lxc_attach.c revision 13f5be6276100761eaeddd77b7b55fbec6b0c9ab
0N/A/*
20N/A * lxc: linux Container library
20N/A *
20N/A * (C) Copyright IBM Corp. 2007, 2010
20N/A *
20N/A * Authors:
20N/A * Daniel Lezcano <dlezcano at fr.ibm.com>
20N/A *
20N/A * This library is free software; you can redistribute it and/or
20N/A * modify it under the terms of the GNU Lesser General Public
20N/A * License as published by the Free Software Foundation; either
20N/A * version 2.1 of the License, or (at your option) any later version.
20N/A *
20N/A * This library is distributed in the hope that it will be useful,
20N/A * but WITHOUT ANY WARRANTY; without even the implied warranty of
20N/A * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
20N/A * Lesser General Public License for more details.
20N/A *
20N/A * You should have received a copy of the GNU Lesser General Public
20N/A * License along with this library; if not, write to the Free Software
20N/A * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
260N/A */
20N/A
20N/A#define _GNU_SOURCE
20N/A#include <unistd.h>
22N/A#include <errno.h>
0N/A#include <pwd.h>
50N/A#include <stdlib.h>
50N/A#include <sys/param.h>
50N/A#include <sys/types.h>
50N/A#include <sys/wait.h>
50N/A
50N/A#include "attach.h"
50N/A#include "commands.h"
50N/A#include "arguments.h"
50N/A#include "caps.h"
50N/A#include "cgroup.h"
50N/A#include "config.h"
50N/A#include "confile.h"
50N/A#include "start.h"
50N/A#include "sync.h"
50N/A#include "log.h"
50N/A#include "namespace.h"
382N/A
382N/A#if HAVE_SYS_PERSONALITY_H
382N/A#include <sys/personality.h>
382N/A#endif
382N/A
382N/Alxc_log_define(lxc_attach_ui, lxc);
382N/A
382N/Astatic const struct option my_longopts[] = {
382N/A {"elevated-privileges", no_argument, 0, 'e'},
382N/A {"arch", required_argument, 0, 'a'},
382N/A {"namespaces", required_argument, 0, 's'},
382N/A {"remount-sys-proc", no_argument, 0, 'R'},
382N/A LXC_COMMON_OPTIONS
382N/A};
382N/A
382N/Astatic int elevated_privileges = 0;
382N/Astatic signed long new_personality = -1;
382N/Astatic int namespace_flags = -1;
382N/Astatic int remount_sys_proc = 0;
382N/A
382N/Astatic int my_parser(struct lxc_arguments* args, int c, char* arg)
26N/A{
0N/A int ret;
52N/A
0N/A switch (c) {
382N/A case 'e': elevated_privileges = 1; break;
382N/A case 'R': remount_sys_proc = 1; break;
382N/A case 'a':
382N/A new_personality = lxc_config_parse_arch(arg);
382N/A if (new_personality < 0) {
382N/A lxc_error(args, "invalid architecture specified: %s", arg);
382N/A return -1;
382N/A }
382N/A break;
382N/A case 's':
382N/A namespace_flags = 0;
22N/A ret = lxc_fill_namespace_flags(arg, &namespace_flags);
114N/A if (ret)
26N/A return -1;
382N/A /* -s implies -e */
382N/A elevated_privileges = 1;
23N/A break;
26N/A }
26N/A
157N/A return 0;
382N/A}
382N/A
135N/Astatic struct lxc_arguments my_args = {
157N/A .progname = "lxc-attach",
26N/A .help = "\
135N/A--name=NAME\n\
14N/A\n\
382N/AExecute the specified command - enter the container NAME\n\
382N/A\n\
14N/AOptions :\n\
382N/A -n, --name=NAME NAME for name of the container\n\
382N/A -e, --elevated-privileges\n\
382N/A Use elevated privileges (capabilities, cgroup\n\
30N/A restrictions) instead of those of the container.\n\
382N/A WARNING: This may leak privleges into the container.\n\
30N/A Use with care.\n\
382N/A -a, --arch=ARCH Use ARCH for program instead of container's own\n\
382N/A architecture.\n\
382N/A -s, --namespaces=FLAGS\n\
382N/A Don't attach to all the namespaces of the container\n\
382N/A but just to the following OR'd list of flags:\n\
258N/A MOUNT, PID, UTSNAME, IPC, USER or NETWORK\n\
382N/A WARNING: Using -s implies -e, it may therefore\n\
382N/A leak privileges into the container. Use with care.\n\
382N/A -R, --remount-sys-proc\n\
382N/A Remount /sys and /proc if not attaching to the\n\
30N/A mount namespace when using -s in order to properly\n\
54N/A reflect the correct namespace context. See the\n\
382N/A lxc-attach(1) manual page for details.\n",
382N/A .options = my_longopts,
157N/A .parser = my_parser,
135N/A .checker = NULL,
382N/A};
382N/A
382N/Aint main(int argc, char *argv[])
382N/A{
382N/A int ret;
382N/A pid_t pid, init_pid;
135N/A struct passwd *passwd;
135N/A struct lxc_proc_context_info *init_ctx;
135N/A struct lxc_handler *handler;
382N/A void *cgroup_data = NULL;
135N/A uid_t uid;
135N/A char *curdir;
382N/A /* TODO: add cmdline arg to set lxcpath */
382N/A const char *lxcpath = NULL;
382N/A
382N/A ret = lxc_caps_init();
382N/A if (ret)
382N/A return ret;
382N/A
382N/A ret = lxc_arguments_parse(&my_args, argc, argv);
382N/A if (ret)
382N/A return ret;
135N/A
382N/A ret = lxc_log_init(my_args.name, my_args.log_file, my_args.log_priority,
157N/A my_args.progname, my_args.quiet);
382N/A if (ret)
135N/A return ret;
382N/A
382N/A init_pid = get_init_pid(my_args.name, lxcpath);
382N/A if (init_pid < 0) {
382N/A ERROR("failed to get the init pid");
382N/A return -1;
382N/A }
382N/A
382N/A init_ctx = lxc_proc_get_context_info(init_pid);
135N/A if (!init_ctx) {
135N/A ERROR("failed to get context of the init process, pid = %d", init_pid);
382N/A return -1;
382N/A }
382N/A
382N/A if (!elevated_privileges) {
382N/A /* we have to do this now since /sys/fs/cgroup may not
382N/A * be available inside the container or we may not have
382N/A * the required permissions anymore
382N/A */
382N/A ret = lxc_cgroup_prepare_attach(my_args.name, &cgroup_data);
382N/A if (ret < 0) {
382N/A ERROR("failed to prepare attaching to cgroup");
382N/A return -1;
382N/A }
382N/A }
382N/A
382N/A curdir = getcwd(NULL, 0);
382N/A
382N/A /* determine which namespaces the container was created with
382N/A * by asking lxc-start
382N/A */
382N/A if (namespace_flags == -1) {
26N/A namespace_flags = lxc_get_clone_flags(my_args.name, lxcpath);
26N/A /* call failed */
26N/A if (namespace_flags == -1) {
382N/A ERROR("failed to automatically determine the "
382N/A "namespaces which the container unshared");
382N/A return -1;
382N/A }
382N/A }
382N/A
382N/A /* we need to attach before we fork since certain namespaces
382N/A * (such as pid namespaces) only really affect children of the
382N/A * current process and not the process itself
382N/A */
382N/A ret = lxc_attach_to_ns(init_pid, namespace_flags);
382N/A if (ret < 0) {
382N/A ERROR("failed to enter the namespace");
382N/A return -1;
382N/A }
382N/A
382N/A if (curdir && chdir(curdir))
382N/A WARN("could not change directory to '%s'", curdir);
382N/A
382N/A free(curdir);
382N/A
382N/A /* hack: we need sync.h infrastructure - and that needs a handler */
382N/A handler = calloc(1, sizeof(*handler));
382N/A
382N/A if (lxc_sync_init(handler)) {
382N/A ERROR("failed to initialize synchronization socket");
382N/A return -1;
145N/A }
217N/A
382N/A pid = fork();
382N/A
382N/A if (pid < 0) {
382N/A SYSERROR("failed to fork");
382N/A return -1;
217N/A }
if (pid) {
int status;
lxc_sync_fini_child(handler);
/* wait until the child has done configuring itself before
* we put it in a cgroup that potentially limits these
* possibilities */
if (lxc_sync_wait_child(handler, LXC_SYNC_CONFIGURE))
return -1;
/* now that we are done with all privileged operations,
* we can add ourselves to the cgroup. Since we smuggled in
* the fds earlier, we still have write permission
*/
if (!elevated_privileges) {
/* since setns() for pid namespaces only really
* affects child processes, the pid we have is
* still valid outside the container, so this is
* fine
*/
ret = lxc_cgroup_finish_attach(cgroup_data, pid);
if (ret < 0) {
ERROR("failed to attach process to cgroup");
return -1;
}
}
/* tell the child we are done initializing */
if (lxc_sync_wake_child(handler, LXC_SYNC_POST_CONFIGURE))
return -1;
lxc_sync_fini(handler);
again:
if (waitpid(pid, &status, 0) < 0) {
if (errno == EINTR)
goto again;
SYSERROR("failed to wait '%d'", pid);
return -1;
}
if (WIFEXITED(status))
return WEXITSTATUS(status);
return -1;
}
if (!pid) {
lxc_sync_fini_parent(handler);
lxc_cgroup_dispose_attach(cgroup_data);
/* A description of the purpose of this functionality is
* provided in the lxc-attach(1) manual page. We have to
* remount here and not in the parent process, otherwise
* /proc may not properly reflect the new pid namespace.
*/
if (!(namespace_flags & CLONE_NEWNS) && remount_sys_proc) {
ret = lxc_attach_remount_sys_proc();
if (ret < 0) {
return -1;
}
}
#if HAVE_SYS_PERSONALITY_H
if (new_personality < 0)
new_personality = init_ctx->personality;
if (personality(new_personality) == -1) {
ERROR("could not ensure correct architecture: %s",
strerror(errno));
return -1;
}
#endif
if (!elevated_privileges && lxc_attach_drop_privs(init_ctx)) {
ERROR("could not drop privileges");
return -1;
}
/* tell parent we are done setting up the container and wait
* until we have been put in the container's cgroup, if
* applicable */
if (lxc_sync_barrier_parent(handler, LXC_SYNC_CONFIGURE))
return -1;
lxc_sync_fini(handler);
if (my_args.argc) {
execvp(my_args.argv[0], my_args.argv);
SYSERROR("failed to exec '%s'", my_args.argv[0]);
return -1;
}
uid = getuid();
passwd = getpwuid(uid);
if (!passwd) {
SYSERROR("failed to get passwd " \
"entry for uid '%d'", uid);
return -1;
}
{
char *const args[] = {
passwd->pw_shell,
NULL,
};
execvp(args[0], args);
SYSERROR("failed to exec '%s'", args[0]);
return -1;
}
}
return 0;
}