]> git.proxmox.com Git - mirror_lxc.git/blob - src/lxc/lxccontainer.c
projects / mirror_lxc.git / blob
? search:
summary | shortlog | log | commit | commitdiff | tree
blame | history | raw | HEAD
Merge pull request #1943 from bhelm/master
[mirror_lxc.git] / src / lxc / lxccontainer.c
1 /* liblxcapi
2 *
3 * Copyright © 2012 Serge Hallyn <serge.hallyn@ubuntu.com>.
4 * Copyright © 2012 Canonical Ltd.
5 *
6 * This library is free software; you can redistribute it and/or
7 * modify it under the terms of the GNU Lesser General Public
8 * License as published by the Free Software Foundation; either
9 * version 2.1 of the License, or (at your option) any later version.
10
11 * This library is distributed in the hope that it will be useful,
12 * but WITHOUT ANY WARRANTY; without even the implied warranty of
13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
14 * Lesser General Public License for more details.
15
16 * You should have received a copy of the GNU Lesser General Public
17 * License along with this library; if not, write to the Free Software
18 * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
19 */
20
21 #ifndef _GNU_SOURCE
22 #define _GNU_SOURCE 1
23 #endif
24 #include <arpa/inet.h>
25 #include <dirent.h>
26 #include <errno.h>
27 #include <fcntl.h>
28 #include <grp.h>
29 #include <libgen.h>
30 #include <pthread.h>
31 #include <sched.h>
32 #include <stdarg.h>
33 #include <stdint.h>
34 #include <stdio.h>
35 #include <stdlib.h>
36 #include <sys/file.h>
37 #include <sys/mman.h>
38 #include <sys/mount.h>
39 #include <sys/stat.h>
40 #include <sys/syscall.h>
41 #include <sys/sysmacros.h>
42 #include <sys/types.h>
43 #include <sys/wait.h>
44 #include <unistd.h>
45
46 #include "../include/netns_ifaddrs.h"
47 #include "af_unix.h"
48 #include "api_extensions.h"
49 #include "attach.h"
50 #include "cgroup.h"
51 #include "commands.h"
52 #include "commands_utils.h"
53 #include "conf.h"
54 #include "config.h"
55 #include "confile.h"
56 #include "confile_utils.h"
57 #include "criu.h"
58 #include "error.h"
59 #include "initutils.h"
60 #include "log.h"
61 #include "lxc.h"
62 #include "lxccontainer.h"
63 #include "lxclock.h"
64 #include "monitor.h"
65 #include "namespace.h"
66 #include "network.h"
67 #include "parse.h"
68 #include "raw_syscalls.h"
69 #include "start.h"
70 #include "state.h"
71 #include "storage.h"
72 #include "storage/btrfs.h"
73 #include "storage/overlay.h"
74 #include "storage_utils.h"
75 #include "sync.h"
76 #include "syscall_wrappers.h"
77 #include "terminal.h"
78 #include "utils.h"
79 #include "version.h"
80
81 /* major()/minor() */
82 #ifdef MAJOR_IN_MKDEV
83 #include <sys/mkdev.h>
84 #endif
85
86 #if IS_BIONIC
87 #include <../include/lxcmntent.h>
88 #else
89 #include <mntent.h>
90 #endif
91
92 #ifndef HAVE_STRLCPY
93 #include "include/strlcpy.h"
94 #endif
95
96 /* Define faccessat() if missing from the C library */
97 #ifndef HAVE_FACCESSAT
98 static int faccessat(int __fd, const char *__file, int __type, int __flag)
99 {
100 #ifdef __NR_faccessat
101 return syscall(__NR_faccessat, __fd, __file, __type, __flag);
102 #else
103 errno = ENOSYS;
104 return -1;
105 #endif
106 }
107 #endif
108
109 lxc_log_define(lxccontainer, lxc);
110
111 static bool do_lxcapi_destroy(struct lxc_container *c);
112 static const char *lxcapi_get_config_path(struct lxc_container *c);
113 #define do_lxcapi_get_config_path(c) lxcapi_get_config_path(c)
114 static bool do_lxcapi_set_config_item(struct lxc_container *c, const char *key, const char *v);
115 static bool container_destroy(struct lxc_container *c,
116 struct lxc_storage *storage);
117 static bool get_snappath_dir(struct lxc_container *c, char *snappath);
118 static bool lxcapi_snapshot_destroy_all(struct lxc_container *c);
119 static bool do_lxcapi_save_config(struct lxc_container *c, const char *alt_file);
120
121 static bool config_file_exists(const char *lxcpath, const char *cname)
122 {
123 int ret;
124 size_t len;
125 char *fname;
126
127 /* $lxcpath + '/' + $cname + '/config' + \0 */
128 len = strlen(lxcpath) + strlen(cname) + 9;
129 fname = alloca(len);
130 ret = snprintf(fname, len, "%s/%s/config", lxcpath, cname);
131 if (ret < 0 || (size_t)ret >= len)
132 return false;
133
134 return file_exists(fname);
135 }
136
137 /* A few functions to help detect when a container creation failed. If a
138 * container creation was killed partway through, then trying to actually start
139 * that container could harm the host. We detect this by creating a 'partial'
140 * file under the container directory, and keeping an advisory lock. When
141 * container creation completes, we remove that file. When we load or try to
142 * start a container, if we find that file, without a flock, we remove the
143 * container.
144 */
145 static int ongoing_create(struct lxc_container *c)
146 {
147 int fd, ret;
148 size_t len;
149 char *path;
150 struct flock lk = {0};
151
152 len = strlen(c->config_path) + strlen(c->name) + 10;
153 path = alloca(len);
154 ret = snprintf(path, len, "%s/%s/partial", c->config_path, c->name);
155 if (ret < 0 || (size_t)ret >= len)
156 return -1;
157
158 fd = open(path, O_RDWR | O_CLOEXEC);
159 if (fd < 0) {
160 if (errno != ENOENT)
161 return -1;
162
163 return 0;
164 }
165
166 lk.l_type = F_WRLCK;
167 lk.l_whence = SEEK_SET;
168 /* F_OFD_GETLK requires that l_pid be set to 0 otherwise the kernel
169 * will EINVAL us.
170 */
171 lk.l_pid = 0;
172
173 ret = fcntl(fd, F_OFD_GETLK, &lk);
174 if (ret < 0 && errno == EINVAL) {
175 ret = flock(fd, LOCK_EX | LOCK_NB);
176 if (ret < 0 && errno == EWOULDBLOCK)
177 ret = 0;
178 }
179
180 close(fd);
181
182 /* F_OFD_GETLK will not send us back a pid so don't check it. */
183 if (ret == 0)
184 /* Create is still ongoing. */
185 return 1;
186
187 /* Create completed but partial is still there. */
188 return 2;
189 }
190
191 static int create_partial(struct lxc_container *c)
192 {
193 int fd, ret;
194 size_t len;
195 char *path;
196 struct flock lk = {0};
197
198 /* $lxcpath + '/' + $name + '/partial' + \0 */
199 len = strlen(c->config_path) + strlen(c->name) + 10;
200 path = alloca(len);
201 ret = snprintf(path, len, "%s/%s/partial", c->config_path, c->name);
202 if (ret < 0 || (size_t)ret >= len)
203 return -1;
204
205 fd = open(path, O_RDWR | O_CREAT | O_EXCL | O_CLOEXEC, 0000);
206 if (fd < 0)
207 return -1;
208
209 lk.l_type = F_WRLCK;
210 lk.l_whence = SEEK_SET;
211
212 ret = fcntl(fd, F_OFD_SETLKW, &lk);
213 if (ret < 0) {
214 if (errno == EINVAL) {
215 ret = flock(fd, LOCK_EX);
216 if (ret == 0)
217 return fd;
218 }
219
220 SYSERROR("Failed to lock partial file %s", path);
221 close(fd);
222 return -1;
223 }
224
225 return fd;
226 }
227
228 static void remove_partial(struct lxc_container *c, int fd)
229 {
230 int ret;
231 size_t len;
232 char *path;
233
234 close(fd);
235
236 /* $lxcpath + '/' + $name + '/partial' + \0 */
237 len = strlen(c->config_path) + strlen(c->name) + 10;
238 path = alloca(len);
239 ret = snprintf(path, len, "%s/%s/partial", c->config_path, c->name);
240 if (ret < 0 || (size_t)ret >= len)
241 return;
242
243 ret = unlink(path);
244 if (ret < 0)
245 SYSERROR("Failed to remove partial file %s", path);
246 }
247
248 /* LOCKING
249 * 1. container_mem_lock(c) protects the struct lxc_container from multiple threads.
250 * 2. container_disk_lock(c) protects the on-disk container data - in particular the
251 * container configuration file.
252 * The container_disk_lock also takes the container_mem_lock.
253 * 3. thread_mutex protects process data (ex: fd table) from multiple threads.
254 * NOTHING mutexes two independent programs with their own struct
255 * lxc_container for the same c->name, between API calls. For instance,
256 * c->config_read(); c->start(); Between those calls, data on disk
257 * could change (which shouldn't bother the caller unless for instance
258 * the rootfs get moved). c->config_read(); update; c->config_write();
259 * Two such updaters could race. The callers should therefore check their
260 * results. Trying to prevent that would necessarily expose us to deadlocks
261 * due to hung callers. So I prefer to keep the locks only within our own
262 * functions, not across functions.
263 *
264 * If you're going to clone while holding a lxccontainer, increment
265 * c->numthreads (under privlock) before forking. When deleting,
266 * decrement numthreads under privlock, then if it hits 0 you can delete.
267 * Do not ever use a lxccontainer whose numthreads you did not bump.
268 */
269 static void lxc_container_free(struct lxc_container *c)
270 {
271 if (!c)
272 return;
273
274 free(c->configfile);
275 c->configfile = NULL;
276
277 free(c->error_string);
278 c->error_string = NULL;
279
280 if (c->slock) {
281 lxc_putlock(c->slock);
282 c->slock = NULL;
283 }
284
285 if (c->privlock) {
286 lxc_putlock(c->privlock);
287 c->privlock = NULL;
288 }
289
290 free(c->name);
291 c->name = NULL;
292
293 if (c->lxc_conf) {
294 lxc_conf_free(c->lxc_conf);
295 c->lxc_conf = NULL;
296 }
297
298 free(c->config_path);
299 c->config_path = NULL;
300
301 free(c);
302 }
303
304 /* Consider the following case:
305 *
306 * |====================================================================|
307 * | freer | racing get()er |
308 * |====================================================================|
309 * | lxc_container_put() | lxc_container_get() |
310 * | \ lxclock(c->privlock) | c->numthreads < 1? (no) |
311 * | \ c->numthreads = 0 | \ lxclock(c->privlock) -> waits |
312 * | \ lxcunlock() | \ |
313 * | \ lxc_container_free() | \ lxclock() returns |
314 * | | \ c->numthreads < 1 -> return 0 |
315 * | \ \ (free stuff) | |
316 * | \ \ sem_destroy(privlock) | |
317 * |_______________________________|____________________________________|
318 *
319 * When the get()er checks numthreads the first time, one of the following
320 * is true:
321 * 1. freer has set numthreads = 0. get() returns 0
322 * 2. freer is between lxclock and setting numthreads to 0. get()er will
323 * sem_wait on privlock, get lxclock after freer() drops it, then see
324 * numthreads is 0 and exit without touching lxclock again..
325 * 3. freer has not yet locked privlock. If get()er runs first, then put()er
326 * will see --numthreads = 1 and not call lxc_container_free().
327 */
328
329 int lxc_container_get(struct lxc_container *c)
330 {
331 if (!c)
332 return 0;
333
334 /* If someone else has already started freeing the container, don't try
335 * to take the lock, which may be invalid.
336 */
337 if (c->numthreads < 1)
338 return 0;
339
340 if (container_mem_lock(c))
341 return 0;
342
343 /* Bail without trying to unlock, bc the privlock is now probably in
344 * freed memory.
345 */
346 if (c->numthreads < 1)
347 return 0;
348
349 c->numthreads++;
350 container_mem_unlock(c);
351
352 return 1;
353 }
354
355 int lxc_container_put(struct lxc_container *c)
356 {
357 if (!c)
358 return -1;
359
360 if (container_mem_lock(c))
361 return -1;
362
363 c->numthreads--;
364
365 if (c->numthreads < 1) {
366 container_mem_unlock(c);
367 lxc_container_free(c);
368 return 1;
369 }
370
371 container_mem_unlock(c);
372 return 0;
373 }
374
375 static bool do_lxcapi_is_defined(struct lxc_container *c)
376 {
377 int statret;
378 struct stat statbuf;
379 bool ret = false;
380
381 if (!c)
382 return false;
383
384 if (container_mem_lock(c))
385 return false;
386
387 if (!c->configfile)
388 goto on_error;
389
390 statret = stat(c->configfile, &statbuf);
391 if (statret != 0)
392 goto on_error;
393
394 ret = true;
395
396 on_error:
397 container_mem_unlock(c);
398 return ret;
399 }
400
401 #define WRAP_API(rettype, fnname) \
402 static rettype fnname(struct lxc_container *c) \
403 { \
404 rettype ret; \
405 bool reset_config = false; \
406 \
407 if (!current_config && c && c->lxc_conf) { \
408 current_config = c->lxc_conf; \
409 reset_config = true; \
410 } \
411 \
412 ret = do_##fnname(c); \
413 if (reset_config) \
414 current_config = NULL; \
415 \
416 return ret; \
417 }
418
419 #define WRAP_API_1(rettype, fnname, t1) \
420 static rettype fnname(struct lxc_container *c, t1 a1) \
421 { \
422 rettype ret; \
423 bool reset_config = false; \
424 \
425 if (!current_config && c && c->lxc_conf) { \
426 current_config = c->lxc_conf; \
427 reset_config = true; \
428 } \
429 \
430 ret = do_##fnname(c, a1); \
431 if (reset_config) \
432 current_config = NULL; \
433 \
434 return ret; \
435 }
436
437 #define WRAP_API_2(rettype, fnname, t1, t2) \
438 static rettype fnname(struct lxc_container *c, t1 a1, t2 a2) \
439 { \
440 rettype ret; \
441 bool reset_config = false; \
442 \
443 if (!current_config && c && c->lxc_conf) { \
444 current_config = c->lxc_conf; \
445 reset_config = true; \
446 } \
447 \
448 ret = do_##fnname(c, a1, a2); \
449 if (reset_config) \
450 current_config = NULL; \
451 \
452 return ret; \
453 }
454
455 #define WRAP_API_3(rettype, fnname, t1, t2, t3) \
456 static rettype fnname(struct lxc_container *c, t1 a1, t2 a2, t3 a3) \
457 { \
458 rettype ret; \
459 bool reset_config = false; \
460 \
461 if (!current_config && c && c->lxc_conf) { \
462 current_config = c->lxc_conf; \
463 reset_config = true; \
464 } \
465 \
466 ret = do_##fnname(c, a1, a2, a3); \
467 if (reset_config) \
468 current_config = NULL; \
469 \
470 return ret; \
471 }
472
473 #define WRAP_API_6(rettype, fnname, t1, t2, t3, t4, t5, t6) \
474 static rettype fnname(struct lxc_container *c, t1 a1, t2 a2, t3 a3, \
475 t4 a4, t5 a5, t6 a6) \
476 { \
477 rettype ret; \
478 bool reset_config = false; \
479 \
480 if (!current_config && c && c->lxc_conf) { \
481 current_config = c->lxc_conf; \
482 reset_config = true; \
483 } \
484 \
485 ret = do_##fnname(c, a1, a2, a3, a4, a5, a6); \
486 if (reset_config) \
487 current_config = NULL; \
488 \
489 return ret; \
490 }
491
492 WRAP_API(bool, lxcapi_is_defined)
493
494 static const char *do_lxcapi_state(struct lxc_container *c)
495 {
496 lxc_state_t s;
497
498 if (!c)
499 return NULL;
500
501 s = lxc_getstate(c->name, c->config_path);
502 return lxc_state2str(s);
503 }
504
505 WRAP_API(const char *, lxcapi_state)
506
507 static bool is_stopped(struct lxc_container *c)
508 {
509 lxc_state_t s;
510
511 s = lxc_getstate(c->name, c->config_path);
512 return (s == STOPPED);
513 }
514
515 static bool do_lxcapi_is_running(struct lxc_container *c)
516 {
517 if (!c)
518 return false;
519
520 return !is_stopped(c);
521 }
522
523 WRAP_API(bool, lxcapi_is_running)
524
525 static bool do_lxcapi_freeze(struct lxc_container *c)
526 {
527 int ret;
528
529 if (!c)
530 return false;
531
532 ret = lxc_freeze(c->lxc_conf, c->name, c->config_path);
533 if (ret < 0)
534 return false;
535
536 return true;
537 }
538
539 WRAP_API(bool, lxcapi_freeze)
540
541 static bool do_lxcapi_unfreeze(struct lxc_container *c)
542 {
543 int ret;
544
545 if (!c)
546 return false;
547
548 ret = lxc_unfreeze(c->lxc_conf, c->name, c->config_path);
549 if (ret < 0)
550 return false;
551
552 return true;
553 }
554
555 WRAP_API(bool, lxcapi_unfreeze)
556
557 static int do_lxcapi_console_getfd(struct lxc_container *c, int *ttynum, int *masterfd)
558 {
559 if (!c)
560 return -1;
561
562 return lxc_terminal_getfd(c, ttynum, masterfd);
563 }
564
565 WRAP_API_2(int, lxcapi_console_getfd, int *, int *)
566
567 static int lxcapi_console(struct lxc_container *c, int ttynum, int stdinfd,
568 int stdoutfd, int stderrfd, int escape)
569 {
570 int ret;
571
572 if (!c)
573 return -1;
574
575 current_config = c->lxc_conf;
576 ret = lxc_console(c, ttynum, stdinfd, stdoutfd, stderrfd, escape);
577 current_config = NULL;
578
579 return ret;
580 }
581
582 static int do_lxcapi_console_log(struct lxc_container *c, struct lxc_console_log *log)
583 {
584 int ret;
585
586 if (!c)
587 return -EINVAL;
588
589 ret = lxc_cmd_console_log(c->name, do_lxcapi_get_config_path(c), log);
590 if (ret < 0) {
591 if (ret == -ENODATA)
592 NOTICE("The console log is empty");
593 else if (ret == -EFAULT)
594 NOTICE("The container does not keep a console log");
595 else if (ret == -ENOENT)
596 NOTICE("The container does not keep a console log file");
597 else if (ret == -EIO)
598 NOTICE("Failed to write console log to log file");
599 else
600 ERROR("Failed to retrieve console log");
601 }
602
603 return ret;
604 }
605
606 WRAP_API_1(int, lxcapi_console_log, struct lxc_console_log *)
607
608 static pid_t do_lxcapi_init_pid(struct lxc_container *c)
609 {
610 if (!c)
611 return -1;
612
613 return lxc_cmd_get_init_pid(c->name, c->config_path);
614 }
615
616 WRAP_API(pid_t, lxcapi_init_pid)
617
618 static bool load_config_locked(struct lxc_container *c, const char *fname)
619 {
620 if (!c->lxc_conf)
621 c->lxc_conf = lxc_conf_init();
622
623 if (!c->lxc_conf)
624 return false;
625
626 if (lxc_config_read(fname, c->lxc_conf, false) != 0)
627 return false;
628
629 c->lxc_conf->name = c->name;
630 return true;
631 }
632
633 static bool do_lxcapi_load_config(struct lxc_container *c, const char *alt_file)
634 {
635 int lret;
636 const char *fname;
637 bool need_disklock = false, ret = false;
638
639 if (!c)
640 return false;
641
642 fname = c->configfile;
643
644 if (alt_file)
645 fname = alt_file;
646
647 if (!fname)
648 return false;
649
650 /* If we're reading something other than the container's config, we only
651 * need to lock the in-memory container. If loading the container's
652 * config file, take the disk lock.
653 */
654 if (strcmp(fname, c->configfile) == 0)
655 need_disklock = true;
656
657 if (need_disklock)
658 lret = container_disk_lock(c);
659 else
660 lret = container_mem_lock(c);
661 if (lret)
662 return false;
663
664 ret = load_config_locked(c, fname);
665
666 if (need_disklock)
667 container_disk_unlock(c);
668 else
669 container_mem_unlock(c);
670
671 return ret;
672 }
673
674 WRAP_API_1(bool, lxcapi_load_config, const char *)
675
676 static bool do_lxcapi_want_daemonize(struct lxc_container *c, bool state)
677 {
678 if (!c || !c->lxc_conf)
679 return false;
680
681 if (container_mem_lock(c))
682 return false;
683
684 c->daemonize = state;
685
686 container_mem_unlock(c);
687
688 return true;
689 }
690
691 WRAP_API_1(bool, lxcapi_want_daemonize, bool)
692
693 static bool do_lxcapi_want_close_all_fds(struct lxc_container *c, bool state)
694 {
695 if (!c || !c->lxc_conf)
696 return false;
697
698 if (container_mem_lock(c))
699 return false;
700
701 c->lxc_conf->close_all_fds = state;
702
703 container_mem_unlock(c);
704
705 return true;
706 }
707
708 WRAP_API_1(bool, lxcapi_want_close_all_fds, bool)
709
710 static bool do_lxcapi_wait(struct lxc_container *c, const char *state,
711 int timeout)
712 {
713 int ret;
714
715 if (!c)
716 return false;
717
718 ret = lxc_wait(c->name, state, timeout, c->config_path);
719 return ret == 0;
720 }
721
722 WRAP_API_2(bool, lxcapi_wait, const char *, int)
723
724 static bool am_single_threaded(void)
725 {
726 DIR *dir;
727 struct dirent *direntp;
728 int count = 0;
729
730 dir = opendir("/proc/self/task");
731 if (!dir)
732 return false;
733
734 while ((direntp = readdir(dir))) {
735 if (strcmp(direntp->d_name, ".") == 0)
736 continue;
737
738 if (strcmp(direntp->d_name, "..") == 0)
739 continue;
740
741 count++;
742 if (count > 1)
743 break;
744 }
745 closedir(dir);
746
747 return count == 1;
748 }
749
750 static void push_arg(char ***argp, char *arg, int *nargs)
751 {
752 char *copy;
753 char **argv;
754
755 copy = must_copy_string(arg);
756
757 do {
758 argv = realloc(*argp, (*nargs + 2) * sizeof(char *));
759 } while (!argv);
760
761 *argp = argv;
762 argv[*nargs] = copy;
763 (*nargs)++;
764 argv[*nargs] = NULL;
765 }
766
767 static char **split_init_cmd(const char *incmd)
768 {
769 size_t len, retlen;
770 char *copy, *p;
771 char **argv;
772 int nargs = 0;
773
774 if (!incmd)
775 return NULL;
776
777 len = strlen(incmd) + 1;
778 copy = alloca(len);
779 retlen = strlcpy(copy, incmd, len);
780 if (retlen >= len)
781 return NULL;
782
783 do {
784 argv = malloc(sizeof(char *));
785 } while (!argv);
786
787 argv[0] = NULL;
788 lxc_iterate_parts(p, copy, " ")
789 push_arg(&argv, p, &nargs);
790
791 if (nargs == 0) {
792 free(argv);
793 return NULL;
794 }
795
796 return argv;
797 }
798
799 static void free_init_cmd(char **argv)
800 {
801 int i = 0;
802
803 if (!argv)
804 return;
805
806 while (argv[i])
807 free(argv[i++]);
808
809 free(argv);
810 }
811
812 static int lxc_rcv_status(int state_socket)
813 {
814 int ret;
815 int state = -1;
816
817 again:
818 /* Receive container state. */
819 ret = lxc_abstract_unix_rcv_credential(state_socket, &state, sizeof(int));
820 if (ret <= 0) {
821 if (errno != EINTR)
822 return -1;
823
824 TRACE("Caught EINTR; retrying");
825 goto again;
826 }
827
828 return state;
829 }
830
831 static bool wait_on_daemonized_start(struct lxc_handler *handler, int pid)
832 {
833 int ret, state;
834
835 /* Close write end of the socket pair. */
836 close(handler->state_socket_pair[1]);
837 handler->state_socket_pair[1] = -1;
838
839 state = lxc_rcv_status(handler->state_socket_pair[0]);
840
841 /* Close read end of the socket pair. */
842 close(handler->state_socket_pair[0]);
843 handler->state_socket_pair[0] = -1;
844
845 /* The first child is going to fork() again and then exits. So we reap
846 * the first child here.
847 */
848 ret = wait_for_pid(pid);
849 if (ret < 0)
850 DEBUG("Failed waiting on first child %d", pid);
851 else
852 DEBUG("First child %d exited", pid);
853
854 if (state < 0) {
855 SYSERROR("Failed to receive the container state");
856 return false;
857 }
858
859 /* If we receive anything else then running we know that the container
860 * failed to start.
861 */
862 if (state != RUNNING) {
863 ERROR("Received container state \"%s\" instead of \"RUNNING\"",
864 lxc_state2str(state));
865 return false;
866 }
867
868 TRACE("Container is in \"RUNNING\" state");
869 return true;
870 }
871
872 static bool do_lxcapi_start(struct lxc_container *c, int useinit, char * const argv[])
873 {
874 int ret;
875 struct lxc_handler *handler;
876 struct lxc_conf *conf;
877 char *default_args[] = {
878 "/sbin/init",
879 NULL,
880 };
881 char **init_cmd = NULL;
882 int keepfds[3] = {-1, -1, -1};
883
884 /* container does exist */
885 if (!c)
886 return false;
887
888 /* If anything fails before we set error_num, we want an error in there.
889 */
890 c->error_num = 1;
891
892 /* Container has not been setup. */
893 if (!c->lxc_conf)
894 return false;
895
896 ret = ongoing_create(c);
897 if (ret < 0) {
898 ERROR("Failed checking for incomplete container creation");
899 return false;
900 } else if (ret == 1) {
901 ERROR("Ongoing container creation detected");
902 return false;
903 } else if (ret == 2) {
904 ERROR("Failed to create container");
905 do_lxcapi_destroy(c);
906 return false;
907 }
908
909 if (container_mem_lock(c))
910 return false;
911
912 conf = c->lxc_conf;
913
914 /* initialize handler */
915 handler = lxc_init_handler(c->name, conf, c->config_path, c->daemonize);
916
917 container_mem_unlock(c);
918 if (!handler)
919 return false;
920
921 if (!argv) {
922 if (useinit && conf->execute_cmd)
923 argv = init_cmd = split_init_cmd(conf->execute_cmd);
924 else
925 argv = init_cmd = split_init_cmd(conf->init_cmd);
926 }
927
928 /* ... otherwise use default_args. */
929 if (!argv) {
930 if (useinit) {
931 ERROR("No valid init detected");
932 lxc_free_handler(handler);
933 return false;
934 }
935 argv = default_args;
936 }
937
938 /* I'm not sure what locks we want here.Any? Is liblxc's locking enough
939 * here to protect the on disk container? We don't want to exclude
940 * things like lxc_info while the container is running.
941 */
942 if (c->daemonize) {
943 bool started;
944 char title[2048];
945 pid_t pid;
946
947 pid = fork();
948 if (pid < 0) {
949 free_init_cmd(init_cmd);
950 lxc_free_handler(handler);
951 return false;
952 }
953
954 /* first parent */
955 if (pid != 0) {
956 /* Set to NULL because we don't want father unlink
957 * the PID file, child will do the free and unlink.
958 */
959 c->pidfile = NULL;
960
961 /* Wait for container to tell us whether it started
962 * successfully.
963 */
964 started = wait_on_daemonized_start(handler, pid);
965
966 free_init_cmd(init_cmd);
967 lxc_free_handler(handler);
968 return started;
969 }
970
971 /* first child */
972
973 /* We don't really care if this doesn't print all the
974 * characters. All that it means is that the proctitle will be
975 * ugly. Similarly, we also don't care if setproctitle() fails.
976 */
977 ret = snprintf(title, sizeof(title), "[lxc monitor] %s %s", c->config_path, c->name);
978 if (ret > 0) {
979 ret = setproctitle(title);
980 if (ret < 0)
981 INFO("Failed to set process title to %s", title);
982 else
983 INFO("Set process title to %s", title);
984 }
985
986 /* We fork() a second time to be reparented to init. Like
987 * POSIX's daemon() function we change to "/" and redirect
988 * std{in,out,err} to /dev/null.
989 */
990 pid = fork();
991 if (pid < 0) {
992 SYSERROR("Failed to fork first child process");
993 _exit(EXIT_FAILURE);
994 }
995
996 /* second parent */
997 if (pid != 0) {
998 free_init_cmd(init_cmd);
999 lxc_free_handler(handler);
1000 _exit(EXIT_SUCCESS);
1001 }
1002
1003 /* second child */
1004
1005 /* change to / directory */
1006 ret = chdir("/");
1007 if (ret < 0) {
1008 SYSERROR("Failed to change to \"/\" directory");
1009 _exit(EXIT_FAILURE);
1010 }
1011
1012 keepfds[0] = handler->conf->maincmd_fd;
1013 keepfds[1] = handler->state_socket_pair[0];
1014 keepfds[2] = handler->state_socket_pair[1];
1015 ret = lxc_check_inherited(conf, true, keepfds,
1016 sizeof(keepfds) / sizeof(keepfds[0]));
1017 if (ret < 0)
1018 _exit(EXIT_FAILURE);
1019
1020 /* redirect std{in,out,err} to /dev/null */
1021 ret = null_stdfds();
1022 if (ret < 0) {
1023 ERROR("Failed to redirect std{in,out,err} to /dev/null");
1024 _exit(EXIT_FAILURE);
1025 }
1026
1027 /* become session leader */
1028 ret = setsid();
1029 if (ret < 0)
1030 TRACE("Process %d is already process group leader", lxc_raw_getpid());
1031 } else if (!am_single_threaded()) {
1032 ERROR("Cannot start non-daemonized container when threaded");
1033 free_init_cmd(init_cmd);
1034 lxc_free_handler(handler);
1035 return false;
1036 }
1037
1038 /* We need to write PID file after daemonize, so we always write the
1039 * right PID.
1040 */
1041 if (c->pidfile) {
1042 int ret, w;
1043 char pidstr[INTTYPE_TO_STRLEN(pid_t)];
1044
1045 w = snprintf(pidstr, sizeof(pidstr), "%d", lxc_raw_getpid());
1046 if (w < 0 || (size_t)w >= sizeof(pidstr)) {
1047 free_init_cmd(init_cmd);
1048 lxc_free_handler(handler);
1049
1050 SYSERROR("Failed to write monitor pid to \"%s\"", c->pidfile);
1051
1052 if (c->daemonize)
1053 _exit(EXIT_FAILURE);
1054
1055 return false;
1056 }
1057
1058 ret = lxc_write_to_file(c->pidfile, pidstr, w, false, 0600);
1059 if (ret < 0) {
1060 free_init_cmd(init_cmd);
1061 lxc_free_handler(handler);
1062
1063 SYSERROR("Failed to write monitor pid to \"%s\"", c->pidfile);
1064
1065 if (c->daemonize)
1066 _exit(EXIT_FAILURE);
1067
1068 return false;
1069 }
1070 }
1071
1072 conf->reboot = REBOOT_NONE;
1073
1074 /* Unshare the mount namespace if requested */
1075 if (conf->monitor_unshare) {
1076 ret = unshare(CLONE_NEWNS);
1077 if (ret < 0) {
1078 SYSERROR("Failed to unshare mount namespace");
1079 lxc_free_handler(handler);
1080 ret = 1;
1081 goto on_error;
1082 }
1083
1084 ret = mount(NULL, "/", NULL, MS_SLAVE|MS_REC, NULL);
1085 if (ret < 0) {
1086 SYSERROR("Failed to make / rslave at startup");
1087 lxc_free_handler(handler);
1088 ret = 1;
1089 goto on_error;
1090 }
1091 }
1092
1093 reboot:
1094 if (conf->reboot == REBOOT_INIT) {
1095 /* initialize handler */
1096 handler = lxc_init_handler(c->name, conf, c->config_path, c->daemonize);
1097 if (!handler) {
1098 ret = 1;
1099 goto on_error;
1100 }
1101 }
1102
1103 keepfds[0] = handler->conf->maincmd_fd;
1104 keepfds[1] = handler->state_socket_pair[0];
1105 keepfds[2] = handler->state_socket_pair[1];
1106 ret = lxc_check_inherited(conf, c->daemonize, keepfds,
1107 sizeof(keepfds) / sizeof(keepfds[0]));
1108 if (ret < 0) {
1109 lxc_free_handler(handler);
1110 ret = 1;
1111 goto on_error;
1112 }
1113
1114 if (useinit)
1115 ret = lxc_execute(c->name, argv, 1, handler, c->config_path,
1116 c->daemonize, &c->error_num);
1117 else
1118 ret = lxc_start(c->name, argv, handler, c->config_path,
1119 c->daemonize, &c->error_num);
1120
1121 if (conf->reboot == REBOOT_REQ) {
1122 INFO("Container requested reboot");
1123 conf->reboot = REBOOT_INIT;
1124 goto reboot;
1125 }
1126
1127 on_error:
1128 if (c->pidfile) {
1129 unlink(c->pidfile);
1130 free(c->pidfile);
1131 c->pidfile = NULL;
1132 }
1133 free_init_cmd(init_cmd);
1134
1135 if (c->daemonize && ret != 0)
1136 _exit(EXIT_FAILURE);
1137 else if (c->daemonize)
1138 _exit(EXIT_SUCCESS);
1139
1140 if (ret != 0)
1141 return false;
1142
1143 return true;
1144 }
1145
1146 static bool lxcapi_start(struct lxc_container *c, int useinit,
1147 char *const argv[])
1148 {
1149 bool ret;
1150
1151 current_config = c ? c->lxc_conf : NULL;
1152 ret = do_lxcapi_start(c, useinit, argv);
1153 current_config = NULL;
1154
1155 return ret;
1156 }
1157
1158 /* Note, there MUST be an ending NULL. */
1159 static bool lxcapi_startl(struct lxc_container *c, int useinit, ...)
1160 {
1161 va_list ap;
1162 char **inargs = NULL;
1163 bool bret = false;
1164
1165 /* container exists */
1166 if (!c)
1167 return false;
1168
1169 current_config = c->lxc_conf;
1170
1171 va_start(ap, useinit);
1172 inargs = lxc_va_arg_list_to_argv(ap, 0, 1);
1173 va_end(ap);
1174 if (!inargs)
1175 goto on_error;
1176
1177 /* pass NULL if no arguments were supplied */
1178 bret = do_lxcapi_start(c, useinit, *inargs ? inargs : NULL);
1179
1180 on_error:
1181 if (inargs) {
1182 char **arg;
1183
1184 for (arg = inargs; *arg; arg++)
1185 free(*arg);
1186 free(inargs);
1187 }
1188
1189 current_config = NULL;
1190
1191 return bret;
1192 }
1193
1194 static bool do_lxcapi_stop(struct lxc_container *c)
1195 {
1196 int ret;
1197
1198 if (!c)
1199 return false;
1200
1201 ret = lxc_cmd_stop(c->name, c->config_path);
1202
1203 return ret == 0;
1204 }
1205
1206 WRAP_API(bool, lxcapi_stop)
1207
1208 static int do_create_container_dir(const char *path, struct lxc_conf *conf)
1209 {
1210 int lasterr;
1211 size_t len;
1212 char *p;
1213 int ret = -1;
1214
1215 mode_t mask = umask(0002);
1216 ret = mkdir(path, 0770);
1217 lasterr = errno;
1218 umask(mask);
1219 errno = lasterr;
1220 if (ret) {
1221 if (errno != EEXIST)
1222 return -1;
1223
1224 ret = 0;
1225 }
1226
1227 len = strlen(path);
1228 p = alloca(len + 1);
1229 (void)strlcpy(p, path, len + 1);
1230
1231 if (!lxc_list_empty(&conf->id_map)) {
1232 ret = chown_mapped_root(p, conf);
1233 if (ret < 0)
1234 ret = -1;
1235 }
1236
1237 return ret;
1238 }
1239
1240 /* Create the standard expected container dir. */
1241 static bool create_container_dir(struct lxc_container *c)
1242 {
1243 int ret;
1244 size_t len;
1245 char *s;
1246
1247 len = strlen(c->config_path) + strlen(c->name) + 2;
1248 s = malloc(len);
1249 if (!s)
1250 return false;
1251
1252 ret = snprintf(s, len, "%s/%s", c->config_path, c->name);
1253 if (ret < 0 || (size_t)ret >= len) {
1254 free(s);
1255 return false;
1256 }
1257
1258 ret = do_create_container_dir(s, c->lxc_conf);
1259 free(s);
1260
1261 return ret == 0;
1262 }
1263
1264 /* do_storage_create: thin wrapper around storage_create(). Like
1265 * storage_create(), it returns a mounted bdev on success, NULL on error.
1266 */
1267 static struct lxc_storage *do_storage_create(struct lxc_container *c,
1268 const char *type,
1269 struct bdev_specs *specs)
1270 {
1271 int ret;
1272 size_t len;
1273 char *dest;
1274 struct lxc_storage *bdev;
1275
1276 /* rootfs.path or lxcpath/lxcname/rootfs */
1277 if (c->lxc_conf->rootfs.path &&
1278 (access(c->lxc_conf->rootfs.path, F_OK) == 0)) {
1279 const char *rpath = c->lxc_conf->rootfs.path;
1280 len = strlen(rpath) + 1;
1281 dest = alloca(len);
1282 ret = snprintf(dest, len, "%s", rpath);
1283 } else {
1284 const char *lxcpath = do_lxcapi_get_config_path(c);
1285 len = strlen(c->name) + strlen(lxcpath) + 9;
1286 dest = alloca(len);
1287 ret = snprintf(dest, len, "%s/%s/rootfs", lxcpath, c->name);
1288 }
1289 if (ret < 0 || (size_t)ret >= len)
1290 return NULL;
1291
1292 bdev = storage_create(dest, type, c->name, specs);
1293 if (!bdev) {
1294 ERROR("Failed to create \"%s\" storage", type);
1295 return NULL;
1296 }
1297
1298 if (!c->set_config_item(c, "lxc.rootfs.path", bdev->src)) {
1299 ERROR("Failed to set \"lxc.rootfs.path = %s\"", bdev->src);
1300 return NULL;
1301 }
1302
1303 /* If we are not root, chown the rootfs dir to root in the target user
1304 * namespace.
1305 */
1306 ret = geteuid();
1307 if (ret != 0 || (c->lxc_conf && !lxc_list_empty(&c->lxc_conf->id_map))) {
1308 ret = chown_mapped_root(bdev->dest, c->lxc_conf);
1309 if (ret < 0) {
1310 ERROR("Error chowning \"%s\" to container root", bdev->dest);
1311 suggest_default_idmap();
1312 storage_put(bdev);
1313 return NULL;
1314 }
1315 }
1316
1317 return bdev;
1318 }
1319
1320 static char *lxcbasename(char *path)
1321 {
1322 char *p;
1323
1324 p = path + strlen(path) - 1;
1325 while (*p != '/' && p > path)
1326 p--;
1327
1328 return p;
1329 }
1330
1331 static bool create_run_template(struct lxc_container *c, char *tpath,
1332 bool need_null_stdfds, char *const argv[])
1333 {
1334 int ret;
1335 pid_t pid;
1336
1337 if (!tpath)
1338 return true;
1339
1340 pid = fork();
1341 if (pid < 0) {
1342 SYSERROR("Failed to fork task for container creation template");
1343 return false;
1344 }
1345
1346 if (pid == 0) { /* child */
1347 int i, len;
1348 char *namearg, *patharg, *rootfsarg;
1349 char **newargv;
1350 int nargs = 0;
1351 struct lxc_storage *bdev = NULL;
1352 struct lxc_conf *conf = c->lxc_conf;
1353 uid_t euid;
1354
1355 if (need_null_stdfds) {
1356 ret = null_stdfds();
1357 if (ret < 0)
1358 _exit(EXIT_FAILURE);
1359 }
1360
1361 bdev = storage_init(c->lxc_conf);
1362 if (!bdev) {
1363 ERROR("Failed to initialize storage");
1364 _exit(EXIT_FAILURE);
1365 }
1366
1367 euid = geteuid();
1368 if (euid == 0) {
1369 ret = unshare(CLONE_NEWNS);
1370 if (ret < 0) {
1371 ERROR("Failed to unshare CLONE_NEWNS");
1372 _exit(EXIT_FAILURE);
1373 }
1374
1375 ret = detect_shared_rootfs();
1376 if (ret == 1) {
1377 ret = mount(NULL, "/", NULL, MS_SLAVE | MS_REC, NULL);
1378 if (ret < 0) {
1379 SYSERROR("Failed to make \"/\" rslave");
1380 ERROR("Continuing...");
1381 }
1382 }
1383 }
1384
1385 if (strcmp(bdev->type, "dir") != 0 && strcmp(bdev->type, "btrfs") != 0) {
1386 if (euid != 0) {
1387 ERROR("Unprivileged users can only create "
1388 "btrfs and directory-backed containers");
1389 _exit(EXIT_FAILURE);
1390 }
1391
1392 if (strcmp(bdev->type, "overlay") == 0 ||
1393 strcmp(bdev->type, "overlayfs") == 0) {
1394 /* If we create an overlay container we need to
1395 * rsync the contents into
1396 * <container-path>/<container-name>/rootfs.
1397 * However, the overlay mount function will
1398 * mount will mount
1399 * <container-path>/<container-name>/delta0
1400 * over
1401 * <container-path>/<container-name>/rootfs
1402 * which means we would rsync the rootfs into
1403 * the delta directory. That doesn't make sense
1404 * since the delta directory only exists to
1405 * record the differences to
1406 * <container-path>/<container-name>/rootfs. So
1407 * let's simply bind-mount here and then rsync
1408 * directly into
1409 * <container-path>/<container-name>/rootfs.
1410 */
1411 char *src;
1412
1413 src = ovl_get_rootfs(bdev->src, &(size_t){0});
1414 if (!src) {
1415 ERROR("Failed to get rootfs");
1416 _exit(EXIT_FAILURE);
1417 }
1418
1419 ret = mount(src, bdev->dest, "bind", MS_BIND | MS_REC, NULL);
1420 if (ret < 0) {
1421 ERROR("Failed to mount rootfs");
1422 _exit(EXIT_FAILURE);
1423 }
1424 } else {
1425 ret = bdev->ops->mount(bdev);
1426 if (ret < 0) {
1427 ERROR("Failed to mount rootfs");
1428 _exit(EXIT_FAILURE);
1429 }
1430 }
1431 } else { /* TODO come up with a better way here! */
1432 const char *src;
1433 free(bdev->dest);
1434 src = lxc_storage_get_path(bdev->src, bdev->type);
1435 bdev->dest = strdup(src);
1436 }
1437
1438 /* Create our new array, pre-pend the template name and base
1439 * args.
1440 */
1441 if (argv)
1442 for (nargs = 0; argv[nargs]; nargs++)
1443 ;
1444
1445 /* template, path, rootfs and name args */
1446 nargs += 4;
1447
1448 newargv = malloc(nargs * sizeof(*newargv));
1449 if (!newargv)
1450 _exit(EXIT_FAILURE);
1451 newargv[0] = lxcbasename(tpath);
1452
1453 /* --path */
1454 len = strlen(c->config_path) + strlen(c->name) + strlen("--path=") + 2;
1455 patharg = malloc(len);
1456 if (!patharg)
1457 _exit(EXIT_FAILURE);
1458
1459 ret = snprintf(patharg, len, "--path=%s/%s", c->config_path, c->name);
1460 if (ret < 0 || ret >= len)
1461 _exit(EXIT_FAILURE);
1462 newargv[1] = patharg;
1463
1464 /* --name */
1465 len = strlen("--name=") + strlen(c->name) + 1;
1466 namearg = malloc(len);
1467 if (!namearg)
1468 _exit(EXIT_FAILURE);
1469
1470 ret = snprintf(namearg, len, "--name=%s", c->name);
1471 if (ret < 0 || ret >= len)
1472 _exit(EXIT_FAILURE);
1473 newargv[2] = namearg;
1474
1475 /* --rootfs */
1476 len = strlen("--rootfs=") + 1 + strlen(bdev->dest);
1477 rootfsarg = malloc(len);
1478 if (!rootfsarg)
1479 _exit(EXIT_FAILURE);
1480
1481 ret = snprintf(rootfsarg, len, "--rootfs=%s", bdev->dest);
1482 if (ret < 0 || ret >= len)
1483 _exit(EXIT_FAILURE);
1484 newargv[3] = rootfsarg;
1485
1486 /* add passed-in args */
1487 if (argv)
1488 for (i = 4; i < nargs; i++)
1489 newargv[i] = argv[i - 4];
1490
1491 /* add trailing NULL */
1492 nargs++;
1493 newargv = realloc(newargv, nargs * sizeof(*newargv));
1494 if (!newargv)
1495 _exit(EXIT_FAILURE);
1496 newargv[nargs - 1] = NULL;
1497
1498 /* If we're running the template in a mapped userns, then we
1499 * prepend the template command with: lxc-usernsexec <-m map1>
1500 * ... <-m mapn> -- and we append "--mapped-uid x", where x is
1501 * the mapped uid for our geteuid()
1502 */
1503 if (!lxc_list_empty(&conf->id_map)) {
1504 int extraargs, hostuid_mapped, hostgid_mapped;
1505 char **n2;
1506 char txtuid[20], txtgid[20];
1507 struct lxc_list *it;
1508 struct id_map *map;
1509 int n2args = 1;
1510
1511 n2 = malloc(n2args * sizeof(*n2));
1512 if (!n2)
1513 _exit(EXIT_FAILURE);
1514
1515 newargv[0] = tpath;
1516 tpath = "lxc-usernsexec";
1517 n2[0] = "lxc-usernsexec";
1518
1519 lxc_list_for_each(it, &conf->id_map) {
1520 map = it->elem;
1521 n2args += 2;
1522 n2 = realloc(n2, n2args * sizeof(char *));
1523 if (!n2)
1524 _exit(EXIT_FAILURE);
1525
1526 n2[n2args - 2] = "-m";
1527 n2[n2args - 1] = malloc(200);
1528 if (!n2[n2args - 1])
1529 _exit(EXIT_FAILURE);
1530
1531 ret = snprintf(n2[n2args - 1], 200, "%c:%lu:%lu:%lu",
1532 map->idtype == ID_TYPE_UID ? 'u' : 'g',
1533 map->nsid, map->hostid, map->range);
1534 if (ret < 0 || ret >= 200)
1535 _exit(EXIT_FAILURE);
1536 }
1537
1538 hostuid_mapped = mapped_hostid(geteuid(), conf, ID_TYPE_UID);
1539 extraargs = hostuid_mapped >= 0 ? 1 : 3;
1540
1541 n2 = realloc(n2, (nargs + n2args + extraargs) * sizeof(char *));
1542 if (!n2)
1543 _exit(EXIT_FAILURE);
1544
1545 if (hostuid_mapped < 0) {
1546 hostuid_mapped = find_unmapped_nsid(conf, ID_TYPE_UID);
1547 n2[n2args++] = "-m";
1548 if (hostuid_mapped < 0) {
1549 ERROR("Failed to find free uid to map");
1550 _exit(EXIT_FAILURE);
1551 }
1552
1553 n2[n2args++] = malloc(200);
1554 if (!n2[n2args - 1]) {
1555 SYSERROR("out of memory");
1556 _exit(EXIT_FAILURE);
1557 }
1558
1559 ret = snprintf(n2[n2args - 1], 200, "u:%d:%d:1",
1560 hostuid_mapped, geteuid());
1561 if (ret < 0 || ret >= 200)
1562 _exit(EXIT_FAILURE);
1563 }
1564
1565 hostgid_mapped = mapped_hostid(getegid(), conf, ID_TYPE_GID);
1566 extraargs = hostgid_mapped >= 0 ? 1 : 3;
1567
1568 n2 = realloc(n2, (nargs + n2args + extraargs) * sizeof(char *));
1569 if (!n2)
1570 _exit(EXIT_FAILURE);
1571
1572 if (hostgid_mapped < 0) {
1573 hostgid_mapped = find_unmapped_nsid(conf, ID_TYPE_GID);
1574 n2[n2args++] = "-m";
1575 if (hostgid_mapped < 0) {
1576 ERROR("Failed to find free gid to map");
1577 _exit(EXIT_FAILURE);
1578 }
1579
1580 n2[n2args++] = malloc(200);
1581 if (!n2[n2args - 1]) {
1582 SYSERROR("out of memory");
1583 _exit(EXIT_FAILURE);
1584 }
1585
1586 ret = snprintf(n2[n2args - 1], 200, "g:%d:%d:1",
1587 hostgid_mapped, getegid());
1588 if (ret < 0 || ret >= 200)
1589 _exit(EXIT_FAILURE);
1590 }
1591
1592 n2[n2args++] = "--";
1593
1594 for (i = 0; i < nargs; i++)
1595 n2[i + n2args] = newargv[i];
1596 n2args += nargs;
1597
1598 /* Finally add "--mapped-uid $uid" to tell template what
1599 * to chown cached images to.
1600 */
1601 n2args += 4;
1602 n2 = realloc(n2, n2args * sizeof(char *));
1603 if (!n2)
1604 _exit(EXIT_FAILURE);
1605
1606 /* note n2[n2args-1] is NULL */
1607 n2[n2args - 5] = "--mapped-uid";
1608
1609 ret = snprintf(txtuid, 20, "%d", hostuid_mapped);
1610 if (ret < 0 || ret >= 20) {
1611 free(newargv);
1612 free(n2);
1613 _exit(EXIT_FAILURE);
1614 }
1615
1616 n2[n2args - 4] = txtuid;
1617 n2[n2args - 3] = "--mapped-gid";
1618
1619 ret = snprintf(txtgid, 20, "%d", hostgid_mapped);
1620 if (ret < 0 || ret >= 20) {
1621 free(newargv);
1622 free(n2);
1623 _exit(EXIT_FAILURE);
1624 }
1625
1626 n2[n2args - 2] = txtgid;
1627 n2[n2args - 1] = NULL;
1628 free(newargv);
1629 newargv = n2;
1630 }
1631
1632 execvp(tpath, newargv);
1633 SYSERROR("Failed to execute template %s", tpath);
1634 _exit(EXIT_FAILURE);
1635 }
1636
1637 ret = wait_for_pid(pid);
1638 if (ret != 0) {
1639 ERROR("Failed to create container from template");
1640 return false;
1641 }
1642
1643 return true;
1644 }
1645
1646 static bool prepend_lxc_header(char *path, const char *t, char *const argv[])
1647 {
1648 long flen;
1649 size_t len;
1650 char *contents;
1651 FILE *f;
1652 int ret = -1;
1653 #if HAVE_LIBGNUTLS
1654 int i;
1655 unsigned char md_value[SHA_DIGEST_LENGTH];
1656 char *tpath;
1657 #endif
1658
1659 f = fopen(path, "r");
1660 if (f == NULL)
1661 return false;
1662
1663 ret = fseek(f, 0, SEEK_END);
1664 if (ret < 0)
1665 goto out_error;
1666
1667 ret = -1;
1668 flen = ftell(f);
1669 if (flen < 0)
1670 goto out_error;
1671
1672 ret = fseek(f, 0, SEEK_SET);
1673 if (ret < 0)
1674 goto out_error;
1675
1676 ret = fseek(f, 0, SEEK_SET);
1677 if (ret < 0)
1678 goto out_error;
1679
1680 ret = -1;
1681 contents = malloc(flen + 1);
1682 if (!contents)
1683 goto out_error;
1684
1685 len = fread(contents, 1, flen, f);
1686 if (len != flen)
1687 goto out_free_contents;
1688
1689 contents[flen] = '\0';
1690
1691 ret = fclose(f);
1692 f = NULL;
1693 if (ret < 0)
1694 goto out_free_contents;
1695
1696 #if HAVE_LIBGNUTLS
1697 tpath = get_template_path(t);
1698 if (!tpath) {
1699 ERROR("Invalid template \"%s\" specified", t);
1700 goto out_free_contents;
1701 }
1702
1703 ret = sha1sum_file(tpath, md_value);
1704 if (ret < 0) {
1705 ERROR("Failed to get sha1sum of %s", tpath);
1706 free(tpath);
1707 goto out_free_contents;
1708 }
1709 free(tpath);
1710 #endif
1711
1712 f = fopen(path, "w");
1713 if (f == NULL) {
1714 SYSERROR("Reopening config for writing");
1715 free(contents);
1716 return false;
1717 }
1718
1719 fprintf(f, "# Template used to create this container: %s\n", t);
1720 if (argv) {
1721 fprintf(f, "# Parameters passed to the template:");
1722 while (*argv) {
1723 fprintf(f, " %s", *argv);
1724 argv++;
1725 }
1726 fprintf(f, "\n");
1727 }
1728
1729 #if HAVE_LIBGNUTLS
1730 fprintf(f, "# Template script checksum (SHA-1): ");
1731 for (i=0; i<SHA_DIGEST_LENGTH; i++)
1732 fprintf(f, "%02x", md_value[i]);
1733 fprintf(f, "\n");
1734 #endif
1735 fprintf(f, "# For additional config options, please look at lxc.container.conf(5)\n");
1736 fprintf(f, "\n# Uncomment the following line to support nesting containers:\n");
1737 fprintf(f, "#lxc.include = " LXCTEMPLATECONFIG "/nesting.conf\n");
1738 fprintf(f, "# (Be aware this has security implications)\n\n");
1739 if (fwrite(contents, 1, flen, f) != flen) {
1740 SYSERROR("Writing original contents");
1741 free(contents);
1742 fclose(f);
1743 return false;
1744 }
1745
1746 ret = 0;
1747
1748 out_free_contents:
1749 free(contents);
1750
1751 out_error:
1752 if (f) {
1753 int newret;
1754 newret = fclose(f);
1755 if (ret == 0)
1756 ret = newret;
1757 }
1758
1759 if (ret < 0) {
1760 SYSERROR("Error prepending header");
1761 return false;
1762 }
1763
1764 return true;
1765 }
1766
1767 static void lxcapi_clear_config(struct lxc_container *c)
1768 {
1769 if (!c || !c->lxc_conf)
1770 return;
1771
1772 lxc_conf_free(c->lxc_conf);
1773 c->lxc_conf = NULL;
1774 }
1775
1776 #define do_lxcapi_clear_config(c) lxcapi_clear_config(c)
1777
1778 /*
1779 * lxcapi_create:
1780 * create a container with the given parameters.
1781 * @c: container to be created. It has the lxcpath, name, and a starting
1782 * configuration already set
1783 * @t: the template to execute to instantiate the root filesystem and
1784 * adjust the configuration.
1785 * @bdevtype: backing store type to use. If NULL, dir will be used.
1786 * @specs: additional parameters for the backing store, i.e. LVM vg to
1787 * use.
1788 *
1789 * @argv: the arguments to pass to the template, terminated by NULL. If no
1790 * arguments, you can just pass NULL.
1791 */
1792 static bool do_lxcapi_create(struct lxc_container *c, const char *t,
1793 const char *bdevtype, struct bdev_specs *specs,
1794 int flags, char *const argv[])
1795 {
1796 int partial_fd;
1797 mode_t mask;
1798 pid_t pid;
1799 bool ret = false;
1800 char *tpath = NULL;
1801
1802 if (!c)
1803 return false;
1804
1805 if (t) {
1806 tpath = get_template_path(t);
1807 if (!tpath) {
1808 ERROR("Unknown template \"%s\"", t);
1809 goto out;
1810 }
1811 }
1812
1813 /* If a template is passed in, and the rootfs already is defined in the
1814 * container config and exists, then the caller is trying to create an
1815 * existing container. Return an error, but do NOT delete the container.
1816 */
1817 if (do_lxcapi_is_defined(c) && c->lxc_conf && c->lxc_conf->rootfs.path &&
1818 access(c->lxc_conf->rootfs.path, F_OK) == 0 && tpath) {
1819 ERROR("Container \"%s\" already exists in \"%s\"", c->name,
1820 c->config_path);
1821 goto free_tpath;
1822 }
1823
1824 if (!c->lxc_conf) {
1825 if (!do_lxcapi_load_config(c, lxc_global_config_value("lxc.default_config"))) {
1826 ERROR("Error loading default configuration file %s",
1827 lxc_global_config_value("lxc.default_config"));
1828 goto free_tpath;
1829 }
1830 }
1831
1832 if (!create_container_dir(c))
1833 goto free_tpath;
1834
1835 /* If both template and rootfs.path are set, template is setup as
1836 * rootfs.path. The container is already created if we have a config and
1837 * rootfs.path is accessible
1838 */
1839 if (!c->lxc_conf->rootfs.path && !tpath) {
1840 /* No template passed in and rootfs does not exist. */
1841 if (!c->save_config(c, NULL)) {
1842 ERROR("Failed to save initial config for \"%s\"", c->name);
1843 goto out;
1844 }
1845 ret = true;
1846 goto out;
1847 }
1848
1849 /* Rootfs passed into configuration, but does not exist. */
1850 if (c->lxc_conf->rootfs.path && access(c->lxc_conf->rootfs.path, F_OK) != 0)
1851 goto out;
1852
1853 if (do_lxcapi_is_defined(c) && c->lxc_conf->rootfs.path && !tpath) {
1854 /* Rootfs already existed, user just wanted to save the loaded
1855 * configuration.
1856 */
1857 if (!c->save_config(c, NULL))
1858 ERROR("Failed to save initial config for \"%s\"", c->name);
1859
1860 ret = true;
1861 goto out;
1862 }
1863
1864 /* Mark that this container is being created */
1865 partial_fd = create_partial(c);
1866 if (partial_fd < 0)
1867 goto out;
1868
1869 /* No need to get disk lock bc we have the partial lock. */
1870
1871 mask = umask(0022);
1872
1873 /* Create the storage.
1874 * Note we can't do this in the same task as we use to execute the
1875 * template because of the way zfs works.
1876 * After you 'zfs create', zfs mounts the fs only in the initial
1877 * namespace.
1878 */
1879 pid = fork();
1880 if (pid < 0) {
1881 SYSERROR("Failed to fork task for container creation template");
1882 goto out_unlock;
1883 }
1884
1885 if (pid == 0) { /* child */
1886 struct lxc_storage *bdev = NULL;
1887
1888 bdev = do_storage_create(c, bdevtype, specs);
1889 if (!bdev) {
1890 ERROR("Failed to create %s storage for %s",
1891 bdevtype ? bdevtype : "(none)", c->name);
1892 _exit(EXIT_FAILURE);
1893 }
1894
1895 /* Save config file again to store the new rootfs location. */
1896 if (!do_lxcapi_save_config(c, NULL)) {
1897 ERROR("Failed to save initial config for %s", c->name);
1898 /* Parent task won't see the storage driver in the
1899 * config so we delete it.
1900 */
1901 bdev->ops->umount(bdev);
1902 bdev->ops->destroy(bdev);
1903 _exit(EXIT_FAILURE);
1904 }
1905
1906 _exit(EXIT_SUCCESS);
1907 }
1908
1909 if (wait_for_pid(pid) != 0)
1910 goto out_unlock;
1911
1912 /* Reload config to get the rootfs. */
1913 lxc_conf_free(c->lxc_conf);
1914 c->lxc_conf = NULL;
1915
1916 if (!load_config_locked(c, c->configfile))
1917 goto out_unlock;
1918
1919 if (!create_run_template(c, tpath, !!(flags & LXC_CREATE_QUIET), argv))
1920 goto out_unlock;
1921
1922 /* Now clear out the lxc_conf we have, reload from the created
1923 * container.
1924 */
1925 do_lxcapi_clear_config(c);
1926
1927 if (t) {
1928 if (!prepend_lxc_header(c->configfile, tpath, argv)) {
1929 ERROR("Failed to prepend header to config file");
1930 goto out_unlock;
1931 }
1932 }
1933
1934 ret = load_config_locked(c, c->configfile);
1935
1936 out_unlock:
1937 umask(mask);
1938 remove_partial(c, partial_fd);
1939
1940 out:
1941 if (!ret)
1942 container_destroy(c, NULL);
1943
1944 free_tpath:
1945 free(tpath);
1946 return ret;
1947 }
1948
1949 static bool lxcapi_create(struct lxc_container *c, const char *t,
1950 const char *bdevtype, struct bdev_specs *specs,
1951 int flags, char *const argv[])
1952 {
1953 bool ret;
1954
1955 current_config = c ? c->lxc_conf : NULL;
1956
1957 ret = do_lxcapi_create(c, t, bdevtype, specs, flags, argv);
1958 current_config = NULL;
1959 return ret;
1960 }
1961
1962 static bool do_lxcapi_reboot(struct lxc_container *c)
1963 {
1964 int ret;
1965 pid_t pid;
1966 int rebootsignal = SIGINT;
1967
1968 if (!c)
1969 return false;
1970
1971 if (!do_lxcapi_is_running(c))
1972 return false;
1973
1974 pid = do_lxcapi_init_pid(c);
1975 if (pid <= 0)
1976 return false;
1977
1978 if (c->lxc_conf && c->lxc_conf->rebootsignal)
1979 rebootsignal = c->lxc_conf->rebootsignal;
1980
1981 ret = kill(pid, rebootsignal);
1982 if (ret < 0) {
1983 WARN("Failed to send signal %d to pid %d", rebootsignal, pid);
1984 return false;
1985 }
1986
1987 return true;
1988 }
1989
1990 WRAP_API(bool, lxcapi_reboot)
1991
1992 static bool do_lxcapi_reboot2(struct lxc_container *c, int timeout)
1993 {
1994 int killret, ret;
1995 pid_t pid;
1996 int rebootsignal = SIGINT, state_client_fd = -1;
1997 lxc_state_t states[MAX_STATE] = {0};
1998
1999 if (!c)
2000 return false;
2001
2002 if (!do_lxcapi_is_running(c))
2003 return true;
2004
2005 pid = do_lxcapi_init_pid(c);
2006 if (pid <= 0)
2007 return true;
2008
2009 if (c->lxc_conf && c->lxc_conf->rebootsignal)
2010 rebootsignal = c->lxc_conf->rebootsignal;
2011
2012 /* Add a new state client before sending the shutdown signal so that we
2013 * don't miss a state.
2014 */
2015 if (timeout != 0) {
2016 states[RUNNING] = 2;
2017 ret = lxc_cmd_add_state_client(c->name, c->config_path, states,
2018 &state_client_fd);
2019 if (ret < 0)
2020 return false;
2021
2022 if (state_client_fd < 0)
2023 return false;
2024
2025 if (ret == RUNNING)
2026 return true;
2027
2028 if (ret < MAX_STATE)
2029 return false;
2030 }
2031
2032 /* Send reboot signal to container. */
2033 killret = kill(pid, rebootsignal);
2034 if (killret < 0) {
2035 if (state_client_fd >= 0)
2036 close(state_client_fd);
2037
2038 WARN("Failed to send signal %d to pid %d", rebootsignal, pid);
2039 return false;
2040 }
2041 TRACE("Sent signal %d to pid %d", rebootsignal, pid);
2042
2043 if (timeout == 0)
2044 return true;
2045
2046 ret = lxc_cmd_sock_rcv_state(state_client_fd, timeout);
2047 close(state_client_fd);
2048 if (ret < 0)
2049 return false;
2050
2051 TRACE("Received state \"%s\"", lxc_state2str(ret));
2052 if (ret != RUNNING)
2053 return false;
2054
2055 return true;
2056 }
2057
2058 WRAP_API_1(bool, lxcapi_reboot2, int)
2059
2060 static bool do_lxcapi_shutdown(struct lxc_container *c, int timeout)
2061 {
2062 int killret, ret;
2063 pid_t pid;
2064 int haltsignal = SIGPWR, state_client_fd = -EBADF;
2065 lxc_state_t states[MAX_STATE] = {0};
2066
2067 if (!c)
2068 return false;
2069
2070 if (!do_lxcapi_is_running(c))
2071 return true;
2072
2073 pid = do_lxcapi_init_pid(c);
2074 if (pid <= 0)
2075 return true;
2076
2077 /* Detect whether we should send SIGRTMIN + 3 (e.g. systemd). */
2078 if (c->lxc_conf && c->lxc_conf->haltsignal)
2079 haltsignal = c->lxc_conf->haltsignal;
2080 else if (task_blocks_signal(pid, (SIGRTMIN + 3)))
2081 haltsignal = (SIGRTMIN + 3);
2082
2083 /* Add a new state client before sending the shutdown signal so that we
2084 * don't miss a state.
2085 */
2086 if (timeout != 0) {
2087 states[STOPPED] = 1;
2088 ret = lxc_cmd_add_state_client(c->name, c->config_path, states,
2089 &state_client_fd);
2090 if (ret < 0)
2091 return false;
2092
2093 if (state_client_fd < 0)
2094 return false;
2095
2096 if (ret == STOPPED)
2097 return true;
2098
2099 if (ret < MAX_STATE)
2100 return false;
2101 }
2102
2103 /* Send shutdown signal to container. */
2104 killret = kill(pid, haltsignal);
2105 if (killret < 0) {
2106 if (state_client_fd >= 0)
2107 close(state_client_fd);
2108
2109 WARN("Failed to send signal %d to pid %d", haltsignal, pid);
2110 return false;
2111 }
2112 TRACE("Sent signal %d to pid %d", haltsignal, pid);
2113
2114 if (timeout == 0)
2115 return true;
2116
2117 ret = lxc_cmd_sock_rcv_state(state_client_fd, timeout);
2118 close(state_client_fd);
2119 if (ret < 0)
2120 return false;
2121
2122 TRACE("Received state \"%s\"", lxc_state2str(ret));
2123 if (ret != STOPPED)
2124 return false;
2125
2126 return true;
2127 }
2128
2129 WRAP_API_1(bool, lxcapi_shutdown, int)
2130
2131 static bool lxcapi_createl(struct lxc_container *c, const char *t,
2132 const char *bdevtype, struct bdev_specs *specs, int flags, ...)
2133 {
2134 bool bret = false;
2135 char **args = NULL;
2136 va_list ap;
2137
2138 if (!c)
2139 return false;
2140
2141 current_config = c->lxc_conf;
2142
2143 /*
2144 * since we're going to wait for create to finish, I don't think we
2145 * need to get a copy of the arguments.
2146 */
2147 va_start(ap, flags);
2148 args = lxc_va_arg_list_to_argv(ap, 0, 0);
2149 va_end(ap);
2150 if (!args) {
2151 ERROR("Failed to allocate memory");
2152 goto out;
2153 }
2154
2155 bret = do_lxcapi_create(c, t, bdevtype, specs, flags, args);
2156
2157 out:
2158 free(args);
2159 current_config = NULL;
2160 return bret;
2161 }
2162
2163 static void do_clear_unexp_config_line(struct lxc_conf *conf, const char *key)
2164 {
2165 if (!strcmp(key, "lxc.cgroup"))
2166 return clear_unexp_config_line(conf, key, true);
2167
2168 if (!strcmp(key, "lxc.network"))
2169 return clear_unexp_config_line(conf, key, true);
2170
2171 if (!strcmp(key, "lxc.net"))
2172 return clear_unexp_config_line(conf, key, true);
2173
2174 /* Clear a network with a specific index. */
2175 if (!strncmp(key, "lxc.net.", 8)) {
2176 int ret;
2177 const char *idx;
2178
2179 idx = key + 8;
2180 ret = lxc_safe_uint(idx, &(unsigned int){0});
2181 if (!ret)
2182 return clear_unexp_config_line(conf, key, true);
2183 }
2184
2185 if (!strcmp(key, "lxc.hook"))
2186 return clear_unexp_config_line(conf, key, true);
2187
2188 return clear_unexp_config_line(conf, key, false);
2189 }
2190
2191 static bool do_lxcapi_clear_config_item(struct lxc_container *c,
2192 const char *key)
2193 {
2194 int ret = 1;
2195 struct lxc_config_t *config;
2196
2197 if (!c || !c->lxc_conf)
2198 return false;
2199
2200 if (container_mem_lock(c))
2201 return false;
2202
2203 config = lxc_get_config(key);
2204 /* Verify that the config key exists and that it has a callback
2205 * implemented.
2206 */
2207 if (config && config->clr)
2208 ret = config->clr(key, c->lxc_conf, NULL);
2209
2210 if (!ret)
2211 do_clear_unexp_config_line(c->lxc_conf, key);
2212
2213 container_mem_unlock(c);
2214 return ret == 0;
2215 }
2216
2217 WRAP_API_1(bool, lxcapi_clear_config_item, const char *)
2218
2219 static inline bool enter_net_ns(struct lxc_container *c)
2220 {
2221 pid_t pid = do_lxcapi_init_pid(c);
2222
2223 if ((geteuid() != 0 || (c->lxc_conf && !lxc_list_empty(&c->lxc_conf->id_map))) &&
2224 (access("/proc/self/ns/user", F_OK) == 0))
2225 if (!switch_to_ns(pid, "user"))
2226 return false;
2227
2228 return switch_to_ns(pid, "net");
2229 }
2230
2231 /* Used by qsort and bsearch functions for comparing names. */
2232 static inline int string_cmp(char **first, char **second)
2233 {
2234 return strcmp(*first, *second);
2235 }
2236
2237 /* Used by qsort and bsearch functions for comparing container names. */
2238 static inline int container_cmp(struct lxc_container **first,
2239 struct lxc_container **second)
2240 {
2241 return strcmp((*first)->name, (*second)->name);
2242 }
2243
2244 static bool add_to_array(char ***names, char *cname, int pos)
2245 {
2246 char **newnames = realloc(*names, (pos+1) * sizeof(char *));
2247 if (!newnames) {
2248 ERROR("Out of memory");
2249 return false;
2250 }
2251
2252 *names = newnames;
2253 newnames[pos] = strdup(cname);
2254 if (!newnames[pos])
2255 return false;
2256
2257 /* Sort the array as we will use binary search on it. */
2258 qsort(newnames, pos + 1, sizeof(char *),
2259 (int (*)(const void *, const void *))string_cmp);
2260
2261 return true;
2262 }
2263
2264 static bool add_to_clist(struct lxc_container ***list, struct lxc_container *c,
2265 int pos, bool sort)
2266 {
2267 struct lxc_container **newlist = realloc(*list, (pos + 1) * sizeof(struct lxc_container *));
2268 if (!newlist) {
2269 ERROR("Out of memory");
2270 return false;
2271 }
2272
2273 *list = newlist;
2274 newlist[pos] = c;
2275
2276 /* Sort the array as we will use binary search on it. */
2277 if (sort)
2278 qsort(newlist, pos + 1, sizeof(struct lxc_container *),
2279 (int (*)(const void *, const void *))container_cmp);
2280
2281 return true;
2282 }
2283
2284 static char** get_from_array(char ***names, char *cname, int size)
2285 {
2286 return (char **)bsearch(&cname, *names, size, sizeof(char *), (int (*)(const void *, const void *))string_cmp);
2287 }
2288
2289 static bool array_contains(char ***names, char *cname, int size)
2290 {
2291 if(get_from_array(names, cname, size) != NULL)
2292 return true;
2293
2294 return false;
2295 }
2296
2297 static bool remove_from_array(char ***names, char *cname, int size)
2298 {
2299 char **result = get_from_array(names, cname, size);
2300 if (result != NULL) {
2301 free(result);
2302 return true;
2303 }
2304
2305 return false;
2306 }
2307
2308 static char **do_lxcapi_get_interfaces(struct lxc_container *c)
2309 {
2310 pid_t pid;
2311 int i, count = 0, pipefd[2];
2312 char **interfaces = NULL;
2313 char interface[IFNAMSIZ];
2314
2315 if (pipe2(pipefd, O_CLOEXEC) < 0)
2316 return NULL;
2317
2318 pid = fork();
2319 if (pid < 0) {
2320 SYSERROR("Failed to fork task to get interfaces information");
2321 close(pipefd[0]);
2322 close(pipefd[1]);
2323 return NULL;
2324 }
2325
2326 if (pid == 0) { /* child */
2327 int ret = 1, nbytes;
2328 struct netns_ifaddrs *interfaceArray = NULL, *tempIfAddr = NULL;
2329
2330 /* close the read-end of the pipe */
2331 close(pipefd[0]);
2332
2333 if (!enter_net_ns(c)) {
2334 SYSERROR("Failed to enter network namespace");
2335 goto out;
2336 }
2337
2338 /* Grab the list of interfaces */
2339 if (netns_getifaddrs(&interfaceArray, -1, &(bool){false})) {
2340 SYSERROR("Failed to get interfaces list");
2341 goto out;
2342 }
2343
2344 /* Iterate through the interfaces */
2345 for (tempIfAddr = interfaceArray; tempIfAddr != NULL;
2346 tempIfAddr = tempIfAddr->ifa_next) {
2347 nbytes = lxc_write_nointr(pipefd[1], tempIfAddr->ifa_name, IFNAMSIZ);
2348 if (nbytes < 0)
2349 goto out;
2350
2351 count++;
2352 }
2353
2354 ret = 0;
2355
2356 out:
2357 if (interfaceArray)
2358 netns_freeifaddrs(interfaceArray);
2359
2360 /* close the write-end of the pipe, thus sending EOF to the reader */
2361 close(pipefd[1]);
2362 _exit(ret);
2363 }
2364
2365 /* close the write-end of the pipe */
2366 close(pipefd[1]);
2367
2368 while (lxc_read_nointr(pipefd[0], &interface, IFNAMSIZ) == IFNAMSIZ) {
2369 interface[IFNAMSIZ - 1] = '\0';
2370
2371 if (array_contains(&interfaces, interface, count))
2372 continue;
2373
2374 if (!add_to_array(&interfaces, interface, count))
2375 ERROR("Failed to add \"%s\" to array", interface);
2376
2377 count++;
2378 }
2379
2380 if (wait_for_pid(pid) != 0) {
2381 for (i = 0; i < count; i++)
2382 free(interfaces[i]);
2383
2384 free(interfaces);
2385 interfaces = NULL;
2386 }
2387
2388 /* close the read-end of the pipe */
2389 close(pipefd[0]);
2390
2391 /* Append NULL to the array */
2392 if (interfaces)
2393 interfaces = (char **)lxc_append_null_to_array((void **)interfaces, count);
2394
2395 return interfaces;
2396 }
2397
2398 WRAP_API(char **, lxcapi_get_interfaces)
2399
2400 static char **do_lxcapi_get_ips(struct lxc_container *c, const char *interface,
2401 const char *family, int scope)
2402 {
2403 int i, ret;
2404 pid_t pid;
2405 int pipefd[2];
2406 char address[INET6_ADDRSTRLEN];
2407 int count = 0;
2408 char **addresses = NULL;
2409
2410 ret = pipe2(pipefd, O_CLOEXEC);
2411 if (ret < 0) {
2412 SYSERROR("Failed to create pipe");
2413 return NULL;
2414 }
2415
2416 pid = fork();
2417 if (pid < 0) {
2418 SYSERROR("Failed to create new process");
2419 close(pipefd[0]);
2420 close(pipefd[1]);
2421 return NULL;
2422 }
2423
2424 if (pid == 0) {
2425 ssize_t nbytes;
2426 char addressOutputBuffer[INET6_ADDRSTRLEN];
2427 int ret = 1;
2428 char *address = NULL;
2429 void *tempAddrPtr = NULL;
2430 struct netns_ifaddrs *interfaceArray = NULL, *tempIfAddr = NULL;
2431
2432 /* close the read-end of the pipe */
2433 close(pipefd[0]);
2434
2435 if (!enter_net_ns(c)) {
2436 SYSERROR("Failed to attach to network namespace");
2437 goto out;
2438 }
2439
2440 /* Grab the list of interfaces */
2441 if (netns_getifaddrs(&interfaceArray, -1, &(bool){false})) {
2442 SYSERROR("Failed to get interfaces list");
2443 goto out;
2444 }
2445
2446 /* Iterate through the interfaces */
2447 for (tempIfAddr = interfaceArray; tempIfAddr;
2448 tempIfAddr = tempIfAddr->ifa_next) {
2449 if (tempIfAddr->ifa_addr == NULL)
2450 continue;
2451
2452 #pragma GCC diagnostic push
2453 #pragma GCC diagnostic ignored "-Wcast-align"
2454
2455 if (tempIfAddr->ifa_addr->sa_family == AF_INET) {
2456 if (family && strcmp(family, "inet"))
2457 continue;
2458
2459 tempAddrPtr = &((struct sockaddr_in *)tempIfAddr->ifa_addr)->sin_addr;
2460 } else {
2461 if (family && strcmp(family, "inet6"))
2462 continue;
2463
2464 if (((struct sockaddr_in6 *)tempIfAddr->ifa_addr)->sin6_scope_id != scope)
2465 continue;
2466
2467 tempAddrPtr = &((struct sockaddr_in6 *)tempIfAddr->ifa_addr)->sin6_addr;
2468 }
2469
2470 #pragma GCC diagnostic pop
2471
2472 if (interface && strcmp(interface, tempIfAddr->ifa_name))
2473 continue;
2474 else if (!interface && strcmp("lo", tempIfAddr->ifa_name) == 0)
2475 continue;
2476
2477 address = (char *)inet_ntop(tempIfAddr->ifa_addr->sa_family,
2478 tempAddrPtr, addressOutputBuffer,
2479 sizeof(addressOutputBuffer));
2480 if (!address)
2481 continue;
2482
2483 nbytes = lxc_write_nointr(pipefd[1], address, INET6_ADDRSTRLEN);
2484 if (nbytes != INET6_ADDRSTRLEN) {
2485 SYSERROR("Failed to send ipv6 address \"%s\"",
2486 address);
2487 goto out;
2488 }
2489
2490 count++;
2491 }
2492
2493 ret = 0;
2494
2495 out:
2496 if (interfaceArray)
2497 netns_freeifaddrs(interfaceArray);
2498
2499 /* close the write-end of the pipe, thus sending EOF to the reader */
2500 close(pipefd[1]);
2501 _exit(ret);
2502 }
2503
2504 /* close the write-end of the pipe */
2505 close(pipefd[1]);
2506
2507 while (lxc_read_nointr(pipefd[0], &address, INET6_ADDRSTRLEN) == INET6_ADDRSTRLEN) {
2508 address[INET6_ADDRSTRLEN - 1] = '\0';
2509
2510 if (!add_to_array(&addresses, address, count))
2511 ERROR("PARENT: add_to_array failed");
2512
2513 count++;
2514 }
2515
2516 if (wait_for_pid(pid) != 0) {
2517 for (i = 0; i < count; i++)
2518 free(addresses[i]);
2519
2520 free(addresses);
2521 addresses = NULL;
2522 }
2523
2524 /* close the read-end of the pipe */
2525 close(pipefd[0]);
2526
2527 /* Append NULL to the array */
2528 if (addresses)
2529 addresses = (char **)lxc_append_null_to_array((void **)addresses, count);
2530
2531 return addresses;
2532 }
2533
2534 WRAP_API_3(char **, lxcapi_get_ips, const char *, const char *, int)
2535
2536 static int do_lxcapi_get_config_item(struct lxc_container *c, const char *key, char *retv, int inlen)
2537 {
2538 int ret = -1;
2539 struct lxc_config_t *config;
2540
2541 if (!c || !c->lxc_conf)
2542 return -1;
2543
2544 if (container_mem_lock(c))
2545 return -1;
2546
2547 config = lxc_get_config(key);
2548 /* Verify that the config key exists and that it has a callback
2549 * implemented.
2550 */
2551 if (config && config->get)
2552 ret = config->get(key, retv, inlen, c->lxc_conf, NULL);
2553
2554 container_mem_unlock(c);
2555 return ret;
2556 }
2557
2558 WRAP_API_3(int, lxcapi_get_config_item, const char *, char *, int)
2559
2560 static char* do_lxcapi_get_running_config_item(struct lxc_container *c, const char *key)
2561 {
2562 char *ret;
2563
2564 if (!c || !c->lxc_conf)
2565 return NULL;
2566
2567 if (container_mem_lock(c))
2568 return NULL;
2569
2570 ret = lxc_cmd_get_config_item(c->name, key, do_lxcapi_get_config_path(c));
2571 container_mem_unlock(c);
2572 return ret;
2573 }
2574
2575 WRAP_API_1(char *, lxcapi_get_running_config_item, const char *)
2576
2577 static int do_lxcapi_get_keys(struct lxc_container *c, const char *key, char *retv, int inlen)
2578 {
2579 int ret = -1;
2580
2581 /* List all config items. */
2582 if (!key)
2583 return lxc_list_config_items(retv, inlen);
2584
2585 if (!c || !c->lxc_conf)
2586 return -1;
2587
2588 if (container_mem_lock(c))
2589 return -1;
2590
2591 /* Support 'lxc.net.<idx>', i.e. 'lxc.net.0'
2592 * This is an intelligent result to show which keys are valid given the
2593 * type of nic it is.
2594 */
2595 if (strncmp(key, "lxc.net.", 8) == 0)
2596 ret = lxc_list_net(c->lxc_conf, key, retv, inlen);
2597 else
2598 ret = lxc_list_subkeys(c->lxc_conf, key, retv, inlen);
2599
2600 container_mem_unlock(c);
2601 return ret;
2602 }
2603
2604 WRAP_API_3(int, lxcapi_get_keys, const char *, char *, int)
2605
2606 static bool do_lxcapi_save_config(struct lxc_container *c, const char *alt_file)
2607 {
2608 int fd, lret;
2609 bool ret = false, need_disklock = false;
2610
2611 if (!alt_file)
2612 alt_file = c->configfile;
2613
2614 if (!alt_file)
2615 return false;
2616
2617 /* If we haven't yet loaded a config, load the stock config. */
2618 if (!c->lxc_conf) {
2619 if (!do_lxcapi_load_config(c, lxc_global_config_value("lxc.default_config"))) {
2620 ERROR("Error loading default configuration file %s "
2621 "while saving %s",
2622 lxc_global_config_value("lxc.default_config"),
2623 c->name);
2624 return false;
2625 }
2626 }
2627
2628 if (!create_container_dir(c))
2629 return false;
2630
2631 /* If we're writing to the container's config file, take the disk lock.
2632 * Otherwise just take the memlock to protect the struct lxc_container
2633 * while we're traversing it.
2634 */
2635 if (strcmp(c->configfile, alt_file) == 0)
2636 need_disklock = true;
2637
2638 if (need_disklock)
2639 lret = container_disk_lock(c);
2640 else
2641 lret = container_mem_lock(c);
2642 if (lret)
2643 return false;
2644
2645 fd = open(alt_file, O_WRONLY | O_CREAT | O_TRUNC | O_CLOEXEC,
2646 S_IRUSR | S_IWUSR | S_IRGRP | S_IWGRP);
2647 if (fd < 0)
2648 goto on_error;
2649
2650 lret = write_config(fd, c->lxc_conf);
2651 close(fd);
2652 if (lret < 0)
2653 goto on_error;
2654
2655 ret = true;
2656
2657 on_error:
2658 if (need_disklock)
2659 container_disk_unlock(c);
2660 else
2661 container_mem_unlock(c);
2662
2663 return ret;
2664 }
2665
2666 WRAP_API_1(bool, lxcapi_save_config, const char *)
2667
2668
2669 static bool mod_rdep(struct lxc_container *c0, struct lxc_container *c, bool inc)
2670 {
2671 FILE *f1;
2672 struct stat fbuf;
2673 void *buf = NULL;
2674 char *del = NULL;
2675 char path[PATH_MAX];
2676 char newpath[PATH_MAX];
2677 int fd, ret, n = 0, v = 0;
2678 bool bret = false;
2679 size_t len = 0, bytes = 0;
2680
2681 if (container_disk_lock(c0))
2682 return false;
2683
2684 ret = snprintf(path, PATH_MAX, "%s/%s/lxc_snapshots", c0->config_path, c0->name);
2685 if (ret < 0 || ret > PATH_MAX)
2686 goto out;
2687
2688 ret = snprintf(newpath, PATH_MAX, "%s\n%s\n", c->config_path, c->name);
2689 if (ret < 0 || ret > PATH_MAX)
2690 goto out;
2691
2692 /* If we find an lxc-snapshot file using the old format only listing the
2693 * number of snapshots we will keep using it. */
2694 f1 = fopen(path, "r");
2695 if (f1) {
2696 n = fscanf(f1, "%d", &v);
2697 fclose(f1);
2698 if (n == 1 && v == 0) {
2699 ret = remove(path);
2700 if (ret < 0)
2701 SYSERROR("Failed to remove \"%s\"", path);
2702
2703 n = 0;
2704 }
2705 }
2706
2707 if (n == 1) {
2708 v += inc ? 1 : -1;
2709 f1 = fopen(path, "w");
2710 if (!f1)
2711 goto out;
2712
2713 if (fprintf(f1, "%d\n", v) < 0) {
2714 ERROR("Error writing new snapshots value");
2715 fclose(f1);
2716 goto out;
2717 }
2718
2719 ret = fclose(f1);
2720 if (ret != 0) {
2721 SYSERROR("Error writing to or closing snapshots file");
2722 goto out;
2723 }
2724 } else {
2725 /* Here we know that we have or can use an lxc-snapshot file
2726 * using the new format. */
2727 if (inc) {
2728 f1 = fopen(path, "a");
2729 if (!f1)
2730 goto out;
2731
2732 if (fprintf(f1, "%s", newpath) < 0) {
2733 ERROR("Error writing new snapshots entry");
2734 ret = fclose(f1);
2735 if (ret != 0)
2736 SYSERROR("Error writing to or closing snapshots file");
2737 goto out;
2738 }
2739
2740 ret = fclose(f1);
2741 if (ret != 0) {
2742 SYSERROR("Error writing to or closing snapshots file");
2743 goto out;
2744 }
2745 } else if (!inc) {
2746 if ((fd = open(path, O_RDWR | O_CLOEXEC)) < 0)
2747 goto out;
2748
2749 if (fstat(fd, &fbuf) < 0) {
2750 close(fd);
2751 goto out;
2752 }
2753
2754 if (fbuf.st_size != 0) {
2755 buf = lxc_strmmap(NULL, fbuf.st_size, PROT_READ | PROT_WRITE, MAP_SHARED, fd, 0);
2756 if (buf == MAP_FAILED) {
2757 SYSERROR("Failed to create mapping %s", path);
2758 close(fd);
2759 goto out;
2760 }
2761
2762 len = strlen(newpath);
2763 while ((del = strstr((char *)buf, newpath))) {
2764 memmove(del, del + len, strlen(del) - len + 1);
2765 bytes += len;
2766 }
2767
2768 lxc_strmunmap(buf, fbuf.st_size);
2769 if (ftruncate(fd, fbuf.st_size - bytes) < 0) {
2770 SYSERROR("Failed to truncate file %s", path);
2771 close(fd);
2772 goto out;
2773 }
2774 }
2775
2776 close(fd);
2777 }
2778
2779 /* If the lxc-snapshot file is empty, remove it. */
2780 if (stat(path, &fbuf) < 0)
2781 goto out;
2782
2783 if (!fbuf.st_size) {
2784 ret = remove(path);
2785 if (ret < 0)
2786 SYSERROR("Failed to remove \"%s\"", path);
2787 }
2788 }
2789
2790 bret = true;
2791
2792 out:
2793 container_disk_unlock(c0);
2794 return bret;
2795 }
2796
2797 void mod_all_rdeps(struct lxc_container *c, bool inc)
2798 {
2799 struct lxc_container *p;
2800 char *lxcpath = NULL, *lxcname = NULL, path[PATH_MAX];
2801 size_t pathlen = 0, namelen = 0;
2802 FILE *f;
2803 int ret;
2804
2805 ret = snprintf(path, PATH_MAX, "%s/%s/lxc_rdepends",
2806 c->config_path, c->name);
2807 if (ret < 0 || ret >= PATH_MAX) {
2808 ERROR("Path name too long");
2809 return;
2810 }
2811
2812 f = fopen(path, "r");
2813 if (f == NULL)
2814 return;
2815
2816 while (getline(&lxcpath, &pathlen, f) != -1) {
2817 if (getline(&lxcname, &namelen, f) == -1) {
2818 ERROR("badly formatted file %s", path);
2819 goto out;
2820 }
2821
2822 remove_trailing_newlines(lxcpath);
2823 remove_trailing_newlines(lxcname);
2824
2825 if ((p = lxc_container_new(lxcname, lxcpath)) == NULL) {
2826 ERROR("Unable to find dependent container %s:%s",
2827 lxcpath, lxcname);
2828 continue;
2829 }
2830
2831 if (!mod_rdep(p, c, inc))
2832 ERROR("Failed to update snapshots file for %s:%s",
2833 lxcpath, lxcname);
2834
2835 lxc_container_put(p);
2836 }
2837
2838 out:
2839 free(lxcpath);
2840 free(lxcname);
2841 fclose(f);
2842 }
2843
2844 static bool has_fs_snapshots(struct lxc_container *c)
2845 {
2846 FILE *f;
2847 char path[PATH_MAX];
2848 int ret, v;
2849 struct stat fbuf;
2850 bool bret = false;
2851
2852 ret = snprintf(path, PATH_MAX, "%s/%s/lxc_snapshots", c->config_path,
2853 c->name);
2854 if (ret < 0 || ret > PATH_MAX)
2855 goto out;
2856
2857 /* If the file doesn't exist there are no snapshots. */
2858 if (stat(path, &fbuf) < 0)
2859 goto out;
2860
2861 v = fbuf.st_size;
2862 if (v != 0) {
2863 f = fopen(path, "r");
2864 if (!f)
2865 goto out;
2866
2867 ret = fscanf(f, "%d", &v);
2868 fclose(f);
2869 /* TODO: Figure out what to do with the return value of fscanf. */
2870 if (ret != 1)
2871 INFO("Container uses new lxc-snapshots format %s", path);
2872 }
2873
2874 bret = v != 0;
2875
2876 out:
2877 return bret;
2878 }
2879
2880 static bool has_snapshots(struct lxc_container *c)
2881 {
2882 char path[PATH_MAX];
2883 struct dirent *direntp;
2884 int count=0;
2885 DIR *dir;
2886
2887 if (!get_snappath_dir(c, path))
2888 return false;
2889
2890 dir = opendir(path);
2891 if (!dir)
2892 return false;
2893
2894 while ((direntp = readdir(dir))) {
2895 if (!strcmp(direntp->d_name, "."))
2896 continue;
2897
2898 if (!strcmp(direntp->d_name, ".."))
2899 continue;
2900 count++;
2901 break;
2902 }
2903
2904 closedir(dir);
2905 return count > 0;
2906 }
2907
2908 static bool do_destroy_container(struct lxc_conf *conf) {
2909 int ret;
2910
2911 if (am_guest_unpriv()) {
2912 ret = userns_exec_full(conf, storage_destroy_wrapper, conf,
2913 "storage_destroy_wrapper");
2914 if (ret < 0)
2915 return false;
2916
2917 return true;
2918 }
2919
2920 return storage_destroy(conf);
2921 }
2922
2923 static int lxc_rmdir_onedev_wrapper(void *data)
2924 {
2925 char *arg = (char *) data;
2926 return lxc_rmdir_onedev(arg, "snaps");
2927 }
2928
2929 static int lxc_unlink_exec_wrapper(void *data)
2930 {
2931 char *arg = data;
2932 return unlink(arg);
2933 }
2934
2935 static bool container_destroy(struct lxc_container *c,
2936 struct lxc_storage *storage)
2937 {
2938 const char *p1;
2939 size_t len;
2940 struct lxc_conf *conf;
2941 char *path = NULL;
2942 bool bret = false;
2943 int ret = 0;
2944
2945 if (!c || !do_lxcapi_is_defined(c))
2946 return false;
2947
2948 conf = c->lxc_conf;
2949 if (container_disk_lock(c))
2950 return false;
2951
2952 if (!is_stopped(c)) {
2953 /* We should queue some sort of error - in c->error_string? */
2954 ERROR("container %s is not stopped", c->name);
2955 goto out;
2956 }
2957
2958 if (conf && !lxc_list_empty(&conf->hooks[LXCHOOK_DESTROY])) {
2959 /* Start of environment variable setup for hooks */
2960 if (setenv("LXC_NAME", c->name, 1))
2961 SYSERROR("Failed to set environment variable for container name");
2962
2963 if (conf->rcfile && setenv("LXC_CONFIG_FILE", conf->rcfile, 1))
2964 SYSERROR("Failed to set environment variable for config path");
2965
2966 if (conf->rootfs.mount && setenv("LXC_ROOTFS_MOUNT", conf->rootfs.mount, 1))
2967 SYSERROR("Failed to set environment variable for rootfs mount");
2968
2969 if (conf->rootfs.path && setenv("LXC_ROOTFS_PATH", conf->rootfs.path, 1))
2970 SYSERROR("Failed to set environment variable for rootfs mount");
2971
2972 if (conf->console.path && setenv("LXC_CONSOLE", conf->console.path, 1))
2973 SYSERROR("Failed to set environment variable for console path");
2974
2975 if (conf->console.log_path && setenv("LXC_CONSOLE_LOGPATH", conf->console.log_path, 1))
2976 SYSERROR("Failed to set environment variable for console log");
2977 /* End of environment variable setup for hooks */
2978
2979 if (run_lxc_hooks(c->name, "destroy", conf, NULL)) {
2980 ERROR("Failed to execute clone hook for \"%s\"", c->name);
2981 goto out;
2982 }
2983 }
2984
2985 if (current_config && conf == current_config) {
2986 current_config = NULL;
2987
2988 if (conf->logfd != -1) {
2989 close(conf->logfd);
2990 conf->logfd = -1;
2991 }
2992 }
2993
2994 /* LXC is not managing the storage of the container. */
2995 if (conf && !conf->rootfs.managed)
2996 goto on_success;
2997
2998 if (conf && conf->rootfs.path && conf->rootfs.mount) {
2999 if (!do_destroy_container(conf)) {
3000 ERROR("Error destroying rootfs for %s", c->name);
3001 goto out;
3002 }
3003 INFO("Destroyed rootfs for %s", c->name);
3004 }
3005
3006 mod_all_rdeps(c, false);
3007
3008 p1 = do_lxcapi_get_config_path(c);
3009 /* strlen(p1)
3010 * +
3011 * /
3012 * +
3013 * strlen(c->name)
3014 * +
3015 * /
3016 * +
3017 * strlen("config") = 6
3018 * +
3019 * \0
3020 */
3021 len = strlen(p1) + 1 + strlen(c->name) + 1 + 6 + 1;
3022 path = malloc(len);
3023 if (!path) {
3024 ERROR("Failed to allocate memory");
3025 goto out;
3026 }
3027
3028 /* For an overlay container the rootfs is considered immutable and
3029 * cannot be removed when restoring from a snapshot.
3030 */
3031 if (storage && (!strcmp(storage->type, "overlay") ||
3032 !strcmp(storage->type, "overlayfs")) &&
3033 (storage->flags & LXC_STORAGE_INTERNAL_OVERLAY_RESTORE)) {
3034 ret = snprintf(path, len, "%s/%s/config", p1, c->name);
3035 if (ret < 0 || (size_t)ret >= len)
3036 goto out;
3037
3038 if (am_guest_unpriv())
3039 ret = userns_exec_1(conf, lxc_unlink_exec_wrapper, path,
3040 "lxc_unlink_exec_wrapper");
3041 else
3042 ret = unlink(path);
3043 if (ret < 0) {
3044 SYSERROR("Failed to destroy config file \"%s\" for \"%s\"",
3045 path, c->name);
3046 goto out;
3047 }
3048 INFO("Destroyed config file \"%s\" for \"%s\"", path, c->name);
3049
3050 bret = true;
3051 goto out;
3052 }
3053
3054 ret = snprintf(path, len, "%s/%s", p1, c->name);
3055 if (ret < 0 || (size_t)ret >= len)
3056 goto out;
3057
3058 if (am_guest_unpriv())
3059 ret = userns_exec_full(conf, lxc_rmdir_onedev_wrapper, path,
3060 "lxc_rmdir_onedev_wrapper");
3061 else
3062 ret = lxc_rmdir_onedev(path, "snaps");
3063 if (ret < 0) {
3064 ERROR("Failed to destroy directory \"%s\" for \"%s\"", path,
3065 c->name);
3066 goto out;
3067 }
3068 INFO("Destroyed directory \"%s\" for \"%s\"", path, c->name);
3069
3070 on_success:
3071 bret = true;
3072
3073 out:
3074 if (path)
3075 free(path);
3076
3077 container_disk_unlock(c);
3078 return bret;
3079 }
3080
3081 static bool do_lxcapi_destroy(struct lxc_container *c)
3082 {
3083 if (!c || !lxcapi_is_defined(c))
3084 return false;
3085
3086 if (c->lxc_conf && c->lxc_conf->rootfs.managed) {
3087 if (has_snapshots(c)) {
3088 ERROR("Container %s has snapshots; not removing", c->name);
3089 return false;
3090 }
3091
3092 if (has_fs_snapshots(c)) {
3093 ERROR("container %s has snapshots on its rootfs", c->name);
3094 return false;
3095 }
3096 }
3097
3098 return container_destroy(c, NULL);
3099 }
3100
3101 WRAP_API(bool, lxcapi_destroy)
3102
3103 static bool do_lxcapi_destroy_with_snapshots(struct lxc_container *c)
3104 {
3105 if (!c || !lxcapi_is_defined(c))
3106 return false;
3107
3108 if (!lxcapi_snapshot_destroy_all(c)) {
3109 ERROR("Error deleting all snapshots");
3110 return false;
3111 }
3112
3113 return lxcapi_destroy(c);
3114 }
3115
3116 WRAP_API(bool, lxcapi_destroy_with_snapshots)
3117
3118 int lxc_set_config_item_locked(struct lxc_conf *conf, const char *key,
3119 const char *v)
3120 {
3121 int ret;
3122 struct lxc_config_t *config;
3123 bool bret = true;
3124
3125 config = lxc_get_config(key);
3126 if (!config)
3127 return -EINVAL;
3128
3129 ret = config->set(key, v, conf, NULL);
3130 if (ret < 0)
3131 return -EINVAL;
3132
3133 if (lxc_config_value_empty(v))
3134 do_clear_unexp_config_line(conf, key);
3135 else
3136 bret = do_append_unexp_config_line(conf, key, v);
3137 if (!bret)
3138 return -ENOMEM;
3139
3140 return 0;
3141 }
3142
3143 static bool do_set_config_item_locked(struct lxc_container *c, const char *key,
3144 const char *v)
3145 {
3146 int ret;
3147
3148 if (!c->lxc_conf)
3149 c->lxc_conf = lxc_conf_init();
3150
3151 if (!c->lxc_conf)
3152 return false;
3153
3154 ret = lxc_set_config_item_locked(c->lxc_conf, key, v);
3155 if (ret < 0)
3156 return false;
3157
3158 return true;
3159 }
3160
3161 static bool do_lxcapi_set_config_item(struct lxc_container *c, const char *key, const char *v)
3162 {
3163 bool b = false;
3164
3165 if (!c)
3166 return false;
3167
3168 if (container_mem_lock(c))
3169 return false;
3170
3171 b = do_set_config_item_locked(c, key, v);
3172
3173 container_mem_unlock(c);
3174 return b;
3175 }
3176
3177 WRAP_API_2(bool, lxcapi_set_config_item, const char *, const char *)
3178
3179 static char *lxcapi_config_file_name(struct lxc_container *c)
3180 {
3181 if (!c || !c->configfile)
3182 return NULL;
3183
3184 return strdup(c->configfile);
3185 }
3186
3187 static const char *lxcapi_get_config_path(struct lxc_container *c)
3188 {
3189 if (!c || !c->config_path)
3190 return NULL;
3191
3192 return (const char *)(c->config_path);
3193 }
3194
3195 /*
3196 * not for export
3197 * Just recalculate the c->configfile based on the
3198 * c->config_path, which must be set.
3199 * The lxc_container must be locked or not yet public.
3200 */
3201 static bool set_config_filename(struct lxc_container *c)
3202 {
3203 char *newpath;
3204 int len, ret;
3205
3206 if (!c->config_path)
3207 return false;
3208
3209 /* $lxc_path + "/" + c->name + "/" + "config" + '\0' */
3210 len = strlen(c->config_path) + strlen(c->name) + strlen("config") + 3;
3211 newpath = malloc(len);
3212 if (!newpath)
3213 return false;
3214
3215 ret = snprintf(newpath, len, "%s/%s/config", c->config_path, c->name);
3216 if (ret < 0 || ret >= len) {
3217 fprintf(stderr, "Error printing out config file name\n");
3218 free(newpath);
3219 return false;
3220 }
3221
3222 free(c->configfile);
3223 c->configfile = newpath;
3224
3225 return true;
3226 }
3227
3228 static bool do_lxcapi_set_config_path(struct lxc_container *c, const char *path)
3229 {
3230 char *p;
3231 bool b = false;
3232 char *oldpath = NULL;
3233
3234 if (!c)
3235 return b;
3236
3237 if (container_mem_lock(c))
3238 return b;
3239
3240 p = strdup(path);
3241 if (!p) {
3242 ERROR("Out of memory setting new lxc path");
3243 goto err;
3244 }
3245
3246 b = true;
3247 if (c->config_path)
3248 oldpath = c->config_path;
3249 c->config_path = p;
3250
3251 /* Since we've changed the config path, we have to change the
3252 * config file name too */
3253 if (!set_config_filename(c)) {
3254 ERROR("Out of memory setting new config filename");
3255 b = false;
3256 free(c->config_path);
3257 c->config_path = oldpath;
3258 oldpath = NULL;
3259 }
3260
3261 err:
3262 free(oldpath);
3263 container_mem_unlock(c);
3264 return b;
3265 }
3266
3267 WRAP_API_1(bool, lxcapi_set_config_path, const char *)
3268
3269 static bool do_lxcapi_set_cgroup_item(struct lxc_container *c, const char *subsys, const char *value)
3270 {
3271 int ret;
3272 struct cgroup_ops *cgroup_ops;
3273
3274 if (!c)
3275 return false;
3276
3277 if (is_stopped(c))
3278 return false;
3279
3280 cgroup_ops = cgroup_init(c->lxc_conf);
3281 if (!cgroup_ops)
3282 return false;
3283
3284 ret = cgroup_ops->set(cgroup_ops, subsys, value, c->name, c->config_path);
3285
3286 cgroup_exit(cgroup_ops);
3287
3288 return ret == 0;
3289 }
3290
3291 WRAP_API_2(bool, lxcapi_set_cgroup_item, const char *, const char *)
3292
3293 static int do_lxcapi_get_cgroup_item(struct lxc_container *c, const char *subsys, char *retv, int inlen)
3294 {
3295 int ret;
3296 struct cgroup_ops *cgroup_ops;
3297
3298 if (!c)
3299 return -1;
3300
3301 if (is_stopped(c))
3302 return -1;
3303
3304 cgroup_ops = cgroup_init(c->lxc_conf);
3305 if (!cgroup_ops)
3306 return -1;
3307
3308 ret = cgroup_ops->get(cgroup_ops, subsys, retv, inlen, c->name,
3309 c->config_path);
3310
3311 cgroup_exit(cgroup_ops);
3312
3313 return ret;
3314 }
3315
3316 WRAP_API_3(int, lxcapi_get_cgroup_item, const char *, char *, int)
3317
3318 const char *lxc_get_global_config_item(const char *key)
3319 {
3320 return lxc_global_config_value(key);
3321 }
3322
3323 const char *lxc_get_version(void)
3324 {
3325 return LXC_VERSION;
3326 }
3327
3328 static int copy_file(const char *old, const char *new)
3329 {
3330 int in, out;
3331 ssize_t len, ret;
3332 char buf[8096];
3333 struct stat sbuf;
3334
3335 if (file_exists(new)) {
3336 ERROR("copy destination %s exists", new);
3337 return -1;
3338 }
3339
3340 ret = stat(old, &sbuf);
3341 if (ret < 0) {
3342 INFO("Error stat'ing %s", old);
3343 return -1;
3344 }
3345
3346 in = open(old, O_RDONLY);
3347 if (in < 0) {
3348 SYSERROR("Error opening original file %s", old);
3349 return -1;
3350 }
3351
3352 out = open(new, O_CREAT | O_EXCL | O_WRONLY, 0644);
3353 if (out < 0) {
3354 SYSERROR("Error opening new file %s", new);
3355 close(in);
3356 return -1;
3357 }
3358
3359 while (1) {
3360 len = lxc_read_nointr(in, buf, 8096);
3361 if (len < 0) {
3362 SYSERROR("Error reading old file %s", old);
3363 goto err;
3364 }
3365
3366 if (len == 0)
3367 break;
3368
3369 ret = lxc_write_nointr(out, buf, len);
3370 if (ret < len) { /* should we retry? */
3371 SYSERROR("Error: write to new file %s was interrupted", new);
3372 goto err;
3373 }
3374 }
3375
3376 close(in);
3377 close(out);
3378
3379 /* We set mode, but not owner/group. */
3380 ret = chmod(new, sbuf.st_mode);
3381 if (ret) {
3382 SYSERROR("Error setting mode on %s", new);
3383 return -1;
3384 }
3385
3386 return 0;
3387
3388 err:
3389 close(in);
3390 close(out);
3391 return -1;
3392 }
3393
3394 static int copyhooks(struct lxc_container *oldc, struct lxc_container *c)
3395 {
3396 int i, len, ret;
3397 struct lxc_list *it;
3398 char *cpath;
3399
3400 len = strlen(oldc->config_path) + strlen(oldc->name) + 3;
3401 cpath = alloca(len);
3402 ret = snprintf(cpath, len, "%s/%s/", oldc->config_path, oldc->name);
3403 if (ret < 0 || ret >= len)
3404 return -1;
3405
3406 for (i=0; i<NUM_LXC_HOOKS; i++) {
3407 lxc_list_for_each(it, &c->lxc_conf->hooks[i]) {
3408 char *hookname = it->elem;
3409 char *fname = strrchr(hookname, '/');
3410 char tmppath[PATH_MAX];
3411 if (!fname) /* relative path - we don't support, but maybe we should */
3412 return 0;
3413
3414 if (strncmp(hookname, cpath, len - 1) != 0) {
3415 /* this hook is public - ignore */
3416 continue;
3417 }
3418
3419 /* copy the script, and change the entry in confile */
3420 ret = snprintf(tmppath, PATH_MAX, "%s/%s/%s",
3421 c->config_path, c->name, fname+1);
3422 if (ret < 0 || ret >= PATH_MAX)
3423 return -1;
3424
3425 ret = copy_file(it->elem, tmppath);
3426 if (ret < 0)
3427 return -1;
3428
3429 free(it->elem);
3430
3431 it->elem = strdup(tmppath);
3432 if (!it->elem) {
3433 ERROR("out of memory copying hook path");
3434 return -1;
3435 }
3436 }
3437 }
3438
3439 if (!clone_update_unexp_hooks(c->lxc_conf, oldc->config_path,
3440 c->config_path, oldc->name, c->name)) {
3441 ERROR("Error saving new hooks in clone");
3442 return -1;
3443 }
3444
3445 do_lxcapi_save_config(c, NULL);
3446 return 0;
3447 }
3448
3449
3450 static int copy_fstab(struct lxc_container *oldc, struct lxc_container *c)
3451 {
3452 char newpath[PATH_MAX];
3453 char *oldpath = oldc->lxc_conf->fstab;
3454 int ret;
3455
3456 if (!oldpath)
3457 return 0;
3458
3459 clear_unexp_config_line(c->lxc_conf, "lxc.mount.fstab", false);
3460
3461 char *p = strrchr(oldpath, '/');
3462 if (!p)
3463 return -1;
3464
3465 ret = snprintf(newpath, PATH_MAX, "%s/%s%s",
3466 c->config_path, c->name, p);
3467 if (ret < 0 || ret >= PATH_MAX) {
3468 ERROR("error printing new path for %s", oldpath);
3469 return -1;
3470 }
3471
3472 if (file_exists(newpath)) {
3473 ERROR("error: fstab file %s exists", newpath);
3474 return -1;
3475 }
3476
3477 if (copy_file(oldpath, newpath) < 0) {
3478 ERROR("error: copying %s to %s", oldpath, newpath);
3479 return -1;
3480 }
3481
3482 free(c->lxc_conf->fstab);
3483
3484 c->lxc_conf->fstab = strdup(newpath);
3485 if (!c->lxc_conf->fstab) {
3486 ERROR("error: allocating pathname");
3487 return -1;
3488 }
3489
3490 if (!do_append_unexp_config_line(c->lxc_conf, "lxc.mount.fstab", newpath)) {
3491 ERROR("error saving new lxctab");
3492 return -1;
3493 }
3494
3495 return 0;
3496 }
3497
3498 static void copy_rdepends(struct lxc_container *c, struct lxc_container *c0)
3499 {
3500 char path0[PATH_MAX], path1[PATH_MAX];
3501 int ret;
3502
3503 ret = snprintf(path0, PATH_MAX, "%s/%s/lxc_rdepends", c0->config_path,
3504 c0->name);
3505 if (ret < 0 || ret >= PATH_MAX) {
3506 WARN("Error copying reverse dependencies");
3507 return;
3508 }
3509
3510 ret = snprintf(path1, PATH_MAX, "%s/%s/lxc_rdepends", c->config_path,
3511 c->name);
3512 if (ret < 0 || ret >= PATH_MAX) {
3513 WARN("Error copying reverse dependencies");
3514 return;
3515 }
3516
3517 if (copy_file(path0, path1) < 0) {
3518 INFO("Error copying reverse dependencies");
3519 return;
3520 }
3521 }
3522
3523 static bool add_rdepends(struct lxc_container *c, struct lxc_container *c0)
3524 {
3525 int ret;
3526 char path[PATH_MAX];
3527 FILE *f;
3528 bool bret;
3529
3530 ret = snprintf(path, PATH_MAX, "%s/%s/lxc_rdepends", c->config_path,
3531 c->name);
3532 if (ret < 0 || ret >= PATH_MAX)
3533 return false;
3534
3535 f = fopen(path, "a");
3536 if (!f)
3537 return false;
3538
3539 bret = true;
3540
3541 /* If anything goes wrong, just return an error. */
3542 if (fprintf(f, "%s\n%s\n", c0->config_path, c0->name) < 0)
3543 bret = false;
3544
3545 if (fclose(f) != 0)
3546 bret = false;
3547
3548 return bret;
3549 }
3550
3551 /*
3552 * If the fs natively supports snapshot clones with no penalty,
3553 * then default to those even if not requested.
3554 * Currently we only do this for btrfs.
3555 */
3556 bool should_default_to_snapshot(struct lxc_container *c0,
3557 struct lxc_container *c1)
3558 {
3559 int ret;
3560 size_t l0 = strlen(c0->config_path) + strlen(c0->name) + 2;
3561 size_t l1 = strlen(c1->config_path) + strlen(c1->name) + 2;
3562 char *p0 = alloca(l0 + 1);
3563 char *p1 = alloca(l1 + 1);
3564 char *rootfs = c0->lxc_conf->rootfs.path;
3565
3566 ret = snprintf(p0, l0, "%s/%s", c0->config_path, c0->name);
3567 if (ret < 0 || ret >= l0)
3568 return false;
3569
3570 ret = snprintf(p1, l1, "%s/%s", c1->config_path, c1->name);
3571 if (ret < 0 || ret >= l1)
3572 return false;
3573
3574 if (!is_btrfs_fs(p0) || !is_btrfs_fs(p1))
3575 return false;
3576
3577 if (is_btrfs_subvol(rootfs) <= 0)
3578 return false;
3579
3580 return btrfs_same_fs(p0, p1) == 0;
3581 }
3582
3583 static int copy_storage(struct lxc_container *c0, struct lxc_container *c,
3584 const char *newtype, int flags, const char *bdevdata,
3585 uint64_t newsize)
3586 {
3587 struct lxc_storage *bdev;
3588 bool need_rdep;
3589
3590 if (should_default_to_snapshot(c0, c))
3591 flags |= LXC_CLONE_SNAPSHOT;
3592
3593 bdev = storage_copy(c0, c->name, c->config_path, newtype, flags,
3594 bdevdata, newsize, &need_rdep);
3595 if (!bdev) {
3596 ERROR("Error copying storage.");
3597 return -1;
3598 }
3599
3600 /* Set new rootfs. */
3601 free(c->lxc_conf->rootfs.path);
3602 c->lxc_conf->rootfs.path = strdup(bdev->src);
3603 storage_put(bdev);
3604
3605 if (!c->lxc_conf->rootfs.path) {
3606 ERROR("Out of memory while setting storage path.");
3607 return -1;
3608 }
3609
3610 /* Append a new lxc.rootfs.path entry to the unexpanded config. */
3611 clear_unexp_config_line(c->lxc_conf, "lxc.rootfs.path", false);
3612 if (!do_append_unexp_config_line(c->lxc_conf, "lxc.rootfs.path",
3613 c->lxc_conf->rootfs.path)) {
3614 ERROR("Error saving new rootfs to cloned config.");
3615 return -1;
3616 }
3617
3618 if (flags & LXC_CLONE_SNAPSHOT)
3619 copy_rdepends(c, c0);
3620
3621 if (need_rdep) {
3622 if (!add_rdepends(c, c0))
3623 WARN("Error adding reverse dependency from %s to %s",
3624 c->name, c0->name);
3625 }
3626
3627 mod_all_rdeps(c, true);
3628
3629 return 0;
3630 }
3631
3632 struct clone_update_data {
3633 struct lxc_container *c0;
3634 struct lxc_container *c1;
3635 int flags;
3636 char **hookargs;
3637 };
3638
3639 static int clone_update_rootfs(struct clone_update_data *data)
3640 {
3641 struct lxc_container *c0 = data->c0;
3642 struct lxc_container *c = data->c1;
3643 int flags = data->flags;
3644 char **hookargs = data->hookargs;
3645 int ret = -1;
3646 char path[PATH_MAX];
3647 struct lxc_storage *bdev;
3648 FILE *fout;
3649 struct lxc_conf *conf = c->lxc_conf;
3650
3651 /* update hostname in rootfs */
3652 /* we're going to mount, so run in a clean namespace to simplify cleanup */
3653
3654 if (setgid(0) < 0) {
3655 ERROR("Failed to setgid to 0");
3656 return -1;
3657 }
3658
3659 if (setuid(0) < 0) {
3660 ERROR("Failed to setuid to 0");
3661 return -1;
3662 }
3663
3664 if (setgroups(0, NULL) < 0)
3665 WARN("Failed to clear groups");
3666
3667 if (unshare(CLONE_NEWNS) < 0)
3668 return -1;
3669
3670 bdev = storage_init(c->lxc_conf);
3671 if (!bdev)
3672 return -1;
3673
3674 if (strcmp(bdev->type, "dir") != 0) {
3675 if (unshare(CLONE_NEWNS) < 0) {
3676 ERROR("error unsharing mounts");
3677 storage_put(bdev);
3678 return -1;
3679 }
3680
3681 if (detect_shared_rootfs()) {
3682 if (mount(NULL, "/", NULL, MS_SLAVE|MS_REC, NULL)) {
3683 SYSERROR("Failed to make / rslave");
3684 ERROR("Continuing...");
3685 }
3686 }
3687
3688 if (bdev->ops->mount(bdev) < 0) {
3689 storage_put(bdev);
3690 return -1;
3691 }
3692 } else { /* TODO come up with a better way */
3693 free(bdev->dest);
3694 bdev->dest = strdup(bdev->src);
3695 }
3696
3697 if (!lxc_list_empty(&conf->hooks[LXCHOOK_CLONE])) {
3698 /* Start of environment variable setup for hooks */
3699 if (c0->name && setenv("LXC_SRC_NAME", c0->name, 1))
3700 SYSERROR("failed to set environment variable for source container name");
3701
3702 if (setenv("LXC_NAME", c->name, 1))
3703 SYSERROR("failed to set environment variable for container name");
3704
3705 if (conf->rcfile && setenv("LXC_CONFIG_FILE", conf->rcfile, 1))
3706 SYSERROR("failed to set environment variable for config path");
3707
3708 if (bdev->dest && setenv("LXC_ROOTFS_MOUNT", bdev->dest, 1))
3709 SYSERROR("failed to set environment variable for rootfs mount");
3710
3711 if (conf->rootfs.path && setenv("LXC_ROOTFS_PATH", conf->rootfs.path, 1))
3712 SYSERROR("failed to set environment variable for rootfs mount");
3713
3714 if (run_lxc_hooks(c->name, "clone", conf, hookargs)) {
3715 ERROR("Error executing clone hook for %s", c->name);
3716 storage_put(bdev);
3717 return -1;
3718 }
3719 }
3720
3721 if (!(flags & LXC_CLONE_KEEPNAME)) {
3722 ret = snprintf(path, PATH_MAX, "%s/etc/hostname", bdev->dest);
3723 storage_put(bdev);
3724
3725 if (ret < 0 || ret >= PATH_MAX)
3726 return -1;
3727
3728 if (!file_exists(path))
3729 return 0;
3730
3731 if (!(fout = fopen(path, "w"))) {
3732 SYSERROR("unable to open %s: ignoring", path);
3733 return 0;
3734 }
3735
3736 if (fprintf(fout, "%s", c->name) < 0) {
3737 fclose(fout);
3738 return -1;
3739 }
3740
3741 if (fclose(fout) < 0)
3742 return -1;
3743 } else {
3744 storage_put(bdev);
3745 }
3746
3747 return 0;
3748 }
3749
3750 static int clone_update_rootfs_wrapper(void *data)
3751 {
3752 struct clone_update_data *arg = (struct clone_update_data *) data;
3753 return clone_update_rootfs(arg);
3754 }
3755
3756 /*
3757 * We want to support:
3758 sudo lxc-clone -o o1 -n n1 -s -L|-fssize fssize -v|--vgname vgname \
3759 -p|--lvprefix lvprefix -t|--fstype fstype -B backingstore
3760
3761 -s [ implies overlay]
3762 -s -B overlay
3763
3764 only rootfs gets converted (copied/snapshotted) on clone.
3765 */
3766
3767 static int create_file_dirname(char *path, struct lxc_conf *conf)
3768 {
3769 char *p = strrchr(path, '/');
3770 int ret = -1;
3771
3772 if (!p)
3773 return -1;
3774
3775 *p = '\0';
3776 ret = do_create_container_dir(path, conf);
3777 *p = '/';
3778
3779 return ret;
3780 }
3781
3782 static struct lxc_container *do_lxcapi_clone(struct lxc_container *c, const char *newname,
3783 const char *lxcpath, int flags,
3784 const char *bdevtype, const char *bdevdata, uint64_t newsize,
3785 char **hookargs)
3786 {
3787 char newpath[PATH_MAX];
3788 int fd, ret;
3789 struct clone_update_data data;
3790 size_t saved_unexp_len;
3791 pid_t pid;
3792 int storage_copied = 0;
3793 char *origroot = NULL, *saved_unexp_conf = NULL;
3794 struct lxc_container *c2 = NULL;
3795
3796 if (!c || !do_lxcapi_is_defined(c))
3797 return NULL;
3798
3799 if (container_mem_lock(c))
3800 return NULL;
3801 if (!is_stopped(c) && !(flags & LXC_CLONE_ALLOW_RUNNING)) {
3802 ERROR("error: Original container (%s) is running. Use --allowrunning if you want to force a snapshot of the running container.", c->name);
3803 goto out;
3804 }
3805
3806 /* Make sure the container doesn't yet exist. */
3807 if (!newname)
3808 newname = c->name;
3809
3810 if (!lxcpath)
3811 lxcpath = do_lxcapi_get_config_path(c);
3812
3813 ret = snprintf(newpath, PATH_MAX, "%s/%s/config", lxcpath, newname);
3814 if (ret < 0 || ret >= PATH_MAX) {
3815 SYSERROR("clone: failed making config pathname");
3816 goto out;
3817 }
3818
3819 if (file_exists(newpath)) {
3820 ERROR("error: clone: %s exists", newpath);
3821 goto out;
3822 }
3823
3824 ret = create_file_dirname(newpath, c->lxc_conf);
3825 if (ret < 0 && errno != EEXIST) {
3826 ERROR("Error creating container dir for %s", newpath);
3827 goto out;
3828 }
3829
3830 /* Copy the configuration. Tweak it as needed. */
3831 if (c->lxc_conf->rootfs.path) {
3832 origroot = c->lxc_conf->rootfs.path;
3833 c->lxc_conf->rootfs.path = NULL;
3834 }
3835
3836 fd = open(newpath, O_WRONLY | O_CREAT | O_CLOEXEC,
3837 S_IRUSR | S_IWUSR | S_IRGRP | S_IWGRP);
3838 if (fd < 0) {
3839 SYSERROR("Failed to open \"%s\"", newpath);
3840 goto out;
3841 }
3842
3843 saved_unexp_conf = c->lxc_conf->unexpanded_config;
3844 saved_unexp_len = c->lxc_conf->unexpanded_len;
3845 c->lxc_conf->unexpanded_config = strdup(saved_unexp_conf);
3846 if (!c->lxc_conf->unexpanded_config) {
3847 close(fd);
3848 goto out;
3849 }
3850
3851 clear_unexp_config_line(c->lxc_conf, "lxc.rootfs.path", false);
3852 write_config(fd, c->lxc_conf);
3853 close(fd);
3854
3855 c->lxc_conf->rootfs.path = origroot;
3856
3857 free(c->lxc_conf->unexpanded_config);
3858 c->lxc_conf->unexpanded_config = saved_unexp_conf;
3859 saved_unexp_conf = NULL;
3860 c->lxc_conf->unexpanded_len = saved_unexp_len;
3861
3862 ret = snprintf(newpath, PATH_MAX, "%s/%s/rootfs", lxcpath, newname);
3863 if (ret < 0 || ret >= PATH_MAX) {
3864 SYSERROR("clone: failed making rootfs pathname");
3865 goto out;
3866 }
3867
3868 ret = mkdir(newpath, 0755);
3869 if (ret < 0) {
3870 /* For an overlay container the rootfs is considered immutable
3871 * and will not have been removed when restoring from a
3872 * snapshot.
3873 */
3874 if (errno != ENOENT &&
3875 !(flags & LXC_STORAGE_INTERNAL_OVERLAY_RESTORE)) {
3876 SYSERROR("Failed to create directory \"%s\"", newpath);
3877 goto out;
3878 }
3879 }
3880
3881 if (am_guest_unpriv()) {
3882 if (chown_mapped_root(newpath, c->lxc_conf) < 0) {
3883 ERROR("Error chowning %s to container root", newpath);
3884 goto out;
3885 }
3886 }
3887
3888 c2 = lxc_container_new(newname, lxcpath);
3889 if (!c2) {
3890 ERROR("clone: failed to create new container (%s %s)", newname,
3891 lxcpath);
3892 goto out;
3893 }
3894
3895 /* copy/snapshot rootfs's */
3896 ret = copy_storage(c, c2, bdevtype, flags, bdevdata, newsize);
3897 if (ret < 0)
3898 goto out;
3899
3900 /* update utsname */
3901 if (!(flags & LXC_CLONE_KEEPNAME)) {
3902 clear_unexp_config_line(c2->lxc_conf, "lxc.utsname", false);
3903 clear_unexp_config_line(c2->lxc_conf, "lxc.uts.name", false);
3904
3905 if (!do_set_config_item_locked(c2, "lxc.uts.name", newname)) {
3906 ERROR("Error setting new hostname");
3907 goto out;
3908 }
3909 }
3910
3911 /* copy hooks */
3912 ret = copyhooks(c, c2);
3913 if (ret < 0) {
3914 ERROR("error copying hooks");
3915 goto out;
3916 }
3917
3918 if (copy_fstab(c, c2) < 0) {
3919 ERROR("error copying fstab");
3920 goto out;
3921 }
3922
3923 /* update macaddrs */
3924 if (!(flags & LXC_CLONE_KEEPMACADDR)) {
3925 if (!network_new_hwaddrs(c2->lxc_conf)) {
3926 ERROR("Error updating mac addresses");
3927 goto out;
3928 }
3929 }
3930
3931 /* Update absolute paths for overlay mount directories. */
3932 if (ovl_update_abs_paths(c2->lxc_conf, c->config_path, c->name, lxcpath, newname) < 0)
3933 goto out;
3934
3935 /* We've now successfully created c2's storage, so clear it out if we
3936 * fail after this.
3937 */
3938 storage_copied = 1;
3939
3940 if (!c2->save_config(c2, NULL))
3941 goto out;
3942
3943 if ((pid = fork()) < 0) {
3944 SYSERROR("fork");
3945 goto out;
3946 }
3947
3948 if (pid > 0) {
3949 ret = wait_for_pid(pid);
3950 if (ret)
3951 goto out;
3952
3953 container_mem_unlock(c);
3954 return c2;
3955 }
3956
3957 data.c0 = c;
3958 data.c1 = c2;
3959 data.flags = flags;
3960 data.hookargs = hookargs;
3961
3962 if (am_guest_unpriv())
3963 ret = userns_exec_full(c->lxc_conf, clone_update_rootfs_wrapper,
3964 &data, "clone_update_rootfs_wrapper");
3965 else
3966 ret = clone_update_rootfs(&data);
3967 if (ret < 0)
3968 _exit(EXIT_FAILURE);
3969
3970 container_mem_unlock(c);
3971 _exit(EXIT_SUCCESS);
3972
3973 out:
3974 container_mem_unlock(c);
3975 if (c2) {
3976 if (!storage_copied)
3977 c2->lxc_conf->rootfs.path = NULL;
3978
3979 c2->destroy(c2);
3980 lxc_container_put(c2);
3981 }
3982
3983 return NULL;
3984 }
3985
3986 static struct lxc_container *lxcapi_clone(struct lxc_container *c, const char *newname,
3987 const char *lxcpath, int flags,
3988 const char *bdevtype, const char *bdevdata, uint64_t newsize,
3989 char **hookargs)
3990 {
3991 struct lxc_container * ret;
3992
3993 current_config = c ? c->lxc_conf : NULL;
3994 ret = do_lxcapi_clone(c, newname, lxcpath, flags, bdevtype, bdevdata, newsize, hookargs);
3995 current_config = NULL;
3996
3997 return ret;
3998 }
3999
4000 static bool do_lxcapi_rename(struct lxc_container *c, const char *newname)
4001 {
4002 struct lxc_storage *bdev;
4003 struct lxc_container *newc;
4004
4005 if (!c || !c->name || !c->config_path || !c->lxc_conf)
4006 return false;
4007
4008 if (has_fs_snapshots(c) || has_snapshots(c)) {
4009 ERROR("Renaming a container with snapshots is not supported");
4010 return false;
4011 }
4012
4013 bdev = storage_init(c->lxc_conf);
4014 if (!bdev) {
4015 ERROR("Failed to find original backing store type");
4016 return false;
4017 }
4018
4019 newc = lxcapi_clone(c, newname, c->config_path, LXC_CLONE_KEEPMACADDR, NULL, bdev->type, 0, NULL);
4020 storage_put(bdev);
4021 if (!newc) {
4022 lxc_container_put(newc);
4023 return false;
4024 }
4025
4026 if (newc && lxcapi_is_defined(newc))
4027 lxc_container_put(newc);
4028
4029 if (!container_destroy(c, NULL)) {
4030 ERROR("Could not destroy existing container %s", c->name);
4031 return false;
4032 }
4033
4034 return true;
4035 }
4036
4037 WRAP_API_1(bool, lxcapi_rename, const char *)
4038
4039 static int lxcapi_attach(struct lxc_container *c, lxc_attach_exec_t exec_function, void *exec_payload, lxc_attach_options_t *options, pid_t *attached_process)
4040 {
4041 int ret;
4042
4043 if (!c)
4044 return -1;
4045
4046 current_config = c->lxc_conf;
4047
4048 ret = lxc_attach(c->name, c->config_path, exec_function, exec_payload, options, attached_process);
4049 current_config = NULL;
4050 return ret;
4051 }
4052
4053 static int do_lxcapi_attach_run_wait(struct lxc_container *c, lxc_attach_options_t *options, const char *program, const char * const argv[])
4054 {
4055 lxc_attach_command_t command;
4056 pid_t pid;
4057 int r;
4058
4059 if (!c)
4060 return -1;
4061
4062 command.program = (char*)program;
4063 command.argv = (char**)argv;
4064
4065 r = lxc_attach(c->name, c->config_path, lxc_attach_run_command, &command, options, &pid);
4066 if (r < 0) {
4067 ERROR("ups");
4068 return r;
4069 }
4070
4071 return lxc_wait_for_pid_status(pid);
4072 }
4073
4074 static int lxcapi_attach_run_wait(struct lxc_container *c, lxc_attach_options_t *options, const char *program, const char * const argv[])
4075 {
4076 int ret;
4077
4078 current_config = c ? c->lxc_conf : NULL;
4079 ret = do_lxcapi_attach_run_wait(c, options, program, argv);
4080 current_config = NULL;
4081
4082 return ret;
4083 }
4084
4085 static int get_next_index(const char *lxcpath, char *cname)
4086 {
4087 char *fname;
4088 struct stat sb;
4089 int i = 0, ret;
4090
4091 fname = alloca(strlen(lxcpath) + 20);
4092
4093 while (1) {
4094 sprintf(fname, "%s/snap%d", lxcpath, i);
4095
4096 ret = stat(fname, &sb);
4097 if (ret != 0)
4098 return i;
4099
4100 i++;
4101 }
4102 }
4103
4104 static bool get_snappath_dir(struct lxc_container *c, char *snappath)
4105 {
4106 int ret;
4107
4108 /*
4109 * If the old style snapshot path exists, use it
4110 * /var/lib/lxc -> /var/lib/lxcsnaps
4111 */
4112 ret = snprintf(snappath, PATH_MAX, "%ssnaps", c->config_path);
4113 if (ret < 0 || ret >= PATH_MAX)
4114 return false;
4115
4116 if (dir_exists(snappath)) {
4117 ret = snprintf(snappath, PATH_MAX, "%ssnaps/%s", c->config_path, c->name);
4118 if (ret < 0 || ret >= PATH_MAX)
4119 return false;
4120
4121 return true;
4122 }
4123
4124 /*
4125 * Use the new style path
4126 * /var/lib/lxc -> /var/lib/lxc + c->name + /snaps + \0
4127 */
4128 ret = snprintf(snappath, PATH_MAX, "%s/%s/snaps", c->config_path, c->name);
4129 if (ret < 0 || ret >= PATH_MAX)
4130 return false;
4131
4132 return true;
4133 }
4134
4135 static int do_lxcapi_snapshot(struct lxc_container *c, const char *commentfile)
4136 {
4137 int i, flags, ret;
4138 time_t timer;
4139 struct tm tm_info;
4140 struct lxc_container *c2;
4141 char snappath[PATH_MAX], newname[20];
4142 char buffer[25];
4143 FILE *f;
4144
4145 if (!c || !lxcapi_is_defined(c))
4146 return -1;
4147
4148 if (!storage_can_backup(c->lxc_conf)) {
4149 ERROR("%s's backing store cannot be backed up", c->name);
4150 ERROR("Your container must use another backing store type");
4151 return -1;
4152 }
4153
4154 if (!get_snappath_dir(c, snappath))
4155 return -1;
4156
4157 i = get_next_index(snappath, c->name);
4158
4159 if (mkdir_p(snappath, 0755) < 0) {
4160 ERROR("Failed to create snapshot directory %s", snappath);
4161 return -1;
4162 }
4163
4164 ret = snprintf(newname, 20, "snap%d", i);
4165 if (ret < 0 || ret >= 20)
4166 return -1;
4167
4168 /*
4169 * We pass LXC_CLONE_SNAPSHOT to make sure that a rdepends file entry is
4170 * created in the original container
4171 */
4172 flags = LXC_CLONE_SNAPSHOT | LXC_CLONE_KEEPMACADDR | LXC_CLONE_KEEPNAME |
4173 LXC_CLONE_KEEPBDEVTYPE | LXC_CLONE_MAYBE_SNAPSHOT;
4174 if (storage_is_dir(c->lxc_conf)) {
4175 ERROR("Snapshot of directory-backed container requested");
4176 ERROR("Making a copy-clone. If you do want snapshots, then");
4177 ERROR("please create overlay clone first, snapshot that");
4178 ERROR("and keep the original container pristine");
4179 flags &= ~LXC_CLONE_SNAPSHOT | LXC_CLONE_MAYBE_SNAPSHOT;
4180 }
4181
4182 c2 = do_lxcapi_clone(c, newname, snappath, flags, NULL, NULL, 0, NULL);
4183 if (!c2) {
4184 ERROR("Failed to clone of %s:%s", c->config_path, c->name);
4185 return -1;
4186 }
4187
4188 lxc_container_put(c2);
4189
4190 /* Now write down the creation time. */
4191 time(&timer);
4192
4193 if (!localtime_r(&timer, &tm_info)) {
4194 ERROR("Failed to get localtime");
4195 return -1;
4196 }
4197
4198 strftime(buffer, 25, "%Y:%m:%d %H:%M:%S", &tm_info);
4199
4200 char *dfnam = alloca(strlen(snappath) + strlen(newname) + 5);
4201 sprintf(dfnam, "%s/%s/ts", snappath, newname);
4202 f = fopen(dfnam, "w");
4203 if (!f) {
4204 ERROR("Failed to open %s", dfnam);
4205 return -1;
4206 }
4207
4208 if (fprintf(f, "%s", buffer) < 0) {
4209 SYSERROR("Writing timestamp");
4210 fclose(f);
4211 return -1;
4212 }
4213
4214 ret = fclose(f);
4215 if (ret != 0) {
4216 SYSERROR("Writing timestamp");
4217 return -1;
4218 }
4219
4220 if (commentfile) {
4221 /* $p / $name / comment \0 */
4222 int len = strlen(snappath) + strlen(newname) + 10;
4223 char *path = alloca(len);
4224
4225 sprintf(path, "%s/%s/comment", snappath, newname);
4226 return copy_file(commentfile, path) < 0 ? -1 : i;
4227 }
4228
4229 return i;
4230 }
4231
4232 WRAP_API_1(int, lxcapi_snapshot, const char *)
4233
4234 static void lxcsnap_free(struct lxc_snapshot *s)
4235 {
4236 free(s->name);
4237 free(s->comment_pathname);
4238 free(s->timestamp);
4239 free(s->lxcpath);
4240 }
4241
4242 static char *get_snapcomment_path(char* snappath, char *name)
4243 {
4244 /* $snappath/$name/comment */
4245 int ret, len = strlen(snappath) + strlen(name) + 10;
4246 char *s = malloc(len);
4247
4248 if (s) {
4249 ret = snprintf(s, len, "%s/%s/comment", snappath, name);
4250 if (ret < 0 || ret >= len) {
4251 free(s);
4252 s = NULL;
4253 }
4254 }
4255
4256 return s;
4257 }
4258
4259 static char *get_timestamp(char* snappath, char *name)
4260 {
4261 char path[PATH_MAX], *s = NULL;
4262 int ret, len;
4263 FILE *fin;
4264
4265 ret = snprintf(path, PATH_MAX, "%s/%s/ts", snappath, name);
4266 if (ret < 0 || ret >= PATH_MAX)
4267 return NULL;
4268
4269 fin = fopen(path, "r");
4270 if (!fin)
4271 return NULL;
4272
4273 (void) fseek(fin, 0, SEEK_END);
4274 len = ftell(fin);
4275 (void) fseek(fin, 0, SEEK_SET);
4276 if (len > 0) {
4277 s = malloc(len+1);
4278 if (s) {
4279 s[len] = '\0';
4280 if (fread(s, 1, len, fin) != len) {
4281 SYSERROR("reading timestamp");
4282 free(s);
4283 s = NULL;
4284 }
4285 }
4286 }
4287
4288 fclose(fin);
4289 return s;
4290 }
4291
4292 static int do_lxcapi_snapshot_list(struct lxc_container *c, struct lxc_snapshot **ret_snaps)
4293 {
4294 char snappath[PATH_MAX], path2[PATH_MAX];
4295 int count = 0, ret;
4296 struct dirent *direntp;
4297 struct lxc_snapshot *snaps =NULL, *nsnaps;
4298 DIR *dir;
4299
4300 if (!c || !lxcapi_is_defined(c))
4301 return -1;
4302
4303 if (!get_snappath_dir(c, snappath)) {
4304 ERROR("path name too long");
4305 return -1;
4306 }
4307
4308 dir = opendir(snappath);
4309 if (!dir) {
4310 INFO("Failed to open %s - assuming no snapshots", snappath);
4311 return 0;
4312 }
4313
4314 while ((direntp = readdir(dir))) {
4315 if (!strcmp(direntp->d_name, "."))
4316 continue;
4317
4318 if (!strcmp(direntp->d_name, ".."))
4319 continue;
4320
4321 ret = snprintf(path2, PATH_MAX, "%s/%s/config", snappath, direntp->d_name);
4322 if (ret < 0 || ret >= PATH_MAX) {
4323 ERROR("pathname too long");
4324 goto out_free;
4325 }
4326
4327 if (!file_exists(path2))
4328 continue;
4329
4330 nsnaps = realloc(snaps, (count + 1)*sizeof(*snaps));
4331 if (!nsnaps) {
4332 SYSERROR("Out of memory");
4333 goto out_free;
4334 }
4335
4336 snaps = nsnaps;
4337 snaps[count].free = lxcsnap_free;
4338 snaps[count].name = strdup(direntp->d_name);
4339 if (!snaps[count].name)
4340 goto out_free;
4341
4342 snaps[count].lxcpath = strdup(snappath);
4343 if (!snaps[count].lxcpath) {
4344 free(snaps[count].name);
4345 goto out_free;
4346 }
4347
4348 snaps[count].comment_pathname = get_snapcomment_path(snappath, direntp->d_name);
4349 snaps[count].timestamp = get_timestamp(snappath, direntp->d_name);
4350 count++;
4351 }
4352
4353 if (closedir(dir))
4354 WARN("Failed to close directory");
4355
4356 *ret_snaps = snaps;
4357 return count;
4358
4359 out_free:
4360 if (snaps) {
4361 int i;
4362
4363 for (i=0; i<count; i++)
4364 lxcsnap_free(&snaps[i]);
4365
4366 free(snaps);
4367 }
4368
4369 if (closedir(dir))
4370 WARN("Failed to close directory");
4371
4372 return -1;
4373 }
4374
4375 WRAP_API_1(int, lxcapi_snapshot_list, struct lxc_snapshot **)
4376
4377 static bool do_lxcapi_snapshot_restore(struct lxc_container *c, const char *snapname, const char *newname)
4378 {
4379 char clonelxcpath[PATH_MAX];
4380 int flags = 0;
4381 struct lxc_container *snap, *rest;
4382 struct lxc_storage *bdev;
4383 bool b = false;
4384
4385 if (!c || !c->name || !c->config_path)
4386 return false;
4387
4388 if (has_fs_snapshots(c)) {
4389 ERROR("container rootfs has dependent snapshots");
4390 return false;
4391 }
4392
4393 bdev = storage_init(c->lxc_conf);
4394 if (!bdev) {
4395 ERROR("Failed to find original backing store type");
4396 return false;
4397 }
4398
4399 /* For an overlay container the rootfs is considered immutable
4400 * and cannot be removed when restoring from a snapshot. We pass this
4401 * internal flag along to communicate this to various parts of the
4402 * codebase.
4403 */
4404 if (!strcmp(bdev->type, "overlay") || !strcmp(bdev->type, "overlayfs"))
4405 bdev->flags |= LXC_STORAGE_INTERNAL_OVERLAY_RESTORE;
4406
4407 if (!newname)
4408 newname = c->name;
4409
4410 if (!get_snappath_dir(c, clonelxcpath)) {
4411 storage_put(bdev);
4412 return false;
4413 }
4414 /* how should we lock this? */
4415
4416 snap = lxc_container_new(snapname, clonelxcpath);
4417 if (!snap || !lxcapi_is_defined(snap)) {
4418 ERROR("Could not open snapshot %s", snapname);
4419
4420 if (snap)
4421 lxc_container_put(snap);
4422
4423 storage_put(bdev);
4424 return false;
4425 }
4426
4427 if (!strcmp(c->name, newname)) {
4428 if (!container_destroy(c, bdev)) {
4429 ERROR("Could not destroy existing container %s", newname);
4430 lxc_container_put(snap);
4431 storage_put(bdev);
4432 return false;
4433 }
4434 }
4435
4436 if (strcmp(bdev->type, "dir") != 0 && strcmp(bdev->type, "loop") != 0)
4437 flags = LXC_CLONE_SNAPSHOT | LXC_CLONE_MAYBE_SNAPSHOT;
4438
4439 if (!strcmp(bdev->type, "overlay") || !strcmp(bdev->type, "overlayfs"))
4440 flags |= LXC_STORAGE_INTERNAL_OVERLAY_RESTORE;
4441
4442 rest = lxcapi_clone(snap, newname, c->config_path, flags, bdev->type,
4443 NULL, 0, NULL);
4444 storage_put(bdev);
4445 if (rest && lxcapi_is_defined(rest))
4446 b = true;
4447
4448 if (rest)
4449 lxc_container_put(rest);
4450
4451 lxc_container_put(snap);
4452 return b;
4453 }
4454
4455 WRAP_API_2(bool, lxcapi_snapshot_restore, const char *, const char *)
4456
4457 static bool do_snapshot_destroy(const char *snapname, const char *clonelxcpath)
4458 {
4459 struct lxc_container *snap = NULL;
4460 bool bret = false;
4461
4462 snap = lxc_container_new(snapname, clonelxcpath);
4463 if (!snap) {
4464 ERROR("Could not find snapshot %s", snapname);
4465 goto err;
4466 }
4467
4468 if (!do_lxcapi_destroy(snap)) {
4469 ERROR("Could not destroy snapshot %s", snapname);
4470 goto err;
4471 }
4472
4473 bret = true;
4474
4475 err:
4476 if (snap)
4477 lxc_container_put(snap);
4478
4479 return bret;
4480 }
4481
4482 static bool remove_all_snapshots(const char *path)
4483 {
4484 DIR *dir;
4485 struct dirent *direntp;
4486 bool bret = true;
4487
4488 dir = opendir(path);
4489 if (!dir) {
4490 SYSERROR("opendir on snapshot path %s", path);
4491 return false;
4492 }
4493
4494 while ((direntp = readdir(dir))) {
4495 if (!strcmp(direntp->d_name, "."))
4496 continue;
4497
4498 if (!strcmp(direntp->d_name, ".."))
4499 continue;
4500
4501 if (!do_snapshot_destroy(direntp->d_name, path)) {
4502 bret = false;
4503 continue;
4504 }
4505 }
4506
4507 closedir(dir);
4508
4509 if (rmdir(path))
4510 SYSERROR("Error removing directory %s", path);
4511
4512 return bret;
4513 }
4514
4515 static bool do_lxcapi_snapshot_destroy(struct lxc_container *c, const char *snapname)
4516 {
4517 char clonelxcpath[PATH_MAX];
4518
4519 if (!c || !c->name || !c->config_path || !snapname)
4520 return false;
4521
4522 if (!get_snappath_dir(c, clonelxcpath))
4523 return false;
4524
4525 return do_snapshot_destroy(snapname, clonelxcpath);
4526 }
4527
4528 WRAP_API_1(bool, lxcapi_snapshot_destroy, const char *)
4529
4530 static bool do_lxcapi_snapshot_destroy_all(struct lxc_container *c)
4531 {
4532 char clonelxcpath[PATH_MAX];
4533
4534 if (!c || !c->name || !c->config_path)
4535 return false;
4536
4537 if (!get_snappath_dir(c, clonelxcpath))
4538 return false;
4539
4540 return remove_all_snapshots(clonelxcpath);
4541 }
4542
4543 WRAP_API(bool, lxcapi_snapshot_destroy_all)
4544
4545 static bool do_lxcapi_may_control(struct lxc_container *c)
4546 {
4547 if (!c)
4548 return false;
4549
4550 return lxc_try_cmd(c->name, c->config_path) == 0;
4551 }
4552
4553 WRAP_API(bool, lxcapi_may_control)
4554
4555 static bool do_add_remove_node(pid_t init_pid, const char *path, bool add,
4556 struct stat *st)
4557 {
4558 int ret;
4559 char *tmp;
4560 pid_t pid;
4561 char chrootpath[PATH_MAX];
4562 char *directory_path = NULL;
4563
4564 pid = fork();
4565 if (pid < 0) {
4566 SYSERROR("Failed to fork()");
4567 return false;
4568 }
4569
4570 if (pid) {
4571 ret = wait_for_pid(pid);
4572 if (ret != 0) {
4573 ERROR("Failed to create device node");
4574 return false;
4575 }
4576
4577 return true;
4578 }
4579
4580 /* prepare the path */
4581 ret = snprintf(chrootpath, PATH_MAX, "/proc/%d/root", init_pid);
4582 if (ret < 0 || ret >= PATH_MAX)
4583 return false;
4584
4585 ret = chroot(chrootpath);
4586 if (ret < 0)
4587 _exit(EXIT_FAILURE);
4588
4589 ret = chdir("/");
4590 if (ret < 0)
4591 _exit(EXIT_FAILURE);
4592
4593 /* remove path if it exists */
4594 ret = faccessat(AT_FDCWD, path, F_OK, AT_SYMLINK_NOFOLLOW);
4595 if(ret == 0) {
4596 ret = unlink(path);
4597 if (ret < 0) {
4598 SYSERROR("Failed to remove \"%s\"", path);
4599 _exit(EXIT_FAILURE);
4600 }
4601 }
4602
4603 if (!add)
4604 _exit(EXIT_SUCCESS);
4605
4606 /* create any missing directories */
4607 tmp = strdup(path);
4608 if (!tmp)
4609 _exit(EXIT_FAILURE);
4610
4611 directory_path = dirname(tmp);
4612 ret = mkdir_p(directory_path, 0755);
4613 if (ret < 0 && errno != EEXIST) {
4614 SYSERROR("Failed to create path \"%s\"", directory_path);
4615 free(tmp);
4616 _exit(EXIT_FAILURE);
4617 }
4618
4619 /* create the device node */
4620 ret = mknod(path, st->st_mode, st->st_rdev);
4621 free(tmp);
4622 if (ret < 0) {
4623 SYSERROR("Failed to create device node at \"%s\"", path);
4624 _exit(EXIT_FAILURE);
4625 }
4626
4627 _exit(EXIT_SUCCESS);
4628 }
4629
4630 static bool add_remove_device_node(struct lxc_container *c, const char *src_path, const char *dest_path, bool add)
4631 {
4632 int ret;
4633 struct stat st;
4634 char value[LXC_MAX_BUFFER];
4635 const char *p;
4636
4637 /* make sure container is running */
4638 if (!do_lxcapi_is_running(c)) {
4639 ERROR("container is not running");
4640 return false;
4641 }
4642
4643 /* use src_path if dest_path is NULL otherwise use dest_path */
4644 p = dest_path ? dest_path : src_path;
4645
4646 /* make sure we can access p */
4647 if(access(p, F_OK) < 0 || stat(p, &st) < 0)
4648 return false;
4649
4650 /* continue if path is character device or block device */
4651 if (S_ISCHR(st.st_mode))
4652 ret = snprintf(value, LXC_MAX_BUFFER, "c %d:%d rwm", major(st.st_rdev), minor(st.st_rdev));
4653 else if (S_ISBLK(st.st_mode))
4654 ret = snprintf(value, LXC_MAX_BUFFER, "b %d:%d rwm", major(st.st_rdev), minor(st.st_rdev));
4655 else
4656 return false;
4657
4658 /* check snprintf return code */
4659 if (ret < 0 || ret >= LXC_MAX_BUFFER)
4660 return false;
4661
4662 if (!do_add_remove_node(do_lxcapi_init_pid(c), p, add, &st))
4663 return false;
4664
4665 /* add or remove device to/from cgroup access list */
4666 if (add) {
4667 if (!do_lxcapi_set_cgroup_item(c, "devices.allow", value)) {
4668 ERROR("set_cgroup_item failed while adding the device node");
4669 return false;
4670 }
4671 } else {
4672 if (!do_lxcapi_set_cgroup_item(c, "devices.deny", value)) {
4673 ERROR("set_cgroup_item failed while removing the device node");
4674 return false;
4675 }
4676 }
4677
4678 return true;
4679 }
4680
4681 static bool do_lxcapi_add_device_node(struct lxc_container *c, const char *src_path, const char *dest_path)
4682 {
4683 // cannot mknod if we're not privileged wrt init_user_ns
4684 if (am_host_unpriv()) {
4685 ERROR(LXC_UNPRIV_EOPNOTSUPP, __FUNCTION__);
4686 return false;
4687 }
4688
4689 return add_remove_device_node(c, src_path, dest_path, true);
4690 }
4691
4692 WRAP_API_2(bool, lxcapi_add_device_node, const char *, const char *)
4693
4694 static bool do_lxcapi_remove_device_node(struct lxc_container *c, const char *src_path, const char *dest_path)
4695 {
4696 if (am_guest_unpriv()) {
4697 ERROR(LXC_UNPRIV_EOPNOTSUPP, __FUNCTION__);
4698 return false;
4699 }
4700
4701 return add_remove_device_node(c, src_path, dest_path, false);
4702 }
4703
4704 WRAP_API_2(bool, lxcapi_remove_device_node, const char *, const char *)
4705
4706 static bool do_lxcapi_attach_interface(struct lxc_container *c,
4707 const char *ifname,
4708 const char *dst_ifname)
4709 {
4710 pid_t init_pid;
4711 int ret = 0;
4712
4713 if (am_guest_unpriv()) {
4714 ERROR(LXC_UNPRIV_EOPNOTSUPP, __FUNCTION__);
4715 return false;
4716 }
4717
4718 if (!ifname) {
4719 ERROR("No source interface name given");
4720 return false;
4721 }
4722
4723 ret = lxc_netdev_isup(ifname);
4724 if (ret > 0) {
4725 /* netdev of ifname is up. */
4726 ret = lxc_netdev_down(ifname);
4727 if (ret)
4728 goto err;
4729 }
4730
4731 init_pid = do_lxcapi_init_pid(c);
4732 ret = lxc_netdev_move_by_name(ifname, init_pid, dst_ifname);
4733 if (ret)
4734 goto err;
4735
4736 INFO("Moved network device \"%s\" to network namespace of %d", ifname, init_pid);
4737 return true;
4738
4739 err:
4740 return false;
4741 }
4742
4743 WRAP_API_2(bool, lxcapi_attach_interface, const char *, const char *)
4744
4745 static bool do_lxcapi_detach_interface(struct lxc_container *c,
4746 const char *ifname,
4747 const char *dst_ifname)
4748 {
4749 int ret;
4750 pid_t pid, pid_outside;
4751
4752 /*
4753 * TODO - if this is a physical device, then we need am_host_unpriv.
4754 * But for other types guest privilege suffices.
4755 */
4756 if (am_guest_unpriv()) {
4757 ERROR(LXC_UNPRIV_EOPNOTSUPP, __FUNCTION__);
4758 return false;
4759 }
4760
4761 if (!ifname) {
4762 ERROR("No source interface name given");
4763 return false;
4764 }
4765
4766 pid_outside = lxc_raw_getpid();
4767 pid = fork();
4768 if (pid < 0) {
4769 ERROR("Failed to fork");
4770 return false;
4771 }
4772
4773 if (pid == 0) { /* child */
4774 pid_t init_pid;
4775
4776 init_pid = do_lxcapi_init_pid(c);
4777 if (!switch_to_ns(init_pid, "net")) {
4778 ERROR("Failed to enter network namespace");
4779 _exit(EXIT_FAILURE);
4780 }
4781
4782 ret = lxc_netdev_isup(ifname);
4783 if (ret < 0) {
4784 ERROR("Failed to determine whether network device \"%s\" is up", ifname);
4785 _exit(EXIT_FAILURE);
4786 }
4787
4788 /* netdev of ifname is up. */
4789 if (ret) {
4790 ret = lxc_netdev_down(ifname);
4791 if (ret) {
4792 ERROR("Failed to set network device \"%s\" down", ifname);
4793 _exit(EXIT_FAILURE);
4794 }
4795 }
4796
4797 ret = lxc_netdev_move_by_name(ifname, pid_outside, dst_ifname);
4798 /* -EINVAL means there is no netdev named as ifname. */
4799 if (ret < 0) {
4800 if (ret == -EINVAL)
4801 ERROR("Network device \"%s\" not found", ifname);
4802 else
4803 ERROR("Failed to remove network device \"%s\"", ifname);
4804
4805 _exit(EXIT_FAILURE);
4806 }
4807
4808 _exit(EXIT_SUCCESS);
4809 }
4810
4811 ret = wait_for_pid(pid);
4812 if (ret != 0)
4813 return false;
4814
4815 INFO("Moved network device \"%s\" to network namespace of %d", ifname, pid_outside);
4816 return true;
4817 }
4818
4819 WRAP_API_2(bool, lxcapi_detach_interface, const char *, const char *)
4820
4821 static int do_lxcapi_migrate(struct lxc_container *c, unsigned int cmd,
4822 struct migrate_opts *opts, unsigned int size)
4823 {
4824 int ret = -1;
4825 struct migrate_opts *valid_opts = opts;
4826 uint64_t features_to_check = 0;
4827
4828 /* If the caller has a bigger (newer) struct migrate_opts, let's make
4829 * sure that the stuff on the end is zero, i.e. that they didn't ask us
4830 * to do anything special.
4831 */
4832 if (size > sizeof(*opts)) {
4833 unsigned char *addr;
4834 unsigned char *end;
4835
4836 addr = (void *)opts + sizeof(*opts);
4837 end = (void *)opts + size;
4838
4839 for (; addr < end; addr++)
4840 if (*addr)
4841 return -E2BIG;
4842 }
4843
4844 /* If the caller has a smaller struct, let's zero out the end for them
4845 * so we don't accidentally use bits of it that they didn't know about
4846 * to initialize.
4847 */
4848 if (size < sizeof(*opts)) {
4849 valid_opts = malloc(sizeof(*opts));
4850 if (!valid_opts)
4851 return -ENOMEM;
4852
4853 memset(valid_opts, 0, sizeof(*opts));
4854 memcpy(valid_opts, opts, size);
4855 }
4856
4857 switch (cmd) {
4858 case MIGRATE_PRE_DUMP:
4859 if (!do_lxcapi_is_running(c)) {
4860 ERROR("container is not running");
4861 goto on_error;
4862 }
4863
4864 ret = !__criu_pre_dump(c, valid_opts);
4865 break;
4866 case MIGRATE_DUMP:
4867 if (!do_lxcapi_is_running(c)) {
4868 ERROR("container is not running");
4869 goto on_error;
4870 }
4871
4872 ret = !__criu_dump(c, valid_opts);
4873 break;
4874 case MIGRATE_RESTORE:
4875 if (do_lxcapi_is_running(c)) {
4876 ERROR("container is already running");
4877 goto on_error;
4878 }
4879
4880 ret = !__criu_restore(c, valid_opts);
4881 break;
4882 case MIGRATE_FEATURE_CHECK:
4883 features_to_check = valid_opts->features_to_check;
4884 ret = !__criu_check_feature(&features_to_check);
4885 if (ret) {
4886 /* Something went wrong. Let's let the caller
4887 * know which feature checks failed. */
4888 valid_opts->features_to_check = features_to_check;
4889 }
4890 break;
4891 default:
4892 ERROR("invalid migrate command %u", cmd);
4893 ret = -EINVAL;
4894 }
4895
4896 on_error:
4897 if (size < sizeof(*opts))
4898 free(valid_opts);
4899
4900 return ret;
4901 }
4902
4903 WRAP_API_3(int, lxcapi_migrate, unsigned int, struct migrate_opts *, unsigned int)
4904
4905 static bool do_lxcapi_checkpoint(struct lxc_container *c, char *directory, bool stop, bool verbose)
4906 {
4907 struct migrate_opts opts;
4908
4909 memset(&opts, 0, sizeof(opts));
4910
4911 opts.directory = directory;
4912 opts.stop = stop;
4913 opts.verbose = verbose;
4914
4915 return !do_lxcapi_migrate(c, MIGRATE_DUMP, &opts, sizeof(opts));
4916 }
4917
4918 WRAP_API_3(bool, lxcapi_checkpoint, char *, bool, bool)
4919
4920 static bool do_lxcapi_restore(struct lxc_container *c, char *directory, bool verbose)
4921 {
4922 struct migrate_opts opts;
4923
4924 memset(&opts, 0, sizeof(opts));
4925
4926 opts.directory = directory;
4927 opts.verbose = verbose;
4928
4929 return !do_lxcapi_migrate(c, MIGRATE_RESTORE, &opts, sizeof(opts));
4930 }
4931
4932 WRAP_API_2(bool, lxcapi_restore, char *, bool)
4933
4934 /* @st_mode is the st_mode field of the stat(source) return struct */
4935 static int create_mount_target(const char *dest, mode_t st_mode)
4936 {
4937 char *dirdup, *destdirname;
4938 int ret;
4939
4940 dirdup = strdup(dest);
4941 if (!dirdup) {
4942 SYSERROR("Failed to duplicate target name \"%s\"", dest);
4943 return -1;
4944 }
4945 destdirname = dirname(dirdup);
4946
4947 ret = mkdir_p(destdirname, 0755);
4948 if (ret < 0) {
4949 SYSERROR("Failed to create \"%s\"", destdirname);
4950 free(dirdup);
4951 return ret;
4952 }
4953 free(dirdup);
4954
4955 (void)remove(dest);
4956
4957 if (S_ISDIR(st_mode))
4958 ret = mkdir(dest, 0000);
4959 else
4960 ret = mknod(dest, S_IFREG | 0000, 0);
4961 if (ret < 0) {
4962 SYSERROR("Failed to create mount target \"%s\"", dest);
4963 return -1;
4964 }
4965
4966 return 0;
4967 }
4968
4969 static int do_lxcapi_mount(struct lxc_container *c, const char *source,
4970 const char *target, const char *filesystemtype,
4971 unsigned long mountflags, const void *data,
4972 struct lxc_mount *mnt)
4973 {
4974 char *suff, *sret;
4975 char template[PATH_MAX], path[PATH_MAX];
4976 pid_t pid, init_pid;
4977 struct stat sb;
4978 bool is_dir;
4979 int ret = -1, fd = -EBADF;
4980
4981 if (!c || !c->lxc_conf) {
4982 ERROR("Container or configuration is NULL");
4983 return -EINVAL;
4984 }
4985
4986 if (!c->lxc_conf->shmount.path_host) {
4987 ERROR("Host path to shared mountpoint must be specified in the config\n");
4988 return -EINVAL;
4989 }
4990
4991 ret = snprintf(template, sizeof(template), "%s/.lxcmount_XXXXXX", c->lxc_conf->shmount.path_host);
4992 if (ret < 0 || (size_t)ret >= sizeof(template)) {
4993 SYSERROR("Error writing shmounts tempdir name");
4994 goto out;
4995 }
4996
4997 /* Create a temporary file / dir under the shared mountpoint */
4998 if (!source || strcmp(source, "") == 0) {
4999 /* If source is not specified, maybe we want to mount a filesystem? */
5000 sb.st_mode = S_IFDIR;
5001 } else {
5002 ret = stat(source, &sb);
5003 if (ret < 0) {
5004 SYSERROR("Error getting stat info about the source \"%s\"", source);
5005 goto out;
5006 }
5007 }
5008
5009 is_dir = (S_ISDIR(sb.st_mode) != 0);
5010 if (is_dir) {
5011 sret = mkdtemp(template);
5012 if (!sret) {
5013 SYSERROR("Could not create shmounts temporary dir");
5014 goto out;
5015 }
5016 } else {
5017 fd = lxc_make_tmpfile(template, false);
5018 if (fd < 0) {
5019 SYSERROR("Could not create shmounts temporary file");
5020 goto out;
5021 }
5022 }
5023
5024 /* Do the fork */
5025 pid = fork();
5026 if (pid < 0) {
5027 SYSERROR("Could not fork");
5028 goto out;
5029 }
5030
5031 if (pid == 0) {
5032 /* Do the mount */
5033 ret = mount(source, template, filesystemtype, mountflags, data);
5034 if (ret < 0) {
5035 SYSERROR("Failed to mount onto \"%s\"", template);
5036 _exit(EXIT_FAILURE);
5037 }
5038 TRACE("Mounted \"%s\" onto \"%s\"", source, template);
5039
5040 init_pid = do_lxcapi_init_pid(c);
5041 if (init_pid < 0) {
5042 ERROR("Failed to obtain container's init pid");
5043 _exit(EXIT_FAILURE);
5044 }
5045
5046 /* Enter the container namespaces */
5047 if (!lxc_list_empty(&c->lxc_conf->id_map)) {
5048 if (!switch_to_ns(init_pid, "user")){
5049 ERROR("Failed to enter user namespace");
5050 _exit(EXIT_FAILURE);
5051 }
5052 }
5053
5054 if (!switch_to_ns(init_pid, "mnt")) {
5055 ERROR("Failed to enter mount namespace");
5056 _exit(EXIT_FAILURE);
5057 }
5058
5059 ret = create_mount_target(target, sb.st_mode);
5060 if (ret < 0)
5061 _exit(EXIT_FAILURE);
5062 TRACE("Created mount target \"%s\"", target);
5063
5064 suff = strrchr(template, '/');
5065 if (!suff)
5066 _exit(EXIT_FAILURE);
5067
5068 ret = snprintf(path, sizeof(path), "%s%s", c->lxc_conf->shmount.path_cont, suff);
5069 if (ret < 0 || (size_t)ret >= sizeof(path)) {
5070 SYSERROR("Error writing container mountpoint name");
5071 _exit(EXIT_FAILURE);
5072 }
5073
5074 ret = mount(path, target, NULL, MS_MOVE | MS_REC, NULL);
5075 if (ret < 0) {
5076 SYSERROR("Failed to move the mount from \"%s\" to \"%s\"", path, target);
5077 _exit(EXIT_FAILURE);
5078 }
5079 TRACE("Moved mount from \"%s\" to \"%s\"", path, target);
5080
5081 _exit(EXIT_SUCCESS);
5082 }
5083
5084 ret = wait_for_pid(pid);
5085 if (ret < 0) {
5086 SYSERROR("Wait for the child with pid %ld failed", (long) pid);
5087 goto out;
5088 }
5089
5090 ret = 0;
5091
5092 (void)umount2(template, MNT_DETACH);
5093 if (is_dir)
5094 (void)rmdir(template);
5095 else
5096 (void)unlink(template);
5097
5098 out:
5099 if (fd >= 0)
5100 close(fd);
5101
5102 return ret;
5103 }
5104
5105 WRAP_API_6(int, lxcapi_mount, const char *, const char *, const char *,
5106 unsigned long, const void *, struct lxc_mount *)
5107
5108 static int do_lxcapi_umount(struct lxc_container *c, const char *target,
5109 unsigned long flags, struct lxc_mount *mnt)
5110 {
5111 pid_t pid, init_pid;
5112 int ret = -1;
5113
5114 if (!c || !c->lxc_conf) {
5115 ERROR("Container or configuration is NULL");
5116 return -EINVAL;
5117 }
5118
5119 /* Do the fork */
5120 pid = fork();
5121 if (pid < 0) {
5122 SYSERROR("Could not fork");
5123 return -1;
5124 }
5125
5126 if (pid == 0) {
5127 init_pid = do_lxcapi_init_pid(c);
5128 if (init_pid < 0) {
5129 ERROR("Failed to obtain container's init pid");
5130 _exit(EXIT_FAILURE);
5131 }
5132
5133 /* Enter the container namespaces */
5134 if (!lxc_list_empty(&c->lxc_conf->id_map)) {
5135 if (!switch_to_ns(init_pid, "user")) {
5136 ERROR("Failed to enter user namespace");
5137 _exit(EXIT_FAILURE);
5138 }
5139 }
5140
5141 if (!switch_to_ns(init_pid, "mnt")) {
5142 ERROR("Failed to enter mount namespace");
5143 _exit(EXIT_FAILURE);
5144 }
5145
5146 /* Do the unmount */
5147 ret = umount2(target, flags);
5148 if (ret < 0) {
5149 SYSERROR("Failed to umount \"%s\"", target);
5150 _exit(EXIT_FAILURE);
5151 }
5152
5153 _exit(EXIT_SUCCESS);
5154 }
5155
5156 ret = wait_for_pid(pid);
5157 if (ret < 0) {
5158 SYSERROR("Wait for the child with pid %ld failed", (long)pid);
5159 return -ret;
5160 }
5161
5162 return 0;
5163 }
5164
5165 WRAP_API_3(int, lxcapi_umount, const char *, unsigned long, struct lxc_mount*)
5166
5167 static int lxcapi_attach_run_waitl(struct lxc_container *c, lxc_attach_options_t *options, const char *program, const char *arg, ...)
5168 {
5169 va_list ap;
5170 const char **argv;
5171 int ret;
5172
5173 if (!c)
5174 return -1;
5175
5176 current_config = c->lxc_conf;
5177
5178 va_start(ap, arg);
5179 argv = lxc_va_arg_list_to_argv_const(ap, 1);
5180 va_end(ap);
5181
5182 if (!argv) {
5183 ERROR("Memory allocation error.");
5184 ret = -1;
5185 goto out;
5186 }
5187 argv[0] = arg;
5188
5189 ret = do_lxcapi_attach_run_wait(c, options, program, (const char * const *)argv);
5190 free((void*)argv);
5191
5192 out:
5193 current_config = NULL;
5194 return ret;
5195 }
5196
5197 struct lxc_container *lxc_container_new(const char *name, const char *configpath)
5198 {
5199 struct lxc_container *c;
5200 size_t len;
5201
5202 if (!name)
5203 return NULL;
5204
5205 c = malloc(sizeof(*c));
5206 if (!c) {
5207 fprintf(stderr, "Failed to allocate memory for %s\n", name);
5208 return NULL;
5209 }
5210 memset(c, 0, sizeof(*c));
5211
5212 if (configpath)
5213 c->config_path = strdup(configpath);
5214 else
5215 c->config_path = strdup(lxc_global_config_value("lxc.lxcpath"));
5216 if (!c->config_path) {
5217 fprintf(stderr, "Failed to allocate memory for %s\n", name);
5218 goto err;
5219 }
5220
5221 remove_trailing_slashes(c->config_path);
5222
5223 len = strlen(name);
5224 c->name = malloc(len + 1);
5225 if (!c->name) {
5226 fprintf(stderr, "Failed to allocate memory for %s\n", name);
5227 goto err;
5228 }
5229 (void)strlcpy(c->name, name, len + 1);
5230
5231 c->numthreads = 1;
5232 c->slock = lxc_newlock(c->config_path, name);
5233 if (!c->slock) {
5234 fprintf(stderr, "Failed to create lock for %s\n", name);
5235 goto err;
5236 }
5237
5238 c->privlock = lxc_newlock(NULL, NULL);
5239 if (!c->privlock) {
5240 fprintf(stderr, "Failed to create private lock for %s\n", name);
5241 goto err;
5242 }
5243
5244 if (!set_config_filename(c)) {
5245 fprintf(stderr, "Failed to create config file name for %s\n", name);
5246 goto err;
5247 }
5248
5249 if (file_exists(c->configfile) && !lxcapi_load_config(c, NULL)) {
5250 fprintf(stderr, "Failed to load config for %s\n", name);
5251 goto err;
5252 }
5253
5254 if (ongoing_create(c) == 2) {
5255 ERROR("Failed to complete container creation for %s", c->name);
5256 container_destroy(c, NULL);
5257 lxcapi_clear_config(c);
5258 }
5259
5260 c->daemonize = true;
5261 c->pidfile = NULL;
5262
5263 /* Assign the member functions. */
5264 c->is_defined = lxcapi_is_defined;
5265 c->state = lxcapi_state;
5266 c->is_running = lxcapi_is_running;
5267 c->freeze = lxcapi_freeze;
5268 c->unfreeze = lxcapi_unfreeze;
5269 c->console = lxcapi_console;
5270 c->console_getfd = lxcapi_console_getfd;
5271 c->init_pid = lxcapi_init_pid;
5272 c->load_config = lxcapi_load_config;
5273 c->want_daemonize = lxcapi_want_daemonize;
5274 c->want_close_all_fds = lxcapi_want_close_all_fds;
5275 c->start = lxcapi_start;
5276 c->startl = lxcapi_startl;
5277 c->stop = lxcapi_stop;
5278 c->config_file_name = lxcapi_config_file_name;
5279 c->wait = lxcapi_wait;
5280 c->set_config_item = lxcapi_set_config_item;
5281 c->destroy = lxcapi_destroy;
5282 c->destroy_with_snapshots = lxcapi_destroy_with_snapshots;
5283 c->rename = lxcapi_rename;
5284 c->save_config = lxcapi_save_config;
5285 c->get_keys = lxcapi_get_keys;
5286 c->create = lxcapi_create;
5287 c->createl = lxcapi_createl;
5288 c->shutdown = lxcapi_shutdown;
5289 c->reboot = lxcapi_reboot;
5290 c->reboot2 = lxcapi_reboot2;
5291 c->clear_config = lxcapi_clear_config;
5292 c->clear_config_item = lxcapi_clear_config_item;
5293 c->get_config_item = lxcapi_get_config_item;
5294 c->get_running_config_item = lxcapi_get_running_config_item;
5295 c->get_cgroup_item = lxcapi_get_cgroup_item;
5296 c->set_cgroup_item = lxcapi_set_cgroup_item;
5297 c->get_config_path = lxcapi_get_config_path;
5298 c->set_config_path = lxcapi_set_config_path;
5299 c->clone = lxcapi_clone;
5300 c->get_interfaces = lxcapi_get_interfaces;
5301 c->get_ips = lxcapi_get_ips;
5302 c->attach = lxcapi_attach;
5303 c->attach_run_wait = lxcapi_attach_run_wait;
5304 c->attach_run_waitl = lxcapi_attach_run_waitl;
5305 c->snapshot = lxcapi_snapshot;
5306 c->snapshot_list = lxcapi_snapshot_list;
5307 c->snapshot_restore = lxcapi_snapshot_restore;
5308 c->snapshot_destroy = lxcapi_snapshot_destroy;
5309 c->snapshot_destroy_all = lxcapi_snapshot_destroy_all;
5310 c->may_control = lxcapi_may_control;
5311 c->add_device_node = lxcapi_add_device_node;
5312 c->remove_device_node = lxcapi_remove_device_node;
5313 c->attach_interface = lxcapi_attach_interface;
5314 c->detach_interface = lxcapi_detach_interface;
5315 c->checkpoint = lxcapi_checkpoint;
5316 c->restore = lxcapi_restore;
5317 c->migrate = lxcapi_migrate;
5318 c->console_log = lxcapi_console_log;
5319 c->mount = lxcapi_mount;
5320 c->umount = lxcapi_umount;
5321
5322 return c;
5323
5324 err:
5325 lxc_container_free(c);
5326 return NULL;
5327 }
5328
5329 int lxc_get_wait_states(const char **states)
5330 {
5331 int i;
5332
5333 if (states)
5334 for (i=0; i<MAX_STATE; i++)
5335 states[i] = lxc_state2str(i);
5336
5337 return MAX_STATE;
5338 }
5339
5340 /*
5341 * These next two could probably be done smarter with reusing a common function
5342 * with different iterators and tests...
5343 */
5344 int list_defined_containers(const char *lxcpath, char ***names, struct lxc_container ***cret)
5345 {
5346 DIR *dir;
5347 int i, cfound = 0, nfound = 0;
5348 struct dirent *direntp;
5349 struct lxc_container *c;
5350
5351 if (!lxcpath)
5352 lxcpath = lxc_global_config_value("lxc.lxcpath");
5353
5354 dir = opendir(lxcpath);
5355 if (!dir) {
5356 SYSERROR("opendir on lxcpath");
5357 return -1;
5358 }
5359
5360 if (cret)
5361 *cret = NULL;
5362
5363 if (names)
5364 *names = NULL;
5365
5366 while ((direntp = readdir(dir))) {
5367 /* Ignore '.', '..' and any hidden directory. */
5368 if (!strncmp(direntp->d_name, ".", 1))
5369 continue;
5370
5371 if (!config_file_exists(lxcpath, direntp->d_name))
5372 continue;
5373
5374 if (names)
5375 if (!add_to_array(names, direntp->d_name, cfound))
5376 goto free_bad;
5377
5378 cfound++;
5379
5380 if (!cret) {
5381 nfound++;
5382 continue;
5383 }
5384
5385 c = lxc_container_new(direntp->d_name, lxcpath);
5386 if (!c) {
5387 INFO("Container %s:%s has a config but could not be loaded",
5388 lxcpath, direntp->d_name);
5389
5390 if (names)
5391 if(!remove_from_array(names, direntp->d_name, cfound--))
5392 goto free_bad;
5393
5394 continue;
5395 }
5396
5397 if (!do_lxcapi_is_defined(c)) {
5398 INFO("Container %s:%s has a config but is not defined",
5399 lxcpath, direntp->d_name);
5400
5401 if (names)
5402 if(!remove_from_array(names, direntp->d_name, cfound--))
5403 goto free_bad;
5404
5405 lxc_container_put(c);
5406 continue;
5407 }
5408
5409 if (!add_to_clist(cret, c, nfound, true)) {
5410 lxc_container_put(c);
5411 goto free_bad;
5412 }
5413
5414 nfound++;
5415 }
5416
5417 closedir(dir);
5418 return nfound;
5419
5420 free_bad:
5421 if (names && *names) {
5422 for (i=0; i<cfound; i++)
5423 free((*names)[i]);
5424 free(*names);
5425 }
5426
5427 if (cret && *cret) {
5428 for (i=0; i<nfound; i++)
5429 lxc_container_put((*cret)[i]);
5430 free(*cret);
5431 }
5432
5433 closedir(dir);
5434 return -1;
5435 }
5436
5437 int list_active_containers(const char *lxcpath, char ***nret,
5438 struct lxc_container ***cret)
5439 {
5440 int i, ret = -1, cret_cnt = 0, ct_name_cnt = 0;
5441 int lxcpath_len;
5442 char *line = NULL;
5443 char **ct_name = NULL;
5444 size_t len = 0;
5445 struct lxc_container *c = NULL;
5446 bool is_hashed;
5447
5448 if (!lxcpath)
5449 lxcpath = lxc_global_config_value("lxc.lxcpath");
5450 lxcpath_len = strlen(lxcpath);
5451
5452 if (cret)
5453 *cret = NULL;
5454
5455 if (nret)
5456 *nret = NULL;
5457
5458 FILE *f = fopen("/proc/net/unix", "r");
5459 if (!f)
5460 return -1;
5461
5462 while (getline(&line, &len, f) != -1) {
5463 char *p = strrchr(line, ' '), *p2;
5464 if (!p)
5465 continue;
5466 p++;
5467
5468 if (*p != 0x40)
5469 continue;
5470 p++;
5471
5472 is_hashed = false;
5473
5474 if (strncmp(p, lxcpath, lxcpath_len) == 0) {
5475 p += lxcpath_len;
5476 } else if (strncmp(p, "lxc/", 4) == 0) {
5477 p += 4;
5478 is_hashed = true;
5479 } else {
5480 continue;
5481 }
5482
5483 while (*p == '/')
5484 p++;
5485
5486 /* Now p is the start of lxc_name. */
5487 p2 = strchr(p, '/');
5488 if (!p2 || strncmp(p2, "/command", 8) != 0)
5489 continue;
5490 *p2 = '\0';
5491
5492 if (is_hashed) {
5493 char *recvpath = lxc_cmd_get_lxcpath(p);
5494 if (!recvpath)
5495 continue;
5496
5497 if (strncmp(lxcpath, recvpath, lxcpath_len) != 0) {
5498 free(recvpath);
5499 continue;
5500 }
5501 free(recvpath);
5502
5503 p = lxc_cmd_get_name(p);
5504 if (!p)
5505 continue;
5506 }
5507
5508 if (array_contains(&ct_name, p, ct_name_cnt)) {
5509 if (is_hashed)
5510 free(p);
5511 continue;
5512 }
5513
5514 if (!add_to_array(&ct_name, p, ct_name_cnt)) {
5515 if (is_hashed)
5516 free(p);
5517 goto free_cret_list;
5518 }
5519
5520 ct_name_cnt++;
5521
5522 if (!cret) {
5523 if (is_hashed)
5524 free(p);
5525 continue;
5526 }
5527
5528 c = lxc_container_new(p, lxcpath);
5529 if (!c) {
5530 INFO("Container %s:%s is running but could not be loaded",
5531 lxcpath, p);
5532
5533 remove_from_array(&ct_name, p, ct_name_cnt--);
5534 if (is_hashed)
5535 free(p);
5536
5537 continue;
5538 }
5539
5540 if (is_hashed)
5541 free(p);
5542
5543 /*
5544 * If this is an anonymous container, then is_defined *can*
5545 * return false. So we don't do that check. Count on the
5546 * fact that the command socket exists.
5547 */
5548
5549 if (!add_to_clist(cret, c, cret_cnt, true)) {
5550 lxc_container_put(c);
5551 goto free_cret_list;
5552 }
5553
5554 cret_cnt++;
5555 }
5556
5557 if (nret && cret && cret_cnt != ct_name_cnt) {
5558 if (c)
5559 lxc_container_put(c);
5560 goto free_cret_list;
5561 }
5562
5563 ret = ct_name_cnt;
5564 if (nret)
5565 *nret = ct_name;
5566 else
5567 goto free_ct_name;
5568
5569 goto out;
5570
5571 free_cret_list:
5572 if (cret && *cret) {
5573 for (i = 0; i < cret_cnt; i++)
5574 lxc_container_put((*cret)[i]);
5575 free(*cret);
5576 }
5577
5578 free_ct_name:
5579 if (ct_name) {
5580 for (i = 0; i < ct_name_cnt; i++)
5581 free(ct_name[i]);
5582 free(ct_name);
5583 }
5584
5585 out:
5586 free(line);
5587 fclose(f);
5588 return ret;
5589 }
5590
5591 int list_all_containers(const char *lxcpath, char ***nret,
5592 struct lxc_container ***cret)
5593 {
5594 int i, ret, active_cnt, ct_cnt, ct_list_cnt;
5595 char **active_name;
5596 char **ct_name;
5597 struct lxc_container **ct_list = NULL;
5598
5599 ct_cnt = list_defined_containers(lxcpath, &ct_name, NULL);
5600 if (ct_cnt < 0)
5601 return ct_cnt;
5602
5603 active_cnt = list_active_containers(lxcpath, &active_name, NULL);
5604 if (active_cnt < 0) {
5605 ret = active_cnt;
5606 goto free_ct_name;
5607 }
5608
5609 for (i = 0; i < active_cnt; i++) {
5610 if (!array_contains(&ct_name, active_name[i], ct_cnt)) {
5611 if (!add_to_array(&ct_name, active_name[i], ct_cnt)) {
5612 ret = -1;
5613 goto free_active_name;
5614 }
5615
5616 ct_cnt++;
5617 }
5618
5619 free(active_name[i]);
5620 active_name[i] = NULL;
5621 }
5622
5623 free(active_name);
5624 active_name = NULL;
5625 active_cnt = 0;
5626
5627 for (i = 0, ct_list_cnt = 0; i < ct_cnt && cret; i++) {
5628 struct lxc_container *c;
5629
5630 c = lxc_container_new(ct_name[i], lxcpath);
5631 if (!c) {
5632 WARN("Container %s:%s could not be loaded", lxcpath, ct_name[i]);
5633 remove_from_array(&ct_name, ct_name[i], ct_cnt--);
5634 continue;
5635 }
5636
5637 if (!add_to_clist(&ct_list, c, ct_list_cnt, false)) {
5638 lxc_container_put(c);
5639 ret = -1;
5640 goto free_ct_list;
5641 }
5642
5643 ct_list_cnt++;
5644 }
5645
5646 if (cret)
5647 *cret = ct_list;
5648
5649 if (nret) {
5650 *nret = ct_name;
5651 } else {
5652 ret = ct_cnt;
5653 goto free_ct_name;
5654 }
5655
5656 return ct_cnt;
5657
5658 free_ct_list:
5659 for (i = 0; i < ct_list_cnt; i++) {
5660 lxc_container_put(ct_list[i]);
5661 }
5662 free(ct_list);
5663
5664 free_active_name:
5665 for (i = 0; i < active_cnt; i++) {
5666 free(active_name[i]);
5667 }
5668 free(active_name);
5669
5670 free_ct_name:
5671 for (i = 0; i < ct_cnt; i++) {
5672 free(ct_name[i]);
5673 }
5674 free(ct_name);
5675 return ret;
5676 }
5677
5678 bool lxc_config_item_is_supported(const char *key)
5679 {
5680 return !!lxc_get_config(key);
5681 }
5682
5683 bool lxc_has_api_extension(const char *extension)
5684 {
5685 /* The NULL API extension is always present. :) */
5686 if (!extension)
5687 return true;
5688
5689 for (size_t i = 0; i < nr_api_extensions; i++)
5690 if (strcmp(api_extensions[i], extension) == 0)
5691 return true;
5692
5693 return false;
5694 }
LXC mirror