]> git.proxmox.com Git - mirror_lxc.git/blob - src/lxc/lxccontainer.c
projects / mirror_lxc.git / blob
? search:
summary | shortlog | log | commit | commitdiff | tree
blame | history | raw | HEAD
tree-wide: fix lxc header inclusion
[mirror_lxc.git] / src / lxc / lxccontainer.c
1 /* SPDX-License-Identifier: LGPL-2.1+ */
2
3 #ifndef _GNU_SOURCE
4 #define _GNU_SOURCE 1
5 #endif
6 #include <arpa/inet.h>
7 #include <dirent.h>
8 #include <errno.h>
9 #include <fcntl.h>
10 #include <grp.h>
11 #include <libgen.h>
12 #include <pthread.h>
13 #include <sched.h>
14 #include <stdarg.h>
15 #include <stdint.h>
16 #include <stdio.h>
17 #include <stdlib.h>
18 #include <sys/file.h>
19 #include <sys/mman.h>
20 #include <sys/mount.h>
21 #include <sys/stat.h>
22 #include <sys/syscall.h>
23 #include <sys/sysmacros.h>
24 #include <sys/types.h>
25 #include <sys/wait.h>
26 #include <unistd.h>
27
28 #include "lxc.h"
29
30 #include "netns_ifaddrs.h"
31 #include "af_unix.h"
32 #include "api_extensions.h"
33 #include "attach.h"
34 #include "cgroup.h"
35 #include "macro.h"
36 #include "commands.h"
37 #include "commands_utils.h"
38 #include "conf.h"
39 #include "config.h"
40 #include "confile.h"
41 #include "confile_utils.h"
42 #include "criu.h"
43 #include "error.h"
44 #include "initutils.h"
45 #include "log.h"
46 #include "lxc.h"
47 #include "lxclock.h"
48 #include "memory_utils.h"
49 #include "monitor.h"
50 #include "namespace.h"
51 #include "network.h"
52 #include "parse.h"
53 #include "process_utils.h"
54 #include "start.h"
55 #include "state.h"
56 #include "storage.h"
57 #include "storage/btrfs.h"
58 #include "storage/overlay.h"
59 #include "storage_utils.h"
60 #include "sync.h"
61 #include "syscall_wrappers.h"
62 #include "terminal.h"
63 #include "utils.h"
64 #include "version.h"
65
66 #if HAVE_OPENSSL
67 #include <openssl/evp.h>
68 #endif
69
70 /* major()/minor() */
71 #ifdef MAJOR_IN_MKDEV
72 #include <sys/mkdev.h>
73 #endif
74
75 #if IS_BIONIC
76 #include <../include/lxcmntent.h>
77 #else
78 #include <mntent.h>
79 #endif
80
81 #ifndef HAVE_STRLCPY
82 #include "include/strlcpy.h"
83 #endif
84
85 lxc_log_define(lxccontainer, lxc);
86
87 static bool do_lxcapi_destroy(struct lxc_container *c);
88 static const char *lxcapi_get_config_path(struct lxc_container *c);
89 #define do_lxcapi_get_config_path(c) lxcapi_get_config_path(c)
90 static bool do_lxcapi_set_config_item(struct lxc_container *c, const char *key, const char *v);
91 static bool container_destroy(struct lxc_container *c,
92 struct lxc_storage *storage);
93 static bool get_snappath_dir(struct lxc_container *c, char *snappath);
94 static bool lxcapi_snapshot_destroy_all(struct lxc_container *c);
95 static bool do_lxcapi_save_config(struct lxc_container *c, const char *alt_file);
96
97 static bool config_file_exists(const char *lxcpath, const char *cname)
98 {
99 __do_free char *fname = NULL;
100 int ret;
101 size_t len;
102
103 /* $lxcpath + '/' + $cname + '/config' + \0 */
104 len = strlen(lxcpath) + 1 + strlen(cname) + 1 + strlen(LXC_CONFIG_FNAME) + 1;
105 fname = must_realloc(NULL, len);
106 ret = strnprintf(fname, len, "%s/%s/%s", lxcpath, cname, LXC_CONFIG_FNAME);
107 if (ret < 0)
108 return false;
109
110 return file_exists(fname);
111 }
112
113 /*
114 * A few functions to help detect when a container creation failed. If a
115 * container creation was killed partway through, then trying to actually start
116 * that container could harm the host. We detect this by creating a 'partial'
117 * file under the container directory, and keeping an advisory lock. When
118 * container creation completes, we remove that file. When we load or try to
119 * start a container, if we find that file, without a flock, we remove the
120 * container.
121 */
122 enum {
123 LXC_CREATE_FAILED = -1,
124 LXC_CREATE_SUCCESS = 0,
125 LXC_CREATE_ONGOING = 1,
126 LXC_CREATE_INCOMPLETE = 2,
127 };
128
129 static int ongoing_create(struct lxc_container *c)
130 {
131 __do_close int fd = -EBADF;
132 __do_free char *path = NULL;
133 struct flock lk = {0};
134 int ret;
135 size_t len;
136
137 len = strlen(c->config_path) + 1 + strlen(c->name) + 1 + strlen(LXC_PARTIAL_FNAME) + 1;
138 path = must_realloc(NULL, len);
139 ret = strnprintf(path, len, "%s/%s/%s", c->config_path, c->name, LXC_PARTIAL_FNAME);
140 if (ret < 0)
141 return LXC_CREATE_FAILED;
142
143 fd = open(path, O_RDWR | O_CLOEXEC);
144 if (fd < 0) {
145 if (errno != ENOENT)
146 return LXC_CREATE_FAILED;
147
148 return LXC_CREATE_SUCCESS;
149 }
150
151 lk.l_type = F_WRLCK;
152 lk.l_whence = SEEK_SET;
153 /*
154 * F_OFD_GETLK requires that l_pid be set to 0 otherwise the kernel
155 * will EINVAL us.
156 */
157 lk.l_pid = 0;
158
159 ret = fcntl(fd, F_OFD_GETLK, &lk);
160 if (ret < 0 && errno == EINVAL) {
161 ret = flock(fd, LOCK_EX | LOCK_NB);
162 if (ret < 0 && errno == EWOULDBLOCK)
163 ret = 0;
164 }
165
166 /* F_OFD_GETLK will not send us back a pid so don't check it. */
167 if (ret == 0)
168 /* Create is still ongoing. */
169 return LXC_CREATE_ONGOING;
170
171 /* Create completed but partial is still there. */
172 return LXC_CREATE_INCOMPLETE;
173 }
174
175 static int create_partial(struct lxc_container *c)
176 {
177 __do_free char *path = NULL;
178 int fd, ret;
179 size_t len;
180 struct flock lk = {0};
181
182 /* $lxcpath + '/' + $name + '/partial' + \0 */
183 len = strlen(c->config_path) + 1 + strlen(c->name) + 1 + strlen(LXC_PARTIAL_FNAME) + 1;
184 path = must_realloc(NULL, len);
185 ret = strnprintf(path, len, "%s/%s/%s", c->config_path, c->name, LXC_PARTIAL_FNAME);
186 if (ret < 0)
187 return -1;
188
189 fd = open(path, O_RDWR | O_CREAT | O_EXCL | O_CLOEXEC, 0000);
190 if (fd < 0)
191 return -1;
192
193 lk.l_type = F_WRLCK;
194 lk.l_whence = SEEK_SET;
195
196 ret = fcntl(fd, F_OFD_SETLKW, &lk);
197 if (ret < 0) {
198 if (errno == EINVAL) {
199 ret = flock(fd, LOCK_EX);
200 if (ret == 0)
201 return fd;
202 }
203
204 SYSERROR("Failed to lock partial file %s", path);
205 close(fd);
206 return -1;
207 }
208
209 return fd;
210 }
211
212 static void remove_partial(struct lxc_container *c, int fd)
213 {
214 __do_free char *path = NULL;
215 int ret;
216 size_t len;
217
218 close(fd);
219
220 /* $lxcpath + '/' + $name + '/partial' + \0 */
221 len = strlen(c->config_path) + 1 + strlen(c->name) + 1 + strlen(LXC_PARTIAL_FNAME) + 1;
222 path = must_realloc(NULL, len);
223 ret = strnprintf(path, len, "%s/%s/%s", c->config_path, c->name, LXC_PARTIAL_FNAME);
224 if (ret < 0)
225 return;
226
227 ret = unlink(path);
228 if (ret < 0)
229 SYSERROR("Failed to remove partial file %s", path);
230 }
231
232 /* LOCKING
233 * 1. container_mem_lock(c) protects the struct lxc_container from multiple threads.
234 * 2. container_disk_lock(c) protects the on-disk container data - in particular the
235 * container configuration file.
236 * The container_disk_lock also takes the container_mem_lock.
237 * 3. thread_mutex protects process data (ex: fd table) from multiple threads.
238 * NOTHING mutexes two independent programs with their own struct
239 * lxc_container for the same c->name, between API calls. For instance,
240 * c->config_read(); c->start(); Between those calls, data on disk
241 * could change (which shouldn't bother the caller unless for instance
242 * the rootfs get moved). c->config_read(); update; c->config_write();
243 * Two such updaters could race. The callers should therefore check their
244 * results. Trying to prevent that would necessarily expose us to deadlocks
245 * due to hung callers. So I prefer to keep the locks only within our own
246 * functions, not across functions.
247 *
248 * If you're going to clone while holding a lxccontainer, increment
249 * c->numthreads (under privlock) before forking. When deleting,
250 * decrement numthreads under privlock, then if it hits 0 you can delete.
251 * Do not ever use a lxccontainer whose numthreads you did not bump.
252 */
253 static void lxc_container_free(struct lxc_container *c)
254 {
255 if (!c)
256 return;
257
258 free(c->configfile);
259 c->configfile = NULL;
260
261 free(c->error_string);
262 c->error_string = NULL;
263
264 if (c->slock) {
265 lxc_putlock(c->slock);
266 c->slock = NULL;
267 }
268
269 if (c->privlock) {
270 lxc_putlock(c->privlock);
271 c->privlock = NULL;
272 }
273
274 free(c->name);
275 c->name = NULL;
276
277 if (c->lxc_conf) {
278 lxc_conf_free(c->lxc_conf);
279 c->lxc_conf = NULL;
280 }
281
282 free(c->config_path);
283 c->config_path = NULL;
284
285 free(c);
286 }
287
288 /* Consider the following case:
289 *
290 * |====================================================================|
291 * | freer | racing get()er |
292 * |====================================================================|
293 * | lxc_container_put() | lxc_container_get() |
294 * | \ lxclock(c->privlock) | c->numthreads < 1? (no) |
295 * | \ c->numthreads = 0 | \ lxclock(c->privlock) -> waits |
296 * | \ lxcunlock() | \ |
297 * | \ lxc_container_free() | \ lxclock() returns |
298 * | | \ c->numthreads < 1 -> return 0 |
299 * | \ \ (free stuff) | |
300 * | \ \ sem_destroy(privlock) | |
301 * |_______________________________|____________________________________|
302 *
303 * When the get()er checks numthreads the first time, one of the following
304 * is true:
305 * 1. freer has set numthreads = 0. get() returns 0
306 * 2. freer is between lxclock and setting numthreads to 0. get()er will
307 * sem_wait on privlock, get lxclock after freer() drops it, then see
308 * numthreads is 0 and exit without touching lxclock again..
309 * 3. freer has not yet locked privlock. If get()er runs first, then put()er
310 * will see --numthreads = 1 and not call lxc_container_free().
311 */
312
313 int lxc_container_get(struct lxc_container *c)
314 {
315 if (!c)
316 return 0;
317
318 /* If someone else has already started freeing the container, don't try
319 * to take the lock, which may be invalid.
320 */
321 if (c->numthreads < 1)
322 return 0;
323
324 if (container_mem_lock(c))
325 return 0;
326
327 /* Bail without trying to unlock, bc the privlock is now probably in
328 * freed memory.
329 */
330 if (c->numthreads < 1)
331 return 0;
332
333 c->numthreads++;
334 container_mem_unlock(c);
335
336 return 1;
337 }
338
339 int lxc_container_put(struct lxc_container *c)
340 {
341 if (!c)
342 return -1;
343
344 if (container_mem_lock(c))
345 return -1;
346
347 c->numthreads--;
348
349 if (c->numthreads < 1) {
350 container_mem_unlock(c);
351 lxc_container_free(c);
352 return 1;
353 }
354
355 container_mem_unlock(c);
356 return 0;
357 }
358
359 static bool do_lxcapi_is_defined(struct lxc_container *c)
360 {
361 int statret;
362 struct stat statbuf;
363 bool ret = false;
364
365 if (!c)
366 return false;
367
368 if (container_mem_lock(c))
369 return false;
370
371 if (!c->configfile)
372 goto on_error;
373
374 statret = stat(c->configfile, &statbuf);
375 if (statret != 0)
376 goto on_error;
377
378 ret = true;
379
380 on_error:
381 container_mem_unlock(c);
382 return ret;
383 }
384
385 #define WRAP_API(rettype, fnname) \
386 static rettype fnname(struct lxc_container *c) \
387 { \
388 rettype ret; \
389 bool reset_config = false; \
390 \
391 if (!current_config && c && c->lxc_conf) { \
392 current_config = c->lxc_conf; \
393 reset_config = true; \
394 } \
395 \
396 ret = do_##fnname(c); \
397 if (reset_config) \
398 current_config = NULL; \
399 \
400 return ret; \
401 }
402
403 #define WRAP_API_1(rettype, fnname, t1) \
404 static rettype fnname(struct lxc_container *c, t1 a1) \
405 { \
406 rettype ret; \
407 bool reset_config = false; \
408 \
409 if (!current_config && c && c->lxc_conf) { \
410 current_config = c->lxc_conf; \
411 reset_config = true; \
412 } \
413 \
414 ret = do_##fnname(c, a1); \
415 if (reset_config) \
416 current_config = NULL; \
417 \
418 return ret; \
419 }
420
421 #define WRAP_API_2(rettype, fnname, t1, t2) \
422 static rettype fnname(struct lxc_container *c, t1 a1, t2 a2) \
423 { \
424 rettype ret; \
425 bool reset_config = false; \
426 \
427 if (!current_config && c && c->lxc_conf) { \
428 current_config = c->lxc_conf; \
429 reset_config = true; \
430 } \
431 \
432 ret = do_##fnname(c, a1, a2); \
433 if (reset_config) \
434 current_config = NULL; \
435 \
436 return ret; \
437 }
438
439 #define WRAP_API_3(rettype, fnname, t1, t2, t3) \
440 static rettype fnname(struct lxc_container *c, t1 a1, t2 a2, t3 a3) \
441 { \
442 rettype ret; \
443 bool reset_config = false; \
444 \
445 if (!current_config && c && c->lxc_conf) { \
446 current_config = c->lxc_conf; \
447 reset_config = true; \
448 } \
449 \
450 ret = do_##fnname(c, a1, a2, a3); \
451 if (reset_config) \
452 current_config = NULL; \
453 \
454 return ret; \
455 }
456
457 #define WRAP_API_6(rettype, fnname, t1, t2, t3, t4, t5, t6) \
458 static rettype fnname(struct lxc_container *c, t1 a1, t2 a2, t3 a3, \
459 t4 a4, t5 a5, t6 a6) \
460 { \
461 rettype ret; \
462 bool reset_config = false; \
463 \
464 if (!current_config && c && c->lxc_conf) { \
465 current_config = c->lxc_conf; \
466 reset_config = true; \
467 } \
468 \
469 ret = do_##fnname(c, a1, a2, a3, a4, a5, a6); \
470 if (reset_config) \
471 current_config = NULL; \
472 \
473 return ret; \
474 }
475
476 WRAP_API(bool, lxcapi_is_defined)
477
478 static const char *do_lxcapi_state(struct lxc_container *c)
479 {
480 lxc_state_t s;
481
482 if (!c)
483 return NULL;
484
485 s = lxc_getstate(c->name, c->config_path);
486 return lxc_state2str(s);
487 }
488
489 WRAP_API(const char *, lxcapi_state)
490
491 static bool is_stopped(struct lxc_container *c)
492 {
493 lxc_state_t s;
494
495 s = lxc_getstate(c->name, c->config_path);
496 return (s == STOPPED);
497 }
498
499 static bool do_lxcapi_is_running(struct lxc_container *c)
500 {
501 if (!c)
502 return false;
503
504 return !is_stopped(c);
505 }
506
507 WRAP_API(bool, lxcapi_is_running)
508
509 static bool do_lxcapi_freeze(struct lxc_container *c)
510 {
511 int ret = 0;
512 lxc_state_t s;
513
514 if (!c || !c->lxc_conf)
515 return false;
516
517 s = lxc_getstate(c->name, c->config_path);
518 if (s != FROZEN) {
519 ret = cgroup_freeze(c->name, c->config_path, -1);
520 if (ret == -ENOCGROUP2)
521 ret = lxc_freeze(c->lxc_conf, c->name, c->config_path);
522 }
523
524 return ret == 0;
525 }
526
527 WRAP_API(bool, lxcapi_freeze)
528
529 static bool do_lxcapi_unfreeze(struct lxc_container *c)
530 {
531 int ret = 0;
532 lxc_state_t s;
533
534 if (!c || !c->lxc_conf)
535 return false;
536
537 s = lxc_getstate(c->name, c->config_path);
538 if (s == FROZEN) {
539 ret = cgroup_unfreeze(c->name, c->config_path, -1);
540 if (ret == -ENOCGROUP2)
541 ret = lxc_unfreeze(c->lxc_conf, c->name, c->config_path);
542 }
543
544
545 return ret == 0;
546 }
547
548 WRAP_API(bool, lxcapi_unfreeze)
549
550 static int do_lxcapi_console_getfd(struct lxc_container *c, int *ttynum, int *ptxfd)
551 {
552 if (!c)
553 return -1;
554
555 return lxc_terminal_getfd(c, ttynum, ptxfd);
556 }
557
558 WRAP_API_2(int, lxcapi_console_getfd, int *, int *)
559
560 static int lxcapi_console(struct lxc_container *c, int ttynum, int stdinfd,
561 int stdoutfd, int stderrfd, int escape)
562 {
563 int ret;
564
565 if (!c)
566 return -1;
567
568 current_config = c->lxc_conf;
569 ret = lxc_console(c, ttynum, stdinfd, stdoutfd, stderrfd, escape);
570 current_config = NULL;
571
572 return ret;
573 }
574
575 static int do_lxcapi_console_log(struct lxc_container *c, struct lxc_console_log *log)
576 {
577 int ret;
578
579 if (!c)
580 return -EINVAL;
581
582 ret = lxc_cmd_console_log(c->name, do_lxcapi_get_config_path(c), log);
583 if (ret < 0) {
584 if (ret == -ENODATA)
585 NOTICE("The console log is empty");
586 else if (ret == -EFAULT)
587 NOTICE("The container does not keep a console log");
588 else if (ret == -ENOENT)
589 NOTICE("The container does not keep a console log file");
590 else if (ret == -EIO)
591 NOTICE("Failed to write console log to log file");
592 else
593 ERROR("Failed to retrieve console log");
594 }
595
596 return ret;
597 }
598
599 WRAP_API_1(int, lxcapi_console_log, struct lxc_console_log *)
600
601 static pid_t do_lxcapi_init_pid(struct lxc_container *c)
602 {
603 if (!c)
604 return -1;
605
606 return lxc_cmd_get_init_pid(c->name, c->config_path);
607 }
608
609 WRAP_API(pid_t, lxcapi_init_pid)
610
611 static int do_lxcapi_init_pidfd(struct lxc_container *c)
612 {
613 if (!c)
614 return ret_errno(EBADF);
615
616 return lxc_cmd_get_init_pidfd(c->name, c->config_path);
617 }
618
619 WRAP_API(int, lxcapi_init_pidfd)
620
621 static int do_lxcapi_devpts_fd(struct lxc_container *c)
622 {
623 if (!c)
624 return ret_errno(EBADF);
625
626 return lxc_cmd_get_devpts_fd(c->name, c->config_path);
627 }
628
629 WRAP_API(int, lxcapi_devpts_fd)
630
631 static bool load_config_locked(struct lxc_container *c, const char *fname)
632 {
633 if (!c->lxc_conf)
634 c->lxc_conf = lxc_conf_init();
635
636 if (!c->lxc_conf)
637 return false;
638
639 if (lxc_config_read(fname, c->lxc_conf, false) != 0)
640 return false;
641
642 c->lxc_conf->name = c->name;
643 return true;
644 }
645
646 static bool do_lxcapi_load_config(struct lxc_container *c, const char *alt_file)
647 {
648 int lret;
649 const char *fname;
650 bool need_disklock = false, ret = false;
651
652 if (!c)
653 return false;
654
655 fname = c->configfile;
656
657 if (alt_file)
658 fname = alt_file;
659
660 if (!fname)
661 return false;
662
663 /* If we're reading something other than the container's config, we only
664 * need to lock the in-memory container. If loading the container's
665 * config file, take the disk lock.
666 */
667 if (strequal(fname, c->configfile))
668 need_disklock = true;
669
670 if (need_disklock)
671 lret = container_disk_lock(c);
672 else
673 lret = container_mem_lock(c);
674 if (lret)
675 return false;
676
677 ret = load_config_locked(c, fname);
678
679 if (need_disklock)
680 container_disk_unlock(c);
681 else
682 container_mem_unlock(c);
683
684 return ret;
685 }
686
687 WRAP_API_1(bool, lxcapi_load_config, const char *)
688
689 static bool do_lxcapi_want_daemonize(struct lxc_container *c, bool state)
690 {
691 if (!c || !c->lxc_conf)
692 return false;
693
694 if (container_mem_lock(c))
695 return false;
696
697 c->daemonize = state;
698
699 container_mem_unlock(c);
700
701 return true;
702 }
703
704 WRAP_API_1(bool, lxcapi_want_daemonize, bool)
705
706 static bool do_lxcapi_want_close_all_fds(struct lxc_container *c, bool state)
707 {
708 if (!c || !c->lxc_conf)
709 return false;
710
711 if (container_mem_lock(c))
712 return false;
713
714 c->lxc_conf->close_all_fds = state;
715
716 container_mem_unlock(c);
717
718 return true;
719 }
720
721 WRAP_API_1(bool, lxcapi_want_close_all_fds, bool)
722
723 static bool do_lxcapi_wait(struct lxc_container *c, const char *state,
724 int timeout)
725 {
726 int ret;
727
728 if (!c)
729 return false;
730
731 ret = lxc_wait(c->name, state, timeout, c->config_path);
732 return ret == 0;
733 }
734
735 WRAP_API_2(bool, lxcapi_wait, const char *, int)
736
737 static bool am_single_threaded(void)
738 {
739 __do_closedir DIR *dir = NULL;
740 struct dirent *direntp;
741 int count = 0;
742
743 dir = opendir("/proc/self/task");
744 if (!dir)
745 return false;
746
747 while ((direntp = readdir(dir))) {
748 if (strequal(direntp->d_name, "."))
749 continue;
750
751 if (strequal(direntp->d_name, ".."))
752 continue;
753
754 count++;
755 if (count > 1)
756 break;
757 }
758
759 return count == 1;
760 }
761
762 static void push_arg(char ***argp, char *arg, int *nargs)
763 {
764 char *copy;
765 char **argv;
766
767 copy = must_copy_string(arg);
768
769 do {
770 argv = realloc(*argp, (*nargs + 2) * sizeof(char *));
771 } while (!argv);
772
773 *argp = argv;
774 argv[*nargs] = copy;
775 (*nargs)++;
776 argv[*nargs] = NULL;
777 }
778
779 static char **split_init_cmd(const char *incmd)
780 {
781 __do_free char *copy = NULL;
782 char *p;
783 char **argv;
784 int nargs = 0;
785
786 if (!incmd)
787 return NULL;
788
789 copy = must_copy_string(incmd);
790
791 do {
792 argv = malloc(sizeof(char *));
793 } while (!argv);
794
795 argv[0] = NULL;
796 lxc_iterate_parts (p, copy, " ")
797 push_arg(&argv, p, &nargs);
798
799 if (nargs == 0) {
800 free(argv);
801 return NULL;
802 }
803
804 return argv;
805 }
806
807 static void free_init_cmd(char **argv)
808 {
809 int i = 0;
810
811 if (!argv)
812 return;
813
814 while (argv[i])
815 free(argv[i++]);
816
817 free(argv);
818 }
819
820 static int lxc_rcv_status(int state_socket)
821 {
822 int ret;
823 int state = -1;
824
825 again:
826 /* Receive container state. */
827 ret = lxc_abstract_unix_rcv_credential(state_socket, &state, sizeof(int));
828 if (ret <= 0) {
829 if (errno != EINTR)
830 return -1;
831
832 TRACE("Caught EINTR; retrying");
833 goto again;
834 }
835
836 return state;
837 }
838
839 static bool wait_on_daemonized_start(struct lxc_handler *handler, int pid)
840 {
841 int ret, state;
842
843 /* The first child is going to fork() again and then exits. So we reap
844 * the first child here.
845 */
846 ret = wait_for_pid(pid);
847 if (ret < 0)
848 DEBUG("Failed waiting on first child %d", pid);
849 else
850 DEBUG("First child %d exited", pid);
851
852 /* Close write end of the socket pair. */
853 close_prot_errno_disarm(handler->state_socket_pair[1]);
854
855 state = lxc_rcv_status(handler->state_socket_pair[0]);
856
857 /* Close read end of the socket pair. */
858 close_prot_errno_disarm(handler->state_socket_pair[0]);
859
860 if (state < 0) {
861 SYSERROR("Failed to receive the container state");
862 return false;
863 }
864
865 /* If we receive anything else then running we know that the container
866 * failed to start.
867 */
868 if (state != RUNNING) {
869 ERROR("Received container state \"%s\" instead of \"RUNNING\"",
870 lxc_state2str(state));
871 return false;
872 }
873
874 TRACE("Container is in \"RUNNING\" state");
875 return true;
876 }
877
878 static bool do_lxcapi_start(struct lxc_container *c, int useinit, char * const argv[])
879 {
880 int ret;
881 struct lxc_handler *handler;
882 struct lxc_conf *conf;
883 char *default_args[] = {
884 "/sbin/init",
885 NULL,
886 };
887 char **init_cmd = NULL;
888
889 /* container does exist */
890 if (!c)
891 return false;
892
893 /* If anything fails before we set error_num, we want an error in there.
894 */
895 c->error_num = 1;
896
897 /* Container has not been setup. */
898 if (!c->lxc_conf)
899 return false;
900
901 ret = ongoing_create(c);
902 switch (ret) {
903 case LXC_CREATE_FAILED:
904 ERROR("Failed checking for incomplete container creation");
905 return false;
906 case LXC_CREATE_ONGOING:
907 ERROR("Ongoing container creation detected");
908 return false;
909 case LXC_CREATE_INCOMPLETE:
910 ERROR("Failed to create container");
911 do_lxcapi_destroy(c);
912 return false;
913 }
914
915 if (container_mem_lock(c))
916 return false;
917
918 conf = c->lxc_conf;
919
920 /* initialize handler */
921 handler = lxc_init_handler(NULL, c->name, conf, c->config_path, c->daemonize);
922
923 container_mem_unlock(c);
924 if (!handler)
925 return false;
926
927 if (!argv) {
928 if (useinit && conf->execute_cmd)
929 argv = init_cmd = split_init_cmd(conf->execute_cmd);
930 else
931 argv = init_cmd = split_init_cmd(conf->init_cmd);
932 }
933
934 /* ... otherwise use default_args. */
935 if (!argv) {
936 if (useinit) {
937 ERROR("No valid init detected");
938 lxc_put_handler(handler);
939 return false;
940 }
941 argv = default_args;
942 }
943
944 /* I'm not sure what locks we want here.Any? Is liblxc's locking enough
945 * here to protect the on disk container? We don't want to exclude
946 * things like lxc_info while the container is running.
947 */
948 if (c->daemonize) {
949 bool started;
950 char title[2048];
951 pid_t pid_first, pid_second;
952
953 pid_first = fork();
954 if (pid_first < 0) {
955 free_init_cmd(init_cmd);
956 lxc_put_handler(handler);
957 return false;
958 }
959
960 /* first parent */
961 if (pid_first != 0) {
962 /* Set to NULL because we don't want father unlink
963 * the PID file, child will do the free and unlink.
964 */
965 c->pidfile = NULL;
966
967 /* Wait for container to tell us whether it started
968 * successfully.
969 */
970 started = wait_on_daemonized_start(handler, pid_first);
971
972 free_init_cmd(init_cmd);
973 lxc_put_handler(handler);
974 return started;
975 }
976
977 /* first child */
978
979 /* We don't really care if this doesn't print all the
980 * characters. All that it means is that the proctitle will be
981 * ugly. Similarly, we also don't care if setproctitle() fails.
982 */
983 ret = strnprintf(title, sizeof(title), "[lxc monitor] %s %s", c->config_path, c->name);
984 if (ret > 0) {
985 ret = setproctitle(title);
986 if (ret < 0)
987 INFO("Failed to set process title to %s", title);
988 else
989 INFO("Set process title to %s", title);
990 }
991
992 /* We fork() a second time to be reparented to init. Like
993 * POSIX's daemon() function we change to "/" and redirect
994 * std{in,out,err} to /dev/null.
995 */
996 pid_second = fork();
997 if (pid_second < 0) {
998 SYSERROR("Failed to fork first child process");
999 _exit(EXIT_FAILURE);
1000 }
1001
1002 /* second parent */
1003 if (pid_second != 0) {
1004 free_init_cmd(init_cmd);
1005 lxc_put_handler(handler);
1006 _exit(EXIT_SUCCESS);
1007 }
1008
1009 /* second child */
1010
1011 /* change to / directory */
1012 ret = chdir("/");
1013 if (ret < 0) {
1014 SYSERROR("Failed to change to \"/\" directory");
1015 _exit(EXIT_FAILURE);
1016 }
1017
1018 ret = inherit_fds(handler, true);
1019 if (ret < 0)
1020 _exit(EXIT_FAILURE);
1021
1022 /* redirect std{in,out,err} to /dev/null */
1023 ret = null_stdfds();
1024 if (ret < 0) {
1025 ERROR("Failed to redirect std{in,out,err} to /dev/null");
1026 _exit(EXIT_FAILURE);
1027 }
1028
1029 /* become session leader */
1030 ret = setsid();
1031 if (ret < 0)
1032 TRACE("Process %d is already process group leader", lxc_raw_getpid());
1033 } else if (!am_single_threaded()) {
1034 ERROR("Cannot start non-daemonized container when threaded");
1035 free_init_cmd(init_cmd);
1036 lxc_put_handler(handler);
1037 return false;
1038 }
1039
1040 /* We need to write PID file after daemonize, so we always write the
1041 * right PID.
1042 */
1043 if (c->pidfile) {
1044 int w;
1045 char pidstr[INTTYPE_TO_STRLEN(pid_t)];
1046
1047 w = strnprintf(pidstr, sizeof(pidstr), "%d", lxc_raw_getpid());
1048 if (w < 0) {
1049 free_init_cmd(init_cmd);
1050 lxc_put_handler(handler);
1051
1052 SYSERROR("Failed to write monitor pid to \"%s\"", c->pidfile);
1053
1054 if (c->daemonize)
1055 _exit(EXIT_FAILURE);
1056
1057 return false;
1058 }
1059
1060 ret = lxc_write_to_file(c->pidfile, pidstr, w, false, 0600);
1061 if (ret < 0) {
1062 free_init_cmd(init_cmd);
1063 lxc_put_handler(handler);
1064
1065 SYSERROR("Failed to write monitor pid to \"%s\"", c->pidfile);
1066
1067 if (c->daemonize)
1068 _exit(EXIT_FAILURE);
1069
1070 return false;
1071 }
1072 }
1073
1074 conf->reboot = REBOOT_NONE;
1075
1076 /* Unshare the mount namespace if requested */
1077 if (conf->monitor_unshare) {
1078 ret = unshare(CLONE_NEWNS);
1079 if (ret < 0) {
1080 SYSERROR("Failed to unshare mount namespace");
1081 lxc_put_handler(handler);
1082 ret = 1;
1083 goto on_error;
1084 }
1085
1086 ret = mount(NULL, "/", NULL, MS_SLAVE|MS_REC, NULL);
1087 if (ret < 0) {
1088 SYSERROR("Failed to recursively turn root mount tree into dependent mount. Continuing...");
1089 lxc_put_handler(handler);
1090 ret = 1;
1091 goto on_error;
1092 }
1093 }
1094
1095 reboot:
1096 if (conf->reboot == REBOOT_INIT) {
1097 /* initialize handler */
1098 handler = lxc_init_handler(handler, c->name, conf, c->config_path, c->daemonize);
1099 if (!handler) {
1100 ret = 1;
1101 goto on_error;
1102 }
1103 }
1104
1105 ret = inherit_fds(handler, c->daemonize);
1106 if (ret < 0) {
1107 lxc_put_handler(handler);
1108 ret = 1;
1109 goto on_error;
1110 }
1111
1112 if (useinit)
1113 ret = lxc_execute(c->name, argv, 1, handler, c->config_path,
1114 c->daemonize, &c->error_num);
1115 else
1116 ret = lxc_start(argv, handler, c->config_path, c->daemonize,
1117 &c->error_num);
1118
1119 if (conf->reboot == REBOOT_REQ) {
1120 INFO("Container requested reboot");
1121 conf->reboot = REBOOT_INIT;
1122 goto reboot;
1123 }
1124
1125 on_error:
1126 if (c->pidfile) {
1127 unlink(c->pidfile);
1128 free(c->pidfile);
1129 c->pidfile = NULL;
1130 }
1131 free_init_cmd(init_cmd);
1132
1133 if (c->daemonize && ret != 0)
1134 _exit(EXIT_FAILURE);
1135 else if (c->daemonize)
1136 _exit(EXIT_SUCCESS);
1137
1138 if (ret != 0)
1139 return false;
1140
1141 return true;
1142 }
1143
1144 static bool lxcapi_start(struct lxc_container *c, int useinit,
1145 char *const argv[])
1146 {
1147 bool ret;
1148
1149 current_config = c ? c->lxc_conf : NULL;
1150 ret = do_lxcapi_start(c, useinit, argv);
1151 current_config = NULL;
1152
1153 return ret;
1154 }
1155
1156 /* Note, there MUST be an ending NULL. */
1157 static bool lxcapi_startl(struct lxc_container *c, int useinit, ...)
1158 {
1159 va_list ap;
1160 char **inargs = NULL;
1161 bool bret = false;
1162
1163 /* container exists */
1164 if (!c)
1165 return false;
1166
1167 current_config = c->lxc_conf;
1168
1169 va_start(ap, useinit);
1170 inargs = lxc_va_arg_list_to_argv(ap, 0, 1);
1171 va_end(ap);
1172 if (!inargs)
1173 goto on_error;
1174
1175 /* pass NULL if no arguments were supplied */
1176 bret = do_lxcapi_start(c, useinit, *inargs ? inargs : NULL);
1177
1178 on_error:
1179 if (inargs) {
1180 char **arg;
1181
1182 for (arg = inargs; *arg; arg++)
1183 free(*arg);
1184 free(inargs);
1185 }
1186
1187 current_config = NULL;
1188
1189 return bret;
1190 }
1191
1192 static bool do_lxcapi_stop(struct lxc_container *c)
1193 {
1194 int ret;
1195
1196 if (!c)
1197 return false;
1198
1199 ret = lxc_cmd_stop(c->name, c->config_path);
1200
1201 return ret == 0;
1202 }
1203
1204 WRAP_API(bool, lxcapi_stop)
1205
1206 static int do_create_container_dir(const char *path, struct lxc_conf *conf)
1207 {
1208 int lasterr;
1209 int ret = -1;
1210
1211 mode_t mask = umask(0002);
1212 ret = mkdir(path, 0770);
1213 lasterr = errno;
1214 umask(mask);
1215 errno = lasterr;
1216 if (ret) {
1217 if (errno != EEXIST)
1218 return -1;
1219
1220 ret = 0;
1221 }
1222
1223 if (!list_empty(&conf->id_map)) {
1224 ret = chown_mapped_root(path, conf);
1225 if (ret < 0)
1226 ret = -1;
1227 }
1228
1229 return ret;
1230 }
1231
1232 /* Create the standard expected container dir. */
1233 static bool create_container_dir(struct lxc_container *c)
1234 {
1235 __do_free char *s = NULL;
1236 int ret;
1237 size_t len;
1238
1239 len = strlen(c->config_path) + strlen(c->name) + 2;
1240 s = malloc(len);
1241 if (!s)
1242 return false;
1243
1244 ret = strnprintf(s, len, "%s/%s", c->config_path, c->name);
1245 if (ret < 0)
1246 return false;
1247
1248 return do_create_container_dir(s, c->lxc_conf) == 0;
1249 }
1250
1251 /* do_storage_create: thin wrapper around storage_create(). Like
1252 * storage_create(), it returns a mounted bdev on success, NULL on error.
1253 */
1254 static struct lxc_storage *do_storage_create(struct lxc_container *c,
1255 const char *type,
1256 struct bdev_specs *specs)
1257 {
1258 __do_free char *dest = NULL;
1259 int ret;
1260 size_t len;
1261 struct lxc_storage *bdev;
1262
1263 /* rootfs.path or lxcpath/lxcname/rootfs */
1264 if (c->lxc_conf->rootfs.path &&
1265 (access(c->lxc_conf->rootfs.path, F_OK) == 0)) {
1266 const char *rpath = c->lxc_conf->rootfs.path;
1267 len = strlen(rpath) + 1;
1268 dest = must_realloc(NULL, len);
1269 ret = strnprintf(dest, len, "%s", rpath);
1270 } else {
1271 const char *lxcpath = do_lxcapi_get_config_path(c);
1272 len = strlen(c->name) + 1 + strlen(lxcpath) + 1 + strlen(LXC_ROOTFS_DNAME) + 1;
1273 dest = must_realloc(NULL, len);
1274 ret = strnprintf(dest, len, "%s/%s/%s", lxcpath, c->name, LXC_ROOTFS_DNAME);
1275 }
1276 if (ret < 0)
1277 return NULL;
1278
1279 bdev = storage_create(dest, type, c->name, specs, c->lxc_conf);
1280 if (!bdev) {
1281 ERROR("Failed to create \"%s\" storage", type);
1282 return NULL;
1283 }
1284
1285 if (!c->set_config_item(c, "lxc.rootfs.path", bdev->src)) {
1286 ERROR("Failed to set \"lxc.rootfs.path = %s\"", bdev->src);
1287 storage_put(bdev);
1288 return NULL;
1289 }
1290
1291 /* If we are not root, chown the rootfs dir to root in the target user
1292 * namespace.
1293 */
1294 if (am_guest_unpriv() || !list_empty(&c->lxc_conf->id_map)) {
1295 ret = chown_mapped_root(bdev->dest, c->lxc_conf);
1296 if (ret < 0) {
1297 ERROR("Error chowning \"%s\" to container root", bdev->dest);
1298 suggest_default_idmap();
1299 storage_put(bdev);
1300 return NULL;
1301 }
1302 }
1303
1304 return bdev;
1305 }
1306
1307 /* Strip path and return name of file for argv[0] passed to execvp */
1308 static char *lxctemplatefilename(char *tpath)
1309 {
1310 char *p;
1311
1312 p = tpath + strlen(tpath) - 1;
1313 while ( (p-1) >= tpath && *(p-1) != '/')
1314 p--;
1315
1316 return p;
1317 }
1318
1319 static bool create_run_template(struct lxc_container *c, char *tpath,
1320 bool need_null_stdfds, char *const argv[])
1321 {
1322 int ret;
1323 pid_t pid;
1324
1325 if (!tpath)
1326 return true;
1327
1328 pid = fork();
1329 if (pid < 0) {
1330 SYSERROR("Failed to fork task for container creation template");
1331 return false;
1332 }
1333
1334 if (pid == 0) { /* child */
1335 int i, len;
1336 char *namearg, *patharg, *rootfsarg;
1337 char **newargv;
1338 int nargs = 0;
1339 struct lxc_storage *bdev = NULL;
1340 struct lxc_conf *conf = c->lxc_conf;
1341 uid_t euid;
1342
1343 if (need_null_stdfds) {
1344 ret = null_stdfds();
1345 if (ret < 0)
1346 _exit(EXIT_FAILURE);
1347 }
1348
1349 ret = lxc_storage_prepare(conf);
1350 if (ret) {
1351 ERROR("Failed to initialize storage");
1352 _exit(EXIT_FAILURE);
1353 }
1354 bdev = conf->rootfs.storage;
1355
1356 euid = geteuid();
1357 if (euid == 0) {
1358 ret = unshare(CLONE_NEWNS);
1359 if (ret < 0) {
1360 ERROR("Failed to unshare CLONE_NEWNS");
1361 _exit(EXIT_FAILURE);
1362 }
1363
1364 if (detect_shared_rootfs() && mount(NULL, "/", NULL, MS_SLAVE | MS_REC, NULL))
1365 SYSERROR("Failed to recursively turn root mount tree into dependent mount. Continuing...");
1366 }
1367
1368 if (!strequal(bdev->type, "dir") && !strequal(bdev->type, "btrfs")) {
1369 if (euid != 0) {
1370 ERROR("Unprivileged users can only create "
1371 "btrfs and directory-backed containers");
1372 _exit(EXIT_FAILURE);
1373 }
1374
1375 if (strequal(bdev->type, "overlay") ||
1376 strequal(bdev->type, "overlayfs")) {
1377 /* If we create an overlay container we need to
1378 * rsync the contents into
1379 * <container-path>/<container-name>/rootfs.
1380 * However, the overlay mount function will
1381 * mount
1382 * <container-path>/<container-name>/delta0
1383 * over
1384 * <container-path>/<container-name>/rootfs
1385 * which means we would rsync the rootfs into
1386 * the delta directory. That doesn't make sense
1387 * since the delta directory only exists to
1388 * record the differences to
1389 * <container-path>/<container-name>/rootfs. So
1390 * let's simply bind-mount here and then rsync
1391 * directly into
1392 * <container-path>/<container-name>/rootfs.
1393 */
1394 char *src;
1395
1396 src = ovl_get_rootfs(bdev->src, &(size_t){0});
1397 if (!src) {
1398 ERROR("Failed to get rootfs");
1399 _exit(EXIT_FAILURE);
1400 }
1401
1402 ret = mount(src, bdev->dest, "bind", MS_BIND | MS_REC, NULL);
1403 if (ret < 0) {
1404 ERROR("Failed to mount rootfs");
1405 _exit(EXIT_FAILURE);
1406 }
1407 } else {
1408 ret = bdev->ops->mount(bdev);
1409 if (ret < 0) {
1410 ERROR("Failed to mount rootfs");
1411 _exit(EXIT_FAILURE);
1412 }
1413 }
1414 } else { /* TODO come up with a better way here! */
1415 const char *src;
1416 free(bdev->dest);
1417 src = lxc_storage_get_path(bdev->src, bdev->type);
1418 bdev->dest = strdup(src);
1419 }
1420
1421 /* Create our new array, pre-pend the template name and base
1422 * args.
1423 */
1424 if (argv)
1425 for (nargs = 0; argv[nargs]; nargs++)
1426 ;
1427
1428 /* template, path, rootfs and name args */
1429 nargs += 4;
1430
1431 newargv = malloc(nargs * sizeof(*newargv));
1432 if (!newargv)
1433 _exit(EXIT_FAILURE);
1434 newargv[0] = lxctemplatefilename(tpath);
1435
1436 /* --path */
1437 len = strlen(c->config_path) + strlen(c->name) + strlen("--path=") + 2;
1438 patharg = malloc(len);
1439 if (!patharg)
1440 _exit(EXIT_FAILURE);
1441
1442 ret = strnprintf(patharg, len, "--path=%s/%s", c->config_path, c->name);
1443 if (ret < 0)
1444 _exit(EXIT_FAILURE);
1445 newargv[1] = patharg;
1446
1447 /* --name */
1448 len = strlen("--name=") + strlen(c->name) + 1;
1449 namearg = malloc(len);
1450 if (!namearg)
1451 _exit(EXIT_FAILURE);
1452
1453 ret = strnprintf(namearg, len, "--name=%s", c->name);
1454 if (ret < 0)
1455 _exit(EXIT_FAILURE);
1456 newargv[2] = namearg;
1457
1458 /* --rootfs */
1459 len = strlen("--rootfs=") + 1 + strlen(bdev->dest);
1460 rootfsarg = malloc(len);
1461 if (!rootfsarg)
1462 _exit(EXIT_FAILURE);
1463
1464 ret = strnprintf(rootfsarg, len, "--rootfs=%s", bdev->dest);
1465 if (ret < 0)
1466 _exit(EXIT_FAILURE);
1467 newargv[3] = rootfsarg;
1468
1469 /* add passed-in args */
1470 if (argv)
1471 for (i = 4; i < nargs; i++)
1472 newargv[i] = argv[i - 4];
1473
1474 /* add trailing NULL */
1475 nargs++;
1476 newargv = realloc(newargv, nargs * sizeof(*newargv));
1477 if (!newargv)
1478 _exit(EXIT_FAILURE);
1479 newargv[nargs - 1] = NULL;
1480
1481 /* If we're running the template in a mapped userns, then we
1482 * prepend the template command with: lxc-usernsexec <-m map1>
1483 * ... <-m mapn> -- and we append "--mapped-uid x", where x is
1484 * the mapped uid for our geteuid()
1485 */
1486 if (!list_empty(&conf->id_map)) {
1487 int extraargs, hostuid_mapped, hostgid_mapped;
1488 char **n2;
1489 char txtuid[20], txtgid[20];
1490 struct id_map *map;
1491 int n2args = 1;
1492
1493 n2 = malloc(n2args * sizeof(*n2));
1494 if (!n2)
1495 _exit(EXIT_FAILURE);
1496
1497 newargv[0] = tpath;
1498 tpath = "lxc-usernsexec";
1499 n2[0] = "lxc-usernsexec";
1500
1501 list_for_each_entry(map, &conf->id_map, head) {
1502 n2args += 2;
1503 n2 = realloc(n2, n2args * sizeof(char *));
1504 if (!n2)
1505 _exit(EXIT_FAILURE);
1506
1507 n2[n2args - 2] = "-m";
1508 n2[n2args - 1] = malloc(200);
1509 if (!n2[n2args - 1])
1510 _exit(EXIT_FAILURE);
1511
1512 ret = strnprintf(n2[n2args - 1], 200, "%c:%lu:%lu:%lu",
1513 map->idtype == ID_TYPE_UID ? 'u' : 'g',
1514 map->nsid, map->hostid, map->range);
1515 if (ret < 0)
1516 _exit(EXIT_FAILURE);
1517 }
1518
1519 hostuid_mapped = mapped_hostid(geteuid(), conf, ID_TYPE_UID);
1520 extraargs = hostuid_mapped >= 0 ? 1 : 3;
1521
1522 n2 = realloc(n2, (nargs + n2args + extraargs) * sizeof(char *));
1523 if (!n2)
1524 _exit(EXIT_FAILURE);
1525
1526 if (hostuid_mapped < 0) {
1527 hostuid_mapped = find_unmapped_nsid(conf, ID_TYPE_UID);
1528 n2[n2args++] = "-m";
1529 if (hostuid_mapped < 0) {
1530 ERROR("Failed to find free uid to map");
1531 _exit(EXIT_FAILURE);
1532 }
1533
1534 n2[n2args++] = malloc(200);
1535 if (!n2[n2args - 1]) {
1536 SYSERROR("out of memory");
1537 _exit(EXIT_FAILURE);
1538 }
1539
1540 ret = strnprintf(n2[n2args - 1], 200, "u:%d:%d:1",
1541 hostuid_mapped, geteuid());
1542 if (ret < 0)
1543 _exit(EXIT_FAILURE);
1544 }
1545
1546 hostgid_mapped = mapped_hostid(getegid(), conf, ID_TYPE_GID);
1547 extraargs = hostgid_mapped >= 0 ? 1 : 3;
1548
1549 n2 = realloc(n2, (nargs + n2args + extraargs) * sizeof(char *));
1550 if (!n2)
1551 _exit(EXIT_FAILURE);
1552
1553 if (hostgid_mapped < 0) {
1554 hostgid_mapped = find_unmapped_nsid(conf, ID_TYPE_GID);
1555 n2[n2args++] = "-m";
1556 if (hostgid_mapped < 0) {
1557 ERROR("Failed to find free gid to map");
1558 _exit(EXIT_FAILURE);
1559 }
1560
1561 n2[n2args++] = malloc(200);
1562 if (!n2[n2args - 1]) {
1563 SYSERROR("out of memory");
1564 _exit(EXIT_FAILURE);
1565 }
1566
1567 ret = strnprintf(n2[n2args - 1], 200, "g:%d:%d:1",
1568 hostgid_mapped, getegid());
1569 if (ret < 0)
1570 _exit(EXIT_FAILURE);
1571 }
1572
1573 n2[n2args++] = "--";
1574
1575 for (i = 0; i < nargs; i++)
1576 n2[i + n2args] = newargv[i];
1577 n2args += nargs;
1578
1579 /* Finally add "--mapped-uid $uid" to tell template what
1580 * to chown cached images to.
1581 */
1582 n2args += 4;
1583 n2 = realloc(n2, n2args * sizeof(char *));
1584 if (!n2)
1585 _exit(EXIT_FAILURE);
1586
1587 /* note n2[n2args-1] is NULL */
1588 n2[n2args - 5] = "--mapped-uid";
1589
1590 ret = strnprintf(txtuid, 20, "%d", hostuid_mapped);
1591 if (ret < 0) {
1592 free(newargv);
1593 free(n2);
1594 _exit(EXIT_FAILURE);
1595 }
1596
1597 n2[n2args - 4] = txtuid;
1598 n2[n2args - 3] = "--mapped-gid";
1599
1600 ret = strnprintf(txtgid, 20, "%d", hostgid_mapped);
1601 if (ret < 0) {
1602 free(newargv);
1603 free(n2);
1604 _exit(EXIT_FAILURE);
1605 }
1606
1607 n2[n2args - 2] = txtgid;
1608 n2[n2args - 1] = NULL;
1609 free(newargv);
1610 newargv = n2;
1611 }
1612
1613 execvp(tpath, newargv);
1614 SYSERROR("Failed to execute template %s", tpath);
1615 _exit(EXIT_FAILURE);
1616 }
1617
1618 ret = wait_for_pid(pid);
1619 if (ret != 0) {
1620 ERROR("Failed to create container from template");
1621 return false;
1622 }
1623
1624 return true;
1625 }
1626
1627 static bool prepend_lxc_header(char *path, const char *t, char *const argv[])
1628 {
1629 ssize_t len, flen;
1630 char *contents;
1631 FILE *f;
1632 int ret = -1;
1633 ssize_t nbytes;
1634 #if HAVE_OPENSSL
1635 unsigned int md_len = 0;
1636 unsigned char md_value[EVP_MAX_MD_SIZE];
1637 char *tpath;
1638 #endif
1639
1640 f = fopen(path, "re");
1641 if (f == NULL)
1642 return false;
1643
1644 ret = fseek(f, 0, SEEK_END);
1645 if (ret < 0)
1646 goto out_error;
1647
1648 ret = -1;
1649 flen = ftell(f);
1650 if (flen < 0)
1651 goto out_error;
1652
1653 ret = fseek(f, 0, SEEK_SET);
1654 if (ret < 0)
1655 goto out_error;
1656
1657 ret = fseek(f, 0, SEEK_SET);
1658 if (ret < 0)
1659 goto out_error;
1660
1661 ret = -1;
1662 contents = malloc(flen + 1);
1663 if (!contents)
1664 goto out_error;
1665
1666 len = fread(contents, 1, flen, f);
1667 if (len != flen)
1668 goto out_free_contents;
1669
1670 contents[flen] = '\0';
1671
1672 ret = fclose(f);
1673 f = NULL;
1674 if (ret < 0)
1675 goto out_free_contents;
1676
1677 #if HAVE_OPENSSL
1678 tpath = get_template_path(t);
1679 if (!tpath) {
1680 ERROR("Invalid template \"%s\" specified", t);
1681 goto out_free_contents;
1682 }
1683
1684 ret = sha1sum_file(tpath, md_value, &md_len);
1685 if (ret < 0) {
1686 ERROR("Failed to get sha1sum of %s", tpath);
1687 free(tpath);
1688 goto out_free_contents;
1689 }
1690 free(tpath);
1691 #endif
1692
1693 f = fopen(path, "we");
1694 if (f == NULL) {
1695 SYSERROR("Reopening config for writing");
1696 free(contents);
1697 return false;
1698 }
1699
1700 fprintf(f, "# Template used to create this container: %s\n", t);
1701 if (argv) {
1702 fprintf(f, "# Parameters passed to the template:");
1703 while (*argv) {
1704 fprintf(f, " %s", *argv);
1705 argv++;
1706 }
1707 fprintf(f, "\n");
1708 }
1709
1710 #if HAVE_OPENSSL
1711 fprintf(f, "# Template script checksum (SHA-1): ");
1712 for (size_t i = 0; i < md_len; i++)
1713 fprintf(f, "%02x", md_value[i]);
1714 fprintf(f, "\n");
1715 #endif
1716 fprintf(f, "# For additional config options, please look at lxc.container.conf(5)\n");
1717 fprintf(f, "\n# Uncomment the following line to support nesting containers:\n");
1718 fprintf(f, "#lxc.include = " LXCTEMPLATECONFIG "/nesting.conf\n");
1719 fprintf(f, "# (Be aware this has security implications)\n\n");
1720 nbytes = fwrite(contents, 1, flen, f);
1721 if (nbytes < 0 || nbytes != flen) {
1722 SYSERROR("Writing original contents");
1723 free(contents);
1724 fclose(f);
1725 return false;
1726 }
1727
1728 ret = 0;
1729
1730 out_free_contents:
1731 free(contents);
1732
1733 out_error:
1734 if (f) {
1735 int newret;
1736 newret = fclose(f);
1737 if (ret == 0)
1738 ret = newret;
1739 }
1740
1741 if (ret < 0) {
1742 SYSERROR("Error prepending header");
1743 return false;
1744 }
1745
1746 return true;
1747 }
1748
1749 static void lxcapi_clear_config(struct lxc_container *c)
1750 {
1751 if (!c || !c->lxc_conf)
1752 return;
1753
1754 lxc_conf_free(c->lxc_conf);
1755 c->lxc_conf = NULL;
1756 }
1757
1758 #define do_lxcapi_clear_config(c) lxcapi_clear_config(c)
1759
1760 /*
1761 * lxcapi_create:
1762 * create a container with the given parameters.
1763 * @c: container to be created. It has the lxcpath, name, and a starting
1764 * configuration already set
1765 * @t: the template to execute to instantiate the root filesystem and
1766 * adjust the configuration.
1767 * @bdevtype: backing store type to use. If NULL, dir will be used.
1768 * @specs: additional parameters for the backing store, i.e. LVM vg to
1769 * use.
1770 *
1771 * @argv: the arguments to pass to the template, terminated by NULL. If no
1772 * arguments, you can just pass NULL.
1773 */
1774 static bool do_lxcapi_create(struct lxc_container *c, const char *t,
1775 const char *bdevtype, struct bdev_specs *specs,
1776 int flags, char *const argv[])
1777 {
1778 __do_free char *path_template = NULL;
1779 int partial_fd;
1780 mode_t mask;
1781 pid_t pid;
1782 bool ret = false, rootfs_managed = true;
1783
1784 if (!c)
1785 return false;
1786
1787 if (t) {
1788 path_template = get_template_path(t);
1789 if (!path_template)
1790 return syserror_set(ENOENT, "Template \"%s\" not found", t);
1791 }
1792
1793 /* If a template is passed in, and the rootfs already is defined in the
1794 * container config and exists, then the caller is trying to create an
1795 * existing container. Return an error, but do NOT delete the container.
1796 */
1797 if (do_lxcapi_is_defined(c) && c->lxc_conf && c->lxc_conf->rootfs.path &&
1798 access(c->lxc_conf->rootfs.path, F_OK) == 0 && path_template)
1799 return syserror_set(EEXIST, "Container \"%s\" already exists in \"%s\"", c->name, c->config_path);
1800
1801 if (!c->lxc_conf &&
1802 !do_lxcapi_load_config(c, lxc_global_config_value("lxc.default_config")))
1803 return syserror_set(EINVAL, "Failed to load default configuration file %s",
1804 lxc_global_config_value("lxc.default_config"));
1805
1806 if (!create_container_dir(c))
1807 return syserror_set(EINVAL, "Failed to create container %s", c->name);
1808
1809 if (c->lxc_conf->rootfs.path)
1810 rootfs_managed = false;
1811
1812 /* If both template and rootfs.path are set, template is setup as
1813 * rootfs.path. The container is already created if we have a config and
1814 * rootfs.path is accessible
1815 */
1816 if (!c->lxc_conf->rootfs.path && !path_template) {
1817 /* No template passed in and rootfs does not exist. */
1818 if (!c->save_config(c, NULL)) {
1819 ERROR("Failed to save initial config for \"%s\"", c->name);
1820 goto out;
1821 }
1822 ret = true;
1823 goto out;
1824 }
1825
1826 /* Rootfs passed into configuration, but does not exist. */
1827 if (c->lxc_conf->rootfs.path && access(c->lxc_conf->rootfs.path, F_OK) != 0)
1828 goto out;
1829
1830 if (do_lxcapi_is_defined(c) && c->lxc_conf->rootfs.path && !path_template) {
1831 /* Rootfs already existed, user just wanted to save the loaded
1832 * configuration.
1833 */
1834 if (!c->save_config(c, NULL))
1835 ERROR("Failed to save initial config for \"%s\"", c->name);
1836
1837 ret = true;
1838 goto out;
1839 }
1840
1841 /* Mark that this container is being created */
1842 partial_fd = create_partial(c);
1843 if (partial_fd < 0)
1844 goto out;
1845
1846 /* No need to get disk lock bc we have the partial lock. */
1847
1848 mask = umask(0022);
1849
1850 /* Create the storage.
1851 * Note we can't do this in the same task as we use to execute the
1852 * template because of the way zfs works.
1853 * After you 'zfs create', zfs mounts the fs only in the initial
1854 * namespace.
1855 */
1856 pid = fork();
1857 if (pid < 0) {
1858 SYSERROR("Failed to fork task for container creation template");
1859 goto out_unlock;
1860 }
1861
1862 if (pid == 0) { /* child */
1863 struct lxc_storage *bdev = NULL;
1864
1865 bdev = do_storage_create(c, bdevtype, specs);
1866 if (!bdev) {
1867 ERROR("Failed to create %s storage for %s",
1868 bdevtype ? bdevtype : "(none)", c->name);
1869 _exit(EXIT_FAILURE);
1870 }
1871
1872 /* Save config file again to store the new rootfs location. */
1873 if (!do_lxcapi_save_config(c, NULL)) {
1874 ERROR("Failed to save initial config for %s", c->name);
1875 /* Parent task won't see the storage driver in the
1876 * config so we delete it.
1877 */
1878 bdev->ops->umount(bdev);
1879 bdev->ops->destroy(bdev);
1880 _exit(EXIT_FAILURE);
1881 }
1882
1883 _exit(EXIT_SUCCESS);
1884 }
1885
1886 if (wait_for_pid(pid) != 0)
1887 goto out_unlock;
1888
1889 /* Reload config to get the rootfs. */
1890 lxc_conf_free(c->lxc_conf);
1891 c->lxc_conf = NULL;
1892
1893 if (!load_config_locked(c, c->configfile))
1894 goto out_unlock;
1895
1896 if (!create_run_template(c, path_template, !!(flags & LXC_CREATE_QUIET), argv))
1897 goto out_unlock;
1898
1899 /* Now clear out the lxc_conf we have, reload from the created
1900 * container.
1901 */
1902 do_lxcapi_clear_config(c);
1903
1904 if (t) {
1905 if (!prepend_lxc_header(c->configfile, path_template, argv)) {
1906 ERROR("Failed to prepend header to config file");
1907 goto out_unlock;
1908 }
1909 }
1910
1911 ret = load_config_locked(c, c->configfile);
1912
1913 out_unlock:
1914 umask(mask);
1915 remove_partial(c, partial_fd);
1916
1917 out:
1918 if (!ret) {
1919 bool reset_managed = c->lxc_conf->rootfs.managed;
1920
1921 /*
1922 * Ensure that we don't destroy storage we didn't create
1923 * ourselves.
1924 */
1925 if (!rootfs_managed)
1926 c->lxc_conf->rootfs.managed = false;
1927 container_destroy(c, NULL);
1928 c->lxc_conf->rootfs.managed = reset_managed;
1929 }
1930
1931 return ret;
1932 }
1933
1934 static bool lxcapi_create(struct lxc_container *c, const char *t,
1935 const char *bdevtype, struct bdev_specs *specs,
1936 int flags, char *const argv[])
1937 {
1938 bool ret;
1939
1940 current_config = c ? c->lxc_conf : NULL;
1941
1942 ret = do_lxcapi_create(c, t, bdevtype, specs, flags, argv);
1943 current_config = NULL;
1944 return ret;
1945 }
1946
1947 static bool do_lxcapi_reboot(struct lxc_container *c)
1948 {
1949 __do_close int pidfd = -EBADF;
1950 pid_t pid = -1;
1951 int ret;
1952 int rebootsignal = SIGINT;
1953
1954 if (!c)
1955 return false;
1956
1957 if (!do_lxcapi_is_running(c))
1958 return false;
1959
1960 pidfd = do_lxcapi_init_pidfd(c);
1961 if (pidfd < 0) {
1962 pid = do_lxcapi_init_pid(c);
1963 if (pid <= 0)
1964 return false;
1965 }
1966
1967 if (c->lxc_conf && c->lxc_conf->rebootsignal)
1968 rebootsignal = c->lxc_conf->rebootsignal;
1969
1970 if (pidfd >= 0)
1971 ret = lxc_raw_pidfd_send_signal(pidfd, rebootsignal, NULL, 0);
1972 else
1973 ret = kill(pid, rebootsignal);
1974 if (ret < 0)
1975 return log_warn(false, "Failed to send signal %d to pid %d",
1976 rebootsignal, pid);
1977
1978 return true;
1979 }
1980
1981 WRAP_API(bool, lxcapi_reboot)
1982
1983 static bool do_lxcapi_reboot2(struct lxc_container *c, int timeout)
1984 {
1985 __do_close int pidfd = -EBADF, state_client_fd = -EBADF;
1986 int rebootsignal = SIGINT;
1987 pid_t pid = -1;
1988 lxc_state_t states[MAX_STATE] = {0};
1989 int killret, ret;
1990
1991 if (!c)
1992 return false;
1993
1994 if (!do_lxcapi_is_running(c))
1995 return true;
1996
1997 pidfd = do_lxcapi_init_pidfd(c);
1998 if (pidfd < 0) {
1999 pid = do_lxcapi_init_pid(c);
2000 if (pid <= 0)
2001 return true;
2002 }
2003
2004 if (c->lxc_conf && c->lxc_conf->rebootsignal)
2005 rebootsignal = c->lxc_conf->rebootsignal;
2006
2007 /* Add a new state client before sending the shutdown signal so that we
2008 * don't miss a state.
2009 */
2010 if (timeout != 0) {
2011 states[RUNNING] = 2;
2012 ret = lxc_cmd_add_state_client(c->name, c->config_path, states,
2013 &state_client_fd);
2014 if (ret < 0)
2015 return false;
2016
2017 if (state_client_fd < 0)
2018 return false;
2019
2020 if (ret == RUNNING)
2021 return true;
2022
2023 if (ret < MAX_STATE)
2024 return false;
2025 }
2026
2027 /* Send reboot signal to container. */
2028 if (pidfd >= 0)
2029 killret = lxc_raw_pidfd_send_signal(pidfd, rebootsignal, NULL, 0);
2030 else
2031 killret = kill(pid, rebootsignal);
2032 if (killret < 0)
2033 return log_warn(false, "Failed to send signal %d to pidfd(%d)/pid(%d)", rebootsignal, pidfd, pid);
2034 TRACE("Sent signal %d to pidfd(%d)/pid(%d)", rebootsignal, pidfd, pid);
2035
2036 if (timeout == 0)
2037 return true;
2038
2039 ret = lxc_cmd_sock_rcv_state(state_client_fd, timeout);
2040 if (ret < 0)
2041 return false;
2042
2043 TRACE("Received state \"%s\"", lxc_state2str(ret));
2044 if (ret != RUNNING)
2045 return false;
2046
2047 return true;
2048 }
2049
2050 WRAP_API_1(bool, lxcapi_reboot2, int)
2051
2052 static bool do_lxcapi_shutdown(struct lxc_container *c, int timeout)
2053 {
2054 __do_close int pidfd = -EBADF, state_client_fd = -EBADF;
2055 int haltsignal = SIGPWR;
2056 pid_t pid = -1;
2057 lxc_state_t states[MAX_STATE] = {0};
2058 int killret, ret;
2059
2060 if (!c)
2061 return false;
2062
2063 if (!do_lxcapi_is_running(c))
2064 return true;
2065
2066 pidfd = do_lxcapi_init_pidfd(c);
2067 pid = do_lxcapi_init_pid(c);
2068 if (pid <= 0)
2069 return true;
2070
2071 /* Detect whether we should send SIGRTMIN + 3 (e.g. systemd). */
2072 if (c->lxc_conf && c->lxc_conf->haltsignal)
2073 haltsignal = c->lxc_conf->haltsignal;
2074 else if (task_blocks_signal(pid, (SIGRTMIN + 3)))
2075 haltsignal = (SIGRTMIN + 3);
2076
2077
2078 /*
2079 * Add a new state client before sending the shutdown signal so
2080 * that we don't miss a state.
2081 */
2082 if (timeout != 0) {
2083 states[STOPPED] = 1;
2084 ret = lxc_cmd_add_state_client(c->name, c->config_path, states,
2085 &state_client_fd);
2086 if (ret < 0)
2087 return false;
2088
2089 if (state_client_fd < 0)
2090 return false;
2091
2092 if (ret == STOPPED)
2093 return true;
2094
2095 if (ret < MAX_STATE)
2096 return false;
2097 }
2098
2099 if (pidfd >= 0) {
2100 struct pollfd pidfd_poll = {
2101 .events = POLLIN,
2102 .fd = pidfd,
2103 };
2104
2105 killret = lxc_raw_pidfd_send_signal(pidfd, haltsignal,
2106 NULL, 0);
2107 if (killret < 0)
2108 return log_warn(false, "Failed to send signal %d to pidfd %d",
2109 haltsignal, pidfd);
2110
2111 TRACE("Sent signal %d to pidfd %d", haltsignal, pidfd);
2112
2113 /*
2114 * No need for going through all of the state server
2115 * complications anymore. We can just poll on pidfds. :)
2116 */
2117
2118 if (timeout != 0) {
2119 ret = poll(&pidfd_poll, 1, timeout * 1000);
2120 if (ret < 0 || !(pidfd_poll.revents & POLLIN))
2121 return false;
2122
2123 TRACE("Pidfd polling detected container exit");
2124 }
2125 } else {
2126 killret = kill(pid, haltsignal);
2127 if (killret < 0)
2128 return log_warn(false, "Failed to send signal %d to pid %d",
2129 haltsignal, pid);
2130
2131 TRACE("Sent signal %d to pid %d", haltsignal, pid);
2132 }
2133
2134 if (timeout == 0)
2135 return true;
2136
2137 ret = lxc_cmd_sock_rcv_state(state_client_fd, timeout);
2138 if (ret < 0)
2139 return false;
2140
2141 TRACE("Received state \"%s\"", lxc_state2str(ret));
2142 if (ret != STOPPED)
2143 return false;
2144
2145 return true;
2146 }
2147
2148 WRAP_API_1(bool, lxcapi_shutdown, int)
2149
2150 static bool lxcapi_createl(struct lxc_container *c, const char *t,
2151 const char *bdevtype, struct bdev_specs *specs, int flags, ...)
2152 {
2153 bool bret = false;
2154 char **args = NULL;
2155 va_list ap;
2156
2157 if (!c)
2158 return false;
2159
2160 current_config = c->lxc_conf;
2161
2162 /*
2163 * since we're going to wait for create to finish, I don't think we
2164 * need to get a copy of the arguments.
2165 */
2166 va_start(ap, flags);
2167 args = lxc_va_arg_list_to_argv(ap, 0, 0);
2168 va_end(ap);
2169 if (!args) {
2170 ERROR("Failed to allocate memory");
2171 goto out;
2172 }
2173
2174 bret = do_lxcapi_create(c, t, bdevtype, specs, flags, args);
2175
2176 out:
2177 free(args);
2178 current_config = NULL;
2179 return bret;
2180 }
2181
2182 static void do_clear_unexp_config_line(struct lxc_conf *conf, const char *key)
2183 {
2184 if (strequal(key, "lxc.cgroup"))
2185 return clear_unexp_config_line(conf, key, true);
2186
2187 if (strequal(key, "lxc.network"))
2188 return clear_unexp_config_line(conf, key, true);
2189
2190 if (strequal(key, "lxc.net"))
2191 return clear_unexp_config_line(conf, key, true);
2192
2193 /* Clear a network with a specific index. */
2194 if (strnequal(key, "lxc.net.", 8)) {
2195 int ret;
2196 const char *idx;
2197
2198 idx = key + 8;
2199 ret = lxc_safe_uint(idx, &(unsigned int){0});
2200 if (!ret)
2201 return clear_unexp_config_line(conf, key, true);
2202 }
2203
2204 if (strequal(key, "lxc.hook"))
2205 return clear_unexp_config_line(conf, key, true);
2206
2207 return clear_unexp_config_line(conf, key, false);
2208 }
2209
2210 static bool do_lxcapi_clear_config_item(struct lxc_container *c,
2211 const char *key)
2212 {
2213 int ret = 1;
2214 struct lxc_config_t *config;
2215
2216 if (!c || !c->lxc_conf)
2217 return false;
2218
2219 if (container_mem_lock(c))
2220 return false;
2221
2222 config = lxc_get_config(key);
2223
2224 ret = config->clr(key, c->lxc_conf, NULL);
2225 if (!ret)
2226 do_clear_unexp_config_line(c->lxc_conf, key);
2227
2228 container_mem_unlock(c);
2229 return ret == 0;
2230 }
2231
2232 WRAP_API_1(bool, lxcapi_clear_config_item, const char *)
2233
2234 static inline bool enter_net_ns(struct lxc_container *c)
2235 {
2236 pid_t pid = do_lxcapi_init_pid(c);
2237
2238 if (pid < 0)
2239 return false;
2240
2241 if ((geteuid() != 0 || (c->lxc_conf && !list_empty(&c->lxc_conf->id_map))) &&
2242 (access("/proc/self/ns/user", F_OK) == 0))
2243 if (!switch_to_ns(pid, "user"))
2244 return false;
2245
2246 return switch_to_ns(pid, "net");
2247 }
2248
2249 /* Used by qsort and bsearch functions for comparing names. */
2250 static inline int string_cmp(char **first, char **second)
2251 {
2252 return strcmp(*first, *second);
2253 }
2254
2255 /* Used by qsort and bsearch functions for comparing container names. */
2256 static inline int container_cmp(struct lxc_container **first,
2257 struct lxc_container **second)
2258 {
2259 return strcmp((*first)->name, (*second)->name);
2260 }
2261
2262 static bool add_to_array(char ***names, char *cname, int pos)
2263 {
2264 __do_free char *dup_cname = NULL;
2265 char **newnames;
2266
2267 dup_cname = strdup(cname);
2268 if (!dup_cname)
2269 return false;
2270
2271 newnames = realloc(*names, (pos + 1) * sizeof(char *));
2272 if (!newnames)
2273 return ret_set_errno(false, ENOMEM);
2274
2275 newnames[pos] = move_ptr(dup_cname);
2276
2277 /* Sort the array as we will use binary search on it. */
2278 qsort(newnames, pos + 1, sizeof(char *),
2279 (int (*)(const void *, const void *))string_cmp);
2280
2281 *names = newnames;
2282 return true;
2283 }
2284
2285 static bool add_to_clist(struct lxc_container ***list, struct lxc_container *c,
2286 int pos, bool sort)
2287 {
2288 struct lxc_container **newlist;
2289
2290 newlist = realloc(*list, (pos + 1) * sizeof(struct lxc_container *));
2291 if (!newlist)
2292 return ret_set_errno(false, ENOMEM);
2293
2294 newlist[pos] = c;
2295
2296 /* Sort the array as we will use binary search on it. */
2297 if (sort)
2298 qsort(newlist, pos + 1, sizeof(struct lxc_container *),
2299 (int (*)(const void *, const void *))container_cmp);
2300
2301 *list = newlist;
2302 return true;
2303 }
2304
2305 static char **get_from_array(char ***names, char *cname, int size)
2306 {
2307 if (!*names)
2308 return NULL;
2309
2310 return bsearch(&cname, *names, size, sizeof(char *),
2311 (int (*)(const void *, const void *))string_cmp);
2312 }
2313
2314 static bool array_contains(char ***names, char *cname, int size)
2315 {
2316 if (get_from_array(names, cname, size))
2317 return true;
2318
2319 return false;
2320 }
2321
2322 static char **do_lxcapi_get_interfaces(struct lxc_container *c)
2323 {
2324 pid_t pid;
2325 int i, count = 0, pipefd[2];
2326 char **interfaces = NULL;
2327 char interface[IFNAMSIZ];
2328
2329 if (pipe2(pipefd, O_CLOEXEC))
2330 return log_error_errno(NULL, errno, "Failed to create pipe");
2331
2332 pid = fork();
2333 if (pid < 0) {
2334 close(pipefd[0]);
2335 close(pipefd[1]);
2336 return log_error_errno(NULL, errno, "Failed to fork task to get interfaces information");
2337 }
2338
2339 if (pid == 0) {
2340 call_cleaner(netns_freeifaddrs) struct netns_ifaddrs *ifaddrs = NULL;
2341 struct netns_ifaddrs *ifa = NULL;
2342 int ret = 1;
2343 int nbytes;
2344
2345 /* close the read-end of the pipe */
2346 close(pipefd[0]);
2347
2348 if (!enter_net_ns(c)) {
2349 SYSERROR("Failed to enter network namespace");
2350 goto out;
2351 }
2352
2353 /* Grab the list of interfaces */
2354 if (netns_getifaddrs(&ifaddrs, -1, &(bool){false})) {
2355 SYSERROR("Failed to get interfaces list");
2356 goto out;
2357 }
2358
2359 /* Iterate through the interfaces */
2360 for (ifa = ifaddrs; ifa != NULL;
2361 ifa = ifa->ifa_next) {
2362 nbytes = lxc_write_nointr(pipefd[1], ifa->ifa_name, IFNAMSIZ);
2363 if (nbytes < 0)
2364 goto out;
2365
2366 count++;
2367 }
2368
2369 ret = 0;
2370
2371 out:
2372 /* close the write-end of the pipe, thus sending EOF to the reader */
2373 close(pipefd[1]);
2374 _exit(ret);
2375 }
2376
2377 /* close the write-end of the pipe */
2378 close(pipefd[1]);
2379
2380 while (lxc_read_nointr(pipefd[0], &interface, IFNAMSIZ) == IFNAMSIZ) {
2381 interface[IFNAMSIZ - 1] = '\0';
2382
2383 if (array_contains(&interfaces, interface, count))
2384 continue;
2385
2386 if (!add_to_array(&interfaces, interface, count))
2387 ERROR("Failed to add \"%s\" to array", interface);
2388
2389 count++;
2390 }
2391
2392 if (wait_for_pid(pid)) {
2393 for (i = 0; i < count; i++)
2394 free(interfaces[i]);
2395
2396 free(interfaces);
2397 interfaces = NULL;
2398 }
2399
2400 /* close the read-end of the pipe */
2401 close(pipefd[0]);
2402
2403 /* Append NULL to the array */
2404 if (interfaces)
2405 interfaces = (char **)lxc_append_null_to_array((void **)interfaces, count);
2406
2407 return interfaces;
2408 }
2409
2410 WRAP_API(char **, lxcapi_get_interfaces)
2411
2412 static char **do_lxcapi_get_ips(struct lxc_container *c, const char *interface,
2413 const char *family, int scope)
2414 {
2415 int i, ret;
2416 pid_t pid;
2417 int pipefd[2];
2418 char address[INET6_ADDRSTRLEN];
2419 int count = 0;
2420 char **addresses = NULL;
2421
2422 ret = pipe2(pipefd, O_CLOEXEC);
2423 if (ret < 0)
2424 return log_error_errno(NULL, errno, "Failed to create pipe");
2425
2426 pid = fork();
2427 if (pid < 0) {
2428 SYSERROR("Failed to create new process");
2429 close(pipefd[0]);
2430 close(pipefd[1]);
2431 return NULL;
2432 }
2433
2434 if (pid == 0) {
2435 call_cleaner(netns_freeifaddrs) struct netns_ifaddrs *ifaddrs = NULL;
2436 struct netns_ifaddrs *ifa = NULL;
2437 ssize_t nbytes;
2438 char addressOutputBuffer[INET6_ADDRSTRLEN];
2439 char *address_ptr = NULL;
2440 void *address_ptr_tmp = NULL;
2441
2442 /* close the read-end of the pipe */
2443 close(pipefd[0]);
2444
2445 if (!enter_net_ns(c)) {
2446 SYSERROR("Failed to attach to network namespace");
2447 goto out;
2448 }
2449
2450 /* Grab the list of interfaces */
2451 if (netns_getifaddrs(&ifaddrs, -1, &(bool){false})) {
2452 SYSERROR("Failed to get interfaces list");
2453 goto out;
2454 }
2455
2456 /* Iterate through the interfaces */
2457 for (ifa = ifaddrs; ifa; ifa = ifa->ifa_next) {
2458 if (ifa->ifa_addr == NULL)
2459 continue;
2460
2461 #pragma GCC diagnostic push
2462 #pragma GCC diagnostic ignored "-Wcast-align"
2463
2464 if (ifa->ifa_addr->sa_family == AF_INET) {
2465 if (family && !strequal(family, "inet"))
2466 continue;
2467
2468 address_ptr_tmp = &((struct sockaddr_in *)ifa->ifa_addr)->sin_addr;
2469 } else {
2470 if (family && !strequal(family, "inet6"))
2471 continue;
2472
2473 if (((struct sockaddr_in6 *)ifa->ifa_addr)->sin6_scope_id != (uint32_t)scope)
2474 continue;
2475
2476 address_ptr_tmp = &((struct sockaddr_in6 *)ifa->ifa_addr)->sin6_addr;
2477 }
2478
2479 #pragma GCC diagnostic pop
2480
2481 if (interface && !strequal(interface, ifa->ifa_name))
2482 continue;
2483 else if (!interface && strequal("lo", ifa->ifa_name))
2484 continue;
2485
2486 address_ptr = (char *)inet_ntop(ifa->ifa_addr->sa_family, address_ptr_tmp,
2487 addressOutputBuffer,
2488 sizeof(addressOutputBuffer));
2489 if (!address_ptr)
2490 continue;
2491
2492 nbytes = lxc_write_nointr(pipefd[1], address_ptr, INET6_ADDRSTRLEN);
2493 if (nbytes != INET6_ADDRSTRLEN) {
2494 SYSERROR("Failed to send ipv6 address \"%s\"", address_ptr);
2495 goto out;
2496 }
2497
2498 count++;
2499 }
2500
2501 ret = 0;
2502
2503 out:
2504 /* close the write-end of the pipe, thus sending EOF to the reader */
2505 close(pipefd[1]);
2506 _exit(ret);
2507 }
2508
2509 /* close the write-end of the pipe */
2510 close(pipefd[1]);
2511
2512 while (lxc_read_nointr(pipefd[0], &address, INET6_ADDRSTRLEN) == INET6_ADDRSTRLEN) {
2513 address[INET6_ADDRSTRLEN - 1] = '\0';
2514
2515 if (!add_to_array(&addresses, address, count))
2516 ERROR("PARENT: add_to_array failed");
2517
2518 count++;
2519 }
2520
2521 if (wait_for_pid(pid)) {
2522 for (i = 0; i < count; i++)
2523 free(addresses[i]);
2524
2525 free(addresses);
2526 addresses = NULL;
2527 }
2528
2529 /* close the read-end of the pipe */
2530 close(pipefd[0]);
2531
2532 /* Append NULL to the array */
2533 if (addresses)
2534 addresses = (char **)lxc_append_null_to_array((void **)addresses, count);
2535
2536 return addresses;
2537 }
2538
2539 WRAP_API_3(char **, lxcapi_get_ips, const char *, const char *, int)
2540
2541 static int do_lxcapi_get_config_item(struct lxc_container *c, const char *key, char *retv, int inlen)
2542 {
2543 int ret = -1;
2544 struct lxc_config_t *config;
2545
2546 if (!c || !c->lxc_conf)
2547 return -1;
2548
2549 if (container_mem_lock(c))
2550 return -1;
2551
2552 config = lxc_get_config(key);
2553
2554 ret = config->get(key, retv, inlen, c->lxc_conf, NULL);
2555
2556 container_mem_unlock(c);
2557 return ret;
2558 }
2559
2560 WRAP_API_3(int, lxcapi_get_config_item, const char *, char *, int)
2561
2562 static char* do_lxcapi_get_running_config_item(struct lxc_container *c, const char *key)
2563 {
2564 char *ret;
2565
2566 if (!c || !c->lxc_conf)
2567 return NULL;
2568
2569 if (container_mem_lock(c))
2570 return NULL;
2571
2572 ret = lxc_cmd_get_config_item(c->name, key, do_lxcapi_get_config_path(c));
2573 container_mem_unlock(c);
2574 return ret;
2575 }
2576
2577 WRAP_API_1(char *, lxcapi_get_running_config_item, const char *)
2578
2579 static int do_lxcapi_get_keys(struct lxc_container *c, const char *key, char *retv, int inlen)
2580 {
2581 int ret = -1;
2582
2583 /* List all config items. */
2584 if (!key)
2585 return lxc_list_config_items(retv, inlen);
2586
2587 if (!c || !c->lxc_conf)
2588 return -1;
2589
2590 if (container_mem_lock(c))
2591 return -1;
2592
2593 /* Support 'lxc.net.<idx>', i.e. 'lxc.net.0'
2594 * This is an intelligent result to show which keys are valid given the
2595 * type of nic it is.
2596 */
2597 if (strnequal(key, "lxc.net.", 8))
2598 ret = lxc_list_net(c->lxc_conf, key, retv, inlen);
2599 else
2600 ret = lxc_list_subkeys(c->lxc_conf, key, retv, inlen);
2601
2602 container_mem_unlock(c);
2603 return ret;
2604 }
2605
2606 WRAP_API_3(int, lxcapi_get_keys, const char *, char *, int)
2607
2608 static bool do_lxcapi_save_config(struct lxc_container *c, const char *alt_file)
2609 {
2610 int fd, lret;
2611 bool ret = false, need_disklock = false;
2612
2613 if (!alt_file)
2614 alt_file = c->configfile;
2615
2616 if (!alt_file)
2617 return false;
2618
2619 /* If we haven't yet loaded a config, load the stock config. */
2620 if (!c->lxc_conf) {
2621 if (!do_lxcapi_load_config(c, lxc_global_config_value("lxc.default_config"))) {
2622 ERROR("Error loading default configuration file %s "
2623 "while saving %s",
2624 lxc_global_config_value("lxc.default_config"),
2625 c->name);
2626 return false;
2627 }
2628 }
2629
2630 if (!create_container_dir(c))
2631 return false;
2632
2633 /* If we're writing to the container's config file, take the disk lock.
2634 * Otherwise just take the memlock to protect the struct lxc_container
2635 * while we're traversing it.
2636 */
2637 if (strequal(c->configfile, alt_file))
2638 need_disklock = true;
2639
2640 if (need_disklock)
2641 lret = container_disk_lock(c);
2642 else
2643 lret = container_mem_lock(c);
2644 if (lret)
2645 return false;
2646
2647 fd = open(alt_file, O_WRONLY | O_CREAT | O_TRUNC | O_CLOEXEC,
2648 S_IRUSR | S_IWUSR | S_IRGRP | S_IWGRP);
2649 if (fd < 0)
2650 goto on_error;
2651
2652 lret = write_config(fd, c->lxc_conf);
2653 close(fd);
2654 if (lret < 0)
2655 goto on_error;
2656
2657 ret = true;
2658
2659 on_error:
2660 if (need_disklock)
2661 container_disk_unlock(c);
2662 else
2663 container_mem_unlock(c);
2664
2665 return ret;
2666 }
2667
2668 WRAP_API_1(bool, lxcapi_save_config, const char *)
2669
2670
2671 static bool mod_rdep(struct lxc_container *c0, struct lxc_container *c, bool inc)
2672 {
2673 FILE *f1;
2674 struct stat fbuf;
2675 void *buf = NULL;
2676 char *del = NULL;
2677 char path[PATH_MAX];
2678 char newpath[PATH_MAX];
2679 int fd, ret, n = 0, v = 0;
2680 bool bret = false;
2681 size_t len = 0, bytes = 0;
2682
2683 if (container_disk_lock(c0))
2684 return false;
2685
2686 ret = strnprintf(path, sizeof(path), "%s/%s/lxc_snapshots", c0->config_path, c0->name);
2687 if (ret < 0)
2688 goto out;
2689
2690 ret = strnprintf(newpath, sizeof(newpath), "%s\n%s\n", c->config_path, c->name);
2691 if (ret < 0)
2692 goto out;
2693
2694 /* If we find an lxc-snapshot file using the old format only listing the
2695 * number of snapshots we will keep using it. */
2696 f1 = fopen(path, "re");
2697 if (f1) {
2698 n = fscanf(f1, "%d", &v);
2699 fclose(f1);
2700 if (n == 1 && v == 0) {
2701 ret = remove(path);
2702 if (ret < 0)
2703 SYSERROR("Failed to remove \"%s\"", path);
2704
2705 n = 0;
2706 }
2707 }
2708
2709 if (n == 1) {
2710 v += inc ? 1 : -1;
2711 f1 = fopen(path, "we");
2712 if (!f1)
2713 goto out;
2714
2715 if (fprintf(f1, "%d\n", v) < 0) {
2716 ERROR("Error writing new snapshots value");
2717 fclose(f1);
2718 goto out;
2719 }
2720
2721 ret = fclose(f1);
2722 if (ret != 0) {
2723 SYSERROR("Error writing to or closing snapshots file");
2724 goto out;
2725 }
2726 } else {
2727 /* Here we know that we have or can use an lxc-snapshot file
2728 * using the new format. */
2729 if (inc) {
2730 f1 = fopen(path, "ae");
2731 if (!f1)
2732 goto out;
2733
2734 if (fprintf(f1, "%s", newpath) < 0) {
2735 ERROR("Error writing new snapshots entry");
2736 ret = fclose(f1);
2737 if (ret != 0)
2738 SYSERROR("Error writing to or closing snapshots file");
2739 goto out;
2740 }
2741
2742 ret = fclose(f1);
2743 if (ret != 0) {
2744 SYSERROR("Error writing to or closing snapshots file");
2745 goto out;
2746 }
2747 } else if (!inc) {
2748 if ((fd = open(path, O_RDWR | O_CLOEXEC)) < 0)
2749 goto out;
2750
2751 if (fstat(fd, &fbuf) < 0) {
2752 close(fd);
2753 goto out;
2754 }
2755
2756 if (fbuf.st_size != 0) {
2757 buf = lxc_strmmap(NULL, fbuf.st_size, PROT_READ | PROT_WRITE, MAP_SHARED, fd, 0);
2758 if (buf == MAP_FAILED) {
2759 SYSERROR("Failed to create mapping %s", path);
2760 close(fd);
2761 goto out;
2762 }
2763
2764 len = strlen(newpath);
2765 while ((del = strstr((char *)buf, newpath))) {
2766 memmove(del, del + len, strlen(del) - len + 1);
2767 bytes += len;
2768 }
2769
2770 lxc_strmunmap(buf, fbuf.st_size);
2771 if (ftruncate(fd, fbuf.st_size - bytes) < 0) {
2772 SYSERROR("Failed to truncate file %s", path);
2773 close(fd);
2774 goto out;
2775 }
2776 }
2777
2778 close(fd);
2779 }
2780
2781 /* If the lxc-snapshot file is empty, remove it. */
2782 if (stat(path, &fbuf) < 0)
2783 goto out;
2784
2785 if (!fbuf.st_size) {
2786 ret = remove(path);
2787 if (ret < 0)
2788 SYSERROR("Failed to remove \"%s\"", path);
2789 }
2790 }
2791
2792 bret = true;
2793
2794 out:
2795 container_disk_unlock(c0);
2796 return bret;
2797 }
2798
2799 void mod_all_rdeps(struct lxc_container *c, bool inc)
2800 {
2801 __do_free char *lxcpath = NULL, *lxcname = NULL;
2802 __do_fclose FILE *f = NULL;
2803 size_t pathlen = 0, namelen = 0;
2804 struct lxc_container *p;
2805 char path[PATH_MAX];
2806 int ret;
2807
2808 ret = strnprintf(path, sizeof(path), "%s/%s/lxc_rdepends",
2809 c->config_path, c->name);
2810 if (ret < 0) {
2811 ERROR("Path name too long");
2812 return;
2813 }
2814
2815 f = fopen(path, "re");
2816 if (!f)
2817 return;
2818
2819 while (getline(&lxcpath, &pathlen, f) != -1) {
2820 if (getline(&lxcname, &namelen, f) == -1) {
2821 ERROR("badly formatted file %s", path);
2822 return;
2823 }
2824
2825 remove_trailing_newlines(lxcpath);
2826 remove_trailing_newlines(lxcname);
2827
2828 if ((p = lxc_container_new(lxcname, lxcpath)) == NULL) {
2829 ERROR("Unable to find dependent container %s:%s",
2830 lxcpath, lxcname);
2831 continue;
2832 }
2833
2834 if (!mod_rdep(p, c, inc))
2835 ERROR("Failed to update snapshots file for %s:%s",
2836 lxcpath, lxcname);
2837
2838 lxc_container_put(p);
2839 }
2840 }
2841
2842 static bool has_fs_snapshots(struct lxc_container *c)
2843 {
2844 __do_fclose FILE *f = NULL;
2845 char path[PATH_MAX];
2846 int ret, v;
2847 struct stat fbuf;
2848
2849 ret = strnprintf(path, sizeof(path), "%s/%s/lxc_snapshots", c->config_path,
2850 c->name);
2851 if (ret < 0)
2852 return false;
2853
2854 /* If the file doesn't exist there are no snapshots. */
2855 if (stat(path, &fbuf) < 0)
2856 return false;
2857
2858 v = fbuf.st_size;
2859 if (v != 0) {
2860 f = fopen(path, "re");
2861 if (!f)
2862 return false;
2863
2864 ret = fscanf(f, "%d", &v);
2865 if (ret != 1)
2866 INFO("Container uses new lxc-snapshots format %s", path);
2867 }
2868
2869 return v != 0;
2870 }
2871
2872 static bool has_snapshots(struct lxc_container *c)
2873 {
2874 __do_closedir DIR *dir = NULL;
2875 char path[PATH_MAX];
2876 struct dirent *direntp;
2877 int count = 0;
2878
2879 if (!get_snappath_dir(c, path))
2880 return false;
2881
2882 dir = opendir(path);
2883 if (!dir)
2884 return false;
2885
2886 while ((direntp = readdir(dir))) {
2887 if (strequal(direntp->d_name, "."))
2888 continue;
2889
2890 if (strequal(direntp->d_name, ".."))
2891 continue;
2892 count++;
2893 break;
2894 }
2895
2896 return count > 0;
2897 }
2898
2899 static bool do_destroy_container(struct lxc_conf *conf) {
2900 int ret;
2901
2902 if (am_guest_unpriv()) {
2903 ret = userns_exec_full(conf, storage_destroy_wrapper, conf,
2904 "storage_destroy_wrapper");
2905 if (ret < 0)
2906 return false;
2907
2908 return true;
2909 }
2910
2911 return storage_destroy(conf);
2912 }
2913
2914 static int lxc_rmdir_onedev_wrapper(void *data)
2915 {
2916 char *arg = (char *) data;
2917 return lxc_rmdir_onedev(arg, "snaps");
2918 }
2919
2920 static int lxc_unlink_exec_wrapper(void *data)
2921 {
2922 char *arg = data;
2923 return unlink(arg);
2924 }
2925
2926 static bool container_destroy(struct lxc_container *c,
2927 struct lxc_storage *storage)
2928 {
2929 const char *p1;
2930 size_t len;
2931 struct lxc_conf *conf;
2932 char *path = NULL;
2933 bool bret = false;
2934 int ret = 0;
2935
2936 if (!c || !do_lxcapi_is_defined(c))
2937 return false;
2938
2939 conf = c->lxc_conf;
2940 if (container_disk_lock(c))
2941 return false;
2942
2943 if (!is_stopped(c)) {
2944 /* We should queue some sort of error - in c->error_string? */
2945 ERROR("container %s is not stopped", c->name);
2946 goto out;
2947 }
2948
2949 if (conf && !list_empty(&conf->hooks[LXCHOOK_DESTROY])) {
2950 /* Start of environment variable setup for hooks */
2951 if (setenv("LXC_NAME", c->name, 1))
2952 SYSERROR("Failed to set environment variable for container name");
2953
2954 if (conf->rcfile && setenv("LXC_CONFIG_FILE", conf->rcfile, 1))
2955 SYSERROR("Failed to set environment variable for config path");
2956
2957 if (conf->rootfs.mount && setenv("LXC_ROOTFS_MOUNT", conf->rootfs.mount, 1))
2958 SYSERROR("Failed to set environment variable for rootfs mount");
2959
2960 if (conf->rootfs.path && setenv("LXC_ROOTFS_PATH", conf->rootfs.path, 1))
2961 SYSERROR("Failed to set environment variable for rootfs mount");
2962
2963 if (conf->console.path && setenv("LXC_CONSOLE", conf->console.path, 1))
2964 SYSERROR("Failed to set environment variable for console path");
2965
2966 if (conf->console.log_path && setenv("LXC_CONSOLE_LOGPATH", conf->console.log_path, 1))
2967 SYSERROR("Failed to set environment variable for console log");
2968 /* End of environment variable setup for hooks */
2969
2970 if (run_lxc_hooks(c->name, "destroy", conf, NULL)) {
2971 ERROR("Failed to execute clone hook for \"%s\"", c->name);
2972 goto out;
2973 }
2974 }
2975
2976 if (current_config && conf == current_config) {
2977 current_config = NULL;
2978
2979 if (conf->logfd != -1) {
2980 close(conf->logfd);
2981 conf->logfd = -1;
2982 }
2983 }
2984
2985 /* LXC is not managing the storage of the container. */
2986 if (conf && !conf->rootfs.managed)
2987 goto on_success;
2988
2989 if (conf && conf->rootfs.path && conf->rootfs.mount) {
2990 if (!do_destroy_container(conf)) {
2991 ERROR("Error destroying rootfs for %s", c->name);
2992 goto out;
2993 }
2994 INFO("Destroyed rootfs for %s", c->name);
2995 }
2996
2997 mod_all_rdeps(c, false);
2998
2999 p1 = do_lxcapi_get_config_path(c);
3000 /* strlen(p1)
3001 * +
3002 * /
3003 * +
3004 * strlen(c->name)
3005 * +
3006 * /
3007 * +
3008 * strlen("config") = 6
3009 * +
3010 * \0
3011 */
3012 len = strlen(p1) + 1 + strlen(c->name) + 1 + strlen(LXC_CONFIG_FNAME) + 1;
3013 path = malloc(len);
3014 if (!path) {
3015 ERROR("Failed to allocate memory");
3016 goto out;
3017 }
3018
3019 /* For an overlay container the rootfs is considered immutable and
3020 * cannot be removed when restoring from a snapshot.
3021 */
3022 if (storage && (strequal(storage->type, "overlay") ||
3023 strequal(storage->type, "overlayfs")) &&
3024 (storage->flags & LXC_STORAGE_INTERNAL_OVERLAY_RESTORE)) {
3025 ret = strnprintf(path, len, "%s/%s/%s", p1, c->name, LXC_CONFIG_FNAME);
3026 if (ret < 0)
3027 goto out;
3028
3029 if (am_guest_unpriv())
3030 ret = userns_exec_1(conf, lxc_unlink_exec_wrapper, path,
3031 "lxc_unlink_exec_wrapper");
3032 else
3033 ret = unlink(path);
3034 if (ret < 0) {
3035 SYSERROR("Failed to destroy config file \"%s\" for \"%s\"",
3036 path, c->name);
3037 goto out;
3038 }
3039 INFO("Destroyed config file \"%s\" for \"%s\"", path, c->name);
3040
3041 bret = true;
3042 goto out;
3043 }
3044
3045 ret = strnprintf(path, len, "%s/%s", p1, c->name);
3046 if (ret < 0)
3047 goto out;
3048
3049 if (am_guest_unpriv())
3050 ret = userns_exec_full(conf, lxc_rmdir_onedev_wrapper, path,
3051 "lxc_rmdir_onedev_wrapper");
3052 else
3053 ret = lxc_rmdir_onedev(path, "snaps");
3054 if (ret < 0) {
3055 ERROR("Failed to destroy directory \"%s\" for \"%s\"", path,
3056 c->name);
3057 goto out;
3058 }
3059 INFO("Destroyed directory \"%s\" for \"%s\"", path, c->name);
3060
3061 on_success:
3062 bret = true;
3063
3064 out:
3065 if (path)
3066 free(path);
3067
3068 container_disk_unlock(c);
3069 return bret;
3070 }
3071
3072 static bool do_lxcapi_destroy(struct lxc_container *c)
3073 {
3074 if (!c || !lxcapi_is_defined(c))
3075 return false;
3076
3077 if (c->lxc_conf && c->lxc_conf->rootfs.managed) {
3078 if (has_snapshots(c)) {
3079 ERROR("Container %s has snapshots; not removing", c->name);
3080 return false;
3081 }
3082
3083 if (has_fs_snapshots(c)) {
3084 ERROR("container %s has snapshots on its rootfs", c->name);
3085 return false;
3086 }
3087 }
3088
3089 return container_destroy(c, NULL);
3090 }
3091
3092 WRAP_API(bool, lxcapi_destroy)
3093
3094 static bool do_lxcapi_destroy_with_snapshots(struct lxc_container *c)
3095 {
3096 if (!c || !lxcapi_is_defined(c))
3097 return false;
3098
3099 if (!lxcapi_snapshot_destroy_all(c)) {
3100 ERROR("Error deleting all snapshots");
3101 return false;
3102 }
3103
3104 return lxcapi_destroy(c);
3105 }
3106
3107 WRAP_API(bool, lxcapi_destroy_with_snapshots)
3108
3109 int lxc_set_config_item_locked(struct lxc_conf *conf, const char *key,
3110 const char *v)
3111 {
3112 int ret;
3113 struct lxc_config_t *config;
3114 bool bret = true;
3115
3116 config = lxc_get_config(key);
3117
3118 ret = config->set(key, v, conf, NULL);
3119 if (ret < 0)
3120 return -EINVAL;
3121
3122 if (lxc_config_value_empty(v))
3123 do_clear_unexp_config_line(conf, key);
3124 else
3125 bret = do_append_unexp_config_line(conf, key, v);
3126 if (!bret)
3127 return -ENOMEM;
3128
3129 return 0;
3130 }
3131
3132 static bool do_set_config_item_locked(struct lxc_container *c, const char *key,
3133 const char *v)
3134 {
3135 int ret;
3136
3137 if (!c->lxc_conf)
3138 c->lxc_conf = lxc_conf_init();
3139
3140 if (!c->lxc_conf)
3141 return false;
3142
3143 ret = lxc_set_config_item_locked(c->lxc_conf, key, v);
3144 if (ret < 0)
3145 return false;
3146
3147 return true;
3148 }
3149
3150 static bool do_lxcapi_set_config_item(struct lxc_container *c, const char *key, const char *v)
3151 {
3152 bool b = false;
3153
3154 if (!c)
3155 return false;
3156
3157 if (container_mem_lock(c))
3158 return false;
3159
3160 b = do_set_config_item_locked(c, key, v);
3161
3162 container_mem_unlock(c);
3163 return b;
3164 }
3165
3166 WRAP_API_2(bool, lxcapi_set_config_item, const char *, const char *)
3167
3168 static char *lxcapi_config_file_name(struct lxc_container *c)
3169 {
3170 if (!c || !c->configfile)
3171 return NULL;
3172
3173 return strdup(c->configfile);
3174 }
3175
3176 static const char *lxcapi_get_config_path(struct lxc_container *c)
3177 {
3178 if (!c || !c->config_path)
3179 return NULL;
3180
3181 return (const char *)(c->config_path);
3182 }
3183
3184 /*
3185 * not for export
3186 * Just recalculate the c->configfile based on the
3187 * c->config_path, which must be set.
3188 * The lxc_container must be locked or not yet public.
3189 */
3190 static bool set_config_filename(struct lxc_container *c)
3191 {
3192 char *newpath;
3193 int len, ret;
3194
3195 if (!c->config_path)
3196 return false;
3197
3198 /* $lxc_path + "/" + c->name + "/" + "config" + '\0' */
3199 len = strlen(c->config_path) + 1 + strlen(c->name) + 1 + strlen(LXC_CONFIG_FNAME) + 1;
3200 newpath = malloc(len);
3201 if (!newpath)
3202 return false;
3203
3204 ret = strnprintf(newpath, len, "%s/%s/%s", c->config_path, c->name, LXC_CONFIG_FNAME);
3205 if (ret < 0) {
3206 fprintf(stderr, "Error printing out config file name\n");
3207 free(newpath);
3208 return false;
3209 }
3210
3211 free(c->configfile);
3212 c->configfile = newpath;
3213
3214 return true;
3215 }
3216
3217 static bool do_lxcapi_set_config_path(struct lxc_container *c, const char *path)
3218 {
3219 char *p;
3220 bool b = false;
3221 char *oldpath = NULL;
3222
3223 if (!c)
3224 return b;
3225
3226 if (container_mem_lock(c))
3227 return b;
3228
3229 p = strdup(path);
3230 if (!p) {
3231 ERROR("Out of memory setting new lxc path");
3232 goto err;
3233 }
3234
3235 b = true;
3236 if (c->config_path)
3237 oldpath = c->config_path;
3238 c->config_path = p;
3239
3240 /* Since we've changed the config path, we have to change the
3241 * config file name too */
3242 if (!set_config_filename(c)) {
3243 ERROR("Out of memory setting new config filename");
3244 b = false;
3245 free(c->config_path);
3246 c->config_path = oldpath;
3247 oldpath = NULL;
3248 }
3249
3250 err:
3251 free(oldpath);
3252 container_mem_unlock(c);
3253 return b;
3254 }
3255
3256 WRAP_API_1(bool, lxcapi_set_config_path, const char *)
3257
3258 static bool do_lxcapi_set_cgroup_item(struct lxc_container *c, const char *subsys, const char *value)
3259 {
3260 call_cleaner(cgroup_exit) struct cgroup_ops *cgroup_ops = NULL;
3261 int ret;
3262
3263 if (!c)
3264 return false;
3265
3266 if (is_stopped(c))
3267 return false;
3268
3269 ret = cgroup_set(c->name, c->config_path, subsys, value);
3270 if (ret < 0 && ERRNO_IS_NOT_SUPPORTED(ret)) {
3271 cgroup_ops = cgroup_init(c->lxc_conf);
3272 if (!cgroup_ops)
3273 return false;
3274
3275 ret = cgroup_ops->set(cgroup_ops, subsys, value, c->name, c->config_path);
3276 }
3277
3278 return ret == 0;
3279 }
3280
3281 WRAP_API_2(bool, lxcapi_set_cgroup_item, const char *, const char *)
3282
3283 static int do_lxcapi_get_cgroup_item(struct lxc_container *c, const char *subsys, char *retv, int inlen)
3284 {
3285 call_cleaner(cgroup_exit) struct cgroup_ops *cgroup_ops = NULL;
3286 int ret;
3287
3288 if (!c)
3289 return -1;
3290
3291 if (is_stopped(c))
3292 return -1;
3293
3294 ret = cgroup_get(c->name, c->config_path, subsys, retv, inlen);
3295 if (ret < 0 && ERRNO_IS_NOT_SUPPORTED(ret)) {
3296 cgroup_ops = cgroup_init(c->lxc_conf);
3297 if (!cgroup_ops)
3298 return -1;
3299
3300 return cgroup_ops->get(cgroup_ops, subsys, retv, inlen, c->name, c->config_path);
3301 }
3302
3303 return ret;
3304 }
3305
3306 WRAP_API_3(int, lxcapi_get_cgroup_item, const char *, char *, int)
3307
3308 const char *lxc_get_global_config_item(const char *key)
3309 {
3310 return lxc_global_config_value(key);
3311 }
3312
3313 const char *lxc_get_version(void)
3314 {
3315 return LXC_VERSION;
3316 }
3317
3318 static int copy_file(const char *old, const char *new)
3319 {
3320 int in, out;
3321 ssize_t len, ret;
3322 char buf[8096];
3323 struct stat sbuf;
3324
3325 if (file_exists(new)) {
3326 ERROR("copy destination %s exists", new);
3327 return -1;
3328 }
3329
3330 ret = stat(old, &sbuf);
3331 if (ret < 0) {
3332 INFO("Error stat'ing %s", old);
3333 return -1;
3334 }
3335
3336 in = open(old, O_RDONLY);
3337 if (in < 0) {
3338 SYSERROR("Error opening original file %s", old);
3339 return -1;
3340 }
3341
3342 out = open(new, O_CREAT | O_EXCL | O_WRONLY, 0644);
3343 if (out < 0) {
3344 SYSERROR("Error opening new file %s", new);
3345 close(in);
3346 return -1;
3347 }
3348
3349 for (;;) {
3350 len = lxc_read_nointr(in, buf, 8096);
3351 if (len < 0) {
3352 SYSERROR("Error reading old file %s", old);
3353 goto err;
3354 }
3355
3356 if (len == 0)
3357 break;
3358
3359 ret = lxc_write_nointr(out, buf, len);
3360 if (ret < len) { /* should we retry? */
3361 SYSERROR("Error: write to new file %s was interrupted", new);
3362 goto err;
3363 }
3364 }
3365
3366 close(in);
3367 close(out);
3368
3369 /* We set mode, but not owner/group. */
3370 ret = chmod(new, sbuf.st_mode);
3371 if (ret) {
3372 SYSERROR("Error setting mode on %s", new);
3373 return -1;
3374 }
3375
3376 return 0;
3377
3378 err:
3379 close(in);
3380 close(out);
3381 return -1;
3382 }
3383
3384 static int copyhooks(struct lxc_container *oldc, struct lxc_container *c)
3385 {
3386 __do_free char *cpath = NULL;
3387 int i, len, ret;
3388 struct string_entry *entry;
3389
3390 len = strlen(oldc->config_path) + strlen(oldc->name) + 3;
3391 cpath = malloc(len);
3392 if (!cpath)
3393 return ret_errno(ENOMEM);
3394
3395 ret = strnprintf(cpath, len, "%s/%s/", oldc->config_path, oldc->name);
3396 if (ret < 0)
3397 return -1;
3398
3399 for (i = 0; i < NUM_LXC_HOOKS; i++) {
3400 list_for_each_entry(entry, &c->lxc_conf->hooks[i], head) {
3401 __do_free char *hookname = NULL;
3402 char *fname, *new_hook;
3403 char tmppath[PATH_MAX];
3404
3405 fname = strrchr(entry->val, '/');
3406 if (!fname)
3407 return 0;
3408
3409 /* If this hook is public - ignore. */
3410 if (!strnequal(entry->val, cpath, len - 1))
3411 continue;
3412
3413 /* copy the script, and change the entry in confile */
3414 ret = strnprintf(tmppath, sizeof(tmppath), "%s/%s/%s",
3415 c->config_path, c->name, fname+1);
3416 if (ret < 0)
3417 return -1;
3418
3419 ret = copy_file(entry->val, tmppath);
3420 if (ret < 0)
3421 return -1;
3422
3423 new_hook = strdup(tmppath);
3424 if (!new_hook)
3425 return syserror("out of memory copying hook path");
3426
3427 hookname = move_ptr(entry->val);
3428 entry->val = move_ptr(new_hook);
3429 }
3430 }
3431
3432 if (!clone_update_unexp_hooks(c->lxc_conf, oldc->config_path,
3433 c->config_path, oldc->name, c->name)) {
3434 return syserror_ret(-1, "Error saving new hooks in clone");
3435 }
3436
3437 do_lxcapi_save_config(c, NULL);
3438 return 0;
3439 }
3440
3441 static int copy_fstab(struct lxc_container *oldc, struct lxc_container *c)
3442 {
3443 char newpath[PATH_MAX];
3444 char *oldpath = oldc->lxc_conf->fstab;
3445 int ret;
3446
3447 if (!oldpath)
3448 return 0;
3449
3450 clear_unexp_config_line(c->lxc_conf, "lxc.mount.fstab", false);
3451
3452 char *p = strrchr(oldpath, '/');
3453 if (!p)
3454 return -1;
3455
3456 ret = strnprintf(newpath, sizeof(newpath), "%s/%s%s",
3457 c->config_path, c->name, p);
3458 if (ret < 0) {
3459 ERROR("error printing new path for %s", oldpath);
3460 return -1;
3461 }
3462
3463 if (file_exists(newpath)) {
3464 ERROR("error: fstab file %s exists", newpath);
3465 return -1;
3466 }
3467
3468 if (copy_file(oldpath, newpath) < 0) {
3469 ERROR("error: copying %s to %s", oldpath, newpath);
3470 return -1;
3471 }
3472
3473 free(c->lxc_conf->fstab);
3474
3475 c->lxc_conf->fstab = strdup(newpath);
3476 if (!c->lxc_conf->fstab) {
3477 ERROR("error: allocating pathname");
3478 return -1;
3479 }
3480
3481 if (!do_append_unexp_config_line(c->lxc_conf, "lxc.mount.fstab", newpath)) {
3482 ERROR("error saving new lxctab");
3483 return -1;
3484 }
3485
3486 return 0;
3487 }
3488
3489 static void copy_rdepends(struct lxc_container *c, struct lxc_container *c0)
3490 {
3491 char path0[PATH_MAX], path1[PATH_MAX];
3492 int ret;
3493
3494 ret = strnprintf(path0, sizeof(path0), "%s/%s/lxc_rdepends", c0->config_path,
3495 c0->name);
3496 if (ret < 0) {
3497 WARN("Error copying reverse dependencies");
3498 return;
3499 }
3500
3501 ret = strnprintf(path1, sizeof(path1), "%s/%s/lxc_rdepends", c->config_path,
3502 c->name);
3503 if (ret < 0) {
3504 WARN("Error copying reverse dependencies");
3505 return;
3506 }
3507
3508 if (copy_file(path0, path1) < 0) {
3509 INFO("Error copying reverse dependencies");
3510 return;
3511 }
3512 }
3513
3514 static bool add_rdepends(struct lxc_container *c, struct lxc_container *c0)
3515 {
3516 __do_fclose FILE *f = NULL;
3517 int ret;
3518 char path[PATH_MAX];
3519
3520 ret = strnprintf(path, sizeof(path), "%s/%s/lxc_rdepends", c->config_path, c->name);
3521 if (ret < 0)
3522 return false;
3523
3524 f = fopen(path, "ae");
3525 if (!f)
3526 return false;
3527
3528 /* If anything goes wrong, just return an error. */
3529 return fprintf(f, "%s\n%s\n", c0->config_path, c0->name) > 0;
3530 }
3531
3532 /*
3533 * If the fs natively supports snapshot clones with no penalty,
3534 * then default to those even if not requested.
3535 * Currently we only do this for btrfs.
3536 */
3537 static bool should_default_to_snapshot(struct lxc_container *c0,
3538 struct lxc_container *c1)
3539 {
3540 __do_free char *p0 = NULL, *p1 = NULL;
3541 int ret;
3542 size_t l0 = strlen(c0->config_path) + strlen(c0->name) + 2;
3543 size_t l1 = strlen(c1->config_path) + strlen(c1->name) + 2;
3544 char *rootfs = c0->lxc_conf->rootfs.path;
3545
3546 p0 = must_realloc(NULL, l0 + 1);
3547 p1 = must_realloc(NULL, l1 + 1);
3548 ret = strnprintf(p0, l0, "%s/%s", c0->config_path, c0->name);
3549 if (ret < 0)
3550 return false;
3551
3552 ret = strnprintf(p1, l1, "%s/%s", c1->config_path, c1->name);
3553 if (ret < 0)
3554 return false;
3555
3556 if (!is_btrfs_fs(p0) || !is_btrfs_fs(p1))
3557 return false;
3558
3559 if (is_btrfs_subvol(rootfs) <= 0)
3560 return false;
3561
3562 return btrfs_same_fs(p0, p1) == 0;
3563 }
3564
3565 static int copy_storage(struct lxc_container *c0, struct lxc_container *c,
3566 const char *newtype, int flags, const char *bdevdata,
3567 uint64_t newsize)
3568 {
3569 struct lxc_storage *bdev;
3570 bool need_rdep;
3571
3572 if (should_default_to_snapshot(c0, c))
3573 flags |= LXC_CLONE_SNAPSHOT;
3574
3575 bdev = storage_copy(c0, c->name, c->config_path, newtype, flags,
3576 bdevdata, newsize, &need_rdep);
3577 if (!bdev) {
3578 ERROR("Error copying storage.");
3579 return -1;
3580 }
3581
3582 /* Set new rootfs. */
3583 free(c->lxc_conf->rootfs.path);
3584 c->lxc_conf->rootfs.path = strdup(bdev->src);
3585 storage_put(bdev);
3586
3587 if (!c->lxc_conf->rootfs.path) {
3588 ERROR("Out of memory while setting storage path.");
3589 return -1;
3590 }
3591
3592 /* Append a new lxc.rootfs.path entry to the unexpanded config. */
3593 clear_unexp_config_line(c->lxc_conf, "lxc.rootfs.path", false);
3594 if (!do_append_unexp_config_line(c->lxc_conf, "lxc.rootfs.path",
3595 c->lxc_conf->rootfs.path)) {
3596 ERROR("Error saving new rootfs to cloned config.");
3597 return -1;
3598 }
3599
3600 if (flags & LXC_CLONE_SNAPSHOT)
3601 copy_rdepends(c, c0);
3602
3603 if (need_rdep) {
3604 if (!add_rdepends(c, c0))
3605 WARN("Error adding reverse dependency from %s to %s",
3606 c->name, c0->name);
3607 }
3608
3609 mod_all_rdeps(c, true);
3610
3611 return 0;
3612 }
3613
3614 struct clone_update_data {
3615 struct lxc_container *c0;
3616 struct lxc_container *c1;
3617 int flags;
3618 char **hookargs;
3619 };
3620
3621 static int clone_update_rootfs(struct clone_update_data *data)
3622 {
3623 struct lxc_container *c0 = data->c0;
3624 struct lxc_container *c = data->c1;
3625 int flags = data->flags;
3626 char **hookargs = data->hookargs;
3627 int ret = -1;
3628 char path[PATH_MAX];
3629 struct lxc_storage *bdev;
3630 FILE *fout;
3631 struct lxc_conf *conf = c->lxc_conf;
3632
3633 /* update hostname in rootfs */
3634 /* we're going to mount, so run in a clean namespace to simplify cleanup */
3635
3636 (void)lxc_drop_groups();
3637
3638 if (setgid(0) < 0) {
3639 ERROR("Failed to setgid to 0");
3640 return -1;
3641 }
3642
3643 if (setuid(0) < 0) {
3644 ERROR("Failed to setuid to 0");
3645 return -1;
3646 }
3647
3648 if (unshare(CLONE_NEWNS) < 0)
3649 return -1;
3650
3651 ret = lxc_storage_prepare(conf);
3652 if (ret)
3653 return -1;
3654 bdev = conf->rootfs.storage;
3655
3656 if (!strequal(bdev->type, "dir")) {
3657 if (unshare(CLONE_NEWNS) < 0) {
3658 ERROR("error unsharing mounts");
3659 lxc_storage_put(conf);
3660 return -1;
3661 }
3662
3663 if (detect_shared_rootfs() && mount(NULL, "/", NULL, MS_SLAVE | MS_REC, NULL))
3664 SYSERROR("Failed to recursively turn root mount tree into dependent mount. Continuing...");
3665
3666 if (bdev->ops->mount(bdev) < 0) {
3667 lxc_storage_put(conf);
3668 return -1;
3669 }
3670 } else { /* TODO come up with a better way */
3671 free(bdev->dest);
3672 bdev->dest = strdup(lxc_storage_get_path(bdev->src, bdev->type));
3673 }
3674
3675 if (!list_empty(&conf->hooks[LXCHOOK_CLONE])) {
3676 /* Start of environment variable setup for hooks */
3677 if (c0->name && setenv("LXC_SRC_NAME", c0->name, 1))
3678 SYSERROR("failed to set environment variable for source container name");
3679
3680 if (setenv("LXC_NAME", c->name, 1))
3681 SYSERROR("failed to set environment variable for container name");
3682
3683 if (conf->rcfile && setenv("LXC_CONFIG_FILE", conf->rcfile, 1))
3684 SYSERROR("failed to set environment variable for config path");
3685
3686 if (bdev->dest && setenv("LXC_ROOTFS_MOUNT", bdev->dest, 1))
3687 SYSERROR("failed to set environment variable for rootfs mount");
3688
3689 if (conf->rootfs.path && setenv("LXC_ROOTFS_PATH", conf->rootfs.path, 1))
3690 SYSERROR("failed to set environment variable for rootfs mount");
3691
3692 if (run_lxc_hooks(c->name, "clone", conf, hookargs)) {
3693 ERROR("Error executing clone hook for %s", c->name);
3694 lxc_storage_put(conf);
3695 return -1;
3696 }
3697 }
3698
3699 if (!(flags & LXC_CLONE_KEEPNAME)) {
3700 ret = strnprintf(path, sizeof(path), "%s/etc/hostname", bdev->dest);
3701 lxc_storage_put(conf);
3702
3703 if (ret < 0)
3704 return -1;
3705
3706 if (!file_exists(path))
3707 return 0;
3708
3709 if (!(fout = fopen(path, "we"))) {
3710 SYSERROR("unable to open %s: ignoring", path);
3711 return 0;
3712 }
3713
3714 if (fprintf(fout, "%s", c->name) < 0) {
3715 fclose(fout);
3716 return -1;
3717 }
3718
3719 if (fclose(fout) < 0)
3720 return -1;
3721 } else {
3722 lxc_storage_put(conf);
3723 }
3724
3725 return 0;
3726 }
3727
3728 static int clone_update_rootfs_wrapper(void *data)
3729 {
3730 struct clone_update_data *arg = (struct clone_update_data *) data;
3731 return clone_update_rootfs(arg);
3732 }
3733
3734 /*
3735 * We want to support:
3736 sudo lxc-clone -o o1 -n n1 -s -L|-fssize fssize -v|--vgname vgname \
3737 -p|--lvprefix lvprefix -t|--fstype fstype -B backingstore
3738
3739 -s [ implies overlay]
3740 -s -B overlay
3741
3742 only rootfs gets converted (copied/snapshotted) on clone.
3743 */
3744
3745 static int create_file_dirname(char *path, struct lxc_conf *conf)
3746 {
3747 char *p = strrchr(path, '/');
3748 int ret = -1;
3749
3750 if (!p)
3751 return -1;
3752
3753 *p = '\0';
3754 ret = do_create_container_dir(path, conf);
3755 *p = '/';
3756
3757 return ret;
3758 }
3759
3760 static struct lxc_container *do_lxcapi_clone(struct lxc_container *c, const char *newname,
3761 const char *lxcpath, int flags,
3762 const char *bdevtype, const char *bdevdata, uint64_t newsize,
3763 char **hookargs)
3764 {
3765 char newpath[PATH_MAX];
3766 int fd, ret;
3767 struct clone_update_data data;
3768 size_t saved_unexp_len;
3769 pid_t pid;
3770 int storage_copied = 0;
3771 char *origroot = NULL, *saved_unexp_conf = NULL;
3772 struct lxc_container *c2 = NULL;
3773
3774 if (!c || !do_lxcapi_is_defined(c))
3775 return NULL;
3776
3777 if (container_mem_lock(c))
3778 return NULL;
3779 if (!is_stopped(c) && !(flags & LXC_CLONE_ALLOW_RUNNING)) {
3780 ERROR("error: Original container (%s) is running. Use --allowrunning if you want to force a snapshot of the running container.", c->name);
3781 goto out;
3782 }
3783
3784 /* Make sure the container doesn't yet exist. */
3785 if (!newname)
3786 newname = c->name;
3787
3788 if (!lxcpath)
3789 lxcpath = do_lxcapi_get_config_path(c);
3790
3791 ret = strnprintf(newpath, sizeof(newpath), "%s/%s/%s", lxcpath, newname, LXC_CONFIG_FNAME);
3792 if (ret < 0) {
3793 SYSERROR("clone: failed making config pathname");
3794 goto out;
3795 }
3796
3797 if (file_exists(newpath)) {
3798 ERROR("error: clone: %s exists", newpath);
3799 goto out;
3800 }
3801
3802 ret = create_file_dirname(newpath, c->lxc_conf);
3803 if (ret < 0 && errno != EEXIST) {
3804 ERROR("Error creating container dir for %s", newpath);
3805 goto out;
3806 }
3807
3808 /* Copy the configuration. Tweak it as needed. */
3809 if (c->lxc_conf->rootfs.path) {
3810 origroot = c->lxc_conf->rootfs.path;
3811 c->lxc_conf->rootfs.path = NULL;
3812 }
3813
3814 fd = open(newpath, O_WRONLY | O_CREAT | O_CLOEXEC,
3815 S_IRUSR | S_IWUSR | S_IRGRP | S_IWGRP);
3816 if (fd < 0) {
3817 SYSERROR("Failed to open \"%s\"", newpath);
3818 goto out;
3819 }
3820
3821 saved_unexp_conf = c->lxc_conf->unexpanded_config;
3822 saved_unexp_len = c->lxc_conf->unexpanded_len;
3823 c->lxc_conf->unexpanded_config = strdup(saved_unexp_conf);
3824 if (!c->lxc_conf->unexpanded_config) {
3825 close(fd);
3826 goto out;
3827 }
3828
3829 clear_unexp_config_line(c->lxc_conf, "lxc.rootfs.path", false);
3830 write_config(fd, c->lxc_conf);
3831 close(fd);
3832
3833 c->lxc_conf->rootfs.path = origroot;
3834
3835 free(c->lxc_conf->unexpanded_config);
3836 c->lxc_conf->unexpanded_config = saved_unexp_conf;
3837 saved_unexp_conf = NULL;
3838 c->lxc_conf->unexpanded_len = saved_unexp_len;
3839
3840 ret = strnprintf(newpath, sizeof(newpath), "%s/%s/%s", lxcpath, newname, LXC_ROOTFS_DNAME);
3841 if (ret < 0) {
3842 SYSERROR("clone: failed making rootfs pathname");
3843 goto out;
3844 }
3845
3846 ret = mkdir(newpath, 0755);
3847 if (ret < 0) {
3848 /* For an overlay container the rootfs is considered immutable
3849 * and will not have been removed when restoring from a
3850 * snapshot.
3851 */
3852 if (errno != ENOENT &&
3853 !(flags & LXC_STORAGE_INTERNAL_OVERLAY_RESTORE)) {
3854 SYSERROR("Failed to create directory \"%s\"", newpath);
3855 goto out;
3856 }
3857 }
3858
3859 if (am_guest_unpriv()) {
3860 if (chown_mapped_root(newpath, c->lxc_conf) < 0) {
3861 ERROR("Error chowning %s to container root", newpath);
3862 goto out;
3863 }
3864 }
3865
3866 c2 = lxc_container_new(newname, lxcpath);
3867 if (!c2) {
3868 ERROR("clone: failed to create new container (%s %s)", newname,
3869 lxcpath);
3870 goto out;
3871 }
3872
3873 /* copy/snapshot rootfs's */
3874 ret = copy_storage(c, c2, bdevtype, flags, bdevdata, newsize);
3875 if (ret < 0)
3876 goto out;
3877
3878 /* update utsname */
3879 if (!(flags & LXC_CLONE_KEEPNAME)) {
3880 clear_unexp_config_line(c2->lxc_conf, "lxc.utsname", false);
3881 clear_unexp_config_line(c2->lxc_conf, "lxc.uts.name", false);
3882
3883 if (!do_set_config_item_locked(c2, "lxc.uts.name", newname)) {
3884 ERROR("Error setting new hostname");
3885 goto out;
3886 }
3887 }
3888
3889 /* copy hooks */
3890 ret = copyhooks(c, c2);
3891 if (ret < 0) {
3892 ERROR("error copying hooks");
3893 goto out;
3894 }
3895
3896 if (copy_fstab(c, c2) < 0) {
3897 ERROR("error copying fstab");
3898 goto out;
3899 }
3900
3901 /* update macaddrs */
3902 if (!(flags & LXC_CLONE_KEEPMACADDR)) {
3903 if (!network_new_hwaddrs(c2->lxc_conf)) {
3904 ERROR("Error updating mac addresses");
3905 goto out;
3906 }
3907 }
3908
3909 /* Update absolute paths for overlay mount directories. */
3910 if (ovl_update_abs_paths(c2->lxc_conf, c->config_path, c->name, lxcpath, newname) < 0)
3911 goto out;
3912
3913 /* We've now successfully created c2's storage, so clear it out if we
3914 * fail after this.
3915 */
3916 storage_copied = 1;
3917
3918 if (!c2->save_config(c2, NULL))
3919 goto out;
3920
3921 if ((pid = fork()) < 0) {
3922 SYSERROR("fork");
3923 goto out;
3924 }
3925
3926 if (pid > 0) {
3927 ret = wait_for_pid(pid);
3928 if (ret)
3929 goto out;
3930
3931 container_mem_unlock(c);
3932 return c2;
3933 }
3934
3935 data.c0 = c;
3936 data.c1 = c2;
3937 data.flags = flags;
3938 data.hookargs = hookargs;
3939
3940 if (am_guest_unpriv())
3941 ret = userns_exec_full(c->lxc_conf, clone_update_rootfs_wrapper,
3942 &data, "clone_update_rootfs_wrapper");
3943 else
3944 ret = clone_update_rootfs(&data);
3945 if (ret < 0)
3946 _exit(EXIT_FAILURE);
3947
3948 container_mem_unlock(c);
3949 _exit(EXIT_SUCCESS);
3950
3951 out:
3952 container_mem_unlock(c);
3953 if (c2) {
3954 if (!storage_copied)
3955 c2->lxc_conf->rootfs.path = NULL;
3956
3957 c2->destroy(c2);
3958 lxc_container_put(c2);
3959 }
3960
3961 return NULL;
3962 }
3963
3964 static struct lxc_container *lxcapi_clone(struct lxc_container *c, const char *newname,
3965 const char *lxcpath, int flags,
3966 const char *bdevtype, const char *bdevdata, uint64_t newsize,
3967 char **hookargs)
3968 {
3969 struct lxc_container * ret;
3970
3971 current_config = c ? c->lxc_conf : NULL;
3972 ret = do_lxcapi_clone(c, newname, lxcpath, flags, bdevtype, bdevdata, newsize, hookargs);
3973 current_config = NULL;
3974
3975 return ret;
3976 }
3977
3978 static bool do_lxcapi_rename(struct lxc_container *c, const char *newname)
3979 {
3980 struct lxc_storage *bdev;
3981 struct lxc_container *newc;
3982
3983 if (!c || !c->name || !c->config_path || !c->lxc_conf)
3984 return false;
3985
3986 if (has_fs_snapshots(c) || has_snapshots(c)) {
3987 ERROR("Renaming a container with snapshots is not supported");
3988 return false;
3989 }
3990
3991 if (lxc_storage_prepare(c->lxc_conf)) {
3992 ERROR("Failed to find original backing store type");
3993 return false;
3994 }
3995 bdev = c->lxc_conf->rootfs.storage;
3996
3997 newc = lxcapi_clone(c, newname, c->config_path, LXC_CLONE_KEEPMACADDR, NULL, bdev->type, 0, NULL);
3998 lxc_storage_put(c->lxc_conf);
3999 if (!newc) {
4000 lxc_container_put(newc);
4001 return false;
4002 }
4003
4004 if (newc && lxcapi_is_defined(newc))
4005 lxc_container_put(newc);
4006
4007 if (!container_destroy(c, NULL)) {
4008 ERROR("Could not destroy existing container %s", c->name);
4009 return false;
4010 }
4011
4012 return true;
4013 }
4014
4015 WRAP_API_1(bool, lxcapi_rename, const char *)
4016
4017 static int lxcapi_attach(struct lxc_container *c,
4018 lxc_attach_exec_t exec_function, void *exec_payload,
4019 lxc_attach_options_t *options, pid_t *attached_process)
4020 {
4021 int ret;
4022
4023 if (!c)
4024 return -1;
4025
4026 current_config = c->lxc_conf;
4027
4028 ret = lxc_attach(c, exec_function, exec_payload, options,
4029 attached_process);
4030 current_config = NULL;
4031 return ret;
4032 }
4033
4034 static int do_lxcapi_attach_run_wait(struct lxc_container *c,
4035 lxc_attach_options_t *options,
4036 const char *program,
4037 const char *const argv[])
4038 {
4039 lxc_attach_command_t command;
4040 pid_t pid;
4041 int ret;
4042
4043 if (!c)
4044 return -1;
4045
4046 command.program = (char *)program;
4047 command.argv = (char **)argv;
4048
4049 ret = lxc_attach(c, lxc_attach_run_command, &command, options, &pid);
4050 if (ret < 0)
4051 return ret;
4052
4053 return lxc_wait_for_pid_status(pid);
4054 }
4055
4056 static int lxcapi_attach_run_wait(struct lxc_container *c,
4057 lxc_attach_options_t *options,
4058 const char *program, const char *const argv[])
4059 {
4060 int ret;
4061
4062 current_config = c ? c->lxc_conf : NULL;
4063 ret = do_lxcapi_attach_run_wait(c, options, program, argv);
4064 current_config = NULL;
4065
4066 return ret;
4067 }
4068
4069 static int get_next_index(const char *lxcpath, char *cname)
4070 {
4071 __do_free char *fname = NULL;
4072 struct stat sb;
4073 int i = 0, ret;
4074
4075 fname = must_realloc(NULL, strlen(lxcpath) + 20);
4076
4077 for (;;) {
4078 sprintf(fname, "%s/snap%d", lxcpath, i);
4079
4080 ret = stat(fname, &sb);
4081 if (ret != 0)
4082 return i;
4083
4084 i++;
4085 }
4086 }
4087
4088 static bool get_snappath_dir(struct lxc_container *c, char *snappath)
4089 {
4090 int ret;
4091
4092 /*
4093 * If the old style snapshot path exists, use it
4094 * /var/lib/lxc -> /var/lib/lxcsnaps
4095 */
4096 ret = strnprintf(snappath, PATH_MAX, "%ssnaps", c->config_path);
4097 if (ret < 0)
4098 return false;
4099
4100 if (dir_exists(snappath)) {
4101 ret = strnprintf(snappath, PATH_MAX, "%ssnaps/%s", c->config_path, c->name);
4102 if (ret < 0)
4103 return false;
4104
4105 return true;
4106 }
4107
4108 /*
4109 * Use the new style path
4110 * /var/lib/lxc -> /var/lib/lxc + c->name + /snaps + \0
4111 */
4112 ret = strnprintf(snappath, PATH_MAX, "%s/%s/snaps", c->config_path, c->name);
4113 if (ret < 0)
4114 return false;
4115
4116 return true;
4117 }
4118
4119 static int do_lxcapi_snapshot(struct lxc_container *c, const char *commentfile)
4120 {
4121 __do_free char *dfnam = NULL;
4122 int len;
4123 int i, flags, ret;
4124 time_t timer;
4125 struct tm tm_info;
4126 struct lxc_container *c2;
4127 char snappath[PATH_MAX], newname[20];
4128 char buffer[25];
4129 FILE *f;
4130
4131 if (!c || !lxcapi_is_defined(c))
4132 return -1;
4133
4134 if (!storage_can_backup(c->lxc_conf)) {
4135 ERROR("%s's backing store cannot be backed up", c->name);
4136 ERROR("Your container must use another backing store type");
4137 return -1;
4138 }
4139
4140 if (!get_snappath_dir(c, snappath))
4141 return -1;
4142
4143 i = get_next_index(snappath, c->name);
4144
4145 if (mkdir_p(snappath, 0755) < 0) {
4146 ERROR("Failed to create snapshot directory %s", snappath);
4147 return -1;
4148 }
4149
4150 ret = strnprintf(newname, 20, "snap%d", i);
4151 if (ret < 0)
4152 return -1;
4153
4154 /*
4155 * We pass LXC_CLONE_SNAPSHOT to make sure that a rdepends file entry is
4156 * created in the original container
4157 */
4158 flags = LXC_CLONE_SNAPSHOT | LXC_CLONE_KEEPMACADDR | LXC_CLONE_KEEPNAME |
4159 LXC_CLONE_KEEPBDEVTYPE | LXC_CLONE_MAYBE_SNAPSHOT;
4160 if (storage_is_dir(c->lxc_conf)) {
4161 ERROR("Snapshot of directory-backed container requested");
4162 ERROR("Making a copy-clone. If you do want snapshots, then");
4163 ERROR("please create overlay clone first, snapshot that");
4164 ERROR("and keep the original container pristine");
4165 flags &= ~LXC_CLONE_SNAPSHOT | LXC_CLONE_MAYBE_SNAPSHOT;
4166 }
4167
4168 c2 = do_lxcapi_clone(c, newname, snappath, flags, NULL, NULL, 0, NULL);
4169 if (!c2) {
4170 ERROR("Failed to clone of %s:%s", c->config_path, c->name);
4171 return -1;
4172 }
4173
4174 lxc_container_put(c2);
4175
4176 /* Now write down the creation time. */
4177 time(&timer);
4178
4179 if (!localtime_r(&timer, &tm_info)) {
4180 ERROR("Failed to get localtime");
4181 return -1;
4182 }
4183
4184 strftime(buffer, 25, "%Y:%m:%d %H:%M:%S", &tm_info);
4185
4186 len = strlen(snappath) + 1 + strlen(newname) + 1 + strlen(LXC_TIMESTAMP_FNAME) + 1;
4187 dfnam = must_realloc(NULL, len);
4188 ret = strnprintf(dfnam, len, "%s/%s/%s", snappath, newname, LXC_TIMESTAMP_FNAME);
4189 if (ret < 0)
4190 return -1;
4191 f = fopen(dfnam, "we");
4192 if (!f) {
4193 ERROR("Failed to open %s", dfnam);
4194 return -1;
4195 }
4196
4197 if (fprintf(f, "%s", buffer) < 0) {
4198 SYSERROR("Writing timestamp");
4199 fclose(f);
4200 return -1;
4201 }
4202
4203 ret = fclose(f);
4204 if (ret != 0) {
4205 SYSERROR("Writing timestamp");
4206 return -1;
4207 }
4208
4209 if (commentfile) {
4210 __do_free char *path = NULL;
4211 /* $p / $name / comment \0 */
4212 len = strlen(snappath) + 1 + strlen(newname) + 1 + strlen(LXC_COMMENT_FNAME) + 1;
4213
4214 path = must_realloc(NULL, len);
4215 ret = strnprintf(path, len, "%s/%s/%s", snappath, newname, LXC_COMMENT_FNAME);
4216 if (ret < 0)
4217 return -1;
4218 return copy_file(commentfile, path) < 0 ? -1 : i;
4219 }
4220
4221 return i;
4222 }
4223
4224 WRAP_API_1(int, lxcapi_snapshot, const char *)
4225
4226 static void lxcsnap_free(struct lxc_snapshot *s)
4227 {
4228 free(s->name);
4229 free(s->comment_pathname);
4230 free(s->timestamp);
4231 free(s->lxcpath);
4232 }
4233
4234 static char *get_snapcomment_path(char *snappath, char *name)
4235 {
4236 __do_free char *s = NULL;
4237 /* $snappath/$name/comment */
4238 int ret, len = strlen(snappath) + strlen(name) + 10;
4239
4240 s = malloc(len);
4241 if (!s)
4242 return NULL;
4243
4244 ret = strnprintf(s, len, "%s/%s/comment", snappath, name);
4245 if (ret < 0)
4246 return NULL;
4247
4248 return move_ptr(s);
4249 }
4250
4251 static char *get_timestamp(char* snappath, char *name)
4252 {
4253 __do_free char *s = NULL;
4254 __do_fclose FILE *fin = NULL;
4255 char path[PATH_MAX];
4256 int ret, len;
4257
4258 ret = strnprintf(path, sizeof(path), "%s/%s/ts", snappath, name);
4259 if (ret < 0)
4260 return NULL;
4261
4262 fin = fopen(path, "re");
4263 if (!fin)
4264 return NULL;
4265
4266 (void) fseek(fin, 0, SEEK_END);
4267 len = ftell(fin);
4268 (void) fseek(fin, 0, SEEK_SET);
4269 if (len > 0) {
4270 s = malloc(len+1);
4271 if (s) {
4272 ssize_t nbytes;
4273
4274 s[len] = '\0';
4275 nbytes = fread(s, 1, len, fin);
4276 if (nbytes < 0 || nbytes != (ssize_t)len)
4277 return log_error_errno(NULL, errno, "reading timestamp");
4278 }
4279 }
4280
4281 return move_ptr(s);
4282 }
4283
4284 static int do_lxcapi_snapshot_list(struct lxc_container *c, struct lxc_snapshot **ret_snaps)
4285 {
4286 __do_closedir DIR *dir = NULL;
4287 char snappath[PATH_MAX], path2[PATH_MAX];
4288 int count = 0, ret;
4289 struct dirent *direntp;
4290 struct lxc_snapshot *snaps =NULL, *nsnaps;
4291
4292 if (!c || !lxcapi_is_defined(c))
4293 return -1;
4294
4295 if (!get_snappath_dir(c, snappath)) {
4296 ERROR("path name too long");
4297 return -1;
4298 }
4299
4300 dir = opendir(snappath);
4301 if (!dir) {
4302 INFO("Failed to open %s - assuming no snapshots", snappath);
4303 return 0;
4304 }
4305
4306 while ((direntp = readdir(dir))) {
4307 if (strequal(direntp->d_name, "."))
4308 continue;
4309
4310 if (strequal(direntp->d_name, ".."))
4311 continue;
4312
4313 ret = strnprintf(path2, sizeof(path2), "%s/%s/%s", snappath, direntp->d_name, LXC_CONFIG_FNAME);
4314 if (ret < 0) {
4315 ERROR("pathname too long");
4316 goto out_free;
4317 }
4318
4319 if (!file_exists(path2))
4320 continue;
4321
4322 nsnaps = realloc(snaps, (count + 1)*sizeof(*snaps));
4323 if (!nsnaps) {
4324 SYSERROR("Out of memory");
4325 goto out_free;
4326 }
4327
4328 snaps = nsnaps;
4329 snaps[count].free = lxcsnap_free;
4330 snaps[count].name = strdup(direntp->d_name);
4331 if (!snaps[count].name)
4332 goto out_free;
4333
4334 snaps[count].lxcpath = strdup(snappath);
4335 if (!snaps[count].lxcpath) {
4336 free(snaps[count].name);
4337 goto out_free;
4338 }
4339
4340 snaps[count].comment_pathname = get_snapcomment_path(snappath, direntp->d_name);
4341 snaps[count].timestamp = get_timestamp(snappath, direntp->d_name);
4342 count++;
4343 }
4344
4345 *ret_snaps = snaps;
4346 return count;
4347
4348 out_free:
4349 if (snaps) {
4350 for (int i = 0; i < count; i++)
4351 lxcsnap_free(&snaps[i]);
4352
4353 free(snaps);
4354 }
4355
4356 return -1;
4357 }
4358
4359 WRAP_API_1(int, lxcapi_snapshot_list, struct lxc_snapshot **)
4360
4361 static bool do_lxcapi_snapshot_restore(struct lxc_container *c, const char *snapname, const char *newname)
4362 {
4363 char clonelxcpath[PATH_MAX];
4364 int flags = 0;
4365 struct lxc_container *snap, *rest;
4366 struct lxc_storage *bdev;
4367 bool b = false;
4368
4369 if (!c || !c->name || !c->config_path)
4370 return false;
4371
4372 if (has_fs_snapshots(c)) {
4373 ERROR("container rootfs has dependent snapshots");
4374 return false;
4375 }
4376
4377 if (lxc_storage_prepare(c->lxc_conf)) {
4378 ERROR("Failed to find original backing store type");
4379 return false;
4380 }
4381 bdev = c->lxc_conf->rootfs.storage;
4382
4383 /* For an overlay container the rootfs is considered immutable
4384 * and cannot be removed when restoring from a snapshot. We pass this
4385 * internal flag along to communicate this to various parts of the
4386 * codebase.
4387 */
4388 if (strequal(bdev->type, "overlay") || strequal(bdev->type, "overlayfs"))
4389 bdev->flags |= LXC_STORAGE_INTERNAL_OVERLAY_RESTORE;
4390
4391 if (!newname)
4392 newname = c->name;
4393
4394 if (!get_snappath_dir(c, clonelxcpath)) {
4395 lxc_storage_put(c->lxc_conf);
4396 return false;
4397 }
4398 /* how should we lock this? */
4399
4400 snap = lxc_container_new(snapname, clonelxcpath);
4401 if (!snap || !lxcapi_is_defined(snap)) {
4402 ERROR("Could not open snapshot %s", snapname);
4403
4404 if (snap)
4405 lxc_container_put(snap);
4406
4407 lxc_storage_put(c->lxc_conf);
4408 return false;
4409 }
4410
4411 if (strequal(c->name, newname)) {
4412 if (!container_destroy(c, bdev)) {
4413 ERROR("Could not destroy existing container %s", newname);
4414 lxc_container_put(snap);
4415 lxc_storage_put(c->lxc_conf);
4416 return false;
4417 }
4418 }
4419
4420 if (!strequal(bdev->type, "dir") && !strequal(bdev->type, "loop"))
4421 flags = LXC_CLONE_SNAPSHOT | LXC_CLONE_MAYBE_SNAPSHOT;
4422
4423 if (strequal(bdev->type, "overlay") || strequal(bdev->type, "overlayfs"))
4424 flags |= LXC_STORAGE_INTERNAL_OVERLAY_RESTORE;
4425
4426 rest = lxcapi_clone(snap, newname, c->config_path, flags, bdev->type,
4427 NULL, 0, NULL);
4428 lxc_storage_put(c->lxc_conf);
4429 if (rest && lxcapi_is_defined(rest))
4430 b = true;
4431
4432 if (rest)
4433 lxc_container_put(rest);
4434
4435 lxc_container_put(snap);
4436 return b;
4437 }
4438
4439 WRAP_API_2(bool, lxcapi_snapshot_restore, const char *, const char *)
4440
4441 static bool do_snapshot_destroy(const char *snapname, const char *clonelxcpath)
4442 {
4443 struct lxc_container *snap = NULL;
4444 bool bret = false;
4445
4446 snap = lxc_container_new(snapname, clonelxcpath);
4447 if (!snap) {
4448 ERROR("Could not find snapshot %s", snapname);
4449 goto err;
4450 }
4451
4452 if (!do_lxcapi_destroy(snap)) {
4453 ERROR("Could not destroy snapshot %s", snapname);
4454 goto err;
4455 }
4456
4457 bret = true;
4458
4459 err:
4460 if (snap)
4461 lxc_container_put(snap);
4462
4463 return bret;
4464 }
4465
4466 static bool remove_all_snapshots(const char *path)
4467 {
4468 __do_closedir DIR *dir = NULL;
4469 struct dirent *direntp;
4470 bool bret = true;
4471
4472 dir = opendir(path);
4473 if (!dir) {
4474 SYSERROR("opendir on snapshot path %s", path);
4475 return false;
4476 }
4477
4478 while ((direntp = readdir(dir))) {
4479 if (strequal(direntp->d_name, "."))
4480 continue;
4481
4482 if (strequal(direntp->d_name, ".."))
4483 continue;
4484
4485 if (!do_snapshot_destroy(direntp->d_name, path)) {
4486 bret = false;
4487 continue;
4488 }
4489 }
4490
4491 if (rmdir(path))
4492 SYSERROR("Error removing directory %s", path);
4493
4494 return bret;
4495 }
4496
4497 static bool do_lxcapi_snapshot_destroy(struct lxc_container *c, const char *snapname)
4498 {
4499 char clonelxcpath[PATH_MAX];
4500
4501 if (!c || !c->name || !c->config_path || !snapname)
4502 return false;
4503
4504 if (!get_snappath_dir(c, clonelxcpath))
4505 return false;
4506
4507 return do_snapshot_destroy(snapname, clonelxcpath);
4508 }
4509
4510 WRAP_API_1(bool, lxcapi_snapshot_destroy, const char *)
4511
4512 static bool do_lxcapi_snapshot_destroy_all(struct lxc_container *c)
4513 {
4514 char clonelxcpath[PATH_MAX];
4515
4516 if (!c || !c->name || !c->config_path)
4517 return false;
4518
4519 if (!get_snappath_dir(c, clonelxcpath))
4520 return false;
4521
4522 return remove_all_snapshots(clonelxcpath);
4523 }
4524
4525 WRAP_API(bool, lxcapi_snapshot_destroy_all)
4526
4527 static bool do_lxcapi_may_control(struct lxc_container *c)
4528 {
4529 if (!c)
4530 return false;
4531
4532 return lxc_try_cmd(c->name, c->config_path) == 0;
4533 }
4534
4535 WRAP_API(bool, lxcapi_may_control)
4536
4537 static bool do_add_remove_node(pid_t init_pid, const char *path, bool add,
4538 struct stat *st)
4539 {
4540 int ret;
4541 char *tmp;
4542 pid_t pid;
4543 char chrootpath[PATH_MAX];
4544 char *directory_path = NULL;
4545
4546 pid = fork();
4547 if (pid < 0) {
4548 SYSERROR("Failed to fork()");
4549 return false;
4550 }
4551
4552 if (pid) {
4553 ret = wait_for_pid(pid);
4554 if (ret != 0) {
4555 ERROR("Failed to create device node");
4556 return false;
4557 }
4558
4559 return true;
4560 }
4561
4562 /* prepare the path */
4563 ret = strnprintf(chrootpath, sizeof(chrootpath), "/proc/%d/root", init_pid);
4564 if (ret < 0)
4565 return false;
4566
4567 ret = chroot(chrootpath);
4568 if (ret < 0)
4569 _exit(EXIT_FAILURE);
4570
4571 ret = chdir("/");
4572 if (ret < 0)
4573 _exit(EXIT_FAILURE);
4574
4575 /* remove path if it exists */
4576 ret = faccessat(AT_FDCWD, path, F_OK, AT_SYMLINK_NOFOLLOW);
4577 if(ret == 0) {
4578 ret = unlink(path);
4579 if (ret < 0) {
4580 SYSERROR("Failed to remove \"%s\"", path);
4581 _exit(EXIT_FAILURE);
4582 }
4583 }
4584
4585 if (!add)
4586 _exit(EXIT_SUCCESS);
4587
4588 /* create any missing directories */
4589 tmp = strdup(path);
4590 if (!tmp)
4591 _exit(EXIT_FAILURE);
4592
4593 directory_path = dirname(tmp);
4594 ret = mkdir_p(directory_path, 0755);
4595 if (ret < 0 && errno != EEXIST) {
4596 SYSERROR("Failed to create path \"%s\"", directory_path);
4597 free(tmp);
4598 _exit(EXIT_FAILURE);
4599 }
4600
4601 /* create the device node */
4602 ret = mknod(path, st->st_mode, st->st_rdev);
4603 free(tmp);
4604 if (ret < 0) {
4605 SYSERROR("Failed to create device node at \"%s\"", path);
4606 _exit(EXIT_FAILURE);
4607 }
4608
4609 _exit(EXIT_SUCCESS);
4610 }
4611
4612 static bool add_remove_device_node(struct lxc_container *c, const char *src_path, const char *dest_path, bool add)
4613 {
4614 int ret;
4615 struct stat st;
4616 char value[LXC_MAX_BUFFER];
4617 const char *p;
4618 pid_t init_pid;
4619
4620 /* make sure container is running */
4621 if (!do_lxcapi_is_running(c)) {
4622 ERROR("container is not running");
4623 return false;
4624 }
4625
4626 /* use src_path if dest_path is NULL otherwise use dest_path */
4627 p = dest_path ? dest_path : src_path;
4628
4629 /* make sure we can access p */
4630 if(access(p, F_OK) < 0 || stat(p, &st) < 0)
4631 return false;
4632
4633 /* continue if path is character device or block device */
4634 if (S_ISCHR(st.st_mode))
4635 ret = strnprintf(value, sizeof(value), "c %d:%d rwm", major(st.st_rdev), minor(st.st_rdev));
4636 else if (S_ISBLK(st.st_mode))
4637 ret = strnprintf(value, sizeof(value), "b %d:%d rwm", major(st.st_rdev), minor(st.st_rdev));
4638 else
4639 return false;
4640 if (ret < 0)
4641 return false;
4642
4643 init_pid = do_lxcapi_init_pid(c);
4644 if (init_pid < 0) {
4645 ERROR("Failed to get init pid");
4646 return false;
4647 }
4648
4649 if (!do_add_remove_node(init_pid, p, add, &st))
4650 return false;
4651
4652 /* add or remove device to/from cgroup access list */
4653 if (add) {
4654 if (!do_lxcapi_set_cgroup_item(c, "devices.allow", value)) {
4655 ERROR("set_cgroup_item failed while adding the device node");
4656 return false;
4657 }
4658 } else {
4659 if (!do_lxcapi_set_cgroup_item(c, "devices.deny", value)) {
4660 ERROR("set_cgroup_item failed while removing the device node");
4661 return false;
4662 }
4663 }
4664
4665 return true;
4666 }
4667
4668 static bool do_lxcapi_add_device_node(struct lxc_container *c, const char *src_path, const char *dest_path)
4669 {
4670 // cannot mknod if we're not privileged wrt init_user_ns
4671 if (am_host_unpriv()) {
4672 ERROR(LXC_UNPRIV_EOPNOTSUPP, __FUNCTION__);
4673 return false;
4674 }
4675
4676 return add_remove_device_node(c, src_path, dest_path, true);
4677 }
4678
4679 WRAP_API_2(bool, lxcapi_add_device_node, const char *, const char *)
4680
4681 static bool do_lxcapi_remove_device_node(struct lxc_container *c, const char *src_path, const char *dest_path)
4682 {
4683 if (am_guest_unpriv()) {
4684 ERROR(LXC_UNPRIV_EOPNOTSUPP, __FUNCTION__);
4685 return false;
4686 }
4687
4688 return add_remove_device_node(c, src_path, dest_path, false);
4689 }
4690
4691 WRAP_API_2(bool, lxcapi_remove_device_node, const char *, const char *)
4692
4693 static bool do_lxcapi_attach_interface(struct lxc_container *c,
4694 const char *ifname,
4695 const char *dst_ifname)
4696 {
4697 pid_t init_pid;
4698 int ret = 0;
4699
4700 if (am_guest_unpriv()) {
4701 ERROR(LXC_UNPRIV_EOPNOTSUPP, __FUNCTION__);
4702 return false;
4703 }
4704
4705 if (!ifname) {
4706 ERROR("No source interface name given");
4707 return false;
4708 }
4709
4710 ret = lxc_netdev_isup(ifname);
4711 if (ret > 0) {
4712 /* netdev of ifname is up. */
4713 ret = lxc_netdev_down(ifname);
4714 if (ret)
4715 goto err;
4716 }
4717
4718 init_pid = do_lxcapi_init_pid(c);
4719 if (init_pid < 0) {
4720 ERROR("Failed to get init pid");
4721 goto err;
4722 }
4723
4724 ret = lxc_netdev_move_by_name(ifname, init_pid, dst_ifname);
4725 if (ret)
4726 goto err;
4727
4728 INFO("Moved network device \"%s\" to network namespace of %d", ifname, init_pid);
4729 return true;
4730
4731 err:
4732 return false;
4733 }
4734
4735 WRAP_API_2(bool, lxcapi_attach_interface, const char *, const char *)
4736
4737 static bool do_lxcapi_detach_interface(struct lxc_container *c,
4738 const char *ifname,
4739 const char *dst_ifname)
4740 {
4741 int ret;
4742 pid_t pid, pid_outside;
4743 __do_free char *physname = NULL;
4744
4745 /*
4746 * TODO - if this is a physical device, then we need am_host_unpriv.
4747 * But for other types guest privilege suffices.
4748 */
4749 if (am_guest_unpriv()) {
4750 ERROR(LXC_UNPRIV_EOPNOTSUPP, __FUNCTION__);
4751 return false;
4752 }
4753
4754 if (!ifname) {
4755 ERROR("No source interface name given");
4756 return false;
4757 }
4758
4759 pid_outside = lxc_raw_getpid();
4760 pid = fork();
4761 if (pid < 0) {
4762 ERROR("Failed to fork");
4763 return false;
4764 }
4765
4766 if (pid == 0) { /* child */
4767 pid_t init_pid;
4768
4769 init_pid = do_lxcapi_init_pid(c);
4770 if (init_pid < 0) {
4771 ERROR("Failed to get init pid");
4772 _exit(EXIT_FAILURE);
4773 }
4774 if (!switch_to_ns(init_pid, "net")) {
4775 ERROR("Failed to enter network namespace");
4776 _exit(EXIT_FAILURE);
4777 }
4778
4779 /* create new mount namespace for use with remounting /sys and is_wlan() below. */
4780 ret = unshare(CLONE_NEWNS);
4781 if (ret < 0) {
4782 ERROR("Failed to unshare mount namespace");
4783 _exit(EXIT_FAILURE);
4784 }
4785
4786 /* set / recursively as private so that mount propagation doesn't affect us. */
4787 if (mount(NULL, "/", NULL, MS_REC | MS_PRIVATE, 0) < 0) {
4788 ERROR("Failed to recursively set / as private in mount namespace");
4789 _exit(EXIT_FAILURE);
4790 }
4791
4792 ret = lxc_netdev_isup(ifname);
4793 if (ret < 0) {
4794 ERROR("Failed to determine whether network device \"%s\" is up", ifname);
4795 _exit(EXIT_FAILURE);
4796 }
4797
4798 /* netdev of ifname is up. */
4799 if (ret) {
4800 ret = lxc_netdev_down(ifname);
4801 if (ret) {
4802 ERROR("Failed to set network device \"%s\" down", ifname);
4803 _exit(EXIT_FAILURE);
4804 }
4805 }
4806
4807 /* remount /sys so is_wlan() can check if this device is a wlan device. */
4808 lxc_attach_remount_sys_proc();
4809 physname = is_wlan(ifname);
4810 if (physname)
4811 ret = lxc_netdev_move_wlan(physname, ifname, pid_outside, dst_ifname);
4812 else
4813 ret = lxc_netdev_move_by_name(ifname, pid_outside, dst_ifname);
4814
4815 /* -EINVAL means there is no netdev named as ifname. */
4816 if (ret < 0) {
4817 if (ret == -EINVAL)
4818 ERROR("Network device \"%s\" not found", ifname);
4819 else
4820 ERROR("Failed to remove network device \"%s\"", ifname);
4821
4822 _exit(EXIT_FAILURE);
4823 }
4824
4825 _exit(EXIT_SUCCESS);
4826 }
4827
4828 ret = wait_for_pid(pid);
4829 if (ret != 0)
4830 return false;
4831
4832 INFO("Moved network device \"%s\" to network namespace of %d", ifname, pid_outside);
4833 return true;
4834 }
4835
4836 WRAP_API_2(bool, lxcapi_detach_interface, const char *, const char *)
4837
4838 static int do_lxcapi_migrate(struct lxc_container *c, unsigned int cmd,
4839 struct migrate_opts *opts, unsigned int size)
4840 {
4841 int ret = -1;
4842 struct migrate_opts *valid_opts = opts;
4843 uint64_t features_to_check = 0;
4844
4845 /* If the caller has a bigger (newer) struct migrate_opts, let's make
4846 * sure that the stuff on the end is zero, i.e. that they didn't ask us
4847 * to do anything special.
4848 */
4849 if (size > sizeof(*opts)) {
4850 unsigned char *addr;
4851 unsigned char *end;
4852
4853 addr = (void *)opts + sizeof(*opts);
4854 end = (void *)opts + size;
4855
4856 for (; addr < end; addr++)
4857 if (*addr)
4858 return -E2BIG;
4859 }
4860
4861 /* If the caller has a smaller struct, let's zero out the end for them
4862 * so we don't accidentally use bits of it that they didn't know about
4863 * to initialize.
4864 */
4865 if (size < sizeof(*opts)) {
4866 valid_opts = malloc(sizeof(*opts));
4867 if (!valid_opts)
4868 return -ENOMEM;
4869
4870 memset(valid_opts, 0, sizeof(*opts));
4871 memcpy(valid_opts, opts, size);
4872 }
4873
4874 switch (cmd) {
4875 case MIGRATE_PRE_DUMP:
4876 if (!do_lxcapi_is_running(c)) {
4877 ERROR("container is not running");
4878 goto on_error;
4879 }
4880
4881 ret = !__criu_pre_dump(c, valid_opts);
4882 break;
4883 case MIGRATE_DUMP:
4884 if (!do_lxcapi_is_running(c)) {
4885 ERROR("container is not running");
4886 goto on_error;
4887 }
4888
4889 ret = !__criu_dump(c, valid_opts);
4890 break;
4891 case MIGRATE_RESTORE:
4892 if (do_lxcapi_is_running(c)) {
4893 ERROR("container is already running");
4894 goto on_error;
4895 }
4896
4897 ret = !__criu_restore(c, valid_opts);
4898 break;
4899 case MIGRATE_FEATURE_CHECK:
4900 features_to_check = valid_opts->features_to_check;
4901 ret = !__criu_check_feature(&features_to_check);
4902 if (ret) {
4903 /* Something went wrong. Let's let the caller
4904 * know which feature checks failed. */
4905 valid_opts->features_to_check = features_to_check;
4906 }
4907 break;
4908 default:
4909 ERROR("invalid migrate command %u", cmd);
4910 ret = -EINVAL;
4911 }
4912
4913 on_error:
4914 if (size < sizeof(*opts))
4915 free(valid_opts);
4916
4917 return ret;
4918 }
4919
4920 WRAP_API_3(int, lxcapi_migrate, unsigned int, struct migrate_opts *, unsigned int)
4921
4922 static bool do_lxcapi_checkpoint(struct lxc_container *c, char *directory, bool stop, bool verbose)
4923 {
4924 struct migrate_opts opts;
4925
4926 memset(&opts, 0, sizeof(opts));
4927
4928 opts.directory = directory;
4929 opts.stop = stop;
4930 opts.verbose = verbose;
4931
4932 return !do_lxcapi_migrate(c, MIGRATE_DUMP, &opts, sizeof(opts));
4933 }
4934
4935 WRAP_API_3(bool, lxcapi_checkpoint, char *, bool, bool)
4936
4937 static bool do_lxcapi_restore(struct lxc_container *c, char *directory, bool verbose)
4938 {
4939 struct migrate_opts opts;
4940
4941 memset(&opts, 0, sizeof(opts));
4942
4943 opts.directory = directory;
4944 opts.verbose = verbose;
4945
4946 return !do_lxcapi_migrate(c, MIGRATE_RESTORE, &opts, sizeof(opts));
4947 }
4948
4949 WRAP_API_2(bool, lxcapi_restore, char *, bool)
4950
4951 /* @st_mode is the st_mode field of the stat(source) return struct */
4952 static int create_mount_target(const char *dest, mode_t st_mode)
4953 {
4954 char *dirdup, *destdirname;
4955 int ret;
4956
4957 dirdup = strdup(dest);
4958 if (!dirdup) {
4959 SYSERROR("Failed to duplicate target name \"%s\"", dest);
4960 return -1;
4961 }
4962 destdirname = dirname(dirdup);
4963
4964 ret = mkdir_p(destdirname, 0755);
4965 if (ret < 0) {
4966 SYSERROR("Failed to create \"%s\"", destdirname);
4967 free(dirdup);
4968 return ret;
4969 }
4970 free(dirdup);
4971
4972 (void)remove(dest);
4973
4974 if (S_ISDIR(st_mode))
4975 ret = mkdir(dest, 0000);
4976 else
4977 ret = mknod(dest, S_IFREG | 0000, 0);
4978
4979 if (ret == 0)
4980 TRACE("Created mount target \"%s\"", dest);
4981 else if (ret < 0 && errno != EEXIST) {
4982 SYSERROR("Failed to create mount target \"%s\"", dest);
4983 return -1;
4984 }
4985
4986 return 0;
4987 }
4988
4989 static int do_lxcapi_mount(struct lxc_container *c, const char *source,
4990 const char *target, const char *filesystemtype,
4991 unsigned long mountflags, const void *data,
4992 struct lxc_mount *mnt)
4993 {
4994 char *suff, *sret;
4995 char template[PATH_MAX], path[PATH_MAX];
4996 pid_t pid, init_pid;
4997 struct stat sb;
4998 bool is_dir;
4999 int ret = -1, fd = -EBADF;
5000
5001 if (!c || !c->lxc_conf) {
5002 ERROR("Container or configuration is NULL");
5003 return -EINVAL;
5004 }
5005
5006 if (!c->lxc_conf->shmount.path_host) {
5007 ERROR("Host path to shared mountpoint must be specified in the config\n");
5008 return -EINVAL;
5009 }
5010
5011 ret = strnprintf(template, sizeof(template), "%s/.lxcmount_XXXXXX", c->lxc_conf->shmount.path_host);
5012 if (ret < 0) {
5013 SYSERROR("Error writing shmounts tempdir name");
5014 goto out;
5015 }
5016
5017 /* Create a temporary file / dir under the shared mountpoint */
5018 if (!source || strequal(source, "")) {
5019 /* If source is not specified, maybe we want to mount a filesystem? */
5020 sb.st_mode = S_IFDIR;
5021 } else {
5022 ret = stat(source, &sb);
5023 if (ret < 0) {
5024 SYSERROR("Error getting stat info about the source \"%s\"", source);
5025 goto out;
5026 }
5027 }
5028
5029 is_dir = (S_ISDIR(sb.st_mode) != 0);
5030 if (is_dir) {
5031 sret = mkdtemp(template);
5032 if (!sret) {
5033 SYSERROR("Could not create shmounts temporary dir");
5034 goto out;
5035 }
5036 } else {
5037 fd = lxc_make_tmpfile(template, false);
5038 if (fd < 0) {
5039 SYSERROR("Could not create shmounts temporary file");
5040 goto out;
5041 }
5042 }
5043
5044 /* Do the fork */
5045 pid = fork();
5046 if (pid < 0) {
5047 SYSERROR("Could not fork");
5048 goto out;
5049 }
5050
5051 if (pid == 0) {
5052 /* Do the mount */
5053 ret = mount(source, template, filesystemtype, mountflags, data);
5054 if (ret < 0) {
5055 SYSERROR("Failed to mount onto \"%s\"", template);
5056 _exit(EXIT_FAILURE);
5057 }
5058 TRACE("Mounted \"%s\" onto \"%s\"", source, template);
5059
5060 init_pid = do_lxcapi_init_pid(c);
5061 if (init_pid < 0) {
5062 ERROR("Failed to obtain container's init pid");
5063 _exit(EXIT_FAILURE);
5064 }
5065
5066 /* Enter the container namespaces */
5067 if (!list_empty(&c->lxc_conf->id_map)) {
5068 if (!switch_to_ns(init_pid, "user")) {
5069 ERROR("Failed to enter user namespace");
5070 _exit(EXIT_FAILURE);
5071 }
5072
5073 if (!lxc_switch_uid_gid(0, 0))
5074 _exit(EXIT_FAILURE);
5075 }
5076
5077 if (!switch_to_ns(init_pid, "mnt")) {
5078 ERROR("Failed to enter mount namespace");
5079 _exit(EXIT_FAILURE);
5080 }
5081
5082 ret = create_mount_target(target, sb.st_mode);
5083 if (ret < 0)
5084 _exit(EXIT_FAILURE);
5085
5086 suff = strrchr(template, '/');
5087 if (!suff)
5088 goto cleanup_target_in_child;
5089
5090 ret = strnprintf(path, sizeof(path), "%s%s", c->lxc_conf->shmount.path_cont, suff);
5091 if (ret < 0) {
5092 SYSERROR("Error writing container mountpoint name");
5093 goto cleanup_target_in_child;
5094 }
5095
5096 ret = mount(path, target, NULL, MS_MOVE | MS_REC, NULL);
5097 if (ret < 0) {
5098 SYSERROR("Failed to move the mount from \"%s\" to \"%s\"", path, target);
5099 goto cleanup_target_in_child;
5100 }
5101 TRACE("Moved mount from \"%s\" to \"%s\"", path, target);
5102
5103 _exit(EXIT_SUCCESS);
5104
5105 cleanup_target_in_child:
5106 (void)remove(target);
5107 _exit(EXIT_FAILURE);
5108 }
5109
5110 ret = wait_for_pid(pid);
5111 if (ret < 0)
5112 SYSERROR("Wait for the child with pid %ld failed", (long)pid);
5113 else
5114 ret = 0;
5115
5116 if (umount2(template, MNT_DETACH))
5117 SYSWARN("Failed to remove temporary mount \"%s\"", template);
5118
5119 if (is_dir)
5120 (void)rmdir(template);
5121 else
5122 (void)unlink(template);
5123
5124 out:
5125 if (fd >= 0)
5126 close(fd);
5127
5128 return ret;
5129 }
5130
5131 WRAP_API_6(int, lxcapi_mount, const char *, const char *, const char *,
5132 unsigned long, const void *, struct lxc_mount *)
5133
5134 static int do_lxcapi_umount(struct lxc_container *c, const char *target,
5135 unsigned long flags, struct lxc_mount *mnt)
5136 {
5137 pid_t pid, init_pid;
5138 int ret = -1;
5139
5140 if (!c || !c->lxc_conf) {
5141 ERROR("Container or configuration is NULL");
5142 return -EINVAL;
5143 }
5144
5145 /* Do the fork */
5146 pid = fork();
5147 if (pid < 0) {
5148 SYSERROR("Could not fork");
5149 return -1;
5150 }
5151
5152 if (pid == 0) {
5153 init_pid = do_lxcapi_init_pid(c);
5154 if (init_pid < 0) {
5155 ERROR("Failed to obtain container's init pid");
5156 _exit(EXIT_FAILURE);
5157 }
5158
5159 /* Enter the container namespaces */
5160 if (!list_empty(&c->lxc_conf->id_map)) {
5161 if (!switch_to_ns(init_pid, "user")) {
5162 ERROR("Failed to enter user namespace");
5163 _exit(EXIT_FAILURE);
5164 }
5165 }
5166
5167 if (!switch_to_ns(init_pid, "mnt")) {
5168 ERROR("Failed to enter mount namespace");
5169 _exit(EXIT_FAILURE);
5170 }
5171
5172 /* Do the unmount */
5173 ret = umount2(target, flags);
5174 if (ret < 0) {
5175 SYSERROR("Failed to umount \"%s\"", target);
5176 _exit(EXIT_FAILURE);
5177 }
5178
5179 _exit(EXIT_SUCCESS);
5180 }
5181
5182 ret = wait_for_pid(pid);
5183 if (ret < 0) {
5184 SYSERROR("Wait for the child with pid %ld failed", (long)pid);
5185 return -ret;
5186 }
5187
5188 return 0;
5189 }
5190
5191 WRAP_API_3(int, lxcapi_umount, const char *, unsigned long, struct lxc_mount*)
5192
5193 static int lxcapi_attach_run_waitl(struct lxc_container *c, lxc_attach_options_t *options, const char *program, const char *arg, ...)
5194 {
5195 va_list ap;
5196 const char **argv;
5197 int ret;
5198
5199 if (!c)
5200 return -1;
5201
5202 current_config = c->lxc_conf;
5203
5204 va_start(ap, arg);
5205 argv = lxc_va_arg_list_to_argv_const(ap, 1);
5206 va_end(ap);
5207
5208 if (!argv) {
5209 ERROR("Memory allocation error.");
5210 ret = -1;
5211 goto out;
5212 }
5213 argv[0] = arg;
5214
5215 ret = do_lxcapi_attach_run_wait(c, options, program, (const char * const *)argv);
5216 free((void*)argv);
5217
5218 out:
5219 current_config = NULL;
5220 return ret;
5221 }
5222
5223 static int do_lxcapi_seccomp_notify_fd(struct lxc_container *c)
5224 {
5225 if (!c || !c->lxc_conf)
5226 return ret_set_errno(-1, -EINVAL);
5227
5228 return lxc_seccomp_get_notify_fd(&c->lxc_conf->seccomp);
5229 }
5230
5231 WRAP_API(int, lxcapi_seccomp_notify_fd)
5232
5233 static int do_lxcapi_seccomp_notify_fd_active(struct lxc_container *c)
5234 {
5235 if (!c || !c->lxc_conf)
5236 return ret_set_errno(-1, -EINVAL);
5237
5238 return lxc_cmd_get_seccomp_notify_fd(c->name, c->config_path);
5239 }
5240
5241 WRAP_API(int, lxcapi_seccomp_notify_fd_active)
5242
5243 struct lxc_container *lxc_container_new(const char *name, const char *configpath)
5244 {
5245 struct lxc_container *c;
5246 size_t len;
5247 int rc;
5248
5249 if (!name)
5250 return NULL;
5251
5252 c = malloc(sizeof(*c));
5253 if (!c) {
5254 fprintf(stderr, "Failed to allocate memory for %s\n", name);
5255 return NULL;
5256 }
5257 memset(c, 0, sizeof(*c));
5258
5259 if (configpath)
5260 c->config_path = strdup(configpath);
5261 else
5262 c->config_path = strdup(lxc_global_config_value("lxc.lxcpath"));
5263 if (!c->config_path) {
5264 fprintf(stderr, "Failed to allocate memory for %s\n", name);
5265 goto err;
5266 }
5267
5268 remove_trailing_slashes(c->config_path);
5269
5270 len = strlen(name);
5271 c->name = malloc(len + 1);
5272 if (!c->name) {
5273 fprintf(stderr, "Failed to allocate memory for %s\n", name);
5274 goto err;
5275 }
5276 (void)strlcpy(c->name, name, len + 1);
5277
5278 c->numthreads = 1;
5279 c->slock = lxc_newlock(c->config_path, name);
5280 if (!c->slock) {
5281 fprintf(stderr, "Failed to create lock for %s\n", name);
5282 goto err;
5283 }
5284
5285 c->privlock = lxc_newlock(NULL, NULL);
5286 if (!c->privlock) {
5287 fprintf(stderr, "Failed to create private lock for %s\n", name);
5288 goto err;
5289 }
5290
5291 if (!set_config_filename(c)) {
5292 fprintf(stderr, "Failed to create config file name for %s\n", name);
5293 goto err;
5294 }
5295
5296 if (file_exists(c->configfile) && !lxcapi_load_config(c, NULL)) {
5297 fprintf(stderr, "Failed to load config for %s\n", name);
5298 goto err;
5299 }
5300
5301 rc = ongoing_create(c);
5302 switch (rc) {
5303 case LXC_CREATE_INCOMPLETE:
5304 SYSERROR("Failed to complete container creation for %s", c->name);
5305 container_destroy(c, NULL);
5306 lxcapi_clear_config(c);
5307 break;
5308 case LXC_CREATE_ONGOING:
5309 /* container creation going on */
5310 break;
5311 case LXC_CREATE_FAILED:
5312 /* container creation failed */
5313 if (errno != EACCES && errno != EPERM) {
5314 /* insufficient privileges */
5315 SYSERROR("Failed checking for incomplete container %s creation", c->name);
5316 goto err;
5317 }
5318 break;
5319 }
5320
5321 c->daemonize = true;
5322 c->pidfile = NULL;
5323
5324 /* Assign the member functions. */
5325 c->is_defined = lxcapi_is_defined;
5326 c->state = lxcapi_state;
5327 c->is_running = lxcapi_is_running;
5328 c->freeze = lxcapi_freeze;
5329 c->unfreeze = lxcapi_unfreeze;
5330 c->console = lxcapi_console;
5331 c->console_getfd = lxcapi_console_getfd;
5332 c->devpts_fd = lxcapi_devpts_fd;
5333 c->init_pid = lxcapi_init_pid;
5334 c->init_pidfd = lxcapi_init_pidfd;
5335 c->load_config = lxcapi_load_config;
5336 c->want_daemonize = lxcapi_want_daemonize;
5337 c->want_close_all_fds = lxcapi_want_close_all_fds;
5338 c->start = lxcapi_start;
5339 c->startl = lxcapi_startl;
5340 c->stop = lxcapi_stop;
5341 c->config_file_name = lxcapi_config_file_name;
5342 c->wait = lxcapi_wait;
5343 c->set_config_item = lxcapi_set_config_item;
5344 c->destroy = lxcapi_destroy;
5345 c->destroy_with_snapshots = lxcapi_destroy_with_snapshots;
5346 c->rename = lxcapi_rename;
5347 c->save_config = lxcapi_save_config;
5348 c->get_keys = lxcapi_get_keys;
5349 c->create = lxcapi_create;
5350 c->createl = lxcapi_createl;
5351 c->shutdown = lxcapi_shutdown;
5352 c->reboot = lxcapi_reboot;
5353 c->reboot2 = lxcapi_reboot2;
5354 c->clear_config = lxcapi_clear_config;
5355 c->clear_config_item = lxcapi_clear_config_item;
5356 c->get_config_item = lxcapi_get_config_item;
5357 c->get_running_config_item = lxcapi_get_running_config_item;
5358 c->get_cgroup_item = lxcapi_get_cgroup_item;
5359 c->set_cgroup_item = lxcapi_set_cgroup_item;
5360 c->get_config_path = lxcapi_get_config_path;
5361 c->set_config_path = lxcapi_set_config_path;
5362 c->clone = lxcapi_clone;
5363 c->get_interfaces = lxcapi_get_interfaces;
5364 c->get_ips = lxcapi_get_ips;
5365 c->attach = lxcapi_attach;
5366 c->attach_run_wait = lxcapi_attach_run_wait;
5367 c->attach_run_waitl = lxcapi_attach_run_waitl;
5368 c->snapshot = lxcapi_snapshot;
5369 c->snapshot_list = lxcapi_snapshot_list;
5370 c->snapshot_restore = lxcapi_snapshot_restore;
5371 c->snapshot_destroy = lxcapi_snapshot_destroy;
5372 c->snapshot_destroy_all = lxcapi_snapshot_destroy_all;
5373 c->may_control = lxcapi_may_control;
5374 c->add_device_node = lxcapi_add_device_node;
5375 c->remove_device_node = lxcapi_remove_device_node;
5376 c->attach_interface = lxcapi_attach_interface;
5377 c->detach_interface = lxcapi_detach_interface;
5378 c->checkpoint = lxcapi_checkpoint;
5379 c->restore = lxcapi_restore;
5380 c->migrate = lxcapi_migrate;
5381 c->console_log = lxcapi_console_log;
5382 c->mount = lxcapi_mount;
5383 c->umount = lxcapi_umount;
5384 c->seccomp_notify_fd = lxcapi_seccomp_notify_fd;
5385 c->seccomp_notify_fd_active = lxcapi_seccomp_notify_fd_active;
5386
5387 return c;
5388
5389 err:
5390 lxc_container_free(c);
5391 return NULL;
5392 }
5393
5394 int lxc_get_wait_states(const char **states)
5395 {
5396 int i;
5397
5398 if (states)
5399 for (i=0; i<MAX_STATE; i++)
5400 states[i] = lxc_state2str(i);
5401
5402 return MAX_STATE;
5403 }
5404
5405 /*
5406 * These next two could probably be done smarter with reusing a common function
5407 * with different iterators and tests...
5408 */
5409 int list_defined_containers(const char *lxcpath, char ***names,
5410 struct lxc_container ***cret)
5411 {
5412 __do_closedir DIR *dir = NULL;
5413 size_t array_len = 0, name_array_len = 0, ct_array_len = 0;
5414 struct dirent *direntp;
5415 struct lxc_container *c;
5416
5417 if (!lxcpath)
5418 lxcpath = lxc_global_config_value("lxc.lxcpath");
5419
5420 dir = opendir(lxcpath);
5421 if (!dir) {
5422 SYSERROR("opendir on lxcpath");
5423 return -1;
5424 }
5425
5426 if (cret)
5427 *cret = NULL;
5428
5429 if (names)
5430 *names = NULL;
5431
5432 while ((direntp = readdir(dir))) {
5433 /* Ignore '.', '..' and any hidden directory. */
5434 if (strnequal(direntp->d_name, ".", 1))
5435 continue;
5436
5437 if (!config_file_exists(lxcpath, direntp->d_name))
5438 continue;
5439
5440 if (cret) {
5441 c = lxc_container_new(direntp->d_name, lxcpath);
5442 if (!c) {
5443 INFO("Container %s:%s has a config but could not be loaded",
5444 lxcpath, direntp->d_name);
5445 continue;
5446 }
5447
5448 if (!do_lxcapi_is_defined(c)) {
5449 INFO("Container %s:%s has a config but is not defined",
5450 lxcpath, direntp->d_name);
5451
5452 lxc_container_put(c);
5453 continue;
5454 }
5455 }
5456
5457 if (names) {
5458 if (!add_to_array(names, direntp->d_name, array_len))
5459 goto free_bad;
5460 name_array_len++;
5461 }
5462
5463 if (cret) {
5464 if (!add_to_clist(cret, c, array_len, true)) {
5465 lxc_container_put(c);
5466 goto free_bad;
5467 }
5468 ct_array_len++;
5469 }
5470
5471 array_len++;
5472 }
5473
5474 return array_len;
5475
5476 free_bad:
5477 if (names && *names) {
5478 for (size_t i = 0; i < name_array_len; i++)
5479 free((*names)[i]);
5480 free(*names);
5481 }
5482
5483 if (cret && *cret) {
5484 for (size_t i = 0; i < ct_array_len; i++)
5485 lxc_container_put((*cret)[i]);
5486 free(*cret);
5487 }
5488
5489 return -1;
5490 }
5491
5492 int list_active_containers(const char *lxcpath, char ***nret,
5493 struct lxc_container ***cret)
5494 {
5495 __do_free char *line = NULL;
5496 __do_fclose FILE *f = NULL;
5497 int i, ret = -1, cret_cnt = 0, ct_name_cnt = 0;
5498 int lxcpath_len;
5499 char **ct_name = NULL;
5500 size_t len = 0;
5501 struct lxc_container *c = NULL;
5502 bool is_hashed;
5503
5504 if (!lxcpath)
5505 lxcpath = lxc_global_config_value("lxc.lxcpath");
5506 lxcpath_len = strlen(lxcpath);
5507
5508 if (cret)
5509 *cret = NULL;
5510
5511 if (nret)
5512 *nret = NULL;
5513
5514 f = fopen("/proc/net/unix", "re");
5515 if (!f)
5516 return -1;
5517
5518 while (getline(&line, &len, f) != -1) {
5519 char *p = strrchr(line, ' '), *p2;
5520 if (!p)
5521 continue;
5522 p++;
5523
5524 if (*p != 0x40)
5525 continue;
5526 p++;
5527
5528 is_hashed = false;
5529
5530 if (strnequal(p, lxcpath, lxcpath_len)) {
5531 p += lxcpath_len;
5532 } else if (strnequal(p, "lxc/", 4)) {
5533 p += 4;
5534 is_hashed = true;
5535 } else {
5536 continue;
5537 }
5538
5539 while (*p == '/')
5540 p++;
5541
5542 /* Now p is the start of lxc_name. */
5543 p2 = strchr(p, '/');
5544 if (!p2 || !strnequal(p2, "/command", 8))
5545 continue;
5546 *p2 = '\0';
5547
5548 if (is_hashed) {
5549 char *recvpath = lxc_cmd_get_lxcpath(p);
5550 if (!recvpath)
5551 continue;
5552
5553 if (!strnequal(lxcpath, recvpath, lxcpath_len)) {
5554 free(recvpath);
5555 continue;
5556 }
5557 free(recvpath);
5558
5559 p = lxc_cmd_get_name(p);
5560 if (!p)
5561 continue;
5562 }
5563
5564 if (array_contains(&ct_name, p, ct_name_cnt)) {
5565 if (is_hashed)
5566 free(p);
5567 continue;
5568 }
5569
5570 if (!add_to_array(&ct_name, p, ct_name_cnt)) {
5571 if (is_hashed)
5572 free(p);
5573 goto free_cret_list;
5574 }
5575
5576 ct_name_cnt++;
5577
5578 if (!cret) {
5579 if (is_hashed)
5580 free(p);
5581 continue;
5582 }
5583
5584 c = lxc_container_new(p, lxcpath);
5585 if (!c) {
5586 INFO("Container %s:%s is running but could not be loaded", lxcpath, p);
5587 if (is_hashed)
5588 free(p);
5589
5590 goto free_cret_list;
5591 }
5592
5593 if (is_hashed)
5594 free(p);
5595
5596 /*
5597 * If this is an anonymous container, then is_defined *can*
5598 * return false. So we don't do that check. Count on the
5599 * fact that the command socket exists.
5600 */
5601
5602 if (!add_to_clist(cret, c, cret_cnt, true)) {
5603 lxc_container_put(c);
5604 goto free_cret_list;
5605 }
5606
5607 cret_cnt++;
5608 }
5609
5610 if (nret && cret && cret_cnt != ct_name_cnt) {
5611 if (c)
5612 lxc_container_put(c);
5613 goto free_cret_list;
5614 }
5615
5616 ret = ct_name_cnt;
5617 if (nret)
5618 *nret = ct_name;
5619 else
5620 goto free_ct_name;
5621
5622 goto out;
5623
5624 free_cret_list:
5625 if (cret && *cret) {
5626 for (i = 0; i < cret_cnt; i++)
5627 lxc_container_put((*cret)[i]);
5628 free(*cret);
5629 }
5630
5631 free_ct_name:
5632 if (ct_name) {
5633 for (i = 0; i < ct_name_cnt; i++)
5634 free(ct_name[i]);
5635 free(ct_name);
5636 }
5637
5638 out:
5639 return ret;
5640 }
5641
5642 int list_all_containers(const char *lxcpath, char ***nret,
5643 struct lxc_container ***cret)
5644 {
5645 int active_cnt, ct_cnt, ct_list_cnt, ret;
5646 char **active_name = NULL, **ct_name = NULL;
5647 struct lxc_container **ct_list = NULL;
5648
5649 ct_cnt = list_defined_containers(lxcpath, &ct_name, NULL);
5650 if (ct_cnt < 0)
5651 return ct_cnt;
5652
5653 active_cnt = list_active_containers(lxcpath, &active_name, NULL);
5654 if (active_cnt < 0) {
5655 ret = active_cnt;
5656 goto free_ct_name;
5657 }
5658
5659 ret = -EINVAL;
5660 for (int i = 0; i < active_cnt; i++) {
5661 if (array_contains(&ct_name, active_name[i], ct_cnt))
5662 continue;
5663
5664 if (!add_to_array(&ct_name, active_name[i], ct_cnt))
5665 goto free_active_name;
5666
5667 ct_cnt++;
5668 }
5669
5670 if (cret) {
5671 ct_list_cnt = 0;
5672 for (int i = 0; i < ct_cnt; i++) {
5673 __put_lxc_container struct lxc_container *c = NULL;
5674
5675 c = lxc_container_new(ct_name[i], lxcpath);
5676 if (!c) {
5677 WARN("Container %s:%s could not be loaded", lxcpath, ct_name[i]);
5678 goto free_ct_list;
5679 }
5680
5681 if (!add_to_clist(&ct_list, c, ct_list_cnt, false))
5682 goto free_ct_list;
5683
5684 ct_list_cnt++;
5685 move_ptr(c);
5686 }
5687
5688 *cret = ct_list;
5689 }
5690
5691 for (int i = 0; i < active_cnt; i++)
5692 free(active_name[i]);
5693 free(active_name);
5694
5695 if (nret) {
5696 *nret = ct_name;
5697 } else {
5698 for (int i = 0; i < ct_cnt; i++)
5699 free(ct_name[i]);
5700 free(ct_name);
5701 }
5702
5703 return ct_cnt;
5704
5705 free_ct_list:
5706 for (int i = 0; i < ct_list_cnt; i++)
5707 lxc_container_put(ct_list[i]);
5708 free(ct_list);
5709
5710 free_active_name:
5711 for (int i = 0; i < active_cnt; i++)
5712 free(active_name[i]);
5713 free(active_name);
5714
5715 free_ct_name:
5716 for (int i = 0; i < ct_cnt; i++)
5717 free(ct_name[i]);
5718 free(ct_name);
5719
5720 return ret;
5721 }
5722
5723 bool lxc_config_item_is_supported(const char *key)
5724 {
5725 return !!lxc_get_config_exact(key);
5726 }
5727
5728 bool lxc_has_api_extension(const char *extension)
5729 {
5730 /* The NULL API extension is always present. :) */
5731 if (!extension)
5732 return true;
5733
5734 for (size_t i = 0; i < nr_api_extensions; i++)
5735 if (strequal(api_extensions[i], extension))
5736 return true;
5737
5738 return false;
5739 }
LXC mirror