/
conf.h
452 lines (393 loc) · 13.6 KB
/
conf.h
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
/*
* lxc: linux Container library
*
* (C) Copyright IBM Corp. 2007, 2008
*
* Authors:
* Daniel Lezcano <daniel.lezcano at free.fr>
*
* This library is free software; you can redistribute it and/or
* modify it under the terms of the GNU Lesser General Public
* License as published by the Free Software Foundation; either
* version 2.1 of the License, or (at your option) any later version.
*
* This library is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
* Lesser General Public License for more details.
*
* You should have received a copy of the GNU Lesser General Public
* License along with this library; if not, write to the Free Software
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
*/
#ifndef __LXC_CONF_H
#define __LXC_CONF_H
#include "config.h"
#include <stdio.h>
#include <net/if.h>
#include <netinet/in.h>
#include <sys/param.h>
#include <sys/types.h>
#if HAVE_SYS_RESOURCE_H
#include <sys/resource.h>
#endif
#include <stdbool.h>
#include "list.h"
#include "ringbuf.h"
#include "start.h" /* for lxc_handler */
#include "terminal.h"
#if HAVE_SCMP_FILTER_CTX
typedef void * scmp_filter_ctx;
#endif
/* worth moving to configure.ac? */
#define subuidfile "/etc/subuid"
#define subgidfile "/etc/subgid"
/*
* Defines a generic struct to configure the control group. It is up to the
* programmer to specify the right subsystem.
* @subsystem : the targeted subsystem
* @value : the value to set
* @version : The version of the cgroup filesystem on which the controller
* resides.
*
* @controllers : The controllers to use for this container.
* @dir : The name of the directory containing the container's cgroup.
* Not that this is a per-container setting.
*/
struct lxc_cgroup {
union {
/* information about a specific controller */
struct /* controller */ {
int version;
char *subsystem;
char *value;
};
/* meta information about cgroup configuration */
struct /* meta */ {
char *controllers;
char *dir;
};
};
};
#if !HAVE_SYS_RESOURCE_H
#define RLIM_INFINITY ((unsigned long)-1)
struct rlimit {
unsigned long rlim_cur;
unsigned long rlim_max;
};
#endif
/*
* Defines a structure to configure resource limits to set via setrlimit().
* @resource : the resource name in lowercase without the RLIMIT_ prefix
* @limit : the limit to set
*/
struct lxc_limit {
char *resource;
struct rlimit limit;
};
enum idtype {
ID_TYPE_UID,
ID_TYPE_GID
};
/*
* Defines a structure to configure kernel parameters at runtime.
* @key : the kernel parameters will be configured without the "lxc.sysctl" prefix
* @value : the value to set
*/
struct lxc_sysctl {
char *key;
char *value;
};
/*
* Defines a structure to configure proc filesystem at runtime.
* @filename : the proc filesystem will be configured without the "lxc.proc" prefix
* @value : the value to set
*/
struct lxc_proc {
char *filename;
char *value;
};
/*
* id_map is an id map entry. Form in confile is:
* lxc.idmap = u 0 9800 100
* lxc.idmap = u 1000 9900 100
* lxc.idmap = g 0 9800 100
* lxc.idmap = g 1000 9900 100
* meaning the container can use uids and gids 0-99 and 1000-1099,
* with [ug]id 0 mapping to [ug]id 9800 on the host, and [ug]id 1000 to
* [ug]id 9900 on the host.
*/
struct id_map {
enum idtype idtype;
unsigned long hostid, nsid, range;
};
/* Defines the number of tty configured and contains the
* instantiated ptys
* @max = number of configured ttys
*/
struct lxc_tty_info {
size_t max;
char *dir;
char *tty_names;
struct lxc_terminal_info *tty;
};
/* Defines a structure to store the rootfs location, the
* optionals pivot_root, rootfs mount paths
* @path : the rootfs source (directory or device)
* @mount : where it is mounted
* @options : mount options
* @bev_type : optional backing store type
*/
struct lxc_rootfs {
char *path;
char *mount;
char *options;
char *bdev_type;
};
/*
* Automatic mounts for LXC to perform inside the container
*/
enum {
LXC_AUTO_PROC_RW = 0x001, /* /proc read-write */
LXC_AUTO_PROC_MIXED = 0x002, /* /proc/sys and /proc/sysrq-trigger read-only */
LXC_AUTO_PROC_MASK = 0x003,
LXC_AUTO_SYS_RW = 0x004, /* /sys */
LXC_AUTO_SYS_RO = 0x008, /* /sys read-only */
LXC_AUTO_SYS_MIXED = 0x00C, /* /sys read-only and /sys/class/net read-write */
LXC_AUTO_SYS_MASK = 0x00C,
LXC_AUTO_CGROUP_RO = 0x010, /* /sys/fs/cgroup (partial mount, read-only) */
LXC_AUTO_CGROUP_RW = 0x020, /* /sys/fs/cgroup (partial mount, read-write) */
LXC_AUTO_CGROUP_MIXED = 0x030, /* /sys/fs/cgroup (partial mount, paths r/o, cgroup r/w) */
LXC_AUTO_CGROUP_FULL_RO = 0x040, /* /sys/fs/cgroup (full mount, read-only) */
LXC_AUTO_CGROUP_FULL_RW = 0x050, /* /sys/fs/cgroup (full mount, read-write) */
LXC_AUTO_CGROUP_FULL_MIXED = 0x060, /* /sys/fs/cgroup (full mount, parent r/o, own r/w) */
/*
* These are defined in such a way as to retain binary compatibility
* with earlier versions of this code. If the previous mask is applied,
* both of these will default back to the _MIXED variants, which is
* safe.
*/
LXC_AUTO_CGROUP_NOSPEC = 0x0B0, /* /sys/fs/cgroup (partial mount, r/w or mixed, depending on caps) */
LXC_AUTO_CGROUP_FULL_NOSPEC = 0x0E0, /* /sys/fs/cgroup (full mount, r/w or mixed, depending on caps) */
LXC_AUTO_CGROUP_FORCE = 0x100, /* mount cgroups even when cgroup namespaces are supported */
LXC_AUTO_CGROUP_MASK = 0x1F0, /* all known cgroup options, doe not contain LXC_AUTO_CGROUP_FORCE */
LXC_AUTO_SHMOUNTS = 0x200, /* shared mount point */
LXC_AUTO_SHMOUNTS_MASK = 0x200, /* shared mount point mask */
LXC_AUTO_ALL_MASK = 0x1FF, /* all known settings */
};
enum lxchooks {
LXCHOOK_PRESTART,
LXCHOOK_PREMOUNT,
LXCHOOK_MOUNT,
LXCHOOK_AUTODEV,
LXCHOOK_START,
LXCHOOK_STOP,
LXCHOOK_POSTSTOP,
LXCHOOK_CLONE,
LXCHOOK_DESTROY,
LXCHOOK_START_HOST,
NUM_LXC_HOOKS
};
extern char *lxchook_names[NUM_LXC_HOOKS];
struct lxc_state_client {
int clientfd;
lxc_state_t states[MAX_STATE];
};
struct lxc_conf {
/* Pointer to the name of the container. Do not free! */
const char *name;
bool is_execute;
int reboot;
signed long personality;
struct utsname *utsname;
struct {
struct lxc_list cgroup;
struct lxc_list cgroup2;
};
struct {
struct lxc_list id_map;
/*
* Pointer to the idmap entry for the container's root uid in
* the id_map list. Do not free!
*/
const struct id_map *root_nsuid_map;
/*
* Pointer to the idmap entry for the container's root gid in
* the id_map list. Do not free!
*/
const struct id_map *root_nsgid_map;
};
struct lxc_list network;
struct {
char *fstab;
int auto_mounts;
struct lxc_list mount_list;
};
struct lxc_list caps;
struct lxc_list keepcaps;
/* /dev/tty<idx> devices */
struct lxc_tty_info ttys;
/* /dev/console device */
struct lxc_terminal console;
/* maximum pty devices allowed by devpts mount */
size_t pty_max;
/* set to true when rootfs has been setup */
bool rootfs_setup;
struct lxc_rootfs rootfs;
bool close_all_fds;
struct {
unsigned int hooks_version;
struct lxc_list hooks[NUM_LXC_HOOKS];
};
char *lsm_aa_profile;
char *lsm_aa_profile_computed;
bool lsm_aa_profile_created;
unsigned int lsm_aa_allow_nesting;
unsigned int lsm_aa_allow_incomplete;
struct lxc_list lsm_aa_raw;
char *lsm_se_context;
bool tmp_umount_proc;
char *seccomp; /* filename with the seccomp rules */
#if HAVE_SCMP_FILTER_CTX
scmp_filter_ctx seccomp_ctx;
#endif
int maincmd_fd;
unsigned int autodev; /* if 1, mount and fill a /dev at start */
int haltsignal; /* signal used to halt container */
int rebootsignal; /* signal used to reboot container */
int stopsignal; /* signal used to hard stop container */
char *rcfile; /* Copy of the top level rcfile we read */
/* Logfile and logleve can be set in a container config file. Those
* function as defaults. The defaults can be overriden by command line.
* However we don't want the command line specified values to be saved
* on c->save_config(). So we store the config file specified values
* here. */
char *logfile; /* the logfile as specifed in config */
int loglevel; /* loglevel as specifed in config (if any) */
int logfd;
unsigned int start_auto;
unsigned int start_delay;
int start_order;
struct lxc_list groups;
int nbd_idx;
/* unshare the mount namespace in the monitor */
unsigned int monitor_unshare;
unsigned int monitor_signal_pdeath;
/* list of included files */
struct lxc_list includes;
/* config entries which are not "lxc.*" are aliens */
struct lxc_list aliens;
/* list of environment variables we'll add to the container when
* started */
struct lxc_list environment;
/* text representation of the config file */
char *unexpanded_config;
size_t unexpanded_len;
size_t unexpanded_alloced;
/* default command for lxc-execute */
char *execute_cmd;
/* init command */
char *init_cmd;
/* if running in a new user namespace, the UID/GID that init and COMMAND
* should run under when using lxc-execute */
uid_t init_uid;
gid_t init_gid;
/* indicator if the container will be destroyed on shutdown */
unsigned int ephemeral;
/* The facility to pass to syslog. Let's users establish as what type of
* program liblxc is supposed to write to the syslog. */
char *syslog;
/* Whether PR_SET_NO_NEW_PRIVS will be set for the container. */
bool no_new_privs;
/* RLIMIT_* limits */
struct lxc_list limits;
/* Contains generic info about the cgroup configuration for this
* container. Note that struct lxc_cgroup contains a union. It is only
* valid to access the members of the anonymous "meta" struct within
* that union.
*/
struct lxc_cgroup cgroup_meta;
struct {
int ns_clone;
int ns_keep;
char *ns_share[LXC_NS_MAX];
};
/* init working directory */
char *init_cwd;
/* A list of clients registered to be informed about a container state. */
struct lxc_list state_clients;
/* sysctls */
struct lxc_list sysctls;
/* procs */
struct lxc_list procs;
struct shmount {
/* Absolute path to the shared mount point on the host */
char *path_host;
/* Absolute path (in the container) to the shared mount point */
char *path_cont;
} shmount;
};
extern int write_id_mapping(enum idtype idtype, pid_t pid, const char *buf,
size_t buf_size);
#ifdef HAVE_TLS
extern __thread struct lxc_conf *current_config;
#else
extern struct lxc_conf *current_config;
#endif
extern int run_lxc_hooks(const char *name, char *hook, struct lxc_conf *conf,
char *argv[]);
extern int detect_shared_rootfs(void);
extern struct lxc_conf *lxc_conf_init(void);
extern void lxc_conf_free(struct lxc_conf *conf);
extern int pin_rootfs(const char *rootfs);
extern int lxc_map_ids(struct lxc_list *idmap, pid_t pid);
extern int lxc_create_tty(const char *name, struct lxc_conf *conf);
extern void lxc_delete_tty(struct lxc_tty_info *ttys);
extern int lxc_clear_config_caps(struct lxc_conf *c);
extern int lxc_clear_config_keepcaps(struct lxc_conf *c);
extern int lxc_clear_cgroups(struct lxc_conf *c, const char *key, int version);
extern int lxc_clear_mount_entries(struct lxc_conf *c);
extern int lxc_clear_automounts(struct lxc_conf *c);
extern int lxc_clear_hooks(struct lxc_conf *c, const char *key);
extern int lxc_clear_idmaps(struct lxc_conf *c);
extern int lxc_clear_groups(struct lxc_conf *c);
extern int lxc_clear_environment(struct lxc_conf *c);
extern int lxc_clear_limits(struct lxc_conf *c, const char *key);
extern int lxc_delete_autodev(struct lxc_handler *handler);
extern void lxc_clear_includes(struct lxc_conf *conf);
extern int lxc_setup_rootfs_prepare_root(struct lxc_conf *conf,
const char *name, const char *lxcpath);
extern int lxc_setup(struct lxc_handler *handler);
extern int lxc_setup_parent(struct lxc_handler *handler);
extern int setup_resource_limits(struct lxc_list *limits, pid_t pid);
extern int find_unmapped_nsid(struct lxc_conf *conf, enum idtype idtype);
extern int mapped_hostid(unsigned id, struct lxc_conf *conf,
enum idtype idtype);
extern int chown_mapped_root(const char *path, struct lxc_conf *conf);
extern int userns_exec_1(struct lxc_conf *conf, int (*fn)(void *), void *data,
const char *fn_name);
extern int userns_exec_full(struct lxc_conf *conf, int (*fn)(void *),
void *data, const char *fn_name);
extern int parse_mntopts(const char *mntopts, unsigned long *mntflags,
char **mntdata);
extern int parse_propagationopts(const char *mntopts, unsigned long *pflags);
extern void tmp_proc_unmount(struct lxc_conf *lxc_conf);
extern void remount_all_slave(void);
extern void suggest_default_idmap(void);
extern FILE *make_anonymous_mount_file(struct lxc_list *mount,
bool include_nesting_helpers);
extern struct lxc_list *sort_cgroup_settings(struct lxc_list *cgroup_settings);
extern unsigned long add_required_remount_flags(const char *s, const char *d,
unsigned long flags);
extern int run_script(const char *name, const char *section, const char *script,
...);
extern int run_script_argv(const char *name, unsigned int hook_version,
const char *section, const char *script,
const char *hookname, char **argsin);
extern int in_caplist(int cap, struct lxc_list *caps);
extern int setup_sysctl_parameters(struct lxc_list *sysctls);
extern int lxc_clear_sysctls(struct lxc_conf *c, const char *key);
extern int setup_proc_filesystem(struct lxc_list *procs, pid_t pid);
extern int lxc_clear_procs(struct lxc_conf *c, const char *key);
extern int lxc_clear_apparmor_raw(struct lxc_conf *c);
#endif /* __LXC_CONF_H */