[lxc-devel] [PATCH] Parse rootfs->path

Serge Hallyn serge.hallyn at ubuntu.com
Mon Oct 19 14:50:11 UTC 2015


Quoting Christian Brauner (christianvanbrauner at gmail.com):
> The mount_entry_overlay_dirs() and mount_entry_aufs_dirs() functions create
> workdirs and upperdirs for overlay and aufs lxc.mount.entry entries. They try
> to make sure that the workdirs and upperdirs can only be created under the
> containerdir (e.g. /path/to/the/container/CONTAINERNAME). In order to do this
> the right hand side of
> 
>                 if ((strncmp(upperdir, lxcpath, dirlen) == 0) && (strncmp(upperdir, rootfs->path, rootfslen) != 0))
> 
> was thought to check if the rootfs->path is not present in the workdir and
> upperdir mount options. But the current check is bogus since it will be
> trivially true whenever the container is a block-dev or overlay or aufs backed
> since the rootfs->path will then have a form like e.g.
> 
>         overlayfs:/some/path:/some/other/path
> 
> This patch parses rootfs->path by searching backwards for the first occurrence
> of the delimiter pair ":/". We do not simply search for ":" since it might be
> used in path names.
> 
> Signed-off-by: Christian Brauner <christianvanbrauner at gmail.com>
> ---
>  src/lxc/conf.c | 126 ++++++++++++++++++++++++++++++++++++++++++++++-----------
>  1 file changed, 103 insertions(+), 23 deletions(-)
> 
> diff --git a/src/lxc/conf.c b/src/lxc/conf.c
> index 16a62f8..a730a67 100644
> --- a/src/lxc/conf.c
> +++ b/src/lxc/conf.c
> @@ -1821,6 +1821,11 @@ static int mount_entry_create_overlay_dirs(const struct mntent *mntent,
>  					   const char *lxc_path)
>  {
>  	char lxcpath[MAXPATHLEN];
> +	char *end = NULL;
> +	char *rootfsdir = NULL;
> +	char *s = NULL;
> +	char *s1 = NULL;
> +	char *tmp = NULL;
>  	char *upperdir = NULL;
>  	char *workdir = NULL;
>  	char **opts = NULL;
> @@ -1830,15 +1835,16 @@ static int mount_entry_create_overlay_dirs(const struct mntent *mntent,
>  	size_t i;
>  	size_t len = 0;
>  	size_t rootfslen = 0;
> +	size_t slen = 0;
>  
>  	if (!rootfs->path || !lxc_name || !lxc_path)
> -		return -1;
> +		goto err;
>  
>  	opts = lxc_string_split(mntent->mnt_opts, ',');
>  	if (opts)
>  		arrlen = lxc_array_len((void **)opts);
>  	else
> -		return -1;
> +		goto err;
>  
>  	for (i = 0; i < arrlen; i++) {
>  		if (strstr(opts[i], "upperdir=") && (strlen(opts[i]) > (len = strlen("upperdir="))))
> @@ -1848,31 +1854,66 @@ static int mount_entry_create_overlay_dirs(const struct mntent *mntent,
>  	}
>  
>  	ret = snprintf(lxcpath, MAXPATHLEN, "%s/%s", lxc_path, lxc_name);
> -	if (ret < 0 || ret >= MAXPATHLEN) {
> -		lxc_free_array((void **)opts, free);
> -		return -1;
> -	}
> +	if (ret < 0 || ret >= MAXPATHLEN)
> +		goto err;
>  
>  	dirlen = strlen(lxcpath);
> -	rootfslen = strlen(rootfs->path);
> +

Could you put this stuff into a helper, i.e.

	rootfsdir = ovl_get_rootfs_dir(rootfs->path, &rootfslen);
> +	s = strdup(rootfs->path);
> +	if (!s)
> +		goto err;
> +
> +	s1 = malloc(strlen(rootfs->path) + 1);
> +	if (!s1)
> +		goto err;
> +	end = stpcpy(s1, rootfs->path);
> +
> +	/* If we find :/ in rootfs->path it means we either have a block-dev or
> +	 * overlay or aufs container. */
> +	while ((tmp = strrchr(s, ':'))) {
> +		len = strlen(tmp);
> +		rootfslen += len;
> +		if (strncmp(tmp, ":/", 2) == 0) {
> +			rootfsdir = end - rootfslen + 1;
> +			rootfslen = strlen(rootfsdir);
> +			break;
> +		} else {
> +			slen = strlen(s);
> +			s[slen - len] = '\0';
> +		}
> +	}
> +
> +	/* If rootfsdir is empty at this point we have a simple directory
> +	 * container. */
> +	if (!rootfsdir) {
> +		rootfsdir = rootfs->path;
> +		rootfslen = strlen(rootfs->path);
> +	}
>  
>  	/* We neither allow users to create upperdirs and workdirs outside the
>  	 * containerdir nor inside the rootfs. The latter might be debatable. */
>  	if (upperdir)
> -		if ((strncmp(upperdir, lxcpath, dirlen) == 0) && (strncmp(upperdir, rootfs->path, rootfslen) != 0))
> +		if ((strncmp(upperdir, lxcpath, dirlen) == 0) && (strncmp(upperdir, rootfsdir, rootfslen) != 0))
>  			if (mkdir_p(upperdir, 0755) < 0) {
>  				WARN("Failed to create upperdir");
>  			}
>  
>  
>  	if (workdir)
> -		if ((strncmp(workdir, lxcpath, dirlen) == 0) && (strncmp(workdir, rootfs->path, rootfslen) != 0))
> +		if ((strncmp(workdir, lxcpath, dirlen) == 0) && (strncmp(workdir, rootfsdir, rootfslen) != 0))
>  			if (mkdir_p(workdir, 0755) < 0) {
>  				WARN("Failed to create workdir");
>  			}
>  
> +	free(s);
> +	free(s1);
>  	lxc_free_array((void **)opts, free);
>  	return 0;
> +err:
> +	free(s);
> +	free(s1);
> +	lxc_free_array((void **)opts, free);
> +	return -1;
>  }
>  
>  static int mount_entry_create_aufs_dirs(const struct mntent *mntent,
> @@ -1881,6 +1922,10 @@ static int mount_entry_create_aufs_dirs(const struct mntent *mntent,
>  					const char *lxc_path)
>  {
>  	char lxcpath[MAXPATHLEN];
> +	char *end = NULL;
> +	char *rootfsdir = NULL;
> +	char *s = NULL;
> +	char *s1 = NULL;
>  	char *scratch = NULL;
>  	char *tmp = NULL;
>  	char *upperdir = NULL;
> @@ -1889,44 +1934,79 @@ static int mount_entry_create_aufs_dirs(const struct mntent *mntent,
>  	size_t arrlen = 0;
>  	size_t i;
>  	size_t len = 0;
> +	size_t rootfslen = 0;
> +	size_t slen = 0;
>  
>  	if (!rootfs->path || !lxc_name || !lxc_path)
> -		return -1;
> +		goto err;
>  
>  	opts = lxc_string_split(mntent->mnt_opts, ',');
>  	if (opts)
>  		arrlen = lxc_array_len((void **)opts);
>  	else
> -		return -1;
> +		goto err;
>  
>  	for (i = 0; i < arrlen; i++) {
>  		if (strstr(opts[i], "br=") && (strlen(opts[i]) > (len = strlen("br="))))
>  			tmp = opts[i] + len;
>  	}
> -	if (!tmp) {
> -		lxc_free_array((void **)opts, free);
> -		return -1;
> -	}
> +	if (!tmp)
> +		goto err;
>  
>  	upperdir = strtok_r(tmp, ":=", &scratch);
> -	if (!upperdir) {
> -		lxc_free_array((void **)opts, free);
> -		return -1;
> -	}
> +	if (!upperdir)
> +		goto err;
>  
>  	ret = snprintf(lxcpath, MAXPATHLEN, "%s/%s", lxc_path, lxc_name);
> -	if (ret < 0 || ret >= MAXPATHLEN) {
> -		lxc_free_array((void **)opts, free);
> -		return -1;
> +	if (ret < 0 || ret >= MAXPATHLEN)
> +		goto err;
> +
> +	s = strdup(rootfs->path);
> +	if (!s)
> +		goto err;
> +
> +	s1 = malloc(strlen(rootfs->path) + 1);
> +	if (!s1)
> +		goto err;
> +	end = stpcpy(s1, rootfs->path);
> +
> +	/* If we find :/ in rootfs->path it means we either have a block-dev or
> +	 * overlay or aufs container. */
> +	while ((tmp = strrchr(s, ':'))) {
> +		len = strlen(tmp);
> +		rootfslen += len;
> +		if (strncmp(tmp, ":/", 2) == 0) {
> +			rootfsdir = end - rootfslen + 1;
> +			rootfslen = strlen(rootfsdir);
> +			break;
> +		} else {
> +			slen = strlen(s);
> +			s[slen - len] = '\0';
> +		}
> +	}
> +
> +	/* If rootfsdir is empty at this point we have a simple directory
> +	 * container. */
> +	if (!rootfsdir) {
> +		rootfsdir = rootfs->path;
> +		rootfslen = strlen(rootfs->path);
>  	}
>  
>  	/* We neither allow users to create upperdirs outside the containerdir
>  	 * nor inside the rootfs. The latter might be debatable. */
> -	if ((strncmp(upperdir, lxcpath, strlen(lxcpath)) == 0) && (strncmp(upperdir, rootfs->path, strlen(rootfs->path)) != 0))
> +	if ((strncmp(upperdir, lxcpath, strlen(lxcpath)) == 0) && (strncmp(upperdir, rootfsdir, rootfslen) != 0))
>  		if (mkdir_p(upperdir, 0755) < 0) {
>  			WARN("Failed to create upperdir");
>  		}
>  
> +	free(s);
> +	free(s1);
> +	lxc_free_array((void **)opts, free);
> +	return 0;
> +
> +err:
> +	free(s);
> +	free(s1);
>  	lxc_free_array((void **)opts, free);
>  	return 0;
>  }
> -- 
> 2.6.1
> 


More information about the lxc-devel mailing list