Merge pull request #3059 from brauner/2019-06-21/seccomp_notify

[mirror_lxc.git] / src / lxc / lxccontainer.c

diff --git a/src/lxc/lxccontainer.c b/src/lxc/lxccontainer.c
index cea8aa5d7bbb13a6903e869a7e6e6601192721d7..57a7adeced730cd4281a60ca2673a9a2940f53d8 100644 (file)
--- a/src/lxc/lxccontainer.c
+++ b/src/lxc/lxccontainer.c
@@ -79,6 +79,10 @@
 #include "utils.h"
 #include "version.h"
 
+#if HAVE_OPENSSL
+#include <openssl/evp.h>
+#endif
+
 /* major()/minor() */
 #ifdef MAJOR_IN_MKDEV
 #include <sys/mkdev.h>
@@ -1300,6 +1304,7 @@ static struct lxc_storage *do_storage_create(struct lxc_container *c,
 
        if (!c->set_config_item(c, "lxc.rootfs.path", bdev->src)) {
                ERROR("Failed to set \"lxc.rootfs.path = %s\"", bdev->src);
+               storage_put(bdev);
                return NULL;
        }
 
@@ -1320,12 +1325,13 @@ static struct lxc_storage *do_storage_create(struct lxc_container *c,
        return bdev;
 }
 
-static char *lxcbasename(char *path)
+/* Strip path and return name of file for argv[0] passed to execvp */
+static char *lxctemplatefilename(char *tpath)
 {
        char *p;
 
-       p = path + strlen(path) - 1;
-       while (*p != '/' && p > path)
+       p = tpath + strlen(tpath) - 1;
+       while ( (p-1) >= tpath && *(p-1) != '/')
                p--;
 
        return p;
@@ -1451,7 +1457,7 @@ static bool create_run_template(struct lxc_container *c, char *tpath,
                newargv = malloc(nargs * sizeof(*newargv));
                if (!newargv)
                        _exit(EXIT_FAILURE);
-               newargv[0] = lxcbasename(tpath);
+               newargv[0] = lxctemplatefilename(tpath);
 
                /* --path */
                len = strlen(c->config_path) + strlen(c->name) + strlen("--path=") + 2;
@@ -1653,9 +1659,9 @@ static bool prepend_lxc_header(char *path, const char *t, char *const argv[])
        char *contents;
        FILE *f;
        int ret = -1;
-#if HAVE_LIBGNUTLS
-       int i;
-       unsigned char md_value[SHA_DIGEST_LENGTH];
+#if HAVE_OPENSSL
+       int i, md_len = 0;
+       unsigned char md_value[EVP_MAX_MD_SIZE];
        char *tpath;
 #endif
 
@@ -1696,14 +1702,14 @@ static bool prepend_lxc_header(char *path, const char *t, char *const argv[])
        if (ret < 0)
                goto out_free_contents;
 
-#if HAVE_LIBGNUTLS
+#if HAVE_OPENSSL
        tpath = get_template_path(t);
        if (!tpath) {
                ERROR("Invalid template \"%s\" specified", t);
                goto out_free_contents;
        }
 
-       ret = sha1sum_file(tpath, md_value);
+       ret = sha1sum_file(tpath, md_value, &md_len);
        if (ret < 0) {
                ERROR("Failed to get sha1sum of %s", tpath);
                free(tpath);
@@ -1729,9 +1735,9 @@ static bool prepend_lxc_header(char *path, const char *t, char *const argv[])
                fprintf(f, "\n");
        }
 
-#if HAVE_LIBGNUTLS
+#if HAVE_OPENSSL
        fprintf(f, "# Template script checksum (SHA-1): ");
-       for (i=0; i<SHA_DIGEST_LENGTH; i++)
+       for (i=0; i<md_len; i++)
                fprintf(f, "%02x", md_value[i]);
        fprintf(f, "\n");
 #endif
@@ -4055,7 +4061,9 @@ static bool do_lxcapi_rename(struct lxc_container *c, const char *newname)
 
 WRAP_API_1(bool, lxcapi_rename, const char *)
 
-static int lxcapi_attach(struct lxc_container *c, lxc_attach_exec_t exec_function, void *exec_payload, lxc_attach_options_t *options, pid_t *attached_process)
+static int lxcapi_attach(struct lxc_container *c,
+                        lxc_attach_exec_t exec_function, void *exec_payload,
+                        lxc_attach_options_t *options, pid_t *attached_process)
 {
        int ret;
 
@@ -4064,33 +4072,37 @@ static int lxcapi_attach(struct lxc_container *c, lxc_attach_exec_t exec_functio
 
        current_config = c->lxc_conf;
 
-       ret = lxc_attach(c->name, c->config_path, exec_function, exec_payload, options, attached_process);
+       ret = lxc_attach(c, exec_function, exec_payload, options,
+                        attached_process);
        current_config = NULL;
        return ret;
 }
 
-static int do_lxcapi_attach_run_wait(struct lxc_container *c, lxc_attach_options_t *options, const char *program, const char * const argv[])
+static int do_lxcapi_attach_run_wait(struct lxc_container *c,
+                                    lxc_attach_options_t *options,
+                                    const char *program,
+                                    const char *const argv[])
 {
        lxc_attach_command_t command;
        pid_t pid;
-       int r;
+       int ret;
 
        if (!c)
                return -1;
 
-       command.program = (char*)program;
-       command.argv = (char**)argv;
+       command.program = (char *)program;
+       command.argv = (char **)argv;
 
-       r = lxc_attach(c->name, c->config_path, lxc_attach_run_command, &command, options, &pid);
-       if (r < 0) {
-               ERROR("ups");
-               return r;
-       }
+       ret = lxc_attach(c, lxc_attach_run_command, &command, options, &pid);
+       if (ret < 0)
+               return ret;
 
        return lxc_wait_for_pid_status(pid);
 }
 
-static int lxcapi_attach_run_wait(struct lxc_container *c, lxc_attach_options_t *options, const char *program, const char * const argv[])
+static int lxcapi_attach_run_wait(struct lxc_container *c,
+                                 lxc_attach_options_t *options,
+                                 const char *program, const char *const argv[])
 {
        int ret;
 
@@ -5236,23 +5248,15 @@ out:
        return ret;
 }
 
-static int do_lxcapi_seccomp_notify(struct lxc_container *c, unsigned int cmd, int fd)
+static int do_lxcapi_seccomp_notify_fd(struct lxc_container *c)
 {
        if (!c || !c->lxc_conf)
                return minus_one_set_errno(-EINVAL);
 
-       switch (cmd) {
-       case LXC_SECCOMP_NOTIFY_GET_FD:
-               if (fd)
-                       return minus_one_set_errno(EINVAL);
-
-               return lxc_seccomp_get_notify_fd(&c->lxc_conf->seccomp);
-       }
-
-       return minus_one_set_errno(EINVAL);
+       return lxc_seccomp_get_notify_fd(&c->lxc_conf->seccomp);
 }
 
-WRAP_API_2(int, lxcapi_seccomp_notify, unsigned int, int)
+WRAP_API(int, lxcapi_seccomp_notify_fd)
 
 struct lxc_container *lxc_container_new(const char *name, const char *configpath)
 {
@@ -5393,7 +5397,7 @@ struct lxc_container *lxc_container_new(const char *name, const char *configpath
        c->console_log = lxcapi_console_log;
        c->mount = lxcapi_mount;
        c->umount = lxcapi_umount;
-       c->seccomp_notify = lxcapi_seccomp_notify;
+       c->seccomp_notify_fd = lxcapi_seccomp_notify_fd;
 
        return c;