]> git.proxmox.com Git - mirror_lxc.git/blob - src/lxc/conf.c
projects / mirror_lxc.git / blob
? search:
summary | shortlog | log | commit | commitdiff | tree
blame | history | raw | HEAD
start: unify and simplify network creation
[mirror_lxc.git] / src / lxc / conf.c
1 /*
2 * lxc: linux Container library
3 *
4 * (C) Copyright IBM Corp. 2007, 2008
5 *
6 * Authors:
7 * Daniel Lezcano <daniel.lezcano at free.fr>
8 *
9 * This library is free software; you can redistribute it and/or
10 * modify it under the terms of the GNU Lesser General Public
11 * License as published by the Free Software Foundation; either
12 * version 2.1 of the License, or (at your option) any later version.
13 *
14 * This library is distributed in the hope that it will be useful,
15 * but WITHOUT ANY WARRANTY; without even the implied warranty of
16 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
17 * Lesser General Public License for more details.
18 *
19 * You should have received a copy of the GNU Lesser General Public
20 * License along with this library; if not, write to the Free Software
21 * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
22 */
23
24 #ifndef _GNU_SOURCE
25 #define _GNU_SOURCE 1
26 #endif
27 #include <arpa/inet.h>
28 #include <dirent.h>
29 #include <errno.h>
30 #include <fcntl.h>
31 #include <grp.h>
32 #include <inttypes.h>
33 #include <libgen.h>
34 #include <linux/loop.h>
35 #include <net/if.h>
36 #include <netinet/in.h>
37 #include <pwd.h>
38 #include <stdarg.h>
39 #include <stdio.h>
40 #include <stdlib.h>
41 #include <string.h>
42 #include <sys/mman.h>
43 #include <sys/mount.h>
44 #include <sys/param.h>
45 #include <sys/prctl.h>
46 #include <sys/sendfile.h>
47 #include <sys/socket.h>
48 #include <sys/stat.h>
49 #include <sys/syscall.h>
50 #include <sys/sysmacros.h>
51 #include <sys/types.h>
52 #include <sys/utsname.h>
53 #include <sys/wait.h>
54 #include <time.h>
55 #include <unistd.h>
56
57 #include "af_unix.h"
58 #include "caps.h"
59 #include "cgroup.h"
60 #include "conf.h"
61 #include "config.h"
62 #include "confile.h"
63 #include "confile_utils.h"
64 #include "error.h"
65 #include "log.h"
66 #include "lsm/lsm.h"
67 #include "lxclock.h"
68 #include "lxcseccomp.h"
69 #include "macro.h"
70 #include "memory_utils.h"
71 #include "namespace.h"
72 #include "network.h"
73 #include "parse.h"
74 #include "raw_syscalls.h"
75 #include "ringbuf.h"
76 #include "start.h"
77 #include "storage.h"
78 #include "storage/overlay.h"
79 #include "syscall_wrappers.h"
80 #include "terminal.h"
81 #include "utils.h"
82 #include "uuid.h"
83
84 #ifdef MAJOR_IN_MKDEV
85 #include <sys/mkdev.h>
86 #endif
87
88 #ifdef HAVE_STATVFS
89 #include <sys/statvfs.h>
90 #endif
91
92 #if HAVE_PTY_H
93 #include <pty.h>
94 #else
95 #include <../include/openpty.h>
96 #endif
97
98 #if HAVE_LIBCAP
99 #include <sys/capability.h>
100 #endif
101
102 #if HAVE_SYS_PERSONALITY_H
103 #include <sys/personality.h>
104 #endif
105
106 #ifndef HAVE_STRLCAT
107 #include "include/strlcat.h"
108 #endif
109
110 #if IS_BIONIC
111 #include <../include/lxcmntent.h>
112 #else
113 #include <mntent.h>
114 #endif
115
116 #if !defined(HAVE_PRLIMIT) && defined(HAVE_PRLIMIT64)
117 #include <../include/prlimit.h>
118 #endif
119
120 lxc_log_define(conf, lxc);
121
122 /* The lxc_conf of the container currently being worked on in an API call.
123 * This is used in the error calls.
124 */
125 #ifdef HAVE_TLS
126 thread_local struct lxc_conf *current_config;
127 #else
128 struct lxc_conf *current_config;
129 #endif
130
131 char *lxchook_names[NUM_LXC_HOOKS] = {
132 "pre-start",
133 "pre-mount",
134 "mount",
135 "autodev",
136 "start",
137 "stop",
138 "post-stop",
139 "clone",
140 "destroy",
141 "start-host"
142 };
143
144 struct mount_opt {
145 char *name;
146 int clear;
147 int flag;
148 };
149
150 struct caps_opt {
151 char *name;
152 int value;
153 };
154
155 struct limit_opt {
156 char *name;
157 int value;
158 };
159
160 static struct mount_opt mount_opt[] = {
161 { "async", 1, MS_SYNCHRONOUS },
162 { "atime", 1, MS_NOATIME },
163 { "bind", 0, MS_BIND },
164 { "defaults", 0, 0 },
165 { "dev", 1, MS_NODEV },
166 { "diratime", 1, MS_NODIRATIME },
167 { "dirsync", 0, MS_DIRSYNC },
168 { "exec", 1, MS_NOEXEC },
169 { "lazytime", 0, MS_LAZYTIME },
170 { "mand", 0, MS_MANDLOCK },
171 { "noatime", 0, MS_NOATIME },
172 { "nodev", 0, MS_NODEV },
173 { "nodiratime", 0, MS_NODIRATIME },
174 { "noexec", 0, MS_NOEXEC },
175 { "nomand", 1, MS_MANDLOCK },
176 { "norelatime", 1, MS_RELATIME },
177 { "nostrictatime", 1, MS_STRICTATIME },
178 { "nosuid", 0, MS_NOSUID },
179 { "rbind", 0, MS_BIND|MS_REC },
180 { "relatime", 0, MS_RELATIME },
181 { "remount", 0, MS_REMOUNT },
182 { "ro", 0, MS_RDONLY },
183 { "rw", 1, MS_RDONLY },
184 { "strictatime", 0, MS_STRICTATIME },
185 { "suid", 1, MS_NOSUID },
186 { "sync", 0, MS_SYNCHRONOUS },
187 { NULL, 0, 0 },
188 };
189
190 static struct mount_opt propagation_opt[] = {
191 { "private", 0, MS_PRIVATE },
192 { "shared", 0, MS_SHARED },
193 { "slave", 0, MS_SLAVE },
194 { "unbindable", 0, MS_UNBINDABLE },
195 { "rprivate", 0, MS_PRIVATE|MS_REC },
196 { "rshared", 0, MS_SHARED|MS_REC },
197 { "rslave", 0, MS_SLAVE|MS_REC },
198 { "runbindable", 0, MS_UNBINDABLE|MS_REC },
199 { NULL, 0, 0 },
200 };
201
202 static struct caps_opt caps_opt[] = {
203 #if HAVE_LIBCAP
204 { "chown", CAP_CHOWN },
205 { "dac_override", CAP_DAC_OVERRIDE },
206 { "dac_read_search", CAP_DAC_READ_SEARCH },
207 { "fowner", CAP_FOWNER },
208 { "fsetid", CAP_FSETID },
209 { "kill", CAP_KILL },
210 { "setgid", CAP_SETGID },
211 { "setuid", CAP_SETUID },
212 { "setpcap", CAP_SETPCAP },
213 { "linux_immutable", CAP_LINUX_IMMUTABLE },
214 { "net_bind_service", CAP_NET_BIND_SERVICE },
215 { "net_broadcast", CAP_NET_BROADCAST },
216 { "net_admin", CAP_NET_ADMIN },
217 { "net_raw", CAP_NET_RAW },
218 { "ipc_lock", CAP_IPC_LOCK },
219 { "ipc_owner", CAP_IPC_OWNER },
220 { "sys_module", CAP_SYS_MODULE },
221 { "sys_rawio", CAP_SYS_RAWIO },
222 { "sys_chroot", CAP_SYS_CHROOT },
223 { "sys_ptrace", CAP_SYS_PTRACE },
224 { "sys_pacct", CAP_SYS_PACCT },
225 { "sys_admin", CAP_SYS_ADMIN },
226 { "sys_boot", CAP_SYS_BOOT },
227 { "sys_nice", CAP_SYS_NICE },
228 { "sys_resource", CAP_SYS_RESOURCE },
229 { "sys_time", CAP_SYS_TIME },
230 { "sys_tty_config", CAP_SYS_TTY_CONFIG },
231 { "mknod", CAP_MKNOD },
232 { "lease", CAP_LEASE },
233 #ifdef CAP_AUDIT_READ
234 { "audit_read", CAP_AUDIT_READ },
235 #endif
236 #ifdef CAP_AUDIT_WRITE
237 { "audit_write", CAP_AUDIT_WRITE },
238 #endif
239 #ifdef CAP_AUDIT_CONTROL
240 { "audit_control", CAP_AUDIT_CONTROL },
241 #endif
242 { "setfcap", CAP_SETFCAP },
243 { "mac_override", CAP_MAC_OVERRIDE },
244 { "mac_admin", CAP_MAC_ADMIN },
245 #ifdef CAP_SYSLOG
246 { "syslog", CAP_SYSLOG },
247 #endif
248 #ifdef CAP_WAKE_ALARM
249 { "wake_alarm", CAP_WAKE_ALARM },
250 #endif
251 #ifdef CAP_BLOCK_SUSPEND
252 { "block_suspend", CAP_BLOCK_SUSPEND },
253 #endif
254 #endif
255 };
256
257 static struct limit_opt limit_opt[] = {
258 #ifdef RLIMIT_AS
259 { "as", RLIMIT_AS },
260 #endif
261 #ifdef RLIMIT_CORE
262 { "core", RLIMIT_CORE },
263 #endif
264 #ifdef RLIMIT_CPU
265 { "cpu", RLIMIT_CPU },
266 #endif
267 #ifdef RLIMIT_DATA
268 { "data", RLIMIT_DATA },
269 #endif
270 #ifdef RLIMIT_FSIZE
271 { "fsize", RLIMIT_FSIZE },
272 #endif
273 #ifdef RLIMIT_LOCKS
274 { "locks", RLIMIT_LOCKS },
275 #endif
276 #ifdef RLIMIT_MEMLOCK
277 { "memlock", RLIMIT_MEMLOCK },
278 #endif
279 #ifdef RLIMIT_MSGQUEUE
280 { "msgqueue", RLIMIT_MSGQUEUE },
281 #endif
282 #ifdef RLIMIT_NICE
283 { "nice", RLIMIT_NICE },
284 #endif
285 #ifdef RLIMIT_NOFILE
286 { "nofile", RLIMIT_NOFILE },
287 #endif
288 #ifdef RLIMIT_NPROC
289 { "nproc", RLIMIT_NPROC },
290 #endif
291 #ifdef RLIMIT_RSS
292 { "rss", RLIMIT_RSS },
293 #endif
294 #ifdef RLIMIT_RTPRIO
295 { "rtprio", RLIMIT_RTPRIO },
296 #endif
297 #ifdef RLIMIT_RTTIME
298 { "rttime", RLIMIT_RTTIME },
299 #endif
300 #ifdef RLIMIT_SIGPENDING
301 { "sigpending", RLIMIT_SIGPENDING },
302 #endif
303 #ifdef RLIMIT_STACK
304 { "stack", RLIMIT_STACK },
305 #endif
306 };
307
308 static int run_buffer(char *buffer)
309 {
310 __do_free char *output = NULL;
311 int fd, ret;
312 struct lxc_popen_FILE *f;
313
314 f = lxc_popen(buffer);
315 if (!f) {
316 SYSERROR("Failed to popen() %s", buffer);
317 return -1;
318 }
319
320 output = malloc(LXC_LOG_BUFFER_SIZE);
321 if (!output) {
322 ERROR("Failed to allocate memory for %s", buffer);
323 lxc_pclose(f);
324 return -1;
325 }
326
327 fd = fileno(f->f);
328 if (fd < 0) {
329 SYSERROR("Failed to retrieve underlying file descriptor");
330 lxc_pclose(f);
331 return -1;
332 }
333
334 for (int i = 0; i < 10; i++) {
335 ssize_t bytes_read;
336
337 bytes_read = lxc_read_nointr(fd, output, LXC_LOG_BUFFER_SIZE - 1);
338 if (bytes_read > 0) {
339 output[bytes_read] = '\0';
340 DEBUG("Script %s produced output: %s", buffer, output);
341 continue;
342 }
343
344 break;
345 }
346
347 ret = lxc_pclose(f);
348 if (ret == -1) {
349 SYSERROR("Script exited with error");
350 return -1;
351 } else if (WIFEXITED(ret) && WEXITSTATUS(ret) != 0) {
352 ERROR("Script exited with status %d", WEXITSTATUS(ret));
353 return -1;
354 } else if (WIFSIGNALED(ret)) {
355 ERROR("Script terminated by signal %d", WTERMSIG(ret));
356 return -1;
357 }
358
359 return 0;
360 }
361
362 int run_script_argv(const char *name, unsigned int hook_version,
363 const char *section, const char *script,
364 const char *hookname, char **argv)
365 {
366 __do_free char *buffer = NULL;
367 int buf_pos, i, ret;
368 size_t size = 0;
369
370 if (hook_version == 0)
371 INFO("Executing script \"%s\" for container \"%s\", config "
372 "section \"%s\"", script, name, section);
373 else
374 INFO("Executing script \"%s\" for container \"%s\"", script, name);
375
376 for (i = 0; argv && argv[i]; i++)
377 size += strlen(argv[i]) + 1;
378
379 size += STRLITERALLEN("exec");
380 size++;
381 size += strlen(script);
382 size++;
383
384 if (size > INT_MAX)
385 return -EFBIG;
386
387 if (hook_version == 0) {
388 size += strlen(hookname);
389 size++;
390
391 size += strlen(name);
392 size++;
393
394 size += strlen(section);
395 size++;
396
397 if (size > INT_MAX)
398 return -EFBIG;
399 }
400
401 buffer = malloc(size);
402 if (!buffer)
403 return -ENOMEM;
404
405 if (hook_version == 0)
406 buf_pos = snprintf(buffer, size, "exec %s %s %s %s", script, name, section, hookname);
407 else
408 buf_pos = snprintf(buffer, size, "exec %s", script);
409 if (buf_pos < 0 || (size_t)buf_pos >= size) {
410 ERROR("Failed to create command line for script \"%s\"", script);
411 return -1;
412 }
413
414 if (hook_version == 1) {
415 ret = setenv("LXC_HOOK_TYPE", hookname, 1);
416 if (ret < 0) {
417 SYSERROR("Failed to set environment variable: "
418 "LXC_HOOK_TYPE=%s", hookname);
419 return -1;
420 }
421 TRACE("Set environment variable: LXC_HOOK_TYPE=%s", hookname);
422
423 ret = setenv("LXC_HOOK_SECTION", section, 1);
424 if (ret < 0) {
425 SYSERROR("Failed to set environment variable: "
426 "LXC_HOOK_SECTION=%s", section);
427 return -1;
428 }
429 TRACE("Set environment variable: LXC_HOOK_SECTION=%s", section);
430
431 if (strcmp(section, "net") == 0) {
432 char *parent;
433
434 if (!argv || !argv[0])
435 return -1;
436
437 ret = setenv("LXC_NET_TYPE", argv[0], 1);
438 if (ret < 0) {
439 SYSERROR("Failed to set environment variable: "
440 "LXC_NET_TYPE=%s", argv[0]);
441 return -1;
442 }
443 TRACE("Set environment variable: LXC_NET_TYPE=%s", argv[0]);
444
445 parent = argv[1] ? argv[1] : "";
446
447 if (strcmp(argv[0], "macvlan") == 0) {
448 ret = setenv("LXC_NET_PARENT", parent, 1);
449 if (ret < 0) {
450 SYSERROR("Failed to set environment "
451 "variable: LXC_NET_PARENT=%s", parent);
452 return -1;
453 }
454 TRACE("Set environment variable: LXC_NET_PARENT=%s", parent);
455 } else if (strcmp(argv[0], "phys") == 0) {
456 ret = setenv("LXC_NET_PARENT", parent, 1);
457 if (ret < 0) {
458 SYSERROR("Failed to set environment "
459 "variable: LXC_NET_PARENT=%s", parent);
460 return -1;
461 }
462 TRACE("Set environment variable: LXC_NET_PARENT=%s", parent);
463 } else if (strcmp(argv[0], "veth") == 0) {
464 char *peer = argv[2] ? argv[2] : "";
465
466 ret = setenv("LXC_NET_PEER", peer, 1);
467 if (ret < 0) {
468 SYSERROR("Failed to set environment "
469 "variable: LXC_NET_PEER=%s", peer);
470 return -1;
471 }
472 TRACE("Set environment variable: LXC_NET_PEER=%s", peer);
473
474 ret = setenv("LXC_NET_PARENT", parent, 1);
475 if (ret < 0) {
476 SYSERROR("Failed to set environment "
477 "variable: LXC_NET_PARENT=%s", parent);
478 return -1;
479 }
480 TRACE("Set environment variable: LXC_NET_PARENT=%s", parent);
481 }
482 }
483 }
484
485 for (i = 0; argv && argv[i]; i++) {
486 size_t len = size - buf_pos;
487
488 ret = snprintf(buffer + buf_pos, len, " %s", argv[i]);
489 if (ret < 0 || (size_t)ret >= len) {
490 ERROR("Failed to create command line for script \"%s\"", script);
491 return -1;
492 }
493 buf_pos += ret;
494 }
495
496 return run_buffer(buffer);
497 }
498
499 int run_script(const char *name, const char *section, const char *script, ...)
500 {
501 __do_free char *buffer = NULL;
502 int ret;
503 char *p;
504 va_list ap;
505 size_t size = 0;
506
507 INFO("Executing script \"%s\" for container \"%s\", config section \"%s\"",
508 script, name, section);
509
510 va_start(ap, script);
511 while ((p = va_arg(ap, char *)))
512 size += strlen(p) + 1;
513 va_end(ap);
514
515 size += STRLITERALLEN("exec");
516 size += strlen(script);
517 size += strlen(name);
518 size += strlen(section);
519 size += 4;
520
521 if (size > INT_MAX)
522 return -1;
523
524 buffer = must_realloc(NULL, size);
525 ret = snprintf(buffer, size, "exec %s %s %s", script, name, section);
526 if (ret < 0 || ret >= size)
527 return -1;
528
529 va_start(ap, script);
530 while ((p = va_arg(ap, char *))) {
531 int len = size - ret;
532 int rc;
533 rc = snprintf(buffer + ret, len, " %s", p);
534 if (rc < 0 || rc >= len) {
535 va_end(ap);
536 return -1;
537 }
538 ret += rc;
539 }
540 va_end(ap);
541
542 return run_buffer(buffer);
543 }
544
545 /* pin_rootfs
546 * if rootfs is a directory, then open ${rootfs}/.lxc-keep for writing for
547 * the duration of the container run, to prevent the container from marking
548 * the underlying fs readonly on shutdown. unlink the file immediately so
549 * no name pollution is happens.
550 * don't unlink on NFS to avoid random named stale handles.
551 * return -1 on error.
552 * return -2 if nothing needed to be pinned.
553 * return an open fd (>=0) if we pinned it.
554 */
555 int pin_rootfs(const char *rootfs)
556 {
557 __do_free char *absrootfs = NULL;
558 int fd, ret;
559 char absrootfspin[PATH_MAX];
560 struct stat s;
561 struct statfs sfs;
562
563 if (rootfs == NULL || strlen(rootfs) == 0)
564 return -2;
565
566 absrootfs = realpath(rootfs, NULL);
567 if (!absrootfs)
568 return -2;
569
570 ret = stat(absrootfs, &s);
571 if (ret < 0)
572 return -1;
573
574 if (!S_ISDIR(s.st_mode))
575 return -2;
576
577 ret = snprintf(absrootfspin, PATH_MAX, "%s/.lxc-keep", absrootfs);
578 if (ret < 0 || ret >= PATH_MAX)
579 return -1;
580
581 fd = open(absrootfspin, O_CREAT | O_RDWR, S_IWUSR | S_IRUSR);
582 if (fd < 0)
583 return fd;
584
585 ret = fstatfs (fd, &sfs);
586 if (ret < 0)
587 return fd;
588
589 if (sfs.f_type == NFS_SUPER_MAGIC) {
590 DEBUG("Rootfs on NFS, not unlinking pin file \"%s\"", absrootfspin);
591 return fd;
592 }
593
594 (void)unlink(absrootfspin);
595
596 return fd;
597 }
598
599 /* If we are asking to remount something, make sure that any NOEXEC etc are
600 * honored.
601 */
602 unsigned long add_required_remount_flags(const char *s, const char *d,
603 unsigned long flags)
604 {
605 #ifdef HAVE_STATVFS
606 int ret;
607 struct statvfs sb;
608 unsigned long required_flags = 0;
609
610 if (!s)
611 s = d;
612
613 if (!s)
614 return flags;
615
616 ret = statvfs(s, &sb);
617 if (ret < 0)
618 return flags;
619
620 if (flags & MS_REMOUNT) {
621 if (sb.f_flag & MS_NOSUID)
622 required_flags |= MS_NOSUID;
623 if (sb.f_flag & MS_NODEV)
624 required_flags |= MS_NODEV;
625 if (sb.f_flag & MS_RDONLY)
626 required_flags |= MS_RDONLY;
627 if (sb.f_flag & MS_NOEXEC)
628 required_flags |= MS_NOEXEC;
629 }
630
631 if (sb.f_flag & MS_NOATIME)
632 required_flags |= MS_NOATIME;
633 if (sb.f_flag & MS_NODIRATIME)
634 required_flags |= MS_NODIRATIME;
635 if (sb.f_flag & MS_LAZYTIME)
636 required_flags |= MS_LAZYTIME;
637 if (sb.f_flag & MS_RELATIME)
638 required_flags |= MS_RELATIME;
639 if (sb.f_flag & MS_STRICTATIME)
640 required_flags |= MS_STRICTATIME;
641
642 return flags | required_flags;
643 #else
644 return flags;
645 #endif
646 }
647
648 static int add_shmount_to_list(struct lxc_conf *conf)
649 {
650 char new_mount[PATH_MAX];
651 /* Offset for the leading '/' since the path_cont
652 * is absolute inside the container.
653 */
654 int offset = 1, ret = -1;
655
656 ret = snprintf(new_mount, sizeof(new_mount),
657 "%s %s none bind,create=dir 0 0", conf->shmount.path_host,
658 conf->shmount.path_cont + offset);
659 if (ret < 0 || (size_t)ret >= sizeof(new_mount))
660 return -1;
661
662 return add_elem_to_mount_list(new_mount, conf);
663 }
664
665 static int lxc_mount_auto_mounts(struct lxc_conf *conf, int flags, struct lxc_handler *handler)
666 {
667 int i, r;
668 static struct {
669 int match_mask;
670 int match_flag;
671 const char *source;
672 const char *destination;
673 const char *fstype;
674 unsigned long flags;
675 const char *options;
676 } default_mounts[] = {
677 /* Read-only bind-mounting... In older kernels, doing that
678 * required to do one MS_BIND mount and then
679 * MS_REMOUNT|MS_RDONLY the same one. According to mount(2)
680 * manpage, MS_BIND honors MS_RDONLY from kernel 2.6.26
681 * onwards. However, this apparently does not work on kernel
682 * 3.8. Unfortunately, on that very same kernel, doing the same
683 * trick as above doesn't seem to work either, there one needs
684 * to ALSO specify MS_BIND for the remount, otherwise the
685 * entire fs is remounted read-only or the mount fails because
686 * it's busy... MS_REMOUNT|MS_BIND|MS_RDONLY seems to work for
687 * kernels as low as 2.6.32...
688 */
689 { LXC_AUTO_PROC_MASK, LXC_AUTO_PROC_MIXED, "proc", "%r/proc", "proc", MS_NODEV|MS_NOEXEC|MS_NOSUID, NULL },
690 /* proc/tty is used as a temporary placeholder for proc/sys/net which we'll move back in a few steps */
691 { LXC_AUTO_PROC_MASK, LXC_AUTO_PROC_MIXED, "%r/proc/sys/net", "%r/proc/tty", NULL, MS_BIND, NULL },
692 { LXC_AUTO_PROC_MASK, LXC_AUTO_PROC_MIXED, "%r/proc/sys", "%r/proc/sys", NULL, MS_BIND, NULL },
693 { LXC_AUTO_PROC_MASK, LXC_AUTO_PROC_MIXED, NULL, "%r/proc/sys", NULL, MS_REMOUNT|MS_BIND|MS_RDONLY, NULL },
694 { LXC_AUTO_PROC_MASK, LXC_AUTO_PROC_MIXED, "%r/proc/tty", "%r/proc/sys/net", NULL, MS_MOVE, NULL },
695 { LXC_AUTO_PROC_MASK, LXC_AUTO_PROC_MIXED, "%r/proc/sysrq-trigger", "%r/proc/sysrq-trigger", NULL, MS_BIND, NULL },
696 { LXC_AUTO_PROC_MASK, LXC_AUTO_PROC_MIXED, NULL, "%r/proc/sysrq-trigger", NULL, MS_REMOUNT|MS_BIND|MS_RDONLY, NULL },
697 { LXC_AUTO_PROC_MASK, LXC_AUTO_PROC_RW, "proc", "%r/proc", "proc", MS_NODEV|MS_NOEXEC|MS_NOSUID, NULL },
698 { LXC_AUTO_SYS_MASK, LXC_AUTO_SYS_RW, "sysfs", "%r/sys", "sysfs", 0, NULL },
699 { LXC_AUTO_SYS_MASK, LXC_AUTO_SYS_RO, "sysfs", "%r/sys", "sysfs", MS_RDONLY, NULL },
700 { LXC_AUTO_SYS_MASK, LXC_AUTO_SYS_MIXED, "sysfs", "%r/sys", "sysfs", MS_NODEV|MS_NOEXEC|MS_NOSUID, NULL },
701 { LXC_AUTO_SYS_MASK, LXC_AUTO_SYS_MIXED, "%r/sys", "%r/sys", NULL, MS_BIND, NULL },
702 { LXC_AUTO_SYS_MASK, LXC_AUTO_SYS_MIXED, NULL, "%r/sys", NULL, MS_REMOUNT|MS_BIND|MS_RDONLY, NULL },
703 { LXC_AUTO_SYS_MASK, LXC_AUTO_SYS_MIXED, "sysfs", "%r/sys/devices/virtual/net", "sysfs", 0, NULL },
704 { LXC_AUTO_SYS_MASK, LXC_AUTO_SYS_MIXED, "%r/sys/devices/virtual/net/devices/virtual/net", "%r/sys/devices/virtual/net", NULL, MS_BIND, NULL },
705 { LXC_AUTO_SYS_MASK, LXC_AUTO_SYS_MIXED, NULL, "%r/sys/devices/virtual/net", NULL, MS_REMOUNT|MS_BIND|MS_NOSUID|MS_NODEV|MS_NOEXEC, NULL },
706 { 0, 0, NULL, NULL, NULL, 0, NULL }
707 };
708
709 for (i = 0; default_mounts[i].match_mask; i++) {
710 __do_free char *destination = NULL, *source = NULL;
711 int saved_errno;
712 unsigned long mflags;
713 if ((flags & default_mounts[i].match_mask) != default_mounts[i].match_flag)
714 continue;
715
716 if (default_mounts[i].source) {
717 /* will act like strdup if %r is not present */
718 source = lxc_string_replace("%r", conf->rootfs.path ? conf->rootfs.mount : "", default_mounts[i].source);
719 if (!source)
720 return -1;
721 }
722
723 if (!default_mounts[i].destination) {
724 ERROR("BUG: auto mounts destination %d was NULL", i);
725 return -1;
726 }
727
728 /* will act like strdup if %r is not present */
729 destination = lxc_string_replace("%r", conf->rootfs.path ? conf->rootfs.mount : "", default_mounts[i].destination);
730 if (!destination) {
731 return -1;
732 }
733
734 mflags = add_required_remount_flags(source, destination,
735 default_mounts[i].flags);
736 r = safe_mount(source, destination, default_mounts[i].fstype,
737 mflags, default_mounts[i].options,
738 conf->rootfs.path ? conf->rootfs.mount : NULL);
739 saved_errno = errno;
740 if (r < 0 && errno == ENOENT) {
741 INFO("Mount source or target for \"%s\" on \"%s\" does "
742 "not exist. Skipping", source, destination);
743 r = 0;
744 } else if (r < 0) {
745 SYSERROR("Failed to mount \"%s\" on \"%s\" with flags %lu", source, destination, mflags);
746 }
747
748 if (r < 0) {
749 errno = saved_errno;
750 return -1;
751 }
752 }
753
754 if (flags & LXC_AUTO_CGROUP_MASK) {
755 int cg_flags;
756
757 cg_flags = flags & (LXC_AUTO_CGROUP_MASK & ~LXC_AUTO_CGROUP_FORCE);
758 /* If the type of cgroup mount was not specified, it depends on
759 * the container's capabilities as to what makes sense: if we
760 * have CAP_SYS_ADMIN, the read-only part can be remounted
761 * read-write anyway, so we may as well default to read-write;
762 * then the admin will not be given a false sense of security.
763 * (And if they really want mixed r/o r/w, then they can
764 * explicitly specify :mixed.) OTOH, if the container lacks
765 * CAP_SYS_ADMIN, do only default to :mixed, because then the
766 * container can't remount it read-write.
767 */
768 if (cg_flags == LXC_AUTO_CGROUP_NOSPEC || cg_flags == LXC_AUTO_CGROUP_FULL_NOSPEC) {
769 int has_sys_admin = 0;
770
771 if (!lxc_list_empty(&conf->keepcaps))
772 has_sys_admin = in_caplist(CAP_SYS_ADMIN, &conf->keepcaps);
773 else
774 has_sys_admin = !in_caplist(CAP_SYS_ADMIN, &conf->caps);
775
776 if (cg_flags == LXC_AUTO_CGROUP_NOSPEC)
777 cg_flags = has_sys_admin ? LXC_AUTO_CGROUP_RW : LXC_AUTO_CGROUP_MIXED;
778 else
779 cg_flags = has_sys_admin ? LXC_AUTO_CGROUP_FULL_RW : LXC_AUTO_CGROUP_FULL_MIXED;
780 }
781
782 if (flags & LXC_AUTO_CGROUP_FORCE)
783 cg_flags |= LXC_AUTO_CGROUP_FORCE;
784
785 if (!handler->cgroup_ops->mount(handler->cgroup_ops,
786 handler,
787 conf->rootfs.path ? conf->rootfs.mount : "",
788 cg_flags)) {
789 SYSERROR("Failed to mount \"/sys/fs/cgroup\"");
790 return -1;
791 }
792 }
793
794 if (flags & LXC_AUTO_SHMOUNTS_MASK) {
795 int ret = add_shmount_to_list(conf);
796 if (ret < 0) {
797 ERROR("Failed to add shmount entry to container config");
798 return -1;
799 }
800 }
801
802 return 0;
803 }
804
805 static int setup_utsname(struct utsname *utsname)
806 {
807 int ret;
808
809 if (!utsname)
810 return 0;
811
812 ret = sethostname(utsname->nodename, strlen(utsname->nodename));
813 if (ret < 0) {
814 SYSERROR("Failed to set the hostname to \"%s\"", utsname->nodename);
815 return -1;
816 }
817
818 INFO("Set hostname to \"%s\"", utsname->nodename);
819
820 return 0;
821 }
822
823 struct dev_symlinks {
824 const char *oldpath;
825 const char *name;
826 };
827
828 static const struct dev_symlinks dev_symlinks[] = {
829 { "/proc/self/fd", "fd" },
830 { "/proc/self/fd/0", "stdin" },
831 { "/proc/self/fd/1", "stdout" },
832 { "/proc/self/fd/2", "stderr" },
833 };
834
835 static int lxc_setup_dev_symlinks(const struct lxc_rootfs *rootfs)
836 {
837 int i, ret;
838 char path[PATH_MAX];
839 struct stat s;
840
841 for (i = 0; i < sizeof(dev_symlinks) / sizeof(dev_symlinks[0]); i++) {
842 const struct dev_symlinks *d = &dev_symlinks[i];
843
844 ret = snprintf(path, sizeof(path), "%s/dev/%s",
845 rootfs->path ? rootfs->mount : "", d->name);
846 if (ret < 0 || ret >= PATH_MAX)
847 return -1;
848
849 /* Stat the path first. If we don't get an error accept it as
850 * is and don't try to create it
851 */
852 ret = stat(path, &s);
853 if (ret == 0)
854 continue;
855
856 ret = symlink(d->oldpath, path);
857 if (ret && errno != EEXIST) {
858 if (errno == EROFS) {
859 WARN("Failed to create \"%s\". Read-only filesystem", path);
860 } else {
861 SYSERROR("Failed to create \"%s\"", path);
862 return -1;
863 }
864 }
865 }
866
867 return 0;
868 }
869
870 /* Build a space-separate list of ptys to pass to systemd. */
871 static bool append_ttyname(char **pp, char *name)
872 {
873 char *p;
874 size_t size;
875
876 if (!*pp) {
877 *pp = malloc(strlen(name) + strlen("container_ttys=") + 1);
878 if (!*pp)
879 return false;
880
881 sprintf(*pp, "container_ttys=%s", name);
882 return true;
883 }
884
885 size = strlen(*pp) + strlen(name) + 2;
886 p = realloc(*pp, size);
887 if (!p)
888 return false;
889
890 *pp = p;
891 (void)strlcat(p, " ", size);
892 (void)strlcat(p, name, size);
893
894 return true;
895 }
896
897 static int lxc_setup_ttys(struct lxc_conf *conf)
898 {
899 int i, ret;
900 const struct lxc_tty_info *ttys = &conf->ttys;
901 char *ttydir = ttys->dir;
902 char path[PATH_MAX], lxcpath[PATH_MAX];
903
904 if (!conf->rootfs.path)
905 return 0;
906
907 for (i = 0; i < ttys->max; i++) {
908 struct lxc_terminal_info *tty = &ttys->tty[i];
909
910 ret = snprintf(path, sizeof(path), "/dev/tty%d", i + 1);
911 if (ret < 0 || (size_t)ret >= sizeof(path))
912 return -1;
913
914 if (ttydir) {
915 /* create dev/lxc/tty%d" */
916 ret = snprintf(lxcpath, sizeof(lxcpath),
917 "/dev/%s/tty%d", ttydir, i + 1);
918 if (ret < 0 || (size_t)ret >= sizeof(lxcpath))
919 return -1;
920
921 ret = mknod(lxcpath, S_IFREG | 0000, 0);
922 if (ret < 0 && errno != EEXIST) {
923 SYSERROR("Failed to create \"%s\"", lxcpath);
924 return -1;
925 }
926
927 ret = unlink(path);
928 if (ret < 0 && errno != ENOENT) {
929 SYSERROR("Failed to unlink \"%s\"", path);
930 return -1;
931 }
932
933 ret = mount(tty->name, lxcpath, "none", MS_BIND, 0);
934 if (ret < 0) {
935 SYSWARN("Failed to bind mount \"%s\" onto \"%s\"",
936 tty->name, lxcpath);
937 continue;
938 }
939 DEBUG("Bind mounted \"%s\" onto \"%s\"", tty->name,
940 lxcpath);
941
942 ret = snprintf(lxcpath, sizeof(lxcpath), "%s/tty%d",
943 ttydir, i + 1);
944 if (ret < 0 || (size_t)ret >= sizeof(lxcpath))
945 return -1;
946
947 ret = symlink(lxcpath, path);
948 if (ret < 0) {
949 SYSERROR("Failed to create symlink \"%s\" -> \"%s\"",
950 path, lxcpath);
951 return -1;
952 }
953 } else {
954 /* If we populated /dev, then we need to create
955 * /dev/ttyN
956 */
957 ret = mknod(path, S_IFREG | 0000, 0);
958 if (ret < 0) /* this isn't fatal, continue */
959 SYSERROR("Failed to create \"%s\"", path);
960
961 ret = mount(tty->name, path, "none", MS_BIND, 0);
962 if (ret < 0) {
963 SYSERROR("Failed to mount '%s'->'%s'", tty->name, path);
964 continue;
965 }
966
967 DEBUG("Bind mounted \"%s\" onto \"%s\"", tty->name, path);
968 }
969
970 if (!append_ttyname(&conf->ttys.tty_names, tty->name)) {
971 ERROR("Error setting up container_ttys string");
972 return -1;
973 }
974 }
975
976 INFO("Finished setting up %zu /dev/tty<N> device(s)", ttys->max);
977 return 0;
978 }
979
980 int lxc_allocate_ttys(struct lxc_conf *conf)
981 {
982 size_t i;
983 int ret;
984 struct lxc_tty_info *ttys = &conf->ttys;
985
986 /* no tty in the configuration */
987 if (ttys->max == 0)
988 return 0;
989
990 ttys->tty = malloc(sizeof(*ttys->tty) * ttys->max);
991 if (!ttys->tty)
992 return -ENOMEM;
993
994 for (i = 0; i < ttys->max; i++) {
995 struct lxc_terminal_info *tty = &ttys->tty[i];
996
997 tty->master = -EBADF;
998 tty->slave = -EBADF;
999 ret = openpty(&tty->master, &tty->slave, NULL, NULL, NULL);
1000 if (ret < 0) {
1001 SYSERROR("Failed to create tty %zu", i);
1002 ttys->max = i;
1003 lxc_delete_tty(ttys);
1004 return -ENOTTY;
1005 }
1006
1007 ret = ttyname_r(tty->slave, tty->name, sizeof(tty->name));
1008 if (ret < 0) {
1009 SYSERROR("Failed to retrieve name of tty %zu slave", i);
1010 ttys->max = i;
1011 lxc_delete_tty(ttys);
1012 return -ENOTTY;
1013 }
1014
1015 DEBUG("Created tty \"%s\" with master fd %d and slave fd %d",
1016 tty->name, tty->master, tty->slave);
1017
1018 /* Prevent leaking the file descriptors to the container */
1019 ret = fd_cloexec(tty->master, true);
1020 if (ret < 0)
1021 SYSWARN("Failed to set FD_CLOEXEC flag on master fd %d of "
1022 "tty device \"%s\"", tty->master, tty->name);
1023
1024 ret = fd_cloexec(tty->slave, true);
1025 if (ret < 0)
1026 SYSWARN("Failed to set FD_CLOEXEC flag on slave fd %d of "
1027 "tty device \"%s\"", tty->slave, tty->name);
1028
1029 tty->busy = 0;
1030 }
1031
1032 INFO("Finished creating %zu tty devices", ttys->max);
1033 return 0;
1034 }
1035
1036 void lxc_delete_tty(struct lxc_tty_info *ttys)
1037 {
1038 int i;
1039
1040 if (!ttys->tty)
1041 return;
1042
1043 for (i = 0; i < ttys->max; i++) {
1044 struct lxc_terminal_info *tty = &ttys->tty[i];
1045
1046 if (tty->master >= 0) {
1047 close(tty->master);
1048 tty->master = -EBADF;
1049 }
1050
1051 if (tty->slave >= 0) {
1052 close(tty->slave);
1053 tty->slave = -EBADF;
1054 }
1055 }
1056
1057 free(ttys->tty);
1058 ttys->tty = NULL;
1059 }
1060
1061 static int lxc_send_ttys_to_parent(struct lxc_handler *handler)
1062 {
1063 int i;
1064 int ret = -1;
1065 struct lxc_conf *conf = handler->conf;
1066 struct lxc_tty_info *ttys = &conf->ttys;
1067 int sock = handler->data_sock[0];
1068
1069 if (ttys->max == 0)
1070 return 0;
1071
1072 for (i = 0; i < ttys->max; i++) {
1073 int ttyfds[2];
1074 struct lxc_terminal_info *tty = &ttys->tty[i];
1075
1076 ttyfds[0] = tty->master;
1077 ttyfds[1] = tty->slave;
1078
1079 ret = lxc_abstract_unix_send_fds(sock, ttyfds, 2, NULL, 0);
1080 if (ret < 0)
1081 break;
1082
1083 TRACE("Sent tty \"%s\" with master fd %d and slave fd %d to "
1084 "parent", tty->name, tty->master, tty->slave);
1085 }
1086
1087 if (ret < 0)
1088 SYSERROR("Failed to send %zu ttys to parent", ttys->max);
1089 else
1090 TRACE("Sent %zu ttys to parent", ttys->max);
1091
1092 return ret;
1093 }
1094
1095 static int lxc_create_ttys(struct lxc_handler *handler)
1096 {
1097 int ret = -1;
1098 struct lxc_conf *conf = handler->conf;
1099
1100 ret = lxc_allocate_ttys(conf);
1101 if (ret < 0) {
1102 ERROR("Failed to allocate ttys");
1103 goto on_error;
1104 }
1105
1106 ret = lxc_send_ttys_to_parent(handler);
1107 if (ret < 0) {
1108 ERROR("Failed to send ttys to parent");
1109 goto on_error;
1110 }
1111
1112 if (!conf->is_execute) {
1113 ret = lxc_setup_ttys(conf);
1114 if (ret < 0) {
1115 ERROR("Failed to setup ttys");
1116 goto on_error;
1117 }
1118 }
1119
1120 if (conf->ttys.tty_names) {
1121 ret = setenv("container_ttys", conf->ttys.tty_names, 1);
1122 if (ret < 0)
1123 SYSERROR("Failed to set \"container_ttys=%s\"", conf->ttys.tty_names);
1124 }
1125
1126 ret = 0;
1127
1128 on_error:
1129 lxc_delete_tty(&conf->ttys);
1130
1131 return ret;
1132 }
1133
1134 /* Just create a path for /dev under $lxcpath/$name and in rootfs If we hit an
1135 * error, log it but don't fail yet.
1136 */
1137 static int mount_autodev(const char *name, const struct lxc_rootfs *rootfs,
1138 const char *lxcpath)
1139 {
1140 __do_free char *path = NULL;
1141 int ret;
1142 size_t clen;
1143 mode_t cur_mask;
1144
1145 INFO("Preparing \"/dev\"");
1146
1147 /* $(rootfs->mount) + "/dev/pts" + '\0' */
1148 clen = (rootfs->path ? strlen(rootfs->mount) : 0) + 9;
1149 path = must_realloc(NULL, clen);
1150
1151 ret = snprintf(path, clen, "%s/dev", rootfs->path ? rootfs->mount : "");
1152 if (ret < 0 || (size_t)ret >= clen)
1153 return -1;
1154
1155 cur_mask = umask(S_IXUSR | S_IXGRP | S_IXOTH);
1156 ret = mkdir(path, S_IRWXU | S_IRGRP | S_IXGRP | S_IROTH | S_IXOTH);
1157 if (ret < 0 && errno != EEXIST) {
1158 SYSERROR("Failed to create \"/dev\" directory");
1159 ret = -errno;
1160 goto reset_umask;
1161 }
1162
1163 ret = safe_mount("none", path, "tmpfs", 0, "size=500000,mode=755",
1164 rootfs->path ? rootfs->mount : NULL);
1165 if (ret < 0) {
1166 SYSERROR("Failed to mount tmpfs on \"%s\"", path);
1167 goto reset_umask;
1168 }
1169 TRACE("Mounted tmpfs on \"%s\"", path);
1170
1171 ret = snprintf(path, clen, "%s/dev/pts", rootfs->path ? rootfs->mount : "");
1172 if (ret < 0 || (size_t)ret >= clen) {
1173 ret = -1;
1174 goto reset_umask;
1175 }
1176
1177 /* If we are running on a devtmpfs mapping, dev/pts may already exist.
1178 * If not, then create it and exit if that fails...
1179 */
1180 ret = mkdir(path, S_IRWXU | S_IRGRP | S_IXGRP | S_IROTH | S_IXOTH);
1181 if (ret < 0 && errno != EEXIST) {
1182 SYSERROR("Failed to create directory \"%s\"", path);
1183 ret = -errno;
1184 goto reset_umask;
1185 }
1186
1187 ret = 0;
1188
1189 reset_umask:
1190 (void)umask(cur_mask);
1191
1192 INFO("Prepared \"/dev\"");
1193 return ret;
1194 }
1195
1196 struct lxc_device_node {
1197 const char *name;
1198 const mode_t mode;
1199 const int maj;
1200 const int min;
1201 };
1202
1203 static const struct lxc_device_node lxc_devices[] = {
1204 { "full", S_IFCHR | S_IRWXU | S_IRWXG | S_IRWXO, 1, 7 },
1205 { "null", S_IFCHR | S_IRWXU | S_IRWXG | S_IRWXO, 1, 3 },
1206 { "random", S_IFCHR | S_IRWXU | S_IRWXG | S_IRWXO, 1, 8 },
1207 { "tty", S_IFCHR | S_IRWXU | S_IRWXG | S_IRWXO, 5, 0 },
1208 { "urandom", S_IFCHR | S_IRWXU | S_IRWXG | S_IRWXO, 1, 9 },
1209 { "zero", S_IFCHR | S_IRWXU | S_IRWXG | S_IRWXO, 1, 5 },
1210 };
1211
1212
1213 enum {
1214 LXC_DEVNODE_BIND,
1215 LXC_DEVNODE_MKNOD,
1216 LXC_DEVNODE_PARTIAL,
1217 LXC_DEVNODE_OPEN,
1218 };
1219
1220 static int lxc_fill_autodev(const struct lxc_rootfs *rootfs)
1221 {
1222 int i, ret;
1223 char path[PATH_MAX];
1224 mode_t cmask;
1225 int use_mknod = LXC_DEVNODE_MKNOD;
1226
1227 ret = snprintf(path, PATH_MAX, "%s/dev",
1228 rootfs->path ? rootfs->mount : "");
1229 if (ret < 0 || ret >= PATH_MAX)
1230 return -1;
1231
1232 /* ignore, just don't try to fill in */
1233 if (!dir_exists(path))
1234 return 0;
1235
1236 INFO("Populating \"/dev\"");
1237
1238 cmask = umask(S_IXUSR | S_IXGRP | S_IXOTH);
1239 for (i = 0; i < sizeof(lxc_devices) / sizeof(lxc_devices[0]); i++) {
1240 char hostpath[PATH_MAX];
1241 const struct lxc_device_node *device = &lxc_devices[i];
1242
1243 ret = snprintf(path, PATH_MAX, "%s/dev/%s",
1244 rootfs->path ? rootfs->mount : "", device->name);
1245 if (ret < 0 || ret >= PATH_MAX)
1246 return -1;
1247
1248 if (use_mknod >= LXC_DEVNODE_MKNOD) {
1249 ret = mknod(path, device->mode, makedev(device->maj, device->min));
1250 if (ret == 0 || (ret < 0 && errno == EEXIST)) {
1251 DEBUG("Created device node \"%s\"", path);
1252 } else if (ret < 0) {
1253 if (errno != EPERM) {
1254 SYSERROR("Failed to create device node \"%s\"", path);
1255 return -1;
1256 }
1257
1258 use_mknod = LXC_DEVNODE_BIND;
1259 }
1260
1261 /* Device nodes are fully useable. */
1262 if (use_mknod == LXC_DEVNODE_OPEN)
1263 continue;
1264
1265 if (use_mknod == LXC_DEVNODE_MKNOD) {
1266 /* See
1267 * - https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=55956b59df336f6738da916dbb520b6e37df9fbd
1268 * - https://lists.linuxfoundation.org/pipermail/containers/2018-June/039176.html
1269 */
1270 ret = open(path, O_RDONLY | O_CLOEXEC);
1271 if (ret >= 0) {
1272 close_prot_errno_disarm(ret);
1273 /* Device nodes are fully useable. */
1274 use_mknod = LXC_DEVNODE_OPEN;
1275 continue;
1276 }
1277
1278 SYSTRACE("Failed to open \"%s\" device", path);
1279 /* Device nodes are only partially useable. */
1280 use_mknod = LXC_DEVNODE_PARTIAL;
1281 }
1282 }
1283
1284 if (use_mknod != LXC_DEVNODE_PARTIAL) {
1285 /* If we are dealing with partially functional device
1286 * nodes the prio mknod() call will have created the
1287 * device node so we can use it as a bind-mount target.
1288 */
1289 ret = mknod(path, S_IFREG | 0000, 0);
1290 if (ret < 0 && errno != EEXIST) {
1291 SYSERROR("Failed to create file \"%s\"", path);
1292 return -1;
1293 }
1294 }
1295
1296 /* Fallback to bind-mounting the device from the host. */
1297 ret = snprintf(hostpath, PATH_MAX, "/dev/%s", device->name);
1298 if (ret < 0 || ret >= PATH_MAX)
1299 return -1;
1300
1301 ret = safe_mount(hostpath, path, 0, MS_BIND, NULL,
1302 rootfs->path ? rootfs->mount : NULL);
1303 if (ret < 0) {
1304 SYSERROR("Failed to bind mount host device node \"%s\" "
1305 "onto \"%s\"", hostpath, path);
1306 return -1;
1307 }
1308 DEBUG("Bind mounted host device node \"%s\" onto \"%s\"",
1309 hostpath, path);
1310 }
1311 (void)umask(cmask);
1312
1313 INFO("Populated \"/dev\"");
1314 return 0;
1315 }
1316
1317 static int lxc_mount_rootfs(struct lxc_conf *conf)
1318 {
1319 int ret;
1320 struct lxc_storage *bdev;
1321 const struct lxc_rootfs *rootfs = &conf->rootfs;
1322
1323 if (!rootfs->path) {
1324 ret = mount("", "/", NULL, MS_SLAVE | MS_REC, 0);
1325 if (ret < 0) {
1326 SYSERROR("Failed to remount \"/\" MS_REC | MS_SLAVE");
1327 return -1;
1328 }
1329
1330 return 0;
1331 }
1332
1333 ret = access(rootfs->mount, F_OK);
1334 if (ret != 0) {
1335 SYSERROR("Failed to access to \"%s\". Check it is present",
1336 rootfs->mount);
1337 return -1;
1338 }
1339
1340 bdev = storage_init(conf);
1341 if (!bdev) {
1342 ERROR("Failed to mount rootfs \"%s\" onto \"%s\" with options \"%s\"",
1343 rootfs->path, rootfs->mount,
1344 rootfs->options ? rootfs->options : "(null)");
1345 return -1;
1346 }
1347
1348 ret = bdev->ops->mount(bdev);
1349 storage_put(bdev);
1350 if (ret < 0) {
1351 ERROR("Failed to mount rootfs \"%s\" onto \"%s\" with options \"%s\"",
1352 rootfs->path, rootfs->mount,
1353 rootfs->options ? rootfs->options : "(null)");
1354 return -1;
1355 }
1356
1357 DEBUG("Mounted rootfs \"%s\" onto \"%s\" with options \"%s\"",
1358 rootfs->path, rootfs->mount,
1359 rootfs->options ? rootfs->options : "(null)");
1360
1361 return 0;
1362 }
1363
1364 int lxc_chroot(const struct lxc_rootfs *rootfs)
1365 {
1366 __do_free char *nroot = NULL;
1367 int i, ret;
1368 char *root = rootfs->mount;
1369
1370 nroot = realpath(root, NULL);
1371 if (!nroot) {
1372 SYSERROR("Failed to resolve \"%s\"", root);
1373 return -1;
1374 }
1375
1376 ret = chdir("/");
1377 if (ret < 0)
1378 return -1;
1379
1380 /* We could use here MS_MOVE, but in userns this mount is locked and
1381 * can't be moved.
1382 */
1383 ret = mount(nroot, "/", NULL, MS_REC | MS_BIND, NULL);
1384 if (ret < 0) {
1385 SYSERROR("Failed to mount \"%s\" onto \"/\" as MS_REC | MS_BIND", nroot);
1386 return -1;
1387 }
1388
1389 ret = mount(NULL, "/", NULL, MS_REC | MS_PRIVATE, NULL);
1390 if (ret < 0) {
1391 SYSERROR("Failed to remount \"/\"");
1392 return -1;
1393 }
1394
1395 /* The following code cleans up inherited mounts which are not required
1396 * for CT.
1397 *
1398 * The mountinfo file shows not all mounts, if a few points have been
1399 * unmounted between read operations from the mountinfo. So we need to
1400 * read mountinfo a few times.
1401 *
1402 * This loop can be skipped if a container uses userns, because all
1403 * inherited mounts are locked and we should live with all this trash.
1404 */
1405 for (;;) {
1406 __do_fclose FILE *f = NULL;
1407 __do_free char *line = NULL;
1408 char *slider1, *slider2;
1409 int progress = 0;
1410 size_t len = 0;
1411
1412 f = fopen("./proc/self/mountinfo", "r");
1413 if (!f) {
1414 SYSERROR("Failed to open \"/proc/self/mountinfo\"");
1415 return -1;
1416 }
1417
1418 while (getline(&line, &len, f) > 0) {
1419 for (slider1 = line, i = 0; slider1 && i < 4; i++)
1420 slider1 = strchr(slider1 + 1, ' ');
1421
1422 if (!slider1)
1423 continue;
1424
1425 slider2 = strchr(slider1 + 1, ' ');
1426 if (!slider2)
1427 continue;
1428
1429 *slider2 = '\0';
1430 *slider1 = '.';
1431
1432 if (strcmp(slider1 + 1, "/") == 0)
1433 continue;
1434
1435 if (strcmp(slider1 + 1, "/proc") == 0)
1436 continue;
1437
1438 ret = umount2(slider1, MNT_DETACH);
1439 if (ret == 0)
1440 progress++;
1441 }
1442
1443 if (!progress)
1444 break;
1445 }
1446
1447 /* This also can be skipped if a container uses userns. */
1448 (void)umount2("./proc", MNT_DETACH);
1449
1450 /* It is weird, but chdir("..") moves us in a new root */
1451 ret = chdir("..");
1452 if (ret < 0) {
1453 SYSERROR("Failed to chdir(\"..\")");
1454 return -1;
1455 }
1456
1457 ret = chroot(".");
1458 if (ret < 0) {
1459 SYSERROR("Failed to chroot(\".\")");
1460 return -1;
1461 }
1462
1463 return 0;
1464 }
1465
1466 /* (The following explanation is copied verbatim from the kernel.)
1467 *
1468 * pivot_root Semantics:
1469 * Moves the root file system of the current process to the directory put_old,
1470 * makes new_root as the new root file system of the current process, and sets
1471 * root/cwd of all processes which had them on the current root to new_root.
1472 *
1473 * Restrictions:
1474 * The new_root and put_old must be directories, and must not be on the
1475 * same file system as the current process root. The put_old must be
1476 * underneath new_root, i.e. adding a non-zero number of /.. to the string
1477 * pointed to by put_old must yield the same directory as new_root. No other
1478 * file system may be mounted on put_old. After all, new_root is a mountpoint.
1479 *
1480 * Also, the current root cannot be on the 'rootfs' (initial ramfs) filesystem.
1481 * See Documentation/filesystems/ramfs-rootfs-initramfs.txt for alternatives
1482 * in this situation.
1483 *
1484 * Notes:
1485 * - we don't move root/cwd if they are not at the root (reason: if something
1486 * cared enough to change them, it's probably wrong to force them elsewhere)
1487 * - it's okay to pick a root that isn't the root of a file system, e.g.
1488 * /nfs/my_root where /nfs is the mount point. It must be a mountpoint,
1489 * though, so you may need to say mount --bind /nfs/my_root /nfs/my_root
1490 * first.
1491 */
1492 static int lxc_pivot_root(const char *rootfs)
1493 {
1494 __do_close_prot_errno int oldroot = -EBADF, newroot = -EBADF;
1495 int ret;
1496
1497 oldroot = open("/", O_DIRECTORY | O_RDONLY | O_CLOEXEC);
1498 if (oldroot < 0) {
1499 SYSERROR("Failed to open old root directory");
1500 return -1;
1501 }
1502
1503 newroot = open(rootfs, O_DIRECTORY | O_RDONLY | O_CLOEXEC);
1504 if (newroot < 0) {
1505 SYSERROR("Failed to open new root directory");
1506 return -1;
1507 }
1508
1509 /* change into new root fs */
1510 ret = fchdir(newroot);
1511 if (ret < 0) {
1512 SYSERROR("Failed to change to new rootfs \"%s\"", rootfs);
1513 return -1;
1514 }
1515
1516 /* pivot_root into our new root fs */
1517 ret = pivot_root(".", ".");
1518 if (ret < 0) {
1519 SYSERROR("Failed to pivot_root()");
1520 return -1;
1521 }
1522
1523 /* At this point the old-root is mounted on top of our new-root. To
1524 * unmounted it we must not be chdir'd into it, so escape back to
1525 * old-root.
1526 */
1527 ret = fchdir(oldroot);
1528 if (ret < 0) {
1529 SYSERROR("Failed to enter old root directory");
1530 return -1;
1531 }
1532
1533 /* Make oldroot rslave to make sure our umounts don't propagate to the
1534 * host.
1535 */
1536 ret = mount("", ".", "", MS_SLAVE | MS_REC, NULL);
1537 if (ret < 0) {
1538 SYSERROR("Failed to make oldroot rslave");
1539 return -1;
1540 }
1541
1542 ret = umount2(".", MNT_DETACH);
1543 if (ret < 0) {
1544 SYSERROR("Failed to detach old root directory");
1545 return -1;
1546 }
1547
1548 ret = fchdir(newroot);
1549 if (ret < 0) {
1550 SYSERROR("Failed to re-enter new root directory");
1551 return -1;
1552 }
1553
1554 TRACE("pivot_root(\"%s\") successful", rootfs);
1555
1556 return 0;
1557 }
1558
1559 static int lxc_setup_rootfs_switch_root(const struct lxc_rootfs *rootfs)
1560 {
1561 if (!rootfs->path) {
1562 DEBUG("Container does not have a rootfs");
1563 return 0;
1564 }
1565
1566 if (detect_ramfs_rootfs())
1567 return lxc_chroot(rootfs);
1568
1569 return lxc_pivot_root(rootfs->mount);
1570 }
1571
1572 static const struct id_map *find_mapped_nsid_entry(struct lxc_conf *conf,
1573 unsigned id,
1574 enum idtype idtype)
1575 {
1576 struct lxc_list *it;
1577 struct id_map *map;
1578 struct id_map *retmap = NULL;
1579
1580 /* Shortcut for container's root mappings. */
1581 if (id == 0) {
1582 if (idtype == ID_TYPE_UID)
1583 return conf->root_nsuid_map;
1584
1585 if (idtype == ID_TYPE_GID)
1586 return conf->root_nsgid_map;
1587 }
1588
1589 lxc_list_for_each(it, &conf->id_map) {
1590 map = it->elem;
1591 if (map->idtype != idtype)
1592 continue;
1593
1594 if (id >= map->nsid && id < map->nsid + map->range) {
1595 retmap = map;
1596 break;
1597 }
1598 }
1599
1600 return retmap;
1601 }
1602
1603 static int lxc_setup_devpts(struct lxc_conf *conf)
1604 {
1605 int ret;
1606 char **opts;
1607 char devpts_mntopts[256];
1608 char *mntopt_sets[5];
1609 char default_devpts_mntopts[256] = "gid=5,newinstance,ptmxmode=0666,mode=0620";
1610
1611 if (conf->pty_max <= 0) {
1612 DEBUG("No new devpts instance will be mounted since no pts "
1613 "devices are requested");
1614 return 0;
1615 }
1616
1617 ret = snprintf(devpts_mntopts, sizeof(devpts_mntopts), "%s,max=%zu",
1618 default_devpts_mntopts, conf->pty_max);
1619 if (ret < 0 || (size_t)ret >= sizeof(devpts_mntopts))
1620 return -1;
1621
1622 (void)umount2("/dev/pts", MNT_DETACH);
1623
1624 /* Create mountpoint for devpts instance. */
1625 ret = mkdir("/dev/pts", 0755);
1626 if (ret < 0 && errno != EEXIST) {
1627 SYSERROR("Failed to create \"/dev/pts\" directory");
1628 return -1;
1629 }
1630
1631 /* gid=5 && max= */
1632 mntopt_sets[0] = devpts_mntopts;
1633
1634 /* !gid=5 && max= */
1635 mntopt_sets[1] = devpts_mntopts + STRLITERALLEN("gid=5") + 1;
1636
1637 /* gid=5 && !max= */
1638 mntopt_sets[2] = default_devpts_mntopts;
1639
1640 /* !gid=5 && !max= */
1641 mntopt_sets[3] = default_devpts_mntopts + STRLITERALLEN("gid=5") + 1;
1642
1643 /* end */
1644 mntopt_sets[4] = NULL;
1645
1646 for (ret = -1, opts = mntopt_sets; opts && *opts; opts++) {
1647 /* mount new devpts instance */
1648 ret = mount("devpts", "/dev/pts", "devpts", MS_NOSUID | MS_NOEXEC, *opts);
1649 if (ret == 0)
1650 break;
1651 }
1652
1653 if (ret < 0) {
1654 SYSERROR("Failed to mount new devpts instance");
1655 return -1;
1656 }
1657 DEBUG("Mount new devpts instance with options \"%s\"", *opts);
1658
1659 /* Remove any pre-existing /dev/ptmx file. */
1660 ret = remove("/dev/ptmx");
1661 if (ret < 0) {
1662 if (errno != ENOENT) {
1663 SYSERROR("Failed to remove existing \"/dev/ptmx\" file");
1664 return -1;
1665 }
1666 } else {
1667 DEBUG("Removed existing \"/dev/ptmx\" file");
1668 }
1669
1670 /* Create dummy /dev/ptmx file as bind mountpoint for /dev/pts/ptmx. */
1671 ret = mknod("/dev/ptmx", S_IFREG | 0000, 0);
1672 if (ret < 0 && errno != EEXIST) {
1673 SYSERROR("Failed to create dummy \"/dev/ptmx\" file as bind mount target");
1674 return -1;
1675 }
1676 DEBUG("Created dummy \"/dev/ptmx\" file as bind mount target");
1677
1678 /* Fallback option: create symlink /dev/ptmx -> /dev/pts/ptmx */
1679 ret = mount("/dev/pts/ptmx", "/dev/ptmx", NULL, MS_BIND, NULL);
1680 if (!ret) {
1681 DEBUG("Bind mounted \"/dev/pts/ptmx\" to \"/dev/ptmx\"");
1682 return 0;
1683 } else {
1684 /* Fallthrough and try to create a symlink. */
1685 ERROR("Failed to bind mount \"/dev/pts/ptmx\" to \"/dev/ptmx\"");
1686 }
1687
1688 /* Remove the dummy /dev/ptmx file we created above. */
1689 ret = remove("/dev/ptmx");
1690 if (ret < 0) {
1691 SYSERROR("Failed to remove existing \"/dev/ptmx\"");
1692 return -1;
1693 }
1694
1695 /* Fallback option: Create symlink /dev/ptmx -> /dev/pts/ptmx. */
1696 ret = symlink("/dev/pts/ptmx", "/dev/ptmx");
1697 if (ret < 0) {
1698 SYSERROR("Failed to create symlink from \"/dev/ptmx\" to \"/dev/pts/ptmx\"");
1699 return -1;
1700 }
1701 DEBUG("Created symlink from \"/dev/ptmx\" to \"/dev/pts/ptmx\"");
1702
1703 return 0;
1704 }
1705
1706 static int setup_personality(int persona)
1707 {
1708 int ret;
1709
1710 #if HAVE_SYS_PERSONALITY_H
1711 if (persona == -1)
1712 return 0;
1713
1714 ret = personality(persona);
1715 if (ret < 0) {
1716 SYSERROR("Failed to set personality to \"0x%x\"", persona);
1717 return -1;
1718 }
1719
1720 INFO("Set personality to \"0x%x\"", persona);
1721 #endif
1722
1723 return 0;
1724 }
1725
1726 static int lxc_setup_dev_console(const struct lxc_rootfs *rootfs,
1727 const struct lxc_terminal *console)
1728 {
1729 int ret;
1730 char path[PATH_MAX];
1731 char *rootfs_path = rootfs->path ? rootfs->mount : "";
1732
1733 if (console->path && !strcmp(console->path, "none"))
1734 return 0;
1735
1736 ret = snprintf(path, sizeof(path), "%s/dev/console", rootfs_path);
1737 if (ret < 0 || (size_t)ret >= sizeof(path))
1738 return -1;
1739
1740 /* When we are asked to setup a console we remove any previous
1741 * /dev/console bind-mounts.
1742 */
1743 if (file_exists(path)) {
1744 ret = lxc_unstack_mountpoint(path, false);
1745 if (ret < 0) {
1746 SYSERROR("Failed to unmount \"%s\"", path);
1747 return -ret;
1748 } else {
1749 DEBUG("Cleared all (%d) mounts from \"%s\"", ret, path);
1750 }
1751 }
1752
1753 /* For unprivileged containers autodev or automounts will already have
1754 * taken care of creating /dev/console.
1755 */
1756 ret = mknod(path, S_IFREG | 0000, 0);
1757 if (ret < 0 && errno != EEXIST) {
1758 SYSERROR("Failed to create console");
1759 return -errno;
1760 }
1761
1762 ret = fchmod(console->slave, S_IXUSR | S_IXGRP);
1763 if (ret < 0) {
1764 SYSERROR("Failed to set mode \"0%o\" to \"%s\"",
1765 S_IXUSR | S_IXGRP, console->name);
1766 return -errno;
1767 }
1768
1769 ret = safe_mount(console->name, path, "none", MS_BIND, 0, rootfs_path);
1770 if (ret < 0) {
1771 ERROR("Failed to mount \"%s\" on \"%s\"", console->name, path);
1772 return -1;
1773 }
1774
1775 DEBUG("Mounted pts device \"%s\" onto \"%s\"", console->name, path);
1776 return 0;
1777 }
1778
1779 static int lxc_setup_ttydir_console(const struct lxc_rootfs *rootfs,
1780 const struct lxc_terminal *console,
1781 char *ttydir)
1782 {
1783 int ret;
1784 char path[PATH_MAX], lxcpath[PATH_MAX];
1785 char *rootfs_path = rootfs->path ? rootfs->mount : "";
1786
1787 if (console->path && !strcmp(console->path, "none"))
1788 return 0;
1789
1790 /* create rootfs/dev/<ttydir> directory */
1791 ret = snprintf(path, sizeof(path), "%s/dev/%s", rootfs_path, ttydir);
1792 if (ret < 0 || (size_t)ret >= sizeof(path))
1793 return -1;
1794
1795 ret = mkdir(path, 0755);
1796 if (ret && errno != EEXIST) {
1797 SYSERROR("Failed to create \"%s\"", path);
1798 return -errno;
1799 }
1800 DEBUG("Created directory for console and tty devices at \"%s\"", path);
1801
1802 ret = snprintf(lxcpath, sizeof(lxcpath), "%s/dev/%s/console", rootfs_path, ttydir);
1803 if (ret < 0 || (size_t)ret >= sizeof(lxcpath))
1804 return -1;
1805
1806 ret = mknod(lxcpath, S_IFREG | 0000, 0);
1807 if (ret < 0 && errno != EEXIST) {
1808 SYSERROR("Failed to create \"%s\"", lxcpath);
1809 return -errno;
1810 }
1811
1812 ret = snprintf(path, sizeof(path), "%s/dev/console", rootfs_path);
1813 if (ret < 0 || (size_t)ret >= sizeof(path))
1814 return -1;
1815
1816 if (file_exists(path)) {
1817 ret = lxc_unstack_mountpoint(path, false);
1818 if (ret < 0) {
1819 SYSERROR("Failed to unmount \"%s\"", path);
1820 return -ret;
1821 } else {
1822 DEBUG("Cleared all (%d) mounts from \"%s\"", ret, path);
1823 }
1824 }
1825
1826 ret = mknod(path, S_IFREG | 0000, 0);
1827 if (ret < 0 && errno != EEXIST) {
1828 SYSERROR("Failed to create console");
1829 return -errno;
1830 }
1831
1832 ret = fchmod(console->slave, S_IXUSR | S_IXGRP);
1833 if (ret < 0) {
1834 SYSERROR("Failed to set mode \"0%o\" to \"%s\"",
1835 S_IXUSR | S_IXGRP, console->name);
1836 return -errno;
1837 }
1838
1839 /* bind mount console->name to '/dev/<ttydir>/console' */
1840 ret = safe_mount(console->name, lxcpath, "none", MS_BIND, 0, rootfs_path);
1841 if (ret < 0) {
1842 ERROR("Failed to mount \"%s\" on \"%s\"", console->name, lxcpath);
1843 return -1;
1844 }
1845 DEBUG("Mounted \"%s\" onto \"%s\"", console->name, lxcpath);
1846
1847 /* bind mount '/dev/<ttydir>/console' to '/dev/console' */
1848 ret = safe_mount(lxcpath, path, "none", MS_BIND, 0, rootfs_path);
1849 if (ret < 0) {
1850 ERROR("Failed to mount \"%s\" on \"%s\"", console->name, lxcpath);
1851 return -1;
1852 }
1853 DEBUG("Mounted \"%s\" onto \"%s\"", console->name, lxcpath);
1854
1855 DEBUG("Console has been setup under \"%s\" and mounted to \"%s\"", lxcpath, path);
1856 return 0;
1857 }
1858
1859 static int lxc_setup_console(const struct lxc_rootfs *rootfs,
1860 const struct lxc_terminal *console, char *ttydir)
1861 {
1862
1863 if (!ttydir)
1864 return lxc_setup_dev_console(rootfs, console);
1865
1866 return lxc_setup_ttydir_console(rootfs, console, ttydir);
1867 }
1868
1869 static void parse_mntopt(char *opt, unsigned long *flags, char **data, size_t size)
1870 {
1871 struct mount_opt *mo;
1872
1873 /* If opt is found in mount_opt, set or clear flags.
1874 * Otherwise append it to data. */
1875
1876 for (mo = &mount_opt[0]; mo->name != NULL; mo++) {
1877 if (strncmp(opt, mo->name, strlen(mo->name)) == 0) {
1878 if (mo->clear)
1879 *flags &= ~mo->flag;
1880 else
1881 *flags |= mo->flag;
1882 return;
1883 }
1884 }
1885
1886 if (strlen(*data))
1887 (void)strlcat(*data, ",", size);
1888
1889 (void)strlcat(*data, opt, size);
1890 }
1891
1892 int parse_mntopts(const char *mntopts, unsigned long *mntflags, char **mntdata)
1893 {
1894 __do_free char *data = NULL, *s = NULL;
1895 char *p;
1896 size_t size;
1897
1898 *mntdata = NULL;
1899 *mntflags = 0L;
1900
1901 if (!mntopts)
1902 return 0;
1903
1904 s = strdup(mntopts);
1905 if (!s)
1906 return -1;
1907
1908 size = strlen(s) + 1;
1909 data = malloc(size);
1910 if (!data)
1911 return -1;
1912 *data = 0;
1913
1914 lxc_iterate_parts(p, s, ",")
1915 parse_mntopt(p, mntflags, &data, size);
1916
1917 if (*data)
1918 *mntdata = move_ptr(data);
1919
1920 return 0;
1921 }
1922
1923 static void parse_propagationopt(char *opt, unsigned long *flags)
1924 {
1925 struct mount_opt *mo;
1926
1927 /* If opt is found in propagation_opt, set or clear flags. */
1928 for (mo = &propagation_opt[0]; mo->name != NULL; mo++) {
1929 if (strncmp(opt, mo->name, strlen(mo->name)) != 0)
1930 continue;
1931
1932 if (mo->clear)
1933 *flags &= ~mo->flag;
1934 else
1935 *flags |= mo->flag;
1936
1937 return;
1938 }
1939 }
1940
1941 int parse_propagationopts(const char *mntopts, unsigned long *pflags)
1942 {
1943 __do_free char *s = NULL;
1944 char *p;
1945
1946 if (!mntopts)
1947 return 0;
1948
1949 s = strdup(mntopts);
1950 if (!s) {
1951 SYSERROR("Failed to allocate memory");
1952 return -ENOMEM;
1953 }
1954
1955 *pflags = 0L;
1956 lxc_iterate_parts(p, s, ",")
1957 parse_propagationopt(p, pflags);
1958
1959 return 0;
1960 }
1961
1962 static void null_endofword(char *word)
1963 {
1964 while (*word && *word != ' ' && *word != '\t')
1965 word++;
1966 *word = '\0';
1967 }
1968
1969 /* skip @nfields spaces in @src */
1970 static char *get_field(char *src, int nfields)
1971 {
1972 int i;
1973 char *p = src;
1974
1975 for (i = 0; i < nfields; i++) {
1976 while (*p && *p != ' ' && *p != '\t')
1977 p++;
1978
1979 if (!*p)
1980 break;
1981
1982 p++;
1983 }
1984
1985 return p;
1986 }
1987
1988 static int mount_entry(const char *fsname, const char *target,
1989 const char *fstype, unsigned long mountflags,
1990 unsigned long pflags, const char *data, bool optional,
1991 bool dev, bool relative, const char *rootfs)
1992 {
1993 int ret;
1994 char srcbuf[PATH_MAX];
1995 const char *srcpath = fsname;
1996 #ifdef HAVE_STATVFS
1997 struct statvfs sb;
1998 #endif
1999
2000 if (relative) {
2001 ret = snprintf(srcbuf, PATH_MAX, "%s/%s", rootfs ? rootfs : "/", fsname ? fsname : "");
2002 if (ret < 0 || ret >= PATH_MAX) {
2003 ERROR("source path is too long");
2004 return -1;
2005 }
2006 srcpath = srcbuf;
2007 }
2008
2009 ret = safe_mount(srcpath, target, fstype, mountflags & ~MS_REMOUNT, data,
2010 rootfs);
2011 if (ret < 0) {
2012 if (optional) {
2013 SYSINFO("Failed to mount \"%s\" on \"%s\" (optional)",
2014 srcpath ? srcpath : "(null)", target);
2015 return 0;
2016 }
2017
2018 SYSERROR("Failed to mount \"%s\" on \"%s\"",
2019 srcpath ? srcpath : "(null)", target);
2020 return -1;
2021 }
2022
2023 if ((mountflags & MS_REMOUNT) || (mountflags & MS_BIND)) {
2024 unsigned long rqd_flags = 0;
2025
2026 DEBUG("Remounting \"%s\" on \"%s\" to respect bind or remount "
2027 "options", srcpath ? srcpath : "(none)", target ? target : "(none)");
2028
2029 if (mountflags & MS_RDONLY)
2030 rqd_flags |= MS_RDONLY;
2031 #ifdef HAVE_STATVFS
2032 if (srcpath && statvfs(srcpath, &sb) == 0) {
2033 unsigned long required_flags = rqd_flags;
2034
2035 if (sb.f_flag & MS_NOSUID)
2036 required_flags |= MS_NOSUID;
2037
2038 if (sb.f_flag & MS_NODEV && !dev)
2039 required_flags |= MS_NODEV;
2040
2041 if (sb.f_flag & MS_RDONLY)
2042 required_flags |= MS_RDONLY;
2043
2044 if (sb.f_flag & MS_NOEXEC)
2045 required_flags |= MS_NOEXEC;
2046
2047 DEBUG("Flags for \"%s\" were %lu, required extra flags "
2048 "are %lu", srcpath, sb.f_flag, required_flags);
2049
2050 /* If this was a bind mount request, and required_flags
2051 * does not have any flags which are not already in
2052 * mountflags, then skip the remount.
2053 */
2054 if (!(mountflags & MS_REMOUNT)) {
2055 if (!(required_flags & ~mountflags) &&
2056 rqd_flags == 0) {
2057 DEBUG("Mountflags already were %lu, "
2058 "skipping remount", mountflags);
2059 goto skipremount;
2060 }
2061 }
2062
2063 mountflags |= required_flags;
2064 }
2065 #endif
2066
2067 ret = mount(srcpath, target, fstype, mountflags | MS_REMOUNT, data);
2068 if (ret < 0) {
2069 if (optional) {
2070 SYSINFO("Failed to mount \"%s\" on \"%s\" (optional)",
2071 srcpath ? srcpath : "(null)", target);
2072 return 0;
2073 }
2074
2075 SYSERROR("Failed to mount \"%s\" on \"%s\"",
2076 srcpath ? srcpath : "(null)", target);
2077 return -1;
2078 }
2079 }
2080
2081 #ifdef HAVE_STATVFS
2082 skipremount:
2083 #endif
2084 if (pflags) {
2085 ret = mount(NULL, target, NULL, pflags, NULL);
2086 if (ret < 0) {
2087 if (optional) {
2088 SYSINFO("Failed to change mount propagation "
2089 "for \"%s\" (optional)", target);
2090 return 0;
2091 } else {
2092 SYSERROR("Failed to change mount propagation "
2093 "for \"%s\" (optional)", target);
2094 return -1;
2095 }
2096 }
2097 DEBUG("Changed mount propagation for \"%s\"", target);
2098 }
2099
2100 DEBUG("Mounted \"%s\" on \"%s\" with filesystem type \"%s\"",
2101 srcpath ? srcpath : "(null)", target, fstype);
2102
2103 return 0;
2104 }
2105
2106 /* Remove "optional", "create=dir", and "create=file" from mntopt */
2107 static void cull_mntent_opt(struct mntent *mntent)
2108 {
2109 int i;
2110 char *list[] = {
2111 "create=dir",
2112 "create=file",
2113 "optional",
2114 "relative",
2115 NULL
2116 };
2117
2118 for (i = 0; list[i]; i++) {
2119 char *p, *p2;
2120
2121 p = strstr(mntent->mnt_opts, list[i]);
2122 if (!p)
2123 continue;
2124
2125 p2 = strchr(p, ',');
2126 if (!p2) {
2127 /* no more mntopts, so just chop it here */
2128 *p = '\0';
2129 continue;
2130 }
2131
2132 memmove(p, p2 + 1, strlen(p2 + 1) + 1);
2133 }
2134 }
2135
2136 static int mount_entry_create_dir_file(const struct mntent *mntent,
2137 const char *path,
2138 const struct lxc_rootfs *rootfs,
2139 const char *lxc_name, const char *lxc_path)
2140 {
2141 __do_free char *p1 = NULL;
2142 int ret;
2143 char *p2;
2144
2145 if (strncmp(mntent->mnt_type, "overlay", 7) == 0) {
2146 ret = ovl_mkdir(mntent, rootfs, lxc_name, lxc_path);
2147 if (ret < 0)
2148 return -1;
2149 }
2150
2151 if (hasmntopt(mntent, "create=dir")) {
2152 ret = mkdir_p(path, 0755);
2153 if (ret < 0 && errno != EEXIST) {
2154 SYSERROR("Failed to create directory \"%s\"", path);
2155 return -1;
2156 }
2157 }
2158
2159 if (!hasmntopt(mntent, "create=file"))
2160 return 0;
2161
2162 ret = access(path, F_OK);
2163 if (ret == 0)
2164 return 0;
2165
2166 p1 = strdup(path);
2167 if (!p1)
2168 return -1;
2169
2170 p2 = dirname(p1);
2171
2172 ret = mkdir_p(p2, 0755);
2173 if (ret < 0 && errno != EEXIST) {
2174 SYSERROR("Failed to create directory \"%s\"", path);
2175 return -1;
2176 }
2177
2178 ret = mknod(path, S_IFREG | 0000, 0);
2179 if (ret < 0 && errno != EEXIST)
2180 return -errno;
2181
2182 return 0;
2183 }
2184
2185 /* rootfs, lxc_name, and lxc_path can be NULL when the container is created
2186 * without a rootfs. */
2187 static inline int mount_entry_on_generic(struct mntent *mntent,
2188 const char *path,
2189 const struct lxc_rootfs *rootfs,
2190 const char *lxc_name,
2191 const char *lxc_path)
2192 {
2193 __do_free char *mntdata = NULL;
2194 int ret;
2195 unsigned long mntflags;
2196 bool dev, optional, relative;
2197 unsigned long pflags = 0;
2198 char *rootfs_path = NULL;
2199
2200 optional = hasmntopt(mntent, "optional") != NULL;
2201 dev = hasmntopt(mntent, "dev") != NULL;
2202 relative = hasmntopt(mntent, "relative") != NULL;
2203
2204 if (rootfs && rootfs->path)
2205 rootfs_path = rootfs->mount;
2206
2207 ret = mount_entry_create_dir_file(mntent, path, rootfs, lxc_name,
2208 lxc_path);
2209 if (ret < 0) {
2210 if (optional)
2211 return 0;
2212
2213 return -1;
2214 }
2215 cull_mntent_opt(mntent);
2216
2217 ret = parse_propagationopts(mntent->mnt_opts, &pflags);
2218 if (ret < 0)
2219 return -1;
2220
2221 ret = parse_mntopts(mntent->mnt_opts, &mntflags, &mntdata);
2222 if (ret < 0)
2223 return -1;
2224
2225 ret = mount_entry(mntent->mnt_fsname, path, mntent->mnt_type, mntflags,
2226 pflags, mntdata, optional, dev, relative, rootfs_path);
2227
2228 return ret;
2229 }
2230
2231 static inline int mount_entry_on_systemfs(struct mntent *mntent)
2232 {
2233 int ret;
2234 char path[PATH_MAX];
2235
2236 /* For containers created without a rootfs all mounts are treated as
2237 * absolute paths starting at / on the host.
2238 */
2239 if (mntent->mnt_dir[0] != '/')
2240 ret = snprintf(path, sizeof(path), "/%s", mntent->mnt_dir);
2241 else
2242 ret = snprintf(path, sizeof(path), "%s", mntent->mnt_dir);
2243 if (ret < 0 || ret >= sizeof(path))
2244 return -1;
2245
2246 return mount_entry_on_generic(mntent, path, NULL, NULL, NULL);
2247 }
2248
2249 static int mount_entry_on_absolute_rootfs(struct mntent *mntent,
2250 const struct lxc_rootfs *rootfs,
2251 const char *lxc_name,
2252 const char *lxc_path)
2253 {
2254 int offset;
2255 char *aux;
2256 const char *lxcpath;
2257 char path[PATH_MAX];
2258 int ret = 0;
2259
2260 lxcpath = lxc_global_config_value("lxc.lxcpath");
2261 if (!lxcpath)
2262 return -1;
2263
2264 /* If rootfs->path is a blockdev path, allow container fstab to use
2265 * <lxcpath>/<name>/rootfs" as the target prefix.
2266 */
2267 ret = snprintf(path, PATH_MAX, "%s/%s/rootfs", lxcpath, lxc_name);
2268 if (ret < 0 || ret >= PATH_MAX)
2269 goto skipvarlib;
2270
2271 aux = strstr(mntent->mnt_dir, path);
2272 if (aux) {
2273 offset = strlen(path);
2274 goto skipabs;
2275 }
2276
2277 skipvarlib:
2278 aux = strstr(mntent->mnt_dir, rootfs->path);
2279 if (!aux) {
2280 WARN("Ignoring mount point \"%s\"", mntent->mnt_dir);
2281 return ret;
2282 }
2283 offset = strlen(rootfs->path);
2284
2285 skipabs:
2286 ret = snprintf(path, PATH_MAX, "%s/%s", rootfs->mount, aux + offset);
2287 if (ret < 0 || ret >= PATH_MAX)
2288 return -1;
2289
2290 return mount_entry_on_generic(mntent, path, rootfs, lxc_name, lxc_path);
2291 }
2292
2293 static int mount_entry_on_relative_rootfs(struct mntent *mntent,
2294 const struct lxc_rootfs *rootfs,
2295 const char *lxc_name,
2296 const char *lxc_path)
2297 {
2298 int ret;
2299 char path[PATH_MAX];
2300
2301 /* relative to root mount point */
2302 ret = snprintf(path, sizeof(path), "%s/%s", rootfs->mount, mntent->mnt_dir);
2303 if (ret < 0 || (size_t)ret >= sizeof(path))
2304 return -1;
2305
2306 return mount_entry_on_generic(mntent, path, rootfs, lxc_name, lxc_path);
2307 }
2308
2309 static int mount_file_entries(const struct lxc_conf *conf,
2310 const struct lxc_rootfs *rootfs, FILE *file,
2311 const char *lxc_name, const char *lxc_path)
2312 {
2313 char buf[PATH_MAX];
2314 struct mntent mntent;
2315
2316 while (getmntent_r(file, &mntent, buf, sizeof(buf))) {
2317 int ret;
2318
2319 if (!rootfs->path)
2320 ret = mount_entry_on_systemfs(&mntent);
2321 else if (mntent.mnt_dir[0] != '/')
2322 ret = mount_entry_on_relative_rootfs(&mntent, rootfs,
2323 lxc_name, lxc_path);
2324 else
2325 ret = mount_entry_on_absolute_rootfs(&mntent, rootfs,
2326 lxc_name, lxc_path);
2327 if (ret < 0)
2328 return -1;
2329 }
2330
2331 if (!feof(file) || ferror(file)) {
2332 ERROR("Failed to parse mount entries");
2333 return -1;
2334 }
2335
2336 return 0;
2337 }
2338
2339 static int setup_mount(const struct lxc_conf *conf,
2340 const struct lxc_rootfs *rootfs, const char *fstab,
2341 const char *lxc_name, const char *lxc_path)
2342 {
2343 FILE *f;
2344 int ret;
2345
2346 if (!fstab)
2347 return 0;
2348
2349 f = setmntent(fstab, "r");
2350 if (!f) {
2351 SYSERROR("Failed to open \"%s\"", fstab);
2352 return -1;
2353 }
2354
2355 ret = mount_file_entries(conf, rootfs, f, lxc_name, lxc_path);
2356 if (ret < 0)
2357 ERROR("Failed to set up mount entries");
2358
2359 endmntent(f);
2360 return ret;
2361 }
2362
2363 /*
2364 * In order for nested containers to be able to mount /proc and /sys they need
2365 * to see a "pure" proc and sysfs mount points with nothing mounted on top
2366 * (like lxcfs).
2367 * For this we provide proc and sysfs in /dev/.lxc/{proc,sys} while using an
2368 * apparmor rule to deny access to them. This is mostly for convenience: The
2369 * container's root user can mount them anyway and thus has access to the two
2370 * file systems. But a non-root user in the container should not be allowed to
2371 * access them as a side effect without explicitly allowing it.
2372 */
2373 static const char nesting_helpers[] =
2374 "proc dev/.lxc/proc proc create=dir,optional 0 0\n"
2375 "sys dev/.lxc/sys sysfs create=dir,optional 0 0\n";
2376
2377 FILE *make_anonymous_mount_file(struct lxc_list *mount,
2378 bool include_nesting_helpers)
2379 {
2380 __do_close_prot_errno int fd = -EBADF;
2381 int ret;
2382 char *mount_entry;
2383 struct lxc_list *iterator;
2384
2385 fd = memfd_create(".lxc_mount_file", MFD_CLOEXEC);
2386 if (fd < 0) {
2387 char template[] = P_tmpdir "/.lxc_mount_file_XXXXXX";
2388
2389 if (errno != ENOSYS)
2390 return NULL;
2391
2392 fd = lxc_make_tmpfile(template, true);
2393 if (fd < 0) {
2394 SYSERROR("Could not create temporary mount file");
2395 return NULL;
2396 }
2397
2398 TRACE("Created temporary mount file");
2399 }
2400
2401 lxc_list_for_each (iterator, mount) {
2402 size_t len;
2403
2404 mount_entry = iterator->elem;
2405 len = strlen(mount_entry);
2406
2407 ret = lxc_write_nointr(fd, mount_entry, len);
2408 if (ret != len)
2409 return NULL;
2410
2411 ret = lxc_write_nointr(fd, "\n", 1);
2412 if (ret != 1)
2413 return NULL;
2414 }
2415
2416 if (include_nesting_helpers) {
2417 ret = lxc_write_nointr(fd, nesting_helpers,
2418 STRARRAYLEN(nesting_helpers));
2419 if (ret != STRARRAYLEN(nesting_helpers))
2420 return NULL;
2421 }
2422
2423 ret = lseek(fd, 0, SEEK_SET);
2424 if (ret < 0)
2425 return NULL;
2426
2427 return fdopen(move_fd(fd), "r+");
2428 }
2429
2430 static int setup_mount_entries(const struct lxc_conf *conf,
2431 const struct lxc_rootfs *rootfs,
2432 struct lxc_list *mount, const char *lxc_name,
2433 const char *lxc_path)
2434 {
2435 __do_fclose FILE *f = NULL;
2436
2437 f = make_anonymous_mount_file(mount, conf->lsm_aa_allow_nesting);
2438 if (!f)
2439 return -1;
2440
2441 return mount_file_entries(conf, rootfs, f, lxc_name, lxc_path);
2442 }
2443
2444 static int parse_cap(const char *cap)
2445 {
2446 size_t i;
2447 int capid = -1;
2448 size_t end = sizeof(caps_opt) / sizeof(caps_opt[0]);
2449 char *ptr = NULL;
2450
2451 if (strcmp(cap, "none") == 0)
2452 return -2;
2453
2454 for (i = 0; i < end; i++) {
2455 if (strcmp(cap, caps_opt[i].name))
2456 continue;
2457
2458 capid = caps_opt[i].value;
2459 break;
2460 }
2461
2462 if (capid < 0) {
2463 /* Try to see if it's numeric, so the user may specify
2464 * capabilities that the running kernel knows about but we
2465 * don't
2466 */
2467 errno = 0;
2468 capid = strtol(cap, &ptr, 10);
2469 if (!ptr || *ptr != '\0' || errno != 0)
2470 /* not a valid number */
2471 capid = -1;
2472 else if (capid > lxc_caps_last_cap())
2473 /* we have a number but it's not a valid
2474 * capability */
2475 capid = -1;
2476 }
2477
2478 return capid;
2479 }
2480
2481 int in_caplist(int cap, struct lxc_list *caps)
2482 {
2483 int capid;
2484 struct lxc_list *iterator;
2485
2486 lxc_list_for_each (iterator, caps) {
2487 capid = parse_cap(iterator->elem);
2488 if (capid == cap)
2489 return 1;
2490 }
2491
2492 return 0;
2493 }
2494
2495 static int setup_caps(struct lxc_list *caps)
2496 {
2497 int capid;
2498 char *drop_entry;
2499 struct lxc_list *iterator;
2500
2501 lxc_list_for_each (iterator, caps) {
2502 int ret;
2503
2504 drop_entry = iterator->elem;
2505
2506 capid = parse_cap(drop_entry);
2507 if (capid < 0) {
2508 ERROR("unknown capability %s", drop_entry);
2509 return -1;
2510 }
2511
2512 ret = prctl(PR_CAPBSET_DROP, prctl_arg(capid), prctl_arg(0),
2513 prctl_arg(0), prctl_arg(0));
2514 if (ret < 0) {
2515 SYSERROR("Failed to remove %s capability", drop_entry);
2516 return -1;
2517 }
2518 DEBUG("Dropped %s (%d) capability", drop_entry, capid);
2519 }
2520
2521 DEBUG("Capabilities have been setup");
2522 return 0;
2523 }
2524
2525 static int dropcaps_except(struct lxc_list *caps)
2526 {
2527 __do_free int *caplist = NULL;
2528 int i, capid, numcaps;
2529 char *keep_entry;
2530 struct lxc_list *iterator;
2531
2532 numcaps = lxc_caps_last_cap() + 1;
2533 if (numcaps <= 0 || numcaps > 200)
2534 return -1;
2535 TRACE("Found %d capabilities", numcaps);
2536
2537 /* caplist[i] is 1 if we keep capability i */
2538 caplist = must_realloc(NULL, numcaps * sizeof(int));
2539 memset(caplist, 0, numcaps * sizeof(int));
2540
2541 lxc_list_for_each (iterator, caps) {
2542 keep_entry = iterator->elem;
2543
2544 capid = parse_cap(keep_entry);
2545 if (capid == -2)
2546 continue;
2547
2548 if (capid < 0) {
2549 ERROR("Unknown capability %s", keep_entry);
2550 return -1;
2551 }
2552
2553 DEBUG("Keep capability %s (%d)", keep_entry, capid);
2554 caplist[capid] = 1;
2555 }
2556
2557 for (i = 0; i < numcaps; i++) {
2558 int ret;
2559
2560 if (caplist[i])
2561 continue;
2562
2563 ret = prctl(PR_CAPBSET_DROP, prctl_arg(i), prctl_arg(0),
2564 prctl_arg(0), prctl_arg(0));
2565 if (ret < 0) {
2566 SYSERROR("Failed to remove capability %d", i);
2567 return -1;
2568 }
2569 }
2570
2571 DEBUG("Capabilities have been setup");
2572 return 0;
2573 }
2574
2575 static int parse_resource(const char *res)
2576 {
2577 int ret;
2578 size_t i;
2579 int resid = -1;
2580
2581 for (i = 0; i < sizeof(limit_opt) / sizeof(limit_opt[0]); ++i)
2582 if (strcmp(res, limit_opt[i].name) == 0)
2583 return limit_opt[i].value;
2584
2585 /* Try to see if it's numeric, so the user may specify
2586 * resources that the running kernel knows about but
2587 * we don't.
2588 */
2589 ret = lxc_safe_int(res, &resid);
2590 if (ret < 0)
2591 return -1;
2592
2593 return resid;
2594 }
2595
2596 int setup_resource_limits(struct lxc_list *limits, pid_t pid)
2597 {
2598 int resid;
2599 struct lxc_list *it;
2600 struct lxc_limit *lim;
2601
2602 lxc_list_for_each (it, limits) {
2603 lim = it->elem;
2604
2605 resid = parse_resource(lim->resource);
2606 if (resid < 0) {
2607 ERROR("Unknown resource %s", lim->resource);
2608 return -1;
2609 }
2610
2611 #if HAVE_PRLIMIT || HAVE_PRLIMIT64
2612 if (prlimit(pid, resid, &lim->limit, NULL) != 0) {
2613 SYSERROR("Failed to set limit %s", lim->resource);
2614 return -1;
2615 }
2616
2617 TRACE("Setup \"%s\" limit", lim->resource);
2618 #else
2619 ERROR("Cannot set limit \"%s\" as prlimit is missing", lim->resource);
2620 return -1;
2621 #endif
2622 }
2623
2624 return 0;
2625 }
2626
2627 int setup_sysctl_parameters(struct lxc_list *sysctls)
2628 {
2629 __do_free char *tmp = NULL;
2630 struct lxc_list *it;
2631 struct lxc_sysctl *elem;
2632 int ret = 0;
2633 char filename[PATH_MAX] = {0};
2634
2635 lxc_list_for_each (it, sysctls) {
2636 elem = it->elem;
2637 tmp = lxc_string_replace(".", "/", elem->key);
2638 if (!tmp) {
2639 ERROR("Failed to replace key %s", elem->key);
2640 return -1;
2641 }
2642
2643 ret = snprintf(filename, sizeof(filename), "/proc/sys/%s", tmp);
2644 if (ret < 0 || (size_t)ret >= sizeof(filename)) {
2645 ERROR("Error setting up sysctl parameters path");
2646 return -1;
2647 }
2648
2649 ret = lxc_write_to_file(filename, elem->value,
2650 strlen(elem->value), false, 0666);
2651 if (ret < 0) {
2652 SYSERROR("Failed to setup sysctl parameters %s to %s",
2653 elem->key, elem->value);
2654 return -1;
2655 }
2656 }
2657
2658 return 0;
2659 }
2660
2661 int setup_proc_filesystem(struct lxc_list *procs, pid_t pid)
2662 {
2663 __do_free char *tmp = NULL;
2664 struct lxc_list *it;
2665 struct lxc_proc *elem;
2666 int ret = 0;
2667 char filename[PATH_MAX] = {0};
2668
2669 lxc_list_for_each (it, procs) {
2670 elem = it->elem;
2671 tmp = lxc_string_replace(".", "/", elem->filename);
2672 if (!tmp) {
2673 ERROR("Failed to replace key %s", elem->filename);
2674 return -1;
2675 }
2676
2677 ret = snprintf(filename, sizeof(filename), "/proc/%d/%s", pid, tmp);
2678 if (ret < 0 || (size_t)ret >= sizeof(filename)) {
2679 ERROR("Error setting up proc filesystem path");
2680 return -1;
2681 }
2682
2683 ret = lxc_write_to_file(filename, elem->value,
2684 strlen(elem->value), false, 0666);
2685 if (ret < 0) {
2686 SYSERROR("Failed to setup proc filesystem %s to %s",
2687 elem->filename, elem->value);
2688 return -1;
2689 }
2690 }
2691
2692 return 0;
2693 }
2694
2695 static char *default_rootfs_mount = LXCROOTFSMOUNT;
2696
2697 struct lxc_conf *lxc_conf_init(void)
2698 {
2699 int i;
2700 struct lxc_conf *new;
2701
2702 new = malloc(sizeof(*new));
2703 if (!new)
2704 return NULL;
2705 memset(new, 0, sizeof(*new));
2706
2707 new->loglevel = LXC_LOG_LEVEL_NOTSET;
2708 new->personality = -1;
2709 new->autodev = 1;
2710 new->console.buffer_size = 0;
2711 new->console.log_path = NULL;
2712 new->console.log_fd = -1;
2713 new->console.log_size = 0;
2714 new->console.path = NULL;
2715 new->console.peer = -1;
2716 new->console.proxy.busy = -1;
2717 new->console.proxy.master = -1;
2718 new->console.proxy.slave = -1;
2719 new->console.master = -1;
2720 new->console.slave = -1;
2721 new->console.name[0] = '\0';
2722 memset(&new->console.ringbuf, 0, sizeof(struct lxc_ringbuf));
2723 new->maincmd_fd = -1;
2724 new->monitor_signal_pdeath = SIGKILL;
2725 new->nbd_idx = -1;
2726 new->rootfs.mount = strdup(default_rootfs_mount);
2727 if (!new->rootfs.mount) {
2728 free(new);
2729 return NULL;
2730 }
2731 new->rootfs.managed = true;
2732 new->logfd = -1;
2733 lxc_list_init(&new->cgroup);
2734 lxc_list_init(&new->cgroup2);
2735 lxc_list_init(&new->network);
2736 lxc_list_init(&new->mount_list);
2737 lxc_list_init(&new->caps);
2738 lxc_list_init(&new->keepcaps);
2739 lxc_list_init(&new->id_map);
2740 new->root_nsuid_map = NULL;
2741 new->root_nsgid_map = NULL;
2742 lxc_list_init(&new->includes);
2743 lxc_list_init(&new->aliens);
2744 lxc_list_init(&new->environment);
2745 lxc_list_init(&new->limits);
2746 lxc_list_init(&new->sysctls);
2747 lxc_list_init(&new->procs);
2748 new->hooks_version = 0;
2749 for (i = 0; i < NUM_LXC_HOOKS; i++)
2750 lxc_list_init(&new->hooks[i]);
2751 lxc_list_init(&new->groups);
2752 lxc_list_init(&new->state_clients);
2753 new->lsm_aa_profile = NULL;
2754 lxc_list_init(&new->lsm_aa_raw);
2755 new->lsm_se_context = NULL;
2756 new->tmp_umount_proc = false;
2757 new->tmp_umount_proc = 0;
2758 new->shmount.path_host = NULL;
2759 new->shmount.path_cont = NULL;
2760
2761 /* if running in a new user namespace, init and COMMAND
2762 * default to running as UID/GID 0 when using lxc-execute */
2763 new->init_uid = 0;
2764 new->init_gid = 0;
2765 memset(&new->cgroup_meta, 0, sizeof(struct lxc_cgroup));
2766 memset(&new->ns_share, 0, sizeof(char *) * LXC_NS_MAX);
2767 seccomp_conf_init(new);
2768
2769 return new;
2770 }
2771
2772 int write_id_mapping(enum idtype idtype, pid_t pid, const char *buf,
2773 size_t buf_size)
2774 {
2775 __do_close_prot_errno int fd = -EBADF;
2776 int ret;
2777 char path[PATH_MAX];
2778
2779 if (geteuid() != 0 && idtype == ID_TYPE_GID) {
2780 __do_close_prot_errno int setgroups_fd = -EBADF;
2781
2782 ret = snprintf(path, PATH_MAX, "/proc/%d/setgroups", pid);
2783 if (ret < 0 || ret >= PATH_MAX)
2784 return -E2BIG;
2785
2786 setgroups_fd = open(path, O_WRONLY);
2787 if (setgroups_fd < 0 && errno != ENOENT) {
2788 SYSERROR("Failed to open \"%s\"", path);
2789 return -1;
2790 }
2791
2792 if (setgroups_fd >= 0) {
2793 ret = lxc_write_nointr(setgroups_fd, "deny\n",
2794 STRLITERALLEN("deny\n"));
2795 if (ret != STRLITERALLEN("deny\n")) {
2796 SYSERROR("Failed to write \"deny\" to \"/proc/%d/setgroups\"", pid);
2797 return -1;
2798 }
2799 TRACE("Wrote \"deny\" to \"/proc/%d/setgroups\"", pid);
2800 }
2801 }
2802
2803 ret = snprintf(path, PATH_MAX, "/proc/%d/%cid_map", pid,
2804 idtype == ID_TYPE_UID ? 'u' : 'g');
2805 if (ret < 0 || ret >= PATH_MAX)
2806 return -E2BIG;
2807
2808 fd = open(path, O_WRONLY);
2809 if (fd < 0) {
2810 SYSERROR("Failed to open \"%s\"", path);
2811 return -1;
2812 }
2813
2814 ret = lxc_write_nointr(fd, buf, buf_size);
2815 if (ret != buf_size) {
2816 SYSERROR("Failed to write %cid mapping to \"%s\"",
2817 idtype == ID_TYPE_UID ? 'u' : 'g', path);
2818 return -1;
2819 }
2820
2821 return 0;
2822 }
2823
2824 /* Check whether a binary exist and has either CAP_SETUID, CAP_SETGID or both.
2825 *
2826 * @return 1 if functional binary was found
2827 * @return 0 if binary exists but is lacking privilege
2828 * @return -ENOENT if binary does not exist
2829 * @return -EINVAL if cap to check is neither CAP_SETUID nor CAP_SETGID
2830 */
2831 static int idmaptool_on_path_and_privileged(const char *binary, cap_value_t cap)
2832 {
2833 __do_free char *path = NULL;
2834 int ret;
2835 struct stat st;
2836
2837 errno = EINVAL;
2838 if (cap != CAP_SETUID && cap != CAP_SETGID)
2839 return -1;
2840
2841 errno = ENOENT;
2842 path = on_path(binary, NULL);
2843 if (!path)
2844 return -1;
2845
2846 ret = stat(path, &st);
2847 if (ret < 0)
2848 return -1;
2849
2850 /* Check if the binary is setuid. */
2851 if (st.st_mode & S_ISUID) {
2852 DEBUG("The binary \"%s\" does have the setuid bit set", path);
2853 return 1;
2854 }
2855
2856 #if HAVE_LIBCAP && LIBCAP_SUPPORTS_FILE_CAPABILITIES
2857 /* Check if it has the CAP_SETUID capability. */
2858 if ((cap & CAP_SETUID) &&
2859 lxc_file_cap_is_set(path, CAP_SETUID, CAP_EFFECTIVE) &&
2860 lxc_file_cap_is_set(path, CAP_SETUID, CAP_PERMITTED)) {
2861 DEBUG("The binary \"%s\" has CAP_SETUID in its CAP_EFFECTIVE "
2862 "and CAP_PERMITTED sets", path);
2863 return 1;
2864 }
2865
2866 /* Check if it has the CAP_SETGID capability. */
2867 if ((cap & CAP_SETGID) &&
2868 lxc_file_cap_is_set(path, CAP_SETGID, CAP_EFFECTIVE) &&
2869 lxc_file_cap_is_set(path, CAP_SETGID, CAP_PERMITTED)) {
2870 DEBUG("The binary \"%s\" has CAP_SETGID in its CAP_EFFECTIVE "
2871 "and CAP_PERMITTED sets", path);
2872 return 1;
2873 }
2874 #else
2875 /* If we cannot check for file capabilities we need to give the benefit
2876 * of the doubt. Otherwise we might fail even though all the necessary
2877 * file capabilities are set.
2878 */
2879 DEBUG("Cannot check for file capabilities as full capability support is "
2880 "missing. Manual intervention needed");
2881 #endif
2882
2883 return 1;
2884 }
2885
2886 int lxc_map_ids_exec_wrapper(void *args)
2887 {
2888 execl("/bin/sh", "sh", "-c", (char *)args, (char *)NULL);
2889 return -1;
2890 }
2891
2892 int lxc_map_ids(struct lxc_list *idmap, pid_t pid)
2893 {
2894 int fill, left;
2895 char u_or_g;
2896 char *pos;
2897 char cmd_output[PATH_MAX];
2898 struct id_map *map;
2899 struct lxc_list *iterator;
2900 enum idtype type;
2901 /* strlen("new@idmap") = 9
2902 * +
2903 * strlen(" ") = 1
2904 * +
2905 * INTTYPE_TO_STRLEN(uint32_t)
2906 * +
2907 * strlen(" ") = 1
2908 *
2909 * We add some additional space to make sure that we really have
2910 * LXC_IDMAPLEN bytes available for our the {g,u]id mapping.
2911 */
2912 int ret = 0, gidmap = 0, uidmap = 0;
2913 char mapbuf[9 + 1 + INTTYPE_TO_STRLEN(uint32_t) + 1 + LXC_IDMAPLEN] = {0};
2914 bool had_entry = false, use_shadow = false;
2915 int hostuid, hostgid;
2916
2917 hostuid = geteuid();
2918 hostgid = getegid();
2919
2920 /* If new{g,u}idmap exists, that is, if shadow is handing out subuid
2921 * ranges, then insist that root also reserve ranges in subuid. This
2922 * will protected it by preventing another user from being handed the
2923 * range by shadow.
2924 */
2925 uidmap = idmaptool_on_path_and_privileged("newuidmap", CAP_SETUID);
2926 if (uidmap == -ENOENT)
2927 WARN("newuidmap binary is missing");
2928 else if (!uidmap)
2929 WARN("newuidmap is lacking necessary privileges");
2930
2931 gidmap = idmaptool_on_path_and_privileged("newgidmap", CAP_SETGID);
2932 if (gidmap == -ENOENT)
2933 WARN("newgidmap binary is missing");
2934 else if (!gidmap)
2935 WARN("newgidmap is lacking necessary privileges");
2936
2937 if (uidmap > 0 && gidmap > 0) {
2938 DEBUG("Functional newuidmap and newgidmap binary found");
2939 use_shadow = true;
2940 } else {
2941 /* In case unprivileged users run application containers via
2942 * execute() or a start*() there are valid cases where they may
2943 * only want to map their own {g,u}id. Let's not block them from
2944 * doing so by requiring geteuid() == 0.
2945 */
2946 DEBUG("No newuidmap and newgidmap binary found. Trying to "
2947 "write directly with euid %d", hostuid);
2948 }
2949
2950 /* Check if we really need to use newuidmap and newgidmap.
2951 * If the user is only remapping his own {g,u}id, we don't need it.
2952 */
2953 if (use_shadow && lxc_list_len(idmap) == 2) {
2954 use_shadow = false;
2955 lxc_list_for_each(iterator, idmap) {
2956 map = iterator->elem;
2957 if (map->idtype == ID_TYPE_UID && map->range == 1 &&
2958 map->nsid == hostuid && map->hostid == hostuid)
2959 continue;
2960 if (map->idtype == ID_TYPE_GID && map->range == 1 &&
2961 map->nsid == hostgid && map->hostid == hostgid)
2962 continue;
2963 use_shadow = true;
2964 break;
2965 }
2966 }
2967
2968 for (type = ID_TYPE_UID, u_or_g = 'u'; type <= ID_TYPE_GID;
2969 type++, u_or_g = 'g') {
2970 pos = mapbuf;
2971
2972 if (use_shadow)
2973 pos += sprintf(mapbuf, "new%cidmap %d", u_or_g, pid);
2974
2975 lxc_list_for_each(iterator, idmap) {
2976 map = iterator->elem;
2977 if (map->idtype != type)
2978 continue;
2979
2980 had_entry = true;
2981
2982 left = LXC_IDMAPLEN - (pos - mapbuf);
2983 fill = snprintf(pos, left, "%s%lu %lu %lu%s",
2984 use_shadow ? " " : "", map->nsid,
2985 map->hostid, map->range,
2986 use_shadow ? "" : "\n");
2987 if (fill <= 0 || fill >= left) {
2988 /* The kernel only takes <= 4k for writes to
2989 * /proc/<pid>/{g,u}id_map
2990 */
2991 SYSERROR("Too many %cid mappings defined", u_or_g);
2992 return -1;
2993 }
2994
2995 pos += fill;
2996 }
2997 if (!had_entry)
2998 continue;
2999
3000 /* Try to catch the output of new{g,u}idmap to make debugging
3001 * easier.
3002 */
3003 if (use_shadow) {
3004 ret = run_command(cmd_output, sizeof(cmd_output),
3005 lxc_map_ids_exec_wrapper,
3006 (void *)mapbuf);
3007 if (ret < 0) {
3008 ERROR("new%cidmap failed to write mapping \"%s\": %s",
3009 u_or_g, cmd_output, mapbuf);
3010 return -1;
3011 }
3012 TRACE("new%cidmap wrote mapping \"%s\"", u_or_g, mapbuf);
3013 } else {
3014 ret = write_id_mapping(type, pid, mapbuf, pos - mapbuf);
3015 if (ret < 0) {
3016 ERROR("Failed to write mapping: %s", mapbuf);
3017 return -1;
3018 }
3019 TRACE("Wrote mapping \"%s\"", mapbuf);
3020 }
3021
3022 memset(mapbuf, 0, sizeof(mapbuf));
3023 }
3024
3025 return 0;
3026 }
3027
3028 /* Return the host uid/gid to which the container root is mapped in val.
3029 * Return true if id was found, false otherwise.
3030 */
3031 bool get_mapped_rootid(struct lxc_conf *conf, enum idtype idtype,
3032 unsigned long *val)
3033 {
3034 unsigned nsid;
3035 struct id_map *map;
3036 struct lxc_list *it;
3037
3038 if (idtype == ID_TYPE_UID)
3039 nsid = (conf->root_nsuid_map != NULL) ? 0 : conf->init_uid;
3040 else
3041 nsid = (conf->root_nsgid_map != NULL) ? 0 : conf->init_gid;
3042
3043 lxc_list_for_each (it, &conf->id_map) {
3044 map = it->elem;
3045 if (map->idtype != idtype)
3046 continue;
3047 if (map->nsid != nsid)
3048 continue;
3049 *val = map->hostid;
3050 return true;
3051 }
3052
3053 return false;
3054 }
3055
3056 int mapped_hostid(unsigned id, struct lxc_conf *conf, enum idtype idtype)
3057 {
3058 struct id_map *map;
3059 struct lxc_list *it;
3060
3061 lxc_list_for_each (it, &conf->id_map) {
3062 map = it->elem;
3063 if (map->idtype != idtype)
3064 continue;
3065
3066 if (id >= map->hostid && id < map->hostid + map->range)
3067 return (id - map->hostid) + map->nsid;
3068 }
3069
3070 return -1;
3071 }
3072
3073 int find_unmapped_nsid(struct lxc_conf *conf, enum idtype idtype)
3074 {
3075 struct id_map *map;
3076 struct lxc_list *it;
3077 unsigned int freeid = 0;
3078
3079 again:
3080 lxc_list_for_each (it, &conf->id_map) {
3081 map = it->elem;
3082 if (map->idtype != idtype)
3083 continue;
3084
3085 if (freeid >= map->nsid && freeid < map->nsid + map->range) {
3086 freeid = map->nsid + map->range;
3087 goto again;
3088 }
3089 }
3090
3091 return freeid;
3092 }
3093
3094 int chown_mapped_root_exec_wrapper(void *args)
3095 {
3096 execvp("lxc-usernsexec", args);
3097 return -1;
3098 }
3099
3100 /* chown_mapped_root: for an unprivileged user with uid/gid X to
3101 * chown a dir to subuid/subgid Y, he needs to run chown as root
3102 * in a userns where nsid 0 is mapped to hostuid/hostgid Y, and
3103 * nsid Y is mapped to hostuid/hostgid X. That way, the container
3104 * root is privileged with respect to hostuid/hostgid X, allowing
3105 * him to do the chown.
3106 */
3107 int chown_mapped_root(const char *path, struct lxc_conf *conf)
3108 {
3109 uid_t rootuid, rootgid;
3110 unsigned long val;
3111 int hostuid, hostgid, ret;
3112 struct stat sb;
3113 char map1[100], map2[100], map3[100], map4[100], map5[100];
3114 char ugid[100];
3115 const char *args1[] = {"lxc-usernsexec",
3116 "-m", map1,
3117 "-m", map2,
3118 "-m", map3,
3119 "-m", map5,
3120 "--", "chown", ugid, path,
3121 NULL};
3122 const char *args2[] = {"lxc-usernsexec",
3123 "-m", map1,
3124 "-m", map2,
3125 "-m", map3,
3126 "-m", map4,
3127 "-m", map5,
3128 "--", "chown", ugid, path,
3129 NULL};
3130 char cmd_output[PATH_MAX];
3131
3132 hostuid = geteuid();
3133 hostgid = getegid();
3134
3135 if (!get_mapped_rootid(conf, ID_TYPE_UID, &val)) {
3136 ERROR("No uid mapping for container root");
3137 return -1;
3138 }
3139 rootuid = (uid_t)val;
3140
3141 if (!get_mapped_rootid(conf, ID_TYPE_GID, &val)) {
3142 ERROR("No gid mapping for container root");
3143 return -1;
3144 }
3145 rootgid = (gid_t)val;
3146
3147 if (hostuid == 0) {
3148 if (chown(path, rootuid, rootgid) < 0) {
3149 ERROR("Error chowning %s", path);
3150 return -1;
3151 }
3152
3153 return 0;
3154 }
3155
3156 if (rootuid == hostuid) {
3157 /* nothing to do */
3158 INFO("Container root is our uid; no need to chown");
3159 return 0;
3160 }
3161
3162 /* save the current gid of "path" */
3163 if (stat(path, &sb) < 0) {
3164 ERROR("Error stat %s", path);
3165 return -1;
3166 }
3167
3168 /* Update the path argument in case this was overlayfs. */
3169 args1[sizeof(args1) / sizeof(args1[0]) - 2] = path;
3170 args2[sizeof(args2) / sizeof(args2[0]) - 2] = path;
3171
3172 /*
3173 * A file has to be group-owned by a gid mapped into the
3174 * container, or the container won't be privileged over it.
3175 */
3176 DEBUG("trying to chown \"%s\" to %d", path, hostgid);
3177 if (sb.st_uid == hostuid &&
3178 mapped_hostid(sb.st_gid, conf, ID_TYPE_GID) < 0 &&
3179 chown(path, -1, hostgid) < 0) {
3180 ERROR("Failed chgrping %s", path);
3181 return -1;
3182 }
3183
3184 /* "u:0:rootuid:1" */
3185 ret = snprintf(map1, 100, "u:0:%d:1", rootuid);
3186 if (ret < 0 || ret >= 100) {
3187 ERROR("Error uid printing map string");
3188 return -1;
3189 }
3190
3191 /* "u:hostuid:hostuid:1" */
3192 ret = snprintf(map2, 100, "u:%d:%d:1", hostuid, hostuid);
3193 if (ret < 0 || ret >= 100) {
3194 ERROR("Error uid printing map string");
3195 return -1;
3196 }
3197
3198 /* "g:0:rootgid:1" */
3199 ret = snprintf(map3, 100, "g:0:%d:1", rootgid);
3200 if (ret < 0 || ret >= 100) {
3201 ERROR("Error gid printing map string");
3202 return -1;
3203 }
3204
3205 /* "g:pathgid:rootgid+pathgid:1" */
3206 ret = snprintf(map4, 100, "g:%d:%d:1", (gid_t)sb.st_gid,
3207 rootgid + (gid_t)sb.st_gid);
3208 if (ret < 0 || ret >= 100) {
3209 ERROR("Error gid printing map string");
3210 return -1;
3211 }
3212
3213 /* "g:hostgid:hostgid:1" */
3214 ret = snprintf(map5, 100, "g:%d:%d:1", hostgid, hostgid);
3215 if (ret < 0 || ret >= 100) {
3216 ERROR("Error gid printing map string");
3217 return -1;
3218 }
3219
3220 /* "0:pathgid" (chown) */
3221 ret = snprintf(ugid, 100, "0:%d", (gid_t)sb.st_gid);
3222 if (ret < 0 || ret >= 100) {
3223 ERROR("Error owner printing format string for chown");
3224 return -1;
3225 }
3226
3227 if (hostgid == sb.st_gid)
3228 ret = run_command(cmd_output, sizeof(cmd_output),
3229 chown_mapped_root_exec_wrapper,
3230 (void *)args1);
3231 else
3232 ret = run_command(cmd_output, sizeof(cmd_output),
3233 chown_mapped_root_exec_wrapper,
3234 (void *)args2);
3235 if (ret < 0)
3236 ERROR("lxc-usernsexec failed: %s", cmd_output);
3237
3238 return ret;
3239 }
3240
3241 /* NOTE: Must not be called from inside the container namespace! */
3242 int lxc_create_tmp_proc_mount(struct lxc_conf *conf)
3243 {
3244 int mounted;
3245
3246 mounted = lxc_mount_proc_if_needed(conf->rootfs.path ? conf->rootfs.mount : "");
3247 if (mounted == -1) {
3248 SYSERROR("Failed to mount proc in the container");
3249 /* continue only if there is no rootfs */
3250 if (conf->rootfs.path)
3251 return -1;
3252 } else if (mounted == 1) {
3253 conf->tmp_umount_proc = true;
3254 }
3255
3256 return 0;
3257 }
3258
3259 void tmp_proc_unmount(struct lxc_conf *lxc_conf)
3260 {
3261 if (!lxc_conf->tmp_umount_proc)
3262 return;
3263
3264 (void)umount2("/proc", MNT_DETACH);
3265 lxc_conf->tmp_umount_proc = false;
3266 }
3267
3268 /* Walk /proc/mounts and change any shared entries to slave. */
3269 void remount_all_slave(void)
3270 {
3271 __do_free char *line = NULL;
3272 __do_fclose FILE *f = NULL;
3273 __do_close_prot_errno int memfd = -EBADF, mntinfo_fd = -EBADF;
3274 int ret;
3275 ssize_t copied;
3276 size_t len = 0;
3277
3278 mntinfo_fd = open("/proc/self/mountinfo", O_RDONLY | O_CLOEXEC);
3279 if (mntinfo_fd < 0) {
3280 SYSERROR("Failed to open \"/proc/self/mountinfo\"");
3281 return;
3282 }
3283
3284 memfd = memfd_create(".lxc_mountinfo", MFD_CLOEXEC);
3285 if (memfd < 0) {
3286 char template[] = P_tmpdir "/.lxc_mountinfo_XXXXXX";
3287
3288 if (errno != ENOSYS) {
3289 SYSERROR("Failed to create temporary in-memory file");
3290 return;
3291 }
3292
3293 memfd = lxc_make_tmpfile(template, true);
3294 if (memfd < 0) {
3295 WARN("Failed to create temporary file");
3296 return;
3297 }
3298 }
3299
3300 again:
3301 copied = lxc_sendfile_nointr(memfd, mntinfo_fd, NULL, LXC_SENDFILE_MAX);
3302 if (copied < 0) {
3303 if (errno == EINTR)
3304 goto again;
3305
3306 SYSERROR("Failed to copy \"/proc/self/mountinfo\"");
3307 return;
3308 }
3309
3310 ret = lseek(memfd, 0, SEEK_SET);
3311 if (ret < 0) {
3312 SYSERROR("Failed to reset file descriptor offset");
3313 return;
3314 }
3315
3316 f = fdopen(memfd, "r");
3317 if (!f) {
3318 SYSERROR("Failed to open copy of \"/proc/self/mountinfo\" to mark all shared. Continuing");
3319 return;
3320 }
3321
3322 /*
3323 * After a successful fdopen() memfd will be closed when calling
3324 * fclose(f). Calling close(memfd) afterwards is undefined.
3325 */
3326 move_fd(memfd);
3327
3328 while (getline(&line, &len, f) != -1) {
3329 char *opts, *target;
3330
3331 target = get_field(line, 4);
3332 if (!target)
3333 continue;
3334
3335 opts = get_field(target, 2);
3336 if (!opts)
3337 continue;
3338
3339 null_endofword(opts);
3340 if (!strstr(opts, "shared"))
3341 continue;
3342
3343 null_endofword(target);
3344 ret = mount(NULL, target, NULL, MS_SLAVE, NULL);
3345 if (ret < 0) {
3346 SYSERROR("Failed to make \"%s\" MS_SLAVE", target);
3347 ERROR("Continuing...");
3348 continue;
3349 }
3350 TRACE("Remounted \"%s\" as MS_SLAVE", target);
3351 }
3352 TRACE("Remounted all mount table entries as MS_SLAVE");
3353 }
3354
3355 static int lxc_execute_bind_init(struct lxc_handler *handler)
3356 {
3357 int ret;
3358 char *p;
3359 char path[PATH_MAX], destpath[PATH_MAX];
3360 struct lxc_conf *conf = handler->conf;
3361
3362 /* If init exists in the container, don't bind mount a static one */
3363 p = choose_init(conf->rootfs.mount);
3364 if (p) {
3365 __do_free char *old = p;
3366
3367 p = strdup(old + strlen(conf->rootfs.mount));
3368 if (!p)
3369 return -ENOMEM;
3370
3371 INFO("Found existing init at \"%s\"", p);
3372 goto out;
3373 }
3374
3375 ret = snprintf(path, PATH_MAX, SBINDIR "/init.lxc.static");
3376 if (ret < 0 || ret >= PATH_MAX)
3377 return -1;
3378
3379 if (!file_exists(path)) {
3380 ERROR("The file \"%s\" does not exist on host", path);
3381 return -1;
3382 }
3383
3384 ret = snprintf(destpath, PATH_MAX, "%s" P_tmpdir "%s", conf->rootfs.mount, "/.lxc-init");
3385 if (ret < 0 || ret >= PATH_MAX)
3386 return -1;
3387
3388 if (!file_exists(destpath)) {
3389 ret = mknod(destpath, S_IFREG | 0000, 0);
3390 if (ret < 0 && errno != EEXIST) {
3391 SYSERROR("Failed to create dummy \"%s\" file as bind mount target", destpath);
3392 return -1;
3393 }
3394 }
3395
3396 ret = safe_mount(path, destpath, "none", MS_BIND, NULL, conf->rootfs.mount);
3397 if (ret < 0) {
3398 SYSERROR("Failed to bind mount lxc.init.static into container");
3399 return -1;
3400 }
3401
3402 p = strdup(destpath + strlen(conf->rootfs.mount));
3403 if (!p)
3404 return -ENOMEM;
3405
3406 INFO("Bind mounted lxc.init.static into container at \"%s\"", path);
3407 out:
3408 ((struct execute_args *)handler->data)->init_fd = -1;
3409 ((struct execute_args *)handler->data)->init_path = p;
3410 return 0;
3411 }
3412
3413 /* This does the work of remounting / if it is shared, calling the container
3414 * pre-mount hooks, and mounting the rootfs.
3415 */
3416 int lxc_setup_rootfs_prepare_root(struct lxc_conf *conf, const char *name,
3417 const char *lxcpath)
3418 {
3419 int ret;
3420
3421 if (conf->rootfs_setup) {
3422 const char *path = conf->rootfs.mount;
3423
3424 /* The rootfs was set up in another namespace. bind-mount it to
3425 * give us a mount in our own ns so we can pivot_root to it
3426 */
3427 ret = mount(path, path, "rootfs", MS_BIND, NULL);
3428 if (ret < 0) {
3429 ERROR("Failed to bind mount container / onto itself");
3430 return -1;
3431 }
3432
3433 TRACE("Bind mounted container / onto itself");
3434 return 0;
3435 }
3436
3437 remount_all_slave();
3438
3439 ret = run_lxc_hooks(name, "pre-mount", conf, NULL);
3440 if (ret < 0) {
3441 ERROR("Failed to run pre-mount hooks");
3442 return -1;
3443 }
3444
3445 ret = lxc_mount_rootfs(conf);
3446 if (ret < 0) {
3447 ERROR("Failed to setup rootfs for");
3448 return -1;
3449 }
3450
3451 conf->rootfs_setup = true;
3452 return 0;
3453 }
3454
3455 static bool verify_start_hooks(struct lxc_conf *conf)
3456 {
3457 char path[PATH_MAX];
3458 struct lxc_list *it;
3459
3460 lxc_list_for_each (it, &conf->hooks[LXCHOOK_START]) {
3461 int ret;
3462 char *hookname = it->elem;
3463
3464 ret = snprintf(path, PATH_MAX, "%s%s",
3465 conf->rootfs.path ? conf->rootfs.mount : "",
3466 hookname);
3467 if (ret < 0 || ret >= PATH_MAX)
3468 return false;
3469
3470 ret = access(path, X_OK);
3471 if (ret < 0) {
3472 SYSERROR("Start hook \"%s\" not found in container",
3473 hookname);
3474 return false;
3475 }
3476
3477 return true;
3478 }
3479
3480 return true;
3481 }
3482
3483 static bool execveat_supported(void)
3484 {
3485 lxc_raw_execveat(-1, "", NULL, NULL, AT_EMPTY_PATH);
3486 if (errno == ENOSYS)
3487 return false;
3488
3489 return true;
3490 }
3491
3492 static int lxc_setup_boot_id(void)
3493 {
3494 int ret;
3495 const char *boot_id_path = "/proc/sys/kernel/random/boot_id";
3496 const char *mock_boot_id_path = "/dev/.lxc-boot-id";
3497 lxc_id128_t n;
3498
3499 if (access(boot_id_path, F_OK))
3500 return 0;
3501
3502 memset(&n, 0, sizeof(n));
3503 if (lxc_id128_randomize(&n)) {
3504 SYSERROR("Failed to generate random data for uuid");
3505 return -1;
3506 }
3507
3508 ret = lxc_id128_write(mock_boot_id_path, n);
3509 if (ret < 0) {
3510 SYSERROR("Failed to write uuid to %s", mock_boot_id_path);
3511 return -1;
3512 }
3513
3514 ret = chmod(mock_boot_id_path, 0444);
3515 if (ret < 0) {
3516 SYSERROR("Failed to chown %s", mock_boot_id_path);
3517 (void)unlink(mock_boot_id_path);
3518 return -1;
3519 }
3520
3521 ret = mount(mock_boot_id_path, boot_id_path, NULL, MS_BIND, NULL);
3522 if (ret < 0) {
3523 SYSERROR("Failed to mount %s to %s", mock_boot_id_path,
3524 boot_id_path);
3525 (void)unlink(mock_boot_id_path);
3526 return -1;
3527 }
3528
3529 ret = mount(NULL, boot_id_path, NULL,
3530 (MS_BIND | MS_REMOUNT | MS_RDONLY | MS_NOSUID | MS_NOEXEC |
3531 MS_NODEV),
3532 NULL);
3533 if (ret < 0) {
3534 SYSERROR("Failed to remount %s read-only", boot_id_path);
3535 (void)unlink(mock_boot_id_path);
3536 return -1;
3537 }
3538
3539 return 0;
3540 }
3541
3542 int lxc_setup(struct lxc_handler *handler)
3543 {
3544 int ret;
3545 const char *lxcpath = handler->lxcpath, *name = handler->name;
3546 struct lxc_conf *lxc_conf = handler->conf;
3547
3548 ret = lxc_setup_rootfs_prepare_root(lxc_conf, name, lxcpath);
3549 if (ret < 0) {
3550 ERROR("Failed to setup rootfs");
3551 return -1;
3552 }
3553
3554 if (handler->nsfd[LXC_NS_UTS] == -1) {
3555 ret = setup_utsname(lxc_conf->utsname);
3556 if (ret < 0) {
3557 ERROR("Failed to setup the utsname %s", name);
3558 return -1;
3559 }
3560 }
3561
3562 ret = lxc_setup_keyring();
3563 if (ret < 0)
3564 return -1;
3565
3566 if (handler->ns_clone_flags & CLONE_NEWNET) {
3567 ret = lxc_setup_network_in_child_namespaces(lxc_conf,
3568 &lxc_conf->network);
3569 if (ret < 0) {
3570 ERROR("Failed to setup network");
3571 return -1;
3572 }
3573
3574 ret = lxc_network_send_name_and_ifindex_to_parent(handler);
3575 if (ret < 0) {
3576 ERROR("Failed to send network device names and ifindices to parent");
3577 return -1;
3578 }
3579 }
3580
3581 if (lxc_conf->autodev > 0) {
3582 ret = mount_autodev(name, &lxc_conf->rootfs, lxcpath);
3583 if (ret < 0) {
3584 ERROR("Failed to mount \"/dev\"");
3585 return -1;
3586 }
3587 }
3588
3589 /* Do automatic mounts (mainly /proc and /sys), but exclude those that
3590 * need to wait until other stuff has finished.
3591 */
3592 ret = lxc_mount_auto_mounts(lxc_conf, lxc_conf->auto_mounts & ~LXC_AUTO_CGROUP_MASK, handler);
3593 if (ret < 0) {
3594 ERROR("Failed to setup first automatic mounts");
3595 return -1;
3596 }
3597
3598 ret = setup_mount(lxc_conf, &lxc_conf->rootfs, lxc_conf->fstab, name, lxcpath);
3599 if (ret < 0) {
3600 ERROR("Failed to setup mounts");
3601 return -1;
3602 }
3603
3604 if (!lxc_list_empty(&lxc_conf->mount_list)) {
3605 ret = setup_mount_entries(lxc_conf, &lxc_conf->rootfs,
3606 &lxc_conf->mount_list, name, lxcpath);
3607 if (ret < 0) {
3608 ERROR("Failed to setup mount entries");
3609 return -1;
3610 }
3611 }
3612
3613 if (lxc_conf->is_execute) {
3614 if (execveat_supported()) {
3615 int fd;
3616 char path[PATH_MAX];
3617
3618 ret = snprintf(path, PATH_MAX, SBINDIR "/init.lxc.static");
3619 if (ret < 0 || ret >= PATH_MAX) {
3620 ERROR("Path to init.lxc.static too long");
3621 return -1;
3622 }
3623
3624 fd = open(path, O_PATH | O_CLOEXEC);
3625 if (fd < 0) {
3626 SYSERROR("Unable to open lxc.init.static");
3627 return -1;
3628 }
3629
3630 ((struct execute_args *)handler->data)->init_fd = fd;
3631 ((struct execute_args *)handler->data)->init_path = NULL;
3632 } else {
3633 ret = lxc_execute_bind_init(handler);
3634 if (ret < 0) {
3635 ERROR("Failed to bind-mount the lxc init system");
3636 return -1;
3637 }
3638 }
3639 }
3640
3641 /* Now mount only cgroups, if wanted. Before, /sys could not have been
3642 * mounted. It is guaranteed to be mounted now either through
3643 * automatically or via fstab entries.
3644 */
3645 ret = lxc_mount_auto_mounts(lxc_conf, lxc_conf->auto_mounts & LXC_AUTO_CGROUP_MASK, handler);
3646 if (ret < 0) {
3647 ERROR("Failed to setup remaining automatic mounts");
3648 return -1;
3649 }
3650
3651 ret = run_lxc_hooks(name, "mount", lxc_conf, NULL);
3652 if (ret < 0) {
3653 ERROR("Failed to run mount hooks");
3654 return -1;
3655 }
3656
3657 if (lxc_conf->autodev > 0) {
3658 ret = run_lxc_hooks(name, "autodev", lxc_conf, NULL);
3659 if (ret < 0) {
3660 ERROR("Failed to run autodev hooks");
3661 return -1;
3662 }
3663
3664 ret = lxc_fill_autodev(&lxc_conf->rootfs);
3665 if (ret < 0) {
3666 ERROR("Failed to populate \"/dev\"");
3667 return -1;
3668 }
3669 }
3670
3671 /* Make sure any start hooks are in the container */
3672 if (!verify_start_hooks(lxc_conf)) {
3673 ERROR("Failed to verify start hooks");
3674 return -1;
3675 }
3676
3677 ret = lxc_setup_console(&lxc_conf->rootfs, &lxc_conf->console,
3678 lxc_conf->ttys.dir);
3679 if (ret < 0) {
3680 ERROR("Failed to setup console");
3681 return -1;
3682 }
3683
3684 ret = lxc_setup_dev_symlinks(&lxc_conf->rootfs);
3685 if (ret < 0) {
3686 ERROR("Failed to setup \"/dev\" symlinks");
3687 return -1;
3688 }
3689
3690 ret = lxc_create_tmp_proc_mount(lxc_conf);
3691 if (ret < 0) {
3692 ERROR("Failed to \"/proc\" LSMs");
3693 return -1;
3694 }
3695
3696 ret = lxc_setup_rootfs_switch_root(&lxc_conf->rootfs);
3697 if (ret < 0) {
3698 ERROR("Failed to pivot root into rootfs");
3699 return -1;
3700 }
3701
3702 /* Setting the boot-id is best-effort for now. */
3703 if (lxc_conf->autodev > 0)
3704 (void)lxc_setup_boot_id();
3705
3706 ret = lxc_setup_devpts(lxc_conf);
3707 if (ret < 0) {
3708 ERROR("Failed to setup new devpts instance");
3709 return -1;
3710 }
3711
3712 ret = lxc_create_ttys(handler);
3713 if (ret < 0)
3714 return -1;
3715
3716 ret = setup_personality(lxc_conf->personality);
3717 if (ret < 0) {
3718 ERROR("Failed to set personality");
3719 return -1;
3720 }
3721
3722 /* Set sysctl value to a path under /proc/sys as determined from the
3723 * key. For e.g. net.ipv4.ip_forward translated to
3724 * /proc/sys/net/ipv4/ip_forward.
3725 */
3726 if (!lxc_list_empty(&lxc_conf->sysctls)) {
3727 ret = setup_sysctl_parameters(&lxc_conf->sysctls);
3728 if (ret < 0) {
3729 ERROR("Failed to setup sysctl parameters");
3730 return -1;
3731 }
3732 }
3733
3734 if (!lxc_list_empty(&lxc_conf->keepcaps)) {
3735 if (!lxc_list_empty(&lxc_conf->caps)) {
3736 ERROR("Container requests lxc.cap.drop and "
3737 "lxc.cap.keep: either use lxc.cap.drop or "
3738 "lxc.cap.keep, not both");
3739 return -1;
3740 }
3741
3742 if (dropcaps_except(&lxc_conf->keepcaps)) {
3743 ERROR("Failed to keep capabilities");
3744 return -1;
3745 }
3746 } else if (setup_caps(&lxc_conf->caps)) {
3747 ERROR("Failed to drop capabilities");
3748 return -1;
3749 }
3750
3751 NOTICE("The container \"%s\" is set up", name);
3752
3753 return 0;
3754 }
3755
3756 int run_lxc_hooks(const char *name, char *hookname, struct lxc_conf *conf,
3757 char *argv[])
3758 {
3759 struct lxc_list *it;
3760 int which;
3761
3762 for (which = 0; which < NUM_LXC_HOOKS; which ++) {
3763 if (strcmp(hookname, lxchook_names[which]) == 0)
3764 break;
3765 }
3766
3767 if (which >= NUM_LXC_HOOKS)
3768 return -1;
3769
3770 lxc_list_for_each (it, &conf->hooks[which]) {
3771 int ret;
3772 char *hook = it->elem;
3773
3774 ret = run_script_argv(name, conf->hooks_version, "lxc", hook,
3775 hookname, argv);
3776 if (ret < 0)
3777 return -1;
3778 }
3779
3780 return 0;
3781 }
3782
3783 int lxc_clear_config_caps(struct lxc_conf *c)
3784 {
3785 struct lxc_list *it, *next;
3786
3787 lxc_list_for_each_safe (it, &c->caps, next) {
3788 lxc_list_del(it);
3789 free(it->elem);
3790 free(it);
3791 }
3792
3793 return 0;
3794 }
3795
3796 static int lxc_free_idmap(struct lxc_list *id_map)
3797 {
3798 struct lxc_list *it, *next;
3799
3800 lxc_list_for_each_safe (it, id_map, next) {
3801 lxc_list_del(it);
3802 free(it->elem);
3803 free(it);
3804 }
3805
3806 return 0;
3807 }
3808
3809 int lxc_clear_idmaps(struct lxc_conf *c)
3810 {
3811 return lxc_free_idmap(&c->id_map);
3812 }
3813
3814 int lxc_clear_config_keepcaps(struct lxc_conf *c)
3815 {
3816 struct lxc_list *it, *next;
3817
3818 lxc_list_for_each_safe (it, &c->keepcaps, next) {
3819 lxc_list_del(it);
3820 free(it->elem);
3821 free(it);
3822 }
3823
3824 return 0;
3825 }
3826
3827 int lxc_clear_namespace(struct lxc_conf *c)
3828 {
3829 int i;
3830 for (i = 0; i < LXC_NS_MAX; i++) {
3831 free(c->ns_share[i]);
3832 c->ns_share[i] = NULL;
3833 }
3834 return 0;
3835 }
3836
3837 int lxc_clear_cgroups(struct lxc_conf *c, const char *key, int version)
3838 {
3839 char *global_token, *namespaced_token;
3840 size_t namespaced_token_len;
3841 struct lxc_list *it, *next, *list;
3842 const char *k = key;
3843 bool all = false;
3844
3845 if (version == CGROUP2_SUPER_MAGIC) {
3846 global_token = "lxc.cgroup2";
3847 namespaced_token = "lxc.cgroup2.";
3848 namespaced_token_len = STRLITERALLEN("lxc.cgroup2.");
3849 list = &c->cgroup2;
3850 } else if (version == CGROUP_SUPER_MAGIC) {
3851 global_token = "lxc.cgroup";
3852 namespaced_token = "lxc.cgroup.";
3853 namespaced_token_len = STRLITERALLEN("lxc.cgroup.");
3854 list = &c->cgroup;
3855 } else {
3856 return -EINVAL;
3857 }
3858
3859 if (strcmp(key, global_token) == 0)
3860 all = true;
3861 else if (strncmp(key, namespaced_token, namespaced_token_len) == 0)
3862 k += namespaced_token_len;
3863 else
3864 return -EINVAL;
3865
3866 lxc_list_for_each_safe (it, list, next) {
3867 struct lxc_cgroup *cg = it->elem;
3868
3869 if (!all && strcmp(cg->subsystem, k) != 0)
3870 continue;
3871
3872 lxc_list_del(it);
3873 free(cg->subsystem);
3874 free(cg->value);
3875 free(cg);
3876 free(it);
3877 }
3878
3879 return 0;
3880 }
3881
3882 int lxc_clear_limits(struct lxc_conf *c, const char *key)
3883 {
3884 struct lxc_list *it, *next;
3885 const char *k = NULL;
3886 bool all = false;
3887
3888 if (strcmp(key, "lxc.limit") == 0 || strcmp(key, "lxc.prlimit") == 0)
3889 all = true;
3890 else if (strncmp(key, "lxc.limit.", STRLITERALLEN("lxc.limit.")) == 0)
3891 k = key + STRLITERALLEN("lxc.limit.");
3892 else if (strncmp(key, "lxc.prlimit.", STRLITERALLEN("lxc.prlimit.")) == 0)
3893 k = key + STRLITERALLEN("lxc.prlimit.");
3894 else
3895 return -1;
3896
3897 lxc_list_for_each_safe (it, &c->limits, next) {
3898 struct lxc_limit *lim = it->elem;
3899
3900 if (!all && strcmp(lim->resource, k) != 0)
3901 continue;
3902
3903 lxc_list_del(it);
3904 free(lim->resource);
3905 free(lim);
3906 free(it);
3907 }
3908
3909 return 0;
3910 }
3911
3912 int lxc_clear_sysctls(struct lxc_conf *c, const char *key)
3913 {
3914 struct lxc_list *it, *next;
3915 const char *k = NULL;
3916 bool all = false;
3917
3918 if (strcmp(key, "lxc.sysctl") == 0)
3919 all = true;
3920 else if (strncmp(key, "lxc.sysctl.", STRLITERALLEN("lxc.sysctl.")) == 0)
3921 k = key + STRLITERALLEN("lxc.sysctl.");
3922 else
3923 return -1;
3924
3925 lxc_list_for_each_safe (it, &c->sysctls, next) {
3926 struct lxc_sysctl *elem = it->elem;
3927
3928 if (!all && strcmp(elem->key, k) != 0)
3929 continue;
3930
3931 lxc_list_del(it);
3932 free(elem->key);
3933 free(elem->value);
3934 free(elem);
3935 free(it);
3936 }
3937
3938 return 0;
3939 }
3940
3941 int lxc_clear_procs(struct lxc_conf *c, const char *key)
3942 {
3943 struct lxc_list *it, *next;
3944 const char *k = NULL;
3945 bool all = false;
3946
3947 if (strcmp(key, "lxc.proc") == 0)
3948 all = true;
3949 else if (strncmp(key, "lxc.proc.", STRLITERALLEN("lxc.proc.")) == 0)
3950 k = key + STRLITERALLEN("lxc.proc.");
3951 else
3952 return -1;
3953
3954 lxc_list_for_each_safe (it, &c->procs, next) {
3955 struct lxc_proc *proc = it->elem;
3956
3957 if (!all && strcmp(proc->filename, k) != 0)
3958 continue;
3959
3960 lxc_list_del(it);
3961 free(proc->filename);
3962 free(proc->value);
3963 free(proc);
3964 free(it);
3965 }
3966
3967 return 0;
3968 }
3969
3970 int lxc_clear_groups(struct lxc_conf *c)
3971 {
3972 struct lxc_list *it, *next;
3973
3974 lxc_list_for_each_safe (it, &c->groups, next) {
3975 lxc_list_del(it);
3976 free(it->elem);
3977 free(it);
3978 }
3979
3980 return 0;
3981 }
3982
3983 int lxc_clear_environment(struct lxc_conf *c)
3984 {
3985 struct lxc_list *it, *next;
3986
3987 lxc_list_for_each_safe (it, &c->environment, next) {
3988 lxc_list_del(it);
3989 free(it->elem);
3990 free(it);
3991 }
3992
3993 return 0;
3994 }
3995
3996 int lxc_clear_mount_entries(struct lxc_conf *c)
3997 {
3998 struct lxc_list *it, *next;
3999
4000 lxc_list_for_each_safe (it, &c->mount_list, next) {
4001 lxc_list_del(it);
4002 free(it->elem);
4003 free(it);
4004 }
4005
4006 return 0;
4007 }
4008
4009 int lxc_clear_automounts(struct lxc_conf *c)
4010 {
4011 c->auto_mounts = 0;
4012 return 0;
4013 }
4014
4015 int lxc_clear_hooks(struct lxc_conf *c, const char *key)
4016 {
4017 int i;
4018 struct lxc_list *it, *next;
4019 const char *k = NULL;
4020 bool all = false, done = false;
4021
4022 if (strcmp(key, "lxc.hook") == 0)
4023 all = true;
4024 else if (strncmp(key, "lxc.hook.", STRLITERALLEN("lxc.hook.")) == 0)
4025 k = key + STRLITERALLEN("lxc.hook.");
4026 else
4027 return -1;
4028
4029 for (i = 0; i < NUM_LXC_HOOKS; i++) {
4030 if (all || strcmp(k, lxchook_names[i]) == 0) {
4031 lxc_list_for_each_safe (it, &c->hooks[i], next) {
4032 lxc_list_del(it);
4033 free(it->elem);
4034 free(it);
4035 }
4036
4037 done = true;
4038 }
4039 }
4040
4041 if (!done) {
4042 ERROR("Invalid hook key: %s", key);
4043 return -1;
4044 }
4045
4046 return 0;
4047 }
4048
4049 static inline void lxc_clear_aliens(struct lxc_conf *conf)
4050 {
4051 struct lxc_list *it, *next;
4052
4053 lxc_list_for_each_safe (it, &conf->aliens, next) {
4054 lxc_list_del(it);
4055 free(it->elem);
4056 free(it);
4057 }
4058 }
4059
4060 void lxc_clear_includes(struct lxc_conf *conf)
4061 {
4062 struct lxc_list *it, *next;
4063
4064 lxc_list_for_each_safe (it, &conf->includes, next) {
4065 lxc_list_del(it);
4066 free(it->elem);
4067 free(it);
4068 }
4069 }
4070
4071 int lxc_clear_apparmor_raw(struct lxc_conf *c)
4072 {
4073 struct lxc_list *it, *next;
4074
4075 lxc_list_for_each_safe (it, &c->lsm_aa_raw, next) {
4076 lxc_list_del(it);
4077 free(it->elem);
4078 free(it);
4079 }
4080
4081 return 0;
4082 }
4083
4084 void lxc_conf_free(struct lxc_conf *conf)
4085 {
4086 if (!conf)
4087 return;
4088
4089 if (current_config == conf)
4090 current_config = NULL;
4091 lxc_terminal_conf_free(&conf->console);
4092 free(conf->rootfs.mount);
4093 free(conf->rootfs.bdev_type);
4094 free(conf->rootfs.options);
4095 free(conf->rootfs.path);
4096 free(conf->logfile);
4097 if (conf->logfd != -1)
4098 close(conf->logfd);
4099 free(conf->utsname);
4100 free(conf->ttys.dir);
4101 free(conf->ttys.tty_names);
4102 free(conf->fstab);
4103 free(conf->rcfile);
4104 free(conf->execute_cmd);
4105 free(conf->init_cmd);
4106 free(conf->init_cwd);
4107 free(conf->unexpanded_config);
4108 free(conf->syslog);
4109 lxc_free_networks(&conf->network);
4110 free(conf->lsm_aa_profile);
4111 free(conf->lsm_aa_profile_computed);
4112 free(conf->lsm_se_context);
4113 lxc_seccomp_free(&conf->seccomp);
4114 lxc_clear_config_caps(conf);
4115 lxc_clear_config_keepcaps(conf);
4116 lxc_clear_cgroups(conf, "lxc.cgroup", CGROUP_SUPER_MAGIC);
4117 lxc_clear_cgroups(conf, "lxc.cgroup2", CGROUP2_SUPER_MAGIC);
4118 lxc_clear_hooks(conf, "lxc.hook");
4119 lxc_clear_mount_entries(conf);
4120 lxc_clear_idmaps(conf);
4121 lxc_clear_groups(conf);
4122 lxc_clear_includes(conf);
4123 lxc_clear_aliens(conf);
4124 lxc_clear_environment(conf);
4125 lxc_clear_limits(conf, "lxc.prlimit");
4126 lxc_clear_sysctls(conf, "lxc.sysctl");
4127 lxc_clear_procs(conf, "lxc.proc");
4128 lxc_clear_apparmor_raw(conf);
4129 lxc_clear_namespace(conf);
4130 free(conf->cgroup_meta.dir);
4131 free(conf->cgroup_meta.controllers);
4132 free(conf->shmount.path_host);
4133 free(conf->shmount.path_cont);
4134 free(conf);
4135 }
4136
4137 struct userns_fn_data {
4138 int (*fn)(void *);
4139 const char *fn_name;
4140 void *arg;
4141 int p[2];
4142 };
4143
4144 static int run_userns_fn(void *data)
4145 {
4146 int ret;
4147 char c;
4148 struct userns_fn_data *d = data;
4149
4150 /* Close write end of the pipe. */
4151 close(d->p[1]);
4152
4153 /* Wait for parent to finish establishing a new mapping in the user
4154 * namespace we are executing in.
4155 */
4156 ret = lxc_read_nointr(d->p[0], &c, 1);
4157 /* Close read end of the pipe. */
4158 close(d->p[0]);
4159 if (ret != 1)
4160 return -1;
4161
4162 if (d->fn_name)
4163 TRACE("Calling function \"%s\"", d->fn_name);
4164
4165 /* Call function to run. */
4166 return d->fn(d->arg);
4167 }
4168
4169 static struct id_map *mapped_nsid_add(struct lxc_conf *conf, unsigned id,
4170 enum idtype idtype)
4171 {
4172 const struct id_map *map;
4173 struct id_map *retmap;
4174
4175 map = find_mapped_nsid_entry(conf, id, idtype);
4176 if (!map)
4177 return NULL;
4178
4179 retmap = malloc(sizeof(*retmap));
4180 if (!retmap)
4181 return NULL;
4182
4183 memcpy(retmap, map, sizeof(*retmap));
4184 return retmap;
4185 }
4186
4187 static struct id_map *find_mapped_hostid_entry(struct lxc_conf *conf,
4188 unsigned id, enum idtype idtype)
4189 {
4190 struct id_map *map;
4191 struct lxc_list *it;
4192 struct id_map *retmap = NULL;
4193
4194 lxc_list_for_each (it, &conf->id_map) {
4195 map = it->elem;
4196 if (map->idtype != idtype)
4197 continue;
4198
4199 if (id >= map->hostid && id < map->hostid + map->range) {
4200 retmap = map;
4201 break;
4202 }
4203 }
4204
4205 return retmap;
4206 }
4207
4208 /* Allocate a new {g,u}id mapping for the given {g,u}id. Re-use an already
4209 * existing one or establish a new one.
4210 */
4211 static struct id_map *mapped_hostid_add(struct lxc_conf *conf, uid_t id,
4212 enum idtype type)
4213 {
4214 int hostid_mapped;
4215 struct id_map *entry = NULL, *tmp = NULL;
4216
4217 entry = malloc(sizeof(*entry));
4218 if (!entry)
4219 return NULL;
4220
4221 /* Reuse existing mapping. */
4222 tmp = find_mapped_hostid_entry(conf, id, type);
4223 if (tmp)
4224 return memcpy(entry, tmp, sizeof(*entry));
4225
4226 /* Find new mapping. */
4227 hostid_mapped = find_unmapped_nsid(conf, type);
4228 if (hostid_mapped < 0) {
4229 DEBUG("Failed to find free mapping for id %d", id);
4230 free(entry);
4231 return NULL;
4232 }
4233
4234 entry->idtype = type;
4235 entry->nsid = hostid_mapped;
4236 entry->hostid = (unsigned long)id;
4237 entry->range = 1;
4238
4239 return entry;
4240 }
4241
4242 struct lxc_list *get_minimal_idmap(struct lxc_conf *conf)
4243 {
4244 __do_free struct id_map *container_root_uid = NULL,
4245 *container_root_gid = NULL,
4246 *host_uid_map = NULL, *host_gid_map = NULL;
4247 __do_free struct lxc_list *idmap = NULL;
4248 uid_t euid, egid;
4249 uid_t nsuid = (conf->root_nsuid_map != NULL) ? 0 : conf->init_uid;
4250 gid_t nsgid = (conf->root_nsgid_map != NULL) ? 0 : conf->init_gid;
4251 struct lxc_list *tmplist = NULL;
4252
4253 /* Find container root mappings. */
4254 container_root_uid = mapped_nsid_add(conf, nsuid, ID_TYPE_UID);
4255 if (!container_root_uid) {
4256 DEBUG("Failed to find mapping for namespace uid %d", 0);
4257 return NULL;
4258 }
4259 euid = geteuid();
4260 if (euid >= container_root_uid->hostid &&
4261 euid < (container_root_uid->hostid + container_root_uid->range))
4262 host_uid_map = container_root_uid;
4263
4264 container_root_gid = mapped_nsid_add(conf, nsgid, ID_TYPE_GID);
4265 if (!container_root_gid) {
4266 DEBUG("Failed to find mapping for namespace gid %d", 0);
4267 return NULL;
4268 }
4269 egid = getegid();
4270 if (egid >= container_root_gid->hostid &&
4271 egid < (container_root_gid->hostid + container_root_gid->range))
4272 host_gid_map = container_root_gid;
4273
4274 /* Check whether the {g,u}id of the user has a mapping. */
4275 if (!host_uid_map)
4276 host_uid_map = mapped_hostid_add(conf, euid, ID_TYPE_UID);
4277 if (!host_uid_map) {
4278 DEBUG("Failed to find mapping for uid %d", euid);
4279 return NULL;
4280 }
4281
4282 if (!host_gid_map)
4283 host_gid_map = mapped_hostid_add(conf, egid, ID_TYPE_GID);
4284 if (!host_gid_map) {
4285 DEBUG("Failed to find mapping for gid %d", egid);
4286 return NULL;
4287 }
4288
4289 /* Allocate new {g,u}id map list. */
4290 idmap = malloc(sizeof(*idmap));
4291 if (!idmap)
4292 return NULL;
4293 lxc_list_init(idmap);
4294
4295 /* Add container root to the map. */
4296 tmplist = malloc(sizeof(*tmplist));
4297 if (!tmplist)
4298 return NULL;
4299 lxc_list_add_elem(tmplist, container_root_uid);
4300 lxc_list_add_tail(idmap, tmplist);
4301
4302 if (host_uid_map && (host_uid_map != container_root_uid)) {
4303 /* idmap will now keep track of that memory. */
4304 move_ptr(container_root_uid);
4305
4306 /* Add container root to the map. */
4307 tmplist = malloc(sizeof(*tmplist));
4308 if (!tmplist)
4309 return NULL;
4310 lxc_list_add_elem(tmplist, host_uid_map);
4311 lxc_list_add_tail(idmap, tmplist);
4312 }
4313 /* idmap will now keep track of that memory. */
4314 move_ptr(container_root_uid);
4315 /* idmap will now keep track of that memory. */
4316 move_ptr(host_uid_map);
4317
4318 tmplist = malloc(sizeof(*tmplist));
4319 if (!tmplist)
4320 return NULL;
4321 lxc_list_add_elem(tmplist, container_root_gid);
4322 lxc_list_add_tail(idmap, tmplist);
4323
4324 if (host_gid_map && (host_gid_map != container_root_gid)) {
4325 /* idmap will now keep track of that memory. */
4326 move_ptr(container_root_gid);
4327
4328 tmplist = malloc(sizeof(*tmplist));
4329 if (!tmplist)
4330 return NULL;
4331 lxc_list_add_elem(tmplist, host_gid_map);
4332 lxc_list_add_tail(idmap, tmplist);
4333 }
4334 /* idmap will now keep track of that memory. */
4335 move_ptr(container_root_gid);
4336 /* idmap will now keep track of that memory. */
4337 move_ptr(host_gid_map);
4338
4339 TRACE("Allocated minimal idmapping");
4340 return move_ptr(idmap);
4341 }
4342
4343 /* Run a function in a new user namespace.
4344 * The caller's euid/egid will be mapped if it is not already.
4345 * Afaict, userns_exec_1() is only used to operate based on privileges for the
4346 * user's own {g,u}id on the host and for the container root's unmapped {g,u}id.
4347 * This means we require only to establish a mapping from:
4348 * - the container root {g,u}id as seen from the host > user's host {g,u}id
4349 * - the container root -> some sub{g,u}id
4350 * The former we add, if the user did not specify a mapping. The latter we
4351 * retrieve from the container's configured {g,u}id mappings as it must have been
4352 * there to start the container in the first place.
4353 */
4354 int userns_exec_1(struct lxc_conf *conf, int (*fn)(void *), void *data,
4355 const char *fn_name)
4356 {
4357 pid_t pid;
4358 int p[2];
4359 struct userns_fn_data d;
4360 struct lxc_list *idmap;
4361 int ret = -1, status = -1;
4362 char c = '1';
4363
4364 if (!conf)
4365 return -EINVAL;
4366
4367 idmap = get_minimal_idmap(conf);
4368 if (!idmap)
4369 return -1;
4370
4371 ret = pipe2(p, O_CLOEXEC);
4372 if (ret < 0) {
4373 SYSERROR("Failed to create pipe");
4374 return -1;
4375 }
4376 d.fn = fn;
4377 d.fn_name = fn_name;
4378 d.arg = data;
4379 d.p[0] = p[0];
4380 d.p[1] = p[1];
4381
4382 /* Clone child in new user namespace. */
4383 pid = lxc_raw_clone_cb(run_userns_fn, &d, CLONE_NEWUSER, NULL);
4384 if (pid < 0) {
4385 ERROR("Failed to clone process in new user namespace");
4386 goto on_error;
4387 }
4388
4389 close(p[0]);
4390 p[0] = -1;
4391
4392 if (lxc_log_get_level() == LXC_LOG_LEVEL_TRACE ||
4393 conf->loglevel == LXC_LOG_LEVEL_TRACE) {
4394 struct id_map *map;
4395 struct lxc_list *it;
4396
4397 lxc_list_for_each (it, idmap) {
4398 map = it->elem;
4399 TRACE("Establishing %cid mapping for \"%d\" in new "
4400 "user namespace: nsuid %lu - hostid %lu - range "
4401 "%lu",
4402 (map->idtype == ID_TYPE_UID) ? 'u' : 'g', pid,
4403 map->nsid, map->hostid, map->range);
4404 }
4405 }
4406
4407 /* Set up {g,u}id mapping for user namespace of child process. */
4408 ret = lxc_map_ids(idmap, pid);
4409 if (ret < 0) {
4410 ERROR("Error setting up {g,u}id mappings for child process \"%d\"", pid);
4411 goto on_error;
4412 }
4413
4414 /* Tell child to proceed. */
4415 if (lxc_write_nointr(p[1], &c, 1) != 1) {
4416 SYSERROR("Failed telling child process \"%d\" to proceed", pid);
4417 goto on_error;
4418 }
4419
4420 on_error:
4421 if (p[0] != -1)
4422 close(p[0]);
4423 close(p[1]);
4424
4425 /* Wait for child to finish. */
4426 if (pid > 0)
4427 status = wait_for_pid(pid);
4428
4429 if (status < 0)
4430 ret = -1;
4431
4432 return ret;
4433 }
4434
4435 int userns_exec_full(struct lxc_conf *conf, int (*fn)(void *), void *data,
4436 const char *fn_name)
4437 {
4438 pid_t pid;
4439 uid_t euid, egid;
4440 int p[2];
4441 struct id_map *map;
4442 struct lxc_list *cur;
4443 struct userns_fn_data d;
4444 int ret = -1;
4445 char c = '1';
4446 struct lxc_list *idmap = NULL, *tmplist = NULL;
4447 struct id_map *container_root_uid = NULL, *container_root_gid = NULL,
4448 *host_uid_map = NULL, *host_gid_map = NULL;
4449
4450 if (!conf)
4451 return -EINVAL;
4452
4453 ret = pipe2(p, O_CLOEXEC);
4454 if (ret < 0) {
4455 SYSERROR("opening pipe");
4456 return -1;
4457 }
4458 d.fn = fn;
4459 d.fn_name = fn_name;
4460 d.arg = data;
4461 d.p[0] = p[0];
4462 d.p[1] = p[1];
4463
4464 /* Clone child in new user namespace. */
4465 pid = lxc_clone(run_userns_fn, &d, CLONE_NEWUSER, NULL);
4466 if (pid < 0) {
4467 ERROR("Failed to clone process in new user namespace");
4468 goto on_error;
4469 }
4470
4471 close(p[0]);
4472 p[0] = -1;
4473
4474 euid = geteuid();
4475 egid = getegid();
4476
4477 /* Allocate new {g,u}id map list. */
4478 idmap = malloc(sizeof(*idmap));
4479 if (!idmap)
4480 goto on_error;
4481 lxc_list_init(idmap);
4482
4483 /* Find container root. */
4484 lxc_list_for_each (cur, &conf->id_map) {
4485 struct id_map *tmpmap;
4486
4487 tmplist = malloc(sizeof(*tmplist));
4488 if (!tmplist)
4489 goto on_error;
4490
4491 tmpmap = malloc(sizeof(*tmpmap));
4492 if (!tmpmap) {
4493 free(tmplist);
4494 goto on_error;
4495 }
4496
4497 memset(tmpmap, 0, sizeof(*tmpmap));
4498 memcpy(tmpmap, cur->elem, sizeof(*tmpmap));
4499 tmplist->elem = tmpmap;
4500
4501 lxc_list_add_tail(idmap, tmplist);
4502
4503 map = cur->elem;
4504
4505 if (map->idtype == ID_TYPE_UID)
4506 if (euid >= map->hostid && euid < map->hostid + map->range)
4507 host_uid_map = map;
4508
4509 if (map->idtype == ID_TYPE_GID)
4510 if (egid >= map->hostid && egid < map->hostid + map->range)
4511 host_gid_map = map;
4512
4513 if (map->nsid != 0)
4514 continue;
4515
4516 if (map->idtype == ID_TYPE_UID)
4517 if (container_root_uid == NULL)
4518 container_root_uid = map;
4519
4520 if (map->idtype == ID_TYPE_GID)
4521 if (container_root_gid == NULL)
4522 container_root_gid = map;
4523 }
4524
4525 if (!container_root_uid || !container_root_gid) {
4526 ERROR("No mapping for container root found");
4527 goto on_error;
4528 }
4529
4530 /* Check whether the {g,u}id of the user has a mapping. */
4531 if (!host_uid_map)
4532 host_uid_map = mapped_hostid_add(conf, euid, ID_TYPE_UID);
4533 else
4534 host_uid_map = container_root_uid;
4535
4536 if (!host_gid_map)
4537 host_gid_map = mapped_hostid_add(conf, egid, ID_TYPE_GID);
4538 else
4539 host_gid_map = container_root_gid;
4540
4541 if (!host_uid_map) {
4542 DEBUG("Failed to find mapping for uid %d", euid);
4543 goto on_error;
4544 }
4545
4546 if (!host_gid_map) {
4547 DEBUG("Failed to find mapping for gid %d", egid);
4548 goto on_error;
4549 }
4550
4551 if (host_uid_map && (host_uid_map != container_root_uid)) {
4552 /* Add container root to the map. */
4553 tmplist = malloc(sizeof(*tmplist));
4554 if (!tmplist)
4555 goto on_error;
4556 lxc_list_add_elem(tmplist, host_uid_map);
4557 lxc_list_add_tail(idmap, tmplist);
4558 }
4559 /* idmap will now keep track of that memory. */
4560 host_uid_map = NULL;
4561
4562 if (host_gid_map && (host_gid_map != container_root_gid)) {
4563 tmplist = malloc(sizeof(*tmplist));
4564 if (!tmplist)
4565 goto on_error;
4566 lxc_list_add_elem(tmplist, host_gid_map);
4567 lxc_list_add_tail(idmap, tmplist);
4568 }
4569 /* idmap will now keep track of that memory. */
4570 host_gid_map = NULL;
4571
4572 if (lxc_log_get_level() == LXC_LOG_LEVEL_TRACE ||
4573 conf->loglevel == LXC_LOG_LEVEL_TRACE) {
4574 lxc_list_for_each (cur, idmap) {
4575 map = cur->elem;
4576 TRACE("establishing %cid mapping for \"%d\" in new "
4577 "user namespace: nsuid %lu - hostid %lu - range "
4578 "%lu",
4579 (map->idtype == ID_TYPE_UID) ? 'u' : 'g', pid,
4580 map->nsid, map->hostid, map->range);
4581 }
4582 }
4583
4584 /* Set up {g,u}id mapping for user namespace of child process. */
4585 ret = lxc_map_ids(idmap, pid);
4586 if (ret < 0) {
4587 ERROR("error setting up {g,u}id mappings for child process \"%d\"", pid);
4588 goto on_error;
4589 }
4590
4591 /* Tell child to proceed. */
4592 if (lxc_write_nointr(p[1], &c, 1) != 1) {
4593 SYSERROR("Failed telling child process \"%d\" to proceed", pid);
4594 goto on_error;
4595 }
4596
4597 on_error:
4598 if (p[0] != -1)
4599 close(p[0]);
4600 close(p[1]);
4601
4602 /* Wait for child to finish. */
4603 if (pid > 0)
4604 ret = wait_for_pid(pid);
4605
4606 if (idmap) {
4607 lxc_free_idmap(idmap);
4608 free(idmap);
4609 }
4610
4611 if (host_uid_map && (host_uid_map != container_root_uid))
4612 free(host_uid_map);
4613 if (host_gid_map && (host_gid_map != container_root_gid))
4614 free(host_gid_map);
4615
4616 return ret;
4617 }
4618
4619 /* not thread-safe, do not use from api without first forking */
4620 static char *getuname(void)
4621 {
4622 __do_free char *buf = NULL;
4623 struct passwd pwent;
4624 struct passwd *pwentp = NULL;
4625 size_t bufsize;
4626 int ret;
4627
4628 bufsize = sysconf(_SC_GETPW_R_SIZE_MAX);
4629 if (bufsize == -1)
4630 bufsize = 1024;
4631
4632 buf = malloc(bufsize);
4633 if (!buf)
4634 return NULL;
4635
4636 ret = getpwuid_r(geteuid(), &pwent, buf, bufsize, &pwentp);
4637 if (!pwentp) {
4638 if (ret == 0)
4639 WARN("Could not find matched password record.");
4640
4641 ERROR("Failed to get password record - %u", geteuid());
4642 return NULL;
4643 }
4644
4645 return strdup(pwent.pw_name);
4646 }
4647
4648 /* not thread-safe, do not use from api without first forking */
4649 static char *getgname(void)
4650 {
4651 __do_free char *buf = NULL;
4652 struct group grent;
4653 struct group *grentp = NULL;
4654 size_t bufsize;
4655 int ret;
4656
4657 bufsize = sysconf(_SC_GETGR_R_SIZE_MAX);
4658 if (bufsize == -1)
4659 bufsize = 1024;
4660
4661 buf = malloc(bufsize);
4662 if (!buf)
4663 return NULL;
4664
4665 ret = getgrgid_r(getegid(), &grent, buf, bufsize, &grentp);
4666 if (!grentp) {
4667 if (ret == 0)
4668 WARN("Could not find matched group record");
4669
4670 ERROR("Failed to get group record - %u", getegid());
4671 return NULL;
4672 }
4673
4674 return strdup(grent.gr_name);
4675 }
4676
4677 /* not thread-safe, do not use from api without first forking */
4678 void suggest_default_idmap(void)
4679 {
4680 __do_free char *gname = NULL, *line = NULL, *uname = NULL;
4681 __do_fclose FILE *subuid_f = NULL, *subgid_f = NULL;
4682 unsigned int uid = 0, urange = 0, gid = 0, grange = 0;
4683 size_t len = 0;
4684
4685 uname = getuname();
4686 if (!uname)
4687 return;
4688
4689 gname = getgname();
4690 if (!gname)
4691 return;
4692
4693 subuid_f = fopen(subuidfile, "r");
4694 if (!subuid_f) {
4695 ERROR("Your system is not configured with subuids");
4696 return;
4697 }
4698
4699 while (getline(&line, &len, subuid_f) != -1) {
4700 char *p, *p2;
4701 size_t no_newline = 0;
4702
4703 p = strchr(line, ':');
4704 if (*line == '#')
4705 continue;
4706 if (!p)
4707 continue;
4708 *p = '\0';
4709 p++;
4710
4711 if (strcmp(line, uname))
4712 continue;
4713
4714 p2 = strchr(p, ':');
4715 if (!p2)
4716 continue;
4717 *p2 = '\0';
4718 p2++;
4719 if (!*p2)
4720 continue;
4721 no_newline = strcspn(p2, "\n");
4722 p2[no_newline] = '\0';
4723
4724 if (lxc_safe_uint(p, &uid) < 0)
4725 WARN("Could not parse UID");
4726 if (lxc_safe_uint(p2, &urange) < 0)
4727 WARN("Could not parse UID range");
4728 }
4729
4730 subgid_f = fopen(subgidfile, "r");
4731 if (!subgid_f) {
4732 ERROR("Your system is not configured with subgids");
4733 return;
4734 }
4735
4736 while (getline(&line, &len, subgid_f) != -1) {
4737 char *p, *p2;
4738 size_t no_newline = 0;
4739
4740 p = strchr(line, ':');
4741 if (*line == '#')
4742 continue;
4743 if (!p)
4744 continue;
4745 *p = '\0';
4746 p++;
4747
4748 if (strcmp(line, uname))
4749 continue;
4750
4751 p2 = strchr(p, ':');
4752 if (!p2)
4753 continue;
4754 *p2 = '\0';
4755 p2++;
4756 if (!*p2)
4757 continue;
4758 no_newline = strcspn(p2, "\n");
4759 p2[no_newline] = '\0';
4760
4761 if (lxc_safe_uint(p, &gid) < 0)
4762 WARN("Could not parse GID");
4763 if (lxc_safe_uint(p2, &grange) < 0)
4764 WARN("Could not parse GID range");
4765 }
4766
4767 if (!urange || !grange) {
4768 ERROR("You do not have subuids or subgids allocated");
4769 ERROR("Unprivileged containers require subuids and subgids");
4770 return;
4771 }
4772
4773 ERROR("You must either run as root, or define uid mappings");
4774 ERROR("To pass uid mappings to lxc-create, you could create");
4775 ERROR("~/.config/lxc/default.conf:");
4776 ERROR("lxc.include = %s", LXC_DEFAULT_CONFIG);
4777 ERROR("lxc.idmap = u 0 %u %u", uid, urange);
4778 ERROR("lxc.idmap = g 0 %u %u", gid, grange);
4779 }
4780
4781 static void free_cgroup_settings(struct lxc_list *result)
4782 {
4783 struct lxc_list *iterator, *next;
4784
4785 lxc_list_for_each_safe (iterator, result, next) {
4786 lxc_list_del(iterator);
4787 free(iterator);
4788 }
4789 free(result);
4790 }
4791
4792 /* Return the list of cgroup_settings sorted according to the following rules
4793 * 1. Put memory.limit_in_bytes before memory.memsw.limit_in_bytes
4794 */
4795 struct lxc_list *sort_cgroup_settings(struct lxc_list *cgroup_settings)
4796 {
4797 struct lxc_list *result;
4798 struct lxc_cgroup *cg = NULL;
4799 struct lxc_list *it = NULL, *item = NULL, *memsw_limit = NULL;
4800
4801 result = malloc(sizeof(*result));
4802 if (!result)
4803 return NULL;
4804 lxc_list_init(result);
4805
4806 /* Iterate over the cgroup settings and copy them to the output list. */
4807 lxc_list_for_each (it, cgroup_settings) {
4808 item = malloc(sizeof(*item));
4809 if (!item) {
4810 free_cgroup_settings(result);
4811 return NULL;
4812 }
4813
4814 item->elem = it->elem;
4815 cg = it->elem;
4816 if (strcmp(cg->subsystem, "memory.memsw.limit_in_bytes") == 0) {
4817 /* Store the memsw_limit location */
4818 memsw_limit = item;
4819 } else if (strcmp(cg->subsystem, "memory.limit_in_bytes") == 0 &&
4820 memsw_limit != NULL) {
4821 /* lxc.cgroup.memory.memsw.limit_in_bytes is found
4822 * before lxc.cgroup.memory.limit_in_bytes, swap these
4823 * two items */
4824 item->elem = memsw_limit->elem;
4825 memsw_limit->elem = it->elem;
4826 }
4827 lxc_list_add_tail(result, item);
4828 }
4829
4830 return result;
4831 }
LXC mirror