]> git.proxmox.com Git - mirror_lxc.git/blob - src/lxc/lxccontainer.c
projects / mirror_lxc.git / blob
? search:
summary | shortlog | log | commit | commitdiff | tree
blame | history | raw | HEAD
attach: do not reload container
[mirror_lxc.git] / src / lxc / lxccontainer.c
1 /* liblxcapi
2 *
3 * Copyright © 2012 Serge Hallyn <serge.hallyn@ubuntu.com>.
4 * Copyright © 2012 Canonical Ltd.
5 *
6 * This library is free software; you can redistribute it and/or
7 * modify it under the terms of the GNU Lesser General Public
8 * License as published by the Free Software Foundation; either
9 * version 2.1 of the License, or (at your option) any later version.
10
11 * This library is distributed in the hope that it will be useful,
12 * but WITHOUT ANY WARRANTY; without even the implied warranty of
13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
14 * Lesser General Public License for more details.
15
16 * You should have received a copy of the GNU Lesser General Public
17 * License along with this library; if not, write to the Free Software
18 * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
19 */
20
21 #ifndef _GNU_SOURCE
22 #define _GNU_SOURCE 1
23 #endif
24 #include <arpa/inet.h>
25 #include <dirent.h>
26 #include <errno.h>
27 #include <fcntl.h>
28 #include <grp.h>
29 #include <libgen.h>
30 #include <pthread.h>
31 #include <sched.h>
32 #include <stdarg.h>
33 #include <stdint.h>
34 #include <stdio.h>
35 #include <stdlib.h>
36 #include <sys/file.h>
37 #include <sys/mman.h>
38 #include <sys/mount.h>
39 #include <sys/stat.h>
40 #include <sys/syscall.h>
41 #include <sys/sysmacros.h>
42 #include <sys/types.h>
43 #include <sys/wait.h>
44 #include <unistd.h>
45
46 #include "../include/netns_ifaddrs.h"
47 #include "af_unix.h"
48 #include "api_extensions.h"
49 #include "attach.h"
50 #include "cgroup.h"
51 #include "commands.h"
52 #include "commands_utils.h"
53 #include "conf.h"
54 #include "config.h"
55 #include "confile.h"
56 #include "confile_utils.h"
57 #include "criu.h"
58 #include "error.h"
59 #include "initutils.h"
60 #include "log.h"
61 #include "lxc.h"
62 #include "lxccontainer.h"
63 #include "lxclock.h"
64 #include "memory_utils.h"
65 #include "monitor.h"
66 #include "namespace.h"
67 #include "network.h"
68 #include "parse.h"
69 #include "raw_syscalls.h"
70 #include "start.h"
71 #include "state.h"
72 #include "storage.h"
73 #include "storage/btrfs.h"
74 #include "storage/overlay.h"
75 #include "storage_utils.h"
76 #include "sync.h"
77 #include "syscall_wrappers.h"
78 #include "terminal.h"
79 #include "utils.h"
80 #include "version.h"
81
82 /* major()/minor() */
83 #ifdef MAJOR_IN_MKDEV
84 #include <sys/mkdev.h>
85 #endif
86
87 #if IS_BIONIC
88 #include <../include/lxcmntent.h>
89 #else
90 #include <mntent.h>
91 #endif
92
93 #ifndef HAVE_STRLCPY
94 #include "include/strlcpy.h"
95 #endif
96
97 /* Define faccessat() if missing from the C library */
98 #ifndef HAVE_FACCESSAT
99 static int faccessat(int __fd, const char *__file, int __type, int __flag)
100 {
101 #ifdef __NR_faccessat
102 return syscall(__NR_faccessat, __fd, __file, __type, __flag);
103 #else
104 errno = ENOSYS;
105 return -1;
106 #endif
107 }
108 #endif
109
110 lxc_log_define(lxccontainer, lxc);
111
112 static bool do_lxcapi_destroy(struct lxc_container *c);
113 static const char *lxcapi_get_config_path(struct lxc_container *c);
114 #define do_lxcapi_get_config_path(c) lxcapi_get_config_path(c)
115 static bool do_lxcapi_set_config_item(struct lxc_container *c, const char *key, const char *v);
116 static bool container_destroy(struct lxc_container *c,
117 struct lxc_storage *storage);
118 static bool get_snappath_dir(struct lxc_container *c, char *snappath);
119 static bool lxcapi_snapshot_destroy_all(struct lxc_container *c);
120 static bool do_lxcapi_save_config(struct lxc_container *c, const char *alt_file);
121
122 static bool config_file_exists(const char *lxcpath, const char *cname)
123 {
124 __do_free char *fname = NULL;
125 int ret;
126 size_t len;
127
128 /* $lxcpath + '/' + $cname + '/config' + \0 */
129 len = strlen(lxcpath) + strlen(cname) + 9;
130 fname = must_realloc(NULL, len);
131 ret = snprintf(fname, len, "%s/%s/config", lxcpath, cname);
132 if (ret < 0 || (size_t)ret >= len)
133 return false;
134
135 return file_exists(fname);
136 }
137
138 /*
139 * A few functions to help detect when a container creation failed. If a
140 * container creation was killed partway through, then trying to actually start
141 * that container could harm the host. We detect this by creating a 'partial'
142 * file under the container directory, and keeping an advisory lock. When
143 * container creation completes, we remove that file. When we load or try to
144 * start a container, if we find that file, without a flock, we remove the
145 * container.
146 */
147 enum {
148 LXC_CREATE_FAILED = -1,
149 LXC_CREATE_SUCCESS = 0,
150 LXC_CREATE_ONGOING = 1,
151 LXC_CREATE_INCOMPLETE = 2,
152 };
153
154 static int ongoing_create(struct lxc_container *c)
155 {
156 __do_close_prot_errno int fd = -EBADF;
157 __do_free char *path = NULL;
158 struct flock lk = {0};
159 int ret;
160 size_t len;
161
162 len = strlen(c->config_path) + strlen(c->name) + 10;
163 path = must_realloc(NULL, len);
164 ret = snprintf(path, len, "%s/%s/partial", c->config_path, c->name);
165 if (ret < 0 || (size_t)ret >= len)
166 return LXC_CREATE_FAILED;
167
168 fd = open(path, O_RDWR | O_CLOEXEC);
169 if (fd < 0) {
170 if (errno != ENOENT)
171 return LXC_CREATE_FAILED;
172
173 return LXC_CREATE_SUCCESS;
174 }
175
176 lk.l_type = F_WRLCK;
177 lk.l_whence = SEEK_SET;
178 /*
179 * F_OFD_GETLK requires that l_pid be set to 0 otherwise the kernel
180 * will EINVAL us.
181 */
182 lk.l_pid = 0;
183
184 ret = fcntl(fd, F_OFD_GETLK, &lk);
185 if (ret < 0 && errno == EINVAL) {
186 ret = flock(fd, LOCK_EX | LOCK_NB);
187 if (ret < 0 && errno == EWOULDBLOCK)
188 ret = 0;
189 }
190
191 /* F_OFD_GETLK will not send us back a pid so don't check it. */
192 if (ret == 0)
193 /* Create is still ongoing. */
194 return LXC_CREATE_ONGOING;
195
196 /* Create completed but partial is still there. */
197 return LXC_CREATE_INCOMPLETE;
198 }
199
200 static int create_partial(struct lxc_container *c)
201 {
202 __do_free char *path = NULL;
203 int fd, ret;
204 size_t len;
205 struct flock lk = {0};
206
207 /* $lxcpath + '/' + $name + '/partial' + \0 */
208 len = strlen(c->config_path) + strlen(c->name) + 10;
209 path = must_realloc(NULL, len);
210 ret = snprintf(path, len, "%s/%s/partial", c->config_path, c->name);
211 if (ret < 0 || (size_t)ret >= len)
212 return -1;
213
214 fd = open(path, O_RDWR | O_CREAT | O_EXCL | O_CLOEXEC, 0000);
215 if (fd < 0)
216 return -1;
217
218 lk.l_type = F_WRLCK;
219 lk.l_whence = SEEK_SET;
220
221 ret = fcntl(fd, F_OFD_SETLKW, &lk);
222 if (ret < 0) {
223 if (errno == EINVAL) {
224 ret = flock(fd, LOCK_EX);
225 if (ret == 0)
226 return fd;
227 }
228
229 SYSERROR("Failed to lock partial file %s", path);
230 close(fd);
231 return -1;
232 }
233
234 return fd;
235 }
236
237 static void remove_partial(struct lxc_container *c, int fd)
238 {
239 __do_free char *path = NULL;
240 int ret;
241 size_t len;
242
243 close(fd);
244
245 /* $lxcpath + '/' + $name + '/partial' + \0 */
246 len = strlen(c->config_path) + strlen(c->name) + 10;
247 path = must_realloc(NULL, len);
248 ret = snprintf(path, len, "%s/%s/partial", c->config_path, c->name);
249 if (ret < 0 || (size_t)ret >= len)
250 return;
251
252 ret = unlink(path);
253 if (ret < 0)
254 SYSERROR("Failed to remove partial file %s", path);
255 }
256
257 /* LOCKING
258 * 1. container_mem_lock(c) protects the struct lxc_container from multiple threads.
259 * 2. container_disk_lock(c) protects the on-disk container data - in particular the
260 * container configuration file.
261 * The container_disk_lock also takes the container_mem_lock.
262 * 3. thread_mutex protects process data (ex: fd table) from multiple threads.
263 * NOTHING mutexes two independent programs with their own struct
264 * lxc_container for the same c->name, between API calls. For instance,
265 * c->config_read(); c->start(); Between those calls, data on disk
266 * could change (which shouldn't bother the caller unless for instance
267 * the rootfs get moved). c->config_read(); update; c->config_write();
268 * Two such updaters could race. The callers should therefore check their
269 * results. Trying to prevent that would necessarily expose us to deadlocks
270 * due to hung callers. So I prefer to keep the locks only within our own
271 * functions, not across functions.
272 *
273 * If you're going to clone while holding a lxccontainer, increment
274 * c->numthreads (under privlock) before forking. When deleting,
275 * decrement numthreads under privlock, then if it hits 0 you can delete.
276 * Do not ever use a lxccontainer whose numthreads you did not bump.
277 */
278 static void lxc_container_free(struct lxc_container *c)
279 {
280 if (!c)
281 return;
282
283 free(c->configfile);
284 c->configfile = NULL;
285
286 free(c->error_string);
287 c->error_string = NULL;
288
289 if (c->slock) {
290 lxc_putlock(c->slock);
291 c->slock = NULL;
292 }
293
294 if (c->privlock) {
295 lxc_putlock(c->privlock);
296 c->privlock = NULL;
297 }
298
299 free(c->name);
300 c->name = NULL;
301
302 if (c->lxc_conf) {
303 lxc_conf_free(c->lxc_conf);
304 c->lxc_conf = NULL;
305 }
306
307 free(c->config_path);
308 c->config_path = NULL;
309
310 free(c);
311 }
312
313 /* Consider the following case:
314 *
315 * |====================================================================|
316 * | freer | racing get()er |
317 * |====================================================================|
318 * | lxc_container_put() | lxc_container_get() |
319 * | \ lxclock(c->privlock) | c->numthreads < 1? (no) |
320 * | \ c->numthreads = 0 | \ lxclock(c->privlock) -> waits |
321 * | \ lxcunlock() | \ |
322 * | \ lxc_container_free() | \ lxclock() returns |
323 * | | \ c->numthreads < 1 -> return 0 |
324 * | \ \ (free stuff) | |
325 * | \ \ sem_destroy(privlock) | |
326 * |_______________________________|____________________________________|
327 *
328 * When the get()er checks numthreads the first time, one of the following
329 * is true:
330 * 1. freer has set numthreads = 0. get() returns 0
331 * 2. freer is between lxclock and setting numthreads to 0. get()er will
332 * sem_wait on privlock, get lxclock after freer() drops it, then see
333 * numthreads is 0 and exit without touching lxclock again..
334 * 3. freer has not yet locked privlock. If get()er runs first, then put()er
335 * will see --numthreads = 1 and not call lxc_container_free().
336 */
337
338 int lxc_container_get(struct lxc_container *c)
339 {
340 if (!c)
341 return 0;
342
343 /* If someone else has already started freeing the container, don't try
344 * to take the lock, which may be invalid.
345 */
346 if (c->numthreads < 1)
347 return 0;
348
349 if (container_mem_lock(c))
350 return 0;
351
352 /* Bail without trying to unlock, bc the privlock is now probably in
353 * freed memory.
354 */
355 if (c->numthreads < 1)
356 return 0;
357
358 c->numthreads++;
359 container_mem_unlock(c);
360
361 return 1;
362 }
363
364 int lxc_container_put(struct lxc_container *c)
365 {
366 if (!c)
367 return -1;
368
369 if (container_mem_lock(c))
370 return -1;
371
372 c->numthreads--;
373
374 if (c->numthreads < 1) {
375 container_mem_unlock(c);
376 lxc_container_free(c);
377 return 1;
378 }
379
380 container_mem_unlock(c);
381 return 0;
382 }
383
384 static bool do_lxcapi_is_defined(struct lxc_container *c)
385 {
386 int statret;
387 struct stat statbuf;
388 bool ret = false;
389
390 if (!c)
391 return false;
392
393 if (container_mem_lock(c))
394 return false;
395
396 if (!c->configfile)
397 goto on_error;
398
399 statret = stat(c->configfile, &statbuf);
400 if (statret != 0)
401 goto on_error;
402
403 ret = true;
404
405 on_error:
406 container_mem_unlock(c);
407 return ret;
408 }
409
410 #define WRAP_API(rettype, fnname) \
411 static rettype fnname(struct lxc_container *c) \
412 { \
413 rettype ret; \
414 bool reset_config = false; \
415 \
416 if (!current_config && c && c->lxc_conf) { \
417 current_config = c->lxc_conf; \
418 reset_config = true; \
419 } \
420 \
421 ret = do_##fnname(c); \
422 if (reset_config) \
423 current_config = NULL; \
424 \
425 return ret; \
426 }
427
428 #define WRAP_API_1(rettype, fnname, t1) \
429 static rettype fnname(struct lxc_container *c, t1 a1) \
430 { \
431 rettype ret; \
432 bool reset_config = false; \
433 \
434 if (!current_config && c && c->lxc_conf) { \
435 current_config = c->lxc_conf; \
436 reset_config = true; \
437 } \
438 \
439 ret = do_##fnname(c, a1); \
440 if (reset_config) \
441 current_config = NULL; \
442 \
443 return ret; \
444 }
445
446 #define WRAP_API_2(rettype, fnname, t1, t2) \
447 static rettype fnname(struct lxc_container *c, t1 a1, t2 a2) \
448 { \
449 rettype ret; \
450 bool reset_config = false; \
451 \
452 if (!current_config && c && c->lxc_conf) { \
453 current_config = c->lxc_conf; \
454 reset_config = true; \
455 } \
456 \
457 ret = do_##fnname(c, a1, a2); \
458 if (reset_config) \
459 current_config = NULL; \
460 \
461 return ret; \
462 }
463
464 #define WRAP_API_3(rettype, fnname, t1, t2, t3) \
465 static rettype fnname(struct lxc_container *c, t1 a1, t2 a2, t3 a3) \
466 { \
467 rettype ret; \
468 bool reset_config = false; \
469 \
470 if (!current_config && c && c->lxc_conf) { \
471 current_config = c->lxc_conf; \
472 reset_config = true; \
473 } \
474 \
475 ret = do_##fnname(c, a1, a2, a3); \
476 if (reset_config) \
477 current_config = NULL; \
478 \
479 return ret; \
480 }
481
482 #define WRAP_API_6(rettype, fnname, t1, t2, t3, t4, t5, t6) \
483 static rettype fnname(struct lxc_container *c, t1 a1, t2 a2, t3 a3, \
484 t4 a4, t5 a5, t6 a6) \
485 { \
486 rettype ret; \
487 bool reset_config = false; \
488 \
489 if (!current_config && c && c->lxc_conf) { \
490 current_config = c->lxc_conf; \
491 reset_config = true; \
492 } \
493 \
494 ret = do_##fnname(c, a1, a2, a3, a4, a5, a6); \
495 if (reset_config) \
496 current_config = NULL; \
497 \
498 return ret; \
499 }
500
501 WRAP_API(bool, lxcapi_is_defined)
502
503 static const char *do_lxcapi_state(struct lxc_container *c)
504 {
505 lxc_state_t s;
506
507 if (!c)
508 return NULL;
509
510 s = lxc_getstate(c->name, c->config_path);
511 return lxc_state2str(s);
512 }
513
514 WRAP_API(const char *, lxcapi_state)
515
516 static bool is_stopped(struct lxc_container *c)
517 {
518 lxc_state_t s;
519
520 s = lxc_getstate(c->name, c->config_path);
521 return (s == STOPPED);
522 }
523
524 static bool do_lxcapi_is_running(struct lxc_container *c)
525 {
526 if (!c)
527 return false;
528
529 return !is_stopped(c);
530 }
531
532 WRAP_API(bool, lxcapi_is_running)
533
534 static bool do_lxcapi_freeze(struct lxc_container *c)
535 {
536 lxc_state_t s;
537
538 if (!c || !c->lxc_conf)
539 return false;
540
541 s = lxc_getstate(c->name, c->config_path);
542 if (s != FROZEN)
543 return lxc_freeze(c->lxc_conf, c->name, c->config_path) == 0;
544
545 return true;
546 }
547
548 WRAP_API(bool, lxcapi_freeze)
549
550 static bool do_lxcapi_unfreeze(struct lxc_container *c)
551 {
552 lxc_state_t s;
553
554 if (!c || !c->lxc_conf)
555 return false;
556
557 s = lxc_getstate(c->name, c->config_path);
558 if (s == FROZEN)
559 return lxc_unfreeze(c->lxc_conf, c->name, c->config_path) == 0;
560
561 return true;
562 }
563
564 WRAP_API(bool, lxcapi_unfreeze)
565
566 static int do_lxcapi_console_getfd(struct lxc_container *c, int *ttynum, int *masterfd)
567 {
568 if (!c)
569 return -1;
570
571 return lxc_terminal_getfd(c, ttynum, masterfd);
572 }
573
574 WRAP_API_2(int, lxcapi_console_getfd, int *, int *)
575
576 static int lxcapi_console(struct lxc_container *c, int ttynum, int stdinfd,
577 int stdoutfd, int stderrfd, int escape)
578 {
579 int ret;
580
581 if (!c)
582 return -1;
583
584 current_config = c->lxc_conf;
585 ret = lxc_console(c, ttynum, stdinfd, stdoutfd, stderrfd, escape);
586 current_config = NULL;
587
588 return ret;
589 }
590
591 static int do_lxcapi_console_log(struct lxc_container *c, struct lxc_console_log *log)
592 {
593 int ret;
594
595 if (!c)
596 return -EINVAL;
597
598 ret = lxc_cmd_console_log(c->name, do_lxcapi_get_config_path(c), log);
599 if (ret < 0) {
600 if (ret == -ENODATA)
601 NOTICE("The console log is empty");
602 else if (ret == -EFAULT)
603 NOTICE("The container does not keep a console log");
604 else if (ret == -ENOENT)
605 NOTICE("The container does not keep a console log file");
606 else if (ret == -EIO)
607 NOTICE("Failed to write console log to log file");
608 else
609 ERROR("Failed to retrieve console log");
610 }
611
612 return ret;
613 }
614
615 WRAP_API_1(int, lxcapi_console_log, struct lxc_console_log *)
616
617 static pid_t do_lxcapi_init_pid(struct lxc_container *c)
618 {
619 if (!c)
620 return -1;
621
622 return lxc_cmd_get_init_pid(c->name, c->config_path);
623 }
624
625 WRAP_API(pid_t, lxcapi_init_pid)
626
627 static bool load_config_locked(struct lxc_container *c, const char *fname)
628 {
629 if (!c->lxc_conf)
630 c->lxc_conf = lxc_conf_init();
631
632 if (!c->lxc_conf)
633 return false;
634
635 if (lxc_config_read(fname, c->lxc_conf, false) != 0)
636 return false;
637
638 c->lxc_conf->name = c->name;
639 return true;
640 }
641
642 static bool do_lxcapi_load_config(struct lxc_container *c, const char *alt_file)
643 {
644 int lret;
645 const char *fname;
646 bool need_disklock = false, ret = false;
647
648 if (!c)
649 return false;
650
651 fname = c->configfile;
652
653 if (alt_file)
654 fname = alt_file;
655
656 if (!fname)
657 return false;
658
659 /* If we're reading something other than the container's config, we only
660 * need to lock the in-memory container. If loading the container's
661 * config file, take the disk lock.
662 */
663 if (strcmp(fname, c->configfile) == 0)
664 need_disklock = true;
665
666 if (need_disklock)
667 lret = container_disk_lock(c);
668 else
669 lret = container_mem_lock(c);
670 if (lret)
671 return false;
672
673 ret = load_config_locked(c, fname);
674
675 if (need_disklock)
676 container_disk_unlock(c);
677 else
678 container_mem_unlock(c);
679
680 return ret;
681 }
682
683 WRAP_API_1(bool, lxcapi_load_config, const char *)
684
685 static bool do_lxcapi_want_daemonize(struct lxc_container *c, bool state)
686 {
687 if (!c || !c->lxc_conf)
688 return false;
689
690 if (container_mem_lock(c))
691 return false;
692
693 c->daemonize = state;
694
695 container_mem_unlock(c);
696
697 return true;
698 }
699
700 WRAP_API_1(bool, lxcapi_want_daemonize, bool)
701
702 static bool do_lxcapi_want_close_all_fds(struct lxc_container *c, bool state)
703 {
704 if (!c || !c->lxc_conf)
705 return false;
706
707 if (container_mem_lock(c))
708 return false;
709
710 c->lxc_conf->close_all_fds = state;
711
712 container_mem_unlock(c);
713
714 return true;
715 }
716
717 WRAP_API_1(bool, lxcapi_want_close_all_fds, bool)
718
719 static bool do_lxcapi_wait(struct lxc_container *c, const char *state,
720 int timeout)
721 {
722 int ret;
723
724 if (!c)
725 return false;
726
727 ret = lxc_wait(c->name, state, timeout, c->config_path);
728 return ret == 0;
729 }
730
731 WRAP_API_2(bool, lxcapi_wait, const char *, int)
732
733 static bool am_single_threaded(void)
734 {
735 DIR *dir;
736 struct dirent *direntp;
737 int count = 0;
738
739 dir = opendir("/proc/self/task");
740 if (!dir)
741 return false;
742
743 while ((direntp = readdir(dir))) {
744 if (strcmp(direntp->d_name, ".") == 0)
745 continue;
746
747 if (strcmp(direntp->d_name, "..") == 0)
748 continue;
749
750 count++;
751 if (count > 1)
752 break;
753 }
754 closedir(dir);
755
756 return count == 1;
757 }
758
759 static void push_arg(char ***argp, char *arg, int *nargs)
760 {
761 char *copy;
762 char **argv;
763
764 copy = must_copy_string(arg);
765
766 do {
767 argv = realloc(*argp, (*nargs + 2) * sizeof(char *));
768 } while (!argv);
769
770 *argp = argv;
771 argv[*nargs] = copy;
772 (*nargs)++;
773 argv[*nargs] = NULL;
774 }
775
776 static char **split_init_cmd(const char *incmd)
777 {
778 __do_free char *copy = NULL;
779 char *p;
780 char **argv;
781 int nargs = 0;
782
783 if (!incmd)
784 return NULL;
785
786 copy = must_copy_string(incmd);
787
788 do {
789 argv = malloc(sizeof(char *));
790 } while (!argv);
791
792 argv[0] = NULL;
793 lxc_iterate_parts (p, copy, " ")
794 push_arg(&argv, p, &nargs);
795
796 if (nargs == 0) {
797 free(argv);
798 return NULL;
799 }
800
801 return argv;
802 }
803
804 static void free_init_cmd(char **argv)
805 {
806 int i = 0;
807
808 if (!argv)
809 return;
810
811 while (argv[i])
812 free(argv[i++]);
813
814 free(argv);
815 }
816
817 static int lxc_rcv_status(int state_socket)
818 {
819 int ret;
820 int state = -1;
821
822 again:
823 /* Receive container state. */
824 ret = lxc_abstract_unix_rcv_credential(state_socket, &state, sizeof(int));
825 if (ret <= 0) {
826 if (errno != EINTR)
827 return -1;
828
829 TRACE("Caught EINTR; retrying");
830 goto again;
831 }
832
833 return state;
834 }
835
836 static bool wait_on_daemonized_start(struct lxc_handler *handler, int pid)
837 {
838 int ret, state;
839
840 /* Close write end of the socket pair. */
841 close(handler->state_socket_pair[1]);
842 handler->state_socket_pair[1] = -1;
843
844 state = lxc_rcv_status(handler->state_socket_pair[0]);
845
846 /* Close read end of the socket pair. */
847 close(handler->state_socket_pair[0]);
848 handler->state_socket_pair[0] = -1;
849
850 /* The first child is going to fork() again and then exits. So we reap
851 * the first child here.
852 */
853 ret = wait_for_pid(pid);
854 if (ret < 0)
855 DEBUG("Failed waiting on first child %d", pid);
856 else
857 DEBUG("First child %d exited", pid);
858
859 if (state < 0) {
860 SYSERROR("Failed to receive the container state");
861 return false;
862 }
863
864 /* If we receive anything else then running we know that the container
865 * failed to start.
866 */
867 if (state != RUNNING) {
868 ERROR("Received container state \"%s\" instead of \"RUNNING\"",
869 lxc_state2str(state));
870 return false;
871 }
872
873 TRACE("Container is in \"RUNNING\" state");
874 return true;
875 }
876
877 static bool do_lxcapi_start(struct lxc_container *c, int useinit, char * const argv[])
878 {
879 int ret;
880 struct lxc_handler *handler;
881 struct lxc_conf *conf;
882 char *default_args[] = {
883 "/sbin/init",
884 NULL,
885 };
886 char **init_cmd = NULL;
887 int keepfds[3] = {-1, -1, -1};
888
889 /* container does exist */
890 if (!c)
891 return false;
892
893 /* If anything fails before we set error_num, we want an error in there.
894 */
895 c->error_num = 1;
896
897 /* Container has not been setup. */
898 if (!c->lxc_conf)
899 return false;
900
901 ret = ongoing_create(c);
902 switch (ret) {
903 case LXC_CREATE_FAILED:
904 ERROR("Failed checking for incomplete container creation");
905 return false;
906 case LXC_CREATE_ONGOING:
907 ERROR("Ongoing container creation detected");
908 return false;
909 case LXC_CREATE_INCOMPLETE:
910 ERROR("Failed to create container");
911 do_lxcapi_destroy(c);
912 return false;
913 }
914
915 if (container_mem_lock(c))
916 return false;
917
918 conf = c->lxc_conf;
919
920 /* initialize handler */
921 handler = lxc_init_handler(c->name, conf, c->config_path, c->daemonize);
922
923 container_mem_unlock(c);
924 if (!handler)
925 return false;
926
927 if (!argv) {
928 if (useinit && conf->execute_cmd)
929 argv = init_cmd = split_init_cmd(conf->execute_cmd);
930 else
931 argv = init_cmd = split_init_cmd(conf->init_cmd);
932 }
933
934 /* ... otherwise use default_args. */
935 if (!argv) {
936 if (useinit) {
937 ERROR("No valid init detected");
938 lxc_free_handler(handler);
939 return false;
940 }
941 argv = default_args;
942 }
943
944 /* I'm not sure what locks we want here.Any? Is liblxc's locking enough
945 * here to protect the on disk container? We don't want to exclude
946 * things like lxc_info while the container is running.
947 */
948 if (c->daemonize) {
949 bool started;
950 char title[2048];
951 pid_t pid;
952
953 pid = fork();
954 if (pid < 0) {
955 free_init_cmd(init_cmd);
956 lxc_free_handler(handler);
957 return false;
958 }
959
960 /* first parent */
961 if (pid != 0) {
962 /* Set to NULL because we don't want father unlink
963 * the PID file, child will do the free and unlink.
964 */
965 c->pidfile = NULL;
966
967 /* Wait for container to tell us whether it started
968 * successfully.
969 */
970 started = wait_on_daemonized_start(handler, pid);
971
972 free_init_cmd(init_cmd);
973 lxc_free_handler(handler);
974 return started;
975 }
976
977 /* first child */
978
979 /* We don't really care if this doesn't print all the
980 * characters. All that it means is that the proctitle will be
981 * ugly. Similarly, we also don't care if setproctitle() fails.
982 */
983 ret = snprintf(title, sizeof(title), "[lxc monitor] %s %s", c->config_path, c->name);
984 if (ret > 0) {
985 ret = setproctitle(title);
986 if (ret < 0)
987 INFO("Failed to set process title to %s", title);
988 else
989 INFO("Set process title to %s", title);
990 }
991
992 /* We fork() a second time to be reparented to init. Like
993 * POSIX's daemon() function we change to "/" and redirect
994 * std{in,out,err} to /dev/null.
995 */
996 pid = fork();
997 if (pid < 0) {
998 SYSERROR("Failed to fork first child process");
999 _exit(EXIT_FAILURE);
1000 }
1001
1002 /* second parent */
1003 if (pid != 0) {
1004 free_init_cmd(init_cmd);
1005 lxc_free_handler(handler);
1006 _exit(EXIT_SUCCESS);
1007 }
1008
1009 /* second child */
1010
1011 /* change to / directory */
1012 ret = chdir("/");
1013 if (ret < 0) {
1014 SYSERROR("Failed to change to \"/\" directory");
1015 _exit(EXIT_FAILURE);
1016 }
1017
1018 keepfds[0] = handler->conf->maincmd_fd;
1019 keepfds[1] = handler->state_socket_pair[0];
1020 keepfds[2] = handler->state_socket_pair[1];
1021 ret = lxc_check_inherited(conf, true, keepfds,
1022 sizeof(keepfds) / sizeof(keepfds[0]));
1023 if (ret < 0)
1024 _exit(EXIT_FAILURE);
1025
1026 /* redirect std{in,out,err} to /dev/null */
1027 ret = null_stdfds();
1028 if (ret < 0) {
1029 ERROR("Failed to redirect std{in,out,err} to /dev/null");
1030 _exit(EXIT_FAILURE);
1031 }
1032
1033 /* become session leader */
1034 ret = setsid();
1035 if (ret < 0)
1036 TRACE("Process %d is already process group leader", lxc_raw_getpid());
1037 } else if (!am_single_threaded()) {
1038 ERROR("Cannot start non-daemonized container when threaded");
1039 free_init_cmd(init_cmd);
1040 lxc_free_handler(handler);
1041 return false;
1042 }
1043
1044 /* We need to write PID file after daemonize, so we always write the
1045 * right PID.
1046 */
1047 if (c->pidfile) {
1048 int w;
1049 char pidstr[INTTYPE_TO_STRLEN(pid_t)];
1050
1051 w = snprintf(pidstr, sizeof(pidstr), "%d", lxc_raw_getpid());
1052 if (w < 0 || (size_t)w >= sizeof(pidstr)) {
1053 free_init_cmd(init_cmd);
1054 lxc_free_handler(handler);
1055
1056 SYSERROR("Failed to write monitor pid to \"%s\"", c->pidfile);
1057
1058 if (c->daemonize)
1059 _exit(EXIT_FAILURE);
1060
1061 return false;
1062 }
1063
1064 ret = lxc_write_to_file(c->pidfile, pidstr, w, false, 0600);
1065 if (ret < 0) {
1066 free_init_cmd(init_cmd);
1067 lxc_free_handler(handler);
1068
1069 SYSERROR("Failed to write monitor pid to \"%s\"", c->pidfile);
1070
1071 if (c->daemonize)
1072 _exit(EXIT_FAILURE);
1073
1074 return false;
1075 }
1076 }
1077
1078 conf->reboot = REBOOT_NONE;
1079
1080 /* Unshare the mount namespace if requested */
1081 if (conf->monitor_unshare) {
1082 ret = unshare(CLONE_NEWNS);
1083 if (ret < 0) {
1084 SYSERROR("Failed to unshare mount namespace");
1085 lxc_free_handler(handler);
1086 ret = 1;
1087 goto on_error;
1088 }
1089
1090 ret = mount(NULL, "/", NULL, MS_SLAVE|MS_REC, NULL);
1091 if (ret < 0) {
1092 SYSERROR("Failed to make / rslave at startup");
1093 lxc_free_handler(handler);
1094 ret = 1;
1095 goto on_error;
1096 }
1097 }
1098
1099 reboot:
1100 if (conf->reboot == REBOOT_INIT) {
1101 /* initialize handler */
1102 handler = lxc_init_handler(c->name, conf, c->config_path, c->daemonize);
1103 if (!handler) {
1104 ret = 1;
1105 goto on_error;
1106 }
1107 }
1108
1109 keepfds[0] = handler->conf->maincmd_fd;
1110 keepfds[1] = handler->state_socket_pair[0];
1111 keepfds[2] = handler->state_socket_pair[1];
1112 ret = lxc_check_inherited(conf, c->daemonize, keepfds,
1113 sizeof(keepfds) / sizeof(keepfds[0]));
1114 if (ret < 0) {
1115 lxc_free_handler(handler);
1116 ret = 1;
1117 goto on_error;
1118 }
1119
1120 if (useinit)
1121 ret = lxc_execute(c->name, argv, 1, handler, c->config_path,
1122 c->daemonize, &c->error_num);
1123 else
1124 ret = lxc_start(c->name, argv, handler, c->config_path,
1125 c->daemonize, &c->error_num);
1126
1127 if (conf->reboot == REBOOT_REQ) {
1128 INFO("Container requested reboot");
1129 conf->reboot = REBOOT_INIT;
1130 goto reboot;
1131 }
1132
1133 on_error:
1134 if (c->pidfile) {
1135 unlink(c->pidfile);
1136 free(c->pidfile);
1137 c->pidfile = NULL;
1138 }
1139 free_init_cmd(init_cmd);
1140
1141 if (c->daemonize && ret != 0)
1142 _exit(EXIT_FAILURE);
1143 else if (c->daemonize)
1144 _exit(EXIT_SUCCESS);
1145
1146 if (ret != 0)
1147 return false;
1148
1149 return true;
1150 }
1151
1152 static bool lxcapi_start(struct lxc_container *c, int useinit,
1153 char *const argv[])
1154 {
1155 bool ret;
1156
1157 current_config = c ? c->lxc_conf : NULL;
1158 ret = do_lxcapi_start(c, useinit, argv);
1159 current_config = NULL;
1160
1161 return ret;
1162 }
1163
1164 /* Note, there MUST be an ending NULL. */
1165 static bool lxcapi_startl(struct lxc_container *c, int useinit, ...)
1166 {
1167 va_list ap;
1168 char **inargs = NULL;
1169 bool bret = false;
1170
1171 /* container exists */
1172 if (!c)
1173 return false;
1174
1175 current_config = c->lxc_conf;
1176
1177 va_start(ap, useinit);
1178 inargs = lxc_va_arg_list_to_argv(ap, 0, 1);
1179 va_end(ap);
1180 if (!inargs)
1181 goto on_error;
1182
1183 /* pass NULL if no arguments were supplied */
1184 bret = do_lxcapi_start(c, useinit, *inargs ? inargs : NULL);
1185
1186 on_error:
1187 if (inargs) {
1188 char **arg;
1189
1190 for (arg = inargs; *arg; arg++)
1191 free(*arg);
1192 free(inargs);
1193 }
1194
1195 current_config = NULL;
1196
1197 return bret;
1198 }
1199
1200 static bool do_lxcapi_stop(struct lxc_container *c)
1201 {
1202 int ret;
1203
1204 if (!c)
1205 return false;
1206
1207 ret = lxc_cmd_stop(c->name, c->config_path);
1208
1209 return ret == 0;
1210 }
1211
1212 WRAP_API(bool, lxcapi_stop)
1213
1214 static int do_create_container_dir(const char *path, struct lxc_conf *conf)
1215 {
1216 __do_free char *p = NULL;
1217 int lasterr;
1218 int ret = -1;
1219
1220 mode_t mask = umask(0002);
1221 ret = mkdir(path, 0770);
1222 lasterr = errno;
1223 umask(mask);
1224 errno = lasterr;
1225 if (ret) {
1226 if (errno != EEXIST)
1227 return -1;
1228
1229 ret = 0;
1230 }
1231
1232 p = must_copy_string(path);
1233
1234 if (!lxc_list_empty(&conf->id_map)) {
1235 ret = chown_mapped_root(p, conf);
1236 if (ret < 0)
1237 ret = -1;
1238 }
1239
1240 return ret;
1241 }
1242
1243 /* Create the standard expected container dir. */
1244 static bool create_container_dir(struct lxc_container *c)
1245 {
1246 int ret;
1247 size_t len;
1248 char *s;
1249
1250 len = strlen(c->config_path) + strlen(c->name) + 2;
1251 s = malloc(len);
1252 if (!s)
1253 return false;
1254
1255 ret = snprintf(s, len, "%s/%s", c->config_path, c->name);
1256 if (ret < 0 || (size_t)ret >= len) {
1257 free(s);
1258 return false;
1259 }
1260
1261 ret = do_create_container_dir(s, c->lxc_conf);
1262 free(s);
1263
1264 return ret == 0;
1265 }
1266
1267 /* do_storage_create: thin wrapper around storage_create(). Like
1268 * storage_create(), it returns a mounted bdev on success, NULL on error.
1269 */
1270 static struct lxc_storage *do_storage_create(struct lxc_container *c,
1271 const char *type,
1272 struct bdev_specs *specs)
1273 {
1274 __do_free char *dest = NULL;
1275 int ret;
1276 size_t len;
1277 struct lxc_storage *bdev;
1278
1279 /* rootfs.path or lxcpath/lxcname/rootfs */
1280 if (c->lxc_conf->rootfs.path &&
1281 (access(c->lxc_conf->rootfs.path, F_OK) == 0)) {
1282 const char *rpath = c->lxc_conf->rootfs.path;
1283 len = strlen(rpath) + 1;
1284 dest = must_realloc(NULL, len);
1285 ret = snprintf(dest, len, "%s", rpath);
1286 } else {
1287 const char *lxcpath = do_lxcapi_get_config_path(c);
1288 len = strlen(c->name) + strlen(lxcpath) + 9;
1289 dest = must_realloc(NULL, len);
1290 ret = snprintf(dest, len, "%s/%s/rootfs", lxcpath, c->name);
1291 }
1292 if (ret < 0 || (size_t)ret >= len)
1293 return NULL;
1294
1295 bdev = storage_create(dest, type, c->name, specs);
1296 if (!bdev) {
1297 ERROR("Failed to create \"%s\" storage", type);
1298 return NULL;
1299 }
1300
1301 if (!c->set_config_item(c, "lxc.rootfs.path", bdev->src)) {
1302 ERROR("Failed to set \"lxc.rootfs.path = %s\"", bdev->src);
1303 return NULL;
1304 }
1305
1306 /* If we are not root, chown the rootfs dir to root in the target user
1307 * namespace.
1308 */
1309 ret = geteuid();
1310 if (ret != 0 || (c->lxc_conf && !lxc_list_empty(&c->lxc_conf->id_map))) {
1311 ret = chown_mapped_root(bdev->dest, c->lxc_conf);
1312 if (ret < 0) {
1313 ERROR("Error chowning \"%s\" to container root", bdev->dest);
1314 suggest_default_idmap();
1315 storage_put(bdev);
1316 return NULL;
1317 }
1318 }
1319
1320 return bdev;
1321 }
1322
1323 static char *lxcbasename(char *path)
1324 {
1325 char *p;
1326
1327 p = path + strlen(path) - 1;
1328 while (*p != '/' && p > path)
1329 p--;
1330
1331 return p;
1332 }
1333
1334 static bool create_run_template(struct lxc_container *c, char *tpath,
1335 bool need_null_stdfds, char *const argv[])
1336 {
1337 int ret;
1338 pid_t pid;
1339
1340 if (!tpath)
1341 return true;
1342
1343 pid = fork();
1344 if (pid < 0) {
1345 SYSERROR("Failed to fork task for container creation template");
1346 return false;
1347 }
1348
1349 if (pid == 0) { /* child */
1350 int i, len;
1351 char *namearg, *patharg, *rootfsarg;
1352 char **newargv;
1353 int nargs = 0;
1354 struct lxc_storage *bdev = NULL;
1355 struct lxc_conf *conf = c->lxc_conf;
1356 uid_t euid;
1357
1358 if (need_null_stdfds) {
1359 ret = null_stdfds();
1360 if (ret < 0)
1361 _exit(EXIT_FAILURE);
1362 }
1363
1364 bdev = storage_init(c->lxc_conf);
1365 if (!bdev) {
1366 ERROR("Failed to initialize storage");
1367 _exit(EXIT_FAILURE);
1368 }
1369
1370 euid = geteuid();
1371 if (euid == 0) {
1372 ret = unshare(CLONE_NEWNS);
1373 if (ret < 0) {
1374 ERROR("Failed to unshare CLONE_NEWNS");
1375 _exit(EXIT_FAILURE);
1376 }
1377
1378 ret = detect_shared_rootfs();
1379 if (ret == 1) {
1380 ret = mount(NULL, "/", NULL, MS_SLAVE | MS_REC, NULL);
1381 if (ret < 0) {
1382 SYSERROR("Failed to make \"/\" rslave");
1383 ERROR("Continuing...");
1384 }
1385 }
1386 }
1387
1388 if (strcmp(bdev->type, "dir") != 0 && strcmp(bdev->type, "btrfs") != 0) {
1389 if (euid != 0) {
1390 ERROR("Unprivileged users can only create "
1391 "btrfs and directory-backed containers");
1392 _exit(EXIT_FAILURE);
1393 }
1394
1395 if (strcmp(bdev->type, "overlay") == 0 ||
1396 strcmp(bdev->type, "overlayfs") == 0) {
1397 /* If we create an overlay container we need to
1398 * rsync the contents into
1399 * <container-path>/<container-name>/rootfs.
1400 * However, the overlay mount function will
1401 * mount will mount
1402 * <container-path>/<container-name>/delta0
1403 * over
1404 * <container-path>/<container-name>/rootfs
1405 * which means we would rsync the rootfs into
1406 * the delta directory. That doesn't make sense
1407 * since the delta directory only exists to
1408 * record the differences to
1409 * <container-path>/<container-name>/rootfs. So
1410 * let's simply bind-mount here and then rsync
1411 * directly into
1412 * <container-path>/<container-name>/rootfs.
1413 */
1414 char *src;
1415
1416 src = ovl_get_rootfs(bdev->src, &(size_t){0});
1417 if (!src) {
1418 ERROR("Failed to get rootfs");
1419 _exit(EXIT_FAILURE);
1420 }
1421
1422 ret = mount(src, bdev->dest, "bind", MS_BIND | MS_REC, NULL);
1423 if (ret < 0) {
1424 ERROR("Failed to mount rootfs");
1425 _exit(EXIT_FAILURE);
1426 }
1427 } else {
1428 ret = bdev->ops->mount(bdev);
1429 if (ret < 0) {
1430 ERROR("Failed to mount rootfs");
1431 _exit(EXIT_FAILURE);
1432 }
1433 }
1434 } else { /* TODO come up with a better way here! */
1435 const char *src;
1436 free(bdev->dest);
1437 src = lxc_storage_get_path(bdev->src, bdev->type);
1438 bdev->dest = strdup(src);
1439 }
1440
1441 /* Create our new array, pre-pend the template name and base
1442 * args.
1443 */
1444 if (argv)
1445 for (nargs = 0; argv[nargs]; nargs++)
1446 ;
1447
1448 /* template, path, rootfs and name args */
1449 nargs += 4;
1450
1451 newargv = malloc(nargs * sizeof(*newargv));
1452 if (!newargv)
1453 _exit(EXIT_FAILURE);
1454 newargv[0] = lxcbasename(tpath);
1455
1456 /* --path */
1457 len = strlen(c->config_path) + strlen(c->name) + strlen("--path=") + 2;
1458 patharg = malloc(len);
1459 if (!patharg)
1460 _exit(EXIT_FAILURE);
1461
1462 ret = snprintf(patharg, len, "--path=%s/%s", c->config_path, c->name);
1463 if (ret < 0 || ret >= len)
1464 _exit(EXIT_FAILURE);
1465 newargv[1] = patharg;
1466
1467 /* --name */
1468 len = strlen("--name=") + strlen(c->name) + 1;
1469 namearg = malloc(len);
1470 if (!namearg)
1471 _exit(EXIT_FAILURE);
1472
1473 ret = snprintf(namearg, len, "--name=%s", c->name);
1474 if (ret < 0 || ret >= len)
1475 _exit(EXIT_FAILURE);
1476 newargv[2] = namearg;
1477
1478 /* --rootfs */
1479 len = strlen("--rootfs=") + 1 + strlen(bdev->dest);
1480 rootfsarg = malloc(len);
1481 if (!rootfsarg)
1482 _exit(EXIT_FAILURE);
1483
1484 ret = snprintf(rootfsarg, len, "--rootfs=%s", bdev->dest);
1485 if (ret < 0 || ret >= len)
1486 _exit(EXIT_FAILURE);
1487 newargv[3] = rootfsarg;
1488
1489 /* add passed-in args */
1490 if (argv)
1491 for (i = 4; i < nargs; i++)
1492 newargv[i] = argv[i - 4];
1493
1494 /* add trailing NULL */
1495 nargs++;
1496 newargv = realloc(newargv, nargs * sizeof(*newargv));
1497 if (!newargv)
1498 _exit(EXIT_FAILURE);
1499 newargv[nargs - 1] = NULL;
1500
1501 /* If we're running the template in a mapped userns, then we
1502 * prepend the template command with: lxc-usernsexec <-m map1>
1503 * ... <-m mapn> -- and we append "--mapped-uid x", where x is
1504 * the mapped uid for our geteuid()
1505 */
1506 if (!lxc_list_empty(&conf->id_map)) {
1507 int extraargs, hostuid_mapped, hostgid_mapped;
1508 char **n2;
1509 char txtuid[20], txtgid[20];
1510 struct lxc_list *it;
1511 struct id_map *map;
1512 int n2args = 1;
1513
1514 n2 = malloc(n2args * sizeof(*n2));
1515 if (!n2)
1516 _exit(EXIT_FAILURE);
1517
1518 newargv[0] = tpath;
1519 tpath = "lxc-usernsexec";
1520 n2[0] = "lxc-usernsexec";
1521
1522 lxc_list_for_each(it, &conf->id_map) {
1523 map = it->elem;
1524 n2args += 2;
1525 n2 = realloc(n2, n2args * sizeof(char *));
1526 if (!n2)
1527 _exit(EXIT_FAILURE);
1528
1529 n2[n2args - 2] = "-m";
1530 n2[n2args - 1] = malloc(200);
1531 if (!n2[n2args - 1])
1532 _exit(EXIT_FAILURE);
1533
1534 ret = snprintf(n2[n2args - 1], 200, "%c:%lu:%lu:%lu",
1535 map->idtype == ID_TYPE_UID ? 'u' : 'g',
1536 map->nsid, map->hostid, map->range);
1537 if (ret < 0 || ret >= 200)
1538 _exit(EXIT_FAILURE);
1539 }
1540
1541 hostuid_mapped = mapped_hostid(geteuid(), conf, ID_TYPE_UID);
1542 extraargs = hostuid_mapped >= 0 ? 1 : 3;
1543
1544 n2 = realloc(n2, (nargs + n2args + extraargs) * sizeof(char *));
1545 if (!n2)
1546 _exit(EXIT_FAILURE);
1547
1548 if (hostuid_mapped < 0) {
1549 hostuid_mapped = find_unmapped_nsid(conf, ID_TYPE_UID);
1550 n2[n2args++] = "-m";
1551 if (hostuid_mapped < 0) {
1552 ERROR("Failed to find free uid to map");
1553 _exit(EXIT_FAILURE);
1554 }
1555
1556 n2[n2args++] = malloc(200);
1557 if (!n2[n2args - 1]) {
1558 SYSERROR("out of memory");
1559 _exit(EXIT_FAILURE);
1560 }
1561
1562 ret = snprintf(n2[n2args - 1], 200, "u:%d:%d:1",
1563 hostuid_mapped, geteuid());
1564 if (ret < 0 || ret >= 200)
1565 _exit(EXIT_FAILURE);
1566 }
1567
1568 hostgid_mapped = mapped_hostid(getegid(), conf, ID_TYPE_GID);
1569 extraargs = hostgid_mapped >= 0 ? 1 : 3;
1570
1571 n2 = realloc(n2, (nargs + n2args + extraargs) * sizeof(char *));
1572 if (!n2)
1573 _exit(EXIT_FAILURE);
1574
1575 if (hostgid_mapped < 0) {
1576 hostgid_mapped = find_unmapped_nsid(conf, ID_TYPE_GID);
1577 n2[n2args++] = "-m";
1578 if (hostgid_mapped < 0) {
1579 ERROR("Failed to find free gid to map");
1580 _exit(EXIT_FAILURE);
1581 }
1582
1583 n2[n2args++] = malloc(200);
1584 if (!n2[n2args - 1]) {
1585 SYSERROR("out of memory");
1586 _exit(EXIT_FAILURE);
1587 }
1588
1589 ret = snprintf(n2[n2args - 1], 200, "g:%d:%d:1",
1590 hostgid_mapped, getegid());
1591 if (ret < 0 || ret >= 200)
1592 _exit(EXIT_FAILURE);
1593 }
1594
1595 n2[n2args++] = "--";
1596
1597 for (i = 0; i < nargs; i++)
1598 n2[i + n2args] = newargv[i];
1599 n2args += nargs;
1600
1601 /* Finally add "--mapped-uid $uid" to tell template what
1602 * to chown cached images to.
1603 */
1604 n2args += 4;
1605 n2 = realloc(n2, n2args * sizeof(char *));
1606 if (!n2)
1607 _exit(EXIT_FAILURE);
1608
1609 /* note n2[n2args-1] is NULL */
1610 n2[n2args - 5] = "--mapped-uid";
1611
1612 ret = snprintf(txtuid, 20, "%d", hostuid_mapped);
1613 if (ret < 0 || ret >= 20) {
1614 free(newargv);
1615 free(n2);
1616 _exit(EXIT_FAILURE);
1617 }
1618
1619 n2[n2args - 4] = txtuid;
1620 n2[n2args - 3] = "--mapped-gid";
1621
1622 ret = snprintf(txtgid, 20, "%d", hostgid_mapped);
1623 if (ret < 0 || ret >= 20) {
1624 free(newargv);
1625 free(n2);
1626 _exit(EXIT_FAILURE);
1627 }
1628
1629 n2[n2args - 2] = txtgid;
1630 n2[n2args - 1] = NULL;
1631 free(newargv);
1632 newargv = n2;
1633 }
1634
1635 execvp(tpath, newargv);
1636 SYSERROR("Failed to execute template %s", tpath);
1637 _exit(EXIT_FAILURE);
1638 }
1639
1640 ret = wait_for_pid(pid);
1641 if (ret != 0) {
1642 ERROR("Failed to create container from template");
1643 return false;
1644 }
1645
1646 return true;
1647 }
1648
1649 static bool prepend_lxc_header(char *path, const char *t, char *const argv[])
1650 {
1651 long flen;
1652 size_t len;
1653 char *contents;
1654 FILE *f;
1655 int ret = -1;
1656 #if HAVE_LIBGNUTLS
1657 int i;
1658 unsigned char md_value[SHA_DIGEST_LENGTH];
1659 char *tpath;
1660 #endif
1661
1662 f = fopen(path, "r");
1663 if (f == NULL)
1664 return false;
1665
1666 ret = fseek(f, 0, SEEK_END);
1667 if (ret < 0)
1668 goto out_error;
1669
1670 ret = -1;
1671 flen = ftell(f);
1672 if (flen < 0)
1673 goto out_error;
1674
1675 ret = fseek(f, 0, SEEK_SET);
1676 if (ret < 0)
1677 goto out_error;
1678
1679 ret = fseek(f, 0, SEEK_SET);
1680 if (ret < 0)
1681 goto out_error;
1682
1683 ret = -1;
1684 contents = malloc(flen + 1);
1685 if (!contents)
1686 goto out_error;
1687
1688 len = fread(contents, 1, flen, f);
1689 if (len != flen)
1690 goto out_free_contents;
1691
1692 contents[flen] = '\0';
1693
1694 ret = fclose(f);
1695 f = NULL;
1696 if (ret < 0)
1697 goto out_free_contents;
1698
1699 #if HAVE_LIBGNUTLS
1700 tpath = get_template_path(t);
1701 if (!tpath) {
1702 ERROR("Invalid template \"%s\" specified", t);
1703 goto out_free_contents;
1704 }
1705
1706 ret = sha1sum_file(tpath, md_value);
1707 if (ret < 0) {
1708 ERROR("Failed to get sha1sum of %s", tpath);
1709 free(tpath);
1710 goto out_free_contents;
1711 }
1712 free(tpath);
1713 #endif
1714
1715 f = fopen(path, "w");
1716 if (f == NULL) {
1717 SYSERROR("Reopening config for writing");
1718 free(contents);
1719 return false;
1720 }
1721
1722 fprintf(f, "# Template used to create this container: %s\n", t);
1723 if (argv) {
1724 fprintf(f, "# Parameters passed to the template:");
1725 while (*argv) {
1726 fprintf(f, " %s", *argv);
1727 argv++;
1728 }
1729 fprintf(f, "\n");
1730 }
1731
1732 #if HAVE_LIBGNUTLS
1733 fprintf(f, "# Template script checksum (SHA-1): ");
1734 for (i=0; i<SHA_DIGEST_LENGTH; i++)
1735 fprintf(f, "%02x", md_value[i]);
1736 fprintf(f, "\n");
1737 #endif
1738 fprintf(f, "# For additional config options, please look at lxc.container.conf(5)\n");
1739 fprintf(f, "\n# Uncomment the following line to support nesting containers:\n");
1740 fprintf(f, "#lxc.include = " LXCTEMPLATECONFIG "/nesting.conf\n");
1741 fprintf(f, "# (Be aware this has security implications)\n\n");
1742 if (fwrite(contents, 1, flen, f) != flen) {
1743 SYSERROR("Writing original contents");
1744 free(contents);
1745 fclose(f);
1746 return false;
1747 }
1748
1749 ret = 0;
1750
1751 out_free_contents:
1752 free(contents);
1753
1754 out_error:
1755 if (f) {
1756 int newret;
1757 newret = fclose(f);
1758 if (ret == 0)
1759 ret = newret;
1760 }
1761
1762 if (ret < 0) {
1763 SYSERROR("Error prepending header");
1764 return false;
1765 }
1766
1767 return true;
1768 }
1769
1770 static void lxcapi_clear_config(struct lxc_container *c)
1771 {
1772 if (!c || !c->lxc_conf)
1773 return;
1774
1775 lxc_conf_free(c->lxc_conf);
1776 c->lxc_conf = NULL;
1777 }
1778
1779 #define do_lxcapi_clear_config(c) lxcapi_clear_config(c)
1780
1781 /*
1782 * lxcapi_create:
1783 * create a container with the given parameters.
1784 * @c: container to be created. It has the lxcpath, name, and a starting
1785 * configuration already set
1786 * @t: the template to execute to instantiate the root filesystem and
1787 * adjust the configuration.
1788 * @bdevtype: backing store type to use. If NULL, dir will be used.
1789 * @specs: additional parameters for the backing store, i.e. LVM vg to
1790 * use.
1791 *
1792 * @argv: the arguments to pass to the template, terminated by NULL. If no
1793 * arguments, you can just pass NULL.
1794 */
1795 static bool do_lxcapi_create(struct lxc_container *c, const char *t,
1796 const char *bdevtype, struct bdev_specs *specs,
1797 int flags, char *const argv[])
1798 {
1799 int partial_fd;
1800 mode_t mask;
1801 pid_t pid;
1802 bool ret = false, rootfs_managed = true;
1803 char *tpath = NULL;
1804
1805 if (!c)
1806 return false;
1807
1808 if (t) {
1809 tpath = get_template_path(t);
1810 if (!tpath) {
1811 ERROR("Unknown template \"%s\"", t);
1812 goto out;
1813 }
1814 }
1815
1816 /* If a template is passed in, and the rootfs already is defined in the
1817 * container config and exists, then the caller is trying to create an
1818 * existing container. Return an error, but do NOT delete the container.
1819 */
1820 if (do_lxcapi_is_defined(c) && c->lxc_conf && c->lxc_conf->rootfs.path &&
1821 access(c->lxc_conf->rootfs.path, F_OK) == 0 && tpath) {
1822 ERROR("Container \"%s\" already exists in \"%s\"", c->name,
1823 c->config_path);
1824 goto free_tpath;
1825 }
1826
1827 if (!c->lxc_conf) {
1828 if (!do_lxcapi_load_config(c, lxc_global_config_value("lxc.default_config"))) {
1829 ERROR("Error loading default configuration file %s",
1830 lxc_global_config_value("lxc.default_config"));
1831 goto free_tpath;
1832 }
1833 }
1834
1835 if (!create_container_dir(c))
1836 goto free_tpath;
1837
1838 if (c->lxc_conf->rootfs.path)
1839 rootfs_managed = false;
1840
1841 /* If both template and rootfs.path are set, template is setup as
1842 * rootfs.path. The container is already created if we have a config and
1843 * rootfs.path is accessible
1844 */
1845 if (!c->lxc_conf->rootfs.path && !tpath) {
1846 /* No template passed in and rootfs does not exist. */
1847 if (!c->save_config(c, NULL)) {
1848 ERROR("Failed to save initial config for \"%s\"", c->name);
1849 goto out;
1850 }
1851 ret = true;
1852 goto out;
1853 }
1854
1855 /* Rootfs passed into configuration, but does not exist. */
1856 if (c->lxc_conf->rootfs.path && access(c->lxc_conf->rootfs.path, F_OK) != 0)
1857 goto out;
1858
1859 if (do_lxcapi_is_defined(c) && c->lxc_conf->rootfs.path && !tpath) {
1860 /* Rootfs already existed, user just wanted to save the loaded
1861 * configuration.
1862 */
1863 if (!c->save_config(c, NULL))
1864 ERROR("Failed to save initial config for \"%s\"", c->name);
1865
1866 ret = true;
1867 goto out;
1868 }
1869
1870 /* Mark that this container is being created */
1871 partial_fd = create_partial(c);
1872 if (partial_fd < 0)
1873 goto out;
1874
1875 /* No need to get disk lock bc we have the partial lock. */
1876
1877 mask = umask(0022);
1878
1879 /* Create the storage.
1880 * Note we can't do this in the same task as we use to execute the
1881 * template because of the way zfs works.
1882 * After you 'zfs create', zfs mounts the fs only in the initial
1883 * namespace.
1884 */
1885 pid = fork();
1886 if (pid < 0) {
1887 SYSERROR("Failed to fork task for container creation template");
1888 goto out_unlock;
1889 }
1890
1891 if (pid == 0) { /* child */
1892 struct lxc_storage *bdev = NULL;
1893
1894 bdev = do_storage_create(c, bdevtype, specs);
1895 if (!bdev) {
1896 ERROR("Failed to create %s storage for %s",
1897 bdevtype ? bdevtype : "(none)", c->name);
1898 _exit(EXIT_FAILURE);
1899 }
1900
1901 /* Save config file again to store the new rootfs location. */
1902 if (!do_lxcapi_save_config(c, NULL)) {
1903 ERROR("Failed to save initial config for %s", c->name);
1904 /* Parent task won't see the storage driver in the
1905 * config so we delete it.
1906 */
1907 bdev->ops->umount(bdev);
1908 bdev->ops->destroy(bdev);
1909 _exit(EXIT_FAILURE);
1910 }
1911
1912 _exit(EXIT_SUCCESS);
1913 }
1914
1915 if (wait_for_pid(pid) != 0)
1916 goto out_unlock;
1917
1918 /* Reload config to get the rootfs. */
1919 lxc_conf_free(c->lxc_conf);
1920 c->lxc_conf = NULL;
1921
1922 if (!load_config_locked(c, c->configfile))
1923 goto out_unlock;
1924
1925 if (!create_run_template(c, tpath, !!(flags & LXC_CREATE_QUIET), argv))
1926 goto out_unlock;
1927
1928 /* Now clear out the lxc_conf we have, reload from the created
1929 * container.
1930 */
1931 do_lxcapi_clear_config(c);
1932
1933 if (t) {
1934 if (!prepend_lxc_header(c->configfile, tpath, argv)) {
1935 ERROR("Failed to prepend header to config file");
1936 goto out_unlock;
1937 }
1938 }
1939
1940 ret = load_config_locked(c, c->configfile);
1941
1942 out_unlock:
1943 umask(mask);
1944 remove_partial(c, partial_fd);
1945
1946 out:
1947 if (!ret) {
1948 bool reset_managed = c->lxc_conf->rootfs.managed;
1949
1950 /*
1951 * Ensure that we don't destroy storage we didn't create
1952 * ourselves.
1953 */
1954 if (!rootfs_managed)
1955 c->lxc_conf->rootfs.managed = false;
1956 container_destroy(c, NULL);
1957 c->lxc_conf->rootfs.managed = reset_managed;
1958 }
1959
1960 free_tpath:
1961 free(tpath);
1962 return ret;
1963 }
1964
1965 static bool lxcapi_create(struct lxc_container *c, const char *t,
1966 const char *bdevtype, struct bdev_specs *specs,
1967 int flags, char *const argv[])
1968 {
1969 bool ret;
1970
1971 current_config = c ? c->lxc_conf : NULL;
1972
1973 ret = do_lxcapi_create(c, t, bdevtype, specs, flags, argv);
1974 current_config = NULL;
1975 return ret;
1976 }
1977
1978 static bool do_lxcapi_reboot(struct lxc_container *c)
1979 {
1980 int ret;
1981 pid_t pid;
1982 int rebootsignal = SIGINT;
1983
1984 if (!c)
1985 return false;
1986
1987 if (!do_lxcapi_is_running(c))
1988 return false;
1989
1990 pid = do_lxcapi_init_pid(c);
1991 if (pid <= 0)
1992 return false;
1993
1994 if (c->lxc_conf && c->lxc_conf->rebootsignal)
1995 rebootsignal = c->lxc_conf->rebootsignal;
1996
1997 ret = kill(pid, rebootsignal);
1998 if (ret < 0) {
1999 WARN("Failed to send signal %d to pid %d", rebootsignal, pid);
2000 return false;
2001 }
2002
2003 return true;
2004 }
2005
2006 WRAP_API(bool, lxcapi_reboot)
2007
2008 static bool do_lxcapi_reboot2(struct lxc_container *c, int timeout)
2009 {
2010 int killret, ret;
2011 pid_t pid;
2012 int rebootsignal = SIGINT, state_client_fd = -1;
2013 lxc_state_t states[MAX_STATE] = {0};
2014
2015 if (!c)
2016 return false;
2017
2018 if (!do_lxcapi_is_running(c))
2019 return true;
2020
2021 pid = do_lxcapi_init_pid(c);
2022 if (pid <= 0)
2023 return true;
2024
2025 if (c->lxc_conf && c->lxc_conf->rebootsignal)
2026 rebootsignal = c->lxc_conf->rebootsignal;
2027
2028 /* Add a new state client before sending the shutdown signal so that we
2029 * don't miss a state.
2030 */
2031 if (timeout != 0) {
2032 states[RUNNING] = 2;
2033 ret = lxc_cmd_add_state_client(c->name, c->config_path, states,
2034 &state_client_fd);
2035 if (ret < 0)
2036 return false;
2037
2038 if (state_client_fd < 0)
2039 return false;
2040
2041 if (ret == RUNNING)
2042 return true;
2043
2044 if (ret < MAX_STATE)
2045 return false;
2046 }
2047
2048 /* Send reboot signal to container. */
2049 killret = kill(pid, rebootsignal);
2050 if (killret < 0) {
2051 if (state_client_fd >= 0)
2052 close(state_client_fd);
2053
2054 WARN("Failed to send signal %d to pid %d", rebootsignal, pid);
2055 return false;
2056 }
2057 TRACE("Sent signal %d to pid %d", rebootsignal, pid);
2058
2059 if (timeout == 0)
2060 return true;
2061
2062 ret = lxc_cmd_sock_rcv_state(state_client_fd, timeout);
2063 close(state_client_fd);
2064 if (ret < 0)
2065 return false;
2066
2067 TRACE("Received state \"%s\"", lxc_state2str(ret));
2068 if (ret != RUNNING)
2069 return false;
2070
2071 return true;
2072 }
2073
2074 WRAP_API_1(bool, lxcapi_reboot2, int)
2075
2076 static bool do_lxcapi_shutdown(struct lxc_container *c, int timeout)
2077 {
2078 int killret, ret;
2079 pid_t pid;
2080 int haltsignal = SIGPWR, state_client_fd = -EBADF;
2081 lxc_state_t states[MAX_STATE] = {0};
2082
2083 if (!c)
2084 return false;
2085
2086 if (!do_lxcapi_is_running(c))
2087 return true;
2088
2089 pid = do_lxcapi_init_pid(c);
2090 if (pid <= 0)
2091 return true;
2092
2093 /* Detect whether we should send SIGRTMIN + 3 (e.g. systemd). */
2094 if (c->lxc_conf && c->lxc_conf->haltsignal)
2095 haltsignal = c->lxc_conf->haltsignal;
2096 else if (task_blocks_signal(pid, (SIGRTMIN + 3)))
2097 haltsignal = (SIGRTMIN + 3);
2098
2099 /* Add a new state client before sending the shutdown signal so that we
2100 * don't miss a state.
2101 */
2102 if (timeout != 0) {
2103 states[STOPPED] = 1;
2104 ret = lxc_cmd_add_state_client(c->name, c->config_path, states,
2105 &state_client_fd);
2106 if (ret < 0)
2107 return false;
2108
2109 if (state_client_fd < 0)
2110 return false;
2111
2112 if (ret == STOPPED)
2113 return true;
2114
2115 if (ret < MAX_STATE)
2116 return false;
2117 }
2118
2119 /* Send shutdown signal to container. */
2120 killret = kill(pid, haltsignal);
2121 if (killret < 0) {
2122 if (state_client_fd >= 0)
2123 close(state_client_fd);
2124
2125 WARN("Failed to send signal %d to pid %d", haltsignal, pid);
2126 return false;
2127 }
2128 TRACE("Sent signal %d to pid %d", haltsignal, pid);
2129
2130 if (timeout == 0)
2131 return true;
2132
2133 ret = lxc_cmd_sock_rcv_state(state_client_fd, timeout);
2134 close(state_client_fd);
2135 if (ret < 0)
2136 return false;
2137
2138 TRACE("Received state \"%s\"", lxc_state2str(ret));
2139 if (ret != STOPPED)
2140 return false;
2141
2142 return true;
2143 }
2144
2145 WRAP_API_1(bool, lxcapi_shutdown, int)
2146
2147 static bool lxcapi_createl(struct lxc_container *c, const char *t,
2148 const char *bdevtype, struct bdev_specs *specs, int flags, ...)
2149 {
2150 bool bret = false;
2151 char **args = NULL;
2152 va_list ap;
2153
2154 if (!c)
2155 return false;
2156
2157 current_config = c->lxc_conf;
2158
2159 /*
2160 * since we're going to wait for create to finish, I don't think we
2161 * need to get a copy of the arguments.
2162 */
2163 va_start(ap, flags);
2164 args = lxc_va_arg_list_to_argv(ap, 0, 0);
2165 va_end(ap);
2166 if (!args) {
2167 ERROR("Failed to allocate memory");
2168 goto out;
2169 }
2170
2171 bret = do_lxcapi_create(c, t, bdevtype, specs, flags, args);
2172
2173 out:
2174 free(args);
2175 current_config = NULL;
2176 return bret;
2177 }
2178
2179 static void do_clear_unexp_config_line(struct lxc_conf *conf, const char *key)
2180 {
2181 if (!strcmp(key, "lxc.cgroup"))
2182 return clear_unexp_config_line(conf, key, true);
2183
2184 if (!strcmp(key, "lxc.network"))
2185 return clear_unexp_config_line(conf, key, true);
2186
2187 if (!strcmp(key, "lxc.net"))
2188 return clear_unexp_config_line(conf, key, true);
2189
2190 /* Clear a network with a specific index. */
2191 if (!strncmp(key, "lxc.net.", 8)) {
2192 int ret;
2193 const char *idx;
2194
2195 idx = key + 8;
2196 ret = lxc_safe_uint(idx, &(unsigned int){0});
2197 if (!ret)
2198 return clear_unexp_config_line(conf, key, true);
2199 }
2200
2201 if (!strcmp(key, "lxc.hook"))
2202 return clear_unexp_config_line(conf, key, true);
2203
2204 return clear_unexp_config_line(conf, key, false);
2205 }
2206
2207 static bool do_lxcapi_clear_config_item(struct lxc_container *c,
2208 const char *key)
2209 {
2210 int ret = 1;
2211 struct lxc_config_t *config;
2212
2213 if (!c || !c->lxc_conf)
2214 return false;
2215
2216 if (container_mem_lock(c))
2217 return false;
2218
2219 config = lxc_get_config(key);
2220 /* Verify that the config key exists and that it has a callback
2221 * implemented.
2222 */
2223 if (config && config->clr)
2224 ret = config->clr(key, c->lxc_conf, NULL);
2225
2226 if (!ret)
2227 do_clear_unexp_config_line(c->lxc_conf, key);
2228
2229 container_mem_unlock(c);
2230 return ret == 0;
2231 }
2232
2233 WRAP_API_1(bool, lxcapi_clear_config_item, const char *)
2234
2235 static inline bool enter_net_ns(struct lxc_container *c)
2236 {
2237 pid_t pid = do_lxcapi_init_pid(c);
2238
2239 if (pid < 0)
2240 return false;
2241
2242 if ((geteuid() != 0 || (c->lxc_conf && !lxc_list_empty(&c->lxc_conf->id_map))) &&
2243 (access("/proc/self/ns/user", F_OK) == 0))
2244 if (!switch_to_ns(pid, "user"))
2245 return false;
2246
2247 return switch_to_ns(pid, "net");
2248 }
2249
2250 /* Used by qsort and bsearch functions for comparing names. */
2251 static inline int string_cmp(char **first, char **second)
2252 {
2253 return strcmp(*first, *second);
2254 }
2255
2256 /* Used by qsort and bsearch functions for comparing container names. */
2257 static inline int container_cmp(struct lxc_container **first,
2258 struct lxc_container **second)
2259 {
2260 return strcmp((*first)->name, (*second)->name);
2261 }
2262
2263 static bool add_to_array(char ***names, char *cname, int pos)
2264 {
2265 char **newnames = realloc(*names, (pos+1) * sizeof(char *));
2266 if (!newnames) {
2267 ERROR("Out of memory");
2268 return false;
2269 }
2270
2271 *names = newnames;
2272 newnames[pos] = strdup(cname);
2273 if (!newnames[pos])
2274 return false;
2275
2276 /* Sort the array as we will use binary search on it. */
2277 qsort(newnames, pos + 1, sizeof(char *),
2278 (int (*)(const void *, const void *))string_cmp);
2279
2280 return true;
2281 }
2282
2283 static bool add_to_clist(struct lxc_container ***list, struct lxc_container *c,
2284 int pos, bool sort)
2285 {
2286 struct lxc_container **newlist = realloc(*list, (pos + 1) * sizeof(struct lxc_container *));
2287 if (!newlist) {
2288 ERROR("Out of memory");
2289 return false;
2290 }
2291
2292 *list = newlist;
2293 newlist[pos] = c;
2294
2295 /* Sort the array as we will use binary search on it. */
2296 if (sort)
2297 qsort(newlist, pos + 1, sizeof(struct lxc_container *),
2298 (int (*)(const void *, const void *))container_cmp);
2299
2300 return true;
2301 }
2302
2303 static char** get_from_array(char ***names, char *cname, int size)
2304 {
2305 return (char **)bsearch(&cname, *names, size, sizeof(char *), (int (*)(const void *, const void *))string_cmp);
2306 }
2307
2308 static bool array_contains(char ***names, char *cname, int size)
2309 {
2310 if(get_from_array(names, cname, size) != NULL)
2311 return true;
2312
2313 return false;
2314 }
2315
2316 static bool remove_from_array(char ***names, char *cname, int size)
2317 {
2318 char **result = get_from_array(names, cname, size);
2319 if (result != NULL) {
2320 free(result);
2321 return true;
2322 }
2323
2324 return false;
2325 }
2326
2327 static char **do_lxcapi_get_interfaces(struct lxc_container *c)
2328 {
2329 pid_t pid;
2330 int i, count = 0, pipefd[2];
2331 char **interfaces = NULL;
2332 char interface[IFNAMSIZ];
2333
2334 if (pipe2(pipefd, O_CLOEXEC) < 0)
2335 return NULL;
2336
2337 pid = fork();
2338 if (pid < 0) {
2339 SYSERROR("Failed to fork task to get interfaces information");
2340 close(pipefd[0]);
2341 close(pipefd[1]);
2342 return NULL;
2343 }
2344
2345 if (pid == 0) { /* child */
2346 int ret = 1, nbytes;
2347 struct netns_ifaddrs *interfaceArray = NULL, *tempIfAddr = NULL;
2348
2349 /* close the read-end of the pipe */
2350 close(pipefd[0]);
2351
2352 if (!enter_net_ns(c)) {
2353 SYSERROR("Failed to enter network namespace");
2354 goto out;
2355 }
2356
2357 /* Grab the list of interfaces */
2358 if (netns_getifaddrs(&interfaceArray, -1, &(bool){false})) {
2359 SYSERROR("Failed to get interfaces list");
2360 goto out;
2361 }
2362
2363 /* Iterate through the interfaces */
2364 for (tempIfAddr = interfaceArray; tempIfAddr != NULL;
2365 tempIfAddr = tempIfAddr->ifa_next) {
2366 nbytes = lxc_write_nointr(pipefd[1], tempIfAddr->ifa_name, IFNAMSIZ);
2367 if (nbytes < 0)
2368 goto out;
2369
2370 count++;
2371 }
2372
2373 ret = 0;
2374
2375 out:
2376 if (interfaceArray)
2377 netns_freeifaddrs(interfaceArray);
2378
2379 /* close the write-end of the pipe, thus sending EOF to the reader */
2380 close(pipefd[1]);
2381 _exit(ret);
2382 }
2383
2384 /* close the write-end of the pipe */
2385 close(pipefd[1]);
2386
2387 while (lxc_read_nointr(pipefd[0], &interface, IFNAMSIZ) == IFNAMSIZ) {
2388 interface[IFNAMSIZ - 1] = '\0';
2389
2390 if (array_contains(&interfaces, interface, count))
2391 continue;
2392
2393 if (!add_to_array(&interfaces, interface, count))
2394 ERROR("Failed to add \"%s\" to array", interface);
2395
2396 count++;
2397 }
2398
2399 if (wait_for_pid(pid) != 0) {
2400 for (i = 0; i < count; i++)
2401 free(interfaces[i]);
2402
2403 free(interfaces);
2404 interfaces = NULL;
2405 }
2406
2407 /* close the read-end of the pipe */
2408 close(pipefd[0]);
2409
2410 /* Append NULL to the array */
2411 if (interfaces)
2412 interfaces = (char **)lxc_append_null_to_array((void **)interfaces, count);
2413
2414 return interfaces;
2415 }
2416
2417 WRAP_API(char **, lxcapi_get_interfaces)
2418
2419 static char **do_lxcapi_get_ips(struct lxc_container *c, const char *interface,
2420 const char *family, int scope)
2421 {
2422 int i, ret;
2423 pid_t pid;
2424 int pipefd[2];
2425 char address[INET6_ADDRSTRLEN];
2426 int count = 0;
2427 char **addresses = NULL;
2428
2429 ret = pipe2(pipefd, O_CLOEXEC);
2430 if (ret < 0) {
2431 SYSERROR("Failed to create pipe");
2432 return NULL;
2433 }
2434
2435 pid = fork();
2436 if (pid < 0) {
2437 SYSERROR("Failed to create new process");
2438 close(pipefd[0]);
2439 close(pipefd[1]);
2440 return NULL;
2441 }
2442
2443 if (pid == 0) {
2444 ssize_t nbytes;
2445 char addressOutputBuffer[INET6_ADDRSTRLEN];
2446 char *address_ptr = NULL;
2447 void *tempAddrPtr = NULL;
2448 struct netns_ifaddrs *interfaceArray = NULL, *tempIfAddr = NULL;
2449
2450 /* close the read-end of the pipe */
2451 close(pipefd[0]);
2452
2453 if (!enter_net_ns(c)) {
2454 SYSERROR("Failed to attach to network namespace");
2455 goto out;
2456 }
2457
2458 /* Grab the list of interfaces */
2459 if (netns_getifaddrs(&interfaceArray, -1, &(bool){false})) {
2460 SYSERROR("Failed to get interfaces list");
2461 goto out;
2462 }
2463
2464 /* Iterate through the interfaces */
2465 for (tempIfAddr = interfaceArray; tempIfAddr;
2466 tempIfAddr = tempIfAddr->ifa_next) {
2467 if (tempIfAddr->ifa_addr == NULL)
2468 continue;
2469
2470 #pragma GCC diagnostic push
2471 #pragma GCC diagnostic ignored "-Wcast-align"
2472
2473 if (tempIfAddr->ifa_addr->sa_family == AF_INET) {
2474 if (family && strcmp(family, "inet"))
2475 continue;
2476
2477 tempAddrPtr = &((struct sockaddr_in *)tempIfAddr->ifa_addr)->sin_addr;
2478 } else {
2479 if (family && strcmp(family, "inet6"))
2480 continue;
2481
2482 if (((struct sockaddr_in6 *)tempIfAddr->ifa_addr)->sin6_scope_id != scope)
2483 continue;
2484
2485 tempAddrPtr = &((struct sockaddr_in6 *)tempIfAddr->ifa_addr)->sin6_addr;
2486 }
2487
2488 #pragma GCC diagnostic pop
2489
2490 if (interface && strcmp(interface, tempIfAddr->ifa_name))
2491 continue;
2492 else if (!interface && strcmp("lo", tempIfAddr->ifa_name) == 0)
2493 continue;
2494
2495 address_ptr = (char *)inet_ntop(tempIfAddr->ifa_addr->sa_family,
2496 tempAddrPtr, addressOutputBuffer,
2497 sizeof(addressOutputBuffer));
2498 if (!address_ptr)
2499 continue;
2500
2501 nbytes = lxc_write_nointr(pipefd[1], address_ptr, INET6_ADDRSTRLEN);
2502 if (nbytes != INET6_ADDRSTRLEN) {
2503 SYSERROR("Failed to send ipv6 address \"%s\"",
2504 address_ptr);
2505 goto out;
2506 }
2507
2508 count++;
2509 }
2510
2511 ret = 0;
2512
2513 out:
2514 if (interfaceArray)
2515 netns_freeifaddrs(interfaceArray);
2516
2517 /* close the write-end of the pipe, thus sending EOF to the reader */
2518 close(pipefd[1]);
2519 _exit(ret);
2520 }
2521
2522 /* close the write-end of the pipe */
2523 close(pipefd[1]);
2524
2525 while (lxc_read_nointr(pipefd[0], &address, INET6_ADDRSTRLEN) == INET6_ADDRSTRLEN) {
2526 address[INET6_ADDRSTRLEN - 1] = '\0';
2527
2528 if (!add_to_array(&addresses, address, count))
2529 ERROR("PARENT: add_to_array failed");
2530
2531 count++;
2532 }
2533
2534 if (wait_for_pid(pid) != 0) {
2535 for (i = 0; i < count; i++)
2536 free(addresses[i]);
2537
2538 free(addresses);
2539 addresses = NULL;
2540 }
2541
2542 /* close the read-end of the pipe */
2543 close(pipefd[0]);
2544
2545 /* Append NULL to the array */
2546 if (addresses)
2547 addresses = (char **)lxc_append_null_to_array((void **)addresses, count);
2548
2549 return addresses;
2550 }
2551
2552 WRAP_API_3(char **, lxcapi_get_ips, const char *, const char *, int)
2553
2554 static int do_lxcapi_get_config_item(struct lxc_container *c, const char *key, char *retv, int inlen)
2555 {
2556 int ret = -1;
2557 struct lxc_config_t *config;
2558
2559 if (!c || !c->lxc_conf)
2560 return -1;
2561
2562 if (container_mem_lock(c))
2563 return -1;
2564
2565 config = lxc_get_config(key);
2566 /* Verify that the config key exists and that it has a callback
2567 * implemented.
2568 */
2569 if (config && config->get)
2570 ret = config->get(key, retv, inlen, c->lxc_conf, NULL);
2571
2572 container_mem_unlock(c);
2573 return ret;
2574 }
2575
2576 WRAP_API_3(int, lxcapi_get_config_item, const char *, char *, int)
2577
2578 static char* do_lxcapi_get_running_config_item(struct lxc_container *c, const char *key)
2579 {
2580 char *ret;
2581
2582 if (!c || !c->lxc_conf)
2583 return NULL;
2584
2585 if (container_mem_lock(c))
2586 return NULL;
2587
2588 ret = lxc_cmd_get_config_item(c->name, key, do_lxcapi_get_config_path(c));
2589 container_mem_unlock(c);
2590 return ret;
2591 }
2592
2593 WRAP_API_1(char *, lxcapi_get_running_config_item, const char *)
2594
2595 static int do_lxcapi_get_keys(struct lxc_container *c, const char *key, char *retv, int inlen)
2596 {
2597 int ret = -1;
2598
2599 /* List all config items. */
2600 if (!key)
2601 return lxc_list_config_items(retv, inlen);
2602
2603 if (!c || !c->lxc_conf)
2604 return -1;
2605
2606 if (container_mem_lock(c))
2607 return -1;
2608
2609 /* Support 'lxc.net.<idx>', i.e. 'lxc.net.0'
2610 * This is an intelligent result to show which keys are valid given the
2611 * type of nic it is.
2612 */
2613 if (strncmp(key, "lxc.net.", 8) == 0)
2614 ret = lxc_list_net(c->lxc_conf, key, retv, inlen);
2615 else
2616 ret = lxc_list_subkeys(c->lxc_conf, key, retv, inlen);
2617
2618 container_mem_unlock(c);
2619 return ret;
2620 }
2621
2622 WRAP_API_3(int, lxcapi_get_keys, const char *, char *, int)
2623
2624 static bool do_lxcapi_save_config(struct lxc_container *c, const char *alt_file)
2625 {
2626 int fd, lret;
2627 bool ret = false, need_disklock = false;
2628
2629 if (!alt_file)
2630 alt_file = c->configfile;
2631
2632 if (!alt_file)
2633 return false;
2634
2635 /* If we haven't yet loaded a config, load the stock config. */
2636 if (!c->lxc_conf) {
2637 if (!do_lxcapi_load_config(c, lxc_global_config_value("lxc.default_config"))) {
2638 ERROR("Error loading default configuration file %s "
2639 "while saving %s",
2640 lxc_global_config_value("lxc.default_config"),
2641 c->name);
2642 return false;
2643 }
2644 }
2645
2646 if (!create_container_dir(c))
2647 return false;
2648
2649 /* If we're writing to the container's config file, take the disk lock.
2650 * Otherwise just take the memlock to protect the struct lxc_container
2651 * while we're traversing it.
2652 */
2653 if (strcmp(c->configfile, alt_file) == 0)
2654 need_disklock = true;
2655
2656 if (need_disklock)
2657 lret = container_disk_lock(c);
2658 else
2659 lret = container_mem_lock(c);
2660 if (lret)
2661 return false;
2662
2663 fd = open(alt_file, O_WRONLY | O_CREAT | O_TRUNC | O_CLOEXEC,
2664 S_IRUSR | S_IWUSR | S_IRGRP | S_IWGRP);
2665 if (fd < 0)
2666 goto on_error;
2667
2668 lret = write_config(fd, c->lxc_conf);
2669 close(fd);
2670 if (lret < 0)
2671 goto on_error;
2672
2673 ret = true;
2674
2675 on_error:
2676 if (need_disklock)
2677 container_disk_unlock(c);
2678 else
2679 container_mem_unlock(c);
2680
2681 return ret;
2682 }
2683
2684 WRAP_API_1(bool, lxcapi_save_config, const char *)
2685
2686
2687 static bool mod_rdep(struct lxc_container *c0, struct lxc_container *c, bool inc)
2688 {
2689 FILE *f1;
2690 struct stat fbuf;
2691 void *buf = NULL;
2692 char *del = NULL;
2693 char path[PATH_MAX];
2694 char newpath[PATH_MAX];
2695 int fd, ret, n = 0, v = 0;
2696 bool bret = false;
2697 size_t len = 0, bytes = 0;
2698
2699 if (container_disk_lock(c0))
2700 return false;
2701
2702 ret = snprintf(path, PATH_MAX, "%s/%s/lxc_snapshots", c0->config_path, c0->name);
2703 if (ret < 0 || ret > PATH_MAX)
2704 goto out;
2705
2706 ret = snprintf(newpath, PATH_MAX, "%s\n%s\n", c->config_path, c->name);
2707 if (ret < 0 || ret > PATH_MAX)
2708 goto out;
2709
2710 /* If we find an lxc-snapshot file using the old format only listing the
2711 * number of snapshots we will keep using it. */
2712 f1 = fopen(path, "r");
2713 if (f1) {
2714 n = fscanf(f1, "%d", &v);
2715 fclose(f1);
2716 if (n == 1 && v == 0) {
2717 ret = remove(path);
2718 if (ret < 0)
2719 SYSERROR("Failed to remove \"%s\"", path);
2720
2721 n = 0;
2722 }
2723 }
2724
2725 if (n == 1) {
2726 v += inc ? 1 : -1;
2727 f1 = fopen(path, "w");
2728 if (!f1)
2729 goto out;
2730
2731 if (fprintf(f1, "%d\n", v) < 0) {
2732 ERROR("Error writing new snapshots value");
2733 fclose(f1);
2734 goto out;
2735 }
2736
2737 ret = fclose(f1);
2738 if (ret != 0) {
2739 SYSERROR("Error writing to or closing snapshots file");
2740 goto out;
2741 }
2742 } else {
2743 /* Here we know that we have or can use an lxc-snapshot file
2744 * using the new format. */
2745 if (inc) {
2746 f1 = fopen(path, "a");
2747 if (!f1)
2748 goto out;
2749
2750 if (fprintf(f1, "%s", newpath) < 0) {
2751 ERROR("Error writing new snapshots entry");
2752 ret = fclose(f1);
2753 if (ret != 0)
2754 SYSERROR("Error writing to or closing snapshots file");
2755 goto out;
2756 }
2757
2758 ret = fclose(f1);
2759 if (ret != 0) {
2760 SYSERROR("Error writing to or closing snapshots file");
2761 goto out;
2762 }
2763 } else if (!inc) {
2764 if ((fd = open(path, O_RDWR | O_CLOEXEC)) < 0)
2765 goto out;
2766
2767 if (fstat(fd, &fbuf) < 0) {
2768 close(fd);
2769 goto out;
2770 }
2771
2772 if (fbuf.st_size != 0) {
2773 buf = lxc_strmmap(NULL, fbuf.st_size, PROT_READ | PROT_WRITE, MAP_SHARED, fd, 0);
2774 if (buf == MAP_FAILED) {
2775 SYSERROR("Failed to create mapping %s", path);
2776 close(fd);
2777 goto out;
2778 }
2779
2780 len = strlen(newpath);
2781 while ((del = strstr((char *)buf, newpath))) {
2782 memmove(del, del + len, strlen(del) - len + 1);
2783 bytes += len;
2784 }
2785
2786 lxc_strmunmap(buf, fbuf.st_size);
2787 if (ftruncate(fd, fbuf.st_size - bytes) < 0) {
2788 SYSERROR("Failed to truncate file %s", path);
2789 close(fd);
2790 goto out;
2791 }
2792 }
2793
2794 close(fd);
2795 }
2796
2797 /* If the lxc-snapshot file is empty, remove it. */
2798 if (stat(path, &fbuf) < 0)
2799 goto out;
2800
2801 if (!fbuf.st_size) {
2802 ret = remove(path);
2803 if (ret < 0)
2804 SYSERROR("Failed to remove \"%s\"", path);
2805 }
2806 }
2807
2808 bret = true;
2809
2810 out:
2811 container_disk_unlock(c0);
2812 return bret;
2813 }
2814
2815 void mod_all_rdeps(struct lxc_container *c, bool inc)
2816 {
2817 struct lxc_container *p;
2818 char *lxcpath = NULL, *lxcname = NULL, path[PATH_MAX];
2819 size_t pathlen = 0, namelen = 0;
2820 FILE *f;
2821 int ret;
2822
2823 ret = snprintf(path, PATH_MAX, "%s/%s/lxc_rdepends",
2824 c->config_path, c->name);
2825 if (ret < 0 || ret >= PATH_MAX) {
2826 ERROR("Path name too long");
2827 return;
2828 }
2829
2830 f = fopen(path, "r");
2831 if (f == NULL)
2832 return;
2833
2834 while (getline(&lxcpath, &pathlen, f) != -1) {
2835 if (getline(&lxcname, &namelen, f) == -1) {
2836 ERROR("badly formatted file %s", path);
2837 goto out;
2838 }
2839
2840 remove_trailing_newlines(lxcpath);
2841 remove_trailing_newlines(lxcname);
2842
2843 if ((p = lxc_container_new(lxcname, lxcpath)) == NULL) {
2844 ERROR("Unable to find dependent container %s:%s",
2845 lxcpath, lxcname);
2846 continue;
2847 }
2848
2849 if (!mod_rdep(p, c, inc))
2850 ERROR("Failed to update snapshots file for %s:%s",
2851 lxcpath, lxcname);
2852
2853 lxc_container_put(p);
2854 }
2855
2856 out:
2857 free(lxcpath);
2858 free(lxcname);
2859 fclose(f);
2860 }
2861
2862 static bool has_fs_snapshots(struct lxc_container *c)
2863 {
2864 FILE *f;
2865 char path[PATH_MAX];
2866 int ret, v;
2867 struct stat fbuf;
2868 bool bret = false;
2869
2870 ret = snprintf(path, PATH_MAX, "%s/%s/lxc_snapshots", c->config_path,
2871 c->name);
2872 if (ret < 0 || ret > PATH_MAX)
2873 goto out;
2874
2875 /* If the file doesn't exist there are no snapshots. */
2876 if (stat(path, &fbuf) < 0)
2877 goto out;
2878
2879 v = fbuf.st_size;
2880 if (v != 0) {
2881 f = fopen(path, "r");
2882 if (!f)
2883 goto out;
2884
2885 ret = fscanf(f, "%d", &v);
2886 fclose(f);
2887 /* TODO: Figure out what to do with the return value of fscanf. */
2888 if (ret != 1)
2889 INFO("Container uses new lxc-snapshots format %s", path);
2890 }
2891
2892 bret = v != 0;
2893
2894 out:
2895 return bret;
2896 }
2897
2898 static bool has_snapshots(struct lxc_container *c)
2899 {
2900 char path[PATH_MAX];
2901 struct dirent *direntp;
2902 int count=0;
2903 DIR *dir;
2904
2905 if (!get_snappath_dir(c, path))
2906 return false;
2907
2908 dir = opendir(path);
2909 if (!dir)
2910 return false;
2911
2912 while ((direntp = readdir(dir))) {
2913 if (!strcmp(direntp->d_name, "."))
2914 continue;
2915
2916 if (!strcmp(direntp->d_name, ".."))
2917 continue;
2918 count++;
2919 break;
2920 }
2921
2922 closedir(dir);
2923 return count > 0;
2924 }
2925
2926 static bool do_destroy_container(struct lxc_conf *conf) {
2927 int ret;
2928
2929 if (am_guest_unpriv()) {
2930 ret = userns_exec_full(conf, storage_destroy_wrapper, conf,
2931 "storage_destroy_wrapper");
2932 if (ret < 0)
2933 return false;
2934
2935 return true;
2936 }
2937
2938 return storage_destroy(conf);
2939 }
2940
2941 static int lxc_rmdir_onedev_wrapper(void *data)
2942 {
2943 char *arg = (char *) data;
2944 return lxc_rmdir_onedev(arg, "snaps");
2945 }
2946
2947 static int lxc_unlink_exec_wrapper(void *data)
2948 {
2949 char *arg = data;
2950 return unlink(arg);
2951 }
2952
2953 static bool container_destroy(struct lxc_container *c,
2954 struct lxc_storage *storage)
2955 {
2956 const char *p1;
2957 size_t len;
2958 struct lxc_conf *conf;
2959 char *path = NULL;
2960 bool bret = false;
2961 int ret = 0;
2962
2963 if (!c || !do_lxcapi_is_defined(c))
2964 return false;
2965
2966 conf = c->lxc_conf;
2967 if (container_disk_lock(c))
2968 return false;
2969
2970 if (!is_stopped(c)) {
2971 /* We should queue some sort of error - in c->error_string? */
2972 ERROR("container %s is not stopped", c->name);
2973 goto out;
2974 }
2975
2976 if (conf && !lxc_list_empty(&conf->hooks[LXCHOOK_DESTROY])) {
2977 /* Start of environment variable setup for hooks */
2978 if (setenv("LXC_NAME", c->name, 1))
2979 SYSERROR("Failed to set environment variable for container name");
2980
2981 if (conf->rcfile && setenv("LXC_CONFIG_FILE", conf->rcfile, 1))
2982 SYSERROR("Failed to set environment variable for config path");
2983
2984 if (conf->rootfs.mount && setenv("LXC_ROOTFS_MOUNT", conf->rootfs.mount, 1))
2985 SYSERROR("Failed to set environment variable for rootfs mount");
2986
2987 if (conf->rootfs.path && setenv("LXC_ROOTFS_PATH", conf->rootfs.path, 1))
2988 SYSERROR("Failed to set environment variable for rootfs mount");
2989
2990 if (conf->console.path && setenv("LXC_CONSOLE", conf->console.path, 1))
2991 SYSERROR("Failed to set environment variable for console path");
2992
2993 if (conf->console.log_path && setenv("LXC_CONSOLE_LOGPATH", conf->console.log_path, 1))
2994 SYSERROR("Failed to set environment variable for console log");
2995 /* End of environment variable setup for hooks */
2996
2997 if (run_lxc_hooks(c->name, "destroy", conf, NULL)) {
2998 ERROR("Failed to execute clone hook for \"%s\"", c->name);
2999 goto out;
3000 }
3001 }
3002
3003 if (current_config && conf == current_config) {
3004 current_config = NULL;
3005
3006 if (conf->logfd != -1) {
3007 close(conf->logfd);
3008 conf->logfd = -1;
3009 }
3010 }
3011
3012 /* LXC is not managing the storage of the container. */
3013 if (conf && !conf->rootfs.managed)
3014 goto on_success;
3015
3016 if (conf && conf->rootfs.path && conf->rootfs.mount) {
3017 if (!do_destroy_container(conf)) {
3018 ERROR("Error destroying rootfs for %s", c->name);
3019 goto out;
3020 }
3021 INFO("Destroyed rootfs for %s", c->name);
3022 }
3023
3024 mod_all_rdeps(c, false);
3025
3026 p1 = do_lxcapi_get_config_path(c);
3027 /* strlen(p1)
3028 * +
3029 * /
3030 * +
3031 * strlen(c->name)
3032 * +
3033 * /
3034 * +
3035 * strlen("config") = 6
3036 * +
3037 * \0
3038 */
3039 len = strlen(p1) + 1 + strlen(c->name) + 1 + 6 + 1;
3040 path = malloc(len);
3041 if (!path) {
3042 ERROR("Failed to allocate memory");
3043 goto out;
3044 }
3045
3046 /* For an overlay container the rootfs is considered immutable and
3047 * cannot be removed when restoring from a snapshot.
3048 */
3049 if (storage && (!strcmp(storage->type, "overlay") ||
3050 !strcmp(storage->type, "overlayfs")) &&
3051 (storage->flags & LXC_STORAGE_INTERNAL_OVERLAY_RESTORE)) {
3052 ret = snprintf(path, len, "%s/%s/config", p1, c->name);
3053 if (ret < 0 || (size_t)ret >= len)
3054 goto out;
3055
3056 if (am_guest_unpriv())
3057 ret = userns_exec_1(conf, lxc_unlink_exec_wrapper, path,
3058 "lxc_unlink_exec_wrapper");
3059 else
3060 ret = unlink(path);
3061 if (ret < 0) {
3062 SYSERROR("Failed to destroy config file \"%s\" for \"%s\"",
3063 path, c->name);
3064 goto out;
3065 }
3066 INFO("Destroyed config file \"%s\" for \"%s\"", path, c->name);
3067
3068 bret = true;
3069 goto out;
3070 }
3071
3072 ret = snprintf(path, len, "%s/%s", p1, c->name);
3073 if (ret < 0 || (size_t)ret >= len)
3074 goto out;
3075
3076 if (am_guest_unpriv())
3077 ret = userns_exec_full(conf, lxc_rmdir_onedev_wrapper, path,
3078 "lxc_rmdir_onedev_wrapper");
3079 else
3080 ret = lxc_rmdir_onedev(path, "snaps");
3081 if (ret < 0) {
3082 ERROR("Failed to destroy directory \"%s\" for \"%s\"", path,
3083 c->name);
3084 goto out;
3085 }
3086 INFO("Destroyed directory \"%s\" for \"%s\"", path, c->name);
3087
3088 on_success:
3089 bret = true;
3090
3091 out:
3092 if (path)
3093 free(path);
3094
3095 container_disk_unlock(c);
3096 return bret;
3097 }
3098
3099 static bool do_lxcapi_destroy(struct lxc_container *c)
3100 {
3101 if (!c || !lxcapi_is_defined(c))
3102 return false;
3103
3104 if (c->lxc_conf && c->lxc_conf->rootfs.managed) {
3105 if (has_snapshots(c)) {
3106 ERROR("Container %s has snapshots; not removing", c->name);
3107 return false;
3108 }
3109
3110 if (has_fs_snapshots(c)) {
3111 ERROR("container %s has snapshots on its rootfs", c->name);
3112 return false;
3113 }
3114 }
3115
3116 return container_destroy(c, NULL);
3117 }
3118
3119 WRAP_API(bool, lxcapi_destroy)
3120
3121 static bool do_lxcapi_destroy_with_snapshots(struct lxc_container *c)
3122 {
3123 if (!c || !lxcapi_is_defined(c))
3124 return false;
3125
3126 if (!lxcapi_snapshot_destroy_all(c)) {
3127 ERROR("Error deleting all snapshots");
3128 return false;
3129 }
3130
3131 return lxcapi_destroy(c);
3132 }
3133
3134 WRAP_API(bool, lxcapi_destroy_with_snapshots)
3135
3136 int lxc_set_config_item_locked(struct lxc_conf *conf, const char *key,
3137 const char *v)
3138 {
3139 int ret;
3140 struct lxc_config_t *config;
3141 bool bret = true;
3142
3143 config = lxc_get_config(key);
3144 if (!config)
3145 return -EINVAL;
3146
3147 ret = config->set(key, v, conf, NULL);
3148 if (ret < 0)
3149 return -EINVAL;
3150
3151 if (lxc_config_value_empty(v))
3152 do_clear_unexp_config_line(conf, key);
3153 else
3154 bret = do_append_unexp_config_line(conf, key, v);
3155 if (!bret)
3156 return -ENOMEM;
3157
3158 return 0;
3159 }
3160
3161 static bool do_set_config_item_locked(struct lxc_container *c, const char *key,
3162 const char *v)
3163 {
3164 int ret;
3165
3166 if (!c->lxc_conf)
3167 c->lxc_conf = lxc_conf_init();
3168
3169 if (!c->lxc_conf)
3170 return false;
3171
3172 ret = lxc_set_config_item_locked(c->lxc_conf, key, v);
3173 if (ret < 0)
3174 return false;
3175
3176 return true;
3177 }
3178
3179 static bool do_lxcapi_set_config_item(struct lxc_container *c, const char *key, const char *v)
3180 {
3181 bool b = false;
3182
3183 if (!c)
3184 return false;
3185
3186 if (container_mem_lock(c))
3187 return false;
3188
3189 b = do_set_config_item_locked(c, key, v);
3190
3191 container_mem_unlock(c);
3192 return b;
3193 }
3194
3195 WRAP_API_2(bool, lxcapi_set_config_item, const char *, const char *)
3196
3197 static char *lxcapi_config_file_name(struct lxc_container *c)
3198 {
3199 if (!c || !c->configfile)
3200 return NULL;
3201
3202 return strdup(c->configfile);
3203 }
3204
3205 static const char *lxcapi_get_config_path(struct lxc_container *c)
3206 {
3207 if (!c || !c->config_path)
3208 return NULL;
3209
3210 return (const char *)(c->config_path);
3211 }
3212
3213 /*
3214 * not for export
3215 * Just recalculate the c->configfile based on the
3216 * c->config_path, which must be set.
3217 * The lxc_container must be locked or not yet public.
3218 */
3219 static bool set_config_filename(struct lxc_container *c)
3220 {
3221 char *newpath;
3222 int len, ret;
3223
3224 if (!c->config_path)
3225 return false;
3226
3227 /* $lxc_path + "/" + c->name + "/" + "config" + '\0' */
3228 len = strlen(c->config_path) + strlen(c->name) + strlen("config") + 3;
3229 newpath = malloc(len);
3230 if (!newpath)
3231 return false;
3232
3233 ret = snprintf(newpath, len, "%s/%s/config", c->config_path, c->name);
3234 if (ret < 0 || ret >= len) {
3235 fprintf(stderr, "Error printing out config file name\n");
3236 free(newpath);
3237 return false;
3238 }
3239
3240 free(c->configfile);
3241 c->configfile = newpath;
3242
3243 return true;
3244 }
3245
3246 static bool do_lxcapi_set_config_path(struct lxc_container *c, const char *path)
3247 {
3248 char *p;
3249 bool b = false;
3250 char *oldpath = NULL;
3251
3252 if (!c)
3253 return b;
3254
3255 if (container_mem_lock(c))
3256 return b;
3257
3258 p = strdup(path);
3259 if (!p) {
3260 ERROR("Out of memory setting new lxc path");
3261 goto err;
3262 }
3263
3264 b = true;
3265 if (c->config_path)
3266 oldpath = c->config_path;
3267 c->config_path = p;
3268
3269 /* Since we've changed the config path, we have to change the
3270 * config file name too */
3271 if (!set_config_filename(c)) {
3272 ERROR("Out of memory setting new config filename");
3273 b = false;
3274 free(c->config_path);
3275 c->config_path = oldpath;
3276 oldpath = NULL;
3277 }
3278
3279 err:
3280 free(oldpath);
3281 container_mem_unlock(c);
3282 return b;
3283 }
3284
3285 WRAP_API_1(bool, lxcapi_set_config_path, const char *)
3286
3287 static bool do_lxcapi_set_cgroup_item(struct lxc_container *c, const char *subsys, const char *value)
3288 {
3289 int ret;
3290 struct cgroup_ops *cgroup_ops;
3291
3292 if (!c)
3293 return false;
3294
3295 if (is_stopped(c))
3296 return false;
3297
3298 cgroup_ops = cgroup_init(c->lxc_conf);
3299 if (!cgroup_ops)
3300 return false;
3301
3302 ret = cgroup_ops->set(cgroup_ops, subsys, value, c->name, c->config_path);
3303
3304 cgroup_exit(cgroup_ops);
3305
3306 return ret == 0;
3307 }
3308
3309 WRAP_API_2(bool, lxcapi_set_cgroup_item, const char *, const char *)
3310
3311 static int do_lxcapi_get_cgroup_item(struct lxc_container *c, const char *subsys, char *retv, int inlen)
3312 {
3313 int ret;
3314 struct cgroup_ops *cgroup_ops;
3315
3316 if (!c)
3317 return -1;
3318
3319 if (is_stopped(c))
3320 return -1;
3321
3322 cgroup_ops = cgroup_init(c->lxc_conf);
3323 if (!cgroup_ops)
3324 return -1;
3325
3326 ret = cgroup_ops->get(cgroup_ops, subsys, retv, inlen, c->name,
3327 c->config_path);
3328
3329 cgroup_exit(cgroup_ops);
3330
3331 return ret;
3332 }
3333
3334 WRAP_API_3(int, lxcapi_get_cgroup_item, const char *, char *, int)
3335
3336 const char *lxc_get_global_config_item(const char *key)
3337 {
3338 return lxc_global_config_value(key);
3339 }
3340
3341 const char *lxc_get_version(void)
3342 {
3343 return LXC_VERSION;
3344 }
3345
3346 static int copy_file(const char *old, const char *new)
3347 {
3348 int in, out;
3349 ssize_t len, ret;
3350 char buf[8096];
3351 struct stat sbuf;
3352
3353 if (file_exists(new)) {
3354 ERROR("copy destination %s exists", new);
3355 return -1;
3356 }
3357
3358 ret = stat(old, &sbuf);
3359 if (ret < 0) {
3360 INFO("Error stat'ing %s", old);
3361 return -1;
3362 }
3363
3364 in = open(old, O_RDONLY);
3365 if (in < 0) {
3366 SYSERROR("Error opening original file %s", old);
3367 return -1;
3368 }
3369
3370 out = open(new, O_CREAT | O_EXCL | O_WRONLY, 0644);
3371 if (out < 0) {
3372 SYSERROR("Error opening new file %s", new);
3373 close(in);
3374 return -1;
3375 }
3376
3377 for (;;) {
3378 len = lxc_read_nointr(in, buf, 8096);
3379 if (len < 0) {
3380 SYSERROR("Error reading old file %s", old);
3381 goto err;
3382 }
3383
3384 if (len == 0)
3385 break;
3386
3387 ret = lxc_write_nointr(out, buf, len);
3388 if (ret < len) { /* should we retry? */
3389 SYSERROR("Error: write to new file %s was interrupted", new);
3390 goto err;
3391 }
3392 }
3393
3394 close(in);
3395 close(out);
3396
3397 /* We set mode, but not owner/group. */
3398 ret = chmod(new, sbuf.st_mode);
3399 if (ret) {
3400 SYSERROR("Error setting mode on %s", new);
3401 return -1;
3402 }
3403
3404 return 0;
3405
3406 err:
3407 close(in);
3408 close(out);
3409 return -1;
3410 }
3411
3412 static int copyhooks(struct lxc_container *oldc, struct lxc_container *c)
3413 {
3414 __do_free char *cpath = NULL;
3415 int i, len, ret;
3416 struct lxc_list *it;
3417
3418 len = strlen(oldc->config_path) + strlen(oldc->name) + 3;
3419 cpath = must_realloc(NULL, len);
3420 ret = snprintf(cpath, len, "%s/%s/", oldc->config_path, oldc->name);
3421 if (ret < 0 || ret >= len)
3422 return -1;
3423
3424 for (i=0; i<NUM_LXC_HOOKS; i++) {
3425 lxc_list_for_each(it, &c->lxc_conf->hooks[i]) {
3426 char *hookname = it->elem;
3427 char *fname = strrchr(hookname, '/');
3428 char tmppath[PATH_MAX];
3429 if (!fname) /* relative path - we don't support, but maybe we should */
3430 return 0;
3431
3432 if (strncmp(hookname, cpath, len - 1) != 0) {
3433 /* this hook is public - ignore */
3434 continue;
3435 }
3436
3437 /* copy the script, and change the entry in confile */
3438 ret = snprintf(tmppath, PATH_MAX, "%s/%s/%s",
3439 c->config_path, c->name, fname+1);
3440 if (ret < 0 || ret >= PATH_MAX)
3441 return -1;
3442
3443 ret = copy_file(it->elem, tmppath);
3444 if (ret < 0)
3445 return -1;
3446
3447 free(it->elem);
3448
3449 it->elem = strdup(tmppath);
3450 if (!it->elem) {
3451 ERROR("out of memory copying hook path");
3452 return -1;
3453 }
3454 }
3455 }
3456
3457 if (!clone_update_unexp_hooks(c->lxc_conf, oldc->config_path,
3458 c->config_path, oldc->name, c->name)) {
3459 ERROR("Error saving new hooks in clone");
3460 return -1;
3461 }
3462
3463 do_lxcapi_save_config(c, NULL);
3464 return 0;
3465 }
3466
3467
3468 static int copy_fstab(struct lxc_container *oldc, struct lxc_container *c)
3469 {
3470 char newpath[PATH_MAX];
3471 char *oldpath = oldc->lxc_conf->fstab;
3472 int ret;
3473
3474 if (!oldpath)
3475 return 0;
3476
3477 clear_unexp_config_line(c->lxc_conf, "lxc.mount.fstab", false);
3478
3479 char *p = strrchr(oldpath, '/');
3480 if (!p)
3481 return -1;
3482
3483 ret = snprintf(newpath, PATH_MAX, "%s/%s%s",
3484 c->config_path, c->name, p);
3485 if (ret < 0 || ret >= PATH_MAX) {
3486 ERROR("error printing new path for %s", oldpath);
3487 return -1;
3488 }
3489
3490 if (file_exists(newpath)) {
3491 ERROR("error: fstab file %s exists", newpath);
3492 return -1;
3493 }
3494
3495 if (copy_file(oldpath, newpath) < 0) {
3496 ERROR("error: copying %s to %s", oldpath, newpath);
3497 return -1;
3498 }
3499
3500 free(c->lxc_conf->fstab);
3501
3502 c->lxc_conf->fstab = strdup(newpath);
3503 if (!c->lxc_conf->fstab) {
3504 ERROR("error: allocating pathname");
3505 return -1;
3506 }
3507
3508 if (!do_append_unexp_config_line(c->lxc_conf, "lxc.mount.fstab", newpath)) {
3509 ERROR("error saving new lxctab");
3510 return -1;
3511 }
3512
3513 return 0;
3514 }
3515
3516 static void copy_rdepends(struct lxc_container *c, struct lxc_container *c0)
3517 {
3518 char path0[PATH_MAX], path1[PATH_MAX];
3519 int ret;
3520
3521 ret = snprintf(path0, PATH_MAX, "%s/%s/lxc_rdepends", c0->config_path,
3522 c0->name);
3523 if (ret < 0 || ret >= PATH_MAX) {
3524 WARN("Error copying reverse dependencies");
3525 return;
3526 }
3527
3528 ret = snprintf(path1, PATH_MAX, "%s/%s/lxc_rdepends", c->config_path,
3529 c->name);
3530 if (ret < 0 || ret >= PATH_MAX) {
3531 WARN("Error copying reverse dependencies");
3532 return;
3533 }
3534
3535 if (copy_file(path0, path1) < 0) {
3536 INFO("Error copying reverse dependencies");
3537 return;
3538 }
3539 }
3540
3541 static bool add_rdepends(struct lxc_container *c, struct lxc_container *c0)
3542 {
3543 int ret;
3544 char path[PATH_MAX];
3545 FILE *f;
3546 bool bret;
3547
3548 ret = snprintf(path, PATH_MAX, "%s/%s/lxc_rdepends", c->config_path,
3549 c->name);
3550 if (ret < 0 || ret >= PATH_MAX)
3551 return false;
3552
3553 f = fopen(path, "a");
3554 if (!f)
3555 return false;
3556
3557 bret = true;
3558
3559 /* If anything goes wrong, just return an error. */
3560 if (fprintf(f, "%s\n%s\n", c0->config_path, c0->name) < 0)
3561 bret = false;
3562
3563 if (fclose(f) != 0)
3564 bret = false;
3565
3566 return bret;
3567 }
3568
3569 /*
3570 * If the fs natively supports snapshot clones with no penalty,
3571 * then default to those even if not requested.
3572 * Currently we only do this for btrfs.
3573 */
3574 bool should_default_to_snapshot(struct lxc_container *c0,
3575 struct lxc_container *c1)
3576 {
3577 __do_free char *p0 = NULL, *p1 = NULL;
3578 int ret;
3579 size_t l0 = strlen(c0->config_path) + strlen(c0->name) + 2;
3580 size_t l1 = strlen(c1->config_path) + strlen(c1->name) + 2;
3581 char *rootfs = c0->lxc_conf->rootfs.path;
3582
3583 p0 = must_realloc(NULL, l0 + 1);
3584 p1 = must_realloc(NULL, l1 + 1);
3585 ret = snprintf(p0, l0, "%s/%s", c0->config_path, c0->name);
3586 if (ret < 0 || ret >= l0)
3587 return false;
3588
3589 ret = snprintf(p1, l1, "%s/%s", c1->config_path, c1->name);
3590 if (ret < 0 || ret >= l1)
3591 return false;
3592
3593 if (!is_btrfs_fs(p0) || !is_btrfs_fs(p1))
3594 return false;
3595
3596 if (is_btrfs_subvol(rootfs) <= 0)
3597 return false;
3598
3599 return btrfs_same_fs(p0, p1) == 0;
3600 }
3601
3602 static int copy_storage(struct lxc_container *c0, struct lxc_container *c,
3603 const char *newtype, int flags, const char *bdevdata,
3604 uint64_t newsize)
3605 {
3606 struct lxc_storage *bdev;
3607 bool need_rdep;
3608
3609 if (should_default_to_snapshot(c0, c))
3610 flags |= LXC_CLONE_SNAPSHOT;
3611
3612 bdev = storage_copy(c0, c->name, c->config_path, newtype, flags,
3613 bdevdata, newsize, &need_rdep);
3614 if (!bdev) {
3615 ERROR("Error copying storage.");
3616 return -1;
3617 }
3618
3619 /* Set new rootfs. */
3620 free(c->lxc_conf->rootfs.path);
3621 c->lxc_conf->rootfs.path = strdup(bdev->src);
3622 storage_put(bdev);
3623
3624 if (!c->lxc_conf->rootfs.path) {
3625 ERROR("Out of memory while setting storage path.");
3626 return -1;
3627 }
3628
3629 /* Append a new lxc.rootfs.path entry to the unexpanded config. */
3630 clear_unexp_config_line(c->lxc_conf, "lxc.rootfs.path", false);
3631 if (!do_append_unexp_config_line(c->lxc_conf, "lxc.rootfs.path",
3632 c->lxc_conf->rootfs.path)) {
3633 ERROR("Error saving new rootfs to cloned config.");
3634 return -1;
3635 }
3636
3637 if (flags & LXC_CLONE_SNAPSHOT)
3638 copy_rdepends(c, c0);
3639
3640 if (need_rdep) {
3641 if (!add_rdepends(c, c0))
3642 WARN("Error adding reverse dependency from %s to %s",
3643 c->name, c0->name);
3644 }
3645
3646 mod_all_rdeps(c, true);
3647
3648 return 0;
3649 }
3650
3651 struct clone_update_data {
3652 struct lxc_container *c0;
3653 struct lxc_container *c1;
3654 int flags;
3655 char **hookargs;
3656 };
3657
3658 static int clone_update_rootfs(struct clone_update_data *data)
3659 {
3660 struct lxc_container *c0 = data->c0;
3661 struct lxc_container *c = data->c1;
3662 int flags = data->flags;
3663 char **hookargs = data->hookargs;
3664 int ret = -1;
3665 char path[PATH_MAX];
3666 struct lxc_storage *bdev;
3667 FILE *fout;
3668 struct lxc_conf *conf = c->lxc_conf;
3669
3670 /* update hostname in rootfs */
3671 /* we're going to mount, so run in a clean namespace to simplify cleanup */
3672
3673 if (setgid(0) < 0) {
3674 ERROR("Failed to setgid to 0");
3675 return -1;
3676 }
3677
3678 if (setuid(0) < 0) {
3679 ERROR("Failed to setuid to 0");
3680 return -1;
3681 }
3682
3683 if (setgroups(0, NULL) < 0)
3684 WARN("Failed to clear groups");
3685
3686 if (unshare(CLONE_NEWNS) < 0)
3687 return -1;
3688
3689 bdev = storage_init(c->lxc_conf);
3690 if (!bdev)
3691 return -1;
3692
3693 if (strcmp(bdev->type, "dir") != 0) {
3694 if (unshare(CLONE_NEWNS) < 0) {
3695 ERROR("error unsharing mounts");
3696 storage_put(bdev);
3697 return -1;
3698 }
3699
3700 if (detect_shared_rootfs()) {
3701 if (mount(NULL, "/", NULL, MS_SLAVE|MS_REC, NULL)) {
3702 SYSERROR("Failed to make / rslave");
3703 ERROR("Continuing...");
3704 }
3705 }
3706
3707 if (bdev->ops->mount(bdev) < 0) {
3708 storage_put(bdev);
3709 return -1;
3710 }
3711 } else { /* TODO come up with a better way */
3712 free(bdev->dest);
3713 bdev->dest = strdup(lxc_storage_get_path(bdev->src, bdev->type));
3714 }
3715
3716 if (!lxc_list_empty(&conf->hooks[LXCHOOK_CLONE])) {
3717 /* Start of environment variable setup for hooks */
3718 if (c0->name && setenv("LXC_SRC_NAME", c0->name, 1))
3719 SYSERROR("failed to set environment variable for source container name");
3720
3721 if (setenv("LXC_NAME", c->name, 1))
3722 SYSERROR("failed to set environment variable for container name");
3723
3724 if (conf->rcfile && setenv("LXC_CONFIG_FILE", conf->rcfile, 1))
3725 SYSERROR("failed to set environment variable for config path");
3726
3727 if (bdev->dest && setenv("LXC_ROOTFS_MOUNT", bdev->dest, 1))
3728 SYSERROR("failed to set environment variable for rootfs mount");
3729
3730 if (conf->rootfs.path && setenv("LXC_ROOTFS_PATH", conf->rootfs.path, 1))
3731 SYSERROR("failed to set environment variable for rootfs mount");
3732
3733 if (run_lxc_hooks(c->name, "clone", conf, hookargs)) {
3734 ERROR("Error executing clone hook for %s", c->name);
3735 storage_put(bdev);
3736 return -1;
3737 }
3738 }
3739
3740 if (!(flags & LXC_CLONE_KEEPNAME)) {
3741 ret = snprintf(path, PATH_MAX, "%s/etc/hostname", bdev->dest);
3742 storage_put(bdev);
3743
3744 if (ret < 0 || ret >= PATH_MAX)
3745 return -1;
3746
3747 if (!file_exists(path))
3748 return 0;
3749
3750 if (!(fout = fopen(path, "w"))) {
3751 SYSERROR("unable to open %s: ignoring", path);
3752 return 0;
3753 }
3754
3755 if (fprintf(fout, "%s", c->name) < 0) {
3756 fclose(fout);
3757 return -1;
3758 }
3759
3760 if (fclose(fout) < 0)
3761 return -1;
3762 } else {
3763 storage_put(bdev);
3764 }
3765
3766 return 0;
3767 }
3768
3769 static int clone_update_rootfs_wrapper(void *data)
3770 {
3771 struct clone_update_data *arg = (struct clone_update_data *) data;
3772 return clone_update_rootfs(arg);
3773 }
3774
3775 /*
3776 * We want to support:
3777 sudo lxc-clone -o o1 -n n1 -s -L|-fssize fssize -v|--vgname vgname \
3778 -p|--lvprefix lvprefix -t|--fstype fstype -B backingstore
3779
3780 -s [ implies overlay]
3781 -s -B overlay
3782
3783 only rootfs gets converted (copied/snapshotted) on clone.
3784 */
3785
3786 static int create_file_dirname(char *path, struct lxc_conf *conf)
3787 {
3788 char *p = strrchr(path, '/');
3789 int ret = -1;
3790
3791 if (!p)
3792 return -1;
3793
3794 *p = '\0';
3795 ret = do_create_container_dir(path, conf);
3796 *p = '/';
3797
3798 return ret;
3799 }
3800
3801 static struct lxc_container *do_lxcapi_clone(struct lxc_container *c, const char *newname,
3802 const char *lxcpath, int flags,
3803 const char *bdevtype, const char *bdevdata, uint64_t newsize,
3804 char **hookargs)
3805 {
3806 char newpath[PATH_MAX];
3807 int fd, ret;
3808 struct clone_update_data data;
3809 size_t saved_unexp_len;
3810 pid_t pid;
3811 int storage_copied = 0;
3812 char *origroot = NULL, *saved_unexp_conf = NULL;
3813 struct lxc_container *c2 = NULL;
3814
3815 if (!c || !do_lxcapi_is_defined(c))
3816 return NULL;
3817
3818 if (container_mem_lock(c))
3819 return NULL;
3820 if (!is_stopped(c) && !(flags & LXC_CLONE_ALLOW_RUNNING)) {
3821 ERROR("error: Original container (%s) is running. Use --allowrunning if you want to force a snapshot of the running container.", c->name);
3822 goto out;
3823 }
3824
3825 /* Make sure the container doesn't yet exist. */
3826 if (!newname)
3827 newname = c->name;
3828
3829 if (!lxcpath)
3830 lxcpath = do_lxcapi_get_config_path(c);
3831
3832 ret = snprintf(newpath, PATH_MAX, "%s/%s/config", lxcpath, newname);
3833 if (ret < 0 || ret >= PATH_MAX) {
3834 SYSERROR("clone: failed making config pathname");
3835 goto out;
3836 }
3837
3838 if (file_exists(newpath)) {
3839 ERROR("error: clone: %s exists", newpath);
3840 goto out;
3841 }
3842
3843 ret = create_file_dirname(newpath, c->lxc_conf);
3844 if (ret < 0 && errno != EEXIST) {
3845 ERROR("Error creating container dir for %s", newpath);
3846 goto out;
3847 }
3848
3849 /* Copy the configuration. Tweak it as needed. */
3850 if (c->lxc_conf->rootfs.path) {
3851 origroot = c->lxc_conf->rootfs.path;
3852 c->lxc_conf->rootfs.path = NULL;
3853 }
3854
3855 fd = open(newpath, O_WRONLY | O_CREAT | O_CLOEXEC,
3856 S_IRUSR | S_IWUSR | S_IRGRP | S_IWGRP);
3857 if (fd < 0) {
3858 SYSERROR("Failed to open \"%s\"", newpath);
3859 goto out;
3860 }
3861
3862 saved_unexp_conf = c->lxc_conf->unexpanded_config;
3863 saved_unexp_len = c->lxc_conf->unexpanded_len;
3864 c->lxc_conf->unexpanded_config = strdup(saved_unexp_conf);
3865 if (!c->lxc_conf->unexpanded_config) {
3866 close(fd);
3867 goto out;
3868 }
3869
3870 clear_unexp_config_line(c->lxc_conf, "lxc.rootfs.path", false);
3871 write_config(fd, c->lxc_conf);
3872 close(fd);
3873
3874 c->lxc_conf->rootfs.path = origroot;
3875
3876 free(c->lxc_conf->unexpanded_config);
3877 c->lxc_conf->unexpanded_config = saved_unexp_conf;
3878 saved_unexp_conf = NULL;
3879 c->lxc_conf->unexpanded_len = saved_unexp_len;
3880
3881 ret = snprintf(newpath, PATH_MAX, "%s/%s/rootfs", lxcpath, newname);
3882 if (ret < 0 || ret >= PATH_MAX) {
3883 SYSERROR("clone: failed making rootfs pathname");
3884 goto out;
3885 }
3886
3887 ret = mkdir(newpath, 0755);
3888 if (ret < 0) {
3889 /* For an overlay container the rootfs is considered immutable
3890 * and will not have been removed when restoring from a
3891 * snapshot.
3892 */
3893 if (errno != ENOENT &&
3894 !(flags & LXC_STORAGE_INTERNAL_OVERLAY_RESTORE)) {
3895 SYSERROR("Failed to create directory \"%s\"", newpath);
3896 goto out;
3897 }
3898 }
3899
3900 if (am_guest_unpriv()) {
3901 if (chown_mapped_root(newpath, c->lxc_conf) < 0) {
3902 ERROR("Error chowning %s to container root", newpath);
3903 goto out;
3904 }
3905 }
3906
3907 c2 = lxc_container_new(newname, lxcpath);
3908 if (!c2) {
3909 ERROR("clone: failed to create new container (%s %s)", newname,
3910 lxcpath);
3911 goto out;
3912 }
3913
3914 /* copy/snapshot rootfs's */
3915 ret = copy_storage(c, c2, bdevtype, flags, bdevdata, newsize);
3916 if (ret < 0)
3917 goto out;
3918
3919 /* update utsname */
3920 if (!(flags & LXC_CLONE_KEEPNAME)) {
3921 clear_unexp_config_line(c2->lxc_conf, "lxc.utsname", false);
3922 clear_unexp_config_line(c2->lxc_conf, "lxc.uts.name", false);
3923
3924 if (!do_set_config_item_locked(c2, "lxc.uts.name", newname)) {
3925 ERROR("Error setting new hostname");
3926 goto out;
3927 }
3928 }
3929
3930 /* copy hooks */
3931 ret = copyhooks(c, c2);
3932 if (ret < 0) {
3933 ERROR("error copying hooks");
3934 goto out;
3935 }
3936
3937 if (copy_fstab(c, c2) < 0) {
3938 ERROR("error copying fstab");
3939 goto out;
3940 }
3941
3942 /* update macaddrs */
3943 if (!(flags & LXC_CLONE_KEEPMACADDR)) {
3944 if (!network_new_hwaddrs(c2->lxc_conf)) {
3945 ERROR("Error updating mac addresses");
3946 goto out;
3947 }
3948 }
3949
3950 /* Update absolute paths for overlay mount directories. */
3951 if (ovl_update_abs_paths(c2->lxc_conf, c->config_path, c->name, lxcpath, newname) < 0)
3952 goto out;
3953
3954 /* We've now successfully created c2's storage, so clear it out if we
3955 * fail after this.
3956 */
3957 storage_copied = 1;
3958
3959 if (!c2->save_config(c2, NULL))
3960 goto out;
3961
3962 if ((pid = fork()) < 0) {
3963 SYSERROR("fork");
3964 goto out;
3965 }
3966
3967 if (pid > 0) {
3968 ret = wait_for_pid(pid);
3969 if (ret)
3970 goto out;
3971
3972 container_mem_unlock(c);
3973 return c2;
3974 }
3975
3976 data.c0 = c;
3977 data.c1 = c2;
3978 data.flags = flags;
3979 data.hookargs = hookargs;
3980
3981 if (am_guest_unpriv())
3982 ret = userns_exec_full(c->lxc_conf, clone_update_rootfs_wrapper,
3983 &data, "clone_update_rootfs_wrapper");
3984 else
3985 ret = clone_update_rootfs(&data);
3986 if (ret < 0)
3987 _exit(EXIT_FAILURE);
3988
3989 container_mem_unlock(c);
3990 _exit(EXIT_SUCCESS);
3991
3992 out:
3993 container_mem_unlock(c);
3994 if (c2) {
3995 if (!storage_copied)
3996 c2->lxc_conf->rootfs.path = NULL;
3997
3998 c2->destroy(c2);
3999 lxc_container_put(c2);
4000 }
4001
4002 return NULL;
4003 }
4004
4005 static struct lxc_container *lxcapi_clone(struct lxc_container *c, const char *newname,
4006 const char *lxcpath, int flags,
4007 const char *bdevtype, const char *bdevdata, uint64_t newsize,
4008 char **hookargs)
4009 {
4010 struct lxc_container * ret;
4011
4012 current_config = c ? c->lxc_conf : NULL;
4013 ret = do_lxcapi_clone(c, newname, lxcpath, flags, bdevtype, bdevdata, newsize, hookargs);
4014 current_config = NULL;
4015
4016 return ret;
4017 }
4018
4019 static bool do_lxcapi_rename(struct lxc_container *c, const char *newname)
4020 {
4021 struct lxc_storage *bdev;
4022 struct lxc_container *newc;
4023
4024 if (!c || !c->name || !c->config_path || !c->lxc_conf)
4025 return false;
4026
4027 if (has_fs_snapshots(c) || has_snapshots(c)) {
4028 ERROR("Renaming a container with snapshots is not supported");
4029 return false;
4030 }
4031
4032 bdev = storage_init(c->lxc_conf);
4033 if (!bdev) {
4034 ERROR("Failed to find original backing store type");
4035 return false;
4036 }
4037
4038 newc = lxcapi_clone(c, newname, c->config_path, LXC_CLONE_KEEPMACADDR, NULL, bdev->type, 0, NULL);
4039 storage_put(bdev);
4040 if (!newc) {
4041 lxc_container_put(newc);
4042 return false;
4043 }
4044
4045 if (newc && lxcapi_is_defined(newc))
4046 lxc_container_put(newc);
4047
4048 if (!container_destroy(c, NULL)) {
4049 ERROR("Could not destroy existing container %s", c->name);
4050 return false;
4051 }
4052
4053 return true;
4054 }
4055
4056 WRAP_API_1(bool, lxcapi_rename, const char *)
4057
4058 static int lxcapi_attach(struct lxc_container *c, lxc_attach_exec_t exec_function, void *exec_payload, lxc_attach_options_t *options, pid_t *attached_process)
4059 {
4060 int ret;
4061
4062 if (!c)
4063 return -1;
4064
4065 current_config = c->lxc_conf;
4066
4067 ret = lxc_attach(c, exec_function, exec_payload, options, attached_process);
4068 current_config = NULL;
4069 return ret;
4070 }
4071
4072 static int do_lxcapi_attach_run_wait(struct lxc_container *c, lxc_attach_options_t *options, const char *program, const char * const argv[])
4073 {
4074 lxc_attach_command_t command;
4075 pid_t pid;
4076 int r;
4077
4078 if (!c)
4079 return -1;
4080
4081 command.program = (char*)program;
4082 command.argv = (char**)argv;
4083
4084 r = lxc_attach(c, lxc_attach_run_command, &command, options, &pid);
4085 if (r < 0) {
4086 ERROR("ups");
4087 return r;
4088 }
4089
4090 return lxc_wait_for_pid_status(pid);
4091 }
4092
4093 static int lxcapi_attach_run_wait(struct lxc_container *c, lxc_attach_options_t *options, const char *program, const char * const argv[])
4094 {
4095 int ret;
4096
4097 current_config = c ? c->lxc_conf : NULL;
4098 ret = do_lxcapi_attach_run_wait(c, options, program, argv);
4099 current_config = NULL;
4100
4101 return ret;
4102 }
4103
4104 static int get_next_index(const char *lxcpath, char *cname)
4105 {
4106 __do_free char *fname = NULL;
4107 struct stat sb;
4108 int i = 0, ret;
4109
4110 fname = must_realloc(NULL, strlen(lxcpath) + 20);
4111
4112 for (;;) {
4113 sprintf(fname, "%s/snap%d", lxcpath, i);
4114
4115 ret = stat(fname, &sb);
4116 if (ret != 0)
4117 return i;
4118
4119 i++;
4120 }
4121 }
4122
4123 static bool get_snappath_dir(struct lxc_container *c, char *snappath)
4124 {
4125 int ret;
4126
4127 /*
4128 * If the old style snapshot path exists, use it
4129 * /var/lib/lxc -> /var/lib/lxcsnaps
4130 */
4131 ret = snprintf(snappath, PATH_MAX, "%ssnaps", c->config_path);
4132 if (ret < 0 || ret >= PATH_MAX)
4133 return false;
4134
4135 if (dir_exists(snappath)) {
4136 ret = snprintf(snappath, PATH_MAX, "%ssnaps/%s", c->config_path, c->name);
4137 if (ret < 0 || ret >= PATH_MAX)
4138 return false;
4139
4140 return true;
4141 }
4142
4143 /*
4144 * Use the new style path
4145 * /var/lib/lxc -> /var/lib/lxc + c->name + /snaps + \0
4146 */
4147 ret = snprintf(snappath, PATH_MAX, "%s/%s/snaps", c->config_path, c->name);
4148 if (ret < 0 || ret >= PATH_MAX)
4149 return false;
4150
4151 return true;
4152 }
4153
4154 static int do_lxcapi_snapshot(struct lxc_container *c, const char *commentfile)
4155 {
4156 __do_free char *dfnam = NULL;
4157 int i, flags, ret;
4158 time_t timer;
4159 struct tm tm_info;
4160 struct lxc_container *c2;
4161 char snappath[PATH_MAX], newname[20];
4162 char buffer[25];
4163 FILE *f;
4164
4165 if (!c || !lxcapi_is_defined(c))
4166 return -1;
4167
4168 if (!storage_can_backup(c->lxc_conf)) {
4169 ERROR("%s's backing store cannot be backed up", c->name);
4170 ERROR("Your container must use another backing store type");
4171 return -1;
4172 }
4173
4174 if (!get_snappath_dir(c, snappath))
4175 return -1;
4176
4177 i = get_next_index(snappath, c->name);
4178
4179 if (mkdir_p(snappath, 0755) < 0) {
4180 ERROR("Failed to create snapshot directory %s", snappath);
4181 return -1;
4182 }
4183
4184 ret = snprintf(newname, 20, "snap%d", i);
4185 if (ret < 0 || ret >= 20)
4186 return -1;
4187
4188 /*
4189 * We pass LXC_CLONE_SNAPSHOT to make sure that a rdepends file entry is
4190 * created in the original container
4191 */
4192 flags = LXC_CLONE_SNAPSHOT | LXC_CLONE_KEEPMACADDR | LXC_CLONE_KEEPNAME |
4193 LXC_CLONE_KEEPBDEVTYPE | LXC_CLONE_MAYBE_SNAPSHOT;
4194 if (storage_is_dir(c->lxc_conf)) {
4195 ERROR("Snapshot of directory-backed container requested");
4196 ERROR("Making a copy-clone. If you do want snapshots, then");
4197 ERROR("please create overlay clone first, snapshot that");
4198 ERROR("and keep the original container pristine");
4199 flags &= ~LXC_CLONE_SNAPSHOT | LXC_CLONE_MAYBE_SNAPSHOT;
4200 }
4201
4202 c2 = do_lxcapi_clone(c, newname, snappath, flags, NULL, NULL, 0, NULL);
4203 if (!c2) {
4204 ERROR("Failed to clone of %s:%s", c->config_path, c->name);
4205 return -1;
4206 }
4207
4208 lxc_container_put(c2);
4209
4210 /* Now write down the creation time. */
4211 time(&timer);
4212
4213 if (!localtime_r(&timer, &tm_info)) {
4214 ERROR("Failed to get localtime");
4215 return -1;
4216 }
4217
4218 strftime(buffer, 25, "%Y:%m:%d %H:%M:%S", &tm_info);
4219
4220 dfnam = must_realloc(NULL, strlen(snappath) + strlen(newname) + 5);
4221 sprintf(dfnam, "%s/%s/ts", snappath, newname);
4222 f = fopen(dfnam, "w");
4223 if (!f) {
4224 ERROR("Failed to open %s", dfnam);
4225 return -1;
4226 }
4227
4228 if (fprintf(f, "%s", buffer) < 0) {
4229 SYSERROR("Writing timestamp");
4230 fclose(f);
4231 return -1;
4232 }
4233
4234 ret = fclose(f);
4235 if (ret != 0) {
4236 SYSERROR("Writing timestamp");
4237 return -1;
4238 }
4239
4240 if (commentfile) {
4241 __do_free char *path = NULL;
4242 /* $p / $name / comment \0 */
4243 int len = strlen(snappath) + strlen(newname) + 10;
4244
4245 path = must_realloc(NULL, len);
4246 sprintf(path, "%s/%s/comment", snappath, newname);
4247 return copy_file(commentfile, path) < 0 ? -1 : i;
4248 }
4249
4250 return i;
4251 }
4252
4253 WRAP_API_1(int, lxcapi_snapshot, const char *)
4254
4255 static void lxcsnap_free(struct lxc_snapshot *s)
4256 {
4257 free(s->name);
4258 free(s->comment_pathname);
4259 free(s->timestamp);
4260 free(s->lxcpath);
4261 }
4262
4263 static char *get_snapcomment_path(char* snappath, char *name)
4264 {
4265 /* $snappath/$name/comment */
4266 int ret, len = strlen(snappath) + strlen(name) + 10;
4267 char *s = malloc(len);
4268
4269 if (s) {
4270 ret = snprintf(s, len, "%s/%s/comment", snappath, name);
4271 if (ret < 0 || ret >= len) {
4272 free(s);
4273 s = NULL;
4274 }
4275 }
4276
4277 return s;
4278 }
4279
4280 static char *get_timestamp(char* snappath, char *name)
4281 {
4282 char path[PATH_MAX], *s = NULL;
4283 int ret, len;
4284 FILE *fin;
4285
4286 ret = snprintf(path, PATH_MAX, "%s/%s/ts", snappath, name);
4287 if (ret < 0 || ret >= PATH_MAX)
4288 return NULL;
4289
4290 fin = fopen(path, "r");
4291 if (!fin)
4292 return NULL;
4293
4294 (void) fseek(fin, 0, SEEK_END);
4295 len = ftell(fin);
4296 (void) fseek(fin, 0, SEEK_SET);
4297 if (len > 0) {
4298 s = malloc(len+1);
4299 if (s) {
4300 s[len] = '\0';
4301 if (fread(s, 1, len, fin) != len) {
4302 SYSERROR("reading timestamp");
4303 free(s);
4304 s = NULL;
4305 }
4306 }
4307 }
4308
4309 fclose(fin);
4310 return s;
4311 }
4312
4313 static int do_lxcapi_snapshot_list(struct lxc_container *c, struct lxc_snapshot **ret_snaps)
4314 {
4315 char snappath[PATH_MAX], path2[PATH_MAX];
4316 int count = 0, ret;
4317 struct dirent *direntp;
4318 struct lxc_snapshot *snaps =NULL, *nsnaps;
4319 DIR *dir;
4320
4321 if (!c || !lxcapi_is_defined(c))
4322 return -1;
4323
4324 if (!get_snappath_dir(c, snappath)) {
4325 ERROR("path name too long");
4326 return -1;
4327 }
4328
4329 dir = opendir(snappath);
4330 if (!dir) {
4331 INFO("Failed to open %s - assuming no snapshots", snappath);
4332 return 0;
4333 }
4334
4335 while ((direntp = readdir(dir))) {
4336 if (!strcmp(direntp->d_name, "."))
4337 continue;
4338
4339 if (!strcmp(direntp->d_name, ".."))
4340 continue;
4341
4342 ret = snprintf(path2, PATH_MAX, "%s/%s/config", snappath, direntp->d_name);
4343 if (ret < 0 || ret >= PATH_MAX) {
4344 ERROR("pathname too long");
4345 goto out_free;
4346 }
4347
4348 if (!file_exists(path2))
4349 continue;
4350
4351 nsnaps = realloc(snaps, (count + 1)*sizeof(*snaps));
4352 if (!nsnaps) {
4353 SYSERROR("Out of memory");
4354 goto out_free;
4355 }
4356
4357 snaps = nsnaps;
4358 snaps[count].free = lxcsnap_free;
4359 snaps[count].name = strdup(direntp->d_name);
4360 if (!snaps[count].name)
4361 goto out_free;
4362
4363 snaps[count].lxcpath = strdup(snappath);
4364 if (!snaps[count].lxcpath) {
4365 free(snaps[count].name);
4366 goto out_free;
4367 }
4368
4369 snaps[count].comment_pathname = get_snapcomment_path(snappath, direntp->d_name);
4370 snaps[count].timestamp = get_timestamp(snappath, direntp->d_name);
4371 count++;
4372 }
4373
4374 if (closedir(dir))
4375 WARN("Failed to close directory");
4376
4377 *ret_snaps = snaps;
4378 return count;
4379
4380 out_free:
4381 if (snaps) {
4382 int i;
4383
4384 for (i=0; i<count; i++)
4385 lxcsnap_free(&snaps[i]);
4386
4387 free(snaps);
4388 }
4389
4390 if (closedir(dir))
4391 WARN("Failed to close directory");
4392
4393 return -1;
4394 }
4395
4396 WRAP_API_1(int, lxcapi_snapshot_list, struct lxc_snapshot **)
4397
4398 static bool do_lxcapi_snapshot_restore(struct lxc_container *c, const char *snapname, const char *newname)
4399 {
4400 char clonelxcpath[PATH_MAX];
4401 int flags = 0;
4402 struct lxc_container *snap, *rest;
4403 struct lxc_storage *bdev;
4404 bool b = false;
4405
4406 if (!c || !c->name || !c->config_path)
4407 return false;
4408
4409 if (has_fs_snapshots(c)) {
4410 ERROR("container rootfs has dependent snapshots");
4411 return false;
4412 }
4413
4414 bdev = storage_init(c->lxc_conf);
4415 if (!bdev) {
4416 ERROR("Failed to find original backing store type");
4417 return false;
4418 }
4419
4420 /* For an overlay container the rootfs is considered immutable
4421 * and cannot be removed when restoring from a snapshot. We pass this
4422 * internal flag along to communicate this to various parts of the
4423 * codebase.
4424 */
4425 if (!strcmp(bdev->type, "overlay") || !strcmp(bdev->type, "overlayfs"))
4426 bdev->flags |= LXC_STORAGE_INTERNAL_OVERLAY_RESTORE;
4427
4428 if (!newname)
4429 newname = c->name;
4430
4431 if (!get_snappath_dir(c, clonelxcpath)) {
4432 storage_put(bdev);
4433 return false;
4434 }
4435 /* how should we lock this? */
4436
4437 snap = lxc_container_new(snapname, clonelxcpath);
4438 if (!snap || !lxcapi_is_defined(snap)) {
4439 ERROR("Could not open snapshot %s", snapname);
4440
4441 if (snap)
4442 lxc_container_put(snap);
4443
4444 storage_put(bdev);
4445 return false;
4446 }
4447
4448 if (!strcmp(c->name, newname)) {
4449 if (!container_destroy(c, bdev)) {
4450 ERROR("Could not destroy existing container %s", newname);
4451 lxc_container_put(snap);
4452 storage_put(bdev);
4453 return false;
4454 }
4455 }
4456
4457 if (strcmp(bdev->type, "dir") != 0 && strcmp(bdev->type, "loop") != 0)
4458 flags = LXC_CLONE_SNAPSHOT | LXC_CLONE_MAYBE_SNAPSHOT;
4459
4460 if (!strcmp(bdev->type, "overlay") || !strcmp(bdev->type, "overlayfs"))
4461 flags |= LXC_STORAGE_INTERNAL_OVERLAY_RESTORE;
4462
4463 rest = lxcapi_clone(snap, newname, c->config_path, flags, bdev->type,
4464 NULL, 0, NULL);
4465 storage_put(bdev);
4466 if (rest && lxcapi_is_defined(rest))
4467 b = true;
4468
4469 if (rest)
4470 lxc_container_put(rest);
4471
4472 lxc_container_put(snap);
4473 return b;
4474 }
4475
4476 WRAP_API_2(bool, lxcapi_snapshot_restore, const char *, const char *)
4477
4478 static bool do_snapshot_destroy(const char *snapname, const char *clonelxcpath)
4479 {
4480 struct lxc_container *snap = NULL;
4481 bool bret = false;
4482
4483 snap = lxc_container_new(snapname, clonelxcpath);
4484 if (!snap) {
4485 ERROR("Could not find snapshot %s", snapname);
4486 goto err;
4487 }
4488
4489 if (!do_lxcapi_destroy(snap)) {
4490 ERROR("Could not destroy snapshot %s", snapname);
4491 goto err;
4492 }
4493
4494 bret = true;
4495
4496 err:
4497 if (snap)
4498 lxc_container_put(snap);
4499
4500 return bret;
4501 }
4502
4503 static bool remove_all_snapshots(const char *path)
4504 {
4505 DIR *dir;
4506 struct dirent *direntp;
4507 bool bret = true;
4508
4509 dir = opendir(path);
4510 if (!dir) {
4511 SYSERROR("opendir on snapshot path %s", path);
4512 return false;
4513 }
4514
4515 while ((direntp = readdir(dir))) {
4516 if (!strcmp(direntp->d_name, "."))
4517 continue;
4518
4519 if (!strcmp(direntp->d_name, ".."))
4520 continue;
4521
4522 if (!do_snapshot_destroy(direntp->d_name, path)) {
4523 bret = false;
4524 continue;
4525 }
4526 }
4527
4528 closedir(dir);
4529
4530 if (rmdir(path))
4531 SYSERROR("Error removing directory %s", path);
4532
4533 return bret;
4534 }
4535
4536 static bool do_lxcapi_snapshot_destroy(struct lxc_container *c, const char *snapname)
4537 {
4538 char clonelxcpath[PATH_MAX];
4539
4540 if (!c || !c->name || !c->config_path || !snapname)
4541 return false;
4542
4543 if (!get_snappath_dir(c, clonelxcpath))
4544 return false;
4545
4546 return do_snapshot_destroy(snapname, clonelxcpath);
4547 }
4548
4549 WRAP_API_1(bool, lxcapi_snapshot_destroy, const char *)
4550
4551 static bool do_lxcapi_snapshot_destroy_all(struct lxc_container *c)
4552 {
4553 char clonelxcpath[PATH_MAX];
4554
4555 if (!c || !c->name || !c->config_path)
4556 return false;
4557
4558 if (!get_snappath_dir(c, clonelxcpath))
4559 return false;
4560
4561 return remove_all_snapshots(clonelxcpath);
4562 }
4563
4564 WRAP_API(bool, lxcapi_snapshot_destroy_all)
4565
4566 static bool do_lxcapi_may_control(struct lxc_container *c)
4567 {
4568 if (!c)
4569 return false;
4570
4571 return lxc_try_cmd(c->name, c->config_path) == 0;
4572 }
4573
4574 WRAP_API(bool, lxcapi_may_control)
4575
4576 static bool do_add_remove_node(pid_t init_pid, const char *path, bool add,
4577 struct stat *st)
4578 {
4579 int ret;
4580 char *tmp;
4581 pid_t pid;
4582 char chrootpath[PATH_MAX];
4583 char *directory_path = NULL;
4584
4585 pid = fork();
4586 if (pid < 0) {
4587 SYSERROR("Failed to fork()");
4588 return false;
4589 }
4590
4591 if (pid) {
4592 ret = wait_for_pid(pid);
4593 if (ret != 0) {
4594 ERROR("Failed to create device node");
4595 return false;
4596 }
4597
4598 return true;
4599 }
4600
4601 /* prepare the path */
4602 ret = snprintf(chrootpath, PATH_MAX, "/proc/%d/root", init_pid);
4603 if (ret < 0 || ret >= PATH_MAX)
4604 return false;
4605
4606 ret = chroot(chrootpath);
4607 if (ret < 0)
4608 _exit(EXIT_FAILURE);
4609
4610 ret = chdir("/");
4611 if (ret < 0)
4612 _exit(EXIT_FAILURE);
4613
4614 /* remove path if it exists */
4615 ret = faccessat(AT_FDCWD, path, F_OK, AT_SYMLINK_NOFOLLOW);
4616 if(ret == 0) {
4617 ret = unlink(path);
4618 if (ret < 0) {
4619 SYSERROR("Failed to remove \"%s\"", path);
4620 _exit(EXIT_FAILURE);
4621 }
4622 }
4623
4624 if (!add)
4625 _exit(EXIT_SUCCESS);
4626
4627 /* create any missing directories */
4628 tmp = strdup(path);
4629 if (!tmp)
4630 _exit(EXIT_FAILURE);
4631
4632 directory_path = dirname(tmp);
4633 ret = mkdir_p(directory_path, 0755);
4634 if (ret < 0 && errno != EEXIST) {
4635 SYSERROR("Failed to create path \"%s\"", directory_path);
4636 free(tmp);
4637 _exit(EXIT_FAILURE);
4638 }
4639
4640 /* create the device node */
4641 ret = mknod(path, st->st_mode, st->st_rdev);
4642 free(tmp);
4643 if (ret < 0) {
4644 SYSERROR("Failed to create device node at \"%s\"", path);
4645 _exit(EXIT_FAILURE);
4646 }
4647
4648 _exit(EXIT_SUCCESS);
4649 }
4650
4651 static bool add_remove_device_node(struct lxc_container *c, const char *src_path, const char *dest_path, bool add)
4652 {
4653 int ret;
4654 struct stat st;
4655 char value[LXC_MAX_BUFFER];
4656 const char *p;
4657 pid_t init_pid;
4658
4659 /* make sure container is running */
4660 if (!do_lxcapi_is_running(c)) {
4661 ERROR("container is not running");
4662 return false;
4663 }
4664
4665 /* use src_path if dest_path is NULL otherwise use dest_path */
4666 p = dest_path ? dest_path : src_path;
4667
4668 /* make sure we can access p */
4669 if(access(p, F_OK) < 0 || stat(p, &st) < 0)
4670 return false;
4671
4672 /* continue if path is character device or block device */
4673 if (S_ISCHR(st.st_mode))
4674 ret = snprintf(value, LXC_MAX_BUFFER, "c %d:%d rwm", major(st.st_rdev), minor(st.st_rdev));
4675 else if (S_ISBLK(st.st_mode))
4676 ret = snprintf(value, LXC_MAX_BUFFER, "b %d:%d rwm", major(st.st_rdev), minor(st.st_rdev));
4677 else
4678 return false;
4679
4680 /* check snprintf return code */
4681 if (ret < 0 || ret >= LXC_MAX_BUFFER)
4682 return false;
4683
4684 init_pid = do_lxcapi_init_pid(c);
4685 if (init_pid < 0) {
4686 ERROR("Failed to get init pid");
4687 return false;
4688 }
4689
4690 if (!do_add_remove_node(init_pid, p, add, &st))
4691 return false;
4692
4693 /* add or remove device to/from cgroup access list */
4694 if (add) {
4695 if (!do_lxcapi_set_cgroup_item(c, "devices.allow", value)) {
4696 ERROR("set_cgroup_item failed while adding the device node");
4697 return false;
4698 }
4699 } else {
4700 if (!do_lxcapi_set_cgroup_item(c, "devices.deny", value)) {
4701 ERROR("set_cgroup_item failed while removing the device node");
4702 return false;
4703 }
4704 }
4705
4706 return true;
4707 }
4708
4709 static bool do_lxcapi_add_device_node(struct lxc_container *c, const char *src_path, const char *dest_path)
4710 {
4711 // cannot mknod if we're not privileged wrt init_user_ns
4712 if (am_host_unpriv()) {
4713 ERROR(LXC_UNPRIV_EOPNOTSUPP, __FUNCTION__);
4714 return false;
4715 }
4716
4717 return add_remove_device_node(c, src_path, dest_path, true);
4718 }
4719
4720 WRAP_API_2(bool, lxcapi_add_device_node, const char *, const char *)
4721
4722 static bool do_lxcapi_remove_device_node(struct lxc_container *c, const char *src_path, const char *dest_path)
4723 {
4724 if (am_guest_unpriv()) {
4725 ERROR(LXC_UNPRIV_EOPNOTSUPP, __FUNCTION__);
4726 return false;
4727 }
4728
4729 return add_remove_device_node(c, src_path, dest_path, false);
4730 }
4731
4732 WRAP_API_2(bool, lxcapi_remove_device_node, const char *, const char *)
4733
4734 static bool do_lxcapi_attach_interface(struct lxc_container *c,
4735 const char *ifname,
4736 const char *dst_ifname)
4737 {
4738 pid_t init_pid;
4739 int ret = 0;
4740
4741 if (am_guest_unpriv()) {
4742 ERROR(LXC_UNPRIV_EOPNOTSUPP, __FUNCTION__);
4743 return false;
4744 }
4745
4746 if (!ifname) {
4747 ERROR("No source interface name given");
4748 return false;
4749 }
4750
4751 ret = lxc_netdev_isup(ifname);
4752 if (ret > 0) {
4753 /* netdev of ifname is up. */
4754 ret = lxc_netdev_down(ifname);
4755 if (ret)
4756 goto err;
4757 }
4758
4759 init_pid = do_lxcapi_init_pid(c);
4760 if (init_pid < 0) {
4761 ERROR("Failed to get init pid");
4762 goto err;
4763 }
4764
4765 ret = lxc_netdev_move_by_name(ifname, init_pid, dst_ifname);
4766 if (ret)
4767 goto err;
4768
4769 INFO("Moved network device \"%s\" to network namespace of %d", ifname, init_pid);
4770 return true;
4771
4772 err:
4773 return false;
4774 }
4775
4776 WRAP_API_2(bool, lxcapi_attach_interface, const char *, const char *)
4777
4778 static bool do_lxcapi_detach_interface(struct lxc_container *c,
4779 const char *ifname,
4780 const char *dst_ifname)
4781 {
4782 int ret;
4783 pid_t pid, pid_outside;
4784
4785 /*
4786 * TODO - if this is a physical device, then we need am_host_unpriv.
4787 * But for other types guest privilege suffices.
4788 */
4789 if (am_guest_unpriv()) {
4790 ERROR(LXC_UNPRIV_EOPNOTSUPP, __FUNCTION__);
4791 return false;
4792 }
4793
4794 if (!ifname) {
4795 ERROR("No source interface name given");
4796 return false;
4797 }
4798
4799 pid_outside = lxc_raw_getpid();
4800 pid = fork();
4801 if (pid < 0) {
4802 ERROR("Failed to fork");
4803 return false;
4804 }
4805
4806 if (pid == 0) { /* child */
4807 pid_t init_pid;
4808
4809 init_pid = do_lxcapi_init_pid(c);
4810 if (init_pid < 0) {
4811 ERROR("Failed to get init pid");
4812 _exit(EXIT_FAILURE);
4813 }
4814 if (!switch_to_ns(init_pid, "net")) {
4815 ERROR("Failed to enter network namespace");
4816 _exit(EXIT_FAILURE);
4817 }
4818
4819 ret = lxc_netdev_isup(ifname);
4820 if (ret < 0) {
4821 ERROR("Failed to determine whether network device \"%s\" is up", ifname);
4822 _exit(EXIT_FAILURE);
4823 }
4824
4825 /* netdev of ifname is up. */
4826 if (ret) {
4827 ret = lxc_netdev_down(ifname);
4828 if (ret) {
4829 ERROR("Failed to set network device \"%s\" down", ifname);
4830 _exit(EXIT_FAILURE);
4831 }
4832 }
4833
4834 ret = lxc_netdev_move_by_name(ifname, pid_outside, dst_ifname);
4835 /* -EINVAL means there is no netdev named as ifname. */
4836 if (ret < 0) {
4837 if (ret == -EINVAL)
4838 ERROR("Network device \"%s\" not found", ifname);
4839 else
4840 ERROR("Failed to remove network device \"%s\"", ifname);
4841
4842 _exit(EXIT_FAILURE);
4843 }
4844
4845 _exit(EXIT_SUCCESS);
4846 }
4847
4848 ret = wait_for_pid(pid);
4849 if (ret != 0)
4850 return false;
4851
4852 INFO("Moved network device \"%s\" to network namespace of %d", ifname, pid_outside);
4853 return true;
4854 }
4855
4856 WRAP_API_2(bool, lxcapi_detach_interface, const char *, const char *)
4857
4858 static int do_lxcapi_migrate(struct lxc_container *c, unsigned int cmd,
4859 struct migrate_opts *opts, unsigned int size)
4860 {
4861 int ret = -1;
4862 struct migrate_opts *valid_opts = opts;
4863 uint64_t features_to_check = 0;
4864
4865 /* If the caller has a bigger (newer) struct migrate_opts, let's make
4866 * sure that the stuff on the end is zero, i.e. that they didn't ask us
4867 * to do anything special.
4868 */
4869 if (size > sizeof(*opts)) {
4870 unsigned char *addr;
4871 unsigned char *end;
4872
4873 addr = (void *)opts + sizeof(*opts);
4874 end = (void *)opts + size;
4875
4876 for (; addr < end; addr++)
4877 if (*addr)
4878 return -E2BIG;
4879 }
4880
4881 /* If the caller has a smaller struct, let's zero out the end for them
4882 * so we don't accidentally use bits of it that they didn't know about
4883 * to initialize.
4884 */
4885 if (size < sizeof(*opts)) {
4886 valid_opts = malloc(sizeof(*opts));
4887 if (!valid_opts)
4888 return -ENOMEM;
4889
4890 memset(valid_opts, 0, sizeof(*opts));
4891 memcpy(valid_opts, opts, size);
4892 }
4893
4894 switch (cmd) {
4895 case MIGRATE_PRE_DUMP:
4896 if (!do_lxcapi_is_running(c)) {
4897 ERROR("container is not running");
4898 goto on_error;
4899 }
4900
4901 ret = !__criu_pre_dump(c, valid_opts);
4902 break;
4903 case MIGRATE_DUMP:
4904 if (!do_lxcapi_is_running(c)) {
4905 ERROR("container is not running");
4906 goto on_error;
4907 }
4908
4909 ret = !__criu_dump(c, valid_opts);
4910 break;
4911 case MIGRATE_RESTORE:
4912 if (do_lxcapi_is_running(c)) {
4913 ERROR("container is already running");
4914 goto on_error;
4915 }
4916
4917 ret = !__criu_restore(c, valid_opts);
4918 break;
4919 case MIGRATE_FEATURE_CHECK:
4920 features_to_check = valid_opts->features_to_check;
4921 ret = !__criu_check_feature(&features_to_check);
4922 if (ret) {
4923 /* Something went wrong. Let's let the caller
4924 * know which feature checks failed. */
4925 valid_opts->features_to_check = features_to_check;
4926 }
4927 break;
4928 default:
4929 ERROR("invalid migrate command %u", cmd);
4930 ret = -EINVAL;
4931 }
4932
4933 on_error:
4934 if (size < sizeof(*opts))
4935 free(valid_opts);
4936
4937 return ret;
4938 }
4939
4940 WRAP_API_3(int, lxcapi_migrate, unsigned int, struct migrate_opts *, unsigned int)
4941
4942 static bool do_lxcapi_checkpoint(struct lxc_container *c, char *directory, bool stop, bool verbose)
4943 {
4944 struct migrate_opts opts;
4945
4946 memset(&opts, 0, sizeof(opts));
4947
4948 opts.directory = directory;
4949 opts.stop = stop;
4950 opts.verbose = verbose;
4951
4952 return !do_lxcapi_migrate(c, MIGRATE_DUMP, &opts, sizeof(opts));
4953 }
4954
4955 WRAP_API_3(bool, lxcapi_checkpoint, char *, bool, bool)
4956
4957 static bool do_lxcapi_restore(struct lxc_container *c, char *directory, bool verbose)
4958 {
4959 struct migrate_opts opts;
4960
4961 memset(&opts, 0, sizeof(opts));
4962
4963 opts.directory = directory;
4964 opts.verbose = verbose;
4965
4966 return !do_lxcapi_migrate(c, MIGRATE_RESTORE, &opts, sizeof(opts));
4967 }
4968
4969 WRAP_API_2(bool, lxcapi_restore, char *, bool)
4970
4971 /* @st_mode is the st_mode field of the stat(source) return struct */
4972 static int create_mount_target(const char *dest, mode_t st_mode)
4973 {
4974 char *dirdup, *destdirname;
4975 int ret;
4976
4977 dirdup = strdup(dest);
4978 if (!dirdup) {
4979 SYSERROR("Failed to duplicate target name \"%s\"", dest);
4980 return -1;
4981 }
4982 destdirname = dirname(dirdup);
4983
4984 ret = mkdir_p(destdirname, 0755);
4985 if (ret < 0) {
4986 SYSERROR("Failed to create \"%s\"", destdirname);
4987 free(dirdup);
4988 return ret;
4989 }
4990 free(dirdup);
4991
4992 (void)remove(dest);
4993
4994 if (S_ISDIR(st_mode))
4995 ret = mkdir(dest, 0000);
4996 else
4997 ret = mknod(dest, S_IFREG | 0000, 0);
4998
4999 if (ret == 0)
5000 TRACE("Created mount target \"%s\"", dest);
5001 else if (ret < 0 && errno != EEXIST) {
5002 SYSERROR("Failed to create mount target \"%s\"", dest);
5003 return -1;
5004 }
5005
5006 return 0;
5007 }
5008
5009 static int do_lxcapi_mount(struct lxc_container *c, const char *source,
5010 const char *target, const char *filesystemtype,
5011 unsigned long mountflags, const void *data,
5012 struct lxc_mount *mnt)
5013 {
5014 char *suff, *sret;
5015 char template[PATH_MAX], path[PATH_MAX];
5016 pid_t pid, init_pid;
5017 struct stat sb;
5018 bool is_dir;
5019 int ret = -1, fd = -EBADF;
5020
5021 if (!c || !c->lxc_conf) {
5022 ERROR("Container or configuration is NULL");
5023 return -EINVAL;
5024 }
5025
5026 if (!c->lxc_conf->shmount.path_host) {
5027 ERROR("Host path to shared mountpoint must be specified in the config\n");
5028 return -EINVAL;
5029 }
5030
5031 ret = snprintf(template, sizeof(template), "%s/.lxcmount_XXXXXX", c->lxc_conf->shmount.path_host);
5032 if (ret < 0 || (size_t)ret >= sizeof(template)) {
5033 SYSERROR("Error writing shmounts tempdir name");
5034 goto out;
5035 }
5036
5037 /* Create a temporary file / dir under the shared mountpoint */
5038 if (!source || strcmp(source, "") == 0) {
5039 /* If source is not specified, maybe we want to mount a filesystem? */
5040 sb.st_mode = S_IFDIR;
5041 } else {
5042 ret = stat(source, &sb);
5043 if (ret < 0) {
5044 SYSERROR("Error getting stat info about the source \"%s\"", source);
5045 goto out;
5046 }
5047 }
5048
5049 is_dir = (S_ISDIR(sb.st_mode) != 0);
5050 if (is_dir) {
5051 sret = mkdtemp(template);
5052 if (!sret) {
5053 SYSERROR("Could not create shmounts temporary dir");
5054 goto out;
5055 }
5056 } else {
5057 fd = lxc_make_tmpfile(template, false);
5058 if (fd < 0) {
5059 SYSERROR("Could not create shmounts temporary file");
5060 goto out;
5061 }
5062 }
5063
5064 /* Do the fork */
5065 pid = fork();
5066 if (pid < 0) {
5067 SYSERROR("Could not fork");
5068 goto out;
5069 }
5070
5071 if (pid == 0) {
5072 /* Do the mount */
5073 ret = mount(source, template, filesystemtype, mountflags, data);
5074 if (ret < 0) {
5075 SYSERROR("Failed to mount onto \"%s\"", template);
5076 _exit(EXIT_FAILURE);
5077 }
5078 TRACE("Mounted \"%s\" onto \"%s\"", source, template);
5079
5080 init_pid = do_lxcapi_init_pid(c);
5081 if (init_pid < 0) {
5082 ERROR("Failed to obtain container's init pid");
5083 _exit(EXIT_FAILURE);
5084 }
5085
5086 /* Enter the container namespaces */
5087 if (!lxc_list_empty(&c->lxc_conf->id_map)) {
5088 if (!switch_to_ns(init_pid, "user")) {
5089 ERROR("Failed to enter user namespace");
5090 _exit(EXIT_FAILURE);
5091 }
5092
5093 if (!lxc_switch_uid_gid(0, 0))
5094 _exit(EXIT_FAILURE);
5095 }
5096
5097 if (!switch_to_ns(init_pid, "mnt")) {
5098 ERROR("Failed to enter mount namespace");
5099 _exit(EXIT_FAILURE);
5100 }
5101
5102 ret = create_mount_target(target, sb.st_mode);
5103 if (ret < 0)
5104 _exit(EXIT_FAILURE);
5105
5106 suff = strrchr(template, '/');
5107 if (!suff)
5108 _exit(EXIT_FAILURE);
5109
5110 ret = snprintf(path, sizeof(path), "%s%s", c->lxc_conf->shmount.path_cont, suff);
5111 if (ret < 0 || (size_t)ret >= sizeof(path)) {
5112 SYSERROR("Error writing container mountpoint name");
5113 _exit(EXIT_FAILURE);
5114 }
5115
5116 ret = mount(path, target, NULL, MS_MOVE | MS_REC, NULL);
5117 if (ret < 0) {
5118 SYSERROR("Failed to move the mount from \"%s\" to \"%s\"", path, target);
5119 _exit(EXIT_FAILURE);
5120 }
5121 TRACE("Moved mount from \"%s\" to \"%s\"", path, target);
5122
5123 _exit(EXIT_SUCCESS);
5124 }
5125
5126 ret = wait_for_pid(pid);
5127 if (ret < 0) {
5128 SYSERROR("Wait for the child with pid %ld failed", (long) pid);
5129 goto out;
5130 }
5131
5132 ret = 0;
5133
5134 (void)umount2(template, MNT_DETACH);
5135 if (is_dir)
5136 (void)rmdir(template);
5137 else
5138 (void)unlink(template);
5139
5140 out:
5141 if (fd >= 0)
5142 close(fd);
5143
5144 return ret;
5145 }
5146
5147 WRAP_API_6(int, lxcapi_mount, const char *, const char *, const char *,
5148 unsigned long, const void *, struct lxc_mount *)
5149
5150 static int do_lxcapi_umount(struct lxc_container *c, const char *target,
5151 unsigned long flags, struct lxc_mount *mnt)
5152 {
5153 pid_t pid, init_pid;
5154 int ret = -1;
5155
5156 if (!c || !c->lxc_conf) {
5157 ERROR("Container or configuration is NULL");
5158 return -EINVAL;
5159 }
5160
5161 /* Do the fork */
5162 pid = fork();
5163 if (pid < 0) {
5164 SYSERROR("Could not fork");
5165 return -1;
5166 }
5167
5168 if (pid == 0) {
5169 init_pid = do_lxcapi_init_pid(c);
5170 if (init_pid < 0) {
5171 ERROR("Failed to obtain container's init pid");
5172 _exit(EXIT_FAILURE);
5173 }
5174
5175 /* Enter the container namespaces */
5176 if (!lxc_list_empty(&c->lxc_conf->id_map)) {
5177 if (!switch_to_ns(init_pid, "user")) {
5178 ERROR("Failed to enter user namespace");
5179 _exit(EXIT_FAILURE);
5180 }
5181 }
5182
5183 if (!switch_to_ns(init_pid, "mnt")) {
5184 ERROR("Failed to enter mount namespace");
5185 _exit(EXIT_FAILURE);
5186 }
5187
5188 /* Do the unmount */
5189 ret = umount2(target, flags);
5190 if (ret < 0) {
5191 SYSERROR("Failed to umount \"%s\"", target);
5192 _exit(EXIT_FAILURE);
5193 }
5194
5195 _exit(EXIT_SUCCESS);
5196 }
5197
5198 ret = wait_for_pid(pid);
5199 if (ret < 0) {
5200 SYSERROR("Wait for the child with pid %ld failed", (long)pid);
5201 return -ret;
5202 }
5203
5204 return 0;
5205 }
5206
5207 WRAP_API_3(int, lxcapi_umount, const char *, unsigned long, struct lxc_mount*)
5208
5209 static int lxcapi_attach_run_waitl(struct lxc_container *c, lxc_attach_options_t *options, const char *program, const char *arg, ...)
5210 {
5211 va_list ap;
5212 const char **argv;
5213 int ret;
5214
5215 if (!c)
5216 return -1;
5217
5218 current_config = c->lxc_conf;
5219
5220 va_start(ap, arg);
5221 argv = lxc_va_arg_list_to_argv_const(ap, 1);
5222 va_end(ap);
5223
5224 if (!argv) {
5225 ERROR("Memory allocation error.");
5226 ret = -1;
5227 goto out;
5228 }
5229 argv[0] = arg;
5230
5231 ret = do_lxcapi_attach_run_wait(c, options, program, (const char * const *)argv);
5232 free((void*)argv);
5233
5234 out:
5235 current_config = NULL;
5236 return ret;
5237 }
5238
5239 static int do_lxcapi_seccomp_notify(struct lxc_container *c, unsigned int cmd, int fd)
5240 {
5241 if (!c || !c->lxc_conf)
5242 return minus_one_set_errno(-EINVAL);
5243
5244 switch (cmd) {
5245 case LXC_SECCOMP_NOTIFY_GET_FD:
5246 if (fd)
5247 return minus_one_set_errno(EINVAL);
5248
5249 return lxc_seccomp_get_notify_fd(&c->lxc_conf->seccomp);
5250 }
5251
5252 return minus_one_set_errno(EINVAL);
5253 }
5254
5255 WRAP_API_2(int, lxcapi_seccomp_notify, unsigned int, int)
5256
5257 struct lxc_container *lxc_container_new(const char *name, const char *configpath)
5258 {
5259 struct lxc_container *c;
5260 size_t len;
5261 int rc;
5262
5263 if (!name)
5264 return NULL;
5265
5266 c = malloc(sizeof(*c));
5267 if (!c) {
5268 fprintf(stderr, "Failed to allocate memory for %s\n", name);
5269 return NULL;
5270 }
5271 memset(c, 0, sizeof(*c));
5272
5273 if (configpath)
5274 c->config_path = strdup(configpath);
5275 else
5276 c->config_path = strdup(lxc_global_config_value("lxc.lxcpath"));
5277 if (!c->config_path) {
5278 fprintf(stderr, "Failed to allocate memory for %s\n", name);
5279 goto err;
5280 }
5281
5282 remove_trailing_slashes(c->config_path);
5283
5284 len = strlen(name);
5285 c->name = malloc(len + 1);
5286 if (!c->name) {
5287 fprintf(stderr, "Failed to allocate memory for %s\n", name);
5288 goto err;
5289 }
5290 (void)strlcpy(c->name, name, len + 1);
5291
5292 c->numthreads = 1;
5293 c->slock = lxc_newlock(c->config_path, name);
5294 if (!c->slock) {
5295 fprintf(stderr, "Failed to create lock for %s\n", name);
5296 goto err;
5297 }
5298
5299 c->privlock = lxc_newlock(NULL, NULL);
5300 if (!c->privlock) {
5301 fprintf(stderr, "Failed to create private lock for %s\n", name);
5302 goto err;
5303 }
5304
5305 if (!set_config_filename(c)) {
5306 fprintf(stderr, "Failed to create config file name for %s\n", name);
5307 goto err;
5308 }
5309
5310 if (file_exists(c->configfile) && !lxcapi_load_config(c, NULL)) {
5311 fprintf(stderr, "Failed to load config for %s\n", name);
5312 goto err;
5313 }
5314
5315 rc = ongoing_create(c);
5316 switch (rc) {
5317 case LXC_CREATE_INCOMPLETE:
5318 SYSERROR("Failed to complete container creation for %s", c->name);
5319 container_destroy(c, NULL);
5320 lxcapi_clear_config(c);
5321 break;
5322 case LXC_CREATE_ONGOING:
5323 /* container creation going on */
5324 break;
5325 case LXC_CREATE_FAILED:
5326 /* container creation failed */
5327 if (errno != EACCES && errno != EPERM) {
5328 /* insufficient privileges */
5329 SYSERROR("Failed checking for incomplete container %s creation", c->name);
5330 goto err;
5331 }
5332 break;
5333 }
5334
5335 c->daemonize = true;
5336 c->pidfile = NULL;
5337
5338 /* Assign the member functions. */
5339 c->is_defined = lxcapi_is_defined;
5340 c->state = lxcapi_state;
5341 c->is_running = lxcapi_is_running;
5342 c->freeze = lxcapi_freeze;
5343 c->unfreeze = lxcapi_unfreeze;
5344 c->console = lxcapi_console;
5345 c->console_getfd = lxcapi_console_getfd;
5346 c->init_pid = lxcapi_init_pid;
5347 c->load_config = lxcapi_load_config;
5348 c->want_daemonize = lxcapi_want_daemonize;
5349 c->want_close_all_fds = lxcapi_want_close_all_fds;
5350 c->start = lxcapi_start;
5351 c->startl = lxcapi_startl;
5352 c->stop = lxcapi_stop;
5353 c->config_file_name = lxcapi_config_file_name;
5354 c->wait = lxcapi_wait;
5355 c->set_config_item = lxcapi_set_config_item;
5356 c->destroy = lxcapi_destroy;
5357 c->destroy_with_snapshots = lxcapi_destroy_with_snapshots;
5358 c->rename = lxcapi_rename;
5359 c->save_config = lxcapi_save_config;
5360 c->get_keys = lxcapi_get_keys;
5361 c->create = lxcapi_create;
5362 c->createl = lxcapi_createl;
5363 c->shutdown = lxcapi_shutdown;
5364 c->reboot = lxcapi_reboot;
5365 c->reboot2 = lxcapi_reboot2;
5366 c->clear_config = lxcapi_clear_config;
5367 c->clear_config_item = lxcapi_clear_config_item;
5368 c->get_config_item = lxcapi_get_config_item;
5369 c->get_running_config_item = lxcapi_get_running_config_item;
5370 c->get_cgroup_item = lxcapi_get_cgroup_item;
5371 c->set_cgroup_item = lxcapi_set_cgroup_item;
5372 c->get_config_path = lxcapi_get_config_path;
5373 c->set_config_path = lxcapi_set_config_path;
5374 c->clone = lxcapi_clone;
5375 c->get_interfaces = lxcapi_get_interfaces;
5376 c->get_ips = lxcapi_get_ips;
5377 c->attach = lxcapi_attach;
5378 c->attach_run_wait = lxcapi_attach_run_wait;
5379 c->attach_run_waitl = lxcapi_attach_run_waitl;
5380 c->snapshot = lxcapi_snapshot;
5381 c->snapshot_list = lxcapi_snapshot_list;
5382 c->snapshot_restore = lxcapi_snapshot_restore;
5383 c->snapshot_destroy = lxcapi_snapshot_destroy;
5384 c->snapshot_destroy_all = lxcapi_snapshot_destroy_all;
5385 c->may_control = lxcapi_may_control;
5386 c->add_device_node = lxcapi_add_device_node;
5387 c->remove_device_node = lxcapi_remove_device_node;
5388 c->attach_interface = lxcapi_attach_interface;
5389 c->detach_interface = lxcapi_detach_interface;
5390 c->checkpoint = lxcapi_checkpoint;
5391 c->restore = lxcapi_restore;
5392 c->migrate = lxcapi_migrate;
5393 c->console_log = lxcapi_console_log;
5394 c->mount = lxcapi_mount;
5395 c->umount = lxcapi_umount;
5396 c->seccomp_notify = lxcapi_seccomp_notify;
5397
5398 return c;
5399
5400 err:
5401 lxc_container_free(c);
5402 return NULL;
5403 }
5404
5405 int lxc_get_wait_states(const char **states)
5406 {
5407 int i;
5408
5409 if (states)
5410 for (i=0; i<MAX_STATE; i++)
5411 states[i] = lxc_state2str(i);
5412
5413 return MAX_STATE;
5414 }
5415
5416 /*
5417 * These next two could probably be done smarter with reusing a common function
5418 * with different iterators and tests...
5419 */
5420 int list_defined_containers(const char *lxcpath, char ***names, struct lxc_container ***cret)
5421 {
5422 DIR *dir;
5423 int i, cfound = 0, nfound = 0;
5424 struct dirent *direntp;
5425 struct lxc_container *c;
5426
5427 if (!lxcpath)
5428 lxcpath = lxc_global_config_value("lxc.lxcpath");
5429
5430 dir = opendir(lxcpath);
5431 if (!dir) {
5432 SYSERROR("opendir on lxcpath");
5433 return -1;
5434 }
5435
5436 if (cret)
5437 *cret = NULL;
5438
5439 if (names)
5440 *names = NULL;
5441
5442 while ((direntp = readdir(dir))) {
5443 /* Ignore '.', '..' and any hidden directory. */
5444 if (!strncmp(direntp->d_name, ".", 1))
5445 continue;
5446
5447 if (!config_file_exists(lxcpath, direntp->d_name))
5448 continue;
5449
5450 if (names)
5451 if (!add_to_array(names, direntp->d_name, cfound))
5452 goto free_bad;
5453
5454 cfound++;
5455
5456 if (!cret) {
5457 nfound++;
5458 continue;
5459 }
5460
5461 c = lxc_container_new(direntp->d_name, lxcpath);
5462 if (!c) {
5463 INFO("Container %s:%s has a config but could not be loaded",
5464 lxcpath, direntp->d_name);
5465
5466 if (names)
5467 if(!remove_from_array(names, direntp->d_name, cfound--))
5468 goto free_bad;
5469
5470 continue;
5471 }
5472
5473 if (!do_lxcapi_is_defined(c)) {
5474 INFO("Container %s:%s has a config but is not defined",
5475 lxcpath, direntp->d_name);
5476
5477 if (names)
5478 if(!remove_from_array(names, direntp->d_name, cfound--))
5479 goto free_bad;
5480
5481 lxc_container_put(c);
5482 continue;
5483 }
5484
5485 if (!add_to_clist(cret, c, nfound, true)) {
5486 lxc_container_put(c);
5487 goto free_bad;
5488 }
5489
5490 nfound++;
5491 }
5492
5493 closedir(dir);
5494 return nfound;
5495
5496 free_bad:
5497 if (names && *names) {
5498 for (i=0; i<cfound; i++)
5499 free((*names)[i]);
5500 free(*names);
5501 }
5502
5503 if (cret && *cret) {
5504 for (i=0; i<nfound; i++)
5505 lxc_container_put((*cret)[i]);
5506 free(*cret);
5507 }
5508
5509 closedir(dir);
5510 return -1;
5511 }
5512
5513 int list_active_containers(const char *lxcpath, char ***nret,
5514 struct lxc_container ***cret)
5515 {
5516 int i, ret = -1, cret_cnt = 0, ct_name_cnt = 0;
5517 int lxcpath_len;
5518 char *line = NULL;
5519 char **ct_name = NULL;
5520 size_t len = 0;
5521 struct lxc_container *c = NULL;
5522 bool is_hashed;
5523
5524 if (!lxcpath)
5525 lxcpath = lxc_global_config_value("lxc.lxcpath");
5526 lxcpath_len = strlen(lxcpath);
5527
5528 if (cret)
5529 *cret = NULL;
5530
5531 if (nret)
5532 *nret = NULL;
5533
5534 FILE *f = fopen("/proc/net/unix", "r");
5535 if (!f)
5536 return -1;
5537
5538 while (getline(&line, &len, f) != -1) {
5539 char *p = strrchr(line, ' '), *p2;
5540 if (!p)
5541 continue;
5542 p++;
5543
5544 if (*p != 0x40)
5545 continue;
5546 p++;
5547
5548 is_hashed = false;
5549
5550 if (strncmp(p, lxcpath, lxcpath_len) == 0) {
5551 p += lxcpath_len;
5552 } else if (strncmp(p, "lxc/", 4) == 0) {
5553 p += 4;
5554 is_hashed = true;
5555 } else {
5556 continue;
5557 }
5558
5559 while (*p == '/')
5560 p++;
5561
5562 /* Now p is the start of lxc_name. */
5563 p2 = strchr(p, '/');
5564 if (!p2 || strncmp(p2, "/command", 8) != 0)
5565 continue;
5566 *p2 = '\0';
5567
5568 if (is_hashed) {
5569 char *recvpath = lxc_cmd_get_lxcpath(p);
5570 if (!recvpath)
5571 continue;
5572
5573 if (strncmp(lxcpath, recvpath, lxcpath_len) != 0) {
5574 free(recvpath);
5575 continue;
5576 }
5577 free(recvpath);
5578
5579 p = lxc_cmd_get_name(p);
5580 if (!p)
5581 continue;
5582 }
5583
5584 if (array_contains(&ct_name, p, ct_name_cnt)) {
5585 if (is_hashed)
5586 free(p);
5587 continue;
5588 }
5589
5590 if (!add_to_array(&ct_name, p, ct_name_cnt)) {
5591 if (is_hashed)
5592 free(p);
5593 goto free_cret_list;
5594 }
5595
5596 ct_name_cnt++;
5597
5598 if (!cret) {
5599 if (is_hashed)
5600 free(p);
5601 continue;
5602 }
5603
5604 c = lxc_container_new(p, lxcpath);
5605 if (!c) {
5606 INFO("Container %s:%s is running but could not be loaded",
5607 lxcpath, p);
5608
5609 remove_from_array(&ct_name, p, ct_name_cnt--);
5610 if (is_hashed)
5611 free(p);
5612
5613 continue;
5614 }
5615
5616 if (is_hashed)
5617 free(p);
5618
5619 /*
5620 * If this is an anonymous container, then is_defined *can*
5621 * return false. So we don't do that check. Count on the
5622 * fact that the command socket exists.
5623 */
5624
5625 if (!add_to_clist(cret, c, cret_cnt, true)) {
5626 lxc_container_put(c);
5627 goto free_cret_list;
5628 }
5629
5630 cret_cnt++;
5631 }
5632
5633 if (nret && cret && cret_cnt != ct_name_cnt) {
5634 if (c)
5635 lxc_container_put(c);
5636 goto free_cret_list;
5637 }
5638
5639 ret = ct_name_cnt;
5640 if (nret)
5641 *nret = ct_name;
5642 else
5643 goto free_ct_name;
5644
5645 goto out;
5646
5647 free_cret_list:
5648 if (cret && *cret) {
5649 for (i = 0; i < cret_cnt; i++)
5650 lxc_container_put((*cret)[i]);
5651 free(*cret);
5652 }
5653
5654 free_ct_name:
5655 if (ct_name) {
5656 for (i = 0; i < ct_name_cnt; i++)
5657 free(ct_name[i]);
5658 free(ct_name);
5659 }
5660
5661 out:
5662 free(line);
5663 fclose(f);
5664 return ret;
5665 }
5666
5667 int list_all_containers(const char *lxcpath, char ***nret,
5668 struct lxc_container ***cret)
5669 {
5670 int i, ret, active_cnt, ct_cnt, ct_list_cnt;
5671 char **active_name;
5672 char **ct_name;
5673 struct lxc_container **ct_list = NULL;
5674
5675 ct_cnt = list_defined_containers(lxcpath, &ct_name, NULL);
5676 if (ct_cnt < 0)
5677 return ct_cnt;
5678
5679 active_cnt = list_active_containers(lxcpath, &active_name, NULL);
5680 if (active_cnt < 0) {
5681 ret = active_cnt;
5682 goto free_ct_name;
5683 }
5684
5685 for (i = 0; i < active_cnt; i++) {
5686 if (!array_contains(&ct_name, active_name[i], ct_cnt)) {
5687 if (!add_to_array(&ct_name, active_name[i], ct_cnt)) {
5688 ret = -1;
5689 goto free_active_name;
5690 }
5691
5692 ct_cnt++;
5693 }
5694
5695 free(active_name[i]);
5696 active_name[i] = NULL;
5697 }
5698
5699 free(active_name);
5700 active_name = NULL;
5701 active_cnt = 0;
5702
5703 for (i = 0, ct_list_cnt = 0; i < ct_cnt && cret; i++) {
5704 struct lxc_container *c;
5705
5706 c = lxc_container_new(ct_name[i], lxcpath);
5707 if (!c) {
5708 WARN("Container %s:%s could not be loaded", lxcpath, ct_name[i]);
5709 remove_from_array(&ct_name, ct_name[i], ct_cnt--);
5710 continue;
5711 }
5712
5713 if (!add_to_clist(&ct_list, c, ct_list_cnt, false)) {
5714 lxc_container_put(c);
5715 ret = -1;
5716 goto free_ct_list;
5717 }
5718
5719 ct_list_cnt++;
5720 }
5721
5722 if (cret)
5723 *cret = ct_list;
5724
5725 if (nret) {
5726 *nret = ct_name;
5727 } else {
5728 ret = ct_cnt;
5729 goto free_ct_name;
5730 }
5731
5732 return ct_cnt;
5733
5734 free_ct_list:
5735 for (i = 0; i < ct_list_cnt; i++) {
5736 lxc_container_put(ct_list[i]);
5737 }
5738 free(ct_list);
5739
5740 free_active_name:
5741 for (i = 0; i < active_cnt; i++) {
5742 free(active_name[i]);
5743 }
5744 free(active_name);
5745
5746 free_ct_name:
5747 for (i = 0; i < ct_cnt; i++) {
5748 free(ct_name[i]);
5749 }
5750 free(ct_name);
5751 return ret;
5752 }
5753
5754 bool lxc_config_item_is_supported(const char *key)
5755 {
5756 return !!lxc_get_config(key);
5757 }
5758
5759 bool lxc_has_api_extension(const char *extension)
5760 {
5761 /* The NULL API extension is always present. :) */
5762 if (!extension)
5763 return true;
5764
5765 for (size_t i = 0; i < nr_api_extensions; i++)
5766 if (strcmp(api_extensions[i], extension) == 0)
5767 return true;
5768
5769 return false;
5770 }
LXC mirror