]> git.proxmox.com Git - mirror_lxc.git/blob - src/lxc/lxccontainer.c
projects / mirror_lxc.git / blob
? search:
summary | shortlog | log | commit | commitdiff | tree
blame | history | raw | HEAD
github: Update for main branch
[mirror_lxc.git] / src / lxc / lxccontainer.c
1 /* SPDX-License-Identifier: LGPL-2.1+ */
2
3 #include "config.h"
4
5 #include <arpa/inet.h>
6 #include <dirent.h>
7 #include <errno.h>
8 #include <fcntl.h>
9 #include <grp.h>
10 #include <libgen.h>
11 #include <pthread.h>
12 #include <sched.h>
13 #include <stdarg.h>
14 #include <stdint.h>
15 #include <stdio.h>
16 #include <stdlib.h>
17 #include <sys/file.h>
18 #include <sys/mman.h>
19 #include <sys/mount.h>
20 #include <sys/stat.h>
21 #include <sys/syscall.h>
22 #include <sys/sysmacros.h>
23 #include <sys/types.h>
24 #include <sys/wait.h>
25 #include <unistd.h>
26
27 #include "lxc.h"
28
29 #include "netns_ifaddrs.h"
30 #include "af_unix.h"
31 #include "api_extensions.h"
32 #include "attach.h"
33 #include "cgroup.h"
34 #include "macro.h"
35 #include "commands.h"
36 #include "commands_utils.h"
37 #include "conf.h"
38 #include "confile.h"
39 #include "confile_utils.h"
40 #include "criu.h"
41 #include "error.h"
42 #include "initutils.h"
43 #include "log.h"
44 #include "lxc.h"
45 #include "lxclock.h"
46 #include "memory_utils.h"
47 #include "monitor.h"
48 #include "namespace.h"
49 #include "network.h"
50 #include "open_utils.h"
51 #include "parse.h"
52 #include "process_utils.h"
53 #include "start.h"
54 #include "state.h"
55 #include "storage.h"
56 #include "storage/btrfs.h"
57 #include "storage/overlay.h"
58 #include "storage_utils.h"
59 #include "sync.h"
60 #include "syscall_wrappers.h"
61 #include "terminal.h"
62 #include "utils.h"
63 #include "version.h"
64
65 #if HAVE_OPENSSL
66 #include <openssl/evp.h>
67 #endif
68
69 /* major()/minor() */
70 #ifdef MAJOR_IN_MKDEV
71 #include <sys/mkdev.h>
72 #endif
73
74 #if IS_BIONIC
75 #include <../include/lxcmntent.h>
76 #else
77 #include <mntent.h>
78 #endif
79
80 #if !HAVE_STRLCPY
81 #include "include/strlcpy.h"
82 #endif
83
84 lxc_log_define(lxccontainer, lxc);
85
86 static bool do_lxcapi_destroy(struct lxc_container *c);
87 static const char *lxcapi_get_config_path(struct lxc_container *c);
88 #define do_lxcapi_get_config_path(c) lxcapi_get_config_path(c)
89 static bool do_lxcapi_set_config_item(struct lxc_container *c, const char *key, const char *v);
90 static bool container_destroy(struct lxc_container *c,
91 struct lxc_storage *storage);
92 static bool get_snappath_dir(struct lxc_container *c, char *snappath);
93 static bool lxcapi_snapshot_destroy_all(struct lxc_container *c);
94 static bool do_lxcapi_save_config(struct lxc_container *c, const char *alt_file);
95
96 static bool config_file_exists(const char *lxcpath, const char *cname)
97 {
98 __do_free char *fname = NULL;
99 int ret;
100 size_t len;
101
102 /* $lxcpath + '/' + $cname + '/config' + \0 */
103 len = strlen(lxcpath) + 1 + strlen(cname) + 1 + strlen(LXC_CONFIG_FNAME) + 1;
104 fname = must_realloc(NULL, len);
105 ret = strnprintf(fname, len, "%s/%s/%s", lxcpath, cname, LXC_CONFIG_FNAME);
106 if (ret < 0)
107 return false;
108
109 return file_exists(fname);
110 }
111
112 /*
113 * A few functions to help detect when a container creation failed. If a
114 * container creation was killed partway through, then trying to actually start
115 * that container could harm the host. We detect this by creating a 'partial'
116 * file under the container directory, and keeping an advisory lock. When
117 * container creation completes, we remove that file. When we load or try to
118 * start a container, if we find that file, without a flock, we remove the
119 * container.
120 */
121 enum {
122 LXC_CREATE_FAILED = -1,
123 LXC_CREATE_SUCCESS = 0,
124 LXC_CREATE_ONGOING = 1,
125 LXC_CREATE_INCOMPLETE = 2,
126 };
127
128 static int ongoing_create(struct lxc_container *c)
129 {
130 __do_close int fd = -EBADF;
131 __do_free char *path = NULL;
132 struct flock lk = {0};
133 int ret;
134 size_t len;
135
136 len = strlen(c->config_path) + 1 + strlen(c->name) + 1 + strlen(LXC_PARTIAL_FNAME) + 1;
137 path = must_realloc(NULL, len);
138 ret = strnprintf(path, len, "%s/%s/%s", c->config_path, c->name, LXC_PARTIAL_FNAME);
139 if (ret < 0)
140 return LXC_CREATE_FAILED;
141
142 fd = open(path, O_RDWR | O_CLOEXEC);
143 if (fd < 0) {
144 if (errno != ENOENT)
145 return LXC_CREATE_FAILED;
146
147 return LXC_CREATE_SUCCESS;
148 }
149
150 lk.l_type = F_WRLCK;
151 lk.l_whence = SEEK_SET;
152 /*
153 * F_OFD_GETLK requires that l_pid be set to 0 otherwise the kernel
154 * will EINVAL us.
155 */
156 lk.l_pid = 0;
157
158 ret = fcntl(fd, F_OFD_GETLK, &lk);
159 if (ret < 0 && errno == EINVAL) {
160 ret = flock(fd, LOCK_EX | LOCK_NB);
161 if (ret < 0 && errno == EWOULDBLOCK)
162 ret = 0;
163 }
164
165 /* F_OFD_GETLK will not send us back a pid so don't check it. */
166 if (ret == 0)
167 /* Create is still ongoing. */
168 return LXC_CREATE_ONGOING;
169
170 /* Create completed but partial is still there. */
171 return LXC_CREATE_INCOMPLETE;
172 }
173
174 static int create_partial(int fd_rootfs, struct lxc_container *c)
175 {
176 __do_close int fd_partial = -EBADF;
177 int ret;
178 struct flock lk = {0};
179
180 fd_partial = openat(fd_rootfs, LXC_PARTIAL_FNAME, O_RDWR | O_CREAT | O_EXCL | O_CLOEXEC, 0000);
181 if (fd_partial < 0)
182 return syserror("errno(%d) - Failed to create \"%d/" LXC_PARTIAL_FNAME "\" to mark container as partially created", errno, fd_rootfs);
183
184 lk.l_type = F_WRLCK;
185 lk.l_whence = SEEK_SET;
186
187 ret = fcntl(fd_partial, F_OFD_SETLKW, &lk);
188 if (ret < 0) {
189 if (errno == EINVAL) {
190 ret = flock(fd_partial, LOCK_EX);
191 if (ret == 0)
192 return move_fd(fd_partial);
193 }
194
195 return syserror("Failed to lock partial file \"%d/" LXC_PARTIAL_FNAME"\"", fd_rootfs);
196 }
197
198 TRACE("Created \"%d/" LXC_PARTIAL_FNAME "\" to mark container as partially created", fd_rootfs);
199 return move_fd(fd_partial);
200 }
201
202 static void remove_partial(struct lxc_container *c, int fd)
203 {
204 __do_free char *path = NULL;
205 int ret;
206 size_t len;
207
208 close(fd);
209
210 /* $lxcpath + '/' + $name + '/partial' + \0 */
211 len = strlen(c->config_path) + 1 + strlen(c->name) + 1 + strlen(LXC_PARTIAL_FNAME) + 1;
212 path = must_realloc(NULL, len);
213 ret = strnprintf(path, len, "%s/%s/%s", c->config_path, c->name, LXC_PARTIAL_FNAME);
214 if (ret < 0)
215 return;
216
217 ret = unlink(path);
218 if (ret < 0)
219 SYSERROR("Failed to remove partial file %s", path);
220 }
221
222 /* LOCKING
223 * 1. container_mem_lock(c) protects the struct lxc_container from multiple threads.
224 * 2. container_disk_lock(c) protects the on-disk container data - in particular the
225 * container configuration file.
226 * The container_disk_lock also takes the container_mem_lock.
227 * 3. thread_mutex protects process data (ex: fd table) from multiple threads.
228 * NOTHING mutexes two independent programs with their own struct
229 * lxc_container for the same c->name, between API calls. For instance,
230 * c->config_read(); c->start(); Between those calls, data on disk
231 * could change (which shouldn't bother the caller unless for instance
232 * the rootfs get moved). c->config_read(); update; c->config_write();
233 * Two such updaters could race. The callers should therefore check their
234 * results. Trying to prevent that would necessarily expose us to deadlocks
235 * due to hung callers. So I prefer to keep the locks only within our own
236 * functions, not across functions.
237 *
238 * If you're going to clone while holding a lxccontainer, increment
239 * c->numthreads (under privlock) before forking. When deleting,
240 * decrement numthreads under privlock, then if it hits 0 you can delete.
241 * Do not ever use a lxccontainer whose numthreads you did not bump.
242 */
243 static void lxc_container_free(struct lxc_container *c)
244 {
245 if (!c)
246 return;
247
248 free(c->configfile);
249 c->configfile = NULL;
250
251 free(c->error_string);
252 c->error_string = NULL;
253
254 if (c->slock) {
255 lxc_putlock(c->slock);
256 c->slock = NULL;
257 }
258
259 if (c->privlock) {
260 lxc_putlock(c->privlock);
261 c->privlock = NULL;
262 }
263
264 free(c->name);
265 c->name = NULL;
266
267 if (c->lxc_conf) {
268 lxc_conf_free(c->lxc_conf);
269 c->lxc_conf = NULL;
270 }
271
272 free(c->config_path);
273 c->config_path = NULL;
274
275 free(c);
276 }
277
278 /* Consider the following case:
279 *
280 * |====================================================================|
281 * | freer | racing get()er |
282 * |====================================================================|
283 * | lxc_container_put() | lxc_container_get() |
284 * | \ lxclock(c->privlock) | c->numthreads < 1? (no) |
285 * | \ c->numthreads = 0 | \ lxclock(c->privlock) -> waits |
286 * | \ lxcunlock() | \ |
287 * | \ lxc_container_free() | \ lxclock() returns |
288 * | | \ c->numthreads < 1 -> return 0 |
289 * | \ \ (free stuff) | |
290 * | \ \ sem_destroy(privlock) | |
291 * |_______________________________|____________________________________|
292 *
293 * When the get()er checks numthreads the first time, one of the following
294 * is true:
295 * 1. freer has set numthreads = 0. get() returns 0
296 * 2. freer is between lxclock and setting numthreads to 0. get()er will
297 * sem_wait on privlock, get lxclock after freer() drops it, then see
298 * numthreads is 0 and exit without touching lxclock again..
299 * 3. freer has not yet locked privlock. If get()er runs first, then put()er
300 * will see --numthreads = 1 and not call lxc_container_free().
301 */
302
303 int lxc_container_get(struct lxc_container *c)
304 {
305 if (!c)
306 return 0;
307
308 /* If someone else has already started freeing the container, don't try
309 * to take the lock, which may be invalid.
310 */
311 if (c->numthreads < 1)
312 return 0;
313
314 if (container_mem_lock(c))
315 return 0;
316
317 /* Bail without trying to unlock, bc the privlock is now probably in
318 * freed memory.
319 */
320 if (c->numthreads < 1)
321 return 0;
322
323 c->numthreads++;
324 container_mem_unlock(c);
325
326 return 1;
327 }
328
329 int lxc_container_put(struct lxc_container *c)
330 {
331 if (!c)
332 return -1;
333
334 if (container_mem_lock(c))
335 return -1;
336
337 c->numthreads--;
338
339 if (c->numthreads < 1) {
340 container_mem_unlock(c);
341 lxc_container_free(c);
342 return 1;
343 }
344
345 container_mem_unlock(c);
346 return 0;
347 }
348
349 static bool do_lxcapi_is_defined(struct lxc_container *c)
350 {
351 int statret;
352 struct stat statbuf;
353 bool ret = false;
354
355 if (!c)
356 return false;
357
358 if (container_mem_lock(c))
359 return false;
360
361 if (!c->configfile)
362 goto on_error;
363
364 statret = stat(c->configfile, &statbuf);
365 if (statret != 0)
366 goto on_error;
367
368 ret = true;
369
370 on_error:
371 container_mem_unlock(c);
372 return ret;
373 }
374
375 #define WRAP_API(rettype, fnname) \
376 static rettype fnname(struct lxc_container *c) \
377 { \
378 rettype ret; \
379 bool reset_config = false; \
380 \
381 if (!current_config && c && c->lxc_conf) { \
382 current_config = c->lxc_conf; \
383 reset_config = true; \
384 } \
385 \
386 ret = do_##fnname(c); \
387 if (reset_config) \
388 current_config = NULL; \
389 \
390 return ret; \
391 }
392
393 #define WRAP_API_1(rettype, fnname, t1) \
394 static rettype fnname(struct lxc_container *c, t1 a1) \
395 { \
396 rettype ret; \
397 bool reset_config = false; \
398 \
399 if (!current_config && c && c->lxc_conf) { \
400 current_config = c->lxc_conf; \
401 reset_config = true; \
402 } \
403 \
404 ret = do_##fnname(c, a1); \
405 if (reset_config) \
406 current_config = NULL; \
407 \
408 return ret; \
409 }
410
411 #define WRAP_API_2(rettype, fnname, t1, t2) \
412 static rettype fnname(struct lxc_container *c, t1 a1, t2 a2) \
413 { \
414 rettype ret; \
415 bool reset_config = false; \
416 \
417 if (!current_config && c && c->lxc_conf) { \
418 current_config = c->lxc_conf; \
419 reset_config = true; \
420 } \
421 \
422 ret = do_##fnname(c, a1, a2); \
423 if (reset_config) \
424 current_config = NULL; \
425 \
426 return ret; \
427 }
428
429 #define WRAP_API_3(rettype, fnname, t1, t2, t3) \
430 static rettype fnname(struct lxc_container *c, t1 a1, t2 a2, t3 a3) \
431 { \
432 rettype ret; \
433 bool reset_config = false; \
434 \
435 if (!current_config && c && c->lxc_conf) { \
436 current_config = c->lxc_conf; \
437 reset_config = true; \
438 } \
439 \
440 ret = do_##fnname(c, a1, a2, a3); \
441 if (reset_config) \
442 current_config = NULL; \
443 \
444 return ret; \
445 }
446
447 #define WRAP_API_5(rettype, fnname, t1, t2, t3, t4, t5) \
448 static rettype fnname(struct lxc_container *c, t1 a1, t2 a2, t3 a3, \
449 t4 a4, t5 a5) \
450 { \
451 rettype ret; \
452 bool reset_config = false; \
453 \
454 if (!current_config && c && c->lxc_conf) { \
455 current_config = c->lxc_conf; \
456 reset_config = true; \
457 } \
458 \
459 ret = do_##fnname(c, a1, a2, a3, a4, a5); \
460 if (reset_config) \
461 current_config = NULL; \
462 \
463 return ret; \
464 }
465
466 #define WRAP_API_6(rettype, fnname, t1, t2, t3, t4, t5, t6) \
467 static rettype fnname(struct lxc_container *c, t1 a1, t2 a2, t3 a3, \
468 t4 a4, t5 a5, t6 a6) \
469 { \
470 rettype ret; \
471 bool reset_config = false; \
472 \
473 if (!current_config && c && c->lxc_conf) { \
474 current_config = c->lxc_conf; \
475 reset_config = true; \
476 } \
477 \
478 ret = do_##fnname(c, a1, a2, a3, a4, a5, a6); \
479 if (reset_config) \
480 current_config = NULL; \
481 \
482 return ret; \
483 }
484
485 WRAP_API(bool, lxcapi_is_defined)
486
487 static const char *do_lxcapi_state(struct lxc_container *c)
488 {
489 lxc_state_t s;
490
491 if (!c)
492 return NULL;
493
494 s = lxc_getstate(c->name, c->config_path);
495 return lxc_state2str(s);
496 }
497
498 WRAP_API(const char *, lxcapi_state)
499
500 static bool is_stopped(struct lxc_container *c)
501 {
502 lxc_state_t s;
503
504 s = lxc_getstate(c->name, c->config_path);
505 return (s == STOPPED);
506 }
507
508 static bool do_lxcapi_is_running(struct lxc_container *c)
509 {
510 if (!c)
511 return false;
512
513 return !is_stopped(c);
514 }
515
516 WRAP_API(bool, lxcapi_is_running)
517
518 static bool do_lxcapi_freeze(struct lxc_container *c)
519 {
520 int ret = 0;
521 lxc_state_t s;
522
523 if (!c || !c->lxc_conf)
524 return false;
525
526 s = lxc_getstate(c->name, c->config_path);
527 if (s != FROZEN) {
528 ret = cgroup_freeze(c->name, c->config_path, -1);
529 if (ret == -ENOCGROUP2)
530 ret = lxc_freeze(c->lxc_conf, c->name, c->config_path);
531 }
532
533 return ret == 0;
534 }
535
536 WRAP_API(bool, lxcapi_freeze)
537
538 static bool do_lxcapi_unfreeze(struct lxc_container *c)
539 {
540 int ret = 0;
541 lxc_state_t s;
542
543 if (!c || !c->lxc_conf)
544 return false;
545
546 s = lxc_getstate(c->name, c->config_path);
547 if (s == FROZEN) {
548 ret = cgroup_unfreeze(c->name, c->config_path, -1);
549 if (ret == -ENOCGROUP2)
550 ret = lxc_unfreeze(c->lxc_conf, c->name, c->config_path);
551 }
552
553
554 return ret == 0;
555 }
556
557 WRAP_API(bool, lxcapi_unfreeze)
558
559 static int do_lxcapi_console_getfd(struct lxc_container *c, int *ttynum, int *ptxfd)
560 {
561 if (!c)
562 return -1;
563
564 return lxc_terminal_getfd(c, ttynum, ptxfd);
565 }
566
567 WRAP_API_2(int, lxcapi_console_getfd, int *, int *)
568
569 static int lxcapi_console(struct lxc_container *c, int ttynum, int stdinfd,
570 int stdoutfd, int stderrfd, int escape)
571 {
572 int ret;
573
574 if (!c)
575 return -1;
576
577 current_config = c->lxc_conf;
578 ret = lxc_console(c, ttynum, stdinfd, stdoutfd, stderrfd, escape);
579 current_config = NULL;
580
581 return ret;
582 }
583
584 static int do_lxcapi_console_log(struct lxc_container *c, struct lxc_console_log *log)
585 {
586 int ret;
587
588 if (!c)
589 return -EINVAL;
590
591 ret = lxc_cmd_console_log(c->name, do_lxcapi_get_config_path(c), log);
592 if (ret < 0) {
593 if (ret == -ENODATA)
594 NOTICE("The console log is empty");
595 else if (ret == -EFAULT)
596 NOTICE("The container does not keep a console log");
597 else if (ret == -ENOENT)
598 NOTICE("The container does not keep a console log file");
599 else if (ret == -EIO)
600 NOTICE("Failed to write console log to log file");
601 else
602 ERROR("Failed to retrieve console log");
603 }
604
605 return ret;
606 }
607
608 WRAP_API_1(int, lxcapi_console_log, struct lxc_console_log *)
609
610 static pid_t do_lxcapi_init_pid(struct lxc_container *c)
611 {
612 if (!c)
613 return -1;
614
615 return lxc_cmd_get_init_pid(c->name, c->config_path);
616 }
617
618 WRAP_API(pid_t, lxcapi_init_pid)
619
620 static int do_lxcapi_init_pidfd(struct lxc_container *c)
621 {
622 if (!c)
623 return ret_errno(EBADF);
624
625 return lxc_cmd_get_init_pidfd(c->name, c->config_path);
626 }
627
628 WRAP_API(int, lxcapi_init_pidfd)
629
630 static int do_lxcapi_devpts_fd(struct lxc_container *c)
631 {
632 if (!c)
633 return ret_errno(EBADF);
634
635 return lxc_cmd_get_devpts_fd(c->name, c->config_path);
636 }
637
638 WRAP_API(int, lxcapi_devpts_fd)
639
640 static bool load_config_locked(struct lxc_container *c, const char *fname)
641 {
642 if (!c->lxc_conf)
643 c->lxc_conf = lxc_conf_init();
644
645 if (!c->lxc_conf)
646 return false;
647
648 if (lxc_config_read(fname, c->lxc_conf, false) != 0)
649 return false;
650
651 c->lxc_conf->name = c->name;
652 return true;
653 }
654
655 static bool do_lxcapi_load_config(struct lxc_container *c, const char *alt_file)
656 {
657 int lret;
658 const char *fname;
659 bool need_disklock = false, ret = false;
660
661 if (!c)
662 return false;
663
664 fname = c->configfile;
665
666 if (alt_file)
667 fname = alt_file;
668
669 if (!fname)
670 return false;
671
672 /* If we're reading something other than the container's config, we only
673 * need to lock the in-memory container. If loading the container's
674 * config file, take the disk lock.
675 */
676 if (strequal(fname, c->configfile))
677 need_disklock = true;
678
679 if (need_disklock)
680 lret = container_disk_lock(c);
681 else
682 lret = container_mem_lock(c);
683 if (lret)
684 return false;
685
686 ret = load_config_locked(c, fname);
687
688 if (need_disklock)
689 container_disk_unlock(c);
690 else
691 container_mem_unlock(c);
692
693 return ret;
694 }
695
696 WRAP_API_1(bool, lxcapi_load_config, const char *)
697
698 static bool do_lxcapi_want_daemonize(struct lxc_container *c, bool state)
699 {
700 if (!c || !c->lxc_conf)
701 return false;
702
703 if (container_mem_lock(c))
704 return false;
705
706 c->daemonize = state;
707
708 container_mem_unlock(c);
709
710 return true;
711 }
712
713 WRAP_API_1(bool, lxcapi_want_daemonize, bool)
714
715 static bool do_lxcapi_want_close_all_fds(struct lxc_container *c, bool state)
716 {
717 if (!c || !c->lxc_conf)
718 return false;
719
720 if (container_mem_lock(c))
721 return false;
722
723 c->lxc_conf->close_all_fds = state;
724
725 container_mem_unlock(c);
726
727 return true;
728 }
729
730 WRAP_API_1(bool, lxcapi_want_close_all_fds, bool)
731
732 static bool do_lxcapi_wait(struct lxc_container *c, const char *state,
733 int timeout)
734 {
735 int ret;
736
737 if (!c)
738 return false;
739
740 ret = lxc_wait(c->name, state, timeout, c->config_path);
741 return ret == 0;
742 }
743
744 WRAP_API_2(bool, lxcapi_wait, const char *, int)
745
746 static bool am_single_threaded(void)
747 {
748 __do_closedir DIR *dir = NULL;
749 struct dirent *direntp;
750 int count = 0;
751
752 dir = opendir("/proc/self/task");
753 if (!dir)
754 return false;
755
756 while ((direntp = readdir(dir))) {
757 if (strequal(direntp->d_name, "."))
758 continue;
759
760 if (strequal(direntp->d_name, ".."))
761 continue;
762
763 count++;
764 if (count > 1)
765 break;
766 }
767
768 return count == 1;
769 }
770
771 static void push_arg(char ***argp, char *arg, int *nargs)
772 {
773 char *copy;
774 char **argv;
775
776 copy = must_copy_string(arg);
777
778 do {
779 argv = realloc(*argp, (*nargs + 2) * sizeof(char *));
780 } while (!argv);
781
782 *argp = argv;
783 argv[*nargs] = copy;
784 (*nargs)++;
785 argv[*nargs] = NULL;
786 }
787
788 static char **split_init_cmd(const char *incmd)
789 {
790 __do_free char *copy = NULL;
791 char *p;
792 char **argv;
793 int nargs = 0;
794
795 if (!incmd)
796 return NULL;
797
798 copy = must_copy_string(incmd);
799
800 do {
801 argv = malloc(sizeof(char *));
802 } while (!argv);
803
804 argv[0] = NULL;
805 lxc_iterate_parts (p, copy, " ")
806 push_arg(&argv, p, &nargs);
807
808 if (nargs == 0) {
809 free(argv);
810 return NULL;
811 }
812
813 return argv;
814 }
815
816 static void free_init_cmd(char **argv)
817 {
818 int i = 0;
819
820 if (!argv)
821 return;
822
823 while (argv[i])
824 free(argv[i++]);
825
826 free(argv);
827 }
828
829 static int lxc_rcv_status(int state_socket)
830 {
831 int ret;
832 int state = -1;
833
834 again:
835 /* Receive container state. */
836 ret = lxc_abstract_unix_rcv_credential(state_socket, &state, sizeof(int));
837 if (ret <= 0) {
838 if (errno != EINTR)
839 return -1;
840
841 TRACE("Caught EINTR; retrying");
842 goto again;
843 }
844
845 return state;
846 }
847
848 static bool wait_on_daemonized_start(struct lxc_handler *handler, int pid)
849 {
850 int ret, state;
851
852 /* The first child is going to fork() again and then exits. So we reap
853 * the first child here.
854 */
855 ret = wait_for_pid(pid);
856 if (ret < 0)
857 DEBUG("Failed waiting on first child %d", pid);
858 else
859 DEBUG("First child %d exited", pid);
860
861 /* Close write end of the socket pair. */
862 close_prot_errno_disarm(handler->state_socket_pair[1]);
863
864 state = lxc_rcv_status(handler->state_socket_pair[0]);
865
866 /* Close read end of the socket pair. */
867 close_prot_errno_disarm(handler->state_socket_pair[0]);
868
869 if (state < 0) {
870 SYSERROR("Failed to receive the container state");
871 return false;
872 }
873
874 /* If we receive anything else then running we know that the container
875 * failed to start.
876 */
877 if (state != RUNNING) {
878 ERROR("Received container state \"%s\" instead of \"RUNNING\"",
879 lxc_state2str(state));
880 return false;
881 }
882
883 TRACE("Container is in \"RUNNING\" state");
884 return true;
885 }
886
887 static bool do_lxcapi_start(struct lxc_container *c, int useinit, char * const argv[])
888 {
889 int ret;
890 struct lxc_handler *handler;
891 struct lxc_conf *conf;
892 char *default_args[] = {
893 "/sbin/init",
894 NULL,
895 };
896 char **init_cmd = NULL;
897
898 /* container does exist */
899 if (!c)
900 return false;
901
902 /* If anything fails before we set error_num, we want an error in there.
903 */
904 c->error_num = 1;
905
906 /* Container has not been setup. */
907 if (!c->lxc_conf)
908 return false;
909
910 ret = ongoing_create(c);
911 switch (ret) {
912 case LXC_CREATE_FAILED:
913 ERROR("Failed checking for incomplete container creation");
914 return false;
915 case LXC_CREATE_ONGOING:
916 ERROR("Ongoing container creation detected");
917 return false;
918 case LXC_CREATE_INCOMPLETE:
919 ERROR("Failed to create container");
920 do_lxcapi_destroy(c);
921 return false;
922 }
923
924 if (container_mem_lock(c))
925 return false;
926
927 conf = c->lxc_conf;
928
929 /* initialize handler */
930 handler = lxc_init_handler(NULL, c->name, conf, c->config_path, c->daemonize);
931
932 container_mem_unlock(c);
933 if (!handler)
934 return false;
935
936 if (!argv) {
937 if (useinit && conf->execute_cmd)
938 argv = init_cmd = split_init_cmd(conf->execute_cmd);
939 else
940 argv = init_cmd = split_init_cmd(conf->init_cmd);
941 }
942
943 /* ... otherwise use default_args. */
944 if (!argv) {
945 if (useinit) {
946 ERROR("No valid init detected");
947 lxc_put_handler(handler);
948 return false;
949 }
950 argv = default_args;
951 }
952
953 /* I'm not sure what locks we want here.Any? Is liblxc's locking enough
954 * here to protect the on disk container? We don't want to exclude
955 * things like lxc_info while the container is running.
956 */
957 if (c->daemonize) {
958 bool started;
959 char title[2048];
960 pid_t pid_first, pid_second;
961
962 pid_first = fork();
963 if (pid_first < 0) {
964 free_init_cmd(init_cmd);
965 lxc_put_handler(handler);
966 return false;
967 }
968
969 /* first parent */
970 if (pid_first != 0) {
971 /* Set to NULL because we don't want father unlink
972 * the PID file, child will do the free and unlink.
973 */
974 c->pidfile = NULL;
975
976 /* Wait for container to tell us whether it started
977 * successfully.
978 */
979 started = wait_on_daemonized_start(handler, pid_first);
980
981 free_init_cmd(init_cmd);
982 lxc_put_handler(handler);
983 return started;
984 }
985
986 /* first child */
987
988 /* We don't really care if this doesn't print all the
989 * characters. All that it means is that the proctitle will be
990 * ugly. Similarly, we also don't care if setproctitle() fails.
991 */
992 ret = strnprintf(title, sizeof(title), "[lxc monitor] %s %s", c->config_path, c->name);
993 if (ret > 0) {
994 ret = setproctitle(title);
995 if (ret < 0)
996 INFO("Failed to set process title to %s", title);
997 else
998 INFO("Set process title to %s", title);
999 }
1000
1001 /* We fork() a second time to be reparented to init. Like
1002 * POSIX's daemon() function we change to "/" and redirect
1003 * std{in,out,err} to /dev/null.
1004 */
1005 pid_second = fork();
1006 if (pid_second < 0) {
1007 SYSERROR("Failed to fork first child process");
1008 _exit(EXIT_FAILURE);
1009 }
1010
1011 /* second parent */
1012 if (pid_second != 0) {
1013 free_init_cmd(init_cmd);
1014 lxc_put_handler(handler);
1015 _exit(EXIT_SUCCESS);
1016 }
1017
1018 /* second child */
1019
1020 /* change to / directory */
1021 ret = chdir("/");
1022 if (ret < 0) {
1023 SYSERROR("Failed to change to \"/\" directory");
1024 _exit(EXIT_FAILURE);
1025 }
1026
1027 ret = inherit_fds(handler, true);
1028 if (ret < 0)
1029 _exit(EXIT_FAILURE);
1030
1031 /* redirect std{in,out,err} to /dev/null */
1032 ret = null_stdfds();
1033 if (ret < 0) {
1034 ERROR("Failed to redirect std{in,out,err} to /dev/null");
1035 _exit(EXIT_FAILURE);
1036 }
1037
1038 /* become session leader */
1039 ret = setsid();
1040 if (ret < 0)
1041 TRACE("Process %d is already process group leader", lxc_raw_getpid());
1042 } else if (!am_single_threaded()) {
1043 ERROR("Cannot start non-daemonized container when threaded");
1044 free_init_cmd(init_cmd);
1045 lxc_put_handler(handler);
1046 return false;
1047 }
1048
1049 /* We need to write PID file after daemonize, so we always write the
1050 * right PID.
1051 */
1052 if (c->pidfile) {
1053 int w;
1054 char pidstr[INTTYPE_TO_STRLEN(pid_t)];
1055
1056 w = strnprintf(pidstr, sizeof(pidstr), "%d", lxc_raw_getpid());
1057 if (w < 0) {
1058 free_init_cmd(init_cmd);
1059 lxc_put_handler(handler);
1060
1061 SYSERROR("Failed to write monitor pid to \"%s\"", c->pidfile);
1062
1063 if (c->daemonize)
1064 _exit(EXIT_FAILURE);
1065
1066 return false;
1067 }
1068
1069 ret = lxc_write_to_file(c->pidfile, pidstr, w, false, 0600);
1070 if (ret < 0) {
1071 free_init_cmd(init_cmd);
1072 lxc_put_handler(handler);
1073
1074 SYSERROR("Failed to write monitor pid to \"%s\"", c->pidfile);
1075
1076 if (c->daemonize)
1077 _exit(EXIT_FAILURE);
1078
1079 return false;
1080 }
1081 }
1082
1083 conf->reboot = REBOOT_NONE;
1084
1085 /* Unshare the mount namespace if requested */
1086 if (conf->monitor_unshare) {
1087 ret = unshare(CLONE_NEWNS);
1088 if (ret < 0) {
1089 SYSERROR("Failed to unshare mount namespace");
1090 lxc_put_handler(handler);
1091 ret = 1;
1092 goto on_error;
1093 }
1094
1095 ret = mount(NULL, "/", NULL, MS_SLAVE|MS_REC, NULL);
1096 if (ret < 0) {
1097 SYSERROR("Failed to recursively turn root mount tree into dependent mount. Continuing...");
1098 lxc_put_handler(handler);
1099 ret = 1;
1100 goto on_error;
1101 }
1102 }
1103
1104 reboot:
1105 if (conf->reboot == REBOOT_INIT) {
1106 /* initialize handler */
1107 handler = lxc_init_handler(handler, c->name, conf, c->config_path, c->daemonize);
1108 if (!handler) {
1109 ret = 1;
1110 goto on_error;
1111 }
1112 }
1113
1114 ret = inherit_fds(handler, c->daemonize);
1115 if (ret < 0) {
1116 lxc_put_handler(handler);
1117 ret = 1;
1118 goto on_error;
1119 }
1120
1121 if (useinit)
1122 ret = lxc_execute(c->name, argv, 1, handler, c->config_path,
1123 c->daemonize, &c->error_num);
1124 else
1125 ret = lxc_start(argv, handler, c->config_path, c->daemonize,
1126 &c->error_num);
1127
1128 if (conf->reboot == REBOOT_REQ) {
1129 INFO("Container requested reboot");
1130 conf->reboot = REBOOT_INIT;
1131 goto reboot;
1132 }
1133
1134 on_error:
1135 if (c->pidfile) {
1136 unlink(c->pidfile);
1137 free(c->pidfile);
1138 c->pidfile = NULL;
1139 }
1140 free_init_cmd(init_cmd);
1141
1142 if (c->daemonize && ret != 0)
1143 _exit(EXIT_FAILURE);
1144 else if (c->daemonize)
1145 _exit(EXIT_SUCCESS);
1146
1147 if (ret != 0)
1148 return false;
1149
1150 return true;
1151 }
1152
1153 static bool lxcapi_start(struct lxc_container *c, int useinit,
1154 char *const argv[])
1155 {
1156 bool ret;
1157
1158 current_config = c ? c->lxc_conf : NULL;
1159 ret = do_lxcapi_start(c, useinit, argv);
1160 current_config = NULL;
1161
1162 return ret;
1163 }
1164
1165 /* Note, there MUST be an ending NULL. */
1166 static bool lxcapi_startl(struct lxc_container *c, int useinit, ...)
1167 {
1168 va_list ap;
1169 char **inargs = NULL;
1170 bool bret = false;
1171
1172 /* container exists */
1173 if (!c)
1174 return false;
1175
1176 current_config = c->lxc_conf;
1177
1178 va_start(ap, useinit);
1179 inargs = lxc_va_arg_list_to_argv(ap, 0, 1);
1180 va_end(ap);
1181 if (!inargs)
1182 goto on_error;
1183
1184 /* pass NULL if no arguments were supplied */
1185 bret = do_lxcapi_start(c, useinit, *inargs ? inargs : NULL);
1186
1187 on_error:
1188 if (inargs) {
1189 char **arg;
1190
1191 for (arg = inargs; *arg; arg++)
1192 free(*arg);
1193 free(inargs);
1194 }
1195
1196 current_config = NULL;
1197
1198 return bret;
1199 }
1200
1201 static bool do_lxcapi_stop(struct lxc_container *c)
1202 {
1203 int ret;
1204
1205 if (!c)
1206 return false;
1207
1208 ret = lxc_cmd_stop(c->name, c->config_path);
1209
1210 return ret == 0;
1211 }
1212
1213 WRAP_API(bool, lxcapi_stop)
1214
1215 static int do_create_container_dir(const char *path, struct lxc_conf *conf)
1216 {
1217 __do_close int fd_rootfs = -EBADF;
1218 int ret = -1;
1219
1220 mode_t mask = umask(0002);
1221 ret = mkdir(path, 0770);
1222 umask(mask);
1223 if (ret < 0 && errno != EEXIST)
1224 return -errno;
1225
1226 fd_rootfs = open_at(-EBADF, path, O_DIRECTORY | O_CLOEXEC, PROTECT_LOOKUP_ABSOLUTE_XDEV_SYMLINKS, 0);
1227 if (fd_rootfs < 0)
1228 return syserror("Failed to open container directory \"%d(%s)\"", fd_rootfs, path);
1229
1230 if (list_empty(&conf->id_map))
1231 return move_fd(fd_rootfs);
1232
1233 ret = userns_exec_mapped_root(NULL, fd_rootfs, conf);
1234 if (ret < 0)
1235 return syserror_ret(-1, "Failed to chown rootfs \"%s\"", path);
1236
1237 return move_fd(fd_rootfs);
1238 }
1239
1240 /* Create the standard expected container dir. */
1241 static int create_container_dir(struct lxc_container *c)
1242 {
1243 __do_free char *s = NULL;
1244 int ret;
1245 size_t len;
1246
1247 len = strlen(c->config_path) + strlen(c->name) + 2;
1248 s = malloc(len);
1249 if (!s)
1250 return ret_errno(ENOMEM);
1251
1252 ret = strnprintf(s, len, "%s/%s", c->config_path, c->name);
1253 if (ret < 0)
1254 return -errno;
1255
1256 return do_create_container_dir(s, c->lxc_conf);
1257 }
1258
1259 /* do_storage_create: thin wrapper around storage_create(). Like
1260 * storage_create(), it returns a mounted bdev on success, NULL on error.
1261 */
1262 static struct lxc_storage *do_storage_create(struct lxc_container *c,
1263 const char *type,
1264 struct bdev_specs *specs)
1265 {
1266 __do_free char *dest = NULL;
1267 int ret;
1268 size_t len;
1269 struct lxc_storage *bdev;
1270
1271 /* rootfs.path or lxcpath/lxcname/rootfs */
1272 if (c->lxc_conf->rootfs.path &&
1273 (access(c->lxc_conf->rootfs.path, F_OK) == 0)) {
1274 const char *rpath = c->lxc_conf->rootfs.path;
1275 len = strlen(rpath) + 1;
1276 dest = must_realloc(NULL, len);
1277 ret = strnprintf(dest, len, "%s", rpath);
1278 } else {
1279 const char *lxcpath = do_lxcapi_get_config_path(c);
1280 len = strlen(c->name) + 1 + strlen(lxcpath) + 1 + strlen(LXC_ROOTFS_DNAME) + 1;
1281 dest = must_realloc(NULL, len);
1282 ret = strnprintf(dest, len, "%s/%s/%s", lxcpath, c->name, LXC_ROOTFS_DNAME);
1283 }
1284 if (ret < 0)
1285 return NULL;
1286
1287 bdev = storage_create(dest, type, c->name, specs, c->lxc_conf);
1288 if (!bdev) {
1289 ERROR("Failed to create \"%s\" storage", type);
1290 return NULL;
1291 }
1292
1293 if (!c->set_config_item(c, "lxc.rootfs.path", bdev->src)) {
1294 ERROR("Failed to set \"lxc.rootfs.path = %s\"", bdev->src);
1295 storage_put(bdev);
1296 return NULL;
1297 }
1298
1299 /* If we are not root, chown the rootfs dir to root in the target user
1300 * namespace.
1301 */
1302 if (am_guest_unpriv() || !list_empty(&c->lxc_conf->id_map)) {
1303 ret = chown_mapped_root(bdev->dest, c->lxc_conf);
1304 if (ret < 0) {
1305 ERROR("Error chowning \"%s\" to container root", bdev->dest);
1306 suggest_default_idmap();
1307 storage_put(bdev);
1308 return NULL;
1309 }
1310 }
1311
1312 return bdev;
1313 }
1314
1315 /* Strip path and return name of file for argv[0] passed to execvp */
1316 static char *lxctemplatefilename(char *tpath)
1317 {
1318 char *p;
1319
1320 p = tpath + strlen(tpath) - 1;
1321 while ( (p-1) >= tpath && *(p-1) != '/')
1322 p--;
1323
1324 return p;
1325 }
1326
1327 static bool create_run_template(struct lxc_container *c, char *tpath,
1328 bool need_null_stdfds, char *const argv[])
1329 {
1330 int ret;
1331 pid_t pid;
1332
1333 if (!tpath)
1334 return true;
1335
1336 pid = fork();
1337 if (pid < 0) {
1338 SYSERROR("Failed to fork task for container creation template");
1339 return false;
1340 }
1341
1342 if (pid == 0) { /* child */
1343 int i, len;
1344 char *namearg, *patharg, *rootfsarg;
1345 char **newargv;
1346 int nargs = 0;
1347 struct lxc_storage *bdev = NULL;
1348 struct lxc_conf *conf = c->lxc_conf;
1349 uid_t euid;
1350
1351 if (need_null_stdfds) {
1352 ret = null_stdfds();
1353 if (ret < 0)
1354 _exit(EXIT_FAILURE);
1355 }
1356
1357 ret = lxc_storage_prepare(conf);
1358 if (ret) {
1359 ERROR("Failed to initialize storage");
1360 _exit(EXIT_FAILURE);
1361 }
1362 bdev = conf->rootfs.storage;
1363
1364 euid = geteuid();
1365 if (euid == 0) {
1366 ret = unshare(CLONE_NEWNS);
1367 if (ret < 0) {
1368 ERROR("Failed to unshare CLONE_NEWNS");
1369 _exit(EXIT_FAILURE);
1370 }
1371
1372 if (detect_shared_rootfs() && mount(NULL, "/", NULL, MS_SLAVE | MS_REC, NULL))
1373 SYSERROR("Failed to recursively turn root mount tree into dependent mount. Continuing...");
1374 }
1375
1376 if (!strequal(bdev->type, "dir") && !strequal(bdev->type, "btrfs")) {
1377 if (euid != 0) {
1378 ERROR("Unprivileged users can only create "
1379 "btrfs and directory-backed containers");
1380 _exit(EXIT_FAILURE);
1381 }
1382
1383 if (strequal(bdev->type, "overlay") ||
1384 strequal(bdev->type, "overlayfs")) {
1385 /* If we create an overlay container we need to
1386 * rsync the contents into
1387 * <container-path>/<container-name>/rootfs.
1388 * However, the overlay mount function will
1389 * mount
1390 * <container-path>/<container-name>/delta0
1391 * over
1392 * <container-path>/<container-name>/rootfs
1393 * which means we would rsync the rootfs into
1394 * the delta directory. That doesn't make sense
1395 * since the delta directory only exists to
1396 * record the differences to
1397 * <container-path>/<container-name>/rootfs. So
1398 * let's simply bind-mount here and then rsync
1399 * directly into
1400 * <container-path>/<container-name>/rootfs.
1401 */
1402 char *src;
1403
1404 src = ovl_get_rootfs(bdev->src, &(size_t){0});
1405 if (!src) {
1406 ERROR("Failed to get rootfs");
1407 _exit(EXIT_FAILURE);
1408 }
1409
1410 ret = mount(src, bdev->dest, "bind", MS_BIND | MS_REC, NULL);
1411 if (ret < 0) {
1412 ERROR("Failed to mount rootfs");
1413 _exit(EXIT_FAILURE);
1414 }
1415 } else {
1416 ret = bdev->ops->mount(bdev);
1417 if (ret < 0) {
1418 ERROR("Failed to mount rootfs");
1419 _exit(EXIT_FAILURE);
1420 }
1421 }
1422 } else { /* TODO come up with a better way here! */
1423 const char *src;
1424 free(bdev->dest);
1425 src = lxc_storage_get_path(bdev->src, bdev->type);
1426 bdev->dest = strdup(src);
1427 }
1428
1429 /* Create our new array, pre-pend the template name and base
1430 * args.
1431 */
1432 if (argv)
1433 for (nargs = 0; argv[nargs]; nargs++)
1434 ;
1435
1436 /* template, path, rootfs and name args */
1437 nargs += 4;
1438
1439 newargv = malloc(nargs * sizeof(*newargv));
1440 if (!newargv)
1441 _exit(EXIT_FAILURE);
1442 newargv[0] = lxctemplatefilename(tpath);
1443
1444 /* --path */
1445 len = strlen(c->config_path) + strlen(c->name) + strlen("--path=") + 2;
1446 patharg = malloc(len);
1447 if (!patharg)
1448 _exit(EXIT_FAILURE);
1449
1450 ret = strnprintf(patharg, len, "--path=%s/%s", c->config_path, c->name);
1451 if (ret < 0)
1452 _exit(EXIT_FAILURE);
1453 newargv[1] = patharg;
1454
1455 /* --name */
1456 len = strlen("--name=") + strlen(c->name) + 1;
1457 namearg = malloc(len);
1458 if (!namearg)
1459 _exit(EXIT_FAILURE);
1460
1461 ret = strnprintf(namearg, len, "--name=%s", c->name);
1462 if (ret < 0)
1463 _exit(EXIT_FAILURE);
1464 newargv[2] = namearg;
1465
1466 /* --rootfs */
1467 len = strlen("--rootfs=") + 1 + strlen(bdev->dest);
1468 rootfsarg = malloc(len);
1469 if (!rootfsarg)
1470 _exit(EXIT_FAILURE);
1471
1472 ret = strnprintf(rootfsarg, len, "--rootfs=%s", bdev->dest);
1473 if (ret < 0)
1474 _exit(EXIT_FAILURE);
1475 newargv[3] = rootfsarg;
1476
1477 /* add passed-in args */
1478 if (argv)
1479 for (i = 4; i < nargs; i++)
1480 newargv[i] = argv[i - 4];
1481
1482 /* add trailing NULL */
1483 nargs++;
1484 newargv = realloc(newargv, nargs * sizeof(*newargv));
1485 if (!newargv)
1486 _exit(EXIT_FAILURE);
1487 newargv[nargs - 1] = NULL;
1488
1489 /* If we're running the template in a mapped userns, then we
1490 * prepend the template command with: lxc-usernsexec <-m map1>
1491 * ... <-m mapn> -- and we append "--mapped-uid x", where x is
1492 * the mapped uid for our geteuid()
1493 */
1494 if (!list_empty(&conf->id_map)) {
1495 int extraargs, hostuid_mapped, hostgid_mapped;
1496 char **n2;
1497 char txtuid[20], txtgid[20];
1498 struct id_map *map;
1499 int n2args = 1;
1500
1501 n2 = malloc(n2args * sizeof(*n2));
1502 if (!n2)
1503 _exit(EXIT_FAILURE);
1504
1505 newargv[0] = tpath;
1506 tpath = "lxc-usernsexec";
1507 n2[0] = "lxc-usernsexec";
1508
1509 list_for_each_entry(map, &conf->id_map, head) {
1510 n2args += 2;
1511 n2 = realloc(n2, n2args * sizeof(char *));
1512 if (!n2)
1513 _exit(EXIT_FAILURE);
1514
1515 n2[n2args - 2] = "-m";
1516 n2[n2args - 1] = malloc(200);
1517 if (!n2[n2args - 1])
1518 _exit(EXIT_FAILURE);
1519
1520 ret = strnprintf(n2[n2args - 1], 200, "%c:%lu:%lu:%lu",
1521 map->idtype == ID_TYPE_UID ? 'u' : 'g',
1522 map->nsid, map->hostid, map->range);
1523 if (ret < 0)
1524 _exit(EXIT_FAILURE);
1525 }
1526
1527 hostuid_mapped = mapped_hostid(geteuid(), conf, ID_TYPE_UID);
1528 extraargs = hostuid_mapped >= 0 ? 1 : 3;
1529
1530 n2 = realloc(n2, (nargs + n2args + extraargs) * sizeof(char *));
1531 if (!n2)
1532 _exit(EXIT_FAILURE);
1533
1534 if (hostuid_mapped < 0) {
1535 hostuid_mapped = find_unmapped_nsid(conf, ID_TYPE_UID);
1536 n2[n2args++] = "-m";
1537 if (hostuid_mapped < 0) {
1538 ERROR("Failed to find free uid to map");
1539 _exit(EXIT_FAILURE);
1540 }
1541
1542 n2[n2args++] = malloc(200);
1543 if (!n2[n2args - 1]) {
1544 SYSERROR("out of memory");
1545 _exit(EXIT_FAILURE);
1546 }
1547
1548 ret = strnprintf(n2[n2args - 1], 200, "u:%d:%d:1",
1549 hostuid_mapped, geteuid());
1550 if (ret < 0)
1551 _exit(EXIT_FAILURE);
1552 }
1553
1554 hostgid_mapped = mapped_hostid(getegid(), conf, ID_TYPE_GID);
1555 extraargs = hostgid_mapped >= 0 ? 1 : 3;
1556
1557 n2 = realloc(n2, (nargs + n2args + extraargs) * sizeof(char *));
1558 if (!n2)
1559 _exit(EXIT_FAILURE);
1560
1561 if (hostgid_mapped < 0) {
1562 hostgid_mapped = find_unmapped_nsid(conf, ID_TYPE_GID);
1563 n2[n2args++] = "-m";
1564 if (hostgid_mapped < 0) {
1565 ERROR("Failed to find free gid to map");
1566 _exit(EXIT_FAILURE);
1567 }
1568
1569 n2[n2args++] = malloc(200);
1570 if (!n2[n2args - 1]) {
1571 SYSERROR("out of memory");
1572 _exit(EXIT_FAILURE);
1573 }
1574
1575 ret = strnprintf(n2[n2args - 1], 200, "g:%d:%d:1",
1576 hostgid_mapped, getegid());
1577 if (ret < 0)
1578 _exit(EXIT_FAILURE);
1579 }
1580
1581 n2[n2args++] = "--";
1582
1583 for (i = 0; i < nargs; i++)
1584 n2[i + n2args] = newargv[i];
1585 n2args += nargs;
1586
1587 /* Finally add "--mapped-uid $uid" to tell template what
1588 * to chown cached images to.
1589 */
1590 n2args += 4;
1591 n2 = realloc(n2, n2args * sizeof(char *));
1592 if (!n2)
1593 _exit(EXIT_FAILURE);
1594
1595 /* note n2[n2args-1] is NULL */
1596 n2[n2args - 5] = "--mapped-uid";
1597
1598 ret = strnprintf(txtuid, 20, "%d", hostuid_mapped);
1599 if (ret < 0) {
1600 free(newargv);
1601 free(n2);
1602 _exit(EXIT_FAILURE);
1603 }
1604
1605 n2[n2args - 4] = txtuid;
1606 n2[n2args - 3] = "--mapped-gid";
1607
1608 ret = strnprintf(txtgid, 20, "%d", hostgid_mapped);
1609 if (ret < 0) {
1610 free(newargv);
1611 free(n2);
1612 _exit(EXIT_FAILURE);
1613 }
1614
1615 n2[n2args - 2] = txtgid;
1616 n2[n2args - 1] = NULL;
1617 free(newargv);
1618 newargv = n2;
1619 }
1620
1621 execvp(tpath, newargv);
1622 SYSERROR("Failed to execute template %s", tpath);
1623 _exit(EXIT_FAILURE);
1624 }
1625
1626 ret = wait_for_pid(pid);
1627 if (ret != 0) {
1628 ERROR("Failed to create container from template");
1629 return false;
1630 }
1631
1632 return true;
1633 }
1634
1635 static bool prepend_lxc_header(char *path, const char *t, char *const argv[])
1636 {
1637 ssize_t len, flen;
1638 char *contents;
1639 FILE *f;
1640 int ret = -1;
1641 ssize_t nbytes;
1642 #if HAVE_OPENSSL
1643 unsigned int md_len = 0;
1644 unsigned char md_value[EVP_MAX_MD_SIZE];
1645 char *tpath;
1646 #endif
1647
1648 f = fopen(path, "re");
1649 if (f == NULL)
1650 return false;
1651
1652 ret = fseek(f, 0, SEEK_END);
1653 if (ret < 0)
1654 goto out_error;
1655
1656 ret = -1;
1657 flen = ftell(f);
1658 if (flen < 0)
1659 goto out_error;
1660
1661 ret = fseek(f, 0, SEEK_SET);
1662 if (ret < 0)
1663 goto out_error;
1664
1665 ret = fseek(f, 0, SEEK_SET);
1666 if (ret < 0)
1667 goto out_error;
1668
1669 ret = -1;
1670 contents = malloc(flen + 1);
1671 if (!contents)
1672 goto out_error;
1673
1674 len = fread(contents, 1, flen, f);
1675 if (len != flen)
1676 goto out_free_contents;
1677
1678 contents[flen] = '\0';
1679
1680 ret = fclose(f);
1681 f = NULL;
1682 if (ret < 0)
1683 goto out_free_contents;
1684
1685 #if HAVE_OPENSSL
1686 tpath = get_template_path(t);
1687 if (!tpath) {
1688 ERROR("Invalid template \"%s\" specified", t);
1689 goto out_free_contents;
1690 }
1691
1692 ret = sha1sum_file(tpath, md_value, &md_len);
1693 if (ret < 0) {
1694 ERROR("Failed to get sha1sum of %s", tpath);
1695 free(tpath);
1696 goto out_free_contents;
1697 }
1698 free(tpath);
1699 #endif
1700
1701 f = fopen(path, "we");
1702 if (f == NULL) {
1703 SYSERROR("Reopening config for writing");
1704 free(contents);
1705 return false;
1706 }
1707
1708 fprintf(f, "# Template used to create this container: %s\n", t);
1709 if (argv) {
1710 fprintf(f, "# Parameters passed to the template:");
1711 while (*argv) {
1712 fprintf(f, " %s", *argv);
1713 argv++;
1714 }
1715 fprintf(f, "\n");
1716 }
1717
1718 #if HAVE_OPENSSL
1719 fprintf(f, "# Template script checksum (SHA-1): ");
1720 for (size_t i = 0; i < md_len; i++)
1721 fprintf(f, "%02x", md_value[i]);
1722 fprintf(f, "\n");
1723 #endif
1724 fprintf(f, "# For additional config options, please look at lxc.container.conf(5)\n");
1725 fprintf(f, "\n# Uncomment the following line to support nesting containers:\n");
1726 fprintf(f, "#lxc.include = " LXCTEMPLATECONFIG "/nesting.conf\n");
1727 fprintf(f, "# (Be aware this has security implications)\n\n");
1728 nbytes = fwrite(contents, 1, flen, f);
1729 if (nbytes < 0 || nbytes != flen) {
1730 SYSERROR("Writing original contents");
1731 free(contents);
1732 fclose(f);
1733 return false;
1734 }
1735
1736 ret = 0;
1737
1738 out_free_contents:
1739 free(contents);
1740
1741 out_error:
1742 if (f) {
1743 int newret;
1744 newret = fclose(f);
1745 if (ret == 0)
1746 ret = newret;
1747 }
1748
1749 if (ret < 0) {
1750 SYSERROR("Error prepending header");
1751 return false;
1752 }
1753
1754 return true;
1755 }
1756
1757 static void lxcapi_clear_config(struct lxc_container *c)
1758 {
1759 if (!c || !c->lxc_conf)
1760 return;
1761
1762 lxc_conf_free(c->lxc_conf);
1763 c->lxc_conf = NULL;
1764 }
1765
1766 #define do_lxcapi_clear_config(c) lxcapi_clear_config(c)
1767
1768 /*
1769 * lxcapi_create:
1770 * create a container with the given parameters.
1771 * @c: container to be created. It has the lxcpath, name, and a starting
1772 * configuration already set
1773 * @t: the template to execute to instantiate the root filesystem and
1774 * adjust the configuration.
1775 * @bdevtype: backing store type to use. If NULL, dir will be used.
1776 * @specs: additional parameters for the backing store, i.e. LVM vg to
1777 * use.
1778 *
1779 * @argv: the arguments to pass to the template, terminated by NULL. If no
1780 * arguments, you can just pass NULL.
1781 */
1782 static bool __lxcapi_create(struct lxc_container *c, const char *t,
1783 const char *bdevtype, struct bdev_specs *specs,
1784 int flags, char *const argv[])
1785 {
1786 __do_close int fd_rootfs = -EBADF;
1787 __do_free char *path_template = NULL;
1788 int partial_fd;
1789 mode_t mask;
1790 pid_t pid;
1791 bool bret = false, rootfs_managed = true;
1792
1793 if (!c)
1794 return false;
1795
1796 if (t) {
1797 path_template = get_template_path(t);
1798 if (!path_template)
1799 return log_error(false, "Template \"%s\" not found", t);
1800 }
1801
1802 /* If a template is passed in, and the rootfs already is defined in the
1803 * container config and exists, then the caller is trying to create an
1804 * existing container. Return an error, but do NOT delete the container.
1805 */
1806 if (do_lxcapi_is_defined(c) && c->lxc_conf && c->lxc_conf->rootfs.path &&
1807 access(c->lxc_conf->rootfs.path, F_OK) == 0 && path_template)
1808 return log_error(false, "Container \"%s\" already exists in \"%s\"",
1809 c->name, c->config_path);
1810
1811 if (!c->lxc_conf &&
1812 !do_lxcapi_load_config(c, lxc_global_config_value("lxc.default_config")))
1813 return log_error(false, "Failed to load default configuration file %s",
1814 lxc_global_config_value("lxc.default_config"));
1815
1816 fd_rootfs = create_container_dir(c);
1817 if (fd_rootfs < 0)
1818 return log_error(false, "Failed to create container %s", c->name);
1819
1820 if (c->lxc_conf->rootfs.path)
1821 rootfs_managed = false;
1822
1823 /* If both template and rootfs.path are set, template is setup as
1824 * rootfs.path. The container is already created if we have a config and
1825 * rootfs.path is accessible
1826 */
1827 if (!c->lxc_conf->rootfs.path && !path_template) {
1828 /* No template passed in and rootfs does not exist. */
1829 if (!c->save_config(c, NULL)) {
1830 ERROR("Failed to save initial config for \"%s\"", c->name);
1831 goto out;
1832 }
1833
1834 bret = true;
1835 goto out;
1836 }
1837
1838 /* Rootfs passed into configuration, but does not exist. */
1839 if (c->lxc_conf->rootfs.path && access(c->lxc_conf->rootfs.path, F_OK) != 0) {
1840 ERROR("The rootfs \"%s\" does not exist", c->lxc_conf->rootfs.path);
1841 goto out;
1842 }
1843
1844 if (do_lxcapi_is_defined(c) && c->lxc_conf->rootfs.path && !path_template) {
1845 /* Rootfs already existed, user just wanted to save the loaded
1846 * configuration.
1847 */
1848 if (!c->save_config(c, NULL))
1849 ERROR("Failed to save initial config for \"%s\"", c->name);
1850
1851 bret = true;
1852 goto out;
1853 }
1854
1855 /* Mark that this container as being created */
1856 partial_fd = create_partial(fd_rootfs, c);
1857 if (partial_fd < 0) {
1858 SYSERROR("Failed to mark container as being partially created");
1859 goto out;
1860 }
1861
1862 /* No need to get disk lock bc we have the partial lock. */
1863
1864 mask = umask(0022);
1865
1866 /* Create the storage.
1867 * Note we can't do this in the same task as we use to execute the
1868 * template because of the way zfs works.
1869 * After you 'zfs create', zfs mounts the fs only in the initial
1870 * namespace.
1871 */
1872 pid = fork();
1873 if (pid < 0) {
1874 SYSERROR("Failed to fork task for container creation template");
1875 goto out_unlock;
1876 }
1877
1878 if (pid == 0) { /* child */
1879 struct lxc_storage *bdev = NULL;
1880
1881 bdev = do_storage_create(c, bdevtype, specs);
1882 if (!bdev) {
1883 ERROR("Failed to create %s storage for %s",
1884 bdevtype ? bdevtype : "(none)", c->name);
1885 _exit(EXIT_FAILURE);
1886 }
1887
1888 /* Save config file again to store the new rootfs location. */
1889 if (!do_lxcapi_save_config(c, NULL)) {
1890 ERROR("Failed to save initial config for %s", c->name);
1891 /* Parent task won't see the storage driver in the
1892 * config so we delete it.
1893 */
1894 bdev->ops->umount(bdev);
1895 bdev->ops->destroy(bdev);
1896 _exit(EXIT_FAILURE);
1897 }
1898
1899 _exit(EXIT_SUCCESS);
1900 }
1901
1902 if (!wait_exited(pid))
1903 goto out_unlock;
1904
1905 /* Reload config to get the rootfs. */
1906 lxc_conf_free(c->lxc_conf);
1907 c->lxc_conf = NULL;
1908
1909 if (!load_config_locked(c, c->configfile))
1910 goto out_unlock;
1911
1912 if (!create_run_template(c, path_template, !!(flags & LXC_CREATE_QUIET), argv))
1913 goto out_unlock;
1914
1915 /* Now clear out the lxc_conf we have, reload from the created
1916 * container.
1917 */
1918 do_lxcapi_clear_config(c);
1919
1920 if (t) {
1921 if (!prepend_lxc_header(c->configfile, path_template, argv)) {
1922 ERROR("Failed to prepend header to config file");
1923 goto out_unlock;
1924 }
1925 }
1926
1927 bret = load_config_locked(c, c->configfile);
1928
1929 out_unlock:
1930 umask(mask);
1931 remove_partial(c, partial_fd);
1932
1933 out:
1934 if (!bret) {
1935 bool reset_managed = c->lxc_conf->rootfs.managed;
1936
1937 /*
1938 * Ensure that we don't destroy storage we didn't create
1939 * ourselves.
1940 */
1941 if (!rootfs_managed)
1942 c->lxc_conf->rootfs.managed = false;
1943 container_destroy(c, NULL);
1944 c->lxc_conf->rootfs.managed = reset_managed;
1945 }
1946
1947 return bret;
1948 }
1949
1950 static bool do_lxcapi_create(struct lxc_container *c, const char *t,
1951 const char *bdevtype, struct bdev_specs *specs,
1952 int flags, char *const argv[])
1953 {
1954 return __lxcapi_create(c, t, bdevtype, specs, flags, argv);
1955 }
1956
1957 WRAP_API_5(bool, lxcapi_create, const char *, const char *,
1958 struct bdev_specs *, int, char *const *)
1959
1960 static bool do_lxcapi_reboot(struct lxc_container *c)
1961 {
1962 __do_close int pidfd = -EBADF;
1963 pid_t pid = -1;
1964 int ret;
1965 int rebootsignal = SIGINT;
1966
1967 if (!c)
1968 return false;
1969
1970 if (!do_lxcapi_is_running(c))
1971 return false;
1972
1973 pidfd = do_lxcapi_init_pidfd(c);
1974 if (pidfd < 0) {
1975 pid = do_lxcapi_init_pid(c);
1976 if (pid <= 0)
1977 return false;
1978 }
1979
1980 if (c->lxc_conf && c->lxc_conf->rebootsignal)
1981 rebootsignal = c->lxc_conf->rebootsignal;
1982
1983 if (pidfd >= 0)
1984 ret = lxc_raw_pidfd_send_signal(pidfd, rebootsignal, NULL, 0);
1985 else
1986 ret = kill(pid, rebootsignal);
1987 if (ret < 0)
1988 return log_warn(false, "Failed to send signal %d to pid %d",
1989 rebootsignal, pid);
1990
1991 return true;
1992 }
1993
1994 WRAP_API(bool, lxcapi_reboot)
1995
1996 static bool do_lxcapi_reboot2(struct lxc_container *c, int timeout)
1997 {
1998 __do_close int pidfd = -EBADF, state_client_fd = -EBADF;
1999 int rebootsignal = SIGINT;
2000 pid_t pid = -1;
2001 lxc_state_t states[MAX_STATE] = {0};
2002 int killret, ret;
2003
2004 if (!c)
2005 return false;
2006
2007 if (!do_lxcapi_is_running(c))
2008 return true;
2009
2010 pidfd = do_lxcapi_init_pidfd(c);
2011 if (pidfd < 0) {
2012 pid = do_lxcapi_init_pid(c);
2013 if (pid <= 0)
2014 return true;
2015 }
2016
2017 if (c->lxc_conf && c->lxc_conf->rebootsignal)
2018 rebootsignal = c->lxc_conf->rebootsignal;
2019
2020 /* Add a new state client before sending the shutdown signal so that we
2021 * don't miss a state.
2022 */
2023 if (timeout != 0) {
2024 states[RUNNING] = 2;
2025 ret = lxc_cmd_add_state_client(c->name, c->config_path, states,
2026 &state_client_fd);
2027 if (ret < 0)
2028 return false;
2029
2030 if (state_client_fd < 0)
2031 return false;
2032
2033 if (ret == RUNNING)
2034 return true;
2035
2036 if (ret < MAX_STATE)
2037 return false;
2038 }
2039
2040 /* Send reboot signal to container. */
2041 if (pidfd >= 0)
2042 killret = lxc_raw_pidfd_send_signal(pidfd, rebootsignal, NULL, 0);
2043 else
2044 killret = kill(pid, rebootsignal);
2045 if (killret < 0)
2046 return log_warn(false, "Failed to send signal %d to pidfd(%d)/pid(%d)", rebootsignal, pidfd, pid);
2047 TRACE("Sent signal %d to pidfd(%d)/pid(%d)", rebootsignal, pidfd, pid);
2048
2049 if (timeout == 0)
2050 return true;
2051
2052 ret = lxc_cmd_sock_rcv_state(state_client_fd, timeout);
2053 if (ret < 0)
2054 return false;
2055
2056 TRACE("Received state \"%s\"", lxc_state2str(ret));
2057 if (ret != RUNNING)
2058 return false;
2059
2060 return true;
2061 }
2062
2063 WRAP_API_1(bool, lxcapi_reboot2, int)
2064
2065 static bool do_lxcapi_shutdown(struct lxc_container *c, int timeout)
2066 {
2067 __do_close int pidfd = -EBADF, state_client_fd = -EBADF;
2068 int haltsignal = SIGPWR;
2069 pid_t pid = -1;
2070 lxc_state_t states[MAX_STATE] = {0};
2071 int killret, ret;
2072
2073 if (!c)
2074 return false;
2075
2076 if (!do_lxcapi_is_running(c))
2077 return true;
2078
2079 pidfd = do_lxcapi_init_pidfd(c);
2080 pid = do_lxcapi_init_pid(c);
2081 if (pid <= 0)
2082 return true;
2083
2084 /* Detect whether we should send SIGRTMIN + 3 (e.g. systemd). */
2085 if (c->lxc_conf && c->lxc_conf->haltsignal)
2086 haltsignal = c->lxc_conf->haltsignal;
2087 else if (task_blocks_signal(pid, (SIGRTMIN + 3)))
2088 haltsignal = (SIGRTMIN + 3);
2089
2090
2091 /*
2092 * Add a new state client before sending the shutdown signal so
2093 * that we don't miss a state.
2094 */
2095 if (timeout != 0) {
2096 states[STOPPED] = 1;
2097 ret = lxc_cmd_add_state_client(c->name, c->config_path, states,
2098 &state_client_fd);
2099 if (ret < 0)
2100 return false;
2101
2102 if (state_client_fd < 0)
2103 return false;
2104
2105 if (ret == STOPPED)
2106 return true;
2107
2108 if (ret < MAX_STATE)
2109 return false;
2110 }
2111
2112 if (pidfd >= 0) {
2113 struct pollfd pidfd_poll = {
2114 .events = POLLIN,
2115 .fd = pidfd,
2116 };
2117
2118 killret = lxc_raw_pidfd_send_signal(pidfd, haltsignal,
2119 NULL, 0);
2120 if (killret < 0)
2121 return log_warn(false, "Failed to send signal %d to pidfd %d",
2122 haltsignal, pidfd);
2123
2124 TRACE("Sent signal %d to pidfd %d", haltsignal, pidfd);
2125
2126 /*
2127 * No need for going through all of the state server
2128 * complications anymore. We can just poll on pidfds. :)
2129 */
2130
2131 if (timeout != 0) {
2132 ret = poll(&pidfd_poll, 1, timeout * 1000);
2133 if (ret < 0 || !(pidfd_poll.revents & POLLIN))
2134 return false;
2135
2136 TRACE("Pidfd polling detected container exit");
2137 }
2138 } else {
2139 killret = kill(pid, haltsignal);
2140 if (killret < 0)
2141 return log_warn(false, "Failed to send signal %d to pid %d",
2142 haltsignal, pid);
2143
2144 TRACE("Sent signal %d to pid %d", haltsignal, pid);
2145 }
2146
2147 if (timeout == 0)
2148 return true;
2149
2150 ret = lxc_cmd_sock_rcv_state(state_client_fd, timeout);
2151 if (ret < 0)
2152 return false;
2153
2154 TRACE("Received state \"%s\"", lxc_state2str(ret));
2155 if (ret != STOPPED)
2156 return false;
2157
2158 return true;
2159 }
2160
2161 WRAP_API_1(bool, lxcapi_shutdown, int)
2162
2163 static bool lxcapi_createl(struct lxc_container *c, const char *t,
2164 const char *bdevtype, struct bdev_specs *specs, int flags, ...)
2165 {
2166 bool bret = false;
2167 char **args = NULL;
2168 va_list ap;
2169
2170 if (!c)
2171 return false;
2172
2173 current_config = c->lxc_conf;
2174
2175 /*
2176 * since we're going to wait for create to finish, I don't think we
2177 * need to get a copy of the arguments.
2178 */
2179 va_start(ap, flags);
2180 args = lxc_va_arg_list_to_argv(ap, 0, 0);
2181 va_end(ap);
2182 if (!args) {
2183 ERROR("Failed to allocate memory");
2184 goto out;
2185 }
2186
2187 bret = __lxcapi_create(c, t, bdevtype, specs, flags, args);
2188
2189 out:
2190 free(args);
2191 current_config = NULL;
2192 return bret;
2193 }
2194
2195 static void do_clear_unexp_config_line(struct lxc_conf *conf, const char *key)
2196 {
2197 if (strequal(key, "lxc.cgroup"))
2198 return clear_unexp_config_line(conf, key, true);
2199
2200 if (strequal(key, "lxc.network"))
2201 return clear_unexp_config_line(conf, key, true);
2202
2203 if (strequal(key, "lxc.net"))
2204 return clear_unexp_config_line(conf, key, true);
2205
2206 /* Clear a network with a specific index. */
2207 if (strnequal(key, "lxc.net.", 8)) {
2208 int ret;
2209 const char *idx;
2210
2211 idx = key + 8;
2212 ret = lxc_safe_uint(idx, &(unsigned int){0});
2213 if (!ret)
2214 return clear_unexp_config_line(conf, key, true);
2215 }
2216
2217 if (strequal(key, "lxc.hook"))
2218 return clear_unexp_config_line(conf, key, true);
2219
2220 return clear_unexp_config_line(conf, key, false);
2221 }
2222
2223 static bool do_lxcapi_clear_config_item(struct lxc_container *c,
2224 const char *key)
2225 {
2226 int ret = 1;
2227 struct lxc_config_t *config;
2228
2229 if (!c || !c->lxc_conf)
2230 return false;
2231
2232 if (container_mem_lock(c))
2233 return false;
2234
2235 config = lxc_get_config(key);
2236
2237 ret = config->clr(key, c->lxc_conf, NULL);
2238 if (!ret)
2239 do_clear_unexp_config_line(c->lxc_conf, key);
2240
2241 container_mem_unlock(c);
2242 return ret == 0;
2243 }
2244
2245 WRAP_API_1(bool, lxcapi_clear_config_item, const char *)
2246
2247 static inline bool enter_net_ns(struct lxc_container *c)
2248 {
2249 pid_t pid = do_lxcapi_init_pid(c);
2250
2251 if (pid < 0)
2252 return false;
2253
2254 if ((geteuid() != 0 || (c->lxc_conf && !list_empty(&c->lxc_conf->id_map))) &&
2255 (access("/proc/self/ns/user", F_OK) == 0))
2256 if (!switch_to_ns(pid, "user"))
2257 return false;
2258
2259 return switch_to_ns(pid, "net");
2260 }
2261
2262 /* Used by qsort and bsearch functions for comparing names. */
2263 static inline int string_cmp(char **first, char **second)
2264 {
2265 return strcmp(*first, *second);
2266 }
2267
2268 /* Used by qsort and bsearch functions for comparing container names. */
2269 static inline int container_cmp(struct lxc_container **first,
2270 struct lxc_container **second)
2271 {
2272 return strcmp((*first)->name, (*second)->name);
2273 }
2274
2275 static bool add_to_array(char ***names, char *cname, int pos)
2276 {
2277 __do_free char *dup_cname = NULL;
2278 char **newnames;
2279
2280 dup_cname = strdup(cname);
2281 if (!dup_cname)
2282 return false;
2283
2284 newnames = realloc(*names, (pos + 1) * sizeof(char *));
2285 if (!newnames)
2286 return ret_set_errno(false, ENOMEM);
2287
2288 newnames[pos] = move_ptr(dup_cname);
2289
2290 /* Sort the array as we will use binary search on it. */
2291 qsort(newnames, pos + 1, sizeof(char *),
2292 (int (*)(const void *, const void *))string_cmp);
2293
2294 *names = newnames;
2295 return true;
2296 }
2297
2298 static bool add_to_clist(struct lxc_container ***list, struct lxc_container *c,
2299 int pos, bool sort)
2300 {
2301 struct lxc_container **newlist;
2302
2303 newlist = realloc(*list, (pos + 1) * sizeof(struct lxc_container *));
2304 if (!newlist)
2305 return ret_set_errno(false, ENOMEM);
2306
2307 newlist[pos] = c;
2308
2309 /* Sort the array as we will use binary search on it. */
2310 if (sort)
2311 qsort(newlist, pos + 1, sizeof(struct lxc_container *),
2312 (int (*)(const void *, const void *))container_cmp);
2313
2314 *list = newlist;
2315 return true;
2316 }
2317
2318 static char **get_from_array(char ***names, char *cname, int size)
2319 {
2320 if (!*names)
2321 return NULL;
2322
2323 return bsearch(&cname, *names, size, sizeof(char *),
2324 (int (*)(const void *, const void *))string_cmp);
2325 }
2326
2327 static bool array_contains(char ***names, char *cname, int size)
2328 {
2329 if (get_from_array(names, cname, size))
2330 return true;
2331
2332 return false;
2333 }
2334
2335 static char **do_lxcapi_get_interfaces(struct lxc_container *c)
2336 {
2337 pid_t pid;
2338 int i, count = 0, pipefd[2];
2339 char **interfaces = NULL;
2340 char interface[IFNAMSIZ];
2341
2342 if (pipe2(pipefd, O_CLOEXEC))
2343 return log_error_errno(NULL, errno, "Failed to create pipe");
2344
2345 pid = fork();
2346 if (pid < 0) {
2347 close(pipefd[0]);
2348 close(pipefd[1]);
2349 return log_error_errno(NULL, errno, "Failed to fork task to get interfaces information");
2350 }
2351
2352 if (pid == 0) {
2353 call_cleaner(netns_freeifaddrs) struct netns_ifaddrs *ifaddrs = NULL;
2354 struct netns_ifaddrs *ifa = NULL;
2355 int ret = 1;
2356 int nbytes;
2357
2358 /* close the read-end of the pipe */
2359 close(pipefd[0]);
2360
2361 if (!enter_net_ns(c)) {
2362 SYSERROR("Failed to enter network namespace");
2363 goto out;
2364 }
2365
2366 /* Grab the list of interfaces */
2367 if (netns_getifaddrs(&ifaddrs, -1, &(bool){false})) {
2368 SYSERROR("Failed to get interfaces list");
2369 goto out;
2370 }
2371
2372 /* Iterate through the interfaces */
2373 for (ifa = ifaddrs; ifa != NULL;
2374 ifa = ifa->ifa_next) {
2375 nbytes = lxc_write_nointr(pipefd[1], ifa->ifa_name, IFNAMSIZ);
2376 if (nbytes < 0)
2377 goto out;
2378
2379 count++;
2380 }
2381
2382 ret = 0;
2383
2384 out:
2385 /* close the write-end of the pipe, thus sending EOF to the reader */
2386 close(pipefd[1]);
2387 _exit(ret);
2388 }
2389
2390 /* close the write-end of the pipe */
2391 close(pipefd[1]);
2392
2393 while (lxc_read_nointr(pipefd[0], &interface, IFNAMSIZ) == IFNAMSIZ) {
2394 interface[IFNAMSIZ - 1] = '\0';
2395
2396 if (array_contains(&interfaces, interface, count))
2397 continue;
2398
2399 if (!add_to_array(&interfaces, interface, count))
2400 ERROR("Failed to add \"%s\" to array", interface);
2401
2402 count++;
2403 }
2404
2405 if (wait_for_pid(pid)) {
2406 for (i = 0; i < count; i++)
2407 free(interfaces[i]);
2408
2409 free(interfaces);
2410 interfaces = NULL;
2411 }
2412
2413 /* close the read-end of the pipe */
2414 close(pipefd[0]);
2415
2416 /* Append NULL to the array */
2417 if (interfaces)
2418 interfaces = (char **)lxc_append_null_to_array((void **)interfaces, count);
2419
2420 return interfaces;
2421 }
2422
2423 WRAP_API(char **, lxcapi_get_interfaces)
2424
2425 static char **do_lxcapi_get_ips(struct lxc_container *c, const char *interface,
2426 const char *family, int scope)
2427 {
2428 int i, ret;
2429 pid_t pid;
2430 int pipefd[2];
2431 char address[INET6_ADDRSTRLEN];
2432 int count = 0;
2433 char **addresses = NULL;
2434
2435 ret = pipe2(pipefd, O_CLOEXEC);
2436 if (ret < 0)
2437 return log_error_errno(NULL, errno, "Failed to create pipe");
2438
2439 pid = fork();
2440 if (pid < 0) {
2441 SYSERROR("Failed to create new process");
2442 close(pipefd[0]);
2443 close(pipefd[1]);
2444 return NULL;
2445 }
2446
2447 if (pid == 0) {
2448 call_cleaner(netns_freeifaddrs) struct netns_ifaddrs *ifaddrs = NULL;
2449 struct netns_ifaddrs *ifa = NULL;
2450 ssize_t nbytes;
2451 char addressOutputBuffer[INET6_ADDRSTRLEN];
2452 char *address_ptr = NULL;
2453 void *address_ptr_tmp = NULL;
2454
2455 /* close the read-end of the pipe */
2456 close(pipefd[0]);
2457
2458 if (!enter_net_ns(c)) {
2459 SYSERROR("Failed to attach to network namespace");
2460 goto out;
2461 }
2462
2463 /* Grab the list of interfaces */
2464 if (netns_getifaddrs(&ifaddrs, -1, &(bool){false})) {
2465 SYSERROR("Failed to get interfaces list");
2466 goto out;
2467 }
2468
2469 /* Iterate through the interfaces */
2470 for (ifa = ifaddrs; ifa; ifa = ifa->ifa_next) {
2471 if (ifa->ifa_addr == NULL)
2472 continue;
2473
2474 #pragma GCC diagnostic push
2475 #pragma GCC diagnostic ignored "-Wcast-align"
2476
2477 if (ifa->ifa_addr->sa_family == AF_INET) {
2478 if (family && !strequal(family, "inet"))
2479 continue;
2480
2481 address_ptr_tmp = &((struct sockaddr_in *)ifa->ifa_addr)->sin_addr;
2482 } else {
2483 if (family && !strequal(family, "inet6"))
2484 continue;
2485
2486 if (((struct sockaddr_in6 *)ifa->ifa_addr)->sin6_scope_id != (uint32_t)scope)
2487 continue;
2488
2489 address_ptr_tmp = &((struct sockaddr_in6 *)ifa->ifa_addr)->sin6_addr;
2490 }
2491
2492 #pragma GCC diagnostic pop
2493
2494 if (interface && !strequal(interface, ifa->ifa_name))
2495 continue;
2496 else if (!interface && strequal("lo", ifa->ifa_name))
2497 continue;
2498
2499 address_ptr = (char *)inet_ntop(ifa->ifa_addr->sa_family, address_ptr_tmp,
2500 addressOutputBuffer,
2501 sizeof(addressOutputBuffer));
2502 if (!address_ptr)
2503 continue;
2504
2505 nbytes = lxc_write_nointr(pipefd[1], address_ptr, INET6_ADDRSTRLEN);
2506 if (nbytes != INET6_ADDRSTRLEN) {
2507 SYSERROR("Failed to send ipv6 address \"%s\"", address_ptr);
2508 goto out;
2509 }
2510
2511 count++;
2512 }
2513
2514 ret = 0;
2515
2516 out:
2517 /* close the write-end of the pipe, thus sending EOF to the reader */
2518 close(pipefd[1]);
2519 _exit(ret);
2520 }
2521
2522 /* close the write-end of the pipe */
2523 close(pipefd[1]);
2524
2525 while (lxc_read_nointr(pipefd[0], &address, INET6_ADDRSTRLEN) == INET6_ADDRSTRLEN) {
2526 address[INET6_ADDRSTRLEN - 1] = '\0';
2527
2528 if (!add_to_array(&addresses, address, count))
2529 ERROR("PARENT: add_to_array failed");
2530
2531 count++;
2532 }
2533
2534 if (wait_for_pid(pid)) {
2535 for (i = 0; i < count; i++)
2536 free(addresses[i]);
2537
2538 free(addresses);
2539 addresses = NULL;
2540 }
2541
2542 /* close the read-end of the pipe */
2543 close(pipefd[0]);
2544
2545 /* Append NULL to the array */
2546 if (addresses)
2547 addresses = (char **)lxc_append_null_to_array((void **)addresses, count);
2548
2549 return addresses;
2550 }
2551
2552 WRAP_API_3(char **, lxcapi_get_ips, const char *, const char *, int)
2553
2554 static int do_lxcapi_get_config_item(struct lxc_container *c, const char *key, char *retv, int inlen)
2555 {
2556 int ret = -1;
2557 struct lxc_config_t *config;
2558
2559 if (!c || !c->lxc_conf)
2560 return -1;
2561
2562 if (container_mem_lock(c))
2563 return -1;
2564
2565 config = lxc_get_config(key);
2566
2567 ret = config->get(key, retv, inlen, c->lxc_conf, NULL);
2568
2569 container_mem_unlock(c);
2570 return ret;
2571 }
2572
2573 WRAP_API_3(int, lxcapi_get_config_item, const char *, char *, int)
2574
2575 static char* do_lxcapi_get_running_config_item(struct lxc_container *c, const char *key)
2576 {
2577 char *ret;
2578
2579 if (!c || !c->lxc_conf)
2580 return NULL;
2581
2582 if (container_mem_lock(c))
2583 return NULL;
2584
2585 ret = lxc_cmd_get_config_item(c->name, key, do_lxcapi_get_config_path(c));
2586 container_mem_unlock(c);
2587 return ret;
2588 }
2589
2590 WRAP_API_1(char *, lxcapi_get_running_config_item, const char *)
2591
2592 static int do_lxcapi_get_keys(struct lxc_container *c, const char *key, char *retv, int inlen)
2593 {
2594 int ret = -1;
2595
2596 /* List all config items. */
2597 if (!key)
2598 return lxc_list_config_items(retv, inlen);
2599
2600 if (!c || !c->lxc_conf)
2601 return -1;
2602
2603 if (container_mem_lock(c))
2604 return -1;
2605
2606 /* Support 'lxc.net.<idx>', i.e. 'lxc.net.0'
2607 * This is an intelligent result to show which keys are valid given the
2608 * type of nic it is.
2609 */
2610 if (strnequal(key, "lxc.net.", 8))
2611 ret = lxc_list_net(c->lxc_conf, key, retv, inlen);
2612 else
2613 ret = lxc_list_subkeys(c->lxc_conf, key, retv, inlen);
2614
2615 container_mem_unlock(c);
2616 return ret;
2617 }
2618
2619 WRAP_API_3(int, lxcapi_get_keys, const char *, char *, int)
2620
2621 static bool do_lxcapi_save_config(struct lxc_container *c, const char *alt_file)
2622 {
2623 __do_close int fd_config = -EBADF, fd_rootfs = -EBADF;
2624 int lret = -1;
2625 bool bret = false, need_disklock = false;
2626
2627 if (!alt_file)
2628 alt_file = c->configfile;
2629
2630 if (!alt_file)
2631 return log_error(false, "No config file found");
2632
2633 /* If we haven't yet loaded a config, load the stock config. */
2634 if (!c->lxc_conf) {
2635 if (!do_lxcapi_load_config(c, lxc_global_config_value("lxc.default_config"))) {
2636 return log_error(false, "Error loading default configuration file %s while saving %s",
2637 lxc_global_config_value("lxc.default_config"), c->name);
2638 }
2639 }
2640
2641 fd_rootfs = create_container_dir(c);
2642 if (fd_rootfs < 0)
2643 return log_error(false, "Failed to create container directory");
2644
2645 /* If we're writing to the container's config file, take the disk lock.
2646 * Otherwise just take the memlock to protect the struct lxc_container
2647 * while we're traversing it.
2648 */
2649 if (strequal(c->configfile, alt_file))
2650 need_disklock = true;
2651
2652 if (need_disklock)
2653 lret = container_disk_lock(c);
2654 else
2655 lret = container_mem_lock(c);
2656 if (lret)
2657 return log_error(false, "Failed to acquire lock");
2658
2659 fd_config = open(alt_file, O_WRONLY | O_CREAT | O_TRUNC | O_CLOEXEC,
2660 S_IRUSR | S_IWUSR | S_IRGRP | S_IWGRP);
2661 if (fd_config < 0) {
2662 SYSERROR("Failed to open config file \"%s\"", alt_file);
2663 goto on_error;
2664 }
2665
2666 lret = write_config(fd_config, c->lxc_conf);
2667 if (lret < 0) {
2668 SYSERROR("Failed to write config file \"%s\"", alt_file);
2669 goto on_error;
2670 }
2671
2672 bret = true;
2673 TRACE("Saved config file \"%s\"", alt_file);
2674
2675 on_error:
2676 if (need_disklock)
2677 container_disk_unlock(c);
2678 else
2679 container_mem_unlock(c);
2680
2681 return bret;
2682 }
2683
2684 WRAP_API_1(bool, lxcapi_save_config, const char *)
2685
2686
2687 static bool mod_rdep(struct lxc_container *c0, struct lxc_container *c, bool inc)
2688 {
2689 FILE *f1;
2690 struct stat fbuf;
2691 void *buf = NULL;
2692 char *del = NULL;
2693 char path[PATH_MAX];
2694 char newpath[PATH_MAX];
2695 int fd, ret, n = 0, v = 0;
2696 bool bret = false;
2697 size_t len = 0, bytes = 0;
2698
2699 if (container_disk_lock(c0))
2700 return false;
2701
2702 ret = strnprintf(path, sizeof(path), "%s/%s/lxc_snapshots", c0->config_path, c0->name);
2703 if (ret < 0)
2704 goto out;
2705
2706 ret = strnprintf(newpath, sizeof(newpath), "%s\n%s\n", c->config_path, c->name);
2707 if (ret < 0)
2708 goto out;
2709
2710 /* If we find an lxc-snapshot file using the old format only listing the
2711 * number of snapshots we will keep using it. */
2712 f1 = fopen(path, "re");
2713 if (f1) {
2714 n = fscanf(f1, "%d", &v);
2715 fclose(f1);
2716 if (n == 1 && v == 0) {
2717 ret = remove(path);
2718 if (ret < 0)
2719 SYSERROR("Failed to remove \"%s\"", path);
2720
2721 n = 0;
2722 }
2723 }
2724
2725 if (n == 1) {
2726 v += inc ? 1 : -1;
2727 f1 = fopen(path, "we");
2728 if (!f1)
2729 goto out;
2730
2731 if (fprintf(f1, "%d\n", v) < 0) {
2732 ERROR("Error writing new snapshots value");
2733 fclose(f1);
2734 goto out;
2735 }
2736
2737 ret = fclose(f1);
2738 if (ret != 0) {
2739 SYSERROR("Error writing to or closing snapshots file");
2740 goto out;
2741 }
2742 } else {
2743 /* Here we know that we have or can use an lxc-snapshot file
2744 * using the new format. */
2745 if (inc) {
2746 f1 = fopen(path, "ae");
2747 if (!f1)
2748 goto out;
2749
2750 if (fprintf(f1, "%s", newpath) < 0) {
2751 ERROR("Error writing new snapshots entry");
2752 ret = fclose(f1);
2753 if (ret != 0)
2754 SYSERROR("Error writing to or closing snapshots file");
2755 goto out;
2756 }
2757
2758 ret = fclose(f1);
2759 if (ret != 0) {
2760 SYSERROR("Error writing to or closing snapshots file");
2761 goto out;
2762 }
2763 } else if (!inc) {
2764 if ((fd = open(path, O_RDWR | O_CLOEXEC)) < 0)
2765 goto out;
2766
2767 if (fstat(fd, &fbuf) < 0) {
2768 close(fd);
2769 goto out;
2770 }
2771
2772 if (fbuf.st_size != 0) {
2773 buf = lxc_strmmap(NULL, fbuf.st_size, PROT_READ | PROT_WRITE, MAP_SHARED, fd, 0);
2774 if (buf == MAP_FAILED) {
2775 SYSERROR("Failed to create mapping %s", path);
2776 close(fd);
2777 goto out;
2778 }
2779
2780 len = strlen(newpath);
2781 while ((del = strstr((char *)buf, newpath))) {
2782 memmove(del, del + len, strlen(del) - len + 1);
2783 bytes += len;
2784 }
2785
2786 lxc_strmunmap(buf, fbuf.st_size);
2787 if (ftruncate(fd, fbuf.st_size - bytes) < 0) {
2788 SYSERROR("Failed to truncate file %s", path);
2789 close(fd);
2790 goto out;
2791 }
2792 }
2793
2794 close(fd);
2795 }
2796
2797 /* If the lxc-snapshot file is empty, remove it. */
2798 if (stat(path, &fbuf) < 0)
2799 goto out;
2800
2801 if (!fbuf.st_size) {
2802 ret = remove(path);
2803 if (ret < 0)
2804 SYSERROR("Failed to remove \"%s\"", path);
2805 }
2806 }
2807
2808 bret = true;
2809
2810 out:
2811 container_disk_unlock(c0);
2812 return bret;
2813 }
2814
2815 void mod_all_rdeps(struct lxc_container *c, bool inc)
2816 {
2817 __do_free char *lxcpath = NULL, *lxcname = NULL;
2818 __do_fclose FILE *f = NULL;
2819 size_t pathlen = 0, namelen = 0;
2820 struct lxc_container *p;
2821 char path[PATH_MAX];
2822 int ret;
2823
2824 ret = strnprintf(path, sizeof(path), "%s/%s/lxc_rdepends",
2825 c->config_path, c->name);
2826 if (ret < 0) {
2827 ERROR("Path name too long");
2828 return;
2829 }
2830
2831 f = fopen(path, "re");
2832 if (!f)
2833 return;
2834
2835 while (getline(&lxcpath, &pathlen, f) != -1) {
2836 if (getline(&lxcname, &namelen, f) == -1) {
2837 ERROR("badly formatted file %s", path);
2838 return;
2839 }
2840
2841 remove_trailing_newlines(lxcpath);
2842 remove_trailing_newlines(lxcname);
2843
2844 if ((p = lxc_container_new(lxcname, lxcpath)) == NULL) {
2845 ERROR("Unable to find dependent container %s:%s",
2846 lxcpath, lxcname);
2847 continue;
2848 }
2849
2850 if (!mod_rdep(p, c, inc))
2851 ERROR("Failed to update snapshots file for %s:%s",
2852 lxcpath, lxcname);
2853
2854 lxc_container_put(p);
2855 }
2856 }
2857
2858 static bool has_fs_snapshots(struct lxc_container *c)
2859 {
2860 __do_fclose FILE *f = NULL;
2861 char path[PATH_MAX];
2862 int ret, v;
2863 struct stat fbuf;
2864
2865 ret = strnprintf(path, sizeof(path), "%s/%s/lxc_snapshots", c->config_path,
2866 c->name);
2867 if (ret < 0)
2868 return false;
2869
2870 /* If the file doesn't exist there are no snapshots. */
2871 if (stat(path, &fbuf) < 0)
2872 return false;
2873
2874 v = fbuf.st_size;
2875 if (v != 0) {
2876 f = fopen(path, "re");
2877 if (!f)
2878 return false;
2879
2880 ret = fscanf(f, "%d", &v);
2881 if (ret != 1)
2882 INFO("Container uses new lxc-snapshots format %s", path);
2883 }
2884
2885 return v != 0;
2886 }
2887
2888 static bool has_snapshots(struct lxc_container *c)
2889 {
2890 __do_closedir DIR *dir = NULL;
2891 char path[PATH_MAX];
2892 struct dirent *direntp;
2893 int count = 0;
2894
2895 if (!get_snappath_dir(c, path))
2896 return false;
2897
2898 dir = opendir(path);
2899 if (!dir)
2900 return false;
2901
2902 while ((direntp = readdir(dir))) {
2903 if (strequal(direntp->d_name, "."))
2904 continue;
2905
2906 if (strequal(direntp->d_name, ".."))
2907 continue;
2908 count++;
2909 break;
2910 }
2911
2912 return count > 0;
2913 }
2914
2915 static bool do_destroy_container(struct lxc_conf *conf) {
2916 int ret;
2917
2918 if (am_guest_unpriv()) {
2919 ret = userns_exec_full(conf, storage_destroy_wrapper, conf,
2920 "storage_destroy_wrapper");
2921 if (ret < 0)
2922 return false;
2923
2924 return true;
2925 }
2926
2927 return storage_destroy(conf);
2928 }
2929
2930 static int lxc_rmdir_onedev_wrapper(void *data)
2931 {
2932 char *arg = (char *) data;
2933 return lxc_rmdir_onedev(arg, "snaps");
2934 }
2935
2936 static int lxc_unlink_exec_wrapper(void *data)
2937 {
2938 char *arg = data;
2939 return unlink(arg);
2940 }
2941
2942 static bool container_destroy(struct lxc_container *c,
2943 struct lxc_storage *storage)
2944 {
2945 const char *p1;
2946 size_t len;
2947 struct lxc_conf *conf;
2948 char *path = NULL;
2949 bool bret = false;
2950 int ret = 0;
2951
2952 if (!c || !do_lxcapi_is_defined(c))
2953 return false;
2954
2955 conf = c->lxc_conf;
2956 if (container_disk_lock(c))
2957 return false;
2958
2959 if (!is_stopped(c)) {
2960 /* We should queue some sort of error - in c->error_string? */
2961 ERROR("container %s is not stopped", c->name);
2962 goto out;
2963 }
2964
2965 if (conf && !list_empty(&conf->hooks[LXCHOOK_DESTROY])) {
2966 /* Start of environment variable setup for hooks */
2967 if (setenv("LXC_NAME", c->name, 1))
2968 SYSERROR("Failed to set environment variable for container name");
2969
2970 if (conf->rcfile && setenv("LXC_CONFIG_FILE", conf->rcfile, 1))
2971 SYSERROR("Failed to set environment variable for config path");
2972
2973 if (conf->rootfs.mount && setenv("LXC_ROOTFS_MOUNT", conf->rootfs.mount, 1))
2974 SYSERROR("Failed to set environment variable for rootfs mount");
2975
2976 if (conf->rootfs.path && setenv("LXC_ROOTFS_PATH", conf->rootfs.path, 1))
2977 SYSERROR("Failed to set environment variable for rootfs mount");
2978
2979 if (conf->console.path && setenv("LXC_CONSOLE", conf->console.path, 1))
2980 SYSERROR("Failed to set environment variable for console path");
2981
2982 if (conf->console.log_path && setenv("LXC_CONSOLE_LOGPATH", conf->console.log_path, 1))
2983 SYSERROR("Failed to set environment variable for console log");
2984 /* End of environment variable setup for hooks */
2985
2986 if (run_lxc_hooks(c->name, "destroy", conf, NULL)) {
2987 ERROR("Failed to execute clone hook for \"%s\"", c->name);
2988 goto out;
2989 }
2990 }
2991
2992 if (current_config && conf == current_config) {
2993 current_config = NULL;
2994
2995 if (conf->logfd != -1) {
2996 close(conf->logfd);
2997 conf->logfd = -1;
2998 }
2999 }
3000
3001 /* LXC is not managing the storage of the container. */
3002 if (conf && !conf->rootfs.managed)
3003 goto on_success;
3004
3005 if (conf && conf->rootfs.path && conf->rootfs.mount) {
3006 if (!do_destroy_container(conf)) {
3007 ERROR("Error destroying rootfs for %s", c->name);
3008 goto out;
3009 }
3010 INFO("Destroyed rootfs for %s", c->name);
3011 }
3012
3013 mod_all_rdeps(c, false);
3014
3015 p1 = do_lxcapi_get_config_path(c);
3016 /* strlen(p1)
3017 * +
3018 * /
3019 * +
3020 * strlen(c->name)
3021 * +
3022 * /
3023 * +
3024 * strlen("config") = 6
3025 * +
3026 * \0
3027 */
3028 len = strlen(p1) + 1 + strlen(c->name) + 1 + strlen(LXC_CONFIG_FNAME) + 1;
3029 path = malloc(len);
3030 if (!path) {
3031 ERROR("Failed to allocate memory");
3032 goto out;
3033 }
3034
3035 /* For an overlay container the rootfs is considered immutable and
3036 * cannot be removed when restoring from a snapshot.
3037 */
3038 if (storage && (strequal(storage->type, "overlay") ||
3039 strequal(storage->type, "overlayfs")) &&
3040 (storage->flags & LXC_STORAGE_INTERNAL_OVERLAY_RESTORE)) {
3041 ret = strnprintf(path, len, "%s/%s/%s", p1, c->name, LXC_CONFIG_FNAME);
3042 if (ret < 0)
3043 goto out;
3044
3045 if (am_guest_unpriv())
3046 ret = userns_exec_1(conf, lxc_unlink_exec_wrapper, path,
3047 "lxc_unlink_exec_wrapper");
3048 else
3049 ret = unlink(path);
3050 if (ret < 0) {
3051 SYSERROR("Failed to destroy config file \"%s\" for \"%s\"",
3052 path, c->name);
3053 goto out;
3054 }
3055 INFO("Destroyed config file \"%s\" for \"%s\"", path, c->name);
3056
3057 bret = true;
3058 goto out;
3059 }
3060
3061 ret = strnprintf(path, len, "%s/%s", p1, c->name);
3062 if (ret < 0)
3063 goto out;
3064
3065 if (am_guest_unpriv())
3066 ret = userns_exec_full(conf, lxc_rmdir_onedev_wrapper, path,
3067 "lxc_rmdir_onedev_wrapper");
3068 else
3069 ret = lxc_rmdir_onedev(path, "snaps");
3070 if (ret < 0) {
3071 ERROR("Failed to destroy directory \"%s\" for \"%s\"", path,
3072 c->name);
3073 goto out;
3074 }
3075 INFO("Destroyed directory \"%s\" for \"%s\"", path, c->name);
3076
3077 on_success:
3078 bret = true;
3079
3080 out:
3081 if (path)
3082 free(path);
3083
3084 container_disk_unlock(c);
3085 return bret;
3086 }
3087
3088 static bool do_lxcapi_destroy(struct lxc_container *c)
3089 {
3090 if (!c || !lxcapi_is_defined(c))
3091 return false;
3092
3093 if (c->lxc_conf && c->lxc_conf->rootfs.managed) {
3094 if (has_snapshots(c)) {
3095 ERROR("Container %s has snapshots; not removing", c->name);
3096 return false;
3097 }
3098
3099 if (has_fs_snapshots(c)) {
3100 ERROR("container %s has snapshots on its rootfs", c->name);
3101 return false;
3102 }
3103 }
3104
3105 return container_destroy(c, NULL);
3106 }
3107
3108 WRAP_API(bool, lxcapi_destroy)
3109
3110 static bool do_lxcapi_destroy_with_snapshots(struct lxc_container *c)
3111 {
3112 if (!c || !lxcapi_is_defined(c))
3113 return false;
3114
3115 if (!lxcapi_snapshot_destroy_all(c)) {
3116 ERROR("Error deleting all snapshots");
3117 return false;
3118 }
3119
3120 return lxcapi_destroy(c);
3121 }
3122
3123 WRAP_API(bool, lxcapi_destroy_with_snapshots)
3124
3125 int lxc_set_config_item_locked(struct lxc_conf *conf, const char *key,
3126 const char *v)
3127 {
3128 int ret;
3129 struct lxc_config_t *config;
3130 bool bret = true;
3131
3132 config = lxc_get_config(key);
3133
3134 ret = config->set(key, v, conf, NULL);
3135 if (ret < 0)
3136 return -EINVAL;
3137
3138 if (lxc_config_value_empty(v))
3139 do_clear_unexp_config_line(conf, key);
3140 else
3141 bret = do_append_unexp_config_line(conf, key, v);
3142 if (!bret)
3143 return -ENOMEM;
3144
3145 return 0;
3146 }
3147
3148 static bool do_set_config_item_locked(struct lxc_container *c, const char *key,
3149 const char *v)
3150 {
3151 int ret;
3152
3153 if (!c->lxc_conf)
3154 c->lxc_conf = lxc_conf_init();
3155
3156 if (!c->lxc_conf)
3157 return false;
3158
3159 ret = lxc_set_config_item_locked(c->lxc_conf, key, v);
3160 if (ret < 0)
3161 return false;
3162
3163 return true;
3164 }
3165
3166 static bool do_lxcapi_set_config_item(struct lxc_container *c, const char *key, const char *v)
3167 {
3168 bool b = false;
3169
3170 if (!c)
3171 return false;
3172
3173 if (container_mem_lock(c))
3174 return false;
3175
3176 b = do_set_config_item_locked(c, key, v);
3177
3178 container_mem_unlock(c);
3179 return b;
3180 }
3181
3182 WRAP_API_2(bool, lxcapi_set_config_item, const char *, const char *)
3183
3184 static char *lxcapi_config_file_name(struct lxc_container *c)
3185 {
3186 if (!c || !c->configfile)
3187 return NULL;
3188
3189 return strdup(c->configfile);
3190 }
3191
3192 static const char *lxcapi_get_config_path(struct lxc_container *c)
3193 {
3194 if (!c || !c->config_path)
3195 return NULL;
3196
3197 return (const char *)(c->config_path);
3198 }
3199
3200 /*
3201 * not for export
3202 * Just recalculate the c->configfile based on the
3203 * c->config_path, which must be set.
3204 * The lxc_container must be locked or not yet public.
3205 */
3206 static bool set_config_filename(struct lxc_container *c)
3207 {
3208 char *newpath;
3209 int len, ret;
3210
3211 if (!c->config_path)
3212 return false;
3213
3214 /* $lxc_path + "/" + c->name + "/" + "config" + '\0' */
3215 len = strlen(c->config_path) + 1 + strlen(c->name) + 1 + strlen(LXC_CONFIG_FNAME) + 1;
3216 newpath = malloc(len);
3217 if (!newpath)
3218 return false;
3219
3220 ret = strnprintf(newpath, len, "%s/%s/%s", c->config_path, c->name, LXC_CONFIG_FNAME);
3221 if (ret < 0) {
3222 fprintf(stderr, "Error printing out config file name\n");
3223 free(newpath);
3224 return false;
3225 }
3226
3227 free(c->configfile);
3228 c->configfile = newpath;
3229
3230 return true;
3231 }
3232
3233 static bool do_lxcapi_set_config_path(struct lxc_container *c, const char *path)
3234 {
3235 char *p;
3236 bool b = false;
3237 char *oldpath = NULL;
3238
3239 if (!c)
3240 return b;
3241
3242 if (container_mem_lock(c))
3243 return b;
3244
3245 p = strdup(path);
3246 if (!p) {
3247 ERROR("Out of memory setting new lxc path");
3248 goto err;
3249 }
3250
3251 b = true;
3252 if (c->config_path)
3253 oldpath = c->config_path;
3254 c->config_path = p;
3255
3256 /* Since we've changed the config path, we have to change the
3257 * config file name too */
3258 if (!set_config_filename(c)) {
3259 ERROR("Out of memory setting new config filename");
3260 b = false;
3261 free(c->config_path);
3262 c->config_path = oldpath;
3263 oldpath = NULL;
3264 }
3265
3266 err:
3267 free(oldpath);
3268 container_mem_unlock(c);
3269 return b;
3270 }
3271
3272 WRAP_API_1(bool, lxcapi_set_config_path, const char *)
3273
3274 static bool do_lxcapi_set_cgroup_item(struct lxc_container *c, const char *subsys, const char *value)
3275 {
3276 call_cleaner(cgroup_exit) struct cgroup_ops *cgroup_ops = NULL;
3277 int ret;
3278
3279 if (!c)
3280 return false;
3281
3282 if (is_stopped(c))
3283 return false;
3284
3285 ret = cgroup_set(c->name, c->config_path, subsys, value);
3286 if (ret < 0 && ERRNO_IS_NOT_SUPPORTED(ret)) {
3287 cgroup_ops = cgroup_init(c->lxc_conf);
3288 if (!cgroup_ops)
3289 return false;
3290
3291 ret = cgroup_ops->set(cgroup_ops, subsys, value, c->name, c->config_path);
3292 }
3293
3294 return ret == 0;
3295 }
3296
3297 WRAP_API_2(bool, lxcapi_set_cgroup_item, const char *, const char *)
3298
3299 static int do_lxcapi_get_cgroup_item(struct lxc_container *c, const char *subsys, char *retv, int inlen)
3300 {
3301 call_cleaner(cgroup_exit) struct cgroup_ops *cgroup_ops = NULL;
3302 int ret;
3303
3304 if (!c)
3305 return -1;
3306
3307 if (is_stopped(c))
3308 return -1;
3309
3310 ret = cgroup_get(c->name, c->config_path, subsys, retv, inlen);
3311 if (ret < 0 && ERRNO_IS_NOT_SUPPORTED(ret)) {
3312 cgroup_ops = cgroup_init(c->lxc_conf);
3313 if (!cgroup_ops)
3314 return -1;
3315
3316 return cgroup_ops->get(cgroup_ops, subsys, retv, inlen, c->name, c->config_path);
3317 }
3318
3319 return ret;
3320 }
3321
3322 WRAP_API_3(int, lxcapi_get_cgroup_item, const char *, char *, int)
3323
3324 const char *lxc_get_global_config_item(const char *key)
3325 {
3326 return lxc_global_config_value(key);
3327 }
3328
3329 const char *lxc_get_version(void)
3330 {
3331 return LXC_VERSION;
3332 }
3333
3334 static int copy_file(const char *old, const char *new)
3335 {
3336 int in, out;
3337 ssize_t len, ret;
3338 char buf[8096];
3339 struct stat sbuf;
3340
3341 if (file_exists(new)) {
3342 ERROR("copy destination %s exists", new);
3343 return -1;
3344 }
3345
3346 ret = stat(old, &sbuf);
3347 if (ret < 0) {
3348 INFO("Error stat'ing %s", old);
3349 return -1;
3350 }
3351
3352 in = open(old, O_RDONLY);
3353 if (in < 0) {
3354 SYSERROR("Error opening original file %s", old);
3355 return -1;
3356 }
3357
3358 out = open(new, O_CREAT | O_EXCL | O_WRONLY, 0644);
3359 if (out < 0) {
3360 SYSERROR("Error opening new file %s", new);
3361 close(in);
3362 return -1;
3363 }
3364
3365 for (;;) {
3366 len = lxc_read_nointr(in, buf, 8096);
3367 if (len < 0) {
3368 SYSERROR("Error reading old file %s", old);
3369 goto err;
3370 }
3371
3372 if (len == 0)
3373 break;
3374
3375 ret = lxc_write_nointr(out, buf, len);
3376 if (ret < len) { /* should we retry? */
3377 SYSERROR("Error: write to new file %s was interrupted", new);
3378 goto err;
3379 }
3380 }
3381
3382 close(in);
3383 close(out);
3384
3385 /* We set mode, but not owner/group. */
3386 ret = chmod(new, sbuf.st_mode);
3387 if (ret) {
3388 SYSERROR("Error setting mode on %s", new);
3389 return -1;
3390 }
3391
3392 return 0;
3393
3394 err:
3395 close(in);
3396 close(out);
3397 return -1;
3398 }
3399
3400 static int copyhooks(struct lxc_container *oldc, struct lxc_container *c)
3401 {
3402 __do_free char *cpath = NULL;
3403 int i, len, ret;
3404 struct string_entry *entry;
3405
3406 len = strlen(oldc->config_path) + strlen(oldc->name) + 3;
3407 cpath = malloc(len);
3408 if (!cpath)
3409 return ret_errno(ENOMEM);
3410
3411 ret = strnprintf(cpath, len, "%s/%s/", oldc->config_path, oldc->name);
3412 if (ret < 0)
3413 return -1;
3414
3415 for (i = 0; i < NUM_LXC_HOOKS; i++) {
3416 list_for_each_entry(entry, &c->lxc_conf->hooks[i], head) {
3417 __do_free char *hookname = NULL;
3418 char *fname, *new_hook;
3419 char tmppath[PATH_MAX];
3420
3421 fname = strrchr(entry->val, '/');
3422 if (!fname)
3423 return 0;
3424
3425 /* If this hook is public - ignore. */
3426 if (!strnequal(entry->val, cpath, len - 1))
3427 continue;
3428
3429 /* copy the script, and change the entry in confile */
3430 ret = strnprintf(tmppath, sizeof(tmppath), "%s/%s/%s",
3431 c->config_path, c->name, fname+1);
3432 if (ret < 0)
3433 return -1;
3434
3435 ret = copy_file(entry->val, tmppath);
3436 if (ret < 0)
3437 return -1;
3438
3439 new_hook = strdup(tmppath);
3440 if (!new_hook)
3441 return syserror("out of memory copying hook path");
3442
3443 hookname = move_ptr(entry->val);
3444 entry->val = move_ptr(new_hook);
3445 }
3446 }
3447
3448 if (!clone_update_unexp_hooks(c->lxc_conf, oldc->config_path,
3449 c->config_path, oldc->name, c->name)) {
3450 return syserror_ret(-1, "Error saving new hooks in clone");
3451 }
3452
3453 do_lxcapi_save_config(c, NULL);
3454 return 0;
3455 }
3456
3457 static int copy_fstab(struct lxc_container *oldc, struct lxc_container *c)
3458 {
3459 char newpath[PATH_MAX];
3460 char *oldpath = oldc->lxc_conf->fstab;
3461 int ret;
3462
3463 if (!oldpath)
3464 return 0;
3465
3466 clear_unexp_config_line(c->lxc_conf, "lxc.mount.fstab", false);
3467
3468 char *p = strrchr(oldpath, '/');
3469 if (!p)
3470 return -1;
3471
3472 ret = strnprintf(newpath, sizeof(newpath), "%s/%s%s",
3473 c->config_path, c->name, p);
3474 if (ret < 0) {
3475 ERROR("error printing new path for %s", oldpath);
3476 return -1;
3477 }
3478
3479 if (file_exists(newpath)) {
3480 ERROR("error: fstab file %s exists", newpath);
3481 return -1;
3482 }
3483
3484 if (copy_file(oldpath, newpath) < 0) {
3485 ERROR("error: copying %s to %s", oldpath, newpath);
3486 return -1;
3487 }
3488
3489 free(c->lxc_conf->fstab);
3490
3491 c->lxc_conf->fstab = strdup(newpath);
3492 if (!c->lxc_conf->fstab) {
3493 ERROR("error: allocating pathname");
3494 return -1;
3495 }
3496
3497 if (!do_append_unexp_config_line(c->lxc_conf, "lxc.mount.fstab", newpath)) {
3498 ERROR("error saving new lxctab");
3499 return -1;
3500 }
3501
3502 return 0;
3503 }
3504
3505 static void copy_rdepends(struct lxc_container *c, struct lxc_container *c0)
3506 {
3507 char path0[PATH_MAX], path1[PATH_MAX];
3508 int ret;
3509
3510 ret = strnprintf(path0, sizeof(path0), "%s/%s/lxc_rdepends", c0->config_path,
3511 c0->name);
3512 if (ret < 0) {
3513 WARN("Error copying reverse dependencies");
3514 return;
3515 }
3516
3517 ret = strnprintf(path1, sizeof(path1), "%s/%s/lxc_rdepends", c->config_path,
3518 c->name);
3519 if (ret < 0) {
3520 WARN("Error copying reverse dependencies");
3521 return;
3522 }
3523
3524 if (copy_file(path0, path1) < 0) {
3525 INFO("Error copying reverse dependencies");
3526 return;
3527 }
3528 }
3529
3530 static bool add_rdepends(struct lxc_container *c, struct lxc_container *c0)
3531 {
3532 __do_fclose FILE *f = NULL;
3533 int ret;
3534 char path[PATH_MAX];
3535
3536 ret = strnprintf(path, sizeof(path), "%s/%s/lxc_rdepends", c->config_path, c->name);
3537 if (ret < 0)
3538 return false;
3539
3540 f = fopen(path, "ae");
3541 if (!f)
3542 return false;
3543
3544 /* If anything goes wrong, just return an error. */
3545 return fprintf(f, "%s\n%s\n", c0->config_path, c0->name) > 0;
3546 }
3547
3548 /*
3549 * If the fs natively supports snapshot clones with no penalty,
3550 * then default to those even if not requested.
3551 * Currently we only do this for btrfs.
3552 */
3553 static bool should_default_to_snapshot(struct lxc_container *c0,
3554 struct lxc_container *c1)
3555 {
3556 __do_free char *p0 = NULL, *p1 = NULL;
3557 int ret;
3558 size_t l0 = strlen(c0->config_path) + strlen(c0->name) + 2;
3559 size_t l1 = strlen(c1->config_path) + strlen(c1->name) + 2;
3560 char *rootfs = c0->lxc_conf->rootfs.path;
3561
3562 p0 = must_realloc(NULL, l0 + 1);
3563 p1 = must_realloc(NULL, l1 + 1);
3564 ret = strnprintf(p0, l0, "%s/%s", c0->config_path, c0->name);
3565 if (ret < 0)
3566 return false;
3567
3568 ret = strnprintf(p1, l1, "%s/%s", c1->config_path, c1->name);
3569 if (ret < 0)
3570 return false;
3571
3572 if (!is_btrfs_fs(p0) || !is_btrfs_fs(p1))
3573 return false;
3574
3575 if (is_btrfs_subvol(rootfs) <= 0)
3576 return false;
3577
3578 return btrfs_same_fs(p0, p1) == 0;
3579 }
3580
3581 static int copy_storage(struct lxc_container *c0, struct lxc_container *c,
3582 const char *newtype, int flags, const char *bdevdata,
3583 uint64_t newsize)
3584 {
3585 struct lxc_storage *bdev;
3586 bool need_rdep;
3587
3588 if (should_default_to_snapshot(c0, c))
3589 flags |= LXC_CLONE_SNAPSHOT;
3590
3591 bdev = storage_copy(c0, c->name, c->config_path, newtype, flags,
3592 bdevdata, newsize, &need_rdep);
3593 if (!bdev) {
3594 ERROR("Error copying storage.");
3595 return -1;
3596 }
3597
3598 /* Set new rootfs. */
3599 free(c->lxc_conf->rootfs.path);
3600 c->lxc_conf->rootfs.path = strdup(bdev->src);
3601 storage_put(bdev);
3602
3603 if (!c->lxc_conf->rootfs.path) {
3604 ERROR("Out of memory while setting storage path.");
3605 return -1;
3606 }
3607
3608 /* Append a new lxc.rootfs.path entry to the unexpanded config. */
3609 clear_unexp_config_line(c->lxc_conf, "lxc.rootfs.path", false);
3610 if (!do_append_unexp_config_line(c->lxc_conf, "lxc.rootfs.path",
3611 c->lxc_conf->rootfs.path)) {
3612 ERROR("Error saving new rootfs to cloned config.");
3613 return -1;
3614 }
3615
3616 if (flags & LXC_CLONE_SNAPSHOT)
3617 copy_rdepends(c, c0);
3618
3619 if (need_rdep) {
3620 if (!add_rdepends(c, c0))
3621 WARN("Error adding reverse dependency from %s to %s",
3622 c->name, c0->name);
3623 }
3624
3625 mod_all_rdeps(c, true);
3626
3627 return 0;
3628 }
3629
3630 struct clone_update_data {
3631 struct lxc_container *c0;
3632 struct lxc_container *c1;
3633 int flags;
3634 char **hookargs;
3635 };
3636
3637 static int clone_update_rootfs(struct clone_update_data *data)
3638 {
3639 struct lxc_container *c0 = data->c0;
3640 struct lxc_container *c = data->c1;
3641 int flags = data->flags;
3642 char **hookargs = data->hookargs;
3643 int ret = -1;
3644 char path[PATH_MAX];
3645 struct lxc_storage *bdev;
3646 FILE *fout;
3647 struct lxc_conf *conf = c->lxc_conf;
3648
3649 /* update hostname in rootfs */
3650 /* we're going to mount, so run in a clean namespace to simplify cleanup */
3651
3652 (void)lxc_drop_groups();
3653
3654 if (setgid(0) < 0) {
3655 ERROR("Failed to setgid to 0");
3656 return -1;
3657 }
3658
3659 if (setuid(0) < 0) {
3660 ERROR("Failed to setuid to 0");
3661 return -1;
3662 }
3663
3664 if (unshare(CLONE_NEWNS) < 0)
3665 return -1;
3666
3667 ret = lxc_storage_prepare(conf);
3668 if (ret)
3669 return -1;
3670 bdev = conf->rootfs.storage;
3671
3672 if (!strequal(bdev->type, "dir")) {
3673 if (unshare(CLONE_NEWNS) < 0) {
3674 ERROR("error unsharing mounts");
3675 lxc_storage_put(conf);
3676 return -1;
3677 }
3678
3679 if (detect_shared_rootfs() && mount(NULL, "/", NULL, MS_SLAVE | MS_REC, NULL))
3680 SYSERROR("Failed to recursively turn root mount tree into dependent mount. Continuing...");
3681
3682 if (bdev->ops->mount(bdev) < 0) {
3683 lxc_storage_put(conf);
3684 return -1;
3685 }
3686 } else { /* TODO come up with a better way */
3687 free(bdev->dest);
3688 bdev->dest = strdup(lxc_storage_get_path(bdev->src, bdev->type));
3689 }
3690
3691 if (!list_empty(&conf->hooks[LXCHOOK_CLONE])) {
3692 /* Start of environment variable setup for hooks */
3693 if (c0->name && setenv("LXC_SRC_NAME", c0->name, 1))
3694 SYSERROR("failed to set environment variable for source container name");
3695
3696 if (setenv("LXC_NAME", c->name, 1))
3697 SYSERROR("failed to set environment variable for container name");
3698
3699 if (conf->rcfile && setenv("LXC_CONFIG_FILE", conf->rcfile, 1))
3700 SYSERROR("failed to set environment variable for config path");
3701
3702 if (bdev->dest && setenv("LXC_ROOTFS_MOUNT", bdev->dest, 1))
3703 SYSERROR("failed to set environment variable for rootfs mount");
3704
3705 if (conf->rootfs.path && setenv("LXC_ROOTFS_PATH", conf->rootfs.path, 1))
3706 SYSERROR("failed to set environment variable for rootfs mount");
3707
3708 if (run_lxc_hooks(c->name, "clone", conf, hookargs)) {
3709 ERROR("Error executing clone hook for %s", c->name);
3710 lxc_storage_put(conf);
3711 return -1;
3712 }
3713 }
3714
3715 if (!(flags & LXC_CLONE_KEEPNAME)) {
3716 ret = strnprintf(path, sizeof(path), "%s/etc/hostname", bdev->dest);
3717 lxc_storage_put(conf);
3718
3719 if (ret < 0)
3720 return -1;
3721
3722 if (!file_exists(path))
3723 return 0;
3724
3725 if (!(fout = fopen(path, "we"))) {
3726 SYSERROR("unable to open %s: ignoring", path);
3727 return 0;
3728 }
3729
3730 if (fprintf(fout, "%s", c->name) < 0) {
3731 fclose(fout);
3732 return -1;
3733 }
3734
3735 if (fclose(fout) < 0)
3736 return -1;
3737 } else {
3738 lxc_storage_put(conf);
3739 }
3740
3741 return 0;
3742 }
3743
3744 static int clone_update_rootfs_wrapper(void *data)
3745 {
3746 struct clone_update_data *arg = (struct clone_update_data *) data;
3747 return clone_update_rootfs(arg);
3748 }
3749
3750 /*
3751 * We want to support:
3752 sudo lxc-clone -o o1 -n n1 -s -L|-fssize fssize -v|--vgname vgname \
3753 -p|--lvprefix lvprefix -t|--fstype fstype -B backingstore
3754
3755 -s [ implies overlay]
3756 -s -B overlay
3757
3758 only rootfs gets converted (copied/snapshotted) on clone.
3759 */
3760
3761 static int create_file_dirname(char *path, struct lxc_conf *conf)
3762 {
3763 __do_close int fd_rootfs = -EBADF;
3764 char *p;
3765
3766 p = strrchr(path, '/');
3767 if (!p)
3768 return -1;
3769
3770 *p = '\0';
3771 fd_rootfs = do_create_container_dir(path, conf);
3772 *p = '/';
3773
3774 return fd_rootfs >= 0;
3775 }
3776
3777 static struct lxc_container *do_lxcapi_clone(struct lxc_container *c, const char *newname,
3778 const char *lxcpath, int flags,
3779 const char *bdevtype, const char *bdevdata, uint64_t newsize,
3780 char **hookargs)
3781 {
3782 char newpath[PATH_MAX];
3783 int fd, ret;
3784 struct clone_update_data data;
3785 size_t saved_unexp_len;
3786 pid_t pid;
3787 int storage_copied = 0;
3788 char *origroot = NULL, *saved_unexp_conf = NULL;
3789 struct lxc_container *c2 = NULL;
3790
3791 if (!c || !do_lxcapi_is_defined(c))
3792 return NULL;
3793
3794 if (container_mem_lock(c))
3795 return NULL;
3796 if (!is_stopped(c) && !(flags & LXC_CLONE_ALLOW_RUNNING)) {
3797 ERROR("error: Original container (%s) is running. Use --allowrunning if you want to force a snapshot of the running container.", c->name);
3798 goto out;
3799 }
3800
3801 /* Make sure the container doesn't yet exist. */
3802 if (!newname)
3803 newname = c->name;
3804
3805 if (!lxcpath)
3806 lxcpath = do_lxcapi_get_config_path(c);
3807
3808 ret = strnprintf(newpath, sizeof(newpath), "%s/%s/%s", lxcpath, newname, LXC_CONFIG_FNAME);
3809 if (ret < 0) {
3810 SYSERROR("clone: failed making config pathname");
3811 goto out;
3812 }
3813
3814 if (file_exists(newpath)) {
3815 ERROR("error: clone: %s exists", newpath);
3816 goto out;
3817 }
3818
3819 ret = create_file_dirname(newpath, c->lxc_conf);
3820 if (ret < 0 && errno != EEXIST) {
3821 ERROR("Error creating container dir for %s", newpath);
3822 goto out;
3823 }
3824
3825 /* Copy the configuration. Tweak it as needed. */
3826 if (c->lxc_conf->rootfs.path) {
3827 origroot = c->lxc_conf->rootfs.path;
3828 c->lxc_conf->rootfs.path = NULL;
3829 }
3830
3831 fd = open(newpath, O_WRONLY | O_CREAT | O_CLOEXEC,
3832 S_IRUSR | S_IWUSR | S_IRGRP | S_IWGRP);
3833 if (fd < 0) {
3834 SYSERROR("Failed to open \"%s\"", newpath);
3835 goto out;
3836 }
3837
3838 saved_unexp_conf = c->lxc_conf->unexpanded_config;
3839 saved_unexp_len = c->lxc_conf->unexpanded_len;
3840 c->lxc_conf->unexpanded_config = strdup(saved_unexp_conf);
3841 if (!c->lxc_conf->unexpanded_config) {
3842 close(fd);
3843 goto out;
3844 }
3845
3846 clear_unexp_config_line(c->lxc_conf, "lxc.rootfs.path", false);
3847 write_config(fd, c->lxc_conf);
3848 close(fd);
3849
3850 c->lxc_conf->rootfs.path = origroot;
3851
3852 free(c->lxc_conf->unexpanded_config);
3853 c->lxc_conf->unexpanded_config = saved_unexp_conf;
3854 saved_unexp_conf = NULL;
3855 c->lxc_conf->unexpanded_len = saved_unexp_len;
3856
3857 ret = strnprintf(newpath, sizeof(newpath), "%s/%s/%s", lxcpath, newname, LXC_ROOTFS_DNAME);
3858 if (ret < 0) {
3859 SYSERROR("clone: failed making rootfs pathname");
3860 goto out;
3861 }
3862
3863 ret = mkdir(newpath, 0755);
3864 if (ret < 0) {
3865 /* For an overlay container the rootfs is considered immutable
3866 * and will not have been removed when restoring from a
3867 * snapshot.
3868 */
3869 if (errno != ENOENT &&
3870 !(flags & LXC_STORAGE_INTERNAL_OVERLAY_RESTORE)) {
3871 SYSERROR("Failed to create directory \"%s\"", newpath);
3872 goto out;
3873 }
3874 }
3875
3876 if (am_guest_unpriv()) {
3877 if (chown_mapped_root(newpath, c->lxc_conf) < 0) {
3878 ERROR("Error chowning %s to container root", newpath);
3879 goto out;
3880 }
3881 }
3882
3883 c2 = lxc_container_new(newname, lxcpath);
3884 if (!c2) {
3885 ERROR("clone: failed to create new container (%s %s)", newname,
3886 lxcpath);
3887 goto out;
3888 }
3889
3890 /* copy/snapshot rootfs's */
3891 ret = copy_storage(c, c2, bdevtype, flags, bdevdata, newsize);
3892 if (ret < 0)
3893 goto out;
3894
3895 /* update utsname */
3896 if (!(flags & LXC_CLONE_KEEPNAME)) {
3897 clear_unexp_config_line(c2->lxc_conf, "lxc.utsname", false);
3898 clear_unexp_config_line(c2->lxc_conf, "lxc.uts.name", false);
3899
3900 if (!do_set_config_item_locked(c2, "lxc.uts.name", newname)) {
3901 ERROR("Error setting new hostname");
3902 goto out;
3903 }
3904 }
3905
3906 /* copy hooks */
3907 ret = copyhooks(c, c2);
3908 if (ret < 0) {
3909 ERROR("error copying hooks");
3910 goto out;
3911 }
3912
3913 if (copy_fstab(c, c2) < 0) {
3914 ERROR("error copying fstab");
3915 goto out;
3916 }
3917
3918 /* update macaddrs */
3919 if (!(flags & LXC_CLONE_KEEPMACADDR)) {
3920 if (!network_new_hwaddrs(c2->lxc_conf)) {
3921 ERROR("Error updating mac addresses");
3922 goto out;
3923 }
3924 }
3925
3926 /* Update absolute paths for overlay mount directories. */
3927 if (ovl_update_abs_paths(c2->lxc_conf, c->config_path, c->name, lxcpath, newname) < 0)
3928 goto out;
3929
3930 /* We've now successfully created c2's storage, so clear it out if we
3931 * fail after this.
3932 */
3933 storage_copied = 1;
3934
3935 if (!c2->save_config(c2, NULL))
3936 goto out;
3937
3938 if ((pid = fork()) < 0) {
3939 SYSERROR("fork");
3940 goto out;
3941 }
3942
3943 if (pid > 0) {
3944 ret = wait_for_pid(pid);
3945 if (ret)
3946 goto out;
3947
3948 container_mem_unlock(c);
3949 return c2;
3950 }
3951
3952 data.c0 = c;
3953 data.c1 = c2;
3954 data.flags = flags;
3955 data.hookargs = hookargs;
3956
3957 if (am_guest_unpriv())
3958 ret = userns_exec_full(c->lxc_conf, clone_update_rootfs_wrapper,
3959 &data, "clone_update_rootfs_wrapper");
3960 else
3961 ret = clone_update_rootfs(&data);
3962 if (ret < 0)
3963 _exit(EXIT_FAILURE);
3964
3965 container_mem_unlock(c);
3966 _exit(EXIT_SUCCESS);
3967
3968 out:
3969 container_mem_unlock(c);
3970 if (c2) {
3971 if (!storage_copied)
3972 c2->lxc_conf->rootfs.path = NULL;
3973
3974 c2->destroy(c2);
3975 lxc_container_put(c2);
3976 }
3977
3978 return NULL;
3979 }
3980
3981 static struct lxc_container *lxcapi_clone(struct lxc_container *c, const char *newname,
3982 const char *lxcpath, int flags,
3983 const char *bdevtype, const char *bdevdata, uint64_t newsize,
3984 char **hookargs)
3985 {
3986 struct lxc_container * ret;
3987
3988 current_config = c ? c->lxc_conf : NULL;
3989 ret = do_lxcapi_clone(c, newname, lxcpath, flags, bdevtype, bdevdata, newsize, hookargs);
3990 current_config = NULL;
3991
3992 return ret;
3993 }
3994
3995 static bool do_lxcapi_rename(struct lxc_container *c, const char *newname)
3996 {
3997 struct lxc_storage *bdev;
3998 struct lxc_container *newc;
3999
4000 if (!c || !c->name || !c->config_path || !c->lxc_conf)
4001 return false;
4002
4003 if (has_fs_snapshots(c) || has_snapshots(c)) {
4004 ERROR("Renaming a container with snapshots is not supported");
4005 return false;
4006 }
4007
4008 if (lxc_storage_prepare(c->lxc_conf)) {
4009 ERROR("Failed to find original backing store type");
4010 return false;
4011 }
4012 bdev = c->lxc_conf->rootfs.storage;
4013
4014 newc = lxcapi_clone(c, newname, c->config_path, LXC_CLONE_KEEPMACADDR, NULL, bdev->type, 0, NULL);
4015 lxc_storage_put(c->lxc_conf);
4016 if (!newc) {
4017 lxc_container_put(newc);
4018 return false;
4019 }
4020
4021 if (newc && lxcapi_is_defined(newc))
4022 lxc_container_put(newc);
4023
4024 if (!container_destroy(c, NULL)) {
4025 ERROR("Could not destroy existing container %s", c->name);
4026 return false;
4027 }
4028
4029 return true;
4030 }
4031
4032 WRAP_API_1(bool, lxcapi_rename, const char *)
4033
4034 static int lxcapi_attach(struct lxc_container *c,
4035 lxc_attach_exec_t exec_function, void *exec_payload,
4036 lxc_attach_options_t *options, pid_t *attached_process)
4037 {
4038 int ret;
4039
4040 if (!c)
4041 return -1;
4042
4043 current_config = c->lxc_conf;
4044
4045 ret = lxc_attach(c, exec_function, exec_payload, options,
4046 attached_process);
4047 current_config = NULL;
4048 return ret;
4049 }
4050
4051 static int do_lxcapi_attach_run_wait(struct lxc_container *c,
4052 lxc_attach_options_t *options,
4053 const char *program,
4054 const char *const argv[])
4055 {
4056 lxc_attach_command_t command;
4057 pid_t pid;
4058 int ret;
4059
4060 if (!c)
4061 return -1;
4062
4063 command.program = (char *)program;
4064 command.argv = (char **)argv;
4065
4066 ret = lxc_attach(c, lxc_attach_run_command, &command, options, &pid);
4067 if (ret < 0)
4068 return ret;
4069
4070 return lxc_wait_for_pid_status(pid);
4071 }
4072
4073 static int lxcapi_attach_run_wait(struct lxc_container *c,
4074 lxc_attach_options_t *options,
4075 const char *program, const char *const argv[])
4076 {
4077 int ret;
4078
4079 current_config = c ? c->lxc_conf : NULL;
4080 ret = do_lxcapi_attach_run_wait(c, options, program, argv);
4081 current_config = NULL;
4082
4083 return ret;
4084 }
4085
4086 static int get_next_index(const char *lxcpath, char *cname)
4087 {
4088 __do_free char *fname = NULL;
4089 struct stat sb;
4090 int i = 0, ret;
4091
4092 fname = must_realloc(NULL, strlen(lxcpath) + 20);
4093
4094 for (;;) {
4095 sprintf(fname, "%s/snap%d", lxcpath, i);
4096
4097 ret = stat(fname, &sb);
4098 if (ret != 0)
4099 return i;
4100
4101 i++;
4102 }
4103 }
4104
4105 static bool get_snappath_dir(struct lxc_container *c, char *snappath)
4106 {
4107 int ret;
4108
4109 /*
4110 * If the old style snapshot path exists, use it
4111 * /var/lib/lxc -> /var/lib/lxcsnaps
4112 */
4113 ret = strnprintf(snappath, PATH_MAX, "%ssnaps", c->config_path);
4114 if (ret < 0)
4115 return false;
4116
4117 if (dir_exists(snappath)) {
4118 ret = strnprintf(snappath, PATH_MAX, "%ssnaps/%s", c->config_path, c->name);
4119 if (ret < 0)
4120 return false;
4121
4122 return true;
4123 }
4124
4125 /*
4126 * Use the new style path
4127 * /var/lib/lxc -> /var/lib/lxc + c->name + /snaps + \0
4128 */
4129 ret = strnprintf(snappath, PATH_MAX, "%s/%s/snaps", c->config_path, c->name);
4130 if (ret < 0)
4131 return false;
4132
4133 return true;
4134 }
4135
4136 static int do_lxcapi_snapshot(struct lxc_container *c, const char *commentfile)
4137 {
4138 __do_free char *dfnam = NULL;
4139 int len;
4140 int i, flags, ret;
4141 time_t timer;
4142 struct tm tm_info;
4143 struct lxc_container *c2;
4144 char snappath[PATH_MAX], newname[20];
4145 char buffer[25];
4146 FILE *f;
4147
4148 if (!c || !lxcapi_is_defined(c))
4149 return -1;
4150
4151 if (!storage_can_backup(c->lxc_conf)) {
4152 ERROR("%s's backing store cannot be backed up", c->name);
4153 ERROR("Your container must use another backing store type");
4154 return -1;
4155 }
4156
4157 if (!get_snappath_dir(c, snappath))
4158 return -1;
4159
4160 i = get_next_index(snappath, c->name);
4161
4162 if (lxc_mkdir_p(snappath, 0755) < 0) {
4163 ERROR("Failed to create snapshot directory %s", snappath);
4164 return -1;
4165 }
4166
4167 ret = strnprintf(newname, 20, "snap%d", i);
4168 if (ret < 0)
4169 return -1;
4170
4171 /*
4172 * We pass LXC_CLONE_SNAPSHOT to make sure that a rdepends file entry is
4173 * created in the original container
4174 */
4175 flags = LXC_CLONE_SNAPSHOT | LXC_CLONE_KEEPMACADDR | LXC_CLONE_KEEPNAME |
4176 LXC_CLONE_KEEPBDEVTYPE | LXC_CLONE_MAYBE_SNAPSHOT;
4177 if (storage_lxc_is_dir(c->lxc_conf)) {
4178 ERROR("Snapshot of directory-backed container requested");
4179 ERROR("Making a copy-clone. If you do want snapshots, then");
4180 ERROR("please create overlay clone first, snapshot that");
4181 ERROR("and keep the original container pristine");
4182 flags &= ~LXC_CLONE_SNAPSHOT | LXC_CLONE_MAYBE_SNAPSHOT;
4183 }
4184
4185 c2 = do_lxcapi_clone(c, newname, snappath, flags, NULL, NULL, 0, NULL);
4186 if (!c2) {
4187 ERROR("Failed to clone of %s:%s", c->config_path, c->name);
4188 return -1;
4189 }
4190
4191 lxc_container_put(c2);
4192
4193 /* Now write down the creation time. */
4194 time(&timer);
4195
4196 if (!localtime_r(&timer, &tm_info)) {
4197 ERROR("Failed to get localtime");
4198 return -1;
4199 }
4200
4201 strftime(buffer, 25, "%Y:%m:%d %H:%M:%S", &tm_info);
4202
4203 len = strlen(snappath) + 1 + strlen(newname) + 1 + strlen(LXC_TIMESTAMP_FNAME) + 1;
4204 dfnam = must_realloc(NULL, len);
4205 ret = strnprintf(dfnam, len, "%s/%s/%s", snappath, newname, LXC_TIMESTAMP_FNAME);
4206 if (ret < 0)
4207 return -1;
4208 f = fopen(dfnam, "we");
4209 if (!f) {
4210 ERROR("Failed to open %s", dfnam);
4211 return -1;
4212 }
4213
4214 if (fprintf(f, "%s", buffer) < 0) {
4215 SYSERROR("Writing timestamp");
4216 fclose(f);
4217 return -1;
4218 }
4219
4220 ret = fclose(f);
4221 if (ret != 0) {
4222 SYSERROR("Writing timestamp");
4223 return -1;
4224 }
4225
4226 if (commentfile) {
4227 __do_free char *path = NULL;
4228 /* $p / $name / comment \0 */
4229 len = strlen(snappath) + 1 + strlen(newname) + 1 + strlen(LXC_COMMENT_FNAME) + 1;
4230
4231 path = must_realloc(NULL, len);
4232 ret = strnprintf(path, len, "%s/%s/%s", snappath, newname, LXC_COMMENT_FNAME);
4233 if (ret < 0)
4234 return -1;
4235 return copy_file(commentfile, path) < 0 ? -1 : i;
4236 }
4237
4238 return i;
4239 }
4240
4241 WRAP_API_1(int, lxcapi_snapshot, const char *)
4242
4243 static void lxcsnap_free(struct lxc_snapshot *s)
4244 {
4245 free(s->name);
4246 free(s->comment_pathname);
4247 free(s->timestamp);
4248 free(s->lxcpath);
4249 }
4250
4251 static char *get_snapcomment_path(char *snappath, char *name)
4252 {
4253 __do_free char *s = NULL;
4254 /* $snappath/$name/comment */
4255 int ret, len = strlen(snappath) + strlen(name) + 10;
4256
4257 s = malloc(len);
4258 if (!s)
4259 return NULL;
4260
4261 ret = strnprintf(s, len, "%s/%s/comment", snappath, name);
4262 if (ret < 0)
4263 return NULL;
4264
4265 return move_ptr(s);
4266 }
4267
4268 static char *get_timestamp(char* snappath, char *name)
4269 {
4270 __do_free char *s = NULL;
4271 __do_fclose FILE *fin = NULL;
4272 char path[PATH_MAX];
4273 int ret, len;
4274
4275 ret = strnprintf(path, sizeof(path), "%s/%s/ts", snappath, name);
4276 if (ret < 0)
4277 return NULL;
4278
4279 fin = fopen(path, "re");
4280 if (!fin)
4281 return NULL;
4282
4283 (void) fseek(fin, 0, SEEK_END);
4284 len = ftell(fin);
4285 (void) fseek(fin, 0, SEEK_SET);
4286 if (len > 0) {
4287 s = malloc(len+1);
4288 if (s) {
4289 ssize_t nbytes;
4290
4291 s[len] = '\0';
4292 nbytes = fread(s, 1, len, fin);
4293 if (nbytes < 0 || nbytes != (ssize_t)len)
4294 return log_error_errno(NULL, errno, "reading timestamp");
4295 }
4296 }
4297
4298 return move_ptr(s);
4299 }
4300
4301 static int do_lxcapi_snapshot_list(struct lxc_container *c, struct lxc_snapshot **ret_snaps)
4302 {
4303 __do_closedir DIR *dir = NULL;
4304 char snappath[PATH_MAX], path2[PATH_MAX];
4305 int count = 0, ret;
4306 struct dirent *direntp;
4307 struct lxc_snapshot *snaps =NULL, *nsnaps;
4308
4309 if (!c || !lxcapi_is_defined(c))
4310 return -1;
4311
4312 if (!get_snappath_dir(c, snappath)) {
4313 ERROR("path name too long");
4314 return -1;
4315 }
4316
4317 dir = opendir(snappath);
4318 if (!dir) {
4319 INFO("Failed to open %s - assuming no snapshots", snappath);
4320 return 0;
4321 }
4322
4323 while ((direntp = readdir(dir))) {
4324 if (strequal(direntp->d_name, "."))
4325 continue;
4326
4327 if (strequal(direntp->d_name, ".."))
4328 continue;
4329
4330 ret = strnprintf(path2, sizeof(path2), "%s/%s/%s", snappath, direntp->d_name, LXC_CONFIG_FNAME);
4331 if (ret < 0) {
4332 ERROR("pathname too long");
4333 goto out_free;
4334 }
4335
4336 if (!file_exists(path2))
4337 continue;
4338
4339 nsnaps = realloc(snaps, (count + 1)*sizeof(*snaps));
4340 if (!nsnaps) {
4341 SYSERROR("Out of memory");
4342 goto out_free;
4343 }
4344
4345 snaps = nsnaps;
4346 snaps[count].free = lxcsnap_free;
4347 snaps[count].name = strdup(direntp->d_name);
4348 if (!snaps[count].name)
4349 goto out_free;
4350
4351 snaps[count].lxcpath = strdup(snappath);
4352 if (!snaps[count].lxcpath) {
4353 free(snaps[count].name);
4354 goto out_free;
4355 }
4356
4357 snaps[count].comment_pathname = get_snapcomment_path(snappath, direntp->d_name);
4358 snaps[count].timestamp = get_timestamp(snappath, direntp->d_name);
4359 count++;
4360 }
4361
4362 *ret_snaps = snaps;
4363 return count;
4364
4365 out_free:
4366 if (snaps) {
4367 for (int i = 0; i < count; i++)
4368 lxcsnap_free(&snaps[i]);
4369
4370 free(snaps);
4371 }
4372
4373 return -1;
4374 }
4375
4376 WRAP_API_1(int, lxcapi_snapshot_list, struct lxc_snapshot **)
4377
4378 static bool do_lxcapi_snapshot_restore(struct lxc_container *c, const char *snapname, const char *newname)
4379 {
4380 char clonelxcpath[PATH_MAX];
4381 int flags = 0;
4382 struct lxc_container *snap, *rest;
4383 struct lxc_storage *bdev;
4384 bool b = false;
4385
4386 if (!c || !c->name || !c->config_path)
4387 return false;
4388
4389 if (has_fs_snapshots(c)) {
4390 ERROR("container rootfs has dependent snapshots");
4391 return false;
4392 }
4393
4394 if (lxc_storage_prepare(c->lxc_conf)) {
4395 ERROR("Failed to find original backing store type");
4396 return false;
4397 }
4398 bdev = c->lxc_conf->rootfs.storage;
4399
4400 /* For an overlay container the rootfs is considered immutable
4401 * and cannot be removed when restoring from a snapshot. We pass this
4402 * internal flag along to communicate this to various parts of the
4403 * codebase.
4404 */
4405 if (strequal(bdev->type, "overlay") || strequal(bdev->type, "overlayfs"))
4406 bdev->flags |= LXC_STORAGE_INTERNAL_OVERLAY_RESTORE;
4407
4408 if (!newname)
4409 newname = c->name;
4410
4411 if (!get_snappath_dir(c, clonelxcpath)) {
4412 lxc_storage_put(c->lxc_conf);
4413 return false;
4414 }
4415 /* how should we lock this? */
4416
4417 snap = lxc_container_new(snapname, clonelxcpath);
4418 if (!snap || !lxcapi_is_defined(snap)) {
4419 ERROR("Could not open snapshot %s", snapname);
4420
4421 if (snap)
4422 lxc_container_put(snap);
4423
4424 lxc_storage_put(c->lxc_conf);
4425 return false;
4426 }
4427
4428 if (strequal(c->name, newname)) {
4429 if (!container_destroy(c, bdev)) {
4430 ERROR("Could not destroy existing container %s", newname);
4431 lxc_container_put(snap);
4432 lxc_storage_put(c->lxc_conf);
4433 return false;
4434 }
4435 }
4436
4437 if (!strequal(bdev->type, "dir") && !strequal(bdev->type, "loop"))
4438 flags = LXC_CLONE_SNAPSHOT | LXC_CLONE_MAYBE_SNAPSHOT;
4439
4440 if (strequal(bdev->type, "overlay") || strequal(bdev->type, "overlayfs"))
4441 flags |= LXC_STORAGE_INTERNAL_OVERLAY_RESTORE;
4442
4443 rest = lxcapi_clone(snap, newname, c->config_path, flags, bdev->type,
4444 NULL, 0, NULL);
4445 lxc_storage_put(c->lxc_conf);
4446 if (rest && lxcapi_is_defined(rest))
4447 b = true;
4448
4449 if (rest)
4450 lxc_container_put(rest);
4451
4452 lxc_container_put(snap);
4453 return b;
4454 }
4455
4456 WRAP_API_2(bool, lxcapi_snapshot_restore, const char *, const char *)
4457
4458 static bool do_snapshot_destroy(const char *snapname, const char *clonelxcpath)
4459 {
4460 struct lxc_container *snap = NULL;
4461 bool bret = false;
4462
4463 snap = lxc_container_new(snapname, clonelxcpath);
4464 if (!snap) {
4465 ERROR("Could not find snapshot %s", snapname);
4466 goto err;
4467 }
4468
4469 if (!do_lxcapi_destroy(snap)) {
4470 ERROR("Could not destroy snapshot %s", snapname);
4471 goto err;
4472 }
4473
4474 bret = true;
4475
4476 err:
4477 if (snap)
4478 lxc_container_put(snap);
4479
4480 return bret;
4481 }
4482
4483 static bool remove_all_snapshots(const char *path)
4484 {
4485 __do_closedir DIR *dir = NULL;
4486 struct dirent *direntp;
4487 bool bret = true;
4488
4489 dir = opendir(path);
4490 if (!dir) {
4491 SYSERROR("opendir on snapshot path %s", path);
4492 return false;
4493 }
4494
4495 while ((direntp = readdir(dir))) {
4496 if (strequal(direntp->d_name, "."))
4497 continue;
4498
4499 if (strequal(direntp->d_name, ".."))
4500 continue;
4501
4502 if (!do_snapshot_destroy(direntp->d_name, path)) {
4503 bret = false;
4504 continue;
4505 }
4506 }
4507
4508 if (rmdir(path))
4509 SYSERROR("Error removing directory %s", path);
4510
4511 return bret;
4512 }
4513
4514 static bool do_lxcapi_snapshot_destroy(struct lxc_container *c, const char *snapname)
4515 {
4516 char clonelxcpath[PATH_MAX];
4517
4518 if (!c || !c->name || !c->config_path || !snapname)
4519 return false;
4520
4521 if (!get_snappath_dir(c, clonelxcpath))
4522 return false;
4523
4524 return do_snapshot_destroy(snapname, clonelxcpath);
4525 }
4526
4527 WRAP_API_1(bool, lxcapi_snapshot_destroy, const char *)
4528
4529 static bool do_lxcapi_snapshot_destroy_all(struct lxc_container *c)
4530 {
4531 char clonelxcpath[PATH_MAX];
4532
4533 if (!c || !c->name || !c->config_path)
4534 return false;
4535
4536 if (!get_snappath_dir(c, clonelxcpath))
4537 return false;
4538
4539 return remove_all_snapshots(clonelxcpath);
4540 }
4541
4542 WRAP_API(bool, lxcapi_snapshot_destroy_all)
4543
4544 static bool do_lxcapi_may_control(struct lxc_container *c)
4545 {
4546 if (!c)
4547 return false;
4548
4549 return lxc_try_cmd(c->name, c->config_path) == 0;
4550 }
4551
4552 WRAP_API(bool, lxcapi_may_control)
4553
4554 static bool do_add_remove_node(pid_t init_pid, const char *path, bool add,
4555 struct stat *st)
4556 {
4557 int ret;
4558 char *tmp;
4559 pid_t pid;
4560 char chrootpath[PATH_MAX];
4561 char *directory_path = NULL;
4562
4563 pid = fork();
4564 if (pid < 0) {
4565 SYSERROR("Failed to fork()");
4566 return false;
4567 }
4568
4569 if (pid) {
4570 ret = wait_for_pid(pid);
4571 if (ret != 0) {
4572 ERROR("Failed to create device node");
4573 return false;
4574 }
4575
4576 return true;
4577 }
4578
4579 /* prepare the path */
4580 ret = strnprintf(chrootpath, sizeof(chrootpath), "/proc/%d/root", init_pid);
4581 if (ret < 0)
4582 return false;
4583
4584 ret = chroot(chrootpath);
4585 if (ret < 0)
4586 _exit(EXIT_FAILURE);
4587
4588 ret = chdir("/");
4589 if (ret < 0)
4590 _exit(EXIT_FAILURE);
4591
4592 /* remove path if it exists */
4593 ret = faccessat(AT_FDCWD, path, F_OK, AT_SYMLINK_NOFOLLOW);
4594 if(ret == 0) {
4595 ret = unlink(path);
4596 if (ret < 0) {
4597 SYSERROR("Failed to remove \"%s\"", path);
4598 _exit(EXIT_FAILURE);
4599 }
4600 }
4601
4602 if (!add)
4603 _exit(EXIT_SUCCESS);
4604
4605 /* create any missing directories */
4606 tmp = strdup(path);
4607 if (!tmp)
4608 _exit(EXIT_FAILURE);
4609
4610 directory_path = dirname(tmp);
4611 ret = lxc_mkdir_p(directory_path, 0755);
4612 if (ret < 0 && errno != EEXIST) {
4613 SYSERROR("Failed to create path \"%s\"", directory_path);
4614 free(tmp);
4615 _exit(EXIT_FAILURE);
4616 }
4617
4618 /* create the device node */
4619 ret = mknod(path, st->st_mode, st->st_rdev);
4620 free(tmp);
4621 if (ret < 0) {
4622 SYSERROR("Failed to create device node at \"%s\"", path);
4623 _exit(EXIT_FAILURE);
4624 }
4625
4626 _exit(EXIT_SUCCESS);
4627 }
4628
4629 static bool add_remove_device_node(struct lxc_container *c, const char *src_path, const char *dest_path, bool add)
4630 {
4631 int ret;
4632 struct stat st;
4633 char value[LXC_MAX_BUFFER];
4634 const char *p;
4635 pid_t init_pid;
4636
4637 /* make sure container is running */
4638 if (!do_lxcapi_is_running(c)) {
4639 ERROR("container is not running");
4640 return false;
4641 }
4642
4643 /* use src_path if dest_path is NULL otherwise use dest_path */
4644 p = dest_path ? dest_path : src_path;
4645
4646 /* make sure we can access p */
4647 if(access(p, F_OK) < 0 || stat(p, &st) < 0)
4648 return false;
4649
4650 /* continue if path is character device or block device */
4651 if (S_ISCHR(st.st_mode))
4652 ret = strnprintf(value, sizeof(value), "c %d:%d rwm", major(st.st_rdev), minor(st.st_rdev));
4653 else if (S_ISBLK(st.st_mode))
4654 ret = strnprintf(value, sizeof(value), "b %d:%d rwm", major(st.st_rdev), minor(st.st_rdev));
4655 else
4656 return false;
4657 if (ret < 0)
4658 return false;
4659
4660 init_pid = do_lxcapi_init_pid(c);
4661 if (init_pid < 0) {
4662 ERROR("Failed to get init pid");
4663 return false;
4664 }
4665
4666 if (!do_add_remove_node(init_pid, p, add, &st))
4667 return false;
4668
4669 /* add or remove device to/from cgroup access list */
4670 if (add) {
4671 if (!do_lxcapi_set_cgroup_item(c, "devices.allow", value)) {
4672 ERROR("set_cgroup_item failed while adding the device node");
4673 return false;
4674 }
4675 } else {
4676 if (!do_lxcapi_set_cgroup_item(c, "devices.deny", value)) {
4677 ERROR("set_cgroup_item failed while removing the device node");
4678 return false;
4679 }
4680 }
4681
4682 return true;
4683 }
4684
4685 static bool do_lxcapi_add_device_node(struct lxc_container *c, const char *src_path, const char *dest_path)
4686 {
4687 // cannot mknod if we're not privileged wrt init_user_ns
4688 if (am_host_unpriv()) {
4689 ERROR(LXC_UNPRIV_EOPNOTSUPP, __FUNCTION__);
4690 return false;
4691 }
4692
4693 return add_remove_device_node(c, src_path, dest_path, true);
4694 }
4695
4696 WRAP_API_2(bool, lxcapi_add_device_node, const char *, const char *)
4697
4698 static bool do_lxcapi_remove_device_node(struct lxc_container *c, const char *src_path, const char *dest_path)
4699 {
4700 if (am_guest_unpriv()) {
4701 ERROR(LXC_UNPRIV_EOPNOTSUPP, __FUNCTION__);
4702 return false;
4703 }
4704
4705 return add_remove_device_node(c, src_path, dest_path, false);
4706 }
4707
4708 WRAP_API_2(bool, lxcapi_remove_device_node, const char *, const char *)
4709
4710 static bool do_lxcapi_attach_interface(struct lxc_container *c,
4711 const char *ifname,
4712 const char *dst_ifname)
4713 {
4714 pid_t init_pid;
4715 int ret = 0;
4716
4717 if (am_guest_unpriv()) {
4718 ERROR(LXC_UNPRIV_EOPNOTSUPP, __FUNCTION__);
4719 return false;
4720 }
4721
4722 if (!ifname) {
4723 ERROR("No source interface name given");
4724 return false;
4725 }
4726
4727 ret = lxc_netdev_isup(ifname);
4728 if (ret > 0) {
4729 /* netdev of ifname is up. */
4730 ret = lxc_netdev_down(ifname);
4731 if (ret)
4732 goto err;
4733 }
4734
4735 init_pid = do_lxcapi_init_pid(c);
4736 if (init_pid < 0) {
4737 ERROR("Failed to get init pid");
4738 goto err;
4739 }
4740
4741 ret = lxc_netdev_move_by_name(ifname, init_pid, dst_ifname);
4742 if (ret)
4743 goto err;
4744
4745 INFO("Moved network device \"%s\" to network namespace of %d", ifname, init_pid);
4746 return true;
4747
4748 err:
4749 return false;
4750 }
4751
4752 WRAP_API_2(bool, lxcapi_attach_interface, const char *, const char *)
4753
4754 static bool do_lxcapi_detach_interface(struct lxc_container *c,
4755 const char *ifname,
4756 const char *dst_ifname)
4757 {
4758 int ret;
4759 pid_t pid, pid_outside;
4760 __do_free char *physname = NULL;
4761
4762 /*
4763 * TODO - if this is a physical device, then we need am_host_unpriv.
4764 * But for other types guest privilege suffices.
4765 */
4766 if (am_guest_unpriv()) {
4767 ERROR(LXC_UNPRIV_EOPNOTSUPP, __FUNCTION__);
4768 return false;
4769 }
4770
4771 if (!ifname) {
4772 ERROR("No source interface name given");
4773 return false;
4774 }
4775
4776 pid_outside = lxc_raw_getpid();
4777 pid = fork();
4778 if (pid < 0) {
4779 ERROR("Failed to fork");
4780 return false;
4781 }
4782
4783 if (pid == 0) { /* child */
4784 pid_t init_pid;
4785
4786 init_pid = do_lxcapi_init_pid(c);
4787 if (init_pid < 0) {
4788 ERROR("Failed to get init pid");
4789 _exit(EXIT_FAILURE);
4790 }
4791 if (!switch_to_ns(init_pid, "net")) {
4792 ERROR("Failed to enter network namespace");
4793 _exit(EXIT_FAILURE);
4794 }
4795
4796 /* create new mount namespace for use with remounting /sys and is_wlan() below. */
4797 ret = unshare(CLONE_NEWNS);
4798 if (ret < 0) {
4799 ERROR("Failed to unshare mount namespace");
4800 _exit(EXIT_FAILURE);
4801 }
4802
4803 /* set / recursively as private so that mount propagation doesn't affect us. */
4804 if (mount(NULL, "/", NULL, MS_REC | MS_PRIVATE, 0) < 0) {
4805 ERROR("Failed to recursively set / as private in mount namespace");
4806 _exit(EXIT_FAILURE);
4807 }
4808
4809 ret = lxc_netdev_isup(ifname);
4810 if (ret < 0) {
4811 ERROR("Failed to determine whether network device \"%s\" is up", ifname);
4812 _exit(EXIT_FAILURE);
4813 }
4814
4815 /* netdev of ifname is up. */
4816 if (ret) {
4817 ret = lxc_netdev_down(ifname);
4818 if (ret) {
4819 ERROR("Failed to set network device \"%s\" down", ifname);
4820 _exit(EXIT_FAILURE);
4821 }
4822 }
4823
4824 /* remount /sys so is_wlan() can check if this device is a wlan device. */
4825 lxc_attach_remount_sys_proc();
4826 physname = is_wlan(ifname);
4827 if (physname)
4828 ret = lxc_netdev_move_wlan(physname, ifname, pid_outside, dst_ifname);
4829 else
4830 ret = lxc_netdev_move_by_name(ifname, pid_outside, dst_ifname);
4831
4832 /* -EINVAL means there is no netdev named as ifname. */
4833 if (ret < 0) {
4834 if (ret == -EINVAL)
4835 ERROR("Network device \"%s\" not found", ifname);
4836 else
4837 ERROR("Failed to remove network device \"%s\"", ifname);
4838
4839 _exit(EXIT_FAILURE);
4840 }
4841
4842 _exit(EXIT_SUCCESS);
4843 }
4844
4845 ret = wait_for_pid(pid);
4846 if (ret != 0)
4847 return false;
4848
4849 INFO("Moved network device \"%s\" to network namespace of %d", ifname, pid_outside);
4850 return true;
4851 }
4852
4853 WRAP_API_2(bool, lxcapi_detach_interface, const char *, const char *)
4854
4855 static int do_lxcapi_migrate(struct lxc_container *c, unsigned int cmd,
4856 struct migrate_opts *opts, unsigned int size)
4857 {
4858 int ret = -1;
4859 struct migrate_opts *valid_opts = opts;
4860 uint64_t features_to_check = 0;
4861
4862 /* If the caller has a bigger (newer) struct migrate_opts, let's make
4863 * sure that the stuff on the end is zero, i.e. that they didn't ask us
4864 * to do anything special.
4865 */
4866 if (size > sizeof(*opts)) {
4867 unsigned char *addr;
4868 unsigned char *end;
4869
4870 addr = (void *)opts + sizeof(*opts);
4871 end = (void *)opts + size;
4872
4873 for (; addr < end; addr++)
4874 if (*addr)
4875 return -E2BIG;
4876 }
4877
4878 /* If the caller has a smaller struct, let's zero out the end for them
4879 * so we don't accidentally use bits of it that they didn't know about
4880 * to initialize.
4881 */
4882 if (size < sizeof(*opts)) {
4883 valid_opts = malloc(sizeof(*opts));
4884 if (!valid_opts)
4885 return -ENOMEM;
4886
4887 memset(valid_opts, 0, sizeof(*opts));
4888 memcpy(valid_opts, opts, size);
4889 }
4890
4891 switch (cmd) {
4892 case MIGRATE_PRE_DUMP:
4893 if (!do_lxcapi_is_running(c)) {
4894 ERROR("container is not running");
4895 goto on_error;
4896 }
4897
4898 ret = !__criu_pre_dump(c, valid_opts);
4899 break;
4900 case MIGRATE_DUMP:
4901 if (!do_lxcapi_is_running(c)) {
4902 ERROR("container is not running");
4903 goto on_error;
4904 }
4905
4906 ret = !__criu_dump(c, valid_opts);
4907 break;
4908 case MIGRATE_RESTORE:
4909 if (do_lxcapi_is_running(c)) {
4910 ERROR("container is already running");
4911 goto on_error;
4912 }
4913
4914 ret = !__criu_restore(c, valid_opts);
4915 break;
4916 case MIGRATE_FEATURE_CHECK:
4917 features_to_check = valid_opts->features_to_check;
4918 ret = !__criu_check_feature(&features_to_check);
4919 if (ret) {
4920 /* Something went wrong. Let's let the caller
4921 * know which feature checks failed. */
4922 valid_opts->features_to_check = features_to_check;
4923 }
4924 break;
4925 default:
4926 ERROR("invalid migrate command %u", cmd);
4927 ret = -EINVAL;
4928 }
4929
4930 on_error:
4931 if (size < sizeof(*opts))
4932 free(valid_opts);
4933
4934 return ret;
4935 }
4936
4937 WRAP_API_3(int, lxcapi_migrate, unsigned int, struct migrate_opts *, unsigned int)
4938
4939 static bool do_lxcapi_checkpoint(struct lxc_container *c, char *directory, bool stop, bool verbose)
4940 {
4941 struct migrate_opts opts;
4942
4943 memset(&opts, 0, sizeof(opts));
4944
4945 opts.directory = directory;
4946 opts.stop = stop;
4947 opts.verbose = verbose;
4948
4949 return !do_lxcapi_migrate(c, MIGRATE_DUMP, &opts, sizeof(opts));
4950 }
4951
4952 WRAP_API_3(bool, lxcapi_checkpoint, char *, bool, bool)
4953
4954 static bool do_lxcapi_restore(struct lxc_container *c, char *directory, bool verbose)
4955 {
4956 struct migrate_opts opts;
4957
4958 memset(&opts, 0, sizeof(opts));
4959
4960 opts.directory = directory;
4961 opts.verbose = verbose;
4962
4963 return !do_lxcapi_migrate(c, MIGRATE_RESTORE, &opts, sizeof(opts));
4964 }
4965
4966 WRAP_API_2(bool, lxcapi_restore, char *, bool)
4967
4968 /* @st_mode is the st_mode field of the stat(source) return struct */
4969 static int create_mount_target(const char *dest, mode_t st_mode)
4970 {
4971 char *dirdup, *destdirname;
4972 int ret;
4973
4974 dirdup = strdup(dest);
4975 if (!dirdup) {
4976 SYSERROR("Failed to duplicate target name \"%s\"", dest);
4977 return -1;
4978 }
4979 destdirname = dirname(dirdup);
4980
4981 ret = lxc_mkdir_p(destdirname, 0755);
4982 if (ret < 0) {
4983 SYSERROR("Failed to create \"%s\"", destdirname);
4984 free(dirdup);
4985 return ret;
4986 }
4987 free(dirdup);
4988
4989 (void)remove(dest);
4990
4991 if (S_ISDIR(st_mode))
4992 ret = mkdir(dest, 0000);
4993 else
4994 ret = mknod(dest, S_IFREG | 0000, 0);
4995
4996 if (ret == 0)
4997 TRACE("Created mount target \"%s\"", dest);
4998 else if (ret < 0 && errno != EEXIST) {
4999 SYSERROR("Failed to create mount target \"%s\"", dest);
5000 return -1;
5001 }
5002
5003 return 0;
5004 }
5005
5006 static int do_lxcapi_mount(struct lxc_container *c, const char *source,
5007 const char *target, const char *filesystemtype,
5008 unsigned long mountflags, const void *data,
5009 struct lxc_mount *mnt)
5010 {
5011 char *suff, *sret;
5012 char template[PATH_MAX], path[PATH_MAX];
5013 pid_t pid, init_pid;
5014 struct stat sb;
5015 bool lxc_is_dir;
5016 int ret = -1, fd = -EBADF;
5017
5018 if (!c || !c->lxc_conf) {
5019 ERROR("Container or configuration is NULL");
5020 return -EINVAL;
5021 }
5022
5023 if (!c->lxc_conf->shmount.path_host) {
5024 ERROR("Host path to shared mountpoint must be specified in the config\n");
5025 return -EINVAL;
5026 }
5027
5028 ret = strnprintf(template, sizeof(template), "%s/.lxcmount_XXXXXX", c->lxc_conf->shmount.path_host);
5029 if (ret < 0) {
5030 SYSERROR("Error writing shmounts tempdir name");
5031 goto out;
5032 }
5033
5034 /* Create a temporary file / dir under the shared mountpoint */
5035 if (!source || strequal(source, "")) {
5036 /* If source is not specified, maybe we want to mount a filesystem? */
5037 sb.st_mode = S_IFDIR;
5038 } else {
5039 ret = stat(source, &sb);
5040 if (ret < 0) {
5041 SYSERROR("Error getting stat info about the source \"%s\"", source);
5042 goto out;
5043 }
5044 }
5045
5046 lxc_is_dir = (S_ISDIR(sb.st_mode) != 0);
5047 if (lxc_is_dir) {
5048 sret = mkdtemp(template);
5049 if (!sret) {
5050 SYSERROR("Could not create shmounts temporary dir");
5051 goto out;
5052 }
5053 } else {
5054 fd = lxc_make_tmpfile(template, false);
5055 if (fd < 0) {
5056 SYSERROR("Could not create shmounts temporary file");
5057 goto out;
5058 }
5059 }
5060
5061 /* Do the fork */
5062 pid = fork();
5063 if (pid < 0) {
5064 SYSERROR("Could not fork");
5065 goto out;
5066 }
5067
5068 if (pid == 0) {
5069 /* Do the mount */
5070 ret = mount(source, template, filesystemtype, mountflags, data);
5071 if (ret < 0) {
5072 SYSERROR("Failed to mount onto \"%s\"", template);
5073 _exit(EXIT_FAILURE);
5074 }
5075 TRACE("Mounted \"%s\" onto \"%s\"", source, template);
5076
5077 init_pid = do_lxcapi_init_pid(c);
5078 if (init_pid < 0) {
5079 ERROR("Failed to obtain container's init pid");
5080 _exit(EXIT_FAILURE);
5081 }
5082
5083 /* Enter the container namespaces */
5084 if (!list_empty(&c->lxc_conf->id_map)) {
5085 if (!switch_to_ns(init_pid, "user")) {
5086 ERROR("Failed to enter user namespace");
5087 _exit(EXIT_FAILURE);
5088 }
5089
5090 if (!lxc_switch_uid_gid(0, 0))
5091 _exit(EXIT_FAILURE);
5092 }
5093
5094 if (!switch_to_ns(init_pid, "mnt")) {
5095 ERROR("Failed to enter mount namespace");
5096 _exit(EXIT_FAILURE);
5097 }
5098
5099 ret = create_mount_target(target, sb.st_mode);
5100 if (ret < 0)
5101 _exit(EXIT_FAILURE);
5102
5103 suff = strrchr(template, '/');
5104 if (!suff)
5105 goto cleanup_target_in_child;
5106
5107 ret = strnprintf(path, sizeof(path), "%s%s", c->lxc_conf->shmount.path_cont, suff);
5108 if (ret < 0) {
5109 SYSERROR("Error writing container mountpoint name");
5110 goto cleanup_target_in_child;
5111 }
5112
5113 ret = mount(path, target, NULL, MS_MOVE | MS_REC, NULL);
5114 if (ret < 0) {
5115 SYSERROR("Failed to move the mount from \"%s\" to \"%s\"", path, target);
5116 goto cleanup_target_in_child;
5117 }
5118 TRACE("Moved mount from \"%s\" to \"%s\"", path, target);
5119
5120 _exit(EXIT_SUCCESS);
5121
5122 cleanup_target_in_child:
5123 (void)remove(target);
5124 _exit(EXIT_FAILURE);
5125 }
5126
5127 ret = wait_for_pid(pid);
5128 if (ret < 0)
5129 SYSERROR("Wait for the child with pid %ld failed", (long)pid);
5130 else
5131 ret = 0;
5132
5133 if (umount2(template, MNT_DETACH))
5134 SYSWARN("Failed to remove temporary mount \"%s\"", template);
5135
5136 if (lxc_is_dir)
5137 (void)rmdir(template);
5138 else
5139 (void)unlink(template);
5140
5141 out:
5142 if (fd >= 0)
5143 close(fd);
5144
5145 return ret;
5146 }
5147
5148 WRAP_API_6(int, lxcapi_mount, const char *, const char *, const char *,
5149 unsigned long, const void *, struct lxc_mount *)
5150
5151 static int do_lxcapi_umount(struct lxc_container *c, const char *target,
5152 unsigned long flags, struct lxc_mount *mnt)
5153 {
5154 pid_t pid, init_pid;
5155 int ret = -1;
5156
5157 if (!c || !c->lxc_conf) {
5158 ERROR("Container or configuration is NULL");
5159 return -EINVAL;
5160 }
5161
5162 /* Do the fork */
5163 pid = fork();
5164 if (pid < 0) {
5165 SYSERROR("Could not fork");
5166 return -1;
5167 }
5168
5169 if (pid == 0) {
5170 init_pid = do_lxcapi_init_pid(c);
5171 if (init_pid < 0) {
5172 ERROR("Failed to obtain container's init pid");
5173 _exit(EXIT_FAILURE);
5174 }
5175
5176 /* Enter the container namespaces */
5177 if (!list_empty(&c->lxc_conf->id_map)) {
5178 if (!switch_to_ns(init_pid, "user")) {
5179 ERROR("Failed to enter user namespace");
5180 _exit(EXIT_FAILURE);
5181 }
5182 }
5183
5184 if (!switch_to_ns(init_pid, "mnt")) {
5185 ERROR("Failed to enter mount namespace");
5186 _exit(EXIT_FAILURE);
5187 }
5188
5189 /* Do the unmount */
5190 ret = umount2(target, flags);
5191 if (ret < 0) {
5192 SYSERROR("Failed to umount \"%s\"", target);
5193 _exit(EXIT_FAILURE);
5194 }
5195
5196 _exit(EXIT_SUCCESS);
5197 }
5198
5199 ret = wait_for_pid(pid);
5200 if (ret < 0) {
5201 SYSERROR("Wait for the child with pid %ld failed", (long)pid);
5202 return -ret;
5203 }
5204
5205 return 0;
5206 }
5207
5208 WRAP_API_3(int, lxcapi_umount, const char *, unsigned long, struct lxc_mount*)
5209
5210 static int lxcapi_attach_run_waitl(struct lxc_container *c, lxc_attach_options_t *options, const char *program, const char *arg, ...)
5211 {
5212 va_list ap;
5213 const char **argv;
5214 int ret;
5215
5216 if (!c)
5217 return -1;
5218
5219 current_config = c->lxc_conf;
5220
5221 va_start(ap, arg);
5222 argv = lxc_va_arg_list_to_argv_const(ap, 1);
5223 va_end(ap);
5224
5225 if (!argv) {
5226 ERROR("Memory allocation error.");
5227 ret = -1;
5228 goto out;
5229 }
5230 argv[0] = arg;
5231
5232 ret = do_lxcapi_attach_run_wait(c, options, program, (const char * const *)argv);
5233 free((void*)argv);
5234
5235 out:
5236 current_config = NULL;
5237 return ret;
5238 }
5239
5240 static int do_lxcapi_seccomp_notify_fd(struct lxc_container *c)
5241 {
5242 if (!c || !c->lxc_conf)
5243 return ret_set_errno(-1, -EINVAL);
5244
5245 return lxc_seccomp_get_notify_fd(&c->lxc_conf->seccomp);
5246 }
5247
5248 WRAP_API(int, lxcapi_seccomp_notify_fd)
5249
5250 static int do_lxcapi_seccomp_notify_fd_active(struct lxc_container *c)
5251 {
5252 if (!c || !c->lxc_conf)
5253 return ret_set_errno(-1, -EINVAL);
5254
5255 return lxc_cmd_get_seccomp_notify_fd(c->name, c->config_path);
5256 }
5257
5258 WRAP_API(int, lxcapi_seccomp_notify_fd_active)
5259
5260 struct lxc_container *lxc_container_new(const char *name, const char *configpath)
5261 {
5262 struct lxc_container *c;
5263 size_t len;
5264 int rc;
5265
5266 if (!name)
5267 return NULL;
5268
5269 c = malloc(sizeof(*c));
5270 if (!c) {
5271 fprintf(stderr, "Failed to allocate memory for %s\n", name);
5272 return NULL;
5273 }
5274 memset(c, 0, sizeof(*c));
5275
5276 if (configpath)
5277 c->config_path = strdup(configpath);
5278 else
5279 c->config_path = strdup(lxc_global_config_value("lxc.lxcpath"));
5280 if (!c->config_path) {
5281 fprintf(stderr, "Failed to allocate memory for %s\n", name);
5282 goto err;
5283 }
5284
5285 remove_trailing_slashes(c->config_path);
5286
5287 len = strlen(name);
5288 c->name = malloc(len + 1);
5289 if (!c->name) {
5290 fprintf(stderr, "Failed to allocate memory for %s\n", name);
5291 goto err;
5292 }
5293 (void)strlcpy(c->name, name, len + 1);
5294
5295 c->numthreads = 1;
5296 c->slock = lxc_newlock(c->config_path, name);
5297 if (!c->slock) {
5298 fprintf(stderr, "Failed to create lock for %s\n", name);
5299 goto err;
5300 }
5301
5302 c->privlock = lxc_newlock(NULL, NULL);
5303 if (!c->privlock) {
5304 fprintf(stderr, "Failed to create private lock for %s\n", name);
5305 goto err;
5306 }
5307
5308 if (!set_config_filename(c)) {
5309 fprintf(stderr, "Failed to create config file name for %s\n", name);
5310 goto err;
5311 }
5312
5313 if (file_exists(c->configfile) && !lxcapi_load_config(c, NULL)) {
5314 fprintf(stderr, "Failed to load config for %s\n", name);
5315 goto err;
5316 }
5317
5318 rc = ongoing_create(c);
5319 switch (rc) {
5320 case LXC_CREATE_INCOMPLETE:
5321 SYSERROR("Failed to complete container creation for %s", c->name);
5322 container_destroy(c, NULL);
5323 lxcapi_clear_config(c);
5324 break;
5325 case LXC_CREATE_ONGOING:
5326 /* container creation going on */
5327 break;
5328 case LXC_CREATE_FAILED:
5329 /* container creation failed */
5330 if (errno != EACCES && errno != EPERM) {
5331 /* insufficient privileges */
5332 SYSERROR("Failed checking for incomplete container %s creation", c->name);
5333 goto err;
5334 }
5335 break;
5336 }
5337
5338 c->daemonize = true;
5339 c->pidfile = NULL;
5340
5341 /* Assign the member functions. */
5342 c->is_defined = lxcapi_is_defined;
5343 c->state = lxcapi_state;
5344 c->is_running = lxcapi_is_running;
5345 c->freeze = lxcapi_freeze;
5346 c->unfreeze = lxcapi_unfreeze;
5347 c->console = lxcapi_console;
5348 c->console_getfd = lxcapi_console_getfd;
5349 c->devpts_fd = lxcapi_devpts_fd;
5350 c->init_pid = lxcapi_init_pid;
5351 c->init_pidfd = lxcapi_init_pidfd;
5352 c->load_config = lxcapi_load_config;
5353 c->want_daemonize = lxcapi_want_daemonize;
5354 c->want_close_all_fds = lxcapi_want_close_all_fds;
5355 c->start = lxcapi_start;
5356 c->startl = lxcapi_startl;
5357 c->stop = lxcapi_stop;
5358 c->config_file_name = lxcapi_config_file_name;
5359 c->wait = lxcapi_wait;
5360 c->set_config_item = lxcapi_set_config_item;
5361 c->destroy = lxcapi_destroy;
5362 c->destroy_with_snapshots = lxcapi_destroy_with_snapshots;
5363 c->rename = lxcapi_rename;
5364 c->save_config = lxcapi_save_config;
5365 c->get_keys = lxcapi_get_keys;
5366 c->create = lxcapi_create;
5367 c->createl = lxcapi_createl;
5368 c->shutdown = lxcapi_shutdown;
5369 c->reboot = lxcapi_reboot;
5370 c->reboot2 = lxcapi_reboot2;
5371 c->clear_config = lxcapi_clear_config;
5372 c->clear_config_item = lxcapi_clear_config_item;
5373 c->get_config_item = lxcapi_get_config_item;
5374 c->get_running_config_item = lxcapi_get_running_config_item;
5375 c->get_cgroup_item = lxcapi_get_cgroup_item;
5376 c->set_cgroup_item = lxcapi_set_cgroup_item;
5377 c->get_config_path = lxcapi_get_config_path;
5378 c->set_config_path = lxcapi_set_config_path;
5379 c->clone = lxcapi_clone;
5380 c->get_interfaces = lxcapi_get_interfaces;
5381 c->get_ips = lxcapi_get_ips;
5382 c->attach = lxcapi_attach;
5383 c->attach_run_wait = lxcapi_attach_run_wait;
5384 c->attach_run_waitl = lxcapi_attach_run_waitl;
5385 c->snapshot = lxcapi_snapshot;
5386 c->snapshot_list = lxcapi_snapshot_list;
5387 c->snapshot_restore = lxcapi_snapshot_restore;
5388 c->snapshot_destroy = lxcapi_snapshot_destroy;
5389 c->snapshot_destroy_all = lxcapi_snapshot_destroy_all;
5390 c->may_control = lxcapi_may_control;
5391 c->add_device_node = lxcapi_add_device_node;
5392 c->remove_device_node = lxcapi_remove_device_node;
5393 c->attach_interface = lxcapi_attach_interface;
5394 c->detach_interface = lxcapi_detach_interface;
5395 c->checkpoint = lxcapi_checkpoint;
5396 c->restore = lxcapi_restore;
5397 c->migrate = lxcapi_migrate;
5398 c->console_log = lxcapi_console_log;
5399 c->mount = lxcapi_mount;
5400 c->umount = lxcapi_umount;
5401 c->seccomp_notify_fd = lxcapi_seccomp_notify_fd;
5402 c->seccomp_notify_fd_active = lxcapi_seccomp_notify_fd_active;
5403
5404 return c;
5405
5406 err:
5407 lxc_container_free(c);
5408 return NULL;
5409 }
5410
5411 int lxc_get_wait_states(const char **states)
5412 {
5413 int i;
5414
5415 if (states)
5416 for (i=0; i<MAX_STATE; i++)
5417 states[i] = lxc_state2str(i);
5418
5419 return MAX_STATE;
5420 }
5421
5422 /*
5423 * These next two could probably be done smarter with reusing a common function
5424 * with different iterators and tests...
5425 */
5426 int list_defined_containers(const char *lxcpath, char ***names,
5427 struct lxc_container ***cret)
5428 {
5429 __do_closedir DIR *dir = NULL;
5430 size_t array_len = 0, name_array_len = 0, ct_array_len = 0;
5431 struct dirent *direntp;
5432 struct lxc_container *c;
5433
5434 if (!lxcpath)
5435 lxcpath = lxc_global_config_value("lxc.lxcpath");
5436
5437 dir = opendir(lxcpath);
5438 if (!dir) {
5439 SYSERROR("opendir on lxcpath");
5440 return -1;
5441 }
5442
5443 if (cret)
5444 *cret = NULL;
5445
5446 if (names)
5447 *names = NULL;
5448
5449 while ((direntp = readdir(dir))) {
5450 /* Ignore '.', '..' and any hidden directory. */
5451 if (strnequal(direntp->d_name, ".", 1))
5452 continue;
5453
5454 if (!config_file_exists(lxcpath, direntp->d_name))
5455 continue;
5456
5457 if (cret) {
5458 c = lxc_container_new(direntp->d_name, lxcpath);
5459 if (!c) {
5460 INFO("Container %s:%s has a config but could not be loaded",
5461 lxcpath, direntp->d_name);
5462 continue;
5463 }
5464
5465 if (!do_lxcapi_is_defined(c)) {
5466 INFO("Container %s:%s has a config but is not defined",
5467 lxcpath, direntp->d_name);
5468
5469 lxc_container_put(c);
5470 continue;
5471 }
5472 }
5473
5474 if (names) {
5475 if (!add_to_array(names, direntp->d_name, array_len))
5476 goto free_bad;
5477 name_array_len++;
5478 }
5479
5480 if (cret) {
5481 if (!add_to_clist(cret, c, array_len, true)) {
5482 lxc_container_put(c);
5483 goto free_bad;
5484 }
5485 ct_array_len++;
5486 }
5487
5488 array_len++;
5489 }
5490
5491 return array_len;
5492
5493 free_bad:
5494 if (names && *names) {
5495 for (size_t i = 0; i < name_array_len; i++)
5496 free((*names)[i]);
5497 free(*names);
5498 }
5499
5500 if (cret && *cret) {
5501 for (size_t i = 0; i < ct_array_len; i++)
5502 lxc_container_put((*cret)[i]);
5503 free(*cret);
5504 }
5505
5506 return -1;
5507 }
5508
5509 int list_active_containers(const char *lxcpath, char ***nret,
5510 struct lxc_container ***cret)
5511 {
5512 __do_free char *line = NULL;
5513 __do_fclose FILE *f = NULL;
5514 int i, ret = -1, cret_cnt = 0, ct_name_cnt = 0;
5515 int lxcpath_len;
5516 char **ct_name = NULL;
5517 size_t len = 0;
5518 struct lxc_container *c = NULL;
5519 bool is_hashed;
5520
5521 if (!lxcpath)
5522 lxcpath = lxc_global_config_value("lxc.lxcpath");
5523 lxcpath_len = strlen(lxcpath);
5524
5525 if (cret)
5526 *cret = NULL;
5527
5528 if (nret)
5529 *nret = NULL;
5530
5531 f = fopen("/proc/net/unix", "re");
5532 if (!f)
5533 return -1;
5534
5535 while (getline(&line, &len, f) != -1) {
5536 char *p = strrchr(line, ' '), *p2;
5537 if (!p)
5538 continue;
5539 p++;
5540
5541 if (*p != 0x40)
5542 continue;
5543 p++;
5544
5545 is_hashed = false;
5546
5547 if (strnequal(p, lxcpath, lxcpath_len)) {
5548 p += lxcpath_len;
5549 } else if (strnequal(p, "lxc/", 4)) {
5550 p += 4;
5551 is_hashed = true;
5552 } else {
5553 continue;
5554 }
5555
5556 while (*p == '/')
5557 p++;
5558
5559 /* Now p is the start of lxc_name. */
5560 p2 = strchr(p, '/');
5561 if (!p2 || !strnequal(p2, "/command", 8))
5562 continue;
5563 *p2 = '\0';
5564
5565 if (is_hashed) {
5566 char *recvpath = lxc_cmd_get_lxcpath(p);
5567 if (!recvpath)
5568 continue;
5569
5570 if (!strnequal(lxcpath, recvpath, lxcpath_len)) {
5571 free(recvpath);
5572 continue;
5573 }
5574 free(recvpath);
5575
5576 p = lxc_cmd_get_name(p);
5577 if (!p)
5578 continue;
5579 }
5580
5581 if (array_contains(&ct_name, p, ct_name_cnt)) {
5582 if (is_hashed)
5583 free(p);
5584 continue;
5585 }
5586
5587 if (!add_to_array(&ct_name, p, ct_name_cnt)) {
5588 if (is_hashed)
5589 free(p);
5590 goto free_cret_list;
5591 }
5592
5593 ct_name_cnt++;
5594
5595 if (!cret) {
5596 if (is_hashed)
5597 free(p);
5598 continue;
5599 }
5600
5601 c = lxc_container_new(p, lxcpath);
5602 if (!c) {
5603 INFO("Container %s:%s is running but could not be loaded", lxcpath, p);
5604 if (is_hashed)
5605 free(p);
5606
5607 goto free_cret_list;
5608 }
5609
5610 if (is_hashed)
5611 free(p);
5612
5613 /*
5614 * If this is an anonymous container, then is_defined *can*
5615 * return false. So we don't do that check. Count on the
5616 * fact that the command socket exists.
5617 */
5618
5619 if (!add_to_clist(cret, c, cret_cnt, true)) {
5620 lxc_container_put(c);
5621 goto free_cret_list;
5622 }
5623
5624 cret_cnt++;
5625 }
5626
5627 if (nret && cret && cret_cnt != ct_name_cnt) {
5628 if (c)
5629 lxc_container_put(c);
5630 goto free_cret_list;
5631 }
5632
5633 ret = ct_name_cnt;
5634 if (nret)
5635 *nret = ct_name;
5636 else
5637 goto free_ct_name;
5638
5639 goto out;
5640
5641 free_cret_list:
5642 if (cret && *cret) {
5643 for (i = 0; i < cret_cnt; i++)
5644 lxc_container_put((*cret)[i]);
5645 free(*cret);
5646 }
5647
5648 free_ct_name:
5649 if (ct_name) {
5650 for (i = 0; i < ct_name_cnt; i++)
5651 free(ct_name[i]);
5652 free(ct_name);
5653 }
5654
5655 out:
5656 return ret;
5657 }
5658
5659 int list_all_containers(const char *lxcpath, char ***nret,
5660 struct lxc_container ***cret)
5661 {
5662 int active_cnt, ct_cnt, ct_list_cnt, ret;
5663 char **active_name = NULL, **ct_name = NULL;
5664 struct lxc_container **ct_list = NULL;
5665
5666 ct_cnt = list_defined_containers(lxcpath, &ct_name, NULL);
5667 if (ct_cnt < 0)
5668 return ct_cnt;
5669
5670 active_cnt = list_active_containers(lxcpath, &active_name, NULL);
5671 if (active_cnt < 0) {
5672 ret = active_cnt;
5673 goto free_ct_name;
5674 }
5675
5676 ret = -EINVAL;
5677 for (int i = 0; i < active_cnt; i++) {
5678 if (array_contains(&ct_name, active_name[i], ct_cnt))
5679 continue;
5680
5681 if (!add_to_array(&ct_name, active_name[i], ct_cnt))
5682 goto free_active_name;
5683
5684 ct_cnt++;
5685 }
5686
5687 if (cret) {
5688 ct_list_cnt = 0;
5689 for (int i = 0; i < ct_cnt; i++) {
5690 __put_lxc_container struct lxc_container *c = NULL;
5691
5692 c = lxc_container_new(ct_name[i], lxcpath);
5693 if (!c) {
5694 WARN("Container %s:%s could not be loaded", lxcpath, ct_name[i]);
5695 goto free_ct_list;
5696 }
5697
5698 if (!add_to_clist(&ct_list, c, ct_list_cnt, false))
5699 goto free_ct_list;
5700
5701 ct_list_cnt++;
5702 move_ptr(c);
5703 }
5704
5705 *cret = ct_list;
5706 }
5707
5708 for (int i = 0; i < active_cnt; i++)
5709 free(active_name[i]);
5710 free(active_name);
5711
5712 if (nret) {
5713 *nret = ct_name;
5714 } else {
5715 for (int i = 0; i < ct_cnt; i++)
5716 free(ct_name[i]);
5717 free(ct_name);
5718 }
5719
5720 return ct_cnt;
5721
5722 free_ct_list:
5723 for (int i = 0; i < ct_list_cnt; i++)
5724 lxc_container_put(ct_list[i]);
5725 free(ct_list);
5726
5727 free_active_name:
5728 for (int i = 0; i < active_cnt; i++)
5729 free(active_name[i]);
5730 free(active_name);
5731
5732 free_ct_name:
5733 for (int i = 0; i < ct_cnt; i++)
5734 free(ct_name[i]);
5735 free(ct_name);
5736
5737 return ret;
5738 }
5739
5740 bool lxc_config_item_is_supported(const char *key)
5741 {
5742 return !!lxc_get_config_exact(key);
5743 }
5744
5745 bool lxc_has_api_extension(const char *extension)
5746 {
5747 /* The NULL API extension is always present. :) */
5748 if (!extension)
5749 return true;
5750
5751 for (size_t i = 0; i < nr_api_extensions; i++)
5752 if (strequal(api_extensions[i], extension))
5753 return true;
5754
5755 return false;
5756 }
LXC mirror