]> git.proxmox.com Git - mirror_lxc.git/blob - src/lxc/lxccontainer.c
projects / mirror_lxc.git / blob
? search:
summary | shortlog | log | commit | commitdiff | tree
blame | history | raw | HEAD
Merge pull request #2836 from brauner/2019-02-10/fix_cgfsng_driver
[mirror_lxc.git] / src / lxc / lxccontainer.c
1 /* liblxcapi
2 *
3 * Copyright © 2012 Serge Hallyn <serge.hallyn@ubuntu.com>.
4 * Copyright © 2012 Canonical Ltd.
5 *
6 * This library is free software; you can redistribute it and/or
7 * modify it under the terms of the GNU Lesser General Public
8 * License as published by the Free Software Foundation; either
9 * version 2.1 of the License, or (at your option) any later version.
10
11 * This library is distributed in the hope that it will be useful,
12 * but WITHOUT ANY WARRANTY; without even the implied warranty of
13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
14 * Lesser General Public License for more details.
15
16 * You should have received a copy of the GNU Lesser General Public
17 * License along with this library; if not, write to the Free Software
18 * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
19 */
20
21 #ifndef _GNU_SOURCE
22 #define _GNU_SOURCE 1
23 #endif
24 #include <arpa/inet.h>
25 #include <dirent.h>
26 #include <errno.h>
27 #include <fcntl.h>
28 #include <grp.h>
29 #include <libgen.h>
30 #include <pthread.h>
31 #include <sched.h>
32 #include <stdarg.h>
33 #include <stdint.h>
34 #include <stdio.h>
35 #include <stdlib.h>
36 #include <sys/file.h>
37 #include <sys/mman.h>
38 #include <sys/mount.h>
39 #include <sys/stat.h>
40 #include <sys/syscall.h>
41 #include <sys/sysmacros.h>
42 #include <sys/types.h>
43 #include <sys/wait.h>
44 #include <unistd.h>
45
46 #include "../include/netns_ifaddrs.h"
47 #include "af_unix.h"
48 #include "api_extensions.h"
49 #include "attach.h"
50 #include "cgroup.h"
51 #include "commands.h"
52 #include "commands_utils.h"
53 #include "conf.h"
54 #include "config.h"
55 #include "confile.h"
56 #include "confile_utils.h"
57 #include "criu.h"
58 #include "error.h"
59 #include "initutils.h"
60 #include "log.h"
61 #include "lxc.h"
62 #include "lxccontainer.h"
63 #include "lxclock.h"
64 #include "memory_utils.h"
65 #include "monitor.h"
66 #include "namespace.h"
67 #include "network.h"
68 #include "parse.h"
69 #include "raw_syscalls.h"
70 #include "start.h"
71 #include "state.h"
72 #include "storage.h"
73 #include "storage/btrfs.h"
74 #include "storage/overlay.h"
75 #include "storage_utils.h"
76 #include "sync.h"
77 #include "syscall_wrappers.h"
78 #include "terminal.h"
79 #include "utils.h"
80 #include "version.h"
81
82 /* major()/minor() */
83 #ifdef MAJOR_IN_MKDEV
84 #include <sys/mkdev.h>
85 #endif
86
87 #if IS_BIONIC
88 #include <../include/lxcmntent.h>
89 #else
90 #include <mntent.h>
91 #endif
92
93 #ifndef HAVE_STRLCPY
94 #include "include/strlcpy.h"
95 #endif
96
97 /* Define faccessat() if missing from the C library */
98 #ifndef HAVE_FACCESSAT
99 static int faccessat(int __fd, const char *__file, int __type, int __flag)
100 {
101 #ifdef __NR_faccessat
102 return syscall(__NR_faccessat, __fd, __file, __type, __flag);
103 #else
104 errno = ENOSYS;
105 return -1;
106 #endif
107 }
108 #endif
109
110 lxc_log_define(lxccontainer, lxc);
111
112 static bool do_lxcapi_destroy(struct lxc_container *c);
113 static const char *lxcapi_get_config_path(struct lxc_container *c);
114 #define do_lxcapi_get_config_path(c) lxcapi_get_config_path(c)
115 static bool do_lxcapi_set_config_item(struct lxc_container *c, const char *key, const char *v);
116 static bool container_destroy(struct lxc_container *c,
117 struct lxc_storage *storage);
118 static bool get_snappath_dir(struct lxc_container *c, char *snappath);
119 static bool lxcapi_snapshot_destroy_all(struct lxc_container *c);
120 static bool do_lxcapi_save_config(struct lxc_container *c, const char *alt_file);
121
122 static bool config_file_exists(const char *lxcpath, const char *cname)
123 {
124 __do_free char *fname;
125 int ret;
126 size_t len;
127
128 /* $lxcpath + '/' + $cname + '/config' + \0 */
129 len = strlen(lxcpath) + strlen(cname) + 9;
130 fname = must_realloc(NULL, len);
131 ret = snprintf(fname, len, "%s/%s/config", lxcpath, cname);
132 if (ret < 0 || (size_t)ret >= len)
133 return false;
134
135 return file_exists(fname);
136 }
137
138 /* A few functions to help detect when a container creation failed. If a
139 * container creation was killed partway through, then trying to actually start
140 * that container could harm the host. We detect this by creating a 'partial'
141 * file under the container directory, and keeping an advisory lock. When
142 * container creation completes, we remove that file. When we load or try to
143 * start a container, if we find that file, without a flock, we remove the
144 * container.
145 */
146 static int ongoing_create(struct lxc_container *c)
147 {
148 __do_free char *path;
149 int fd, ret;
150 size_t len;
151 struct flock lk = {0};
152
153 len = strlen(c->config_path) + strlen(c->name) + 10;
154 path = must_realloc(NULL, len);
155 ret = snprintf(path, len, "%s/%s/partial", c->config_path, c->name);
156 if (ret < 0 || (size_t)ret >= len)
157 return -1;
158
159 fd = open(path, O_RDWR | O_CLOEXEC);
160 if (fd < 0) {
161 if (errno != ENOENT)
162 return -1;
163
164 return 0;
165 }
166
167 lk.l_type = F_WRLCK;
168 lk.l_whence = SEEK_SET;
169 /* F_OFD_GETLK requires that l_pid be set to 0 otherwise the kernel
170 * will EINVAL us.
171 */
172 lk.l_pid = 0;
173
174 ret = fcntl(fd, F_OFD_GETLK, &lk);
175 if (ret < 0 && errno == EINVAL) {
176 ret = flock(fd, LOCK_EX | LOCK_NB);
177 if (ret < 0 && errno == EWOULDBLOCK)
178 ret = 0;
179 }
180
181 close(fd);
182
183 /* F_OFD_GETLK will not send us back a pid so don't check it. */
184 if (ret == 0)
185 /* Create is still ongoing. */
186 return 1;
187
188 /* Create completed but partial is still there. */
189 return 2;
190 }
191
192 static int create_partial(struct lxc_container *c)
193 {
194 __do_free char *path;
195 int fd, ret;
196 size_t len;
197 struct flock lk = {0};
198
199 /* $lxcpath + '/' + $name + '/partial' + \0 */
200 len = strlen(c->config_path) + strlen(c->name) + 10;
201 path = must_realloc(NULL, len);
202 ret = snprintf(path, len, "%s/%s/partial", c->config_path, c->name);
203 if (ret < 0 || (size_t)ret >= len)
204 return -1;
205
206 fd = open(path, O_RDWR | O_CREAT | O_EXCL | O_CLOEXEC, 0000);
207 if (fd < 0)
208 return -1;
209
210 lk.l_type = F_WRLCK;
211 lk.l_whence = SEEK_SET;
212
213 ret = fcntl(fd, F_OFD_SETLKW, &lk);
214 if (ret < 0) {
215 if (errno == EINVAL) {
216 ret = flock(fd, LOCK_EX);
217 if (ret == 0)
218 return fd;
219 }
220
221 SYSERROR("Failed to lock partial file %s", path);
222 close(fd);
223 return -1;
224 }
225
226 return fd;
227 }
228
229 static void remove_partial(struct lxc_container *c, int fd)
230 {
231 __do_free char *path;
232 int ret;
233 size_t len;
234
235 close(fd);
236
237 /* $lxcpath + '/' + $name + '/partial' + \0 */
238 len = strlen(c->config_path) + strlen(c->name) + 10;
239 path = must_realloc(NULL, len);
240 ret = snprintf(path, len, "%s/%s/partial", c->config_path, c->name);
241 if (ret < 0 || (size_t)ret >= len)
242 return;
243
244 ret = unlink(path);
245 if (ret < 0)
246 SYSERROR("Failed to remove partial file %s", path);
247 }
248
249 /* LOCKING
250 * 1. container_mem_lock(c) protects the struct lxc_container from multiple threads.
251 * 2. container_disk_lock(c) protects the on-disk container data - in particular the
252 * container configuration file.
253 * The container_disk_lock also takes the container_mem_lock.
254 * 3. thread_mutex protects process data (ex: fd table) from multiple threads.
255 * NOTHING mutexes two independent programs with their own struct
256 * lxc_container for the same c->name, between API calls. For instance,
257 * c->config_read(); c->start(); Between those calls, data on disk
258 * could change (which shouldn't bother the caller unless for instance
259 * the rootfs get moved). c->config_read(); update; c->config_write();
260 * Two such updaters could race. The callers should therefore check their
261 * results. Trying to prevent that would necessarily expose us to deadlocks
262 * due to hung callers. So I prefer to keep the locks only within our own
263 * functions, not across functions.
264 *
265 * If you're going to clone while holding a lxccontainer, increment
266 * c->numthreads (under privlock) before forking. When deleting,
267 * decrement numthreads under privlock, then if it hits 0 you can delete.
268 * Do not ever use a lxccontainer whose numthreads you did not bump.
269 */
270 static void lxc_container_free(struct lxc_container *c)
271 {
272 if (!c)
273 return;
274
275 free(c->configfile);
276 c->configfile = NULL;
277
278 free(c->error_string);
279 c->error_string = NULL;
280
281 if (c->slock) {
282 lxc_putlock(c->slock);
283 c->slock = NULL;
284 }
285
286 if (c->privlock) {
287 lxc_putlock(c->privlock);
288 c->privlock = NULL;
289 }
290
291 free(c->name);
292 c->name = NULL;
293
294 if (c->lxc_conf) {
295 lxc_conf_free(c->lxc_conf);
296 c->lxc_conf = NULL;
297 }
298
299 free(c->config_path);
300 c->config_path = NULL;
301
302 free(c);
303 }
304
305 /* Consider the following case:
306 *
307 * |====================================================================|
308 * | freer | racing get()er |
309 * |====================================================================|
310 * | lxc_container_put() | lxc_container_get() |
311 * | \ lxclock(c->privlock) | c->numthreads < 1? (no) |
312 * | \ c->numthreads = 0 | \ lxclock(c->privlock) -> waits |
313 * | \ lxcunlock() | \ |
314 * | \ lxc_container_free() | \ lxclock() returns |
315 * | | \ c->numthreads < 1 -> return 0 |
316 * | \ \ (free stuff) | |
317 * | \ \ sem_destroy(privlock) | |
318 * |_______________________________|____________________________________|
319 *
320 * When the get()er checks numthreads the first time, one of the following
321 * is true:
322 * 1. freer has set numthreads = 0. get() returns 0
323 * 2. freer is between lxclock and setting numthreads to 0. get()er will
324 * sem_wait on privlock, get lxclock after freer() drops it, then see
325 * numthreads is 0 and exit without touching lxclock again..
326 * 3. freer has not yet locked privlock. If get()er runs first, then put()er
327 * will see --numthreads = 1 and not call lxc_container_free().
328 */
329
330 int lxc_container_get(struct lxc_container *c)
331 {
332 if (!c)
333 return 0;
334
335 /* If someone else has already started freeing the container, don't try
336 * to take the lock, which may be invalid.
337 */
338 if (c->numthreads < 1)
339 return 0;
340
341 if (container_mem_lock(c))
342 return 0;
343
344 /* Bail without trying to unlock, bc the privlock is now probably in
345 * freed memory.
346 */
347 if (c->numthreads < 1)
348 return 0;
349
350 c->numthreads++;
351 container_mem_unlock(c);
352
353 return 1;
354 }
355
356 int lxc_container_put(struct lxc_container *c)
357 {
358 if (!c)
359 return -1;
360
361 if (container_mem_lock(c))
362 return -1;
363
364 c->numthreads--;
365
366 if (c->numthreads < 1) {
367 container_mem_unlock(c);
368 lxc_container_free(c);
369 return 1;
370 }
371
372 container_mem_unlock(c);
373 return 0;
374 }
375
376 static bool do_lxcapi_is_defined(struct lxc_container *c)
377 {
378 int statret;
379 struct stat statbuf;
380 bool ret = false;
381
382 if (!c)
383 return false;
384
385 if (container_mem_lock(c))
386 return false;
387
388 if (!c->configfile)
389 goto on_error;
390
391 statret = stat(c->configfile, &statbuf);
392 if (statret != 0)
393 goto on_error;
394
395 ret = true;
396
397 on_error:
398 container_mem_unlock(c);
399 return ret;
400 }
401
402 #define WRAP_API(rettype, fnname) \
403 static rettype fnname(struct lxc_container *c) \
404 { \
405 rettype ret; \
406 bool reset_config = false; \
407 \
408 if (!current_config && c && c->lxc_conf) { \
409 current_config = c->lxc_conf; \
410 reset_config = true; \
411 } \
412 \
413 ret = do_##fnname(c); \
414 if (reset_config) \
415 current_config = NULL; \
416 \
417 return ret; \
418 }
419
420 #define WRAP_API_1(rettype, fnname, t1) \
421 static rettype fnname(struct lxc_container *c, t1 a1) \
422 { \
423 rettype ret; \
424 bool reset_config = false; \
425 \
426 if (!current_config && c && c->lxc_conf) { \
427 current_config = c->lxc_conf; \
428 reset_config = true; \
429 } \
430 \
431 ret = do_##fnname(c, a1); \
432 if (reset_config) \
433 current_config = NULL; \
434 \
435 return ret; \
436 }
437
438 #define WRAP_API_2(rettype, fnname, t1, t2) \
439 static rettype fnname(struct lxc_container *c, t1 a1, t2 a2) \
440 { \
441 rettype ret; \
442 bool reset_config = false; \
443 \
444 if (!current_config && c && c->lxc_conf) { \
445 current_config = c->lxc_conf; \
446 reset_config = true; \
447 } \
448 \
449 ret = do_##fnname(c, a1, a2); \
450 if (reset_config) \
451 current_config = NULL; \
452 \
453 return ret; \
454 }
455
456 #define WRAP_API_3(rettype, fnname, t1, t2, t3) \
457 static rettype fnname(struct lxc_container *c, t1 a1, t2 a2, t3 a3) \
458 { \
459 rettype ret; \
460 bool reset_config = false; \
461 \
462 if (!current_config && c && c->lxc_conf) { \
463 current_config = c->lxc_conf; \
464 reset_config = true; \
465 } \
466 \
467 ret = do_##fnname(c, a1, a2, a3); \
468 if (reset_config) \
469 current_config = NULL; \
470 \
471 return ret; \
472 }
473
474 #define WRAP_API_6(rettype, fnname, t1, t2, t3, t4, t5, t6) \
475 static rettype fnname(struct lxc_container *c, t1 a1, t2 a2, t3 a3, \
476 t4 a4, t5 a5, t6 a6) \
477 { \
478 rettype ret; \
479 bool reset_config = false; \
480 \
481 if (!current_config && c && c->lxc_conf) { \
482 current_config = c->lxc_conf; \
483 reset_config = true; \
484 } \
485 \
486 ret = do_##fnname(c, a1, a2, a3, a4, a5, a6); \
487 if (reset_config) \
488 current_config = NULL; \
489 \
490 return ret; \
491 }
492
493 WRAP_API(bool, lxcapi_is_defined)
494
495 static const char *do_lxcapi_state(struct lxc_container *c)
496 {
497 lxc_state_t s;
498
499 if (!c)
500 return NULL;
501
502 s = lxc_getstate(c->name, c->config_path);
503 return lxc_state2str(s);
504 }
505
506 WRAP_API(const char *, lxcapi_state)
507
508 static bool is_stopped(struct lxc_container *c)
509 {
510 lxc_state_t s;
511
512 s = lxc_getstate(c->name, c->config_path);
513 return (s == STOPPED);
514 }
515
516 static bool do_lxcapi_is_running(struct lxc_container *c)
517 {
518 if (!c)
519 return false;
520
521 return !is_stopped(c);
522 }
523
524 WRAP_API(bool, lxcapi_is_running)
525
526 static bool do_lxcapi_freeze(struct lxc_container *c)
527 {
528 int ret;
529 lxc_state_t s;
530
531 if (!c || !c->lxc_conf)
532 return false;
533
534 s = lxc_getstate(c->name, c->config_path);
535 if (s != FROZEN)
536 return lxc_freeze(c->lxc_conf, c->name, c->config_path) == 0;
537
538 return true;
539 }
540
541 WRAP_API(bool, lxcapi_freeze)
542
543 static bool do_lxcapi_unfreeze(struct lxc_container *c)
544 {
545 int ret;
546 lxc_state_t s;
547
548 if (!c || !c->lxc_conf)
549 return false;
550
551 s = lxc_getstate(c->name, c->config_path);
552 if (s == FROZEN)
553 return lxc_unfreeze(c->lxc_conf, c->name, c->config_path) == 0;
554
555 return true;
556 }
557
558 WRAP_API(bool, lxcapi_unfreeze)
559
560 static int do_lxcapi_console_getfd(struct lxc_container *c, int *ttynum, int *masterfd)
561 {
562 if (!c)
563 return -1;
564
565 return lxc_terminal_getfd(c, ttynum, masterfd);
566 }
567
568 WRAP_API_2(int, lxcapi_console_getfd, int *, int *)
569
570 static int lxcapi_console(struct lxc_container *c, int ttynum, int stdinfd,
571 int stdoutfd, int stderrfd, int escape)
572 {
573 int ret;
574
575 if (!c)
576 return -1;
577
578 current_config = c->lxc_conf;
579 ret = lxc_console(c, ttynum, stdinfd, stdoutfd, stderrfd, escape);
580 current_config = NULL;
581
582 return ret;
583 }
584
585 static int do_lxcapi_console_log(struct lxc_container *c, struct lxc_console_log *log)
586 {
587 int ret;
588
589 if (!c)
590 return -EINVAL;
591
592 ret = lxc_cmd_console_log(c->name, do_lxcapi_get_config_path(c), log);
593 if (ret < 0) {
594 if (ret == -ENODATA)
595 NOTICE("The console log is empty");
596 else if (ret == -EFAULT)
597 NOTICE("The container does not keep a console log");
598 else if (ret == -ENOENT)
599 NOTICE("The container does not keep a console log file");
600 else if (ret == -EIO)
601 NOTICE("Failed to write console log to log file");
602 else
603 ERROR("Failed to retrieve console log");
604 }
605
606 return ret;
607 }
608
609 WRAP_API_1(int, lxcapi_console_log, struct lxc_console_log *)
610
611 static pid_t do_lxcapi_init_pid(struct lxc_container *c)
612 {
613 if (!c)
614 return -1;
615
616 return lxc_cmd_get_init_pid(c->name, c->config_path);
617 }
618
619 WRAP_API(pid_t, lxcapi_init_pid)
620
621 static bool load_config_locked(struct lxc_container *c, const char *fname)
622 {
623 if (!c->lxc_conf)
624 c->lxc_conf = lxc_conf_init();
625
626 if (!c->lxc_conf)
627 return false;
628
629 if (lxc_config_read(fname, c->lxc_conf, false) != 0)
630 return false;
631
632 c->lxc_conf->name = c->name;
633 return true;
634 }
635
636 static bool do_lxcapi_load_config(struct lxc_container *c, const char *alt_file)
637 {
638 int lret;
639 const char *fname;
640 bool need_disklock = false, ret = false;
641
642 if (!c)
643 return false;
644
645 fname = c->configfile;
646
647 if (alt_file)
648 fname = alt_file;
649
650 if (!fname)
651 return false;
652
653 /* If we're reading something other than the container's config, we only
654 * need to lock the in-memory container. If loading the container's
655 * config file, take the disk lock.
656 */
657 if (strcmp(fname, c->configfile) == 0)
658 need_disklock = true;
659
660 if (need_disklock)
661 lret = container_disk_lock(c);
662 else
663 lret = container_mem_lock(c);
664 if (lret)
665 return false;
666
667 ret = load_config_locked(c, fname);
668
669 if (need_disklock)
670 container_disk_unlock(c);
671 else
672 container_mem_unlock(c);
673
674 return ret;
675 }
676
677 WRAP_API_1(bool, lxcapi_load_config, const char *)
678
679 static bool do_lxcapi_want_daemonize(struct lxc_container *c, bool state)
680 {
681 if (!c || !c->lxc_conf)
682 return false;
683
684 if (container_mem_lock(c))
685 return false;
686
687 c->daemonize = state;
688
689 container_mem_unlock(c);
690
691 return true;
692 }
693
694 WRAP_API_1(bool, lxcapi_want_daemonize, bool)
695
696 static bool do_lxcapi_want_close_all_fds(struct lxc_container *c, bool state)
697 {
698 if (!c || !c->lxc_conf)
699 return false;
700
701 if (container_mem_lock(c))
702 return false;
703
704 c->lxc_conf->close_all_fds = state;
705
706 container_mem_unlock(c);
707
708 return true;
709 }
710
711 WRAP_API_1(bool, lxcapi_want_close_all_fds, bool)
712
713 static bool do_lxcapi_wait(struct lxc_container *c, const char *state,
714 int timeout)
715 {
716 int ret;
717
718 if (!c)
719 return false;
720
721 ret = lxc_wait(c->name, state, timeout, c->config_path);
722 return ret == 0;
723 }
724
725 WRAP_API_2(bool, lxcapi_wait, const char *, int)
726
727 static bool am_single_threaded(void)
728 {
729 DIR *dir;
730 struct dirent *direntp;
731 int count = 0;
732
733 dir = opendir("/proc/self/task");
734 if (!dir)
735 return false;
736
737 while ((direntp = readdir(dir))) {
738 if (strcmp(direntp->d_name, ".") == 0)
739 continue;
740
741 if (strcmp(direntp->d_name, "..") == 0)
742 continue;
743
744 count++;
745 if (count > 1)
746 break;
747 }
748 closedir(dir);
749
750 return count == 1;
751 }
752
753 static void push_arg(char ***argp, char *arg, int *nargs)
754 {
755 char *copy;
756 char **argv;
757
758 copy = must_copy_string(arg);
759
760 do {
761 argv = realloc(*argp, (*nargs + 2) * sizeof(char *));
762 } while (!argv);
763
764 *argp = argv;
765 argv[*nargs] = copy;
766 (*nargs)++;
767 argv[*nargs] = NULL;
768 }
769
770 static char **split_init_cmd(const char *incmd)
771 {
772 __do_free char *copy = NULL;
773 char *p;
774 char **argv;
775 int nargs = 0;
776
777 if (!incmd)
778 return NULL;
779
780 copy = must_copy_string(incmd);
781
782 do {
783 argv = malloc(sizeof(char *));
784 } while (!argv);
785
786 argv[0] = NULL;
787 lxc_iterate_parts (p, copy, " ")
788 push_arg(&argv, p, &nargs);
789
790 if (nargs == 0) {
791 free(argv);
792 return NULL;
793 }
794
795 return argv;
796 }
797
798 static void free_init_cmd(char **argv)
799 {
800 int i = 0;
801
802 if (!argv)
803 return;
804
805 while (argv[i])
806 free(argv[i++]);
807
808 free(argv);
809 }
810
811 static int lxc_rcv_status(int state_socket)
812 {
813 int ret;
814 int state = -1;
815
816 again:
817 /* Receive container state. */
818 ret = lxc_abstract_unix_rcv_credential(state_socket, &state, sizeof(int));
819 if (ret <= 0) {
820 if (errno != EINTR)
821 return -1;
822
823 TRACE("Caught EINTR; retrying");
824 goto again;
825 }
826
827 return state;
828 }
829
830 static bool wait_on_daemonized_start(struct lxc_handler *handler, int pid)
831 {
832 int ret, state;
833
834 /* Close write end of the socket pair. */
835 close(handler->state_socket_pair[1]);
836 handler->state_socket_pair[1] = -1;
837
838 state = lxc_rcv_status(handler->state_socket_pair[0]);
839
840 /* Close read end of the socket pair. */
841 close(handler->state_socket_pair[0]);
842 handler->state_socket_pair[0] = -1;
843
844 /* The first child is going to fork() again and then exits. So we reap
845 * the first child here.
846 */
847 ret = wait_for_pid(pid);
848 if (ret < 0)
849 DEBUG("Failed waiting on first child %d", pid);
850 else
851 DEBUG("First child %d exited", pid);
852
853 if (state < 0) {
854 SYSERROR("Failed to receive the container state");
855 return false;
856 }
857
858 /* If we receive anything else then running we know that the container
859 * failed to start.
860 */
861 if (state != RUNNING) {
862 ERROR("Received container state \"%s\" instead of \"RUNNING\"",
863 lxc_state2str(state));
864 return false;
865 }
866
867 TRACE("Container is in \"RUNNING\" state");
868 return true;
869 }
870
871 static bool do_lxcapi_start(struct lxc_container *c, int useinit, char * const argv[])
872 {
873 int ret;
874 struct lxc_handler *handler;
875 struct lxc_conf *conf;
876 char *default_args[] = {
877 "/sbin/init",
878 NULL,
879 };
880 char **init_cmd = NULL;
881 int keepfds[3] = {-1, -1, -1};
882
883 /* container does exist */
884 if (!c)
885 return false;
886
887 /* If anything fails before we set error_num, we want an error in there.
888 */
889 c->error_num = 1;
890
891 /* Container has not been setup. */
892 if (!c->lxc_conf)
893 return false;
894
895 ret = ongoing_create(c);
896 if (ret < 0) {
897 ERROR("Failed checking for incomplete container creation");
898 return false;
899 } else if (ret == 1) {
900 ERROR("Ongoing container creation detected");
901 return false;
902 } else if (ret == 2) {
903 ERROR("Failed to create container");
904 do_lxcapi_destroy(c);
905 return false;
906 }
907
908 if (container_mem_lock(c))
909 return false;
910
911 conf = c->lxc_conf;
912
913 /* initialize handler */
914 handler = lxc_init_handler(c->name, conf, c->config_path, c->daemonize);
915
916 container_mem_unlock(c);
917 if (!handler)
918 return false;
919
920 if (!argv) {
921 if (useinit && conf->execute_cmd)
922 argv = init_cmd = split_init_cmd(conf->execute_cmd);
923 else
924 argv = init_cmd = split_init_cmd(conf->init_cmd);
925 }
926
927 /* ... otherwise use default_args. */
928 if (!argv) {
929 if (useinit) {
930 ERROR("No valid init detected");
931 lxc_free_handler(handler);
932 return false;
933 }
934 argv = default_args;
935 }
936
937 /* I'm not sure what locks we want here.Any? Is liblxc's locking enough
938 * here to protect the on disk container? We don't want to exclude
939 * things like lxc_info while the container is running.
940 */
941 if (c->daemonize) {
942 bool started;
943 char title[2048];
944 pid_t pid;
945
946 pid = fork();
947 if (pid < 0) {
948 free_init_cmd(init_cmd);
949 lxc_free_handler(handler);
950 return false;
951 }
952
953 /* first parent */
954 if (pid != 0) {
955 /* Set to NULL because we don't want father unlink
956 * the PID file, child will do the free and unlink.
957 */
958 c->pidfile = NULL;
959
960 /* Wait for container to tell us whether it started
961 * successfully.
962 */
963 started = wait_on_daemonized_start(handler, pid);
964
965 free_init_cmd(init_cmd);
966 lxc_free_handler(handler);
967 return started;
968 }
969
970 /* first child */
971
972 /* We don't really care if this doesn't print all the
973 * characters. All that it means is that the proctitle will be
974 * ugly. Similarly, we also don't care if setproctitle() fails.
975 */
976 ret = snprintf(title, sizeof(title), "[lxc monitor] %s %s", c->config_path, c->name);
977 if (ret > 0) {
978 ret = setproctitle(title);
979 if (ret < 0)
980 INFO("Failed to set process title to %s", title);
981 else
982 INFO("Set process title to %s", title);
983 }
984
985 /* We fork() a second time to be reparented to init. Like
986 * POSIX's daemon() function we change to "/" and redirect
987 * std{in,out,err} to /dev/null.
988 */
989 pid = fork();
990 if (pid < 0) {
991 SYSERROR("Failed to fork first child process");
992 _exit(EXIT_FAILURE);
993 }
994
995 /* second parent */
996 if (pid != 0) {
997 free_init_cmd(init_cmd);
998 lxc_free_handler(handler);
999 _exit(EXIT_SUCCESS);
1000 }
1001
1002 /* second child */
1003
1004 /* change to / directory */
1005 ret = chdir("/");
1006 if (ret < 0) {
1007 SYSERROR("Failed to change to \"/\" directory");
1008 _exit(EXIT_FAILURE);
1009 }
1010
1011 keepfds[0] = handler->conf->maincmd_fd;
1012 keepfds[1] = handler->state_socket_pair[0];
1013 keepfds[2] = handler->state_socket_pair[1];
1014 ret = lxc_check_inherited(conf, true, keepfds,
1015 sizeof(keepfds) / sizeof(keepfds[0]));
1016 if (ret < 0)
1017 _exit(EXIT_FAILURE);
1018
1019 /* redirect std{in,out,err} to /dev/null */
1020 ret = null_stdfds();
1021 if (ret < 0) {
1022 ERROR("Failed to redirect std{in,out,err} to /dev/null");
1023 _exit(EXIT_FAILURE);
1024 }
1025
1026 /* become session leader */
1027 ret = setsid();
1028 if (ret < 0)
1029 TRACE("Process %d is already process group leader", lxc_raw_getpid());
1030 } else if (!am_single_threaded()) {
1031 ERROR("Cannot start non-daemonized container when threaded");
1032 free_init_cmd(init_cmd);
1033 lxc_free_handler(handler);
1034 return false;
1035 }
1036
1037 /* We need to write PID file after daemonize, so we always write the
1038 * right PID.
1039 */
1040 if (c->pidfile) {
1041 int w;
1042 char pidstr[INTTYPE_TO_STRLEN(pid_t)];
1043
1044 w = snprintf(pidstr, sizeof(pidstr), "%d", lxc_raw_getpid());
1045 if (w < 0 || (size_t)w >= sizeof(pidstr)) {
1046 free_init_cmd(init_cmd);
1047 lxc_free_handler(handler);
1048
1049 SYSERROR("Failed to write monitor pid to \"%s\"", c->pidfile);
1050
1051 if (c->daemonize)
1052 _exit(EXIT_FAILURE);
1053
1054 return false;
1055 }
1056
1057 ret = lxc_write_to_file(c->pidfile, pidstr, w, false, 0600);
1058 if (ret < 0) {
1059 free_init_cmd(init_cmd);
1060 lxc_free_handler(handler);
1061
1062 SYSERROR("Failed to write monitor pid to \"%s\"", c->pidfile);
1063
1064 if (c->daemonize)
1065 _exit(EXIT_FAILURE);
1066
1067 return false;
1068 }
1069 }
1070
1071 conf->reboot = REBOOT_NONE;
1072
1073 /* Unshare the mount namespace if requested */
1074 if (conf->monitor_unshare) {
1075 ret = unshare(CLONE_NEWNS);
1076 if (ret < 0) {
1077 SYSERROR("Failed to unshare mount namespace");
1078 lxc_free_handler(handler);
1079 ret = 1;
1080 goto on_error;
1081 }
1082
1083 ret = mount(NULL, "/", NULL, MS_SLAVE|MS_REC, NULL);
1084 if (ret < 0) {
1085 SYSERROR("Failed to make / rslave at startup");
1086 lxc_free_handler(handler);
1087 ret = 1;
1088 goto on_error;
1089 }
1090 }
1091
1092 reboot:
1093 if (conf->reboot == REBOOT_INIT) {
1094 /* initialize handler */
1095 handler = lxc_init_handler(c->name, conf, c->config_path, c->daemonize);
1096 if (!handler) {
1097 ret = 1;
1098 goto on_error;
1099 }
1100 }
1101
1102 keepfds[0] = handler->conf->maincmd_fd;
1103 keepfds[1] = handler->state_socket_pair[0];
1104 keepfds[2] = handler->state_socket_pair[1];
1105 ret = lxc_check_inherited(conf, c->daemonize, keepfds,
1106 sizeof(keepfds) / sizeof(keepfds[0]));
1107 if (ret < 0) {
1108 lxc_free_handler(handler);
1109 ret = 1;
1110 goto on_error;
1111 }
1112
1113 if (useinit)
1114 ret = lxc_execute(c->name, argv, 1, handler, c->config_path,
1115 c->daemonize, &c->error_num);
1116 else
1117 ret = lxc_start(c->name, argv, handler, c->config_path,
1118 c->daemonize, &c->error_num);
1119
1120 if (conf->reboot == REBOOT_REQ) {
1121 INFO("Container requested reboot");
1122 conf->reboot = REBOOT_INIT;
1123 goto reboot;
1124 }
1125
1126 on_error:
1127 if (c->pidfile) {
1128 unlink(c->pidfile);
1129 free(c->pidfile);
1130 c->pidfile = NULL;
1131 }
1132 free_init_cmd(init_cmd);
1133
1134 if (c->daemonize && ret != 0)
1135 _exit(EXIT_FAILURE);
1136 else if (c->daemonize)
1137 _exit(EXIT_SUCCESS);
1138
1139 if (ret != 0)
1140 return false;
1141
1142 return true;
1143 }
1144
1145 static bool lxcapi_start(struct lxc_container *c, int useinit,
1146 char *const argv[])
1147 {
1148 bool ret;
1149
1150 current_config = c ? c->lxc_conf : NULL;
1151 ret = do_lxcapi_start(c, useinit, argv);
1152 current_config = NULL;
1153
1154 return ret;
1155 }
1156
1157 /* Note, there MUST be an ending NULL. */
1158 static bool lxcapi_startl(struct lxc_container *c, int useinit, ...)
1159 {
1160 va_list ap;
1161 char **inargs = NULL;
1162 bool bret = false;
1163
1164 /* container exists */
1165 if (!c)
1166 return false;
1167
1168 current_config = c->lxc_conf;
1169
1170 va_start(ap, useinit);
1171 inargs = lxc_va_arg_list_to_argv(ap, 0, 1);
1172 va_end(ap);
1173 if (!inargs)
1174 goto on_error;
1175
1176 /* pass NULL if no arguments were supplied */
1177 bret = do_lxcapi_start(c, useinit, *inargs ? inargs : NULL);
1178
1179 on_error:
1180 if (inargs) {
1181 char **arg;
1182
1183 for (arg = inargs; *arg; arg++)
1184 free(*arg);
1185 free(inargs);
1186 }
1187
1188 current_config = NULL;
1189
1190 return bret;
1191 }
1192
1193 static bool do_lxcapi_stop(struct lxc_container *c)
1194 {
1195 int ret;
1196
1197 if (!c)
1198 return false;
1199
1200 ret = lxc_cmd_stop(c->name, c->config_path);
1201
1202 return ret == 0;
1203 }
1204
1205 WRAP_API(bool, lxcapi_stop)
1206
1207 static int do_create_container_dir(const char *path, struct lxc_conf *conf)
1208 {
1209 __do_free char *p = NULL;
1210 int lasterr;
1211 size_t len;
1212 int ret = -1;
1213
1214 mode_t mask = umask(0002);
1215 ret = mkdir(path, 0770);
1216 lasterr = errno;
1217 umask(mask);
1218 errno = lasterr;
1219 if (ret) {
1220 if (errno != EEXIST)
1221 return -1;
1222
1223 ret = 0;
1224 }
1225
1226 p = must_copy_string(path);
1227
1228 if (!lxc_list_empty(&conf->id_map)) {
1229 ret = chown_mapped_root(p, conf);
1230 if (ret < 0)
1231 ret = -1;
1232 }
1233
1234 return ret;
1235 }
1236
1237 /* Create the standard expected container dir. */
1238 static bool create_container_dir(struct lxc_container *c)
1239 {
1240 int ret;
1241 size_t len;
1242 char *s;
1243
1244 len = strlen(c->config_path) + strlen(c->name) + 2;
1245 s = malloc(len);
1246 if (!s)
1247 return false;
1248
1249 ret = snprintf(s, len, "%s/%s", c->config_path, c->name);
1250 if (ret < 0 || (size_t)ret >= len) {
1251 free(s);
1252 return false;
1253 }
1254
1255 ret = do_create_container_dir(s, c->lxc_conf);
1256 free(s);
1257
1258 return ret == 0;
1259 }
1260
1261 /* do_storage_create: thin wrapper around storage_create(). Like
1262 * storage_create(), it returns a mounted bdev on success, NULL on error.
1263 */
1264 static struct lxc_storage *do_storage_create(struct lxc_container *c,
1265 const char *type,
1266 struct bdev_specs *specs)
1267 {
1268 __do_free char *dest;
1269 int ret;
1270 size_t len;
1271 struct lxc_storage *bdev;
1272
1273 /* rootfs.path or lxcpath/lxcname/rootfs */
1274 if (c->lxc_conf->rootfs.path &&
1275 (access(c->lxc_conf->rootfs.path, F_OK) == 0)) {
1276 const char *rpath = c->lxc_conf->rootfs.path;
1277 len = strlen(rpath) + 1;
1278 dest = must_realloc(NULL, len);
1279 ret = snprintf(dest, len, "%s", rpath);
1280 } else {
1281 const char *lxcpath = do_lxcapi_get_config_path(c);
1282 len = strlen(c->name) + strlen(lxcpath) + 9;
1283 dest = must_realloc(NULL, len);
1284 ret = snprintf(dest, len, "%s/%s/rootfs", lxcpath, c->name);
1285 }
1286 if (ret < 0 || (size_t)ret >= len)
1287 return NULL;
1288
1289 bdev = storage_create(dest, type, c->name, specs);
1290 if (!bdev) {
1291 ERROR("Failed to create \"%s\" storage", type);
1292 return NULL;
1293 }
1294
1295 if (!c->set_config_item(c, "lxc.rootfs.path", bdev->src)) {
1296 ERROR("Failed to set \"lxc.rootfs.path = %s\"", bdev->src);
1297 return NULL;
1298 }
1299
1300 /* If we are not root, chown the rootfs dir to root in the target user
1301 * namespace.
1302 */
1303 ret = geteuid();
1304 if (ret != 0 || (c->lxc_conf && !lxc_list_empty(&c->lxc_conf->id_map))) {
1305 ret = chown_mapped_root(bdev->dest, c->lxc_conf);
1306 if (ret < 0) {
1307 ERROR("Error chowning \"%s\" to container root", bdev->dest);
1308 suggest_default_idmap();
1309 storage_put(bdev);
1310 return NULL;
1311 }
1312 }
1313
1314 return bdev;
1315 }
1316
1317 static char *lxcbasename(char *path)
1318 {
1319 char *p;
1320
1321 p = path + strlen(path) - 1;
1322 while (*p != '/' && p > path)
1323 p--;
1324
1325 return p;
1326 }
1327
1328 static bool create_run_template(struct lxc_container *c, char *tpath,
1329 bool need_null_stdfds, char *const argv[])
1330 {
1331 int ret;
1332 pid_t pid;
1333
1334 if (!tpath)
1335 return true;
1336
1337 pid = fork();
1338 if (pid < 0) {
1339 SYSERROR("Failed to fork task for container creation template");
1340 return false;
1341 }
1342
1343 if (pid == 0) { /* child */
1344 int i, len;
1345 char *namearg, *patharg, *rootfsarg;
1346 char **newargv;
1347 int nargs = 0;
1348 struct lxc_storage *bdev = NULL;
1349 struct lxc_conf *conf = c->lxc_conf;
1350 uid_t euid;
1351
1352 if (need_null_stdfds) {
1353 ret = null_stdfds();
1354 if (ret < 0)
1355 _exit(EXIT_FAILURE);
1356 }
1357
1358 bdev = storage_init(c->lxc_conf);
1359 if (!bdev) {
1360 ERROR("Failed to initialize storage");
1361 _exit(EXIT_FAILURE);
1362 }
1363
1364 euid = geteuid();
1365 if (euid == 0) {
1366 ret = unshare(CLONE_NEWNS);
1367 if (ret < 0) {
1368 ERROR("Failed to unshare CLONE_NEWNS");
1369 _exit(EXIT_FAILURE);
1370 }
1371
1372 ret = detect_shared_rootfs();
1373 if (ret == 1) {
1374 ret = mount(NULL, "/", NULL, MS_SLAVE | MS_REC, NULL);
1375 if (ret < 0) {
1376 SYSERROR("Failed to make \"/\" rslave");
1377 ERROR("Continuing...");
1378 }
1379 }
1380 }
1381
1382 if (strcmp(bdev->type, "dir") != 0 && strcmp(bdev->type, "btrfs") != 0) {
1383 if (euid != 0) {
1384 ERROR("Unprivileged users can only create "
1385 "btrfs and directory-backed containers");
1386 _exit(EXIT_FAILURE);
1387 }
1388
1389 if (strcmp(bdev->type, "overlay") == 0 ||
1390 strcmp(bdev->type, "overlayfs") == 0) {
1391 /* If we create an overlay container we need to
1392 * rsync the contents into
1393 * <container-path>/<container-name>/rootfs.
1394 * However, the overlay mount function will
1395 * mount will mount
1396 * <container-path>/<container-name>/delta0
1397 * over
1398 * <container-path>/<container-name>/rootfs
1399 * which means we would rsync the rootfs into
1400 * the delta directory. That doesn't make sense
1401 * since the delta directory only exists to
1402 * record the differences to
1403 * <container-path>/<container-name>/rootfs. So
1404 * let's simply bind-mount here and then rsync
1405 * directly into
1406 * <container-path>/<container-name>/rootfs.
1407 */
1408 char *src;
1409
1410 src = ovl_get_rootfs(bdev->src, &(size_t){0});
1411 if (!src) {
1412 ERROR("Failed to get rootfs");
1413 _exit(EXIT_FAILURE);
1414 }
1415
1416 ret = mount(src, bdev->dest, "bind", MS_BIND | MS_REC, NULL);
1417 if (ret < 0) {
1418 ERROR("Failed to mount rootfs");
1419 _exit(EXIT_FAILURE);
1420 }
1421 } else {
1422 ret = bdev->ops->mount(bdev);
1423 if (ret < 0) {
1424 ERROR("Failed to mount rootfs");
1425 _exit(EXIT_FAILURE);
1426 }
1427 }
1428 } else { /* TODO come up with a better way here! */
1429 const char *src;
1430 free(bdev->dest);
1431 src = lxc_storage_get_path(bdev->src, bdev->type);
1432 bdev->dest = strdup(src);
1433 }
1434
1435 /* Create our new array, pre-pend the template name and base
1436 * args.
1437 */
1438 if (argv)
1439 for (nargs = 0; argv[nargs]; nargs++)
1440 ;
1441
1442 /* template, path, rootfs and name args */
1443 nargs += 4;
1444
1445 newargv = malloc(nargs * sizeof(*newargv));
1446 if (!newargv)
1447 _exit(EXIT_FAILURE);
1448 newargv[0] = lxcbasename(tpath);
1449
1450 /* --path */
1451 len = strlen(c->config_path) + strlen(c->name) + strlen("--path=") + 2;
1452 patharg = malloc(len);
1453 if (!patharg)
1454 _exit(EXIT_FAILURE);
1455
1456 ret = snprintf(patharg, len, "--path=%s/%s", c->config_path, c->name);
1457 if (ret < 0 || ret >= len)
1458 _exit(EXIT_FAILURE);
1459 newargv[1] = patharg;
1460
1461 /* --name */
1462 len = strlen("--name=") + strlen(c->name) + 1;
1463 namearg = malloc(len);
1464 if (!namearg)
1465 _exit(EXIT_FAILURE);
1466
1467 ret = snprintf(namearg, len, "--name=%s", c->name);
1468 if (ret < 0 || ret >= len)
1469 _exit(EXIT_FAILURE);
1470 newargv[2] = namearg;
1471
1472 /* --rootfs */
1473 len = strlen("--rootfs=") + 1 + strlen(bdev->dest);
1474 rootfsarg = malloc(len);
1475 if (!rootfsarg)
1476 _exit(EXIT_FAILURE);
1477
1478 ret = snprintf(rootfsarg, len, "--rootfs=%s", bdev->dest);
1479 if (ret < 0 || ret >= len)
1480 _exit(EXIT_FAILURE);
1481 newargv[3] = rootfsarg;
1482
1483 /* add passed-in args */
1484 if (argv)
1485 for (i = 4; i < nargs; i++)
1486 newargv[i] = argv[i - 4];
1487
1488 /* add trailing NULL */
1489 nargs++;
1490 newargv = realloc(newargv, nargs * sizeof(*newargv));
1491 if (!newargv)
1492 _exit(EXIT_FAILURE);
1493 newargv[nargs - 1] = NULL;
1494
1495 /* If we're running the template in a mapped userns, then we
1496 * prepend the template command with: lxc-usernsexec <-m map1>
1497 * ... <-m mapn> -- and we append "--mapped-uid x", where x is
1498 * the mapped uid for our geteuid()
1499 */
1500 if (!lxc_list_empty(&conf->id_map)) {
1501 int extraargs, hostuid_mapped, hostgid_mapped;
1502 char **n2;
1503 char txtuid[20], txtgid[20];
1504 struct lxc_list *it;
1505 struct id_map *map;
1506 int n2args = 1;
1507
1508 n2 = malloc(n2args * sizeof(*n2));
1509 if (!n2)
1510 _exit(EXIT_FAILURE);
1511
1512 newargv[0] = tpath;
1513 tpath = "lxc-usernsexec";
1514 n2[0] = "lxc-usernsexec";
1515
1516 lxc_list_for_each(it, &conf->id_map) {
1517 map = it->elem;
1518 n2args += 2;
1519 n2 = realloc(n2, n2args * sizeof(char *));
1520 if (!n2)
1521 _exit(EXIT_FAILURE);
1522
1523 n2[n2args - 2] = "-m";
1524 n2[n2args - 1] = malloc(200);
1525 if (!n2[n2args - 1])
1526 _exit(EXIT_FAILURE);
1527
1528 ret = snprintf(n2[n2args - 1], 200, "%c:%lu:%lu:%lu",
1529 map->idtype == ID_TYPE_UID ? 'u' : 'g',
1530 map->nsid, map->hostid, map->range);
1531 if (ret < 0 || ret >= 200)
1532 _exit(EXIT_FAILURE);
1533 }
1534
1535 hostuid_mapped = mapped_hostid(geteuid(), conf, ID_TYPE_UID);
1536 extraargs = hostuid_mapped >= 0 ? 1 : 3;
1537
1538 n2 = realloc(n2, (nargs + n2args + extraargs) * sizeof(char *));
1539 if (!n2)
1540 _exit(EXIT_FAILURE);
1541
1542 if (hostuid_mapped < 0) {
1543 hostuid_mapped = find_unmapped_nsid(conf, ID_TYPE_UID);
1544 n2[n2args++] = "-m";
1545 if (hostuid_mapped < 0) {
1546 ERROR("Failed to find free uid to map");
1547 _exit(EXIT_FAILURE);
1548 }
1549
1550 n2[n2args++] = malloc(200);
1551 if (!n2[n2args - 1]) {
1552 SYSERROR("out of memory");
1553 _exit(EXIT_FAILURE);
1554 }
1555
1556 ret = snprintf(n2[n2args - 1], 200, "u:%d:%d:1",
1557 hostuid_mapped, geteuid());
1558 if (ret < 0 || ret >= 200)
1559 _exit(EXIT_FAILURE);
1560 }
1561
1562 hostgid_mapped = mapped_hostid(getegid(), conf, ID_TYPE_GID);
1563 extraargs = hostgid_mapped >= 0 ? 1 : 3;
1564
1565 n2 = realloc(n2, (nargs + n2args + extraargs) * sizeof(char *));
1566 if (!n2)
1567 _exit(EXIT_FAILURE);
1568
1569 if (hostgid_mapped < 0) {
1570 hostgid_mapped = find_unmapped_nsid(conf, ID_TYPE_GID);
1571 n2[n2args++] = "-m";
1572 if (hostgid_mapped < 0) {
1573 ERROR("Failed to find free gid to map");
1574 _exit(EXIT_FAILURE);
1575 }
1576
1577 n2[n2args++] = malloc(200);
1578 if (!n2[n2args - 1]) {
1579 SYSERROR("out of memory");
1580 _exit(EXIT_FAILURE);
1581 }
1582
1583 ret = snprintf(n2[n2args - 1], 200, "g:%d:%d:1",
1584 hostgid_mapped, getegid());
1585 if (ret < 0 || ret >= 200)
1586 _exit(EXIT_FAILURE);
1587 }
1588
1589 n2[n2args++] = "--";
1590
1591 for (i = 0; i < nargs; i++)
1592 n2[i + n2args] = newargv[i];
1593 n2args += nargs;
1594
1595 /* Finally add "--mapped-uid $uid" to tell template what
1596 * to chown cached images to.
1597 */
1598 n2args += 4;
1599 n2 = realloc(n2, n2args * sizeof(char *));
1600 if (!n2)
1601 _exit(EXIT_FAILURE);
1602
1603 /* note n2[n2args-1] is NULL */
1604 n2[n2args - 5] = "--mapped-uid";
1605
1606 ret = snprintf(txtuid, 20, "%d", hostuid_mapped);
1607 if (ret < 0 || ret >= 20) {
1608 free(newargv);
1609 free(n2);
1610 _exit(EXIT_FAILURE);
1611 }
1612
1613 n2[n2args - 4] = txtuid;
1614 n2[n2args - 3] = "--mapped-gid";
1615
1616 ret = snprintf(txtgid, 20, "%d", hostgid_mapped);
1617 if (ret < 0 || ret >= 20) {
1618 free(newargv);
1619 free(n2);
1620 _exit(EXIT_FAILURE);
1621 }
1622
1623 n2[n2args - 2] = txtgid;
1624 n2[n2args - 1] = NULL;
1625 free(newargv);
1626 newargv = n2;
1627 }
1628
1629 execvp(tpath, newargv);
1630 SYSERROR("Failed to execute template %s", tpath);
1631 _exit(EXIT_FAILURE);
1632 }
1633
1634 ret = wait_for_pid(pid);
1635 if (ret != 0) {
1636 ERROR("Failed to create container from template");
1637 return false;
1638 }
1639
1640 return true;
1641 }
1642
1643 static bool prepend_lxc_header(char *path, const char *t, char *const argv[])
1644 {
1645 long flen;
1646 size_t len;
1647 char *contents;
1648 FILE *f;
1649 int ret = -1;
1650 #if HAVE_LIBGNUTLS
1651 int i;
1652 unsigned char md_value[SHA_DIGEST_LENGTH];
1653 char *tpath;
1654 #endif
1655
1656 f = fopen(path, "r");
1657 if (f == NULL)
1658 return false;
1659
1660 ret = fseek(f, 0, SEEK_END);
1661 if (ret < 0)
1662 goto out_error;
1663
1664 ret = -1;
1665 flen = ftell(f);
1666 if (flen < 0)
1667 goto out_error;
1668
1669 ret = fseek(f, 0, SEEK_SET);
1670 if (ret < 0)
1671 goto out_error;
1672
1673 ret = fseek(f, 0, SEEK_SET);
1674 if (ret < 0)
1675 goto out_error;
1676
1677 ret = -1;
1678 contents = malloc(flen + 1);
1679 if (!contents)
1680 goto out_error;
1681
1682 len = fread(contents, 1, flen, f);
1683 if (len != flen)
1684 goto out_free_contents;
1685
1686 contents[flen] = '\0';
1687
1688 ret = fclose(f);
1689 f = NULL;
1690 if (ret < 0)
1691 goto out_free_contents;
1692
1693 #if HAVE_LIBGNUTLS
1694 tpath = get_template_path(t);
1695 if (!tpath) {
1696 ERROR("Invalid template \"%s\" specified", t);
1697 goto out_free_contents;
1698 }
1699
1700 ret = sha1sum_file(tpath, md_value);
1701 if (ret < 0) {
1702 ERROR("Failed to get sha1sum of %s", tpath);
1703 free(tpath);
1704 goto out_free_contents;
1705 }
1706 free(tpath);
1707 #endif
1708
1709 f = fopen(path, "w");
1710 if (f == NULL) {
1711 SYSERROR("Reopening config for writing");
1712 free(contents);
1713 return false;
1714 }
1715
1716 fprintf(f, "# Template used to create this container: %s\n", t);
1717 if (argv) {
1718 fprintf(f, "# Parameters passed to the template:");
1719 while (*argv) {
1720 fprintf(f, " %s", *argv);
1721 argv++;
1722 }
1723 fprintf(f, "\n");
1724 }
1725
1726 #if HAVE_LIBGNUTLS
1727 fprintf(f, "# Template script checksum (SHA-1): ");
1728 for (i=0; i<SHA_DIGEST_LENGTH; i++)
1729 fprintf(f, "%02x", md_value[i]);
1730 fprintf(f, "\n");
1731 #endif
1732 fprintf(f, "# For additional config options, please look at lxc.container.conf(5)\n");
1733 fprintf(f, "\n# Uncomment the following line to support nesting containers:\n");
1734 fprintf(f, "#lxc.include = " LXCTEMPLATECONFIG "/nesting.conf\n");
1735 fprintf(f, "# (Be aware this has security implications)\n\n");
1736 if (fwrite(contents, 1, flen, f) != flen) {
1737 SYSERROR("Writing original contents");
1738 free(contents);
1739 fclose(f);
1740 return false;
1741 }
1742
1743 ret = 0;
1744
1745 out_free_contents:
1746 free(contents);
1747
1748 out_error:
1749 if (f) {
1750 int newret;
1751 newret = fclose(f);
1752 if (ret == 0)
1753 ret = newret;
1754 }
1755
1756 if (ret < 0) {
1757 SYSERROR("Error prepending header");
1758 return false;
1759 }
1760
1761 return true;
1762 }
1763
1764 static void lxcapi_clear_config(struct lxc_container *c)
1765 {
1766 if (!c || !c->lxc_conf)
1767 return;
1768
1769 lxc_conf_free(c->lxc_conf);
1770 c->lxc_conf = NULL;
1771 }
1772
1773 #define do_lxcapi_clear_config(c) lxcapi_clear_config(c)
1774
1775 /*
1776 * lxcapi_create:
1777 * create a container with the given parameters.
1778 * @c: container to be created. It has the lxcpath, name, and a starting
1779 * configuration already set
1780 * @t: the template to execute to instantiate the root filesystem and
1781 * adjust the configuration.
1782 * @bdevtype: backing store type to use. If NULL, dir will be used.
1783 * @specs: additional parameters for the backing store, i.e. LVM vg to
1784 * use.
1785 *
1786 * @argv: the arguments to pass to the template, terminated by NULL. If no
1787 * arguments, you can just pass NULL.
1788 */
1789 static bool do_lxcapi_create(struct lxc_container *c, const char *t,
1790 const char *bdevtype, struct bdev_specs *specs,
1791 int flags, char *const argv[])
1792 {
1793 int partial_fd;
1794 mode_t mask;
1795 pid_t pid;
1796 bool ret = false, rootfs_managed = true;
1797 char *tpath = NULL;
1798
1799 if (!c)
1800 return false;
1801
1802 if (t) {
1803 tpath = get_template_path(t);
1804 if (!tpath) {
1805 ERROR("Unknown template \"%s\"", t);
1806 goto out;
1807 }
1808 }
1809
1810 /* If a template is passed in, and the rootfs already is defined in the
1811 * container config and exists, then the caller is trying to create an
1812 * existing container. Return an error, but do NOT delete the container.
1813 */
1814 if (do_lxcapi_is_defined(c) && c->lxc_conf && c->lxc_conf->rootfs.path &&
1815 access(c->lxc_conf->rootfs.path, F_OK) == 0 && tpath) {
1816 ERROR("Container \"%s\" already exists in \"%s\"", c->name,
1817 c->config_path);
1818 goto free_tpath;
1819 }
1820
1821 if (!c->lxc_conf) {
1822 if (!do_lxcapi_load_config(c, lxc_global_config_value("lxc.default_config"))) {
1823 ERROR("Error loading default configuration file %s",
1824 lxc_global_config_value("lxc.default_config"));
1825 goto free_tpath;
1826 }
1827 }
1828
1829 if (!create_container_dir(c))
1830 goto free_tpath;
1831
1832 if (c->lxc_conf->rootfs.path)
1833 rootfs_managed = false;
1834
1835 /* If both template and rootfs.path are set, template is setup as
1836 * rootfs.path. The container is already created if we have a config and
1837 * rootfs.path is accessible
1838 */
1839 if (!c->lxc_conf->rootfs.path && !tpath) {
1840 /* No template passed in and rootfs does not exist. */
1841 if (!c->save_config(c, NULL)) {
1842 ERROR("Failed to save initial config for \"%s\"", c->name);
1843 goto out;
1844 }
1845 ret = true;
1846 goto out;
1847 }
1848
1849 /* Rootfs passed into configuration, but does not exist. */
1850 if (c->lxc_conf->rootfs.path && access(c->lxc_conf->rootfs.path, F_OK) != 0)
1851 goto out;
1852
1853 if (do_lxcapi_is_defined(c) && c->lxc_conf->rootfs.path && !tpath) {
1854 /* Rootfs already existed, user just wanted to save the loaded
1855 * configuration.
1856 */
1857 if (!c->save_config(c, NULL))
1858 ERROR("Failed to save initial config for \"%s\"", c->name);
1859
1860 ret = true;
1861 goto out;
1862 }
1863
1864 /* Mark that this container is being created */
1865 partial_fd = create_partial(c);
1866 if (partial_fd < 0)
1867 goto out;
1868
1869 /* No need to get disk lock bc we have the partial lock. */
1870
1871 mask = umask(0022);
1872
1873 /* Create the storage.
1874 * Note we can't do this in the same task as we use to execute the
1875 * template because of the way zfs works.
1876 * After you 'zfs create', zfs mounts the fs only in the initial
1877 * namespace.
1878 */
1879 pid = fork();
1880 if (pid < 0) {
1881 SYSERROR("Failed to fork task for container creation template");
1882 goto out_unlock;
1883 }
1884
1885 if (pid == 0) { /* child */
1886 struct lxc_storage *bdev = NULL;
1887
1888 bdev = do_storage_create(c, bdevtype, specs);
1889 if (!bdev) {
1890 ERROR("Failed to create %s storage for %s",
1891 bdevtype ? bdevtype : "(none)", c->name);
1892 _exit(EXIT_FAILURE);
1893 }
1894
1895 /* Save config file again to store the new rootfs location. */
1896 if (!do_lxcapi_save_config(c, NULL)) {
1897 ERROR("Failed to save initial config for %s", c->name);
1898 /* Parent task won't see the storage driver in the
1899 * config so we delete it.
1900 */
1901 bdev->ops->umount(bdev);
1902 bdev->ops->destroy(bdev);
1903 _exit(EXIT_FAILURE);
1904 }
1905
1906 _exit(EXIT_SUCCESS);
1907 }
1908
1909 if (wait_for_pid(pid) != 0)
1910 goto out_unlock;
1911
1912 /* Reload config to get the rootfs. */
1913 lxc_conf_free(c->lxc_conf);
1914 c->lxc_conf = NULL;
1915
1916 if (!load_config_locked(c, c->configfile))
1917 goto out_unlock;
1918
1919 if (!create_run_template(c, tpath, !!(flags & LXC_CREATE_QUIET), argv))
1920 goto out_unlock;
1921
1922 /* Now clear out the lxc_conf we have, reload from the created
1923 * container.
1924 */
1925 do_lxcapi_clear_config(c);
1926
1927 if (t) {
1928 if (!prepend_lxc_header(c->configfile, tpath, argv)) {
1929 ERROR("Failed to prepend header to config file");
1930 goto out_unlock;
1931 }
1932 }
1933
1934 ret = load_config_locked(c, c->configfile);
1935
1936 out_unlock:
1937 umask(mask);
1938 remove_partial(c, partial_fd);
1939
1940 out:
1941 if (!ret) {
1942 bool reset_managed = c->lxc_conf->rootfs.managed;
1943
1944 /*
1945 * Ensure that we don't destroy storage we didn't create
1946 * ourselves.
1947 */
1948 if (!rootfs_managed)
1949 c->lxc_conf->rootfs.managed = false;
1950 container_destroy(c, NULL);
1951 c->lxc_conf->rootfs.managed = reset_managed;
1952 }
1953
1954 free_tpath:
1955 free(tpath);
1956 return ret;
1957 }
1958
1959 static bool lxcapi_create(struct lxc_container *c, const char *t,
1960 const char *bdevtype, struct bdev_specs *specs,
1961 int flags, char *const argv[])
1962 {
1963 bool ret;
1964
1965 current_config = c ? c->lxc_conf : NULL;
1966
1967 ret = do_lxcapi_create(c, t, bdevtype, specs, flags, argv);
1968 current_config = NULL;
1969 return ret;
1970 }
1971
1972 static bool do_lxcapi_reboot(struct lxc_container *c)
1973 {
1974 int ret;
1975 pid_t pid;
1976 int rebootsignal = SIGINT;
1977
1978 if (!c)
1979 return false;
1980
1981 if (!do_lxcapi_is_running(c))
1982 return false;
1983
1984 pid = do_lxcapi_init_pid(c);
1985 if (pid <= 0)
1986 return false;
1987
1988 if (c->lxc_conf && c->lxc_conf->rebootsignal)
1989 rebootsignal = c->lxc_conf->rebootsignal;
1990
1991 ret = kill(pid, rebootsignal);
1992 if (ret < 0) {
1993 WARN("Failed to send signal %d to pid %d", rebootsignal, pid);
1994 return false;
1995 }
1996
1997 return true;
1998 }
1999
2000 WRAP_API(bool, lxcapi_reboot)
2001
2002 static bool do_lxcapi_reboot2(struct lxc_container *c, int timeout)
2003 {
2004 int killret, ret;
2005 pid_t pid;
2006 int rebootsignal = SIGINT, state_client_fd = -1;
2007 lxc_state_t states[MAX_STATE] = {0};
2008
2009 if (!c)
2010 return false;
2011
2012 if (!do_lxcapi_is_running(c))
2013 return true;
2014
2015 pid = do_lxcapi_init_pid(c);
2016 if (pid <= 0)
2017 return true;
2018
2019 if (c->lxc_conf && c->lxc_conf->rebootsignal)
2020 rebootsignal = c->lxc_conf->rebootsignal;
2021
2022 /* Add a new state client before sending the shutdown signal so that we
2023 * don't miss a state.
2024 */
2025 if (timeout != 0) {
2026 states[RUNNING] = 2;
2027 ret = lxc_cmd_add_state_client(c->name, c->config_path, states,
2028 &state_client_fd);
2029 if (ret < 0)
2030 return false;
2031
2032 if (state_client_fd < 0)
2033 return false;
2034
2035 if (ret == RUNNING)
2036 return true;
2037
2038 if (ret < MAX_STATE)
2039 return false;
2040 }
2041
2042 /* Send reboot signal to container. */
2043 killret = kill(pid, rebootsignal);
2044 if (killret < 0) {
2045 if (state_client_fd >= 0)
2046 close(state_client_fd);
2047
2048 WARN("Failed to send signal %d to pid %d", rebootsignal, pid);
2049 return false;
2050 }
2051 TRACE("Sent signal %d to pid %d", rebootsignal, pid);
2052
2053 if (timeout == 0)
2054 return true;
2055
2056 ret = lxc_cmd_sock_rcv_state(state_client_fd, timeout);
2057 close(state_client_fd);
2058 if (ret < 0)
2059 return false;
2060
2061 TRACE("Received state \"%s\"", lxc_state2str(ret));
2062 if (ret != RUNNING)
2063 return false;
2064
2065 return true;
2066 }
2067
2068 WRAP_API_1(bool, lxcapi_reboot2, int)
2069
2070 static bool do_lxcapi_shutdown(struct lxc_container *c, int timeout)
2071 {
2072 int killret, ret;
2073 pid_t pid;
2074 int haltsignal = SIGPWR, state_client_fd = -EBADF;
2075 lxc_state_t states[MAX_STATE] = {0};
2076
2077 if (!c)
2078 return false;
2079
2080 if (!do_lxcapi_is_running(c))
2081 return true;
2082
2083 pid = do_lxcapi_init_pid(c);
2084 if (pid <= 0)
2085 return true;
2086
2087 /* Detect whether we should send SIGRTMIN + 3 (e.g. systemd). */
2088 if (c->lxc_conf && c->lxc_conf->haltsignal)
2089 haltsignal = c->lxc_conf->haltsignal;
2090 else if (task_blocks_signal(pid, (SIGRTMIN + 3)))
2091 haltsignal = (SIGRTMIN + 3);
2092
2093 /* Add a new state client before sending the shutdown signal so that we
2094 * don't miss a state.
2095 */
2096 if (timeout != 0) {
2097 states[STOPPED] = 1;
2098 ret = lxc_cmd_add_state_client(c->name, c->config_path, states,
2099 &state_client_fd);
2100 if (ret < 0)
2101 return false;
2102
2103 if (state_client_fd < 0)
2104 return false;
2105
2106 if (ret == STOPPED)
2107 return true;
2108
2109 if (ret < MAX_STATE)
2110 return false;
2111 }
2112
2113 /* Send shutdown signal to container. */
2114 killret = kill(pid, haltsignal);
2115 if (killret < 0) {
2116 if (state_client_fd >= 0)
2117 close(state_client_fd);
2118
2119 WARN("Failed to send signal %d to pid %d", haltsignal, pid);
2120 return false;
2121 }
2122 TRACE("Sent signal %d to pid %d", haltsignal, pid);
2123
2124 if (timeout == 0)
2125 return true;
2126
2127 ret = lxc_cmd_sock_rcv_state(state_client_fd, timeout);
2128 close(state_client_fd);
2129 if (ret < 0)
2130 return false;
2131
2132 TRACE("Received state \"%s\"", lxc_state2str(ret));
2133 if (ret != STOPPED)
2134 return false;
2135
2136 return true;
2137 }
2138
2139 WRAP_API_1(bool, lxcapi_shutdown, int)
2140
2141 static bool lxcapi_createl(struct lxc_container *c, const char *t,
2142 const char *bdevtype, struct bdev_specs *specs, int flags, ...)
2143 {
2144 bool bret = false;
2145 char **args = NULL;
2146 va_list ap;
2147
2148 if (!c)
2149 return false;
2150
2151 current_config = c->lxc_conf;
2152
2153 /*
2154 * since we're going to wait for create to finish, I don't think we
2155 * need to get a copy of the arguments.
2156 */
2157 va_start(ap, flags);
2158 args = lxc_va_arg_list_to_argv(ap, 0, 0);
2159 va_end(ap);
2160 if (!args) {
2161 ERROR("Failed to allocate memory");
2162 goto out;
2163 }
2164
2165 bret = do_lxcapi_create(c, t, bdevtype, specs, flags, args);
2166
2167 out:
2168 free(args);
2169 current_config = NULL;
2170 return bret;
2171 }
2172
2173 static void do_clear_unexp_config_line(struct lxc_conf *conf, const char *key)
2174 {
2175 if (!strcmp(key, "lxc.cgroup"))
2176 return clear_unexp_config_line(conf, key, true);
2177
2178 if (!strcmp(key, "lxc.network"))
2179 return clear_unexp_config_line(conf, key, true);
2180
2181 if (!strcmp(key, "lxc.net"))
2182 return clear_unexp_config_line(conf, key, true);
2183
2184 /* Clear a network with a specific index. */
2185 if (!strncmp(key, "lxc.net.", 8)) {
2186 int ret;
2187 const char *idx;
2188
2189 idx = key + 8;
2190 ret = lxc_safe_uint(idx, &(unsigned int){0});
2191 if (!ret)
2192 return clear_unexp_config_line(conf, key, true);
2193 }
2194
2195 if (!strcmp(key, "lxc.hook"))
2196 return clear_unexp_config_line(conf, key, true);
2197
2198 return clear_unexp_config_line(conf, key, false);
2199 }
2200
2201 static bool do_lxcapi_clear_config_item(struct lxc_container *c,
2202 const char *key)
2203 {
2204 int ret = 1;
2205 struct lxc_config_t *config;
2206
2207 if (!c || !c->lxc_conf)
2208 return false;
2209
2210 if (container_mem_lock(c))
2211 return false;
2212
2213 config = lxc_get_config(key);
2214 /* Verify that the config key exists and that it has a callback
2215 * implemented.
2216 */
2217 if (config && config->clr)
2218 ret = config->clr(key, c->lxc_conf, NULL);
2219
2220 if (!ret)
2221 do_clear_unexp_config_line(c->lxc_conf, key);
2222
2223 container_mem_unlock(c);
2224 return ret == 0;
2225 }
2226
2227 WRAP_API_1(bool, lxcapi_clear_config_item, const char *)
2228
2229 static inline bool enter_net_ns(struct lxc_container *c)
2230 {
2231 pid_t pid = do_lxcapi_init_pid(c);
2232
2233 if ((geteuid() != 0 || (c->lxc_conf && !lxc_list_empty(&c->lxc_conf->id_map))) &&
2234 (access("/proc/self/ns/user", F_OK) == 0))
2235 if (!switch_to_ns(pid, "user"))
2236 return false;
2237
2238 return switch_to_ns(pid, "net");
2239 }
2240
2241 /* Used by qsort and bsearch functions for comparing names. */
2242 static inline int string_cmp(char **first, char **second)
2243 {
2244 return strcmp(*first, *second);
2245 }
2246
2247 /* Used by qsort and bsearch functions for comparing container names. */
2248 static inline int container_cmp(struct lxc_container **first,
2249 struct lxc_container **second)
2250 {
2251 return strcmp((*first)->name, (*second)->name);
2252 }
2253
2254 static bool add_to_array(char ***names, char *cname, int pos)
2255 {
2256 char **newnames = realloc(*names, (pos+1) * sizeof(char *));
2257 if (!newnames) {
2258 ERROR("Out of memory");
2259 return false;
2260 }
2261
2262 *names = newnames;
2263 newnames[pos] = strdup(cname);
2264 if (!newnames[pos])
2265 return false;
2266
2267 /* Sort the array as we will use binary search on it. */
2268 qsort(newnames, pos + 1, sizeof(char *),
2269 (int (*)(const void *, const void *))string_cmp);
2270
2271 return true;
2272 }
2273
2274 static bool add_to_clist(struct lxc_container ***list, struct lxc_container *c,
2275 int pos, bool sort)
2276 {
2277 struct lxc_container **newlist = realloc(*list, (pos + 1) * sizeof(struct lxc_container *));
2278 if (!newlist) {
2279 ERROR("Out of memory");
2280 return false;
2281 }
2282
2283 *list = newlist;
2284 newlist[pos] = c;
2285
2286 /* Sort the array as we will use binary search on it. */
2287 if (sort)
2288 qsort(newlist, pos + 1, sizeof(struct lxc_container *),
2289 (int (*)(const void *, const void *))container_cmp);
2290
2291 return true;
2292 }
2293
2294 static char** get_from_array(char ***names, char *cname, int size)
2295 {
2296 return (char **)bsearch(&cname, *names, size, sizeof(char *), (int (*)(const void *, const void *))string_cmp);
2297 }
2298
2299 static bool array_contains(char ***names, char *cname, int size)
2300 {
2301 if(get_from_array(names, cname, size) != NULL)
2302 return true;
2303
2304 return false;
2305 }
2306
2307 static bool remove_from_array(char ***names, char *cname, int size)
2308 {
2309 char **result = get_from_array(names, cname, size);
2310 if (result != NULL) {
2311 free(result);
2312 return true;
2313 }
2314
2315 return false;
2316 }
2317
2318 static char **do_lxcapi_get_interfaces(struct lxc_container *c)
2319 {
2320 pid_t pid;
2321 int i, count = 0, pipefd[2];
2322 char **interfaces = NULL;
2323 char interface[IFNAMSIZ];
2324
2325 if (pipe2(pipefd, O_CLOEXEC) < 0)
2326 return NULL;
2327
2328 pid = fork();
2329 if (pid < 0) {
2330 SYSERROR("Failed to fork task to get interfaces information");
2331 close(pipefd[0]);
2332 close(pipefd[1]);
2333 return NULL;
2334 }
2335
2336 if (pid == 0) { /* child */
2337 int ret = 1, nbytes;
2338 struct netns_ifaddrs *interfaceArray = NULL, *tempIfAddr = NULL;
2339
2340 /* close the read-end of the pipe */
2341 close(pipefd[0]);
2342
2343 if (!enter_net_ns(c)) {
2344 SYSERROR("Failed to enter network namespace");
2345 goto out;
2346 }
2347
2348 /* Grab the list of interfaces */
2349 if (netns_getifaddrs(&interfaceArray, -1, &(bool){false})) {
2350 SYSERROR("Failed to get interfaces list");
2351 goto out;
2352 }
2353
2354 /* Iterate through the interfaces */
2355 for (tempIfAddr = interfaceArray; tempIfAddr != NULL;
2356 tempIfAddr = tempIfAddr->ifa_next) {
2357 nbytes = lxc_write_nointr(pipefd[1], tempIfAddr->ifa_name, IFNAMSIZ);
2358 if (nbytes < 0)
2359 goto out;
2360
2361 count++;
2362 }
2363
2364 ret = 0;
2365
2366 out:
2367 if (interfaceArray)
2368 netns_freeifaddrs(interfaceArray);
2369
2370 /* close the write-end of the pipe, thus sending EOF to the reader */
2371 close(pipefd[1]);
2372 _exit(ret);
2373 }
2374
2375 /* close the write-end of the pipe */
2376 close(pipefd[1]);
2377
2378 while (lxc_read_nointr(pipefd[0], &interface, IFNAMSIZ) == IFNAMSIZ) {
2379 interface[IFNAMSIZ - 1] = '\0';
2380
2381 if (array_contains(&interfaces, interface, count))
2382 continue;
2383
2384 if (!add_to_array(&interfaces, interface, count))
2385 ERROR("Failed to add \"%s\" to array", interface);
2386
2387 count++;
2388 }
2389
2390 if (wait_for_pid(pid) != 0) {
2391 for (i = 0; i < count; i++)
2392 free(interfaces[i]);
2393
2394 free(interfaces);
2395 interfaces = NULL;
2396 }
2397
2398 /* close the read-end of the pipe */
2399 close(pipefd[0]);
2400
2401 /* Append NULL to the array */
2402 if (interfaces)
2403 interfaces = (char **)lxc_append_null_to_array((void **)interfaces, count);
2404
2405 return interfaces;
2406 }
2407
2408 WRAP_API(char **, lxcapi_get_interfaces)
2409
2410 static char **do_lxcapi_get_ips(struct lxc_container *c, const char *interface,
2411 const char *family, int scope)
2412 {
2413 int i, ret;
2414 pid_t pid;
2415 int pipefd[2];
2416 char address[INET6_ADDRSTRLEN];
2417 int count = 0;
2418 char **addresses = NULL;
2419
2420 ret = pipe2(pipefd, O_CLOEXEC);
2421 if (ret < 0) {
2422 SYSERROR("Failed to create pipe");
2423 return NULL;
2424 }
2425
2426 pid = fork();
2427 if (pid < 0) {
2428 SYSERROR("Failed to create new process");
2429 close(pipefd[0]);
2430 close(pipefd[1]);
2431 return NULL;
2432 }
2433
2434 if (pid == 0) {
2435 ssize_t nbytes;
2436 char addressOutputBuffer[INET6_ADDRSTRLEN];
2437 char *address_ptr = NULL;
2438 void *tempAddrPtr = NULL;
2439 struct netns_ifaddrs *interfaceArray = NULL, *tempIfAddr = NULL;
2440
2441 /* close the read-end of the pipe */
2442 close(pipefd[0]);
2443
2444 if (!enter_net_ns(c)) {
2445 SYSERROR("Failed to attach to network namespace");
2446 goto out;
2447 }
2448
2449 /* Grab the list of interfaces */
2450 if (netns_getifaddrs(&interfaceArray, -1, &(bool){false})) {
2451 SYSERROR("Failed to get interfaces list");
2452 goto out;
2453 }
2454
2455 /* Iterate through the interfaces */
2456 for (tempIfAddr = interfaceArray; tempIfAddr;
2457 tempIfAddr = tempIfAddr->ifa_next) {
2458 if (tempIfAddr->ifa_addr == NULL)
2459 continue;
2460
2461 #pragma GCC diagnostic push
2462 #pragma GCC diagnostic ignored "-Wcast-align"
2463
2464 if (tempIfAddr->ifa_addr->sa_family == AF_INET) {
2465 if (family && strcmp(family, "inet"))
2466 continue;
2467
2468 tempAddrPtr = &((struct sockaddr_in *)tempIfAddr->ifa_addr)->sin_addr;
2469 } else {
2470 if (family && strcmp(family, "inet6"))
2471 continue;
2472
2473 if (((struct sockaddr_in6 *)tempIfAddr->ifa_addr)->sin6_scope_id != scope)
2474 continue;
2475
2476 tempAddrPtr = &((struct sockaddr_in6 *)tempIfAddr->ifa_addr)->sin6_addr;
2477 }
2478
2479 #pragma GCC diagnostic pop
2480
2481 if (interface && strcmp(interface, tempIfAddr->ifa_name))
2482 continue;
2483 else if (!interface && strcmp("lo", tempIfAddr->ifa_name) == 0)
2484 continue;
2485
2486 address_ptr = (char *)inet_ntop(tempIfAddr->ifa_addr->sa_family,
2487 tempAddrPtr, addressOutputBuffer,
2488 sizeof(addressOutputBuffer));
2489 if (!address_ptr)
2490 continue;
2491
2492 nbytes = lxc_write_nointr(pipefd[1], address_ptr, INET6_ADDRSTRLEN);
2493 if (nbytes != INET6_ADDRSTRLEN) {
2494 SYSERROR("Failed to send ipv6 address \"%s\"",
2495 address_ptr);
2496 goto out;
2497 }
2498
2499 count++;
2500 }
2501
2502 ret = 0;
2503
2504 out:
2505 if (interfaceArray)
2506 netns_freeifaddrs(interfaceArray);
2507
2508 /* close the write-end of the pipe, thus sending EOF to the reader */
2509 close(pipefd[1]);
2510 _exit(ret);
2511 }
2512
2513 /* close the write-end of the pipe */
2514 close(pipefd[1]);
2515
2516 while (lxc_read_nointr(pipefd[0], &address, INET6_ADDRSTRLEN) == INET6_ADDRSTRLEN) {
2517 address[INET6_ADDRSTRLEN - 1] = '\0';
2518
2519 if (!add_to_array(&addresses, address, count))
2520 ERROR("PARENT: add_to_array failed");
2521
2522 count++;
2523 }
2524
2525 if (wait_for_pid(pid) != 0) {
2526 for (i = 0; i < count; i++)
2527 free(addresses[i]);
2528
2529 free(addresses);
2530 addresses = NULL;
2531 }
2532
2533 /* close the read-end of the pipe */
2534 close(pipefd[0]);
2535
2536 /* Append NULL to the array */
2537 if (addresses)
2538 addresses = (char **)lxc_append_null_to_array((void **)addresses, count);
2539
2540 return addresses;
2541 }
2542
2543 WRAP_API_3(char **, lxcapi_get_ips, const char *, const char *, int)
2544
2545 static int do_lxcapi_get_config_item(struct lxc_container *c, const char *key, char *retv, int inlen)
2546 {
2547 int ret = -1;
2548 struct lxc_config_t *config;
2549
2550 if (!c || !c->lxc_conf)
2551 return -1;
2552
2553 if (container_mem_lock(c))
2554 return -1;
2555
2556 config = lxc_get_config(key);
2557 /* Verify that the config key exists and that it has a callback
2558 * implemented.
2559 */
2560 if (config && config->get)
2561 ret = config->get(key, retv, inlen, c->lxc_conf, NULL);
2562
2563 container_mem_unlock(c);
2564 return ret;
2565 }
2566
2567 WRAP_API_3(int, lxcapi_get_config_item, const char *, char *, int)
2568
2569 static char* do_lxcapi_get_running_config_item(struct lxc_container *c, const char *key)
2570 {
2571 char *ret;
2572
2573 if (!c || !c->lxc_conf)
2574 return NULL;
2575
2576 if (container_mem_lock(c))
2577 return NULL;
2578
2579 ret = lxc_cmd_get_config_item(c->name, key, do_lxcapi_get_config_path(c));
2580 container_mem_unlock(c);
2581 return ret;
2582 }
2583
2584 WRAP_API_1(char *, lxcapi_get_running_config_item, const char *)
2585
2586 static int do_lxcapi_get_keys(struct lxc_container *c, const char *key, char *retv, int inlen)
2587 {
2588 int ret = -1;
2589
2590 /* List all config items. */
2591 if (!key)
2592 return lxc_list_config_items(retv, inlen);
2593
2594 if (!c || !c->lxc_conf)
2595 return -1;
2596
2597 if (container_mem_lock(c))
2598 return -1;
2599
2600 /* Support 'lxc.net.<idx>', i.e. 'lxc.net.0'
2601 * This is an intelligent result to show which keys are valid given the
2602 * type of nic it is.
2603 */
2604 if (strncmp(key, "lxc.net.", 8) == 0)
2605 ret = lxc_list_net(c->lxc_conf, key, retv, inlen);
2606 else
2607 ret = lxc_list_subkeys(c->lxc_conf, key, retv, inlen);
2608
2609 container_mem_unlock(c);
2610 return ret;
2611 }
2612
2613 WRAP_API_3(int, lxcapi_get_keys, const char *, char *, int)
2614
2615 static bool do_lxcapi_save_config(struct lxc_container *c, const char *alt_file)
2616 {
2617 int fd, lret;
2618 bool ret = false, need_disklock = false;
2619
2620 if (!alt_file)
2621 alt_file = c->configfile;
2622
2623 if (!alt_file)
2624 return false;
2625
2626 /* If we haven't yet loaded a config, load the stock config. */
2627 if (!c->lxc_conf) {
2628 if (!do_lxcapi_load_config(c, lxc_global_config_value("lxc.default_config"))) {
2629 ERROR("Error loading default configuration file %s "
2630 "while saving %s",
2631 lxc_global_config_value("lxc.default_config"),
2632 c->name);
2633 return false;
2634 }
2635 }
2636
2637 if (!create_container_dir(c))
2638 return false;
2639
2640 /* If we're writing to the container's config file, take the disk lock.
2641 * Otherwise just take the memlock to protect the struct lxc_container
2642 * while we're traversing it.
2643 */
2644 if (strcmp(c->configfile, alt_file) == 0)
2645 need_disklock = true;
2646
2647 if (need_disklock)
2648 lret = container_disk_lock(c);
2649 else
2650 lret = container_mem_lock(c);
2651 if (lret)
2652 return false;
2653
2654 fd = open(alt_file, O_WRONLY | O_CREAT | O_TRUNC | O_CLOEXEC,
2655 S_IRUSR | S_IWUSR | S_IRGRP | S_IWGRP);
2656 if (fd < 0)
2657 goto on_error;
2658
2659 lret = write_config(fd, c->lxc_conf);
2660 close(fd);
2661 if (lret < 0)
2662 goto on_error;
2663
2664 ret = true;
2665
2666 on_error:
2667 if (need_disklock)
2668 container_disk_unlock(c);
2669 else
2670 container_mem_unlock(c);
2671
2672 return ret;
2673 }
2674
2675 WRAP_API_1(bool, lxcapi_save_config, const char *)
2676
2677
2678 static bool mod_rdep(struct lxc_container *c0, struct lxc_container *c, bool inc)
2679 {
2680 FILE *f1;
2681 struct stat fbuf;
2682 void *buf = NULL;
2683 char *del = NULL;
2684 char path[PATH_MAX];
2685 char newpath[PATH_MAX];
2686 int fd, ret, n = 0, v = 0;
2687 bool bret = false;
2688 size_t len = 0, bytes = 0;
2689
2690 if (container_disk_lock(c0))
2691 return false;
2692
2693 ret = snprintf(path, PATH_MAX, "%s/%s/lxc_snapshots", c0->config_path, c0->name);
2694 if (ret < 0 || ret > PATH_MAX)
2695 goto out;
2696
2697 ret = snprintf(newpath, PATH_MAX, "%s\n%s\n", c->config_path, c->name);
2698 if (ret < 0 || ret > PATH_MAX)
2699 goto out;
2700
2701 /* If we find an lxc-snapshot file using the old format only listing the
2702 * number of snapshots we will keep using it. */
2703 f1 = fopen(path, "r");
2704 if (f1) {
2705 n = fscanf(f1, "%d", &v);
2706 fclose(f1);
2707 if (n == 1 && v == 0) {
2708 ret = remove(path);
2709 if (ret < 0)
2710 SYSERROR("Failed to remove \"%s\"", path);
2711
2712 n = 0;
2713 }
2714 }
2715
2716 if (n == 1) {
2717 v += inc ? 1 : -1;
2718 f1 = fopen(path, "w");
2719 if (!f1)
2720 goto out;
2721
2722 if (fprintf(f1, "%d\n", v) < 0) {
2723 ERROR("Error writing new snapshots value");
2724 fclose(f1);
2725 goto out;
2726 }
2727
2728 ret = fclose(f1);
2729 if (ret != 0) {
2730 SYSERROR("Error writing to or closing snapshots file");
2731 goto out;
2732 }
2733 } else {
2734 /* Here we know that we have or can use an lxc-snapshot file
2735 * using the new format. */
2736 if (inc) {
2737 f1 = fopen(path, "a");
2738 if (!f1)
2739 goto out;
2740
2741 if (fprintf(f1, "%s", newpath) < 0) {
2742 ERROR("Error writing new snapshots entry");
2743 ret = fclose(f1);
2744 if (ret != 0)
2745 SYSERROR("Error writing to or closing snapshots file");
2746 goto out;
2747 }
2748
2749 ret = fclose(f1);
2750 if (ret != 0) {
2751 SYSERROR("Error writing to or closing snapshots file");
2752 goto out;
2753 }
2754 } else if (!inc) {
2755 if ((fd = open(path, O_RDWR | O_CLOEXEC)) < 0)
2756 goto out;
2757
2758 if (fstat(fd, &fbuf) < 0) {
2759 close(fd);
2760 goto out;
2761 }
2762
2763 if (fbuf.st_size != 0) {
2764 buf = lxc_strmmap(NULL, fbuf.st_size, PROT_READ | PROT_WRITE, MAP_SHARED, fd, 0);
2765 if (buf == MAP_FAILED) {
2766 SYSERROR("Failed to create mapping %s", path);
2767 close(fd);
2768 goto out;
2769 }
2770
2771 len = strlen(newpath);
2772 while ((del = strstr((char *)buf, newpath))) {
2773 memmove(del, del + len, strlen(del) - len + 1);
2774 bytes += len;
2775 }
2776
2777 lxc_strmunmap(buf, fbuf.st_size);
2778 if (ftruncate(fd, fbuf.st_size - bytes) < 0) {
2779 SYSERROR("Failed to truncate file %s", path);
2780 close(fd);
2781 goto out;
2782 }
2783 }
2784
2785 close(fd);
2786 }
2787
2788 /* If the lxc-snapshot file is empty, remove it. */
2789 if (stat(path, &fbuf) < 0)
2790 goto out;
2791
2792 if (!fbuf.st_size) {
2793 ret = remove(path);
2794 if (ret < 0)
2795 SYSERROR("Failed to remove \"%s\"", path);
2796 }
2797 }
2798
2799 bret = true;
2800
2801 out:
2802 container_disk_unlock(c0);
2803 return bret;
2804 }
2805
2806 void mod_all_rdeps(struct lxc_container *c, bool inc)
2807 {
2808 struct lxc_container *p;
2809 char *lxcpath = NULL, *lxcname = NULL, path[PATH_MAX];
2810 size_t pathlen = 0, namelen = 0;
2811 FILE *f;
2812 int ret;
2813
2814 ret = snprintf(path, PATH_MAX, "%s/%s/lxc_rdepends",
2815 c->config_path, c->name);
2816 if (ret < 0 || ret >= PATH_MAX) {
2817 ERROR("Path name too long");
2818 return;
2819 }
2820
2821 f = fopen(path, "r");
2822 if (f == NULL)
2823 return;
2824
2825 while (getline(&lxcpath, &pathlen, f) != -1) {
2826 if (getline(&lxcname, &namelen, f) == -1) {
2827 ERROR("badly formatted file %s", path);
2828 goto out;
2829 }
2830
2831 remove_trailing_newlines(lxcpath);
2832 remove_trailing_newlines(lxcname);
2833
2834 if ((p = lxc_container_new(lxcname, lxcpath)) == NULL) {
2835 ERROR("Unable to find dependent container %s:%s",
2836 lxcpath, lxcname);
2837 continue;
2838 }
2839
2840 if (!mod_rdep(p, c, inc))
2841 ERROR("Failed to update snapshots file for %s:%s",
2842 lxcpath, lxcname);
2843
2844 lxc_container_put(p);
2845 }
2846
2847 out:
2848 free(lxcpath);
2849 free(lxcname);
2850 fclose(f);
2851 }
2852
2853 static bool has_fs_snapshots(struct lxc_container *c)
2854 {
2855 FILE *f;
2856 char path[PATH_MAX];
2857 int ret, v;
2858 struct stat fbuf;
2859 bool bret = false;
2860
2861 ret = snprintf(path, PATH_MAX, "%s/%s/lxc_snapshots", c->config_path,
2862 c->name);
2863 if (ret < 0 || ret > PATH_MAX)
2864 goto out;
2865
2866 /* If the file doesn't exist there are no snapshots. */
2867 if (stat(path, &fbuf) < 0)
2868 goto out;
2869
2870 v = fbuf.st_size;
2871 if (v != 0) {
2872 f = fopen(path, "r");
2873 if (!f)
2874 goto out;
2875
2876 ret = fscanf(f, "%d", &v);
2877 fclose(f);
2878 /* TODO: Figure out what to do with the return value of fscanf. */
2879 if (ret != 1)
2880 INFO("Container uses new lxc-snapshots format %s", path);
2881 }
2882
2883 bret = v != 0;
2884
2885 out:
2886 return bret;
2887 }
2888
2889 static bool has_snapshots(struct lxc_container *c)
2890 {
2891 char path[PATH_MAX];
2892 struct dirent *direntp;
2893 int count=0;
2894 DIR *dir;
2895
2896 if (!get_snappath_dir(c, path))
2897 return false;
2898
2899 dir = opendir(path);
2900 if (!dir)
2901 return false;
2902
2903 while ((direntp = readdir(dir))) {
2904 if (!strcmp(direntp->d_name, "."))
2905 continue;
2906
2907 if (!strcmp(direntp->d_name, ".."))
2908 continue;
2909 count++;
2910 break;
2911 }
2912
2913 closedir(dir);
2914 return count > 0;
2915 }
2916
2917 static bool do_destroy_container(struct lxc_conf *conf) {
2918 int ret;
2919
2920 if (am_guest_unpriv()) {
2921 ret = userns_exec_full(conf, storage_destroy_wrapper, conf,
2922 "storage_destroy_wrapper");
2923 if (ret < 0)
2924 return false;
2925
2926 return true;
2927 }
2928
2929 return storage_destroy(conf);
2930 }
2931
2932 static int lxc_rmdir_onedev_wrapper(void *data)
2933 {
2934 char *arg = (char *) data;
2935 return lxc_rmdir_onedev(arg, "snaps");
2936 }
2937
2938 static int lxc_unlink_exec_wrapper(void *data)
2939 {
2940 char *arg = data;
2941 return unlink(arg);
2942 }
2943
2944 static bool container_destroy(struct lxc_container *c,
2945 struct lxc_storage *storage)
2946 {
2947 const char *p1;
2948 size_t len;
2949 struct lxc_conf *conf;
2950 char *path = NULL;
2951 bool bret = false;
2952 int ret = 0;
2953
2954 if (!c || !do_lxcapi_is_defined(c))
2955 return false;
2956
2957 conf = c->lxc_conf;
2958 if (container_disk_lock(c))
2959 return false;
2960
2961 if (!is_stopped(c)) {
2962 /* We should queue some sort of error - in c->error_string? */
2963 ERROR("container %s is not stopped", c->name);
2964 goto out;
2965 }
2966
2967 if (conf && !lxc_list_empty(&conf->hooks[LXCHOOK_DESTROY])) {
2968 /* Start of environment variable setup for hooks */
2969 if (setenv("LXC_NAME", c->name, 1))
2970 SYSERROR("Failed to set environment variable for container name");
2971
2972 if (conf->rcfile && setenv("LXC_CONFIG_FILE", conf->rcfile, 1))
2973 SYSERROR("Failed to set environment variable for config path");
2974
2975 if (conf->rootfs.mount && setenv("LXC_ROOTFS_MOUNT", conf->rootfs.mount, 1))
2976 SYSERROR("Failed to set environment variable for rootfs mount");
2977
2978 if (conf->rootfs.path && setenv("LXC_ROOTFS_PATH", conf->rootfs.path, 1))
2979 SYSERROR("Failed to set environment variable for rootfs mount");
2980
2981 if (conf->console.path && setenv("LXC_CONSOLE", conf->console.path, 1))
2982 SYSERROR("Failed to set environment variable for console path");
2983
2984 if (conf->console.log_path && setenv("LXC_CONSOLE_LOGPATH", conf->console.log_path, 1))
2985 SYSERROR("Failed to set environment variable for console log");
2986 /* End of environment variable setup for hooks */
2987
2988 if (run_lxc_hooks(c->name, "destroy", conf, NULL)) {
2989 ERROR("Failed to execute clone hook for \"%s\"", c->name);
2990 goto out;
2991 }
2992 }
2993
2994 if (current_config && conf == current_config) {
2995 current_config = NULL;
2996
2997 if (conf->logfd != -1) {
2998 close(conf->logfd);
2999 conf->logfd = -1;
3000 }
3001 }
3002
3003 /* LXC is not managing the storage of the container. */
3004 if (conf && !conf->rootfs.managed)
3005 goto on_success;
3006
3007 if (conf && conf->rootfs.path && conf->rootfs.mount) {
3008 if (!do_destroy_container(conf)) {
3009 ERROR("Error destroying rootfs for %s", c->name);
3010 goto out;
3011 }
3012 INFO("Destroyed rootfs for %s", c->name);
3013 }
3014
3015 mod_all_rdeps(c, false);
3016
3017 p1 = do_lxcapi_get_config_path(c);
3018 /* strlen(p1)
3019 * +
3020 * /
3021 * +
3022 * strlen(c->name)
3023 * +
3024 * /
3025 * +
3026 * strlen("config") = 6
3027 * +
3028 * \0
3029 */
3030 len = strlen(p1) + 1 + strlen(c->name) + 1 + 6 + 1;
3031 path = malloc(len);
3032 if (!path) {
3033 ERROR("Failed to allocate memory");
3034 goto out;
3035 }
3036
3037 /* For an overlay container the rootfs is considered immutable and
3038 * cannot be removed when restoring from a snapshot.
3039 */
3040 if (storage && (!strcmp(storage->type, "overlay") ||
3041 !strcmp(storage->type, "overlayfs")) &&
3042 (storage->flags & LXC_STORAGE_INTERNAL_OVERLAY_RESTORE)) {
3043 ret = snprintf(path, len, "%s/%s/config", p1, c->name);
3044 if (ret < 0 || (size_t)ret >= len)
3045 goto out;
3046
3047 if (am_guest_unpriv())
3048 ret = userns_exec_1(conf, lxc_unlink_exec_wrapper, path,
3049 "lxc_unlink_exec_wrapper");
3050 else
3051 ret = unlink(path);
3052 if (ret < 0) {
3053 SYSERROR("Failed to destroy config file \"%s\" for \"%s\"",
3054 path, c->name);
3055 goto out;
3056 }
3057 INFO("Destroyed config file \"%s\" for \"%s\"", path, c->name);
3058
3059 bret = true;
3060 goto out;
3061 }
3062
3063 ret = snprintf(path, len, "%s/%s", p1, c->name);
3064 if (ret < 0 || (size_t)ret >= len)
3065 goto out;
3066
3067 if (am_guest_unpriv())
3068 ret = userns_exec_full(conf, lxc_rmdir_onedev_wrapper, path,
3069 "lxc_rmdir_onedev_wrapper");
3070 else
3071 ret = lxc_rmdir_onedev(path, "snaps");
3072 if (ret < 0) {
3073 ERROR("Failed to destroy directory \"%s\" for \"%s\"", path,
3074 c->name);
3075 goto out;
3076 }
3077 INFO("Destroyed directory \"%s\" for \"%s\"", path, c->name);
3078
3079 on_success:
3080 bret = true;
3081
3082 out:
3083 if (path)
3084 free(path);
3085
3086 container_disk_unlock(c);
3087 return bret;
3088 }
3089
3090 static bool do_lxcapi_destroy(struct lxc_container *c)
3091 {
3092 if (!c || !lxcapi_is_defined(c))
3093 return false;
3094
3095 if (c->lxc_conf && c->lxc_conf->rootfs.managed) {
3096 if (has_snapshots(c)) {
3097 ERROR("Container %s has snapshots; not removing", c->name);
3098 return false;
3099 }
3100
3101 if (has_fs_snapshots(c)) {
3102 ERROR("container %s has snapshots on its rootfs", c->name);
3103 return false;
3104 }
3105 }
3106
3107 return container_destroy(c, NULL);
3108 }
3109
3110 WRAP_API(bool, lxcapi_destroy)
3111
3112 static bool do_lxcapi_destroy_with_snapshots(struct lxc_container *c)
3113 {
3114 if (!c || !lxcapi_is_defined(c))
3115 return false;
3116
3117 if (!lxcapi_snapshot_destroy_all(c)) {
3118 ERROR("Error deleting all snapshots");
3119 return false;
3120 }
3121
3122 return lxcapi_destroy(c);
3123 }
3124
3125 WRAP_API(bool, lxcapi_destroy_with_snapshots)
3126
3127 int lxc_set_config_item_locked(struct lxc_conf *conf, const char *key,
3128 const char *v)
3129 {
3130 int ret;
3131 struct lxc_config_t *config;
3132 bool bret = true;
3133
3134 config = lxc_get_config(key);
3135 if (!config)
3136 return -EINVAL;
3137
3138 ret = config->set(key, v, conf, NULL);
3139 if (ret < 0)
3140 return -EINVAL;
3141
3142 if (lxc_config_value_empty(v))
3143 do_clear_unexp_config_line(conf, key);
3144 else
3145 bret = do_append_unexp_config_line(conf, key, v);
3146 if (!bret)
3147 return -ENOMEM;
3148
3149 return 0;
3150 }
3151
3152 static bool do_set_config_item_locked(struct lxc_container *c, const char *key,
3153 const char *v)
3154 {
3155 int ret;
3156
3157 if (!c->lxc_conf)
3158 c->lxc_conf = lxc_conf_init();
3159
3160 if (!c->lxc_conf)
3161 return false;
3162
3163 ret = lxc_set_config_item_locked(c->lxc_conf, key, v);
3164 if (ret < 0)
3165 return false;
3166
3167 return true;
3168 }
3169
3170 static bool do_lxcapi_set_config_item(struct lxc_container *c, const char *key, const char *v)
3171 {
3172 bool b = false;
3173
3174 if (!c)
3175 return false;
3176
3177 if (container_mem_lock(c))
3178 return false;
3179
3180 b = do_set_config_item_locked(c, key, v);
3181
3182 container_mem_unlock(c);
3183 return b;
3184 }
3185
3186 WRAP_API_2(bool, lxcapi_set_config_item, const char *, const char *)
3187
3188 static char *lxcapi_config_file_name(struct lxc_container *c)
3189 {
3190 if (!c || !c->configfile)
3191 return NULL;
3192
3193 return strdup(c->configfile);
3194 }
3195
3196 static const char *lxcapi_get_config_path(struct lxc_container *c)
3197 {
3198 if (!c || !c->config_path)
3199 return NULL;
3200
3201 return (const char *)(c->config_path);
3202 }
3203
3204 /*
3205 * not for export
3206 * Just recalculate the c->configfile based on the
3207 * c->config_path, which must be set.
3208 * The lxc_container must be locked or not yet public.
3209 */
3210 static bool set_config_filename(struct lxc_container *c)
3211 {
3212 char *newpath;
3213 int len, ret;
3214
3215 if (!c->config_path)
3216 return false;
3217
3218 /* $lxc_path + "/" + c->name + "/" + "config" + '\0' */
3219 len = strlen(c->config_path) + strlen(c->name) + strlen("config") + 3;
3220 newpath = malloc(len);
3221 if (!newpath)
3222 return false;
3223
3224 ret = snprintf(newpath, len, "%s/%s/config", c->config_path, c->name);
3225 if (ret < 0 || ret >= len) {
3226 fprintf(stderr, "Error printing out config file name\n");
3227 free(newpath);
3228 return false;
3229 }
3230
3231 free(c->configfile);
3232 c->configfile = newpath;
3233
3234 return true;
3235 }
3236
3237 static bool do_lxcapi_set_config_path(struct lxc_container *c, const char *path)
3238 {
3239 char *p;
3240 bool b = false;
3241 char *oldpath = NULL;
3242
3243 if (!c)
3244 return b;
3245
3246 if (container_mem_lock(c))
3247 return b;
3248
3249 p = strdup(path);
3250 if (!p) {
3251 ERROR("Out of memory setting new lxc path");
3252 goto err;
3253 }
3254
3255 b = true;
3256 if (c->config_path)
3257 oldpath = c->config_path;
3258 c->config_path = p;
3259
3260 /* Since we've changed the config path, we have to change the
3261 * config file name too */
3262 if (!set_config_filename(c)) {
3263 ERROR("Out of memory setting new config filename");
3264 b = false;
3265 free(c->config_path);
3266 c->config_path = oldpath;
3267 oldpath = NULL;
3268 }
3269
3270 err:
3271 free(oldpath);
3272 container_mem_unlock(c);
3273 return b;
3274 }
3275
3276 WRAP_API_1(bool, lxcapi_set_config_path, const char *)
3277
3278 static bool do_lxcapi_set_cgroup_item(struct lxc_container *c, const char *subsys, const char *value)
3279 {
3280 int ret;
3281 struct cgroup_ops *cgroup_ops;
3282
3283 if (!c)
3284 return false;
3285
3286 if (is_stopped(c))
3287 return false;
3288
3289 cgroup_ops = cgroup_init(c->lxc_conf);
3290 if (!cgroup_ops)
3291 return false;
3292
3293 ret = cgroup_ops->set(cgroup_ops, subsys, value, c->name, c->config_path);
3294
3295 cgroup_exit(cgroup_ops);
3296
3297 return ret == 0;
3298 }
3299
3300 WRAP_API_2(bool, lxcapi_set_cgroup_item, const char *, const char *)
3301
3302 static int do_lxcapi_get_cgroup_item(struct lxc_container *c, const char *subsys, char *retv, int inlen)
3303 {
3304 int ret;
3305 struct cgroup_ops *cgroup_ops;
3306
3307 if (!c)
3308 return -1;
3309
3310 if (is_stopped(c))
3311 return -1;
3312
3313 cgroup_ops = cgroup_init(c->lxc_conf);
3314 if (!cgroup_ops)
3315 return -1;
3316
3317 ret = cgroup_ops->get(cgroup_ops, subsys, retv, inlen, c->name,
3318 c->config_path);
3319
3320 cgroup_exit(cgroup_ops);
3321
3322 return ret;
3323 }
3324
3325 WRAP_API_3(int, lxcapi_get_cgroup_item, const char *, char *, int)
3326
3327 const char *lxc_get_global_config_item(const char *key)
3328 {
3329 return lxc_global_config_value(key);
3330 }
3331
3332 const char *lxc_get_version(void)
3333 {
3334 return LXC_VERSION;
3335 }
3336
3337 static int copy_file(const char *old, const char *new)
3338 {
3339 int in, out;
3340 ssize_t len, ret;
3341 char buf[8096];
3342 struct stat sbuf;
3343
3344 if (file_exists(new)) {
3345 ERROR("copy destination %s exists", new);
3346 return -1;
3347 }
3348
3349 ret = stat(old, &sbuf);
3350 if (ret < 0) {
3351 INFO("Error stat'ing %s", old);
3352 return -1;
3353 }
3354
3355 in = open(old, O_RDONLY);
3356 if (in < 0) {
3357 SYSERROR("Error opening original file %s", old);
3358 return -1;
3359 }
3360
3361 out = open(new, O_CREAT | O_EXCL | O_WRONLY, 0644);
3362 if (out < 0) {
3363 SYSERROR("Error opening new file %s", new);
3364 close(in);
3365 return -1;
3366 }
3367
3368 for (;;) {
3369 len = lxc_read_nointr(in, buf, 8096);
3370 if (len < 0) {
3371 SYSERROR("Error reading old file %s", old);
3372 goto err;
3373 }
3374
3375 if (len == 0)
3376 break;
3377
3378 ret = lxc_write_nointr(out, buf, len);
3379 if (ret < len) { /* should we retry? */
3380 SYSERROR("Error: write to new file %s was interrupted", new);
3381 goto err;
3382 }
3383 }
3384
3385 close(in);
3386 close(out);
3387
3388 /* We set mode, but not owner/group. */
3389 ret = chmod(new, sbuf.st_mode);
3390 if (ret) {
3391 SYSERROR("Error setting mode on %s", new);
3392 return -1;
3393 }
3394
3395 return 0;
3396
3397 err:
3398 close(in);
3399 close(out);
3400 return -1;
3401 }
3402
3403 static int copyhooks(struct lxc_container *oldc, struct lxc_container *c)
3404 {
3405 __do_free char *cpath;
3406 int i, len, ret;
3407 struct lxc_list *it;
3408
3409 len = strlen(oldc->config_path) + strlen(oldc->name) + 3;
3410 cpath = must_realloc(NULL, len);
3411 ret = snprintf(cpath, len, "%s/%s/", oldc->config_path, oldc->name);
3412 if (ret < 0 || ret >= len)
3413 return -1;
3414
3415 for (i=0; i<NUM_LXC_HOOKS; i++) {
3416 lxc_list_for_each(it, &c->lxc_conf->hooks[i]) {
3417 char *hookname = it->elem;
3418 char *fname = strrchr(hookname, '/');
3419 char tmppath[PATH_MAX];
3420 if (!fname) /* relative path - we don't support, but maybe we should */
3421 return 0;
3422
3423 if (strncmp(hookname, cpath, len - 1) != 0) {
3424 /* this hook is public - ignore */
3425 continue;
3426 }
3427
3428 /* copy the script, and change the entry in confile */
3429 ret = snprintf(tmppath, PATH_MAX, "%s/%s/%s",
3430 c->config_path, c->name, fname+1);
3431 if (ret < 0 || ret >= PATH_MAX)
3432 return -1;
3433
3434 ret = copy_file(it->elem, tmppath);
3435 if (ret < 0)
3436 return -1;
3437
3438 free(it->elem);
3439
3440 it->elem = strdup(tmppath);
3441 if (!it->elem) {
3442 ERROR("out of memory copying hook path");
3443 return -1;
3444 }
3445 }
3446 }
3447
3448 if (!clone_update_unexp_hooks(c->lxc_conf, oldc->config_path,
3449 c->config_path, oldc->name, c->name)) {
3450 ERROR("Error saving new hooks in clone");
3451 return -1;
3452 }
3453
3454 do_lxcapi_save_config(c, NULL);
3455 return 0;
3456 }
3457
3458
3459 static int copy_fstab(struct lxc_container *oldc, struct lxc_container *c)
3460 {
3461 char newpath[PATH_MAX];
3462 char *oldpath = oldc->lxc_conf->fstab;
3463 int ret;
3464
3465 if (!oldpath)
3466 return 0;
3467
3468 clear_unexp_config_line(c->lxc_conf, "lxc.mount.fstab", false);
3469
3470 char *p = strrchr(oldpath, '/');
3471 if (!p)
3472 return -1;
3473
3474 ret = snprintf(newpath, PATH_MAX, "%s/%s%s",
3475 c->config_path, c->name, p);
3476 if (ret < 0 || ret >= PATH_MAX) {
3477 ERROR("error printing new path for %s", oldpath);
3478 return -1;
3479 }
3480
3481 if (file_exists(newpath)) {
3482 ERROR("error: fstab file %s exists", newpath);
3483 return -1;
3484 }
3485
3486 if (copy_file(oldpath, newpath) < 0) {
3487 ERROR("error: copying %s to %s", oldpath, newpath);
3488 return -1;
3489 }
3490
3491 free(c->lxc_conf->fstab);
3492
3493 c->lxc_conf->fstab = strdup(newpath);
3494 if (!c->lxc_conf->fstab) {
3495 ERROR("error: allocating pathname");
3496 return -1;
3497 }
3498
3499 if (!do_append_unexp_config_line(c->lxc_conf, "lxc.mount.fstab", newpath)) {
3500 ERROR("error saving new lxctab");
3501 return -1;
3502 }
3503
3504 return 0;
3505 }
3506
3507 static void copy_rdepends(struct lxc_container *c, struct lxc_container *c0)
3508 {
3509 char path0[PATH_MAX], path1[PATH_MAX];
3510 int ret;
3511
3512 ret = snprintf(path0, PATH_MAX, "%s/%s/lxc_rdepends", c0->config_path,
3513 c0->name);
3514 if (ret < 0 || ret >= PATH_MAX) {
3515 WARN("Error copying reverse dependencies");
3516 return;
3517 }
3518
3519 ret = snprintf(path1, PATH_MAX, "%s/%s/lxc_rdepends", c->config_path,
3520 c->name);
3521 if (ret < 0 || ret >= PATH_MAX) {
3522 WARN("Error copying reverse dependencies");
3523 return;
3524 }
3525
3526 if (copy_file(path0, path1) < 0) {
3527 INFO("Error copying reverse dependencies");
3528 return;
3529 }
3530 }
3531
3532 static bool add_rdepends(struct lxc_container *c, struct lxc_container *c0)
3533 {
3534 int ret;
3535 char path[PATH_MAX];
3536 FILE *f;
3537 bool bret;
3538
3539 ret = snprintf(path, PATH_MAX, "%s/%s/lxc_rdepends", c->config_path,
3540 c->name);
3541 if (ret < 0 || ret >= PATH_MAX)
3542 return false;
3543
3544 f = fopen(path, "a");
3545 if (!f)
3546 return false;
3547
3548 bret = true;
3549
3550 /* If anything goes wrong, just return an error. */
3551 if (fprintf(f, "%s\n%s\n", c0->config_path, c0->name) < 0)
3552 bret = false;
3553
3554 if (fclose(f) != 0)
3555 bret = false;
3556
3557 return bret;
3558 }
3559
3560 /*
3561 * If the fs natively supports snapshot clones with no penalty,
3562 * then default to those even if not requested.
3563 * Currently we only do this for btrfs.
3564 */
3565 bool should_default_to_snapshot(struct lxc_container *c0,
3566 struct lxc_container *c1)
3567 {
3568 __do_free char *p0, *p1;
3569 int ret;
3570 size_t l0 = strlen(c0->config_path) + strlen(c0->name) + 2;
3571 size_t l1 = strlen(c1->config_path) + strlen(c1->name) + 2;
3572 char *rootfs = c0->lxc_conf->rootfs.path;
3573
3574 p0 = must_realloc(NULL, l0 + 1);
3575 p1 = must_realloc(NULL, l1 + 1);
3576 ret = snprintf(p0, l0, "%s/%s", c0->config_path, c0->name);
3577 if (ret < 0 || ret >= l0)
3578 return false;
3579
3580 ret = snprintf(p1, l1, "%s/%s", c1->config_path, c1->name);
3581 if (ret < 0 || ret >= l1)
3582 return false;
3583
3584 if (!is_btrfs_fs(p0) || !is_btrfs_fs(p1))
3585 return false;
3586
3587 if (is_btrfs_subvol(rootfs) <= 0)
3588 return false;
3589
3590 return btrfs_same_fs(p0, p1) == 0;
3591 }
3592
3593 static int copy_storage(struct lxc_container *c0, struct lxc_container *c,
3594 const char *newtype, int flags, const char *bdevdata,
3595 uint64_t newsize)
3596 {
3597 struct lxc_storage *bdev;
3598 bool need_rdep;
3599
3600 if (should_default_to_snapshot(c0, c))
3601 flags |= LXC_CLONE_SNAPSHOT;
3602
3603 bdev = storage_copy(c0, c->name, c->config_path, newtype, flags,
3604 bdevdata, newsize, &need_rdep);
3605 if (!bdev) {
3606 ERROR("Error copying storage.");
3607 return -1;
3608 }
3609
3610 /* Set new rootfs. */
3611 free(c->lxc_conf->rootfs.path);
3612 c->lxc_conf->rootfs.path = strdup(bdev->src);
3613 storage_put(bdev);
3614
3615 if (!c->lxc_conf->rootfs.path) {
3616 ERROR("Out of memory while setting storage path.");
3617 return -1;
3618 }
3619
3620 /* Append a new lxc.rootfs.path entry to the unexpanded config. */
3621 clear_unexp_config_line(c->lxc_conf, "lxc.rootfs.path", false);
3622 if (!do_append_unexp_config_line(c->lxc_conf, "lxc.rootfs.path",
3623 c->lxc_conf->rootfs.path)) {
3624 ERROR("Error saving new rootfs to cloned config.");
3625 return -1;
3626 }
3627
3628 if (flags & LXC_CLONE_SNAPSHOT)
3629 copy_rdepends(c, c0);
3630
3631 if (need_rdep) {
3632 if (!add_rdepends(c, c0))
3633 WARN("Error adding reverse dependency from %s to %s",
3634 c->name, c0->name);
3635 }
3636
3637 mod_all_rdeps(c, true);
3638
3639 return 0;
3640 }
3641
3642 struct clone_update_data {
3643 struct lxc_container *c0;
3644 struct lxc_container *c1;
3645 int flags;
3646 char **hookargs;
3647 };
3648
3649 static int clone_update_rootfs(struct clone_update_data *data)
3650 {
3651 struct lxc_container *c0 = data->c0;
3652 struct lxc_container *c = data->c1;
3653 int flags = data->flags;
3654 char **hookargs = data->hookargs;
3655 int ret = -1;
3656 char path[PATH_MAX];
3657 struct lxc_storage *bdev;
3658 FILE *fout;
3659 struct lxc_conf *conf = c->lxc_conf;
3660
3661 /* update hostname in rootfs */
3662 /* we're going to mount, so run in a clean namespace to simplify cleanup */
3663
3664 if (setgid(0) < 0) {
3665 ERROR("Failed to setgid to 0");
3666 return -1;
3667 }
3668
3669 if (setuid(0) < 0) {
3670 ERROR("Failed to setuid to 0");
3671 return -1;
3672 }
3673
3674 if (setgroups(0, NULL) < 0)
3675 WARN("Failed to clear groups");
3676
3677 if (unshare(CLONE_NEWNS) < 0)
3678 return -1;
3679
3680 bdev = storage_init(c->lxc_conf);
3681 if (!bdev)
3682 return -1;
3683
3684 if (strcmp(bdev->type, "dir") != 0) {
3685 if (unshare(CLONE_NEWNS) < 0) {
3686 ERROR("error unsharing mounts");
3687 storage_put(bdev);
3688 return -1;
3689 }
3690
3691 if (detect_shared_rootfs()) {
3692 if (mount(NULL, "/", NULL, MS_SLAVE|MS_REC, NULL)) {
3693 SYSERROR("Failed to make / rslave");
3694 ERROR("Continuing...");
3695 }
3696 }
3697
3698 if (bdev->ops->mount(bdev) < 0) {
3699 storage_put(bdev);
3700 return -1;
3701 }
3702 } else { /* TODO come up with a better way */
3703 free(bdev->dest);
3704 bdev->dest = strdup(lxc_storage_get_path(bdev->src, bdev->type));
3705 }
3706
3707 if (!lxc_list_empty(&conf->hooks[LXCHOOK_CLONE])) {
3708 /* Start of environment variable setup for hooks */
3709 if (c0->name && setenv("LXC_SRC_NAME", c0->name, 1))
3710 SYSERROR("failed to set environment variable for source container name");
3711
3712 if (setenv("LXC_NAME", c->name, 1))
3713 SYSERROR("failed to set environment variable for container name");
3714
3715 if (conf->rcfile && setenv("LXC_CONFIG_FILE", conf->rcfile, 1))
3716 SYSERROR("failed to set environment variable for config path");
3717
3718 if (bdev->dest && setenv("LXC_ROOTFS_MOUNT", bdev->dest, 1))
3719 SYSERROR("failed to set environment variable for rootfs mount");
3720
3721 if (conf->rootfs.path && setenv("LXC_ROOTFS_PATH", conf->rootfs.path, 1))
3722 SYSERROR("failed to set environment variable for rootfs mount");
3723
3724 if (run_lxc_hooks(c->name, "clone", conf, hookargs)) {
3725 ERROR("Error executing clone hook for %s", c->name);
3726 storage_put(bdev);
3727 return -1;
3728 }
3729 }
3730
3731 if (!(flags & LXC_CLONE_KEEPNAME)) {
3732 ret = snprintf(path, PATH_MAX, "%s/etc/hostname", bdev->dest);
3733 storage_put(bdev);
3734
3735 if (ret < 0 || ret >= PATH_MAX)
3736 return -1;
3737
3738 if (!file_exists(path))
3739 return 0;
3740
3741 if (!(fout = fopen(path, "w"))) {
3742 SYSERROR("unable to open %s: ignoring", path);
3743 return 0;
3744 }
3745
3746 if (fprintf(fout, "%s", c->name) < 0) {
3747 fclose(fout);
3748 return -1;
3749 }
3750
3751 if (fclose(fout) < 0)
3752 return -1;
3753 } else {
3754 storage_put(bdev);
3755 }
3756
3757 return 0;
3758 }
3759
3760 static int clone_update_rootfs_wrapper(void *data)
3761 {
3762 struct clone_update_data *arg = (struct clone_update_data *) data;
3763 return clone_update_rootfs(arg);
3764 }
3765
3766 /*
3767 * We want to support:
3768 sudo lxc-clone -o o1 -n n1 -s -L|-fssize fssize -v|--vgname vgname \
3769 -p|--lvprefix lvprefix -t|--fstype fstype -B backingstore
3770
3771 -s [ implies overlay]
3772 -s -B overlay
3773
3774 only rootfs gets converted (copied/snapshotted) on clone.
3775 */
3776
3777 static int create_file_dirname(char *path, struct lxc_conf *conf)
3778 {
3779 char *p = strrchr(path, '/');
3780 int ret = -1;
3781
3782 if (!p)
3783 return -1;
3784
3785 *p = '\0';
3786 ret = do_create_container_dir(path, conf);
3787 *p = '/';
3788
3789 return ret;
3790 }
3791
3792 static struct lxc_container *do_lxcapi_clone(struct lxc_container *c, const char *newname,
3793 const char *lxcpath, int flags,
3794 const char *bdevtype, const char *bdevdata, uint64_t newsize,
3795 char **hookargs)
3796 {
3797 char newpath[PATH_MAX];
3798 int fd, ret;
3799 struct clone_update_data data;
3800 size_t saved_unexp_len;
3801 pid_t pid;
3802 int storage_copied = 0;
3803 char *origroot = NULL, *saved_unexp_conf = NULL;
3804 struct lxc_container *c2 = NULL;
3805
3806 if (!c || !do_lxcapi_is_defined(c))
3807 return NULL;
3808
3809 if (container_mem_lock(c))
3810 return NULL;
3811 if (!is_stopped(c) && !(flags & LXC_CLONE_ALLOW_RUNNING)) {
3812 ERROR("error: Original container (%s) is running. Use --allowrunning if you want to force a snapshot of the running container.", c->name);
3813 goto out;
3814 }
3815
3816 /* Make sure the container doesn't yet exist. */
3817 if (!newname)
3818 newname = c->name;
3819
3820 if (!lxcpath)
3821 lxcpath = do_lxcapi_get_config_path(c);
3822
3823 ret = snprintf(newpath, PATH_MAX, "%s/%s/config", lxcpath, newname);
3824 if (ret < 0 || ret >= PATH_MAX) {
3825 SYSERROR("clone: failed making config pathname");
3826 goto out;
3827 }
3828
3829 if (file_exists(newpath)) {
3830 ERROR("error: clone: %s exists", newpath);
3831 goto out;
3832 }
3833
3834 ret = create_file_dirname(newpath, c->lxc_conf);
3835 if (ret < 0 && errno != EEXIST) {
3836 ERROR("Error creating container dir for %s", newpath);
3837 goto out;
3838 }
3839
3840 /* Copy the configuration. Tweak it as needed. */
3841 if (c->lxc_conf->rootfs.path) {
3842 origroot = c->lxc_conf->rootfs.path;
3843 c->lxc_conf->rootfs.path = NULL;
3844 }
3845
3846 fd = open(newpath, O_WRONLY | O_CREAT | O_CLOEXEC,
3847 S_IRUSR | S_IWUSR | S_IRGRP | S_IWGRP);
3848 if (fd < 0) {
3849 SYSERROR("Failed to open \"%s\"", newpath);
3850 goto out;
3851 }
3852
3853 saved_unexp_conf = c->lxc_conf->unexpanded_config;
3854 saved_unexp_len = c->lxc_conf->unexpanded_len;
3855 c->lxc_conf->unexpanded_config = strdup(saved_unexp_conf);
3856 if (!c->lxc_conf->unexpanded_config) {
3857 close(fd);
3858 goto out;
3859 }
3860
3861 clear_unexp_config_line(c->lxc_conf, "lxc.rootfs.path", false);
3862 write_config(fd, c->lxc_conf);
3863 close(fd);
3864
3865 c->lxc_conf->rootfs.path = origroot;
3866
3867 free(c->lxc_conf->unexpanded_config);
3868 c->lxc_conf->unexpanded_config = saved_unexp_conf;
3869 saved_unexp_conf = NULL;
3870 c->lxc_conf->unexpanded_len = saved_unexp_len;
3871
3872 ret = snprintf(newpath, PATH_MAX, "%s/%s/rootfs", lxcpath, newname);
3873 if (ret < 0 || ret >= PATH_MAX) {
3874 SYSERROR("clone: failed making rootfs pathname");
3875 goto out;
3876 }
3877
3878 ret = mkdir(newpath, 0755);
3879 if (ret < 0) {
3880 /* For an overlay container the rootfs is considered immutable
3881 * and will not have been removed when restoring from a
3882 * snapshot.
3883 */
3884 if (errno != ENOENT &&
3885 !(flags & LXC_STORAGE_INTERNAL_OVERLAY_RESTORE)) {
3886 SYSERROR("Failed to create directory \"%s\"", newpath);
3887 goto out;
3888 }
3889 }
3890
3891 if (am_guest_unpriv()) {
3892 if (chown_mapped_root(newpath, c->lxc_conf) < 0) {
3893 ERROR("Error chowning %s to container root", newpath);
3894 goto out;
3895 }
3896 }
3897
3898 c2 = lxc_container_new(newname, lxcpath);
3899 if (!c2) {
3900 ERROR("clone: failed to create new container (%s %s)", newname,
3901 lxcpath);
3902 goto out;
3903 }
3904
3905 /* copy/snapshot rootfs's */
3906 ret = copy_storage(c, c2, bdevtype, flags, bdevdata, newsize);
3907 if (ret < 0)
3908 goto out;
3909
3910 /* update utsname */
3911 if (!(flags & LXC_CLONE_KEEPNAME)) {
3912 clear_unexp_config_line(c2->lxc_conf, "lxc.utsname", false);
3913 clear_unexp_config_line(c2->lxc_conf, "lxc.uts.name", false);
3914
3915 if (!do_set_config_item_locked(c2, "lxc.uts.name", newname)) {
3916 ERROR("Error setting new hostname");
3917 goto out;
3918 }
3919 }
3920
3921 /* copy hooks */
3922 ret = copyhooks(c, c2);
3923 if (ret < 0) {
3924 ERROR("error copying hooks");
3925 goto out;
3926 }
3927
3928 if (copy_fstab(c, c2) < 0) {
3929 ERROR("error copying fstab");
3930 goto out;
3931 }
3932
3933 /* update macaddrs */
3934 if (!(flags & LXC_CLONE_KEEPMACADDR)) {
3935 if (!network_new_hwaddrs(c2->lxc_conf)) {
3936 ERROR("Error updating mac addresses");
3937 goto out;
3938 }
3939 }
3940
3941 /* Update absolute paths for overlay mount directories. */
3942 if (ovl_update_abs_paths(c2->lxc_conf, c->config_path, c->name, lxcpath, newname) < 0)
3943 goto out;
3944
3945 /* We've now successfully created c2's storage, so clear it out if we
3946 * fail after this.
3947 */
3948 storage_copied = 1;
3949
3950 if (!c2->save_config(c2, NULL))
3951 goto out;
3952
3953 if ((pid = fork()) < 0) {
3954 SYSERROR("fork");
3955 goto out;
3956 }
3957
3958 if (pid > 0) {
3959 ret = wait_for_pid(pid);
3960 if (ret)
3961 goto out;
3962
3963 container_mem_unlock(c);
3964 return c2;
3965 }
3966
3967 data.c0 = c;
3968 data.c1 = c2;
3969 data.flags = flags;
3970 data.hookargs = hookargs;
3971
3972 if (am_guest_unpriv())
3973 ret = userns_exec_full(c->lxc_conf, clone_update_rootfs_wrapper,
3974 &data, "clone_update_rootfs_wrapper");
3975 else
3976 ret = clone_update_rootfs(&data);
3977 if (ret < 0)
3978 _exit(EXIT_FAILURE);
3979
3980 container_mem_unlock(c);
3981 _exit(EXIT_SUCCESS);
3982
3983 out:
3984 container_mem_unlock(c);
3985 if (c2) {
3986 if (!storage_copied)
3987 c2->lxc_conf->rootfs.path = NULL;
3988
3989 c2->destroy(c2);
3990 lxc_container_put(c2);
3991 }
3992
3993 return NULL;
3994 }
3995
3996 static struct lxc_container *lxcapi_clone(struct lxc_container *c, const char *newname,
3997 const char *lxcpath, int flags,
3998 const char *bdevtype, const char *bdevdata, uint64_t newsize,
3999 char **hookargs)
4000 {
4001 struct lxc_container * ret;
4002
4003 current_config = c ? c->lxc_conf : NULL;
4004 ret = do_lxcapi_clone(c, newname, lxcpath, flags, bdevtype, bdevdata, newsize, hookargs);
4005 current_config = NULL;
4006
4007 return ret;
4008 }
4009
4010 static bool do_lxcapi_rename(struct lxc_container *c, const char *newname)
4011 {
4012 struct lxc_storage *bdev;
4013 struct lxc_container *newc;
4014
4015 if (!c || !c->name || !c->config_path || !c->lxc_conf)
4016 return false;
4017
4018 if (has_fs_snapshots(c) || has_snapshots(c)) {
4019 ERROR("Renaming a container with snapshots is not supported");
4020 return false;
4021 }
4022
4023 bdev = storage_init(c->lxc_conf);
4024 if (!bdev) {
4025 ERROR("Failed to find original backing store type");
4026 return false;
4027 }
4028
4029 newc = lxcapi_clone(c, newname, c->config_path, LXC_CLONE_KEEPMACADDR, NULL, bdev->type, 0, NULL);
4030 storage_put(bdev);
4031 if (!newc) {
4032 lxc_container_put(newc);
4033 return false;
4034 }
4035
4036 if (newc && lxcapi_is_defined(newc))
4037 lxc_container_put(newc);
4038
4039 if (!container_destroy(c, NULL)) {
4040 ERROR("Could not destroy existing container %s", c->name);
4041 return false;
4042 }
4043
4044 return true;
4045 }
4046
4047 WRAP_API_1(bool, lxcapi_rename, const char *)
4048
4049 static int lxcapi_attach(struct lxc_container *c, lxc_attach_exec_t exec_function, void *exec_payload, lxc_attach_options_t *options, pid_t *attached_process)
4050 {
4051 int ret;
4052
4053 if (!c)
4054 return -1;
4055
4056 current_config = c->lxc_conf;
4057
4058 ret = lxc_attach(c->name, c->config_path, exec_function, exec_payload, options, attached_process);
4059 current_config = NULL;
4060 return ret;
4061 }
4062
4063 static int do_lxcapi_attach_run_wait(struct lxc_container *c, lxc_attach_options_t *options, const char *program, const char * const argv[])
4064 {
4065 lxc_attach_command_t command;
4066 pid_t pid;
4067 int r;
4068
4069 if (!c)
4070 return -1;
4071
4072 command.program = (char*)program;
4073 command.argv = (char**)argv;
4074
4075 r = lxc_attach(c->name, c->config_path, lxc_attach_run_command, &command, options, &pid);
4076 if (r < 0) {
4077 ERROR("ups");
4078 return r;
4079 }
4080
4081 return lxc_wait_for_pid_status(pid);
4082 }
4083
4084 static int lxcapi_attach_run_wait(struct lxc_container *c, lxc_attach_options_t *options, const char *program, const char * const argv[])
4085 {
4086 int ret;
4087
4088 current_config = c ? c->lxc_conf : NULL;
4089 ret = do_lxcapi_attach_run_wait(c, options, program, argv);
4090 current_config = NULL;
4091
4092 return ret;
4093 }
4094
4095 static int get_next_index(const char *lxcpath, char *cname)
4096 {
4097 __do_free char *fname;
4098 struct stat sb;
4099 int i = 0, ret;
4100
4101 fname = must_realloc(NULL, strlen(lxcpath) + 20);
4102
4103 for (;;) {
4104 sprintf(fname, "%s/snap%d", lxcpath, i);
4105
4106 ret = stat(fname, &sb);
4107 if (ret != 0)
4108 return i;
4109
4110 i++;
4111 }
4112 }
4113
4114 static bool get_snappath_dir(struct lxc_container *c, char *snappath)
4115 {
4116 int ret;
4117
4118 /*
4119 * If the old style snapshot path exists, use it
4120 * /var/lib/lxc -> /var/lib/lxcsnaps
4121 */
4122 ret = snprintf(snappath, PATH_MAX, "%ssnaps", c->config_path);
4123 if (ret < 0 || ret >= PATH_MAX)
4124 return false;
4125
4126 if (dir_exists(snappath)) {
4127 ret = snprintf(snappath, PATH_MAX, "%ssnaps/%s", c->config_path, c->name);
4128 if (ret < 0 || ret >= PATH_MAX)
4129 return false;
4130
4131 return true;
4132 }
4133
4134 /*
4135 * Use the new style path
4136 * /var/lib/lxc -> /var/lib/lxc + c->name + /snaps + \0
4137 */
4138 ret = snprintf(snappath, PATH_MAX, "%s/%s/snaps", c->config_path, c->name);
4139 if (ret < 0 || ret >= PATH_MAX)
4140 return false;
4141
4142 return true;
4143 }
4144
4145 static int do_lxcapi_snapshot(struct lxc_container *c, const char *commentfile)
4146 {
4147 __do_free char *dfnam = NULL;
4148 int i, flags, ret;
4149 time_t timer;
4150 struct tm tm_info;
4151 struct lxc_container *c2;
4152 char snappath[PATH_MAX], newname[20];
4153 char buffer[25];
4154 FILE *f;
4155
4156 if (!c || !lxcapi_is_defined(c))
4157 return -1;
4158
4159 if (!storage_can_backup(c->lxc_conf)) {
4160 ERROR("%s's backing store cannot be backed up", c->name);
4161 ERROR("Your container must use another backing store type");
4162 return -1;
4163 }
4164
4165 if (!get_snappath_dir(c, snappath))
4166 return -1;
4167
4168 i = get_next_index(snappath, c->name);
4169
4170 if (mkdir_p(snappath, 0755) < 0) {
4171 ERROR("Failed to create snapshot directory %s", snappath);
4172 return -1;
4173 }
4174
4175 ret = snprintf(newname, 20, "snap%d", i);
4176 if (ret < 0 || ret >= 20)
4177 return -1;
4178
4179 /*
4180 * We pass LXC_CLONE_SNAPSHOT to make sure that a rdepends file entry is
4181 * created in the original container
4182 */
4183 flags = LXC_CLONE_SNAPSHOT | LXC_CLONE_KEEPMACADDR | LXC_CLONE_KEEPNAME |
4184 LXC_CLONE_KEEPBDEVTYPE | LXC_CLONE_MAYBE_SNAPSHOT;
4185 if (storage_is_dir(c->lxc_conf)) {
4186 ERROR("Snapshot of directory-backed container requested");
4187 ERROR("Making a copy-clone. If you do want snapshots, then");
4188 ERROR("please create overlay clone first, snapshot that");
4189 ERROR("and keep the original container pristine");
4190 flags &= ~LXC_CLONE_SNAPSHOT | LXC_CLONE_MAYBE_SNAPSHOT;
4191 }
4192
4193 c2 = do_lxcapi_clone(c, newname, snappath, flags, NULL, NULL, 0, NULL);
4194 if (!c2) {
4195 ERROR("Failed to clone of %s:%s", c->config_path, c->name);
4196 return -1;
4197 }
4198
4199 lxc_container_put(c2);
4200
4201 /* Now write down the creation time. */
4202 time(&timer);
4203
4204 if (!localtime_r(&timer, &tm_info)) {
4205 ERROR("Failed to get localtime");
4206 return -1;
4207 }
4208
4209 strftime(buffer, 25, "%Y:%m:%d %H:%M:%S", &tm_info);
4210
4211 dfnam = must_realloc(NULL, strlen(snappath) + strlen(newname) + 5);
4212 sprintf(dfnam, "%s/%s/ts", snappath, newname);
4213 f = fopen(dfnam, "w");
4214 if (!f) {
4215 ERROR("Failed to open %s", dfnam);
4216 return -1;
4217 }
4218
4219 if (fprintf(f, "%s", buffer) < 0) {
4220 SYSERROR("Writing timestamp");
4221 fclose(f);
4222 return -1;
4223 }
4224
4225 ret = fclose(f);
4226 if (ret != 0) {
4227 SYSERROR("Writing timestamp");
4228 return -1;
4229 }
4230
4231 if (commentfile) {
4232 __do_free char *path;
4233 /* $p / $name / comment \0 */
4234 int len = strlen(snappath) + strlen(newname) + 10;
4235
4236 path = must_realloc(NULL, len);
4237 sprintf(path, "%s/%s/comment", snappath, newname);
4238 return copy_file(commentfile, path) < 0 ? -1 : i;
4239 }
4240
4241 return i;
4242 }
4243
4244 WRAP_API_1(int, lxcapi_snapshot, const char *)
4245
4246 static void lxcsnap_free(struct lxc_snapshot *s)
4247 {
4248 free(s->name);
4249 free(s->comment_pathname);
4250 free(s->timestamp);
4251 free(s->lxcpath);
4252 }
4253
4254 static char *get_snapcomment_path(char* snappath, char *name)
4255 {
4256 /* $snappath/$name/comment */
4257 int ret, len = strlen(snappath) + strlen(name) + 10;
4258 char *s = malloc(len);
4259
4260 if (s) {
4261 ret = snprintf(s, len, "%s/%s/comment", snappath, name);
4262 if (ret < 0 || ret >= len) {
4263 free(s);
4264 s = NULL;
4265 }
4266 }
4267
4268 return s;
4269 }
4270
4271 static char *get_timestamp(char* snappath, char *name)
4272 {
4273 char path[PATH_MAX], *s = NULL;
4274 int ret, len;
4275 FILE *fin;
4276
4277 ret = snprintf(path, PATH_MAX, "%s/%s/ts", snappath, name);
4278 if (ret < 0 || ret >= PATH_MAX)
4279 return NULL;
4280
4281 fin = fopen(path, "r");
4282 if (!fin)
4283 return NULL;
4284
4285 (void) fseek(fin, 0, SEEK_END);
4286 len = ftell(fin);
4287 (void) fseek(fin, 0, SEEK_SET);
4288 if (len > 0) {
4289 s = malloc(len+1);
4290 if (s) {
4291 s[len] = '\0';
4292 if (fread(s, 1, len, fin) != len) {
4293 SYSERROR("reading timestamp");
4294 free(s);
4295 s = NULL;
4296 }
4297 }
4298 }
4299
4300 fclose(fin);
4301 return s;
4302 }
4303
4304 static int do_lxcapi_snapshot_list(struct lxc_container *c, struct lxc_snapshot **ret_snaps)
4305 {
4306 char snappath[PATH_MAX], path2[PATH_MAX];
4307 int count = 0, ret;
4308 struct dirent *direntp;
4309 struct lxc_snapshot *snaps =NULL, *nsnaps;
4310 DIR *dir;
4311
4312 if (!c || !lxcapi_is_defined(c))
4313 return -1;
4314
4315 if (!get_snappath_dir(c, snappath)) {
4316 ERROR("path name too long");
4317 return -1;
4318 }
4319
4320 dir = opendir(snappath);
4321 if (!dir) {
4322 INFO("Failed to open %s - assuming no snapshots", snappath);
4323 return 0;
4324 }
4325
4326 while ((direntp = readdir(dir))) {
4327 if (!strcmp(direntp->d_name, "."))
4328 continue;
4329
4330 if (!strcmp(direntp->d_name, ".."))
4331 continue;
4332
4333 ret = snprintf(path2, PATH_MAX, "%s/%s/config", snappath, direntp->d_name);
4334 if (ret < 0 || ret >= PATH_MAX) {
4335 ERROR("pathname too long");
4336 goto out_free;
4337 }
4338
4339 if (!file_exists(path2))
4340 continue;
4341
4342 nsnaps = realloc(snaps, (count + 1)*sizeof(*snaps));
4343 if (!nsnaps) {
4344 SYSERROR("Out of memory");
4345 goto out_free;
4346 }
4347
4348 snaps = nsnaps;
4349 snaps[count].free = lxcsnap_free;
4350 snaps[count].name = strdup(direntp->d_name);
4351 if (!snaps[count].name)
4352 goto out_free;
4353
4354 snaps[count].lxcpath = strdup(snappath);
4355 if (!snaps[count].lxcpath) {
4356 free(snaps[count].name);
4357 goto out_free;
4358 }
4359
4360 snaps[count].comment_pathname = get_snapcomment_path(snappath, direntp->d_name);
4361 snaps[count].timestamp = get_timestamp(snappath, direntp->d_name);
4362 count++;
4363 }
4364
4365 if (closedir(dir))
4366 WARN("Failed to close directory");
4367
4368 *ret_snaps = snaps;
4369 return count;
4370
4371 out_free:
4372 if (snaps) {
4373 int i;
4374
4375 for (i=0; i<count; i++)
4376 lxcsnap_free(&snaps[i]);
4377
4378 free(snaps);
4379 }
4380
4381 if (closedir(dir))
4382 WARN("Failed to close directory");
4383
4384 return -1;
4385 }
4386
4387 WRAP_API_1(int, lxcapi_snapshot_list, struct lxc_snapshot **)
4388
4389 static bool do_lxcapi_snapshot_restore(struct lxc_container *c, const char *snapname, const char *newname)
4390 {
4391 char clonelxcpath[PATH_MAX];
4392 int flags = 0;
4393 struct lxc_container *snap, *rest;
4394 struct lxc_storage *bdev;
4395 bool b = false;
4396
4397 if (!c || !c->name || !c->config_path)
4398 return false;
4399
4400 if (has_fs_snapshots(c)) {
4401 ERROR("container rootfs has dependent snapshots");
4402 return false;
4403 }
4404
4405 bdev = storage_init(c->lxc_conf);
4406 if (!bdev) {
4407 ERROR("Failed to find original backing store type");
4408 return false;
4409 }
4410
4411 /* For an overlay container the rootfs is considered immutable
4412 * and cannot be removed when restoring from a snapshot. We pass this
4413 * internal flag along to communicate this to various parts of the
4414 * codebase.
4415 */
4416 if (!strcmp(bdev->type, "overlay") || !strcmp(bdev->type, "overlayfs"))
4417 bdev->flags |= LXC_STORAGE_INTERNAL_OVERLAY_RESTORE;
4418
4419 if (!newname)
4420 newname = c->name;
4421
4422 if (!get_snappath_dir(c, clonelxcpath)) {
4423 storage_put(bdev);
4424 return false;
4425 }
4426 /* how should we lock this? */
4427
4428 snap = lxc_container_new(snapname, clonelxcpath);
4429 if (!snap || !lxcapi_is_defined(snap)) {
4430 ERROR("Could not open snapshot %s", snapname);
4431
4432 if (snap)
4433 lxc_container_put(snap);
4434
4435 storage_put(bdev);
4436 return false;
4437 }
4438
4439 if (!strcmp(c->name, newname)) {
4440 if (!container_destroy(c, bdev)) {
4441 ERROR("Could not destroy existing container %s", newname);
4442 lxc_container_put(snap);
4443 storage_put(bdev);
4444 return false;
4445 }
4446 }
4447
4448 if (strcmp(bdev->type, "dir") != 0 && strcmp(bdev->type, "loop") != 0)
4449 flags = LXC_CLONE_SNAPSHOT | LXC_CLONE_MAYBE_SNAPSHOT;
4450
4451 if (!strcmp(bdev->type, "overlay") || !strcmp(bdev->type, "overlayfs"))
4452 flags |= LXC_STORAGE_INTERNAL_OVERLAY_RESTORE;
4453
4454 rest = lxcapi_clone(snap, newname, c->config_path, flags, bdev->type,
4455 NULL, 0, NULL);
4456 storage_put(bdev);
4457 if (rest && lxcapi_is_defined(rest))
4458 b = true;
4459
4460 if (rest)
4461 lxc_container_put(rest);
4462
4463 lxc_container_put(snap);
4464 return b;
4465 }
4466
4467 WRAP_API_2(bool, lxcapi_snapshot_restore, const char *, const char *)
4468
4469 static bool do_snapshot_destroy(const char *snapname, const char *clonelxcpath)
4470 {
4471 struct lxc_container *snap = NULL;
4472 bool bret = false;
4473
4474 snap = lxc_container_new(snapname, clonelxcpath);
4475 if (!snap) {
4476 ERROR("Could not find snapshot %s", snapname);
4477 goto err;
4478 }
4479
4480 if (!do_lxcapi_destroy(snap)) {
4481 ERROR("Could not destroy snapshot %s", snapname);
4482 goto err;
4483 }
4484
4485 bret = true;
4486
4487 err:
4488 if (snap)
4489 lxc_container_put(snap);
4490
4491 return bret;
4492 }
4493
4494 static bool remove_all_snapshots(const char *path)
4495 {
4496 DIR *dir;
4497 struct dirent *direntp;
4498 bool bret = true;
4499
4500 dir = opendir(path);
4501 if (!dir) {
4502 SYSERROR("opendir on snapshot path %s", path);
4503 return false;
4504 }
4505
4506 while ((direntp = readdir(dir))) {
4507 if (!strcmp(direntp->d_name, "."))
4508 continue;
4509
4510 if (!strcmp(direntp->d_name, ".."))
4511 continue;
4512
4513 if (!do_snapshot_destroy(direntp->d_name, path)) {
4514 bret = false;
4515 continue;
4516 }
4517 }
4518
4519 closedir(dir);
4520
4521 if (rmdir(path))
4522 SYSERROR("Error removing directory %s", path);
4523
4524 return bret;
4525 }
4526
4527 static bool do_lxcapi_snapshot_destroy(struct lxc_container *c, const char *snapname)
4528 {
4529 char clonelxcpath[PATH_MAX];
4530
4531 if (!c || !c->name || !c->config_path || !snapname)
4532 return false;
4533
4534 if (!get_snappath_dir(c, clonelxcpath))
4535 return false;
4536
4537 return do_snapshot_destroy(snapname, clonelxcpath);
4538 }
4539
4540 WRAP_API_1(bool, lxcapi_snapshot_destroy, const char *)
4541
4542 static bool do_lxcapi_snapshot_destroy_all(struct lxc_container *c)
4543 {
4544 char clonelxcpath[PATH_MAX];
4545
4546 if (!c || !c->name || !c->config_path)
4547 return false;
4548
4549 if (!get_snappath_dir(c, clonelxcpath))
4550 return false;
4551
4552 return remove_all_snapshots(clonelxcpath);
4553 }
4554
4555 WRAP_API(bool, lxcapi_snapshot_destroy_all)
4556
4557 static bool do_lxcapi_may_control(struct lxc_container *c)
4558 {
4559 if (!c)
4560 return false;
4561
4562 return lxc_try_cmd(c->name, c->config_path) == 0;
4563 }
4564
4565 WRAP_API(bool, lxcapi_may_control)
4566
4567 static bool do_add_remove_node(pid_t init_pid, const char *path, bool add,
4568 struct stat *st)
4569 {
4570 int ret;
4571 char *tmp;
4572 pid_t pid;
4573 char chrootpath[PATH_MAX];
4574 char *directory_path = NULL;
4575
4576 pid = fork();
4577 if (pid < 0) {
4578 SYSERROR("Failed to fork()");
4579 return false;
4580 }
4581
4582 if (pid) {
4583 ret = wait_for_pid(pid);
4584 if (ret != 0) {
4585 ERROR("Failed to create device node");
4586 return false;
4587 }
4588
4589 return true;
4590 }
4591
4592 /* prepare the path */
4593 ret = snprintf(chrootpath, PATH_MAX, "/proc/%d/root", init_pid);
4594 if (ret < 0 || ret >= PATH_MAX)
4595 return false;
4596
4597 ret = chroot(chrootpath);
4598 if (ret < 0)
4599 _exit(EXIT_FAILURE);
4600
4601 ret = chdir("/");
4602 if (ret < 0)
4603 _exit(EXIT_FAILURE);
4604
4605 /* remove path if it exists */
4606 ret = faccessat(AT_FDCWD, path, F_OK, AT_SYMLINK_NOFOLLOW);
4607 if(ret == 0) {
4608 ret = unlink(path);
4609 if (ret < 0) {
4610 SYSERROR("Failed to remove \"%s\"", path);
4611 _exit(EXIT_FAILURE);
4612 }
4613 }
4614
4615 if (!add)
4616 _exit(EXIT_SUCCESS);
4617
4618 /* create any missing directories */
4619 tmp = strdup(path);
4620 if (!tmp)
4621 _exit(EXIT_FAILURE);
4622
4623 directory_path = dirname(tmp);
4624 ret = mkdir_p(directory_path, 0755);
4625 if (ret < 0 && errno != EEXIST) {
4626 SYSERROR("Failed to create path \"%s\"", directory_path);
4627 free(tmp);
4628 _exit(EXIT_FAILURE);
4629 }
4630
4631 /* create the device node */
4632 ret = mknod(path, st->st_mode, st->st_rdev);
4633 free(tmp);
4634 if (ret < 0) {
4635 SYSERROR("Failed to create device node at \"%s\"", path);
4636 _exit(EXIT_FAILURE);
4637 }
4638
4639 _exit(EXIT_SUCCESS);
4640 }
4641
4642 static bool add_remove_device_node(struct lxc_container *c, const char *src_path, const char *dest_path, bool add)
4643 {
4644 int ret;
4645 struct stat st;
4646 char value[LXC_MAX_BUFFER];
4647 const char *p;
4648
4649 /* make sure container is running */
4650 if (!do_lxcapi_is_running(c)) {
4651 ERROR("container is not running");
4652 return false;
4653 }
4654
4655 /* use src_path if dest_path is NULL otherwise use dest_path */
4656 p = dest_path ? dest_path : src_path;
4657
4658 /* make sure we can access p */
4659 if(access(p, F_OK) < 0 || stat(p, &st) < 0)
4660 return false;
4661
4662 /* continue if path is character device or block device */
4663 if (S_ISCHR(st.st_mode))
4664 ret = snprintf(value, LXC_MAX_BUFFER, "c %d:%d rwm", major(st.st_rdev), minor(st.st_rdev));
4665 else if (S_ISBLK(st.st_mode))
4666 ret = snprintf(value, LXC_MAX_BUFFER, "b %d:%d rwm", major(st.st_rdev), minor(st.st_rdev));
4667 else
4668 return false;
4669
4670 /* check snprintf return code */
4671 if (ret < 0 || ret >= LXC_MAX_BUFFER)
4672 return false;
4673
4674 if (!do_add_remove_node(do_lxcapi_init_pid(c), p, add, &st))
4675 return false;
4676
4677 /* add or remove device to/from cgroup access list */
4678 if (add) {
4679 if (!do_lxcapi_set_cgroup_item(c, "devices.allow", value)) {
4680 ERROR("set_cgroup_item failed while adding the device node");
4681 return false;
4682 }
4683 } else {
4684 if (!do_lxcapi_set_cgroup_item(c, "devices.deny", value)) {
4685 ERROR("set_cgroup_item failed while removing the device node");
4686 return false;
4687 }
4688 }
4689
4690 return true;
4691 }
4692
4693 static bool do_lxcapi_add_device_node(struct lxc_container *c, const char *src_path, const char *dest_path)
4694 {
4695 // cannot mknod if we're not privileged wrt init_user_ns
4696 if (am_host_unpriv()) {
4697 ERROR(LXC_UNPRIV_EOPNOTSUPP, __FUNCTION__);
4698 return false;
4699 }
4700
4701 return add_remove_device_node(c, src_path, dest_path, true);
4702 }
4703
4704 WRAP_API_2(bool, lxcapi_add_device_node, const char *, const char *)
4705
4706 static bool do_lxcapi_remove_device_node(struct lxc_container *c, const char *src_path, const char *dest_path)
4707 {
4708 if (am_guest_unpriv()) {
4709 ERROR(LXC_UNPRIV_EOPNOTSUPP, __FUNCTION__);
4710 return false;
4711 }
4712
4713 return add_remove_device_node(c, src_path, dest_path, false);
4714 }
4715
4716 WRAP_API_2(bool, lxcapi_remove_device_node, const char *, const char *)
4717
4718 static bool do_lxcapi_attach_interface(struct lxc_container *c,
4719 const char *ifname,
4720 const char *dst_ifname)
4721 {
4722 pid_t init_pid;
4723 int ret = 0;
4724
4725 if (am_guest_unpriv()) {
4726 ERROR(LXC_UNPRIV_EOPNOTSUPP, __FUNCTION__);
4727 return false;
4728 }
4729
4730 if (!ifname) {
4731 ERROR("No source interface name given");
4732 return false;
4733 }
4734
4735 ret = lxc_netdev_isup(ifname);
4736 if (ret > 0) {
4737 /* netdev of ifname is up. */
4738 ret = lxc_netdev_down(ifname);
4739 if (ret)
4740 goto err;
4741 }
4742
4743 init_pid = do_lxcapi_init_pid(c);
4744 ret = lxc_netdev_move_by_name(ifname, init_pid, dst_ifname);
4745 if (ret)
4746 goto err;
4747
4748 INFO("Moved network device \"%s\" to network namespace of %d", ifname, init_pid);
4749 return true;
4750
4751 err:
4752 return false;
4753 }
4754
4755 WRAP_API_2(bool, lxcapi_attach_interface, const char *, const char *)
4756
4757 static bool do_lxcapi_detach_interface(struct lxc_container *c,
4758 const char *ifname,
4759 const char *dst_ifname)
4760 {
4761 int ret;
4762 pid_t pid, pid_outside;
4763
4764 /*
4765 * TODO - if this is a physical device, then we need am_host_unpriv.
4766 * But for other types guest privilege suffices.
4767 */
4768 if (am_guest_unpriv()) {
4769 ERROR(LXC_UNPRIV_EOPNOTSUPP, __FUNCTION__);
4770 return false;
4771 }
4772
4773 if (!ifname) {
4774 ERROR("No source interface name given");
4775 return false;
4776 }
4777
4778 pid_outside = lxc_raw_getpid();
4779 pid = fork();
4780 if (pid < 0) {
4781 ERROR("Failed to fork");
4782 return false;
4783 }
4784
4785 if (pid == 0) { /* child */
4786 pid_t init_pid;
4787
4788 init_pid = do_lxcapi_init_pid(c);
4789 if (!switch_to_ns(init_pid, "net")) {
4790 ERROR("Failed to enter network namespace");
4791 _exit(EXIT_FAILURE);
4792 }
4793
4794 ret = lxc_netdev_isup(ifname);
4795 if (ret < 0) {
4796 ERROR("Failed to determine whether network device \"%s\" is up", ifname);
4797 _exit(EXIT_FAILURE);
4798 }
4799
4800 /* netdev of ifname is up. */
4801 if (ret) {
4802 ret = lxc_netdev_down(ifname);
4803 if (ret) {
4804 ERROR("Failed to set network device \"%s\" down", ifname);
4805 _exit(EXIT_FAILURE);
4806 }
4807 }
4808
4809 ret = lxc_netdev_move_by_name(ifname, pid_outside, dst_ifname);
4810 /* -EINVAL means there is no netdev named as ifname. */
4811 if (ret < 0) {
4812 if (ret == -EINVAL)
4813 ERROR("Network device \"%s\" not found", ifname);
4814 else
4815 ERROR("Failed to remove network device \"%s\"", ifname);
4816
4817 _exit(EXIT_FAILURE);
4818 }
4819
4820 _exit(EXIT_SUCCESS);
4821 }
4822
4823 ret = wait_for_pid(pid);
4824 if (ret != 0)
4825 return false;
4826
4827 INFO("Moved network device \"%s\" to network namespace of %d", ifname, pid_outside);
4828 return true;
4829 }
4830
4831 WRAP_API_2(bool, lxcapi_detach_interface, const char *, const char *)
4832
4833 static int do_lxcapi_migrate(struct lxc_container *c, unsigned int cmd,
4834 struct migrate_opts *opts, unsigned int size)
4835 {
4836 int ret = -1;
4837 struct migrate_opts *valid_opts = opts;
4838 uint64_t features_to_check = 0;
4839
4840 /* If the caller has a bigger (newer) struct migrate_opts, let's make
4841 * sure that the stuff on the end is zero, i.e. that they didn't ask us
4842 * to do anything special.
4843 */
4844 if (size > sizeof(*opts)) {
4845 unsigned char *addr;
4846 unsigned char *end;
4847
4848 addr = (void *)opts + sizeof(*opts);
4849 end = (void *)opts + size;
4850
4851 for (; addr < end; addr++)
4852 if (*addr)
4853 return -E2BIG;
4854 }
4855
4856 /* If the caller has a smaller struct, let's zero out the end for them
4857 * so we don't accidentally use bits of it that they didn't know about
4858 * to initialize.
4859 */
4860 if (size < sizeof(*opts)) {
4861 valid_opts = malloc(sizeof(*opts));
4862 if (!valid_opts)
4863 return -ENOMEM;
4864
4865 memset(valid_opts, 0, sizeof(*opts));
4866 memcpy(valid_opts, opts, size);
4867 }
4868
4869 switch (cmd) {
4870 case MIGRATE_PRE_DUMP:
4871 if (!do_lxcapi_is_running(c)) {
4872 ERROR("container is not running");
4873 goto on_error;
4874 }
4875
4876 ret = !__criu_pre_dump(c, valid_opts);
4877 break;
4878 case MIGRATE_DUMP:
4879 if (!do_lxcapi_is_running(c)) {
4880 ERROR("container is not running");
4881 goto on_error;
4882 }
4883
4884 ret = !__criu_dump(c, valid_opts);
4885 break;
4886 case MIGRATE_RESTORE:
4887 if (do_lxcapi_is_running(c)) {
4888 ERROR("container is already running");
4889 goto on_error;
4890 }
4891
4892 ret = !__criu_restore(c, valid_opts);
4893 break;
4894 case MIGRATE_FEATURE_CHECK:
4895 features_to_check = valid_opts->features_to_check;
4896 ret = !__criu_check_feature(&features_to_check);
4897 if (ret) {
4898 /* Something went wrong. Let's let the caller
4899 * know which feature checks failed. */
4900 valid_opts->features_to_check = features_to_check;
4901 }
4902 break;
4903 default:
4904 ERROR("invalid migrate command %u", cmd);
4905 ret = -EINVAL;
4906 }
4907
4908 on_error:
4909 if (size < sizeof(*opts))
4910 free(valid_opts);
4911
4912 return ret;
4913 }
4914
4915 WRAP_API_3(int, lxcapi_migrate, unsigned int, struct migrate_opts *, unsigned int)
4916
4917 static bool do_lxcapi_checkpoint(struct lxc_container *c, char *directory, bool stop, bool verbose)
4918 {
4919 struct migrate_opts opts;
4920
4921 memset(&opts, 0, sizeof(opts));
4922
4923 opts.directory = directory;
4924 opts.stop = stop;
4925 opts.verbose = verbose;
4926
4927 return !do_lxcapi_migrate(c, MIGRATE_DUMP, &opts, sizeof(opts));
4928 }
4929
4930 WRAP_API_3(bool, lxcapi_checkpoint, char *, bool, bool)
4931
4932 static bool do_lxcapi_restore(struct lxc_container *c, char *directory, bool verbose)
4933 {
4934 struct migrate_opts opts;
4935
4936 memset(&opts, 0, sizeof(opts));
4937
4938 opts.directory = directory;
4939 opts.verbose = verbose;
4940
4941 return !do_lxcapi_migrate(c, MIGRATE_RESTORE, &opts, sizeof(opts));
4942 }
4943
4944 WRAP_API_2(bool, lxcapi_restore, char *, bool)
4945
4946 /* @st_mode is the st_mode field of the stat(source) return struct */
4947 static int create_mount_target(const char *dest, mode_t st_mode)
4948 {
4949 char *dirdup, *destdirname;
4950 int ret;
4951
4952 dirdup = strdup(dest);
4953 if (!dirdup) {
4954 SYSERROR("Failed to duplicate target name \"%s\"", dest);
4955 return -1;
4956 }
4957 destdirname = dirname(dirdup);
4958
4959 ret = mkdir_p(destdirname, 0755);
4960 if (ret < 0) {
4961 SYSERROR("Failed to create \"%s\"", destdirname);
4962 free(dirdup);
4963 return ret;
4964 }
4965 free(dirdup);
4966
4967 (void)remove(dest);
4968
4969 if (S_ISDIR(st_mode))
4970 ret = mkdir(dest, 0000);
4971 else
4972 ret = mknod(dest, S_IFREG | 0000, 0);
4973 if (ret < 0) {
4974 SYSERROR("Failed to create mount target \"%s\"", dest);
4975 return -1;
4976 }
4977
4978 return 0;
4979 }
4980
4981 static int do_lxcapi_mount(struct lxc_container *c, const char *source,
4982 const char *target, const char *filesystemtype,
4983 unsigned long mountflags, const void *data,
4984 struct lxc_mount *mnt)
4985 {
4986 char *suff, *sret;
4987 char template[PATH_MAX], path[PATH_MAX];
4988 pid_t pid, init_pid;
4989 struct stat sb;
4990 bool is_dir;
4991 int ret = -1, fd = -EBADF;
4992
4993 if (!c || !c->lxc_conf) {
4994 ERROR("Container or configuration is NULL");
4995 return -EINVAL;
4996 }
4997
4998 if (!c->lxc_conf->shmount.path_host) {
4999 ERROR("Host path to shared mountpoint must be specified in the config\n");
5000 return -EINVAL;
5001 }
5002
5003 ret = snprintf(template, sizeof(template), "%s/.lxcmount_XXXXXX", c->lxc_conf->shmount.path_host);
5004 if (ret < 0 || (size_t)ret >= sizeof(template)) {
5005 SYSERROR("Error writing shmounts tempdir name");
5006 goto out;
5007 }
5008
5009 /* Create a temporary file / dir under the shared mountpoint */
5010 if (!source || strcmp(source, "") == 0) {
5011 /* If source is not specified, maybe we want to mount a filesystem? */
5012 sb.st_mode = S_IFDIR;
5013 } else {
5014 ret = stat(source, &sb);
5015 if (ret < 0) {
5016 SYSERROR("Error getting stat info about the source \"%s\"", source);
5017 goto out;
5018 }
5019 }
5020
5021 is_dir = (S_ISDIR(sb.st_mode) != 0);
5022 if (is_dir) {
5023 sret = mkdtemp(template);
5024 if (!sret) {
5025 SYSERROR("Could not create shmounts temporary dir");
5026 goto out;
5027 }
5028 } else {
5029 fd = lxc_make_tmpfile(template, false);
5030 if (fd < 0) {
5031 SYSERROR("Could not create shmounts temporary file");
5032 goto out;
5033 }
5034 }
5035
5036 /* Do the fork */
5037 pid = fork();
5038 if (pid < 0) {
5039 SYSERROR("Could not fork");
5040 goto out;
5041 }
5042
5043 if (pid == 0) {
5044 /* Do the mount */
5045 ret = mount(source, template, filesystemtype, mountflags, data);
5046 if (ret < 0) {
5047 SYSERROR("Failed to mount onto \"%s\"", template);
5048 _exit(EXIT_FAILURE);
5049 }
5050 TRACE("Mounted \"%s\" onto \"%s\"", source, template);
5051
5052 init_pid = do_lxcapi_init_pid(c);
5053 if (init_pid < 0) {
5054 ERROR("Failed to obtain container's init pid");
5055 _exit(EXIT_FAILURE);
5056 }
5057
5058 /* Enter the container namespaces */
5059 if (!lxc_list_empty(&c->lxc_conf->id_map)) {
5060 if (!switch_to_ns(init_pid, "user")) {
5061 ERROR("Failed to enter user namespace");
5062 _exit(EXIT_FAILURE);
5063 }
5064
5065 if (!lxc_switch_uid_gid(0, 0))
5066 _exit(EXIT_FAILURE);
5067 }
5068
5069 if (!switch_to_ns(init_pid, "mnt")) {
5070 ERROR("Failed to enter mount namespace");
5071 _exit(EXIT_FAILURE);
5072 }
5073
5074 ret = create_mount_target(target, sb.st_mode);
5075 if (ret < 0)
5076 _exit(EXIT_FAILURE);
5077 TRACE("Created mount target \"%s\"", target);
5078
5079 suff = strrchr(template, '/');
5080 if (!suff)
5081 _exit(EXIT_FAILURE);
5082
5083 ret = snprintf(path, sizeof(path), "%s%s", c->lxc_conf->shmount.path_cont, suff);
5084 if (ret < 0 || (size_t)ret >= sizeof(path)) {
5085 SYSERROR("Error writing container mountpoint name");
5086 _exit(EXIT_FAILURE);
5087 }
5088
5089 ret = mount(path, target, NULL, MS_MOVE | MS_REC, NULL);
5090 if (ret < 0) {
5091 SYSERROR("Failed to move the mount from \"%s\" to \"%s\"", path, target);
5092 _exit(EXIT_FAILURE);
5093 }
5094 TRACE("Moved mount from \"%s\" to \"%s\"", path, target);
5095
5096 _exit(EXIT_SUCCESS);
5097 }
5098
5099 ret = wait_for_pid(pid);
5100 if (ret < 0) {
5101 SYSERROR("Wait for the child with pid %ld failed", (long) pid);
5102 goto out;
5103 }
5104
5105 ret = 0;
5106
5107 (void)umount2(template, MNT_DETACH);
5108 if (is_dir)
5109 (void)rmdir(template);
5110 else
5111 (void)unlink(template);
5112
5113 out:
5114 if (fd >= 0)
5115 close(fd);
5116
5117 return ret;
5118 }
5119
5120 WRAP_API_6(int, lxcapi_mount, const char *, const char *, const char *,
5121 unsigned long, const void *, struct lxc_mount *)
5122
5123 static int do_lxcapi_umount(struct lxc_container *c, const char *target,
5124 unsigned long flags, struct lxc_mount *mnt)
5125 {
5126 pid_t pid, init_pid;
5127 int ret = -1;
5128
5129 if (!c || !c->lxc_conf) {
5130 ERROR("Container or configuration is NULL");
5131 return -EINVAL;
5132 }
5133
5134 /* Do the fork */
5135 pid = fork();
5136 if (pid < 0) {
5137 SYSERROR("Could not fork");
5138 return -1;
5139 }
5140
5141 if (pid == 0) {
5142 init_pid = do_lxcapi_init_pid(c);
5143 if (init_pid < 0) {
5144 ERROR("Failed to obtain container's init pid");
5145 _exit(EXIT_FAILURE);
5146 }
5147
5148 /* Enter the container namespaces */
5149 if (!lxc_list_empty(&c->lxc_conf->id_map)) {
5150 if (!switch_to_ns(init_pid, "user")) {
5151 ERROR("Failed to enter user namespace");
5152 _exit(EXIT_FAILURE);
5153 }
5154 }
5155
5156 if (!switch_to_ns(init_pid, "mnt")) {
5157 ERROR("Failed to enter mount namespace");
5158 _exit(EXIT_FAILURE);
5159 }
5160
5161 /* Do the unmount */
5162 ret = umount2(target, flags);
5163 if (ret < 0) {
5164 SYSERROR("Failed to umount \"%s\"", target);
5165 _exit(EXIT_FAILURE);
5166 }
5167
5168 _exit(EXIT_SUCCESS);
5169 }
5170
5171 ret = wait_for_pid(pid);
5172 if (ret < 0) {
5173 SYSERROR("Wait for the child with pid %ld failed", (long)pid);
5174 return -ret;
5175 }
5176
5177 return 0;
5178 }
5179
5180 WRAP_API_3(int, lxcapi_umount, const char *, unsigned long, struct lxc_mount*)
5181
5182 static int lxcapi_attach_run_waitl(struct lxc_container *c, lxc_attach_options_t *options, const char *program, const char *arg, ...)
5183 {
5184 va_list ap;
5185 const char **argv;
5186 int ret;
5187
5188 if (!c)
5189 return -1;
5190
5191 current_config = c->lxc_conf;
5192
5193 va_start(ap, arg);
5194 argv = lxc_va_arg_list_to_argv_const(ap, 1);
5195 va_end(ap);
5196
5197 if (!argv) {
5198 ERROR("Memory allocation error.");
5199 ret = -1;
5200 goto out;
5201 }
5202 argv[0] = arg;
5203
5204 ret = do_lxcapi_attach_run_wait(c, options, program, (const char * const *)argv);
5205 free((void*)argv);
5206
5207 out:
5208 current_config = NULL;
5209 return ret;
5210 }
5211
5212 struct lxc_container *lxc_container_new(const char *name, const char *configpath)
5213 {
5214 struct lxc_container *c;
5215 size_t len;
5216
5217 if (!name)
5218 return NULL;
5219
5220 c = malloc(sizeof(*c));
5221 if (!c) {
5222 fprintf(stderr, "Failed to allocate memory for %s\n", name);
5223 return NULL;
5224 }
5225 memset(c, 0, sizeof(*c));
5226
5227 if (configpath)
5228 c->config_path = strdup(configpath);
5229 else
5230 c->config_path = strdup(lxc_global_config_value("lxc.lxcpath"));
5231 if (!c->config_path) {
5232 fprintf(stderr, "Failed to allocate memory for %s\n", name);
5233 goto err;
5234 }
5235
5236 remove_trailing_slashes(c->config_path);
5237
5238 len = strlen(name);
5239 c->name = malloc(len + 1);
5240 if (!c->name) {
5241 fprintf(stderr, "Failed to allocate memory for %s\n", name);
5242 goto err;
5243 }
5244 (void)strlcpy(c->name, name, len + 1);
5245
5246 c->numthreads = 1;
5247 c->slock = lxc_newlock(c->config_path, name);
5248 if (!c->slock) {
5249 fprintf(stderr, "Failed to create lock for %s\n", name);
5250 goto err;
5251 }
5252
5253 c->privlock = lxc_newlock(NULL, NULL);
5254 if (!c->privlock) {
5255 fprintf(stderr, "Failed to create private lock for %s\n", name);
5256 goto err;
5257 }
5258
5259 if (!set_config_filename(c)) {
5260 fprintf(stderr, "Failed to create config file name for %s\n", name);
5261 goto err;
5262 }
5263
5264 if (file_exists(c->configfile) && !lxcapi_load_config(c, NULL)) {
5265 fprintf(stderr, "Failed to load config for %s\n", name);
5266 goto err;
5267 }
5268
5269 if (ongoing_create(c) == 2) {
5270 ERROR("Failed to complete container creation for %s", c->name);
5271 container_destroy(c, NULL);
5272 lxcapi_clear_config(c);
5273 }
5274
5275 c->daemonize = true;
5276 c->pidfile = NULL;
5277
5278 /* Assign the member functions. */
5279 c->is_defined = lxcapi_is_defined;
5280 c->state = lxcapi_state;
5281 c->is_running = lxcapi_is_running;
5282 c->freeze = lxcapi_freeze;
5283 c->unfreeze = lxcapi_unfreeze;
5284 c->console = lxcapi_console;
5285 c->console_getfd = lxcapi_console_getfd;
5286 c->init_pid = lxcapi_init_pid;
5287 c->load_config = lxcapi_load_config;
5288 c->want_daemonize = lxcapi_want_daemonize;
5289 c->want_close_all_fds = lxcapi_want_close_all_fds;
5290 c->start = lxcapi_start;
5291 c->startl = lxcapi_startl;
5292 c->stop = lxcapi_stop;
5293 c->config_file_name = lxcapi_config_file_name;
5294 c->wait = lxcapi_wait;
5295 c->set_config_item = lxcapi_set_config_item;
5296 c->destroy = lxcapi_destroy;
5297 c->destroy_with_snapshots = lxcapi_destroy_with_snapshots;
5298 c->rename = lxcapi_rename;
5299 c->save_config = lxcapi_save_config;
5300 c->get_keys = lxcapi_get_keys;
5301 c->create = lxcapi_create;
5302 c->createl = lxcapi_createl;
5303 c->shutdown = lxcapi_shutdown;
5304 c->reboot = lxcapi_reboot;
5305 c->reboot2 = lxcapi_reboot2;
5306 c->clear_config = lxcapi_clear_config;
5307 c->clear_config_item = lxcapi_clear_config_item;
5308 c->get_config_item = lxcapi_get_config_item;
5309 c->get_running_config_item = lxcapi_get_running_config_item;
5310 c->get_cgroup_item = lxcapi_get_cgroup_item;
5311 c->set_cgroup_item = lxcapi_set_cgroup_item;
5312 c->get_config_path = lxcapi_get_config_path;
5313 c->set_config_path = lxcapi_set_config_path;
5314 c->clone = lxcapi_clone;
5315 c->get_interfaces = lxcapi_get_interfaces;
5316 c->get_ips = lxcapi_get_ips;
5317 c->attach = lxcapi_attach;
5318 c->attach_run_wait = lxcapi_attach_run_wait;
5319 c->attach_run_waitl = lxcapi_attach_run_waitl;
5320 c->snapshot = lxcapi_snapshot;
5321 c->snapshot_list = lxcapi_snapshot_list;
5322 c->snapshot_restore = lxcapi_snapshot_restore;
5323 c->snapshot_destroy = lxcapi_snapshot_destroy;
5324 c->snapshot_destroy_all = lxcapi_snapshot_destroy_all;
5325 c->may_control = lxcapi_may_control;
5326 c->add_device_node = lxcapi_add_device_node;
5327 c->remove_device_node = lxcapi_remove_device_node;
5328 c->attach_interface = lxcapi_attach_interface;
5329 c->detach_interface = lxcapi_detach_interface;
5330 c->checkpoint = lxcapi_checkpoint;
5331 c->restore = lxcapi_restore;
5332 c->migrate = lxcapi_migrate;
5333 c->console_log = lxcapi_console_log;
5334 c->mount = lxcapi_mount;
5335 c->umount = lxcapi_umount;
5336
5337 return c;
5338
5339 err:
5340 lxc_container_free(c);
5341 return NULL;
5342 }
5343
5344 int lxc_get_wait_states(const char **states)
5345 {
5346 int i;
5347
5348 if (states)
5349 for (i=0; i<MAX_STATE; i++)
5350 states[i] = lxc_state2str(i);
5351
5352 return MAX_STATE;
5353 }
5354
5355 /*
5356 * These next two could probably be done smarter with reusing a common function
5357 * with different iterators and tests...
5358 */
5359 int list_defined_containers(const char *lxcpath, char ***names, struct lxc_container ***cret)
5360 {
5361 DIR *dir;
5362 int i, cfound = 0, nfound = 0;
5363 struct dirent *direntp;
5364 struct lxc_container *c;
5365
5366 if (!lxcpath)
5367 lxcpath = lxc_global_config_value("lxc.lxcpath");
5368
5369 dir = opendir(lxcpath);
5370 if (!dir) {
5371 SYSERROR("opendir on lxcpath");
5372 return -1;
5373 }
5374
5375 if (cret)
5376 *cret = NULL;
5377
5378 if (names)
5379 *names = NULL;
5380
5381 while ((direntp = readdir(dir))) {
5382 /* Ignore '.', '..' and any hidden directory. */
5383 if (!strncmp(direntp->d_name, ".", 1))
5384 continue;
5385
5386 if (!config_file_exists(lxcpath, direntp->d_name))
5387 continue;
5388
5389 if (names)
5390 if (!add_to_array(names, direntp->d_name, cfound))
5391 goto free_bad;
5392
5393 cfound++;
5394
5395 if (!cret) {
5396 nfound++;
5397 continue;
5398 }
5399
5400 c = lxc_container_new(direntp->d_name, lxcpath);
5401 if (!c) {
5402 INFO("Container %s:%s has a config but could not be loaded",
5403 lxcpath, direntp->d_name);
5404
5405 if (names)
5406 if(!remove_from_array(names, direntp->d_name, cfound--))
5407 goto free_bad;
5408
5409 continue;
5410 }
5411
5412 if (!do_lxcapi_is_defined(c)) {
5413 INFO("Container %s:%s has a config but is not defined",
5414 lxcpath, direntp->d_name);
5415
5416 if (names)
5417 if(!remove_from_array(names, direntp->d_name, cfound--))
5418 goto free_bad;
5419
5420 lxc_container_put(c);
5421 continue;
5422 }
5423
5424 if (!add_to_clist(cret, c, nfound, true)) {
5425 lxc_container_put(c);
5426 goto free_bad;
5427 }
5428
5429 nfound++;
5430 }
5431
5432 closedir(dir);
5433 return nfound;
5434
5435 free_bad:
5436 if (names && *names) {
5437 for (i=0; i<cfound; i++)
5438 free((*names)[i]);
5439 free(*names);
5440 }
5441
5442 if (cret && *cret) {
5443 for (i=0; i<nfound; i++)
5444 lxc_container_put((*cret)[i]);
5445 free(*cret);
5446 }
5447
5448 closedir(dir);
5449 return -1;
5450 }
5451
5452 int list_active_containers(const char *lxcpath, char ***nret,
5453 struct lxc_container ***cret)
5454 {
5455 int i, ret = -1, cret_cnt = 0, ct_name_cnt = 0;
5456 int lxcpath_len;
5457 char *line = NULL;
5458 char **ct_name = NULL;
5459 size_t len = 0;
5460 struct lxc_container *c = NULL;
5461 bool is_hashed;
5462
5463 if (!lxcpath)
5464 lxcpath = lxc_global_config_value("lxc.lxcpath");
5465 lxcpath_len = strlen(lxcpath);
5466
5467 if (cret)
5468 *cret = NULL;
5469
5470 if (nret)
5471 *nret = NULL;
5472
5473 FILE *f = fopen("/proc/net/unix", "r");
5474 if (!f)
5475 return -1;
5476
5477 while (getline(&line, &len, f) != -1) {
5478 char *p = strrchr(line, ' '), *p2;
5479 if (!p)
5480 continue;
5481 p++;
5482
5483 if (*p != 0x40)
5484 continue;
5485 p++;
5486
5487 is_hashed = false;
5488
5489 if (strncmp(p, lxcpath, lxcpath_len) == 0) {
5490 p += lxcpath_len;
5491 } else if (strncmp(p, "lxc/", 4) == 0) {
5492 p += 4;
5493 is_hashed = true;
5494 } else {
5495 continue;
5496 }
5497
5498 while (*p == '/')
5499 p++;
5500
5501 /* Now p is the start of lxc_name. */
5502 p2 = strchr(p, '/');
5503 if (!p2 || strncmp(p2, "/command", 8) != 0)
5504 continue;
5505 *p2 = '\0';
5506
5507 if (is_hashed) {
5508 char *recvpath = lxc_cmd_get_lxcpath(p);
5509 if (!recvpath)
5510 continue;
5511
5512 if (strncmp(lxcpath, recvpath, lxcpath_len) != 0) {
5513 free(recvpath);
5514 continue;
5515 }
5516 free(recvpath);
5517
5518 p = lxc_cmd_get_name(p);
5519 if (!p)
5520 continue;
5521 }
5522
5523 if (array_contains(&ct_name, p, ct_name_cnt)) {
5524 if (is_hashed)
5525 free(p);
5526 continue;
5527 }
5528
5529 if (!add_to_array(&ct_name, p, ct_name_cnt)) {
5530 if (is_hashed)
5531 free(p);
5532 goto free_cret_list;
5533 }
5534
5535 ct_name_cnt++;
5536
5537 if (!cret) {
5538 if (is_hashed)
5539 free(p);
5540 continue;
5541 }
5542
5543 c = lxc_container_new(p, lxcpath);
5544 if (!c) {
5545 INFO("Container %s:%s is running but could not be loaded",
5546 lxcpath, p);
5547
5548 remove_from_array(&ct_name, p, ct_name_cnt--);
5549 if (is_hashed)
5550 free(p);
5551
5552 continue;
5553 }
5554
5555 if (is_hashed)
5556 free(p);
5557
5558 /*
5559 * If this is an anonymous container, then is_defined *can*
5560 * return false. So we don't do that check. Count on the
5561 * fact that the command socket exists.
5562 */
5563
5564 if (!add_to_clist(cret, c, cret_cnt, true)) {
5565 lxc_container_put(c);
5566 goto free_cret_list;
5567 }
5568
5569 cret_cnt++;
5570 }
5571
5572 if (nret && cret && cret_cnt != ct_name_cnt) {
5573 if (c)
5574 lxc_container_put(c);
5575 goto free_cret_list;
5576 }
5577
5578 ret = ct_name_cnt;
5579 if (nret)
5580 *nret = ct_name;
5581 else
5582 goto free_ct_name;
5583
5584 goto out;
5585
5586 free_cret_list:
5587 if (cret && *cret) {
5588 for (i = 0; i < cret_cnt; i++)
5589 lxc_container_put((*cret)[i]);
5590 free(*cret);
5591 }
5592
5593 free_ct_name:
5594 if (ct_name) {
5595 for (i = 0; i < ct_name_cnt; i++)
5596 free(ct_name[i]);
5597 free(ct_name);
5598 }
5599
5600 out:
5601 free(line);
5602 fclose(f);
5603 return ret;
5604 }
5605
5606 int list_all_containers(const char *lxcpath, char ***nret,
5607 struct lxc_container ***cret)
5608 {
5609 int i, ret, active_cnt, ct_cnt, ct_list_cnt;
5610 char **active_name;
5611 char **ct_name;
5612 struct lxc_container **ct_list = NULL;
5613
5614 ct_cnt = list_defined_containers(lxcpath, &ct_name, NULL);
5615 if (ct_cnt < 0)
5616 return ct_cnt;
5617
5618 active_cnt = list_active_containers(lxcpath, &active_name, NULL);
5619 if (active_cnt < 0) {
5620 ret = active_cnt;
5621 goto free_ct_name;
5622 }
5623
5624 for (i = 0; i < active_cnt; i++) {
5625 if (!array_contains(&ct_name, active_name[i], ct_cnt)) {
5626 if (!add_to_array(&ct_name, active_name[i], ct_cnt)) {
5627 ret = -1;
5628 goto free_active_name;
5629 }
5630
5631 ct_cnt++;
5632 }
5633
5634 free(active_name[i]);
5635 active_name[i] = NULL;
5636 }
5637
5638 free(active_name);
5639 active_name = NULL;
5640 active_cnt = 0;
5641
5642 for (i = 0, ct_list_cnt = 0; i < ct_cnt && cret; i++) {
5643 struct lxc_container *c;
5644
5645 c = lxc_container_new(ct_name[i], lxcpath);
5646 if (!c) {
5647 WARN("Container %s:%s could not be loaded", lxcpath, ct_name[i]);
5648 remove_from_array(&ct_name, ct_name[i], ct_cnt--);
5649 continue;
5650 }
5651
5652 if (!add_to_clist(&ct_list, c, ct_list_cnt, false)) {
5653 lxc_container_put(c);
5654 ret = -1;
5655 goto free_ct_list;
5656 }
5657
5658 ct_list_cnt++;
5659 }
5660
5661 if (cret)
5662 *cret = ct_list;
5663
5664 if (nret) {
5665 *nret = ct_name;
5666 } else {
5667 ret = ct_cnt;
5668 goto free_ct_name;
5669 }
5670
5671 return ct_cnt;
5672
5673 free_ct_list:
5674 for (i = 0; i < ct_list_cnt; i++) {
5675 lxc_container_put(ct_list[i]);
5676 }
5677 free(ct_list);
5678
5679 free_active_name:
5680 for (i = 0; i < active_cnt; i++) {
5681 free(active_name[i]);
5682 }
5683 free(active_name);
5684
5685 free_ct_name:
5686 for (i = 0; i < ct_cnt; i++) {
5687 free(ct_name[i]);
5688 }
5689 free(ct_name);
5690 return ret;
5691 }
5692
5693 bool lxc_config_item_is_supported(const char *key)
5694 {
5695 return !!lxc_get_config(key);
5696 }
5697
5698 bool lxc_has_api_extension(const char *extension)
5699 {
5700 /* The NULL API extension is always present. :) */
5701 if (!extension)
5702 return true;
5703
5704 for (size_t i = 0; i < nr_api_extensions; i++)
5705 if (strcmp(api_extensions[i], extension) == 0)
5706 return true;
5707
5708 return false;
5709 }
LXC mirror