src/lxc/start.c

   1 /*
   2  * lxc: linux Container library
   3  *
   4  * (C) Copyright IBM Corp. 2007, 2008
   5  *
   6  * Authors:
   7  * Daniel Lezcano <dlezcano at fr.ibm.com>
   8  *
   9  * This library is free software; you can redistribute it and/or
  10  * modify it under the terms of the GNU Lesser General Public
  11  * License as published by the Free Software Foundation; either
  12  * version 2.1 of the License, or (at your option) any later version.
  13  *
  14  * This library is distributed in the hope that it will be useful,
  15  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  16  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  17  * Lesser General Public License for more details.
  18  *
  19  * You should have received a copy of the GNU Lesser General Public
  20  * License along with this library; if not, write to the Free Software
  21  * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
  22  */
  23
  24 #include "config.h"
  25
  26 #include <stdio.h>
  27 #undef _GNU_SOURCE
  28 #include <string.h>
  29 #include <stdlib.h>
  30 #include <dirent.h>
  31 #include <errno.h>
  32 #include <unistd.h>
  33 #include <signal.h>
  34 #include <fcntl.h>
  35 #include <termios.h>
  36 #include <sys/param.h>
  37 #include <sys/file.h>
  38 #include <sys/mount.h>
  39 #include <sys/stat.h>
  40 #include <sys/types.h>
  41 #include <sys/prctl.h>
  42 #include <sys/types.h>
  43 #include <sys/capability.h>
  44 #include <sys/wait.h>
  45 #include <sys/un.h>
  46 #include <sys/poll.h>
  47
  48 #ifdef HAVE_SYS_SIGNALFD_H
  49 #  include <sys/signalfd.h>
  50 #else
  51 /* assume kernel headers are too old */
  52 #include <stdint.h>
  53 struct signalfd_siginfo
  54 {
  55         uint32_t ssi_signo;
  56         int32_t ssi_errno;
  57         int32_t ssi_code;
  58         uint32_t ssi_pid;
  59         uint32_t ssi_uid;
  60         int32_t ssi_fd;
  61         uint32_t ssi_tid;
  62         uint32_t ssi_band;
  63         uint32_t ssi_overrun;
  64         uint32_t ssi_trapno;
  65         int32_t ssi_status;
  66         int32_t ssi_int;
  67         uint64_t ssi_ptr;
  68         uint64_t ssi_utime;
  69         uint64_t ssi_stime;
  70         uint64_t ssi_addr;
  71         uint8_t __pad[48];
  72 };
  73
  74 #  ifndef __NR_signalfd4
  75 /* assume kernel headers are too old */
  76 #    if __i386__
  77 #      define __NR_signalfd4 327
  78 #    elif __x86_64__
  79 #      define __NR_signalfd4 289
  80 #    elif __powerpc__
  81 #      define __NR_signalfd4 313
  82 #    elif __s390x__
  83 #      define __NR_signalfd4 322
  84 #    endif
  85 #endif
  86
  87 #  ifndef __NR_signalfd
  88 /* assume kernel headers are too old */
  89 #    if __i386__
  90 #      define __NR_signalfd 321
  91 #    elif __x86_64__
  92 #      define __NR_signalfd 282
  93 #    elif __powerpc__
  94 #      define __NR_signalfd 305
  95 #    elif __s390x__
  96 #      define __NR_signalfd 316
  97 #    endif
  98 #endif
  99
 100 int signalfd(int fd, const sigset_t *mask, int flags)
 101 {
 102         int retval;
 103
 104         retval = syscall (__NR_signalfd4, fd, mask, _NSIG / 8, flags);
 105         if (errno == ENOSYS && flags == 0)
 106                 retval = syscall (__NR_signalfd, fd, mask, _NSIG / 8);
 107         return retval;
 108 }
 109 #endif
 110
 111 #if !HAVE_DECL_PR_CAPBSET_DROP
 112 #define PR_CAPBSET_DROP 24
 113 #endif
 114
 115 #include "start.h"
 116 #include "conf.h"
 117 #include "log.h"
 118 #include "cgroup.h"
 119 #include "error.h"
 120 #include "af_unix.h"
 121 #include "mainloop.h"
 122 #include "utils.h"
 123 #include "utmp.h"
 124 #include "monitor.h"
 125 #include "commands.h"
 126 #include "console.h"
 127 #include "sync.h"
 128 #include "namespace.h"
 129 #include "apparmor.h"
 130 #include "lxcseccomp.h"
 131
 132 lxc_log_define(lxc_start, lxc);
 133
 134 static int match_fd(int fd)
 135 {
 136         return (fd == 0 || fd == 1 || fd == 2);
 137 }
 138
 139 int lxc_check_inherited(struct lxc_conf *conf, int fd_to_ignore)
 140 {
 141         struct dirent dirent, *direntp;
 142         int fd, fddir;
 143         DIR *dir;
 144
 145 restart:
 146         dir = opendir("/proc/self/fd");
 147         if (!dir) {
 148                 WARN("failed to open directory: %m");
 149                 return -1;
 150         }
 151
 152         fddir = dirfd(dir);
 153
 154         while (!readdir_r(dir, &dirent, &direntp)) {
 155                 if (!direntp)
 156                         break;
 157
 158                 if (!strcmp(direntp->d_name, "."))
 159                         continue;
 160
 161                 if (!strcmp(direntp->d_name, ".."))
 162                         continue;
 163
 164                 fd = atoi(direntp->d_name);
 165
 166                 if (fd == fddir || fd == lxc_log_fd || fd == fd_to_ignore)
 167                         continue;
 168
 169                 if (match_fd(fd))
 170                         continue;
 171
 172                 if (conf->close_all_fds) {
 173                         close(fd);
 174                         closedir(dir);
 175                         INFO("closed inherited fd %d", fd);
 176                         goto restart;
 177                 }
 178                 WARN("inherited fd %d", fd);
 179         }
 180
 181         closedir(dir); /* cannot fail */
 182         return 0;
 183 }
 184
 185 static int setup_signal_fd(sigset_t *oldmask)
 186 {
 187         sigset_t mask;
 188         int fd;
 189
 190         /* Block everything except serious error signals */
 191         if (sigfillset(&mask) ||
 192             sigdelset(&mask, SIGILL) ||
 193             sigdelset(&mask, SIGSEGV) ||
 194             sigdelset(&mask, SIGBUS) ||
 195             sigprocmask(SIG_BLOCK, &mask, oldmask)) {
 196                 SYSERROR("failed to set signal mask");
 197                 return -1;
 198         }
 199
 200         fd = signalfd(-1, &mask, 0);
 201         if (fd < 0) {
 202                 SYSERROR("failed to create the signal fd");
 203                 return -1;
 204         }
 205
 206         if (fcntl(fd, F_SETFD, FD_CLOEXEC)) {
 207                 SYSERROR("failed to set sigfd to close-on-exec");
 208                 close(fd);
 209                 return -1;
 210         }
 211
 212         DEBUG("sigchild handler set");
 213
 214         return fd;
 215 }
 216
 217 static int signal_handler(int fd, void *data,
 218                            struct lxc_epoll_descr *descr)
 219 {
 220         struct signalfd_siginfo siginfo;
 221         int ret;
 222         pid_t *pid = data;
 223
 224         ret = read(fd, &siginfo, sizeof(siginfo));
 225         if (ret < 0) {
 226                 ERROR("failed to read signal info");
 227                 return -1;
 228         }
 229
 230         if (ret != sizeof(siginfo)) {
 231                 ERROR("unexpected siginfo size");
 232                 return -1;
 233         }
 234
 235         if (siginfo.ssi_signo != SIGCHLD) {
 236                 kill(*pid, siginfo.ssi_signo);
 237                 INFO("forwarded signal %d to pid %d", siginfo.ssi_signo, *pid);
 238                 return 0;
 239         }
 240
 241         if (siginfo.ssi_code == CLD_STOPPED ||
 242             siginfo.ssi_code == CLD_CONTINUED) {
 243                 INFO("container init process was stopped/continued");
 244                 return 0;
 245         }
 246
 247         /* more robustness, protect ourself from a SIGCHLD sent
 248          * by a process different from the container init
 249          */
 250         if (siginfo.ssi_pid != *pid) {
 251                 WARN("invalid pid for SIGCHLD");
 252                 return 0;
 253         }
 254
 255         DEBUG("container init process exited");
 256         return 1;
 257 }
 258
 259 int lxc_pid_callback(int fd, struct lxc_request *request,
 260                      struct lxc_handler *handler)
 261 {
 262         struct lxc_answer answer;
 263         int ret;
 264
 265         answer.pid = handler->pid;
 266         answer.ret = 0;
 267
 268         ret = send(fd, &answer, sizeof(answer), 0);
 269         if (ret < 0) {
 270                 WARN("failed to send answer to the peer");
 271                 return -1;
 272         }
 273
 274         if (ret != sizeof(answer)) {
 275                 ERROR("partial answer sent");
 276                 return -1;
 277         }
 278
 279         return 0;
 280 }
 281
 282 int lxc_clone_flags_callback(int fd, struct lxc_request *request,
 283                              struct lxc_handler *handler)
 284 {
 285         struct lxc_answer answer;
 286         int ret;
 287
 288         answer.pid = 0;
 289         answer.ret = handler->clone_flags;
 290
 291         ret = send(fd, &answer, sizeof(answer), 0);
 292         if (ret < 0) {
 293                 WARN("failed to send answer to the peer");
 294                 return -1;
 295         }
 296
 297         if (ret != sizeof(answer)) {
 298                 ERROR("partial answer sent");
 299                 return -1;
 300         }
 301
 302         return 0;
 303 }
 304
 305 int lxc_set_state(const char *name, struct lxc_handler *handler, lxc_state_t state)
 306 {
 307         handler->state = state;
 308         lxc_monitor_send_state(name, state);
 309         return 0;
 310 }
 311
 312 int lxc_poll(const char *name, struct lxc_handler *handler)
 313 {
 314         int sigfd = handler->sigfd;
 315         int pid = handler->pid;
 316         struct lxc_epoll_descr descr;
 317
 318         if (lxc_mainloop_open(&descr)) {
 319                 ERROR("failed to create mainloop");
 320                 goto out_sigfd;
 321         }
 322
 323         if (lxc_mainloop_add_handler(&descr, sigfd, signal_handler, &pid)) {
 324                 ERROR("failed to add handler for the signal");
 325                 goto out_mainloop_open;
 326         }
 327
 328         if (lxc_console_mainloop_add(&descr, handler)) {
 329                 ERROR("failed to add console handler to mainloop");
 330                 goto out_mainloop_open;
 331         }
 332
 333         if (lxc_command_mainloop_add(name, &descr, handler)) {
 334                 ERROR("failed to add command handler to mainloop");
 335                 goto out_mainloop_open;
 336         }
 337
 338         if (handler->conf->need_utmp_watch) {
 339                 if (lxc_utmp_mainloop_add(&descr, handler)) {
 340                         ERROR("failed to add utmp handler to mainloop");
 341                         goto out_mainloop_open;
 342                 }
 343         }
 344
 345         return lxc_mainloop(&descr);
 346
 347 out_mainloop_open:
 348         lxc_mainloop_close(&descr);
 349 out_sigfd:
 350         close(sigfd);
 351         return -1;
 352 }
 353
 354 extern int lxc_caps_check(void);
 355
 356 struct lxc_handler *lxc_init(const char *name, struct lxc_conf *conf)
 357 {
 358         struct lxc_handler *handler;
 359
 360         if (!lxc_caps_check()) {
 361                 ERROR("Not running with sufficient privilege");
 362                 return NULL;
 363         }
 364
 365         handler = malloc(sizeof(*handler));
 366         if (!handler)
 367                 return NULL;
 368
 369         memset(handler, 0, sizeof(*handler));
 370
 371         handler->conf = conf;
 372
 373         apparmor_handler_init(handler);
 374         handler->name = strdup(name);
 375         if (!handler->name) {
 376                 ERROR("failed to allocate memory");
 377                 goto out_free;
 378         }
 379
 380         if (lxc_command_init(name, handler))
 381                 goto out_free_name;
 382
 383         if (lxc_read_seccomp_config(conf) != 0) {
 384                 ERROR("failed loading seccomp policy");
 385                 goto out_close_maincmd_fd;
 386         }
 387
 388         /* Begin the set the state to STARTING*/
 389         if (lxc_set_state(name, handler, STARTING)) {
 390                 ERROR("failed to set state '%s'", lxc_state2str(STARTING));
 391                 goto out_free_name;
 392         }
 393
 394         if (run_lxc_hooks(name, "pre-start", conf)) {
 395                 ERROR("failed to run pre-start hooks for container '%s'.", name);
 396                 goto out_aborting;
 397         }
 398
 399         if (lxc_create_tty(name, conf)) {
 400                 ERROR("failed to create the ttys");
 401                 goto out_aborting;
 402         }
 403
 404         if (lxc_create_console(conf)) {
 405                 ERROR("failed to create console");
 406                 goto out_delete_tty;
 407         }
 408
 409         /* the signal fd has to be created before forking otherwise
 410          * if the child process exits before we setup the signal fd,
 411          * the event will be lost and the command will be stuck */
 412         handler->sigfd = setup_signal_fd(&handler->oldmask);
 413         if (handler->sigfd < 0) {
 414                 ERROR("failed to set sigchild fd handler");
 415                 goto out_delete_console;
 416         }
 417
 418         INFO("'%s' is initialized", name);
 419         return handler;
 420
 421 out_delete_console:
 422         lxc_delete_console(&conf->console);
 423 out_delete_tty:
 424         lxc_delete_tty(&conf->tty_info);
 425 out_aborting:
 426         lxc_set_state(name, handler, ABORTING);
 427 out_close_maincmd_fd:
 428         close(conf->maincmd_fd);
 429         conf->maincmd_fd = -1;
 430 out_free_name:
 431         free(handler->name);
 432         handler->name = NULL;
 433 out_free:
 434         free(handler);
 435         return NULL;
 436 }
 437
 438 void lxc_fini(const char *name, struct lxc_handler *handler)
 439 {
 440         /* The STOPPING state is there for future cleanup code
 441          * which can take awhile
 442          */
 443         lxc_set_state(name, handler, STOPPING);
 444         lxc_set_state(name, handler, STOPPED);
 445
 446         if (run_lxc_hooks(name, "post-stop", handler->conf))
 447                 ERROR("failed to run post-stop hooks for container '%s'.", name);
 448
 449         /* reset mask set by setup_signal_fd */
 450         if (sigprocmask(SIG_SETMASK, &handler->oldmask, NULL))
 451                 WARN("failed to restore sigprocmask");
 452
 453         lxc_delete_console(&handler->conf->console);
 454         lxc_delete_tty(&handler->conf->tty_info);
 455         close(handler->conf->maincmd_fd);
 456         handler->conf->maincmd_fd = -1;
 457         free(handler->name);
 458         free(handler);
 459 }
 460
 461 void lxc_abort(const char *name, struct lxc_handler *handler)
 462 {
 463         lxc_set_state(name, handler, ABORTING);
 464         if (handler->pid > 0)
 465                 kill(handler->pid, SIGKILL);
 466 }
 467
 468 #include <sys/reboot.h>
 469 #include <linux/reboot.h>
 470
 471 /*
 472  * reboot(LINUX_REBOOT_CMD_CAD_ON) will return -EINVAL
 473  * in a child pid namespace if container reboot support exists.
 474  * Otherwise, it will either succeed or return -EPERM.
 475  */
 476 static int container_reboot_supported(void *arg)
 477 {
 478         int *cmd = arg;
 479         int ret;
 480
 481         ret = reboot(*cmd);
 482         if (ret == -1 && errno == EINVAL)
 483                 return 1;
 484         return 0;
 485 }
 486
 487 static int must_drop_cap_sys_boot(void)
 488 {
 489         FILE *f = fopen("/proc/sys/kernel/ctrl-alt-del", "r");
 490         int ret, cmd, v;
 491         long stack_size = 4096;
 492         void *stack = alloca(stack_size) + stack_size;
 493         int status;
 494         pid_t pid;
 495
 496         if (!f) {
 497                 DEBUG("failed to open /proc/sys/kernel/ctrl-alt-del");
 498                 return 1;
 499         }
 500
 501         ret = fscanf(f, "%d", &v);
 502         fclose(f);
 503         if (ret != 1) {
 504                 DEBUG("Failed to read /proc/sys/kernel/ctrl-alt-del");
 505                 return 1;
 506         }
 507         cmd = v ? LINUX_REBOOT_CMD_CAD_ON : LINUX_REBOOT_CMD_CAD_OFF;
 508
 509         pid = clone(container_reboot_supported, stack, CLONE_NEWPID | SIGCHLD, &cmd);
 510         if (pid < 0) {
 511                 SYSERROR("failed to clone\n");
 512                 return -1;
 513         }
 514         if (wait(&status) < 0) {
 515                 SYSERROR("unexpected wait error: %m\n");
 516                 return -1;
 517         }
 518
 519         if (WEXITSTATUS(status) != 1)
 520                 return 1;
 521
 522         return 0;
 523 }
 524
 525 static int do_start(void *data)
 526 {
 527         struct lxc_handler *handler = data;
 528
 529         if (sigprocmask(SIG_SETMASK, &handler->oldmask, NULL)) {
 530                 SYSERROR("failed to set sigprocmask");
 531                 return -1;
 532         }
 533
 534         /* This prctl must be before the synchro, so if the parent
 535          * dies before we set the parent death signal, we will detect
 536          * its death with the synchro right after, otherwise we have
 537          * a window where the parent can exit before we set the pdeath
 538          * signal leading to a unsupervized container.
 539          */
 540         if (prctl(PR_SET_PDEATHSIG, SIGKILL, 0, 0, 0)) {
 541                 SYSERROR("failed to set pdeath signal");
 542                 return -1;
 543         }
 544
 545         lxc_sync_fini_parent(handler);
 546
 547         /* Tell the parent task it can begin to configure the
 548          * container and wait for it to finish
 549          */
 550         if (lxc_sync_barrier_parent(handler, LXC_SYNC_CONFIGURE))
 551                 return -1;
 552
 553         if (handler->conf->need_utmp_watch) {
 554                 if (prctl(PR_CAPBSET_DROP, CAP_SYS_BOOT, 0, 0, 0)) {
 555                         SYSERROR("failed to remove CAP_SYS_BOOT capability");
 556                         return -1;
 557                 }
 558                 DEBUG("Dropped cap_sys_boot\n");
 559         }
 560
 561         /* Setup the container, ip, names, utsname, ... */
 562         if (lxc_setup(handler->name, handler->conf)) {
 563                 ERROR("failed to setup the container");
 564                 goto out_warn_father;
 565         }
 566
 567         if (apparmor_load(handler) < 0)
 568                 goto out_warn_father;
 569
 570         if (lxc_seccomp_load(handler->conf) != 0)
 571                 goto out_warn_father;
 572
 573         if (run_lxc_hooks(handler->name, "start", handler->conf)) {
 574                 ERROR("failed to run start hooks for container '%s'.", handler->name);
 575                 goto out_warn_father;
 576         }
 577
 578         close(handler->sigfd);
 579
 580         /* after this call, we are in error because this
 581          * ops should not return as it execs */
 582         if (handler->ops->start(handler, handler->data))
 583                 return -1;
 584
 585 out_warn_father:
 586         lxc_sync_wake_parent(handler, LXC_SYNC_POST_CONFIGURE);
 587         return -1;
 588 }
 589
 590 int save_phys_nics(struct lxc_conf *conf)
 591 {
 592         struct lxc_list *iterator;
 593
 594         lxc_list_for_each(iterator, &conf->network) {
 595                 struct lxc_netdev *netdev = iterator->elem;
 596
 597                 if (netdev->type != LXC_NET_PHYS)
 598                         continue;
 599                 conf->saved_nics = realloc(conf->saved_nics,
 600                                 (conf->num_savednics+1)*sizeof(struct saved_nic));
 601                 if (!conf->saved_nics) {
 602                         SYSERROR("failed to allocate memory");
 603                         return -1;
 604                 }
 605                 conf->saved_nics[conf->num_savednics].ifindex = netdev->ifindex;
 606                 conf->saved_nics[conf->num_savednics].orig_name = strdup(netdev->link);
 607                 if (!conf->saved_nics[conf->num_savednics].orig_name) {
 608                         SYSERROR("failed to allocate memory");
 609                         return -1;
 610                 }
 611                 INFO("stored saved_nic #%d idx %d name %s\n", conf->num_savednics,
 612                         conf->saved_nics[conf->num_savednics].ifindex,
 613                         conf->saved_nics[conf->num_savednics].orig_name);
 614                 conf->num_savednics++;
 615         }
 616
 617         return 0;
 618 }
 619
 620
 621 int lxc_spawn(struct lxc_handler *handler)
 622 {
 623         int failed_before_rename = 0;
 624         const char *name = handler->name;
 625         int pinfd;
 626
 627         if (lxc_sync_init(handler))
 628                 return -1;
 629
 630         handler->clone_flags = CLONE_NEWUTS|CLONE_NEWPID|CLONE_NEWIPC|CLONE_NEWNS;
 631         if (!lxc_list_empty(&handler->conf->network)) {
 632
 633                 handler->clone_flags |= CLONE_NEWNET;
 634
 635                 /* Find gateway addresses from the link device, which is
 636                  * no longer accessible inside the container. Do this
 637                  * before creating network interfaces, since goto
 638                  * out_delete_net does not work before lxc_clone. */
 639                 if (lxc_find_gateway_addresses(handler)) {
 640                         ERROR("failed to find gateway addresses");
 641                         lxc_sync_fini(handler);
 642                         return -1;
 643                 }
 644
 645                 /* that should be done before the clone because we will
 646                  * fill the netdev index and use them in the child
 647                  */
 648                 if (lxc_create_network(handler)) {
 649                         ERROR("failed to create the network");
 650                         lxc_sync_fini(handler);
 651                         return -1;
 652                 }
 653         }
 654
 655         if (save_phys_nics(handler->conf)) {
 656                 ERROR("failed to save physical nic info");
 657                 goto out_abort;
 658         }
 659
 660         /*
 661          * if the rootfs is not a blockdev, prevent the container from
 662          * marking it readonly.
 663          */
 664
 665         pinfd = pin_rootfs(handler->conf->rootfs.path);
 666         if (pinfd == -1) {
 667                 ERROR("failed to pin the container's rootfs");
 668                 goto out_abort;
 669         }
 670
 671         /* Create a process in a new set of namespaces */
 672         handler->pid = lxc_clone(do_start, handler, handler->clone_flags);
 673         if (handler->pid < 0) {
 674                 SYSERROR("failed to fork into a new namespace");
 675                 goto out_delete_net;
 676         }
 677
 678         lxc_sync_fini_child(handler);
 679
 680         if (lxc_sync_wait_child(handler, LXC_SYNC_CONFIGURE))
 681                 failed_before_rename = 1;
 682
 683         if (lxc_cgroup_create(name, handler->pid))
 684                 goto out_delete_net;
 685
 686         if (failed_before_rename)
 687                 goto out_delete_net;
 688
 689         /* Create the network configuration */
 690         if (handler->clone_flags & CLONE_NEWNET) {
 691                 if (lxc_assign_network(&handler->conf->network, handler->pid)) {
 692                         ERROR("failed to create the configured network");
 693                         goto out_delete_net;
 694                 }
 695         }
 696
 697         /* Tell the child to continue its initialization and wait for
 698          * it to exec or return an error
 699          */
 700         if (lxc_sync_barrier_child(handler, LXC_SYNC_POST_CONFIGURE))
 701                 return -1;
 702
 703         if (handler->ops->post_start(handler, handler->data))
 704                 goto out_abort;
 705
 706         if (lxc_set_state(name, handler, RUNNING)) {
 707                 ERROR("failed to set state to %s",
 708                               lxc_state2str(RUNNING));
 709                 goto out_abort;
 710         }
 711
 712         lxc_sync_fini(handler);
 713
 714         if (pinfd >= 0)
 715                 close(pinfd);
 716
 717         return 0;
 718
 719 out_delete_net:
 720         if (handler->clone_flags & CLONE_NEWNET)
 721                 lxc_delete_network(handler);
 722 out_abort:
 723         lxc_abort(name, handler);
 724         lxc_sync_fini(handler);
 725         return -1;
 726 }
 727
 728 int __lxc_start(const char *name, struct lxc_conf *conf,
 729                 struct lxc_operations* ops, void *data)
 730 {
 731         struct lxc_handler *handler;
 732         int err = -1;
 733         int status;
 734
 735         handler = lxc_init(name, conf);
 736         if (!handler) {
 737                 ERROR("failed to initialize the container");
 738                 return -1;
 739         }
 740         handler->ops = ops;
 741         handler->data = data;
 742
 743         if (must_drop_cap_sys_boot()) {
 744                 DEBUG("Dropping cap_sys_boot\n");
 745         } else {
 746                 DEBUG("Not dropping cap_sys_boot or watching utmp\n");
 747                 handler->conf->need_utmp_watch = 0;
 748         }
 749
 750         err = lxc_spawn(handler);
 751         if (err) {
 752                 ERROR("failed to spawn '%s'", name);
 753                 goto out_fini_nonet;
 754         }
 755
 756         err = lxc_poll(name, handler);
 757         if (err) {
 758                 ERROR("mainloop exited with an error");
 759                 goto out_abort;
 760         }
 761
 762         while (waitpid(handler->pid, &status, 0) < 0 && errno == EINTR)
 763                 continue;
 764
 765         /*
 766          * If the child process exited but was not signaled,
 767          * it didn't call reboot.  This should mean it was an
 768          * lxc-execute which simply exited.  In any case, treat
 769          * it as a 'halt'
 770          */
 771         if (WIFSIGNALED(status)) {
 772                 switch(WTERMSIG(status)) {
 773                 case SIGINT: /* halt */
 774                         DEBUG("Container halting");
 775                         break;
 776                 case SIGHUP: /* reboot */
 777                         DEBUG("Container rebooting");
 778                         handler->conf->reboot = 1;
 779                         break;
 780                 default:
 781                         DEBUG("unknown exit status for init: %d\n", WTERMSIG(status));
 782                         break;
 783                 }
 784         }
 785
 786         lxc_rename_phys_nics_on_shutdown(handler->conf);
 787
 788         err =  lxc_error_set_and_log(handler->pid, status);
 789 out_fini:
 790         lxc_delete_network(handler);
 791
 792 out_fini_nonet:
 793         lxc_cgroup_destroy(name);
 794         lxc_fini(name, handler);
 795         return err;
 796
 797 out_abort:
 798         lxc_abort(name, handler);
 799         goto out_fini;
 800 }
 801
 802 struct start_args {
 803         char *const *argv;
 804 };
 805
 806 static int start(struct lxc_handler *handler, void* data)
 807 {
 808         struct start_args *arg = data;
 809
 810         NOTICE("exec'ing '%s'", arg->argv[0]);
 811
 812         execvp(arg->argv[0], arg->argv);
 813         SYSERROR("failed to exec %s", arg->argv[0]);
 814         return 0;
 815 }
 816
 817 static int post_start(struct lxc_handler *handler, void* data)
 818 {
 819         struct start_args *arg = data;
 820
 821         NOTICE("'%s' started with pid '%d'", arg->argv[0], handler->pid);
 822         return 0;
 823 }
 824
 825 static struct lxc_operations start_ops = {
 826         .start = start,
 827         .post_start = post_start
 828 };
 829
 830 int lxc_start(const char *name, char *const argv[], struct lxc_conf *conf)
 831 {
 832         struct start_args start_arg = {
 833                 .argv = argv,
 834         };
 835
 836         if (lxc_check_inherited(conf, -1))
 837                 return -1;
 838
 839         conf->need_utmp_watch = 1;
 840         return __lxc_start(name, conf, &start_ops, &start_arg);
 841 }