]> git.proxmox.com Git - mirror_lxc.git/blob - src/lxc/lxccontainer.c
projects / mirror_lxc.git / blob
? search:
summary | shortlog | log | commit | commitdiff | tree
blame | history | raw | HEAD
lxccontainer: do_lxcapi_freeze()
[mirror_lxc.git] / src / lxc / lxccontainer.c
1 /* liblxcapi
2 *
3 * Copyright © 2012 Serge Hallyn <serge.hallyn@ubuntu.com>.
4 * Copyright © 2012 Canonical Ltd.
5 *
6 * This library is free software; you can redistribute it and/or
7 * modify it under the terms of the GNU Lesser General Public
8 * License as published by the Free Software Foundation; either
9 * version 2.1 of the License, or (at your option) any later version.
10
11 * This library is distributed in the hope that it will be useful,
12 * but WITHOUT ANY WARRANTY; without even the implied warranty of
13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
14 * Lesser General Public License for more details.
15
16 * You should have received a copy of the GNU Lesser General Public
17 * License along with this library; if not, write to the Free Software
18 * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
19 */
20
21 #define _GNU_SOURCE
22 #include <dirent.h>
23 #include <errno.h>
24 #include <fcntl.h>
25 #include <grp.h>
26 #include <libgen.h>
27 #include <pthread.h>
28 #include <sched.h>
29 #include <stdarg.h>
30 #include <stdint.h>
31 #include <stdio.h>
32 #include <unistd.h>
33 #include <arpa/inet.h>
34 #include <sys/sysmacros.h>
35 #include <sys/mman.h>
36 #include <sys/mount.h>
37 #include <sys/syscall.h>
38 #include <sys/types.h>
39 #include <sys/wait.h>
40
41 #include "af_unix.h"
42 #include "attach.h"
43 #include "cgroup.h"
44 #include "conf.h"
45 #include "config.h"
46 #include "commands.h"
47 #include "commands_utils.h"
48 #include "confile.h"
49 #include "confile_utils.h"
50 #include "console.h"
51 #include "criu.h"
52 #include "error.h"
53 #include "initutils.h"
54 #include "log.h"
55 #include "lxc.h"
56 #include "lxccontainer.h"
57 #include "lxclock.h"
58 #include "monitor.h"
59 #include "namespace.h"
60 #include "network.h"
61 #include "parse.h"
62 #include "start.h"
63 #include "state.h"
64 #include "storage.h"
65 #include "storage_utils.h"
66 #include "storage/btrfs.h"
67 #include "storage/overlay.h"
68 #include "sync.h"
69 #include "utils.h"
70 #include "version.h"
71
72 /* major()/minor() */
73 #ifdef MAJOR_IN_MKDEV
74 #include <sys/mkdev.h>
75 #endif
76
77 #if HAVE_IFADDRS_H
78 #include <ifaddrs.h>
79 #else
80 #include <../include/ifaddrs.h>
81 #endif
82
83 #if IS_BIONIC
84 #include <../include/lxcmntent.h>
85 #else
86 #include <mntent.h>
87 #endif
88
89 /* Define faccessat() if missing from the C library */
90 #ifndef HAVE_FACCESSAT
91 static int faccessat(int __fd, const char *__file, int __type, int __flag)
92 {
93 #ifdef __NR_faccessat
94 return syscall(__NR_faccessat, __fd, __file, __type, __flag);
95 #else
96 errno = ENOSYS;
97 return -1;
98 #endif
99 }
100 #endif
101
102 lxc_log_define(lxc_container, lxc);
103
104 static bool do_lxcapi_destroy(struct lxc_container *c);
105 static const char *lxcapi_get_config_path(struct lxc_container *c);
106 #define do_lxcapi_get_config_path(c) lxcapi_get_config_path(c)
107 static bool do_lxcapi_set_config_item(struct lxc_container *c, const char *key, const char *v);
108 static bool container_destroy(struct lxc_container *c,
109 struct lxc_storage *storage);
110 static bool get_snappath_dir(struct lxc_container *c, char *snappath);
111 static bool lxcapi_snapshot_destroy_all(struct lxc_container *c);
112 static bool do_lxcapi_save_config(struct lxc_container *c, const char *alt_file);
113
114 static bool config_file_exists(const char *lxcpath, const char *cname)
115 {
116 int ret;
117 size_t len;
118 char *fname;
119
120 /* $lxcpath + '/' + $cname + '/config' + \0 */
121 len = strlen(lxcpath) + strlen(cname) + 9;
122 fname = alloca(len);
123 ret = snprintf(fname, len, "%s/%s/config", lxcpath, cname);
124 if (ret < 0 || (size_t)ret >= len)
125 return false;
126
127 return file_exists(fname);
128 }
129
130 /* A few functions to help detect when a container creation failed. If a
131 * container creation was killed partway through, then trying to actually start
132 * that container could harm the host. We detect this by creating a 'partial'
133 * file under the container directory, and keeping an advisory lock. When
134 * container creation completes, we remove that file. When we load or try to
135 * start a container, if we find that file, without a flock, we remove the
136 * container.
137 */
138 static int ongoing_create(struct lxc_container *c)
139 {
140 int fd, ret;
141 size_t len;
142 char *path;
143 struct flock lk;
144
145 len = strlen(c->config_path) + strlen(c->name) + 10;
146 path = alloca(len);
147 ret = snprintf(path, len, "%s/%s/partial", c->config_path, c->name);
148 if (ret < 0 || (size_t)ret >= len)
149 return -1;
150
151 if (!file_exists(path))
152 return 0;
153
154 fd = open(path, O_RDWR);
155 if (fd < 0)
156 return 0;
157
158 lk.l_type = F_WRLCK;
159 lk.l_whence = SEEK_SET;
160 lk.l_start = 0;
161 lk.l_len = 0;
162 lk.l_pid = -1;
163
164 ret = fcntl(fd, F_GETLK, &lk);
165 close(fd);
166 if (ret == 0 && lk.l_pid != -1) {
167 /* create is still ongoing */
168 return 1;
169 }
170
171 /* Create completed but partial is still there. */
172 return 2;
173 }
174
175 static int create_partial(struct lxc_container *c)
176 {
177 int fd, ret;
178 size_t len;
179 char *path;
180 struct flock lk;
181
182 /* $lxcpath + '/' + $name + '/partial' + \0 */
183 len = strlen(c->config_path) + strlen(c->name) + 10;
184 path = alloca(len);
185 ret = snprintf(path, len, "%s/%s/partial", c->config_path, c->name);
186 if (ret < 0 || (size_t)ret >= len)
187 return -1;
188
189 fd = open(path, O_RDWR | O_CREAT | O_EXCL, 0755);
190 if (fd < 0)
191 return -1;
192
193 lk.l_type = F_WRLCK;
194 lk.l_whence = SEEK_SET;
195 lk.l_start = 0;
196 lk.l_len = 0;
197
198 ret = fcntl(fd, F_SETLKW, &lk);
199 if (ret < 0) {
200 SYSERROR("Failed to lock partial file %s", path);
201 close(fd);
202 return -1;
203 }
204
205 return fd;
206 }
207
208 static void remove_partial(struct lxc_container *c, int fd)
209 {
210 int ret;
211 size_t len;
212 char *path;
213
214 close(fd);
215 /* $lxcpath + '/' + $name + '/partial' + \0 */
216 len = strlen(c->config_path) + strlen(c->name) + 10;
217 path = alloca(len);
218 ret = snprintf(path, len, "%s/%s/partial", c->config_path, c->name);
219 if (ret < 0 || (size_t)ret >= len)
220 return;
221
222 ret = unlink(path);
223 if (ret < 0)
224 SYSERROR("Failed to remove partial file %s", path);
225 }
226
227 /* LOCKING
228 * 1. container_mem_lock(c) protects the struct lxc_container from multiple threads.
229 * 2. container_disk_lock(c) protects the on-disk container data - in particular the
230 * container configuration file.
231 * The container_disk_lock also takes the container_mem_lock.
232 * 3. thread_mutex protects process data (ex: fd table) from multiple threads.
233 * NOTHING mutexes two independent programs with their own struct
234 * lxc_container for the same c->name, between API calls. For instance,
235 * c->config_read(); c->start(); Between those calls, data on disk
236 * could change (which shouldn't bother the caller unless for instance
237 * the rootfs get moved). c->config_read(); update; c->config_write();
238 * Two such updaters could race. The callers should therefore check their
239 * results. Trying to prevent that would necessarily expose us to deadlocks
240 * due to hung callers. So I prefer to keep the locks only within our own
241 * functions, not across functions.
242 *
243 * If you're going to clone while holding a lxccontainer, increment
244 * c->numthreads (under privlock) before forking. When deleting,
245 * decrement numthreads under privlock, then if it hits 0 you can delete.
246 * Do not ever use a lxccontainer whose numthreads you did not bump.
247 */
248
249 static void lxc_container_free(struct lxc_container *c)
250 {
251 if (!c)
252 return;
253
254 free(c->configfile);
255 c->configfile = NULL;
256
257 free(c->error_string);
258 c->error_string = NULL;
259
260 if (c->slock) {
261 lxc_putlock(c->slock);
262 c->slock = NULL;
263 }
264
265 if (c->privlock) {
266 lxc_putlock(c->privlock);
267 c->privlock = NULL;
268 }
269
270 free(c->name);
271 c->name = NULL;
272
273 if (c->lxc_conf) {
274 lxc_conf_free(c->lxc_conf);
275 c->lxc_conf = NULL;
276 }
277
278 free(c->config_path);
279 c->config_path = NULL;
280
281 free(c);
282 }
283
284 /* Consider the following case:
285 *
286 * |====================================================================|
287 * | freer | racing get()er |
288 * |====================================================================|
289 * | lxc_container_put() | lxc_container_get() |
290 * | \ lxclock(c->privlock) | c->numthreads < 1? (no) |
291 * | \ c->numthreads = 0 | \ lxclock(c->privlock) -> waits |
292 * | \ lxcunlock() | \ |
293 * | \ lxc_container_free() | \ lxclock() returns |
294 * | | \ c->numthreads < 1 -> return 0 |
295 * | \ \ (free stuff) | |
296 * | \ \ sem_destroy(privlock) | |
297 * |_______________________________|____________________________________|
298 *
299 * When the get()er checks numthreads the first time, one of the following
300 * is true:
301 * 1. freer has set numthreads = 0. get() returns 0
302 * 2. freer is between lxclock and setting numthreads to 0. get()er will
303 * sem_wait on privlock, get lxclock after freer() drops it, then see
304 * numthreads is 0 and exit without touching lxclock again..
305 * 3. freer has not yet locked privlock. If get()er runs first, then put()er
306 * will see --numthreads = 1 and not call lxc_container_free().
307 */
308
309 int lxc_container_get(struct lxc_container *c)
310 {
311 if (!c)
312 return 0;
313
314 /* If someone else has already started freeing the container, don't try
315 * to take the lock, which may be invalid.
316 */
317 if (c->numthreads < 1)
318 return 0;
319
320 if (container_mem_lock(c))
321 return 0;
322
323 /* Bail without trying to unlock, bc the privlock is now probably in
324 * freed memory.
325 */
326 if (c->numthreads < 1)
327 return 0;
328
329 c->numthreads++;
330 container_mem_unlock(c);
331
332 return 1;
333 }
334
335 int lxc_container_put(struct lxc_container *c)
336 {
337 if (!c)
338 return -1;
339
340 if (container_mem_lock(c))
341 return -1;
342
343 if (--c->numthreads < 1) {
344 container_mem_unlock(c);
345 lxc_container_free(c);
346 return 1;
347 }
348
349 container_mem_unlock(c);
350
351 return 0;
352 }
353
354 static bool do_lxcapi_is_defined(struct lxc_container *c)
355 {
356 int statret;
357 struct stat statbuf;
358 bool ret = false;
359
360 if (!c)
361 return false;
362
363 if (container_mem_lock(c))
364 return false;
365
366 if (!c->configfile)
367 goto on_error;
368
369 statret = stat(c->configfile, &statbuf);
370 if (statret != 0)
371 goto on_error;
372
373 ret = true;
374
375 on_error:
376 container_mem_unlock(c);
377
378 return ret;
379 }
380
381 #define WRAP_API(rettype, fnname) \
382 static rettype fnname(struct lxc_container *c) \
383 { \
384 rettype ret; \
385 bool reset_config = false; \
386 \
387 if (!current_config && c && c->lxc_conf) { \
388 current_config = c->lxc_conf; \
389 reset_config = true; \
390 } \
391 \
392 ret = do_##fnname(c); \
393 if (reset_config) \
394 current_config = NULL; \
395 \
396 return ret; \
397 }
398
399 #define WRAP_API_1(rettype, fnname, t1) \
400 static rettype fnname(struct lxc_container *c, t1 a1) \
401 { \
402 rettype ret; \
403 bool reset_config = false; \
404 \
405 if (!current_config && c && c->lxc_conf) { \
406 current_config = c->lxc_conf; \
407 reset_config = true; \
408 } \
409 \
410 ret = do_##fnname(c, a1); \
411 if (reset_config) \
412 current_config = NULL; \
413 \
414 return ret; \
415 }
416
417 #define WRAP_API_2(rettype, fnname, t1, t2) \
418 static rettype fnname(struct lxc_container *c, t1 a1, t2 a2) \
419 { \
420 rettype ret; \
421 bool reset_config = false; \
422 \
423 if (!current_config && c && c->lxc_conf) { \
424 current_config = c->lxc_conf; \
425 reset_config = true; \
426 } \
427 \
428 ret = do_##fnname(c, a1, a2); \
429 if (reset_config) \
430 current_config = NULL; \
431 \
432 return ret; \
433 }
434
435 #define WRAP_API_3(rettype, fnname, t1, t2, t3) \
436 static rettype fnname(struct lxc_container *c, t1 a1, t2 a2, t3 a3) \
437 { \
438 rettype ret; \
439 bool reset_config = false; \
440 \
441 if (!current_config && c && c->lxc_conf) { \
442 current_config = c->lxc_conf; \
443 reset_config = true; \
444 } \
445 \
446 ret = do_##fnname(c, a1, a2, a3); \
447 if (reset_config) \
448 current_config = NULL; \
449 \
450 return ret; \
451 }
452
453 WRAP_API(bool, lxcapi_is_defined)
454
455 static const char *do_lxcapi_state(struct lxc_container *c)
456 {
457 lxc_state_t s;
458
459 if (!c)
460 return NULL;
461
462 s = lxc_getstate(c->name, c->config_path);
463 return lxc_state2str(s);
464 }
465
466 WRAP_API(const char *, lxcapi_state)
467
468 static bool is_stopped(struct lxc_container *c)
469 {
470 lxc_state_t s;
471
472 s = lxc_getstate(c->name, c->config_path);
473 return (s == STOPPED);
474 }
475
476 static bool do_lxcapi_is_running(struct lxc_container *c)
477 {
478 const char *s;
479
480 if (!c)
481 return false;
482
483 s = do_lxcapi_state(c);
484 if (!s || strcmp(s, "STOPPED") == 0)
485 return false;
486
487 return true;
488 }
489
490 WRAP_API(bool, lxcapi_is_running)
491
492 static bool do_lxcapi_freeze(struct lxc_container *c)
493 {
494 int ret;
495
496 if (!c)
497 return false;
498
499 ret = lxc_freeze(c->name, c->config_path);
500 if (ret)
501 return false;
502
503 return true;
504 }
505
506 WRAP_API(bool, lxcapi_freeze)
507
508 static bool do_lxcapi_unfreeze(struct lxc_container *c)
509 {
510 int ret;
511 if (!c)
512 return false;
513
514 ret = lxc_unfreeze(c->name, c->config_path);
515 if (ret)
516 return false;
517 return true;
518 }
519
520 WRAP_API(bool, lxcapi_unfreeze)
521
522 static int do_lxcapi_console_getfd(struct lxc_container *c, int *ttynum, int *masterfd)
523 {
524 int ttyfd;
525 if (!c)
526 return -1;
527
528 ttyfd = lxc_console_getfd(c, ttynum, masterfd);
529 return ttyfd;
530 }
531
532 WRAP_API_2(int, lxcapi_console_getfd, int *, int *)
533
534 static int lxcapi_console(struct lxc_container *c, int ttynum, int stdinfd,
535 int stdoutfd, int stderrfd, int escape)
536 {
537 int ret;
538
539 if (!c)
540 return -1;
541
542 current_config = c->lxc_conf;
543 ret = lxc_console(c, ttynum, stdinfd, stdoutfd, stderrfd, escape);
544 current_config = NULL;
545 return ret;
546 }
547
548 static int do_lxcapi_console_log(struct lxc_container *c, struct lxc_console_log *log)
549 {
550 int ret;
551
552 ret = lxc_cmd_console_log(c->name, do_lxcapi_get_config_path(c), log);
553 if (ret < 0) {
554 if (ret == -ENODATA)
555 NOTICE("The console log is empty");
556 else if (ret == -EFAULT)
557 NOTICE("The container does not keep a console log");
558 else if (ret == -ENOENT)
559 NOTICE("The container does not keep a console log file");
560 else if (ret == -EIO)
561 NOTICE("Failed to write console log to log file");
562 else
563 ERROR("Failed to retrieve console log");
564 }
565
566 return ret;
567 }
568
569 WRAP_API_1(int, lxcapi_console_log, struct lxc_console_log *)
570
571 static pid_t do_lxcapi_init_pid(struct lxc_container *c)
572 {
573 if (!c)
574 return -1;
575
576 return lxc_cmd_get_init_pid(c->name, c->config_path);
577 }
578
579 WRAP_API(pid_t, lxcapi_init_pid)
580
581 static bool load_config_locked(struct lxc_container *c, const char *fname)
582 {
583 if (!c->lxc_conf)
584 c->lxc_conf = lxc_conf_init();
585 if (!c->lxc_conf)
586 return false;
587 if (lxc_config_read(fname, c->lxc_conf, false) != 0)
588 return false;
589 return true;
590 }
591
592 static bool do_lxcapi_load_config(struct lxc_container *c, const char *alt_file)
593 {
594 bool ret = false, need_disklock = false;
595 int lret;
596 const char *fname;
597 if (!c)
598 return false;
599
600 fname = c->configfile;
601 if (alt_file)
602 fname = alt_file;
603 if (!fname)
604 return false;
605 /*
606 * If we're reading something other than the container's config,
607 * we only need to lock the in-memory container. If loading the
608 * container's config file, take the disk lock.
609 */
610 if (strcmp(fname, c->configfile) == 0)
611 need_disklock = true;
612
613 if (need_disklock)
614 lret = container_disk_lock(c);
615 else
616 lret = container_mem_lock(c);
617 if (lret)
618 return false;
619
620 ret = load_config_locked(c, fname);
621
622 if (need_disklock)
623 container_disk_unlock(c);
624 else
625 container_mem_unlock(c);
626 return ret;
627 }
628
629 WRAP_API_1(bool, lxcapi_load_config, const char *)
630
631 static bool do_lxcapi_want_daemonize(struct lxc_container *c, bool state)
632 {
633 if (!c || !c->lxc_conf)
634 return false;
635 if (container_mem_lock(c)) {
636 ERROR("Error getting mem lock");
637 return false;
638 }
639 c->daemonize = state;
640 container_mem_unlock(c);
641 return true;
642 }
643
644 WRAP_API_1(bool, lxcapi_want_daemonize, bool)
645
646 static bool do_lxcapi_want_close_all_fds(struct lxc_container *c, bool state)
647 {
648 if (!c || !c->lxc_conf)
649 return false;
650 if (container_mem_lock(c)) {
651 ERROR("Error getting mem lock");
652 return false;
653 }
654 c->lxc_conf->close_all_fds = state;
655 container_mem_unlock(c);
656 return true;
657 }
658
659 WRAP_API_1(bool, lxcapi_want_close_all_fds, bool)
660
661 static bool do_lxcapi_wait(struct lxc_container *c, const char *state, int timeout)
662 {
663 int ret;
664
665 if (!c)
666 return false;
667
668 ret = lxc_wait(c->name, state, timeout, c->config_path);
669 return ret == 0;
670 }
671
672 WRAP_API_2(bool, lxcapi_wait, const char *, int)
673
674 static bool am_single_threaded(void)
675 {
676 struct dirent *direntp;
677 DIR *dir;
678 int count=0;
679
680 dir = opendir("/proc/self/task");
681 if (!dir) {
682 INFO("failed to open /proc/self/task");
683 return false;
684 }
685
686 while ((direntp = readdir(dir))) {
687 if (!strcmp(direntp->d_name, "."))
688 continue;
689
690 if (!strcmp(direntp->d_name, ".."))
691 continue;
692 if (++count > 1)
693 break;
694 }
695 closedir(dir);
696 return count == 1;
697 }
698
699 static void push_arg(char ***argp, char *arg, int *nargs)
700 {
701 char **argv;
702 char *copy;
703
704 do {
705 copy = strdup(arg);
706 } while (!copy);
707 do {
708 argv = realloc(*argp, (*nargs + 2) * sizeof(char *));
709 } while (!argv);
710 *argp = argv;
711 argv[*nargs] = copy;
712 (*nargs)++;
713 argv[*nargs] = NULL;
714 }
715
716 static char **split_init_cmd(const char *incmd)
717 {
718 size_t len;
719 int nargs = 0;
720 char *copy, *p, *saveptr = NULL;
721 char **argv;
722
723 if (!incmd)
724 return NULL;
725
726 len = strlen(incmd) + 1;
727 copy = alloca(len);
728 strncpy(copy, incmd, len);
729 copy[len-1] = '\0';
730
731 do {
732 argv = malloc(sizeof(char *));
733 } while (!argv);
734 argv[0] = NULL;
735 for (p = strtok_r(copy, " ", &saveptr); p != NULL;
736 p = strtok_r(NULL, " ", &saveptr))
737 push_arg(&argv, p, &nargs);
738
739 if (nargs == 0) {
740 free(argv);
741 return NULL;
742 }
743 return argv;
744 }
745
746 static void free_init_cmd(char **argv)
747 {
748 int i = 0;
749
750 if (!argv)
751 return;
752 while (argv[i])
753 free(argv[i++]);
754 free(argv);
755 }
756
757 static int lxc_rcv_status(int state_socket)
758 {
759 int ret;
760 int state = -1;
761
762 again:
763 /* Receive container state. */
764 ret = lxc_abstract_unix_rcv_credential(state_socket, &state,
765 sizeof(int));
766 if (ret <= 0) {
767 if (errno != EINTR)
768 return -1;
769 TRACE("Caught EINTR; retrying");
770 goto again;
771 }
772
773 return state;
774 }
775
776 static bool wait_on_daemonized_start(struct lxc_handler *handler, int pid)
777 {
778 int ret, state;
779
780 /* Close write end of the socket pair. */
781 close(handler->state_socket_pair[1]);
782 handler->state_socket_pair[1] = -1;
783
784 state = lxc_rcv_status(handler->state_socket_pair[0]);
785
786 /* Close read end of the socket pair. */
787 close(handler->state_socket_pair[0]);
788 handler->state_socket_pair[0] = -1;
789
790 /* The first child is going to fork() again and then exits. So we reap
791 * the first child here.
792 */
793 ret = wait_for_pid(pid);
794 if (ret < 0)
795 DEBUG("Failed waiting on first child %d", pid);
796 else
797 DEBUG("First child %d exited", pid);
798
799 if (state < 0) {
800 SYSERROR("Failed to receive the container state");
801 return false;
802 }
803
804 /* If we receive anything else then running we know that the container
805 * failed to start.
806 */
807 if (state != RUNNING) {
808 ERROR("Received container state \"%s\" instead of \"RUNNING\"",
809 lxc_state2str(state));
810 return false;
811 }
812
813 TRACE("Container is in \"RUNNING\" state");
814 return true;
815 }
816
817 static bool do_lxcapi_start(struct lxc_container *c, int useinit, char * const argv[])
818 {
819 int ret;
820 struct lxc_handler *handler;
821 struct lxc_conf *conf;
822 bool daemonize = false;
823 FILE *pid_fp = NULL;
824 char *default_args[] = {
825 "/sbin/init",
826 NULL,
827 };
828 char **init_cmd = NULL;
829 int keepfds[3] = {-1, -1, -1};
830
831 /* container does exist */
832 if (!c)
833 return false;
834
835 /* If anything fails before we set error_num, we want an error in there.
836 */
837 c->error_num = 1;
838
839 /* Container has not been setup. */
840 if (!c->lxc_conf)
841 return false;
842
843 ret = ongoing_create(c);
844 if (ret < 0) {
845 ERROR("Failed checking for incomplete container creation");
846 return false;
847 } else if (ret == 1) {
848 ERROR("Ongoing container creation detected");
849 return false;
850 } else if (ret == 2) {
851 ERROR("Failed to create container");
852 do_lxcapi_destroy(c);
853 return false;
854 }
855
856 if (container_mem_lock(c))
857 return false;
858 conf = c->lxc_conf;
859 daemonize = c->daemonize;
860
861 /* initialize handler */
862 handler = lxc_init_handler(c->name, conf, c->config_path, daemonize);
863 container_mem_unlock(c);
864 if (!handler)
865 return false;
866
867 if (!argv) {
868 if (useinit && conf->execute_cmd)
869 argv = init_cmd = split_init_cmd(conf->execute_cmd);
870 else
871 argv = init_cmd = split_init_cmd(conf->init_cmd);
872 }
873
874 /* ... otherwise use default_args. */
875 if (!argv) {
876 if (useinit) {
877 ERROR("No valid init detected");
878 lxc_free_handler(handler);
879 return false;
880 }
881 argv = default_args;
882 }
883
884 /* I'm not sure what locks we want here.Any? Is liblxc's locking enough
885 * here to protect the on disk container? We don't want to exclude
886 * things like lxc_info while the container is running.
887 */
888 if (daemonize) {
889 bool started;
890 char title[2048];
891 pid_t pid;
892
893 pid = fork();
894 if (pid < 0) {
895 free_init_cmd(init_cmd);
896 lxc_free_handler(handler);
897 return false;
898 }
899
900 /* first parent */
901 if (pid != 0) {
902 /* Set to NULL because we don't want father unlink
903 * the PID file, child will do the free and unlink.
904 */
905 c->pidfile = NULL;
906
907 /* Wait for container to tell us whether it started
908 * successfully.
909 */
910 started = wait_on_daemonized_start(handler, pid);
911
912 free_init_cmd(init_cmd);
913 lxc_free_handler(handler);
914 return started;
915 }
916
917 /* first child */
918
919 /* We don't really care if this doesn't print all the
920 * characters. All that it means is that the proctitle will be
921 * ugly. Similarly, we also don't care if setproctitle() fails.
922 * */
923 snprintf(title, sizeof(title), "[lxc monitor] %s %s", c->config_path, c->name);
924 INFO("Attempting to set proc title to %s", title);
925 setproctitle(title);
926
927 /* We fork() a second time to be reparented to init. Like
928 * POSIX's daemon() function we change to "/" and redirect
929 * std{in,out,err} to /dev/null.
930 */
931 pid = fork();
932 if (pid < 0) {
933 SYSERROR("Failed to fork first child process");
934 _exit(EXIT_FAILURE);
935 }
936
937 /* second parent */
938 if (pid != 0) {
939 free_init_cmd(init_cmd);
940 lxc_free_handler(handler);
941 _exit(EXIT_SUCCESS);
942 }
943
944 /* second child */
945
946 /* change to / directory */
947 ret = chdir("/");
948 if (ret < 0) {
949 SYSERROR("Failed to change to \"/\" directory");
950 _exit(EXIT_FAILURE);
951 }
952
953 keepfds[0] = handler->conf->maincmd_fd;
954 keepfds[1] = handler->state_socket_pair[0];
955 keepfds[2] = handler->state_socket_pair[1];
956 ret = lxc_check_inherited(conf, true, keepfds,
957 sizeof(keepfds) / sizeof(keepfds[0]));
958 if (ret < 0)
959 _exit(EXIT_FAILURE);
960
961 /* redirect std{in,out,err} to /dev/null */
962 ret = null_stdfds();
963 if (ret < 0) {
964 ERROR("Failed to redirect std{in,out,err} to /dev/null");
965 _exit(EXIT_FAILURE);
966 }
967
968 /* become session leader */
969 ret = setsid();
970 if (ret < 0)
971 TRACE("Process %d is already process group leader", lxc_raw_getpid());
972 } else {
973 if (!am_single_threaded()) {
974 ERROR("Cannot start non-daemonized container when threaded");
975 free_init_cmd(init_cmd);
976 lxc_free_handler(handler);
977 return false;
978 }
979 }
980
981 /* We need to write PID file after daemonize, so we always
982 * write the right PID.
983 */
984 if (c->pidfile) {
985 pid_fp = fopen(c->pidfile, "w");
986 if (pid_fp == NULL) {
987 SYSERROR("Failed to create pidfile '%s' for '%s'",
988 c->pidfile, c->name);
989 free_init_cmd(init_cmd);
990 lxc_free_handler(handler);
991 if (daemonize)
992 _exit(EXIT_FAILURE);
993 return false;
994 }
995
996 if (fprintf(pid_fp, "%d\n", lxc_raw_getpid()) < 0) {
997 SYSERROR("Failed to write '%s'", c->pidfile);
998 fclose(pid_fp);
999 pid_fp = NULL;
1000 free_init_cmd(init_cmd);
1001 lxc_free_handler(handler);
1002 if (daemonize)
1003 _exit(EXIT_FAILURE);
1004 return false;
1005 }
1006
1007 fclose(pid_fp);
1008 pid_fp = NULL;
1009 }
1010
1011 conf->reboot = 0;
1012
1013 /* Unshare the mount namespace if requested */
1014 if (conf->monitor_unshare) {
1015 ret = unshare(CLONE_NEWNS);
1016 if (ret < 0) {
1017 SYSERROR("failed to unshare mount namespace");
1018 lxc_free_handler(handler);
1019 ret = 1;
1020 goto on_error;
1021 }
1022
1023 ret = mount(NULL, "/", NULL, MS_SLAVE|MS_REC, NULL);
1024 if (ret < 0) {
1025 SYSERROR("Failed to make / rslave at startup");
1026 lxc_free_handler(handler);
1027 ret = 1;
1028 goto on_error;
1029 }
1030 }
1031
1032 reboot:
1033 if (conf->reboot == 2) {
1034 /* initialize handler */
1035 handler = lxc_init_handler(c->name, conf, c->config_path, daemonize);
1036 if (!handler) {
1037 ret = 1;
1038 goto on_error;
1039 }
1040 }
1041
1042 keepfds[0] = handler->conf->maincmd_fd;
1043 keepfds[1] = handler->state_socket_pair[0];
1044 keepfds[2] = handler->state_socket_pair[1];
1045 ret = lxc_check_inherited(conf, daemonize, keepfds,
1046 sizeof(keepfds) / sizeof(keepfds[0]));
1047 if (ret < 0) {
1048 lxc_free_handler(handler);
1049 ret = 1;
1050 goto on_error;
1051 }
1052
1053 if (useinit)
1054 ret = lxc_execute(c->name, argv, 1, handler, c->config_path, daemonize);
1055 else
1056 ret = lxc_start(c->name, argv, handler, c->config_path, daemonize);
1057 c->error_num = handler->exit_status;
1058
1059 if (conf->reboot == 1) {
1060 INFO("Container requested reboot");
1061 conf->reboot = 2;
1062 goto reboot;
1063 }
1064
1065 on_error:
1066 if (c->pidfile) {
1067 unlink(c->pidfile);
1068 free(c->pidfile);
1069 c->pidfile = NULL;
1070 }
1071 free_init_cmd(init_cmd);
1072
1073 if (daemonize && ret != 0)
1074 _exit(EXIT_FAILURE);
1075 else if (daemonize)
1076 _exit(EXIT_SUCCESS);
1077
1078 if (ret != 0)
1079 return false;
1080
1081 return true;
1082 }
1083
1084 static bool lxcapi_start(struct lxc_container *c, int useinit, char * const argv[])
1085 {
1086 bool ret;
1087 current_config = c ? c->lxc_conf : NULL;
1088 ret = do_lxcapi_start(c, useinit, argv);
1089 current_config = NULL;
1090 return ret;
1091 }
1092
1093 /*
1094 * note there MUST be an ending NULL
1095 */
1096 static bool lxcapi_startl(struct lxc_container *c, int useinit, ...)
1097 {
1098 va_list ap;
1099 char **inargs = NULL;
1100 bool bret = false;
1101
1102 /* container exists */
1103 if (!c)
1104 return false;
1105
1106 current_config = c->lxc_conf;
1107
1108 va_start(ap, useinit);
1109 inargs = lxc_va_arg_list_to_argv(ap, 0, 1);
1110 va_end(ap);
1111
1112 if (!inargs) {
1113 ERROR("Memory allocation error.");
1114 goto out;
1115 }
1116
1117 /* pass NULL if no arguments were supplied */
1118 bret = do_lxcapi_start(c, useinit, *inargs ? inargs : NULL);
1119
1120 out:
1121 if (inargs) {
1122 char **arg;
1123 for (arg = inargs; *arg; arg++)
1124 free(*arg);
1125 free(inargs);
1126 }
1127
1128 current_config = NULL;
1129 return bret;
1130 }
1131
1132 static bool do_lxcapi_stop(struct lxc_container *c)
1133 {
1134 int ret;
1135
1136 if (!c)
1137 return false;
1138
1139 ret = lxc_cmd_stop(c->name, c->config_path);
1140
1141 return ret == 0;
1142 }
1143
1144 WRAP_API(bool, lxcapi_stop)
1145
1146 static int do_create_container_dir(const char *path, struct lxc_conf *conf)
1147 {
1148 int ret = -1, lasterr;
1149 char *p = alloca(strlen(path)+1);
1150 mode_t mask = umask(0002);
1151 ret = mkdir(path, 0770);
1152 lasterr = errno;
1153 umask(mask);
1154 errno = lasterr;
1155 if (ret) {
1156 if (errno == EEXIST)
1157 ret = 0;
1158 else {
1159 SYSERROR("failed to create container path %s", path);
1160 return -1;
1161 }
1162 }
1163 strcpy(p, path);
1164 if (!lxc_list_empty(&conf->id_map) && chown_mapped_root(p, conf) != 0) {
1165 ERROR("Failed to chown container dir");
1166 ret = -1;
1167 }
1168 return ret;
1169 }
1170
1171 /*
1172 * create the standard expected container dir
1173 */
1174 static bool create_container_dir(struct lxc_container *c)
1175 {
1176 char *s;
1177 int len, ret;
1178
1179 len = strlen(c->config_path) + strlen(c->name) + 2;
1180 s = malloc(len);
1181 if (!s)
1182 return false;
1183 ret = snprintf(s, len, "%s/%s", c->config_path, c->name);
1184 if (ret < 0 || ret >= len) {
1185 free(s);
1186 return false;
1187 }
1188 ret = do_create_container_dir(s, c->lxc_conf);
1189 free(s);
1190 return ret == 0;
1191 }
1192
1193 /* do_storage_create: thin wrapper around storage_create(). Like
1194 * storage_create(), it returns a mounted bdev on success, NULL on error.
1195 */
1196 static struct lxc_storage *do_storage_create(struct lxc_container *c,
1197 const char *type,
1198 struct bdev_specs *specs)
1199 {
1200 int ret;
1201 size_t len;
1202 char *dest;
1203 struct lxc_storage *bdev;
1204
1205 /* rootfs.path or lxcpath/lxcname/rootfs */
1206 if (c->lxc_conf->rootfs.path &&
1207 (access(c->lxc_conf->rootfs.path, F_OK) == 0)) {
1208 const char *rpath = c->lxc_conf->rootfs.path;
1209 len = strlen(rpath) + 1;
1210 dest = alloca(len);
1211 ret = snprintf(dest, len, "%s", rpath);
1212 } else {
1213 const char *lxcpath = do_lxcapi_get_config_path(c);
1214 len = strlen(c->name) + strlen(lxcpath) + 9;
1215 dest = alloca(len);
1216 ret = snprintf(dest, len, "%s/%s/rootfs", lxcpath, c->name);
1217 }
1218 if (ret < 0 || (size_t)ret >= len)
1219 return NULL;
1220
1221 bdev = storage_create(dest, type, c->name, specs);
1222 if (!bdev) {
1223 ERROR("Failed to create \"%s\" storage", type);
1224 return NULL;
1225 }
1226
1227 if (!c->set_config_item(c, "lxc.rootfs.path", bdev->src)) {
1228 ERROR("Failed to set \"lxc.rootfs.path = %s\"", bdev->src);
1229 return NULL;
1230 }
1231
1232 /* If we are not root, chown the rootfs dir to root in the target user
1233 * namespace.
1234 */
1235 ret = geteuid();
1236 if (ret != 0 || (c->lxc_conf && !lxc_list_empty(&c->lxc_conf->id_map))) {
1237 ret = chown_mapped_root(bdev->dest, c->lxc_conf);
1238 if (ret < 0) {
1239 ERROR("Error chowning \"%s\" to container root", bdev->dest);
1240 suggest_default_idmap();
1241 storage_put(bdev);
1242 return NULL;
1243 }
1244 }
1245
1246 return bdev;
1247 }
1248
1249 static char *lxcbasename(char *path)
1250 {
1251 char *p;
1252
1253 p = path + strlen(path) - 1;
1254 while (*p != '/' && p > path)
1255 p--;
1256
1257 return p;
1258 }
1259
1260 static bool create_run_template(struct lxc_container *c, char *tpath,
1261 bool need_null_stdfds, char *const argv[])
1262 {
1263 int ret;
1264 pid_t pid;
1265
1266 if (!tpath)
1267 return true;
1268
1269 pid = fork();
1270 if (pid < 0) {
1271 SYSERROR("Failed to fork task for container creation template");
1272 return false;
1273 }
1274
1275 if (pid == 0) { /* child */
1276 int i, len;
1277 char *namearg, *patharg, *rootfsarg;
1278 char **newargv;
1279 int nargs = 0;
1280 struct lxc_storage *bdev = NULL;
1281 struct lxc_conf *conf = c->lxc_conf;
1282 uid_t euid;
1283
1284 if (need_null_stdfds) {
1285 ret = null_stdfds();
1286 if (ret < 0)
1287 _exit(EXIT_FAILURE);
1288 }
1289
1290 bdev = storage_init(c->lxc_conf);
1291 if (!bdev) {
1292 ERROR("Failed to initialize storage");
1293 _exit(EXIT_FAILURE);
1294 }
1295
1296 euid = geteuid();
1297 if (euid == 0) {
1298 ret = unshare(CLONE_NEWNS);
1299 if (ret < 0) {
1300 ERROR("Failed to unshare CLONE_NEWNS");
1301 _exit(EXIT_FAILURE);
1302 }
1303
1304 ret = detect_shared_rootfs();
1305 if (ret == 1) {
1306 ret = mount(NULL, "/", NULL, MS_SLAVE | MS_REC, NULL);
1307 if (ret < 0) {
1308 SYSERROR("Failed to make \"/\" rslave");
1309 ERROR("Continuing...");
1310 }
1311 }
1312 }
1313
1314 if (strcmp(bdev->type, "dir") != 0 && strcmp(bdev->type, "btrfs") != 0) {
1315 if (euid != 0) {
1316 ERROR("Unprivileged users can only create "
1317 "btrfs and directory-backed containers");
1318 _exit(EXIT_FAILURE);
1319 }
1320
1321 if (strcmp(bdev->type, "overlay") == 0 ||
1322 strcmp(bdev->type, "overlayfs") == 0) {
1323 /* If we create an overlay container we need to
1324 * rsync the contents into
1325 * <container-path>/<container-name>/rootfs.
1326 * However, the overlay mount function will
1327 * mount will mount
1328 * <container-path>/<container-name>/delta0
1329 * over
1330 * <container-path>/<container-name>/rootfs
1331 * which means we would rsync the rootfs into
1332 * the delta directory. That doesn't make sense
1333 * since the delta directory only exists to
1334 * record the differences to
1335 * <container-path>/<container-name>/rootfs. So
1336 * let's simply bind-mount here and then rsync
1337 * directly into
1338 * <container-path>/<container-name>/rootfs.
1339 */
1340 char *src;
1341
1342 src = ovl_get_rootfs(bdev->src, &(size_t){0});
1343 if (!src) {
1344 ERROR("Failed to get rootfs");
1345 _exit(EXIT_FAILURE);
1346 }
1347
1348 ret = mount(src, bdev->dest, "bind", MS_BIND | MS_REC, NULL);
1349 if (ret < 0) {
1350 ERROR("Failed to mount rootfs");
1351 return -1;
1352 }
1353 } else {
1354 ret = bdev->ops->mount(bdev);
1355 if (ret < 0) {
1356 ERROR("Failed to mount rootfs");
1357 _exit(EXIT_FAILURE);
1358 }
1359 }
1360 } else { /* TODO come up with a better way here! */
1361 const char *src;
1362 free(bdev->dest);
1363 src = lxc_storage_get_path(bdev->src, bdev->type);
1364 bdev->dest = strdup(src);
1365 }
1366
1367 /* Create our new array, pre-pend the template name and base
1368 * args.
1369 */
1370 if (argv)
1371 for (nargs = 0; argv[nargs]; nargs++) {
1372 ;
1373 }
1374 /* template, path, rootfs and name args */
1375 nargs += 4;
1376
1377 newargv = malloc(nargs * sizeof(*newargv));
1378 if (!newargv)
1379 _exit(EXIT_FAILURE);
1380 newargv[0] = lxcbasename(tpath);
1381
1382 /* --path */
1383 len = strlen(c->config_path) + strlen(c->name) + strlen("--path=") + 2;
1384 patharg = malloc(len);
1385 if (!patharg)
1386 _exit(EXIT_FAILURE);
1387 ret = snprintf(patharg, len, "--path=%s/%s", c->config_path, c->name);
1388 if (ret < 0 || ret >= len)
1389 _exit(EXIT_FAILURE);
1390 newargv[1] = patharg;
1391
1392 /* --name */
1393 len = strlen("--name=") + strlen(c->name) + 1;
1394 namearg = malloc(len);
1395 if (!namearg)
1396 _exit(EXIT_FAILURE);
1397 ret = snprintf(namearg, len, "--name=%s", c->name);
1398 if (ret < 0 || ret >= len)
1399 _exit(EXIT_FAILURE);
1400 newargv[2] = namearg;
1401
1402 /* --rootfs */
1403 len = strlen("--rootfs=") + 1 + strlen(bdev->dest);
1404 rootfsarg = malloc(len);
1405 if (!rootfsarg)
1406 _exit(EXIT_FAILURE);
1407 ret = snprintf(rootfsarg, len, "--rootfs=%s", bdev->dest);
1408 if (ret < 0 || ret >= len)
1409 _exit(EXIT_FAILURE);
1410 newargv[3] = rootfsarg;
1411
1412 /* add passed-in args */
1413 if (argv)
1414 for (i = 4; i < nargs; i++)
1415 newargv[i] = argv[i - 4];
1416
1417 /* add trailing NULL */
1418 nargs++;
1419 newargv = realloc(newargv, nargs * sizeof(*newargv));
1420 if (!newargv)
1421 _exit(EXIT_FAILURE);
1422 newargv[nargs - 1] = NULL;
1423
1424 /* If we're running the template in a mapped userns, then we
1425 * prepend the template command with: lxc-usernsexec <-m map1>
1426 * ... <-m mapn> -- and we append "--mapped-uid x", where x is
1427 * the mapped uid for our geteuid()
1428 */
1429 if (!lxc_list_empty(&conf->id_map)) {
1430 int extraargs, hostuid_mapped, hostgid_mapped;
1431 char **n2;
1432 char txtuid[20], txtgid[20];
1433 struct lxc_list *it;
1434 struct id_map *map;
1435 int n2args = 1;
1436
1437 n2 = malloc(n2args * sizeof(*n2));
1438 if (!n2)
1439 _exit(EXIT_FAILURE);
1440
1441 newargv[0] = tpath;
1442 tpath = "lxc-usernsexec";
1443 n2[0] = "lxc-usernsexec";
1444 lxc_list_for_each(it, &conf->id_map) {
1445 map = it->elem;
1446 n2args += 2;
1447 n2 = realloc(n2, n2args * sizeof(char *));
1448 if (!n2)
1449 _exit(EXIT_FAILURE);
1450
1451 n2[n2args - 2] = "-m";
1452 n2[n2args - 1] = malloc(200);
1453 if (!n2[n2args - 1])
1454 _exit(EXIT_FAILURE);
1455
1456 ret = snprintf(n2[n2args - 1], 200, "%c:%lu:%lu:%lu",
1457 map->idtype == ID_TYPE_UID ? 'u' : 'g',
1458 map->nsid, map->hostid, map->range);
1459 if (ret < 0 || ret >= 200)
1460 _exit(EXIT_FAILURE);
1461 }
1462
1463 hostuid_mapped = mapped_hostid(geteuid(), conf, ID_TYPE_UID);
1464 extraargs = hostuid_mapped >= 0 ? 1 : 3;
1465 n2 = realloc(n2, (nargs + n2args + extraargs) * sizeof(char *));
1466 if (!n2)
1467 _exit(EXIT_FAILURE);
1468
1469 if (hostuid_mapped < 0) {
1470 hostuid_mapped = find_unmapped_nsid(conf, ID_TYPE_UID);
1471 n2[n2args++] = "-m";
1472 if (hostuid_mapped < 0) {
1473 ERROR("Failed to find free uid to map");
1474 _exit(EXIT_FAILURE);
1475 }
1476
1477 n2[n2args++] = malloc(200);
1478 if (!n2[n2args - 1]) {
1479 SYSERROR("out of memory");
1480 _exit(EXIT_FAILURE);
1481 }
1482 ret = snprintf(n2[n2args - 1], 200, "u:%d:%d:1",
1483 hostuid_mapped, geteuid());
1484 if (ret < 0 || ret >= 200)
1485 _exit(EXIT_FAILURE);
1486 }
1487
1488 hostgid_mapped = mapped_hostid(getegid(), conf, ID_TYPE_GID);
1489 extraargs = hostgid_mapped >= 0 ? 1 : 3;
1490 n2 = realloc(n2, (nargs + n2args + extraargs) * sizeof(char *));
1491 if (!n2)
1492 _exit(EXIT_FAILURE);
1493
1494 if (hostgid_mapped < 0) {
1495 hostgid_mapped = find_unmapped_nsid(conf, ID_TYPE_GID);
1496 n2[n2args++] = "-m";
1497 if (hostgid_mapped < 0) {
1498 ERROR("Failed to find free gid to map");
1499 _exit(EXIT_FAILURE);
1500 }
1501
1502 n2[n2args++] = malloc(200);
1503 if (!n2[n2args - 1]) {
1504 SYSERROR("out of memory");
1505 _exit(EXIT_FAILURE);
1506 }
1507
1508 ret = snprintf(n2[n2args - 1], 200, "g:%d:%d:1",
1509 hostgid_mapped, getegid());
1510 if (ret < 0 || ret >= 200)
1511 _exit(EXIT_FAILURE);
1512 }
1513 n2[n2args++] = "--";
1514 for (i = 0; i < nargs; i++)
1515 n2[i + n2args] = newargv[i];
1516 n2args += nargs;
1517
1518 /* Finally add "--mapped-uid $uid" to tell template what
1519 * to chown cached images to.
1520 */
1521 n2args += 4;
1522 n2 = realloc(n2, n2args * sizeof(char *));
1523 if (!n2)
1524 _exit(EXIT_FAILURE);
1525
1526 /* note n2[n2args-1] is NULL */
1527 n2[n2args - 5] = "--mapped-uid";
1528 snprintf(txtuid, 20, "%d", hostuid_mapped);
1529 n2[n2args - 4] = txtuid;
1530 n2[n2args - 3] = "--mapped-gid";
1531 snprintf(txtgid, 20, "%d", hostgid_mapped);
1532 n2[n2args - 2] = txtgid;
1533 n2[n2args - 1] = NULL;
1534 free(newargv);
1535 newargv = n2;
1536 }
1537
1538 execvp(tpath, newargv);
1539 SYSERROR("Failed to execute template %s", tpath);
1540 _exit(EXIT_FAILURE);
1541 }
1542
1543 ret = wait_for_pid(pid);
1544 if (ret != 0) {
1545 ERROR("Failed to create container from template");
1546 return false;
1547 }
1548
1549 return true;
1550 }
1551
1552 static bool prepend_lxc_header(char *path, const char *t, char *const argv[])
1553 {
1554 long flen;
1555 char *contents;
1556 FILE *f;
1557 int ret = -1;
1558 #if HAVE_LIBGNUTLS
1559 int i;
1560 unsigned char md_value[SHA_DIGEST_LENGTH];
1561 char *tpath;
1562 #endif
1563
1564 f = fopen(path, "r");
1565 if (f == NULL)
1566 return false;
1567
1568 if (fseek(f, 0, SEEK_END) < 0)
1569 goto out_error;
1570 if ((flen = ftell(f)) < 0)
1571 goto out_error;
1572 if (fseek(f, 0, SEEK_SET) < 0)
1573 goto out_error;
1574 if ((contents = malloc(flen + 1)) == NULL)
1575 goto out_error;
1576 if (fread(contents, 1, flen, f) != flen)
1577 goto out_free_contents;
1578
1579 contents[flen] = '\0';
1580 ret = fclose(f);
1581 f = NULL;
1582 if (ret < 0)
1583 goto out_free_contents;
1584
1585 #if HAVE_LIBGNUTLS
1586 tpath = get_template_path(t);
1587 if (!tpath) {
1588 ERROR("bad template: %s", t);
1589 goto out_free_contents;
1590 }
1591
1592 ret = sha1sum_file(tpath, md_value);
1593 if (ret < 0) {
1594 ERROR("Error getting sha1sum of %s", tpath);
1595 free(tpath);
1596 goto out_free_contents;
1597 }
1598 free(tpath);
1599 #endif
1600
1601 f = fopen(path, "w");
1602 if (f == NULL) {
1603 SYSERROR("reopening config for writing");
1604 free(contents);
1605 return false;
1606 }
1607 fprintf(f, "# Template used to create this container: %s\n", t);
1608 if (argv) {
1609 fprintf(f, "# Parameters passed to the template:");
1610 while (*argv) {
1611 fprintf(f, " %s", *argv);
1612 argv++;
1613 }
1614 fprintf(f, "\n");
1615 }
1616 #if HAVE_LIBGNUTLS
1617 fprintf(f, "# Template script checksum (SHA-1): ");
1618 for (i=0; i<SHA_DIGEST_LENGTH; i++)
1619 fprintf(f, "%02x", md_value[i]);
1620 fprintf(f, "\n");
1621 #endif
1622 fprintf(f, "# For additional config options, please look at lxc.container.conf(5)\n");
1623 fprintf(f, "\n# Uncomment the following line to support nesting containers:\n");
1624 fprintf(f, "#lxc.include = " LXCTEMPLATECONFIG "/nesting.conf\n");
1625 fprintf(f, "# (Be aware this has security implications)\n\n");
1626 if (fwrite(contents, 1, flen, f) != flen) {
1627 SYSERROR("Writing original contents");
1628 free(contents);
1629 fclose(f);
1630 return false;
1631 }
1632 ret = 0;
1633 out_free_contents:
1634 free(contents);
1635 out_error:
1636 if (f) {
1637 int newret;
1638 newret = fclose(f);
1639 if (ret == 0)
1640 ret = newret;
1641 }
1642 if (ret < 0) {
1643 SYSERROR("Error prepending header");
1644 return false;
1645 }
1646 return true;
1647 }
1648
1649 static void lxcapi_clear_config(struct lxc_container *c)
1650 {
1651 if (c) {
1652 if (c->lxc_conf) {
1653 lxc_conf_free(c->lxc_conf);
1654 c->lxc_conf = NULL;
1655 }
1656 }
1657 }
1658
1659 #define do_lxcapi_clear_config(c) lxcapi_clear_config(c)
1660
1661 /*
1662 * lxcapi_create:
1663 * create a container with the given parameters.
1664 * @c: container to be created. It has the lxcpath, name, and a starting
1665 * configuration already set
1666 * @t: the template to execute to instantiate the root filesystem and
1667 * adjust the configuration.
1668 * @bdevtype: backing store type to use. If NULL, dir will be used.
1669 * @specs: additional parameters for the backing store, i.e. LVM vg to
1670 * use.
1671 *
1672 * @argv: the arguments to pass to the template, terminated by NULL. If no
1673 * arguments, you can just pass NULL.
1674 */
1675 static bool do_lxcapi_create(struct lxc_container *c, const char *t,
1676 const char *bdevtype, struct bdev_specs *specs,
1677 int flags, char *const argv[])
1678 {
1679 int partial_fd;
1680 pid_t pid;
1681 bool ret = false;
1682 char *tpath = NULL;
1683
1684 if (!c)
1685 return false;
1686
1687 if (t) {
1688 tpath = get_template_path(t);
1689 if (!tpath) {
1690 ERROR("Unknown template \"%s\"", t);
1691 goto out;
1692 }
1693 }
1694
1695 /* If a template is passed in, and the rootfs already is defined in the
1696 * container config and exists, then the caller is trying to create an
1697 * existing container. Return an error, but do NOT delete the container.
1698 */
1699 if (do_lxcapi_is_defined(c) && c->lxc_conf && c->lxc_conf->rootfs.path &&
1700 access(c->lxc_conf->rootfs.path, F_OK) == 0 && tpath) {
1701 ERROR("Container \"%s\" already exists in \"%s\"", c->name,
1702 c->config_path);
1703 goto free_tpath;
1704 }
1705
1706 if (!c->lxc_conf) {
1707 if (!do_lxcapi_load_config(c, lxc_global_config_value("lxc.default_config"))) {
1708 ERROR("Error loading default configuration file %s",
1709 lxc_global_config_value("lxc.default_config"));
1710 goto free_tpath;
1711 }
1712 }
1713
1714 if (!create_container_dir(c))
1715 goto free_tpath;
1716
1717 /* If both template and rootfs.path are set, template is setup as
1718 * rootfs.path. The container is already created if we have a config and
1719 * rootfs.path is accessible
1720 */
1721 if (!c->lxc_conf->rootfs.path && !tpath) {
1722 /* No template passed in and rootfs does not exist. */
1723 if (!c->save_config(c, NULL)) {
1724 ERROR("Failed to save initial config for \"%s\"", c->name);
1725 goto out;
1726 }
1727 ret = true;
1728 goto out;
1729 }
1730
1731 /* Rootfs passed into configuration, but does not exist. */
1732 if (c->lxc_conf->rootfs.path && access(c->lxc_conf->rootfs.path, F_OK) != 0)
1733 goto out;
1734
1735 if (do_lxcapi_is_defined(c) && c->lxc_conf->rootfs.path && !tpath) {
1736 /* Rootfs already existed, user just wanted to save the loaded
1737 * configuration.
1738 */
1739 if (!c->save_config(c, NULL))
1740 ERROR("Failed to save initial config for \"%s\"", c->name);
1741 ret = true;
1742 goto out;
1743 }
1744
1745 /* Mark that this container is being created */
1746 partial_fd = create_partial(c);
1747 if (partial_fd < 0)
1748 goto out;
1749
1750 /* No need to get disk lock bc we have the partial lock. */
1751
1752 /* Create the storage.
1753 * Note we can't do this in the same task as we use to execute the
1754 * template because of the way zfs works.
1755 * After you 'zfs create', zfs mounts the fs only in the initial
1756 * namespace.
1757 */
1758 pid = fork();
1759 if (pid < 0) {
1760 SYSERROR("Failed to fork task for container creation template");
1761 goto out_unlock;
1762 }
1763
1764 if (pid == 0) { /* child */
1765 struct lxc_storage *bdev = NULL;
1766
1767 bdev = do_storage_create(c, bdevtype, specs);
1768 if (!bdev) {
1769 ERROR("Failed to create %s storage for %s",
1770 bdevtype ? bdevtype : "(none)", c->name);
1771 _exit(EXIT_FAILURE);
1772 }
1773
1774 /* Save config file again to store the new rootfs location. */
1775 if (!do_lxcapi_save_config(c, NULL)) {
1776 ERROR("Failed to save initial config for %s", c->name);
1777 /* Parent task won't see the storage driver in the
1778 * config so we delete it.
1779 */
1780 bdev->ops->umount(bdev);
1781 bdev->ops->destroy(bdev);
1782 _exit(EXIT_FAILURE);
1783 }
1784 _exit(EXIT_SUCCESS);
1785 }
1786 if (wait_for_pid(pid) != 0)
1787 goto out_unlock;
1788
1789 /* Reload config to get the rootfs. */
1790 lxc_conf_free(c->lxc_conf);
1791 c->lxc_conf = NULL;
1792 if (!load_config_locked(c, c->configfile))
1793 goto out_unlock;
1794
1795 if (!create_run_template(c, tpath, !!(flags & LXC_CREATE_QUIET), argv))
1796 goto out_unlock;
1797
1798 /* Now clear out the lxc_conf we have, reload from the created
1799 * container.
1800 */
1801 do_lxcapi_clear_config(c);
1802
1803 if (t) {
1804 if (!prepend_lxc_header(c->configfile, tpath, argv)) {
1805 ERROR("Failed to prepend header to config file");
1806 goto out_unlock;
1807 }
1808 }
1809 ret = load_config_locked(c, c->configfile);
1810
1811 out_unlock:
1812 if (partial_fd >= 0)
1813 remove_partial(c, partial_fd);
1814 out:
1815 if (!ret)
1816 container_destroy(c, NULL);
1817 free_tpath:
1818 free(tpath);
1819 return ret;
1820 }
1821
1822 static bool lxcapi_create(struct lxc_container *c, const char *t,
1823 const char *bdevtype, struct bdev_specs *specs,
1824 int flags, char *const argv[])
1825 {
1826 bool ret;
1827 current_config = c ? c->lxc_conf : NULL;
1828 ret = do_lxcapi_create(c, t, bdevtype, specs, flags, argv);
1829 current_config = NULL;
1830 return ret;
1831 }
1832
1833 static bool do_lxcapi_reboot(struct lxc_container *c)
1834 {
1835 pid_t pid;
1836 int rebootsignal = SIGINT;
1837
1838 if (!c)
1839 return false;
1840 if (!do_lxcapi_is_running(c))
1841 return false;
1842 pid = do_lxcapi_init_pid(c);
1843 if (pid <= 0)
1844 return false;
1845 if (c->lxc_conf && c->lxc_conf->rebootsignal)
1846 rebootsignal = c->lxc_conf->rebootsignal;
1847 if (kill(pid, rebootsignal) < 0) {
1848 WARN("Could not send signal %d to pid %d.", rebootsignal, pid);
1849 return false;
1850 }
1851 return true;
1852
1853 }
1854
1855 WRAP_API(bool, lxcapi_reboot)
1856
1857 static bool do_lxcapi_reboot2(struct lxc_container *c, int timeout)
1858 {
1859 int killret, ret;
1860 pid_t pid;
1861 int rebootsignal = SIGINT, state_client_fd = -1;
1862 lxc_state_t states[MAX_STATE] = {0};
1863
1864 if (!c)
1865 return false;
1866
1867 if (!do_lxcapi_is_running(c))
1868 return true;
1869
1870 pid = do_lxcapi_init_pid(c);
1871 if (pid <= 0)
1872 return true;
1873
1874 if (c->lxc_conf && c->lxc_conf->rebootsignal)
1875 rebootsignal = c->lxc_conf->rebootsignal;
1876
1877 /* Add a new state client before sending the shutdown signal so that we
1878 * don't miss a state.
1879 */
1880 if (timeout != 0) {
1881 states[RUNNING] = 2;
1882 ret = lxc_cmd_add_state_client(c->name, c->config_path, states,
1883 &state_client_fd);
1884 if (ret < 0)
1885 return false;
1886
1887 if (state_client_fd < 0)
1888 return false;
1889
1890 if (ret == RUNNING)
1891 return true;
1892
1893 if (ret < MAX_STATE)
1894 return false;
1895 }
1896
1897 /* Send reboot signal to container. */
1898 killret = kill(pid, rebootsignal);
1899 if (killret < 0) {
1900 WARN("Could not send signal %d to pid %d", rebootsignal, pid);
1901 if (state_client_fd >= 0)
1902 close(state_client_fd);
1903 return false;
1904 }
1905 TRACE("Sent signal %d to pid %d", rebootsignal, pid);
1906
1907 if (timeout == 0)
1908 return true;
1909
1910 ret = lxc_cmd_sock_rcv_state(state_client_fd, timeout);
1911 close(state_client_fd);
1912 if (ret < 0)
1913 return false;
1914
1915 TRACE("Received state \"%s\"", lxc_state2str(ret));
1916 if (ret != RUNNING)
1917 return false;
1918
1919 return true;
1920 }
1921
1922 WRAP_API_1(bool, lxcapi_reboot2, int)
1923
1924 static bool do_lxcapi_shutdown(struct lxc_container *c, int timeout)
1925 {
1926 int killret, ret;
1927 pid_t pid;
1928 int haltsignal = SIGPWR, state_client_fd = -1;
1929 lxc_state_t states[MAX_STATE] = {0};
1930
1931 if (!c)
1932 return false;
1933
1934 if (!do_lxcapi_is_running(c))
1935 return true;
1936
1937 pid = do_lxcapi_init_pid(c);
1938 if (pid <= 0)
1939 return true;
1940
1941 /* Detect whether we should send SIGRTMIN + 3 (e.g. systemd). */
1942 if (task_blocking_signal(pid, (SIGRTMIN + 3)))
1943 haltsignal = (SIGRTMIN + 3);
1944
1945 if (c->lxc_conf && c->lxc_conf->haltsignal)
1946 haltsignal = c->lxc_conf->haltsignal;
1947
1948 /* Add a new state client before sending the shutdown signal so that we
1949 * don't miss a state.
1950 */
1951 if (timeout != 0) {
1952 states[STOPPED] = 1;
1953 ret = lxc_cmd_add_state_client(c->name, c->config_path, states,
1954 &state_client_fd);
1955 if (ret < 0)
1956 return false;
1957
1958 if (state_client_fd < 0)
1959 return false;
1960
1961 if (ret == STOPPED)
1962 return true;
1963
1964 if (ret < MAX_STATE)
1965 return false;
1966 }
1967
1968 /* Send shutdown signal to container. */
1969 killret = kill(pid, haltsignal);
1970 if (killret < 0) {
1971 WARN("Could not send signal %d to pid %d", haltsignal, pid);
1972 if (state_client_fd >= 0)
1973 close(state_client_fd);
1974 return false;
1975 }
1976 TRACE("Sent signal %d to pid %d", haltsignal, pid);
1977
1978 if (timeout == 0)
1979 return true;
1980
1981 ret = lxc_cmd_sock_rcv_state(state_client_fd, timeout);
1982 close(state_client_fd);
1983 if (ret < 0)
1984 return false;
1985
1986 TRACE("Received state \"%s\"", lxc_state2str(ret));
1987 if (ret != STOPPED)
1988 return false;
1989
1990 return true;
1991 }
1992
1993 WRAP_API_1(bool, lxcapi_shutdown, int)
1994
1995 static bool lxcapi_createl(struct lxc_container *c, const char *t,
1996 const char *bdevtype, struct bdev_specs *specs, int flags, ...)
1997 {
1998 bool bret = false;
1999 char **args = NULL;
2000 va_list ap;
2001
2002 if (!c)
2003 return false;
2004
2005 current_config = c->lxc_conf;
2006
2007 /*
2008 * since we're going to wait for create to finish, I don't think we
2009 * need to get a copy of the arguments.
2010 */
2011 va_start(ap, flags);
2012 args = lxc_va_arg_list_to_argv(ap, 0, 0);
2013 va_end(ap);
2014 if (!args) {
2015 ERROR("Failed to allocate memory");
2016 goto out;
2017 }
2018
2019 bret = do_lxcapi_create(c, t, bdevtype, specs, flags, args);
2020
2021 out:
2022 free(args);
2023 current_config = NULL;
2024 return bret;
2025 }
2026
2027 static void do_clear_unexp_config_line(struct lxc_conf *conf, const char *key)
2028 {
2029 if (!strcmp(key, "lxc.cgroup"))
2030 return clear_unexp_config_line(conf, key, true);
2031
2032 if (!strcmp(key, "lxc.network"))
2033 return clear_unexp_config_line(conf, key, true);
2034
2035 if (!strcmp(key, "lxc.net"))
2036 return clear_unexp_config_line(conf, key, true);
2037
2038 /* Clear a network with a specific index. */
2039 if (!strncmp(key, "lxc.net.", 8)) {
2040 int ret;
2041 const char *idx;
2042
2043 idx = key + 8;
2044 ret = lxc_safe_uint(idx, &(unsigned int){0});
2045 if (!ret)
2046 return clear_unexp_config_line(conf, key, true);
2047 }
2048
2049 if (!strcmp(key, "lxc.hook"))
2050 return clear_unexp_config_line(conf, key, true);
2051
2052 return clear_unexp_config_line(conf, key, false);
2053 }
2054
2055 static bool do_lxcapi_clear_config_item(struct lxc_container *c,
2056 const char *key)
2057 {
2058 int ret = 1;
2059 struct lxc_config_t *config;
2060
2061 if (!c || !c->lxc_conf)
2062 return false;
2063
2064 if (container_mem_lock(c))
2065 return false;
2066
2067 config = lxc_get_config(key);
2068 /* Verify that the config key exists and that it has a callback
2069 * implemented.
2070 */
2071 if (config && config->clr)
2072 ret = config->clr(key, c->lxc_conf, NULL);
2073 if (!ret)
2074 do_clear_unexp_config_line(c->lxc_conf, key);
2075
2076 container_mem_unlock(c);
2077 return ret == 0;
2078 }
2079
2080 WRAP_API_1(bool, lxcapi_clear_config_item, const char *)
2081
2082 static inline bool enter_net_ns(struct lxc_container *c)
2083 {
2084 pid_t pid = do_lxcapi_init_pid(c);
2085
2086 if ((geteuid() != 0 || (c->lxc_conf && !lxc_list_empty(&c->lxc_conf->id_map))) && access("/proc/self/ns/user", F_OK) == 0) {
2087 if (!switch_to_ns(pid, "user"))
2088 return false;
2089 }
2090 return switch_to_ns(pid, "net");
2091 }
2092
2093 /* Used by qsort and bsearch functions for comparing names. */
2094 static inline int string_cmp(char **first, char **second)
2095 {
2096 return strcmp(*first, *second);
2097 }
2098
2099 /* Used by qsort and bsearch functions for comparing container names. */
2100 static inline int container_cmp(struct lxc_container **first,
2101 struct lxc_container **second)
2102 {
2103 return strcmp((*first)->name, (*second)->name);
2104 }
2105
2106 static bool add_to_array(char ***names, char *cname, int pos)
2107 {
2108 char **newnames = realloc(*names, (pos+1) * sizeof(char *));
2109 if (!newnames) {
2110 ERROR("Out of memory");
2111 return false;
2112 }
2113
2114 *names = newnames;
2115 newnames[pos] = strdup(cname);
2116 if (!newnames[pos])
2117 return false;
2118
2119 /* Sort the arrray as we will use binary search on it. */
2120 qsort(newnames, pos + 1, sizeof(char *),
2121 (int (*)(const void *, const void *))string_cmp);
2122
2123 return true;
2124 }
2125
2126 static bool add_to_clist(struct lxc_container ***list, struct lxc_container *c,
2127 int pos, bool sort)
2128 {
2129 struct lxc_container **newlist = realloc(*list, (pos + 1) * sizeof(struct lxc_container *));
2130 if (!newlist) {
2131 ERROR("Out of memory");
2132 return false;
2133 }
2134
2135 *list = newlist;
2136 newlist[pos] = c;
2137
2138 /* Sort the arrray as we will use binary search on it. */
2139 if (sort)
2140 qsort(newlist, pos + 1, sizeof(struct lxc_container *),
2141 (int (*)(const void *, const void *))container_cmp);
2142
2143 return true;
2144 }
2145
2146 static char** get_from_array(char ***names, char *cname, int size)
2147 {
2148 return (char **)bsearch(&cname, *names, size, sizeof(char *), (int (*)(const void *, const void *))string_cmp);
2149 }
2150
2151
2152 static bool array_contains(char ***names, char *cname, int size) {
2153 if(get_from_array(names, cname, size) != NULL)
2154 return true;
2155 return false;
2156 }
2157
2158 static bool remove_from_array(char ***names, char *cname, int size)
2159 {
2160 char **result = get_from_array(names, cname, size);
2161 if (result != NULL) {
2162 free(result);
2163 return true;
2164 }
2165 return false;
2166 }
2167
2168 static char ** do_lxcapi_get_interfaces(struct lxc_container *c)
2169 {
2170 pid_t pid;
2171 int i, count = 0, pipefd[2];
2172 char **interfaces = NULL;
2173 char interface[IFNAMSIZ];
2174
2175 if(pipe(pipefd) < 0) {
2176 SYSERROR("pipe failed");
2177 return NULL;
2178 }
2179
2180 pid = fork();
2181 if (pid < 0) {
2182 SYSERROR("failed to fork task to get interfaces information");
2183 close(pipefd[0]);
2184 close(pipefd[1]);
2185 return NULL;
2186 }
2187
2188 if (pid == 0) { /* child */
2189 int ret = 1, nbytes;
2190 struct ifaddrs *interfaceArray = NULL, *tempIfAddr = NULL;
2191
2192 /* close the read-end of the pipe */
2193 close(pipefd[0]);
2194
2195 if (!enter_net_ns(c)) {
2196 SYSERROR("failed to enter namespace");
2197 goto out;
2198 }
2199
2200 /* Grab the list of interfaces */
2201 if (getifaddrs(&interfaceArray)) {
2202 SYSERROR("failed to get interfaces list");
2203 goto out;
2204 }
2205
2206 /* Iterate through the interfaces */
2207 for (tempIfAddr = interfaceArray; tempIfAddr != NULL; tempIfAddr = tempIfAddr->ifa_next) {
2208 nbytes = write(pipefd[1], tempIfAddr->ifa_name, IFNAMSIZ);
2209 if (nbytes < 0) {
2210 ERROR("write failed");
2211 goto out;
2212 }
2213 count++;
2214 }
2215 ret = 0;
2216
2217 out:
2218 if (interfaceArray)
2219 freeifaddrs(interfaceArray);
2220
2221 /* close the write-end of the pipe, thus sending EOF to the reader */
2222 close(pipefd[1]);
2223 _exit(ret);
2224 }
2225
2226 /* close the write-end of the pipe */
2227 close(pipefd[1]);
2228
2229 while (read(pipefd[0], &interface, IFNAMSIZ) == IFNAMSIZ) {
2230 interface[IFNAMSIZ - 1] = '\0';
2231
2232 if (array_contains(&interfaces, interface, count))
2233 continue;
2234
2235 if(!add_to_array(&interfaces, interface, count))
2236 ERROR("Failed to add \"%s\" to array", interface);
2237
2238 count++;
2239 }
2240
2241 if (wait_for_pid(pid) != 0) {
2242 for(i=0;i<count;i++)
2243 free(interfaces[i]);
2244 free(interfaces);
2245 interfaces = NULL;
2246 }
2247
2248 /* close the read-end of the pipe */
2249 close(pipefd[0]);
2250
2251 /* Append NULL to the array */
2252 if(interfaces)
2253 interfaces = (char **)lxc_append_null_to_array((void **)interfaces, count);
2254
2255 return interfaces;
2256 }
2257
2258 WRAP_API(char **, lxcapi_get_interfaces)
2259
2260 static char** do_lxcapi_get_ips(struct lxc_container *c, const char* interface, const char* family, int scope)
2261 {
2262 pid_t pid;
2263 int i, count = 0, pipefd[2];
2264 char **addresses = NULL;
2265 char address[INET6_ADDRSTRLEN];
2266
2267 if(pipe(pipefd) < 0) {
2268 SYSERROR("pipe failed");
2269 return NULL;
2270 }
2271
2272 pid = fork();
2273 if (pid < 0) {
2274 SYSERROR("failed to fork task to get container ips");
2275 close(pipefd[0]);
2276 close(pipefd[1]);
2277 return NULL;
2278 }
2279
2280 if (pid == 0) { /* child */
2281 int ret = 1, nbytes;
2282 struct ifaddrs *interfaceArray = NULL, *tempIfAddr = NULL;
2283 char addressOutputBuffer[INET6_ADDRSTRLEN];
2284 void *tempAddrPtr = NULL;
2285 char *address = NULL;
2286
2287 /* close the read-end of the pipe */
2288 close(pipefd[0]);
2289
2290 if (!enter_net_ns(c)) {
2291 SYSERROR("failed to enter namespace");
2292 goto out;
2293 }
2294
2295 /* Grab the list of interfaces */
2296 if (getifaddrs(&interfaceArray)) {
2297 SYSERROR("failed to get interfaces list");
2298 goto out;
2299 }
2300
2301 /* Iterate through the interfaces */
2302 for (tempIfAddr = interfaceArray; tempIfAddr != NULL; tempIfAddr = tempIfAddr->ifa_next) {
2303 if (tempIfAddr->ifa_addr == NULL)
2304 continue;
2305
2306 if(tempIfAddr->ifa_addr->sa_family == AF_INET) {
2307 if (family && strcmp(family, "inet"))
2308 continue;
2309 tempAddrPtr = &((struct sockaddr_in *)tempIfAddr->ifa_addr)->sin_addr;
2310 }
2311 else {
2312 if (family && strcmp(family, "inet6"))
2313 continue;
2314
2315 if (((struct sockaddr_in6 *)tempIfAddr->ifa_addr)->sin6_scope_id != scope)
2316 continue;
2317
2318 tempAddrPtr = &((struct sockaddr_in6 *)tempIfAddr->ifa_addr)->sin6_addr;
2319 }
2320
2321 if (interface && strcmp(interface, tempIfAddr->ifa_name))
2322 continue;
2323 else if (!interface && strcmp("lo", tempIfAddr->ifa_name) == 0)
2324 continue;
2325
2326 address = (char *)inet_ntop(tempIfAddr->ifa_addr->sa_family,
2327 tempAddrPtr,
2328 addressOutputBuffer,
2329 sizeof(addressOutputBuffer));
2330 if (!address)
2331 continue;
2332
2333 nbytes = write(pipefd[1], address, INET6_ADDRSTRLEN);
2334 if (nbytes < 0) {
2335 ERROR("write failed");
2336 goto out;
2337 }
2338 count++;
2339 }
2340 ret = 0;
2341
2342 out:
2343 if(interfaceArray)
2344 freeifaddrs(interfaceArray);
2345
2346 /* close the write-end of the pipe, thus sending EOF to the reader */
2347 close(pipefd[1]);
2348 _exit(ret);
2349 }
2350
2351 /* close the write-end of the pipe */
2352 close(pipefd[1]);
2353
2354 while (read(pipefd[0], &address, INET6_ADDRSTRLEN) == INET6_ADDRSTRLEN) {
2355 if(!add_to_array(&addresses, address, count))
2356 ERROR("PARENT: add_to_array failed");
2357 count++;
2358 }
2359
2360 if (wait_for_pid(pid) != 0) {
2361 for(i=0;i<count;i++)
2362 free(addresses[i]);
2363 free(addresses);
2364 addresses = NULL;
2365 }
2366
2367 /* close the read-end of the pipe */
2368 close(pipefd[0]);
2369
2370 /* Append NULL to the array */
2371 if(addresses)
2372 addresses = (char **)lxc_append_null_to_array((void **)addresses, count);
2373
2374 return addresses;
2375 }
2376
2377 WRAP_API_3(char **, lxcapi_get_ips, const char *, const char *, int)
2378
2379 static int do_lxcapi_get_config_item(struct lxc_container *c, const char *key, char *retv, int inlen)
2380 {
2381 int ret = -1;
2382 struct lxc_config_t *config;
2383
2384 if (!c || !c->lxc_conf)
2385 return -1;
2386
2387 if (container_mem_lock(c))
2388 return -1;
2389
2390 config = lxc_get_config(key);
2391 /* Verify that the config key exists and that it has a callback
2392 * implemented.
2393 */
2394 if (config && config->get)
2395 ret = config->get(key, retv, inlen, c->lxc_conf, NULL);
2396
2397 container_mem_unlock(c);
2398 return ret;
2399 }
2400
2401 WRAP_API_3(int, lxcapi_get_config_item, const char *, char *, int)
2402
2403 static char* do_lxcapi_get_running_config_item(struct lxc_container *c, const char *key)
2404 {
2405 char *ret;
2406
2407 if (!c || !c->lxc_conf)
2408 return NULL;
2409 if (container_mem_lock(c))
2410 return NULL;
2411 ret = lxc_cmd_get_config_item(c->name, key, do_lxcapi_get_config_path(c));
2412 container_mem_unlock(c);
2413 return ret;
2414 }
2415
2416 WRAP_API_1(char *, lxcapi_get_running_config_item, const char *)
2417
2418 static int do_lxcapi_get_keys(struct lxc_container *c, const char *key, char *retv, int inlen)
2419 {
2420 int ret = -1;
2421
2422 /* List all config items. */
2423 if (!key)
2424 return lxc_list_config_items(retv, inlen);
2425
2426 if (!c || !c->lxc_conf)
2427 return -1;
2428
2429 if (container_mem_lock(c))
2430 return -1;
2431
2432 /* Support 'lxc.net.<idx>', i.e. 'lxc.net.0'
2433 * This is an intelligent result to show which keys are valid given the
2434 * type of nic it is.
2435 */
2436 if (strncmp(key, "lxc.net.", 8) == 0)
2437 ret = lxc_list_net(c->lxc_conf, key, retv, inlen);
2438 else
2439 ret = lxc_list_subkeys(c->lxc_conf, key, retv, inlen);
2440
2441 container_mem_unlock(c);
2442 return ret;
2443 }
2444
2445 WRAP_API_3(int, lxcapi_get_keys, const char *, char *, int)
2446
2447 static bool do_lxcapi_save_config(struct lxc_container *c, const char *alt_file)
2448 {
2449 int fd, lret;
2450 bool ret = false, need_disklock = false;
2451
2452 if (!alt_file)
2453 alt_file = c->configfile;
2454 if (!alt_file)
2455 return false;
2456
2457 /* If we haven't yet loaded a config, load the stock config. */
2458 if (!c->lxc_conf) {
2459 if (!do_lxcapi_load_config(c, lxc_global_config_value("lxc.default_config"))) {
2460 ERROR("Error loading default configuration file %s "
2461 "while saving %s",
2462 lxc_global_config_value("lxc.default_config"),
2463 c->name);
2464 return false;
2465 }
2466 }
2467
2468 if (!create_container_dir(c))
2469 return false;
2470
2471 /* If we're writing to the container's config file, take the disk lock.
2472 * Otherwise just take the memlock to protect the struct lxc_container
2473 * while we're traversing it.
2474 */
2475 if (strcmp(c->configfile, alt_file) == 0)
2476 need_disklock = true;
2477
2478 if (need_disklock)
2479 lret = container_disk_lock(c);
2480 else
2481 lret = container_mem_lock(c);
2482
2483 if (lret)
2484 return false;
2485
2486 fd = open(alt_file, O_WRONLY | O_CREAT | O_CLOEXEC,
2487 S_IRUSR | S_IWUSR | S_IRGRP | S_IWGRP | S_IROTH | S_IWOTH);
2488 if (fd < 0)
2489 goto on_error;
2490
2491 lret = write_config(fd, c->lxc_conf);
2492 close(fd);
2493 if (lret < 0)
2494 goto on_error;
2495
2496 ret = true;
2497
2498 on_error:
2499 if (need_disklock)
2500 container_disk_unlock(c);
2501 else
2502 container_mem_unlock(c);
2503
2504 return ret;
2505 }
2506
2507 WRAP_API_1(bool, lxcapi_save_config, const char *)
2508
2509
2510 static bool mod_rdep(struct lxc_container *c0, struct lxc_container *c, bool inc)
2511 {
2512 FILE *f1;
2513 struct stat fbuf;
2514 void *buf = NULL;
2515 char *del = NULL;
2516 char path[MAXPATHLEN];
2517 char newpath[MAXPATHLEN];
2518 int fd, ret, n = 0, v = 0;
2519 bool bret = false;
2520 size_t len = 0, bytes = 0;
2521
2522 if (container_disk_lock(c0))
2523 return false;
2524
2525 ret = snprintf(path, MAXPATHLEN, "%s/%s/lxc_snapshots", c0->config_path, c0->name);
2526 if (ret < 0 || ret > MAXPATHLEN)
2527 goto out;
2528 ret = snprintf(newpath, MAXPATHLEN, "%s\n%s\n", c->config_path, c->name);
2529 if (ret < 0 || ret > MAXPATHLEN)
2530 goto out;
2531
2532 /* If we find an lxc-snapshot file using the old format only listing the
2533 * number of snapshots we will keep using it. */
2534 f1 = fopen(path, "r");
2535 if (f1) {
2536 n = fscanf(f1, "%d", &v);
2537 fclose(f1);
2538 if (n == 1 && v == 0) {
2539 remove(path);
2540 n = 0;
2541 }
2542 }
2543 if (n == 1) {
2544 v += inc ? 1 : -1;
2545 f1 = fopen(path, "w");
2546 if (!f1)
2547 goto out;
2548 if (fprintf(f1, "%d\n", v) < 0) {
2549 ERROR("Error writing new snapshots value");
2550 fclose(f1);
2551 goto out;
2552 }
2553 ret = fclose(f1);
2554 if (ret != 0) {
2555 SYSERROR("Error writing to or closing snapshots file");
2556 goto out;
2557 }
2558 } else {
2559 /* Here we know that we have or can use an lxc-snapshot file
2560 * using the new format. */
2561 if (inc) {
2562 f1 = fopen(path, "a");
2563 if (!f1)
2564 goto out;
2565
2566 if (fprintf(f1, "%s", newpath) < 0) {
2567 ERROR("Error writing new snapshots entry");
2568 ret = fclose(f1);
2569 if (ret != 0)
2570 SYSERROR("Error writing to or closing snapshots file");
2571 goto out;
2572 }
2573
2574 ret = fclose(f1);
2575 if (ret != 0) {
2576 SYSERROR("Error writing to or closing snapshots file");
2577 goto out;
2578 }
2579 } else if (!inc) {
2580 if ((fd = open(path, O_RDWR | O_CLOEXEC)) < 0)
2581 goto out;
2582
2583 if (fstat(fd, &fbuf) < 0) {
2584 close(fd);
2585 goto out;
2586 }
2587
2588 if (fbuf.st_size != 0) {
2589
2590 buf = lxc_strmmap(NULL, fbuf.st_size, PROT_READ | PROT_WRITE, MAP_SHARED, fd, 0);
2591 if (buf == MAP_FAILED) {
2592 SYSERROR("Failed to create mapping %s", path);
2593 close(fd);
2594 goto out;
2595 }
2596
2597 len = strlen(newpath);
2598 while ((del = strstr((char *)buf, newpath))) {
2599 memmove(del, del + len, strlen(del) - len + 1);
2600 bytes += len;
2601 }
2602
2603 lxc_strmunmap(buf, fbuf.st_size);
2604 if (ftruncate(fd, fbuf.st_size - bytes) < 0) {
2605 SYSERROR("Failed to truncate file %s", path);
2606 close(fd);
2607 goto out;
2608 }
2609 }
2610 close(fd);
2611 }
2612
2613 /* If the lxc-snapshot file is empty, remove it. */
2614 if (stat(path, &fbuf) < 0)
2615 goto out;
2616 if (!fbuf.st_size) {
2617 remove(path);
2618 }
2619 }
2620
2621 bret = true;
2622
2623 out:
2624 container_disk_unlock(c0);
2625 return bret;
2626 }
2627
2628 static void strip_newline(char *p)
2629 {
2630 size_t len = strlen(p);
2631 if (len < 1)
2632 return;
2633 if (p[len-1] == '\n')
2634 p[len-1] = '\0';
2635 }
2636
2637 void mod_all_rdeps(struct lxc_container *c, bool inc)
2638 {
2639 struct lxc_container *p;
2640 char *lxcpath = NULL, *lxcname = NULL, path[MAXPATHLEN];
2641 size_t pathlen = 0, namelen = 0;
2642 FILE *f;
2643 int ret;
2644
2645 ret = snprintf(path, MAXPATHLEN, "%s/%s/lxc_rdepends",
2646 c->config_path, c->name);
2647 if (ret < 0 || ret >= MAXPATHLEN) {
2648 ERROR("Path name too long");
2649 return;
2650 }
2651 f = fopen(path, "r");
2652 if (f == NULL)
2653 return;
2654 while (getline(&lxcpath, &pathlen, f) != -1) {
2655 if (getline(&lxcname, &namelen, f) == -1) {
2656 ERROR("badly formatted file %s", path);
2657 goto out;
2658 }
2659 strip_newline(lxcpath);
2660 strip_newline(lxcname);
2661 if ((p = lxc_container_new(lxcname, lxcpath)) == NULL) {
2662 ERROR("Unable to find dependent container %s:%s",
2663 lxcpath, lxcname);
2664 continue;
2665 }
2666 if (!mod_rdep(p, c, inc))
2667 ERROR("Failed to update snapshots file for %s:%s",
2668 lxcpath, lxcname);
2669 lxc_container_put(p);
2670 }
2671 out:
2672 free(lxcpath);
2673 free(lxcname);
2674 fclose(f);
2675 }
2676
2677 static bool has_fs_snapshots(struct lxc_container *c)
2678 {
2679 FILE *f;
2680 char path[MAXPATHLEN];
2681 int ret, v;
2682 struct stat fbuf;
2683 bool bret = false;
2684
2685 ret = snprintf(path, MAXPATHLEN, "%s/%s/lxc_snapshots", c->config_path,
2686 c->name);
2687 if (ret < 0 || ret > MAXPATHLEN)
2688 goto out;
2689 /* If the file doesn't exist there are no snapshots. */
2690 if (stat(path, &fbuf) < 0)
2691 goto out;
2692 v = fbuf.st_size;
2693 if (v != 0) {
2694 f = fopen(path, "r");
2695 if (!f)
2696 goto out;
2697 ret = fscanf(f, "%d", &v);
2698 fclose(f);
2699 /* TODO: Figure out what to do with the return value of fscanf. */
2700 if (ret != 1)
2701 INFO("Container uses new lxc-snapshots format %s", path);
2702 }
2703 bret = v != 0;
2704
2705 out:
2706 return bret;
2707 }
2708
2709 static bool has_snapshots(struct lxc_container *c)
2710 {
2711 char path[MAXPATHLEN];
2712 struct dirent *direntp;
2713 int count=0;
2714 DIR *dir;
2715
2716 if (!get_snappath_dir(c, path))
2717 return false;
2718 dir = opendir(path);
2719 if (!dir)
2720 return false;
2721 while ((direntp = readdir(dir))) {
2722 if (!direntp)
2723 break;
2724
2725 if (!strcmp(direntp->d_name, "."))
2726 continue;
2727
2728 if (!strcmp(direntp->d_name, ".."))
2729 continue;
2730 count++;
2731 break;
2732 }
2733 closedir(dir);
2734 return count > 0;
2735 }
2736
2737 static bool do_destroy_container(struct lxc_conf *conf) {
2738 int ret;
2739
2740 if (am_guest_unpriv()) {
2741 ret = userns_exec_full(conf, storage_destroy_wrapper, conf,
2742 "storage_destroy_wrapper");
2743 if (ret < 0)
2744 return false;
2745
2746 return true;
2747 }
2748
2749 return storage_destroy(conf);
2750 }
2751
2752 static int lxc_rmdir_onedev_wrapper(void *data)
2753 {
2754 char *arg = (char *) data;
2755 return lxc_rmdir_onedev(arg, "snaps");
2756 }
2757
2758 static int lxc_unlink_exec_wrapper(void *data)
2759 {
2760 char *arg = data;
2761 return unlink(arg);
2762 }
2763
2764 static bool container_destroy(struct lxc_container *c,
2765 struct lxc_storage *storage)
2766 {
2767 const char *p1;
2768 size_t len;
2769 struct lxc_conf *conf;
2770 char *path = NULL;
2771 bool bret = false;
2772 int ret = 0;
2773
2774 if (!c || !do_lxcapi_is_defined(c))
2775 return false;
2776
2777 conf = c->lxc_conf;
2778 if (container_disk_lock(c))
2779 return false;
2780
2781 if (!is_stopped(c)) {
2782 /* We should queue some sort of error - in c->error_string? */
2783 ERROR("container %s is not stopped", c->name);
2784 goto out;
2785 }
2786
2787 if (conf && !lxc_list_empty(&conf->hooks[LXCHOOK_DESTROY])) {
2788 /* Start of environment variable setup for hooks */
2789 if (setenv("LXC_NAME", c->name, 1))
2790 SYSERROR("Failed to set environment variable for container name");
2791
2792 if (conf->rcfile && setenv("LXC_CONFIG_FILE", conf->rcfile, 1))
2793 SYSERROR("Failed to set environment variable for config path");
2794
2795 if (conf->rootfs.mount && setenv("LXC_ROOTFS_MOUNT", conf->rootfs.mount, 1))
2796 SYSERROR("Failed to set environment variable for rootfs mount");
2797
2798 if (conf->rootfs.path && setenv("LXC_ROOTFS_PATH", conf->rootfs.path, 1))
2799 SYSERROR("Failed to set environment variable for rootfs mount");
2800
2801 if (conf->console.path && setenv("LXC_CONSOLE", conf->console.path, 1))
2802 SYSERROR("Failed to set environment variable for console path");
2803
2804 if (conf->console.log_path && setenv("LXC_CONSOLE_LOGPATH", conf->console.log_path, 1))
2805 SYSERROR("Failed to set environment variable for console log");
2806 /* End of environment variable setup for hooks */
2807
2808 if (run_lxc_hooks(c->name, "destroy", conf, NULL)) {
2809 ERROR("Failed to execute clone hook for \"%s\"", c->name);
2810 goto out;
2811 }
2812 }
2813
2814 if (current_config && conf == current_config) {
2815 current_config = NULL;
2816 if (conf->logfd != -1) {
2817 close(conf->logfd);
2818 conf->logfd = -1;
2819 }
2820 }
2821
2822 if (conf && conf->rootfs.path && conf->rootfs.mount) {
2823 if (!do_destroy_container(conf)) {
2824 ERROR("Error destroying rootfs for %s", c->name);
2825 goto out;
2826 }
2827 INFO("Destroyed rootfs for %s", c->name);
2828 }
2829
2830 mod_all_rdeps(c, false);
2831
2832 p1 = do_lxcapi_get_config_path(c);
2833 /* strlen(p1)
2834 * +
2835 * /
2836 * +
2837 * strlen(c->name)
2838 * +
2839 * /
2840 * +
2841 * strlen("config") = 6
2842 * +
2843 * \0
2844 */
2845 len = strlen(p1) + 1 + strlen(c->name) + 1 + 6 + 1;
2846 path = malloc(len);
2847 if (!path) {
2848 ERROR("Failed to allocate memory");
2849 goto out;
2850 }
2851
2852 /* For an overlay container the rootfs is considered immutable and
2853 * cannot be removed when restoring from a snapshot.
2854 */
2855 if (storage && (!strcmp(storage->type, "overlay") ||
2856 !strcmp(storage->type, "overlayfs")) &&
2857 (storage->flags & LXC_STORAGE_INTERNAL_OVERLAY_RESTORE)) {
2858 ret = snprintf(path, len, "%s/%s/config", p1, c->name);
2859 if (ret < 0 || (size_t)ret >= len)
2860 goto out;
2861
2862 if (am_guest_unpriv())
2863 ret = userns_exec_1(conf, lxc_unlink_exec_wrapper, path,
2864 "lxc_unlink_exec_wrapper");
2865 else
2866 ret = unlink(path);
2867 if (ret < 0) {
2868 SYSERROR("Failed to destroy config file \"%s\" for \"%s\"",
2869 path, c->name);
2870 goto out;
2871 }
2872 INFO("Destroyed config file \"%s\" for \"%s\"", path, c->name);
2873
2874 bret = true;
2875 goto out;
2876 }
2877
2878 ret = snprintf(path, len, "%s/%s", p1, c->name);
2879 if (ret < 0 || (size_t)ret >= len)
2880 goto out;
2881 if (am_guest_unpriv())
2882 ret = userns_exec_full(conf, lxc_rmdir_onedev_wrapper, path,
2883 "lxc_rmdir_onedev_wrapper");
2884 else
2885 ret = lxc_rmdir_onedev(path, "snaps");
2886 if (ret < 0) {
2887 ERROR("Failed to destroy directory \"%s\" for \"%s\"", path,
2888 c->name);
2889 goto out;
2890 }
2891 INFO("Destroyed directory \"%s\" for \"%s\"", path, c->name);
2892
2893 bret = true;
2894
2895 out:
2896 if (path)
2897 free(path);
2898 container_disk_unlock(c);
2899 return bret;
2900 }
2901
2902 static bool do_lxcapi_destroy(struct lxc_container *c)
2903 {
2904 if (!c || !lxcapi_is_defined(c))
2905 return false;
2906 if (has_snapshots(c)) {
2907 ERROR("Container %s has snapshots; not removing", c->name);
2908 return false;
2909 }
2910
2911 if (has_fs_snapshots(c)) {
2912 ERROR("container %s has snapshots on its rootfs", c->name);
2913 return false;
2914 }
2915
2916 return container_destroy(c, NULL);
2917 }
2918
2919 WRAP_API(bool, lxcapi_destroy)
2920
2921 static bool do_lxcapi_destroy_with_snapshots(struct lxc_container *c)
2922 {
2923 if (!c || !lxcapi_is_defined(c))
2924 return false;
2925 if (!lxcapi_snapshot_destroy_all(c)) {
2926 ERROR("Error deleting all snapshots");
2927 return false;
2928 }
2929 return lxcapi_destroy(c);
2930 }
2931
2932 WRAP_API(bool, lxcapi_destroy_with_snapshots)
2933
2934 int lxc_set_config_item_locked(struct lxc_conf *conf, const char *key,
2935 const char *v)
2936 {
2937 int ret;
2938 struct lxc_config_t *config;
2939 bool bret = true;
2940
2941 config = lxc_get_config(key);
2942 if (!config)
2943 return -EINVAL;
2944
2945 ret = config->set(key, v, conf, NULL);
2946 if (ret < 0)
2947 return -EINVAL;
2948
2949 if (lxc_config_value_empty(v))
2950 do_clear_unexp_config_line(conf, key);
2951 else
2952 bret = do_append_unexp_config_line(conf, key, v);
2953 if (!bret)
2954 return -ENOMEM;
2955
2956 return 0;
2957 }
2958
2959 static bool do_set_config_item_locked(struct lxc_container *c, const char *key,
2960 const char *v)
2961 {
2962 int ret;
2963
2964 if (!c->lxc_conf)
2965 c->lxc_conf = lxc_conf_init();
2966
2967 if (!c->lxc_conf)
2968 return false;
2969
2970 ret = lxc_set_config_item_locked(c->lxc_conf, key, v);
2971 if (ret < 0)
2972 return false;
2973
2974 return true;
2975 }
2976
2977 static bool do_lxcapi_set_config_item(struct lxc_container *c, const char *key, const char *v)
2978 {
2979 bool b = false;
2980
2981 if (!c)
2982 return false;
2983
2984 if (container_mem_lock(c))
2985 return false;
2986
2987 b = do_set_config_item_locked(c, key, v);
2988
2989 container_mem_unlock(c);
2990 return b;
2991 }
2992
2993 WRAP_API_2(bool, lxcapi_set_config_item, const char *, const char *)
2994
2995 static char *lxcapi_config_file_name(struct lxc_container *c)
2996 {
2997 if (!c || !c->configfile)
2998 return NULL;
2999 return strdup(c->configfile);
3000 }
3001
3002 static const char *lxcapi_get_config_path(struct lxc_container *c)
3003 {
3004 if (!c || !c->config_path)
3005 return NULL;
3006 return (const char *)(c->config_path);
3007 }
3008
3009 /*
3010 * not for export
3011 * Just recalculate the c->configfile based on the
3012 * c->config_path, which must be set.
3013 * The lxc_container must be locked or not yet public.
3014 */
3015 static bool set_config_filename(struct lxc_container *c)
3016 {
3017 char *newpath;
3018 int len, ret;
3019
3020 if (!c->config_path)
3021 return false;
3022
3023 /* $lxc_path + "/" + c->name + "/" + "config" + '\0' */
3024 len = strlen(c->config_path) + strlen(c->name) + strlen("config") + 3;
3025 newpath = malloc(len);
3026 if (!newpath)
3027 return false;
3028
3029 ret = snprintf(newpath, len, "%s/%s/config", c->config_path, c->name);
3030 if (ret < 0 || ret >= len) {
3031 fprintf(stderr, "Error printing out config file name\n");
3032 free(newpath);
3033 return false;
3034 }
3035
3036 free(c->configfile);
3037 c->configfile = newpath;
3038
3039 return true;
3040 }
3041
3042 static bool do_lxcapi_set_config_path(struct lxc_container *c, const char *path)
3043 {
3044 char *p;
3045 bool b = false;
3046 char *oldpath = NULL;
3047
3048 if (!c)
3049 return b;
3050
3051 if (container_mem_lock(c))
3052 return b;
3053
3054 p = strdup(path);
3055 if (!p) {
3056 ERROR("Out of memory setting new lxc path");
3057 goto err;
3058 }
3059
3060 b = true;
3061 if (c->config_path)
3062 oldpath = c->config_path;
3063 c->config_path = p;
3064
3065 /* Since we've changed the config path, we have to change the
3066 * config file name too */
3067 if (!set_config_filename(c)) {
3068 ERROR("Out of memory setting new config filename");
3069 b = false;
3070 free(c->config_path);
3071 c->config_path = oldpath;
3072 oldpath = NULL;
3073 }
3074 err:
3075 free(oldpath);
3076 container_mem_unlock(c);
3077 return b;
3078 }
3079
3080 WRAP_API_1(bool, lxcapi_set_config_path, const char *)
3081
3082 static bool do_lxcapi_set_cgroup_item(struct lxc_container *c, const char *subsys, const char *value)
3083 {
3084 int ret;
3085
3086 if (!c)
3087 return false;
3088
3089 if (is_stopped(c))
3090 return false;
3091
3092 if (container_disk_lock(c))
3093 return false;
3094
3095 ret = lxc_cgroup_set(subsys, value, c->name, c->config_path);
3096
3097 container_disk_unlock(c);
3098 return ret == 0;
3099 }
3100
3101 WRAP_API_2(bool, lxcapi_set_cgroup_item, const char *, const char *)
3102
3103 static int do_lxcapi_get_cgroup_item(struct lxc_container *c, const char *subsys, char *retv, int inlen)
3104 {
3105 int ret;
3106
3107 if (!c)
3108 return -1;
3109
3110 if (is_stopped(c))
3111 return -1;
3112
3113 if (container_disk_lock(c))
3114 return -1;
3115
3116 ret = lxc_cgroup_get(subsys, retv, inlen, c->name, c->config_path);
3117
3118 container_disk_unlock(c);
3119 return ret;
3120 }
3121
3122 WRAP_API_3(int, lxcapi_get_cgroup_item, const char *, char *, int)
3123
3124 const char *lxc_get_global_config_item(const char *key)
3125 {
3126 return lxc_global_config_value(key);
3127 }
3128
3129 const char *lxc_get_version(void)
3130 {
3131 return LXC_VERSION;
3132 }
3133
3134 static int copy_file(const char *old, const char *new)
3135 {
3136 int in, out;
3137 ssize_t len, ret;
3138 char buf[8096];
3139 struct stat sbuf;
3140
3141 if (file_exists(new)) {
3142 ERROR("copy destination %s exists", new);
3143 return -1;
3144 }
3145 ret = stat(old, &sbuf);
3146 if (ret < 0) {
3147 INFO("Error stat'ing %s", old);
3148 return -1;
3149 }
3150
3151 in = open(old, O_RDONLY);
3152 if (in < 0) {
3153 SYSERROR("Error opening original file %s", old);
3154 return -1;
3155 }
3156 out = open(new, O_CREAT | O_EXCL | O_WRONLY, 0644);
3157 if (out < 0) {
3158 SYSERROR("Error opening new file %s", new);
3159 close(in);
3160 return -1;
3161 }
3162
3163 while (1) {
3164 len = read(in, buf, 8096);
3165 if (len < 0) {
3166 SYSERROR("Error reading old file %s", old);
3167 goto err;
3168 }
3169 if (len == 0)
3170 break;
3171 ret = write(out, buf, len);
3172 if (ret < len) { /* should we retry? */
3173 SYSERROR("Error: write to new file %s was interrupted", new);
3174 goto err;
3175 }
3176 }
3177 close(in);
3178 close(out);
3179
3180 /* We set mode, but not owner/group. */
3181 ret = chmod(new, sbuf.st_mode);
3182 if (ret) {
3183 SYSERROR("Error setting mode on %s", new);
3184 return -1;
3185 }
3186
3187 return 0;
3188
3189 err:
3190 close(in);
3191 close(out);
3192 return -1;
3193 }
3194
3195 static int copyhooks(struct lxc_container *oldc, struct lxc_container *c)
3196 {
3197 int i, len, ret;
3198 struct lxc_list *it;
3199 char *cpath;
3200
3201 len = strlen(oldc->config_path) + strlen(oldc->name) + 3;
3202 cpath = alloca(len);
3203 ret = snprintf(cpath, len, "%s/%s/", oldc->config_path, oldc->name);
3204 if (ret < 0 || ret >= len)
3205 return -1;
3206
3207 for (i=0; i<NUM_LXC_HOOKS; i++) {
3208 lxc_list_for_each(it, &c->lxc_conf->hooks[i]) {
3209 char *hookname = it->elem;
3210 char *fname = strrchr(hookname, '/');
3211 char tmppath[MAXPATHLEN];
3212 if (!fname) /* relative path - we don't support, but maybe we should */
3213 return 0;
3214 if (strncmp(hookname, cpath, len - 1) != 0) {
3215 /* this hook is public - ignore */
3216 continue;
3217 }
3218 /* copy the script, and change the entry in confile */
3219 ret = snprintf(tmppath, MAXPATHLEN, "%s/%s/%s",
3220 c->config_path, c->name, fname+1);
3221 if (ret < 0 || ret >= MAXPATHLEN)
3222 return -1;
3223 ret = copy_file(it->elem, tmppath);
3224 if (ret < 0)
3225 return -1;
3226 free(it->elem);
3227 it->elem = strdup(tmppath);
3228 if (!it->elem) {
3229 ERROR("out of memory copying hook path");
3230 return -1;
3231 }
3232 }
3233 }
3234
3235 if (!clone_update_unexp_hooks(c->lxc_conf, oldc->config_path,
3236 c->config_path, oldc->name, c->name)) {
3237 ERROR("Error saving new hooks in clone");
3238 return -1;
3239 }
3240 do_lxcapi_save_config(c, NULL);
3241 return 0;
3242 }
3243
3244
3245 static int copy_fstab(struct lxc_container *oldc, struct lxc_container *c)
3246 {
3247 char newpath[MAXPATHLEN];
3248 char *oldpath = oldc->lxc_conf->fstab;
3249 int ret;
3250
3251 if (!oldpath)
3252 return 0;
3253
3254 clear_unexp_config_line(c->lxc_conf, "lxc.mount.fstab", false);
3255
3256 char *p = strrchr(oldpath, '/');
3257 if (!p)
3258 return -1;
3259 ret = snprintf(newpath, MAXPATHLEN, "%s/%s%s",
3260 c->config_path, c->name, p);
3261 if (ret < 0 || ret >= MAXPATHLEN) {
3262 ERROR("error printing new path for %s", oldpath);
3263 return -1;
3264 }
3265 if (file_exists(newpath)) {
3266 ERROR("error: fstab file %s exists", newpath);
3267 return -1;
3268 }
3269
3270 if (copy_file(oldpath, newpath) < 0) {
3271 ERROR("error: copying %s to %s", oldpath, newpath);
3272 return -1;
3273 }
3274 free(c->lxc_conf->fstab);
3275 c->lxc_conf->fstab = strdup(newpath);
3276 if (!c->lxc_conf->fstab) {
3277 ERROR("error: allocating pathname");
3278 return -1;
3279 }
3280 if (!do_append_unexp_config_line(c->lxc_conf, "lxc.mount.fstab", newpath)) {
3281 ERROR("error saving new lxctab");
3282 return -1;
3283 }
3284
3285 return 0;
3286 }
3287
3288 static void copy_rdepends(struct lxc_container *c, struct lxc_container *c0)
3289 {
3290 char path0[MAXPATHLEN], path1[MAXPATHLEN];
3291 int ret;
3292
3293 ret = snprintf(path0, MAXPATHLEN, "%s/%s/lxc_rdepends", c0->config_path,
3294 c0->name);
3295 if (ret < 0 || ret >= MAXPATHLEN) {
3296 WARN("Error copying reverse dependencies");
3297 return;
3298 }
3299 ret = snprintf(path1, MAXPATHLEN, "%s/%s/lxc_rdepends", c->config_path,
3300 c->name);
3301 if (ret < 0 || ret >= MAXPATHLEN) {
3302 WARN("Error copying reverse dependencies");
3303 return;
3304 }
3305 if (copy_file(path0, path1) < 0) {
3306 INFO("Error copying reverse dependencies");
3307 return;
3308 }
3309 }
3310
3311 static bool add_rdepends(struct lxc_container *c, struct lxc_container *c0)
3312 {
3313 int ret;
3314 char path[MAXPATHLEN];
3315 FILE *f;
3316 bool bret;
3317
3318 ret = snprintf(path, MAXPATHLEN, "%s/%s/lxc_rdepends", c->config_path,
3319 c->name);
3320 if (ret < 0 || ret >= MAXPATHLEN)
3321 return false;
3322 f = fopen(path, "a");
3323 if (!f)
3324 return false;
3325 bret = true;
3326 /* If anything goes wrong, just return an error. */
3327 if (fprintf(f, "%s\n%s\n", c0->config_path, c0->name) < 0)
3328 bret = false;
3329 if (fclose(f) != 0)
3330 bret = false;
3331 return bret;
3332 }
3333
3334 /*
3335 * If the fs natively supports snapshot clones with no penalty,
3336 * then default to those even if not requested.
3337 * Currently we only do this for btrfs.
3338 */
3339 bool should_default_to_snapshot(struct lxc_container *c0,
3340 struct lxc_container *c1)
3341 {
3342 size_t l0 = strlen(c0->config_path) + strlen(c0->name) + 2;
3343 size_t l1 = strlen(c1->config_path) + strlen(c1->name) + 2;
3344 char *p0 = alloca(l0 + 1);
3345 char *p1 = alloca(l1 + 1);
3346 char *rootfs = c0->lxc_conf->rootfs.path;
3347
3348 snprintf(p0, l0, "%s/%s", c0->config_path, c0->name);
3349 snprintf(p1, l1, "%s/%s", c1->config_path, c1->name);
3350
3351 if (!is_btrfs_fs(p0) || !is_btrfs_fs(p1))
3352 return false;
3353
3354 if (is_btrfs_subvol(rootfs) <= 0)
3355 return false;
3356
3357 return btrfs_same_fs(p0, p1) == 0;
3358 }
3359
3360 static int copy_storage(struct lxc_container *c0, struct lxc_container *c,
3361 const char *newtype, int flags, const char *bdevdata,
3362 uint64_t newsize)
3363 {
3364 struct lxc_storage *bdev;
3365 bool need_rdep;
3366
3367 if (should_default_to_snapshot(c0, c))
3368 flags |= LXC_CLONE_SNAPSHOT;
3369
3370 bdev = storage_copy(c0, c->name, c->config_path, newtype, flags,
3371 bdevdata, newsize, &need_rdep);
3372 if (!bdev) {
3373 ERROR("Error copying storage.");
3374 return -1;
3375 }
3376
3377 /* Set new rootfs. */
3378 free(c->lxc_conf->rootfs.path);
3379 c->lxc_conf->rootfs.path = strdup(bdev->src);
3380 storage_put(bdev);
3381
3382 if (!c->lxc_conf->rootfs.path) {
3383 ERROR("Out of memory while setting storage path.");
3384 return -1;
3385 }
3386
3387 /* Append a new lxc.rootfs.path entry to the unexpanded config. */
3388 clear_unexp_config_line(c->lxc_conf, "lxc.rootfs.path", false);
3389 if (!do_append_unexp_config_line(c->lxc_conf, "lxc.rootfs.path",
3390 c->lxc_conf->rootfs.path)) {
3391 ERROR("Error saving new rootfs to cloned config.");
3392 return -1;
3393 }
3394
3395 if (flags & LXC_CLONE_SNAPSHOT)
3396 copy_rdepends(c, c0);
3397 if (need_rdep) {
3398 if (!add_rdepends(c, c0))
3399 WARN("Error adding reverse dependency from %s to %s",
3400 c->name, c0->name);
3401 }
3402
3403 mod_all_rdeps(c, true);
3404
3405 return 0;
3406 }
3407
3408 struct clone_update_data {
3409 struct lxc_container *c0;
3410 struct lxc_container *c1;
3411 int flags;
3412 char **hookargs;
3413 };
3414
3415 static int clone_update_rootfs(struct clone_update_data *data)
3416 {
3417 struct lxc_container *c0 = data->c0;
3418 struct lxc_container *c = data->c1;
3419 int flags = data->flags;
3420 char **hookargs = data->hookargs;
3421 int ret = -1;
3422 char path[MAXPATHLEN];
3423 struct lxc_storage *bdev;
3424 FILE *fout;
3425 struct lxc_conf *conf = c->lxc_conf;
3426
3427 /* update hostname in rootfs */
3428 /* we're going to mount, so run in a clean namespace to simplify cleanup */
3429
3430 if (setgid(0) < 0) {
3431 ERROR("Failed to setgid to 0");
3432 return -1;
3433 }
3434 if (setuid(0) < 0) {
3435 ERROR("Failed to setuid to 0");
3436 return -1;
3437 }
3438 if (setgroups(0, NULL) < 0)
3439 WARN("Failed to clear groups");
3440
3441 if (unshare(CLONE_NEWNS) < 0)
3442 return -1;
3443 bdev = storage_init(c->lxc_conf);
3444 if (!bdev)
3445 return -1;
3446 if (strcmp(bdev->type, "dir") != 0) {
3447 if (unshare(CLONE_NEWNS) < 0) {
3448 ERROR("error unsharing mounts");
3449 storage_put(bdev);
3450 return -1;
3451 }
3452 if (detect_shared_rootfs()) {
3453 if (mount(NULL, "/", NULL, MS_SLAVE|MS_REC, NULL)) {
3454 SYSERROR("Failed to make / rslave");
3455 ERROR("Continuing...");
3456 }
3457 }
3458 if (bdev->ops->mount(bdev) < 0) {
3459 storage_put(bdev);
3460 return -1;
3461 }
3462 } else { /* TODO come up with a better way */
3463 free(bdev->dest);
3464 bdev->dest = strdup(bdev->src);
3465 }
3466
3467 if (!lxc_list_empty(&conf->hooks[LXCHOOK_CLONE])) {
3468 /* Start of environment variable setup for hooks */
3469 if (c0->name && setenv("LXC_SRC_NAME", c0->name, 1)) {
3470 SYSERROR("failed to set environment variable for source container name");
3471 }
3472 if (setenv("LXC_NAME", c->name, 1)) {
3473 SYSERROR("failed to set environment variable for container name");
3474 }
3475 if (conf->rcfile && setenv("LXC_CONFIG_FILE", conf->rcfile, 1)) {
3476 SYSERROR("failed to set environment variable for config path");
3477 }
3478 if (bdev->dest && setenv("LXC_ROOTFS_MOUNT", bdev->dest, 1)) {
3479 SYSERROR("failed to set environment variable for rootfs mount");
3480 }
3481 if (conf->rootfs.path && setenv("LXC_ROOTFS_PATH", conf->rootfs.path, 1)) {
3482 SYSERROR("failed to set environment variable for rootfs mount");
3483 }
3484
3485 if (run_lxc_hooks(c->name, "clone", conf, hookargs)) {
3486 ERROR("Error executing clone hook for %s", c->name);
3487 storage_put(bdev);
3488 return -1;
3489 }
3490 }
3491
3492 if (!(flags & LXC_CLONE_KEEPNAME)) {
3493 ret = snprintf(path, MAXPATHLEN, "%s/etc/hostname", bdev->dest);
3494 storage_put(bdev);
3495
3496 if (ret < 0 || ret >= MAXPATHLEN)
3497 return -1;
3498 if (!file_exists(path))
3499 return 0;
3500 if (!(fout = fopen(path, "w"))) {
3501 SYSERROR("unable to open %s: ignoring", path);
3502 return 0;
3503 }
3504 if (fprintf(fout, "%s", c->name) < 0) {
3505 fclose(fout);
3506 return -1;
3507 }
3508 if (fclose(fout) < 0)
3509 return -1;
3510 } else {
3511 storage_put(bdev);
3512 }
3513
3514 return 0;
3515 }
3516
3517 static int clone_update_rootfs_wrapper(void *data)
3518 {
3519 struct clone_update_data *arg = (struct clone_update_data *) data;
3520 return clone_update_rootfs(arg);
3521 }
3522
3523 /*
3524 * We want to support:
3525 sudo lxc-clone -o o1 -n n1 -s -L|-fssize fssize -v|--vgname vgname \
3526 -p|--lvprefix lvprefix -t|--fstype fstype -B backingstore
3527
3528 -s [ implies overlay]
3529 -s -B overlay
3530 -s -B aufs
3531
3532 only rootfs gets converted (copied/snapshotted) on clone.
3533 */
3534
3535 static int create_file_dirname(char *path, struct lxc_conf *conf)
3536 {
3537 char *p = strrchr(path, '/');
3538 int ret = -1;
3539
3540 if (!p)
3541 return -1;
3542 *p = '\0';
3543 ret = do_create_container_dir(path, conf);
3544 *p = '/';
3545 return ret;
3546 }
3547
3548 static struct lxc_container *do_lxcapi_clone(struct lxc_container *c, const char *newname,
3549 const char *lxcpath, int flags,
3550 const char *bdevtype, const char *bdevdata, uint64_t newsize,
3551 char **hookargs)
3552 {
3553 char newpath[MAXPATHLEN];
3554 int fd, ret;
3555 struct clone_update_data data;
3556 size_t saved_unexp_len;
3557 pid_t pid;
3558 int storage_copied = 0;
3559 char *origroot = NULL, *saved_unexp_conf = NULL;
3560 struct lxc_container *c2 = NULL;
3561
3562 if (!c || !do_lxcapi_is_defined(c))
3563 return NULL;
3564
3565 if (container_mem_lock(c))
3566 return NULL;
3567
3568 if (!is_stopped(c)) {
3569 ERROR("error: Original container (%s) is running", c->name);
3570 goto out;
3571 }
3572
3573 /* Make sure the container doesn't yet exist. */
3574 if (!newname)
3575 newname = c->name;
3576 if (!lxcpath)
3577 lxcpath = do_lxcapi_get_config_path(c);
3578 ret = snprintf(newpath, MAXPATHLEN, "%s/%s/config", lxcpath, newname);
3579 if (ret < 0 || ret >= MAXPATHLEN) {
3580 SYSERROR("clone: failed making config pathname");
3581 goto out;
3582 }
3583
3584 if (file_exists(newpath)) {
3585 ERROR("error: clone: %s exists", newpath);
3586 goto out;
3587 }
3588
3589 ret = create_file_dirname(newpath, c->lxc_conf);
3590 if (ret < 0 && errno != EEXIST) {
3591 ERROR("Error creating container dir for %s", newpath);
3592 goto out;
3593 }
3594
3595 /* Copy the configuration. Tweak it as needed. */
3596 if (c->lxc_conf->rootfs.path) {
3597 origroot = c->lxc_conf->rootfs.path;
3598 c->lxc_conf->rootfs.path = NULL;
3599 }
3600
3601 fd = open(newpath, O_WRONLY | O_CREAT | O_CLOEXEC,
3602 S_IRUSR | S_IWUSR | S_IRGRP | S_IWGRP | S_IROTH | S_IWOTH);
3603 if (fd < 0) {
3604 SYSERROR("Failed to open \"%s\"", newpath);
3605 goto out;
3606 }
3607
3608 saved_unexp_conf = c->lxc_conf->unexpanded_config;
3609 saved_unexp_len = c->lxc_conf->unexpanded_len;
3610 c->lxc_conf->unexpanded_config = strdup(saved_unexp_conf);
3611 if (!c->lxc_conf->unexpanded_config) {
3612 close(fd);
3613 goto out;
3614 }
3615
3616 clear_unexp_config_line(c->lxc_conf, "lxc.rootfs.path", false);
3617 write_config(fd, c->lxc_conf);
3618 close(fd);
3619 c->lxc_conf->rootfs.path = origroot;
3620 free(c->lxc_conf->unexpanded_config);
3621 c->lxc_conf->unexpanded_config = saved_unexp_conf;
3622 saved_unexp_conf = NULL;
3623 c->lxc_conf->unexpanded_len = saved_unexp_len;
3624
3625 ret = snprintf(newpath, MAXPATHLEN, "%s/%s/rootfs", lxcpath, newname);
3626 if (ret < 0 || ret >= MAXPATHLEN) {
3627 SYSERROR("clone: failed making rootfs pathname");
3628 goto out;
3629 }
3630
3631 ret = mkdir(newpath, 0755);
3632 if (ret < 0) {
3633 /* For an overlay container the rootfs is considered immutable
3634 * and will not have been removed when restoring from a
3635 * snapshot.
3636 */
3637 if (errno != ENOENT &&
3638 !(flags & LXC_STORAGE_INTERNAL_OVERLAY_RESTORE)) {
3639 SYSERROR("Failed to create directory \"%s\"", newpath);
3640 goto out;
3641 }
3642 }
3643
3644 if (am_guest_unpriv()) {
3645 if (chown_mapped_root(newpath, c->lxc_conf) < 0) {
3646 ERROR("Error chowning %s to container root", newpath);
3647 goto out;
3648 }
3649 }
3650
3651 c2 = lxc_container_new(newname, lxcpath);
3652 if (!c2) {
3653 ERROR("clone: failed to create new container (%s %s)", newname,
3654 lxcpath);
3655 goto out;
3656 }
3657
3658 /* copy/snapshot rootfs's */
3659 ret = copy_storage(c, c2, bdevtype, flags, bdevdata, newsize);
3660 if (ret < 0)
3661 goto out;
3662
3663
3664 /* update utsname */
3665 if (!(flags & LXC_CLONE_KEEPNAME)) {
3666 clear_unexp_config_line(c2->lxc_conf, "lxc.utsname", false);
3667 clear_unexp_config_line(c2->lxc_conf, "lxc.uts.name", false);
3668
3669 if (!do_set_config_item_locked(c2, "lxc.uts.name", newname)) {
3670 ERROR("Error setting new hostname");
3671 goto out;
3672 }
3673 }
3674
3675 /* copy hooks */
3676 ret = copyhooks(c, c2);
3677 if (ret < 0) {
3678 ERROR("error copying hooks");
3679 goto out;
3680 }
3681
3682 if (copy_fstab(c, c2) < 0) {
3683 ERROR("error copying fstab");
3684 goto out;
3685 }
3686
3687 /* update macaddrs */
3688 if (!(flags & LXC_CLONE_KEEPMACADDR)) {
3689 if (!network_new_hwaddrs(c2->lxc_conf)) {
3690 ERROR("Error updating mac addresses");
3691 goto out;
3692 }
3693 }
3694
3695 /* Update absolute paths for overlay mount directories. */
3696 if (ovl_update_abs_paths(c2->lxc_conf, c->config_path, c->name, lxcpath, newname) < 0)
3697 goto out;
3698
3699 /* We've now successfully created c2's storage, so clear it out if we
3700 * fail after this.
3701 */
3702 storage_copied = 1;
3703
3704 if (!c2->save_config(c2, NULL))
3705 goto out;
3706
3707 if ((pid = fork()) < 0) {
3708 SYSERROR("fork");
3709 goto out;
3710 }
3711 if (pid > 0) {
3712 ret = wait_for_pid(pid);
3713 if (ret)
3714 goto out;
3715 container_mem_unlock(c);
3716 return c2;
3717 }
3718 data.c0 = c;
3719 data.c1 = c2;
3720 data.flags = flags;
3721 data.hookargs = hookargs;
3722 if (am_guest_unpriv())
3723 ret = userns_exec_full(c->lxc_conf, clone_update_rootfs_wrapper,
3724 &data, "clone_update_rootfs_wrapper");
3725 else
3726 ret = clone_update_rootfs(&data);
3727 if (ret < 0)
3728 _exit(EXIT_FAILURE);
3729
3730 container_mem_unlock(c);
3731 _exit(EXIT_SUCCESS);
3732
3733 out:
3734 container_mem_unlock(c);
3735 if (c2) {
3736 if (!storage_copied)
3737 c2->lxc_conf->rootfs.path = NULL;
3738 c2->destroy(c2);
3739 lxc_container_put(c2);
3740 }
3741
3742 return NULL;
3743 }
3744
3745 static struct lxc_container *lxcapi_clone(struct lxc_container *c, const char *newname,
3746 const char *lxcpath, int flags,
3747 const char *bdevtype, const char *bdevdata, uint64_t newsize,
3748 char **hookargs)
3749 {
3750 struct lxc_container * ret;
3751 current_config = c ? c->lxc_conf : NULL;
3752 ret = do_lxcapi_clone(c, newname, lxcpath, flags, bdevtype, bdevdata, newsize, hookargs);
3753 current_config = NULL;
3754 return ret;
3755 }
3756
3757 static bool do_lxcapi_rename(struct lxc_container *c, const char *newname)
3758 {
3759 struct lxc_storage *bdev;
3760 struct lxc_container *newc;
3761
3762 if (!c || !c->name || !c->config_path || !c->lxc_conf)
3763 return false;
3764
3765 if (has_fs_snapshots(c) || has_snapshots(c)) {
3766 ERROR("Renaming a container with snapshots is not supported");
3767 return false;
3768 }
3769 bdev = storage_init(c->lxc_conf);
3770 if (!bdev) {
3771 ERROR("Failed to find original backing store type");
3772 return false;
3773 }
3774
3775 newc = lxcapi_clone(c, newname, c->config_path, LXC_CLONE_KEEPMACADDR, NULL, bdev->type, 0, NULL);
3776 storage_put(bdev);
3777 if (!newc) {
3778 lxc_container_put(newc);
3779 return false;
3780 }
3781
3782 if (newc && lxcapi_is_defined(newc))
3783 lxc_container_put(newc);
3784
3785 if (!container_destroy(c, NULL)) {
3786 ERROR("Could not destroy existing container %s", c->name);
3787 return false;
3788 }
3789 return true;
3790 }
3791
3792 WRAP_API_1(bool, lxcapi_rename, const char *)
3793
3794 static int lxcapi_attach(struct lxc_container *c, lxc_attach_exec_t exec_function, void *exec_payload, lxc_attach_options_t *options, pid_t *attached_process)
3795 {
3796 int ret;
3797
3798 if (!c)
3799 return -1;
3800
3801 current_config = c->lxc_conf;
3802
3803 ret = lxc_attach(c->name, c->config_path, exec_function, exec_payload, options, attached_process);
3804 current_config = NULL;
3805 return ret;
3806 }
3807
3808 static int do_lxcapi_attach_run_wait(struct lxc_container *c, lxc_attach_options_t *options, const char *program, const char * const argv[])
3809 {
3810 lxc_attach_command_t command;
3811 pid_t pid;
3812 int r;
3813
3814 if (!c)
3815 return -1;
3816
3817 command.program = (char*)program;
3818 command.argv = (char**)argv;
3819 r = lxc_attach(c->name, c->config_path, lxc_attach_run_command, &command, options, &pid);
3820 if (r < 0) {
3821 ERROR("ups");
3822 return r;
3823 }
3824 return lxc_wait_for_pid_status(pid);
3825 }
3826
3827 static int lxcapi_attach_run_wait(struct lxc_container *c, lxc_attach_options_t *options, const char *program, const char * const argv[])
3828 {
3829 int ret;
3830 current_config = c ? c->lxc_conf : NULL;
3831 ret = do_lxcapi_attach_run_wait(c, options, program, argv);
3832 current_config = NULL;
3833 return ret;
3834 }
3835
3836 static int get_next_index(const char *lxcpath, char *cname)
3837 {
3838 char *fname;
3839 struct stat sb;
3840 int i = 0, ret;
3841
3842 fname = alloca(strlen(lxcpath) + 20);
3843 while (1) {
3844 sprintf(fname, "%s/snap%d", lxcpath, i);
3845 ret = stat(fname, &sb);
3846 if (ret != 0)
3847 return i;
3848 i++;
3849 }
3850 }
3851
3852 static bool get_snappath_dir(struct lxc_container *c, char *snappath)
3853 {
3854 int ret;
3855 /*
3856 * If the old style snapshot path exists, use it
3857 * /var/lib/lxc -> /var/lib/lxcsnaps
3858 */
3859 ret = snprintf(snappath, MAXPATHLEN, "%ssnaps", c->config_path);
3860 if (ret < 0 || ret >= MAXPATHLEN)
3861 return false;
3862 if (dir_exists(snappath)) {
3863 ret = snprintf(snappath, MAXPATHLEN, "%ssnaps/%s", c->config_path, c->name);
3864 if (ret < 0 || ret >= MAXPATHLEN)
3865 return false;
3866 return true;
3867 }
3868
3869 /*
3870 * Use the new style path
3871 * /var/lib/lxc -> /var/lib/lxc + c->name + /snaps + \0
3872 */
3873 ret = snprintf(snappath, MAXPATHLEN, "%s/%s/snaps", c->config_path, c->name);
3874 if (ret < 0 || ret >= MAXPATHLEN)
3875 return false;
3876 return true;
3877 }
3878
3879 static int do_lxcapi_snapshot(struct lxc_container *c, const char *commentfile)
3880 {
3881 int i, flags, ret;
3882 struct lxc_container *c2;
3883 char snappath[MAXPATHLEN], newname[20];
3884
3885 if (!c || !lxcapi_is_defined(c))
3886 return -1;
3887
3888 if (!storage_can_backup(c->lxc_conf)) {
3889 ERROR("%s's backing store cannot be backed up.", c->name);
3890 ERROR("Your container must use another backing store type.");
3891 return -1;
3892 }
3893
3894 if (!get_snappath_dir(c, snappath))
3895 return -1;
3896
3897 i = get_next_index(snappath, c->name);
3898
3899 if (mkdir_p(snappath, 0755) < 0) {
3900 ERROR("Failed to create snapshot directory %s", snappath);
3901 return -1;
3902 }
3903
3904 ret = snprintf(newname, 20, "snap%d", i);
3905 if (ret < 0 || ret >= 20)
3906 return -1;
3907
3908 /*
3909 * We pass LXC_CLONE_SNAPSHOT to make sure that a rdepends file entry is
3910 * created in the original container
3911 */
3912 flags = LXC_CLONE_SNAPSHOT | LXC_CLONE_KEEPMACADDR | LXC_CLONE_KEEPNAME |
3913 LXC_CLONE_KEEPBDEVTYPE | LXC_CLONE_MAYBE_SNAPSHOT;
3914 if (storage_is_dir(c->lxc_conf)) {
3915 ERROR("Snapshot of directory-backed container requested.");
3916 ERROR("Making a copy-clone. If you do want snapshots, then");
3917 ERROR("please create an aufs or overlay clone first, snapshot that");
3918 ERROR("and keep the original container pristine.");
3919 flags &= ~LXC_CLONE_SNAPSHOT | LXC_CLONE_MAYBE_SNAPSHOT;
3920 }
3921 c2 = do_lxcapi_clone(c, newname, snappath, flags, NULL, NULL, 0, NULL);
3922 if (!c2) {
3923 ERROR("clone of %s:%s failed", c->config_path, c->name);
3924 return -1;
3925 }
3926
3927 lxc_container_put(c2);
3928
3929 /* Now write down the creation time. */
3930 time_t timer;
3931 char buffer[25];
3932 struct tm* tm_info;
3933 FILE *f;
3934
3935 time(&timer);
3936 tm_info = localtime(&timer);
3937
3938 strftime(buffer, 25, "%Y:%m:%d %H:%M:%S", tm_info);
3939
3940 char *dfnam = alloca(strlen(snappath) + strlen(newname) + 5);
3941 sprintf(dfnam, "%s/%s/ts", snappath, newname);
3942 f = fopen(dfnam, "w");
3943 if (!f) {
3944 ERROR("Failed to open %s", dfnam);
3945 return -1;
3946 }
3947 if (fprintf(f, "%s", buffer) < 0) {
3948 SYSERROR("Writing timestamp");
3949 fclose(f);
3950 return -1;
3951 }
3952 ret = fclose(f);
3953 if (ret != 0) {
3954 SYSERROR("Writing timestamp");
3955 return -1;
3956 }
3957
3958 if (commentfile) {
3959 /* $p / $name / comment \0 */
3960 int len = strlen(snappath) + strlen(newname) + 10;
3961 char *path = alloca(len);
3962 sprintf(path, "%s/%s/comment", snappath, newname);
3963 return copy_file(commentfile, path) < 0 ? -1 : i;
3964 }
3965
3966 return i;
3967 }
3968
3969 WRAP_API_1(int, lxcapi_snapshot, const char *)
3970
3971 static void lxcsnap_free(struct lxc_snapshot *s)
3972 {
3973 free(s->name);
3974 free(s->comment_pathname);
3975 free(s->timestamp);
3976 free(s->lxcpath);
3977 }
3978
3979 static char *get_snapcomment_path(char* snappath, char *name)
3980 {
3981 /* $snappath/$name/comment */
3982 int ret, len = strlen(snappath) + strlen(name) + 10;
3983 char *s = malloc(len);
3984
3985 if (s) {
3986 ret = snprintf(s, len, "%s/%s/comment", snappath, name);
3987 if (ret < 0 || ret >= len) {
3988 free(s);
3989 s = NULL;
3990 }
3991 }
3992 return s;
3993 }
3994
3995 static char *get_timestamp(char* snappath, char *name)
3996 {
3997 char path[MAXPATHLEN], *s = NULL;
3998 int ret, len;
3999 FILE *fin;
4000
4001 ret = snprintf(path, MAXPATHLEN, "%s/%s/ts", snappath, name);
4002 if (ret < 0 || ret >= MAXPATHLEN)
4003 return NULL;
4004 fin = fopen(path, "r");
4005 if (!fin)
4006 return NULL;
4007 (void) fseek(fin, 0, SEEK_END);
4008 len = ftell(fin);
4009 (void) fseek(fin, 0, SEEK_SET);
4010 if (len > 0) {
4011 s = malloc(len+1);
4012 if (s) {
4013 s[len] = '\0';
4014 if (fread(s, 1, len, fin) != len) {
4015 SYSERROR("reading timestamp");
4016 free(s);
4017 s = NULL;
4018 }
4019 }
4020 }
4021 fclose(fin);
4022 return s;
4023 }
4024
4025 static int do_lxcapi_snapshot_list(struct lxc_container *c, struct lxc_snapshot **ret_snaps)
4026 {
4027 char snappath[MAXPATHLEN], path2[MAXPATHLEN];
4028 int count = 0, ret;
4029 struct dirent *direntp;
4030 struct lxc_snapshot *snaps =NULL, *nsnaps;
4031 DIR *dir;
4032
4033 if (!c || !lxcapi_is_defined(c))
4034 return -1;
4035
4036 if (!get_snappath_dir(c, snappath)) {
4037 ERROR("path name too long");
4038 return -1;
4039 }
4040 dir = opendir(snappath);
4041 if (!dir) {
4042 INFO("failed to open %s - assuming no snapshots", snappath);
4043 return 0;
4044 }
4045
4046 while ((direntp = readdir(dir))) {
4047 if (!direntp)
4048 break;
4049
4050 if (!strcmp(direntp->d_name, "."))
4051 continue;
4052
4053 if (!strcmp(direntp->d_name, ".."))
4054 continue;
4055
4056 ret = snprintf(path2, MAXPATHLEN, "%s/%s/config", snappath, direntp->d_name);
4057 if (ret < 0 || ret >= MAXPATHLEN) {
4058 ERROR("pathname too long");
4059 goto out_free;
4060 }
4061 if (!file_exists(path2))
4062 continue;
4063 nsnaps = realloc(snaps, (count + 1)*sizeof(*snaps));
4064 if (!nsnaps) {
4065 SYSERROR("Out of memory");
4066 goto out_free;
4067 }
4068 snaps = nsnaps;
4069 snaps[count].free = lxcsnap_free;
4070 snaps[count].name = strdup(direntp->d_name);
4071 if (!snaps[count].name)
4072 goto out_free;
4073 snaps[count].lxcpath = strdup(snappath);
4074 if (!snaps[count].lxcpath) {
4075 free(snaps[count].name);
4076 goto out_free;
4077 }
4078 snaps[count].comment_pathname = get_snapcomment_path(snappath, direntp->d_name);
4079 snaps[count].timestamp = get_timestamp(snappath, direntp->d_name);
4080 count++;
4081 }
4082
4083 if (closedir(dir))
4084 WARN("failed to close directory");
4085
4086 *ret_snaps = snaps;
4087 return count;
4088
4089 out_free:
4090 if (snaps) {
4091 int i;
4092 for (i=0; i<count; i++)
4093 lxcsnap_free(&snaps[i]);
4094 free(snaps);
4095 }
4096 if (closedir(dir))
4097 WARN("failed to close directory");
4098 return -1;
4099 }
4100
4101 WRAP_API_1(int, lxcapi_snapshot_list, struct lxc_snapshot **)
4102
4103 static bool do_lxcapi_snapshot_restore(struct lxc_container *c, const char *snapname, const char *newname)
4104 {
4105 char clonelxcpath[MAXPATHLEN];
4106 int flags = 0;
4107 struct lxc_container *snap, *rest;
4108 struct lxc_storage *bdev;
4109 bool b = false;
4110
4111 if (!c || !c->name || !c->config_path)
4112 return false;
4113
4114 if (has_fs_snapshots(c)) {
4115 ERROR("container rootfs has dependent snapshots");
4116 return false;
4117 }
4118
4119 bdev = storage_init(c->lxc_conf);
4120 if (!bdev) {
4121 ERROR("Failed to find original backing store type");
4122 return false;
4123 }
4124
4125 /* For an overlay container the rootfs is considered immutable
4126 * and cannot be removed when restoring from a snapshot. We pass this
4127 * internal flag along to communicate this to various parts of the
4128 * codebase.
4129 */
4130 if (!strcmp(bdev->type, "overlay") || !strcmp(bdev->type, "overlayfs"))
4131 bdev->flags |= LXC_STORAGE_INTERNAL_OVERLAY_RESTORE;
4132
4133 if (!newname)
4134 newname = c->name;
4135
4136 if (!get_snappath_dir(c, clonelxcpath)) {
4137 storage_put(bdev);
4138 return false;
4139 }
4140 /* how should we lock this? */
4141
4142 snap = lxc_container_new(snapname, clonelxcpath);
4143 if (!snap || !lxcapi_is_defined(snap)) {
4144 ERROR("Could not open snapshot %s", snapname);
4145 if (snap)
4146 lxc_container_put(snap);
4147 storage_put(bdev);
4148 return false;
4149 }
4150
4151 if (!strcmp(c->name, newname)) {
4152 if (!container_destroy(c, bdev)) {
4153 ERROR("Could not destroy existing container %s", newname);
4154 lxc_container_put(snap);
4155 storage_put(bdev);
4156 return false;
4157 }
4158 }
4159
4160 if (strcmp(bdev->type, "dir") != 0 && strcmp(bdev->type, "loop") != 0)
4161 flags = LXC_CLONE_SNAPSHOT | LXC_CLONE_MAYBE_SNAPSHOT;
4162
4163 if (!strcmp(bdev->type, "overlay") || !strcmp(bdev->type, "overlayfs"))
4164 flags |= LXC_STORAGE_INTERNAL_OVERLAY_RESTORE;
4165 rest = lxcapi_clone(snap, newname, c->config_path, flags, bdev->type,
4166 NULL, 0, NULL);
4167 storage_put(bdev);
4168 if (rest && lxcapi_is_defined(rest))
4169 b = true;
4170 if (rest)
4171 lxc_container_put(rest);
4172
4173 lxc_container_put(snap);
4174 return b;
4175 }
4176
4177 WRAP_API_2(bool, lxcapi_snapshot_restore, const char *, const char *)
4178
4179 static bool do_snapshot_destroy(const char *snapname, const char *clonelxcpath)
4180 {
4181 struct lxc_container *snap = NULL;
4182 bool bret = false;
4183
4184 snap = lxc_container_new(snapname, clonelxcpath);
4185 if (!snap) {
4186 ERROR("Could not find snapshot %s", snapname);
4187 goto err;
4188 }
4189
4190 if (!do_lxcapi_destroy(snap)) {
4191 ERROR("Could not destroy snapshot %s", snapname);
4192 goto err;
4193 }
4194 bret = true;
4195
4196 err:
4197 if (snap)
4198 lxc_container_put(snap);
4199 return bret;
4200 }
4201
4202 static bool remove_all_snapshots(const char *path)
4203 {
4204 DIR *dir;
4205 struct dirent *direntp;
4206 bool bret = true;
4207
4208 dir = opendir(path);
4209 if (!dir) {
4210 SYSERROR("opendir on snapshot path %s", path);
4211 return false;
4212 }
4213 while ((direntp = readdir(dir))) {
4214 if (!strcmp(direntp->d_name, "."))
4215 continue;
4216 if (!strcmp(direntp->d_name, ".."))
4217 continue;
4218 if (!do_snapshot_destroy(direntp->d_name, path)) {
4219 bret = false;
4220 continue;
4221 }
4222 }
4223
4224 closedir(dir);
4225
4226 if (rmdir(path))
4227 SYSERROR("Error removing directory %s", path);
4228
4229 return bret;
4230 }
4231
4232 static bool do_lxcapi_snapshot_destroy(struct lxc_container *c, const char *snapname)
4233 {
4234 char clonelxcpath[MAXPATHLEN];
4235
4236 if (!c || !c->name || !c->config_path || !snapname)
4237 return false;
4238
4239 if (!get_snappath_dir(c, clonelxcpath))
4240 return false;
4241
4242 return do_snapshot_destroy(snapname, clonelxcpath);
4243 }
4244
4245 WRAP_API_1(bool, lxcapi_snapshot_destroy, const char *)
4246
4247 static bool do_lxcapi_snapshot_destroy_all(struct lxc_container *c)
4248 {
4249 char clonelxcpath[MAXPATHLEN];
4250
4251 if (!c || !c->name || !c->config_path)
4252 return false;
4253
4254 if (!get_snappath_dir(c, clonelxcpath))
4255 return false;
4256
4257 return remove_all_snapshots(clonelxcpath);
4258 }
4259
4260 WRAP_API(bool, lxcapi_snapshot_destroy_all)
4261
4262 static bool do_lxcapi_may_control(struct lxc_container *c)
4263 {
4264 return lxc_try_cmd(c->name, c->config_path) == 0;
4265 }
4266
4267 WRAP_API(bool, lxcapi_may_control)
4268
4269 static bool do_add_remove_node(pid_t init_pid, const char *path, bool add,
4270 struct stat *st)
4271 {
4272 int ret;
4273 char *tmp;
4274 pid_t pid;
4275 char chrootpath[MAXPATHLEN];
4276 char *directory_path = NULL;
4277
4278 pid = fork();
4279 if (pid < 0) {
4280 SYSERROR("Failed to fork()");
4281 return false;
4282 }
4283
4284 if (pid) {
4285 ret = wait_for_pid(pid);
4286 if (ret != 0) {
4287 ERROR("Failed to create device node");
4288 return false;
4289 }
4290
4291 return true;
4292 }
4293
4294 /* prepare the path */
4295 ret = snprintf(chrootpath, MAXPATHLEN, "/proc/%d/root", init_pid);
4296 if (ret < 0 || ret >= MAXPATHLEN)
4297 return false;
4298
4299 ret = chroot(chrootpath);
4300 if (ret < 0)
4301 _exit(EXIT_FAILURE);
4302
4303 ret = chdir("/");
4304 if (ret < 0)
4305 _exit(EXIT_FAILURE);
4306
4307 /* remove path if it exists */
4308 ret = faccessat(AT_FDCWD, path, F_OK, AT_SYMLINK_NOFOLLOW);
4309 if(ret == 0) {
4310 ret = unlink(path);
4311 if (ret < 0) {
4312 ERROR("%s - Failed to remove \"%s\"", strerror(errno), path);
4313 _exit(EXIT_FAILURE);
4314 }
4315 }
4316
4317 if (!add)
4318 _exit(EXIT_SUCCESS);
4319
4320 /* create any missing directories */
4321 tmp = strdup(path);
4322 if (!tmp)
4323 _exit(EXIT_FAILURE);
4324
4325 directory_path = dirname(tmp);
4326 ret = mkdir_p(directory_path, 0755);
4327 if (ret < 0 && errno != EEXIST) {
4328 ERROR("%s - Failed to create path \"%s\"", strerror(errno), directory_path);
4329 free(tmp);
4330 _exit(EXIT_FAILURE);
4331 }
4332
4333 /* create the device node */
4334 ret = mknod(path, st->st_mode, st->st_rdev);
4335 free(tmp);
4336 if (ret < 0) {
4337 ERROR("%s - Failed to create device node at \"%s\"", strerror(errno), path);
4338 _exit(EXIT_FAILURE);
4339 }
4340
4341 _exit(EXIT_SUCCESS);
4342 }
4343
4344 static bool add_remove_device_node(struct lxc_container *c, const char *src_path, const char *dest_path, bool add)
4345 {
4346 int ret;
4347 struct stat st;
4348 char value[LXC_MAX_BUFFER];
4349 const char *p;
4350
4351 /* make sure container is running */
4352 if (!do_lxcapi_is_running(c)) {
4353 ERROR("container is not running");
4354 return false;
4355 }
4356
4357 /* use src_path if dest_path is NULL otherwise use dest_path */
4358 p = dest_path ? dest_path : src_path;
4359
4360 /* make sure we can access p */
4361 if(access(p, F_OK) < 0 || stat(p, &st) < 0)
4362 return false;
4363
4364 /* continue if path is character device or block device */
4365 if (S_ISCHR(st.st_mode))
4366 ret = snprintf(value, LXC_MAX_BUFFER, "c %d:%d rwm", major(st.st_rdev), minor(st.st_rdev));
4367 else if (S_ISBLK(st.st_mode))
4368 ret = snprintf(value, LXC_MAX_BUFFER, "b %d:%d rwm", major(st.st_rdev), minor(st.st_rdev));
4369 else
4370 return false;
4371
4372 /* check snprintf return code */
4373 if (ret < 0 || ret >= LXC_MAX_BUFFER)
4374 return false;
4375
4376 if (!do_add_remove_node(do_lxcapi_init_pid(c), p, add, &st))
4377 return false;
4378
4379 /* add or remove device to/from cgroup access list */
4380 if (add) {
4381 if (!do_lxcapi_set_cgroup_item(c, "devices.allow", value)) {
4382 ERROR("set_cgroup_item failed while adding the device node");
4383 return false;
4384 }
4385 } else {
4386 if (!do_lxcapi_set_cgroup_item(c, "devices.deny", value)) {
4387 ERROR("set_cgroup_item failed while removing the device node");
4388 return false;
4389 }
4390 }
4391
4392 return true;
4393 }
4394
4395 static bool do_lxcapi_add_device_node(struct lxc_container *c, const char *src_path, const char *dest_path)
4396 {
4397 // cannot mknod if we're not privileged wrt init_user_ns
4398 if (am_host_unpriv()) {
4399 ERROR(LXC_UNPRIV_EOPNOTSUPP, __FUNCTION__);
4400 return false;
4401 }
4402 return add_remove_device_node(c, src_path, dest_path, true);
4403 }
4404
4405 WRAP_API_2(bool, lxcapi_add_device_node, const char *, const char *)
4406
4407 static bool do_lxcapi_remove_device_node(struct lxc_container *c, const char *src_path, const char *dest_path)
4408 {
4409 if (am_guest_unpriv()) {
4410 ERROR(LXC_UNPRIV_EOPNOTSUPP, __FUNCTION__);
4411 return false;
4412 }
4413 return add_remove_device_node(c, src_path, dest_path, false);
4414 }
4415
4416 WRAP_API_2(bool, lxcapi_remove_device_node, const char *, const char *)
4417
4418 static bool do_lxcapi_attach_interface(struct lxc_container *c,
4419 const char *ifname,
4420 const char *dst_ifname)
4421 {
4422 pid_t init_pid;
4423 int ret = 0;
4424
4425 if (am_guest_unpriv()) {
4426 ERROR(LXC_UNPRIV_EOPNOTSUPP, __FUNCTION__);
4427 return false;
4428 }
4429
4430 if (!ifname) {
4431 ERROR("No source interface name given");
4432 return false;
4433 }
4434
4435 ret = lxc_netdev_isup(ifname);
4436 if (ret > 0) {
4437 /* netdev of ifname is up. */
4438 ret = lxc_netdev_down(ifname);
4439 if (ret)
4440 goto err;
4441 }
4442
4443 init_pid = do_lxcapi_init_pid(c);
4444 ret = lxc_netdev_move_by_name(ifname, init_pid, dst_ifname);
4445 if (ret)
4446 goto err;
4447
4448 INFO("Moved network device \"%s\" to network namespace of %d", ifname, init_pid);
4449 return true;
4450
4451 err:
4452 return false;
4453 }
4454
4455 WRAP_API_2(bool, lxcapi_attach_interface, const char *, const char *)
4456
4457 static bool do_lxcapi_detach_interface(struct lxc_container *c,
4458 const char *ifname,
4459 const char *dst_ifname)
4460 {
4461 int ret;
4462 pid_t pid, pid_outside;
4463
4464 /*
4465 * TODO - if this is a physical device, then we need am_host_unpriv.
4466 * But for other types guest privilege suffices.
4467 */
4468 if (am_guest_unpriv()) {
4469 ERROR(LXC_UNPRIV_EOPNOTSUPP, __FUNCTION__);
4470 return false;
4471 }
4472
4473 if (!ifname) {
4474 ERROR("No source interface name given");
4475 return false;
4476 }
4477
4478 pid_outside = lxc_raw_getpid();
4479 pid = fork();
4480 if (pid < 0) {
4481 ERROR("Failed to fork");
4482 return false;
4483 }
4484
4485 if (pid == 0) { /* child */
4486 pid_t init_pid;
4487
4488 init_pid = do_lxcapi_init_pid(c);
4489 if (!switch_to_ns(init_pid, "net")) {
4490 ERROR("Failed to enter network namespace");
4491 _exit(EXIT_FAILURE);
4492 }
4493
4494 ret = lxc_netdev_isup(ifname);
4495 if (ret < 0) {
4496 ERROR("Failed to determine whether network device \"%s\" is up", ifname);
4497 _exit(EXIT_FAILURE);
4498 }
4499
4500 /* netdev of ifname is up. */
4501 if (ret) {
4502 ret = lxc_netdev_down(ifname);
4503 if (ret) {
4504 ERROR("Failed to set network device \"%s\" down", ifname);
4505 _exit(EXIT_FAILURE);
4506 }
4507 }
4508
4509 ret = lxc_netdev_move_by_name(ifname, pid_outside, dst_ifname);
4510 /* -EINVAL means there is no netdev named as ifname. */
4511 if (ret < 0) {
4512 if (ret == -EINVAL)
4513 ERROR("Network device \"%s\" not found", ifname);
4514 else
4515 ERROR("Failed to remove network device \"%s\"", ifname);
4516 _exit(EXIT_FAILURE);
4517 }
4518
4519 _exit(EXIT_SUCCESS);
4520 }
4521
4522 ret = wait_for_pid(pid);
4523 if (ret != 0)
4524 return false;
4525
4526 INFO("Moved network device \"%s\" to network namespace of %d", ifname, pid_outside);
4527 return true;
4528 }
4529
4530 WRAP_API_2(bool, lxcapi_detach_interface, const char *, const char *)
4531
4532 static int do_lxcapi_migrate(struct lxc_container *c, unsigned int cmd,
4533 struct migrate_opts *opts, unsigned int size)
4534 {
4535 int ret = -1;
4536 struct migrate_opts *valid_opts = opts;
4537 uint64_t features_to_check = 0;
4538
4539 /* If the caller has a bigger (newer) struct migrate_opts, let's make
4540 * sure that the stuff on the end is zero, i.e. that they didn't ask us
4541 * to do anything special.
4542 */
4543 if (size > sizeof(*opts)) {
4544 unsigned char *addr;
4545 unsigned char *end;
4546
4547 addr = (void *)opts + sizeof(*opts);
4548 end = (void *)opts + size;
4549 for (; addr < end; addr++) {
4550 if (*addr) {
4551 return -E2BIG;
4552 }
4553 }
4554 }
4555
4556 /* If the caller has a smaller struct, let's zero out the end for them
4557 * so we don't accidentally use bits of it that they didn't know about
4558 * to initialize.
4559 */
4560 if (size < sizeof(*opts)) {
4561 valid_opts = malloc(sizeof(*opts));
4562 if (!valid_opts)
4563 return -ENOMEM;
4564
4565 memset(valid_opts, 0, sizeof(*opts));
4566 memcpy(valid_opts, opts, size);
4567 }
4568
4569 switch (cmd) {
4570 case MIGRATE_PRE_DUMP:
4571 if (!do_lxcapi_is_running(c)) {
4572 ERROR("container is not running");
4573 goto on_error;
4574 }
4575 ret = !__criu_pre_dump(c, valid_opts);
4576 break;
4577 case MIGRATE_DUMP:
4578 if (!do_lxcapi_is_running(c)) {
4579 ERROR("container is not running");
4580 goto on_error;
4581 }
4582 ret = !__criu_dump(c, valid_opts);
4583 break;
4584 case MIGRATE_RESTORE:
4585 if (do_lxcapi_is_running(c)) {
4586 ERROR("container is already running");
4587 goto on_error;
4588 }
4589 ret = !__criu_restore(c, valid_opts);
4590 break;
4591 case MIGRATE_FEATURE_CHECK:
4592 features_to_check = valid_opts->features_to_check;
4593 ret = !__criu_check_feature(&features_to_check);
4594 if (ret) {
4595 /* Something went wrong. Let's let the caller
4596 * know which feature checks failed. */
4597 valid_opts->features_to_check = features_to_check;
4598 }
4599 break;
4600 default:
4601 ERROR("invalid migrate command %u", cmd);
4602 ret = -EINVAL;
4603 }
4604
4605 on_error:
4606 if (size < sizeof(*opts))
4607 free(valid_opts);
4608
4609 return ret;
4610 }
4611
4612 WRAP_API_3(int, lxcapi_migrate, unsigned int, struct migrate_opts *, unsigned int)
4613
4614 static bool do_lxcapi_checkpoint(struct lxc_container *c, char *directory, bool stop, bool verbose)
4615 {
4616 struct migrate_opts opts;
4617
4618 memset(&opts, 0, sizeof(opts));
4619
4620 opts.directory = directory;
4621 opts.stop = stop;
4622 opts.verbose = verbose;
4623
4624 return !do_lxcapi_migrate(c, MIGRATE_DUMP, &opts, sizeof(opts));
4625 }
4626
4627 WRAP_API_3(bool, lxcapi_checkpoint, char *, bool, bool)
4628
4629 static bool do_lxcapi_restore(struct lxc_container *c, char *directory, bool verbose)
4630 {
4631 struct migrate_opts opts;
4632
4633 memset(&opts, 0, sizeof(opts));
4634
4635 opts.directory = directory;
4636 opts.verbose = verbose;
4637
4638 return !do_lxcapi_migrate(c, MIGRATE_RESTORE, &opts, sizeof(opts));
4639 }
4640
4641 WRAP_API_2(bool, lxcapi_restore, char *, bool)
4642
4643 static int lxcapi_attach_run_waitl(struct lxc_container *c, lxc_attach_options_t *options, const char *program, const char *arg, ...)
4644 {
4645 va_list ap;
4646 const char **argv;
4647 int ret;
4648
4649 if (!c)
4650 return -1;
4651
4652 current_config = c->lxc_conf;
4653
4654 va_start(ap, arg);
4655 argv = lxc_va_arg_list_to_argv_const(ap, 1);
4656 va_end(ap);
4657
4658 if (!argv) {
4659 ERROR("Memory allocation error.");
4660 ret = -1;
4661 goto out;
4662 }
4663 argv[0] = arg;
4664
4665 ret = do_lxcapi_attach_run_wait(c, options, program, (const char * const *)argv);
4666 free((void*)argv);
4667 out:
4668 current_config = NULL;
4669 return ret;
4670 }
4671
4672 struct lxc_container *lxc_container_new(const char *name, const char *configpath)
4673 {
4674 struct lxc_container *c;
4675
4676 if (!name)
4677 return NULL;
4678
4679 c = malloc(sizeof(*c));
4680 if (!c) {
4681 fprintf(stderr, "Failed to allocate memory for %s\n", name);
4682 return NULL;
4683 }
4684 memset(c, 0, sizeof(*c));
4685
4686 if (configpath)
4687 c->config_path = strdup(configpath);
4688 else
4689 c->config_path = strdup(lxc_global_config_value("lxc.lxcpath"));
4690
4691 if (!c->config_path) {
4692 fprintf(stderr, "Failed to allocate memory for %s\n", name);
4693 goto err;
4694 }
4695
4696 remove_trailing_slashes(c->config_path);
4697 c->name = malloc(strlen(name)+1);
4698 if (!c->name) {
4699 fprintf(stderr, "Failed to allocate memory for %s\n", name);
4700 goto err;
4701 }
4702 strcpy(c->name, name);
4703
4704 c->numthreads = 1;
4705 c->slock = lxc_newlock(c->config_path, name);
4706 if (!c->slock) {
4707 fprintf(stderr, "Failed to create lock for %s\n", name);
4708 goto err;
4709 }
4710
4711 c->privlock = lxc_newlock(NULL, NULL);
4712 if (!c->privlock) {
4713 fprintf(stderr, "Failed to create private lock for %s\n", name);
4714 goto err;
4715 }
4716
4717 if (!set_config_filename(c)) {
4718 fprintf(stderr, "Failed to create config file name for %s\n", name);
4719 goto err;
4720 }
4721
4722 if (file_exists(c->configfile) && !lxcapi_load_config(c, NULL)) {
4723 fprintf(stderr, "Failed to load config for %s\n", name);
4724 goto err;
4725 }
4726
4727 if (ongoing_create(c) == 2) {
4728 ERROR("Failed to complete container creation for %s", c->name);
4729 container_destroy(c, NULL);
4730 lxcapi_clear_config(c);
4731 }
4732 c->daemonize = true;
4733 c->pidfile = NULL;
4734
4735 /* Assign the member functions. */
4736 c->is_defined = lxcapi_is_defined;
4737 c->state = lxcapi_state;
4738 c->is_running = lxcapi_is_running;
4739 c->freeze = lxcapi_freeze;
4740 c->unfreeze = lxcapi_unfreeze;
4741 c->console = lxcapi_console;
4742 c->console_getfd = lxcapi_console_getfd;
4743 c->init_pid = lxcapi_init_pid;
4744 c->load_config = lxcapi_load_config;
4745 c->want_daemonize = lxcapi_want_daemonize;
4746 c->want_close_all_fds = lxcapi_want_close_all_fds;
4747 c->start = lxcapi_start;
4748 c->startl = lxcapi_startl;
4749 c->stop = lxcapi_stop;
4750 c->config_file_name = lxcapi_config_file_name;
4751 c->wait = lxcapi_wait;
4752 c->set_config_item = lxcapi_set_config_item;
4753 c->destroy = lxcapi_destroy;
4754 c->destroy_with_snapshots = lxcapi_destroy_with_snapshots;
4755 c->rename = lxcapi_rename;
4756 c->save_config = lxcapi_save_config;
4757 c->get_keys = lxcapi_get_keys;
4758 c->create = lxcapi_create;
4759 c->createl = lxcapi_createl;
4760 c->shutdown = lxcapi_shutdown;
4761 c->reboot = lxcapi_reboot;
4762 c->reboot2 = lxcapi_reboot2;
4763 c->clear_config = lxcapi_clear_config;
4764 c->clear_config_item = lxcapi_clear_config_item;
4765 c->get_config_item = lxcapi_get_config_item;
4766 c->get_running_config_item = lxcapi_get_running_config_item;
4767 c->get_cgroup_item = lxcapi_get_cgroup_item;
4768 c->set_cgroup_item = lxcapi_set_cgroup_item;
4769 c->get_config_path = lxcapi_get_config_path;
4770 c->set_config_path = lxcapi_set_config_path;
4771 c->clone = lxcapi_clone;
4772 c->get_interfaces = lxcapi_get_interfaces;
4773 c->get_ips = lxcapi_get_ips;
4774 c->attach = lxcapi_attach;
4775 c->attach_run_wait = lxcapi_attach_run_wait;
4776 c->attach_run_waitl = lxcapi_attach_run_waitl;
4777 c->snapshot = lxcapi_snapshot;
4778 c->snapshot_list = lxcapi_snapshot_list;
4779 c->snapshot_restore = lxcapi_snapshot_restore;
4780 c->snapshot_destroy = lxcapi_snapshot_destroy;
4781 c->snapshot_destroy_all = lxcapi_snapshot_destroy_all;
4782 c->may_control = lxcapi_may_control;
4783 c->add_device_node = lxcapi_add_device_node;
4784 c->remove_device_node = lxcapi_remove_device_node;
4785 c->attach_interface = lxcapi_attach_interface;
4786 c->detach_interface = lxcapi_detach_interface;
4787 c->checkpoint = lxcapi_checkpoint;
4788 c->restore = lxcapi_restore;
4789 c->migrate = lxcapi_migrate;
4790 c->console_log = lxcapi_console_log;
4791
4792 return c;
4793
4794 err:
4795 lxc_container_free(c);
4796 return NULL;
4797 }
4798
4799 int lxc_get_wait_states(const char **states)
4800 {
4801 int i;
4802
4803 if (states)
4804 for (i=0; i<MAX_STATE; i++)
4805 states[i] = lxc_state2str(i);
4806 return MAX_STATE;
4807 }
4808
4809 /*
4810 * These next two could probably be done smarter with reusing a common function
4811 * with different iterators and tests...
4812 */
4813 int list_defined_containers(const char *lxcpath, char ***names, struct lxc_container ***cret)
4814 {
4815 DIR *dir;
4816 int i, cfound = 0, nfound = 0;
4817 struct dirent *direntp;
4818 struct lxc_container *c;
4819
4820 if (!lxcpath)
4821 lxcpath = lxc_global_config_value("lxc.lxcpath");
4822
4823 dir = opendir(lxcpath);
4824 if (!dir) {
4825 SYSERROR("opendir on lxcpath");
4826 return -1;
4827 }
4828
4829 if (cret)
4830 *cret = NULL;
4831 if (names)
4832 *names = NULL;
4833
4834 while ((direntp = readdir(dir))) {
4835 if (!direntp)
4836 break;
4837
4838 /* Ignore '.', '..' and any hidden directory. */
4839 if (!strncmp(direntp->d_name, ".", 1))
4840 continue;
4841
4842 if (!config_file_exists(lxcpath, direntp->d_name))
4843 continue;
4844
4845 if (names) {
4846 if (!add_to_array(names, direntp->d_name, cfound))
4847 goto free_bad;
4848 }
4849 cfound++;
4850
4851 if (!cret) {
4852 nfound++;
4853 continue;
4854 }
4855
4856 c = lxc_container_new(direntp->d_name, lxcpath);
4857 if (!c) {
4858 INFO("Container %s:%s has a config but could not be loaded",
4859 lxcpath, direntp->d_name);
4860 if (names)
4861 if(!remove_from_array(names, direntp->d_name, cfound--))
4862 goto free_bad;
4863 continue;
4864 }
4865 if (!do_lxcapi_is_defined(c)) {
4866 INFO("Container %s:%s has a config but is not defined",
4867 lxcpath, direntp->d_name);
4868 if (names)
4869 if(!remove_from_array(names, direntp->d_name, cfound--))
4870 goto free_bad;
4871 lxc_container_put(c);
4872 continue;
4873 }
4874
4875 if (!add_to_clist(cret, c, nfound, true)) {
4876 lxc_container_put(c);
4877 goto free_bad;
4878 }
4879 nfound++;
4880 }
4881
4882 closedir(dir);
4883 return nfound;
4884
4885 free_bad:
4886 if (names && *names) {
4887 for (i=0; i<cfound; i++)
4888 free((*names)[i]);
4889 free(*names);
4890 }
4891 if (cret && *cret) {
4892 for (i=0; i<nfound; i++)
4893 lxc_container_put((*cret)[i]);
4894 free(*cret);
4895 }
4896 closedir(dir);
4897 return -1;
4898 }
4899
4900 int list_active_containers(const char *lxcpath, char ***nret,
4901 struct lxc_container ***cret)
4902 {
4903 int i, ret = -1, cret_cnt = 0, ct_name_cnt = 0;
4904 int lxcpath_len;
4905 char *line = NULL;
4906 char **ct_name = NULL;
4907 size_t len = 0;
4908 struct lxc_container *c = NULL;
4909 bool is_hashed;
4910
4911 if (!lxcpath)
4912 lxcpath = lxc_global_config_value("lxc.lxcpath");
4913 lxcpath_len = strlen(lxcpath);
4914
4915 if (cret)
4916 *cret = NULL;
4917 if (nret)
4918 *nret = NULL;
4919
4920 FILE *f = fopen("/proc/net/unix", "r");
4921 if (!f)
4922 return -1;
4923
4924 while (getline(&line, &len, f) != -1) {
4925
4926 char *p = strrchr(line, ' '), *p2;
4927 if (!p)
4928 continue;
4929 p++;
4930 if (*p != 0x40)
4931 continue;
4932 p++;
4933
4934 is_hashed = false;
4935 if (strncmp(p, lxcpath, lxcpath_len) == 0) {
4936 p += lxcpath_len;
4937 } else if (strncmp(p, "lxc/", 4) == 0) {
4938 p += 4;
4939 is_hashed = true;
4940 } else {
4941 continue;
4942 }
4943
4944 while (*p == '/')
4945 p++;
4946
4947 /* Now p is the start of lxc_name. */
4948 p2 = strchr(p, '/');
4949 if (!p2 || strncmp(p2, "/command", 8) != 0)
4950 continue;
4951 *p2 = '\0';
4952
4953 if (is_hashed) {
4954 char *recvpath = lxc_cmd_get_lxcpath(p);
4955 if (!recvpath)
4956 continue;
4957 if (strncmp(lxcpath, recvpath, lxcpath_len) != 0)
4958 continue;
4959 p = lxc_cmd_get_name(p);
4960 if (!p)
4961 continue;
4962 }
4963
4964 if (array_contains(&ct_name, p, ct_name_cnt))
4965 continue;
4966
4967 if (!add_to_array(&ct_name, p, ct_name_cnt))
4968 goto free_cret_list;
4969
4970 ct_name_cnt++;
4971
4972 if (!cret)
4973 continue;
4974
4975 c = lxc_container_new(p, lxcpath);
4976 if (!c) {
4977 INFO("Container %s:%s is running but could not be loaded",
4978 lxcpath, p);
4979 remove_from_array(&ct_name, p, ct_name_cnt--);
4980 continue;
4981 }
4982
4983 /*
4984 * If this is an anonymous container, then is_defined *can*
4985 * return false. So we don't do that check. Count on the
4986 * fact that the command socket exists.
4987 */
4988
4989 if (!add_to_clist(cret, c, cret_cnt, true)) {
4990 lxc_container_put(c);
4991 goto free_cret_list;
4992 }
4993 cret_cnt++;
4994 }
4995
4996 if (nret && cret && cret_cnt != ct_name_cnt) {
4997 if (c)
4998 lxc_container_put(c);
4999 goto free_cret_list;
5000 }
5001
5002 ret = ct_name_cnt;
5003 if (nret)
5004 *nret = ct_name;
5005 else
5006 goto free_ct_name;
5007 goto out;
5008
5009 free_cret_list:
5010 if (cret && *cret) {
5011 for (i = 0; i < cret_cnt; i++)
5012 lxc_container_put((*cret)[i]);
5013 free(*cret);
5014 }
5015
5016 free_ct_name:
5017 if (ct_name) {
5018 for (i = 0; i < ct_name_cnt; i++)
5019 free(ct_name[i]);
5020 free(ct_name);
5021 }
5022
5023 out:
5024 free(line);
5025
5026 fclose(f);
5027 return ret;
5028 }
5029
5030 int list_all_containers(const char *lxcpath, char ***nret,
5031 struct lxc_container ***cret)
5032 {
5033 int i, ret, active_cnt, ct_cnt, ct_list_cnt;
5034 char **active_name;
5035 char **ct_name;
5036 struct lxc_container **ct_list = NULL;
5037
5038 ct_cnt = list_defined_containers(lxcpath, &ct_name, NULL);
5039 if (ct_cnt < 0)
5040 return ct_cnt;
5041
5042 active_cnt = list_active_containers(lxcpath, &active_name, NULL);
5043 if (active_cnt < 0) {
5044 ret = active_cnt;
5045 goto free_ct_name;
5046 }
5047
5048 for (i = 0; i < active_cnt; i++) {
5049 if (!array_contains(&ct_name, active_name[i], ct_cnt)) {
5050 if (!add_to_array(&ct_name, active_name[i], ct_cnt)) {
5051 ret = -1;
5052 goto free_active_name;
5053 }
5054 ct_cnt++;
5055 }
5056 free(active_name[i]);
5057 active_name[i] = NULL;
5058 }
5059 free(active_name);
5060 active_name = NULL;
5061 active_cnt = 0;
5062
5063 for (i = 0, ct_list_cnt = 0; i < ct_cnt && cret; i++) {
5064 struct lxc_container *c;
5065
5066 c = lxc_container_new(ct_name[i], lxcpath);
5067 if (!c) {
5068 WARN("Container %s:%s could not be loaded", lxcpath, ct_name[i]);
5069 remove_from_array(&ct_name, ct_name[i], ct_cnt--);
5070 continue;
5071 }
5072
5073 if (!add_to_clist(&ct_list, c, ct_list_cnt, false)) {
5074 lxc_container_put(c);
5075 ret = -1;
5076 goto free_ct_list;
5077 }
5078 ct_list_cnt++;
5079 }
5080
5081 if (cret)
5082 *cret = ct_list;
5083
5084 if (nret)
5085 *nret = ct_name;
5086 else {
5087 ret = ct_cnt;
5088 goto free_ct_name;
5089 }
5090 return ct_cnt;
5091
5092 free_ct_list:
5093 for (i = 0; i < ct_list_cnt; i++) {
5094 lxc_container_put(ct_list[i]);
5095 }
5096 free(ct_list);
5097
5098 free_active_name:
5099 for (i = 0; i < active_cnt; i++) {
5100 free(active_name[i]);
5101 }
5102 free(active_name);
5103
5104 free_ct_name:
5105 for (i = 0; i < ct_cnt; i++) {
5106 free(ct_name[i]);
5107 }
5108 free(ct_name);
5109 return ret;
5110 }
5111
5112 bool lxc_config_item_is_supported(const char *key)
5113 {
5114 return !!lxc_get_config(key);
5115 }
LXC mirror