]> git.ipfire.org Git - thirdparty/systemd.git/blame - src/nspawn/nspawn.c
projects / thirdparty / systemd.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
Merge pull request #26785 from keszybz/udev-distcheck
[thirdparty/systemd.git] / src / nspawn / nspawn.c
CommitLineData
db9ecf05 1/* SPDX-License-Identifier: LGPL-2.1-or-later */
88213476 2
349cc4a5 3#if HAVE_BLKID
8fe0087e 4#endif
88213476 5#include <errno.h>
88213476 6#include <getopt.h>
503f480f 7#include <linux/fs.h>
1b9e5b12 8#include <linux/loop.h>
349cc4a5 9#if HAVE_SELINUX
8fe0087e 10#include <selinux/selinux.h>
1b9e5b12 11#endif
8fe0087e 12#include <stdlib.h>
8fe0087e 13#include <sys/file.h>
335d2ead 14#include <sys/ioctl.h>
8fe0087e
LP		 15#include <sys/personality.h>
16#include <sys/prctl.h>
17#include <sys/types.h>
6916b164 18#include <sys/wait.h>
335d2ead 19#include <termios.h>
8fe0087e 20#include <unistd.h>
1b9e5b12 21
b053cd5f 22#include "sd-bus.h"
1f0cd86b 23#include "sd-daemon.h"
1f0cd86b 24#include "sd-id128.h"
8fe0087e 25
b5efdb8a 26#include "alloc-util.h"
8fe0087e
LP		 27#include "barrier.h"
28#include "base-filesystem.h"
29#include "blkid-util.h"
30#include "btrfs-util.h"
d6b4d1c7 31#include "build.h"
b8ea7a6e 32#include "bus-error.h"
b053cd5f 33#include "bus-util.h"
8fe0087e 34#include "cap-list.h"
430f0182 35#include "capability-util.h"
04d391da 36#include "cgroup-util.h"
f4351959 37#include "chase-symlinks.h"
988851b6 38#include "common-signal.h"
8fe0087e 39#include "copy.h"
d107bb7d 40#include "cpu-set-util.h"
786d19fd 41#include "creds-util.h"
4fc9982c 42#include "dev-setup.h"
57f1b61b 43#include "discover-image.h"
2d845785 44#include "dissect-image.h"
8fe0087e 45#include "env-util.h"
3652872a 46#include "escape.h"
3ffd4af2 47#include "fd-util.h"
842f3b0f 48#include "fdset.h"
a5c32cff 49#include "fileio.h"
f97b34a6 50#include "format-util.h"
f4f15635 51#include "fs-util.h"
1b9e5b12 52#include "gpt.h"
4623e8e6 53#include "hexdecoct.h"
e2054217 54#include "hostname-setup.h"
8fe0087e 55#include "hostname-util.h"
910fd145 56#include "id128-util.h"
3652872a 57#include "io-util.h"
8fe0087e 58#include "log.h"
2d845785 59#include "loop-util.h"
8fe0087e 60#include "loopback-setup.h"
8fe0087e 61#include "macro.h"
44dbef90 62#include "main-func.h"
f5947a5e 63#include "missing_sched.h"
8fe0087e 64#include "mkdir.h"
4349cd7c 65#include "mount-util.h"
049af8ad 66#include "mountpoint-util.h"
0cb8e3d1 67#include "namespace-util.h"
8fe0087e 68#include "netlink-util.h"
2f893044 69#include "nspawn-bind-user.h"
07630cea 70#include "nspawn-cgroup.h"
3652872a 71#include "nspawn-creds.h"
3603efde 72#include "nspawn-def.h"
07630cea
LP		 73#include "nspawn-expose-ports.h"
74#include "nspawn-mount.h"
75#include "nspawn-network.h"
de40a303 76#include "nspawn-oci.h"
7336138e 77#include "nspawn-patch-uid.h"
07630cea 78#include "nspawn-register.h"
910fd145 79#include "nspawn-seccomp.h"
07630cea
LP		 80#include "nspawn-settings.h"
81#include "nspawn-setuid.h"
7732f92b 82#include "nspawn-stub-pid1.h"
c9394f4f 83#include "nspawn-util.h"
91181e07 84#include "nspawn.h"
d8b4d14d 85#include "nulstr-util.h"
d58ad743 86#include "os-util.h"
50ebcf6c 87#include "pager.h"
614b022c 88#include "parse-argument.h"
6bedfcbb 89#include "parse-util.h"
294bf0c3 90#include "pretty-print.h"
0b452006 91#include "process-util.h"
8fe0087e
LP		 92#include "ptyfwd.h"
93#include "random-util.h"
8869a0b4 94#include "raw-clone.h"
86775e35 95#include "resolve-util.h"
bf428efb 96#include "rlimit-util.h"
8fe0087e 97#include "rm-rf.h"
de40a303
LP		 98#if HAVE_SECCOMP
99#include "seccomp-util.h"
100#endif
68b02049 101#include "selinux-util.h"
8fe0087e 102#include "signal-util.h"
2583fbea 103#include "socket-util.h"
8fcde012 104#include "stat-util.h"
15a5e950 105#include "stdio-util.h"
5c828e66 106#include "string-table.h"
07630cea 107#include "string-util.h"
8fe0087e 108#include "strv.h"
de40a303 109#include "sysctl-util.h"
8fe0087e 110#include "terminal-util.h"
e4de7287 111#include "tmpfile-util.h"
affb60b1 112#include "umask-util.h"
43c3fb46 113#include "unit-name.h"
b1d4f8e1 114#include "user-util.h"
e9642be2 115
e96ceaba
LP		 116/* The notify socket inside the container it can use to talk to nspawn using the sd_notify(3) protocol */
117#define NSPAWN_NOTIFY_SOCKET_PATH "/run/host/notify"
e79581dd 118#define NSPAWN_MOUNT_TUNNEL "/run/host/incoming"
0e7ac751 119
2a49b612
ZJS		 120#define EXIT_FORCE_RESTART 133
121
113cea80
DH		 122typedef enum ContainerStatus {
123 CONTAINER_TERMINATED,
6145bb4f 124 CONTAINER_REBOOTED,
113cea80
DH		 125} ContainerStatus;
126
88213476 127static char *arg_directory = NULL;
ec16945e 128static char *arg_template = NULL;
5f932eb9 129static char *arg_chdir = NULL;
b53ede69
PW		 130static char *arg_pivot_root_new = NULL;
131static char *arg_pivot_root_old = NULL;
687d0825 132static char *arg_user = NULL;
de40a303
LP		 133static uid_t arg_uid = UID_INVALID;
134static gid_t arg_gid = GID_INVALID;
135static gid_t* arg_supplementary_gids = NULL;
136static size_t arg_n_supplementary_gids = 0;
9444b1f2 137static sd_id128_t arg_uuid = {};
3a9530e5
LP		 138static char *arg_machine = NULL; /* The name used by the host to refer to this */
139static char *arg_hostname = NULL; /* The name the payload sees by default */
c74e630d
LP		 140static const char *arg_selinux_context = NULL;
141static const char *arg_selinux_apifs_context = NULL;
de40a303 142static char *arg_slice = NULL;
ff01d048 143static bool arg_private_network = false;
bc2f673e 144static bool arg_read_only = false;
7732f92b 145static StartMode arg_start_mode = START_PID1;
ec16945e 146static bool arg_ephemeral = false;
57fb9fb5 147static LinkJournal arg_link_journal = LINK_AUTO;
574edc90 148static bool arg_link_journal_try = false;
520e0d54 149static uint64_t arg_caps_retain =
50b52222
LP		 150 (1ULL << CAP_AUDIT_CONTROL) |
151 (1ULL << CAP_AUDIT_WRITE) |
5076f0cc
LP		 152 (1ULL << CAP_CHOWN) |
153 (1ULL << CAP_DAC_OVERRIDE) |
154 (1ULL << CAP_DAC_READ_SEARCH) |
155 (1ULL << CAP_FOWNER) |
156 (1ULL << CAP_FSETID) |
157 (1ULL << CAP_IPC_OWNER) |
158 (1ULL << CAP_KILL) |
159 (1ULL << CAP_LEASE) |
160 (1ULL << CAP_LINUX_IMMUTABLE) |
50b52222 161 (1ULL << CAP_MKNOD) |
5076f0cc
LP		 162 (1ULL << CAP_NET_BIND_SERVICE) |
163 (1ULL << CAP_NET_BROADCAST) |
164 (1ULL << CAP_NET_RAW) |
5076f0cc 165 (1ULL << CAP_SETFCAP) |
50b52222 166 (1ULL << CAP_SETGID) |
5076f0cc
LP		 167 (1ULL << CAP_SETPCAP) |
168 (1ULL << CAP_SETUID) |
169 (1ULL << CAP_SYS_ADMIN) |
50b52222 170 (1ULL << CAP_SYS_BOOT) |
5076f0cc
LP		 171 (1ULL << CAP_SYS_CHROOT) |
172 (1ULL << CAP_SYS_NICE) |
173 (1ULL << CAP_SYS_PTRACE) |
d87be9b0 174 (1ULL << CAP_SYS_RESOURCE) |
50b52222 175 (1ULL << CAP_SYS_TTY_CONFIG);
88fc9c9b 176static uint64_t arg_caps_ambient = 0;
de40a303 177static CapabilityQuintet arg_full_capabilities = CAPABILITY_QUINTET_NULL;
5a8af538 178static CustomMount *arg_custom_mounts = NULL;
88614c8a 179static size_t arg_n_custom_mounts = 0;
f4889f65 180static char **arg_setenv = NULL;
284c0b91 181static bool arg_quiet = false;
eb91eb18 182static bool arg_register = true;
89f7c846 183static bool arg_keep_unit = false;
aa28aefe 184static char **arg_network_interfaces = NULL;
c74e630d 185static char **arg_network_macvlan = NULL;
4bbfe7ad 186static char **arg_network_ipvlan = NULL;
69c79d3c 187static bool arg_network_veth = false;
f6d6bad1 188static char **arg_network_veth_extra = NULL;
f757855e 189static char *arg_network_bridge = NULL;
22b28dfd 190static char *arg_network_zone = NULL;
d7bea6b6 191static char *arg_network_namespace_path = NULL;
bb068de0 192static PagerFlags arg_pager_flags = 0;
050f7277 193static unsigned long arg_personality = PERSONALITY_INVALID;
ec16945e 194static char *arg_image = NULL;
de40a303 195static char *arg_oci_bundle = NULL;
f757855e 196static VolatileMode arg_volatile_mode = VOLATILE_NO;
6d0b55c2 197static ExposePort *arg_expose_ports = NULL;
f36933fe 198static char **arg_property = NULL;
de40a303 199static sd_bus_message *arg_property_message = NULL;
0de7acce 200static UserNamespaceMode arg_userns_mode = USER_NAMESPACE_NO;
6dac160c 201static uid_t arg_uid_shift = UID_INVALID, arg_uid_range = 0x10000U;
6c045a99 202static UserNamespaceOwnership arg_userns_ownership = _USER_NAMESPACE_OWNERSHIP_INVALID;
c6c8f6e2 203static int arg_kill_signal = 0;
5da38d07 204static CGroupUnified arg_unified_cgroup_hierarchy = CGROUP_UNIFIED_UNKNOWN;
f757855e
LP		 205static SettingsMask arg_settings_mask = 0;
206static int arg_settings_trusted = -1;
207static char **arg_parameters = NULL;
6aadfa4c 208static const char *arg_container_service_name = "systemd-nspawn";
9c1e04d0 209static bool arg_notify_ready = false;
5a8ff0e6 210static bool arg_use_cgns = true;
0c582db0 211static unsigned long arg_clone_ns_flags = CLONE_NEWIPC|CLONE_NEWPID|CLONE_NEWUTS;
1099ceeb 212static MountSettingsMask arg_mount_settings = MOUNT_APPLY_APIVFS_RO|MOUNT_APPLY_TMPFS_TMP;
aee36b4e 213static VeritySettings arg_verity_settings = VERITY_SETTINGS_DEFAULT;
6b000af4
LP		 214static char **arg_syscall_allow_list = NULL;
215static char **arg_syscall_deny_list = NULL;
de40a303
LP		 216#if HAVE_SECCOMP
217static scmp_filter_ctx arg_seccomp = NULL;
218#endif
bf428efb 219static struct rlimit *arg_rlimit[_RLIMIT_MAX] = {};
66edd963 220static bool arg_no_new_privileges = false;
81f345df
LP		 221static int arg_oom_score_adjust = 0;
222static bool arg_oom_score_adjust_set = false;
0985c7c4 223static CPUSet arg_cpu_set = {};
09d423e9 224static ResolvConfMode arg_resolv_conf = RESOLV_CONF_AUTO;
1688841f 225static TimezoneMode arg_timezone = TIMEZONE_AUTO;
f5fbe71d 226static unsigned arg_console_width = UINT_MAX, arg_console_height = UINT_MAX;
de40a303
LP		 227static DeviceNode* arg_extra_nodes = NULL;
228static size_t arg_n_extra_nodes = 0;
229static char **arg_sysctl = NULL;
230static ConsoleMode arg_console_mode = _CONSOLE_MODE_INVALID;
3652872a
LP		 231static Credential *arg_credentials = NULL;
232static size_t arg_n_credentials = 0;
2f893044 233static char **arg_bind_user = NULL;
4a4654e0 234static bool arg_suppress_sync = false;
3603f151 235static char *arg_settings_filename = NULL;
4c27749b 236static Architecture arg_architecture = _ARCHITECTURE_INVALID;
88213476 237
6145bb4f
LP		 238STATIC_DESTRUCTOR_REGISTER(arg_directory, freep);
239STATIC_DESTRUCTOR_REGISTER(arg_template, freep);
240STATIC_DESTRUCTOR_REGISTER(arg_chdir, freep);
241STATIC_DESTRUCTOR_REGISTER(arg_pivot_root_new, freep);
242STATIC_DESTRUCTOR_REGISTER(arg_pivot_root_old, freep);
243STATIC_DESTRUCTOR_REGISTER(arg_user, freep);
244STATIC_DESTRUCTOR_REGISTER(arg_supplementary_gids, freep);
245STATIC_DESTRUCTOR_REGISTER(arg_machine, freep);
246STATIC_DESTRUCTOR_REGISTER(arg_hostname, freep);
247STATIC_DESTRUCTOR_REGISTER(arg_slice, freep);
248STATIC_DESTRUCTOR_REGISTER(arg_setenv, strv_freep);
249STATIC_DESTRUCTOR_REGISTER(arg_network_interfaces, strv_freep);
250STATIC_DESTRUCTOR_REGISTER(arg_network_macvlan, strv_freep);
251STATIC_DESTRUCTOR_REGISTER(arg_network_ipvlan, strv_freep);
252STATIC_DESTRUCTOR_REGISTER(arg_network_veth_extra, strv_freep);
253STATIC_DESTRUCTOR_REGISTER(arg_network_bridge, freep);
254STATIC_DESTRUCTOR_REGISTER(arg_network_zone, freep);
255STATIC_DESTRUCTOR_REGISTER(arg_network_namespace_path, freep);
256STATIC_DESTRUCTOR_REGISTER(arg_image, freep);
257STATIC_DESTRUCTOR_REGISTER(arg_oci_bundle, freep);
258STATIC_DESTRUCTOR_REGISTER(arg_property, strv_freep);
259STATIC_DESTRUCTOR_REGISTER(arg_property_message, sd_bus_message_unrefp);
260STATIC_DESTRUCTOR_REGISTER(arg_parameters, strv_freep);
89e62e0b 261STATIC_DESTRUCTOR_REGISTER(arg_verity_settings, verity_settings_done);
6b000af4
LP		 262STATIC_DESTRUCTOR_REGISTER(arg_syscall_allow_list, strv_freep);
263STATIC_DESTRUCTOR_REGISTER(arg_syscall_deny_list, strv_freep);
6145bb4f
LP		 264#if HAVE_SECCOMP
265STATIC_DESTRUCTOR_REGISTER(arg_seccomp, seccomp_releasep);
266#endif
0985c7c4 267STATIC_DESTRUCTOR_REGISTER(arg_cpu_set, cpu_set_reset);
6145bb4f 268STATIC_DESTRUCTOR_REGISTER(arg_sysctl, strv_freep);
2f893044 269STATIC_DESTRUCTOR_REGISTER(arg_bind_user, strv_freep);
3603f151 270STATIC_DESTRUCTOR_REGISTER(arg_settings_filename, freep);
6145bb4f 271
dce66ffe
ZJS		 272static int handle_arg_console(const char *arg) {
273 if (streq(arg, "help")) {
10e8a60b
LP		 274 puts("autopipe\n"
275 "interactive\n"
dce66ffe 276 "passive\n"
10e8a60b
LP		 277 "pipe\n"
278 "read-only");
dce66ffe
ZJS		 279 return 0;
280 }
281
282 if (streq(arg, "interactive"))
283 arg_console_mode = CONSOLE_INTERACTIVE;
284 else if (streq(arg, "read-only"))
285 arg_console_mode = CONSOLE_READ_ONLY;
286 else if (streq(arg, "passive"))
287 arg_console_mode = CONSOLE_PASSIVE;
554c4beb
LP		 288 else if (streq(arg, "pipe")) {
289 if (isatty(STDIN_FILENO) > 0 && isatty(STDOUT_FILENO) > 0)
290 log_full(arg_quiet ? LOG_DEBUG : LOG_NOTICE,
291 "Console mode 'pipe' selected, but standard input/output are connected to an interactive TTY. "
292 "Most likely you want to use 'interactive' console mode for proper interactivity and shell job control. "
293 "Proceeding anyway.");
294
dce66ffe 295 arg_console_mode = CONSOLE_PIPE;
10e8a60b
LP		 296 } else if (streq(arg, "autopipe")) {
297 if (isatty(STDIN_FILENO) > 0 && isatty(STDOUT_FILENO) > 0)
298 arg_console_mode = CONSOLE_INTERACTIVE;
299 else
300 arg_console_mode = CONSOLE_PIPE;
554c4beb 301 } else
dce66ffe
ZJS		 302 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Unknown console mode: %s", optarg);
303
304 arg_settings_mask |= SETTING_CONSOLE_MODE;
305 return 1;
306}
307
37ec0fdd
LP		 308static int help(void) {
309 _cleanup_free_ char *link = NULL;
310 int r;
311
384c2c32 312 pager_open(arg_pager_flags);
50ebcf6c 313
37ec0fdd
LP		 314 r = terminal_urlify_man("systemd-nspawn", "1", &link);
315 if (r < 0)
316 return log_oom();
317
25148653 318 printf("%1$s [OPTIONS...] [PATH] [ARGUMENTS...]\n\n"
37a92352 319 "%5$sSpawn a command or OS in a light-weight container.%6$s\n\n"
a8828ed9
DW		 320 " -h --help Show this help\n"
321 " --version Print version string\n"
69c79d3c 322 " -q --quiet Do not show status information\n"
bb068de0 323 " --no-pager Do not pipe output into a pager\n"
25148653
LP		 324 " --settings=BOOLEAN Load additional settings from .nspawn file\n\n"
325 "%3$sImage:%4$s\n"
1b9e5b12 326 " -D --directory=PATH Root directory for the container\n"
ec16945e
LP		 327 " --template=PATH Initialize root directory from template directory,\n"
328 " if missing\n"
329 " -x --ephemeral Run container with snapshot of root directory, and\n"
330 " remove it after exit\n"
25e68fd3
LP		 331 " -i --image=PATH Root file system disk image (or device node) for\n"
332 " the container\n"
de40a303 333 " --oci-bundle=PATH OCI bundle directory\n"
25148653
LP		 334 " --read-only Mount the root directory read-only\n"
335 " --volatile[=MODE] Run the system in volatile mode\n"
25e68fd3 336 " --root-hash=HASH Specify verity root hash for root disk image\n"
c2923fdc
LB		 337 " --root-hash-sig=SIG Specify pkcs7 signature of root hash for verity\n"
338 " as a DER encoded PKCS7, either as a path to a file\n"
339 " or as an ASCII base64 encoded string prefixed by\n"
340 " 'base64:'\n"
e7cbe5cb 341 " --verity-data=PATH Specify hash device for verity\n"
25148653
LP		 342 " --pivot-root=PATH[:PATH]\n"
343 " Pivot root to given directory in the container\n\n"
344 "%3$sExecution:%4$s\n"
7732f92b 345 " -a --as-pid2 Maintain a stub init as PID1, invoke binary as PID2\n"
a8828ed9 346 " -b --boot Boot up full system (i.e. invoke init)\n"
5f932eb9 347 " --chdir=PATH Set working directory in the container\n"
0d2a0179 348 " -E --setenv=NAME[=VALUE] Pass an environment variable to PID 1\n"
25148653
LP		 349 " -u --user=USER Run the command under specified user or UID\n"
350 " --kill-signal=SIGNAL Select signal to use for shutting down PID 1\n"
4a4654e0
LP		 351 " --notify-ready=BOOLEAN Receive notifications from the child init process\n"
352 " --suppress-sync=BOOLEAN\n"
353 " Suppress any form of disk data synchronization\n\n"
25148653 354 "%3$sSystem Identity:%4$s\n"
a8828ed9 355 " -M --machine=NAME Set the machine name for the container\n"
3a9530e5 356 " --hostname=NAME Override the hostname for the container\n"
25148653
LP		 357 " --uuid=UUID Set a specific machine UUID for the container\n\n"
358 "%3$sProperties:%4$s\n"
a8828ed9 359 " -S --slice=SLICE Place the container in the specified slice\n"
f36933fe 360 " --property=NAME=VALUE Set scope unit property\n"
25148653
LP		 361 " --register=BOOLEAN Register container as machine\n"
362 " --keep-unit Do not register a scope for the machine, reuse\n"
363 " the service unit nspawn is running in\n\n"
364 "%3$sUser Namespacing:%4$s\n"
b917743d
YW		 365 " --private-users=no Run without user namespacing\n"
366 " --private-users=yes|pick|identity\n"
367 " Run within user namespace, autoselect UID/GID range\n"
368 " --private-users=UIDBASE[:NUIDS]\n"
90b4a64d 369 " Similar, but with user configured UID/GID range\n"
6c045a99
LP		 370 " --private-users-ownership=MODE\n"
371 " Adjust ('chown') or map ('map') OS tree ownership\n"
b917743d
YW		 372 " to private UID/GID range\n"
373 " -U Equivalent to --private-users=pick and\n"
374 " --private-users-ownership=auto\n\n"
25148653 375 "%3$sNetworking:%4$s\n"
69c79d3c
LP		 376 " --private-network Disable network in container\n"
377 " --network-interface=INTERFACE\n"
378 " Assign an existing network interface to the\n"
379 " container\n"
c74e630d
LP		 380 " --network-macvlan=INTERFACE\n"
381 " Create a macvlan network interface based on an\n"
382 " existing network interface to the container\n"
4bbfe7ad 383 " --network-ipvlan=INTERFACE\n"
387f6955 384 " Create an ipvlan network interface based on an\n"
4bbfe7ad 385 " existing network interface to the container\n"
a8eaaee7 386 " -n --network-veth Add a virtual Ethernet connection between host\n"
69c79d3c 387 " and container\n"
f6d6bad1
LP		 388 " --network-veth-extra=HOSTIF[:CONTAINERIF]\n"
389 " Add an additional virtual Ethernet link between\n"
390 " host and container\n"
ab046dde 391 " --network-bridge=INTERFACE\n"
90b4a64d
ZJS		 392 " Add a virtual Ethernet connection to the container\n"
393 " and attach it to an existing bridge on the host\n"
394 " --network-zone=NAME Similar, but attach the new interface to an\n"
395 " an automatically managed bridge interface\n"
d7bea6b6
DP		 396 " --network-namespace-path=PATH\n"
397 " Set network namespace to the one represented by\n"
398 " the specified kernel namespace file node\n"
6d0b55c2 399 " -p --port=[PROTOCOL:]HOSTPORT[:CONTAINERPORT]\n"
25148653
LP		 400 " Expose a container IP port on the host\n\n"
401 "%3$sSecurity:%4$s\n"
a8828ed9
DW		 402 " --capability=CAP In addition to the default, retain specified\n"
403 " capability\n"
404 " --drop-capability=CAP Drop the specified capability from the default set\n"
88fc9c9b
TH		 405 " --ambient-capability=CAP\n"
406 " Sets the specified capability for the started\n"
407 " process. Not useful if booting a machine.\n"
f4e803c8 408 " --no-new-privileges Set PR_SET_NO_NEW_PRIVS flag for container payload\n"
960e4569
LP		 409 " --system-call-filter=LIST|~LIST\n"
410 " Permit/prohibit specific system calls\n"
25148653
LP		 411 " -Z --selinux-context=SECLABEL\n"
412 " Set the SELinux security context to be used by\n"
413 " processes in the container\n"
414 " -L --selinux-apifs-context=SECLABEL\n"
415 " Set the SELinux security context to be used by\n"
416 " API/tmpfs file systems in the container\n\n"
417 "%3$sResources:%4$s\n"
bf428efb 418 " --rlimit=NAME=LIMIT Set a resource limit for the payload\n"
81f345df
LP		 419 " --oom-score-adjust=VALUE\n"
420 " Adjust the OOM score value for the payload\n"
f4e803c8
LP		 421 " --cpu-affinity=CPUS Adjust the CPU affinity of the container\n"
422 " --personality=ARCH Pick personality for this container\n\n"
25148653 423 "%3$sIntegration:%4$s\n"
09d423e9 424 " --resolv-conf=MODE Select mode of /etc/resolv.conf initialization\n"
1688841f 425 " --timezone=MODE Select mode of /etc/localtime initialization\n"
25148653
LP		 426 " --link-journal=MODE Link up guest journal, one of no, auto, guest, \n"
427 " host, try-guest, try-host\n"
428 " -j Equivalent to --link-journal=try-guest\n\n"
429 "%3$sMounts:%4$s\n"
5e5bfa6e
EY		 430 " --bind=PATH[:PATH[:OPTIONS]]\n"
431 " Bind mount a file or directory from the host into\n"
a8828ed9 432 " the container\n"
5e5bfa6e
EY		 433 " --bind-ro=PATH[:PATH[:OPTIONS]\n"
434 " Similar, but creates a read-only bind mount\n"
de40a303
LP		 435 " --inaccessible=PATH Over-mount file node with inaccessible node to mask\n"
436 " it\n"
06c17c39 437 " --tmpfs=PATH:[OPTIONS] Mount an empty tmpfs to the specified directory\n"
5a8af538
LP		 438 " --overlay=PATH[:PATH...]:PATH\n"
439 " Create an overlay mount from the host to \n"
440 " the container\n"
441 " --overlay-ro=PATH[:PATH...]:PATH\n"
2f893044
LP		 442 " Similar, but creates a read-only overlay mount\n"
443 " --bind-user=NAME Bind user from host to container\n\n"
25148653 444 "%3$sInput/Output:%4$s\n"
de40a303
LP		 445 " --console=MODE Select how stdin/stdout/stderr and /dev/console are\n"
446 " set up for the container.\n"
3652872a
LP		 447 " -P --pipe Equivalent to --console=pipe\n\n"
448 "%3$sCredentials:%4$s\n"
449 " --set-credential=ID:VALUE\n"
450 " Pass a credential with literal value to container.\n"
451 " --load-credential=ID:PATH\n"
452 " Load credential to pass to container from file or\n"
453 " AF_UNIX stream socket.\n"
bc556335
DDM		 454 "\nSee the %2$s for details.\n",
455 program_invocation_short_name,
456 link,
457 ansi_underline(),
458 ansi_normal(),
459 ansi_highlight(),
460 ansi_normal());
37ec0fdd
LP		 461
462 return 0;
88213476
LP		 463}
464
86c0dd4a 465static int custom_mount_check_all(void) {
88614c8a 466 size_t i;
5a8af538 467
5a8af538
LP		 468 for (i = 0; i < arg_n_custom_mounts; i++) {
469 CustomMount *m = &arg_custom_mounts[i];
470
0de7acce 471 if (path_equal(m->destination, "/") && arg_userns_mode != USER_NAMESPACE_NO) {
6c045a99 472 if (arg_userns_ownership != USER_NAMESPACE_OWNERSHIP_OFF)
baaa35ad 473 return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
c920b863 474 "--private-users-ownership=own may not be combined with custom root mounts.");
6c045a99 475 if (arg_uid_shift == UID_INVALID)
baaa35ad
ZJS		 476 return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
477 "--private-users with automatic UID shift may not be combined with custom root mounts.");
825d5287 478 }
5a8af538
LP		 479 }
480
481 return 0;
482}
483
8199d554 484static int detect_unified_cgroup_hierarchy_from_environment(void) {
c78c095b 485 const char *e, *var = "SYSTEMD_NSPAWN_UNIFIED_HIERARCHY";
415fc41c 486 int r;
5da38d07 487
efdb0237 488 /* Allow the user to control whether the unified hierarchy is used */
c78c095b
ZJS		 489
490 e = getenv(var);
491 if (!e) {
d5fc5b2f 492 /* $UNIFIED_CGROUP_HIERARCHY has been renamed to $SYSTEMD_NSPAWN_UNIFIED_HIERARCHY. */
c78c095b
ZJS		 493 var = "UNIFIED_CGROUP_HIERARCHY";
494 e = getenv(var);
c78c095b
ZJS		 495 }
496
497 if (!isempty(e)) {
efdb0237
LP		 498 r = parse_boolean(e);
499 if (r < 0)
c78c095b 500 return log_error_errno(r, "Failed to parse $%s: %m", var);
5da38d07
TH		 501 if (r > 0)
502 arg_unified_cgroup_hierarchy = CGROUP_UNIFIED_ALL;
503 else
504 arg_unified_cgroup_hierarchy = CGROUP_UNIFIED_NONE;
efdb0237
LP		 505 }
506
8199d554
LP		 507 return 0;
508}
509
510static int detect_unified_cgroup_hierarchy_from_image(const char *directory) {
511 int r;
512
75b0d8b8
ZJS		 513 /* Let's inherit the mode to use from the host system, but let's take into consideration what systemd
514 * in the image actually supports. */
b4cccbc1
LP		 515 r = cg_all_unified();
516 if (r < 0)
517 return log_error_errno(r, "Failed to determine whether we are in all unified mode.");
518 if (r > 0) {
a8725a06
ZJS		 519 /* Unified cgroup hierarchy support was added in 230. Unfortunately the detection
520 * routine only detects 231, so we'll have a false negative here for 230. */
7e6821ed 521 r = systemd_installation_has_version(directory, "230");
a8725a06
ZJS		 522 if (r < 0)
523 return log_error_errno(r, "Failed to determine systemd version in container: %m");
524 if (r > 0)
525 arg_unified_cgroup_hierarchy = CGROUP_UNIFIED_ALL;
526 else
527 arg_unified_cgroup_hierarchy = CGROUP_UNIFIED_NONE;
c22800e4 528 } else if (cg_unified_controller(SYSTEMD_CGROUP_CONTROLLER) > 0) {
2977724b 529 /* Mixed cgroup hierarchy support was added in 233 */
7e6821ed 530 r = systemd_installation_has_version(directory, "233");
0fd9563f
ZJS		 531 if (r < 0)
532 return log_error_errno(r, "Failed to determine systemd version in container: %m");
533 if (r > 0)
534 arg_unified_cgroup_hierarchy = CGROUP_UNIFIED_SYSTEMD;
535 else
536 arg_unified_cgroup_hierarchy = CGROUP_UNIFIED_NONE;
537 } else
5da38d07 538 arg_unified_cgroup_hierarchy = CGROUP_UNIFIED_NONE;
efdb0237 539
8199d554
LP		 540 log_debug("Using %s hierarchy for container.",
541 arg_unified_cgroup_hierarchy == CGROUP_UNIFIED_NONE ? "legacy" :
542 arg_unified_cgroup_hierarchy == CGROUP_UNIFIED_SYSTEMD ? "hybrid" : "unified");
543
efdb0237
LP		 544 return 0;
545}
546
8a99bd0c
ZJS		 547static int parse_capability_spec(const char *spec, uint64_t *ret_mask) {
548 uint64_t mask = 0;
549 int r;
550
551 for (;;) {
552 _cleanup_free_ char *t = NULL;
553
554 r = extract_first_word(&spec, &t, ",", 0);
555 if (r < 0)
556 return log_error_errno(r, "Failed to parse capability %s.", t);
557 if (r == 0)
558 break;
559
560 if (streq(t, "help")) {
561 for (int i = 0; i < capability_list_length(); i++) {
562 const char *name;
563
564 name = capability_to_name(i);
565 if (name)
566 puts(name);
567 }
568
569 return 0; /* quit */
570 }
571
572 if (streq(t, "all"))
f5fbe71d 573 mask = UINT64_MAX;
8a99bd0c
ZJS		 574 else {
575 r = capability_from_name(t);
576 if (r < 0)
577 return log_error_errno(r, "Failed to parse capability %s.", t);
578
579 mask |= 1ULL << r;
580 }
581 }
582
583 *ret_mask = mask;
584 return 1; /* continue */
585}
586
49048684 587static int parse_share_ns_env(const char *name, unsigned long ns_flag) {
0c582db0
LB		 588 int r;
589
590 r = getenv_bool(name);
591 if (r == -ENXIO)
49048684 592 return 0;
0c582db0 593 if (r < 0)
49048684 594 return log_error_errno(r, "Failed to parse $%s: %m", name);
de40a303 595
0c582db0 596 arg_clone_ns_flags = (arg_clone_ns_flags & ~ns_flag) | (r > 0 ? 0 : ns_flag);
de40a303 597 arg_settings_mask |= SETTING_CLONE_NS_FLAGS;
49048684 598 return 0;
0c582db0
LB		 599}
600
49048684 601static int parse_mount_settings_env(void) {
4f086aab 602 const char *e;
1099ceeb
LP		 603 int r;
604
605 r = getenv_bool("SYSTEMD_NSPAWN_TMPFS_TMP");
49048684
ZJS		 606 if (r < 0 && r != -ENXIO)
607 return log_error_errno(r, "Failed to parse $SYSTEMD_NSPAWN_TMPFS_TMP: %m");
1099ceeb
LP		 608 if (r >= 0)
609 SET_FLAG(arg_mount_settings, MOUNT_APPLY_TMPFS_TMP, r > 0);
4f086aab
SU		 610
611 e = getenv("SYSTEMD_NSPAWN_API_VFS_WRITABLE");
49048684 612 if (streq_ptr(e, "network"))
4f086aab 613 arg_mount_settings |= MOUNT_APPLY_APIVFS_RO|MOUNT_APPLY_APIVFS_NETNS;
4f086aab 614
49048684
ZJS		 615 else if (e) {
616 r = parse_boolean(e);
617 if (r < 0)
618 return log_error_errno(r, "Failed to parse $SYSTEMD_NSPAWN_API_VFS_WRITABLE: %m");
619
620 SET_FLAG(arg_mount_settings, MOUNT_APPLY_APIVFS_RO, r == 0);
621 SET_FLAG(arg_mount_settings, MOUNT_APPLY_APIVFS_NETNS, false);
ab8ee0f2 622 }
4f086aab 623
49048684 624 return 0;
4f086aab
SU		 625}
626
49048684 627static int parse_environment(void) {
d5455d2f
LP		 628 const char *e;
629 int r;
630
49048684
ZJS		 631 r = parse_share_ns_env("SYSTEMD_NSPAWN_SHARE_NS_IPC", CLONE_NEWIPC);
632 if (r < 0)
633 return r;
634 r = parse_share_ns_env("SYSTEMD_NSPAWN_SHARE_NS_PID", CLONE_NEWPID);
635 if (r < 0)
636 return r;
637 r = parse_share_ns_env("SYSTEMD_NSPAWN_SHARE_NS_UTS", CLONE_NEWUTS);
638 if (r < 0)
639 return r;
640 r = parse_share_ns_env("SYSTEMD_NSPAWN_SHARE_SYSTEM", CLONE_NEWIPC|CLONE_NEWPID|CLONE_NEWUTS);
641 if (r < 0)
642 return r;
d5455d2f 643
49048684
ZJS		 644 r = parse_mount_settings_env();
645 if (r < 0)
646 return r;
d5455d2f 647
489fae52
ZJS		 648 /* SYSTEMD_NSPAWN_USE_CGNS=0 can be used to disable CLONE_NEWCGROUP use,
649 * even if it is supported. If not supported, it has no effect. */
de40a303 650 if (!cg_ns_supported())
489fae52 651 arg_use_cgns = false;
de40a303
LP		 652 else {
653 r = getenv_bool("SYSTEMD_NSPAWN_USE_CGNS");
654 if (r < 0) {
655 if (r != -ENXIO)
49048684 656 return log_error_errno(r, "Failed to parse $SYSTEMD_NSPAWN_USE_CGNS: %m");
de40a303
LP		 657
658 arg_use_cgns = true;
659 } else {
660 arg_use_cgns = r > 0;
661 arg_settings_mask |= SETTING_USE_CGNS;
662 }
663 }
d5455d2f
LP		 664
665 e = getenv("SYSTEMD_NSPAWN_CONTAINER_SERVICE");
666 if (e)
667 arg_container_service_name = e;
668
4a4654e0
LP		 669 r = getenv_bool("SYSTEMD_SUPPRESS_SYNC");
670 if (r >= 0)
671 arg_suppress_sync = r;
672 else if (r != -ENXIO)
673 log_debug_errno(r, "Failed to parse $SYSTEMD_SUPPRESS_SYNC, ignoring: %m");
674
49048684 675 return detect_unified_cgroup_hierarchy_from_environment();
d5455d2f
LP		 676}
677
88213476 678static int parse_argv(int argc, char *argv[]) {
a41fe3a2 679 enum {
acbeb427
ZJS		 680 ARG_VERSION = 0x100,
681 ARG_PRIVATE_NETWORK,
bc2f673e 682 ARG_UUID,
5076f0cc 683 ARG_READ_ONLY,
57fb9fb5 684 ARG_CAPABILITY,
88fc9c9b 685 ARG_AMBIENT_CAPABILITY,
420c7379 686 ARG_DROP_CAPABILITY,
17fe0523
LP		 687 ARG_LINK_JOURNAL,
688 ARG_BIND,
f4889f65 689 ARG_BIND_RO,
06c17c39 690 ARG_TMPFS,
5a8af538
LP		 691 ARG_OVERLAY,
692 ARG_OVERLAY_RO,
de40a303 693 ARG_INACCESSIBLE,
eb91eb18 694 ARG_SHARE_SYSTEM,
89f7c846 695 ARG_REGISTER,
aa28aefe 696 ARG_KEEP_UNIT,
69c79d3c 697 ARG_NETWORK_INTERFACE,
c74e630d 698 ARG_NETWORK_MACVLAN,
4bbfe7ad 699 ARG_NETWORK_IPVLAN,
ab046dde 700 ARG_NETWORK_BRIDGE,
22b28dfd 701 ARG_NETWORK_ZONE,
f6d6bad1 702 ARG_NETWORK_VETH_EXTRA,
d7bea6b6 703 ARG_NETWORK_NAMESPACE_PATH,
6afc95b7 704 ARG_PERSONALITY,
4d9f07b4 705 ARG_VOLATILE,
ec16945e 706 ARG_TEMPLATE,
f36933fe 707 ARG_PROPERTY,
6dac160c 708 ARG_PRIVATE_USERS,
c6c8f6e2 709 ARG_KILL_SIGNAL,
f757855e 710 ARG_SETTINGS,
5f932eb9 711 ARG_CHDIR,
b53ede69 712 ARG_PIVOT_ROOT,
7336138e 713 ARG_PRIVATE_USERS_CHOWN,
6c045a99 714 ARG_PRIVATE_USERS_OWNERSHIP,
9c1e04d0 715 ARG_NOTIFY_READY,
4623e8e6 716 ARG_ROOT_HASH,
89e62e0b
LP		 717 ARG_ROOT_HASH_SIG,
718 ARG_VERITY_DATA,
960e4569 719 ARG_SYSTEM_CALL_FILTER,
bf428efb 720 ARG_RLIMIT,
3a9530e5 721 ARG_HOSTNAME,
66edd963 722 ARG_NO_NEW_PRIVILEGES,
81f345df 723 ARG_OOM_SCORE_ADJUST,
d107bb7d 724 ARG_CPU_AFFINITY,
09d423e9 725 ARG_RESOLV_CONF,
1688841f 726 ARG_TIMEZONE,
de40a303
LP		 727 ARG_CONSOLE,
728 ARG_PIPE,
729 ARG_OCI_BUNDLE,
bb068de0 730 ARG_NO_PAGER,
3652872a
LP		 731 ARG_SET_CREDENTIAL,
732 ARG_LOAD_CREDENTIAL,
2f893044 733 ARG_BIND_USER,
4a4654e0 734 ARG_SUPPRESS_SYNC,
a41fe3a2
LP		 735 };
736
88213476 737 static const struct option options[] = {
d7bea6b6
DP		 738 { "help", no_argument, NULL, 'h' },
739 { "version", no_argument, NULL, ARG_VERSION },
740 { "directory", required_argument, NULL, 'D' },
741 { "template", required_argument, NULL, ARG_TEMPLATE },
742 { "ephemeral", no_argument, NULL, 'x' },
743 { "user", required_argument, NULL, 'u' },
744 { "private-network", no_argument, NULL, ARG_PRIVATE_NETWORK },
745 { "as-pid2", no_argument, NULL, 'a' },
746 { "boot", no_argument, NULL, 'b' },
747 { "uuid", required_argument, NULL, ARG_UUID },
748 { "read-only", no_argument, NULL, ARG_READ_ONLY },
749 { "capability", required_argument, NULL, ARG_CAPABILITY },
88fc9c9b 750 { "ambient-capability", required_argument, NULL, ARG_AMBIENT_CAPABILITY },
d7bea6b6 751 { "drop-capability", required_argument, NULL, ARG_DROP_CAPABILITY },
66edd963 752 { "no-new-privileges", required_argument, NULL, ARG_NO_NEW_PRIVILEGES },
d7bea6b6
DP		 753 { "link-journal", required_argument, NULL, ARG_LINK_JOURNAL },
754 { "bind", required_argument, NULL, ARG_BIND },
755 { "bind-ro", required_argument, NULL, ARG_BIND_RO },
756 { "tmpfs", required_argument, NULL, ARG_TMPFS },
757 { "overlay", required_argument, NULL, ARG_OVERLAY },
758 { "overlay-ro", required_argument, NULL, ARG_OVERLAY_RO },
de40a303 759 { "inaccessible", required_argument, NULL, ARG_INACCESSIBLE },
d7bea6b6 760 { "machine", required_argument, NULL, 'M' },
3a9530e5 761 { "hostname", required_argument, NULL, ARG_HOSTNAME },
d7bea6b6
DP		 762 { "slice", required_argument, NULL, 'S' },
763 { "setenv", required_argument, NULL, 'E' },
764 { "selinux-context", required_argument, NULL, 'Z' },
765 { "selinux-apifs-context", required_argument, NULL, 'L' },
766 { "quiet", no_argument, NULL, 'q' },
767 { "share-system", no_argument, NULL, ARG_SHARE_SYSTEM }, /* not documented */
768 { "register", required_argument, NULL, ARG_REGISTER },
769 { "keep-unit", no_argument, NULL, ARG_KEEP_UNIT },
770 { "network-interface", required_argument, NULL, ARG_NETWORK_INTERFACE },
771 { "network-macvlan", required_argument, NULL, ARG_NETWORK_MACVLAN },
772 { "network-ipvlan", required_argument, NULL, ARG_NETWORK_IPVLAN },
773 { "network-veth", no_argument, NULL, 'n' },
774 { "network-veth-extra", required_argument, NULL, ARG_NETWORK_VETH_EXTRA },
775 { "network-bridge", required_argument, NULL, ARG_NETWORK_BRIDGE },
776 { "network-zone", required_argument, NULL, ARG_NETWORK_ZONE },
777 { "network-namespace-path", required_argument, NULL, ARG_NETWORK_NAMESPACE_PATH },
778 { "personality", required_argument, NULL, ARG_PERSONALITY },
779 { "image", required_argument, NULL, 'i' },
780 { "volatile", optional_argument, NULL, ARG_VOLATILE },
781 { "port", required_argument, NULL, 'p' },
782 { "property", required_argument, NULL, ARG_PROPERTY },
783 { "private-users", optional_argument, NULL, ARG_PRIVATE_USERS },
6c045a99
LP		 784 { "private-users-chown", optional_argument, NULL, ARG_PRIVATE_USERS_CHOWN }, /* obsolete */
785 { "private-users-ownership",required_argument, NULL, ARG_PRIVATE_USERS_OWNERSHIP},
d7bea6b6
DP		 786 { "kill-signal", required_argument, NULL, ARG_KILL_SIGNAL },
787 { "settings", required_argument, NULL, ARG_SETTINGS },
788 { "chdir", required_argument, NULL, ARG_CHDIR },
789 { "pivot-root", required_argument, NULL, ARG_PIVOT_ROOT },
790 { "notify-ready", required_argument, NULL, ARG_NOTIFY_READY },
791 { "root-hash", required_argument, NULL, ARG_ROOT_HASH },
89e62e0b
LP		 792 { "root-hash-sig", required_argument, NULL, ARG_ROOT_HASH_SIG },
793 { "verity-data", required_argument, NULL, ARG_VERITY_DATA },
d7bea6b6 794 { "system-call-filter", required_argument, NULL, ARG_SYSTEM_CALL_FILTER },
bf428efb 795 { "rlimit", required_argument, NULL, ARG_RLIMIT },
81f345df 796 { "oom-score-adjust", required_argument, NULL, ARG_OOM_SCORE_ADJUST },
d107bb7d 797 { "cpu-affinity", required_argument, NULL, ARG_CPU_AFFINITY },
09d423e9 798 { "resolv-conf", required_argument, NULL, ARG_RESOLV_CONF },
1688841f 799 { "timezone", required_argument, NULL, ARG_TIMEZONE },
de40a303
LP		 800 { "console", required_argument, NULL, ARG_CONSOLE },
801 { "pipe", no_argument, NULL, ARG_PIPE },
802 { "oci-bundle", required_argument, NULL, ARG_OCI_BUNDLE },
bb068de0 803 { "no-pager", no_argument, NULL, ARG_NO_PAGER },
3652872a
LP		 804 { "set-credential", required_argument, NULL, ARG_SET_CREDENTIAL },
805 { "load-credential", required_argument, NULL, ARG_LOAD_CREDENTIAL },
2f893044 806 { "bind-user", required_argument, NULL, ARG_BIND_USER },
4a4654e0 807 { "suppress-sync", required_argument, NULL, ARG_SUPPRESS_SYNC },
eb9da376 808 {}
88213476
LP		 809 };
810
9444b1f2 811 int c, r;
a42c8b54 812 uint64_t plus = 0, minus = 0;
f757855e 813 bool mask_all_settings = false, mask_no_settings = false;
88213476
LP		 814
815 assert(argc >= 0);
816 assert(argv);
817
de40a303 818 while ((c = getopt_long(argc, argv, "+hD:u:abL:M:jS:Z:qi:xp:nUE:P", options, NULL)) >= 0)
88213476
LP		 819 switch (c) {
820
821 case 'h':
37ec0fdd 822 return help();
88213476 823
acbeb427 824 case ARG_VERSION:
3f6fd1ba 825 return version();
acbeb427 826
88213476 827 case 'D':
614b022c 828 r = parse_path_argument(optarg, false, &arg_directory);
ec16945e 829 if (r < 0)
0f03c2a4 830 return r;
de40a303
LP		 831
832 arg_settings_mask |= SETTING_DIRECTORY;
ec16945e
LP		 833 break;
834
835 case ARG_TEMPLATE:
614b022c 836 r = parse_path_argument(optarg, false, &arg_template);
ec16945e 837 if (r < 0)
0f03c2a4 838 return r;
de40a303
LP		 839
840 arg_settings_mask |= SETTING_DIRECTORY;
88213476
LP		 841 break;
842
1b9e5b12 843 case 'i':
614b022c 844 r = parse_path_argument(optarg, false, &arg_image);
ec16945e 845 if (r < 0)
0f03c2a4 846 return r;
de40a303
LP		 847
848 arg_settings_mask |= SETTING_DIRECTORY;
849 break;
850
851 case ARG_OCI_BUNDLE:
614b022c 852 r = parse_path_argument(optarg, false, &arg_oci_bundle);
de40a303
LP		 853 if (r < 0)
854 return r;
855
ec16945e
LP		 856 break;
857
858 case 'x':
859 arg_ephemeral = true;
a2f577fc 860 arg_settings_mask |= SETTING_EPHEMERAL;
1b9e5b12
LP		 861 break;
862
687d0825 863 case 'u':
2fc09a9c
DM		 864 r = free_and_strdup(&arg_user, optarg);
865 if (r < 0)
7027ff61 866 return log_oom();
687d0825 867
f757855e 868 arg_settings_mask |= SETTING_USER;
687d0825
MV		 869 break;
870
22b28dfd
LP		 871 case ARG_NETWORK_ZONE: {
872 char *j;
873
b910cc72 874 j = strjoin("vz-", optarg);
22b28dfd
LP		 875 if (!j)
876 return log_oom();
877
878 if (!ifname_valid(j)) {
879 log_error("Network zone name not valid: %s", j);
880 free(j);
881 return -EINVAL;
882 }
883
df1fac6d 884 free_and_replace(arg_network_zone, j);
22b28dfd
LP		 885
886 arg_network_veth = true;
887 arg_private_network = true;
888 arg_settings_mask |= SETTING_NETWORK;
889 break;
890 }
891
ab046dde 892 case ARG_NETWORK_BRIDGE:
ef76dff2 893
baaa35ad
ZJS		 894 if (!ifname_valid(optarg))
895 return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
896 "Bridge interface name not valid: %s", optarg);
ef76dff2 897
f757855e
LP		 898 r = free_and_strdup(&arg_network_bridge, optarg);
899 if (r < 0)
900 return log_oom();
ab046dde 901
4831981d 902 _fallthrough_;
0dfaa006 903 case 'n':
69c79d3c
LP		 904 arg_network_veth = true;
905 arg_private_network = true;
f757855e 906 arg_settings_mask |= SETTING_NETWORK;
69c79d3c
LP		 907 break;
908
f6d6bad1
LP		 909 case ARG_NETWORK_VETH_EXTRA:
910 r = veth_extra_parse(&arg_network_veth_extra, optarg);
911 if (r < 0)
912 return log_error_errno(r, "Failed to parse --network-veth-extra= parameter: %s", optarg);
913
914 arg_private_network = true;
915 arg_settings_mask |= SETTING_NETWORK;
916 break;
917
aa28aefe 918 case ARG_NETWORK_INTERFACE:
baaa35ad
ZJS		 919 if (!ifname_valid(optarg))
920 return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
921 "Network interface name not valid: %s", optarg);
ef76dff2 922
b390f178
DDM		 923 r = test_network_interface_initialized(optarg);
924 if (r < 0)
925 return r;
926
c74e630d
LP		 927 if (strv_extend(&arg_network_interfaces, optarg) < 0)
928 return log_oom();
929
930 arg_private_network = true;
f757855e 931 arg_settings_mask |= SETTING_NETWORK;
c74e630d
LP		 932 break;
933
934 case ARG_NETWORK_MACVLAN:
ef76dff2 935
baaa35ad
ZJS		 936 if (!ifname_valid(optarg))
937 return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
938 "MACVLAN network interface name not valid: %s", optarg);
ef76dff2 939
b390f178
DDM		 940 r = test_network_interface_initialized(optarg);
941 if (r < 0)
942 return r;
943
c74e630d 944 if (strv_extend(&arg_network_macvlan, optarg) < 0)
aa28aefe
LP		 945 return log_oom();
946
4bbfe7ad 947 arg_private_network = true;
f757855e 948 arg_settings_mask |= SETTING_NETWORK;
4bbfe7ad
TG		 949 break;
950
951 case ARG_NETWORK_IPVLAN:
ef76dff2 952
baaa35ad
ZJS		 953 if (!ifname_valid(optarg))
954 return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
955 "IPVLAN network interface name not valid: %s", optarg);
ef76dff2 956
b390f178
DDM		 957 r = test_network_interface_initialized(optarg);
958 if (r < 0)
959 return r;
960
4bbfe7ad
TG		 961 if (strv_extend(&arg_network_ipvlan, optarg) < 0)
962 return log_oom();
963
4831981d 964 _fallthrough_;
ff01d048
LP		 965 case ARG_PRIVATE_NETWORK:
966 arg_private_network = true;
f757855e 967 arg_settings_mask |= SETTING_NETWORK;
a41fe3a2
LP		 968 break;
969
d7bea6b6 970 case ARG_NETWORK_NAMESPACE_PATH:
614b022c 971 r = parse_path_argument(optarg, false, &arg_network_namespace_path);
d7bea6b6
DP		 972 if (r < 0)
973 return r;
974
de40a303 975 arg_settings_mask |= SETTING_NETWORK;
d7bea6b6
DP		 976 break;
977
0f0dbc46 978 case 'b':
baaa35ad
ZJS		 979 if (arg_start_mode == START_PID2)
980 return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
981 "--boot and --as-pid2 may not be combined.");
7732f92b
LP		 982
983 arg_start_mode = START_BOOT;
984 arg_settings_mask |= SETTING_START_MODE;
985 break;
986
987 case 'a':
baaa35ad
ZJS		 988 if (arg_start_mode == START_BOOT)
989 return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
990 "--boot and --as-pid2 may not be combined.");
7732f92b
LP		 991
992 arg_start_mode = START_PID2;
993 arg_settings_mask |= SETTING_START_MODE;
0f0dbc46
LP		 994 break;
995
144f0fc0 996 case ARG_UUID:
9444b1f2 997 r = sd_id128_from_string(optarg, &arg_uuid);
317feb4d
LP		 998 if (r < 0)
999 return log_error_errno(r, "Invalid UUID: %s", optarg);
1000
baaa35ad
ZJS		 1001 if (sd_id128_is_null(arg_uuid))
1002 return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
1003 "Machine UUID may not be all zeroes.");
f757855e
LP		 1004
1005 arg_settings_mask |= SETTING_MACHINE_ID;
9444b1f2 1006 break;
aa96c6cb 1007
43c3fb46
LP		 1008 case 'S': {
1009 _cleanup_free_ char *mangled = NULL;
1010
1011 r = unit_name_mangle_with_suffix(optarg, NULL, UNIT_NAME_MANGLE_WARN, ".slice", &mangled);
de40a303
LP		 1012 if (r < 0)
1013 return log_oom();
1014
43c3fb46 1015 free_and_replace(arg_slice, mangled);
de40a303 1016 arg_settings_mask |= SETTING_SLICE;
144f0fc0 1017 break;
43c3fb46 1018 }
144f0fc0 1019
7027ff61 1020 case 'M':
c1521918 1021 if (isempty(optarg))
97b11eed 1022 arg_machine = mfree(arg_machine);
c1521918 1023 else {
52ef5dd7 1024 if (!hostname_is_valid(optarg, 0))
baaa35ad
ZJS		 1025 return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
1026 "Invalid machine name: %s", optarg);
7027ff61 1027
0c3c4284
LP		 1028 r = free_and_strdup(&arg_machine, optarg);
1029 if (r < 0)
eb91eb18 1030 return log_oom();
eb91eb18 1031 }
9ce6d1b3 1032 break;
7027ff61 1033
3a9530e5
LP		 1034 case ARG_HOSTNAME:
1035 if (isempty(optarg))
1036 arg_hostname = mfree(arg_hostname);
1037 else {
52ef5dd7 1038 if (!hostname_is_valid(optarg, 0))
baaa35ad
ZJS		 1039 return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
1040 "Invalid hostname: %s", optarg);
3a9530e5
LP		 1041
1042 r = free_and_strdup(&arg_hostname, optarg);
1043 if (r < 0)
1044 return log_oom();
1045 }
1046
1047 arg_settings_mask |= SETTING_HOSTNAME;
1048 break;
1049
82adf6af
LP		 1050 case 'Z':
1051 arg_selinux_context = optarg;
a8828ed9
DW		 1052 break;
1053
82adf6af
LP		 1054 case 'L':
1055 arg_selinux_apifs_context = optarg;
a8828ed9
DW		 1056 break;
1057
bc2f673e
LP		 1058 case ARG_READ_ONLY:
1059 arg_read_only = true;
f757855e 1060 arg_settings_mask |= SETTING_READ_ONLY;
bc2f673e
LP		 1061 break;
1062
88fc9c9b
TH		 1063 case ARG_AMBIENT_CAPABILITY: {
1064 uint64_t m;
1065 r = parse_capability_spec(optarg, &m);
1066 if (r <= 0)
1067 return r;
1068 arg_caps_ambient |= m;
1069 arg_settings_mask |= SETTING_CAPABILITY;
1070 break;
1071 }
420c7379
LP		 1072 case ARG_CAPABILITY:
1073 case ARG_DROP_CAPABILITY: {
8a99bd0c
ZJS		 1074 uint64_t m;
1075 r = parse_capability_spec(optarg, &m);
1076 if (r <= 0)
1077 return r;
5076f0cc 1078
8a99bd0c
ZJS		 1079 if (c == ARG_CAPABILITY)
1080 plus |= m;
1081 else
1082 minus |= m;
f757855e 1083 arg_settings_mask |= SETTING_CAPABILITY;
5076f0cc
LP		 1084 break;
1085 }
66edd963
LP		 1086 case ARG_NO_NEW_PRIVILEGES:
1087 r = parse_boolean(optarg);
1088 if (r < 0)
1089 return log_error_errno(r, "Failed to parse --no-new-privileges= argument: %s", optarg);
1090
1091 arg_no_new_privileges = r;
1092 arg_settings_mask |= SETTING_NO_NEW_PRIVILEGES;
1093 break;
1094
57fb9fb5
LP		 1095 case 'j':
1096 arg_link_journal = LINK_GUEST;
574edc90 1097 arg_link_journal_try = true;
4e1d6aa9 1098 arg_settings_mask |= SETTING_LINK_JOURNAL;
57fb9fb5
LP		 1099 break;
1100
1101 case ARG_LINK_JOURNAL:
4e1d6aa9 1102 r = parse_link_journal(optarg, &arg_link_journal, &arg_link_journal_try);
c6147113
LP		 1103 if (r < 0)
1104 return log_error_errno(r, "Failed to parse link journal mode %s", optarg);
57fb9fb5 1105
4e1d6aa9 1106 arg_settings_mask |= SETTING_LINK_JOURNAL;
57fb9fb5
LP		 1107 break;
1108
17fe0523 1109 case ARG_BIND:
f757855e
LP		 1110 case ARG_BIND_RO:
1111 r = bind_mount_parse(&arg_custom_mounts, &arg_n_custom_mounts, optarg, c == ARG_BIND_RO);
1112 if (r < 0)
1113 return log_error_errno(r, "Failed to parse --bind(-ro)= argument %s: %m", optarg);
17fe0523 1114
f757855e 1115 arg_settings_mask |= SETTING_CUSTOM_MOUNTS;
17fe0523 1116 break;
06c17c39 1117
f757855e
LP		 1118 case ARG_TMPFS:
1119 r = tmpfs_mount_parse(&arg_custom_mounts, &arg_n_custom_mounts, optarg);
1120 if (r < 0)
1121 return log_error_errno(r, "Failed to parse --tmpfs= argument %s: %m", optarg);
5a8af538 1122
f757855e 1123 arg_settings_mask |= SETTING_CUSTOM_MOUNTS;
5a8af538 1124 break;
5a8af538
LP		 1125
1126 case ARG_OVERLAY:
ad85779a
LP		 1127 case ARG_OVERLAY_RO:
1128 r = overlay_mount_parse(&arg_custom_mounts, &arg_n_custom_mounts, optarg, c == ARG_OVERLAY_RO);
1129 if (r == -EADDRNOTAVAIL)
1130 return log_error_errno(r, "--overlay(-ro)= needs at least two colon-separated directories specified.");
1131 if (r < 0)
1132 return log_error_errno(r, "Failed to parse --overlay(-ro)= argument %s: %m", optarg);
06c17c39 1133
f757855e 1134 arg_settings_mask |= SETTING_CUSTOM_MOUNTS;
06c17c39 1135 break;
06c17c39 1136
de40a303
LP		 1137 case ARG_INACCESSIBLE:
1138 r = inaccessible_mount_parse(&arg_custom_mounts, &arg_n_custom_mounts, optarg);
1139 if (r < 0)
1140 return log_error_errno(r, "Failed to parse --inaccessible= argument %s: %m", optarg);
1141
1142 arg_settings_mask |= SETTING_CUSTOM_MOUNTS;
1143 break;
1144
0d2a0179
ZJS		 1145 case 'E':
1146 r = strv_env_replace_strdup_passthrough(&arg_setenv, optarg);
aaf057c4 1147 if (r < 0)
0d2a0179 1148 return log_error_errno(r, "Cannot assign environment variable %s: %m", optarg);
f4889f65 1149
f757855e 1150 arg_settings_mask |= SETTING_ENVIRONMENT;
f4889f65 1151 break;
f4889f65 1152
284c0b91
LP		 1153 case 'q':
1154 arg_quiet = true;
1155 break;
1156
8a96d94e 1157 case ARG_SHARE_SYSTEM:
a6b5216c 1158 /* We don't officially support this anymore, except for compat reasons. People should use the
0c582db0 1159 * $SYSTEMD_NSPAWN_SHARE_* environment variables instead. */
63d1c29f 1160 log_warning("Please do not use --share-system anymore, use $SYSTEMD_NSPAWN_SHARE_* instead.");
0c582db0 1161 arg_clone_ns_flags = 0;
8a96d94e
LP		 1162 break;
1163
eb91eb18
LP		 1164 case ARG_REGISTER:
1165 r = parse_boolean(optarg);
1166 if (r < 0) {
1167 log_error("Failed to parse --register= argument: %s", optarg);
1168 return r;
1169 }
1170
1171 arg_register = r;
1172 break;
1173
89f7c846
LP		 1174 case ARG_KEEP_UNIT:
1175 arg_keep_unit = true;
1176 break;
1177
6afc95b7
LP		 1178 case ARG_PERSONALITY:
1179
ac45f971 1180 arg_personality = personality_from_string(optarg);
baaa35ad
ZJS		 1181 if (arg_personality == PERSONALITY_INVALID)
1182 return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
1183 "Unknown or unsupported personality '%s'.", optarg);
6afc95b7 1184
f757855e 1185 arg_settings_mask |= SETTING_PERSONALITY;
6afc95b7
LP		 1186 break;
1187
4d9f07b4
LP		 1188 case ARG_VOLATILE:
1189
1190 if (!optarg)
f757855e 1191 arg_volatile_mode = VOLATILE_YES;
5c828e66
LP		 1192 else if (streq(optarg, "help")) {
1193 DUMP_STRING_TABLE(volatile_mode, VolatileMode, _VOLATILE_MODE_MAX);
1194 return 0;
1195 } else {
f757855e 1196 VolatileMode m;
4d9f07b4 1197
f757855e 1198 m = volatile_mode_from_string(optarg);
baaa35ad
ZJS		 1199 if (m < 0)
1200 return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
1201 "Failed to parse --volatile= argument: %s", optarg);
1202 else
f757855e 1203 arg_volatile_mode = m;
6d0b55c2
LP		 1204 }
1205
f757855e
LP		 1206 arg_settings_mask |= SETTING_VOLATILE_MODE;
1207 break;
6d0b55c2 1208
f757855e
LP		 1209 case 'p':
1210 r = expose_port_parse(&arg_expose_ports, optarg);
1211 if (r == -EEXIST)
1212 return log_error_errno(r, "Duplicate port specification: %s", optarg);
1213 if (r < 0)
1214 return log_error_errno(r, "Failed to parse host port %s: %m", optarg);
6d0b55c2 1215
f757855e 1216 arg_settings_mask |= SETTING_EXPOSE_PORTS;
6d0b55c2 1217 break;
6d0b55c2 1218
f36933fe
LP		 1219 case ARG_PROPERTY:
1220 if (strv_extend(&arg_property, optarg) < 0)
1221 return log_oom();
1222
1223 break;
1224
ae209204 1225 case ARG_PRIVATE_USERS: {
33eac552 1226 int boolean;
0de7acce 1227
ae209204
ZJS		 1228 if (!optarg)
1229 boolean = true;
1230 else if (!in_charset(optarg, DIGITS))
1231 /* do *not* parse numbers as booleans */
1232 boolean = parse_boolean(optarg);
33eac552
LP		 1233 else
1234 boolean = -1;
ae209204 1235
33eac552 1236 if (boolean == 0) {
0de7acce
LP		 1237 /* no: User namespacing off */
1238 arg_userns_mode = USER_NAMESPACE_NO;
1239 arg_uid_shift = UID_INVALID;
1240 arg_uid_range = UINT32_C(0x10000);
33eac552 1241 } else if (boolean > 0) {
0de7acce
LP		 1242 /* yes: User namespacing on, UID range is read from root dir */
1243 arg_userns_mode = USER_NAMESPACE_FIXED;
1244 arg_uid_shift = UID_INVALID;
1245 arg_uid_range = UINT32_C(0x10000);
1246 } else if (streq(optarg, "pick")) {
1247 /* pick: User namespacing on, UID range is picked randomly */
6c045a99
LP		 1248 arg_userns_mode = USER_NAMESPACE_PICK; /* Note that arg_userns_ownership is
1249 * implied by USER_NAMESPACE_PICK
33eac552 1250 * further down. */
0de7acce
LP		 1251 arg_uid_shift = UID_INVALID;
1252 arg_uid_range = UINT32_C(0x10000);
33eac552
LP		 1253
1254 } else if (streq(optarg, "identity")) {
6c2d70ce 1255 /* identity: User namespaces on, UID range is map the 0…0xFFFF range to
33eac552
LP		 1256 * itself, i.e. we don't actually map anything, but do take benefit of
1257 * isolation of capability sets. */
1258 arg_userns_mode = USER_NAMESPACE_FIXED;
1259 arg_uid_shift = 0;
1260 arg_uid_range = UINT32_C(0x10000);
0de7acce 1261 } else {
6c2058b3 1262 _cleanup_free_ char *buffer = NULL;
6dac160c
LP		 1263 const char *range, *shift;
1264
0de7acce
LP		 1265 /* anything else: User namespacing on, UID range is explicitly configured */
1266
6dac160c
LP		 1267 range = strchr(optarg, ':');
1268 if (range) {
6c2058b3
ZJS		 1269 buffer = strndup(optarg, range - optarg);
1270 if (!buffer)
1271 return log_oom();
1272 shift = buffer;
6dac160c
LP		 1273
1274 range++;
bfd292ec
ZJS		 1275 r = safe_atou32(range, &arg_uid_range);
1276 if (r < 0)
be715731 1277 return log_error_errno(r, "Failed to parse UID range \"%s\": %m", range);
6dac160c
LP		 1278 } else
1279 shift = optarg;
1280
be715731
ZJS		 1281 r = parse_uid(shift, &arg_uid_shift);
1282 if (r < 0)
1283 return log_error_errno(r, "Failed to parse UID \"%s\": %m", optarg);
0de7acce
LP		 1284
1285 arg_userns_mode = USER_NAMESPACE_FIXED;
6dac160c 1286
58e13de5
LP		 1287 if (!userns_shift_range_valid(arg_uid_shift, arg_uid_range))
1288 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "UID range cannot be empty or go beyond " UID_FMT ".", UID_INVALID);
1289 }
be715731 1290
0de7acce 1291 arg_settings_mask |= SETTING_USERNS;
6dac160c 1292 break;
ae209204 1293 }
6dac160c 1294
0de7acce 1295 case 'U':
ccabee0d 1296 if (userns_supported()) {
6c045a99
LP		 1297 arg_userns_mode = USER_NAMESPACE_PICK; /* Note that arg_userns_ownership is
1298 * implied by USER_NAMESPACE_PICK
33eac552 1299 * further down. */
ccabee0d
LP		 1300 arg_uid_shift = UID_INVALID;
1301 arg_uid_range = UINT32_C(0x10000);
1302
1303 arg_settings_mask |= SETTING_USERNS;
6dac160c
LP		 1304 }
1305
7336138e
LP		 1306 break;
1307
0de7acce 1308 case ARG_PRIVATE_USERS_CHOWN:
6c045a99
LP		 1309 arg_userns_ownership = USER_NAMESPACE_OWNERSHIP_CHOWN;
1310
1311 arg_settings_mask |= SETTING_USERNS;
1312 break;
1313
1314 case ARG_PRIVATE_USERS_OWNERSHIP:
1315 if (streq(optarg, "help")) {
1316 DUMP_STRING_TABLE(user_namespace_ownership, UserNamespaceOwnership, _USER_NAMESPACE_OWNERSHIP_MAX);
1317 return 0;
1318 }
1319
1320 arg_userns_ownership = user_namespace_ownership_from_string(optarg);
1321 if (arg_userns_ownership < 0)
1322 return log_error_errno(arg_userns_ownership, "Cannot parse --user-namespace-ownership= value: %s", optarg);
0de7acce
LP		 1323
1324 arg_settings_mask |= SETTING_USERNS;
6dac160c
LP		 1325 break;
1326
c6c8f6e2 1327 case ARG_KILL_SIGNAL:
5c828e66
LP		 1328 if (streq(optarg, "help")) {
1329 DUMP_STRING_TABLE(signal, int, _NSIG);
1330 return 0;
1331 }
1332
29a3db75 1333 arg_kill_signal = signal_from_string(optarg);
baaa35ad 1334 if (arg_kill_signal < 0)
7211c853 1335 return log_error_errno(arg_kill_signal, "Cannot parse signal: %s", optarg);
c6c8f6e2 1336
f757855e
LP		 1337 arg_settings_mask |= SETTING_KILL_SIGNAL;
1338 break;
1339
1340 case ARG_SETTINGS:
1341
1342 /* no → do not read files
1343 * yes → read files, do not override cmdline, trust only subset
1344 * override → read files, override cmdline, trust only subset
1345 * trusted → read files, do not override cmdline, trust all
1346 */
1347
1348 r = parse_boolean(optarg);
1349 if (r < 0) {
1350 if (streq(optarg, "trusted")) {
1351 mask_all_settings = false;
1352 mask_no_settings = false;
1353 arg_settings_trusted = true;
1354
1355 } else if (streq(optarg, "override")) {
1356 mask_all_settings = false;
1357 mask_no_settings = true;
1358 arg_settings_trusted = -1;
1359 } else
1360 return log_error_errno(r, "Failed to parse --settings= argument: %s", optarg);
1361 } else if (r > 0) {
1362 /* yes */
1363 mask_all_settings = false;
1364 mask_no_settings = false;
1365 arg_settings_trusted = -1;
1366 } else {
1367 /* no */
1368 mask_all_settings = true;
1369 mask_no_settings = false;
1370 arg_settings_trusted = false;
1371 }
1372
c6c8f6e2
LP		 1373 break;
1374
5f932eb9 1375 case ARG_CHDIR:
baaa35ad
ZJS		 1376 if (!path_is_absolute(optarg))
1377 return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
1378 "Working directory %s is not an absolute path.", optarg);
5f932eb9
LP		 1379
1380 r = free_and_strdup(&arg_chdir, optarg);
1381 if (r < 0)
1382 return log_oom();
1383
1384 arg_settings_mask |= SETTING_WORKING_DIRECTORY;
1385 break;
1386
b53ede69
PW		 1387 case ARG_PIVOT_ROOT:
1388 r = pivot_root_parse(&arg_pivot_root_new, &arg_pivot_root_old, optarg);
1389 if (r < 0)
1390 return log_error_errno(r, "Failed to parse --pivot-root= argument %s: %m", optarg);
1391
1392 arg_settings_mask |= SETTING_PIVOT_ROOT;
1393 break;
1394
9c1e04d0
AP		 1395 case ARG_NOTIFY_READY:
1396 r = parse_boolean(optarg);
baaa35ad
ZJS		 1397 if (r < 0)
1398 return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
1399 "%s is not a valid notify mode. Valid modes are: yes, no, and ready.", optarg);
9c1e04d0
AP		 1400 arg_notify_ready = r;
1401 arg_settings_mask |= SETTING_NOTIFY_READY;
1402 break;
1403
4623e8e6 1404 case ARG_ROOT_HASH: {
89e62e0b 1405 _cleanup_free_ void *k = NULL;
4623e8e6
LP		 1406 size_t l;
1407
1408 r = unhexmem(optarg, strlen(optarg), &k, &l);
1409 if (r < 0)
1410 return log_error_errno(r, "Failed to parse root hash: %s", optarg);
89e62e0b 1411 if (l < sizeof(sd_id128_t))
c6147113 1412 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Root hash must be at least 128bit long: %s", optarg);
4623e8e6 1413
89e62e0b
LP		 1414 free_and_replace(arg_verity_settings.root_hash, k);
1415 arg_verity_settings.root_hash_size = l;
4623e8e6
LP		 1416 break;
1417 }
1418
c2923fdc
LB		 1419 case ARG_ROOT_HASH_SIG: {
1420 char *value;
89e62e0b
LP		 1421 size_t l;
1422 void *p;
c2923fdc
LB		 1423
1424 if ((value = startswith(optarg, "base64:"))) {
c2923fdc
LB		 1425 r = unbase64mem(value, strlen(value), &p, &l);
1426 if (r < 0)
1427 return log_error_errno(r, "Failed to parse root hash signature '%s': %m", optarg);
1428
c2923fdc 1429 } else {
89e62e0b 1430 r = read_full_file(optarg, (char**) &p, &l);
c2923fdc 1431 if (r < 0)
89e62e0b 1432 return log_error_errno(r, "Failed parse root hash signature file '%s': %m", optarg);
c2923fdc
LB		 1433 }
1434
89e62e0b
LP		 1435 free_and_replace(arg_verity_settings.root_hash_sig, p);
1436 arg_verity_settings.root_hash_sig_size = l;
c2923fdc
LB		 1437 break;
1438 }
1439
89e62e0b 1440 case ARG_VERITY_DATA:
614b022c 1441 r = parse_path_argument(optarg, false, &arg_verity_settings.data_path);
89e62e0b
LP		 1442 if (r < 0)
1443 return r;
1444 break;
1445
960e4569
LP		 1446 case ARG_SYSTEM_CALL_FILTER: {
1447 bool negative;
1448 const char *items;
1449
1450 negative = optarg[0] == '~';
1451 items = negative ? optarg + 1 : optarg;
1452
1453 for (;;) {
1454 _cleanup_free_ char *word = NULL;
1455
1456 r = extract_first_word(&items, &word, NULL, 0);
1457 if (r == 0)
1458 break;
1459 if (r == -ENOMEM)
1460 return log_oom();
1461 if (r < 0)
1462 return log_error_errno(r, "Failed to parse system call filter: %m");
1463
1464 if (negative)
6b000af4 1465 r = strv_extend(&arg_syscall_deny_list, word);
960e4569 1466 else
6b000af4 1467 r = strv_extend(&arg_syscall_allow_list, word);
960e4569
LP		 1468 if (r < 0)
1469 return log_oom();
1470 }
1471
1472 arg_settings_mask |= SETTING_SYSCALL_FILTER;
1473 break;
1474 }
1475
bf428efb
LP		 1476 case ARG_RLIMIT: {
1477 const char *eq;
622ecfa8 1478 _cleanup_free_ char *name = NULL;
bf428efb
LP		 1479 int rl;
1480
5c828e66
LP		 1481 if (streq(optarg, "help")) {
1482 DUMP_STRING_TABLE(rlimit, int, _RLIMIT_MAX);
1483 return 0;
1484 }
1485
bf428efb 1486 eq = strchr(optarg, '=');
baaa35ad
ZJS		 1487 if (!eq)
1488 return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
1489 "--rlimit= expects an '=' assignment.");
bf428efb
LP		 1490
1491 name = strndup(optarg, eq - optarg);
1492 if (!name)
1493 return log_oom();
1494
1495 rl = rlimit_from_string_harder(name);
baaa35ad 1496 if (rl < 0)
7211c853 1497 return log_error_errno(rl, "Unknown resource limit: %s", name);
bf428efb
LP		 1498
1499 if (!arg_rlimit[rl]) {
1500 arg_rlimit[rl] = new0(struct rlimit, 1);
1501 if (!arg_rlimit[rl])
1502 return log_oom();
1503 }
1504
1505 r = rlimit_parse(rl, eq + 1, arg_rlimit[rl]);
1506 if (r < 0)
1507 return log_error_errno(r, "Failed to parse resource limit: %s", eq + 1);
1508
1509 arg_settings_mask |= SETTING_RLIMIT_FIRST << rl;
1510 break;
1511 }
1512
81f345df
LP		 1513 case ARG_OOM_SCORE_ADJUST:
1514 r = parse_oom_score_adjust(optarg, &arg_oom_score_adjust);
1515 if (r < 0)
1516 return log_error_errno(r, "Failed to parse --oom-score-adjust= parameter: %s", optarg);
1517
1518 arg_oom_score_adjust_set = true;
1519 arg_settings_mask |= SETTING_OOM_SCORE_ADJUST;
1520 break;
1521
d107bb7d 1522 case ARG_CPU_AFFINITY: {
0985c7c4 1523 CPUSet cpuset;
d107bb7d
LP		 1524
1525 r = parse_cpu_set(optarg, &cpuset);
1526 if (r < 0)
0985c7c4 1527 return log_error_errno(r, "Failed to parse CPU affinity mask %s: %m", optarg);
d107bb7d 1528
0985c7c4
ZJS		 1529 cpu_set_reset(&arg_cpu_set);
1530 arg_cpu_set = cpuset;
d107bb7d
LP		 1531 arg_settings_mask |= SETTING_CPU_AFFINITY;
1532 break;
1533 }
1534
09d423e9
LP		 1535 case ARG_RESOLV_CONF:
1536 if (streq(optarg, "help")) {
1537 DUMP_STRING_TABLE(resolv_conf_mode, ResolvConfMode, _RESOLV_CONF_MODE_MAX);
1538 return 0;
1539 }
1540
1541 arg_resolv_conf = resolv_conf_mode_from_string(optarg);
baaa35ad 1542 if (arg_resolv_conf < 0)
7211c853 1543 return log_error_errno(arg_resolv_conf,
baaa35ad 1544 "Failed to parse /etc/resolv.conf mode: %s", optarg);
09d423e9
LP		 1545
1546 arg_settings_mask |= SETTING_RESOLV_CONF;
1547 break;
1548
1688841f
LP		 1549 case ARG_TIMEZONE:
1550 if (streq(optarg, "help")) {
1551 DUMP_STRING_TABLE(timezone_mode, TimezoneMode, _TIMEZONE_MODE_MAX);
1552 return 0;
1553 }
1554
1555 arg_timezone = timezone_mode_from_string(optarg);
baaa35ad 1556 if (arg_timezone < 0)
7211c853 1557 return log_error_errno(arg_timezone,
baaa35ad 1558 "Failed to parse /etc/localtime mode: %s", optarg);
1688841f
LP		 1559
1560 arg_settings_mask |= SETTING_TIMEZONE;
1561 break;
1562
de40a303 1563 case ARG_CONSOLE:
dce66ffe
ZJS		 1564 r = handle_arg_console(optarg);
1565 if (r <= 0)
1566 return r;
de40a303
LP		 1567 break;
1568
1569 case 'P':
1570 case ARG_PIPE:
dce66ffe
ZJS		 1571 r = handle_arg_console("pipe");
1572 if (r <= 0)
1573 return r;
de40a303
LP		 1574 break;
1575
bb068de0
ZJS		 1576 case ARG_NO_PAGER:
1577 arg_pager_flags |= PAGER_DISABLE;
1578 break;
1579
3652872a
LP		 1580 case ARG_SET_CREDENTIAL: {
1581 _cleanup_free_ char *word = NULL, *data = NULL;
1582 const char *p = optarg;
1583 Credential *a;
e437538f 1584 ssize_t l;
3652872a
LP		 1585
1586 r = extract_first_word(&p, &word, ":", EXTRACT_DONT_COALESCE_SEPARATORS);
1587 if (r == -ENOMEM)
1588 return log_oom();
1589 if (r < 0)
1590 return log_error_errno(r, "Failed to parse --set-credential= parameter: %m");
1591 if (r == 0 || !p)
1592 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Missing value for --set-credential=: %s", optarg);
1593
1594 if (!credential_name_valid(word))
1595 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Credential name is not valid: %s", word);
1596
12d729b2 1597 for (size_t i = 0; i < arg_n_credentials; i++)
3652872a
LP		 1598 if (streq(arg_credentials[i].id, word))
1599 return log_error_errno(SYNTHETIC_ERRNO(EEXIST), "Duplicate credential '%s', refusing.", word);
1600
1601 l = cunescape(p, UNESCAPE_ACCEPT_NUL, &data);
1602 if (l < 0)
1603 return log_error_errno(l, "Failed to unescape credential data: %s", p);
1604
1605 a = reallocarray(arg_credentials, arg_n_credentials + 1, sizeof(Credential));
1606 if (!a)
1607 return log_oom();
1608
1609 a[arg_n_credentials++] = (Credential) {
1610 .id = TAKE_PTR(word),
1611 .data = TAKE_PTR(data),
1612 .size = l,
1613 };
1614
1615 arg_credentials = a;
1616
1617 arg_settings_mask |= SETTING_CREDENTIALS;
1618 break;
1619 }
1620
1621 case ARG_LOAD_CREDENTIAL: {
1622 ReadFullFileFlags flags = READ_FULL_FILE_SECURE;
1623 _cleanup_(erase_and_freep) char *data = NULL;
1624 _cleanup_free_ char *word = NULL, *j = NULL;
1625 const char *p = optarg;
1626 Credential *a;
1627 size_t size, i;
1628
1629 r = extract_first_word(&p, &word, ":", EXTRACT_DONT_COALESCE_SEPARATORS);
1630 if (r == -ENOMEM)
1631 return log_oom();
1632 if (r < 0)
c941b650 1633 return log_error_errno(r, "Failed to parse --load-credential= parameter: %m");
3652872a 1634 if (r == 0 || !p)
c941b650 1635 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Missing value for --load-credential=: %s", optarg);
3652872a
LP		 1636
1637 if (!credential_name_valid(word))
1638 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Credential name is not valid: %s", word);
1639
1640 for (i = 0; i < arg_n_credentials; i++)
1641 if (streq(arg_credentials[i].id, word))
1642 return log_error_errno(SYNTHETIC_ERRNO(EEXIST), "Duplicate credential '%s', refusing.", word);
1643
1644 if (path_is_absolute(p))
1645 flags |= READ_FULL_FILE_CONNECT_SOCKET;
1646 else {
1647 const char *e;
1648
786d19fd
LP		 1649 r = get_credentials_dir(&e);
1650 if (r < 0)
1651 return log_error_errno(r, "Credential not available (no credentials passed at all): %s", word);
3652872a
LP		 1652
1653 j = path_join(e, p);
1654 if (!j)
1655 return log_oom();
1656 }
1657
986311c2
LP		 1658 r = read_full_file_full(AT_FDCWD, j ?: p, UINT64_MAX, SIZE_MAX,
1659 flags,
1660 NULL,
1661 &data, &size);
3652872a
LP		 1662 if (r < 0)
1663 return log_error_errno(r, "Failed to read credential '%s': %m", j ?: p);
1664
1665 a = reallocarray(arg_credentials, arg_n_credentials + 1, sizeof(Credential));
1666 if (!a)
1667 return log_oom();
1668
1669 a[arg_n_credentials++] = (Credential) {
1670 .id = TAKE_PTR(word),
1671 .data = TAKE_PTR(data),
1672 .size = size,
1673 };
1674
1675 arg_credentials = a;
1676
1677 arg_settings_mask |= SETTING_CREDENTIALS;
1678 break;
1679 }
1680
2f893044
LP		 1681 case ARG_BIND_USER:
1682 if (!valid_user_group_name(optarg, 0))
1683 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Invalid user name to bind: %s", optarg);
1684
1685 if (strv_extend(&arg_bind_user, optarg) < 0)
1686 return log_oom();
1687
1688 arg_settings_mask |= SETTING_BIND_USER;
1689 break;
1690
4a4654e0
LP		 1691 case ARG_SUPPRESS_SYNC:
1692 r = parse_boolean_argument("--suppress-sync=", optarg, &arg_suppress_sync);
1693 if (r < 0)
1694 return r;
1695
1696 arg_settings_mask |= SETTING_SUPPRESS_SYNC;
1697 break;
1698
88213476
LP		 1699 case '?':
1700 return -EINVAL;
1701
1702 default:
04499a70 1703 assert_not_reached();
88213476 1704 }
88213476 1705
60f1ec13
LP		 1706 if (argc > optind) {
1707 strv_free(arg_parameters);
1708 arg_parameters = strv_copy(argv + optind);
1709 if (!arg_parameters)
1710 return log_oom();
d7bea6b6 1711
60f1ec13
LP		 1712 arg_settings_mask |= SETTING_START_MODE;
1713 }
1714
1715 if (arg_ephemeral && arg_template && !arg_directory)
1716 /* User asked for ephemeral execution but specified --template= instead of --directory=. Semantically
1717 * such an invocation makes some sense, see https://github.com/systemd/systemd/issues/3667. Let's
1718 * accept this here, and silently make "--ephemeral --template=" equivalent to "--ephemeral
1719 * --directory=". */
1720 arg_directory = TAKE_PTR(arg_template);
1721
2642d22a
DDM		 1722 arg_caps_retain |= plus;
1723 arg_caps_retain |= arg_private_network ? UINT64_C(1) << CAP_NET_ADMIN : 0;
1724
1725 /* If we're not unsharing the network namespace and are unsharing the user namespace, we won't have
1726 * permissions to bind ports in the container, so let's drop the CAP_NET_BIND_SERVICE capability to
1727 * indicate that. */
1728 if (!arg_private_network && arg_userns_mode != USER_NAMESPACE_NO && arg_uid_shift > 0)
1729 arg_caps_retain &= ~(UINT64_C(1) << CAP_NET_BIND_SERVICE);
1730
1731 arg_caps_retain &= ~minus;
60f1ec13 1732
de40a303 1733 /* Make sure to parse environment before we reset the settings mask below */
49048684
ZJS		 1734 r = parse_environment();
1735 if (r < 0)
1736 return r;
de40a303 1737
60f1ec13
LP		 1738 /* Load all settings from .nspawn files */
1739 if (mask_no_settings)
1740 arg_settings_mask = 0;
1741
1742 /* Don't load any settings from .nspawn files */
1743 if (mask_all_settings)
1744 arg_settings_mask = _SETTINGS_MASK_ALL;
1745
1746 return 1;
1747}
1748
1749static int verify_arguments(void) {
1750 int r;
a6b5216c 1751
75b0d8b8
ZJS		 1752 if (arg_start_mode == START_PID2 && arg_unified_cgroup_hierarchy == CGROUP_UNIFIED_UNKNOWN) {
1753 /* If we are running the stub init in the container, we don't need to look at what the init
1754 * in the container supports, because we are not using it. Let's immediately pick the right
1755 * setting based on the host system configuration.
1756 *
1757 * We only do this, if the user didn't use an environment variable to override the detection.
1758 */
1759
1760 r = cg_all_unified();
1761 if (r < 0)
1762 return log_error_errno(r, "Failed to determine whether we are in all unified mode.");
1763 if (r > 0)
1764 arg_unified_cgroup_hierarchy = CGROUP_UNIFIED_ALL;
1765 else if (cg_unified_controller(SYSTEMD_CGROUP_CONTROLLER) > 0)
1766 arg_unified_cgroup_hierarchy = CGROUP_UNIFIED_SYSTEMD;
1767 else
1768 arg_unified_cgroup_hierarchy = CGROUP_UNIFIED_NONE;
1769 }
1770
4f086aab
SU		 1771 if (arg_userns_mode != USER_NAMESPACE_NO)
1772 arg_mount_settings |= MOUNT_USE_USERNS;
1773
1774 if (arg_private_network)
1775 arg_mount_settings |= MOUNT_APPLY_APIVFS_NETNS;
1776
48a8d337
LB		 1777 if (!(arg_clone_ns_flags & CLONE_NEWPID) ||
1778 !(arg_clone_ns_flags & CLONE_NEWUTS)) {
eb91eb18 1779 arg_register = false;
baaa35ad 1780 if (arg_start_mode != START_PID1)
60f1ec13 1781 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "--boot cannot be used without namespacing.");
0c582db0 1782 }
eb91eb18 1783
6c045a99
LP		 1784 if (arg_userns_ownership < 0)
1785 arg_userns_ownership =
f61c7f88 1786 arg_userns_mode == USER_NAMESPACE_PICK ? USER_NAMESPACE_OWNERSHIP_AUTO :
6c045a99 1787 USER_NAMESPACE_OWNERSHIP_OFF;
0e7ac751 1788
60f1ec13
LP		 1789 if (arg_start_mode == START_BOOT && arg_kill_signal <= 0)
1790 arg_kill_signal = SIGRTMIN+3;
1791
e5a4bb0d
LP		 1792 if (arg_volatile_mode != VOLATILE_NO) /* Make sure all file systems contained in the image are mounted read-only if we are in volatile mode */
1793 arg_read_only = true;
1794
2436ea76
DDM		 1795 if (has_custom_root_mount(arg_custom_mounts, arg_n_custom_mounts))
1796 arg_read_only = true;
1797
baaa35ad 1798 if (arg_keep_unit && arg_register && cg_pid_get_owner_uid(0, NULL) >= 0)
8d9c2bca
AJ		 1799 /* Save the user from accidentally registering either user-$SESSION.scope or user@.service.
1800 * The latter is not technically a user session, but we don't need to labour the point. */
60f1ec13 1801 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "--keep-unit --register=yes may not be used when invoked from a user session.");
89f7c846 1802
baaa35ad 1803 if (arg_directory && arg_image)
60f1ec13 1804 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "--directory= and --image= may not be combined.");
1b9e5b12 1805
baaa35ad 1806 if (arg_template && arg_image)
60f1ec13 1807 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "--template= and --image= may not be combined.");
8cd328d8 1808
baaa35ad 1809 if (arg_template && !(arg_directory || arg_machine))
60f1ec13 1810 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "--template= needs --directory= or --machine=.");
ec16945e 1811
baaa35ad 1812 if (arg_ephemeral && arg_template)
60f1ec13 1813 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "--ephemeral and --template= may not be combined.");
ec16945e 1814
baaa35ad 1815 if (arg_ephemeral && !IN_SET(arg_link_journal, LINK_NO, LINK_AUTO))
60f1ec13 1816 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "--ephemeral and --link-journal= may not be combined.");
df9a75e4 1817
baaa35ad 1818 if (arg_userns_mode != USER_NAMESPACE_NO && !userns_supported())
60f1ec13 1819 return log_error_errno(SYNTHETIC_ERRNO(EOPNOTSUPP), "--private-users= is not supported, kernel compiled without user namespace support.");
7336138e 1820
6c045a99 1821 if (arg_userns_ownership == USER_NAMESPACE_OWNERSHIP_CHOWN && arg_read_only)
de40a303 1822 return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
6c045a99 1823 "--read-only and --private-users-ownership=chown may not be combined.");
f757855e 1824
6c045a99
LP		 1825 /* We don't support --private-users-ownership=chown together with any of the volatile modes since we
1826 * couldn't change the read-only part of the tree (i.e. /usr) anyway, or because it would trigger a
1827 * massive copy-up (in case of overlay) making the entire exercise pointless. */
1828 if (arg_userns_ownership == USER_NAMESPACE_OWNERSHIP_CHOWN && arg_volatile_mode != VOLATILE_NO)
1829 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "--volatile= and --private-users-ownership=chown may not be combined.");
e5a4bb0d 1830
679ecd36
SZ		 1831 /* If --network-namespace-path is given with any other network-related option (except --private-network),
1832 * we need to error out, to avoid conflicts between different network options. */
60f1ec13
LP		 1833 if (arg_network_namespace_path &&
1834 (arg_network_interfaces || arg_network_macvlan ||
1835 arg_network_ipvlan || arg_network_veth_extra ||
1836 arg_network_bridge || arg_network_zone ||
679ecd36 1837 arg_network_veth))
de40a303 1838 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "--network-namespace-path= cannot be combined with other network options.");
86c0dd4a 1839
60f1ec13 1840 if (arg_network_bridge && arg_network_zone)
de40a303
LP		 1841 return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
1842 "--network-bridge= and --network-zone= may not be combined.");
f757855e 1843
baaa35ad 1844 if (arg_userns_mode != USER_NAMESPACE_NO && (arg_mount_settings & MOUNT_APPLY_APIVFS_NETNS) && !arg_private_network)
60f1ec13 1845 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Invalid namespacing settings. Mounting sysfs with --private-users requires --private-network.");
4f086aab 1846
baaa35ad 1847 if (arg_userns_mode != USER_NAMESPACE_NO && !(arg_mount_settings & MOUNT_APPLY_APIVFS_RO))
60f1ec13 1848 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Cannot combine --private-users with read-write mounts.");
f757855e 1849
baaa35ad 1850 if (arg_expose_ports && !arg_private_network)
60f1ec13 1851 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Cannot use --port= without private networking.");
6d0b55c2 1852
88fc9c9b 1853 if (arg_caps_ambient) {
f5fbe71d 1854 if (arg_caps_ambient == UINT64_MAX)
88fc9c9b
TH		 1855 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "AmbientCapability= does not support the value all.");
1856
1857 if ((arg_caps_ambient & arg_caps_retain) != arg_caps_ambient)
1858 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "AmbientCapability= setting is not fully covered by Capability= setting.");
1859
1860 if (arg_start_mode == START_BOOT)
1861 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "AmbientCapability= setting is not useful for boot mode.");
1862 }
1863
2f893044
LP		 1864 if (arg_userns_mode == USER_NAMESPACE_NO && !strv_isempty(arg_bind_user))
1865 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "--bind-user= requires --private-users");
1866
1867 /* Drop duplicate --bind-user= entries */
1868 strv_uniq(arg_bind_user);
1869
60f1ec13
LP		 1870 r = custom_mount_check_all();
1871 if (r < 0)
1872 return r;
c6c8f6e2 1873
f757855e 1874 return 0;
88213476
LP		 1875}
1876
91181e07 1877int userns_lchown(const char *p, uid_t uid, gid_t gid) {
03cfe0d5
LP		 1878 assert(p);
1879
0de7acce 1880 if (arg_userns_mode == USER_NAMESPACE_NO)
03cfe0d5
LP		 1881 return 0;
1882
1883 if (uid == UID_INVALID && gid == GID_INVALID)
1884 return 0;
1885
1886 if (uid != UID_INVALID) {
1887 uid += arg_uid_shift;
1888
1889 if (uid < arg_uid_shift || uid >= arg_uid_shift + arg_uid_range)
1890 return -EOVERFLOW;
1891 }
1892
1893 if (gid != GID_INVALID) {
1894 gid += (gid_t) arg_uid_shift;
1895
1896 if (gid < (gid_t) arg_uid_shift || gid >= (gid_t) (arg_uid_shift + arg_uid_range))
1897 return -EOVERFLOW;
1898 }
1899
7c248223 1900 return RET_NERRNO(lchown(p, uid, gid));
b12afc8c
LP		 1901}
1902
91181e07 1903int userns_mkdir(const char *root, const char *path, mode_t mode, uid_t uid, gid_t gid) {
03cfe0d5 1904 const char *q;
dae8b82e 1905 int r;
03cfe0d5
LP		 1906
1907 q = prefix_roota(root, path);
3f692e2e 1908 r = RET_NERRNO(mkdir(q, mode));
dae8b82e
ZJS		 1909 if (r == -EEXIST)
1910 return 0;
1911 if (r < 0)
1912 return r;
03cfe0d5
LP		 1913
1914 return userns_lchown(q, uid, gid);
1915}
1916
1688841f 1917static const char *timezone_from_path(const char *path) {
da9fc98d
LP		 1918 return PATH_STARTSWITH_SET(
1919 path,
1920 "../usr/share/zoneinfo/",
1921 "/usr/share/zoneinfo/");
1688841f
LP		 1922}
1923
83205269
LP		 1924static bool etc_writable(void) {
1925 return !arg_read_only || IN_SET(arg_volatile_mode, VOLATILE_YES, VOLATILE_OVERLAY);
1926}
1927
e58a1277 1928static int setup_timezone(const char *dest) {
1688841f
LP		 1929 _cleanup_free_ char *p = NULL, *etc = NULL;
1930 const char *where, *check;
1931 TimezoneMode m;
d4036145 1932 int r;
f8440af5 1933
e58a1277
LP		 1934 assert(dest);
1935
1688841f 1936 if (IN_SET(arg_timezone, TIMEZONE_AUTO, TIMEZONE_SYMLINK)) {
1688841f
LP		 1937 r = readlink_malloc("/etc/localtime", &p);
1938 if (r == -ENOENT && arg_timezone == TIMEZONE_AUTO)
83205269 1939 m = etc_writable() ? TIMEZONE_DELETE : TIMEZONE_OFF;
1688841f 1940 else if (r == -EINVAL && arg_timezone == TIMEZONE_AUTO) /* regular file? */
83205269 1941 m = etc_writable() ? TIMEZONE_COPY : TIMEZONE_BIND;
1688841f
LP		 1942 else if (r < 0) {
1943 log_warning_errno(r, "Failed to read host's /etc/localtime symlink, not updating container timezone: %m");
1944 /* To handle warning, delete /etc/localtime and replace it with a symbolic link to a time zone data
1945 * file.
1946 *
1947 * Example:
1948 * ln -s /usr/share/zoneinfo/UTC /etc/localtime
1949 */
1950 return 0;
1951 } else if (arg_timezone == TIMEZONE_AUTO)
83205269 1952 m = etc_writable() ? TIMEZONE_SYMLINK : TIMEZONE_BIND;
1688841f
LP		 1953 else
1954 m = arg_timezone;
1955 } else
1956 m = arg_timezone;
1957
1958 if (m == TIMEZONE_OFF)
1959 return 0;
1960
a5648b80 1961 r = chase_symlinks("/etc", dest, CHASE_PREFIX_ROOT, &etc, NULL);
d4036145 1962 if (r < 0) {
1688841f 1963 log_warning_errno(r, "Failed to resolve /etc path in container, ignoring: %m");
d4036145
LP		 1964 return 0;
1965 }
1966
1688841f
LP		 1967 where = strjoina(etc, "/localtime");
1968
1969 switch (m) {
1970
1971 case TIMEZONE_DELETE:
1972 if (unlink(where) < 0)
1973 log_full_errno(errno == ENOENT ? LOG_DEBUG : LOG_WARNING, errno, "Failed to remove '%s', ignoring: %m", where);
1974
d4036145 1975 return 0;
d4036145 1976
1688841f
LP		 1977 case TIMEZONE_SYMLINK: {
1978 _cleanup_free_ char *q = NULL;
1979 const char *z, *what;
4d1c38b8 1980
1688841f
LP		 1981 z = timezone_from_path(p);
1982 if (!z) {
1983 log_warning("/etc/localtime does not point into /usr/share/zoneinfo/, not updating container timezone.");
d4036145 1984 return 0;
1688841f 1985 }
d4036145 1986
1688841f
LP		 1987 r = readlink_malloc(where, &q);
1988 if (r >= 0 && streq_ptr(timezone_from_path(q), z))
1989 return 0; /* Already pointing to the right place? Then do nothing .. */
1990
1991 check = strjoina(dest, "/usr/share/zoneinfo/", z);
a5648b80 1992 r = chase_symlinks(check, dest, 0, NULL, NULL);
1688841f
LP		 1993 if (r < 0)
1994 log_debug_errno(r, "Timezone %s does not exist (or is not accessible) in container, not creating symlink: %m", z);
1995 else {
1996 if (unlink(where) < 0 && errno != ENOENT) {
1997 log_full_errno(IN_SET(errno, EROFS, EACCES, EPERM) ? LOG_DEBUG : LOG_WARNING, /* Don't complain on read-only images */
1998 errno, "Failed to remove existing timezone info %s in container, ignoring: %m", where);
1999 return 0;
2000 }
2001
2002 what = strjoina("../usr/share/zoneinfo/", z);
2003 if (symlink(what, where) < 0) {
2004 log_full_errno(IN_SET(errno, EROFS, EACCES, EPERM) ? LOG_DEBUG : LOG_WARNING,
2005 errno, "Failed to correct timezone of container, ignoring: %m");
2006 return 0;
2007 }
2008
2009 break;
2010 }
2011
2012 _fallthrough_;
d4036145 2013 }
68fb0892 2014
1688841f
LP		 2015 case TIMEZONE_BIND: {
2016 _cleanup_free_ char *resolved = NULL;
2017 int found;
2018
a5648b80 2019 found = chase_symlinks(where, dest, CHASE_NONEXISTENT, &resolved, NULL);
1688841f
LP		 2020 if (found < 0) {
2021 log_warning_errno(found, "Failed to resolve /etc/localtime path in container, ignoring: %m");
2022 return 0;
2023 }
2024
2025 if (found == 0) /* missing? */
2026 (void) touch(resolved);
2027
511a8cfe 2028 r = mount_nofollow_verbose(LOG_WARNING, "/etc/localtime", resolved, NULL, MS_BIND, NULL);
1688841f 2029 if (r >= 0)
511a8cfe 2030 return mount_nofollow_verbose(LOG_ERR, NULL, resolved, NULL, MS_BIND|MS_REMOUNT|MS_RDONLY|MS_NOSUID|MS_NODEV, NULL);
1688841f
LP		 2031
2032 _fallthrough_;
79d80fc1 2033 }
4d9f07b4 2034
1688841f
LP		 2035 case TIMEZONE_COPY:
2036 /* If mounting failed, try to copy */
7c2f5495 2037 r = copy_file_atomic("/etc/localtime", where, 0644, COPY_REFLINK|COPY_REPLACE);
1688841f
LP		 2038 if (r < 0) {
2039 log_full_errno(IN_SET(r, -EROFS, -EACCES, -EPERM) ? LOG_DEBUG : LOG_WARNING, r,
2040 "Failed to copy /etc/localtime to %s, ignoring: %m", where);
2041 return 0;
2042 }
2043
2044 break;
2045
2046 default:
04499a70 2047 assert_not_reached();
d4036145 2048 }
e58a1277 2049
1688841f 2050 /* Fix permissions of the symlink or file copy we just created */
03cfe0d5
LP		 2051 r = userns_lchown(where, 0, 0);
2052 if (r < 0)
1688841f 2053 log_warning_errno(r, "Failed to chown /etc/localtime, ignoring: %m");
03cfe0d5 2054
e58a1277 2055 return 0;
88213476
LP		 2056}
2057
09d423e9
LP		 2058static int have_resolv_conf(const char *path) {
2059 assert(path);
2060
2061 if (access(path, F_OK) < 0) {
2062 if (errno == ENOENT)
2063 return 0;
2064
2065 return log_debug_errno(errno, "Failed to determine whether '%s' is available: %m", path);
2066 }
2067
2068 return 1;
2069}
2070
7357272e 2071static int resolved_listening(void) {
b8ea7a6e 2072 _cleanup_(sd_bus_error_free) sd_bus_error error = SD_BUS_ERROR_NULL;
b053cd5f 2073 _cleanup_(sd_bus_flush_close_unrefp) sd_bus *bus = NULL;
7357272e 2074 _cleanup_free_ char *dns_stub_listener_mode = NULL;
b053cd5f
LP		 2075 int r;
2076
7357272e 2077 /* Check if resolved is listening */
b053cd5f
LP		 2078
2079 r = sd_bus_open_system(&bus);
2080 if (r < 0)
b8ea7a6e 2081 return log_debug_errno(r, "Failed to open system bus: %m");
b053cd5f 2082
7357272e 2083 r = bus_name_has_owner(bus, "org.freedesktop.resolve1", NULL);
b8ea7a6e
LP		 2084 if (r < 0)
2085 return log_debug_errno(r, "Failed to check whether the 'org.freedesktop.resolve1' bus name is taken: %m");
2086 if (r == 0)
2087 return 0;
7357272e
DM		 2088
2089 r = sd_bus_get_property_string(bus,
2090 "org.freedesktop.resolve1",
2091 "/org/freedesktop/resolve1",
2092 "org.freedesktop.resolve1.Manager",
2093 "DNSStubListener",
b8ea7a6e 2094 &error,
7357272e
DM		 2095 &dns_stub_listener_mode);
2096 if (r < 0)
b8ea7a6e 2097 return log_debug_errno(r, "Failed to query DNSStubListener property: %s", bus_error_message(&error, r));
7357272e
DM		 2098
2099 return STR_IN_SET(dns_stub_listener_mode, "udp", "yes");
b053cd5f
LP		 2100}
2101
2547bb41 2102static int setup_resolv_conf(const char *dest) {
09d423e9
LP		 2103 _cleanup_free_ char *etc = NULL;
2104 const char *where, *what;
2105 ResolvConfMode m;
2106 int r;
2547bb41
LP		 2107
2108 assert(dest);
2109
09d423e9
LP		 2110 if (arg_resolv_conf == RESOLV_CONF_AUTO) {
2111 if (arg_private_network)
2112 m = RESOLV_CONF_OFF;
86775e35
LP		 2113 else if (have_resolv_conf(PRIVATE_STUB_RESOLV_CONF) > 0 && resolved_listening() > 0)
2114 m = etc_writable() ? RESOLV_CONF_COPY_STUB : RESOLV_CONF_BIND_STUB;
09d423e9 2115 else if (have_resolv_conf("/etc/resolv.conf") > 0)
83205269 2116 m = etc_writable() ? RESOLV_CONF_COPY_HOST : RESOLV_CONF_BIND_HOST;
09d423e9 2117 else
83205269 2118 m = etc_writable() ? RESOLV_CONF_DELETE : RESOLV_CONF_OFF;
86775e35 2119
09d423e9
LP		 2120 } else
2121 m = arg_resolv_conf;
2122
2123 if (m == RESOLV_CONF_OFF)
2547bb41
LP		 2124 return 0;
2125
a5648b80 2126 r = chase_symlinks("/etc", dest, CHASE_PREFIX_ROOT, &etc, NULL);
87447ae4
LP		 2127 if (r < 0) {
2128 log_warning_errno(r, "Failed to resolve /etc path in container, ignoring: %m");
2129 return 0;
2130 }
2131
2132 where = strjoina(etc, "/resolv.conf");
09d423e9
LP		 2133
2134 if (m == RESOLV_CONF_DELETE) {
2135 if (unlink(where) < 0)
2136 log_full_errno(errno == ENOENT ? LOG_DEBUG : LOG_WARNING, errno, "Failed to remove '%s', ignoring: %m", where);
2137
87447ae4
LP		 2138 return 0;
2139 }
79d80fc1 2140
86775e35
LP		 2141 if (IN_SET(m, RESOLV_CONF_BIND_STATIC, RESOLV_CONF_REPLACE_STATIC, RESOLV_CONF_COPY_STATIC))
2142 what = PRIVATE_STATIC_RESOLV_CONF;
2143 else if (IN_SET(m, RESOLV_CONF_BIND_UPLINK, RESOLV_CONF_REPLACE_UPLINK, RESOLV_CONF_COPY_UPLINK))
2144 what = PRIVATE_UPLINK_RESOLV_CONF;
2145 else if (IN_SET(m, RESOLV_CONF_BIND_STUB, RESOLV_CONF_REPLACE_STUB, RESOLV_CONF_COPY_STUB))
2146 what = PRIVATE_STUB_RESOLV_CONF;
09d423e9
LP		 2147 else
2148 what = "/etc/resolv.conf";
87447ae4 2149
86775e35 2150 if (IN_SET(m, RESOLV_CONF_BIND_HOST, RESOLV_CONF_BIND_STATIC, RESOLV_CONF_BIND_UPLINK, RESOLV_CONF_BIND_STUB)) {
09d423e9
LP		 2151 _cleanup_free_ char *resolved = NULL;
2152 int found;
2153
a5648b80 2154 found = chase_symlinks(where, dest, CHASE_NONEXISTENT, &resolved, NULL);
09d423e9
LP		 2155 if (found < 0) {
2156 log_warning_errno(found, "Failed to resolve /etc/resolv.conf path in container, ignoring: %m");
2157 return 0;
2158 }
3539724c 2159
87447ae4
LP		 2160 if (found == 0) /* missing? */
2161 (void) touch(resolved);
5367354d 2162
511a8cfe 2163 r = mount_nofollow_verbose(LOG_WARNING, what, resolved, NULL, MS_BIND, NULL);
60e76d48 2164 if (r >= 0)
511a8cfe 2165 return mount_nofollow_verbose(LOG_ERR, NULL, resolved, NULL, MS_BIND|MS_REMOUNT|MS_RDONLY|MS_NOSUID|MS_NODEV, NULL);
86775e35
LP		 2166
2167 /* If that didn't work, let's copy the file */
3539724c
LP		 2168 }
2169
86775e35 2170 if (IN_SET(m, RESOLV_CONF_REPLACE_HOST, RESOLV_CONF_REPLACE_STATIC, RESOLV_CONF_REPLACE_UPLINK, RESOLV_CONF_REPLACE_STUB))
7c2f5495 2171 r = copy_file_atomic(what, where, 0644, COPY_REFLINK|COPY_REPLACE);
86775e35 2172 else
7c2f5495 2173 r = copy_file(what, where, O_TRUNC|O_NOFOLLOW, 0644, COPY_REFLINK);
79d80fc1 2174 if (r < 0) {
3539724c
LP		 2175 /* If the file already exists as symlink, let's suppress the warning, under the assumption that
2176 * resolved or something similar runs inside and the symlink points there.
68a313c5 2177 *
3539724c 2178 * If the disk image is read-only, there's also no point in complaining.
68a313c5 2179 */
86775e35
LP		 2180 log_full_errno(!IN_SET(RESOLV_CONF_COPY_HOST, RESOLV_CONF_COPY_STATIC, RESOLV_CONF_COPY_UPLINK, RESOLV_CONF_COPY_STUB) &&
2181 IN_SET(r, -ELOOP, -EROFS, -EACCES, -EPERM) ? LOG_DEBUG : LOG_WARNING, r,
3539724c 2182 "Failed to copy /etc/resolv.conf to %s, ignoring: %m", where);
79d80fc1
TG		 2183 return 0;
2184 }
2547bb41 2185
03cfe0d5
LP		 2186 r = userns_lchown(where, 0, 0);
2187 if (r < 0)
3539724c 2188 log_warning_errno(r, "Failed to chown /etc/resolv.conf, ignoring: %m");
03cfe0d5 2189
2547bb41
LP		 2190 return 0;
2191}
2192
1e4f1671 2193static int setup_boot_id(void) {
cdde6ba6
LP		 2194 _cleanup_(unlink_and_freep) char *from = NULL;
2195 _cleanup_free_ char *path = NULL;
3bbaff3e 2196 sd_id128_t rnd = SD_ID128_NULL;
cdde6ba6 2197 const char *to;
04bc4a3f
LP		 2198 int r;
2199
1eacc470 2200 /* Generate a new randomized boot ID, so that each boot-up of the container gets a new one */
04bc4a3f 2201
1eacc470 2202 r = tempfn_random_child("/run", "proc-sys-kernel-random-boot-id", &path);
cdde6ba6
LP		 2203 if (r < 0)
2204 return log_error_errno(r, "Failed to generate random boot ID path: %m");
04bc4a3f
LP		 2205
2206 r = sd_id128_randomize(&rnd);
f647962d
MS		 2207 if (r < 0)
2208 return log_error_errno(r, "Failed to generate random boot id: %m");
04bc4a3f 2209
b40c8ebd 2210 r = id128_write(path, ID128_FORMAT_UUID, rnd);
f647962d
MS		 2211 if (r < 0)
2212 return log_error_errno(r, "Failed to write boot id: %m");
04bc4a3f 2213
cdde6ba6
LP		 2214 from = TAKE_PTR(path);
2215 to = "/proc/sys/kernel/random/boot_id";
2216
511a8cfe 2217 r = mount_nofollow_verbose(LOG_ERR, from, to, NULL, MS_BIND, NULL);
cdde6ba6
LP		 2218 if (r < 0)
2219 return r;
04bc4a3f 2220
511a8cfe 2221 return mount_nofollow_verbose(LOG_ERR, NULL, to, NULL, MS_BIND|MS_REMOUNT|MS_RDONLY|MS_NOSUID|MS_NOEXEC|MS_NODEV, NULL);
04bc4a3f
LP		 2222}
2223
e58a1277 2224static int copy_devnodes(const char *dest) {
88213476
LP		 2225 static const char devnodes[] =
2226 "null\0"
2227 "zero\0"
2228 "full\0"
2229 "random\0"
2230 "urandom\0"
85614d66
TG		 2231 "tty\0"
2232 "net/tun\0";
88213476 2233
e58a1277 2234 int r = 0;
a258bf26
LP		 2235
2236 assert(dest);
124640f1 2237
52f05ef2 2238 BLOCK_WITH_UMASK(0000);
88213476 2239
03cfe0d5
LP		 2240 /* Create /dev/net, so that we can create /dev/net/tun in it */
2241 if (userns_mkdir(dest, "/dev/net", 0755, 0, 0) < 0)
2242 return log_error_errno(r, "Failed to create /dev/net directory: %m");
2243
88213476 2244 NULSTR_FOREACH(d, devnodes) {
7fd1b19b 2245 _cleanup_free_ char *from = NULL, *to = NULL;
7f112f50 2246 struct stat st;
88213476 2247
c6134d3e 2248 from = path_join("/dev/", d);
8967f291
LP		 2249 if (!from)
2250 return log_oom();
2251
c6134d3e 2252 to = path_join(dest, from);
8967f291
LP		 2253 if (!to)
2254 return log_oom();
88213476
LP		 2255
2256 if (stat(from, &st) < 0) {
2257
4a62c710
MS		 2258 if (errno != ENOENT)
2259 return log_error_errno(errno, "Failed to stat %s: %m", from);
88213476 2260
baaa35ad
ZJS		 2261 } else if (!S_ISCHR(st.st_mode) && !S_ISBLK(st.st_mode))
2262 return log_error_errno(SYNTHETIC_ERRNO(EIO),
2263 "%s is not a char or block device, cannot copy.", from);
2264 else {
8dfce114
LP		 2265 _cleanup_free_ char *sl = NULL, *prefixed = NULL, *dn = NULL, *t = NULL;
2266
81f5049b 2267 if (mknod(to, st.st_mode, st.st_rdev) < 0) {
8dbf71ec 2268 /* Explicitly warn the user when /dev is already populated. */
41eb4362 2269 if (errno == EEXIST)
8dbf71ec 2270 log_notice("%s/dev is pre-mounted and pre-populated. If a pre-mounted /dev is provided it needs to be an unpopulated file system.", dest);
81f5049b
AC		 2271 if (errno != EPERM)
2272 return log_error_errno(errno, "mknod(%s) failed: %m", to);
2273
8dfce114 2274 /* Some systems abusively restrict mknod but allow bind mounts. */
81f5049b
AC		 2275 r = touch(to);
2276 if (r < 0)
2277 return log_error_errno(r, "touch (%s) failed: %m", to);
511a8cfe 2278 r = mount_nofollow_verbose(LOG_DEBUG, from, to, NULL, MS_BIND, NULL);
60e76d48
ZJS		 2279 if (r < 0)
2280 return log_error_errno(r, "Both mknod and bind mount (%s) failed: %m", to);
81f5049b 2281 }
6278cf60 2282
03cfe0d5
LP		 2283 r = userns_lchown(to, 0, 0);
2284 if (r < 0)
2285 return log_error_errno(r, "chown() of device node %s failed: %m", to);
8dfce114 2286
657ee2d8 2287 dn = path_join("/dev", S_ISCHR(st.st_mode) ? "char" : "block");
8dfce114
LP		 2288 if (!dn)
2289 return log_oom();
2290
2291 r = userns_mkdir(dest, dn, 0755, 0, 0);
2292 if (r < 0)
2293 return log_error_errno(r, "Failed to create '%s': %m", dn);
2294
2295 if (asprintf(&sl, "%s/%u:%u", dn, major(st.st_rdev), minor(st.st_rdev)) < 0)
2296 return log_oom();
2297
c6134d3e 2298 prefixed = path_join(dest, sl);
8dfce114
LP		 2299 if (!prefixed)
2300 return log_oom();
2301
2d9b74ba 2302 t = path_join("..", d);
8dfce114
LP		 2303 if (!t)
2304 return log_oom();
2305
2306 if (symlink(t, prefixed) < 0)
2307 log_debug_errno(errno, "Failed to symlink '%s' to '%s': %m", t, prefixed);
88213476 2308 }
88213476
LP		 2309 }
2310
e58a1277
LP		 2311 return r;
2312}
88213476 2313
de40a303 2314static int make_extra_nodes(const char *dest) {
de40a303
LP		 2315 size_t i;
2316 int r;
2317
52f05ef2 2318 BLOCK_WITH_UMASK(0000);
de40a303
LP		 2319
2320 for (i = 0; i < arg_n_extra_nodes; i++) {
2321 _cleanup_free_ char *path = NULL;
2322 DeviceNode *n = arg_extra_nodes + i;
2323
c6134d3e 2324 path = path_join(dest, n->path);
de40a303
LP		 2325 if (!path)
2326 return log_oom();
2327
2328 if (mknod(path, n->mode, S_ISCHR(n->mode) || S_ISBLK(n->mode) ? makedev(n->major, n->minor) : 0) < 0)
2329 return log_error_errno(errno, "Failed to create device node '%s': %m", path);
2330
2331 r = chmod_and_chown(path, n->mode, n->uid, n->gid);
2332 if (r < 0)
2333 return log_error_errno(r, "Failed to adjust device node ownership of '%s': %m", path);
2334 }
2335
2336 return 0;
2337}
2338
03cfe0d5
LP		 2339static int setup_pts(const char *dest) {
2340 _cleanup_free_ char *options = NULL;
2341 const char *p;
709f6e46 2342 int r;
03cfe0d5 2343
349cc4a5 2344#if HAVE_SELINUX
03cfe0d5
LP		 2345 if (arg_selinux_apifs_context)
2346 (void) asprintf(&options,
3dce8915 2347 "newinstance,ptmxmode=0666,mode=620,gid=" GID_FMT ",context=\"%s\"",
03cfe0d5
LP		 2348 arg_uid_shift + TTY_GID,
2349 arg_selinux_apifs_context);
2350 else
2351#endif
2352 (void) asprintf(&options,
3dce8915 2353 "newinstance,ptmxmode=0666,mode=620,gid=" GID_FMT,
03cfe0d5 2354 arg_uid_shift + TTY_GID);
f2d88580 2355
03cfe0d5 2356 if (!options)
f2d88580
LP		 2357 return log_oom();
2358
03cfe0d5 2359 /* Mount /dev/pts itself */
cc9fce65 2360 p = prefix_roota(dest, "/dev/pts");
3f692e2e 2361 r = RET_NERRNO(mkdir(p, 0755));
dae8b82e
ZJS		 2362 if (r < 0)
2363 return log_error_errno(r, "Failed to create /dev/pts: %m");
2364
511a8cfe 2365 r = mount_nofollow_verbose(LOG_ERR, "devpts", p, "devpts", MS_NOSUID|MS_NOEXEC, options);
60e76d48
ZJS		 2366 if (r < 0)
2367 return r;
709f6e46
MS		 2368 r = userns_lchown(p, 0, 0);
2369 if (r < 0)
2370 return log_error_errno(r, "Failed to chown /dev/pts: %m");
03cfe0d5
LP		 2371
2372 /* Create /dev/ptmx symlink */
2373 p = prefix_roota(dest, "/dev/ptmx");
4a62c710
MS		 2374 if (symlink("pts/ptmx", p) < 0)
2375 return log_error_errno(errno, "Failed to create /dev/ptmx symlink: %m");
709f6e46
MS		 2376 r = userns_lchown(p, 0, 0);
2377 if (r < 0)
2378 return log_error_errno(r, "Failed to chown /dev/ptmx: %m");
f2d88580 2379
03cfe0d5
LP		 2380 /* And fix /dev/pts/ptmx ownership */
2381 p = prefix_roota(dest, "/dev/pts/ptmx");
709f6e46
MS		 2382 r = userns_lchown(p, 0, 0);
2383 if (r < 0)
2384 return log_error_errno(r, "Failed to chown /dev/pts/ptmx: %m");
6278cf60 2385
f2d88580
LP		 2386 return 0;
2387}
2388
3acc84eb 2389static int setup_stdio_as_dev_console(void) {
5bb1d7fb 2390 _cleanup_close_ int terminal = -EBADF;
e58a1277 2391 int r;
e58a1277 2392
335d2ead
LP		 2393 /* We open the TTY in O_NOCTTY mode, so that we do not become controller yet. We'll do that later
2394 * explicitly, if we are configured to. */
2395 terminal = open_terminal("/dev/console", O_RDWR|O_NOCTTY);
3acc84eb
FB		 2396 if (terminal < 0)
2397 return log_error_errno(terminal, "Failed to open console: %m");
e58a1277 2398
3acc84eb
FB		 2399 /* Make sure we can continue logging to the original stderr, even if
2400 * stderr points elsewhere now */
2401 r = log_dup_console();
2402 if (r < 0)
2403 return log_error_errno(r, "Failed to duplicate stderr: %m");
de40a303 2404
3acc84eb
FB		 2405 /* invalidates 'terminal' on success and failure */
2406 r = rearrange_stdio(terminal, terminal, terminal);
2fef50cd 2407 TAKE_FD(terminal);
f647962d 2408 if (r < 0)
3acc84eb
FB		 2409 return log_error_errno(r, "Failed to move console to stdin/stdout/stderr: %m");
2410
2411 return 0;
2412}
88213476 2413
3acc84eb
FB		 2414static int setup_dev_console(const char *console) {
2415 _cleanup_free_ char *p = NULL;
2416 int r;
a258bf26 2417
3acc84eb
FB		 2418 /* Create /dev/console symlink */
2419 r = path_make_relative("/dev", console, &p);
81f5049b 2420 if (r < 0)
3acc84eb
FB		 2421 return log_error_errno(r, "Failed to create relative path: %m");
2422
2423 if (symlink(p, "/dev/console") < 0)
2424 return log_error_errno(errno, "Failed to create /dev/console symlink: %m");
a258bf26 2425
3acc84eb 2426 return 0;
e58a1277
LP		 2427}
2428
8e5430c4
LP		 2429static int setup_keyring(void) {
2430 key_serial_t keyring;
2431
6b000af4
LP		 2432 /* Allocate a new session keyring for the container. This makes sure the keyring of the session
2433 * systemd-nspawn was invoked from doesn't leak into the container. Note that by default we block
2434 * keyctl() and request_key() anyway via seccomp so doing this operation isn't strictly necessary,
2435 * but in case people explicitly allow-list these system calls let's make sure we don't leak anything
2436 * into the container. */
8e5430c4
LP		 2437
2438 keyring = keyctl(KEYCTL_JOIN_SESSION_KEYRING, 0, 0, 0, 0);
2439 if (keyring == -1) {
2440 if (errno == ENOSYS)
2441 log_debug_errno(errno, "Kernel keyring not supported, ignoring.");
065b4774 2442 else if (ERRNO_IS_PRIVILEGE(errno))
8e5430c4
LP		 2443 log_debug_errno(errno, "Kernel keyring access prohibited, ignoring.");
2444 else
2445 return log_error_errno(errno, "Setting up kernel keyring failed: %m");
2446 }
2447
2448 return 0;
2449}
2450
3652872a
LP		 2451static int setup_credentials(const char *root) {
2452 const char *q;
2453 int r;
2454
2455 if (arg_n_credentials <= 0)
2456 return 0;
2457
2458 r = userns_mkdir(root, "/run/host", 0755, 0, 0);
2459 if (r < 0)
2460 return log_error_errno(r, "Failed to create /run/host: %m");
2461
2462 r = userns_mkdir(root, "/run/host/credentials", 0700, 0, 0);
2463 if (r < 0)
2464 return log_error_errno(r, "Failed to create /run/host/credentials: %m");
2465
2466 q = prefix_roota(root, "/run/host/credentials");
511a8cfe 2467 r = mount_nofollow_verbose(LOG_ERR, NULL, q, "ramfs", MS_NOSUID|MS_NOEXEC|MS_NODEV, "mode=0700");
3652872a
LP		 2468 if (r < 0)
2469 return r;
2470
2471 for (size_t i = 0; i < arg_n_credentials; i++) {
2472 _cleanup_free_ char *j = NULL;
254d1313 2473 _cleanup_close_ int fd = -EBADF;
3652872a
LP		 2474
2475 j = path_join(q, arg_credentials[i].id);
2476 if (!j)
2477 return log_oom();
2478
2479 fd = open(j, O_CREAT|O_EXCL|O_WRONLY|O_CLOEXEC|O_NOFOLLOW, 0600);
2480 if (fd < 0)
2481 return log_error_errno(errno, "Failed to create credential file %s: %m", j);
2482
2483 r = loop_write(fd, arg_credentials[i].data, arg_credentials[i].size, /* do_poll= */ false);
2484 if (r < 0)
2485 return log_error_errno(r, "Failed to write credential to file %s: %m", j);
2486
2487 if (fchmod(fd, 0400) < 0)
2488 return log_error_errno(errno, "Failed to adjust access mode of %s: %m", j);
2489
2490 if (arg_userns_mode != USER_NAMESPACE_NO) {
2491 if (fchown(fd, arg_uid_shift, arg_uid_shift) < 0)
2492 return log_error_errno(errno, "Failed to adjust ownership of %s: %m", j);
2493 }
2494 }
2495
2496 if (chmod(q, 0500) < 0)
2497 return log_error_errno(errno, "Failed to adjust access mode of %s: %m", q);
2498
2499 r = userns_lchown(q, 0, 0);
2500 if (r < 0)
2501 return r;
2502
2503 /* Make both mount and superblock read-only now */
511a8cfe 2504 r = mount_nofollow_verbose(LOG_ERR, NULL, q, NULL, MS_REMOUNT|MS_BIND|MS_RDONLY|MS_NOSUID|MS_NOEXEC|MS_NODEV, NULL);
3652872a
LP		 2505 if (r < 0)
2506 return r;
2507
511a8cfe 2508 return mount_nofollow_verbose(LOG_ERR, NULL, q, NULL, MS_REMOUNT|MS_RDONLY|MS_NOSUID|MS_NOEXEC|MS_NODEV, "mode=0500");
3652872a
LP		 2509}
2510
5d9d3fcb 2511static int setup_kmsg(int fd_inner_socket) {
9ec5a93c
LP		 2512 _cleanup_(unlink_and_freep) char *from = NULL;
2513 _cleanup_free_ char *fifo = NULL;
254d1313 2514 _cleanup_close_ int fd = -EBADF;
9ec5a93c 2515 int r;
e58a1277 2516
5d9d3fcb 2517 assert(fd_inner_socket >= 0);
a258bf26 2518
52f05ef2 2519 BLOCK_WITH_UMASK(0000);
a258bf26 2520
30fd9a2d 2521 /* We create the kmsg FIFO as a temporary file in /run, but immediately delete it after bind mounting it to
9ec5a93c
LP		 2522 * /proc/kmsg. While FIFOs on the reading side behave very similar to /proc/kmsg, their writing side behaves
2523 * differently from /dev/kmsg in that writing blocks when nothing is reading. In order to avoid any problems
2524 * with containers deadlocking due to this we simply make /dev/kmsg unavailable to the container. */
2525
1eacc470 2526 r = tempfn_random_child("/run", "proc-kmsg", &fifo);
9ec5a93c
LP		 2527 if (r < 0)
2528 return log_error_errno(r, "Failed to generate kmsg path: %m");
e58a1277 2529
9ec5a93c 2530 if (mkfifo(fifo, 0600) < 0)
03cfe0d5 2531 return log_error_errno(errno, "mkfifo() for /run/kmsg failed: %m");
9ec5a93c
LP		 2532
2533 from = TAKE_PTR(fifo);
9ec5a93c 2534
511a8cfe 2535 r = mount_nofollow_verbose(LOG_ERR, from, "/proc/kmsg", NULL, MS_BIND, NULL);
60e76d48
ZJS		 2536 if (r < 0)
2537 return r;
e58a1277 2538
669fc4e5 2539 fd = open(from, O_RDWR|O_NONBLOCK|O_CLOEXEC);
4a62c710
MS		 2540 if (fd < 0)
2541 return log_error_errno(errno, "Failed to open fifo: %m");
e58a1277 2542
9ec5a93c 2543 /* Store away the fd in the socket, so that it stays open as long as we run the child */
5d9d3fcb 2544 r = send_one_fd(fd_inner_socket, fd, 0);
d9603714
DH		 2545 if (r < 0)
2546 return log_error_errno(r, "Failed to send FIFO fd: %m");
a258bf26 2547
25ea79fe 2548 return 0;
88213476
LP		 2549}
2550
761cf19d 2551struct ExposeArgs {
deff68e7
FW		 2552 union in_addr_union address4;
2553 union in_addr_union address6;
761cf19d
FW		 2554 struct FirewallContext *fw_ctx;
2555};
2556
1c4baffc 2557static int on_address_change(sd_netlink *rtnl, sd_netlink_message *m, void *userdata) {
99534007 2558 struct ExposeArgs *args = ASSERT_PTR(userdata);
6d0b55c2
LP		 2559
2560 assert(rtnl);
2561 assert(m);
6d0b55c2 2562
fb9044cb
LP		 2563 (void) expose_port_execute(rtnl, &args->fw_ctx, arg_expose_ports, AF_INET, &args->address4);
2564 (void) expose_port_execute(rtnl, &args->fw_ctx, arg_expose_ports, AF_INET6, &args->address6);
6d0b55c2
LP		 2565 return 0;
2566}
2567
3a74cea5 2568static int setup_hostname(void) {
c818eef1 2569 int r;
3a74cea5 2570
0c582db0 2571 if ((arg_clone_ns_flags & CLONE_NEWUTS) == 0)
eb91eb18
LP		 2572 return 0;
2573
c818eef1
LP		 2574 r = sethostname_idempotent(arg_hostname ?: arg_machine);
2575 if (r < 0)
2576 return log_error_errno(r, "Failed to set hostname: %m");
3a74cea5 2577
7027ff61 2578 return 0;
3a74cea5
LP		 2579}
2580
57fb9fb5 2581static int setup_journal(const char *directory) {
0f5e1382 2582 _cleanup_free_ char *d = NULL;
5980d463 2583 const char *p, *q;
b2238e38 2584 sd_id128_t this_id;
8054d749 2585 bool try;
57fb9fb5
LP		 2586 int r;
2587
df9a75e4
LP		 2588 /* Don't link journals in ephemeral mode */
2589 if (arg_ephemeral)
2590 return 0;
2591
8054d749
LP		 2592 if (arg_link_journal == LINK_NO)
2593 return 0;
2594
2595 try = arg_link_journal_try || arg_link_journal == LINK_AUTO;
2596
4d680aee 2597 r = sd_id128_get_machine(&this_id);
f647962d
MS		 2598 if (r < 0)
2599 return log_error_errno(r, "Failed to retrieve machine ID: %m");
4d680aee 2600
e01ff70a 2601 if (sd_id128_equal(arg_uuid, this_id)) {
8054d749 2602 log_full(try ? LOG_WARNING : LOG_ERR,
85b55869 2603 "Host and machine ids are equal (%s): refusing to link journals", SD_ID128_TO_STRING(arg_uuid));
8054d749 2604 if (try)
4d680aee 2605 return 0;
df9a75e4 2606 return -EEXIST;
4d680aee
ZJS		 2607 }
2608
369ca6da
ZJS		 2609 FOREACH_STRING(dirname, "/var", "/var/log", "/var/log/journal") {
2610 r = userns_mkdir(directory, dirname, 0755, 0, 0);
2611 if (r < 0) {
2612 bool ignore = r == -EROFS && try;
2613 log_full_errno(ignore ? LOG_DEBUG : LOG_ERR, r,
2614 "Failed to create %s%s: %m", dirname, ignore ? ", ignoring" : "");
2615 return ignore ? 0 : r;
2616 }
2617 }
03cfe0d5 2618
85b55869 2619 p = strjoina("/var/log/journal/", SD_ID128_TO_STRING(arg_uuid));
03cfe0d5 2620 q = prefix_roota(directory, p);
27407a01 2621
e1873695 2622 if (path_is_mount_point(p, NULL, 0) > 0) {
8054d749
LP		 2623 if (try)
2624 return 0;
27407a01 2625
baaa35ad
ZJS		 2626 return log_error_errno(SYNTHETIC_ERRNO(EEXIST),
2627 "%s: already a mount point, refusing to use for journal", p);
57fb9fb5
LP		 2628 }
2629
e1873695 2630 if (path_is_mount_point(q, NULL, 0) > 0) {
8054d749
LP		 2631 if (try)
2632 return 0;
57fb9fb5 2633
baaa35ad
ZJS		 2634 return log_error_errno(SYNTHETIC_ERRNO(EEXIST),
2635 "%s: already a mount point, refusing to use for journal", q);
57fb9fb5
LP		 2636 }
2637
2638 r = readlink_and_make_absolute(p, &d);
2639 if (r >= 0) {
3742095b 2640 if (IN_SET(arg_link_journal, LINK_GUEST, LINK_AUTO) &&
57fb9fb5
LP		 2641 path_equal(d, q)) {
2642
03cfe0d5 2643 r = userns_mkdir(directory, p, 0755, 0, 0);
27407a01 2644 if (r < 0)
709f6e46 2645 log_warning_errno(r, "Failed to create directory %s: %m", q);
27407a01 2646 return 0;
57fb9fb5
LP		 2647 }
2648
4a62c710
MS		 2649 if (unlink(p) < 0)
2650 return log_error_errno(errno, "Failed to remove symlink %s: %m", p);
57fb9fb5
LP		 2651 } else if (r == -EINVAL) {
2652
2653 if (arg_link_journal == LINK_GUEST &&
2654 rmdir(p) < 0) {
2655
27407a01
ZJS		 2656 if (errno == ENOTDIR) {
2657 log_error("%s already exists and is neither a symlink nor a directory", p);
2658 return r;
4314d33f
MS		 2659 } else
2660 return log_error_errno(errno, "Failed to remove %s: %m", p);
57fb9fb5 2661 }
4314d33f
MS		 2662 } else if (r != -ENOENT)
2663 return log_error_errno(r, "readlink(%s) failed: %m", p);
57fb9fb5
LP		 2664
2665 if (arg_link_journal == LINK_GUEST) {
2666
2667 if (symlink(q, p) < 0) {
8054d749 2668 if (try) {
56f64d95 2669 log_debug_errno(errno, "Failed to symlink %s to %s, skipping journal setup: %m", q, p);
574edc90 2670 return 0;
4314d33f
MS		 2671 } else
2672 return log_error_errno(errno, "Failed to symlink %s to %s: %m", q, p);
57fb9fb5
LP		 2673 }
2674
03cfe0d5 2675 r = userns_mkdir(directory, p, 0755, 0, 0);
27407a01 2676 if (r < 0)
709f6e46 2677 log_warning_errno(r, "Failed to create directory %s: %m", q);
27407a01 2678 return 0;
57fb9fb5
LP		 2679 }
2680
2681 if (arg_link_journal == LINK_HOST) {
ccddd104 2682 /* don't create parents here — if the host doesn't have
574edc90 2683 * permanent journal set up, don't force it here */
ba8e6c4d 2684
3f692e2e 2685 r = RET_NERRNO(mkdir(p, 0755));
dae8b82e 2686 if (r < 0 && r != -EEXIST) {
8054d749 2687 if (try) {
dae8b82e 2688 log_debug_errno(r, "Failed to create %s, skipping journal setup: %m", p);
574edc90 2689 return 0;
4314d33f 2690 } else
dae8b82e 2691 return log_error_errno(r, "Failed to create %s: %m", p);
57fb9fb5
LP		 2692 }
2693
27407a01
ZJS		 2694 } else if (access(p, F_OK) < 0)
2695 return 0;
57fb9fb5 2696
db55bbf2 2697 if (dir_is_empty(q, /* ignore_hidden_or_backup= */ false) == 0)
cdb2b9d0
LP		 2698 log_warning("%s is not empty, proceeding anyway.", q);
2699
03cfe0d5 2700 r = userns_mkdir(directory, p, 0755, 0, 0);
709f6e46
MS		 2701 if (r < 0)
2702 return log_error_errno(r, "Failed to create %s: %m", q);
57fb9fb5 2703
511a8cfe 2704 r = mount_nofollow_verbose(LOG_DEBUG, p, q, NULL, MS_BIND, NULL);
60e76d48 2705 if (r < 0)
4a62c710 2706 return log_error_errno(errno, "Failed to bind mount journal from host into guest: %m");
57fb9fb5 2707
27407a01 2708 return 0;
57fb9fb5
LP		 2709}
2710
de40a303
LP		 2711static int drop_capabilities(uid_t uid) {
2712 CapabilityQuintet q;
2713
2714 /* Let's initialize all five capability sets to something valid. If the quintet was configured via
2715 * OCI use that, but fill in missing bits. If it wasn't then derive the quintet in full from
2716 * arg_caps_retain. */
2717
2718 if (capability_quintet_is_set(&arg_full_capabilities)) {
2719 q = arg_full_capabilities;
2720
f5fbe71d 2721 if (q.bounding == UINT64_MAX)
de40a303
LP		 2722 q.bounding = uid == 0 ? arg_caps_retain : 0;
2723
f5fbe71d 2724 if (q.effective == UINT64_MAX)
de40a303
LP		 2725 q.effective = uid == 0 ? q.bounding : 0;
2726
f5fbe71d 2727 if (q.inheritable == UINT64_MAX)
88fc9c9b 2728 q.inheritable = uid == 0 ? q.bounding : arg_caps_ambient;
de40a303 2729
f5fbe71d 2730 if (q.permitted == UINT64_MAX)
88fc9c9b 2731 q.permitted = uid == 0 ? q.bounding : arg_caps_ambient;
de40a303 2732
f5fbe71d 2733 if (q.ambient == UINT64_MAX && ambient_capabilities_supported())
88fc9c9b 2734 q.ambient = arg_caps_ambient;
f66ad460
AZ		 2735
2736 if (capability_quintet_mangle(&q))
2737 return log_error_errno(SYNTHETIC_ERRNO(EPERM), "Cannot set capabilities that are not in the current bounding set.");
2738
2739 } else {
de40a303
LP		 2740 q = (CapabilityQuintet) {
2741 .bounding = arg_caps_retain,
2742 .effective = uid == 0 ? arg_caps_retain : 0,
88fc9c9b
TH		 2743 .inheritable = uid == 0 ? arg_caps_retain : arg_caps_ambient,
2744 .permitted = uid == 0 ? arg_caps_retain : arg_caps_ambient,
f5fbe71d 2745 .ambient = ambient_capabilities_supported() ? arg_caps_ambient : UINT64_MAX,
de40a303
LP		 2746 };
2747
f66ad460
AZ		 2748 /* If we're not using OCI, proceed with mangled capabilities (so we don't error out)
2749 * in order to maintain the same behavior as systemd < 242. */
2750 if (capability_quintet_mangle(&q))
0ccdaa79
JT		 2751 log_full(arg_quiet ? LOG_DEBUG : LOG_WARNING,
2752 "Some capabilities will not be set because they are not in the current bounding set.");
f66ad460
AZ		 2753
2754 }
2755
de40a303 2756 return capability_quintet_enforce(&q);
88213476
LP		 2757}
2758
db999e0f
LP		 2759static int reset_audit_loginuid(void) {
2760 _cleanup_free_ char *p = NULL;
2761 int r;
2762
0c582db0 2763 if ((arg_clone_ns_flags & CLONE_NEWPID) == 0)
db999e0f
LP		 2764 return 0;
2765
2766 r = read_one_line_file("/proc/self/loginuid", &p);
13e8ceb8 2767 if (r == -ENOENT)
db999e0f 2768 return 0;
f647962d
MS		 2769 if (r < 0)
2770 return log_error_errno(r, "Failed to read /proc/self/loginuid: %m");
db999e0f
LP		 2771
2772 /* Already reset? */
2773 if (streq(p, "4294967295"))
2774 return 0;
2775
57512c89 2776 r = write_string_file("/proc/self/loginuid", "4294967295", WRITE_STRING_FILE_DISABLE_BUFFER);
db999e0f 2777 if (r < 0) {
10a87006
LP		 2778 log_error_errno(r,
2779 "Failed to reset audit login UID. This probably means that your kernel is too\n"
2780 "old and you have audit enabled. Note that the auditing subsystem is known to\n"
2781 "be incompatible with containers on old kernels. Please make sure to upgrade\n"
2782 "your kernel or to off auditing with 'audit=0' on the kernel command line before\n"
2783 "using systemd-nspawn. Sleeping for 5s... (%m)");
77b6e194 2784
db999e0f 2785 sleep(5);
77b6e194 2786 }
db999e0f
LP		 2787
2788 return 0;
77b6e194
LP		 2789}
2790
e79581dd 2791static int mount_tunnel_dig(const char *root) {
785890ac 2792 const char *p, *q;
709f6e46 2793 int r;
785890ac
LP		 2794
2795 (void) mkdir_p("/run/systemd/nspawn/", 0755);
2796 (void) mkdir_p("/run/systemd/nspawn/propagate", 0600);
63c372cb 2797 p = strjoina("/run/systemd/nspawn/propagate/", arg_machine);
785890ac
LP		 2798 (void) mkdir_p(p, 0600);
2799
5a27b395 2800 r = userns_mkdir(root, "/run/host", 0755, 0, 0);
709f6e46 2801 if (r < 0)
5a27b395 2802 return log_error_errno(r, "Failed to create /run/host: %m");
03cfe0d5 2803
e79581dd 2804 r = userns_mkdir(root, NSPAWN_MOUNT_TUNNEL, 0600, 0, 0);
709f6e46 2805 if (r < 0)
e79581dd 2806 return log_error_errno(r, "Failed to create "NSPAWN_MOUNT_TUNNEL": %m");
03cfe0d5 2807
e79581dd 2808 q = prefix_roota(root, NSPAWN_MOUNT_TUNNEL);
511a8cfe 2809 r = mount_nofollow_verbose(LOG_ERR, p, q, NULL, MS_BIND, NULL);
60e76d48
ZJS		 2810 if (r < 0)
2811 return r;
785890ac 2812
511a8cfe 2813 r = mount_nofollow_verbose(LOG_ERR, NULL, q, NULL, MS_BIND|MS_REMOUNT|MS_RDONLY, NULL);
60e76d48
ZJS		 2814 if (r < 0)
2815 return r;
785890ac 2816
e79581dd
CB		 2817 return 0;
2818}
2819
2820static int mount_tunnel_open(void) {
2821 int r;
2822
2823 r = mount_follow_verbose(LOG_ERR, NULL, NSPAWN_MOUNT_TUNNEL, NULL, MS_SLAVE, NULL);
2824 if (r < 0)
2825 return r;
2826
2827 return 0;
785890ac
LP		 2828}
2829
317feb4d 2830static int setup_machine_id(const char *directory) {
691675ba
LP		 2831 const char *etc_machine_id;
2832 sd_id128_t id;
3bbaff3e 2833 int r;
e01ff70a 2834
317feb4d
LP		 2835 /* If the UUID in the container is already set, then that's what counts, and we use. If it isn't set, and the
2836 * caller passed --uuid=, then we'll pass it in the $container_uuid env var to PID 1 of the container. The
2837 * assumption is that PID 1 will then write it to /etc/machine-id to make it persistent. If --uuid= is not
2838 * passed we generate a random UUID, and pass it via $container_uuid. In effect this means that /etc/machine-id
2839 * in the container and our idea of the container UUID will always be in sync (at least if PID 1 in the
2840 * container behaves nicely). */
2841
e01ff70a
MS		 2842 etc_machine_id = prefix_roota(directory, "/etc/machine-id");
2843
057bf780 2844 r = id128_read(etc_machine_id, ID128_FORMAT_PLAIN, &id);
317feb4d 2845 if (r < 0) {
74e795ee 2846 if (!ERRNO_IS_MACHINE_ID_UNSET(r)) /* If the file is missing, empty, or uninitialized, we don't mind */
317feb4d 2847 return log_error_errno(r, "Failed to read machine ID from container image: %m");
691675ba 2848
317feb4d
LP		 2849 if (sd_id128_is_null(arg_uuid)) {
2850 r = sd_id128_randomize(&arg_uuid);
2851 if (r < 0)
2852 return log_error_errno(r, "Failed to acquire randomized machine UUID: %m");
2853 }
2854 } else {
baaa35ad
ZJS		 2855 if (sd_id128_is_null(id))
2856 return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
2857 "Machine ID in container image is zero, refusing.");
e01ff70a 2858
317feb4d
LP		 2859 arg_uuid = id;
2860 }
691675ba 2861
e01ff70a
MS		 2862 return 0;
2863}
2864
7336138e
LP		 2865static int recursive_chown(const char *directory, uid_t shift, uid_t range) {
2866 int r;
2867
2868 assert(directory);
2869
6c045a99 2870 if (arg_userns_mode == USER_NAMESPACE_NO || arg_userns_ownership != USER_NAMESPACE_OWNERSHIP_CHOWN)
7336138e
LP		 2871 return 0;
2872
2873 r = path_patch_uid(directory, arg_uid_shift, arg_uid_range);
2874 if (r == -EOPNOTSUPP)
2875 return log_error_errno(r, "Automatic UID/GID adjusting is only supported for UID/GID ranges starting at multiples of 2^16 with a range of 2^16.");
2876 if (r == -EBADE)
2877 return log_error_errno(r, "Upper 16 bits of root directory UID and GID do not match.");
2878 if (r < 0)
2879 return log_error_errno(r, "Failed to adjust UID/GID shift of OS tree: %m");
2880 if (r == 0)
2881 log_debug("Root directory of image is already owned by the right UID/GID range, skipping recursive chown operation.");
2882 else
2883 log_debug("Patched directory tree to match UID/GID range.");
2884
2885 return r;
2886}
2887
113cea80 2888/*
6d416b9c
LS		 2889 * Return values:
2890 * < 0 : wait_for_terminate() failed to get the state of the
2891 * container, the container was terminated by a signal, or
2892 * failed for an unknown reason. No change is made to the
2893 * container argument.
2894 * > 0 : The program executed in the container terminated with an
2895 * error. The exit code of the program executed in the
919699ec
LP		 2896 * container is returned. The container argument has been set
2897 * to CONTAINER_TERMINATED.
6d416b9c
LS		 2898 * 0 : The container is being rebooted, has been shut down or exited
2899 * successfully. The container argument has been set to either
2900 * CONTAINER_TERMINATED or CONTAINER_REBOOTED.
113cea80 2901 *
6d416b9c
LS		 2902 * That is, success is indicated by a return value of zero, and an
2903 * error is indicated by a non-zero value.
113cea80
DH		 2904 */
2905static int wait_for_container(pid_t pid, ContainerStatus *container) {
113cea80 2906 siginfo_t status;
919699ec 2907 int r;
113cea80
DH		 2908
2909 r = wait_for_terminate(pid, &status);
f647962d
MS		 2910 if (r < 0)
2911 return log_warning_errno(r, "Failed to wait for container: %m");
113cea80
DH		 2912
2913 switch (status.si_code) {
fddbb89c 2914
113cea80 2915 case CLD_EXITED:
b5a2179b 2916 if (status.si_status == 0)
919699ec 2917 log_full(arg_quiet ? LOG_DEBUG : LOG_INFO, "Container %s exited successfully.", arg_machine);
b5a2179b 2918 else
919699ec 2919 log_full(arg_quiet ? LOG_DEBUG : LOG_INFO, "Container %s failed with error code %i.", arg_machine, status.si_status);
fddbb89c 2920
919699ec
LP		 2921 *container = CONTAINER_TERMINATED;
2922 return status.si_status;
113cea80
DH		 2923
2924 case CLD_KILLED:
2925 if (status.si_status == SIGINT) {
919699ec 2926 log_full(arg_quiet ? LOG_DEBUG : LOG_INFO, "Container %s has been shut down.", arg_machine);
113cea80 2927 *container = CONTAINER_TERMINATED;
919699ec
LP		 2928 return 0;
2929
113cea80 2930 } else if (status.si_status == SIGHUP) {
919699ec 2931 log_full(arg_quiet ? LOG_DEBUG : LOG_INFO, "Container %s is being rebooted.", arg_machine);
113cea80 2932 *container = CONTAINER_REBOOTED;
919699ec 2933 return 0;
113cea80 2934 }
919699ec 2935
4831981d 2936 _fallthrough_;
113cea80 2937 case CLD_DUMPED:
baaa35ad
ZJS		 2938 return log_error_errno(SYNTHETIC_ERRNO(EIO),
2939 "Container %s terminated by signal %s.", arg_machine, signal_to_string(status.si_status));
113cea80
DH		 2940
2941 default:
baaa35ad
ZJS		 2942 return log_error_errno(SYNTHETIC_ERRNO(EIO),
2943 "Container %s failed due to unknown reason.", arg_machine);
113cea80 2944 }
113cea80
DH		 2945}
2946
023fb90b
LP		 2947static int on_orderly_shutdown(sd_event_source *s, const struct signalfd_siginfo *si, void *userdata) {
2948 pid_t pid;
2949
4a0b58c4 2950 pid = PTR_TO_PID(userdata);
023fb90b 2951 if (pid > 0) {
c6c8f6e2 2952 if (kill(pid, arg_kill_signal) >= 0) {
023fb90b
LP		 2953 log_info("Trying to halt container. Send SIGTERM again to trigger immediate termination.");
2954 sd_event_source_set_userdata(s, NULL);
2955 return 0;
2956 }
2957 }
2958
2959 sd_event_exit(sd_event_source_get_event(s), 0);
2960 return 0;
2961}
2962
6916b164 2963static int on_sigchld(sd_event_source *s, const struct signalfd_siginfo *ssi, void *userdata) {
abdb9b08
LP		 2964 pid_t pid;
2965
2966 assert(s);
2967 assert(ssi);
2968
2969 pid = PTR_TO_PID(userdata);
2970
6916b164
AU		 2971 for (;;) {
2972 siginfo_t si = {};
abdb9b08 2973
6916b164
AU		 2974 if (waitid(P_ALL, 0, &si, WNOHANG|WNOWAIT|WEXITED) < 0)
2975 return log_error_errno(errno, "Failed to waitid(): %m");
2976 if (si.si_pid == 0) /* No pending children. */
2977 break;
abdb9b08 2978 if (si.si_pid == pid) {
6916b164
AU		 2979 /* The main process we care for has exited. Return from
2980 * signal handler but leave the zombie. */
2981 sd_event_exit(sd_event_source_get_event(s), 0);
2982 break;
2983 }
abdb9b08 2984
6916b164
AU		 2985 /* Reap all other children. */
2986 (void) waitid(P_PID, si.si_pid, &si, WNOHANG|WEXITED);
2987 }
2988
2989 return 0;
2990}
2991
abdb9b08
LP		 2992static int on_request_stop(sd_bus_message *m, void *userdata, sd_bus_error *error) {
2993 pid_t pid;
2994
2995 assert(m);
2996
2997 pid = PTR_TO_PID(userdata);
2998
2999 if (arg_kill_signal > 0) {
3000 log_info("Container termination requested. Attempting to halt container.");
3001 (void) kill(pid, arg_kill_signal);
3002 } else {
3003 log_info("Container termination requested. Exiting.");
3004 sd_event_exit(sd_bus_get_event(sd_bus_message_get_bus(m)), 0);
3005 }
3006
3007 return 0;
3008}
3009
ec16945e 3010static int determine_names(void) {
1b9cebf6 3011 int r;
ec16945e 3012
c1521918
LP		 3013 if (arg_template && !arg_directory && arg_machine) {
3014
3015 /* If --template= was specified then we should not
3016 * search for a machine, but instead create a new one
3017 * in /var/lib/machine. */
3018
657ee2d8 3019 arg_directory = path_join("/var/lib/machines", arg_machine);
c1521918
LP		 3020 if (!arg_directory)
3021 return log_oom();
3022 }
3023
ec16945e 3024 if (!arg_image && !arg_directory) {
1b9cebf6
LP		 3025 if (arg_machine) {
3026 _cleanup_(image_unrefp) Image *i = NULL;
3027
d577d4a4 3028 r = image_find(IMAGE_MACHINE, arg_machine, NULL, &i);
3a6ce860
LP		 3029 if (r == -ENOENT)
3030 return log_error_errno(r, "No image for machine '%s'.", arg_machine);
1b9cebf6
LP		 3031 if (r < 0)
3032 return log_error_errno(r, "Failed to find image for machine '%s': %m", arg_machine);
1b9cebf6 3033
eb38edce 3034 if (IN_SET(i->type, IMAGE_RAW, IMAGE_BLOCK))
0f03c2a4 3035 r = free_and_strdup(&arg_image, i->path);
1b9cebf6 3036 else
0f03c2a4 3037 r = free_and_strdup(&arg_directory, i->path);
1b9cebf6 3038 if (r < 0)
0f3be6ca 3039 return log_oom();
1b9cebf6 3040
aee327b8
LP		 3041 if (!arg_ephemeral)
3042 arg_read_only = arg_read_only || i->read_only;
d7249575
LP		 3043 } else {
3044 r = safe_getcwd(&arg_directory);
3045 if (r < 0)
3046 return log_error_errno(r, "Failed to determine current directory: %m");
3047 }
ec16945e 3048
c6147113
LP		 3049 if (!arg_directory && !arg_image)
3050 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Failed to determine path, please use -D or -i.");
ec16945e
LP		 3051 }
3052
3053 if (!arg_machine) {
b9ba4dab
LP		 3054 if (arg_directory && path_equal(arg_directory, "/"))
3055 arg_machine = gethostname_malloc();
e9b88a6d
LP		 3056 else if (arg_image) {
3057 char *e;
4827ab48 3058
b36e39d2
LP		 3059 r = path_extract_filename(arg_image, &arg_machine);
3060 if (r < 0)
3061 return log_error_errno(r, "Failed to extract file name from '%s': %m", arg_image);
4827ab48 3062
e9b88a6d
LP		 3063 /* Truncate suffix if there is one */
3064 e = endswith(arg_machine, ".raw");
3065 if (e)
3066 *e = 0;
b36e39d2
LP		 3067 } else {
3068 r = path_extract_filename(arg_directory, &arg_machine);
3069 if (r < 0)
3070 return log_error_errno(r, "Failed to extract file name from '%s': %m", arg_directory);
3071 }
ec16945e 3072
ae691c1d 3073 hostname_cleanup(arg_machine);
52ef5dd7 3074 if (!hostname_is_valid(arg_machine, 0))
c6147113 3075 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Failed to determine machine name automatically, please use -M.");
b9ba4dab 3076
3603f151
LB		 3077 /* Copy the machine name before the random suffix is added below, otherwise we won't be able
3078 * to match fixed config file names. */
3079 arg_settings_filename = strjoin(arg_machine, ".nspawn");
3080 if (!arg_settings_filename)
3081 return log_oom();
3082
e9b88a6d
LP		 3083 /* Add a random suffix when this is an ephemeral machine, so that we can run many
3084 * instances at once without manually having to specify -M each time. */
3085 if (arg_ephemeral)
3086 if (strextendf(&arg_machine, "-%016" PRIx64, random_u64()) < 0)
b9ba4dab 3087 return log_oom();
3603f151
LB		 3088 } else {
3089 arg_settings_filename = strjoin(arg_machine, ".nspawn");
3090 if (!arg_settings_filename)
3091 return log_oom();
ec16945e
LP		 3092 }
3093
3094 return 0;
3095}
3096
8d4aa2bb 3097static int chase_symlinks_and_update(char **p, unsigned flags) {
3f342ec4
LP		 3098 char *chased;
3099 int r;
3100
3101 assert(p);
3102
3103 if (!*p)
3104 return 0;
3105
a5648b80 3106 r = chase_symlinks(*p, NULL, flags, &chased, NULL);
3f342ec4
LP		 3107 if (r < 0)
3108 return log_error_errno(r, "Failed to resolve path %s: %m", *p);
3109
a5648b80 3110 return free_and_replace(*p, chased);
3f342ec4
LP		 3111}
3112
03cfe0d5 3113static int determine_uid_shift(const char *directory) {
6dac160c 3114
0de7acce 3115 if (arg_userns_mode == USER_NAMESPACE_NO) {
03cfe0d5 3116 arg_uid_shift = 0;
6dac160c 3117 return 0;
03cfe0d5 3118 }
6dac160c
LP		 3119
3120 if (arg_uid_shift == UID_INVALID) {
3121 struct stat st;
3122
993da6d4
LP		 3123 /* Read the UID shift off the image. Maybe we can reuse this to avoid chowning. */
3124
3125 if (stat(directory, &st) < 0)
03cfe0d5 3126 return log_error_errno(errno, "Failed to determine UID base of %s: %m", directory);
6dac160c
LP		 3127
3128 arg_uid_shift = st.st_uid & UINT32_C(0xffff0000);
3129
baaa35ad
ZJS		 3130 if (arg_uid_shift != (st.st_gid & UINT32_C(0xffff0000)))
3131 return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
3132 "UID and GID base of %s don't match.", directory);
6dac160c
LP		 3133
3134 arg_uid_range = UINT32_C(0x10000);
f61c7f88
LP		 3135
3136 if (arg_uid_shift != 0) {
3137 /* If the image is shifted already, then we'll fall back to classic chowning, for
3138 * compatibility (and simplicity), or refuse if mapping is explicitly requested. */
3139
3140 if (arg_userns_ownership == USER_NAMESPACE_OWNERSHIP_AUTO) {
3141 log_debug("UID base of %s is non-zero, not using UID mapping.", directory);
3142 arg_userns_ownership = USER_NAMESPACE_OWNERSHIP_CHOWN;
3143 } else if (arg_userns_ownership == USER_NAMESPACE_OWNERSHIP_MAP)
3144 return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
3145 "UID base of %s is not zero, UID mapping not supported.", directory);
3146 }
6dac160c
LP		 3147 }
3148
58e13de5
LP		 3149 if (!userns_shift_range_valid(arg_uid_shift, arg_uid_range))
3150 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "UID base too high for UID range.");
6dac160c 3151
6dac160c
LP		 3152 return 0;
3153}
3154
de40a303
LP		 3155static unsigned long effective_clone_ns_flags(void) {
3156 unsigned long flags = arg_clone_ns_flags;
3157
3158 if (arg_private_network)
3159 flags |= CLONE_NEWNET;
3160 if (arg_use_cgns)
3161 flags |= CLONE_NEWCGROUP;
3162 if (arg_userns_mode != USER_NAMESPACE_NO)
3163 flags |= CLONE_NEWUSER;
3164
3165 return flags;
3166}
3167
3168static int patch_sysctl(void) {
3169
3170 /* This table is inspired by runc's sysctl() function */
3171 static const struct {
3172 const char *key;
3173 bool prefix;
3174 unsigned long clone_flags;
3175 } safe_sysctl[] = {
3176 { "kernel.hostname", false, CLONE_NEWUTS },
3177 { "kernel.domainname", false, CLONE_NEWUTS },
3178 { "kernel.msgmax", false, CLONE_NEWIPC },
3179 { "kernel.msgmnb", false, CLONE_NEWIPC },
3180 { "kernel.msgmni", false, CLONE_NEWIPC },
3181 { "kernel.sem", false, CLONE_NEWIPC },
3182 { "kernel.shmall", false, CLONE_NEWIPC },
3183 { "kernel.shmmax", false, CLONE_NEWIPC },
3184 { "kernel.shmmni", false, CLONE_NEWIPC },
3185 { "fs.mqueue.", true, CLONE_NEWIPC },
3186 { "net.", true, CLONE_NEWNET },
3187 };
3188
3189 unsigned long flags;
de40a303
LP		 3190 int r;
3191
3192 flags = effective_clone_ns_flags();
3193
3194 STRV_FOREACH_PAIR(k, v, arg_sysctl) {
3195 bool good = false;
3196 size_t i;
3197
3198 for (i = 0; i < ELEMENTSOF(safe_sysctl); i++) {
3199
3200 if (!FLAGS_SET(flags, safe_sysctl[i].clone_flags))
3201 continue;
3202
3203 if (safe_sysctl[i].prefix)
3204 good = startswith(*k, safe_sysctl[i].key);
3205 else
3206 good = streq(*k, safe_sysctl[i].key);
3207
3208 if (good)
3209 break;
3210 }
3211
c6147113
LP		 3212 if (!good)
3213 return log_error_errno(SYNTHETIC_ERRNO(EPERM), "Refusing to write to sysctl '%s', as it is not safe in the selected namespaces.", *k);
de40a303
LP		 3214
3215 r = sysctl_write(*k, *v);
3216 if (r < 0)
3217 return log_error_errno(r, "Failed to write sysctl '%s': %m", *k);
3218 }
3219
3220 return 0;
3221}
3222
03cfe0d5
LP		 3223static int inner_child(
3224 Barrier *barrier,
5d9d3fcb 3225 int fd_inner_socket,
e1bb4b0d
LB		 3226 FDSet *fds,
3227 char **os_release_pairs) {
69c79d3c 3228
03cfe0d5 3229 _cleanup_free_ char *home = NULL;
88614c8a 3230 size_t n_env = 1;
4ab3d29f
ZJS		 3231 char *envp[] = {
3232 (char*) "PATH=" DEFAULT_PATH_COMPAT,
6aadfa4c 3233 NULL, /* container */
03cfe0d5
LP		 3234 NULL, /* TERM */
3235 NULL, /* HOME */
3236 NULL, /* USER */
3237 NULL, /* LOGNAME */
3238 NULL, /* container_uuid */
3239 NULL, /* LISTEN_FDS */
3240 NULL, /* LISTEN_PID */
9c1e04d0 3241 NULL, /* NOTIFY_SOCKET */
3652872a 3242 NULL, /* CREDENTIALS_DIRECTORY */
b626f695 3243 NULL, /* LANG */
03cfe0d5
LP		 3244 NULL
3245 };
1a68e1e5 3246 const char *exec_target;
2371271c 3247 _cleanup_strv_free_ char **env_use = NULL;
de40a303 3248 int r, which_failed;
88213476 3249
b37469d7
LP		 3250 /* This is the "inner" child process, i.e. the one forked off by the "outer" child process, which is the one
3251 * the container manager itself forked off. At the time of clone() it gained its own CLONE_NEWNS, CLONE_NEWPID,
3252 * CLONE_NEWUTS, CLONE_NEWIPC, CLONE_NEWUSER namespaces. Note that it has its own CLONE_NEWNS namespace,
3253 * separate from the CLONE_NEWNS created for the "outer" child, and also separate from the host's CLONE_NEWNS
3254 * namespace. The reason for having two levels of CLONE_NEWNS namespaces is that the "inner" one is owned by
3255 * the CLONE_NEWUSER namespace of the container, while the "outer" one is owned by the host's CLONE_NEWUSER
3256 * namespace.
3257 *
3258 * Note at this point we have no CLONE_NEWNET namespace yet. We'll acquire that one later through
3259 * unshare(). See below. */
3260
03cfe0d5 3261 assert(barrier);
5d9d3fcb 3262 assert(fd_inner_socket >= 0);
88213476 3263
de40a303
LP		 3264 log_debug("Inner child is initializing.");
3265
0de7acce 3266 if (arg_userns_mode != USER_NAMESPACE_NO) {
03cfe0d5
LP		 3267 /* Tell the parent, that it now can write the UID map. */
3268 (void) barrier_place(barrier); /* #1 */
7027ff61 3269
03cfe0d5 3270 /* Wait until the parent wrote the UID map */
baaa35ad 3271 if (!barrier_place_and_sync(barrier)) /* #2 */
2a2e78e9 3272 return log_error_errno(SYNTHETIC_ERRNO(ESRCH), "Parent died too early");
88213476 3273
2a2e78e9
LP		 3274 /* Become the new root user inside our namespace */
3275 r = reset_uid_gid();
3276 if (r < 0)
3277 return log_error_errno(r, "Couldn't become new root: %m");
3278
3279 /* Creating a new user namespace means all MS_SHARED mounts become MS_SLAVE. Let's put them
3280 * back to MS_SHARED here, since that's what we want as defaults. (This will not reconnect
3281 * propagation, but simply create new peer groups for all our mounts). */
511a8cfe 3282 r = mount_follow_verbose(LOG_ERR, NULL, "/", NULL, MS_SHARED|MS_REC, NULL);
2a2e78e9
LP		 3283 if (r < 0)
3284 return r;
3285 }
6d66bd3b 3286
0de7acce 3287 r = mount_all(NULL,
4f086aab 3288 arg_mount_settings | MOUNT_IN_USERNS,
0de7acce 3289 arg_uid_shift,
0de7acce 3290 arg_selinux_apifs_context);
03cfe0d5
LP		 3291 if (r < 0)
3292 return r;
3293
04413780
ZJS		 3294 if (!arg_network_namespace_path && arg_private_network) {
3295 r = unshare(CLONE_NEWNET);
3296 if (r < 0)
3297 return log_error_errno(errno, "Failed to unshare network namespace: %m");
75116558
PS		 3298
3299 /* Tell the parent that it can setup network interfaces. */
3300 (void) barrier_place(barrier); /* #3 */
04413780
ZJS		 3301 }
3302
4f086aab 3303 r = mount_sysfs(NULL, arg_mount_settings);
d8fc6a00
LP		 3304 if (r < 0)
3305 return r;
3306
03cfe0d5
LP		 3307 /* Wait until we are cgroup-ified, so that we
3308 * can mount the right cgroup path writable */
baaa35ad
ZJS		 3309 if (!barrier_place_and_sync(barrier)) /* #4 */
3310 return log_error_errno(SYNTHETIC_ERRNO(ESRCH),
3311 "Parent died too early");
88213476 3312
489fae52 3313 if (arg_use_cgns) {
0996ef00
CB		 3314 r = unshare(CLONE_NEWCGROUP);
3315 if (r < 0)
04413780 3316 return log_error_errno(errno, "Failed to unshare cgroup namespace: %m");
0996ef00
CB		 3317 r = mount_cgroups(
3318 "",
3319 arg_unified_cgroup_hierarchy,
3320 arg_userns_mode != USER_NAMESPACE_NO,
3321 arg_uid_shift,
3322 arg_uid_range,
5a8ff0e6 3323 arg_selinux_apifs_context,
ada54120 3324 true);
1433e0f2 3325 } else
0996ef00 3326 r = mount_systemd_cgroup_writable("", arg_unified_cgroup_hierarchy);
1433e0f2
LP		 3327 if (r < 0)
3328 return r;
ec16945e 3329
1e4f1671 3330 r = setup_boot_id();
03cfe0d5
LP		 3331 if (r < 0)
3332 return r;
ec16945e 3333
5d9d3fcb 3334 r = setup_kmsg(fd_inner_socket);
03cfe0d5
LP		 3335 if (r < 0)
3336 return r;
ec16945e 3337
de40a303
LP		 3338 r = mount_custom(
3339 "/",
3340 arg_custom_mounts,
3341 arg_n_custom_mounts,
de40a303 3342 0,
c0c8f718 3343 0,
de40a303 3344 arg_selinux_apifs_context,
5f0a6347 3345 MOUNT_NON_ROOT_ONLY | MOUNT_IN_USERNS);
de40a303
LP		 3346 if (r < 0)
3347 return r;
3348
03cfe0d5
LP		 3349 if (setsid() < 0)
3350 return log_error_errno(errno, "setsid() failed: %m");
3351
3352 if (arg_private_network)
df883de9 3353 (void) loopback_setup();
03cfe0d5 3354
7a8f6325 3355 if (arg_expose_ports) {
b07ee903 3356 r = expose_port_send_rtnl(fd_inner_socket);
7a8f6325
LP		 3357 if (r < 0)
3358 return r;
7a8f6325 3359 }
03cfe0d5 3360
3acc84eb 3361 if (arg_console_mode != CONSOLE_PIPE) {
5bb1d7fb 3362 _cleanup_close_ int master = -EBADF;
3acc84eb
FB		 3363 _cleanup_free_ char *console = NULL;
3364
3365 /* Allocate a pty and make it available as /dev/console. */
dc98caea 3366 master = openpt_allocate(O_RDWR|O_NONBLOCK, &console);
3acc84eb 3367 if (master < 0)
dc98caea 3368 return log_error_errno(master, "Failed to allocate a pty: %m");
3acc84eb
FB		 3369
3370 r = setup_dev_console(console);
3371 if (r < 0)
105a1a36 3372 return log_error_errno(r, "Failed to set up /dev/console: %m");
3acc84eb 3373
bb1aa185 3374 r = send_one_fd(fd_inner_socket, master, 0);
3acc84eb
FB		 3375 if (r < 0)
3376 return log_error_errno(r, "Failed to send master fd: %m");
3acc84eb
FB		 3377
3378 r = setup_stdio_as_dev_console();
3379 if (r < 0)
3380 return r;
3381 }
3382
de40a303
LP		 3383 r = patch_sysctl();
3384 if (r < 0)
3385 return r;
3386
81f345df
LP		 3387 if (arg_oom_score_adjust_set) {
3388 r = set_oom_score_adjust(arg_oom_score_adjust);
3389 if (r < 0)
3390 return log_error_errno(r, "Failed to adjust OOM score: %m");
3391 }
3392
0985c7c4
ZJS		 3393 if (arg_cpu_set.set)
3394 if (sched_setaffinity(0, arg_cpu_set.allocated, arg_cpu_set.set) < 0)
d107bb7d
LP		 3395 return log_error_errno(errno, "Failed to set CPU affinity: %m");
3396
c818eef1 3397 (void) setup_hostname();
03cfe0d5 3398
050f7277 3399 if (arg_personality != PERSONALITY_INVALID) {
21022b9d
LP		 3400 r = safe_personality(arg_personality);
3401 if (r < 0)
3402 return log_error_errno(r, "personality() failed: %m");
4c27749b
LP		 3403#ifdef ARCHITECTURE_SECONDARY
3404 } else if (arg_architecture == ARCHITECTURE_SECONDARY) {
21022b9d
LP		 3405 r = safe_personality(PER_LINUX32);
3406 if (r < 0)
3407 return log_error_errno(r, "personality() failed: %m");
4c27749b
LP		 3408#endif
3409 } else if (arg_architecture >= 0 && arg_architecture != native_architecture())
3410 return log_error_errno(SYNTHETIC_ERRNO(EOPNOTSUPP),
3411 "Selected architecture '%s' not supported locally, refusing.",
3412 architecture_to_string(arg_architecture));
03cfe0d5 3413
de40a303
LP		 3414 r = setrlimit_closest_all((const struct rlimit *const*) arg_rlimit, &which_failed);
3415 if (r < 0)
3416 return log_error_errno(r, "Failed to apply resource limit RLIMIT_%s: %m", rlimit_to_string(which_failed));
3417
3418#if HAVE_SECCOMP
3419 if (arg_seccomp) {
3420
3421 if (is_seccomp_available()) {
3422
3423 r = seccomp_load(arg_seccomp);
7bc5e0b1 3424 if (ERRNO_IS_SECCOMP_FATAL(r))
de40a303
LP		 3425 return log_error_errno(r, "Failed to install seccomp filter: %m");
3426 if (r < 0)
3427 log_debug_errno(r, "Failed to install seccomp filter: %m");
3428 }
3429 } else
3430#endif
3431 {
6b000af4 3432 r = setup_seccomp(arg_caps_retain, arg_syscall_allow_list, arg_syscall_deny_list);
de40a303
LP		 3433 if (r < 0)
3434 return r;
3435 }
3436
4a4654e0 3437 if (arg_suppress_sync) {
20e458ae 3438#if HAVE_SECCOMP
4a4654e0
LP		 3439 r = seccomp_suppress_sync();
3440 if (r < 0)
3441 log_debug_errno(r, "Failed to install sync() suppression seccomp filter, ignoring: %m");
20e458ae 3442#else
2db32618 3443 log_debug("systemd is built without SECCOMP support. Ignoring --suppress-sync= command line option and SuppressSync= setting.");
20e458ae 3444#endif
4a4654e0
LP		 3445 }
3446
349cc4a5 3447#if HAVE_SELINUX
03cfe0d5 3448 if (arg_selinux_context)
2ed96880 3449 if (setexeccon(arg_selinux_context) < 0)
03cfe0d5
LP		 3450 return log_error_errno(errno, "setexeccon(\"%s\") failed: %m", arg_selinux_context);
3451#endif
3452
de40a303
LP		 3453 /* Make sure we keep the caps across the uid/gid dropping, so that we can retain some selected caps
3454 * if we need to later on. */
3455 if (prctl(PR_SET_KEEPCAPS, 1) < 0)
3456 return log_error_errno(errno, "Failed to set PR_SET_KEEPCAPS: %m");
3457
3458 if (uid_is_valid(arg_uid) || gid_is_valid(arg_gid))
3462d773 3459 r = change_uid_gid_raw(arg_uid, arg_gid, arg_supplementary_gids, arg_n_supplementary_gids, arg_console_mode != CONSOLE_PIPE);
de40a303 3460 else
3462d773 3461 r = change_uid_gid(arg_user, arg_console_mode != CONSOLE_PIPE, &home);
03cfe0d5
LP		 3462 if (r < 0)
3463 return r;
3464
de40a303
LP		 3465 r = drop_capabilities(getuid());
3466 if (r < 0)
3467 return log_error_errno(r, "Dropping capabilities failed: %m");
3468
66edd963
LP		 3469 if (arg_no_new_privileges)
3470 if (prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0) < 0)
3471 return log_error_errno(errno, "Failed to disable new privileges: %m");
3472
6aadfa4c
ILG		 3473 /* LXC sets container=lxc, so follow the scheme here */
3474 envp[n_env++] = strjoina("container=", arg_container_service_name);
3475
03cfe0d5
LP		 3476 envp[n_env] = strv_find_prefix(environ, "TERM=");
3477 if (envp[n_env])
313cefa1 3478 n_env++;
03cfe0d5 3479
de40a303 3480 if (home || !uid_is_valid(arg_uid) || arg_uid == 0)
4ab3d29f 3481 if (asprintf(envp + n_env++, "HOME=%s", home ?: "/root") < 0)
de40a303
LP		 3482 return log_oom();
3483
3484 if (arg_user || !uid_is_valid(arg_uid) || arg_uid == 0)
4ab3d29f 3485 if (asprintf(envp + n_env++, "USER=%s", arg_user ?: "root") < 0 ||
1da3cb81 3486 asprintf(envp + n_env++, "LOGNAME=%s", arg_user ?: "root") < 0)
de40a303 3487 return log_oom();
03cfe0d5 3488
3bbaff3e 3489 assert(!sd_id128_is_null(arg_uuid));
03cfe0d5 3490
b7416360 3491 if (asprintf(envp + n_env++, "container_uuid=%s", SD_ID128_TO_UUID_STRING(arg_uuid)) < 0)
e01ff70a 3492 return log_oom();
03cfe0d5
LP		 3493
3494 if (fdset_size(fds) > 0) {
3495 r = fdset_cloexec(fds, false);
3496 if (r < 0)
3497 return log_error_errno(r, "Failed to unset O_CLOEXEC for file descriptors.");
3498
4ab3d29f
ZJS		 3499 if ((asprintf(envp + n_env++, "LISTEN_FDS=%u", fdset_size(fds)) < 0) ||
3500 (asprintf(envp + n_env++, "LISTEN_PID=1") < 0))
03cfe0d5
LP		 3501 return log_oom();
3502 }
4ab3d29f 3503 if (asprintf(envp + n_env++, "NOTIFY_SOCKET=%s", NSPAWN_NOTIFY_SOCKET_PATH) < 0)
9c1e04d0 3504 return log_oom();
03cfe0d5 3505
3652872a
LP		 3506 if (arg_n_credentials > 0) {
3507 envp[n_env] = strdup("CREDENTIALS_DIRECTORY=/run/host/credentials");
3508 if (!envp[n_env])
3509 return log_oom();
3510 n_env++;
3511 }
3512
b626f695 3513 if (arg_start_mode != START_BOOT) {
a22f5186 3514 envp[n_env] = strdup("LANG=" SYSTEMD_NSPAWN_LOCALE);
b626f695
DDM		 3515 if (!envp[n_env])
3516 return log_oom();
3517 n_env++;
3518 }
3519
4ab3d29f 3520 env_use = strv_env_merge(envp, os_release_pairs, arg_setenv);
2371271c
TG		 3521 if (!env_use)
3522 return log_oom();
03cfe0d5
LP		 3523
3524 /* Let the parent know that we are ready and
3525 * wait until the parent is ready with the
3526 * setup, too... */
baaa35ad 3527 if (!barrier_place_and_sync(barrier)) /* #5 */
335d2ead 3528 return log_error_errno(SYNTHETIC_ERRNO(ESRCH), "Parent died too early");
03cfe0d5 3529
5f932eb9
LP		 3530 if (arg_chdir)
3531 if (chdir(arg_chdir) < 0)
3532 return log_error_errno(errno, "Failed to change to specified working directory %s: %m", arg_chdir);
3533
7732f92b 3534 if (arg_start_mode == START_PID2) {
75bf701f 3535 r = stub_pid1(arg_uuid);
7732f92b
LP		 3536 if (r < 0)
3537 return r;
3538 }
3539
335d2ead
LP		 3540 if (arg_console_mode != CONSOLE_PIPE) {
3541 /* So far our pty wasn't controlled by any process. Finally, it's time to change that, if we
3542 * are configured for that. Acquire it as controlling tty. */
3543 if (ioctl(STDIN_FILENO, TIOCSCTTY) < 0)
3544 return log_error_errno(errno, "Failed to acquire controlling TTY: %m");
3545 }
3546
de40a303
LP		 3547 log_debug("Inner child completed, invoking payload.");
3548
8ca082b4
LP		 3549 /* Now, explicitly close the log, so that we then can close all remaining fds. Closing the log explicitly first
3550 * has the benefit that the logging subsystem knows about it, and is thus ready to be reopened should we need
3551 * it again. Note that the other fds closed here are at least the locking and barrier fds. */
03cfe0d5 3552 log_close();
8ca082b4 3553 log_set_open_when_needed(true);
a3b00f91 3554 log_settle_target();
8ca082b4 3555
03cfe0d5
LP		 3556 (void) fdset_close_others(fds);
3557
7732f92b 3558 if (arg_start_mode == START_BOOT) {
03cfe0d5
LP		 3559 char **a;
3560 size_t m;
3561
3562 /* Automatically search for the init system */
3563
75f32f04
ZJS		 3564 m = strv_length(arg_parameters);
3565 a = newa(char*, m + 2);
3566 memcpy_safe(a + 1, arg_parameters, m * sizeof(char*));
3567 a[1 + m] = NULL;
03cfe0d5 3568
a5096641
LP		 3569 FOREACH_STRING(init,
3570 "/usr/lib/systemd/systemd",
3571 "/lib/systemd/systemd",
3572 "/sbin/init") {
3573 a[0] = (char*) init;
3574 execve(a[0], a, env_use);
3575 }
ced58da7
LP		 3576
3577 exec_target = "/usr/lib/systemd/systemd, /lib/systemd/systemd, /sbin/init";
1a68e1e5 3578 } else if (!strv_isempty(arg_parameters)) {
b6b180b7
LP		 3579 const char *dollar_path;
3580
1a68e1e5 3581 exec_target = arg_parameters[0];
b6b180b7
LP		 3582
3583 /* Use the user supplied search $PATH if there is one, or DEFAULT_PATH_COMPAT if not to search the
3584 * binary. */
3585 dollar_path = strv_env_get(env_use, "PATH");
3586 if (dollar_path) {
6f646e01 3587 if (setenv("PATH", dollar_path, 1) < 0)
b6b180b7
LP		 3588 return log_error_errno(errno, "Failed to update $PATH: %m");
3589 }
3590
f757855e 3591 execvpe(arg_parameters[0], arg_parameters, env_use);
1a68e1e5 3592 } else {
5f932eb9 3593 if (!arg_chdir)
d929b0f9
ZJS		 3594 /* If we cannot change the directory, we'll end up in /, that is expected. */
3595 (void) chdir(home ?: "/root");
5f932eb9 3596
53350c7b 3597 execle(DEFAULT_USER_SHELL, "-" DEFAULT_USER_SHELL_NAME, NULL, env_use);
3598 if (!streq(DEFAULT_USER_SHELL, "/bin/bash"))
3599 execle("/bin/bash", "-bash", NULL, env_use);
3600 if (!streq(DEFAULT_USER_SHELL, "/bin/sh"))
3601 execle("/bin/sh", "-sh", NULL, env_use);
ced58da7 3602
53350c7b 3603 exec_target = DEFAULT_USER_SHELL ", /bin/bash, /bin/sh";
03cfe0d5
LP		 3604 }
3605
8ca082b4 3606 return log_error_errno(errno, "execv(%s) failed: %m", exec_target);
03cfe0d5
LP		 3607}
3608
e96ceaba 3609static int setup_notify_child(void) {
254d1313 3610 _cleanup_close_ int fd = -EBADF;
1eb874b9 3611 static const union sockaddr_union sa = {
44ed5214
LP		 3612 .un.sun_family = AF_UNIX,
3613 .un.sun_path = NSPAWN_NOTIFY_SOCKET_PATH,
9c1e04d0
AP		 3614 };
3615 int r;
3616
3617 fd = socket(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0);
3618 if (fd < 0)
3619 return log_error_errno(errno, "Failed to allocate notification socket: %m");
3620
3621 (void) mkdir_parents(NSPAWN_NOTIFY_SOCKET_PATH, 0755);
fbda85b0 3622 (void) sockaddr_un_unlink(&sa.un);
9c1e04d0 3623
9c1e04d0 3624 r = bind(fd, &sa.sa, SOCKADDR_UN_LEN(sa.un));
271f518f 3625 if (r < 0)
44ed5214 3626 return log_error_errno(errno, "bind(" NSPAWN_NOTIFY_SOCKET_PATH ") failed: %m");
9c1e04d0 3627
adc7d9f0 3628 r = userns_lchown(NSPAWN_NOTIFY_SOCKET_PATH, 0, 0);
271f518f 3629 if (r < 0)
adc7d9f0 3630 return log_error_errno(r, "Failed to chown " NSPAWN_NOTIFY_SOCKET_PATH ": %m");
adc7d9f0 3631
2ff48e98 3632 r = setsockopt_int(fd, SOL_SOCKET, SO_PASSCRED, true);
271f518f 3633 if (r < 0)
2ff48e98 3634 return log_error_errno(r, "SO_PASSCRED failed: %m");
9c1e04d0 3635
271f518f 3636 return TAKE_FD(fd);
9c1e04d0
AP		 3637}
3638
03cfe0d5
LP		 3639static int outer_child(
3640 Barrier *barrier,
3641 const char *directory,
2d845785 3642 DissectedImage *dissected_image,
af06cd30 3643 int fd_outer_socket,
5d9d3fcb 3644 int fd_inner_socket,
d7bea6b6
DP		 3645 FDSet *fds,
3646 int netns_fd) {
03cfe0d5 3647
2f893044 3648 _cleanup_(bind_user_context_freep) BindUserContext *bind_user_context = NULL;
e1bb4b0d 3649 _cleanup_strv_free_ char **os_release_pairs = NULL;
254d1313 3650 _cleanup_close_ int fd = -EBADF, mntns_fd = -EBADF;
f61c7f88 3651 bool idmap = false;
e5f10caf 3652 const char *p;
03cfe0d5
LP		 3653 pid_t pid;
3654 ssize_t l;
de40a303 3655 int r;
03cfe0d5 3656
d1d0b895
LP		 3657 /* This is the "outer" child process, i.e the one forked off by the container manager itself. It
3658 * already has its own CLONE_NEWNS namespace (which was created by the clone()). It still lives in
3659 * the host's CLONE_NEWPID, CLONE_NEWUTS, CLONE_NEWIPC, CLONE_NEWUSER and CLONE_NEWNET
3660 * namespaces. After it completed a number of initializations a second child (the "inner" one) is
3661 * forked off it, and it exits. */
b37469d7 3662
03cfe0d5
LP		 3663 assert(barrier);
3664 assert(directory);
af06cd30 3665 assert(fd_outer_socket >= 0);
5d9d3fcb 3666 assert(fd_inner_socket >= 0);
03cfe0d5 3667
de40a303
LP		 3668 log_debug("Outer child is initializing.");
3669
e1bb4b0d
LB		 3670 r = load_os_release_pairs_with_prefix("/", "container_host_", &os_release_pairs);
3671 if (r < 0)
3672 log_debug_errno(r, "Failed to read os-release from host for container, ignoring: %m");
3673
03cfe0d5
LP		 3674 if (prctl(PR_SET_PDEATHSIG, SIGKILL) < 0)
3675 return log_error_errno(errno, "PR_SET_PDEATHSIG failed: %m");
3676
03cfe0d5
LP		 3677 r = reset_audit_loginuid();
3678 if (r < 0)
3679 return r;
3680
2a2e78e9
LP		 3681 /* Mark everything as slave, so that we still receive mounts from the real root, but don't propagate
3682 * mounts to the real root. */
511a8cfe 3683 r = mount_follow_verbose(LOG_ERR, NULL, "/", NULL, MS_SLAVE|MS_REC, NULL);
60e76d48
ZJS		 3684 if (r < 0)
3685 return r;
03cfe0d5 3686
2d845785 3687 if (dissected_image) {
d1d0b895
LP		 3688 /* If we are operating on a disk image, then mount its root directory now, but leave out the
3689 * rest. We can read the UID shift from it if we need to. Further down we'll mount the rest,
3690 * but then with the uid shift known. That way we can mount VFAT file systems shifted to the
3691 * right place right away. This makes sure ESP partitions and userns are compatible. */
2d3a5a73 3692
af187ab2 3693 r = dissected_image_mount_and_warn(
d04faa4e
LP		 3694 dissected_image,
3695 directory,
3696 arg_uid_shift,
21b61b1d 3697 arg_uid_range,
d04faa4e
LP		 3698 DISSECT_IMAGE_MOUNT_ROOT_ONLY|
3699 DISSECT_IMAGE_DISCARD_ON_LOOP|
3700 DISSECT_IMAGE_USR_NO_ROOT|
c65f854a 3701 (arg_read_only ? DISSECT_IMAGE_READ_ONLY : DISSECT_IMAGE_FSCK|DISSECT_IMAGE_GROWFS)|
af187ab2 3702 (arg_start_mode == START_BOOT ? DISSECT_IMAGE_VALIDATE_OS : 0));
2d845785 3703 if (r < 0)
af187ab2 3704 return r;
2d845785 3705 }
03cfe0d5 3706
391567f4
LP		 3707 r = determine_uid_shift(directory);
3708 if (r < 0)
3709 return r;
3710
0de7acce 3711 if (arg_userns_mode != USER_NAMESPACE_NO) {
b71a0192
CB		 3712 r = namespace_open(0, NULL, &mntns_fd, NULL, NULL, NULL);
3713 if (r < 0)
3714 return log_error_errno(r, "Failed to pin outer mount namespace: %m");
3715
af06cd30 3716 l = send_one_fd(fd_outer_socket, mntns_fd, 0);
b71a0192
CB		 3717 if (l < 0)
3718 return log_error_errno(l, "Failed to send outer mount namespace fd: %m");
3719 mntns_fd = safe_close(mntns_fd);
3720
0e7ac751 3721 /* Let the parent know which UID shift we read from the image */
af06cd30 3722 l = send(fd_outer_socket, &arg_uid_shift, sizeof(arg_uid_shift), MSG_NOSIGNAL);
825d5287
RM		 3723 if (l < 0)
3724 return log_error_errno(errno, "Failed to send UID shift: %m");
baaa35ad
ZJS		 3725 if (l != sizeof(arg_uid_shift))
3726 return log_error_errno(SYNTHETIC_ERRNO(EIO),
3727 "Short write while sending UID shift.");
0e7ac751 3728
0de7acce 3729 if (arg_userns_mode == USER_NAMESPACE_PICK) {
d1d0b895
LP		 3730 /* When we are supposed to pick the UID shift, the parent will check now whether the
3731 * UID shift we just read from the image is available. If yes, it will send the UID
3732 * shift back to us, if not it will pick a different one, and send it back to us. */
0e7ac751 3733
af06cd30 3734 l = recv(fd_outer_socket, &arg_uid_shift, sizeof(arg_uid_shift), 0);
0e7ac751
LP		 3735 if (l < 0)
3736 return log_error_errno(errno, "Failed to recv UID shift: %m");
baaa35ad
ZJS		 3737 if (l != sizeof(arg_uid_shift))
3738 return log_error_errno(SYNTHETIC_ERRNO(EIO),
3739 "Short read while receiving UID shift.");
0e7ac751
LP		 3740 }
3741
ff6c6cc1
LP		 3742 log_full(arg_quiet ? LOG_DEBUG : LOG_INFO,
3743 "Selected user namespace base " UID_FMT " and range " UID_FMT ".", arg_uid_shift, arg_uid_range);
825d5287
RM		 3744 }
3745
6f83d3d1
LP		 3746 if (path_equal(directory, "/")) {
3747 /* If the directory we shall boot is the host, let's operate on a bind mount at a different
3748 * place, so that we can make changes to its mount structure (for example, to implement
3749 * --volatile=) without this interfering with our ability to access files such as
3750 * /etc/localtime to copy into the container. Note that we use a fixed place for this
6c2d70ce 3751 * (instead of a temporary directory, since we are living in our own mount namespace here
7802194a 3752 * already, and thus don't need to be afraid of colliding with anyone else's mounts). */
6f83d3d1
LP		 3753 (void) mkdir_p("/run/systemd/nspawn-root", 0755);
3754
511a8cfe 3755 r = mount_nofollow_verbose(LOG_ERR, "/", "/run/systemd/nspawn-root", NULL, MS_BIND|MS_REC, NULL);
6f83d3d1
LP		 3756 if (r < 0)
3757 return r;
3758
3759 directory = "/run/systemd/nspawn-root";
e50cd82f 3760 }
7d0ecdd6 3761
75f81732
LP		 3762 /* Make sure we always have a mount that we can move to root later on. */
3763 r = make_mount_point(directory);
3764 if (r < 0)
3765 return r;
3766
3767 /* So the whole tree is now MS_SLAVE, i.e. we'll still receive mount/umount events from the host
3768 * mount namespace. For the directory we are going to run our container let's turn this off, so that
3769 * we'll live in our own little world from now on, and propagation from the host may only happen via
3770 * the mount tunnel dir, or not at all. */
3771 r = mount_follow_verbose(LOG_ERR, NULL, directory, NULL, MS_PRIVATE|MS_REC, NULL);
3772 if (r < 0)
3773 return r;
3774
7d0ecdd6
LP		 3775 r = setup_pivot_root(
3776 directory,
3777 arg_pivot_root_new,
3778 arg_pivot_root_old);
3779 if (r < 0)
3780 return r;
3781
3782 r = setup_volatile_mode(
3783 directory,
3784 arg_volatile_mode,
7d0ecdd6 3785 arg_uid_shift,
8f1ed04a 3786 arg_selinux_apifs_context);
7d0ecdd6
LP		 3787 if (r < 0)
3788 return r;
3789
2f893044
LP		 3790 r = bind_user_prepare(
3791 directory,
3792 arg_bind_user,
3793 arg_uid_shift,
3794 arg_uid_range,
3795 &arg_custom_mounts, &arg_n_custom_mounts,
3796 &bind_user_context);
3797 if (r < 0)
3798 return r;
3799
3800 if (arg_userns_mode != USER_NAMESPACE_NO && bind_user_context) {
d1d0b895
LP		 3801 /* Send the user maps we determined to the parent, so that it installs it in our user
3802 * namespace UID map table */
2f893044
LP		 3803
3804 for (size_t i = 0; i < bind_user_context->n_data; i++) {
3805 uid_t map[] = {
3806 bind_user_context->data[i].payload_user->uid,
3807 bind_user_context->data[i].host_user->uid,
3808 (uid_t) bind_user_context->data[i].payload_group->gid,
3809 (uid_t) bind_user_context->data[i].host_group->gid,
3810 };
3811
af06cd30 3812 l = send(fd_outer_socket, map, sizeof(map), MSG_NOSIGNAL);
2f893044
LP		 3813 if (l < 0)
3814 return log_error_errno(errno, "Failed to send user UID map: %m");
3815 if (l != sizeof(map))
3816 return log_error_errno(SYNTHETIC_ERRNO(EIO),
3817 "Short write while sending user UID map.");
3818 }
3819 }
3820
5f0a6347
DDM		 3821 r = mount_custom(
3822 directory,
3823 arg_custom_mounts,
3824 arg_n_custom_mounts,
5f0a6347 3825 arg_uid_shift,
c0c8f718 3826 arg_uid_range,
5f0a6347
DDM		 3827 arg_selinux_apifs_context,
3828 MOUNT_ROOT_ONLY);
3829 if (r < 0)
3830 return r;
3831
c0c8f718
AV		 3832 if (arg_userns_mode != USER_NAMESPACE_NO &&
3833 IN_SET(arg_userns_ownership, USER_NAMESPACE_OWNERSHIP_MAP, USER_NAMESPACE_OWNERSHIP_AUTO) &&
3834 arg_uid_shift != 0) {
3835
2b2777ed 3836 r = remount_idmap(directory, arg_uid_shift, arg_uid_range, UID_INVALID, REMOUNT_IDMAPPING_HOST_ROOT);
c0c8f718
AV		 3837 if (r == -EINVAL || ERRNO_IS_NOT_SUPPORTED(r)) {
3838 /* This might fail because the kernel or file system doesn't support idmapping. We
3839 * can't really distinguish this nicely, nor do we have any guarantees about the
3840 * error codes we see, could be EOPNOTSUPP or EINVAL. */
3841 if (arg_userns_ownership != USER_NAMESPACE_OWNERSHIP_AUTO)
3842 return log_error_errno(SYNTHETIC_ERRNO(EOPNOTSUPP),
3843 "ID mapped mounts are apparently not available, sorry.");
3844
3845 log_debug("ID mapped mounts are apparently not available on this kernel or for the selected file system, reverting to recursive chown()ing.");
3846 arg_userns_ownership = USER_NAMESPACE_OWNERSHIP_CHOWN;
3847 } else if (r < 0)
3848 return log_error_errno(r, "Failed to set up ID mapped mounts: %m");
3849 else {
3850 log_debug("ID mapped mounts available, making use of them.");
3851 idmap = true;
3852 }
3853 }
3854
2d3a5a73
LP		 3855 if (dissected_image) {
3856 /* Now we know the uid shift, let's now mount everything else that might be in the image. */
d04faa4e
LP		 3857 r = dissected_image_mount(
3858 dissected_image,
3859 directory,
3860 arg_uid_shift,
21b61b1d 3861 arg_uid_range,
d04faa4e
LP		 3862 DISSECT_IMAGE_MOUNT_NON_ROOT_ONLY|
3863 DISSECT_IMAGE_DISCARD_ON_LOOP|
3864 DISSECT_IMAGE_USR_NO_ROOT|
f61c7f88
LP		 3865 (arg_read_only ? DISSECT_IMAGE_READ_ONLY : DISSECT_IMAGE_FSCK|DISSECT_IMAGE_GROWFS)|
3866 (idmap ? DISSECT_IMAGE_MOUNT_IDMAPPED : 0));
4fcb96ce
LP		 3867 if (r == -EUCLEAN)
3868 return log_error_errno(r, "File system check for image failed: %m");
2d3a5a73 3869 if (r < 0)
4fcb96ce 3870 return log_error_errno(r, "Failed to mount image file system: %m");
2d3a5a73
LP		 3871 }
3872
8199d554
LP		 3873 if (arg_unified_cgroup_hierarchy == CGROUP_UNIFIED_UNKNOWN) {
3874 /* OK, we don't know yet which cgroup mode to use yet. Let's figure it out, and tell the parent. */
3875
3876 r = detect_unified_cgroup_hierarchy_from_image(directory);
3877 if (r < 0)
3878 return r;
3879
fefb7a6d 3880 l = send(fd_outer_socket, &arg_unified_cgroup_hierarchy, sizeof(arg_unified_cgroup_hierarchy), MSG_NOSIGNAL);
8199d554
LP		 3881 if (l < 0)
3882 return log_error_errno(errno, "Failed to send cgroup mode: %m");
baaa35ad
ZJS		 3883 if (l != sizeof(arg_unified_cgroup_hierarchy))
3884 return log_error_errno(SYNTHETIC_ERRNO(EIO),
3885 "Short write while sending cgroup mode.");
8199d554
LP		 3886 }
3887
4ad14eff
LP		 3888 r = recursive_chown(directory, arg_uid_shift, arg_uid_range);
3889 if (r < 0)
3890 return r;
3891
03cfe0d5
LP		 3892 r = base_filesystem_create(directory, arg_uid_shift, (gid_t) arg_uid_shift);
3893 if (r < 0)
3894 return r;
3895
bbd407ea
DDM		 3896 if (arg_read_only && arg_volatile_mode == VOLATILE_NO &&
3897 !has_custom_root_mount(arg_custom_mounts, arg_n_custom_mounts)) {
64e82c19 3898 r = bind_remount_recursive(directory, MS_RDONLY, MS_RDONLY, NULL);
03cfe0d5
LP		 3899 if (r < 0)
3900 return log_error_errno(r, "Failed to make tree read-only: %m");
3901 }
3902
0de7acce 3903 r = mount_all(directory,
4f086aab 3904 arg_mount_settings,
0de7acce 3905 arg_uid_shift,
0de7acce 3906 arg_selinux_apifs_context);
03cfe0d5
LP		 3907 if (r < 0)
3908 return r;
3909
07fa00f9
LP		 3910 r = copy_devnodes(directory);
3911 if (r < 0)
03cfe0d5
LP		 3912 return r;
3913
de40a303
LP		 3914 r = make_extra_nodes(directory);
3915 if (r < 0)
3916 return r;
3917
3918 (void) dev_setup(directory, arg_uid_shift, arg_uid_shift);
e5f10caf 3919
9fac5029 3920 p = prefix_roota(directory, "/run/host");
e5f10caf 3921 (void) make_inaccessible_nodes(p, arg_uid_shift, arg_uid_shift);
03cfe0d5 3922
07fa00f9
LP		 3923 r = setup_pts(directory);
3924 if (r < 0)
03cfe0d5
LP		 3925 return r;
3926
e79581dd 3927 r = mount_tunnel_dig(directory);
03cfe0d5
LP		 3928 if (r < 0)
3929 return r;
3930
8e5430c4
LP		 3931 r = setup_keyring();
3932 if (r < 0)
3933 return r;
3934
3652872a
LP		 3935 r = setup_credentials(directory);
3936 if (r < 0)
3937 return r;
3938
2f893044
LP		 3939 r = bind_user_setup(bind_user_context, directory);
3940 if (r < 0)
3941 return r;
3942
5c4deb9a
MJ		 3943 r = mount_custom(
3944 directory,
3945 arg_custom_mounts,
3946 arg_n_custom_mounts,
3947 arg_uid_shift,
c0c8f718 3948 arg_uid_range,
5c4deb9a
MJ		 3949 arg_selinux_apifs_context,
3950 MOUNT_NON_ROOT_ONLY);
3951 if (r < 0)
3952 return r;
3953
03cfe0d5
LP		 3954 r = setup_timezone(directory);
3955 if (r < 0)
3956 return r;
3957
3958 r = setup_resolv_conf(directory);
3959 if (r < 0)
3960 return r;
3961
e01ff70a
MS		 3962 r = setup_machine_id(directory);
3963 if (r < 0)
3964 return r;
3965
03cfe0d5
LP		 3966 r = setup_journal(directory);
3967 if (r < 0)
3968 return r;
3969
0f48ba7b
LP		 3970 /* The same stuff as the $container env var, but nicely readable for the entire payload */
3971 p = prefix_roota(directory, "/run/host/container-manager");
3972 (void) write_string_file(p, arg_container_service_name, WRITE_STRING_FILE_CREATE);
3973
3974 /* The same stuff as the $container_uuid env var */
3975 p = prefix_roota(directory, "/run/host/container-uuid");
3976 (void) write_string_filef(p, WRITE_STRING_FILE_CREATE, SD_ID128_UUID_FORMAT_STR, SD_ID128_FORMAT_VAL(arg_uuid));
3977
489fae52 3978 if (!arg_use_cgns) {
0996ef00
CB		 3979 r = mount_cgroups(
3980 directory,
3981 arg_unified_cgroup_hierarchy,
3982 arg_userns_mode != USER_NAMESPACE_NO,
3983 arg_uid_shift,
3984 arg_uid_range,
5a8ff0e6 3985 arg_selinux_apifs_context,
ada54120 3986 false);
0996ef00
CB		 3987 if (r < 0)
3988 return r;
3989 }
03cfe0d5 3990
57c10a56
CB		 3991 /* Mark everything as shared so our mounts get propagated down. This is required to make new bind
3992 * mounts available in systemd services inside the container that create a new mount namespace. See
3993 * https://github.com/systemd/systemd/issues/3860 Further submounts (such as /dev) done after this
3994 * will inherit the shared propagation mode.
3995 *
3996 * IMPORTANT: Do not overmount the root directory anymore from now on to enable moving the root
3997 * directory mount to root later on.
3998 * https://github.com/systemd/systemd/issues/3847#issuecomment-562735251
3999 */
9d50f850 4000 r = mount_switch_root(directory, MS_SHARED);
03cfe0d5
LP		 4001 if (r < 0)
4002 return log_error_errno(r, "Failed to move root directory: %m");
4003
e79581dd
CB		 4004 /* We finished setting up the rootfs which is a shared mount. The mount tunnel needs to be a
4005 * dependent mount otherwise we can't MS_MOVE mounts that were propagated from the host into
4006 * the container. */
4007 r = mount_tunnel_open();
4008 if (r < 0)
4009 return r;
4010
b71a0192
CB		 4011 if (arg_userns_mode != USER_NAMESPACE_NO) {
4012 /* In order to mount procfs and sysfs in an unprivileged container the kernel
4013 * requires that a fully visible instance is already present in the target mount
4014 * namespace. Mount one here so the inner child can mount its own instances. Later
4015 * we umount the temporary instances created here before we actually exec the
4016 * payload. Since the rootfs is shared the umount will propagate into the container.
4017 * Note, the inner child wouldn't be able to unmount the instances on its own since
4018 * it doesn't own the originating mount namespace. IOW, the outer child needs to do
4019 * this. */
4020 r = pin_fully_visible_fs();
4021 if (r < 0)
4022 return r;
4023 }
4024
e96ceaba 4025 fd = setup_notify_child();
9c1e04d0
AP		 4026 if (fd < 0)
4027 return fd;
4028
03cfe0d5 4029 pid = raw_clone(SIGCHLD|CLONE_NEWNS|
0c582db0 4030 arg_clone_ns_flags |
8869a0b4 4031 (arg_userns_mode != USER_NAMESPACE_NO ? CLONE_NEWUSER : 0));
03cfe0d5
LP		 4032 if (pid < 0)
4033 return log_error_errno(errno, "Failed to fork inner child: %m");
03cfe0d5 4034 if (pid == 0) {
af06cd30 4035 fd_outer_socket = safe_close(fd_outer_socket);
03cfe0d5 4036
2a2e78e9
LP		 4037 /* The inner child has all namespaces that are requested, so that we all are owned by the
4038 * user if user namespaces are turned on. */
03cfe0d5 4039
d7bea6b6
DP		 4040 if (arg_network_namespace_path) {
4041 r = namespace_enter(-1, -1, netns_fd, -1, -1);
4042 if (r < 0)
e2d39e54 4043 return log_error_errno(r, "Failed to join network namespace: %m");
d7bea6b6
DP		 4044 }
4045
11875a98 4046 r = inner_child(barrier, fd_inner_socket, fds, os_release_pairs);
03cfe0d5
LP		 4047 if (r < 0)
4048 _exit(EXIT_FAILURE);
4049
4050 _exit(EXIT_SUCCESS);
4051 }
4052
af06cd30 4053 l = send(fd_outer_socket, &pid, sizeof(pid), MSG_NOSIGNAL);
03cfe0d5
LP		 4054 if (l < 0)
4055 return log_error_errno(errno, "Failed to send PID: %m");
baaa35ad
ZJS		 4056 if (l != sizeof(pid))
4057 return log_error_errno(SYNTHETIC_ERRNO(EIO),
4058 "Short write while sending PID.");
03cfe0d5 4059
af06cd30 4060 l = send(fd_outer_socket, &arg_uuid, sizeof(arg_uuid), MSG_NOSIGNAL);
e01ff70a
MS		 4061 if (l < 0)
4062 return log_error_errno(errno, "Failed to send machine ID: %m");
baaa35ad
ZJS		 4063 if (l != sizeof(arg_uuid))
4064 return log_error_errno(SYNTHETIC_ERRNO(EIO),
4065 "Short write while sending machine ID.");
e01ff70a 4066
af06cd30 4067 l = send_one_fd(fd_outer_socket, fd, 0);
9c1e04d0 4068 if (l < 0)
ba72801d 4069 return log_error_errno(l, "Failed to send notify fd: %m");
9c1e04d0 4070
af06cd30 4071 fd_outer_socket = safe_close(fd_outer_socket);
5d9d3fcb 4072 fd_inner_socket = safe_close(fd_inner_socket);
d7bea6b6 4073 netns_fd = safe_close(netns_fd);
03cfe0d5
LP		 4074
4075 return 0;
4076}
4077
0e7ac751 4078static int uid_shift_pick(uid_t *shift, LockFile *ret_lock_file) {
d381c8a6 4079 bool tried_hashed = false;
0e7ac751
LP		 4080 unsigned n_tries = 100;
4081 uid_t candidate;
4082 int r;
4083
4084 assert(shift);
4085 assert(ret_lock_file);
0de7acce 4086 assert(arg_userns_mode == USER_NAMESPACE_PICK);
0e7ac751
LP		 4087 assert(arg_uid_range == 0x10000U);
4088
4089 candidate = *shift;
4090
4091 (void) mkdir("/run/systemd/nspawn-uid", 0755);
4092
4093 for (;;) {
fbd0b64f 4094 char lock_path[STRLEN("/run/systemd/nspawn-uid/") + DECIMAL_STR_MAX(uid_t) + 1];
8e766630 4095 _cleanup_(release_lock_file) LockFile lf = LOCK_FILE_INIT;
0e7ac751
LP		 4096
4097 if (--n_tries <= 0)
4098 return -EBUSY;
4099
87d5e4f2 4100 if (candidate < CONTAINER_UID_BASE_MIN || candidate > CONTAINER_UID_BASE_MAX)
0e7ac751
LP		 4101 goto next;
4102 if ((candidate & UINT32_C(0xFFFF)) != 0)
4103 goto next;
4104
4105 xsprintf(lock_path, "/run/systemd/nspawn-uid/" UID_FMT, candidate);
4106 r = make_lock_file(lock_path, LOCK_EX|LOCK_NB, &lf);
4107 if (r == -EBUSY) /* Range already taken by another nspawn instance */
4108 goto next;
4109 if (r < 0)
4110 return r;
4111
4112 /* Make some superficial checks whether the range is currently known in the user database */
4113 if (getpwuid(candidate))
4114 goto next;
4115 if (getpwuid(candidate + UINT32_C(0xFFFE)))
4116 goto next;
4117 if (getgrgid(candidate))
4118 goto next;
4119 if (getgrgid(candidate + UINT32_C(0xFFFE)))
4120 goto next;
4121
4122 *ret_lock_file = lf;
4123 lf = (struct LockFile) LOCK_FILE_INIT;
4124 *shift = candidate;
4125 return 0;
4126
4127 next:
d381c8a6
LP		 4128 if (arg_machine && !tried_hashed) {
4129 /* Try to hash the base from the container name */
4130
4131 static const uint8_t hash_key[] = {
4132 0xe1, 0x56, 0xe0, 0xf0, 0x4a, 0xf0, 0x41, 0xaf,
4133 0x96, 0x41, 0xcf, 0x41, 0x33, 0x94, 0xff, 0x72
4134 };
4135
4136 candidate = (uid_t) siphash24(arg_machine, strlen(arg_machine), hash_key);
4137
4138 tried_hashed = true;
4139 } else
4140 random_bytes(&candidate, sizeof(candidate));
4141
87d5e4f2 4142 candidate = (candidate % (CONTAINER_UID_BASE_MAX - CONTAINER_UID_BASE_MIN)) + CONTAINER_UID_BASE_MIN;
0e7ac751
LP		 4143 candidate &= (uid_t) UINT32_C(0xFFFF0000);
4144 }
4145}
4146
2f893044
LP		 4147static int add_one_uid_map(
4148 char **p,
4149 uid_t container_uid,
4150 uid_t host_uid,
4151 uid_t range) {
4152
4153 return strextendf(p,
4154 UID_FMT " " UID_FMT " " UID_FMT "\n",
4155 container_uid, host_uid, range);
4156}
4157
4158static int make_uid_map_string(
4159 const uid_t bind_user_uid[],
4160 size_t n_bind_user_uid,
4161 size_t offset,
4162 char **ret) {
4163
4164 _cleanup_free_ char *s = NULL;
4165 uid_t previous_uid = 0;
4166 int r;
4167
4168 assert(n_bind_user_uid == 0 || bind_user_uid);
2f092762 4169 assert(IN_SET(offset, 0, 2)); /* used to switch between UID and GID map */
2f893044
LP		 4170 assert(ret);
4171
4172 /* The bind_user_uid[] array is a series of 4 uid_t values, for each --bind-user= entry one
4173 * quadruplet, consisting of host and container UID + GID. */
4174
4175 for (size_t i = 0; i < n_bind_user_uid; i++) {
05ab439a
YW		 4176 uid_t payload_uid = bind_user_uid[i*4+offset],
4177 host_uid = bind_user_uid[i*4+offset+1];
2f893044
LP		 4178
4179 assert(previous_uid <= payload_uid);
4180 assert(payload_uid < arg_uid_range);
4181
4182 /* Add a range to close the gap to previous entry */
4183 if (payload_uid > previous_uid) {
4184 r = add_one_uid_map(&s, previous_uid, arg_uid_shift + previous_uid, payload_uid - previous_uid);
4185 if (r < 0)
4186 return r;
4187 }
4188
4189 /* Map this specific user */
4190 r = add_one_uid_map(&s, payload_uid, host_uid, 1);
4191 if (r < 0)
4192 return r;
4193
4194 previous_uid = payload_uid + 1;
4195 }
4196
4197 /* And add a range to close the gap to finish the range */
4198 if (arg_uid_range > previous_uid) {
4199 r = add_one_uid_map(&s, previous_uid, arg_uid_shift + previous_uid, arg_uid_range - previous_uid);
4200 if (r < 0)
4201 return r;
4202 }
4203
4204 assert(s);
4205
4206 *ret = TAKE_PTR(s);
4207 return 0;
4208}
4209
4210static int setup_uid_map(
4211 pid_t pid,
4212 const uid_t bind_user_uid[],
4213 size_t n_bind_user_uid) {
4214
4215 char uid_map[STRLEN("/proc//uid_map") + DECIMAL_STR_MAX(uid_t) + 1];
4216 _cleanup_free_ char *s = NULL;
03cfe0d5
LP		 4217 int r;
4218
4219 assert(pid > 1);
4220
2f893044
LP		 4221 /* Build the UID map string */
4222 if (make_uid_map_string(bind_user_uid, n_bind_user_uid, 0, &s) < 0) /* offset=0 contains the UID pair */
4223 return log_oom();
4224
03cfe0d5 4225 xsprintf(uid_map, "/proc/" PID_FMT "/uid_map", pid);
2f893044 4226 r = write_string_file(uid_map, s, WRITE_STRING_FILE_DISABLE_BUFFER);
03cfe0d5
LP		 4227 if (r < 0)
4228 return log_error_errno(r, "Failed to write UID map: %m");
4229
2f893044
LP		 4230 /* And now build the GID map string */
4231 s = mfree(s);
4232 if (make_uid_map_string(bind_user_uid, n_bind_user_uid, 2, &s) < 0) /* offset=2 contains the GID pair */
4233 return log_oom();
4234
03cfe0d5 4235 xsprintf(uid_map, "/proc/" PID_FMT "/gid_map", pid);
2f893044 4236 r = write_string_file(uid_map, s, WRITE_STRING_FILE_DISABLE_BUFFER);
03cfe0d5
LP		 4237 if (r < 0)
4238 return log_error_errno(r, "Failed to write GID map: %m");
4239
4240 return 0;
4241}
4242
9c1e04d0 4243static int nspawn_dispatch_notify_fd(sd_event_source *source, int fd, uint32_t revents, void *userdata) {
9c1e04d0
AP		 4244 char buf[NOTIFY_BUFFER_MAX+1];
4245 char *p = NULL;
4246 struct iovec iovec = {
4247 .iov_base = buf,
4248 .iov_len = sizeof(buf)-1,
4249 };
fb29cdbe
LP		 4250 CMSG_BUFFER_TYPE(CMSG_SPACE(sizeof(struct ucred)) +
4251 CMSG_SPACE(sizeof(int) * NOTIFY_FD_MAX)) control;
9c1e04d0
AP		 4252 struct msghdr msghdr = {
4253 .msg_iov = &iovec,
4254 .msg_iovlen = 1,
4255 .msg_control = &control,
4256 .msg_controllen = sizeof(control),
4257 };
371d72e0 4258 struct ucred *ucred;
9c1e04d0
AP		 4259 ssize_t n;
4260 pid_t inner_child_pid;
4261 _cleanup_strv_free_ char **tags = NULL;
4bf4f50f 4262 int r;
9c1e04d0
AP		 4263
4264 assert(userdata);
4265
4266 inner_child_pid = PTR_TO_PID(userdata);
4267
4268 if (revents != EPOLLIN) {
4269 log_warning("Got unexpected poll event for notify fd.");
4270 return 0;
4271 }
4272
3691bcf3 4273 n = recvmsg_safe(fd, &msghdr, MSG_DONTWAIT|MSG_CMSG_CLOEXEC);
8add30a0
YW		 4274 if (n < 0) {
4275 if (ERRNO_IS_TRANSIENT(n))
4276 return 0;
4277 if (n == -EXFULL) {
4278 log_warning("Got message with truncated control data (too many fds sent?), ignoring.");
4279 return 0;
4280 }
3691bcf3 4281 return log_warning_errno(n, "Couldn't read notification socket: %m");
8add30a0 4282 }
9c1e04d0 4283
9c1e04d0
AP		 4284 cmsg_close_all(&msghdr);
4285
371d72e0 4286 ucred = CMSG_FIND_DATA(&msghdr, SOL_SOCKET, SCM_CREDENTIALS, struct ucred);
9c1e04d0 4287 if (!ucred || ucred->pid != inner_child_pid) {
8cb57430 4288 log_debug("Received notify message without valid credentials. Ignoring.");
9c1e04d0
AP		 4289 return 0;
4290 }
4291
4292 if ((size_t) n >= sizeof(buf)) {
4293 log_warning("Received notify message exceeded maximum size. Ignoring.");
4294 return 0;
4295 }
4296
4297 buf[n] = 0;
4298 tags = strv_split(buf, "\n\r");
4299 if (!tags)
4300 return log_oom();
4301
d29cc4d6 4302 if (strv_contains(tags, "READY=1")) {
d4341b76 4303 r = sd_notify(false, "READY=1\n");
4bf4f50f
ZJS		 4304 if (r < 0)
4305 log_warning_errno(r, "Failed to send readiness notification, ignoring: %m");
4306 }
9c1e04d0
AP		 4307
4308 p = strv_find_startswith(tags, "STATUS=");
4309 if (p)
04f590a4 4310 (void) sd_notifyf(false, "STATUS=Container running: %s", p);
9c1e04d0
AP		 4311
4312 return 0;
4313}
4314
e96ceaba 4315static int setup_notify_parent(sd_event *event, int fd, pid_t *inner_child_pid, sd_event_source **notify_event_source) {
9c1e04d0 4316 int r;
9c1e04d0 4317
5773024d 4318 r = sd_event_add_io(event, notify_event_source, fd, EPOLLIN, nspawn_dispatch_notify_fd, inner_child_pid);
9c1e04d0
AP		 4319 if (r < 0)
4320 return log_error_errno(r, "Failed to allocate notify event source: %m");
4321
5773024d 4322 (void) sd_event_source_set_description(*notify_event_source, "nspawn-notify");
9c1e04d0
AP		 4323
4324 return 0;
4325}
4326
5d961407
LP		 4327static int merge_settings(Settings *settings, const char *path) {
4328 int rl;
f757855e 4329
5d961407
LP		 4330 assert(settings);
4331 assert(path);
f757855e 4332
5d961407
LP		 4333 /* Copy over bits from the settings, unless they have been explicitly masked by command line switches. Note
4334 * that this steals the fields of the Settings* structure, and hence modifies it. */
f757855e 4335
7732f92b
LP		 4336 if ((arg_settings_mask & SETTING_START_MODE) == 0 &&
4337 settings->start_mode >= 0) {
4338 arg_start_mode = settings->start_mode;
130d3d22 4339 strv_free_and_replace(arg_parameters, settings->parameters);
f757855e
LP		 4340 }
4341
d3689b94
LP		 4342 if ((arg_settings_mask & SETTING_EPHEMERAL) == 0 &&
4343 settings->ephemeral >= 0)
a2f577fc
JL		 4344 arg_ephemeral = settings->ephemeral;
4345
de40a303
LP		 4346 if ((arg_settings_mask & SETTING_DIRECTORY) == 0 &&
4347 settings->root) {
4348
4349 if (!arg_settings_trusted)
4350 log_warning("Ignoring root directory setting, file %s is not trusted.", path);
4351 else
4352 free_and_replace(arg_directory, settings->root);
4353 }
4354
b53ede69
PW		 4355 if ((arg_settings_mask & SETTING_PIVOT_ROOT) == 0 &&
4356 settings->pivot_root_new) {
4357 free_and_replace(arg_pivot_root_new, settings->pivot_root_new);
4358 free_and_replace(arg_pivot_root_old, settings->pivot_root_old);
4359 }
4360
5f932eb9 4361 if ((arg_settings_mask & SETTING_WORKING_DIRECTORY) == 0 &&
1cc6c93a
YW		 4362 settings->working_directory)
4363 free_and_replace(arg_chdir, settings->working_directory);
5f932eb9 4364
f757855e 4365 if ((arg_settings_mask & SETTING_ENVIRONMENT) == 0 &&
130d3d22
YW		 4366 settings->environment)
4367 strv_free_and_replace(arg_setenv, settings->environment);
f757855e 4368
de40a303
LP		 4369 if ((arg_settings_mask & SETTING_USER) == 0) {
4370
4371 if (settings->user)
4372 free_and_replace(arg_user, settings->user);
4373
4374 if (uid_is_valid(settings->uid))
4375 arg_uid = settings->uid;
4376 if (gid_is_valid(settings->gid))
4377 arg_gid = settings->gid;
4378 if (settings->n_supplementary_gids > 0) {
4379 free_and_replace(arg_supplementary_gids, settings->supplementary_gids);
4380 arg_n_supplementary_gids = settings->n_supplementary_gids;
4381 }
4382 }
f757855e
LP		 4383
4384 if ((arg_settings_mask & SETTING_CAPABILITY) == 0) {
a3fc6b55 4385 uint64_t plus, minus;
7be830c6 4386 uint64_t network_minus = 0;
88fc9c9b 4387 uint64_t ambient;
f757855e 4388
de40a303
LP		 4389 /* Note that we copy both the simple plus/minus caps here, and the full quintet from the
4390 * Settings structure */
4391
0e265674 4392 plus = settings->capability;
a3fc6b55
LP		 4393 minus = settings->drop_capability;
4394
9baa294c
LP		 4395 if ((arg_settings_mask & SETTING_NETWORK) == 0 &&
4396 settings_network_configured(settings)) {
a3fc6b55
LP		 4397 if (settings_private_network(settings))
4398 plus |= UINT64_C(1) << CAP_NET_ADMIN;
4399 else
7be830c6 4400 network_minus |= UINT64_C(1) << CAP_NET_ADMIN;
a3fc6b55 4401 }
0e265674
LP		 4402
4403 if (!arg_settings_trusted && plus != 0) {
4404 if (settings->capability != 0)
5d961407 4405 log_warning("Ignoring Capability= setting, file %s is not trusted.", path);
7be830c6
TH		 4406 } else {
4407 arg_caps_retain &= ~network_minus;
520e0d54 4408 arg_caps_retain |= plus;
7be830c6 4409 }
f757855e 4410
a3fc6b55 4411 arg_caps_retain &= ~minus;
de40a303
LP		 4412
4413 /* Copy the full capabilities over too */
4414 if (capability_quintet_is_set(&settings->full_capabilities)) {
4415 if (!arg_settings_trusted)
5238e957 4416 log_warning("Ignoring capability settings, file %s is not trusted.", path);
de40a303
LP		 4417 else
4418 arg_full_capabilities = settings->full_capabilities;
4419 }
88fc9c9b
TH		 4420
4421 ambient = settings->ambient_capability;
4422 if (!arg_settings_trusted && ambient != 0)
4423 log_warning("Ignoring AmbientCapability= setting, file %s is not trusted.", path);
4424 else
4425 arg_caps_ambient |= ambient;
f757855e
LP		 4426 }
4427
4428 if ((arg_settings_mask & SETTING_KILL_SIGNAL) == 0 &&
4429 settings->kill_signal > 0)
4430 arg_kill_signal = settings->kill_signal;
4431
4432 if ((arg_settings_mask & SETTING_PERSONALITY) == 0 &&
4433 settings->personality != PERSONALITY_INVALID)
4434 arg_personality = settings->personality;
4435
4436 if ((arg_settings_mask & SETTING_MACHINE_ID) == 0 &&
4437 !sd_id128_is_null(settings->machine_id)) {
4438
4439 if (!arg_settings_trusted)
5d961407 4440 log_warning("Ignoring MachineID= setting, file %s is not trusted.", path);
f757855e
LP		 4441 else
4442 arg_uuid = settings->machine_id;
4443 }
4444
4445 if ((arg_settings_mask & SETTING_READ_ONLY) == 0 &&
4446 settings->read_only >= 0)
4447 arg_read_only = settings->read_only;
4448
4449 if ((arg_settings_mask & SETTING_VOLATILE_MODE) == 0 &&
4450 settings->volatile_mode != _VOLATILE_MODE_INVALID)
4451 arg_volatile_mode = settings->volatile_mode;
4452
4453 if ((arg_settings_mask & SETTING_CUSTOM_MOUNTS) == 0 &&
4454 settings->n_custom_mounts > 0) {
4455
4456 if (!arg_settings_trusted)
5d961407 4457 log_warning("Ignoring TemporaryFileSystem=, Bind= and BindReadOnly= settings, file %s is not trusted.", path);
f757855e
LP		 4458 else {
4459 custom_mount_free_all(arg_custom_mounts, arg_n_custom_mounts);
1cc6c93a 4460 arg_custom_mounts = TAKE_PTR(settings->custom_mounts);
f757855e 4461 arg_n_custom_mounts = settings->n_custom_mounts;
f757855e
LP		 4462 settings->n_custom_mounts = 0;
4463 }
4464 }
4465
4466 if ((arg_settings_mask & SETTING_NETWORK) == 0 &&
a1dfd585 4467 settings_network_configured(settings)) {
f757855e
LP		 4468
4469 if (!arg_settings_trusted)
5d961407 4470 log_warning("Ignoring network settings, file %s is not trusted.", path);
f757855e 4471 else {
f6d6bad1 4472 arg_network_veth = settings_network_veth(settings);
0e265674
LP		 4473 arg_private_network = settings_private_network(settings);
4474
130d3d22
YW		 4475 strv_free_and_replace(arg_network_interfaces, settings->network_interfaces);
4476 strv_free_and_replace(arg_network_macvlan, settings->network_macvlan);
4477 strv_free_and_replace(arg_network_ipvlan, settings->network_ipvlan);
4478 strv_free_and_replace(arg_network_veth_extra, settings->network_veth_extra);
f6d6bad1 4479
1cc6c93a
YW		 4480 free_and_replace(arg_network_bridge, settings->network_bridge);
4481 free_and_replace(arg_network_zone, settings->network_zone);
de40a303
LP		 4482
4483 free_and_replace(arg_network_namespace_path, settings->network_namespace_path);
f757855e
LP		 4484 }
4485 }
4486
4487 if ((arg_settings_mask & SETTING_EXPOSE_PORTS) == 0 &&
4488 settings->expose_ports) {
4489
4490 if (!arg_settings_trusted)
5d961407 4491 log_warning("Ignoring Port= setting, file %s is not trusted.", path);
f757855e
LP		 4492 else {
4493 expose_port_free_all(arg_expose_ports);
1cc6c93a 4494 arg_expose_ports = TAKE_PTR(settings->expose_ports);
f757855e
LP		 4495 }
4496 }
4497
0de7acce
LP		 4498 if ((arg_settings_mask & SETTING_USERNS) == 0 &&
4499 settings->userns_mode != _USER_NAMESPACE_MODE_INVALID) {
4500
4501 if (!arg_settings_trusted)
5d961407 4502 log_warning("Ignoring PrivateUsers= and PrivateUsersChown= settings, file %s is not trusted.", path);
0de7acce
LP		 4503 else {
4504 arg_userns_mode = settings->userns_mode;
4505 arg_uid_shift = settings->uid_shift;
4506 arg_uid_range = settings->uid_range;
6c045a99 4507 arg_userns_ownership = settings->userns_ownership;
0de7acce
LP		 4508 }
4509 }
4510
0cc3c9f9
LP		 4511 if ((arg_settings_mask & SETTING_BIND_USER) == 0 &&
4512 !strv_isempty(settings->bind_user))
2f893044
LP		 4513 strv_free_and_replace(arg_bind_user, settings->bind_user);
4514
d3689b94
LP		 4515 if ((arg_settings_mask & SETTING_NOTIFY_READY) == 0 &&
4516 settings->notify_ready >= 0)
9c1e04d0
AP		 4517 arg_notify_ready = settings->notify_ready;
4518
960e4569
LP		 4519 if ((arg_settings_mask & SETTING_SYSCALL_FILTER) == 0) {
4520
2d09ea44
LP		 4521 if (!strv_isempty(settings->syscall_allow_list) || !strv_isempty(settings->syscall_deny_list)) {
4522 if (!arg_settings_trusted && !strv_isempty(settings->syscall_allow_list))
4523 log_warning("Ignoring SystemCallFilter= settings, file %s is not trusted.", path);
4524 else {
4525 strv_free_and_replace(arg_syscall_allow_list, settings->syscall_allow_list);
4526 strv_free_and_replace(arg_syscall_deny_list, settings->syscall_deny_list);
4527 }
960e4569 4528 }
de40a303
LP		 4529
4530#if HAVE_SECCOMP
2d09ea44
LP		 4531 if (settings->seccomp) {
4532 if (!arg_settings_trusted)
4533 log_warning("Ignoring SECCOMP filter, file %s is not trusted.", path);
4534 else {
4535 seccomp_release(arg_seccomp);
4536 arg_seccomp = TAKE_PTR(settings->seccomp);
4537 }
de40a303
LP		 4538 }
4539#endif
960e4569
LP		 4540 }
4541
bf428efb
LP		 4542 for (rl = 0; rl < _RLIMIT_MAX; rl ++) {
4543 if ((arg_settings_mask & (SETTING_RLIMIT_FIRST << rl)))
4544 continue;
4545
4546 if (!settings->rlimit[rl])
4547 continue;
4548
4549 if (!arg_settings_trusted) {
5d961407 4550 log_warning("Ignoring Limit%s= setting, file '%s' is not trusted.", rlimit_to_string(rl), path);
bf428efb
LP		 4551 continue;
4552 }
4553
4554 free_and_replace(arg_rlimit[rl], settings->rlimit[rl]);
4555 }
4556
3a9530e5
LP		 4557 if ((arg_settings_mask & SETTING_HOSTNAME) == 0 &&
4558 settings->hostname)
4559 free_and_replace(arg_hostname, settings->hostname);
4560
66edd963
LP		 4561 if ((arg_settings_mask & SETTING_NO_NEW_PRIVILEGES) == 0 &&
4562 settings->no_new_privileges >= 0)
4563 arg_no_new_privileges = settings->no_new_privileges;
4564
81f345df
LP		 4565 if ((arg_settings_mask & SETTING_OOM_SCORE_ADJUST) == 0 &&
4566 settings->oom_score_adjust_set) {
4567
4568 if (!arg_settings_trusted)
5d961407 4569 log_warning("Ignoring OOMScoreAdjust= setting, file '%s' is not trusted.", path);
81f345df
LP		 4570 else {
4571 arg_oom_score_adjust = settings->oom_score_adjust;
4572 arg_oom_score_adjust_set = true;
4573 }
4574 }
4575
d107bb7d 4576 if ((arg_settings_mask & SETTING_CPU_AFFINITY) == 0 &&
0985c7c4 4577 settings->cpu_set.set) {
d107bb7d
LP		 4578
4579 if (!arg_settings_trusted)
5d961407 4580 log_warning("Ignoring CPUAffinity= setting, file '%s' is not trusted.", path);
d107bb7d 4581 else {
0985c7c4
ZJS		 4582 cpu_set_reset(&arg_cpu_set);
4583 arg_cpu_set = settings->cpu_set;
4584 settings->cpu_set = (CPUSet) {};
d107bb7d
LP		 4585 }
4586 }
4587
09d423e9
LP		 4588 if ((arg_settings_mask & SETTING_RESOLV_CONF) == 0 &&
4589 settings->resolv_conf != _RESOLV_CONF_MODE_INVALID)
4590 arg_resolv_conf = settings->resolv_conf;
4591
4e1d6aa9
LP		 4592 if ((arg_settings_mask & SETTING_LINK_JOURNAL) == 0 &&
4593 settings->link_journal != _LINK_JOURNAL_INVALID) {
4594
4595 if (!arg_settings_trusted)
4596 log_warning("Ignoring journal link setting, file '%s' is not trusted.", path);
4597 else {
4598 arg_link_journal = settings->link_journal;
4599 arg_link_journal_try = settings->link_journal_try;
4600 }
4601 }
4602
1688841f
LP		 4603 if ((arg_settings_mask & SETTING_TIMEZONE) == 0 &&
4604 settings->timezone != _TIMEZONE_MODE_INVALID)
4605 arg_timezone = settings->timezone;
4606
de40a303
LP		 4607 if ((arg_settings_mask & SETTING_SLICE) == 0 &&
4608 settings->slice) {
4609
4610 if (!arg_settings_trusted)
4611 log_warning("Ignoring slice setting, file '%s' is not trusted.", path);
4612 else
4613 free_and_replace(arg_slice, settings->slice);
4614 }
4615
4616 if ((arg_settings_mask & SETTING_USE_CGNS) == 0 &&
4617 settings->use_cgns >= 0) {
4618
4619 if (!arg_settings_trusted)
4620 log_warning("Ignoring cgroup namespace setting, file '%s' is not trusted.", path);
4621 else
4622 arg_use_cgns = settings->use_cgns;
4623 }
4624
4625 if ((arg_settings_mask & SETTING_CLONE_NS_FLAGS) == 0 &&
f5fbe71d 4626 settings->clone_ns_flags != ULONG_MAX) {
de40a303
LP		 4627
4628 if (!arg_settings_trusted)
4629 log_warning("Ignoring namespace setting, file '%s' is not trusted.", path);
4630 else
4631 arg_clone_ns_flags = settings->clone_ns_flags;
4632 }
4633
4634 if ((arg_settings_mask & SETTING_CONSOLE_MODE) == 0 &&
4635 settings->console_mode >= 0) {
4636
4637 if (!arg_settings_trusted)
4638 log_warning("Ignoring console mode setting, file '%s' is not trusted.", path);
4639 else
4640 arg_console_mode = settings->console_mode;
4641 }
4642
d3689b94
LP		 4643 if ((arg_settings_mask & SETTING_SUPPRESS_SYNC) == 0 &&
4644 settings->suppress_sync >= 0)
4a4654e0
LP		 4645 arg_suppress_sync = settings->suppress_sync;
4646
de40a303
LP		 4647 /* The following properties can only be set through the OCI settings logic, not from the command line, hence we
4648 * don't consult arg_settings_mask for them. */
4649
4650 sd_bus_message_unref(arg_property_message);
4651 arg_property_message = TAKE_PTR(settings->properties);
4652
4653 arg_console_width = settings->console_width;
4654 arg_console_height = settings->console_height;
4655
b2645747 4656 device_node_array_free(arg_extra_nodes, arg_n_extra_nodes);
de40a303
LP		 4657 arg_extra_nodes = TAKE_PTR(settings->extra_nodes);
4658 arg_n_extra_nodes = settings->n_extra_nodes;
4659
f757855e
LP		 4660 return 0;
4661}
4662
5d961407
LP		 4663static int load_settings(void) {
4664 _cleanup_(settings_freep) Settings *settings = NULL;
4665 _cleanup_fclose_ FILE *f = NULL;
3603f151 4666 _cleanup_free_ char *p = NULL;
5d961407
LP		 4667 int r;
4668
de40a303
LP		 4669 if (arg_oci_bundle)
4670 return 0;
4671
5d961407
LP		 4672 /* If all settings are masked, there's no point in looking for
4673 * the settings file */
d7a0f1f4 4674 if (FLAGS_SET(arg_settings_mask, _SETTINGS_MASK_ALL))
5d961407
LP		 4675 return 0;
4676
5d961407
LP		 4677 /* We first look in the admin's directories in /etc and /run */
4678 FOREACH_STRING(i, "/etc/systemd/nspawn", "/run/systemd/nspawn") {
4679 _cleanup_free_ char *j = NULL;
4680
3603f151 4681 j = path_join(i, arg_settings_filename);
5d961407
LP		 4682 if (!j)
4683 return log_oom();
4684
4685 f = fopen(j, "re");
4686 if (f) {
4687 p = TAKE_PTR(j);
4688
4689 /* By default, we trust configuration from /etc and /run */
4690 if (arg_settings_trusted < 0)
4691 arg_settings_trusted = true;
4692
4693 break;
4694 }
4695
4696 if (errno != ENOENT)
4697 return log_error_errno(errno, "Failed to open %s: %m", j);
4698 }
4699
4700 if (!f) {
4701 /* After that, let's look for a file next to the
4702 * actual image we shall boot. */
4703
4704 if (arg_image) {
162f6477
LP		 4705 r = file_in_same_dir(arg_image, arg_settings_filename, &p);
4706 if (r < 0)
4707 return log_error_errno(r, "Failed to generate settings path from image path: %m");
4708 } else if (arg_directory) {
4709 r = file_in_same_dir(arg_directory, arg_settings_filename, &p);
4710 if (r < 0 && r != -EADDRNOTAVAIL) /* if directory is root fs, don't complain */
4711 return log_error_errno(r, "Failed to generate settings path from directory path: %m");
5d961407
LP		 4712 }
4713
4714 if (p) {
4715 f = fopen(p, "re");
4716 if (!f && errno != ENOENT)
4717 return log_error_errno(errno, "Failed to open %s: %m", p);
4718
4719 /* By default, we do not trust configuration from /var/lib/machines */
4720 if (arg_settings_trusted < 0)
4721 arg_settings_trusted = false;
4722 }
4723 }
4724
4725 if (!f)
4726 return 0;
4727
4728 log_debug("Settings are trusted: %s", yes_no(arg_settings_trusted));
4729
4730 r = settings_load(f, p, &settings);
4731 if (r < 0)
4732 return r;
4733
4734 return merge_settings(settings, p);
4735}
4736
de40a303
LP		 4737static int load_oci_bundle(void) {
4738 _cleanup_(settings_freep) Settings *settings = NULL;
4739 int r;
4740
4741 if (!arg_oci_bundle)
4742 return 0;
4743
4744 /* By default let's trust OCI bundles */
4745 if (arg_settings_trusted < 0)
4746 arg_settings_trusted = true;
4747
4748 r = oci_load(NULL, arg_oci_bundle, &settings);
4749 if (r < 0)
4750 return r;
4751
4752 return merge_settings(settings, arg_oci_bundle);
4753}
4754
3acc84eb 4755static int run_container(
2d845785 4756 DissectedImage *dissected_image,
b0067625
ZJS		 4757 FDSet *fds,
4758 char veth_name[IFNAMSIZ], bool *veth_created,
761cf19d 4759 struct ExposeArgs *expose_args,
3acc84eb 4760 int *master, pid_t *pid, int *ret) {
b0067625
ZJS		 4761
4762 static const struct sigaction sa = {
4763 .sa_handler = nop_signal_handler,
e28c7cd0 4764 .sa_flags = SA_NOCLDSTOP|SA_RESTART,
b0067625
ZJS		 4765 };
4766
8e766630 4767 _cleanup_(release_lock_file) LockFile uid_shift_lock = LOCK_FILE_INIT;
5bb1d7fb 4768 _cleanup_close_ int etc_passwd_lock = -EBADF;
b0067625 4769 _cleanup_close_pair_ int
19ee48a6
YW		 4770 fd_inner_socket_pair[2] = PIPE_EBADF,
4771 fd_outer_socket_pair[2] = PIPE_EBADF;
8199d554 4772
5bb1d7fb 4773 _cleanup_close_ int notify_socket = -EBADF, mntns_fd = -EBADF, fd_kmsg_fifo = -EBADF;
b0067625 4774 _cleanup_(barrier_destroy) Barrier barrier = BARRIER_NULL;
5773024d 4775 _cleanup_(sd_event_source_unrefp) sd_event_source *notify_event_source = NULL;
b0067625
ZJS		 4776 _cleanup_(sd_event_unrefp) sd_event *event = NULL;
4777 _cleanup_(pty_forward_freep) PTYForward *forward = NULL;
4778 _cleanup_(sd_netlink_unrefp) sd_netlink *rtnl = NULL;
abdb9b08 4779 _cleanup_(sd_bus_flush_close_unrefp) sd_bus *bus = NULL;
2f893044
LP		 4780 _cleanup_free_ uid_t *bind_user_uid = NULL;
4781 size_t n_bind_user_uid = 0;
b0067625 4782 ContainerStatus container_status = 0;
b0067625
ZJS		 4783 int ifi = 0, r;
4784 ssize_t l;
4785 sigset_t mask_chld;
254d1313 4786 _cleanup_close_ int child_netns_fd = -EBADF;
b0067625
ZJS		 4787
4788 assert_se(sigemptyset(&mask_chld) == 0);
4789 assert_se(sigaddset(&mask_chld, SIGCHLD) == 0);
4790
4791 if (arg_userns_mode == USER_NAMESPACE_PICK) {
4792 /* When we shall pick the UID/GID range, let's first lock /etc/passwd, so that we can safely
4793 * check with getpwuid() if the specific user already exists. Note that /etc might be
4794 * read-only, in which case this will fail with EROFS. But that's really OK, as in that case we
4795 * can be reasonably sure that no users are going to be added. Note that getpwuid() checks are
4796 * really just an extra safety net. We kinda assume that the UID range we allocate from is
4797 * really ours. */
4798
4799 etc_passwd_lock = take_etc_passwd_lock(NULL);
4800 if (etc_passwd_lock < 0 && etc_passwd_lock != -EROFS)
4801 return log_error_errno(etc_passwd_lock, "Failed to take /etc/passwd lock: %m");
4802 }
4803
4804 r = barrier_create(&barrier);
4805 if (r < 0)
4806 return log_error_errno(r, "Cannot initialize IPC barrier: %m");
4807
5d9d3fcb
CB		 4808 if (socketpair(AF_UNIX, SOCK_SEQPACKET|SOCK_CLOEXEC, 0, fd_inner_socket_pair) < 0)
4809 return log_error_errno(errno, "Failed to create inner socket pair: %m");
4810
af06cd30
CB		 4811 if (socketpair(AF_UNIX, SOCK_SEQPACKET|SOCK_CLOEXEC, 0, fd_outer_socket_pair) < 0)
4812 return log_error_errno(errno, "Failed to create outer socket pair: %m");
b0067625 4813
b0067625
ZJS		 4814 /* Child can be killed before execv(), so handle SIGCHLD in order to interrupt
4815 * parent's blocking calls and give it a chance to call wait() and terminate. */
4816 r = sigprocmask(SIG_UNBLOCK, &mask_chld, NULL);
4817 if (r < 0)
4818 return log_error_errno(errno, "Failed to change the signal mask: %m");
4819
4820 r = sigaction(SIGCHLD, &sa, NULL);
4821 if (r < 0)
4822 return log_error_errno(errno, "Failed to install SIGCHLD handler: %m");
4823
d7bea6b6 4824 if (arg_network_namespace_path) {
5b4855ab
DDM		 4825 child_netns_fd = open(arg_network_namespace_path, O_RDONLY|O_NOCTTY|O_CLOEXEC);
4826 if (child_netns_fd < 0)
d7bea6b6
DP		 4827 return log_error_errno(errno, "Cannot open file %s: %m", arg_network_namespace_path);
4828
54c2459d 4829 r = fd_is_ns(child_netns_fd, CLONE_NEWNET);
6619ad88
LP		 4830 if (r == -EUCLEAN)
4831 log_debug_errno(r, "Cannot determine if passed network namespace path '%s' really refers to a network namespace, assuming it does.", arg_network_namespace_path);
4832 else if (r < 0)
d7bea6b6 4833 return log_error_errno(r, "Failed to check %s fs type: %m", arg_network_namespace_path);
c6147113
LP		 4834 else if (r == 0)
4835 return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
4836 "Path %s doesn't refer to a network namespace, refusing.", arg_network_namespace_path);
d7bea6b6
DP		 4837 }
4838
b0067625
ZJS		 4839 *pid = raw_clone(SIGCHLD|CLONE_NEWNS);
4840 if (*pid < 0)
4841 return log_error_errno(errno, "clone() failed%s: %m",
4842 errno == EINVAL ?
4843 ", do you have namespace support enabled in your kernel? (You need UTS, IPC, PID and NET namespacing built in)" : "");
4844
4845 if (*pid == 0) {
4846 /* The outer child only has a file system namespace. */
4847 barrier_set_role(&barrier, BARRIER_CHILD);
4848
5d9d3fcb 4849 fd_inner_socket_pair[0] = safe_close(fd_inner_socket_pair[0]);
af06cd30 4850 fd_outer_socket_pair[0] = safe_close(fd_outer_socket_pair[0]);
b0067625
ZJS		 4851
4852 (void) reset_all_signal_handlers();
4853 (void) reset_signal_mask();
4854
4855 r = outer_child(&barrier,
4856 arg_directory,
2d845785 4857 dissected_image,
af06cd30 4858 fd_outer_socket_pair[1],
5d9d3fcb 4859 fd_inner_socket_pair[1],
d7bea6b6 4860 fds,
5b4855ab 4861 child_netns_fd);
b0067625
ZJS		 4862 if (r < 0)
4863 _exit(EXIT_FAILURE);
4864
4865 _exit(EXIT_SUCCESS);
4866 }
4867
4868 barrier_set_role(&barrier, BARRIER_PARENT);
4869
e4077ff6 4870 fdset_close(fds);
b0067625 4871
5d9d3fcb 4872 fd_inner_socket_pair[1] = safe_close(fd_inner_socket_pair[1]);
af06cd30 4873 fd_outer_socket_pair[1] = safe_close(fd_outer_socket_pair[1]);
b0067625
ZJS		 4874
4875 if (arg_userns_mode != USER_NAMESPACE_NO) {
af06cd30 4876 mntns_fd = receive_one_fd(fd_outer_socket_pair[0], 0);
b71a0192
CB		 4877 if (mntns_fd < 0)
4878 return log_error_errno(mntns_fd, "Failed to receive mount namespace fd from outer child: %m");
4879
b0067625 4880 /* The child just let us know the UID shift it might have read from the image. */
af06cd30 4881 l = recv(fd_outer_socket_pair[0], &arg_uid_shift, sizeof arg_uid_shift, 0);
b0067625
ZJS		 4882 if (l < 0)
4883 return log_error_errno(errno, "Failed to read UID shift: %m");
c6147113
LP		 4884 if (l != sizeof arg_uid_shift)
4885 return log_error_errno(SYNTHETIC_ERRNO(EIO), "Short read while reading UID shift.");
b0067625
ZJS		 4886
4887 if (arg_userns_mode == USER_NAMESPACE_PICK) {
4888 /* If we are supposed to pick the UID shift, let's try to use the shift read from the
4889 * image, but if that's already in use, pick a new one, and report back to the child,
4890 * which one we now picked. */
4891
4892 r = uid_shift_pick(&arg_uid_shift, &uid_shift_lock);
4893 if (r < 0)
4894 return log_error_errno(r, "Failed to pick suitable UID/GID range: %m");
4895
af06cd30 4896 l = send(fd_outer_socket_pair[0], &arg_uid_shift, sizeof arg_uid_shift, MSG_NOSIGNAL);
b0067625
ZJS		 4897 if (l < 0)
4898 return log_error_errno(errno, "Failed to send UID shift: %m");
c6147113
LP		 4899 if (l != sizeof arg_uid_shift)
4900 return log_error_errno(SYNTHETIC_ERRNO(EIO), "Short write while writing UID shift.");
b0067625 4901 }
2f893044
LP		 4902
4903 n_bind_user_uid = strv_length(arg_bind_user);
4904 if (n_bind_user_uid > 0) {
4905 /* Right after the UID shift, we'll receive the list of UID mappings for the
4906 * --bind-user= logic. Always a quadruplet of payload and host UID + GID. */
4907
4908 bind_user_uid = new(uid_t, n_bind_user_uid*4);
4909 if (!bind_user_uid)
4910 return log_oom();
4911
4912 for (size_t i = 0; i < n_bind_user_uid; i++) {
af06cd30 4913 l = recv(fd_outer_socket_pair[0], bind_user_uid + i*4, sizeof(uid_t)*4, 0);
2f893044
LP		 4914 if (l < 0)
4915 return log_error_errno(errno, "Failed to read user UID map pair: %m");
4916 if (l != sizeof(uid_t)*4)
4917 return log_full_errno(l == 0 ? LOG_DEBUG : LOG_WARNING,
4918 SYNTHETIC_ERRNO(EIO),
4919 "Short read while reading bind user UID pairs.");
4920 }
4921 }
b0067625
ZJS		 4922 }
4923
8199d554
LP		 4924 if (arg_unified_cgroup_hierarchy == CGROUP_UNIFIED_UNKNOWN) {
4925 /* The child let us know the support cgroup mode it might have read from the image. */
fefb7a6d 4926 l = recv(fd_outer_socket_pair[0], &arg_unified_cgroup_hierarchy, sizeof(arg_unified_cgroup_hierarchy), 0);
8199d554
LP		 4927 if (l < 0)
4928 return log_error_errno(errno, "Failed to read cgroup mode: %m");
c6147113 4929 if (l != sizeof(arg_unified_cgroup_hierarchy))
c0f86d66 4930 return log_error_errno(SYNTHETIC_ERRNO(EIO), "Short read while reading cgroup mode (%zi bytes).%s",
c6147113 4931 l, l == 0 ? " The child is most likely dead." : "");
8199d554
LP		 4932 }
4933
b0067625 4934 /* Wait for the outer child. */
d2e0ac3d
LP		 4935 r = wait_for_terminate_and_check("(sd-namespace)", *pid, WAIT_LOG_ABNORMAL);
4936 if (r < 0)
4937 return r;
4938 if (r != EXIT_SUCCESS)
4939 return -EIO;
b0067625
ZJS		 4940
4941 /* And now retrieve the PID of the inner child. */
af06cd30 4942 l = recv(fd_outer_socket_pair[0], pid, sizeof *pid, 0);
b0067625
ZJS		 4943 if (l < 0)
4944 return log_error_errno(errno, "Failed to read inner child PID: %m");
c6147113
LP		 4945 if (l != sizeof *pid)
4946 return log_error_errno(SYNTHETIC_ERRNO(EIO), "Short read while reading inner child PID.");
b0067625
ZJS		 4947
4948 /* We also retrieve container UUID in case it was generated by outer child */
af06cd30 4949 l = recv(fd_outer_socket_pair[0], &arg_uuid, sizeof arg_uuid, 0);
b0067625
ZJS		 4950 if (l < 0)
4951 return log_error_errno(errno, "Failed to read container machine ID: %m");
c6147113
LP		 4952 if (l != sizeof(arg_uuid))
4953 return log_error_errno(SYNTHETIC_ERRNO(EIO), "Short read while reading container machined ID.");
b0067625
ZJS		 4954
4955 /* We also retrieve the socket used for notifications generated by outer child */
af06cd30 4956 notify_socket = receive_one_fd(fd_outer_socket_pair[0], 0);
b0067625
ZJS		 4957 if (notify_socket < 0)
4958 return log_error_errno(notify_socket,
4959 "Failed to receive notification socket from the outer child: %m");
4960
4961 log_debug("Init process invoked as PID "PID_FMT, *pid);
4962
4963 if (arg_userns_mode != USER_NAMESPACE_NO) {
c6147113
LP		 4964 if (!barrier_place_and_sync(&barrier)) /* #1 */
4965 return log_error_errno(SYNTHETIC_ERRNO(ESRCH), "Child died too early.");
b0067625 4966
2f893044 4967 r = setup_uid_map(*pid, bind_user_uid, n_bind_user_uid);
b0067625
ZJS		 4968 if (r < 0)
4969 return r;
4970
4971 (void) barrier_place(&barrier); /* #2 */
4972 }
4973
4974 if (arg_private_network) {
75116558
PS		 4975 if (!arg_network_namespace_path) {
4976 /* Wait until the child has unshared its network namespace. */
c6147113
LP		 4977 if (!barrier_place_and_sync(&barrier)) /* #3 */
4978 return log_error_errno(SYNTHETIC_ERRNO(ESRCH), "Child died too early");
75116558
PS		 4979 }
4980
5b4855ab
DDM		 4981 if (child_netns_fd < 0) {
4982 /* Make sure we have an open file descriptor to the child's network
4983 * namespace so it stays alive even if the child exits. */
4984 r = namespace_open(*pid, NULL, NULL, &child_netns_fd, NULL, NULL);
4985 if (r < 0)
4986 return log_error_errno(r, "Failed to open child network namespace: %m");
4987 }
4988
4989 r = move_network_interfaces(child_netns_fd, arg_network_interfaces);
b0067625
ZJS		 4990 if (r < 0)
4991 return r;
4992
4993 if (arg_network_veth) {
4994 r = setup_veth(arg_machine, *pid, veth_name,
4995 arg_network_bridge || arg_network_zone);
4996 if (r < 0)
4997 return r;
4998 else if (r > 0)
4999 ifi = r;
5000
5001 if (arg_network_bridge) {
5002 /* Add the interface to a bridge */
5003 r = setup_bridge(veth_name, arg_network_bridge, false);
5004 if (r < 0)
5005 return r;
5006 if (r > 0)
5007 ifi = r;
5008 } else if (arg_network_zone) {
5009 /* Add the interface to a bridge, possibly creating it */
5010 r = setup_bridge(veth_name, arg_network_zone, true);
5011 if (r < 0)
5012 return r;
5013 if (r > 0)
5014 ifi = r;
5015 }
5016 }
5017
5018 r = setup_veth_extra(arg_machine, *pid, arg_network_veth_extra);
5019 if (r < 0)
5020 return r;
5021
5022 /* We created the primary and extra veth links now; let's remember this, so that we know to
5023 remove them later on. Note that we don't bother with removing veth links that were created
5024 here when their setup failed half-way, because in that case the kernel should be able to
5025 remove them on its own, since they cannot be referenced by anything yet. */
5026 *veth_created = true;
5027
5028 r = setup_macvlan(arg_machine, *pid, arg_network_macvlan);
5029 if (r < 0)
5030 return r;
5031
5032 r = setup_ipvlan(arg_machine, *pid, arg_network_ipvlan);
5033 if (r < 0)
5034 return r;
5035 }
5036
abdb9b08
LP		 5037 if (arg_register || !arg_keep_unit) {
5038 r = sd_bus_default_system(&bus);
5039 if (r < 0)
5040 return log_error_errno(r, "Failed to open system bus: %m");
e5a2d8b5
LP		 5041
5042 r = sd_bus_set_close_on_exit(bus, false);
5043 if (r < 0)
5044 return log_error_errno(r, "Failed to disable close-on-exit behaviour: %m");
abdb9b08
LP		 5045 }
5046
5047 if (!arg_keep_unit) {
5048 /* When a new scope is created for this container, then we'll be registered as its controller, in which
5049 * case PID 1 will send us a friendly RequestStop signal, when it is asked to terminate the
5050 * scope. Let's hook into that, and cleanly shut down the container, and print a friendly message. */
5051
75152a4d
LP		 5052 r = sd_bus_match_signal_async(
5053 bus,
5054 NULL,
5055 "org.freedesktop.systemd1",
5056 NULL,
5057 "org.freedesktop.systemd1.Scope",
5058 "RequestStop",
5059 on_request_stop, NULL, PID_TO_PTR(*pid));
abdb9b08 5060 if (r < 0)
75152a4d 5061 return log_error_errno(r, "Failed to request RequestStop match: %m");
abdb9b08
LP		 5062 }
5063
b0067625
ZJS		 5064 if (arg_register) {
5065 r = register_machine(
abdb9b08 5066 bus,
b0067625
ZJS		 5067 arg_machine,
5068 *pid,
5069 arg_directory,
5070 arg_uuid,
5071 ifi,
5072 arg_slice,
5073 arg_custom_mounts, arg_n_custom_mounts,
5074 arg_kill_signal,
5075 arg_property,
de40a303 5076 arg_property_message,
b0067625
ZJS		 5077 arg_keep_unit,
5078 arg_container_service_name);
5079 if (r < 0)
5080 return r;
abdb9b08 5081
cd2dfc6f
LP		 5082 } else if (!arg_keep_unit) {
5083 r = allocate_scope(
abdb9b08 5084 bus,
cd2dfc6f
LP		 5085 arg_machine,
5086 *pid,
5087 arg_slice,
5088 arg_custom_mounts, arg_n_custom_mounts,
5089 arg_kill_signal,
de40a303
LP		 5090 arg_property,
5091 arg_property_message);
cd2dfc6f
LP		 5092 if (r < 0)
5093 return r;
5094
5095 } else if (arg_slice || arg_property)
5096 log_notice("Machine and scope registration turned off, --slice= and --property= settings will have no effect.");
b0067625 5097
27da7ef0 5098 r = create_subcgroup(*pid, arg_keep_unit, arg_unified_cgroup_hierarchy);
b0067625
ZJS		 5099 if (r < 0)
5100 return r;
5101
27da7ef0 5102 r = sync_cgroup(*pid, arg_unified_cgroup_hierarchy, arg_uid_shift);
720f0a2f
LP		 5103 if (r < 0)
5104 return r;
b0067625 5105
de54e02d 5106 r = chown_cgroup(*pid, arg_unified_cgroup_hierarchy, arg_uid_shift);
b0067625
ZJS		 5107 if (r < 0)
5108 return r;
5109
5110 /* Notify the child that the parent is ready with all
5111 * its setup (including cgroup-ification), and that
5112 * the child can now hand over control to the code to
5113 * run inside the container. */
75116558 5114 (void) barrier_place(&barrier); /* #4 */
b0067625
ZJS		 5115
5116 /* Block SIGCHLD here, before notifying child.
5117 * process_pty() will handle it with the other signals. */
5118 assert_se(sigprocmask(SIG_BLOCK, &mask_chld, NULL) >= 0);
5119
5120 /* Reset signal to default */
9c274488 5121 r = default_signals(SIGCHLD);
b0067625
ZJS		 5122 if (r < 0)
5123 return log_error_errno(r, "Failed to reset SIGCHLD: %m");
5124
5125 r = sd_event_new(&event);
5126 if (r < 0)
5127 return log_error_errno(r, "Failed to get default event source: %m");
5128
8fd010bb
LP		 5129 (void) sd_event_set_watchdog(event, true);
5130
abdb9b08
LP		 5131 if (bus) {
5132 r = sd_bus_attach_event(bus, event, 0);
5133 if (r < 0)
5134 return log_error_errno(r, "Failed to attach bus to event loop: %m");
5135 }
5136
e96ceaba 5137 r = setup_notify_parent(event, notify_socket, PID_TO_PTR(*pid), &notify_event_source);
b0067625
ZJS		 5138 if (r < 0)
5139 return r;
5140
b71a0192
CB		 5141 if (arg_userns_mode != USER_NAMESPACE_NO) {
5142 r = wipe_fully_visible_fs(mntns_fd);
5143 if (r < 0)
5144 return r;
5145 mntns_fd = safe_close(mntns_fd);
5146 }
5147
b0067625 5148 /* Let the child know that we are ready and wait that the child is completely ready now. */
c6147113
LP		 5149 if (!barrier_place_and_sync(&barrier)) /* #5 */
5150 return log_error_errno(SYNTHETIC_ERRNO(ESRCH), "Child died too early.");
b0067625 5151
38ccb557 5152 /* At this point we have made use of the UID we picked, and thus nss-systemd/systemd-machined.service
b0067625
ZJS		 5153 * will make them appear in getpwuid(), thus we can release the /etc/passwd lock. */
5154 etc_passwd_lock = safe_close(etc_passwd_lock);
5155
04f590a4
LP		 5156 (void) sd_notifyf(false,
5157 "STATUS=Container running.\n"
5158 "X_NSPAWN_LEADER_PID=" PID_FMT, *pid);
4bf4f50f
ZJS		 5159 if (!arg_notify_ready) {
5160 r = sd_notify(false, "READY=1\n");
5161 if (r < 0)
5162 log_warning_errno(r, "Failed to send readiness notification, ignoring: %m");
5163 }
b0067625
ZJS		 5164
5165 if (arg_kill_signal > 0) {
5166 /* Try to kill the init system on SIGINT or SIGTERM */
919f5ae0
LP		 5167 (void) sd_event_add_signal(event, NULL, SIGINT, on_orderly_shutdown, PID_TO_PTR(*pid));
5168 (void) sd_event_add_signal(event, NULL, SIGTERM, on_orderly_shutdown, PID_TO_PTR(*pid));
b0067625
ZJS		 5169 } else {
5170 /* Immediately exit */
919f5ae0
LP		 5171 (void) sd_event_add_signal(event, NULL, SIGINT, NULL, NULL);
5172 (void) sd_event_add_signal(event, NULL, SIGTERM, NULL, NULL);
b0067625
ZJS		 5173 }
5174
988851b6
LP		 5175 (void) sd_event_add_signal(event, NULL, SIGRTMIN+18, sigrtmin18_handler, NULL);
5176
5177 r = sd_event_add_memory_pressure(event, NULL, NULL, NULL);
5178 if (r < 0)
5179 log_debug_errno(r, "Failed allocate memory pressure event source, ignoring: %m");
5180
6916b164 5181 /* Exit when the child exits */
919f5ae0 5182 (void) sd_event_add_signal(event, NULL, SIGCHLD, on_sigchld, PID_TO_PTR(*pid));
b0067625 5183
b07ee903
CB		 5184 /* Retrieve the kmsg fifo allocated by inner child */
5185 fd_kmsg_fifo = receive_one_fd(fd_inner_socket_pair[0], 0);
5186 if (fd_kmsg_fifo < 0)
5187 return log_error_errno(fd_kmsg_fifo, "Failed to receive kmsg fifo from inner child: %m");
5188
b0067625 5189 if (arg_expose_ports) {
b07ee903 5190 r = expose_port_watch_rtnl(event, fd_inner_socket_pair[0], on_address_change, expose_args, &rtnl);
b0067625
ZJS		 5191 if (r < 0)
5192 return r;
5193
deff68e7
FW		 5194 (void) expose_port_execute(rtnl, &expose_args->fw_ctx, arg_expose_ports, AF_INET, &expose_args->address4);
5195 (void) expose_port_execute(rtnl, &expose_args->fw_ctx, arg_expose_ports, AF_INET6, &expose_args->address6);
b0067625
ZJS		 5196 }
5197
3acc84eb 5198 if (arg_console_mode != CONSOLE_PIPE) {
254d1313 5199 _cleanup_close_ int fd = -EBADF;
3acc84eb 5200 PTYForwardFlags flags = 0;
de40a303 5201
3acc84eb 5202 /* Retrieve the master pty allocated by inner child */
bb1aa185 5203 fd = receive_one_fd(fd_inner_socket_pair[0], 0);
3acc84eb
FB		 5204 if (fd < 0)
5205 return log_error_errno(fd, "Failed to receive master pty from the inner child: %m");
5206
5207 switch (arg_console_mode) {
de40a303 5208
3acc84eb
FB		 5209 case CONSOLE_READ_ONLY:
5210 flags |= PTY_FORWARD_READ_ONLY;
5211
5212 _fallthrough_;
5213
5214 case CONSOLE_INTERACTIVE:
5215 flags |= PTY_FORWARD_IGNORE_VHANGUP;
5216
5217 r = pty_forward_new(event, fd, flags, &forward);
5218 if (r < 0)
5219 return log_error_errno(r, "Failed to create PTY forwarder: %m");
5220
f5fbe71d 5221 if (arg_console_width != UINT_MAX || arg_console_height != UINT_MAX)
3acc84eb
FB		 5222 (void) pty_forward_set_width_height(forward,
5223 arg_console_width,
5224 arg_console_height);
5225 break;
5226
5227 default:
5228 assert(arg_console_mode == CONSOLE_PASSIVE);
5229 }
5230
5231 *master = TAKE_FD(fd);
de40a303 5232 }
b0067625 5233
5d9d3fcb
CB		 5234 fd_inner_socket_pair[0] = safe_close(fd_inner_socket_pair[0]);
5235
b0067625
ZJS		 5236 r = sd_event_loop(event);
5237 if (r < 0)
5238 return log_error_errno(r, "Failed to run event loop: %m");
5239
de40a303
LP		 5240 if (forward) {
5241 char last_char = 0;
b0067625 5242
de40a303
LP		 5243 (void) pty_forward_get_last_char(forward, &last_char);
5244 forward = pty_forward_free(forward);
b0067625 5245
de40a303
LP		 5246 if (!arg_quiet && last_char != '\n')
5247 putc('\n', stdout);
5248 }
b0067625
ZJS		 5249
5250 /* Kill if it is not dead yet anyway */
0bb0a9fa
ZJS		 5251 if (!arg_register && !arg_keep_unit && bus)
5252 terminate_scope(bus, arg_machine);
b0067625
ZJS		 5253
5254 /* Normally redundant, but better safe than sorry */
c67b0082 5255 (void) kill(*pid, SIGKILL);
b0067625 5256
5d9d3fcb
CB		 5257 fd_kmsg_fifo = safe_close(fd_kmsg_fifo);
5258
5b4855ab
DDM		 5259 if (arg_private_network) {
5260 /* Move network interfaces back to the parent network namespace. We use `safe_fork`
5261 * to avoid having to move the parent to the child network namespace. */
5262 r = safe_fork(NULL, FORK_RESET_SIGNALS|FORK_DEATHSIG|FORK_WAIT|FORK_LOG, NULL);
5263 if (r < 0)
5264 return r;
5265
5266 if (r == 0) {
254d1313 5267 _cleanup_close_ int parent_netns_fd = -EBADF;
5b4855ab
DDM		 5268
5269 r = namespace_open(getpid(), NULL, NULL, &parent_netns_fd, NULL, NULL);
5270 if (r < 0) {
5271 log_error_errno(r, "Failed to open parent network namespace: %m");
5272 _exit(EXIT_FAILURE);
5273 }
5274
5275 r = namespace_enter(-1, -1, child_netns_fd, -1, -1);
5276 if (r < 0) {
5277 log_error_errno(r, "Failed to enter child network namespace: %m");
5278 _exit(EXIT_FAILURE);
5279 }
5280
5281 r = move_network_interfaces(parent_netns_fd, arg_network_interfaces);
5282 if (r < 0)
5283 log_error_errno(r, "Failed to move network interfaces back to parent network namespace: %m");
5284
5285 _exit(r < 0 ? EXIT_FAILURE : EXIT_SUCCESS);
5286 }
5287 }
5288
8f03de53 5289 r = wait_for_container(TAKE_PID(*pid), &container_status);
b0067625 5290
0bb0a9fa
ZJS		 5291 /* Tell machined that we are gone. */
5292 if (bus)
5293 (void) unregister_machine(bus, arg_machine);
5294
b0067625
ZJS		 5295 if (r < 0)
5296 /* We failed to wait for the container, or the container exited abnormally. */
5297 return r;
5298 if (r > 0 || container_status == CONTAINER_TERMINATED) {
27e29a1e
ZJS		 5299 /* r > 0 → The container exited with a non-zero status.
5300 * As a special case, we need to replace 133 with a different value,
5301 * because 133 is special-cased in the service file to reboot the container.
5302 * otherwise → The container exited with zero status and a reboot was not requested.
5303 */
2a49b612 5304 if (r == EXIT_FORCE_RESTART)
27e29a1e 5305 r = EXIT_FAILURE; /* replace 133 with the general failure code */
b0067625 5306 *ret = r;
b0067625
ZJS		 5307 return 0; /* finito */
5308 }
5309
5310 /* CONTAINER_REBOOTED, loop again */
5311
5312 if (arg_keep_unit) {
5313 /* Special handling if we are running as a service: instead of simply
5314 * restarting the machine we want to restart the entire service, so let's
5315 * inform systemd about this with the special exit code 133. The service
5316 * file uses RestartForceExitStatus=133 so that this results in a full
5317 * nspawn restart. This is necessary since we might have cgroup parameters
5318 * set we want to have flushed out. */
2a49b612
ZJS		 5319 *ret = EXIT_FORCE_RESTART;
5320 return 0; /* finito */
b0067625
ZJS		 5321 }
5322
deff68e7
FW		 5323 expose_port_flush(&expose_args->fw_ctx, arg_expose_ports, AF_INET, &expose_args->address4);
5324 expose_port_flush(&expose_args->fw_ctx, arg_expose_ports, AF_INET6, &expose_args->address6);
b0067625
ZJS		 5325
5326 (void) remove_veth_links(veth_name, arg_network_veth_extra);
5327 *veth_created = false;
5328 return 1; /* loop again */
5329}
5330
bf428efb 5331static int initialize_rlimits(void) {
852b6250 5332 /* The default resource limits the kernel passes to PID 1, as per kernel 5.16. Let's pass our container payload
bf428efb
LP		 5333 * the same values as the kernel originally passed to PID 1, in order to minimize differences between host and
5334 * container execution environments. */
5335
5336 static const struct rlimit kernel_defaults[_RLIMIT_MAX] = {
852b6250
LP		 5337 [RLIMIT_AS] = { RLIM_INFINITY, RLIM_INFINITY },
5338 [RLIMIT_CORE] = { 0, RLIM_INFINITY },
5339 [RLIMIT_CPU] = { RLIM_INFINITY, RLIM_INFINITY },
5340 [RLIMIT_DATA] = { RLIM_INFINITY, RLIM_INFINITY },
5341 [RLIMIT_FSIZE] = { RLIM_INFINITY, RLIM_INFINITY },
5342 [RLIMIT_LOCKS] = { RLIM_INFINITY, RLIM_INFINITY },
5343 [RLIMIT_MEMLOCK] = { DEFAULT_RLIMIT_MEMLOCK, DEFAULT_RLIMIT_MEMLOCK },
5344 [RLIMIT_MSGQUEUE] = { 819200, 819200 },
5345 [RLIMIT_NICE] = { 0, 0 },
5346 [RLIMIT_NOFILE] = { 1024, 4096 },
5347 [RLIMIT_RSS] = { RLIM_INFINITY, RLIM_INFINITY },
5348 [RLIMIT_RTPRIO] = { 0, 0 },
5349 [RLIMIT_RTTIME] = { RLIM_INFINITY, RLIM_INFINITY },
5350 [RLIMIT_STACK] = { 8388608, RLIM_INFINITY },
bf428efb
LP		 5351
5352 /* The kernel scales the default for RLIMIT_NPROC and RLIMIT_SIGPENDING based on the system's amount of
5353 * RAM. To provide best compatibility we'll read these limits off PID 1 instead of hardcoding them
5354 * here. This is safe as we know that PID 1 doesn't change these two limits and thus the original
5355 * kernel's initialization should still be valid during runtime — at least if PID 1 is systemd. Note
5356 * that PID 1 changes a number of other resource limits during early initialization which is why we
5357 * don't read the other limits from PID 1 but prefer the static table above. */
5358 };
5359
5360 int rl;
5361
5362 for (rl = 0; rl < _RLIMIT_MAX; rl++) {
bf428efb
LP		 5363 /* Let's only fill in what the user hasn't explicitly configured anyway */
5364 if ((arg_settings_mask & (SETTING_RLIMIT_FIRST << rl)) == 0) {
5365 const struct rlimit *v;
5366 struct rlimit buffer;
5367
5368 if (IN_SET(rl, RLIMIT_NPROC, RLIMIT_SIGPENDING)) {
5369 /* For these two let's read the limits off PID 1. See above for an explanation. */
5370
5371 if (prlimit(1, rl, NULL, &buffer) < 0)
5372 return log_error_errno(errno, "Failed to read resource limit RLIMIT_%s of PID 1: %m", rlimit_to_string(rl));
5373
dbf1aca6
LP		 5374 v = &buffer;
5375 } else if (rl == RLIMIT_NOFILE) {
5376 /* We nowadays bump RLIMIT_NOFILE's hard limit early in PID 1 for all
5377 * userspace. Given that nspawn containers are often run without our PID 1,
5378 * let's grant the containers a raised RLIMIT_NOFILE hard limit by default,
5379 * so that container userspace gets similar resources as host userspace
5380 * gets. */
5381 buffer = kernel_defaults[rl];
5382 buffer.rlim_max = MIN((rlim_t) read_nr_open(), (rlim_t) HIGH_RLIMIT_NOFILE);
bf428efb
LP		 5383 v = &buffer;
5384 } else
5385 v = kernel_defaults + rl;
5386
5387 arg_rlimit[rl] = newdup(struct rlimit, v, 1);
5388 if (!arg_rlimit[rl])
5389 return log_oom();
5390 }
5391
5392 if (DEBUG_LOGGING) {
5393 _cleanup_free_ char *k = NULL;
5394
5395 (void) rlimit_format(arg_rlimit[rl], &k);
5396 log_debug("Setting RLIMIT_%s to %s.", rlimit_to_string(rl), k);
5397 }
5398 }
5399
5400 return 0;
5401}
5402
287b7376 5403static int cant_be_in_netns(void) {
254d1313 5404 _cleanup_close_ int fd = -EBADF;
287b7376
LP		 5405 struct ucred ucred;
5406 int r;
5407
5408 /* Check if we are in the same netns as udev. If we aren't, then device monitoring (and thus waiting
5409 * for loopback block devices) won't work, and we will hang. Detect this case and exit early with a
5410 * nice message. */
5411
5412 if (!arg_image) /* only matters if --image= us used, i.e. we actually need to use loopback devices */
5413 return 0;
5414
5415 fd = socket(AF_UNIX, SOCK_SEQPACKET|SOCK_NONBLOCK|SOCK_CLOEXEC, 0);
5416 if (fd < 0)
5417 return log_error_errno(errno, "Failed to allocate udev control socket: %m");
5418
1861986a
LP		 5419 r = connect_unix_path(fd, AT_FDCWD, "/run/udev/control");
5420 if (r < 0) {
5421 if (r == -ENOENT || ERRNO_IS_DISCONNECT(r))
287b7376
LP		 5422 return log_error_errno(SYNTHETIC_ERRNO(EOPNOTSUPP),
5423 "Sorry, but --image= requires access to the host's /run/ hierarchy, since we need access to udev.");
5424
1861986a 5425 return log_error_errno(r, "Failed to connect socket to udev control socket: %m");
287b7376
LP		 5426 }
5427
5428 r = getpeercred(fd, &ucred);
5429 if (r < 0)
5430 return log_error_errno(r, "Failed to determine peer of udev control socket: %m");
5431
f7a2dc3d 5432 r = in_same_namespace(ucred.pid, 0, NAMESPACE_NET);
287b7376 5433 if (r < 0)
f7a2dc3d
CB		 5434 return log_error_errno(r, "Failed to determine network namespace of udev: %m");
5435 if (r == 0)
287b7376
LP		 5436 return log_error_errno(SYNTHETIC_ERRNO(EOPNOTSUPP),
5437 "Sorry, but --image= is only supported in the main network namespace, since we need access to udev/AF_NETLINK.");
5438 return 0;
5439}
5440
44dbef90 5441static int run(int argc, char *argv[]) {
4c27749b 5442 bool remove_directory = false, remove_image = false, veth_created = false, remove_tmprootdir = false;
5bb1d7fb 5443 _cleanup_close_ int master = -EBADF;
03cfe0d5 5444 _cleanup_fdset_free_ FDSet *fds = NULL;
2d845785 5445 int r, n_fd_passed, ret = EXIT_SUCCESS;
5aa3eba5 5446 char veth_name[IFNAMSIZ] = "";
761cf19d 5447 struct ExposeArgs expose_args = {};
8e766630 5448 _cleanup_(release_lock_file) LockFile tree_global_lock = LOCK_FILE_INIT, tree_local_lock = LOCK_FILE_INIT;
c67b0082 5449 char tmprootdir[] = "/tmp/nspawn-root-XXXXXX";
2d845785 5450 _cleanup_(loop_device_unrefp) LoopDevice *loop = NULL;
18b5886e 5451 _cleanup_(dissected_image_unrefp) DissectedImage *dissected_image = NULL;
761cf19d 5452 _cleanup_(fw_ctx_freep) FirewallContext *fw_ctx = NULL;
7bf011e3 5453 pid_t pid = 0;
03cfe0d5
LP		 5454
5455 log_parse_environment();
5456 log_open();
415fc41c 5457
03cfe0d5
LP		 5458 r = parse_argv(argc, argv);
5459 if (r <= 0)
5460 goto finish;
5461
38ee19c0
ZJS		 5462 if (geteuid() != 0) {
5463 r = log_warning_errno(SYNTHETIC_ERRNO(EPERM),
5464 argc >= 2 ? "Need to be root." :
5465 "Need to be root (and some arguments are usually required).\nHint: try --help");
03cfe0d5 5466 goto finish;
38ee19c0 5467 }
fba868fa 5468
287b7376
LP		 5469 r = cant_be_in_netns();
5470 if (r < 0)
5471 goto finish;
5472
bf428efb
LP		 5473 r = initialize_rlimits();
5474 if (r < 0)
5475 goto finish;
5476
de40a303
LP		 5477 r = load_oci_bundle();
5478 if (r < 0)
5479 goto finish;
5480
f757855e
LP		 5481 r = determine_names();
5482 if (r < 0)
5483 goto finish;
5484
5485 r = load_settings();
5486 if (r < 0)
5487 goto finish;
5488
d4d99bc6 5489 r = cg_unified();
5eee8290
LP		 5490 if (r < 0) {
5491 log_error_errno(r, "Failed to determine whether the unified cgroups hierarchy is used: %m");
5492 goto finish;
5493 }
5494
f757855e
LP		 5495 r = verify_arguments();
5496 if (r < 0)
5497 goto finish;
03cfe0d5 5498
49048684
ZJS		 5499 /* Reapply environment settings. */
5500 (void) detect_unified_cgroup_hierarchy_from_environment();
8199d554 5501
2949ff26
LP		 5502 /* Ignore SIGPIPE here, because we use splice() on the ptyfwd stuff and that will generate SIGPIPE if
5503 * the result is closed. Note that the container payload child will reset signal mask+handler anyway,
5504 * so just turning this off here means we only turn it off in nspawn itself, not any children. */
9c274488 5505 (void) ignore_signals(SIGPIPE);
2949ff26 5506
03cfe0d5
LP		 5507 n_fd_passed = sd_listen_fds(false);
5508 if (n_fd_passed > 0) {
5509 r = fdset_new_listen_fds(&fds, false);
5510 if (r < 0) {
5511 log_error_errno(r, "Failed to collect file descriptors: %m");
5512 goto finish;
5513 }
5514 }
5515
83e803a9
ZJS		 5516 /* The "default" umask. This is appropriate for most file and directory
5517 * operations performed by nspawn, and is the umask that will be used for
5518 * the child. Functions like copy_devnodes() change the umask temporarily. */
5519 umask(0022);
5520
03cfe0d5
LP		 5521 if (arg_directory) {
5522 assert(!arg_image);
5523
b35ca61a
LP		 5524 /* Safety precaution: let's not allow running images from the live host OS image, as long as
5525 * /var from the host will propagate into container dynamically (because bad things happen if
5526 * two systems write to the same /var). Let's allow it for the special cases where /var is
5527 * either copied (i.e. --ephemeral) or replaced (i.e. --volatile=yes|state). */
5528 if (path_equal(arg_directory, "/") && !(arg_ephemeral || IN_SET(arg_volatile_mode, VOLATILE_YES, VOLATILE_STATE))) {
1406bd66
LP		 5529 r = log_error_errno(SYNTHETIC_ERRNO(EINVAL),
5530 "Spawning container on root directory is not supported. Consider using --ephemeral, --volatile=yes or --volatile=state.");
03cfe0d5
LP		 5531 goto finish;
5532 }
5533
5534 if (arg_ephemeral) {
5535 _cleanup_free_ char *np = NULL;
5536
8d4aa2bb 5537 r = chase_symlinks_and_update(&arg_directory, 0);
3f342ec4
LP		 5538 if (r < 0)
5539 goto finish;
5540
7bf011e3
LP		 5541 /* If the specified path is a mount point we generate the new snapshot immediately
5542 * inside it under a random name. However if the specified is not a mount point we
5543 * create the new snapshot in the parent directory, just next to it. */
e1873695 5544 r = path_is_mount_point(arg_directory, NULL, 0);
03cfe0d5
LP		 5545 if (r < 0) {
5546 log_error_errno(r, "Failed to determine whether directory %s is mount point: %m", arg_directory);
5547 goto finish;
5548 }
5549 if (r > 0)
770b5ce4 5550 r = tempfn_random_child(arg_directory, "machine.", &np);
03cfe0d5 5551 else
770b5ce4 5552 r = tempfn_random(arg_directory, "machine.", &np);
03cfe0d5 5553 if (r < 0) {
0f3be6ca 5554 log_error_errno(r, "Failed to generate name for directory snapshot: %m");
03cfe0d5
LP		 5555 goto finish;
5556 }
5557
6992459c 5558 /* We take an exclusive lock on this image, since it's our private, ephemeral copy
162392b7 5559 * only owned by us and no one else. */
6992459c 5560 r = image_path_lock(np, LOCK_EX|LOCK_NB, &tree_global_lock, &tree_local_lock);
03cfe0d5
LP		 5561 if (r < 0) {
5562 log_error_errno(r, "Failed to lock %s: %m", np);
5563 goto finish;
5564 }
5565
7bf011e3
LP		 5566 {
5567 BLOCK_SIGNALS(SIGINT);
5568 r = btrfs_subvol_snapshot(arg_directory, np,
5569 (arg_read_only ? BTRFS_SNAPSHOT_READ_ONLY : 0) |
5570 BTRFS_SNAPSHOT_FALLBACK_COPY |
5571 BTRFS_SNAPSHOT_FALLBACK_DIRECTORY |
5572 BTRFS_SNAPSHOT_RECURSIVE |
5573 BTRFS_SNAPSHOT_QUOTA |
5574 BTRFS_SNAPSHOT_SIGINT);
5575 }
5576 if (r == -EINTR) {
5577 log_error_errno(r, "Interrupted while copying file system tree to %s, removed again.", np);
5578 goto finish;
5579 }
03cfe0d5
LP		 5580 if (r < 0) {
5581 log_error_errno(r, "Failed to create snapshot %s from %s: %m", np, arg_directory);
5582 goto finish;
ec16945e
LP		 5583 }
5584
1cc6c93a 5585 free_and_replace(arg_directory, np);
17cbb288 5586 remove_directory = true;
30535c16 5587 } else {
cb638b5e 5588 r = chase_symlinks_and_update(&arg_directory, arg_template ? CHASE_NONEXISTENT : 0);
8d4aa2bb
LP		 5589 if (r < 0)
5590 goto finish;
5591
30535c16
LP		 5592 r = image_path_lock(arg_directory, (arg_read_only ? LOCK_SH : LOCK_EX) | LOCK_NB, &tree_global_lock, &tree_local_lock);
5593 if (r == -EBUSY) {
5594 log_error_errno(r, "Directory tree %s is currently busy.", arg_directory);
5595 goto finish;
5596 }
5597 if (r < 0) {
5598 log_error_errno(r, "Failed to lock %s: %m", arg_directory);
476b8254 5599 goto finish;
30535c16
LP		 5600 }
5601
5602 if (arg_template) {
8d4aa2bb 5603 r = chase_symlinks_and_update(&arg_template, 0);
3f342ec4
LP		 5604 if (r < 0)
5605 goto finish;
5606
7bf011e3
LP		 5607 {
5608 BLOCK_SIGNALS(SIGINT);
5609 r = btrfs_subvol_snapshot(arg_template, arg_directory,
5610 (arg_read_only ? BTRFS_SNAPSHOT_READ_ONLY : 0) |
5611 BTRFS_SNAPSHOT_FALLBACK_COPY |
5612 BTRFS_SNAPSHOT_FALLBACK_DIRECTORY |
5613 BTRFS_SNAPSHOT_FALLBACK_IMMUTABLE |
5614 BTRFS_SNAPSHOT_RECURSIVE |
5615 BTRFS_SNAPSHOT_QUOTA |
5616 BTRFS_SNAPSHOT_SIGINT);
5617 }
ff6c6cc1
LP		 5618 if (r == -EEXIST)
5619 log_full(arg_quiet ? LOG_DEBUG : LOG_INFO,
5620 "Directory %s already exists, not populating from template %s.", arg_directory, arg_template);
7bf011e3
LP		 5621 else if (r == -EINTR) {
5622 log_error_errno(r, "Interrupted while copying file system tree to %s, removed again.", arg_directory);
5623 goto finish;
5624 } else if (r < 0) {
83521414 5625 log_error_errno(r, "Couldn't create snapshot %s from %s: %m", arg_directory, arg_template);
30535c16 5626 goto finish;
ff6c6cc1
LP		 5627 } else
5628 log_full(arg_quiet ? LOG_DEBUG : LOG_INFO,
5629 "Populated %s from template %s.", arg_directory, arg_template);
30535c16 5630 }
ec16945e
LP		 5631 }
5632
7732f92b 5633 if (arg_start_mode == START_BOOT) {
aff7ae0d 5634 _cleanup_free_ char *b = NULL;
a5201ed6 5635 const char *p;
c9fe05e0 5636
aff7ae0d
LP		 5637 if (arg_pivot_root_new) {
5638 b = path_join(arg_directory, arg_pivot_root_new);
5639 if (!b)
5640 return log_oom();
5641
5642 p = b;
5643 } else
a5201ed6 5644 p = arg_directory;
c9fe05e0
AR		 5645
5646 if (path_is_os_tree(p) <= 0) {
aff7ae0d
LP		 5647 r = log_error_errno(SYNTHETIC_ERRNO(EINVAL),
5648 "Directory %s doesn't look like an OS root directory (os-release file is missing). Refusing.", p);
1b9e5b12
LP		 5649 goto finish;
5650 }
5651 } else {
aff7ae0d 5652 _cleanup_free_ char *p = NULL;
c9fe05e0 5653
a5201ed6 5654 if (arg_pivot_root_new)
aff7ae0d 5655 p = path_join(arg_directory, arg_pivot_root_new, "/usr/");
a5201ed6 5656 else
aff7ae0d
LP		 5657 p = path_join(arg_directory, "/usr/");
5658 if (!p)
5659 return log_oom();
1b9e5b12 5660
aff7ae0d
LP		 5661 if (laccess(p, F_OK) < 0) {
5662 r = log_error_errno(SYNTHETIC_ERRNO(EINVAL),
5663 "Directory %s doesn't look like it has an OS tree (/usr/ directory is missing). Refusing.", arg_directory);
1b9e5b12 5664 goto finish;
1b9e5b12
LP		 5665 }
5666 }
ec16945e 5667
6b9132a9 5668 } else {
d04faa4e 5669 DissectImageFlags dissect_image_flags =
4b5de5dd 5670 DISSECT_IMAGE_GENERIC_ROOT |
d04faa4e
LP		 5671 DISSECT_IMAGE_REQUIRE_ROOT |
5672 DISSECT_IMAGE_RELAX_VAR_CHECK |
73d88b80
LP		 5673 DISSECT_IMAGE_USR_NO_ROOT |
5674 DISSECT_IMAGE_ADD_PARTITION_DEVICES |
5675 DISSECT_IMAGE_PIN_PARTITION_DEVICES;
ec16945e
LP		 5676 assert(arg_image);
5677 assert(!arg_template);
5678
8d4aa2bb 5679 r = chase_symlinks_and_update(&arg_image, 0);
3f342ec4
LP		 5680 if (r < 0)
5681 goto finish;
5682
0f3be6ca
LP		 5683 if (arg_ephemeral) {
5684 _cleanup_free_ char *np = NULL;
5685
5686 r = tempfn_random(arg_image, "machine.", &np);
5687 if (r < 0) {
5688 log_error_errno(r, "Failed to generate name for image snapshot: %m");
5689 goto finish;
5690 }
5691
6992459c
LP		 5692 /* Always take an exclusive lock on our own ephemeral copy. */
5693 r = image_path_lock(np, LOCK_EX|LOCK_NB, &tree_global_lock, &tree_local_lock);
0f3be6ca
LP		 5694 if (r < 0) {
5695 r = log_error_errno(r, "Failed to create image lock: %m");
5696 goto finish;
5697 }
5698
7bf011e3
LP		 5699 {
5700 BLOCK_SIGNALS(SIGINT);
7c2f5495
DDM		 5701 r = copy_file_full(arg_image, np, O_EXCL, arg_read_only ? 0400 : 0600,
5702 FS_NOCOW_FL, FS_NOCOW_FL,
5703 COPY_REFLINK|COPY_CRTIME|COPY_SIGINT,
5704 NULL, NULL);
7bf011e3
LP		 5705 }
5706 if (r == -EINTR) {
5707 log_error_errno(r, "Interrupted while copying image file to %s, removed again.", np);
5708 goto finish;
5709 }
0f3be6ca
LP		 5710 if (r < 0) {
5711 r = log_error_errno(r, "Failed to copy image file: %m");
5712 goto finish;
5713 }
5714
1cc6c93a 5715 free_and_replace(arg_image, np);
0f3be6ca
LP		 5716 remove_image = true;
5717 } else {
5718 r = image_path_lock(arg_image, (arg_read_only ? LOCK_SH : LOCK_EX) | LOCK_NB, &tree_global_lock, &tree_local_lock);
5719 if (r == -EBUSY) {
5720 r = log_error_errno(r, "Disk image %s is currently busy.", arg_image);
5721 goto finish;
5722 }
5723 if (r < 0) {
5724 r = log_error_errno(r, "Failed to create image lock: %m");
5725 goto finish;
5726 }
4623e8e6 5727
89e62e0b
LP		 5728 r = verity_settings_load(
5729 &arg_verity_settings,
5730 arg_image, NULL, NULL);
e7cbe5cb
LB		 5731 if (r < 0) {
5732 log_error_errno(r, "Failed to read verity artefacts for %s: %m", arg_image);
5733 goto finish;
78ebe980 5734 }
89e62e0b
LP		 5735
5736 if (arg_verity_settings.data_path)
5737 dissect_image_flags |= DISSECT_IMAGE_NO_PARTITION_TABLE;
30535c16
LP		 5738 }
5739
c67b0082 5740 if (!mkdtemp(tmprootdir)) {
0f3be6ca 5741 r = log_error_errno(errno, "Failed to create temporary directory: %m");
6b9132a9 5742 goto finish;
1b9e5b12 5743 }
6b9132a9 5744
c67b0082
LP		 5745 remove_tmprootdir = true;
5746
5747 arg_directory = strdup(tmprootdir);
1b9e5b12
LP		 5748 if (!arg_directory) {
5749 r = log_oom();
5750 goto finish;
6b9132a9 5751 }
88213476 5752
89e62e0b
LP		 5753 r = loop_device_make_by_path(
5754 arg_image,
5755 arg_read_only ? O_RDONLY : O_RDWR,
22ee78a8 5756 /* sector_size= */ UINT32_MAX,
89e62e0b 5757 FLAGS_SET(dissect_image_flags, DISSECT_IMAGE_NO_PARTITION_TABLE) ? 0 : LO_FLAGS_PARTSCAN,
7f52206a 5758 LOCK_SH,
89e62e0b 5759 &loop);
2d845785
LP		 5760 if (r < 0) {
5761 log_error_errno(r, "Failed to set up loopback block device: %m");
842f3b0f
LP		 5762 goto finish;
5763 }
1b9e5b12 5764
bad31660 5765 r = dissect_loop_device_and_warn(
bad31660 5766 loop,
89e62e0b 5767 &arg_verity_settings,
18d73705 5768 NULL,
e7cbe5cb 5769 dissect_image_flags,
e0f9e7bd 5770 &dissected_image);
2d845785 5771 if (r == -ENOPKG) {
4526113f 5772 /* dissected_image_and_warn() already printed a brief error message. Extend on that with more details */
2d845785
LP		 5773 log_notice("Note that the disk image needs to\n"
5774 " a) either contain only a single MBR partition of type 0x83 that is marked bootable\n"
5775 " b) or contain a single GPT partition of type 0FC63DAF-8483-4772-8E79-3D69D8477DE4\n"
db811444 5776 " c) or follow https://uapi-group.org/specifications/specs/discoverable_partitions_specification\n"
2d845785
LP		 5777 " d) or contain a file system without a partition table\n"
5778 "in order to be bootable with systemd-nspawn.");
1b9e5b12 5779 goto finish;
2d845785 5780 }
4526113f 5781 if (r < 0)
842f3b0f 5782 goto finish;
1b9e5b12 5783
88b3300f
LP		 5784 r = dissected_image_load_verity_sig_partition(
5785 dissected_image,
5786 loop->fd,
5787 &arg_verity_settings);
5788 if (r < 0)
5789 goto finish;
5790
8ee9615e
LP		 5791 if (dissected_image->has_verity && !arg_verity_settings.root_hash && !dissected_image->has_verity_sig)
5792 log_notice("Note: image %s contains verity information, but no root hash specified and no embedded "
5793 "root hash signature found! Proceeding without integrity checking.", arg_image);
4623e8e6 5794
89e62e0b
LP		 5795 r = dissected_image_decrypt_interactively(
5796 dissected_image,
5797 NULL,
5798 &arg_verity_settings,
e330f97a 5799 0);
1b9e5b12
LP		 5800 if (r < 0)
5801 goto finish;
0f3be6ca
LP		 5802
5803 /* Now that we mounted the image, let's try to remove it again, if it is ephemeral */
5804 if (remove_image && unlink(arg_image) >= 0)
5805 remove_image = false;
4c27749b
LP		 5806
5807 if (arg_architecture < 0)
5808 arg_architecture = dissected_image_architecture(dissected_image);
842f3b0f 5809 }
842f3b0f 5810
86c0dd4a 5811 r = custom_mount_prepare_all(arg_directory, arg_custom_mounts, arg_n_custom_mounts);
5a8af538
LP		 5812 if (r < 0)
5813 goto finish;
5814
de40a303
LP		 5815 if (arg_console_mode < 0)
5816 arg_console_mode =
5817 isatty(STDIN_FILENO) > 0 &&
5818 isatty(STDOUT_FILENO) > 0 ? CONSOLE_INTERACTIVE : CONSOLE_READ_ONLY;
9c857b9d 5819
de40a303
LP		 5820 if (arg_console_mode == CONSOLE_PIPE) /* if we pass STDERR on to the container, don't add our own logs into it too */
5821 arg_quiet = true;
a258bf26 5822
9c857b9d 5823 if (!arg_quiet)
c85c2f79 5824 log_info("Spawning container %s on %s.\nPress Ctrl-] three times within 1s to kill container.",
9c857b9d
LP		 5825 arg_machine, arg_image ?: arg_directory);
5826
988851b6 5827 assert_se(sigprocmask_many(SIG_BLOCK, NULL, SIGCHLD, SIGWINCH, SIGTERM, SIGINT, SIGRTMIN+18, -1) >= 0);
a258bf26 5828
66edd963 5829 if (prctl(PR_SET_CHILD_SUBREAPER, 1, 0, 0, 0) < 0) {
03cfe0d5
LP		 5830 r = log_error_errno(errno, "Failed to become subreaper: %m");
5831 goto finish;
5832 }
5833
761cf19d
FW		 5834 if (arg_expose_ports) {
5835 r = fw_ctx_new(&fw_ctx);
5836 if (r < 0) {
5837 log_error_errno(r, "Cannot expose configured ports, firewall initialization failed: %m");
5838 goto finish;
5839 }
5840 expose_args.fw_ctx = fw_ctx;
5841 }
d87be9b0 5842 for (;;) {
3acc84eb 5843 r = run_container(dissected_image,
44dbef90
LP		 5844 fds,
5845 veth_name, &veth_created,
761cf19d 5846 &expose_args, &master,
44dbef90 5847 &pid, &ret);
b0067625 5848 if (r <= 0)
d87be9b0 5849 break;
d87be9b0 5850 }
88213476
LP		 5851
5852finish:
04f590a4
LP		 5853 (void) sd_notify(false,
5854 r == 0 && ret == EXIT_FORCE_RESTART ? "STOPPING=1\nSTATUS=Restarting..." :
5855 "STOPPING=1\nSTATUS=Terminating...");
af4ec430 5856
9444b1f2 5857 if (pid > 0)
c67b0082 5858 (void) kill(pid, SIGKILL);
88213476 5859
503546da 5860 /* Try to flush whatever is still queued in the pty */
6a0f896b 5861 if (master >= 0) {
f5fbe71d 5862 (void) copy_bytes(master, STDOUT_FILENO, UINT64_MAX, 0);
6a0f896b
LP		 5863 master = safe_close(master);
5864 }
5865
5866 if (pid > 0)
5867 (void) wait_for_terminate(pid, NULL);
503546da 5868
50ebcf6c
LP		 5869 pager_close();
5870
17cbb288 5871 if (remove_directory && arg_directory) {
ec16945e
LP		 5872 int k;
5873
17cbb288 5874 k = rm_rf(arg_directory, REMOVE_ROOT|REMOVE_PHYSICAL|REMOVE_SUBVOLUME);
ec16945e 5875 if (k < 0)
17cbb288 5876 log_warning_errno(k, "Cannot remove '%s', ignoring: %m", arg_directory);
ec16945e
LP		 5877 }
5878
0f3be6ca
LP		 5879 if (remove_image && arg_image) {
5880 if (unlink(arg_image) < 0)
5881 log_warning_errno(errno, "Can't remove image file '%s', ignoring: %m", arg_image);
5882 }
5883
c67b0082
LP		 5884 if (remove_tmprootdir) {
5885 if (rmdir(tmprootdir) < 0)
5886 log_debug_errno(errno, "Can't remove temporary root directory '%s', ignoring: %m", tmprootdir);
5887 }
5888
785890ac
LP		 5889 if (arg_machine) {
5890 const char *p;
5891
63c372cb 5892 p = strjoina("/run/systemd/nspawn/propagate/", arg_machine);
c6878637 5893 (void) rm_rf(p, REMOVE_ROOT);
785890ac
LP		 5894 }
5895
deff68e7
FW		 5896 expose_port_flush(&fw_ctx, arg_expose_ports, AF_INET, &expose_args.address4);
5897 expose_port_flush(&fw_ctx, arg_expose_ports, AF_INET6, &expose_args.address6);
7513c5b8
LP		 5898
5899 if (veth_created)
5900 (void) remove_veth_links(veth_name, arg_network_veth_extra);
22b28dfd 5901 (void) remove_bridge(arg_network_zone);
f757855e 5902
f757855e
LP		 5903 custom_mount_free_all(arg_custom_mounts, arg_n_custom_mounts);
5904 expose_port_free_all(arg_expose_ports);
bf428efb 5905 rlimit_free_all(arg_rlimit);
b2645747 5906 device_node_array_free(arg_extra_nodes, arg_n_extra_nodes);
3652872a 5907 credential_free_all(arg_credentials, arg_n_credentials);
6d0b55c2 5908
44dbef90
LP		 5909 if (r < 0)
5910 return r;
5911
5912 return ret;
88213476 5913}
44dbef90
LP		 5914
5915DEFINE_MAIN_FUNCTION_WITH_POSITIVE_FAILURE(run);
Unnamed repository; edit this file 'description' to name the repository.