#include "caps.h"
#include "bdev.h"
#include "lsm/lsm.h"
+#include "lxclock.h"
lxc_log_define(lxc_start, lxc);
[LXC_NS_NET] = {"net", CLONE_NEWNET}
};
+extern void mod_all_rdeps(struct lxc_container *c, bool inc);
+static bool do_destroy_container(struct lxc_conf *conf);
+static int lxc_rmdir_onedev_wrapper(void *data);
+static void lxc_destroy_container_on_signal(struct lxc_handler *handler,
+ const char *name);
+
static void print_top_failing_dir(const char *path)
{
size_t len = strlen(path);
if (fd == fddir || fd == lxc_log_fd || fd == fd_to_ignore)
continue;
+ if (current_config && fd == current_config->logfd)
+ continue;
+
if (match_fd(fd))
continue;
}
/* Start of environment variable setup for hooks */
- if (setenv("LXC_NAME", name, 1)) {
+ if (name && setenv("LXC_NAME", name, 1)) {
SYSERROR("failed to set environment variable for container name");
}
- if (setenv("LXC_CONFIG_FILE", conf->rcfile, 1)) {
+ if (conf->rcfile && setenv("LXC_CONFIG_FILE", conf->rcfile, 1)) {
SYSERROR("failed to set environment variable for config path");
}
- if (setenv("LXC_ROOTFS_MOUNT", conf->rootfs.mount, 1)) {
+ if (conf->rootfs.mount && setenv("LXC_ROOTFS_MOUNT", conf->rootfs.mount, 1)) {
SYSERROR("failed to set environment variable for rootfs mount");
}
- if (setenv("LXC_ROOTFS_PATH", conf->rootfs.path, 1)) {
+ if (conf->rootfs.path && setenv("LXC_ROOTFS_PATH", conf->rootfs.path, 1)) {
SYSERROR("failed to set environment variable for rootfs mount");
}
if (conf->console.path && setenv("LXC_CONSOLE", conf->console.path, 1)) {
close(handler->ttysock[0]);
close(handler->ttysock[1]);
}
+ if (handler->conf->ephemeral == 1 && handler->conf->reboot != 1) {
+ lxc_destroy_container_on_signal(handler, name);
+ }
cgroup_destroy(handler);
free(handler);
}
/*
* if we are in a new user namespace, become root there to have
- * privilege over our namespace
+ * privilege over our namespace. When using lxc-execute we default to root,
+ * but this can be overriden using the lxc.init_uid and lxc.init_gid
+ * configuration options.
*/
if (!lxc_list_empty(&handler->conf->id_map)) {
- NOTICE("switching to gid/uid 0 in new user namespace");
- if (setgid(0)) {
+ gid_t new_gid = 0;
+ if (handler->conf->is_execute && handler->conf->init_gid)
+ new_gid = handler->conf->init_gid;
+
+ uid_t new_uid = 0;
+ if (handler->conf->is_execute && handler->conf->init_uid)
+ new_uid = handler->conf->init_uid;
+
+ NOTICE("switching to gid/uid %d/%d in new user namespace", new_gid, new_uid);
+ if (setgid(new_gid)) {
SYSERROR("setgid");
goto out_warn_father;
}
- if (setuid(0)) {
+ if (setuid(new_uid)) {
SYSERROR("setuid");
goto out_warn_father;
}
close(handler->sigfd);
+ if (handler->backgrounded && null_stdfds() < 0)
+ goto out_warn_father;
+
/* after this call, we are in error because this
* ops should not return as it execs */
handler->ops->start(handler, handler->data);
}
int __lxc_start(const char *name, struct lxc_conf *conf,
- struct lxc_operations* ops, void *data, const char *lxcpath)
+ struct lxc_operations* ops, void *data, const char *lxcpath,
+ bool backgrounded)
{
struct lxc_handler *handler;
int err = -1;
}
handler->ops = ops;
handler->data = data;
+ handler->backgrounded = backgrounded;
if (must_drop_cap_sys_boot(handler->conf)) {
#if HAVE_SYS_CAPABILITY_H
goto out_detach_blockdev;
}
+ handler->conf->reboot = 0;
+
netnsfd = get_netns_fd(handler->pid);
err = lxc_poll(name, handler);
}
}
+ DEBUG("Pushing physical nics back to host namespace");
lxc_rename_phys_nics_on_shutdown(netnsfd, handler->conf);
+
+ DEBUG("Tearing down virtual network devices used by container");
+ lxc_delete_network(handler);
+
if (netnsfd >= 0)
close(netnsfd);
};
int lxc_start(const char *name, char *const argv[], struct lxc_conf *conf,
- const char *lxcpath)
+ const char *lxcpath, bool backgrounded)
{
struct start_args start_arg = {
.argv = argv,
};
conf->need_utmp_watch = 1;
- return __lxc_start(name, conf, &start_ops, &start_arg, lxcpath);
+ return __lxc_start(name, conf, &start_ops, &start_arg, lxcpath, backgrounded);
}
+
+static void lxc_destroy_container_on_signal(struct lxc_handler *handler,
+ const char *name)
+{
+ char destroy[MAXPATHLEN];
+ bool bret = true;
+ int ret = 0;
+ struct lxc_container *c;
+ if (handler->conf && handler->conf->rootfs.path && handler->conf->rootfs.mount) {
+ bret = do_destroy_container(handler->conf);
+ if (!bret) {
+ ERROR("Error destroying rootfs for %s", name);
+ return;
+ }
+ }
+ INFO("Destroyed rootfs for %s", name);
+
+ ret = snprintf(destroy, MAXPATHLEN, "%s/%s", handler->lxcpath, name);
+ if (ret < 0 || ret >= MAXPATHLEN) {
+ ERROR("Error printing path for %s", name);
+ ERROR("Error destroying directory for %s", name);
+ return;
+ }
+
+ c = lxc_container_new(name, handler->lxcpath);
+ if (c) {
+ if (container_disk_lock(c)) {
+ INFO("Could not update lxc_snapshots file");
+ lxc_container_put(c);
+ } else {
+ mod_all_rdeps(c, false);
+ container_disk_unlock(c);
+ lxc_container_put(c);
+ }
+ }
+
+ if (am_unpriv())
+ ret = userns_exec_1(handler->conf, lxc_rmdir_onedev_wrapper, destroy);
+ else
+ ret = lxc_rmdir_onedev(destroy, NULL);
+
+ if (ret < 0) {
+ ERROR("Error destroying directory for %s", name);
+ return;
+ }
+ INFO("Destroyed directory for %s", name);
+}
+
+static int lxc_rmdir_onedev_wrapper(void *data)
+{
+ char *arg = (char *) data;
+ return lxc_rmdir_onedev(arg, NULL);
+}
+
+static bool do_destroy_container(struct lxc_conf *conf) {
+ if (am_unpriv()) {
+ if (userns_exec_1(conf, bdev_destroy_wrapper, conf) < 0)
+ return false;
+ return true;
+ }
+ return bdev_destroy(conf);
+}
+
projects / mirror_lxc.git / blobdiff