[lxc-devel] [PATCH v2 7/7] added the unmount-namespace hook
Serge Hallyn
serge.hallyn at ubuntu.com
Mon Oct 5 14:10:51 UTC 2015
Quoting Wolfgang Bumiller (w.bumiller at proxmox.com):
> Signed-off-by: Wolfgang Bumiller <w.bumiller at proxmox.com>
> ---
> hooks/Makefile.am | 6 ++
> hooks/unmount-namespace.c | 180 ++++++++++++++++++++++++++++++++++++++++++++++
> 2 files changed, 186 insertions(+)
> create mode 100644 hooks/unmount-namespace.c
>
> diff --git a/hooks/Makefile.am b/hooks/Makefile.am
> index be55601..ef82083 100644
> --- a/hooks/Makefile.am
> +++ b/hooks/Makefile.am
> @@ -6,4 +6,10 @@ hooks_SCRIPTS = \
> ubuntu-cloud-prep \
> squid-deb-proxy-client
>
> +hooks_PROGRAMS = \
> + unmount-namespace
> +
> +unmount_namespace_SOURCES = \
> + unmount-namespace.c
> +
> EXTRA_DIST=$(hooks_SCRIPTS)
> diff --git a/hooks/unmount-namespace.c b/hooks/unmount-namespace.c
> new file mode 100644
> index 0000000..aa64985
> --- /dev/null
> +++ b/hooks/unmount-namespace.c
> @@ -0,0 +1,180 @@
> +/*
> + * Copyright © 2015 Wolfgang Bumiller <w.bumiller at proxmox.com>.
> + * Copyright © 2015 Proxmox Server Solutions GmbH
> + *
> + * This program is free software; you can redistribute it and/or modify
> + * it under the terms of the GNU General Public License version 2, as
> + * published by the Free Software Foundation.
> + *
> + * This program is distributed in the hope that it will be useful,
> + * but WITHOUT ANY WARRANTY; without even the implied warranty of
> + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
> + * GNU General Public License for more details.
> + *
> + * You should have received a copy of the GNU General Public License along
> + * with this program; if not, write to the Free Software Foundation, Inc.,
> + * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
> + */
> +
A description of what the hook is intended to do would be good here.
> +#define _GNU_SOURCE /* setns */
> +#include <stdio.h> /* fdopen, getmntent, endmntent */
> +#include <stdlib.h> /* malloc, qsort */
> +#include <unistd.h> /* close */
> +#include <string.h> /* strcmp, strncmp, strdup, strerror */
> +#include <sched.h> /* setns */
> +#include <sys/mount.h> /* umount2 */
> +#include <sys/types.h> /* openat, open */
> +#include <sys/stat.h> /* openat, open */
> +#include <fcntl.h> /* openat, open */
> +#include <mntent.h> /* getmntent, endmntent */
> +#include <errno.h> /* errno */
> +
> +struct mount {
> + char *src; /* currently not used */
> + char *dst;
> + char *fs; /* currently not used */
> +};
> +
> +static void mount_free(struct mount *mnt) {
> + free(mnt->src);
> + free(mnt->dst);
> + free(mnt->fs);
> +}
> +
> +static int mount_cmp_dst(const void *a_, const void *b_) {
> + struct mount *a = (struct mount*)a_;
> + struct mount *b = (struct mount*)b_;
> + return strcmp(b->dst, a->dst); /* swapped order */
> +}
> +
> +/* Unmounting /dev/pts fails, and so /dev also fails, but /dev is not what
> + * we're interested in.
It's not inconceivable that some people are still mounting a cgroupfs onto
/dev/cgroup. You might not care about that either...
> + */
> +static int mount_should_error(const struct mount *mnt) {
> + const char *dst = mnt->dst;
> + return !(strncmp(dst, "/dev", 4) == 0 && (dst[4] == 0 || dst[4] == '/'));
> +}
> +
> +/* Read mounts from 'self/mounts' relative to a directory filedescriptor.
> + * Before entering the container we open a handle to /proc on the host as we
> + * need to access /proc/self/mounts and the container's /proc doesn't contain
> + * our /self. We then use openat(2) to avoid having to mount a temporary /proc.
> + */
> +static int read_mounts(int procfd, struct mount **mp, size_t *countp) {
> + int fd;
> + struct mntent *ent;
> + FILE *mf;
> + size_t capacity = 32;
> + size_t count = 0;
> + struct mount *mounts = (struct mount*)malloc(capacity * sizeof(*mounts));
> +
> + *mp = NULL;
> + *countp = 0;
> +
> + fd = openat(procfd, "self/mounts", O_RDONLY);
> + if (fd < 0)
> + return 0;
> +
> + mf = fdopen(fd, "r");
> + if (!mf) {
> + int error = errno;
> + close(fd);
> + errno = error;
> + return 0;
> + }
> + while ((ent = getmntent(mf))) {
> + if (count == capacity) {
> + capacity *= 2;
> + mounts = (struct mount*)realloc(mounts, capacity * sizeof(*mounts));
Need to check for allocation failure here. Cleaning up isn't terribly
important since you'll immediately exit, otherwise the normal thing to
do would be
struct mount *tmp = realloc(mounts, newsize);
if (!tmp) {
free(mounts;
endmntentmf);
return -1;
}
mounts = tmp;
> + }
> + mounts[count].src = strdup(ent->mnt_fsname);
> + mounts[count].dst = strdup(ent->mnt_dir);
> + mounts[count].fs = strdup(ent->mnt_type);
Check these too.
> + ++count;
> + }
> + endmntent(mf);
> +
> + *mp = mounts;
> + *countp = count;
> +
> + return 1;
> +}
> +
> +int main(int argc, char **argv) {
> + int i, procfd, ctmntfd;
> + struct mount *mounts;
> + size_t zi, count = 0;
> + const char *mntns = NULL;
> +
> + if (argc < 4 || strcmp(argv[2], "lxc") != 0) {
> + fprintf(stderr, "%s: usage error, expected LXC hook arguments\n", argv[0]);
> + return 2;
> + }
> +
> + if (strcmp(argv[3], "stop") != 0)
> + return 0;
> +
> + for (i = 4; i != argc; ++i) {
> + if (!strncmp(argv[i], "mnt:", 4))
> + mntns = argv[i] + 4;
(might as well break here)
> + }
> +
> + if (!mntns) {
> + fprintf(stderr, "%s: no mount namespace provided\n", argv[0]);
> + return 3;
> + }
> +
> + /* Open a handle to /proc on the host as we need to access /proc/self/mounts
> + * and the container's /proc doesn't contain our /self. See read_mounts().
> + */
> + procfd = open("/proc", O_RDONLY | O_DIRECTORY | O_PATH);
> + if (procfd < 0) {
> + fprintf(stderr, "%s: failed to open /proc: %s\n", argv[0], strerror(errno));
> + return 4;
> + }
> +
> + /* Open the mount namespace and enter it. */
> + ctmntfd = open(mntns, O_RDONLY);
> + if (ctmntfd < 0) {
> + fprintf(stderr, "%s: failed to open mount namespace: %s\n",
> + argv[0], strerror(errno));
> + close(procfd);
> + return 5;
> + }
> +
> + if (setns(ctmntfd, CLONE_NEWNS) != 0) {
> + fprintf(stderr, "%s: failed to attach to namespace: %s\n",
> + argv[0], strerror(errno));
> + close(ctmntfd);
> + close(procfd);
> + return 6;
> + }
> + close(ctmntfd);
> +
> + /* Now read [[procfd]]/self/mounts */
> + if (!read_mounts(procfd, &mounts, &count)) {
> + fprintf(stderr, "%s: failed to read mountpoints: %s\n",
> + argv[0], strerror(errno));
> + close(procfd);
> + return 7;
> + }
> + close(procfd);
> +
> + /* Just sort to get a sane unmount-order... */
> + qsort(mounts, count, sizeof(*mounts), &mount_cmp_dst);
> +
> + for (zi = 0; zi != count; ++zi) {
> + /* fprintf(stderr, "Unmount: %s\n", mounts[zi].dst); */
> + if (umount2(mounts[zi].dst, 0) != 0) {
> + int error = errno;
> + if (mount_should_error(&mounts[zi])) {
> + fprintf(stderr, "%s: failed to unmount %s: %s\n",
> + argv[0], mounts[zi].dst, strerror(error));
> + }
> + }
> + mount_free(&mounts[zi]);
> + }
> + free(mounts);
> +
> + return 0;
> +}
> --
> 2.1.4
>
>
> _______________________________________________
> lxc-devel mailing list
> lxc-devel at lists.linuxcontainers.org
> http://lists.linuxcontainers.org/listinfo/lxc-devel
More information about the lxc-devel
mailing list