src/lxc/start.c

   1 /* SPDX-License-Identifier: LGPL-2.1+ */
   2
   3 #ifndef _GNU_SOURCE
   4 #define _GNU_SOURCE 1
   5 #endif
   6 #include <dirent.h>
   7 #include <errno.h>
   8 #include <fcntl.h>
   9 #include <grp.h>
  10 #include <poll.h>
  11 #include <pthread.h>
  12 #include <signal.h>
  13 #include <stdio.h>
  14 #include <stdlib.h>
  15 #include <string.h>
  16 #include <sys/file.h>
  17 #include <sys/mount.h>
  18 #include <sys/param.h>
  19 #include <sys/prctl.h>
  20 #include <sys/socket.h>
  21 #include <sys/stat.h>
  22 #include <sys/syscall.h>
  23 #include <sys/types.h>
  24 #include <sys/un.h>
  25 #include <sys/wait.h>
  26 #include <unistd.h>
  27
  28 #include "af_unix.h"
  29 #include "caps.h"
  30 #include "cgroup.h"
  31 #include "commands.h"
  32 #include "commands_utils.h"
  33 #include "conf.h"
  34 #include "config.h"
  35 #include "confile_utils.h"
  36 #include "error.h"
  37 #include "file_utils.h"
  38 #include "list.h"
  39 #include "log.h"
  40 #include "lsm/lsm.h"
  41 #include "lxccontainer.h"
  42 #include "lxclock.h"
  43 #include "lxcseccomp.h"
  44 #include "macro.h"
  45 #include "mainloop.h"
  46 #include "memory_utils.h"
  47 #include "monitor.h"
  48 #include "namespace.h"
  49 #include "network.h"
  50 #include "raw_syscalls.h"
  51 #include "start.h"
  52 #include "storage/storage.h"
  53 #include "storage/storage_utils.h"
  54 #include "sync.h"
  55 #include "syscall_wrappers.h"
  56 #include "terminal.h"
  57 #include "utils.h"
  58
  59 #if HAVE_LIBCAP
  60 #include <sys/capability.h>
  61 #endif
  62
  63 #ifndef HAVE_STRLCPY
  64 #include "include/strlcpy.h"
  65 #endif
  66
  67 lxc_log_define(start, lxc);
  68
  69 extern void mod_all_rdeps(struct lxc_container *c, bool inc);
  70 static bool do_destroy_container(struct lxc_handler *handler);
  71 static int lxc_rmdir_onedev_wrapper(void *data);
  72 static void lxc_destroy_container_on_signal(struct lxc_handler *handler,
  73                                             const char *name);
  74
  75 static void print_top_failing_dir(const char *path)
  76 {
  77         __do_free char *copy = NULL;
  78         int ret;
  79         char *e, *p, saved;
  80
  81         copy = must_copy_string(path);
  82         p = copy;
  83         e = copy + strlen(path);
  84
  85         while (p < e) {
  86                 while (p < e && *p == '/')
  87                         p++;
  88
  89                 while (p < e && *p != '/')
  90                         p++;
  91
  92                 saved = *p;
  93                 *p = '\0';
  94
  95                 ret = access(copy, X_OK);
  96                 if (ret != 0) {
  97                         SYSERROR("Could not access %s. Please grant it x access, or add an ACL for the container " "root", copy);
  98                         return;
  99                 }
 100                 *p = saved;
 101         }
 102 }
 103
 104 static void lxc_put_nsfds(struct lxc_handler *handler)
 105 {
 106         for (int i = 0; i < LXC_NS_MAX; i++) {
 107                 if (handler->nsfd[i] < 0)
 108                         continue;
 109
 110                 close_prot_errno_disarm(handler->nsfd[i]);
 111         }
 112 }
 113
 114 static int lxc_try_preserve_ns(const int pid, const char *ns)
 115 {
 116         int fd;
 117
 118         fd = lxc_preserve_ns(pid, ns);
 119         if (fd < 0) {
 120                 if (errno != ENOENT)
 121                         return log_error_errno(-EINVAL,
 122                                                errno, "Failed to preserve %s namespace",
 123                                                ns);
 124
 125                 return log_warn_errno(-EOPNOTSUPP,
 126                                       errno, "Kernel does not support preserving %s namespaces",
 127                                       ns);
 128         }
 129
 130         return fd;
 131 }
 132
 133 /* lxc_try_preserve_namespaces: open /proc/@pid/ns/@ns for each namespace
 134  * specified in ns_clone_flags.
 135  * Return true on success, false on failure.
 136  */
 137 static bool lxc_try_preserve_namespaces(struct lxc_handler *handler,
 138                                         int ns_clone_flags, pid_t pid)
 139 {
 140         int i;
 141
 142         for (i = 0; i < LXC_NS_MAX; i++)
 143                 handler->nsfd[i] = -EBADF;
 144
 145         for (i = 0; i < LXC_NS_MAX; i++) {
 146                 int fd;
 147
 148                 if ((ns_clone_flags & ns_info[i].clone_flag) == 0)
 149                         continue;
 150
 151                 fd = lxc_try_preserve_ns(pid, ns_info[i].proc_name);
 152                 if (fd < 0) {
 153                         /* Do not fail to start container on kernels that do
 154                          * not support interacting with namespaces through
 155                          * /proc.
 156                          */
 157                         if (fd == -EOPNOTSUPP)
 158                                 continue;
 159
 160                         lxc_put_nsfds(handler);
 161                         return false;
 162                 }
 163
 164                 handler->nsfd[i] = fd;
 165                 DEBUG("Preserved %s namespace via fd %d", ns_info[i].proc_name,
 166                       handler->nsfd[i]);
 167         }
 168
 169         return true;
 170 }
 171
 172 static inline bool match_stdfds(int fd)
 173 {
 174         return (fd == STDIN_FILENO || fd == STDOUT_FILENO || fd == STDERR_FILENO);
 175 }
 176
 177 #ifdef HAVE_DLOG
 178 static bool match_dlog_fds(struct dirent *direntp)
 179 {
 180         char path[PATH_MAX] = {0};
 181         char link[PATH_MAX] = {0};
 182         ssize_t linklen;
 183         int ret;
 184
 185         ret = snprintf(path, PATH_MAX, "/proc/self/fd/%s", direntp->d_name);
 186         if (ret < 0 || ret >= PATH_MAX)
 187                 return log_error(false, "Failed to create file descriptor name");
 188
 189         linklen = readlink(path, link, PATH_MAX);
 190         if (linklen < 0)
 191                 return log_error(false, "Failed to read link path - \"%s\"", path);
 192         else if (linklen >= PATH_MAX)
 193                 return log_error(false, "The name of link path is too long - \"%s\"", path);
 194
 195         if (strcmp(link, "/dev/log_main")       == 0 ||
 196             strcmp(link, "/dev/log_system")     == 0 ||
 197             strcmp(link, "/dev/log_radio")      == 0)
 198                 return true;
 199
 200         return false;
 201 }
 202 #endif
 203
 204 int lxc_check_inherited(struct lxc_conf *conf, bool closeall,
 205                         int *fds_to_ignore, size_t len_fds)
 206 {
 207         int fd, fddir;
 208         size_t i;
 209         DIR *dir;
 210         struct dirent *direntp;
 211
 212         if (conf && conf->close_all_fds)
 213                 closeall = true;
 214
 215 restart:
 216         dir = opendir("/proc/self/fd");
 217         if (!dir)
 218                 return log_warn(-1, "Failed to open directory");
 219
 220         fddir = dirfd(dir);
 221
 222         while ((direntp = readdir(dir))) {
 223                 int ret;
 224                 struct lxc_list *cur;
 225                 bool matched = false;
 226
 227                 if (strcmp(direntp->d_name, ".") == 0)
 228                         continue;
 229
 230                 if (strcmp(direntp->d_name, "..") == 0)
 231                         continue;
 232
 233                 ret = lxc_safe_int(direntp->d_name, &fd);
 234                 if (ret < 0) {
 235                         INFO("Could not parse file descriptor for \"%s\"", direntp->d_name);
 236                         continue;
 237                 }
 238
 239                 for (i = 0; i < len_fds; i++)
 240                         if (fds_to_ignore[i] == fd)
 241                                 break;
 242
 243                 if (fd == fddir || fd == lxc_log_fd ||
 244                     (i < len_fds && fd == fds_to_ignore[i]))
 245                         continue;
 246
 247                 /* Keep state clients that wait on reboots. */
 248                 if (conf) {
 249                         lxc_list_for_each(cur, &conf->state_clients) {
 250                                 struct lxc_state_client *client = cur->elem;
 251
 252                                 if (client->clientfd != fd)
 253                                         continue;
 254
 255                                 matched = true;
 256                                 break;
 257                         }
 258                 }
 259
 260                 if (matched)
 261                         continue;
 262
 263                 if (current_config && fd == current_config->logfd)
 264                         continue;
 265
 266                 if (match_stdfds(fd))
 267                         continue;
 268
 269 #ifdef HAVE_DLOG
 270                 if (match_dlog_fds(direntp))
 271                         continue;
 272
 273 #endif
 274                 if (closeall) {
 275                         close(fd);
 276                         closedir(dir);
 277                         INFO("Closed inherited fd %d", fd);
 278                         goto restart;
 279                 }
 280                 WARN("Inherited fd %d", fd);
 281         }
 282
 283         /* Only enable syslog at this point to avoid the above logging function
 284          * to open a new fd and make the check_inherited function enter an
 285          * infinite loop.
 286          */
 287         lxc_log_enable_syslog();
 288
 289         closedir(dir); /* cannot fail */
 290         return 0;
 291 }
 292
 293 static int setup_signal_fd(sigset_t *oldmask)
 294 {
 295         int ret;
 296         sigset_t mask;
 297         const int signals[] = {SIGBUS, SIGILL, SIGSEGV, SIGWINCH};
 298
 299         /* Block everything except serious error signals. */
 300         ret = sigfillset(&mask);
 301         if (ret < 0)
 302                 return -EBADF;
 303
 304         for (int sig = 0; sig < (sizeof(signals) / sizeof(signals[0])); sig++) {
 305                 ret = sigdelset(&mask, signals[sig]);
 306                 if (ret < 0)
 307                         return -EBADF;
 308         }
 309
 310         ret = pthread_sigmask(SIG_BLOCK, &mask, oldmask);
 311         if (ret < 0)
 312                 return log_error_errno(-EBADF, errno,
 313                                        "Failed to set signal mask");
 314
 315         ret = signalfd(-1, &mask, SFD_CLOEXEC);
 316         if (ret < 0)
 317                 return log_error_errno(-EBADF,
 318                                        errno, "Failed to create signal file descriptor");
 319
 320         TRACE("Created signal file descriptor %d", ret);
 321
 322         return ret;
 323 }
 324
 325 static int signal_handler(int fd, uint32_t events, void *data,
 326                           struct lxc_epoll_descr *descr)
 327 {
 328         int ret;
 329         siginfo_t info;
 330         struct signalfd_siginfo siginfo;
 331         struct lxc_handler *hdlr = data;
 332
 333         ret = lxc_read_nointr(fd, &siginfo, sizeof(siginfo));
 334         if (ret < 0)
 335                 return log_error(LXC_MAINLOOP_ERROR, "Failed to read signal info from signal file descriptor %d", fd);
 336
 337         if (ret != sizeof(siginfo))
 338                 return log_error(-EINVAL, "Unexpected size for struct signalfd_siginfo");
 339
 340         /* Check whether init is running. */
 341         info.si_pid = 0;
 342         ret = waitid(P_PID, hdlr->pid, &info, WEXITED | WNOWAIT | WNOHANG);
 343         if (ret == 0 && info.si_pid == hdlr->pid)
 344                 hdlr->init_died = true;
 345
 346         /* Try to figure out a reasonable exit status to report. */
 347         if (hdlr->init_died) {
 348                 switch (info.si_code) {
 349                 case CLD_EXITED:
 350                         hdlr->exit_status = info.si_status << 8;
 351                         break;
 352                 case CLD_KILLED:
 353                 case CLD_DUMPED:
 354                 case CLD_STOPPED:
 355                         hdlr->exit_status = info.si_status << 8 | 0x7f;
 356                         break;
 357                 case CLD_CONTINUED:
 358                         /* Huh? The waitid() told us it's dead *and* continued? */
 359                         WARN("Init %d dead and continued?", hdlr->pid);
 360                         hdlr->exit_status = 1;
 361                         break;
 362                 default:
 363                         ERROR("Unknown si_code: %d", info.si_code);
 364                         hdlr->exit_status = 1;
 365                 }
 366         }
 367
 368         if (siginfo.ssi_signo == SIGHUP) {
 369                 if (hdlr->pidfd >= 0)
 370                         lxc_raw_pidfd_send_signal(hdlr->pidfd, SIGTERM, NULL, 0);
 371                 else
 372                         kill(hdlr->pid, SIGTERM);
 373                 INFO("Killing %d since terminal hung up", hdlr->pid);
 374                 return hdlr->init_died ? LXC_MAINLOOP_CLOSE
 375                                        : LXC_MAINLOOP_CONTINUE;
 376         }
 377
 378         if (siginfo.ssi_signo != SIGCHLD) {
 379                 if (hdlr->pidfd >= 0)
 380                         lxc_raw_pidfd_send_signal(hdlr->pidfd,
 381                                                   siginfo.ssi_signo, NULL, 0);
 382                 else
 383                         kill(hdlr->pid, siginfo.ssi_signo);
 384                 INFO("Forwarded signal %d to pid %d", siginfo.ssi_signo, hdlr->pid);
 385                 return hdlr->init_died ? LXC_MAINLOOP_CLOSE
 386                                        : LXC_MAINLOOP_CONTINUE;
 387         }
 388
 389         /* More robustness, protect ourself from a SIGCHLD sent
 390          * by a process different from the container init.
 391          */
 392         if (siginfo.ssi_pid != hdlr->pid) {
 393                 NOTICE("Received %d from pid %d instead of container init %d",
 394                        siginfo.ssi_signo, siginfo.ssi_pid, hdlr->pid);
 395                 return hdlr->init_died ? LXC_MAINLOOP_CLOSE
 396                                        : LXC_MAINLOOP_CONTINUE;
 397         }
 398
 399         if (siginfo.ssi_code == CLD_STOPPED) {
 400                 INFO("Container init process was stopped");
 401                 return hdlr->init_died ? LXC_MAINLOOP_CLOSE
 402                                        : LXC_MAINLOOP_CONTINUE;
 403         }
 404
 405         if (siginfo.ssi_code == CLD_CONTINUED) {
 406                 INFO("Container init process was continued");
 407                 return hdlr->init_died ? LXC_MAINLOOP_CLOSE
 408                                        : LXC_MAINLOOP_CONTINUE;
 409         }
 410
 411         return log_debug(LXC_MAINLOOP_CLOSE, "Container init process %d exited", hdlr->pid);
 412 }
 413
 414 int lxc_serve_state_clients(const char *name, struct lxc_handler *handler,
 415                             lxc_state_t state)
 416 {
 417         size_t retlen;
 418         ssize_t ret;
 419         struct lxc_list *cur, *next;
 420         struct lxc_msg msg = {.type = lxc_msg_state, .value = state};
 421
 422         if (state == THAWED)
 423                 handler->state = RUNNING;
 424         else
 425                 handler->state = state;
 426
 427         TRACE("Set container state to %s", lxc_state2str(state));
 428
 429         if (lxc_list_empty(&handler->conf->state_clients))
 430                 return log_trace(0, "No state clients registered");
 431
 432         retlen = strlcpy(msg.name, name, sizeof(msg.name));
 433         if (retlen >= sizeof(msg.name))
 434                 return -E2BIG;
 435
 436         lxc_list_for_each_safe(cur, &handler->conf->state_clients, next) {
 437                 struct lxc_state_client *client = cur->elem;
 438
 439                 if (client->states[state] == 0) {
 440                         TRACE("State %s not registered for state client %d",
 441                               lxc_state2str(state), client->clientfd);
 442                         continue;
 443                 }
 444
 445                 TRACE("Sending state %s to state client %d",
 446                       lxc_state2str(state), client->clientfd);
 447
 448                 ret = lxc_send_nointr(client->clientfd, &msg, sizeof(msg), MSG_NOSIGNAL);
 449                 if (ret <= 0)
 450                         SYSERROR("Failed to send message to client");
 451
 452                 /* kick client from list */
 453                 lxc_list_del(cur);
 454                 close(client->clientfd);
 455                 free(cur->elem);
 456                 free(cur);
 457         }
 458
 459         return 0;
 460 }
 461
 462 static int lxc_serve_state_socket_pair(const char *name,
 463                                        struct lxc_handler *handler,
 464                                        lxc_state_t state)
 465 {
 466         ssize_t ret;
 467
 468         if (!handler->daemonize ||
 469             handler->state_socket_pair[1] < 0 ||
 470             state == STARTING)
 471                 return 0;
 472
 473         /* Close read end of the socket pair. */
 474         close_prot_errno_disarm(handler->state_socket_pair[0]);
 475
 476 again:
 477         ret = lxc_abstract_unix_send_credential(handler->state_socket_pair[1],
 478                                                 &(int){state}, sizeof(int));
 479         if (ret < 0) {
 480                 SYSERROR("Failed to send state to %d", handler->state_socket_pair[1]);
 481
 482                 if (errno == EINTR)
 483                         goto again;
 484
 485                 return -1;
 486         }
 487
 488         if (ret != sizeof(int))
 489                 return log_error(-1, "Message too long : %d", handler->state_socket_pair[1]);
 490
 491         TRACE("Sent container state \"%s\" to %d", lxc_state2str(state),
 492               handler->state_socket_pair[1]);
 493
 494         /* Close write end of the socket pair. */
 495         close_prot_errno_disarm(handler->state_socket_pair[1]);
 496
 497         return 0;
 498 }
 499
 500 int lxc_set_state(const char *name, struct lxc_handler *handler,
 501                   lxc_state_t state)
 502 {
 503         int ret;
 504
 505         ret = lxc_serve_state_socket_pair(name, handler, state);
 506         if (ret < 0)
 507                 return log_error(-1, "Failed to synchronize via anonymous pair of unix sockets");
 508
 509         ret = lxc_serve_state_clients(name, handler, state);
 510         if (ret < 0)
 511                 return -1;
 512
 513         /* This function will try to connect to the legacy lxc-monitord state
 514          * server and only exists for backwards compatibility.
 515          */
 516         lxc_monitor_send_state(name, state, handler->lxcpath);
 517
 518         return 0;
 519 }
 520
 521 int lxc_poll(const char *name, struct lxc_handler *handler)
 522 {
 523         int ret;
 524         bool has_console = true;
 525         struct lxc_epoll_descr descr, descr_console;
 526
 527         if (handler->conf->console.path &&
 528             strcmp(handler->conf->console.path, "none") == 0)
 529                 has_console = false;
 530
 531         ret = lxc_mainloop_open(&descr);
 532         if (ret < 0) {
 533                 ERROR("Failed to create mainloop");
 534                 goto out_sigfd;
 535         }
 536
 537         if (has_console) {
 538                 ret = lxc_mainloop_open(&descr_console);
 539                 if (ret < 0) {
 540                         ERROR("Failed to create console mainloop");
 541                         goto out_mainloop;
 542                 }
 543         }
 544
 545         ret = lxc_mainloop_add_handler(&descr, handler->sigfd, signal_handler, handler);
 546         if (ret < 0) {
 547                 ERROR("Failed to add signal handler for %d to mainloop", handler->sigfd);
 548                 goto out_mainloop_console;
 549         }
 550
 551         ret = lxc_seccomp_setup_proxy(&handler->conf->seccomp, &descr, handler);
 552         if (ret < 0) {
 553                 ERROR("Failed to setup seccomp proxy");
 554                 goto out_mainloop_console;
 555         }
 556
 557         if (has_console) {
 558                 struct lxc_terminal *console = &handler->conf->console;
 559
 560                 ret = lxc_terminal_mainloop_add(&descr, console);
 561                 if (ret < 0) {
 562                         ERROR("Failed to add console handlers to mainloop");
 563                         goto out_mainloop_console;
 564                 }
 565
 566                 ret = lxc_terminal_mainloop_add(&descr_console, console);
 567                 if (ret < 0) {
 568                         ERROR("Failed to add console handlers to console mainloop");
 569                         goto out_mainloop_console;
 570                 }
 571
 572                 handler->conf->console.descr = &descr;
 573         }
 574
 575         ret = lxc_cmd_mainloop_add(name, &descr, handler);
 576         if (ret < 0) {
 577                 ERROR("Failed to add command handler to mainloop");
 578                 goto out_mainloop_console;
 579         }
 580
 581         TRACE("Mainloop is ready");
 582
 583         ret = lxc_mainloop(&descr, -1);
 584         close_prot_errno_disarm(descr.epfd);
 585         if (ret < 0 || !handler->init_died)
 586                 goto out_mainloop_console;
 587
 588         if (has_console)
 589                 ret = lxc_mainloop(&descr_console, 0);
 590
 591 out_mainloop_console:
 592         if (has_console) {
 593                 lxc_mainloop_close(&descr_console);
 594                 TRACE("Closed console mainloop");
 595         }
 596
 597 out_mainloop:
 598         lxc_mainloop_close(&descr);
 599         TRACE("Closed mainloop");
 600
 601 out_sigfd:
 602         TRACE("Closed signal file descriptor %d", handler->sigfd);
 603         close_prot_errno_disarm(handler->sigfd);
 604
 605         return ret;
 606 }
 607
 608 void lxc_zero_handler(struct lxc_handler *handler)
 609 {
 610         memset(handler, 0, sizeof(struct lxc_handler));
 611
 612         handler->state = STOPPED;
 613
 614         handler->pinfd = -EBADF;
 615
 616         handler->pidfd = -EBADF;
 617
 618         handler->sigfd = -EBADF;
 619
 620         for (int i = 0; i < LXC_NS_MAX; i++)
 621                 handler->nsfd[i] = -EBADF;
 622
 623         handler->data_sock[0] = -EBADF;
 624         handler->data_sock[1] = -EBADF;
 625
 626         handler->state_socket_pair[0] = -EBADF;
 627         handler->state_socket_pair[1] = -EBADF;
 628
 629         handler->sync_sock[0] = -EBADF;
 630         handler->sync_sock[1] = -EBADF;
 631 }
 632
 633 void lxc_free_handler(struct lxc_handler *handler)
 634 {
 635         close_prot_errno_disarm(handler->pinfd);
 636         close_prot_errno_disarm(handler->pidfd);
 637         close_prot_errno_disarm(handler->sigfd);
 638         lxc_put_nsfds(handler);
 639         if (handler->conf && handler->conf->reboot == REBOOT_NONE)
 640                 close_prot_errno_disarm(handler->conf->maincmd_fd);
 641         close_prot_errno_disarm(handler->monitor_status_fd);
 642         close_prot_errno_disarm(handler->state_socket_pair[0]);
 643         close_prot_errno_disarm(handler->state_socket_pair[1]);
 644         cgroup_exit(handler->cgroup_ops);
 645         handler->conf = NULL;
 646         free_disarm(handler);
 647 }
 648
 649 struct lxc_handler *lxc_init_handler(const char *name, struct lxc_conf *conf,
 650                                      const char *lxcpath, bool daemonize)
 651 {
 652         int ret;
 653         struct lxc_handler *handler;
 654
 655         handler = malloc(sizeof(*handler));
 656         if (!handler)
 657                 return NULL;
 658
 659         memset(handler, 0, sizeof(*handler));
 660
 661         /* Note that am_guest_unpriv() checks the effective uid. We
 662          * probably don't care if we are real root only if we are running
 663          * as root so this should be fine.
 664          */
 665         handler->am_root = !am_guest_unpriv();
 666         handler->conf = conf;
 667         handler->lxcpath = lxcpath;
 668         handler->init_died = false;
 669         handler->data_sock[0] = -EBADF;
 670         handler->data_sock[1] = -EBADF;
 671         handler->monitor_status_fd = -EBADF;
 672         handler->pinfd = -EBADF;
 673         handler->pidfd = -EBADF;
 674         handler->sigfd = -EBADF;
 675         handler->state_socket_pair[0] = -EBADF;
 676         handler->state_socket_pair[1] = -EBADF;
 677         if (handler->conf->reboot == REBOOT_NONE)
 678                 lxc_list_init(&handler->conf->state_clients);
 679
 680         for (int i = 0; i < LXC_NS_MAX; i++)
 681                 handler->nsfd[i] = -EBADF;
 682
 683         handler->name = name;
 684         if (daemonize)
 685                 handler->transient_pid = lxc_raw_getpid();
 686         else
 687                 handler->transient_pid = -1;
 688
 689         if (daemonize && handler->conf->reboot == REBOOT_NONE) {
 690                 /* Create socketpair() to synchronize on daemonized startup.
 691                  * When the container reboots we don't need to synchronize
 692                  * again currently so don't open another socketpair().
 693                  */
 694                 ret = socketpair(AF_UNIX, SOCK_STREAM | SOCK_CLOEXEC, 0,
 695                                  handler->state_socket_pair);
 696                 if (ret < 0) {
 697                         ERROR("Failed to create anonymous pair of unix sockets");
 698                         goto on_error;
 699                 }
 700
 701                 TRACE("Created anonymous pair {%d,%d} of unix sockets",
 702                       handler->state_socket_pair[0],
 703                       handler->state_socket_pair[1]);
 704         }
 705
 706         if (handler->conf->reboot == REBOOT_NONE) {
 707                 handler->conf->maincmd_fd = lxc_cmd_init(name, lxcpath, "command");
 708                 if (handler->conf->maincmd_fd < 0) {
 709                         ERROR("Failed to set up command socket");
 710                         goto on_error;
 711                 }
 712         }
 713
 714         TRACE("Unix domain socket %d for command server is ready",
 715               handler->conf->maincmd_fd);
 716
 717         return handler;
 718
 719 on_error:
 720         lxc_free_handler(handler);
 721
 722         return NULL;
 723 }
 724
 725 int lxc_init(const char *name, struct lxc_handler *handler)
 726 {
 727         __do_close int status_fd = -EBADF;
 728         int ret;
 729         const char *loglevel;
 730         struct lxc_conf *conf = handler->conf;
 731
 732         handler->monitor_pid = lxc_raw_getpid();
 733         status_fd = open("/proc/self/status", O_RDONLY | O_CLOEXEC);
 734         if (status_fd < 0)
 735                 return log_error_errno(-1, errno, "Failed to open monitor status fd");
 736
 737         lsm_init();
 738         TRACE("Initialized LSM");
 739
 740         ret = lxc_read_seccomp_config(conf);
 741         if (ret < 0)
 742                 return log_error(-1, "Failed loading seccomp policy");
 743         TRACE("Read seccomp policy");
 744
 745         /* Begin by setting the state to STARTING. */
 746         ret = lxc_set_state(name, handler, STARTING);
 747         if (ret < 0)
 748                 return log_error(-1, "Failed to set state to \"%s\"", lxc_state2str(STARTING));
 749         TRACE("Set container state to \"STARTING\"");
 750
 751         /* Start of environment variable setup for hooks. */
 752         ret = setenv("LXC_NAME", name, 1);
 753         if (ret < 0)
 754                 SYSERROR("Failed to set environment variable: LXC_NAME=%s", name);
 755
 756         if (conf->rcfile) {
 757                 ret = setenv("LXC_CONFIG_FILE", conf->rcfile, 1);
 758                 if (ret < 0)
 759                         SYSERROR("Failed to set environment variable: LXC_CONFIG_FILE=%s", conf->rcfile);
 760         }
 761
 762         if (conf->rootfs.mount) {
 763                 ret = setenv("LXC_ROOTFS_MOUNT", conf->rootfs.mount, 1);
 764                 if (ret < 0)
 765                         SYSERROR("Failed to set environment variable: LXC_ROOTFS_MOUNT=%s", conf->rootfs.mount);
 766         }
 767
 768         if (conf->rootfs.path) {
 769                 ret = setenv("LXC_ROOTFS_PATH", conf->rootfs.path, 1);
 770                 if (ret < 0)
 771                         SYSERROR("Failed to set environment variable: LXC_ROOTFS_PATH=%s", conf->rootfs.path);
 772         }
 773
 774         if (conf->console.path) {
 775                 ret = setenv("LXC_CONSOLE", conf->console.path, 1);
 776                 if (ret < 0)
 777                         SYSERROR("Failed to set environment variable: LXC_CONSOLE=%s", conf->console.path);
 778         }
 779
 780         if (conf->console.log_path) {
 781                 ret = setenv("LXC_CONSOLE_LOGPATH", conf->console.log_path, 1);
 782                 if (ret < 0)
 783                         SYSERROR("Failed to set environment variable: LXC_CONSOLE_LOGPATH=%s", conf->console.log_path);
 784         }
 785
 786         if (cgns_supported()) {
 787                 ret = setenv("LXC_CGNS_AWARE", "1", 1);
 788                 if (ret < 0)
 789                         SYSERROR("Failed to set environment variable LXC_CGNS_AWARE=1");
 790         }
 791
 792         loglevel = lxc_log_priority_to_string(lxc_log_get_level());
 793         ret = setenv("LXC_LOG_LEVEL", loglevel, 1);
 794         if (ret < 0)
 795                 SYSERROR("Set environment variable LXC_LOG_LEVEL=%s", loglevel);
 796
 797         if (conf->hooks_version == 0)
 798                 ret = setenv("LXC_HOOK_VERSION", "0", 1);
 799         else
 800                 ret = setenv("LXC_HOOK_VERSION", "1", 1);
 801         if (ret < 0)
 802                 SYSERROR("Failed to set environment variable LXC_HOOK_VERSION=%u", conf->hooks_version);
 803         /* End of environment variable setup for hooks. */
 804
 805         TRACE("Set environment variables");
 806
 807         ret = run_lxc_hooks(name, "pre-start", conf, NULL);
 808         if (ret < 0)
 809                 return log_error(-1, "Failed to run lxc.hook.pre-start for container \"%s\"", name);
 810         TRACE("Ran pre-start hooks");
 811
 812         /* The signal fd has to be created before forking otherwise if the child
 813          * process exits before we setup the signal fd, the event will be lost
 814          * and the command will be stuck.
 815          */
 816         handler->sigfd = setup_signal_fd(&handler->oldmask);
 817         if (handler->sigfd < 0)
 818                 return log_error(-1, "Failed to setup SIGCHLD fd handler.");
 819         TRACE("Set up signal fd");
 820
 821         /* Do this after setting up signals since it might unblock SIGWINCH. */
 822         ret = lxc_terminal_setup(conf);
 823         if (ret < 0) {
 824                 ERROR("Failed to create console");
 825                 goto out_restore_sigmask;
 826         }
 827         TRACE("Created console");
 828
 829         ret = lxc_terminal_map_ids(conf, &conf->console);
 830         if (ret < 0) {
 831                 ERROR("Failed to chown console");
 832                 goto out_delete_terminal;
 833         }
 834         TRACE("Chowned console");
 835
 836         handler->cgroup_ops = cgroup_init(handler->conf);
 837         if (!handler->cgroup_ops) {
 838                 ERROR("Failed to initialize cgroup driver");
 839                 goto out_delete_terminal;
 840         }
 841         TRACE("Initialized cgroup driver");
 842
 843         ret = lsm_process_prepare(conf, handler->lxcpath);
 844         if (ret < 0) {
 845                 ERROR("Failed to initialize LSM");
 846                 goto out_delete_terminal;
 847         }
 848         TRACE("Initialized LSM");
 849
 850         INFO("Container \"%s\" is initialized", name);
 851         handler->monitor_status_fd = move_fd(status_fd);
 852         return 0;
 853
 854 out_delete_terminal:
 855         lxc_terminal_delete(&handler->conf->console);
 856
 857 out_restore_sigmask:
 858         (void)pthread_sigmask(SIG_SETMASK, &handler->oldmask, NULL);
 859
 860         return -1;
 861 }
 862
 863 void lxc_fini(const char *name, struct lxc_handler *handler)
 864 {
 865         int ret;
 866         pid_t self;
 867         struct lxc_list *cur, *next;
 868         char *namespaces[LXC_NS_MAX + 1];
 869         size_t namespace_count = 0;
 870         struct cgroup_ops *cgroup_ops = handler->cgroup_ops;
 871
 872         /* The STOPPING state is there for future cleanup code which can take
 873          * awhile.
 874          */
 875         lxc_set_state(name, handler, STOPPING);
 876
 877         self = lxc_raw_getpid();
 878         for (int i = 0; i < LXC_NS_MAX; i++) {
 879                 if (handler->nsfd[i] < 0)
 880                         continue;
 881
 882                 if (handler->conf->hooks_version == 0)
 883                         ret = asprintf(&namespaces[namespace_count],
 884                                       "%s:/proc/%d/fd/%d", ns_info[i].proc_name,
 885                                       self, handler->nsfd[i]);
 886                 else
 887                         ret = asprintf(&namespaces[namespace_count],
 888                                       "/proc/%d/fd/%d", self, handler->nsfd[i]);
 889                 if (ret < 0) {
 890                         SYSERROR("Failed to allocate memory");
 891                         break;
 892                 }
 893
 894                 if (handler->conf->hooks_version == 0) {
 895                         namespace_count++;
 896                         continue;
 897                 }
 898
 899                 ret = setenv(ns_info[i].env_name, namespaces[namespace_count], 1);
 900                 if (ret < 0)
 901                         SYSERROR("Failed to set environment variable %s=%s",
 902                                  ns_info[i].env_name, namespaces[namespace_count]);
 903                 else
 904                         TRACE("Set environment variable %s=%s",
 905                               ns_info[i].env_name, namespaces[namespace_count]);
 906
 907                 namespace_count++;
 908         }
 909         namespaces[namespace_count] = NULL;
 910
 911         if (handler->conf->reboot > REBOOT_NONE) {
 912                 ret = setenv("LXC_TARGET", "reboot", 1);
 913                 if (ret < 0)
 914                         SYSERROR("Failed to set environment variable: LXC_TARGET=reboot");
 915         }
 916
 917         if (handler->conf->reboot == REBOOT_NONE) {
 918                 ret = setenv("LXC_TARGET", "stop", 1);
 919                 if (ret < 0)
 920                         SYSERROR("Failed to set environment variable: LXC_TARGET=stop");
 921         }
 922
 923         if (handler->conf->hooks_version == 0)
 924                 ret = run_lxc_hooks(name, "stop", handler->conf, namespaces);
 925         else
 926                 ret = run_lxc_hooks(name, "stop", handler->conf, NULL);
 927         if (ret < 0)
 928                 ERROR("Failed to run \"lxc.hook.stop\" hook");
 929
 930         while (namespace_count--)
 931                 free(namespaces[namespace_count]);
 932
 933         lsm_process_cleanup(handler->conf, handler->lxcpath);
 934
 935         if (cgroup_ops) {
 936                 cgroup_ops->payload_destroy(cgroup_ops, handler);
 937                 cgroup_ops->monitor_destroy(cgroup_ops, handler);
 938         }
 939
 940         if (handler->conf->reboot == REBOOT_NONE) {
 941                 /* For all new state clients simply close the command socket.
 942                  * This will inform all state clients that the container is
 943                  * STOPPED and also prevents a race between a open()/close() on
 944                  * the command socket causing a new process to get ECONNREFUSED
 945                  * because we haven't yet closed the command socket.
 946                  */
 947                 close_prot_errno_disarm(handler->conf->maincmd_fd);
 948                 TRACE("Closed command socket");
 949
 950                 /* This function will try to connect to the legacy lxc-monitord
 951                  * state server and only exists for backwards compatibility.
 952                  */
 953                 lxc_monitor_send_state(name, STOPPED, handler->lxcpath);
 954
 955                 /* The command socket is closed so no one can acces the command
 956                  * socket anymore so there's no need to lock it.
 957                  */
 958                 handler->state = STOPPED;
 959                 TRACE("Set container state to \"STOPPED\"");
 960         } else {
 961                 lxc_set_state(name, handler, STOPPED);
 962         }
 963
 964         /* Avoid lingering namespace references. */
 965         lxc_put_nsfds(handler);
 966
 967         ret = run_lxc_hooks(name, "post-stop", handler->conf, NULL);
 968         if (ret < 0) {
 969                 ERROR("Failed to run lxc.hook.post-stop for container \"%s\"", name);
 970                 if (handler->conf->reboot > REBOOT_NONE) {
 971                         WARN("Container will be stopped instead of rebooted");
 972                         handler->conf->reboot = REBOOT_NONE;
 973
 974                         ret = setenv("LXC_TARGET", "stop", 1);
 975                         if (ret < 0)
 976                                 WARN("Failed to set environment variable: LXC_TARGET=stop");
 977                 }
 978         }
 979
 980         /* Reset mask set by setup_signal_fd. */
 981         ret = pthread_sigmask(SIG_SETMASK, &handler->oldmask, NULL);
 982         if (ret < 0)
 983                 SYSWARN("Failed to restore signal mask");
 984
 985         lxc_terminal_delete(&handler->conf->console);
 986         lxc_delete_tty(&handler->conf->ttys);
 987
 988         /* The command socket is now closed, no more state clients can register
 989          * themselves from now on. So free the list of state clients.
 990          */
 991         lxc_list_for_each_safe(cur, &handler->conf->state_clients, next) {
 992                 struct lxc_state_client *client = cur->elem;
 993
 994                 /* Keep state clients that want to be notified about reboots. */
 995                 if ((handler->conf->reboot > REBOOT_NONE) &&
 996                     (client->states[RUNNING] == 2))
 997                         continue;
 998
 999                 /* close state client socket */
1000                 lxc_list_del(cur);
1001                 close(client->clientfd);
1002                 free(cur->elem);
1003                 free(cur);
1004         }
1005
1006         if (handler->conf->ephemeral == 1 && handler->conf->reboot != REBOOT_REQ)
1007                 lxc_destroy_container_on_signal(handler, name);
1008
1009         lxc_free_handler(handler);
1010 }
1011
1012 void lxc_abort(const char *name, struct lxc_handler *handler)
1013 {
1014         int ret = 0;
1015         int status;
1016
1017         lxc_set_state(name, handler, ABORTING);
1018
1019         if (handler->pidfd >= 0) {
1020                 ret = lxc_raw_pidfd_send_signal(handler->pidfd, SIGKILL, NULL, 0);
1021                 if (ret)
1022                         SYSWARN("Failed to send SIGKILL via pidfd %d for process %d",
1023                                 handler->pidfd, handler->pid);
1024         }
1025
1026         if ((!ret || errno != ESRCH) && handler->pid > 0)
1027                 if (kill(handler->pid, SIGKILL))
1028                         SYSWARN("Failed to send SIGKILL to %d", handler->pid);
1029
1030         do {
1031                 ret = waitpid(-1, &status, 0);
1032         } while (ret > 0);
1033 }
1034
1035 static int do_start(void *data)
1036 {
1037         struct lxc_handler *handler = data;
1038         __lxc_unused __do_close int data_sock0 = handler->data_sock[0],
1039                                            data_sock1 = handler->data_sock[1];
1040         __do_close int status_fd = -EBADF;
1041         int ret;
1042         uid_t new_uid;
1043         gid_t new_gid;
1044         struct lxc_list *iterator;
1045         uid_t nsuid = 0;
1046         gid_t nsgid = 0;
1047         int devnull_fd = -1;
1048
1049         lxc_sync_fini_parent(handler);
1050
1051         if (lxc_abstract_unix_recv_fds(data_sock1, &status_fd, 1, NULL, 0) < 0) {
1052                 ERROR("Failed to receive status file descriptor to child process");
1053                 goto out_warn_father;
1054         }
1055
1056         /* This prctl must be before the synchro, so if the parent dies before
1057          * we set the parent death signal, we will detect its death with the
1058          * synchro right after, otherwise we have a window where the parent can
1059          * exit before we set the pdeath signal leading to a unsupervized
1060          * container.
1061          */
1062         ret = lxc_set_death_signal(SIGKILL, handler->monitor_pid, status_fd);
1063         if (ret < 0) {
1064                 SYSERROR("Failed to set PR_SET_PDEATHSIG to SIGKILL");
1065                 goto out_warn_father;
1066         }
1067
1068         ret = lxc_ambient_caps_up();
1069         if (ret < 0) {
1070                 ERROR("Failed to raise ambient capabilities");
1071                 goto out_warn_father;
1072         }
1073
1074         ret = pthread_sigmask(SIG_SETMASK, &handler->oldmask, NULL);
1075         if (ret < 0) {
1076                 SYSERROR("Failed to set signal mask");
1077                 goto out_warn_father;
1078         }
1079
1080         /* Don't leak the pinfd to the container. */
1081         close_prot_errno_disarm(handler->pinfd);
1082
1083         ret = lxc_sync_wait_parent(handler, LXC_SYNC_STARTUP);
1084         if (ret < 0)
1085                 goto out_warn_father;
1086
1087         /* Unshare CLONE_NEWNET after CLONE_NEWUSER. See
1088          * https://github.com/lxc/lxd/issues/1978.
1089          */
1090         if ((handler->ns_clone_flags & (CLONE_NEWNET | CLONE_NEWUSER)) ==
1091             (CLONE_NEWNET | CLONE_NEWUSER)) {
1092                 ret = unshare(CLONE_NEWNET);
1093                 if (ret < 0) {
1094                         SYSERROR("Failed to unshare CLONE_NEWNET");
1095                         goto out_warn_father;
1096                 }
1097                 INFO("Unshared CLONE_NEWNET");
1098         }
1099
1100         /* Tell the parent task it can begin to configure the container and wait
1101          * for it to finish.
1102          */
1103         ret = lxc_sync_barrier_parent(handler, LXC_SYNC_CONFIGURE);
1104         if (ret < 0)
1105                 goto out_error;
1106
1107         if (handler->ns_clone_flags & CLONE_NEWNET) {
1108                 ret = lxc_network_recv_from_parent(handler);
1109                 if (ret < 0) {
1110                         ERROR("Failed to receive veth names from parent");
1111                         goto out_warn_father;
1112                 }
1113         }
1114
1115         /* If we are in a new user namespace, become root there to have
1116          * privilege over our namespace.
1117          */
1118         if (!lxc_list_empty(&handler->conf->id_map)) {
1119                 if (!handler->conf->root_nsuid_map)
1120                         nsuid = handler->conf->init_uid;
1121
1122                 if (!handler->conf->root_nsgid_map)
1123                         nsgid = handler->conf->init_gid;
1124
1125                 /* Drop groups only after we switched to a valid gid in the new
1126                  * user namespace.
1127                  */
1128                 if (!lxc_setgroups(0, NULL) &&
1129                     (handler->am_root || errno != EPERM))
1130                         goto out_warn_father;
1131
1132                 if (!lxc_switch_uid_gid(nsuid, nsgid))
1133                         goto out_warn_father;
1134
1135                 ret = prctl(PR_SET_DUMPABLE, prctl_arg(1), prctl_arg(0),
1136                             prctl_arg(0), prctl_arg(0));
1137                 if (ret < 0)
1138                         goto out_warn_father;
1139
1140                 /* set{g,u}id() clears deathsignal */
1141                 ret = lxc_set_death_signal(SIGKILL, handler->monitor_pid, status_fd);
1142                 if (ret < 0) {
1143                         SYSERROR("Failed to set PR_SET_PDEATHSIG to SIGKILL");
1144                         goto out_warn_father;
1145                 }
1146         }
1147
1148         ret = access(handler->lxcpath, X_OK);
1149         if (ret != 0) {
1150                 print_top_failing_dir(handler->lxcpath);
1151                 goto out_warn_father;
1152         }
1153
1154         /* In order to checkpoint restore, we need to have everything in the
1155          * same mount namespace. However, some containers may not have a
1156          * reasonable /dev (in particular, they may not have /dev/null), so we
1157          * can't set init's std fds to /dev/null by opening it from inside the
1158          * container.
1159          *
1160          * If that's the case, fall back to using the host's /dev/null. This
1161          * means that migration won't work, but at least we won't spew output
1162          * where it isn't wanted.
1163          */
1164         if (handler->daemonize && !handler->conf->autodev) {
1165                 char path[PATH_MAX];
1166
1167                 ret = snprintf(path, sizeof(path), "%s/dev/null",
1168                                handler->conf->rootfs.mount);
1169                 if (ret < 0 || ret >= sizeof(path))
1170                         goto out_warn_father;
1171
1172                 ret = access(path, F_OK);
1173                 if (ret != 0) {
1174                         devnull_fd = open_devnull();
1175
1176                         if (devnull_fd < 0)
1177                                 goto out_warn_father;
1178                         WARN("Using /dev/null from the host for container init's standard file descriptors. Migration will not work");
1179                 }
1180         }
1181
1182         /* Ask father to setup cgroups and wait for him to finish. */
1183         ret = lxc_sync_barrier_parent(handler, LXC_SYNC_CGROUP);
1184         if (ret < 0)
1185                 goto out_error;
1186
1187         /* Unshare cgroup namespace after we have setup our cgroups. If we do it
1188          * earlier we end up with a wrong view of /proc/self/cgroup. For
1189          * example, assume we unshare(CLONE_NEWCGROUP) first, and then create
1190          * the cgroup for the container, say /sys/fs/cgroup/cpuset/lxc/c, then
1191          * /proc/self/cgroup would show us:
1192          *
1193          *      8:cpuset:/lxc/c
1194          *
1195          * whereas it should actually show
1196          *
1197          *      8:cpuset:/
1198          */
1199         if (handler->ns_clone_flags & CLONE_NEWCGROUP) {
1200                 ret = unshare(CLONE_NEWCGROUP);
1201                 if (ret < 0) {
1202                         if (errno != EINVAL) {
1203                                 SYSERROR("Failed to unshare CLONE_NEWCGROUP");
1204                                 goto out_warn_father;
1205                         }
1206
1207                         handler->ns_clone_flags &= ~CLONE_NEWCGROUP;
1208                         SYSINFO("Kernel does not support CLONE_NEWCGROUP");
1209                 } else {
1210                         INFO("Unshared CLONE_NEWCGROUP");
1211                 }
1212         }
1213
1214         /* Add the requested environment variables to the current environment to
1215          * allow them to be used by the various hooks, such as the start hook
1216          * below.
1217          */
1218         lxc_list_for_each(iterator, &handler->conf->environment) {
1219                 ret = putenv((char *)iterator->elem);
1220                 if (ret < 0) {
1221                         SYSERROR("Failed to set environment variable: %s",
1222                                  (char *)iterator->elem);
1223                         goto out_warn_father;
1224                 }
1225         }
1226
1227         /* Setup the container, ip, names, utsname, ... */
1228         ret = lxc_setup(handler);
1229         if (ret < 0) {
1230                 ERROR("Failed to setup container \"%s\"", handler->name);
1231                 goto out_warn_father;
1232         }
1233
1234         /* Set the label to change to when we exec(2) the container's init. */
1235         ret = lsm_process_label_set(NULL, handler->conf, true);
1236         if (ret < 0)
1237                 goto out_warn_father;
1238
1239         /* Set PR_SET_NO_NEW_PRIVS after we changed the lsm label. If we do it
1240          * before we aren't allowed anymore.
1241          */
1242         if (handler->conf->no_new_privs) {
1243                 ret = prctl(PR_SET_NO_NEW_PRIVS, prctl_arg(1), prctl_arg(0),
1244                             prctl_arg(0), prctl_arg(0));
1245                 if (ret < 0) {
1246                         SYSERROR("Could not set PR_SET_NO_NEW_PRIVS to block execve() gainable privileges");
1247                         goto out_warn_father;
1248                 }
1249                 DEBUG("Set PR_SET_NO_NEW_PRIVS to block execve() gainable privileges");
1250         }
1251
1252         /* Some init's such as busybox will set sane tty settings on stdin,
1253          * stdout, stderr which it thinks is the console. We already set them
1254          * the way we wanted on the real terminal, and we want init to do its
1255          * setup on its console ie. the pty allocated in lxc_terminal_setup() so
1256          * make sure that that pty is stdin,stdout,stderr.
1257          */
1258          if (handler->conf->console.slave >= 0) {
1259                  if (handler->daemonize || !handler->conf->is_execute)
1260                          ret = set_stdfds(handler->conf->console.slave);
1261                  else
1262                          ret = lxc_terminal_set_stdfds(handler->conf->console.slave);
1263                  if (ret < 0) {
1264                         ERROR("Failed to redirect std{in,out,err} to pty file descriptor %d",
1265                               handler->conf->console.slave);
1266                         goto out_warn_father;
1267                  }
1268          }
1269
1270         /* If we mounted a temporary proc, then unmount it now. */
1271         tmp_proc_unmount(handler->conf);
1272
1273         ret = lxc_seccomp_load(handler->conf);
1274         if (ret < 0)
1275                 goto out_warn_father;
1276
1277         ret = lxc_seccomp_send_notifier_fd(&handler->conf->seccomp, data_sock0);
1278         if (ret < 0) {
1279                 SYSERROR("Failed to send seccomp notify fd to parent");
1280                 goto out_warn_father;
1281         }
1282
1283         ret = run_lxc_hooks(handler->name, "start", handler->conf, NULL);
1284         if (ret < 0) {
1285                 ERROR("Failed to run lxc.hook.start for container \"%s\"",
1286                       handler->name);
1287                 goto out_warn_father;
1288         }
1289
1290         close_prot_errno_disarm(handler->sigfd);
1291
1292         if (handler->conf->console.slave < 0 && handler->daemonize) {
1293                 if (devnull_fd < 0) {
1294                         devnull_fd = open_devnull();
1295                         if (devnull_fd < 0)
1296                                 goto out_warn_father;
1297                 }
1298
1299                 ret = set_stdfds(devnull_fd);
1300                 if (ret < 0) {
1301                         ERROR("Failed to redirect std{in,out,err} to \"/dev/null\"");
1302                         goto out_warn_father;
1303                 }
1304         }
1305
1306         close_prot_errno_disarm(devnull_fd);
1307
1308         setsid();
1309
1310         if (handler->conf->init_cwd) {
1311                 ret = chdir(handler->conf->init_cwd);
1312                 if (ret < 0) {
1313                         SYSERROR("Could not change directory to \"%s\"",
1314                                  handler->conf->init_cwd);
1315                         goto out_warn_father;
1316                 }
1317         }
1318
1319         ret = lxc_sync_barrier_parent(handler, LXC_SYNC_CGROUP_LIMITS);
1320         if (ret < 0)
1321                 goto out_warn_father;
1322
1323         /* Reset the environment variables the user requested in a clear
1324          * environment.
1325          */
1326         ret = clearenv();
1327         /* Don't error out though. */
1328         if (ret < 0)
1329                 SYSERROR("Failed to clear environment.");
1330
1331         lxc_list_for_each(iterator, &handler->conf->environment) {
1332                 ret = putenv((char *)iterator->elem);
1333                 if (ret < 0) {
1334                         SYSERROR("Failed to set environment variable: %s",
1335                                  (char *)iterator->elem);
1336                         goto out_warn_father;
1337                 }
1338         }
1339
1340         ret = putenv("container=lxc");
1341         if (ret < 0) {
1342                 SYSERROR("Failed to set environment variable: container=lxc");
1343                 goto out_warn_father;
1344         }
1345
1346         if (handler->conf->ttys.tty_names) {
1347                 ret = putenv(handler->conf->ttys.tty_names);
1348                 if (ret < 0) {
1349                         SYSERROR("Failed to set environment variable for container ptys");
1350                         goto out_warn_father;
1351                 }
1352         }
1353
1354         /* The container has been setup. We can now switch to an unprivileged
1355          * uid/gid.
1356          */
1357         new_uid = handler->conf->init_uid;
1358         new_gid = handler->conf->init_gid;
1359
1360         /* Avoid unnecessary syscalls. */
1361         if (new_uid == nsuid)
1362                 new_uid = LXC_INVALID_UID;
1363
1364         if (new_gid == nsgid)
1365                 new_gid = LXC_INVALID_GID;
1366
1367         /* If we are in a new user namespace we already dropped all groups when
1368          * we switched to root in the new user namespace further above. Only
1369          * drop groups if we can, so ensure that we have necessary privilege.
1370          */
1371         if (lxc_list_empty(&handler->conf->id_map))
1372                 #if HAVE_LIBCAP
1373                 if (lxc_proc_cap_is_set(CAP_SETGID, CAP_EFFECTIVE))
1374                 #endif
1375                         if (!lxc_setgroups(0, NULL))
1376                                 goto out_warn_father;
1377
1378         if (!lxc_switch_uid_gid(new_uid, new_gid))
1379                 goto out_warn_father;
1380
1381         ret = lxc_ambient_caps_down();
1382         if (ret < 0) {
1383                 ERROR("Failed to clear ambient capabilities");
1384                 goto out_warn_father;
1385         }
1386
1387         if (handler->conf->monitor_signal_pdeath != SIGKILL) {
1388                 ret = lxc_set_death_signal(handler->conf->monitor_signal_pdeath,
1389                                            handler->monitor_pid, status_fd);
1390                 if (ret < 0) {
1391                         SYSERROR("Failed to set PR_SET_PDEATHSIG to %d",
1392                                  handler->conf->monitor_signal_pdeath);
1393                         goto out_warn_father;
1394                 }
1395         }
1396
1397         /* After this call, we are in error because this ops should not return
1398          * as it execs.
1399          */
1400         handler->ops->start(handler, handler->data);
1401
1402 out_warn_father:
1403         /* We want the parent to know something went wrong, so we return a
1404          * special error code.
1405          */
1406         lxc_sync_wake_parent(handler, LXC_SYNC_ERROR);
1407
1408 out_error:
1409         close_prot_errno_disarm(devnull_fd);
1410
1411         return -1;
1412 }
1413
1414 static int lxc_recv_ttys_from_child(struct lxc_handler *handler)
1415 {
1416         int i;
1417         struct lxc_terminal_info *tty;
1418         int ret = -1;
1419         int sock = handler->data_sock[1];
1420         struct lxc_conf *conf = handler->conf;
1421         struct lxc_tty_info *ttys = &conf->ttys;
1422
1423         if (!conf->ttys.max)
1424                 return 0;
1425
1426         ttys->tty = malloc(sizeof(*ttys->tty) * ttys->max);
1427         if (!ttys->tty)
1428                 return -1;
1429
1430         for (i = 0; i < conf->ttys.max; i++) {
1431                 int ttyfds[2];
1432
1433                 ret = lxc_abstract_unix_recv_fds(sock, ttyfds, 2, NULL, 0);
1434                 if (ret < 0)
1435                         break;
1436
1437                 tty = &ttys->tty[i];
1438                 tty->busy = -1;
1439                 tty->master = ttyfds[0];
1440                 tty->slave = ttyfds[1];
1441                 TRACE("Received pty with master fd %d and slave fd %d from child", tty->master, tty->slave);
1442         }
1443
1444         if (ret < 0)
1445                 SYSERROR("Failed to receive %zu ttys from child", ttys->max);
1446         else
1447                 TRACE("Received %zu ttys from child", ttys->max);
1448
1449         return ret;
1450 }
1451
1452 int resolve_clone_flags(struct lxc_handler *handler)
1453 {
1454         int i;
1455         struct lxc_conf *conf = handler->conf;
1456
1457         for (i = 0; i < LXC_NS_MAX; i++) {
1458                 if (conf->ns_keep) {
1459                         if (!(conf->ns_keep & ns_info[i].clone_flag))
1460                                 handler->ns_clone_flags |= ns_info[i].clone_flag;
1461                 } else if (conf->ns_clone) {
1462                         if ((conf->ns_clone & ns_info[i].clone_flag))
1463                                 handler->ns_clone_flags |= ns_info[i].clone_flag;
1464                 } else {
1465                         if (i == LXC_NS_USER && lxc_list_empty(&handler->conf->id_map))
1466                                 continue;
1467
1468                         if (i == LXC_NS_NET && lxc_requests_empty_network(handler))
1469                                 continue;
1470
1471                         if (i == LXC_NS_CGROUP && !cgns_supported())
1472                                 continue;
1473
1474                         handler->ns_clone_flags |= ns_info[i].clone_flag;
1475                 }
1476
1477                 if (!conf->ns_share[i])
1478                         continue;
1479
1480                 handler->ns_clone_flags &= ~ns_info[i].clone_flag;
1481                 TRACE("Sharing %s namespace", ns_info[i].proc_name);
1482         }
1483
1484         return 0;
1485 }
1486
1487 /* Note that this function is used with clone(CLONE_VM). Some glibc versions
1488  * used to reset the pid/tid to -1 when CLONE_VM was used without CLONE_THREAD.
1489  * But since the memory between parent and child is shared on CLONE_VM this
1490  * would invalidate the getpid() cache that glibc used to maintain and so
1491  * getpid() in the child would return the parent's pid. This is all fixed in
1492  * newer glibc versions where the getpid() cache is removed and the pid/tid is
1493  * not reset anymore.
1494  * However, if for whatever reason you - dear committer - somehow need to get the
1495  * pid of the dummy intermediate process for do_share_ns() you need to call
1496  * lxc_raw_getpid(). The next lxc_raw_clone() call does not employ CLONE_VM and
1497  * will be fine.
1498  */
1499 static inline int do_share_ns(void *arg)
1500 {
1501         int i, flags, ret;
1502         struct lxc_handler *handler = arg;
1503
1504         for (i = 0; i < LXC_NS_MAX; i++) {
1505                 if (handler->nsfd[i] < 0)
1506                         continue;
1507
1508                 ret = setns(handler->nsfd[i], 0);
1509                 if (ret < 0) {
1510                         /*
1511                          * Note that joining a user and/or mount namespace
1512                          * requires the process is not multithreaded otherwise
1513                          * setns() will fail here.
1514                          */
1515                         SYSERROR("Failed to inherit %s namespace",
1516                                  ns_info[i].proc_name);
1517                         return -1;
1518                 }
1519
1520                 DEBUG("Inherited %s namespace", ns_info[i].proc_name);
1521         }
1522
1523         flags = handler->ns_on_clone_flags;
1524         flags |= CLONE_PARENT;
1525         handler->pid = lxc_raw_clone_cb(do_start, handler, CLONE_PIDFD | flags,
1526                                         &handler->pidfd);
1527         if (handler->pid < 0)
1528                 return -1;
1529
1530         return 0;
1531 }
1532
1533 /* lxc_spawn() performs crucial setup tasks and clone()s the new process which
1534  * exec()s the requested container binary.
1535  * Note that lxc_spawn() runs in the parent namespaces. Any operations performed
1536  * right here should be double checked if they'd pose a security risk. (For
1537  * example, any {u}mount() operations performed here will be reflected on the
1538  * host!)
1539  */
1540 static int lxc_spawn(struct lxc_handler *handler)
1541 {
1542         __do_close int data_sock0 = -EBADF, data_sock1 = -EBADF;
1543         int i, ret;
1544         char pidstr[20];
1545         bool wants_to_map_ids;
1546         struct lxc_list *id_map;
1547         const char *name = handler->name;
1548         const char *lxcpath = handler->lxcpath;
1549         bool share_ns = false;
1550         struct lxc_conf *conf = handler->conf;
1551         struct cgroup_ops *cgroup_ops = handler->cgroup_ops;
1552
1553         id_map = &conf->id_map;
1554         wants_to_map_ids = !lxc_list_empty(id_map);
1555
1556         for (i = 0; i < LXC_NS_MAX; i++) {
1557                 if (!conf->ns_share[i])
1558                         continue;
1559
1560                 handler->nsfd[i] = lxc_inherit_namespace(conf->ns_share[i], lxcpath, ns_info[i].proc_name);
1561                 if (handler->nsfd[i] < 0)
1562                         return -1;
1563
1564                 share_ns = true;
1565         }
1566
1567         ret = lxc_sync_init(handler);
1568         if (ret < 0)
1569                 return -1;
1570
1571         ret = socketpair(AF_UNIX, SOCK_STREAM | SOCK_CLOEXEC, 0,
1572                          handler->data_sock);
1573         if (ret < 0)
1574                 goto out_sync_fini;
1575         data_sock0 = handler->data_sock[0];
1576         data_sock1 = handler->data_sock[1];
1577
1578         ret = resolve_clone_flags(handler);
1579         if (ret < 0)
1580                 goto out_sync_fini;
1581
1582         if (handler->ns_clone_flags & CLONE_NEWNET) {
1583                 ret = lxc_find_gateway_addresses(handler);
1584                 if (ret) {
1585                         ERROR("Failed to find gateway addresses");
1586                         goto out_sync_fini;
1587                 }
1588         }
1589
1590         if (!cgroup_ops->payload_create(cgroup_ops, handler)) {
1591                 ERROR("Failed creating cgroups");
1592                 goto out_delete_net;
1593         }
1594
1595         /* If the rootfs is not a blockdev, prevent the container from marking
1596          * it readonly.
1597          * If the container is unprivileged then skip rootfs pinning.
1598          */
1599         if (!wants_to_map_ids) {
1600                 handler->pinfd = pin_rootfs(conf->rootfs.path);
1601                 if (handler->pinfd == -EBADF)
1602                         INFO("Failed to pin the rootfs for container \"%s\"", handler->name);
1603         }
1604
1605         /* Create a process in a new set of namespaces. */
1606         handler->ns_on_clone_flags = handler->ns_clone_flags;
1607         if (handler->ns_clone_flags & CLONE_NEWUSER) {
1608                 /* If CLONE_NEWUSER and CLONE_NEWNET was requested, we need to
1609                  * clone a new user namespace first and only later unshare our
1610                  * network namespace to ensure that network devices ownership is
1611                  * set up correctly.
1612                  */
1613                 handler->ns_on_clone_flags &= ~CLONE_NEWNET;
1614         }
1615         /* The cgroup namespace gets unshare()ed not clone()ed. */
1616         handler->ns_on_clone_flags &= ~CLONE_NEWCGROUP;
1617
1618         if (share_ns) {
1619                 pid_t attacher_pid;
1620
1621                 attacher_pid = lxc_clone(do_share_ns, handler,
1622                                          CLONE_VFORK | CLONE_VM | CLONE_FILES, NULL);
1623                 if (attacher_pid < 0) {
1624                         SYSERROR(LXC_CLONE_ERROR);
1625                         goto out_delete_net;
1626                 }
1627
1628                 ret = wait_for_pid(attacher_pid);
1629                 if (ret < 0) {
1630                         SYSERROR("Intermediate process failed");
1631                         goto out_delete_net;
1632                 }
1633         } else {
1634                 handler->pid = lxc_raw_clone_cb(do_start, handler,
1635                                                 CLONE_PIDFD | handler->ns_on_clone_flags,
1636                                                 &handler->pidfd);
1637         }
1638         if (handler->pid < 0) {
1639                 SYSERROR(LXC_CLONE_ERROR);
1640                 goto out_delete_net;
1641         }
1642         TRACE("Cloned child process %d", handler->pid);
1643
1644         /* Verify that we can actually make use of pidfds. */
1645         if (!lxc_can_use_pidfd(handler->pidfd))
1646                 close_prot_errno_disarm(handler->pidfd);
1647
1648         ret = snprintf(pidstr, 20, "%d", handler->pid);
1649         if (ret < 0 || ret >= 20)
1650                 goto out_delete_net;
1651
1652         ret = setenv("LXC_PID", pidstr, 1);
1653         if (ret < 0)
1654                 SYSERROR("Failed to set environment variable: LXC_PID=%s", pidstr);
1655
1656         for (i = 0; i < LXC_NS_MAX; i++)
1657                 if (handler->ns_on_clone_flags & ns_info[i].clone_flag)
1658                         INFO("Cloned %s", ns_info[i].flag_name);
1659
1660         if (!lxc_try_preserve_namespaces(handler, handler->ns_on_clone_flags, handler->pid)) {
1661                 ERROR("Failed to preserve cloned namespaces for lxc.hook.stop");
1662                 goto out_delete_net;
1663         }
1664
1665         lxc_sync_fini_child(handler);
1666
1667         if (lxc_abstract_unix_send_fds(handler->data_sock[0], &handler->monitor_status_fd, 1, NULL, 0) < 0) {
1668                 ERROR("Failed to send status file descriptor to child process");
1669                 goto out_delete_net;
1670         }
1671         close_prot_errno_disarm(handler->monitor_status_fd);
1672
1673         /* Map the container uids. The container became an invalid userid the
1674          * moment it was cloned with CLONE_NEWUSER. This call doesn't change
1675          * anything immediately, but allows the container to setuid(0) (0 being
1676          * mapped to something else on the host.) later to become a valid uid
1677          * again.
1678          */
1679         if (wants_to_map_ids) {
1680                 if (!handler->conf->ns_share[LXC_NS_USER] &&
1681                     (handler->conf->ns_keep & CLONE_NEWUSER) == 0) {
1682                         ret = lxc_map_ids(id_map, handler->pid);
1683                         if (ret < 0) {
1684                                 ERROR("Failed to set up id mapping.");
1685                                 goto out_delete_net;
1686                         }
1687                 }
1688         }
1689
1690         ret = lxc_sync_wake_child(handler, LXC_SYNC_STARTUP);
1691         if (ret < 0)
1692                 goto out_delete_net;
1693
1694         ret = lxc_sync_wait_child(handler, LXC_SYNC_CONFIGURE);
1695         if (ret < 0)
1696                 goto out_delete_net;
1697
1698         if (!cgroup_ops->setup_limits_legacy(cgroup_ops, handler->conf, false)) {
1699                 ERROR("Failed to setup cgroup limits for container \"%s\"", name);
1700                 goto out_delete_net;
1701         }
1702
1703         if (!cgroup_ops->payload_enter(cgroup_ops, handler)) {
1704                 goto out_delete_net;
1705         }
1706
1707         if (!cgroup_ops->payload_delegate_controllers(cgroup_ops)) {
1708                 ERROR("Failed to delegate controllers to payload cgroup");
1709                 goto out_delete_net;
1710         }
1711
1712         if (!cgroup_ops->setup_limits(cgroup_ops, handler)) {
1713                 ERROR("Failed to setup cgroup limits for container \"%s\"", name);
1714                 goto out_delete_net;
1715         }
1716
1717         if (!cgroup_ops->chown(cgroup_ops, handler->conf))
1718                 goto out_delete_net;
1719
1720         /* If not done yet, we're now ready to preserve the network namespace */
1721         if (handler->nsfd[LXC_NS_NET] < 0) {
1722                 ret = lxc_try_preserve_ns(handler->pid, "net");
1723                 if (ret < 0) {
1724                         if (ret != -EOPNOTSUPP) {
1725                                 SYSERROR("Failed to preserve net namespace");
1726                                 goto out_delete_net;
1727                         }
1728                 } else {
1729                         handler->nsfd[LXC_NS_NET] = ret;
1730                         DEBUG("Preserved net namespace via fd %d", ret);
1731                 }
1732         }
1733         ret = lxc_netns_set_nsid(handler->nsfd[LXC_NS_NET]);
1734         if (ret < 0)
1735                 SYSWARN("Failed to allocate new network namespace id");
1736         else
1737                 TRACE("Allocated new network namespace id");
1738
1739         /* Create the network configuration. */
1740         if (handler->ns_clone_flags & CLONE_NEWNET) {
1741                 ret = lxc_create_network(handler);
1742                 if (ret < 0) {
1743                         ERROR("Failed to create the network");
1744                         goto out_delete_net;
1745                 }
1746
1747                 ret = lxc_network_send_to_child(handler);
1748                 if (ret < 0) {
1749                         ERROR("Failed to send veth names to child");
1750                         goto out_delete_net;
1751                 }
1752         }
1753
1754         if (!lxc_list_empty(&conf->procs)) {
1755                 ret = setup_proc_filesystem(&conf->procs, handler->pid);
1756                 if (ret < 0)
1757                         goto out_delete_net;
1758         }
1759
1760         /* Tell the child to continue its initialization. We'll get
1761          * LXC_SYNC_CGROUP when it is ready for us to setup cgroups.
1762          */
1763         ret = lxc_sync_barrier_child(handler, LXC_SYNC_POST_CONFIGURE);
1764         if (ret < 0)
1765                 goto out_delete_net;
1766
1767         if (!lxc_list_empty(&conf->limits)) {
1768                 ret = setup_resource_limits(&conf->limits, handler->pid);
1769                 if (ret < 0) {
1770                         ERROR("Failed to setup resource limits");
1771                         goto out_delete_net;
1772                 }
1773         }
1774
1775         ret = lxc_sync_barrier_child(handler, LXC_SYNC_CGROUP_UNSHARE);
1776         if (ret < 0)
1777                 goto out_delete_net;
1778
1779         if (!cgroup_ops->setup_limits_legacy(cgroup_ops, handler->conf, true)) {
1780                 ERROR("Failed to setup legacy device cgroup controller limits");
1781                 goto out_delete_net;
1782         }
1783         TRACE("Set up legacy device cgroup controller limits");
1784
1785         if (!cgroup_ops->devices_activate(cgroup_ops, handler)) {
1786                 ERROR("Failed to setup cgroup2 device controller limits");
1787                 goto out_delete_net;
1788         }
1789         TRACE("Set up cgroup2 device controller limits");
1790
1791         if (handler->ns_clone_flags & CLONE_NEWCGROUP) {
1792                 /* Now we're ready to preserve the cgroup namespace */
1793                 ret = lxc_try_preserve_ns(handler->pid, "cgroup");
1794                 if (ret < 0) {
1795                         if (ret != -EOPNOTSUPP) {
1796                                 SYSERROR("Failed to preserve cgroup namespace");
1797                                 goto out_delete_net;
1798                         }
1799                 } else {
1800                         handler->nsfd[LXC_NS_CGROUP] = ret;
1801                         DEBUG("Preserved cgroup namespace via fd %d", ret);
1802                 }
1803         }
1804
1805         cgroup_ops->payload_finalize(cgroup_ops);
1806         TRACE("Finished setting up cgroups");
1807
1808         /* Run any host-side start hooks */
1809         ret = run_lxc_hooks(name, "start-host", conf, NULL);
1810         if (ret < 0) {
1811                 ERROR("Failed to run lxc.hook.start-host");
1812                 goto out_delete_net;
1813         }
1814
1815         /* Tell the child to complete its initialization and wait for it to exec
1816          * or return an error. (The child will never return
1817          * LXC_SYNC_READY_START+1. It will either close the sync pipe, causing
1818          * lxc_sync_barrier_child to return success, or return a different
1819          * value, causing us to error out).
1820          */
1821         ret = lxc_sync_barrier_child(handler, LXC_SYNC_READY_START);
1822         if (ret < 0)
1823                 goto out_delete_net;
1824
1825         if (handler->ns_clone_flags & CLONE_NEWNET) {
1826                 ret = lxc_network_recv_name_and_ifindex_from_child(handler);
1827                 if (ret < 0) {
1828                         ERROR("Failed to receive names and ifindices for network devices from child");
1829                         goto out_delete_net;
1830                 }
1831         }
1832
1833         /* Now all networks are created, network devices are moved into place,
1834          * and the correct names and ifindices in the respective namespaces have
1835          * been recorded. The corresponding structs have now all been filled. So
1836          * log them for debugging purposes.
1837          */
1838         lxc_log_configured_netdevs(conf);
1839
1840         /* Read tty fds allocated by child. */
1841         ret = lxc_recv_ttys_from_child(handler);
1842         if (ret < 0) {
1843                 ERROR("Failed to receive tty info from child process");
1844                 goto out_delete_net;
1845         }
1846
1847         ret = lxc_seccomp_recv_notifier_fd(&handler->conf->seccomp, data_sock1);
1848         if (ret < 0) {
1849                 SYSERROR("Failed to receive seccomp notify fd from child");
1850                 goto out_delete_net;
1851         }
1852
1853         ret = handler->ops->post_start(handler, handler->data);
1854         if (ret < 0)
1855                 goto out_abort;
1856
1857         ret = lxc_set_state(name, handler, RUNNING);
1858         if (ret < 0) {
1859                 ERROR("Failed to set state to \"%s\"", lxc_state2str(RUNNING));
1860                 goto out_abort;
1861         }
1862
1863         lxc_sync_fini(handler);
1864
1865         return 0;
1866
1867 out_delete_net:
1868         if (handler->ns_clone_flags & CLONE_NEWNET)
1869                 lxc_delete_network(handler);
1870
1871 out_abort:
1872         lxc_abort(name, handler);
1873
1874 out_sync_fini:
1875         lxc_sync_fini(handler);
1876         close_prot_errno_disarm(handler->pinfd);
1877
1878         return -1;
1879 }
1880
1881 int __lxc_start(const char *name, struct lxc_handler *handler,
1882                 struct lxc_operations* ops, void *data, const char *lxcpath,
1883                 bool daemonize, int *error_num)
1884 {
1885         int ret, status;
1886         struct lxc_conf *conf = handler->conf;
1887         struct cgroup_ops *cgroup_ops;
1888
1889         ret = lxc_init(name, handler);
1890         if (ret < 0) {
1891                 ERROR("Failed to initialize container \"%s\"", name);
1892                 goto out_fini_nonet;
1893         }
1894         handler->ops = ops;
1895         handler->data = data;
1896         handler->daemonize = daemonize;
1897         cgroup_ops = handler->cgroup_ops;
1898
1899         if (!attach_block_device(handler->conf)) {
1900                 ERROR("Failed to attach block device");
1901                 ret = -1;
1902                 goto out_fini_nonet;
1903         }
1904
1905         if (!cgroup_ops->monitor_create(cgroup_ops, handler)) {
1906                 ERROR("Failed to create monitor cgroup");
1907                 ret = -1;
1908                 goto out_fini_nonet;
1909         }
1910
1911         if (!cgroup_ops->monitor_enter(cgroup_ops, handler)) {
1912                 ERROR("Failed to enter monitor cgroup");
1913                 ret = -1;
1914                 goto out_fini_nonet;
1915         }
1916
1917         if (!cgroup_ops->monitor_delegate_controllers(cgroup_ops)) {
1918                 ERROR("Failed to delegate controllers to monitor cgroup");
1919                 ret = -1;
1920                 goto out_fini_nonet;
1921         }
1922
1923         if (geteuid() == 0 && !lxc_list_empty(&conf->id_map)) {
1924                 /* If the backing store is a device, mount it here and now. */
1925                 if (rootfs_is_blockdev(conf)) {
1926                         ret = unshare(CLONE_NEWNS);
1927                         if (ret < 0) {
1928                                 ERROR("Failed to unshare CLONE_NEWNS");
1929                                 goto out_fini_nonet;
1930                         }
1931                         INFO("Unshared CLONE_NEWNS");
1932
1933                         remount_all_slave();
1934                         ret = lxc_setup_rootfs_prepare_root(conf, name, lxcpath);
1935                         if (ret < 0) {
1936                                 ERROR("Error setting up rootfs mount as root before spawn");
1937                                 goto out_fini_nonet;
1938                         }
1939                         INFO("Set up container rootfs as host root");
1940                 }
1941         }
1942
1943         ret = lxc_spawn(handler);
1944         if (ret < 0) {
1945                 ERROR("Failed to spawn container \"%s\"", name);
1946                 goto out_detach_blockdev;
1947         }
1948
1949         handler->conf->reboot = REBOOT_NONE;
1950
1951         ret = lxc_poll(name, handler);
1952         if (ret) {
1953                 ERROR("LXC mainloop exited with error: %d", ret);
1954                 goto out_abort;
1955         }
1956
1957         if (!handler->init_died && handler->pid > 0) {
1958                 ERROR("Child process is not killed");
1959                 ret = -1;
1960                 goto out_abort;
1961         }
1962
1963         status = lxc_wait_for_pid_status(handler->pid);
1964         if (status < 0)
1965                 SYSERROR("Failed to retrieve status for %d", handler->pid);
1966
1967         /* If the child process exited but was not signaled, it didn't call
1968          * reboot. This should mean it was an lxc-execute which simply exited.
1969          * In any case, treat it as a 'halt'.
1970          */
1971         if (WIFSIGNALED(status)) {
1972                 switch(WTERMSIG(status)) {
1973                 case SIGINT: /* halt */
1974                         DEBUG("Container \"%s\" is halting", name);
1975                         break;
1976                 case SIGHUP: /* reboot */
1977                         DEBUG("Container \"%s\" is rebooting", name);
1978                         handler->conf->reboot = REBOOT_REQ;
1979                         break;
1980                 case SIGSYS: /* seccomp */
1981                         DEBUG("Container \"%s\" violated its seccomp policy", name);
1982                         break;
1983                 default:
1984                         DEBUG("Unknown exit status for container \"%s\" init %d", name, WTERMSIG(status));
1985                         break;
1986                 }
1987         }
1988
1989         ret = lxc_restore_phys_nics_to_netns(handler);
1990         if (ret < 0)
1991                 ERROR("Failed to move physical network devices back to parent network namespace");
1992
1993         close_prot_errno_disarm(handler->pinfd);
1994
1995         lxc_monitor_send_exit_code(name, status, handler->lxcpath);
1996         lxc_error_set_and_log(handler->pid, status);
1997         if (error_num)
1998                 *error_num = handler->exit_status;
1999
2000 /* These are the goto targets you are not allowed to jump to. */
2001 __out_fini:
2002         lxc_delete_network(handler);
2003
2004 __out_detach_blockdev:
2005         detach_block_device(handler->conf);
2006
2007 __out_fini_nonet:
2008         lxc_fini(name, handler);
2009
2010         return ret;
2011
2012 /* These are the goto targets you want to jump to. */
2013 out_fini_nonet:
2014         lxc_abort(name, handler);
2015         goto __out_fini_nonet;
2016
2017 out_detach_blockdev:
2018         lxc_abort(name, handler);
2019         goto __out_detach_blockdev;
2020
2021 out_abort:
2022         lxc_abort(name, handler);
2023         goto __out_fini;
2024
2025 }
2026
2027 struct start_args {
2028         char *const *argv;
2029 };
2030
2031 static int start(struct lxc_handler *handler, void* data)
2032 {
2033         struct start_args *arg = data;
2034
2035         NOTICE("Exec'ing \"%s\"", arg->argv[0]);
2036
2037         execvp(arg->argv[0], arg->argv);
2038         SYSERROR("Failed to exec \"%s\"", arg->argv[0]);
2039         return 0;
2040 }
2041
2042 static int post_start(struct lxc_handler *handler, void* data)
2043 {
2044         struct start_args *arg = data;
2045
2046         NOTICE("Started \"%s\" with pid \"%d\"", arg->argv[0], handler->pid);
2047         return 0;
2048 }
2049
2050 static struct lxc_operations start_ops = {
2051         .start = start,
2052         .post_start = post_start
2053 };
2054
2055 int lxc_start(const char *name, char *const argv[], struct lxc_handler *handler,
2056               const char *lxcpath, bool daemonize, int *error_num)
2057 {
2058         struct start_args start_arg = {
2059                 .argv = argv,
2060         };
2061
2062         TRACE("Doing lxc_start");
2063         return __lxc_start(name, handler, &start_ops, &start_arg, lxcpath, daemonize, error_num);
2064 }
2065
2066 static void lxc_destroy_container_on_signal(struct lxc_handler *handler,
2067                                             const char *name)
2068 {
2069         char destroy[PATH_MAX];
2070         struct lxc_container *c;
2071         int ret = 0;
2072         bool bret = true;
2073
2074         if (handler->conf->rootfs.path && handler->conf->rootfs.mount) {
2075                 bret = do_destroy_container(handler);
2076                 if (!bret) {
2077                         ERROR("Error destroying rootfs for container \"%s\"", name);
2078                         return;
2079                 }
2080         }
2081         INFO("Destroyed rootfs for container \"%s\"", name);
2082
2083         ret = snprintf(destroy, PATH_MAX, "%s/%s", handler->lxcpath, name);
2084         if (ret < 0 || ret >= PATH_MAX) {
2085                 ERROR("Error destroying directory for container \"%s\"", name);
2086                 return;
2087         }
2088
2089         c = lxc_container_new(name, handler->lxcpath);
2090         if (c) {
2091                 if (container_disk_lock(c)) {
2092                         INFO("Could not update lxc_snapshots file");
2093                         lxc_container_put(c);
2094                 } else {
2095                         mod_all_rdeps(c, false);
2096                         container_disk_unlock(c);
2097                         lxc_container_put(c);
2098                 }
2099         }
2100
2101         if (!handler->am_root)
2102                 ret = userns_exec_full(handler->conf, lxc_rmdir_onedev_wrapper,
2103                                        destroy, "lxc_rmdir_onedev_wrapper");
2104         else
2105                 ret = lxc_rmdir_onedev(destroy, NULL);
2106
2107         if (ret < 0) {
2108                 ERROR("Error destroying directory for container \"%s\"", name);
2109                 return;
2110         }
2111         INFO("Destroyed directory for container \"%s\"", name);
2112 }
2113
2114 static int lxc_rmdir_onedev_wrapper(void *data)
2115 {
2116         char *arg = (char *) data;
2117         return lxc_rmdir_onedev(arg, NULL);
2118 }
2119
2120 static bool do_destroy_container(struct lxc_handler *handler)
2121 {
2122         int ret;
2123
2124         if (!handler->am_root) {
2125                 ret = userns_exec_full(handler->conf, storage_destroy_wrapper,
2126                                        handler->conf, "storage_destroy_wrapper");
2127                 if (ret < 0)
2128                         return false;
2129
2130                 return true;
2131         }
2132
2133         return storage_destroy(handler->conf);
2134 }