]> git.proxmox.com Git - mirror_lxc.git/blob - src/lxc/lxccontainer.c
projects / mirror_lxc.git / blob
? search:
summary | shortlog | log | commit | commitdiff | tree
blame | history | raw | HEAD
lxccontainer: properly cleanup on mount injection failure
[mirror_lxc.git] / src / lxc / lxccontainer.c
1 /* liblxcapi
2 *
3 * Copyright © 2012 Serge Hallyn <serge.hallyn@ubuntu.com>.
4 * Copyright © 2012 Canonical Ltd.
5 *
6 * This library is free software; you can redistribute it and/or
7 * modify it under the terms of the GNU Lesser General Public
8 * License as published by the Free Software Foundation; either
9 * version 2.1 of the License, or (at your option) any later version.
10
11 * This library is distributed in the hope that it will be useful,
12 * but WITHOUT ANY WARRANTY; without even the implied warranty of
13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
14 * Lesser General Public License for more details.
15
16 * You should have received a copy of the GNU Lesser General Public
17 * License along with this library; if not, write to the Free Software
18 * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
19 */
20
21 #ifndef _GNU_SOURCE
22 #define _GNU_SOURCE 1
23 #endif
24 #include <arpa/inet.h>
25 #include <dirent.h>
26 #include <errno.h>
27 #include <fcntl.h>
28 #include <grp.h>
29 #include <libgen.h>
30 #include <pthread.h>
31 #include <sched.h>
32 #include <stdarg.h>
33 #include <stdint.h>
34 #include <stdio.h>
35 #include <stdlib.h>
36 #include <sys/file.h>
37 #include <sys/mman.h>
38 #include <sys/mount.h>
39 #include <sys/stat.h>
40 #include <sys/syscall.h>
41 #include <sys/sysmacros.h>
42 #include <sys/types.h>
43 #include <sys/wait.h>
44 #include <unistd.h>
45
46 #include "../include/netns_ifaddrs.h"
47 #include "af_unix.h"
48 #include "api_extensions.h"
49 #include "attach.h"
50 #include "cgroup.h"
51 #include "commands.h"
52 #include "commands_utils.h"
53 #include "conf.h"
54 #include "config.h"
55 #include "confile.h"
56 #include "confile_utils.h"
57 #include "criu.h"
58 #include "error.h"
59 #include "initutils.h"
60 #include "log.h"
61 #include "lxc.h"
62 #include "lxccontainer.h"
63 #include "lxclock.h"
64 #include "memory_utils.h"
65 #include "monitor.h"
66 #include "namespace.h"
67 #include "network.h"
68 #include "parse.h"
69 #include "raw_syscalls.h"
70 #include "start.h"
71 #include "state.h"
72 #include "storage.h"
73 #include "storage/btrfs.h"
74 #include "storage/overlay.h"
75 #include "storage_utils.h"
76 #include "sync.h"
77 #include "syscall_wrappers.h"
78 #include "terminal.h"
79 #include "utils.h"
80 #include "version.h"
81
82 #if HAVE_OPENSSL
83 #include <openssl/evp.h>
84 #endif
85
86 /* major()/minor() */
87 #ifdef MAJOR_IN_MKDEV
88 #include <sys/mkdev.h>
89 #endif
90
91 #if IS_BIONIC
92 #include <../include/lxcmntent.h>
93 #else
94 #include <mntent.h>
95 #endif
96
97 #ifndef HAVE_STRLCPY
98 #include "include/strlcpy.h"
99 #endif
100
101 /* Define faccessat() if missing from the C library */
102 #ifndef HAVE_FACCESSAT
103 static int faccessat(int __fd, const char *__file, int __type, int __flag)
104 {
105 #ifdef __NR_faccessat
106 return syscall(__NR_faccessat, __fd, __file, __type, __flag);
107 #else
108 errno = ENOSYS;
109 return -1;
110 #endif
111 }
112 #endif
113
114 lxc_log_define(lxccontainer, lxc);
115
116 static bool do_lxcapi_destroy(struct lxc_container *c);
117 static const char *lxcapi_get_config_path(struct lxc_container *c);
118 #define do_lxcapi_get_config_path(c) lxcapi_get_config_path(c)
119 static bool do_lxcapi_set_config_item(struct lxc_container *c, const char *key, const char *v);
120 static bool container_destroy(struct lxc_container *c,
121 struct lxc_storage *storage);
122 static bool get_snappath_dir(struct lxc_container *c, char *snappath);
123 static bool lxcapi_snapshot_destroy_all(struct lxc_container *c);
124 static bool do_lxcapi_save_config(struct lxc_container *c, const char *alt_file);
125
126 static bool config_file_exists(const char *lxcpath, const char *cname)
127 {
128 __do_free char *fname = NULL;
129 int ret;
130 size_t len;
131
132 /* $lxcpath + '/' + $cname + '/config' + \0 */
133 len = strlen(lxcpath) + strlen(cname) + 9;
134 fname = must_realloc(NULL, len);
135 ret = snprintf(fname, len, "%s/%s/config", lxcpath, cname);
136 if (ret < 0 || (size_t)ret >= len)
137 return false;
138
139 return file_exists(fname);
140 }
141
142 /*
143 * A few functions to help detect when a container creation failed. If a
144 * container creation was killed partway through, then trying to actually start
145 * that container could harm the host. We detect this by creating a 'partial'
146 * file under the container directory, and keeping an advisory lock. When
147 * container creation completes, we remove that file. When we load or try to
148 * start a container, if we find that file, without a flock, we remove the
149 * container.
150 */
151 enum {
152 LXC_CREATE_FAILED = -1,
153 LXC_CREATE_SUCCESS = 0,
154 LXC_CREATE_ONGOING = 1,
155 LXC_CREATE_INCOMPLETE = 2,
156 };
157
158 static int ongoing_create(struct lxc_container *c)
159 {
160 __do_close_prot_errno int fd = -EBADF;
161 __do_free char *path = NULL;
162 struct flock lk = {0};
163 int ret;
164 size_t len;
165
166 len = strlen(c->config_path) + strlen(c->name) + 10;
167 path = must_realloc(NULL, len);
168 ret = snprintf(path, len, "%s/%s/partial", c->config_path, c->name);
169 if (ret < 0 || (size_t)ret >= len)
170 return LXC_CREATE_FAILED;
171
172 fd = open(path, O_RDWR | O_CLOEXEC);
173 if (fd < 0) {
174 if (errno != ENOENT)
175 return LXC_CREATE_FAILED;
176
177 return LXC_CREATE_SUCCESS;
178 }
179
180 lk.l_type = F_WRLCK;
181 lk.l_whence = SEEK_SET;
182 /*
183 * F_OFD_GETLK requires that l_pid be set to 0 otherwise the kernel
184 * will EINVAL us.
185 */
186 lk.l_pid = 0;
187
188 ret = fcntl(fd, F_OFD_GETLK, &lk);
189 if (ret < 0 && errno == EINVAL) {
190 ret = flock(fd, LOCK_EX | LOCK_NB);
191 if (ret < 0 && errno == EWOULDBLOCK)
192 ret = 0;
193 }
194
195 /* F_OFD_GETLK will not send us back a pid so don't check it. */
196 if (ret == 0)
197 /* Create is still ongoing. */
198 return LXC_CREATE_ONGOING;
199
200 /* Create completed but partial is still there. */
201 return LXC_CREATE_INCOMPLETE;
202 }
203
204 static int create_partial(struct lxc_container *c)
205 {
206 __do_free char *path = NULL;
207 int fd, ret;
208 size_t len;
209 struct flock lk = {0};
210
211 /* $lxcpath + '/' + $name + '/partial' + \0 */
212 len = strlen(c->config_path) + strlen(c->name) + 10;
213 path = must_realloc(NULL, len);
214 ret = snprintf(path, len, "%s/%s/partial", c->config_path, c->name);
215 if (ret < 0 || (size_t)ret >= len)
216 return -1;
217
218 fd = open(path, O_RDWR | O_CREAT | O_EXCL | O_CLOEXEC, 0000);
219 if (fd < 0)
220 return -1;
221
222 lk.l_type = F_WRLCK;
223 lk.l_whence = SEEK_SET;
224
225 ret = fcntl(fd, F_OFD_SETLKW, &lk);
226 if (ret < 0) {
227 if (errno == EINVAL) {
228 ret = flock(fd, LOCK_EX);
229 if (ret == 0)
230 return fd;
231 }
232
233 SYSERROR("Failed to lock partial file %s", path);
234 close(fd);
235 return -1;
236 }
237
238 return fd;
239 }
240
241 static void remove_partial(struct lxc_container *c, int fd)
242 {
243 __do_free char *path = NULL;
244 int ret;
245 size_t len;
246
247 close(fd);
248
249 /* $lxcpath + '/' + $name + '/partial' + \0 */
250 len = strlen(c->config_path) + strlen(c->name) + 10;
251 path = must_realloc(NULL, len);
252 ret = snprintf(path, len, "%s/%s/partial", c->config_path, c->name);
253 if (ret < 0 || (size_t)ret >= len)
254 return;
255
256 ret = unlink(path);
257 if (ret < 0)
258 SYSERROR("Failed to remove partial file %s", path);
259 }
260
261 /* LOCKING
262 * 1. container_mem_lock(c) protects the struct lxc_container from multiple threads.
263 * 2. container_disk_lock(c) protects the on-disk container data - in particular the
264 * container configuration file.
265 * The container_disk_lock also takes the container_mem_lock.
266 * 3. thread_mutex protects process data (ex: fd table) from multiple threads.
267 * NOTHING mutexes two independent programs with their own struct
268 * lxc_container for the same c->name, between API calls. For instance,
269 * c->config_read(); c->start(); Between those calls, data on disk
270 * could change (which shouldn't bother the caller unless for instance
271 * the rootfs get moved). c->config_read(); update; c->config_write();
272 * Two such updaters could race. The callers should therefore check their
273 * results. Trying to prevent that would necessarily expose us to deadlocks
274 * due to hung callers. So I prefer to keep the locks only within our own
275 * functions, not across functions.
276 *
277 * If you're going to clone while holding a lxccontainer, increment
278 * c->numthreads (under privlock) before forking. When deleting,
279 * decrement numthreads under privlock, then if it hits 0 you can delete.
280 * Do not ever use a lxccontainer whose numthreads you did not bump.
281 */
282 static void lxc_container_free(struct lxc_container *c)
283 {
284 if (!c)
285 return;
286
287 free(c->configfile);
288 c->configfile = NULL;
289
290 free(c->error_string);
291 c->error_string = NULL;
292
293 if (c->slock) {
294 lxc_putlock(c->slock);
295 c->slock = NULL;
296 }
297
298 if (c->privlock) {
299 lxc_putlock(c->privlock);
300 c->privlock = NULL;
301 }
302
303 free(c->name);
304 c->name = NULL;
305
306 if (c->lxc_conf) {
307 lxc_conf_free(c->lxc_conf);
308 c->lxc_conf = NULL;
309 }
310
311 free(c->config_path);
312 c->config_path = NULL;
313
314 free(c);
315 }
316
317 /* Consider the following case:
318 *
319 * |====================================================================|
320 * | freer | racing get()er |
321 * |====================================================================|
322 * | lxc_container_put() | lxc_container_get() |
323 * | \ lxclock(c->privlock) | c->numthreads < 1? (no) |
324 * | \ c->numthreads = 0 | \ lxclock(c->privlock) -> waits |
325 * | \ lxcunlock() | \ |
326 * | \ lxc_container_free() | \ lxclock() returns |
327 * | | \ c->numthreads < 1 -> return 0 |
328 * | \ \ (free stuff) | |
329 * | \ \ sem_destroy(privlock) | |
330 * |_______________________________|____________________________________|
331 *
332 * When the get()er checks numthreads the first time, one of the following
333 * is true:
334 * 1. freer has set numthreads = 0. get() returns 0
335 * 2. freer is between lxclock and setting numthreads to 0. get()er will
336 * sem_wait on privlock, get lxclock after freer() drops it, then see
337 * numthreads is 0 and exit without touching lxclock again..
338 * 3. freer has not yet locked privlock. If get()er runs first, then put()er
339 * will see --numthreads = 1 and not call lxc_container_free().
340 */
341
342 int lxc_container_get(struct lxc_container *c)
343 {
344 if (!c)
345 return 0;
346
347 /* If someone else has already started freeing the container, don't try
348 * to take the lock, which may be invalid.
349 */
350 if (c->numthreads < 1)
351 return 0;
352
353 if (container_mem_lock(c))
354 return 0;
355
356 /* Bail without trying to unlock, bc the privlock is now probably in
357 * freed memory.
358 */
359 if (c->numthreads < 1)
360 return 0;
361
362 c->numthreads++;
363 container_mem_unlock(c);
364
365 return 1;
366 }
367
368 int lxc_container_put(struct lxc_container *c)
369 {
370 if (!c)
371 return -1;
372
373 if (container_mem_lock(c))
374 return -1;
375
376 c->numthreads--;
377
378 if (c->numthreads < 1) {
379 container_mem_unlock(c);
380 lxc_container_free(c);
381 return 1;
382 }
383
384 container_mem_unlock(c);
385 return 0;
386 }
387
388 static bool do_lxcapi_is_defined(struct lxc_container *c)
389 {
390 int statret;
391 struct stat statbuf;
392 bool ret = false;
393
394 if (!c)
395 return false;
396
397 if (container_mem_lock(c))
398 return false;
399
400 if (!c->configfile)
401 goto on_error;
402
403 statret = stat(c->configfile, &statbuf);
404 if (statret != 0)
405 goto on_error;
406
407 ret = true;
408
409 on_error:
410 container_mem_unlock(c);
411 return ret;
412 }
413
414 #define WRAP_API(rettype, fnname) \
415 static rettype fnname(struct lxc_container *c) \
416 { \
417 rettype ret; \
418 bool reset_config = false; \
419 \
420 if (!current_config && c && c->lxc_conf) { \
421 current_config = c->lxc_conf; \
422 reset_config = true; \
423 } \
424 \
425 ret = do_##fnname(c); \
426 if (reset_config) \
427 current_config = NULL; \
428 \
429 return ret; \
430 }
431
432 #define WRAP_API_1(rettype, fnname, t1) \
433 static rettype fnname(struct lxc_container *c, t1 a1) \
434 { \
435 rettype ret; \
436 bool reset_config = false; \
437 \
438 if (!current_config && c && c->lxc_conf) { \
439 current_config = c->lxc_conf; \
440 reset_config = true; \
441 } \
442 \
443 ret = do_##fnname(c, a1); \
444 if (reset_config) \
445 current_config = NULL; \
446 \
447 return ret; \
448 }
449
450 #define WRAP_API_2(rettype, fnname, t1, t2) \
451 static rettype fnname(struct lxc_container *c, t1 a1, t2 a2) \
452 { \
453 rettype ret; \
454 bool reset_config = false; \
455 \
456 if (!current_config && c && c->lxc_conf) { \
457 current_config = c->lxc_conf; \
458 reset_config = true; \
459 } \
460 \
461 ret = do_##fnname(c, a1, a2); \
462 if (reset_config) \
463 current_config = NULL; \
464 \
465 return ret; \
466 }
467
468 #define WRAP_API_3(rettype, fnname, t1, t2, t3) \
469 static rettype fnname(struct lxc_container *c, t1 a1, t2 a2, t3 a3) \
470 { \
471 rettype ret; \
472 bool reset_config = false; \
473 \
474 if (!current_config && c && c->lxc_conf) { \
475 current_config = c->lxc_conf; \
476 reset_config = true; \
477 } \
478 \
479 ret = do_##fnname(c, a1, a2, a3); \
480 if (reset_config) \
481 current_config = NULL; \
482 \
483 return ret; \
484 }
485
486 #define WRAP_API_6(rettype, fnname, t1, t2, t3, t4, t5, t6) \
487 static rettype fnname(struct lxc_container *c, t1 a1, t2 a2, t3 a3, \
488 t4 a4, t5 a5, t6 a6) \
489 { \
490 rettype ret; \
491 bool reset_config = false; \
492 \
493 if (!current_config && c && c->lxc_conf) { \
494 current_config = c->lxc_conf; \
495 reset_config = true; \
496 } \
497 \
498 ret = do_##fnname(c, a1, a2, a3, a4, a5, a6); \
499 if (reset_config) \
500 current_config = NULL; \
501 \
502 return ret; \
503 }
504
505 WRAP_API(bool, lxcapi_is_defined)
506
507 static const char *do_lxcapi_state(struct lxc_container *c)
508 {
509 lxc_state_t s;
510
511 if (!c)
512 return NULL;
513
514 s = lxc_getstate(c->name, c->config_path);
515 return lxc_state2str(s);
516 }
517
518 WRAP_API(const char *, lxcapi_state)
519
520 static bool is_stopped(struct lxc_container *c)
521 {
522 lxc_state_t s;
523
524 s = lxc_getstate(c->name, c->config_path);
525 return (s == STOPPED);
526 }
527
528 static bool do_lxcapi_is_running(struct lxc_container *c)
529 {
530 if (!c)
531 return false;
532
533 return !is_stopped(c);
534 }
535
536 WRAP_API(bool, lxcapi_is_running)
537
538 static bool do_lxcapi_freeze(struct lxc_container *c)
539 {
540 lxc_state_t s;
541
542 if (!c || !c->lxc_conf)
543 return false;
544
545 s = lxc_getstate(c->name, c->config_path);
546 if (s != FROZEN)
547 return lxc_freeze(c->lxc_conf, c->name, c->config_path) == 0;
548
549 return true;
550 }
551
552 WRAP_API(bool, lxcapi_freeze)
553
554 static bool do_lxcapi_unfreeze(struct lxc_container *c)
555 {
556 lxc_state_t s;
557
558 if (!c || !c->lxc_conf)
559 return false;
560
561 s = lxc_getstate(c->name, c->config_path);
562 if (s == FROZEN)
563 return lxc_unfreeze(c->lxc_conf, c->name, c->config_path) == 0;
564
565 return true;
566 }
567
568 WRAP_API(bool, lxcapi_unfreeze)
569
570 static int do_lxcapi_console_getfd(struct lxc_container *c, int *ttynum, int *masterfd)
571 {
572 if (!c)
573 return -1;
574
575 return lxc_terminal_getfd(c, ttynum, masterfd);
576 }
577
578 WRAP_API_2(int, lxcapi_console_getfd, int *, int *)
579
580 static int lxcapi_console(struct lxc_container *c, int ttynum, int stdinfd,
581 int stdoutfd, int stderrfd, int escape)
582 {
583 int ret;
584
585 if (!c)
586 return -1;
587
588 current_config = c->lxc_conf;
589 ret = lxc_console(c, ttynum, stdinfd, stdoutfd, stderrfd, escape);
590 current_config = NULL;
591
592 return ret;
593 }
594
595 static int do_lxcapi_console_log(struct lxc_container *c, struct lxc_console_log *log)
596 {
597 int ret;
598
599 if (!c)
600 return -EINVAL;
601
602 ret = lxc_cmd_console_log(c->name, do_lxcapi_get_config_path(c), log);
603 if (ret < 0) {
604 if (ret == -ENODATA)
605 NOTICE("The console log is empty");
606 else if (ret == -EFAULT)
607 NOTICE("The container does not keep a console log");
608 else if (ret == -ENOENT)
609 NOTICE("The container does not keep a console log file");
610 else if (ret == -EIO)
611 NOTICE("Failed to write console log to log file");
612 else
613 ERROR("Failed to retrieve console log");
614 }
615
616 return ret;
617 }
618
619 WRAP_API_1(int, lxcapi_console_log, struct lxc_console_log *)
620
621 static pid_t do_lxcapi_init_pid(struct lxc_container *c)
622 {
623 if (!c)
624 return -1;
625
626 return lxc_cmd_get_init_pid(c->name, c->config_path);
627 }
628
629 WRAP_API(pid_t, lxcapi_init_pid)
630
631 static bool load_config_locked(struct lxc_container *c, const char *fname)
632 {
633 if (!c->lxc_conf)
634 c->lxc_conf = lxc_conf_init();
635
636 if (!c->lxc_conf)
637 return false;
638
639 if (lxc_config_read(fname, c->lxc_conf, false) != 0)
640 return false;
641
642 c->lxc_conf->name = c->name;
643 return true;
644 }
645
646 static bool do_lxcapi_load_config(struct lxc_container *c, const char *alt_file)
647 {
648 int lret;
649 const char *fname;
650 bool need_disklock = false, ret = false;
651
652 if (!c)
653 return false;
654
655 fname = c->configfile;
656
657 if (alt_file)
658 fname = alt_file;
659
660 if (!fname)
661 return false;
662
663 /* If we're reading something other than the container's config, we only
664 * need to lock the in-memory container. If loading the container's
665 * config file, take the disk lock.
666 */
667 if (strcmp(fname, c->configfile) == 0)
668 need_disklock = true;
669
670 if (need_disklock)
671 lret = container_disk_lock(c);
672 else
673 lret = container_mem_lock(c);
674 if (lret)
675 return false;
676
677 ret = load_config_locked(c, fname);
678
679 if (need_disklock)
680 container_disk_unlock(c);
681 else
682 container_mem_unlock(c);
683
684 return ret;
685 }
686
687 WRAP_API_1(bool, lxcapi_load_config, const char *)
688
689 static bool do_lxcapi_want_daemonize(struct lxc_container *c, bool state)
690 {
691 if (!c || !c->lxc_conf)
692 return false;
693
694 if (container_mem_lock(c))
695 return false;
696
697 c->daemonize = state;
698
699 container_mem_unlock(c);
700
701 return true;
702 }
703
704 WRAP_API_1(bool, lxcapi_want_daemonize, bool)
705
706 static bool do_lxcapi_want_close_all_fds(struct lxc_container *c, bool state)
707 {
708 if (!c || !c->lxc_conf)
709 return false;
710
711 if (container_mem_lock(c))
712 return false;
713
714 c->lxc_conf->close_all_fds = state;
715
716 container_mem_unlock(c);
717
718 return true;
719 }
720
721 WRAP_API_1(bool, lxcapi_want_close_all_fds, bool)
722
723 static bool do_lxcapi_wait(struct lxc_container *c, const char *state,
724 int timeout)
725 {
726 int ret;
727
728 if (!c)
729 return false;
730
731 ret = lxc_wait(c->name, state, timeout, c->config_path);
732 return ret == 0;
733 }
734
735 WRAP_API_2(bool, lxcapi_wait, const char *, int)
736
737 static bool am_single_threaded(void)
738 {
739 DIR *dir;
740 struct dirent *direntp;
741 int count = 0;
742
743 dir = opendir("/proc/self/task");
744 if (!dir)
745 return false;
746
747 while ((direntp = readdir(dir))) {
748 if (strcmp(direntp->d_name, ".") == 0)
749 continue;
750
751 if (strcmp(direntp->d_name, "..") == 0)
752 continue;
753
754 count++;
755 if (count > 1)
756 break;
757 }
758 closedir(dir);
759
760 return count == 1;
761 }
762
763 static void push_arg(char ***argp, char *arg, int *nargs)
764 {
765 char *copy;
766 char **argv;
767
768 copy = must_copy_string(arg);
769
770 do {
771 argv = realloc(*argp, (*nargs + 2) * sizeof(char *));
772 } while (!argv);
773
774 *argp = argv;
775 argv[*nargs] = copy;
776 (*nargs)++;
777 argv[*nargs] = NULL;
778 }
779
780 static char **split_init_cmd(const char *incmd)
781 {
782 __do_free char *copy = NULL;
783 char *p;
784 char **argv;
785 int nargs = 0;
786
787 if (!incmd)
788 return NULL;
789
790 copy = must_copy_string(incmd);
791
792 do {
793 argv = malloc(sizeof(char *));
794 } while (!argv);
795
796 argv[0] = NULL;
797 lxc_iterate_parts (p, copy, " ")
798 push_arg(&argv, p, &nargs);
799
800 if (nargs == 0) {
801 free(argv);
802 return NULL;
803 }
804
805 return argv;
806 }
807
808 static void free_init_cmd(char **argv)
809 {
810 int i = 0;
811
812 if (!argv)
813 return;
814
815 while (argv[i])
816 free(argv[i++]);
817
818 free(argv);
819 }
820
821 static int lxc_rcv_status(int state_socket)
822 {
823 int ret;
824 int state = -1;
825
826 again:
827 /* Receive container state. */
828 ret = lxc_abstract_unix_rcv_credential(state_socket, &state, sizeof(int));
829 if (ret <= 0) {
830 if (errno != EINTR)
831 return -1;
832
833 TRACE("Caught EINTR; retrying");
834 goto again;
835 }
836
837 return state;
838 }
839
840 static bool wait_on_daemonized_start(struct lxc_handler *handler, int pid)
841 {
842 int ret, state;
843
844 /* Close write end of the socket pair. */
845 close(handler->state_socket_pair[1]);
846 handler->state_socket_pair[1] = -1;
847
848 state = lxc_rcv_status(handler->state_socket_pair[0]);
849
850 /* Close read end of the socket pair. */
851 close(handler->state_socket_pair[0]);
852 handler->state_socket_pair[0] = -1;
853
854 /* The first child is going to fork() again and then exits. So we reap
855 * the first child here.
856 */
857 ret = wait_for_pid(pid);
858 if (ret < 0)
859 DEBUG("Failed waiting on first child %d", pid);
860 else
861 DEBUG("First child %d exited", pid);
862
863 if (state < 0) {
864 SYSERROR("Failed to receive the container state");
865 return false;
866 }
867
868 /* If we receive anything else then running we know that the container
869 * failed to start.
870 */
871 if (state != RUNNING) {
872 ERROR("Received container state \"%s\" instead of \"RUNNING\"",
873 lxc_state2str(state));
874 return false;
875 }
876
877 TRACE("Container is in \"RUNNING\" state");
878 return true;
879 }
880
881 static bool do_lxcapi_start(struct lxc_container *c, int useinit, char * const argv[])
882 {
883 int ret;
884 struct lxc_handler *handler;
885 struct lxc_conf *conf;
886 char *default_args[] = {
887 "/sbin/init",
888 NULL,
889 };
890 char **init_cmd = NULL;
891 int keepfds[3] = {-1, -1, -1};
892
893 /* container does exist */
894 if (!c)
895 return false;
896
897 /* If anything fails before we set error_num, we want an error in there.
898 */
899 c->error_num = 1;
900
901 /* Container has not been setup. */
902 if (!c->lxc_conf)
903 return false;
904
905 ret = ongoing_create(c);
906 switch (ret) {
907 case LXC_CREATE_FAILED:
908 ERROR("Failed checking for incomplete container creation");
909 return false;
910 case LXC_CREATE_ONGOING:
911 ERROR("Ongoing container creation detected");
912 return false;
913 case LXC_CREATE_INCOMPLETE:
914 ERROR("Failed to create container");
915 do_lxcapi_destroy(c);
916 return false;
917 }
918
919 if (container_mem_lock(c))
920 return false;
921
922 conf = c->lxc_conf;
923
924 /* initialize handler */
925 handler = lxc_init_handler(c->name, conf, c->config_path, c->daemonize);
926
927 container_mem_unlock(c);
928 if (!handler)
929 return false;
930
931 if (!argv) {
932 if (useinit && conf->execute_cmd)
933 argv = init_cmd = split_init_cmd(conf->execute_cmd);
934 else
935 argv = init_cmd = split_init_cmd(conf->init_cmd);
936 }
937
938 /* ... otherwise use default_args. */
939 if (!argv) {
940 if (useinit) {
941 ERROR("No valid init detected");
942 lxc_free_handler(handler);
943 return false;
944 }
945 argv = default_args;
946 }
947
948 /* I'm not sure what locks we want here.Any? Is liblxc's locking enough
949 * here to protect the on disk container? We don't want to exclude
950 * things like lxc_info while the container is running.
951 */
952 if (c->daemonize) {
953 bool started;
954 char title[2048];
955 pid_t pid;
956
957 pid = fork();
958 if (pid < 0) {
959 free_init_cmd(init_cmd);
960 lxc_free_handler(handler);
961 return false;
962 }
963
964 /* first parent */
965 if (pid != 0) {
966 /* Set to NULL because we don't want father unlink
967 * the PID file, child will do the free and unlink.
968 */
969 c->pidfile = NULL;
970
971 /* Wait for container to tell us whether it started
972 * successfully.
973 */
974 started = wait_on_daemonized_start(handler, pid);
975
976 free_init_cmd(init_cmd);
977 lxc_free_handler(handler);
978 return started;
979 }
980
981 /* first child */
982
983 /* We don't really care if this doesn't print all the
984 * characters. All that it means is that the proctitle will be
985 * ugly. Similarly, we also don't care if setproctitle() fails.
986 */
987 ret = snprintf(title, sizeof(title), "[lxc monitor] %s %s", c->config_path, c->name);
988 if (ret > 0) {
989 ret = setproctitle(title);
990 if (ret < 0)
991 INFO("Failed to set process title to %s", title);
992 else
993 INFO("Set process title to %s", title);
994 }
995
996 /* We fork() a second time to be reparented to init. Like
997 * POSIX's daemon() function we change to "/" and redirect
998 * std{in,out,err} to /dev/null.
999 */
1000 pid = fork();
1001 if (pid < 0) {
1002 SYSERROR("Failed to fork first child process");
1003 _exit(EXIT_FAILURE);
1004 }
1005
1006 /* second parent */
1007 if (pid != 0) {
1008 free_init_cmd(init_cmd);
1009 lxc_free_handler(handler);
1010 _exit(EXIT_SUCCESS);
1011 }
1012
1013 /* second child */
1014
1015 /* change to / directory */
1016 ret = chdir("/");
1017 if (ret < 0) {
1018 SYSERROR("Failed to change to \"/\" directory");
1019 _exit(EXIT_FAILURE);
1020 }
1021
1022 keepfds[0] = handler->conf->maincmd_fd;
1023 keepfds[1] = handler->state_socket_pair[0];
1024 keepfds[2] = handler->state_socket_pair[1];
1025 ret = lxc_check_inherited(conf, true, keepfds,
1026 sizeof(keepfds) / sizeof(keepfds[0]));
1027 if (ret < 0)
1028 _exit(EXIT_FAILURE);
1029
1030 /* redirect std{in,out,err} to /dev/null */
1031 ret = null_stdfds();
1032 if (ret < 0) {
1033 ERROR("Failed to redirect std{in,out,err} to /dev/null");
1034 _exit(EXIT_FAILURE);
1035 }
1036
1037 /* become session leader */
1038 ret = setsid();
1039 if (ret < 0)
1040 TRACE("Process %d is already process group leader", lxc_raw_getpid());
1041 } else if (!am_single_threaded()) {
1042 ERROR("Cannot start non-daemonized container when threaded");
1043 free_init_cmd(init_cmd);
1044 lxc_free_handler(handler);
1045 return false;
1046 }
1047
1048 /* We need to write PID file after daemonize, so we always write the
1049 * right PID.
1050 */
1051 if (c->pidfile) {
1052 int w;
1053 char pidstr[INTTYPE_TO_STRLEN(pid_t)];
1054
1055 w = snprintf(pidstr, sizeof(pidstr), "%d", lxc_raw_getpid());
1056 if (w < 0 || (size_t)w >= sizeof(pidstr)) {
1057 free_init_cmd(init_cmd);
1058 lxc_free_handler(handler);
1059
1060 SYSERROR("Failed to write monitor pid to \"%s\"", c->pidfile);
1061
1062 if (c->daemonize)
1063 _exit(EXIT_FAILURE);
1064
1065 return false;
1066 }
1067
1068 ret = lxc_write_to_file(c->pidfile, pidstr, w, false, 0600);
1069 if (ret < 0) {
1070 free_init_cmd(init_cmd);
1071 lxc_free_handler(handler);
1072
1073 SYSERROR("Failed to write monitor pid to \"%s\"", c->pidfile);
1074
1075 if (c->daemonize)
1076 _exit(EXIT_FAILURE);
1077
1078 return false;
1079 }
1080 }
1081
1082 conf->reboot = REBOOT_NONE;
1083
1084 /* Unshare the mount namespace if requested */
1085 if (conf->monitor_unshare) {
1086 ret = unshare(CLONE_NEWNS);
1087 if (ret < 0) {
1088 SYSERROR("Failed to unshare mount namespace");
1089 lxc_free_handler(handler);
1090 ret = 1;
1091 goto on_error;
1092 }
1093
1094 ret = mount(NULL, "/", NULL, MS_SLAVE|MS_REC, NULL);
1095 if (ret < 0) {
1096 SYSERROR("Failed to make / rslave at startup");
1097 lxc_free_handler(handler);
1098 ret = 1;
1099 goto on_error;
1100 }
1101 }
1102
1103 reboot:
1104 if (conf->reboot == REBOOT_INIT) {
1105 /* initialize handler */
1106 handler = lxc_init_handler(c->name, conf, c->config_path, c->daemonize);
1107 if (!handler) {
1108 ret = 1;
1109 goto on_error;
1110 }
1111 }
1112
1113 keepfds[0] = handler->conf->maincmd_fd;
1114 keepfds[1] = handler->state_socket_pair[0];
1115 keepfds[2] = handler->state_socket_pair[1];
1116 ret = lxc_check_inherited(conf, c->daemonize, keepfds,
1117 sizeof(keepfds) / sizeof(keepfds[0]));
1118 if (ret < 0) {
1119 lxc_free_handler(handler);
1120 ret = 1;
1121 goto on_error;
1122 }
1123
1124 if (useinit)
1125 ret = lxc_execute(c->name, argv, 1, handler, c->config_path,
1126 c->daemonize, &c->error_num);
1127 else
1128 ret = lxc_start(c->name, argv, handler, c->config_path,
1129 c->daemonize, &c->error_num);
1130
1131 if (conf->reboot == REBOOT_REQ) {
1132 INFO("Container requested reboot");
1133 conf->reboot = REBOOT_INIT;
1134 goto reboot;
1135 }
1136
1137 on_error:
1138 if (c->pidfile) {
1139 unlink(c->pidfile);
1140 free(c->pidfile);
1141 c->pidfile = NULL;
1142 }
1143 free_init_cmd(init_cmd);
1144
1145 if (c->daemonize && ret != 0)
1146 _exit(EXIT_FAILURE);
1147 else if (c->daemonize)
1148 _exit(EXIT_SUCCESS);
1149
1150 if (ret != 0)
1151 return false;
1152
1153 return true;
1154 }
1155
1156 static bool lxcapi_start(struct lxc_container *c, int useinit,
1157 char *const argv[])
1158 {
1159 bool ret;
1160
1161 current_config = c ? c->lxc_conf : NULL;
1162 ret = do_lxcapi_start(c, useinit, argv);
1163 current_config = NULL;
1164
1165 return ret;
1166 }
1167
1168 /* Note, there MUST be an ending NULL. */
1169 static bool lxcapi_startl(struct lxc_container *c, int useinit, ...)
1170 {
1171 va_list ap;
1172 char **inargs = NULL;
1173 bool bret = false;
1174
1175 /* container exists */
1176 if (!c)
1177 return false;
1178
1179 current_config = c->lxc_conf;
1180
1181 va_start(ap, useinit);
1182 inargs = lxc_va_arg_list_to_argv(ap, 0, 1);
1183 va_end(ap);
1184 if (!inargs)
1185 goto on_error;
1186
1187 /* pass NULL if no arguments were supplied */
1188 bret = do_lxcapi_start(c, useinit, *inargs ? inargs : NULL);
1189
1190 on_error:
1191 if (inargs) {
1192 char **arg;
1193
1194 for (arg = inargs; *arg; arg++)
1195 free(*arg);
1196 free(inargs);
1197 }
1198
1199 current_config = NULL;
1200
1201 return bret;
1202 }
1203
1204 static bool do_lxcapi_stop(struct lxc_container *c)
1205 {
1206 int ret;
1207
1208 if (!c)
1209 return false;
1210
1211 ret = lxc_cmd_stop(c->name, c->config_path);
1212
1213 return ret == 0;
1214 }
1215
1216 WRAP_API(bool, lxcapi_stop)
1217
1218 static int do_create_container_dir(const char *path, struct lxc_conf *conf)
1219 {
1220 __do_free char *p = NULL;
1221 int lasterr;
1222 int ret = -1;
1223
1224 mode_t mask = umask(0002);
1225 ret = mkdir(path, 0770);
1226 lasterr = errno;
1227 umask(mask);
1228 errno = lasterr;
1229 if (ret) {
1230 if (errno != EEXIST)
1231 return -1;
1232
1233 ret = 0;
1234 }
1235
1236 p = must_copy_string(path);
1237
1238 if (!lxc_list_empty(&conf->id_map)) {
1239 ret = chown_mapped_root(p, conf);
1240 if (ret < 0)
1241 ret = -1;
1242 }
1243
1244 return ret;
1245 }
1246
1247 /* Create the standard expected container dir. */
1248 static bool create_container_dir(struct lxc_container *c)
1249 {
1250 int ret;
1251 size_t len;
1252 char *s;
1253
1254 len = strlen(c->config_path) + strlen(c->name) + 2;
1255 s = malloc(len);
1256 if (!s)
1257 return false;
1258
1259 ret = snprintf(s, len, "%s/%s", c->config_path, c->name);
1260 if (ret < 0 || (size_t)ret >= len) {
1261 free(s);
1262 return false;
1263 }
1264
1265 ret = do_create_container_dir(s, c->lxc_conf);
1266 free(s);
1267
1268 return ret == 0;
1269 }
1270
1271 /* do_storage_create: thin wrapper around storage_create(). Like
1272 * storage_create(), it returns a mounted bdev on success, NULL on error.
1273 */
1274 static struct lxc_storage *do_storage_create(struct lxc_container *c,
1275 const char *type,
1276 struct bdev_specs *specs)
1277 {
1278 __do_free char *dest = NULL;
1279 int ret;
1280 size_t len;
1281 struct lxc_storage *bdev;
1282
1283 /* rootfs.path or lxcpath/lxcname/rootfs */
1284 if (c->lxc_conf->rootfs.path &&
1285 (access(c->lxc_conf->rootfs.path, F_OK) == 0)) {
1286 const char *rpath = c->lxc_conf->rootfs.path;
1287 len = strlen(rpath) + 1;
1288 dest = must_realloc(NULL, len);
1289 ret = snprintf(dest, len, "%s", rpath);
1290 } else {
1291 const char *lxcpath = do_lxcapi_get_config_path(c);
1292 len = strlen(c->name) + strlen(lxcpath) + 9;
1293 dest = must_realloc(NULL, len);
1294 ret = snprintf(dest, len, "%s/%s/rootfs", lxcpath, c->name);
1295 }
1296 if (ret < 0 || (size_t)ret >= len)
1297 return NULL;
1298
1299 bdev = storage_create(dest, type, c->name, specs);
1300 if (!bdev) {
1301 ERROR("Failed to create \"%s\" storage", type);
1302 return NULL;
1303 }
1304
1305 if (!c->set_config_item(c, "lxc.rootfs.path", bdev->src)) {
1306 ERROR("Failed to set \"lxc.rootfs.path = %s\"", bdev->src);
1307 storage_put(bdev);
1308 return NULL;
1309 }
1310
1311 /* If we are not root, chown the rootfs dir to root in the target user
1312 * namespace.
1313 */
1314 ret = geteuid();
1315 if (ret != 0 || (c->lxc_conf && !lxc_list_empty(&c->lxc_conf->id_map))) {
1316 ret = chown_mapped_root(bdev->dest, c->lxc_conf);
1317 if (ret < 0) {
1318 ERROR("Error chowning \"%s\" to container root", bdev->dest);
1319 suggest_default_idmap();
1320 storage_put(bdev);
1321 return NULL;
1322 }
1323 }
1324
1325 return bdev;
1326 }
1327
1328 /* Strip path and return name of file for argv[0] passed to execvp */
1329 static char *lxctemplatefilename(char *tpath)
1330 {
1331 char *p;
1332
1333 p = tpath + strlen(tpath) - 1;
1334 while ( (p-1) >= tpath && *(p-1) != '/')
1335 p--;
1336
1337 return p;
1338 }
1339
1340 static bool create_run_template(struct lxc_container *c, char *tpath,
1341 bool need_null_stdfds, char *const argv[])
1342 {
1343 int ret;
1344 pid_t pid;
1345
1346 if (!tpath)
1347 return true;
1348
1349 pid = fork();
1350 if (pid < 0) {
1351 SYSERROR("Failed to fork task for container creation template");
1352 return false;
1353 }
1354
1355 if (pid == 0) { /* child */
1356 int i, len;
1357 char *namearg, *patharg, *rootfsarg;
1358 char **newargv;
1359 int nargs = 0;
1360 struct lxc_storage *bdev = NULL;
1361 struct lxc_conf *conf = c->lxc_conf;
1362 uid_t euid;
1363
1364 if (need_null_stdfds) {
1365 ret = null_stdfds();
1366 if (ret < 0)
1367 _exit(EXIT_FAILURE);
1368 }
1369
1370 bdev = storage_init(c->lxc_conf);
1371 if (!bdev) {
1372 ERROR("Failed to initialize storage");
1373 _exit(EXIT_FAILURE);
1374 }
1375
1376 euid = geteuid();
1377 if (euid == 0) {
1378 ret = unshare(CLONE_NEWNS);
1379 if (ret < 0) {
1380 ERROR("Failed to unshare CLONE_NEWNS");
1381 _exit(EXIT_FAILURE);
1382 }
1383
1384 ret = detect_shared_rootfs();
1385 if (ret == 1) {
1386 ret = mount(NULL, "/", NULL, MS_SLAVE | MS_REC, NULL);
1387 if (ret < 0) {
1388 SYSERROR("Failed to make \"/\" rslave");
1389 ERROR("Continuing...");
1390 }
1391 }
1392 }
1393
1394 if (strcmp(bdev->type, "dir") != 0 && strcmp(bdev->type, "btrfs") != 0) {
1395 if (euid != 0) {
1396 ERROR("Unprivileged users can only create "
1397 "btrfs and directory-backed containers");
1398 _exit(EXIT_FAILURE);
1399 }
1400
1401 if (strcmp(bdev->type, "overlay") == 0 ||
1402 strcmp(bdev->type, "overlayfs") == 0) {
1403 /* If we create an overlay container we need to
1404 * rsync the contents into
1405 * <container-path>/<container-name>/rootfs.
1406 * However, the overlay mount function will
1407 * mount will mount
1408 * <container-path>/<container-name>/delta0
1409 * over
1410 * <container-path>/<container-name>/rootfs
1411 * which means we would rsync the rootfs into
1412 * the delta directory. That doesn't make sense
1413 * since the delta directory only exists to
1414 * record the differences to
1415 * <container-path>/<container-name>/rootfs. So
1416 * let's simply bind-mount here and then rsync
1417 * directly into
1418 * <container-path>/<container-name>/rootfs.
1419 */
1420 char *src;
1421
1422 src = ovl_get_rootfs(bdev->src, &(size_t){0});
1423 if (!src) {
1424 ERROR("Failed to get rootfs");
1425 _exit(EXIT_FAILURE);
1426 }
1427
1428 ret = mount(src, bdev->dest, "bind", MS_BIND | MS_REC, NULL);
1429 if (ret < 0) {
1430 ERROR("Failed to mount rootfs");
1431 _exit(EXIT_FAILURE);
1432 }
1433 } else {
1434 ret = bdev->ops->mount(bdev);
1435 if (ret < 0) {
1436 ERROR("Failed to mount rootfs");
1437 _exit(EXIT_FAILURE);
1438 }
1439 }
1440 } else { /* TODO come up with a better way here! */
1441 const char *src;
1442 free(bdev->dest);
1443 src = lxc_storage_get_path(bdev->src, bdev->type);
1444 bdev->dest = strdup(src);
1445 }
1446
1447 /* Create our new array, pre-pend the template name and base
1448 * args.
1449 */
1450 if (argv)
1451 for (nargs = 0; argv[nargs]; nargs++)
1452 ;
1453
1454 /* template, path, rootfs and name args */
1455 nargs += 4;
1456
1457 newargv = malloc(nargs * sizeof(*newargv));
1458 if (!newargv)
1459 _exit(EXIT_FAILURE);
1460 newargv[0] = lxctemplatefilename(tpath);
1461
1462 /* --path */
1463 len = strlen(c->config_path) + strlen(c->name) + strlen("--path=") + 2;
1464 patharg = malloc(len);
1465 if (!patharg)
1466 _exit(EXIT_FAILURE);
1467
1468 ret = snprintf(patharg, len, "--path=%s/%s", c->config_path, c->name);
1469 if (ret < 0 || ret >= len)
1470 _exit(EXIT_FAILURE);
1471 newargv[1] = patharg;
1472
1473 /* --name */
1474 len = strlen("--name=") + strlen(c->name) + 1;
1475 namearg = malloc(len);
1476 if (!namearg)
1477 _exit(EXIT_FAILURE);
1478
1479 ret = snprintf(namearg, len, "--name=%s", c->name);
1480 if (ret < 0 || ret >= len)
1481 _exit(EXIT_FAILURE);
1482 newargv[2] = namearg;
1483
1484 /* --rootfs */
1485 len = strlen("--rootfs=") + 1 + strlen(bdev->dest);
1486 rootfsarg = malloc(len);
1487 if (!rootfsarg)
1488 _exit(EXIT_FAILURE);
1489
1490 ret = snprintf(rootfsarg, len, "--rootfs=%s", bdev->dest);
1491 if (ret < 0 || ret >= len)
1492 _exit(EXIT_FAILURE);
1493 newargv[3] = rootfsarg;
1494
1495 /* add passed-in args */
1496 if (argv)
1497 for (i = 4; i < nargs; i++)
1498 newargv[i] = argv[i - 4];
1499
1500 /* add trailing NULL */
1501 nargs++;
1502 newargv = realloc(newargv, nargs * sizeof(*newargv));
1503 if (!newargv)
1504 _exit(EXIT_FAILURE);
1505 newargv[nargs - 1] = NULL;
1506
1507 /* If we're running the template in a mapped userns, then we
1508 * prepend the template command with: lxc-usernsexec <-m map1>
1509 * ... <-m mapn> -- and we append "--mapped-uid x", where x is
1510 * the mapped uid for our geteuid()
1511 */
1512 if (!lxc_list_empty(&conf->id_map)) {
1513 int extraargs, hostuid_mapped, hostgid_mapped;
1514 char **n2;
1515 char txtuid[20], txtgid[20];
1516 struct lxc_list *it;
1517 struct id_map *map;
1518 int n2args = 1;
1519
1520 n2 = malloc(n2args * sizeof(*n2));
1521 if (!n2)
1522 _exit(EXIT_FAILURE);
1523
1524 newargv[0] = tpath;
1525 tpath = "lxc-usernsexec";
1526 n2[0] = "lxc-usernsexec";
1527
1528 lxc_list_for_each(it, &conf->id_map) {
1529 map = it->elem;
1530 n2args += 2;
1531 n2 = realloc(n2, n2args * sizeof(char *));
1532 if (!n2)
1533 _exit(EXIT_FAILURE);
1534
1535 n2[n2args - 2] = "-m";
1536 n2[n2args - 1] = malloc(200);
1537 if (!n2[n2args - 1])
1538 _exit(EXIT_FAILURE);
1539
1540 ret = snprintf(n2[n2args - 1], 200, "%c:%lu:%lu:%lu",
1541 map->idtype == ID_TYPE_UID ? 'u' : 'g',
1542 map->nsid, map->hostid, map->range);
1543 if (ret < 0 || ret >= 200)
1544 _exit(EXIT_FAILURE);
1545 }
1546
1547 hostuid_mapped = mapped_hostid(geteuid(), conf, ID_TYPE_UID);
1548 extraargs = hostuid_mapped >= 0 ? 1 : 3;
1549
1550 n2 = realloc(n2, (nargs + n2args + extraargs) * sizeof(char *));
1551 if (!n2)
1552 _exit(EXIT_FAILURE);
1553
1554 if (hostuid_mapped < 0) {
1555 hostuid_mapped = find_unmapped_nsid(conf, ID_TYPE_UID);
1556 n2[n2args++] = "-m";
1557 if (hostuid_mapped < 0) {
1558 ERROR("Failed to find free uid to map");
1559 _exit(EXIT_FAILURE);
1560 }
1561
1562 n2[n2args++] = malloc(200);
1563 if (!n2[n2args - 1]) {
1564 SYSERROR("out of memory");
1565 _exit(EXIT_FAILURE);
1566 }
1567
1568 ret = snprintf(n2[n2args - 1], 200, "u:%d:%d:1",
1569 hostuid_mapped, geteuid());
1570 if (ret < 0 || ret >= 200)
1571 _exit(EXIT_FAILURE);
1572 }
1573
1574 hostgid_mapped = mapped_hostid(getegid(), conf, ID_TYPE_GID);
1575 extraargs = hostgid_mapped >= 0 ? 1 : 3;
1576
1577 n2 = realloc(n2, (nargs + n2args + extraargs) * sizeof(char *));
1578 if (!n2)
1579 _exit(EXIT_FAILURE);
1580
1581 if (hostgid_mapped < 0) {
1582 hostgid_mapped = find_unmapped_nsid(conf, ID_TYPE_GID);
1583 n2[n2args++] = "-m";
1584 if (hostgid_mapped < 0) {
1585 ERROR("Failed to find free gid to map");
1586 _exit(EXIT_FAILURE);
1587 }
1588
1589 n2[n2args++] = malloc(200);
1590 if (!n2[n2args - 1]) {
1591 SYSERROR("out of memory");
1592 _exit(EXIT_FAILURE);
1593 }
1594
1595 ret = snprintf(n2[n2args - 1], 200, "g:%d:%d:1",
1596 hostgid_mapped, getegid());
1597 if (ret < 0 || ret >= 200)
1598 _exit(EXIT_FAILURE);
1599 }
1600
1601 n2[n2args++] = "--";
1602
1603 for (i = 0; i < nargs; i++)
1604 n2[i + n2args] = newargv[i];
1605 n2args += nargs;
1606
1607 /* Finally add "--mapped-uid $uid" to tell template what
1608 * to chown cached images to.
1609 */
1610 n2args += 4;
1611 n2 = realloc(n2, n2args * sizeof(char *));
1612 if (!n2)
1613 _exit(EXIT_FAILURE);
1614
1615 /* note n2[n2args-1] is NULL */
1616 n2[n2args - 5] = "--mapped-uid";
1617
1618 ret = snprintf(txtuid, 20, "%d", hostuid_mapped);
1619 if (ret < 0 || ret >= 20) {
1620 free(newargv);
1621 free(n2);
1622 _exit(EXIT_FAILURE);
1623 }
1624
1625 n2[n2args - 4] = txtuid;
1626 n2[n2args - 3] = "--mapped-gid";
1627
1628 ret = snprintf(txtgid, 20, "%d", hostgid_mapped);
1629 if (ret < 0 || ret >= 20) {
1630 free(newargv);
1631 free(n2);
1632 _exit(EXIT_FAILURE);
1633 }
1634
1635 n2[n2args - 2] = txtgid;
1636 n2[n2args - 1] = NULL;
1637 free(newargv);
1638 newargv = n2;
1639 }
1640
1641 execvp(tpath, newargv);
1642 SYSERROR("Failed to execute template %s", tpath);
1643 _exit(EXIT_FAILURE);
1644 }
1645
1646 ret = wait_for_pid(pid);
1647 if (ret != 0) {
1648 ERROR("Failed to create container from template");
1649 return false;
1650 }
1651
1652 return true;
1653 }
1654
1655 static bool prepend_lxc_header(char *path, const char *t, char *const argv[])
1656 {
1657 long flen;
1658 size_t len;
1659 char *contents;
1660 FILE *f;
1661 int ret = -1;
1662 #if HAVE_OPENSSL
1663 int i, md_len = 0;
1664 unsigned char md_value[EVP_MAX_MD_SIZE];
1665 char *tpath;
1666 #endif
1667
1668 f = fopen(path, "r");
1669 if (f == NULL)
1670 return false;
1671
1672 ret = fseek(f, 0, SEEK_END);
1673 if (ret < 0)
1674 goto out_error;
1675
1676 ret = -1;
1677 flen = ftell(f);
1678 if (flen < 0)
1679 goto out_error;
1680
1681 ret = fseek(f, 0, SEEK_SET);
1682 if (ret < 0)
1683 goto out_error;
1684
1685 ret = fseek(f, 0, SEEK_SET);
1686 if (ret < 0)
1687 goto out_error;
1688
1689 ret = -1;
1690 contents = malloc(flen + 1);
1691 if (!contents)
1692 goto out_error;
1693
1694 len = fread(contents, 1, flen, f);
1695 if (len != flen)
1696 goto out_free_contents;
1697
1698 contents[flen] = '\0';
1699
1700 ret = fclose(f);
1701 f = NULL;
1702 if (ret < 0)
1703 goto out_free_contents;
1704
1705 #if HAVE_OPENSSL
1706 tpath = get_template_path(t);
1707 if (!tpath) {
1708 ERROR("Invalid template \"%s\" specified", t);
1709 goto out_free_contents;
1710 }
1711
1712 ret = sha1sum_file(tpath, md_value, &md_len);
1713 if (ret < 0) {
1714 ERROR("Failed to get sha1sum of %s", tpath);
1715 free(tpath);
1716 goto out_free_contents;
1717 }
1718 free(tpath);
1719 #endif
1720
1721 f = fopen(path, "w");
1722 if (f == NULL) {
1723 SYSERROR("Reopening config for writing");
1724 free(contents);
1725 return false;
1726 }
1727
1728 fprintf(f, "# Template used to create this container: %s\n", t);
1729 if (argv) {
1730 fprintf(f, "# Parameters passed to the template:");
1731 while (*argv) {
1732 fprintf(f, " %s", *argv);
1733 argv++;
1734 }
1735 fprintf(f, "\n");
1736 }
1737
1738 #if HAVE_OPENSSL
1739 fprintf(f, "# Template script checksum (SHA-1): ");
1740 for (i=0; i<md_len; i++)
1741 fprintf(f, "%02x", md_value[i]);
1742 fprintf(f, "\n");
1743 #endif
1744 fprintf(f, "# For additional config options, please look at lxc.container.conf(5)\n");
1745 fprintf(f, "\n# Uncomment the following line to support nesting containers:\n");
1746 fprintf(f, "#lxc.include = " LXCTEMPLATECONFIG "/nesting.conf\n");
1747 fprintf(f, "# (Be aware this has security implications)\n\n");
1748 if (fwrite(contents, 1, flen, f) != flen) {
1749 SYSERROR("Writing original contents");
1750 free(contents);
1751 fclose(f);
1752 return false;
1753 }
1754
1755 ret = 0;
1756
1757 out_free_contents:
1758 free(contents);
1759
1760 out_error:
1761 if (f) {
1762 int newret;
1763 newret = fclose(f);
1764 if (ret == 0)
1765 ret = newret;
1766 }
1767
1768 if (ret < 0) {
1769 SYSERROR("Error prepending header");
1770 return false;
1771 }
1772
1773 return true;
1774 }
1775
1776 static void lxcapi_clear_config(struct lxc_container *c)
1777 {
1778 if (!c || !c->lxc_conf)
1779 return;
1780
1781 lxc_conf_free(c->lxc_conf);
1782 c->lxc_conf = NULL;
1783 }
1784
1785 #define do_lxcapi_clear_config(c) lxcapi_clear_config(c)
1786
1787 /*
1788 * lxcapi_create:
1789 * create a container with the given parameters.
1790 * @c: container to be created. It has the lxcpath, name, and a starting
1791 * configuration already set
1792 * @t: the template to execute to instantiate the root filesystem and
1793 * adjust the configuration.
1794 * @bdevtype: backing store type to use. If NULL, dir will be used.
1795 * @specs: additional parameters for the backing store, i.e. LVM vg to
1796 * use.
1797 *
1798 * @argv: the arguments to pass to the template, terminated by NULL. If no
1799 * arguments, you can just pass NULL.
1800 */
1801 static bool do_lxcapi_create(struct lxc_container *c, const char *t,
1802 const char *bdevtype, struct bdev_specs *specs,
1803 int flags, char *const argv[])
1804 {
1805 int partial_fd;
1806 mode_t mask;
1807 pid_t pid;
1808 bool ret = false, rootfs_managed = true;
1809 char *tpath = NULL;
1810
1811 if (!c)
1812 return false;
1813
1814 if (t) {
1815 tpath = get_template_path(t);
1816 if (!tpath) {
1817 ERROR("Unknown template \"%s\"", t);
1818 goto out;
1819 }
1820 }
1821
1822 /* If a template is passed in, and the rootfs already is defined in the
1823 * container config and exists, then the caller is trying to create an
1824 * existing container. Return an error, but do NOT delete the container.
1825 */
1826 if (do_lxcapi_is_defined(c) && c->lxc_conf && c->lxc_conf->rootfs.path &&
1827 access(c->lxc_conf->rootfs.path, F_OK) == 0 && tpath) {
1828 ERROR("Container \"%s\" already exists in \"%s\"", c->name,
1829 c->config_path);
1830 goto free_tpath;
1831 }
1832
1833 if (!c->lxc_conf) {
1834 if (!do_lxcapi_load_config(c, lxc_global_config_value("lxc.default_config"))) {
1835 ERROR("Error loading default configuration file %s",
1836 lxc_global_config_value("lxc.default_config"));
1837 goto free_tpath;
1838 }
1839 }
1840
1841 if (!create_container_dir(c))
1842 goto free_tpath;
1843
1844 if (c->lxc_conf->rootfs.path)
1845 rootfs_managed = false;
1846
1847 /* If both template and rootfs.path are set, template is setup as
1848 * rootfs.path. The container is already created if we have a config and
1849 * rootfs.path is accessible
1850 */
1851 if (!c->lxc_conf->rootfs.path && !tpath) {
1852 /* No template passed in and rootfs does not exist. */
1853 if (!c->save_config(c, NULL)) {
1854 ERROR("Failed to save initial config for \"%s\"", c->name);
1855 goto out;
1856 }
1857 ret = true;
1858 goto out;
1859 }
1860
1861 /* Rootfs passed into configuration, but does not exist. */
1862 if (c->lxc_conf->rootfs.path && access(c->lxc_conf->rootfs.path, F_OK) != 0)
1863 goto out;
1864
1865 if (do_lxcapi_is_defined(c) && c->lxc_conf->rootfs.path && !tpath) {
1866 /* Rootfs already existed, user just wanted to save the loaded
1867 * configuration.
1868 */
1869 if (!c->save_config(c, NULL))
1870 ERROR("Failed to save initial config for \"%s\"", c->name);
1871
1872 ret = true;
1873 goto out;
1874 }
1875
1876 /* Mark that this container is being created */
1877 partial_fd = create_partial(c);
1878 if (partial_fd < 0)
1879 goto out;
1880
1881 /* No need to get disk lock bc we have the partial lock. */
1882
1883 mask = umask(0022);
1884
1885 /* Create the storage.
1886 * Note we can't do this in the same task as we use to execute the
1887 * template because of the way zfs works.
1888 * After you 'zfs create', zfs mounts the fs only in the initial
1889 * namespace.
1890 */
1891 pid = fork();
1892 if (pid < 0) {
1893 SYSERROR("Failed to fork task for container creation template");
1894 goto out_unlock;
1895 }
1896
1897 if (pid == 0) { /* child */
1898 struct lxc_storage *bdev = NULL;
1899
1900 bdev = do_storage_create(c, bdevtype, specs);
1901 if (!bdev) {
1902 ERROR("Failed to create %s storage for %s",
1903 bdevtype ? bdevtype : "(none)", c->name);
1904 _exit(EXIT_FAILURE);
1905 }
1906
1907 /* Save config file again to store the new rootfs location. */
1908 if (!do_lxcapi_save_config(c, NULL)) {
1909 ERROR("Failed to save initial config for %s", c->name);
1910 /* Parent task won't see the storage driver in the
1911 * config so we delete it.
1912 */
1913 bdev->ops->umount(bdev);
1914 bdev->ops->destroy(bdev);
1915 _exit(EXIT_FAILURE);
1916 }
1917
1918 _exit(EXIT_SUCCESS);
1919 }
1920
1921 if (wait_for_pid(pid) != 0)
1922 goto out_unlock;
1923
1924 /* Reload config to get the rootfs. */
1925 lxc_conf_free(c->lxc_conf);
1926 c->lxc_conf = NULL;
1927
1928 if (!load_config_locked(c, c->configfile))
1929 goto out_unlock;
1930
1931 if (!create_run_template(c, tpath, !!(flags & LXC_CREATE_QUIET), argv))
1932 goto out_unlock;
1933
1934 /* Now clear out the lxc_conf we have, reload from the created
1935 * container.
1936 */
1937 do_lxcapi_clear_config(c);
1938
1939 if (t) {
1940 if (!prepend_lxc_header(c->configfile, tpath, argv)) {
1941 ERROR("Failed to prepend header to config file");
1942 goto out_unlock;
1943 }
1944 }
1945
1946 ret = load_config_locked(c, c->configfile);
1947
1948 out_unlock:
1949 umask(mask);
1950 remove_partial(c, partial_fd);
1951
1952 out:
1953 if (!ret) {
1954 bool reset_managed = c->lxc_conf->rootfs.managed;
1955
1956 /*
1957 * Ensure that we don't destroy storage we didn't create
1958 * ourselves.
1959 */
1960 if (!rootfs_managed)
1961 c->lxc_conf->rootfs.managed = false;
1962 container_destroy(c, NULL);
1963 c->lxc_conf->rootfs.managed = reset_managed;
1964 }
1965
1966 free_tpath:
1967 free(tpath);
1968 return ret;
1969 }
1970
1971 static bool lxcapi_create(struct lxc_container *c, const char *t,
1972 const char *bdevtype, struct bdev_specs *specs,
1973 int flags, char *const argv[])
1974 {
1975 bool ret;
1976
1977 current_config = c ? c->lxc_conf : NULL;
1978
1979 ret = do_lxcapi_create(c, t, bdevtype, specs, flags, argv);
1980 current_config = NULL;
1981 return ret;
1982 }
1983
1984 static bool do_lxcapi_reboot(struct lxc_container *c)
1985 {
1986 int ret;
1987 pid_t pid;
1988 int rebootsignal = SIGINT;
1989
1990 if (!c)
1991 return false;
1992
1993 if (!do_lxcapi_is_running(c))
1994 return false;
1995
1996 pid = do_lxcapi_init_pid(c);
1997 if (pid <= 0)
1998 return false;
1999
2000 if (c->lxc_conf && c->lxc_conf->rebootsignal)
2001 rebootsignal = c->lxc_conf->rebootsignal;
2002
2003 ret = kill(pid, rebootsignal);
2004 if (ret < 0) {
2005 WARN("Failed to send signal %d to pid %d", rebootsignal, pid);
2006 return false;
2007 }
2008
2009 return true;
2010 }
2011
2012 WRAP_API(bool, lxcapi_reboot)
2013
2014 static bool do_lxcapi_reboot2(struct lxc_container *c, int timeout)
2015 {
2016 int killret, ret;
2017 pid_t pid;
2018 int rebootsignal = SIGINT, state_client_fd = -1;
2019 lxc_state_t states[MAX_STATE] = {0};
2020
2021 if (!c)
2022 return false;
2023
2024 if (!do_lxcapi_is_running(c))
2025 return true;
2026
2027 pid = do_lxcapi_init_pid(c);
2028 if (pid <= 0)
2029 return true;
2030
2031 if (c->lxc_conf && c->lxc_conf->rebootsignal)
2032 rebootsignal = c->lxc_conf->rebootsignal;
2033
2034 /* Add a new state client before sending the shutdown signal so that we
2035 * don't miss a state.
2036 */
2037 if (timeout != 0) {
2038 states[RUNNING] = 2;
2039 ret = lxc_cmd_add_state_client(c->name, c->config_path, states,
2040 &state_client_fd);
2041 if (ret < 0)
2042 return false;
2043
2044 if (state_client_fd < 0)
2045 return false;
2046
2047 if (ret == RUNNING)
2048 return true;
2049
2050 if (ret < MAX_STATE)
2051 return false;
2052 }
2053
2054 /* Send reboot signal to container. */
2055 killret = kill(pid, rebootsignal);
2056 if (killret < 0) {
2057 if (state_client_fd >= 0)
2058 close(state_client_fd);
2059
2060 WARN("Failed to send signal %d to pid %d", rebootsignal, pid);
2061 return false;
2062 }
2063 TRACE("Sent signal %d to pid %d", rebootsignal, pid);
2064
2065 if (timeout == 0)
2066 return true;
2067
2068 ret = lxc_cmd_sock_rcv_state(state_client_fd, timeout);
2069 close(state_client_fd);
2070 if (ret < 0)
2071 return false;
2072
2073 TRACE("Received state \"%s\"", lxc_state2str(ret));
2074 if (ret != RUNNING)
2075 return false;
2076
2077 return true;
2078 }
2079
2080 WRAP_API_1(bool, lxcapi_reboot2, int)
2081
2082 static bool do_lxcapi_shutdown(struct lxc_container *c, int timeout)
2083 {
2084 int killret, ret;
2085 pid_t pid;
2086 int haltsignal = SIGPWR, state_client_fd = -EBADF;
2087 lxc_state_t states[MAX_STATE] = {0};
2088
2089 if (!c)
2090 return false;
2091
2092 if (!do_lxcapi_is_running(c))
2093 return true;
2094
2095 pid = do_lxcapi_init_pid(c);
2096 if (pid <= 0)
2097 return true;
2098
2099 /* Detect whether we should send SIGRTMIN + 3 (e.g. systemd). */
2100 if (c->lxc_conf && c->lxc_conf->haltsignal)
2101 haltsignal = c->lxc_conf->haltsignal;
2102 else if (task_blocks_signal(pid, (SIGRTMIN + 3)))
2103 haltsignal = (SIGRTMIN + 3);
2104
2105 /* Add a new state client before sending the shutdown signal so that we
2106 * don't miss a state.
2107 */
2108 if (timeout != 0) {
2109 states[STOPPED] = 1;
2110 ret = lxc_cmd_add_state_client(c->name, c->config_path, states,
2111 &state_client_fd);
2112 if (ret < 0)
2113 return false;
2114
2115 if (state_client_fd < 0)
2116 return false;
2117
2118 if (ret == STOPPED)
2119 return true;
2120
2121 if (ret < MAX_STATE)
2122 return false;
2123 }
2124
2125 /* Send shutdown signal to container. */
2126 killret = kill(pid, haltsignal);
2127 if (killret < 0) {
2128 if (state_client_fd >= 0)
2129 close(state_client_fd);
2130
2131 WARN("Failed to send signal %d to pid %d", haltsignal, pid);
2132 return false;
2133 }
2134 TRACE("Sent signal %d to pid %d", haltsignal, pid);
2135
2136 if (timeout == 0)
2137 return true;
2138
2139 ret = lxc_cmd_sock_rcv_state(state_client_fd, timeout);
2140 close(state_client_fd);
2141 if (ret < 0)
2142 return false;
2143
2144 TRACE("Received state \"%s\"", lxc_state2str(ret));
2145 if (ret != STOPPED)
2146 return false;
2147
2148 return true;
2149 }
2150
2151 WRAP_API_1(bool, lxcapi_shutdown, int)
2152
2153 static bool lxcapi_createl(struct lxc_container *c, const char *t,
2154 const char *bdevtype, struct bdev_specs *specs, int flags, ...)
2155 {
2156 bool bret = false;
2157 char **args = NULL;
2158 va_list ap;
2159
2160 if (!c)
2161 return false;
2162
2163 current_config = c->lxc_conf;
2164
2165 /*
2166 * since we're going to wait for create to finish, I don't think we
2167 * need to get a copy of the arguments.
2168 */
2169 va_start(ap, flags);
2170 args = lxc_va_arg_list_to_argv(ap, 0, 0);
2171 va_end(ap);
2172 if (!args) {
2173 ERROR("Failed to allocate memory");
2174 goto out;
2175 }
2176
2177 bret = do_lxcapi_create(c, t, bdevtype, specs, flags, args);
2178
2179 out:
2180 free(args);
2181 current_config = NULL;
2182 return bret;
2183 }
2184
2185 static void do_clear_unexp_config_line(struct lxc_conf *conf, const char *key)
2186 {
2187 if (!strcmp(key, "lxc.cgroup"))
2188 return clear_unexp_config_line(conf, key, true);
2189
2190 if (!strcmp(key, "lxc.network"))
2191 return clear_unexp_config_line(conf, key, true);
2192
2193 if (!strcmp(key, "lxc.net"))
2194 return clear_unexp_config_line(conf, key, true);
2195
2196 /* Clear a network with a specific index. */
2197 if (!strncmp(key, "lxc.net.", 8)) {
2198 int ret;
2199 const char *idx;
2200
2201 idx = key + 8;
2202 ret = lxc_safe_uint(idx, &(unsigned int){0});
2203 if (!ret)
2204 return clear_unexp_config_line(conf, key, true);
2205 }
2206
2207 if (!strcmp(key, "lxc.hook"))
2208 return clear_unexp_config_line(conf, key, true);
2209
2210 return clear_unexp_config_line(conf, key, false);
2211 }
2212
2213 static bool do_lxcapi_clear_config_item(struct lxc_container *c,
2214 const char *key)
2215 {
2216 int ret = 1;
2217 struct lxc_config_t *config;
2218
2219 if (!c || !c->lxc_conf)
2220 return false;
2221
2222 if (container_mem_lock(c))
2223 return false;
2224
2225 config = lxc_get_config(key);
2226 /* Verify that the config key exists and that it has a callback
2227 * implemented.
2228 */
2229 if (config && config->clr)
2230 ret = config->clr(key, c->lxc_conf, NULL);
2231
2232 if (!ret)
2233 do_clear_unexp_config_line(c->lxc_conf, key);
2234
2235 container_mem_unlock(c);
2236 return ret == 0;
2237 }
2238
2239 WRAP_API_1(bool, lxcapi_clear_config_item, const char *)
2240
2241 static inline bool enter_net_ns(struct lxc_container *c)
2242 {
2243 pid_t pid = do_lxcapi_init_pid(c);
2244
2245 if (pid < 0)
2246 return false;
2247
2248 if ((geteuid() != 0 || (c->lxc_conf && !lxc_list_empty(&c->lxc_conf->id_map))) &&
2249 (access("/proc/self/ns/user", F_OK) == 0))
2250 if (!switch_to_ns(pid, "user"))
2251 return false;
2252
2253 return switch_to_ns(pid, "net");
2254 }
2255
2256 /* Used by qsort and bsearch functions for comparing names. */
2257 static inline int string_cmp(char **first, char **second)
2258 {
2259 return strcmp(*first, *second);
2260 }
2261
2262 /* Used by qsort and bsearch functions for comparing container names. */
2263 static inline int container_cmp(struct lxc_container **first,
2264 struct lxc_container **second)
2265 {
2266 return strcmp((*first)->name, (*second)->name);
2267 }
2268
2269 static bool add_to_array(char ***names, char *cname, int pos)
2270 {
2271 char **newnames = realloc(*names, (pos+1) * sizeof(char *));
2272 if (!newnames) {
2273 ERROR("Out of memory");
2274 return false;
2275 }
2276
2277 *names = newnames;
2278 newnames[pos] = strdup(cname);
2279 if (!newnames[pos])
2280 return false;
2281
2282 /* Sort the array as we will use binary search on it. */
2283 qsort(newnames, pos + 1, sizeof(char *),
2284 (int (*)(const void *, const void *))string_cmp);
2285
2286 return true;
2287 }
2288
2289 static bool add_to_clist(struct lxc_container ***list, struct lxc_container *c,
2290 int pos, bool sort)
2291 {
2292 struct lxc_container **newlist = realloc(*list, (pos + 1) * sizeof(struct lxc_container *));
2293 if (!newlist) {
2294 ERROR("Out of memory");
2295 return false;
2296 }
2297
2298 *list = newlist;
2299 newlist[pos] = c;
2300
2301 /* Sort the array as we will use binary search on it. */
2302 if (sort)
2303 qsort(newlist, pos + 1, sizeof(struct lxc_container *),
2304 (int (*)(const void *, const void *))container_cmp);
2305
2306 return true;
2307 }
2308
2309 static char** get_from_array(char ***names, char *cname, int size)
2310 {
2311 return (char **)bsearch(&cname, *names, size, sizeof(char *), (int (*)(const void *, const void *))string_cmp);
2312 }
2313
2314 static bool array_contains(char ***names, char *cname, int size)
2315 {
2316 if(get_from_array(names, cname, size) != NULL)
2317 return true;
2318
2319 return false;
2320 }
2321
2322 static bool remove_from_array(char ***names, char *cname, int size)
2323 {
2324 char **result = get_from_array(names, cname, size);
2325 if (result != NULL) {
2326 free(result);
2327 return true;
2328 }
2329
2330 return false;
2331 }
2332
2333 static char **do_lxcapi_get_interfaces(struct lxc_container *c)
2334 {
2335 pid_t pid;
2336 int i, count = 0, pipefd[2];
2337 char **interfaces = NULL;
2338 char interface[IFNAMSIZ];
2339
2340 if (pipe2(pipefd, O_CLOEXEC) < 0)
2341 return NULL;
2342
2343 pid = fork();
2344 if (pid < 0) {
2345 SYSERROR("Failed to fork task to get interfaces information");
2346 close(pipefd[0]);
2347 close(pipefd[1]);
2348 return NULL;
2349 }
2350
2351 if (pid == 0) { /* child */
2352 int ret = 1, nbytes;
2353 struct netns_ifaddrs *interfaceArray = NULL, *tempIfAddr = NULL;
2354
2355 /* close the read-end of the pipe */
2356 close(pipefd[0]);
2357
2358 if (!enter_net_ns(c)) {
2359 SYSERROR("Failed to enter network namespace");
2360 goto out;
2361 }
2362
2363 /* Grab the list of interfaces */
2364 if (netns_getifaddrs(&interfaceArray, -1, &(bool){false})) {
2365 SYSERROR("Failed to get interfaces list");
2366 goto out;
2367 }
2368
2369 /* Iterate through the interfaces */
2370 for (tempIfAddr = interfaceArray; tempIfAddr != NULL;
2371 tempIfAddr = tempIfAddr->ifa_next) {
2372 nbytes = lxc_write_nointr(pipefd[1], tempIfAddr->ifa_name, IFNAMSIZ);
2373 if (nbytes < 0)
2374 goto out;
2375
2376 count++;
2377 }
2378
2379 ret = 0;
2380
2381 out:
2382 if (interfaceArray)
2383 netns_freeifaddrs(interfaceArray);
2384
2385 /* close the write-end of the pipe, thus sending EOF to the reader */
2386 close(pipefd[1]);
2387 _exit(ret);
2388 }
2389
2390 /* close the write-end of the pipe */
2391 close(pipefd[1]);
2392
2393 while (lxc_read_nointr(pipefd[0], &interface, IFNAMSIZ) == IFNAMSIZ) {
2394 interface[IFNAMSIZ - 1] = '\0';
2395
2396 if (array_contains(&interfaces, interface, count))
2397 continue;
2398
2399 if (!add_to_array(&interfaces, interface, count))
2400 ERROR("Failed to add \"%s\" to array", interface);
2401
2402 count++;
2403 }
2404
2405 if (wait_for_pid(pid) != 0) {
2406 for (i = 0; i < count; i++)
2407 free(interfaces[i]);
2408
2409 free(interfaces);
2410 interfaces = NULL;
2411 }
2412
2413 /* close the read-end of the pipe */
2414 close(pipefd[0]);
2415
2416 /* Append NULL to the array */
2417 if (interfaces)
2418 interfaces = (char **)lxc_append_null_to_array((void **)interfaces, count);
2419
2420 return interfaces;
2421 }
2422
2423 WRAP_API(char **, lxcapi_get_interfaces)
2424
2425 static char **do_lxcapi_get_ips(struct lxc_container *c, const char *interface,
2426 const char *family, int scope)
2427 {
2428 int i, ret;
2429 pid_t pid;
2430 int pipefd[2];
2431 char address[INET6_ADDRSTRLEN];
2432 int count = 0;
2433 char **addresses = NULL;
2434
2435 ret = pipe2(pipefd, O_CLOEXEC);
2436 if (ret < 0) {
2437 SYSERROR("Failed to create pipe");
2438 return NULL;
2439 }
2440
2441 pid = fork();
2442 if (pid < 0) {
2443 SYSERROR("Failed to create new process");
2444 close(pipefd[0]);
2445 close(pipefd[1]);
2446 return NULL;
2447 }
2448
2449 if (pid == 0) {
2450 ssize_t nbytes;
2451 char addressOutputBuffer[INET6_ADDRSTRLEN];
2452 char *address_ptr = NULL;
2453 void *tempAddrPtr = NULL;
2454 struct netns_ifaddrs *interfaceArray = NULL, *tempIfAddr = NULL;
2455
2456 /* close the read-end of the pipe */
2457 close(pipefd[0]);
2458
2459 if (!enter_net_ns(c)) {
2460 SYSERROR("Failed to attach to network namespace");
2461 goto out;
2462 }
2463
2464 /* Grab the list of interfaces */
2465 if (netns_getifaddrs(&interfaceArray, -1, &(bool){false})) {
2466 SYSERROR("Failed to get interfaces list");
2467 goto out;
2468 }
2469
2470 /* Iterate through the interfaces */
2471 for (tempIfAddr = interfaceArray; tempIfAddr;
2472 tempIfAddr = tempIfAddr->ifa_next) {
2473 if (tempIfAddr->ifa_addr == NULL)
2474 continue;
2475
2476 #pragma GCC diagnostic push
2477 #pragma GCC diagnostic ignored "-Wcast-align"
2478
2479 if (tempIfAddr->ifa_addr->sa_family == AF_INET) {
2480 if (family && strcmp(family, "inet"))
2481 continue;
2482
2483 tempAddrPtr = &((struct sockaddr_in *)tempIfAddr->ifa_addr)->sin_addr;
2484 } else {
2485 if (family && strcmp(family, "inet6"))
2486 continue;
2487
2488 if (((struct sockaddr_in6 *)tempIfAddr->ifa_addr)->sin6_scope_id != scope)
2489 continue;
2490
2491 tempAddrPtr = &((struct sockaddr_in6 *)tempIfAddr->ifa_addr)->sin6_addr;
2492 }
2493
2494 #pragma GCC diagnostic pop
2495
2496 if (interface && strcmp(interface, tempIfAddr->ifa_name))
2497 continue;
2498 else if (!interface && strcmp("lo", tempIfAddr->ifa_name) == 0)
2499 continue;
2500
2501 address_ptr = (char *)inet_ntop(tempIfAddr->ifa_addr->sa_family,
2502 tempAddrPtr, addressOutputBuffer,
2503 sizeof(addressOutputBuffer));
2504 if (!address_ptr)
2505 continue;
2506
2507 nbytes = lxc_write_nointr(pipefd[1], address_ptr, INET6_ADDRSTRLEN);
2508 if (nbytes != INET6_ADDRSTRLEN) {
2509 SYSERROR("Failed to send ipv6 address \"%s\"",
2510 address_ptr);
2511 goto out;
2512 }
2513
2514 count++;
2515 }
2516
2517 ret = 0;
2518
2519 out:
2520 if (interfaceArray)
2521 netns_freeifaddrs(interfaceArray);
2522
2523 /* close the write-end of the pipe, thus sending EOF to the reader */
2524 close(pipefd[1]);
2525 _exit(ret);
2526 }
2527
2528 /* close the write-end of the pipe */
2529 close(pipefd[1]);
2530
2531 while (lxc_read_nointr(pipefd[0], &address, INET6_ADDRSTRLEN) == INET6_ADDRSTRLEN) {
2532 address[INET6_ADDRSTRLEN - 1] = '\0';
2533
2534 if (!add_to_array(&addresses, address, count))
2535 ERROR("PARENT: add_to_array failed");
2536
2537 count++;
2538 }
2539
2540 if (wait_for_pid(pid) != 0) {
2541 for (i = 0; i < count; i++)
2542 free(addresses[i]);
2543
2544 free(addresses);
2545 addresses = NULL;
2546 }
2547
2548 /* close the read-end of the pipe */
2549 close(pipefd[0]);
2550
2551 /* Append NULL to the array */
2552 if (addresses)
2553 addresses = (char **)lxc_append_null_to_array((void **)addresses, count);
2554
2555 return addresses;
2556 }
2557
2558 WRAP_API_3(char **, lxcapi_get_ips, const char *, const char *, int)
2559
2560 static int do_lxcapi_get_config_item(struct lxc_container *c, const char *key, char *retv, int inlen)
2561 {
2562 int ret = -1;
2563 struct lxc_config_t *config;
2564
2565 if (!c || !c->lxc_conf)
2566 return -1;
2567
2568 if (container_mem_lock(c))
2569 return -1;
2570
2571 config = lxc_get_config(key);
2572 /* Verify that the config key exists and that it has a callback
2573 * implemented.
2574 */
2575 if (config && config->get)
2576 ret = config->get(key, retv, inlen, c->lxc_conf, NULL);
2577
2578 container_mem_unlock(c);
2579 return ret;
2580 }
2581
2582 WRAP_API_3(int, lxcapi_get_config_item, const char *, char *, int)
2583
2584 static char* do_lxcapi_get_running_config_item(struct lxc_container *c, const char *key)
2585 {
2586 char *ret;
2587
2588 if (!c || !c->lxc_conf)
2589 return NULL;
2590
2591 if (container_mem_lock(c))
2592 return NULL;
2593
2594 ret = lxc_cmd_get_config_item(c->name, key, do_lxcapi_get_config_path(c));
2595 container_mem_unlock(c);
2596 return ret;
2597 }
2598
2599 WRAP_API_1(char *, lxcapi_get_running_config_item, const char *)
2600
2601 static int do_lxcapi_get_keys(struct lxc_container *c, const char *key, char *retv, int inlen)
2602 {
2603 int ret = -1;
2604
2605 /* List all config items. */
2606 if (!key)
2607 return lxc_list_config_items(retv, inlen);
2608
2609 if (!c || !c->lxc_conf)
2610 return -1;
2611
2612 if (container_mem_lock(c))
2613 return -1;
2614
2615 /* Support 'lxc.net.<idx>', i.e. 'lxc.net.0'
2616 * This is an intelligent result to show which keys are valid given the
2617 * type of nic it is.
2618 */
2619 if (strncmp(key, "lxc.net.", 8) == 0)
2620 ret = lxc_list_net(c->lxc_conf, key, retv, inlen);
2621 else
2622 ret = lxc_list_subkeys(c->lxc_conf, key, retv, inlen);
2623
2624 container_mem_unlock(c);
2625 return ret;
2626 }
2627
2628 WRAP_API_3(int, lxcapi_get_keys, const char *, char *, int)
2629
2630 static bool do_lxcapi_save_config(struct lxc_container *c, const char *alt_file)
2631 {
2632 int fd, lret;
2633 bool ret = false, need_disklock = false;
2634
2635 if (!alt_file)
2636 alt_file = c->configfile;
2637
2638 if (!alt_file)
2639 return false;
2640
2641 /* If we haven't yet loaded a config, load the stock config. */
2642 if (!c->lxc_conf) {
2643 if (!do_lxcapi_load_config(c, lxc_global_config_value("lxc.default_config"))) {
2644 ERROR("Error loading default configuration file %s "
2645 "while saving %s",
2646 lxc_global_config_value("lxc.default_config"),
2647 c->name);
2648 return false;
2649 }
2650 }
2651
2652 if (!create_container_dir(c))
2653 return false;
2654
2655 /* If we're writing to the container's config file, take the disk lock.
2656 * Otherwise just take the memlock to protect the struct lxc_container
2657 * while we're traversing it.
2658 */
2659 if (strcmp(c->configfile, alt_file) == 0)
2660 need_disklock = true;
2661
2662 if (need_disklock)
2663 lret = container_disk_lock(c);
2664 else
2665 lret = container_mem_lock(c);
2666 if (lret)
2667 return false;
2668
2669 fd = open(alt_file, O_WRONLY | O_CREAT | O_TRUNC | O_CLOEXEC,
2670 S_IRUSR | S_IWUSR | S_IRGRP | S_IWGRP);
2671 if (fd < 0)
2672 goto on_error;
2673
2674 lret = write_config(fd, c->lxc_conf);
2675 close(fd);
2676 if (lret < 0)
2677 goto on_error;
2678
2679 ret = true;
2680
2681 on_error:
2682 if (need_disklock)
2683 container_disk_unlock(c);
2684 else
2685 container_mem_unlock(c);
2686
2687 return ret;
2688 }
2689
2690 WRAP_API_1(bool, lxcapi_save_config, const char *)
2691
2692
2693 static bool mod_rdep(struct lxc_container *c0, struct lxc_container *c, bool inc)
2694 {
2695 FILE *f1;
2696 struct stat fbuf;
2697 void *buf = NULL;
2698 char *del = NULL;
2699 char path[PATH_MAX];
2700 char newpath[PATH_MAX];
2701 int fd, ret, n = 0, v = 0;
2702 bool bret = false;
2703 size_t len = 0, bytes = 0;
2704
2705 if (container_disk_lock(c0))
2706 return false;
2707
2708 ret = snprintf(path, PATH_MAX, "%s/%s/lxc_snapshots", c0->config_path, c0->name);
2709 if (ret < 0 || ret > PATH_MAX)
2710 goto out;
2711
2712 ret = snprintf(newpath, PATH_MAX, "%s\n%s\n", c->config_path, c->name);
2713 if (ret < 0 || ret > PATH_MAX)
2714 goto out;
2715
2716 /* If we find an lxc-snapshot file using the old format only listing the
2717 * number of snapshots we will keep using it. */
2718 f1 = fopen(path, "r");
2719 if (f1) {
2720 n = fscanf(f1, "%d", &v);
2721 fclose(f1);
2722 if (n == 1 && v == 0) {
2723 ret = remove(path);
2724 if (ret < 0)
2725 SYSERROR("Failed to remove \"%s\"", path);
2726
2727 n = 0;
2728 }
2729 }
2730
2731 if (n == 1) {
2732 v += inc ? 1 : -1;
2733 f1 = fopen(path, "w");
2734 if (!f1)
2735 goto out;
2736
2737 if (fprintf(f1, "%d\n", v) < 0) {
2738 ERROR("Error writing new snapshots value");
2739 fclose(f1);
2740 goto out;
2741 }
2742
2743 ret = fclose(f1);
2744 if (ret != 0) {
2745 SYSERROR("Error writing to or closing snapshots file");
2746 goto out;
2747 }
2748 } else {
2749 /* Here we know that we have or can use an lxc-snapshot file
2750 * using the new format. */
2751 if (inc) {
2752 f1 = fopen(path, "a");
2753 if (!f1)
2754 goto out;
2755
2756 if (fprintf(f1, "%s", newpath) < 0) {
2757 ERROR("Error writing new snapshots entry");
2758 ret = fclose(f1);
2759 if (ret != 0)
2760 SYSERROR("Error writing to or closing snapshots file");
2761 goto out;
2762 }
2763
2764 ret = fclose(f1);
2765 if (ret != 0) {
2766 SYSERROR("Error writing to or closing snapshots file");
2767 goto out;
2768 }
2769 } else if (!inc) {
2770 if ((fd = open(path, O_RDWR | O_CLOEXEC)) < 0)
2771 goto out;
2772
2773 if (fstat(fd, &fbuf) < 0) {
2774 close(fd);
2775 goto out;
2776 }
2777
2778 if (fbuf.st_size != 0) {
2779 buf = lxc_strmmap(NULL, fbuf.st_size, PROT_READ | PROT_WRITE, MAP_SHARED, fd, 0);
2780 if (buf == MAP_FAILED) {
2781 SYSERROR("Failed to create mapping %s", path);
2782 close(fd);
2783 goto out;
2784 }
2785
2786 len = strlen(newpath);
2787 while ((del = strstr((char *)buf, newpath))) {
2788 memmove(del, del + len, strlen(del) - len + 1);
2789 bytes += len;
2790 }
2791
2792 lxc_strmunmap(buf, fbuf.st_size);
2793 if (ftruncate(fd, fbuf.st_size - bytes) < 0) {
2794 SYSERROR("Failed to truncate file %s", path);
2795 close(fd);
2796 goto out;
2797 }
2798 }
2799
2800 close(fd);
2801 }
2802
2803 /* If the lxc-snapshot file is empty, remove it. */
2804 if (stat(path, &fbuf) < 0)
2805 goto out;
2806
2807 if (!fbuf.st_size) {
2808 ret = remove(path);
2809 if (ret < 0)
2810 SYSERROR("Failed to remove \"%s\"", path);
2811 }
2812 }
2813
2814 bret = true;
2815
2816 out:
2817 container_disk_unlock(c0);
2818 return bret;
2819 }
2820
2821 void mod_all_rdeps(struct lxc_container *c, bool inc)
2822 {
2823 struct lxc_container *p;
2824 char *lxcpath = NULL, *lxcname = NULL, path[PATH_MAX];
2825 size_t pathlen = 0, namelen = 0;
2826 FILE *f;
2827 int ret;
2828
2829 ret = snprintf(path, PATH_MAX, "%s/%s/lxc_rdepends",
2830 c->config_path, c->name);
2831 if (ret < 0 || ret >= PATH_MAX) {
2832 ERROR("Path name too long");
2833 return;
2834 }
2835
2836 f = fopen(path, "r");
2837 if (f == NULL)
2838 return;
2839
2840 while (getline(&lxcpath, &pathlen, f) != -1) {
2841 if (getline(&lxcname, &namelen, f) == -1) {
2842 ERROR("badly formatted file %s", path);
2843 goto out;
2844 }
2845
2846 remove_trailing_newlines(lxcpath);
2847 remove_trailing_newlines(lxcname);
2848
2849 if ((p = lxc_container_new(lxcname, lxcpath)) == NULL) {
2850 ERROR("Unable to find dependent container %s:%s",
2851 lxcpath, lxcname);
2852 continue;
2853 }
2854
2855 if (!mod_rdep(p, c, inc))
2856 ERROR("Failed to update snapshots file for %s:%s",
2857 lxcpath, lxcname);
2858
2859 lxc_container_put(p);
2860 }
2861
2862 out:
2863 free(lxcpath);
2864 free(lxcname);
2865 fclose(f);
2866 }
2867
2868 static bool has_fs_snapshots(struct lxc_container *c)
2869 {
2870 FILE *f;
2871 char path[PATH_MAX];
2872 int ret, v;
2873 struct stat fbuf;
2874 bool bret = false;
2875
2876 ret = snprintf(path, PATH_MAX, "%s/%s/lxc_snapshots", c->config_path,
2877 c->name);
2878 if (ret < 0 || ret > PATH_MAX)
2879 goto out;
2880
2881 /* If the file doesn't exist there are no snapshots. */
2882 if (stat(path, &fbuf) < 0)
2883 goto out;
2884
2885 v = fbuf.st_size;
2886 if (v != 0) {
2887 f = fopen(path, "r");
2888 if (!f)
2889 goto out;
2890
2891 ret = fscanf(f, "%d", &v);
2892 fclose(f);
2893 /* TODO: Figure out what to do with the return value of fscanf. */
2894 if (ret != 1)
2895 INFO("Container uses new lxc-snapshots format %s", path);
2896 }
2897
2898 bret = v != 0;
2899
2900 out:
2901 return bret;
2902 }
2903
2904 static bool has_snapshots(struct lxc_container *c)
2905 {
2906 char path[PATH_MAX];
2907 struct dirent *direntp;
2908 int count=0;
2909 DIR *dir;
2910
2911 if (!get_snappath_dir(c, path))
2912 return false;
2913
2914 dir = opendir(path);
2915 if (!dir)
2916 return false;
2917
2918 while ((direntp = readdir(dir))) {
2919 if (!strcmp(direntp->d_name, "."))
2920 continue;
2921
2922 if (!strcmp(direntp->d_name, ".."))
2923 continue;
2924 count++;
2925 break;
2926 }
2927
2928 closedir(dir);
2929 return count > 0;
2930 }
2931
2932 static bool do_destroy_container(struct lxc_conf *conf) {
2933 int ret;
2934
2935 if (am_guest_unpriv()) {
2936 ret = userns_exec_full(conf, storage_destroy_wrapper, conf,
2937 "storage_destroy_wrapper");
2938 if (ret < 0)
2939 return false;
2940
2941 return true;
2942 }
2943
2944 return storage_destroy(conf);
2945 }
2946
2947 static int lxc_rmdir_onedev_wrapper(void *data)
2948 {
2949 char *arg = (char *) data;
2950 return lxc_rmdir_onedev(arg, "snaps");
2951 }
2952
2953 static int lxc_unlink_exec_wrapper(void *data)
2954 {
2955 char *arg = data;
2956 return unlink(arg);
2957 }
2958
2959 static bool container_destroy(struct lxc_container *c,
2960 struct lxc_storage *storage)
2961 {
2962 const char *p1;
2963 size_t len;
2964 struct lxc_conf *conf;
2965 char *path = NULL;
2966 bool bret = false;
2967 int ret = 0;
2968
2969 if (!c || !do_lxcapi_is_defined(c))
2970 return false;
2971
2972 conf = c->lxc_conf;
2973 if (container_disk_lock(c))
2974 return false;
2975
2976 if (!is_stopped(c)) {
2977 /* We should queue some sort of error - in c->error_string? */
2978 ERROR("container %s is not stopped", c->name);
2979 goto out;
2980 }
2981
2982 if (conf && !lxc_list_empty(&conf->hooks[LXCHOOK_DESTROY])) {
2983 /* Start of environment variable setup for hooks */
2984 if (setenv("LXC_NAME", c->name, 1))
2985 SYSERROR("Failed to set environment variable for container name");
2986
2987 if (conf->rcfile && setenv("LXC_CONFIG_FILE", conf->rcfile, 1))
2988 SYSERROR("Failed to set environment variable for config path");
2989
2990 if (conf->rootfs.mount && setenv("LXC_ROOTFS_MOUNT", conf->rootfs.mount, 1))
2991 SYSERROR("Failed to set environment variable for rootfs mount");
2992
2993 if (conf->rootfs.path && setenv("LXC_ROOTFS_PATH", conf->rootfs.path, 1))
2994 SYSERROR("Failed to set environment variable for rootfs mount");
2995
2996 if (conf->console.path && setenv("LXC_CONSOLE", conf->console.path, 1))
2997 SYSERROR("Failed to set environment variable for console path");
2998
2999 if (conf->console.log_path && setenv("LXC_CONSOLE_LOGPATH", conf->console.log_path, 1))
3000 SYSERROR("Failed to set environment variable for console log");
3001 /* End of environment variable setup for hooks */
3002
3003 if (run_lxc_hooks(c->name, "destroy", conf, NULL)) {
3004 ERROR("Failed to execute clone hook for \"%s\"", c->name);
3005 goto out;
3006 }
3007 }
3008
3009 if (current_config && conf == current_config) {
3010 current_config = NULL;
3011
3012 if (conf->logfd != -1) {
3013 close(conf->logfd);
3014 conf->logfd = -1;
3015 }
3016 }
3017
3018 /* LXC is not managing the storage of the container. */
3019 if (conf && !conf->rootfs.managed)
3020 goto on_success;
3021
3022 if (conf && conf->rootfs.path && conf->rootfs.mount) {
3023 if (!do_destroy_container(conf)) {
3024 ERROR("Error destroying rootfs for %s", c->name);
3025 goto out;
3026 }
3027 INFO("Destroyed rootfs for %s", c->name);
3028 }
3029
3030 mod_all_rdeps(c, false);
3031
3032 p1 = do_lxcapi_get_config_path(c);
3033 /* strlen(p1)
3034 * +
3035 * /
3036 * +
3037 * strlen(c->name)
3038 * +
3039 * /
3040 * +
3041 * strlen("config") = 6
3042 * +
3043 * \0
3044 */
3045 len = strlen(p1) + 1 + strlen(c->name) + 1 + 6 + 1;
3046 path = malloc(len);
3047 if (!path) {
3048 ERROR("Failed to allocate memory");
3049 goto out;
3050 }
3051
3052 /* For an overlay container the rootfs is considered immutable and
3053 * cannot be removed when restoring from a snapshot.
3054 */
3055 if (storage && (!strcmp(storage->type, "overlay") ||
3056 !strcmp(storage->type, "overlayfs")) &&
3057 (storage->flags & LXC_STORAGE_INTERNAL_OVERLAY_RESTORE)) {
3058 ret = snprintf(path, len, "%s/%s/config", p1, c->name);
3059 if (ret < 0 || (size_t)ret >= len)
3060 goto out;
3061
3062 if (am_guest_unpriv())
3063 ret = userns_exec_1(conf, lxc_unlink_exec_wrapper, path,
3064 "lxc_unlink_exec_wrapper");
3065 else
3066 ret = unlink(path);
3067 if (ret < 0) {
3068 SYSERROR("Failed to destroy config file \"%s\" for \"%s\"",
3069 path, c->name);
3070 goto out;
3071 }
3072 INFO("Destroyed config file \"%s\" for \"%s\"", path, c->name);
3073
3074 bret = true;
3075 goto out;
3076 }
3077
3078 ret = snprintf(path, len, "%s/%s", p1, c->name);
3079 if (ret < 0 || (size_t)ret >= len)
3080 goto out;
3081
3082 if (am_guest_unpriv())
3083 ret = userns_exec_full(conf, lxc_rmdir_onedev_wrapper, path,
3084 "lxc_rmdir_onedev_wrapper");
3085 else
3086 ret = lxc_rmdir_onedev(path, "snaps");
3087 if (ret < 0) {
3088 ERROR("Failed to destroy directory \"%s\" for \"%s\"", path,
3089 c->name);
3090 goto out;
3091 }
3092 INFO("Destroyed directory \"%s\" for \"%s\"", path, c->name);
3093
3094 on_success:
3095 bret = true;
3096
3097 out:
3098 if (path)
3099 free(path);
3100
3101 container_disk_unlock(c);
3102 return bret;
3103 }
3104
3105 static bool do_lxcapi_destroy(struct lxc_container *c)
3106 {
3107 if (!c || !lxcapi_is_defined(c))
3108 return false;
3109
3110 if (c->lxc_conf && c->lxc_conf->rootfs.managed) {
3111 if (has_snapshots(c)) {
3112 ERROR("Container %s has snapshots; not removing", c->name);
3113 return false;
3114 }
3115
3116 if (has_fs_snapshots(c)) {
3117 ERROR("container %s has snapshots on its rootfs", c->name);
3118 return false;
3119 }
3120 }
3121
3122 return container_destroy(c, NULL);
3123 }
3124
3125 WRAP_API(bool, lxcapi_destroy)
3126
3127 static bool do_lxcapi_destroy_with_snapshots(struct lxc_container *c)
3128 {
3129 if (!c || !lxcapi_is_defined(c))
3130 return false;
3131
3132 if (!lxcapi_snapshot_destroy_all(c)) {
3133 ERROR("Error deleting all snapshots");
3134 return false;
3135 }
3136
3137 return lxcapi_destroy(c);
3138 }
3139
3140 WRAP_API(bool, lxcapi_destroy_with_snapshots)
3141
3142 int lxc_set_config_item_locked(struct lxc_conf *conf, const char *key,
3143 const char *v)
3144 {
3145 int ret;
3146 struct lxc_config_t *config;
3147 bool bret = true;
3148
3149 config = lxc_get_config(key);
3150 if (!config)
3151 return -EINVAL;
3152
3153 ret = config->set(key, v, conf, NULL);
3154 if (ret < 0)
3155 return -EINVAL;
3156
3157 if (lxc_config_value_empty(v))
3158 do_clear_unexp_config_line(conf, key);
3159 else
3160 bret = do_append_unexp_config_line(conf, key, v);
3161 if (!bret)
3162 return -ENOMEM;
3163
3164 return 0;
3165 }
3166
3167 static bool do_set_config_item_locked(struct lxc_container *c, const char *key,
3168 const char *v)
3169 {
3170 int ret;
3171
3172 if (!c->lxc_conf)
3173 c->lxc_conf = lxc_conf_init();
3174
3175 if (!c->lxc_conf)
3176 return false;
3177
3178 ret = lxc_set_config_item_locked(c->lxc_conf, key, v);
3179 if (ret < 0)
3180 return false;
3181
3182 return true;
3183 }
3184
3185 static bool do_lxcapi_set_config_item(struct lxc_container *c, const char *key, const char *v)
3186 {
3187 bool b = false;
3188
3189 if (!c)
3190 return false;
3191
3192 if (container_mem_lock(c))
3193 return false;
3194
3195 b = do_set_config_item_locked(c, key, v);
3196
3197 container_mem_unlock(c);
3198 return b;
3199 }
3200
3201 WRAP_API_2(bool, lxcapi_set_config_item, const char *, const char *)
3202
3203 static char *lxcapi_config_file_name(struct lxc_container *c)
3204 {
3205 if (!c || !c->configfile)
3206 return NULL;
3207
3208 return strdup(c->configfile);
3209 }
3210
3211 static const char *lxcapi_get_config_path(struct lxc_container *c)
3212 {
3213 if (!c || !c->config_path)
3214 return NULL;
3215
3216 return (const char *)(c->config_path);
3217 }
3218
3219 /*
3220 * not for export
3221 * Just recalculate the c->configfile based on the
3222 * c->config_path, which must be set.
3223 * The lxc_container must be locked or not yet public.
3224 */
3225 static bool set_config_filename(struct lxc_container *c)
3226 {
3227 char *newpath;
3228 int len, ret;
3229
3230 if (!c->config_path)
3231 return false;
3232
3233 /* $lxc_path + "/" + c->name + "/" + "config" + '\0' */
3234 len = strlen(c->config_path) + strlen(c->name) + strlen("config") + 3;
3235 newpath = malloc(len);
3236 if (!newpath)
3237 return false;
3238
3239 ret = snprintf(newpath, len, "%s/%s/config", c->config_path, c->name);
3240 if (ret < 0 || ret >= len) {
3241 fprintf(stderr, "Error printing out config file name\n");
3242 free(newpath);
3243 return false;
3244 }
3245
3246 free(c->configfile);
3247 c->configfile = newpath;
3248
3249 return true;
3250 }
3251
3252 static bool do_lxcapi_set_config_path(struct lxc_container *c, const char *path)
3253 {
3254 char *p;
3255 bool b = false;
3256 char *oldpath = NULL;
3257
3258 if (!c)
3259 return b;
3260
3261 if (container_mem_lock(c))
3262 return b;
3263
3264 p = strdup(path);
3265 if (!p) {
3266 ERROR("Out of memory setting new lxc path");
3267 goto err;
3268 }
3269
3270 b = true;
3271 if (c->config_path)
3272 oldpath = c->config_path;
3273 c->config_path = p;
3274
3275 /* Since we've changed the config path, we have to change the
3276 * config file name too */
3277 if (!set_config_filename(c)) {
3278 ERROR("Out of memory setting new config filename");
3279 b = false;
3280 free(c->config_path);
3281 c->config_path = oldpath;
3282 oldpath = NULL;
3283 }
3284
3285 err:
3286 free(oldpath);
3287 container_mem_unlock(c);
3288 return b;
3289 }
3290
3291 WRAP_API_1(bool, lxcapi_set_config_path, const char *)
3292
3293 static bool do_lxcapi_set_cgroup_item(struct lxc_container *c, const char *subsys, const char *value)
3294 {
3295 int ret;
3296 struct cgroup_ops *cgroup_ops;
3297
3298 if (!c)
3299 return false;
3300
3301 if (is_stopped(c))
3302 return false;
3303
3304 cgroup_ops = cgroup_init(c->lxc_conf);
3305 if (!cgroup_ops)
3306 return false;
3307
3308 ret = cgroup_ops->set(cgroup_ops, subsys, value, c->name, c->config_path);
3309
3310 cgroup_exit(cgroup_ops);
3311
3312 return ret == 0;
3313 }
3314
3315 WRAP_API_2(bool, lxcapi_set_cgroup_item, const char *, const char *)
3316
3317 static int do_lxcapi_get_cgroup_item(struct lxc_container *c, const char *subsys, char *retv, int inlen)
3318 {
3319 int ret;
3320 struct cgroup_ops *cgroup_ops;
3321
3322 if (!c)
3323 return -1;
3324
3325 if (is_stopped(c))
3326 return -1;
3327
3328 cgroup_ops = cgroup_init(c->lxc_conf);
3329 if (!cgroup_ops)
3330 return -1;
3331
3332 ret = cgroup_ops->get(cgroup_ops, subsys, retv, inlen, c->name,
3333 c->config_path);
3334
3335 cgroup_exit(cgroup_ops);
3336
3337 return ret;
3338 }
3339
3340 WRAP_API_3(int, lxcapi_get_cgroup_item, const char *, char *, int)
3341
3342 const char *lxc_get_global_config_item(const char *key)
3343 {
3344 return lxc_global_config_value(key);
3345 }
3346
3347 const char *lxc_get_version(void)
3348 {
3349 return LXC_VERSION;
3350 }
3351
3352 static int copy_file(const char *old, const char *new)
3353 {
3354 int in, out;
3355 ssize_t len, ret;
3356 char buf[8096];
3357 struct stat sbuf;
3358
3359 if (file_exists(new)) {
3360 ERROR("copy destination %s exists", new);
3361 return -1;
3362 }
3363
3364 ret = stat(old, &sbuf);
3365 if (ret < 0) {
3366 INFO("Error stat'ing %s", old);
3367 return -1;
3368 }
3369
3370 in = open(old, O_RDONLY);
3371 if (in < 0) {
3372 SYSERROR("Error opening original file %s", old);
3373 return -1;
3374 }
3375
3376 out = open(new, O_CREAT | O_EXCL | O_WRONLY, 0644);
3377 if (out < 0) {
3378 SYSERROR("Error opening new file %s", new);
3379 close(in);
3380 return -1;
3381 }
3382
3383 for (;;) {
3384 len = lxc_read_nointr(in, buf, 8096);
3385 if (len < 0) {
3386 SYSERROR("Error reading old file %s", old);
3387 goto err;
3388 }
3389
3390 if (len == 0)
3391 break;
3392
3393 ret = lxc_write_nointr(out, buf, len);
3394 if (ret < len) { /* should we retry? */
3395 SYSERROR("Error: write to new file %s was interrupted", new);
3396 goto err;
3397 }
3398 }
3399
3400 close(in);
3401 close(out);
3402
3403 /* We set mode, but not owner/group. */
3404 ret = chmod(new, sbuf.st_mode);
3405 if (ret) {
3406 SYSERROR("Error setting mode on %s", new);
3407 return -1;
3408 }
3409
3410 return 0;
3411
3412 err:
3413 close(in);
3414 close(out);
3415 return -1;
3416 }
3417
3418 static int copyhooks(struct lxc_container *oldc, struct lxc_container *c)
3419 {
3420 __do_free char *cpath = NULL;
3421 int i, len, ret;
3422 struct lxc_list *it;
3423
3424 len = strlen(oldc->config_path) + strlen(oldc->name) + 3;
3425 cpath = must_realloc(NULL, len);
3426 ret = snprintf(cpath, len, "%s/%s/", oldc->config_path, oldc->name);
3427 if (ret < 0 || ret >= len)
3428 return -1;
3429
3430 for (i=0; i<NUM_LXC_HOOKS; i++) {
3431 lxc_list_for_each(it, &c->lxc_conf->hooks[i]) {
3432 char *hookname = it->elem;
3433 char *fname = strrchr(hookname, '/');
3434 char tmppath[PATH_MAX];
3435 if (!fname) /* relative path - we don't support, but maybe we should */
3436 return 0;
3437
3438 if (strncmp(hookname, cpath, len - 1) != 0) {
3439 /* this hook is public - ignore */
3440 continue;
3441 }
3442
3443 /* copy the script, and change the entry in confile */
3444 ret = snprintf(tmppath, PATH_MAX, "%s/%s/%s",
3445 c->config_path, c->name, fname+1);
3446 if (ret < 0 || ret >= PATH_MAX)
3447 return -1;
3448
3449 ret = copy_file(it->elem, tmppath);
3450 if (ret < 0)
3451 return -1;
3452
3453 free(it->elem);
3454
3455 it->elem = strdup(tmppath);
3456 if (!it->elem) {
3457 ERROR("out of memory copying hook path");
3458 return -1;
3459 }
3460 }
3461 }
3462
3463 if (!clone_update_unexp_hooks(c->lxc_conf, oldc->config_path,
3464 c->config_path, oldc->name, c->name)) {
3465 ERROR("Error saving new hooks in clone");
3466 return -1;
3467 }
3468
3469 do_lxcapi_save_config(c, NULL);
3470 return 0;
3471 }
3472
3473
3474 static int copy_fstab(struct lxc_container *oldc, struct lxc_container *c)
3475 {
3476 char newpath[PATH_MAX];
3477 char *oldpath = oldc->lxc_conf->fstab;
3478 int ret;
3479
3480 if (!oldpath)
3481 return 0;
3482
3483 clear_unexp_config_line(c->lxc_conf, "lxc.mount.fstab", false);
3484
3485 char *p = strrchr(oldpath, '/');
3486 if (!p)
3487 return -1;
3488
3489 ret = snprintf(newpath, PATH_MAX, "%s/%s%s",
3490 c->config_path, c->name, p);
3491 if (ret < 0 || ret >= PATH_MAX) {
3492 ERROR("error printing new path for %s", oldpath);
3493 return -1;
3494 }
3495
3496 if (file_exists(newpath)) {
3497 ERROR("error: fstab file %s exists", newpath);
3498 return -1;
3499 }
3500
3501 if (copy_file(oldpath, newpath) < 0) {
3502 ERROR("error: copying %s to %s", oldpath, newpath);
3503 return -1;
3504 }
3505
3506 free(c->lxc_conf->fstab);
3507
3508 c->lxc_conf->fstab = strdup(newpath);
3509 if (!c->lxc_conf->fstab) {
3510 ERROR("error: allocating pathname");
3511 return -1;
3512 }
3513
3514 if (!do_append_unexp_config_line(c->lxc_conf, "lxc.mount.fstab", newpath)) {
3515 ERROR("error saving new lxctab");
3516 return -1;
3517 }
3518
3519 return 0;
3520 }
3521
3522 static void copy_rdepends(struct lxc_container *c, struct lxc_container *c0)
3523 {
3524 char path0[PATH_MAX], path1[PATH_MAX];
3525 int ret;
3526
3527 ret = snprintf(path0, PATH_MAX, "%s/%s/lxc_rdepends", c0->config_path,
3528 c0->name);
3529 if (ret < 0 || ret >= PATH_MAX) {
3530 WARN("Error copying reverse dependencies");
3531 return;
3532 }
3533
3534 ret = snprintf(path1, PATH_MAX, "%s/%s/lxc_rdepends", c->config_path,
3535 c->name);
3536 if (ret < 0 || ret >= PATH_MAX) {
3537 WARN("Error copying reverse dependencies");
3538 return;
3539 }
3540
3541 if (copy_file(path0, path1) < 0) {
3542 INFO("Error copying reverse dependencies");
3543 return;
3544 }
3545 }
3546
3547 static bool add_rdepends(struct lxc_container *c, struct lxc_container *c0)
3548 {
3549 int ret;
3550 char path[PATH_MAX];
3551 FILE *f;
3552 bool bret;
3553
3554 ret = snprintf(path, PATH_MAX, "%s/%s/lxc_rdepends", c->config_path,
3555 c->name);
3556 if (ret < 0 || ret >= PATH_MAX)
3557 return false;
3558
3559 f = fopen(path, "a");
3560 if (!f)
3561 return false;
3562
3563 bret = true;
3564
3565 /* If anything goes wrong, just return an error. */
3566 if (fprintf(f, "%s\n%s\n", c0->config_path, c0->name) < 0)
3567 bret = false;
3568
3569 if (fclose(f) != 0)
3570 bret = false;
3571
3572 return bret;
3573 }
3574
3575 /*
3576 * If the fs natively supports snapshot clones with no penalty,
3577 * then default to those even if not requested.
3578 * Currently we only do this for btrfs.
3579 */
3580 bool should_default_to_snapshot(struct lxc_container *c0,
3581 struct lxc_container *c1)
3582 {
3583 __do_free char *p0 = NULL, *p1 = NULL;
3584 int ret;
3585 size_t l0 = strlen(c0->config_path) + strlen(c0->name) + 2;
3586 size_t l1 = strlen(c1->config_path) + strlen(c1->name) + 2;
3587 char *rootfs = c0->lxc_conf->rootfs.path;
3588
3589 p0 = must_realloc(NULL, l0 + 1);
3590 p1 = must_realloc(NULL, l1 + 1);
3591 ret = snprintf(p0, l0, "%s/%s", c0->config_path, c0->name);
3592 if (ret < 0 || ret >= l0)
3593 return false;
3594
3595 ret = snprintf(p1, l1, "%s/%s", c1->config_path, c1->name);
3596 if (ret < 0 || ret >= l1)
3597 return false;
3598
3599 if (!is_btrfs_fs(p0) || !is_btrfs_fs(p1))
3600 return false;
3601
3602 if (is_btrfs_subvol(rootfs) <= 0)
3603 return false;
3604
3605 return btrfs_same_fs(p0, p1) == 0;
3606 }
3607
3608 static int copy_storage(struct lxc_container *c0, struct lxc_container *c,
3609 const char *newtype, int flags, const char *bdevdata,
3610 uint64_t newsize)
3611 {
3612 struct lxc_storage *bdev;
3613 bool need_rdep;
3614
3615 if (should_default_to_snapshot(c0, c))
3616 flags |= LXC_CLONE_SNAPSHOT;
3617
3618 bdev = storage_copy(c0, c->name, c->config_path, newtype, flags,
3619 bdevdata, newsize, &need_rdep);
3620 if (!bdev) {
3621 ERROR("Error copying storage.");
3622 return -1;
3623 }
3624
3625 /* Set new rootfs. */
3626 free(c->lxc_conf->rootfs.path);
3627 c->lxc_conf->rootfs.path = strdup(bdev->src);
3628 storage_put(bdev);
3629
3630 if (!c->lxc_conf->rootfs.path) {
3631 ERROR("Out of memory while setting storage path.");
3632 return -1;
3633 }
3634
3635 /* Append a new lxc.rootfs.path entry to the unexpanded config. */
3636 clear_unexp_config_line(c->lxc_conf, "lxc.rootfs.path", false);
3637 if (!do_append_unexp_config_line(c->lxc_conf, "lxc.rootfs.path",
3638 c->lxc_conf->rootfs.path)) {
3639 ERROR("Error saving new rootfs to cloned config.");
3640 return -1;
3641 }
3642
3643 if (flags & LXC_CLONE_SNAPSHOT)
3644 copy_rdepends(c, c0);
3645
3646 if (need_rdep) {
3647 if (!add_rdepends(c, c0))
3648 WARN("Error adding reverse dependency from %s to %s",
3649 c->name, c0->name);
3650 }
3651
3652 mod_all_rdeps(c, true);
3653
3654 return 0;
3655 }
3656
3657 struct clone_update_data {
3658 struct lxc_container *c0;
3659 struct lxc_container *c1;
3660 int flags;
3661 char **hookargs;
3662 };
3663
3664 static int clone_update_rootfs(struct clone_update_data *data)
3665 {
3666 struct lxc_container *c0 = data->c0;
3667 struct lxc_container *c = data->c1;
3668 int flags = data->flags;
3669 char **hookargs = data->hookargs;
3670 int ret = -1;
3671 char path[PATH_MAX];
3672 struct lxc_storage *bdev;
3673 FILE *fout;
3674 struct lxc_conf *conf = c->lxc_conf;
3675
3676 /* update hostname in rootfs */
3677 /* we're going to mount, so run in a clean namespace to simplify cleanup */
3678
3679 if (setgid(0) < 0) {
3680 ERROR("Failed to setgid to 0");
3681 return -1;
3682 }
3683
3684 if (setuid(0) < 0) {
3685 ERROR("Failed to setuid to 0");
3686 return -1;
3687 }
3688
3689 if (setgroups(0, NULL) < 0)
3690 WARN("Failed to clear groups");
3691
3692 if (unshare(CLONE_NEWNS) < 0)
3693 return -1;
3694
3695 bdev = storage_init(c->lxc_conf);
3696 if (!bdev)
3697 return -1;
3698
3699 if (strcmp(bdev->type, "dir") != 0) {
3700 if (unshare(CLONE_NEWNS) < 0) {
3701 ERROR("error unsharing mounts");
3702 storage_put(bdev);
3703 return -1;
3704 }
3705
3706 if (detect_shared_rootfs()) {
3707 if (mount(NULL, "/", NULL, MS_SLAVE|MS_REC, NULL)) {
3708 SYSERROR("Failed to make / rslave");
3709 ERROR("Continuing...");
3710 }
3711 }
3712
3713 if (bdev->ops->mount(bdev) < 0) {
3714 storage_put(bdev);
3715 return -1;
3716 }
3717 } else { /* TODO come up with a better way */
3718 free(bdev->dest);
3719 bdev->dest = strdup(lxc_storage_get_path(bdev->src, bdev->type));
3720 }
3721
3722 if (!lxc_list_empty(&conf->hooks[LXCHOOK_CLONE])) {
3723 /* Start of environment variable setup for hooks */
3724 if (c0->name && setenv("LXC_SRC_NAME", c0->name, 1))
3725 SYSERROR("failed to set environment variable for source container name");
3726
3727 if (setenv("LXC_NAME", c->name, 1))
3728 SYSERROR("failed to set environment variable for container name");
3729
3730 if (conf->rcfile && setenv("LXC_CONFIG_FILE", conf->rcfile, 1))
3731 SYSERROR("failed to set environment variable for config path");
3732
3733 if (bdev->dest && setenv("LXC_ROOTFS_MOUNT", bdev->dest, 1))
3734 SYSERROR("failed to set environment variable for rootfs mount");
3735
3736 if (conf->rootfs.path && setenv("LXC_ROOTFS_PATH", conf->rootfs.path, 1))
3737 SYSERROR("failed to set environment variable for rootfs mount");
3738
3739 if (run_lxc_hooks(c->name, "clone", conf, hookargs)) {
3740 ERROR("Error executing clone hook for %s", c->name);
3741 storage_put(bdev);
3742 return -1;
3743 }
3744 }
3745
3746 if (!(flags & LXC_CLONE_KEEPNAME)) {
3747 ret = snprintf(path, PATH_MAX, "%s/etc/hostname", bdev->dest);
3748 storage_put(bdev);
3749
3750 if (ret < 0 || ret >= PATH_MAX)
3751 return -1;
3752
3753 if (!file_exists(path))
3754 return 0;
3755
3756 if (!(fout = fopen(path, "w"))) {
3757 SYSERROR("unable to open %s: ignoring", path);
3758 return 0;
3759 }
3760
3761 if (fprintf(fout, "%s", c->name) < 0) {
3762 fclose(fout);
3763 return -1;
3764 }
3765
3766 if (fclose(fout) < 0)
3767 return -1;
3768 } else {
3769 storage_put(bdev);
3770 }
3771
3772 return 0;
3773 }
3774
3775 static int clone_update_rootfs_wrapper(void *data)
3776 {
3777 struct clone_update_data *arg = (struct clone_update_data *) data;
3778 return clone_update_rootfs(arg);
3779 }
3780
3781 /*
3782 * We want to support:
3783 sudo lxc-clone -o o1 -n n1 -s -L|-fssize fssize -v|--vgname vgname \
3784 -p|--lvprefix lvprefix -t|--fstype fstype -B backingstore
3785
3786 -s [ implies overlay]
3787 -s -B overlay
3788
3789 only rootfs gets converted (copied/snapshotted) on clone.
3790 */
3791
3792 static int create_file_dirname(char *path, struct lxc_conf *conf)
3793 {
3794 char *p = strrchr(path, '/');
3795 int ret = -1;
3796
3797 if (!p)
3798 return -1;
3799
3800 *p = '\0';
3801 ret = do_create_container_dir(path, conf);
3802 *p = '/';
3803
3804 return ret;
3805 }
3806
3807 static struct lxc_container *do_lxcapi_clone(struct lxc_container *c, const char *newname,
3808 const char *lxcpath, int flags,
3809 const char *bdevtype, const char *bdevdata, uint64_t newsize,
3810 char **hookargs)
3811 {
3812 char newpath[PATH_MAX];
3813 int fd, ret;
3814 struct clone_update_data data;
3815 size_t saved_unexp_len;
3816 pid_t pid;
3817 int storage_copied = 0;
3818 char *origroot = NULL, *saved_unexp_conf = NULL;
3819 struct lxc_container *c2 = NULL;
3820
3821 if (!c || !do_lxcapi_is_defined(c))
3822 return NULL;
3823
3824 if (container_mem_lock(c))
3825 return NULL;
3826 if (!is_stopped(c) && !(flags & LXC_CLONE_ALLOW_RUNNING)) {
3827 ERROR("error: Original container (%s) is running. Use --allowrunning if you want to force a snapshot of the running container.", c->name);
3828 goto out;
3829 }
3830
3831 /* Make sure the container doesn't yet exist. */
3832 if (!newname)
3833 newname = c->name;
3834
3835 if (!lxcpath)
3836 lxcpath = do_lxcapi_get_config_path(c);
3837
3838 ret = snprintf(newpath, PATH_MAX, "%s/%s/config", lxcpath, newname);
3839 if (ret < 0 || ret >= PATH_MAX) {
3840 SYSERROR("clone: failed making config pathname");
3841 goto out;
3842 }
3843
3844 if (file_exists(newpath)) {
3845 ERROR("error: clone: %s exists", newpath);
3846 goto out;
3847 }
3848
3849 ret = create_file_dirname(newpath, c->lxc_conf);
3850 if (ret < 0 && errno != EEXIST) {
3851 ERROR("Error creating container dir for %s", newpath);
3852 goto out;
3853 }
3854
3855 /* Copy the configuration. Tweak it as needed. */
3856 if (c->lxc_conf->rootfs.path) {
3857 origroot = c->lxc_conf->rootfs.path;
3858 c->lxc_conf->rootfs.path = NULL;
3859 }
3860
3861 fd = open(newpath, O_WRONLY | O_CREAT | O_CLOEXEC,
3862 S_IRUSR | S_IWUSR | S_IRGRP | S_IWGRP);
3863 if (fd < 0) {
3864 SYSERROR("Failed to open \"%s\"", newpath);
3865 goto out;
3866 }
3867
3868 saved_unexp_conf = c->lxc_conf->unexpanded_config;
3869 saved_unexp_len = c->lxc_conf->unexpanded_len;
3870 c->lxc_conf->unexpanded_config = strdup(saved_unexp_conf);
3871 if (!c->lxc_conf->unexpanded_config) {
3872 close(fd);
3873 goto out;
3874 }
3875
3876 clear_unexp_config_line(c->lxc_conf, "lxc.rootfs.path", false);
3877 write_config(fd, c->lxc_conf);
3878 close(fd);
3879
3880 c->lxc_conf->rootfs.path = origroot;
3881
3882 free(c->lxc_conf->unexpanded_config);
3883 c->lxc_conf->unexpanded_config = saved_unexp_conf;
3884 saved_unexp_conf = NULL;
3885 c->lxc_conf->unexpanded_len = saved_unexp_len;
3886
3887 ret = snprintf(newpath, PATH_MAX, "%s/%s/rootfs", lxcpath, newname);
3888 if (ret < 0 || ret >= PATH_MAX) {
3889 SYSERROR("clone: failed making rootfs pathname");
3890 goto out;
3891 }
3892
3893 ret = mkdir(newpath, 0755);
3894 if (ret < 0) {
3895 /* For an overlay container the rootfs is considered immutable
3896 * and will not have been removed when restoring from a
3897 * snapshot.
3898 */
3899 if (errno != ENOENT &&
3900 !(flags & LXC_STORAGE_INTERNAL_OVERLAY_RESTORE)) {
3901 SYSERROR("Failed to create directory \"%s\"", newpath);
3902 goto out;
3903 }
3904 }
3905
3906 if (am_guest_unpriv()) {
3907 if (chown_mapped_root(newpath, c->lxc_conf) < 0) {
3908 ERROR("Error chowning %s to container root", newpath);
3909 goto out;
3910 }
3911 }
3912
3913 c2 = lxc_container_new(newname, lxcpath);
3914 if (!c2) {
3915 ERROR("clone: failed to create new container (%s %s)", newname,
3916 lxcpath);
3917 goto out;
3918 }
3919
3920 /* copy/snapshot rootfs's */
3921 ret = copy_storage(c, c2, bdevtype, flags, bdevdata, newsize);
3922 if (ret < 0)
3923 goto out;
3924
3925 /* update utsname */
3926 if (!(flags & LXC_CLONE_KEEPNAME)) {
3927 clear_unexp_config_line(c2->lxc_conf, "lxc.utsname", false);
3928 clear_unexp_config_line(c2->lxc_conf, "lxc.uts.name", false);
3929
3930 if (!do_set_config_item_locked(c2, "lxc.uts.name", newname)) {
3931 ERROR("Error setting new hostname");
3932 goto out;
3933 }
3934 }
3935
3936 /* copy hooks */
3937 ret = copyhooks(c, c2);
3938 if (ret < 0) {
3939 ERROR("error copying hooks");
3940 goto out;
3941 }
3942
3943 if (copy_fstab(c, c2) < 0) {
3944 ERROR("error copying fstab");
3945 goto out;
3946 }
3947
3948 /* update macaddrs */
3949 if (!(flags & LXC_CLONE_KEEPMACADDR)) {
3950 if (!network_new_hwaddrs(c2->lxc_conf)) {
3951 ERROR("Error updating mac addresses");
3952 goto out;
3953 }
3954 }
3955
3956 /* Update absolute paths for overlay mount directories. */
3957 if (ovl_update_abs_paths(c2->lxc_conf, c->config_path, c->name, lxcpath, newname) < 0)
3958 goto out;
3959
3960 /* We've now successfully created c2's storage, so clear it out if we
3961 * fail after this.
3962 */
3963 storage_copied = 1;
3964
3965 if (!c2->save_config(c2, NULL))
3966 goto out;
3967
3968 if ((pid = fork()) < 0) {
3969 SYSERROR("fork");
3970 goto out;
3971 }
3972
3973 if (pid > 0) {
3974 ret = wait_for_pid(pid);
3975 if (ret)
3976 goto out;
3977
3978 container_mem_unlock(c);
3979 return c2;
3980 }
3981
3982 data.c0 = c;
3983 data.c1 = c2;
3984 data.flags = flags;
3985 data.hookargs = hookargs;
3986
3987 if (am_guest_unpriv())
3988 ret = userns_exec_full(c->lxc_conf, clone_update_rootfs_wrapper,
3989 &data, "clone_update_rootfs_wrapper");
3990 else
3991 ret = clone_update_rootfs(&data);
3992 if (ret < 0)
3993 _exit(EXIT_FAILURE);
3994
3995 container_mem_unlock(c);
3996 _exit(EXIT_SUCCESS);
3997
3998 out:
3999 container_mem_unlock(c);
4000 if (c2) {
4001 if (!storage_copied)
4002 c2->lxc_conf->rootfs.path = NULL;
4003
4004 c2->destroy(c2);
4005 lxc_container_put(c2);
4006 }
4007
4008 return NULL;
4009 }
4010
4011 static struct lxc_container *lxcapi_clone(struct lxc_container *c, const char *newname,
4012 const char *lxcpath, int flags,
4013 const char *bdevtype, const char *bdevdata, uint64_t newsize,
4014 char **hookargs)
4015 {
4016 struct lxc_container * ret;
4017
4018 current_config = c ? c->lxc_conf : NULL;
4019 ret = do_lxcapi_clone(c, newname, lxcpath, flags, bdevtype, bdevdata, newsize, hookargs);
4020 current_config = NULL;
4021
4022 return ret;
4023 }
4024
4025 static bool do_lxcapi_rename(struct lxc_container *c, const char *newname)
4026 {
4027 struct lxc_storage *bdev;
4028 struct lxc_container *newc;
4029
4030 if (!c || !c->name || !c->config_path || !c->lxc_conf)
4031 return false;
4032
4033 if (has_fs_snapshots(c) || has_snapshots(c)) {
4034 ERROR("Renaming a container with snapshots is not supported");
4035 return false;
4036 }
4037
4038 bdev = storage_init(c->lxc_conf);
4039 if (!bdev) {
4040 ERROR("Failed to find original backing store type");
4041 return false;
4042 }
4043
4044 newc = lxcapi_clone(c, newname, c->config_path, LXC_CLONE_KEEPMACADDR, NULL, bdev->type, 0, NULL);
4045 storage_put(bdev);
4046 if (!newc) {
4047 lxc_container_put(newc);
4048 return false;
4049 }
4050
4051 if (newc && lxcapi_is_defined(newc))
4052 lxc_container_put(newc);
4053
4054 if (!container_destroy(c, NULL)) {
4055 ERROR("Could not destroy existing container %s", c->name);
4056 return false;
4057 }
4058
4059 return true;
4060 }
4061
4062 WRAP_API_1(bool, lxcapi_rename, const char *)
4063
4064 static int lxcapi_attach(struct lxc_container *c,
4065 lxc_attach_exec_t exec_function, void *exec_payload,
4066 lxc_attach_options_t *options, pid_t *attached_process)
4067 {
4068 int ret;
4069
4070 if (!c)
4071 return -1;
4072
4073 current_config = c->lxc_conf;
4074
4075 ret = lxc_attach(c, exec_function, exec_payload, options,
4076 attached_process);
4077 current_config = NULL;
4078 return ret;
4079 }
4080
4081 static int do_lxcapi_attach_run_wait(struct lxc_container *c,
4082 lxc_attach_options_t *options,
4083 const char *program,
4084 const char *const argv[])
4085 {
4086 lxc_attach_command_t command;
4087 pid_t pid;
4088 int ret;
4089
4090 if (!c)
4091 return -1;
4092
4093 command.program = (char *)program;
4094 command.argv = (char **)argv;
4095
4096 ret = lxc_attach(c, lxc_attach_run_command, &command, options, &pid);
4097 if (ret < 0)
4098 return ret;
4099
4100 return lxc_wait_for_pid_status(pid);
4101 }
4102
4103 static int lxcapi_attach_run_wait(struct lxc_container *c,
4104 lxc_attach_options_t *options,
4105 const char *program, const char *const argv[])
4106 {
4107 int ret;
4108
4109 current_config = c ? c->lxc_conf : NULL;
4110 ret = do_lxcapi_attach_run_wait(c, options, program, argv);
4111 current_config = NULL;
4112
4113 return ret;
4114 }
4115
4116 static int get_next_index(const char *lxcpath, char *cname)
4117 {
4118 __do_free char *fname = NULL;
4119 struct stat sb;
4120 int i = 0, ret;
4121
4122 fname = must_realloc(NULL, strlen(lxcpath) + 20);
4123
4124 for (;;) {
4125 sprintf(fname, "%s/snap%d", lxcpath, i);
4126
4127 ret = stat(fname, &sb);
4128 if (ret != 0)
4129 return i;
4130
4131 i++;
4132 }
4133 }
4134
4135 static bool get_snappath_dir(struct lxc_container *c, char *snappath)
4136 {
4137 int ret;
4138
4139 /*
4140 * If the old style snapshot path exists, use it
4141 * /var/lib/lxc -> /var/lib/lxcsnaps
4142 */
4143 ret = snprintf(snappath, PATH_MAX, "%ssnaps", c->config_path);
4144 if (ret < 0 || ret >= PATH_MAX)
4145 return false;
4146
4147 if (dir_exists(snappath)) {
4148 ret = snprintf(snappath, PATH_MAX, "%ssnaps/%s", c->config_path, c->name);
4149 if (ret < 0 || ret >= PATH_MAX)
4150 return false;
4151
4152 return true;
4153 }
4154
4155 /*
4156 * Use the new style path
4157 * /var/lib/lxc -> /var/lib/lxc + c->name + /snaps + \0
4158 */
4159 ret = snprintf(snappath, PATH_MAX, "%s/%s/snaps", c->config_path, c->name);
4160 if (ret < 0 || ret >= PATH_MAX)
4161 return false;
4162
4163 return true;
4164 }
4165
4166 static int do_lxcapi_snapshot(struct lxc_container *c, const char *commentfile)
4167 {
4168 __do_free char *dfnam = NULL;
4169 int i, flags, ret;
4170 time_t timer;
4171 struct tm tm_info;
4172 struct lxc_container *c2;
4173 char snappath[PATH_MAX], newname[20];
4174 char buffer[25];
4175 FILE *f;
4176
4177 if (!c || !lxcapi_is_defined(c))
4178 return -1;
4179
4180 if (!storage_can_backup(c->lxc_conf)) {
4181 ERROR("%s's backing store cannot be backed up", c->name);
4182 ERROR("Your container must use another backing store type");
4183 return -1;
4184 }
4185
4186 if (!get_snappath_dir(c, snappath))
4187 return -1;
4188
4189 i = get_next_index(snappath, c->name);
4190
4191 if (mkdir_p(snappath, 0755) < 0) {
4192 ERROR("Failed to create snapshot directory %s", snappath);
4193 return -1;
4194 }
4195
4196 ret = snprintf(newname, 20, "snap%d", i);
4197 if (ret < 0 || ret >= 20)
4198 return -1;
4199
4200 /*
4201 * We pass LXC_CLONE_SNAPSHOT to make sure that a rdepends file entry is
4202 * created in the original container
4203 */
4204 flags = LXC_CLONE_SNAPSHOT | LXC_CLONE_KEEPMACADDR | LXC_CLONE_KEEPNAME |
4205 LXC_CLONE_KEEPBDEVTYPE | LXC_CLONE_MAYBE_SNAPSHOT;
4206 if (storage_is_dir(c->lxc_conf)) {
4207 ERROR("Snapshot of directory-backed container requested");
4208 ERROR("Making a copy-clone. If you do want snapshots, then");
4209 ERROR("please create overlay clone first, snapshot that");
4210 ERROR("and keep the original container pristine");
4211 flags &= ~LXC_CLONE_SNAPSHOT | LXC_CLONE_MAYBE_SNAPSHOT;
4212 }
4213
4214 c2 = do_lxcapi_clone(c, newname, snappath, flags, NULL, NULL, 0, NULL);
4215 if (!c2) {
4216 ERROR("Failed to clone of %s:%s", c->config_path, c->name);
4217 return -1;
4218 }
4219
4220 lxc_container_put(c2);
4221
4222 /* Now write down the creation time. */
4223 time(&timer);
4224
4225 if (!localtime_r(&timer, &tm_info)) {
4226 ERROR("Failed to get localtime");
4227 return -1;
4228 }
4229
4230 strftime(buffer, 25, "%Y:%m:%d %H:%M:%S", &tm_info);
4231
4232 dfnam = must_realloc(NULL, strlen(snappath) + strlen(newname) + 5);
4233 sprintf(dfnam, "%s/%s/ts", snappath, newname);
4234 f = fopen(dfnam, "w");
4235 if (!f) {
4236 ERROR("Failed to open %s", dfnam);
4237 return -1;
4238 }
4239
4240 if (fprintf(f, "%s", buffer) < 0) {
4241 SYSERROR("Writing timestamp");
4242 fclose(f);
4243 return -1;
4244 }
4245
4246 ret = fclose(f);
4247 if (ret != 0) {
4248 SYSERROR("Writing timestamp");
4249 return -1;
4250 }
4251
4252 if (commentfile) {
4253 __do_free char *path = NULL;
4254 /* $p / $name / comment \0 */
4255 int len = strlen(snappath) + strlen(newname) + 10;
4256
4257 path = must_realloc(NULL, len);
4258 sprintf(path, "%s/%s/comment", snappath, newname);
4259 return copy_file(commentfile, path) < 0 ? -1 : i;
4260 }
4261
4262 return i;
4263 }
4264
4265 WRAP_API_1(int, lxcapi_snapshot, const char *)
4266
4267 static void lxcsnap_free(struct lxc_snapshot *s)
4268 {
4269 free(s->name);
4270 free(s->comment_pathname);
4271 free(s->timestamp);
4272 free(s->lxcpath);
4273 }
4274
4275 static char *get_snapcomment_path(char* snappath, char *name)
4276 {
4277 /* $snappath/$name/comment */
4278 int ret, len = strlen(snappath) + strlen(name) + 10;
4279 char *s = malloc(len);
4280
4281 if (s) {
4282 ret = snprintf(s, len, "%s/%s/comment", snappath, name);
4283 if (ret < 0 || ret >= len) {
4284 free(s);
4285 s = NULL;
4286 }
4287 }
4288
4289 return s;
4290 }
4291
4292 static char *get_timestamp(char* snappath, char *name)
4293 {
4294 char path[PATH_MAX], *s = NULL;
4295 int ret, len;
4296 FILE *fin;
4297
4298 ret = snprintf(path, PATH_MAX, "%s/%s/ts", snappath, name);
4299 if (ret < 0 || ret >= PATH_MAX)
4300 return NULL;
4301
4302 fin = fopen(path, "r");
4303 if (!fin)
4304 return NULL;
4305
4306 (void) fseek(fin, 0, SEEK_END);
4307 len = ftell(fin);
4308 (void) fseek(fin, 0, SEEK_SET);
4309 if (len > 0) {
4310 s = malloc(len+1);
4311 if (s) {
4312 s[len] = '\0';
4313 if (fread(s, 1, len, fin) != len) {
4314 SYSERROR("reading timestamp");
4315 free(s);
4316 s = NULL;
4317 }
4318 }
4319 }
4320
4321 fclose(fin);
4322 return s;
4323 }
4324
4325 static int do_lxcapi_snapshot_list(struct lxc_container *c, struct lxc_snapshot **ret_snaps)
4326 {
4327 char snappath[PATH_MAX], path2[PATH_MAX];
4328 int count = 0, ret;
4329 struct dirent *direntp;
4330 struct lxc_snapshot *snaps =NULL, *nsnaps;
4331 DIR *dir;
4332
4333 if (!c || !lxcapi_is_defined(c))
4334 return -1;
4335
4336 if (!get_snappath_dir(c, snappath)) {
4337 ERROR("path name too long");
4338 return -1;
4339 }
4340
4341 dir = opendir(snappath);
4342 if (!dir) {
4343 INFO("Failed to open %s - assuming no snapshots", snappath);
4344 return 0;
4345 }
4346
4347 while ((direntp = readdir(dir))) {
4348 if (!strcmp(direntp->d_name, "."))
4349 continue;
4350
4351 if (!strcmp(direntp->d_name, ".."))
4352 continue;
4353
4354 ret = snprintf(path2, PATH_MAX, "%s/%s/config", snappath, direntp->d_name);
4355 if (ret < 0 || ret >= PATH_MAX) {
4356 ERROR("pathname too long");
4357 goto out_free;
4358 }
4359
4360 if (!file_exists(path2))
4361 continue;
4362
4363 nsnaps = realloc(snaps, (count + 1)*sizeof(*snaps));
4364 if (!nsnaps) {
4365 SYSERROR("Out of memory");
4366 goto out_free;
4367 }
4368
4369 snaps = nsnaps;
4370 snaps[count].free = lxcsnap_free;
4371 snaps[count].name = strdup(direntp->d_name);
4372 if (!snaps[count].name)
4373 goto out_free;
4374
4375 snaps[count].lxcpath = strdup(snappath);
4376 if (!snaps[count].lxcpath) {
4377 free(snaps[count].name);
4378 goto out_free;
4379 }
4380
4381 snaps[count].comment_pathname = get_snapcomment_path(snappath, direntp->d_name);
4382 snaps[count].timestamp = get_timestamp(snappath, direntp->d_name);
4383 count++;
4384 }
4385
4386 if (closedir(dir))
4387 WARN("Failed to close directory");
4388
4389 *ret_snaps = snaps;
4390 return count;
4391
4392 out_free:
4393 if (snaps) {
4394 int i;
4395
4396 for (i=0; i<count; i++)
4397 lxcsnap_free(&snaps[i]);
4398
4399 free(snaps);
4400 }
4401
4402 if (closedir(dir))
4403 WARN("Failed to close directory");
4404
4405 return -1;
4406 }
4407
4408 WRAP_API_1(int, lxcapi_snapshot_list, struct lxc_snapshot **)
4409
4410 static bool do_lxcapi_snapshot_restore(struct lxc_container *c, const char *snapname, const char *newname)
4411 {
4412 char clonelxcpath[PATH_MAX];
4413 int flags = 0;
4414 struct lxc_container *snap, *rest;
4415 struct lxc_storage *bdev;
4416 bool b = false;
4417
4418 if (!c || !c->name || !c->config_path)
4419 return false;
4420
4421 if (has_fs_snapshots(c)) {
4422 ERROR("container rootfs has dependent snapshots");
4423 return false;
4424 }
4425
4426 bdev = storage_init(c->lxc_conf);
4427 if (!bdev) {
4428 ERROR("Failed to find original backing store type");
4429 return false;
4430 }
4431
4432 /* For an overlay container the rootfs is considered immutable
4433 * and cannot be removed when restoring from a snapshot. We pass this
4434 * internal flag along to communicate this to various parts of the
4435 * codebase.
4436 */
4437 if (!strcmp(bdev->type, "overlay") || !strcmp(bdev->type, "overlayfs"))
4438 bdev->flags |= LXC_STORAGE_INTERNAL_OVERLAY_RESTORE;
4439
4440 if (!newname)
4441 newname = c->name;
4442
4443 if (!get_snappath_dir(c, clonelxcpath)) {
4444 storage_put(bdev);
4445 return false;
4446 }
4447 /* how should we lock this? */
4448
4449 snap = lxc_container_new(snapname, clonelxcpath);
4450 if (!snap || !lxcapi_is_defined(snap)) {
4451 ERROR("Could not open snapshot %s", snapname);
4452
4453 if (snap)
4454 lxc_container_put(snap);
4455
4456 storage_put(bdev);
4457 return false;
4458 }
4459
4460 if (!strcmp(c->name, newname)) {
4461 if (!container_destroy(c, bdev)) {
4462 ERROR("Could not destroy existing container %s", newname);
4463 lxc_container_put(snap);
4464 storage_put(bdev);
4465 return false;
4466 }
4467 }
4468
4469 if (strcmp(bdev->type, "dir") != 0 && strcmp(bdev->type, "loop") != 0)
4470 flags = LXC_CLONE_SNAPSHOT | LXC_CLONE_MAYBE_SNAPSHOT;
4471
4472 if (!strcmp(bdev->type, "overlay") || !strcmp(bdev->type, "overlayfs"))
4473 flags |= LXC_STORAGE_INTERNAL_OVERLAY_RESTORE;
4474
4475 rest = lxcapi_clone(snap, newname, c->config_path, flags, bdev->type,
4476 NULL, 0, NULL);
4477 storage_put(bdev);
4478 if (rest && lxcapi_is_defined(rest))
4479 b = true;
4480
4481 if (rest)
4482 lxc_container_put(rest);
4483
4484 lxc_container_put(snap);
4485 return b;
4486 }
4487
4488 WRAP_API_2(bool, lxcapi_snapshot_restore, const char *, const char *)
4489
4490 static bool do_snapshot_destroy(const char *snapname, const char *clonelxcpath)
4491 {
4492 struct lxc_container *snap = NULL;
4493 bool bret = false;
4494
4495 snap = lxc_container_new(snapname, clonelxcpath);
4496 if (!snap) {
4497 ERROR("Could not find snapshot %s", snapname);
4498 goto err;
4499 }
4500
4501 if (!do_lxcapi_destroy(snap)) {
4502 ERROR("Could not destroy snapshot %s", snapname);
4503 goto err;
4504 }
4505
4506 bret = true;
4507
4508 err:
4509 if (snap)
4510 lxc_container_put(snap);
4511
4512 return bret;
4513 }
4514
4515 static bool remove_all_snapshots(const char *path)
4516 {
4517 DIR *dir;
4518 struct dirent *direntp;
4519 bool bret = true;
4520
4521 dir = opendir(path);
4522 if (!dir) {
4523 SYSERROR("opendir on snapshot path %s", path);
4524 return false;
4525 }
4526
4527 while ((direntp = readdir(dir))) {
4528 if (!strcmp(direntp->d_name, "."))
4529 continue;
4530
4531 if (!strcmp(direntp->d_name, ".."))
4532 continue;
4533
4534 if (!do_snapshot_destroy(direntp->d_name, path)) {
4535 bret = false;
4536 continue;
4537 }
4538 }
4539
4540 closedir(dir);
4541
4542 if (rmdir(path))
4543 SYSERROR("Error removing directory %s", path);
4544
4545 return bret;
4546 }
4547
4548 static bool do_lxcapi_snapshot_destroy(struct lxc_container *c, const char *snapname)
4549 {
4550 char clonelxcpath[PATH_MAX];
4551
4552 if (!c || !c->name || !c->config_path || !snapname)
4553 return false;
4554
4555 if (!get_snappath_dir(c, clonelxcpath))
4556 return false;
4557
4558 return do_snapshot_destroy(snapname, clonelxcpath);
4559 }
4560
4561 WRAP_API_1(bool, lxcapi_snapshot_destroy, const char *)
4562
4563 static bool do_lxcapi_snapshot_destroy_all(struct lxc_container *c)
4564 {
4565 char clonelxcpath[PATH_MAX];
4566
4567 if (!c || !c->name || !c->config_path)
4568 return false;
4569
4570 if (!get_snappath_dir(c, clonelxcpath))
4571 return false;
4572
4573 return remove_all_snapshots(clonelxcpath);
4574 }
4575
4576 WRAP_API(bool, lxcapi_snapshot_destroy_all)
4577
4578 static bool do_lxcapi_may_control(struct lxc_container *c)
4579 {
4580 if (!c)
4581 return false;
4582
4583 return lxc_try_cmd(c->name, c->config_path) == 0;
4584 }
4585
4586 WRAP_API(bool, lxcapi_may_control)
4587
4588 static bool do_add_remove_node(pid_t init_pid, const char *path, bool add,
4589 struct stat *st)
4590 {
4591 int ret;
4592 char *tmp;
4593 pid_t pid;
4594 char chrootpath[PATH_MAX];
4595 char *directory_path = NULL;
4596
4597 pid = fork();
4598 if (pid < 0) {
4599 SYSERROR("Failed to fork()");
4600 return false;
4601 }
4602
4603 if (pid) {
4604 ret = wait_for_pid(pid);
4605 if (ret != 0) {
4606 ERROR("Failed to create device node");
4607 return false;
4608 }
4609
4610 return true;
4611 }
4612
4613 /* prepare the path */
4614 ret = snprintf(chrootpath, PATH_MAX, "/proc/%d/root", init_pid);
4615 if (ret < 0 || ret >= PATH_MAX)
4616 return false;
4617
4618 ret = chroot(chrootpath);
4619 if (ret < 0)
4620 _exit(EXIT_FAILURE);
4621
4622 ret = chdir("/");
4623 if (ret < 0)
4624 _exit(EXIT_FAILURE);
4625
4626 /* remove path if it exists */
4627 ret = faccessat(AT_FDCWD, path, F_OK, AT_SYMLINK_NOFOLLOW);
4628 if(ret == 0) {
4629 ret = unlink(path);
4630 if (ret < 0) {
4631 SYSERROR("Failed to remove \"%s\"", path);
4632 _exit(EXIT_FAILURE);
4633 }
4634 }
4635
4636 if (!add)
4637 _exit(EXIT_SUCCESS);
4638
4639 /* create any missing directories */
4640 tmp = strdup(path);
4641 if (!tmp)
4642 _exit(EXIT_FAILURE);
4643
4644 directory_path = dirname(tmp);
4645 ret = mkdir_p(directory_path, 0755);
4646 if (ret < 0 && errno != EEXIST) {
4647 SYSERROR("Failed to create path \"%s\"", directory_path);
4648 free(tmp);
4649 _exit(EXIT_FAILURE);
4650 }
4651
4652 /* create the device node */
4653 ret = mknod(path, st->st_mode, st->st_rdev);
4654 free(tmp);
4655 if (ret < 0) {
4656 SYSERROR("Failed to create device node at \"%s\"", path);
4657 _exit(EXIT_FAILURE);
4658 }
4659
4660 _exit(EXIT_SUCCESS);
4661 }
4662
4663 static bool add_remove_device_node(struct lxc_container *c, const char *src_path, const char *dest_path, bool add)
4664 {
4665 int ret;
4666 struct stat st;
4667 char value[LXC_MAX_BUFFER];
4668 const char *p;
4669 pid_t init_pid;
4670
4671 /* make sure container is running */
4672 if (!do_lxcapi_is_running(c)) {
4673 ERROR("container is not running");
4674 return false;
4675 }
4676
4677 /* use src_path if dest_path is NULL otherwise use dest_path */
4678 p = dest_path ? dest_path : src_path;
4679
4680 /* make sure we can access p */
4681 if(access(p, F_OK) < 0 || stat(p, &st) < 0)
4682 return false;
4683
4684 /* continue if path is character device or block device */
4685 if (S_ISCHR(st.st_mode))
4686 ret = snprintf(value, LXC_MAX_BUFFER, "c %d:%d rwm", major(st.st_rdev), minor(st.st_rdev));
4687 else if (S_ISBLK(st.st_mode))
4688 ret = snprintf(value, LXC_MAX_BUFFER, "b %d:%d rwm", major(st.st_rdev), minor(st.st_rdev));
4689 else
4690 return false;
4691
4692 /* check snprintf return code */
4693 if (ret < 0 || ret >= LXC_MAX_BUFFER)
4694 return false;
4695
4696 init_pid = do_lxcapi_init_pid(c);
4697 if (init_pid < 0) {
4698 ERROR("Failed to get init pid");
4699 return false;
4700 }
4701
4702 if (!do_add_remove_node(init_pid, p, add, &st))
4703 return false;
4704
4705 /* add or remove device to/from cgroup access list */
4706 if (add) {
4707 if (!do_lxcapi_set_cgroup_item(c, "devices.allow", value)) {
4708 ERROR("set_cgroup_item failed while adding the device node");
4709 return false;
4710 }
4711 } else {
4712 if (!do_lxcapi_set_cgroup_item(c, "devices.deny", value)) {
4713 ERROR("set_cgroup_item failed while removing the device node");
4714 return false;
4715 }
4716 }
4717
4718 return true;
4719 }
4720
4721 static bool do_lxcapi_add_device_node(struct lxc_container *c, const char *src_path, const char *dest_path)
4722 {
4723 // cannot mknod if we're not privileged wrt init_user_ns
4724 if (am_host_unpriv()) {
4725 ERROR(LXC_UNPRIV_EOPNOTSUPP, __FUNCTION__);
4726 return false;
4727 }
4728
4729 return add_remove_device_node(c, src_path, dest_path, true);
4730 }
4731
4732 WRAP_API_2(bool, lxcapi_add_device_node, const char *, const char *)
4733
4734 static bool do_lxcapi_remove_device_node(struct lxc_container *c, const char *src_path, const char *dest_path)
4735 {
4736 if (am_guest_unpriv()) {
4737 ERROR(LXC_UNPRIV_EOPNOTSUPP, __FUNCTION__);
4738 return false;
4739 }
4740
4741 return add_remove_device_node(c, src_path, dest_path, false);
4742 }
4743
4744 WRAP_API_2(bool, lxcapi_remove_device_node, const char *, const char *)
4745
4746 static bool do_lxcapi_attach_interface(struct lxc_container *c,
4747 const char *ifname,
4748 const char *dst_ifname)
4749 {
4750 pid_t init_pid;
4751 int ret = 0;
4752
4753 if (am_guest_unpriv()) {
4754 ERROR(LXC_UNPRIV_EOPNOTSUPP, __FUNCTION__);
4755 return false;
4756 }
4757
4758 if (!ifname) {
4759 ERROR("No source interface name given");
4760 return false;
4761 }
4762
4763 ret = lxc_netdev_isup(ifname);
4764 if (ret > 0) {
4765 /* netdev of ifname is up. */
4766 ret = lxc_netdev_down(ifname);
4767 if (ret)
4768 goto err;
4769 }
4770
4771 init_pid = do_lxcapi_init_pid(c);
4772 if (init_pid < 0) {
4773 ERROR("Failed to get init pid");
4774 goto err;
4775 }
4776
4777 ret = lxc_netdev_move_by_name(ifname, init_pid, dst_ifname);
4778 if (ret)
4779 goto err;
4780
4781 INFO("Moved network device \"%s\" to network namespace of %d", ifname, init_pid);
4782 return true;
4783
4784 err:
4785 return false;
4786 }
4787
4788 WRAP_API_2(bool, lxcapi_attach_interface, const char *, const char *)
4789
4790 static bool do_lxcapi_detach_interface(struct lxc_container *c,
4791 const char *ifname,
4792 const char *dst_ifname)
4793 {
4794 int ret;
4795 pid_t pid, pid_outside;
4796
4797 /*
4798 * TODO - if this is a physical device, then we need am_host_unpriv.
4799 * But for other types guest privilege suffices.
4800 */
4801 if (am_guest_unpriv()) {
4802 ERROR(LXC_UNPRIV_EOPNOTSUPP, __FUNCTION__);
4803 return false;
4804 }
4805
4806 if (!ifname) {
4807 ERROR("No source interface name given");
4808 return false;
4809 }
4810
4811 pid_outside = lxc_raw_getpid();
4812 pid = fork();
4813 if (pid < 0) {
4814 ERROR("Failed to fork");
4815 return false;
4816 }
4817
4818 if (pid == 0) { /* child */
4819 pid_t init_pid;
4820
4821 init_pid = do_lxcapi_init_pid(c);
4822 if (init_pid < 0) {
4823 ERROR("Failed to get init pid");
4824 _exit(EXIT_FAILURE);
4825 }
4826 if (!switch_to_ns(init_pid, "net")) {
4827 ERROR("Failed to enter network namespace");
4828 _exit(EXIT_FAILURE);
4829 }
4830
4831 ret = lxc_netdev_isup(ifname);
4832 if (ret < 0) {
4833 ERROR("Failed to determine whether network device \"%s\" is up", ifname);
4834 _exit(EXIT_FAILURE);
4835 }
4836
4837 /* netdev of ifname is up. */
4838 if (ret) {
4839 ret = lxc_netdev_down(ifname);
4840 if (ret) {
4841 ERROR("Failed to set network device \"%s\" down", ifname);
4842 _exit(EXIT_FAILURE);
4843 }
4844 }
4845
4846 ret = lxc_netdev_move_by_name(ifname, pid_outside, dst_ifname);
4847 /* -EINVAL means there is no netdev named as ifname. */
4848 if (ret < 0) {
4849 if (ret == -EINVAL)
4850 ERROR("Network device \"%s\" not found", ifname);
4851 else
4852 ERROR("Failed to remove network device \"%s\"", ifname);
4853
4854 _exit(EXIT_FAILURE);
4855 }
4856
4857 _exit(EXIT_SUCCESS);
4858 }
4859
4860 ret = wait_for_pid(pid);
4861 if (ret != 0)
4862 return false;
4863
4864 INFO("Moved network device \"%s\" to network namespace of %d", ifname, pid_outside);
4865 return true;
4866 }
4867
4868 WRAP_API_2(bool, lxcapi_detach_interface, const char *, const char *)
4869
4870 static int do_lxcapi_migrate(struct lxc_container *c, unsigned int cmd,
4871 struct migrate_opts *opts, unsigned int size)
4872 {
4873 int ret = -1;
4874 struct migrate_opts *valid_opts = opts;
4875 uint64_t features_to_check = 0;
4876
4877 /* If the caller has a bigger (newer) struct migrate_opts, let's make
4878 * sure that the stuff on the end is zero, i.e. that they didn't ask us
4879 * to do anything special.
4880 */
4881 if (size > sizeof(*opts)) {
4882 unsigned char *addr;
4883 unsigned char *end;
4884
4885 addr = (void *)opts + sizeof(*opts);
4886 end = (void *)opts + size;
4887
4888 for (; addr < end; addr++)
4889 if (*addr)
4890 return -E2BIG;
4891 }
4892
4893 /* If the caller has a smaller struct, let's zero out the end for them
4894 * so we don't accidentally use bits of it that they didn't know about
4895 * to initialize.
4896 */
4897 if (size < sizeof(*opts)) {
4898 valid_opts = malloc(sizeof(*opts));
4899 if (!valid_opts)
4900 return -ENOMEM;
4901
4902 memset(valid_opts, 0, sizeof(*opts));
4903 memcpy(valid_opts, opts, size);
4904 }
4905
4906 switch (cmd) {
4907 case MIGRATE_PRE_DUMP:
4908 if (!do_lxcapi_is_running(c)) {
4909 ERROR("container is not running");
4910 goto on_error;
4911 }
4912
4913 ret = !__criu_pre_dump(c, valid_opts);
4914 break;
4915 case MIGRATE_DUMP:
4916 if (!do_lxcapi_is_running(c)) {
4917 ERROR("container is not running");
4918 goto on_error;
4919 }
4920
4921 ret = !__criu_dump(c, valid_opts);
4922 break;
4923 case MIGRATE_RESTORE:
4924 if (do_lxcapi_is_running(c)) {
4925 ERROR("container is already running");
4926 goto on_error;
4927 }
4928
4929 ret = !__criu_restore(c, valid_opts);
4930 break;
4931 case MIGRATE_FEATURE_CHECK:
4932 features_to_check = valid_opts->features_to_check;
4933 ret = !__criu_check_feature(&features_to_check);
4934 if (ret) {
4935 /* Something went wrong. Let's let the caller
4936 * know which feature checks failed. */
4937 valid_opts->features_to_check = features_to_check;
4938 }
4939 break;
4940 default:
4941 ERROR("invalid migrate command %u", cmd);
4942 ret = -EINVAL;
4943 }
4944
4945 on_error:
4946 if (size < sizeof(*opts))
4947 free(valid_opts);
4948
4949 return ret;
4950 }
4951
4952 WRAP_API_3(int, lxcapi_migrate, unsigned int, struct migrate_opts *, unsigned int)
4953
4954 static bool do_lxcapi_checkpoint(struct lxc_container *c, char *directory, bool stop, bool verbose)
4955 {
4956 struct migrate_opts opts;
4957
4958 memset(&opts, 0, sizeof(opts));
4959
4960 opts.directory = directory;
4961 opts.stop = stop;
4962 opts.verbose = verbose;
4963
4964 return !do_lxcapi_migrate(c, MIGRATE_DUMP, &opts, sizeof(opts));
4965 }
4966
4967 WRAP_API_3(bool, lxcapi_checkpoint, char *, bool, bool)
4968
4969 static bool do_lxcapi_restore(struct lxc_container *c, char *directory, bool verbose)
4970 {
4971 struct migrate_opts opts;
4972
4973 memset(&opts, 0, sizeof(opts));
4974
4975 opts.directory = directory;
4976 opts.verbose = verbose;
4977
4978 return !do_lxcapi_migrate(c, MIGRATE_RESTORE, &opts, sizeof(opts));
4979 }
4980
4981 WRAP_API_2(bool, lxcapi_restore, char *, bool)
4982
4983 /* @st_mode is the st_mode field of the stat(source) return struct */
4984 static int create_mount_target(const char *dest, mode_t st_mode)
4985 {
4986 char *dirdup, *destdirname;
4987 int ret;
4988
4989 dirdup = strdup(dest);
4990 if (!dirdup) {
4991 SYSERROR("Failed to duplicate target name \"%s\"", dest);
4992 return -1;
4993 }
4994 destdirname = dirname(dirdup);
4995
4996 ret = mkdir_p(destdirname, 0755);
4997 if (ret < 0) {
4998 SYSERROR("Failed to create \"%s\"", destdirname);
4999 free(dirdup);
5000 return ret;
5001 }
5002 free(dirdup);
5003
5004 (void)remove(dest);
5005
5006 if (S_ISDIR(st_mode))
5007 ret = mkdir(dest, 0000);
5008 else
5009 ret = mknod(dest, S_IFREG | 0000, 0);
5010
5011 if (ret == 0)
5012 TRACE("Created mount target \"%s\"", dest);
5013 else if (ret < 0 && errno != EEXIST) {
5014 SYSERROR("Failed to create mount target \"%s\"", dest);
5015 return -1;
5016 }
5017
5018 return 0;
5019 }
5020
5021 static int do_lxcapi_mount(struct lxc_container *c, const char *source,
5022 const char *target, const char *filesystemtype,
5023 unsigned long mountflags, const void *data,
5024 struct lxc_mount *mnt)
5025 {
5026 char *suff, *sret;
5027 char template[PATH_MAX], path[PATH_MAX];
5028 pid_t pid, init_pid;
5029 struct stat sb;
5030 bool is_dir;
5031 int ret = -1, fd = -EBADF;
5032
5033 if (!c || !c->lxc_conf) {
5034 ERROR("Container or configuration is NULL");
5035 return -EINVAL;
5036 }
5037
5038 if (!c->lxc_conf->shmount.path_host) {
5039 ERROR("Host path to shared mountpoint must be specified in the config\n");
5040 return -EINVAL;
5041 }
5042
5043 ret = snprintf(template, sizeof(template), "%s/.lxcmount_XXXXXX", c->lxc_conf->shmount.path_host);
5044 if (ret < 0 || (size_t)ret >= sizeof(template)) {
5045 SYSERROR("Error writing shmounts tempdir name");
5046 goto out;
5047 }
5048
5049 /* Create a temporary file / dir under the shared mountpoint */
5050 if (!source || strcmp(source, "") == 0) {
5051 /* If source is not specified, maybe we want to mount a filesystem? */
5052 sb.st_mode = S_IFDIR;
5053 } else {
5054 ret = stat(source, &sb);
5055 if (ret < 0) {
5056 SYSERROR("Error getting stat info about the source \"%s\"", source);
5057 goto out;
5058 }
5059 }
5060
5061 is_dir = (S_ISDIR(sb.st_mode) != 0);
5062 if (is_dir) {
5063 sret = mkdtemp(template);
5064 if (!sret) {
5065 SYSERROR("Could not create shmounts temporary dir");
5066 goto out;
5067 }
5068 } else {
5069 fd = lxc_make_tmpfile(template, false);
5070 if (fd < 0) {
5071 SYSERROR("Could not create shmounts temporary file");
5072 goto out;
5073 }
5074 }
5075
5076 /* Do the fork */
5077 pid = fork();
5078 if (pid < 0) {
5079 SYSERROR("Could not fork");
5080 goto out;
5081 }
5082
5083 if (pid == 0) {
5084 /* Do the mount */
5085 ret = mount(source, template, filesystemtype, mountflags, data);
5086 if (ret < 0) {
5087 SYSERROR("Failed to mount onto \"%s\"", template);
5088 _exit(EXIT_FAILURE);
5089 }
5090 TRACE("Mounted \"%s\" onto \"%s\"", source, template);
5091
5092 init_pid = do_lxcapi_init_pid(c);
5093 if (init_pid < 0) {
5094 ERROR("Failed to obtain container's init pid");
5095 _exit(EXIT_FAILURE);
5096 }
5097
5098 /* Enter the container namespaces */
5099 if (!lxc_list_empty(&c->lxc_conf->id_map)) {
5100 if (!switch_to_ns(init_pid, "user")) {
5101 ERROR("Failed to enter user namespace");
5102 _exit(EXIT_FAILURE);
5103 }
5104
5105 if (!lxc_switch_uid_gid(0, 0))
5106 _exit(EXIT_FAILURE);
5107 }
5108
5109 if (!switch_to_ns(init_pid, "mnt")) {
5110 ERROR("Failed to enter mount namespace");
5111 _exit(EXIT_FAILURE);
5112 }
5113
5114 ret = create_mount_target(target, sb.st_mode);
5115 if (ret < 0)
5116 _exit(EXIT_FAILURE);
5117
5118 suff = strrchr(template, '/');
5119 if (!suff)
5120 goto cleanup_target_in_child;
5121
5122 ret = snprintf(path, sizeof(path), "%s%s", c->lxc_conf->shmount.path_cont, suff);
5123 if (ret < 0 || (size_t)ret >= sizeof(path)) {
5124 SYSERROR("Error writing container mountpoint name");
5125 goto cleanup_target_in_child;
5126 }
5127
5128 ret = mount(path, target, NULL, MS_MOVE | MS_REC, NULL);
5129 if (ret < 0) {
5130 SYSERROR("Failed to move the mount from \"%s\" to \"%s\"", path, target);
5131 goto cleanup_target_in_child;
5132 }
5133 TRACE("Moved mount from \"%s\" to \"%s\"", path, target);
5134
5135 _exit(EXIT_SUCCESS);
5136
5137 cleanup_target_in_child:
5138 (void)remove(target);
5139 _exit(EXIT_FAILURE);
5140 }
5141
5142 ret = wait_for_pid(pid);
5143 if (ret < 0)
5144 SYSERROR("Wait for the child with pid %ld failed", (long)pid);
5145 else
5146 ret = 0;
5147
5148 if (umount2(template, MNT_DETACH))
5149 SYSWARN("Failed to remove temporary mount \"%s\"", template);
5150
5151 if (is_dir)
5152 (void)rmdir(template);
5153 else
5154 (void)unlink(template);
5155
5156 out:
5157 if (fd >= 0)
5158 close(fd);
5159
5160 return ret;
5161 }
5162
5163 WRAP_API_6(int, lxcapi_mount, const char *, const char *, const char *,
5164 unsigned long, const void *, struct lxc_mount *)
5165
5166 static int do_lxcapi_umount(struct lxc_container *c, const char *target,
5167 unsigned long flags, struct lxc_mount *mnt)
5168 {
5169 pid_t pid, init_pid;
5170 int ret = -1;
5171
5172 if (!c || !c->lxc_conf) {
5173 ERROR("Container or configuration is NULL");
5174 return -EINVAL;
5175 }
5176
5177 /* Do the fork */
5178 pid = fork();
5179 if (pid < 0) {
5180 SYSERROR("Could not fork");
5181 return -1;
5182 }
5183
5184 if (pid == 0) {
5185 init_pid = do_lxcapi_init_pid(c);
5186 if (init_pid < 0) {
5187 ERROR("Failed to obtain container's init pid");
5188 _exit(EXIT_FAILURE);
5189 }
5190
5191 /* Enter the container namespaces */
5192 if (!lxc_list_empty(&c->lxc_conf->id_map)) {
5193 if (!switch_to_ns(init_pid, "user")) {
5194 ERROR("Failed to enter user namespace");
5195 _exit(EXIT_FAILURE);
5196 }
5197 }
5198
5199 if (!switch_to_ns(init_pid, "mnt")) {
5200 ERROR("Failed to enter mount namespace");
5201 _exit(EXIT_FAILURE);
5202 }
5203
5204 /* Do the unmount */
5205 ret = umount2(target, flags);
5206 if (ret < 0) {
5207 SYSERROR("Failed to umount \"%s\"", target);
5208 _exit(EXIT_FAILURE);
5209 }
5210
5211 _exit(EXIT_SUCCESS);
5212 }
5213
5214 ret = wait_for_pid(pid);
5215 if (ret < 0) {
5216 SYSERROR("Wait for the child with pid %ld failed", (long)pid);
5217 return -ret;
5218 }
5219
5220 return 0;
5221 }
5222
5223 WRAP_API_3(int, lxcapi_umount, const char *, unsigned long, struct lxc_mount*)
5224
5225 static int lxcapi_attach_run_waitl(struct lxc_container *c, lxc_attach_options_t *options, const char *program, const char *arg, ...)
5226 {
5227 va_list ap;
5228 const char **argv;
5229 int ret;
5230
5231 if (!c)
5232 return -1;
5233
5234 current_config = c->lxc_conf;
5235
5236 va_start(ap, arg);
5237 argv = lxc_va_arg_list_to_argv_const(ap, 1);
5238 va_end(ap);
5239
5240 if (!argv) {
5241 ERROR("Memory allocation error.");
5242 ret = -1;
5243 goto out;
5244 }
5245 argv[0] = arg;
5246
5247 ret = do_lxcapi_attach_run_wait(c, options, program, (const char * const *)argv);
5248 free((void*)argv);
5249
5250 out:
5251 current_config = NULL;
5252 return ret;
5253 }
5254
5255 static int do_lxcapi_seccomp_notify_fd(struct lxc_container *c)
5256 {
5257 if (!c || !c->lxc_conf)
5258 return minus_one_set_errno(-EINVAL);
5259
5260 return lxc_seccomp_get_notify_fd(&c->lxc_conf->seccomp);
5261 }
5262
5263 WRAP_API(int, lxcapi_seccomp_notify_fd)
5264
5265 struct lxc_container *lxc_container_new(const char *name, const char *configpath)
5266 {
5267 struct lxc_container *c;
5268 size_t len;
5269 int rc;
5270
5271 if (!name)
5272 return NULL;
5273
5274 c = malloc(sizeof(*c));
5275 if (!c) {
5276 fprintf(stderr, "Failed to allocate memory for %s\n", name);
5277 return NULL;
5278 }
5279 memset(c, 0, sizeof(*c));
5280
5281 if (configpath)
5282 c->config_path = strdup(configpath);
5283 else
5284 c->config_path = strdup(lxc_global_config_value("lxc.lxcpath"));
5285 if (!c->config_path) {
5286 fprintf(stderr, "Failed to allocate memory for %s\n", name);
5287 goto err;
5288 }
5289
5290 remove_trailing_slashes(c->config_path);
5291
5292 len = strlen(name);
5293 c->name = malloc(len + 1);
5294 if (!c->name) {
5295 fprintf(stderr, "Failed to allocate memory for %s\n", name);
5296 goto err;
5297 }
5298 (void)strlcpy(c->name, name, len + 1);
5299
5300 c->numthreads = 1;
5301 c->slock = lxc_newlock(c->config_path, name);
5302 if (!c->slock) {
5303 fprintf(stderr, "Failed to create lock for %s\n", name);
5304 goto err;
5305 }
5306
5307 c->privlock = lxc_newlock(NULL, NULL);
5308 if (!c->privlock) {
5309 fprintf(stderr, "Failed to create private lock for %s\n", name);
5310 goto err;
5311 }
5312
5313 if (!set_config_filename(c)) {
5314 fprintf(stderr, "Failed to create config file name for %s\n", name);
5315 goto err;
5316 }
5317
5318 if (file_exists(c->configfile) && !lxcapi_load_config(c, NULL)) {
5319 fprintf(stderr, "Failed to load config for %s\n", name);
5320 goto err;
5321 }
5322
5323 rc = ongoing_create(c);
5324 switch (rc) {
5325 case LXC_CREATE_INCOMPLETE:
5326 SYSERROR("Failed to complete container creation for %s", c->name);
5327 container_destroy(c, NULL);
5328 lxcapi_clear_config(c);
5329 break;
5330 case LXC_CREATE_ONGOING:
5331 /* container creation going on */
5332 break;
5333 case LXC_CREATE_FAILED:
5334 /* container creation failed */
5335 if (errno != EACCES && errno != EPERM) {
5336 /* insufficient privileges */
5337 SYSERROR("Failed checking for incomplete container %s creation", c->name);
5338 goto err;
5339 }
5340 break;
5341 }
5342
5343 c->daemonize = true;
5344 c->pidfile = NULL;
5345
5346 /* Assign the member functions. */
5347 c->is_defined = lxcapi_is_defined;
5348 c->state = lxcapi_state;
5349 c->is_running = lxcapi_is_running;
5350 c->freeze = lxcapi_freeze;
5351 c->unfreeze = lxcapi_unfreeze;
5352 c->console = lxcapi_console;
5353 c->console_getfd = lxcapi_console_getfd;
5354 c->init_pid = lxcapi_init_pid;
5355 c->load_config = lxcapi_load_config;
5356 c->want_daemonize = lxcapi_want_daemonize;
5357 c->want_close_all_fds = lxcapi_want_close_all_fds;
5358 c->start = lxcapi_start;
5359 c->startl = lxcapi_startl;
5360 c->stop = lxcapi_stop;
5361 c->config_file_name = lxcapi_config_file_name;
5362 c->wait = lxcapi_wait;
5363 c->set_config_item = lxcapi_set_config_item;
5364 c->destroy = lxcapi_destroy;
5365 c->destroy_with_snapshots = lxcapi_destroy_with_snapshots;
5366 c->rename = lxcapi_rename;
5367 c->save_config = lxcapi_save_config;
5368 c->get_keys = lxcapi_get_keys;
5369 c->create = lxcapi_create;
5370 c->createl = lxcapi_createl;
5371 c->shutdown = lxcapi_shutdown;
5372 c->reboot = lxcapi_reboot;
5373 c->reboot2 = lxcapi_reboot2;
5374 c->clear_config = lxcapi_clear_config;
5375 c->clear_config_item = lxcapi_clear_config_item;
5376 c->get_config_item = lxcapi_get_config_item;
5377 c->get_running_config_item = lxcapi_get_running_config_item;
5378 c->get_cgroup_item = lxcapi_get_cgroup_item;
5379 c->set_cgroup_item = lxcapi_set_cgroup_item;
5380 c->get_config_path = lxcapi_get_config_path;
5381 c->set_config_path = lxcapi_set_config_path;
5382 c->clone = lxcapi_clone;
5383 c->get_interfaces = lxcapi_get_interfaces;
5384 c->get_ips = lxcapi_get_ips;
5385 c->attach = lxcapi_attach;
5386 c->attach_run_wait = lxcapi_attach_run_wait;
5387 c->attach_run_waitl = lxcapi_attach_run_waitl;
5388 c->snapshot = lxcapi_snapshot;
5389 c->snapshot_list = lxcapi_snapshot_list;
5390 c->snapshot_restore = lxcapi_snapshot_restore;
5391 c->snapshot_destroy = lxcapi_snapshot_destroy;
5392 c->snapshot_destroy_all = lxcapi_snapshot_destroy_all;
5393 c->may_control = lxcapi_may_control;
5394 c->add_device_node = lxcapi_add_device_node;
5395 c->remove_device_node = lxcapi_remove_device_node;
5396 c->attach_interface = lxcapi_attach_interface;
5397 c->detach_interface = lxcapi_detach_interface;
5398 c->checkpoint = lxcapi_checkpoint;
5399 c->restore = lxcapi_restore;
5400 c->migrate = lxcapi_migrate;
5401 c->console_log = lxcapi_console_log;
5402 c->mount = lxcapi_mount;
5403 c->umount = lxcapi_umount;
5404 c->seccomp_notify_fd = lxcapi_seccomp_notify_fd;
5405
5406 return c;
5407
5408 err:
5409 lxc_container_free(c);
5410 return NULL;
5411 }
5412
5413 int lxc_get_wait_states(const char **states)
5414 {
5415 int i;
5416
5417 if (states)
5418 for (i=0; i<MAX_STATE; i++)
5419 states[i] = lxc_state2str(i);
5420
5421 return MAX_STATE;
5422 }
5423
5424 /*
5425 * These next two could probably be done smarter with reusing a common function
5426 * with different iterators and tests...
5427 */
5428 int list_defined_containers(const char *lxcpath, char ***names, struct lxc_container ***cret)
5429 {
5430 DIR *dir;
5431 int i, cfound = 0, nfound = 0;
5432 struct dirent *direntp;
5433 struct lxc_container *c;
5434
5435 if (!lxcpath)
5436 lxcpath = lxc_global_config_value("lxc.lxcpath");
5437
5438 dir = opendir(lxcpath);
5439 if (!dir) {
5440 SYSERROR("opendir on lxcpath");
5441 return -1;
5442 }
5443
5444 if (cret)
5445 *cret = NULL;
5446
5447 if (names)
5448 *names = NULL;
5449
5450 while ((direntp = readdir(dir))) {
5451 /* Ignore '.', '..' and any hidden directory. */
5452 if (!strncmp(direntp->d_name, ".", 1))
5453 continue;
5454
5455 if (!config_file_exists(lxcpath, direntp->d_name))
5456 continue;
5457
5458 if (names)
5459 if (!add_to_array(names, direntp->d_name, cfound))
5460 goto free_bad;
5461
5462 cfound++;
5463
5464 if (!cret) {
5465 nfound++;
5466 continue;
5467 }
5468
5469 c = lxc_container_new(direntp->d_name, lxcpath);
5470 if (!c) {
5471 INFO("Container %s:%s has a config but could not be loaded",
5472 lxcpath, direntp->d_name);
5473
5474 if (names)
5475 if(!remove_from_array(names, direntp->d_name, cfound--))
5476 goto free_bad;
5477
5478 continue;
5479 }
5480
5481 if (!do_lxcapi_is_defined(c)) {
5482 INFO("Container %s:%s has a config but is not defined",
5483 lxcpath, direntp->d_name);
5484
5485 if (names)
5486 if(!remove_from_array(names, direntp->d_name, cfound--))
5487 goto free_bad;
5488
5489 lxc_container_put(c);
5490 continue;
5491 }
5492
5493 if (!add_to_clist(cret, c, nfound, true)) {
5494 lxc_container_put(c);
5495 goto free_bad;
5496 }
5497
5498 nfound++;
5499 }
5500
5501 closedir(dir);
5502 return nfound;
5503
5504 free_bad:
5505 if (names && *names) {
5506 for (i=0; i<cfound; i++)
5507 free((*names)[i]);
5508 free(*names);
5509 }
5510
5511 if (cret && *cret) {
5512 for (i=0; i<nfound; i++)
5513 lxc_container_put((*cret)[i]);
5514 free(*cret);
5515 }
5516
5517 closedir(dir);
5518 return -1;
5519 }
5520
5521 int list_active_containers(const char *lxcpath, char ***nret,
5522 struct lxc_container ***cret)
5523 {
5524 int i, ret = -1, cret_cnt = 0, ct_name_cnt = 0;
5525 int lxcpath_len;
5526 char *line = NULL;
5527 char **ct_name = NULL;
5528 size_t len = 0;
5529 struct lxc_container *c = NULL;
5530 bool is_hashed;
5531
5532 if (!lxcpath)
5533 lxcpath = lxc_global_config_value("lxc.lxcpath");
5534 lxcpath_len = strlen(lxcpath);
5535
5536 if (cret)
5537 *cret = NULL;
5538
5539 if (nret)
5540 *nret = NULL;
5541
5542 FILE *f = fopen("/proc/net/unix", "r");
5543 if (!f)
5544 return -1;
5545
5546 while (getline(&line, &len, f) != -1) {
5547 char *p = strrchr(line, ' '), *p2;
5548 if (!p)
5549 continue;
5550 p++;
5551
5552 if (*p != 0x40)
5553 continue;
5554 p++;
5555
5556 is_hashed = false;
5557
5558 if (strncmp(p, lxcpath, lxcpath_len) == 0) {
5559 p += lxcpath_len;
5560 } else if (strncmp(p, "lxc/", 4) == 0) {
5561 p += 4;
5562 is_hashed = true;
5563 } else {
5564 continue;
5565 }
5566
5567 while (*p == '/')
5568 p++;
5569
5570 /* Now p is the start of lxc_name. */
5571 p2 = strchr(p, '/');
5572 if (!p2 || strncmp(p2, "/command", 8) != 0)
5573 continue;
5574 *p2 = '\0';
5575
5576 if (is_hashed) {
5577 char *recvpath = lxc_cmd_get_lxcpath(p);
5578 if (!recvpath)
5579 continue;
5580
5581 if (strncmp(lxcpath, recvpath, lxcpath_len) != 0) {
5582 free(recvpath);
5583 continue;
5584 }
5585 free(recvpath);
5586
5587 p = lxc_cmd_get_name(p);
5588 if (!p)
5589 continue;
5590 }
5591
5592 if (array_contains(&ct_name, p, ct_name_cnt)) {
5593 if (is_hashed)
5594 free(p);
5595 continue;
5596 }
5597
5598 if (!add_to_array(&ct_name, p, ct_name_cnt)) {
5599 if (is_hashed)
5600 free(p);
5601 goto free_cret_list;
5602 }
5603
5604 ct_name_cnt++;
5605
5606 if (!cret) {
5607 if (is_hashed)
5608 free(p);
5609 continue;
5610 }
5611
5612 c = lxc_container_new(p, lxcpath);
5613 if (!c) {
5614 INFO("Container %s:%s is running but could not be loaded",
5615 lxcpath, p);
5616
5617 remove_from_array(&ct_name, p, ct_name_cnt--);
5618 if (is_hashed)
5619 free(p);
5620
5621 continue;
5622 }
5623
5624 if (is_hashed)
5625 free(p);
5626
5627 /*
5628 * If this is an anonymous container, then is_defined *can*
5629 * return false. So we don't do that check. Count on the
5630 * fact that the command socket exists.
5631 */
5632
5633 if (!add_to_clist(cret, c, cret_cnt, true)) {
5634 lxc_container_put(c);
5635 goto free_cret_list;
5636 }
5637
5638 cret_cnt++;
5639 }
5640
5641 if (nret && cret && cret_cnt != ct_name_cnt) {
5642 if (c)
5643 lxc_container_put(c);
5644 goto free_cret_list;
5645 }
5646
5647 ret = ct_name_cnt;
5648 if (nret)
5649 *nret = ct_name;
5650 else
5651 goto free_ct_name;
5652
5653 goto out;
5654
5655 free_cret_list:
5656 if (cret && *cret) {
5657 for (i = 0; i < cret_cnt; i++)
5658 lxc_container_put((*cret)[i]);
5659 free(*cret);
5660 }
5661
5662 free_ct_name:
5663 if (ct_name) {
5664 for (i = 0; i < ct_name_cnt; i++)
5665 free(ct_name[i]);
5666 free(ct_name);
5667 }
5668
5669 out:
5670 free(line);
5671 fclose(f);
5672 return ret;
5673 }
5674
5675 int list_all_containers(const char *lxcpath, char ***nret,
5676 struct lxc_container ***cret)
5677 {
5678 int i, ret, active_cnt, ct_cnt, ct_list_cnt;
5679 char **active_name;
5680 char **ct_name;
5681 struct lxc_container **ct_list = NULL;
5682
5683 ct_cnt = list_defined_containers(lxcpath, &ct_name, NULL);
5684 if (ct_cnt < 0)
5685 return ct_cnt;
5686
5687 active_cnt = list_active_containers(lxcpath, &active_name, NULL);
5688 if (active_cnt < 0) {
5689 ret = active_cnt;
5690 goto free_ct_name;
5691 }
5692
5693 for (i = 0; i < active_cnt; i++) {
5694 if (!array_contains(&ct_name, active_name[i], ct_cnt)) {
5695 if (!add_to_array(&ct_name, active_name[i], ct_cnt)) {
5696 ret = -1;
5697 goto free_active_name;
5698 }
5699
5700 ct_cnt++;
5701 }
5702
5703 free(active_name[i]);
5704 active_name[i] = NULL;
5705 }
5706
5707 free(active_name);
5708 active_name = NULL;
5709 active_cnt = 0;
5710
5711 for (i = 0, ct_list_cnt = 0; i < ct_cnt && cret; i++) {
5712 struct lxc_container *c;
5713
5714 c = lxc_container_new(ct_name[i], lxcpath);
5715 if (!c) {
5716 WARN("Container %s:%s could not be loaded", lxcpath, ct_name[i]);
5717 remove_from_array(&ct_name, ct_name[i], ct_cnt--);
5718 continue;
5719 }
5720
5721 if (!add_to_clist(&ct_list, c, ct_list_cnt, false)) {
5722 lxc_container_put(c);
5723 ret = -1;
5724 goto free_ct_list;
5725 }
5726
5727 ct_list_cnt++;
5728 }
5729
5730 if (cret)
5731 *cret = ct_list;
5732
5733 if (nret) {
5734 *nret = ct_name;
5735 } else {
5736 ret = ct_cnt;
5737 goto free_ct_name;
5738 }
5739
5740 return ct_cnt;
5741
5742 free_ct_list:
5743 for (i = 0; i < ct_list_cnt; i++) {
5744 lxc_container_put(ct_list[i]);
5745 }
5746 free(ct_list);
5747
5748 free_active_name:
5749 for (i = 0; i < active_cnt; i++) {
5750 free(active_name[i]);
5751 }
5752 free(active_name);
5753
5754 free_ct_name:
5755 for (i = 0; i < ct_cnt; i++) {
5756 free(ct_name[i]);
5757 }
5758 free(ct_name);
5759 return ret;
5760 }
5761
5762 bool lxc_config_item_is_supported(const char *key)
5763 {
5764 return !!lxc_get_config(key);
5765 }
5766
5767 bool lxc_has_api_extension(const char *extension)
5768 {
5769 /* The NULL API extension is always present. :) */
5770 if (!extension)
5771 return true;
5772
5773 for (size_t i = 0; i < nr_api_extensions; i++)
5774 if (strcmp(api_extensions[i], extension) == 0)
5775 return true;
5776
5777 return false;
5778 }
LXC mirror