]> git.ipfire.org Git - thirdparty/systemd.git/blame - src/nspawn/nspawn.c
projects / thirdparty / systemd.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
nspawn,pid1: pass "inaccessible" nodes from cntr mgr to pid1 payload via /run/host
[thirdparty/systemd.git] / src / nspawn / nspawn.c
CommitLineData
53e1b683 1/* SPDX-License-Identifier: LGPL-2.1+ */
88213476 2
349cc4a5 3#if HAVE_BLKID
8fe0087e 4#endif
88213476 5#include <errno.h>
88213476 6#include <getopt.h>
503f480f 7#include <linux/fs.h>
1b9e5b12 8#include <linux/loop.h>
349cc4a5 9#if HAVE_SELINUX
8fe0087e 10#include <selinux/selinux.h>
1b9e5b12 11#endif
8fe0087e 12#include <stdlib.h>
8fe0087e 13#include <sys/file.h>
8fe0087e
LP		 14#include <sys/personality.h>
15#include <sys/prctl.h>
16#include <sys/types.h>
6916b164 17#include <sys/wait.h>
8fe0087e 18#include <unistd.h>
1b9e5b12 19
b053cd5f 20#include "sd-bus.h"
1f0cd86b 21#include "sd-daemon.h"
1f0cd86b 22#include "sd-id128.h"
8fe0087e 23
b5efdb8a 24#include "alloc-util.h"
8fe0087e
LP		 25#include "barrier.h"
26#include "base-filesystem.h"
27#include "blkid-util.h"
28#include "btrfs-util.h"
b8ea7a6e 29#include "bus-error.h"
b053cd5f 30#include "bus-util.h"
8fe0087e 31#include "cap-list.h"
430f0182 32#include "capability-util.h"
04d391da 33#include "cgroup-util.h"
8fe0087e 34#include "copy.h"
d107bb7d 35#include "cpu-set-util.h"
4fc9982c 36#include "dev-setup.h"
2d845785 37#include "dissect-image.h"
8fe0087e 38#include "env-util.h"
3ffd4af2 39#include "fd-util.h"
842f3b0f 40#include "fdset.h"
a5c32cff 41#include "fileio.h"
f97b34a6 42#include "format-util.h"
f4f15635 43#include "fs-util.h"
1b9e5b12 44#include "gpt.h"
4623e8e6 45#include "hexdecoct.h"
8fe0087e 46#include "hostname-util.h"
910fd145 47#include "id128-util.h"
8fe0087e 48#include "log.h"
2d845785 49#include "loop-util.h"
8fe0087e 50#include "loopback-setup.h"
1b9cebf6 51#include "machine-image.h"
8fe0087e 52#include "macro.h"
44dbef90 53#include "main-func.h"
f5947a5e 54#include "missing_sched.h"
8fe0087e 55#include "mkdir.h"
4349cd7c 56#include "mount-util.h"
049af8ad 57#include "mountpoint-util.h"
0cb8e3d1 58#include "namespace-util.h"
8fe0087e 59#include "netlink-util.h"
07630cea 60#include "nspawn-cgroup.h"
3603efde 61#include "nspawn-def.h"
07630cea
LP		 62#include "nspawn-expose-ports.h"
63#include "nspawn-mount.h"
64#include "nspawn-network.h"
de40a303 65#include "nspawn-oci.h"
7336138e 66#include "nspawn-patch-uid.h"
07630cea 67#include "nspawn-register.h"
910fd145 68#include "nspawn-seccomp.h"
07630cea
LP		 69#include "nspawn-settings.h"
70#include "nspawn-setuid.h"
7732f92b 71#include "nspawn-stub-pid1.h"
d8b4d14d 72#include "nulstr-util.h"
d58ad743 73#include "os-util.h"
50ebcf6c 74#include "pager.h"
6bedfcbb 75#include "parse-util.h"
8fe0087e 76#include "path-util.h"
294bf0c3 77#include "pretty-print.h"
0b452006 78#include "process-util.h"
8fe0087e
LP		 79#include "ptyfwd.h"
80#include "random-util.h"
8869a0b4 81#include "raw-clone.h"
86775e35 82#include "resolve-util.h"
bf428efb 83#include "rlimit-util.h"
8fe0087e 84#include "rm-rf.h"
de40a303
LP		 85#if HAVE_SECCOMP
86#include "seccomp-util.h"
87#endif
68b02049 88#include "selinux-util.h"
8fe0087e 89#include "signal-util.h"
2583fbea 90#include "socket-util.h"
8fcde012 91#include "stat-util.h"
15a5e950 92#include "stdio-util.h"
5c828e66 93#include "string-table.h"
07630cea 94#include "string-util.h"
8fe0087e 95#include "strv.h"
de40a303 96#include "sysctl-util.h"
8fe0087e 97#include "terminal-util.h"
e4de7287 98#include "tmpfile-util.h"
affb60b1 99#include "umask-util.h"
43c3fb46 100#include "unit-name.h"
b1d4f8e1 101#include "user-util.h"
8fe0087e 102#include "util.h"
e9642be2 103
e96ceaba
LP		 104/* The notify socket inside the container it can use to talk to nspawn using the sd_notify(3) protocol */
105#define NSPAWN_NOTIFY_SOCKET_PATH "/run/host/notify"
0e7ac751 106
2a49b612
ZJS		 107#define EXIT_FORCE_RESTART 133
108
113cea80
DH		 109typedef enum ContainerStatus {
110 CONTAINER_TERMINATED,
6145bb4f 111 CONTAINER_REBOOTED,
113cea80
DH		 112} ContainerStatus;
113
88213476 114static char *arg_directory = NULL;
ec16945e 115static char *arg_template = NULL;
5f932eb9 116static char *arg_chdir = NULL;
b53ede69
PW		 117static char *arg_pivot_root_new = NULL;
118static char *arg_pivot_root_old = NULL;
687d0825 119static char *arg_user = NULL;
de40a303
LP		 120static uid_t arg_uid = UID_INVALID;
121static gid_t arg_gid = GID_INVALID;
122static gid_t* arg_supplementary_gids = NULL;
123static size_t arg_n_supplementary_gids = 0;
9444b1f2 124static sd_id128_t arg_uuid = {};
3a9530e5
LP		 125static char *arg_machine = NULL; /* The name used by the host to refer to this */
126static char *arg_hostname = NULL; /* The name the payload sees by default */
c74e630d
LP		 127static const char *arg_selinux_context = NULL;
128static const char *arg_selinux_apifs_context = NULL;
de40a303 129static char *arg_slice = NULL;
ff01d048 130static bool arg_private_network = false;
bc2f673e 131static bool arg_read_only = false;
7732f92b 132static StartMode arg_start_mode = START_PID1;
ec16945e 133static bool arg_ephemeral = false;
57fb9fb5 134static LinkJournal arg_link_journal = LINK_AUTO;
574edc90 135static bool arg_link_journal_try = false;
520e0d54 136static uint64_t arg_caps_retain =
50b52222
LP		 137 (1ULL << CAP_AUDIT_CONTROL) |
138 (1ULL << CAP_AUDIT_WRITE) |
5076f0cc
LP		 139 (1ULL << CAP_CHOWN) |
140 (1ULL << CAP_DAC_OVERRIDE) |
141 (1ULL << CAP_DAC_READ_SEARCH) |
142 (1ULL << CAP_FOWNER) |
143 (1ULL << CAP_FSETID) |
144 (1ULL << CAP_IPC_OWNER) |
145 (1ULL << CAP_KILL) |
146 (1ULL << CAP_LEASE) |
147 (1ULL << CAP_LINUX_IMMUTABLE) |
50b52222 148 (1ULL << CAP_MKNOD) |
5076f0cc
LP		 149 (1ULL << CAP_NET_BIND_SERVICE) |
150 (1ULL << CAP_NET_BROADCAST) |
151 (1ULL << CAP_NET_RAW) |
5076f0cc 152 (1ULL << CAP_SETFCAP) |
50b52222 153 (1ULL << CAP_SETGID) |
5076f0cc
LP		 154 (1ULL << CAP_SETPCAP) |
155 (1ULL << CAP_SETUID) |
156 (1ULL << CAP_SYS_ADMIN) |
50b52222 157 (1ULL << CAP_SYS_BOOT) |
5076f0cc
LP		 158 (1ULL << CAP_SYS_CHROOT) |
159 (1ULL << CAP_SYS_NICE) |
160 (1ULL << CAP_SYS_PTRACE) |
d87be9b0 161 (1ULL << CAP_SYS_RESOURCE) |
50b52222 162 (1ULL << CAP_SYS_TTY_CONFIG);
de40a303 163static CapabilityQuintet arg_full_capabilities = CAPABILITY_QUINTET_NULL;
5a8af538 164static CustomMount *arg_custom_mounts = NULL;
88614c8a 165static size_t arg_n_custom_mounts = 0;
f4889f65 166static char **arg_setenv = NULL;
284c0b91 167static bool arg_quiet = false;
eb91eb18 168static bool arg_register = true;
89f7c846 169static bool arg_keep_unit = false;
aa28aefe 170static char **arg_network_interfaces = NULL;
c74e630d 171static char **arg_network_macvlan = NULL;
4bbfe7ad 172static char **arg_network_ipvlan = NULL;
69c79d3c 173static bool arg_network_veth = false;
f6d6bad1 174static char **arg_network_veth_extra = NULL;
f757855e 175static char *arg_network_bridge = NULL;
22b28dfd 176static char *arg_network_zone = NULL;
d7bea6b6 177static char *arg_network_namespace_path = NULL;
bb068de0 178static PagerFlags arg_pager_flags = 0;
050f7277 179static unsigned long arg_personality = PERSONALITY_INVALID;
ec16945e 180static char *arg_image = NULL;
de40a303 181static char *arg_oci_bundle = NULL;
f757855e 182static VolatileMode arg_volatile_mode = VOLATILE_NO;
6d0b55c2 183static ExposePort *arg_expose_ports = NULL;
f36933fe 184static char **arg_property = NULL;
de40a303 185static sd_bus_message *arg_property_message = NULL;
0de7acce 186static UserNamespaceMode arg_userns_mode = USER_NAMESPACE_NO;
6dac160c 187static uid_t arg_uid_shift = UID_INVALID, arg_uid_range = 0x10000U;
0de7acce 188static bool arg_userns_chown = false;
c6c8f6e2 189static int arg_kill_signal = 0;
5da38d07 190static CGroupUnified arg_unified_cgroup_hierarchy = CGROUP_UNIFIED_UNKNOWN;
f757855e
LP		 191static SettingsMask arg_settings_mask = 0;
192static int arg_settings_trusted = -1;
193static char **arg_parameters = NULL;
6aadfa4c 194static const char *arg_container_service_name = "systemd-nspawn";
9c1e04d0 195static bool arg_notify_ready = false;
5a8ff0e6 196static bool arg_use_cgns = true;
0c582db0 197static unsigned long arg_clone_ns_flags = CLONE_NEWIPC|CLONE_NEWPID|CLONE_NEWUTS;
1099ceeb 198static MountSettingsMask arg_mount_settings = MOUNT_APPLY_APIVFS_RO|MOUNT_APPLY_TMPFS_TMP;
4623e8e6 199static void *arg_root_hash = NULL;
e7cbe5cb 200static char *arg_verity_data = NULL;
c2923fdc
LB		 201static char *arg_root_hash_sig_path = NULL;
202static void *arg_root_hash_sig = NULL;
203static size_t arg_root_hash_sig_size = 0;
4623e8e6 204static size_t arg_root_hash_size = 0;
6b000af4
LP		 205static char **arg_syscall_allow_list = NULL;
206static char **arg_syscall_deny_list = NULL;
de40a303
LP		 207#if HAVE_SECCOMP
208static scmp_filter_ctx arg_seccomp = NULL;
209#endif
bf428efb 210static struct rlimit *arg_rlimit[_RLIMIT_MAX] = {};
66edd963 211static bool arg_no_new_privileges = false;
81f345df
LP		 212static int arg_oom_score_adjust = 0;
213static bool arg_oom_score_adjust_set = false;
0985c7c4 214static CPUSet arg_cpu_set = {};
09d423e9 215static ResolvConfMode arg_resolv_conf = RESOLV_CONF_AUTO;
1688841f 216static TimezoneMode arg_timezone = TIMEZONE_AUTO;
de40a303
LP		 217static unsigned arg_console_width = (unsigned) -1, arg_console_height = (unsigned) -1;
218static DeviceNode* arg_extra_nodes = NULL;
219static size_t arg_n_extra_nodes = 0;
220static char **arg_sysctl = NULL;
221static ConsoleMode arg_console_mode = _CONSOLE_MODE_INVALID;
88213476 222
6145bb4f
LP		 223STATIC_DESTRUCTOR_REGISTER(arg_directory, freep);
224STATIC_DESTRUCTOR_REGISTER(arg_template, freep);
225STATIC_DESTRUCTOR_REGISTER(arg_chdir, freep);
226STATIC_DESTRUCTOR_REGISTER(arg_pivot_root_new, freep);
227STATIC_DESTRUCTOR_REGISTER(arg_pivot_root_old, freep);
228STATIC_DESTRUCTOR_REGISTER(arg_user, freep);
229STATIC_DESTRUCTOR_REGISTER(arg_supplementary_gids, freep);
230STATIC_DESTRUCTOR_REGISTER(arg_machine, freep);
231STATIC_DESTRUCTOR_REGISTER(arg_hostname, freep);
232STATIC_DESTRUCTOR_REGISTER(arg_slice, freep);
233STATIC_DESTRUCTOR_REGISTER(arg_setenv, strv_freep);
234STATIC_DESTRUCTOR_REGISTER(arg_network_interfaces, strv_freep);
235STATIC_DESTRUCTOR_REGISTER(arg_network_macvlan, strv_freep);
236STATIC_DESTRUCTOR_REGISTER(arg_network_ipvlan, strv_freep);
237STATIC_DESTRUCTOR_REGISTER(arg_network_veth_extra, strv_freep);
238STATIC_DESTRUCTOR_REGISTER(arg_network_bridge, freep);
239STATIC_DESTRUCTOR_REGISTER(arg_network_zone, freep);
240STATIC_DESTRUCTOR_REGISTER(arg_network_namespace_path, freep);
241STATIC_DESTRUCTOR_REGISTER(arg_image, freep);
242STATIC_DESTRUCTOR_REGISTER(arg_oci_bundle, freep);
243STATIC_DESTRUCTOR_REGISTER(arg_property, strv_freep);
244STATIC_DESTRUCTOR_REGISTER(arg_property_message, sd_bus_message_unrefp);
245STATIC_DESTRUCTOR_REGISTER(arg_parameters, strv_freep);
246STATIC_DESTRUCTOR_REGISTER(arg_root_hash, freep);
e7cbe5cb 247STATIC_DESTRUCTOR_REGISTER(arg_verity_data, freep);
c2923fdc
LB		 248STATIC_DESTRUCTOR_REGISTER(arg_root_hash_sig_path, freep);
249STATIC_DESTRUCTOR_REGISTER(arg_root_hash_sig, freep);
6b000af4
LP		 250STATIC_DESTRUCTOR_REGISTER(arg_syscall_allow_list, strv_freep);
251STATIC_DESTRUCTOR_REGISTER(arg_syscall_deny_list, strv_freep);
6145bb4f
LP		 252#if HAVE_SECCOMP
253STATIC_DESTRUCTOR_REGISTER(arg_seccomp, seccomp_releasep);
254#endif
0985c7c4 255STATIC_DESTRUCTOR_REGISTER(arg_cpu_set, cpu_set_reset);
6145bb4f
LP		 256STATIC_DESTRUCTOR_REGISTER(arg_sysctl, strv_freep);
257
dce66ffe
ZJS		 258static int handle_arg_console(const char *arg) {
259 if (streq(arg, "help")) {
260 puts("interactive\n"
261 "read-only\n"
262 "passive\n"
263 "pipe");
264 return 0;
265 }
266
267 if (streq(arg, "interactive"))
268 arg_console_mode = CONSOLE_INTERACTIVE;
269 else if (streq(arg, "read-only"))
270 arg_console_mode = CONSOLE_READ_ONLY;
271 else if (streq(arg, "passive"))
272 arg_console_mode = CONSOLE_PASSIVE;
273 else if (streq(arg, "pipe"))
274 arg_console_mode = CONSOLE_PIPE;
275 else
276 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Unknown console mode: %s", optarg);
277
278 arg_settings_mask |= SETTING_CONSOLE_MODE;
279 return 1;
280}
281
37ec0fdd
LP		 282static int help(void) {
283 _cleanup_free_ char *link = NULL;
284 int r;
285
bb068de0 286 (void) pager_open(arg_pager_flags);
50ebcf6c 287
37ec0fdd
LP		 288 r = terminal_urlify_man("systemd-nspawn", "1", &link);
289 if (r < 0)
290 return log_oom();
291
25148653 292 printf("%1$s [OPTIONS...] [PATH] [ARGUMENTS...]\n\n"
37a92352 293 "%5$sSpawn a command or OS in a light-weight container.%6$s\n\n"
a8828ed9
DW		 294 " -h --help Show this help\n"
295 " --version Print version string\n"
69c79d3c 296 " -q --quiet Do not show status information\n"
bb068de0 297 " --no-pager Do not pipe output into a pager\n"
25148653
LP		 298 " --settings=BOOLEAN Load additional settings from .nspawn file\n\n"
299 "%3$sImage:%4$s\n"
1b9e5b12 300 " -D --directory=PATH Root directory for the container\n"
ec16945e
LP		 301 " --template=PATH Initialize root directory from template directory,\n"
302 " if missing\n"
303 " -x --ephemeral Run container with snapshot of root directory, and\n"
304 " remove it after exit\n"
25e68fd3
LP		 305 " -i --image=PATH Root file system disk image (or device node) for\n"
306 " the container\n"
de40a303 307 " --oci-bundle=PATH OCI bundle directory\n"
25148653
LP		 308 " --read-only Mount the root directory read-only\n"
309 " --volatile[=MODE] Run the system in volatile mode\n"
25e68fd3 310 " --root-hash=HASH Specify verity root hash for root disk image\n"
c2923fdc
LB		 311 " --root-hash-sig=SIG Specify pkcs7 signature of root hash for verity\n"
312 " as a DER encoded PKCS7, either as a path to a file\n"
313 " or as an ASCII base64 encoded string prefixed by\n"
314 " 'base64:'\n"
e7cbe5cb 315 " --verity-data=PATH Specify hash device for verity\n"
25148653
LP		 316 " --pivot-root=PATH[:PATH]\n"
317 " Pivot root to given directory in the container\n\n"
318 "%3$sExecution:%4$s\n"
7732f92b 319 " -a --as-pid2 Maintain a stub init as PID1, invoke binary as PID2\n"
a8828ed9 320 " -b --boot Boot up full system (i.e. invoke init)\n"
5f932eb9 321 " --chdir=PATH Set working directory in the container\n"
25148653
LP		 322 " -E --setenv=NAME=VALUE Pass an environment variable to PID 1\n"
323 " -u --user=USER Run the command under specified user or UID\n"
324 " --kill-signal=SIGNAL Select signal to use for shutting down PID 1\n"
325 " --notify-ready=BOOLEAN Receive notifications from the child init process\n\n"
326 "%3$sSystem Identity:%4$s\n"
a8828ed9 327 " -M --machine=NAME Set the machine name for the container\n"
3a9530e5 328 " --hostname=NAME Override the hostname for the container\n"
25148653
LP		 329 " --uuid=UUID Set a specific machine UUID for the container\n\n"
330 "%3$sProperties:%4$s\n"
a8828ed9 331 " -S --slice=SLICE Place the container in the specified slice\n"
f36933fe 332 " --property=NAME=VALUE Set scope unit property\n"
25148653
LP		 333 " --register=BOOLEAN Register container as machine\n"
334 " --keep-unit Do not register a scope for the machine, reuse\n"
335 " the service unit nspawn is running in\n\n"
336 "%3$sUser Namespacing:%4$s\n"
90b4a64d 337 " -U --private-users=pick Run within user namespace, autoselect UID/GID range\n"
03cfe0d5 338 " --private-users[=UIDBASE[:NUIDS]]\n"
90b4a64d 339 " Similar, but with user configured UID/GID range\n"
25148653
LP		 340 " --private-users-chown Adjust OS tree ownership to private UID/GID range\n\n"
341 "%3$sNetworking:%4$s\n"
69c79d3c
LP		 342 " --private-network Disable network in container\n"
343 " --network-interface=INTERFACE\n"
344 " Assign an existing network interface to the\n"
345 " container\n"
c74e630d
LP		 346 " --network-macvlan=INTERFACE\n"
347 " Create a macvlan network interface based on an\n"
348 " existing network interface to the container\n"
4bbfe7ad
TG		 349 " --network-ipvlan=INTERFACE\n"
350 " Create a ipvlan network interface based on an\n"
351 " existing network interface to the container\n"
a8eaaee7 352 " -n --network-veth Add a virtual Ethernet connection between host\n"
69c79d3c 353 " and container\n"
f6d6bad1
LP		 354 " --network-veth-extra=HOSTIF[:CONTAINERIF]\n"
355 " Add an additional virtual Ethernet link between\n"
356 " host and container\n"
ab046dde 357 " --network-bridge=INTERFACE\n"
90b4a64d
ZJS		 358 " Add a virtual Ethernet connection to the container\n"
359 " and attach it to an existing bridge on the host\n"
360 " --network-zone=NAME Similar, but attach the new interface to an\n"
361 " an automatically managed bridge interface\n"
d7bea6b6
DP		 362 " --network-namespace-path=PATH\n"
363 " Set network namespace to the one represented by\n"
364 " the specified kernel namespace file node\n"
6d0b55c2 365 " -p --port=[PROTOCOL:]HOSTPORT[:CONTAINERPORT]\n"
25148653
LP		 366 " Expose a container IP port on the host\n\n"
367 "%3$sSecurity:%4$s\n"
a8828ed9
DW		 368 " --capability=CAP In addition to the default, retain specified\n"
369 " capability\n"
370 " --drop-capability=CAP Drop the specified capability from the default set\n"
f4e803c8 371 " --no-new-privileges Set PR_SET_NO_NEW_PRIVS flag for container payload\n"
960e4569
LP		 372 " --system-call-filter=LIST|~LIST\n"
373 " Permit/prohibit specific system calls\n"
25148653
LP		 374 " -Z --selinux-context=SECLABEL\n"
375 " Set the SELinux security context to be used by\n"
376 " processes in the container\n"
377 " -L --selinux-apifs-context=SECLABEL\n"
378 " Set the SELinux security context to be used by\n"
379 " API/tmpfs file systems in the container\n\n"
380 "%3$sResources:%4$s\n"
bf428efb 381 " --rlimit=NAME=LIMIT Set a resource limit for the payload\n"
81f345df
LP		 382 " --oom-score-adjust=VALUE\n"
383 " Adjust the OOM score value for the payload\n"
f4e803c8
LP		 384 " --cpu-affinity=CPUS Adjust the CPU affinity of the container\n"
385 " --personality=ARCH Pick personality for this container\n\n"
25148653 386 "%3$sIntegration:%4$s\n"
09d423e9 387 " --resolv-conf=MODE Select mode of /etc/resolv.conf initialization\n"
1688841f 388 " --timezone=MODE Select mode of /etc/localtime initialization\n"
25148653
LP		 389 " --link-journal=MODE Link up guest journal, one of no, auto, guest, \n"
390 " host, try-guest, try-host\n"
391 " -j Equivalent to --link-journal=try-guest\n\n"
392 "%3$sMounts:%4$s\n"
5e5bfa6e
EY		 393 " --bind=PATH[:PATH[:OPTIONS]]\n"
394 " Bind mount a file or directory from the host into\n"
a8828ed9 395 " the container\n"
5e5bfa6e
EY		 396 " --bind-ro=PATH[:PATH[:OPTIONS]\n"
397 " Similar, but creates a read-only bind mount\n"
de40a303
LP		 398 " --inaccessible=PATH Over-mount file node with inaccessible node to mask\n"
399 " it\n"
06c17c39 400 " --tmpfs=PATH:[OPTIONS] Mount an empty tmpfs to the specified directory\n"
5a8af538
LP		 401 " --overlay=PATH[:PATH...]:PATH\n"
402 " Create an overlay mount from the host to \n"
403 " the container\n"
404 " --overlay-ro=PATH[:PATH...]:PATH\n"
25148653
LP		 405 " Similar, but creates a read-only overlay mount\n\n"
406 "%3$sInput/Output:%4$s\n"
de40a303
LP		 407 " --console=MODE Select how stdin/stdout/stderr and /dev/console are\n"
408 " set up for the container.\n"
409 " -P --pipe Equivalent to --console=pipe\n"
25148653 410 "\nSee the %2$s for details.\n"
37ec0fdd
LP		 411 , program_invocation_short_name
412 , link
37a92352
LP		 413 , ansi_underline(), ansi_normal()
414 , ansi_highlight(), ansi_normal()
415 );
37ec0fdd
LP		 416
417 return 0;
88213476
LP		 418}
419
86c0dd4a 420static int custom_mount_check_all(void) {
88614c8a 421 size_t i;
5a8af538 422
5a8af538
LP		 423 for (i = 0; i < arg_n_custom_mounts; i++) {
424 CustomMount *m = &arg_custom_mounts[i];
425
0de7acce 426 if (path_equal(m->destination, "/") && arg_userns_mode != USER_NAMESPACE_NO) {
baaa35ad
ZJS		 427 if (arg_userns_chown)
428 return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
429 "--private-users-chown may not be combined with custom root mounts.");
430 else if (arg_uid_shift == UID_INVALID)
431 return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
432 "--private-users with automatic UID shift may not be combined with custom root mounts.");
825d5287 433 }
5a8af538
LP		 434 }
435
436 return 0;
437}
438
8199d554 439static int detect_unified_cgroup_hierarchy_from_environment(void) {
c78c095b 440 const char *e, *var = "SYSTEMD_NSPAWN_UNIFIED_HIERARCHY";
415fc41c 441 int r;
5da38d07 442
efdb0237 443 /* Allow the user to control whether the unified hierarchy is used */
c78c095b
ZJS		 444
445 e = getenv(var);
446 if (!e) {
d5fc5b2f 447 /* $UNIFIED_CGROUP_HIERARCHY has been renamed to $SYSTEMD_NSPAWN_UNIFIED_HIERARCHY. */
c78c095b
ZJS		 448 var = "UNIFIED_CGROUP_HIERARCHY";
449 e = getenv(var);
c78c095b
ZJS		 450 }
451
452 if (!isempty(e)) {
efdb0237
LP		 453 r = parse_boolean(e);
454 if (r < 0)
c78c095b 455 return log_error_errno(r, "Failed to parse $%s: %m", var);
5da38d07
TH		 456 if (r > 0)
457 arg_unified_cgroup_hierarchy = CGROUP_UNIFIED_ALL;
458 else
459 arg_unified_cgroup_hierarchy = CGROUP_UNIFIED_NONE;
efdb0237
LP		 460 }
461
8199d554
LP		 462 return 0;
463}
464
465static int detect_unified_cgroup_hierarchy_from_image(const char *directory) {
466 int r;
467
75b0d8b8
ZJS		 468 /* Let's inherit the mode to use from the host system, but let's take into consideration what systemd
469 * in the image actually supports. */
b4cccbc1
LP		 470 r = cg_all_unified();
471 if (r < 0)
472 return log_error_errno(r, "Failed to determine whether we are in all unified mode.");
473 if (r > 0) {
a8725a06
ZJS		 474 /* Unified cgroup hierarchy support was added in 230. Unfortunately the detection
475 * routine only detects 231, so we'll have a false negative here for 230. */
476 r = systemd_installation_has_version(directory, 230);
477 if (r < 0)
478 return log_error_errno(r, "Failed to determine systemd version in container: %m");
479 if (r > 0)
480 arg_unified_cgroup_hierarchy = CGROUP_UNIFIED_ALL;
481 else
482 arg_unified_cgroup_hierarchy = CGROUP_UNIFIED_NONE;
c22800e4 483 } else if (cg_unified_controller(SYSTEMD_CGROUP_CONTROLLER) > 0) {
2977724b
TH		 484 /* Mixed cgroup hierarchy support was added in 233 */
485 r = systemd_installation_has_version(directory, 233);
0fd9563f
ZJS		 486 if (r < 0)
487 return log_error_errno(r, "Failed to determine systemd version in container: %m");
488 if (r > 0)
489 arg_unified_cgroup_hierarchy = CGROUP_UNIFIED_SYSTEMD;
490 else
491 arg_unified_cgroup_hierarchy = CGROUP_UNIFIED_NONE;
492 } else
5da38d07 493 arg_unified_cgroup_hierarchy = CGROUP_UNIFIED_NONE;
efdb0237 494
8199d554
LP		 495 log_debug("Using %s hierarchy for container.",
496 arg_unified_cgroup_hierarchy == CGROUP_UNIFIED_NONE ? "legacy" :
497 arg_unified_cgroup_hierarchy == CGROUP_UNIFIED_SYSTEMD ? "hybrid" : "unified");
498
efdb0237
LP		 499 return 0;
500}
501
8a99bd0c
ZJS		 502static int parse_capability_spec(const char *spec, uint64_t *ret_mask) {
503 uint64_t mask = 0;
504 int r;
505
506 for (;;) {
507 _cleanup_free_ char *t = NULL;
508
509 r = extract_first_word(&spec, &t, ",", 0);
510 if (r < 0)
511 return log_error_errno(r, "Failed to parse capability %s.", t);
512 if (r == 0)
513 break;
514
515 if (streq(t, "help")) {
516 for (int i = 0; i < capability_list_length(); i++) {
517 const char *name;
518
519 name = capability_to_name(i);
520 if (name)
521 puts(name);
522 }
523
524 return 0; /* quit */
525 }
526
527 if (streq(t, "all"))
528 mask = (uint64_t) -1;
529 else {
530 r = capability_from_name(t);
531 if (r < 0)
532 return log_error_errno(r, "Failed to parse capability %s.", t);
533
534 mask |= 1ULL << r;
535 }
536 }
537
538 *ret_mask = mask;
539 return 1; /* continue */
540}
541
49048684 542static int parse_share_ns_env(const char *name, unsigned long ns_flag) {
0c582db0
LB		 543 int r;
544
545 r = getenv_bool(name);
546 if (r == -ENXIO)
49048684 547 return 0;
0c582db0 548 if (r < 0)
49048684 549 return log_error_errno(r, "Failed to parse $%s: %m", name);
de40a303 550
0c582db0 551 arg_clone_ns_flags = (arg_clone_ns_flags & ~ns_flag) | (r > 0 ? 0 : ns_flag);
de40a303 552 arg_settings_mask |= SETTING_CLONE_NS_FLAGS;
49048684 553 return 0;
0c582db0
LB		 554}
555
49048684 556static int parse_mount_settings_env(void) {
4f086aab 557 const char *e;
1099ceeb
LP		 558 int r;
559
560 r = getenv_bool("SYSTEMD_NSPAWN_TMPFS_TMP");
49048684
ZJS		 561 if (r < 0 && r != -ENXIO)
562 return log_error_errno(r, "Failed to parse $SYSTEMD_NSPAWN_TMPFS_TMP: %m");
1099ceeb
LP		 563 if (r >= 0)
564 SET_FLAG(arg_mount_settings, MOUNT_APPLY_TMPFS_TMP, r > 0);
4f086aab
SU		 565
566 e = getenv("SYSTEMD_NSPAWN_API_VFS_WRITABLE");
49048684 567 if (streq_ptr(e, "network"))
4f086aab 568 arg_mount_settings |= MOUNT_APPLY_APIVFS_RO|MOUNT_APPLY_APIVFS_NETNS;
4f086aab 569
49048684
ZJS		 570 else if (e) {
571 r = parse_boolean(e);
572 if (r < 0)
573 return log_error_errno(r, "Failed to parse $SYSTEMD_NSPAWN_API_VFS_WRITABLE: %m");
574
575 SET_FLAG(arg_mount_settings, MOUNT_APPLY_APIVFS_RO, r == 0);
576 SET_FLAG(arg_mount_settings, MOUNT_APPLY_APIVFS_NETNS, false);
ab8ee0f2 577 }
4f086aab 578
49048684 579 return 0;
4f086aab
SU		 580}
581
49048684 582static int parse_environment(void) {
d5455d2f
LP		 583 const char *e;
584 int r;
585
49048684
ZJS		 586 r = parse_share_ns_env("SYSTEMD_NSPAWN_SHARE_NS_IPC", CLONE_NEWIPC);
587 if (r < 0)
588 return r;
589 r = parse_share_ns_env("SYSTEMD_NSPAWN_SHARE_NS_PID", CLONE_NEWPID);
590 if (r < 0)
591 return r;
592 r = parse_share_ns_env("SYSTEMD_NSPAWN_SHARE_NS_UTS", CLONE_NEWUTS);
593 if (r < 0)
594 return r;
595 r = parse_share_ns_env("SYSTEMD_NSPAWN_SHARE_SYSTEM", CLONE_NEWIPC|CLONE_NEWPID|CLONE_NEWUTS);
596 if (r < 0)
597 return r;
d5455d2f 598
49048684
ZJS		 599 r = parse_mount_settings_env();
600 if (r < 0)
601 return r;
d5455d2f 602
489fae52
ZJS		 603 /* SYSTEMD_NSPAWN_USE_CGNS=0 can be used to disable CLONE_NEWCGROUP use,
604 * even if it is supported. If not supported, it has no effect. */
de40a303 605 if (!cg_ns_supported())
489fae52 606 arg_use_cgns = false;
de40a303
LP		 607 else {
608 r = getenv_bool("SYSTEMD_NSPAWN_USE_CGNS");
609 if (r < 0) {
610 if (r != -ENXIO)
49048684 611 return log_error_errno(r, "Failed to parse $SYSTEMD_NSPAWN_USE_CGNS: %m");
de40a303
LP		 612
613 arg_use_cgns = true;
614 } else {
615 arg_use_cgns = r > 0;
616 arg_settings_mask |= SETTING_USE_CGNS;
617 }
618 }
d5455d2f
LP		 619
620 e = getenv("SYSTEMD_NSPAWN_CONTAINER_SERVICE");
621 if (e)
622 arg_container_service_name = e;
623
49048684 624 return detect_unified_cgroup_hierarchy_from_environment();
d5455d2f
LP		 625}
626
88213476 627static int parse_argv(int argc, char *argv[]) {
a41fe3a2 628 enum {
acbeb427
ZJS		 629 ARG_VERSION = 0x100,
630 ARG_PRIVATE_NETWORK,
bc2f673e 631 ARG_UUID,
5076f0cc 632 ARG_READ_ONLY,
57fb9fb5 633 ARG_CAPABILITY,
420c7379 634 ARG_DROP_CAPABILITY,
17fe0523
LP		 635 ARG_LINK_JOURNAL,
636 ARG_BIND,
f4889f65 637 ARG_BIND_RO,
06c17c39 638 ARG_TMPFS,
5a8af538
LP		 639 ARG_OVERLAY,
640 ARG_OVERLAY_RO,
de40a303 641 ARG_INACCESSIBLE,
eb91eb18 642 ARG_SHARE_SYSTEM,
89f7c846 643 ARG_REGISTER,
aa28aefe 644 ARG_KEEP_UNIT,
69c79d3c 645 ARG_NETWORK_INTERFACE,
c74e630d 646 ARG_NETWORK_MACVLAN,
4bbfe7ad 647 ARG_NETWORK_IPVLAN,
ab046dde 648 ARG_NETWORK_BRIDGE,
22b28dfd 649 ARG_NETWORK_ZONE,
f6d6bad1 650 ARG_NETWORK_VETH_EXTRA,
d7bea6b6 651 ARG_NETWORK_NAMESPACE_PATH,
6afc95b7 652 ARG_PERSONALITY,
4d9f07b4 653 ARG_VOLATILE,
ec16945e 654 ARG_TEMPLATE,
f36933fe 655 ARG_PROPERTY,
6dac160c 656 ARG_PRIVATE_USERS,
c6c8f6e2 657 ARG_KILL_SIGNAL,
f757855e 658 ARG_SETTINGS,
5f932eb9 659 ARG_CHDIR,
b53ede69 660 ARG_PIVOT_ROOT,
7336138e 661 ARG_PRIVATE_USERS_CHOWN,
9c1e04d0 662 ARG_NOTIFY_READY,
4623e8e6 663 ARG_ROOT_HASH,
960e4569 664 ARG_SYSTEM_CALL_FILTER,
bf428efb 665 ARG_RLIMIT,
3a9530e5 666 ARG_HOSTNAME,
66edd963 667 ARG_NO_NEW_PRIVILEGES,
81f345df 668 ARG_OOM_SCORE_ADJUST,
d107bb7d 669 ARG_CPU_AFFINITY,
09d423e9 670 ARG_RESOLV_CONF,
1688841f 671 ARG_TIMEZONE,
de40a303
LP		 672 ARG_CONSOLE,
673 ARG_PIPE,
674 ARG_OCI_BUNDLE,
bb068de0 675 ARG_NO_PAGER,
e7cbe5cb 676 ARG_VERITY_DATA,
c2923fdc 677 ARG_ROOT_HASH_SIG,
a41fe3a2
LP		 678 };
679
88213476 680 static const struct option options[] = {
d7bea6b6
DP		 681 { "help", no_argument, NULL, 'h' },
682 { "version", no_argument, NULL, ARG_VERSION },
683 { "directory", required_argument, NULL, 'D' },
684 { "template", required_argument, NULL, ARG_TEMPLATE },
685 { "ephemeral", no_argument, NULL, 'x' },
686 { "user", required_argument, NULL, 'u' },
687 { "private-network", no_argument, NULL, ARG_PRIVATE_NETWORK },
688 { "as-pid2", no_argument, NULL, 'a' },
689 { "boot", no_argument, NULL, 'b' },
690 { "uuid", required_argument, NULL, ARG_UUID },
691 { "read-only", no_argument, NULL, ARG_READ_ONLY },
692 { "capability", required_argument, NULL, ARG_CAPABILITY },
693 { "drop-capability", required_argument, NULL, ARG_DROP_CAPABILITY },
66edd963 694 { "no-new-privileges", required_argument, NULL, ARG_NO_NEW_PRIVILEGES },
d7bea6b6
DP		 695 { "link-journal", required_argument, NULL, ARG_LINK_JOURNAL },
696 { "bind", required_argument, NULL, ARG_BIND },
697 { "bind-ro", required_argument, NULL, ARG_BIND_RO },
698 { "tmpfs", required_argument, NULL, ARG_TMPFS },
699 { "overlay", required_argument, NULL, ARG_OVERLAY },
700 { "overlay-ro", required_argument, NULL, ARG_OVERLAY_RO },
de40a303 701 { "inaccessible", required_argument, NULL, ARG_INACCESSIBLE },
d7bea6b6 702 { "machine", required_argument, NULL, 'M' },
3a9530e5 703 { "hostname", required_argument, NULL, ARG_HOSTNAME },
d7bea6b6
DP		 704 { "slice", required_argument, NULL, 'S' },
705 { "setenv", required_argument, NULL, 'E' },
706 { "selinux-context", required_argument, NULL, 'Z' },
707 { "selinux-apifs-context", required_argument, NULL, 'L' },
708 { "quiet", no_argument, NULL, 'q' },
709 { "share-system", no_argument, NULL, ARG_SHARE_SYSTEM }, /* not documented */
710 { "register", required_argument, NULL, ARG_REGISTER },
711 { "keep-unit", no_argument, NULL, ARG_KEEP_UNIT },
712 { "network-interface", required_argument, NULL, ARG_NETWORK_INTERFACE },
713 { "network-macvlan", required_argument, NULL, ARG_NETWORK_MACVLAN },
714 { "network-ipvlan", required_argument, NULL, ARG_NETWORK_IPVLAN },
715 { "network-veth", no_argument, NULL, 'n' },
716 { "network-veth-extra", required_argument, NULL, ARG_NETWORK_VETH_EXTRA },
717 { "network-bridge", required_argument, NULL, ARG_NETWORK_BRIDGE },
718 { "network-zone", required_argument, NULL, ARG_NETWORK_ZONE },
719 { "network-namespace-path", required_argument, NULL, ARG_NETWORK_NAMESPACE_PATH },
720 { "personality", required_argument, NULL, ARG_PERSONALITY },
721 { "image", required_argument, NULL, 'i' },
722 { "volatile", optional_argument, NULL, ARG_VOLATILE },
723 { "port", required_argument, NULL, 'p' },
724 { "property", required_argument, NULL, ARG_PROPERTY },
725 { "private-users", optional_argument, NULL, ARG_PRIVATE_USERS },
726 { "private-users-chown", optional_argument, NULL, ARG_PRIVATE_USERS_CHOWN },
727 { "kill-signal", required_argument, NULL, ARG_KILL_SIGNAL },
728 { "settings", required_argument, NULL, ARG_SETTINGS },
729 { "chdir", required_argument, NULL, ARG_CHDIR },
730 { "pivot-root", required_argument, NULL, ARG_PIVOT_ROOT },
731 { "notify-ready", required_argument, NULL, ARG_NOTIFY_READY },
732 { "root-hash", required_argument, NULL, ARG_ROOT_HASH },
733 { "system-call-filter", required_argument, NULL, ARG_SYSTEM_CALL_FILTER },
bf428efb 734 { "rlimit", required_argument, NULL, ARG_RLIMIT },
81f345df 735 { "oom-score-adjust", required_argument, NULL, ARG_OOM_SCORE_ADJUST },
d107bb7d 736 { "cpu-affinity", required_argument, NULL, ARG_CPU_AFFINITY },
09d423e9 737 { "resolv-conf", required_argument, NULL, ARG_RESOLV_CONF },
1688841f 738 { "timezone", required_argument, NULL, ARG_TIMEZONE },
de40a303
LP		 739 { "console", required_argument, NULL, ARG_CONSOLE },
740 { "pipe", no_argument, NULL, ARG_PIPE },
741 { "oci-bundle", required_argument, NULL, ARG_OCI_BUNDLE },
bb068de0 742 { "no-pager", no_argument, NULL, ARG_NO_PAGER },
e7cbe5cb 743 { "verity-data", required_argument, NULL, ARG_VERITY_DATA },
c2923fdc 744 { "root-hash-sig", required_argument, NULL, ARG_ROOT_HASH_SIG },
eb9da376 745 {}
88213476
LP		 746 };
747
9444b1f2 748 int c, r;
a42c8b54 749 uint64_t plus = 0, minus = 0;
f757855e 750 bool mask_all_settings = false, mask_no_settings = false;
88213476
LP		 751
752 assert(argc >= 0);
753 assert(argv);
754
de40a303 755 while ((c = getopt_long(argc, argv, "+hD:u:abL:M:jS:Z:qi:xp:nUE:P", options, NULL)) >= 0)
88213476
LP		 756 switch (c) {
757
758 case 'h':
37ec0fdd 759 return help();
88213476 760
acbeb427 761 case ARG_VERSION:
3f6fd1ba 762 return version();
acbeb427 763
88213476 764 case 'D':
0f03c2a4 765 r = parse_path_argument_and_warn(optarg, false, &arg_directory);
ec16945e 766 if (r < 0)
0f03c2a4 767 return r;
de40a303
LP		 768
769 arg_settings_mask |= SETTING_DIRECTORY;
ec16945e
LP		 770 break;
771
772 case ARG_TEMPLATE:
0f03c2a4 773 r = parse_path_argument_and_warn(optarg, false, &arg_template);
ec16945e 774 if (r < 0)
0f03c2a4 775 return r;
de40a303
LP		 776
777 arg_settings_mask |= SETTING_DIRECTORY;
88213476
LP		 778 break;
779
1b9e5b12 780 case 'i':
0f03c2a4 781 r = parse_path_argument_and_warn(optarg, false, &arg_image);
ec16945e 782 if (r < 0)
0f03c2a4 783 return r;
de40a303
LP		 784
785 arg_settings_mask |= SETTING_DIRECTORY;
786 break;
787
788 case ARG_OCI_BUNDLE:
789 r = parse_path_argument_and_warn(optarg, false, &arg_oci_bundle);
790 if (r < 0)
791 return r;
792
ec16945e
LP		 793 break;
794
795 case 'x':
796 arg_ephemeral = true;
a2f577fc 797 arg_settings_mask |= SETTING_EPHEMERAL;
1b9e5b12
LP		 798 break;
799
687d0825 800 case 'u':
2fc09a9c
DM		 801 r = free_and_strdup(&arg_user, optarg);
802 if (r < 0)
7027ff61 803 return log_oom();
687d0825 804
f757855e 805 arg_settings_mask |= SETTING_USER;
687d0825
MV		 806 break;
807
22b28dfd
LP		 808 case ARG_NETWORK_ZONE: {
809 char *j;
810
b910cc72 811 j = strjoin("vz-", optarg);
22b28dfd
LP		 812 if (!j)
813 return log_oom();
814
815 if (!ifname_valid(j)) {
816 log_error("Network zone name not valid: %s", j);
817 free(j);
818 return -EINVAL;
819 }
820
df1fac6d 821 free_and_replace(arg_network_zone, j);
22b28dfd
LP		 822
823 arg_network_veth = true;
824 arg_private_network = true;
825 arg_settings_mask |= SETTING_NETWORK;
826 break;
827 }
828
ab046dde 829 case ARG_NETWORK_BRIDGE:
ef76dff2 830
baaa35ad
ZJS		 831 if (!ifname_valid(optarg))
832 return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
833 "Bridge interface name not valid: %s", optarg);
ef76dff2 834
f757855e
LP		 835 r = free_and_strdup(&arg_network_bridge, optarg);
836 if (r < 0)
837 return log_oom();
ab046dde 838
4831981d 839 _fallthrough_;
0dfaa006 840 case 'n':
69c79d3c
LP		 841 arg_network_veth = true;
842 arg_private_network = true;
f757855e 843 arg_settings_mask |= SETTING_NETWORK;
69c79d3c
LP		 844 break;
845
f6d6bad1
LP		 846 case ARG_NETWORK_VETH_EXTRA:
847 r = veth_extra_parse(&arg_network_veth_extra, optarg);
848 if (r < 0)
849 return log_error_errno(r, "Failed to parse --network-veth-extra= parameter: %s", optarg);
850
851 arg_private_network = true;
852 arg_settings_mask |= SETTING_NETWORK;
853 break;
854
aa28aefe 855 case ARG_NETWORK_INTERFACE:
baaa35ad
ZJS		 856 if (!ifname_valid(optarg))
857 return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
858 "Network interface name not valid: %s", optarg);
ef76dff2 859
b390f178
DDM		 860 r = test_network_interface_initialized(optarg);
861 if (r < 0)
862 return r;
863
c74e630d
LP		 864 if (strv_extend(&arg_network_interfaces, optarg) < 0)
865 return log_oom();
866
867 arg_private_network = true;
f757855e 868 arg_settings_mask |= SETTING_NETWORK;
c74e630d
LP		 869 break;
870
871 case ARG_NETWORK_MACVLAN:
ef76dff2 872
baaa35ad
ZJS		 873 if (!ifname_valid(optarg))
874 return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
875 "MACVLAN network interface name not valid: %s", optarg);
ef76dff2 876
b390f178
DDM		 877 r = test_network_interface_initialized(optarg);
878 if (r < 0)
879 return r;
880
c74e630d 881 if (strv_extend(&arg_network_macvlan, optarg) < 0)
aa28aefe
LP		 882 return log_oom();
883
4bbfe7ad 884 arg_private_network = true;
f757855e 885 arg_settings_mask |= SETTING_NETWORK;
4bbfe7ad
TG		 886 break;
887
888 case ARG_NETWORK_IPVLAN:
ef76dff2 889
baaa35ad
ZJS		 890 if (!ifname_valid(optarg))
891 return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
892 "IPVLAN network interface name not valid: %s", optarg);
ef76dff2 893
b390f178
DDM		 894 r = test_network_interface_initialized(optarg);
895 if (r < 0)
896 return r;
897
4bbfe7ad
TG		 898 if (strv_extend(&arg_network_ipvlan, optarg) < 0)
899 return log_oom();
900
4831981d 901 _fallthrough_;
ff01d048
LP		 902 case ARG_PRIVATE_NETWORK:
903 arg_private_network = true;
f757855e 904 arg_settings_mask |= SETTING_NETWORK;
a41fe3a2
LP		 905 break;
906
d7bea6b6
DP		 907 case ARG_NETWORK_NAMESPACE_PATH:
908 r = parse_path_argument_and_warn(optarg, false, &arg_network_namespace_path);
909 if (r < 0)
910 return r;
911
de40a303 912 arg_settings_mask |= SETTING_NETWORK;
d7bea6b6
DP		 913 break;
914
0f0dbc46 915 case 'b':
baaa35ad
ZJS		 916 if (arg_start_mode == START_PID2)
917 return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
918 "--boot and --as-pid2 may not be combined.");
7732f92b
LP		 919
920 arg_start_mode = START_BOOT;
921 arg_settings_mask |= SETTING_START_MODE;
922 break;
923
924 case 'a':
baaa35ad
ZJS		 925 if (arg_start_mode == START_BOOT)
926 return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
927 "--boot and --as-pid2 may not be combined.");
7732f92b
LP		 928
929 arg_start_mode = START_PID2;
930 arg_settings_mask |= SETTING_START_MODE;
0f0dbc46
LP		 931 break;
932
144f0fc0 933 case ARG_UUID:
9444b1f2 934 r = sd_id128_from_string(optarg, &arg_uuid);
317feb4d
LP		 935 if (r < 0)
936 return log_error_errno(r, "Invalid UUID: %s", optarg);
937
baaa35ad
ZJS		 938 if (sd_id128_is_null(arg_uuid))
939 return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
940 "Machine UUID may not be all zeroes.");
f757855e
LP		 941
942 arg_settings_mask |= SETTING_MACHINE_ID;
9444b1f2 943 break;
aa96c6cb 944
43c3fb46
LP		 945 case 'S': {
946 _cleanup_free_ char *mangled = NULL;
947
948 r = unit_name_mangle_with_suffix(optarg, NULL, UNIT_NAME_MANGLE_WARN, ".slice", &mangled);
de40a303
LP		 949 if (r < 0)
950 return log_oom();
951
43c3fb46 952 free_and_replace(arg_slice, mangled);
de40a303 953 arg_settings_mask |= SETTING_SLICE;
144f0fc0 954 break;
43c3fb46 955 }
144f0fc0 956
7027ff61 957 case 'M':
c1521918 958 if (isempty(optarg))
97b11eed 959 arg_machine = mfree(arg_machine);
c1521918 960 else {
baaa35ad
ZJS		 961 if (!machine_name_is_valid(optarg))
962 return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
963 "Invalid machine name: %s", optarg);
7027ff61 964
0c3c4284
LP		 965 r = free_and_strdup(&arg_machine, optarg);
966 if (r < 0)
eb91eb18 967 return log_oom();
eb91eb18 968 }
9ce6d1b3 969 break;
7027ff61 970
3a9530e5
LP		 971 case ARG_HOSTNAME:
972 if (isempty(optarg))
973 arg_hostname = mfree(arg_hostname);
974 else {
baaa35ad
ZJS		 975 if (!hostname_is_valid(optarg, false))
976 return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
977 "Invalid hostname: %s", optarg);
3a9530e5
LP		 978
979 r = free_and_strdup(&arg_hostname, optarg);
980 if (r < 0)
981 return log_oom();
982 }
983
984 arg_settings_mask |= SETTING_HOSTNAME;
985 break;
986
82adf6af
LP		 987 case 'Z':
988 arg_selinux_context = optarg;
a8828ed9
DW		 989 break;
990
82adf6af
LP		 991 case 'L':
992 arg_selinux_apifs_context = optarg;
a8828ed9
DW		 993 break;
994
bc2f673e
LP		 995 case ARG_READ_ONLY:
996 arg_read_only = true;
f757855e 997 arg_settings_mask |= SETTING_READ_ONLY;
bc2f673e
LP		 998 break;
999
420c7379
LP		 1000 case ARG_CAPABILITY:
1001 case ARG_DROP_CAPABILITY: {
8a99bd0c
ZJS		 1002 uint64_t m;
1003 r = parse_capability_spec(optarg, &m);
1004 if (r <= 0)
1005 return r;
5076f0cc 1006
8a99bd0c
ZJS		 1007 if (c == ARG_CAPABILITY)
1008 plus |= m;
1009 else
1010 minus |= m;
f757855e 1011 arg_settings_mask |= SETTING_CAPABILITY;
5076f0cc
LP		 1012 break;
1013 }
66edd963
LP		 1014 case ARG_NO_NEW_PRIVILEGES:
1015 r = parse_boolean(optarg);
1016 if (r < 0)
1017 return log_error_errno(r, "Failed to parse --no-new-privileges= argument: %s", optarg);
1018
1019 arg_no_new_privileges = r;
1020 arg_settings_mask |= SETTING_NO_NEW_PRIVILEGES;
1021 break;
1022
57fb9fb5
LP		 1023 case 'j':
1024 arg_link_journal = LINK_GUEST;
574edc90 1025 arg_link_journal_try = true;
4e1d6aa9 1026 arg_settings_mask |= SETTING_LINK_JOURNAL;
57fb9fb5
LP		 1027 break;
1028
1029 case ARG_LINK_JOURNAL:
4e1d6aa9 1030 r = parse_link_journal(optarg, &arg_link_journal, &arg_link_journal_try);
c6147113
LP		 1031 if (r < 0)
1032 return log_error_errno(r, "Failed to parse link journal mode %s", optarg);
57fb9fb5 1033
4e1d6aa9 1034 arg_settings_mask |= SETTING_LINK_JOURNAL;
57fb9fb5
LP		 1035 break;
1036
17fe0523 1037 case ARG_BIND:
f757855e
LP		 1038 case ARG_BIND_RO:
1039 r = bind_mount_parse(&arg_custom_mounts, &arg_n_custom_mounts, optarg, c == ARG_BIND_RO);
1040 if (r < 0)
1041 return log_error_errno(r, "Failed to parse --bind(-ro)= argument %s: %m", optarg);
17fe0523 1042
f757855e 1043 arg_settings_mask |= SETTING_CUSTOM_MOUNTS;
17fe0523 1044 break;
06c17c39 1045
f757855e
LP		 1046 case ARG_TMPFS:
1047 r = tmpfs_mount_parse(&arg_custom_mounts, &arg_n_custom_mounts, optarg);
1048 if (r < 0)
1049 return log_error_errno(r, "Failed to parse --tmpfs= argument %s: %m", optarg);
5a8af538 1050
f757855e 1051 arg_settings_mask |= SETTING_CUSTOM_MOUNTS;
5a8af538 1052 break;
5a8af538
LP		 1053
1054 case ARG_OVERLAY:
ad85779a
LP		 1055 case ARG_OVERLAY_RO:
1056 r = overlay_mount_parse(&arg_custom_mounts, &arg_n_custom_mounts, optarg, c == ARG_OVERLAY_RO);
1057 if (r == -EADDRNOTAVAIL)
1058 return log_error_errno(r, "--overlay(-ro)= needs at least two colon-separated directories specified.");
1059 if (r < 0)
1060 return log_error_errno(r, "Failed to parse --overlay(-ro)= argument %s: %m", optarg);
06c17c39 1061
f757855e 1062 arg_settings_mask |= SETTING_CUSTOM_MOUNTS;
06c17c39 1063 break;
06c17c39 1064
de40a303
LP		 1065 case ARG_INACCESSIBLE:
1066 r = inaccessible_mount_parse(&arg_custom_mounts, &arg_n_custom_mounts, optarg);
1067 if (r < 0)
1068 return log_error_errno(r, "Failed to parse --inaccessible= argument %s: %m", optarg);
1069
1070 arg_settings_mask |= SETTING_CUSTOM_MOUNTS;
1071 break;
1072
a5f1cb3b 1073 case 'E': {
f4889f65
LP		 1074 char **n;
1075
baaa35ad
ZJS		 1076 if (!env_assignment_is_valid(optarg))
1077 return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
1078 "Environment variable assignment '%s' is not valid.", optarg);
f4889f65
LP		 1079
1080 n = strv_env_set(arg_setenv, optarg);
1081 if (!n)
1082 return log_oom();
1083
130d3d22 1084 strv_free_and_replace(arg_setenv, n);
f757855e 1085 arg_settings_mask |= SETTING_ENVIRONMENT;
f4889f65
LP		 1086 break;
1087 }
1088
284c0b91
LP		 1089 case 'q':
1090 arg_quiet = true;
1091 break;
1092
8a96d94e 1093 case ARG_SHARE_SYSTEM:
a6b5216c 1094 /* We don't officially support this anymore, except for compat reasons. People should use the
0c582db0 1095 * $SYSTEMD_NSPAWN_SHARE_* environment variables instead. */
63d1c29f 1096 log_warning("Please do not use --share-system anymore, use $SYSTEMD_NSPAWN_SHARE_* instead.");
0c582db0 1097 arg_clone_ns_flags = 0;
8a96d94e
LP		 1098 break;
1099
eb91eb18
LP		 1100 case ARG_REGISTER:
1101 r = parse_boolean(optarg);
1102 if (r < 0) {
1103 log_error("Failed to parse --register= argument: %s", optarg);
1104 return r;
1105 }
1106
1107 arg_register = r;
1108 break;
1109
89f7c846
LP		 1110 case ARG_KEEP_UNIT:
1111 arg_keep_unit = true;
1112 break;
1113
6afc95b7
LP		 1114 case ARG_PERSONALITY:
1115
ac45f971 1116 arg_personality = personality_from_string(optarg);
baaa35ad
ZJS		 1117 if (arg_personality == PERSONALITY_INVALID)
1118 return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
1119 "Unknown or unsupported personality '%s'.", optarg);
6afc95b7 1120
f757855e 1121 arg_settings_mask |= SETTING_PERSONALITY;
6afc95b7
LP		 1122 break;
1123
4d9f07b4
LP		 1124 case ARG_VOLATILE:
1125
1126 if (!optarg)
f757855e 1127 arg_volatile_mode = VOLATILE_YES;
5c828e66
LP		 1128 else if (streq(optarg, "help")) {
1129 DUMP_STRING_TABLE(volatile_mode, VolatileMode, _VOLATILE_MODE_MAX);
1130 return 0;
1131 } else {
f757855e 1132 VolatileMode m;
4d9f07b4 1133
f757855e 1134 m = volatile_mode_from_string(optarg);
baaa35ad
ZJS		 1135 if (m < 0)
1136 return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
1137 "Failed to parse --volatile= argument: %s", optarg);
1138 else
f757855e 1139 arg_volatile_mode = m;
6d0b55c2
LP		 1140 }
1141
f757855e
LP		 1142 arg_settings_mask |= SETTING_VOLATILE_MODE;
1143 break;
6d0b55c2 1144
f757855e
LP		 1145 case 'p':
1146 r = expose_port_parse(&arg_expose_ports, optarg);
1147 if (r == -EEXIST)
1148 return log_error_errno(r, "Duplicate port specification: %s", optarg);
1149 if (r < 0)
1150 return log_error_errno(r, "Failed to parse host port %s: %m", optarg);
6d0b55c2 1151
f757855e 1152 arg_settings_mask |= SETTING_EXPOSE_PORTS;
6d0b55c2 1153 break;
6d0b55c2 1154
f36933fe
LP		 1155 case ARG_PROPERTY:
1156 if (strv_extend(&arg_property, optarg) < 0)
1157 return log_oom();
1158
1159 break;
1160
ae209204
ZJS		 1161 case ARG_PRIVATE_USERS: {
1162 int boolean = -1;
0de7acce 1163
ae209204
ZJS		 1164 if (!optarg)
1165 boolean = true;
1166 else if (!in_charset(optarg, DIGITS))
1167 /* do *not* parse numbers as booleans */
1168 boolean = parse_boolean(optarg);
1169
1170 if (boolean == false) {
0de7acce
LP		 1171 /* no: User namespacing off */
1172 arg_userns_mode = USER_NAMESPACE_NO;
1173 arg_uid_shift = UID_INVALID;
1174 arg_uid_range = UINT32_C(0x10000);
ae209204 1175 } else if (boolean == true) {
0de7acce
LP		 1176 /* yes: User namespacing on, UID range is read from root dir */
1177 arg_userns_mode = USER_NAMESPACE_FIXED;
1178 arg_uid_shift = UID_INVALID;
1179 arg_uid_range = UINT32_C(0x10000);
1180 } else if (streq(optarg, "pick")) {
1181 /* pick: User namespacing on, UID range is picked randomly */
1182 arg_userns_mode = USER_NAMESPACE_PICK;
1183 arg_uid_shift = UID_INVALID;
1184 arg_uid_range = UINT32_C(0x10000);
1185 } else {
6c2058b3 1186 _cleanup_free_ char *buffer = NULL;
6dac160c
LP		 1187 const char *range, *shift;
1188
0de7acce
LP		 1189 /* anything else: User namespacing on, UID range is explicitly configured */
1190
6dac160c
LP		 1191 range = strchr(optarg, ':');
1192 if (range) {
6c2058b3
ZJS		 1193 buffer = strndup(optarg, range - optarg);
1194 if (!buffer)
1195 return log_oom();
1196 shift = buffer;
6dac160c
LP		 1197
1198 range++;
bfd292ec
ZJS		 1199 r = safe_atou32(range, &arg_uid_range);
1200 if (r < 0)
be715731 1201 return log_error_errno(r, "Failed to parse UID range \"%s\": %m", range);
6dac160c
LP		 1202 } else
1203 shift = optarg;
1204
be715731
ZJS		 1205 r = parse_uid(shift, &arg_uid_shift);
1206 if (r < 0)
1207 return log_error_errno(r, "Failed to parse UID \"%s\": %m", optarg);
0de7acce
LP		 1208
1209 arg_userns_mode = USER_NAMESPACE_FIXED;
6dac160c
LP		 1210 }
1211
baaa35ad
ZJS		 1212 if (arg_uid_range <= 0)
1213 return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
1214 "UID range cannot be 0.");
be715731 1215
0de7acce 1216 arg_settings_mask |= SETTING_USERNS;
6dac160c 1217 break;
ae209204 1218 }
6dac160c 1219
0de7acce 1220 case 'U':
ccabee0d
LP		 1221 if (userns_supported()) {
1222 arg_userns_mode = USER_NAMESPACE_PICK;
1223 arg_uid_shift = UID_INVALID;
1224 arg_uid_range = UINT32_C(0x10000);
1225
1226 arg_settings_mask |= SETTING_USERNS;
6dac160c
LP		 1227 }
1228
7336138e
LP		 1229 break;
1230
0de7acce 1231 case ARG_PRIVATE_USERS_CHOWN:
19aac838 1232 arg_userns_chown = true;
0de7acce
LP		 1233
1234 arg_settings_mask |= SETTING_USERNS;
6dac160c
LP		 1235 break;
1236
c6c8f6e2 1237 case ARG_KILL_SIGNAL:
5c828e66
LP		 1238 if (streq(optarg, "help")) {
1239 DUMP_STRING_TABLE(signal, int, _NSIG);
1240 return 0;
1241 }
1242
29a3db75 1243 arg_kill_signal = signal_from_string(optarg);
baaa35ad
ZJS		 1244 if (arg_kill_signal < 0)
1245 return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
1246 "Cannot parse signal: %s", optarg);
c6c8f6e2 1247
f757855e
LP		 1248 arg_settings_mask |= SETTING_KILL_SIGNAL;
1249 break;
1250
1251 case ARG_SETTINGS:
1252
1253 /* no → do not read files
1254 * yes → read files, do not override cmdline, trust only subset
1255 * override → read files, override cmdline, trust only subset
1256 * trusted → read files, do not override cmdline, trust all
1257 */
1258
1259 r = parse_boolean(optarg);
1260 if (r < 0) {
1261 if (streq(optarg, "trusted")) {
1262 mask_all_settings = false;
1263 mask_no_settings = false;
1264 arg_settings_trusted = true;
1265
1266 } else if (streq(optarg, "override")) {
1267 mask_all_settings = false;
1268 mask_no_settings = true;
1269 arg_settings_trusted = -1;
1270 } else
1271 return log_error_errno(r, "Failed to parse --settings= argument: %s", optarg);
1272 } else if (r > 0) {
1273 /* yes */
1274 mask_all_settings = false;
1275 mask_no_settings = false;
1276 arg_settings_trusted = -1;
1277 } else {
1278 /* no */
1279 mask_all_settings = true;
1280 mask_no_settings = false;
1281 arg_settings_trusted = false;
1282 }
1283
c6c8f6e2
LP		 1284 break;
1285
5f932eb9 1286 case ARG_CHDIR:
baaa35ad
ZJS		 1287 if (!path_is_absolute(optarg))
1288 return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
1289 "Working directory %s is not an absolute path.", optarg);
5f932eb9
LP		 1290
1291 r = free_and_strdup(&arg_chdir, optarg);
1292 if (r < 0)
1293 return log_oom();
1294
1295 arg_settings_mask |= SETTING_WORKING_DIRECTORY;
1296 break;
1297
b53ede69
PW		 1298 case ARG_PIVOT_ROOT:
1299 r = pivot_root_parse(&arg_pivot_root_new, &arg_pivot_root_old, optarg);
1300 if (r < 0)
1301 return log_error_errno(r, "Failed to parse --pivot-root= argument %s: %m", optarg);
1302
1303 arg_settings_mask |= SETTING_PIVOT_ROOT;
1304 break;
1305
9c1e04d0
AP		 1306 case ARG_NOTIFY_READY:
1307 r = parse_boolean(optarg);
baaa35ad
ZJS		 1308 if (r < 0)
1309 return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
1310 "%s is not a valid notify mode. Valid modes are: yes, no, and ready.", optarg);
9c1e04d0
AP		 1311 arg_notify_ready = r;
1312 arg_settings_mask |= SETTING_NOTIFY_READY;
1313 break;
1314
4623e8e6
LP		 1315 case ARG_ROOT_HASH: {
1316 void *k;
1317 size_t l;
1318
1319 r = unhexmem(optarg, strlen(optarg), &k, &l);
1320 if (r < 0)
1321 return log_error_errno(r, "Failed to parse root hash: %s", optarg);
1322 if (l < sizeof(sd_id128_t)) {
4623e8e6 1323 free(k);
c6147113 1324 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Root hash must be at least 128bit long: %s", optarg);
4623e8e6
LP		 1325 }
1326
1327 free(arg_root_hash);
1328 arg_root_hash = k;
1329 arg_root_hash_size = l;
1330 break;
1331 }
1332
e7cbe5cb
LB		 1333 case ARG_VERITY_DATA:
1334 r = parse_path_argument_and_warn(optarg, false, &arg_verity_data);
1335 if (r < 0)
1336 return r;
1337 break;
1338
c2923fdc
LB		 1339 case ARG_ROOT_HASH_SIG: {
1340 char *value;
1341
1342 if ((value = startswith(optarg, "base64:"))) {
1343 void *p;
1344 size_t l;
1345
1346 r = unbase64mem(value, strlen(value), &p, &l);
1347 if (r < 0)
1348 return log_error_errno(r, "Failed to parse root hash signature '%s': %m", optarg);
1349
1350 free_and_replace(arg_root_hash_sig, p);
1351 arg_root_hash_sig_size = l;
1352 arg_root_hash_sig_path = mfree(arg_root_hash_sig_path);
1353 } else {
1354 r = parse_path_argument_and_warn(optarg, false, &arg_root_hash_sig_path);
1355 if (r < 0)
1356 return r;
1357 arg_root_hash_sig = mfree(arg_root_hash_sig);
1358 arg_root_hash_sig_size = 0;
1359 }
1360
1361 break;
1362 }
1363
960e4569
LP		 1364 case ARG_SYSTEM_CALL_FILTER: {
1365 bool negative;
1366 const char *items;
1367
1368 negative = optarg[0] == '~';
1369 items = negative ? optarg + 1 : optarg;
1370
1371 for (;;) {
1372 _cleanup_free_ char *word = NULL;
1373
1374 r = extract_first_word(&items, &word, NULL, 0);
1375 if (r == 0)
1376 break;
1377 if (r == -ENOMEM)
1378 return log_oom();
1379 if (r < 0)
1380 return log_error_errno(r, "Failed to parse system call filter: %m");
1381
1382 if (negative)
6b000af4 1383 r = strv_extend(&arg_syscall_deny_list, word);
960e4569 1384 else
6b000af4 1385 r = strv_extend(&arg_syscall_allow_list, word);
960e4569
LP		 1386 if (r < 0)
1387 return log_oom();
1388 }
1389
1390 arg_settings_mask |= SETTING_SYSCALL_FILTER;
1391 break;
1392 }
1393
bf428efb
LP		 1394 case ARG_RLIMIT: {
1395 const char *eq;
622ecfa8 1396 _cleanup_free_ char *name = NULL;
bf428efb
LP		 1397 int rl;
1398
5c828e66
LP		 1399 if (streq(optarg, "help")) {
1400 DUMP_STRING_TABLE(rlimit, int, _RLIMIT_MAX);
1401 return 0;
1402 }
1403
bf428efb 1404 eq = strchr(optarg, '=');
baaa35ad
ZJS		 1405 if (!eq)
1406 return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
1407 "--rlimit= expects an '=' assignment.");
bf428efb
LP		 1408
1409 name = strndup(optarg, eq - optarg);
1410 if (!name)
1411 return log_oom();
1412
1413 rl = rlimit_from_string_harder(name);
baaa35ad
ZJS		 1414 if (rl < 0)
1415 return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
1416 "Unknown resource limit: %s", name);
bf428efb
LP		 1417
1418 if (!arg_rlimit[rl]) {
1419 arg_rlimit[rl] = new0(struct rlimit, 1);
1420 if (!arg_rlimit[rl])
1421 return log_oom();
1422 }
1423
1424 r = rlimit_parse(rl, eq + 1, arg_rlimit[rl]);
1425 if (r < 0)
1426 return log_error_errno(r, "Failed to parse resource limit: %s", eq + 1);
1427
1428 arg_settings_mask |= SETTING_RLIMIT_FIRST << rl;
1429 break;
1430 }
1431
81f345df
LP		 1432 case ARG_OOM_SCORE_ADJUST:
1433 r = parse_oom_score_adjust(optarg, &arg_oom_score_adjust);
1434 if (r < 0)
1435 return log_error_errno(r, "Failed to parse --oom-score-adjust= parameter: %s", optarg);
1436
1437 arg_oom_score_adjust_set = true;
1438 arg_settings_mask |= SETTING_OOM_SCORE_ADJUST;
1439 break;
1440
d107bb7d 1441 case ARG_CPU_AFFINITY: {
0985c7c4 1442 CPUSet cpuset;
d107bb7d
LP		 1443
1444 r = parse_cpu_set(optarg, &cpuset);
1445 if (r < 0)
0985c7c4 1446 return log_error_errno(r, "Failed to parse CPU affinity mask %s: %m", optarg);
d107bb7d 1447
0985c7c4
ZJS		 1448 cpu_set_reset(&arg_cpu_set);
1449 arg_cpu_set = cpuset;
d107bb7d
LP		 1450 arg_settings_mask |= SETTING_CPU_AFFINITY;
1451 break;
1452 }
1453
09d423e9
LP		 1454 case ARG_RESOLV_CONF:
1455 if (streq(optarg, "help")) {
1456 DUMP_STRING_TABLE(resolv_conf_mode, ResolvConfMode, _RESOLV_CONF_MODE_MAX);
1457 return 0;
1458 }
1459
1460 arg_resolv_conf = resolv_conf_mode_from_string(optarg);
baaa35ad
ZJS		 1461 if (arg_resolv_conf < 0)
1462 return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
1463 "Failed to parse /etc/resolv.conf mode: %s", optarg);
09d423e9
LP		 1464
1465 arg_settings_mask |= SETTING_RESOLV_CONF;
1466 break;
1467
1688841f
LP		 1468 case ARG_TIMEZONE:
1469 if (streq(optarg, "help")) {
1470 DUMP_STRING_TABLE(timezone_mode, TimezoneMode, _TIMEZONE_MODE_MAX);
1471 return 0;
1472 }
1473
1474 arg_timezone = timezone_mode_from_string(optarg);
baaa35ad
ZJS		 1475 if (arg_timezone < 0)
1476 return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
1477 "Failed to parse /etc/localtime mode: %s", optarg);
1688841f
LP		 1478
1479 arg_settings_mask |= SETTING_TIMEZONE;
1480 break;
1481
de40a303 1482 case ARG_CONSOLE:
dce66ffe
ZJS		 1483 r = handle_arg_console(optarg);
1484 if (r <= 0)
1485 return r;
de40a303
LP		 1486 break;
1487
1488 case 'P':
1489 case ARG_PIPE:
dce66ffe
ZJS		 1490 r = handle_arg_console("pipe");
1491 if (r <= 0)
1492 return r;
de40a303
LP		 1493 break;
1494
bb068de0
ZJS		 1495 case ARG_NO_PAGER:
1496 arg_pager_flags |= PAGER_DISABLE;
1497 break;
1498
88213476
LP		 1499 case '?':
1500 return -EINVAL;
1501
1502 default:
eb9da376 1503 assert_not_reached("Unhandled option");
88213476 1504 }
88213476 1505
60f1ec13
LP		 1506 if (argc > optind) {
1507 strv_free(arg_parameters);
1508 arg_parameters = strv_copy(argv + optind);
1509 if (!arg_parameters)
1510 return log_oom();
d7bea6b6 1511
60f1ec13
LP		 1512 arg_settings_mask |= SETTING_START_MODE;
1513 }
1514
1515 if (arg_ephemeral && arg_template && !arg_directory)
1516 /* User asked for ephemeral execution but specified --template= instead of --directory=. Semantically
1517 * such an invocation makes some sense, see https://github.com/systemd/systemd/issues/3667. Let's
1518 * accept this here, and silently make "--ephemeral --template=" equivalent to "--ephemeral
1519 * --directory=". */
1520 arg_directory = TAKE_PTR(arg_template);
1521
bd4b15f2 1522 arg_caps_retain = (arg_caps_retain | plus | (arg_private_network ? UINT64_C(1) << CAP_NET_ADMIN : 0)) & ~minus;
60f1ec13 1523
de40a303 1524 /* Make sure to parse environment before we reset the settings mask below */
49048684
ZJS		 1525 r = parse_environment();
1526 if (r < 0)
1527 return r;
de40a303 1528
60f1ec13
LP		 1529 /* Load all settings from .nspawn files */
1530 if (mask_no_settings)
1531 arg_settings_mask = 0;
1532
1533 /* Don't load any settings from .nspawn files */
1534 if (mask_all_settings)
1535 arg_settings_mask = _SETTINGS_MASK_ALL;
1536
1537 return 1;
1538}
1539
1540static int verify_arguments(void) {
1541 int r;
a6b5216c 1542
75b0d8b8
ZJS		 1543 if (arg_start_mode == START_PID2 && arg_unified_cgroup_hierarchy == CGROUP_UNIFIED_UNKNOWN) {
1544 /* If we are running the stub init in the container, we don't need to look at what the init
1545 * in the container supports, because we are not using it. Let's immediately pick the right
1546 * setting based on the host system configuration.
1547 *
1548 * We only do this, if the user didn't use an environment variable to override the detection.
1549 */
1550
1551 r = cg_all_unified();
1552 if (r < 0)
1553 return log_error_errno(r, "Failed to determine whether we are in all unified mode.");
1554 if (r > 0)
1555 arg_unified_cgroup_hierarchy = CGROUP_UNIFIED_ALL;
1556 else if (cg_unified_controller(SYSTEMD_CGROUP_CONTROLLER) > 0)
1557 arg_unified_cgroup_hierarchy = CGROUP_UNIFIED_SYSTEMD;
1558 else
1559 arg_unified_cgroup_hierarchy = CGROUP_UNIFIED_NONE;
1560 }
1561
4f086aab
SU		 1562 if (arg_userns_mode != USER_NAMESPACE_NO)
1563 arg_mount_settings |= MOUNT_USE_USERNS;
1564
1565 if (arg_private_network)
1566 arg_mount_settings |= MOUNT_APPLY_APIVFS_NETNS;
1567
48a8d337
LB		 1568 if (!(arg_clone_ns_flags & CLONE_NEWPID) ||
1569 !(arg_clone_ns_flags & CLONE_NEWUTS)) {
eb91eb18 1570 arg_register = false;
baaa35ad 1571 if (arg_start_mode != START_PID1)
60f1ec13 1572 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "--boot cannot be used without namespacing.");
0c582db0 1573 }
eb91eb18 1574
0de7acce 1575 if (arg_userns_mode == USER_NAMESPACE_PICK)
0e7ac751
LP		 1576 arg_userns_chown = true;
1577
60f1ec13
LP		 1578 if (arg_start_mode == START_BOOT && arg_kill_signal <= 0)
1579 arg_kill_signal = SIGRTMIN+3;
1580
e5a4bb0d
LP		 1581 if (arg_volatile_mode != VOLATILE_NO) /* Make sure all file systems contained in the image are mounted read-only if we are in volatile mode */
1582 arg_read_only = true;
1583
2436ea76
DDM		 1584 if (has_custom_root_mount(arg_custom_mounts, arg_n_custom_mounts))
1585 arg_read_only = true;
1586
baaa35ad 1587 if (arg_keep_unit && arg_register && cg_pid_get_owner_uid(0, NULL) >= 0)
8d9c2bca
AJ		 1588 /* Save the user from accidentally registering either user-$SESSION.scope or user@.service.
1589 * The latter is not technically a user session, but we don't need to labour the point. */
60f1ec13 1590 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "--keep-unit --register=yes may not be used when invoked from a user session.");
89f7c846 1591
baaa35ad 1592 if (arg_directory && arg_image)
60f1ec13 1593 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "--directory= and --image= may not be combined.");
1b9e5b12 1594
baaa35ad 1595 if (arg_template && arg_image)
60f1ec13 1596 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "--template= and --image= may not be combined.");
8cd328d8 1597
baaa35ad 1598 if (arg_template && !(arg_directory || arg_machine))
60f1ec13 1599 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "--template= needs --directory= or --machine=.");
ec16945e 1600
baaa35ad 1601 if (arg_ephemeral && arg_template)
60f1ec13 1602 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "--ephemeral and --template= may not be combined.");
ec16945e 1603
baaa35ad 1604 if (arg_ephemeral && !IN_SET(arg_link_journal, LINK_NO, LINK_AUTO))
60f1ec13 1605 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "--ephemeral and --link-journal= may not be combined.");
df9a75e4 1606
baaa35ad 1607 if (arg_userns_mode != USER_NAMESPACE_NO && !userns_supported())
60f1ec13 1608 return log_error_errno(SYNTHETIC_ERRNO(EOPNOTSUPP), "--private-users= is not supported, kernel compiled without user namespace support.");
7336138e 1609
baaa35ad 1610 if (arg_userns_chown && arg_read_only)
de40a303
LP		 1611 return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
1612 "--read-only and --private-users-chown may not be combined.");
f757855e 1613
e5a4bb0d
LP		 1614 /* We don't support --private-users-chown together with any of the volatile modes since we couldn't
1615 * change the read-only part of the tree (i.e. /usr) anyway, or because it would trigger a massive
5238e957 1616 * copy-up (in case of overlay) making the entire exercise pointless. */
e5a4bb0d
LP		 1617 if (arg_userns_chown && arg_volatile_mode != VOLATILE_NO)
1618 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "--volatile= and --private-users-chown may not be combined.");
1619
679ecd36
SZ		 1620 /* If --network-namespace-path is given with any other network-related option (except --private-network),
1621 * we need to error out, to avoid conflicts between different network options. */
60f1ec13
LP		 1622 if (arg_network_namespace_path &&
1623 (arg_network_interfaces || arg_network_macvlan ||
1624 arg_network_ipvlan || arg_network_veth_extra ||
1625 arg_network_bridge || arg_network_zone ||
679ecd36 1626 arg_network_veth))
de40a303 1627 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "--network-namespace-path= cannot be combined with other network options.");
86c0dd4a 1628
60f1ec13 1629 if (arg_network_bridge && arg_network_zone)
de40a303
LP		 1630 return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
1631 "--network-bridge= and --network-zone= may not be combined.");
f757855e 1632
baaa35ad 1633 if (arg_userns_mode != USER_NAMESPACE_NO && (arg_mount_settings & MOUNT_APPLY_APIVFS_NETNS) && !arg_private_network)
60f1ec13 1634 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Invalid namespacing settings. Mounting sysfs with --private-users requires --private-network.");
4f086aab 1635
baaa35ad 1636 if (arg_userns_mode != USER_NAMESPACE_NO && !(arg_mount_settings & MOUNT_APPLY_APIVFS_RO))
60f1ec13 1637 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Cannot combine --private-users with read-write mounts.");
f757855e 1638
baaa35ad 1639 if (arg_expose_ports && !arg_private_network)
60f1ec13 1640 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Cannot use --port= without private networking.");
6d0b55c2 1641
349cc4a5 1642#if ! HAVE_LIBIPTC
baaa35ad 1643 if (arg_expose_ports)
60f1ec13 1644 return log_error_errno(SYNTHETIC_ERRNO(EOPNOTSUPP), "--port= is not supported, compiled without libiptc support.");
1c1ea217
EV		 1645#endif
1646
60f1ec13
LP		 1647 r = custom_mount_check_all();
1648 if (r < 0)
1649 return r;
c6c8f6e2 1650
f757855e 1651 return 0;
88213476
LP		 1652}
1653
03cfe0d5
LP		 1654static int userns_lchown(const char *p, uid_t uid, gid_t gid) {
1655 assert(p);
1656
0de7acce 1657 if (arg_userns_mode == USER_NAMESPACE_NO)
03cfe0d5
LP		 1658 return 0;
1659
1660 if (uid == UID_INVALID && gid == GID_INVALID)
1661 return 0;
1662
1663 if (uid != UID_INVALID) {
1664 uid += arg_uid_shift;
1665
1666 if (uid < arg_uid_shift || uid >= arg_uid_shift + arg_uid_range)
1667 return -EOVERFLOW;
1668 }
1669
1670 if (gid != GID_INVALID) {
1671 gid += (gid_t) arg_uid_shift;
1672
1673 if (gid < (gid_t) arg_uid_shift || gid >= (gid_t) (arg_uid_shift + arg_uid_range))
1674 return -EOVERFLOW;
1675 }
1676
1677 if (lchown(p, uid, gid) < 0)
1678 return -errno;
b12afc8c
LP		 1679
1680 return 0;
1681}
1682
03cfe0d5
LP		 1683static int userns_mkdir(const char *root, const char *path, mode_t mode, uid_t uid, gid_t gid) {
1684 const char *q;
dae8b82e 1685 int r;
03cfe0d5
LP		 1686
1687 q = prefix_roota(root, path);
dae8b82e
ZJS		 1688 r = mkdir_errno_wrapper(q, mode);
1689 if (r == -EEXIST)
1690 return 0;
1691 if (r < 0)
1692 return r;
03cfe0d5
LP		 1693
1694 return userns_lchown(q, uid, gid);
1695}
1696
1688841f 1697static const char *timezone_from_path(const char *path) {
da9fc98d
LP		 1698 return PATH_STARTSWITH_SET(
1699 path,
1700 "../usr/share/zoneinfo/",
1701 "/usr/share/zoneinfo/");
1688841f
LP		 1702}
1703
83205269
LP		 1704static bool etc_writable(void) {
1705 return !arg_read_only || IN_SET(arg_volatile_mode, VOLATILE_YES, VOLATILE_OVERLAY);
1706}
1707
e58a1277 1708static int setup_timezone(const char *dest) {
1688841f
LP		 1709 _cleanup_free_ char *p = NULL, *etc = NULL;
1710 const char *where, *check;
1711 TimezoneMode m;
d4036145 1712 int r;
f8440af5 1713
e58a1277
LP		 1714 assert(dest);
1715
1688841f 1716 if (IN_SET(arg_timezone, TIMEZONE_AUTO, TIMEZONE_SYMLINK)) {
1688841f
LP		 1717 r = readlink_malloc("/etc/localtime", &p);
1718 if (r == -ENOENT && arg_timezone == TIMEZONE_AUTO)
83205269 1719 m = etc_writable() ? TIMEZONE_DELETE : TIMEZONE_OFF;
1688841f 1720 else if (r == -EINVAL && arg_timezone == TIMEZONE_AUTO) /* regular file? */
83205269 1721 m = etc_writable() ? TIMEZONE_COPY : TIMEZONE_BIND;
1688841f
LP		 1722 else if (r < 0) {
1723 log_warning_errno(r, "Failed to read host's /etc/localtime symlink, not updating container timezone: %m");
1724 /* To handle warning, delete /etc/localtime and replace it with a symbolic link to a time zone data
1725 * file.
1726 *
1727 * Example:
1728 * ln -s /usr/share/zoneinfo/UTC /etc/localtime
1729 */
1730 return 0;
1731 } else if (arg_timezone == TIMEZONE_AUTO)
83205269 1732 m = etc_writable() ? TIMEZONE_SYMLINK : TIMEZONE_BIND;
1688841f
LP		 1733 else
1734 m = arg_timezone;
1735 } else
1736 m = arg_timezone;
1737
1738 if (m == TIMEZONE_OFF)
1739 return 0;
1740
a5648b80 1741 r = chase_symlinks("/etc", dest, CHASE_PREFIX_ROOT, &etc, NULL);
d4036145 1742 if (r < 0) {
1688841f 1743 log_warning_errno(r, "Failed to resolve /etc path in container, ignoring: %m");
d4036145
LP		 1744 return 0;
1745 }
1746
1688841f
LP		 1747 where = strjoina(etc, "/localtime");
1748
1749 switch (m) {
1750
1751 case TIMEZONE_DELETE:
1752 if (unlink(where) < 0)
1753 log_full_errno(errno == ENOENT ? LOG_DEBUG : LOG_WARNING, errno, "Failed to remove '%s', ignoring: %m", where);
1754
d4036145 1755 return 0;
d4036145 1756
1688841f
LP		 1757 case TIMEZONE_SYMLINK: {
1758 _cleanup_free_ char *q = NULL;
1759 const char *z, *what;
4d1c38b8 1760
1688841f
LP		 1761 z = timezone_from_path(p);
1762 if (!z) {
1763 log_warning("/etc/localtime does not point into /usr/share/zoneinfo/, not updating container timezone.");
d4036145 1764 return 0;
1688841f 1765 }
d4036145 1766
1688841f
LP		 1767 r = readlink_malloc(where, &q);
1768 if (r >= 0 && streq_ptr(timezone_from_path(q), z))
1769 return 0; /* Already pointing to the right place? Then do nothing .. */
1770
1771 check = strjoina(dest, "/usr/share/zoneinfo/", z);
a5648b80 1772 r = chase_symlinks(check, dest, 0, NULL, NULL);
1688841f
LP		 1773 if (r < 0)
1774 log_debug_errno(r, "Timezone %s does not exist (or is not accessible) in container, not creating symlink: %m", z);
1775 else {
1776 if (unlink(where) < 0 && errno != ENOENT) {
1777 log_full_errno(IN_SET(errno, EROFS, EACCES, EPERM) ? LOG_DEBUG : LOG_WARNING, /* Don't complain on read-only images */
1778 errno, "Failed to remove existing timezone info %s in container, ignoring: %m", where);
1779 return 0;
1780 }
1781
1782 what = strjoina("../usr/share/zoneinfo/", z);
1783 if (symlink(what, where) < 0) {
1784 log_full_errno(IN_SET(errno, EROFS, EACCES, EPERM) ? LOG_DEBUG : LOG_WARNING,
1785 errno, "Failed to correct timezone of container, ignoring: %m");
1786 return 0;
1787 }
1788
1789 break;
1790 }
1791
1792 _fallthrough_;
d4036145 1793 }
68fb0892 1794
1688841f
LP		 1795 case TIMEZONE_BIND: {
1796 _cleanup_free_ char *resolved = NULL;
1797 int found;
1798
a5648b80 1799 found = chase_symlinks(where, dest, CHASE_NONEXISTENT, &resolved, NULL);
1688841f
LP		 1800 if (found < 0) {
1801 log_warning_errno(found, "Failed to resolve /etc/localtime path in container, ignoring: %m");
1802 return 0;
1803 }
1804
1805 if (found == 0) /* missing? */
1806 (void) touch(resolved);
1807
1808 r = mount_verbose(LOG_WARNING, "/etc/localtime", resolved, NULL, MS_BIND, NULL);
1809 if (r >= 0)
1810 return mount_verbose(LOG_ERR, NULL, resolved, NULL, MS_BIND|MS_REMOUNT|MS_RDONLY|MS_NOSUID|MS_NODEV, NULL);
1811
1812 _fallthrough_;
79d80fc1 1813 }
4d9f07b4 1814
1688841f
LP		 1815 case TIMEZONE_COPY:
1816 /* If mounting failed, try to copy */
8a016c74 1817 r = copy_file_atomic("/etc/localtime", where, 0644, 0, 0, COPY_REFLINK|COPY_REPLACE);
1688841f
LP		 1818 if (r < 0) {
1819 log_full_errno(IN_SET(r, -EROFS, -EACCES, -EPERM) ? LOG_DEBUG : LOG_WARNING, r,
1820 "Failed to copy /etc/localtime to %s, ignoring: %m", where);
1821 return 0;
1822 }
1823
1824 break;
1825
1826 default:
1827 assert_not_reached("unexpected mode");
d4036145 1828 }
e58a1277 1829
1688841f 1830 /* Fix permissions of the symlink or file copy we just created */
03cfe0d5
LP		 1831 r = userns_lchown(where, 0, 0);
1832 if (r < 0)
1688841f 1833 log_warning_errno(r, "Failed to chown /etc/localtime, ignoring: %m");
03cfe0d5 1834
e58a1277 1835 return 0;
88213476
LP		 1836}
1837
09d423e9
LP		 1838static int have_resolv_conf(const char *path) {
1839 assert(path);
1840
1841 if (access(path, F_OK) < 0) {
1842 if (errno == ENOENT)
1843 return 0;
1844
1845 return log_debug_errno(errno, "Failed to determine whether '%s' is available: %m", path);
1846 }
1847
1848 return 1;
1849}
1850
7357272e 1851static int resolved_listening(void) {
b8ea7a6e 1852 _cleanup_(sd_bus_error_free) sd_bus_error error = SD_BUS_ERROR_NULL;
b053cd5f 1853 _cleanup_(sd_bus_flush_close_unrefp) sd_bus *bus = NULL;
7357272e 1854 _cleanup_free_ char *dns_stub_listener_mode = NULL;
b053cd5f
LP		 1855 int r;
1856
7357272e 1857 /* Check if resolved is listening */
b053cd5f
LP		 1858
1859 r = sd_bus_open_system(&bus);
1860 if (r < 0)
b8ea7a6e 1861 return log_debug_errno(r, "Failed to open system bus: %m");
b053cd5f 1862
7357272e 1863 r = bus_name_has_owner(bus, "org.freedesktop.resolve1", NULL);
b8ea7a6e
LP		 1864 if (r < 0)
1865 return log_debug_errno(r, "Failed to check whether the 'org.freedesktop.resolve1' bus name is taken: %m");
1866 if (r == 0)
1867 return 0;
7357272e
DM		 1868
1869 r = sd_bus_get_property_string(bus,
1870 "org.freedesktop.resolve1",
1871 "/org/freedesktop/resolve1",
1872 "org.freedesktop.resolve1.Manager",
1873 "DNSStubListener",
b8ea7a6e 1874 &error,
7357272e
DM		 1875 &dns_stub_listener_mode);
1876 if (r < 0)
b8ea7a6e 1877 return log_debug_errno(r, "Failed to query DNSStubListener property: %s", bus_error_message(&error, r));
7357272e
DM		 1878
1879 return STR_IN_SET(dns_stub_listener_mode, "udp", "yes");
b053cd5f
LP		 1880}
1881
2547bb41 1882static int setup_resolv_conf(const char *dest) {
09d423e9
LP		 1883 _cleanup_free_ char *etc = NULL;
1884 const char *where, *what;
1885 ResolvConfMode m;
1886 int r;
2547bb41
LP		 1887
1888 assert(dest);
1889
09d423e9
LP		 1890 if (arg_resolv_conf == RESOLV_CONF_AUTO) {
1891 if (arg_private_network)
1892 m = RESOLV_CONF_OFF;
86775e35
LP		 1893 else if (have_resolv_conf(PRIVATE_STUB_RESOLV_CONF) > 0 && resolved_listening() > 0)
1894 m = etc_writable() ? RESOLV_CONF_COPY_STUB : RESOLV_CONF_BIND_STUB;
09d423e9 1895 else if (have_resolv_conf("/etc/resolv.conf") > 0)
83205269 1896 m = etc_writable() ? RESOLV_CONF_COPY_HOST : RESOLV_CONF_BIND_HOST;
09d423e9 1897 else
83205269 1898 m = etc_writable() ? RESOLV_CONF_DELETE : RESOLV_CONF_OFF;
86775e35 1899
09d423e9
LP		 1900 } else
1901 m = arg_resolv_conf;
1902
1903 if (m == RESOLV_CONF_OFF)
2547bb41
LP		 1904 return 0;
1905
a5648b80 1906 r = chase_symlinks("/etc", dest, CHASE_PREFIX_ROOT, &etc, NULL);
87447ae4
LP		 1907 if (r < 0) {
1908 log_warning_errno(r, "Failed to resolve /etc path in container, ignoring: %m");
1909 return 0;
1910 }
1911
1912 where = strjoina(etc, "/resolv.conf");
09d423e9
LP		 1913
1914 if (m == RESOLV_CONF_DELETE) {
1915 if (unlink(where) < 0)
1916 log_full_errno(errno == ENOENT ? LOG_DEBUG : LOG_WARNING, errno, "Failed to remove '%s', ignoring: %m", where);
1917
87447ae4
LP		 1918 return 0;
1919 }
79d80fc1 1920
86775e35
LP		 1921 if (IN_SET(m, RESOLV_CONF_BIND_STATIC, RESOLV_CONF_REPLACE_STATIC, RESOLV_CONF_COPY_STATIC))
1922 what = PRIVATE_STATIC_RESOLV_CONF;
1923 else if (IN_SET(m, RESOLV_CONF_BIND_UPLINK, RESOLV_CONF_REPLACE_UPLINK, RESOLV_CONF_COPY_UPLINK))
1924 what = PRIVATE_UPLINK_RESOLV_CONF;
1925 else if (IN_SET(m, RESOLV_CONF_BIND_STUB, RESOLV_CONF_REPLACE_STUB, RESOLV_CONF_COPY_STUB))
1926 what = PRIVATE_STUB_RESOLV_CONF;
09d423e9
LP		 1927 else
1928 what = "/etc/resolv.conf";
87447ae4 1929
86775e35 1930 if (IN_SET(m, RESOLV_CONF_BIND_HOST, RESOLV_CONF_BIND_STATIC, RESOLV_CONF_BIND_UPLINK, RESOLV_CONF_BIND_STUB)) {
09d423e9
LP		 1931 _cleanup_free_ char *resolved = NULL;
1932 int found;
1933
a5648b80 1934 found = chase_symlinks(where, dest, CHASE_NONEXISTENT, &resolved, NULL);
09d423e9
LP		 1935 if (found < 0) {
1936 log_warning_errno(found, "Failed to resolve /etc/resolv.conf path in container, ignoring: %m");
1937 return 0;
1938 }
3539724c 1939
87447ae4
LP		 1940 if (found == 0) /* missing? */
1941 (void) touch(resolved);
5367354d 1942
09d423e9 1943 r = mount_verbose(LOG_WARNING, what, resolved, NULL, MS_BIND, NULL);
60e76d48 1944 if (r >= 0)
87447ae4 1945 return mount_verbose(LOG_ERR, NULL, resolved, NULL, MS_BIND|MS_REMOUNT|MS_RDONLY|MS_NOSUID|MS_NODEV, NULL);
86775e35
LP		 1946
1947 /* If that didn't work, let's copy the file */
3539724c
LP		 1948 }
1949
86775e35
LP		 1950 if (IN_SET(m, RESOLV_CONF_REPLACE_HOST, RESOLV_CONF_REPLACE_STATIC, RESOLV_CONF_REPLACE_UPLINK, RESOLV_CONF_REPLACE_STUB))
1951 r = copy_file_atomic(what, where, 0644, 0, 0, COPY_REFLINK|COPY_REPLACE);
1952 else
1953 r = copy_file(what, where, O_TRUNC|O_NOFOLLOW, 0644, 0, 0, COPY_REFLINK);
79d80fc1 1954 if (r < 0) {
3539724c
LP		 1955 /* If the file already exists as symlink, let's suppress the warning, under the assumption that
1956 * resolved or something similar runs inside and the symlink points there.
68a313c5 1957 *
3539724c 1958 * If the disk image is read-only, there's also no point in complaining.
68a313c5 1959 */
86775e35
LP		 1960 log_full_errno(!IN_SET(RESOLV_CONF_COPY_HOST, RESOLV_CONF_COPY_STATIC, RESOLV_CONF_COPY_UPLINK, RESOLV_CONF_COPY_STUB) &&
1961 IN_SET(r, -ELOOP, -EROFS, -EACCES, -EPERM) ? LOG_DEBUG : LOG_WARNING, r,
3539724c 1962 "Failed to copy /etc/resolv.conf to %s, ignoring: %m", where);
79d80fc1
TG		 1963 return 0;
1964 }
2547bb41 1965
03cfe0d5
LP		 1966 r = userns_lchown(where, 0, 0);
1967 if (r < 0)
3539724c 1968 log_warning_errno(r, "Failed to chown /etc/resolv.conf, ignoring: %m");
03cfe0d5 1969
2547bb41
LP		 1970 return 0;
1971}
1972
1e4f1671 1973static int setup_boot_id(void) {
cdde6ba6
LP		 1974 _cleanup_(unlink_and_freep) char *from = NULL;
1975 _cleanup_free_ char *path = NULL;
3bbaff3e 1976 sd_id128_t rnd = SD_ID128_NULL;
cdde6ba6 1977 const char *to;
04bc4a3f
LP		 1978 int r;
1979
1eacc470 1980 /* Generate a new randomized boot ID, so that each boot-up of the container gets a new one */
04bc4a3f 1981
1eacc470 1982 r = tempfn_random_child("/run", "proc-sys-kernel-random-boot-id", &path);
cdde6ba6
LP		 1983 if (r < 0)
1984 return log_error_errno(r, "Failed to generate random boot ID path: %m");
04bc4a3f
LP		 1985
1986 r = sd_id128_randomize(&rnd);
f647962d
MS		 1987 if (r < 0)
1988 return log_error_errno(r, "Failed to generate random boot id: %m");
04bc4a3f 1989
cdde6ba6 1990 r = id128_write(path, ID128_UUID, rnd, false);
f647962d
MS		 1991 if (r < 0)
1992 return log_error_errno(r, "Failed to write boot id: %m");
04bc4a3f 1993
cdde6ba6
LP		 1994 from = TAKE_PTR(path);
1995 to = "/proc/sys/kernel/random/boot_id";
1996
60e76d48 1997 r = mount_verbose(LOG_ERR, from, to, NULL, MS_BIND, NULL);
cdde6ba6
LP		 1998 if (r < 0)
1999 return r;
04bc4a3f 2000
cdde6ba6 2001 return mount_verbose(LOG_ERR, NULL, to, NULL, MS_BIND|MS_REMOUNT|MS_RDONLY|MS_NOSUID|MS_NOEXEC|MS_NODEV, NULL);
04bc4a3f
LP		 2002}
2003
e58a1277 2004static int copy_devnodes(const char *dest) {
88213476
LP		 2005 static const char devnodes[] =
2006 "null\0"
2007 "zero\0"
2008 "full\0"
2009 "random\0"
2010 "urandom\0"
85614d66
TG		 2011 "tty\0"
2012 "net/tun\0";
88213476 2013
de40a303 2014 _cleanup_umask_ mode_t u;
88213476 2015 const char *d;
e58a1277 2016 int r = 0;
a258bf26
LP		 2017
2018 assert(dest);
124640f1
LP		 2019
2020 u = umask(0000);
88213476 2021
03cfe0d5
LP		 2022 /* Create /dev/net, so that we can create /dev/net/tun in it */
2023 if (userns_mkdir(dest, "/dev/net", 0755, 0, 0) < 0)
2024 return log_error_errno(r, "Failed to create /dev/net directory: %m");
2025
88213476 2026 NULSTR_FOREACH(d, devnodes) {
7fd1b19b 2027 _cleanup_free_ char *from = NULL, *to = NULL;
7f112f50 2028 struct stat st;
88213476 2029
c6134d3e 2030 from = path_join("/dev/", d);
8967f291
LP		 2031 if (!from)
2032 return log_oom();
2033
c6134d3e 2034 to = path_join(dest, from);
8967f291
LP		 2035 if (!to)
2036 return log_oom();
88213476
LP		 2037
2038 if (stat(from, &st) < 0) {
2039
4a62c710
MS		 2040 if (errno != ENOENT)
2041 return log_error_errno(errno, "Failed to stat %s: %m", from);
88213476 2042
baaa35ad
ZJS		 2043 } else if (!S_ISCHR(st.st_mode) && !S_ISBLK(st.st_mode))
2044 return log_error_errno(SYNTHETIC_ERRNO(EIO),
2045 "%s is not a char or block device, cannot copy.", from);
2046 else {
8dfce114
LP		 2047 _cleanup_free_ char *sl = NULL, *prefixed = NULL, *dn = NULL, *t = NULL;
2048
81f5049b 2049 if (mknod(to, st.st_mode, st.st_rdev) < 0) {
8dbf71ec 2050 /* Explicitly warn the user when /dev is already populated. */
41eb4362 2051 if (errno == EEXIST)
8dbf71ec 2052 log_notice("%s/dev is pre-mounted and pre-populated. If a pre-mounted /dev is provided it needs to be an unpopulated file system.", dest);
81f5049b
AC		 2053 if (errno != EPERM)
2054 return log_error_errno(errno, "mknod(%s) failed: %m", to);
2055
8dfce114 2056 /* Some systems abusively restrict mknod but allow bind mounts. */
81f5049b
AC		 2057 r = touch(to);
2058 if (r < 0)
2059 return log_error_errno(r, "touch (%s) failed: %m", to);
60e76d48
ZJS		 2060 r = mount_verbose(LOG_DEBUG, from, to, NULL, MS_BIND, NULL);
2061 if (r < 0)
2062 return log_error_errno(r, "Both mknod and bind mount (%s) failed: %m", to);
81f5049b 2063 }
6278cf60 2064
03cfe0d5
LP		 2065 r = userns_lchown(to, 0, 0);
2066 if (r < 0)
2067 return log_error_errno(r, "chown() of device node %s failed: %m", to);
8dfce114 2068
657ee2d8 2069 dn = path_join("/dev", S_ISCHR(st.st_mode) ? "char" : "block");
8dfce114
LP		 2070 if (!dn)
2071 return log_oom();
2072
2073 r = userns_mkdir(dest, dn, 0755, 0, 0);
2074 if (r < 0)
2075 return log_error_errno(r, "Failed to create '%s': %m", dn);
2076
2077 if (asprintf(&sl, "%s/%u:%u", dn, major(st.st_rdev), minor(st.st_rdev)) < 0)
2078 return log_oom();
2079
c6134d3e 2080 prefixed = path_join(dest, sl);
8dfce114
LP		 2081 if (!prefixed)
2082 return log_oom();
2083
2d9b74ba 2084 t = path_join("..", d);
8dfce114
LP		 2085 if (!t)
2086 return log_oom();
2087
2088 if (symlink(t, prefixed) < 0)
2089 log_debug_errno(errno, "Failed to symlink '%s' to '%s': %m", t, prefixed);
88213476 2090 }
88213476
LP		 2091 }
2092
e58a1277
LP		 2093 return r;
2094}
88213476 2095
de40a303
LP		 2096static int make_extra_nodes(const char *dest) {
2097 _cleanup_umask_ mode_t u;
2098 size_t i;
2099 int r;
2100
2101 u = umask(0000);
2102
2103 for (i = 0; i < arg_n_extra_nodes; i++) {
2104 _cleanup_free_ char *path = NULL;
2105 DeviceNode *n = arg_extra_nodes + i;
2106
c6134d3e 2107 path = path_join(dest, n->path);
de40a303
LP		 2108 if (!path)
2109 return log_oom();
2110
2111 if (mknod(path, n->mode, S_ISCHR(n->mode) || S_ISBLK(n->mode) ? makedev(n->major, n->minor) : 0) < 0)
2112 return log_error_errno(errno, "Failed to create device node '%s': %m", path);
2113
2114 r = chmod_and_chown(path, n->mode, n->uid, n->gid);
2115 if (r < 0)
2116 return log_error_errno(r, "Failed to adjust device node ownership of '%s': %m", path);
2117 }
2118
2119 return 0;
2120}
2121
03cfe0d5
LP		 2122static int setup_pts(const char *dest) {
2123 _cleanup_free_ char *options = NULL;
2124 const char *p;
709f6e46 2125 int r;
03cfe0d5 2126
349cc4a5 2127#if HAVE_SELINUX
03cfe0d5
LP		 2128 if (arg_selinux_apifs_context)
2129 (void) asprintf(&options,
3dce8915 2130 "newinstance,ptmxmode=0666,mode=620,gid=" GID_FMT ",context=\"%s\"",
03cfe0d5
LP		 2131 arg_uid_shift + TTY_GID,
2132 arg_selinux_apifs_context);
2133 else
2134#endif
2135 (void) asprintf(&options,
3dce8915 2136 "newinstance,ptmxmode=0666,mode=620,gid=" GID_FMT,
03cfe0d5 2137 arg_uid_shift + TTY_GID);
f2d88580 2138
03cfe0d5 2139 if (!options)
f2d88580
LP		 2140 return log_oom();
2141
03cfe0d5 2142 /* Mount /dev/pts itself */
cc9fce65 2143 p = prefix_roota(dest, "/dev/pts");
dae8b82e
ZJS		 2144 r = mkdir_errno_wrapper(p, 0755);
2145 if (r < 0)
2146 return log_error_errno(r, "Failed to create /dev/pts: %m");
2147
60e76d48
ZJS		 2148 r = mount_verbose(LOG_ERR, "devpts", p, "devpts", MS_NOSUID|MS_NOEXEC, options);
2149 if (r < 0)
2150 return r;
709f6e46
MS		 2151 r = userns_lchown(p, 0, 0);
2152 if (r < 0)
2153 return log_error_errno(r, "Failed to chown /dev/pts: %m");
03cfe0d5
LP		 2154
2155 /* Create /dev/ptmx symlink */
2156 p = prefix_roota(dest, "/dev/ptmx");
4a62c710
MS		 2157 if (symlink("pts/ptmx", p) < 0)
2158 return log_error_errno(errno, "Failed to create /dev/ptmx symlink: %m");
709f6e46
MS		 2159 r = userns_lchown(p, 0, 0);
2160 if (r < 0)
2161 return log_error_errno(r, "Failed to chown /dev/ptmx: %m");
f2d88580 2162
03cfe0d5
LP		 2163 /* And fix /dev/pts/ptmx ownership */
2164 p = prefix_roota(dest, "/dev/pts/ptmx");
709f6e46
MS		 2165 r = userns_lchown(p, 0, 0);
2166 if (r < 0)
2167 return log_error_errno(r, "Failed to chown /dev/pts/ptmx: %m");
6278cf60 2168
f2d88580
LP		 2169 return 0;
2170}
2171
3acc84eb
FB		 2172static int setup_stdio_as_dev_console(void) {
2173 int terminal;
e58a1277 2174 int r;
e58a1277 2175
3acc84eb
FB		 2176 terminal = open_terminal("/dev/console", O_RDWR);
2177 if (terminal < 0)
2178 return log_error_errno(terminal, "Failed to open console: %m");
e58a1277 2179
3acc84eb
FB		 2180 /* Make sure we can continue logging to the original stderr, even if
2181 * stderr points elsewhere now */
2182 r = log_dup_console();
2183 if (r < 0)
2184 return log_error_errno(r, "Failed to duplicate stderr: %m");
de40a303 2185
3acc84eb
FB		 2186 /* invalidates 'terminal' on success and failure */
2187 r = rearrange_stdio(terminal, terminal, terminal);
f647962d 2188 if (r < 0)
3acc84eb
FB		 2189 return log_error_errno(r, "Failed to move console to stdin/stdout/stderr: %m");
2190
2191 return 0;
2192}
88213476 2193
3acc84eb
FB		 2194static int setup_dev_console(const char *console) {
2195 _cleanup_free_ char *p = NULL;
2196 int r;
a258bf26 2197
3acc84eb
FB		 2198 /* Create /dev/console symlink */
2199 r = path_make_relative("/dev", console, &p);
81f5049b 2200 if (r < 0)
3acc84eb
FB		 2201 return log_error_errno(r, "Failed to create relative path: %m");
2202
2203 if (symlink(p, "/dev/console") < 0)
2204 return log_error_errno(errno, "Failed to create /dev/console symlink: %m");
a258bf26 2205
3acc84eb 2206 return 0;
e58a1277
LP		 2207}
2208
8e5430c4
LP		 2209static int setup_keyring(void) {
2210 key_serial_t keyring;
2211
6b000af4
LP		 2212 /* Allocate a new session keyring for the container. This makes sure the keyring of the session
2213 * systemd-nspawn was invoked from doesn't leak into the container. Note that by default we block
2214 * keyctl() and request_key() anyway via seccomp so doing this operation isn't strictly necessary,
2215 * but in case people explicitly allow-list these system calls let's make sure we don't leak anything
2216 * into the container. */
8e5430c4
LP		 2217
2218 keyring = keyctl(KEYCTL_JOIN_SESSION_KEYRING, 0, 0, 0, 0);
2219 if (keyring == -1) {
2220 if (errno == ENOSYS)
2221 log_debug_errno(errno, "Kernel keyring not supported, ignoring.");
2222 else if (IN_SET(errno, EACCES, EPERM))
2223 log_debug_errno(errno, "Kernel keyring access prohibited, ignoring.");
2224 else
2225 return log_error_errno(errno, "Setting up kernel keyring failed: %m");
2226 }
2227
2228 return 0;
2229}
2230
1e4f1671 2231static int setup_kmsg(int kmsg_socket) {
9ec5a93c
LP		 2232 _cleanup_(unlink_and_freep) char *from = NULL;
2233 _cleanup_free_ char *fifo = NULL;
2234 _cleanup_close_ int fd = -1;
7fd1b19b 2235 _cleanup_umask_ mode_t u;
9ec5a93c 2236 int r;
e58a1277 2237
e58a1277 2238 assert(kmsg_socket >= 0);
a258bf26 2239
e58a1277 2240 u = umask(0000);
a258bf26 2241
1eacc470 2242 /* We create the kmsg FIFO as as temporary file in /run, but immediately delete it after bind mounting it to
9ec5a93c
LP		 2243 * /proc/kmsg. While FIFOs on the reading side behave very similar to /proc/kmsg, their writing side behaves
2244 * differently from /dev/kmsg in that writing blocks when nothing is reading. In order to avoid any problems
2245 * with containers deadlocking due to this we simply make /dev/kmsg unavailable to the container. */
2246
1eacc470 2247 r = tempfn_random_child("/run", "proc-kmsg", &fifo);
9ec5a93c
LP		 2248 if (r < 0)
2249 return log_error_errno(r, "Failed to generate kmsg path: %m");
e58a1277 2250
9ec5a93c 2251 if (mkfifo(fifo, 0600) < 0)
03cfe0d5 2252 return log_error_errno(errno, "mkfifo() for /run/kmsg failed: %m");
9ec5a93c
LP		 2253
2254 from = TAKE_PTR(fifo);
9ec5a93c 2255
1eacc470 2256 r = mount_verbose(LOG_ERR, from, "/proc/kmsg", NULL, MS_BIND, NULL);
60e76d48
ZJS		 2257 if (r < 0)
2258 return r;
e58a1277 2259
669fc4e5 2260 fd = open(from, O_RDWR|O_NONBLOCK|O_CLOEXEC);
4a62c710
MS		 2261 if (fd < 0)
2262 return log_error_errno(errno, "Failed to open fifo: %m");
e58a1277 2263
9ec5a93c 2264 /* Store away the fd in the socket, so that it stays open as long as we run the child */
3ee897d6 2265 r = send_one_fd(kmsg_socket, fd, 0);
d9603714
DH		 2266 if (r < 0)
2267 return log_error_errno(r, "Failed to send FIFO fd: %m");
a258bf26 2268
25ea79fe 2269 return 0;
88213476
LP		 2270}
2271
1c4baffc 2272static int on_address_change(sd_netlink *rtnl, sd_netlink_message *m, void *userdata) {
6d0b55c2
LP		 2273 union in_addr_union *exposed = userdata;
2274
2275 assert(rtnl);
2276 assert(m);
2277 assert(exposed);
2278
7a8f6325 2279 expose_port_execute(rtnl, arg_expose_ports, exposed);
6d0b55c2
LP		 2280 return 0;
2281}
2282
3a74cea5 2283static int setup_hostname(void) {
c818eef1 2284 int r;
3a74cea5 2285
0c582db0 2286 if ((arg_clone_ns_flags & CLONE_NEWUTS) == 0)
eb91eb18
LP		 2287 return 0;
2288
c818eef1
LP		 2289 r = sethostname_idempotent(arg_hostname ?: arg_machine);
2290 if (r < 0)
2291 return log_error_errno(r, "Failed to set hostname: %m");
3a74cea5 2292
7027ff61 2293 return 0;
3a74cea5
LP		 2294}
2295
57fb9fb5 2296static int setup_journal(const char *directory) {
0f5e1382 2297 _cleanup_free_ char *d = NULL;
5905d7cf 2298 char id[SD_ID128_STRING_MAX];
b2238e38
LP		 2299 const char *dirname, *p, *q;
2300 sd_id128_t this_id;
8054d749 2301 bool try;
57fb9fb5
LP		 2302 int r;
2303
df9a75e4
LP		 2304 /* Don't link journals in ephemeral mode */
2305 if (arg_ephemeral)
2306 return 0;
2307
8054d749
LP		 2308 if (arg_link_journal == LINK_NO)
2309 return 0;
2310
2311 try = arg_link_journal_try || arg_link_journal == LINK_AUTO;
2312
4d680aee 2313 r = sd_id128_get_machine(&this_id);
f647962d
MS		 2314 if (r < 0)
2315 return log_error_errno(r, "Failed to retrieve machine ID: %m");
4d680aee 2316
e01ff70a 2317 if (sd_id128_equal(arg_uuid, this_id)) {
8054d749 2318 log_full(try ? LOG_WARNING : LOG_ERR,
e192a281 2319 "Host and machine ids are equal (%s): refusing to link journals", sd_id128_to_string(arg_uuid, id));
8054d749 2320 if (try)
4d680aee 2321 return 0;
df9a75e4 2322 return -EEXIST;
4d680aee
ZJS		 2323 }
2324
369ca6da
ZJS		 2325 FOREACH_STRING(dirname, "/var", "/var/log", "/var/log/journal") {
2326 r = userns_mkdir(directory, dirname, 0755, 0, 0);
2327 if (r < 0) {
2328 bool ignore = r == -EROFS && try;
2329 log_full_errno(ignore ? LOG_DEBUG : LOG_ERR, r,
2330 "Failed to create %s%s: %m", dirname, ignore ? ", ignoring" : "");
2331 return ignore ? 0 : r;
2332 }
2333 }
03cfe0d5 2334
e01ff70a
MS		 2335 (void) sd_id128_to_string(arg_uuid, id);
2336
03cfe0d5
LP		 2337 p = strjoina("/var/log/journal/", id);
2338 q = prefix_roota(directory, p);
27407a01 2339
e1873695 2340 if (path_is_mount_point(p, NULL, 0) > 0) {
8054d749
LP		 2341 if (try)
2342 return 0;
27407a01 2343
baaa35ad
ZJS		 2344 return log_error_errno(SYNTHETIC_ERRNO(EEXIST),
2345 "%s: already a mount point, refusing to use for journal", p);
57fb9fb5
LP		 2346 }
2347
e1873695 2348 if (path_is_mount_point(q, NULL, 0) > 0) {
8054d749
LP		 2349 if (try)
2350 return 0;
57fb9fb5 2351
baaa35ad
ZJS		 2352 return log_error_errno(SYNTHETIC_ERRNO(EEXIST),
2353 "%s: already a mount point, refusing to use for journal", q);
57fb9fb5
LP		 2354 }
2355
2356 r = readlink_and_make_absolute(p, &d);
2357 if (r >= 0) {
3742095b 2358 if (IN_SET(arg_link_journal, LINK_GUEST, LINK_AUTO) &&
57fb9fb5
LP		 2359 path_equal(d, q)) {
2360
03cfe0d5 2361 r = userns_mkdir(directory, p, 0755, 0, 0);
27407a01 2362 if (r < 0)
709f6e46 2363 log_warning_errno(r, "Failed to create directory %s: %m", q);
27407a01 2364 return 0;
57fb9fb5
LP		 2365 }
2366
4a62c710
MS		 2367 if (unlink(p) < 0)
2368 return log_error_errno(errno, "Failed to remove symlink %s: %m", p);
57fb9fb5
LP		 2369 } else if (r == -EINVAL) {
2370
2371 if (arg_link_journal == LINK_GUEST &&
2372 rmdir(p) < 0) {
2373
27407a01
ZJS		 2374 if (errno == ENOTDIR) {
2375 log_error("%s already exists and is neither a symlink nor a directory", p);
2376 return r;
4314d33f
MS		 2377 } else
2378 return log_error_errno(errno, "Failed to remove %s: %m", p);
57fb9fb5 2379 }
4314d33f
MS		 2380 } else if (r != -ENOENT)
2381 return log_error_errno(r, "readlink(%s) failed: %m", p);
57fb9fb5
LP		 2382
2383 if (arg_link_journal == LINK_GUEST) {
2384
2385 if (symlink(q, p) < 0) {
8054d749 2386 if (try) {
56f64d95 2387 log_debug_errno(errno, "Failed to symlink %s to %s, skipping journal setup: %m", q, p);
574edc90 2388 return 0;
4314d33f
MS		 2389 } else
2390 return log_error_errno(errno, "Failed to symlink %s to %s: %m", q, p);
57fb9fb5
LP		 2391 }
2392
03cfe0d5 2393 r = userns_mkdir(directory, p, 0755, 0, 0);
27407a01 2394 if (r < 0)
709f6e46 2395 log_warning_errno(r, "Failed to create directory %s: %m", q);
27407a01 2396 return 0;
57fb9fb5
LP		 2397 }
2398
2399 if (arg_link_journal == LINK_HOST) {
ccddd104 2400 /* don't create parents here — if the host doesn't have
574edc90 2401 * permanent journal set up, don't force it here */
ba8e6c4d 2402
dae8b82e
ZJS		 2403 r = mkdir_errno_wrapper(p, 0755);
2404 if (r < 0 && r != -EEXIST) {
8054d749 2405 if (try) {
dae8b82e 2406 log_debug_errno(r, "Failed to create %s, skipping journal setup: %m", p);
574edc90 2407 return 0;
4314d33f 2408 } else
dae8b82e 2409 return log_error_errno(r, "Failed to create %s: %m", p);
57fb9fb5
LP		 2410 }
2411
27407a01
ZJS		 2412 } else if (access(p, F_OK) < 0)
2413 return 0;
57fb9fb5 2414
cdb2b9d0
LP		 2415 if (dir_is_empty(q) == 0)
2416 log_warning("%s is not empty, proceeding anyway.", q);
2417
03cfe0d5 2418 r = userns_mkdir(directory, p, 0755, 0, 0);
709f6e46
MS		 2419 if (r < 0)
2420 return log_error_errno(r, "Failed to create %s: %m", q);
57fb9fb5 2421
60e76d48
ZJS		 2422 r = mount_verbose(LOG_DEBUG, p, q, NULL, MS_BIND, NULL);
2423 if (r < 0)
4a62c710 2424 return log_error_errno(errno, "Failed to bind mount journal from host into guest: %m");
57fb9fb5 2425
27407a01 2426 return 0;
57fb9fb5
LP		 2427}
2428
de40a303
LP		 2429static int drop_capabilities(uid_t uid) {
2430 CapabilityQuintet q;
2431
2432 /* Let's initialize all five capability sets to something valid. If the quintet was configured via
2433 * OCI use that, but fill in missing bits. If it wasn't then derive the quintet in full from
2434 * arg_caps_retain. */
2435
2436 if (capability_quintet_is_set(&arg_full_capabilities)) {
2437 q = arg_full_capabilities;
2438
2439 if (q.bounding == (uint64_t) -1)
2440 q.bounding = uid == 0 ? arg_caps_retain : 0;
2441
2442 if (q.effective == (uint64_t) -1)
2443 q.effective = uid == 0 ? q.bounding : 0;
2444
2445 if (q.inheritable == (uint64_t) -1)
2446 q.inheritable = uid == 0 ? q.bounding : 0;
2447
2448 if (q.permitted == (uint64_t) -1)
2449 q.permitted = uid == 0 ? q.bounding : 0;
2450
2451 if (q.ambient == (uint64_t) -1 && ambient_capabilities_supported())
2452 q.ambient = 0;
f66ad460
AZ		 2453
2454 if (capability_quintet_mangle(&q))
2455 return log_error_errno(SYNTHETIC_ERRNO(EPERM), "Cannot set capabilities that are not in the current bounding set.");
2456
2457 } else {
de40a303
LP		 2458 q = (CapabilityQuintet) {
2459 .bounding = arg_caps_retain,
2460 .effective = uid == 0 ? arg_caps_retain : 0,
2461 .inheritable = uid == 0 ? arg_caps_retain : 0,
2462 .permitted = uid == 0 ? arg_caps_retain : 0,
2463 .ambient = ambient_capabilities_supported() ? 0 : (uint64_t) -1,
2464 };
2465
f66ad460
AZ		 2466 /* If we're not using OCI, proceed with mangled capabilities (so we don't error out)
2467 * in order to maintain the same behavior as systemd < 242. */
2468 if (capability_quintet_mangle(&q))
0ccdaa79
JT		 2469 log_full(arg_quiet ? LOG_DEBUG : LOG_WARNING,
2470 "Some capabilities will not be set because they are not in the current bounding set.");
f66ad460
AZ		 2471
2472 }
2473
de40a303 2474 return capability_quintet_enforce(&q);
88213476
LP		 2475}
2476
db999e0f
LP		 2477static int reset_audit_loginuid(void) {
2478 _cleanup_free_ char *p = NULL;
2479 int r;
2480
0c582db0 2481 if ((arg_clone_ns_flags & CLONE_NEWPID) == 0)
db999e0f
LP		 2482 return 0;
2483
2484 r = read_one_line_file("/proc/self/loginuid", &p);
13e8ceb8 2485 if (r == -ENOENT)
db999e0f 2486 return 0;
f647962d
MS		 2487 if (r < 0)
2488 return log_error_errno(r, "Failed to read /proc/self/loginuid: %m");
db999e0f
LP		 2489
2490 /* Already reset? */
2491 if (streq(p, "4294967295"))
2492 return 0;
2493
57512c89 2494 r = write_string_file("/proc/self/loginuid", "4294967295", WRITE_STRING_FILE_DISABLE_BUFFER);
db999e0f 2495 if (r < 0) {
10a87006
LP		 2496 log_error_errno(r,
2497 "Failed to reset audit login UID. This probably means that your kernel is too\n"
2498 "old and you have audit enabled. Note that the auditing subsystem is known to\n"
2499 "be incompatible with containers on old kernels. Please make sure to upgrade\n"
2500 "your kernel or to off auditing with 'audit=0' on the kernel command line before\n"
2501 "using systemd-nspawn. Sleeping for 5s... (%m)");
77b6e194 2502
db999e0f 2503 sleep(5);
77b6e194 2504 }
db999e0f
LP		 2505
2506 return 0;
77b6e194
LP		 2507}
2508
785890ac
LP		 2509static int setup_propagate(const char *root) {
2510 const char *p, *q;
709f6e46 2511 int r;
785890ac
LP		 2512
2513 (void) mkdir_p("/run/systemd/nspawn/", 0755);
2514 (void) mkdir_p("/run/systemd/nspawn/propagate", 0600);
63c372cb 2515 p = strjoina("/run/systemd/nspawn/propagate/", arg_machine);
785890ac
LP		 2516 (void) mkdir_p(p, 0600);
2517
5a27b395 2518 r = userns_mkdir(root, "/run/host", 0755, 0, 0);
709f6e46 2519 if (r < 0)
5a27b395 2520 return log_error_errno(r, "Failed to create /run/host: %m");
03cfe0d5 2521
5a27b395 2522 r = userns_mkdir(root, "/run/host/incoming", 0600, 0, 0);
709f6e46 2523 if (r < 0)
5a27b395 2524 return log_error_errno(r, "Failed to create /run/host/incoming: %m");
03cfe0d5 2525
5a27b395 2526 q = prefix_roota(root, "/run/host/incoming");
60e76d48
ZJS		 2527 r = mount_verbose(LOG_ERR, p, q, NULL, MS_BIND, NULL);
2528 if (r < 0)
2529 return r;
785890ac 2530
60e76d48
ZJS		 2531 r = mount_verbose(LOG_ERR, NULL, q, NULL, MS_BIND|MS_REMOUNT|MS_RDONLY, NULL);
2532 if (r < 0)
2533 return r;
785890ac 2534
5a27b395 2535 /* machined will MS_MOVE into that directory, and that's only supported for non-shared mounts. */
60e76d48 2536 return mount_verbose(LOG_ERR, NULL, q, NULL, MS_SLAVE, NULL);
785890ac
LP		 2537}
2538
317feb4d 2539static int setup_machine_id(const char *directory) {
691675ba
LP		 2540 const char *etc_machine_id;
2541 sd_id128_t id;
3bbaff3e 2542 int r;
e01ff70a 2543
317feb4d
LP		 2544 /* If the UUID in the container is already set, then that's what counts, and we use. If it isn't set, and the
2545 * caller passed --uuid=, then we'll pass it in the $container_uuid env var to PID 1 of the container. The
2546 * assumption is that PID 1 will then write it to /etc/machine-id to make it persistent. If --uuid= is not
2547 * passed we generate a random UUID, and pass it via $container_uuid. In effect this means that /etc/machine-id
2548 * in the container and our idea of the container UUID will always be in sync (at least if PID 1 in the
2549 * container behaves nicely). */
2550
e01ff70a
MS		 2551 etc_machine_id = prefix_roota(directory, "/etc/machine-id");
2552
691675ba 2553 r = id128_read(etc_machine_id, ID128_PLAIN, &id);
317feb4d
LP		 2554 if (r < 0) {
2555 if (!IN_SET(r, -ENOENT, -ENOMEDIUM)) /* If the file is missing or empty, we don't mind */
2556 return log_error_errno(r, "Failed to read machine ID from container image: %m");
691675ba 2557
317feb4d
LP		 2558 if (sd_id128_is_null(arg_uuid)) {
2559 r = sd_id128_randomize(&arg_uuid);
2560 if (r < 0)
2561 return log_error_errno(r, "Failed to acquire randomized machine UUID: %m");
2562 }
2563 } else {
baaa35ad
ZJS		 2564 if (sd_id128_is_null(id))
2565 return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
2566 "Machine ID in container image is zero, refusing.");
e01ff70a 2567
317feb4d
LP		 2568 arg_uuid = id;
2569 }
691675ba 2570
e01ff70a
MS		 2571 return 0;
2572}
2573
7336138e
LP		 2574static int recursive_chown(const char *directory, uid_t shift, uid_t range) {
2575 int r;
2576
2577 assert(directory);
2578
0de7acce 2579 if (arg_userns_mode == USER_NAMESPACE_NO || !arg_userns_chown)
7336138e
LP		 2580 return 0;
2581
2582 r = path_patch_uid(directory, arg_uid_shift, arg_uid_range);
2583 if (r == -EOPNOTSUPP)
2584 return log_error_errno(r, "Automatic UID/GID adjusting is only supported for UID/GID ranges starting at multiples of 2^16 with a range of 2^16.");
2585 if (r == -EBADE)
2586 return log_error_errno(r, "Upper 16 bits of root directory UID and GID do not match.");
2587 if (r < 0)
2588 return log_error_errno(r, "Failed to adjust UID/GID shift of OS tree: %m");
2589 if (r == 0)
2590 log_debug("Root directory of image is already owned by the right UID/GID range, skipping recursive chown operation.");
2591 else
2592 log_debug("Patched directory tree to match UID/GID range.");
2593
2594 return r;
2595}
2596
113cea80 2597/*
6d416b9c
LS		 2598 * Return values:
2599 * < 0 : wait_for_terminate() failed to get the state of the
2600 * container, the container was terminated by a signal, or
2601 * failed for an unknown reason. No change is made to the
2602 * container argument.
2603 * > 0 : The program executed in the container terminated with an
2604 * error. The exit code of the program executed in the
919699ec
LP		 2605 * container is returned. The container argument has been set
2606 * to CONTAINER_TERMINATED.
6d416b9c
LS		 2607 * 0 : The container is being rebooted, has been shut down or exited
2608 * successfully. The container argument has been set to either
2609 * CONTAINER_TERMINATED or CONTAINER_REBOOTED.
113cea80 2610 *
6d416b9c
LS		 2611 * That is, success is indicated by a return value of zero, and an
2612 * error is indicated by a non-zero value.
113cea80
DH		 2613 */
2614static int wait_for_container(pid_t pid, ContainerStatus *container) {
113cea80 2615 siginfo_t status;
919699ec 2616 int r;
113cea80
DH		 2617
2618 r = wait_for_terminate(pid, &status);
f647962d
MS		 2619 if (r < 0)
2620 return log_warning_errno(r, "Failed to wait for container: %m");
113cea80
DH		 2621
2622 switch (status.si_code) {
fddbb89c 2623
113cea80 2624 case CLD_EXITED:
b5a2179b 2625 if (status.si_status == 0)
919699ec 2626 log_full(arg_quiet ? LOG_DEBUG : LOG_INFO, "Container %s exited successfully.", arg_machine);
b5a2179b 2627 else
919699ec 2628 log_full(arg_quiet ? LOG_DEBUG : LOG_INFO, "Container %s failed with error code %i.", arg_machine, status.si_status);
fddbb89c 2629
919699ec
LP		 2630 *container = CONTAINER_TERMINATED;
2631 return status.si_status;
113cea80
DH		 2632
2633 case CLD_KILLED:
2634 if (status.si_status == SIGINT) {
919699ec 2635 log_full(arg_quiet ? LOG_DEBUG : LOG_INFO, "Container %s has been shut down.", arg_machine);
113cea80 2636 *container = CONTAINER_TERMINATED;
919699ec
LP		 2637 return 0;
2638
113cea80 2639 } else if (status.si_status == SIGHUP) {
919699ec 2640 log_full(arg_quiet ? LOG_DEBUG : LOG_INFO, "Container %s is being rebooted.", arg_machine);
113cea80 2641 *container = CONTAINER_REBOOTED;
919699ec 2642 return 0;
113cea80 2643 }
919699ec 2644
4831981d 2645 _fallthrough_;
113cea80 2646 case CLD_DUMPED:
baaa35ad
ZJS		 2647 return log_error_errno(SYNTHETIC_ERRNO(EIO),
2648 "Container %s terminated by signal %s.", arg_machine, signal_to_string(status.si_status));
113cea80
DH		 2649
2650 default:
baaa35ad
ZJS		 2651 return log_error_errno(SYNTHETIC_ERRNO(EIO),
2652 "Container %s failed due to unknown reason.", arg_machine);
113cea80 2653 }
113cea80
DH		 2654}
2655
023fb90b
LP		 2656static int on_orderly_shutdown(sd_event_source *s, const struct signalfd_siginfo *si, void *userdata) {
2657 pid_t pid;
2658
4a0b58c4 2659 pid = PTR_TO_PID(userdata);
023fb90b 2660 if (pid > 0) {
c6c8f6e2 2661 if (kill(pid, arg_kill_signal) >= 0) {
023fb90b
LP		 2662 log_info("Trying to halt container. Send SIGTERM again to trigger immediate termination.");
2663 sd_event_source_set_userdata(s, NULL);
2664 return 0;
2665 }
2666 }
2667
2668 sd_event_exit(sd_event_source_get_event(s), 0);
2669 return 0;
2670}
2671
6916b164 2672static int on_sigchld(sd_event_source *s, const struct signalfd_siginfo *ssi, void *userdata) {
abdb9b08
LP		 2673 pid_t pid;
2674
2675 assert(s);
2676 assert(ssi);
2677
2678 pid = PTR_TO_PID(userdata);
2679
6916b164
AU		 2680 for (;;) {
2681 siginfo_t si = {};
abdb9b08 2682
6916b164
AU		 2683 if (waitid(P_ALL, 0, &si, WNOHANG|WNOWAIT|WEXITED) < 0)
2684 return log_error_errno(errno, "Failed to waitid(): %m");
2685 if (si.si_pid == 0) /* No pending children. */
2686 break;
abdb9b08 2687 if (si.si_pid == pid) {
6916b164
AU		 2688 /* The main process we care for has exited. Return from
2689 * signal handler but leave the zombie. */
2690 sd_event_exit(sd_event_source_get_event(s), 0);
2691 break;
2692 }
abdb9b08 2693
6916b164
AU		 2694 /* Reap all other children. */
2695 (void) waitid(P_PID, si.si_pid, &si, WNOHANG|WEXITED);
2696 }
2697
2698 return 0;
2699}
2700
abdb9b08
LP		 2701static int on_request_stop(sd_bus_message *m, void *userdata, sd_bus_error *error) {
2702 pid_t pid;
2703
2704 assert(m);
2705
2706 pid = PTR_TO_PID(userdata);
2707
2708 if (arg_kill_signal > 0) {
2709 log_info("Container termination requested. Attempting to halt container.");
2710 (void) kill(pid, arg_kill_signal);
2711 } else {
2712 log_info("Container termination requested. Exiting.");
2713 sd_event_exit(sd_bus_get_event(sd_bus_message_get_bus(m)), 0);
2714 }
2715
2716 return 0;
2717}
2718
ec16945e 2719static int determine_names(void) {
1b9cebf6 2720 int r;
ec16945e 2721
c1521918
LP		 2722 if (arg_template && !arg_directory && arg_machine) {
2723
2724 /* If --template= was specified then we should not
2725 * search for a machine, but instead create a new one
2726 * in /var/lib/machine. */
2727
657ee2d8 2728 arg_directory = path_join("/var/lib/machines", arg_machine);
c1521918
LP		 2729 if (!arg_directory)
2730 return log_oom();
2731 }
2732
ec16945e 2733 if (!arg_image && !arg_directory) {
1b9cebf6
LP		 2734 if (arg_machine) {
2735 _cleanup_(image_unrefp) Image *i = NULL;
2736
5ef46e5f 2737 r = image_find(IMAGE_MACHINE, arg_machine, &i);
3a6ce860
LP		 2738 if (r == -ENOENT)
2739 return log_error_errno(r, "No image for machine '%s'.", arg_machine);
1b9cebf6
LP		 2740 if (r < 0)
2741 return log_error_errno(r, "Failed to find image for machine '%s': %m", arg_machine);
1b9cebf6 2742
eb38edce 2743 if (IN_SET(i->type, IMAGE_RAW, IMAGE_BLOCK))
0f03c2a4 2744 r = free_and_strdup(&arg_image, i->path);
1b9cebf6 2745 else
0f03c2a4 2746 r = free_and_strdup(&arg_directory, i->path);
1b9cebf6 2747 if (r < 0)
0f3be6ca 2748 return log_oom();
1b9cebf6 2749
aee327b8
LP		 2750 if (!arg_ephemeral)
2751 arg_read_only = arg_read_only || i->read_only;
d7249575
LP		 2752 } else {
2753 r = safe_getcwd(&arg_directory);
2754 if (r < 0)
2755 return log_error_errno(r, "Failed to determine current directory: %m");
2756 }
ec16945e 2757
c6147113
LP		 2758 if (!arg_directory && !arg_image)
2759 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Failed to determine path, please use -D or -i.");
ec16945e
LP		 2760 }
2761
2762 if (!arg_machine) {
b9ba4dab
LP		 2763 if (arg_directory && path_equal(arg_directory, "/"))
2764 arg_machine = gethostname_malloc();
4827ab48
LP		 2765 else {
2766 if (arg_image) {
2767 char *e;
2768
2769 arg_machine = strdup(basename(arg_image));
2770
2771 /* Truncate suffix if there is one */
2772 e = endswith(arg_machine, ".raw");
2773 if (e)
2774 *e = 0;
2775 } else
2776 arg_machine = strdup(basename(arg_directory));
2777 }
ec16945e
LP		 2778 if (!arg_machine)
2779 return log_oom();
2780
ae691c1d 2781 hostname_cleanup(arg_machine);
c6147113
LP		 2782 if (!machine_name_is_valid(arg_machine))
2783 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Failed to determine machine name automatically, please use -M.");
b9ba4dab
LP		 2784
2785 if (arg_ephemeral) {
2786 char *b;
2787
2788 /* Add a random suffix when this is an
2789 * ephemeral machine, so that we can run many
2790 * instances at once without manually having
2791 * to specify -M each time. */
2792
2793 if (asprintf(&b, "%s-%016" PRIx64, arg_machine, random_u64()) < 0)
2794 return log_oom();
2795
2796 free(arg_machine);
2797 arg_machine = b;
2798 }
ec16945e
LP		 2799 }
2800
2801 return 0;
2802}
2803
8d4aa2bb 2804static int chase_symlinks_and_update(char **p, unsigned flags) {
3f342ec4
LP		 2805 char *chased;
2806 int r;
2807
2808 assert(p);
2809
2810 if (!*p)
2811 return 0;
2812
a5648b80 2813 r = chase_symlinks(*p, NULL, flags, &chased, NULL);
3f342ec4
LP		 2814 if (r < 0)
2815 return log_error_errno(r, "Failed to resolve path %s: %m", *p);
2816
a5648b80 2817 return free_and_replace(*p, chased);
3f342ec4
LP		 2818}
2819
03cfe0d5 2820static int determine_uid_shift(const char *directory) {
6dac160c
LP		 2821 int r;
2822
0de7acce 2823 if (arg_userns_mode == USER_NAMESPACE_NO) {
03cfe0d5 2824 arg_uid_shift = 0;
6dac160c 2825 return 0;
03cfe0d5 2826 }
6dac160c
LP		 2827
2828 if (arg_uid_shift == UID_INVALID) {
2829 struct stat st;
2830
03cfe0d5 2831 r = stat(directory, &st);
6dac160c 2832 if (r < 0)
03cfe0d5 2833 return log_error_errno(errno, "Failed to determine UID base of %s: %m", directory);
6dac160c
LP		 2834
2835 arg_uid_shift = st.st_uid & UINT32_C(0xffff0000);
2836
baaa35ad
ZJS		 2837 if (arg_uid_shift != (st.st_gid & UINT32_C(0xffff0000)))
2838 return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
2839 "UID and GID base of %s don't match.", directory);
6dac160c
LP		 2840
2841 arg_uid_range = UINT32_C(0x10000);
2842 }
2843
baaa35ad
ZJS		 2844 if (arg_uid_shift > (uid_t) -1 - arg_uid_range)
2845 return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
2846 "UID base too high for UID range.");
6dac160c 2847
6dac160c
LP		 2848 return 0;
2849}
2850
de40a303
LP		 2851static unsigned long effective_clone_ns_flags(void) {
2852 unsigned long flags = arg_clone_ns_flags;
2853
2854 if (arg_private_network)
2855 flags |= CLONE_NEWNET;
2856 if (arg_use_cgns)
2857 flags |= CLONE_NEWCGROUP;
2858 if (arg_userns_mode != USER_NAMESPACE_NO)
2859 flags |= CLONE_NEWUSER;
2860
2861 return flags;
2862}
2863
2864static int patch_sysctl(void) {
2865
2866 /* This table is inspired by runc's sysctl() function */
2867 static const struct {
2868 const char *key;
2869 bool prefix;
2870 unsigned long clone_flags;
2871 } safe_sysctl[] = {
2872 { "kernel.hostname", false, CLONE_NEWUTS },
2873 { "kernel.domainname", false, CLONE_NEWUTS },
2874 { "kernel.msgmax", false, CLONE_NEWIPC },
2875 { "kernel.msgmnb", false, CLONE_NEWIPC },
2876 { "kernel.msgmni", false, CLONE_NEWIPC },
2877 { "kernel.sem", false, CLONE_NEWIPC },
2878 { "kernel.shmall", false, CLONE_NEWIPC },
2879 { "kernel.shmmax", false, CLONE_NEWIPC },
2880 { "kernel.shmmni", false, CLONE_NEWIPC },
2881 { "fs.mqueue.", true, CLONE_NEWIPC },
2882 { "net.", true, CLONE_NEWNET },
2883 };
2884
2885 unsigned long flags;
2886 char **k, **v;
2887 int r;
2888
2889 flags = effective_clone_ns_flags();
2890
2891 STRV_FOREACH_PAIR(k, v, arg_sysctl) {
2892 bool good = false;
2893 size_t i;
2894
2895 for (i = 0; i < ELEMENTSOF(safe_sysctl); i++) {
2896
2897 if (!FLAGS_SET(flags, safe_sysctl[i].clone_flags))
2898 continue;
2899
2900 if (safe_sysctl[i].prefix)
2901 good = startswith(*k, safe_sysctl[i].key);
2902 else
2903 good = streq(*k, safe_sysctl[i].key);
2904
2905 if (good)
2906 break;
2907 }
2908
c6147113
LP		 2909 if (!good)
2910 return log_error_errno(SYNTHETIC_ERRNO(EPERM), "Refusing to write to sysctl '%s', as it is not safe in the selected namespaces.", *k);
de40a303
LP		 2911
2912 r = sysctl_write(*k, *v);
2913 if (r < 0)
2914 return log_error_errno(r, "Failed to write sysctl '%s': %m", *k);
2915 }
2916
2917 return 0;
2918}
2919
03cfe0d5
LP		 2920static int inner_child(
2921 Barrier *barrier,
2922 const char *directory,
2923 bool secondary,
2924 int kmsg_socket,
2925 int rtnl_socket,
3acc84eb 2926 int master_pty_socket,
e1bb4b0d
LB		 2927 FDSet *fds,
2928 char **os_release_pairs) {
69c79d3c 2929
03cfe0d5 2930 _cleanup_free_ char *home = NULL;
b5ea030d 2931 char as_uuid[ID128_UUID_STRING_MAX];
88614c8a 2932 size_t n_env = 1;
03cfe0d5 2933 const char *envp[] = {
0c300adf 2934 "PATH=" DEFAULT_PATH_COMPAT,
6aadfa4c 2935 NULL, /* container */
03cfe0d5
LP		 2936 NULL, /* TERM */
2937 NULL, /* HOME */
2938 NULL, /* USER */
2939 NULL, /* LOGNAME */
2940 NULL, /* container_uuid */
2941 NULL, /* LISTEN_FDS */
2942 NULL, /* LISTEN_PID */
9c1e04d0 2943 NULL, /* NOTIFY_SOCKET */
03cfe0d5
LP		 2944 NULL
2945 };
1a68e1e5 2946 const char *exec_target;
2371271c 2947 _cleanup_strv_free_ char **env_use = NULL;
de40a303 2948 int r, which_failed;
88213476 2949
b37469d7
LP		 2950 /* This is the "inner" child process, i.e. the one forked off by the "outer" child process, which is the one
2951 * the container manager itself forked off. At the time of clone() it gained its own CLONE_NEWNS, CLONE_NEWPID,
2952 * CLONE_NEWUTS, CLONE_NEWIPC, CLONE_NEWUSER namespaces. Note that it has its own CLONE_NEWNS namespace,
2953 * separate from the CLONE_NEWNS created for the "outer" child, and also separate from the host's CLONE_NEWNS
2954 * namespace. The reason for having two levels of CLONE_NEWNS namespaces is that the "inner" one is owned by
2955 * the CLONE_NEWUSER namespace of the container, while the "outer" one is owned by the host's CLONE_NEWUSER
2956 * namespace.
2957 *
2958 * Note at this point we have no CLONE_NEWNET namespace yet. We'll acquire that one later through
2959 * unshare(). See below. */
2960
03cfe0d5
LP		 2961 assert(barrier);
2962 assert(directory);
2963 assert(kmsg_socket >= 0);
88213476 2964
de40a303
LP		 2965 log_debug("Inner child is initializing.");
2966
0de7acce 2967 if (arg_userns_mode != USER_NAMESPACE_NO) {
03cfe0d5
LP		 2968 /* Tell the parent, that it now can write the UID map. */
2969 (void) barrier_place(barrier); /* #1 */
7027ff61 2970
03cfe0d5 2971 /* Wait until the parent wrote the UID map */
baaa35ad 2972 if (!barrier_place_and_sync(barrier)) /* #2 */
2a2e78e9 2973 return log_error_errno(SYNTHETIC_ERRNO(ESRCH), "Parent died too early");
88213476 2974
2a2e78e9
LP		 2975 /* Become the new root user inside our namespace */
2976 r = reset_uid_gid();
2977 if (r < 0)
2978 return log_error_errno(r, "Couldn't become new root: %m");
2979
2980 /* Creating a new user namespace means all MS_SHARED mounts become MS_SLAVE. Let's put them
2981 * back to MS_SHARED here, since that's what we want as defaults. (This will not reconnect
2982 * propagation, but simply create new peer groups for all our mounts). */
2983 r = mount_verbose(LOG_ERR, NULL, "/", NULL, MS_SHARED|MS_REC, NULL);
2984 if (r < 0)
2985 return r;
2986 }
6d66bd3b 2987
0de7acce 2988 r = mount_all(NULL,
4f086aab 2989 arg_mount_settings | MOUNT_IN_USERNS,
0de7acce 2990 arg_uid_shift,
0de7acce 2991 arg_selinux_apifs_context);
03cfe0d5
LP		 2992 if (r < 0)
2993 return r;
2994
04413780
ZJS		 2995 if (!arg_network_namespace_path && arg_private_network) {
2996 r = unshare(CLONE_NEWNET);
2997 if (r < 0)
2998 return log_error_errno(errno, "Failed to unshare network namespace: %m");
75116558
PS		 2999
3000 /* Tell the parent that it can setup network interfaces. */
3001 (void) barrier_place(barrier); /* #3 */
04413780
ZJS		 3002 }
3003
4f086aab 3004 r = mount_sysfs(NULL, arg_mount_settings);
d8fc6a00
LP		 3005 if (r < 0)
3006 return r;
3007
03cfe0d5
LP		 3008 /* Wait until we are cgroup-ified, so that we
3009 * can mount the right cgroup path writable */
baaa35ad
ZJS		 3010 if (!barrier_place_and_sync(barrier)) /* #4 */
3011 return log_error_errno(SYNTHETIC_ERRNO(ESRCH),
3012 "Parent died too early");
88213476 3013
489fae52 3014 if (arg_use_cgns) {
0996ef00
CB		 3015 r = unshare(CLONE_NEWCGROUP);
3016 if (r < 0)
04413780 3017 return log_error_errno(errno, "Failed to unshare cgroup namespace: %m");
0996ef00
CB		 3018 r = mount_cgroups(
3019 "",
3020 arg_unified_cgroup_hierarchy,
3021 arg_userns_mode != USER_NAMESPACE_NO,
3022 arg_uid_shift,
3023 arg_uid_range,
5a8ff0e6 3024 arg_selinux_apifs_context,
ada54120 3025 true);
1433e0f2 3026 } else
0996ef00 3027 r = mount_systemd_cgroup_writable("", arg_unified_cgroup_hierarchy);
1433e0f2
LP		 3028 if (r < 0)
3029 return r;
ec16945e 3030
1e4f1671 3031 r = setup_boot_id();
03cfe0d5
LP		 3032 if (r < 0)
3033 return r;
ec16945e 3034
1e4f1671 3035 r = setup_kmsg(kmsg_socket);
03cfe0d5
LP		 3036 if (r < 0)
3037 return r;
3038 kmsg_socket = safe_close(kmsg_socket);
ec16945e 3039
de40a303
LP		 3040 r = mount_custom(
3041 "/",
3042 arg_custom_mounts,
3043 arg_n_custom_mounts,
de40a303
LP		 3044 0,
3045 arg_selinux_apifs_context,
5f0a6347 3046 MOUNT_NON_ROOT_ONLY | MOUNT_IN_USERNS);
de40a303
LP		 3047 if (r < 0)
3048 return r;
3049
03cfe0d5
LP		 3050 if (setsid() < 0)
3051 return log_error_errno(errno, "setsid() failed: %m");
3052
3053 if (arg_private_network)
df883de9 3054 (void) loopback_setup();
03cfe0d5 3055
7a8f6325
LP		 3056 if (arg_expose_ports) {
3057 r = expose_port_send_rtnl(rtnl_socket);
3058 if (r < 0)
3059 return r;
3060 rtnl_socket = safe_close(rtnl_socket);
3061 }
03cfe0d5 3062
3acc84eb 3063 if (arg_console_mode != CONSOLE_PIPE) {
cd132992 3064 _cleanup_close_ int master = -1;
3acc84eb
FB		 3065 _cleanup_free_ char *console = NULL;
3066
3067 /* Allocate a pty and make it available as /dev/console. */
dc98caea 3068 master = openpt_allocate(O_RDWR|O_NONBLOCK, &console);
3acc84eb 3069 if (master < 0)
dc98caea 3070 return log_error_errno(master, "Failed to allocate a pty: %m");
3acc84eb
FB		 3071
3072 r = setup_dev_console(console);
3073 if (r < 0)
105a1a36 3074 return log_error_errno(r, "Failed to set up /dev/console: %m");
3acc84eb
FB		 3075
3076 r = send_one_fd(master_pty_socket, master, 0);
3077 if (r < 0)
3078 return log_error_errno(r, "Failed to send master fd: %m");
3079 master_pty_socket = safe_close(master_pty_socket);
3080
3081 r = setup_stdio_as_dev_console();
3082 if (r < 0)
3083 return r;
3084 }
3085
de40a303
LP		 3086 r = patch_sysctl();
3087 if (r < 0)
3088 return r;
3089
81f345df
LP		 3090 if (arg_oom_score_adjust_set) {
3091 r = set_oom_score_adjust(arg_oom_score_adjust);
3092 if (r < 0)
3093 return log_error_errno(r, "Failed to adjust OOM score: %m");
3094 }
3095
0985c7c4
ZJS		 3096 if (arg_cpu_set.set)
3097 if (sched_setaffinity(0, arg_cpu_set.allocated, arg_cpu_set.set) < 0)
d107bb7d
LP		 3098 return log_error_errno(errno, "Failed to set CPU affinity: %m");
3099
c818eef1 3100 (void) setup_hostname();
03cfe0d5 3101
050f7277 3102 if (arg_personality != PERSONALITY_INVALID) {
21022b9d
LP		 3103 r = safe_personality(arg_personality);
3104 if (r < 0)
3105 return log_error_errno(r, "personality() failed: %m");
03cfe0d5 3106 } else if (secondary) {
21022b9d
LP		 3107 r = safe_personality(PER_LINUX32);
3108 if (r < 0)
3109 return log_error_errno(r, "personality() failed: %m");
03cfe0d5
LP		 3110 }
3111
de40a303
LP		 3112 r = setrlimit_closest_all((const struct rlimit *const*) arg_rlimit, &which_failed);
3113 if (r < 0)
3114 return log_error_errno(r, "Failed to apply resource limit RLIMIT_%s: %m", rlimit_to_string(which_failed));
3115
3116#if HAVE_SECCOMP
3117 if (arg_seccomp) {
3118
3119 if (is_seccomp_available()) {
3120
3121 r = seccomp_load(arg_seccomp);
7bc5e0b1 3122 if (ERRNO_IS_SECCOMP_FATAL(r))
de40a303
LP		 3123 return log_error_errno(r, "Failed to install seccomp filter: %m");
3124 if (r < 0)
3125 log_debug_errno(r, "Failed to install seccomp filter: %m");
3126 }
3127 } else
3128#endif
3129 {
6b000af4 3130 r = setup_seccomp(arg_caps_retain, arg_syscall_allow_list, arg_syscall_deny_list);
de40a303
LP		 3131 if (r < 0)
3132 return r;
3133 }
3134
349cc4a5 3135#if HAVE_SELINUX
03cfe0d5 3136 if (arg_selinux_context)
2ed96880 3137 if (setexeccon(arg_selinux_context) < 0)
03cfe0d5
LP		 3138 return log_error_errno(errno, "setexeccon(\"%s\") failed: %m", arg_selinux_context);
3139#endif
3140
de40a303
LP		 3141 /* Make sure we keep the caps across the uid/gid dropping, so that we can retain some selected caps
3142 * if we need to later on. */
3143 if (prctl(PR_SET_KEEPCAPS, 1) < 0)
3144 return log_error_errno(errno, "Failed to set PR_SET_KEEPCAPS: %m");
3145
3146 if (uid_is_valid(arg_uid) || gid_is_valid(arg_gid))
3147 r = change_uid_gid_raw(arg_uid, arg_gid, arg_supplementary_gids, arg_n_supplementary_gids);
3148 else
3149 r = change_uid_gid(arg_user, &home);
03cfe0d5
LP		 3150 if (r < 0)
3151 return r;
3152
de40a303
LP		 3153 r = drop_capabilities(getuid());
3154 if (r < 0)
3155 return log_error_errno(r, "Dropping capabilities failed: %m");
3156
66edd963
LP		 3157 if (arg_no_new_privileges)
3158 if (prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0) < 0)
3159 return log_error_errno(errno, "Failed to disable new privileges: %m");
3160
6aadfa4c
ILG		 3161 /* LXC sets container=lxc, so follow the scheme here */
3162 envp[n_env++] = strjoina("container=", arg_container_service_name);
3163
03cfe0d5
LP		 3164 envp[n_env] = strv_find_prefix(environ, "TERM=");
3165 if (envp[n_env])
313cefa1 3166 n_env++;
03cfe0d5 3167
de40a303
LP		 3168 if (home || !uid_is_valid(arg_uid) || arg_uid == 0)
3169 if (asprintf((char**)(envp + n_env++), "HOME=%s", home ?: "/root") < 0)
3170 return log_oom();
3171
3172 if (arg_user || !uid_is_valid(arg_uid) || arg_uid == 0)
3173 if (asprintf((char**)(envp + n_env++), "USER=%s", arg_user ?: "root") < 0 ||
3174 asprintf((char**)(envp + n_env++), "LOGNAME=%s", arg_user ? arg_user : "root") < 0)
3175 return log_oom();
03cfe0d5 3176
3bbaff3e 3177 assert(!sd_id128_is_null(arg_uuid));
03cfe0d5 3178
691675ba 3179 if (asprintf((char**)(envp + n_env++), "container_uuid=%s", id128_to_uuid_string(arg_uuid, as_uuid)) < 0)
e01ff70a 3180 return log_oom();
03cfe0d5
LP		 3181
3182 if (fdset_size(fds) > 0) {
3183 r = fdset_cloexec(fds, false);
3184 if (r < 0)
3185 return log_error_errno(r, "Failed to unset O_CLOEXEC for file descriptors.");
3186
3187 if ((asprintf((char **)(envp + n_env++), "LISTEN_FDS=%u", fdset_size(fds)) < 0) ||
3188 (asprintf((char **)(envp + n_env++), "LISTEN_PID=1") < 0))
3189 return log_oom();
3190 }
9c1e04d0
AP		 3191 if (asprintf((char **)(envp + n_env++), "NOTIFY_SOCKET=%s", NSPAWN_NOTIFY_SOCKET_PATH) < 0)
3192 return log_oom();
03cfe0d5 3193
ed4512d0 3194 env_use = strv_env_merge(3, envp, os_release_pairs, arg_setenv);
2371271c
TG		 3195 if (!env_use)
3196 return log_oom();
03cfe0d5
LP		 3197
3198 /* Let the parent know that we are ready and
3199 * wait until the parent is ready with the
3200 * setup, too... */
baaa35ad
ZJS		 3201 if (!barrier_place_and_sync(barrier)) /* #5 */
3202 return log_error_errno(SYNTHETIC_ERRNO(ESRCH),
3203 "Parent died too early");
03cfe0d5 3204
5f932eb9
LP		 3205 if (arg_chdir)
3206 if (chdir(arg_chdir) < 0)
3207 return log_error_errno(errno, "Failed to change to specified working directory %s: %m", arg_chdir);
3208
7732f92b 3209 if (arg_start_mode == START_PID2) {
75bf701f 3210 r = stub_pid1(arg_uuid);
7732f92b
LP		 3211 if (r < 0)
3212 return r;
3213 }
3214
de40a303
LP		 3215 log_debug("Inner child completed, invoking payload.");
3216
8ca082b4
LP		 3217 /* Now, explicitly close the log, so that we then can close all remaining fds. Closing the log explicitly first
3218 * has the benefit that the logging subsystem knows about it, and is thus ready to be reopened should we need
3219 * it again. Note that the other fds closed here are at least the locking and barrier fds. */
03cfe0d5 3220 log_close();
8ca082b4
LP		 3221 log_set_open_when_needed(true);
3222
03cfe0d5
LP		 3223 (void) fdset_close_others(fds);
3224
7732f92b 3225 if (arg_start_mode == START_BOOT) {
03cfe0d5
LP		 3226 char **a;
3227 size_t m;
3228
3229 /* Automatically search for the init system */
3230
75f32f04
ZJS		 3231 m = strv_length(arg_parameters);
3232 a = newa(char*, m + 2);
3233 memcpy_safe(a + 1, arg_parameters, m * sizeof(char*));
3234 a[1 + m] = NULL;
03cfe0d5 3235
ced58da7 3236 a[0] = (char*) "/usr/lib/systemd/systemd";
03cfe0d5
LP		 3237 execve(a[0], a, env_use);
3238
ced58da7 3239 a[0] = (char*) "/lib/systemd/systemd";
03cfe0d5
LP		 3240 execve(a[0], a, env_use);
3241
ced58da7 3242 a[0] = (char*) "/sbin/init";
03cfe0d5 3243 execve(a[0], a, env_use);
ced58da7
LP		 3244
3245 exec_target = "/usr/lib/systemd/systemd, /lib/systemd/systemd, /sbin/init";
1a68e1e5 3246 } else if (!strv_isempty(arg_parameters)) {
b6b180b7
LP		 3247 const char *dollar_path;
3248
1a68e1e5 3249 exec_target = arg_parameters[0];
b6b180b7
LP		 3250
3251 /* Use the user supplied search $PATH if there is one, or DEFAULT_PATH_COMPAT if not to search the
3252 * binary. */
3253 dollar_path = strv_env_get(env_use, "PATH");
3254 if (dollar_path) {
6f646e01 3255 if (setenv("PATH", dollar_path, 1) < 0)
b6b180b7
LP		 3256 return log_error_errno(errno, "Failed to update $PATH: %m");
3257 }
3258
f757855e 3259 execvpe(arg_parameters[0], arg_parameters, env_use);
1a68e1e5 3260 } else {
5f932eb9 3261 if (!arg_chdir)
d929b0f9
ZJS		 3262 /* If we cannot change the directory, we'll end up in /, that is expected. */
3263 (void) chdir(home ?: "/root");
5f932eb9 3264
03cfe0d5
LP		 3265 execle("/bin/bash", "-bash", NULL, env_use);
3266 execle("/bin/sh", "-sh", NULL, env_use);
ced58da7
LP		 3267
3268 exec_target = "/bin/bash, /bin/sh";
03cfe0d5
LP		 3269 }
3270
8ca082b4 3271 return log_error_errno(errno, "execv(%s) failed: %m", exec_target);
03cfe0d5
LP		 3272}
3273
e96ceaba 3274static int setup_notify_child(void) {
271f518f 3275 _cleanup_close_ int fd = -1;
9c1e04d0 3276 union sockaddr_union sa = {
44ed5214
LP		 3277 .un.sun_family = AF_UNIX,
3278 .un.sun_path = NSPAWN_NOTIFY_SOCKET_PATH,
9c1e04d0
AP		 3279 };
3280 int r;
3281
3282 fd = socket(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0);
3283 if (fd < 0)
3284 return log_error_errno(errno, "Failed to allocate notification socket: %m");
3285
3286 (void) mkdir_parents(NSPAWN_NOTIFY_SOCKET_PATH, 0755);
fbda85b0 3287 (void) sockaddr_un_unlink(&sa.un);
9c1e04d0 3288
9c1e04d0 3289 r = bind(fd, &sa.sa, SOCKADDR_UN_LEN(sa.un));
271f518f 3290 if (r < 0)
44ed5214 3291 return log_error_errno(errno, "bind(" NSPAWN_NOTIFY_SOCKET_PATH ") failed: %m");
9c1e04d0 3292
adc7d9f0 3293 r = userns_lchown(NSPAWN_NOTIFY_SOCKET_PATH, 0, 0);
271f518f 3294 if (r < 0)
adc7d9f0 3295 return log_error_errno(r, "Failed to chown " NSPAWN_NOTIFY_SOCKET_PATH ": %m");
adc7d9f0 3296
2ff48e98 3297 r = setsockopt_int(fd, SOL_SOCKET, SO_PASSCRED, true);
271f518f 3298 if (r < 0)
2ff48e98 3299 return log_error_errno(r, "SO_PASSCRED failed: %m");
9c1e04d0 3300
271f518f 3301 return TAKE_FD(fd);
9c1e04d0
AP		 3302}
3303
03cfe0d5
LP		 3304static int outer_child(
3305 Barrier *barrier,
3306 const char *directory,
2d845785 3307 DissectedImage *dissected_image,
03cfe0d5
LP		 3308 bool secondary,
3309 int pid_socket,
e01ff70a 3310 int uuid_socket,
9c1e04d0 3311 int notify_socket,
03cfe0d5
LP		 3312 int kmsg_socket,
3313 int rtnl_socket,
825d5287 3314 int uid_shift_socket,
3acc84eb 3315 int master_pty_socket,
8199d554 3316 int unified_cgroup_hierarchy_socket,
d7bea6b6
DP		 3317 FDSet *fds,
3318 int netns_fd) {
03cfe0d5 3319
e1bb4b0d 3320 _cleanup_strv_free_ char **os_release_pairs = NULL;
bf428efb 3321 _cleanup_close_ int fd = -1;
e5f10caf 3322 const char *p;
03cfe0d5
LP		 3323 pid_t pid;
3324 ssize_t l;
de40a303 3325 int r;
03cfe0d5 3326
b37469d7
LP		 3327 /* This is the "outer" child process, i.e the one forked off by the container manager itself. It already has
3328 * its own CLONE_NEWNS namespace (which was created by the clone()). It still lives in the host's CLONE_NEWPID,
3329 * CLONE_NEWUTS, CLONE_NEWIPC, CLONE_NEWUSER and CLONE_NEWNET namespaces. After it completed a number of
3330 * initializations a second child (the "inner" one) is forked off it, and it exits. */
3331
03cfe0d5
LP		 3332 assert(barrier);
3333 assert(directory);
03cfe0d5 3334 assert(pid_socket >= 0);
e01ff70a 3335 assert(uuid_socket >= 0);
9c1e04d0 3336 assert(notify_socket >= 0);
3acc84eb 3337 assert(master_pty_socket >= 0);
03cfe0d5
LP		 3338 assert(kmsg_socket >= 0);
3339
de40a303
LP		 3340 log_debug("Outer child is initializing.");
3341
e1bb4b0d
LB		 3342 r = load_os_release_pairs_with_prefix("/", "container_host_", &os_release_pairs);
3343 if (r < 0)
3344 log_debug_errno(r, "Failed to read os-release from host for container, ignoring: %m");
3345
03cfe0d5
LP		 3346 if (prctl(PR_SET_PDEATHSIG, SIGKILL) < 0)
3347 return log_error_errno(errno, "PR_SET_PDEATHSIG failed: %m");
3348
03cfe0d5
LP		 3349 r = reset_audit_loginuid();
3350 if (r < 0)
3351 return r;
3352
2a2e78e9
LP		 3353 /* Mark everything as slave, so that we still receive mounts from the real root, but don't propagate
3354 * mounts to the real root. */
60e76d48
ZJS		 3355 r = mount_verbose(LOG_ERR, NULL, "/", NULL, MS_SLAVE|MS_REC, NULL);
3356 if (r < 0)
3357 return r;
03cfe0d5 3358
2d845785 3359 if (dissected_image) {
2d3a5a73
LP		 3360 /* If we are operating on a disk image, then mount its root directory now, but leave out the rest. We
3361 * can read the UID shift from it if we need to. Further down we'll mount the rest, but then with the
3362 * uid shift known. That way we can mount VFAT file systems shifted to the right place right away. This
3363 * makes sure ESP partitions and userns are compatible. */
3364
af187ab2
LP		 3365 r = dissected_image_mount_and_warn(
3366 dissected_image, directory, arg_uid_shift,
3367 DISSECT_IMAGE_MOUNT_ROOT_ONLY|DISSECT_IMAGE_DISCARD_ON_LOOP|
3368 (arg_read_only ? DISSECT_IMAGE_READ_ONLY : DISSECT_IMAGE_FSCK)|
3369 (arg_start_mode == START_BOOT ? DISSECT_IMAGE_VALIDATE_OS : 0));
2d845785 3370 if (r < 0)
af187ab2 3371 return r;
2d845785 3372 }
03cfe0d5 3373
391567f4
LP		 3374 r = determine_uid_shift(directory);
3375 if (r < 0)
3376 return r;
3377
0de7acce 3378 if (arg_userns_mode != USER_NAMESPACE_NO) {
0e7ac751 3379 /* Let the parent know which UID shift we read from the image */
825d5287
RM		 3380 l = send(uid_shift_socket, &arg_uid_shift, sizeof(arg_uid_shift), MSG_NOSIGNAL);
3381 if (l < 0)
3382 return log_error_errno(errno, "Failed to send UID shift: %m");
baaa35ad
ZJS		 3383 if (l != sizeof(arg_uid_shift))
3384 return log_error_errno(SYNTHETIC_ERRNO(EIO),
3385 "Short write while sending UID shift.");
0e7ac751 3386
0de7acce 3387 if (arg_userns_mode == USER_NAMESPACE_PICK) {
0e7ac751
LP		 3388 /* When we are supposed to pick the UID shift, the parent will check now whether the UID shift
3389 * we just read from the image is available. If yes, it will send the UID shift back to us, if
3390 * not it will pick a different one, and send it back to us. */
3391
3392 l = recv(uid_shift_socket, &arg_uid_shift, sizeof(arg_uid_shift), 0);
3393 if (l < 0)
3394 return log_error_errno(errno, "Failed to recv UID shift: %m");
baaa35ad
ZJS		 3395 if (l != sizeof(arg_uid_shift))
3396 return log_error_errno(SYNTHETIC_ERRNO(EIO),
3397 "Short read while receiving UID shift.");
0e7ac751
LP		 3398 }
3399
ff6c6cc1
LP		 3400 log_full(arg_quiet ? LOG_DEBUG : LOG_INFO,
3401 "Selected user namespace base " UID_FMT " and range " UID_FMT ".", arg_uid_shift, arg_uid_range);
825d5287
RM		 3402 }
3403
6f83d3d1
LP		 3404 if (path_equal(directory, "/")) {
3405 /* If the directory we shall boot is the host, let's operate on a bind mount at a different
3406 * place, so that we can make changes to its mount structure (for example, to implement
3407 * --volatile=) without this interfering with our ability to access files such as
3408 * /etc/localtime to copy into the container. Note that we use a fixed place for this
3409 * (instead of a temporary directory, since we are living in our own mount namspace here
3410 * already, and thus don't need to be afraid of colliding with anyone else's mounts).*/
3411 (void) mkdir_p("/run/systemd/nspawn-root", 0755);
3412
3413 r = mount_verbose(LOG_ERR, "/", "/run/systemd/nspawn-root", NULL, MS_BIND|MS_REC, NULL);
3414 if (r < 0)
3415 return r;
3416
3417 directory = "/run/systemd/nspawn-root";
e50cd82f 3418 }
7d0ecdd6
LP		 3419
3420 r = setup_pivot_root(
3421 directory,
3422 arg_pivot_root_new,
3423 arg_pivot_root_old);
3424 if (r < 0)
3425 return r;
3426
3427 r = setup_volatile_mode(
3428 directory,
3429 arg_volatile_mode,
7d0ecdd6 3430 arg_uid_shift,
8f1ed04a 3431 arg_selinux_apifs_context);
7d0ecdd6
LP		 3432 if (r < 0)
3433 return r;
3434
5f0a6347
DDM		 3435 r = mount_custom(
3436 directory,
3437 arg_custom_mounts,
3438 arg_n_custom_mounts,
5f0a6347 3439 arg_uid_shift,
5f0a6347
DDM		 3440 arg_selinux_apifs_context,
3441 MOUNT_ROOT_ONLY);
3442 if (r < 0)
3443 return r;
3444
5530dc87
DDM		 3445 /* Make sure we always have a mount that we can move to root later on. */
3446 if (!path_is_mount_point(directory, NULL, 0)) {
3447 r = mount_verbose(LOG_ERR, directory, directory, NULL, MS_BIND|MS_REC, NULL);
3448 if (r < 0)
3449 return r;
3450 }
3451
2d3a5a73
LP		 3452 if (dissected_image) {
3453 /* Now we know the uid shift, let's now mount everything else that might be in the image. */
3454 r = dissected_image_mount(dissected_image, directory, arg_uid_shift,
4fcb96ce
LP		 3455 DISSECT_IMAGE_MOUNT_NON_ROOT_ONLY|DISSECT_IMAGE_DISCARD_ON_LOOP|(arg_read_only ? DISSECT_IMAGE_READ_ONLY : DISSECT_IMAGE_FSCK));
3456 if (r == -EUCLEAN)
3457 return log_error_errno(r, "File system check for image failed: %m");
2d3a5a73 3458 if (r < 0)
4fcb96ce 3459 return log_error_errno(r, "Failed to mount image file system: %m");
2d3a5a73
LP		 3460 }
3461
8199d554
LP		 3462 if (arg_unified_cgroup_hierarchy == CGROUP_UNIFIED_UNKNOWN) {
3463 /* OK, we don't know yet which cgroup mode to use yet. Let's figure it out, and tell the parent. */
3464
3465 r = detect_unified_cgroup_hierarchy_from_image(directory);
3466 if (r < 0)
3467 return r;
3468
3469 l = send(unified_cgroup_hierarchy_socket, &arg_unified_cgroup_hierarchy, sizeof(arg_unified_cgroup_hierarchy), MSG_NOSIGNAL);
3470 if (l < 0)
3471 return log_error_errno(errno, "Failed to send cgroup mode: %m");
baaa35ad
ZJS		 3472 if (l != sizeof(arg_unified_cgroup_hierarchy))
3473 return log_error_errno(SYNTHETIC_ERRNO(EIO),
3474 "Short write while sending cgroup mode.");
8199d554
LP		 3475
3476 unified_cgroup_hierarchy_socket = safe_close(unified_cgroup_hierarchy_socket);
3477 }
3478
4ad14eff
LP		 3479 /* Mark everything as shared so our mounts get propagated down. This is
3480 * required to make new bind mounts available in systemd services
5238e957 3481 * inside the container that create a new mount namespace.
4ad14eff
LP		 3482 * See https://github.com/systemd/systemd/issues/3860
3483 * Further submounts (such as /dev) done after this will inherit the
5f0a6347
DDM		 3484 * shared propagation mode.
3485 *
3486 * IMPORTANT: Do not overmount the root directory anymore from now on to
3487 * enable moving the root directory mount to root later on.
3488 * https://github.com/systemd/systemd/issues/3847#issuecomment-562735251
3489 */
4ad14eff
LP		 3490 r = mount_verbose(LOG_ERR, NULL, directory, NULL, MS_SHARED|MS_REC, NULL);
3491 if (r < 0)
3492 return r;
3493
3494 r = recursive_chown(directory, arg_uid_shift, arg_uid_range);
3495 if (r < 0)
3496 return r;
3497
03cfe0d5
LP		 3498 r = base_filesystem_create(directory, arg_uid_shift, (gid_t) arg_uid_shift);
3499 if (r < 0)
3500 return r;
3501
bbd407ea
DDM		 3502 if (arg_read_only && arg_volatile_mode == VOLATILE_NO &&
3503 !has_custom_root_mount(arg_custom_mounts, arg_n_custom_mounts)) {
64e82c19 3504 r = bind_remount_recursive(directory, MS_RDONLY, MS_RDONLY, NULL);
03cfe0d5
LP		 3505 if (r < 0)
3506 return log_error_errno(r, "Failed to make tree read-only: %m");
3507 }
3508
0de7acce 3509 r = mount_all(directory,
4f086aab 3510 arg_mount_settings,
0de7acce 3511 arg_uid_shift,
0de7acce 3512 arg_selinux_apifs_context);
03cfe0d5
LP		 3513 if (r < 0)
3514 return r;
3515
07fa00f9
LP		 3516 r = copy_devnodes(directory);
3517 if (r < 0)
03cfe0d5
LP		 3518 return r;
3519
de40a303
LP		 3520 r = make_extra_nodes(directory);
3521 if (r < 0)
3522 return r;
3523
3524 (void) dev_setup(directory, arg_uid_shift, arg_uid_shift);
e5f10caf 3525
9fac5029 3526 p = prefix_roota(directory, "/run/host");
e5f10caf 3527 (void) make_inaccessible_nodes(p, arg_uid_shift, arg_uid_shift);
03cfe0d5 3528
07fa00f9
LP		 3529 r = setup_pts(directory);
3530 if (r < 0)
03cfe0d5
LP		 3531 return r;
3532
3533 r = setup_propagate(directory);
3534 if (r < 0)
3535 return r;
3536
8e5430c4
LP		 3537 r = setup_keyring();
3538 if (r < 0)
3539 return r;
3540
5c4deb9a
MJ		 3541 r = mount_custom(
3542 directory,
3543 arg_custom_mounts,
3544 arg_n_custom_mounts,
3545 arg_uid_shift,
3546 arg_selinux_apifs_context,
3547 MOUNT_NON_ROOT_ONLY);
3548 if (r < 0)
3549 return r;
3550
03cfe0d5
LP		 3551 r = setup_timezone(directory);
3552 if (r < 0)
3553 return r;
3554
3555 r = setup_resolv_conf(directory);
3556 if (r < 0)
3557 return r;
3558
e01ff70a
MS		 3559 r = setup_machine_id(directory);
3560 if (r < 0)
3561 return r;
3562
03cfe0d5
LP		 3563 r = setup_journal(directory);
3564 if (r < 0)
3565 return r;
3566
489fae52 3567 if (!arg_use_cgns) {
0996ef00
CB		 3568 r = mount_cgroups(
3569 directory,
3570 arg_unified_cgroup_hierarchy,
3571 arg_userns_mode != USER_NAMESPACE_NO,
3572 arg_uid_shift,
3573 arg_uid_range,
5a8ff0e6 3574 arg_selinux_apifs_context,
ada54120 3575 false);
0996ef00
CB		 3576 if (r < 0)
3577 return r;
3578 }
03cfe0d5
LP		 3579
3580 r = mount_move_root(directory);
3581 if (r < 0)
3582 return log_error_errno(r, "Failed to move root directory: %m");
3583
e96ceaba 3584 fd = setup_notify_child();
9c1e04d0
AP		 3585 if (fd < 0)
3586 return fd;
3587
03cfe0d5 3588 pid = raw_clone(SIGCHLD|CLONE_NEWNS|
0c582db0 3589 arg_clone_ns_flags |
8869a0b4 3590 (arg_userns_mode != USER_NAMESPACE_NO ? CLONE_NEWUSER : 0));
03cfe0d5
LP		 3591 if (pid < 0)
3592 return log_error_errno(errno, "Failed to fork inner child: %m");
03cfe0d5
LP		 3593 if (pid == 0) {
3594 pid_socket = safe_close(pid_socket);
e01ff70a 3595 uuid_socket = safe_close(uuid_socket);
9c1e04d0 3596 notify_socket = safe_close(notify_socket);
825d5287 3597 uid_shift_socket = safe_close(uid_shift_socket);
03cfe0d5 3598
2a2e78e9
LP		 3599 /* The inner child has all namespaces that are requested, so that we all are owned by the
3600 * user if user namespaces are turned on. */
03cfe0d5 3601
d7bea6b6
DP		 3602 if (arg_network_namespace_path) {
3603 r = namespace_enter(-1, -1, netns_fd, -1, -1);
3604 if (r < 0)
e2d39e54 3605 return log_error_errno(r, "Failed to join network namespace: %m");
d7bea6b6
DP		 3606 }
3607
e1bb4b0d 3608 r = inner_child(barrier, directory, secondary, kmsg_socket, rtnl_socket, master_pty_socket, fds, os_release_pairs);
03cfe0d5
LP		 3609 if (r < 0)
3610 _exit(EXIT_FAILURE);
3611
3612 _exit(EXIT_SUCCESS);
3613 }
3614
3615 l = send(pid_socket, &pid, sizeof(pid), MSG_NOSIGNAL);
3616 if (l < 0)
3617 return log_error_errno(errno, "Failed to send PID: %m");
baaa35ad
ZJS		 3618 if (l != sizeof(pid))
3619 return log_error_errno(SYNTHETIC_ERRNO(EIO),
3620 "Short write while sending PID.");
03cfe0d5 3621
e01ff70a
MS		 3622 l = send(uuid_socket, &arg_uuid, sizeof(arg_uuid), MSG_NOSIGNAL);
3623 if (l < 0)
3624 return log_error_errno(errno, "Failed to send machine ID: %m");
baaa35ad
ZJS		 3625 if (l != sizeof(arg_uuid))
3626 return log_error_errno(SYNTHETIC_ERRNO(EIO),
3627 "Short write while sending machine ID.");
e01ff70a 3628
9c1e04d0
AP		 3629 l = send_one_fd(notify_socket, fd, 0);
3630 if (l < 0)
ba72801d 3631 return log_error_errno(l, "Failed to send notify fd: %m");
9c1e04d0 3632
03cfe0d5 3633 pid_socket = safe_close(pid_socket);
e01ff70a 3634 uuid_socket = safe_close(uuid_socket);
9c1e04d0 3635 notify_socket = safe_close(notify_socket);
3acc84eb 3636 master_pty_socket = safe_close(master_pty_socket);
327e26d6
KN		 3637 kmsg_socket = safe_close(kmsg_socket);
3638 rtnl_socket = safe_close(rtnl_socket);
d7bea6b6 3639 netns_fd = safe_close(netns_fd);
03cfe0d5
LP		 3640
3641 return 0;
3642}
3643
0e7ac751 3644static int uid_shift_pick(uid_t *shift, LockFile *ret_lock_file) {
d381c8a6 3645 bool tried_hashed = false;
0e7ac751
LP		 3646 unsigned n_tries = 100;
3647 uid_t candidate;
3648 int r;
3649
3650 assert(shift);
3651 assert(ret_lock_file);
0de7acce 3652 assert(arg_userns_mode == USER_NAMESPACE_PICK);
0e7ac751
LP		 3653 assert(arg_uid_range == 0x10000U);
3654
3655 candidate = *shift;
3656
3657 (void) mkdir("/run/systemd/nspawn-uid", 0755);
3658
3659 for (;;) {
fbd0b64f 3660 char lock_path[STRLEN("/run/systemd/nspawn-uid/") + DECIMAL_STR_MAX(uid_t) + 1];
8e766630 3661 _cleanup_(release_lock_file) LockFile lf = LOCK_FILE_INIT;
0e7ac751
LP		 3662
3663 if (--n_tries <= 0)
3664 return -EBUSY;
3665
87d5e4f2 3666 if (candidate < CONTAINER_UID_BASE_MIN || candidate > CONTAINER_UID_BASE_MAX)
0e7ac751
LP		 3667 goto next;
3668 if ((candidate & UINT32_C(0xFFFF)) != 0)
3669 goto next;
3670
3671 xsprintf(lock_path, "/run/systemd/nspawn-uid/" UID_FMT, candidate);
3672 r = make_lock_file(lock_path, LOCK_EX|LOCK_NB, &lf);
3673 if (r == -EBUSY) /* Range already taken by another nspawn instance */
3674 goto next;
3675 if (r < 0)
3676 return r;
3677
3678 /* Make some superficial checks whether the range is currently known in the user database */
3679 if (getpwuid(candidate))
3680 goto next;
3681 if (getpwuid(candidate + UINT32_C(0xFFFE)))
3682 goto next;
3683 if (getgrgid(candidate))
3684 goto next;
3685 if (getgrgid(candidate + UINT32_C(0xFFFE)))
3686 goto next;
3687
3688 *ret_lock_file = lf;
3689 lf = (struct LockFile) LOCK_FILE_INIT;
3690 *shift = candidate;
3691 return 0;
3692
3693 next:
d381c8a6
LP		 3694 if (arg_machine && !tried_hashed) {
3695 /* Try to hash the base from the container name */
3696
3697 static const uint8_t hash_key[] = {
3698 0xe1, 0x56, 0xe0, 0xf0, 0x4a, 0xf0, 0x41, 0xaf,
3699 0x96, 0x41, 0xcf, 0x41, 0x33, 0x94, 0xff, 0x72
3700 };
3701
3702 candidate = (uid_t) siphash24(arg_machine, strlen(arg_machine), hash_key);
3703
3704 tried_hashed = true;
3705 } else
3706 random_bytes(&candidate, sizeof(candidate));
3707
87d5e4f2 3708 candidate = (candidate % (CONTAINER_UID_BASE_MAX - CONTAINER_UID_BASE_MIN)) + CONTAINER_UID_BASE_MIN;
0e7ac751
LP		 3709 candidate &= (uid_t) UINT32_C(0xFFFF0000);
3710 }
3711}
3712
03cfe0d5 3713static int setup_uid_map(pid_t pid) {
fbd0b64f 3714 char uid_map[STRLEN("/proc//uid_map") + DECIMAL_STR_MAX(uid_t) + 1], line[DECIMAL_STR_MAX(uid_t)*3+3+1];
03cfe0d5
LP		 3715 int r;
3716
3717 assert(pid > 1);
3718
3719 xsprintf(uid_map, "/proc/" PID_FMT "/uid_map", pid);
3720 xsprintf(line, UID_FMT " " UID_FMT " " UID_FMT "\n", 0, arg_uid_shift, arg_uid_range);
57512c89 3721 r = write_string_file(uid_map, line, WRITE_STRING_FILE_DISABLE_BUFFER);
03cfe0d5
LP		 3722 if (r < 0)
3723 return log_error_errno(r, "Failed to write UID map: %m");
3724
3725 /* We always assign the same UID and GID ranges */
3726 xsprintf(uid_map, "/proc/" PID_FMT "/gid_map", pid);
57512c89 3727 r = write_string_file(uid_map, line, WRITE_STRING_FILE_DISABLE_BUFFER);
03cfe0d5
LP		 3728 if (r < 0)
3729 return log_error_errno(r, "Failed to write GID map: %m");
3730
3731 return 0;
3732}
3733
9c1e04d0 3734static int nspawn_dispatch_notify_fd(sd_event_source *source, int fd, uint32_t revents, void *userdata) {
9c1e04d0
AP		 3735 char buf[NOTIFY_BUFFER_MAX+1];
3736 char *p = NULL;
3737 struct iovec iovec = {
3738 .iov_base = buf,
3739 .iov_len = sizeof(buf)-1,
3740 };
fb29cdbe
LP		 3741 CMSG_BUFFER_TYPE(CMSG_SPACE(sizeof(struct ucred)) +
3742 CMSG_SPACE(sizeof(int) * NOTIFY_FD_MAX)) control;
9c1e04d0
AP		 3743 struct msghdr msghdr = {
3744 .msg_iov = &iovec,
3745 .msg_iovlen = 1,
3746 .msg_control = &control,
3747 .msg_controllen = sizeof(control),
3748 };
371d72e0 3749 struct ucred *ucred;
9c1e04d0
AP		 3750 ssize_t n;
3751 pid_t inner_child_pid;
3752 _cleanup_strv_free_ char **tags = NULL;
3753
3754 assert(userdata);
3755
3756 inner_child_pid = PTR_TO_PID(userdata);
3757
3758 if (revents != EPOLLIN) {
3759 log_warning("Got unexpected poll event for notify fd.");
3760 return 0;
3761 }
3762
3691bcf3
LP		 3763 n = recvmsg_safe(fd, &msghdr, MSG_DONTWAIT|MSG_CMSG_CLOEXEC);
3764 if (IN_SET(n, -EAGAIN, -EINTR))
3765 return 0;
3766 if (n < 0)
3767 return log_warning_errno(n, "Couldn't read notification socket: %m");
9c1e04d0 3768
9c1e04d0
AP		 3769 cmsg_close_all(&msghdr);
3770
371d72e0 3771 ucred = CMSG_FIND_DATA(&msghdr, SOL_SOCKET, SCM_CREDENTIALS, struct ucred);
9c1e04d0 3772 if (!ucred || ucred->pid != inner_child_pid) {
8cb57430 3773 log_debug("Received notify message without valid credentials. Ignoring.");
9c1e04d0
AP		 3774 return 0;
3775 }
3776
3777 if ((size_t) n >= sizeof(buf)) {
3778 log_warning("Received notify message exceeded maximum size. Ignoring.");
3779 return 0;
3780 }
3781
3782 buf[n] = 0;
3783 tags = strv_split(buf, "\n\r");
3784 if (!tags)
3785 return log_oom();
3786
3787 if (strv_find(tags, "READY=1"))
04f590a4 3788 (void) sd_notifyf(false, "READY=1\n");
9c1e04d0
AP		 3789
3790 p = strv_find_startswith(tags, "STATUS=");
3791 if (p)
04f590a4 3792 (void) sd_notifyf(false, "STATUS=Container running: %s", p);
9c1e04d0
AP		 3793
3794 return 0;
3795}
3796
e96ceaba 3797static int setup_notify_parent(sd_event *event, int fd, pid_t *inner_child_pid, sd_event_source **notify_event_source) {
9c1e04d0 3798 int r;
9c1e04d0 3799
5773024d 3800 r = sd_event_add_io(event, notify_event_source, fd, EPOLLIN, nspawn_dispatch_notify_fd, inner_child_pid);
9c1e04d0
AP		 3801 if (r < 0)
3802 return log_error_errno(r, "Failed to allocate notify event source: %m");
3803
5773024d 3804 (void) sd_event_source_set_description(*notify_event_source, "nspawn-notify");
9c1e04d0
AP		 3805
3806 return 0;
3807}
3808
5d961407
LP		 3809static int merge_settings(Settings *settings, const char *path) {
3810 int rl;
f757855e 3811
5d961407
LP		 3812 assert(settings);
3813 assert(path);
f757855e 3814
5d961407
LP		 3815 /* Copy over bits from the settings, unless they have been explicitly masked by command line switches. Note
3816 * that this steals the fields of the Settings* structure, and hence modifies it. */
f757855e 3817
7732f92b
LP		 3818 if ((arg_settings_mask & SETTING_START_MODE) == 0 &&
3819 settings->start_mode >= 0) {
3820 arg_start_mode = settings->start_mode;
130d3d22 3821 strv_free_and_replace(arg_parameters, settings->parameters);
f757855e
LP		 3822 }
3823
a2f577fc
JL		 3824 if ((arg_settings_mask & SETTING_EPHEMERAL) == 0)
3825 arg_ephemeral = settings->ephemeral;
3826
de40a303
LP		 3827 if ((arg_settings_mask & SETTING_DIRECTORY) == 0 &&
3828 settings->root) {
3829
3830 if (!arg_settings_trusted)
3831 log_warning("Ignoring root directory setting, file %s is not trusted.", path);
3832 else
3833 free_and_replace(arg_directory, settings->root);
3834 }
3835
b53ede69
PW		 3836 if ((arg_settings_mask & SETTING_PIVOT_ROOT) == 0 &&
3837 settings->pivot_root_new) {
3838 free_and_replace(arg_pivot_root_new, settings->pivot_root_new);
3839 free_and_replace(arg_pivot_root_old, settings->pivot_root_old);
3840 }
3841
5f932eb9 3842 if ((arg_settings_mask & SETTING_WORKING_DIRECTORY) == 0 &&
1cc6c93a
YW		 3843 settings->working_directory)
3844 free_and_replace(arg_chdir, settings->working_directory);
5f932eb9 3845
f757855e 3846 if ((arg_settings_mask & SETTING_ENVIRONMENT) == 0 &&
130d3d22
YW		 3847 settings->environment)
3848 strv_free_and_replace(arg_setenv, settings->environment);
f757855e 3849
de40a303
LP		 3850 if ((arg_settings_mask & SETTING_USER) == 0) {
3851
3852 if (settings->user)
3853 free_and_replace(arg_user, settings->user);
3854
3855 if (uid_is_valid(settings->uid))
3856 arg_uid = settings->uid;
3857 if (gid_is_valid(settings->gid))
3858 arg_gid = settings->gid;
3859 if (settings->n_supplementary_gids > 0) {
3860 free_and_replace(arg_supplementary_gids, settings->supplementary_gids);
3861 arg_n_supplementary_gids = settings->n_supplementary_gids;
3862 }
3863 }
f757855e
LP		 3864
3865 if ((arg_settings_mask & SETTING_CAPABILITY) == 0) {
a3fc6b55 3866 uint64_t plus, minus;
7be830c6 3867 uint64_t network_minus = 0;
f757855e 3868
de40a303
LP		 3869 /* Note that we copy both the simple plus/minus caps here, and the full quintet from the
3870 * Settings structure */
3871
0e265674 3872 plus = settings->capability;
a3fc6b55
LP		 3873 minus = settings->drop_capability;
3874
3875 if ((arg_settings_mask & SETTING_NETWORK) == 0) {
3876 if (settings_private_network(settings))
3877 plus |= UINT64_C(1) << CAP_NET_ADMIN;
3878 else
7be830c6 3879 network_minus |= UINT64_C(1) << CAP_NET_ADMIN;
a3fc6b55 3880 }
0e265674
LP		 3881
3882 if (!arg_settings_trusted && plus != 0) {
3883 if (settings->capability != 0)
5d961407 3884 log_warning("Ignoring Capability= setting, file %s is not trusted.", path);
7be830c6
TH		 3885 } else {
3886 arg_caps_retain &= ~network_minus;
520e0d54 3887 arg_caps_retain |= plus;
7be830c6 3888 }
f757855e 3889
a3fc6b55 3890 arg_caps_retain &= ~minus;
de40a303
LP		 3891
3892 /* Copy the full capabilities over too */
3893 if (capability_quintet_is_set(&settings->full_capabilities)) {
3894 if (!arg_settings_trusted)
5238e957 3895 log_warning("Ignoring capability settings, file %s is not trusted.", path);
de40a303
LP		 3896 else
3897 arg_full_capabilities = settings->full_capabilities;
3898 }
f757855e
LP		 3899 }
3900
3901 if ((arg_settings_mask & SETTING_KILL_SIGNAL) == 0 &&
3902 settings->kill_signal > 0)
3903 arg_kill_signal = settings->kill_signal;
3904
3905 if ((arg_settings_mask & SETTING_PERSONALITY) == 0 &&
3906 settings->personality != PERSONALITY_INVALID)
3907 arg_personality = settings->personality;
3908
3909 if ((arg_settings_mask & SETTING_MACHINE_ID) == 0 &&
3910 !sd_id128_is_null(settings->machine_id)) {
3911
3912 if (!arg_settings_trusted)
5d961407 3913 log_warning("Ignoring MachineID= setting, file %s is not trusted.", path);
f757855e
LP		 3914 else
3915 arg_uuid = settings->machine_id;
3916 }
3917
3918 if ((arg_settings_mask & SETTING_READ_ONLY) == 0 &&
3919 settings->read_only >= 0)
3920 arg_read_only = settings->read_only;
3921
3922 if ((arg_settings_mask & SETTING_VOLATILE_MODE) == 0 &&
3923 settings->volatile_mode != _VOLATILE_MODE_INVALID)
3924 arg_volatile_mode = settings->volatile_mode;
3925
3926 if ((arg_settings_mask & SETTING_CUSTOM_MOUNTS) == 0 &&
3927 settings->n_custom_mounts > 0) {
3928
3929 if (!arg_settings_trusted)
5d961407 3930 log_warning("Ignoring TemporaryFileSystem=, Bind= and BindReadOnly= settings, file %s is not trusted.", path);
f757855e
LP		 3931 else {
3932 custom_mount_free_all(arg_custom_mounts, arg_n_custom_mounts);
1cc6c93a 3933 arg_custom_mounts = TAKE_PTR(settings->custom_mounts);
f757855e 3934 arg_n_custom_mounts = settings->n_custom_mounts;
f757855e
LP		 3935 settings->n_custom_mounts = 0;
3936 }
3937 }
3938
3939 if ((arg_settings_mask & SETTING_NETWORK) == 0 &&
3940 (settings->private_network >= 0 ||
3941 settings->network_veth >= 0 ||
3942 settings->network_bridge ||
22b28dfd 3943 settings->network_zone ||
f757855e
LP		 3944 settings->network_interfaces ||
3945 settings->network_macvlan ||
f6d6bad1 3946 settings->network_ipvlan ||
de40a303
LP		 3947 settings->network_veth_extra ||
3948 settings->network_namespace_path)) {
f757855e
LP		 3949
3950 if (!arg_settings_trusted)
5d961407 3951 log_warning("Ignoring network settings, file %s is not trusted.", path);
f757855e 3952 else {
f6d6bad1 3953 arg_network_veth = settings_network_veth(settings);
0e265674
LP		 3954 arg_private_network = settings_private_network(settings);
3955
130d3d22
YW		 3956 strv_free_and_replace(arg_network_interfaces, settings->network_interfaces);
3957 strv_free_and_replace(arg_network_macvlan, settings->network_macvlan);
3958 strv_free_and_replace(arg_network_ipvlan, settings->network_ipvlan);
3959 strv_free_and_replace(arg_network_veth_extra, settings->network_veth_extra);
f6d6bad1 3960
1cc6c93a
YW		 3961 free_and_replace(arg_network_bridge, settings->network_bridge);
3962 free_and_replace(arg_network_zone, settings->network_zone);
de40a303
LP		 3963
3964 free_and_replace(arg_network_namespace_path, settings->network_namespace_path);
f757855e
LP		 3965 }
3966 }
3967
3968 if ((arg_settings_mask & SETTING_EXPOSE_PORTS) == 0 &&
3969 settings->expose_ports) {
3970
3971 if (!arg_settings_trusted)
5d961407 3972 log_warning("Ignoring Port= setting, file %s is not trusted.", path);
f757855e
LP		 3973 else {
3974 expose_port_free_all(arg_expose_ports);
1cc6c93a 3975 arg_expose_ports = TAKE_PTR(settings->expose_ports);
f757855e
LP		 3976 }
3977 }
3978
0de7acce
LP		 3979 if ((arg_settings_mask & SETTING_USERNS) == 0 &&
3980 settings->userns_mode != _USER_NAMESPACE_MODE_INVALID) {
3981
3982 if (!arg_settings_trusted)
5d961407 3983 log_warning("Ignoring PrivateUsers= and PrivateUsersChown= settings, file %s is not trusted.", path);
0de7acce
LP		 3984 else {
3985 arg_userns_mode = settings->userns_mode;
3986 arg_uid_shift = settings->uid_shift;
3987 arg_uid_range = settings->uid_range;
3988 arg_userns_chown = settings->userns_chown;
3989 }
3990 }
3991
9c1e04d0
AP		 3992 if ((arg_settings_mask & SETTING_NOTIFY_READY) == 0)
3993 arg_notify_ready = settings->notify_ready;
3994
960e4569
LP		 3995 if ((arg_settings_mask & SETTING_SYSCALL_FILTER) == 0) {
3996
6b000af4 3997 if (!arg_settings_trusted && !strv_isempty(settings->syscall_allow_list))
5d961407 3998 log_warning("Ignoring SystemCallFilter= settings, file %s is not trusted.", path);
960e4569 3999 else {
6b000af4
LP		 4000 strv_free_and_replace(arg_syscall_allow_list, settings->syscall_allow_list);
4001 strv_free_and_replace(arg_syscall_deny_list, settings->syscall_deny_list);
960e4569 4002 }
de40a303
LP		 4003
4004#if HAVE_SECCOMP
4005 if (!arg_settings_trusted && settings->seccomp)
4006 log_warning("Ignoring SECCOMP filter, file %s is not trusted.", path);
4007 else {
4008 seccomp_release(arg_seccomp);
4009 arg_seccomp = TAKE_PTR(settings->seccomp);
4010 }
4011#endif
960e4569
LP		 4012 }
4013
bf428efb
LP		 4014 for (rl = 0; rl < _RLIMIT_MAX; rl ++) {
4015 if ((arg_settings_mask & (SETTING_RLIMIT_FIRST << rl)))
4016 continue;
4017
4018 if (!settings->rlimit[rl])
4019 continue;
4020
4021 if (!arg_settings_trusted) {
5d961407 4022 log_warning("Ignoring Limit%s= setting, file '%s' is not trusted.", rlimit_to_string(rl), path);
bf428efb
LP		 4023 continue;
4024 }
4025
4026 free_and_replace(arg_rlimit[rl], settings->rlimit[rl]);
4027 }
4028
3a9530e5
LP		 4029 if ((arg_settings_mask & SETTING_HOSTNAME) == 0 &&
4030 settings->hostname)
4031 free_and_replace(arg_hostname, settings->hostname);
4032
66edd963
LP		 4033 if ((arg_settings_mask & SETTING_NO_NEW_PRIVILEGES) == 0 &&
4034 settings->no_new_privileges >= 0)
4035 arg_no_new_privileges = settings->no_new_privileges;
4036
81f345df
LP		 4037 if ((arg_settings_mask & SETTING_OOM_SCORE_ADJUST) == 0 &&
4038 settings->oom_score_adjust_set) {
4039
4040 if (!arg_settings_trusted)
5d961407 4041 log_warning("Ignoring OOMScoreAdjust= setting, file '%s' is not trusted.", path);
81f345df
LP		 4042 else {
4043 arg_oom_score_adjust = settings->oom_score_adjust;
4044 arg_oom_score_adjust_set = true;
4045 }
4046 }
4047
d107bb7d 4048 if ((arg_settings_mask & SETTING_CPU_AFFINITY) == 0 &&
0985c7c4 4049 settings->cpu_set.set) {
d107bb7d
LP		 4050
4051 if (!arg_settings_trusted)
5d961407 4052 log_warning("Ignoring CPUAffinity= setting, file '%s' is not trusted.", path);
d107bb7d 4053 else {
0985c7c4
ZJS		 4054 cpu_set_reset(&arg_cpu_set);
4055 arg_cpu_set = settings->cpu_set;
4056 settings->cpu_set = (CPUSet) {};
d107bb7d
LP		 4057 }
4058 }
4059
09d423e9
LP		 4060 if ((arg_settings_mask & SETTING_RESOLV_CONF) == 0 &&
4061 settings->resolv_conf != _RESOLV_CONF_MODE_INVALID)
4062 arg_resolv_conf = settings->resolv_conf;
4063
4e1d6aa9
LP		 4064 if ((arg_settings_mask & SETTING_LINK_JOURNAL) == 0 &&
4065 settings->link_journal != _LINK_JOURNAL_INVALID) {
4066
4067 if (!arg_settings_trusted)
4068 log_warning("Ignoring journal link setting, file '%s' is not trusted.", path);
4069 else {
4070 arg_link_journal = settings->link_journal;
4071 arg_link_journal_try = settings->link_journal_try;
4072 }
4073 }
4074
1688841f
LP		 4075 if ((arg_settings_mask & SETTING_TIMEZONE) == 0 &&
4076 settings->timezone != _TIMEZONE_MODE_INVALID)
4077 arg_timezone = settings->timezone;
4078
de40a303
LP		 4079 if ((arg_settings_mask & SETTING_SLICE) == 0 &&
4080 settings->slice) {
4081
4082 if (!arg_settings_trusted)
4083 log_warning("Ignoring slice setting, file '%s' is not trusted.", path);
4084 else
4085 free_and_replace(arg_slice, settings->slice);
4086 }
4087
4088 if ((arg_settings_mask & SETTING_USE_CGNS) == 0 &&
4089 settings->use_cgns >= 0) {
4090
4091 if (!arg_settings_trusted)
4092 log_warning("Ignoring cgroup namespace setting, file '%s' is not trusted.", path);
4093 else
4094 arg_use_cgns = settings->use_cgns;
4095 }
4096
4097 if ((arg_settings_mask & SETTING_CLONE_NS_FLAGS) == 0 &&
4098 settings->clone_ns_flags != (unsigned long) -1) {
4099
4100 if (!arg_settings_trusted)
4101 log_warning("Ignoring namespace setting, file '%s' is not trusted.", path);
4102 else
4103 arg_clone_ns_flags = settings->clone_ns_flags;
4104 }
4105
4106 if ((arg_settings_mask & SETTING_CONSOLE_MODE) == 0 &&
4107 settings->console_mode >= 0) {
4108
4109 if (!arg_settings_trusted)
4110 log_warning("Ignoring console mode setting, file '%s' is not trusted.", path);
4111 else
4112 arg_console_mode = settings->console_mode;
4113 }
4114
4115 /* The following properties can only be set through the OCI settings logic, not from the command line, hence we
4116 * don't consult arg_settings_mask for them. */
4117
4118 sd_bus_message_unref(arg_property_message);
4119 arg_property_message = TAKE_PTR(settings->properties);
4120
4121 arg_console_width = settings->console_width;
4122 arg_console_height = settings->console_height;
4123
b2645747 4124 device_node_array_free(arg_extra_nodes, arg_n_extra_nodes);
de40a303
LP		 4125 arg_extra_nodes = TAKE_PTR(settings->extra_nodes);
4126 arg_n_extra_nodes = settings->n_extra_nodes;
4127
f757855e
LP		 4128 return 0;
4129}
4130
5d961407
LP		 4131static int load_settings(void) {
4132 _cleanup_(settings_freep) Settings *settings = NULL;
4133 _cleanup_fclose_ FILE *f = NULL;
4134 _cleanup_free_ char *p = NULL;
4135 const char *fn, *i;
4136 int r;
4137
de40a303
LP		 4138 if (arg_oci_bundle)
4139 return 0;
4140
5d961407
LP		 4141 /* If all settings are masked, there's no point in looking for
4142 * the settings file */
4143 if ((arg_settings_mask & _SETTINGS_MASK_ALL) == _SETTINGS_MASK_ALL)
4144 return 0;
4145
4146 fn = strjoina(arg_machine, ".nspawn");
4147
4148 /* We first look in the admin's directories in /etc and /run */
4149 FOREACH_STRING(i, "/etc/systemd/nspawn", "/run/systemd/nspawn") {
4150 _cleanup_free_ char *j = NULL;
4151
657ee2d8 4152 j = path_join(i, fn);
5d961407
LP		 4153 if (!j)
4154 return log_oom();
4155
4156 f = fopen(j, "re");
4157 if (f) {
4158 p = TAKE_PTR(j);
4159
4160 /* By default, we trust configuration from /etc and /run */
4161 if (arg_settings_trusted < 0)
4162 arg_settings_trusted = true;
4163
4164 break;
4165 }
4166
4167 if (errno != ENOENT)
4168 return log_error_errno(errno, "Failed to open %s: %m", j);
4169 }
4170
4171 if (!f) {
4172 /* After that, let's look for a file next to the
4173 * actual image we shall boot. */
4174
4175 if (arg_image) {
4176 p = file_in_same_dir(arg_image, fn);
4177 if (!p)
4178 return log_oom();
cd6e3914 4179 } else if (arg_directory && !path_equal(arg_directory, "/")) {
5d961407
LP		 4180 p = file_in_same_dir(arg_directory, fn);
4181 if (!p)
4182 return log_oom();
4183 }
4184
4185 if (p) {
4186 f = fopen(p, "re");
4187 if (!f && errno != ENOENT)
4188 return log_error_errno(errno, "Failed to open %s: %m", p);
4189
4190 /* By default, we do not trust configuration from /var/lib/machines */
4191 if (arg_settings_trusted < 0)
4192 arg_settings_trusted = false;
4193 }
4194 }
4195
4196 if (!f)
4197 return 0;
4198
4199 log_debug("Settings are trusted: %s", yes_no(arg_settings_trusted));
4200
4201 r = settings_load(f, p, &settings);
4202 if (r < 0)
4203 return r;
4204
4205 return merge_settings(settings, p);
4206}
4207
de40a303
LP		 4208static int load_oci_bundle(void) {
4209 _cleanup_(settings_freep) Settings *settings = NULL;
4210 int r;
4211
4212 if (!arg_oci_bundle)
4213 return 0;
4214
4215 /* By default let's trust OCI bundles */
4216 if (arg_settings_trusted < 0)
4217 arg_settings_trusted = true;
4218
4219 r = oci_load(NULL, arg_oci_bundle, &settings);
4220 if (r < 0)
4221 return r;
4222
4223 return merge_settings(settings, arg_oci_bundle);
4224}
4225
3acc84eb 4226static int run_container(
2d845785 4227 DissectedImage *dissected_image,
b0067625
ZJS		 4228 bool secondary,
4229 FDSet *fds,
4230 char veth_name[IFNAMSIZ], bool *veth_created,
4231 union in_addr_union *exposed,
3acc84eb 4232 int *master, pid_t *pid, int *ret) {
b0067625
ZJS		 4233
4234 static const struct sigaction sa = {
4235 .sa_handler = nop_signal_handler,
e28c7cd0 4236 .sa_flags = SA_NOCLDSTOP|SA_RESTART,
b0067625
ZJS		 4237 };
4238
8e766630 4239 _cleanup_(release_lock_file) LockFile uid_shift_lock = LOCK_FILE_INIT;
b0067625
ZJS		 4240 _cleanup_close_ int etc_passwd_lock = -1;
4241 _cleanup_close_pair_ int
4242 kmsg_socket_pair[2] = { -1, -1 },
4243 rtnl_socket_pair[2] = { -1, -1 },
4244 pid_socket_pair[2] = { -1, -1 },
4245 uuid_socket_pair[2] = { -1, -1 },
4246 notify_socket_pair[2] = { -1, -1 },
8199d554 4247 uid_shift_socket_pair[2] = { -1, -1 },
3acc84eb 4248 master_pty_socket_pair[2] = { -1, -1 },
8199d554
LP		 4249 unified_cgroup_hierarchy_socket_pair[2] = { -1, -1};
4250
3acc84eb 4251 _cleanup_close_ int notify_socket = -1;
b0067625 4252 _cleanup_(barrier_destroy) Barrier barrier = BARRIER_NULL;
5773024d 4253 _cleanup_(sd_event_source_unrefp) sd_event_source *notify_event_source = NULL;
b0067625
ZJS		 4254 _cleanup_(sd_event_unrefp) sd_event *event = NULL;
4255 _cleanup_(pty_forward_freep) PTYForward *forward = NULL;
4256 _cleanup_(sd_netlink_unrefp) sd_netlink *rtnl = NULL;
abdb9b08 4257 _cleanup_(sd_bus_flush_close_unrefp) sd_bus *bus = NULL;
b0067625 4258 ContainerStatus container_status = 0;
b0067625
ZJS		 4259 int ifi = 0, r;
4260 ssize_t l;
4261 sigset_t mask_chld;
5b4855ab 4262 _cleanup_close_ int child_netns_fd = -1;
b0067625
ZJS		 4263
4264 assert_se(sigemptyset(&mask_chld) == 0);
4265 assert_se(sigaddset(&mask_chld, SIGCHLD) == 0);
4266
4267 if (arg_userns_mode == USER_NAMESPACE_PICK) {
4268 /* When we shall pick the UID/GID range, let's first lock /etc/passwd, so that we can safely
4269 * check with getpwuid() if the specific user already exists. Note that /etc might be
4270 * read-only, in which case this will fail with EROFS. But that's really OK, as in that case we
4271 * can be reasonably sure that no users are going to be added. Note that getpwuid() checks are
4272 * really just an extra safety net. We kinda assume that the UID range we allocate from is
4273 * really ours. */
4274
4275 etc_passwd_lock = take_etc_passwd_lock(NULL);
4276 if (etc_passwd_lock < 0 && etc_passwd_lock != -EROFS)
4277 return log_error_errno(etc_passwd_lock, "Failed to take /etc/passwd lock: %m");
4278 }
4279
4280 r = barrier_create(&barrier);
4281 if (r < 0)
4282 return log_error_errno(r, "Cannot initialize IPC barrier: %m");
4283
4284 if (socketpair(AF_UNIX, SOCK_SEQPACKET|SOCK_CLOEXEC, 0, kmsg_socket_pair) < 0)
4285 return log_error_errno(errno, "Failed to create kmsg socket pair: %m");
4286
4287 if (socketpair(AF_UNIX, SOCK_SEQPACKET|SOCK_CLOEXEC, 0, rtnl_socket_pair) < 0)
4288 return log_error_errno(errno, "Failed to create rtnl socket pair: %m");
4289
4290 if (socketpair(AF_UNIX, SOCK_SEQPACKET|SOCK_CLOEXEC, 0, pid_socket_pair) < 0)
4291 return log_error_errno(errno, "Failed to create pid socket pair: %m");
4292
4293 if (socketpair(AF_UNIX, SOCK_SEQPACKET|SOCK_CLOEXEC, 0, uuid_socket_pair) < 0)
4294 return log_error_errno(errno, "Failed to create id socket pair: %m");
4295
4296 if (socketpair(AF_UNIX, SOCK_SEQPACKET|SOCK_CLOEXEC, 0, notify_socket_pair) < 0)
4297 return log_error_errno(errno, "Failed to create notify socket pair: %m");
4298
3acc84eb
FB		 4299 if (socketpair(AF_UNIX, SOCK_SEQPACKET|SOCK_CLOEXEC, 0, master_pty_socket_pair) < 0)
4300 return log_error_errno(errno, "Failed to create console socket pair: %m");
4301
b0067625
ZJS		 4302 if (arg_userns_mode != USER_NAMESPACE_NO)
4303 if (socketpair(AF_UNIX, SOCK_SEQPACKET|SOCK_CLOEXEC, 0, uid_shift_socket_pair) < 0)
4304 return log_error_errno(errno, "Failed to create uid shift socket pair: %m");
4305
8199d554
LP		 4306 if (arg_unified_cgroup_hierarchy == CGROUP_UNIFIED_UNKNOWN)
4307 if (socketpair(AF_UNIX, SOCK_SEQPACKET|SOCK_CLOEXEC, 0, unified_cgroup_hierarchy_socket_pair) < 0)
4308 return log_error_errno(errno, "Failed to create unified cgroup socket pair: %m");
4309
b0067625
ZJS		 4310 /* Child can be killed before execv(), so handle SIGCHLD in order to interrupt
4311 * parent's blocking calls and give it a chance to call wait() and terminate. */
4312 r = sigprocmask(SIG_UNBLOCK, &mask_chld, NULL);
4313 if (r < 0)
4314 return log_error_errno(errno, "Failed to change the signal mask: %m");
4315
4316 r = sigaction(SIGCHLD, &sa, NULL);
4317 if (r < 0)
4318 return log_error_errno(errno, "Failed to install SIGCHLD handler: %m");
4319
d7bea6b6 4320 if (arg_network_namespace_path) {
5b4855ab
DDM		 4321 child_netns_fd = open(arg_network_namespace_path, O_RDONLY|O_NOCTTY|O_CLOEXEC);
4322 if (child_netns_fd < 0)
d7bea6b6
DP		 4323 return log_error_errno(errno, "Cannot open file %s: %m", arg_network_namespace_path);
4324
5b4855ab 4325 r = fd_is_network_ns(child_netns_fd);
6619ad88
LP		 4326 if (r == -EUCLEAN)
4327 log_debug_errno(r, "Cannot determine if passed network namespace path '%s' really refers to a network namespace, assuming it does.", arg_network_namespace_path);
4328 else if (r < 0)
d7bea6b6 4329 return log_error_errno(r, "Failed to check %s fs type: %m", arg_network_namespace_path);
c6147113
LP		 4330 else if (r == 0)
4331 return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
4332 "Path %s doesn't refer to a network namespace, refusing.", arg_network_namespace_path);
d7bea6b6
DP		 4333 }
4334
b0067625
ZJS		 4335 *pid = raw_clone(SIGCHLD|CLONE_NEWNS);
4336 if (*pid < 0)
4337 return log_error_errno(errno, "clone() failed%s: %m",
4338 errno == EINVAL ?
4339 ", do you have namespace support enabled in your kernel? (You need UTS, IPC, PID and NET namespacing built in)" : "");
4340
4341 if (*pid == 0) {
4342 /* The outer child only has a file system namespace. */
4343 barrier_set_role(&barrier, BARRIER_CHILD);
4344
b0067625
ZJS		 4345 kmsg_socket_pair[0] = safe_close(kmsg_socket_pair[0]);
4346 rtnl_socket_pair[0] = safe_close(rtnl_socket_pair[0]);
4347 pid_socket_pair[0] = safe_close(pid_socket_pair[0]);
4348 uuid_socket_pair[0] = safe_close(uuid_socket_pair[0]);
4349 notify_socket_pair[0] = safe_close(notify_socket_pair[0]);
3acc84eb 4350 master_pty_socket_pair[0] = safe_close(master_pty_socket_pair[0]);
b0067625 4351 uid_shift_socket_pair[0] = safe_close(uid_shift_socket_pair[0]);
8199d554 4352 unified_cgroup_hierarchy_socket_pair[0] = safe_close(unified_cgroup_hierarchy_socket_pair[0]);
b0067625
ZJS		 4353
4354 (void) reset_all_signal_handlers();
4355 (void) reset_signal_mask();
4356
4357 r = outer_child(&barrier,
4358 arg_directory,
2d845785 4359 dissected_image,
b0067625
ZJS		 4360 secondary,
4361 pid_socket_pair[1],
4362 uuid_socket_pair[1],
4363 notify_socket_pair[1],
4364 kmsg_socket_pair[1],
4365 rtnl_socket_pair[1],
4366 uid_shift_socket_pair[1],
3acc84eb 4367 master_pty_socket_pair[1],
8199d554 4368 unified_cgroup_hierarchy_socket_pair[1],
d7bea6b6 4369 fds,
5b4855ab 4370 child_netns_fd);
b0067625
ZJS		 4371 if (r < 0)
4372 _exit(EXIT_FAILURE);
4373
4374 _exit(EXIT_SUCCESS);
4375 }
4376
4377 barrier_set_role(&barrier, BARRIER_PARENT);
4378
e4077ff6 4379 fdset_close(fds);
b0067625
ZJS		 4380
4381 kmsg_socket_pair[1] = safe_close(kmsg_socket_pair[1]);
4382 rtnl_socket_pair[1] = safe_close(rtnl_socket_pair[1]);
4383 pid_socket_pair[1] = safe_close(pid_socket_pair[1]);
4384 uuid_socket_pair[1] = safe_close(uuid_socket_pair[1]);
4385 notify_socket_pair[1] = safe_close(notify_socket_pair[1]);
3acc84eb 4386 master_pty_socket_pair[1] = safe_close(master_pty_socket_pair[1]);
b0067625 4387 uid_shift_socket_pair[1] = safe_close(uid_shift_socket_pair[1]);
8199d554 4388 unified_cgroup_hierarchy_socket_pair[1] = safe_close(unified_cgroup_hierarchy_socket_pair[1]);
b0067625
ZJS		 4389
4390 if (arg_userns_mode != USER_NAMESPACE_NO) {
4391 /* The child just let us know the UID shift it might have read from the image. */
4392 l = recv(uid_shift_socket_pair[0], &arg_uid_shift, sizeof arg_uid_shift, 0);
4393 if (l < 0)
4394 return log_error_errno(errno, "Failed to read UID shift: %m");
c6147113
LP		 4395 if (l != sizeof arg_uid_shift)
4396 return log_error_errno(SYNTHETIC_ERRNO(EIO), "Short read while reading UID shift.");
b0067625
ZJS		 4397
4398 if (arg_userns_mode == USER_NAMESPACE_PICK) {
4399 /* If we are supposed to pick the UID shift, let's try to use the shift read from the
4400 * image, but if that's already in use, pick a new one, and report back to the child,
4401 * which one we now picked. */
4402
4403 r = uid_shift_pick(&arg_uid_shift, &uid_shift_lock);
4404 if (r < 0)
4405 return log_error_errno(r, "Failed to pick suitable UID/GID range: %m");
4406
4407 l = send(uid_shift_socket_pair[0], &arg_uid_shift, sizeof arg_uid_shift, MSG_NOSIGNAL);
4408 if (l < 0)
4409 return log_error_errno(errno, "Failed to send UID shift: %m");
c6147113
LP		 4410 if (l != sizeof arg_uid_shift)
4411 return log_error_errno(SYNTHETIC_ERRNO(EIO), "Short write while writing UID shift.");
b0067625
ZJS		 4412 }
4413 }
4414
8199d554
LP		 4415 if (arg_unified_cgroup_hierarchy == CGROUP_UNIFIED_UNKNOWN) {
4416 /* The child let us know the support cgroup mode it might have read from the image. */
4417 l = recv(unified_cgroup_hierarchy_socket_pair[0], &arg_unified_cgroup_hierarchy, sizeof(arg_unified_cgroup_hierarchy), 0);
4418 if (l < 0)
4419 return log_error_errno(errno, "Failed to read cgroup mode: %m");
c6147113
LP		 4420 if (l != sizeof(arg_unified_cgroup_hierarchy))
4421 return log_error_errno(SYNTHETIC_ERRNO(EIO), "Short read while reading cgroup mode (%zu bytes).%s",
4422 l, l == 0 ? " The child is most likely dead." : "");
8199d554
LP		 4423 }
4424
b0067625 4425 /* Wait for the outer child. */
d2e0ac3d
LP		 4426 r = wait_for_terminate_and_check("(sd-namespace)", *pid, WAIT_LOG_ABNORMAL);
4427 if (r < 0)
4428 return r;
4429 if (r != EXIT_SUCCESS)
4430 return -EIO;
b0067625
ZJS		 4431
4432 /* And now retrieve the PID of the inner child. */
4433 l = recv(pid_socket_pair[0], pid, sizeof *pid, 0);
4434 if (l < 0)
4435 return log_error_errno(errno, "Failed to read inner child PID: %m");
c6147113
LP		 4436 if (l != sizeof *pid)
4437 return log_error_errno(SYNTHETIC_ERRNO(EIO), "Short read while reading inner child PID.");
b0067625
ZJS		 4438
4439 /* We also retrieve container UUID in case it was generated by outer child */
4440 l = recv(uuid_socket_pair[0], &arg_uuid, sizeof arg_uuid, 0);
4441 if (l < 0)
4442 return log_error_errno(errno, "Failed to read container machine ID: %m");
c6147113
LP		 4443 if (l != sizeof(arg_uuid))
4444 return log_error_errno(SYNTHETIC_ERRNO(EIO), "Short read while reading container machined ID.");
b0067625
ZJS		 4445
4446 /* We also retrieve the socket used for notifications generated by outer child */
4447 notify_socket = receive_one_fd(notify_socket_pair[0], 0);
4448 if (notify_socket < 0)
4449 return log_error_errno(notify_socket,
4450 "Failed to receive notification socket from the outer child: %m");
4451
4452 log_debug("Init process invoked as PID "PID_FMT, *pid);
4453
4454 if (arg_userns_mode != USER_NAMESPACE_NO) {
c6147113
LP		 4455 if (!barrier_place_and_sync(&barrier)) /* #1 */
4456 return log_error_errno(SYNTHETIC_ERRNO(ESRCH), "Child died too early.");
b0067625
ZJS		 4457
4458 r = setup_uid_map(*pid);
4459 if (r < 0)
4460 return r;
4461
4462 (void) barrier_place(&barrier); /* #2 */
4463 }
4464
4465 if (arg_private_network) {
75116558
PS		 4466 if (!arg_network_namespace_path) {
4467 /* Wait until the child has unshared its network namespace. */
c6147113
LP		 4468 if (!barrier_place_and_sync(&barrier)) /* #3 */
4469 return log_error_errno(SYNTHETIC_ERRNO(ESRCH), "Child died too early");
75116558
PS		 4470 }
4471
5b4855ab
DDM		 4472 if (child_netns_fd < 0) {
4473 /* Make sure we have an open file descriptor to the child's network
4474 * namespace so it stays alive even if the child exits. */
4475 r = namespace_open(*pid, NULL, NULL, &child_netns_fd, NULL, NULL);
4476 if (r < 0)
4477 return log_error_errno(r, "Failed to open child network namespace: %m");
4478 }
4479
4480 r = move_network_interfaces(child_netns_fd, arg_network_interfaces);
b0067625
ZJS		 4481 if (r < 0)
4482 return r;
4483
4484 if (arg_network_veth) {
4485 r = setup_veth(arg_machine, *pid, veth_name,
4486 arg_network_bridge || arg_network_zone);
4487 if (r < 0)
4488 return r;
4489 else if (r > 0)
4490 ifi = r;
4491
4492 if (arg_network_bridge) {
4493 /* Add the interface to a bridge */
4494 r = setup_bridge(veth_name, arg_network_bridge, false);
4495 if (r < 0)
4496 return r;
4497 if (r > 0)
4498 ifi = r;
4499 } else if (arg_network_zone) {
4500 /* Add the interface to a bridge, possibly creating it */
4501 r = setup_bridge(veth_name, arg_network_zone, true);
4502 if (r < 0)
4503 return r;
4504 if (r > 0)
4505 ifi = r;
4506 }
4507 }
4508
4509 r = setup_veth_extra(arg_machine, *pid, arg_network_veth_extra);
4510 if (r < 0)
4511 return r;
4512
4513 /* We created the primary and extra veth links now; let's remember this, so that we know to
4514 remove them later on. Note that we don't bother with removing veth links that were created
4515 here when their setup failed half-way, because in that case the kernel should be able to
4516 remove them on its own, since they cannot be referenced by anything yet. */
4517 *veth_created = true;
4518
4519 r = setup_macvlan(arg_machine, *pid, arg_network_macvlan);
4520 if (r < 0)
4521 return r;
4522
4523 r = setup_ipvlan(arg_machine, *pid, arg_network_ipvlan);
4524 if (r < 0)
4525 return r;
4526 }
4527
abdb9b08
LP		 4528 if (arg_register || !arg_keep_unit) {
4529 r = sd_bus_default_system(&bus);
4530 if (r < 0)
4531 return log_error_errno(r, "Failed to open system bus: %m");
e5a2d8b5
LP		 4532
4533 r = sd_bus_set_close_on_exit(bus, false);
4534 if (r < 0)
4535 return log_error_errno(r, "Failed to disable close-on-exit behaviour: %m");
abdb9b08
LP		 4536 }
4537
4538 if (!arg_keep_unit) {
4539 /* When a new scope is created for this container, then we'll be registered as its controller, in which
4540 * case PID 1 will send us a friendly RequestStop signal, when it is asked to terminate the
4541 * scope. Let's hook into that, and cleanly shut down the container, and print a friendly message. */
4542
75152a4d
LP		 4543 r = sd_bus_match_signal_async(
4544 bus,
4545 NULL,
4546 "org.freedesktop.systemd1",
4547 NULL,
4548 "org.freedesktop.systemd1.Scope",
4549 "RequestStop",
4550 on_request_stop, NULL, PID_TO_PTR(*pid));
abdb9b08 4551 if (r < 0)
75152a4d 4552 return log_error_errno(r, "Failed to request RequestStop match: %m");
abdb9b08
LP		 4553 }
4554
b0067625
ZJS		 4555 if (arg_register) {
4556 r = register_machine(
abdb9b08 4557 bus,
b0067625
ZJS		 4558 arg_machine,
4559 *pid,
4560 arg_directory,
4561 arg_uuid,
4562 ifi,
4563 arg_slice,
4564 arg_custom_mounts, arg_n_custom_mounts,
4565 arg_kill_signal,
4566 arg_property,
de40a303 4567 arg_property_message,
b0067625
ZJS		 4568 arg_keep_unit,
4569 arg_container_service_name);
4570 if (r < 0)
4571 return r;
abdb9b08 4572
cd2dfc6f
LP		 4573 } else if (!arg_keep_unit) {
4574 r = allocate_scope(
abdb9b08 4575 bus,
cd2dfc6f
LP		 4576 arg_machine,
4577 *pid,
4578 arg_slice,
4579 arg_custom_mounts, arg_n_custom_mounts,
4580 arg_kill_signal,
de40a303
LP		 4581 arg_property,
4582 arg_property_message);
cd2dfc6f
LP		 4583 if (r < 0)
4584 return r;
4585
4586 } else if (arg_slice || arg_property)
4587 log_notice("Machine and scope registration turned off, --slice= and --property= settings will have no effect.");
b0067625 4588
27da7ef0 4589 r = create_subcgroup(*pid, arg_keep_unit, arg_unified_cgroup_hierarchy);
b0067625
ZJS		 4590 if (r < 0)
4591 return r;
4592
27da7ef0 4593 r = sync_cgroup(*pid, arg_unified_cgroup_hierarchy, arg_uid_shift);
720f0a2f
LP		 4594 if (r < 0)
4595 return r;
b0067625 4596
de54e02d 4597 r = chown_cgroup(*pid, arg_unified_cgroup_hierarchy, arg_uid_shift);
b0067625
ZJS		 4598 if (r < 0)
4599 return r;
4600
4601 /* Notify the child that the parent is ready with all
4602 * its setup (including cgroup-ification), and that
4603 * the child can now hand over control to the code to
4604 * run inside the container. */
75116558 4605 (void) barrier_place(&barrier); /* #4 */
b0067625
ZJS		 4606
4607 /* Block SIGCHLD here, before notifying child.
4608 * process_pty() will handle it with the other signals. */
4609 assert_se(sigprocmask(SIG_BLOCK, &mask_chld, NULL) >= 0);
4610
4611 /* Reset signal to default */
4612 r = default_signals(SIGCHLD, -1);
4613 if (r < 0)
4614 return log_error_errno(r, "Failed to reset SIGCHLD: %m");
4615
4616 r = sd_event_new(&event);
4617 if (r < 0)
4618 return log_error_errno(r, "Failed to get default event source: %m");
4619
8fd010bb
LP		 4620 (void) sd_event_set_watchdog(event, true);
4621
abdb9b08
LP		 4622 if (bus) {
4623 r = sd_bus_attach_event(bus, event, 0);
4624 if (r < 0)
4625 return log_error_errno(r, "Failed to attach bus to event loop: %m");
4626 }
4627
e96ceaba 4628 r = setup_notify_parent(event, notify_socket, PID_TO_PTR(*pid), &notify_event_source);
b0067625
ZJS		 4629 if (r < 0)
4630 return r;
4631
4632 /* Let the child know that we are ready and wait that the child is completely ready now. */
c6147113
LP		 4633 if (!barrier_place_and_sync(&barrier)) /* #5 */
4634 return log_error_errno(SYNTHETIC_ERRNO(ESRCH), "Child died too early.");
b0067625 4635
38ccb557 4636 /* At this point we have made use of the UID we picked, and thus nss-systemd/systemd-machined.service
b0067625
ZJS		 4637 * will make them appear in getpwuid(), thus we can release the /etc/passwd lock. */
4638 etc_passwd_lock = safe_close(etc_passwd_lock);
4639
04f590a4
LP		 4640 (void) sd_notifyf(false,
4641 "STATUS=Container running.\n"
4642 "X_NSPAWN_LEADER_PID=" PID_FMT, *pid);
b0067625 4643 if (!arg_notify_ready)
919f5ae0 4644 (void) sd_notify(false, "READY=1\n");
b0067625
ZJS		 4645
4646 if (arg_kill_signal > 0) {
4647 /* Try to kill the init system on SIGINT or SIGTERM */
919f5ae0
LP		 4648 (void) sd_event_add_signal(event, NULL, SIGINT, on_orderly_shutdown, PID_TO_PTR(*pid));
4649 (void) sd_event_add_signal(event, NULL, SIGTERM, on_orderly_shutdown, PID_TO_PTR(*pid));
b0067625
ZJS		 4650 } else {
4651 /* Immediately exit */
919f5ae0
LP		 4652 (void) sd_event_add_signal(event, NULL, SIGINT, NULL, NULL);
4653 (void) sd_event_add_signal(event, NULL, SIGTERM, NULL, NULL);
b0067625
ZJS		 4654 }
4655
6916b164 4656 /* Exit when the child exits */
919f5ae0 4657 (void) sd_event_add_signal(event, NULL, SIGCHLD, on_sigchld, PID_TO_PTR(*pid));
b0067625
ZJS		 4658
4659 if (arg_expose_ports) {
4660 r = expose_port_watch_rtnl(event, rtnl_socket_pair[0], on_address_change, exposed, &rtnl);
4661 if (r < 0)
4662 return r;
4663
4664 (void) expose_port_execute(rtnl, arg_expose_ports, exposed);
4665 }
4666
4667 rtnl_socket_pair[0] = safe_close(rtnl_socket_pair[0]);
4668
3acc84eb
FB		 4669 if (arg_console_mode != CONSOLE_PIPE) {
4670 _cleanup_close_ int fd = -1;
4671 PTYForwardFlags flags = 0;
de40a303 4672
3acc84eb
FB		 4673 /* Retrieve the master pty allocated by inner child */
4674 fd = receive_one_fd(master_pty_socket_pair[0], 0);
4675 if (fd < 0)
4676 return log_error_errno(fd, "Failed to receive master pty from the inner child: %m");
4677
4678 switch (arg_console_mode) {
de40a303 4679
3acc84eb
FB		 4680 case CONSOLE_READ_ONLY:
4681 flags |= PTY_FORWARD_READ_ONLY;
4682
4683 _fallthrough_;
4684
4685 case CONSOLE_INTERACTIVE:
4686 flags |= PTY_FORWARD_IGNORE_VHANGUP;
4687
4688 r = pty_forward_new(event, fd, flags, &forward);
4689 if (r < 0)
4690 return log_error_errno(r, "Failed to create PTY forwarder: %m");
4691
4692 if (arg_console_width != (unsigned) -1 || arg_console_height != (unsigned) -1)
4693 (void) pty_forward_set_width_height(forward,
4694 arg_console_width,
4695 arg_console_height);
4696 break;
4697
4698 default:
4699 assert(arg_console_mode == CONSOLE_PASSIVE);
4700 }
4701
4702 *master = TAKE_FD(fd);
de40a303 4703 }
b0067625
ZJS		 4704
4705 r = sd_event_loop(event);
4706 if (r < 0)
4707 return log_error_errno(r, "Failed to run event loop: %m");
4708
de40a303
LP		 4709 if (forward) {
4710 char last_char = 0;
b0067625 4711
de40a303
LP		 4712 (void) pty_forward_get_last_char(forward, &last_char);
4713 forward = pty_forward_free(forward);
b0067625 4714
de40a303
LP		 4715 if (!arg_quiet && last_char != '\n')
4716 putc('\n', stdout);
4717 }
b0067625
ZJS		 4718
4719 /* Kill if it is not dead yet anyway */
0bb0a9fa
ZJS		 4720 if (!arg_register && !arg_keep_unit && bus)
4721 terminate_scope(bus, arg_machine);
b0067625
ZJS		 4722
4723 /* Normally redundant, but better safe than sorry */
c67b0082 4724 (void) kill(*pid, SIGKILL);
b0067625 4725
5b4855ab
DDM		 4726 if (arg_private_network) {
4727 /* Move network interfaces back to the parent network namespace. We use `safe_fork`
4728 * to avoid having to move the parent to the child network namespace. */
4729 r = safe_fork(NULL, FORK_RESET_SIGNALS|FORK_DEATHSIG|FORK_WAIT|FORK_LOG, NULL);
4730 if (r < 0)
4731 return r;
4732
4733 if (r == 0) {
4734 _cleanup_close_ int parent_netns_fd = -1;
4735
4736 r = namespace_open(getpid(), NULL, NULL, &parent_netns_fd, NULL, NULL);
4737 if (r < 0) {
4738 log_error_errno(r, "Failed to open parent network namespace: %m");
4739 _exit(EXIT_FAILURE);
4740 }
4741
4742 r = namespace_enter(-1, -1, child_netns_fd, -1, -1);
4743 if (r < 0) {
4744 log_error_errno(r, "Failed to enter child network namespace: %m");
4745 _exit(EXIT_FAILURE);
4746 }
4747
4748 r = move_network_interfaces(parent_netns_fd, arg_network_interfaces);
4749 if (r < 0)
4750 log_error_errno(r, "Failed to move network interfaces back to parent network namespace: %m");
4751
4752 _exit(r < 0 ? EXIT_FAILURE : EXIT_SUCCESS);
4753 }
4754 }
4755
b0067625
ZJS		 4756 r = wait_for_container(*pid, &container_status);
4757 *pid = 0;
4758
0bb0a9fa
ZJS		 4759 /* Tell machined that we are gone. */
4760 if (bus)
4761 (void) unregister_machine(bus, arg_machine);
4762
b0067625
ZJS		 4763 if (r < 0)
4764 /* We failed to wait for the container, or the container exited abnormally. */
4765 return r;
4766 if (r > 0 || container_status == CONTAINER_TERMINATED) {
27e29a1e
ZJS		 4767 /* r > 0 → The container exited with a non-zero status.
4768 * As a special case, we need to replace 133 with a different value,
4769 * because 133 is special-cased in the service file to reboot the container.
4770 * otherwise → The container exited with zero status and a reboot was not requested.
4771 */
2a49b612 4772 if (r == EXIT_FORCE_RESTART)
27e29a1e 4773 r = EXIT_FAILURE; /* replace 133 with the general failure code */
b0067625 4774 *ret = r;
b0067625
ZJS		 4775 return 0; /* finito */
4776 }
4777
4778 /* CONTAINER_REBOOTED, loop again */
4779
4780 if (arg_keep_unit) {
4781 /* Special handling if we are running as a service: instead of simply
4782 * restarting the machine we want to restart the entire service, so let's
4783 * inform systemd about this with the special exit code 133. The service
4784 * file uses RestartForceExitStatus=133 so that this results in a full
4785 * nspawn restart. This is necessary since we might have cgroup parameters
4786 * set we want to have flushed out. */
2a49b612
ZJS		 4787 *ret = EXIT_FORCE_RESTART;
4788 return 0; /* finito */
b0067625
ZJS		 4789 }
4790
4791 expose_port_flush(arg_expose_ports, exposed);
4792
4793 (void) remove_veth_links(veth_name, arg_network_veth_extra);
4794 *veth_created = false;
4795 return 1; /* loop again */
4796}
4797
bf428efb 4798static int initialize_rlimits(void) {
bf428efb
LP		 4799 /* The default resource limits the kernel passes to PID 1, as per kernel 4.16. Let's pass our container payload
4800 * the same values as the kernel originally passed to PID 1, in order to minimize differences between host and
4801 * container execution environments. */
4802
4803 static const struct rlimit kernel_defaults[_RLIMIT_MAX] = {
4804 [RLIMIT_AS] = { RLIM_INFINITY, RLIM_INFINITY },
4805 [RLIMIT_CORE] = { 0, RLIM_INFINITY },
4806 [RLIMIT_CPU] = { RLIM_INFINITY, RLIM_INFINITY },
4807 [RLIMIT_DATA] = { RLIM_INFINITY, RLIM_INFINITY },
4808 [RLIMIT_FSIZE] = { RLIM_INFINITY, RLIM_INFINITY },
4809 [RLIMIT_LOCKS] = { RLIM_INFINITY, RLIM_INFINITY },
4810 [RLIMIT_MEMLOCK] = { 65536, 65536 },
4811 [RLIMIT_MSGQUEUE] = { 819200, 819200 },
4812 [RLIMIT_NICE] = { 0, 0 },
4813 [RLIMIT_NOFILE] = { 1024, 4096 },
4814 [RLIMIT_RSS] = { RLIM_INFINITY, RLIM_INFINITY },
4815 [RLIMIT_RTPRIO] = { 0, 0 },
4816 [RLIMIT_RTTIME] = { RLIM_INFINITY, RLIM_INFINITY },
4817 [RLIMIT_STACK] = { 8388608, RLIM_INFINITY },
4818
4819 /* The kernel scales the default for RLIMIT_NPROC and RLIMIT_SIGPENDING based on the system's amount of
4820 * RAM. To provide best compatibility we'll read these limits off PID 1 instead of hardcoding them
4821 * here. This is safe as we know that PID 1 doesn't change these two limits and thus the original
4822 * kernel's initialization should still be valid during runtime — at least if PID 1 is systemd. Note
4823 * that PID 1 changes a number of other resource limits during early initialization which is why we
4824 * don't read the other limits from PID 1 but prefer the static table above. */
4825 };
4826
4827 int rl;
4828
4829 for (rl = 0; rl < _RLIMIT_MAX; rl++) {
bf428efb
LP		 4830 /* Let's only fill in what the user hasn't explicitly configured anyway */
4831 if ((arg_settings_mask & (SETTING_RLIMIT_FIRST << rl)) == 0) {
4832 const struct rlimit *v;
4833 struct rlimit buffer;
4834
4835 if (IN_SET(rl, RLIMIT_NPROC, RLIMIT_SIGPENDING)) {
4836 /* For these two let's read the limits off PID 1. See above for an explanation. */
4837
4838 if (prlimit(1, rl, NULL, &buffer) < 0)
4839 return log_error_errno(errno, "Failed to read resource limit RLIMIT_%s of PID 1: %m", rlimit_to_string(rl));
4840
4841 v = &buffer;
4842 } else
4843 v = kernel_defaults + rl;
4844
4845 arg_rlimit[rl] = newdup(struct rlimit, v, 1);
4846 if (!arg_rlimit[rl])
4847 return log_oom();
4848 }
4849
4850 if (DEBUG_LOGGING) {
4851 _cleanup_free_ char *k = NULL;
4852
4853 (void) rlimit_format(arg_rlimit[rl], &k);
4854 log_debug("Setting RLIMIT_%s to %s.", rlimit_to_string(rl), k);
4855 }
4856 }
4857
4858 return 0;
4859}
4860
287b7376
LP		 4861static int cant_be_in_netns(void) {
4862 union sockaddr_union sa = {
4863 .un = {
4864 .sun_family = AF_UNIX,
4865 .sun_path = "/run/udev/control",
4866 },
4867 };
4868 char udev_path[STRLEN("/proc//ns/net") + DECIMAL_STR_MAX(pid_t)];
4869 _cleanup_free_ char *udev_ns = NULL, *our_ns = NULL;
4870 _cleanup_close_ int fd = -1;
4871 struct ucred ucred;
4872 int r;
4873
4874 /* Check if we are in the same netns as udev. If we aren't, then device monitoring (and thus waiting
4875 * for loopback block devices) won't work, and we will hang. Detect this case and exit early with a
4876 * nice message. */
4877
4878 if (!arg_image) /* only matters if --image= us used, i.e. we actually need to use loopback devices */
4879 return 0;
4880
4881 fd = socket(AF_UNIX, SOCK_SEQPACKET|SOCK_NONBLOCK|SOCK_CLOEXEC, 0);
4882 if (fd < 0)
4883 return log_error_errno(errno, "Failed to allocate udev control socket: %m");
4884
4885 if (connect(fd, &sa.un, SOCKADDR_UN_LEN(sa.un)) < 0) {
4886
4887 if (errno == ENOENT || ERRNO_IS_DISCONNECT(errno))
4888 return log_error_errno(SYNTHETIC_ERRNO(EOPNOTSUPP),
4889 "Sorry, but --image= requires access to the host's /run/ hierarchy, since we need access to udev.");
4890
4891 return log_error_errno(errno, "Failed to connect socket to udev control socket: %m");
4892 }
4893
4894 r = getpeercred(fd, &ucred);
4895 if (r < 0)
4896 return log_error_errno(r, "Failed to determine peer of udev control socket: %m");
4897
4898 xsprintf(udev_path, "/proc/" PID_FMT "/ns/net", ucred.pid);
4899 r = readlink_malloc(udev_path, &udev_ns);
4900 if (r < 0)
4901 return log_error_errno(r, "Failed to read network namespace of udev: %m");
4902
4903 r = readlink_malloc("/proc/self/ns/net", &our_ns);
4904 if (r < 0)
4905 return log_error_errno(r, "Failed to read our own network namespace: %m");
4906
4907 if (!streq(our_ns, udev_ns))
4908 return log_error_errno(SYNTHETIC_ERRNO(EOPNOTSUPP),
4909 "Sorry, but --image= is only supported in the main network namespace, since we need access to udev/AF_NETLINK.");
4910 return 0;
4911}
4912
44dbef90 4913static int run(int argc, char *argv[]) {
7bf011e3
LP		 4914 bool secondary = false, remove_directory = false, remove_image = false,
4915 veth_created = false, remove_tmprootdir = false;
2d845785 4916 _cleanup_close_ int master = -1;
03cfe0d5 4917 _cleanup_fdset_free_ FDSet *fds = NULL;
2d845785 4918 int r, n_fd_passed, ret = EXIT_SUCCESS;
5aa3eba5 4919 char veth_name[IFNAMSIZ] = "";
03cfe0d5 4920 union in_addr_union exposed = {};
8e766630 4921 _cleanup_(release_lock_file) LockFile tree_global_lock = LOCK_FILE_INIT, tree_local_lock = LOCK_FILE_INIT;
c67b0082 4922 char tmprootdir[] = "/tmp/nspawn-root-XXXXXX";
2d845785 4923 _cleanup_(loop_device_unrefp) LoopDevice *loop = NULL;
18b5886e
LP		 4924 _cleanup_(decrypted_image_unrefp) DecryptedImage *decrypted_image = NULL;
4925 _cleanup_(dissected_image_unrefp) DissectedImage *dissected_image = NULL;
7bf011e3 4926 pid_t pid = 0;
03cfe0d5
LP		 4927
4928 log_parse_environment();
4929 log_open();
415fc41c 4930
03cfe0d5
LP		 4931 r = parse_argv(argc, argv);
4932 if (r <= 0)
4933 goto finish;
4934
fba868fa
LP		 4935 r = must_be_root();
4936 if (r < 0)
03cfe0d5 4937 goto finish;
fba868fa 4938
287b7376
LP		 4939 r = cant_be_in_netns();
4940 if (r < 0)
4941 goto finish;
4942
bf428efb
LP		 4943 r = initialize_rlimits();
4944 if (r < 0)
4945 goto finish;
4946
de40a303
LP		 4947 r = load_oci_bundle();
4948 if (r < 0)
4949 goto finish;
4950
f757855e
LP		 4951 r = determine_names();
4952 if (r < 0)
4953 goto finish;
4954
4955 r = load_settings();
4956 if (r < 0)
4957 goto finish;
4958
d4d99bc6 4959 r = cg_unified();
5eee8290
LP		 4960 if (r < 0) {
4961 log_error_errno(r, "Failed to determine whether the unified cgroups hierarchy is used: %m");
4962 goto finish;
4963 }
4964
f757855e
LP		 4965 r = verify_arguments();
4966 if (r < 0)
4967 goto finish;
03cfe0d5 4968
49048684
ZJS		 4969 /* Reapply environment settings. */
4970 (void) detect_unified_cgroup_hierarchy_from_environment();
8199d554 4971
2949ff26
LP		 4972 /* Ignore SIGPIPE here, because we use splice() on the ptyfwd stuff and that will generate SIGPIPE if
4973 * the result is closed. Note that the container payload child will reset signal mask+handler anyway,
4974 * so just turning this off here means we only turn it off in nspawn itself, not any children. */
4975 (void) ignore_signals(SIGPIPE, -1);
4976
03cfe0d5
LP		 4977 n_fd_passed = sd_listen_fds(false);
4978 if (n_fd_passed > 0) {
4979 r = fdset_new_listen_fds(&fds, false);
4980 if (r < 0) {
4981 log_error_errno(r, "Failed to collect file descriptors: %m");
4982 goto finish;
4983 }
4984 }
4985
83e803a9
ZJS		 4986 /* The "default" umask. This is appropriate for most file and directory
4987 * operations performed by nspawn, and is the umask that will be used for
4988 * the child. Functions like copy_devnodes() change the umask temporarily. */
4989 umask(0022);
4990
03cfe0d5
LP		 4991 if (arg_directory) {
4992 assert(!arg_image);
4993
b35ca61a
LP		 4994 /* Safety precaution: let's not allow running images from the live host OS image, as long as
4995 * /var from the host will propagate into container dynamically (because bad things happen if
4996 * two systems write to the same /var). Let's allow it for the special cases where /var is
4997 * either copied (i.e. --ephemeral) or replaced (i.e. --volatile=yes|state). */
4998 if (path_equal(arg_directory, "/") && !(arg_ephemeral || IN_SET(arg_volatile_mode, VOLATILE_YES, VOLATILE_STATE))) {
4999 log_error("Spawning container on root directory is not supported. Consider using --ephemeral, --volatile=yes or --volatile=state.");
03cfe0d5
LP		 5000 r = -EINVAL;
5001 goto finish;
5002 }
5003
5004 if (arg_ephemeral) {
5005 _cleanup_free_ char *np = NULL;
5006
8d4aa2bb 5007 r = chase_symlinks_and_update(&arg_directory, 0);
3f342ec4
LP		 5008 if (r < 0)
5009 goto finish;
5010
7bf011e3
LP		 5011 /* If the specified path is a mount point we generate the new snapshot immediately
5012 * inside it under a random name. However if the specified is not a mount point we
5013 * create the new snapshot in the parent directory, just next to it. */
e1873695 5014 r = path_is_mount_point(arg_directory, NULL, 0);
03cfe0d5
LP		 5015 if (r < 0) {
5016 log_error_errno(r, "Failed to determine whether directory %s is mount point: %m", arg_directory);
5017 goto finish;
5018 }
5019 if (r > 0)
770b5ce4 5020 r = tempfn_random_child(arg_directory, "machine.", &np);
03cfe0d5 5021 else
770b5ce4 5022 r = tempfn_random(arg_directory, "machine.", &np);
03cfe0d5 5023 if (r < 0) {
0f3be6ca 5024 log_error_errno(r, "Failed to generate name for directory snapshot: %m");
03cfe0d5
LP		 5025 goto finish;
5026 }
5027
6992459c 5028 /* We take an exclusive lock on this image, since it's our private, ephemeral copy
162392b7 5029 * only owned by us and no one else. */
6992459c 5030 r = image_path_lock(np, LOCK_EX|LOCK_NB, &tree_global_lock, &tree_local_lock);
03cfe0d5
LP		 5031 if (r < 0) {
5032 log_error_errno(r, "Failed to lock %s: %m", np);
5033 goto finish;
5034 }
5035
7bf011e3
LP		 5036 {
5037 BLOCK_SIGNALS(SIGINT);
5038 r = btrfs_subvol_snapshot(arg_directory, np,
5039 (arg_read_only ? BTRFS_SNAPSHOT_READ_ONLY : 0) |
5040 BTRFS_SNAPSHOT_FALLBACK_COPY |
5041 BTRFS_SNAPSHOT_FALLBACK_DIRECTORY |
5042 BTRFS_SNAPSHOT_RECURSIVE |
5043 BTRFS_SNAPSHOT_QUOTA |
5044 BTRFS_SNAPSHOT_SIGINT);
5045 }
5046 if (r == -EINTR) {
5047 log_error_errno(r, "Interrupted while copying file system tree to %s, removed again.", np);
5048 goto finish;
5049 }
03cfe0d5
LP		 5050 if (r < 0) {
5051 log_error_errno(r, "Failed to create snapshot %s from %s: %m", np, arg_directory);
5052 goto finish;
ec16945e
LP		 5053 }
5054
1cc6c93a 5055 free_and_replace(arg_directory, np);
17cbb288 5056 remove_directory = true;
30535c16 5057 } else {
cb638b5e 5058 r = chase_symlinks_and_update(&arg_directory, arg_template ? CHASE_NONEXISTENT : 0);
8d4aa2bb
LP		 5059 if (r < 0)
5060 goto finish;
5061
30535c16
LP		 5062 r = image_path_lock(arg_directory, (arg_read_only ? LOCK_SH : LOCK_EX) | LOCK_NB, &tree_global_lock, &tree_local_lock);
5063 if (r == -EBUSY) {
5064 log_error_errno(r, "Directory tree %s is currently busy.", arg_directory);
5065 goto finish;
5066 }
5067 if (r < 0) {
5068 log_error_errno(r, "Failed to lock %s: %m", arg_directory);
476b8254 5069 goto finish;
30535c16
LP		 5070 }
5071
5072 if (arg_template) {
8d4aa2bb 5073 r = chase_symlinks_and_update(&arg_template, 0);
3f342ec4
LP		 5074 if (r < 0)
5075 goto finish;
5076
7bf011e3
LP		 5077 {
5078 BLOCK_SIGNALS(SIGINT);
5079 r = btrfs_subvol_snapshot(arg_template, arg_directory,
5080 (arg_read_only ? BTRFS_SNAPSHOT_READ_ONLY : 0) |
5081 BTRFS_SNAPSHOT_FALLBACK_COPY |
5082 BTRFS_SNAPSHOT_FALLBACK_DIRECTORY |
5083 BTRFS_SNAPSHOT_FALLBACK_IMMUTABLE |
5084 BTRFS_SNAPSHOT_RECURSIVE |
5085 BTRFS_SNAPSHOT_QUOTA |
5086 BTRFS_SNAPSHOT_SIGINT);
5087 }
ff6c6cc1
LP		 5088 if (r == -EEXIST)
5089 log_full(arg_quiet ? LOG_DEBUG : LOG_INFO,
5090 "Directory %s already exists, not populating from template %s.", arg_directory, arg_template);
7bf011e3
LP		 5091 else if (r == -EINTR) {
5092 log_error_errno(r, "Interrupted while copying file system tree to %s, removed again.", arg_directory);
5093 goto finish;
5094 } else if (r < 0) {
83521414 5095 log_error_errno(r, "Couldn't create snapshot %s from %s: %m", arg_directory, arg_template);
30535c16 5096 goto finish;
ff6c6cc1
LP		 5097 } else
5098 log_full(arg_quiet ? LOG_DEBUG : LOG_INFO,
5099 "Populated %s from template %s.", arg_directory, arg_template);
30535c16 5100 }
ec16945e
LP		 5101 }
5102
7732f92b 5103 if (arg_start_mode == START_BOOT) {
a5201ed6 5104 const char *p;
c9fe05e0 5105
a5201ed6
LP		 5106 if (arg_pivot_root_new)
5107 p = prefix_roota(arg_directory, arg_pivot_root_new);
5108 else
5109 p = arg_directory;
c9fe05e0
AR		 5110
5111 if (path_is_os_tree(p) <= 0) {
5112 log_error("Directory %s doesn't look like an OS root directory (os-release file is missing). Refusing.", p);
ec16945e 5113 r = -EINVAL;
1b9e5b12
LP		 5114 goto finish;
5115 }
5116 } else {
c9fe05e0
AR		 5117 const char *p, *q;
5118
a5201ed6
LP		 5119 if (arg_pivot_root_new)
5120 p = prefix_roota(arg_directory, arg_pivot_root_new);
5121 else
5122 p = arg_directory;
c9fe05e0
AR		 5123
5124 q = strjoina(p, "/usr/");
1b9e5b12 5125
c9fe05e0
AR		 5126 if (laccess(q, F_OK) < 0) {
5127 log_error("Directory %s doesn't look like it has an OS tree. Refusing.", p);
ec16945e 5128 r = -EINVAL;
1b9e5b12 5129 goto finish;
1b9e5b12
LP		 5130 }
5131 }
ec16945e 5132
6b9132a9 5133 } else {
e7cbe5cb 5134 DissectImageFlags dissect_image_flags = DISSECT_IMAGE_REQUIRE_ROOT | DISSECT_IMAGE_RELAX_VAR_CHECK;
ec16945e
LP		 5135 assert(arg_image);
5136 assert(!arg_template);
5137
8d4aa2bb 5138 r = chase_symlinks_and_update(&arg_image, 0);
3f342ec4
LP		 5139 if (r < 0)
5140 goto finish;
5141
0f3be6ca
LP		 5142 if (arg_ephemeral) {
5143 _cleanup_free_ char *np = NULL;
5144
5145 r = tempfn_random(arg_image, "machine.", &np);
5146 if (r < 0) {
5147 log_error_errno(r, "Failed to generate name for image snapshot: %m");
5148 goto finish;
5149 }
5150
6992459c
LP		 5151 /* Always take an exclusive lock on our own ephemeral copy. */
5152 r = image_path_lock(np, LOCK_EX|LOCK_NB, &tree_global_lock, &tree_local_lock);
0f3be6ca
LP		 5153 if (r < 0) {
5154 r = log_error_errno(r, "Failed to create image lock: %m");
5155 goto finish;
5156 }
5157
7bf011e3
LP		 5158 {
5159 BLOCK_SIGNALS(SIGINT);
5160 r = copy_file(arg_image, np, O_EXCL, arg_read_only ? 0400 : 0600, FS_NOCOW_FL, FS_NOCOW_FL, COPY_REFLINK|COPY_CRTIME|COPY_SIGINT);
5161 }
5162 if (r == -EINTR) {
5163 log_error_errno(r, "Interrupted while copying image file to %s, removed again.", np);
5164 goto finish;
5165 }
0f3be6ca
LP		 5166 if (r < 0) {
5167 r = log_error_errno(r, "Failed to copy image file: %m");
5168 goto finish;
5169 }
5170
1cc6c93a 5171 free_and_replace(arg_image, np);
0f3be6ca
LP		 5172 remove_image = true;
5173 } else {
5174 r = image_path_lock(arg_image, (arg_read_only ? LOCK_SH : LOCK_EX) | LOCK_NB, &tree_global_lock, &tree_local_lock);
5175 if (r == -EBUSY) {
5176 r = log_error_errno(r, "Disk image %s is currently busy.", arg_image);
5177 goto finish;
5178 }
5179 if (r < 0) {
5180 r = log_error_errno(r, "Failed to create image lock: %m");
5181 goto finish;
5182 }
4623e8e6 5183
0389f4fa 5184 r = verity_metadata_load(arg_image, NULL, arg_root_hash ? NULL : &arg_root_hash, &arg_root_hash_size,
c2923fdc
LB		 5185 arg_verity_data ? NULL : &arg_verity_data,
5186 arg_root_hash_sig_path || arg_root_hash_sig ? NULL : &arg_root_hash_sig_path);
e7cbe5cb
LB		 5187 if (r < 0) {
5188 log_error_errno(r, "Failed to read verity artefacts for %s: %m", arg_image);
5189 goto finish;
78ebe980 5190 }
e7cbe5cb 5191 dissect_image_flags |= arg_verity_data ? DISSECT_IMAGE_NO_PARTITION_TABLE : 0;
30535c16
LP		 5192 }
5193
c67b0082 5194 if (!mkdtemp(tmprootdir)) {
0f3be6ca 5195 r = log_error_errno(errno, "Failed to create temporary directory: %m");
6b9132a9 5196 goto finish;
1b9e5b12 5197 }
6b9132a9 5198
c67b0082
LP		 5199 remove_tmprootdir = true;
5200
5201 arg_directory = strdup(tmprootdir);
1b9e5b12
LP		 5202 if (!arg_directory) {
5203 r = log_oom();
5204 goto finish;
6b9132a9 5205 }
88213476 5206
e08f94ac 5207 r = loop_device_make_by_path(arg_image, arg_read_only ? O_RDONLY : O_RDWR, LO_FLAGS_PARTSCAN, &loop);
2d845785
LP		 5208 if (r < 0) {
5209 log_error_errno(r, "Failed to set up loopback block device: %m");
842f3b0f
LP		 5210 goto finish;
5211 }
1b9e5b12 5212
4526113f 5213 r = dissect_image_and_warn(
e0f9e7bd 5214 loop->fd,
4526113f 5215 arg_image,
e0f9e7bd 5216 arg_root_hash, arg_root_hash_size,
e7cbe5cb 5217 arg_verity_data,
18d73705 5218 NULL,
e7cbe5cb 5219 dissect_image_flags,
e0f9e7bd 5220 &dissected_image);
2d845785 5221 if (r == -ENOPKG) {
4526113f 5222 /* dissected_image_and_warn() already printed a brief error message. Extend on that with more details */
2d845785
LP		 5223 log_notice("Note that the disk image needs to\n"
5224 " a) either contain only a single MBR partition of type 0x83 that is marked bootable\n"
5225 " b) or contain a single GPT partition of type 0FC63DAF-8483-4772-8E79-3D69D8477DE4\n"
19ac32cd 5226 " c) or follow https://systemd.io/DISCOVERABLE_PARTITIONS\n"
2d845785
LP		 5227 " d) or contain a file system without a partition table\n"
5228 "in order to be bootable with systemd-nspawn.");
1b9e5b12 5229 goto finish;
2d845785 5230 }
4526113f 5231 if (r < 0)
842f3b0f 5232 goto finish;
1b9e5b12 5233
4623e8e6
LP		 5234 if (!arg_root_hash && dissected_image->can_verity)
5235 log_notice("Note: image %s contains verity information, but no root hash specified! Proceeding without integrity checking.", arg_image);
5236
c2923fdc 5237 r = dissected_image_decrypt_interactively(dissected_image, NULL, arg_root_hash, arg_root_hash_size, arg_verity_data, arg_root_hash_sig_path, arg_root_hash_sig, arg_root_hash_sig_size, 0, &decrypted_image);
1b9e5b12
LP		 5238 if (r < 0)
5239 goto finish;
0f3be6ca
LP		 5240
5241 /* Now that we mounted the image, let's try to remove it again, if it is ephemeral */
5242 if (remove_image && unlink(arg_image) >= 0)
5243 remove_image = false;
842f3b0f 5244 }
842f3b0f 5245
86c0dd4a 5246 r = custom_mount_prepare_all(arg_directory, arg_custom_mounts, arg_n_custom_mounts);
5a8af538
LP		 5247 if (r < 0)
5248 goto finish;
5249
de40a303
LP		 5250 if (arg_console_mode < 0)
5251 arg_console_mode =
5252 isatty(STDIN_FILENO) > 0 &&
5253 isatty(STDOUT_FILENO) > 0 ? CONSOLE_INTERACTIVE : CONSOLE_READ_ONLY;
9c857b9d 5254
de40a303
LP		 5255 if (arg_console_mode == CONSOLE_PIPE) /* if we pass STDERR on to the container, don't add our own logs into it too */
5256 arg_quiet = true;
a258bf26 5257
9c857b9d
LP		 5258 if (!arg_quiet)
5259 log_info("Spawning container %s on %s.\nPress ^] three times within 1s to kill container.",
5260 arg_machine, arg_image ?: arg_directory);
5261
72c0a2c2 5262 assert_se(sigprocmask_many(SIG_BLOCK, NULL, SIGCHLD, SIGWINCH, SIGTERM, SIGINT, -1) >= 0);
a258bf26 5263
66edd963 5264 if (prctl(PR_SET_CHILD_SUBREAPER, 1, 0, 0, 0) < 0) {
03cfe0d5
LP		 5265 r = log_error_errno(errno, "Failed to become subreaper: %m");
5266 goto finish;
5267 }
5268
d87be9b0 5269 for (;;) {
3acc84eb 5270 r = run_container(dissected_image,
44dbef90
LP		 5271 secondary,
5272 fds,
5273 veth_name, &veth_created,
3acc84eb 5274 &exposed, &master,
44dbef90 5275 &pid, &ret);
b0067625 5276 if (r <= 0)
d87be9b0 5277 break;
d87be9b0 5278 }
88213476
LP		 5279
5280finish:
04f590a4
LP		 5281 (void) sd_notify(false,
5282 r == 0 && ret == EXIT_FORCE_RESTART ? "STOPPING=1\nSTATUS=Restarting..." :
5283 "STOPPING=1\nSTATUS=Terminating...");
af4ec430 5284
9444b1f2 5285 if (pid > 0)
c67b0082 5286 (void) kill(pid, SIGKILL);
88213476 5287
503546da 5288 /* Try to flush whatever is still queued in the pty */
6a0f896b 5289 if (master >= 0) {
1c876927 5290 (void) copy_bytes(master, STDOUT_FILENO, (uint64_t) -1, 0);
6a0f896b
LP		 5291 master = safe_close(master);
5292 }
5293
5294 if (pid > 0)
5295 (void) wait_for_terminate(pid, NULL);
503546da 5296
50ebcf6c
LP		 5297 pager_close();
5298
17cbb288 5299 if (remove_directory && arg_directory) {
ec16945e
LP		 5300 int k;
5301
17cbb288 5302 k = rm_rf(arg_directory, REMOVE_ROOT|REMOVE_PHYSICAL|REMOVE_SUBVOLUME);
ec16945e 5303 if (k < 0)
17cbb288 5304 log_warning_errno(k, "Cannot remove '%s', ignoring: %m", arg_directory);
ec16945e
LP		 5305 }
5306
0f3be6ca
LP		 5307 if (remove_image && arg_image) {
5308 if (unlink(arg_image) < 0)
5309 log_warning_errno(errno, "Can't remove image file '%s', ignoring: %m", arg_image);
5310 }
5311
c67b0082
LP		 5312 if (remove_tmprootdir) {
5313 if (rmdir(tmprootdir) < 0)
5314 log_debug_errno(errno, "Can't remove temporary root directory '%s', ignoring: %m", tmprootdir);
5315 }
5316
785890ac
LP		 5317 if (arg_machine) {
5318 const char *p;
5319
63c372cb 5320 p = strjoina("/run/systemd/nspawn/propagate/", arg_machine);
c6878637 5321 (void) rm_rf(p, REMOVE_ROOT);
785890ac
LP		 5322 }
5323
7a8f6325 5324 expose_port_flush(arg_expose_ports, &exposed);
7513c5b8
LP		 5325
5326 if (veth_created)
5327 (void) remove_veth_links(veth_name, arg_network_veth_extra);
22b28dfd 5328 (void) remove_bridge(arg_network_zone);
f757855e 5329
f757855e
LP		 5330 custom_mount_free_all(arg_custom_mounts, arg_n_custom_mounts);
5331 expose_port_free_all(arg_expose_ports);
bf428efb 5332 rlimit_free_all(arg_rlimit);
b2645747 5333 device_node_array_free(arg_extra_nodes, arg_n_extra_nodes);
6d0b55c2 5334
44dbef90
LP		 5335 if (r < 0)
5336 return r;
5337
5338 return ret;
88213476 5339}
44dbef90
LP		 5340
5341DEFINE_MAIN_FUNCTION_WITH_POSITIVE_FAILURE(run);
Unnamed repository; edit this file 'description' to name the repository.