src/lxc/start.c

   1 /*
   2  * lxc: linux Container library
   3  *
   4  * (C) Copyright IBM Corp. 2007, 2008
   5  *
   6  * Authors:
   7  * Daniel Lezcano <dlezcano at fr.ibm.com>
   8  *
   9  * This library is free software; you can redistribute it and/or
  10  * modify it under the terms of the GNU Lesser General Public
  11  * License as published by the Free Software Foundation; either
  12  * version 2.1 of the License, or (at your option) any later version.
  13  *
  14  * This library is distributed in the hope that it will be useful,
  15  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  16  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  17  * Lesser General Public License for more details.
  18  *
  19  * You should have received a copy of the GNU Lesser General Public
  20  * License along with this library; if not, write to the Free Software
  21  * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
  22  */
  23
  24 #include "../config.h"
  25 #include <stdio.h>
  26 #undef _GNU_SOURCE
  27 #include <string.h>
  28 #include <stdlib.h>
  29 #include <dirent.h>
  30 #include <errno.h>
  31 #include <unistd.h>
  32 #include <signal.h>
  33 #include <fcntl.h>
  34 #include <termios.h>
  35 #include <namespace.h>
  36 #include <sys/param.h>
  37 #include <sys/file.h>
  38 #include <sys/mount.h>
  39 #include <sys/types.h>
  40 #include <sys/prctl.h>
  41 #include <sys/types.h>
  42 #include <sys/capability.h>
  43 #include <sys/wait.h>
  44 #include <sys/un.h>
  45 #include <sys/poll.h>
  46
  47 #ifdef HAVE_SYS_SIGNALFD_H
  48 #  include <sys/signalfd.h>
  49 #else
  50 #  ifndef __NR_signalfd4
  51 /* assume kernel headers are too old */
  52 #    if __i386__
  53 #      define __NR_signalfd4 327
  54 #    elif __x86_64__
  55 #      define __NR_signalfd4 289
  56 #    elif __powerpc__
  57 #      define __NR_signalfd4 313
  58 #    elif __s390x__
  59 #      define __NR_signalfd4 322
  60 #    endif
  61 #endif
  62
  63 #  ifndef __NR_signalfd
  64 /* assume kernel headers are too old */
  65 #    if __i386__
  66 #      define __NR_signalfd 321
  67 #    elif __x86_64__
  68 #      define __NR_signalfd 282
  69 #    elif __powerpc__
  70 #      define __NR_signalfd 305
  71 #    elif __s390x__
  72 #      define __NR_signalfd 316
  73 #    endif
  74 #endif
  75
  76 int signalfd(int fd, const sigset_t *mask, int flags)
  77 {
  78         int retval;
  79
  80         retval = syscall (__NR_signalfd4, fd, mask, _NSIG / 8, flags);
  81         if (errno == ENOSYS && flags == 0)
  82                 retval = syscall (__NR_signalfd, fd, mask, _NSIG / 8);
  83         return retval;
  84 }
  85 #endif
  86
  87 #if !HAVE_DECL_PR_CAPBSET_DROP
  88 #define PR_CAPBSET_DROP 24
  89 #endif
  90
  91 #include <lxc/log.h>
  92 #include <lxc/conf.h>
  93 #include <lxc/confile.h>
  94 #include <lxc/start.h>
  95 #include <lxc/utils.h>
  96 #include <lxc/cgroup.h>
  97 #include <lxc/monitor.h>
  98
  99 #include "error.h"
 100 #include "af_unix.h"
 101 #include "mainloop.h"
 102 #include "commands.h"
 103
 104
 105 lxc_log_define(lxc_start, lxc);
 106
 107 LXC_TTY_HANDLER(SIGINT);
 108 LXC_TTY_HANDLER(SIGQUIT);
 109
 110 static int setup_sigchld_fd(sigset_t *oldmask)
 111 {
 112         sigset_t mask;
 113         int fd;
 114
 115         if (sigprocmask(SIG_BLOCK, NULL, &mask)) {
 116                 SYSERROR("failed to get mask signal");
 117                 return -1;
 118         }
 119
 120         if (sigaddset(&mask, SIGCHLD) || sigprocmask(SIG_BLOCK, &mask, oldmask)) {
 121                 SYSERROR("failed to set mask signal");
 122                 return -1;
 123         }
 124
 125         fd = signalfd(-1, &mask, 0);
 126         if (fd < 0) {
 127                 SYSERROR("failed to create the signal fd");
 128                 return -1;
 129         }
 130
 131         if (fcntl(fd, F_SETFD, FD_CLOEXEC)) {
 132                 SYSERROR("failed to set sigfd to close-on-exec");
 133                 close(fd);
 134                 return -1;
 135         }
 136
 137         DEBUG("sigchild handler set");
 138
 139         return fd;
 140 }
 141
 142 static int sigchld_handler(int fd, void *data,
 143                            struct lxc_epoll_descr *descr)
 144 {
 145         DEBUG("child exited");
 146
 147         return 1;
 148 }
 149
 150 int lxc_set_state(const char *name, struct lxc_handler *handler, lxc_state_t state)
 151 {
 152         handler->state = state;
 153         lxc_monitor_send_state(name, state);
 154         return 0;
 155 }
 156
 157 int lxc_poll(const char *name, struct lxc_handler *handler)
 158 {
 159         int sigfd = handler->sigfd;
 160         int pid = handler->pid;
 161         int ret = -1;
 162         struct lxc_epoll_descr descr;
 163
 164         if (lxc_mainloop_open(&descr)) {
 165                 ERROR("failed to create mainloop");
 166                 goto out_sigfd;
 167         }
 168
 169         if (lxc_mainloop_add_handler(&descr, sigfd, sigchld_handler, &pid)) {
 170                 ERROR("failed to add handler for the signal");
 171                 goto out_mainloop_open;
 172         }
 173
 174         if (lxc_command_mainloop_add(name, &descr, handler))
 175                 goto out_mainloop_open;
 176
 177         ret = lxc_mainloop(&descr);
 178
 179 out:
 180         return ret;
 181
 182 out_mainloop_open:
 183         lxc_mainloop_close(&descr);
 184 out_sigfd:
 185         close(sigfd);
 186         goto out;
 187 }
 188
 189 static int fdname(int fd, char *name, size_t size)
 190 {
 191         char path[MAXPATHLEN];
 192         ssize_t len;
 193
 194         snprintf(path, MAXPATHLEN, "/proc/self/fd/%d", fd);
 195
 196         len = readlink(path, name, size);
 197         if (len >  0)
 198                 path[len] = '\0';
 199
 200         return (len <= 0) ? -1 : 0;
 201 }
 202
 203 static int console_init(char *console, size_t size)
 204 {
 205         struct stat stat;
 206         int i;
 207
 208         for (i = 0; i < 3; i++) {
 209                 if (!isatty(i))
 210                         continue;
 211
 212                 if (ttyname_r(i, console, size)) {
 213                         SYSERROR("failed to retrieve tty name");
 214                         return -1;
 215                 }
 216
 217                 return 0;
 218         }
 219
 220         if (!fstat(0, &stat)) {
 221                 if (S_ISREG(stat.st_mode) || S_ISCHR(stat.st_mode) ||
 222                     S_ISFIFO(stat.st_mode) || S_ISLNK(stat.st_mode))
 223                         return fdname(0, console, size);
 224         }
 225
 226         console[0] = '\0';
 227
 228         DEBUG("console initialized");
 229
 230         return 0;
 231 }
 232
 233 struct lxc_handler *lxc_init(const char *name, const char *rcfile)
 234 {
 235         struct lxc_handler *handler;
 236
 237         handler = malloc(sizeof(*handler));
 238         if (!handler)
 239                 return NULL;
 240
 241         memset(handler, 0, sizeof(*handler));
 242
 243         /* Begin the set the state to STARTING*/
 244         if (lxc_set_state(name, handler, STARTING)) {
 245                 ERROR("failed to set state '%s'", lxc_state2str(STARTING));
 246                 goto out_free;
 247         }
 248
 249         if (lxc_conf_init(&handler->conf)) {
 250                 ERROR("failed to initialize the configuration");
 251                 goto out_aborting;
 252         }
 253
 254         if (rcfile) {
 255                 if (access(rcfile, F_OK)) {
 256                         ERROR("failed to access rcfile");
 257                         goto out_aborting;
 258                 }
 259
 260                 if (lxc_config_read(rcfile, &handler->conf)) {
 261                         ERROR("failed to read the configuration file");
 262                         goto out_aborting;
 263                 }
 264         }
 265
 266         if (console_init(handler->conf.console,
 267                          sizeof(handler->conf.console))) {
 268                 ERROR("failed to initialize the console");
 269                 goto out_aborting;
 270         }
 271
 272         if (lxc_create_tty(name, &handler->conf)) {
 273                 ERROR("failed to create the ttys");
 274                 goto out_aborting;
 275         }
 276
 277         /* the signal fd has to be created before forking otherwise
 278          * if the child process exits before we setup the signal fd,
 279          * the event will be lost and the command will be stuck */
 280         handler->sigfd = setup_sigchld_fd(&handler->oldmask);
 281         if (handler->sigfd < 0) {
 282                 ERROR("failed to set sigchild fd handler");
 283                 goto out_delete_tty;
 284         }
 285
 286         /* Avoid signals from terminal */
 287         LXC_TTY_ADD_HANDLER(SIGINT);
 288         LXC_TTY_ADD_HANDLER(SIGQUIT);
 289
 290 out:
 291         if (handler)
 292                 INFO("'%s' is initialized", name);
 293
 294         return handler;
 295
 296 out_delete_tty:
 297         lxc_delete_tty(&handler->conf.tty_info);
 298 out_aborting:
 299         lxc_set_state(name, handler, ABORTING);
 300 out_free:
 301         free(handler);
 302         handler = NULL;
 303         goto out;
 304 }
 305
 306 void lxc_fini(const char *name, struct lxc_handler *handler)
 307 {
 308         /* The STOPPING state is there for future cleanup code
 309          * which can take awhile
 310          */
 311         lxc_set_state(name, handler, STOPPING);
 312         lxc_set_state(name, handler, STOPPED);
 313         lxc_unlink_nsgroup(name);
 314
 315         if (handler) {
 316                 lxc_delete_tty(&handler->conf.tty_info);
 317                 free(handler);
 318         }
 319
 320         LXC_TTY_DEL_HANDLER(SIGQUIT);
 321         LXC_TTY_DEL_HANDLER(SIGINT);
 322 }
 323
 324 void lxc_abort(const char *name, struct lxc_handler *handler)
 325 {
 326         lxc_set_state(name, handler, ABORTING);
 327         kill(handler->pid, SIGKILL);
 328 }
 329
 330 struct start_arg {
 331         const char *name;
 332         char *const *argv;
 333         struct lxc_handler *handler;
 334         int *sv;
 335 };
 336
 337 static int do_start(void *arg)
 338 {
 339         struct start_arg *start_arg = arg;
 340         struct lxc_handler *handler = start_arg->handler;
 341         const char *name = start_arg->name;
 342         char *const *argv = start_arg->argv;
 343         int *sv = start_arg->sv;
 344         int err = -1, sync;
 345
 346         if (sigprocmask(SIG_SETMASK, &handler->oldmask, NULL)) {
 347                 SYSERROR("failed to set sigprocmask");
 348                 goto out_child;
 349         }
 350
 351         close(sv[1]);
 352
 353         /* Be sure we don't inherit this after the exec */
 354         fcntl(sv[0], F_SETFD, FD_CLOEXEC);
 355
 356         /* Tell our father he can begin to configure the container */
 357         if (write(sv[0], &sync, sizeof(sync)) < 0) {
 358                 SYSERROR("failed to write socket");
 359                 goto out_child;
 360         }
 361
 362         /* Wait for the father to finish the configuration */
 363         if (read(sv[0], &sync, sizeof(sync)) < 0) {
 364                 SYSERROR("failed to read socket");
 365                 goto out_child;
 366         }
 367
 368         /* Setup the container, ip, names, utsname, ... */
 369         if (lxc_setup(name, &handler->conf)) {
 370                 ERROR("failed to setup the container");
 371                 goto out_warn_father;
 372         }
 373
 374         if (prctl(PR_CAPBSET_DROP, CAP_SYS_BOOT, 0, 0, 0)) {
 375                 SYSERROR("failed to remove CAP_SYS_BOOT capability");
 376                 goto out_child;
 377         }
 378
 379         if (prctl(PR_SET_PDEATHSIG, SIGKILL, 0, 0, 0)) {
 380                 SYSERROR("failed to set pdeath signal");
 381                 goto out_child;
 382         }
 383
 384         NOTICE("exec'ing '%s'", argv[0]);
 385
 386         execvp(argv[0], argv);
 387         SYSERROR("failed to exec %s", argv[0]);
 388
 389 out_warn_father:
 390         /* If the exec fails, tell that to our father */
 391         if (write(sv[0], &err, sizeof(err)) < 0)
 392                 SYSERROR("failed to write the socket");
 393 out_child:
 394         return -1;
 395 }
 396
 397 int lxc_spawn(const char *name, struct lxc_handler *handler, char *const argv[])
 398 {
 399         int sv[2];
 400         int clone_flags;
 401         int err = -1, sync;
 402
 403         struct start_arg start_arg = {
 404                 .name = name,
 405                 .argv = argv,
 406                 .handler = handler,
 407                 .sv = sv,
 408         };
 409
 410         /* Synchro socketpair */
 411         if (socketpair(AF_LOCAL, SOCK_STREAM, 0, sv)) {
 412                 SYSERROR("failed to create communication socketpair");
 413                 goto out;
 414         }
 415
 416         clone_flags = CLONE_NEWUTS|CLONE_NEWPID|CLONE_NEWIPC|CLONE_NEWNS;
 417         if (!lxc_list_empty(&handler->conf.network)) {
 418
 419                 clone_flags |= CLONE_NEWNET;
 420
 421                 /* that should be done before the clone because we will
 422                  * fill the netdev index and use them in the child
 423                  */
 424                 if (lxc_create_network(&handler->conf.network)) {
 425                         ERROR("failed to create the network");
 426                         goto out_close;
 427                 }
 428         }
 429
 430         /* Create a process in a new set of namespaces */
 431         handler->pid = lxc_clone(do_start, &start_arg, clone_flags);
 432         if (handler->pid < 0) {
 433                 SYSERROR("failed to fork into a new namespace");
 434                 goto out_close;
 435         }
 436
 437         close(sv[0]);
 438
 439         /* Wait for the child to be ready */
 440         if (read(sv[1], &sync, sizeof(sync)) < 0) {
 441                 SYSERROR("failed to read the socket");
 442                 goto out_abort;
 443         }
 444
 445         if (lxc_rename_nsgroup(name, handler))
 446                 goto out_abort;
 447
 448         /* Create the network configuration */
 449         if (clone_flags & CLONE_NEWNET) {
 450                 if (lxc_assign_network(&handler->conf.network, handler->pid)) {
 451                         ERROR("failed to create the configured network");
 452                         goto out_abort;
 453                 }
 454         }
 455
 456         /* Tell the child to continue its initialization */
 457         if (write(sv[1], &sync, sizeof(sync)) < 0) {
 458                 SYSERROR("failed to write the socket");
 459                 goto out_abort;
 460         }
 461
 462         /* Wait for the child to exec or returning an error */
 463         if (read(sv[1], &sync, sizeof(sync)) < 0) {
 464                 ERROR("failed to read the socket");
 465                 goto out_abort;
 466         }
 467
 468         if (lxc_set_state(name, handler, RUNNING)) {
 469                 ERROR("failed to set state to %s",
 470                               lxc_state2str(RUNNING));
 471                 goto out_abort;
 472         }
 473
 474         err = 0;
 475
 476         NOTICE("'%s' started with pid '%d'", argv[0], handler->pid);
 477
 478 out_close:
 479         close(sv[0]);
 480         close(sv[1]);
 481 out:
 482         return err;
 483
 484 out_abort:
 485         lxc_abort(name, handler);
 486         goto out_close;
 487 }
 488
 489 int lxc_start(const char *name, char *const argv[], const char *rcfile)
 490 {
 491         struct lxc_handler *handler;
 492         int err = -1;
 493         int status;
 494
 495         handler = lxc_init(name, rcfile);
 496         if (!handler) {
 497                 ERROR("failed to initialize the container");
 498                 return -1;
 499         }
 500
 501         err = lxc_spawn(name, handler, argv);
 502         if (err) {
 503                 ERROR("failed to spawn '%s'", argv[0]);
 504                 goto out;
 505         }
 506
 507         err = lxc_close_all_inherited_fd();
 508         if (err) {
 509                 ERROR("unable to close inherited fds");
 510                 goto out_abort;
 511         }
 512
 513         err = lxc_poll(name, handler);
 514         if (err) {
 515                 ERROR("mainloop exited with an error");
 516                 goto out_abort;
 517         }
 518
 519         while (waitpid(handler->pid, &status, 0) < 0 && errno == EINTR)
 520                 continue;
 521
 522         err =  lxc_error_set_and_log(handler->pid, status);
 523 out:
 524         lxc_fini(name, handler);
 525         return err;
 526
 527 out_abort:
 528         lxc_abort(name, handler);
 529         goto out;
 530 }