[lxc-devel] [PATCH] Parse rootfs->path
Christian Brauner
christianvanbrauner at gmail.com
Sat Oct 17 13:26:29 UTC 2015
The mount_entry_overlay_dirs() and mount_entry_aufs_dirs() functions create
workdirs and upperdirs for overlay and aufs lxc.mount.entry entries. They try
to make sure that the workdirs and upperdirs can only be created under the
containerdir (e.g. /path/to/the/container/CONTAINERNAME). In order to do this
the right hand side of
if ((strncmp(upperdir, lxcpath, dirlen) == 0) && (strncmp(upperdir, rootfs->path, rootfslen) != 0))
was thought to check if the rootfs->path is not present in the workdir and
upperdir mount options. But the current check is bogus since it will be
trivially true whenever the container is a block-dev or overlay or aufs backed
since the rootfs->path will then have a form like e.g.
overlayfs:/some/path:/some/other/path
This patch parses rootfs->path by searching backwards for the first occurrence
of the delimiter pair ":/". We do not simply search for ":" since it might be
used in path names.
Signed-off-by: Christian Brauner <christianvanbrauner at gmail.com>
---
src/lxc/conf.c | 126 ++++++++++++++++++++++++++++++++++++++++++++++-----------
1 file changed, 103 insertions(+), 23 deletions(-)
diff --git a/src/lxc/conf.c b/src/lxc/conf.c
index 16a62f8..a730a67 100644
--- a/src/lxc/conf.c
+++ b/src/lxc/conf.c
@@ -1821,6 +1821,11 @@ static int mount_entry_create_overlay_dirs(const struct mntent *mntent,
const char *lxc_path)
{
char lxcpath[MAXPATHLEN];
+ char *end = NULL;
+ char *rootfsdir = NULL;
+ char *s = NULL;
+ char *s1 = NULL;
+ char *tmp = NULL;
char *upperdir = NULL;
char *workdir = NULL;
char **opts = NULL;
@@ -1830,15 +1835,16 @@ static int mount_entry_create_overlay_dirs(const struct mntent *mntent,
size_t i;
size_t len = 0;
size_t rootfslen = 0;
+ size_t slen = 0;
if (!rootfs->path || !lxc_name || !lxc_path)
- return -1;
+ goto err;
opts = lxc_string_split(mntent->mnt_opts, ',');
if (opts)
arrlen = lxc_array_len((void **)opts);
else
- return -1;
+ goto err;
for (i = 0; i < arrlen; i++) {
if (strstr(opts[i], "upperdir=") && (strlen(opts[i]) > (len = strlen("upperdir="))))
@@ -1848,31 +1854,66 @@ static int mount_entry_create_overlay_dirs(const struct mntent *mntent,
}
ret = snprintf(lxcpath, MAXPATHLEN, "%s/%s", lxc_path, lxc_name);
- if (ret < 0 || ret >= MAXPATHLEN) {
- lxc_free_array((void **)opts, free);
- return -1;
- }
+ if (ret < 0 || ret >= MAXPATHLEN)
+ goto err;
dirlen = strlen(lxcpath);
- rootfslen = strlen(rootfs->path);
+
+ s = strdup(rootfs->path);
+ if (!s)
+ goto err;
+
+ s1 = malloc(strlen(rootfs->path) + 1);
+ if (!s1)
+ goto err;
+ end = stpcpy(s1, rootfs->path);
+
+ /* If we find :/ in rootfs->path it means we either have a block-dev or
+ * overlay or aufs container. */
+ while ((tmp = strrchr(s, ':'))) {
+ len = strlen(tmp);
+ rootfslen += len;
+ if (strncmp(tmp, ":/", 2) == 0) {
+ rootfsdir = end - rootfslen + 1;
+ rootfslen = strlen(rootfsdir);
+ break;
+ } else {
+ slen = strlen(s);
+ s[slen - len] = '\0';
+ }
+ }
+
+ /* If rootfsdir is empty at this point we have a simple directory
+ * container. */
+ if (!rootfsdir) {
+ rootfsdir = rootfs->path;
+ rootfslen = strlen(rootfs->path);
+ }
/* We neither allow users to create upperdirs and workdirs outside the
* containerdir nor inside the rootfs. The latter might be debatable. */
if (upperdir)
- if ((strncmp(upperdir, lxcpath, dirlen) == 0) && (strncmp(upperdir, rootfs->path, rootfslen) != 0))
+ if ((strncmp(upperdir, lxcpath, dirlen) == 0) && (strncmp(upperdir, rootfsdir, rootfslen) != 0))
if (mkdir_p(upperdir, 0755) < 0) {
WARN("Failed to create upperdir");
}
if (workdir)
- if ((strncmp(workdir, lxcpath, dirlen) == 0) && (strncmp(workdir, rootfs->path, rootfslen) != 0))
+ if ((strncmp(workdir, lxcpath, dirlen) == 0) && (strncmp(workdir, rootfsdir, rootfslen) != 0))
if (mkdir_p(workdir, 0755) < 0) {
WARN("Failed to create workdir");
}
+ free(s);
+ free(s1);
lxc_free_array((void **)opts, free);
return 0;
+err:
+ free(s);
+ free(s1);
+ lxc_free_array((void **)opts, free);
+ return -1;
}
static int mount_entry_create_aufs_dirs(const struct mntent *mntent,
@@ -1881,6 +1922,10 @@ static int mount_entry_create_aufs_dirs(const struct mntent *mntent,
const char *lxc_path)
{
char lxcpath[MAXPATHLEN];
+ char *end = NULL;
+ char *rootfsdir = NULL;
+ char *s = NULL;
+ char *s1 = NULL;
char *scratch = NULL;
char *tmp = NULL;
char *upperdir = NULL;
@@ -1889,44 +1934,79 @@ static int mount_entry_create_aufs_dirs(const struct mntent *mntent,
size_t arrlen = 0;
size_t i;
size_t len = 0;
+ size_t rootfslen = 0;
+ size_t slen = 0;
if (!rootfs->path || !lxc_name || !lxc_path)
- return -1;
+ goto err;
opts = lxc_string_split(mntent->mnt_opts, ',');
if (opts)
arrlen = lxc_array_len((void **)opts);
else
- return -1;
+ goto err;
for (i = 0; i < arrlen; i++) {
if (strstr(opts[i], "br=") && (strlen(opts[i]) > (len = strlen("br="))))
tmp = opts[i] + len;
}
- if (!tmp) {
- lxc_free_array((void **)opts, free);
- return -1;
- }
+ if (!tmp)
+ goto err;
upperdir = strtok_r(tmp, ":=", &scratch);
- if (!upperdir) {
- lxc_free_array((void **)opts, free);
- return -1;
- }
+ if (!upperdir)
+ goto err;
ret = snprintf(lxcpath, MAXPATHLEN, "%s/%s", lxc_path, lxc_name);
- if (ret < 0 || ret >= MAXPATHLEN) {
- lxc_free_array((void **)opts, free);
- return -1;
+ if (ret < 0 || ret >= MAXPATHLEN)
+ goto err;
+
+ s = strdup(rootfs->path);
+ if (!s)
+ goto err;
+
+ s1 = malloc(strlen(rootfs->path) + 1);
+ if (!s1)
+ goto err;
+ end = stpcpy(s1, rootfs->path);
+
+ /* If we find :/ in rootfs->path it means we either have a block-dev or
+ * overlay or aufs container. */
+ while ((tmp = strrchr(s, ':'))) {
+ len = strlen(tmp);
+ rootfslen += len;
+ if (strncmp(tmp, ":/", 2) == 0) {
+ rootfsdir = end - rootfslen + 1;
+ rootfslen = strlen(rootfsdir);
+ break;
+ } else {
+ slen = strlen(s);
+ s[slen - len] = '\0';
+ }
+ }
+
+ /* If rootfsdir is empty at this point we have a simple directory
+ * container. */
+ if (!rootfsdir) {
+ rootfsdir = rootfs->path;
+ rootfslen = strlen(rootfs->path);
}
/* We neither allow users to create upperdirs outside the containerdir
* nor inside the rootfs. The latter might be debatable. */
- if ((strncmp(upperdir, lxcpath, strlen(lxcpath)) == 0) && (strncmp(upperdir, rootfs->path, strlen(rootfs->path)) != 0))
+ if ((strncmp(upperdir, lxcpath, strlen(lxcpath)) == 0) && (strncmp(upperdir, rootfsdir, rootfslen) != 0))
if (mkdir_p(upperdir, 0755) < 0) {
WARN("Failed to create upperdir");
}
+ free(s);
+ free(s1);
+ lxc_free_array((void **)opts, free);
+ return 0;
+
+err:
+ free(s);
+ free(s1);
lxc_free_array((void **)opts, free);
return 0;
}
--
2.6.1
More information about the lxc-devel
mailing list