >= PATH_MAX)
4110 return false;
4111
4112 return true;
4113 }
4114
4115 /*
4116 * Use the new style path
4117 * /var/lib/lxc -> /var/lib/lxc + c->name + /snaps + \0
4118 */
4119 ret = snprintf(snappath, PATH_MAX, "%s/%s/snaps", c->config_path, c->name);
4120 if (ret < 0 || ret >= PATH_MAX)
4121 return false;
4122
4123 return true;
4124 }
4125
4126 static int do_lxcapi_snapshot(struct lxc_container *c, const char *commentfile)
4127 {
4128 __do_free char *dfnam = NULL;
4129 int len;
4130 int i, flags, ret;
4131 time_t timer;
4132 struct tm tm_info;
4133 struct lxc_container *c2;
4134 char snappath[PATH_MAX], newname[20];
4135 char buffer[25];
4136 FILE *f;
4137
4138 if (!c || !lxcapi_is_defined(c))
4139 return -1;
4140
4141 if (!storage_can_backup(c->lxc_conf)) {
4142 ERROR("%s's backing store cannot be backed up", c->name);
4143 ERROR("Your container must use another backing store type");
4144 return -1;
4145 }
4146
4147 if (!get_snappath_dir(c, snappath))
4148 return -1;
4149
4150 i = get_next_index(snappath, c->name);
4151
4152 if (mkdir_p(snappath, 0755) < 0) {
4153 ERROR("Failed to create snapshot directory %s", snappath);
4154 return -1;
4155 }
4156
4157 ret = snprintf(newname, 20, "snap%d", i);
4158 if (ret < 0 || ret >= 20)
4159 return -1;
4160
4161 /*
4162 * We pass LXC_CLONE_SNAPSHOT to make sure that a rdepends file entry is
4163 * created in the original container
4164 */
4165 flags = LXC_CLONE_SNAPSHOT | LXC_CLONE_KEEPMACADDR | LXC_CLONE_KEEPNAME |
4166 LXC_CLONE_KEEPBDEVTYPE | LXC_CLONE_MAYBE_SNAPSHOT;
4167 if (storage_is_dir(c->lxc_conf)) {
4168 ERROR("Snapshot of directory-backed container requested");
4169 ERROR("Making a copy-clone. If you do want snapshots, then");
4170 ERROR("please create overlay clone first, snapshot that");
4171 ERROR("and keep the original container pristine");
4172 flags &= ~LXC_CLONE_SNAPSHOT | LXC_CLONE_MAYBE_SNAPSHOT;
4173 }
4174
4175 c2 = do_lxcapi_clone(c, newname, snappath, flags, NULL, NULL, 0, NULL);
4176 if (!c2) {
4177 ERROR("Failed to clone of %s:%s", c->config_path, c->name);
4178 return -1;
4179 }
4180
4181 lxc_container_put(c2);
4182
4183 /* Now write down the creation time. */
4184 time(&timer);
4185
4186 if (!localtime_r(&timer, &tm_info)) {
4187 ERROR("Failed to get localtime");
4188 return -1;
4189 }
4190
4191 strftime(buffer, 25, "%Y:%m:%d %H:%M:%S", &tm_info);
4192
4193 len = strlen(snappath) + 1 + strlen(newname) + 1 + strlen(LXC_TIMESTAMP_FNAME) + 1;
4194 dfnam = must_realloc(NULL, len);
4195 snprintf(dfnam, len, "%s/%s/%s", snappath, newname, LXC_TIMESTAMP_FNAME);
4196 f = fopen(dfnam, "we");
4197 if (!f) {
4198 ERROR("Failed to open %s", dfnam);
4199 return -1;
4200 }
4201
4202 if (fprintf(f, "%s", buffer) < 0) {
4203 SYSERROR("Writing timestamp");
4204 fclose(f);
4205 return -1;
4206 }
4207
4208 ret = fclose(f);
4209 if (ret != 0) {
4210 SYSERROR("Writing timestamp");
4211 return -1;
4212 }
4213
4214 if (commentfile) {
4215 __do_free char *path = NULL;
4216 /* $p / $name / comment \0 */
4217 len = strlen(snappath) + 1 + strlen(newname) + 1 + strlen(LXC_COMMENT_FNAME) + 1;
4218
4219 path = must_realloc(NULL, len);
4220 snprintf(path, len, "%s/%s/%s", snappath, newname, LXC_COMMENT_FNAME);
4221 return copy_file(commentfile, path) < 0 ? -1 : i;
4222 }
4223
4224 return i;
4225 }
4226
4227 WRAP_API_1(int, lxcapi_snapshot, const char *)
4228
4229 static void lxcsnap_free(struct lxc_snapshot *s)
4230 {
4231 free(s->name);
4232 free(s->comment_pathname);
4233 free(s->timestamp);
4234 free(s->lxcpath);
4235 }
4236
4237 static char *get_snapcomment_path(char* snappath, char *name)
4238 {
4239 /* $snappath/$name/comment */
4240 int ret, len = strlen(snappath) + strlen(name) + 10;
4241 char *s = malloc(len);
4242
4243 if (s) {
4244 ret = snprintf(s, len, "%s/%s/comment", snappath, name);
4245 if (ret < 0 || ret >= len) {
4246 free(s);
4247 s = NULL;
4248 }
4249 }
4250
4251 return s;
4252 }
4253
4254 static char *get_timestamp(char* snappath, char *name)
4255 {
4256 __do_free char *s = NULL;
4257 __do_fclose FILE *fin = NULL;
4258 char path[PATH_MAX];
4259 int ret, len;
4260
4261 ret = snprintf(path, PATH_MAX, "%s/%s/ts", snappath, name);
4262 if (ret < 0 || ret >= PATH_MAX)
4263 return NULL;
4264
4265 fin = fopen(path, "re");
4266 if (!fin)
4267 return NULL;
4268
4269 (void) fseek(fin, 0, SEEK_END);
4270 len = ftell(fin);
4271 (void) fseek(fin, 0, SEEK_SET);
4272 if (len > 0) {
4273 s = malloc(len+1);
4274 if (s) {
4275 s[len] = '\0';
4276 if (fread(s, 1, len, fin) != len)
4277 return log_error_errno(NULL, errno, "reading timestamp");
4278 }
4279 }
4280
4281 return move_ptr(s);
4282 }
4283
4284 static int do_lxcapi_snapshot_list(struct lxc_container *c, struct lxc_snapshot **ret_snaps)
4285 {
4286 __do_closedir DIR *dir = NULL;
4287 char snappath[PATH_MAX], path2[PATH_MAX];
4288 int count = 0, ret;
4289 struct dirent *direntp;
4290 struct lxc_snapshot *snaps =NULL, *nsnaps;
4291
4292 if (!c || !lxcapi_is_defined(c))
4293 return -1;
4294
4295 if (!get_snappath_dir(c, snappath)) {
4296 ERROR("path name too long");
4297 return -1;
4298 }
4299
4300 dir = opendir(snappath);
4301 if (!dir) {
4302 INFO("Failed to open %s - assuming no snapshots", snappath);
4303 return 0;
4304 }
4305
4306 while ((direntp = readdir(dir))) {
4307 if (!strcmp(direntp->d_name, "."))
4308 continue;
4309
4310 if (!strcmp(direntp->d_name, ".."))
4311 continue;
4312
4313 ret = snprintf(path2, PATH_MAX, "%s/%s/%s", snappath, direntp->d_name, LXC_CONFIG_FNAME);
4314 if (ret < 0 || ret >= PATH_MAX) {
4315 ERROR("pathname too long");
4316 goto out_free;
4317 }
4318
4319 if (!file_exists(path2))
4320 continue;
4321
4322 nsnaps = realloc(snaps, (count + 1)*sizeof(*snaps));
4323 if (!nsnaps) {
4324 SYSERROR("Out of memory");
4325 goto out_free;
4326 }
4327
4328 snaps = nsnaps;
4329 snaps[count].free = lxcsnap_free;
4330 snaps[count].name = strdup(direntp->d_name);
4331 if (!snaps[count].name)
4332 goto out_free;
4333
4334 snaps[count].lxcpath = strdup(snappath);
4335 if (!snaps[count].lxcpath) {
4336 free(snaps[count].name);
4337 goto out_free;
4338 }
4339
4340 snaps[count].comment_pathname = get_snapcomment_path(snappath, direntp->d_name);
4341 snaps[count].timestamp = get_timestamp(snappath, direntp->d_name);
4342 count++;
4343 }
4344
4345 *ret_snaps = snaps;
4346 return count;
4347
4348 out_free:
4349 if (snaps) {
4350 for (int i = 0; i < count; i++)
4351 lxcsnap_free(&snaps[i]);
4352
4353 free(snaps);
4354 }
4355
4356 return -1;
4357 }
4358
4359 WRAP_API_1(int, lxcapi_snapshot_list, struct lxc_snapshot **)
4360
4361 static bool do_lxcapi_snapshot_restore(struct lxc_container *c, const char *snapname, const char *newname)
4362 {
4363 char clonelxcpath[PATH_MAX];
4364 int flags = 0;
4365 struct lxc_container *snap, *rest;
4366 struct lxc_storage *bdev;
4367 bool b = false;
4368
4369 if (!c || !c->name || !c->config_path)
4370 return false;
4371
4372 if (has_fs_snapshots(c)) {
4373 ERROR("container rootfs has dependent snapshots");
4374 return false;
4375 }
4376
4377 bdev = storage_init(c->lxc_conf);
4378 if (!bdev) {
4379 ERROR("Failed to find original backing store type");
4380 return false;
4381 }
4382
4383 /* For an overlay container the rootfs is considered immutable
4384 * and cannot be removed when restoring from a snapshot. We pass this
4385 * internal flag along to communicate this to various parts of the
4386 * codebase.
4387 */
4388 if (!strcmp(bdev->type, "overlay") || !strcmp(bdev->type, "overlayfs"))
4389 bdev->flags |= LXC_STORAGE_INTERNAL_OVERLAY_RESTORE;
4390
4391 if (!newname)
4392 newname = c->name;
4393
4394 if (!get_snappath_dir(c, clonelxcpath)) {
4395 storage_put(bdev);
4396 return false;
4397 }
4398 /* how should we lock this? */
4399
4400 snap = lxc_container_new(snapname, clonelxcpath);
4401 if (!snap || !lxcapi_is_defined(snap)) {
4402 ERROR("Could not open snapshot %s", snapname);
4403
4404 if (snap)
4405 lxc_container_put(snap);
4406
4407 storage_put(bdev);
4408 return false;
4409 }
4410
4411 if (!strcmp(c->name, newname)) {
4412 if (!container_destroy(c, bdev)) {
4413 ERROR("Could not destroy existing container %s", newname);
4414 lxc_container_put(snap);
4415 storage_put(bdev);
4416 return false;
4417 }
4418 }
4419
4420 if (strcmp(bdev->type, "dir") != 0 && strcmp(bdev->type, "loop") != 0)
4421 flags = LXC_CLONE_SNAPSHOT | LXC_CLONE_MAYBE_SNAPSHOT;
4422
4423 if (!strcmp(bdev->type, "overlay") || !strcmp(bdev->type, "overlayfs"))
4424 flags |= LXC_STORAGE_INTERNAL_OVERLAY_RESTORE;
4425
4426 rest = lxcapi_clone(snap, newname, c->config_path, flags, bdev->type,
4427 NULL, 0, NULL);
4428 storage_put(bdev);
4429 if (rest && lxcapi_is_defined(rest))
4430 b = true;
4431
4432 if (rest)
4433 lxc_container_put(rest);
4434
4435 lxc_container_put(snap);
4436 return b;
4437 }
4438
4439 WRAP_API_2(bool, lxcapi_snapshot_restore, const char *, const char *)
4440
4441 static bool do_snapshot_destroy(const char *snapname, const char *clonelxcpath)
4442 {
4443 struct lxc_container *snap = NULL;
4444 bool bret = false;
4445
4446 snap = lxc_container_new(snapname, clonelxcpath);
4447 if (!snap) {
4448 ERROR("Could not find snapshot %s", snapname);
4449 goto err;
4450 }
4451
4452 if (!do_lxcapi_destroy(snap)) {
4453 ERROR("Could not destroy snapshot %s", snapname);
4454 goto err;
4455 }
4456
4457 bret = true;
4458
4459 err:
4460 if (snap)
4461 lxc_container_put(snap);
4462
4463 return bret;
4464 }
4465
4466 static bool remove_all_snapshots(const char *path)
4467 {
4468 __do_closedir DIR *dir = NULL;
4469 struct dirent *direntp;
4470 bool bret = true;
4471
4472 dir = opendir(path);
4473 if (!dir) {
4474 SYSERROR("opendir on snapshot path %s", path);
4475 return false;
4476 }
4477
4478 while ((direntp = readdir(dir))) {
4479 if (!strcmp(direntp->d_name, "."))
4480 continue;
4481
4482 if (!strcmp(direntp->d_name, ".."))
4483 continue;
4484
4485 if (!do_snapshot_destroy(direntp->d_name, path)) {
4486 bret = false;
4487 continue;
4488 }
4489 }
4490
4491 if (rmdir(path))
4492 SYSERROR("Error removing directory %s", path);
4493
4494 return bret;
4495 }
4496
4497 static bool do_lxcapi_snapshot_destroy(struct lxc_container *c, const char *snapname)
4498 {
4499 char clonelxcpath[PATH_MAX];
4500
4501 if (!c || !c->name || !c->config_path || !snapname)
4502 return false;
4503
4504 if (!get_snappath_dir(c, clonelxcpath))
4505 return false;
4506
4507 return do_snapshot_destroy(snapname, clonelxcpath);
4508 }
4509
4510 WRAP_API_1(bool, lxcapi_snapshot_destroy, const char *)
4511
4512 static bool do_lxcapi_snapshot_destroy_all(struct lxc_container *c)
4513 {
4514 char clonelxcpath[PATH_MAX];
4515
4516 if (!c || !c->name || !c->config_path)
4517 return false;
4518
4519 if (!get_snappath_dir(c, clonelxcpath))
4520 return false;
4521
4522 return remove_all_snapshots(clonelxcpath);
4523 }
4524
4525 WRAP_API(bool, lxcapi_snapshot_destroy_all)
4526
4527 static bool do_lxcapi_may_control(struct lxc_container *c)
4528 {
4529 if (!c)
4530 return false;
4531
4532 return lxc_try_cmd(c->name, c->config_path) == 0;
4533 }
4534
4535 WRAP_API(bool, lxcapi_may_control)
4536
4537 static bool do_add_remove_node(pid_t init_pid, const char *path, bool add,
4538 struct stat *st)
4539 {
4540 int ret;
4541 char *tmp;
4542 pid_t pid;
4543 char chrootpath[PATH_MAX];
4544 char *directory_path = NULL;
4545
4546 pid = fork();
4547 if (pid < 0) {
4548 SYSERROR("Failed to fork()");
4549 return false;
4550 }
4551
4552 if (pid) {
4553 ret = wait_for_pid(pid);
4554 if (ret != 0) {
4555 ERROR("Failed to create device node");
4556 return false;
4557 }
4558
4559 return true;
4560 }
4561
4562 /* prepare the path */
4563 ret = snprintf(chrootpath, PATH_MAX, "/proc/%d/root", init_pid);
4564 if (ret < 0 || ret >= PATH_MAX)
4565 return false;
4566
4567 ret = chroot(chrootpath);
4568 if (ret < 0)
4569 _exit(EXIT_FAILURE);
4570
4571 ret = chdir("/");
4572 if (ret < 0)
4573 _exit(EXIT_FAILURE);
4574
4575 /* remove path if it exists */
4576 ret = faccessat(AT_FDCWD, path, F_OK, AT_SYMLINK_NOFOLLOW);
4577 if(ret == 0) {
4578 ret = unlink(path);
4579 if (ret < 0) {
4580 SYSERROR("Failed to remove \"%s\"", path);
4581 _exit(EXIT_FAILURE);
4582 }
4583 }
4584
4585 if (!add)
4586 _exit(EXIT_SUCCESS);
4587
4588 /* create any missing directories */
4589 tmp = strdup(path);
4590 if (!tmp)
4591 _exit(EXIT_FAILURE);
4592
4593 directory_path = dirname(tmp);
4594 ret = mkdir_p(directory_path, 0755);
4595 if (ret < 0 && errno != EEXIST) {
4596 SYSERROR("Failed to create path \"%s\"", directory_path);
4597 free(tmp);
4598 _exit(EXIT_FAILURE);
4599 }
4600
4601 /* create the device node */
4602 ret = mknod(path, st->st_mode, st->st_rdev);
4603 free(tmp);
4604 if (ret < 0) {
4605 SYSERROR("Failed to create device node at \"%s\"", path);
4606 _exit(EXIT_FAILURE);
4607 }
4608
4609 _exit(EXIT_SUCCESS);
4610 }
4611
4612 static bool add_remove_device_node(struct lxc_container *c, const char *src_path, const char *dest_path, bool add)
4613 {
4614 int ret;
4615 struct stat st;
4616 char value[LXC_MAX_BUFFER];
4617 const char *p;
4618 pid_t init_pid;
4619
4620 /* make sure container is running */
4621 if (!do_lxcapi_is_running(c)) {
4622 ERROR("container is not running");
4623 return false;
4624 }
4625
4626 /* use src_path if dest_path is NULL otherwise use dest_path */
4627 p = dest_path ? dest_path : src_path;
4628
4629 /* make sure we can access p */
4630 if(access(p, F_OK) < 0 || stat(p, &st) < 0)
4631 return false;
4632
4633 /* continue if path is character device or block device */
4634 if (S_ISCHR(st.st_mode))
4635 ret = snprintf(value, LXC_MAX_BUFFER, "c %d:%d rwm", major(st.st_rdev), minor(st.st_rdev));
4636 else if (S_ISBLK(st.st_mode))
4637 ret = snprintf(value, LXC_MAX_BUFFER, "b %d:%d rwm", major(st.st_rdev), minor(st.st_rdev));
4638 else
4639 return false;
4640
4641 /* check snprintf return code */
4642 if (ret < 0 || ret >= LXC_MAX_BUFFER)
4643 return false;
4644
4645 init_pid = do_lxcapi_init_pid(c);
4646 if (init_pid < 0) {
4647 ERROR("Failed to get init pid");
4648 return false;
4649 }
4650
4651 if (!do_add_remove_node(init_pid, p, add, &st))
4652 return false;
4653
4654 /* add or remove device to/from cgroup access list */
4655 if (add) {
4656 if (!do_lxcapi_set_cgroup_item(c, "devices.allow", value)) {
4657 ERROR("set_cgroup_item failed while adding the device node");
4658 return false;
4659 }
4660 } else {
4661 if (!do_lxcapi_set_cgroup_item(c, "devices.deny", value)) {
4662 ERROR("set_cgroup_item failed while removing the device node");
4663 return false;
4664 }
4665 }
4666
4667 return true;
4668 }
4669
4670 static bool do_lxcapi_add_device_node(struct lxc_container *c, const char *src_path, const char *dest_path)
4671 {
4672 // cannot mknod if we're not privileged wrt init_user_ns
4673 if (am_host_unpriv()) {
4674 ERROR(LXC_UNPRIV_EOPNOTSUPP, __FUNCTION__);
4675 return false;
4676 }
4677
4678 return add_remove_device_node(c, src_path, dest_path, true);
4679 }
4680
4681 WRAP_API_2(bool, lxcapi_add_device_node, const char *, const char *)
4682
4683 static bool do_lxcapi_remove_device_node(struct lxc_container *c, const char *src_path, const char *dest_path)
4684 {
4685 if (am_guest_unpriv()) {
4686 ERROR(LXC_UNPRIV_EOPNOTSUPP, __FUNCTION__);
4687 return false;
4688 }
4689
4690 return add_remove_device_node(c, src_path, dest_path, false);
4691 }
4692
4693 WRAP_API_2(bool, lxcapi_remove_device_node, const char *, const char *)
4694
4695 static bool do_lxcapi_attach_interface(struct lxc_container *c,
4696 const char *ifname,
4697 const char *dst_ifname)
4698 {
4699 pid_t init_pid;
4700 int ret = 0;
4701
4702 if (am_guest_unpriv()) {
4703 ERROR(LXC_UNPRIV_EOPNOTSUPP, __FUNCTION__);
4704 return false;
4705 }
4706
4707 if (!ifname) {
4708 ERROR("No source interface name given");
4709 return false;
4710 }
4711
4712 ret = lxc_netdev_isup(ifname);
4713 if (ret > 0) {
4714 /* netdev of ifname is up. */
4715 ret = lxc_netdev_down(ifname);
4716 if (ret)
4717 goto err;
4718 }
4719
4720 init_pid = do_lxcapi_init_pid(c);
4721 if (init_pid < 0) {
4722 ERROR("Failed to get init pid");
4723 goto err;
4724 }
4725
4726 ret = lxc_netdev_move_by_name(ifname, init_pid, dst_ifname);
4727 if (ret)
4728 goto err;
4729
4730 INFO("Moved network device \"%s\" to network namespace of %d", ifname, init_pid);
4731 return true;
4732
4733 err:
4734 return false;
4735 }
4736
4737 WRAP_API_2(bool, lxcapi_attach_interface, const char *, const char *)
4738
4739 static bool do_lxcapi_detach_interface(struct lxc_container *c,
4740 const char *ifname,
4741 const char *dst_ifname)
4742 {
4743 int ret;
4744 pid_t pid, pid_outside;
4745 __do_free char *physname = NULL;
4746
4747 /*
4748 * TODO - if this is a physical device, then we need am_host_unpriv.
4749 * But for other types guest privilege suffices.
4750 */
4751 if (am_guest_unpriv()) {
4752 ERROR(LXC_UNPRIV_EOPNOTSUPP, __FUNCTION__);
4753 return false;
4754 }
4755
4756 if (!ifname) {
4757 ERROR("No source interface name given");
4758 return false;
4759 }
4760
4761 pid_outside = lxc_raw_getpid();
4762 pid = fork();
4763 if (pid < 0) {
4764 ERROR("Failed to fork");
4765 return false;
4766 }
4767
4768 if (pid == 0) { /* child */
4769 pid_t init_pid;
4770
4771 init_pid = do_lxcapi_init_pid(c);
4772 if (init_pid < 0) {
4773 ERROR("Failed to get init pid");
4774 _exit(EXIT_FAILURE);
4775 }
4776 if (!switch_to_ns(init_pid, "net")) {
4777 ERROR("Failed to enter network namespace");
4778 _exit(EXIT_FAILURE);
4779 }
4780
4781 /* create new mount namespace for use with remounting /sys and is_wlan() below. */
4782 ret = unshare(CLONE_NEWNS);
4783 if (ret < 0) {
4784 ERROR("Failed to unshare mount namespace");
4785 _exit(EXIT_FAILURE);
4786 }
4787
4788 /* set / recursively as private so that mount propagation doesn't affect us. */
4789 if (mount(NULL, "/", NULL, MS_REC | MS_PRIVATE, 0) < 0) {
4790 ERROR("Failed to recursively set / as private in mount namespace");
4791 _exit(EXIT_FAILURE);
4792 }
4793
4794 ret = lxc_netdev_isup(ifname);
4795 if (ret < 0) {
4796 ERROR("Failed to determine whether network device \"%s\" is up", ifname);
4797 _exit(EXIT_FAILURE);
4798 }
4799
4800 /* netdev of ifname is up. */
4801 if (ret) {
4802 ret = lxc_netdev_down(ifname);
4803 if (ret) {
4804 ERROR("Failed to set network device \"%s\" down", ifname);
4805 _exit(EXIT_FAILURE);
4806 }
4807 }
4808
4809 /* remount /sys so is_wlan() can check if this device is a wlan device. */
4810 lxc_attach_remount_sys_proc();
4811 physname = is_wlan(ifname);
4812 if (physname)
4813 ret = lxc_netdev_move_wlan(physname, ifname, pid_outside, dst_ifname);
4814 else
4815 ret = lxc_netdev_move_by_name(ifname, pid_outside, dst_ifname);
4816
4817 /* -EINVAL means there is no netdev named as ifname. */
4818 if (ret < 0) {
4819 if (ret == -EINVAL)
4820 ERROR("Network device \"%s\" not found", ifname);
4821 else
4822 ERROR("Failed to remove network device \"%s\"", ifname);
4823
4824 _exit(EXIT_FAILURE);
4825 }
4826
4827 _exit(EXIT_SUCCESS);
4828 }
4829
4830 ret = wait_for_pid(pid);
4831 if (ret != 0)
4832 return false;
4833
4834 INFO("Moved network device \"%s\" to network namespace of %d", ifname, pid_outside);
4835 return true;
4836 }
4837
4838 WRAP_API_2(bool, lxcapi_detach_interface, const char *, const char *)
4839
4840 static int do_lxcapi_migrate(struct lxc_container *c, unsigned int cmd,
4841 struct migrate_opts *opts, unsigned int size)
4842 {
4843 int ret = -1;
4844 struct migrate_opts *valid_opts = opts;
4845 uint64_t features_to_check = 0;
4846
4847 /* If the caller has a bigger (newer) struct migrate_opts, let's make
4848 * sure that the stuff on the end is zero, i.e. that they didn't ask us
4849 * to do anything special.
4850 */
4851 if (size > sizeof(*opts)) {
4852 unsigned char *addr;
4853 unsigned char *end;
4854
4855 addr = (void *)opts + sizeof(*opts);
4856 end = (void *)opts + size;
4857
4858 for (; addr < end; addr++)
4859 if (*addr)
4860 return -E2BIG;
4861 }
4862
4863 /* If the caller has a smaller struct, let's zero out the end for them
4864 * so we don't accidentally use bits of it that they didn't know about
4865 * to initialize.
4866 */
4867 if (size < sizeof(*opts)) {
4868 valid_opts = malloc(sizeof(*opts));
4869 if (!valid_opts)
4870 return -ENOMEM;
4871
4872 memset(valid_opts, 0, sizeof(*opts));
4873 memcpy(valid_opts, opts, size);
4874 }
4875
4876 switch (cmd) {
4877 case MIGRATE_PRE_DUMP:
4878 if (!do_lxcapi_is_running(c)) {
4879 ERROR("container is not running");
4880 goto on_error;
4881 }
4882
4883 ret = !__criu_pre_dump(c, valid_opts);
4884 break;
4885 case MIGRATE_DUMP:
4886 if (!do_lxcapi_is_running(c)) {
4887 ERROR("container is not running");
4888 goto on_error;
4889 }
4890
4891 ret = !__criu_dump(c, valid_opts);
4892 break;
4893 case MIGRATE_RESTORE:
4894 if (do_lxcapi_is_running(c)) {
4895 ERROR("container is already running");
4896 goto on_error;
4897 }
4898
4899 ret = !__criu_restore(c, valid_opts);
4900 break;
4901 case MIGRATE_FEATURE_CHECK:
4902 features_to_check = valid_opts->features_to_check;
4903 ret = !__criu_check_feature(&features_to_check);
4904 if (ret) {
4905 /* Something went wrong. Let's let the caller
4906 * know which feature checks failed. */
4907 valid_opts->features_to_check = features_to_check;
4908 }
4909 break;
4910 default:
4911 ERROR("invalid migrate command %u", cmd);
4912 ret = -EINVAL;
4913 }
4914
4915 on_error:
4916 if (size < sizeof(*opts))
4917 free(valid_opts);
4918
4919 return ret;
4920 }
4921
4922 WRAP_API_3(int, lxcapi_migrate, unsigned int, struct migrate_opts *, unsigned int)
4923
4924 static bool do_lxcapi_checkpoint(struct lxc_container *c, char *directory, bool stop, bool verbose)
4925 {
4926 struct migrate_opts opts;
4927
4928 memset(&opts, 0, sizeof(opts));
4929
4930 opts.directory = directory;
4931 opts.stop = stop;
4932 opts.verbose = verbose;
4933
4934 return !do_lxcapi_migrate(c, MIGRATE_DUMP, &opts, sizeof(opts));
4935 }
4936
4937 WRAP_API_3(bool, lxcapi_checkpoint, char *, bool, bool)
4938
4939 static bool do_lxcapi_restore(struct lxc_container *c, char *directory, bool verbose)
4940 {
4941 struct migrate_opts opts;
4942
4943 memset(&opts, 0, sizeof(opts));
4944
4945 opts.directory = directory;
4946 opts.verbose = verbose;
4947
4948 return !do_lxcapi_migrate(c, MIGRATE_RESTORE, &opts, sizeof(opts));
4949 }
4950
4951 WRAP_API_2(bool, lxcapi_restore, char *, bool)
4952
4953 /* @st_mode is the st_mode field of the stat(source) return struct */
4954 static int create_mount_target(const char *dest, mode_t st_mode)
4955 {
4956 char *dirdup, *destdirname;
4957 int ret;
4958
4959 dirdup = strdup(dest);
4960 if (!dirdup) {
4961 SYSERROR("Failed to duplicate target name \"%s\"", dest);
4962 return -1;
4963 }
4964 destdirname = dirname(dirdup);
4965
4966 ret = mkdir_p(destdirname, 0755);
4967 if (ret < 0) {
4968 SYSERROR("Failed to create \"%s\"", destdirname);
4969 free(dirdup);
4970 return ret;
4971 }
4972 free(dirdup);
4973
4974 (void)remove(dest);
4975
4976 if (S_ISDIR(st_mode))
4977 ret = mkdir(dest, 0000);
4978 else
4979 ret = mknod(dest, S_IFREG | 0000, 0);
4980
4981 if (ret == 0)
4982 TRACE("Created mount target \"%s\"", dest);
4983 else if (ret < 0 && errno != EEXIST) {
4984 SYSERROR("Failed to create mount target \"%s\"", dest);
4985 return -1;
4986 }
4987
4988 return 0;
4989 }
4990
4991 static int do_lxcapi_mount(struct lxc_container *c, const char *source,
4992 const char *target, const char *filesystemtype,
4993 unsigned long mountflags, const void *data,
4994 struct lxc_mount *mnt)
4995 {
4996 char *suff, *sret;
4997 char template[PATH_MAX], path[PATH_MAX];
4998 pid_t pid, init_pid;
4999 struct stat sb;
5000 bool is_dir;
5001 int ret = -1, fd = -EBADF;
5002
5003 if (!c || !c->lxc_conf) {
5004 ERROR("Container or configuration is NULL");
5005 return -EINVAL;
5006 }
5007
5008 if (!c->lxc_conf->shmount.path_host) {
5009 ERROR("Host path to shared mountpoint must be specified in the config\n");
5010 return -EINVAL;
5011 }
5012
5013 ret = snprintf(template, sizeof(template), "%s/.lxcmount_XXXXXX", c->lxc_conf->shmount.path_host);
5014 if (ret < 0 || (size_t)ret >= sizeof(template)) {
5015 SYSERROR("Error writing shmounts tempdir name");
5016 goto out;
5017 }
5018
5019 /* Create a temporary file / dir under the shared mountpoint */
5020 if (!source || strcmp(source, "") == 0) {
5021 /* If source is not specified, maybe we want to mount a filesystem? */
5022 sb.st_mode = S_IFDIR;
5023 } else {
5024 ret = stat(source, &sb);
5025 if (ret < 0) {
5026 SYSERROR("Error getting stat info about the source \"%s\"", source);
5027 goto out;
5028 }
5029 }
5030
5031 is_dir = (S_ISDIR(sb.st_mode) != 0);
5032 if (is_dir) {
5033 sret = mkdtemp(template);
5034 if (!sret) {
5035 SYSERROR("Could not create shmounts temporary dir");
5036 goto out;
5037 }
5038 } else {
5039 fd = lxc_make_tmpfile(template, false);
5040 if (fd < 0) {
5041 SYSERROR("Could not create shmounts temporary file");
5042 goto out;
5043 }
5044 }
5045
5046 /* Do the fork */
5047 pid = fork();
5048 if (pid < 0) {
5049 SYSERROR("Could not fork");
5050 goto out;
5051 }
5052
5053 if (pid == 0) {
5054 /* Do the mount */
5055 ret = mount(source, template, filesystemtype, mountflags, data);
5056 if (ret < 0) {
5057 SYSERROR("Failed to mount onto \"%s\"", template);
5058 _exit(EXIT_FAILURE);
5059 }
5060 TRACE("Mounted \"%s\" onto \"%s\"", source, template);
5061
5062 init_pid = do_lxcapi_init_pid(c);
5063 if (init_pid < 0) {
5064 ERROR("Failed to obtain container's init pid");
5065 _exit(EXIT_FAILURE);
5066 }
5067
5068 /* Enter the container namespaces */
5069 if (!lxc_list_empty(&c->lxc_conf->id_map)) {
5070 if (!switch_to_ns(init_pid, "user")) {
5071 ERROR("Failed to enter user namespace");
5072 _exit(EXIT_FAILURE);
5073 }
5074
5075 if (!lxc_switch_uid_gid(0, 0))
5076 _exit(EXIT_FAILURE);
5077 }
5078
5079 if (!switch_to_ns(init_pid, "mnt")) {
5080 ERROR("Failed to enter mount namespace");
5081 _exit(EXIT_FAILURE);
5082 }
5083
5084 ret = create_mount_target(target, sb.st_mode);
5085 if (ret < 0)
5086 _exit(EXIT_FAILURE);
5087
5088 suff = strrchr(template, '/');
5089 if (!suff)
5090 goto cleanup_target_in_child;
5091
5092 ret = snprintf(path, sizeof(path), "%s%s", c->lxc_conf->shmount.path_cont, suff);
5093 if (ret < 0 || (size_t)ret >= sizeof(path)) {
5094 SYSERROR("Error writing container mountpoint name");
5095 goto cleanup_target_in_child;
5096 }
5097
5098 ret = mount(path, target, NULL, MS_MOVE | MS_REC, NULL);
5099 if (ret < 0) {
5100 SYSERROR("Failed to move the mount from \"%s\" to \"%s\"", path, target);
5101 goto cleanup_target_in_child;
5102 }
5103 TRACE("Moved mount from \"%s\" to \"%s\"", path, target);
5104
5105 _exit(EXIT_SUCCESS);
5106
5107 cleanup_target_in_child:
5108 (void)remove(target);
5109 _exit(EXIT_FAILURE);
5110 }
5111
5112 ret = wait_for_pid(pid);
5113 if (ret < 0)
5114 SYSERROR("Wait for the child with pid %ld failed", (long)pid);
5115 else
5116 ret = 0;
5117
5118 if (umount2(template, MNT_DETACH))
5119 SYSWARN("Failed to remove temporary mount \"%s\"", template);
5120
5121 if (is_dir)
5122 (void)rmdir(template);
5123 else
5124 (void)unlink(template);
5125
5126 out:
5127 if (fd >= 0)
5128 close(fd);
5129
5130 return ret;
5131 }
5132
5133 WRAP_API_6(int, lxcapi_mount, const char *, const char *, const char *,
5134 unsigned long, const void *, struct lxc_mount *)
5135
5136 static int do_lxcapi_umount(struct lxc_container *c, const char *target,
5137 unsigned long flags, struct lxc_mount *mnt)
5138 {
5139 pid_t pid, init_pid;
5140 int ret = -1;
5141
5142 if (!c || !c->lxc_conf) {
5143 ERROR("Container or configuration is NULL");
5144 return -EINVAL;
5145 }
5146
5147 /* Do the fork */
5148 pid = fork();
5149 if (pid < 0) {
5150 SYSERROR("Could not fork");
5151 return -1;
5152 }
5153
5154 if (pid == 0) {
5155 init_pid = do_lxcapi_init_pid(c);
5156 if (init_pid < 0) {
5157 ERROR("Failed to obtain container's init pid");
5158 _exit(EXIT_FAILURE);
5159 }
5160
5161 /* Enter the container namespaces */
5162 if (!lxc_list_empty(&c->lxc_conf->id_map)) {
5163 if (!switch_to_ns(init_pid, "user")) {
5164 ERROR("Failed to enter user namespace");
5165 _exit(EXIT_FAILURE);
5166 }
5167 }
5168
5169 if (!switch_to_ns(init_pid, "mnt")) {
5170 ERROR("Failed to enter mount namespace");
5171 _exit(EXIT_FAILURE);
5172 }
5173
5174 /* Do the unmount */
5175 ret = umount2(target, flags);
5176 if (ret < 0) {
5177 SYSERROR("Failed to umount \"%s\"", target);
5178 _exit(EXIT_FAILURE);
5179 }
5180
5181 _exit(EXIT_SUCCESS);
5182 }
5183
5184 ret = wait_for_pid(pid);
5185 if (ret < 0) {
5186 SYSERROR("Wait for the child with pid %ld failed", (long)pid);
5187 return -ret;
5188 }
5189
5190 return 0;
5191 }
5192
5193 WRAP_API_3(int, lxcapi_umount, const char *, unsigned long, struct lxc_mount*)
5194
5195 static int lxcapi_attach_run_waitl(struct lxc_container *c, lxc_attach_options_t *options, const char *program, const char *arg, ...)
5196 {
5197 va_list ap;
5198 const char **argv;
5199 int ret;
5200
5201 if (!c)
5202 return -1;
5203
5204 current_config = c->lxc_conf;
5205
5206 va_start(ap, arg);
5207 argv = lxc_va_arg_list_to_argv_const(ap, 1);
5208 va_end(ap);
5209
5210 if (!argv) {
5211 ERROR("Memory allocation error.");
5212 ret = -1;
5213 goto out;
5214 }
5215 argv[0] = arg;
5216
5217 ret = do_lxcapi_attach_run_wait(c, options, program, (const char * const *)argv);
5218 free((void*)argv);
5219
5220 out:
5221 current_config = NULL;
5222 return ret;
5223 }
5224
5225 static int do_lxcapi_seccomp_notify_fd(struct lxc_container *c)
5226 {
5227 if (!c || !c->lxc_conf)
5228 return ret_set_errno(-1, -EINVAL);
5229
5230 return lxc_seccomp_get_notify_fd(&c->lxc_conf->seccomp);
5231 }
5232
5233 WRAP_API(int, lxcapi_seccomp_notify_fd)
5234
5235 static int do_lxcapi_seccomp_notify_fd_active(struct lxc_container *c)
5236 {
5237 if (!c || !c->lxc_conf)
5238 return ret_set_errno(-1, -EINVAL);
5239
5240 return lxc_cmd_get_seccomp_notify_fd(c->name, c->config_path);
5241 }
5242
5243 WRAP_API(int, lxcapi_seccomp_notify_fd_active)
5244
5245 struct lxc_container *lxc_container_new(const char *name, const char *configpath)
5246 {
5247 struct lxc_container *c;
5248 size_t len;
5249 int rc;
5250
5251 if (!name)
5252 return NULL;
5253
5254 c = malloc(sizeof(*c));
5255 if (!c) {
5256 fprintf(stderr, "Failed to allocate memory for %s\n", name);
5257 return NULL;
5258 }
5259 memset(c, 0, sizeof(*c));
5260
5261 if (configpath)
5262 c->config_path = strdup(configpath);
5263 else
5264 c->config_path = strdup(lxc_global_config_value("lxc.lxcpath"));
5265 if (!c->config_path) {
5266 fprintf(stderr, "Failed to allocate memory for %s\n", name);
5267 goto err;
5268 }
5269
5270 remove_trailing_slashes(c->config_path);
5271
5272 len = strlen(name);
5273 c->name = malloc(len + 1);
5274 if (!c->name) {
5275 fprintf(stderr, "Failed to allocate memory for %s\n", name);
5276 goto err;
5277 }
5278 (void)strlcpy(c->name, name, len + 1);
5279
5280 c->numthreads = 1;
5281 c->slock = lxc_newlock(c->config_path, name);
5282 if (!c->slock) {
5283 fprintf(stderr, "Failed to create lock for %s\n", name);
5284 goto err;
5285 }
5286
5287 c->privlock = lxc_newlock(NULL, NULL);
5288 if (!c->privlock) {
5289 fprintf(stderr, "Failed to create private lock for %s\n", name);
5290 goto err;
5291 }
5292
5293 if (!set_config_filename(c)) {
5294 fprintf(stderr, "Failed to create config file name for %s\n", name);
5295 goto err;
5296 }
5297
5298 if (file_exists(c->configfile) && !lxcapi_load_config(c, NULL)) {
5299 fprintf(stderr, "Failed to load config for %s\n", name);
5300 goto err;
5301 }
5302
5303 rc = ongoing_create(c);
5304 switch (rc) {
5305 case LXC_CREATE_INCOMPLETE:
5306 SYSERROR("Failed to complete container creation for %s", c->name);
5307 container_destroy(c, NULL);
5308 lxcapi_clear_config(c);
5309 break;
5310 case LXC_CREATE_ONGOING:
5311 /* container creation going on */
5312 break;
5313 case LXC_CREATE_FAILED:
5314 /* container creation failed */
5315 if (errno != EACCES && errno != EPERM) {
5316 /* insufficient privileges */
5317 SYSERROR("Failed checking for incomplete container %s creation", c->name);
5318 goto err;
5319 }
5320 break;
5321 }
5322
5323 c->daemonize = true;
5324 c->pidfile = NULL;
5325
5326 /* Assign the member functions. */
5327 c->is_defined = lxcapi_is_defined;
5328 c->state = lxcapi_state;
5329 c->is_running = lxcapi_is_running;
5330 c->freeze = lxcapi_freeze;
5331 c->unfreeze = lxcapi_unfreeze;
5332 c->console = lxcapi_console;
5333 c->console_getfd = lxcapi_console_getfd;
5334 c->devpts_fd = lxcapi_devpts_fd;
5335 c->init_pid = lxcapi_init_pid;
5336 c->init_pidfd = lxcapi_init_pidfd;
5337 c->load_config = lxcapi_load_config;
5338 c->want_daemonize = lxcapi_want_daemonize;
5339 c->want_close_all_fds = lxcapi_want_close_all_fds;
5340 c->start = lxcapi_start;
5341 c->startl = lxcapi_startl;
5342 c->stop = lxcapi_stop;
5343 c->config_file_name = lxcapi_config_file_name;
5344 c->wait = lxcapi_wait;
5345 c->set_config_item = lxcapi_set_config_item;
5346 c->destroy = lxcapi_destroy;
5347 c->destroy_with_snapshots = lxcapi_destroy_with_snapshots;
5348 c->rename = lxcapi_rename;
5349 c->save_config = lxcapi_save_config;
5350 c->get_keys = lxcapi_get_keys;
5351 c->create = lxcapi_create;
5352 c->createl = lxcapi_createl;
5353 c->shutdown = lxcapi_shutdown;
5354 c->reboot = lxcapi_reboot;
5355 c->reboot2 = lxcapi_reboot2;
5356 c->clear_config = lxcapi_clear_config;
5357 c->clear_config_item = lxcapi_clear_config_item;
5358 c->get_config_item = lxcapi_get_config_item;
5359 c->get_running_config_item = lxcapi_get_running_config_item;
5360 c->get_cgroup_item = lxcapi_get_cgroup_item;
5361 c->set_cgroup_item = lxcapi_set_cgroup_item;
5362 c->get_config_path = lxcapi_get_config_path;
5363 c->set_config_path = lxcapi_set_config_path;
5364 c->clone = lxcapi_clone;
5365 c->get_interfaces = lxcapi_get_interfaces;
5366 c->get_ips = lxcapi_get_ips;
5367 c->attach = lxcapi_attach;
5368 c->attach_run_wait = lxcapi_attach_run_wait;
5369 c->attach_run_waitl = lxcapi_attach_run_waitl;
5370 c->snapshot = lxcapi_snapshot;
5371 c->snapshot_list = lxcapi_snapshot_list;
5372 c->snapshot_restore = lxcapi_snapshot_restore;
5373 c->snapshot_destroy = lxcapi_snapshot_destroy;
5374 c->snapshot_destroy_all = lxcapi_snapshot_destroy_all;
5375 c->may_control = lxcapi_may_control;
5376 c->add_device_node = lxcapi_add_device_node;
5377 c->remove_device_node = lxcapi_remove_device_node;
5378 c->attach_interface = lxcapi_attach_interface;
5379 c->detach_interface = lxcapi_detach_interface;
5380 c->checkpoint = lxcapi_checkpoint;
5381 c->restore = lxcapi_restore;
5382 c->migrate = lxcapi_migrate;
5383 c->console_log = lxcapi_console_log;
5384 c->mount = lxcapi_mount;
5385 c->umount = lxcapi_umount;
5386 c->seccomp_notify_fd = lxcapi_seccomp_notify_fd;
5387 c->seccomp_notify_fd_active = lxcapi_seccomp_notify_fd_active;
5388
5389 return c;
5390
5391 err:
5392 lxc_container_free(c);
5393 return NULL;
5394 }
5395
5396 int lxc_get_wait_states(const char **states)
5397 {
5398 int i;
5399
5400 if (states)
5401 for (i=0; i<MAX_STATE; i++)
5402 states[i] = lxc_state2str(i);
5403
5404 return MAX_STATE;
5405 }
5406
5407 /*
5408 * These next two could probably be done smarter with reusing a common function
5409 * with different iterators and tests...
5410 */
5411 int list_defined_containers(const char *lxcpath, char ***names, struct lxc_container ***cret)
5412 {
5413 __do_closedir DIR *dir = NULL;
5414 int i, cfound = 0, nfound = 0;
5415 struct dirent *direntp;
5416 struct lxc_container *c;
5417
5418 if (!lxcpath)
5419 lxcpath = lxc_global_config_value("lxc.lxcpath");
5420
5421 dir = opendir(lxcpath);
5422 if (!dir) {
5423 SYSERROR("opendir on lxcpath");
5424 return -1;
5425 }
5426
5427 if (cret)
5428 *cret = NULL;
5429
5430 if (names)
5431 *names = NULL;
5432
5433 while ((direntp = readdir(dir))) {
5434 /* Ignore '.', '..' and any hidden directory. */
5435 if (!strncmp(direntp->d_name, ".", 1))
5436 continue;
5437
5438 if (!config_file_exists(lxcpath, direntp->d_name))
5439 continue;
5440
5441 if (names)
5442 if (!add_to_array(names, direntp->d_name, cfound))
5443 goto free_bad;
5444
5445 cfound++;
5446
5447 if (!cret) {
5448 nfound++;
5449 continue;
5450 }
5451
5452 c = lxc_container_new(direntp->d_name, lxcpath);
5453 if (!c) {
5454 INFO("Container %s:%s has a config but could not be loaded",
5455 lxcpath, direntp->d_name);
5456
5457 if (names)
5458 if(!remove_from_array(names, direntp->d_name, cfound--))
5459 goto free_bad;
5460
5461 continue;
5462 }
5463
5464 if (!do_lxcapi_is_defined(c)) {
5465 INFO("Container %s:%s has a config but is not defined",
5466 lxcpath, direntp->d_name);
5467
5468 if (names)
5469 if(!remove_from_array(names, direntp->d_name, cfound--))
5470 goto free_bad;
5471
5472 lxc_container_put(c);
5473 continue;
5474 }
5475
5476 if (!add_to_clist(cret, c, nfound, true)) {
5477 lxc_container_put(c);
5478 goto free_bad;
5479 }
5480
5481 nfound++;
5482 }
5483
5484 return nfound;
5485
5486 free_bad:
5487 if (names && *names) {
5488 for (i = 0; i < cfound; i++)
5489 free((*names)[i]);
5490 free(*names);
5491 }
5492
5493 if (cret && *cret) {
5494 for (i = 0; i < nfound; i++)
5495 lxc_container_put((*cret)[i]);
5496 free(*cret);
5497 }
5498
5499 return -1;
5500 }
5501
5502 int list_active_containers(const char *lxcpath, char ***nret,
5503 struct lxc_container ***cret)
5504 {
5505 __do_free char *line = NULL;
5506 __do_fclose FILE *f = NULL;
5507 int i, ret = -1, cret_cnt = 0, ct_name_cnt = 0;
5508 int lxcpath_len;
5509 char **ct_name = NULL;
5510 size_t len = 0;
5511 struct lxc_container *c = NULL;
5512 bool is_hashed;
5513
5514 if (!lxcpath)
5515 lxcpath = lxc_global_config_value("lxc.lxcpath");
5516 lxcpath_len = strlen(lxcpath);
5517
5518 if (cret)
5519 *cret = NULL;
5520
5521 if (nret)
5522 *nret = NULL;
5523
5524 f = fopen("/proc/net/unix", "re");
5525 if (!f)
5526 return -1;
5527
5528 while (getline(&line, &len, f) != -1) {
5529 char *p = strrchr(line, ' '), *p2;
5530 if (!p)
5531 continue;
5532 p++;
5533
5534 if (*p != 0x40)
5535 continue;
5536 p++;
5537
5538 is_hashed = false;
5539
5540 if (strncmp(p, lxcpath, lxcpath_len) == 0) {
5541 p += lxcpath_len;
5542 } else if (strncmp(p, "lxc/", 4) == 0) {
5543 p += 4;
5544 is_hashed = true;
5545 } else {
5546 continue;
5547 }
5548
5549 while (*p == '/')
5550 p++;
5551
5552 /* Now p is the start of lxc_name. */
5553 p2 = strchr(p, '/');
5554 if (!p2 || strncmp(p2, "/command", 8) != 0)
5555 continue;
5556 *p2 = '\0';
5557
5558 if (is_hashed) {
5559 char *recvpath = lxc_cmd_get_lxcpath(p);
5560 if (!recvpath)
5561 continue;
5562
5563 if (strncmp(lxcpath, recvpath, lxcpath_len) != 0) {
5564 free(recvpath);
5565 continue;
5566 }
5567 free(recvpath);
5568
5569 p = lxc_cmd_get_name(p);
5570 if (!p)
5571 continue;
5572 }
5573
5574 if (array_contains(&ct_name, p, ct_name_cnt)) {
5575 if (is_hashed)
5576 free(p);
5577 continue;
5578 }
5579
5580 if (!add_to_array(&ct_name, p, ct_name_cnt)) {
5581 if (is_hashed)
5582 free(p);
5583 goto free_cret_list;
5584 }
5585
5586 ct_name_cnt++;
5587
5588 if (!cret) {
5589 if (is_hashed)
5590 free(p);
5591 continue;
5592 }
5593
5594 c = lxc_container_new(p, lxcpath);
5595 if (!c) {
5596 INFO("Container %s:%s is running but could not be loaded",
5597 lxcpath, p);
5598
5599 remove_from_array(&ct_name, p, ct_name_cnt--);
5600 if (is_hashed)
5601 free(p);
5602
5603 continue;
5604 }
5605
5606 if (is_hashed)
5607 free(p);
5608
5609 /*
5610 * If this is an anonymous container, then is_defined *can*
5611 * return false. So we don't do that check. Count on the
5612 * fact that the command socket exists.
5613 */
5614
5615 if (!add_to_clist(cret, c, cret_cnt, true)) {
5616 lxc_container_put(c);
5617 goto free_cret_list;
5618 }
5619
5620 cret_cnt++;
5621 }
5622
5623 if (nret && cret && cret_cnt != ct_name_cnt) {
5624 if (c)
5625 lxc_container_put(c);
5626 goto free_cret_list;
5627 }
5628
5629 ret = ct_name_cnt;
5630 if (nret)
5631 *nret = ct_name;
5632 else
5633 goto free_ct_name;
5634
5635 goto out;
5636
5637 free_cret_list:
5638 if (cret && *cret) {
5639 for (i = 0; i < cret_cnt; i++)
5640 lxc_container_put((*cret)[i]);
5641 free(*cret);
5642 }
5643
5644 free_ct_name:
5645 if (ct_name) {
5646 for (i = 0; i < ct_name_cnt; i++)
5647 free(ct_name[i]);
5648 free(ct_name);
5649 }
5650
5651 out:
5652 return ret;
5653 }
5654
5655 int list_all_containers(const char *lxcpath, char ***nret,
5656 struct lxc_container ***cret)
5657 {
5658 int i, ret, active_cnt, ct_cnt, ct_list_cnt;
5659 char **active_name;
5660 char **ct_name;
5661 struct lxc_container **ct_list = NULL;
5662
5663 ct_cnt = list_defined_containers(lxcpath, &ct_name, NULL);
5664 if (ct_cnt < 0)
5665 return ct_cnt;
5666
5667 active_cnt = list_active_containers(lxcpath, &active_name, NULL);
5668 if (active_cnt < 0) {
5669 ret = active_cnt;
5670 goto free_ct_name;
5671 }
5672
5673 for (i = 0; i < active_cnt; i++) {
5674 if (!array_contains(&ct_name, active_name[i], ct_cnt)) {
5675 if (!add_to_array(&ct_name, active_name[i], ct_cnt)) {
5676 ret = -1;
5677 goto free_active_name;
5678 }
5679
5680 ct_cnt++;
5681 }
5682
5683 free(active_name[i]);
5684 active_name[i] = NULL;
5685 }
5686
5687 free(active_name);
5688 active_name = NULL;
5689 active_cnt = 0;
5690
5691 for (i = 0, ct_list_cnt = 0; i < ct_cnt && cret; i++) {
5692 struct lxc_container *c;
5693
5694 c = lxc_container_new(ct_name[i], lxcpath);
5695 if (!c) {
5696 WARN("Container %s:%s could not be loaded", lxcpath, ct_name[i]);
5697 remove_from_array(&ct_name, ct_name[i], ct_cnt--);
5698 continue;
5699 }
5700
5701 if (!add_to_clist(&ct_list, c, ct_list_cnt, false)) {
5702 lxc_container_put(c);
5703 ret = -1;
5704 goto free_ct_list;
5705 }
5706
5707 ct_list_cnt++;
5708 }
5709
5710 if (cret)
5711 *cret = ct_list;
5712
5713 if (nret) {
5714 *nret = ct_name;
5715 } else {
5716 ret = ct_cnt;
5717 goto free_ct_name;
5718 }
5719
5720 return ct_cnt;
5721
5722 free_ct_list:
5723 for (i = 0; i < ct_list_cnt; i++) {
5724 lxc_container_put(ct_list[i]);
5725 }
5726 free(ct_list);
5727
5728 free_active_name:
5729 for (i = 0; i < active_cnt; i++) {
5730 free(active_name[i]);
5731 }
5732 free(active_name);
5733
5734 free_ct_name:
5735 for (i = 0; i < ct_cnt; i++) {
5736 free(ct_name[i]);
5737 }
5738 free(ct_name);
5739 return ret;
5740 }
5741
5742 bool lxc_config_item_is_supported(const char *key)
5743 {
5744 return !!lxc_get_config_exact(key);
5745 }
5746
5747 bool lxc_has_api_extension(const char *extension)
5748 {
5749 /* The NULL API extension is always present. :) */
5750 if (!extension)
5751 return true;
5752
5753 for (size_t i = 0; i < nr_api_extensions; i++)
5754 if (strcmp(api_extensions[i], extension) == 0)
5755 return true;
5756
5757 return false;
5758 }
LXC mirror