* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
*/
-#define _GNU_SOURCE
-#include "config.h"
-
-#include <alloca.h>
+#ifndef _GNU_SOURCE
+#define _GNU_SOURCE 1
+#endif
#include <dirent.h>
#include <errno.h>
#include <fcntl.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
-#include <unistd.h>
#include <sys/file.h>
#include <sys/mount.h>
#include <sys/param.h>
#include <sys/types.h>
#include <sys/un.h>
#include <sys/wait.h>
-
-#if HAVE_LIBCAP
-#include <sys/capability.h>
-#endif
+#include <unistd.h>
#include "af_unix.h"
#include "caps.h"
#include "commands.h"
#include "commands_utils.h"
#include "conf.h"
+#include "config.h"
#include "confile_utils.h"
#include "error.h"
#include "file_utils.h"
#include "list.h"
-#include "lsm/lsm.h"
#include "log.h"
+#include "lsm/lsm.h"
#include "lxccontainer.h"
#include "lxclock.h"
#include "lxcseccomp.h"
#include "macro.h"
#include "mainloop.h"
+#include "memory_utils.h"
#include "monitor.h"
#include "namespace.h"
#include "network.h"
+#include "raw_syscalls.h"
#include "start.h"
#include "storage/storage.h"
#include "storage/storage_utils.h"
#include "sync.h"
+#include "syscall_wrappers.h"
#include "terminal.h"
#include "utils.h"
+#if HAVE_LIBCAP
+#include <sys/capability.h>
+#endif
+
#ifndef HAVE_STRLCPY
#include "include/strlcpy.h"
#endif
static void print_top_failing_dir(const char *path)
{
+ __do_free char *copy = NULL;
int ret;
- size_t len;
- char *copy, *e, *p, saved;
-
- len = strlen(path);
- copy = alloca(len + 1);
- (void)strlcpy(copy, path, len + 1);
+ char *e, *p, saved;
+ copy = must_copy_string(path);
p = copy;
- e = copy + len;
+ e = copy + strlen(path);
while (p < e) {
while (p < e && *p == '/')
fd = lxc_try_preserve_ns(pid, ns_info[i].proc_name);
if (fd < 0) {
- handler->nsfd[i] = -EBADF;
-
/* Do not fail to start container on kernels that do
* not support interacting with namespaces through
* /proc.
return (fd == STDIN_FILENO || fd == STDOUT_FILENO || fd == STDERR_FILENO);
}
+#ifdef HAVE_DLOG
+static bool match_dlog_fds(struct dirent *direntp)
+{
+ char path[PATH_MAX] = {0};
+ char link[PATH_MAX] = {0};
+ ssize_t linklen;
+ int ret;
+
+ ret = snprintf(path, PATH_MAX, "/proc/self/fd/%s", direntp->d_name);
+ if (ret < 0 || ret >= PATH_MAX) {
+ ERROR("Failed to create file descriptor name");
+ return false;
+ }
+
+ linklen = readlink(path, link, PATH_MAX);
+ if (linklen < 0) {
+ SYSERROR("Failed to read link path - \"%s\"", path);
+ return false;
+ } else if (linklen >= PATH_MAX) {
+ ERROR("The name of link path is too long - \"%s\"", path);
+ return false;
+ }
+
+ if (strcmp(link, "/dev/log_main") == 0 ||
+ strcmp(link, "/dev/log_system") == 0 ||
+ strcmp(link, "/dev/log_radio") == 0)
+ return true;
+
+ return false;
+}
+#endif
+
int lxc_check_inherited(struct lxc_conf *conf, bool closeall,
int *fds_to_ignore, size_t len_fds)
{
if (match_stdfds(fd))
continue;
+#ifdef HAVE_DLOG
+ if (match_dlog_fds(direntp))
+ continue;
+
+#endif
if (closeall) {
close(fd);
closedir(dir);
static int setup_signal_fd(sigset_t *oldmask)
{
int ret;
- int sig;
sigset_t mask;
const int signals[] = {SIGBUS, SIGILL, SIGSEGV, SIGWINCH};
if (ret < 0)
return -EBADF;
- for (sig = 0; sig < (sizeof(signals) / sizeof(signals[0])); sig++) {
+ for (int sig = 0; sig < (sizeof(signals) / sizeof(signals[0])); sig++) {
ret = sigdelset(&mask, signals[sig]);
if (ret < 0)
return -EBADF;
if (siginfo.ssi_signo == SIGHUP) {
kill(hdlr->pid, SIGTERM);
INFO("Killing %d since terminal hung up", hdlr->pid);
- return hdlr->init_died ? LXC_MAINLOOP_CLOSE : LXC_MAINLOOP_CONTINUE;
+ return hdlr->init_died ? LXC_MAINLOOP_CLOSE
+ : LXC_MAINLOOP_CONTINUE;
}
if (siginfo.ssi_signo != SIGCHLD) {
kill(hdlr->pid, siginfo.ssi_signo);
INFO("Forwarded signal %d to pid %d", siginfo.ssi_signo, hdlr->pid);
- return hdlr->init_died ? LXC_MAINLOOP_CLOSE : LXC_MAINLOOP_CONTINUE;
+ return hdlr->init_died ? LXC_MAINLOOP_CLOSE
+ : LXC_MAINLOOP_CONTINUE;
}
/* More robustness, protect ourself from a SIGCHLD sent
if (siginfo.ssi_pid != hdlr->pid) {
NOTICE("Received %d from pid %d instead of container init %d",
siginfo.ssi_signo, siginfo.ssi_pid, hdlr->pid);
- return hdlr->init_died ? LXC_MAINLOOP_CLOSE : LXC_MAINLOOP_CONTINUE;
+ return hdlr->init_died ? LXC_MAINLOOP_CLOSE
+ : LXC_MAINLOOP_CONTINUE;
}
if (siginfo.ssi_code == CLD_STOPPED) {
INFO("Container init process was stopped");
- return hdlr->init_died ? LXC_MAINLOOP_CLOSE : LXC_MAINLOOP_CONTINUE;
- } else if (siginfo.ssi_code == CLD_CONTINUED) {
+ return hdlr->init_died ? LXC_MAINLOOP_CLOSE
+ : LXC_MAINLOOP_CONTINUE;
+ }
+
+ if (siginfo.ssi_code == CLD_CONTINUED) {
INFO("Container init process was continued");
- return hdlr->init_died ? LXC_MAINLOOP_CLOSE : LXC_MAINLOOP_CONTINUE;
+ return hdlr->init_died ? LXC_MAINLOOP_CLOSE
+ : LXC_MAINLOOP_CONTINUE;
}
DEBUG("Container init process %d exited", hdlr->pid);
+
return LXC_MAINLOOP_CLOSE;
}
size_t retlen;
ssize_t ret;
struct lxc_list *cur, *next;
- struct lxc_state_client *client;
struct lxc_msg msg = {.type = lxc_msg_state, .value = state};
if (state == THAWED)
return -E2BIG;
lxc_list_for_each_safe(cur, &handler->conf->state_clients, next) {
- client = cur->elem;
+ struct lxc_state_client *client = cur->elem;
if (client->states[state] == 0) {
TRACE("State %s not registered for state client %d",
{
ssize_t ret;
- if (!handler->backgrounded ||
+ if (!handler->daemonize ||
handler->state_socket_pair[1] < 0 ||
state == STARTING)
return 0;
goto out_mainloop_console;
}
+#if HAVE_DECL_SECCOMP_NOTIF_GET_FD
+ if (handler->conf->has_seccomp_notify &&
+ handler->conf->seccomp_notify_proxy_addr.sun_path[1] != '\0') {
+ __do_close_prot_errno int notify_fd = -EBADF;
+
+ notify_fd = lxc_unix_connect(&handler->conf->seccomp_notify_proxy_addr);
+ if (notify_fd < 0)
+ goto out_mainloop_console;
+
+ /* 30 second timeout */
+ ret = lxc_socket_set_timeout(notify_fd, 30, 30);
+ if (ret)
+ goto out_mainloop_console;
+
+ ret = lxc_mainloop_add_handler(&descr,
+ handler->conf->seccomp_notify_fd,
+ seccomp_notify_handler, handler);
+ if (ret < 0) {
+ ERROR("Failed to add seccomp notify handler for %d to mainloop",
+ handler->conf->seccomp_notify_fd);
+ goto out_mainloop_console;
+ }
+
+ handler->conf->seccomp_notify_proxy_fd = move_fd(notify_fd);
+ }
+#endif
+
if (has_console) {
struct lxc_terminal *console = &handler->conf->console;
if (handler->state_socket_pair[1] >= 0)
close(handler->state_socket_pair[1]);
+ if (handler->cgroup_ops)
+ cgroup_exit(handler->cgroup_ops);
+
handler->conf = NULL;
free(handler);
handler = NULL;
const char *loglevel;
struct lxc_conf *conf = handler->conf;
+ handler->monitor_pid = lxc_raw_getpid();
+
lsm_init();
TRACE("Initialized LSM");
return 0;
out_destroy_cgroups:
- handler->cgroup_ops->destroy(handler->cgroup_ops, handler);
+ handler->cgroup_ops->payload_destroy(handler->cgroup_ops, handler);
+ handler->cgroup_ops->monitor_destroy(handler->cgroup_ops, handler);
out_delete_terminal:
lxc_terminal_delete(&handler->conf->console);
lsm_process_cleanup(handler->conf, handler->lxcpath);
- cgroup_ops->destroy(cgroup_ops, handler);
- cgroup_exit(cgroup_ops);
+ cgroup_ops->payload_destroy(cgroup_ops, handler);
+ cgroup_ops->monitor_destroy(cgroup_ops, handler);
if (handler->conf->reboot == REBOOT_NONE) {
/* For all new state clients simply close the command socket.
lxc_set_state(name, handler, STOPPED);
}
+ /* Avoid lingering namespace references. */
+ lxc_put_nsfds(handler);
+
ret = run_lxc_hooks(name, "post-stop", handler->conf, NULL);
if (ret < 0) {
ERROR("Failed to run lxc.hook.post-stop for container \"%s\"", name);
static int do_start(void *data)
{
+ struct lxc_handler *handler = data;
+ ATTR_UNUSED __do_close_prot_errno int data_sock0 = handler->data_sock[0],
+ data_sock1 = handler->data_sock[1];
int ret;
char path[PATH_MAX];
uid_t new_uid;
uid_t nsuid = 0;
gid_t nsgid = 0;
int devnull_fd = -1;
- struct lxc_handler *handler = data;
lxc_sync_fini_parent(handler);
* exit before we set the pdeath signal leading to a unsupervized
* container.
*/
- ret = lxc_set_death_signal(SIGKILL);
+ ret = lxc_set_death_signal(SIGKILL, handler->monitor_pid);
if (ret < 0) {
SYSERROR("Failed to set PR_SET_PDEATHSIG to SIGKILL");
goto out_warn_father;
goto out_warn_father;
/* set{g,u}id() clears deathsignal */
- ret = lxc_set_death_signal(SIGKILL);
+ ret = lxc_set_death_signal(SIGKILL, handler->monitor_pid);
if (ret < 0) {
SYSERROR("Failed to set PR_SET_PDEATHSIG to SIGKILL");
goto out_warn_father;
* means that migration won't work, but at least we won't spew output
* where it isn't wanted.
*/
- if (handler->backgrounded && !handler->conf->autodev) {
+ if (handler->daemonize && !handler->conf->autodev) {
ret = access(path, F_OK);
if (ret != 0) {
devnull_fd = open_devnull();
if (handler->ns_clone_flags & CLONE_NEWCGROUP) {
ret = unshare(CLONE_NEWCGROUP);
if (ret < 0) {
- INFO("Failed to unshare CLONE_NEWCGROUP");
- goto out_warn_father;
+ if (errno != EINVAL) {
+ SYSERROR("Failed to unshare CLONE_NEWCGROUP");
+ goto out_warn_father;
+ }
+
+ handler->ns_clone_flags &= ~CLONE_NEWCGROUP;
+ SYSINFO("Kernel does not support CLONE_NEWCGROUP");
+ } else {
+ INFO("Unshared CLONE_NEWCGROUP");
}
- INFO("Unshared CLONE_NEWCGROUP");
}
/* Add the requested environment variables to the current environment to
/* Setup the container, ip, names, utsname, ... */
ret = lxc_setup(handler);
- close(handler->data_sock[1]);
- close(handler->data_sock[0]);
if (ret < 0) {
ERROR("Failed to setup container \"%s\"", handler->name);
goto out_warn_father;
* make sure that that pty is stdin,stdout,stderr.
*/
if (handler->conf->console.slave >= 0) {
- if (handler->backgrounded || !handler->conf->is_execute)
+ if (handler->daemonize || !handler->conf->is_execute)
ret = set_stdfds(handler->conf->console.slave);
else
ret = lxc_terminal_set_stdfds(handler->conf->console.slave);
if (ret < 0)
goto out_warn_father;
+#if HAVE_DECL_SECCOMP_NOTIF_GET_FD
+ if (handler->conf->has_seccomp_notify) {
+ ret = lxc_abstract_unix_send_fds(data_sock0,
+ &handler->conf->seccomp_notify_fd,
+ 1, NULL, 0);
+ if (ret < 0) {
+ SYSERROR("Failed to send seccomp notify fd to parent");
+ goto out_warn_father;
+ }
+ close(handler->conf->seccomp_notify_fd);
+ handler->conf->seccomp_notify_fd = -EBADF;
+ }
+#endif
+
ret = run_lxc_hooks(handler->name, "start", handler->conf, NULL);
if (ret < 0) {
ERROR("Failed to run lxc.hook.start for container \"%s\"",
close(handler->sigfd);
- if (handler->conf->console.slave < 0 && handler->backgrounded) {
+ if (handler->conf->console.slave < 0 && handler->daemonize) {
if (devnull_fd < 0) {
devnull_fd = open_devnull();
if (devnull_fd < 0)
}
if (handler->conf->monitor_signal_pdeath != SIGKILL) {
- ret = lxc_set_death_signal(handler->conf->monitor_signal_pdeath);
+ ret = lxc_set_death_signal(handler->conf->monitor_signal_pdeath, handler->monitor_pid);
if (ret < 0) {
SYSERROR("Failed to set PR_SET_PDEATHSIG to %d",
handler->conf->monitor_signal_pdeath);
struct lxc_conf *conf = handler->conf;
for (i = 0; i < LXC_NS_MAX; i++) {
- if (conf->ns_keep != 0) {
- if ((conf->ns_keep & ns_info[i].clone_flag) == 0)
+ if (conf->ns_keep) {
+ if (!(conf->ns_keep & ns_info[i].clone_flag))
handler->ns_clone_flags |= ns_info[i].clone_flag;
- } else if (conf->ns_clone != 0) {
- if ((conf->ns_clone & ns_info[i].clone_flag) > 0)
+ } else if (conf->ns_clone) {
+ if ((conf->ns_clone & ns_info[i].clone_flag))
handler->ns_clone_flags |= ns_info[i].clone_flag;
} else {
if (i == LXC_NS_USER && lxc_list_empty(&handler->conf->id_map))
* getpid() in the child would return the parent's pid. This is all fixed in
* newer glibc versions where the getpid() cache is removed and the pid/tid is
* not reset anymore.
- * However, if for whatever reason you - dear commiter - somehow need to get the
+ * However, if for whatever reason you - dear committer - somehow need to get the
* pid of the dummy intermediate process for do_share_ns() you need to call
* lxc_raw_getpid(). The next lxc_raw_clone() call does not employ CLONE_VM and
* will be fine.
return 0;
}
-static int lxc_setup_shmount(struct lxc_conf *conf)
-{
- size_t len_cont;
- char *full_cont_path;
- int ret = -1;
-
- /* Construct the shmount path under the container root. */
- len_cont = strlen(conf->rootfs.mount) + 1 + strlen(conf->shmount.path_cont);
- /* +1 for the terminating '\0' */
- full_cont_path = malloc(len_cont + 1);
- if (!full_cont_path) {
- SYSERROR("Not enough memory");
- return -ENOMEM;
- }
-
- ret = snprintf(full_cont_path, len_cont + 1, "%s/%s",
- conf->rootfs.mount, conf->shmount.path_cont);
- if (ret < 0 || ret >= len_cont + 1) {
- SYSERROR("Failed to create filename");
- free(full_cont_path);
- return -1;
- }
-
- /* Check if shmount point is already set up. */
- if (is_shared_mountpoint(conf->shmount.path_host)) {
- INFO("Path \"%s\" is already MS_SHARED. Reusing",
- conf->shmount.path_host);
- free(full_cont_path);
- return 0;
- }
-
- /* Create host and cont mount paths */
- ret = mkdir_p(conf->shmount.path_host, 0711);
- if (ret < 0 && errno != EEXIST) {
- SYSERROR("Failed to create directory \"%s\"",
- conf->shmount.path_host);
- free(full_cont_path);
- return ret;
- }
-
- ret = mkdir_p(full_cont_path, 0711);
- if (ret < 0 && errno != EEXIST) {
- SYSERROR("Failed to create directory \"%s\"", full_cont_path);
- free(full_cont_path);
- return ret;
- }
-
- /* Prepare host mountpoint */
- ret = mount("tmpfs", conf->shmount.path_host, "tmpfs", 0,
- "size=100k,mode=0711");
- if (ret < 0) {
- SYSERROR("Failed to mount \"%s\"", conf->shmount.path_host);
- free(full_cont_path);
- return ret;
- }
-
- ret = mount(conf->shmount.path_host, conf->shmount.path_host, "none",
- MS_REC | MS_SHARED, "");
- if (ret < 0) {
- SYSERROR("Failed to make shared \"%s\"", conf->shmount.path_host);
- free(full_cont_path);
- return ret;
- }
-
- INFO("Setup shared mount point \"%s\"", conf->shmount.path_host);
- free(full_cont_path);
- return 0;
-}
-
/* lxc_spawn() performs crucial setup tasks and clone()s the new process which
* exec()s the requested container binary.
* Note that lxc_spawn() runs in the parent namespaces. Any operations performed
*/
static int lxc_spawn(struct lxc_handler *handler)
{
+ __do_close_prot_errno int data_sock0 = -EBADF, data_sock1 = -EBADF;
int i, ret;
char pidstr[20];
bool wants_to_map_ids;
handler->data_sock);
if (ret < 0)
goto out_sync_fini;
+ data_sock0 = handler->data_sock[0];
+ data_sock1 = handler->data_sock[1];
ret = resolve_clone_flags(handler);
if (ret < 0)
goto out_sync_fini;
- if (conf->shmount.path_host) {
- if (!conf->shmount.path_cont)
- goto out_sync_fini;
-
- ret = lxc_setup_shmount(conf);
- if (ret < 0) {
- ERROR("Failed to setup shared mount point");
- goto out_sync_fini;
- }
- }
-
if (handler->ns_clone_flags & CLONE_NEWNET) {
if (!lxc_list_empty(&conf->network)) {
}
}
- if (!cgroup_ops->create(cgroup_ops, handler)) {
+ if (!cgroup_ops->payload_create(cgroup_ops, handler)) {
ERROR("Failed creating cgroups");
goto out_delete_net;
}
goto out_delete_net;
}
- if (!cgroup_ops->enter(cgroup_ops, handler->pid))
+ if (!cgroup_ops->payload_enter(cgroup_ops, handler->pid))
goto out_delete_net;
if (!cgroup_ops->chown(cgroup_ops, handler->conf))
ret = lxc_netns_set_nsid(handler->nsfd[LXC_NS_NET]);
if (ret < 0)
- SYSERROR("Failed to allocate new network namespace id");
+ SYSWARN("Failed to allocate new network namespace id");
else
TRACE("Allocated new network namespace id");
}
}
/* Now all networks are created, network devices are moved into place,
- * and the correct names and ifindeces in the respective namespaces have
+ * and the correct names and ifindices in the respective namespaces have
* been recorded. The corresponding structs have now all been filled. So
* log them for debugging purposes.
*/
goto out_delete_net;
}
+#if HAVE_DECL_SECCOMP_NOTIF_GET_FD
+ if (handler->conf->has_seccomp_notify) {
+ ret = lxc_abstract_unix_recv_fds(handler->data_sock[1],
+ &handler->conf->seccomp_notify_fd,
+ 1, NULL, 0);
+ if (ret < 0) {
+ SYSERROR("Failed to receive seccomp notify fd from child");
+ goto out_delete_net;
+ }
+
+ ret = seccomp_notif_alloc(&handler->conf->seccomp_notify_req,
+ &handler->conf->seccomp_notify_resp);
+ if (ret) {
+ errno = ret;
+ ret = -1;
+ goto out_delete_net;
+ }
+ }
+#endif
+
ret = handler->ops->post_start(handler, handler->data);
if (ret < 0)
goto out_abort;
int __lxc_start(const char *name, struct lxc_handler *handler,
struct lxc_operations* ops, void *data, const char *lxcpath,
- bool backgrounded, int *error_num)
+ bool daemonize, int *error_num)
{
int ret, status;
struct lxc_conf *conf = handler->conf;
+ struct cgroup_ops *cgroup_ops;
ret = lxc_init(name, handler);
if (ret < 0) {
}
handler->ops = ops;
handler->data = data;
- handler->backgrounded = backgrounded;
+ handler->daemonize = daemonize;
+ cgroup_ops = handler->cgroup_ops;
if (!attach_block_device(handler->conf)) {
ERROR("Failed to attach block device");
+ ret = -1;
+ goto out_fini_nonet;
+ }
+
+ if (!cgroup_ops->monitor_create(cgroup_ops, handler)) {
+ ERROR("Failed to create monitor cgroup");
+ ret = -1;
+ goto out_fini_nonet;
+ }
+
+ if (!cgroup_ops->monitor_enter(cgroup_ops, handler->monitor_pid)) {
+ ERROR("Failed to enter monitor cgroup");
+ ret = -1;
goto out_fini_nonet;
}
ERROR("Failed to spawn container \"%s\"", name);
goto out_detach_blockdev;
}
- /* close parent side of data socket */
- close(handler->data_sock[0]);
- handler->data_sock[0] = -1;
- close(handler->data_sock[1]);
- handler->data_sock[1] = -1;
handler->conf->reboot = REBOOT_NONE;
if (!handler->init_died && handler->pid > 0) {
ERROR("Child process is not killed");
+ ret = -1;
goto out_abort;
}
};
int lxc_start(const char *name, char *const argv[], struct lxc_handler *handler,
- const char *lxcpath, bool backgrounded, int *error_num)
+ const char *lxcpath, bool daemonize, int *error_num)
{
struct start_args start_arg = {
.argv = argv,
};
TRACE("Doing lxc_start");
- return __lxc_start(name, handler, &start_ops, &start_arg, lxcpath, backgrounded, error_num);
+ return __lxc_start(name, handler, &start_ops, &start_arg, lxcpath, daemonize, error_num);
}
static void lxc_destroy_container_on_signal(struct lxc_handler *handler,
const char *name)
{
- char destroy[MAXPATHLEN];
+ char destroy[PATH_MAX];
struct lxc_container *c;
int ret = 0;
bool bret = true;
}
INFO("Destroyed rootfs for container \"%s\"", name);
- ret = snprintf(destroy, MAXPATHLEN, "%s/%s", handler->lxcpath, name);
- if (ret < 0 || ret >= MAXPATHLEN) {
+ ret = snprintf(destroy, PATH_MAX, "%s/%s", handler->lxcpath, name);
+ if (ret < 0 || ret >= PATH_MAX) {
ERROR("Error destroying directory for container \"%s\"", name);
return;
}
projects / mirror_lxc.git / blobdiff