]> git.proxmox.com Git - mirror_lxc.git/blob - src/lxc/lxccontainer.c
projects / mirror_lxc.git / blob
? search:
summary | shortlog | log | commit | commitdiff | tree
blame | history | raw | HEAD
Merge pull request #3045 from hallyn/2019-06-13/openssl
[mirror_lxc.git] / src / lxc / lxccontainer.c
1 /* liblxcapi
2 *
3 * Copyright © 2012 Serge Hallyn <serge.hallyn@ubuntu.com>.
4 * Copyright © 2012 Canonical Ltd.
5 *
6 * This library is free software; you can redistribute it and/or
7 * modify it under the terms of the GNU Lesser General Public
8 * License as published by the Free Software Foundation; either
9 * version 2.1 of the License, or (at your option) any later version.
10
11 * This library is distributed in the hope that it will be useful,
12 * but WITHOUT ANY WARRANTY; without even the implied warranty of
13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
14 * Lesser General Public License for more details.
15
16 * You should have received a copy of the GNU Lesser General Public
17 * License along with this library; if not, write to the Free Software
18 * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
19 */
20
21 #ifndef _GNU_SOURCE
22 #define _GNU_SOURCE 1
23 #endif
24 #include <arpa/inet.h>
25 #include <dirent.h>
26 #include <errno.h>
27 #include <fcntl.h>
28 #include <grp.h>
29 #include <libgen.h>
30 #include <pthread.h>
31 #include <sched.h>
32 #include <stdarg.h>
33 #include <stdint.h>
34 #include <stdio.h>
35 #include <stdlib.h>
36 #include <sys/file.h>
37 #include <sys/mman.h>
38 #include <sys/mount.h>
39 #include <sys/stat.h>
40 #include <sys/syscall.h>
41 #include <sys/sysmacros.h>
42 #include <sys/types.h>
43 #include <sys/wait.h>
44 #include <unistd.h>
45
46 #include "../include/netns_ifaddrs.h"
47 #include "af_unix.h"
48 #include "api_extensions.h"
49 #include "attach.h"
50 #include "cgroup.h"
51 #include "commands.h"
52 #include "commands_utils.h"
53 #include "conf.h"
54 #include "config.h"
55 #include "confile.h"
56 #include "confile_utils.h"
57 #include "criu.h"
58 #include "error.h"
59 #include "initutils.h"
60 #include "log.h"
61 #include "lxc.h"
62 #include "lxccontainer.h"
63 #include "lxclock.h"
64 #include "memory_utils.h"
65 #include "monitor.h"
66 #include "namespace.h"
67 #include "network.h"
68 #include "parse.h"
69 #include "raw_syscalls.h"
70 #include "start.h"
71 #include "state.h"
72 #include "storage.h"
73 #include "storage/btrfs.h"
74 #include "storage/overlay.h"
75 #include "storage_utils.h"
76 #include "sync.h"
77 #include "syscall_wrappers.h"
78 #include "terminal.h"
79 #include "utils.h"
80 #include "version.h"
81
82 #if HAVE_OPENSSL
83 #include <openssl/evp.h>
84 #endif
85
86 /* major()/minor() */
87 #ifdef MAJOR_IN_MKDEV
88 #include <sys/mkdev.h>
89 #endif
90
91 #if IS_BIONIC
92 #include <../include/lxcmntent.h>
93 #else
94 #include <mntent.h>
95 #endif
96
97 #ifndef HAVE_STRLCPY
98 #include "include/strlcpy.h"
99 #endif
100
101 /* Define faccessat() if missing from the C library */
102 #ifndef HAVE_FACCESSAT
103 static int faccessat(int __fd, const char *__file, int __type, int __flag)
104 {
105 #ifdef __NR_faccessat
106 return syscall(__NR_faccessat, __fd, __file, __type, __flag);
107 #else
108 errno = ENOSYS;
109 return -1;
110 #endif
111 }
112 #endif
113
114 lxc_log_define(lxccontainer, lxc);
115
116 static bool do_lxcapi_destroy(struct lxc_container *c);
117 static const char *lxcapi_get_config_path(struct lxc_container *c);
118 #define do_lxcapi_get_config_path(c) lxcapi_get_config_path(c)
119 static bool do_lxcapi_set_config_item(struct lxc_container *c, const char *key, const char *v);
120 static bool container_destroy(struct lxc_container *c,
121 struct lxc_storage *storage);
122 static bool get_snappath_dir(struct lxc_container *c, char *snappath);
123 static bool lxcapi_snapshot_destroy_all(struct lxc_container *c);
124 static bool do_lxcapi_save_config(struct lxc_container *c, const char *alt_file);
125
126 static bool config_file_exists(const char *lxcpath, const char *cname)
127 {
128 __do_free char *fname = NULL;
129 int ret;
130 size_t len;
131
132 /* $lxcpath + '/' + $cname + '/config' + \0 */
133 len = strlen(lxcpath) + strlen(cname) + 9;
134 fname = must_realloc(NULL, len);
135 ret = snprintf(fname, len, "%s/%s/config", lxcpath, cname);
136 if (ret < 0 || (size_t)ret >= len)
137 return false;
138
139 return file_exists(fname);
140 }
141
142 /*
143 * A few functions to help detect when a container creation failed. If a
144 * container creation was killed partway through, then trying to actually start
145 * that container could harm the host. We detect this by creating a 'partial'
146 * file under the container directory, and keeping an advisory lock. When
147 * container creation completes, we remove that file. When we load or try to
148 * start a container, if we find that file, without a flock, we remove the
149 * container.
150 */
151 enum {
152 LXC_CREATE_FAILED = -1,
153 LXC_CREATE_SUCCESS = 0,
154 LXC_CREATE_ONGOING = 1,
155 LXC_CREATE_INCOMPLETE = 2,
156 };
157
158 static int ongoing_create(struct lxc_container *c)
159 {
160 __do_close_prot_errno int fd = -EBADF;
161 __do_free char *path = NULL;
162 struct flock lk = {0};
163 int ret;
164 size_t len;
165
166 len = strlen(c->config_path) + strlen(c->name) + 10;
167 path = must_realloc(NULL, len);
168 ret = snprintf(path, len, "%s/%s/partial", c->config_path, c->name);
169 if (ret < 0 || (size_t)ret >= len)
170 return LXC_CREATE_FAILED;
171
172 fd = open(path, O_RDWR | O_CLOEXEC);
173 if (fd < 0) {
174 if (errno != ENOENT)
175 return LXC_CREATE_FAILED;
176
177 return LXC_CREATE_SUCCESS;
178 }
179
180 lk.l_type = F_WRLCK;
181 lk.l_whence = SEEK_SET;
182 /*
183 * F_OFD_GETLK requires that l_pid be set to 0 otherwise the kernel
184 * will EINVAL us.
185 */
186 lk.l_pid = 0;
187
188 ret = fcntl(fd, F_OFD_GETLK, &lk);
189 if (ret < 0 && errno == EINVAL) {
190 ret = flock(fd, LOCK_EX | LOCK_NB);
191 if (ret < 0 && errno == EWOULDBLOCK)
192 ret = 0;
193 }
194
195 /* F_OFD_GETLK will not send us back a pid so don't check it. */
196 if (ret == 0)
197 /* Create is still ongoing. */
198 return LXC_CREATE_ONGOING;
199
200 /* Create completed but partial is still there. */
201 return LXC_CREATE_INCOMPLETE;
202 }
203
204 static int create_partial(struct lxc_container *c)
205 {
206 __do_free char *path = NULL;
207 int fd, ret;
208 size_t len;
209 struct flock lk = {0};
210
211 /* $lxcpath + '/' + $name + '/partial' + \0 */
212 len = strlen(c->config_path) + strlen(c->name) + 10;
213 path = must_realloc(NULL, len);
214 ret = snprintf(path, len, "%s/%s/partial", c->config_path, c->name);
215 if (ret < 0 || (size_t)ret >= len)
216 return -1;
217
218 fd = open(path, O_RDWR | O_CREAT | O_EXCL | O_CLOEXEC, 0000);
219 if (fd < 0)
220 return -1;
221
222 lk.l_type = F_WRLCK;
223 lk.l_whence = SEEK_SET;
224
225 ret = fcntl(fd, F_OFD_SETLKW, &lk);
226 if (ret < 0) {
227 if (errno == EINVAL) {
228 ret = flock(fd, LOCK_EX);
229 if (ret == 0)
230 return fd;
231 }
232
233 SYSERROR("Failed to lock partial file %s", path);
234 close(fd);
235 return -1;
236 }
237
238 return fd;
239 }
240
241 static void remove_partial(struct lxc_container *c, int fd)
242 {
243 __do_free char *path = NULL;
244 int ret;
245 size_t len;
246
247 close(fd);
248
249 /* $lxcpath + '/' + $name + '/partial' + \0 */
250 len = strlen(c->config_path) + strlen(c->name) + 10;
251 path = must_realloc(NULL, len);
252 ret = snprintf(path, len, "%s/%s/partial", c->config_path, c->name);
253 if (ret < 0 || (size_t)ret >= len)
254 return;
255
256 ret = unlink(path);
257 if (ret < 0)
258 SYSERROR("Failed to remove partial file %s", path);
259 }
260
261 /* LOCKING
262 * 1. container_mem_lock(c) protects the struct lxc_container from multiple threads.
263 * 2. container_disk_lock(c) protects the on-disk container data - in particular the
264 * container configuration file.
265 * The container_disk_lock also takes the container_mem_lock.
266 * 3. thread_mutex protects process data (ex: fd table) from multiple threads.
267 * NOTHING mutexes two independent programs with their own struct
268 * lxc_container for the same c->name, between API calls. For instance,
269 * c->config_read(); c->start(); Between those calls, data on disk
270 * could change (which shouldn't bother the caller unless for instance
271 * the rootfs get moved). c->config_read(); update; c->config_write();
272 * Two such updaters could race. The callers should therefore check their
273 * results. Trying to prevent that would necessarily expose us to deadlocks
274 * due to hung callers. So I prefer to keep the locks only within our own
275 * functions, not across functions.
276 *
277 * If you're going to clone while holding a lxccontainer, increment
278 * c->numthreads (under privlock) before forking. When deleting,
279 * decrement numthreads under privlock, then if it hits 0 you can delete.
280 * Do not ever use a lxccontainer whose numthreads you did not bump.
281 */
282 static void lxc_container_free(struct lxc_container *c)
283 {
284 if (!c)
285 return;
286
287 free(c->configfile);
288 c->configfile = NULL;
289
290 free(c->error_string);
291 c->error_string = NULL;
292
293 if (c->slock) {
294 lxc_putlock(c->slock);
295 c->slock = NULL;
296 }
297
298 if (c->privlock) {
299 lxc_putlock(c->privlock);
300 c->privlock = NULL;
301 }
302
303 free(c->name);
304 c->name = NULL;
305
306 if (c->lxc_conf) {
307 lxc_conf_free(c->lxc_conf);
308 c->lxc_conf = NULL;
309 }
310
311 free(c->config_path);
312 c->config_path = NULL;
313
314 free(c);
315 }
316
317 /* Consider the following case:
318 *
319 * |====================================================================|
320 * | freer | racing get()er |
321 * |====================================================================|
322 * | lxc_container_put() | lxc_container_get() |
323 * | \ lxclock(c->privlock) | c->numthreads < 1? (no) |
324 * | \ c->numthreads = 0 | \ lxclock(c->privlock) -> waits |
325 * | \ lxcunlock() | \ |
326 * | \ lxc_container_free() | \ lxclock() returns |
327 * | | \ c->numthreads < 1 -> return 0 |
328 * | \ \ (free stuff) | |
329 * | \ \ sem_destroy(privlock) | |
330 * |_______________________________|____________________________________|
331 *
332 * When the get()er checks numthreads the first time, one of the following
333 * is true:
334 * 1. freer has set numthreads = 0. get() returns 0
335 * 2. freer is between lxclock and setting numthreads to 0. get()er will
336 * sem_wait on privlock, get lxclock after freer() drops it, then see
337 * numthreads is 0 and exit without touching lxclock again..
338 * 3. freer has not yet locked privlock. If get()er runs first, then put()er
339 * will see --numthreads = 1 and not call lxc_container_free().
340 */
341
342 int lxc_container_get(struct lxc_container *c)
343 {
344 if (!c)
345 return 0;
346
347 /* If someone else has already started freeing the container, don't try
348 * to take the lock, which may be invalid.
349 */
350 if (c->numthreads < 1)
351 return 0;
352
353 if (container_mem_lock(c))
354 return 0;
355
356 /* Bail without trying to unlock, bc the privlock is now probably in
357 * freed memory.
358 */
359 if (c->numthreads < 1)
360 return 0;
361
362 c->numthreads++;
363 container_mem_unlock(c);
364
365 return 1;
366 }
367
368 int lxc_container_put(struct lxc_container *c)
369 {
370 if (!c)
371 return -1;
372
373 if (container_mem_lock(c))
374 return -1;
375
376 c->numthreads--;
377
378 if (c->numthreads < 1) {
379 container_mem_unlock(c);
380 lxc_container_free(c);
381 return 1;
382 }
383
384 container_mem_unlock(c);
385 return 0;
386 }
387
388 static bool do_lxcapi_is_defined(struct lxc_container *c)
389 {
390 int statret;
391 struct stat statbuf;
392 bool ret = false;
393
394 if (!c)
395 return false;
396
397 if (container_mem_lock(c))
398 return false;
399
400 if (!c->configfile)
401 goto on_error;
402
403 statret = stat(c->configfile, &statbuf);
404 if (statret != 0)
405 goto on_error;
406
407 ret = true;
408
409 on_error:
410 container_mem_unlock(c);
411 return ret;
412 }
413
414 #define WRAP_API(rettype, fnname) \
415 static rettype fnname(struct lxc_container *c) \
416 { \
417 rettype ret; \
418 bool reset_config = false; \
419 \
420 if (!current_config && c && c->lxc_conf) { \
421 current_config = c->lxc_conf; \
422 reset_config = true; \
423 } \
424 \
425 ret = do_##fnname(c); \
426 if (reset_config) \
427 current_config = NULL; \
428 \
429 return ret; \
430 }
431
432 #define WRAP_API_1(rettype, fnname, t1) \
433 static rettype fnname(struct lxc_container *c, t1 a1) \
434 { \
435 rettype ret; \
436 bool reset_config = false; \
437 \
438 if (!current_config && c && c->lxc_conf) { \
439 current_config = c->lxc_conf; \
440 reset_config = true; \
441 } \
442 \
443 ret = do_##fnname(c, a1); \
444 if (reset_config) \
445 current_config = NULL; \
446 \
447 return ret; \
448 }
449
450 #define WRAP_API_2(rettype, fnname, t1, t2) \
451 static rettype fnname(struct lxc_container *c, t1 a1, t2 a2) \
452 { \
453 rettype ret; \
454 bool reset_config = false; \
455 \
456 if (!current_config && c && c->lxc_conf) { \
457 current_config = c->lxc_conf; \
458 reset_config = true; \
459 } \
460 \
461 ret = do_##fnname(c, a1, a2); \
462 if (reset_config) \
463 current_config = NULL; \
464 \
465 return ret; \
466 }
467
468 #define WRAP_API_3(rettype, fnname, t1, t2, t3) \
469 static rettype fnname(struct lxc_container *c, t1 a1, t2 a2, t3 a3) \
470 { \
471 rettype ret; \
472 bool reset_config = false; \
473 \
474 if (!current_config && c && c->lxc_conf) { \
475 current_config = c->lxc_conf; \
476 reset_config = true; \
477 } \
478 \
479 ret = do_##fnname(c, a1, a2, a3); \
480 if (reset_config) \
481 current_config = NULL; \
482 \
483 return ret; \
484 }
485
486 #define WRAP_API_6(rettype, fnname, t1, t2, t3, t4, t5, t6) \
487 static rettype fnname(struct lxc_container *c, t1 a1, t2 a2, t3 a3, \
488 t4 a4, t5 a5, t6 a6) \
489 { \
490 rettype ret; \
491 bool reset_config = false; \
492 \
493 if (!current_config && c && c->lxc_conf) { \
494 current_config = c->lxc_conf; \
495 reset_config = true; \
496 } \
497 \
498 ret = do_##fnname(c, a1, a2, a3, a4, a5, a6); \
499 if (reset_config) \
500 current_config = NULL; \
501 \
502 return ret; \
503 }
504
505 WRAP_API(bool, lxcapi_is_defined)
506
507 static const char *do_lxcapi_state(struct lxc_container *c)
508 {
509 lxc_state_t s;
510
511 if (!c)
512 return NULL;
513
514 s = lxc_getstate(c->name, c->config_path);
515 return lxc_state2str(s);
516 }
517
518 WRAP_API(const char *, lxcapi_state)
519
520 static bool is_stopped(struct lxc_container *c)
521 {
522 lxc_state_t s;
523
524 s = lxc_getstate(c->name, c->config_path);
525 return (s == STOPPED);
526 }
527
528 static bool do_lxcapi_is_running(struct lxc_container *c)
529 {
530 if (!c)
531 return false;
532
533 return !is_stopped(c);
534 }
535
536 WRAP_API(bool, lxcapi_is_running)
537
538 static bool do_lxcapi_freeze(struct lxc_container *c)
539 {
540 lxc_state_t s;
541
542 if (!c || !c->lxc_conf)
543 return false;
544
545 s = lxc_getstate(c->name, c->config_path);
546 if (s != FROZEN)
547 return lxc_freeze(c->lxc_conf, c->name, c->config_path) == 0;
548
549 return true;
550 }
551
552 WRAP_API(bool, lxcapi_freeze)
553
554 static bool do_lxcapi_unfreeze(struct lxc_container *c)
555 {
556 lxc_state_t s;
557
558 if (!c || !c->lxc_conf)
559 return false;
560
561 s = lxc_getstate(c->name, c->config_path);
562 if (s == FROZEN)
563 return lxc_unfreeze(c->lxc_conf, c->name, c->config_path) == 0;
564
565 return true;
566 }
567
568 WRAP_API(bool, lxcapi_unfreeze)
569
570 static int do_lxcapi_console_getfd(struct lxc_container *c, int *ttynum, int *masterfd)
571 {
572 if (!c)
573 return -1;
574
575 return lxc_terminal_getfd(c, ttynum, masterfd);
576 }
577
578 WRAP_API_2(int, lxcapi_console_getfd, int *, int *)
579
580 static int lxcapi_console(struct lxc_container *c, int ttynum, int stdinfd,
581 int stdoutfd, int stderrfd, int escape)
582 {
583 int ret;
584
585 if (!c)
586 return -1;
587
588 current_config = c->lxc_conf;
589 ret = lxc_console(c, ttynum, stdinfd, stdoutfd, stderrfd, escape);
590 current_config = NULL;
591
592 return ret;
593 }
594
595 static int do_lxcapi_console_log(struct lxc_container *c, struct lxc_console_log *log)
596 {
597 int ret;
598
599 if (!c)
600 return -EINVAL;
601
602 ret = lxc_cmd_console_log(c->name, do_lxcapi_get_config_path(c), log);
603 if (ret < 0) {
604 if (ret == -ENODATA)
605 NOTICE("The console log is empty");
606 else if (ret == -EFAULT)
607 NOTICE("The container does not keep a console log");
608 else if (ret == -ENOENT)
609 NOTICE("The container does not keep a console log file");
610 else if (ret == -EIO)
611 NOTICE("Failed to write console log to log file");
612 else
613 ERROR("Failed to retrieve console log");
614 }
615
616 return ret;
617 }
618
619 WRAP_API_1(int, lxcapi_console_log, struct lxc_console_log *)
620
621 static pid_t do_lxcapi_init_pid(struct lxc_container *c)
622 {
623 if (!c)
624 return -1;
625
626 return lxc_cmd_get_init_pid(c->name, c->config_path);
627 }
628
629 WRAP_API(pid_t, lxcapi_init_pid)
630
631 static bool load_config_locked(struct lxc_container *c, const char *fname)
632 {
633 if (!c->lxc_conf)
634 c->lxc_conf = lxc_conf_init();
635
636 if (!c->lxc_conf)
637 return false;
638
639 if (lxc_config_read(fname, c->lxc_conf, false) != 0)
640 return false;
641
642 c->lxc_conf->name = c->name;
643 return true;
644 }
645
646 static bool do_lxcapi_load_config(struct lxc_container *c, const char *alt_file)
647 {
648 int lret;
649 const char *fname;
650 bool need_disklock = false, ret = false;
651
652 if (!c)
653 return false;
654
655 fname = c->configfile;
656
657 if (alt_file)
658 fname = alt_file;
659
660 if (!fname)
661 return false;
662
663 /* If we're reading something other than the container's config, we only
664 * need to lock the in-memory container. If loading the container's
665 * config file, take the disk lock.
666 */
667 if (strcmp(fname, c->configfile) == 0)
668 need_disklock = true;
669
670 if (need_disklock)
671 lret = container_disk_lock(c);
672 else
673 lret = container_mem_lock(c);
674 if (lret)
675 return false;
676
677 ret = load_config_locked(c, fname);
678
679 if (need_disklock)
680 container_disk_unlock(c);
681 else
682 container_mem_unlock(c);
683
684 return ret;
685 }
686
687 WRAP_API_1(bool, lxcapi_load_config, const char *)
688
689 static bool do_lxcapi_want_daemonize(struct lxc_container *c, bool state)
690 {
691 if (!c || !c->lxc_conf)
692 return false;
693
694 if (container_mem_lock(c))
695 return false;
696
697 c->daemonize = state;
698
699 container_mem_unlock(c);
700
701 return true;
702 }
703
704 WRAP_API_1(bool, lxcapi_want_daemonize, bool)
705
706 static bool do_lxcapi_want_close_all_fds(struct lxc_container *c, bool state)
707 {
708 if (!c || !c->lxc_conf)
709 return false;
710
711 if (container_mem_lock(c))
712 return false;
713
714 c->lxc_conf->close_all_fds = state;
715
716 container_mem_unlock(c);
717
718 return true;
719 }
720
721 WRAP_API_1(bool, lxcapi_want_close_all_fds, bool)
722
723 static bool do_lxcapi_wait(struct lxc_container *c, const char *state,
724 int timeout)
725 {
726 int ret;
727
728 if (!c)
729 return false;
730
731 ret = lxc_wait(c->name, state, timeout, c->config_path);
732 return ret == 0;
733 }
734
735 WRAP_API_2(bool, lxcapi_wait, const char *, int)
736
737 static bool am_single_threaded(void)
738 {
739 DIR *dir;
740 struct dirent *direntp;
741 int count = 0;
742
743 dir = opendir("/proc/self/task");
744 if (!dir)
745 return false;
746
747 while ((direntp = readdir(dir))) {
748 if (strcmp(direntp->d_name, ".") == 0)
749 continue;
750
751 if (strcmp(direntp->d_name, "..") == 0)
752 continue;
753
754 count++;
755 if (count > 1)
756 break;
757 }
758 closedir(dir);
759
760 return count == 1;
761 }
762
763 static void push_arg(char ***argp, char *arg, int *nargs)
764 {
765 char *copy;
766 char **argv;
767
768 copy = must_copy_string(arg);
769
770 do {
771 argv = realloc(*argp, (*nargs + 2) * sizeof(char *));
772 } while (!argv);
773
774 *argp = argv;
775 argv[*nargs] = copy;
776 (*nargs)++;
777 argv[*nargs] = NULL;
778 }
779
780 static char **split_init_cmd(const char *incmd)
781 {
782 __do_free char *copy = NULL;
783 char *p;
784 char **argv;
785 int nargs = 0;
786
787 if (!incmd)
788 return NULL;
789
790 copy = must_copy_string(incmd);
791
792 do {
793 argv = malloc(sizeof(char *));
794 } while (!argv);
795
796 argv[0] = NULL;
797 lxc_iterate_parts (p, copy, " ")
798 push_arg(&argv, p, &nargs);
799
800 if (nargs == 0) {
801 free(argv);
802 return NULL;
803 }
804
805 return argv;
806 }
807
808 static void free_init_cmd(char **argv)
809 {
810 int i = 0;
811
812 if (!argv)
813 return;
814
815 while (argv[i])
816 free(argv[i++]);
817
818 free(argv);
819 }
820
821 static int lxc_rcv_status(int state_socket)
822 {
823 int ret;
824 int state = -1;
825
826 again:
827 /* Receive container state. */
828 ret = lxc_abstract_unix_rcv_credential(state_socket, &state, sizeof(int));
829 if (ret <= 0) {
830 if (errno != EINTR)
831 return -1;
832
833 TRACE("Caught EINTR; retrying");
834 goto again;
835 }
836
837 return state;
838 }
839
840 static bool wait_on_daemonized_start(struct lxc_handler *handler, int pid)
841 {
842 int ret, state;
843
844 /* Close write end of the socket pair. */
845 close(handler->state_socket_pair[1]);
846 handler->state_socket_pair[1] = -1;
847
848 state = lxc_rcv_status(handler->state_socket_pair[0]);
849
850 /* Close read end of the socket pair. */
851 close(handler->state_socket_pair[0]);
852 handler->state_socket_pair[0] = -1;
853
854 /* The first child is going to fork() again and then exits. So we reap
855 * the first child here.
856 */
857 ret = wait_for_pid(pid);
858 if (ret < 0)
859 DEBUG("Failed waiting on first child %d", pid);
860 else
861 DEBUG("First child %d exited", pid);
862
863 if (state < 0) {
864 SYSERROR("Failed to receive the container state");
865 return false;
866 }
867
868 /* If we receive anything else then running we know that the container
869 * failed to start.
870 */
871 if (state != RUNNING) {
872 ERROR("Received container state \"%s\" instead of \"RUNNING\"",
873 lxc_state2str(state));
874 return false;
875 }
876
877 TRACE("Container is in \"RUNNING\" state");
878 return true;
879 }
880
881 static bool do_lxcapi_start(struct lxc_container *c, int useinit, char * const argv[])
882 {
883 int ret;
884 struct lxc_handler *handler;
885 struct lxc_conf *conf;
886 char *default_args[] = {
887 "/sbin/init",
888 NULL,
889 };
890 char **init_cmd = NULL;
891 int keepfds[3] = {-1, -1, -1};
892
893 /* container does exist */
894 if (!c)
895 return false;
896
897 /* If anything fails before we set error_num, we want an error in there.
898 */
899 c->error_num = 1;
900
901 /* Container has not been setup. */
902 if (!c->lxc_conf)
903 return false;
904
905 ret = ongoing_create(c);
906 switch (ret) {
907 case LXC_CREATE_FAILED:
908 ERROR("Failed checking for incomplete container creation");
909 return false;
910 case LXC_CREATE_ONGOING:
911 ERROR("Ongoing container creation detected");
912 return false;
913 case LXC_CREATE_INCOMPLETE:
914 ERROR("Failed to create container");
915 do_lxcapi_destroy(c);
916 return false;
917 }
918
919 if (container_mem_lock(c))
920 return false;
921
922 conf = c->lxc_conf;
923
924 /* initialize handler */
925 handler = lxc_init_handler(c->name, conf, c->config_path, c->daemonize);
926
927 container_mem_unlock(c);
928 if (!handler)
929 return false;
930
931 if (!argv) {
932 if (useinit && conf->execute_cmd)
933 argv = init_cmd = split_init_cmd(conf->execute_cmd);
934 else
935 argv = init_cmd = split_init_cmd(conf->init_cmd);
936 }
937
938 /* ... otherwise use default_args. */
939 if (!argv) {
940 if (useinit) {
941 ERROR("No valid init detected");
942 lxc_free_handler(handler);
943 return false;
944 }
945 argv = default_args;
946 }
947
948 /* I'm not sure what locks we want here.Any? Is liblxc's locking enough
949 * here to protect the on disk container? We don't want to exclude
950 * things like lxc_info while the container is running.
951 */
952 if (c->daemonize) {
953 bool started;
954 char title[2048];
955 pid_t pid;
956
957 pid = fork();
958 if (pid < 0) {
959 free_init_cmd(init_cmd);
960 lxc_free_handler(handler);
961 return false;
962 }
963
964 /* first parent */
965 if (pid != 0) {
966 /* Set to NULL because we don't want father unlink
967 * the PID file, child will do the free and unlink.
968 */
969 c->pidfile = NULL;
970
971 /* Wait for container to tell us whether it started
972 * successfully.
973 */
974 started = wait_on_daemonized_start(handler, pid);
975
976 free_init_cmd(init_cmd);
977 lxc_free_handler(handler);
978 return started;
979 }
980
981 /* first child */
982
983 /* We don't really care if this doesn't print all the
984 * characters. All that it means is that the proctitle will be
985 * ugly. Similarly, we also don't care if setproctitle() fails.
986 */
987 ret = snprintf(title, sizeof(title), "[lxc monitor] %s %s", c->config_path, c->name);
988 if (ret > 0) {
989 ret = setproctitle(title);
990 if (ret < 0)
991 INFO("Failed to set process title to %s", title);
992 else
993 INFO("Set process title to %s", title);
994 }
995
996 /* We fork() a second time to be reparented to init. Like
997 * POSIX's daemon() function we change to "/" and redirect
998 * std{in,out,err} to /dev/null.
999 */
1000 pid = fork();
1001 if (pid < 0) {
1002 SYSERROR("Failed to fork first child process");
1003 _exit(EXIT_FAILURE);
1004 }
1005
1006 /* second parent */
1007 if (pid != 0) {
1008 free_init_cmd(init_cmd);
1009 lxc_free_handler(handler);
1010 _exit(EXIT_SUCCESS);
1011 }
1012
1013 /* second child */
1014
1015 /* change to / directory */
1016 ret = chdir("/");
1017 if (ret < 0) {
1018 SYSERROR("Failed to change to \"/\" directory");
1019 _exit(EXIT_FAILURE);
1020 }
1021
1022 keepfds[0] = handler->conf->maincmd_fd;
1023 keepfds[1] = handler->state_socket_pair[0];
1024 keepfds[2] = handler->state_socket_pair[1];
1025 ret = lxc_check_inherited(conf, true, keepfds,
1026 sizeof(keepfds) / sizeof(keepfds[0]));
1027 if (ret < 0)
1028 _exit(EXIT_FAILURE);
1029
1030 /* redirect std{in,out,err} to /dev/null */
1031 ret = null_stdfds();
1032 if (ret < 0) {
1033 ERROR("Failed to redirect std{in,out,err} to /dev/null");
1034 _exit(EXIT_FAILURE);
1035 }
1036
1037 /* become session leader */
1038 ret = setsid();
1039 if (ret < 0)
1040 TRACE("Process %d is already process group leader", lxc_raw_getpid());
1041 } else if (!am_single_threaded()) {
1042 ERROR("Cannot start non-daemonized container when threaded");
1043 free_init_cmd(init_cmd);
1044 lxc_free_handler(handler);
1045 return false;
1046 }
1047
1048 /* We need to write PID file after daemonize, so we always write the
1049 * right PID.
1050 */
1051 if (c->pidfile) {
1052 int w;
1053 char pidstr[INTTYPE_TO_STRLEN(pid_t)];
1054
1055 w = snprintf(pidstr, sizeof(pidstr), "%d", lxc_raw_getpid());
1056 if (w < 0 || (size_t)w >= sizeof(pidstr)) {
1057 free_init_cmd(init_cmd);
1058 lxc_free_handler(handler);
1059
1060 SYSERROR("Failed to write monitor pid to \"%s\"", c->pidfile);
1061
1062 if (c->daemonize)
1063 _exit(EXIT_FAILURE);
1064
1065 return false;
1066 }
1067
1068 ret = lxc_write_to_file(c->pidfile, pidstr, w, false, 0600);
1069 if (ret < 0) {
1070 free_init_cmd(init_cmd);
1071 lxc_free_handler(handler);
1072
1073 SYSERROR("Failed to write monitor pid to \"%s\"", c->pidfile);
1074
1075 if (c->daemonize)
1076 _exit(EXIT_FAILURE);
1077
1078 return false;
1079 }
1080 }
1081
1082 conf->reboot = REBOOT_NONE;
1083
1084 /* Unshare the mount namespace if requested */
1085 if (conf->monitor_unshare) {
1086 ret = unshare(CLONE_NEWNS);
1087 if (ret < 0) {
1088 SYSERROR("Failed to unshare mount namespace");
1089 lxc_free_handler(handler);
1090 ret = 1;
1091 goto on_error;
1092 }
1093
1094 ret = mount(NULL, "/", NULL, MS_SLAVE|MS_REC, NULL);
1095 if (ret < 0) {
1096 SYSERROR("Failed to make / rslave at startup");
1097 lxc_free_handler(handler);
1098 ret = 1;
1099 goto on_error;
1100 }
1101 }
1102
1103 reboot:
1104 if (conf->reboot == REBOOT_INIT) {
1105 /* initialize handler */
1106 handler = lxc_init_handler(c->name, conf, c->config_path, c->daemonize);
1107 if (!handler) {
1108 ret = 1;
1109 goto on_error;
1110 }
1111 }
1112
1113 keepfds[0] = handler->conf->maincmd_fd;
1114 keepfds[1] = handler->state_socket_pair[0];
1115 keepfds[2] = handler->state_socket_pair[1];
1116 ret = lxc_check_inherited(conf, c->daemonize, keepfds,
1117 sizeof(keepfds) / sizeof(keepfds[0]));
1118 if (ret < 0) {
1119 lxc_free_handler(handler);
1120 ret = 1;
1121 goto on_error;
1122 }
1123
1124 if (useinit)
1125 ret = lxc_execute(c->name, argv, 1, handler, c->config_path,
1126 c->daemonize, &c->error_num);
1127 else
1128 ret = lxc_start(c->name, argv, handler, c->config_path,
1129 c->daemonize, &c->error_num);
1130
1131 if (conf->reboot == REBOOT_REQ) {
1132 INFO("Container requested reboot");
1133 conf->reboot = REBOOT_INIT;
1134 goto reboot;
1135 }
1136
1137 on_error:
1138 if (c->pidfile) {
1139 unlink(c->pidfile);
1140 free(c->pidfile);
1141 c->pidfile = NULL;
1142 }
1143 free_init_cmd(init_cmd);
1144
1145 if (c->daemonize && ret != 0)
1146 _exit(EXIT_FAILURE);
1147 else if (c->daemonize)
1148 _exit(EXIT_SUCCESS);
1149
1150 if (ret != 0)
1151 return false;
1152
1153 return true;
1154 }
1155
1156 static bool lxcapi_start(struct lxc_container *c, int useinit,
1157 char *const argv[])
1158 {
1159 bool ret;
1160
1161 current_config = c ? c->lxc_conf : NULL;
1162 ret = do_lxcapi_start(c, useinit, argv);
1163 current_config = NULL;
1164
1165 return ret;
1166 }
1167
1168 /* Note, there MUST be an ending NULL. */
1169 static bool lxcapi_startl(struct lxc_container *c, int useinit, ...)
1170 {
1171 va_list ap;
1172 char **inargs = NULL;
1173 bool bret = false;
1174
1175 /* container exists */
1176 if (!c)
1177 return false;
1178
1179 current_config = c->lxc_conf;
1180
1181 va_start(ap, useinit);
1182 inargs = lxc_va_arg_list_to_argv(ap, 0, 1);
1183 va_end(ap);
1184 if (!inargs)
1185 goto on_error;
1186
1187 /* pass NULL if no arguments were supplied */
1188 bret = do_lxcapi_start(c, useinit, *inargs ? inargs : NULL);
1189
1190 on_error:
1191 if (inargs) {
1192 char **arg;
1193
1194 for (arg = inargs; *arg; arg++)
1195 free(*arg);
1196 free(inargs);
1197 }
1198
1199 current_config = NULL;
1200
1201 return bret;
1202 }
1203
1204 static bool do_lxcapi_stop(struct lxc_container *c)
1205 {
1206 int ret;
1207
1208 if (!c)
1209 return false;
1210
1211 ret = lxc_cmd_stop(c->name, c->config_path);
1212
1213 return ret == 0;
1214 }
1215
1216 WRAP_API(bool, lxcapi_stop)
1217
1218 static int do_create_container_dir(const char *path, struct lxc_conf *conf)
1219 {
1220 __do_free char *p = NULL;
1221 int lasterr;
1222 int ret = -1;
1223
1224 mode_t mask = umask(0002);
1225 ret = mkdir(path, 0770);
1226 lasterr = errno;
1227 umask(mask);
1228 errno = lasterr;
1229 if (ret) {
1230 if (errno != EEXIST)
1231 return -1;
1232
1233 ret = 0;
1234 }
1235
1236 p = must_copy_string(path);
1237
1238 if (!lxc_list_empty(&conf->id_map)) {
1239 ret = chown_mapped_root(p, conf);
1240 if (ret < 0)
1241 ret = -1;
1242 }
1243
1244 return ret;
1245 }
1246
1247 /* Create the standard expected container dir. */
1248 static bool create_container_dir(struct lxc_container *c)
1249 {
1250 int ret;
1251 size_t len;
1252 char *s;
1253
1254 len = strlen(c->config_path) + strlen(c->name) + 2;
1255 s = malloc(len);
1256 if (!s)
1257 return false;
1258
1259 ret = snprintf(s, len, "%s/%s", c->config_path, c->name);
1260 if (ret < 0 || (size_t)ret >= len) {
1261 free(s);
1262 return false;
1263 }
1264
1265 ret = do_create_container_dir(s, c->lxc_conf);
1266 free(s);
1267
1268 return ret == 0;
1269 }
1270
1271 /* do_storage_create: thin wrapper around storage_create(). Like
1272 * storage_create(), it returns a mounted bdev on success, NULL on error.
1273 */
1274 static struct lxc_storage *do_storage_create(struct lxc_container *c,
1275 const char *type,
1276 struct bdev_specs *specs)
1277 {
1278 __do_free char *dest = NULL;
1279 int ret;
1280 size_t len;
1281 struct lxc_storage *bdev;
1282
1283 /* rootfs.path or lxcpath/lxcname/rootfs */
1284 if (c->lxc_conf->rootfs.path &&
1285 (access(c->lxc_conf->rootfs.path, F_OK) == 0)) {
1286 const char *rpath = c->lxc_conf->rootfs.path;
1287 len = strlen(rpath) + 1;
1288 dest = must_realloc(NULL, len);
1289 ret = snprintf(dest, len, "%s", rpath);
1290 } else {
1291 const char *lxcpath = do_lxcapi_get_config_path(c);
1292 len = strlen(c->name) + strlen(lxcpath) + 9;
1293 dest = must_realloc(NULL, len);
1294 ret = snprintf(dest, len, "%s/%s/rootfs", lxcpath, c->name);
1295 }
1296 if (ret < 0 || (size_t)ret >= len)
1297 return NULL;
1298
1299 bdev = storage_create(dest, type, c->name, specs);
1300 if (!bdev) {
1301 ERROR("Failed to create \"%s\" storage", type);
1302 return NULL;
1303 }
1304
1305 if (!c->set_config_item(c, "lxc.rootfs.path", bdev->src)) {
1306 ERROR("Failed to set \"lxc.rootfs.path = %s\"", bdev->src);
1307 return NULL;
1308 }
1309
1310 /* If we are not root, chown the rootfs dir to root in the target user
1311 * namespace.
1312 */
1313 ret = geteuid();
1314 if (ret != 0 || (c->lxc_conf && !lxc_list_empty(&c->lxc_conf->id_map))) {
1315 ret = chown_mapped_root(bdev->dest, c->lxc_conf);
1316 if (ret < 0) {
1317 ERROR("Error chowning \"%s\" to container root", bdev->dest);
1318 suggest_default_idmap();
1319 storage_put(bdev);
1320 return NULL;
1321 }
1322 }
1323
1324 return bdev;
1325 }
1326
1327 /* Strip path and return name of file for argv[0] passed to execvp */
1328 static char *lxctemplatefilename(char *tpath)
1329 {
1330 char *p;
1331
1332 p = tpath + strlen(tpath) - 1;
1333 while ( (p-1) >= tpath && *(p-1) != '/')
1334 p--;
1335
1336 return p;
1337 }
1338
1339 static bool create_run_template(struct lxc_container *c, char *tpath,
1340 bool need_null_stdfds, char *const argv[])
1341 {
1342 int ret;
1343 pid_t pid;
1344
1345 if (!tpath)
1346 return true;
1347
1348 pid = fork();
1349 if (pid < 0) {
1350 SYSERROR("Failed to fork task for container creation template");
1351 return false;
1352 }
1353
1354 if (pid == 0) { /* child */
1355 int i, len;
1356 char *namearg, *patharg, *rootfsarg;
1357 char **newargv;
1358 int nargs = 0;
1359 struct lxc_storage *bdev = NULL;
1360 struct lxc_conf *conf = c->lxc_conf;
1361 uid_t euid;
1362
1363 if (need_null_stdfds) {
1364 ret = null_stdfds();
1365 if (ret < 0)
1366 _exit(EXIT_FAILURE);
1367 }
1368
1369 bdev = storage_init(c->lxc_conf);
1370 if (!bdev) {
1371 ERROR("Failed to initialize storage");
1372 _exit(EXIT_FAILURE);
1373 }
1374
1375 euid = geteuid();
1376 if (euid == 0) {
1377 ret = unshare(CLONE_NEWNS);
1378 if (ret < 0) {
1379 ERROR("Failed to unshare CLONE_NEWNS");
1380 _exit(EXIT_FAILURE);
1381 }
1382
1383 ret = detect_shared_rootfs();
1384 if (ret == 1) {
1385 ret = mount(NULL, "/", NULL, MS_SLAVE | MS_REC, NULL);
1386 if (ret < 0) {
1387 SYSERROR("Failed to make \"/\" rslave");
1388 ERROR("Continuing...");
1389 }
1390 }
1391 }
1392
1393 if (strcmp(bdev->type, "dir") != 0 && strcmp(bdev->type, "btrfs") != 0) {
1394 if (euid != 0) {
1395 ERROR("Unprivileged users can only create "
1396 "btrfs and directory-backed containers");
1397 _exit(EXIT_FAILURE);
1398 }
1399
1400 if (strcmp(bdev->type, "overlay") == 0 ||
1401 strcmp(bdev->type, "overlayfs") == 0) {
1402 /* If we create an overlay container we need to
1403 * rsync the contents into
1404 * <container-path>/<container-name>/rootfs.
1405 * However, the overlay mount function will
1406 * mount will mount
1407 * <container-path>/<container-name>/delta0
1408 * over
1409 * <container-path>/<container-name>/rootfs
1410 * which means we would rsync the rootfs into
1411 * the delta directory. That doesn't make sense
1412 * since the delta directory only exists to
1413 * record the differences to
1414 * <container-path>/<container-name>/rootfs. So
1415 * let's simply bind-mount here and then rsync
1416 * directly into
1417 * <container-path>/<container-name>/rootfs.
1418 */
1419 char *src;
1420
1421 src = ovl_get_rootfs(bdev->src, &(size_t){0});
1422 if (!src) {
1423 ERROR("Failed to get rootfs");
1424 _exit(EXIT_FAILURE);
1425 }
1426
1427 ret = mount(src, bdev->dest, "bind", MS_BIND | MS_REC, NULL);
1428 if (ret < 0) {
1429 ERROR("Failed to mount rootfs");
1430 _exit(EXIT_FAILURE);
1431 }
1432 } else {
1433 ret = bdev->ops->mount(bdev);
1434 if (ret < 0) {
1435 ERROR("Failed to mount rootfs");
1436 _exit(EXIT_FAILURE);
1437 }
1438 }
1439 } else { /* TODO come up with a better way here! */
1440 const char *src;
1441 free(bdev->dest);
1442 src = lxc_storage_get_path(bdev->src, bdev->type);
1443 bdev->dest = strdup(src);
1444 }
1445
1446 /* Create our new array, pre-pend the template name and base
1447 * args.
1448 */
1449 if (argv)
1450 for (nargs = 0; argv[nargs]; nargs++)
1451 ;
1452
1453 /* template, path, rootfs and name args */
1454 nargs += 4;
1455
1456 newargv = malloc(nargs * sizeof(*newargv));
1457 if (!newargv)
1458 _exit(EXIT_FAILURE);
1459 newargv[0] = lxctemplatefilename(tpath);
1460
1461 /* --path */
1462 len = strlen(c->config_path) + strlen(c->name) + strlen("--path=") + 2;
1463 patharg = malloc(len);
1464 if (!patharg)
1465 _exit(EXIT_FAILURE);
1466
1467 ret = snprintf(patharg, len, "--path=%s/%s", c->config_path, c->name);
1468 if (ret < 0 || ret >= len)
1469 _exit(EXIT_FAILURE);
1470 newargv[1] = patharg;
1471
1472 /* --name */
1473 len = strlen("--name=") + strlen(c->name) + 1;
1474 namearg = malloc(len);
1475 if (!namearg)
1476 _exit(EXIT_FAILURE);
1477
1478 ret = snprintf(namearg, len, "--name=%s", c->name);
1479 if (ret < 0 || ret >= len)
1480 _exit(EXIT_FAILURE);
1481 newargv[2] = namearg;
1482
1483 /* --rootfs */
1484 len = strlen("--rootfs=") + 1 + strlen(bdev->dest);
1485 rootfsarg = malloc(len);
1486 if (!rootfsarg)
1487 _exit(EXIT_FAILURE);
1488
1489 ret = snprintf(rootfsarg, len, "--rootfs=%s", bdev->dest);
1490 if (ret < 0 || ret >= len)
1491 _exit(EXIT_FAILURE);
1492 newargv[3] = rootfsarg;
1493
1494 /* add passed-in args */
1495 if (argv)
1496 for (i = 4; i < nargs; i++)
1497 newargv[i] = argv[i - 4];
1498
1499 /* add trailing NULL */
1500 nargs++;
1501 newargv = realloc(newargv, nargs * sizeof(*newargv));
1502 if (!newargv)
1503 _exit(EXIT_FAILURE);
1504 newargv[nargs - 1] = NULL;
1505
1506 /* If we're running the template in a mapped userns, then we
1507 * prepend the template command with: lxc-usernsexec <-m map1>
1508 * ... <-m mapn> -- and we append "--mapped-uid x", where x is
1509 * the mapped uid for our geteuid()
1510 */
1511 if (!lxc_list_empty(&conf->id_map)) {
1512 int extraargs, hostuid_mapped, hostgid_mapped;
1513 char **n2;
1514 char txtuid[20], txtgid[20];
1515 struct lxc_list *it;
1516 struct id_map *map;
1517 int n2args = 1;
1518
1519 n2 = malloc(n2args * sizeof(*n2));
1520 if (!n2)
1521 _exit(EXIT_FAILURE);
1522
1523 newargv[0] = tpath;
1524 tpath = "lxc-usernsexec";
1525 n2[0] = "lxc-usernsexec";
1526
1527 lxc_list_for_each(it, &conf->id_map) {
1528 map = it->elem;
1529 n2args += 2;
1530 n2 = realloc(n2, n2args * sizeof(char *));
1531 if (!n2)
1532 _exit(EXIT_FAILURE);
1533
1534 n2[n2args - 2] = "-m";
1535 n2[n2args - 1] = malloc(200);
1536 if (!n2[n2args - 1])
1537 _exit(EXIT_FAILURE);
1538
1539 ret = snprintf(n2[n2args - 1], 200, "%c:%lu:%lu:%lu",
1540 map->idtype == ID_TYPE_UID ? 'u' : 'g',
1541 map->nsid, map->hostid, map->range);
1542 if (ret < 0 || ret >= 200)
1543 _exit(EXIT_FAILURE);
1544 }
1545
1546 hostuid_mapped = mapped_hostid(geteuid(), conf, ID_TYPE_UID);
1547 extraargs = hostuid_mapped >= 0 ? 1 : 3;
1548
1549 n2 = realloc(n2, (nargs + n2args + extraargs) * sizeof(char *));
1550 if (!n2)
1551 _exit(EXIT_FAILURE);
1552
1553 if (hostuid_mapped < 0) {
1554 hostuid_mapped = find_unmapped_nsid(conf, ID_TYPE_UID);
1555 n2[n2args++] = "-m";
1556 if (hostuid_mapped < 0) {
1557 ERROR("Failed to find free uid to map");
1558 _exit(EXIT_FAILURE);
1559 }
1560
1561 n2[n2args++] = malloc(200);
1562 if (!n2[n2args - 1]) {
1563 SYSERROR("out of memory");
1564 _exit(EXIT_FAILURE);
1565 }
1566
1567 ret = snprintf(n2[n2args - 1], 200, "u:%d:%d:1",
1568 hostuid_mapped, geteuid());
1569 if (ret < 0 || ret >= 200)
1570 _exit(EXIT_FAILURE);
1571 }
1572
1573 hostgid_mapped = mapped_hostid(getegid(), conf, ID_TYPE_GID);
1574 extraargs = hostgid_mapped >= 0 ? 1 : 3;
1575
1576 n2 = realloc(n2, (nargs + n2args + extraargs) * sizeof(char *));
1577 if (!n2)
1578 _exit(EXIT_FAILURE);
1579
1580 if (hostgid_mapped < 0) {
1581 hostgid_mapped = find_unmapped_nsid(conf, ID_TYPE_GID);
1582 n2[n2args++] = "-m";
1583 if (hostgid_mapped < 0) {
1584 ERROR("Failed to find free gid to map");
1585 _exit(EXIT_FAILURE);
1586 }
1587
1588 n2[n2args++] = malloc(200);
1589 if (!n2[n2args - 1]) {
1590 SYSERROR("out of memory");
1591 _exit(EXIT_FAILURE);
1592 }
1593
1594 ret = snprintf(n2[n2args - 1], 200, "g:%d:%d:1",
1595 hostgid_mapped, getegid());
1596 if (ret < 0 || ret >= 200)
1597 _exit(EXIT_FAILURE);
1598 }
1599
1600 n2[n2args++] = "--";
1601
1602 for (i = 0; i < nargs; i++)
1603 n2[i + n2args] = newargv[i];
1604 n2args += nargs;
1605
1606 /* Finally add "--mapped-uid $uid" to tell template what
1607 * to chown cached images to.
1608 */
1609 n2args += 4;
1610 n2 = realloc(n2, n2args * sizeof(char *));
1611 if (!n2)
1612 _exit(EXIT_FAILURE);
1613
1614 /* note n2[n2args-1] is NULL */
1615 n2[n2args - 5] = "--mapped-uid";
1616
1617 ret = snprintf(txtuid, 20, "%d", hostuid_mapped);
1618 if (ret < 0 || ret >= 20) {
1619 free(newargv);
1620 free(n2);
1621 _exit(EXIT_FAILURE);
1622 }
1623
1624 n2[n2args - 4] = txtuid;
1625 n2[n2args - 3] = "--mapped-gid";
1626
1627 ret = snprintf(txtgid, 20, "%d", hostgid_mapped);
1628 if (ret < 0 || ret >= 20) {
1629 free(newargv);
1630 free(n2);
1631 _exit(EXIT_FAILURE);
1632 }
1633
1634 n2[n2args - 2] = txtgid;
1635 n2[n2args - 1] = NULL;
1636 free(newargv);
1637 newargv = n2;
1638 }
1639
1640 execvp(tpath, newargv);
1641 SYSERROR("Failed to execute template %s", tpath);
1642 _exit(EXIT_FAILURE);
1643 }
1644
1645 ret = wait_for_pid(pid);
1646 if (ret != 0) {
1647 ERROR("Failed to create container from template");
1648 return false;
1649 }
1650
1651 return true;
1652 }
1653
1654 static bool prepend_lxc_header(char *path, const char *t, char *const argv[])
1655 {
1656 long flen;
1657 size_t len;
1658 char *contents;
1659 FILE *f;
1660 int ret = -1;
1661 #if HAVE_OPENSSL
1662 int i, md_len = 0;
1663 unsigned char md_value[EVP_MAX_MD_SIZE];
1664 char *tpath;
1665 #endif
1666
1667 f = fopen(path, "r");
1668 if (f == NULL)
1669 return false;
1670
1671 ret = fseek(f, 0, SEEK_END);
1672 if (ret < 0)
1673 goto out_error;
1674
1675 ret = -1;
1676 flen = ftell(f);
1677 if (flen < 0)
1678 goto out_error;
1679
1680 ret = fseek(f, 0, SEEK_SET);
1681 if (ret < 0)
1682 goto out_error;
1683
1684 ret = fseek(f, 0, SEEK_SET);
1685 if (ret < 0)
1686 goto out_error;
1687
1688 ret = -1;
1689 contents = malloc(flen + 1);
1690 if (!contents)
1691 goto out_error;
1692
1693 len = fread(contents, 1, flen, f);
1694 if (len != flen)
1695 goto out_free_contents;
1696
1697 contents[flen] = '\0';
1698
1699 ret = fclose(f);
1700 f = NULL;
1701 if (ret < 0)
1702 goto out_free_contents;
1703
1704 #if HAVE_OPENSSL
1705 tpath = get_template_path(t);
1706 if (!tpath) {
1707 ERROR("Invalid template \"%s\" specified", t);
1708 goto out_free_contents;
1709 }
1710
1711 ret = sha1sum_file(tpath, md_value, &md_len);
1712 if (ret < 0) {
1713 ERROR("Failed to get sha1sum of %s", tpath);
1714 free(tpath);
1715 goto out_free_contents;
1716 }
1717 free(tpath);
1718 #endif
1719
1720 f = fopen(path, "w");
1721 if (f == NULL) {
1722 SYSERROR("Reopening config for writing");
1723 free(contents);
1724 return false;
1725 }
1726
1727 fprintf(f, "# Template used to create this container: %s\n", t);
1728 if (argv) {
1729 fprintf(f, "# Parameters passed to the template:");
1730 while (*argv) {
1731 fprintf(f, " %s", *argv);
1732 argv++;
1733 }
1734 fprintf(f, "\n");
1735 }
1736
1737 #if HAVE_OPENSSL
1738 fprintf(f, "# Template script checksum (SHA-1): ");
1739 for (i=0; i<md_len; i++)
1740 fprintf(f, "%02x", md_value[i]);
1741 fprintf(f, "\n");
1742 #endif
1743 fprintf(f, "# For additional config options, please look at lxc.container.conf(5)\n");
1744 fprintf(f, "\n# Uncomment the following line to support nesting containers:\n");
1745 fprintf(f, "#lxc.include = " LXCTEMPLATECONFIG "/nesting.conf\n");
1746 fprintf(f, "# (Be aware this has security implications)\n\n");
1747 if (fwrite(contents, 1, flen, f) != flen) {
1748 SYSERROR("Writing original contents");
1749 free(contents);
1750 fclose(f);
1751 return false;
1752 }
1753
1754 ret = 0;
1755
1756 out_free_contents:
1757 free(contents);
1758
1759 out_error:
1760 if (f) {
1761 int newret;
1762 newret = fclose(f);
1763 if (ret == 0)
1764 ret = newret;
1765 }
1766
1767 if (ret < 0) {
1768 SYSERROR("Error prepending header");
1769 return false;
1770 }
1771
1772 return true;
1773 }
1774
1775 static void lxcapi_clear_config(struct lxc_container *c)
1776 {
1777 if (!c || !c->lxc_conf)
1778 return;
1779
1780 lxc_conf_free(c->lxc_conf);
1781 c->lxc_conf = NULL;
1782 }
1783
1784 #define do_lxcapi_clear_config(c) lxcapi_clear_config(c)
1785
1786 /*
1787 * lxcapi_create:
1788 * create a container with the given parameters.
1789 * @c: container to be created. It has the lxcpath, name, and a starting
1790 * configuration already set
1791 * @t: the template to execute to instantiate the root filesystem and
1792 * adjust the configuration.
1793 * @bdevtype: backing store type to use. If NULL, dir will be used.
1794 * @specs: additional parameters for the backing store, i.e. LVM vg to
1795 * use.
1796 *
1797 * @argv: the arguments to pass to the template, terminated by NULL. If no
1798 * arguments, you can just pass NULL.
1799 */
1800 static bool do_lxcapi_create(struct lxc_container *c, const char *t,
1801 const char *bdevtype, struct bdev_specs *specs,
1802 int flags, char *const argv[])
1803 {
1804 int partial_fd;
1805 mode_t mask;
1806 pid_t pid;
1807 bool ret = false, rootfs_managed = true;
1808 char *tpath = NULL;
1809
1810 if (!c)
1811 return false;
1812
1813 if (t) {
1814 tpath = get_template_path(t);
1815 if (!tpath) {
1816 ERROR("Unknown template \"%s\"", t);
1817 goto out;
1818 }
1819 }
1820
1821 /* If a template is passed in, and the rootfs already is defined in the
1822 * container config and exists, then the caller is trying to create an
1823 * existing container. Return an error, but do NOT delete the container.
1824 */
1825 if (do_lxcapi_is_defined(c) && c->lxc_conf && c->lxc_conf->rootfs.path &&
1826 access(c->lxc_conf->rootfs.path, F_OK) == 0 && tpath) {
1827 ERROR("Container \"%s\" already exists in \"%s\"", c->name,
1828 c->config_path);
1829 goto free_tpath;
1830 }
1831
1832 if (!c->lxc_conf) {
1833 if (!do_lxcapi_load_config(c, lxc_global_config_value("lxc.default_config"))) {
1834 ERROR("Error loading default configuration file %s",
1835 lxc_global_config_value("lxc.default_config"));
1836 goto free_tpath;
1837 }
1838 }
1839
1840 if (!create_container_dir(c))
1841 goto free_tpath;
1842
1843 if (c->lxc_conf->rootfs.path)
1844 rootfs_managed = false;
1845
1846 /* If both template and rootfs.path are set, template is setup as
1847 * rootfs.path. The container is already created if we have a config and
1848 * rootfs.path is accessible
1849 */
1850 if (!c->lxc_conf->rootfs.path && !tpath) {
1851 /* No template passed in and rootfs does not exist. */
1852 if (!c->save_config(c, NULL)) {
1853 ERROR("Failed to save initial config for \"%s\"", c->name);
1854 goto out;
1855 }
1856 ret = true;
1857 goto out;
1858 }
1859
1860 /* Rootfs passed into configuration, but does not exist. */
1861 if (c->lxc_conf->rootfs.path && access(c->lxc_conf->rootfs.path, F_OK) != 0)
1862 goto out;
1863
1864 if (do_lxcapi_is_defined(c) && c->lxc_conf->rootfs.path && !tpath) {
1865 /* Rootfs already existed, user just wanted to save the loaded
1866 * configuration.
1867 */
1868 if (!c->save_config(c, NULL))
1869 ERROR("Failed to save initial config for \"%s\"", c->name);
1870
1871 ret = true;
1872 goto out;
1873 }
1874
1875 /* Mark that this container is being created */
1876 partial_fd = create_partial(c);
1877 if (partial_fd < 0)
1878 goto out;
1879
1880 /* No need to get disk lock bc we have the partial lock. */
1881
1882 mask = umask(0022);
1883
1884 /* Create the storage.
1885 * Note we can't do this in the same task as we use to execute the
1886 * template because of the way zfs works.
1887 * After you 'zfs create', zfs mounts the fs only in the initial
1888 * namespace.
1889 */
1890 pid = fork();
1891 if (pid < 0) {
1892 SYSERROR("Failed to fork task for container creation template");
1893 goto out_unlock;
1894 }
1895
1896 if (pid == 0) { /* child */
1897 struct lxc_storage *bdev = NULL;
1898
1899 bdev = do_storage_create(c, bdevtype, specs);
1900 if (!bdev) {
1901 ERROR("Failed to create %s storage for %s",
1902 bdevtype ? bdevtype : "(none)", c->name);
1903 _exit(EXIT_FAILURE);
1904 }
1905
1906 /* Save config file again to store the new rootfs location. */
1907 if (!do_lxcapi_save_config(c, NULL)) {
1908 ERROR("Failed to save initial config for %s", c->name);
1909 /* Parent task won't see the storage driver in the
1910 * config so we delete it.
1911 */
1912 bdev->ops->umount(bdev);
1913 bdev->ops->destroy(bdev);
1914 _exit(EXIT_FAILURE);
1915 }
1916
1917 _exit(EXIT_SUCCESS);
1918 }
1919
1920 if (wait_for_pid(pid) != 0)
1921 goto out_unlock;
1922
1923 /* Reload config to get the rootfs. */
1924 lxc_conf_free(c->lxc_conf);
1925 c->lxc_conf = NULL;
1926
1927 if (!load_config_locked(c, c->configfile))
1928 goto out_unlock;
1929
1930 if (!create_run_template(c, tpath, !!(flags & LXC_CREATE_QUIET), argv))
1931 goto out_unlock;
1932
1933 /* Now clear out the lxc_conf we have, reload from the created
1934 * container.
1935 */
1936 do_lxcapi_clear_config(c);
1937
1938 if (t) {
1939 if (!prepend_lxc_header(c->configfile, tpath, argv)) {
1940 ERROR("Failed to prepend header to config file");
1941 goto out_unlock;
1942 }
1943 }
1944
1945 ret = load_config_locked(c, c->configfile);
1946
1947 out_unlock:
1948 umask(mask);
1949 remove_partial(c, partial_fd);
1950
1951 out:
1952 if (!ret) {
1953 bool reset_managed = c->lxc_conf->rootfs.managed;
1954
1955 /*
1956 * Ensure that we don't destroy storage we didn't create
1957 * ourselves.
1958 */
1959 if (!rootfs_managed)
1960 c->lxc_conf->rootfs.managed = false;
1961 container_destroy(c, NULL);
1962 c->lxc_conf->rootfs.managed = reset_managed;
1963 }
1964
1965 free_tpath:
1966 free(tpath);
1967 return ret;
1968 }
1969
1970 static bool lxcapi_create(struct lxc_container *c, const char *t,
1971 const char *bdevtype, struct bdev_specs *specs,
1972 int flags, char *const argv[])
1973 {
1974 bool ret;
1975
1976 current_config = c ? c->lxc_conf : NULL;
1977
1978 ret = do_lxcapi_create(c, t, bdevtype, specs, flags, argv);
1979 current_config = NULL;
1980 return ret;
1981 }
1982
1983 static bool do_lxcapi_reboot(struct lxc_container *c)
1984 {
1985 int ret;
1986 pid_t pid;
1987 int rebootsignal = SIGINT;
1988
1989 if (!c)
1990 return false;
1991
1992 if (!do_lxcapi_is_running(c))
1993 return false;
1994
1995 pid = do_lxcapi_init_pid(c);
1996 if (pid <= 0)
1997 return false;
1998
1999 if (c->lxc_conf && c->lxc_conf->rebootsignal)
2000 rebootsignal = c->lxc_conf->rebootsignal;
2001
2002 ret = kill(pid, rebootsignal);
2003 if (ret < 0) {
2004 WARN("Failed to send signal %d to pid %d", rebootsignal, pid);
2005 return false;
2006 }
2007
2008 return true;
2009 }
2010
2011 WRAP_API(bool, lxcapi_reboot)
2012
2013 static bool do_lxcapi_reboot2(struct lxc_container *c, int timeout)
2014 {
2015 int killret, ret;
2016 pid_t pid;
2017 int rebootsignal = SIGINT, state_client_fd = -1;
2018 lxc_state_t states[MAX_STATE] = {0};
2019
2020 if (!c)
2021 return false;
2022
2023 if (!do_lxcapi_is_running(c))
2024 return true;
2025
2026 pid = do_lxcapi_init_pid(c);
2027 if (pid <= 0)
2028 return true;
2029
2030 if (c->lxc_conf && c->lxc_conf->rebootsignal)
2031 rebootsignal = c->lxc_conf->rebootsignal;
2032
2033 /* Add a new state client before sending the shutdown signal so that we
2034 * don't miss a state.
2035 */
2036 if (timeout != 0) {
2037 states[RUNNING] = 2;
2038 ret = lxc_cmd_add_state_client(c->name, c->config_path, states,
2039 &state_client_fd);
2040 if (ret < 0)
2041 return false;
2042
2043 if (state_client_fd < 0)
2044 return false;
2045
2046 if (ret == RUNNING)
2047 return true;
2048
2049 if (ret < MAX_STATE)
2050 return false;
2051 }
2052
2053 /* Send reboot signal to container. */
2054 killret = kill(pid, rebootsignal);
2055 if (killret < 0) {
2056 if (state_client_fd >= 0)
2057 close(state_client_fd);
2058
2059 WARN("Failed to send signal %d to pid %d", rebootsignal, pid);
2060 return false;
2061 }
2062 TRACE("Sent signal %d to pid %d", rebootsignal, pid);
2063
2064 if (timeout == 0)
2065 return true;
2066
2067 ret = lxc_cmd_sock_rcv_state(state_client_fd, timeout);
2068 close(state_client_fd);
2069 if (ret < 0)
2070 return false;
2071
2072 TRACE("Received state \"%s\"", lxc_state2str(ret));
2073 if (ret != RUNNING)
2074 return false;
2075
2076 return true;
2077 }
2078
2079 WRAP_API_1(bool, lxcapi_reboot2, int)
2080
2081 static bool do_lxcapi_shutdown(struct lxc_container *c, int timeout)
2082 {
2083 int killret, ret;
2084 pid_t pid;
2085 int haltsignal = SIGPWR, state_client_fd = -EBADF;
2086 lxc_state_t states[MAX_STATE] = {0};
2087
2088 if (!c)
2089 return false;
2090
2091 if (!do_lxcapi_is_running(c))
2092 return true;
2093
2094 pid = do_lxcapi_init_pid(c);
2095 if (pid <= 0)
2096 return true;
2097
2098 /* Detect whether we should send SIGRTMIN + 3 (e.g. systemd). */
2099 if (c->lxc_conf && c->lxc_conf->haltsignal)
2100 haltsignal = c->lxc_conf->haltsignal;
2101 else if (task_blocks_signal(pid, (SIGRTMIN + 3)))
2102 haltsignal = (SIGRTMIN + 3);
2103
2104 /* Add a new state client before sending the shutdown signal so that we
2105 * don't miss a state.
2106 */
2107 if (timeout != 0) {
2108 states[STOPPED] = 1;
2109 ret = lxc_cmd_add_state_client(c->name, c->config_path, states,
2110 &state_client_fd);
2111 if (ret < 0)
2112 return false;
2113
2114 if (state_client_fd < 0)
2115 return false;
2116
2117 if (ret == STOPPED)
2118 return true;
2119
2120 if (ret < MAX_STATE)
2121 return false;
2122 }
2123
2124 /* Send shutdown signal to container. */
2125 killret = kill(pid, haltsignal);
2126 if (killret < 0) {
2127 if (state_client_fd >= 0)
2128 close(state_client_fd);
2129
2130 WARN("Failed to send signal %d to pid %d", haltsignal, pid);
2131 return false;
2132 }
2133 TRACE("Sent signal %d to pid %d", haltsignal, pid);
2134
2135 if (timeout == 0)
2136 return true;
2137
2138 ret = lxc_cmd_sock_rcv_state(state_client_fd, timeout);
2139 close(state_client_fd);
2140 if (ret < 0)
2141 return false;
2142
2143 TRACE("Received state \"%s\"", lxc_state2str(ret));
2144 if (ret != STOPPED)
2145 return false;
2146
2147 return true;
2148 }
2149
2150 WRAP_API_1(bool, lxcapi_shutdown, int)
2151
2152 static bool lxcapi_createl(struct lxc_container *c, const char *t,
2153 const char *bdevtype, struct bdev_specs *specs, int flags, ...)
2154 {
2155 bool bret = false;
2156 char **args = NULL;
2157 va_list ap;
2158
2159 if (!c)
2160 return false;
2161
2162 current_config = c->lxc_conf;
2163
2164 /*
2165 * since we're going to wait for create to finish, I don't think we
2166 * need to get a copy of the arguments.
2167 */
2168 va_start(ap, flags);
2169 args = lxc_va_arg_list_to_argv(ap, 0, 0);
2170 va_end(ap);
2171 if (!args) {
2172 ERROR("Failed to allocate memory");
2173 goto out;
2174 }
2175
2176 bret = do_lxcapi_create(c, t, bdevtype, specs, flags, args);
2177
2178 out:
2179 free(args);
2180 current_config = NULL;
2181 return bret;
2182 }
2183
2184 static void do_clear_unexp_config_line(struct lxc_conf *conf, const char *key)
2185 {
2186 if (!strcmp(key, "lxc.cgroup"))
2187 return clear_unexp_config_line(conf, key, true);
2188
2189 if (!strcmp(key, "lxc.network"))
2190 return clear_unexp_config_line(conf, key, true);
2191
2192 if (!strcmp(key, "lxc.net"))
2193 return clear_unexp_config_line(conf, key, true);
2194
2195 /* Clear a network with a specific index. */
2196 if (!strncmp(key, "lxc.net.", 8)) {
2197 int ret;
2198 const char *idx;
2199
2200 idx = key + 8;
2201 ret = lxc_safe_uint(idx, &(unsigned int){0});
2202 if (!ret)
2203 return clear_unexp_config_line(conf, key, true);
2204 }
2205
2206 if (!strcmp(key, "lxc.hook"))
2207 return clear_unexp_config_line(conf, key, true);
2208
2209 return clear_unexp_config_line(conf, key, false);
2210 }
2211
2212 static bool do_lxcapi_clear_config_item(struct lxc_container *c,
2213 const char *key)
2214 {
2215 int ret = 1;
2216 struct lxc_config_t *config;
2217
2218 if (!c || !c->lxc_conf)
2219 return false;
2220
2221 if (container_mem_lock(c))
2222 return false;
2223
2224 config = lxc_get_config(key);
2225 /* Verify that the config key exists and that it has a callback
2226 * implemented.
2227 */
2228 if (config && config->clr)
2229 ret = config->clr(key, c->lxc_conf, NULL);
2230
2231 if (!ret)
2232 do_clear_unexp_config_line(c->lxc_conf, key);
2233
2234 container_mem_unlock(c);
2235 return ret == 0;
2236 }
2237
2238 WRAP_API_1(bool, lxcapi_clear_config_item, const char *)
2239
2240 static inline bool enter_net_ns(struct lxc_container *c)
2241 {
2242 pid_t pid = do_lxcapi_init_pid(c);
2243
2244 if (pid < 0)
2245 return false;
2246
2247 if ((geteuid() != 0 || (c->lxc_conf && !lxc_list_empty(&c->lxc_conf->id_map))) &&
2248 (access("/proc/self/ns/user", F_OK) == 0))
2249 if (!switch_to_ns(pid, "user"))
2250 return false;
2251
2252 return switch_to_ns(pid, "net");
2253 }
2254
2255 /* Used by qsort and bsearch functions for comparing names. */
2256 static inline int string_cmp(char **first, char **second)
2257 {
2258 return strcmp(*first, *second);
2259 }
2260
2261 /* Used by qsort and bsearch functions for comparing container names. */
2262 static inline int container_cmp(struct lxc_container **first,
2263 struct lxc_container **second)
2264 {
2265 return strcmp((*first)->name, (*second)->name);
2266 }
2267
2268 static bool add_to_array(char ***names, char *cname, int pos)
2269 {
2270 char **newnames = realloc(*names, (pos+1) * sizeof(char *));
2271 if (!newnames) {
2272 ERROR("Out of memory");
2273 return false;
2274 }
2275
2276 *names = newnames;
2277 newnames[pos] = strdup(cname);
2278 if (!newnames[pos])
2279 return false;
2280
2281 /* Sort the array as we will use binary search on it. */
2282 qsort(newnames, pos + 1, sizeof(char *),
2283 (int (*)(const void *, const void *))string_cmp);
2284
2285 return true;
2286 }
2287
2288 static bool add_to_clist(struct lxc_container ***list, struct lxc_container *c,
2289 int pos, bool sort)
2290 {
2291 struct lxc_container **newlist = realloc(*list, (pos + 1) * sizeof(struct lxc_container *));
2292 if (!newlist) {
2293 ERROR("Out of memory");
2294 return false;
2295 }
2296
2297 *list = newlist;
2298 newlist[pos] = c;
2299
2300 /* Sort the array as we will use binary search on it. */
2301 if (sort)
2302 qsort(newlist, pos + 1, sizeof(struct lxc_container *),
2303 (int (*)(const void *, const void *))container_cmp);
2304
2305 return true;
2306 }
2307
2308 static char** get_from_array(char ***names, char *cname, int size)
2309 {
2310 return (char **)bsearch(&cname, *names, size, sizeof(char *), (int (*)(const void *, const void *))string_cmp);
2311 }
2312
2313 static bool array_contains(char ***names, char *cname, int size)
2314 {
2315 if(get_from_array(names, cname, size) != NULL)
2316 return true;
2317
2318 return false;
2319 }
2320
2321 static bool remove_from_array(char ***names, char *cname, int size)
2322 {
2323 char **result = get_from_array(names, cname, size);
2324 if (result != NULL) {
2325 free(result);
2326 return true;
2327 }
2328
2329 return false;
2330 }
2331
2332 static char **do_lxcapi_get_interfaces(struct lxc_container *c)
2333 {
2334 pid_t pid;
2335 int i, count = 0, pipefd[2];
2336 char **interfaces = NULL;
2337 char interface[IFNAMSIZ];
2338
2339 if (pipe2(pipefd, O_CLOEXEC) < 0)
2340 return NULL;
2341
2342 pid = fork();
2343 if (pid < 0) {
2344 SYSERROR("Failed to fork task to get interfaces information");
2345 close(pipefd[0]);
2346 close(pipefd[1]);
2347 return NULL;
2348 }
2349
2350 if (pid == 0) { /* child */
2351 int ret = 1, nbytes;
2352 struct netns_ifaddrs *interfaceArray = NULL, *tempIfAddr = NULL;
2353
2354 /* close the read-end of the pipe */
2355 close(pipefd[0]);
2356
2357 if (!enter_net_ns(c)) {
2358 SYSERROR("Failed to enter network namespace");
2359 goto out;
2360 }
2361
2362 /* Grab the list of interfaces */
2363 if (netns_getifaddrs(&interfaceArray, -1, &(bool){false})) {
2364 SYSERROR("Failed to get interfaces list");
2365 goto out;
2366 }
2367
2368 /* Iterate through the interfaces */
2369 for (tempIfAddr = interfaceArray; tempIfAddr != NULL;
2370 tempIfAddr = tempIfAddr->ifa_next) {
2371 nbytes = lxc_write_nointr(pipefd[1], tempIfAddr->ifa_name, IFNAMSIZ);
2372 if (nbytes < 0)
2373 goto out;
2374
2375 count++;
2376 }
2377
2378 ret = 0;
2379
2380 out:
2381 if (interfaceArray)
2382 netns_freeifaddrs(interfaceArray);
2383
2384 /* close the write-end of the pipe, thus sending EOF to the reader */
2385 close(pipefd[1]);
2386 _exit(ret);
2387 }
2388
2389 /* close the write-end of the pipe */
2390 close(pipefd[1]);
2391
2392 while (lxc_read_nointr(pipefd[0], &interface, IFNAMSIZ) == IFNAMSIZ) {
2393 interface[IFNAMSIZ - 1] = '\0';
2394
2395 if (array_contains(&interfaces, interface, count))
2396 continue;
2397
2398 if (!add_to_array(&interfaces, interface, count))
2399 ERROR("Failed to add \"%s\" to array", interface);
2400
2401 count++;
2402 }
2403
2404 if (wait_for_pid(pid) != 0) {
2405 for (i = 0; i < count; i++)
2406 free(interfaces[i]);
2407
2408 free(interfaces);
2409 interfaces = NULL;
2410 }
2411
2412 /* close the read-end of the pipe */
2413 close(pipefd[0]);
2414
2415 /* Append NULL to the array */
2416 if (interfaces)
2417 interfaces = (char **)lxc_append_null_to_array((void **)interfaces, count);
2418
2419 return interfaces;
2420 }
2421
2422 WRAP_API(char **, lxcapi_get_interfaces)
2423
2424 static char **do_lxcapi_get_ips(struct lxc_container *c, const char *interface,
2425 const char *family, int scope)
2426 {
2427 int i, ret;
2428 pid_t pid;
2429 int pipefd[2];
2430 char address[INET6_ADDRSTRLEN];
2431 int count = 0;
2432 char **addresses = NULL;
2433
2434 ret = pipe2(pipefd, O_CLOEXEC);
2435 if (ret < 0) {
2436 SYSERROR("Failed to create pipe");
2437 return NULL;
2438 }
2439
2440 pid = fork();
2441 if (pid < 0) {
2442 SYSERROR("Failed to create new process");
2443 close(pipefd[0]);
2444 close(pipefd[1]);
2445 return NULL;
2446 }
2447
2448 if (pid == 0) {
2449 ssize_t nbytes;
2450 char addressOutputBuffer[INET6_ADDRSTRLEN];
2451 char *address_ptr = NULL;
2452 void *tempAddrPtr = NULL;
2453 struct netns_ifaddrs *interfaceArray = NULL, *tempIfAddr = NULL;
2454
2455 /* close the read-end of the pipe */
2456 close(pipefd[0]);
2457
2458 if (!enter_net_ns(c)) {
2459 SYSERROR("Failed to attach to network namespace");
2460 goto out;
2461 }
2462
2463 /* Grab the list of interfaces */
2464 if (netns_getifaddrs(&interfaceArray, -1, &(bool){false})) {
2465 SYSERROR("Failed to get interfaces list");
2466 goto out;
2467 }
2468
2469 /* Iterate through the interfaces */
2470 for (tempIfAddr = interfaceArray; tempIfAddr;
2471 tempIfAddr = tempIfAddr->ifa_next) {
2472 if (tempIfAddr->ifa_addr == NULL)
2473 continue;
2474
2475 #pragma GCC diagnostic push
2476 #pragma GCC diagnostic ignored "-Wcast-align"
2477
2478 if (tempIfAddr->ifa_addr->sa_family == AF_INET) {
2479 if (family && strcmp(family, "inet"))
2480 continue;
2481
2482 tempAddrPtr = &((struct sockaddr_in *)tempIfAddr->ifa_addr)->sin_addr;
2483 } else {
2484 if (family && strcmp(family, "inet6"))
2485 continue;
2486
2487 if (((struct sockaddr_in6 *)tempIfAddr->ifa_addr)->sin6_scope_id != scope)
2488 continue;
2489
2490 tempAddrPtr = &((struct sockaddr_in6 *)tempIfAddr->ifa_addr)->sin6_addr;
2491 }
2492
2493 #pragma GCC diagnostic pop
2494
2495 if (interface && strcmp(interface, tempIfAddr->ifa_name))
2496 continue;
2497 else if (!interface && strcmp("lo", tempIfAddr->ifa_name) == 0)
2498 continue;
2499
2500 address_ptr = (char *)inet_ntop(tempIfAddr->ifa_addr->sa_family,
2501 tempAddrPtr, addressOutputBuffer,
2502 sizeof(addressOutputBuffer));
2503 if (!address_ptr)
2504 continue;
2505
2506 nbytes = lxc_write_nointr(pipefd[1], address_ptr, INET6_ADDRSTRLEN);
2507 if (nbytes != INET6_ADDRSTRLEN) {
2508 SYSERROR("Failed to send ipv6 address \"%s\"",
2509 address_ptr);
2510 goto out;
2511 }
2512
2513 count++;
2514 }
2515
2516 ret = 0;
2517
2518 out:
2519 if (interfaceArray)
2520 netns_freeifaddrs(interfaceArray);
2521
2522 /* close the write-end of the pipe, thus sending EOF to the reader */
2523 close(pipefd[1]);
2524 _exit(ret);
2525 }
2526
2527 /* close the write-end of the pipe */
2528 close(pipefd[1]);
2529
2530 while (lxc_read_nointr(pipefd[0], &address, INET6_ADDRSTRLEN) == INET6_ADDRSTRLEN) {
2531 address[INET6_ADDRSTRLEN - 1] = '\0';
2532
2533 if (!add_to_array(&addresses, address, count))
2534 ERROR("PARENT: add_to_array failed");
2535
2536 count++;
2537 }
2538
2539 if (wait_for_pid(pid) != 0) {
2540 for (i = 0; i < count; i++)
2541 free(addresses[i]);
2542
2543 free(addresses);
2544 addresses = NULL;
2545 }
2546
2547 /* close the read-end of the pipe */
2548 close(pipefd[0]);
2549
2550 /* Append NULL to the array */
2551 if (addresses)
2552 addresses = (char **)lxc_append_null_to_array((void **)addresses, count);
2553
2554 return addresses;
2555 }
2556
2557 WRAP_API_3(char **, lxcapi_get_ips, const char *, const char *, int)
2558
2559 static int do_lxcapi_get_config_item(struct lxc_container *c, const char *key, char *retv, int inlen)
2560 {
2561 int ret = -1;
2562 struct lxc_config_t *config;
2563
2564 if (!c || !c->lxc_conf)
2565 return -1;
2566
2567 if (container_mem_lock(c))
2568 return -1;
2569
2570 config = lxc_get_config(key);
2571 /* Verify that the config key exists and that it has a callback
2572 * implemented.
2573 */
2574 if (config && config->get)
2575 ret = config->get(key, retv, inlen, c->lxc_conf, NULL);
2576
2577 container_mem_unlock(c);
2578 return ret;
2579 }
2580
2581 WRAP_API_3(int, lxcapi_get_config_item, const char *, char *, int)
2582
2583 static char* do_lxcapi_get_running_config_item(struct lxc_container *c, const char *key)
2584 {
2585 char *ret;
2586
2587 if (!c || !c->lxc_conf)
2588 return NULL;
2589
2590 if (container_mem_lock(c))
2591 return NULL;
2592
2593 ret = lxc_cmd_get_config_item(c->name, key, do_lxcapi_get_config_path(c));
2594 container_mem_unlock(c);
2595 return ret;
2596 }
2597
2598 WRAP_API_1(char *, lxcapi_get_running_config_item, const char *)
2599
2600 static int do_lxcapi_get_keys(struct lxc_container *c, const char *key, char *retv, int inlen)
2601 {
2602 int ret = -1;
2603
2604 /* List all config items. */
2605 if (!key)
2606 return lxc_list_config_items(retv, inlen);
2607
2608 if (!c || !c->lxc_conf)
2609 return -1;
2610
2611 if (container_mem_lock(c))
2612 return -1;
2613
2614 /* Support 'lxc.net.<idx>', i.e. 'lxc.net.0'
2615 * This is an intelligent result to show which keys are valid given the
2616 * type of nic it is.
2617 */
2618 if (strncmp(key, "lxc.net.", 8) == 0)
2619 ret = lxc_list_net(c->lxc_conf, key, retv, inlen);
2620 else
2621 ret = lxc_list_subkeys(c->lxc_conf, key, retv, inlen);
2622
2623 container_mem_unlock(c);
2624 return ret;
2625 }
2626
2627 WRAP_API_3(int, lxcapi_get_keys, const char *, char *, int)
2628
2629 static bool do_lxcapi_save_config(struct lxc_container *c, const char *alt_file)
2630 {
2631 int fd, lret;
2632 bool ret = false, need_disklock = false;
2633
2634 if (!alt_file)
2635 alt_file = c->configfile;
2636
2637 if (!alt_file)
2638 return false;
2639
2640 /* If we haven't yet loaded a config, load the stock config. */
2641 if (!c->lxc_conf) {
2642 if (!do_lxcapi_load_config(c, lxc_global_config_value("lxc.default_config"))) {
2643 ERROR("Error loading default configuration file %s "
2644 "while saving %s",
2645 lxc_global_config_value("lxc.default_config"),
2646 c->name);
2647 return false;
2648 }
2649 }
2650
2651 if (!create_container_dir(c))
2652 return false;
2653
2654 /* If we're writing to the container's config file, take the disk lock.
2655 * Otherwise just take the memlock to protect the struct lxc_container
2656 * while we're traversing it.
2657 */
2658 if (strcmp(c->configfile, alt_file) == 0)
2659 need_disklock = true;
2660
2661 if (need_disklock)
2662 lret = container_disk_lock(c);
2663 else
2664 lret = container_mem_lock(c);
2665 if (lret)
2666 return false;
2667
2668 fd = open(alt_file, O_WRONLY | O_CREAT | O_TRUNC | O_CLOEXEC,
2669 S_IRUSR | S_IWUSR | S_IRGRP | S_IWGRP);
2670 if (fd < 0)
2671 goto on_error;
2672
2673 lret = write_config(fd, c->lxc_conf);
2674 close(fd);
2675 if (lret < 0)
2676 goto on_error;
2677
2678 ret = true;
2679
2680 on_error:
2681 if (need_disklock)
2682 container_disk_unlock(c);
2683 else
2684 container_mem_unlock(c);
2685
2686 return ret;
2687 }
2688
2689 WRAP_API_1(bool, lxcapi_save_config, const char *)
2690
2691
2692 static bool mod_rdep(struct lxc_container *c0, struct lxc_container *c, bool inc)
2693 {
2694 FILE *f1;
2695 struct stat fbuf;
2696 void *buf = NULL;
2697 char *del = NULL;
2698 char path[PATH_MAX];
2699 char newpath[PATH_MAX];
2700 int fd, ret, n = 0, v = 0;
2701 bool bret = false;
2702 size_t len = 0, bytes = 0;
2703
2704 if (container_disk_lock(c0))
2705 return false;
2706
2707 ret = snprintf(path, PATH_MAX, "%s/%s/lxc_snapshots", c0->config_path, c0->name);
2708 if (ret < 0 || ret > PATH_MAX)
2709 goto out;
2710
2711 ret = snprintf(newpath, PATH_MAX, "%s\n%s\n", c->config_path, c->name);
2712 if (ret < 0 || ret > PATH_MAX)
2713 goto out;
2714
2715 /* If we find an lxc-snapshot file using the old format only listing the
2716 * number of snapshots we will keep using it. */
2717 f1 = fopen(path, "r");
2718 if (f1) {
2719 n = fscanf(f1, "%d", &v);
2720 fclose(f1);
2721 if (n == 1 && v == 0) {
2722 ret = remove(path);
2723 if (ret < 0)
2724 SYSERROR("Failed to remove \"%s\"", path);
2725
2726 n = 0;
2727 }
2728 }
2729
2730 if (n == 1) {
2731 v += inc ? 1 : -1;
2732 f1 = fopen(path, "w");
2733 if (!f1)
2734 goto out;
2735
2736 if (fprintf(f1, "%d\n", v) < 0) {
2737 ERROR("Error writing new snapshots value");
2738 fclose(f1);
2739 goto out;
2740 }
2741
2742 ret = fclose(f1);
2743 if (ret != 0) {
2744 SYSERROR("Error writing to or closing snapshots file");
2745 goto out;
2746 }
2747 } else {
2748 /* Here we know that we have or can use an lxc-snapshot file
2749 * using the new format. */
2750 if (inc) {
2751 f1 = fopen(path, "a");
2752 if (!f1)
2753 goto out;
2754
2755 if (fprintf(f1, "%s", newpath) < 0) {
2756 ERROR("Error writing new snapshots entry");
2757 ret = fclose(f1);
2758 if (ret != 0)
2759 SYSERROR("Error writing to or closing snapshots file");
2760 goto out;
2761 }
2762
2763 ret = fclose(f1);
2764 if (ret != 0) {
2765 SYSERROR("Error writing to or closing snapshots file");
2766 goto out;
2767 }
2768 } else if (!inc) {
2769 if ((fd = open(path, O_RDWR | O_CLOEXEC)) < 0)
2770 goto out;
2771
2772 if (fstat(fd, &fbuf) < 0) {
2773 close(fd);
2774 goto out;
2775 }
2776
2777 if (fbuf.st_size != 0) {
2778 buf = lxc_strmmap(NULL, fbuf.st_size, PROT_READ | PROT_WRITE, MAP_SHARED, fd, 0);
2779 if (buf == MAP_FAILED) {
2780 SYSERROR("Failed to create mapping %s", path);
2781 close(fd);
2782 goto out;
2783 }
2784
2785 len = strlen(newpath);
2786 while ((del = strstr((char *)buf, newpath))) {
2787 memmove(del, del + len, strlen(del) - len + 1);
2788 bytes += len;
2789 }
2790
2791 lxc_strmunmap(buf, fbuf.st_size);
2792 if (ftruncate(fd, fbuf.st_size - bytes) < 0) {
2793 SYSERROR("Failed to truncate file %s", path);
2794 close(fd);
2795 goto out;
2796 }
2797 }
2798
2799 close(fd);
2800 }
2801
2802 /* If the lxc-snapshot file is empty, remove it. */
2803 if (stat(path, &fbuf) < 0)
2804 goto out;
2805
2806 if (!fbuf.st_size) {
2807 ret = remove(path);
2808 if (ret < 0)
2809 SYSERROR("Failed to remove \"%s\"", path);
2810 }
2811 }
2812
2813 bret = true;
2814
2815 out:
2816 container_disk_unlock(c0);
2817 return bret;
2818 }
2819
2820 void mod_all_rdeps(struct lxc_container *c, bool inc)
2821 {
2822 struct lxc_container *p;
2823 char *lxcpath = NULL, *lxcname = NULL, path[PATH_MAX];
2824 size_t pathlen = 0, namelen = 0;
2825 FILE *f;
2826 int ret;
2827
2828 ret = snprintf(path, PATH_MAX, "%s/%s/lxc_rdepends",
2829 c->config_path, c->name);
2830 if (ret < 0 || ret >= PATH_MAX) {
2831 ERROR("Path name too long");
2832 return;
2833 }
2834
2835 f = fopen(path, "r");
2836 if (f == NULL)
2837 return;
2838
2839 while (getline(&lxcpath, &pathlen, f) != -1) {
2840 if (getline(&lxcname, &namelen, f) == -1) {
2841 ERROR("badly formatted file %s", path);
2842 goto out;
2843 }
2844
2845 remove_trailing_newlines(lxcpath);
2846 remove_trailing_newlines(lxcname);
2847
2848 if ((p = lxc_container_new(lxcname, lxcpath)) == NULL) {
2849 ERROR("Unable to find dependent container %s:%s",
2850 lxcpath, lxcname);
2851 continue;
2852 }
2853
2854 if (!mod_rdep(p, c, inc))
2855 ERROR("Failed to update snapshots file for %s:%s",
2856 lxcpath, lxcname);
2857
2858 lxc_container_put(p);
2859 }
2860
2861 out:
2862 free(lxcpath);
2863 free(lxcname);
2864 fclose(f);
2865 }
2866
2867 static bool has_fs_snapshots(struct lxc_container *c)
2868 {
2869 FILE *f;
2870 char path[PATH_MAX];
2871 int ret, v;
2872 struct stat fbuf;
2873 bool bret = false;
2874
2875 ret = snprintf(path, PATH_MAX, "%s/%s/lxc_snapshots", c->config_path,
2876 c->name);
2877 if (ret < 0 || ret > PATH_MAX)
2878 goto out;
2879
2880 /* If the file doesn't exist there are no snapshots. */
2881 if (stat(path, &fbuf) < 0)
2882 goto out;
2883
2884 v = fbuf.st_size;
2885 if (v != 0) {
2886 f = fopen(path, "r");
2887 if (!f)
2888 goto out;
2889
2890 ret = fscanf(f, "%d", &v);
2891 fclose(f);
2892 /* TODO: Figure out what to do with the return value of fscanf. */
2893 if (ret != 1)
2894 INFO("Container uses new lxc-snapshots format %s", path);
2895 }
2896
2897 bret = v != 0;
2898
2899 out:
2900 return bret;
2901 }
2902
2903 static bool has_snapshots(struct lxc_container *c)
2904 {
2905 char path[PATH_MAX];
2906 struct dirent *direntp;
2907 int count=0;
2908 DIR *dir;
2909
2910 if (!get_snappath_dir(c, path))
2911 return false;
2912
2913 dir = opendir(path);
2914 if (!dir)
2915 return false;
2916
2917 while ((direntp = readdir(dir))) {
2918 if (!strcmp(direntp->d_name, "."))
2919 continue;
2920
2921 if (!strcmp(direntp->d_name, ".."))
2922 continue;
2923 count++;
2924 break;
2925 }
2926
2927 closedir(dir);
2928 return count > 0;
2929 }
2930
2931 static bool do_destroy_container(struct lxc_conf *conf) {
2932 int ret;
2933
2934 if (am_guest_unpriv()) {
2935 ret = userns_exec_full(conf, storage_destroy_wrapper, conf,
2936 "storage_destroy_wrapper");
2937 if (ret < 0)
2938 return false;
2939
2940 return true;
2941 }
2942
2943 return storage_destroy(conf);
2944 }
2945
2946 static int lxc_rmdir_onedev_wrapper(void *data)
2947 {
2948 char *arg = (char *) data;
2949 return lxc_rmdir_onedev(arg, "snaps");
2950 }
2951
2952 static int lxc_unlink_exec_wrapper(void *data)
2953 {
2954 char *arg = data;
2955 return unlink(arg);
2956 }
2957
2958 static bool container_destroy(struct lxc_container *c,
2959 struct lxc_storage *storage)
2960 {
2961 const char *p1;
2962 size_t len;
2963 struct lxc_conf *conf;
2964 char *path = NULL;
2965 bool bret = false;
2966 int ret = 0;
2967
2968 if (!c || !do_lxcapi_is_defined(c))
2969 return false;
2970
2971 conf = c->lxc_conf;
2972 if (container_disk_lock(c))
2973 return false;
2974
2975 if (!is_stopped(c)) {
2976 /* We should queue some sort of error - in c->error_string? */
2977 ERROR("container %s is not stopped", c->name);
2978 goto out;
2979 }
2980
2981 if (conf && !lxc_list_empty(&conf->hooks[LXCHOOK_DESTROY])) {
2982 /* Start of environment variable setup for hooks */
2983 if (setenv("LXC_NAME", c->name, 1))
2984 SYSERROR("Failed to set environment variable for container name");
2985
2986 if (conf->rcfile && setenv("LXC_CONFIG_FILE", conf->rcfile, 1))
2987 SYSERROR("Failed to set environment variable for config path");
2988
2989 if (conf->rootfs.mount && setenv("LXC_ROOTFS_MOUNT", conf->rootfs.mount, 1))
2990 SYSERROR("Failed to set environment variable for rootfs mount");
2991
2992 if (conf->rootfs.path && setenv("LXC_ROOTFS_PATH", conf->rootfs.path, 1))
2993 SYSERROR("Failed to set environment variable for rootfs mount");
2994
2995 if (conf->console.path && setenv("LXC_CONSOLE", conf->console.path, 1))
2996 SYSERROR("Failed to set environment variable for console path");
2997
2998 if (conf->console.log_path && setenv("LXC_CONSOLE_LOGPATH", conf->console.log_path, 1))
2999 SYSERROR("Failed to set environment variable for console log");
3000 /* End of environment variable setup for hooks */
3001
3002 if (run_lxc_hooks(c->name, "destroy", conf, NULL)) {
3003 ERROR("Failed to execute clone hook for \"%s\"", c->name);
3004 goto out;
3005 }
3006 }
3007
3008 if (current_config && conf == current_config) {
3009 current_config = NULL;
3010
3011 if (conf->logfd != -1) {
3012 close(conf->logfd);
3013 conf->logfd = -1;
3014 }
3015 }
3016
3017 /* LXC is not managing the storage of the container. */
3018 if (conf && !conf->rootfs.managed)
3019 goto on_success;
3020
3021 if (conf && conf->rootfs.path && conf->rootfs.mount) {
3022 if (!do_destroy_container(conf)) {
3023 ERROR("Error destroying rootfs for %s", c->name);
3024 goto out;
3025 }
3026 INFO("Destroyed rootfs for %s", c->name);
3027 }
3028
3029 mod_all_rdeps(c, false);
3030
3031 p1 = do_lxcapi_get_config_path(c);
3032 /* strlen(p1)
3033 * +
3034 * /
3035 * +
3036 * strlen(c->name)
3037 * +
3038 * /
3039 * +
3040 * strlen("config") = 6
3041 * +
3042 * \0
3043 */
3044 len = strlen(p1) + 1 + strlen(c->name) + 1 + 6 + 1;
3045 path = malloc(len);
3046 if (!path) {
3047 ERROR("Failed to allocate memory");
3048 goto out;
3049 }
3050
3051 /* For an overlay container the rootfs is considered immutable and
3052 * cannot be removed when restoring from a snapshot.
3053 */
3054 if (storage && (!strcmp(storage->type, "overlay") ||
3055 !strcmp(storage->type, "overlayfs")) &&
3056 (storage->flags & LXC_STORAGE_INTERNAL_OVERLAY_RESTORE)) {
3057 ret = snprintf(path, len, "%s/%s/config", p1, c->name);
3058 if (ret < 0 || (size_t)ret >= len)
3059 goto out;
3060
3061 if (am_guest_unpriv())
3062 ret = userns_exec_1(conf, lxc_unlink_exec_wrapper, path,
3063 "lxc_unlink_exec_wrapper");
3064 else
3065 ret = unlink(path);
3066 if (ret < 0) {
3067 SYSERROR("Failed to destroy config file \"%s\" for \"%s\"",
3068 path, c->name);
3069 goto out;
3070 }
3071 INFO("Destroyed config file \"%s\" for \"%s\"", path, c->name);
3072
3073 bret = true;
3074 goto out;
3075 }
3076
3077 ret = snprintf(path, len, "%s/%s", p1, c->name);
3078 if (ret < 0 || (size_t)ret >= len)
3079 goto out;
3080
3081 if (am_guest_unpriv())
3082 ret = userns_exec_full(conf, lxc_rmdir_onedev_wrapper, path,
3083 "lxc_rmdir_onedev_wrapper");
3084 else
3085 ret = lxc_rmdir_onedev(path, "snaps");
3086 if (ret < 0) {
3087 ERROR("Failed to destroy directory \"%s\" for \"%s\"", path,
3088 c->name);
3089 goto out;
3090 }
3091 INFO("Destroyed directory \"%s\" for \"%s\"", path, c->name);
3092
3093 on_success:
3094 bret = true;
3095
3096 out:
3097 if (path)
3098 free(path);
3099
3100 container_disk_unlock(c);
3101 return bret;
3102 }
3103
3104 static bool do_lxcapi_destroy(struct lxc_container *c)
3105 {
3106 if (!c || !lxcapi_is_defined(c))
3107 return false;
3108
3109 if (c->lxc_conf && c->lxc_conf->rootfs.managed) {
3110 if (has_snapshots(c)) {
3111 ERROR("Container %s has snapshots; not removing", c->name);
3112 return false;
3113 }
3114
3115 if (has_fs_snapshots(c)) {
3116 ERROR("container %s has snapshots on its rootfs", c->name);
3117 return false;
3118 }
3119 }
3120
3121 return container_destroy(c, NULL);
3122 }
3123
3124 WRAP_API(bool, lxcapi_destroy)
3125
3126 static bool do_lxcapi_destroy_with_snapshots(struct lxc_container *c)
3127 {
3128 if (!c || !lxcapi_is_defined(c))
3129 return false;
3130
3131 if (!lxcapi_snapshot_destroy_all(c)) {
3132 ERROR("Error deleting all snapshots");
3133 return false;
3134 }
3135
3136 return lxcapi_destroy(c);
3137 }
3138
3139 WRAP_API(bool, lxcapi_destroy_with_snapshots)
3140
3141 int lxc_set_config_item_locked(struct lxc_conf *conf, const char *key,
3142 const char *v)
3143 {
3144 int ret;
3145 struct lxc_config_t *config;
3146 bool bret = true;
3147
3148 config = lxc_get_config(key);
3149 if (!config)
3150 return -EINVAL;
3151
3152 ret = config->set(key, v, conf, NULL);
3153 if (ret < 0)
3154 return -EINVAL;
3155
3156 if (lxc_config_value_empty(v))
3157 do_clear_unexp_config_line(conf, key);
3158 else
3159 bret = do_append_unexp_config_line(conf, key, v);
3160 if (!bret)
3161 return -ENOMEM;
3162
3163 return 0;
3164 }
3165
3166 static bool do_set_config_item_locked(struct lxc_container *c, const char *key,
3167 const char *v)
3168 {
3169 int ret;
3170
3171 if (!c->lxc_conf)
3172 c->lxc_conf = lxc_conf_init();
3173
3174 if (!c->lxc_conf)
3175 return false;
3176
3177 ret = lxc_set_config_item_locked(c->lxc_conf, key, v);
3178 if (ret < 0)
3179 return false;
3180
3181 return true;
3182 }
3183
3184 static bool do_lxcapi_set_config_item(struct lxc_container *c, const char *key, const char *v)
3185 {
3186 bool b = false;
3187
3188 if (!c)
3189 return false;
3190
3191 if (container_mem_lock(c))
3192 return false;
3193
3194 b = do_set_config_item_locked(c, key, v);
3195
3196 container_mem_unlock(c);
3197 return b;
3198 }
3199
3200 WRAP_API_2(bool, lxcapi_set_config_item, const char *, const char *)
3201
3202 static char *lxcapi_config_file_name(struct lxc_container *c)
3203 {
3204 if (!c || !c->configfile)
3205 return NULL;
3206
3207 return strdup(c->configfile);
3208 }
3209
3210 static const char *lxcapi_get_config_path(struct lxc_container *c)
3211 {
3212 if (!c || !c->config_path)
3213 return NULL;
3214
3215 return (const char *)(c->config_path);
3216 }
3217
3218 /*
3219 * not for export
3220 * Just recalculate the c->configfile based on the
3221 * c->config_path, which must be set.
3222 * The lxc_container must be locked or not yet public.
3223 */
3224 static bool set_config_filename(struct lxc_container *c)
3225 {
3226 char *newpath;
3227 int len, ret;
3228
3229 if (!c->config_path)
3230 return false;
3231
3232 /* $lxc_path + "/" + c->name + "/" + "config" + '\0' */
3233 len = strlen(c->config_path) + strlen(c->name) + strlen("config") + 3;
3234 newpath = malloc(len);
3235 if (!newpath)
3236 return false;
3237
3238 ret = snprintf(newpath, len, "%s/%s/config", c->config_path, c->name);
3239 if (ret < 0 || ret >= len) {
3240 fprintf(stderr, "Error printing out config file name\n");
3241 free(newpath);
3242 return false;
3243 }
3244
3245 free(c->configfile);
3246 c->configfile = newpath;
3247
3248 return true;
3249 }
3250
3251 static bool do_lxcapi_set_config_path(struct lxc_container *c, const char *path)
3252 {
3253 char *p;
3254 bool b = false;
3255 char *oldpath = NULL;
3256
3257 if (!c)
3258 return b;
3259
3260 if (container_mem_lock(c))
3261 return b;
3262
3263 p = strdup(path);
3264 if (!p) {
3265 ERROR("Out of memory setting new lxc path");
3266 goto err;
3267 }
3268
3269 b = true;
3270 if (c->config_path)
3271 oldpath = c->config_path;
3272 c->config_path = p;
3273
3274 /* Since we've changed the config path, we have to change the
3275 * config file name too */
3276 if (!set_config_filename(c)) {
3277 ERROR("Out of memory setting new config filename");
3278 b = false;
3279 free(c->config_path);
3280 c->config_path = oldpath;
3281 oldpath = NULL;
3282 }
3283
3284 err:
3285 free(oldpath);
3286 container_mem_unlock(c);
3287 return b;
3288 }
3289
3290 WRAP_API_1(bool, lxcapi_set_config_path, const char *)
3291
3292 static bool do_lxcapi_set_cgroup_item(struct lxc_container *c, const char *subsys, const char *value)
3293 {
3294 int ret;
3295 struct cgroup_ops *cgroup_ops;
3296
3297 if (!c)
3298 return false;
3299
3300 if (is_stopped(c))
3301 return false;
3302
3303 cgroup_ops = cgroup_init(c->lxc_conf);
3304 if (!cgroup_ops)
3305 return false;
3306
3307 ret = cgroup_ops->set(cgroup_ops, subsys, value, c->name, c->config_path);
3308
3309 cgroup_exit(cgroup_ops);
3310
3311 return ret == 0;
3312 }
3313
3314 WRAP_API_2(bool, lxcapi_set_cgroup_item, const char *, const char *)
3315
3316 static int do_lxcapi_get_cgroup_item(struct lxc_container *c, const char *subsys, char *retv, int inlen)
3317 {
3318 int ret;
3319 struct cgroup_ops *cgroup_ops;
3320
3321 if (!c)
3322 return -1;
3323
3324 if (is_stopped(c))
3325 return -1;
3326
3327 cgroup_ops = cgroup_init(c->lxc_conf);
3328 if (!cgroup_ops)
3329 return -1;
3330
3331 ret = cgroup_ops->get(cgroup_ops, subsys, retv, inlen, c->name,
3332 c->config_path);
3333
3334 cgroup_exit(cgroup_ops);
3335
3336 return ret;
3337 }
3338
3339 WRAP_API_3(int, lxcapi_get_cgroup_item, const char *, char *, int)
3340
3341 const char *lxc_get_global_config_item(const char *key)
3342 {
3343 return lxc_global_config_value(key);
3344 }
3345
3346 const char *lxc_get_version(void)
3347 {
3348 return LXC_VERSION;
3349 }
3350
3351 static int copy_file(const char *old, const char *new)
3352 {
3353 int in, out;
3354 ssize_t len, ret;
3355 char buf[8096];
3356 struct stat sbuf;
3357
3358 if (file_exists(new)) {
3359 ERROR("copy destination %s exists", new);
3360 return -1;
3361 }
3362
3363 ret = stat(old, &sbuf);
3364 if (ret < 0) {
3365 INFO("Error stat'ing %s", old);
3366 return -1;
3367 }
3368
3369 in = open(old, O_RDONLY);
3370 if (in < 0) {
3371 SYSERROR("Error opening original file %s", old);
3372 return -1;
3373 }
3374
3375 out = open(new, O_CREAT | O_EXCL | O_WRONLY, 0644);
3376 if (out < 0) {
3377 SYSERROR("Error opening new file %s", new);
3378 close(in);
3379 return -1;
3380 }
3381
3382 for (;;) {
3383 len = lxc_read_nointr(in, buf, 8096);
3384 if (len < 0) {
3385 SYSERROR("Error reading old file %s", old);
3386 goto err;
3387 }
3388
3389 if (len == 0)
3390 break;
3391
3392 ret = lxc_write_nointr(out, buf, len);
3393 if (ret < len) { /* should we retry? */
3394 SYSERROR("Error: write to new file %s was interrupted", new);
3395 goto err;
3396 }
3397 }
3398
3399 close(in);
3400 close(out);
3401
3402 /* We set mode, but not owner/group. */
3403 ret = chmod(new, sbuf.st_mode);
3404 if (ret) {
3405 SYSERROR("Error setting mode on %s", new);
3406 return -1;
3407 }
3408
3409 return 0;
3410
3411 err:
3412 close(in);
3413 close(out);
3414 return -1;
3415 }
3416
3417 static int copyhooks(struct lxc_container *oldc, struct lxc_container *c)
3418 {
3419 __do_free char *cpath = NULL;
3420 int i, len, ret;
3421 struct lxc_list *it;
3422
3423 len = strlen(oldc->config_path) + strlen(oldc->name) + 3;
3424 cpath = must_realloc(NULL, len);
3425 ret = snprintf(cpath, len, "%s/%s/", oldc->config_path, oldc->name);
3426 if (ret < 0 || ret >= len)
3427 return -1;
3428
3429 for (i=0; i<NUM_LXC_HOOKS; i++) {
3430 lxc_list_for_each(it, &c->lxc_conf->hooks[i]) {
3431 char *hookname = it->elem;
3432 char *fname = strrchr(hookname, '/');
3433 char tmppath[PATH_MAX];
3434 if (!fname) /* relative path - we don't support, but maybe we should */
3435 return 0;
3436
3437 if (strncmp(hookname, cpath, len - 1) != 0) {
3438 /* this hook is public - ignore */
3439 continue;
3440 }
3441
3442 /* copy the script, and change the entry in confile */
3443 ret = snprintf(tmppath, PATH_MAX, "%s/%s/%s",
3444 c->config_path, c->name, fname+1);
3445 if (ret < 0 || ret >= PATH_MAX)
3446 return -1;
3447
3448 ret = copy_file(it->elem, tmppath);
3449 if (ret < 0)
3450 return -1;
3451
3452 free(it->elem);
3453
3454 it->elem = strdup(tmppath);
3455 if (!it->elem) {
3456 ERROR("out of memory copying hook path");
3457 return -1;
3458 }
3459 }
3460 }
3461
3462 if (!clone_update_unexp_hooks(c->lxc_conf, oldc->config_path,
3463 c->config_path, oldc->name, c->name)) {
3464 ERROR("Error saving new hooks in clone");
3465 return -1;
3466 }
3467
3468 do_lxcapi_save_config(c, NULL);
3469 return 0;
3470 }
3471
3472
3473 static int copy_fstab(struct lxc_container *oldc, struct lxc_container *c)
3474 {
3475 char newpath[PATH_MAX];
3476 char *oldpath = oldc->lxc_conf->fstab;
3477 int ret;
3478
3479 if (!oldpath)
3480 return 0;
3481
3482 clear_unexp_config_line(c->lxc_conf, "lxc.mount.fstab", false);
3483
3484 char *p = strrchr(oldpath, '/');
3485 if (!p)
3486 return -1;
3487
3488 ret = snprintf(newpath, PATH_MAX, "%s/%s%s",
3489 c->config_path, c->name, p);
3490 if (ret < 0 || ret >= PATH_MAX) {
3491 ERROR("error printing new path for %s", oldpath);
3492 return -1;
3493 }
3494
3495 if (file_exists(newpath)) {
3496 ERROR("error: fstab file %s exists", newpath);
3497 return -1;
3498 }
3499
3500 if (copy_file(oldpath, newpath) < 0) {
3501 ERROR("error: copying %s to %s", oldpath, newpath);
3502 return -1;
3503 }
3504
3505 free(c->lxc_conf->fstab);
3506
3507 c->lxc_conf->fstab = strdup(newpath);
3508 if (!c->lxc_conf->fstab) {
3509 ERROR("error: allocating pathname");
3510 return -1;
3511 }
3512
3513 if (!do_append_unexp_config_line(c->lxc_conf, "lxc.mount.fstab", newpath)) {
3514 ERROR("error saving new lxctab");
3515 return -1;
3516 }
3517
3518 return 0;
3519 }
3520
3521 static void copy_rdepends(struct lxc_container *c, struct lxc_container *c0)
3522 {
3523 char path0[PATH_MAX], path1[PATH_MAX];
3524 int ret;
3525
3526 ret = snprintf(path0, PATH_MAX, "%s/%s/lxc_rdepends", c0->config_path,
3527 c0->name);
3528 if (ret < 0 || ret >= PATH_MAX) {
3529 WARN("Error copying reverse dependencies");
3530 return;
3531 }
3532
3533 ret = snprintf(path1, PATH_MAX, "%s/%s/lxc_rdepends", c->config_path,
3534 c->name);
3535 if (ret < 0 || ret >= PATH_MAX) {
3536 WARN("Error copying reverse dependencies");
3537 return;
3538 }
3539
3540 if (copy_file(path0, path1) < 0) {
3541 INFO("Error copying reverse dependencies");
3542 return;
3543 }
3544 }
3545
3546 static bool add_rdepends(struct lxc_container *c, struct lxc_container *c0)
3547 {
3548 int ret;
3549 char path[PATH_MAX];
3550 FILE *f;
3551 bool bret;
3552
3553 ret = snprintf(path, PATH_MAX, "%s/%s/lxc_rdepends", c->config_path,
3554 c->name);
3555 if (ret < 0 || ret >= PATH_MAX)
3556 return false;
3557
3558 f = fopen(path, "a");
3559 if (!f)
3560 return false;
3561
3562 bret = true;
3563
3564 /* If anything goes wrong, just return an error. */
3565 if (fprintf(f, "%s\n%s\n", c0->config_path, c0->name) < 0)
3566 bret = false;
3567
3568 if (fclose(f) != 0)
3569 bret = false;
3570
3571 return bret;
3572 }
3573
3574 /*
3575 * If the fs natively supports snapshot clones with no penalty,
3576 * then default to those even if not requested.
3577 * Currently we only do this for btrfs.
3578 */
3579 bool should_default_to_snapshot(struct lxc_container *c0,
3580 struct lxc_container *c1)
3581 {
3582 __do_free char *p0 = NULL, *p1 = NULL;
3583 int ret;
3584 size_t l0 = strlen(c0->config_path) + strlen(c0->name) + 2;
3585 size_t l1 = strlen(c1->config_path) + strlen(c1->name) + 2;
3586 char *rootfs = c0->lxc_conf->rootfs.path;
3587
3588 p0 = must_realloc(NULL, l0 + 1);
3589 p1 = must_realloc(NULL, l1 + 1);
3590 ret = snprintf(p0, l0, "%s/%s", c0->config_path, c0->name);
3591 if (ret < 0 || ret >= l0)
3592 return false;
3593
3594 ret = snprintf(p1, l1, "%s/%s", c1->config_path, c1->name);
3595 if (ret < 0 || ret >= l1)
3596 return false;
3597
3598 if (!is_btrfs_fs(p0) || !is_btrfs_fs(p1))
3599 return false;
3600
3601 if (is_btrfs_subvol(rootfs) <= 0)
3602 return false;
3603
3604 return btrfs_same_fs(p0, p1) == 0;
3605 }
3606
3607 static int copy_storage(struct lxc_container *c0, struct lxc_container *c,
3608 const char *newtype, int flags, const char *bdevdata,
3609 uint64_t newsize)
3610 {
3611 struct lxc_storage *bdev;
3612 bool need_rdep;
3613
3614 if (should_default_to_snapshot(c0, c))
3615 flags |= LXC_CLONE_SNAPSHOT;
3616
3617 bdev = storage_copy(c0, c->name, c->config_path, newtype, flags,
3618 bdevdata, newsize, &need_rdep);
3619 if (!bdev) {
3620 ERROR("Error copying storage.");
3621 return -1;
3622 }
3623
3624 /* Set new rootfs. */
3625 free(c->lxc_conf->rootfs.path);
3626 c->lxc_conf->rootfs.path = strdup(bdev->src);
3627 storage_put(bdev);
3628
3629 if (!c->lxc_conf->rootfs.path) {
3630 ERROR("Out of memory while setting storage path.");
3631 return -1;
3632 }
3633
3634 /* Append a new lxc.rootfs.path entry to the unexpanded config. */
3635 clear_unexp_config_line(c->lxc_conf, "lxc.rootfs.path", false);
3636 if (!do_append_unexp_config_line(c->lxc_conf, "lxc.rootfs.path",
3637 c->lxc_conf->rootfs.path)) {
3638 ERROR("Error saving new rootfs to cloned config.");
3639 return -1;
3640 }
3641
3642 if (flags & LXC_CLONE_SNAPSHOT)
3643 copy_rdepends(c, c0);
3644
3645 if (need_rdep) {
3646 if (!add_rdepends(c, c0))
3647 WARN("Error adding reverse dependency from %s to %s",
3648 c->name, c0->name);
3649 }
3650
3651 mod_all_rdeps(c, true);
3652
3653 return 0;
3654 }
3655
3656 struct clone_update_data {
3657 struct lxc_container *c0;
3658 struct lxc_container *c1;
3659 int flags;
3660 char **hookargs;
3661 };
3662
3663 static int clone_update_rootfs(struct clone_update_data *data)
3664 {
3665 struct lxc_container *c0 = data->c0;
3666 struct lxc_container *c = data->c1;
3667 int flags = data->flags;
3668 char **hookargs = data->hookargs;
3669 int ret = -1;
3670 char path[PATH_MAX];
3671 struct lxc_storage *bdev;
3672 FILE *fout;
3673 struct lxc_conf *conf = c->lxc_conf;
3674
3675 /* update hostname in rootfs */
3676 /* we're going to mount, so run in a clean namespace to simplify cleanup */
3677
3678 if (setgid(0) < 0) {
3679 ERROR("Failed to setgid to 0");
3680 return -1;
3681 }
3682
3683 if (setuid(0) < 0) {
3684 ERROR("Failed to setuid to 0");
3685 return -1;
3686 }
3687
3688 if (setgroups(0, NULL) < 0)
3689 WARN("Failed to clear groups");
3690
3691 if (unshare(CLONE_NEWNS) < 0)
3692 return -1;
3693
3694 bdev = storage_init(c->lxc_conf);
3695 if (!bdev)
3696 return -1;
3697
3698 if (strcmp(bdev->type, "dir") != 0) {
3699 if (unshare(CLONE_NEWNS) < 0) {
3700 ERROR("error unsharing mounts");
3701 storage_put(bdev);
3702 return -1;
3703 }
3704
3705 if (detect_shared_rootfs()) {
3706 if (mount(NULL, "/", NULL, MS_SLAVE|MS_REC, NULL)) {
3707 SYSERROR("Failed to make / rslave");
3708 ERROR("Continuing...");
3709 }
3710 }
3711
3712 if (bdev->ops->mount(bdev) < 0) {
3713 storage_put(bdev);
3714 return -1;
3715 }
3716 } else { /* TODO come up with a better way */
3717 free(bdev->dest);
3718 bdev->dest = strdup(lxc_storage_get_path(bdev->src, bdev->type));
3719 }
3720
3721 if (!lxc_list_empty(&conf->hooks[LXCHOOK_CLONE])) {
3722 /* Start of environment variable setup for hooks */
3723 if (c0->name && setenv("LXC_SRC_NAME", c0->name, 1))
3724 SYSERROR("failed to set environment variable for source container name");
3725
3726 if (setenv("LXC_NAME", c->name, 1))
3727 SYSERROR("failed to set environment variable for container name");
3728
3729 if (conf->rcfile && setenv("LXC_CONFIG_FILE", conf->rcfile, 1))
3730 SYSERROR("failed to set environment variable for config path");
3731
3732 if (bdev->dest && setenv("LXC_ROOTFS_MOUNT", bdev->dest, 1))
3733 SYSERROR("failed to set environment variable for rootfs mount");
3734
3735 if (conf->rootfs.path && setenv("LXC_ROOTFS_PATH", conf->rootfs.path, 1))
3736 SYSERROR("failed to set environment variable for rootfs mount");
3737
3738 if (run_lxc_hooks(c->name, "clone", conf, hookargs)) {
3739 ERROR("Error executing clone hook for %s", c->name);
3740 storage_put(bdev);
3741 return -1;
3742 }
3743 }
3744
3745 if (!(flags & LXC_CLONE_KEEPNAME)) {
3746 ret = snprintf(path, PATH_MAX, "%s/etc/hostname", bdev->dest);
3747 storage_put(bdev);
3748
3749 if (ret < 0 || ret >= PATH_MAX)
3750 return -1;
3751
3752 if (!file_exists(path))
3753 return 0;
3754
3755 if (!(fout = fopen(path, "w"))) {
3756 SYSERROR("unable to open %s: ignoring", path);
3757 return 0;
3758 }
3759
3760 if (fprintf(fout, "%s", c->name) < 0) {
3761 fclose(fout);
3762 return -1;
3763 }
3764
3765 if (fclose(fout) < 0)
3766 return -1;
3767 } else {
3768 storage_put(bdev);
3769 }
3770
3771 return 0;
3772 }
3773
3774 static int clone_update_rootfs_wrapper(void *data)
3775 {
3776 struct clone_update_data *arg = (struct clone_update_data *) data;
3777 return clone_update_rootfs(arg);
3778 }
3779
3780 /*
3781 * We want to support:
3782 sudo lxc-clone -o o1 -n n1 -s -L|-fssize fssize -v|--vgname vgname \
3783 -p|--lvprefix lvprefix -t|--fstype fstype -B backingstore
3784
3785 -s [ implies overlay]
3786 -s -B overlay
3787
3788 only rootfs gets converted (copied/snapshotted) on clone.
3789 */
3790
3791 static int create_file_dirname(char *path, struct lxc_conf *conf)
3792 {
3793 char *p = strrchr(path, '/');
3794 int ret = -1;
3795
3796 if (!p)
3797 return -1;
3798
3799 *p = '\0';
3800 ret = do_create_container_dir(path, conf);
3801 *p = '/';
3802
3803 return ret;
3804 }
3805
3806 static struct lxc_container *do_lxcapi_clone(struct lxc_container *c, const char *newname,
3807 const char *lxcpath, int flags,
3808 const char *bdevtype, const char *bdevdata, uint64_t newsize,
3809 char **hookargs)
3810 {
3811 char newpath[PATH_MAX];
3812 int fd, ret;
3813 struct clone_update_data data;
3814 size_t saved_unexp_len;
3815 pid_t pid;
3816 int storage_copied = 0;
3817 char *origroot = NULL, *saved_unexp_conf = NULL;
3818 struct lxc_container *c2 = NULL;
3819
3820 if (!c || !do_lxcapi_is_defined(c))
3821 return NULL;
3822
3823 if (container_mem_lock(c))
3824 return NULL;
3825 if (!is_stopped(c) && !(flags & LXC_CLONE_ALLOW_RUNNING)) {
3826 ERROR("error: Original container (%s) is running. Use --allowrunning if you want to force a snapshot of the running container.", c->name);
3827 goto out;
3828 }
3829
3830 /* Make sure the container doesn't yet exist. */
3831 if (!newname)
3832 newname = c->name;
3833
3834 if (!lxcpath)
3835 lxcpath = do_lxcapi_get_config_path(c);
3836
3837 ret = snprintf(newpath, PATH_MAX, "%s/%s/config", lxcpath, newname);
3838 if (ret < 0 || ret >= PATH_MAX) {
3839 SYSERROR("clone: failed making config pathname");
3840 goto out;
3841 }
3842
3843 if (file_exists(newpath)) {
3844 ERROR("error: clone: %s exists", newpath);
3845 goto out;
3846 }
3847
3848 ret = create_file_dirname(newpath, c->lxc_conf);
3849 if (ret < 0 && errno != EEXIST) {
3850 ERROR("Error creating container dir for %s", newpath);
3851 goto out;
3852 }
3853
3854 /* Copy the configuration. Tweak it as needed. */
3855 if (c->lxc_conf->rootfs.path) {
3856 origroot = c->lxc_conf->rootfs.path;
3857 c->lxc_conf->rootfs.path = NULL;
3858 }
3859
3860 fd = open(newpath, O_WRONLY | O_CREAT | O_CLOEXEC,
3861 S_IRUSR | S_IWUSR | S_IRGRP | S_IWGRP);
3862 if (fd < 0) {
3863 SYSERROR("Failed to open \"%s\"", newpath);
3864 goto out;
3865 }
3866
3867 saved_unexp_conf = c->lxc_conf->unexpanded_config;
3868 saved_unexp_len = c->lxc_conf->unexpanded_len;
3869 c->lxc_conf->unexpanded_config = strdup(saved_unexp_conf);
3870 if (!c->lxc_conf->unexpanded_config) {
3871 close(fd);
3872 goto out;
3873 }
3874
3875 clear_unexp_config_line(c->lxc_conf, "lxc.rootfs.path", false);
3876 write_config(fd, c->lxc_conf);
3877 close(fd);
3878
3879 c->lxc_conf->rootfs.path = origroot;
3880
3881 free(c->lxc_conf->unexpanded_config);
3882 c->lxc_conf->unexpanded_config = saved_unexp_conf;
3883 saved_unexp_conf = NULL;
3884 c->lxc_conf->unexpanded_len = saved_unexp_len;
3885
3886 ret = snprintf(newpath, PATH_MAX, "%s/%s/rootfs", lxcpath, newname);
3887 if (ret < 0 || ret >= PATH_MAX) {
3888 SYSERROR("clone: failed making rootfs pathname");
3889 goto out;
3890 }
3891
3892 ret = mkdir(newpath, 0755);
3893 if (ret < 0) {
3894 /* For an overlay container the rootfs is considered immutable
3895 * and will not have been removed when restoring from a
3896 * snapshot.
3897 */
3898 if (errno != ENOENT &&
3899 !(flags & LXC_STORAGE_INTERNAL_OVERLAY_RESTORE)) {
3900 SYSERROR("Failed to create directory \"%s\"", newpath);
3901 goto out;
3902 }
3903 }
3904
3905 if (am_guest_unpriv()) {
3906 if (chown_mapped_root(newpath, c->lxc_conf) < 0) {
3907 ERROR("Error chowning %s to container root", newpath);
3908 goto out;
3909 }
3910 }
3911
3912 c2 = lxc_container_new(newname, lxcpath);
3913 if (!c2) {
3914 ERROR("clone: failed to create new container (%s %s)", newname,
3915 lxcpath);
3916 goto out;
3917 }
3918
3919 /* copy/snapshot rootfs's */
3920 ret = copy_storage(c, c2, bdevtype, flags, bdevdata, newsize);
3921 if (ret < 0)
3922 goto out;
3923
3924 /* update utsname */
3925 if (!(flags & LXC_CLONE_KEEPNAME)) {
3926 clear_unexp_config_line(c2->lxc_conf, "lxc.utsname", false);
3927 clear_unexp_config_line(c2->lxc_conf, "lxc.uts.name", false);
3928
3929 if (!do_set_config_item_locked(c2, "lxc.uts.name", newname)) {
3930 ERROR("Error setting new hostname");
3931 goto out;
3932 }
3933 }
3934
3935 /* copy hooks */
3936 ret = copyhooks(c, c2);
3937 if (ret < 0) {
3938 ERROR("error copying hooks");
3939 goto out;
3940 }
3941
3942 if (copy_fstab(c, c2) < 0) {
3943 ERROR("error copying fstab");
3944 goto out;
3945 }
3946
3947 /* update macaddrs */
3948 if (!(flags & LXC_CLONE_KEEPMACADDR)) {
3949 if (!network_new_hwaddrs(c2->lxc_conf)) {
3950 ERROR("Error updating mac addresses");
3951 goto out;
3952 }
3953 }
3954
3955 /* Update absolute paths for overlay mount directories. */
3956 if (ovl_update_abs_paths(c2->lxc_conf, c->config_path, c->name, lxcpath, newname) < 0)
3957 goto out;
3958
3959 /* We've now successfully created c2's storage, so clear it out if we
3960 * fail after this.
3961 */
3962 storage_copied = 1;
3963
3964 if (!c2->save_config(c2, NULL))
3965 goto out;
3966
3967 if ((pid = fork()) < 0) {
3968 SYSERROR("fork");
3969 goto out;
3970 }
3971
3972 if (pid > 0) {
3973 ret = wait_for_pid(pid);
3974 if (ret)
3975 goto out;
3976
3977 container_mem_unlock(c);
3978 return c2;
3979 }
3980
3981 data.c0 = c;
3982 data.c1 = c2;
3983 data.flags = flags;
3984 data.hookargs = hookargs;
3985
3986 if (am_guest_unpriv())
3987 ret = userns_exec_full(c->lxc_conf, clone_update_rootfs_wrapper,
3988 &data, "clone_update_rootfs_wrapper");
3989 else
3990 ret = clone_update_rootfs(&data);
3991 if (ret < 0)
3992 _exit(EXIT_FAILURE);
3993
3994 container_mem_unlock(c);
3995 _exit(EXIT_SUCCESS);
3996
3997 out:
3998 container_mem_unlock(c);
3999 if (c2) {
4000 if (!storage_copied)
4001 c2->lxc_conf->rootfs.path = NULL;
4002
4003 c2->destroy(c2);
4004 lxc_container_put(c2);
4005 }
4006
4007 return NULL;
4008 }
4009
4010 static struct lxc_container *lxcapi_clone(struct lxc_container *c, const char *newname,
4011 const char *lxcpath, int flags,
4012 const char *bdevtype, const char *bdevdata, uint64_t newsize,
4013 char **hookargs)
4014 {
4015 struct lxc_container * ret;
4016
4017 current_config = c ? c->lxc_conf : NULL;
4018 ret = do_lxcapi_clone(c, newname, lxcpath, flags, bdevtype, bdevdata, newsize, hookargs);
4019 current_config = NULL;
4020
4021 return ret;
4022 }
4023
4024 static bool do_lxcapi_rename(struct lxc_container *c, const char *newname)
4025 {
4026 struct lxc_storage *bdev;
4027 struct lxc_container *newc;
4028
4029 if (!c || !c->name || !c->config_path || !c->lxc_conf)
4030 return false;
4031
4032 if (has_fs_snapshots(c) || has_snapshots(c)) {
4033 ERROR("Renaming a container with snapshots is not supported");
4034 return false;
4035 }
4036
4037 bdev = storage_init(c->lxc_conf);
4038 if (!bdev) {
4039 ERROR("Failed to find original backing store type");
4040 return false;
4041 }
4042
4043 newc = lxcapi_clone(c, newname, c->config_path, LXC_CLONE_KEEPMACADDR, NULL, bdev->type, 0, NULL);
4044 storage_put(bdev);
4045 if (!newc) {
4046 lxc_container_put(newc);
4047 return false;
4048 }
4049
4050 if (newc && lxcapi_is_defined(newc))
4051 lxc_container_put(newc);
4052
4053 if (!container_destroy(c, NULL)) {
4054 ERROR("Could not destroy existing container %s", c->name);
4055 return false;
4056 }
4057
4058 return true;
4059 }
4060
4061 WRAP_API_1(bool, lxcapi_rename, const char *)
4062
4063 static int lxcapi_attach(struct lxc_container *c,
4064 lxc_attach_exec_t exec_function, void *exec_payload,
4065 lxc_attach_options_t *options, pid_t *attached_process)
4066 {
4067 int ret;
4068
4069 if (!c)
4070 return -1;
4071
4072 current_config = c->lxc_conf;
4073
4074 ret = lxc_attach(c, exec_function, exec_payload, options,
4075 attached_process);
4076 current_config = NULL;
4077 return ret;
4078 }
4079
4080 static int do_lxcapi_attach_run_wait(struct lxc_container *c,
4081 lxc_attach_options_t *options,
4082 const char *program,
4083 const char *const argv[])
4084 {
4085 lxc_attach_command_t command;
4086 pid_t pid;
4087 int ret;
4088
4089 if (!c)
4090 return -1;
4091
4092 command.program = (char *)program;
4093 command.argv = (char **)argv;
4094
4095 ret = lxc_attach(c, lxc_attach_run_command, &command, options, &pid);
4096 if (ret < 0)
4097 return ret;
4098
4099 return lxc_wait_for_pid_status(pid);
4100 }
4101
4102 static int lxcapi_attach_run_wait(struct lxc_container *c,
4103 lxc_attach_options_t *options,
4104 const char *program, const char *const argv[])
4105 {
4106 int ret;
4107
4108 current_config = c ? c->lxc_conf : NULL;
4109 ret = do_lxcapi_attach_run_wait(c, options, program, argv);
4110 current_config = NULL;
4111
4112 return ret;
4113 }
4114
4115 static int get_next_index(const char *lxcpath, char *cname)
4116 {
4117 __do_free char *fname = NULL;
4118 struct stat sb;
4119 int i = 0, ret;
4120
4121 fname = must_realloc(NULL, strlen(lxcpath) + 20);
4122
4123 for (;;) {
4124 sprintf(fname, "%s/snap%d", lxcpath, i);
4125
4126 ret = stat(fname, &sb);
4127 if (ret != 0)
4128 return i;
4129
4130 i++;
4131 }
4132 }
4133
4134 static bool get_snappath_dir(struct lxc_container *c, char *snappath)
4135 {
4136 int ret;
4137
4138 /*
4139 * If the old style snapshot path exists, use it
4140 * /var/lib/lxc -> /var/lib/lxcsnaps
4141 */
4142 ret = snprintf(snappath, PATH_MAX, "%ssnaps", c->config_path);
4143 if (ret < 0 || ret >= PATH_MAX)
4144 return false;
4145
4146 if (dir_exists(snappath)) {
4147 ret = snprintf(snappath, PATH_MAX, "%ssnaps/%s", c->config_path, c->name);
4148 if (ret < 0 || ret >= PATH_MAX)
4149 return false;
4150
4151 return true;
4152 }
4153
4154 /*
4155 * Use the new style path
4156 * /var/lib/lxc -> /var/lib/lxc + c->name + /snaps + \0
4157 */
4158 ret = snprintf(snappath, PATH_MAX, "%s/%s/snaps", c->config_path, c->name);
4159 if (ret < 0 || ret >= PATH_MAX)
4160 return false;
4161
4162 return true;
4163 }
4164
4165 static int do_lxcapi_snapshot(struct lxc_container *c, const char *commentfile)
4166 {
4167 __do_free char *dfnam = NULL;
4168 int i, flags, ret;
4169 time_t timer;
4170 struct tm tm_info;
4171 struct lxc_container *c2;
4172 char snappath[PATH_MAX], newname[20];
4173 char buffer[25];
4174 FILE *f;
4175
4176 if (!c || !lxcapi_is_defined(c))
4177 return -1;
4178
4179 if (!storage_can_backup(c->lxc_conf)) {
4180 ERROR("%s's backing store cannot be backed up", c->name);
4181 ERROR("Your container must use another backing store type");
4182 return -1;
4183 }
4184
4185 if (!get_snappath_dir(c, snappath))
4186 return -1;
4187
4188 i = get_next_index(snappath, c->name);
4189
4190 if (mkdir_p(snappath, 0755) < 0) {
4191 ERROR("Failed to create snapshot directory %s", snappath);
4192 return -1;
4193 }
4194
4195 ret = snprintf(newname, 20, "snap%d", i);
4196 if (ret < 0 || ret >= 20)
4197 return -1;
4198
4199 /*
4200 * We pass LXC_CLONE_SNAPSHOT to make sure that a rdepends file entry is
4201 * created in the original container
4202 */
4203 flags = LXC_CLONE_SNAPSHOT | LXC_CLONE_KEEPMACADDR | LXC_CLONE_KEEPNAME |
4204 LXC_CLONE_KEEPBDEVTYPE | LXC_CLONE_MAYBE_SNAPSHOT;
4205 if (storage_is_dir(c->lxc_conf)) {
4206 ERROR("Snapshot of directory-backed container requested");
4207 ERROR("Making a copy-clone. If you do want snapshots, then");
4208 ERROR("please create overlay clone first, snapshot that");
4209 ERROR("and keep the original container pristine");
4210 flags &= ~LXC_CLONE_SNAPSHOT | LXC_CLONE_MAYBE_SNAPSHOT;
4211 }
4212
4213 c2 = do_lxcapi_clone(c, newname, snappath, flags, NULL, NULL, 0, NULL);
4214 if (!c2) {
4215 ERROR("Failed to clone of %s:%s", c->config_path, c->name);
4216 return -1;
4217 }
4218
4219 lxc_container_put(c2);
4220
4221 /* Now write down the creation time. */
4222 time(&timer);
4223
4224 if (!localtime_r(&timer, &tm_info)) {
4225 ERROR("Failed to get localtime");
4226 return -1;
4227 }
4228
4229 strftime(buffer, 25, "%Y:%m:%d %H:%M:%S", &tm_info);
4230
4231 dfnam = must_realloc(NULL, strlen(snappath) + strlen(newname) + 5);
4232 sprintf(dfnam, "%s/%s/ts", snappath, newname);
4233 f = fopen(dfnam, "w");
4234 if (!f) {
4235 ERROR("Failed to open %s", dfnam);
4236 return -1;
4237 }
4238
4239 if (fprintf(f, "%s", buffer) < 0) {
4240 SYSERROR("Writing timestamp");
4241 fclose(f);
4242 return -1;
4243 }
4244
4245 ret = fclose(f);
4246 if (ret != 0) {
4247 SYSERROR("Writing timestamp");
4248 return -1;
4249 }
4250
4251 if (commentfile) {
4252 __do_free char *path = NULL;
4253 /* $p / $name / comment \0 */
4254 int len = strlen(snappath) + strlen(newname) + 10;
4255
4256 path = must_realloc(NULL, len);
4257 sprintf(path, "%s/%s/comment", snappath, newname);
4258 return copy_file(commentfile, path) < 0 ? -1 : i;
4259 }
4260
4261 return i;
4262 }
4263
4264 WRAP_API_1(int, lxcapi_snapshot, const char *)
4265
4266 static void lxcsnap_free(struct lxc_snapshot *s)
4267 {
4268 free(s->name);
4269 free(s->comment_pathname);
4270 free(s->timestamp);
4271 free(s->lxcpath);
4272 }
4273
4274 static char *get_snapcomment_path(char* snappath, char *name)
4275 {
4276 /* $snappath/$name/comment */
4277 int ret, len = strlen(snappath) + strlen(name) + 10;
4278 char *s = malloc(len);
4279
4280 if (s) {
4281 ret = snprintf(s, len, "%s/%s/comment", snappath, name);
4282 if (ret < 0 || ret >= len) {
4283 free(s);
4284 s = NULL;
4285 }
4286 }
4287
4288 return s;
4289 }
4290
4291 static char *get_timestamp(char* snappath, char *name)
4292 {
4293 char path[PATH_MAX], *s = NULL;
4294 int ret, len;
4295 FILE *fin;
4296
4297 ret = snprintf(path, PATH_MAX, "%s/%s/ts", snappath, name);
4298 if (ret < 0 || ret >= PATH_MAX)
4299 return NULL;
4300
4301 fin = fopen(path, "r");
4302 if (!fin)
4303 return NULL;
4304
4305 (void) fseek(fin, 0, SEEK_END);
4306 len = ftell(fin);
4307 (void) fseek(fin, 0, SEEK_SET);
4308 if (len > 0) {
4309 s = malloc(len+1);
4310 if (s) {
4311 s[len] = '\0';
4312 if (fread(s, 1, len, fin) != len) {
4313 SYSERROR("reading timestamp");
4314 free(s);
4315 s = NULL;
4316 }
4317 }
4318 }
4319
4320 fclose(fin);
4321 return s;
4322 }
4323
4324 static int do_lxcapi_snapshot_list(struct lxc_container *c, struct lxc_snapshot **ret_snaps)
4325 {
4326 char snappath[PATH_MAX], path2[PATH_MAX];
4327 int count = 0, ret;
4328 struct dirent *direntp;
4329 struct lxc_snapshot *snaps =NULL, *nsnaps;
4330 DIR *dir;
4331
4332 if (!c || !lxcapi_is_defined(c))
4333 return -1;
4334
4335 if (!get_snappath_dir(c, snappath)) {
4336 ERROR("path name too long");
4337 return -1;
4338 }
4339
4340 dir = opendir(snappath);
4341 if (!dir) {
4342 INFO("Failed to open %s - assuming no snapshots", snappath);
4343 return 0;
4344 }
4345
4346 while ((direntp = readdir(dir))) {
4347 if (!strcmp(direntp->d_name, "."))
4348 continue;
4349
4350 if (!strcmp(direntp->d_name, ".."))
4351 continue;
4352
4353 ret = snprintf(path2, PATH_MAX, "%s/%s/config", snappath, direntp->d_name);
4354 if (ret < 0 || ret >= PATH_MAX) {
4355 ERROR("pathname too long");
4356 goto out_free;
4357 }
4358
4359 if (!file_exists(path2))
4360 continue;
4361
4362 nsnaps = realloc(snaps, (count + 1)*sizeof(*snaps));
4363 if (!nsnaps) {
4364 SYSERROR("Out of memory");
4365 goto out_free;
4366 }
4367
4368 snaps = nsnaps;
4369 snaps[count].free = lxcsnap_free;
4370 snaps[count].name = strdup(direntp->d_name);
4371 if (!snaps[count].name)
4372 goto out_free;
4373
4374 snaps[count].lxcpath = strdup(snappath);
4375 if (!snaps[count].lxcpath) {
4376 free(snaps[count].name);
4377 goto out_free;
4378 }
4379
4380 snaps[count].comment_pathname = get_snapcomment_path(snappath, direntp->d_name);
4381 snaps[count].timestamp = get_timestamp(snappath, direntp->d_name);
4382 count++;
4383 }
4384
4385 if (closedir(dir))
4386 WARN("Failed to close directory");
4387
4388 *ret_snaps = snaps;
4389 return count;
4390
4391 out_free:
4392 if (snaps) {
4393 int i;
4394
4395 for (i=0; i<count; i++)
4396 lxcsnap_free(&snaps[i]);
4397
4398 free(snaps);
4399 }
4400
4401 if (closedir(dir))
4402 WARN("Failed to close directory");
4403
4404 return -1;
4405 }
4406
4407 WRAP_API_1(int, lxcapi_snapshot_list, struct lxc_snapshot **)
4408
4409 static bool do_lxcapi_snapshot_restore(struct lxc_container *c, const char *snapname, const char *newname)
4410 {
4411 char clonelxcpath[PATH_MAX];
4412 int flags = 0;
4413 struct lxc_container *snap, *rest;
4414 struct lxc_storage *bdev;
4415 bool b = false;
4416
4417 if (!c || !c->name || !c->config_path)
4418 return false;
4419
4420 if (has_fs_snapshots(c)) {
4421 ERROR("container rootfs has dependent snapshots");
4422 return false;
4423 }
4424
4425 bdev = storage_init(c->lxc_conf);
4426 if (!bdev) {
4427 ERROR("Failed to find original backing store type");
4428 return false;
4429 }
4430
4431 /* For an overlay container the rootfs is considered immutable
4432 * and cannot be removed when restoring from a snapshot. We pass this
4433 * internal flag along to communicate this to various parts of the
4434 * codebase.
4435 */
4436 if (!strcmp(bdev->type, "overlay") || !strcmp(bdev->type, "overlayfs"))
4437 bdev->flags |= LXC_STORAGE_INTERNAL_OVERLAY_RESTORE;
4438
4439 if (!newname)
4440 newname = c->name;
4441
4442 if (!get_snappath_dir(c, clonelxcpath)) {
4443 storage_put(bdev);
4444 return false;
4445 }
4446 /* how should we lock this? */
4447
4448 snap = lxc_container_new(snapname, clonelxcpath);
4449 if (!snap || !lxcapi_is_defined(snap)) {
4450 ERROR("Could not open snapshot %s", snapname);
4451
4452 if (snap)
4453 lxc_container_put(snap);
4454
4455 storage_put(bdev);
4456 return false;
4457 }
4458
4459 if (!strcmp(c->name, newname)) {
4460 if (!container_destroy(c, bdev)) {
4461 ERROR("Could not destroy existing container %s", newname);
4462 lxc_container_put(snap);
4463 storage_put(bdev);
4464 return false;
4465 }
4466 }
4467
4468 if (strcmp(bdev->type, "dir") != 0 && strcmp(bdev->type, "loop") != 0)
4469 flags = LXC_CLONE_SNAPSHOT | LXC_CLONE_MAYBE_SNAPSHOT;
4470
4471 if (!strcmp(bdev->type, "overlay") || !strcmp(bdev->type, "overlayfs"))
4472 flags |= LXC_STORAGE_INTERNAL_OVERLAY_RESTORE;
4473
4474 rest = lxcapi_clone(snap, newname, c->config_path, flags, bdev->type,
4475 NULL, 0, NULL);
4476 storage_put(bdev);
4477 if (rest && lxcapi_is_defined(rest))
4478 b = true;
4479
4480 if (rest)
4481 lxc_container_put(rest);
4482
4483 lxc_container_put(snap);
4484 return b;
4485 }
4486
4487 WRAP_API_2(bool, lxcapi_snapshot_restore, const char *, const char *)
4488
4489 static bool do_snapshot_destroy(const char *snapname, const char *clonelxcpath)
4490 {
4491 struct lxc_container *snap = NULL;
4492 bool bret = false;
4493
4494 snap = lxc_container_new(snapname, clonelxcpath);
4495 if (!snap) {
4496 ERROR("Could not find snapshot %s", snapname);
4497 goto err;
4498 }
4499
4500 if (!do_lxcapi_destroy(snap)) {
4501 ERROR("Could not destroy snapshot %s", snapname);
4502 goto err;
4503 }
4504
4505 bret = true;
4506
4507 err:
4508 if (snap)
4509 lxc_container_put(snap);
4510
4511 return bret;
4512 }
4513
4514 static bool remove_all_snapshots(const char *path)
4515 {
4516 DIR *dir;
4517 struct dirent *direntp;
4518 bool bret = true;
4519
4520 dir = opendir(path);
4521 if (!dir) {
4522 SYSERROR("opendir on snapshot path %s", path);
4523 return false;
4524 }
4525
4526 while ((direntp = readdir(dir))) {
4527 if (!strcmp(direntp->d_name, "."))
4528 continue;
4529
4530 if (!strcmp(direntp->d_name, ".."))
4531 continue;
4532
4533 if (!do_snapshot_destroy(direntp->d_name, path)) {
4534 bret = false;
4535 continue;
4536 }
4537 }
4538
4539 closedir(dir);
4540
4541 if (rmdir(path))
4542 SYSERROR("Error removing directory %s", path);
4543
4544 return bret;
4545 }
4546
4547 static bool do_lxcapi_snapshot_destroy(struct lxc_container *c, const char *snapname)
4548 {
4549 char clonelxcpath[PATH_MAX];
4550
4551 if (!c || !c->name || !c->config_path || !snapname)
4552 return false;
4553
4554 if (!get_snappath_dir(c, clonelxcpath))
4555 return false;
4556
4557 return do_snapshot_destroy(snapname, clonelxcpath);
4558 }
4559
4560 WRAP_API_1(bool, lxcapi_snapshot_destroy, const char *)
4561
4562 static bool do_lxcapi_snapshot_destroy_all(struct lxc_container *c)
4563 {
4564 char clonelxcpath[PATH_MAX];
4565
4566 if (!c || !c->name || !c->config_path)
4567 return false;
4568
4569 if (!get_snappath_dir(c, clonelxcpath))
4570 return false;
4571
4572 return remove_all_snapshots(clonelxcpath);
4573 }
4574
4575 WRAP_API(bool, lxcapi_snapshot_destroy_all)
4576
4577 static bool do_lxcapi_may_control(struct lxc_container *c)
4578 {
4579 if (!c)
4580 return false;
4581
4582 return lxc_try_cmd(c->name, c->config_path) == 0;
4583 }
4584
4585 WRAP_API(bool, lxcapi_may_control)
4586
4587 static bool do_add_remove_node(pid_t init_pid, const char *path, bool add,
4588 struct stat *st)
4589 {
4590 int ret;
4591 char *tmp;
4592 pid_t pid;
4593 char chrootpath[PATH_MAX];
4594 char *directory_path = NULL;
4595
4596 pid = fork();
4597 if (pid < 0) {
4598 SYSERROR("Failed to fork()");
4599 return false;
4600 }
4601
4602 if (pid) {
4603 ret = wait_for_pid(pid);
4604 if (ret != 0) {
4605 ERROR("Failed to create device node");
4606 return false;
4607 }
4608
4609 return true;
4610 }
4611
4612 /* prepare the path */
4613 ret = snprintf(chrootpath, PATH_MAX, "/proc/%d/root", init_pid);
4614 if (ret < 0 || ret >= PATH_MAX)
4615 return false;
4616
4617 ret = chroot(chrootpath);
4618 if (ret < 0)
4619 _exit(EXIT_FAILURE);
4620
4621 ret = chdir("/");
4622 if (ret < 0)
4623 _exit(EXIT_FAILURE);
4624
4625 /* remove path if it exists */
4626 ret = faccessat(AT_FDCWD, path, F_OK, AT_SYMLINK_NOFOLLOW);
4627 if(ret == 0) {
4628 ret = unlink(path);
4629 if (ret < 0) {
4630 SYSERROR("Failed to remove \"%s\"", path);
4631 _exit(EXIT_FAILURE);
4632 }
4633 }
4634
4635 if (!add)
4636 _exit(EXIT_SUCCESS);
4637
4638 /* create any missing directories */
4639 tmp = strdup(path);
4640 if (!tmp)
4641 _exit(EXIT_FAILURE);
4642
4643 directory_path = dirname(tmp);
4644 ret = mkdir_p(directory_path, 0755);
4645 if (ret < 0 && errno != EEXIST) {
4646 SYSERROR("Failed to create path \"%s\"", directory_path);
4647 free(tmp);
4648 _exit(EXIT_FAILURE);
4649 }
4650
4651 /* create the device node */
4652 ret = mknod(path, st->st_mode, st->st_rdev);
4653 free(tmp);
4654 if (ret < 0) {
4655 SYSERROR("Failed to create device node at \"%s\"", path);
4656 _exit(EXIT_FAILURE);
4657 }
4658
4659 _exit(EXIT_SUCCESS);
4660 }
4661
4662 static bool add_remove_device_node(struct lxc_container *c, const char *src_path, const char *dest_path, bool add)
4663 {
4664 int ret;
4665 struct stat st;
4666 char value[LXC_MAX_BUFFER];
4667 const char *p;
4668 pid_t init_pid;
4669
4670 /* make sure container is running */
4671 if (!do_lxcapi_is_running(c)) {
4672 ERROR("container is not running");
4673 return false;
4674 }
4675
4676 /* use src_path if dest_path is NULL otherwise use dest_path */
4677 p = dest_path ? dest_path : src_path;
4678
4679 /* make sure we can access p */
4680 if(access(p, F_OK) < 0 || stat(p, &st) < 0)
4681 return false;
4682
4683 /* continue if path is character device or block device */
4684 if (S_ISCHR(st.st_mode))
4685 ret = snprintf(value, LXC_MAX_BUFFER, "c %d:%d rwm", major(st.st_rdev), minor(st.st_rdev));
4686 else if (S_ISBLK(st.st_mode))
4687 ret = snprintf(value, LXC_MAX_BUFFER, "b %d:%d rwm", major(st.st_rdev), minor(st.st_rdev));
4688 else
4689 return false;
4690
4691 /* check snprintf return code */
4692 if (ret < 0 || ret >= LXC_MAX_BUFFER)
4693 return false;
4694
4695 init_pid = do_lxcapi_init_pid(c);
4696 if (init_pid < 0) {
4697 ERROR("Failed to get init pid");
4698 return false;
4699 }
4700
4701 if (!do_add_remove_node(init_pid, p, add, &st))
4702 return false;
4703
4704 /* add or remove device to/from cgroup access list */
4705 if (add) {
4706 if (!do_lxcapi_set_cgroup_item(c, "devices.allow", value)) {
4707 ERROR("set_cgroup_item failed while adding the device node");
4708 return false;
4709 }
4710 } else {
4711 if (!do_lxcapi_set_cgroup_item(c, "devices.deny", value)) {
4712 ERROR("set_cgroup_item failed while removing the device node");
4713 return false;
4714 }
4715 }
4716
4717 return true;
4718 }
4719
4720 static bool do_lxcapi_add_device_node(struct lxc_container *c, const char *src_path, const char *dest_path)
4721 {
4722 // cannot mknod if we're not privileged wrt init_user_ns
4723 if (am_host_unpriv()) {
4724 ERROR(LXC_UNPRIV_EOPNOTSUPP, __FUNCTION__);
4725 return false;
4726 }
4727
4728 return add_remove_device_node(c, src_path, dest_path, true);
4729 }
4730
4731 WRAP_API_2(bool, lxcapi_add_device_node, const char *, const char *)
4732
4733 static bool do_lxcapi_remove_device_node(struct lxc_container *c, const char *src_path, const char *dest_path)
4734 {
4735 if (am_guest_unpriv()) {
4736 ERROR(LXC_UNPRIV_EOPNOTSUPP, __FUNCTION__);
4737 return false;
4738 }
4739
4740 return add_remove_device_node(c, src_path, dest_path, false);
4741 }
4742
4743 WRAP_API_2(bool, lxcapi_remove_device_node, const char *, const char *)
4744
4745 static bool do_lxcapi_attach_interface(struct lxc_container *c,
4746 const char *ifname,
4747 const char *dst_ifname)
4748 {
4749 pid_t init_pid;
4750 int ret = 0;
4751
4752 if (am_guest_unpriv()) {
4753 ERROR(LXC_UNPRIV_EOPNOTSUPP, __FUNCTION__);
4754 return false;
4755 }
4756
4757 if (!ifname) {
4758 ERROR("No source interface name given");
4759 return false;
4760 }
4761
4762 ret = lxc_netdev_isup(ifname);
4763 if (ret > 0) {
4764 /* netdev of ifname is up. */
4765 ret = lxc_netdev_down(ifname);
4766 if (ret)
4767 goto err;
4768 }
4769
4770 init_pid = do_lxcapi_init_pid(c);
4771 if (init_pid < 0) {
4772 ERROR("Failed to get init pid");
4773 goto err;
4774 }
4775
4776 ret = lxc_netdev_move_by_name(ifname, init_pid, dst_ifname);
4777 if (ret)
4778 goto err;
4779
4780 INFO("Moved network device \"%s\" to network namespace of %d", ifname, init_pid);
4781 return true;
4782
4783 err:
4784 return false;
4785 }
4786
4787 WRAP_API_2(bool, lxcapi_attach_interface, const char *, const char *)
4788
4789 static bool do_lxcapi_detach_interface(struct lxc_container *c,
4790 const char *ifname,
4791 const char *dst_ifname)
4792 {
4793 int ret;
4794 pid_t pid, pid_outside;
4795
4796 /*
4797 * TODO - if this is a physical device, then we need am_host_unpriv.
4798 * But for other types guest privilege suffices.
4799 */
4800 if (am_guest_unpriv()) {
4801 ERROR(LXC_UNPRIV_EOPNOTSUPP, __FUNCTION__);
4802 return false;
4803 }
4804
4805 if (!ifname) {
4806 ERROR("No source interface name given");
4807 return false;
4808 }
4809
4810 pid_outside = lxc_raw_getpid();
4811 pid = fork();
4812 if (pid < 0) {
4813 ERROR("Failed to fork");
4814 return false;
4815 }
4816
4817 if (pid == 0) { /* child */
4818 pid_t init_pid;
4819
4820 init_pid = do_lxcapi_init_pid(c);
4821 if (init_pid < 0) {
4822 ERROR("Failed to get init pid");
4823 _exit(EXIT_FAILURE);
4824 }
4825 if (!switch_to_ns(init_pid, "net")) {
4826 ERROR("Failed to enter network namespace");
4827 _exit(EXIT_FAILURE);
4828 }
4829
4830 ret = lxc_netdev_isup(ifname);
4831 if (ret < 0) {
4832 ERROR("Failed to determine whether network device \"%s\" is up", ifname);
4833 _exit(EXIT_FAILURE);
4834 }
4835
4836 /* netdev of ifname is up. */
4837 if (ret) {
4838 ret = lxc_netdev_down(ifname);
4839 if (ret) {
4840 ERROR("Failed to set network device \"%s\" down", ifname);
4841 _exit(EXIT_FAILURE);
4842 }
4843 }
4844
4845 ret = lxc_netdev_move_by_name(ifname, pid_outside, dst_ifname);
4846 /* -EINVAL means there is no netdev named as ifname. */
4847 if (ret < 0) {
4848 if (ret == -EINVAL)
4849 ERROR("Network device \"%s\" not found", ifname);
4850 else
4851 ERROR("Failed to remove network device \"%s\"", ifname);
4852
4853 _exit(EXIT_FAILURE);
4854 }
4855
4856 _exit(EXIT_SUCCESS);
4857 }
4858
4859 ret = wait_for_pid(pid);
4860 if (ret != 0)
4861 return false;
4862
4863 INFO("Moved network device \"%s\" to network namespace of %d", ifname, pid_outside);
4864 return true;
4865 }
4866
4867 WRAP_API_2(bool, lxcapi_detach_interface, const char *, const char *)
4868
4869 static int do_lxcapi_migrate(struct lxc_container *c, unsigned int cmd,
4870 struct migrate_opts *opts, unsigned int size)
4871 {
4872 int ret = -1;
4873 struct migrate_opts *valid_opts = opts;
4874 uint64_t features_to_check = 0;
4875
4876 /* If the caller has a bigger (newer) struct migrate_opts, let's make
4877 * sure that the stuff on the end is zero, i.e. that they didn't ask us
4878 * to do anything special.
4879 */
4880 if (size > sizeof(*opts)) {
4881 unsigned char *addr;
4882 unsigned char *end;
4883
4884 addr = (void *)opts + sizeof(*opts);
4885 end = (void *)opts + size;
4886
4887 for (; addr < end; addr++)
4888 if (*addr)
4889 return -E2BIG;
4890 }
4891
4892 /* If the caller has a smaller struct, let's zero out the end for them
4893 * so we don't accidentally use bits of it that they didn't know about
4894 * to initialize.
4895 */
4896 if (size < sizeof(*opts)) {
4897 valid_opts = malloc(sizeof(*opts));
4898 if (!valid_opts)
4899 return -ENOMEM;
4900
4901 memset(valid_opts, 0, sizeof(*opts));
4902 memcpy(valid_opts, opts, size);
4903 }
4904
4905 switch (cmd) {
4906 case MIGRATE_PRE_DUMP:
4907 if (!do_lxcapi_is_running(c)) {
4908 ERROR("container is not running");
4909 goto on_error;
4910 }
4911
4912 ret = !__criu_pre_dump(c, valid_opts);
4913 break;
4914 case MIGRATE_DUMP:
4915 if (!do_lxcapi_is_running(c)) {
4916 ERROR("container is not running");
4917 goto on_error;
4918 }
4919
4920 ret = !__criu_dump(c, valid_opts);
4921 break;
4922 case MIGRATE_RESTORE:
4923 if (do_lxcapi_is_running(c)) {
4924 ERROR("container is already running");
4925 goto on_error;
4926 }
4927
4928 ret = !__criu_restore(c, valid_opts);
4929 break;
4930 case MIGRATE_FEATURE_CHECK:
4931 features_to_check = valid_opts->features_to_check;
4932 ret = !__criu_check_feature(&features_to_check);
4933 if (ret) {
4934 /* Something went wrong. Let's let the caller
4935 * know which feature checks failed. */
4936 valid_opts->features_to_check = features_to_check;
4937 }
4938 break;
4939 default:
4940 ERROR("invalid migrate command %u", cmd);
4941 ret = -EINVAL;
4942 }
4943
4944 on_error:
4945 if (size < sizeof(*opts))
4946 free(valid_opts);
4947
4948 return ret;
4949 }
4950
4951 WRAP_API_3(int, lxcapi_migrate, unsigned int, struct migrate_opts *, unsigned int)
4952
4953 static bool do_lxcapi_checkpoint(struct lxc_container *c, char *directory, bool stop, bool verbose)
4954 {
4955 struct migrate_opts opts;
4956
4957 memset(&opts, 0, sizeof(opts));
4958
4959 opts.directory = directory;
4960 opts.stop = stop;
4961 opts.verbose = verbose;
4962
4963 return !do_lxcapi_migrate(c, MIGRATE_DUMP, &opts, sizeof(opts));
4964 }
4965
4966 WRAP_API_3(bool, lxcapi_checkpoint, char *, bool, bool)
4967
4968 static bool do_lxcapi_restore(struct lxc_container *c, char *directory, bool verbose)
4969 {
4970 struct migrate_opts opts;
4971
4972 memset(&opts, 0, sizeof(opts));
4973
4974 opts.directory = directory;
4975 opts.verbose = verbose;
4976
4977 return !do_lxcapi_migrate(c, MIGRATE_RESTORE, &opts, sizeof(opts));
4978 }
4979
4980 WRAP_API_2(bool, lxcapi_restore, char *, bool)
4981
4982 /* @st_mode is the st_mode field of the stat(source) return struct */
4983 static int create_mount_target(const char *dest, mode_t st_mode)
4984 {
4985 char *dirdup, *destdirname;
4986 int ret;
4987
4988 dirdup = strdup(dest);
4989 if (!dirdup) {
4990 SYSERROR("Failed to duplicate target name \"%s\"", dest);
4991 return -1;
4992 }
4993 destdirname = dirname(dirdup);
4994
4995 ret = mkdir_p(destdirname, 0755);
4996 if (ret < 0) {
4997 SYSERROR("Failed to create \"%s\"", destdirname);
4998 free(dirdup);
4999 return ret;
5000 }
5001 free(dirdup);
5002
5003 (void)remove(dest);
5004
5005 if (S_ISDIR(st_mode))
5006 ret = mkdir(dest, 0000);
5007 else
5008 ret = mknod(dest, S_IFREG | 0000, 0);
5009
5010 if (ret == 0)
5011 TRACE("Created mount target \"%s\"", dest);
5012 else if (ret < 0 && errno != EEXIST) {
5013 SYSERROR("Failed to create mount target \"%s\"", dest);
5014 return -1;
5015 }
5016
5017 return 0;
5018 }
5019
5020 static int do_lxcapi_mount(struct lxc_container *c, const char *source,
5021 const char *target, const char *filesystemtype,
5022 unsigned long mountflags, const void *data,
5023 struct lxc_mount *mnt)
5024 {
5025 char *suff, *sret;
5026 char template[PATH_MAX], path[PATH_MAX];
5027 pid_t pid, init_pid;
5028 struct stat sb;
5029 bool is_dir;
5030 int ret = -1, fd = -EBADF;
5031
5032 if (!c || !c->lxc_conf) {
5033 ERROR("Container or configuration is NULL");
5034 return -EINVAL;
5035 }
5036
5037 if (!c->lxc_conf->shmount.path_host) {
5038 ERROR("Host path to shared mountpoint must be specified in the config\n");
5039 return -EINVAL;
5040 }
5041
5042 ret = snprintf(template, sizeof(template), "%s/.lxcmount_XXXXXX", c->lxc_conf->shmount.path_host);
5043 if (ret < 0 || (size_t)ret >= sizeof(template)) {
5044 SYSERROR("Error writing shmounts tempdir name");
5045 goto out;
5046 }
5047
5048 /* Create a temporary file / dir under the shared mountpoint */
5049 if (!source || strcmp(source, "") == 0) {
5050 /* If source is not specified, maybe we want to mount a filesystem? */
5051 sb.st_mode = S_IFDIR;
5052 } else {
5053 ret = stat(source, &sb);
5054 if (ret < 0) {
5055 SYSERROR("Error getting stat info about the source \"%s\"", source);
5056 goto out;
5057 }
5058 }
5059
5060 is_dir = (S_ISDIR(sb.st_mode) != 0);
5061 if (is_dir) {
5062 sret = mkdtemp(template);
5063 if (!sret) {
5064 SYSERROR("Could not create shmounts temporary dir");
5065 goto out;
5066 }
5067 } else {
5068 fd = lxc_make_tmpfile(template, false);
5069 if (fd < 0) {
5070 SYSERROR("Could not create shmounts temporary file");
5071 goto out;
5072 }
5073 }
5074
5075 /* Do the fork */
5076 pid = fork();
5077 if (pid < 0) {
5078 SYSERROR("Could not fork");
5079 goto out;
5080 }
5081
5082 if (pid == 0) {
5083 /* Do the mount */
5084 ret = mount(source, template, filesystemtype, mountflags, data);
5085 if (ret < 0) {
5086 SYSERROR("Failed to mount onto \"%s\"", template);
5087 _exit(EXIT_FAILURE);
5088 }
5089 TRACE("Mounted \"%s\" onto \"%s\"", source, template);
5090
5091 init_pid = do_lxcapi_init_pid(c);
5092 if (init_pid < 0) {
5093 ERROR("Failed to obtain container's init pid");
5094 _exit(EXIT_FAILURE);
5095 }
5096
5097 /* Enter the container namespaces */
5098 if (!lxc_list_empty(&c->lxc_conf->id_map)) {
5099 if (!switch_to_ns(init_pid, "user")) {
5100 ERROR("Failed to enter user namespace");
5101 _exit(EXIT_FAILURE);
5102 }
5103
5104 if (!lxc_switch_uid_gid(0, 0))
5105 _exit(EXIT_FAILURE);
5106 }
5107
5108 if (!switch_to_ns(init_pid, "mnt")) {
5109 ERROR("Failed to enter mount namespace");
5110 _exit(EXIT_FAILURE);
5111 }
5112
5113 ret = create_mount_target(target, sb.st_mode);
5114 if (ret < 0)
5115 _exit(EXIT_FAILURE);
5116
5117 suff = strrchr(template, '/');
5118 if (!suff)
5119 _exit(EXIT_FAILURE);
5120
5121 ret = snprintf(path, sizeof(path), "%s%s", c->lxc_conf->shmount.path_cont, suff);
5122 if (ret < 0 || (size_t)ret >= sizeof(path)) {
5123 SYSERROR("Error writing container mountpoint name");
5124 _exit(EXIT_FAILURE);
5125 }
5126
5127 ret = mount(path, target, NULL, MS_MOVE | MS_REC, NULL);
5128 if (ret < 0) {
5129 SYSERROR("Failed to move the mount from \"%s\" to \"%s\"", path, target);
5130 _exit(EXIT_FAILURE);
5131 }
5132 TRACE("Moved mount from \"%s\" to \"%s\"", path, target);
5133
5134 _exit(EXIT_SUCCESS);
5135 }
5136
5137 ret = wait_for_pid(pid);
5138 if (ret < 0) {
5139 SYSERROR("Wait for the child with pid %ld failed", (long) pid);
5140 goto out;
5141 }
5142
5143 ret = 0;
5144
5145 (void)umount2(template, MNT_DETACH);
5146 if (is_dir)
5147 (void)rmdir(template);
5148 else
5149 (void)unlink(template);
5150
5151 out:
5152 if (fd >= 0)
5153 close(fd);
5154
5155 return ret;
5156 }
5157
5158 WRAP_API_6(int, lxcapi_mount, const char *, const char *, const char *,
5159 unsigned long, const void *, struct lxc_mount *)
5160
5161 static int do_lxcapi_umount(struct lxc_container *c, const char *target,
5162 unsigned long flags, struct lxc_mount *mnt)
5163 {
5164 pid_t pid, init_pid;
5165 int ret = -1;
5166
5167 if (!c || !c->lxc_conf) {
5168 ERROR("Container or configuration is NULL");
5169 return -EINVAL;
5170 }
5171
5172 /* Do the fork */
5173 pid = fork();
5174 if (pid < 0) {
5175 SYSERROR("Could not fork");
5176 return -1;
5177 }
5178
5179 if (pid == 0) {
5180 init_pid = do_lxcapi_init_pid(c);
5181 if (init_pid < 0) {
5182 ERROR("Failed to obtain container's init pid");
5183 _exit(EXIT_FAILURE);
5184 }
5185
5186 /* Enter the container namespaces */
5187 if (!lxc_list_empty(&c->lxc_conf->id_map)) {
5188 if (!switch_to_ns(init_pid, "user")) {
5189 ERROR("Failed to enter user namespace");
5190 _exit(EXIT_FAILURE);
5191 }
5192 }
5193
5194 if (!switch_to_ns(init_pid, "mnt")) {
5195 ERROR("Failed to enter mount namespace");
5196 _exit(EXIT_FAILURE);
5197 }
5198
5199 /* Do the unmount */
5200 ret = umount2(target, flags);
5201 if (ret < 0) {
5202 SYSERROR("Failed to umount \"%s\"", target);
5203 _exit(EXIT_FAILURE);
5204 }
5205
5206 _exit(EXIT_SUCCESS);
5207 }
5208
5209 ret = wait_for_pid(pid);
5210 if (ret < 0) {
5211 SYSERROR("Wait for the child with pid %ld failed", (long)pid);
5212 return -ret;
5213 }
5214
5215 return 0;
5216 }
5217
5218 WRAP_API_3(int, lxcapi_umount, const char *, unsigned long, struct lxc_mount*)
5219
5220 static int lxcapi_attach_run_waitl(struct lxc_container *c, lxc_attach_options_t *options, const char *program, const char *arg, ...)
5221 {
5222 va_list ap;
5223 const char **argv;
5224 int ret;
5225
5226 if (!c)
5227 return -1;
5228
5229 current_config = c->lxc_conf;
5230
5231 va_start(ap, arg);
5232 argv = lxc_va_arg_list_to_argv_const(ap, 1);
5233 va_end(ap);
5234
5235 if (!argv) {
5236 ERROR("Memory allocation error.");
5237 ret = -1;
5238 goto out;
5239 }
5240 argv[0] = arg;
5241
5242 ret = do_lxcapi_attach_run_wait(c, options, program, (const char * const *)argv);
5243 free((void*)argv);
5244
5245 out:
5246 current_config = NULL;
5247 return ret;
5248 }
5249
5250 static int do_lxcapi_seccomp_notify(struct lxc_container *c, unsigned int cmd, int fd)
5251 {
5252 if (!c || !c->lxc_conf)
5253 return minus_one_set_errno(-EINVAL);
5254
5255 switch (cmd) {
5256 case LXC_SECCOMP_NOTIFY_GET_FD:
5257 if (fd)
5258 return minus_one_set_errno(EINVAL);
5259
5260 return lxc_seccomp_get_notify_fd(&c->lxc_conf->seccomp);
5261 }
5262
5263 return minus_one_set_errno(EINVAL);
5264 }
5265
5266 WRAP_API_2(int, lxcapi_seccomp_notify, unsigned int, int)
5267
5268 struct lxc_container *lxc_container_new(const char *name, const char *configpath)
5269 {
5270 struct lxc_container *c;
5271 size_t len;
5272 int rc;
5273
5274 if (!name)
5275 return NULL;
5276
5277 c = malloc(sizeof(*c));
5278 if (!c) {
5279 fprintf(stderr, "Failed to allocate memory for %s\n", name);
5280 return NULL;
5281 }
5282 memset(c, 0, sizeof(*c));
5283
5284 if (configpath)
5285 c->config_path = strdup(configpath);
5286 else
5287 c->config_path = strdup(lxc_global_config_value("lxc.lxcpath"));
5288 if (!c->config_path) {
5289 fprintf(stderr, "Failed to allocate memory for %s\n", name);
5290 goto err;
5291 }
5292
5293 remove_trailing_slashes(c->config_path);
5294
5295 len = strlen(name);
5296 c->name = malloc(len + 1);
5297 if (!c->name) {
5298 fprintf(stderr, "Failed to allocate memory for %s\n", name);
5299 goto err;
5300 }
5301 (void)strlcpy(c->name, name, len + 1);
5302
5303 c->numthreads = 1;
5304 c->slock = lxc_newlock(c->config_path, name);
5305 if (!c->slock) {
5306 fprintf(stderr, "Failed to create lock for %s\n", name);
5307 goto err;
5308 }
5309
5310 c->privlock = lxc_newlock(NULL, NULL);
5311 if (!c->privlock) {
5312 fprintf(stderr, "Failed to create private lock for %s\n", name);
5313 goto err;
5314 }
5315
5316 if (!set_config_filename(c)) {
5317 fprintf(stderr, "Failed to create config file name for %s\n", name);
5318 goto err;
5319 }
5320
5321 if (file_exists(c->configfile) && !lxcapi_load_config(c, NULL)) {
5322 fprintf(stderr, "Failed to load config for %s\n", name);
5323 goto err;
5324 }
5325
5326 rc = ongoing_create(c);
5327 switch (rc) {
5328 case LXC_CREATE_INCOMPLETE:
5329 SYSERROR("Failed to complete container creation for %s", c->name);
5330 container_destroy(c, NULL);
5331 lxcapi_clear_config(c);
5332 break;
5333 case LXC_CREATE_ONGOING:
5334 /* container creation going on */
5335 break;
5336 case LXC_CREATE_FAILED:
5337 /* container creation failed */
5338 if (errno != EACCES && errno != EPERM) {
5339 /* insufficient privileges */
5340 SYSERROR("Failed checking for incomplete container %s creation", c->name);
5341 goto err;
5342 }
5343 break;
5344 }
5345
5346 c->daemonize = true;
5347 c->pidfile = NULL;
5348
5349 /* Assign the member functions. */
5350 c->is_defined = lxcapi_is_defined;
5351 c->state = lxcapi_state;
5352 c->is_running = lxcapi_is_running;
5353 c->freeze = lxcapi_freeze;
5354 c->unfreeze = lxcapi_unfreeze;
5355 c->console = lxcapi_console;
5356 c->console_getfd = lxcapi_console_getfd;
5357 c->init_pid = lxcapi_init_pid;
5358 c->load_config = lxcapi_load_config;
5359 c->want_daemonize = lxcapi_want_daemonize;
5360 c->want_close_all_fds = lxcapi_want_close_all_fds;
5361 c->start = lxcapi_start;
5362 c->startl = lxcapi_startl;
5363 c->stop = lxcapi_stop;
5364 c->config_file_name = lxcapi_config_file_name;
5365 c->wait = lxcapi_wait;
5366 c->set_config_item = lxcapi_set_config_item;
5367 c->destroy = lxcapi_destroy;
5368 c->destroy_with_snapshots = lxcapi_destroy_with_snapshots;
5369 c->rename = lxcapi_rename;
5370 c->save_config = lxcapi_save_config;
5371 c->get_keys = lxcapi_get_keys;
5372 c->create = lxcapi_create;
5373 c->createl = lxcapi_createl;
5374 c->shutdown = lxcapi_shutdown;
5375 c->reboot = lxcapi_reboot;
5376 c->reboot2 = lxcapi_reboot2;
5377 c->clear_config = lxcapi_clear_config;
5378 c->clear_config_item = lxcapi_clear_config_item;
5379 c->get_config_item = lxcapi_get_config_item;
5380 c->get_running_config_item = lxcapi_get_running_config_item;
5381 c->get_cgroup_item = lxcapi_get_cgroup_item;
5382 c->set_cgroup_item = lxcapi_set_cgroup_item;
5383 c->get_config_path = lxcapi_get_config_path;
5384 c->set_config_path = lxcapi_set_config_path;
5385 c->clone = lxcapi_clone;
5386 c->get_interfaces = lxcapi_get_interfaces;
5387 c->get_ips = lxcapi_get_ips;
5388 c->attach = lxcapi_attach;
5389 c->attach_run_wait = lxcapi_attach_run_wait;
5390 c->attach_run_waitl = lxcapi_attach_run_waitl;
5391 c->snapshot = lxcapi_snapshot;
5392 c->snapshot_list = lxcapi_snapshot_list;
5393 c->snapshot_restore = lxcapi_snapshot_restore;
5394 c->snapshot_destroy = lxcapi_snapshot_destroy;
5395 c->snapshot_destroy_all = lxcapi_snapshot_destroy_all;
5396 c->may_control = lxcapi_may_control;
5397 c->add_device_node = lxcapi_add_device_node;
5398 c->remove_device_node = lxcapi_remove_device_node;
5399 c->attach_interface = lxcapi_attach_interface;
5400 c->detach_interface = lxcapi_detach_interface;
5401 c->checkpoint = lxcapi_checkpoint;
5402 c->restore = lxcapi_restore;
5403 c->migrate = lxcapi_migrate;
5404 c->console_log = lxcapi_console_log;
5405 c->mount = lxcapi_mount;
5406 c->umount = lxcapi_umount;
5407 c->seccomp_notify = lxcapi_seccomp_notify;
5408
5409 return c;
5410
5411 err:
5412 lxc_container_free(c);
5413 return NULL;
5414 }
5415
5416 int lxc_get_wait_states(const char **states)
5417 {
5418 int i;
5419
5420 if (states)
5421 for (i=0; i<MAX_STATE; i++)
5422 states[i] = lxc_state2str(i);
5423
5424 return MAX_STATE;
5425 }
5426
5427 /*
5428 * These next two could probably be done smarter with reusing a common function
5429 * with different iterators and tests...
5430 */
5431 int list_defined_containers(const char *lxcpath, char ***names, struct lxc_container ***cret)
5432 {
5433 DIR *dir;
5434 int i, cfound = 0, nfound = 0;
5435 struct dirent *direntp;
5436 struct lxc_container *c;
5437
5438 if (!lxcpath)
5439 lxcpath = lxc_global_config_value("lxc.lxcpath");
5440
5441 dir = opendir(lxcpath);
5442 if (!dir) {
5443 SYSERROR("opendir on lxcpath");
5444 return -1;
5445 }
5446
5447 if (cret)
5448 *cret = NULL;
5449
5450 if (names)
5451 *names = NULL;
5452
5453 while ((direntp = readdir(dir))) {
5454 /* Ignore '.', '..' and any hidden directory. */
5455 if (!strncmp(direntp->d_name, ".", 1))
5456 continue;
5457
5458 if (!config_file_exists(lxcpath, direntp->d_name))
5459 continue;
5460
5461 if (names)
5462 if (!add_to_array(names, direntp->d_name, cfound))
5463 goto free_bad;
5464
5465 cfound++;
5466
5467 if (!cret) {
5468 nfound++;
5469 continue;
5470 }
5471
5472 c = lxc_container_new(direntp->d_name, lxcpath);
5473 if (!c) {
5474 INFO("Container %s:%s has a config but could not be loaded",
5475 lxcpath, direntp->d_name);
5476
5477 if (names)
5478 if(!remove_from_array(names, direntp->d_name, cfound--))
5479 goto free_bad;
5480
5481 continue;
5482 }
5483
5484 if (!do_lxcapi_is_defined(c)) {
5485 INFO("Container %s:%s has a config but is not defined",
5486 lxcpath, direntp->d_name);
5487
5488 if (names)
5489 if(!remove_from_array(names, direntp->d_name, cfound--))
5490 goto free_bad;
5491
5492 lxc_container_put(c);
5493 continue;
5494 }
5495
5496 if (!add_to_clist(cret, c, nfound, true)) {
5497 lxc_container_put(c);
5498 goto free_bad;
5499 }
5500
5501 nfound++;
5502 }
5503
5504 closedir(dir);
5505 return nfound;
5506
5507 free_bad:
5508 if (names && *names) {
5509 for (i=0; i<cfound; i++)
5510 free((*names)[i]);
5511 free(*names);
5512 }
5513
5514 if (cret && *cret) {
5515 for (i=0; i<nfound; i++)
5516 lxc_container_put((*cret)[i]);
5517 free(*cret);
5518 }
5519
5520 closedir(dir);
5521 return -1;
5522 }
5523
5524 int list_active_containers(const char *lxcpath, char ***nret,
5525 struct lxc_container ***cret)
5526 {
5527 int i, ret = -1, cret_cnt = 0, ct_name_cnt = 0;
5528 int lxcpath_len;
5529 char *line = NULL;
5530 char **ct_name = NULL;
5531 size_t len = 0;
5532 struct lxc_container *c = NULL;
5533 bool is_hashed;
5534
5535 if (!lxcpath)
5536 lxcpath = lxc_global_config_value("lxc.lxcpath");
5537 lxcpath_len = strlen(lxcpath);
5538
5539 if (cret)
5540 *cret = NULL;
5541
5542 if (nret)
5543 *nret = NULL;
5544
5545 FILE *f = fopen("/proc/net/unix", "r");
5546 if (!f)
5547 return -1;
5548
5549 while (getline(&line, &len, f) != -1) {
5550 char *p = strrchr(line, ' '), *p2;
5551 if (!p)
5552 continue;
5553 p++;
5554
5555 if (*p != 0x40)
5556 continue;
5557 p++;
5558
5559 is_hashed = false;
5560
5561 if (strncmp(p, lxcpath, lxcpath_len) == 0) {
5562 p += lxcpath_len;
5563 } else if (strncmp(p, "lxc/", 4) == 0) {
5564 p += 4;
5565 is_hashed = true;
5566 } else {
5567 continue;
5568 }
5569
5570 while (*p == '/')
5571 p++;
5572
5573 /* Now p is the start of lxc_name. */
5574 p2 = strchr(p, '/');
5575 if (!p2 || strncmp(p2, "/command", 8) != 0)
5576 continue;
5577 *p2 = '\0';
5578
5579 if (is_hashed) {
5580 char *recvpath = lxc_cmd_get_lxcpath(p);
5581 if (!recvpath)
5582 continue;
5583
5584 if (strncmp(lxcpath, recvpath, lxcpath_len) != 0) {
5585 free(recvpath);
5586 continue;
5587 }
5588 free(recvpath);
5589
5590 p = lxc_cmd_get_name(p);
5591 if (!p)
5592 continue;
5593 }
5594
5595 if (array_contains(&ct_name, p, ct_name_cnt)) {
5596 if (is_hashed)
5597 free(p);
5598 continue;
5599 }
5600
5601 if (!add_to_array(&ct_name, p, ct_name_cnt)) {
5602 if (is_hashed)
5603 free(p);
5604 goto free_cret_list;
5605 }
5606
5607 ct_name_cnt++;
5608
5609 if (!cret) {
5610 if (is_hashed)
5611 free(p);
5612 continue;
5613 }
5614
5615 c = lxc_container_new(p, lxcpath);
5616 if (!c) {
5617 INFO("Container %s:%s is running but could not be loaded",
5618 lxcpath, p);
5619
5620 remove_from_array(&ct_name, p, ct_name_cnt--);
5621 if (is_hashed)
5622 free(p);
5623
5624 continue;
5625 }
5626
5627 if (is_hashed)
5628 free(p);
5629
5630 /*
5631 * If this is an anonymous container, then is_defined *can*
5632 * return false. So we don't do that check. Count on the
5633 * fact that the command socket exists.
5634 */
5635
5636 if (!add_to_clist(cret, c, cret_cnt, true)) {
5637 lxc_container_put(c);
5638 goto free_cret_list;
5639 }
5640
5641 cret_cnt++;
5642 }
5643
5644 if (nret && cret && cret_cnt != ct_name_cnt) {
5645 if (c)
5646 lxc_container_put(c);
5647 goto free_cret_list;
5648 }
5649
5650 ret = ct_name_cnt;
5651 if (nret)
5652 *nret = ct_name;
5653 else
5654 goto free_ct_name;
5655
5656 goto out;
5657
5658 free_cret_list:
5659 if (cret && *cret) {
5660 for (i = 0; i < cret_cnt; i++)
5661 lxc_container_put((*cret)[i]);
5662 free(*cret);
5663 }
5664
5665 free_ct_name:
5666 if (ct_name) {
5667 for (i = 0; i < ct_name_cnt; i++)
5668 free(ct_name[i]);
5669 free(ct_name);
5670 }
5671
5672 out:
5673 free(line);
5674 fclose(f);
5675 return ret;
5676 }
5677
5678 int list_all_containers(const char *lxcpath, char ***nret,
5679 struct lxc_container ***cret)
5680 {
5681 int i, ret, active_cnt, ct_cnt, ct_list_cnt;
5682 char **active_name;
5683 char **ct_name;
5684 struct lxc_container **ct_list = NULL;
5685
5686 ct_cnt = list_defined_containers(lxcpath, &ct_name, NULL);
5687 if (ct_cnt < 0)
5688 return ct_cnt;
5689
5690 active_cnt = list_active_containers(lxcpath, &active_name, NULL);
5691 if (active_cnt < 0) {
5692 ret = active_cnt;
5693 goto free_ct_name;
5694 }
5695
5696 for (i = 0; i < active_cnt; i++) {
5697 if (!array_contains(&ct_name, active_name[i], ct_cnt)) {
5698 if (!add_to_array(&ct_name, active_name[i], ct_cnt)) {
5699 ret = -1;
5700 goto free_active_name;
5701 }
5702
5703 ct_cnt++;
5704 }
5705
5706 free(active_name[i]);
5707 active_name[i] = NULL;
5708 }
5709
5710 free(active_name);
5711 active_name = NULL;
5712 active_cnt = 0;
5713
5714 for (i = 0, ct_list_cnt = 0; i < ct_cnt && cret; i++) {
5715 struct lxc_container *c;
5716
5717 c = lxc_container_new(ct_name[i], lxcpath);
5718 if (!c) {
5719 WARN("Container %s:%s could not be loaded", lxcpath, ct_name[i]);
5720 remove_from_array(&ct_name, ct_name[i], ct_cnt--);
5721 continue;
5722 }
5723
5724 if (!add_to_clist(&ct_list, c, ct_list_cnt, false)) {
5725 lxc_container_put(c);
5726 ret = -1;
5727 goto free_ct_list;
5728 }
5729
5730 ct_list_cnt++;
5731 }
5732
5733 if (cret)
5734 *cret = ct_list;
5735
5736 if (nret) {
5737 *nret = ct_name;
5738 } else {
5739 ret = ct_cnt;
5740 goto free_ct_name;
5741 }
5742
5743 return ct_cnt;
5744
5745 free_ct_list:
5746 for (i = 0; i < ct_list_cnt; i++) {
5747 lxc_container_put(ct_list[i]);
5748 }
5749 free(ct_list);
5750
5751 free_active_name:
5752 for (i = 0; i < active_cnt; i++) {
5753 free(active_name[i]);
5754 }
5755 free(active_name);
5756
5757 free_ct_name:
5758 for (i = 0; i < ct_cnt; i++) {
5759 free(ct_name[i]);
5760 }
5761 free(ct_name);
5762 return ret;
5763 }
5764
5765 bool lxc_config_item_is_supported(const char *key)
5766 {
5767 return !!lxc_get_config(key);
5768 }
5769
5770 bool lxc_has_api_extension(const char *extension)
5771 {
5772 /* The NULL API extension is always present. :) */
5773 if (!extension)
5774 return true;
5775
5776 for (size_t i = 0; i < nr_api_extensions; i++)
5777 if (strcmp(api_extensions[i], extension) == 0)
5778 return true;
5779
5780 return false;
5781 }
LXC mirror