src/lxc/start.c

   1 /*
   2  * lxc: linux Container library
   3  *
   4  * (C) Copyright IBM Corp. 2007, 2008
   5  *
   6  * Authors:
   7  * Daniel Lezcano <dlezcano at fr.ibm.com>
   8  *
   9  * This library is free software; you can redistribute it and/or
  10  * modify it under the terms of the GNU Lesser General Public
  11  * License as published by the Free Software Foundation; either
  12  * version 2.1 of the License, or (at your option) any later version.
  13  *
  14  * This library is distributed in the hope that it will be useful,
  15  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  16  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  17  * Lesser General Public License for more details.
  18  *
  19  * You should have received a copy of the GNU Lesser General Public
  20  * License along with this library; if not, write to the Free Software
  21  * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
  22  */
  23
  24 #include "../config.h"
  25 #include <stdio.h>
  26 #undef _GNU_SOURCE
  27 #include <string.h>
  28 #include <stdlib.h>
  29 #include <dirent.h>
  30 #include <errno.h>
  31 #include <unistd.h>
  32 #include <signal.h>
  33 #include <fcntl.h>
  34 #include <termios.h>
  35 #include <sys/param.h>
  36 #include <sys/file.h>
  37 #include <sys/mount.h>
  38 #include <sys/types.h>
  39 #include <sys/prctl.h>
  40 #include <sys/capability.h>
  41 #include <sys/wait.h>
  42 #include <sys/un.h>
  43 #include <sys/poll.h>
  44
  45 #ifdef HAVE_SYS_SIGNALFD_H
  46 #  include <sys/signalfd.h>
  47 #else
  48 #  ifndef __NR_signalfd4
  49 /* assume kernel headers are too old */
  50 #    if __i386__
  51 #      define __NR_signalfd4 327
  52 #    elif __x86_64__
  53 #      define __NR_signalfd4 289
  54 #    elif __powerpc__
  55 #      define __NR_signalfd4 313
  56 #    elif __s390x__
  57 #      define __NR_signalfd4 322
  58 #    endif
  59 #endif
  60
  61 #  ifndef __NR_signalfd
  62 /* assume kernel headers are too old */
  63 #    if __i386__
  64 #      define __NR_signalfd 321
  65 #    elif __x86_64__
  66 #      define __NR_signalfd 282
  67 #    elif __powerpc__
  68 #      define __NR_signalfd 305
  69 #    elif __s390x__
  70 #      define __NR_signalfd 316
  71 #    endif
  72 #endif
  73
  74 int signalfd(int fd, const sigset_t *mask, int flags)
  75 {
  76         int retval;
  77
  78         retval = syscall (__NR_signalfd4, fd, mask, _NSIG / 8, flags);
  79         if (errno == ENOSYS && flags == 0)
  80                 retval = syscall (__NR_signalfd, fd, mask, _NSIG / 8);
  81         return retval;
  82 }
  83 #endif
  84
  85 #if !HAVE_DECL_PR_CAPBSET_DROP
  86 #define PR_CAPBSET_DROP 24
  87 #endif
  88
  89 #include "error.h"
  90 #include "af_unix.h"
  91 #include "mainloop.h"
  92
  93 #include <lxc/lxc.h>
  94 #include <lxc/log.h>
  95
  96 lxc_log_define(lxc_start, lxc);
  97
  98 LXC_TTY_HANDLER(SIGINT);
  99 LXC_TTY_HANDLER(SIGQUIT);
 100
 101 static int setup_sigchld_fd(sigset_t *oldmask)
 102 {
 103         sigset_t mask;
 104         int fd;
 105
 106         if (sigprocmask(SIG_BLOCK, NULL, &mask)) {
 107                 SYSERROR("failed to get mask signal");
 108                 return -1;
 109         }
 110
 111         if (sigaddset(&mask, SIGCHLD) || sigprocmask(SIG_BLOCK, &mask, oldmask)) {
 112                 SYSERROR("failed to set mask signal");
 113                 return -1;
 114         }
 115
 116         fd = signalfd(-1, &mask, 0);
 117         if (fd < 0) {
 118                 SYSERROR("failed to create the signal fd");
 119                 return -1;
 120         }
 121
 122         if (fcntl(fd, F_SETFD, FD_CLOEXEC)) {
 123                 SYSERROR("failed to set sigfd to close-on-exec");
 124                 close(fd);
 125                 return -1;
 126         }
 127
 128         return fd;
 129 }
 130
 131 static int setup_tty_service(const char *name, int *ttyfd)
 132 {
 133         int fd;
 134         struct sockaddr_un addr = { 0 };
 135         char *offset = &addr.sun_path[1];
 136
 137         strcpy(offset, name);
 138         addr.sun_path[0] = '\0';
 139
 140         fd = lxc_af_unix_open(addr.sun_path, SOCK_STREAM, 0);
 141         if (fd < 0)
 142                 return -1;
 143
 144         if (fcntl(fd, F_SETFD, FD_CLOEXEC)) {
 145                 SYSERROR("failed to close-on-exec flag");
 146                 close(fd);
 147                 return -1;
 148         }
 149
 150         *ttyfd = fd;
 151
 152         return 0;
 153 }
 154
 155 static int sigchld_handler(int fd, void *data,
 156                            struct lxc_epoll_descr *descr)
 157 {
 158         return 1;
 159 }
 160
 161 static int ttyclient_handler(int fd, void *data,
 162                              struct lxc_epoll_descr *descr)
 163 {
 164         int i;
 165         struct lxc_tty_info *tty_info = data;
 166
 167         for (i = 0; i < tty_info->nbtty; i++) {
 168
 169                 if (tty_info->pty_info[i].busy != fd)
 170                         continue;
 171
 172                 lxc_mainloop_del_handler(descr, fd);
 173                 tty_info->pty_info[i].busy = 0;
 174                 close(fd);
 175         }
 176
 177         return 0;
 178 }
 179
 180 static int ttyservice_handler(int fd, void *data,
 181                               struct lxc_epoll_descr *descr)
 182 {
 183         int conn, ttynum, val = 1, ret = -1;
 184         struct lxc_tty_info *tty_info = data;
 185
 186         conn = accept(fd, NULL, 0);
 187         if (conn < 0) {
 188                 SYSERROR("failed to accept tty client");
 189                 return -1;
 190         }
 191
 192         if (setsockopt(conn, SOL_SOCKET, SO_PASSCRED, &val, sizeof(val))) {
 193                 SYSERROR("failed to enable credential on socket");
 194                 goto out_close;
 195         }
 196
 197         if (lxc_af_unix_rcv_credential(conn, &ttynum, sizeof(ttynum)))
 198                 goto out_close;
 199
 200         if (ttynum > 0) {
 201                 if (ttynum > tty_info->nbtty)
 202                         goto out_close;
 203
 204                 if (tty_info->pty_info[ttynum - 1].busy)
 205                         goto out_close;
 206
 207                 goto out_send;
 208         }
 209
 210         /* fixup index tty1 => [0] */
 211         for (ttynum = 1;
 212              ttynum <= tty_info->nbtty && tty_info->pty_info[ttynum - 1].busy;
 213              ttynum++);
 214
 215         /* we didn't find any available slot for tty */
 216         if (ttynum > tty_info->nbtty)
 217                 goto out_close;
 218
 219 out_send:
 220         if (lxc_af_unix_send_fd(conn, tty_info->pty_info[ttynum - 1].master,
 221                                 &ttynum, sizeof(ttynum)) < 0) {
 222                 ERROR("failed to send tty to client");
 223                 goto out_close;
 224         }
 225
 226         if (lxc_mainloop_add_handler(descr, conn,
 227                                      ttyclient_handler, tty_info)) {
 228                 ERROR("failed to add tty client handler");
 229                 goto out_close;
 230         }
 231
 232         tty_info->pty_info[ttynum - 1].busy = conn;
 233
 234         ret = 0;
 235 out:
 236         return ret;
 237 out_close:
 238         close(conn);
 239         goto out;
 240 }
 241
 242 int lxc_poll(const char *name, struct lxc_handler *handler)
 243 {
 244         int sigfd = handler->sigfd;
 245         int pid = handler->pid;
 246         const struct lxc_tty_info *tty_info = &handler->tty_info;
 247
 248         int nfds, ttyfd = -1, ret = -1;
 249         struct lxc_epoll_descr descr;
 250
 251         if (tty_info->nbtty && setup_tty_service(name, &ttyfd)) {
 252                 ERROR("failed to create the tty service point");
 253                 goto out_sigfd;
 254         }
 255
 256         /* sigfd + nb tty + tty service
 257          * if tty is enabled */
 258         nfds = tty_info->nbtty + 1 + tty_info->nbtty ? 1 : 0;
 259
 260         if (lxc_mainloop_open(nfds, &descr)) {
 261                 ERROR("failed to create mainloop");
 262                 goto out_ttyfd;
 263         }
 264
 265         if (lxc_mainloop_add_handler(&descr, sigfd, sigchld_handler, &pid)) {
 266                 ERROR("failed to add handler for the signal");
 267                 goto out_mainloop_open;
 268         }
 269
 270         if (tty_info->nbtty) {
 271                 if (lxc_mainloop_add_handler(&descr, ttyfd,
 272                                              ttyservice_handler,
 273                                              (void *)tty_info)) {
 274                         ERROR("failed to add handler for the tty");
 275                         goto out_mainloop_open;
 276                 }
 277         }
 278
 279         ret = lxc_mainloop(&descr);
 280
 281 out:
 282         return ret;
 283
 284 out_mainloop_open:
 285         lxc_mainloop_close(&descr);
 286 out_ttyfd:
 287         close(ttyfd);
 288 out_sigfd:
 289         close(sigfd);
 290         goto out;
 291 }
 292
 293 static int save_init_pid(const char *name, pid_t pid)
 294 {
 295         char init[MAXPATHLEN];
 296         char *val;
 297         int fd, err = -1;
 298
 299         snprintf(init, MAXPATHLEN, LXCPATH "/%s/init", name);
 300
 301         if (!asprintf(&val, "%d\n", pid)) {
 302                 SYSERROR("failed to allocate memory");
 303                 goto out;
 304         }
 305
 306         fd = open(init, O_WRONLY|O_CREAT|O_TRUNC, S_IRUSR|S_IWUSR);
 307         if (fd < 0) {
 308                 SYSERROR("failed to open '%s'", init);
 309                 goto out_free;
 310         }
 311
 312         if (write(fd, val, strlen(val)) < 0) {
 313                 SYSERROR("failed to write the init pid");
 314                 goto out_close;
 315         }
 316
 317         err = 0;
 318
 319 out_close:
 320         close(fd);
 321 out_free:
 322         free(val);
 323 out:
 324         return err;
 325 }
 326
 327 static void remove_init_pid(const char *name, pid_t pid)
 328 {
 329         char init[MAXPATHLEN];
 330
 331         snprintf(init, MAXPATHLEN, LXCPATH "/%s/init", name);
 332         unlink(init);
 333 }
 334
 335 int lxc_init(const char *name, struct lxc_handler *handler)
 336 {
 337         int err = -1;
 338
 339         memset(handler, 0, sizeof(*handler));
 340
 341         handler->lock = lxc_get_lock(name);
 342         if (handler->lock < 0)
 343                 goto out;
 344
 345         /* Begin the set the state to STARTING*/
 346         if (lxc_setstate(name, STARTING)) {
 347                 ERROR("failed to set state '%s'", lxc_state2str(STARTING));
 348                 goto out_put_lock;
 349         }
 350
 351         /* If we are not attached to a tty, disable it */
 352         if (ttyname_r(0, handler->tty, sizeof(handler->tty)))
 353                 handler->tty[0] = '\0';
 354
 355         if (lxc_create_tty(name, &handler->tty_info)) {
 356                 ERROR("failed to create the ttys");
 357                 goto out_aborting;
 358         }
 359
 360         /* the signal fd has to be created before forking otherwise
 361          * if the child process exits before we setup the signal fd,
 362          * the event will be lost and the command will be stuck */
 363         handler->sigfd = setup_sigchld_fd(&handler->oldmask);
 364         if (handler->sigfd < 0) {
 365                 ERROR("failed to set sigchild fd handler");
 366                 goto out_delete_tty;
 367         }
 368
 369         /* Avoid signals from terminal */
 370         LXC_TTY_ADD_HANDLER(SIGINT);
 371         LXC_TTY_ADD_HANDLER(SIGQUIT);
 372
 373         err = 0;
 374 out:
 375         return err;
 376
 377 out_delete_tty:
 378         lxc_delete_tty(&handler->tty_info);
 379 out_aborting:
 380         lxc_setstate(name, ABORTING);
 381 out_put_lock:
 382         lxc_put_lock(handler->lock);
 383         goto out;
 384 }
 385
 386 void lxc_fini(const char *name, struct lxc_handler *handler)
 387 {
 388         /* The STOPPING state is there for future cleanup code
 389          * which can take awhile
 390          */
 391         lxc_setstate(name, STOPPING);
 392
 393         lxc_setstate(name, STOPPED);
 394
 395         remove_init_pid(name, handler->pid);
 396
 397         lxc_delete_tty(&handler->tty_info);
 398
 399         lxc_unlink_nsgroup(name);
 400
 401         lxc_put_lock(handler->lock);
 402
 403         LXC_TTY_DEL_HANDLER(SIGQUIT);
 404         LXC_TTY_DEL_HANDLER(SIGINT);
 405 }
 406
 407 void lxc_abort(const char *name, struct lxc_handler *handler)
 408 {
 409         lxc_setstate(name, ABORTING);
 410         kill(handler->pid, SIGKILL);
 411 }
 412
 413 int lxc_spawn(const char *name, struct lxc_handler *handler, char *const argv[])
 414 {
 415         int sv[2];
 416         int clone_flags;
 417         int err = -1, sync;
 418
 419         /* Synchro socketpair */
 420         if (socketpair(AF_LOCAL, SOCK_STREAM, 0, sv)) {
 421                 SYSERROR("failed to create communication socketpair");
 422                 goto out;
 423         }
 424
 425         clone_flags = CLONE_NEWPID|CLONE_NEWIPC|CLONE_NEWNS;
 426         if (conf_has_utsname(name))
 427                 clone_flags |= CLONE_NEWUTS;
 428         if (conf_has_network(name))
 429                 clone_flags |= CLONE_NEWNET;
 430
 431         /* Create a process in a new set of namespaces */
 432         handler->pid = fork_ns(clone_flags);
 433         if (handler->pid < 0) {
 434                 SYSERROR("failed to fork into a new namespace");
 435                 goto out_close;
 436         }
 437
 438         if (!handler->pid) {
 439
 440                 if (sigprocmask(SIG_SETMASK, &handler->oldmask, NULL)) {
 441                         SYSERROR("failed to set sigprocmask");
 442                         goto out_child;
 443                 }
 444
 445                 close(sv[1]);
 446
 447                 /* Be sure we don't inherit this after the exec */
 448                 fcntl(sv[0], F_SETFD, FD_CLOEXEC);
 449
 450                 /* Tell our father he can begin to configure the container */
 451                 if (write(sv[0], &sync, sizeof(sync)) < 0) {
 452                         SYSERROR("failed to write socket");
 453                         goto out_child;
 454                 }
 455
 456                 /* Wait for the father to finish the configuration */
 457                 if (read(sv[0], &sync, sizeof(sync)) < 0) {
 458                         SYSERROR("failed to read socket");
 459                         goto out_child;
 460                 }
 461
 462                 /* Setup the container, ip, names, utsname, ... */
 463                 if (lxc_setup(name, handler->tty, &handler->tty_info)) {
 464                         ERROR("failed to setup the container");
 465                         goto out_warn_father;
 466                 }
 467
 468                 if (prctl(PR_CAPBSET_DROP, CAP_SYS_BOOT, 0, 0, 0)) {
 469                         SYSERROR("failed to remove CAP_SYS_BOOT capability");
 470                         goto out_child;
 471                 }
 472
 473                 execvp(argv[0], argv);
 474                 SYSERROR("failed to exec %s", argv[0]);
 475
 476         out_warn_father:
 477                 /* If the exec fails, tell that to our father */
 478                 if (write(sv[0], &err, sizeof(err)) < 0)
 479                         SYSERROR("failed to write the socket");
 480         out_child:
 481                 exit(err);
 482         }
 483
 484         close(sv[0]);
 485
 486         /* Wait for the child to be ready */
 487         if (read(sv[1], &sync, sizeof(sync)) < 0) {
 488                 SYSERROR("failed to read the socket");
 489                 goto out_abort;
 490         }
 491
 492         if (lxc_link_nsgroup(name, handler->pid))
 493                 WARN("cgroupfs not found: cgroup disabled");
 494
 495         /* Create the network configuration */
 496         if (clone_flags & CLONE_NEWNET && conf_create_network(name, handler->pid)) {
 497                 ERROR("failed to create the configured network");
 498                 goto out_abort;
 499         }
 500
 501         /* Tell the child to continue its initialization */
 502         if (write(sv[1], &sync, sizeof(sync)) < 0) {
 503                 SYSERROR("failed to write the socket");
 504                 goto out_abort;
 505         }
 506
 507         /* Wait for the child to exec or returning an error */
 508         if (read(sv[1], &sync, sizeof(sync)) < 0) {
 509                 ERROR("failed to read the socket");
 510                 goto out_abort;
 511         }
 512
 513         if (save_init_pid(name, handler->pid)) {
 514                 ERROR("failed to save the init pid info");
 515                 goto out_abort;
 516         }
 517
 518         if (lxc_setstate(name, RUNNING)) {
 519                 ERROR("failed to set state to %s",
 520                               lxc_state2str(RUNNING));
 521                 goto out_abort;
 522         }
 523
 524         err = 0;
 525
 526 out_close:
 527         close(sv[0]);
 528         close(sv[1]);
 529 out:
 530         return err;
 531
 532 out_abort:
 533         lxc_abort(name, handler);
 534         goto out_close;
 535 }
 536
 537 int lxc_start(const char *name, char *const argv[])
 538 {
 539         struct lxc_handler handler = { 0 };
 540         int err = -1;
 541         int status;
 542
 543         if (lxc_init(name, &handler)) {
 544                 ERROR("failed to initialize the container");
 545                 goto out;
 546         }
 547
 548         err = lxc_spawn(name, &handler, argv);
 549         if (err) {
 550                 ERROR("failed to spawn '%s'", argv[0]);
 551                 goto out;
 552         }
 553
 554         err = lxc_poll(name, &handler);
 555         if (err) {
 556                 ERROR("mainloop exited with an error");
 557                 goto out_abort;
 558         }
 559
 560         while (waitpid(handler.pid, &status, 0) < 0 && errno == EINTR)
 561                 continue;
 562
 563         err =  lxc_error_set_and_log(handler.pid, status);
 564 out:
 565         lxc_fini(name, &handler);
 566         return err;
 567
 568 out_abort:
 569         lxc_abort(name, &handler);
 570         goto out;
 571 }