lxc_controller.c 46.5 KB
Newer Older
1
/*
2 3
 * Copyright (C) 2010-2011 Red Hat, Inc.
 * Copyright IBM Corp. 2008
4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20
 *
 * lxc_controller.c: linux container process controller
 *
 * Authors:
 *  David L. Leskovec <dlesko at linux.vnet.ibm.com>
 *
 * This library is free software; you can redistribute it and/or
 * modify it under the terms of the GNU Lesser General Public
 * License as published by the Free Software Foundation; either
 * version 2.1 of the License, or (at your option) any later version.
 *
 * This library is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
 * Lesser General Public License for more details.
 *
 * You should have received a copy of the GNU Lesser General Public
O
Osier Yang 已提交
21 22
 * License along with this library;  If not, see
 * <http://www.gnu.org/licenses/>.
23 24 25 26 27
 */

#include <config.h>

#include <sys/epoll.h>
28 29
#include <sys/wait.h>
#include <sys/socket.h>
30 31
#include <sys/types.h>
#include <sys/un.h>
32 33
#include <sys/utsname.h>
#include <sys/personality.h>
34
#include <unistd.h>
35
#include <paths.h>
36
#include <errno.h>
37 38
#include <fcntl.h>
#include <signal.h>
39
#include <getopt.h>
40
#include <sys/mount.h>
E
Eric Blake 已提交
41
#include <locale.h>
42 43
#include <grp.h>
#include <sys/stat.h>
44
#include <time.h>
45

D
Daniel P. Berrange 已提交
46
#if HAVE_CAPNG
47
# include <cap-ng.h>
D
Daniel P. Berrange 已提交
48 49
#endif

50 51 52 53 54
#if HAVE_NUMACTL
# define NUMA_VERSION1_COMPATIBILITY 1
# include <numa.h>
#endif

55
#include "virterror_internal.h"
56
#include "logging.h"
57 58 59
#include "util.h"

#include "lxc_conf.h"
60
#include "lxc_container.h"
61
#include "lxc_cgroup.h"
62
#include "lxc_protocol.h"
63 64
#include "virnetdev.h"
#include "virnetdevveth.h"
65 66
#include "memory.h"
#include "util.h"
E
Eric Blake 已提交
67
#include "virfile.h"
68
#include "virpidfile.h"
69
#include "command.h"
70 71
#include "processinfo.h"
#include "nodeinfo.h"
72
#include "virrandom.h"
73
#include "rpc/virnetserver.h"
74

75 76
#define VIR_FROM_THIS VIR_FROM_LXC

77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100
typedef struct _virLXCControllerConsole virLXCControllerConsole;
typedef virLXCControllerConsole *virLXCControllerConsolePtr;
struct _virLXCControllerConsole {
    int hostWatch;
    int hostFd;  /* PTY FD in the host OS */
    bool hostClosed;
    int hostEpoll;
    bool hostBlocking;

    int contWatch;
    int contFd;  /* PTY FD in the container */
    bool contClosed;
    int contEpoll;
    bool contBlocking;

    int epollWatch;
    int epollFd; /* epoll FD for dealing with EOF */

    size_t fromHostLen;
    char fromHostBuf[1024];
    size_t fromContLen;
    char fromContBuf[1024];
};

101 102 103 104 105
typedef struct _virLXCController virLXCController;
typedef virLXCController *virLXCControllerPtr;
struct _virLXCController {
    char *name;
    virDomainDefPtr def;
106

107 108
    int handshakeFd;

109 110
    pid_t initpid;

111 112
    size_t nveths;
    char **veths;
113 114 115

    size_t nconsoles;
    virLXCControllerConsolePtr consoles;
116
    char *devptmx;
117 118 119

    size_t nloopDevs;
    int *loopDevFds;
120 121

    virSecurityManagerPtr securityManager;
122

123 124
    /* Server socket */
    virNetServerPtr server;
125 126 127 128
    virNetServerClientPtr client;
    virNetServerProgramPtr prog;
    bool inShutdown;
    int timerShutdown;
129 130
};

131 132
#include "lxc_controller_dispatch.h"

133 134
static void virLXCControllerFree(virLXCControllerPtr ctrl);

135 136 137 138 139 140 141 142 143
static void virLXCControllerQuitTimer(int timer ATTRIBUTE_UNUSED, void *opaque)
{
    virLXCControllerPtr ctrl = opaque;

    VIR_DEBUG("Triggering event loop quit");
    virNetServerQuit(ctrl->server);
}


144 145 146 147 148 149 150 151 152
static virLXCControllerPtr virLXCControllerNew(const char *name)
{
    virLXCControllerPtr ctrl = NULL;
    virCapsPtr caps = NULL;
    char *configFile = NULL;

    if (VIR_ALLOC(ctrl) < 0)
        goto no_memory;

153 154
    ctrl->timerShutdown = -1;

155 156 157 158 159 160 161 162 163 164 165 166 167 168 169 170
    if (!(ctrl->name = strdup(name)))
        goto no_memory;

    if ((caps = lxcCapsInit(NULL)) == NULL)
        goto error;

    if ((configFile = virDomainConfigFile(LXC_STATE_DIR,
                                          ctrl->name)) == NULL)
        goto error;

    if ((ctrl->def = virDomainDefParseFile(caps,
                                           configFile,
                                           1 << VIR_DOMAIN_VIRT_LXC,
                                           0)) == NULL)
        goto error;

171 172 173 174 175
    if ((ctrl->timerShutdown = virEventAddTimeout(-1,
                                                  virLXCControllerQuitTimer, ctrl,
                                                  NULL)) < 0)
        goto error;

176 177 178 179 180 181 182 183 184 185 186 187 188
cleanup:
    VIR_FREE(configFile);
    virCapabilitiesFree(caps);
    return ctrl;

no_memory:
    virReportOOMError();
error:
    virLXCControllerFree(ctrl);
    ctrl = NULL;
    goto cleanup;
}

189

190 191 192 193 194 195 196 197 198 199 200 201 202 203 204 205 206 207 208 209 210
static int virLXCControllerCloseLoopDevices(virLXCControllerPtr ctrl,
                                            bool force)
{
    size_t i;

    for (i = 0 ; i < ctrl->nloopDevs ; i++) {
        if (force) {
            VIR_FORCE_CLOSE(ctrl->loopDevFds[i]);
        } else {
            if (VIR_CLOSE(ctrl->loopDevFds[i]) < 0) {
                virReportSystemError(errno, "%s",
                                     _("Unable to close loop device"));
                return -1;
            }
        }
    }

    return 0;
}


211 212 213 214 215
static void virLXCControllerStopInit(virLXCControllerPtr ctrl)
{
    if (ctrl->initpid == 0)
        return;

216
    virLXCControllerCloseLoopDevices(ctrl, true);
217 218 219 220 221
    virPidAbort(ctrl->initpid);
    ctrl->initpid = 0;
}


222 223 224 225 226 227 228 229 230 231 232 233 234 235 236 237
static void virLXCControllerConsoleClose(virLXCControllerConsolePtr console)
{
    if (console->hostWatch != -1)
        virEventRemoveHandle(console->hostWatch);
    VIR_FORCE_CLOSE(console->hostFd);

    if (console->contWatch != -1)
        virEventRemoveHandle(console->contWatch);
    VIR_FORCE_CLOSE(console->contFd);

    if (console->epollWatch != -1)
        virEventRemoveHandle(console->epollWatch);
    VIR_FORCE_CLOSE(console->epollFd);
}


238 239
static void virLXCControllerFree(virLXCControllerPtr ctrl)
{
240 241
    size_t i;

242 243 244
    if (!ctrl)
        return;

245 246
    virLXCControllerStopInit(ctrl);

247 248
    virSecurityManagerFree(ctrl->securityManager);

249 250 251 252
    for (i = 0 ; i < ctrl->nveths ; i++)
        VIR_FREE(ctrl->veths[i]);
    VIR_FREE(ctrl->veths);

253 254 255 256
    for (i = 0 ; i < ctrl->nconsoles ; i++)
        virLXCControllerConsoleClose(&(ctrl->consoles[i]));
    VIR_FREE(ctrl->consoles);

257 258
    VIR_FORCE_CLOSE(ctrl->handshakeFd);

259 260
    VIR_FREE(ctrl->devptmx);

261 262 263
    virDomainDefFree(ctrl->def);
    VIR_FREE(ctrl->name);

264 265 266
    if (ctrl->timerShutdown != -1)
        virEventRemoveTimeout(ctrl->timerShutdown);

267
    virNetServerFree(ctrl->server);
268

269 270 271
    VIR_FREE(ctrl);
}

272

273 274 275 276 277 278 279 280 281 282 283 284 285 286 287 288 289 290 291 292 293 294 295 296 297 298 299 300 301 302 303 304
static int virLXCControllerAddConsole(virLXCControllerPtr ctrl,
                                      int hostFd)
{
    if (VIR_EXPAND_N(ctrl->consoles, ctrl->nconsoles, 1) < 0) {
        virReportOOMError();
        return -1;
    }
    ctrl->consoles[ctrl->nconsoles-1].hostFd = hostFd;
    ctrl->consoles[ctrl->nconsoles-1].hostWatch = -1;

    ctrl->consoles[ctrl->nconsoles-1].contFd = -1;
    ctrl->consoles[ctrl->nconsoles-1].contWatch = -1;

    ctrl->consoles[ctrl->nconsoles-1].epollFd = -1;
    ctrl->consoles[ctrl->nconsoles-1].epollWatch = -1;
    return 0;
}


static int virLXCControllerConsoleSetNonblocking(virLXCControllerConsolePtr console)
{
    if (virSetBlocking(console->hostFd, false) < 0 ||
        virSetBlocking(console->contFd, false) < 0) {
        virReportSystemError(errno, "%s",
                             _("Unable to set console file descriptor non-blocking"));
        return -1;
    }

    return 0;
}


305 306 307 308 309 310 311 312 313 314 315 316
static int virLXCControllerDaemonHandshake(virLXCControllerPtr ctrl)
{
    if (lxcContainerSendContinue(ctrl->handshakeFd) < 0) {
        virReportSystemError(errno, "%s",
                             _("error sending continue signal to daemon"));
        return -1;
    }
    VIR_FORCE_CLOSE(ctrl->handshakeFd);
    return 0;
}


317 318 319
static int virLXCControllerValidateNICs(virLXCControllerPtr ctrl)
{
    if (ctrl->def->nnets != ctrl->nveths) {
320 321 322
        virReportError(VIR_ERR_INTERNAL_ERROR,
                       _("expecting %d veths, but got %zu"),
                       ctrl->def->nnets, ctrl->nveths);
323 324 325 326 327 328 329
        return -1;
    }

    return 0;
}


330 331 332
static int virLXCControllerValidateConsoles(virLXCControllerPtr ctrl)
{
    if (ctrl->def->nconsoles != ctrl->nconsoles) {
333 334 335
        virReportError(VIR_ERR_INTERNAL_ERROR,
                       _("expecting %d consoles, but got %zu tty file handlers"),
                       ctrl->def->nconsoles, ctrl->nconsoles);
336 337 338 339 340 341 342
        return -1;
    }

    return 0;
}


343
static int virLXCControllerSetupLoopDevice(virDomainFSDefPtr fs)
344
{
345
    int lofd;
346 347
    char *loname = NULL;

348
    if ((lofd = virFileLoopDeviceAssociate(fs->src, &loname)) < 0)
349 350 351 352 353 354 355 356 357 358 359 360 361 362 363
        return -1;

    /*
     * We now change it into a block device type, so that
     * the rest of container setup 'just works'
     */
    fs->type = VIR_DOMAIN_FS_TYPE_BLOCK;
    VIR_FREE(fs->src);
    fs->src = loname;
    loname = NULL;

    return lofd;
}


364
static int virLXCControllerSetupLoopDevices(virLXCControllerPtr ctrl)
365 366 367 368
{
    size_t i;
    int ret = -1;

369
    for (i = 0 ; i < ctrl->def->nfss ; i++) {
370 371
        int fd;

372
        if (ctrl->def->fss[i]->type != VIR_DOMAIN_FS_TYPE_FILE)
373 374
            continue;

375
        fd = virLXCControllerSetupLoopDevice(ctrl->def->fss[i]);
376 377 378 379
        if (fd < 0)
            goto cleanup;

        VIR_DEBUG("Saving loop fd %d", fd);
380
        if (VIR_EXPAND_N(ctrl->loopDevFds, ctrl->nloopDevs, 1) < 0) {
381 382 383 384
            VIR_FORCE_CLOSE(fd);
            virReportOOMError();
            goto cleanup;
        }
385
        ctrl->loopDevFds[ctrl->nloopDevs - 1] = fd;
386 387 388 389 390 391 392 393 394
    }

    VIR_DEBUG("Setup all loop devices");
    ret = 0;

cleanup:
    return ret;
}

395
#if HAVE_NUMACTL
396
static int virLXCControllerSetupNUMAPolicy(virLXCControllerPtr ctrl)
397 398 399 400 401 402 403 404 405
{
    nodemask_t mask;
    int mode = -1;
    int node = -1;
    int ret = -1;
    int i = 0;
    int maxnode = 0;
    bool warned = false;

406
    if (!ctrl->def->numatune.memory.nodemask)
407 408 409 410 411
        return 0;

    VIR_DEBUG("Setting NUMA memory policy");

    if (numa_available() < 0) {
412 413
        virReportError(VIR_ERR_CONFIG_UNSUPPORTED,
                       "%s", _("Host kernel is not aware of NUMA."));
414 415 416 417 418 419 420 421
        return -1;
    }

    maxnode = numa_max_node() + 1;

    /* Convert nodemask to NUMA bitmask. */
    nodemask_zero(&mask);
    for (i = 0; i < VIR_DOMAIN_CPUMASK_LEN; i++) {
422
        if (ctrl->def->numatune.memory.nodemask[i]) {
423
            if (i > NUMA_NUM_NODES) {
424 425
                virReportError(VIR_ERR_CONFIG_UNSUPPORTED,
                               _("Host cannot support NUMA node %d"), i);
426 427 428 429 430 431 432 433 434 435 436
                return -1;
            }
            if (i > maxnode && !warned) {
                VIR_WARN("nodeset is out of range, there is only %d NUMA "
                         "nodes on host", maxnode);
                warned = true;
            }
            nodemask_set(&mask, i);
        }
    }

437
    mode = ctrl->def->numatune.memory.mode;
438 439 440 441 442 443 444 445 446 447 448 449 450 451 452

    if (mode == VIR_DOMAIN_NUMATUNE_MEM_STRICT) {
        numa_set_bind_policy(1);
        numa_set_membind(&mask);
        numa_set_bind_policy(0);
    } else if (mode == VIR_DOMAIN_NUMATUNE_MEM_PREFERRED) {
        int nnodes = 0;
        for (i = 0; i < NUMA_NUM_NODES; i++) {
            if (nodemask_isset(&mask, i)) {
                node = i;
                nnodes++;
            }
        }

        if (nnodes != 1) {
453 454 455
            virReportError(VIR_ERR_CONFIG_UNSUPPORTED,
                           "%s", _("NUMA memory tuning in 'preferred' mode "
                                   "only supports single node"));
456 457 458 459 460 461 462 463
            goto cleanup;
        }

        numa_set_bind_policy(0);
        numa_set_preferred(node);
    } else if (mode == VIR_DOMAIN_NUMATUNE_MEM_INTERLEAVE) {
        numa_set_interleave_mask(&mask);
    } else {
464 465 466
        virReportError(VIR_ERR_CONFIG_UNSUPPORTED,
                       _("Unable to set NUMA policy %s"),
                       virDomainNumatuneMemModeTypeToString(mode));
467 468 469 470 471 472 473 474 475
        goto cleanup;
    }

    ret = 0;

cleanup:
    return ret;
}
#else
476
static int virLXCControllerSetupNUMAPolicy(virLXCControllerPtr ctrl)
477
{
478
    if (ctrl->def->numatune.memory.nodemask) {
479 480
        virReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s",
                       _("NUMA policy is not available on this platform"));
481 482 483 484 485 486 487
        return -1;
    }

    return 0;
}
#endif

488 489 490 491

/*
 * To be run while still single threaded
 */
492
static int virLXCControllerSetupCpuAffinity(virLXCControllerPtr ctrl)
493 494 495 496 497 498 499 500 501 502 503 504 505 506 507 508 509 510 511 512 513 514 515
{
    int i, hostcpus, maxcpu = CPU_SETSIZE;
    virNodeInfo nodeinfo;
    unsigned char *cpumap;
    int cpumaplen;

    VIR_DEBUG("Setting CPU affinity");

    if (nodeGetInfo(NULL, &nodeinfo) < 0)
        return -1;

    /* setaffinity fails if you set bits for CPUs which
     * aren't present, so we have to limit ourselves */
    hostcpus = VIR_NODEINFO_MAXCPUS(nodeinfo);
    if (maxcpu > hostcpus)
        maxcpu = hostcpus;

    cpumaplen = VIR_CPU_MAPLEN(maxcpu);
    if (VIR_ALLOC_N(cpumap, cpumaplen) < 0) {
        virReportOOMError();
        return -1;
    }

516
    if (ctrl->def->cpumask) {
517 518
        /* XXX why don't we keep 'cpumask' in the libvirt cpumap
         * format to start with ?!?! */
519 520
        for (i = 0 ; i < maxcpu && i < ctrl->def->cpumasklen ; i++)
            if (ctrl->def->cpumask[i])
521 522 523 524 525 526 527 528 529 530 531 532 533 534 535 536 537 538 539 540 541 542 543 544 545
                VIR_USE_CPU(cpumap, i);
    } else {
        /* You may think this is redundant, but we can't assume libvirtd
         * itself is running on all pCPUs, so we need to explicitly set
         * the spawned LXC instance to all pCPUs if no map is given in
         * its config file */
        for (i = 0 ; i < maxcpu ; i++)
            VIR_USE_CPU(cpumap, i);
    }

    /* We are pressuming we are running between fork/exec of LXC
     * so use '0' to indicate our own process ID. No threads are
     * running at this point
     */
    if (virProcessInfoSetAffinity(0, /* Self */
                                  cpumap, cpumaplen, maxcpu) < 0) {
        VIR_FREE(cpumap);
        return -1;
    }
    VIR_FREE(cpumap);

    return 0;
}


546
/**
547 548
 * virLXCControllerSetupResourceLimits
 * @ctrl: the controller state
549 550 551 552 553 554
 *
 * Creates a cgroup for the container, moves the task inside,
 * and sets resource limits
 *
 * Returns 0 on success or -1 in case of error
 */
555
static int virLXCControllerSetupResourceLimits(virLXCControllerPtr ctrl)
556 557
{

558
    if (virLXCControllerSetupCpuAffinity(ctrl) < 0)
559 560
        return -1;

561
    if (virLXCControllerSetupNUMAPolicy(ctrl) < 0)
562 563
        return -1;

564
    return virLXCCgroupSetup(ctrl->def);
D
Dan Smith 已提交
565 566
}

567

568 569 570 571 572 573 574 575 576 577 578 579 580
static void virLXCControllerClientCloseHook(virNetServerClientPtr client)
{
    virLXCControllerPtr ctrl = virNetServerClientGetPrivateData(client);

    VIR_DEBUG("Client %p has closed", client);
    if (ctrl->client == client)
        ctrl->client = NULL;
    if (ctrl->inShutdown) {
        VIR_DEBUG("Arm timer to quit event loop");
        virEventUpdateTimeout(ctrl->timerShutdown, 0);
    }
}

581 582 583 584 585 586
static int virLXCControllerClientHook(virNetServerPtr server ATTRIBUTE_UNUSED,
                                      virNetServerClientPtr client,
                                      void *opaque)
{
    virLXCControllerPtr ctrl = opaque;
    virNetServerClientSetPrivateData(client, ctrl, NULL);
587 588 589
    virNetServerClientSetCloseHook(client, virLXCControllerClientCloseHook);
    VIR_DEBUG("Got new client %p", client);
    ctrl->client = client;
590
    return 0;
591 592
}

593 594

static int virLXCControllerSetupServer(virLXCControllerPtr ctrl)
595
{
596 597
    virNetServerServicePtr svc = NULL;
    char *sockpath;
598

599 600 601 602
    if (virAsprintf(&sockpath, "%s/%s.sock",
                    LXC_STATE_DIR, ctrl->name) < 0) {
        virReportOOMError();
        return -1;
603 604
    }

605 606 607 608 609
    if (!(ctrl->server = virNetServerNew(0, 0, 0, 1,
                                         -1, 0, false,
                                         NULL,
                                         virLXCControllerClientHook,
                                         ctrl)))
C
Chris Lalancette 已提交
610
        goto error;
611

612 613 614 615 616 617 618
    if (!(svc = virNetServerServiceNewUNIX(sockpath,
                                           0700,
                                           0,
                                           0,
                                           false,
                                           5,
                                           NULL)))
619
        goto error;
620 621

    if (virNetServerAddService(ctrl->server, svc, NULL) < 0)
622
        goto error;
623 624
    virNetServerServiceFree(svc);
    svc = NULL;
625

626 627 628 629 630 631
    if (!(ctrl->prog = virNetServerProgramNew(VIR_LXC_PROTOCOL_PROGRAM,
                                              VIR_LXC_PROTOCOL_PROGRAM_VERSION,
                                              virLXCProtocolProcs,
                                              virLXCProtocolNProcs)))
        goto error;

632 633 634
    virNetServerUpdateServices(ctrl->server, true);
    VIR_FREE(sockpath);
    return 0;
635 636

error:
637 638 639 640
    VIR_FREE(sockpath);
    virNetServerFree(ctrl->server);
    ctrl->server = NULL;
    virNetServerServiceFree(svc);
641 642
    return -1;
}
643

D
Daniel P. Berrange 已提交
644 645 646 647 648 649 650 651 652

static int lxcControllerClearCapabilities(void)
{
#if HAVE_CAPNG
    int ret;

    capng_clear(CAPNG_SELECT_BOTH);

    if ((ret = capng_apply(CAPNG_SELECT_BOTH)) < 0) {
653 654
        virReportError(VIR_ERR_INTERNAL_ERROR,
                       _("failed to apply capabilities: %d"), ret);
D
Daniel P. Berrange 已提交
655 656 657
        return -1;
    }
#else
658
    VIR_WARN("libcap-ng support not compiled in, unable to clear capabilities");
D
Daniel P. Berrange 已提交
659 660 661 662
#endif
    return 0;
}

663
static bool quit = false;
664
static bool wantReboot = false;
665 666 667
static virMutex lock;


668 669
static void virLXCControllerSignalChildIO(virNetServerPtr server ATTRIBUTE_UNUSED,
                                          siginfo_t *info ATTRIBUTE_UNUSED,
670
                                          void *opaque)
671
{
672
    virLXCControllerPtr ctrl = opaque;
673
    int ret;
674
    int status;
675

676
    ret = waitpid(-1, &status, WNOHANG);
677 678 679
    if (ret == ctrl->initpid) {
        virMutexLock(&lock);
        quit = true;
680 681 682
        if (WIFSIGNALED(status) &&
            WTERMSIG(status) == SIGHUP)
            wantReboot = true;
683 684
        virMutexUnlock(&lock);
    }
685 686 687
}


688
static void virLXCControllerConsoleUpdateWatch(virLXCControllerConsolePtr console)
689 690 691 692
{
    int hostEvents = 0;
    int contEvents = 0;

693
    if (!console->hostClosed || (!console->hostBlocking && console->fromContLen)) {
694 695 696 697 698
        if (console->fromHostLen < sizeof(console->fromHostBuf))
            hostEvents |= VIR_EVENT_HANDLE_READABLE;
        if (console->fromContLen)
            hostEvents |= VIR_EVENT_HANDLE_WRITABLE;
    }
699
    if (!console->contClosed || (!console->contBlocking && console->fromHostLen)) {
700 701 702 703 704 705
        if (console->fromContLen < sizeof(console->fromContBuf))
            contEvents |= VIR_EVENT_HANDLE_READABLE;
        if (console->fromHostLen)
            contEvents |= VIR_EVENT_HANDLE_WRITABLE;
    }

706 707 708
    VIR_DEBUG("Container watch %d=%d host watch %d=%d",
              console->contWatch, contEvents,
              console->hostWatch, hostEvents);
709 710
    virEventUpdateHandle(console->contWatch, contEvents);
    virEventUpdateHandle(console->hostWatch, hostEvents);
711

712 713 714 715 716 717 718 719 720 721 722 723 724 725 726 727 728 729 730 731 732 733 734 735 736 737 738 739 740 741 742 743 744 745 746 747
    if (console->hostClosed) {
        int events = EPOLLIN | EPOLLET;
        if (console->hostBlocking)
            events |= EPOLLOUT;

        if (events != console->hostEpoll) {
            struct epoll_event event;
            int action = EPOLL_CTL_ADD;
            if (console->hostEpoll)
                action = EPOLL_CTL_MOD;

            VIR_DEBUG("newHostEvents=%x oldHostEvents=%x", events, console->hostEpoll);

            event.events = events;
            event.data.fd = console->hostFd;
            if (epoll_ctl(console->epollFd, action, console->hostFd, &event) < 0) {
                VIR_DEBUG(":fail");
                virReportSystemError(errno, "%s",
                                     _("Unable to add epoll fd"));
                quit = true;
                goto cleanup;
            }
            console->hostEpoll = events;
            VIR_DEBUG("newHostEvents=%x oldHostEvents=%x", events, console->hostEpoll);
        }
    } else if (console->hostEpoll) {
        VIR_DEBUG("Stop epoll oldContEvents=%x", console->hostEpoll);
        if (epoll_ctl(console->epollFd, EPOLL_CTL_DEL, console->hostFd, NULL) < 0) {
            virReportSystemError(errno, "%s",
                                 _("Unable to remove epoll fd"));
                VIR_DEBUG(":fail");
            quit = true;
            goto cleanup;
        }
        console->hostEpoll = 0;
    }
748

749 750 751 752 753 754 755 756 757 758 759 760 761 762 763 764 765 766 767 768 769 770 771 772 773 774 775 776 777 778 779 780 781 782 783 784 785 786 787
    if (console->contClosed) {
        int events = EPOLLIN | EPOLLET;
        if (console->contBlocking)
            events |= EPOLLOUT;

        if (events != console->contEpoll) {
            struct epoll_event event;
            int action = EPOLL_CTL_ADD;
            if (console->contEpoll)
                action = EPOLL_CTL_MOD;

            VIR_DEBUG("newContEvents=%x oldContEvents=%x", events, console->contEpoll);

            event.events = events;
            event.data.fd = console->contFd;
            if (epoll_ctl(console->epollFd, action, console->contFd, &event) < 0) {
                virReportSystemError(errno, "%s",
                                     _("Unable to add epoll fd"));
                VIR_DEBUG(":fail");
                quit = true;
                goto cleanup;
            }
            console->contEpoll = events;
            VIR_DEBUG("newHostEvents=%x oldHostEvents=%x", events, console->contEpoll);
        }
    } else if (console->contEpoll) {
        VIR_DEBUG("Stop epoll oldContEvents=%x", console->contEpoll);
        if (epoll_ctl(console->epollFd, EPOLL_CTL_DEL, console->contFd, NULL) < 0) {
            virReportSystemError(errno, "%s",
                                 _("Unable to remove epoll fd"));
                VIR_DEBUG(":fail");
            quit = true;
            goto cleanup;
        }
        console->contEpoll = 0;
    }
cleanup:
    return;
}
788 789


790
static void virLXCControllerConsoleEPoll(int watch, int fd, int events, void *opaque)
791
{
792
    virLXCControllerConsolePtr console = opaque;
793

794 795 796 797 798 799 800 801 802 803
    virMutexLock(&lock);
    VIR_DEBUG("IO event watch=%d fd=%d events=%d fromHost=%zu fromcont=%zu",
              watch, fd, events,
              console->fromHostLen,
              console->fromContLen);

    while (1) {
        struct epoll_event event;
        int ret;
        ret = epoll_wait(console->epollFd, &event, 1, 0);
804
        if (ret < 0) {
S
Stefan Berger 已提交
805
            if (errno == EINTR)
806 807 808 809 810 811 812
                continue;
            virReportSystemError(errno, "%s",
                                 _("Unable to wait on epoll"));
            quit = true;
            goto cleanup;
        }

813 814 815 816 817 818 819
        if (ret == 0)
            break;

        VIR_DEBUG("fd=%d hostFd=%d contFd=%d hostEpoll=%x contEpoll=%x",
                  event.data.fd, console->hostFd, console->contFd,
                  console->hostEpoll, console->contEpoll);

820 821 822
        /* If we get HUP+dead PID, we just re-enable the main loop
         * which will see the PID has died and exit */
        if ((event.events & EPOLLIN)) {
823 824
            if (event.data.fd == console->hostFd) {
                console->hostClosed = false;
825
            } else {
826
                console->contClosed = false;
827
            }
828
            virLXCControllerConsoleUpdateWatch(console);
829 830 831 832 833
            break;
        }
    }

cleanup:
834
    virMutexUnlock(&lock);
835 836
}

837
static void virLXCControllerConsoleIO(int watch, int fd, int events, void *opaque)
838
{
839
    virLXCControllerConsolePtr console = opaque;
840 841

    virMutexLock(&lock);
842 843 844 845
    VIR_DEBUG("IO event watch=%d fd=%d events=%d fromHost=%zu fromcont=%zu",
              watch, fd, events,
              console->fromHostLen,
              console->fromContLen);
846 847 848 849 850 851 852 853 854 855 856 857 858 859 860 861 862 863 864 865 866 867 868 869 870 871 872 873 874 875 876 877 878 879 880 881 882 883 884 885 886 887 888 889 890 891 892 893 894 895 896 897 898 899 900 901
    if (events & VIR_EVENT_HANDLE_READABLE) {
        char *buf;
        size_t *len;
        size_t avail;
        ssize_t done;
        if (watch == console->hostWatch) {
            buf = console->fromHostBuf;
            len = &console->fromHostLen;
            avail = sizeof(console->fromHostBuf) - *len;
        } else {
            buf = console->fromContBuf;
            len = &console->fromContLen;
            avail = sizeof(console->fromContBuf) - *len;
        }
    reread:
        done = read(fd, buf + *len, avail);
        if (done == -1 && errno == EINTR)
            goto reread;
        if (done == -1 && errno != EAGAIN) {
            virReportSystemError(errno, "%s",
                                 _("Unable to read container pty"));
            goto error;
        }
        if (done > 0) {
            *len += done;
        } else {
            VIR_DEBUG("Read fd %d done %d errno %d", fd, (int)done, errno);
        }
    }

    if (events & VIR_EVENT_HANDLE_WRITABLE) {
        char *buf;
        size_t *len;
        ssize_t done;
        if (watch == console->hostWatch) {
            buf = console->fromContBuf;
            len = &console->fromContLen;
        } else {
            buf = console->fromHostBuf;
            len = &console->fromHostLen;
        }

    rewrite:
        done = write(fd, buf, *len);
        if (done == -1 && errno == EINTR)
            goto rewrite;
        if (done == -1 && errno != EAGAIN) {
            virReportSystemError(errno, "%s",
                                 _("Unable to write to container pty"));
            goto error;
        }
        if (done > 0) {
            memmove(buf, buf + done, (*len - done));
            *len -= done;
        } else {
            VIR_DEBUG("Write fd %d done %d errno %d", fd, (int)done, errno);
902 903 904 905
            if (watch == console->hostWatch)
                console->hostBlocking = true;
            else
                console->contBlocking = true;
906 907 908 909 910 911 912 913 914 915 916 917
        }
    }

    if (events & VIR_EVENT_HANDLE_HANGUP) {
        if (watch == console->hostWatch) {
            console->hostClosed = true;
        } else {
            console->contClosed = true;
        }
        VIR_DEBUG("Got EOF on %d %d", watch, fd);
    }

918
    virLXCControllerConsoleUpdateWatch(console);
919 920 921 922 923 924 925 926 927 928 929 930
    virMutexUnlock(&lock);
    return;

error:
    virEventRemoveHandle(console->contWatch);
    virEventRemoveHandle(console->hostWatch);
    console->contWatch = console->hostWatch = -1;
    quit = true;
    virMutexUnlock(&lock);
}


931
/**
932
 * lxcControllerMain
933 934
 * @serverFd: server socket fd to accept client requests
 * @clientFd: initial client which is the libvirtd daemon
935
 *
936
 * Processes I/O on consoles and the monitor
937 938 939
 *
 * Returns 0 on success or -1 in case of error
 */
940
static int virLXCControllerMain(virLXCControllerPtr ctrl)
941
{
942
    virErrorPtr err;
943
    int rc = -1;
944
    size_t i;
945 946 947 948

    if (virMutexInit(&lock) < 0)
        goto cleanup2;

949 950 951 952
    if (virNetServerAddSignalHandler(ctrl->server,
                                     SIGCHLD,
                                     virLXCControllerSignalChildIO,
                                     ctrl) < 0)
953 954
        goto cleanup;

955 956
    virResetLastError();

957 958
    for (i = 0 ; i < ctrl->nconsoles ; i++) {
        if ((ctrl->consoles[i].epollFd = epoll_create1(EPOLL_CLOEXEC)) < 0) {
959 960 961 962 963
            virReportSystemError(errno, "%s",
                                 _("Unable to create epoll fd"));
            goto cleanup;
        }

964 965 966 967 968
        if ((ctrl->consoles[i].epollWatch = virEventAddHandle(ctrl->consoles[i].epollFd,
                                                              VIR_EVENT_HANDLE_READABLE,
                                                              virLXCControllerConsoleEPoll,
                                                              &(ctrl->consoles[i]),
                                                              NULL)) < 0) {
969 970
            virReportError(VIR_ERR_INTERNAL_ERROR, "%s",
                           _("Unable to watch epoll FD"));
971 972 973
            goto cleanup;
        }

974 975 976 977 978
        if ((ctrl->consoles[i].hostWatch = virEventAddHandle(ctrl->consoles[i].hostFd,
                                                             VIR_EVENT_HANDLE_READABLE,
                                                             virLXCControllerConsoleIO,
                                                             &(ctrl->consoles[i]),
                                                             NULL)) < 0) {
979 980
            virReportError(VIR_ERR_INTERNAL_ERROR, "%s",
                           _("Unable to watch host console PTY"));
981 982 983
            goto cleanup;
        }

984 985 986 987 988
        if ((ctrl->consoles[i].contWatch = virEventAddHandle(ctrl->consoles[i].contFd,
                                                             VIR_EVENT_HANDLE_READABLE,
                                                             virLXCControllerConsoleIO,
                                                             &(ctrl->consoles[i]),
                                                             NULL)) < 0) {
989 990
            virReportError(VIR_ERR_INTERNAL_ERROR, "%s",
                           _("Unable to watch host console PTY"));
991 992
            goto cleanup;
        }
993
    }
994

995 996 997 998
    virMutexLock(&lock);
    while (!quit) {
        virMutexUnlock(&lock);
        if (virEventRunDefaultImpl() < 0)
999
            goto cleanup;
1000
        virMutexLock(&lock);
1001
    }
1002
    virMutexUnlock(&lock);
1003

1004 1005
    err = virGetLastError();
    if (!err || err->code == VIR_ERR_OK)
1006
        rc = wantReboot ? 1 : 0;
1007 1008

cleanup:
1009 1010
    virMutexDestroy(&lock);
cleanup2:
1011

1012 1013
    for (i = 0 ; i < ctrl->nconsoles ; i++)
        virLXCControllerConsoleClose(&(ctrl->consoles[i]));
1014

1015 1016 1017
    return rc;
}

1018 1019 1020


/**
1021
 * virLXCControllerMoveInterfaces
1022 1023 1024 1025 1026 1027 1028 1029
 * @nveths: number of interfaces
 * @veths: interface names
 * @container: pid of container
 *
 * Moves network interfaces into a container's namespace
 *
 * Returns 0 on success or -1 in case of error
 */
1030
static int virLXCControllerMoveInterfaces(virLXCControllerPtr ctrl)
1031
{
1032 1033 1034
    size_t i;

    for (i = 0 ; i < ctrl->nveths ; i++) {
1035
        if (virNetDevSetNamespace(ctrl->veths[i], ctrl->initpid) < 0)
1036
            return -1;
1037
    }
1038 1039 1040 1041 1042 1043

    return 0;
}


/**
1044 1045
 * virLXCControllerDeleteInterfaces:
 * @ctrl: the LXC controller
1046 1047 1048 1049 1050
 *
 * Cleans up the container interfaces by deleting the veth device pairs.
 *
 * Returns 0 on success or -1 in case of error
 */
1051
static int virLXCControllerDeleteInterfaces(virLXCControllerPtr ctrl)
1052
{
1053 1054
    size_t i;
    int ret = 0;
1055

1056 1057 1058 1059 1060 1061
    for (i = 0 ; i < ctrl->nveths ; i++) {
        if (virNetDevVethDelete(ctrl->veths[i]) < 0)
            ret = -1;
    }

    return ret;
1062 1063
}

1064

1065 1066 1067 1068 1069 1070 1071 1072 1073 1074 1075 1076 1077 1078 1079 1080 1081 1082 1083
static int lxcSetPersonality(virDomainDefPtr def)
{
    struct utsname utsname;
    const char *altArch;

    uname(&utsname);

    altArch = lxcContainerGetAlt32bitArch(utsname.machine);
    if (altArch &&
        STREQ(def->os.arch, altArch)) {
        if (personality(PER_LINUX32) < 0) {
            virReportSystemError(errno, _("Unable to request personality for %s on %s"),
                                 altArch, utsname.machine);
            return -1;
        }
    }
    return 0;
}

1084
#ifndef MS_REC
1085
# define MS_REC          16384
1086 1087 1088
#endif

#ifndef MS_SLAVE
1089
# define MS_SLAVE              (1<<19)
1090
#endif
1091

1092 1093 1094 1095 1096 1097 1098 1099 1100 1101 1102 1103 1104 1105 1106 1107 1108 1109 1110 1111 1112 1113 1114 1115 1116 1117 1118 1119 1120 1121 1122 1123 1124 1125 1126 1127 1128 1129 1130 1131 1132 1133 1134 1135
/* Create a private tty using the private devpts at PTMX, returning
 * the master in *TTYMASTER and the name of the slave, _from the
 * perspective of the guest after remounting file systems_, in
 * *TTYNAME.  Heavily borrowed from glibc, but doesn't require that
 * devpts == "/dev/pts" */
static int
lxcCreateTty(char *ptmx, int *ttymaster, char **ttyName)
{
    int ret = -1;
    int ptyno;
    int unlock = 0;

    if ((*ttymaster = open(ptmx, O_RDWR|O_NOCTTY|O_NONBLOCK)) < 0)
        goto cleanup;

    if (ioctl(*ttymaster, TIOCSPTLCK, &unlock) < 0)
        goto cleanup;

    if (ioctl(*ttymaster, TIOCGPTN, &ptyno) < 0)
        goto cleanup;

    /* If mount() succeeded at honoring newinstance, then the kernel
     * was new enough to also honor the mode=0620,gid=5 options, which
     * guarantee that the new pty already has correct permissions; so
     * while glibc has to fstat(), fchmod(), and fchown() for older
     * kernels, we can skip those steps.  ptyno shouldn't currently be
     * anything other than 0, but let's play it safe.  */
    if (virAsprintf(ttyName, "/dev/pts/%d", ptyno) < 0) {
        virReportOOMError();
        errno = ENOMEM;
        goto cleanup;
    }

    ret = 0;

cleanup:
    if (ret != 0) {
        VIR_FORCE_CLOSE(*ttymaster);
        VIR_FREE(*ttyName);
    }

    return ret;
}

1136

1137
static int
1138
virLXCControllerSetupDevPTS(virLXCControllerPtr ctrl)
1139
{
1140
    virDomainFSDefPtr root = virDomainGetRootFilesystem(ctrl->def);
1141
    char *mount_options = NULL;
1142 1143 1144
    char *opts;
    char *devpts = NULL;
    int ret = -1;
1145

1146 1147
    if (!root) {
        if (ctrl->nconsoles != 1) {
1148 1149 1150
            virReportError(VIR_ERR_CONFIG_UNSUPPORTED,
                           _("Expected exactly one console, but got %zu"),
                           ctrl->nconsoles);
1151 1152 1153
            return -1;
        }
        return 0;
1154 1155
    }

1156
    VIR_DEBUG("Setting up private /dev/pts");
1157

1158 1159 1160 1161 1162 1163 1164 1165 1166 1167 1168 1169 1170 1171 1172 1173 1174 1175 1176 1177
    /*
     * If doing a chroot style setup, we need to prepare
     * a private /dev/pts for the child now, which they
     * will later move into position.
     *
     * This is complex because 'virsh console' needs to
     * use /dev/pts from the host OS, and the guest OS
     * needs to use /dev/pts from the guest.
     *
     * This means that we (libvirt_lxc) need to see and
     * use both /dev/pts instances. We're running in the
     * host OS context though and don't want to expose
     * the guest OS /dev/pts there.
     *
     * Thus we call unshare(CLONE_NS) so that we can see
     * the guest's new /dev/pts, without it becoming
     * visible to the host OS. We also put the root FS
     * into slave mode, just in case it was currently
     * marked as shared
     */
1178 1179
    mount_options = virSecurityManagerGetMountOptions(ctrl->securityManager,
                                                      ctrl->def);
1180

1181 1182 1183 1184 1185 1186
    if (!virFileExists(root->src)) {
        virReportSystemError(errno,
                             _("root source %s does not exist"),
                             root->src);
        goto cleanup;
    }
1187

1188 1189 1190 1191 1192
    if (unshare(CLONE_NEWNS) < 0) {
        virReportSystemError(errno, "%s",
                             _("Cannot unshare mount namespace"));
        goto cleanup;
    }
1193

1194 1195 1196 1197 1198
    if (mount("", "/", NULL, MS_SLAVE|MS_REC, NULL) < 0) {
        virReportSystemError(errno, "%s",
                             _("Failed to switch root mount into slave mode"));
        goto cleanup;
    }
1199

1200 1201 1202 1203 1204
    if (virAsprintf(&devpts, "%s/dev/pts", root->src) < 0 ||
        virAsprintf(&ctrl->devptmx, "%s/dev/pts/ptmx", root->src) < 0) {
        virReportOOMError();
        goto cleanup;
    }
1205

1206 1207 1208 1209 1210 1211
    if (virFileMakePath(devpts) < 0) {
        virReportSystemError(errno,
                             _("Failed to make path %s"),
                             devpts);
        goto cleanup;
    }
1212

1213 1214 1215 1216 1217 1218 1219
    /* XXX should we support gid=X for X!=5 for distros which use
     * a different gid for tty?  */
    if (virAsprintf(&opts, "newinstance,ptmxmode=0666,mode=0620,gid=5%s",
                    (mount_options ? mount_options : "")) < 0) {
        virReportOOMError();
        goto cleanup;
    }
1220

1221 1222 1223 1224 1225 1226 1227 1228
    VIR_DEBUG("Mount devpts on %s type=tmpfs flags=%x, opts=%s",
              devpts, MS_NOSUID, opts);
    if (mount("devpts", devpts, "devpts", MS_NOSUID, opts) < 0) {
        virReportSystemError(errno,
                             _("Failed to mount devpts on %s"),
                             devpts);
        goto cleanup;
    }
1229

1230 1231 1232
    if (access(ctrl->devptmx, R_OK) < 0) {
        VIR_WARN("Kernel does not support private devpts, using shared devpts");
        VIR_FREE(ctrl->devptmx);
1233 1234
    }

1235 1236 1237 1238 1239 1240 1241 1242 1243 1244 1245 1246 1247 1248 1249
    ret = 0;

cleanup:
    VIR_FREE(opts);
    VIR_FREE(devpts);
    return ret;
}


static int
virLXCControllerSetupConsoles(virLXCControllerPtr ctrl,
                              char **containerTTYPaths)
{
    size_t i;

1250
    for (i = 0 ; i < ctrl->nconsoles ; i++) {
1251 1252 1253
        if (ctrl->devptmx) {
            VIR_DEBUG("Opening tty on private %s", ctrl->devptmx);
            if (lxcCreateTty(ctrl->devptmx,
1254 1255
                             &ctrl->consoles[i].contFd,
                             &containerTTYPaths[i]) < 0) {
1256 1257
                virReportSystemError(errno, "%s",
                                     _("Failed to allocate tty"));
1258
                return -1;
1259 1260 1261
            }
        } else {
            VIR_DEBUG("Opening tty on shared /dev/ptmx");
1262 1263
            if (virFileOpenTty(&ctrl->consoles[i].contFd,
                               &containerTTYPaths[i],
1264 1265 1266
                               0) < 0) {
                virReportSystemError(errno, "%s",
                                     _("Failed to allocate tty"));
1267
                return -1;
1268 1269 1270
            }
        }
    }
1271 1272 1273 1274
    return 0;
}


1275 1276 1277 1278 1279 1280 1281 1282 1283 1284 1285 1286 1287 1288 1289 1290 1291 1292 1293 1294 1295 1296 1297 1298 1299 1300 1301 1302 1303 1304 1305 1306 1307 1308 1309 1310 1311 1312 1313 1314 1315 1316 1317 1318 1319 1320 1321 1322 1323 1324 1325 1326
static void
virLXCControllerEventSend(virLXCControllerPtr ctrl,
                          int procnr,
                          xdrproc_t proc,
                          void *data)
{
    virNetMessagePtr msg;

    if (!ctrl->client)
        return;

    VIR_DEBUG("Send event %d client=%p", procnr, ctrl->client);
    if (!(msg = virNetMessageNew(false)))
        goto error;

    msg->header.prog = virNetServerProgramGetID(ctrl->prog);
    msg->header.vers = virNetServerProgramGetVersion(ctrl->prog);
    msg->header.proc = procnr;
    msg->header.type = VIR_NET_MESSAGE;
    msg->header.serial = 1;
    msg->header.status = VIR_NET_OK;

    if (virNetMessageEncodeHeader(msg) < 0)
        goto error;

    if (virNetMessageEncodePayload(msg, proc, data) < 0)
        goto error;

    VIR_DEBUG("Queue event %d %zu", procnr, msg->bufferLength);
    virNetServerClientSendMessage(ctrl->client, msg);

    xdr_free(proc, data);
    return;

error:
    virNetMessageFree(msg);
    xdr_free(proc, data);
}


static int
virLXCControllerEventSendExit(virLXCControllerPtr ctrl,
                              int exitstatus)
{
    virLXCProtocolExitEventMsg msg;

    VIR_DEBUG("Exit status %d", exitstatus);
    memset(&msg, 0, sizeof(msg));
    switch (exitstatus) {
    case 0:
        msg.status = VIR_LXC_PROTOCOL_EXIT_STATUS_SHUTDOWN;
        break;
1327 1328 1329
    case 1:
        msg.status = VIR_LXC_PROTOCOL_EXIT_STATUS_REBOOT;
        break;
1330 1331 1332 1333 1334 1335 1336 1337 1338 1339 1340 1341 1342 1343 1344 1345 1346 1347 1348 1349 1350
    default:
        msg.status = VIR_LXC_PROTOCOL_EXIT_STATUS_ERROR;
        break;
    }

    virLXCControllerEventSend(ctrl,
                              VIR_LXC_PROTOCOL_PROC_EXIT_EVENT,
                              (xdrproc_t)xdr_virLXCProtocolExitEventMsg,
                              (void*)&msg);

    if (ctrl->client) {
        VIR_DEBUG("Waiting for client to complete dispatch");
        ctrl->inShutdown = true;
        virNetServerClientDelayedClose(ctrl->client);
        virNetServerRun(ctrl->server);
    }
    VIR_DEBUG("Client has gone away");
    return 0;
}


1351
static int
1352
virLXCControllerRun(virLXCControllerPtr ctrl)
1353 1354 1355 1356 1357 1358 1359 1360 1361 1362 1363 1364 1365 1366 1367 1368 1369 1370 1371 1372 1373 1374 1375 1376 1377 1378 1379
{
    int rc = -1;
    int control[2] = { -1, -1};
    int containerhandshake[2] = { -1, -1 };
    char **containerTTYPaths = NULL;
    size_t i;

    if (VIR_ALLOC_N(containerTTYPaths, ctrl->nconsoles) < 0) {
        virReportOOMError();
        goto cleanup;
    }

    if (socketpair(PF_UNIX, SOCK_STREAM, 0, control) < 0) {
        virReportSystemError(errno, "%s",
                             _("sockpair failed"));
        goto cleanup;
    }

    if (socketpair(PF_UNIX, SOCK_STREAM, 0, containerhandshake) < 0) {
        virReportSystemError(errno, "%s",
                             _("socketpair failed"));
        goto cleanup;
    }

    if (virLXCControllerSetupLoopDevices(ctrl) < 0)
        goto cleanup;

1380
    if (virLXCControllerSetupResourceLimits(ctrl) < 0)
1381 1382 1383 1384 1385 1386 1387
        goto cleanup;

    if (virLXCControllerSetupDevPTS(ctrl) < 0)
        goto cleanup;

    if (virLXCControllerSetupConsoles(ctrl, containerTTYPaths) < 0)
        goto cleanup;
1388

1389
    if (lxcSetPersonality(ctrl->def) < 0)
1390
        goto cleanup;
1391

1392
    if ((ctrl->initpid = lxcContainerStart(ctrl->def,
1393
                                           ctrl->securityManager,
1394 1395 1396 1397
                                           ctrl->nveths,
                                           ctrl->veths,
                                           control[1],
                                           containerhandshake[1],
1398 1399
                                           containerTTYPaths,
                                           ctrl->nconsoles)) < 0)
1400
        goto cleanup;
1401
    VIR_FORCE_CLOSE(control[1]);
1402
    VIR_FORCE_CLOSE(containerhandshake[1]);
1403

1404
    if (virLXCControllerMoveInterfaces(ctrl) < 0)
1405 1406
        goto cleanup;

1407 1408 1409
    if (lxcContainerSendContinue(control[0]) < 0) {
        virReportSystemError(errno, "%s",
                             _("Unable to send container continue message"));
1410
        goto cleanup;
1411
    }
1412

1413 1414 1415 1416 1417 1418
    if (lxcContainerWaitForContinue(containerhandshake[0]) < 0) {
        virReportSystemError(errno, "%s",
                             _("error receiving signal from container"));
        goto cleanup;
    }

1419 1420 1421
    /* Now the container is fully setup... */

    /* ...we can close the loop devices... */
1422 1423
    if (virLXCControllerCloseLoopDevices(ctrl, false) < 0)
        goto cleanup;
1424 1425

    /* ...and reduce our privileges */
D
Daniel P. Berrange 已提交
1426 1427 1428
    if (lxcControllerClearCapabilities() < 0)
        goto cleanup;

1429
    if (virLXCControllerDaemonHandshake(ctrl) < 0)
1430 1431
        goto cleanup;

1432 1433
    for (i = 0 ; i < ctrl->nconsoles ; i++)
        if (virLXCControllerConsoleSetNonblocking(&(ctrl->consoles[i])) < 0)
1434
            goto cleanup;
1435

1436
    rc = virLXCControllerMain(ctrl);
1437

1438 1439
    virLXCControllerEventSendExit(ctrl, rc);

1440
cleanup:
1441 1442
    VIR_FORCE_CLOSE(control[0]);
    VIR_FORCE_CLOSE(control[1]);
1443 1444
    VIR_FORCE_CLOSE(containerhandshake[0]);
    VIR_FORCE_CLOSE(containerhandshake[1]);
1445

1446 1447 1448
    for (i = 0 ; i < ctrl->nconsoles ; i++)
        VIR_FREE(containerTTYPaths[i]);
    VIR_FREE(containerTTYPaths);
1449

1450
    virLXCControllerStopInit(ctrl);
1451

1452 1453 1454 1455
    return rc;
}


1456
int main(int argc, char *argv[])
1457 1458
{
    pid_t pid;
1459 1460
    int rc = 1;
    char *name = NULL;
1461
    size_t nveths = 0;
1462
    char **veths = NULL;
1463
    int handshakeFd = -1;
1464
    int bg = 0;
1465
    const struct option options[] = {
1466 1467 1468 1469
        { "background", 0, NULL, 'b' },
        { "name",   1, NULL, 'n' },
        { "veth",   1, NULL, 'v' },
        { "console", 1, NULL, 'c' },
1470
        { "handshakefd", 1, NULL, 's' },
1471
        { "security", 1, NULL, 'S' },
1472 1473 1474
        { "help", 0, NULL, 'h' },
        { 0, 0, 0, 0 },
    };
1475 1476
    int *ttyFDs = NULL;
    size_t nttyFDs = 0;
1477
    virLXCControllerPtr ctrl = NULL;
1478
    size_t i;
1479
    const char *securityDriver = "none";
1480

E
Eric Blake 已提交
1481 1482
    if (setlocale(LC_ALL, "") == NULL ||
        bindtextdomain(PACKAGE, LOCALEDIR) == NULL ||
1483 1484
        textdomain(PACKAGE) == NULL ||
        virRandomInitialize(time(NULL) ^ getpid())) {
E
Eric Blake 已提交
1485 1486 1487 1488
        fprintf(stderr, _("%s: initialization failed\n"), argv[0]);
        exit(EXIT_FAILURE);
    }

1489 1490 1491
    /* Initialize logging */
    virLogSetFromEnv();

1492 1493
    while (1) {
        int c;
1494

1495
        c = getopt_long(argc, argv, "dn:v:m:c:s:h:S:",
1496 1497 1498 1499 1500 1501 1502 1503 1504 1505 1506 1507
                       options, NULL);

        if (c == -1)
            break;

        switch (c) {
        case 'b':
            bg = 1;
            break;

        case 'n':
            if ((name = strdup(optarg)) == NULL) {
1508
                virReportOOMError();
1509
                goto cleanup;
1510
            }
1511 1512 1513 1514
            break;

        case 'v':
            if (VIR_REALLOC_N(veths, nveths+1) < 0) {
1515
                virReportOOMError();
1516
                goto cleanup;
1517
            }
1518
            if ((veths[nveths++] = strdup(optarg)) == NULL) {
1519
                virReportOOMError();
1520
                goto cleanup;
1521
            }
1522 1523 1524
            break;

        case 'c':
1525 1526 1527 1528 1529
            if (VIR_REALLOC_N(ttyFDs, nttyFDs + 1) < 0) {
                virReportOOMError();
                goto cleanup;
            }
            if (virStrToLong_i(optarg, NULL, 10, &ttyFDs[nttyFDs++]) < 0) {
1530 1531 1532 1533 1534
                fprintf(stderr, "malformed --console argument '%s'", optarg);
                goto cleanup;
            }
            break;

1535
        case 's':
1536
            if (virStrToLong_i(optarg, NULL, 10, &handshakeFd) < 0) {
1537 1538 1539 1540 1541 1542
                fprintf(stderr, "malformed --handshakefd argument '%s'",
                        optarg);
                goto cleanup;
            }
            break;

1543
        case 'S':
1544
            securityDriver = optarg;
1545 1546
            break;

1547 1548 1549 1550 1551 1552 1553 1554 1555 1556 1557
        case 'h':
        case '?':
            fprintf(stderr, "\n");
            fprintf(stderr, "syntax: %s [OPTIONS]\n", argv[0]);
            fprintf(stderr, "\n");
            fprintf(stderr, "Options\n");
            fprintf(stderr, "\n");
            fprintf(stderr, "  -b, --background\n");
            fprintf(stderr, "  -n NAME, --name NAME\n");
            fprintf(stderr, "  -c FD, --console FD\n");
            fprintf(stderr, "  -v VETH, --veth VETH\n");
1558
            fprintf(stderr, "  -s FD, --handshakefd FD\n");
1559
            fprintf(stderr, "  -S NAME, --security NAME\n");
1560 1561 1562
            fprintf(stderr, "  -h, --help\n");
            fprintf(stderr, "\n");
            goto cleanup;
1563 1564 1565
        }
    }

1566 1567 1568 1569 1570
    if (name == NULL) {
        fprintf(stderr, "%s: missing --name argument for configuration\n", argv[0]);
        goto cleanup;
    }

1571
    if (handshakeFd < 0) {
1572 1573 1574 1575 1576
        fprintf(stderr, "%s: missing --handshake argument for container PTY\n",
                argv[0]);
        goto cleanup;
    }

1577
    if (getuid() != 0) {
1578 1579 1580
        fprintf(stderr, "%s: must be run as the 'root' user\n", argv[0]);
        goto cleanup;
    }
1581

1582 1583
    virEventRegisterDefaultImpl();

1584
    if (!(ctrl = virLXCControllerNew(name)))
1585
        goto cleanup;
1586

1587 1588
    ctrl->handshakeFd = handshakeFd;

1589 1590 1591 1592 1593
    if (!(ctrl->securityManager = virSecurityManagerNew(securityDriver,
                                                        LXC_DRIVER_NAME,
                                                        false, false, false)))
        goto cleanup;

1594
    VIR_DEBUG("Security model %s type %s label %s imagelabel %s",
1595 1596 1597 1598
              NULLSTR(ctrl->def->seclabel.model),
              virDomainSeclabelTypeToString(ctrl->def->seclabel.type),
              NULLSTR(ctrl->def->seclabel.label),
              NULLSTR(ctrl->def->seclabel.imagelabel));
1599

1600 1601 1602
    ctrl->veths = veths;
    ctrl->nveths = nveths;

1603 1604 1605 1606 1607 1608
    for (i = 0 ; i < nttyFDs ; i++) {
        if (virLXCControllerAddConsole(ctrl, ttyFDs[i]) < 0)
            goto cleanup;
        ttyFDs[i] = -1;
    }

1609
    if (virLXCControllerValidateNICs(ctrl) < 0)
1610
        goto cleanup;
1611

1612 1613 1614
    if (virLXCControllerValidateConsoles(ctrl) < 0)
        goto cleanup;

1615
    if (virLXCControllerSetupServer(ctrl) < 0)
1616
        goto cleanup;
1617

1618 1619 1620
    if (bg) {
        if ((pid = fork()) < 0)
            goto cleanup;
1621

1622
        if (pid > 0) {
1623
            if ((rc = virPidFileWrite(LXC_STATE_DIR, name, pid)) < 0) {
1624
                virReportSystemError(-rc,
1625 1626
                                     _("Unable to write pid file '%s/%s.pid'"),
                                     LXC_STATE_DIR, name);
1627 1628
                _exit(1);
            }
1629

1630 1631 1632 1633
            /* First child now exits, allowing original caller
             * (ie libvirtd's LXC driver to complete their
             * waitpid & continue */
            _exit(0);
1634 1635
        }

1636 1637
        /* Don't hold onto any cwd we inherit from libvirtd either */
        if (chdir("/") < 0) {
1638
            virReportSystemError(errno, "%s",
1639
                                 _("Unable to change to root dir"));
1640 1641 1642 1643
            goto cleanup;
        }

        if (setsid() < 0) {
1644
            virReportSystemError(errno, "%s",
1645
                                 _("Unable to become session leader"));
1646 1647 1648
            goto cleanup;
        }
    }
1649

1650
    rc = virLXCControllerRun(ctrl);
1651

1652
cleanup:
1653
    virPidFileDelete(LXC_STATE_DIR, name);
1654
    virLXCControllerDeleteInterfaces(ctrl);
1655 1656 1657 1658
    for (i = 0 ; i < nttyFDs ; i++)
        VIR_FORCE_CLOSE(ttyFDs[i]);
    VIR_FREE(ttyFDs);

1659
    virLXCControllerFree(ctrl);
1660

1661
    return rc < 0? EXIT_FAILURE : EXIT_SUCCESS;
1662
}