spelling: container

[mirror_lxc.git] / src / lxc / conf.c

diff --git a/src/lxc/conf.c b/src/lxc/conf.c
index 856fde1ddbc10bb7381b9560c2e285d8b633446a..1905fd156a849c4391e400dc7d5a30dace2ea82f 100644 (file)
--- a/src/lxc/conf.c
+++ b/src/lxc/conf.c
@@ -1494,15 +1494,16 @@ int lxc_chroot(const struct lxc_rootfs *rootfs)
  */
 static int lxc_pivot_root(const char *rootfs)
 {
-       int newroot = -1, oldroot = -1, ret = -1;
+       int oldroot;
+       int newroot = -1, ret = -1;
 
-       oldroot = open("/", O_DIRECTORY | O_RDONLY);
+       oldroot = open("/", O_DIRECTORY | O_RDONLY | O_CLOEXEC);
        if (oldroot < 0) {
                SYSERROR("Failed to open old root directory");
                return -1;
        }
 
-       newroot = open(rootfs, O_DIRECTORY | O_RDONLY);
+       newroot = open(rootfs, O_DIRECTORY | O_RDONLY | O_CLOEXEC);
        if (newroot < 0) {
                SYSERROR("Failed to open new root directory");
                goto on_error;
@@ -1564,9 +1565,9 @@ static int lxc_pivot_root(const char *rootfs)
        TRACE("pivot_root(\"%s\") successful", rootfs);
 
 on_error:
-       if (oldroot != -1)
-               close(oldroot);
-       if (newroot != -1)
+       close(oldroot);
+
+       if (newroot >= 0)
                close(newroot);
 
        return ret;
@@ -2419,10 +2420,6 @@ FILE *make_anonymous_mount_file(struct lxc_list *mount,
 
                TRACE("Created temporary mount file");
        }
-       if (fd < 0) {
-               SYSERROR("Could not create temporary mount file");
-               return NULL;
-       }
 
        lxc_list_for_each (iterator, mount) {
                size_t len;
@@ -2647,8 +2644,10 @@ int setup_resource_limits(struct lxc_list *limits, pid_t pid)
                        SYSERROR("Failed to set limit %s", lim->resource);
                        return -1;
                }
+
+               TRACE("Setup \"%s\" limit", lim->resource);
 #else
-               ERROR("Cannot set limit %s as prlimit is missing", lim->resource);
+               ERROR("Cannot set limit \"%s\" as prlimit is missing", lim->resource);
                return -1;
 #endif
        }
@@ -2917,7 +2916,7 @@ static int idmaptool_on_path_and_privileged(const char *binary, cap_value_t cap)
         * of the doubt. Otherwise we might fail even though all the necessary
         * file capabilities are set.
         */
-       DEBUG("Cannot check for file capabilites as full capability support is "
+       DEBUG("Cannot check for file capabilities as full capability support is "
              "missing. Manual intervention needed");
        fret = 1;
 #endif
@@ -3342,9 +3341,8 @@ void remount_all_slave(void)
                }
        }
 
-#define __LXC_SENDFILE_MAX 0x7ffff000 /* maximum number of bytes sendfile can handle */
 again:
-       copied = sendfile(memfd, mntinfo_fd, NULL, __LXC_SENDFILE_MAX);
+       copied = lxc_sendfile_nointr(memfd, mntinfo_fd, NULL, LXC_SENDFILE_MAX);
        if (copied < 0) {
                if (errno == EINTR)
                        goto again;
@@ -3512,7 +3510,6 @@ static bool verify_start_hooks(struct lxc_conf *conf)
 
        lxc_list_for_each (it, &conf->hooks[LXCHOOK_START]) {
                int ret;
-               struct stat st;
                char *hookname = it->elem;
 
                ret = snprintf(path, PATH_MAX, "%s%s",
@@ -3521,9 +3518,9 @@ static bool verify_start_hooks(struct lxc_conf *conf)
                if (ret < 0 || ret >= PATH_MAX)
                        return false;
 
-               ret = stat(path, &st);
+               ret = access(path, X_OK);
                if (ret < 0) {
-                       SYSERROR("Start hook %s not found in container",
+                       SYSERROR("Start hook \"%s\" not found in container",
                                 hookname);
                        return false;
                }
@@ -3602,10 +3599,6 @@ int lxc_setup(struct lxc_handler *handler)
                return -1;
        }
 
-       /* Make sure any start hooks are in the container */
-       if (!verify_start_hooks(lxc_conf))
-               return -1;
-
        if (lxc_conf->is_execute) {
                if (execveat_supported()) {
                        int fd;
@@ -3673,6 +3666,12 @@ int lxc_setup(struct lxc_handler *handler)
                }
        }
 
+       /* Make sure any start hooks are in the container */
+       if (!verify_start_hooks(lxc_conf)) {
+               ERROR("Failed to verify start hooks");
+               return -1;
+       }
+
        ret = lxc_setup_console(&lxc_conf->rootfs, &lxc_conf->console,
                                lxc_conf->ttys.dir);
        if (ret < 0) {
@@ -4361,7 +4360,7 @@ on_error:
  * - the container root {g,u}id as seen from the host > user's host {g,u}id
  * - the container root -> some sub{g,u}id
  * The former we add, if the user did not specifiy a mapping. The latter we
- * retrieve from the ontainer's configured {g,u}id mappings as it must have been
+ * retrieve from the container's configured {g,u}id mappings as it must have been
  * there to start the container in the first place.
  */
 int userns_exec_1(struct lxc_conf *conf, int (*fn)(void *), void *data,