[thirdparty/systemd.git] / src / home / homework-directory.c

/* SPDX-License-Identifier: LGPL-2.1-or-later */

#include <sys/mount.h>

#include "btrfs-util.h"
#include "fd-util.h"
#include "homework-directory.h"
#include "homework-mount.h"
#include "homework-quota.h"
#include "mkdir.h"
#include "mount-util.h"
#include "path-util.h"
#include "rm-rf.h"
#include "tmpfile-util.h"
#include "umask-util.h"

int home_setup_directory(UserRecord *h, HomeSetup *setup) {
        const char *ip;
        int r;

        assert(h);
        assert(setup);
        assert(setup->root_fd < 0);

        /* We'll bind mount the image directory to a new mount point where we'll start adjusting it. Only
         * once that's complete we'll move the thing to its final place eventually. */
        r = home_unshare_and_mkdir();
        if (r < 0)
                return r;

        assert_se(ip = user_record_image_path(h));

        r = mount_follow_verbose(LOG_ERR, ip, HOME_RUNTIME_WORK_DIR, NULL, MS_BIND, NULL);
        if (r < 0)
                return r;

        setup->undo_mount = true;

        /* Turn off any form of propagation for this */
        r = mount_nofollow_verbose(LOG_ERR, NULL, HOME_RUNTIME_WORK_DIR, NULL, MS_PRIVATE, NULL);
        if (r < 0)
                return r;

        /* Adjust MS_SUID and similar flags */
        r = mount_nofollow_verbose(LOG_ERR, NULL, HOME_RUNTIME_WORK_DIR, NULL, MS_BIND|MS_REMOUNT|user_record_mount_flags(h), NULL);
        if (r < 0)
                return r;

        setup->root_fd = open(HOME_RUNTIME_WORK_DIR, O_RDONLY|O_CLOEXEC|O_DIRECTORY|O_NOFOLLOW);
        if (setup->root_fd < 0)
                return log_error_errno(errno, "Failed to open home directory: %m");

        return 0;
}

int home_activate_directory(
                UserRecord *h,
                HomeSetup *setup,
                PasswordCache *cache,
                UserRecord **ret_home) {

        _cleanup_(user_record_unrefp) UserRecord *new_home = NULL, *header_home = NULL;
        const char *hd, *hdo;
        int r;

        assert(h);
        assert(IN_SET(user_record_storage(h), USER_DIRECTORY, USER_SUBVOLUME, USER_FSCRYPT));
        assert(setup);
        assert(ret_home);

        assert_se(hdo = user_record_home_directory(h));
        hd = strdupa_safe(hdo);

        r = home_setup(h, 0, cache, setup, &header_home);
        if (r < 0)
                return r;

        r = home_refresh(h, setup, header_home, cache, NULL, &new_home);
        if (r < 0)
                return r;

        r = home_extend_embedded_identity(new_home, h, setup);
        if (r < 0)
                return r;

        /* Close fd to private mount before moving mount */
        setup->root_fd = safe_close(setup->root_fd);

        /* We are now done with everything, move the mount into place */
        r = home_move_mount(NULL, hd);
        if (r < 0)
                return r;

        setup->undo_mount = false;

        setup->do_drop_caches = false;

        log_info("Everything completed.");

        *ret_home = TAKE_PTR(new_home);
        return 0;
}

int home_create_directory_or_subvolume(UserRecord *h, HomeSetup *setup, UserRecord **ret_home) {
        _cleanup_(rm_rf_subvolume_and_freep) char *temporary = NULL;
        _cleanup_(user_record_unrefp) UserRecord *new_home = NULL;
        _cleanup_free_ char *d = NULL;
        const char *ip;
        int r;

        assert(h);
        assert(IN_SET(user_record_storage(h), USER_DIRECTORY, USER_SUBVOLUME));
        assert(setup);
        assert(ret_home);

        assert_se(ip = user_record_image_path(h));

        r = tempfn_random(ip, "homework", &d);
        if (r < 0)
                return log_error_errno(r, "Failed to allocate temporary directory: %m");

        (void) mkdir_parents(d, 0755);

        switch (user_record_storage(h)) {

        case USER_SUBVOLUME:
                RUN_WITH_UMASK(0077)
                        r = btrfs_subvol_make(d);

                if (r >= 0) {
                        log_info("Subvolume created.");

                        if (h->disk_size != UINT64_MAX) {

                                /* Enable quota for the subvolume we just created. Note we don't check for
                                 * errors here and only log about debug level about this. */
                                r = btrfs_quota_enable(d, true);
                                if (r < 0)
                                        log_debug_errno(r, "Failed to enable quota on %s, ignoring: %m", d);

                                r = btrfs_subvol_auto_qgroup(d, 0, false);
                                if (r < 0)
                                        log_debug_errno(r, "Failed to set up automatic quota group on %s, ignoring: %m", d);

                                /* Actually configure the quota. We also ignore errors here, but we do log
                                 * about them loudly, to keep things discoverable even though we don't
                                 * consider lacking quota support in kernel fatal. */
                                (void) home_update_quota_btrfs(h, d);
                        }

                        break;
                }
                if (r != -ENOTTY)
                        return log_error_errno(r, "Failed to create temporary home directory subvolume %s: %m", d);

                log_info("Creating subvolume %s is not supported, as file system does not support subvolumes. Falling back to regular directory.", d);
                _fallthrough_;

        case USER_DIRECTORY:

                if (mkdir(d, 0700) < 0)
                        return log_error_errno(errno, "Failed to create temporary home directory %s: %m", d);

                (void) home_update_quota_classic(h, d);
                break;

        default:
                assert_not_reached();
        }

        temporary = TAKE_PTR(d); /* Needs to be destroyed now */

        setup->root_fd = open(temporary, O_RDONLY|O_CLOEXEC|O_DIRECTORY|O_NOFOLLOW);
        if (setup->root_fd < 0)
                return log_error_errno(errno, "Failed to open temporary home directory: %m");

        r = home_populate(h, setup->root_fd);
        if (r < 0)
                return r;

        r = home_sync_and_statfs(setup->root_fd, NULL);
        if (r < 0)
                return r;

        r = user_record_clone(h, USER_RECORD_LOAD_MASK_SECRET|USER_RECORD_PERMISSIVE, &new_home);
        if (r < 0)
                return log_error_errno(r, "Failed to clone record: %m");

        r = user_record_add_binding(
                        new_home,
                        user_record_storage(h),
                        ip,
                        SD_ID128_NULL,
                        SD_ID128_NULL,
                        SD_ID128_NULL,
                        NULL,
                        NULL,
                        UINT64_MAX,
                        NULL,
                        NULL,
                        h->uid,
                        (gid_t) h->uid);
        if (r < 0)
                return log_error_errno(r, "Failed to add binding to record: %m");

        if (rename(temporary, ip) < 0)
                return log_error_errno(errno, "Failed to rename %s to %s: %m", temporary, ip);

        temporary = mfree(temporary);

        log_info("Everything completed.");

        *ret_home = TAKE_PTR(new_home);
        return 0;
}

int home_resize_directory(
                UserRecord *h,
                HomeSetupFlags flags,
                PasswordCache *cache,
                HomeSetup *setup,
                UserRecord **ret_home) {

        _cleanup_(user_record_unrefp) UserRecord *embedded_home = NULL, *new_home = NULL;
        int r;

        assert(h);
        assert(setup);
        assert(ret_home);
        assert(IN_SET(user_record_storage(h), USER_DIRECTORY, USER_SUBVOLUME, USER_FSCRYPT));

        r = home_setup(h, flags, cache, setup, NULL);
        if (r < 0)
                return r;

        r = home_load_embedded_identity(h, setup->root_fd, NULL, USER_RECONCILE_REQUIRE_NEWER_OR_EQUAL, cache, &embedded_home, &new_home);
        if (r < 0)
                return r;

        r = home_update_quota_auto(h, NULL);
        if (ERRNO_IS_NOT_SUPPORTED(r))
                return -ESOCKTNOSUPPORT; /* make recognizable */
        if (r < 0)
                return r;

        r = home_store_embedded_identity(new_home, setup->root_fd, h->uid, embedded_home);
        if (r < 0)
                return r;

        r = home_extend_embedded_identity(new_home, h, setup);
        if (r < 0)
                return r;

        r = home_sync_and_statfs(setup->root_fd, NULL);
        if (r < 0)
                return r;

        r = home_setup_done(setup);
        if (r < 0)
                return r;

        log_info("Everything completed.");

        *ret_home = TAKE_PTR(new_home);
        return 0;
}
Commit	Line	Data
db9ecf05	1	/* SPDX-License-Identifier: LGPL-2.1-or-later */
70a5db58 LP	2
	3	#include <sys/mount.h>
	4
	5	#include "btrfs-util.h"
	6	#include "fd-util.h"
	7	#include "homework-directory.h"
2ba38f78	8	#include "homework-mount.h"
70a5db58 LP	9	#include "homework-quota.h"
	10	#include "mkdir.h"
	11	#include "mount-util.h"
	12	#include "path-util.h"
	13	#include "rm-rf.h"
	14	#include "tmpfile-util.h"
	15	#include "umask-util.h"
	16
e1df968b	17	int home_setup_directory(UserRecord h, HomeSetup setup) {
2ba38f78 LP	18	const char *ip;
	19	int r;
	20
70a5db58 LP	21	assert(h);
70a5db58 LP	22	assert(setup);
2ba38f78 LP	23	assert(setup->root_fd < 0);
	24
	25	/* We'll bind mount the image directory to a new mount point where we'll start adjusting it. Only
	26	* once that's complete we'll move the thing to its final place eventually. */
	27	r = home_unshare_and_mkdir();
	28	if (r < 0)
	29	return r;
	30
	31	assert_se(ip = user_record_image_path(h));
	32
	33	r = mount_follow_verbose(LOG_ERR, ip, HOME_RUNTIME_WORK_DIR, NULL, MS_BIND, NULL);
	34	if (r < 0)
	35	return r;
70a5db58	36
2ba38f78 LP	37	setup->undo_mount = true;
	38
	39	/* Turn off any form of propagation for this */
	40	r = mount_nofollow_verbose(LOG_ERR, NULL, HOME_RUNTIME_WORK_DIR, NULL, MS_PRIVATE, NULL);
	41	if (r < 0)
	42	return r;
	43
	44	/* Adjust MS_SUID and similar flags */
	45	r = mount_nofollow_verbose(LOG_ERR, NULL, HOME_RUNTIME_WORK_DIR, NULL, MS_BIND\|MS_REMOUNT\|user_record_mount_flags(h), NULL);
	46	if (r < 0)
	47	return r;
	48
	49	setup->root_fd = open(HOME_RUNTIME_WORK_DIR, O_RDONLY\|O_CLOEXEC\|O_DIRECTORY\|O_NOFOLLOW);
70a5db58 LP	50	if (setup->root_fd < 0)
	51	return log_error_errno(errno, "Failed to open home directory: %m");
	52
	53	return 0;
	54	}
	55
	56	int home_activate_directory(
	57	UserRecord *h,
a74e2e44	58	HomeSetup *setup,
7b78db28	59	PasswordCache *cache,
70a5db58 LP	60	UserRecord **ret_home) {
	61
	62	_cleanup_(user_record_unrefp) UserRecord new_home = NULL, header_home = NULL;
2ba38f78	63	const char hd, hdo;
70a5db58 LP	64	int r;
	65
	66	assert(h);
	67	assert(IN_SET(user_record_storage(h), USER_DIRECTORY, USER_SUBVOLUME, USER_FSCRYPT));
a74e2e44	68	assert(setup);
70a5db58 LP	69	assert(ret_home);
70a5db58 LP	70
70a5db58	71	assert_se(hdo = user_record_home_directory(h));
2f82562b	72	hd = strdupa_safe(hdo);
70a5db58	73
a74e2e44	74	r = home_setup(h, 0, cache, setup, &header_home);
70a5db58 LP	75	if (r < 0)
	76	return r;
	77
a74e2e44	78	r = home_refresh(h, setup, header_home, cache, NULL, &new_home);
70a5db58 LP	79	if (r < 0)
	80	return r;
	81
cfef46f5 LP	82	r = home_extend_embedded_identity(new_home, h, setup);
	83	if (r < 0)
	84	return r;
	85
2ba38f78	86	/* Close fd to private mount before moving mount */
a74e2e44	87	setup->root_fd = safe_close(setup->root_fd);
70a5db58	88
2ba38f78 LP	89	/* We are now done with everything, move the mount into place */
2ba38f78 LP	90	r = home_move_mount(NULL, hd);
70a5db58 LP	91	if (r < 0)
	92	return r;
	93
2ba38f78	94	setup->undo_mount = false;
70a5db58	95
aa0379f1 LP	96	setup->do_drop_caches = false;
aa0379f1 LP	97
70a5db58 LP	98	log_info("Everything completed.");
	99
	100	*ret_home = TAKE_PTR(new_home);
	101	return 0;
	102	}
	103
e1aeaf27	104	int home_create_directory_or_subvolume(UserRecord h, HomeSetup setup, UserRecord **ret_home) {
70a5db58 LP	105	_cleanup_(rm_rf_subvolume_and_freep) char *temporary = NULL;
70a5db58 LP	106	_cleanup_(user_record_unrefp) UserRecord *new_home = NULL;
70a5db58 LP	107	_cleanup_free_ char *d = NULL;
	108	const char *ip;
	109	int r;
	110
	111	assert(h);
	112	assert(IN_SET(user_record_storage(h), USER_DIRECTORY, USER_SUBVOLUME));
e1aeaf27	113	assert(setup);
70a5db58 LP	114	assert(ret_home);
	115
	116	assert_se(ip = user_record_image_path(h));
	117
	118	r = tempfn_random(ip, "homework", &d);
	119	if (r < 0)
	120	return log_error_errno(r, "Failed to allocate temporary directory: %m");
	121
	122	(void) mkdir_parents(d, 0755);
	123
	124	switch (user_record_storage(h)) {
	125
	126	case USER_SUBVOLUME:
	127	RUN_WITH_UMASK(0077)
	128	r = btrfs_subvol_make(d);
	129
	130	if (r >= 0) {
	131	log_info("Subvolume created.");
	132
	133	if (h->disk_size != UINT64_MAX) {
	134
	135	/* Enable quota for the subvolume we just created. Note we don't check for
	136	* errors here and only log about debug level about this. */
	137	r = btrfs_quota_enable(d, true);
	138	if (r < 0)
	139	log_debug_errno(r, "Failed to enable quota on %s, ignoring: %m", d);
	140
	141	r = btrfs_subvol_auto_qgroup(d, 0, false);
	142	if (r < 0)
	143	log_debug_errno(r, "Failed to set up automatic quota group on %s, ignoring: %m", d);
	144
	145	/* Actually configure the quota. We also ignore errors here, but we do log
	146	* about them loudly, to keep things discoverable even though we don't
	147	* consider lacking quota support in kernel fatal. */
	148	(void) home_update_quota_btrfs(h, d);
	149	}
	150
	151	break;
	152	}
	153	if (r != -ENOTTY)
	154	return log_error_errno(r, "Failed to create temporary home directory subvolume %s: %m", d);
	155
	156	log_info("Creating subvolume %s is not supported, as file system does not support subvolumes. Falling back to regular directory.", d);
	157	_fallthrough_;
	158
	159	case USER_DIRECTORY:
	160
	161	if (mkdir(d, 0700) < 0)
	162	return log_error_errno(errno, "Failed to create temporary home directory %s: %m", d);
	163
	164	(void) home_update_quota_classic(h, d);
	165	break;
	166
	167	default:
04499a70	168	assert_not_reached();
70a5db58 LP	169	}
	170
	171	temporary = TAKE_PTR(d); /* Needs to be destroyed now */
	172
e1aeaf27 LP	173	setup->root_fd = open(temporary, O_RDONLY\|O_CLOEXEC\|O_DIRECTORY\|O_NOFOLLOW);
e1aeaf27 LP	174	if (setup->root_fd < 0)
70a5db58 LP	175	return log_error_errno(errno, "Failed to open temporary home directory: %m");
70a5db58 LP	176
e1aeaf27	177	r = home_populate(h, setup->root_fd);
70a5db58 LP	178	if (r < 0)
	179	return r;
	180
e1aeaf27	181	r = home_sync_and_statfs(setup->root_fd, NULL);
70a5db58 LP	182	if (r < 0)
	183	return r;
	184
bfc0cc1a	185	r = user_record_clone(h, USER_RECORD_LOAD_MASK_SECRET\|USER_RECORD_PERMISSIVE, &new_home);
70a5db58 LP	186	if (r < 0)
	187	return log_error_errno(r, "Failed to clone record: %m");
	188
	189	r = user_record_add_binding(
	190	new_home,
	191	user_record_storage(h),
	192	ip,
	193	SD_ID128_NULL,
	194	SD_ID128_NULL,
	195	SD_ID128_NULL,
	196	NULL,
	197	NULL,
	198	UINT64_MAX,
	199	NULL,
	200	NULL,
	201	h->uid,
	202	(gid_t) h->uid);
	203	if (r < 0)
	204	return log_error_errno(r, "Failed to add binding to record: %m");
	205
	206	if (rename(temporary, ip) < 0)
	207	return log_error_errno(errno, "Failed to rename %s to %s: %m", temporary, ip);
	208
	209	temporary = mfree(temporary);
	210
	211	log_info("Everything completed.");
	212
	213	*ret_home = TAKE_PTR(new_home);
	214	return 0;
	215	}
	216
	217	int home_resize_directory(
	218	UserRecord *h,
e1df968b	219	HomeSetupFlags flags,
7b78db28	220	PasswordCache *cache,
70a5db58 LP	221	HomeSetup *setup,
	222	UserRecord **ret_home) {
	223
	224	_cleanup_(user_record_unrefp) UserRecord embedded_home = NULL, new_home = NULL;
	225	int r;
	226
	227	assert(h);
	228	assert(setup);
	229	assert(ret_home);
	230	assert(IN_SET(user_record_storage(h), USER_DIRECTORY, USER_SUBVOLUME, USER_FSCRYPT));
	231
e1df968b	232	r = home_setup(h, flags, cache, setup, NULL);
70a5db58 LP	233	if (r < 0)
	234	return r;
	235
7b78db28	236	r = home_load_embedded_identity(h, setup->root_fd, NULL, USER_RECONCILE_REQUIRE_NEWER_OR_EQUAL, cache, &embedded_home, &new_home);
70a5db58 LP	237	if (r < 0)
	238	return r;
	239
	240	r = home_update_quota_auto(h, NULL);
	241	if (ERRNO_IS_NOT_SUPPORTED(r))
	242	return -ESOCKTNOSUPPORT; /* make recognizable */
	243	if (r < 0)
	244	return r;
	245
	246	r = home_store_embedded_identity(new_home, setup->root_fd, h->uid, embedded_home);
	247	if (r < 0)
	248	return r;
	249
	250	r = home_extend_embedded_identity(new_home, h, setup);
	251	if (r < 0)
	252	return r;
	253
	254	r = home_sync_and_statfs(setup->root_fd, NULL);
	255	if (r < 0)
	256	return r;
	257
66aa51f8	258	r = home_setup_done(setup);
70a5db58 LP	259	if (r < 0)
	260	return r;
	261
	262	log_info("Everything completed.");
	263
	264	*ret_home = TAKE_PTR(new_home);
	265	return 0;
	266	}