#include <unistd.h>
#include <signal.h>
#include <fcntl.h>
-#include <termios.h>
#include <grp.h>
#include <poll.h>
#include <sys/param.h>
#include "namespace.h"
#include "lxcseccomp.h"
#include "caps.h"
+#include "bdev.h"
#include "lsm/lsm.h"
+#include "lxclock.h"
lxc_log_define(lxc_start, lxc);
[LXC_NS_NET] = {"net", CLONE_NEWNET}
};
+extern void mod_all_rdeps(struct lxc_container *c, bool inc);
+static bool do_destroy_container(struct lxc_conf *conf);
+static int lxc_rmdir_onedev_wrapper(void *data);
+static void lxc_destroy_container_on_signal(struct lxc_handler *handler,
+ const char *name);
+
static void print_top_failing_dir(const char *path)
{
size_t len = strlen(path);
return (fd == 0 || fd == 1 || fd == 2);
}
-int lxc_check_inherited(struct lxc_conf *conf, int fd_to_ignore)
+/*
+ * Check for any fds we need to close
+ * * if fd_to_ignore != -1, then if we find that fd open we will ignore it.
+ * * By default we warn about open fds we find.
+ * * If closeall is true, we will close open fds.
+ * * If lxc-start was passed "-C", then conf->close_all_fds will be true,
+ * in which case we also close all open fds.
+ * * A daemonized container will always pass closeall=true.
+ */
+int lxc_check_inherited(struct lxc_conf *conf, bool closeall, int fd_to_ignore)
{
struct dirent dirent, *direntp;
int fd, fddir;
DIR *dir;
+ if (conf && conf->close_all_fds)
+ closeall = true;
+
restart:
dir = opendir("/proc/self/fd");
if (!dir) {
if (fd == fddir || fd == lxc_log_fd || fd == fd_to_ignore)
continue;
+ if (current_config && fd == current_config->logfd)
+ continue;
+
if (match_fd(fd))
continue;
- if (conf->close_all_fds) {
+ if (closeall) {
close(fd);
closedir(dir);
INFO("closed inherited fd %d", fd);
return 1;
}
-static int lxc_set_state(const char *name, struct lxc_handler *handler, lxc_state_t state)
+int lxc_set_state(const char *name, struct lxc_handler *handler, lxc_state_t state)
{
handler->state = state;
lxc_monitor_send_state(name, state, handler->lxcpath);
return 0;
}
-static int lxc_poll(const char *name, struct lxc_handler *handler)
+int lxc_poll(const char *name, struct lxc_handler *handler)
{
int sigfd = handler->sigfd;
int pid = handler->pid;
memset(handler, 0, sizeof(*handler));
+ handler->ttysock[0] = handler->ttysock[1] = -1;
handler->conf = conf;
handler->lxcpath = lxcpath;
handler->pinfd = -1;
}
/* Start of environment variable setup for hooks */
- if (setenv("LXC_NAME", name, 1)) {
+ if (name && setenv("LXC_NAME", name, 1)) {
SYSERROR("failed to set environment variable for container name");
}
- if (setenv("LXC_CONFIG_FILE", conf->rcfile, 1)) {
+ if (conf->rcfile && setenv("LXC_CONFIG_FILE", conf->rcfile, 1)) {
SYSERROR("failed to set environment variable for config path");
}
- if (setenv("LXC_ROOTFS_MOUNT", conf->rootfs.mount, 1)) {
+ if (conf->rootfs.mount && setenv("LXC_ROOTFS_MOUNT", conf->rootfs.mount, 1)) {
SYSERROR("failed to set environment variable for rootfs mount");
}
- if (setenv("LXC_ROOTFS_PATH", conf->rootfs.path, 1)) {
+ if (conf->rootfs.path && setenv("LXC_ROOTFS_PATH", conf->rootfs.path, 1)) {
SYSERROR("failed to set environment variable for rootfs mount");
}
if (conf->console.path && setenv("LXC_CONSOLE", conf->console.path, 1)) {
goto out_aborting;
}
- if (lxc_create_tty(name, conf)) {
- ERROR("failed to create the ttys");
- goto out_aborting;
- }
-
/* the signal fd has to be created before forking otherwise
* if the child process exits before we setup the signal fd,
* the event will be lost and the command will be stuck */
return NULL;
}
-static void lxc_fini(const char *name, struct lxc_handler *handler)
+void lxc_fini(const char *name, struct lxc_handler *handler)
{
/* The STOPPING state is there for future cleanup code
* which can take awhile
close(handler->conf->maincmd_fd);
handler->conf->maincmd_fd = -1;
free(handler->name);
+ if (handler->ttysock[0] != -1) {
+ close(handler->ttysock[0]);
+ close(handler->ttysock[1]);
+ }
+ if (handler->conf->ephemeral == 1 && handler->conf->reboot != 1) {
+ lxc_destroy_container_on_signal(handler, name);
+ }
cgroup_destroy(handler);
free(handler);
}
-static void lxc_abort(const char *name, struct lxc_handler *handler)
+void lxc_abort(const char *name, struct lxc_handler *handler)
{
int ret, status;
pid = clone(container_reboot_supported, stack, flags, &cmd);
#endif
if (pid < 0) {
- SYSERROR("failed to clone");
+ if (flags & CLONE_NEWUSER)
+ ERROR("failed to clone (%#x): %s (includes CLONE_NEWUSER)", flags, strerror(errno));
+ else
+ ERROR("failed to clone (%#x): %s", flags, strerror(errno));
return -1;
}
if (wait(&status) < 0) {
static int do_start(void *data)
{
+ struct lxc_list *iterator;
struct lxc_handler *handler = data;
- const char *lsm_label = NULL;
if (sigprocmask(SIG_SETMASK, &handler->oldmask, NULL)) {
SYSERROR("failed to set sigprocmask");
/*
* if we are in a new user namespace, become root there to have
- * privilege over our namespace
+ * privilege over our namespace. When using lxc-execute we default to root,
+ * but this can be overriden using the lxc.init_uid and lxc.init_gid
+ * configuration options.
*/
if (!lxc_list_empty(&handler->conf->id_map)) {
- NOTICE("switching to gid/uid 0 in new user namespace");
- if (setgid(0)) {
+ gid_t new_gid = 0;
+ if (handler->conf->is_execute && handler->conf->init_gid)
+ new_gid = handler->conf->init_gid;
+
+ uid_t new_uid = 0;
+ if (handler->conf->is_execute && handler->conf->init_uid)
+ new_uid = handler->conf->init_uid;
+
+ NOTICE("switching to gid/uid %d/%d in new user namespace", new_gid, new_uid);
+ if (setgid(new_gid)) {
SYSERROR("setgid");
goto out_warn_father;
}
- if (setuid(0)) {
+ if (setuid(new_uid)) {
SYSERROR("setuid");
goto out_warn_father;
}
return -1;
/* Set the label to change to when we exec(2) the container's init */
- if (!strcmp(lsm_name(), "AppArmor"))
- lsm_label = handler->conf->lsm_aa_profile;
- else if (!strcmp(lsm_name(), "SELinux"))
- lsm_label = handler->conf->lsm_se_context;
- if (lsm_process_label_set(lsm_label, 1, 1) < 0)
+ if (lsm_process_label_set(NULL, handler->conf, 1, 1) < 0)
goto out_warn_father;
- if (lxc_check_inherited(handler->conf, handler->sigfd))
- return -1;
+ /* Some init's such as busybox will set sane tty settings on stdin,
+ * stdout, stderr which it thinks is the console. We already set them
+ * the way we wanted on the real terminal, and we want init to do its
+ * setup on its console ie. the pty allocated in lxc_console_create()
+ * so make sure that that pty is stdin,stdout,stderr.
+ */
+ if (lxc_console_set_stdfds(handler) < 0)
+ goto out_warn_father;
/* If we mounted a temporary proc, then unmount it now */
tmp_proc_unmount(handler->conf);
}
/* The clearenv() and putenv() calls have been moved here
- * to allow us to use enviroment variables passed to the various
+ * to allow us to use environment variables passed to the various
* hooks, such as the start hook above. Not all of the
* variables like CONFIG_PATH or ROOTFS are valid in this
* context but others are. */
/* don't error out though */
}
+ lxc_list_for_each(iterator, &handler->conf->environment) {
+ if (putenv((char *)iterator->elem)) {
+ SYSERROR("failed to set environment variable '%s'", (char *)iterator->elem);
+ goto out_warn_father;
+ }
+ }
+
if (putenv("container=lxc")) {
- SYSERROR("failed to set environment variable");
+ SYSERROR("failed to set environment variable 'container=lxc'");
goto out_warn_father;
}
+ if (handler->conf->pty_names) {
+ if (putenv(handler->conf->pty_names)) {
+ SYSERROR("failed to set environment variable for container ptys");
+ goto out_warn_father;
+ }
+ }
+
close(handler->sigfd);
+ if (handler->backgrounded && null_stdfds() < 0)
+ goto out_warn_father;
+
/* after this call, we are in error because this
* ops should not return as it execs */
handler->ops->start(handler, handler->data);
return 0;
}
+static int recv_fd(int sock, int *fd)
+{
+ if (lxc_abstract_unix_recv_fd(sock, fd, NULL, 0) < 0) {
+ SYSERROR("Error receiving tty fd from child");
+ return -1;
+ }
+ if (*fd == -1)
+ return -1;
+ return 0;
+}
+
+static int recv_ttys_from_child(struct lxc_handler *handler)
+{
+ struct lxc_conf *conf = handler->conf;
+ int i, sock = handler->ttysock[1];
+ struct lxc_tty_info *tty_info = &conf->tty_info;
+
+ if (!conf->tty)
+ return 0;
+
+ tty_info->pty_info = malloc(sizeof(*tty_info->pty_info)*conf->tty);
+ if (!tty_info->pty_info) {
+ SYSERROR("failed to allocate pty_info");
+ return -1;
+ }
+
+ for (i = 0; i < conf->tty; i++) {
+ struct lxc_pty_info *pty_info = &tty_info->pty_info[i];
+ pty_info->busy = 0;
+ if (recv_fd(sock, &pty_info->slave) < 0 ||
+ recv_fd(sock, &pty_info->master) < 0) {
+ ERROR("Error receiving tty info from child");
+ return -1;
+ }
+ }
+ tty_info->nbtty = conf->tty;
+
+ return 0;
+}
+
+void resolve_clone_flags(struct lxc_handler *handler)
+{
+ handler->clone_flags = CLONE_NEWPID | CLONE_NEWNS;
+
+ if (!lxc_list_empty(&handler->conf->id_map)) {
+ INFO("Cloning a new user namespace");
+ handler->clone_flags |= CLONE_NEWUSER;
+ }
+
+ if (handler->conf->inherit_ns_fd[LXC_NS_NET] == -1) {
+ if (!lxc_requests_empty_network(handler))
+ handler->clone_flags |= CLONE_NEWNET;
+ } else {
+ INFO("Inheriting a net namespace");
+ }
+
+ if (handler->conf->inherit_ns_fd[LXC_NS_IPC] == -1) {
+ handler->clone_flags |= CLONE_NEWIPC;
+ } else {
+ INFO("Inheriting an IPC namespace");
+ }
+
+ if (handler->conf->inherit_ns_fd[LXC_NS_UTS] == -1) {
+ handler->clone_flags |= CLONE_NEWUTS;
+ } else {
+ INFO("Inheriting a UTS namespace");
+ }
+}
+
static int lxc_spawn(struct lxc_handler *handler)
{
int failed_before_rename = 0;
int preserve_mask = 0, i;
int netpipepair[2], nveths;
+ netpipe = -1;
+
for (i = 0; i < LXC_NS_MAX; i++)
if (handler->conf->inherit_ns_fd[i] != -1)
preserve_mask |= ns_info[i].clone_flag;
if (lxc_sync_init(handler))
return -1;
- handler->clone_flags = CLONE_NEWPID|CLONE_NEWNS;
- if (!lxc_list_empty(&handler->conf->id_map)) {
- INFO("Cloning a new user namespace");
- handler->clone_flags |= CLONE_NEWUSER;
+ if (socketpair(AF_UNIX, SOCK_DGRAM, 0, handler->ttysock) < 0) {
+ lxc_sync_fini(handler);
+ return -1;
}
- if (handler->conf->inherit_ns_fd[LXC_NS_NET] == -1) {
- if (!lxc_requests_empty_network(handler))
- handler->clone_flags |= CLONE_NEWNET;
+ resolve_clone_flags(handler);
+ if (handler->clone_flags & CLONE_NEWNET) {
if (!lxc_list_empty(&handler->conf->network)) {
/* Find gateway addresses from the link device, which is
ERROR("failed to save physical nic info");
goto out_abort;
}
- } else {
- INFO("Inheriting a net namespace");
}
- if (handler->conf->inherit_ns_fd[LXC_NS_IPC] == -1) {
- handler->clone_flags |= CLONE_NEWIPC;
- } else {
- INFO("Inheriting an IPC namespace");
- }
-
- if (handler->conf->inherit_ns_fd[LXC_NS_UTS] == -1) {
- handler->clone_flags |= CLONE_NEWUTS;
- } else {
- INFO("Inheriting a UTS namespace");
- }
-
-
if (!cgroup_init(handler)) {
ERROR("failed initializing cgroup support");
goto out_delete_net;
cgroup_disconnect();
cgroups_connected = false;
+ /* read tty fds allocated by child */
+ if (recv_ttys_from_child(handler) < 0) {
+ ERROR("failed to receive tty info from child");
+ goto out_delete_net;
+ }
+
/* Tell the child to complete its initialization and wait for
* it to exec or return an error. (the child will never
* return LXC_SYNC_POST_CGROUP+1. It will either close the
}
int __lxc_start(const char *name, struct lxc_conf *conf,
- struct lxc_operations* ops, void *data, const char *lxcpath)
+ struct lxc_operations* ops, void *data, const char *lxcpath,
+ bool backgrounded)
{
struct lxc_handler *handler;
int err = -1;
}
handler->ops = ops;
handler->data = data;
+ handler->backgrounded = backgrounded;
if (must_drop_cap_sys_boot(handler->conf)) {
#if HAVE_SYS_CAPABILITY_H
handler->conf->need_utmp_watch = 0;
}
+ if (!attach_block_device(handler->conf)) {
+ ERROR("Failure attaching block device");
+ goto out_fini_nonet;
+ }
+
+ if (geteuid() == 0 && !lxc_list_empty(&conf->id_map)) {
+ /* if the backing store is a device, mount it here and now */
+ if (rootfs_is_blockdev(conf)) {
+ if (unshare(CLONE_NEWNS) < 0) {
+ ERROR("Error unsharing mounts");
+ goto out_fini_nonet;
+ }
+ remount_all_slave();
+ if (do_rootfs_setup(conf, name, lxcpath) < 0) {
+ ERROR("Error setting up rootfs mount as root before spawn");
+ goto out_fini_nonet;
+ }
+ INFO("Set up container rootfs as host root");
+ }
+ }
+
err = lxc_spawn(handler);
if (err) {
ERROR("failed to spawn '%s'", name);
- goto out_fini_nonet;
+ goto out_detach_blockdev;
}
+ handler->conf->reboot = 0;
+
netnsfd = get_netns_fd(handler->pid);
err = lxc_poll(name, handler);
if (err) {
ERROR("mainloop exited with an error");
+ if (netnsfd >= 0)
+ close(netnsfd);
goto out_abort;
}
}
}
+ DEBUG("Pushing physical nics back to host namespace");
lxc_rename_phys_nics_on_shutdown(netnsfd, handler->conf);
- close(netnsfd);
+
+ DEBUG("Tearing down virtual network devices used by container");
+ lxc_delete_network(handler);
+
+ if (netnsfd >= 0)
+ close(netnsfd);
if (handler->pinfd >= 0) {
close(handler->pinfd);
handler->pinfd = -1;
}
+ lxc_monitor_send_exit_code(name, status, handler->lxcpath);
err = lxc_error_set_and_log(handler->pid, status);
out_fini:
lxc_delete_network(handler);
+out_detach_blockdev:
+ detach_block_device(handler->conf);
+
out_fini_nonet:
lxc_fini(name, handler);
return err;
};
int lxc_start(const char *name, char *const argv[], struct lxc_conf *conf,
- const char *lxcpath)
+ const char *lxcpath, bool backgrounded)
{
struct start_args start_arg = {
.argv = argv,
};
conf->need_utmp_watch = 1;
- return __lxc_start(name, conf, &start_ops, &start_arg, lxcpath);
+ return __lxc_start(name, conf, &start_ops, &start_arg, lxcpath, backgrounded);
+}
+
+static void lxc_destroy_container_on_signal(struct lxc_handler *handler,
+ const char *name)
+{
+ char destroy[MAXPATHLEN];
+ bool bret = true;
+ int ret = 0;
+ struct lxc_container *c;
+ if (handler->conf && handler->conf->rootfs.path && handler->conf->rootfs.mount) {
+ bret = do_destroy_container(handler->conf);
+ if (!bret) {
+ ERROR("Error destroying rootfs for %s", name);
+ return;
+ }
+ }
+ INFO("Destroyed rootfs for %s", name);
+
+ ret = snprintf(destroy, MAXPATHLEN, "%s/%s", handler->lxcpath, name);
+ if (ret < 0 || ret >= MAXPATHLEN) {
+ ERROR("Error printing path for %s", name);
+ ERROR("Error destroying directory for %s", name);
+ return;
+ }
+
+ c = lxc_container_new(name, handler->lxcpath);
+ if (c) {
+ if (container_disk_lock(c)) {
+ INFO("Could not update lxc_snapshots file");
+ lxc_container_put(c);
+ } else {
+ mod_all_rdeps(c, false);
+ container_disk_unlock(c);
+ lxc_container_put(c);
+ }
+ }
+
+ if (am_unpriv())
+ ret = userns_exec_1(handler->conf, lxc_rmdir_onedev_wrapper, destroy);
+ else
+ ret = lxc_rmdir_onedev(destroy, NULL);
+
+ if (ret < 0) {
+ ERROR("Error destroying directory for %s", name);
+ return;
+ }
+ INFO("Destroyed directory for %s", name);
+}
+
+static int lxc_rmdir_onedev_wrapper(void *data)
+{
+ char *arg = (char *) data;
+ return lxc_rmdir_onedev(arg, NULL);
}
+
+static bool do_destroy_container(struct lxc_conf *conf) {
+ if (am_unpriv()) {
+ if (userns_exec_1(conf, bdev_destroy_wrapper, conf) < 0)
+ return false;
+ return true;
+ }
+ return bdev_destroy(conf);
+}
+
projects / mirror_lxc.git / blobdiff