ovl_rsync: make sure to umount

[mirror_lxc.git] / src / lxc / start.c

diff --git a/src/lxc/start.c b/src/lxc/start.c
index ad8867eb5102efc5d792998f7bbf39a09849f92a..4e977c52fd9e5d8a3adee7034f1c7e43e8334c79 100644 (file)
--- a/src/lxc/start.c
+++ b/src/lxc/start.c
@@ -71,6 +71,7 @@
 #include "caps.h"
 #include "bdev.h"
 #include "lsm/lsm.h"
+#include "lxclock.h"
 
 lxc_log_define(lxc_start, lxc);
 
@@ -83,6 +84,12 @@ const struct ns_info ns_info[LXC_NS_MAX] = {
        [LXC_NS_NET] = {"net", CLONE_NEWNET}
 };
 
+extern void mod_all_rdeps(struct lxc_container *c, bool inc);
+static bool do_destroy_container(struct lxc_conf *conf);
+static int lxc_rmdir_onedev_wrapper(void *data);
+static void lxc_destroy_container_on_signal(struct lxc_handler *handler,
+                                           const char *name);
+
 static void print_top_failing_dir(const char *path)
 {
        size_t len = strlen(path);
@@ -495,6 +502,9 @@ void lxc_fini(const char *name, struct lxc_handler *handler)
                close(handler->ttysock[0]);
                close(handler->ttysock[1]);
        }
+       if (handler->conf->ephemeral == 1 && handler->conf->reboot != 1) {
+               lxc_destroy_container_on_signal(handler, name);
+       }
        cgroup_destroy(handler);
        free(handler);
 }
@@ -664,15 +674,25 @@ static int do_start(void *data)
 
        /*
         * if we are in a new user namespace, become root there to have
-        * privilege over our namespace
+        * privilege over our namespace. When using lxc-execute we default to root,
+        * but this can be overriden using the lxc.init_uid and lxc.init_gid
+        * configuration options.
         */
        if (!lxc_list_empty(&handler->conf->id_map)) {
-               NOTICE("switching to gid/uid 0 in new user namespace");
-               if (setgid(0)) {
+               gid_t new_gid = 0;
+               if (handler->conf->is_execute && handler->conf->init_gid)
+                       new_gid = handler->conf->init_gid;
+
+               uid_t new_uid = 0;
+               if (handler->conf->is_execute && handler->conf->init_uid)
+                       new_uid = handler->conf->init_uid;
+
+               NOTICE("switching to gid/uid %d/%d in new user namespace", new_gid, new_uid);
+               if (setgid(new_gid)) {
                        SYSERROR("setgid");
                        goto out_warn_father;
                }
-               if (setuid(0)) {
+               if (setuid(new_uid)) {
                        SYSERROR("setuid");
                        goto out_warn_father;
                }
@@ -1212,7 +1232,12 @@ int __lxc_start(const char *name, struct lxc_conf *conf,
                }
         }
 
+       DEBUG("Pushing physical nics back to host namespace");
        lxc_rename_phys_nics_on_shutdown(netnsfd, handler->conf);
+
+       DEBUG("Tearing down virtual network devices used by container");
+       lxc_delete_network(handler);
+
        if (netnsfd >= 0)
                close(netnsfd);
 
@@ -1276,3 +1301,66 @@ int lxc_start(const char *name, char *const argv[], struct lxc_conf *conf,
        conf->need_utmp_watch = 1;
        return __lxc_start(name, conf, &start_ops, &start_arg, lxcpath, backgrounded);
 }
+
+static void lxc_destroy_container_on_signal(struct lxc_handler *handler,
+                                           const char *name)
+{
+       char destroy[MAXPATHLEN];
+       bool bret = true;
+       int ret = 0;
+       struct lxc_container *c;
+       if (handler->conf && handler->conf->rootfs.path && handler->conf->rootfs.mount) {
+               bret = do_destroy_container(handler->conf);
+               if (!bret) {
+                       ERROR("Error destroying rootfs for %s", name);
+                       return;
+               }
+       }
+       INFO("Destroyed rootfs for %s", name);
+
+       ret = snprintf(destroy, MAXPATHLEN, "%s/%s", handler->lxcpath, name);
+       if (ret < 0 || ret >= MAXPATHLEN) {
+               ERROR("Error printing path for %s", name);
+               ERROR("Error destroying directory for %s", name);
+               return;
+       }
+
+       c = lxc_container_new(name, handler->lxcpath);
+       if (c) {
+               if (container_disk_lock(c)) {
+                       INFO("Could not update lxc_snapshots file");
+                       lxc_container_put(c);
+               } else {
+                       mod_all_rdeps(c, false);
+                       container_disk_unlock(c);
+                       lxc_container_put(c);
+               }
+       }
+
+       if (am_unpriv())
+               ret = userns_exec_1(handler->conf, lxc_rmdir_onedev_wrapper, destroy);
+       else
+               ret = lxc_rmdir_onedev(destroy, NULL);
+
+       if (ret < 0) {
+               ERROR("Error destroying directory for %s", name);
+               return;
+       }
+       INFO("Destroyed directory for %s", name);
+}
+
+static int lxc_rmdir_onedev_wrapper(void *data)
+{
+       char *arg = (char *) data;
+       return lxc_rmdir_onedev(arg, NULL);
+}
+
+static bool do_destroy_container(struct lxc_conf *conf) {
+        if (am_unpriv()) {
+                if (userns_exec_1(conf, bdev_destroy_wrapper, conf) < 0)
+                        return false;
+                return true;
+        }
+        return bdev_destroy(conf);
+}
+