]> git.proxmox.com Git - mirror_lxc.git/blob - src/lxc/lxccontainer.c
projects / mirror_lxc.git / blob
? search:
summary | shortlog | log | commit | commitdiff | tree
blame | history | raw | HEAD
don't hang on some errors in do_restore
[mirror_lxc.git] / src / lxc / lxccontainer.c
1 /* liblxcapi
2 *
3 * Copyright © 2012 Serge Hallyn <serge.hallyn@ubuntu.com>.
4 * Copyright © 2012 Canonical Ltd.
5 *
6 * This library is free software; you can redistribute it and/or
7 * modify it under the terms of the GNU Lesser General Public
8 * License as published by the Free Software Foundation; either
9 * version 2.1 of the License, or (at your option) any later version.
10
11 * This library is distributed in the hope that it will be useful,
12 * but WITHOUT ANY WARRANTY; without even the implied warranty of
13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
14 * Lesser General Public License for more details.
15
16 * You should have received a copy of the GNU Lesser General Public
17 * License along with this library; if not, write to the Free Software
18 * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
19 */
20
21 #define _GNU_SOURCE
22 #include <assert.h>
23 #include <stdarg.h>
24 #include <pthread.h>
25 #include <unistd.h>
26 #include <sys/types.h>
27 #include <sys/wait.h>
28 #include <sys/mount.h>
29 #include <errno.h>
30 #include <fcntl.h>
31 #include <sched.h>
32 #include <dirent.h>
33 #include <sched.h>
34 #include <arpa/inet.h>
35 #include <libgen.h>
36 #include <stdint.h>
37 #include <grp.h>
38 #include <sys/syscall.h>
39
40 #include <lxc/lxccontainer.h>
41 #include <lxc/version.h>
42 #include <lxc/network.h>
43
44 #include "config.h"
45 #include "lxc.h"
46 #include "state.h"
47 #include "conf.h"
48 #include "confile.h"
49 #include "console.h"
50 #include "cgroup.h"
51 #include "commands.h"
52 #include "log.h"
53 #include "bdev.h"
54 #include "utils.h"
55 #include "attach.h"
56 #include "monitor.h"
57 #include "namespace.h"
58 #include "network.h"
59 #include "lxclock.h"
60 #include "sync.h"
61
62 #if HAVE_IFADDRS_H
63 #include <ifaddrs.h>
64 #else
65 #include <../include/ifaddrs.h>
66 #endif
67
68 #define MAX_BUFFER 4096
69
70 #define NOT_SUPPORTED_ERROR "the requested function %s is not currently supported with unprivileged containers"
71
72 /* Define faccessat() if missing from the C library */
73 #ifndef HAVE_FACCESSAT
74 static int faccessat(int __fd, const char *__file, int __type, int __flag)
75 {
76 #ifdef __NR_faccessat
77 return syscall(__NR_faccessat, __fd, __file, __type, __flag);
78 #else
79 errno = ENOSYS;
80 return -1;
81 #endif
82 }
83 #endif
84
85
86 lxc_log_define(lxc_container, lxc);
87
88 static bool do_lxcapi_destroy(struct lxc_container *c);
89 static const char *lxcapi_get_config_path(struct lxc_container *c);
90 #define do_lxcapi_get_config_path(c) lxcapi_get_config_path(c)
91 static bool do_lxcapi_set_config_item(struct lxc_container *c, const char *key, const char *v);
92 static bool container_destroy(struct lxc_container *c);
93 static bool get_snappath_dir(struct lxc_container *c, char *snappath);
94 static bool lxcapi_snapshot_destroy_all(struct lxc_container *c);
95 static bool do_lxcapi_save_config(struct lxc_container *c, const char *alt_file);
96
97 static bool config_file_exists(const char *lxcpath, const char *cname)
98 {
99 /* $lxcpath + '/' + $cname + '/config' + \0 */
100 int ret, len = strlen(lxcpath) + strlen(cname) + 9;
101 char *fname = alloca(len);
102
103 ret = snprintf(fname, len, "%s/%s/config", lxcpath, cname);
104 if (ret < 0 || ret >= len)
105 return false;
106
107 return file_exists(fname);
108 }
109
110 /*
111 * A few functions to help detect when a container creation failed.
112 * If a container creation was killed partway through, then trying
113 * to actually start that container could harm the host. We detect
114 * this by creating a 'partial' file under the container directory,
115 * and keeping an advisory lock. When container creation completes,
116 * we remove that file. When we load or try to start a container, if
117 * we find that file, without a flock, we remove the container.
118 */
119 static int ongoing_create(struct lxc_container *c)
120 {
121 int len = strlen(c->config_path) + strlen(c->name) + 10;
122 char *path = alloca(len);
123 int fd, ret;
124 struct flock lk;
125
126 ret = snprintf(path, len, "%s/%s/partial", c->config_path, c->name);
127 if (ret < 0 || ret >= len) {
128 ERROR("Error writing partial pathname");
129 return -1;
130 }
131
132 if (!file_exists(path))
133 return 0;
134 fd = open(path, O_RDWR);
135 if (fd < 0) {
136 // give benefit of the doubt
137 SYSERROR("Error opening partial file");
138 return 0;
139 }
140 lk.l_type = F_WRLCK;
141 lk.l_whence = SEEK_SET;
142 lk.l_start = 0;
143 lk.l_len = 0;
144 lk.l_pid = -1;
145 if (fcntl(fd, F_GETLK, &lk) == 0 && lk.l_pid != -1) {
146 // create is still ongoing
147 close(fd);
148 return 1;
149 }
150 // create completed but partial is still there.
151 close(fd);
152 return 2;
153 }
154
155 static int create_partial(struct lxc_container *c)
156 {
157 // $lxcpath + '/' + $name + '/partial' + \0
158 int len = strlen(c->config_path) + strlen(c->name) + 10;
159 char *path = alloca(len);
160 int fd, ret;
161 struct flock lk;
162
163 ret = snprintf(path, len, "%s/%s/partial", c->config_path, c->name);
164 if (ret < 0 || ret >= len) {
165 ERROR("Error writing partial pathname");
166 return -1;
167 }
168 if ((fd=open(path, O_RDWR | O_CREAT | O_EXCL, 0755)) < 0) {
169 SYSERROR("Erorr creating partial file");
170 return -1;
171 }
172 lk.l_type = F_WRLCK;
173 lk.l_whence = SEEK_SET;
174 lk.l_start = 0;
175 lk.l_len = 0;
176 if (fcntl(fd, F_SETLKW, &lk) < 0) {
177 SYSERROR("Error locking partial file %s", path);
178 close(fd);
179 return -1;
180 }
181
182 return fd;
183 }
184
185 static void remove_partial(struct lxc_container *c, int fd)
186 {
187 // $lxcpath + '/' + $name + '/partial' + \0
188 int len = strlen(c->config_path) + strlen(c->name) + 10;
189 char *path = alloca(len);
190 int ret;
191
192 close(fd);
193 ret = snprintf(path, len, "%s/%s/partial", c->config_path, c->name);
194 if (ret < 0 || ret >= len) {
195 ERROR("Error writing partial pathname");
196 return;
197 }
198 if (unlink(path) < 0)
199 SYSERROR("Error unlink partial file %s", path);
200 }
201
202 /* LOCKING
203 * 1. container_mem_lock(c) protects the struct lxc_container from multiple threads.
204 * 2. container_disk_lock(c) protects the on-disk container data - in particular the
205 * container configuration file.
206 * The container_disk_lock also takes the container_mem_lock.
207 * 3. thread_mutex protects process data (ex: fd table) from multiple threads.
208 * NOTHING mutexes two independent programs with their own struct
209 * lxc_container for the same c->name, between API calls. For instance,
210 * c->config_read(); c->start(); Between those calls, data on disk
211 * could change (which shouldn't bother the caller unless for instance
212 * the rootfs get moved). c->config_read(); update; c->config_write();
213 * Two such updaters could race. The callers should therefore check their
214 * results. Trying to prevent that would necessarily expose us to deadlocks
215 * due to hung callers. So I prefer to keep the locks only within our own
216 * functions, not across functions.
217 *
218 * If you're going to clone while holding a lxccontainer, increment
219 * c->numthreads (under privlock) before forking. When deleting,
220 * decrement numthreads under privlock, then if it hits 0 you can delete.
221 * Do not ever use a lxccontainer whose numthreads you did not bump.
222 */
223
224 static void lxc_container_free(struct lxc_container *c)
225 {
226 if (!c)
227 return;
228
229 free(c->configfile);
230 c->configfile = NULL;
231 free(c->error_string);
232 c->error_string = NULL;
233 if (c->slock) {
234 lxc_putlock(c->slock);
235 c->slock = NULL;
236 }
237 if (c->privlock) {
238 lxc_putlock(c->privlock);
239 c->privlock = NULL;
240 }
241 free(c->name);
242 c->name = NULL;
243 if (c->lxc_conf) {
244 lxc_conf_free(c->lxc_conf);
245 c->lxc_conf = NULL;
246 }
247 free(c->config_path);
248 c->config_path = NULL;
249
250 free(c);
251 }
252
253 /*
254 * Consider the following case:
255 freer | racing get()er
256 ==================================================================
257 lxc_container_put() | lxc_container_get()
258 \ lxclock(c->privlock) | c->numthreads < 1? (no)
259 \ c->numthreads = 0 | \ lxclock(c->privlock) -> waits
260 \ lxcunlock() | \
261 \ lxc_container_free() | \ lxclock() returns
262 | \ c->numthreads < 1 -> return 0
263 \ \ (free stuff) |
264 \ \ sem_destroy(privlock) |
265
266 * When the get()er checks numthreads the first time, one of the following
267 * is true:
268 * 1. freer has set numthreads = 0. get() returns 0
269 * 2. freer is between lxclock and setting numthreads to 0. get()er will
270 * sem_wait on privlock, get lxclock after freer() drops it, then see
271 * numthreads is 0 and exit without touching lxclock again..
272 * 3. freer has not yet locked privlock. If get()er runs first, then put()er
273 * will see --numthreads = 1 and not call lxc_container_free().
274 */
275
276 int lxc_container_get(struct lxc_container *c)
277 {
278 if (!c)
279 return 0;
280
281 // if someone else has already started freeing the container, don't
282 // try to take the lock, which may be invalid
283 if (c->numthreads < 1)
284 return 0;
285
286 if (container_mem_lock(c))
287 return 0;
288 if (c->numthreads < 1) {
289 // bail without trying to unlock, bc the privlock is now probably
290 // in freed memory
291 return 0;
292 }
293 c->numthreads++;
294 container_mem_unlock(c);
295 return 1;
296 }
297
298 int lxc_container_put(struct lxc_container *c)
299 {
300 if (!c)
301 return -1;
302 if (container_mem_lock(c))
303 return -1;
304 if (--c->numthreads < 1) {
305 container_mem_unlock(c);
306 lxc_container_free(c);
307 return 1;
308 }
309 container_mem_unlock(c);
310 return 0;
311 }
312
313 static bool do_lxcapi_is_defined(struct lxc_container *c)
314 {
315 struct stat statbuf;
316 bool ret = false;
317 int statret;
318
319 if (!c)
320 return false;
321
322 if (container_mem_lock(c))
323 return false;
324 if (!c->configfile)
325 goto out;
326 statret = stat(c->configfile, &statbuf);
327 if (statret != 0)
328 goto out;
329 ret = true;
330
331 out:
332 container_mem_unlock(c);
333 return ret;
334 }
335
336 #define WRAP_API(rettype, fnname) \
337 static rettype fnname(struct lxc_container *c) \
338 { \
339 rettype ret; \
340 struct lxc_conf *old = current_config; \
341 current_config = c ? c->lxc_conf : NULL; \
342 ret = do_##fnname(c); \
343 current_config = old; \
344 return ret; \
345 }
346
347 #define WRAP_API_1(rettype, fnname, t1) \
348 static rettype fnname(struct lxc_container *c, t1 a1) \
349 { \
350 rettype ret; \
351 struct lxc_conf *old = current_config; \
352 current_config = c ? c->lxc_conf : NULL; \
353 ret = do_##fnname(c, a1); \
354 current_config = old; \
355 return ret; \
356 }
357
358 #define WRAP_API_2(rettype, fnname, t1, t2) \
359 static rettype fnname(struct lxc_container *c, t1 a1, t2 a2) \
360 { \
361 rettype ret; \
362 struct lxc_conf *old = current_config; \
363 current_config = c ? c->lxc_conf : NULL; \
364 ret = do_##fnname(c, a1, a2); \
365 current_config = old; \
366 return ret; \
367 }
368
369 #define WRAP_API_3(rettype, fnname, t1, t2, t3) \
370 static rettype fnname(struct lxc_container *c, t1 a1, t2 a2, t3 a3) \
371 { \
372 rettype ret; \
373 struct lxc_conf *old = current_config; \
374 current_config = c ? c->lxc_conf : NULL; \
375 ret = do_##fnname(c, a1, a2, a3); \
376 current_config = old; \
377 return ret; \
378 }
379
380 WRAP_API(bool, lxcapi_is_defined)
381
382 static const char *do_lxcapi_state(struct lxc_container *c)
383 {
384 lxc_state_t s;
385
386 if (!c)
387 return NULL;
388 s = lxc_getstate(c->name, c->config_path);
389 return lxc_state2str(s);
390 }
391
392 WRAP_API(const char *, lxcapi_state)
393
394 static bool is_stopped(struct lxc_container *c)
395 {
396 lxc_state_t s;
397 s = lxc_getstate(c->name, c->config_path);
398 return (s == STOPPED);
399 }
400
401 static bool do_lxcapi_is_running(struct lxc_container *c)
402 {
403 const char *s;
404
405 if (!c)
406 return false;
407 s = do_lxcapi_state(c);
408 if (!s || strcmp(s, "STOPPED") == 0)
409 return false;
410 return true;
411 }
412
413 WRAP_API(bool, lxcapi_is_running)
414
415 static bool do_lxcapi_freeze(struct lxc_container *c)
416 {
417 int ret;
418 if (!c)
419 return false;
420
421 ret = lxc_freeze(c->name, c->config_path);
422 if (ret)
423 return false;
424 return true;
425 }
426
427 WRAP_API(bool, lxcapi_freeze)
428
429 static bool do_lxcapi_unfreeze(struct lxc_container *c)
430 {
431 int ret;
432 if (!c)
433 return false;
434
435 ret = lxc_unfreeze(c->name, c->config_path);
436 if (ret)
437 return false;
438 return true;
439 }
440
441 WRAP_API(bool, lxcapi_unfreeze)
442
443 static int do_lxcapi_console_getfd(struct lxc_container *c, int *ttynum, int *masterfd)
444 {
445 int ttyfd;
446 if (!c)
447 return -1;
448
449 ttyfd = lxc_console_getfd(c, ttynum, masterfd);
450 return ttyfd;
451 }
452
453 WRAP_API_2(int, lxcapi_console_getfd, int *, int *)
454
455 static int lxcapi_console(struct lxc_container *c, int ttynum, int stdinfd,
456 int stdoutfd, int stderrfd, int escape)
457 {
458 int ret;
459 struct lxc_conf *old = current_config;
460 current_config = c ? c->lxc_conf : NULL;
461 ret = lxc_console(c, ttynum, stdinfd, stdoutfd, stderrfd, escape);
462 current_config = old;
463 return ret;
464 }
465
466 static pid_t do_lxcapi_init_pid(struct lxc_container *c)
467 {
468 if (!c)
469 return -1;
470
471 return lxc_cmd_get_init_pid(c->name, c->config_path);
472 }
473
474 WRAP_API(pid_t, lxcapi_init_pid)
475
476 static bool load_config_locked(struct lxc_container *c, const char *fname)
477 {
478 if (!c->lxc_conf)
479 c->lxc_conf = lxc_conf_init();
480 if (!c->lxc_conf)
481 return false;
482 if (lxc_config_read(fname, c->lxc_conf, false) != 0)
483 return false;
484 return true;
485 }
486
487 static bool do_lxcapi_load_config(struct lxc_container *c, const char *alt_file)
488 {
489 bool ret = false, need_disklock = false;
490 int lret;
491 const char *fname;
492 if (!c)
493 return false;
494
495 fname = c->configfile;
496 if (alt_file)
497 fname = alt_file;
498 if (!fname)
499 return false;
500 /*
501 * If we're reading something other than the container's config,
502 * we only need to lock the in-memory container. If loading the
503 * container's config file, take the disk lock.
504 */
505 if (strcmp(fname, c->configfile) == 0)
506 need_disklock = true;
507
508 if (need_disklock)
509 lret = container_disk_lock(c);
510 else
511 lret = container_mem_lock(c);
512 if (lret)
513 return false;
514
515 ret = load_config_locked(c, fname);
516
517 if (need_disklock)
518 container_disk_unlock(c);
519 else
520 container_mem_unlock(c);
521 return ret;
522 }
523
524 WRAP_API_1(bool, lxcapi_load_config, const char *)
525
526 static bool do_lxcapi_want_daemonize(struct lxc_container *c, bool state)
527 {
528 if (!c || !c->lxc_conf)
529 return false;
530 if (container_mem_lock(c)) {
531 ERROR("Error getting mem lock");
532 return false;
533 }
534 c->daemonize = state;
535 container_mem_unlock(c);
536 return true;
537 }
538
539 WRAP_API_1(bool, lxcapi_want_daemonize, bool)
540
541 static bool do_lxcapi_want_close_all_fds(struct lxc_container *c, bool state)
542 {
543 if (!c || !c->lxc_conf)
544 return false;
545 if (container_mem_lock(c)) {
546 ERROR("Error getting mem lock");
547 return false;
548 }
549 c->lxc_conf->close_all_fds = state;
550 container_mem_unlock(c);
551 return true;
552 }
553
554 WRAP_API_1(bool, lxcapi_want_close_all_fds, bool)
555
556 static bool do_lxcapi_wait(struct lxc_container *c, const char *state, int timeout)
557 {
558 int ret;
559
560 if (!c)
561 return false;
562
563 ret = lxc_wait(c->name, state, timeout, c->config_path);
564 return ret == 0;
565 }
566
567 WRAP_API_2(bool, lxcapi_wait, const char *, int)
568
569 static bool do_wait_on_daemonized_start(struct lxc_container *c, int pid)
570 {
571 /* we'll probably want to make this timeout configurable? */
572 int timeout = 5, ret, status;
573
574 /*
575 * our child is going to fork again, then exit. reap the
576 * child
577 */
578 ret = waitpid(pid, &status, 0);
579 if (ret == -1 || !WIFEXITED(status) || WEXITSTATUS(status) != 0)
580 DEBUG("failed waiting for first dual-fork child");
581 return do_lxcapi_wait(c, "RUNNING", timeout);
582 }
583
584 WRAP_API_1(bool, wait_on_daemonized_start, int)
585
586 static bool am_single_threaded(void)
587 {
588 struct dirent dirent, *direntp;
589 DIR *dir;
590 int count=0;
591
592 dir = opendir("/proc/self/task");
593 if (!dir) {
594 INFO("failed to open /proc/self/task");
595 return false;
596 }
597
598 while (!readdir_r(dir, &dirent, &direntp)) {
599 if (!direntp)
600 break;
601
602 if (!strcmp(direntp->d_name, "."))
603 continue;
604
605 if (!strcmp(direntp->d_name, ".."))
606 continue;
607 if (++count > 1)
608 break;
609 }
610 closedir(dir);
611 return count == 1;
612 }
613
614 /*
615 * I can't decide if it'd be more convenient for callers if we accept '...',
616 * or a null-terminated array (i.e. execl vs execv)
617 */
618 static bool do_lxcapi_start(struct lxc_container *c, int useinit, char * const argv[])
619 {
620 int ret;
621 struct lxc_conf *conf;
622 bool daemonize = false;
623 FILE *pid_fp = NULL;
624 char *default_args[] = {
625 "/sbin/init",
626 NULL,
627 };
628 char *init_cmd[2];
629
630 /* container exists */
631 if (!c)
632 return false;
633 /* container has been setup */
634 if (!c->lxc_conf)
635 return false;
636
637 if ((ret = ongoing_create(c)) < 0) {
638 ERROR("Error checking for incomplete creation");
639 return false;
640 }
641 if (ret == 2) {
642 ERROR("Error: %s creation was not completed", c->name);
643 do_lxcapi_destroy(c);
644 return false;
645 } else if (ret == 1) {
646 ERROR("Error: creation of %s is ongoing", c->name);
647 return false;
648 }
649
650 /* is this app meant to be run through lxcinit, as in lxc-execute? */
651 if (useinit && !argv)
652 return false;
653
654 if (container_mem_lock(c))
655 return false;
656 conf = c->lxc_conf;
657 daemonize = c->daemonize;
658 container_mem_unlock(c);
659
660 if (useinit) {
661 ret = lxc_execute(c->name, argv, 1, conf, c->config_path);
662 return ret == 0 ? true : false;
663 }
664
665 if (!argv) {
666 if (conf->init_cmd) {
667 init_cmd[0] = conf->init_cmd;
668 init_cmd[1] = NULL;
669 argv = init_cmd;
670 }
671 else
672 argv = default_args;
673 }
674
675 /*
676 * say, I'm not sure - what locks do we want here? Any?
677 * Is liblxc's locking enough here to protect the on disk
678 * container? We don't want to exclude things like lxc_info
679 * while container is running...
680 */
681 if (daemonize) {
682 char title[2048];
683 lxc_monitord_spawn(c->config_path);
684
685 pid_t pid = fork();
686 if (pid < 0)
687 return false;
688
689 if (pid != 0) {
690 /* Set to NULL because we don't want father unlink
691 * the PID file, child will do the free and unlink.
692 */
693 c->pidfile = NULL;
694 return wait_on_daemonized_start(c, pid);
695 }
696
697 /* We don't really care if this doesn't print all the
698 * characters; all that it means is that the proctitle will be
699 * ugly. Similarly, we also don't care if setproctitle()
700 * fails. */
701 snprintf(title, sizeof(title), "[lxc monitor] %s %s", c->config_path, c->name);
702 INFO("Attempting to set proc title to %s", title);
703 setproctitle(title);
704
705 /* second fork to be reparented by init */
706 pid = fork();
707 if (pid < 0) {
708 SYSERROR("Error doing dual-fork");
709 return false;
710 }
711 if (pid != 0)
712 exit(0);
713 /* like daemon(), chdir to / and redirect 0,1,2 to /dev/null */
714 if (chdir("/")) {
715 SYSERROR("Error chdir()ing to /.");
716 return false;
717 }
718 lxc_check_inherited(conf, true, -1);
719 close(0);
720 close(1);
721 close(2);
722 open("/dev/zero", O_RDONLY);
723 open("/dev/null", O_RDWR);
724 open("/dev/null", O_RDWR);
725 setsid();
726 } else {
727 if (!am_single_threaded()) {
728 ERROR("Cannot start non-daemonized container when threaded");
729 return false;
730 }
731 }
732
733 /* We need to write PID file after daeminize, so we always
734 * write the right PID.
735 */
736 if (c->pidfile) {
737 pid_fp = fopen(c->pidfile, "w");
738 if (pid_fp == NULL) {
739 SYSERROR("Failed to create pidfile '%s' for '%s'",
740 c->pidfile, c->name);
741 return false;
742 }
743
744 if (fprintf(pid_fp, "%d\n", getpid()) < 0) {
745 SYSERROR("Failed to write '%s'", c->pidfile);
746 fclose(pid_fp);
747 pid_fp = NULL;
748 return false;
749 }
750
751 fclose(pid_fp);
752 pid_fp = NULL;
753 }
754
755 reboot:
756 conf->reboot = 0;
757
758 if (lxc_check_inherited(conf, daemonize, -1)) {
759 ERROR("Inherited fds found");
760 ret = 1;
761 goto out;
762 }
763
764 ret = lxc_start(c->name, argv, conf, c->config_path);
765 c->error_num = ret;
766
767 if (conf->reboot) {
768 INFO("container requested reboot");
769 conf->reboot = 0;
770 goto reboot;
771 }
772
773 out:
774 if (c->pidfile) {
775 unlink(c->pidfile);
776 free(c->pidfile);
777 c->pidfile = NULL;
778 }
779
780 if (daemonize)
781 exit (ret == 0 ? true : false);
782 else
783 return (ret == 0 ? true : false);
784 }
785
786 static bool lxcapi_start(struct lxc_container *c, int useinit, char * const argv[])
787 {
788 bool ret;
789 struct lxc_conf *old = current_config;
790 current_config = c ? c->lxc_conf : NULL;
791 ret = do_lxcapi_start(c, useinit, argv);
792 current_config = old;
793 return ret;
794 }
795
796 /*
797 * note there MUST be an ending NULL
798 */
799 static bool lxcapi_startl(struct lxc_container *c, int useinit, ...)
800 {
801 va_list ap;
802 char **inargs = NULL;
803 bool bret = false;
804
805 /* container exists */
806 if (!c)
807 return false;
808
809 struct lxc_conf *old = current_config;
810 current_config = c->lxc_conf;
811
812 va_start(ap, useinit);
813 inargs = lxc_va_arg_list_to_argv(ap, 0, 1);
814 va_end(ap);
815
816 if (!inargs) {
817 ERROR("Memory allocation error.");
818 goto out;
819 }
820
821 /* pass NULL if no arguments were supplied */
822 bret = do_lxcapi_start(c, useinit, *inargs ? inargs : NULL);
823
824 out:
825 if (inargs) {
826 char **arg;
827 for (arg = inargs; *arg; arg++)
828 free(*arg);
829 free(inargs);
830 }
831
832 current_config = old;
833 return bret;
834 }
835
836 static bool do_lxcapi_stop(struct lxc_container *c)
837 {
838 int ret;
839
840 if (!c)
841 return false;
842
843 ret = lxc_cmd_stop(c->name, c->config_path);
844
845 return ret == 0;
846 }
847
848 WRAP_API(bool, lxcapi_stop)
849
850 static int do_create_container_dir(const char *path, struct lxc_conf *conf)
851 {
852 int ret = -1, lasterr;
853 char *p = alloca(strlen(path)+1);
854 mode_t mask = umask(0002);
855 ret = mkdir(path, 0770);
856 lasterr = errno;
857 umask(mask);
858 errno = lasterr;
859 if (ret) {
860 if (errno == EEXIST)
861 ret = 0;
862 else {
863 SYSERROR("failed to create container path %s", path);
864 return -1;
865 }
866 }
867 strcpy(p, path);
868 if (!lxc_list_empty(&conf->id_map) && chown_mapped_root(p, conf) != 0) {
869 ERROR("Failed to chown container dir");
870 ret = -1;
871 }
872 return ret;
873 }
874
875 /*
876 * create the standard expected container dir
877 */
878 static bool create_container_dir(struct lxc_container *c)
879 {
880 char *s;
881 int len, ret;
882
883 len = strlen(c->config_path) + strlen(c->name) + 2;
884 s = malloc(len);
885 if (!s)
886 return false;
887 ret = snprintf(s, len, "%s/%s", c->config_path, c->name);
888 if (ret < 0 || ret >= len) {
889 free(s);
890 return false;
891 }
892 ret = do_create_container_dir(s, c->lxc_conf);
893 free(s);
894 return ret == 0;
895 }
896
897 /*
898 * do_bdev_create: thin wrapper around bdev_create(). Like bdev_create(),
899 * it returns a mounted bdev on success, NULL on error.
900 */
901 static struct bdev *do_bdev_create(struct lxc_container *c, const char *type,
902 struct bdev_specs *specs)
903 {
904 char *dest;
905 size_t len;
906 struct bdev *bdev;
907 int ret;
908
909 /* rootfs.path or lxcpath/lxcname/rootfs */
910 if (c->lxc_conf->rootfs.path && access(c->lxc_conf->rootfs.path, F_OK) == 0) {
911 const char *rpath = c->lxc_conf->rootfs.path;
912 len = strlen(rpath) + 1;
913 dest = alloca(len);
914 ret = snprintf(dest, len, "%s", rpath);
915 } else {
916 const char *lxcpath = do_lxcapi_get_config_path(c);
917 len = strlen(c->name) + strlen(lxcpath) + 9;
918 dest = alloca(len);
919 ret = snprintf(dest, len, "%s/%s/rootfs", lxcpath, c->name);
920 }
921 if (ret < 0 || ret >= len)
922 return NULL;
923
924 bdev = bdev_create(dest, type, c->name, specs);
925 if (!bdev) {
926 ERROR("Failed to create backing store type %s", type);
927 return NULL;
928 }
929
930 do_lxcapi_set_config_item(c, "lxc.rootfs", bdev->src);
931
932 /* if we are not root, chown the rootfs dir to root in the
933 * target uidmap */
934
935 if (geteuid() != 0 || (c->lxc_conf && !lxc_list_empty(&c->lxc_conf->id_map))) {
936 if (chown_mapped_root(bdev->dest, c->lxc_conf) < 0) {
937 ERROR("Error chowning %s to container root", bdev->dest);
938 suggest_default_idmap();
939 bdev_put(bdev);
940 return NULL;
941 }
942 }
943
944 return bdev;
945 }
946
947 static char *lxcbasename(char *path)
948 {
949 char *p = path + strlen(path) - 1;
950 while (*p != '/' && p > path)
951 p--;
952 return p;
953 }
954
955 static bool create_run_template(struct lxc_container *c, char *tpath, bool quiet,
956 char *const argv[])
957 {
958 pid_t pid;
959
960 if (!tpath)
961 return true;
962
963 pid = fork();
964 if (pid < 0) {
965 SYSERROR("failed to fork task for container creation template");
966 return false;
967 }
968
969 if (pid == 0) { // child
970 char *patharg, *namearg, *rootfsarg, *src;
971 struct bdev *bdev = NULL;
972 int i;
973 int ret, len, nargs = 0;
974 char **newargv;
975 struct lxc_conf *conf = c->lxc_conf;
976
977 if (quiet) {
978 close(0);
979 close(1);
980 close(2);
981 open("/dev/zero", O_RDONLY);
982 open("/dev/null", O_RDWR);
983 open("/dev/null", O_RDWR);
984 }
985
986 src = c->lxc_conf->rootfs.path;
987 /*
988 * for an overlay create, what the user wants is the template to fill
989 * in what will become the readonly lower layer. So don't mount for
990 * the template
991 */
992 if (strncmp(src, "overlayfs:", 10) == 0)
993 src = overlay_getlower(src+10);
994 if (strncmp(src, "aufs:", 5) == 0)
995 src = overlay_getlower(src+5);
996
997 bdev = bdev_init(c->lxc_conf, src, c->lxc_conf->rootfs.mount, NULL);
998 if (!bdev) {
999 ERROR("Error opening rootfs");
1000 exit(1);
1001 }
1002
1003 if (geteuid() == 0) {
1004 if (unshare(CLONE_NEWNS) < 0) {
1005 ERROR("error unsharing mounts");
1006 exit(1);
1007 }
1008 if (detect_shared_rootfs()) {
1009 if (mount(NULL, "/", NULL, MS_SLAVE|MS_REC, NULL)) {
1010 SYSERROR("Failed to make / rslave to run template");
1011 ERROR("Continuing...");
1012 }
1013 }
1014 }
1015 if (strcmp(bdev->type, "dir") && strcmp(bdev->type, "btrfs")) {
1016 if (geteuid() != 0) {
1017 ERROR("non-root users can only create btrfs and directory-backed containers");
1018 exit(1);
1019 }
1020 if (bdev->ops->mount(bdev) < 0) {
1021 ERROR("Error mounting rootfs");
1022 exit(1);
1023 }
1024 } else { // TODO come up with a better way here!
1025 free(bdev->dest);
1026 bdev->dest = strdup(bdev->src);
1027 }
1028
1029 /*
1030 * create our new array, pre-pend the template name and
1031 * base args
1032 */
1033 if (argv)
1034 for (nargs = 0; argv[nargs]; nargs++) ;
1035 nargs += 4; // template, path, rootfs and name args
1036
1037 newargv = malloc(nargs * sizeof(*newargv));
1038 if (!newargv)
1039 exit(1);
1040 newargv[0] = lxcbasename(tpath);
1041
1042 len = strlen(c->config_path) + strlen(c->name) + strlen("--path=") + 2;
1043 patharg = malloc(len);
1044 if (!patharg)
1045 exit(1);
1046 ret = snprintf(patharg, len, "--path=%s/%s", c->config_path, c->name);
1047 if (ret < 0 || ret >= len)
1048 exit(1);
1049 newargv[1] = patharg;
1050 len = strlen("--name=") + strlen(c->name) + 1;
1051 namearg = malloc(len);
1052 if (!namearg)
1053 exit(1);
1054 ret = snprintf(namearg, len, "--name=%s", c->name);
1055 if (ret < 0 || ret >= len)
1056 exit(1);
1057 newargv[2] = namearg;
1058
1059 len = strlen("--rootfs=") + 1 + strlen(bdev->dest);
1060 rootfsarg = malloc(len);
1061 if (!rootfsarg)
1062 exit(1);
1063 ret = snprintf(rootfsarg, len, "--rootfs=%s", bdev->dest);
1064 if (ret < 0 || ret >= len)
1065 exit(1);
1066 newargv[3] = rootfsarg;
1067
1068 /* add passed-in args */
1069 if (argv)
1070 for (i = 4; i < nargs; i++)
1071 newargv[i] = argv[i-4];
1072
1073 /* add trailing NULL */
1074 nargs++;
1075 newargv = realloc(newargv, nargs * sizeof(*newargv));
1076 if (!newargv)
1077 exit(1);
1078 newargv[nargs - 1] = NULL;
1079
1080 /*
1081 * If we're running the template in a mapped userns, then
1082 * we prepend the template command with:
1083 * lxc-usernsexec <-m map1> ... <-m mapn> --
1084 * and we append "--mapped-uid x", where x is the mapped uid
1085 * for our geteuid()
1086 */
1087 if (!lxc_list_empty(&conf->id_map)) {
1088 int n2args = 1;
1089 char txtuid[20];
1090 char txtgid[20];
1091 char **n2 = malloc(n2args * sizeof(*n2));
1092 struct lxc_list *it;
1093 struct id_map *map;
1094
1095 if (!n2) {
1096 SYSERROR("out of memory");
1097 exit(1);
1098 }
1099 newargv[0] = tpath;
1100 tpath = "lxc-usernsexec";
1101 n2[0] = "lxc-usernsexec";
1102 lxc_list_for_each(it, &conf->id_map) {
1103 map = it->elem;
1104 n2args += 2;
1105 n2 = realloc(n2, n2args * sizeof(char *));
1106 if (!n2)
1107 exit(1);
1108 n2[n2args-2] = "-m";
1109 n2[n2args-1] = malloc(200);
1110 if (!n2[n2args-1])
1111 exit(1);
1112 ret = snprintf(n2[n2args-1], 200, "%c:%lu:%lu:%lu",
1113 map->idtype == ID_TYPE_UID ? 'u' : 'g',
1114 map->nsid, map->hostid, map->range);
1115 if (ret < 0 || ret >= 200)
1116 exit(1);
1117 }
1118 int hostid_mapped = mapped_hostid(geteuid(), conf, ID_TYPE_UID);
1119 int extraargs = hostid_mapped >= 0 ? 1 : 3;
1120 n2 = realloc(n2, (nargs + n2args + extraargs) * sizeof(char *));
1121 if (!n2)
1122 exit(1);
1123 if (hostid_mapped < 0) {
1124 hostid_mapped = find_unmapped_nsuid(conf, ID_TYPE_UID);
1125 n2[n2args++] = "-m";
1126 if (hostid_mapped < 0) {
1127 ERROR("Could not find free uid to map");
1128 exit(1);
1129 }
1130 n2[n2args++] = malloc(200);
1131 if (!n2[n2args-1]) {
1132 SYSERROR("out of memory");
1133 exit(1);
1134 }
1135 ret = snprintf(n2[n2args-1], 200, "u:%d:%d:1",
1136 hostid_mapped, geteuid());
1137 if (ret < 0 || ret >= 200) {
1138 ERROR("string too long");
1139 exit(1);
1140 }
1141 }
1142 int hostgid_mapped = mapped_hostid(getegid(), conf, ID_TYPE_GID);
1143 extraargs = hostgid_mapped >= 0 ? 1 : 3;
1144 n2 = realloc(n2, (nargs + n2args + extraargs) * sizeof(char *));
1145 if (!n2)
1146 exit(1);
1147 if (hostgid_mapped < 0) {
1148 hostgid_mapped = find_unmapped_nsuid(conf, ID_TYPE_GID);
1149 n2[n2args++] = "-m";
1150 if (hostgid_mapped < 0) {
1151 ERROR("Could not find free uid to map");
1152 exit(1);
1153 }
1154 n2[n2args++] = malloc(200);
1155 if (!n2[n2args-1]) {
1156 SYSERROR("out of memory");
1157 exit(1);
1158 }
1159 ret = snprintf(n2[n2args-1], 200, "g:%d:%d:1",
1160 hostgid_mapped, getegid());
1161 if (ret < 0 || ret >= 200) {
1162 ERROR("string too long");
1163 exit(1);
1164 }
1165 }
1166 n2[n2args++] = "--";
1167 for (i = 0; i < nargs; i++)
1168 n2[i + n2args] = newargv[i];
1169 n2args += nargs;
1170 // Finally add "--mapped-uid $uid" to tell template what to chown
1171 // cached images to
1172 n2args += 4;
1173 n2 = realloc(n2, n2args * sizeof(char *));
1174 if (!n2) {
1175 SYSERROR("out of memory");
1176 exit(1);
1177 }
1178 // note n2[n2args-1] is NULL
1179 n2[n2args-5] = "--mapped-uid";
1180 snprintf(txtuid, 20, "%d", hostid_mapped);
1181 n2[n2args-4] = txtuid;
1182 n2[n2args-3] = "--mapped-gid";
1183 snprintf(txtgid, 20, "%d", hostgid_mapped);
1184 n2[n2args-2] = txtgid;
1185 n2[n2args-1] = NULL;
1186 free(newargv);
1187 newargv = n2;
1188 }
1189 /* execute */
1190 execvp(tpath, newargv);
1191 SYSERROR("failed to execute template %s", tpath);
1192 exit(1);
1193 }
1194
1195 if (wait_for_pid(pid) != 0) {
1196 ERROR("container creation template for %s failed", c->name);
1197 return false;
1198 }
1199
1200 return true;
1201 }
1202
1203 static bool prepend_lxc_header(char *path, const char *t, char *const argv[])
1204 {
1205 long flen;
1206 char *contents;
1207 FILE *f;
1208 int ret = -1;
1209 #if HAVE_LIBGNUTLS
1210 int i;
1211 unsigned char md_value[SHA_DIGEST_LENGTH];
1212 char *tpath;
1213 #endif
1214
1215 f = fopen(path, "r");
1216 if (f == NULL)
1217 return false;
1218
1219 if (fseek(f, 0, SEEK_END) < 0)
1220 goto out_error;
1221 if ((flen = ftell(f)) < 0)
1222 goto out_error;
1223 if (fseek(f, 0, SEEK_SET) < 0)
1224 goto out_error;
1225 if ((contents = malloc(flen + 1)) == NULL)
1226 goto out_error;
1227 if (fread(contents, 1, flen, f) != flen)
1228 goto out_free_contents;
1229
1230 contents[flen] = '\0';
1231 ret = fclose(f);
1232 f = NULL;
1233 if (ret < 0)
1234 goto out_free_contents;
1235
1236 #if HAVE_LIBGNUTLS
1237 tpath = get_template_path(t);
1238 if (!tpath) {
1239 ERROR("bad template: %s", t);
1240 goto out_free_contents;
1241 }
1242
1243 ret = sha1sum_file(tpath, md_value);
1244 if (ret < 0) {
1245 ERROR("Error getting sha1sum of %s", tpath);
1246 free(tpath);
1247 goto out_free_contents;
1248 }
1249 free(tpath);
1250 #endif
1251
1252 f = fopen(path, "w");
1253 if (f == NULL) {
1254 SYSERROR("reopening config for writing");
1255 free(contents);
1256 return false;
1257 }
1258 fprintf(f, "# Template used to create this container: %s\n", t);
1259 if (argv) {
1260 fprintf(f, "# Parameters passed to the template:");
1261 while (*argv) {
1262 fprintf(f, " %s", *argv);
1263 argv++;
1264 }
1265 fprintf(f, "\n");
1266 }
1267 #if HAVE_LIBGNUTLS
1268 fprintf(f, "# Template script checksum (SHA-1): ");
1269 for (i=0; i<SHA_DIGEST_LENGTH; i++)
1270 fprintf(f, "%02x", md_value[i]);
1271 fprintf(f, "\n");
1272 #endif
1273 fprintf(f, "# For additional config options, please look at lxc.container.conf(5)\n");
1274 if (fwrite(contents, 1, flen, f) != flen) {
1275 SYSERROR("Writing original contents");
1276 free(contents);
1277 fclose(f);
1278 return false;
1279 }
1280 ret = 0;
1281 out_free_contents:
1282 free(contents);
1283 out_error:
1284 if (f) {
1285 int newret;
1286 newret = fclose(f);
1287 if (ret == 0)
1288 ret = newret;
1289 }
1290 if (ret < 0) {
1291 SYSERROR("Error prepending header");
1292 return false;
1293 }
1294 return true;
1295 }
1296
1297 static void lxcapi_clear_config(struct lxc_container *c)
1298 {
1299 if (c) {
1300 if (c->lxc_conf) {
1301 lxc_conf_free(c->lxc_conf);
1302 c->lxc_conf = NULL;
1303 }
1304 }
1305 }
1306
1307 #define do_lxcapi_clear_config(c) lxcapi_clear_config(c)
1308
1309 /*
1310 * lxcapi_create:
1311 * create a container with the given parameters.
1312 * @c: container to be created. It has the lxcpath, name, and a starting
1313 * configuration already set
1314 * @t: the template to execute to instantiate the root filesystem and
1315 * adjust the configuration.
1316 * @bdevtype: backing store type to use. If NULL, dir will be used.
1317 * @specs: additional parameters for the backing store, i.e. LVM vg to
1318 * use.
1319 *
1320 * @argv: the arguments to pass to the template, terminated by NULL. If no
1321 * arguments, you can just pass NULL.
1322 */
1323 static bool do_lxcapi_create(struct lxc_container *c, const char *t,
1324 const char *bdevtype, struct bdev_specs *specs, int flags,
1325 char *const argv[])
1326 {
1327 bool ret = false;
1328 pid_t pid;
1329 char *tpath = NULL;
1330 int partial_fd;
1331
1332 if (!c)
1333 return false;
1334
1335 if (t) {
1336 tpath = get_template_path(t);
1337 if (!tpath) {
1338 ERROR("bad template: %s", t);
1339 goto out;
1340 }
1341 }
1342
1343 /*
1344 * If a template is passed in, and the rootfs already is defined in
1345 * the container config and exists, then * caller is trying to create
1346 * an existing container. Return an error, but do NOT delete the
1347 * container.
1348 */
1349 if (do_lxcapi_is_defined(c) && c->lxc_conf && c->lxc_conf->rootfs.path &&
1350 access(c->lxc_conf->rootfs.path, F_OK) == 0 && tpath) {
1351 ERROR("Container %s:%s already exists", c->config_path, c->name);
1352 goto free_tpath;
1353 }
1354
1355 if (!c->lxc_conf) {
1356 if (!do_lxcapi_load_config(c, lxc_global_config_value("lxc.default_config"))) {
1357 ERROR("Error loading default configuration file %s", lxc_global_config_value("lxc.default_config"));
1358 goto free_tpath;
1359 }
1360 }
1361
1362 if (!create_container_dir(c))
1363 goto free_tpath;
1364
1365 /*
1366 * either template or rootfs.path should be set.
1367 * if both template and rootfs.path are set, template is setup as rootfs.path.
1368 * container is already created if we have a config and rootfs.path is accessible
1369 */
1370 if (!c->lxc_conf->rootfs.path && !tpath)
1371 /* no template passed in and rootfs does not exist: error */
1372 goto out;
1373 if (c->lxc_conf->rootfs.path && access(c->lxc_conf->rootfs.path, F_OK) != 0)
1374 /* rootfs passed into configuration, but does not exist: error */
1375 goto out;
1376 if (do_lxcapi_is_defined(c) && c->lxc_conf->rootfs.path && !tpath) {
1377 /* Rootfs already existed, user just wanted to save the
1378 * loaded configuration */
1379 ret = true;
1380 goto out;
1381 }
1382
1383 /* Mark that this container is being created */
1384 if ((partial_fd = create_partial(c)) < 0)
1385 goto out;
1386
1387 /* no need to get disk lock bc we have the partial locked */
1388
1389 /*
1390 * Create the backing store
1391 * Note we can't do this in the same task as we use to execute the
1392 * template because of the way zfs works.
1393 * After you 'zfs create', zfs mounts the fs only in the initial
1394 * namespace.
1395 */
1396 pid = fork();
1397 if (pid < 0) {
1398 SYSERROR("failed to fork task for container creation template");
1399 goto out_unlock;
1400 }
1401
1402 if (pid == 0) { // child
1403 struct bdev *bdev = NULL;
1404
1405 if (!(bdev = do_bdev_create(c, bdevtype, specs))) {
1406 ERROR("Error creating backing store type %s for %s",
1407 bdevtype ? bdevtype : "(none)", c->name);
1408 exit(1);
1409 }
1410
1411 /* save config file again to store the new rootfs location */
1412 if (!do_lxcapi_save_config(c, NULL)) {
1413 ERROR("failed to save starting configuration for %s", c->name);
1414 // parent task won't see bdev in config so we delete it
1415 bdev->ops->umount(bdev);
1416 bdev->ops->destroy(bdev);
1417 exit(1);
1418 }
1419 exit(0);
1420 }
1421 if (wait_for_pid(pid) != 0)
1422 goto out_unlock;
1423
1424 /* reload config to get the rootfs */
1425 lxc_conf_free(c->lxc_conf);
1426 c->lxc_conf = NULL;
1427 if (!load_config_locked(c, c->configfile))
1428 goto out_unlock;
1429
1430 if (!create_run_template(c, tpath, !!(flags & LXC_CREATE_QUIET), argv))
1431 goto out_unlock;
1432
1433 // now clear out the lxc_conf we have, reload from the created
1434 // container
1435 do_lxcapi_clear_config(c);
1436
1437 if (t) {
1438 if (!prepend_lxc_header(c->configfile, tpath, argv)) {
1439 ERROR("Error prepending header to configuration file");
1440 goto out_unlock;
1441 }
1442 }
1443 ret = load_config_locked(c, c->configfile);
1444
1445 out_unlock:
1446 if (partial_fd >= 0)
1447 remove_partial(c, partial_fd);
1448 out:
1449 if (!ret)
1450 container_destroy(c);
1451 free_tpath:
1452 free(tpath);
1453 return ret;
1454 }
1455
1456 static bool lxcapi_create(struct lxc_container *c, const char *t,
1457 const char *bdevtype, struct bdev_specs *specs, int flags,
1458 char *const argv[])
1459 {
1460 bool ret;
1461 struct lxc_conf *old = current_config;
1462 current_config = c ? c->lxc_conf : NULL;
1463 ret = do_lxcapi_create(c, t, bdevtype, specs, flags, argv);
1464 current_config = old;
1465 return ret;
1466 }
1467
1468 static bool do_lxcapi_reboot(struct lxc_container *c)
1469 {
1470 pid_t pid;
1471 int rebootsignal = SIGINT;
1472
1473 if (!c)
1474 return false;
1475 if (!do_lxcapi_is_running(c))
1476 return false;
1477 pid = do_lxcapi_init_pid(c);
1478 if (pid <= 0)
1479 return false;
1480 if (c->lxc_conf && c->lxc_conf->rebootsignal)
1481 rebootsignal = c->lxc_conf->rebootsignal;
1482 if (kill(pid, rebootsignal) < 0)
1483 return false;
1484 return true;
1485
1486 }
1487
1488 WRAP_API(bool, lxcapi_reboot)
1489
1490 static bool do_lxcapi_shutdown(struct lxc_container *c, int timeout)
1491 {
1492 bool retv;
1493 pid_t pid;
1494 int haltsignal = SIGPWR;
1495
1496 if (!c)
1497 return false;
1498
1499 if (!do_lxcapi_is_running(c))
1500 return true;
1501 pid = do_lxcapi_init_pid(c);
1502 if (pid <= 0)
1503 return true;
1504 if (c->lxc_conf && c->lxc_conf->haltsignal)
1505 haltsignal = c->lxc_conf->haltsignal;
1506 kill(pid, haltsignal);
1507 retv = do_lxcapi_wait(c, "STOPPED", timeout);
1508 return retv;
1509 }
1510
1511 WRAP_API_1(bool, lxcapi_shutdown, int)
1512
1513 static bool lxcapi_createl(struct lxc_container *c, const char *t,
1514 const char *bdevtype, struct bdev_specs *specs, int flags, ...)
1515 {
1516 bool bret = false;
1517 char **args = NULL;
1518 va_list ap;
1519
1520 if (!c)
1521 return false;
1522
1523 struct lxc_conf *old = current_config;
1524 current_config = c ? c->lxc_conf : NULL;
1525
1526 /*
1527 * since we're going to wait for create to finish, I don't think we
1528 * need to get a copy of the arguments.
1529 */
1530 va_start(ap, flags);
1531 args = lxc_va_arg_list_to_argv(ap, 0, 0);
1532 va_end(ap);
1533 if (!args) {
1534 ERROR("Memory allocation error.");
1535 goto out;
1536 }
1537
1538 bret = do_lxcapi_create(c, t, bdevtype, specs, flags, args);
1539
1540 out:
1541 free(args);
1542 current_config = old;
1543 return bret;
1544 }
1545
1546 static void do_clear_unexp_config_line(struct lxc_conf *conf, const char *key)
1547 {
1548 if (strcmp(key, "lxc.cgroup") == 0)
1549 clear_unexp_config_line(conf, key, true);
1550 else if (strcmp(key, "lxc.network") == 0)
1551 clear_unexp_config_line(conf, key, true);
1552 else if (strcmp(key, "lxc.hook") == 0)
1553 clear_unexp_config_line(conf, key, true);
1554 else
1555 clear_unexp_config_line(conf, key, false);
1556 if (!do_append_unexp_config_line(conf, key, ""))
1557 WARN("Error clearing configuration for %s", key);
1558 }
1559
1560 static bool do_lxcapi_clear_config_item(struct lxc_container *c, const char *key)
1561 {
1562 int ret;
1563
1564 if (!c || !c->lxc_conf)
1565 return false;
1566 if (container_mem_lock(c))
1567 return false;
1568 ret = lxc_clear_config_item(c->lxc_conf, key);
1569 if (!ret)
1570 do_clear_unexp_config_line(c->lxc_conf, key);
1571 container_mem_unlock(c);
1572 return ret == 0;
1573 }
1574
1575 WRAP_API_1(bool, lxcapi_clear_config_item, const char *)
1576
1577 static inline bool enter_net_ns(struct lxc_container *c)
1578 {
1579 pid_t pid = do_lxcapi_init_pid(c);
1580
1581 if ((geteuid() != 0 || (c->lxc_conf && !lxc_list_empty(&c->lxc_conf->id_map))) && access("/proc/self/ns/user", F_OK) == 0) {
1582 if (!switch_to_ns(pid, "user"))
1583 return false;
1584 }
1585 return switch_to_ns(pid, "net");
1586 }
1587
1588 // used by qsort and bsearch functions for comparing names
1589 static inline int string_cmp(char **first, char **second)
1590 {
1591 return strcmp(*first, *second);
1592 }
1593
1594 // used by qsort and bsearch functions for comparing container names
1595 static inline int container_cmp(struct lxc_container **first, struct lxc_container **second)
1596 {
1597 return strcmp((*first)->name, (*second)->name);
1598 }
1599
1600 static bool add_to_array(char ***names, char *cname, int pos)
1601 {
1602 char **newnames = realloc(*names, (pos+1) * sizeof(char *));
1603 if (!newnames) {
1604 ERROR("Out of memory");
1605 return false;
1606 }
1607
1608 *names = newnames;
1609 newnames[pos] = strdup(cname);
1610 if (!newnames[pos])
1611 return false;
1612
1613 // sort the arrray as we will use binary search on it
1614 qsort(newnames, pos + 1, sizeof(char *), (int (*)(const void *,const void *))string_cmp);
1615
1616 return true;
1617 }
1618
1619 static bool add_to_clist(struct lxc_container ***list, struct lxc_container *c, int pos, bool sort)
1620 {
1621 struct lxc_container **newlist = realloc(*list, (pos+1) * sizeof(struct lxc_container *));
1622 if (!newlist) {
1623 ERROR("Out of memory");
1624 return false;
1625 }
1626
1627 *list = newlist;
1628 newlist[pos] = c;
1629
1630 // sort the arrray as we will use binary search on it
1631 if (sort)
1632 qsort(newlist, pos + 1, sizeof(struct lxc_container *), (int (*)(const void *,const void *))container_cmp);
1633
1634 return true;
1635 }
1636
1637 static char** get_from_array(char ***names, char *cname, int size)
1638 {
1639 return (char **)bsearch(&cname, *names, size, sizeof(char *), (int (*)(const void *, const void *))string_cmp);
1640 }
1641
1642
1643 static bool array_contains(char ***names, char *cname, int size) {
1644 if(get_from_array(names, cname, size) != NULL)
1645 return true;
1646 return false;
1647 }
1648
1649 static bool remove_from_array(char ***names, char *cname, int size)
1650 {
1651 char **result = get_from_array(names, cname, size);
1652 if (result != NULL) {
1653 free(result);
1654 return true;
1655 }
1656 return false;
1657 }
1658
1659 static char ** do_lxcapi_get_interfaces(struct lxc_container *c)
1660 {
1661 pid_t pid;
1662 int i, count = 0, pipefd[2];
1663 char **interfaces = NULL;
1664 char interface[IFNAMSIZ];
1665
1666 if(pipe(pipefd) < 0) {
1667 SYSERROR("pipe failed");
1668 return NULL;
1669 }
1670
1671 pid = fork();
1672 if (pid < 0) {
1673 SYSERROR("failed to fork task to get interfaces information");
1674 close(pipefd[0]);
1675 close(pipefd[1]);
1676 return NULL;
1677 }
1678
1679 if (pid == 0) { // child
1680 int ret = 1, nbytes;
1681 struct ifaddrs *interfaceArray = NULL, *tempIfAddr = NULL;
1682
1683 /* close the read-end of the pipe */
1684 close(pipefd[0]);
1685
1686 if (!enter_net_ns(c)) {
1687 SYSERROR("failed to enter namespace");
1688 goto out;
1689 }
1690
1691 /* Grab the list of interfaces */
1692 if (getifaddrs(&interfaceArray)) {
1693 SYSERROR("failed to get interfaces list");
1694 goto out;
1695 }
1696
1697 /* Iterate through the interfaces */
1698 for (tempIfAddr = interfaceArray; tempIfAddr != NULL; tempIfAddr = tempIfAddr->ifa_next) {
1699 nbytes = write(pipefd[1], tempIfAddr->ifa_name, IFNAMSIZ);
1700 if (nbytes < 0) {
1701 ERROR("write failed");
1702 goto out;
1703 }
1704 count++;
1705 }
1706 ret = 0;
1707
1708 out:
1709 if (interfaceArray)
1710 freeifaddrs(interfaceArray);
1711
1712 /* close the write-end of the pipe, thus sending EOF to the reader */
1713 close(pipefd[1]);
1714 exit(ret);
1715 }
1716
1717 /* close the write-end of the pipe */
1718 close(pipefd[1]);
1719
1720 while (read(pipefd[0], &interface, IFNAMSIZ) == IFNAMSIZ) {
1721 if (array_contains(&interfaces, interface, count))
1722 continue;
1723
1724 if(!add_to_array(&interfaces, interface, count))
1725 ERROR("PARENT: add_to_array failed");
1726 count++;
1727 }
1728
1729 if (wait_for_pid(pid) != 0) {
1730 for(i=0;i<count;i++)
1731 free(interfaces[i]);
1732 free(interfaces);
1733 interfaces = NULL;
1734 }
1735
1736 /* close the read-end of the pipe */
1737 close(pipefd[0]);
1738
1739 /* Append NULL to the array */
1740 if(interfaces)
1741 interfaces = (char **)lxc_append_null_to_array((void **)interfaces, count);
1742
1743 return interfaces;
1744 }
1745
1746 WRAP_API(char **, lxcapi_get_interfaces)
1747
1748 static char** do_lxcapi_get_ips(struct lxc_container *c, const char* interface, const char* family, int scope)
1749 {
1750 pid_t pid;
1751 int i, count = 0, pipefd[2];
1752 char **addresses = NULL;
1753 char address[INET6_ADDRSTRLEN];
1754
1755 if(pipe(pipefd) < 0) {
1756 SYSERROR("pipe failed");
1757 return NULL;
1758 }
1759
1760 pid = fork();
1761 if (pid < 0) {
1762 SYSERROR("failed to fork task to get container ips");
1763 close(pipefd[0]);
1764 close(pipefd[1]);
1765 return NULL;
1766 }
1767
1768 if (pid == 0) { // child
1769 int ret = 1, nbytes;
1770 struct ifaddrs *interfaceArray = NULL, *tempIfAddr = NULL;
1771 char addressOutputBuffer[INET6_ADDRSTRLEN];
1772 void *tempAddrPtr = NULL;
1773 char *address = NULL;
1774
1775 /* close the read-end of the pipe */
1776 close(pipefd[0]);
1777
1778 if (!enter_net_ns(c)) {
1779 SYSERROR("failed to enter namespace");
1780 goto out;
1781 }
1782
1783 /* Grab the list of interfaces */
1784 if (getifaddrs(&interfaceArray)) {
1785 SYSERROR("failed to get interfaces list");
1786 goto out;
1787 }
1788
1789 /* Iterate through the interfaces */
1790 for (tempIfAddr = interfaceArray; tempIfAddr != NULL; tempIfAddr = tempIfAddr->ifa_next) {
1791 if (tempIfAddr->ifa_addr == NULL)
1792 continue;
1793
1794 if(tempIfAddr->ifa_addr->sa_family == AF_INET) {
1795 if (family && strcmp(family, "inet"))
1796 continue;
1797 tempAddrPtr = &((struct sockaddr_in *)tempIfAddr->ifa_addr)->sin_addr;
1798 }
1799 else {
1800 if (family && strcmp(family, "inet6"))
1801 continue;
1802
1803 if (((struct sockaddr_in6 *)tempIfAddr->ifa_addr)->sin6_scope_id != scope)
1804 continue;
1805
1806 tempAddrPtr = &((struct sockaddr_in6 *)tempIfAddr->ifa_addr)->sin6_addr;
1807 }
1808
1809 if (interface && strcmp(interface, tempIfAddr->ifa_name))
1810 continue;
1811 else if (!interface && strcmp("lo", tempIfAddr->ifa_name) == 0)
1812 continue;
1813
1814 address = (char *)inet_ntop(tempIfAddr->ifa_addr->sa_family,
1815 tempAddrPtr,
1816 addressOutputBuffer,
1817 sizeof(addressOutputBuffer));
1818 if (!address)
1819 continue;
1820
1821 nbytes = write(pipefd[1], address, INET6_ADDRSTRLEN);
1822 if (nbytes < 0) {
1823 ERROR("write failed");
1824 goto out;
1825 }
1826 count++;
1827 }
1828 ret = 0;
1829
1830 out:
1831 if(interfaceArray)
1832 freeifaddrs(interfaceArray);
1833
1834 /* close the write-end of the pipe, thus sending EOF to the reader */
1835 close(pipefd[1]);
1836 exit(ret);
1837 }
1838
1839 /* close the write-end of the pipe */
1840 close(pipefd[1]);
1841
1842 while (read(pipefd[0], &address, INET6_ADDRSTRLEN) == INET6_ADDRSTRLEN) {
1843 if(!add_to_array(&addresses, address, count))
1844 ERROR("PARENT: add_to_array failed");
1845 count++;
1846 }
1847
1848 if (wait_for_pid(pid) != 0) {
1849 for(i=0;i<count;i++)
1850 free(addresses[i]);
1851 free(addresses);
1852 addresses = NULL;
1853 }
1854
1855 /* close the read-end of the pipe */
1856 close(pipefd[0]);
1857
1858 /* Append NULL to the array */
1859 if(addresses)
1860 addresses = (char **)lxc_append_null_to_array((void **)addresses, count);
1861
1862 return addresses;
1863 }
1864
1865 WRAP_API_3(char **, lxcapi_get_ips, const char *, const char *, int)
1866
1867 static int do_lxcapi_get_config_item(struct lxc_container *c, const char *key, char *retv, int inlen)
1868 {
1869 int ret;
1870
1871 if (!c || !c->lxc_conf)
1872 return -1;
1873 if (container_mem_lock(c))
1874 return -1;
1875 ret = lxc_get_config_item(c->lxc_conf, key, retv, inlen);
1876 container_mem_unlock(c);
1877 return ret;
1878 }
1879
1880 WRAP_API_3(int, lxcapi_get_config_item, const char *, char *, int)
1881
1882 static char* do_lxcapi_get_running_config_item(struct lxc_container *c, const char *key)
1883 {
1884 char *ret;
1885
1886 if (!c || !c->lxc_conf)
1887 return NULL;
1888 if (container_mem_lock(c))
1889 return NULL;
1890 ret = lxc_cmd_get_config_item(c->name, key, do_lxcapi_get_config_path(c));
1891 container_mem_unlock(c);
1892 return ret;
1893 }
1894
1895 WRAP_API_1(char *, lxcapi_get_running_config_item, const char *)
1896
1897 static int do_lxcapi_get_keys(struct lxc_container *c, const char *key, char *retv, int inlen)
1898 {
1899 if (!key)
1900 return lxc_listconfigs(retv, inlen);
1901 /*
1902 * Support 'lxc.network.<idx>', i.e. 'lxc.network.0'
1903 * This is an intelligent result to show which keys are valid given
1904 * the type of nic it is
1905 */
1906 if (!c || !c->lxc_conf)
1907 return -1;
1908 if (container_mem_lock(c))
1909 return -1;
1910 int ret = -1;
1911 if (strncmp(key, "lxc.network.", 12) == 0)
1912 ret = lxc_list_nicconfigs(c->lxc_conf, key, retv, inlen);
1913 container_mem_unlock(c);
1914 return ret;
1915 }
1916
1917 WRAP_API_3(int, lxcapi_get_keys, const char *, char *, int)
1918
1919 static bool do_lxcapi_save_config(struct lxc_container *c, const char *alt_file)
1920 {
1921 FILE *fout;
1922 bool ret = false, need_disklock = false;
1923 int lret;
1924
1925 if (!alt_file)
1926 alt_file = c->configfile;
1927 if (!alt_file)
1928 return false; // should we write to stdout if no file is specified?
1929
1930 // If we haven't yet loaded a config, load the stock config
1931 if (!c->lxc_conf) {
1932 if (!do_lxcapi_load_config(c, lxc_global_config_value("lxc.default_config"))) {
1933 ERROR("Error loading default configuration file %s while saving %s", lxc_global_config_value("lxc.default_config"), c->name);
1934 return false;
1935 }
1936 }
1937
1938 if (!create_container_dir(c))
1939 return false;
1940
1941 /*
1942 * If we're writing to the container's config file, take the
1943 * disk lock. Otherwise just take the memlock to protect the
1944 * struct lxc_container while we're traversing it.
1945 */
1946 if (strcmp(c->configfile, alt_file) == 0)
1947 need_disklock = true;
1948
1949 if (need_disklock)
1950 lret = container_disk_lock(c);
1951 else
1952 lret = container_mem_lock(c);
1953
1954 if (lret)
1955 return false;
1956
1957 fout = fopen(alt_file, "w");
1958 if (!fout)
1959 goto out;
1960 write_config(fout, c->lxc_conf);
1961 fclose(fout);
1962 ret = true;
1963
1964 out:
1965 if (need_disklock)
1966 container_disk_unlock(c);
1967 else
1968 container_mem_unlock(c);
1969 return ret;
1970 }
1971
1972 WRAP_API_1(bool, lxcapi_save_config, const char *)
1973
1974 static bool mod_rdep(struct lxc_container *c, bool inc)
1975 {
1976 char path[MAXPATHLEN];
1977 int ret, v = 0;
1978 FILE *f;
1979 bool bret = false;
1980
1981 if (container_disk_lock(c))
1982 return false;
1983 ret = snprintf(path, MAXPATHLEN, "%s/%s/lxc_snapshots", c->config_path,
1984 c->name);
1985 if (ret < 0 || ret > MAXPATHLEN)
1986 goto out;
1987 f = fopen(path, "r");
1988 if (f) {
1989 ret = fscanf(f, "%d", &v);
1990 fclose(f);
1991 if (ret != 1) {
1992 ERROR("Corrupted file %s", path);
1993 goto out;
1994 }
1995 }
1996 v += inc ? 1 : -1;
1997 f = fopen(path, "w");
1998 if (!f)
1999 goto out;
2000 if (fprintf(f, "%d\n", v) < 0) {
2001 ERROR("Error writing new snapshots value");
2002 fclose(f);
2003 goto out;
2004 }
2005 ret = fclose(f);
2006 if (ret != 0) {
2007 SYSERROR("Error writing to or closing snapshots file");
2008 goto out;
2009 }
2010
2011 bret = true;
2012
2013 out:
2014 container_disk_unlock(c);
2015 return bret;
2016 }
2017
2018 static void strip_newline(char *p)
2019 {
2020 size_t len = strlen(p);
2021 if (len < 1)
2022 return;
2023 if (p[len-1] == '\n')
2024 p[len-1] = '\0';
2025 }
2026
2027 static void mod_all_rdeps(struct lxc_container *c, bool inc)
2028 {
2029 struct lxc_container *p;
2030 char *lxcpath = NULL, *lxcname = NULL, path[MAXPATHLEN];
2031 size_t pathlen = 0, namelen = 0;
2032 FILE *f;
2033 int ret;
2034
2035 ret = snprintf(path, MAXPATHLEN, "%s/%s/lxc_rdepends",
2036 c->config_path, c->name);
2037 if (ret < 0 || ret >= MAXPATHLEN) {
2038 ERROR("Path name too long");
2039 return;
2040 }
2041 f = fopen(path, "r");
2042 if (f == NULL)
2043 return;
2044 while (getline(&lxcpath, &pathlen, f) != -1) {
2045 if (getline(&lxcname, &namelen, f) == -1) {
2046 ERROR("badly formatted file %s", path);
2047 goto out;
2048 }
2049 strip_newline(lxcpath);
2050 strip_newline(lxcname);
2051 if ((p = lxc_container_new(lxcname, lxcpath)) == NULL) {
2052 ERROR("Unable to find dependent container %s:%s",
2053 lxcpath, lxcname);
2054 continue;
2055 }
2056 if (!mod_rdep(p, inc))
2057 ERROR("Failed to increase numsnapshots for %s:%s",
2058 lxcpath, lxcname);
2059 lxc_container_put(p);
2060 }
2061 out:
2062 free(lxcpath);
2063 free(lxcname);
2064 fclose(f);
2065 }
2066
2067 static bool has_fs_snapshots(struct lxc_container *c)
2068 {
2069 char path[MAXPATHLEN];
2070 int ret, v;
2071 FILE *f;
2072 bool bret = false;
2073
2074 ret = snprintf(path, MAXPATHLEN, "%s/%s/lxc_snapshots", c->config_path,
2075 c->name);
2076 if (ret < 0 || ret > MAXPATHLEN)
2077 goto out;
2078 f = fopen(path, "r");
2079 if (!f)
2080 goto out;
2081 ret = fscanf(f, "%d", &v);
2082 fclose(f);
2083 if (ret != 1)
2084 goto out;
2085 bret = v != 0;
2086
2087 out:
2088 return bret;
2089 }
2090
2091 static bool has_snapshots(struct lxc_container *c)
2092 {
2093 char path[MAXPATHLEN];
2094 struct dirent dirent, *direntp;
2095 int count=0;
2096 DIR *dir;
2097
2098 if (!get_snappath_dir(c, path))
2099 return false;
2100 dir = opendir(path);
2101 if (!dir)
2102 return false;
2103 while (!readdir_r(dir, &dirent, &direntp)) {
2104 if (!direntp)
2105 break;
2106
2107 if (!strcmp(direntp->d_name, "."))
2108 continue;
2109
2110 if (!strcmp(direntp->d_name, ".."))
2111 continue;
2112 count++;
2113 break;
2114 }
2115 closedir(dir);
2116 return count > 0;
2117 }
2118
2119 static int lxc_rmdir_onedev_wrapper(void *data)
2120 {
2121 char *arg = (char *) data;
2122 return lxc_rmdir_onedev(arg, "snaps");
2123 }
2124
2125 static int do_bdev_destroy(struct lxc_conf *conf)
2126 {
2127 struct bdev *r;
2128 int ret = 0;
2129
2130 r = bdev_init(conf, conf->rootfs.path, conf->rootfs.mount, NULL);
2131 if (!r)
2132 return -1;
2133
2134 if (r->ops->destroy(r) < 0)
2135 ret = -1;
2136 bdev_put(r);
2137 return ret;
2138 }
2139
2140 static int bdev_destroy_wrapper(void *data)
2141 {
2142 struct lxc_conf *conf = data;
2143
2144 if (setgid(0) < 0) {
2145 ERROR("Failed to setgid to 0");
2146 return -1;
2147 }
2148 if (setgroups(0, NULL) < 0)
2149 WARN("Failed to clear groups");
2150 if (setuid(0) < 0) {
2151 ERROR("Failed to setuid to 0");
2152 return -1;
2153 }
2154 return do_bdev_destroy(conf);
2155 }
2156
2157 static bool container_destroy(struct lxc_container *c)
2158 {
2159 bool bret = false;
2160 int ret;
2161
2162 if (!c || !do_lxcapi_is_defined(c))
2163 return false;
2164
2165 if (container_disk_lock(c))
2166 return false;
2167
2168 if (!is_stopped(c)) {
2169 // we should queue some sort of error - in c->error_string?
2170 ERROR("container %s is not stopped", c->name);
2171 goto out;
2172 }
2173
2174 if (c->lxc_conf && c->lxc_conf->rootfs.path && c->lxc_conf->rootfs.mount) {
2175 if (am_unpriv())
2176 ret = userns_exec_1(c->lxc_conf, bdev_destroy_wrapper, c->lxc_conf);
2177 else
2178 ret = do_bdev_destroy(c->lxc_conf);
2179 if (ret < 0) {
2180 ERROR("Error destroying rootfs for %s", c->name);
2181 goto out;
2182 }
2183 }
2184
2185 mod_all_rdeps(c, false);
2186
2187 const char *p1 = do_lxcapi_get_config_path(c);
2188 char *path = alloca(strlen(p1) + strlen(c->name) + 2);
2189 sprintf(path, "%s/%s", p1, c->name);
2190 if (am_unpriv())
2191 ret = userns_exec_1(c->lxc_conf, lxc_rmdir_onedev_wrapper, path);
2192 else
2193 ret = lxc_rmdir_onedev(path, "snaps");
2194 if (ret < 0) {
2195 ERROR("Error destroying container directory for %s", c->name);
2196 goto out;
2197 }
2198 bret = true;
2199
2200 out:
2201 container_disk_unlock(c);
2202 return bret;
2203 }
2204
2205 static bool do_lxcapi_destroy(struct lxc_container *c)
2206 {
2207 if (!c || !lxcapi_is_defined(c))
2208 return false;
2209 if (has_snapshots(c)) {
2210 ERROR("Container %s has snapshots; not removing", c->name);
2211 return false;
2212 }
2213
2214 if (has_fs_snapshots(c)) {
2215 ERROR("container %s has snapshots on its rootfs", c->name);
2216 return false;
2217 }
2218
2219 return container_destroy(c);
2220 }
2221
2222 WRAP_API(bool, lxcapi_destroy)
2223
2224 static bool do_lxcapi_destroy_with_snapshots(struct lxc_container *c)
2225 {
2226 if (!c || !lxcapi_is_defined(c))
2227 return false;
2228 if (!lxcapi_snapshot_destroy_all(c)) {
2229 ERROR("Error deleting all snapshots");
2230 return false;
2231 }
2232 return lxcapi_destroy(c);
2233 }
2234
2235 WRAP_API(bool, lxcapi_destroy_with_snapshots)
2236
2237 static bool set_config_item_locked(struct lxc_container *c, const char *key, const char *v)
2238 {
2239 struct lxc_config_t *config;
2240
2241 if (!c->lxc_conf)
2242 c->lxc_conf = lxc_conf_init();
2243 if (!c->lxc_conf)
2244 return false;
2245 config = lxc_getconfig(key);
2246 if (!config)
2247 return false;
2248 if (config->cb(key, v, c->lxc_conf) != 0)
2249 return false;
2250 return do_append_unexp_config_line(c->lxc_conf, key, v);
2251 }
2252
2253 static bool do_lxcapi_set_config_item(struct lxc_container *c, const char *key, const char *v)
2254 {
2255 bool b = false;
2256
2257 if (!c)
2258 return false;
2259
2260 if (container_mem_lock(c))
2261 return false;
2262
2263 b = set_config_item_locked(c, key, v);
2264
2265 container_mem_unlock(c);
2266 return b;
2267 }
2268
2269 WRAP_API_2(bool, lxcapi_set_config_item, const char *, const char *)
2270
2271 static char *lxcapi_config_file_name(struct lxc_container *c)
2272 {
2273 if (!c || !c->configfile)
2274 return NULL;
2275 return strdup(c->configfile);
2276 }
2277
2278 static const char *lxcapi_get_config_path(struct lxc_container *c)
2279 {
2280 if (!c || !c->config_path)
2281 return NULL;
2282 return (const char *)(c->config_path);
2283 }
2284
2285 /*
2286 * not for export
2287 * Just recalculate the c->configfile based on the
2288 * c->config_path, which must be set.
2289 * The lxc_container must be locked or not yet public.
2290 */
2291 static bool set_config_filename(struct lxc_container *c)
2292 {
2293 char *newpath;
2294 int len, ret;
2295
2296 if (!c->config_path)
2297 return false;
2298
2299 /* $lxc_path + "/" + c->name + "/" + "config" + '\0' */
2300 len = strlen(c->config_path) + strlen(c->name) + strlen("config") + 3;
2301 newpath = malloc(len);
2302 if (!newpath)
2303 return false;
2304
2305 ret = snprintf(newpath, len, "%s/%s/config", c->config_path, c->name);
2306 if (ret < 0 || ret >= len) {
2307 fprintf(stderr, "Error printing out config file name\n");
2308 free(newpath);
2309 return false;
2310 }
2311
2312 free(c->configfile);
2313 c->configfile = newpath;
2314
2315 return true;
2316 }
2317
2318 static bool do_lxcapi_set_config_path(struct lxc_container *c, const char *path)
2319 {
2320 char *p;
2321 bool b = false;
2322 char *oldpath = NULL;
2323
2324 if (!c)
2325 return b;
2326
2327 if (container_mem_lock(c))
2328 return b;
2329
2330 p = strdup(path);
2331 if (!p) {
2332 ERROR("Out of memory setting new lxc path");
2333 goto err;
2334 }
2335
2336 b = true;
2337 if (c->config_path)
2338 oldpath = c->config_path;
2339 c->config_path = p;
2340
2341 /* Since we've changed the config path, we have to change the
2342 * config file name too */
2343 if (!set_config_filename(c)) {
2344 ERROR("Out of memory setting new config filename");
2345 b = false;
2346 free(c->config_path);
2347 c->config_path = oldpath;
2348 oldpath = NULL;
2349 }
2350 err:
2351 free(oldpath);
2352 container_mem_unlock(c);
2353 return b;
2354 }
2355
2356 WRAP_API_1(bool, lxcapi_set_config_path, const char *)
2357
2358 static bool do_lxcapi_set_cgroup_item(struct lxc_container *c, const char *subsys, const char *value)
2359 {
2360 int ret;
2361
2362 if (!c)
2363 return false;
2364
2365 if (is_stopped(c))
2366 return false;
2367
2368 if (container_disk_lock(c))
2369 return false;
2370
2371 ret = lxc_cgroup_set(subsys, value, c->name, c->config_path);
2372
2373 container_disk_unlock(c);
2374 return ret == 0;
2375 }
2376
2377 WRAP_API_2(bool, lxcapi_set_cgroup_item, const char *, const char *)
2378
2379 static int do_lxcapi_get_cgroup_item(struct lxc_container *c, const char *subsys, char *retv, int inlen)
2380 {
2381 int ret;
2382
2383 if (!c)
2384 return -1;
2385
2386 if (is_stopped(c))
2387 return -1;
2388
2389 if (container_disk_lock(c))
2390 return -1;
2391
2392 ret = lxc_cgroup_get(subsys, retv, inlen, c->name, c->config_path);
2393
2394 container_disk_unlock(c);
2395 return ret;
2396 }
2397
2398 WRAP_API_3(int, lxcapi_get_cgroup_item, const char *, char *, int)
2399
2400 const char *lxc_get_global_config_item(const char *key)
2401 {
2402 return lxc_global_config_value(key);
2403 }
2404
2405 const char *lxc_get_version(void)
2406 {
2407 return LXC_VERSION;
2408 }
2409
2410 static int copy_file(const char *old, const char *new)
2411 {
2412 int in, out;
2413 ssize_t len, ret;
2414 char buf[8096];
2415 struct stat sbuf;
2416
2417 if (file_exists(new)) {
2418 ERROR("copy destination %s exists", new);
2419 return -1;
2420 }
2421 ret = stat(old, &sbuf);
2422 if (ret < 0) {
2423 INFO("Error stat'ing %s", old);
2424 return -1;
2425 }
2426
2427 in = open(old, O_RDONLY);
2428 if (in < 0) {
2429 SYSERROR("Error opening original file %s", old);
2430 return -1;
2431 }
2432 out = open(new, O_CREAT | O_EXCL | O_WRONLY, 0644);
2433 if (out < 0) {
2434 SYSERROR("Error opening new file %s", new);
2435 close(in);
2436 return -1;
2437 }
2438
2439 while (1) {
2440 len = read(in, buf, 8096);
2441 if (len < 0) {
2442 SYSERROR("Error reading old file %s", old);
2443 goto err;
2444 }
2445 if (len == 0)
2446 break;
2447 ret = write(out, buf, len);
2448 if (ret < len) { // should we retry?
2449 SYSERROR("Error: write to new file %s was interrupted", new);
2450 goto err;
2451 }
2452 }
2453 close(in);
2454 close(out);
2455
2456 // we set mode, but not owner/group
2457 ret = chmod(new, sbuf.st_mode);
2458 if (ret) {
2459 SYSERROR("Error setting mode on %s", new);
2460 return -1;
2461 }
2462
2463 return 0;
2464
2465 err:
2466 close(in);
2467 close(out);
2468 return -1;
2469 }
2470
2471 static int copyhooks(struct lxc_container *oldc, struct lxc_container *c)
2472 {
2473 int i, len, ret;
2474 struct lxc_list *it;
2475 char *cpath;
2476
2477 len = strlen(oldc->config_path) + strlen(oldc->name) + 3;
2478 cpath = alloca(len);
2479 ret = snprintf(cpath, len, "%s/%s/", oldc->config_path, oldc->name);
2480 if (ret < 0 || ret >= len)
2481 return -1;
2482
2483 for (i=0; i<NUM_LXC_HOOKS; i++) {
2484 lxc_list_for_each(it, &c->lxc_conf->hooks[i]) {
2485 char *hookname = it->elem;
2486 char *fname = strrchr(hookname, '/');
2487 char tmppath[MAXPATHLEN];
2488 if (!fname) // relative path - we don't support, but maybe we should
2489 return 0;
2490 if (strncmp(hookname, cpath, len - 1) != 0) {
2491 // this hook is public - ignore
2492 continue;
2493 }
2494 // copy the script, and change the entry in confile
2495 ret = snprintf(tmppath, MAXPATHLEN, "%s/%s/%s",
2496 c->config_path, c->name, fname+1);
2497 if (ret < 0 || ret >= MAXPATHLEN)
2498 return -1;
2499 ret = copy_file(it->elem, tmppath);
2500 if (ret < 0)
2501 return -1;
2502 free(it->elem);
2503 it->elem = strdup(tmppath);
2504 if (!it->elem) {
2505 ERROR("out of memory copying hook path");
2506 return -1;
2507 }
2508 }
2509 }
2510
2511 if (!clone_update_unexp_hooks(c->lxc_conf, oldc->config_path,
2512 c->config_path, oldc->name, c->name)) {
2513 ERROR("Error saving new hooks in clone");
2514 return -1;
2515 }
2516 do_lxcapi_save_config(c, NULL);
2517 return 0;
2518 }
2519
2520
2521 static int copy_fstab(struct lxc_container *oldc, struct lxc_container *c)
2522 {
2523 char newpath[MAXPATHLEN];
2524 char *oldpath = oldc->lxc_conf->fstab;
2525 int ret;
2526
2527 if (!oldpath)
2528 return 0;
2529
2530 clear_unexp_config_line(c->lxc_conf, "lxc.mount", false);
2531
2532 char *p = strrchr(oldpath, '/');
2533 if (!p)
2534 return -1;
2535 ret = snprintf(newpath, MAXPATHLEN, "%s/%s%s",
2536 c->config_path, c->name, p);
2537 if (ret < 0 || ret >= MAXPATHLEN) {
2538 ERROR("error printing new path for %s", oldpath);
2539 return -1;
2540 }
2541 if (file_exists(newpath)) {
2542 ERROR("error: fstab file %s exists", newpath);
2543 return -1;
2544 }
2545
2546 if (copy_file(oldpath, newpath) < 0) {
2547 ERROR("error: copying %s to %s", oldpath, newpath);
2548 return -1;
2549 }
2550 free(c->lxc_conf->fstab);
2551 c->lxc_conf->fstab = strdup(newpath);
2552 if (!c->lxc_conf->fstab) {
2553 ERROR("error: allocating pathname");
2554 return -1;
2555 }
2556 if (!do_append_unexp_config_line(c->lxc_conf, "lxc.mount", newpath)) {
2557 ERROR("error saving new lxctab");
2558 return -1;
2559 }
2560
2561 return 0;
2562 }
2563
2564 static void copy_rdepends(struct lxc_container *c, struct lxc_container *c0)
2565 {
2566 char path0[MAXPATHLEN], path1[MAXPATHLEN];
2567 int ret;
2568
2569 ret = snprintf(path0, MAXPATHLEN, "%s/%s/lxc_rdepends", c0->config_path,
2570 c0->name);
2571 if (ret < 0 || ret >= MAXPATHLEN) {
2572 WARN("Error copying reverse dependencies");
2573 return;
2574 }
2575 ret = snprintf(path1, MAXPATHLEN, "%s/%s/lxc_rdepends", c->config_path,
2576 c->name);
2577 if (ret < 0 || ret >= MAXPATHLEN) {
2578 WARN("Error copying reverse dependencies");
2579 return;
2580 }
2581 if (copy_file(path0, path1) < 0) {
2582 INFO("Error copying reverse dependencies");
2583 return;
2584 }
2585 }
2586
2587 static bool add_rdepends(struct lxc_container *c, struct lxc_container *c0)
2588 {
2589 int ret;
2590 char path[MAXPATHLEN];
2591 FILE *f;
2592 bool bret;
2593
2594 ret = snprintf(path, MAXPATHLEN, "%s/%s/lxc_rdepends", c->config_path,
2595 c->name);
2596 if (ret < 0 || ret >= MAXPATHLEN)
2597 return false;
2598 f = fopen(path, "a");
2599 if (!f)
2600 return false;
2601 bret = true;
2602 // if anything goes wrong, just return an error
2603 if (fprintf(f, "%s\n%s\n", c0->config_path, c0->name) < 0)
2604 bret = false;
2605 if (fclose(f) != 0)
2606 bret = false;
2607 return bret;
2608 }
2609
2610 static int copy_storage(struct lxc_container *c0, struct lxc_container *c,
2611 const char *newtype, int flags, const char *bdevdata, uint64_t newsize)
2612 {
2613 struct bdev *bdev;
2614 int need_rdep;
2615
2616 bdev = bdev_copy(c0, c->name, c->config_path, newtype, flags,
2617 bdevdata, newsize, &need_rdep);
2618 if (!bdev) {
2619 ERROR("Error copying storage");
2620 return -1;
2621 }
2622 free(c->lxc_conf->rootfs.path);
2623 c->lxc_conf->rootfs.path = strdup(bdev->src);
2624 bdev_put(bdev);
2625 if (!c->lxc_conf->rootfs.path) {
2626 ERROR("Out of memory while setting storage path");
2627 return -1;
2628 }
2629 // We will simply append a new lxc.rootfs entry to the unexpanded config
2630 clear_unexp_config_line(c->lxc_conf, "lxc.rootfs", false);
2631 if (!do_append_unexp_config_line(c->lxc_conf, "lxc.rootfs", c->lxc_conf->rootfs.path)) {
2632 ERROR("Error saving new rootfs to cloend config");
2633 return -1;
2634 }
2635 if (flags & LXC_CLONE_SNAPSHOT)
2636 copy_rdepends(c, c0);
2637 if (need_rdep) {
2638 if (!add_rdepends(c, c0))
2639 WARN("Error adding reverse dependency from %s to %s",
2640 c->name, c0->name);
2641 }
2642
2643 mod_all_rdeps(c, true);
2644
2645 return 0;
2646 }
2647
2648 struct clone_update_data {
2649 struct lxc_container *c0;
2650 struct lxc_container *c1;
2651 int flags;
2652 char **hookargs;
2653 };
2654
2655 static int clone_update_rootfs(struct clone_update_data *data)
2656 {
2657 struct lxc_container *c0 = data->c0;
2658 struct lxc_container *c = data->c1;
2659 int flags = data->flags;
2660 char **hookargs = data->hookargs;
2661 int ret = -1;
2662 char path[MAXPATHLEN];
2663 struct bdev *bdev;
2664 FILE *fout;
2665 struct lxc_conf *conf = c->lxc_conf;
2666
2667 /* update hostname in rootfs */
2668 /* we're going to mount, so run in a clean namespace to simplify cleanup */
2669
2670 if (setgid(0) < 0) {
2671 ERROR("Failed to setgid to 0");
2672 return -1;
2673 }
2674 if (setuid(0) < 0) {
2675 ERROR("Failed to setuid to 0");
2676 return -1;
2677 }
2678 if (setgroups(0, NULL) < 0)
2679 WARN("Failed to clear groups");
2680
2681 if (unshare(CLONE_NEWNS) < 0)
2682 return -1;
2683 bdev = bdev_init(c->lxc_conf, c->lxc_conf->rootfs.path, c->lxc_conf->rootfs.mount, NULL);
2684 if (!bdev)
2685 return -1;
2686 if (strcmp(bdev->type, "dir") != 0) {
2687 if (unshare(CLONE_NEWNS) < 0) {
2688 ERROR("error unsharing mounts");
2689 bdev_put(bdev);
2690 return -1;
2691 }
2692 if (detect_shared_rootfs()) {
2693 if (mount(NULL, "/", NULL, MS_SLAVE|MS_REC, NULL)) {
2694 SYSERROR("Failed to make / rslave");
2695 ERROR("Continuing...");
2696 }
2697 }
2698 if (bdev->ops->mount(bdev) < 0) {
2699 bdev_put(bdev);
2700 return -1;
2701 }
2702 } else { // TODO come up with a better way
2703 free(bdev->dest);
2704 bdev->dest = strdup(bdev->src);
2705 }
2706
2707 if (!lxc_list_empty(&conf->hooks[LXCHOOK_CLONE])) {
2708 /* Start of environment variable setup for hooks */
2709 if (setenv("LXC_SRC_NAME", c0->name, 1)) {
2710 SYSERROR("failed to set environment variable for source container name");
2711 }
2712 if (setenv("LXC_NAME", c->name, 1)) {
2713 SYSERROR("failed to set environment variable for container name");
2714 }
2715 if (setenv("LXC_CONFIG_FILE", conf->rcfile, 1)) {
2716 SYSERROR("failed to set environment variable for config path");
2717 }
2718 if (setenv("LXC_ROOTFS_MOUNT", bdev->dest, 1)) {
2719 SYSERROR("failed to set environment variable for rootfs mount");
2720 }
2721 if (setenv("LXC_ROOTFS_PATH", conf->rootfs.path, 1)) {
2722 SYSERROR("failed to set environment variable for rootfs mount");
2723 }
2724
2725 if (run_lxc_hooks(c->name, "clone", conf, c->get_config_path(c), hookargs)) {
2726 ERROR("Error executing clone hook for %s", c->name);
2727 bdev_put(bdev);
2728 return -1;
2729 }
2730 }
2731
2732 if (!(flags & LXC_CLONE_KEEPNAME)) {
2733 ret = snprintf(path, MAXPATHLEN, "%s/etc/hostname", bdev->dest);
2734 bdev_put(bdev);
2735
2736 if (ret < 0 || ret >= MAXPATHLEN)
2737 return -1;
2738 if (!file_exists(path))
2739 return 0;
2740 if (!(fout = fopen(path, "w"))) {
2741 SYSERROR("unable to open %s: ignoring", path);
2742 return 0;
2743 }
2744 if (fprintf(fout, "%s", c->name) < 0) {
2745 fclose(fout);
2746 return -1;
2747 }
2748 if (fclose(fout) < 0)
2749 return -1;
2750 }
2751 else
2752 bdev_put(bdev);
2753
2754 return 0;
2755 }
2756
2757 static int clone_update_rootfs_wrapper(void *data)
2758 {
2759 struct clone_update_data *arg = (struct clone_update_data *) data;
2760 return clone_update_rootfs(arg);
2761 }
2762
2763 /*
2764 * We want to support:
2765 sudo lxc-clone -o o1 -n n1 -s -L|-fssize fssize -v|--vgname vgname \
2766 -p|--lvprefix lvprefix -t|--fstype fstype -B backingstore
2767
2768 -s [ implies overlayfs]
2769 -s -B overlayfs
2770 -s -B aufs
2771
2772 only rootfs gets converted (copied/snapshotted) on clone.
2773 */
2774
2775 static int create_file_dirname(char *path, struct lxc_conf *conf)
2776 {
2777 char *p = strrchr(path, '/');
2778 int ret = -1;
2779
2780 if (!p)
2781 return -1;
2782 *p = '\0';
2783 ret = do_create_container_dir(path, conf);
2784 *p = '/';
2785 return ret;
2786 }
2787
2788 static struct lxc_container *do_lxcapi_clone(struct lxc_container *c, const char *newname,
2789 const char *lxcpath, int flags,
2790 const char *bdevtype, const char *bdevdata, uint64_t newsize,
2791 char **hookargs)
2792 {
2793 struct lxc_container *c2 = NULL;
2794 char newpath[MAXPATHLEN];
2795 int ret, storage_copied = 0;
2796 char *origroot = NULL;
2797 struct clone_update_data data;
2798 FILE *fout;
2799 pid_t pid;
2800
2801 if (!c || !do_lxcapi_is_defined(c))
2802 return NULL;
2803
2804 if (container_mem_lock(c))
2805 return NULL;
2806
2807 if (!is_stopped(c)) {
2808 ERROR("error: Original container (%s) is running", c->name);
2809 goto out;
2810 }
2811
2812 // Make sure the container doesn't yet exist.
2813 if (!newname)
2814 newname = c->name;
2815 if (!lxcpath)
2816 lxcpath = do_lxcapi_get_config_path(c);
2817 ret = snprintf(newpath, MAXPATHLEN, "%s/%s/config", lxcpath, newname);
2818 if (ret < 0 || ret >= MAXPATHLEN) {
2819 SYSERROR("clone: failed making config pathname");
2820 goto out;
2821 }
2822 if (file_exists(newpath)) {
2823 ERROR("error: clone: %s exists", newpath);
2824 goto out;
2825 }
2826
2827 ret = create_file_dirname(newpath, c->lxc_conf);
2828 if (ret < 0 && errno != EEXIST) {
2829 ERROR("Error creating container dir for %s", newpath);
2830 goto out;
2831 }
2832
2833 // copy the configuration, tweak it as needed,
2834 if (c->lxc_conf->rootfs.path) {
2835 origroot = c->lxc_conf->rootfs.path;
2836 c->lxc_conf->rootfs.path = NULL;
2837 }
2838 fout = fopen(newpath, "w");
2839 if (!fout) {
2840 SYSERROR("open %s", newpath);
2841 goto out;
2842 }
2843 write_config(fout, c->lxc_conf);
2844 fclose(fout);
2845 c->lxc_conf->rootfs.path = origroot;
2846
2847 sprintf(newpath, "%s/%s/rootfs", lxcpath, newname);
2848 if (mkdir(newpath, 0755) < 0) {
2849 SYSERROR("error creating %s", newpath);
2850 goto out;
2851 }
2852
2853 if (am_unpriv()) {
2854 if (chown_mapped_root(newpath, c->lxc_conf) < 0) {
2855 ERROR("Error chowning %s to container root", newpath);
2856 goto out;
2857 }
2858 }
2859
2860 c2 = lxc_container_new(newname, lxcpath);
2861 if (!c2) {
2862 ERROR("clone: failed to create new container (%s %s)", newname,
2863 lxcpath);
2864 goto out;
2865 }
2866
2867 // copy/snapshot rootfs's
2868 ret = copy_storage(c, c2, bdevtype, flags, bdevdata, newsize);
2869 if (ret < 0)
2870 goto out;
2871
2872 clear_unexp_config_line(c2->lxc_conf, "lxc.utsname", false);
2873
2874 // update utsname
2875 if (!set_config_item_locked(c2, "lxc.utsname", newname)) {
2876 ERROR("Error setting new hostname");
2877 goto out;
2878 }
2879
2880 // copy hooks
2881 ret = copyhooks(c, c2);
2882 if (ret < 0) {
2883 ERROR("error copying hooks");
2884 goto out;
2885 }
2886
2887 if (copy_fstab(c, c2) < 0) {
2888 ERROR("error copying fstab");
2889 goto out;
2890 }
2891
2892 // update macaddrs
2893 if (!(flags & LXC_CLONE_KEEPMACADDR)) {
2894 if (!network_new_hwaddrs(c2->lxc_conf)) {
2895 ERROR("Error updating mac addresses");
2896 goto out;
2897 }
2898 }
2899
2900 // We've now successfully created c2's storage, so clear it out if we
2901 // fail after this
2902 storage_copied = 1;
2903
2904 if (!c2->save_config(c2, NULL))
2905 goto out;
2906
2907 if ((pid = fork()) < 0) {
2908 SYSERROR("fork");
2909 goto out;
2910 }
2911 if (pid > 0) {
2912 ret = wait_for_pid(pid);
2913 if (ret)
2914 goto out;
2915 container_mem_unlock(c);
2916 return c2;
2917 }
2918 data.c0 = c;
2919 data.c1 = c2;
2920 data.flags = flags;
2921 data.hookargs = hookargs;
2922 if (am_unpriv())
2923 ret = userns_exec_1(c->lxc_conf, clone_update_rootfs_wrapper,
2924 &data);
2925 else
2926 ret = clone_update_rootfs(&data);
2927 if (ret < 0)
2928 exit(1);
2929
2930 container_mem_unlock(c);
2931 exit(0);
2932
2933 out:
2934 container_mem_unlock(c);
2935 if (c2) {
2936 if (!storage_copied)
2937 c2->lxc_conf->rootfs.path = NULL;
2938 c2->destroy(c2);
2939 lxc_container_put(c2);
2940 }
2941
2942 return NULL;
2943 }
2944
2945 static struct lxc_container *lxcapi_clone(struct lxc_container *c, const char *newname,
2946 const char *lxcpath, int flags,
2947 const char *bdevtype, const char *bdevdata, uint64_t newsize,
2948 char **hookargs)
2949 {
2950 struct lxc_container * ret;
2951 struct lxc_conf *old = current_config;
2952 current_config = c ? c->lxc_conf : NULL;
2953 ret = do_lxcapi_clone(c, newname, lxcpath, flags, bdevtype, bdevdata, newsize, hookargs);
2954 current_config = old;
2955 return ret;
2956 }
2957
2958 static bool do_lxcapi_rename(struct lxc_container *c, const char *newname)
2959 {
2960 struct bdev *bdev;
2961 struct lxc_container *newc;
2962
2963 if (!c || !c->name || !c->config_path || !c->lxc_conf)
2964 return false;
2965
2966 if (has_fs_snapshots(c) || has_snapshots(c)) {
2967 ERROR("Renaming a container with snapshots is not supported");
2968 return false;
2969 }
2970 bdev = bdev_init(c->lxc_conf, c->lxc_conf->rootfs.path, c->lxc_conf->rootfs.mount, NULL);
2971 if (!bdev) {
2972 ERROR("Failed to find original backing store type");
2973 return false;
2974 }
2975
2976 newc = lxcapi_clone(c, newname, c->config_path, LXC_CLONE_KEEPMACADDR, NULL, bdev->type, 0, NULL);
2977 bdev_put(bdev);
2978 if (!newc) {
2979 lxc_container_put(newc);
2980 return false;
2981 }
2982
2983 if (newc && lxcapi_is_defined(newc))
2984 lxc_container_put(newc);
2985
2986 if (!container_destroy(c)) {
2987 ERROR("Could not destroy existing container %s", c->name);
2988 return false;
2989 }
2990 return true;
2991 }
2992
2993 WRAP_API_1(bool, lxcapi_rename, const char *)
2994
2995 static int lxcapi_attach(struct lxc_container *c, lxc_attach_exec_t exec_function, void *exec_payload, lxc_attach_options_t *options, pid_t *attached_process)
2996 {
2997 struct lxc_conf *old = current_config;
2998 int ret;
2999
3000 if (!c)
3001 return -1;
3002
3003 current_config = c->lxc_conf;
3004
3005 ret = lxc_attach(c->name, c->config_path, exec_function, exec_payload, options, attached_process);
3006 current_config = old;
3007 return ret;
3008 }
3009
3010 static int do_lxcapi_attach_run_wait(struct lxc_container *c, lxc_attach_options_t *options, const char *program, const char * const argv[])
3011 {
3012 lxc_attach_command_t command;
3013 pid_t pid;
3014 int r;
3015
3016 if (!c)
3017 return -1;
3018
3019 command.program = (char*)program;
3020 command.argv = (char**)argv;
3021 r = lxc_attach(c->name, c->config_path, lxc_attach_run_command, &command, options, &pid);
3022 if (r < 0) {
3023 ERROR("ups");
3024 return r;
3025 }
3026 return lxc_wait_for_pid_status(pid);
3027 }
3028
3029 static int lxcapi_attach_run_wait(struct lxc_container *c, lxc_attach_options_t *options, const char *program, const char * const argv[])
3030 {
3031 int ret;
3032 struct lxc_conf *old = current_config;
3033 current_config = c ? c->lxc_conf : NULL;
3034 ret = do_lxcapi_attach_run_wait(c, options, program, argv);
3035 current_config = old;
3036 return ret;
3037 }
3038
3039 static int get_next_index(const char *lxcpath, char *cname)
3040 {
3041 char *fname;
3042 struct stat sb;
3043 int i = 0, ret;
3044
3045 fname = alloca(strlen(lxcpath) + 20);
3046 while (1) {
3047 sprintf(fname, "%s/snap%d", lxcpath, i);
3048 ret = stat(fname, &sb);
3049 if (ret != 0)
3050 return i;
3051 i++;
3052 }
3053 }
3054
3055 static bool get_snappath_dir(struct lxc_container *c, char *snappath)
3056 {
3057 int ret;
3058 /*
3059 * If the old style snapshot path exists, use it
3060 * /var/lib/lxc -> /var/lib/lxcsnaps
3061 */
3062 ret = snprintf(snappath, MAXPATHLEN, "%ssnaps", c->config_path);
3063 if (ret < 0 || ret >= MAXPATHLEN)
3064 return false;
3065 if (dir_exists(snappath)) {
3066 ret = snprintf(snappath, MAXPATHLEN, "%ssnaps/%s", c->config_path, c->name);
3067 if (ret < 0 || ret >= MAXPATHLEN)
3068 return false;
3069 return true;
3070 }
3071
3072 /*
3073 * Use the new style path
3074 * /var/lib/lxc -> /var/lib/lxc + c->name + /snaps + \0
3075 */
3076 ret = snprintf(snappath, MAXPATHLEN, "%s/%s/snaps", c->config_path, c->name);
3077 if (ret < 0 || ret >= MAXPATHLEN)
3078 return false;
3079 return true;
3080 }
3081
3082 static int do_lxcapi_snapshot(struct lxc_container *c, const char *commentfile)
3083 {
3084 int i, flags, ret;
3085 struct lxc_container *c2;
3086 char snappath[MAXPATHLEN], newname[20];
3087
3088 if (!c || !lxcapi_is_defined(c))
3089 return -1;
3090
3091 if (!bdev_can_backup(c->lxc_conf)) {
3092 ERROR("%s's backing store cannot be backed up.", c->name);
3093 ERROR("Your container must use another backing store type.");
3094 return -1;
3095 }
3096
3097 if (!get_snappath_dir(c, snappath))
3098 return -1;
3099
3100 i = get_next_index(snappath, c->name);
3101
3102 if (mkdir_p(snappath, 0755) < 0) {
3103 ERROR("Failed to create snapshot directory %s", snappath);
3104 return -1;
3105 }
3106
3107 ret = snprintf(newname, 20, "snap%d", i);
3108 if (ret < 0 || ret >= 20)
3109 return -1;
3110
3111 /*
3112 * We pass LXC_CLONE_SNAPSHOT to make sure that a rdepends file entry is
3113 * created in the original container
3114 */
3115 flags = LXC_CLONE_SNAPSHOT | LXC_CLONE_KEEPMACADDR | LXC_CLONE_KEEPNAME |
3116 LXC_CLONE_KEEPBDEVTYPE | LXC_CLONE_MAYBE_SNAPSHOT;
3117 if (bdev_is_dir(c->lxc_conf, c->lxc_conf->rootfs.path)) {
3118 ERROR("Snapshot of directory-backed container requested.");
3119 ERROR("Making a copy-clone. If you do want snapshots, then");
3120 ERROR("please create an aufs or overlayfs clone first, snapshot that");
3121 ERROR("and keep the original container pristine.");
3122 flags &= ~LXC_CLONE_SNAPSHOT | LXC_CLONE_MAYBE_SNAPSHOT;
3123 }
3124 c2 = do_lxcapi_clone(c, newname, snappath, flags, NULL, NULL, 0, NULL);
3125 if (!c2) {
3126 ERROR("clone of %s:%s failed", c->config_path, c->name);
3127 return -1;
3128 }
3129
3130 lxc_container_put(c2);
3131
3132 // Now write down the creation time
3133 time_t timer;
3134 char buffer[25];
3135 struct tm* tm_info;
3136 FILE *f;
3137
3138 time(&timer);
3139 tm_info = localtime(&timer);
3140
3141 strftime(buffer, 25, "%Y:%m:%d %H:%M:%S", tm_info);
3142
3143 char *dfnam = alloca(strlen(snappath) + strlen(newname) + 5);
3144 sprintf(dfnam, "%s/%s/ts", snappath, newname);
3145 f = fopen(dfnam, "w");
3146 if (!f) {
3147 ERROR("Failed to open %s", dfnam);
3148 return -1;
3149 }
3150 if (fprintf(f, "%s", buffer) < 0) {
3151 SYSERROR("Writing timestamp");
3152 fclose(f);
3153 return -1;
3154 }
3155 ret = fclose(f);
3156 if (ret != 0) {
3157 SYSERROR("Writing timestamp");
3158 return -1;
3159 }
3160
3161 if (commentfile) {
3162 // $p / $name / comment \0
3163 int len = strlen(snappath) + strlen(newname) + 10;
3164 char *path = alloca(len);
3165 sprintf(path, "%s/%s/comment", snappath, newname);
3166 return copy_file(commentfile, path) < 0 ? -1 : i;
3167 }
3168
3169 return i;
3170 }
3171
3172 WRAP_API_1(int, lxcapi_snapshot, const char *)
3173
3174 static void lxcsnap_free(struct lxc_snapshot *s)
3175 {
3176 free(s->name);
3177 free(s->comment_pathname);
3178 free(s->timestamp);
3179 free(s->lxcpath);
3180 }
3181
3182 static char *get_snapcomment_path(char* snappath, char *name)
3183 {
3184 // $snappath/$name/comment
3185 int ret, len = strlen(snappath) + strlen(name) + 10;
3186 char *s = malloc(len);
3187
3188 if (s) {
3189 ret = snprintf(s, len, "%s/%s/comment", snappath, name);
3190 if (ret < 0 || ret >= len) {
3191 free(s);
3192 s = NULL;
3193 }
3194 }
3195 return s;
3196 }
3197
3198 static char *get_timestamp(char* snappath, char *name)
3199 {
3200 char path[MAXPATHLEN], *s = NULL;
3201 int ret, len;
3202 FILE *fin;
3203
3204 ret = snprintf(path, MAXPATHLEN, "%s/%s/ts", snappath, name);
3205 if (ret < 0 || ret >= MAXPATHLEN)
3206 return NULL;
3207 fin = fopen(path, "r");
3208 if (!fin)
3209 return NULL;
3210 (void) fseek(fin, 0, SEEK_END);
3211 len = ftell(fin);
3212 (void) fseek(fin, 0, SEEK_SET);
3213 if (len > 0) {
3214 s = malloc(len+1);
3215 if (s) {
3216 s[len] = '\0';
3217 if (fread(s, 1, len, fin) != len) {
3218 SYSERROR("reading timestamp");
3219 free(s);
3220 s = NULL;
3221 }
3222 }
3223 }
3224 fclose(fin);
3225 return s;
3226 }
3227
3228 static int do_lxcapi_snapshot_list(struct lxc_container *c, struct lxc_snapshot **ret_snaps)
3229 {
3230 char snappath[MAXPATHLEN], path2[MAXPATHLEN];
3231 int count = 0, ret;
3232 struct dirent dirent, *direntp;
3233 struct lxc_snapshot *snaps =NULL, *nsnaps;
3234 DIR *dir;
3235
3236 if (!c || !lxcapi_is_defined(c))
3237 return -1;
3238
3239 if (!get_snappath_dir(c, snappath)) {
3240 ERROR("path name too long");
3241 return -1;
3242 }
3243 dir = opendir(snappath);
3244 if (!dir) {
3245 INFO("failed to open %s - assuming no snapshots", snappath);
3246 return 0;
3247 }
3248
3249 while (!readdir_r(dir, &dirent, &direntp)) {
3250 if (!direntp)
3251 break;
3252
3253 if (!strcmp(direntp->d_name, "."))
3254 continue;
3255
3256 if (!strcmp(direntp->d_name, ".."))
3257 continue;
3258
3259 ret = snprintf(path2, MAXPATHLEN, "%s/%s/config", snappath, direntp->d_name);
3260 if (ret < 0 || ret >= MAXPATHLEN) {
3261 ERROR("pathname too long");
3262 goto out_free;
3263 }
3264 if (!file_exists(path2))
3265 continue;
3266 nsnaps = realloc(snaps, (count + 1)*sizeof(*snaps));
3267 if (!nsnaps) {
3268 SYSERROR("Out of memory");
3269 goto out_free;
3270 }
3271 snaps = nsnaps;
3272 snaps[count].free = lxcsnap_free;
3273 snaps[count].name = strdup(direntp->d_name);
3274 if (!snaps[count].name)
3275 goto out_free;
3276 snaps[count].lxcpath = strdup(snappath);
3277 if (!snaps[count].lxcpath) {
3278 free(snaps[count].name);
3279 goto out_free;
3280 }
3281 snaps[count].comment_pathname = get_snapcomment_path(snappath, direntp->d_name);
3282 snaps[count].timestamp = get_timestamp(snappath, direntp->d_name);
3283 count++;
3284 }
3285
3286 if (closedir(dir))
3287 WARN("failed to close directory");
3288
3289 *ret_snaps = snaps;
3290 return count;
3291
3292 out_free:
3293 if (snaps) {
3294 int i;
3295 for (i=0; i<count; i++)
3296 lxcsnap_free(&snaps[i]);
3297 free(snaps);
3298 }
3299 if (closedir(dir))
3300 WARN("failed to close directory");
3301 return -1;
3302 }
3303
3304 WRAP_API_1(int, lxcapi_snapshot_list, struct lxc_snapshot **)
3305
3306 static bool do_lxcapi_snapshot_restore(struct lxc_container *c, const char *snapname, const char *newname)
3307 {
3308 char clonelxcpath[MAXPATHLEN];
3309 int flags = 0;
3310 struct lxc_container *snap, *rest;
3311 struct bdev *bdev;
3312 bool b = false;
3313
3314 if (!c || !c->name || !c->config_path)
3315 return false;
3316
3317 if (has_fs_snapshots(c)) {
3318 ERROR("container rootfs has dependent snapshots");
3319 return false;
3320 }
3321
3322 bdev = bdev_init(c->lxc_conf, c->lxc_conf->rootfs.path, c->lxc_conf->rootfs.mount, NULL);
3323 if (!bdev) {
3324 ERROR("Failed to find original backing store type");
3325 return false;
3326 }
3327
3328 if (!newname)
3329 newname = c->name;
3330
3331 if (!get_snappath_dir(c, clonelxcpath)) {
3332 bdev_put(bdev);
3333 return false;
3334 }
3335 // how should we lock this?
3336
3337 snap = lxc_container_new(snapname, clonelxcpath);
3338 if (!snap || !lxcapi_is_defined(snap)) {
3339 ERROR("Could not open snapshot %s", snapname);
3340 if (snap) lxc_container_put(snap);
3341 bdev_put(bdev);
3342 return false;
3343 }
3344
3345 if (strcmp(c->name, newname) == 0) {
3346 if (!container_destroy(c)) {
3347 ERROR("Could not destroy existing container %s", newname);
3348 lxc_container_put(snap);
3349 bdev_put(bdev);
3350 return false;
3351 }
3352 }
3353
3354 if (strcmp(bdev->type, "dir") != 0 && strcmp(bdev->type, "loop") != 0)
3355 flags = LXC_CLONE_SNAPSHOT | LXC_CLONE_MAYBE_SNAPSHOT;
3356 rest = lxcapi_clone(snap, newname, c->config_path, flags,
3357 bdev->type, NULL, 0, NULL);
3358 bdev_put(bdev);
3359 if (rest && lxcapi_is_defined(rest))
3360 b = true;
3361 if (rest)
3362 lxc_container_put(rest);
3363 lxc_container_put(snap);
3364 return b;
3365 }
3366
3367 WRAP_API_2(bool, lxcapi_snapshot_restore, const char *, const char *)
3368
3369 static bool do_snapshot_destroy(const char *snapname, const char *clonelxcpath)
3370 {
3371 struct lxc_container *snap = NULL;
3372 bool bret = false;
3373
3374 snap = lxc_container_new(snapname, clonelxcpath);
3375 if (!snap) {
3376 ERROR("Could not find snapshot %s", snapname);
3377 goto err;
3378 }
3379
3380 if (!do_lxcapi_destroy(snap)) {
3381 ERROR("Could not destroy snapshot %s", snapname);
3382 goto err;
3383 }
3384 bret = true;
3385
3386 err:
3387 if (snap)
3388 lxc_container_put(snap);
3389 return bret;
3390 }
3391
3392 static bool remove_all_snapshots(const char *path)
3393 {
3394 DIR *dir;
3395 struct dirent dirent, *direntp;
3396 bool bret = true;
3397
3398 dir = opendir(path);
3399 if (!dir) {
3400 SYSERROR("opendir on snapshot path %s", path);
3401 return false;
3402 }
3403 while (!readdir_r(dir, &dirent, &direntp)) {
3404 if (!direntp)
3405 break;
3406 if (!strcmp(direntp->d_name, "."))
3407 continue;
3408 if (!strcmp(direntp->d_name, ".."))
3409 continue;
3410 if (!do_snapshot_destroy(direntp->d_name, path)) {
3411 bret = false;
3412 continue;
3413 }
3414 }
3415
3416 closedir(dir);
3417
3418 if (rmdir(path))
3419 SYSERROR("Error removing directory %s", path);
3420
3421 return bret;
3422 }
3423
3424 static bool do_lxcapi_snapshot_destroy(struct lxc_container *c, const char *snapname)
3425 {
3426 char clonelxcpath[MAXPATHLEN];
3427
3428 if (!c || !c->name || !c->config_path || !snapname)
3429 return false;
3430
3431 if (!get_snappath_dir(c, clonelxcpath))
3432 return false;
3433
3434 return do_snapshot_destroy(snapname, clonelxcpath);
3435 }
3436
3437 WRAP_API_1(bool, lxcapi_snapshot_destroy, const char *)
3438
3439 static bool do_lxcapi_snapshot_destroy_all(struct lxc_container *c)
3440 {
3441 char clonelxcpath[MAXPATHLEN];
3442
3443 if (!c || !c->name || !c->config_path)
3444 return false;
3445
3446 if (!get_snappath_dir(c, clonelxcpath))
3447 return false;
3448
3449 return remove_all_snapshots(clonelxcpath);
3450 }
3451
3452 WRAP_API(bool, lxcapi_snapshot_destroy_all)
3453
3454 static bool do_lxcapi_may_control(struct lxc_container *c)
3455 {
3456 return lxc_try_cmd(c->name, c->config_path) == 0;
3457 }
3458
3459 WRAP_API(bool, lxcapi_may_control)
3460
3461 static bool do_add_remove_node(pid_t init_pid, const char *path, bool add,
3462 struct stat *st)
3463 {
3464 char chrootpath[MAXPATHLEN];
3465 char *directory_path = NULL;
3466 pid_t pid;
3467 int ret;
3468
3469 if ((pid = fork()) < 0) {
3470 SYSERROR("failed to fork a child helper");
3471 return false;
3472 }
3473 if (pid) {
3474 if (wait_for_pid(pid) != 0) {
3475 ERROR("Failed to create note in guest");
3476 return false;
3477 }
3478 return true;
3479 }
3480
3481 /* prepare the path */
3482 ret = snprintf(chrootpath, MAXPATHLEN, "/proc/%d/root", init_pid);
3483 if (ret < 0 || ret >= MAXPATHLEN)
3484 return false;
3485
3486 if (chroot(chrootpath) < 0)
3487 exit(1);
3488 if (chdir("/") < 0)
3489 exit(1);
3490 /* remove path if it exists */
3491 if(faccessat(AT_FDCWD, path, F_OK, AT_SYMLINK_NOFOLLOW) == 0) {
3492 if (unlink(path) < 0) {
3493 ERROR("unlink failed");
3494 exit(1);
3495 }
3496 }
3497 if (!add)
3498 exit(0);
3499
3500 /* create any missing directories */
3501 directory_path = dirname(strdup(path));
3502 if (mkdir_p(directory_path, 0755) < 0 && errno != EEXIST) {
3503 ERROR("failed to create directory");
3504 exit(1);
3505 }
3506
3507 /* create the device node */
3508 if (mknod(path, st->st_mode, st->st_rdev) < 0) {
3509 ERROR("mknod failed");
3510 exit(1);
3511 }
3512
3513 exit(0);
3514 }
3515
3516 static bool add_remove_device_node(struct lxc_container *c, const char *src_path, const char *dest_path, bool add)
3517 {
3518 int ret;
3519 struct stat st;
3520 char value[MAX_BUFFER];
3521 const char *p;
3522
3523 /* make sure container is running */
3524 if (!do_lxcapi_is_running(c)) {
3525 ERROR("container is not running");
3526 return false;
3527 }
3528
3529 /* use src_path if dest_path is NULL otherwise use dest_path */
3530 p = dest_path ? dest_path : src_path;
3531
3532 /* make sure we can access p */
3533 if(access(p, F_OK) < 0 || stat(p, &st) < 0)
3534 return false;
3535
3536 /* continue if path is character device or block device */
3537 if (S_ISCHR(st.st_mode))
3538 ret = snprintf(value, MAX_BUFFER, "c %d:%d rwm", major(st.st_rdev), minor(st.st_rdev));
3539 else if (S_ISBLK(st.st_mode))
3540 ret = snprintf(value, MAX_BUFFER, "b %d:%d rwm", major(st.st_rdev), minor(st.st_rdev));
3541 else
3542 return false;
3543
3544 /* check snprintf return code */
3545 if (ret < 0 || ret >= MAX_BUFFER)
3546 return false;
3547
3548 if (!do_add_remove_node(do_lxcapi_init_pid(c), p, add, &st))
3549 return false;
3550
3551 /* add or remove device to/from cgroup access list */
3552 if (add) {
3553 if (!do_lxcapi_set_cgroup_item(c, "devices.allow", value)) {
3554 ERROR("set_cgroup_item failed while adding the device node");
3555 return false;
3556 }
3557 } else {
3558 if (!do_lxcapi_set_cgroup_item(c, "devices.deny", value)) {
3559 ERROR("set_cgroup_item failed while removing the device node");
3560 return false;
3561 }
3562 }
3563
3564 return true;
3565 }
3566
3567 static bool do_lxcapi_add_device_node(struct lxc_container *c, const char *src_path, const char *dest_path)
3568 {
3569 if (am_unpriv()) {
3570 ERROR(NOT_SUPPORTED_ERROR, __FUNCTION__);
3571 return false;
3572 }
3573 return add_remove_device_node(c, src_path, dest_path, true);
3574 }
3575
3576 WRAP_API_2(bool, lxcapi_add_device_node, const char *, const char *)
3577
3578 static bool do_lxcapi_remove_device_node(struct lxc_container *c, const char *src_path, const char *dest_path)
3579 {
3580 if (am_unpriv()) {
3581 ERROR(NOT_SUPPORTED_ERROR, __FUNCTION__);
3582 return false;
3583 }
3584 return add_remove_device_node(c, src_path, dest_path, false);
3585 }
3586
3587 WRAP_API_2(bool, lxcapi_remove_device_node, const char *, const char *)
3588
3589 static bool do_lxcapi_attach_interface(struct lxc_container *c, const char *ifname,
3590 const char *dst_ifname)
3591 {
3592 int ret = 0;
3593 if (am_unpriv()) {
3594 ERROR(NOT_SUPPORTED_ERROR, __FUNCTION__);
3595 return false;
3596 }
3597
3598 if (!ifname) {
3599 ERROR("No source interface name given");
3600 return false;
3601 }
3602
3603 ret = lxc_netdev_isup(ifname);
3604
3605 if (ret > 0) {
3606 /* netdev of ifname is up. */
3607 ret = lxc_netdev_down(ifname);
3608 if (ret)
3609 goto err;
3610 }
3611
3612 ret = lxc_netdev_move_by_name(ifname, do_lxcapi_init_pid(c), dst_ifname);
3613 if (ret)
3614 goto err;
3615
3616 return true;
3617
3618 err:
3619 return false;
3620 }
3621
3622 WRAP_API_2(bool, lxcapi_attach_interface, const char *, const char *)
3623
3624 static bool do_lxcapi_detach_interface(struct lxc_container *c, const char *ifname,
3625 const char *dst_ifname)
3626 {
3627 pid_t pid, pid_outside;
3628
3629 if (am_unpriv()) {
3630 ERROR(NOT_SUPPORTED_ERROR, __FUNCTION__);
3631 return false;
3632 }
3633
3634 if (!ifname) {
3635 ERROR("No source interface name given");
3636 return false;
3637 }
3638
3639 pid_outside = getpid();
3640 pid = fork();
3641 if (pid < 0) {
3642 ERROR("failed to fork task to get interfaces information");
3643 return false;
3644 }
3645
3646 if (pid == 0) { // child
3647 int ret = 0;
3648 if (!enter_net_ns(c)) {
3649 ERROR("failed to enter namespace");
3650 exit(-1);
3651 }
3652
3653 ret = lxc_netdev_isup(ifname);
3654 if (ret < 0)
3655 exit(ret);
3656
3657 /* netdev of ifname is up. */
3658 if (ret) {
3659 ret = lxc_netdev_down(ifname);
3660 if (ret)
3661 exit(ret);
3662 }
3663
3664 ret = lxc_netdev_move_by_name(ifname, pid_outside, dst_ifname);
3665
3666 /* -EINVAL means there is no netdev named as ifanme. */
3667 if (ret == -EINVAL) {
3668 ERROR("No network device named as %s.", ifname);
3669 }
3670 exit(ret);
3671 }
3672
3673 if (wait_for_pid(pid) != 0)
3674 return false;
3675
3676 return true;
3677 }
3678
3679 WRAP_API_2(bool, lxcapi_detach_interface, const char *, const char *)
3680
3681 struct criu_opts {
3682 /* The type of criu invocation, one of "dump" or "restore" */
3683 char *action;
3684
3685 /* The directory to pass to criu */
3686 char *directory;
3687
3688 /* The container to dump */
3689 struct lxc_container *c;
3690
3691 /* Enable criu verbose mode? */
3692 bool verbose;
3693
3694 /* dump: stop the container or not after dumping? */
3695 bool stop;
3696
3697 /* restore: the file to write the init process' pid into */
3698 char *pidfile;
3699 const char *cgroup_path;
3700 };
3701
3702 static void exec_criu(struct criu_opts *opts)
3703 {
3704 char **argv, log[PATH_MAX], buf[257];
3705 int static_args = 14, argc = 0, i, ret;
3706 int netnr = 0;
3707 struct lxc_list *it;
3708
3709 /* The command line always looks like:
3710 * criu $(action) --tcp-established --file-locks --link-remap --force-irmap \
3711 * --manage-cgroups action-script foo.sh -D $(directory) \
3712 * -o $(directory)/$(action).log
3713 * +1 for final NULL */
3714
3715 if (strcmp(opts->action, "dump") == 0) {
3716 /* -t pid */
3717 static_args += 2;
3718
3719 /* --leave-running */
3720 if (!opts->stop)
3721 static_args++;
3722 } else if (strcmp(opts->action, "restore") == 0) {
3723 /* --root $(lxc_mount_point) --restore-detached
3724 * --restore-sibling --pidfile $foo --cgroup-root $foo */
3725 static_args += 8;
3726 } else {
3727 return;
3728 }
3729
3730 if (opts->verbose)
3731 static_args++;
3732
3733 ret = snprintf(log, PATH_MAX, "%s/%s.log", opts->directory, opts->action);
3734 if (ret < 0 || ret >= PATH_MAX) {
3735 ERROR("logfile name too long\n");
3736 return;
3737 }
3738
3739 // We need to tell criu where cgmanager's socket is bind mounted from
3740 // if it exists since it's external.
3741 if (cgroup_driver() == CGMANAGER)
3742 static_args+=2;
3743
3744 argv = malloc(static_args * sizeof(*argv));
3745 if (!argv)
3746 return;
3747
3748 memset(argv, 0, static_args * sizeof(*argv));
3749
3750 #define DECLARE_ARG(arg) \
3751 do { \
3752 if (arg == NULL) { \
3753 ERROR("Got NULL argument for criu"); \
3754 goto err; \
3755 } \
3756 argv[argc++] = strdup(arg); \
3757 if (!argv[argc-1]) \
3758 goto err; \
3759 } while (0)
3760
3761 argv[argc++] = on_path("criu", NULL);
3762 if (!argv[argc-1]) {
3763 ERROR("Couldn't find criu binary\n");
3764 goto err;
3765 }
3766
3767 DECLARE_ARG(opts->action);
3768 DECLARE_ARG("--tcp-established");
3769 DECLARE_ARG("--file-locks");
3770 DECLARE_ARG("--link-remap");
3771 DECLARE_ARG("--force-irmap");
3772 DECLARE_ARG("--manage-cgroups");
3773 DECLARE_ARG("--action-script");
3774 DECLARE_ARG(DATADIR "/lxc/lxc-restore-net");
3775 DECLARE_ARG("-D");
3776 DECLARE_ARG(opts->directory);
3777 DECLARE_ARG("-o");
3778 DECLARE_ARG(log);
3779
3780 if (opts->verbose)
3781 DECLARE_ARG("-vvvvvv");
3782
3783 if (strcmp(opts->action, "dump") == 0) {
3784 char pid[32];
3785
3786 if (cgroup_driver() == CGMANAGER) {
3787 DECLARE_ARG("--ext-mount-map");
3788 DECLARE_ARG("/sys/fs/cgroup/cgmanager:cgmanager");
3789 }
3790
3791 if (sprintf(pid, "%d", lxcapi_init_pid(opts->c)) < 0)
3792 goto err;
3793
3794 DECLARE_ARG("-t");
3795 DECLARE_ARG(pid);
3796 if (!opts->stop)
3797 DECLARE_ARG("--leave-running");
3798 } else if (strcmp(opts->action, "restore") == 0) {
3799
3800 if (cgroup_driver() == CGMANAGER) {
3801 DECLARE_ARG("--ext-mount-map");
3802 DECLARE_ARG("cgmanager:/sys/fs/cgroup/cgmanager");
3803 }
3804
3805 DECLARE_ARG("--root");
3806 DECLARE_ARG(opts->c->lxc_conf->rootfs.mount);
3807 DECLARE_ARG("--restore-detached");
3808 DECLARE_ARG("--restore-sibling");
3809 DECLARE_ARG("--pidfile");
3810 DECLARE_ARG(opts->pidfile);
3811 DECLARE_ARG("--cgroup-root");
3812 DECLARE_ARG(opts->cgroup_path);
3813
3814 lxc_list_for_each(it, &opts->c->lxc_conf->network) {
3815 char eth[128], *veth;
3816 void *m;
3817 struct lxc_netdev *n = it->elem;
3818
3819 if (n->name) {
3820 if (strlen(n->name) >= sizeof(eth))
3821 goto err;
3822 strncpy(eth, n->name, sizeof(eth));
3823 } else
3824 sprintf(eth, "eth%d", netnr);
3825
3826 veth = n->priv.veth_attr.pair;
3827
3828 ret = snprintf(buf, sizeof(buf), "%s=%s", eth, veth);
3829 if (ret < 0 || ret >= sizeof(buf))
3830 goto err;
3831
3832 /* final NULL and --veth-pair eth0=vethASDF */
3833 m = realloc(argv, (argc + 1 + 2) * sizeof(*argv));
3834 if (!m)
3835 goto err;
3836 argv = m;
3837
3838 DECLARE_ARG("--veth-pair");
3839 DECLARE_ARG(buf);
3840 argv[argc] = NULL;
3841
3842 }
3843 }
3844
3845 netnr = 0;
3846 lxc_list_for_each(it, &opts->c->lxc_conf->network) {
3847 struct lxc_netdev *n = it->elem;
3848 char veth[128];
3849
3850 /*
3851 * Here, we set some parameters that lxc-restore-net
3852 * will examine to figure out the right network to
3853 * restore.
3854 */
3855 snprintf(buf, sizeof(buf), "LXC_CRIU_BRIDGE%d", netnr);
3856 if (setenv(buf, n->link, 1))
3857 goto err;
3858
3859 if (strcmp("restore", opts->action) == 0)
3860 strncpy(veth, n->priv.veth_attr.pair, sizeof(veth));
3861 else {
3862 char *tmp;
3863 ret = snprintf(buf, sizeof(buf), "lxc.network.%d.veth.pair", netnr);
3864 if (ret < 0 || ret >= sizeof(buf))
3865 goto err;
3866 tmp = lxcapi_get_running_config_item(opts->c, buf);
3867 strncpy(veth, tmp, sizeof(veth));
3868 free(tmp);
3869 }
3870
3871 snprintf(buf, sizeof(buf), "LXC_CRIU_VETH%d", netnr);
3872 if (setenv(buf, veth, 1))
3873 goto err;
3874
3875 netnr++;
3876 }
3877
3878 #undef DECLARE_ARG
3879 execv(argv[0], argv);
3880 err:
3881 for (i = 0; argv[i]; i++)
3882 free(argv[i]);
3883 free(argv);
3884 }
3885
3886 /* Check and make sure the container has a configuration that we know CRIU can
3887 * dump. */
3888 static bool criu_ok(struct lxc_container *c)
3889 {
3890 struct lxc_list *it;
3891 bool found_deny_rule = false;
3892
3893 if (geteuid()) {
3894 ERROR("Must be root to checkpoint\n");
3895 return false;
3896 }
3897
3898 /* We only know how to restore containers with veth networks. */
3899 lxc_list_for_each(it, &c->lxc_conf->network) {
3900 struct lxc_netdev *n = it->elem;
3901 if (n->type != LXC_NET_VETH && n->type != LXC_NET_NONE) {
3902 ERROR("Found network that is not VETH or NONE\n");
3903 return false;
3904 }
3905 }
3906
3907 // These requirements come from http://criu.org/LXC
3908 if (c->lxc_conf->console.path &&
3909 strcmp(c->lxc_conf->console.path, "none") != 0) {
3910 ERROR("lxc.console must be none\n");
3911 return false;
3912 }
3913
3914 if (c->lxc_conf->tty != 0) {
3915 ERROR("lxc.tty must be 0\n");
3916 return false;
3917 }
3918
3919 lxc_list_for_each(it, &c->lxc_conf->cgroup) {
3920 struct lxc_cgroup *cg = it->elem;
3921 if (strcmp(cg->subsystem, "devices.deny") == 0 &&
3922 strcmp(cg->value, "c 5:1 rwm") == 0) {
3923
3924 found_deny_rule = true;
3925 break;
3926 }
3927 }
3928
3929 if (!found_deny_rule) {
3930 ERROR("couldn't find devices.deny = c 5:1 rwm");
3931 return false;
3932 }
3933
3934 return true;
3935 }
3936
3937 static bool dump_net_info(struct lxc_container *c, char *directory)
3938 {
3939 int netnr;
3940 struct lxc_list *it;
3941
3942 netnr = 0;
3943 lxc_list_for_each(it, &c->lxc_conf->network) {
3944 char *veth = NULL, *bridge = NULL, veth_path[PATH_MAX], eth[128];
3945 struct lxc_netdev *n = it->elem;
3946 bool has_error = true;
3947 int pret;
3948
3949 pret = snprintf(veth_path, PATH_MAX, "lxc.network.%d.veth.pair", netnr);
3950 if (pret < 0 || pret >= PATH_MAX)
3951 goto out;
3952
3953 veth = lxcapi_get_running_config_item(c, veth_path);
3954 if (!veth) {
3955 /* criu_ok() checks that all interfaces are
3956 * LXC_NET{VETH,NONE}, and VETHs should have this
3957 * config */
3958 assert(n->type == LXC_NET_NONE);
3959 break;
3960 }
3961
3962 bridge = lxcapi_get_running_config_item(c, veth_path);
3963 if (!bridge)
3964 goto out;
3965
3966 pret = snprintf(veth_path, PATH_MAX, "%s/veth%d", directory, netnr);
3967 if (pret < 0 || pret >= PATH_MAX || print_to_file(veth_path, veth) < 0)
3968 goto out;
3969
3970 if (n->name) {
3971 if (strlen(n->name) >= 128)
3972 goto out;
3973 strncpy(eth, n->name, 128);
3974 } else
3975 sprintf(eth, "eth%d", netnr);
3976
3977 has_error = false;
3978 out:
3979 free(veth);
3980 free(bridge);
3981 if (has_error)
3982 return false;
3983 }
3984
3985 return true;
3986 }
3987
3988 static bool do_lxcapi_checkpoint(struct lxc_container *c, char *directory, bool stop, bool verbose)
3989 {
3990 pid_t pid;
3991 int status;
3992
3993 if (!criu_ok(c))
3994 return false;
3995
3996 if (mkdir(directory, 0700) < 0 && errno != EEXIST)
3997 return false;
3998
3999 if (!dump_net_info(c, directory))
4000 return false;
4001
4002 pid = fork();
4003 if (pid < 0)
4004 return false;
4005
4006 if (pid == 0) {
4007 struct criu_opts os;
4008
4009 os.action = "dump";
4010 os.directory = directory;
4011 os.c = c;
4012 os.stop = stop;
4013 os.verbose = verbose;
4014
4015 /* exec_criu() returning is an error */
4016 exec_criu(&os);
4017 exit(1);
4018 } else {
4019 pid_t w = waitpid(pid, &status, 0);
4020 if (w == -1) {
4021 perror("waitpid");
4022 return false;
4023 }
4024
4025 if (WIFEXITED(status)) {
4026 return !WEXITSTATUS(status);
4027 }
4028
4029 return false;
4030 }
4031 }
4032
4033 WRAP_API_3(bool, lxcapi_checkpoint, char *, bool, bool)
4034
4035 static bool restore_net_info(struct lxc_container *c)
4036 {
4037 struct lxc_list *it;
4038 bool has_error = true;
4039
4040 if (container_mem_lock(c))
4041 return false;
4042
4043 lxc_list_for_each(it, &c->lxc_conf->network) {
4044 struct lxc_netdev *netdev = it->elem;
4045 char template[IFNAMSIZ];
4046 snprintf(template, sizeof(template), "vethXXXXXX");
4047
4048 if (!netdev->priv.veth_attr.pair)
4049 netdev->priv.veth_attr.pair = lxc_mkifname(template);
4050
4051 if (!netdev->priv.veth_attr.pair)
4052 goto out_unlock;
4053 }
4054
4055 has_error = false;
4056
4057 out_unlock:
4058 container_mem_unlock(c);
4059 return !has_error;
4060 }
4061
4062 // do_restore never returns, the calling process is used as the
4063 // monitor process. do_restore calls exit() if it fails.
4064 static void do_restore(struct lxc_container *c, int pipe, char *directory, bool verbose)
4065 {
4066 pid_t pid;
4067 char pidfile[L_tmpnam];
4068 struct lxc_handler *handler;
4069 int status;
4070
4071 if (!tmpnam(pidfile))
4072 goto out;
4073
4074 handler = lxc_init(c->name, c->lxc_conf, c->config_path);
4075 if (!handler)
4076 goto out;
4077
4078 if (!cgroup_init(handler)) {
4079 ERROR("failed initing cgroups");
4080 goto out_fini_handler;
4081 }
4082
4083 if (!cgroup_create(handler)) {
4084 ERROR("failed creating groups");
4085 goto out_fini_handler;
4086 }
4087
4088 if (!restore_net_info(c)) {
4089 ERROR("failed restoring network info");
4090 goto out_fini_handler;
4091 }
4092
4093 pid = fork();
4094 if (pid < 0)
4095 goto out_fini_handler;
4096
4097 if (pid == 0) {
4098 struct criu_opts os;
4099 struct lxc_rootfs *rootfs;
4100
4101 close(pipe);
4102 pipe = -1;
4103
4104 if (unshare(CLONE_NEWNS))
4105 goto out_fini_handler;
4106
4107 /* CRIU needs the lxc root bind mounted so that it is the root of some
4108 * mount. */
4109 rootfs = &c->lxc_conf->rootfs;
4110
4111 if (rootfs_is_blockdev(c->lxc_conf)) {
4112 if (do_rootfs_setup(c->lxc_conf, c->name, c->config_path) < 0)
4113 goto out_fini_handler;
4114 } else {
4115 if (mkdir(rootfs->mount, 0755) < 0 && errno != EEXIST)
4116 goto out_fini_handler;
4117
4118 if (mount(rootfs->path, rootfs->mount, NULL, MS_BIND, NULL) < 0) {
4119 rmdir(rootfs->mount);
4120 goto out_fini_handler;
4121 }
4122 }
4123
4124 os.action = "restore";
4125 os.directory = directory;
4126 os.c = c;
4127 os.pidfile = pidfile;
4128 os.verbose = verbose;
4129 os.cgroup_path = cgroup_canonical_path(handler);
4130
4131 /* exec_criu() returning is an error */
4132 exec_criu(&os);
4133 umount(rootfs->mount);
4134 rmdir(rootfs->mount);
4135 goto out_fini_handler;
4136 } else {
4137 int ret;
4138 char title[2048];
4139
4140 pid_t w = waitpid(pid, &status, 0);
4141 if (w == -1) {
4142 perror("waitpid");
4143 goto out_fini_handler;
4144 }
4145
4146 ret = write(pipe, &status, sizeof(status));
4147 close(pipe);
4148 pipe = -1;
4149
4150 if (sizeof(status) != ret) {
4151 perror("write");
4152 ERROR("failed to write all of status");
4153 goto out_fini_handler;
4154 }
4155
4156 if (WIFEXITED(status)) {
4157 if (WEXITSTATUS(status)) {
4158 goto out_fini_handler;
4159 } else {
4160 int ret;
4161 FILE *f = fopen(pidfile, "r");
4162 if (!f) {
4163 perror("reading pidfile");
4164 ERROR("couldn't read restore's init pidfile %s\n", pidfile);
4165 goto out_fini_handler;
4166 }
4167
4168 ret = fscanf(f, "%d", (int*) &handler->pid);
4169 fclose(f);
4170 if (ret != 1) {
4171 ERROR("reading restore pid failed");
4172 goto out_fini_handler;
4173 }
4174
4175 if (lxc_set_state(c->name, handler, RUNNING))
4176 goto out_fini_handler;
4177 }
4178 } else {
4179 ERROR("CRIU was killed with signal %d\n", WTERMSIG(status));
4180 goto out_fini_handler;
4181 }
4182
4183 /*
4184 * See comment in lxcapi_start; we don't care if these
4185 * fail because it's just a beauty thing. We just
4186 * assign the return here to silence potential.
4187 */
4188 ret = snprintf(title, sizeof(title), "[lxc monitor] %s %s", c->config_path, c->name);
4189 ret = setproctitle(title);
4190
4191 ret = lxc_poll(c->name, handler);
4192 if (ret)
4193 lxc_abort(c->name, handler);
4194 lxc_fini(c->name, handler);
4195 exit(ret);
4196 }
4197
4198 out_fini_handler:
4199 lxc_fini(c->name, handler);
4200
4201 out:
4202 if (pipe >= 0) {
4203 status = 1;
4204 if (write(pipe, &status, sizeof(status)) != sizeof(status)) {
4205 SYSERROR("writing status failed");
4206 }
4207 close(pipe);
4208 }
4209
4210 exit(1);
4211 }
4212
4213 static bool do_lxcapi_restore(struct lxc_container *c, char *directory, bool verbose)
4214 {
4215 pid_t pid;
4216 int status, nread;
4217 int pipefd[2];
4218
4219 if (!criu_ok(c))
4220 return false;
4221
4222 if (geteuid()) {
4223 ERROR("Must be root to restore\n");
4224 return false;
4225 }
4226
4227 if (pipe(pipefd)) {
4228 ERROR("failed to create pipe");
4229 return false;
4230 }
4231
4232 pid = fork();
4233 if (pid < 0) {
4234 close(pipefd[0]);
4235 close(pipefd[1]);
4236 return false;
4237 }
4238
4239 if (pid == 0) {
4240 close(pipefd[0]);
4241 // this never returns
4242 do_restore(c, pipefd[1], directory, verbose);
4243 }
4244
4245 close(pipefd[1]);
4246
4247 nread = read(pipefd[0], &status, sizeof(status));
4248 close(pipefd[0]);
4249 if (sizeof(status) != nread) {
4250 ERROR("reading status from pipe failed");
4251 goto err_wait;
4252 }
4253
4254 // If the criu process was killed or exited nonzero, wait() for the
4255 // handler, since the restore process died. Otherwise, we don't need to
4256 // wait, since the child becomes the monitor process.
4257 if (!WIFEXITED(status) || WEXITSTATUS(status))
4258 goto err_wait;
4259 return true;
4260
4261 err_wait:
4262 if (wait_for_pid(pid))
4263 ERROR("restore process died");
4264 return false;
4265 }
4266
4267 WRAP_API_2(bool, lxcapi_restore, char *, bool)
4268
4269 static int lxcapi_attach_run_waitl(struct lxc_container *c, lxc_attach_options_t *options, const char *program, const char *arg, ...)
4270 {
4271 va_list ap;
4272 const char **argv;
4273 int ret;
4274
4275 if (!c)
4276 return -1;
4277
4278 struct lxc_conf *old = current_config;
4279 current_config = c->lxc_conf;
4280
4281 va_start(ap, arg);
4282 argv = lxc_va_arg_list_to_argv_const(ap, 1);
4283 va_end(ap);
4284
4285 if (!argv) {
4286 ERROR("Memory allocation error.");
4287 ret = -1;
4288 goto out;
4289 }
4290 argv[0] = arg;
4291
4292 ret = do_lxcapi_attach_run_wait(c, options, program, (const char * const *)argv);
4293 free((void*)argv);
4294 out:
4295 current_config = old;
4296 return ret;
4297 }
4298
4299 struct lxc_container *lxc_container_new(const char *name, const char *configpath)
4300 {
4301 struct lxc_container *c;
4302
4303 if (!name)
4304 return NULL;
4305
4306 c = malloc(sizeof(*c));
4307 if (!c) {
4308 fprintf(stderr, "failed to malloc lxc_container\n");
4309 return NULL;
4310 }
4311 memset(c, 0, sizeof(*c));
4312
4313 if (configpath)
4314 c->config_path = strdup(configpath);
4315 else
4316 c->config_path = strdup(lxc_global_config_value("lxc.lxcpath"));
4317
4318 if (!c->config_path) {
4319 fprintf(stderr, "Out of memory\n");
4320 goto err;
4321 }
4322
4323 remove_trailing_slashes(c->config_path);
4324 c->name = malloc(strlen(name)+1);
4325 if (!c->name) {
4326 fprintf(stderr, "Error allocating lxc_container name\n");
4327 goto err;
4328 }
4329 strcpy(c->name, name);
4330
4331 c->numthreads = 1;
4332 if (!(c->slock = lxc_newlock(c->config_path, name))) {
4333 fprintf(stderr, "failed to create lock\n");
4334 goto err;
4335 }
4336
4337 if (!(c->privlock = lxc_newlock(NULL, NULL))) {
4338 fprintf(stderr, "failed to alloc privlock\n");
4339 goto err;
4340 }
4341
4342 if (!set_config_filename(c)) {
4343 fprintf(stderr, "Error allocating config file pathname\n");
4344 goto err;
4345 }
4346
4347 if (file_exists(c->configfile) && !lxcapi_load_config(c, NULL))
4348 goto err;
4349
4350 if (ongoing_create(c) == 2) {
4351 ERROR("Error: %s creation was not completed", c->name);
4352 container_destroy(c);
4353 lxcapi_clear_config(c);
4354 }
4355 c->daemonize = true;
4356 c->pidfile = NULL;
4357
4358 // assign the member functions
4359 c->is_defined = lxcapi_is_defined;
4360 c->state = lxcapi_state;
4361 c->is_running = lxcapi_is_running;
4362 c->freeze = lxcapi_freeze;
4363 c->unfreeze = lxcapi_unfreeze;
4364 c->console = lxcapi_console;
4365 c->console_getfd = lxcapi_console_getfd;
4366 c->init_pid = lxcapi_init_pid;
4367 c->load_config = lxcapi_load_config;
4368 c->want_daemonize = lxcapi_want_daemonize;
4369 c->want_close_all_fds = lxcapi_want_close_all_fds;
4370 c->start = lxcapi_start;
4371 c->startl = lxcapi_startl;
4372 c->stop = lxcapi_stop;
4373 c->config_file_name = lxcapi_config_file_name;
4374 c->wait = lxcapi_wait;
4375 c->set_config_item = lxcapi_set_config_item;
4376 c->destroy = lxcapi_destroy;
4377 c->destroy_with_snapshots = lxcapi_destroy_with_snapshots;
4378 c->rename = lxcapi_rename;
4379 c->save_config = lxcapi_save_config;
4380 c->get_keys = lxcapi_get_keys;
4381 c->create = lxcapi_create;
4382 c->createl = lxcapi_createl;
4383 c->shutdown = lxcapi_shutdown;
4384 c->reboot = lxcapi_reboot;
4385 c->clear_config = lxcapi_clear_config;
4386 c->clear_config_item = lxcapi_clear_config_item;
4387 c->get_config_item = lxcapi_get_config_item;
4388 c->get_running_config_item = lxcapi_get_running_config_item;
4389 c->get_cgroup_item = lxcapi_get_cgroup_item;
4390 c->set_cgroup_item = lxcapi_set_cgroup_item;
4391 c->get_config_path = lxcapi_get_config_path;
4392 c->set_config_path = lxcapi_set_config_path;
4393 c->clone = lxcapi_clone;
4394 c->get_interfaces = lxcapi_get_interfaces;
4395 c->get_ips = lxcapi_get_ips;
4396 c->attach = lxcapi_attach;
4397 c->attach_run_wait = lxcapi_attach_run_wait;
4398 c->attach_run_waitl = lxcapi_attach_run_waitl;
4399 c->snapshot = lxcapi_snapshot;
4400 c->snapshot_list = lxcapi_snapshot_list;
4401 c->snapshot_restore = lxcapi_snapshot_restore;
4402 c->snapshot_destroy = lxcapi_snapshot_destroy;
4403 c->snapshot_destroy_all = lxcapi_snapshot_destroy_all;
4404 c->may_control = lxcapi_may_control;
4405 c->add_device_node = lxcapi_add_device_node;
4406 c->remove_device_node = lxcapi_remove_device_node;
4407 c->attach_interface = lxcapi_attach_interface;
4408 c->detach_interface = lxcapi_detach_interface;
4409 c->checkpoint = lxcapi_checkpoint;
4410 c->restore = lxcapi_restore;
4411
4412 return c;
4413
4414 err:
4415 lxc_container_free(c);
4416 return NULL;
4417 }
4418
4419 int lxc_get_wait_states(const char **states)
4420 {
4421 int i;
4422
4423 if (states)
4424 for (i=0; i<MAX_STATE; i++)
4425 states[i] = lxc_state2str(i);
4426 return MAX_STATE;
4427 }
4428
4429 /*
4430 * These next two could probably be done smarter with reusing a common function
4431 * with different iterators and tests...
4432 */
4433 int list_defined_containers(const char *lxcpath, char ***names, struct lxc_container ***cret)
4434 {
4435 DIR *dir;
4436 int i, cfound = 0, nfound = 0;
4437 struct dirent dirent, *direntp;
4438 struct lxc_container *c;
4439
4440 if (!lxcpath)
4441 lxcpath = lxc_global_config_value("lxc.lxcpath");
4442
4443 dir = opendir(lxcpath);
4444 if (!dir) {
4445 SYSERROR("opendir on lxcpath");
4446 return -1;
4447 }
4448
4449 if (cret)
4450 *cret = NULL;
4451 if (names)
4452 *names = NULL;
4453
4454 while (!readdir_r(dir, &dirent, &direntp)) {
4455 if (!direntp)
4456 break;
4457 if (!strcmp(direntp->d_name, "."))
4458 continue;
4459 if (!strcmp(direntp->d_name, ".."))
4460 continue;
4461
4462 if (!config_file_exists(lxcpath, direntp->d_name))
4463 continue;
4464
4465 if (names) {
4466 if (!add_to_array(names, direntp->d_name, cfound))
4467 goto free_bad;
4468 }
4469 cfound++;
4470
4471 if (!cret) {
4472 nfound++;
4473 continue;
4474 }
4475
4476 c = lxc_container_new(direntp->d_name, lxcpath);
4477 if (!c) {
4478 INFO("Container %s:%s has a config but could not be loaded",
4479 lxcpath, direntp->d_name);
4480 if (names)
4481 if(!remove_from_array(names, direntp->d_name, cfound--))
4482 goto free_bad;
4483 continue;
4484 }
4485 if (!do_lxcapi_is_defined(c)) {
4486 INFO("Container %s:%s has a config but is not defined",
4487 lxcpath, direntp->d_name);
4488 if (names)
4489 if(!remove_from_array(names, direntp->d_name, cfound--))
4490 goto free_bad;
4491 lxc_container_put(c);
4492 continue;
4493 }
4494
4495 if (!add_to_clist(cret, c, nfound, true)) {
4496 lxc_container_put(c);
4497 goto free_bad;
4498 }
4499 nfound++;
4500 }
4501
4502 closedir(dir);
4503 return nfound;
4504
4505 free_bad:
4506 if (names && *names) {
4507 for (i=0; i<cfound; i++)
4508 free((*names)[i]);
4509 free(*names);
4510 }
4511 if (cret && *cret) {
4512 for (i=0; i<nfound; i++)
4513 lxc_container_put((*cret)[i]);
4514 free(*cret);
4515 }
4516 closedir(dir);
4517 return -1;
4518 }
4519
4520 int list_active_containers(const char *lxcpath, char ***nret,
4521 struct lxc_container ***cret)
4522 {
4523 int i, ret = -1, cret_cnt = 0, ct_name_cnt = 0;
4524 int lxcpath_len;
4525 char *line = NULL;
4526 char **ct_name = NULL;
4527 size_t len = 0;
4528 struct lxc_container *c;
4529 bool is_hashed;
4530
4531 if (!lxcpath)
4532 lxcpath = lxc_global_config_value("lxc.lxcpath");
4533 lxcpath_len = strlen(lxcpath);
4534
4535 if (cret)
4536 *cret = NULL;
4537 if (nret)
4538 *nret = NULL;
4539
4540 FILE *f = fopen("/proc/net/unix", "r");
4541 if (!f)
4542 return -1;
4543
4544 while (getline(&line, &len, f) != -1) {
4545
4546 char *p = strrchr(line, ' '), *p2;
4547 if (!p)
4548 continue;
4549 p++;
4550 if (*p != 0x40)
4551 continue;
4552 p++;
4553
4554 is_hashed = false;
4555 if (strncmp(p, lxcpath, lxcpath_len) == 0) {
4556 p += lxcpath_len;
4557 } else if (strncmp(p, "lxc/", 4) == 0) {
4558 p += 4;
4559 is_hashed = true;
4560 } else {
4561 continue;
4562 }
4563
4564 while (*p == '/')
4565 p++;
4566
4567 // Now p is the start of lxc_name
4568 p2 = strchr(p, '/');
4569 if (!p2 || strncmp(p2, "/command", 8) != 0)
4570 continue;
4571 *p2 = '\0';
4572
4573 if (is_hashed) {
4574 if (strncmp(lxcpath, lxc_cmd_get_lxcpath(p), lxcpath_len) != 0)
4575 continue;
4576 p = lxc_cmd_get_name(p);
4577 }
4578
4579 if (array_contains(&ct_name, p, ct_name_cnt))
4580 continue;
4581
4582 if (!add_to_array(&ct_name, p, ct_name_cnt))
4583 goto free_cret_list;
4584
4585 ct_name_cnt++;
4586
4587 if (!cret)
4588 continue;
4589
4590 c = lxc_container_new(p, lxcpath);
4591 if (!c) {
4592 INFO("Container %s:%s is running but could not be loaded",
4593 lxcpath, p);
4594 remove_from_array(&ct_name, p, ct_name_cnt--);
4595 continue;
4596 }
4597
4598 /*
4599 * If this is an anonymous container, then is_defined *can*
4600 * return false. So we don't do that check. Count on the
4601 * fact that the command socket exists.
4602 */
4603
4604 if (!add_to_clist(cret, c, cret_cnt, true)) {
4605 lxc_container_put(c);
4606 goto free_cret_list;
4607 }
4608 cret_cnt++;
4609 }
4610
4611 assert(!nret || !cret || cret_cnt == ct_name_cnt);
4612 ret = ct_name_cnt;
4613 if (nret)
4614 *nret = ct_name;
4615 else
4616 goto free_ct_name;
4617 goto out;
4618
4619 free_cret_list:
4620 if (cret && *cret) {
4621 for (i = 0; i < cret_cnt; i++)
4622 lxc_container_put((*cret)[i]);
4623 free(*cret);
4624 }
4625
4626 free_ct_name:
4627 if (ct_name) {
4628 for (i = 0; i < ct_name_cnt; i++)
4629 free(ct_name[i]);
4630 free(ct_name);
4631 }
4632
4633 out:
4634 free(line);
4635
4636 fclose(f);
4637 return ret;
4638 }
4639
4640 int list_all_containers(const char *lxcpath, char ***nret,
4641 struct lxc_container ***cret)
4642 {
4643 int i, ret, active_cnt, ct_cnt, ct_list_cnt;
4644 char **active_name;
4645 char **ct_name;
4646 struct lxc_container **ct_list = NULL;
4647
4648 ct_cnt = list_defined_containers(lxcpath, &ct_name, NULL);
4649 if (ct_cnt < 0)
4650 return ct_cnt;
4651
4652 active_cnt = list_active_containers(lxcpath, &active_name, NULL);
4653 if (active_cnt < 0) {
4654 ret = active_cnt;
4655 goto free_ct_name;
4656 }
4657
4658 for (i = 0; i < active_cnt; i++) {
4659 if (!array_contains(&ct_name, active_name[i], ct_cnt)) {
4660 if (!add_to_array(&ct_name, active_name[i], ct_cnt)) {
4661 ret = -1;
4662 goto free_active_name;
4663 }
4664 ct_cnt++;
4665 }
4666 free(active_name[i]);
4667 active_name[i] = NULL;
4668 }
4669 free(active_name);
4670 active_name = NULL;
4671 active_cnt = 0;
4672
4673 for (i = 0, ct_list_cnt = 0; i < ct_cnt && cret; i++) {
4674 struct lxc_container *c;
4675
4676 c = lxc_container_new(ct_name[i], lxcpath);
4677 if (!c) {
4678 WARN("Container %s:%s could not be loaded", lxcpath, ct_name[i]);
4679 remove_from_array(&ct_name, ct_name[i], ct_cnt--);
4680 continue;
4681 }
4682
4683 if (!add_to_clist(&ct_list, c, ct_list_cnt, false)) {
4684 lxc_container_put(c);
4685 ret = -1;
4686 goto free_ct_list;
4687 }
4688 ct_list_cnt++;
4689 }
4690
4691 if (cret)
4692 *cret = ct_list;
4693
4694 if (nret)
4695 *nret = ct_name;
4696 else {
4697 ret = ct_cnt;
4698 goto free_ct_name;
4699 }
4700 return ct_cnt;
4701
4702 free_ct_list:
4703 for (i = 0; i < ct_list_cnt; i++) {
4704 lxc_container_put(ct_list[i]);
4705 }
4706 free(ct_list);
4707
4708 free_active_name:
4709 for (i = 0; i < active_cnt; i++) {
4710 free(active_name[i]);
4711 }
4712 free(active_name);
4713
4714 free_ct_name:
4715 for (i = 0; i < ct_cnt; i++) {
4716 free(ct_name[i]);
4717 }
4718 free(ct_name);
4719 return ret;
4720 }
LXC mirror