reflink.py 16 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479
  1. #
  2. # The Qubes OS Project, https://www.qubes-os.org/
  3. #
  4. # Copyright (C) 2018 Rusty Bird <rustybird@net-c.com>
  5. #
  6. # This library is free software; you can redistribute it and/or
  7. # modify it under the terms of the GNU Lesser General Public
  8. # License as published by the Free Software Foundation; either
  9. # version 2.1 of the License, or (at your option) any later version.
  10. #
  11. # This library is distributed in the hope that it will be useful,
  12. # but WITHOUT ANY WARRANTY; without even the implied warranty of
  13. # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
  14. # Lesser General Public License for more details.
  15. #
  16. # You should have received a copy of the GNU Lesser General Public
  17. # License along with this library; if not, see <https://www.gnu.org/licenses/>.
  18. #
  19. ''' Driver for handling VM images as files, without any device-mapper
  20. involvement. A reflink-capable filesystem is strongly recommended,
  21. but not required.
  22. '''
  23. import asyncio
  24. import collections
  25. import errno
  26. import fcntl
  27. import functools
  28. import glob
  29. import logging
  30. import os
  31. import subprocess
  32. import tempfile
  33. from contextlib import contextmanager, suppress
  34. import qubes.storage
  35. import qubes.utils
  36. FICLONE = 1074041865 # defined in <linux/fs.h>, assuming sizeof(int)==4
  37. LOOP_SET_CAPACITY = 0x4C07 # defined in <linux/loop.h>
  38. LOGGER = logging.getLogger('qubes.storage.reflink')
  39. def _coroutinized(function):
  40. ''' Wrap a synchronous function in a coroutine that runs the
  41. function via the event loop's ThreadPool-based default
  42. executor.
  43. '''
  44. @asyncio.coroutine
  45. @functools.wraps(function)
  46. def wrapper(*args, **kwargs):
  47. return (yield from asyncio.get_event_loop().run_in_executor(
  48. None, functools.partial(function, *args, **kwargs)))
  49. return wrapper
  50. class ReflinkPool(qubes.storage.Pool):
  51. driver = 'file-reflink'
  52. _known_dir_path_prefixes = ['appvms', 'vm-templates']
  53. def __init__(self, *, name, revisions_to_keep=1,
  54. dir_path, setup_check=True):
  55. super().__init__(name=name, revisions_to_keep=revisions_to_keep)
  56. self._setup_check = qubes.property.bool(None, None, setup_check)
  57. self._volumes = {}
  58. self.dir_path = os.path.abspath(dir_path)
  59. @_coroutinized
  60. def setup(self):
  61. created = _make_dir(self.dir_path)
  62. if self._setup_check and not is_supported(self.dir_path):
  63. if created:
  64. _remove_empty_dir(self.dir_path)
  65. raise qubes.storage.StoragePoolException(
  66. 'The filesystem for {!r} does not support reflinks. If you'
  67. ' can live with VM startup delays and wasted disk space, pass'
  68. ' the "setup_check=False" option.'.format(self.dir_path))
  69. for dir_path_prefix in self._known_dir_path_prefixes:
  70. _make_dir(os.path.join(self.dir_path, dir_path_prefix))
  71. return self
  72. def init_volume(self, vm, volume_config):
  73. # Fail closed on any strange VM dir_path_prefix, just in case
  74. # /etc/udev/rules.d/00-qubes-ignore-devices.rules needs update
  75. assert vm.dir_path_prefix in self._known_dir_path_prefixes, \
  76. 'Unknown dir_path_prefix {!r}'.format(vm.dir_path_prefix)
  77. volume_config['pool'] = self
  78. if 'revisions_to_keep' not in volume_config:
  79. volume_config['revisions_to_keep'] = self.revisions_to_keep
  80. if 'vid' not in volume_config:
  81. volume_config['vid'] = os.path.join(vm.dir_path_prefix, vm.name,
  82. volume_config['name'])
  83. volume = ReflinkVolume(**volume_config)
  84. self._volumes[volume_config['vid']] = volume
  85. return volume
  86. def list_volumes(self):
  87. return list(self._volumes.values())
  88. def get_volume(self, vid):
  89. return self._volumes[vid]
  90. def destroy(self):
  91. pass
  92. @property
  93. def config(self):
  94. return {
  95. 'name': self.name,
  96. 'dir_path': self.dir_path,
  97. 'driver': ReflinkPool.driver,
  98. 'revisions_to_keep': self.revisions_to_keep
  99. }
  100. @property
  101. def size(self):
  102. statvfs = os.statvfs(self.dir_path)
  103. return statvfs.f_frsize * statvfs.f_blocks
  104. @property
  105. def usage(self):
  106. statvfs = os.statvfs(self.dir_path)
  107. return statvfs.f_frsize * (statvfs.f_blocks - statvfs.f_bfree)
  108. def included_in(self, app):
  109. ''' Check if there is pool containing this one - either as a
  110. filesystem or its LVM volume'''
  111. return qubes.storage.search_pool_containing_dir(
  112. [pool for pool in app.pools.values() if pool is not self],
  113. self.dir_path)
  114. class ReflinkVolume(qubes.storage.Volume):
  115. def __init__(self, *args, **kwargs):
  116. super().__init__(*args, **kwargs)
  117. self._path_vid = os.path.join(self.pool.dir_path, self.vid)
  118. self._path_clean = self._path_vid + '.img'
  119. self._path_dirty = self._path_vid + '-dirty.img'
  120. self._path_import = self._path_vid + '-import.img'
  121. self.path = self._path_dirty
  122. @qubes.storage.Volume.locked
  123. @_coroutinized
  124. def create(self):
  125. self._remove_all_images()
  126. if self.save_on_stop and not self.snap_on_start:
  127. _create_sparse_file(self._path_clean, self._size)
  128. return self
  129. @_coroutinized
  130. def verify(self):
  131. if self.snap_on_start:
  132. img = self.source._path_clean # pylint: disable=protected-access
  133. elif self.save_on_stop:
  134. img = self._path_clean
  135. else:
  136. img = None
  137. if img is None or os.path.exists(img):
  138. return True
  139. raise qubes.storage.StoragePoolException(
  140. 'Missing image file {!r} for volume {}'.format(img, self.vid))
  141. @qubes.storage.Volume.locked
  142. @_coroutinized
  143. def remove(self):
  144. self.pool._volumes.pop(self, None) # pylint: disable=protected-access
  145. self._remove_all_images()
  146. _remove_empty_dir(os.path.dirname(self._path_vid))
  147. return self
  148. def _remove_all_images(self):
  149. self._remove_incomplete_images()
  150. self._prune_revisions(keep=0)
  151. _remove_file(self._path_clean)
  152. _remove_file(self._path_dirty)
  153. def _remove_incomplete_images(self):
  154. for tmp in glob.iglob(glob.escape(self._path_vid) + '*.img*~*'):
  155. _remove_file(tmp)
  156. _remove_file(self._path_import)
  157. def is_outdated(self):
  158. if self.snap_on_start:
  159. with suppress(FileNotFoundError):
  160. # pylint: disable=protected-access
  161. return (os.path.getmtime(self.source._path_clean) >
  162. os.path.getmtime(self._path_clean))
  163. return False
  164. def is_dirty(self):
  165. return self.save_on_stop and os.path.exists(self._path_dirty)
  166. @qubes.storage.Volume.locked
  167. @_coroutinized
  168. def start(self):
  169. self._remove_incomplete_images()
  170. if not self.is_dirty():
  171. if self.snap_on_start:
  172. # pylint: disable=protected-access
  173. _copy_file(self.source._path_clean, self._path_clean)
  174. if self.snap_on_start or self.save_on_stop:
  175. _copy_file(self._path_clean, self._path_dirty)
  176. else:
  177. # Preferably use the size of a leftover image, in case
  178. # the volume was previously resized - but then a crash
  179. # prevented qubes.xml serialization of the new size.
  180. _create_sparse_file(self._path_dirty, self.size)
  181. return self
  182. @qubes.storage.Volume.locked
  183. @_coroutinized
  184. def stop(self):
  185. if self.save_on_stop:
  186. self._commit(self._path_dirty)
  187. else:
  188. if not self.snap_on_start:
  189. self._size = self.size # preserve manual resize of image
  190. _remove_file(self._path_dirty)
  191. _remove_file(self._path_clean)
  192. return self
  193. def _commit(self, path_from):
  194. self._add_revision()
  195. self._prune_revisions()
  196. _fsync_path(path_from)
  197. _rename_file(path_from, self._path_clean)
  198. def _add_revision(self):
  199. if self.revisions_to_keep == 0:
  200. return
  201. ctime = os.path.getctime(self._path_clean)
  202. timestamp = qubes.storage.isodate(int(ctime))
  203. _copy_file(self._path_clean,
  204. self._path_revision(self._next_revision_number, timestamp))
  205. def _prune_revisions(self, keep=None):
  206. if keep is None:
  207. keep = self.revisions_to_keep
  208. # pylint: disable=invalid-unary-operand-type
  209. for number, timestamp in list(self.revisions.items())[:-keep or None]:
  210. _remove_file(self._path_revision(number, timestamp))
  211. @qubes.storage.Volume.locked
  212. @_coroutinized
  213. def revert(self, revision=None):
  214. if self.is_dirty():
  215. raise qubes.storage.StoragePoolException(
  216. 'Cannot revert: {} is not cleanly stopped'.format(self.vid))
  217. if revision is None:
  218. number, timestamp = list(self.revisions.items())[-1]
  219. else:
  220. number, timestamp = revision, None
  221. path_revision = self._path_revision(number, timestamp)
  222. self._add_revision()
  223. _rename_file(path_revision, self._path_clean)
  224. return self
  225. @qubes.storage.Volume.locked
  226. @_coroutinized
  227. def resize(self, size):
  228. ''' Resize a read-write volume; notify any corresponding loop
  229. devices of the size change.
  230. '''
  231. if not self.rw:
  232. raise qubes.storage.StoragePoolException(
  233. 'Cannot resize: {} is read-only'.format(self.vid))
  234. for path in (self._path_dirty, self._path_clean):
  235. with suppress(FileNotFoundError):
  236. _resize_file(path, size)
  237. break
  238. self._size = size
  239. if path == self._path_dirty:
  240. _update_loopdev_sizes(self._path_dirty)
  241. return self
  242. def export(self):
  243. if not self.save_on_stop:
  244. raise NotImplementedError(
  245. 'Cannot export: {} is not save_on_stop'.format(self.vid))
  246. return self._path_clean
  247. @qubes.storage.Volume.locked
  248. @_coroutinized
  249. def import_data(self, size):
  250. if not self.save_on_stop:
  251. raise NotImplementedError(
  252. 'Cannot import_data: {} is not save_on_stop'.format(self.vid))
  253. _create_sparse_file(self._path_import, size)
  254. return self._path_import
  255. def _import_data_end(self, success):
  256. (self._commit if success else _remove_file)(self._path_import)
  257. return self
  258. import_data_end = qubes.storage.Volume.locked(_coroutinized(
  259. _import_data_end))
  260. @qubes.storage.Volume.locked
  261. @asyncio.coroutine
  262. def import_volume(self, src_volume):
  263. if self.save_on_stop:
  264. try:
  265. success = False
  266. src_path = yield from qubes.utils.coro_maybe(
  267. src_volume.export())
  268. try:
  269. yield from _coroutinized(_copy_file)(
  270. src_path, self._path_import)
  271. finally:
  272. yield from qubes.utils.coro_maybe(
  273. src_volume.export_end(src_path))
  274. success = True
  275. finally:
  276. yield from _coroutinized(self._import_data_end)(success)
  277. return self
  278. def _path_revision(self, number, timestamp=None):
  279. if timestamp is None:
  280. timestamp = self.revisions[number]
  281. return self._path_clean + '.' + number + '@' + timestamp + 'Z'
  282. @property
  283. def _next_revision_number(self):
  284. numbers = self.revisions.keys()
  285. if numbers:
  286. return str(int(list(numbers)[-1]) + 1)
  287. return '1'
  288. @property
  289. def revisions(self):
  290. prefix = self._path_clean + '.'
  291. paths = glob.iglob(glob.escape(prefix) + '*@*Z')
  292. items = (path[len(prefix):-1].split('@') for path in paths)
  293. return collections.OrderedDict(sorted(items,
  294. key=lambda item: int(item[0])))
  295. @property
  296. def size(self):
  297. for path in (self._path_dirty, self._path_clean):
  298. with suppress(FileNotFoundError):
  299. return os.path.getsize(path)
  300. return self._size
  301. @property
  302. def usage(self):
  303. ''' Return volume disk usage from the VM's perspective. It is
  304. usually much lower from the host's perspective due to CoW.
  305. '''
  306. for path in (self._path_dirty, self._path_clean):
  307. with suppress(FileNotFoundError):
  308. return os.stat(path).st_blocks * 512
  309. return 0
  310. @contextmanager
  311. def _replace_file(dst):
  312. ''' Yield a tempfile whose name starts with dst, creating the last
  313. directory component if necessary. If the block does not raise
  314. an exception, safely rename the tempfile to dst.
  315. '''
  316. tmp_dir, prefix = os.path.split(dst + '~')
  317. _make_dir(tmp_dir)
  318. tmp = tempfile.NamedTemporaryFile(dir=tmp_dir, prefix=prefix, delete=False)
  319. try:
  320. yield tmp
  321. tmp.flush()
  322. os.fsync(tmp.fileno())
  323. tmp.close()
  324. _rename_file(tmp.name, dst)
  325. except:
  326. tmp.close()
  327. _remove_file(tmp.name)
  328. raise
  329. def _fsync_path(path):
  330. fd = os.open(path, os.O_RDONLY) # works for a file or a directory
  331. try:
  332. os.fsync(fd)
  333. finally:
  334. os.close(fd)
  335. def _make_dir(path):
  336. ''' mkdir path, ignoring FileExistsError; return whether we
  337. created it.
  338. '''
  339. with suppress(FileExistsError):
  340. os.mkdir(path)
  341. _fsync_path(os.path.dirname(path))
  342. LOGGER.info('Created directory: %s', path)
  343. return True
  344. return False
  345. def _remove_file(path):
  346. with suppress(FileNotFoundError):
  347. os.remove(path)
  348. _fsync_path(os.path.dirname(path))
  349. LOGGER.info('Removed file: %s', path)
  350. def _remove_empty_dir(path):
  351. try:
  352. os.rmdir(path)
  353. _fsync_path(os.path.dirname(path))
  354. LOGGER.info('Removed empty directory: %s', path)
  355. except OSError as ex:
  356. if ex.errno not in (errno.ENOENT, errno.ENOTEMPTY):
  357. raise
  358. def _rename_file(src, dst):
  359. os.rename(src, dst)
  360. dst_dir = os.path.dirname(dst)
  361. src_dir = os.path.dirname(src)
  362. _fsync_path(dst_dir)
  363. if src_dir != dst_dir:
  364. _fsync_path(src_dir)
  365. LOGGER.info('Renamed file: %s -> %s', src, dst)
  366. def _resize_file(path, size):
  367. ''' Resize an existing file. '''
  368. with open(path, 'rb+') as file:
  369. file.truncate(size)
  370. os.fsync(file.fileno())
  371. def _create_sparse_file(path, size):
  372. ''' Create an empty sparse file. '''
  373. with _replace_file(path) as tmp:
  374. tmp.truncate(size)
  375. LOGGER.info('Created sparse file: %s', tmp.name)
  376. def _update_loopdev_sizes(img):
  377. ''' Resolve img; update the size of loop devices backed by it. '''
  378. needle = os.fsencode(os.path.realpath(img)) + b'\n'
  379. for sys_path in glob.iglob('/sys/block/loop[0-9]*/loop/backing_file'):
  380. try:
  381. with open(sys_path, 'rb') as sys_io:
  382. if sys_io.read() != needle:
  383. continue
  384. except FileNotFoundError:
  385. continue
  386. with open('/dev/' + sys_path.split('/')[3], 'rb') as dev_io:
  387. fcntl.ioctl(dev_io.fileno(), LOOP_SET_CAPACITY)
  388. def _attempt_ficlone(src, dst):
  389. try:
  390. fcntl.ioctl(dst.fileno(), FICLONE, src.fileno())
  391. return True
  392. except OSError as ex:
  393. if ex.errno not in (errno.EBADF, errno.EINVAL,
  394. errno.EOPNOTSUPP, errno.EXDEV):
  395. raise
  396. return False
  397. def _copy_file(src, dst):
  398. ''' Copy src to dst as a reflink if possible, sparse if not. '''
  399. with _replace_file(dst) as tmp_io:
  400. with open(src, 'rb') as src_io:
  401. if _attempt_ficlone(src_io, tmp_io):
  402. LOGGER.info('Reflinked file: %s -> %s', src, tmp_io.name)
  403. return True
  404. LOGGER.info('Copying file: %s -> %s', src, tmp_io.name)
  405. cmd = 'cp', '--sparse=always', src, tmp_io.name
  406. p = subprocess.run(cmd, stdout=subprocess.PIPE, stderr=subprocess.PIPE,
  407. check=False)
  408. if p.returncode != 0:
  409. raise qubes.storage.StoragePoolException(str(p))
  410. return False
  411. def is_supported(dst_dir, src_dir=None):
  412. ''' Return whether destination directory supports reflink copies
  413. from source directory. (A temporary file is created in each
  414. directory, using O_TMPFILE if possible.)
  415. '''
  416. if src_dir is None:
  417. src_dir = dst_dir
  418. with tempfile.TemporaryFile(dir=src_dir) as src, \
  419. tempfile.TemporaryFile(dir=dst_dir) as dst:
  420. src.write(b'foo') # don't let any fs get clever with empty files
  421. return _attempt_ficlone(src, dst)