]> git.proxmox.com Git - mirror_lxc.git/blob - src/lxc/lxccontainer.c
projects / mirror_lxc.git / blob
? search:
summary | shortlog | log | commit | commitdiff | tree
blame | history | raw | HEAD
c/r: no double fclose() of mnts
[mirror_lxc.git] / src / lxc / lxccontainer.c
1 /* liblxcapi
2 *
3 * Copyright © 2012 Serge Hallyn <serge.hallyn@ubuntu.com>.
4 * Copyright © 2012 Canonical Ltd.
5 *
6 * This library is free software; you can redistribute it and/or
7 * modify it under the terms of the GNU Lesser General Public
8 * License as published by the Free Software Foundation; either
9 * version 2.1 of the License, or (at your option) any later version.
10
11 * This library is distributed in the hope that it will be useful,
12 * but WITHOUT ANY WARRANTY; without even the implied warranty of
13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
14 * Lesser General Public License for more details.
15
16 * You should have received a copy of the GNU Lesser General Public
17 * License along with this library; if not, write to the Free Software
18 * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
19 */
20
21 #define _GNU_SOURCE
22 #include <assert.h>
23 #include <stdarg.h>
24 #include <pthread.h>
25 #include <unistd.h>
26 #include <sys/types.h>
27 #include <sys/wait.h>
28 #include <sys/mount.h>
29 #include <errno.h>
30 #include <fcntl.h>
31 #include <sched.h>
32 #include <dirent.h>
33 #include <sched.h>
34 #include <arpa/inet.h>
35 #include <libgen.h>
36 #include <stdint.h>
37 #include <grp.h>
38 #include <stdio.h>
39 #include <sys/syscall.h>
40
41 #include <lxc/lxccontainer.h>
42 #include <lxc/version.h>
43 #include <lxc/network.h>
44
45 #include "config.h"
46 #include "lxc.h"
47 #include "state.h"
48 #include "conf.h"
49 #include "confile.h"
50 #include "console.h"
51 #include "cgroup.h"
52 #include "commands.h"
53 #include "log.h"
54 #include "bdev.h"
55 #include "utils.h"
56 #include "attach.h"
57 #include "monitor.h"
58 #include "namespace.h"
59 #include "network.h"
60 #include "lxclock.h"
61 #include "sync.h"
62
63 #if HAVE_IFADDRS_H
64 #include <ifaddrs.h>
65 #else
66 #include <../include/ifaddrs.h>
67 #endif
68
69 #if IS_BIONIC
70 #include <../include/lxcmntent.h>
71 #else
72 #include <mntent.h>
73 #endif
74
75 #define MAX_BUFFER 4096
76
77 #define NOT_SUPPORTED_ERROR "the requested function %s is not currently supported with unprivileged containers"
78
79 /* Define faccessat() if missing from the C library */
80 #ifndef HAVE_FACCESSAT
81 static int faccessat(int __fd, const char *__file, int __type, int __flag)
82 {
83 #ifdef __NR_faccessat
84 return syscall(__NR_faccessat, __fd, __file, __type, __flag);
85 #else
86 errno = ENOSYS;
87 return -1;
88 #endif
89 }
90 #endif
91
92 lxc_log_define(lxc_container, lxc);
93
94 static bool do_lxcapi_destroy(struct lxc_container *c);
95 static const char *lxcapi_get_config_path(struct lxc_container *c);
96 #define do_lxcapi_get_config_path(c) lxcapi_get_config_path(c)
97 static bool do_lxcapi_set_config_item(struct lxc_container *c, const char *key, const char *v);
98 static bool container_destroy(struct lxc_container *c);
99 static bool get_snappath_dir(struct lxc_container *c, char *snappath);
100 static bool lxcapi_snapshot_destroy_all(struct lxc_container *c);
101 static bool do_lxcapi_save_config(struct lxc_container *c, const char *alt_file);
102
103 static bool config_file_exists(const char *lxcpath, const char *cname)
104 {
105 /* $lxcpath + '/' + $cname + '/config' + \0 */
106 int ret, len = strlen(lxcpath) + strlen(cname) + 9;
107 char *fname = alloca(len);
108
109 ret = snprintf(fname, len, "%s/%s/config", lxcpath, cname);
110 if (ret < 0 || ret >= len)
111 return false;
112
113 return file_exists(fname);
114 }
115
116 /*
117 * A few functions to help detect when a container creation failed.
118 * If a container creation was killed partway through, then trying
119 * to actually start that container could harm the host. We detect
120 * this by creating a 'partial' file under the container directory,
121 * and keeping an advisory lock. When container creation completes,
122 * we remove that file. When we load or try to start a container, if
123 * we find that file, without a flock, we remove the container.
124 */
125 static int ongoing_create(struct lxc_container *c)
126 {
127 int len = strlen(c->config_path) + strlen(c->name) + 10;
128 char *path = alloca(len);
129 int fd, ret;
130 struct flock lk;
131
132 ret = snprintf(path, len, "%s/%s/partial", c->config_path, c->name);
133 if (ret < 0 || ret >= len) {
134 ERROR("Error writing partial pathname");
135 return -1;
136 }
137
138 if (!file_exists(path))
139 return 0;
140 fd = open(path, O_RDWR);
141 if (fd < 0) {
142 // give benefit of the doubt
143 SYSERROR("Error opening partial file");
144 return 0;
145 }
146 lk.l_type = F_WRLCK;
147 lk.l_whence = SEEK_SET;
148 lk.l_start = 0;
149 lk.l_len = 0;
150 lk.l_pid = -1;
151 if (fcntl(fd, F_GETLK, &lk) == 0 && lk.l_pid != -1) {
152 // create is still ongoing
153 close(fd);
154 return 1;
155 }
156 // create completed but partial is still there.
157 close(fd);
158 return 2;
159 }
160
161 static int create_partial(struct lxc_container *c)
162 {
163 // $lxcpath + '/' + $name + '/partial' + \0
164 int len = strlen(c->config_path) + strlen(c->name) + 10;
165 char *path = alloca(len);
166 int fd, ret;
167 struct flock lk;
168
169 ret = snprintf(path, len, "%s/%s/partial", c->config_path, c->name);
170 if (ret < 0 || ret >= len) {
171 ERROR("Error writing partial pathname");
172 return -1;
173 }
174 if ((fd=open(path, O_RDWR | O_CREAT | O_EXCL, 0755)) < 0) {
175 SYSERROR("Erorr creating partial file");
176 return -1;
177 }
178 lk.l_type = F_WRLCK;
179 lk.l_whence = SEEK_SET;
180 lk.l_start = 0;
181 lk.l_len = 0;
182 if (fcntl(fd, F_SETLKW, &lk) < 0) {
183 SYSERROR("Error locking partial file %s", path);
184 close(fd);
185 return -1;
186 }
187
188 return fd;
189 }
190
191 static void remove_partial(struct lxc_container *c, int fd)
192 {
193 // $lxcpath + '/' + $name + '/partial' + \0
194 int len = strlen(c->config_path) + strlen(c->name) + 10;
195 char *path = alloca(len);
196 int ret;
197
198 close(fd);
199 ret = snprintf(path, len, "%s/%s/partial", c->config_path, c->name);
200 if (ret < 0 || ret >= len) {
201 ERROR("Error writing partial pathname");
202 return;
203 }
204 if (unlink(path) < 0)
205 SYSERROR("Error unlink partial file %s", path);
206 }
207
208 /* LOCKING
209 * 1. container_mem_lock(c) protects the struct lxc_container from multiple threads.
210 * 2. container_disk_lock(c) protects the on-disk container data - in particular the
211 * container configuration file.
212 * The container_disk_lock also takes the container_mem_lock.
213 * 3. thread_mutex protects process data (ex: fd table) from multiple threads.
214 * NOTHING mutexes two independent programs with their own struct
215 * lxc_container for the same c->name, between API calls. For instance,
216 * c->config_read(); c->start(); Between those calls, data on disk
217 * could change (which shouldn't bother the caller unless for instance
218 * the rootfs get moved). c->config_read(); update; c->config_write();
219 * Two such updaters could race. The callers should therefore check their
220 * results. Trying to prevent that would necessarily expose us to deadlocks
221 * due to hung callers. So I prefer to keep the locks only within our own
222 * functions, not across functions.
223 *
224 * If you're going to clone while holding a lxccontainer, increment
225 * c->numthreads (under privlock) before forking. When deleting,
226 * decrement numthreads under privlock, then if it hits 0 you can delete.
227 * Do not ever use a lxccontainer whose numthreads you did not bump.
228 */
229
230 static void lxc_container_free(struct lxc_container *c)
231 {
232 if (!c)
233 return;
234
235 free(c->configfile);
236 c->configfile = NULL;
237 free(c->error_string);
238 c->error_string = NULL;
239 if (c->slock) {
240 lxc_putlock(c->slock);
241 c->slock = NULL;
242 }
243 if (c->privlock) {
244 lxc_putlock(c->privlock);
245 c->privlock = NULL;
246 }
247 free(c->name);
248 c->name = NULL;
249 if (c->lxc_conf) {
250 lxc_conf_free(c->lxc_conf);
251 c->lxc_conf = NULL;
252 }
253 free(c->config_path);
254 c->config_path = NULL;
255
256 free(c);
257 }
258
259 /*
260 * Consider the following case:
261 freer | racing get()er
262 ==================================================================
263 lxc_container_put() | lxc_container_get()
264 \ lxclock(c->privlock) | c->numthreads < 1? (no)
265 \ c->numthreads = 0 | \ lxclock(c->privlock) -> waits
266 \ lxcunlock() | \
267 \ lxc_container_free() | \ lxclock() returns
268 | \ c->numthreads < 1 -> return 0
269 \ \ (free stuff) |
270 \ \ sem_destroy(privlock) |
271
272 * When the get()er checks numthreads the first time, one of the following
273 * is true:
274 * 1. freer has set numthreads = 0. get() returns 0
275 * 2. freer is between lxclock and setting numthreads to 0. get()er will
276 * sem_wait on privlock, get lxclock after freer() drops it, then see
277 * numthreads is 0 and exit without touching lxclock again..
278 * 3. freer has not yet locked privlock. If get()er runs first, then put()er
279 * will see --numthreads = 1 and not call lxc_container_free().
280 */
281
282 int lxc_container_get(struct lxc_container *c)
283 {
284 if (!c)
285 return 0;
286
287 // if someone else has already started freeing the container, don't
288 // try to take the lock, which may be invalid
289 if (c->numthreads < 1)
290 return 0;
291
292 if (container_mem_lock(c))
293 return 0;
294 if (c->numthreads < 1) {
295 // bail without trying to unlock, bc the privlock is now probably
296 // in freed memory
297 return 0;
298 }
299 c->numthreads++;
300 container_mem_unlock(c);
301 return 1;
302 }
303
304 int lxc_container_put(struct lxc_container *c)
305 {
306 if (!c)
307 return -1;
308 if (container_mem_lock(c))
309 return -1;
310 if (--c->numthreads < 1) {
311 container_mem_unlock(c);
312 lxc_container_free(c);
313 return 1;
314 }
315 container_mem_unlock(c);
316 return 0;
317 }
318
319 static bool do_lxcapi_is_defined(struct lxc_container *c)
320 {
321 struct stat statbuf;
322 bool ret = false;
323 int statret;
324
325 if (!c)
326 return false;
327
328 if (container_mem_lock(c))
329 return false;
330 if (!c->configfile)
331 goto out;
332 statret = stat(c->configfile, &statbuf);
333 if (statret != 0)
334 goto out;
335 ret = true;
336
337 out:
338 container_mem_unlock(c);
339 return ret;
340 }
341
342 #define WRAP_API(rettype, fnname) \
343 static rettype fnname(struct lxc_container *c) \
344 { \
345 rettype ret; \
346 struct lxc_conf *old = current_config; \
347 current_config = c ? c->lxc_conf : NULL; \
348 ret = do_##fnname(c); \
349 current_config = old; \
350 return ret; \
351 }
352
353 #define WRAP_API_1(rettype, fnname, t1) \
354 static rettype fnname(struct lxc_container *c, t1 a1) \
355 { \
356 rettype ret; \
357 struct lxc_conf *old = current_config; \
358 current_config = c ? c->lxc_conf : NULL; \
359 ret = do_##fnname(c, a1); \
360 current_config = old; \
361 return ret; \
362 }
363
364 #define WRAP_API_2(rettype, fnname, t1, t2) \
365 static rettype fnname(struct lxc_container *c, t1 a1, t2 a2) \
366 { \
367 rettype ret; \
368 struct lxc_conf *old = current_config; \
369 current_config = c ? c->lxc_conf : NULL; \
370 ret = do_##fnname(c, a1, a2); \
371 current_config = old; \
372 return ret; \
373 }
374
375 #define WRAP_API_3(rettype, fnname, t1, t2, t3) \
376 static rettype fnname(struct lxc_container *c, t1 a1, t2 a2, t3 a3) \
377 { \
378 rettype ret; \
379 struct lxc_conf *old = current_config; \
380 current_config = c ? c->lxc_conf : NULL; \
381 ret = do_##fnname(c, a1, a2, a3); \
382 current_config = old; \
383 return ret; \
384 }
385
386 WRAP_API(bool, lxcapi_is_defined)
387
388 static const char *do_lxcapi_state(struct lxc_container *c)
389 {
390 lxc_state_t s;
391
392 if (!c)
393 return NULL;
394 s = lxc_getstate(c->name, c->config_path);
395 return lxc_state2str(s);
396 }
397
398 WRAP_API(const char *, lxcapi_state)
399
400 static bool is_stopped(struct lxc_container *c)
401 {
402 lxc_state_t s;
403 s = lxc_getstate(c->name, c->config_path);
404 return (s == STOPPED);
405 }
406
407 static bool do_lxcapi_is_running(struct lxc_container *c)
408 {
409 const char *s;
410
411 if (!c)
412 return false;
413 s = do_lxcapi_state(c);
414 if (!s || strcmp(s, "STOPPED") == 0)
415 return false;
416 return true;
417 }
418
419 WRAP_API(bool, lxcapi_is_running)
420
421 static bool do_lxcapi_freeze(struct lxc_container *c)
422 {
423 int ret;
424 if (!c)
425 return false;
426
427 ret = lxc_freeze(c->name, c->config_path);
428 if (ret)
429 return false;
430 return true;
431 }
432
433 WRAP_API(bool, lxcapi_freeze)
434
435 static bool do_lxcapi_unfreeze(struct lxc_container *c)
436 {
437 int ret;
438 if (!c)
439 return false;
440
441 ret = lxc_unfreeze(c->name, c->config_path);
442 if (ret)
443 return false;
444 return true;
445 }
446
447 WRAP_API(bool, lxcapi_unfreeze)
448
449 static int do_lxcapi_console_getfd(struct lxc_container *c, int *ttynum, int *masterfd)
450 {
451 int ttyfd;
452 if (!c)
453 return -1;
454
455 ttyfd = lxc_console_getfd(c, ttynum, masterfd);
456 return ttyfd;
457 }
458
459 WRAP_API_2(int, lxcapi_console_getfd, int *, int *)
460
461 static int lxcapi_console(struct lxc_container *c, int ttynum, int stdinfd,
462 int stdoutfd, int stderrfd, int escape)
463 {
464 int ret;
465 struct lxc_conf *old = current_config;
466 current_config = c ? c->lxc_conf : NULL;
467 ret = lxc_console(c, ttynum, stdinfd, stdoutfd, stderrfd, escape);
468 current_config = old;
469 return ret;
470 }
471
472 static pid_t do_lxcapi_init_pid(struct lxc_container *c)
473 {
474 if (!c)
475 return -1;
476
477 return lxc_cmd_get_init_pid(c->name, c->config_path);
478 }
479
480 WRAP_API(pid_t, lxcapi_init_pid)
481
482 static bool load_config_locked(struct lxc_container *c, const char *fname)
483 {
484 if (!c->lxc_conf)
485 c->lxc_conf = lxc_conf_init();
486 if (!c->lxc_conf)
487 return false;
488 if (lxc_config_read(fname, c->lxc_conf, false) != 0)
489 return false;
490 return true;
491 }
492
493 static bool do_lxcapi_load_config(struct lxc_container *c, const char *alt_file)
494 {
495 bool ret = false, need_disklock = false;
496 int lret;
497 const char *fname;
498 if (!c)
499 return false;
500
501 fname = c->configfile;
502 if (alt_file)
503 fname = alt_file;
504 if (!fname)
505 return false;
506 /*
507 * If we're reading something other than the container's config,
508 * we only need to lock the in-memory container. If loading the
509 * container's config file, take the disk lock.
510 */
511 if (strcmp(fname, c->configfile) == 0)
512 need_disklock = true;
513
514 if (need_disklock)
515 lret = container_disk_lock(c);
516 else
517 lret = container_mem_lock(c);
518 if (lret)
519 return false;
520
521 ret = load_config_locked(c, fname);
522
523 if (need_disklock)
524 container_disk_unlock(c);
525 else
526 container_mem_unlock(c);
527 return ret;
528 }
529
530 WRAP_API_1(bool, lxcapi_load_config, const char *)
531
532 static bool do_lxcapi_want_daemonize(struct lxc_container *c, bool state)
533 {
534 if (!c || !c->lxc_conf)
535 return false;
536 if (container_mem_lock(c)) {
537 ERROR("Error getting mem lock");
538 return false;
539 }
540 c->daemonize = state;
541 container_mem_unlock(c);
542 return true;
543 }
544
545 WRAP_API_1(bool, lxcapi_want_daemonize, bool)
546
547 static bool do_lxcapi_want_close_all_fds(struct lxc_container *c, bool state)
548 {
549 if (!c || !c->lxc_conf)
550 return false;
551 if (container_mem_lock(c)) {
552 ERROR("Error getting mem lock");
553 return false;
554 }
555 c->lxc_conf->close_all_fds = state;
556 container_mem_unlock(c);
557 return true;
558 }
559
560 WRAP_API_1(bool, lxcapi_want_close_all_fds, bool)
561
562 static bool do_lxcapi_wait(struct lxc_container *c, const char *state, int timeout)
563 {
564 int ret;
565
566 if (!c)
567 return false;
568
569 ret = lxc_wait(c->name, state, timeout, c->config_path);
570 return ret == 0;
571 }
572
573 WRAP_API_2(bool, lxcapi_wait, const char *, int)
574
575 static bool do_wait_on_daemonized_start(struct lxc_container *c, int pid)
576 {
577 /* we'll probably want to make this timeout configurable? */
578 int timeout = 5, ret, status;
579
580 /*
581 * our child is going to fork again, then exit. reap the
582 * child
583 */
584 ret = waitpid(pid, &status, 0);
585 if (ret == -1 || !WIFEXITED(status) || WEXITSTATUS(status) != 0)
586 DEBUG("failed waiting for first dual-fork child");
587 return do_lxcapi_wait(c, "RUNNING", timeout);
588 }
589
590 WRAP_API_1(bool, wait_on_daemonized_start, int)
591
592 static bool am_single_threaded(void)
593 {
594 struct dirent dirent, *direntp;
595 DIR *dir;
596 int count=0;
597
598 dir = opendir("/proc/self/task");
599 if (!dir) {
600 INFO("failed to open /proc/self/task");
601 return false;
602 }
603
604 while (!readdir_r(dir, &dirent, &direntp)) {
605 if (!direntp)
606 break;
607
608 if (!strcmp(direntp->d_name, "."))
609 continue;
610
611 if (!strcmp(direntp->d_name, ".."))
612 continue;
613 if (++count > 1)
614 break;
615 }
616 closedir(dir);
617 return count == 1;
618 }
619
620 /*
621 * I can't decide if it'd be more convenient for callers if we accept '...',
622 * or a null-terminated array (i.e. execl vs execv)
623 */
624 static bool do_lxcapi_start(struct lxc_container *c, int useinit, char * const argv[])
625 {
626 int ret;
627 struct lxc_conf *conf;
628 bool daemonize = false;
629 FILE *pid_fp = NULL;
630 char *default_args[] = {
631 "/sbin/init",
632 NULL,
633 };
634 char *init_cmd[2];
635
636 /* container exists */
637 if (!c)
638 return false;
639 /* container has been setup */
640 if (!c->lxc_conf)
641 return false;
642
643 if ((ret = ongoing_create(c)) < 0) {
644 ERROR("Error checking for incomplete creation");
645 return false;
646 }
647 if (ret == 2) {
648 ERROR("Error: %s creation was not completed", c->name);
649 do_lxcapi_destroy(c);
650 return false;
651 } else if (ret == 1) {
652 ERROR("Error: creation of %s is ongoing", c->name);
653 return false;
654 }
655
656 /* is this app meant to be run through lxcinit, as in lxc-execute? */
657 if (useinit && !argv)
658 return false;
659
660 if (container_mem_lock(c))
661 return false;
662 conf = c->lxc_conf;
663 daemonize = c->daemonize;
664 container_mem_unlock(c);
665
666 if (useinit) {
667 ret = lxc_execute(c->name, argv, 1, conf, c->config_path);
668 return ret == 0 ? true : false;
669 }
670
671 if (!argv) {
672 if (conf->init_cmd) {
673 init_cmd[0] = conf->init_cmd;
674 init_cmd[1] = NULL;
675 argv = init_cmd;
676 }
677 else
678 argv = default_args;
679 }
680
681 /*
682 * say, I'm not sure - what locks do we want here? Any?
683 * Is liblxc's locking enough here to protect the on disk
684 * container? We don't want to exclude things like lxc_info
685 * while container is running...
686 */
687 if (daemonize) {
688 char title[2048];
689 lxc_monitord_spawn(c->config_path);
690
691 pid_t pid = fork();
692 if (pid < 0)
693 return false;
694
695 if (pid != 0) {
696 /* Set to NULL because we don't want father unlink
697 * the PID file, child will do the free and unlink.
698 */
699 c->pidfile = NULL;
700 return wait_on_daemonized_start(c, pid);
701 }
702
703 /* We don't really care if this doesn't print all the
704 * characters; all that it means is that the proctitle will be
705 * ugly. Similarly, we also don't care if setproctitle()
706 * fails. */
707 snprintf(title, sizeof(title), "[lxc monitor] %s %s", c->config_path, c->name);
708 INFO("Attempting to set proc title to %s", title);
709 setproctitle(title);
710
711 /* second fork to be reparented by init */
712 pid = fork();
713 if (pid < 0) {
714 SYSERROR("Error doing dual-fork");
715 return false;
716 }
717 if (pid != 0)
718 exit(0);
719 /* like daemon(), chdir to / and redirect 0,1,2 to /dev/null */
720 if (chdir("/")) {
721 SYSERROR("Error chdir()ing to /.");
722 return false;
723 }
724 lxc_check_inherited(conf, true, -1);
725 close(0);
726 close(1);
727 close(2);
728 open("/dev/zero", O_RDONLY);
729 open("/dev/null", O_RDWR);
730 open("/dev/null", O_RDWR);
731 setsid();
732 } else {
733 if (!am_single_threaded()) {
734 ERROR("Cannot start non-daemonized container when threaded");
735 return false;
736 }
737 }
738
739 /* We need to write PID file after daeminize, so we always
740 * write the right PID.
741 */
742 if (c->pidfile) {
743 pid_fp = fopen(c->pidfile, "w");
744 if (pid_fp == NULL) {
745 SYSERROR("Failed to create pidfile '%s' for '%s'",
746 c->pidfile, c->name);
747 return false;
748 }
749
750 if (fprintf(pid_fp, "%d\n", getpid()) < 0) {
751 SYSERROR("Failed to write '%s'", c->pidfile);
752 fclose(pid_fp);
753 pid_fp = NULL;
754 return false;
755 }
756
757 fclose(pid_fp);
758 pid_fp = NULL;
759 }
760
761 reboot:
762 conf->reboot = 0;
763
764 if (lxc_check_inherited(conf, daemonize, -1)) {
765 ERROR("Inherited fds found");
766 ret = 1;
767 goto out;
768 }
769
770 ret = lxc_start(c->name, argv, conf, c->config_path);
771 c->error_num = ret;
772
773 if (conf->reboot) {
774 INFO("container requested reboot");
775 conf->reboot = 0;
776 goto reboot;
777 }
778
779 out:
780 if (c->pidfile) {
781 unlink(c->pidfile);
782 free(c->pidfile);
783 c->pidfile = NULL;
784 }
785
786 if (daemonize)
787 exit (ret == 0 ? true : false);
788 else
789 return (ret == 0 ? true : false);
790 }
791
792 static bool lxcapi_start(struct lxc_container *c, int useinit, char * const argv[])
793 {
794 bool ret;
795 struct lxc_conf *old = current_config;
796 current_config = c ? c->lxc_conf : NULL;
797 ret = do_lxcapi_start(c, useinit, argv);
798 current_config = old;
799 return ret;
800 }
801
802 /*
803 * note there MUST be an ending NULL
804 */
805 static bool lxcapi_startl(struct lxc_container *c, int useinit, ...)
806 {
807 va_list ap;
808 char **inargs = NULL;
809 bool bret = false;
810
811 /* container exists */
812 if (!c)
813 return false;
814
815 struct lxc_conf *old = current_config;
816 current_config = c->lxc_conf;
817
818 va_start(ap, useinit);
819 inargs = lxc_va_arg_list_to_argv(ap, 0, 1);
820 va_end(ap);
821
822 if (!inargs) {
823 ERROR("Memory allocation error.");
824 goto out;
825 }
826
827 /* pass NULL if no arguments were supplied */
828 bret = do_lxcapi_start(c, useinit, *inargs ? inargs : NULL);
829
830 out:
831 if (inargs) {
832 char **arg;
833 for (arg = inargs; *arg; arg++)
834 free(*arg);
835 free(inargs);
836 }
837
838 current_config = old;
839 return bret;
840 }
841
842 static bool do_lxcapi_stop(struct lxc_container *c)
843 {
844 int ret;
845
846 if (!c)
847 return false;
848
849 ret = lxc_cmd_stop(c->name, c->config_path);
850
851 return ret == 0;
852 }
853
854 WRAP_API(bool, lxcapi_stop)
855
856 static int do_create_container_dir(const char *path, struct lxc_conf *conf)
857 {
858 int ret = -1, lasterr;
859 char *p = alloca(strlen(path)+1);
860 mode_t mask = umask(0002);
861 ret = mkdir(path, 0770);
862 lasterr = errno;
863 umask(mask);
864 errno = lasterr;
865 if (ret) {
866 if (errno == EEXIST)
867 ret = 0;
868 else {
869 SYSERROR("failed to create container path %s", path);
870 return -1;
871 }
872 }
873 strcpy(p, path);
874 if (!lxc_list_empty(&conf->id_map) && chown_mapped_root(p, conf) != 0) {
875 ERROR("Failed to chown container dir");
876 ret = -1;
877 }
878 return ret;
879 }
880
881 /*
882 * create the standard expected container dir
883 */
884 static bool create_container_dir(struct lxc_container *c)
885 {
886 char *s;
887 int len, ret;
888
889 len = strlen(c->config_path) + strlen(c->name) + 2;
890 s = malloc(len);
891 if (!s)
892 return false;
893 ret = snprintf(s, len, "%s/%s", c->config_path, c->name);
894 if (ret < 0 || ret >= len) {
895 free(s);
896 return false;
897 }
898 ret = do_create_container_dir(s, c->lxc_conf);
899 free(s);
900 return ret == 0;
901 }
902
903 /*
904 * do_bdev_create: thin wrapper around bdev_create(). Like bdev_create(),
905 * it returns a mounted bdev on success, NULL on error.
906 */
907 static struct bdev *do_bdev_create(struct lxc_container *c, const char *type,
908 struct bdev_specs *specs)
909 {
910 char *dest;
911 size_t len;
912 struct bdev *bdev;
913 int ret;
914
915 /* rootfs.path or lxcpath/lxcname/rootfs */
916 if (c->lxc_conf->rootfs.path && access(c->lxc_conf->rootfs.path, F_OK) == 0) {
917 const char *rpath = c->lxc_conf->rootfs.path;
918 len = strlen(rpath) + 1;
919 dest = alloca(len);
920 ret = snprintf(dest, len, "%s", rpath);
921 } else {
922 const char *lxcpath = do_lxcapi_get_config_path(c);
923 len = strlen(c->name) + strlen(lxcpath) + 9;
924 dest = alloca(len);
925 ret = snprintf(dest, len, "%s/%s/rootfs", lxcpath, c->name);
926 }
927 if (ret < 0 || ret >= len)
928 return NULL;
929
930 bdev = bdev_create(dest, type, c->name, specs);
931 if (!bdev) {
932 ERROR("Failed to create backing store type %s", type);
933 return NULL;
934 }
935
936 do_lxcapi_set_config_item(c, "lxc.rootfs", bdev->src);
937
938 /* if we are not root, chown the rootfs dir to root in the
939 * target uidmap */
940
941 if (geteuid() != 0 || (c->lxc_conf && !lxc_list_empty(&c->lxc_conf->id_map))) {
942 if (chown_mapped_root(bdev->dest, c->lxc_conf) < 0) {
943 ERROR("Error chowning %s to container root", bdev->dest);
944 suggest_default_idmap();
945 bdev_put(bdev);
946 return NULL;
947 }
948 }
949
950 return bdev;
951 }
952
953 static char *lxcbasename(char *path)
954 {
955 char *p = path + strlen(path) - 1;
956 while (*p != '/' && p > path)
957 p--;
958 return p;
959 }
960
961 static bool create_run_template(struct lxc_container *c, char *tpath, bool quiet,
962 char *const argv[])
963 {
964 pid_t pid;
965
966 if (!tpath)
967 return true;
968
969 pid = fork();
970 if (pid < 0) {
971 SYSERROR("failed to fork task for container creation template");
972 return false;
973 }
974
975 if (pid == 0) { // child
976 char *patharg, *namearg, *rootfsarg, *src;
977 struct bdev *bdev = NULL;
978 int i;
979 int ret, len, nargs = 0;
980 char **newargv;
981 struct lxc_conf *conf = c->lxc_conf;
982
983 if (quiet) {
984 close(0);
985 close(1);
986 close(2);
987 open("/dev/zero", O_RDONLY);
988 open("/dev/null", O_RDWR);
989 open("/dev/null", O_RDWR);
990 }
991
992 src = c->lxc_conf->rootfs.path;
993 /*
994 * for an overlay create, what the user wants is the template to fill
995 * in what will become the readonly lower layer. So don't mount for
996 * the template
997 */
998 if (strncmp(src, "overlayfs:", 10) == 0)
999 src = overlay_getlower(src+10);
1000 if (strncmp(src, "aufs:", 5) == 0)
1001 src = overlay_getlower(src+5);
1002
1003 bdev = bdev_init(c->lxc_conf, src, c->lxc_conf->rootfs.mount, NULL);
1004 if (!bdev) {
1005 ERROR("Error opening rootfs");
1006 exit(1);
1007 }
1008
1009 if (geteuid() == 0) {
1010 if (unshare(CLONE_NEWNS) < 0) {
1011 ERROR("error unsharing mounts");
1012 exit(1);
1013 }
1014 if (detect_shared_rootfs()) {
1015 if (mount(NULL, "/", NULL, MS_SLAVE|MS_REC, NULL)) {
1016 SYSERROR("Failed to make / rslave to run template");
1017 ERROR("Continuing...");
1018 }
1019 }
1020 }
1021 if (strcmp(bdev->type, "dir") && strcmp(bdev->type, "btrfs")) {
1022 if (geteuid() != 0) {
1023 ERROR("non-root users can only create btrfs and directory-backed containers");
1024 exit(1);
1025 }
1026 if (bdev->ops->mount(bdev) < 0) {
1027 ERROR("Error mounting rootfs");
1028 exit(1);
1029 }
1030 } else { // TODO come up with a better way here!
1031 free(bdev->dest);
1032 bdev->dest = strdup(bdev->src);
1033 }
1034
1035 /*
1036 * create our new array, pre-pend the template name and
1037 * base args
1038 */
1039 if (argv)
1040 for (nargs = 0; argv[nargs]; nargs++) ;
1041 nargs += 4; // template, path, rootfs and name args
1042
1043 newargv = malloc(nargs * sizeof(*newargv));
1044 if (!newargv)
1045 exit(1);
1046 newargv[0] = lxcbasename(tpath);
1047
1048 len = strlen(c->config_path) + strlen(c->name) + strlen("--path=") + 2;
1049 patharg = malloc(len);
1050 if (!patharg)
1051 exit(1);
1052 ret = snprintf(patharg, len, "--path=%s/%s", c->config_path, c->name);
1053 if (ret < 0 || ret >= len)
1054 exit(1);
1055 newargv[1] = patharg;
1056 len = strlen("--name=") + strlen(c->name) + 1;
1057 namearg = malloc(len);
1058 if (!namearg)
1059 exit(1);
1060 ret = snprintf(namearg, len, "--name=%s", c->name);
1061 if (ret < 0 || ret >= len)
1062 exit(1);
1063 newargv[2] = namearg;
1064
1065 len = strlen("--rootfs=") + 1 + strlen(bdev->dest);
1066 rootfsarg = malloc(len);
1067 if (!rootfsarg)
1068 exit(1);
1069 ret = snprintf(rootfsarg, len, "--rootfs=%s", bdev->dest);
1070 if (ret < 0 || ret >= len)
1071 exit(1);
1072 newargv[3] = rootfsarg;
1073
1074 /* add passed-in args */
1075 if (argv)
1076 for (i = 4; i < nargs; i++)
1077 newargv[i] = argv[i-4];
1078
1079 /* add trailing NULL */
1080 nargs++;
1081 newargv = realloc(newargv, nargs * sizeof(*newargv));
1082 if (!newargv)
1083 exit(1);
1084 newargv[nargs - 1] = NULL;
1085
1086 /*
1087 * If we're running the template in a mapped userns, then
1088 * we prepend the template command with:
1089 * lxc-usernsexec <-m map1> ... <-m mapn> --
1090 * and we append "--mapped-uid x", where x is the mapped uid
1091 * for our geteuid()
1092 */
1093 if (!lxc_list_empty(&conf->id_map)) {
1094 int n2args = 1;
1095 char txtuid[20];
1096 char txtgid[20];
1097 char **n2 = malloc(n2args * sizeof(*n2));
1098 struct lxc_list *it;
1099 struct id_map *map;
1100
1101 if (!n2) {
1102 SYSERROR("out of memory");
1103 exit(1);
1104 }
1105 newargv[0] = tpath;
1106 tpath = "lxc-usernsexec";
1107 n2[0] = "lxc-usernsexec";
1108 lxc_list_for_each(it, &conf->id_map) {
1109 map = it->elem;
1110 n2args += 2;
1111 n2 = realloc(n2, n2args * sizeof(char *));
1112 if (!n2)
1113 exit(1);
1114 n2[n2args-2] = "-m";
1115 n2[n2args-1] = malloc(200);
1116 if (!n2[n2args-1])
1117 exit(1);
1118 ret = snprintf(n2[n2args-1], 200, "%c:%lu:%lu:%lu",
1119 map->idtype == ID_TYPE_UID ? 'u' : 'g',
1120 map->nsid, map->hostid, map->range);
1121 if (ret < 0 || ret >= 200)
1122 exit(1);
1123 }
1124 int hostid_mapped = mapped_hostid(geteuid(), conf, ID_TYPE_UID);
1125 int extraargs = hostid_mapped >= 0 ? 1 : 3;
1126 n2 = realloc(n2, (nargs + n2args + extraargs) * sizeof(char *));
1127 if (!n2)
1128 exit(1);
1129 if (hostid_mapped < 0) {
1130 hostid_mapped = find_unmapped_nsuid(conf, ID_TYPE_UID);
1131 n2[n2args++] = "-m";
1132 if (hostid_mapped < 0) {
1133 ERROR("Could not find free uid to map");
1134 exit(1);
1135 }
1136 n2[n2args++] = malloc(200);
1137 if (!n2[n2args-1]) {
1138 SYSERROR("out of memory");
1139 exit(1);
1140 }
1141 ret = snprintf(n2[n2args-1], 200, "u:%d:%d:1",
1142 hostid_mapped, geteuid());
1143 if (ret < 0 || ret >= 200) {
1144 ERROR("string too long");
1145 exit(1);
1146 }
1147 }
1148 int hostgid_mapped = mapped_hostid(getegid(), conf, ID_TYPE_GID);
1149 extraargs = hostgid_mapped >= 0 ? 1 : 3;
1150 n2 = realloc(n2, (nargs + n2args + extraargs) * sizeof(char *));
1151 if (!n2)
1152 exit(1);
1153 if (hostgid_mapped < 0) {
1154 hostgid_mapped = find_unmapped_nsuid(conf, ID_TYPE_GID);
1155 n2[n2args++] = "-m";
1156 if (hostgid_mapped < 0) {
1157 ERROR("Could not find free uid to map");
1158 exit(1);
1159 }
1160 n2[n2args++] = malloc(200);
1161 if (!n2[n2args-1]) {
1162 SYSERROR("out of memory");
1163 exit(1);
1164 }
1165 ret = snprintf(n2[n2args-1], 200, "g:%d:%d:1",
1166 hostgid_mapped, getegid());
1167 if (ret < 0 || ret >= 200) {
1168 ERROR("string too long");
1169 exit(1);
1170 }
1171 }
1172 n2[n2args++] = "--";
1173 for (i = 0; i < nargs; i++)
1174 n2[i + n2args] = newargv[i];
1175 n2args += nargs;
1176 // Finally add "--mapped-uid $uid" to tell template what to chown
1177 // cached images to
1178 n2args += 4;
1179 n2 = realloc(n2, n2args * sizeof(char *));
1180 if (!n2) {
1181 SYSERROR("out of memory");
1182 exit(1);
1183 }
1184 // note n2[n2args-1] is NULL
1185 n2[n2args-5] = "--mapped-uid";
1186 snprintf(txtuid, 20, "%d", hostid_mapped);
1187 n2[n2args-4] = txtuid;
1188 n2[n2args-3] = "--mapped-gid";
1189 snprintf(txtgid, 20, "%d", hostgid_mapped);
1190 n2[n2args-2] = txtgid;
1191 n2[n2args-1] = NULL;
1192 free(newargv);
1193 newargv = n2;
1194 }
1195 /* execute */
1196 execvp(tpath, newargv);
1197 SYSERROR("failed to execute template %s", tpath);
1198 exit(1);
1199 }
1200
1201 if (wait_for_pid(pid) != 0) {
1202 ERROR("container creation template for %s failed", c->name);
1203 return false;
1204 }
1205
1206 return true;
1207 }
1208
1209 static bool prepend_lxc_header(char *path, const char *t, char *const argv[])
1210 {
1211 long flen;
1212 char *contents;
1213 FILE *f;
1214 int ret = -1;
1215 #if HAVE_LIBGNUTLS
1216 int i;
1217 unsigned char md_value[SHA_DIGEST_LENGTH];
1218 char *tpath;
1219 #endif
1220
1221 f = fopen(path, "r");
1222 if (f == NULL)
1223 return false;
1224
1225 if (fseek(f, 0, SEEK_END) < 0)
1226 goto out_error;
1227 if ((flen = ftell(f)) < 0)
1228 goto out_error;
1229 if (fseek(f, 0, SEEK_SET) < 0)
1230 goto out_error;
1231 if ((contents = malloc(flen + 1)) == NULL)
1232 goto out_error;
1233 if (fread(contents, 1, flen, f) != flen)
1234 goto out_free_contents;
1235
1236 contents[flen] = '\0';
1237 ret = fclose(f);
1238 f = NULL;
1239 if (ret < 0)
1240 goto out_free_contents;
1241
1242 #if HAVE_LIBGNUTLS
1243 tpath = get_template_path(t);
1244 if (!tpath) {
1245 ERROR("bad template: %s", t);
1246 goto out_free_contents;
1247 }
1248
1249 ret = sha1sum_file(tpath, md_value);
1250 if (ret < 0) {
1251 ERROR("Error getting sha1sum of %s", tpath);
1252 free(tpath);
1253 goto out_free_contents;
1254 }
1255 free(tpath);
1256 #endif
1257
1258 f = fopen(path, "w");
1259 if (f == NULL) {
1260 SYSERROR("reopening config for writing");
1261 free(contents);
1262 return false;
1263 }
1264 fprintf(f, "# Template used to create this container: %s\n", t);
1265 if (argv) {
1266 fprintf(f, "# Parameters passed to the template:");
1267 while (*argv) {
1268 fprintf(f, " %s", *argv);
1269 argv++;
1270 }
1271 fprintf(f, "\n");
1272 }
1273 #if HAVE_LIBGNUTLS
1274 fprintf(f, "# Template script checksum (SHA-1): ");
1275 for (i=0; i<SHA_DIGEST_LENGTH; i++)
1276 fprintf(f, "%02x", md_value[i]);
1277 fprintf(f, "\n");
1278 #endif
1279 fprintf(f, "# For additional config options, please look at lxc.container.conf(5)\n");
1280 if (fwrite(contents, 1, flen, f) != flen) {
1281 SYSERROR("Writing original contents");
1282 free(contents);
1283 fclose(f);
1284 return false;
1285 }
1286 ret = 0;
1287 out_free_contents:
1288 free(contents);
1289 out_error:
1290 if (f) {
1291 int newret;
1292 newret = fclose(f);
1293 if (ret == 0)
1294 ret = newret;
1295 }
1296 if (ret < 0) {
1297 SYSERROR("Error prepending header");
1298 return false;
1299 }
1300 return true;
1301 }
1302
1303 static void lxcapi_clear_config(struct lxc_container *c)
1304 {
1305 if (c) {
1306 if (c->lxc_conf) {
1307 lxc_conf_free(c->lxc_conf);
1308 c->lxc_conf = NULL;
1309 }
1310 }
1311 }
1312
1313 #define do_lxcapi_clear_config(c) lxcapi_clear_config(c)
1314
1315 /*
1316 * lxcapi_create:
1317 * create a container with the given parameters.
1318 * @c: container to be created. It has the lxcpath, name, and a starting
1319 * configuration already set
1320 * @t: the template to execute to instantiate the root filesystem and
1321 * adjust the configuration.
1322 * @bdevtype: backing store type to use. If NULL, dir will be used.
1323 * @specs: additional parameters for the backing store, i.e. LVM vg to
1324 * use.
1325 *
1326 * @argv: the arguments to pass to the template, terminated by NULL. If no
1327 * arguments, you can just pass NULL.
1328 */
1329 static bool do_lxcapi_create(struct lxc_container *c, const char *t,
1330 const char *bdevtype, struct bdev_specs *specs, int flags,
1331 char *const argv[])
1332 {
1333 bool ret = false;
1334 pid_t pid;
1335 char *tpath = NULL;
1336 int partial_fd;
1337
1338 if (!c)
1339 return false;
1340
1341 if (t) {
1342 tpath = get_template_path(t);
1343 if (!tpath) {
1344 ERROR("bad template: %s", t);
1345 goto out;
1346 }
1347 }
1348
1349 /*
1350 * If a template is passed in, and the rootfs already is defined in
1351 * the container config and exists, then * caller is trying to create
1352 * an existing container. Return an error, but do NOT delete the
1353 * container.
1354 */
1355 if (do_lxcapi_is_defined(c) && c->lxc_conf && c->lxc_conf->rootfs.path &&
1356 access(c->lxc_conf->rootfs.path, F_OK) == 0 && tpath) {
1357 ERROR("Container %s:%s already exists", c->config_path, c->name);
1358 goto free_tpath;
1359 }
1360
1361 if (!c->lxc_conf) {
1362 if (!do_lxcapi_load_config(c, lxc_global_config_value("lxc.default_config"))) {
1363 ERROR("Error loading default configuration file %s", lxc_global_config_value("lxc.default_config"));
1364 goto free_tpath;
1365 }
1366 }
1367
1368 if (!create_container_dir(c))
1369 goto free_tpath;
1370
1371 /*
1372 * either template or rootfs.path should be set.
1373 * if both template and rootfs.path are set, template is setup as rootfs.path.
1374 * container is already created if we have a config and rootfs.path is accessible
1375 */
1376 if (!c->lxc_conf->rootfs.path && !tpath)
1377 /* no template passed in and rootfs does not exist: error */
1378 goto out;
1379 if (c->lxc_conf->rootfs.path && access(c->lxc_conf->rootfs.path, F_OK) != 0)
1380 /* rootfs passed into configuration, but does not exist: error */
1381 goto out;
1382 if (do_lxcapi_is_defined(c) && c->lxc_conf->rootfs.path && !tpath) {
1383 /* Rootfs already existed, user just wanted to save the
1384 * loaded configuration */
1385 ret = true;
1386 goto out;
1387 }
1388
1389 /* Mark that this container is being created */
1390 if ((partial_fd = create_partial(c)) < 0)
1391 goto out;
1392
1393 /* no need to get disk lock bc we have the partial locked */
1394
1395 /*
1396 * Create the backing store
1397 * Note we can't do this in the same task as we use to execute the
1398 * template because of the way zfs works.
1399 * After you 'zfs create', zfs mounts the fs only in the initial
1400 * namespace.
1401 */
1402 pid = fork();
1403 if (pid < 0) {
1404 SYSERROR("failed to fork task for container creation template");
1405 goto out_unlock;
1406 }
1407
1408 if (pid == 0) { // child
1409 struct bdev *bdev = NULL;
1410
1411 if (!(bdev = do_bdev_create(c, bdevtype, specs))) {
1412 ERROR("Error creating backing store type %s for %s",
1413 bdevtype ? bdevtype : "(none)", c->name);
1414 exit(1);
1415 }
1416
1417 /* save config file again to store the new rootfs location */
1418 if (!do_lxcapi_save_config(c, NULL)) {
1419 ERROR("failed to save starting configuration for %s", c->name);
1420 // parent task won't see bdev in config so we delete it
1421 bdev->ops->umount(bdev);
1422 bdev->ops->destroy(bdev);
1423 exit(1);
1424 }
1425 exit(0);
1426 }
1427 if (wait_for_pid(pid) != 0)
1428 goto out_unlock;
1429
1430 /* reload config to get the rootfs */
1431 lxc_conf_free(c->lxc_conf);
1432 c->lxc_conf = NULL;
1433 if (!load_config_locked(c, c->configfile))
1434 goto out_unlock;
1435
1436 if (!create_run_template(c, tpath, !!(flags & LXC_CREATE_QUIET), argv))
1437 goto out_unlock;
1438
1439 // now clear out the lxc_conf we have, reload from the created
1440 // container
1441 do_lxcapi_clear_config(c);
1442
1443 if (t) {
1444 if (!prepend_lxc_header(c->configfile, tpath, argv)) {
1445 ERROR("Error prepending header to configuration file");
1446 goto out_unlock;
1447 }
1448 }
1449 ret = load_config_locked(c, c->configfile);
1450
1451 out_unlock:
1452 if (partial_fd >= 0)
1453 remove_partial(c, partial_fd);
1454 out:
1455 if (!ret)
1456 container_destroy(c);
1457 free_tpath:
1458 free(tpath);
1459 return ret;
1460 }
1461
1462 static bool lxcapi_create(struct lxc_container *c, const char *t,
1463 const char *bdevtype, struct bdev_specs *specs, int flags,
1464 char *const argv[])
1465 {
1466 bool ret;
1467 struct lxc_conf *old = current_config;
1468 current_config = c ? c->lxc_conf : NULL;
1469 ret = do_lxcapi_create(c, t, bdevtype, specs, flags, argv);
1470 current_config = old;
1471 return ret;
1472 }
1473
1474 static bool do_lxcapi_reboot(struct lxc_container *c)
1475 {
1476 pid_t pid;
1477 int rebootsignal = SIGINT;
1478
1479 if (!c)
1480 return false;
1481 if (!do_lxcapi_is_running(c))
1482 return false;
1483 pid = do_lxcapi_init_pid(c);
1484 if (pid <= 0)
1485 return false;
1486 if (c->lxc_conf && c->lxc_conf->rebootsignal)
1487 rebootsignal = c->lxc_conf->rebootsignal;
1488 if (kill(pid, rebootsignal) < 0)
1489 return false;
1490 return true;
1491
1492 }
1493
1494 WRAP_API(bool, lxcapi_reboot)
1495
1496 static bool do_lxcapi_shutdown(struct lxc_container *c, int timeout)
1497 {
1498 bool retv;
1499 pid_t pid;
1500 int haltsignal = SIGPWR;
1501
1502 if (!c)
1503 return false;
1504
1505 if (!do_lxcapi_is_running(c))
1506 return true;
1507 pid = do_lxcapi_init_pid(c);
1508 if (pid <= 0)
1509 return true;
1510 if (c->lxc_conf && c->lxc_conf->haltsignal)
1511 haltsignal = c->lxc_conf->haltsignal;
1512 kill(pid, haltsignal);
1513 retv = do_lxcapi_wait(c, "STOPPED", timeout);
1514 return retv;
1515 }
1516
1517 WRAP_API_1(bool, lxcapi_shutdown, int)
1518
1519 static bool lxcapi_createl(struct lxc_container *c, const char *t,
1520 const char *bdevtype, struct bdev_specs *specs, int flags, ...)
1521 {
1522 bool bret = false;
1523 char **args = NULL;
1524 va_list ap;
1525
1526 if (!c)
1527 return false;
1528
1529 struct lxc_conf *old = current_config;
1530 current_config = c ? c->lxc_conf : NULL;
1531
1532 /*
1533 * since we're going to wait for create to finish, I don't think we
1534 * need to get a copy of the arguments.
1535 */
1536 va_start(ap, flags);
1537 args = lxc_va_arg_list_to_argv(ap, 0, 0);
1538 va_end(ap);
1539 if (!args) {
1540 ERROR("Memory allocation error.");
1541 goto out;
1542 }
1543
1544 bret = do_lxcapi_create(c, t, bdevtype, specs, flags, args);
1545
1546 out:
1547 free(args);
1548 current_config = old;
1549 return bret;
1550 }
1551
1552 static void do_clear_unexp_config_line(struct lxc_conf *conf, const char *key)
1553 {
1554 if (strcmp(key, "lxc.cgroup") == 0)
1555 clear_unexp_config_line(conf, key, true);
1556 else if (strcmp(key, "lxc.network") == 0)
1557 clear_unexp_config_line(conf, key, true);
1558 else if (strcmp(key, "lxc.hook") == 0)
1559 clear_unexp_config_line(conf, key, true);
1560 else
1561 clear_unexp_config_line(conf, key, false);
1562 if (!do_append_unexp_config_line(conf, key, ""))
1563 WARN("Error clearing configuration for %s", key);
1564 }
1565
1566 static bool do_lxcapi_clear_config_item(struct lxc_container *c, const char *key)
1567 {
1568 int ret;
1569
1570 if (!c || !c->lxc_conf)
1571 return false;
1572 if (container_mem_lock(c))
1573 return false;
1574 ret = lxc_clear_config_item(c->lxc_conf, key);
1575 if (!ret)
1576 do_clear_unexp_config_line(c->lxc_conf, key);
1577 container_mem_unlock(c);
1578 return ret == 0;
1579 }
1580
1581 WRAP_API_1(bool, lxcapi_clear_config_item, const char *)
1582
1583 static inline bool enter_net_ns(struct lxc_container *c)
1584 {
1585 pid_t pid = do_lxcapi_init_pid(c);
1586
1587 if ((geteuid() != 0 || (c->lxc_conf && !lxc_list_empty(&c->lxc_conf->id_map))) && access("/proc/self/ns/user", F_OK) == 0) {
1588 if (!switch_to_ns(pid, "user"))
1589 return false;
1590 }
1591 return switch_to_ns(pid, "net");
1592 }
1593
1594 // used by qsort and bsearch functions for comparing names
1595 static inline int string_cmp(char **first, char **second)
1596 {
1597 return strcmp(*first, *second);
1598 }
1599
1600 // used by qsort and bsearch functions for comparing container names
1601 static inline int container_cmp(struct lxc_container **first, struct lxc_container **second)
1602 {
1603 return strcmp((*first)->name, (*second)->name);
1604 }
1605
1606 static bool add_to_array(char ***names, char *cname, int pos)
1607 {
1608 char **newnames = realloc(*names, (pos+1) * sizeof(char *));
1609 if (!newnames) {
1610 ERROR("Out of memory");
1611 return false;
1612 }
1613
1614 *names = newnames;
1615 newnames[pos] = strdup(cname);
1616 if (!newnames[pos])
1617 return false;
1618
1619 // sort the arrray as we will use binary search on it
1620 qsort(newnames, pos + 1, sizeof(char *), (int (*)(const void *,const void *))string_cmp);
1621
1622 return true;
1623 }
1624
1625 static bool add_to_clist(struct lxc_container ***list, struct lxc_container *c, int pos, bool sort)
1626 {
1627 struct lxc_container **newlist = realloc(*list, (pos+1) * sizeof(struct lxc_container *));
1628 if (!newlist) {
1629 ERROR("Out of memory");
1630 return false;
1631 }
1632
1633 *list = newlist;
1634 newlist[pos] = c;
1635
1636 // sort the arrray as we will use binary search on it
1637 if (sort)
1638 qsort(newlist, pos + 1, sizeof(struct lxc_container *), (int (*)(const void *,const void *))container_cmp);
1639
1640 return true;
1641 }
1642
1643 static char** get_from_array(char ***names, char *cname, int size)
1644 {
1645 return (char **)bsearch(&cname, *names, size, sizeof(char *), (int (*)(const void *, const void *))string_cmp);
1646 }
1647
1648
1649 static bool array_contains(char ***names, char *cname, int size) {
1650 if(get_from_array(names, cname, size) != NULL)
1651 return true;
1652 return false;
1653 }
1654
1655 static bool remove_from_array(char ***names, char *cname, int size)
1656 {
1657 char **result = get_from_array(names, cname, size);
1658 if (result != NULL) {
1659 free(result);
1660 return true;
1661 }
1662 return false;
1663 }
1664
1665 static char ** do_lxcapi_get_interfaces(struct lxc_container *c)
1666 {
1667 pid_t pid;
1668 int i, count = 0, pipefd[2];
1669 char **interfaces = NULL;
1670 char interface[IFNAMSIZ];
1671
1672 if(pipe(pipefd) < 0) {
1673 SYSERROR("pipe failed");
1674 return NULL;
1675 }
1676
1677 pid = fork();
1678 if (pid < 0) {
1679 SYSERROR("failed to fork task to get interfaces information");
1680 close(pipefd[0]);
1681 close(pipefd[1]);
1682 return NULL;
1683 }
1684
1685 if (pid == 0) { // child
1686 int ret = 1, nbytes;
1687 struct ifaddrs *interfaceArray = NULL, *tempIfAddr = NULL;
1688
1689 /* close the read-end of the pipe */
1690 close(pipefd[0]);
1691
1692 if (!enter_net_ns(c)) {
1693 SYSERROR("failed to enter namespace");
1694 goto out;
1695 }
1696
1697 /* Grab the list of interfaces */
1698 if (getifaddrs(&interfaceArray)) {
1699 SYSERROR("failed to get interfaces list");
1700 goto out;
1701 }
1702
1703 /* Iterate through the interfaces */
1704 for (tempIfAddr = interfaceArray; tempIfAddr != NULL; tempIfAddr = tempIfAddr->ifa_next) {
1705 nbytes = write(pipefd[1], tempIfAddr->ifa_name, IFNAMSIZ);
1706 if (nbytes < 0) {
1707 ERROR("write failed");
1708 goto out;
1709 }
1710 count++;
1711 }
1712 ret = 0;
1713
1714 out:
1715 if (interfaceArray)
1716 freeifaddrs(interfaceArray);
1717
1718 /* close the write-end of the pipe, thus sending EOF to the reader */
1719 close(pipefd[1]);
1720 exit(ret);
1721 }
1722
1723 /* close the write-end of the pipe */
1724 close(pipefd[1]);
1725
1726 while (read(pipefd[0], &interface, IFNAMSIZ) == IFNAMSIZ) {
1727 if (array_contains(&interfaces, interface, count))
1728 continue;
1729
1730 if(!add_to_array(&interfaces, interface, count))
1731 ERROR("PARENT: add_to_array failed");
1732 count++;
1733 }
1734
1735 if (wait_for_pid(pid) != 0) {
1736 for(i=0;i<count;i++)
1737 free(interfaces[i]);
1738 free(interfaces);
1739 interfaces = NULL;
1740 }
1741
1742 /* close the read-end of the pipe */
1743 close(pipefd[0]);
1744
1745 /* Append NULL to the array */
1746 if(interfaces)
1747 interfaces = (char **)lxc_append_null_to_array((void **)interfaces, count);
1748
1749 return interfaces;
1750 }
1751
1752 WRAP_API(char **, lxcapi_get_interfaces)
1753
1754 static char** do_lxcapi_get_ips(struct lxc_container *c, const char* interface, const char* family, int scope)
1755 {
1756 pid_t pid;
1757 int i, count = 0, pipefd[2];
1758 char **addresses = NULL;
1759 char address[INET6_ADDRSTRLEN];
1760
1761 if(pipe(pipefd) < 0) {
1762 SYSERROR("pipe failed");
1763 return NULL;
1764 }
1765
1766 pid = fork();
1767 if (pid < 0) {
1768 SYSERROR("failed to fork task to get container ips");
1769 close(pipefd[0]);
1770 close(pipefd[1]);
1771 return NULL;
1772 }
1773
1774 if (pid == 0) { // child
1775 int ret = 1, nbytes;
1776 struct ifaddrs *interfaceArray = NULL, *tempIfAddr = NULL;
1777 char addressOutputBuffer[INET6_ADDRSTRLEN];
1778 void *tempAddrPtr = NULL;
1779 char *address = NULL;
1780
1781 /* close the read-end of the pipe */
1782 close(pipefd[0]);
1783
1784 if (!enter_net_ns(c)) {
1785 SYSERROR("failed to enter namespace");
1786 goto out;
1787 }
1788
1789 /* Grab the list of interfaces */
1790 if (getifaddrs(&interfaceArray)) {
1791 SYSERROR("failed to get interfaces list");
1792 goto out;
1793 }
1794
1795 /* Iterate through the interfaces */
1796 for (tempIfAddr = interfaceArray; tempIfAddr != NULL; tempIfAddr = tempIfAddr->ifa_next) {
1797 if (tempIfAddr->ifa_addr == NULL)
1798 continue;
1799
1800 if(tempIfAddr->ifa_addr->sa_family == AF_INET) {
1801 if (family && strcmp(family, "inet"))
1802 continue;
1803 tempAddrPtr = &((struct sockaddr_in *)tempIfAddr->ifa_addr)->sin_addr;
1804 }
1805 else {
1806 if (family && strcmp(family, "inet6"))
1807 continue;
1808
1809 if (((struct sockaddr_in6 *)tempIfAddr->ifa_addr)->sin6_scope_id != scope)
1810 continue;
1811
1812 tempAddrPtr = &((struct sockaddr_in6 *)tempIfAddr->ifa_addr)->sin6_addr;
1813 }
1814
1815 if (interface && strcmp(interface, tempIfAddr->ifa_name))
1816 continue;
1817 else if (!interface && strcmp("lo", tempIfAddr->ifa_name) == 0)
1818 continue;
1819
1820 address = (char *)inet_ntop(tempIfAddr->ifa_addr->sa_family,
1821 tempAddrPtr,
1822 addressOutputBuffer,
1823 sizeof(addressOutputBuffer));
1824 if (!address)
1825 continue;
1826
1827 nbytes = write(pipefd[1], address, INET6_ADDRSTRLEN);
1828 if (nbytes < 0) {
1829 ERROR("write failed");
1830 goto out;
1831 }
1832 count++;
1833 }
1834 ret = 0;
1835
1836 out:
1837 if(interfaceArray)
1838 freeifaddrs(interfaceArray);
1839
1840 /* close the write-end of the pipe, thus sending EOF to the reader */
1841 close(pipefd[1]);
1842 exit(ret);
1843 }
1844
1845 /* close the write-end of the pipe */
1846 close(pipefd[1]);
1847
1848 while (read(pipefd[0], &address, INET6_ADDRSTRLEN) == INET6_ADDRSTRLEN) {
1849 if(!add_to_array(&addresses, address, count))
1850 ERROR("PARENT: add_to_array failed");
1851 count++;
1852 }
1853
1854 if (wait_for_pid(pid) != 0) {
1855 for(i=0;i<count;i++)
1856 free(addresses[i]);
1857 free(addresses);
1858 addresses = NULL;
1859 }
1860
1861 /* close the read-end of the pipe */
1862 close(pipefd[0]);
1863
1864 /* Append NULL to the array */
1865 if(addresses)
1866 addresses = (char **)lxc_append_null_to_array((void **)addresses, count);
1867
1868 return addresses;
1869 }
1870
1871 WRAP_API_3(char **, lxcapi_get_ips, const char *, const char *, int)
1872
1873 static int do_lxcapi_get_config_item(struct lxc_container *c, const char *key, char *retv, int inlen)
1874 {
1875 int ret;
1876
1877 if (!c || !c->lxc_conf)
1878 return -1;
1879 if (container_mem_lock(c))
1880 return -1;
1881 ret = lxc_get_config_item(c->lxc_conf, key, retv, inlen);
1882 container_mem_unlock(c);
1883 return ret;
1884 }
1885
1886 WRAP_API_3(int, lxcapi_get_config_item, const char *, char *, int)
1887
1888 static char* do_lxcapi_get_running_config_item(struct lxc_container *c, const char *key)
1889 {
1890 char *ret;
1891
1892 if (!c || !c->lxc_conf)
1893 return NULL;
1894 if (container_mem_lock(c))
1895 return NULL;
1896 ret = lxc_cmd_get_config_item(c->name, key, do_lxcapi_get_config_path(c));
1897 container_mem_unlock(c);
1898 return ret;
1899 }
1900
1901 WRAP_API_1(char *, lxcapi_get_running_config_item, const char *)
1902
1903 static int do_lxcapi_get_keys(struct lxc_container *c, const char *key, char *retv, int inlen)
1904 {
1905 if (!key)
1906 return lxc_listconfigs(retv, inlen);
1907 /*
1908 * Support 'lxc.network.<idx>', i.e. 'lxc.network.0'
1909 * This is an intelligent result to show which keys are valid given
1910 * the type of nic it is
1911 */
1912 if (!c || !c->lxc_conf)
1913 return -1;
1914 if (container_mem_lock(c))
1915 return -1;
1916 int ret = -1;
1917 if (strncmp(key, "lxc.network.", 12) == 0)
1918 ret = lxc_list_nicconfigs(c->lxc_conf, key, retv, inlen);
1919 container_mem_unlock(c);
1920 return ret;
1921 }
1922
1923 WRAP_API_3(int, lxcapi_get_keys, const char *, char *, int)
1924
1925 static bool do_lxcapi_save_config(struct lxc_container *c, const char *alt_file)
1926 {
1927 FILE *fout;
1928 bool ret = false, need_disklock = false;
1929 int lret;
1930
1931 if (!alt_file)
1932 alt_file = c->configfile;
1933 if (!alt_file)
1934 return false; // should we write to stdout if no file is specified?
1935
1936 // If we haven't yet loaded a config, load the stock config
1937 if (!c->lxc_conf) {
1938 if (!do_lxcapi_load_config(c, lxc_global_config_value("lxc.default_config"))) {
1939 ERROR("Error loading default configuration file %s while saving %s", lxc_global_config_value("lxc.default_config"), c->name);
1940 return false;
1941 }
1942 }
1943
1944 if (!create_container_dir(c))
1945 return false;
1946
1947 /*
1948 * If we're writing to the container's config file, take the
1949 * disk lock. Otherwise just take the memlock to protect the
1950 * struct lxc_container while we're traversing it.
1951 */
1952 if (strcmp(c->configfile, alt_file) == 0)
1953 need_disklock = true;
1954
1955 if (need_disklock)
1956 lret = container_disk_lock(c);
1957 else
1958 lret = container_mem_lock(c);
1959
1960 if (lret)
1961 return false;
1962
1963 fout = fopen(alt_file, "w");
1964 if (!fout)
1965 goto out;
1966 write_config(fout, c->lxc_conf);
1967 fclose(fout);
1968 ret = true;
1969
1970 out:
1971 if (need_disklock)
1972 container_disk_unlock(c);
1973 else
1974 container_mem_unlock(c);
1975 return ret;
1976 }
1977
1978 WRAP_API_1(bool, lxcapi_save_config, const char *)
1979
1980 static bool mod_rdep(struct lxc_container *c, bool inc)
1981 {
1982 char path[MAXPATHLEN];
1983 int ret, v = 0;
1984 FILE *f;
1985 bool bret = false;
1986
1987 if (container_disk_lock(c))
1988 return false;
1989 ret = snprintf(path, MAXPATHLEN, "%s/%s/lxc_snapshots", c->config_path,
1990 c->name);
1991 if (ret < 0 || ret > MAXPATHLEN)
1992 goto out;
1993 f = fopen(path, "r");
1994 if (f) {
1995 ret = fscanf(f, "%d", &v);
1996 fclose(f);
1997 if (ret != 1) {
1998 ERROR("Corrupted file %s", path);
1999 goto out;
2000 }
2001 }
2002 v += inc ? 1 : -1;
2003 f = fopen(path, "w");
2004 if (!f)
2005 goto out;
2006 if (fprintf(f, "%d\n", v) < 0) {
2007 ERROR("Error writing new snapshots value");
2008 fclose(f);
2009 goto out;
2010 }
2011 ret = fclose(f);
2012 if (ret != 0) {
2013 SYSERROR("Error writing to or closing snapshots file");
2014 goto out;
2015 }
2016
2017 bret = true;
2018
2019 out:
2020 container_disk_unlock(c);
2021 return bret;
2022 }
2023
2024 static void strip_newline(char *p)
2025 {
2026 size_t len = strlen(p);
2027 if (len < 1)
2028 return;
2029 if (p[len-1] == '\n')
2030 p[len-1] = '\0';
2031 }
2032
2033 static void mod_all_rdeps(struct lxc_container *c, bool inc)
2034 {
2035 struct lxc_container *p;
2036 char *lxcpath = NULL, *lxcname = NULL, path[MAXPATHLEN];
2037 size_t pathlen = 0, namelen = 0;
2038 FILE *f;
2039 int ret;
2040
2041 ret = snprintf(path, MAXPATHLEN, "%s/%s/lxc_rdepends",
2042 c->config_path, c->name);
2043 if (ret < 0 || ret >= MAXPATHLEN) {
2044 ERROR("Path name too long");
2045 return;
2046 }
2047 f = fopen(path, "r");
2048 if (f == NULL)
2049 return;
2050 while (getline(&lxcpath, &pathlen, f) != -1) {
2051 if (getline(&lxcname, &namelen, f) == -1) {
2052 ERROR("badly formatted file %s", path);
2053 goto out;
2054 }
2055 strip_newline(lxcpath);
2056 strip_newline(lxcname);
2057 if ((p = lxc_container_new(lxcname, lxcpath)) == NULL) {
2058 ERROR("Unable to find dependent container %s:%s",
2059 lxcpath, lxcname);
2060 continue;
2061 }
2062 if (!mod_rdep(p, inc))
2063 ERROR("Failed to increase numsnapshots for %s:%s",
2064 lxcpath, lxcname);
2065 lxc_container_put(p);
2066 }
2067 out:
2068 free(lxcpath);
2069 free(lxcname);
2070 fclose(f);
2071 }
2072
2073 static bool has_fs_snapshots(struct lxc_container *c)
2074 {
2075 char path[MAXPATHLEN];
2076 int ret, v;
2077 FILE *f;
2078 bool bret = false;
2079
2080 ret = snprintf(path, MAXPATHLEN, "%s/%s/lxc_snapshots", c->config_path,
2081 c->name);
2082 if (ret < 0 || ret > MAXPATHLEN)
2083 goto out;
2084 f = fopen(path, "r");
2085 if (!f)
2086 goto out;
2087 ret = fscanf(f, "%d", &v);
2088 fclose(f);
2089 if (ret != 1)
2090 goto out;
2091 bret = v != 0;
2092
2093 out:
2094 return bret;
2095 }
2096
2097 static bool has_snapshots(struct lxc_container *c)
2098 {
2099 char path[MAXPATHLEN];
2100 struct dirent dirent, *direntp;
2101 int count=0;
2102 DIR *dir;
2103
2104 if (!get_snappath_dir(c, path))
2105 return false;
2106 dir = opendir(path);
2107 if (!dir)
2108 return false;
2109 while (!readdir_r(dir, &dirent, &direntp)) {
2110 if (!direntp)
2111 break;
2112
2113 if (!strcmp(direntp->d_name, "."))
2114 continue;
2115
2116 if (!strcmp(direntp->d_name, ".."))
2117 continue;
2118 count++;
2119 break;
2120 }
2121 closedir(dir);
2122 return count > 0;
2123 }
2124
2125 static int lxc_rmdir_onedev_wrapper(void *data)
2126 {
2127 char *arg = (char *) data;
2128 return lxc_rmdir_onedev(arg, "snaps");
2129 }
2130
2131 static int do_bdev_destroy(struct lxc_conf *conf)
2132 {
2133 struct bdev *r;
2134 int ret = 0;
2135
2136 r = bdev_init(conf, conf->rootfs.path, conf->rootfs.mount, NULL);
2137 if (!r)
2138 return -1;
2139
2140 if (r->ops->destroy(r) < 0)
2141 ret = -1;
2142 bdev_put(r);
2143 return ret;
2144 }
2145
2146 static int bdev_destroy_wrapper(void *data)
2147 {
2148 struct lxc_conf *conf = data;
2149
2150 if (setgid(0) < 0) {
2151 ERROR("Failed to setgid to 0");
2152 return -1;
2153 }
2154 if (setgroups(0, NULL) < 0)
2155 WARN("Failed to clear groups");
2156 if (setuid(0) < 0) {
2157 ERROR("Failed to setuid to 0");
2158 return -1;
2159 }
2160 return do_bdev_destroy(conf);
2161 }
2162
2163 static bool container_destroy(struct lxc_container *c)
2164 {
2165 bool bret = false;
2166 int ret;
2167
2168 if (!c || !do_lxcapi_is_defined(c))
2169 return false;
2170
2171 if (container_disk_lock(c))
2172 return false;
2173
2174 if (!is_stopped(c)) {
2175 // we should queue some sort of error - in c->error_string?
2176 ERROR("container %s is not stopped", c->name);
2177 goto out;
2178 }
2179
2180 if (c->lxc_conf && c->lxc_conf->rootfs.path && c->lxc_conf->rootfs.mount) {
2181 if (am_unpriv())
2182 ret = userns_exec_1(c->lxc_conf, bdev_destroy_wrapper, c->lxc_conf);
2183 else
2184 ret = do_bdev_destroy(c->lxc_conf);
2185 if (ret < 0) {
2186 ERROR("Error destroying rootfs for %s", c->name);
2187 goto out;
2188 }
2189 }
2190
2191 mod_all_rdeps(c, false);
2192
2193 const char *p1 = do_lxcapi_get_config_path(c);
2194 char *path = alloca(strlen(p1) + strlen(c->name) + 2);
2195 sprintf(path, "%s/%s", p1, c->name);
2196 if (am_unpriv())
2197 ret = userns_exec_1(c->lxc_conf, lxc_rmdir_onedev_wrapper, path);
2198 else
2199 ret = lxc_rmdir_onedev(path, "snaps");
2200 if (ret < 0) {
2201 ERROR("Error destroying container directory for %s", c->name);
2202 goto out;
2203 }
2204 bret = true;
2205
2206 out:
2207 container_disk_unlock(c);
2208 return bret;
2209 }
2210
2211 static bool do_lxcapi_destroy(struct lxc_container *c)
2212 {
2213 if (!c || !lxcapi_is_defined(c))
2214 return false;
2215 if (has_snapshots(c)) {
2216 ERROR("Container %s has snapshots; not removing", c->name);
2217 return false;
2218 }
2219
2220 if (has_fs_snapshots(c)) {
2221 ERROR("container %s has snapshots on its rootfs", c->name);
2222 return false;
2223 }
2224
2225 return container_destroy(c);
2226 }
2227
2228 WRAP_API(bool, lxcapi_destroy)
2229
2230 static bool do_lxcapi_destroy_with_snapshots(struct lxc_container *c)
2231 {
2232 if (!c || !lxcapi_is_defined(c))
2233 return false;
2234 if (!lxcapi_snapshot_destroy_all(c)) {
2235 ERROR("Error deleting all snapshots");
2236 return false;
2237 }
2238 return lxcapi_destroy(c);
2239 }
2240
2241 WRAP_API(bool, lxcapi_destroy_with_snapshots)
2242
2243 static bool set_config_item_locked(struct lxc_container *c, const char *key, const char *v)
2244 {
2245 struct lxc_config_t *config;
2246
2247 if (!c->lxc_conf)
2248 c->lxc_conf = lxc_conf_init();
2249 if (!c->lxc_conf)
2250 return false;
2251 config = lxc_getconfig(key);
2252 if (!config)
2253 return false;
2254 if (config->cb(key, v, c->lxc_conf) != 0)
2255 return false;
2256 return do_append_unexp_config_line(c->lxc_conf, key, v);
2257 }
2258
2259 static bool do_lxcapi_set_config_item(struct lxc_container *c, const char *key, const char *v)
2260 {
2261 bool b = false;
2262
2263 if (!c)
2264 return false;
2265
2266 if (container_mem_lock(c))
2267 return false;
2268
2269 b = set_config_item_locked(c, key, v);
2270
2271 container_mem_unlock(c);
2272 return b;
2273 }
2274
2275 WRAP_API_2(bool, lxcapi_set_config_item, const char *, const char *)
2276
2277 static char *lxcapi_config_file_name(struct lxc_container *c)
2278 {
2279 if (!c || !c->configfile)
2280 return NULL;
2281 return strdup(c->configfile);
2282 }
2283
2284 static const char *lxcapi_get_config_path(struct lxc_container *c)
2285 {
2286 if (!c || !c->config_path)
2287 return NULL;
2288 return (const char *)(c->config_path);
2289 }
2290
2291 /*
2292 * not for export
2293 * Just recalculate the c->configfile based on the
2294 * c->config_path, which must be set.
2295 * The lxc_container must be locked or not yet public.
2296 */
2297 static bool set_config_filename(struct lxc_container *c)
2298 {
2299 char *newpath;
2300 int len, ret;
2301
2302 if (!c->config_path)
2303 return false;
2304
2305 /* $lxc_path + "/" + c->name + "/" + "config" + '\0' */
2306 len = strlen(c->config_path) + strlen(c->name) + strlen("config") + 3;
2307 newpath = malloc(len);
2308 if (!newpath)
2309 return false;
2310
2311 ret = snprintf(newpath, len, "%s/%s/config", c->config_path, c->name);
2312 if (ret < 0 || ret >= len) {
2313 fprintf(stderr, "Error printing out config file name\n");
2314 free(newpath);
2315 return false;
2316 }
2317
2318 free(c->configfile);
2319 c->configfile = newpath;
2320
2321 return true;
2322 }
2323
2324 static bool do_lxcapi_set_config_path(struct lxc_container *c, const char *path)
2325 {
2326 char *p;
2327 bool b = false;
2328 char *oldpath = NULL;
2329
2330 if (!c)
2331 return b;
2332
2333 if (container_mem_lock(c))
2334 return b;
2335
2336 p = strdup(path);
2337 if (!p) {
2338 ERROR("Out of memory setting new lxc path");
2339 goto err;
2340 }
2341
2342 b = true;
2343 if (c->config_path)
2344 oldpath = c->config_path;
2345 c->config_path = p;
2346
2347 /* Since we've changed the config path, we have to change the
2348 * config file name too */
2349 if (!set_config_filename(c)) {
2350 ERROR("Out of memory setting new config filename");
2351 b = false;
2352 free(c->config_path);
2353 c->config_path = oldpath;
2354 oldpath = NULL;
2355 }
2356 err:
2357 free(oldpath);
2358 container_mem_unlock(c);
2359 return b;
2360 }
2361
2362 WRAP_API_1(bool, lxcapi_set_config_path, const char *)
2363
2364 static bool do_lxcapi_set_cgroup_item(struct lxc_container *c, const char *subsys, const char *value)
2365 {
2366 int ret;
2367
2368 if (!c)
2369 return false;
2370
2371 if (is_stopped(c))
2372 return false;
2373
2374 if (container_disk_lock(c))
2375 return false;
2376
2377 ret = lxc_cgroup_set(subsys, value, c->name, c->config_path);
2378
2379 container_disk_unlock(c);
2380 return ret == 0;
2381 }
2382
2383 WRAP_API_2(bool, lxcapi_set_cgroup_item, const char *, const char *)
2384
2385 static int do_lxcapi_get_cgroup_item(struct lxc_container *c, const char *subsys, char *retv, int inlen)
2386 {
2387 int ret;
2388
2389 if (!c)
2390 return -1;
2391
2392 if (is_stopped(c))
2393 return -1;
2394
2395 if (container_disk_lock(c))
2396 return -1;
2397
2398 ret = lxc_cgroup_get(subsys, retv, inlen, c->name, c->config_path);
2399
2400 container_disk_unlock(c);
2401 return ret;
2402 }
2403
2404 WRAP_API_3(int, lxcapi_get_cgroup_item, const char *, char *, int)
2405
2406 const char *lxc_get_global_config_item(const char *key)
2407 {
2408 return lxc_global_config_value(key);
2409 }
2410
2411 const char *lxc_get_version(void)
2412 {
2413 return LXC_VERSION;
2414 }
2415
2416 static int copy_file(const char *old, const char *new)
2417 {
2418 int in, out;
2419 ssize_t len, ret;
2420 char buf[8096];
2421 struct stat sbuf;
2422
2423 if (file_exists(new)) {
2424 ERROR("copy destination %s exists", new);
2425 return -1;
2426 }
2427 ret = stat(old, &sbuf);
2428 if (ret < 0) {
2429 INFO("Error stat'ing %s", old);
2430 return -1;
2431 }
2432
2433 in = open(old, O_RDONLY);
2434 if (in < 0) {
2435 SYSERROR("Error opening original file %s", old);
2436 return -1;
2437 }
2438 out = open(new, O_CREAT | O_EXCL | O_WRONLY, 0644);
2439 if (out < 0) {
2440 SYSERROR("Error opening new file %s", new);
2441 close(in);
2442 return -1;
2443 }
2444
2445 while (1) {
2446 len = read(in, buf, 8096);
2447 if (len < 0) {
2448 SYSERROR("Error reading old file %s", old);
2449 goto err;
2450 }
2451 if (len == 0)
2452 break;
2453 ret = write(out, buf, len);
2454 if (ret < len) { // should we retry?
2455 SYSERROR("Error: write to new file %s was interrupted", new);
2456 goto err;
2457 }
2458 }
2459 close(in);
2460 close(out);
2461
2462 // we set mode, but not owner/group
2463 ret = chmod(new, sbuf.st_mode);
2464 if (ret) {
2465 SYSERROR("Error setting mode on %s", new);
2466 return -1;
2467 }
2468
2469 return 0;
2470
2471 err:
2472 close(in);
2473 close(out);
2474 return -1;
2475 }
2476
2477 static int copyhooks(struct lxc_container *oldc, struct lxc_container *c)
2478 {
2479 int i, len, ret;
2480 struct lxc_list *it;
2481 char *cpath;
2482
2483 len = strlen(oldc->config_path) + strlen(oldc->name) + 3;
2484 cpath = alloca(len);
2485 ret = snprintf(cpath, len, "%s/%s/", oldc->config_path, oldc->name);
2486 if (ret < 0 || ret >= len)
2487 return -1;
2488
2489 for (i=0; i<NUM_LXC_HOOKS; i++) {
2490 lxc_list_for_each(it, &c->lxc_conf->hooks[i]) {
2491 char *hookname = it->elem;
2492 char *fname = strrchr(hookname, '/');
2493 char tmppath[MAXPATHLEN];
2494 if (!fname) // relative path - we don't support, but maybe we should
2495 return 0;
2496 if (strncmp(hookname, cpath, len - 1) != 0) {
2497 // this hook is public - ignore
2498 continue;
2499 }
2500 // copy the script, and change the entry in confile
2501 ret = snprintf(tmppath, MAXPATHLEN, "%s/%s/%s",
2502 c->config_path, c->name, fname+1);
2503 if (ret < 0 || ret >= MAXPATHLEN)
2504 return -1;
2505 ret = copy_file(it->elem, tmppath);
2506 if (ret < 0)
2507 return -1;
2508 free(it->elem);
2509 it->elem = strdup(tmppath);
2510 if (!it->elem) {
2511 ERROR("out of memory copying hook path");
2512 return -1;
2513 }
2514 }
2515 }
2516
2517 if (!clone_update_unexp_hooks(c->lxc_conf, oldc->config_path,
2518 c->config_path, oldc->name, c->name)) {
2519 ERROR("Error saving new hooks in clone");
2520 return -1;
2521 }
2522 do_lxcapi_save_config(c, NULL);
2523 return 0;
2524 }
2525
2526
2527 static int copy_fstab(struct lxc_container *oldc, struct lxc_container *c)
2528 {
2529 char newpath[MAXPATHLEN];
2530 char *oldpath = oldc->lxc_conf->fstab;
2531 int ret;
2532
2533 if (!oldpath)
2534 return 0;
2535
2536 clear_unexp_config_line(c->lxc_conf, "lxc.mount", false);
2537
2538 char *p = strrchr(oldpath, '/');
2539 if (!p)
2540 return -1;
2541 ret = snprintf(newpath, MAXPATHLEN, "%s/%s%s",
2542 c->config_path, c->name, p);
2543 if (ret < 0 || ret >= MAXPATHLEN) {
2544 ERROR("error printing new path for %s", oldpath);
2545 return -1;
2546 }
2547 if (file_exists(newpath)) {
2548 ERROR("error: fstab file %s exists", newpath);
2549 return -1;
2550 }
2551
2552 if (copy_file(oldpath, newpath) < 0) {
2553 ERROR("error: copying %s to %s", oldpath, newpath);
2554 return -1;
2555 }
2556 free(c->lxc_conf->fstab);
2557 c->lxc_conf->fstab = strdup(newpath);
2558 if (!c->lxc_conf->fstab) {
2559 ERROR("error: allocating pathname");
2560 return -1;
2561 }
2562 if (!do_append_unexp_config_line(c->lxc_conf, "lxc.mount", newpath)) {
2563 ERROR("error saving new lxctab");
2564 return -1;
2565 }
2566
2567 return 0;
2568 }
2569
2570 static void copy_rdepends(struct lxc_container *c, struct lxc_container *c0)
2571 {
2572 char path0[MAXPATHLEN], path1[MAXPATHLEN];
2573 int ret;
2574
2575 ret = snprintf(path0, MAXPATHLEN, "%s/%s/lxc_rdepends", c0->config_path,
2576 c0->name);
2577 if (ret < 0 || ret >= MAXPATHLEN) {
2578 WARN("Error copying reverse dependencies");
2579 return;
2580 }
2581 ret = snprintf(path1, MAXPATHLEN, "%s/%s/lxc_rdepends", c->config_path,
2582 c->name);
2583 if (ret < 0 || ret >= MAXPATHLEN) {
2584 WARN("Error copying reverse dependencies");
2585 return;
2586 }
2587 if (copy_file(path0, path1) < 0) {
2588 INFO("Error copying reverse dependencies");
2589 return;
2590 }
2591 }
2592
2593 static bool add_rdepends(struct lxc_container *c, struct lxc_container *c0)
2594 {
2595 int ret;
2596 char path[MAXPATHLEN];
2597 FILE *f;
2598 bool bret;
2599
2600 ret = snprintf(path, MAXPATHLEN, "%s/%s/lxc_rdepends", c->config_path,
2601 c->name);
2602 if (ret < 0 || ret >= MAXPATHLEN)
2603 return false;
2604 f = fopen(path, "a");
2605 if (!f)
2606 return false;
2607 bret = true;
2608 // if anything goes wrong, just return an error
2609 if (fprintf(f, "%s\n%s\n", c0->config_path, c0->name) < 0)
2610 bret = false;
2611 if (fclose(f) != 0)
2612 bret = false;
2613 return bret;
2614 }
2615
2616 static int copy_storage(struct lxc_container *c0, struct lxc_container *c,
2617 const char *newtype, int flags, const char *bdevdata, uint64_t newsize)
2618 {
2619 struct bdev *bdev;
2620 int need_rdep;
2621
2622 bdev = bdev_copy(c0, c->name, c->config_path, newtype, flags,
2623 bdevdata, newsize, &need_rdep);
2624 if (!bdev) {
2625 ERROR("Error copying storage");
2626 return -1;
2627 }
2628 free(c->lxc_conf->rootfs.path);
2629 c->lxc_conf->rootfs.path = strdup(bdev->src);
2630 bdev_put(bdev);
2631 if (!c->lxc_conf->rootfs.path) {
2632 ERROR("Out of memory while setting storage path");
2633 return -1;
2634 }
2635 // We will simply append a new lxc.rootfs entry to the unexpanded config
2636 clear_unexp_config_line(c->lxc_conf, "lxc.rootfs", false);
2637 if (!do_append_unexp_config_line(c->lxc_conf, "lxc.rootfs", c->lxc_conf->rootfs.path)) {
2638 ERROR("Error saving new rootfs to cloend config");
2639 return -1;
2640 }
2641 if (flags & LXC_CLONE_SNAPSHOT)
2642 copy_rdepends(c, c0);
2643 if (need_rdep) {
2644 if (!add_rdepends(c, c0))
2645 WARN("Error adding reverse dependency from %s to %s",
2646 c->name, c0->name);
2647 }
2648
2649 mod_all_rdeps(c, true);
2650
2651 return 0;
2652 }
2653
2654 struct clone_update_data {
2655 struct lxc_container *c0;
2656 struct lxc_container *c1;
2657 int flags;
2658 char **hookargs;
2659 };
2660
2661 static int clone_update_rootfs(struct clone_update_data *data)
2662 {
2663 struct lxc_container *c0 = data->c0;
2664 struct lxc_container *c = data->c1;
2665 int flags = data->flags;
2666 char **hookargs = data->hookargs;
2667 int ret = -1;
2668 char path[MAXPATHLEN];
2669 struct bdev *bdev;
2670 FILE *fout;
2671 struct lxc_conf *conf = c->lxc_conf;
2672
2673 /* update hostname in rootfs */
2674 /* we're going to mount, so run in a clean namespace to simplify cleanup */
2675
2676 if (setgid(0) < 0) {
2677 ERROR("Failed to setgid to 0");
2678 return -1;
2679 }
2680 if (setuid(0) < 0) {
2681 ERROR("Failed to setuid to 0");
2682 return -1;
2683 }
2684 if (setgroups(0, NULL) < 0)
2685 WARN("Failed to clear groups");
2686
2687 if (unshare(CLONE_NEWNS) < 0)
2688 return -1;
2689 bdev = bdev_init(c->lxc_conf, c->lxc_conf->rootfs.path, c->lxc_conf->rootfs.mount, NULL);
2690 if (!bdev)
2691 return -1;
2692 if (strcmp(bdev->type, "dir") != 0) {
2693 if (unshare(CLONE_NEWNS) < 0) {
2694 ERROR("error unsharing mounts");
2695 bdev_put(bdev);
2696 return -1;
2697 }
2698 if (detect_shared_rootfs()) {
2699 if (mount(NULL, "/", NULL, MS_SLAVE|MS_REC, NULL)) {
2700 SYSERROR("Failed to make / rslave");
2701 ERROR("Continuing...");
2702 }
2703 }
2704 if (bdev->ops->mount(bdev) < 0) {
2705 bdev_put(bdev);
2706 return -1;
2707 }
2708 } else { // TODO come up with a better way
2709 free(bdev->dest);
2710 bdev->dest = strdup(bdev->src);
2711 }
2712
2713 if (!lxc_list_empty(&conf->hooks[LXCHOOK_CLONE])) {
2714 /* Start of environment variable setup for hooks */
2715 if (setenv("LXC_SRC_NAME", c0->name, 1)) {
2716 SYSERROR("failed to set environment variable for source container name");
2717 }
2718 if (setenv("LXC_NAME", c->name, 1)) {
2719 SYSERROR("failed to set environment variable for container name");
2720 }
2721 if (setenv("LXC_CONFIG_FILE", conf->rcfile, 1)) {
2722 SYSERROR("failed to set environment variable for config path");
2723 }
2724 if (setenv("LXC_ROOTFS_MOUNT", bdev->dest, 1)) {
2725 SYSERROR("failed to set environment variable for rootfs mount");
2726 }
2727 if (setenv("LXC_ROOTFS_PATH", conf->rootfs.path, 1)) {
2728 SYSERROR("failed to set environment variable for rootfs mount");
2729 }
2730
2731 if (run_lxc_hooks(c->name, "clone", conf, c->get_config_path(c), hookargs)) {
2732 ERROR("Error executing clone hook for %s", c->name);
2733 bdev_put(bdev);
2734 return -1;
2735 }
2736 }
2737
2738 if (!(flags & LXC_CLONE_KEEPNAME)) {
2739 ret = snprintf(path, MAXPATHLEN, "%s/etc/hostname", bdev->dest);
2740 bdev_put(bdev);
2741
2742 if (ret < 0 || ret >= MAXPATHLEN)
2743 return -1;
2744 if (!file_exists(path))
2745 return 0;
2746 if (!(fout = fopen(path, "w"))) {
2747 SYSERROR("unable to open %s: ignoring", path);
2748 return 0;
2749 }
2750 if (fprintf(fout, "%s", c->name) < 0) {
2751 fclose(fout);
2752 return -1;
2753 }
2754 if (fclose(fout) < 0)
2755 return -1;
2756 }
2757 else
2758 bdev_put(bdev);
2759
2760 return 0;
2761 }
2762
2763 static int clone_update_rootfs_wrapper(void *data)
2764 {
2765 struct clone_update_data *arg = (struct clone_update_data *) data;
2766 return clone_update_rootfs(arg);
2767 }
2768
2769 /*
2770 * We want to support:
2771 sudo lxc-clone -o o1 -n n1 -s -L|-fssize fssize -v|--vgname vgname \
2772 -p|--lvprefix lvprefix -t|--fstype fstype -B backingstore
2773
2774 -s [ implies overlayfs]
2775 -s -B overlayfs
2776 -s -B aufs
2777
2778 only rootfs gets converted (copied/snapshotted) on clone.
2779 */
2780
2781 static int create_file_dirname(char *path, struct lxc_conf *conf)
2782 {
2783 char *p = strrchr(path, '/');
2784 int ret = -1;
2785
2786 if (!p)
2787 return -1;
2788 *p = '\0';
2789 ret = do_create_container_dir(path, conf);
2790 *p = '/';
2791 return ret;
2792 }
2793
2794 static struct lxc_container *do_lxcapi_clone(struct lxc_container *c, const char *newname,
2795 const char *lxcpath, int flags,
2796 const char *bdevtype, const char *bdevdata, uint64_t newsize,
2797 char **hookargs)
2798 {
2799 struct lxc_container *c2 = NULL;
2800 char newpath[MAXPATHLEN];
2801 int ret, storage_copied = 0;
2802 char *origroot = NULL;
2803 struct clone_update_data data;
2804 FILE *fout;
2805 pid_t pid;
2806
2807 if (!c || !do_lxcapi_is_defined(c))
2808 return NULL;
2809
2810 if (container_mem_lock(c))
2811 return NULL;
2812
2813 if (!is_stopped(c)) {
2814 ERROR("error: Original container (%s) is running", c->name);
2815 goto out;
2816 }
2817
2818 // Make sure the container doesn't yet exist.
2819 if (!newname)
2820 newname = c->name;
2821 if (!lxcpath)
2822 lxcpath = do_lxcapi_get_config_path(c);
2823 ret = snprintf(newpath, MAXPATHLEN, "%s/%s/config", lxcpath, newname);
2824 if (ret < 0 || ret >= MAXPATHLEN) {
2825 SYSERROR("clone: failed making config pathname");
2826 goto out;
2827 }
2828 if (file_exists(newpath)) {
2829 ERROR("error: clone: %s exists", newpath);
2830 goto out;
2831 }
2832
2833 ret = create_file_dirname(newpath, c->lxc_conf);
2834 if (ret < 0 && errno != EEXIST) {
2835 ERROR("Error creating container dir for %s", newpath);
2836 goto out;
2837 }
2838
2839 // copy the configuration, tweak it as needed,
2840 if (c->lxc_conf->rootfs.path) {
2841 origroot = c->lxc_conf->rootfs.path;
2842 c->lxc_conf->rootfs.path = NULL;
2843 }
2844 fout = fopen(newpath, "w");
2845 if (!fout) {
2846 SYSERROR("open %s", newpath);
2847 goto out;
2848 }
2849 write_config(fout, c->lxc_conf);
2850 fclose(fout);
2851 c->lxc_conf->rootfs.path = origroot;
2852
2853 sprintf(newpath, "%s/%s/rootfs", lxcpath, newname);
2854 if (mkdir(newpath, 0755) < 0) {
2855 SYSERROR("error creating %s", newpath);
2856 goto out;
2857 }
2858
2859 if (am_unpriv()) {
2860 if (chown_mapped_root(newpath, c->lxc_conf) < 0) {
2861 ERROR("Error chowning %s to container root", newpath);
2862 goto out;
2863 }
2864 }
2865
2866 c2 = lxc_container_new(newname, lxcpath);
2867 if (!c2) {
2868 ERROR("clone: failed to create new container (%s %s)", newname,
2869 lxcpath);
2870 goto out;
2871 }
2872
2873 // copy/snapshot rootfs's
2874 ret = copy_storage(c, c2, bdevtype, flags, bdevdata, newsize);
2875 if (ret < 0)
2876 goto out;
2877
2878 clear_unexp_config_line(c2->lxc_conf, "lxc.utsname", false);
2879
2880 // update utsname
2881 if (!set_config_item_locked(c2, "lxc.utsname", newname)) {
2882 ERROR("Error setting new hostname");
2883 goto out;
2884 }
2885
2886 // copy hooks
2887 ret = copyhooks(c, c2);
2888 if (ret < 0) {
2889 ERROR("error copying hooks");
2890 goto out;
2891 }
2892
2893 if (copy_fstab(c, c2) < 0) {
2894 ERROR("error copying fstab");
2895 goto out;
2896 }
2897
2898 // update macaddrs
2899 if (!(flags & LXC_CLONE_KEEPMACADDR)) {
2900 if (!network_new_hwaddrs(c2->lxc_conf)) {
2901 ERROR("Error updating mac addresses");
2902 goto out;
2903 }
2904 }
2905
2906 // We've now successfully created c2's storage, so clear it out if we
2907 // fail after this
2908 storage_copied = 1;
2909
2910 if (!c2->save_config(c2, NULL))
2911 goto out;
2912
2913 if ((pid = fork()) < 0) {
2914 SYSERROR("fork");
2915 goto out;
2916 }
2917 if (pid > 0) {
2918 ret = wait_for_pid(pid);
2919 if (ret)
2920 goto out;
2921 container_mem_unlock(c);
2922 return c2;
2923 }
2924 data.c0 = c;
2925 data.c1 = c2;
2926 data.flags = flags;
2927 data.hookargs = hookargs;
2928 if (am_unpriv())
2929 ret = userns_exec_1(c->lxc_conf, clone_update_rootfs_wrapper,
2930 &data);
2931 else
2932 ret = clone_update_rootfs(&data);
2933 if (ret < 0)
2934 exit(1);
2935
2936 container_mem_unlock(c);
2937 exit(0);
2938
2939 out:
2940 container_mem_unlock(c);
2941 if (c2) {
2942 if (!storage_copied)
2943 c2->lxc_conf->rootfs.path = NULL;
2944 c2->destroy(c2);
2945 lxc_container_put(c2);
2946 }
2947
2948 return NULL;
2949 }
2950
2951 static struct lxc_container *lxcapi_clone(struct lxc_container *c, const char *newname,
2952 const char *lxcpath, int flags,
2953 const char *bdevtype, const char *bdevdata, uint64_t newsize,
2954 char **hookargs)
2955 {
2956 struct lxc_container * ret;
2957 struct lxc_conf *old = current_config;
2958 current_config = c ? c->lxc_conf : NULL;
2959 ret = do_lxcapi_clone(c, newname, lxcpath, flags, bdevtype, bdevdata, newsize, hookargs);
2960 current_config = old;
2961 return ret;
2962 }
2963
2964 static bool do_lxcapi_rename(struct lxc_container *c, const char *newname)
2965 {
2966 struct bdev *bdev;
2967 struct lxc_container *newc;
2968
2969 if (!c || !c->name || !c->config_path || !c->lxc_conf)
2970 return false;
2971
2972 if (has_fs_snapshots(c) || has_snapshots(c)) {
2973 ERROR("Renaming a container with snapshots is not supported");
2974 return false;
2975 }
2976 bdev = bdev_init(c->lxc_conf, c->lxc_conf->rootfs.path, c->lxc_conf->rootfs.mount, NULL);
2977 if (!bdev) {
2978 ERROR("Failed to find original backing store type");
2979 return false;
2980 }
2981
2982 newc = lxcapi_clone(c, newname, c->config_path, LXC_CLONE_KEEPMACADDR, NULL, bdev->type, 0, NULL);
2983 bdev_put(bdev);
2984 if (!newc) {
2985 lxc_container_put(newc);
2986 return false;
2987 }
2988
2989 if (newc && lxcapi_is_defined(newc))
2990 lxc_container_put(newc);
2991
2992 if (!container_destroy(c)) {
2993 ERROR("Could not destroy existing container %s", c->name);
2994 return false;
2995 }
2996 return true;
2997 }
2998
2999 WRAP_API_1(bool, lxcapi_rename, const char *)
3000
3001 static int lxcapi_attach(struct lxc_container *c, lxc_attach_exec_t exec_function, void *exec_payload, lxc_attach_options_t *options, pid_t *attached_process)
3002 {
3003 struct lxc_conf *old = current_config;
3004 int ret;
3005
3006 if (!c)
3007 return -1;
3008
3009 current_config = c->lxc_conf;
3010
3011 ret = lxc_attach(c->name, c->config_path, exec_function, exec_payload, options, attached_process);
3012 current_config = old;
3013 return ret;
3014 }
3015
3016 static int do_lxcapi_attach_run_wait(struct lxc_container *c, lxc_attach_options_t *options, const char *program, const char * const argv[])
3017 {
3018 lxc_attach_command_t command;
3019 pid_t pid;
3020 int r;
3021
3022 if (!c)
3023 return -1;
3024
3025 command.program = (char*)program;
3026 command.argv = (char**)argv;
3027 r = lxc_attach(c->name, c->config_path, lxc_attach_run_command, &command, options, &pid);
3028 if (r < 0) {
3029 ERROR("ups");
3030 return r;
3031 }
3032 return lxc_wait_for_pid_status(pid);
3033 }
3034
3035 static int lxcapi_attach_run_wait(struct lxc_container *c, lxc_attach_options_t *options, const char *program, const char * const argv[])
3036 {
3037 int ret;
3038 struct lxc_conf *old = current_config;
3039 current_config = c ? c->lxc_conf : NULL;
3040 ret = do_lxcapi_attach_run_wait(c, options, program, argv);
3041 current_config = old;
3042 return ret;
3043 }
3044
3045 static int get_next_index(const char *lxcpath, char *cname)
3046 {
3047 char *fname;
3048 struct stat sb;
3049 int i = 0, ret;
3050
3051 fname = alloca(strlen(lxcpath) + 20);
3052 while (1) {
3053 sprintf(fname, "%s/snap%d", lxcpath, i);
3054 ret = stat(fname, &sb);
3055 if (ret != 0)
3056 return i;
3057 i++;
3058 }
3059 }
3060
3061 static bool get_snappath_dir(struct lxc_container *c, char *snappath)
3062 {
3063 int ret;
3064 /*
3065 * If the old style snapshot path exists, use it
3066 * /var/lib/lxc -> /var/lib/lxcsnaps
3067 */
3068 ret = snprintf(snappath, MAXPATHLEN, "%ssnaps", c->config_path);
3069 if (ret < 0 || ret >= MAXPATHLEN)
3070 return false;
3071 if (dir_exists(snappath)) {
3072 ret = snprintf(snappath, MAXPATHLEN, "%ssnaps/%s", c->config_path, c->name);
3073 if (ret < 0 || ret >= MAXPATHLEN)
3074 return false;
3075 return true;
3076 }
3077
3078 /*
3079 * Use the new style path
3080 * /var/lib/lxc -> /var/lib/lxc + c->name + /snaps + \0
3081 */
3082 ret = snprintf(snappath, MAXPATHLEN, "%s/%s/snaps", c->config_path, c->name);
3083 if (ret < 0 || ret >= MAXPATHLEN)
3084 return false;
3085 return true;
3086 }
3087
3088 static int do_lxcapi_snapshot(struct lxc_container *c, const char *commentfile)
3089 {
3090 int i, flags, ret;
3091 struct lxc_container *c2;
3092 char snappath[MAXPATHLEN], newname[20];
3093
3094 if (!c || !lxcapi_is_defined(c))
3095 return -1;
3096
3097 if (!bdev_can_backup(c->lxc_conf)) {
3098 ERROR("%s's backing store cannot be backed up.", c->name);
3099 ERROR("Your container must use another backing store type.");
3100 return -1;
3101 }
3102
3103 if (!get_snappath_dir(c, snappath))
3104 return -1;
3105
3106 i = get_next_index(snappath, c->name);
3107
3108 if (mkdir_p(snappath, 0755) < 0) {
3109 ERROR("Failed to create snapshot directory %s", snappath);
3110 return -1;
3111 }
3112
3113 ret = snprintf(newname, 20, "snap%d", i);
3114 if (ret < 0 || ret >= 20)
3115 return -1;
3116
3117 /*
3118 * We pass LXC_CLONE_SNAPSHOT to make sure that a rdepends file entry is
3119 * created in the original container
3120 */
3121 flags = LXC_CLONE_SNAPSHOT | LXC_CLONE_KEEPMACADDR | LXC_CLONE_KEEPNAME |
3122 LXC_CLONE_KEEPBDEVTYPE | LXC_CLONE_MAYBE_SNAPSHOT;
3123 if (bdev_is_dir(c->lxc_conf, c->lxc_conf->rootfs.path)) {
3124 ERROR("Snapshot of directory-backed container requested.");
3125 ERROR("Making a copy-clone. If you do want snapshots, then");
3126 ERROR("please create an aufs or overlayfs clone first, snapshot that");
3127 ERROR("and keep the original container pristine.");
3128 flags &= ~LXC_CLONE_SNAPSHOT | LXC_CLONE_MAYBE_SNAPSHOT;
3129 }
3130 c2 = do_lxcapi_clone(c, newname, snappath, flags, NULL, NULL, 0, NULL);
3131 if (!c2) {
3132 ERROR("clone of %s:%s failed", c->config_path, c->name);
3133 return -1;
3134 }
3135
3136 lxc_container_put(c2);
3137
3138 // Now write down the creation time
3139 time_t timer;
3140 char buffer[25];
3141 struct tm* tm_info;
3142 FILE *f;
3143
3144 time(&timer);
3145 tm_info = localtime(&timer);
3146
3147 strftime(buffer, 25, "%Y:%m:%d %H:%M:%S", tm_info);
3148
3149 char *dfnam = alloca(strlen(snappath) + strlen(newname) + 5);
3150 sprintf(dfnam, "%s/%s/ts", snappath, newname);
3151 f = fopen(dfnam, "w");
3152 if (!f) {
3153 ERROR("Failed to open %s", dfnam);
3154 return -1;
3155 }
3156 if (fprintf(f, "%s", buffer) < 0) {
3157 SYSERROR("Writing timestamp");
3158 fclose(f);
3159 return -1;
3160 }
3161 ret = fclose(f);
3162 if (ret != 0) {
3163 SYSERROR("Writing timestamp");
3164 return -1;
3165 }
3166
3167 if (commentfile) {
3168 // $p / $name / comment \0
3169 int len = strlen(snappath) + strlen(newname) + 10;
3170 char *path = alloca(len);
3171 sprintf(path, "%s/%s/comment", snappath, newname);
3172 return copy_file(commentfile, path) < 0 ? -1 : i;
3173 }
3174
3175 return i;
3176 }
3177
3178 WRAP_API_1(int, lxcapi_snapshot, const char *)
3179
3180 static void lxcsnap_free(struct lxc_snapshot *s)
3181 {
3182 free(s->name);
3183 free(s->comment_pathname);
3184 free(s->timestamp);
3185 free(s->lxcpath);
3186 }
3187
3188 static char *get_snapcomment_path(char* snappath, char *name)
3189 {
3190 // $snappath/$name/comment
3191 int ret, len = strlen(snappath) + strlen(name) + 10;
3192 char *s = malloc(len);
3193
3194 if (s) {
3195 ret = snprintf(s, len, "%s/%s/comment", snappath, name);
3196 if (ret < 0 || ret >= len) {
3197 free(s);
3198 s = NULL;
3199 }
3200 }
3201 return s;
3202 }
3203
3204 static char *get_timestamp(char* snappath, char *name)
3205 {
3206 char path[MAXPATHLEN], *s = NULL;
3207 int ret, len;
3208 FILE *fin;
3209
3210 ret = snprintf(path, MAXPATHLEN, "%s/%s/ts", snappath, name);
3211 if (ret < 0 || ret >= MAXPATHLEN)
3212 return NULL;
3213 fin = fopen(path, "r");
3214 if (!fin)
3215 return NULL;
3216 (void) fseek(fin, 0, SEEK_END);
3217 len = ftell(fin);
3218 (void) fseek(fin, 0, SEEK_SET);
3219 if (len > 0) {
3220 s = malloc(len+1);
3221 if (s) {
3222 s[len] = '\0';
3223 if (fread(s, 1, len, fin) != len) {
3224 SYSERROR("reading timestamp");
3225 free(s);
3226 s = NULL;
3227 }
3228 }
3229 }
3230 fclose(fin);
3231 return s;
3232 }
3233
3234 static int do_lxcapi_snapshot_list(struct lxc_container *c, struct lxc_snapshot **ret_snaps)
3235 {
3236 char snappath[MAXPATHLEN], path2[MAXPATHLEN];
3237 int count = 0, ret;
3238 struct dirent dirent, *direntp;
3239 struct lxc_snapshot *snaps =NULL, *nsnaps;
3240 DIR *dir;
3241
3242 if (!c || !lxcapi_is_defined(c))
3243 return -1;
3244
3245 if (!get_snappath_dir(c, snappath)) {
3246 ERROR("path name too long");
3247 return -1;
3248 }
3249 dir = opendir(snappath);
3250 if (!dir) {
3251 INFO("failed to open %s - assuming no snapshots", snappath);
3252 return 0;
3253 }
3254
3255 while (!readdir_r(dir, &dirent, &direntp)) {
3256 if (!direntp)
3257 break;
3258
3259 if (!strcmp(direntp->d_name, "."))
3260 continue;
3261
3262 if (!strcmp(direntp->d_name, ".."))
3263 continue;
3264
3265 ret = snprintf(path2, MAXPATHLEN, "%s/%s/config", snappath, direntp->d_name);
3266 if (ret < 0 || ret >= MAXPATHLEN) {
3267 ERROR("pathname too long");
3268 goto out_free;
3269 }
3270 if (!file_exists(path2))
3271 continue;
3272 nsnaps = realloc(snaps, (count + 1)*sizeof(*snaps));
3273 if (!nsnaps) {
3274 SYSERROR("Out of memory");
3275 goto out_free;
3276 }
3277 snaps = nsnaps;
3278 snaps[count].free = lxcsnap_free;
3279 snaps[count].name = strdup(direntp->d_name);
3280 if (!snaps[count].name)
3281 goto out_free;
3282 snaps[count].lxcpath = strdup(snappath);
3283 if (!snaps[count].lxcpath) {
3284 free(snaps[count].name);
3285 goto out_free;
3286 }
3287 snaps[count].comment_pathname = get_snapcomment_path(snappath, direntp->d_name);
3288 snaps[count].timestamp = get_timestamp(snappath, direntp->d_name);
3289 count++;
3290 }
3291
3292 if (closedir(dir))
3293 WARN("failed to close directory");
3294
3295 *ret_snaps = snaps;
3296 return count;
3297
3298 out_free:
3299 if (snaps) {
3300 int i;
3301 for (i=0; i<count; i++)
3302 lxcsnap_free(&snaps[i]);
3303 free(snaps);
3304 }
3305 if (closedir(dir))
3306 WARN("failed to close directory");
3307 return -1;
3308 }
3309
3310 WRAP_API_1(int, lxcapi_snapshot_list, struct lxc_snapshot **)
3311
3312 static bool do_lxcapi_snapshot_restore(struct lxc_container *c, const char *snapname, const char *newname)
3313 {
3314 char clonelxcpath[MAXPATHLEN];
3315 int flags = 0;
3316 struct lxc_container *snap, *rest;
3317 struct bdev *bdev;
3318 bool b = false;
3319
3320 if (!c || !c->name || !c->config_path)
3321 return false;
3322
3323 if (has_fs_snapshots(c)) {
3324 ERROR("container rootfs has dependent snapshots");
3325 return false;
3326 }
3327
3328 bdev = bdev_init(c->lxc_conf, c->lxc_conf->rootfs.path, c->lxc_conf->rootfs.mount, NULL);
3329 if (!bdev) {
3330 ERROR("Failed to find original backing store type");
3331 return false;
3332 }
3333
3334 if (!newname)
3335 newname = c->name;
3336
3337 if (!get_snappath_dir(c, clonelxcpath)) {
3338 bdev_put(bdev);
3339 return false;
3340 }
3341 // how should we lock this?
3342
3343 snap = lxc_container_new(snapname, clonelxcpath);
3344 if (!snap || !lxcapi_is_defined(snap)) {
3345 ERROR("Could not open snapshot %s", snapname);
3346 if (snap) lxc_container_put(snap);
3347 bdev_put(bdev);
3348 return false;
3349 }
3350
3351 if (strcmp(c->name, newname) == 0) {
3352 if (!container_destroy(c)) {
3353 ERROR("Could not destroy existing container %s", newname);
3354 lxc_container_put(snap);
3355 bdev_put(bdev);
3356 return false;
3357 }
3358 }
3359
3360 if (strcmp(bdev->type, "dir") != 0 && strcmp(bdev->type, "loop") != 0)
3361 flags = LXC_CLONE_SNAPSHOT | LXC_CLONE_MAYBE_SNAPSHOT;
3362 rest = lxcapi_clone(snap, newname, c->config_path, flags,
3363 bdev->type, NULL, 0, NULL);
3364 bdev_put(bdev);
3365 if (rest && lxcapi_is_defined(rest))
3366 b = true;
3367 if (rest)
3368 lxc_container_put(rest);
3369 lxc_container_put(snap);
3370 return b;
3371 }
3372
3373 WRAP_API_2(bool, lxcapi_snapshot_restore, const char *, const char *)
3374
3375 static bool do_snapshot_destroy(const char *snapname, const char *clonelxcpath)
3376 {
3377 struct lxc_container *snap = NULL;
3378 bool bret = false;
3379
3380 snap = lxc_container_new(snapname, clonelxcpath);
3381 if (!snap) {
3382 ERROR("Could not find snapshot %s", snapname);
3383 goto err;
3384 }
3385
3386 if (!do_lxcapi_destroy(snap)) {
3387 ERROR("Could not destroy snapshot %s", snapname);
3388 goto err;
3389 }
3390 bret = true;
3391
3392 err:
3393 if (snap)
3394 lxc_container_put(snap);
3395 return bret;
3396 }
3397
3398 static bool remove_all_snapshots(const char *path)
3399 {
3400 DIR *dir;
3401 struct dirent dirent, *direntp;
3402 bool bret = true;
3403
3404 dir = opendir(path);
3405 if (!dir) {
3406 SYSERROR("opendir on snapshot path %s", path);
3407 return false;
3408 }
3409 while (!readdir_r(dir, &dirent, &direntp)) {
3410 if (!direntp)
3411 break;
3412 if (!strcmp(direntp->d_name, "."))
3413 continue;
3414 if (!strcmp(direntp->d_name, ".."))
3415 continue;
3416 if (!do_snapshot_destroy(direntp->d_name, path)) {
3417 bret = false;
3418 continue;
3419 }
3420 }
3421
3422 closedir(dir);
3423
3424 if (rmdir(path))
3425 SYSERROR("Error removing directory %s", path);
3426
3427 return bret;
3428 }
3429
3430 static bool do_lxcapi_snapshot_destroy(struct lxc_container *c, const char *snapname)
3431 {
3432 char clonelxcpath[MAXPATHLEN];
3433
3434 if (!c || !c->name || !c->config_path || !snapname)
3435 return false;
3436
3437 if (!get_snappath_dir(c, clonelxcpath))
3438 return false;
3439
3440 return do_snapshot_destroy(snapname, clonelxcpath);
3441 }
3442
3443 WRAP_API_1(bool, lxcapi_snapshot_destroy, const char *)
3444
3445 static bool do_lxcapi_snapshot_destroy_all(struct lxc_container *c)
3446 {
3447 char clonelxcpath[MAXPATHLEN];
3448
3449 if (!c || !c->name || !c->config_path)
3450 return false;
3451
3452 if (!get_snappath_dir(c, clonelxcpath))
3453 return false;
3454
3455 return remove_all_snapshots(clonelxcpath);
3456 }
3457
3458 WRAP_API(bool, lxcapi_snapshot_destroy_all)
3459
3460 static bool do_lxcapi_may_control(struct lxc_container *c)
3461 {
3462 return lxc_try_cmd(c->name, c->config_path) == 0;
3463 }
3464
3465 WRAP_API(bool, lxcapi_may_control)
3466
3467 static bool do_add_remove_node(pid_t init_pid, const char *path, bool add,
3468 struct stat *st)
3469 {
3470 char chrootpath[MAXPATHLEN];
3471 char *directory_path = NULL;
3472 pid_t pid;
3473 int ret;
3474
3475 if ((pid = fork()) < 0) {
3476 SYSERROR("failed to fork a child helper");
3477 return false;
3478 }
3479 if (pid) {
3480 if (wait_for_pid(pid) != 0) {
3481 ERROR("Failed to create note in guest");
3482 return false;
3483 }
3484 return true;
3485 }
3486
3487 /* prepare the path */
3488 ret = snprintf(chrootpath, MAXPATHLEN, "/proc/%d/root", init_pid);
3489 if (ret < 0 || ret >= MAXPATHLEN)
3490 return false;
3491
3492 if (chroot(chrootpath) < 0)
3493 exit(1);
3494 if (chdir("/") < 0)
3495 exit(1);
3496 /* remove path if it exists */
3497 if(faccessat(AT_FDCWD, path, F_OK, AT_SYMLINK_NOFOLLOW) == 0) {
3498 if (unlink(path) < 0) {
3499 ERROR("unlink failed");
3500 exit(1);
3501 }
3502 }
3503 if (!add)
3504 exit(0);
3505
3506 /* create any missing directories */
3507 directory_path = dirname(strdup(path));
3508 if (mkdir_p(directory_path, 0755) < 0 && errno != EEXIST) {
3509 ERROR("failed to create directory");
3510 exit(1);
3511 }
3512
3513 /* create the device node */
3514 if (mknod(path, st->st_mode, st->st_rdev) < 0) {
3515 ERROR("mknod failed");
3516 exit(1);
3517 }
3518
3519 exit(0);
3520 }
3521
3522 static bool add_remove_device_node(struct lxc_container *c, const char *src_path, const char *dest_path, bool add)
3523 {
3524 int ret;
3525 struct stat st;
3526 char value[MAX_BUFFER];
3527 const char *p;
3528
3529 /* make sure container is running */
3530 if (!do_lxcapi_is_running(c)) {
3531 ERROR("container is not running");
3532 return false;
3533 }
3534
3535 /* use src_path if dest_path is NULL otherwise use dest_path */
3536 p = dest_path ? dest_path : src_path;
3537
3538 /* make sure we can access p */
3539 if(access(p, F_OK) < 0 || stat(p, &st) < 0)
3540 return false;
3541
3542 /* continue if path is character device or block device */
3543 if (S_ISCHR(st.st_mode))
3544 ret = snprintf(value, MAX_BUFFER, "c %d:%d rwm", major(st.st_rdev), minor(st.st_rdev));
3545 else if (S_ISBLK(st.st_mode))
3546 ret = snprintf(value, MAX_BUFFER, "b %d:%d rwm", major(st.st_rdev), minor(st.st_rdev));
3547 else
3548 return false;
3549
3550 /* check snprintf return code */
3551 if (ret < 0 || ret >= MAX_BUFFER)
3552 return false;
3553
3554 if (!do_add_remove_node(do_lxcapi_init_pid(c), p, add, &st))
3555 return false;
3556
3557 /* add or remove device to/from cgroup access list */
3558 if (add) {
3559 if (!do_lxcapi_set_cgroup_item(c, "devices.allow", value)) {
3560 ERROR("set_cgroup_item failed while adding the device node");
3561 return false;
3562 }
3563 } else {
3564 if (!do_lxcapi_set_cgroup_item(c, "devices.deny", value)) {
3565 ERROR("set_cgroup_item failed while removing the device node");
3566 return false;
3567 }
3568 }
3569
3570 return true;
3571 }
3572
3573 static bool do_lxcapi_add_device_node(struct lxc_container *c, const char *src_path, const char *dest_path)
3574 {
3575 if (am_unpriv()) {
3576 ERROR(NOT_SUPPORTED_ERROR, __FUNCTION__);
3577 return false;
3578 }
3579 return add_remove_device_node(c, src_path, dest_path, true);
3580 }
3581
3582 WRAP_API_2(bool, lxcapi_add_device_node, const char *, const char *)
3583
3584 static bool do_lxcapi_remove_device_node(struct lxc_container *c, const char *src_path, const char *dest_path)
3585 {
3586 if (am_unpriv()) {
3587 ERROR(NOT_SUPPORTED_ERROR, __FUNCTION__);
3588 return false;
3589 }
3590 return add_remove_device_node(c, src_path, dest_path, false);
3591 }
3592
3593 WRAP_API_2(bool, lxcapi_remove_device_node, const char *, const char *)
3594
3595 static bool do_lxcapi_attach_interface(struct lxc_container *c, const char *ifname,
3596 const char *dst_ifname)
3597 {
3598 int ret = 0;
3599 if (am_unpriv()) {
3600 ERROR(NOT_SUPPORTED_ERROR, __FUNCTION__);
3601 return false;
3602 }
3603
3604 if (!ifname) {
3605 ERROR("No source interface name given");
3606 return false;
3607 }
3608
3609 ret = lxc_netdev_isup(ifname);
3610
3611 if (ret > 0) {
3612 /* netdev of ifname is up. */
3613 ret = lxc_netdev_down(ifname);
3614 if (ret)
3615 goto err;
3616 }
3617
3618 ret = lxc_netdev_move_by_name(ifname, do_lxcapi_init_pid(c), dst_ifname);
3619 if (ret)
3620 goto err;
3621
3622 return true;
3623
3624 err:
3625 return false;
3626 }
3627
3628 WRAP_API_2(bool, lxcapi_attach_interface, const char *, const char *)
3629
3630 static bool do_lxcapi_detach_interface(struct lxc_container *c, const char *ifname,
3631 const char *dst_ifname)
3632 {
3633 pid_t pid, pid_outside;
3634
3635 if (am_unpriv()) {
3636 ERROR(NOT_SUPPORTED_ERROR, __FUNCTION__);
3637 return false;
3638 }
3639
3640 if (!ifname) {
3641 ERROR("No source interface name given");
3642 return false;
3643 }
3644
3645 pid_outside = getpid();
3646 pid = fork();
3647 if (pid < 0) {
3648 ERROR("failed to fork task to get interfaces information");
3649 return false;
3650 }
3651
3652 if (pid == 0) { // child
3653 int ret = 0;
3654 if (!enter_net_ns(c)) {
3655 ERROR("failed to enter namespace");
3656 exit(-1);
3657 }
3658
3659 ret = lxc_netdev_isup(ifname);
3660 if (ret < 0)
3661 exit(ret);
3662
3663 /* netdev of ifname is up. */
3664 if (ret) {
3665 ret = lxc_netdev_down(ifname);
3666 if (ret)
3667 exit(ret);
3668 }
3669
3670 ret = lxc_netdev_move_by_name(ifname, pid_outside, dst_ifname);
3671
3672 /* -EINVAL means there is no netdev named as ifanme. */
3673 if (ret == -EINVAL) {
3674 ERROR("No network device named as %s.", ifname);
3675 }
3676 exit(ret);
3677 }
3678
3679 if (wait_for_pid(pid) != 0)
3680 return false;
3681
3682 return true;
3683 }
3684
3685 WRAP_API_2(bool, lxcapi_detach_interface, const char *, const char *)
3686
3687 struct criu_opts {
3688 /* The type of criu invocation, one of "dump" or "restore" */
3689 char *action;
3690
3691 /* The directory to pass to criu */
3692 char *directory;
3693
3694 /* The container to dump */
3695 struct lxc_container *c;
3696
3697 /* Enable criu verbose mode? */
3698 bool verbose;
3699
3700 /* dump: stop the container or not after dumping? */
3701 bool stop;
3702
3703 /* restore: the file to write the init process' pid into */
3704 char *pidfile;
3705 const char *cgroup_path;
3706 };
3707
3708 static void exec_criu(struct criu_opts *opts)
3709 {
3710 char **argv, log[PATH_MAX];
3711 int static_args = 14, argc = 0, i, ret;
3712 int netnr = 0;
3713 struct lxc_list *it;
3714
3715 struct mntent mntent;
3716 char buf[4096];
3717 FILE *mnts = NULL;
3718
3719 /* The command line always looks like:
3720 * criu $(action) --tcp-established --file-locks --link-remap --force-irmap \
3721 * --manage-cgroups action-script foo.sh -D $(directory) \
3722 * -o $(directory)/$(action).log
3723 * +1 for final NULL */
3724
3725 if (strcmp(opts->action, "dump") == 0) {
3726 /* -t pid */
3727 static_args += 2;
3728
3729 /* --leave-running */
3730 if (!opts->stop)
3731 static_args++;
3732 } else if (strcmp(opts->action, "restore") == 0) {
3733 /* --root $(lxc_mount_point) --restore-detached
3734 * --restore-sibling --pidfile $foo --cgroup-root $foo */
3735 static_args += 8;
3736 } else {
3737 return;
3738 }
3739
3740 if (opts->verbose)
3741 static_args++;
3742
3743 ret = snprintf(log, PATH_MAX, "%s/%s.log", opts->directory, opts->action);
3744 if (ret < 0 || ret >= PATH_MAX) {
3745 ERROR("logfile name too long\n");
3746 return;
3747 }
3748
3749 // We need to tell criu where cgmanager's socket is bind mounted from
3750 // if it exists since it's external.
3751 if (cgroup_driver() == CGMANAGER)
3752 static_args+=2;
3753
3754 argv = malloc(static_args * sizeof(*argv));
3755 if (!argv)
3756 return;
3757
3758 memset(argv, 0, static_args * sizeof(*argv));
3759
3760 #define DECLARE_ARG(arg) \
3761 do { \
3762 if (arg == NULL) { \
3763 ERROR("Got NULL argument for criu"); \
3764 goto err; \
3765 } \
3766 argv[argc++] = strdup(arg); \
3767 if (!argv[argc-1]) \
3768 goto err; \
3769 } while (0)
3770
3771 argv[argc++] = on_path("criu", NULL);
3772 if (!argv[argc-1]) {
3773 ERROR("Couldn't find criu binary\n");
3774 goto err;
3775 }
3776
3777 DECLARE_ARG(opts->action);
3778 DECLARE_ARG("--tcp-established");
3779 DECLARE_ARG("--file-locks");
3780 DECLARE_ARG("--link-remap");
3781 DECLARE_ARG("--force-irmap");
3782 DECLARE_ARG("--manage-cgroups");
3783 DECLARE_ARG("--action-script");
3784 DECLARE_ARG(DATADIR "/lxc/lxc-restore-net");
3785 DECLARE_ARG("-D");
3786 DECLARE_ARG(opts->directory);
3787 DECLARE_ARG("-o");
3788 DECLARE_ARG(log);
3789
3790 if (opts->verbose)
3791 DECLARE_ARG("-vvvvvv");
3792
3793 /*
3794 * Note: this macro is not intended to be called unless argc is equal
3795 * to the length of the array; there is nothing that keeps track of the
3796 * length of the array besides the location in the code that this is
3797 * called. (Yes this is bad, and we should fix it.)
3798 */
3799 #define RESIZE_ARGS(additional) \
3800 do { \
3801 void *m; \
3802 if (additional < 0) { \
3803 ERROR("resizing by negative amount"); \
3804 goto err; \
3805 } else if (additional == 0) \
3806 continue; \
3807 \
3808 m = realloc(argv, (argc + additional + 1) * sizeof(*argv)); \
3809 if (!m) \
3810 goto err; \
3811 argv = m; \
3812 } while (0)
3813
3814 if (strcmp(opts->action, "dump") == 0) {
3815 char pid[32];
3816
3817 if (cgroup_driver() == CGMANAGER) {
3818 DECLARE_ARG("--ext-mount-map");
3819 DECLARE_ARG("/sys/fs/cgroup/cgmanager:cgmanager");
3820 }
3821
3822 if (sprintf(pid, "%d", lxcapi_init_pid(opts->c)) < 0)
3823 goto err;
3824
3825 DECLARE_ARG("-t");
3826 DECLARE_ARG(pid);
3827 if (!opts->stop)
3828 DECLARE_ARG("--leave-running");
3829 } else if (strcmp(opts->action, "restore") == 0) {
3830
3831 if (cgroup_driver() == CGMANAGER) {
3832 DECLARE_ARG("--ext-mount-map");
3833 DECLARE_ARG("cgmanager:/sys/fs/cgroup/cgmanager");
3834 }
3835
3836 DECLARE_ARG("--root");
3837 DECLARE_ARG(opts->c->lxc_conf->rootfs.mount);
3838 DECLARE_ARG("--restore-detached");
3839 DECLARE_ARG("--restore-sibling");
3840 DECLARE_ARG("--pidfile");
3841 DECLARE_ARG(opts->pidfile);
3842 DECLARE_ARG("--cgroup-root");
3843 DECLARE_ARG(opts->cgroup_path);
3844
3845 RESIZE_ARGS(lxc_list_len(&opts->c->lxc_conf->network) * 2);
3846
3847 lxc_list_for_each(it, &opts->c->lxc_conf->network) {
3848 char eth[128], *veth;
3849 struct lxc_netdev *n = it->elem;
3850
3851 if (n->name) {
3852 if (strlen(n->name) >= sizeof(eth))
3853 goto err;
3854 strncpy(eth, n->name, sizeof(eth));
3855 } else
3856 sprintf(eth, "eth%d", netnr);
3857
3858 veth = n->priv.veth_attr.pair;
3859
3860 ret = snprintf(buf, sizeof(buf), "%s=%s", eth, veth);
3861 if (ret < 0 || ret >= sizeof(buf))
3862 goto err;
3863
3864 DECLARE_ARG("--veth-pair");
3865 DECLARE_ARG(buf);
3866 }
3867 }
3868
3869 // CRIU wants to know about any external bind mounts the
3870 // container has.
3871 mnts = write_mount_file(&opts->c->lxc_conf->mount_list);
3872 if (!mnts)
3873 goto err;
3874
3875 RESIZE_ARGS(lxc_list_len(&opts->c->lxc_conf->mount_list) * 2);
3876
3877 while (getmntent_r(mnts, &mntent, buf, sizeof(buf))) {
3878 char arg[2048], *key, *val;
3879 int ret;
3880
3881 if (strcmp(opts->action, "dump") == 0) {
3882 key = mntent.mnt_fsname;
3883 val = mntent.mnt_dir;
3884 } else {
3885 key = mntent.mnt_dir;
3886 val = mntent.mnt_fsname;
3887 }
3888
3889 ret = snprintf(arg, sizeof(arg), "%s:%s", key, val);
3890 if (ret < 0 || ret >= sizeof(arg)) {
3891 goto err;
3892 }
3893
3894 DECLARE_ARG("--ext-mount-map");
3895 DECLARE_ARG(arg);
3896 }
3897 fclose(mnts);
3898 mnts = NULL;
3899
3900 argv[argc] = NULL;
3901
3902 netnr = 0;
3903 lxc_list_for_each(it, &opts->c->lxc_conf->network) {
3904 struct lxc_netdev *n = it->elem;
3905 char veth[128];
3906
3907 /*
3908 * Here, we set some parameters that lxc-restore-net
3909 * will examine to figure out the right network to
3910 * restore.
3911 */
3912 snprintf(buf, sizeof(buf), "LXC_CRIU_BRIDGE%d", netnr);
3913 if (setenv(buf, n->link, 1))
3914 goto err;
3915
3916 if (strcmp("restore", opts->action) == 0)
3917 strncpy(veth, n->priv.veth_attr.pair, sizeof(veth));
3918 else {
3919 char *tmp;
3920 ret = snprintf(buf, sizeof(buf), "lxc.network.%d.veth.pair", netnr);
3921 if (ret < 0 || ret >= sizeof(buf))
3922 goto err;
3923 tmp = lxcapi_get_running_config_item(opts->c, buf);
3924 strncpy(veth, tmp, sizeof(veth));
3925 free(tmp);
3926 }
3927
3928 snprintf(buf, sizeof(buf), "LXC_CRIU_VETH%d", netnr);
3929 if (setenv(buf, veth, 1))
3930 goto err;
3931
3932 netnr++;
3933 }
3934
3935 #undef DECLARE_ARG
3936 #undef RESIZE_ARGS
3937 execv(argv[0], argv);
3938 err:
3939 if (mnts)
3940 fclose(mnts);
3941 for (i = 0; argv[i]; i++)
3942 free(argv[i]);
3943 free(argv);
3944 }
3945
3946 /* Check and make sure the container has a configuration that we know CRIU can
3947 * dump. */
3948 static bool criu_ok(struct lxc_container *c)
3949 {
3950 struct lxc_list *it;
3951 bool found_deny_rule = false;
3952
3953 if (geteuid()) {
3954 ERROR("Must be root to checkpoint\n");
3955 return false;
3956 }
3957
3958 /* We only know how to restore containers with veth networks. */
3959 lxc_list_for_each(it, &c->lxc_conf->network) {
3960 struct lxc_netdev *n = it->elem;
3961 if (n->type != LXC_NET_VETH && n->type != LXC_NET_NONE) {
3962 ERROR("Found network that is not VETH or NONE\n");
3963 return false;
3964 }
3965 }
3966
3967 // These requirements come from http://criu.org/LXC
3968 if (c->lxc_conf->console.path &&
3969 strcmp(c->lxc_conf->console.path, "none") != 0) {
3970 ERROR("lxc.console must be none\n");
3971 return false;
3972 }
3973
3974 if (c->lxc_conf->tty != 0) {
3975 ERROR("lxc.tty must be 0\n");
3976 return false;
3977 }
3978
3979 lxc_list_for_each(it, &c->lxc_conf->cgroup) {
3980 struct lxc_cgroup *cg = it->elem;
3981 if (strcmp(cg->subsystem, "devices.deny") == 0 &&
3982 strcmp(cg->value, "c 5:1 rwm") == 0) {
3983
3984 found_deny_rule = true;
3985 break;
3986 }
3987 }
3988
3989 if (!found_deny_rule) {
3990 ERROR("couldn't find devices.deny = c 5:1 rwm");
3991 return false;
3992 }
3993
3994 return true;
3995 }
3996
3997 static bool dump_net_info(struct lxc_container *c, char *directory)
3998 {
3999 int netnr;
4000 struct lxc_list *it;
4001
4002 netnr = 0;
4003 lxc_list_for_each(it, &c->lxc_conf->network) {
4004 char *veth = NULL, *bridge = NULL, veth_path[PATH_MAX], eth[128];
4005 struct lxc_netdev *n = it->elem;
4006 bool has_error = true;
4007 int pret;
4008
4009 pret = snprintf(veth_path, PATH_MAX, "lxc.network.%d.veth.pair", netnr);
4010 if (pret < 0 || pret >= PATH_MAX)
4011 goto out;
4012
4013 veth = lxcapi_get_running_config_item(c, veth_path);
4014 if (!veth) {
4015 /* criu_ok() checks that all interfaces are
4016 * LXC_NET{VETH,NONE}, and VETHs should have this
4017 * config */
4018 assert(n->type == LXC_NET_NONE);
4019 break;
4020 }
4021
4022 bridge = lxcapi_get_running_config_item(c, veth_path);
4023 if (!bridge)
4024 goto out;
4025
4026 pret = snprintf(veth_path, PATH_MAX, "%s/veth%d", directory, netnr);
4027 if (pret < 0 || pret >= PATH_MAX || print_to_file(veth_path, veth) < 0)
4028 goto out;
4029
4030 if (n->name) {
4031 if (strlen(n->name) >= 128)
4032 goto out;
4033 strncpy(eth, n->name, 128);
4034 } else
4035 sprintf(eth, "eth%d", netnr);
4036
4037 has_error = false;
4038 out:
4039 free(veth);
4040 free(bridge);
4041 if (has_error)
4042 return false;
4043 }
4044
4045 return true;
4046 }
4047
4048 static bool do_lxcapi_checkpoint(struct lxc_container *c, char *directory, bool stop, bool verbose)
4049 {
4050 pid_t pid;
4051 int status;
4052
4053 if (!criu_ok(c))
4054 return false;
4055
4056 if (mkdir(directory, 0700) < 0 && errno != EEXIST)
4057 return false;
4058
4059 if (!dump_net_info(c, directory))
4060 return false;
4061
4062 pid = fork();
4063 if (pid < 0)
4064 return false;
4065
4066 if (pid == 0) {
4067 struct criu_opts os;
4068
4069 os.action = "dump";
4070 os.directory = directory;
4071 os.c = c;
4072 os.stop = stop;
4073 os.verbose = verbose;
4074
4075 /* exec_criu() returning is an error */
4076 exec_criu(&os);
4077 exit(1);
4078 } else {
4079 pid_t w = waitpid(pid, &status, 0);
4080 if (w == -1) {
4081 SYSERROR("waitpid");
4082 return false;
4083 }
4084
4085 if (WIFEXITED(status)) {
4086 return !WEXITSTATUS(status);
4087 }
4088
4089 return false;
4090 }
4091 }
4092
4093 WRAP_API_3(bool, lxcapi_checkpoint, char *, bool, bool)
4094
4095 static bool restore_net_info(struct lxc_container *c)
4096 {
4097 struct lxc_list *it;
4098 bool has_error = true;
4099
4100 if (container_mem_lock(c))
4101 return false;
4102
4103 lxc_list_for_each(it, &c->lxc_conf->network) {
4104 struct lxc_netdev *netdev = it->elem;
4105 char template[IFNAMSIZ];
4106 snprintf(template, sizeof(template), "vethXXXXXX");
4107
4108 if (!netdev->priv.veth_attr.pair)
4109 netdev->priv.veth_attr.pair = lxc_mkifname(template);
4110
4111 if (!netdev->priv.veth_attr.pair)
4112 goto out_unlock;
4113 }
4114
4115 has_error = false;
4116
4117 out_unlock:
4118 container_mem_unlock(c);
4119 return !has_error;
4120 }
4121
4122 // do_restore never returns, the calling process is used as the
4123 // monitor process. do_restore calls exit() if it fails.
4124 static void do_restore(struct lxc_container *c, int pipe, char *directory, bool verbose)
4125 {
4126 pid_t pid;
4127 char pidfile[L_tmpnam];
4128 struct lxc_handler *handler;
4129 int status;
4130
4131 if (!tmpnam(pidfile))
4132 goto out;
4133
4134 handler = lxc_init(c->name, c->lxc_conf, c->config_path);
4135 if (!handler)
4136 goto out;
4137
4138 if (!cgroup_init(handler)) {
4139 ERROR("failed initing cgroups");
4140 goto out_fini_handler;
4141 }
4142
4143 if (!cgroup_create(handler)) {
4144 ERROR("failed creating groups");
4145 goto out_fini_handler;
4146 }
4147
4148 if (!restore_net_info(c)) {
4149 ERROR("failed restoring network info");
4150 goto out_fini_handler;
4151 }
4152
4153 resolve_clone_flags(handler);
4154
4155 pid = fork();
4156 if (pid < 0)
4157 goto out_fini_handler;
4158
4159 if (pid == 0) {
4160 struct criu_opts os;
4161 struct lxc_rootfs *rootfs;
4162
4163 close(pipe);
4164 pipe = -1;
4165
4166 if (unshare(CLONE_NEWNS))
4167 goto out_fini_handler;
4168
4169 /* CRIU needs the lxc root bind mounted so that it is the root of some
4170 * mount. */
4171 rootfs = &c->lxc_conf->rootfs;
4172
4173 if (rootfs_is_blockdev(c->lxc_conf)) {
4174 if (do_rootfs_setup(c->lxc_conf, c->name, c->config_path) < 0)
4175 goto out_fini_handler;
4176 } else {
4177 if (mkdir(rootfs->mount, 0755) < 0 && errno != EEXIST)
4178 goto out_fini_handler;
4179
4180 if (mount(rootfs->path, rootfs->mount, NULL, MS_BIND, NULL) < 0) {
4181 rmdir(rootfs->mount);
4182 goto out_fini_handler;
4183 }
4184 }
4185
4186 os.action = "restore";
4187 os.directory = directory;
4188 os.c = c;
4189 os.pidfile = pidfile;
4190 os.verbose = verbose;
4191 os.cgroup_path = cgroup_canonical_path(handler);
4192
4193 /* exec_criu() returning is an error */
4194 exec_criu(&os);
4195 umount(rootfs->mount);
4196 rmdir(rootfs->mount);
4197 goto out_fini_handler;
4198 } else {
4199 int ret;
4200 char title[2048];
4201
4202 pid_t w = waitpid(pid, &status, 0);
4203 if (w == -1) {
4204 SYSERROR("waitpid");
4205 goto out_fini_handler;
4206 }
4207
4208 ret = write(pipe, &status, sizeof(status));
4209 close(pipe);
4210 pipe = -1;
4211
4212 if (sizeof(status) != ret) {
4213 SYSERROR("failed to write all of status");
4214 goto out_fini_handler;
4215 }
4216
4217 if (WIFEXITED(status)) {
4218 if (WEXITSTATUS(status)) {
4219 goto out_fini_handler;
4220 } else {
4221 int ret;
4222 FILE *f = fopen(pidfile, "r");
4223 if (!f) {
4224 SYSERROR("couldn't read restore's init pidfile %s\n", pidfile);
4225 goto out_fini_handler;
4226 }
4227
4228 ret = fscanf(f, "%d", (int*) &handler->pid);
4229 fclose(f);
4230 if (ret != 1) {
4231 ERROR("reading restore pid failed");
4232 goto out_fini_handler;
4233 }
4234
4235 if (lxc_set_state(c->name, handler, RUNNING))
4236 goto out_fini_handler;
4237 }
4238 } else {
4239 ERROR("CRIU was killed with signal %d\n", WTERMSIG(status));
4240 goto out_fini_handler;
4241 }
4242
4243 /*
4244 * See comment in lxcapi_start; we don't care if these
4245 * fail because it's just a beauty thing. We just
4246 * assign the return here to silence potential.
4247 */
4248 ret = snprintf(title, sizeof(title), "[lxc monitor] %s %s", c->config_path, c->name);
4249 ret = setproctitle(title);
4250
4251 ret = lxc_poll(c->name, handler);
4252 if (ret)
4253 lxc_abort(c->name, handler);
4254 lxc_fini(c->name, handler);
4255 exit(ret);
4256 }
4257
4258 out_fini_handler:
4259 lxc_fini(c->name, handler);
4260
4261 out:
4262 if (pipe >= 0) {
4263 status = 1;
4264 if (write(pipe, &status, sizeof(status)) != sizeof(status)) {
4265 SYSERROR("writing status failed");
4266 }
4267 close(pipe);
4268 }
4269
4270 exit(1);
4271 }
4272
4273 static bool do_lxcapi_restore(struct lxc_container *c, char *directory, bool verbose)
4274 {
4275 pid_t pid;
4276 int status, nread;
4277 int pipefd[2];
4278
4279 if (!criu_ok(c))
4280 return false;
4281
4282 if (geteuid()) {
4283 ERROR("Must be root to restore\n");
4284 return false;
4285 }
4286
4287 if (pipe(pipefd)) {
4288 ERROR("failed to create pipe");
4289 return false;
4290 }
4291
4292 pid = fork();
4293 if (pid < 0) {
4294 close(pipefd[0]);
4295 close(pipefd[1]);
4296 return false;
4297 }
4298
4299 if (pid == 0) {
4300 close(pipefd[0]);
4301 // this never returns
4302 do_restore(c, pipefd[1], directory, verbose);
4303 }
4304
4305 close(pipefd[1]);
4306
4307 nread = read(pipefd[0], &status, sizeof(status));
4308 close(pipefd[0]);
4309 if (sizeof(status) != nread) {
4310 ERROR("reading status from pipe failed");
4311 goto err_wait;
4312 }
4313
4314 // If the criu process was killed or exited nonzero, wait() for the
4315 // handler, since the restore process died. Otherwise, we don't need to
4316 // wait, since the child becomes the monitor process.
4317 if (!WIFEXITED(status) || WEXITSTATUS(status))
4318 goto err_wait;
4319 return true;
4320
4321 err_wait:
4322 if (wait_for_pid(pid))
4323 ERROR("restore process died");
4324 return false;
4325 }
4326
4327 WRAP_API_2(bool, lxcapi_restore, char *, bool)
4328
4329 static int lxcapi_attach_run_waitl(struct lxc_container *c, lxc_attach_options_t *options, const char *program, const char *arg, ...)
4330 {
4331 va_list ap;
4332 const char **argv;
4333 int ret;
4334
4335 if (!c)
4336 return -1;
4337
4338 struct lxc_conf *old = current_config;
4339 current_config = c->lxc_conf;
4340
4341 va_start(ap, arg);
4342 argv = lxc_va_arg_list_to_argv_const(ap, 1);
4343 va_end(ap);
4344
4345 if (!argv) {
4346 ERROR("Memory allocation error.");
4347 ret = -1;
4348 goto out;
4349 }
4350 argv[0] = arg;
4351
4352 ret = do_lxcapi_attach_run_wait(c, options, program, (const char * const *)argv);
4353 free((void*)argv);
4354 out:
4355 current_config = old;
4356 return ret;
4357 }
4358
4359 struct lxc_container *lxc_container_new(const char *name, const char *configpath)
4360 {
4361 struct lxc_container *c;
4362
4363 if (!name)
4364 return NULL;
4365
4366 c = malloc(sizeof(*c));
4367 if (!c) {
4368 fprintf(stderr, "failed to malloc lxc_container\n");
4369 return NULL;
4370 }
4371 memset(c, 0, sizeof(*c));
4372
4373 if (configpath)
4374 c->config_path = strdup(configpath);
4375 else
4376 c->config_path = strdup(lxc_global_config_value("lxc.lxcpath"));
4377
4378 if (!c->config_path) {
4379 fprintf(stderr, "Out of memory\n");
4380 goto err;
4381 }
4382
4383 remove_trailing_slashes(c->config_path);
4384 c->name = malloc(strlen(name)+1);
4385 if (!c->name) {
4386 fprintf(stderr, "Error allocating lxc_container name\n");
4387 goto err;
4388 }
4389 strcpy(c->name, name);
4390
4391 c->numthreads = 1;
4392 if (!(c->slock = lxc_newlock(c->config_path, name))) {
4393 fprintf(stderr, "failed to create lock\n");
4394 goto err;
4395 }
4396
4397 if (!(c->privlock = lxc_newlock(NULL, NULL))) {
4398 fprintf(stderr, "failed to alloc privlock\n");
4399 goto err;
4400 }
4401
4402 if (!set_config_filename(c)) {
4403 fprintf(stderr, "Error allocating config file pathname\n");
4404 goto err;
4405 }
4406
4407 if (file_exists(c->configfile) && !lxcapi_load_config(c, NULL))
4408 goto err;
4409
4410 if (ongoing_create(c) == 2) {
4411 ERROR("Error: %s creation was not completed", c->name);
4412 container_destroy(c);
4413 lxcapi_clear_config(c);
4414 }
4415 c->daemonize = true;
4416 c->pidfile = NULL;
4417
4418 // assign the member functions
4419 c->is_defined = lxcapi_is_defined;
4420 c->state = lxcapi_state;
4421 c->is_running = lxcapi_is_running;
4422 c->freeze = lxcapi_freeze;
4423 c->unfreeze = lxcapi_unfreeze;
4424 c->console = lxcapi_console;
4425 c->console_getfd = lxcapi_console_getfd;
4426 c->init_pid = lxcapi_init_pid;
4427 c->load_config = lxcapi_load_config;
4428 c->want_daemonize = lxcapi_want_daemonize;
4429 c->want_close_all_fds = lxcapi_want_close_all_fds;
4430 c->start = lxcapi_start;
4431 c->startl = lxcapi_startl;
4432 c->stop = lxcapi_stop;
4433 c->config_file_name = lxcapi_config_file_name;
4434 c->wait = lxcapi_wait;
4435 c->set_config_item = lxcapi_set_config_item;
4436 c->destroy = lxcapi_destroy;
4437 c->destroy_with_snapshots = lxcapi_destroy_with_snapshots;
4438 c->rename = lxcapi_rename;
4439 c->save_config = lxcapi_save_config;
4440 c->get_keys = lxcapi_get_keys;
4441 c->create = lxcapi_create;
4442 c->createl = lxcapi_createl;
4443 c->shutdown = lxcapi_shutdown;
4444 c->reboot = lxcapi_reboot;
4445 c->clear_config = lxcapi_clear_config;
4446 c->clear_config_item = lxcapi_clear_config_item;
4447 c->get_config_item = lxcapi_get_config_item;
4448 c->get_running_config_item = lxcapi_get_running_config_item;
4449 c->get_cgroup_item = lxcapi_get_cgroup_item;
4450 c->set_cgroup_item = lxcapi_set_cgroup_item;
4451 c->get_config_path = lxcapi_get_config_path;
4452 c->set_config_path = lxcapi_set_config_path;
4453 c->clone = lxcapi_clone;
4454 c->get_interfaces = lxcapi_get_interfaces;
4455 c->get_ips = lxcapi_get_ips;
4456 c->attach = lxcapi_attach;
4457 c->attach_run_wait = lxcapi_attach_run_wait;
4458 c->attach_run_waitl = lxcapi_attach_run_waitl;
4459 c->snapshot = lxcapi_snapshot;
4460 c->snapshot_list = lxcapi_snapshot_list;
4461 c->snapshot_restore = lxcapi_snapshot_restore;
4462 c->snapshot_destroy = lxcapi_snapshot_destroy;
4463 c->snapshot_destroy_all = lxcapi_snapshot_destroy_all;
4464 c->may_control = lxcapi_may_control;
4465 c->add_device_node = lxcapi_add_device_node;
4466 c->remove_device_node = lxcapi_remove_device_node;
4467 c->attach_interface = lxcapi_attach_interface;
4468 c->detach_interface = lxcapi_detach_interface;
4469 c->checkpoint = lxcapi_checkpoint;
4470 c->restore = lxcapi_restore;
4471
4472 return c;
4473
4474 err:
4475 lxc_container_free(c);
4476 return NULL;
4477 }
4478
4479 int lxc_get_wait_states(const char **states)
4480 {
4481 int i;
4482
4483 if (states)
4484 for (i=0; i<MAX_STATE; i++)
4485 states[i] = lxc_state2str(i);
4486 return MAX_STATE;
4487 }
4488
4489 /*
4490 * These next two could probably be done smarter with reusing a common function
4491 * with different iterators and tests...
4492 */
4493 int list_defined_containers(const char *lxcpath, char ***names, struct lxc_container ***cret)
4494 {
4495 DIR *dir;
4496 int i, cfound = 0, nfound = 0;
4497 struct dirent dirent, *direntp;
4498 struct lxc_container *c;
4499
4500 if (!lxcpath)
4501 lxcpath = lxc_global_config_value("lxc.lxcpath");
4502
4503 dir = opendir(lxcpath);
4504 if (!dir) {
4505 SYSERROR("opendir on lxcpath");
4506 return -1;
4507 }
4508
4509 if (cret)
4510 *cret = NULL;
4511 if (names)
4512 *names = NULL;
4513
4514 while (!readdir_r(dir, &dirent, &direntp)) {
4515 if (!direntp)
4516 break;
4517 if (!strcmp(direntp->d_name, "."))
4518 continue;
4519 if (!strcmp(direntp->d_name, ".."))
4520 continue;
4521
4522 if (!config_file_exists(lxcpath, direntp->d_name))
4523 continue;
4524
4525 if (names) {
4526 if (!add_to_array(names, direntp->d_name, cfound))
4527 goto free_bad;
4528 }
4529 cfound++;
4530
4531 if (!cret) {
4532 nfound++;
4533 continue;
4534 }
4535
4536 c = lxc_container_new(direntp->d_name, lxcpath);
4537 if (!c) {
4538 INFO("Container %s:%s has a config but could not be loaded",
4539 lxcpath, direntp->d_name);
4540 if (names)
4541 if(!remove_from_array(names, direntp->d_name, cfound--))
4542 goto free_bad;
4543 continue;
4544 }
4545 if (!do_lxcapi_is_defined(c)) {
4546 INFO("Container %s:%s has a config but is not defined",
4547 lxcpath, direntp->d_name);
4548 if (names)
4549 if(!remove_from_array(names, direntp->d_name, cfound--))
4550 goto free_bad;
4551 lxc_container_put(c);
4552 continue;
4553 }
4554
4555 if (!add_to_clist(cret, c, nfound, true)) {
4556 lxc_container_put(c);
4557 goto free_bad;
4558 }
4559 nfound++;
4560 }
4561
4562 closedir(dir);
4563 return nfound;
4564
4565 free_bad:
4566 if (names && *names) {
4567 for (i=0; i<cfound; i++)
4568 free((*names)[i]);
4569 free(*names);
4570 }
4571 if (cret && *cret) {
4572 for (i=0; i<nfound; i++)
4573 lxc_container_put((*cret)[i]);
4574 free(*cret);
4575 }
4576 closedir(dir);
4577 return -1;
4578 }
4579
4580 int list_active_containers(const char *lxcpath, char ***nret,
4581 struct lxc_container ***cret)
4582 {
4583 int i, ret = -1, cret_cnt = 0, ct_name_cnt = 0;
4584 int lxcpath_len;
4585 char *line = NULL;
4586 char **ct_name = NULL;
4587 size_t len = 0;
4588 struct lxc_container *c;
4589 bool is_hashed;
4590
4591 if (!lxcpath)
4592 lxcpath = lxc_global_config_value("lxc.lxcpath");
4593 lxcpath_len = strlen(lxcpath);
4594
4595 if (cret)
4596 *cret = NULL;
4597 if (nret)
4598 *nret = NULL;
4599
4600 FILE *f = fopen("/proc/net/unix", "r");
4601 if (!f)
4602 return -1;
4603
4604 while (getline(&line, &len, f) != -1) {
4605
4606 char *p = strrchr(line, ' '), *p2;
4607 if (!p)
4608 continue;
4609 p++;
4610 if (*p != 0x40)
4611 continue;
4612 p++;
4613
4614 is_hashed = false;
4615 if (strncmp(p, lxcpath, lxcpath_len) == 0) {
4616 p += lxcpath_len;
4617 } else if (strncmp(p, "lxc/", 4) == 0) {
4618 p += 4;
4619 is_hashed = true;
4620 } else {
4621 continue;
4622 }
4623
4624 while (*p == '/')
4625 p++;
4626
4627 // Now p is the start of lxc_name
4628 p2 = strchr(p, '/');
4629 if (!p2 || strncmp(p2, "/command", 8) != 0)
4630 continue;
4631 *p2 = '\0';
4632
4633 if (is_hashed) {
4634 if (strncmp(lxcpath, lxc_cmd_get_lxcpath(p), lxcpath_len) != 0)
4635 continue;
4636 p = lxc_cmd_get_name(p);
4637 }
4638
4639 if (array_contains(&ct_name, p, ct_name_cnt))
4640 continue;
4641
4642 if (!add_to_array(&ct_name, p, ct_name_cnt))
4643 goto free_cret_list;
4644
4645 ct_name_cnt++;
4646
4647 if (!cret)
4648 continue;
4649
4650 c = lxc_container_new(p, lxcpath);
4651 if (!c) {
4652 INFO("Container %s:%s is running but could not be loaded",
4653 lxcpath, p);
4654 remove_from_array(&ct_name, p, ct_name_cnt--);
4655 continue;
4656 }
4657
4658 /*
4659 * If this is an anonymous container, then is_defined *can*
4660 * return false. So we don't do that check. Count on the
4661 * fact that the command socket exists.
4662 */
4663
4664 if (!add_to_clist(cret, c, cret_cnt, true)) {
4665 lxc_container_put(c);
4666 goto free_cret_list;
4667 }
4668 cret_cnt++;
4669 }
4670
4671 assert(!nret || !cret || cret_cnt == ct_name_cnt);
4672 ret = ct_name_cnt;
4673 if (nret)
4674 *nret = ct_name;
4675 else
4676 goto free_ct_name;
4677 goto out;
4678
4679 free_cret_list:
4680 if (cret && *cret) {
4681 for (i = 0; i < cret_cnt; i++)
4682 lxc_container_put((*cret)[i]);
4683 free(*cret);
4684 }
4685
4686 free_ct_name:
4687 if (ct_name) {
4688 for (i = 0; i < ct_name_cnt; i++)
4689 free(ct_name[i]);
4690 free(ct_name);
4691 }
4692
4693 out:
4694 free(line);
4695
4696 fclose(f);
4697 return ret;
4698 }
4699
4700 int list_all_containers(const char *lxcpath, char ***nret,
4701 struct lxc_container ***cret)
4702 {
4703 int i, ret, active_cnt, ct_cnt, ct_list_cnt;
4704 char **active_name;
4705 char **ct_name;
4706 struct lxc_container **ct_list = NULL;
4707
4708 ct_cnt = list_defined_containers(lxcpath, &ct_name, NULL);
4709 if (ct_cnt < 0)
4710 return ct_cnt;
4711
4712 active_cnt = list_active_containers(lxcpath, &active_name, NULL);
4713 if (active_cnt < 0) {
4714 ret = active_cnt;
4715 goto free_ct_name;
4716 }
4717
4718 for (i = 0; i < active_cnt; i++) {
4719 if (!array_contains(&ct_name, active_name[i], ct_cnt)) {
4720 if (!add_to_array(&ct_name, active_name[i], ct_cnt)) {
4721 ret = -1;
4722 goto free_active_name;
4723 }
4724 ct_cnt++;
4725 }
4726 free(active_name[i]);
4727 active_name[i] = NULL;
4728 }
4729 free(active_name);
4730 active_name = NULL;
4731 active_cnt = 0;
4732
4733 for (i = 0, ct_list_cnt = 0; i < ct_cnt && cret; i++) {
4734 struct lxc_container *c;
4735
4736 c = lxc_container_new(ct_name[i], lxcpath);
4737 if (!c) {
4738 WARN("Container %s:%s could not be loaded", lxcpath, ct_name[i]);
4739 remove_from_array(&ct_name, ct_name[i], ct_cnt--);
4740 continue;
4741 }
4742
4743 if (!add_to_clist(&ct_list, c, ct_list_cnt, false)) {
4744 lxc_container_put(c);
4745 ret = -1;
4746 goto free_ct_list;
4747 }
4748 ct_list_cnt++;
4749 }
4750
4751 if (cret)
4752 *cret = ct_list;
4753
4754 if (nret)
4755 *nret = ct_name;
4756 else {
4757 ret = ct_cnt;
4758 goto free_ct_name;
4759 }
4760 return ct_cnt;
4761
4762 free_ct_list:
4763 for (i = 0; i < ct_list_cnt; i++) {
4764 lxc_container_put(ct_list[i]);
4765 }
4766 free(ct_list);
4767
4768 free_active_name:
4769 for (i = 0; i < active_cnt; i++) {
4770 free(active_name[i]);
4771 }
4772 free(active_name);
4773
4774 free_ct_name:
4775 for (i = 0; i < ct_cnt; i++) {
4776 free(ct_name[i]);
4777 }
4778 free(ct_name);
4779 return ret;
4780 }
LXC mirror