#include "caps.h"
#include "bdev.h"
#include "lsm/lsm.h"
+#include "lxclock.h"
lxc_log_define(lxc_start, lxc);
[LXC_NS_NET] = {"net", CLONE_NEWNET}
};
+extern void mod_all_rdeps(struct lxc_container *c, bool inc);
+static bool do_destroy_container(struct lxc_conf *conf);
+static int lxc_rmdir_onedev_wrapper(void *data);
+static void lxc_destroy_container_on_signal(struct lxc_handler *handler,
+ const char *name);
+
static void print_top_failing_dir(const char *path)
{
size_t len = strlen(path);
if (fd == fddir || fd == lxc_log_fd || fd == fd_to_ignore)
continue;
+ if (current_config && fd == current_config->logfd)
+ continue;
+
if (match_fd(fd))
continue;
memset(handler, 0, sizeof(*handler));
+ handler->ttysock[0] = handler->ttysock[1] = -1;
handler->conf = conf;
handler->lxcpath = lxcpath;
handler->pinfd = -1;
}
/* Start of environment variable setup for hooks */
- if (setenv("LXC_NAME", name, 1)) {
+ if (name && setenv("LXC_NAME", name, 1)) {
SYSERROR("failed to set environment variable for container name");
}
- if (setenv("LXC_CONFIG_FILE", conf->rcfile, 1)) {
+ if (conf->rcfile && setenv("LXC_CONFIG_FILE", conf->rcfile, 1)) {
SYSERROR("failed to set environment variable for config path");
}
- if (setenv("LXC_ROOTFS_MOUNT", conf->rootfs.mount, 1)) {
+ if (conf->rootfs.mount && setenv("LXC_ROOTFS_MOUNT", conf->rootfs.mount, 1)) {
SYSERROR("failed to set environment variable for rootfs mount");
}
- if (setenv("LXC_ROOTFS_PATH", conf->rootfs.path, 1)) {
+ if (conf->rootfs.path && setenv("LXC_ROOTFS_PATH", conf->rootfs.path, 1)) {
SYSERROR("failed to set environment variable for rootfs mount");
}
if (conf->console.path && setenv("LXC_CONSOLE", conf->console.path, 1)) {
goto out_aborting;
}
- if (lxc_create_tty(name, conf)) {
- ERROR("failed to create the ttys");
- goto out_aborting;
- }
-
/* the signal fd has to be created before forking otherwise
* if the child process exits before we setup the signal fd,
* the event will be lost and the command will be stuck */
close(handler->conf->maincmd_fd);
handler->conf->maincmd_fd = -1;
free(handler->name);
+ if (handler->ttysock[0] != -1) {
+ close(handler->ttysock[0]);
+ close(handler->ttysock[1]);
+ }
+ if (handler->conf->ephemeral == 1 && handler->conf->reboot != 1) {
+ lxc_destroy_container_on_signal(handler, name);
+ }
cgroup_destroy(handler);
free(handler);
}
/*
* if we are in a new user namespace, become root there to have
- * privilege over our namespace
+ * privilege over our namespace. When using lxc-execute we default to root,
+ * but this can be overriden using the lxc.init_uid and lxc.init_gid
+ * configuration options.
*/
if (!lxc_list_empty(&handler->conf->id_map)) {
- NOTICE("switching to gid/uid 0 in new user namespace");
- if (setgid(0)) {
+ gid_t new_gid = 0;
+ if (handler->conf->is_execute && handler->conf->init_gid)
+ new_gid = handler->conf->init_gid;
+
+ uid_t new_uid = 0;
+ if (handler->conf->is_execute && handler->conf->init_uid)
+ new_uid = handler->conf->init_uid;
+
+ NOTICE("switching to gid/uid %d/%d in new user namespace", new_gid, new_uid);
+ if (setgid(new_gid)) {
SYSERROR("setgid");
goto out_warn_father;
}
- if (setuid(0)) {
+ if (setuid(new_uid)) {
SYSERROR("setuid");
goto out_warn_father;
}
goto out_warn_father;
}
+ if (handler->conf->pty_names) {
+ if (putenv(handler->conf->pty_names)) {
+ SYSERROR("failed to set environment variable for container ptys");
+ goto out_warn_father;
+ }
+ }
+
close(handler->sigfd);
+ if (handler->backgrounded && null_stdfds() < 0)
+ goto out_warn_father;
+
/* after this call, we are in error because this
* ops should not return as it execs */
handler->ops->start(handler, handler->data);
return 0;
}
+static int recv_fd(int sock, int *fd)
+{
+ if (lxc_abstract_unix_recv_fd(sock, fd, NULL, 0) < 0) {
+ SYSERROR("Error receiving tty fd from child");
+ return -1;
+ }
+ if (*fd == -1)
+ return -1;
+ return 0;
+}
+
+static int recv_ttys_from_child(struct lxc_handler *handler)
+{
+ struct lxc_conf *conf = handler->conf;
+ int i, sock = handler->ttysock[1];
+ struct lxc_tty_info *tty_info = &conf->tty_info;
+
+ if (!conf->tty)
+ return 0;
+
+ tty_info->pty_info = malloc(sizeof(*tty_info->pty_info)*conf->tty);
+ if (!tty_info->pty_info) {
+ SYSERROR("failed to allocate pty_info");
+ return -1;
+ }
+
+ for (i = 0; i < conf->tty; i++) {
+ struct lxc_pty_info *pty_info = &tty_info->pty_info[i];
+ pty_info->busy = 0;
+ if (recv_fd(sock, &pty_info->slave) < 0 ||
+ recv_fd(sock, &pty_info->master) < 0) {
+ ERROR("Error receiving tty info from child");
+ return -1;
+ }
+ }
+ tty_info->nbtty = conf->tty;
+
+ return 0;
+}
+
+void resolve_clone_flags(struct lxc_handler *handler)
+{
+ handler->clone_flags = CLONE_NEWPID | CLONE_NEWNS;
+
+ if (!lxc_list_empty(&handler->conf->id_map)) {
+ INFO("Cloning a new user namespace");
+ handler->clone_flags |= CLONE_NEWUSER;
+ }
+
+ if (handler->conf->inherit_ns_fd[LXC_NS_NET] == -1) {
+ if (!lxc_requests_empty_network(handler))
+ handler->clone_flags |= CLONE_NEWNET;
+ } else {
+ INFO("Inheriting a net namespace");
+ }
+
+ if (handler->conf->inherit_ns_fd[LXC_NS_IPC] == -1) {
+ handler->clone_flags |= CLONE_NEWIPC;
+ } else {
+ INFO("Inheriting an IPC namespace");
+ }
+
+ if (handler->conf->inherit_ns_fd[LXC_NS_UTS] == -1) {
+ handler->clone_flags |= CLONE_NEWUTS;
+ } else {
+ INFO("Inheriting a UTS namespace");
+ }
+}
+
static int lxc_spawn(struct lxc_handler *handler)
{
int failed_before_rename = 0;
if (lxc_sync_init(handler))
return -1;
- handler->clone_flags = CLONE_NEWPID|CLONE_NEWNS;
- if (!lxc_list_empty(&handler->conf->id_map)) {
- INFO("Cloning a new user namespace");
- handler->clone_flags |= CLONE_NEWUSER;
+ if (socketpair(AF_UNIX, SOCK_DGRAM, 0, handler->ttysock) < 0) {
+ lxc_sync_fini(handler);
+ return -1;
}
- if (handler->conf->inherit_ns_fd[LXC_NS_NET] == -1) {
- if (!lxc_requests_empty_network(handler))
- handler->clone_flags |= CLONE_NEWNET;
+ resolve_clone_flags(handler);
+ if (handler->clone_flags & CLONE_NEWNET) {
if (!lxc_list_empty(&handler->conf->network)) {
/* Find gateway addresses from the link device, which is
ERROR("failed to save physical nic info");
goto out_abort;
}
- } else {
- INFO("Inheriting a net namespace");
- }
-
- if (handler->conf->inherit_ns_fd[LXC_NS_IPC] == -1) {
- handler->clone_flags |= CLONE_NEWIPC;
- } else {
- INFO("Inheriting an IPC namespace");
}
- if (handler->conf->inherit_ns_fd[LXC_NS_UTS] == -1) {
- handler->clone_flags |= CLONE_NEWUTS;
- } else {
- INFO("Inheriting a UTS namespace");
- }
-
-
if (!cgroup_init(handler)) {
ERROR("failed initializing cgroup support");
goto out_delete_net;
cgroup_disconnect();
cgroups_connected = false;
+ /* read tty fds allocated by child */
+ if (recv_ttys_from_child(handler) < 0) {
+ ERROR("failed to receive tty info from child");
+ goto out_delete_net;
+ }
+
/* Tell the child to complete its initialization and wait for
* it to exec or return an error. (the child will never
* return LXC_SYNC_POST_CGROUP+1. It will either close the
}
int __lxc_start(const char *name, struct lxc_conf *conf,
- struct lxc_operations* ops, void *data, const char *lxcpath)
+ struct lxc_operations* ops, void *data, const char *lxcpath,
+ bool backgrounded)
{
struct lxc_handler *handler;
int err = -1;
}
handler->ops = ops;
handler->data = data;
+ handler->backgrounded = backgrounded;
if (must_drop_cap_sys_boot(handler->conf)) {
#if HAVE_SYS_CAPABILITY_H
goto out_detach_blockdev;
}
+ handler->conf->reboot = 0;
+
netnsfd = get_netns_fd(handler->pid);
err = lxc_poll(name, handler);
}
}
+ DEBUG("Pushing physical nics back to host namespace");
lxc_rename_phys_nics_on_shutdown(netnsfd, handler->conf);
+
+ DEBUG("Tearing down virtual network devices used by container");
+ lxc_delete_network(handler);
+
if (netnsfd >= 0)
close(netnsfd);
};
int lxc_start(const char *name, char *const argv[], struct lxc_conf *conf,
- const char *lxcpath)
+ const char *lxcpath, bool backgrounded)
{
struct start_args start_arg = {
.argv = argv,
};
conf->need_utmp_watch = 1;
- return __lxc_start(name, conf, &start_ops, &start_arg, lxcpath);
+ return __lxc_start(name, conf, &start_ops, &start_arg, lxcpath, backgrounded);
+}
+
+static void lxc_destroy_container_on_signal(struct lxc_handler *handler,
+ const char *name)
+{
+ char destroy[MAXPATHLEN];
+ bool bret = true;
+ int ret = 0;
+ struct lxc_container *c;
+ if (handler->conf && handler->conf->rootfs.path && handler->conf->rootfs.mount) {
+ bret = do_destroy_container(handler->conf);
+ if (!bret) {
+ ERROR("Error destroying rootfs for %s", name);
+ return;
+ }
+ }
+ INFO("Destroyed rootfs for %s", name);
+
+ ret = snprintf(destroy, MAXPATHLEN, "%s/%s", handler->lxcpath, name);
+ if (ret < 0 || ret >= MAXPATHLEN) {
+ ERROR("Error printing path for %s", name);
+ ERROR("Error destroying directory for %s", name);
+ return;
+ }
+
+ c = lxc_container_new(name, handler->lxcpath);
+ if (c) {
+ if (container_disk_lock(c)) {
+ INFO("Could not update lxc_snapshots file");
+ lxc_container_put(c);
+ } else {
+ mod_all_rdeps(c, false);
+ container_disk_unlock(c);
+ lxc_container_put(c);
+ }
+ }
+
+ if (am_unpriv())
+ ret = userns_exec_1(handler->conf, lxc_rmdir_onedev_wrapper, destroy);
+ else
+ ret = lxc_rmdir_onedev(destroy, NULL);
+
+ if (ret < 0) {
+ ERROR("Error destroying directory for %s", name);
+ return;
+ }
+ INFO("Destroyed directory for %s", name);
}
+
+static int lxc_rmdir_onedev_wrapper(void *data)
+{
+ char *arg = (char *) data;
+ return lxc_rmdir_onedev(arg, NULL);
+}
+
+static bool do_destroy_container(struct lxc_conf *conf) {
+ if (am_unpriv()) {
+ if (userns_exec_1(conf, bdev_destroy_wrapper, conf) < 0)
+ return false;
+ return true;
+ }
+ return bdev_destroy(conf);
+}
+
projects / mirror_lxc.git / blobdiff