X-Git-Url: http://git.annexia.org/?p=libguestfs.git;a=blobdiff_plain;f=src%2Fguestfs.c;h=0e4cb73bc2a259c395b2a2739299693499c673f8;hp=bc4fe4eaceb85e167db6ebbe4e1daf2149bf960a;hb=1214b321621e7750c67423ecf4d9528809e1eeac;hpb=8d8b3fafa3655f0a389d98cac63db23ddf9b446c diff --git a/src/guestfs.c b/src/guestfs.c index bc4fe4e..0e4cb73 100644 --- a/src/guestfs.c +++ b/src/guestfs.c @@ -1,5 +1,5 @@ /* libguestfs - * Copyright (C) 2009 Red Hat Inc. + * Copyright (C) 2009-2010 Red Hat Inc. * * This library is free software; you can redistribute it and/or * modify it under the terms of the GNU Lesser General Public @@ -24,14 +24,16 @@ #include #include #include +#include +#include #include -#include #include #include #include #include #include #include +#include #include #include @@ -56,10 +58,17 @@ #include #endif +#include +#include + +#include "c-ctype.h" +#include "glthread/lock.h" +#include "ignore-value.h" + #include "guestfs.h" +#include "guestfs-internal.h" #include "guestfs-internal-actions.h" #include "guestfs_protocol.h" -#include "ignore-value.h" #ifdef HAVE_GETTEXT #include "gettext.h" @@ -77,16 +86,52 @@ #define safe_strdup guestfs_safe_strdup //#define safe_memdup guestfs_safe_memdup +#ifdef __linux__ +#define CAN_CHECK_PEER_EUID 1 +#else +#define CAN_CHECK_PEER_EUID 0 +#endif + static void default_error_cb (guestfs_h *g, void *data, const char *msg); static int send_to_daemon (guestfs_h *g, const void *v_buf, size_t n); static int recv_from_daemon (guestfs_h *g, uint32_t *size_rtn, void **buf_rtn); +static int accept_from_daemon (guestfs_h *g); +static int check_peer_euid (guestfs_h *g, int sock, uid_t *rtn); static void close_handles (void); +static int qemu_supports (guestfs_h *g, const char *option); #define UNIX_PATH_MAX 108 -/* Also in guestfsd.c */ -#define GUESTFWD_PORT 6666 -#define GUESTFWD_ADDR "10.0.2.4" +#ifndef MAX +#define MAX(a,b) ((a)>(b)?(a):(b)) +#endif + +#ifdef __APPLE__ +#define xdr_uint32_t xdr_u_int32_t +#endif + +/* Network configuration of the appliance. Note these addresses are + * only meaningful within the context of the running appliance. QEMU + * translates network connections to these magic addresses into + * userspace calls on the host (eg. connect(2)). qemu-doc has a nice + * diagram which is also useful to refer to. + * + * NETWORK: The network. + * + * ROUTER: The address of the "host", ie. this library. + * + * [Note: If you change NETWORK and ROUTER then you also have to + * change the network configuration in appliance/init]. + * + * GUESTFWD_ADDR, GUESTFWD_PORT: The guestfwd feature of qemu + * magically connects this pseudo-address to the guestfwd channel. In + * typical Linux configurations of libguestfs, guestfwd is not + * actually used any more. + */ +#define NETWORK "169.254.0.0/16" +#define ROUTER "169.254.2.2" +#define GUESTFWD_ADDR "169.254.2.4" +#define GUESTFWD_PORT "6666" /* GuestFS handle and connection. */ enum state { CONFIG, LAUNCHING, READY, BUSY, NO_HANDLE }; @@ -102,7 +147,8 @@ struct guestfs_h int sock; /* Daemon communications socket. */ pid_t pid; /* Qemu PID. */ pid_t recoverypid; /* Recovery process PID. */ - time_t start_t; /* The time when we started qemu. */ + + struct timeval launch_t; /* The time that we called guestfs_launch. */ char *tmpdir; /* Temporary directory containing socket. */ @@ -114,6 +160,8 @@ struct guestfs_h int verbose; int trace; int autosync; + int direct; + int recovery_proc; char *path; /* Path to kernel, initrd. */ char *qemu; /* Qemu binary. */ @@ -139,6 +187,7 @@ struct guestfs_h int msg_next_serial; }; +gl_lock_define_initialized (static, handles_lock); static guestfs_h *handles = NULL; static int atexit_handler_set = 0; @@ -163,11 +212,13 @@ guestfs_create (void) g->error_cb = default_error_cb; g->error_cb_data = NULL; + g->recovery_proc = 1; + str = getenv ("LIBGUESTFS_DEBUG"); - g->verbose = str != NULL && strcmp (str, "1") == 0; + g->verbose = str != NULL && STREQ (str, "1"); str = getenv ("LIBGUESTFS_TRACE"); - g->trace = str != NULL && strcmp (str, "1") == 0; + g->trace = str != NULL && STREQ (str, "1"); str = getenv ("LIBGUESTFS_PATH"); g->path = str != NULL ? strdup (str) : strdup (GUESTFS_DEFAULT_PATH); @@ -204,17 +255,15 @@ guestfs_create (void) */ g->msg_next_serial = 0x00123400; - /* Link the handles onto a global list. This is the one area - * where the library needs to be made thread-safe. (XXX) - */ - /* acquire mutex (XXX) */ + /* Link the handles onto a global list. */ + gl_lock_lock (handles_lock); g->next = handles; handles = g; if (!atexit_handler_set) { atexit (close_handles); atexit_handler_set = 1; } - /* release mutex (XXX) */ + gl_lock_unlock (handles_lock); if (g->verbose) fprintf (stderr, "new guestfs handle %p\n", g); @@ -299,7 +348,7 @@ guestfs_close (guestfs_h *g) /* Mark the handle as dead before freeing it. */ g->state = NO_HANDLE; - /* acquire mutex (XXX) */ + gl_lock_lock (handles_lock); if (handles == g) handles = g->next; else { @@ -307,7 +356,7 @@ guestfs_close (guestfs_h *g) ; gg->next = g->next; } - /* release mutex (XXX) */ + gl_lock_unlock (handles_lock); free (g->last_error); free (g->path); @@ -375,7 +424,7 @@ guestfs_perrorf (guestfs_h *g, const char *fs, ...) if (err < 0) return; -#ifndef _GNU_SOURCE +#if !defined(_GNU_SOURCE) || defined(__APPLE__) char buf[256]; strerror_r (errnum, buf, sizeof buf); #else @@ -419,7 +468,11 @@ guestfs_safe_malloc (guestfs_h *g, size_t nbytes) /* Technically we should add an autoconf test for this, testing for the desired functionality, like what's done in gnulib, but for now, this is fine. */ +#if defined(__GLIBC__) #define HAVE_GNU_CALLOC (__GLIBC__ >= 2) +#else +#define HAVE_GNU_CALLOC 0 +#endif /* Allocate zeroed memory for N elements of S bytes, with error checking. S must be nonzero. */ @@ -646,6 +699,32 @@ guestfs__get_trace (guestfs_h *g) return g->trace; } +int +guestfs__set_direct (guestfs_h *g, int d) +{ + g->direct = !!d; + return 0; +} + +int +guestfs__get_direct (guestfs_h *g) +{ + return g->direct; +} + +int +guestfs__set_recovery_proc (guestfs_h *g, int f) +{ + g->recovery_proc = !!f; + return 0; +} + +int +guestfs__get_recovery_proc (guestfs_h *g) +{ + return g->recovery_proc; +} + /* Add a string to the current command line. */ static void incr_cmdline_size (guestfs_h *g) @@ -687,13 +766,13 @@ guestfs__config (guestfs_h *g, /* A bit fascist, but the user will probably break the extra * parameters that we add if they try to set any of these. */ - if (strcmp (qemu_param, "-kernel") == 0 || - strcmp (qemu_param, "-initrd") == 0 || - strcmp (qemu_param, "-nographic") == 0 || - strcmp (qemu_param, "-serial") == 0 || - strcmp (qemu_param, "-full-screen") == 0 || - strcmp (qemu_param, "-std-vga") == 0 || - strcmp (qemu_param, "-vnc") == 0) { + if (STREQ (qemu_param, "-kernel") || + STREQ (qemu_param, "-initrd") || + STREQ (qemu_param, "-nographic") || + STREQ (qemu_param, "-serial") || + STREQ (qemu_param, "-full-screen") || + STREQ (qemu_param, "-std-vga") || + STREQ (qemu_param, "-vnc")) { error (g, _("guestfs_config: parameter '%s' isn't allowed"), qemu_param); return -1; } @@ -708,7 +787,8 @@ guestfs__config (guestfs_h *g, } int -guestfs__add_drive (guestfs_h *g, const char *filename) +guestfs__add_drive_with_if (guestfs_h *g, const char *filename, + const char *drive_if) { size_t len = strlen (filename) + 64; char buf[len]; @@ -731,12 +811,12 @@ guestfs__add_drive (guestfs_h *g, const char *filename) int fd = open (filename, O_RDONLY|O_DIRECT); if (fd >= 0) { close (fd); - snprintf (buf, len, "file=%s,cache=off,if=" DRIVE_IF, filename); + snprintf (buf, len, "file=%s,cache=off,if=%s", filename, drive_if); } else { fd = open (filename, O_RDONLY); if (fd >= 0) { close (fd); - snprintf (buf, len, "file=%s,if=" DRIVE_IF, filename); + snprintf (buf, len, "file=%s,if=%s", filename, drive_if); } else { perrorf (g, "%s", filename); return -1; @@ -747,11 +827,9 @@ guestfs__add_drive (guestfs_h *g, const char *filename) } int -guestfs__add_drive_ro (guestfs_h *g, const char *filename) +guestfs__add_drive_ro_with_if (guestfs_h *g, const char *filename, + const char *drive_if) { - size_t len = strlen (filename) + 64; - char buf[len]; - if (strchr (filename, ',') != NULL) { error (g, _("filename cannot contain ',' (comma) character")); return -1; @@ -762,12 +840,41 @@ guestfs__add_drive_ro (guestfs_h *g, const char *filename) return -1; } - snprintf (buf, len, "file=%s,snapshot=on,if=%s", filename, DRIVE_IF); + if (qemu_supports (g, NULL) == -1) + return -1; + + /* Only SCSI and virtio drivers support readonly mode. + * This is only supported as a QEMU feature since 2010/01. + */ + int supports_ro = 0; + if ((STREQ (drive_if, "scsi") || STREQ (drive_if, "virtio")) && + qemu_supports (g, "readonly=on")) + supports_ro = 1; + + size_t len = strlen (filename) + 100; + char buf[len]; + + snprintf (buf, len, "file=%s,snapshot=on,%sif=%s", + filename, + supports_ro ? "readonly=on," : "", + drive_if); return guestfs__config (g, "-drive", buf); } int +guestfs__add_drive (guestfs_h *g, const char *filename) +{ + return guestfs__add_drive_with_if (g, filename, DRIVE_IF); +} + +int +guestfs__add_drive_ro (guestfs_h *g, const char *filename) +{ + return guestfs__add_drive_ro_with_if (g, filename, DRIVE_IF); +} + +int guestfs__add_cdrom (guestfs_h *g, const char *filename) { if (strchr (filename, ',') != NULL) { @@ -814,17 +921,13 @@ dir_contains_files (const char *dir, ...) return 1; } +static void print_timestamped_message (guestfs_h *g, const char *fs, ...); static int build_supermin_appliance (guestfs_h *g, const char *path, char **kernel, char **initrd); -static int test_qemu (guestfs_h *g); -static int qemu_supports (guestfs_h *g, const char *option); +static int is_openable (guestfs_h *g, const char *path, int flags); static void print_cmdline (guestfs_h *g); static const char *kernel_name = "vmlinuz." REPO "." host_cpu; static const char *initrd_name = "initramfs." REPO "." host_cpu ".img"; -static const char *supermin_name = - "initramfs." REPO "." host_cpu ".supermin.img"; -static const char *supermin_hostfiles_name = - "initramfs." REPO "." host_cpu ".supermin.hostfiles"; int guestfs__launch (guestfs_h *g) @@ -837,18 +940,10 @@ guestfs__launch (guestfs_h *g) int tries; char *path, *pelem, *pend; char *kernel = NULL, *initrd = NULL; + int null_vmchannel_sock; char unixsock[256]; struct sockaddr_un addr; -#ifdef P_tmpdir - tmpdir = P_tmpdir; -#else - tmpdir = "/tmp"; -#endif - - tmpdir = getenv ("TMPDIR") ? : tmpdir; - snprintf (dir_template, sizeof dir_template, "%s/libguestfsXXXXXX", tmpdir); - /* Configured? */ if (!g->cmdline) { error (g, _("you must call guestfs_add_drive before guestfs_launch")); @@ -856,11 +951,23 @@ guestfs__launch (guestfs_h *g) } if (g->state != CONFIG) { - error (g, _("qemu has already been launched")); + error (g, _("the libguestfs handle has already been launched")); return -1; } + /* Start the clock ... */ + gettimeofday (&g->launch_t, NULL); + /* Make the temporary directory. */ +#ifdef P_tmpdir + tmpdir = P_tmpdir; +#else + tmpdir = "/tmp"; +#endif + + tmpdir = getenv ("TMPDIR") ? : tmpdir; + snprintf (dir_template, sizeof dir_template, "%s/libguestfsXXXXXX", tmpdir); + if (!g->tmpdir) { g->tmpdir = safe_strdup (g, dir_template); if (mkdtemp (g->tmpdir) == NULL) { @@ -887,8 +994,7 @@ guestfs__launch (guestfs_h *g) fprintf (stderr, "looking for supermin appliance in current directory\n"); if (dir_contains_files (".", - supermin_name, supermin_hostfiles_name, - "kmod.whitelist", NULL)) { + "supermin.d", "kmod.whitelist", NULL)) { if (build_supermin_appliance (g, ".", &kernel, &initrd) == -1) return -1; break; @@ -900,8 +1006,7 @@ guestfs__launch (guestfs_h *g) fprintf (stderr, "looking for supermin appliance in %s\n", pelem); if (dir_contains_files (pelem, - supermin_name, supermin_hostfiles_name, - "kmod.whitelist", NULL)) { + "supermin.d", "kmod.whitelist", NULL)) { if (build_supermin_appliance (g, pelem, &kernel, &initrd) == -1) return -1; break; @@ -959,48 +1064,131 @@ guestfs__launch (guestfs_h *g) goto cleanup0; } + if (g->verbose) + print_timestamped_message (g, "begin testing qemu features"); + /* Get qemu help text and version. */ - if (test_qemu (g) == -1) + if (qemu_supports (g, NULL) == -1) goto cleanup0; - /* Make the vmchannel socket. */ - snprintf (unixsock, sizeof unixsock, "%s/sock", g->tmpdir); - unlink (unixsock); + /* Choose which vmchannel implementation to use. */ + if (CAN_CHECK_PEER_EUID && qemu_supports (g, "-net user")) { + /* The "null vmchannel" implementation. Requires SLIRP (user mode + * networking in qemu) but no other vmchannel support. The daemon + * will connect back to a random port number on localhost. + */ + struct sockaddr_in addr; + socklen_t addrlen = sizeof addr; - if (pipe (wfd) == -1 || pipe (rfd) == -1) { - perrorf (g, "pipe"); - goto cleanup0; + g->sock = socket (AF_INET, SOCK_STREAM, IPPROTO_TCP); + if (g->sock == -1) { + perrorf (g, "socket"); + goto cleanup0; + } + addr.sin_family = AF_INET; + addr.sin_port = htons (0); + addr.sin_addr.s_addr = htonl (INADDR_LOOPBACK); + if (bind (g->sock, (struct sockaddr *) &addr, addrlen) == -1) { + perrorf (g, "bind"); + goto cleanup0; + } + + if (listen (g->sock, 256) == -1) { + perrorf (g, "listen"); + goto cleanup0; + } + + if (getsockname (g->sock, (struct sockaddr *) &addr, &addrlen) == -1) { + perrorf (g, "getsockname"); + goto cleanup0; + } + + if (fcntl (g->sock, F_SETFL, O_NONBLOCK) == -1) { + perrorf (g, "fcntl"); + goto cleanup0; + } + + null_vmchannel_sock = ntohs (addr.sin_port); + if (g->verbose) + fprintf (stderr, "null_vmchannel_sock = %d\n", null_vmchannel_sock); + } else { + /* Using some vmchannel impl. We need to create a local Unix + * domain socket for qemu to use. + */ + snprintf (unixsock, sizeof unixsock, "%s/sock", g->tmpdir); + unlink (unixsock); + null_vmchannel_sock = 0; + } + + if (!g->direct) { + if (pipe (wfd) == -1 || pipe (rfd) == -1) { + perrorf (g, "pipe"); + goto cleanup0; + } } + if (g->verbose) + print_timestamped_message (g, "finished testing qemu features"); + r = fork (); if (r == -1) { perrorf (g, "fork"); - close (wfd[0]); - close (wfd[1]); - close (rfd[0]); - close (rfd[1]); + if (!g->direct) { + close (wfd[0]); + close (wfd[1]); + close (rfd[0]); + close (rfd[1]); + } goto cleanup0; } if (r == 0) { /* Child (qemu). */ char buf[256]; - char append[256]; - char memsize_str[256]; + const char *vmchannel = NULL; /* Set up the full command line. Do this in the subprocess so we * don't need to worry about cleaning up. */ g->cmdline[0] = g->qemu; - snprintf (memsize_str, sizeof memsize_str, "%d", g->memsize); + /* qemu sometimes needs this option to enable hardware + * virtualization, but some versions of 'qemu-kvm' will use KVM + * regardless (even where this option appears in the help text). + * It is rumoured that there are versions of qemu where supplying + * this option when hardware virtualization is not available will + * cause qemu to fail, so we we have to check at least that + * /dev/kvm is openable. That's not reliable, since /dev/kvm + * might be openable by qemu but not by us (think: SELinux) in + * which case the user would not get hardware virtualization, + * although at least shouldn't fail. A giant clusterfuck with the + * qemu command line, again. + */ + if (qemu_supports (g, "-enable-kvm") && + is_openable (g, "/dev/kvm", O_RDWR)) + add_cmdline (g, "-enable-kvm"); + + /* Newer versions of qemu (from around 2009/12) changed the + * behaviour of monitors so that an implicit '-monitor stdio' is + * assumed if we are in -nographic mode and there is no other + * -monitor option. Only a single stdio device is allowed, so + * this broke the '-serial stdio' option. There is a new flag + * called -nodefaults which gets rid of all this default crud, so + * let's use that to avoid this and any future surprises. + */ + if (qemu_supports (g, "-nodefaults")) + add_cmdline (g, "-nodefaults"); - add_cmdline (g, "-m"); - add_cmdline (g, memsize_str); - add_cmdline (g, "-no-reboot"); /* Force exit instead of reboot on panic */ add_cmdline (g, "-nographic"); add_cmdline (g, "-serial"); add_cmdline (g, "stdio"); + snprintf (buf, sizeof buf, "%d", g->memsize); + add_cmdline (g, "-m"); + add_cmdline (g, buf); + + /* Force exit instead of reboot on panic */ + add_cmdline (g, "-no-reboot"); + /* These options recommended by KVM developers to improve reliability. */ if (qemu_supports (g, "-no-hpet")) add_cmdline (g, "-no-hpet"); @@ -1008,18 +1196,32 @@ guestfs__launch (guestfs_h *g) if (qemu_supports (g, "-rtc-td-hack")) add_cmdline (g, "-rtc-td-hack"); - if (qemu_supports (g, "-chardev") && qemu_supports (g, "guestfwd")) { - /* New-style -net user,guestfwd=... syntax for guestfwd. See: - * - * http://git.savannah.gnu.org/cgit/qemu.git/commit/?id=c92ef6a22d3c71538fcc48fb61ad353f7ba03b62 - * - * The original suggested format doesn't work, see: - * - * http://lists.gnu.org/archive/html/qemu-devel/2009-07/msg01654.html - * - * However Gerd Hoffman privately suggested to me using -chardev - * instead, which does work. - */ + /* If qemu has SLIRP (user mode network) enabled then we can get + * away with "no vmchannel", where we just connect back to a random + * host port. + */ + if (null_vmchannel_sock) { + add_cmdline (g, "-net"); + add_cmdline (g, "user,vlan=0,net=" NETWORK); + + snprintf (buf, sizeof buf, + "guestfs_vmchannel=tcp:" ROUTER ":%d", + null_vmchannel_sock); + vmchannel = strdup (buf); + } + + /* New-style -net user,guestfwd=... syntax for guestfwd. See: + * + * http://git.savannah.gnu.org/cgit/qemu.git/commit/?id=c92ef6a22d3c71538fcc48fb61ad353f7ba03b62 + * + * The original suggested format doesn't work, see: + * + * http://lists.gnu.org/archive/html/qemu-devel/2009-07/msg01654.html + * + * However Gerd Hoffman privately suggested to me using -chardev + * instead, which does work. + */ + else if (qemu_supports (g, "-chardev") && qemu_supports (g, "guestfwd")) { snprintf (buf, sizeof buf, "socket,id=guestfsvmc,path=%s,server,nowait", unixsock); @@ -1027,23 +1229,29 @@ guestfs__launch (guestfs_h *g) add_cmdline (g, buf); snprintf (buf, sizeof buf, - "user,vlan=0,net=10.0.2.0/8," - "guestfwd=tcp:%s:%d-chardev:guestfsvmc", - GUESTFWD_ADDR, GUESTFWD_PORT); + "user,vlan=0,net=" NETWORK "," + "guestfwd=tcp:" GUESTFWD_ADDR ":" GUESTFWD_PORT + "-chardev:guestfsvmc"); add_cmdline (g, "-net"); add_cmdline (g, buf); - } else { - /* Not guestfwd. HOPEFULLY this qemu uses the older -net channel - * syntax, or if not then we'll get a quick failure. - */ + + vmchannel = "guestfs_vmchannel=tcp:" GUESTFWD_ADDR ":" GUESTFWD_PORT; + } + + /* Not guestfwd. HOPEFULLY this qemu uses the older -net channel + * syntax, or if not then we'll get a quick failure. + */ + else { snprintf (buf, sizeof buf, - "channel,%d:unix:%s,server,nowait", GUESTFWD_PORT, unixsock); + "channel," GUESTFWD_PORT ":unix:%s,server,nowait", unixsock); add_cmdline (g, "-net"); add_cmdline (g, buf); add_cmdline (g, "-net"); - add_cmdline (g, "user,vlan=0,net=10.0.2.0/8"); + add_cmdline (g, "user,vlan=0,net=" NETWORK); + + vmchannel = "guestfs_vmchannel=tcp:" GUESTFWD_ADDR ":" GUESTFWD_PORT; } add_cmdline (g, "-net"); add_cmdline (g, "nic,model=" NET_IF ",vlan=0"); @@ -1054,16 +1262,21 @@ guestfs__launch (guestfs_h *g) "udevtimeout=300 " /* good for very slow systems (RHBZ#480319) */ \ "noapic " /* workaround for RHBZ#502058 - ok if not SMP */ \ "acpi=off " /* we don't need ACPI, turn it off */ \ + "printk.time=1 " /* display timestamp before kernel messages */ \ "cgroup_disable=memory " /* saves us about 5 MB of RAM */ /* Linux kernel command line. */ - snprintf (append, sizeof append, + snprintf (buf, sizeof buf, LINUX_CMDLINE - "%s" /* (selinux) */ - "%s" /* (verbose) */ + "%s " /* (selinux) */ + "%s " /* (vmchannel) */ + "%s " /* (verbose) */ + "TERM=%s " /* (TERM environment variable) */ "%s", /* (append) */ - g->selinux ? "selinux=1 enforcing=0 " : "selinux=0 ", - g->verbose ? "guestfs_verbose=1 " : " ", + g->selinux ? "selinux=1 enforcing=0" : "selinux=0", + vmchannel ? vmchannel : "", + g->verbose ? "guestfs_verbose=1" : "", + getenv ("TERM") ? : "linux", g->append ? g->append : ""); add_cmdline (g, "-kernel"); @@ -1071,7 +1284,7 @@ guestfs__launch (guestfs_h *g) add_cmdline (g, "-initrd"); add_cmdline (g, (char *) initrd); add_cmdline (g, "-append"); - add_cmdline (g, append); + add_cmdline (g, buf); /* Finish off the command line. */ incr_cmdline_size (g); @@ -1080,22 +1293,24 @@ guestfs__launch (guestfs_h *g) if (g->verbose) print_cmdline (g); - /* Set up stdin, stdout. */ - close (0); - close (1); - close (wfd[1]); - close (rfd[0]); + if (!g->direct) { + /* Set up stdin, stdout. */ + close (0); + close (1); + close (wfd[1]); + close (rfd[0]); + + if (dup (wfd[0]) == -1) { + dup_failed: + perror ("dup failed"); + _exit (EXIT_FAILURE); + } + if (dup (rfd[1]) == -1) + goto dup_failed; - if (dup (wfd[0]) == -1) { - dup_failed: - perror ("dup failed"); - _exit (1); + close (wfd[0]); + close (rfd[1]); } - if (dup (rfd[1]) == -1) - goto dup_failed; - - close (wfd[0]); - close (rfd[1]); #if 0 /* Set up a new process group, so we can signal this process @@ -1104,9 +1319,11 @@ guestfs__launch (guestfs_h *g) setpgid (0, 0); #endif + setenv ("LC_ALL", "C", 1); + execv (g->qemu, g->cmdline); /* Run qemu. */ perror (g->qemu); - _exit (1); + _exit (EXIT_FAILURE); } /* Parent (library). */ @@ -1120,116 +1337,199 @@ guestfs__launch (guestfs_h *g) /* Fork the recovery process off which will kill qemu if the parent * process fails to do so (eg. if the parent segfaults). */ - r = fork (); - if (r == 0) { - pid_t qemu_pid = g->pid; - pid_t parent_pid = getppid (); + g->recoverypid = -1; + if (g->recovery_proc) { + r = fork (); + if (r == 0) { + pid_t qemu_pid = g->pid; + pid_t parent_pid = getppid (); + + /* Writing to argv is hideously complicated and error prone. See: + * http://anoncvs.postgresql.org/cvsweb.cgi/pgsql/src/backend/utils/misc/ps_status.c?rev=1.33.2.1;content-type=text%2Fplain + */ + + /* Loop around waiting for one or both of the other processes to + * disappear. It's fair to say this is very hairy. The PIDs that + * we are looking at might be reused by another process. We are + * effectively polling. Is the cure worse than the disease? + */ + for (;;) { + if (kill (qemu_pid, 0) == -1) /* qemu's gone away, we aren't needed */ + _exit (EXIT_SUCCESS); + if (kill (parent_pid, 0) == -1) { + /* Parent's gone away, qemu still around, so kill qemu. */ + kill (qemu_pid, 9); + _exit (EXIT_SUCCESS); + } + sleep (2); + } + } - /* Writing to argv is hideously complicated and error prone. See: - * http://anoncvs.postgresql.org/cvsweb.cgi/pgsql/src/backend/utils/misc/ps_status.c?rev=1.33.2.1;content-type=text%2Fplain + /* Don't worry, if the fork failed, this will be -1. The recovery + * process isn't essential. */ + g->recoverypid = r; + } + + if (!g->direct) { + /* Close the other ends of the pipe. */ + close (wfd[0]); + close (rfd[1]); + + if (fcntl (wfd[1], F_SETFL, O_NONBLOCK) == -1 || + fcntl (rfd[0], F_SETFL, O_NONBLOCK) == -1) { + perrorf (g, "fcntl"); + goto cleanup1; + } + + g->fd[0] = wfd[1]; /* stdin of child */ + g->fd[1] = rfd[0]; /* stdout of child */ + } else { + g->fd[0] = open ("/dev/null", O_RDWR); + if (g->fd[0] == -1) { + perrorf (g, "open /dev/null"); + goto cleanup1; + } + g->fd[1] = dup (g->fd[0]); + if (g->fd[1] == -1) { + perrorf (g, "dup"); + close (g->fd[0]); + goto cleanup1; + } + } + + if (null_vmchannel_sock) { + int sock = -1; + uid_t uid; - /* Loop around waiting for one or both of the other processes to - * disappear. It's fair to say this is very hairy. The PIDs that - * we are looking at might be reused by another process. We are - * effectively polling. Is the cure worse than the disease? + /* Null vmchannel implementation: We listen on g->sock for a + * connection. The connection could come from any local process + * so we must check it comes from the appliance (or at least + * from our UID) for security reasons. */ - for (;;) { - if (kill (qemu_pid, 0) == -1) /* qemu's gone away, we aren't needed */ - _exit (0); - if (kill (parent_pid, 0) == -1) { - /* Parent's gone away, qemu still around, so kill qemu. */ - kill (qemu_pid, 9); - _exit (0); + while (sock == -1) { + sock = accept_from_daemon (g); + if (sock == -1) + goto cleanup1; + + if (check_peer_euid (g, sock, &uid) == -1) + goto cleanup1; + if (uid != geteuid ()) { + fprintf (stderr, + "libguestfs: warning: unexpected connection from UID %d to port %d\n", + uid, null_vmchannel_sock); + close (sock); + sock = -1; + continue; } - sleep (2); } - } - /* Don't worry, if the fork failed, this will be -1. The recovery - * process isn't essential. - */ - g->recoverypid = r; + if (fcntl (sock, F_SETFL, O_NONBLOCK) == -1) { + perrorf (g, "fcntl"); + goto cleanup1; + } - /* Start the clock ... */ - time (&g->start_t); + close (g->sock); + g->sock = sock; + } else { + /* Other vmchannel. Open the Unix socket. + * + * The vmchannel implementation that got merged with qemu sucks in + * a number of ways. Both ends do connect(2), which means that no + * one knows what, if anything, is connected to the other end, or + * if it becomes disconnected. Even worse, we have to wait some + * indeterminate time for qemu to create the socket and connect to + * it (which happens very early in qemu's start-up), so any code + * that uses vmchannel is inherently racy. Hence this silly loop. + */ + g->sock = socket (AF_UNIX, SOCK_STREAM, 0); + if (g->sock == -1) { + perrorf (g, "socket"); + goto cleanup1; + } + + if (fcntl (g->sock, F_SETFL, O_NONBLOCK) == -1) { + perrorf (g, "fcntl"); + goto cleanup1; + } - /* Close the other ends of the pipe. */ - close (wfd[0]); - close (rfd[1]); + addr.sun_family = AF_UNIX; + strncpy (addr.sun_path, unixsock, UNIX_PATH_MAX); + addr.sun_path[UNIX_PATH_MAX-1] = '\0'; + + tries = 100; + /* Always sleep at least once to give qemu a small chance to start up. */ + usleep (10000); + while (tries > 0) { + r = connect (g->sock, (struct sockaddr *) &addr, sizeof addr); + if ((r == -1 && errno == EINPROGRESS) || r == 0) + goto connected; + + if (errno != ENOENT) + perrorf (g, "connect"); + tries--; + usleep (100000); + } - if (fcntl (wfd[1], F_SETFL, O_NONBLOCK) == -1 || - fcntl (rfd[0], F_SETFL, O_NONBLOCK) == -1) { - perrorf (g, "fcntl"); + error (g, _("failed to connect to vmchannel socket")); goto cleanup1; + + connected: ; } - g->fd[0] = wfd[1]; /* stdin of child */ - g->fd[1] = rfd[0]; /* stdout of child */ + g->state = LAUNCHING; - /* Open the Unix socket. The vmchannel implementation that got - * merged with qemu sucks in a number of ways. Both ends do - * connect(2), which means that no one knows what, if anything, is - * connected to the other end, or if it becomes disconnected. Even - * worse, we have to wait some indeterminate time for qemu to create - * the socket and connect to it (which happens very early in qemu's - * start-up), so any code that uses vmchannel is inherently racy. - * Hence this silly loop. + /* Wait for qemu to start and to connect back to us via vmchannel and + * send the GUESTFS_LAUNCH_FLAG message. */ - g->sock = socket (AF_UNIX, SOCK_STREAM, 0); - if (g->sock == -1) { - perrorf (g, "socket"); - goto cleanup1; - } + uint32_t size; + void *buf = NULL; + r = recv_from_daemon (g, &size, &buf); + free (buf); - if (fcntl (g->sock, F_SETFL, O_NONBLOCK) == -1) { - perrorf (g, "fcntl"); - goto cleanup2; - } + if (r == -1) return -1; - addr.sun_family = AF_UNIX; - strncpy (addr.sun_path, unixsock, UNIX_PATH_MAX); - addr.sun_path[UNIX_PATH_MAX-1] = '\0'; + if (size != GUESTFS_LAUNCH_FLAG) { + error (g, _("guestfs_launch failed, see earlier error messages")); + goto cleanup1; + } - tries = 100; - /* Always sleep at least once to give qemu a small chance to start up. */ - usleep (10000); - while (tries > 0) { - r = connect (g->sock, (struct sockaddr *) &addr, sizeof addr); - if ((r == -1 && errno == EINPROGRESS) || r == 0) - goto connected; + if (g->verbose) + print_timestamped_message (g, "appliance is up"); - if (errno != ENOENT) - perrorf (g, "connect"); - tries--; - usleep (100000); + /* This is possible in some really strange situations, such as + * guestfsd starts up OK but then qemu immediately exits. Check for + * it because the caller is probably expecting to be able to send + * commands after this function returns. + */ + if (g->state != READY) { + error (g, _("qemu launched and contacted daemon, but state != READY")); + goto cleanup1; } - error (g, _("failed to connect to vmchannel socket")); - goto cleanup2; - - connected: - g->state = LAUNCHING; return 0; - cleanup2: - close (g->sock); - cleanup1: - close (wfd[1]); - close (rfd[0]); - kill (g->pid, 9); + if (!g->direct) { + close (wfd[1]); + close (rfd[0]); + } + if (g->pid > 0) kill (g->pid, 9); if (g->recoverypid > 0) kill (g->recoverypid, 9); waitpid (g->pid, NULL, 0); if (g->recoverypid > 0) waitpid (g->recoverypid, NULL, 0); g->fd[0] = -1; g->fd[1] = -1; - g->sock = -1; g->pid = 0; g->recoverypid = 0; - g->start_t = 0; + memset (&g->launch_t, 0, sizeof g->launch_t); cleanup0: + if (g->sock >= 0) { + close (g->sock); + g->sock = -1; + } + g->state = CONFIG; free (kernel); free (initrd); return -1; @@ -1275,6 +1575,9 @@ build_supermin_appliance (guestfs_h *g, const char *path, char cmd[4096]; int r, len; + if (g->verbose) + print_timestamped_message (g, "begin building supermin appliance"); + len = strlen (g->tmpdir); *kernel = safe_malloc (g, len + 8); snprintf (*kernel, len+8, "%s/kernel", g->tmpdir); @@ -1282,10 +1585,17 @@ build_supermin_appliance (guestfs_h *g, const char *path, snprintf (*initrd, len+8, "%s/initrd", g->tmpdir); snprintf (cmd, sizeof cmd, - "PATH='%s':$PATH " - "libguestfs-supermin-helper '%s' %s %s", + "febootstrap-supermin-helper%s " + "-k '%s/kmod.whitelist' " + "'%s/supermin.d' " + host_cpu " " + "%s %s", + g->verbose ? " --verbose" : "", + path, path, - path, *kernel, *initrd); + *kernel, *initrd); + if (g->verbose) + print_timestamped_message (g, "%s", cmd); r = system (cmd); if (r == -1 || WEXITSTATUS(r) != 0) { @@ -1296,9 +1606,48 @@ build_supermin_appliance (guestfs_h *g, const char *path, return -1; } + if (g->verbose) + print_timestamped_message (g, "finished building supermin appliance"); + return 0; } +/* Compute Y - X and return the result in milliseconds. + * Approximately the same as this code: + * http://www.mpp.mpg.de/~huber/util/timevaldiff.c + */ +static int64_t +timeval_diff (const struct timeval *x, const struct timeval *y) +{ + int64_t msec; + + msec = (y->tv_sec - x->tv_sec) * 1000; + msec += (y->tv_usec - x->tv_usec) / 1000; + return msec; +} + +static void +print_timestamped_message (guestfs_h *g, const char *fs, ...) +{ + va_list args; + char *msg; + int err; + struct timeval tv; + + va_start (args, fs); + err = vasprintf (&msg, fs, args); + va_end (args); + + if (err < 0) return; + + gettimeofday (&tv, NULL); + + fprintf (stderr, "[%05" PRIi64 "ms] %s\n", + timeval_diff (&g->launch_t, &tv), msg); + + free (msg); +} + static int read_all (guestfs_h *g, FILE *fp, char **ret); /* Test qemu binary (or wrapper) runs, and do 'qemu -help' and @@ -1311,12 +1660,7 @@ test_qemu (guestfs_h *g) char cmd[1024]; FILE *fp; - free (g->qemu_help); - free (g->qemu_version); - g->qemu_help = NULL; - g->qemu_version = NULL; - - snprintf (cmd, sizeof cmd, "'%s' -help", g->qemu); + snprintf (cmd, sizeof cmd, "LC_ALL=C '%s' -nographic -help", g->qemu); fp = popen (cmd, "r"); /* qemu -help should always work (qemu -version OTOH wasn't @@ -1338,7 +1682,8 @@ test_qemu (guestfs_h *g) if (pclose (fp) == -1) goto error; - snprintf (cmd, sizeof cmd, "'%s' -version 2>/dev/null", g->qemu); + snprintf (cmd, sizeof cmd, "LC_ALL=C '%s' -nographic -version 2>/dev/null", + g->qemu); fp = popen (cmd, "r"); if (fp) { @@ -1376,49 +1721,134 @@ read_all (guestfs_h *g, FILE *fp, char **ret) /* Test if option is supported by qemu command line (just by grepping * the help text). + * + * The first time this is used, it has to run the external qemu + * binary. If that fails, it returns -1. + * + * To just do the first-time run of the qemu binary, call this with + * option == NULL, in which case it will return -1 if there was an + * error doing that. */ static int qemu_supports (guestfs_h *g, const char *option) { - return g->qemu_help && strstr (g->qemu_help, option) != NULL; + if (!g->qemu_help) { + if (test_qemu (g) == -1) + return -1; + } + + if (option == NULL) + return 1; + + return strstr (g->qemu_help, option) != NULL; } -int -guestfs__wait_ready (guestfs_h *g) +/* Check if a file can be opened. */ +static int +is_openable (guestfs_h *g, const char *path, int flags) { - int r; - uint32_t size; - void *buf = NULL; + int fd = open (path, flags); + if (fd == -1) { + if (g->verbose) + perror (path); + return 0; + } + close (fd); + return 1; +} - if (g->state == READY) return 0; +/* Check the peer effective UID for a TCP socket. Ideally we'd like + * SO_PEERCRED for a loopback TCP socket. This isn't possible on + * Linux (but it is on Solaris!) so we read /proc/net/tcp instead. + */ +static int +check_peer_euid (guestfs_h *g, int sock, uid_t *rtn) +{ +#if CAN_CHECK_PEER_EUID + struct sockaddr_in peer; + socklen_t addrlen = sizeof peer; - if (g->state == BUSY) { - error (g, _("qemu has finished launching already")); + if (getpeername (sock, (struct sockaddr *) &peer, &addrlen) == -1) { + perrorf (g, "getpeername"); return -1; } - if (g->state != LAUNCHING) { - error (g, _("qemu has not been launched yet")); + if (peer.sin_family != AF_INET || + ntohl (peer.sin_addr.s_addr) != INADDR_LOOPBACK) { + error (g, "check_peer_euid: unexpected connection from non-IPv4, non-loopback peer (family = %d, addr = %s)", + peer.sin_family, inet_ntoa (peer.sin_addr)); return -1; } - r = recv_from_daemon (g, &size, &buf); - free (buf); + struct sockaddr_in our; + addrlen = sizeof our; + if (getsockname (sock, (struct sockaddr *) &our, &addrlen) == -1) { + perrorf (g, "getsockname"); + return -1; + } - if (r == -1) return -1; + FILE *fp = fopen ("/proc/net/tcp", "r"); + if (fp == NULL) { + perrorf (g, "/proc/net/tcp"); + return -1; + } - if (size != GUESTFS_LAUNCH_FLAG) { - error (g, _("guestfs_wait_ready failed, see earlier error messages")); + char line[256]; + if (fgets (line, sizeof line, fp) == NULL) { /* Drop first line. */ + error (g, "unexpected end of file in /proc/net/tcp"); + fclose (fp); return -1; } - /* This is possible in some really strange situations, such as - * guestfsd starts up OK but then qemu immediately exits. Check for - * it because the caller is probably expecting to be able to send - * commands after this function returns. + while (fgets (line, sizeof line, fp) != NULL) { + unsigned line_our_addr, line_our_port, line_peer_addr, line_peer_port; + int dummy0, dummy1, dummy2, dummy3, dummy4, dummy5, dummy6; + int line_uid; + + if (sscanf (line, "%d:%08X:%04X %08X:%04X %02X %08X:%08X %02X:%08X %08X %d", + &dummy0, + &line_our_addr, &line_our_port, + &line_peer_addr, &line_peer_port, + &dummy1, &dummy2, &dummy3, &dummy4, &dummy5, &dummy6, + &line_uid) == 12) { + /* Note about /proc/net/tcp: local_address and rem_address are + * always in network byte order. However the port part is + * always in host byte order. + * + * The sockname and peername that we got above are in network + * byte order. So we have to byte swap the port but not the + * address part. + */ + if (line_our_addr == our.sin_addr.s_addr && + line_our_port == ntohs (our.sin_port) && + line_peer_addr == peer.sin_addr.s_addr && + line_peer_port == ntohs (peer.sin_port)) { + *rtn = line_uid; + fclose (fp); + return 0; + } + } + } + + error (g, "check_peer_euid: no matching TCP connection found in /proc/net/tcp"); + fclose (fp); + return -1; +#else /* !CAN_CHECK_PEER_EUID */ + /* This function exists but should never be called in this + * configuration. */ - if (g->state != READY) { - error (g, _("qemu launched and contacted daemon, but state != READY")); + abort (); +#endif /* !CAN_CHECK_PEER_EUID */ +} + +/* You had to call this function after launch in versions <= 1.0.70, + * but it is now a no-op. + */ +int +guestfs__wait_ready (guestfs_h *g) +{ + if (g->state != READY) { + error (g, _("qemu has not been launched yet")); return -1; } @@ -1436,7 +1866,7 @@ guestfs__kill_subprocess (guestfs_h *g) if (g->verbose) fprintf (stderr, "sending SIGTERM to process %d\n", g->pid); - kill (g->pid, SIGTERM); + if (g->pid > 0) kill (g->pid, SIGTERM); if (g->recoverypid > 0) kill (g->recoverypid, 9); return 0; @@ -1587,7 +2017,7 @@ child_cleanup (guestfs_h *g) if (g->verbose) fprintf (stderr, "child_cleanup: %p: child process died\n", g); - /*kill (g->pid, SIGTERM);*/ + /*if (g->pid > 0) kill (g->pid, SIGTERM);*/ if (g->recoverypid > 0) kill (g->recoverypid, 9); waitpid (g->pid, NULL, 0); if (g->recoverypid > 0) waitpid (g->recoverypid, NULL, 0); @@ -1599,14 +2029,14 @@ child_cleanup (guestfs_h *g) g->sock = -1; g->pid = 0; g->recoverypid = 0; - g->start_t = 0; + memset (&g->launch_t, 0, sizeof g->launch_t); g->state = CONFIG; if (g->subprocess_quit_cb) g->subprocess_quit_cb (g, g->subprocess_quit_cb_data); } static int -read_log_message_or_eof (guestfs_h *g, int fd) +read_log_message_or_eof (guestfs_h *g, int fd, int error_if_eof) { char buf[BUFSIZ]; int n; @@ -1627,6 +2057,13 @@ read_log_message_or_eof (guestfs_h *g, int fd) if (n == 0) { /* Hopefully this indicates the qemu child process has died. */ child_cleanup (g); + + if (error_if_eof) { + /* We weren't expecting eof here (called from launch) so place + * something in the error buffer. RHBZ#588851. + */ + error (g, "child process died unexpectedly"); + } return -1; } @@ -1720,7 +2157,7 @@ send_to_daemon (guestfs_h *g, const void *v_buf, size_t n) FD_SET (g->sock, &rset); /* Read socket for cancellation & EOF. */ FD_SET (g->sock, &wset); /* Write to socket to send the data. */ - int max_fd = g->sock > g->fd[1] ? g->sock : g->fd[1]; + int max_fd = MAX (g->sock, g->fd[1]); while (n > 0) { rset2 = rset; @@ -1734,7 +2171,7 @@ send_to_daemon (guestfs_h *g, const void *v_buf, size_t n) } if (FD_ISSET (g->fd[1], &rset2)) { - if (read_log_message_or_eof (g, g->fd[1]) == -1) + if (read_log_message_or_eof (g, g->fd[1], 0) == -1) return -1; } if (FD_ISSET (g->sock, &rset2)) { @@ -1793,7 +2230,7 @@ recv_from_daemon (guestfs_h *g, uint32_t *size_rtn, void **buf_rtn) FD_SET (g->fd[1], &rset); /* Read qemu stdout for log messages & EOF. */ FD_SET (g->sock, &rset); /* Read socket for data & EOF. */ - int max_fd = g->sock > g->fd[1] ? g->sock : g->fd[1]; + int max_fd = MAX (g->sock, g->fd[1]); *size_rtn = 0; *buf_rtn = NULL; @@ -1817,7 +2254,7 @@ recv_from_daemon (guestfs_h *g, uint32_t *size_rtn, void **buf_rtn) } if (FD_ISSET (g->fd[1], &rset2)) { - if (read_log_message_or_eof (g, g->fd[1]) == -1) { + if (read_log_message_or_eof (g, g->fd[1], 0) == -1) { free (*buf_rtn); *buf_rtn = NULL; return -1; @@ -1917,7 +2354,7 @@ recv_from_daemon (guestfs_h *g, uint32_t *size_rtn, void **buf_rtn) printf (" "); printf ("|"); for (j = i; j < MIN (i+16, nr); ++j) - if (isprint ((*(char **)buf_rtn)[j])) + if (c_isprint ((*(char **)buf_rtn)[j])) printf ("%c", (*(char **)buf_rtn)[j]); else printf ("."); @@ -1931,6 +2368,64 @@ recv_from_daemon (guestfs_h *g, uint32_t *size_rtn, void **buf_rtn) return 0; } +/* This is very much like recv_from_daemon above, but g->sock is + * a listening socket and we are accepting a new connection on + * that socket instead of reading anything. Returns the newly + * accepted socket. + */ +static int +accept_from_daemon (guestfs_h *g) +{ + fd_set rset, rset2; + + if (g->verbose) + fprintf (stderr, + "accept_from_daemon: %p g->state = %d\n", g, g->state); + + FD_ZERO (&rset); + + FD_SET (g->fd[1], &rset); /* Read qemu stdout for log messages & EOF. */ + FD_SET (g->sock, &rset); /* Read socket for accept. */ + + int max_fd = MAX (g->sock, g->fd[1]); + int sock = -1; + + while (sock == -1) { + /* If the qemu process has died, clean up the zombie (RHBZ#579155). + * By partially polling in the select below we ensure that this + * function will be called eventually. + */ + waitpid (g->pid, NULL, WNOHANG); + + rset2 = rset; + + struct timeval tv = { .tv_sec = 1, .tv_usec = 0 }; + int r = select (max_fd+1, &rset2, NULL, NULL, &tv); + if (r == -1) { + if (errno == EINTR || errno == EAGAIN) + continue; + perrorf (g, "select"); + return -1; + } + + if (FD_ISSET (g->fd[1], &rset2)) { + if (read_log_message_or_eof (g, g->fd[1], 1) == -1) + return -1; + } + if (FD_ISSET (g->sock, &rset2)) { + sock = accept (g->sock, NULL, NULL); + if (sock == -1) { + if (errno == EINTR || errno == EAGAIN) + continue; + perrorf (g, "accept"); + return -1; + } + } + } + + return sock; +} + int guestfs___send (guestfs_h *g, int proc_nr, xdrproc_t xdrp, char *args) { @@ -2225,7 +2720,6 @@ guestfs___recv_file (guestfs_h *g, const char *filename) { void *buf; int fd, r; - size_t len; fd = open (filename, O_WRONLY|O_CREAT|O_TRUNC|O_NOCTTY, 0666); if (fd == -1) {