]> git.proxmox.com Git - mirror_lxc.git/blob - src/lxc/lxccontainer.c
projects / mirror_lxc.git / blob
? search:
summary | shortlog | log | commit | commitdiff | tree
blame | history | raw | HEAD
coverity: #1425744
[mirror_lxc.git] / src / lxc / lxccontainer.c
1 /* liblxcapi
2 *
3 * Copyright © 2012 Serge Hallyn <serge.hallyn@ubuntu.com>.
4 * Copyright © 2012 Canonical Ltd.
5 *
6 * This library is free software; you can redistribute it and/or
7 * modify it under the terms of the GNU Lesser General Public
8 * License as published by the Free Software Foundation; either
9 * version 2.1 of the License, or (at your option) any later version.
10
11 * This library is distributed in the hope that it will be useful,
12 * but WITHOUT ANY WARRANTY; without even the implied warranty of
13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
14 * Lesser General Public License for more details.
15
16 * You should have received a copy of the GNU Lesser General Public
17 * License along with this library; if not, write to the Free Software
18 * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
19 */
20
21 #define _GNU_SOURCE
22 #include <arpa/inet.h>
23 #include <dirent.h>
24 #include <errno.h>
25 #include <fcntl.h>
26 #include <grp.h>
27 #include <libgen.h>
28 #include <pthread.h>
29 #include <sched.h>
30 #include <stdarg.h>
31 #include <stdint.h>
32 #include <stdio.h>
33 #include <sys/file.h>
34 #include <sys/mman.h>
35 #include <sys/mount.h>
36 #include <sys/syscall.h>
37 #include <sys/sysmacros.h>
38 #include <sys/types.h>
39 #include <sys/wait.h>
40 #include <unistd.h>
41
42 #include "af_unix.h"
43 #include "attach.h"
44 #include "cgroup.h"
45 #include "commands.h"
46 #include "commands_utils.h"
47 #include "conf.h"
48 #include "config.h"
49 #include "confile.h"
50 #include "confile_utils.h"
51 #include "criu.h"
52 #include "error.h"
53 #include "initutils.h"
54 #include "log.h"
55 #include "lxc.h"
56 #include "lxccontainer.h"
57 #include "lxclock.h"
58 #include "monitor.h"
59 #include "namespace.h"
60 #include "network.h"
61 #include "parse.h"
62 #include "start.h"
63 #include "state.h"
64 #include "storage.h"
65 #include "storage/btrfs.h"
66 #include "storage/overlay.h"
67 #include "storage_utils.h"
68 #include "sync.h"
69 #include "terminal.h"
70 #include "utils.h"
71 #include "version.h"
72
73 /* major()/minor() */
74 #ifdef MAJOR_IN_MKDEV
75 #include <sys/mkdev.h>
76 #endif
77
78 #if HAVE_IFADDRS_H
79 #include <ifaddrs.h>
80 #else
81 #include <../include/ifaddrs.h>
82 #endif
83
84 #if IS_BIONIC
85 #include <../include/lxcmntent.h>
86 #else
87 #include <mntent.h>
88 #endif
89
90 /* Define faccessat() if missing from the C library */
91 #ifndef HAVE_FACCESSAT
92 static int faccessat(int __fd, const char *__file, int __type, int __flag)
93 {
94 #ifdef __NR_faccessat
95 return syscall(__NR_faccessat, __fd, __file, __type, __flag);
96 #else
97 errno = ENOSYS;
98 return -1;
99 #endif
100 }
101 #endif
102
103 lxc_log_define(lxc_container, lxc);
104
105 static bool do_lxcapi_destroy(struct lxc_container *c);
106 static const char *lxcapi_get_config_path(struct lxc_container *c);
107 #define do_lxcapi_get_config_path(c) lxcapi_get_config_path(c)
108 static bool do_lxcapi_set_config_item(struct lxc_container *c, const char *key, const char *v);
109 static bool container_destroy(struct lxc_container *c,
110 struct lxc_storage *storage);
111 static bool get_snappath_dir(struct lxc_container *c, char *snappath);
112 static bool lxcapi_snapshot_destroy_all(struct lxc_container *c);
113 static bool do_lxcapi_save_config(struct lxc_container *c, const char *alt_file);
114
115 static bool config_file_exists(const char *lxcpath, const char *cname)
116 {
117 int ret;
118 size_t len;
119 char *fname;
120
121 /* $lxcpath + '/' + $cname + '/config' + \0 */
122 len = strlen(lxcpath) + strlen(cname) + 9;
123 fname = alloca(len);
124 ret = snprintf(fname, len, "%s/%s/config", lxcpath, cname);
125 if (ret < 0 || (size_t)ret >= len)
126 return false;
127
128 return file_exists(fname);
129 }
130
131 /* A few functions to help detect when a container creation failed. If a
132 * container creation was killed partway through, then trying to actually start
133 * that container could harm the host. We detect this by creating a 'partial'
134 * file under the container directory, and keeping an advisory lock. When
135 * container creation completes, we remove that file. When we load or try to
136 * start a container, if we find that file, without a flock, we remove the
137 * container.
138 */
139 static int ongoing_create(struct lxc_container *c)
140 {
141 int fd, ret;
142 size_t len;
143 char *path;
144 struct flock lk = {0};
145
146 len = strlen(c->config_path) + strlen(c->name) + 10;
147 path = alloca(len);
148 ret = snprintf(path, len, "%s/%s/partial", c->config_path, c->name);
149 if (ret < 0 || (size_t)ret >= len)
150 return -1;
151
152 if (!file_exists(path))
153 return 0;
154
155 fd = open(path, O_RDWR);
156 if (fd < 0)
157 return 0;
158
159 lk.l_type = F_WRLCK;
160 lk.l_whence = SEEK_SET;
161 lk.l_pid = -1;
162
163 ret = fcntl(fd, F_OFD_GETLK, &lk);
164 if (ret < 0 && errno == EINVAL)
165 ret = flock(fd, LOCK_EX | LOCK_NB);
166 close(fd);
167 if (ret == 0 && lk.l_pid != -1) {
168 /* create is still ongoing */
169 return 1;
170 }
171
172 /* Create completed but partial is still there. */
173 return 2;
174 }
175
176 static int create_partial(struct lxc_container *c)
177 {
178 int fd, ret;
179 size_t len;
180 char *path;
181 struct flock lk = {0};
182
183 /* $lxcpath + '/' + $name + '/partial' + \0 */
184 len = strlen(c->config_path) + strlen(c->name) + 10;
185 path = alloca(len);
186 ret = snprintf(path, len, "%s/%s/partial", c->config_path, c->name);
187 if (ret < 0 || (size_t)ret >= len)
188 return -1;
189
190 fd = open(path, O_RDWR | O_CREAT | O_EXCL, 0755);
191 if (fd < 0)
192 return -1;
193
194 lk.l_type = F_WRLCK;
195 lk.l_whence = SEEK_SET;
196
197 ret = fcntl(fd, F_OFD_SETLKW, &lk);
198 if (ret < 0) {
199 if (errno == EINVAL) {
200 ret = flock(fd, LOCK_EX);
201 if (ret == 0)
202 return fd;
203 }
204
205 SYSERROR("Failed to lock partial file %s", path);
206 close(fd);
207 return -1;
208 }
209
210 return fd;
211 }
212
213 static void remove_partial(struct lxc_container *c, int fd)
214 {
215 int ret;
216 size_t len;
217 char *path;
218
219 close(fd);
220 /* $lxcpath + '/' + $name + '/partial' + \0 */
221 len = strlen(c->config_path) + strlen(c->name) + 10;
222 path = alloca(len);
223 ret = snprintf(path, len, "%s/%s/partial", c->config_path, c->name);
224 if (ret < 0 || (size_t)ret >= len)
225 return;
226
227 ret = unlink(path);
228 if (ret < 0)
229 SYSERROR("Failed to remove partial file %s", path);
230 }
231
232 /* LOCKING
233 * 1. container_mem_lock(c) protects the struct lxc_container from multiple threads.
234 * 2. container_disk_lock(c) protects the on-disk container data - in particular the
235 * container configuration file.
236 * The container_disk_lock also takes the container_mem_lock.
237 * 3. thread_mutex protects process data (ex: fd table) from multiple threads.
238 * NOTHING mutexes two independent programs with their own struct
239 * lxc_container for the same c->name, between API calls. For instance,
240 * c->config_read(); c->start(); Between those calls, data on disk
241 * could change (which shouldn't bother the caller unless for instance
242 * the rootfs get moved). c->config_read(); update; c->config_write();
243 * Two such updaters could race. The callers should therefore check their
244 * results. Trying to prevent that would necessarily expose us to deadlocks
245 * due to hung callers. So I prefer to keep the locks only within our own
246 * functions, not across functions.
247 *
248 * If you're going to clone while holding a lxccontainer, increment
249 * c->numthreads (under privlock) before forking. When deleting,
250 * decrement numthreads under privlock, then if it hits 0 you can delete.
251 * Do not ever use a lxccontainer whose numthreads you did not bump.
252 */
253
254 static void lxc_container_free(struct lxc_container *c)
255 {
256 if (!c)
257 return;
258
259 free(c->configfile);
260 c->configfile = NULL;
261
262 free(c->error_string);
263 c->error_string = NULL;
264
265 if (c->slock) {
266 lxc_putlock(c->slock);
267 c->slock = NULL;
268 }
269
270 if (c->privlock) {
271 lxc_putlock(c->privlock);
272 c->privlock = NULL;
273 }
274
275 free(c->name);
276 c->name = NULL;
277
278 if (c->lxc_conf) {
279 lxc_conf_free(c->lxc_conf);
280 c->lxc_conf = NULL;
281 }
282
283 free(c->config_path);
284 c->config_path = NULL;
285
286 free(c);
287 }
288
289 /* Consider the following case:
290 *
291 * |====================================================================|
292 * | freer | racing get()er |
293 * |====================================================================|
294 * | lxc_container_put() | lxc_container_get() |
295 * | \ lxclock(c->privlock) | c->numthreads < 1? (no) |
296 * | \ c->numthreads = 0 | \ lxclock(c->privlock) -> waits |
297 * | \ lxcunlock() | \ |
298 * | \ lxc_container_free() | \ lxclock() returns |
299 * | | \ c->numthreads < 1 -> return 0 |
300 * | \ \ (free stuff) | |
301 * | \ \ sem_destroy(privlock) | |
302 * |_______________________________|____________________________________|
303 *
304 * When the get()er checks numthreads the first time, one of the following
305 * is true:
306 * 1. freer has set numthreads = 0. get() returns 0
307 * 2. freer is between lxclock and setting numthreads to 0. get()er will
308 * sem_wait on privlock, get lxclock after freer() drops it, then see
309 * numthreads is 0 and exit without touching lxclock again..
310 * 3. freer has not yet locked privlock. If get()er runs first, then put()er
311 * will see --numthreads = 1 and not call lxc_container_free().
312 */
313
314 int lxc_container_get(struct lxc_container *c)
315 {
316 if (!c)
317 return 0;
318
319 /* If someone else has already started freeing the container, don't try
320 * to take the lock, which may be invalid.
321 */
322 if (c->numthreads < 1)
323 return 0;
324
325 if (container_mem_lock(c))
326 return 0;
327
328 /* Bail without trying to unlock, bc the privlock is now probably in
329 * freed memory.
330 */
331 if (c->numthreads < 1)
332 return 0;
333
334 c->numthreads++;
335 container_mem_unlock(c);
336
337 return 1;
338 }
339
340 int lxc_container_put(struct lxc_container *c)
341 {
342 if (!c)
343 return -1;
344
345 if (container_mem_lock(c))
346 return -1;
347
348 c->numthreads--;
349
350 if (c->numthreads < 1) {
351 container_mem_unlock(c);
352 lxc_container_free(c);
353 return 1;
354 }
355
356 container_mem_unlock(c);
357
358 return 0;
359 }
360
361 static bool do_lxcapi_is_defined(struct lxc_container *c)
362 {
363 int statret;
364 struct stat statbuf;
365 bool ret = false;
366
367 if (!c)
368 return false;
369
370 if (container_mem_lock(c))
371 return false;
372
373 if (!c->configfile)
374 goto on_error;
375
376 statret = stat(c->configfile, &statbuf);
377 if (statret != 0)
378 goto on_error;
379
380 ret = true;
381
382 on_error:
383 container_mem_unlock(c);
384
385 return ret;
386 }
387
388 #define WRAP_API(rettype, fnname) \
389 static rettype fnname(struct lxc_container *c) \
390 { \
391 rettype ret; \
392 bool reset_config = false; \
393 \
394 if (!current_config && c && c->lxc_conf) { \
395 current_config = c->lxc_conf; \
396 reset_config = true; \
397 } \
398 \
399 ret = do_##fnname(c); \
400 if (reset_config) \
401 current_config = NULL; \
402 \
403 return ret; \
404 }
405
406 #define WRAP_API_1(rettype, fnname, t1) \
407 static rettype fnname(struct lxc_container *c, t1 a1) \
408 { \
409 rettype ret; \
410 bool reset_config = false; \
411 \
412 if (!current_config && c && c->lxc_conf) { \
413 current_config = c->lxc_conf; \
414 reset_config = true; \
415 } \
416 \
417 ret = do_##fnname(c, a1); \
418 if (reset_config) \
419 current_config = NULL; \
420 \
421 return ret; \
422 }
423
424 #define WRAP_API_2(rettype, fnname, t1, t2) \
425 static rettype fnname(struct lxc_container *c, t1 a1, t2 a2) \
426 { \
427 rettype ret; \
428 bool reset_config = false; \
429 \
430 if (!current_config && c && c->lxc_conf) { \
431 current_config = c->lxc_conf; \
432 reset_config = true; \
433 } \
434 \
435 ret = do_##fnname(c, a1, a2); \
436 if (reset_config) \
437 current_config = NULL; \
438 \
439 return ret; \
440 }
441
442 #define WRAP_API_3(rettype, fnname, t1, t2, t3) \
443 static rettype fnname(struct lxc_container *c, t1 a1, t2 a2, t3 a3) \
444 { \
445 rettype ret; \
446 bool reset_config = false; \
447 \
448 if (!current_config && c && c->lxc_conf) { \
449 current_config = c->lxc_conf; \
450 reset_config = true; \
451 } \
452 \
453 ret = do_##fnname(c, a1, a2, a3); \
454 if (reset_config) \
455 current_config = NULL; \
456 \
457 return ret; \
458 }
459
460 WRAP_API(bool, lxcapi_is_defined)
461
462 static const char *do_lxcapi_state(struct lxc_container *c)
463 {
464 lxc_state_t s;
465
466 if (!c)
467 return NULL;
468
469 s = lxc_getstate(c->name, c->config_path);
470 return lxc_state2str(s);
471 }
472
473 WRAP_API(const char *, lxcapi_state)
474
475 static bool is_stopped(struct lxc_container *c)
476 {
477 lxc_state_t s;
478
479 s = lxc_getstate(c->name, c->config_path);
480 return (s == STOPPED);
481 }
482
483 static bool do_lxcapi_is_running(struct lxc_container *c)
484 {
485 if (!c)
486 return false;
487
488 return !is_stopped(c);
489 }
490
491 WRAP_API(bool, lxcapi_is_running)
492
493 static bool do_lxcapi_freeze(struct lxc_container *c)
494 {
495 int ret;
496
497 if (!c)
498 return false;
499
500 ret = lxc_freeze(c->name, c->config_path);
501 if (ret < 0)
502 return false;
503
504 return true;
505 }
506
507 WRAP_API(bool, lxcapi_freeze)
508
509 static bool do_lxcapi_unfreeze(struct lxc_container *c)
510 {
511 int ret;
512
513 if (!c)
514 return false;
515
516 ret = lxc_unfreeze(c->name, c->config_path);
517 if (ret < 0)
518 return false;
519
520 return true;
521 }
522
523 WRAP_API(bool, lxcapi_unfreeze)
524
525 static int do_lxcapi_console_getfd(struct lxc_container *c, int *ttynum, int *masterfd)
526 {
527 if (!c)
528 return -1;
529
530 return lxc_terminal_getfd(c, ttynum, masterfd);
531 }
532
533 WRAP_API_2(int, lxcapi_console_getfd, int *, int *)
534
535 static int lxcapi_console(struct lxc_container *c, int ttynum, int stdinfd,
536 int stdoutfd, int stderrfd, int escape)
537 {
538 int ret;
539
540 if (!c)
541 return -1;
542
543 current_config = c->lxc_conf;
544 ret = lxc_console(c, ttynum, stdinfd, stdoutfd, stderrfd, escape);
545 current_config = NULL;
546
547 return ret;
548 }
549
550 static int do_lxcapi_console_log(struct lxc_container *c, struct lxc_console_log *log)
551 {
552 int ret;
553
554 ret = lxc_cmd_console_log(c->name, do_lxcapi_get_config_path(c), log);
555 if (ret < 0) {
556 if (ret == -ENODATA)
557 NOTICE("The console log is empty");
558 else if (ret == -EFAULT)
559 NOTICE("The container does not keep a console log");
560 else if (ret == -ENOENT)
561 NOTICE("The container does not keep a console log file");
562 else if (ret == -EIO)
563 NOTICE("Failed to write console log to log file");
564 else
565 ERROR("Failed to retrieve console log");
566 }
567
568 return ret;
569 }
570
571 WRAP_API_1(int, lxcapi_console_log, struct lxc_console_log *)
572
573 static pid_t do_lxcapi_init_pid(struct lxc_container *c)
574 {
575 if (!c)
576 return -1;
577
578 return lxc_cmd_get_init_pid(c->name, c->config_path);
579 }
580
581 WRAP_API(pid_t, lxcapi_init_pid)
582
583 static bool load_config_locked(struct lxc_container *c, const char *fname)
584 {
585 if (!c->lxc_conf)
586 c->lxc_conf = lxc_conf_init();
587
588 if (!c->lxc_conf)
589 return false;
590
591 if (lxc_config_read(fname, c->lxc_conf, false) != 0)
592 return false;
593
594 return true;
595 }
596
597 static bool do_lxcapi_load_config(struct lxc_container *c, const char *alt_file)
598 {
599 int lret;
600 const char *fname;
601 bool need_disklock = false, ret = false;
602
603 if (!c)
604 return false;
605
606 fname = c->configfile;
607 if (alt_file)
608 fname = alt_file;
609 if (!fname)
610 return false;
611
612 /* If we're reading something other than the container's config, we only
613 * need to lock the in-memory container. If loading the container's
614 * config file, take the disk lock.
615 */
616 if (strcmp(fname, c->configfile) == 0)
617 need_disklock = true;
618
619 if (need_disklock)
620 lret = container_disk_lock(c);
621 else
622 lret = container_mem_lock(c);
623 if (lret)
624 return false;
625
626 ret = load_config_locked(c, fname);
627
628 if (need_disklock)
629 container_disk_unlock(c);
630 else
631 container_mem_unlock(c);
632
633 return ret;
634 }
635
636 WRAP_API_1(bool, lxcapi_load_config, const char *)
637
638 static bool do_lxcapi_want_daemonize(struct lxc_container *c, bool state)
639 {
640 if (!c || !c->lxc_conf)
641 return false;
642
643 if (container_mem_lock(c))
644 return false;
645
646 c->daemonize = state;
647
648 container_mem_unlock(c);
649
650 return true;
651 }
652
653 WRAP_API_1(bool, lxcapi_want_daemonize, bool)
654
655 static bool do_lxcapi_want_close_all_fds(struct lxc_container *c, bool state)
656 {
657 if (!c || !c->lxc_conf)
658 return false;
659
660 if (container_mem_lock(c))
661 return false;
662
663 c->lxc_conf->close_all_fds = state;
664
665 container_mem_unlock(c);
666
667 return true;
668 }
669
670 WRAP_API_1(bool, lxcapi_want_close_all_fds, bool)
671
672 static bool do_lxcapi_wait(struct lxc_container *c, const char *state,
673 int timeout)
674 {
675 int ret;
676
677 if (!c)
678 return false;
679
680 ret = lxc_wait(c->name, state, timeout, c->config_path);
681 return ret == 0;
682 }
683
684 WRAP_API_2(bool, lxcapi_wait, const char *, int)
685
686 static bool am_single_threaded(void)
687 {
688 DIR *dir;
689 struct dirent *direntp;
690 int count = 0;
691
692 dir = opendir("/proc/self/task");
693 if (!dir)
694 return false;
695
696 while ((direntp = readdir(dir))) {
697 if (strcmp(direntp->d_name, ".") == 0)
698 continue;
699
700 if (strcmp(direntp->d_name, "..") == 0)
701 continue;
702
703 count++;
704 if (count > 1)
705 break;
706 }
707 closedir(dir);
708
709 return count == 1;
710 }
711
712 static void push_arg(char ***argp, char *arg, int *nargs)
713 {
714 char *copy;
715 char **argv;
716
717 copy = must_copy_string(arg);
718
719 do {
720 argv = realloc(*argp, (*nargs + 2) * sizeof(char *));
721 } while (!argv);
722
723 *argp = argv;
724 argv[*nargs] = copy;
725 (*nargs)++;
726 argv[*nargs] = NULL;
727 }
728
729 static char **split_init_cmd(const char *incmd)
730 {
731 size_t len;
732 char *copy, *p;
733 char **argv;
734 int nargs = 0;
735 char *saveptr = NULL;
736
737 if (!incmd)
738 return NULL;
739
740 len = strlen(incmd) + 1;
741 copy = alloca(len);
742 strncpy(copy, incmd, len);
743 copy[len - 1] = '\0';
744
745 do {
746 argv = malloc(sizeof(char *));
747 } while (!argv);
748
749 argv[0] = NULL;
750 for (; (p = strtok_r(copy, " ", &saveptr)); copy = NULL)
751 push_arg(&argv, p, &nargs);
752
753 if (nargs == 0) {
754 free(argv);
755 return NULL;
756 }
757
758 return argv;
759 }
760
761 static void free_init_cmd(char **argv)
762 {
763 int i = 0;
764
765 if (!argv)
766 return;
767
768 while (argv[i])
769 free(argv[i++]);
770
771 free(argv);
772 }
773
774 static int lxc_rcv_status(int state_socket)
775 {
776 int ret;
777 int state = -1;
778
779 again:
780 /* Receive container state. */
781 ret = lxc_abstract_unix_rcv_credential(state_socket, &state,
782 sizeof(int));
783 if (ret <= 0) {
784 if (errno != EINTR)
785 return -1;
786 TRACE("Caught EINTR; retrying");
787 goto again;
788 }
789
790 return state;
791 }
792
793 static bool wait_on_daemonized_start(struct lxc_handler *handler, int pid)
794 {
795 int ret, state;
796
797 /* Close write end of the socket pair. */
798 close(handler->state_socket_pair[1]);
799 handler->state_socket_pair[1] = -1;
800
801 state = lxc_rcv_status(handler->state_socket_pair[0]);
802
803 /* Close read end of the socket pair. */
804 close(handler->state_socket_pair[0]);
805 handler->state_socket_pair[0] = -1;
806
807 /* The first child is going to fork() again and then exits. So we reap
808 * the first child here.
809 */
810 ret = wait_for_pid(pid);
811 if (ret < 0)
812 DEBUG("Failed waiting on first child %d", pid);
813 else
814 DEBUG("First child %d exited", pid);
815
816 if (state < 0) {
817 SYSERROR("Failed to receive the container state");
818 return false;
819 }
820
821 /* If we receive anything else then running we know that the container
822 * failed to start.
823 */
824 if (state != RUNNING) {
825 ERROR("Received container state \"%s\" instead of \"RUNNING\"",
826 lxc_state2str(state));
827 return false;
828 }
829
830 TRACE("Container is in \"RUNNING\" state");
831 return true;
832 }
833
834 static bool do_lxcapi_start(struct lxc_container *c, int useinit, char * const argv[])
835 {
836 int ret;
837 struct lxc_handler *handler;
838 struct lxc_conf *conf;
839 char *default_args[] = {
840 "/sbin/init",
841 NULL,
842 };
843 char **init_cmd = NULL;
844 int keepfds[3] = {-1, -1, -1};
845
846 /* container does exist */
847 if (!c)
848 return false;
849
850 /* If anything fails before we set error_num, we want an error in there.
851 */
852 c->error_num = 1;
853
854 /* Container has not been setup. */
855 if (!c->lxc_conf)
856 return false;
857
858 ret = ongoing_create(c);
859 if (ret < 0) {
860 ERROR("Failed checking for incomplete container creation");
861 return false;
862 } else if (ret == 1) {
863 ERROR("Ongoing container creation detected");
864 return false;
865 } else if (ret == 2) {
866 ERROR("Failed to create container");
867 do_lxcapi_destroy(c);
868 return false;
869 }
870
871 if (container_mem_lock(c))
872 return false;
873
874 conf = c->lxc_conf;
875
876 /* initialize handler */
877 handler = lxc_init_handler(c->name, conf, c->config_path, c->daemonize);
878
879 container_mem_unlock(c);
880 if (!handler)
881 return false;
882
883 if (!argv) {
884 if (useinit && conf->execute_cmd)
885 argv = init_cmd = split_init_cmd(conf->execute_cmd);
886 else
887 argv = init_cmd = split_init_cmd(conf->init_cmd);
888 }
889
890 /* ... otherwise use default_args. */
891 if (!argv) {
892 if (useinit) {
893 ERROR("No valid init detected");
894 lxc_free_handler(handler);
895 return false;
896 }
897 argv = default_args;
898 }
899
900 /* I'm not sure what locks we want here.Any? Is liblxc's locking enough
901 * here to protect the on disk container? We don't want to exclude
902 * things like lxc_info while the container is running.
903 */
904 if (c->daemonize) {
905 bool started;
906 char title[2048];
907 pid_t pid;
908
909 pid = fork();
910 if (pid < 0) {
911 free_init_cmd(init_cmd);
912 lxc_free_handler(handler);
913 return false;
914 }
915
916 /* first parent */
917 if (pid != 0) {
918 /* Set to NULL because we don't want father unlink
919 * the PID file, child will do the free and unlink.
920 */
921 c->pidfile = NULL;
922
923 /* Wait for container to tell us whether it started
924 * successfully.
925 */
926 started = wait_on_daemonized_start(handler, pid);
927
928 free_init_cmd(init_cmd);
929 lxc_free_handler(handler);
930 return started;
931 }
932
933 /* first child */
934
935 /* We don't really care if this doesn't print all the
936 * characters. All that it means is that the proctitle will be
937 * ugly. Similarly, we also don't care if setproctitle() fails.
938 * */
939 (void)snprintf(title, sizeof(title), "[lxc monitor] %s %s", c->config_path, c->name);
940 INFO("Attempting to set proc title to %s", title);
941 (void)setproctitle(title);
942
943 /* We fork() a second time to be reparented to init. Like
944 * POSIX's daemon() function we change to "/" and redirect
945 * std{in,out,err} to /dev/null.
946 */
947 pid = fork();
948 if (pid < 0) {
949 SYSERROR("Failed to fork first child process");
950 _exit(EXIT_FAILURE);
951 }
952
953 /* second parent */
954 if (pid != 0) {
955 free_init_cmd(init_cmd);
956 lxc_free_handler(handler);
957 _exit(EXIT_SUCCESS);
958 }
959
960 /* second child */
961
962 /* change to / directory */
963 ret = chdir("/");
964 if (ret < 0) {
965 SYSERROR("Failed to change to \"/\" directory");
966 _exit(EXIT_FAILURE);
967 }
968
969 keepfds[0] = handler->conf->maincmd_fd;
970 keepfds[1] = handler->state_socket_pair[0];
971 keepfds[2] = handler->state_socket_pair[1];
972 ret = lxc_check_inherited(conf, true, keepfds,
973 sizeof(keepfds) / sizeof(keepfds[0]));
974 if (ret < 0)
975 _exit(EXIT_FAILURE);
976
977 /* redirect std{in,out,err} to /dev/null */
978 ret = null_stdfds();
979 if (ret < 0) {
980 ERROR("Failed to redirect std{in,out,err} to /dev/null");
981 _exit(EXIT_FAILURE);
982 }
983
984 /* become session leader */
985 ret = setsid();
986 if (ret < 0)
987 TRACE("Process %d is already process group leader", lxc_raw_getpid());
988 } else {
989 if (!am_single_threaded()) {
990 ERROR("Cannot start non-daemonized container when threaded");
991 free_init_cmd(init_cmd);
992 lxc_free_handler(handler);
993 return false;
994 }
995 }
996
997 /* We need to write PID file after daemonize, so we always
998 * write the right PID.
999 */
1000 if (c->pidfile) {
1001 int ret, w;
1002 char pidstr[LXC_NUMSTRLEN64];
1003
1004 w = snprintf(pidstr, LXC_NUMSTRLEN64, "%d", (int)lxc_raw_getpid());
1005 if (w < 0 || (size_t)w >= LXC_NUMSTRLEN64) {
1006 free_init_cmd(init_cmd);
1007 lxc_free_handler(handler);
1008
1009 SYSERROR("Failed to write monitor pid to \"%s\"", c->pidfile);
1010
1011 if (c->daemonize)
1012 _exit(EXIT_FAILURE);
1013
1014 return false;
1015 }
1016
1017 ret = lxc_write_to_file(c->pidfile, pidstr, w, false, 0600);
1018 if (ret < 0) {
1019 free_init_cmd(init_cmd);
1020 lxc_free_handler(handler);
1021
1022 SYSERROR("Failed to write '%s'", c->pidfile);
1023
1024 if (c->daemonize)
1025 _exit(EXIT_FAILURE);
1026
1027 return false;
1028 }
1029 }
1030
1031 conf->reboot = 0;
1032
1033 /* Unshare the mount namespace if requested */
1034 if (conf->monitor_unshare) {
1035 ret = unshare(CLONE_NEWNS);
1036 if (ret < 0) {
1037 SYSERROR("failed to unshare mount namespace");
1038 lxc_free_handler(handler);
1039 ret = 1;
1040 goto on_error;
1041 }
1042
1043 ret = mount(NULL, "/", NULL, MS_SLAVE|MS_REC, NULL);
1044 if (ret < 0) {
1045 SYSERROR("Failed to make / rslave at startup");
1046 lxc_free_handler(handler);
1047 ret = 1;
1048 goto on_error;
1049 }
1050 }
1051
1052 reboot:
1053 if (conf->reboot == 2) {
1054 /* initialize handler */
1055 handler = lxc_init_handler(c->name, conf, c->config_path, c->daemonize);
1056 if (!handler) {
1057 ret = 1;
1058 goto on_error;
1059 }
1060 }
1061
1062 keepfds[0] = handler->conf->maincmd_fd;
1063 keepfds[1] = handler->state_socket_pair[0];
1064 keepfds[2] = handler->state_socket_pair[1];
1065 ret = lxc_check_inherited(conf, c->daemonize, keepfds,
1066 sizeof(keepfds) / sizeof(keepfds[0]));
1067 if (ret < 0) {
1068 lxc_free_handler(handler);
1069 ret = 1;
1070 goto on_error;
1071 }
1072
1073 if (useinit)
1074 ret = lxc_execute(c->name, argv, 1, handler, c->config_path,
1075 c->daemonize, &c->error_num);
1076 else
1077 ret = lxc_start(c->name, argv, handler, c->config_path,
1078 c->daemonize, &c->error_num);
1079
1080 if (conf->reboot == 1) {
1081 INFO("Container requested reboot");
1082 conf->reboot = 2;
1083 goto reboot;
1084 }
1085
1086 on_error:
1087 if (c->pidfile) {
1088 unlink(c->pidfile);
1089 free(c->pidfile);
1090 c->pidfile = NULL;
1091 }
1092 free_init_cmd(init_cmd);
1093
1094 if (c->daemonize && ret != 0)
1095 _exit(EXIT_FAILURE);
1096 else if (c->daemonize)
1097 _exit(EXIT_SUCCESS);
1098
1099 if (ret != 0)
1100 return false;
1101
1102 return true;
1103 }
1104
1105 static bool lxcapi_start(struct lxc_container *c, int useinit,
1106 char *const argv[])
1107 {
1108 bool ret;
1109
1110 current_config = c ? c->lxc_conf : NULL;
1111 ret = do_lxcapi_start(c, useinit, argv);
1112 current_config = NULL;
1113
1114 return ret;
1115 }
1116
1117 /* Note, there MUST be an ending NULL. */
1118 static bool lxcapi_startl(struct lxc_container *c, int useinit, ...)
1119 {
1120 va_list ap;
1121 char **inargs = NULL;
1122 bool bret = false;
1123
1124 /* container exists */
1125 if (!c)
1126 return false;
1127
1128 current_config = c->lxc_conf;
1129
1130 va_start(ap, useinit);
1131 inargs = lxc_va_arg_list_to_argv(ap, 0, 1);
1132 va_end(ap);
1133 if (!inargs)
1134 goto on_error;
1135
1136 /* pass NULL if no arguments were supplied */
1137 bret = do_lxcapi_start(c, useinit, *inargs ? inargs : NULL);
1138
1139 on_error:
1140 if (inargs) {
1141 char **arg;
1142 for (arg = inargs; *arg; arg++)
1143 free(*arg);
1144 free(inargs);
1145 }
1146
1147 current_config = NULL;
1148
1149 return bret;
1150 }
1151
1152 static bool do_lxcapi_stop(struct lxc_container *c)
1153 {
1154 int ret;
1155
1156 if (!c)
1157 return false;
1158
1159 ret = lxc_cmd_stop(c->name, c->config_path);
1160
1161 return ret == 0;
1162 }
1163
1164 WRAP_API(bool, lxcapi_stop)
1165
1166 static int do_create_container_dir(const char *path, struct lxc_conf *conf)
1167 {
1168 int lasterr;
1169 size_t len;
1170 char *p;
1171 int ret = -1;
1172
1173 mode_t mask = umask(0002);
1174 ret = mkdir(path, 0770);
1175 lasterr = errno;
1176 umask(mask);
1177 errno = lasterr;
1178 if (ret) {
1179 if (errno != EEXIST)
1180 return -1;
1181
1182 ret = 0;
1183 }
1184
1185 len = strlen(path);
1186 p = alloca(len + 1);
1187 strcpy(p, path);
1188 if (!lxc_list_empty(&conf->id_map)) {
1189 ret = chown_mapped_root(p, conf);
1190 if (ret < 0)
1191 ret = -1;
1192 }
1193
1194 return ret;
1195 }
1196
1197 /* Create the standard expected container dir. */
1198 static bool create_container_dir(struct lxc_container *c)
1199 {
1200 int ret;
1201 size_t len;
1202 char *s;
1203
1204 len = strlen(c->config_path) + strlen(c->name) + 2;
1205 s = malloc(len);
1206 if (!s)
1207 return false;
1208
1209 ret = snprintf(s, len, "%s/%s", c->config_path, c->name);
1210 if (ret < 0 || (size_t)ret >= len) {
1211 free(s);
1212 return false;
1213 }
1214
1215 ret = do_create_container_dir(s, c->lxc_conf);
1216 free(s);
1217
1218 return ret == 0;
1219 }
1220
1221 /* do_storage_create: thin wrapper around storage_create(). Like
1222 * storage_create(), it returns a mounted bdev on success, NULL on error.
1223 */
1224 static struct lxc_storage *do_storage_create(struct lxc_container *c,
1225 const char *type,
1226 struct bdev_specs *specs)
1227 {
1228 int ret;
1229 size_t len;
1230 char *dest;
1231 struct lxc_storage *bdev;
1232
1233 /* rootfs.path or lxcpath/lxcname/rootfs */
1234 if (c->lxc_conf->rootfs.path &&
1235 (access(c->lxc_conf->rootfs.path, F_OK) == 0)) {
1236 const char *rpath = c->lxc_conf->rootfs.path;
1237 len = strlen(rpath) + 1;
1238 dest = alloca(len);
1239 ret = snprintf(dest, len, "%s", rpath);
1240 } else {
1241 const char *lxcpath = do_lxcapi_get_config_path(c);
1242 len = strlen(c->name) + strlen(lxcpath) + 9;
1243 dest = alloca(len);
1244 ret = snprintf(dest, len, "%s/%s/rootfs", lxcpath, c->name);
1245 }
1246 if (ret < 0 || (size_t)ret >= len)
1247 return NULL;
1248
1249 bdev = storage_create(dest, type, c->name, specs);
1250 if (!bdev) {
1251 ERROR("Failed to create \"%s\" storage", type);
1252 return NULL;
1253 }
1254
1255 if (!c->set_config_item(c, "lxc.rootfs.path", bdev->src)) {
1256 ERROR("Failed to set \"lxc.rootfs.path = %s\"", bdev->src);
1257 return NULL;
1258 }
1259
1260 /* If we are not root, chown the rootfs dir to root in the target user
1261 * namespace.
1262 */
1263 ret = geteuid();
1264 if (ret != 0 || (c->lxc_conf && !lxc_list_empty(&c->lxc_conf->id_map))) {
1265 ret = chown_mapped_root(bdev->dest, c->lxc_conf);
1266 if (ret < 0) {
1267 ERROR("Error chowning \"%s\" to container root", bdev->dest);
1268 suggest_default_idmap();
1269 storage_put(bdev);
1270 return NULL;
1271 }
1272 }
1273
1274 return bdev;
1275 }
1276
1277 static char *lxcbasename(char *path)
1278 {
1279 char *p;
1280
1281 p = path + strlen(path) - 1;
1282 while (*p != '/' && p > path)
1283 p--;
1284
1285 return p;
1286 }
1287
1288 static bool create_run_template(struct lxc_container *c, char *tpath,
1289 bool need_null_stdfds, char *const argv[])
1290 {
1291 int ret;
1292 pid_t pid;
1293
1294 if (!tpath)
1295 return true;
1296
1297 pid = fork();
1298 if (pid < 0) {
1299 SYSERROR("Failed to fork task for container creation template");
1300 return false;
1301 }
1302
1303 if (pid == 0) { /* child */
1304 int i, len;
1305 char *namearg, *patharg, *rootfsarg;
1306 char **newargv;
1307 int nargs = 0;
1308 struct lxc_storage *bdev = NULL;
1309 struct lxc_conf *conf = c->lxc_conf;
1310 uid_t euid;
1311
1312 if (need_null_stdfds) {
1313 ret = null_stdfds();
1314 if (ret < 0)
1315 _exit(EXIT_FAILURE);
1316 }
1317
1318 bdev = storage_init(c->lxc_conf);
1319 if (!bdev) {
1320 ERROR("Failed to initialize storage");
1321 _exit(EXIT_FAILURE);
1322 }
1323
1324 euid = geteuid();
1325 if (euid == 0) {
1326 ret = unshare(CLONE_NEWNS);
1327 if (ret < 0) {
1328 ERROR("Failed to unshare CLONE_NEWNS");
1329 _exit(EXIT_FAILURE);
1330 }
1331
1332 ret = detect_shared_rootfs();
1333 if (ret == 1) {
1334 ret = mount(NULL, "/", NULL, MS_SLAVE | MS_REC, NULL);
1335 if (ret < 0) {
1336 SYSERROR("Failed to make \"/\" rslave");
1337 ERROR("Continuing...");
1338 }
1339 }
1340 }
1341
1342 if (strcmp(bdev->type, "dir") != 0 && strcmp(bdev->type, "btrfs") != 0) {
1343 if (euid != 0) {
1344 ERROR("Unprivileged users can only create "
1345 "btrfs and directory-backed containers");
1346 _exit(EXIT_FAILURE);
1347 }
1348
1349 if (strcmp(bdev->type, "overlay") == 0 ||
1350 strcmp(bdev->type, "overlayfs") == 0) {
1351 /* If we create an overlay container we need to
1352 * rsync the contents into
1353 * <container-path>/<container-name>/rootfs.
1354 * However, the overlay mount function will
1355 * mount will mount
1356 * <container-path>/<container-name>/delta0
1357 * over
1358 * <container-path>/<container-name>/rootfs
1359 * which means we would rsync the rootfs into
1360 * the delta directory. That doesn't make sense
1361 * since the delta directory only exists to
1362 * record the differences to
1363 * <container-path>/<container-name>/rootfs. So
1364 * let's simply bind-mount here and then rsync
1365 * directly into
1366 * <container-path>/<container-name>/rootfs.
1367 */
1368 char *src;
1369
1370 src = ovl_get_rootfs(bdev->src, &(size_t){0});
1371 if (!src) {
1372 ERROR("Failed to get rootfs");
1373 _exit(EXIT_FAILURE);
1374 }
1375
1376 ret = mount(src, bdev->dest, "bind", MS_BIND | MS_REC, NULL);
1377 if (ret < 0) {
1378 ERROR("Failed to mount rootfs");
1379 return -1;
1380 }
1381 } else {
1382 ret = bdev->ops->mount(bdev);
1383 if (ret < 0) {
1384 ERROR("Failed to mount rootfs");
1385 _exit(EXIT_FAILURE);
1386 }
1387 }
1388 } else { /* TODO come up with a better way here! */
1389 const char *src;
1390 free(bdev->dest);
1391 src = lxc_storage_get_path(bdev->src, bdev->type);
1392 bdev->dest = strdup(src);
1393 }
1394
1395 /* Create our new array, pre-pend the template name and base
1396 * args.
1397 */
1398 if (argv)
1399 for (nargs = 0; argv[nargs]; nargs++) {
1400 ;
1401 }
1402 /* template, path, rootfs and name args */
1403 nargs += 4;
1404
1405 newargv = malloc(nargs * sizeof(*newargv));
1406 if (!newargv)
1407 _exit(EXIT_FAILURE);
1408 newargv[0] = lxcbasename(tpath);
1409
1410 /* --path */
1411 len = strlen(c->config_path) + strlen(c->name) + strlen("--path=") + 2;
1412 patharg = malloc(len);
1413 if (!patharg)
1414 _exit(EXIT_FAILURE);
1415 ret = snprintf(patharg, len, "--path=%s/%s", c->config_path, c->name);
1416 if (ret < 0 || ret >= len)
1417 _exit(EXIT_FAILURE);
1418 newargv[1] = patharg;
1419
1420 /* --name */
1421 len = strlen("--name=") + strlen(c->name) + 1;
1422 namearg = malloc(len);
1423 if (!namearg)
1424 _exit(EXIT_FAILURE);
1425 ret = snprintf(namearg, len, "--name=%s", c->name);
1426 if (ret < 0 || ret >= len)
1427 _exit(EXIT_FAILURE);
1428 newargv[2] = namearg;
1429
1430 /* --rootfs */
1431 len = strlen("--rootfs=") + 1 + strlen(bdev->dest);
1432 rootfsarg = malloc(len);
1433 if (!rootfsarg)
1434 _exit(EXIT_FAILURE);
1435 ret = snprintf(rootfsarg, len, "--rootfs=%s", bdev->dest);
1436 if (ret < 0 || ret >= len)
1437 _exit(EXIT_FAILURE);
1438 newargv[3] = rootfsarg;
1439
1440 /* add passed-in args */
1441 if (argv)
1442 for (i = 4; i < nargs; i++)
1443 newargv[i] = argv[i - 4];
1444
1445 /* add trailing NULL */
1446 nargs++;
1447 newargv = realloc(newargv, nargs * sizeof(*newargv));
1448 if (!newargv)
1449 _exit(EXIT_FAILURE);
1450 newargv[nargs - 1] = NULL;
1451
1452 /* If we're running the template in a mapped userns, then we
1453 * prepend the template command with: lxc-usernsexec <-m map1>
1454 * ... <-m mapn> -- and we append "--mapped-uid x", where x is
1455 * the mapped uid for our geteuid()
1456 */
1457 if (!lxc_list_empty(&conf->id_map)) {
1458 int extraargs, hostuid_mapped, hostgid_mapped;
1459 char **n2;
1460 char txtuid[20], txtgid[20];
1461 struct lxc_list *it;
1462 struct id_map *map;
1463 int n2args = 1;
1464
1465 n2 = malloc(n2args * sizeof(*n2));
1466 if (!n2)
1467 _exit(EXIT_FAILURE);
1468
1469 newargv[0] = tpath;
1470 tpath = "lxc-usernsexec";
1471 n2[0] = "lxc-usernsexec";
1472 lxc_list_for_each(it, &conf->id_map) {
1473 map = it->elem;
1474 n2args += 2;
1475 n2 = realloc(n2, n2args * sizeof(char *));
1476 if (!n2)
1477 _exit(EXIT_FAILURE);
1478
1479 n2[n2args - 2] = "-m";
1480 n2[n2args - 1] = malloc(200);
1481 if (!n2[n2args - 1])
1482 _exit(EXIT_FAILURE);
1483
1484 ret = snprintf(n2[n2args - 1], 200, "%c:%lu:%lu:%lu",
1485 map->idtype == ID_TYPE_UID ? 'u' : 'g',
1486 map->nsid, map->hostid, map->range);
1487 if (ret < 0 || ret >= 200)
1488 _exit(EXIT_FAILURE);
1489 }
1490
1491 hostuid_mapped = mapped_hostid(geteuid(), conf, ID_TYPE_UID);
1492 extraargs = hostuid_mapped >= 0 ? 1 : 3;
1493 n2 = realloc(n2, (nargs + n2args + extraargs) * sizeof(char *));
1494 if (!n2)
1495 _exit(EXIT_FAILURE);
1496
1497 if (hostuid_mapped < 0) {
1498 hostuid_mapped = find_unmapped_nsid(conf, ID_TYPE_UID);
1499 n2[n2args++] = "-m";
1500 if (hostuid_mapped < 0) {
1501 ERROR("Failed to find free uid to map");
1502 _exit(EXIT_FAILURE);
1503 }
1504
1505 n2[n2args++] = malloc(200);
1506 if (!n2[n2args - 1]) {
1507 SYSERROR("out of memory");
1508 _exit(EXIT_FAILURE);
1509 }
1510 ret = snprintf(n2[n2args - 1], 200, "u:%d:%d:1",
1511 hostuid_mapped, geteuid());
1512 if (ret < 0 || ret >= 200)
1513 _exit(EXIT_FAILURE);
1514 }
1515
1516 hostgid_mapped = mapped_hostid(getegid(), conf, ID_TYPE_GID);
1517 extraargs = hostgid_mapped >= 0 ? 1 : 3;
1518 n2 = realloc(n2, (nargs + n2args + extraargs) * sizeof(char *));
1519 if (!n2)
1520 _exit(EXIT_FAILURE);
1521
1522 if (hostgid_mapped < 0) {
1523 hostgid_mapped = find_unmapped_nsid(conf, ID_TYPE_GID);
1524 n2[n2args++] = "-m";
1525 if (hostgid_mapped < 0) {
1526 ERROR("Failed to find free gid to map");
1527 _exit(EXIT_FAILURE);
1528 }
1529
1530 n2[n2args++] = malloc(200);
1531 if (!n2[n2args - 1]) {
1532 SYSERROR("out of memory");
1533 _exit(EXIT_FAILURE);
1534 }
1535
1536 ret = snprintf(n2[n2args - 1], 200, "g:%d:%d:1",
1537 hostgid_mapped, getegid());
1538 if (ret < 0 || ret >= 200)
1539 _exit(EXIT_FAILURE);
1540 }
1541 n2[n2args++] = "--";
1542 for (i = 0; i < nargs; i++)
1543 n2[i + n2args] = newargv[i];
1544 n2args += nargs;
1545
1546 /* Finally add "--mapped-uid $uid" to tell template what
1547 * to chown cached images to.
1548 */
1549 n2args += 4;
1550 n2 = realloc(n2, n2args * sizeof(char *));
1551 if (!n2)
1552 _exit(EXIT_FAILURE);
1553
1554 /* note n2[n2args-1] is NULL */
1555 n2[n2args - 5] = "--mapped-uid";
1556 snprintf(txtuid, 20, "%d", hostuid_mapped);
1557 n2[n2args - 4] = txtuid;
1558 n2[n2args - 3] = "--mapped-gid";
1559 snprintf(txtgid, 20, "%d", hostgid_mapped);
1560 n2[n2args - 2] = txtgid;
1561 n2[n2args - 1] = NULL;
1562 free(newargv);
1563 newargv = n2;
1564 }
1565
1566 execvp(tpath, newargv);
1567 SYSERROR("Failed to execute template %s", tpath);
1568 _exit(EXIT_FAILURE);
1569 }
1570
1571 ret = wait_for_pid(pid);
1572 if (ret != 0) {
1573 ERROR("Failed to create container from template");
1574 return false;
1575 }
1576
1577 return true;
1578 }
1579
1580 static bool prepend_lxc_header(char *path, const char *t, char *const argv[])
1581 {
1582 long flen;
1583 size_t len;
1584 char *contents;
1585 FILE *f;
1586 int ret = -1;
1587 #if HAVE_LIBGNUTLS
1588 int i;
1589 unsigned char md_value[SHA_DIGEST_LENGTH];
1590 char *tpath;
1591 #endif
1592
1593 f = fopen(path, "r");
1594 if (f == NULL)
1595 return false;
1596
1597 ret = fseek(f, 0, SEEK_END);
1598 if (ret < 0)
1599 goto out_error;
1600
1601 ret = -1;
1602 flen = ftell(f);
1603 if (flen < 0)
1604 goto out_error;
1605
1606 ret = fseek(f, 0, SEEK_SET);
1607 if (ret < 0)
1608 goto out_error;
1609
1610 ret = fseek(f, 0, SEEK_SET);
1611 if (ret < 0)
1612 goto out_error;
1613
1614 ret = -1;
1615 contents = malloc(flen + 1);
1616 if (!contents)
1617 goto out_error;
1618
1619 len = fread(contents, 1, flen, f);
1620 if (len != flen)
1621 goto out_free_contents;
1622
1623 contents[flen] = '\0';
1624 ret = fclose(f);
1625 f = NULL;
1626 if (ret < 0)
1627 goto out_free_contents;
1628
1629 #if HAVE_LIBGNUTLS
1630 tpath = get_template_path(t);
1631 if (!tpath) {
1632 ERROR("Invalid template \"%s\" specified", t);
1633 goto out_free_contents;
1634 }
1635
1636 ret = sha1sum_file(tpath, md_value);
1637 if (ret < 0) {
1638 ERROR("Failed to get sha1sum of %s", tpath);
1639 free(tpath);
1640 goto out_free_contents;
1641 }
1642 free(tpath);
1643 #endif
1644
1645 f = fopen(path, "w");
1646 if (f == NULL) {
1647 SYSERROR("Reopening config for writing");
1648 free(contents);
1649 return false;
1650 }
1651
1652 fprintf(f, "# Template used to create this container: %s\n", t);
1653 if (argv) {
1654 fprintf(f, "# Parameters passed to the template:");
1655 while (*argv) {
1656 fprintf(f, " %s", *argv);
1657 argv++;
1658 }
1659 fprintf(f, "\n");
1660 }
1661 #if HAVE_LIBGNUTLS
1662 fprintf(f, "# Template script checksum (SHA-1): ");
1663 for (i=0; i<SHA_DIGEST_LENGTH; i++)
1664 fprintf(f, "%02x", md_value[i]);
1665 fprintf(f, "\n");
1666 #endif
1667 fprintf(f, "# For additional config options, please look at lxc.container.conf(5)\n");
1668 fprintf(f, "\n# Uncomment the following line to support nesting containers:\n");
1669 fprintf(f, "#lxc.include = " LXCTEMPLATECONFIG "/nesting.conf\n");
1670 fprintf(f, "# (Be aware this has security implications)\n\n");
1671 if (fwrite(contents, 1, flen, f) != flen) {
1672 SYSERROR("Writing original contents");
1673 free(contents);
1674 fclose(f);
1675 return false;
1676 }
1677
1678 ret = 0;
1679
1680 out_free_contents:
1681 free(contents);
1682
1683 out_error:
1684 if (f) {
1685 int newret;
1686 newret = fclose(f);
1687 if (ret == 0)
1688 ret = newret;
1689 }
1690
1691 if (ret < 0) {
1692 SYSERROR("Error prepending header");
1693 return false;
1694 }
1695
1696 return true;
1697 }
1698
1699 static void lxcapi_clear_config(struct lxc_container *c)
1700 {
1701 if (!c || !c->lxc_conf)
1702 return;
1703
1704 lxc_conf_free(c->lxc_conf);
1705 c->lxc_conf = NULL;
1706 }
1707
1708 #define do_lxcapi_clear_config(c) lxcapi_clear_config(c)
1709
1710 /*
1711 * lxcapi_create:
1712 * create a container with the given parameters.
1713 * @c: container to be created. It has the lxcpath, name, and a starting
1714 * configuration already set
1715 * @t: the template to execute to instantiate the root filesystem and
1716 * adjust the configuration.
1717 * @bdevtype: backing store type to use. If NULL, dir will be used.
1718 * @specs: additional parameters for the backing store, i.e. LVM vg to
1719 * use.
1720 *
1721 * @argv: the arguments to pass to the template, terminated by NULL. If no
1722 * arguments, you can just pass NULL.
1723 */
1724 static bool do_lxcapi_create(struct lxc_container *c, const char *t,
1725 const char *bdevtype, struct bdev_specs *specs,
1726 int flags, char *const argv[])
1727 {
1728 int partial_fd;
1729 mode_t mask;
1730 pid_t pid;
1731 bool ret = false;
1732 char *tpath = NULL;
1733
1734 if (!c)
1735 return false;
1736
1737 if (t) {
1738 tpath = get_template_path(t);
1739 if (!tpath) {
1740 ERROR("Unknown template \"%s\"", t);
1741 goto out;
1742 }
1743 }
1744
1745 /* If a template is passed in, and the rootfs already is defined in the
1746 * container config and exists, then the caller is trying to create an
1747 * existing container. Return an error, but do NOT delete the container.
1748 */
1749 if (do_lxcapi_is_defined(c) && c->lxc_conf && c->lxc_conf->rootfs.path &&
1750 access(c->lxc_conf->rootfs.path, F_OK) == 0 && tpath) {
1751 ERROR("Container \"%s\" already exists in \"%s\"", c->name,
1752 c->config_path);
1753 goto free_tpath;
1754 }
1755
1756 if (!c->lxc_conf) {
1757 if (!do_lxcapi_load_config(c, lxc_global_config_value("lxc.default_config"))) {
1758 ERROR("Error loading default configuration file %s",
1759 lxc_global_config_value("lxc.default_config"));
1760 goto free_tpath;
1761 }
1762 }
1763
1764 if (!create_container_dir(c))
1765 goto free_tpath;
1766
1767 /* If both template and rootfs.path are set, template is setup as
1768 * rootfs.path. The container is already created if we have a config and
1769 * rootfs.path is accessible
1770 */
1771 if (!c->lxc_conf->rootfs.path && !tpath) {
1772 /* No template passed in and rootfs does not exist. */
1773 if (!c->save_config(c, NULL)) {
1774 ERROR("Failed to save initial config for \"%s\"", c->name);
1775 goto out;
1776 }
1777 ret = true;
1778 goto out;
1779 }
1780
1781 /* Rootfs passed into configuration, but does not exist. */
1782 if (c->lxc_conf->rootfs.path && access(c->lxc_conf->rootfs.path, F_OK) != 0)
1783 goto out;
1784
1785 if (do_lxcapi_is_defined(c) && c->lxc_conf->rootfs.path && !tpath) {
1786 /* Rootfs already existed, user just wanted to save the loaded
1787 * configuration.
1788 */
1789 if (!c->save_config(c, NULL))
1790 ERROR("Failed to save initial config for \"%s\"", c->name);
1791 ret = true;
1792 goto out;
1793 }
1794
1795 /* Mark that this container is being created */
1796 partial_fd = create_partial(c);
1797 if (partial_fd < 0)
1798 goto out;
1799
1800 /* No need to get disk lock bc we have the partial lock. */
1801
1802 mask = umask(0022);
1803
1804 /* Create the storage.
1805 * Note we can't do this in the same task as we use to execute the
1806 * template because of the way zfs works.
1807 * After you 'zfs create', zfs mounts the fs only in the initial
1808 * namespace.
1809 */
1810 pid = fork();
1811 if (pid < 0) {
1812 SYSERROR("Failed to fork task for container creation template");
1813 goto out_unlock;
1814 }
1815
1816 if (pid == 0) { /* child */
1817 struct lxc_storage *bdev = NULL;
1818
1819 bdev = do_storage_create(c, bdevtype, specs);
1820 if (!bdev) {
1821 ERROR("Failed to create %s storage for %s",
1822 bdevtype ? bdevtype : "(none)", c->name);
1823 _exit(EXIT_FAILURE);
1824 }
1825
1826 /* Save config file again to store the new rootfs location. */
1827 if (!do_lxcapi_save_config(c, NULL)) {
1828 ERROR("Failed to save initial config for %s", c->name);
1829 /* Parent task won't see the storage driver in the
1830 * config so we delete it.
1831 */
1832 bdev->ops->umount(bdev);
1833 bdev->ops->destroy(bdev);
1834 _exit(EXIT_FAILURE);
1835 }
1836 _exit(EXIT_SUCCESS);
1837 }
1838 if (wait_for_pid(pid) != 0)
1839 goto out_unlock;
1840
1841 /* Reload config to get the rootfs. */
1842 lxc_conf_free(c->lxc_conf);
1843 c->lxc_conf = NULL;
1844 if (!load_config_locked(c, c->configfile))
1845 goto out_unlock;
1846
1847 if (!create_run_template(c, tpath, !!(flags & LXC_CREATE_QUIET), argv))
1848 goto out_unlock;
1849
1850 /* Now clear out the lxc_conf we have, reload from the created
1851 * container.
1852 */
1853 do_lxcapi_clear_config(c);
1854
1855 if (t) {
1856 if (!prepend_lxc_header(c->configfile, tpath, argv)) {
1857 ERROR("Failed to prepend header to config file");
1858 goto out_unlock;
1859 }
1860 }
1861 ret = load_config_locked(c, c->configfile);
1862
1863 out_unlock:
1864 umask(mask);
1865 if (partial_fd >= 0)
1866 remove_partial(c, partial_fd);
1867 out:
1868 if (!ret)
1869 container_destroy(c, NULL);
1870 free_tpath:
1871 free(tpath);
1872 return ret;
1873 }
1874
1875 static bool lxcapi_create(struct lxc_container *c, const char *t,
1876 const char *bdevtype, struct bdev_specs *specs,
1877 int flags, char *const argv[])
1878 {
1879 bool ret;
1880 current_config = c ? c->lxc_conf : NULL;
1881 ret = do_lxcapi_create(c, t, bdevtype, specs, flags, argv);
1882 current_config = NULL;
1883 return ret;
1884 }
1885
1886 static bool do_lxcapi_reboot(struct lxc_container *c)
1887 {
1888 pid_t pid;
1889 int rebootsignal = SIGINT;
1890
1891 if (!c)
1892 return false;
1893 if (!do_lxcapi_is_running(c))
1894 return false;
1895 pid = do_lxcapi_init_pid(c);
1896 if (pid <= 0)
1897 return false;
1898 if (c->lxc_conf && c->lxc_conf->rebootsignal)
1899 rebootsignal = c->lxc_conf->rebootsignal;
1900 if (kill(pid, rebootsignal) < 0) {
1901 WARN("Could not send signal %d to pid %d.", rebootsignal, pid);
1902 return false;
1903 }
1904 return true;
1905
1906 }
1907
1908 WRAP_API(bool, lxcapi_reboot)
1909
1910 static bool do_lxcapi_reboot2(struct lxc_container *c, int timeout)
1911 {
1912 int killret, ret;
1913 pid_t pid;
1914 int rebootsignal = SIGINT, state_client_fd = -1;
1915 lxc_state_t states[MAX_STATE] = {0};
1916
1917 if (!c)
1918 return false;
1919
1920 if (!do_lxcapi_is_running(c))
1921 return true;
1922
1923 pid = do_lxcapi_init_pid(c);
1924 if (pid <= 0)
1925 return true;
1926
1927 if (c->lxc_conf && c->lxc_conf->rebootsignal)
1928 rebootsignal = c->lxc_conf->rebootsignal;
1929
1930 /* Add a new state client before sending the shutdown signal so that we
1931 * don't miss a state.
1932 */
1933 if (timeout != 0) {
1934 states[RUNNING] = 2;
1935 ret = lxc_cmd_add_state_client(c->name, c->config_path, states,
1936 &state_client_fd);
1937 if (ret < 0)
1938 return false;
1939
1940 if (state_client_fd < 0)
1941 return false;
1942
1943 if (ret == RUNNING)
1944 return true;
1945
1946 if (ret < MAX_STATE)
1947 return false;
1948 }
1949
1950 /* Send reboot signal to container. */
1951 killret = kill(pid, rebootsignal);
1952 if (killret < 0) {
1953 WARN("Could not send signal %d to pid %d", rebootsignal, pid);
1954 if (state_client_fd >= 0)
1955 close(state_client_fd);
1956 return false;
1957 }
1958 TRACE("Sent signal %d to pid %d", rebootsignal, pid);
1959
1960 if (timeout == 0)
1961 return true;
1962
1963 ret = lxc_cmd_sock_rcv_state(state_client_fd, timeout);
1964 close(state_client_fd);
1965 if (ret < 0)
1966 return false;
1967
1968 TRACE("Received state \"%s\"", lxc_state2str(ret));
1969 if (ret != RUNNING)
1970 return false;
1971
1972 return true;
1973 }
1974
1975 WRAP_API_1(bool, lxcapi_reboot2, int)
1976
1977 static bool do_lxcapi_shutdown(struct lxc_container *c, int timeout)
1978 {
1979 int killret, ret;
1980 pid_t pid;
1981 int haltsignal = SIGPWR, state_client_fd = -1;
1982 lxc_state_t states[MAX_STATE] = {0};
1983
1984 if (!c)
1985 return false;
1986
1987 if (!do_lxcapi_is_running(c))
1988 return true;
1989
1990 pid = do_lxcapi_init_pid(c);
1991 if (pid <= 0)
1992 return true;
1993
1994 /* Detect whether we should send SIGRTMIN + 3 (e.g. systemd). */
1995 if (task_blocking_signal(pid, (SIGRTMIN + 3)))
1996 haltsignal = (SIGRTMIN + 3);
1997
1998 if (c->lxc_conf && c->lxc_conf->haltsignal)
1999 haltsignal = c->lxc_conf->haltsignal;
2000
2001 /* Add a new state client before sending the shutdown signal so that we
2002 * don't miss a state.
2003 */
2004 if (timeout != 0) {
2005 states[STOPPED] = 1;
2006 ret = lxc_cmd_add_state_client(c->name, c->config_path, states,
2007 &state_client_fd);
2008 if (ret < 0)
2009 return false;
2010
2011 if (state_client_fd < 0)
2012 return false;
2013
2014 if (ret == STOPPED)
2015 return true;
2016
2017 if (ret < MAX_STATE)
2018 return false;
2019 }
2020
2021 /* Send shutdown signal to container. */
2022 killret = kill(pid, haltsignal);
2023 if (killret < 0) {
2024 WARN("Could not send signal %d to pid %d", haltsignal, pid);
2025 if (state_client_fd >= 0)
2026 close(state_client_fd);
2027 return false;
2028 }
2029 TRACE("Sent signal %d to pid %d", haltsignal, pid);
2030
2031 if (timeout == 0)
2032 return true;
2033
2034 ret = lxc_cmd_sock_rcv_state(state_client_fd, timeout);
2035 close(state_client_fd);
2036 if (ret < 0)
2037 return false;
2038
2039 TRACE("Received state \"%s\"", lxc_state2str(ret));
2040 if (ret != STOPPED)
2041 return false;
2042
2043 return true;
2044 }
2045
2046 WRAP_API_1(bool, lxcapi_shutdown, int)
2047
2048 static bool lxcapi_createl(struct lxc_container *c, const char *t,
2049 const char *bdevtype, struct bdev_specs *specs, int flags, ...)
2050 {
2051 bool bret = false;
2052 char **args = NULL;
2053 va_list ap;
2054
2055 if (!c)
2056 return false;
2057
2058 current_config = c->lxc_conf;
2059
2060 /*
2061 * since we're going to wait for create to finish, I don't think we
2062 * need to get a copy of the arguments.
2063 */
2064 va_start(ap, flags);
2065 args = lxc_va_arg_list_to_argv(ap, 0, 0);
2066 va_end(ap);
2067 if (!args) {
2068 ERROR("Failed to allocate memory");
2069 goto out;
2070 }
2071
2072 bret = do_lxcapi_create(c, t, bdevtype, specs, flags, args);
2073
2074 out:
2075 free(args);
2076 current_config = NULL;
2077 return bret;
2078 }
2079
2080 static void do_clear_unexp_config_line(struct lxc_conf *conf, const char *key)
2081 {
2082 if (!strcmp(key, "lxc.cgroup"))
2083 return clear_unexp_config_line(conf, key, true);
2084
2085 if (!strcmp(key, "lxc.network"))
2086 return clear_unexp_config_line(conf, key, true);
2087
2088 if (!strcmp(key, "lxc.net"))
2089 return clear_unexp_config_line(conf, key, true);
2090
2091 /* Clear a network with a specific index. */
2092 if (!strncmp(key, "lxc.net.", 8)) {
2093 int ret;
2094 const char *idx;
2095
2096 idx = key + 8;
2097 ret = lxc_safe_uint(idx, &(unsigned int){0});
2098 if (!ret)
2099 return clear_unexp_config_line(conf, key, true);
2100 }
2101
2102 if (!strcmp(key, "lxc.hook"))
2103 return clear_unexp_config_line(conf, key, true);
2104
2105 return clear_unexp_config_line(conf, key, false);
2106 }
2107
2108 static bool do_lxcapi_clear_config_item(struct lxc_container *c,
2109 const char *key)
2110 {
2111 int ret = 1;
2112 struct lxc_config_t *config;
2113
2114 if (!c || !c->lxc_conf)
2115 return false;
2116
2117 if (container_mem_lock(c))
2118 return false;
2119
2120 config = lxc_get_config(key);
2121 /* Verify that the config key exists and that it has a callback
2122 * implemented.
2123 */
2124 if (config && config->clr)
2125 ret = config->clr(key, c->lxc_conf, NULL);
2126 if (!ret)
2127 do_clear_unexp_config_line(c->lxc_conf, key);
2128
2129 container_mem_unlock(c);
2130 return ret == 0;
2131 }
2132
2133 WRAP_API_1(bool, lxcapi_clear_config_item, const char *)
2134
2135 static inline bool enter_net_ns(struct lxc_container *c)
2136 {
2137 pid_t pid = do_lxcapi_init_pid(c);
2138
2139 if ((geteuid() != 0 || (c->lxc_conf && !lxc_list_empty(&c->lxc_conf->id_map))) && access("/proc/self/ns/user", F_OK) == 0) {
2140 if (!switch_to_ns(pid, "user"))
2141 return false;
2142 }
2143 return switch_to_ns(pid, "net");
2144 }
2145
2146 /* Used by qsort and bsearch functions for comparing names. */
2147 static inline int string_cmp(char **first, char **second)
2148 {
2149 return strcmp(*first, *second);
2150 }
2151
2152 /* Used by qsort and bsearch functions for comparing container names. */
2153 static inline int container_cmp(struct lxc_container **first,
2154 struct lxc_container **second)
2155 {
2156 return strcmp((*first)->name, (*second)->name);
2157 }
2158
2159 static bool add_to_array(char ***names, char *cname, int pos)
2160 {
2161 char **newnames = realloc(*names, (pos+1) * sizeof(char *));
2162 if (!newnames) {
2163 ERROR("Out of memory");
2164 return false;
2165 }
2166
2167 *names = newnames;
2168 newnames[pos] = strdup(cname);
2169 if (!newnames[pos])
2170 return false;
2171
2172 /* Sort the arrray as we will use binary search on it. */
2173 qsort(newnames, pos + 1, sizeof(char *),
2174 (int (*)(const void *, const void *))string_cmp);
2175
2176 return true;
2177 }
2178
2179 static bool add_to_clist(struct lxc_container ***list, struct lxc_container *c,
2180 int pos, bool sort)
2181 {
2182 struct lxc_container **newlist = realloc(*list, (pos + 1) * sizeof(struct lxc_container *));
2183 if (!newlist) {
2184 ERROR("Out of memory");
2185 return false;
2186 }
2187
2188 *list = newlist;
2189 newlist[pos] = c;
2190
2191 /* Sort the arrray as we will use binary search on it. */
2192 if (sort)
2193 qsort(newlist, pos + 1, sizeof(struct lxc_container *),
2194 (int (*)(const void *, const void *))container_cmp);
2195
2196 return true;
2197 }
2198
2199 static char** get_from_array(char ***names, char *cname, int size)
2200 {
2201 return (char **)bsearch(&cname, *names, size, sizeof(char *), (int (*)(const void *, const void *))string_cmp);
2202 }
2203
2204
2205 static bool array_contains(char ***names, char *cname, int size) {
2206 if(get_from_array(names, cname, size) != NULL)
2207 return true;
2208 return false;
2209 }
2210
2211 static bool remove_from_array(char ***names, char *cname, int size)
2212 {
2213 char **result = get_from_array(names, cname, size);
2214 if (result != NULL) {
2215 free(result);
2216 return true;
2217 }
2218 return false;
2219 }
2220
2221 static char ** do_lxcapi_get_interfaces(struct lxc_container *c)
2222 {
2223 pid_t pid;
2224 int i, count = 0, pipefd[2];
2225 char **interfaces = NULL;
2226 char interface[IFNAMSIZ];
2227
2228 if(pipe(pipefd) < 0) {
2229 SYSERROR("pipe failed");
2230 return NULL;
2231 }
2232
2233 pid = fork();
2234 if (pid < 0) {
2235 SYSERROR("failed to fork task to get interfaces information");
2236 close(pipefd[0]);
2237 close(pipefd[1]);
2238 return NULL;
2239 }
2240
2241 if (pid == 0) { /* child */
2242 int ret = 1, nbytes;
2243 struct ifaddrs *interfaceArray = NULL, *tempIfAddr = NULL;
2244
2245 /* close the read-end of the pipe */
2246 close(pipefd[0]);
2247
2248 if (!enter_net_ns(c)) {
2249 SYSERROR("failed to enter namespace");
2250 goto out;
2251 }
2252
2253 /* Grab the list of interfaces */
2254 if (getifaddrs(&interfaceArray)) {
2255 SYSERROR("failed to get interfaces list");
2256 goto out;
2257 }
2258
2259 /* Iterate through the interfaces */
2260 for (tempIfAddr = interfaceArray; tempIfAddr != NULL; tempIfAddr = tempIfAddr->ifa_next) {
2261 nbytes = write(pipefd[1], tempIfAddr->ifa_name, IFNAMSIZ);
2262 if (nbytes < 0) {
2263 ERROR("write failed");
2264 goto out;
2265 }
2266 count++;
2267 }
2268 ret = 0;
2269
2270 out:
2271 if (interfaceArray)
2272 freeifaddrs(interfaceArray);
2273
2274 /* close the write-end of the pipe, thus sending EOF to the reader */
2275 close(pipefd[1]);
2276 _exit(ret);
2277 }
2278
2279 /* close the write-end of the pipe */
2280 close(pipefd[1]);
2281
2282 while (read(pipefd[0], &interface, IFNAMSIZ) == IFNAMSIZ) {
2283 interface[IFNAMSIZ - 1] = '\0';
2284
2285 if (array_contains(&interfaces, interface, count))
2286 continue;
2287
2288 if(!add_to_array(&interfaces, interface, count))
2289 ERROR("Failed to add \"%s\" to array", interface);
2290
2291 count++;
2292 }
2293
2294 if (wait_for_pid(pid) != 0) {
2295 for(i=0;i<count;i++)
2296 free(interfaces[i]);
2297 free(interfaces);
2298 interfaces = NULL;
2299 }
2300
2301 /* close the read-end of the pipe */
2302 close(pipefd[0]);
2303
2304 /* Append NULL to the array */
2305 if(interfaces)
2306 interfaces = (char **)lxc_append_null_to_array((void **)interfaces, count);
2307
2308 return interfaces;
2309 }
2310
2311 WRAP_API(char **, lxcapi_get_interfaces)
2312
2313 static char** do_lxcapi_get_ips(struct lxc_container *c, const char* interface, const char* family, int scope)
2314 {
2315 pid_t pid;
2316 int i, count = 0, pipefd[2];
2317 char **addresses = NULL;
2318 char address[INET6_ADDRSTRLEN];
2319
2320 if(pipe(pipefd) < 0) {
2321 SYSERROR("pipe failed");
2322 return NULL;
2323 }
2324
2325 pid = fork();
2326 if (pid < 0) {
2327 SYSERROR("failed to fork task to get container ips");
2328 close(pipefd[0]);
2329 close(pipefd[1]);
2330 return NULL;
2331 }
2332
2333 if (pid == 0) { /* child */
2334 int ret = 1, nbytes;
2335 struct ifaddrs *interfaceArray = NULL, *tempIfAddr = NULL;
2336 char addressOutputBuffer[INET6_ADDRSTRLEN];
2337 void *tempAddrPtr = NULL;
2338 char *address = NULL;
2339
2340 /* close the read-end of the pipe */
2341 close(pipefd[0]);
2342
2343 if (!enter_net_ns(c)) {
2344 SYSERROR("failed to enter namespace");
2345 goto out;
2346 }
2347
2348 /* Grab the list of interfaces */
2349 if (getifaddrs(&interfaceArray)) {
2350 SYSERROR("failed to get interfaces list");
2351 goto out;
2352 }
2353
2354 /* Iterate through the interfaces */
2355 for (tempIfAddr = interfaceArray; tempIfAddr != NULL; tempIfAddr = tempIfAddr->ifa_next) {
2356 if (tempIfAddr->ifa_addr == NULL)
2357 continue;
2358
2359 if(tempIfAddr->ifa_addr->sa_family == AF_INET) {
2360 if (family && strcmp(family, "inet"))
2361 continue;
2362 tempAddrPtr = &((struct sockaddr_in *)tempIfAddr->ifa_addr)->sin_addr;
2363 }
2364 else {
2365 if (family && strcmp(family, "inet6"))
2366 continue;
2367
2368 if (((struct sockaddr_in6 *)tempIfAddr->ifa_addr)->sin6_scope_id != scope)
2369 continue;
2370
2371 tempAddrPtr = &((struct sockaddr_in6 *)tempIfAddr->ifa_addr)->sin6_addr;
2372 }
2373
2374 if (interface && strcmp(interface, tempIfAddr->ifa_name))
2375 continue;
2376 else if (!interface && strcmp("lo", tempIfAddr->ifa_name) == 0)
2377 continue;
2378
2379 address = (char *)inet_ntop(tempIfAddr->ifa_addr->sa_family,
2380 tempAddrPtr,
2381 addressOutputBuffer,
2382 sizeof(addressOutputBuffer));
2383 if (!address)
2384 continue;
2385
2386 nbytes = write(pipefd[1], address, INET6_ADDRSTRLEN);
2387 if (nbytes < 0) {
2388 ERROR("write failed");
2389 goto out;
2390 }
2391 count++;
2392 }
2393 ret = 0;
2394
2395 out:
2396 if(interfaceArray)
2397 freeifaddrs(interfaceArray);
2398
2399 /* close the write-end of the pipe, thus sending EOF to the reader */
2400 close(pipefd[1]);
2401 _exit(ret);
2402 }
2403
2404 /* close the write-end of the pipe */
2405 close(pipefd[1]);
2406
2407 while (read(pipefd[0], &address, INET6_ADDRSTRLEN) == INET6_ADDRSTRLEN) {
2408 if(!add_to_array(&addresses, address, count))
2409 ERROR("PARENT: add_to_array failed");
2410 count++;
2411 }
2412
2413 if (wait_for_pid(pid) != 0) {
2414 for(i=0;i<count;i++)
2415 free(addresses[i]);
2416 free(addresses);
2417 addresses = NULL;
2418 }
2419
2420 /* close the read-end of the pipe */
2421 close(pipefd[0]);
2422
2423 /* Append NULL to the array */
2424 if(addresses)
2425 addresses = (char **)lxc_append_null_to_array((void **)addresses, count);
2426
2427 return addresses;
2428 }
2429
2430 WRAP_API_3(char **, lxcapi_get_ips, const char *, const char *, int)
2431
2432 static int do_lxcapi_get_config_item(struct lxc_container *c, const char *key, char *retv, int inlen)
2433 {
2434 int ret = -1;
2435 struct lxc_config_t *config;
2436
2437 if (!c || !c->lxc_conf)
2438 return -1;
2439
2440 if (container_mem_lock(c))
2441 return -1;
2442
2443 config = lxc_get_config(key);
2444 /* Verify that the config key exists and that it has a callback
2445 * implemented.
2446 */
2447 if (config && config->get)
2448 ret = config->get(key, retv, inlen, c->lxc_conf, NULL);
2449
2450 container_mem_unlock(c);
2451 return ret;
2452 }
2453
2454 WRAP_API_3(int, lxcapi_get_config_item, const char *, char *, int)
2455
2456 static char* do_lxcapi_get_running_config_item(struct lxc_container *c, const char *key)
2457 {
2458 char *ret;
2459
2460 if (!c || !c->lxc_conf)
2461 return NULL;
2462 if (container_mem_lock(c))
2463 return NULL;
2464 ret = lxc_cmd_get_config_item(c->name, key, do_lxcapi_get_config_path(c));
2465 container_mem_unlock(c);
2466 return ret;
2467 }
2468
2469 WRAP_API_1(char *, lxcapi_get_running_config_item, const char *)
2470
2471 static int do_lxcapi_get_keys(struct lxc_container *c, const char *key, char *retv, int inlen)
2472 {
2473 int ret = -1;
2474
2475 /* List all config items. */
2476 if (!key)
2477 return lxc_list_config_items(retv, inlen);
2478
2479 if (!c || !c->lxc_conf)
2480 return -1;
2481
2482 if (container_mem_lock(c))
2483 return -1;
2484
2485 /* Support 'lxc.net.<idx>', i.e. 'lxc.net.0'
2486 * This is an intelligent result to show which keys are valid given the
2487 * type of nic it is.
2488 */
2489 if (strncmp(key, "lxc.net.", 8) == 0)
2490 ret = lxc_list_net(c->lxc_conf, key, retv, inlen);
2491 else
2492 ret = lxc_list_subkeys(c->lxc_conf, key, retv, inlen);
2493
2494 container_mem_unlock(c);
2495 return ret;
2496 }
2497
2498 WRAP_API_3(int, lxcapi_get_keys, const char *, char *, int)
2499
2500 static bool do_lxcapi_save_config(struct lxc_container *c, const char *alt_file)
2501 {
2502 int fd, lret;
2503 bool ret = false, need_disklock = false;
2504
2505 if (!alt_file)
2506 alt_file = c->configfile;
2507 if (!alt_file)
2508 return false;
2509
2510 /* If we haven't yet loaded a config, load the stock config. */
2511 if (!c->lxc_conf) {
2512 if (!do_lxcapi_load_config(c, lxc_global_config_value("lxc.default_config"))) {
2513 ERROR("Error loading default configuration file %s "
2514 "while saving %s",
2515 lxc_global_config_value("lxc.default_config"),
2516 c->name);
2517 return false;
2518 }
2519 }
2520
2521 if (!create_container_dir(c))
2522 return false;
2523
2524 /* If we're writing to the container's config file, take the disk lock.
2525 * Otherwise just take the memlock to protect the struct lxc_container
2526 * while we're traversing it.
2527 */
2528 if (strcmp(c->configfile, alt_file) == 0)
2529 need_disklock = true;
2530
2531 if (need_disklock)
2532 lret = container_disk_lock(c);
2533 else
2534 lret = container_mem_lock(c);
2535 if (lret)
2536 return false;
2537
2538 fd = open(alt_file, O_WRONLY | O_CREAT | O_TRUNC | O_CLOEXEC,
2539 S_IRUSR | S_IWUSR | S_IRGRP | S_IWGRP | S_IROTH | S_IWOTH);
2540 if (fd < 0)
2541 goto on_error;
2542
2543 lret = write_config(fd, c->lxc_conf);
2544 close(fd);
2545 if (lret < 0)
2546 goto on_error;
2547
2548 ret = true;
2549
2550 on_error:
2551 if (need_disklock)
2552 container_disk_unlock(c);
2553 else
2554 container_mem_unlock(c);
2555
2556 return ret;
2557 }
2558
2559 WRAP_API_1(bool, lxcapi_save_config, const char *)
2560
2561
2562 static bool mod_rdep(struct lxc_container *c0, struct lxc_container *c, bool inc)
2563 {
2564 FILE *f1;
2565 struct stat fbuf;
2566 void *buf = NULL;
2567 char *del = NULL;
2568 char path[MAXPATHLEN];
2569 char newpath[MAXPATHLEN];
2570 int fd, ret, n = 0, v = 0;
2571 bool bret = false;
2572 size_t len = 0, bytes = 0;
2573
2574 if (container_disk_lock(c0))
2575 return false;
2576
2577 ret = snprintf(path, MAXPATHLEN, "%s/%s/lxc_snapshots", c0->config_path, c0->name);
2578 if (ret < 0 || ret > MAXPATHLEN)
2579 goto out;
2580 ret = snprintf(newpath, MAXPATHLEN, "%s\n%s\n", c->config_path, c->name);
2581 if (ret < 0 || ret > MAXPATHLEN)
2582 goto out;
2583
2584 /* If we find an lxc-snapshot file using the old format only listing the
2585 * number of snapshots we will keep using it. */
2586 f1 = fopen(path, "r");
2587 if (f1) {
2588 n = fscanf(f1, "%d", &v);
2589 fclose(f1);
2590 if (n == 1 && v == 0) {
2591 remove(path);
2592 n = 0;
2593 }
2594 }
2595 if (n == 1) {
2596 v += inc ? 1 : -1;
2597 f1 = fopen(path, "w");
2598 if (!f1)
2599 goto out;
2600 if (fprintf(f1, "%d\n", v) < 0) {
2601 ERROR("Error writing new snapshots value");
2602 fclose(f1);
2603 goto out;
2604 }
2605 ret = fclose(f1);
2606 if (ret != 0) {
2607 SYSERROR("Error writing to or closing snapshots file");
2608 goto out;
2609 }
2610 } else {
2611 /* Here we know that we have or can use an lxc-snapshot file
2612 * using the new format. */
2613 if (inc) {
2614 f1 = fopen(path, "a");
2615 if (!f1)
2616 goto out;
2617
2618 if (fprintf(f1, "%s", newpath) < 0) {
2619 ERROR("Error writing new snapshots entry");
2620 ret = fclose(f1);
2621 if (ret != 0)
2622 SYSERROR("Error writing to or closing snapshots file");
2623 goto out;
2624 }
2625
2626 ret = fclose(f1);
2627 if (ret != 0) {
2628 SYSERROR("Error writing to or closing snapshots file");
2629 goto out;
2630 }
2631 } else if (!inc) {
2632 if ((fd = open(path, O_RDWR | O_CLOEXEC)) < 0)
2633 goto out;
2634
2635 if (fstat(fd, &fbuf) < 0) {
2636 close(fd);
2637 goto out;
2638 }
2639
2640 if (fbuf.st_size != 0) {
2641
2642 buf = lxc_strmmap(NULL, fbuf.st_size, PROT_READ | PROT_WRITE, MAP_SHARED, fd, 0);
2643 if (buf == MAP_FAILED) {
2644 SYSERROR("Failed to create mapping %s", path);
2645 close(fd);
2646 goto out;
2647 }
2648
2649 len = strlen(newpath);
2650 while ((del = strstr((char *)buf, newpath))) {
2651 memmove(del, del + len, strlen(del) - len + 1);
2652 bytes += len;
2653 }
2654
2655 lxc_strmunmap(buf, fbuf.st_size);
2656 if (ftruncate(fd, fbuf.st_size - bytes) < 0) {
2657 SYSERROR("Failed to truncate file %s", path);
2658 close(fd);
2659 goto out;
2660 }
2661 }
2662 close(fd);
2663 }
2664
2665 /* If the lxc-snapshot file is empty, remove it. */
2666 if (stat(path, &fbuf) < 0)
2667 goto out;
2668 if (!fbuf.st_size) {
2669 remove(path);
2670 }
2671 }
2672
2673 bret = true;
2674
2675 out:
2676 container_disk_unlock(c0);
2677 return bret;
2678 }
2679
2680 static void strip_newline(char *p)
2681 {
2682 size_t len = strlen(p);
2683 if (len < 1)
2684 return;
2685 if (p[len-1] == '\n')
2686 p[len-1] = '\0';
2687 }
2688
2689 void mod_all_rdeps(struct lxc_container *c, bool inc)
2690 {
2691 struct lxc_container *p;
2692 char *lxcpath = NULL, *lxcname = NULL, path[MAXPATHLEN];
2693 size_t pathlen = 0, namelen = 0;
2694 FILE *f;
2695 int ret;
2696
2697 ret = snprintf(path, MAXPATHLEN, "%s/%s/lxc_rdepends",
2698 c->config_path, c->name);
2699 if (ret < 0 || ret >= MAXPATHLEN) {
2700 ERROR("Path name too long");
2701 return;
2702 }
2703 f = fopen(path, "r");
2704 if (f == NULL)
2705 return;
2706 while (getline(&lxcpath, &pathlen, f) != -1) {
2707 if (getline(&lxcname, &namelen, f) == -1) {
2708 ERROR("badly formatted file %s", path);
2709 goto out;
2710 }
2711 strip_newline(lxcpath);
2712 strip_newline(lxcname);
2713 if ((p = lxc_container_new(lxcname, lxcpath)) == NULL) {
2714 ERROR("Unable to find dependent container %s:%s",
2715 lxcpath, lxcname);
2716 continue;
2717 }
2718 if (!mod_rdep(p, c, inc))
2719 ERROR("Failed to update snapshots file for %s:%s",
2720 lxcpath, lxcname);
2721 lxc_container_put(p);
2722 }
2723 out:
2724 free(lxcpath);
2725 free(lxcname);
2726 fclose(f);
2727 }
2728
2729 static bool has_fs_snapshots(struct lxc_container *c)
2730 {
2731 FILE *f;
2732 char path[MAXPATHLEN];
2733 int ret, v;
2734 struct stat fbuf;
2735 bool bret = false;
2736
2737 ret = snprintf(path, MAXPATHLEN, "%s/%s/lxc_snapshots", c->config_path,
2738 c->name);
2739 if (ret < 0 || ret > MAXPATHLEN)
2740 goto out;
2741 /* If the file doesn't exist there are no snapshots. */
2742 if (stat(path, &fbuf) < 0)
2743 goto out;
2744 v = fbuf.st_size;
2745 if (v != 0) {
2746 f = fopen(path, "r");
2747 if (!f)
2748 goto out;
2749 ret = fscanf(f, "%d", &v);
2750 fclose(f);
2751 /* TODO: Figure out what to do with the return value of fscanf. */
2752 if (ret != 1)
2753 INFO("Container uses new lxc-snapshots format %s", path);
2754 }
2755 bret = v != 0;
2756
2757 out:
2758 return bret;
2759 }
2760
2761 static bool has_snapshots(struct lxc_container *c)
2762 {
2763 char path[MAXPATHLEN];
2764 struct dirent *direntp;
2765 int count=0;
2766 DIR *dir;
2767
2768 if (!get_snappath_dir(c, path))
2769 return false;
2770 dir = opendir(path);
2771 if (!dir)
2772 return false;
2773 while ((direntp = readdir(dir))) {
2774 if (!direntp)
2775 break;
2776
2777 if (!strcmp(direntp->d_name, "."))
2778 continue;
2779
2780 if (!strcmp(direntp->d_name, ".."))
2781 continue;
2782 count++;
2783 break;
2784 }
2785 closedir(dir);
2786 return count > 0;
2787 }
2788
2789 static bool do_destroy_container(struct lxc_conf *conf) {
2790 int ret;
2791
2792 if (am_guest_unpriv()) {
2793 ret = userns_exec_full(conf, storage_destroy_wrapper, conf,
2794 "storage_destroy_wrapper");
2795 if (ret < 0)
2796 return false;
2797
2798 return true;
2799 }
2800
2801 return storage_destroy(conf);
2802 }
2803
2804 static int lxc_rmdir_onedev_wrapper(void *data)
2805 {
2806 char *arg = (char *) data;
2807 return lxc_rmdir_onedev(arg, "snaps");
2808 }
2809
2810 static int lxc_unlink_exec_wrapper(void *data)
2811 {
2812 char *arg = data;
2813 return unlink(arg);
2814 }
2815
2816 static bool container_destroy(struct lxc_container *c,
2817 struct lxc_storage *storage)
2818 {
2819 const char *p1;
2820 size_t len;
2821 struct lxc_conf *conf;
2822 char *path = NULL;
2823 bool bret = false;
2824 int ret = 0;
2825
2826 if (!c || !do_lxcapi_is_defined(c))
2827 return false;
2828
2829 conf = c->lxc_conf;
2830 if (container_disk_lock(c))
2831 return false;
2832
2833 if (!is_stopped(c)) {
2834 /* We should queue some sort of error - in c->error_string? */
2835 ERROR("container %s is not stopped", c->name);
2836 goto out;
2837 }
2838
2839 if (conf && !lxc_list_empty(&conf->hooks[LXCHOOK_DESTROY])) {
2840 /* Start of environment variable setup for hooks */
2841 if (setenv("LXC_NAME", c->name, 1))
2842 SYSERROR("Failed to set environment variable for container name");
2843
2844 if (conf->rcfile && setenv("LXC_CONFIG_FILE", conf->rcfile, 1))
2845 SYSERROR("Failed to set environment variable for config path");
2846
2847 if (conf->rootfs.mount && setenv("LXC_ROOTFS_MOUNT", conf->rootfs.mount, 1))
2848 SYSERROR("Failed to set environment variable for rootfs mount");
2849
2850 if (conf->rootfs.path && setenv("LXC_ROOTFS_PATH", conf->rootfs.path, 1))
2851 SYSERROR("Failed to set environment variable for rootfs mount");
2852
2853 if (conf->console.path && setenv("LXC_CONSOLE", conf->console.path, 1))
2854 SYSERROR("Failed to set environment variable for console path");
2855
2856 if (conf->console.log_path && setenv("LXC_CONSOLE_LOGPATH", conf->console.log_path, 1))
2857 SYSERROR("Failed to set environment variable for console log");
2858 /* End of environment variable setup for hooks */
2859
2860 if (run_lxc_hooks(c->name, "destroy", conf, NULL)) {
2861 ERROR("Failed to execute clone hook for \"%s\"", c->name);
2862 goto out;
2863 }
2864 }
2865
2866 if (current_config && conf == current_config) {
2867 current_config = NULL;
2868 if (conf->logfd != -1) {
2869 close(conf->logfd);
2870 conf->logfd = -1;
2871 }
2872 }
2873
2874 if (conf && conf->rootfs.path && conf->rootfs.mount) {
2875 if (!do_destroy_container(conf)) {
2876 ERROR("Error destroying rootfs for %s", c->name);
2877 goto out;
2878 }
2879 INFO("Destroyed rootfs for %s", c->name);
2880 }
2881
2882 mod_all_rdeps(c, false);
2883
2884 p1 = do_lxcapi_get_config_path(c);
2885 /* strlen(p1)
2886 * +
2887 * /
2888 * +
2889 * strlen(c->name)
2890 * +
2891 * /
2892 * +
2893 * strlen("config") = 6
2894 * +
2895 * \0
2896 */
2897 len = strlen(p1) + 1 + strlen(c->name) + 1 + 6 + 1;
2898 path = malloc(len);
2899 if (!path) {
2900 ERROR("Failed to allocate memory");
2901 goto out;
2902 }
2903
2904 /* For an overlay container the rootfs is considered immutable and
2905 * cannot be removed when restoring from a snapshot.
2906 */
2907 if (storage && (!strcmp(storage->type, "overlay") ||
2908 !strcmp(storage->type, "overlayfs")) &&
2909 (storage->flags & LXC_STORAGE_INTERNAL_OVERLAY_RESTORE)) {
2910 ret = snprintf(path, len, "%s/%s/config", p1, c->name);
2911 if (ret < 0 || (size_t)ret >= len)
2912 goto out;
2913
2914 if (am_guest_unpriv())
2915 ret = userns_exec_1(conf, lxc_unlink_exec_wrapper, path,
2916 "lxc_unlink_exec_wrapper");
2917 else
2918 ret = unlink(path);
2919 if (ret < 0) {
2920 SYSERROR("Failed to destroy config file \"%s\" for \"%s\"",
2921 path, c->name);
2922 goto out;
2923 }
2924 INFO("Destroyed config file \"%s\" for \"%s\"", path, c->name);
2925
2926 bret = true;
2927 goto out;
2928 }
2929
2930 ret = snprintf(path, len, "%s/%s", p1, c->name);
2931 if (ret < 0 || (size_t)ret >= len)
2932 goto out;
2933 if (am_guest_unpriv())
2934 ret = userns_exec_full(conf, lxc_rmdir_onedev_wrapper, path,
2935 "lxc_rmdir_onedev_wrapper");
2936 else
2937 ret = lxc_rmdir_onedev(path, "snaps");
2938 if (ret < 0) {
2939 ERROR("Failed to destroy directory \"%s\" for \"%s\"", path,
2940 c->name);
2941 goto out;
2942 }
2943 INFO("Destroyed directory \"%s\" for \"%s\"", path, c->name);
2944
2945 bret = true;
2946
2947 out:
2948 if (path)
2949 free(path);
2950 container_disk_unlock(c);
2951 return bret;
2952 }
2953
2954 static bool do_lxcapi_destroy(struct lxc_container *c)
2955 {
2956 if (!c || !lxcapi_is_defined(c))
2957 return false;
2958
2959 if (has_snapshots(c)) {
2960 ERROR("Container %s has snapshots; not removing", c->name);
2961 return false;
2962 }
2963
2964 if (has_fs_snapshots(c)) {
2965 ERROR("container %s has snapshots on its rootfs", c->name);
2966 return false;
2967 }
2968
2969 return container_destroy(c, NULL);
2970 }
2971
2972 WRAP_API(bool, lxcapi_destroy)
2973
2974 static bool do_lxcapi_destroy_with_snapshots(struct lxc_container *c)
2975 {
2976 if (!c || !lxcapi_is_defined(c))
2977 return false;
2978 if (!lxcapi_snapshot_destroy_all(c)) {
2979 ERROR("Error deleting all snapshots");
2980 return false;
2981 }
2982 return lxcapi_destroy(c);
2983 }
2984
2985 WRAP_API(bool, lxcapi_destroy_with_snapshots)
2986
2987 int lxc_set_config_item_locked(struct lxc_conf *conf, const char *key,
2988 const char *v)
2989 {
2990 int ret;
2991 struct lxc_config_t *config;
2992 bool bret = true;
2993
2994 config = lxc_get_config(key);
2995 if (!config)
2996 return -EINVAL;
2997
2998 ret = config->set(key, v, conf, NULL);
2999 if (ret < 0)
3000 return -EINVAL;
3001
3002 if (lxc_config_value_empty(v))
3003 do_clear_unexp_config_line(conf, key);
3004 else
3005 bret = do_append_unexp_config_line(conf, key, v);
3006 if (!bret)
3007 return -ENOMEM;
3008
3009 return 0;
3010 }
3011
3012 static bool do_set_config_item_locked(struct lxc_container *c, const char *key,
3013 const char *v)
3014 {
3015 int ret;
3016
3017 if (!c->lxc_conf)
3018 c->lxc_conf = lxc_conf_init();
3019
3020 if (!c->lxc_conf)
3021 return false;
3022
3023 ret = lxc_set_config_item_locked(c->lxc_conf, key, v);
3024 if (ret < 0)
3025 return false;
3026
3027 return true;
3028 }
3029
3030 static bool do_lxcapi_set_config_item(struct lxc_container *c, const char *key, const char *v)
3031 {
3032 bool b = false;
3033
3034 if (!c)
3035 return false;
3036
3037 if (container_mem_lock(c))
3038 return false;
3039
3040 b = do_set_config_item_locked(c, key, v);
3041
3042 container_mem_unlock(c);
3043 return b;
3044 }
3045
3046 WRAP_API_2(bool, lxcapi_set_config_item, const char *, const char *)
3047
3048 static char *lxcapi_config_file_name(struct lxc_container *c)
3049 {
3050 if (!c || !c->configfile)
3051 return NULL;
3052 return strdup(c->configfile);
3053 }
3054
3055 static const char *lxcapi_get_config_path(struct lxc_container *c)
3056 {
3057 if (!c || !c->config_path)
3058 return NULL;
3059 return (const char *)(c->config_path);
3060 }
3061
3062 /*
3063 * not for export
3064 * Just recalculate the c->configfile based on the
3065 * c->config_path, which must be set.
3066 * The lxc_container must be locked or not yet public.
3067 */
3068 static bool set_config_filename(struct lxc_container *c)
3069 {
3070 char *newpath;
3071 int len, ret;
3072
3073 if (!c->config_path)
3074 return false;
3075
3076 /* $lxc_path + "/" + c->name + "/" + "config" + '\0' */
3077 len = strlen(c->config_path) + strlen(c->name) + strlen("config") + 3;
3078 newpath = malloc(len);
3079 if (!newpath)
3080 return false;
3081
3082 ret = snprintf(newpath, len, "%s/%s/config", c->config_path, c->name);
3083 if (ret < 0 || ret >= len) {
3084 fprintf(stderr, "Error printing out config file name\n");
3085 free(newpath);
3086 return false;
3087 }
3088
3089 free(c->configfile);
3090 c->configfile = newpath;
3091
3092 return true;
3093 }
3094
3095 static bool do_lxcapi_set_config_path(struct lxc_container *c, const char *path)
3096 {
3097 char *p;
3098 bool b = false;
3099 char *oldpath = NULL;
3100
3101 if (!c)
3102 return b;
3103
3104 if (container_mem_lock(c))
3105 return b;
3106
3107 p = strdup(path);
3108 if (!p) {
3109 ERROR("Out of memory setting new lxc path");
3110 goto err;
3111 }
3112
3113 b = true;
3114 if (c->config_path)
3115 oldpath = c->config_path;
3116 c->config_path = p;
3117
3118 /* Since we've changed the config path, we have to change the
3119 * config file name too */
3120 if (!set_config_filename(c)) {
3121 ERROR("Out of memory setting new config filename");
3122 b = false;
3123 free(c->config_path);
3124 c->config_path = oldpath;
3125 oldpath = NULL;
3126 }
3127 err:
3128 free(oldpath);
3129 container_mem_unlock(c);
3130 return b;
3131 }
3132
3133 WRAP_API_1(bool, lxcapi_set_config_path, const char *)
3134
3135 static bool do_lxcapi_set_cgroup_item(struct lxc_container *c, const char *subsys, const char *value)
3136 {
3137 int ret;
3138
3139 if (!c)
3140 return false;
3141
3142 if (is_stopped(c))
3143 return false;
3144
3145 if (container_disk_lock(c))
3146 return false;
3147
3148 ret = lxc_cgroup_set(subsys, value, c->name, c->config_path);
3149
3150 container_disk_unlock(c);
3151 return ret == 0;
3152 }
3153
3154 WRAP_API_2(bool, lxcapi_set_cgroup_item, const char *, const char *)
3155
3156 static int do_lxcapi_get_cgroup_item(struct lxc_container *c, const char *subsys, char *retv, int inlen)
3157 {
3158 int ret;
3159
3160 if (!c)
3161 return -1;
3162
3163 if (is_stopped(c))
3164 return -1;
3165
3166 if (container_disk_lock(c))
3167 return -1;
3168
3169 ret = lxc_cgroup_get(subsys, retv, inlen, c->name, c->config_path);
3170
3171 container_disk_unlock(c);
3172 return ret;
3173 }
3174
3175 WRAP_API_3(int, lxcapi_get_cgroup_item, const char *, char *, int)
3176
3177 const char *lxc_get_global_config_item(const char *key)
3178 {
3179 return lxc_global_config_value(key);
3180 }
3181
3182 const char *lxc_get_version(void)
3183 {
3184 return LXC_VERSION;
3185 }
3186
3187 static int copy_file(const char *old, const char *new)
3188 {
3189 int in, out;
3190 ssize_t len, ret;
3191 char buf[8096];
3192 struct stat sbuf;
3193
3194 if (file_exists(new)) {
3195 ERROR("copy destination %s exists", new);
3196 return -1;
3197 }
3198 ret = stat(old, &sbuf);
3199 if (ret < 0) {
3200 INFO("Error stat'ing %s", old);
3201 return -1;
3202 }
3203
3204 in = open(old, O_RDONLY);
3205 if (in < 0) {
3206 SYSERROR("Error opening original file %s", old);
3207 return -1;
3208 }
3209 out = open(new, O_CREAT | O_EXCL | O_WRONLY, 0644);
3210 if (out < 0) {
3211 SYSERROR("Error opening new file %s", new);
3212 close(in);
3213 return -1;
3214 }
3215
3216 while (1) {
3217 len = read(in, buf, 8096);
3218 if (len < 0) {
3219 SYSERROR("Error reading old file %s", old);
3220 goto err;
3221 }
3222 if (len == 0)
3223 break;
3224 ret = write(out, buf, len);
3225 if (ret < len) { /* should we retry? */
3226 SYSERROR("Error: write to new file %s was interrupted", new);
3227 goto err;
3228 }
3229 }
3230 close(in);
3231 close(out);
3232
3233 /* We set mode, but not owner/group. */
3234 ret = chmod(new, sbuf.st_mode);
3235 if (ret) {
3236 SYSERROR("Error setting mode on %s", new);
3237 return -1;
3238 }
3239
3240 return 0;
3241
3242 err:
3243 close(in);
3244 close(out);
3245 return -1;
3246 }
3247
3248 static int copyhooks(struct lxc_container *oldc, struct lxc_container *c)
3249 {
3250 int i, len, ret;
3251 struct lxc_list *it;
3252 char *cpath;
3253
3254 len = strlen(oldc->config_path) + strlen(oldc->name) + 3;
3255 cpath = alloca(len);
3256 ret = snprintf(cpath, len, "%s/%s/", oldc->config_path, oldc->name);
3257 if (ret < 0 || ret >= len)
3258 return -1;
3259
3260 for (i=0; i<NUM_LXC_HOOKS; i++) {
3261 lxc_list_for_each(it, &c->lxc_conf->hooks[i]) {
3262 char *hookname = it->elem;
3263 char *fname = strrchr(hookname, '/');
3264 char tmppath[MAXPATHLEN];
3265 if (!fname) /* relative path - we don't support, but maybe we should */
3266 return 0;
3267 if (strncmp(hookname, cpath, len - 1) != 0) {
3268 /* this hook is public - ignore */
3269 continue;
3270 }
3271 /* copy the script, and change the entry in confile */
3272 ret = snprintf(tmppath, MAXPATHLEN, "%s/%s/%s",
3273 c->config_path, c->name, fname+1);
3274 if (ret < 0 || ret >= MAXPATHLEN)
3275 return -1;
3276 ret = copy_file(it->elem, tmppath);
3277 if (ret < 0)
3278 return -1;
3279 free(it->elem);
3280 it->elem = strdup(tmppath);
3281 if (!it->elem) {
3282 ERROR("out of memory copying hook path");
3283 return -1;
3284 }
3285 }
3286 }
3287
3288 if (!clone_update_unexp_hooks(c->lxc_conf, oldc->config_path,
3289 c->config_path, oldc->name, c->name)) {
3290 ERROR("Error saving new hooks in clone");
3291 return -1;
3292 }
3293 do_lxcapi_save_config(c, NULL);
3294 return 0;
3295 }
3296
3297
3298 static int copy_fstab(struct lxc_container *oldc, struct lxc_container *c)
3299 {
3300 char newpath[MAXPATHLEN];
3301 char *oldpath = oldc->lxc_conf->fstab;
3302 int ret;
3303
3304 if (!oldpath)
3305 return 0;
3306
3307 clear_unexp_config_line(c->lxc_conf, "lxc.mount.fstab", false);
3308
3309 char *p = strrchr(oldpath, '/');
3310 if (!p)
3311 return -1;
3312 ret = snprintf(newpath, MAXPATHLEN, "%s/%s%s",
3313 c->config_path, c->name, p);
3314 if (ret < 0 || ret >= MAXPATHLEN) {
3315 ERROR("error printing new path for %s", oldpath);
3316 return -1;
3317 }
3318 if (file_exists(newpath)) {
3319 ERROR("error: fstab file %s exists", newpath);
3320 return -1;
3321 }
3322
3323 if (copy_file(oldpath, newpath) < 0) {
3324 ERROR("error: copying %s to %s", oldpath, newpath);
3325 return -1;
3326 }
3327 free(c->lxc_conf->fstab);
3328 c->lxc_conf->fstab = strdup(newpath);
3329 if (!c->lxc_conf->fstab) {
3330 ERROR("error: allocating pathname");
3331 return -1;
3332 }
3333 if (!do_append_unexp_config_line(c->lxc_conf, "lxc.mount.fstab", newpath)) {
3334 ERROR("error saving new lxctab");
3335 return -1;
3336 }
3337
3338 return 0;
3339 }
3340
3341 static void copy_rdepends(struct lxc_container *c, struct lxc_container *c0)
3342 {
3343 char path0[MAXPATHLEN], path1[MAXPATHLEN];
3344 int ret;
3345
3346 ret = snprintf(path0, MAXPATHLEN, "%s/%s/lxc_rdepends", c0->config_path,
3347 c0->name);
3348 if (ret < 0 || ret >= MAXPATHLEN) {
3349 WARN("Error copying reverse dependencies");
3350 return;
3351 }
3352 ret = snprintf(path1, MAXPATHLEN, "%s/%s/lxc_rdepends", c->config_path,
3353 c->name);
3354 if (ret < 0 || ret >= MAXPATHLEN) {
3355 WARN("Error copying reverse dependencies");
3356 return;
3357 }
3358 if (copy_file(path0, path1) < 0) {
3359 INFO("Error copying reverse dependencies");
3360 return;
3361 }
3362 }
3363
3364 static bool add_rdepends(struct lxc_container *c, struct lxc_container *c0)
3365 {
3366 int ret;
3367 char path[MAXPATHLEN];
3368 FILE *f;
3369 bool bret;
3370
3371 ret = snprintf(path, MAXPATHLEN, "%s/%s/lxc_rdepends", c->config_path,
3372 c->name);
3373 if (ret < 0 || ret >= MAXPATHLEN)
3374 return false;
3375 f = fopen(path, "a");
3376 if (!f)
3377 return false;
3378 bret = true;
3379 /* If anything goes wrong, just return an error. */
3380 if (fprintf(f, "%s\n%s\n", c0->config_path, c0->name) < 0)
3381 bret = false;
3382 if (fclose(f) != 0)
3383 bret = false;
3384 return bret;
3385 }
3386
3387 /*
3388 * If the fs natively supports snapshot clones with no penalty,
3389 * then default to those even if not requested.
3390 * Currently we only do this for btrfs.
3391 */
3392 bool should_default_to_snapshot(struct lxc_container *c0,
3393 struct lxc_container *c1)
3394 {
3395 size_t l0 = strlen(c0->config_path) + strlen(c0->name) + 2;
3396 size_t l1 = strlen(c1->config_path) + strlen(c1->name) + 2;
3397 char *p0 = alloca(l0 + 1);
3398 char *p1 = alloca(l1 + 1);
3399 char *rootfs = c0->lxc_conf->rootfs.path;
3400
3401 snprintf(p0, l0, "%s/%s", c0->config_path, c0->name);
3402 snprintf(p1, l1, "%s/%s", c1->config_path, c1->name);
3403
3404 if (!is_btrfs_fs(p0) || !is_btrfs_fs(p1))
3405 return false;
3406
3407 if (is_btrfs_subvol(rootfs) <= 0)
3408 return false;
3409
3410 return btrfs_same_fs(p0, p1) == 0;
3411 }
3412
3413 static int copy_storage(struct lxc_container *c0, struct lxc_container *c,
3414 const char *newtype, int flags, const char *bdevdata,
3415 uint64_t newsize)
3416 {
3417 struct lxc_storage *bdev;
3418 bool need_rdep;
3419
3420 if (should_default_to_snapshot(c0, c))
3421 flags |= LXC_CLONE_SNAPSHOT;
3422
3423 bdev = storage_copy(c0, c->name, c->config_path, newtype, flags,
3424 bdevdata, newsize, &need_rdep);
3425 if (!bdev) {
3426 ERROR("Error copying storage.");
3427 return -1;
3428 }
3429
3430 /* Set new rootfs. */
3431 free(c->lxc_conf->rootfs.path);
3432 c->lxc_conf->rootfs.path = strdup(bdev->src);
3433 storage_put(bdev);
3434
3435 if (!c->lxc_conf->rootfs.path) {
3436 ERROR("Out of memory while setting storage path.");
3437 return -1;
3438 }
3439
3440 /* Append a new lxc.rootfs.path entry to the unexpanded config. */
3441 clear_unexp_config_line(c->lxc_conf, "lxc.rootfs.path", false);
3442 if (!do_append_unexp_config_line(c->lxc_conf, "lxc.rootfs.path",
3443 c->lxc_conf->rootfs.path)) {
3444 ERROR("Error saving new rootfs to cloned config.");
3445 return -1;
3446 }
3447
3448 if (flags & LXC_CLONE_SNAPSHOT)
3449 copy_rdepends(c, c0);
3450 if (need_rdep) {
3451 if (!add_rdepends(c, c0))
3452 WARN("Error adding reverse dependency from %s to %s",
3453 c->name, c0->name);
3454 }
3455
3456 mod_all_rdeps(c, true);
3457
3458 return 0;
3459 }
3460
3461 struct clone_update_data {
3462 struct lxc_container *c0;
3463 struct lxc_container *c1;
3464 int flags;
3465 char **hookargs;
3466 };
3467
3468 static int clone_update_rootfs(struct clone_update_data *data)
3469 {
3470 struct lxc_container *c0 = data->c0;
3471 struct lxc_container *c = data->c1;
3472 int flags = data->flags;
3473 char **hookargs = data->hookargs;
3474 int ret = -1;
3475 char path[MAXPATHLEN];
3476 struct lxc_storage *bdev;
3477 FILE *fout;
3478 struct lxc_conf *conf = c->lxc_conf;
3479
3480 /* update hostname in rootfs */
3481 /* we're going to mount, so run in a clean namespace to simplify cleanup */
3482
3483 if (setgid(0) < 0) {
3484 ERROR("Failed to setgid to 0");
3485 return -1;
3486 }
3487 if (setuid(0) < 0) {
3488 ERROR("Failed to setuid to 0");
3489 return -1;
3490 }
3491 if (setgroups(0, NULL) < 0)
3492 WARN("Failed to clear groups");
3493
3494 if (unshare(CLONE_NEWNS) < 0)
3495 return -1;
3496 bdev = storage_init(c->lxc_conf);
3497 if (!bdev)
3498 return -1;
3499 if (strcmp(bdev->type, "dir") != 0) {
3500 if (unshare(CLONE_NEWNS) < 0) {
3501 ERROR("error unsharing mounts");
3502 storage_put(bdev);
3503 return -1;
3504 }
3505 if (detect_shared_rootfs()) {
3506 if (mount(NULL, "/", NULL, MS_SLAVE|MS_REC, NULL)) {
3507 SYSERROR("Failed to make / rslave");
3508 ERROR("Continuing...");
3509 }
3510 }
3511 if (bdev->ops->mount(bdev) < 0) {
3512 storage_put(bdev);
3513 return -1;
3514 }
3515 } else { /* TODO come up with a better way */
3516 free(bdev->dest);
3517 bdev->dest = strdup(bdev->src);
3518 }
3519
3520 if (!lxc_list_empty(&conf->hooks[LXCHOOK_CLONE])) {
3521 /* Start of environment variable setup for hooks */
3522 if (c0->name && setenv("LXC_SRC_NAME", c0->name, 1)) {
3523 SYSERROR("failed to set environment variable for source container name");
3524 }
3525 if (setenv("LXC_NAME", c->name, 1)) {
3526 SYSERROR("failed to set environment variable for container name");
3527 }
3528 if (conf->rcfile && setenv("LXC_CONFIG_FILE", conf->rcfile, 1)) {
3529 SYSERROR("failed to set environment variable for config path");
3530 }
3531 if (bdev->dest && setenv("LXC_ROOTFS_MOUNT", bdev->dest, 1)) {
3532 SYSERROR("failed to set environment variable for rootfs mount");
3533 }
3534 if (conf->rootfs.path && setenv("LXC_ROOTFS_PATH", conf->rootfs.path, 1)) {
3535 SYSERROR("failed to set environment variable for rootfs mount");
3536 }
3537
3538 if (run_lxc_hooks(c->name, "clone", conf, hookargs)) {
3539 ERROR("Error executing clone hook for %s", c->name);
3540 storage_put(bdev);
3541 return -1;
3542 }
3543 }
3544
3545 if (!(flags & LXC_CLONE_KEEPNAME)) {
3546 ret = snprintf(path, MAXPATHLEN, "%s/etc/hostname", bdev->dest);
3547 storage_put(bdev);
3548
3549 if (ret < 0 || ret >= MAXPATHLEN)
3550 return -1;
3551 if (!file_exists(path))
3552 return 0;
3553 if (!(fout = fopen(path, "w"))) {
3554 SYSERROR("unable to open %s: ignoring", path);
3555 return 0;
3556 }
3557 if (fprintf(fout, "%s", c->name) < 0) {
3558 fclose(fout);
3559 return -1;
3560 }
3561 if (fclose(fout) < 0)
3562 return -1;
3563 } else {
3564 storage_put(bdev);
3565 }
3566
3567 return 0;
3568 }
3569
3570 static int clone_update_rootfs_wrapper(void *data)
3571 {
3572 struct clone_update_data *arg = (struct clone_update_data *) data;
3573 return clone_update_rootfs(arg);
3574 }
3575
3576 /*
3577 * We want to support:
3578 sudo lxc-clone -o o1 -n n1 -s -L|-fssize fssize -v|--vgname vgname \
3579 -p|--lvprefix lvprefix -t|--fstype fstype -B backingstore
3580
3581 -s [ implies overlay]
3582 -s -B overlay
3583
3584 only rootfs gets converted (copied/snapshotted) on clone.
3585 */
3586
3587 static int create_file_dirname(char *path, struct lxc_conf *conf)
3588 {
3589 char *p = strrchr(path, '/');
3590 int ret = -1;
3591
3592 if (!p)
3593 return -1;
3594 *p = '\0';
3595 ret = do_create_container_dir(path, conf);
3596 *p = '/';
3597 return ret;
3598 }
3599
3600 static struct lxc_container *do_lxcapi_clone(struct lxc_container *c, const char *newname,
3601 const char *lxcpath, int flags,
3602 const char *bdevtype, const char *bdevdata, uint64_t newsize,
3603 char **hookargs)
3604 {
3605 char newpath[MAXPATHLEN];
3606 int fd, ret;
3607 struct clone_update_data data;
3608 size_t saved_unexp_len;
3609 pid_t pid;
3610 int storage_copied = 0;
3611 char *origroot = NULL, *saved_unexp_conf = NULL;
3612 struct lxc_container *c2 = NULL;
3613
3614 if (!c || !do_lxcapi_is_defined(c))
3615 return NULL;
3616
3617 if (container_mem_lock(c))
3618 return NULL;
3619
3620 if (!is_stopped(c)) {
3621 ERROR("error: Original container (%s) is running", c->name);
3622 goto out;
3623 }
3624
3625 /* Make sure the container doesn't yet exist. */
3626 if (!newname)
3627 newname = c->name;
3628 if (!lxcpath)
3629 lxcpath = do_lxcapi_get_config_path(c);
3630 ret = snprintf(newpath, MAXPATHLEN, "%s/%s/config", lxcpath, newname);
3631 if (ret < 0 || ret >= MAXPATHLEN) {
3632 SYSERROR("clone: failed making config pathname");
3633 goto out;
3634 }
3635
3636 if (file_exists(newpath)) {
3637 ERROR("error: clone: %s exists", newpath);
3638 goto out;
3639 }
3640
3641 ret = create_file_dirname(newpath, c->lxc_conf);
3642 if (ret < 0 && errno != EEXIST) {
3643 ERROR("Error creating container dir for %s", newpath);
3644 goto out;
3645 }
3646
3647 /* Copy the configuration. Tweak it as needed. */
3648 if (c->lxc_conf->rootfs.path) {
3649 origroot = c->lxc_conf->rootfs.path;
3650 c->lxc_conf->rootfs.path = NULL;
3651 }
3652
3653 fd = open(newpath, O_WRONLY | O_CREAT | O_CLOEXEC,
3654 S_IRUSR | S_IWUSR | S_IRGRP | S_IWGRP | S_IROTH | S_IWOTH);
3655 if (fd < 0) {
3656 SYSERROR("Failed to open \"%s\"", newpath);
3657 goto out;
3658 }
3659
3660 saved_unexp_conf = c->lxc_conf->unexpanded_config;
3661 saved_unexp_len = c->lxc_conf->unexpanded_len;
3662 c->lxc_conf->unexpanded_config = strdup(saved_unexp_conf);
3663 if (!c->lxc_conf->unexpanded_config) {
3664 close(fd);
3665 goto out;
3666 }
3667
3668 clear_unexp_config_line(c->lxc_conf, "lxc.rootfs.path", false);
3669 write_config(fd, c->lxc_conf);
3670 close(fd);
3671 c->lxc_conf->rootfs.path = origroot;
3672 free(c->lxc_conf->unexpanded_config);
3673 c->lxc_conf->unexpanded_config = saved_unexp_conf;
3674 saved_unexp_conf = NULL;
3675 c->lxc_conf->unexpanded_len = saved_unexp_len;
3676
3677 ret = snprintf(newpath, MAXPATHLEN, "%s/%s/rootfs", lxcpath, newname);
3678 if (ret < 0 || ret >= MAXPATHLEN) {
3679 SYSERROR("clone: failed making rootfs pathname");
3680 goto out;
3681 }
3682
3683 ret = mkdir(newpath, 0755);
3684 if (ret < 0) {
3685 /* For an overlay container the rootfs is considered immutable
3686 * and will not have been removed when restoring from a
3687 * snapshot.
3688 */
3689 if (errno != ENOENT &&
3690 !(flags & LXC_STORAGE_INTERNAL_OVERLAY_RESTORE)) {
3691 SYSERROR("Failed to create directory \"%s\"", newpath);
3692 goto out;
3693 }
3694 }
3695
3696 if (am_guest_unpriv()) {
3697 if (chown_mapped_root(newpath, c->lxc_conf) < 0) {
3698 ERROR("Error chowning %s to container root", newpath);
3699 goto out;
3700 }
3701 }
3702
3703 c2 = lxc_container_new(newname, lxcpath);
3704 if (!c2) {
3705 ERROR("clone: failed to create new container (%s %s)", newname,
3706 lxcpath);
3707 goto out;
3708 }
3709
3710 /* copy/snapshot rootfs's */
3711 ret = copy_storage(c, c2, bdevtype, flags, bdevdata, newsize);
3712 if (ret < 0)
3713 goto out;
3714
3715
3716 /* update utsname */
3717 if (!(flags & LXC_CLONE_KEEPNAME)) {
3718 clear_unexp_config_line(c2->lxc_conf, "lxc.utsname", false);
3719 clear_unexp_config_line(c2->lxc_conf, "lxc.uts.name", false);
3720
3721 if (!do_set_config_item_locked(c2, "lxc.uts.name", newname)) {
3722 ERROR("Error setting new hostname");
3723 goto out;
3724 }
3725 }
3726
3727 /* copy hooks */
3728 ret = copyhooks(c, c2);
3729 if (ret < 0) {
3730 ERROR("error copying hooks");
3731 goto out;
3732 }
3733
3734 if (copy_fstab(c, c2) < 0) {
3735 ERROR("error copying fstab");
3736 goto out;
3737 }
3738
3739 /* update macaddrs */
3740 if (!(flags & LXC_CLONE_KEEPMACADDR)) {
3741 if (!network_new_hwaddrs(c2->lxc_conf)) {
3742 ERROR("Error updating mac addresses");
3743 goto out;
3744 }
3745 }
3746
3747 /* Update absolute paths for overlay mount directories. */
3748 if (ovl_update_abs_paths(c2->lxc_conf, c->config_path, c->name, lxcpath, newname) < 0)
3749 goto out;
3750
3751 /* We've now successfully created c2's storage, so clear it out if we
3752 * fail after this.
3753 */
3754 storage_copied = 1;
3755
3756 if (!c2->save_config(c2, NULL))
3757 goto out;
3758
3759 if ((pid = fork()) < 0) {
3760 SYSERROR("fork");
3761 goto out;
3762 }
3763 if (pid > 0) {
3764 ret = wait_for_pid(pid);
3765 if (ret)
3766 goto out;
3767 container_mem_unlock(c);
3768 return c2;
3769 }
3770 data.c0 = c;
3771 data.c1 = c2;
3772 data.flags = flags;
3773 data.hookargs = hookargs;
3774 if (am_guest_unpriv())
3775 ret = userns_exec_full(c->lxc_conf, clone_update_rootfs_wrapper,
3776 &data, "clone_update_rootfs_wrapper");
3777 else
3778 ret = clone_update_rootfs(&data);
3779 if (ret < 0)
3780 _exit(EXIT_FAILURE);
3781
3782 container_mem_unlock(c);
3783 _exit(EXIT_SUCCESS);
3784
3785 out:
3786 container_mem_unlock(c);
3787 if (c2) {
3788 if (!storage_copied)
3789 c2->lxc_conf->rootfs.path = NULL;
3790 c2->destroy(c2);
3791 lxc_container_put(c2);
3792 }
3793
3794 return NULL;
3795 }
3796
3797 static struct lxc_container *lxcapi_clone(struct lxc_container *c, const char *newname,
3798 const char *lxcpath, int flags,
3799 const char *bdevtype, const char *bdevdata, uint64_t newsize,
3800 char **hookargs)
3801 {
3802 struct lxc_container * ret;
3803 current_config = c ? c->lxc_conf : NULL;
3804 ret = do_lxcapi_clone(c, newname, lxcpath, flags, bdevtype, bdevdata, newsize, hookargs);
3805 current_config = NULL;
3806 return ret;
3807 }
3808
3809 static bool do_lxcapi_rename(struct lxc_container *c, const char *newname)
3810 {
3811 struct lxc_storage *bdev;
3812 struct lxc_container *newc;
3813
3814 if (!c || !c->name || !c->config_path || !c->lxc_conf)
3815 return false;
3816
3817 if (has_fs_snapshots(c) || has_snapshots(c)) {
3818 ERROR("Renaming a container with snapshots is not supported");
3819 return false;
3820 }
3821 bdev = storage_init(c->lxc_conf);
3822 if (!bdev) {
3823 ERROR("Failed to find original backing store type");
3824 return false;
3825 }
3826
3827 newc = lxcapi_clone(c, newname, c->config_path, LXC_CLONE_KEEPMACADDR, NULL, bdev->type, 0, NULL);
3828 storage_put(bdev);
3829 if (!newc) {
3830 lxc_container_put(newc);
3831 return false;
3832 }
3833
3834 if (newc && lxcapi_is_defined(newc))
3835 lxc_container_put(newc);
3836
3837 if (!container_destroy(c, NULL)) {
3838 ERROR("Could not destroy existing container %s", c->name);
3839 return false;
3840 }
3841 return true;
3842 }
3843
3844 WRAP_API_1(bool, lxcapi_rename, const char *)
3845
3846 static int lxcapi_attach(struct lxc_container *c, lxc_attach_exec_t exec_function, void *exec_payload, lxc_attach_options_t *options, pid_t *attached_process)
3847 {
3848 int ret;
3849
3850 if (!c)
3851 return -1;
3852
3853 current_config = c->lxc_conf;
3854
3855 ret = lxc_attach(c->name, c->config_path, exec_function, exec_payload, options, attached_process);
3856 current_config = NULL;
3857 return ret;
3858 }
3859
3860 static int do_lxcapi_attach_run_wait(struct lxc_container *c, lxc_attach_options_t *options, const char *program, const char * const argv[])
3861 {
3862 lxc_attach_command_t command;
3863 pid_t pid;
3864 int r;
3865
3866 if (!c)
3867 return -1;
3868
3869 command.program = (char*)program;
3870 command.argv = (char**)argv;
3871 r = lxc_attach(c->name, c->config_path, lxc_attach_run_command, &command, options, &pid);
3872 if (r < 0) {
3873 ERROR("ups");
3874 return r;
3875 }
3876 return lxc_wait_for_pid_status(pid);
3877 }
3878
3879 static int lxcapi_attach_run_wait(struct lxc_container *c, lxc_attach_options_t *options, const char *program, const char * const argv[])
3880 {
3881 int ret;
3882 current_config = c ? c->lxc_conf : NULL;
3883 ret = do_lxcapi_attach_run_wait(c, options, program, argv);
3884 current_config = NULL;
3885 return ret;
3886 }
3887
3888 static int get_next_index(const char *lxcpath, char *cname)
3889 {
3890 char *fname;
3891 struct stat sb;
3892 int i = 0, ret;
3893
3894 fname = alloca(strlen(lxcpath) + 20);
3895 while (1) {
3896 sprintf(fname, "%s/snap%d", lxcpath, i);
3897 ret = stat(fname, &sb);
3898 if (ret != 0)
3899 return i;
3900 i++;
3901 }
3902 }
3903
3904 static bool get_snappath_dir(struct lxc_container *c, char *snappath)
3905 {
3906 int ret;
3907 /*
3908 * If the old style snapshot path exists, use it
3909 * /var/lib/lxc -> /var/lib/lxcsnaps
3910 */
3911 ret = snprintf(snappath, MAXPATHLEN, "%ssnaps", c->config_path);
3912 if (ret < 0 || ret >= MAXPATHLEN)
3913 return false;
3914 if (dir_exists(snappath)) {
3915 ret = snprintf(snappath, MAXPATHLEN, "%ssnaps/%s", c->config_path, c->name);
3916 if (ret < 0 || ret >= MAXPATHLEN)
3917 return false;
3918 return true;
3919 }
3920
3921 /*
3922 * Use the new style path
3923 * /var/lib/lxc -> /var/lib/lxc + c->name + /snaps + \0
3924 */
3925 ret = snprintf(snappath, MAXPATHLEN, "%s/%s/snaps", c->config_path, c->name);
3926 if (ret < 0 || ret >= MAXPATHLEN)
3927 return false;
3928 return true;
3929 }
3930
3931 static int do_lxcapi_snapshot(struct lxc_container *c, const char *commentfile)
3932 {
3933 int i, flags, ret;
3934 struct lxc_container *c2;
3935 char snappath[MAXPATHLEN], newname[20];
3936
3937 if (!c || !lxcapi_is_defined(c))
3938 return -1;
3939
3940 if (!storage_can_backup(c->lxc_conf)) {
3941 ERROR("%s's backing store cannot be backed up.", c->name);
3942 ERROR("Your container must use another backing store type.");
3943 return -1;
3944 }
3945
3946 if (!get_snappath_dir(c, snappath))
3947 return -1;
3948
3949 i = get_next_index(snappath, c->name);
3950
3951 if (mkdir_p(snappath, 0755) < 0) {
3952 ERROR("Failed to create snapshot directory %s", snappath);
3953 return -1;
3954 }
3955
3956 ret = snprintf(newname, 20, "snap%d", i);
3957 if (ret < 0 || ret >= 20)
3958 return -1;
3959
3960 /*
3961 * We pass LXC_CLONE_SNAPSHOT to make sure that a rdepends file entry is
3962 * created in the original container
3963 */
3964 flags = LXC_CLONE_SNAPSHOT | LXC_CLONE_KEEPMACADDR | LXC_CLONE_KEEPNAME |
3965 LXC_CLONE_KEEPBDEVTYPE | LXC_CLONE_MAYBE_SNAPSHOT;
3966 if (storage_is_dir(c->lxc_conf)) {
3967 ERROR("Snapshot of directory-backed container requested.");
3968 ERROR("Making a copy-clone. If you do want snapshots, then");
3969 ERROR("please create overlay clone first, snapshot that");
3970 ERROR("and keep the original container pristine.");
3971 flags &= ~LXC_CLONE_SNAPSHOT | LXC_CLONE_MAYBE_SNAPSHOT;
3972 }
3973 c2 = do_lxcapi_clone(c, newname, snappath, flags, NULL, NULL, 0, NULL);
3974 if (!c2) {
3975 ERROR("clone of %s:%s failed", c->config_path, c->name);
3976 return -1;
3977 }
3978
3979 lxc_container_put(c2);
3980
3981 /* Now write down the creation time. */
3982 time_t timer;
3983 char buffer[25];
3984 struct tm* tm_info;
3985 FILE *f;
3986
3987 time(&timer);
3988 tm_info = localtime(&timer);
3989
3990 strftime(buffer, 25, "%Y:%m:%d %H:%M:%S", tm_info);
3991
3992 char *dfnam = alloca(strlen(snappath) + strlen(newname) + 5);
3993 sprintf(dfnam, "%s/%s/ts", snappath, newname);
3994 f = fopen(dfnam, "w");
3995 if (!f) {
3996 ERROR("Failed to open %s", dfnam);
3997 return -1;
3998 }
3999 if (fprintf(f, "%s", buffer) < 0) {
4000 SYSERROR("Writing timestamp");
4001 fclose(f);
4002 return -1;
4003 }
4004 ret = fclose(f);
4005 if (ret != 0) {
4006 SYSERROR("Writing timestamp");
4007 return -1;
4008 }
4009
4010 if (commentfile) {
4011 /* $p / $name / comment \0 */
4012 int len = strlen(snappath) + strlen(newname) + 10;
4013 char *path = alloca(len);
4014 sprintf(path, "%s/%s/comment", snappath, newname);
4015 return copy_file(commentfile, path) < 0 ? -1 : i;
4016 }
4017
4018 return i;
4019 }
4020
4021 WRAP_API_1(int, lxcapi_snapshot, const char *)
4022
4023 static void lxcsnap_free(struct lxc_snapshot *s)
4024 {
4025 free(s->name);
4026 free(s->comment_pathname);
4027 free(s->timestamp);
4028 free(s->lxcpath);
4029 }
4030
4031 static char *get_snapcomment_path(char* snappath, char *name)
4032 {
4033 /* $snappath/$name/comment */
4034 int ret, len = strlen(snappath) + strlen(name) + 10;
4035 char *s = malloc(len);
4036
4037 if (s) {
4038 ret = snprintf(s, len, "%s/%s/comment", snappath, name);
4039 if (ret < 0 || ret >= len) {
4040 free(s);
4041 s = NULL;
4042 }
4043 }
4044 return s;
4045 }
4046
4047 static char *get_timestamp(char* snappath, char *name)
4048 {
4049 char path[MAXPATHLEN], *s = NULL;
4050 int ret, len;
4051 FILE *fin;
4052
4053 ret = snprintf(path, MAXPATHLEN, "%s/%s/ts", snappath, name);
4054 if (ret < 0 || ret >= MAXPATHLEN)
4055 return NULL;
4056 fin = fopen(path, "r");
4057 if (!fin)
4058 return NULL;
4059 (void) fseek(fin, 0, SEEK_END);
4060 len = ftell(fin);
4061 (void) fseek(fin, 0, SEEK_SET);
4062 if (len > 0) {
4063 s = malloc(len+1);
4064 if (s) {
4065 s[len] = '\0';
4066 if (fread(s, 1, len, fin) != len) {
4067 SYSERROR("reading timestamp");
4068 free(s);
4069 s = NULL;
4070 }
4071 }
4072 }
4073 fclose(fin);
4074 return s;
4075 }
4076
4077 static int do_lxcapi_snapshot_list(struct lxc_container *c, struct lxc_snapshot **ret_snaps)
4078 {
4079 char snappath[MAXPATHLEN], path2[MAXPATHLEN];
4080 int count = 0, ret;
4081 struct dirent *direntp;
4082 struct lxc_snapshot *snaps =NULL, *nsnaps;
4083 DIR *dir;
4084
4085 if (!c || !lxcapi_is_defined(c))
4086 return -1;
4087
4088 if (!get_snappath_dir(c, snappath)) {
4089 ERROR("path name too long");
4090 return -1;
4091 }
4092 dir = opendir(snappath);
4093 if (!dir) {
4094 INFO("failed to open %s - assuming no snapshots", snappath);
4095 return 0;
4096 }
4097
4098 while ((direntp = readdir(dir))) {
4099 if (!direntp)
4100 break;
4101
4102 if (!strcmp(direntp->d_name, "."))
4103 continue;
4104
4105 if (!strcmp(direntp->d_name, ".."))
4106 continue;
4107
4108 ret = snprintf(path2, MAXPATHLEN, "%s/%s/config", snappath, direntp->d_name);
4109 if (ret < 0 || ret >= MAXPATHLEN) {
4110 ERROR("pathname too long");
4111 goto out_free;
4112 }
4113 if (!file_exists(path2))
4114 continue;
4115 nsnaps = realloc(snaps, (count + 1)*sizeof(*snaps));
4116 if (!nsnaps) {
4117 SYSERROR("Out of memory");
4118 goto out_free;
4119 }
4120 snaps = nsnaps;
4121 snaps[count].free = lxcsnap_free;
4122 snaps[count].name = strdup(direntp->d_name);
4123 if (!snaps[count].name)
4124 goto out_free;
4125 snaps[count].lxcpath = strdup(snappath);
4126 if (!snaps[count].lxcpath) {
4127 free(snaps[count].name);
4128 goto out_free;
4129 }
4130 snaps[count].comment_pathname = get_snapcomment_path(snappath, direntp->d_name);
4131 snaps[count].timestamp = get_timestamp(snappath, direntp->d_name);
4132 count++;
4133 }
4134
4135 if (closedir(dir))
4136 WARN("failed to close directory");
4137
4138 *ret_snaps = snaps;
4139 return count;
4140
4141 out_free:
4142 if (snaps) {
4143 int i;
4144 for (i=0; i<count; i++)
4145 lxcsnap_free(&snaps[i]);
4146 free(snaps);
4147 }
4148 if (closedir(dir))
4149 WARN("failed to close directory");
4150 return -1;
4151 }
4152
4153 WRAP_API_1(int, lxcapi_snapshot_list, struct lxc_snapshot **)
4154
4155 static bool do_lxcapi_snapshot_restore(struct lxc_container *c, const char *snapname, const char *newname)
4156 {
4157 char clonelxcpath[MAXPATHLEN];
4158 int flags = 0;
4159 struct lxc_container *snap, *rest;
4160 struct lxc_storage *bdev;
4161 bool b = false;
4162
4163 if (!c || !c->name || !c->config_path)
4164 return false;
4165
4166 if (has_fs_snapshots(c)) {
4167 ERROR("container rootfs has dependent snapshots");
4168 return false;
4169 }
4170
4171 bdev = storage_init(c->lxc_conf);
4172 if (!bdev) {
4173 ERROR("Failed to find original backing store type");
4174 return false;
4175 }
4176
4177 /* For an overlay container the rootfs is considered immutable
4178 * and cannot be removed when restoring from a snapshot. We pass this
4179 * internal flag along to communicate this to various parts of the
4180 * codebase.
4181 */
4182 if (!strcmp(bdev->type, "overlay") || !strcmp(bdev->type, "overlayfs"))
4183 bdev->flags |= LXC_STORAGE_INTERNAL_OVERLAY_RESTORE;
4184
4185 if (!newname)
4186 newname = c->name;
4187
4188 if (!get_snappath_dir(c, clonelxcpath)) {
4189 storage_put(bdev);
4190 return false;
4191 }
4192 /* how should we lock this? */
4193
4194 snap = lxc_container_new(snapname, clonelxcpath);
4195 if (!snap || !lxcapi_is_defined(snap)) {
4196 ERROR("Could not open snapshot %s", snapname);
4197 if (snap)
4198 lxc_container_put(snap);
4199 storage_put(bdev);
4200 return false;
4201 }
4202
4203 if (!strcmp(c->name, newname)) {
4204 if (!container_destroy(c, bdev)) {
4205 ERROR("Could not destroy existing container %s", newname);
4206 lxc_container_put(snap);
4207 storage_put(bdev);
4208 return false;
4209 }
4210 }
4211
4212 if (strcmp(bdev->type, "dir") != 0 && strcmp(bdev->type, "loop") != 0)
4213 flags = LXC_CLONE_SNAPSHOT | LXC_CLONE_MAYBE_SNAPSHOT;
4214
4215 if (!strcmp(bdev->type, "overlay") || !strcmp(bdev->type, "overlayfs"))
4216 flags |= LXC_STORAGE_INTERNAL_OVERLAY_RESTORE;
4217 rest = lxcapi_clone(snap, newname, c->config_path, flags, bdev->type,
4218 NULL, 0, NULL);
4219 storage_put(bdev);
4220 if (rest && lxcapi_is_defined(rest))
4221 b = true;
4222 if (rest)
4223 lxc_container_put(rest);
4224
4225 lxc_container_put(snap);
4226 return b;
4227 }
4228
4229 WRAP_API_2(bool, lxcapi_snapshot_restore, const char *, const char *)
4230
4231 static bool do_snapshot_destroy(const char *snapname, const char *clonelxcpath)
4232 {
4233 struct lxc_container *snap = NULL;
4234 bool bret = false;
4235
4236 snap = lxc_container_new(snapname, clonelxcpath);
4237 if (!snap) {
4238 ERROR("Could not find snapshot %s", snapname);
4239 goto err;
4240 }
4241
4242 if (!do_lxcapi_destroy(snap)) {
4243 ERROR("Could not destroy snapshot %s", snapname);
4244 goto err;
4245 }
4246 bret = true;
4247
4248 err:
4249 if (snap)
4250 lxc_container_put(snap);
4251 return bret;
4252 }
4253
4254 static bool remove_all_snapshots(const char *path)
4255 {
4256 DIR *dir;
4257 struct dirent *direntp;
4258 bool bret = true;
4259
4260 dir = opendir(path);
4261 if (!dir) {
4262 SYSERROR("opendir on snapshot path %s", path);
4263 return false;
4264 }
4265 while ((direntp = readdir(dir))) {
4266 if (!strcmp(direntp->d_name, "."))
4267 continue;
4268 if (!strcmp(direntp->d_name, ".."))
4269 continue;
4270 if (!do_snapshot_destroy(direntp->d_name, path)) {
4271 bret = false;
4272 continue;
4273 }
4274 }
4275
4276 closedir(dir);
4277
4278 if (rmdir(path))
4279 SYSERROR("Error removing directory %s", path);
4280
4281 return bret;
4282 }
4283
4284 static bool do_lxcapi_snapshot_destroy(struct lxc_container *c, const char *snapname)
4285 {
4286 char clonelxcpath[MAXPATHLEN];
4287
4288 if (!c || !c->name || !c->config_path || !snapname)
4289 return false;
4290
4291 if (!get_snappath_dir(c, clonelxcpath))
4292 return false;
4293
4294 return do_snapshot_destroy(snapname, clonelxcpath);
4295 }
4296
4297 WRAP_API_1(bool, lxcapi_snapshot_destroy, const char *)
4298
4299 static bool do_lxcapi_snapshot_destroy_all(struct lxc_container *c)
4300 {
4301 char clonelxcpath[MAXPATHLEN];
4302
4303 if (!c || !c->name || !c->config_path)
4304 return false;
4305
4306 if (!get_snappath_dir(c, clonelxcpath))
4307 return false;
4308
4309 return remove_all_snapshots(clonelxcpath);
4310 }
4311
4312 WRAP_API(bool, lxcapi_snapshot_destroy_all)
4313
4314 static bool do_lxcapi_may_control(struct lxc_container *c)
4315 {
4316 return lxc_try_cmd(c->name, c->config_path) == 0;
4317 }
4318
4319 WRAP_API(bool, lxcapi_may_control)
4320
4321 static bool do_add_remove_node(pid_t init_pid, const char *path, bool add,
4322 struct stat *st)
4323 {
4324 int ret;
4325 char *tmp;
4326 pid_t pid;
4327 char chrootpath[MAXPATHLEN];
4328 char *directory_path = NULL;
4329
4330 pid = fork();
4331 if (pid < 0) {
4332 SYSERROR("Failed to fork()");
4333 return false;
4334 }
4335
4336 if (pid) {
4337 ret = wait_for_pid(pid);
4338 if (ret != 0) {
4339 ERROR("Failed to create device node");
4340 return false;
4341 }
4342
4343 return true;
4344 }
4345
4346 /* prepare the path */
4347 ret = snprintf(chrootpath, MAXPATHLEN, "/proc/%d/root", init_pid);
4348 if (ret < 0 || ret >= MAXPATHLEN)
4349 return false;
4350
4351 ret = chroot(chrootpath);
4352 if (ret < 0)
4353 _exit(EXIT_FAILURE);
4354
4355 ret = chdir("/");
4356 if (ret < 0)
4357 _exit(EXIT_FAILURE);
4358
4359 /* remove path if it exists */
4360 ret = faccessat(AT_FDCWD, path, F_OK, AT_SYMLINK_NOFOLLOW);
4361 if(ret == 0) {
4362 ret = unlink(path);
4363 if (ret < 0) {
4364 ERROR("%s - Failed to remove \"%s\"", strerror(errno), path);
4365 _exit(EXIT_FAILURE);
4366 }
4367 }
4368
4369 if (!add)
4370 _exit(EXIT_SUCCESS);
4371
4372 /* create any missing directories */
4373 tmp = strdup(path);
4374 if (!tmp)
4375 _exit(EXIT_FAILURE);
4376
4377 directory_path = dirname(tmp);
4378 ret = mkdir_p(directory_path, 0755);
4379 if (ret < 0 && errno != EEXIST) {
4380 ERROR("%s - Failed to create path \"%s\"", strerror(errno), directory_path);
4381 free(tmp);
4382 _exit(EXIT_FAILURE);
4383 }
4384
4385 /* create the device node */
4386 ret = mknod(path, st->st_mode, st->st_rdev);
4387 free(tmp);
4388 if (ret < 0) {
4389 ERROR("%s - Failed to create device node at \"%s\"", strerror(errno), path);
4390 _exit(EXIT_FAILURE);
4391 }
4392
4393 _exit(EXIT_SUCCESS);
4394 }
4395
4396 static bool add_remove_device_node(struct lxc_container *c, const char *src_path, const char *dest_path, bool add)
4397 {
4398 int ret;
4399 struct stat st;
4400 char value[LXC_MAX_BUFFER];
4401 const char *p;
4402
4403 /* make sure container is running */
4404 if (!do_lxcapi_is_running(c)) {
4405 ERROR("container is not running");
4406 return false;
4407 }
4408
4409 /* use src_path if dest_path is NULL otherwise use dest_path */
4410 p = dest_path ? dest_path : src_path;
4411
4412 /* make sure we can access p */
4413 if(access(p, F_OK) < 0 || stat(p, &st) < 0)
4414 return false;
4415
4416 /* continue if path is character device or block device */
4417 if (S_ISCHR(st.st_mode))
4418 ret = snprintf(value, LXC_MAX_BUFFER, "c %d:%d rwm", major(st.st_rdev), minor(st.st_rdev));
4419 else if (S_ISBLK(st.st_mode))
4420 ret = snprintf(value, LXC_MAX_BUFFER, "b %d:%d rwm", major(st.st_rdev), minor(st.st_rdev));
4421 else
4422 return false;
4423
4424 /* check snprintf return code */
4425 if (ret < 0 || ret >= LXC_MAX_BUFFER)
4426 return false;
4427
4428 if (!do_add_remove_node(do_lxcapi_init_pid(c), p, add, &st))
4429 return false;
4430
4431 /* add or remove device to/from cgroup access list */
4432 if (add) {
4433 if (!do_lxcapi_set_cgroup_item(c, "devices.allow", value)) {
4434 ERROR("set_cgroup_item failed while adding the device node");
4435 return false;
4436 }
4437 } else {
4438 if (!do_lxcapi_set_cgroup_item(c, "devices.deny", value)) {
4439 ERROR("set_cgroup_item failed while removing the device node");
4440 return false;
4441 }
4442 }
4443
4444 return true;
4445 }
4446
4447 static bool do_lxcapi_add_device_node(struct lxc_container *c, const char *src_path, const char *dest_path)
4448 {
4449 // cannot mknod if we're not privileged wrt init_user_ns
4450 if (am_host_unpriv()) {
4451 ERROR(LXC_UNPRIV_EOPNOTSUPP, __FUNCTION__);
4452 return false;
4453 }
4454 return add_remove_device_node(c, src_path, dest_path, true);
4455 }
4456
4457 WRAP_API_2(bool, lxcapi_add_device_node, const char *, const char *)
4458
4459 static bool do_lxcapi_remove_device_node(struct lxc_container *c, const char *src_path, const char *dest_path)
4460 {
4461 if (am_guest_unpriv()) {
4462 ERROR(LXC_UNPRIV_EOPNOTSUPP, __FUNCTION__);
4463 return false;
4464 }
4465 return add_remove_device_node(c, src_path, dest_path, false);
4466 }
4467
4468 WRAP_API_2(bool, lxcapi_remove_device_node, const char *, const char *)
4469
4470 static bool do_lxcapi_attach_interface(struct lxc_container *c,
4471 const char *ifname,
4472 const char *dst_ifname)
4473 {
4474 pid_t init_pid;
4475 int ret = 0;
4476
4477 if (am_guest_unpriv()) {
4478 ERROR(LXC_UNPRIV_EOPNOTSUPP, __FUNCTION__);
4479 return false;
4480 }
4481
4482 if (!ifname) {
4483 ERROR("No source interface name given");
4484 return false;
4485 }
4486
4487 ret = lxc_netdev_isup(ifname);
4488 if (ret > 0) {
4489 /* netdev of ifname is up. */
4490 ret = lxc_netdev_down(ifname);
4491 if (ret)
4492 goto err;
4493 }
4494
4495 init_pid = do_lxcapi_init_pid(c);
4496 ret = lxc_netdev_move_by_name(ifname, init_pid, dst_ifname);
4497 if (ret)
4498 goto err;
4499
4500 INFO("Moved network device \"%s\" to network namespace of %d", ifname, init_pid);
4501 return true;
4502
4503 err:
4504 return false;
4505 }
4506
4507 WRAP_API_2(bool, lxcapi_attach_interface, const char *, const char *)
4508
4509 static bool do_lxcapi_detach_interface(struct lxc_container *c,
4510 const char *ifname,
4511 const char *dst_ifname)
4512 {
4513 int ret;
4514 pid_t pid, pid_outside;
4515
4516 /*
4517 * TODO - if this is a physical device, then we need am_host_unpriv.
4518 * But for other types guest privilege suffices.
4519 */
4520 if (am_guest_unpriv()) {
4521 ERROR(LXC_UNPRIV_EOPNOTSUPP, __FUNCTION__);
4522 return false;
4523 }
4524
4525 if (!ifname) {
4526 ERROR("No source interface name given");
4527 return false;
4528 }
4529
4530 pid_outside = lxc_raw_getpid();
4531 pid = fork();
4532 if (pid < 0) {
4533 ERROR("Failed to fork");
4534 return false;
4535 }
4536
4537 if (pid == 0) { /* child */
4538 pid_t init_pid;
4539
4540 init_pid = do_lxcapi_init_pid(c);
4541 if (!switch_to_ns(init_pid, "net")) {
4542 ERROR("Failed to enter network namespace");
4543 _exit(EXIT_FAILURE);
4544 }
4545
4546 ret = lxc_netdev_isup(ifname);
4547 if (ret < 0) {
4548 ERROR("Failed to determine whether network device \"%s\" is up", ifname);
4549 _exit(EXIT_FAILURE);
4550 }
4551
4552 /* netdev of ifname is up. */
4553 if (ret) {
4554 ret = lxc_netdev_down(ifname);
4555 if (ret) {
4556 ERROR("Failed to set network device \"%s\" down", ifname);
4557 _exit(EXIT_FAILURE);
4558 }
4559 }
4560
4561 ret = lxc_netdev_move_by_name(ifname, pid_outside, dst_ifname);
4562 /* -EINVAL means there is no netdev named as ifname. */
4563 if (ret < 0) {
4564 if (ret == -EINVAL)
4565 ERROR("Network device \"%s\" not found", ifname);
4566 else
4567 ERROR("Failed to remove network device \"%s\"", ifname);
4568 _exit(EXIT_FAILURE);
4569 }
4570
4571 _exit(EXIT_SUCCESS);
4572 }
4573
4574 ret = wait_for_pid(pid);
4575 if (ret != 0)
4576 return false;
4577
4578 INFO("Moved network device \"%s\" to network namespace of %d", ifname, pid_outside);
4579 return true;
4580 }
4581
4582 WRAP_API_2(bool, lxcapi_detach_interface, const char *, const char *)
4583
4584 static int do_lxcapi_migrate(struct lxc_container *c, unsigned int cmd,
4585 struct migrate_opts *opts, unsigned int size)
4586 {
4587 int ret = -1;
4588 struct migrate_opts *valid_opts = opts;
4589 uint64_t features_to_check = 0;
4590
4591 /* If the caller has a bigger (newer) struct migrate_opts, let's make
4592 * sure that the stuff on the end is zero, i.e. that they didn't ask us
4593 * to do anything special.
4594 */
4595 if (size > sizeof(*opts)) {
4596 unsigned char *addr;
4597 unsigned char *end;
4598
4599 addr = (void *)opts + sizeof(*opts);
4600 end = (void *)opts + size;
4601 for (; addr < end; addr++) {
4602 if (*addr) {
4603 return -E2BIG;
4604 }
4605 }
4606 }
4607
4608 /* If the caller has a smaller struct, let's zero out the end for them
4609 * so we don't accidentally use bits of it that they didn't know about
4610 * to initialize.
4611 */
4612 if (size < sizeof(*opts)) {
4613 valid_opts = malloc(sizeof(*opts));
4614 if (!valid_opts)
4615 return -ENOMEM;
4616
4617 memset(valid_opts, 0, sizeof(*opts));
4618 memcpy(valid_opts, opts, size);
4619 }
4620
4621 switch (cmd) {
4622 case MIGRATE_PRE_DUMP:
4623 if (!do_lxcapi_is_running(c)) {
4624 ERROR("container is not running");
4625 goto on_error;
4626 }
4627 ret = !__criu_pre_dump(c, valid_opts);
4628 break;
4629 case MIGRATE_DUMP:
4630 if (!do_lxcapi_is_running(c)) {
4631 ERROR("container is not running");
4632 goto on_error;
4633 }
4634 ret = !__criu_dump(c, valid_opts);
4635 break;
4636 case MIGRATE_RESTORE:
4637 if (do_lxcapi_is_running(c)) {
4638 ERROR("container is already running");
4639 goto on_error;
4640 }
4641 ret = !__criu_restore(c, valid_opts);
4642 break;
4643 case MIGRATE_FEATURE_CHECK:
4644 features_to_check = valid_opts->features_to_check;
4645 ret = !__criu_check_feature(&features_to_check);
4646 if (ret) {
4647 /* Something went wrong. Let's let the caller
4648 * know which feature checks failed. */
4649 valid_opts->features_to_check = features_to_check;
4650 }
4651 break;
4652 default:
4653 ERROR("invalid migrate command %u", cmd);
4654 ret = -EINVAL;
4655 }
4656
4657 on_error:
4658 if (size < sizeof(*opts))
4659 free(valid_opts);
4660
4661 return ret;
4662 }
4663
4664 WRAP_API_3(int, lxcapi_migrate, unsigned int, struct migrate_opts *, unsigned int)
4665
4666 static bool do_lxcapi_checkpoint(struct lxc_container *c, char *directory, bool stop, bool verbose)
4667 {
4668 struct migrate_opts opts;
4669
4670 memset(&opts, 0, sizeof(opts));
4671
4672 opts.directory = directory;
4673 opts.stop = stop;
4674 opts.verbose = verbose;
4675
4676 return !do_lxcapi_migrate(c, MIGRATE_DUMP, &opts, sizeof(opts));
4677 }
4678
4679 WRAP_API_3(bool, lxcapi_checkpoint, char *, bool, bool)
4680
4681 static bool do_lxcapi_restore(struct lxc_container *c, char *directory, bool verbose)
4682 {
4683 struct migrate_opts opts;
4684
4685 memset(&opts, 0, sizeof(opts));
4686
4687 opts.directory = directory;
4688 opts.verbose = verbose;
4689
4690 return !do_lxcapi_migrate(c, MIGRATE_RESTORE, &opts, sizeof(opts));
4691 }
4692
4693 WRAP_API_2(bool, lxcapi_restore, char *, bool)
4694
4695 static int lxcapi_attach_run_waitl(struct lxc_container *c, lxc_attach_options_t *options, const char *program, const char *arg, ...)
4696 {
4697 va_list ap;
4698 const char **argv;
4699 int ret;
4700
4701 if (!c)
4702 return -1;
4703
4704 current_config = c->lxc_conf;
4705
4706 va_start(ap, arg);
4707 argv = lxc_va_arg_list_to_argv_const(ap, 1);
4708 va_end(ap);
4709
4710 if (!argv) {
4711 ERROR("Memory allocation error.");
4712 ret = -1;
4713 goto out;
4714 }
4715 argv[0] = arg;
4716
4717 ret = do_lxcapi_attach_run_wait(c, options, program, (const char * const *)argv);
4718 free((void*)argv);
4719 out:
4720 current_config = NULL;
4721 return ret;
4722 }
4723
4724 struct lxc_container *lxc_container_new(const char *name, const char *configpath)
4725 {
4726 struct lxc_container *c;
4727
4728 if (!name)
4729 return NULL;
4730
4731 c = malloc(sizeof(*c));
4732 if (!c) {
4733 fprintf(stderr, "Failed to allocate memory for %s\n", name);
4734 return NULL;
4735 }
4736 memset(c, 0, sizeof(*c));
4737
4738 if (configpath)
4739 c->config_path = strdup(configpath);
4740 else
4741 c->config_path = strdup(lxc_global_config_value("lxc.lxcpath"));
4742
4743 if (!c->config_path) {
4744 fprintf(stderr, "Failed to allocate memory for %s\n", name);
4745 goto err;
4746 }
4747
4748 remove_trailing_slashes(c->config_path);
4749 c->name = malloc(strlen(name)+1);
4750 if (!c->name) {
4751 fprintf(stderr, "Failed to allocate memory for %s\n", name);
4752 goto err;
4753 }
4754 strcpy(c->name, name);
4755
4756 c->numthreads = 1;
4757 c->slock = lxc_newlock(c->config_path, name);
4758 if (!c->slock) {
4759 fprintf(stderr, "Failed to create lock for %s\n", name);
4760 goto err;
4761 }
4762
4763 c->privlock = lxc_newlock(NULL, NULL);
4764 if (!c->privlock) {
4765 fprintf(stderr, "Failed to create private lock for %s\n", name);
4766 goto err;
4767 }
4768
4769 if (!set_config_filename(c)) {
4770 fprintf(stderr, "Failed to create config file name for %s\n", name);
4771 goto err;
4772 }
4773
4774 if (file_exists(c->configfile) && !lxcapi_load_config(c, NULL)) {
4775 fprintf(stderr, "Failed to load config for %s\n", name);
4776 goto err;
4777 }
4778
4779 if (ongoing_create(c) == 2) {
4780 ERROR("Failed to complete container creation for %s", c->name);
4781 container_destroy(c, NULL);
4782 lxcapi_clear_config(c);
4783 }
4784 c->daemonize = true;
4785 c->pidfile = NULL;
4786
4787 /* Assign the member functions. */
4788 c->is_defined = lxcapi_is_defined;
4789 c->state = lxcapi_state;
4790 c->is_running = lxcapi_is_running;
4791 c->freeze = lxcapi_freeze;
4792 c->unfreeze = lxcapi_unfreeze;
4793 c->console = lxcapi_console;
4794 c->console_getfd = lxcapi_console_getfd;
4795 c->init_pid = lxcapi_init_pid;
4796 c->load_config = lxcapi_load_config;
4797 c->want_daemonize = lxcapi_want_daemonize;
4798 c->want_close_all_fds = lxcapi_want_close_all_fds;
4799 c->start = lxcapi_start;
4800 c->startl = lxcapi_startl;
4801 c->stop = lxcapi_stop;
4802 c->config_file_name = lxcapi_config_file_name;
4803 c->wait = lxcapi_wait;
4804 c->set_config_item = lxcapi_set_config_item;
4805 c->destroy = lxcapi_destroy;
4806 c->destroy_with_snapshots = lxcapi_destroy_with_snapshots;
4807 c->rename = lxcapi_rename;
4808 c->save_config = lxcapi_save_config;
4809 c->get_keys = lxcapi_get_keys;
4810 c->create = lxcapi_create;
4811 c->createl = lxcapi_createl;
4812 c->shutdown = lxcapi_shutdown;
4813 c->reboot = lxcapi_reboot;
4814 c->reboot2 = lxcapi_reboot2;
4815 c->clear_config = lxcapi_clear_config;
4816 c->clear_config_item = lxcapi_clear_config_item;
4817 c->get_config_item = lxcapi_get_config_item;
4818 c->get_running_config_item = lxcapi_get_running_config_item;
4819 c->get_cgroup_item = lxcapi_get_cgroup_item;
4820 c->set_cgroup_item = lxcapi_set_cgroup_item;
4821 c->get_config_path = lxcapi_get_config_path;
4822 c->set_config_path = lxcapi_set_config_path;
4823 c->clone = lxcapi_clone;
4824 c->get_interfaces = lxcapi_get_interfaces;
4825 c->get_ips = lxcapi_get_ips;
4826 c->attach = lxcapi_attach;
4827 c->attach_run_wait = lxcapi_attach_run_wait;
4828 c->attach_run_waitl = lxcapi_attach_run_waitl;
4829 c->snapshot = lxcapi_snapshot;
4830 c->snapshot_list = lxcapi_snapshot_list;
4831 c->snapshot_restore = lxcapi_snapshot_restore;
4832 c->snapshot_destroy = lxcapi_snapshot_destroy;
4833 c->snapshot_destroy_all = lxcapi_snapshot_destroy_all;
4834 c->may_control = lxcapi_may_control;
4835 c->add_device_node = lxcapi_add_device_node;
4836 c->remove_device_node = lxcapi_remove_device_node;
4837 c->attach_interface = lxcapi_attach_interface;
4838 c->detach_interface = lxcapi_detach_interface;
4839 c->checkpoint = lxcapi_checkpoint;
4840 c->restore = lxcapi_restore;
4841 c->migrate = lxcapi_migrate;
4842 c->console_log = lxcapi_console_log;
4843
4844 return c;
4845
4846 err:
4847 lxc_container_free(c);
4848 return NULL;
4849 }
4850
4851 int lxc_get_wait_states(const char **states)
4852 {
4853 int i;
4854
4855 if (states)
4856 for (i=0; i<MAX_STATE; i++)
4857 states[i] = lxc_state2str(i);
4858 return MAX_STATE;
4859 }
4860
4861 /*
4862 * These next two could probably be done smarter with reusing a common function
4863 * with different iterators and tests...
4864 */
4865 int list_defined_containers(const char *lxcpath, char ***names, struct lxc_container ***cret)
4866 {
4867 DIR *dir;
4868 int i, cfound = 0, nfound = 0;
4869 struct dirent *direntp;
4870 struct lxc_container *c;
4871
4872 if (!lxcpath)
4873 lxcpath = lxc_global_config_value("lxc.lxcpath");
4874
4875 dir = opendir(lxcpath);
4876 if (!dir) {
4877 SYSERROR("opendir on lxcpath");
4878 return -1;
4879 }
4880
4881 if (cret)
4882 *cret = NULL;
4883 if (names)
4884 *names = NULL;
4885
4886 while ((direntp = readdir(dir))) {
4887 if (!direntp)
4888 break;
4889
4890 /* Ignore '.', '..' and any hidden directory. */
4891 if (!strncmp(direntp->d_name, ".", 1))
4892 continue;
4893
4894 if (!config_file_exists(lxcpath, direntp->d_name))
4895 continue;
4896
4897 if (names) {
4898 if (!add_to_array(names, direntp->d_name, cfound))
4899 goto free_bad;
4900 }
4901 cfound++;
4902
4903 if (!cret) {
4904 nfound++;
4905 continue;
4906 }
4907
4908 c = lxc_container_new(direntp->d_name, lxcpath);
4909 if (!c) {
4910 INFO("Container %s:%s has a config but could not be loaded",
4911 lxcpath, direntp->d_name);
4912 if (names)
4913 if(!remove_from_array(names, direntp->d_name, cfound--))
4914 goto free_bad;
4915 continue;
4916 }
4917 if (!do_lxcapi_is_defined(c)) {
4918 INFO("Container %s:%s has a config but is not defined",
4919 lxcpath, direntp->d_name);
4920 if (names)
4921 if(!remove_from_array(names, direntp->d_name, cfound--))
4922 goto free_bad;
4923 lxc_container_put(c);
4924 continue;
4925 }
4926
4927 if (!add_to_clist(cret, c, nfound, true)) {
4928 lxc_container_put(c);
4929 goto free_bad;
4930 }
4931 nfound++;
4932 }
4933
4934 closedir(dir);
4935 return nfound;
4936
4937 free_bad:
4938 if (names && *names) {
4939 for (i=0; i<cfound; i++)
4940 free((*names)[i]);
4941 free(*names);
4942 }
4943 if (cret && *cret) {
4944 for (i=0; i<nfound; i++)
4945 lxc_container_put((*cret)[i]);
4946 free(*cret);
4947 }
4948 closedir(dir);
4949 return -1;
4950 }
4951
4952 int list_active_containers(const char *lxcpath, char ***nret,
4953 struct lxc_container ***cret)
4954 {
4955 int i, ret = -1, cret_cnt = 0, ct_name_cnt = 0;
4956 int lxcpath_len;
4957 char *line = NULL;
4958 char **ct_name = NULL;
4959 size_t len = 0;
4960 struct lxc_container *c = NULL;
4961 bool is_hashed;
4962
4963 if (!lxcpath)
4964 lxcpath = lxc_global_config_value("lxc.lxcpath");
4965 lxcpath_len = strlen(lxcpath);
4966
4967 if (cret)
4968 *cret = NULL;
4969 if (nret)
4970 *nret = NULL;
4971
4972 FILE *f = fopen("/proc/net/unix", "r");
4973 if (!f)
4974 return -1;
4975
4976 while (getline(&line, &len, f) != -1) {
4977
4978 char *p = strrchr(line, ' '), *p2;
4979 if (!p)
4980 continue;
4981 p++;
4982 if (*p != 0x40)
4983 continue;
4984 p++;
4985
4986 is_hashed = false;
4987 if (strncmp(p, lxcpath, lxcpath_len) == 0) {
4988 p += lxcpath_len;
4989 } else if (strncmp(p, "lxc/", 4) == 0) {
4990 p += 4;
4991 is_hashed = true;
4992 } else {
4993 continue;
4994 }
4995
4996 while (*p == '/')
4997 p++;
4998
4999 /* Now p is the start of lxc_name. */
5000 p2 = strchr(p, '/');
5001 if (!p2 || strncmp(p2, "/command", 8) != 0)
5002 continue;
5003 *p2 = '\0';
5004
5005 if (is_hashed) {
5006 char *recvpath = lxc_cmd_get_lxcpath(p);
5007 if (!recvpath)
5008 continue;
5009 if (strncmp(lxcpath, recvpath, lxcpath_len) != 0) {
5010 free(recvpath);
5011 continue;
5012 }
5013 free(recvpath);
5014 p = lxc_cmd_get_name(p);
5015 if (!p)
5016 continue;
5017 }
5018
5019 if (array_contains(&ct_name, p, ct_name_cnt)) {
5020 if (is_hashed)
5021 free(p);
5022 continue;
5023 }
5024
5025 if (!add_to_array(&ct_name, p, ct_name_cnt)) {
5026 if (is_hashed)
5027 free(p);
5028 goto free_cret_list;
5029 }
5030
5031 ct_name_cnt++;
5032
5033 if (!cret) {
5034 if (is_hashed)
5035 free(p);
5036 continue;
5037 }
5038
5039 c = lxc_container_new(p, lxcpath);
5040 if (!c) {
5041 INFO("Container %s:%s is running but could not be loaded",
5042 lxcpath, p);
5043 remove_from_array(&ct_name, p, ct_name_cnt--);
5044 if (is_hashed)
5045 free(p);
5046 continue;
5047 }
5048
5049 if (is_hashed)
5050 free(p);
5051
5052 /*
5053 * If this is an anonymous container, then is_defined *can*
5054 * return false. So we don't do that check. Count on the
5055 * fact that the command socket exists.
5056 */
5057
5058 if (!add_to_clist(cret, c, cret_cnt, true)) {
5059 lxc_container_put(c);
5060 goto free_cret_list;
5061 }
5062 cret_cnt++;
5063 }
5064
5065 if (nret && cret && cret_cnt != ct_name_cnt) {
5066 if (c)
5067 lxc_container_put(c);
5068 goto free_cret_list;
5069 }
5070
5071 ret = ct_name_cnt;
5072 if (nret)
5073 *nret = ct_name;
5074 else
5075 goto free_ct_name;
5076 goto out;
5077
5078 free_cret_list:
5079 if (cret && *cret) {
5080 for (i = 0; i < cret_cnt; i++)
5081 lxc_container_put((*cret)[i]);
5082 free(*cret);
5083 }
5084
5085 free_ct_name:
5086 if (ct_name) {
5087 for (i = 0; i < ct_name_cnt; i++)
5088 free(ct_name[i]);
5089 free(ct_name);
5090 }
5091
5092 out:
5093 free(line);
5094
5095 fclose(f);
5096 return ret;
5097 }
5098
5099 int list_all_containers(const char *lxcpath, char ***nret,
5100 struct lxc_container ***cret)
5101 {
5102 int i, ret, active_cnt, ct_cnt, ct_list_cnt;
5103 char **active_name;
5104 char **ct_name;
5105 struct lxc_container **ct_list = NULL;
5106
5107 ct_cnt = list_defined_containers(lxcpath, &ct_name, NULL);
5108 if (ct_cnt < 0)
5109 return ct_cnt;
5110
5111 active_cnt = list_active_containers(lxcpath, &active_name, NULL);
5112 if (active_cnt < 0) {
5113 ret = active_cnt;
5114 goto free_ct_name;
5115 }
5116
5117 for (i = 0; i < active_cnt; i++) {
5118 if (!array_contains(&ct_name, active_name[i], ct_cnt)) {
5119 if (!add_to_array(&ct_name, active_name[i], ct_cnt)) {
5120 ret = -1;
5121 goto free_active_name;
5122 }
5123 ct_cnt++;
5124 }
5125 free(active_name[i]);
5126 active_name[i] = NULL;
5127 }
5128 free(active_name);
5129 active_name = NULL;
5130 active_cnt = 0;
5131
5132 for (i = 0, ct_list_cnt = 0; i < ct_cnt && cret; i++) {
5133 struct lxc_container *c;
5134
5135 c = lxc_container_new(ct_name[i], lxcpath);
5136 if (!c) {
5137 WARN("Container %s:%s could not be loaded", lxcpath, ct_name[i]);
5138 remove_from_array(&ct_name, ct_name[i], ct_cnt--);
5139 continue;
5140 }
5141
5142 if (!add_to_clist(&ct_list, c, ct_list_cnt, false)) {
5143 lxc_container_put(c);
5144 ret = -1;
5145 goto free_ct_list;
5146 }
5147 ct_list_cnt++;
5148 }
5149
5150 if (cret)
5151 *cret = ct_list;
5152
5153 if (nret)
5154 *nret = ct_name;
5155 else {
5156 ret = ct_cnt;
5157 goto free_ct_name;
5158 }
5159 return ct_cnt;
5160
5161 free_ct_list:
5162 for (i = 0; i < ct_list_cnt; i++) {
5163 lxc_container_put(ct_list[i]);
5164 }
5165 free(ct_list);
5166
5167 free_active_name:
5168 for (i = 0; i < active_cnt; i++) {
5169 free(active_name[i]);
5170 }
5171 free(active_name);
5172
5173 free_ct_name:
5174 for (i = 0; i < ct_cnt; i++) {
5175 free(ct_name[i]);
5176 }
5177 free(ct_name);
5178 return ret;
5179 }
5180
5181 bool lxc_config_item_is_supported(const char *key)
5182 {
5183 return !!lxc_get_config(key);
5184 }
LXC mirror