]> git.proxmox.com Git - mirror_lxc.git/blobdiff - src/lxc/start.c
ovl_rsync: make sure to umount
[mirror_lxc.git] / src / lxc / start.c
index bb136af0d8e42175e417cf061d231fadc8591c27..4e977c52fd9e5d8a3adee7034f1c7e43e8334c79 100644 (file)
@@ -71,6 +71,7 @@
 #include "caps.h"
 #include "bdev.h"
 #include "lsm/lsm.h"
+#include "lxclock.h"
 
 lxc_log_define(lxc_start, lxc);
 
@@ -83,6 +84,12 @@ const struct ns_info ns_info[LXC_NS_MAX] = {
        [LXC_NS_NET] = {"net", CLONE_NEWNET}
 };
 
+extern void mod_all_rdeps(struct lxc_container *c, bool inc);
+static bool do_destroy_container(struct lxc_conf *conf);
+static int lxc_rmdir_onedev_wrapper(void *data);
+static void lxc_destroy_container_on_signal(struct lxc_handler *handler,
+                                           const char *name);
+
 static void print_top_failing_dir(const char *path)
 {
        size_t len = strlen(path);
@@ -170,12 +177,24 @@ static int match_fd(int fd)
        return (fd == 0 || fd == 1 || fd == 2);
 }
 
-int lxc_check_inherited(struct lxc_conf *conf, int fd_to_ignore)
+/*
+ * Check for any fds we need to close
+ * * if fd_to_ignore != -1, then if we find that fd open we will ignore it.
+ * * By default we warn about open fds we find.
+ * * If closeall is true, we will close open fds.
+ * * If lxc-start was passed "-C", then conf->close_all_fds will be true,
+ *     in which case we also close all open fds.
+ * * A daemonized container will always pass closeall=true.
+ */
+int lxc_check_inherited(struct lxc_conf *conf, bool closeall, int fd_to_ignore)
 {
        struct dirent dirent, *direntp;
        int fd, fddir;
        DIR *dir;
 
+       if (conf && conf->close_all_fds)
+               closeall = true;
+
 restart:
        dir = opendir("/proc/self/fd");
        if (!dir) {
@@ -200,10 +219,13 @@ restart:
                if (fd == fddir || fd == lxc_log_fd || fd == fd_to_ignore)
                        continue;
 
+               if (current_config && fd == current_config->logfd)
+                       continue;
+
                if (match_fd(fd))
                        continue;
 
-               if (conf->close_all_fds) {
+               if (closeall) {
                        close(fd);
                        closedir(dir);
                        INFO("closed inherited fd %d", fd);
@@ -300,14 +322,14 @@ static int signal_handler(int fd, uint32_t events, void *data,
        return 1;
 }
 
-static int lxc_set_state(const char *name, struct lxc_handler *handler, lxc_state_t state)
+int lxc_set_state(const char *name, struct lxc_handler *handler, lxc_state_t state)
 {
        handler->state = state;
        lxc_monitor_send_state(name, state, handler->lxcpath);
        return 0;
 }
 
-static int lxc_poll(const char *name, struct lxc_handler *handler)
+int lxc_poll(const char *name, struct lxc_handler *handler)
 {
        int sigfd = handler->sigfd;
        int pid = handler->pid;
@@ -363,6 +385,7 @@ struct lxc_handler *lxc_init(const char *name, struct lxc_conf *conf, const char
 
        memset(handler, 0, sizeof(*handler));
 
+       handler->ttysock[0] = handler->ttysock[1] = -1;
        handler->conf = conf;
        handler->lxcpath = lxcpath;
        handler->pinfd = -1;
@@ -390,16 +413,16 @@ struct lxc_handler *lxc_init(const char *name, struct lxc_conf *conf, const char
        }
 
        /* Start of environment variable setup for hooks */
-       if (setenv("LXC_NAME", name, 1)) {
+       if (name && setenv("LXC_NAME", name, 1)) {
                SYSERROR("failed to set environment variable for container name");
        }
-       if (setenv("LXC_CONFIG_FILE", conf->rcfile, 1)) {
+       if (conf->rcfile && setenv("LXC_CONFIG_FILE", conf->rcfile, 1)) {
                SYSERROR("failed to set environment variable for config path");
        }
-       if (setenv("LXC_ROOTFS_MOUNT", conf->rootfs.mount, 1)) {
+       if (conf->rootfs.mount && setenv("LXC_ROOTFS_MOUNT", conf->rootfs.mount, 1)) {
                SYSERROR("failed to set environment variable for rootfs mount");
        }
-       if (setenv("LXC_ROOTFS_PATH", conf->rootfs.path, 1)) {
+       if (conf->rootfs.path && setenv("LXC_ROOTFS_PATH", conf->rootfs.path, 1)) {
                SYSERROR("failed to set environment variable for rootfs mount");
        }
        if (conf->console.path && setenv("LXC_CONSOLE", conf->console.path, 1)) {
@@ -415,11 +438,6 @@ struct lxc_handler *lxc_init(const char *name, struct lxc_conf *conf, const char
                goto out_aborting;
        }
 
-       if (lxc_create_tty(name, conf)) {
-               ERROR("failed to create the ttys");
-               goto out_aborting;
-       }
-
        /* the signal fd has to be created before forking otherwise
         * if the child process exits before we setup the signal fd,
         * the event will be lost and the command will be stuck */
@@ -460,7 +478,7 @@ out_free:
        return NULL;
 }
 
-static void lxc_fini(const char *name, struct lxc_handler *handler)
+void lxc_fini(const char *name, struct lxc_handler *handler)
 {
        /* The STOPPING state is there for future cleanup code
         * which can take awhile
@@ -480,11 +498,18 @@ static void lxc_fini(const char *name, struct lxc_handler *handler)
        close(handler->conf->maincmd_fd);
        handler->conf->maincmd_fd = -1;
        free(handler->name);
+       if (handler->ttysock[0] != -1) {
+               close(handler->ttysock[0]);
+               close(handler->ttysock[1]);
+       }
+       if (handler->conf->ephemeral == 1 && handler->conf->reboot != 1) {
+               lxc_destroy_container_on_signal(handler, name);
+       }
        cgroup_destroy(handler);
        free(handler);
 }
 
-static void lxc_abort(const char *name, struct lxc_handler *handler)
+void lxc_abort(const char *name, struct lxc_handler *handler)
 {
        int ret, status;
 
@@ -547,7 +572,10 @@ static int must_drop_cap_sys_boot(struct lxc_conf *conf)
        pid = clone(container_reboot_supported, stack, flags, &cmd);
 #endif
        if (pid < 0) {
-               SYSERROR("failed to clone");
+               if (flags & CLONE_NEWUSER)
+                       ERROR("failed to clone (%#x): %s (includes CLONE_NEWUSER)", flags, strerror(errno));
+               else
+                       ERROR("failed to clone (%#x): %s", flags, strerror(errno));
                return -1;
        }
        if (wait(&status) < 0) {
@@ -611,7 +639,6 @@ static int do_start(void *data)
 {
        struct lxc_list *iterator;
        struct lxc_handler *handler = data;
-       const char *lsm_label = NULL;
 
        if (sigprocmask(SIG_SETMASK, &handler->oldmask, NULL)) {
                SYSERROR("failed to set sigprocmask");
@@ -647,15 +674,25 @@ static int do_start(void *data)
 
        /*
         * if we are in a new user namespace, become root there to have
-        * privilege over our namespace
+        * privilege over our namespace. When using lxc-execute we default to root,
+        * but this can be overriden using the lxc.init_uid and lxc.init_gid
+        * configuration options.
         */
        if (!lxc_list_empty(&handler->conf->id_map)) {
-               NOTICE("switching to gid/uid 0 in new user namespace");
-               if (setgid(0)) {
+               gid_t new_gid = 0;
+               if (handler->conf->is_execute && handler->conf->init_gid)
+                       new_gid = handler->conf->init_gid;
+
+               uid_t new_uid = 0;
+               if (handler->conf->is_execute && handler->conf->init_uid)
+                       new_uid = handler->conf->init_uid;
+
+               NOTICE("switching to gid/uid %d/%d in new user namespace", new_gid, new_uid);
+               if (setgid(new_gid)) {
                        SYSERROR("setgid");
                        goto out_warn_father;
                }
-               if (setuid(0)) {
+               if (setuid(new_uid)) {
                        SYSERROR("setuid");
                        goto out_warn_father;
                }
@@ -691,11 +728,7 @@ static int do_start(void *data)
                return -1;
 
        /* Set the label to change to when we exec(2) the container's init */
-       if (!strcmp(lsm_name(), "AppArmor"))
-               lsm_label = handler->conf->lsm_aa_profile;
-       else if (!strcmp(lsm_name(), "SELinux"))
-               lsm_label = handler->conf->lsm_se_context;
-       if (lsm_process_label_set(lsm_label, 1, 1) < 0)
+       if (lsm_process_label_set(NULL, handler->conf, 1, 1) < 0)
                goto out_warn_father;
 
        /* Some init's such as busybox will set sane tty settings on stdin,
@@ -719,7 +752,7 @@ static int do_start(void *data)
        }
 
        /* The clearenv() and putenv() calls have been moved here
-        * to allow us to use enviroment variables passed to the various
+        * to allow us to use environment variables passed to the various
         * hooks, such as the start hook above.  Not all of the
         * variables like CONFIG_PATH or ROOTFS are valid in this
         * context but others are. */
@@ -740,8 +773,18 @@ static int do_start(void *data)
                goto out_warn_father;
        }
 
+       if (handler->conf->pty_names) {
+               if (putenv(handler->conf->pty_names)) {
+                       SYSERROR("failed to set environment variable for container ptys");
+                       goto out_warn_father;
+               }
+       }
+
        close(handler->sigfd);
 
+       if (handler->backgrounded && null_stdfds() < 0)
+               goto out_warn_father;
+
        /* after this call, we are in error because this
         * ops should not return as it execs */
        handler->ops->start(handler, handler->data);
@@ -783,6 +826,75 @@ static int save_phys_nics(struct lxc_conf *conf)
        return 0;
 }
 
+static int recv_fd(int sock, int *fd)
+{
+       if (lxc_abstract_unix_recv_fd(sock, fd, NULL, 0) < 0) {
+               SYSERROR("Error receiving tty fd from child");
+               return -1;
+       }
+       if (*fd == -1)
+               return -1;
+       return 0;
+}
+
+static int recv_ttys_from_child(struct lxc_handler *handler)
+{
+       struct lxc_conf *conf = handler->conf;
+       int i, sock = handler->ttysock[1];
+       struct lxc_tty_info *tty_info = &conf->tty_info;
+
+       if (!conf->tty)
+               return 0;
+
+       tty_info->pty_info = malloc(sizeof(*tty_info->pty_info)*conf->tty);
+       if (!tty_info->pty_info) {
+               SYSERROR("failed to allocate pty_info");
+               return -1;
+       }
+
+       for (i = 0; i < conf->tty; i++) {
+               struct lxc_pty_info *pty_info = &tty_info->pty_info[i];
+               pty_info->busy = 0;
+               if (recv_fd(sock, &pty_info->slave) < 0 ||
+                               recv_fd(sock, &pty_info->master) < 0) {
+                       ERROR("Error receiving tty info from child");
+                       return -1;
+               }
+       }
+       tty_info->nbtty = conf->tty;
+
+       return 0;
+}
+
+void resolve_clone_flags(struct lxc_handler *handler)
+{
+       handler->clone_flags = CLONE_NEWPID | CLONE_NEWNS;
+
+       if (!lxc_list_empty(&handler->conf->id_map)) {
+               INFO("Cloning a new user namespace");
+               handler->clone_flags |= CLONE_NEWUSER;
+       }
+
+       if (handler->conf->inherit_ns_fd[LXC_NS_NET] == -1) {
+               if (!lxc_requests_empty_network(handler))
+                       handler->clone_flags |= CLONE_NEWNET;
+       } else {
+               INFO("Inheriting a net namespace");
+       }
+
+       if (handler->conf->inherit_ns_fd[LXC_NS_IPC] == -1) {
+               handler->clone_flags |= CLONE_NEWIPC;
+       } else {
+               INFO("Inheriting an IPC namespace");
+       }
+
+       if (handler->conf->inherit_ns_fd[LXC_NS_UTS] == -1) {
+               handler->clone_flags |= CLONE_NEWUTS;
+       } else {
+               INFO("Inheriting a UTS namespace");
+       }
+}
+
 static int lxc_spawn(struct lxc_handler *handler)
 {
        int failed_before_rename = 0;
@@ -801,16 +913,14 @@ static int lxc_spawn(struct lxc_handler *handler)
        if (lxc_sync_init(handler))
                return -1;
 
-       handler->clone_flags = CLONE_NEWPID|CLONE_NEWNS;
-       if (!lxc_list_empty(&handler->conf->id_map)) {
-               INFO("Cloning a new user namespace");
-               handler->clone_flags |= CLONE_NEWUSER;
+       if (socketpair(AF_UNIX, SOCK_DGRAM, 0, handler->ttysock) < 0) {
+               lxc_sync_fini(handler);
+               return -1;
        }
 
-       if (handler->conf->inherit_ns_fd[LXC_NS_NET] == -1) {
-               if (!lxc_requests_empty_network(handler))
-                       handler->clone_flags |= CLONE_NEWNET;
+       resolve_clone_flags(handler);
 
+       if (handler->clone_flags & CLONE_NEWNET) {
                if (!lxc_list_empty(&handler->conf->network)) {
 
                        /* Find gateway addresses from the link device, which is
@@ -837,23 +947,8 @@ static int lxc_spawn(struct lxc_handler *handler)
                        ERROR("failed to save physical nic info");
                        goto out_abort;
                }
-       } else {
-               INFO("Inheriting a net namespace");
-       }
-
-       if (handler->conf->inherit_ns_fd[LXC_NS_IPC] == -1) {
-               handler->clone_flags |= CLONE_NEWIPC;
-       } else {
-               INFO("Inheriting an IPC namespace");
        }
 
-       if (handler->conf->inherit_ns_fd[LXC_NS_UTS] == -1) {
-               handler->clone_flags |= CLONE_NEWUTS;
-       } else {
-               INFO("Inheriting a UTS namespace");
-       }
-
-
        if (!cgroup_init(handler)) {
                ERROR("failed initializing cgroup support");
                goto out_delete_net;
@@ -974,6 +1069,12 @@ static int lxc_spawn(struct lxc_handler *handler)
        cgroup_disconnect();
        cgroups_connected = false;
 
+       /* read tty fds allocated by child */
+       if (recv_ttys_from_child(handler) < 0) {
+               ERROR("failed to receive tty info from child");
+               goto out_delete_net;
+       }
+
        /* Tell the child to complete its initialization and wait for
         * it to exec or return an error.  (the child will never
         * return LXC_SYNC_POST_CGROUP+1.  It will either close the
@@ -1037,7 +1138,8 @@ int get_netns_fd(int pid)
 }
 
 int __lxc_start(const char *name, struct lxc_conf *conf,
-               struct lxc_operations* ops, void *data, const char *lxcpath)
+               struct lxc_operations* ops, void *data, const char *lxcpath,
+               bool backgrounded)
 {
        struct lxc_handler *handler;
        int err = -1;
@@ -1051,6 +1153,7 @@ int __lxc_start(const char *name, struct lxc_conf *conf,
        }
        handler->ops = ops;
        handler->data = data;
+       handler->backgrounded = backgrounded;
 
        if (must_drop_cap_sys_boot(handler->conf)) {
                #if HAVE_SYS_CAPABILITY_H
@@ -1075,6 +1178,7 @@ int __lxc_start(const char *name, struct lxc_conf *conf,
                                ERROR("Error unsharing mounts");
                                goto out_fini_nonet;
                        }
+                       remount_all_slave();
                        if (do_rootfs_setup(conf, name, lxcpath) < 0) {
                                ERROR("Error setting up rootfs mount as root before spawn");
                                goto out_fini_nonet;
@@ -1089,6 +1193,8 @@ int __lxc_start(const char *name, struct lxc_conf *conf,
                goto out_detach_blockdev;
        }
 
+       handler->conf->reboot = 0;
+
        netnsfd = get_netns_fd(handler->pid);
 
        err = lxc_poll(name, handler);
@@ -1126,7 +1232,12 @@ int __lxc_start(const char *name, struct lxc_conf *conf,
                }
         }
 
+       DEBUG("Pushing physical nics back to host namespace");
        lxc_rename_phys_nics_on_shutdown(netnsfd, handler->conf);
+
+       DEBUG("Tearing down virtual network devices used by container");
+       lxc_delete_network(handler);
+
        if (netnsfd >= 0)
                close(netnsfd);
 
@@ -1135,6 +1246,7 @@ int __lxc_start(const char *name, struct lxc_conf *conf,
                handler->pinfd = -1;
        }
 
+       lxc_monitor_send_exit_code(name, status, handler->lxcpath);
        err =  lxc_error_set_and_log(handler->pid, status);
 out_fini:
        lxc_delete_network(handler);
@@ -1180,15 +1292,75 @@ static struct lxc_operations start_ops = {
 };
 
 int lxc_start(const char *name, char *const argv[], struct lxc_conf *conf,
-             const char *lxcpath)
+             const char *lxcpath, bool backgrounded)
 {
        struct start_args start_arg = {
                .argv = argv,
        };
 
-       if (lxc_check_inherited(conf, -1))
-               return -1;
-
        conf->need_utmp_watch = 1;
-       return __lxc_start(name, conf, &start_ops, &start_arg, lxcpath);
+       return __lxc_start(name, conf, &start_ops, &start_arg, lxcpath, backgrounded);
+}
+
+static void lxc_destroy_container_on_signal(struct lxc_handler *handler,
+                                           const char *name)
+{
+       char destroy[MAXPATHLEN];
+       bool bret = true;
+       int ret = 0;
+       struct lxc_container *c;
+       if (handler->conf && handler->conf->rootfs.path && handler->conf->rootfs.mount) {
+               bret = do_destroy_container(handler->conf);
+               if (!bret) {
+                       ERROR("Error destroying rootfs for %s", name);
+                       return;
+               }
+       }
+       INFO("Destroyed rootfs for %s", name);
+
+       ret = snprintf(destroy, MAXPATHLEN, "%s/%s", handler->lxcpath, name);
+       if (ret < 0 || ret >= MAXPATHLEN) {
+               ERROR("Error printing path for %s", name);
+               ERROR("Error destroying directory for %s", name);
+               return;
+       }
+
+       c = lxc_container_new(name, handler->lxcpath);
+       if (c) {
+               if (container_disk_lock(c)) {
+                       INFO("Could not update lxc_snapshots file");
+                       lxc_container_put(c);
+               } else {
+                       mod_all_rdeps(c, false);
+                       container_disk_unlock(c);
+                       lxc_container_put(c);
+               }
+       }
+
+       if (am_unpriv())
+               ret = userns_exec_1(handler->conf, lxc_rmdir_onedev_wrapper, destroy);
+       else
+               ret = lxc_rmdir_onedev(destroy, NULL);
+
+       if (ret < 0) {
+               ERROR("Error destroying directory for %s", name);
+               return;
+       }
+       INFO("Destroyed directory for %s", name);
 }
+
+static int lxc_rmdir_onedev_wrapper(void *data)
+{
+       char *arg = (char *) data;
+       return lxc_rmdir_onedev(arg, NULL);
+}
+
+static bool do_destroy_container(struct lxc_conf *conf) {
+        if (am_unpriv()) {
+                if (userns_exec_1(conf, bdev_destroy_wrapper, conf) < 0)
+                        return false;
+                return true;
+        }
+        return bdev_destroy(conf);
+}
+